diff options
| author | srdusr <[email protected]> | 2026-06-24 14:40:00 +0200 |
|---|---|---|
| committer | srdusr <[email protected]> | 2026-06-24 14:40:00 +0200 |
| commit | e01afcbf0de00af52fe90959ba77288679e3303d (patch) | |
| tree | 073ff1430af629e28556a6f651ee47f6989376da /cmd | |
| parent | 23c8ab359c2108654d57176e233d2c099b398f31 (diff) | |
| download | mitmux-e01afcbf0de00af52fe90959ba77288679e3303d.tar.gz mitmux-e01afcbf0de00af52fe90959ba77288679e3303d.zip | |
SOCKS5 upstream proxy chaining
Extends -upstream-proxy to accept a socks5://[user:pass@]host:port
prefix, using golang.org/x/net/proxy (already an indirect dependency
via http2, so no new module) rather than hand-rolling the client side
of RFC 1928/1929. parseSOCKS5 is the single place that decides which
kind of upstream a given UpstreamProxy string names; dialViaProxy
(CONNECT/TLS path) and dialUpstreamPlain (plain-HTTP path) both check
it first and fall through to the existing HTTP CONNECT behavior
otherwise. SOCKS5 needs no absolute-form request adjustment on the
plain-HTTP path the way HTTP-proxy chaining does, since it tunnels
straight to the target rather than expecting a proxy-aware request.
Tested against a real, minimal SOCKS5 server built for the test suite
(exercises dialSOCKS5's actual wire behavior, not a mock of the
client library), plus live against a real standalone SOCKS5 relay
process: both a plain HTTP and an HTTPS request through mitmux were
confirmed, via the relay's own log, to have actually traversed it.
Diffstat (limited to 'cmd')
| -rw-r--r-- | cmd/mitmuxd/main.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cmd/mitmuxd/main.go b/cmd/mitmuxd/main.go index 0114871..5fc937a 100644 --- a/cmd/mitmuxd/main.go +++ b/cmd/mitmuxd/main.go @@ -31,7 +31,7 @@ func main() { dbPath := flag.String("db", "", "path to history database (default: <ca-dir>/history.db)") socketPath := flag.String("socket", "", "control socket path (default: $XDG_RUNTIME_DIR/mitmux.sock, else <ca-dir>/mitmux.sock)") installCA := flag.Bool("install-ca", false, "generate the CA if needed, print OS-specific trust-store install steps, and exit (doesn't start the proxy)") - upstreamProxy := flag.String("upstream-proxy", "", "chain all outbound connections through this HTTP CONNECT proxy (host:port, optional http:// prefix) instead of dialing origins directly") + upstreamProxy := flag.String("upstream-proxy", "", "chain all outbound connections through this proxy instead of dialing origins directly - an HTTP CONNECT proxy (host:port, optional http:// prefix) or a SOCKS5 proxy (socks5://[user:pass@]host:port)") showVersion := flag.Bool("version", false, "print version and exit") flag.Parse() |