From e01afcbf0de00af52fe90959ba77288679e3303d Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Wed, 24 Jun 2026 14:40:00 +0200
Subject: SOCKS5 upstream proxy chaining

Extends -upstream-proxy to accept a socks5://[user:pass@]host:port
prefix, using golang.org/x/net/proxy (already an indirect dependency
via http2, so no new module) rather than hand-rolling the client side
of RFC 1928/1929. parseSOCKS5 is the single place that decides which
kind of upstream a given UpstreamProxy string names; dialViaProxy
(CONNECT/TLS path) and dialUpstreamPlain (plain-HTTP path) both check
it first and fall through to the existing HTTP CONNECT behavior
otherwise. SOCKS5 needs no absolute-form request adjustment on the
plain-HTTP path the way HTTP-proxy chaining does, since it tunnels
straight to the target rather than expecting a proxy-aware request.

Tested against a real, minimal SOCKS5 server built for the test suite
(exercises dialSOCKS5's actual wire behavior, not a mock of the
client library), plus live against a real standalone SOCKS5 relay
process: both a plain HTTP and an HTTPS request through mitmux were
confirmed, via the relay's own log, to have actually traversed it.
---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'README.md')

diff --git a/README.md b/README.md
index b1237f6..16a1880 100644
--- a/README.md
+++ b/README.md
@@ -204,7 +204,9 @@ another *intercepting* proxy needs that proxy's own CA trusted too -
 it terminates and re-signs the connection with its own CA, which
 mitmux's outbound TLS client has no reason to trust otherwise; you'll
 see a clear certificate-verification error in history rather than a
-silent failure. SOCKS5 upstreams aren't implemented.
+silent failure. `-upstream-proxy socks5://[user:pass@]host:port`
+chains through a SOCKS5 proxy instead - Tor, `ssh -D`, or any other
+SOCKS5 relay - with optional username/password auth.
 
 ## Usage
 
@@ -557,8 +559,6 @@ reasoning behind each:
 - `mitmuxd -install-ca` prints per-OS trust-store install steps; it
   never runs them for you (see Quick start above for why)
 - No WebSocket interception
-- Upstream proxy chaining (`-upstream-proxy`) is HTTP CONNECT only, no
-  SOCKS5
 - No active or passive vulnerability scanning, no plugin system - this
   is a manual-testing tool, not a scanner
 
-- 
cgit v1.2.3