RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

[hsq]

Hello OpenSSH developers,


I would like to discuss a possible enhancement for ssh dynamic
forwarding (-D).


Currently, dynamic forwarding provides a SOCKS proxy interface.
Applications connecting to the local forwarding port must speak
SOCKS4/SOCKS5.


The proposal is to allow the dynamic forwarding listener to also
accept HTTP CONNECT proxy requests, with automatic protocol detection.


Example:


    ssh -D 1080 user at example.com


would accept both:


SOCKS5:


    client -> SOCKS5 -> ssh -D -> SSH channel -> target


and HTTP CONNECT:


    client -> CONNECT host:port HTTP/1.1 -> ssh -D -> SSH channel -> target




The protocol could be detected from the initial bytes received on the
dynamic forwarding socket:


- SOCKS4/SOCKS5: existing handling
- HTTP CONNECT: parse CONNECT request and establish the same
  direct-tcpip channel


The HTTP support would only need to implement the CONNECT method;
features such as HTTP proxy authentication, caching, or forwarding
headers would not be required.


The motivation is interoperability with applications that only support
HTTP proxies and cannot be configured to use SOCKS proxies. Currently,
users need to run an additional SOCKS-to-HTTP proxy adapter locally,
for example:


    ssh -D 1080 host
              |
              v
        HTTP/SOCKS adapter
              |
              v
          HTTP clients




I would like to know whether this functionality fits the design goals
of dynamic forwarding, or whether maintaining SOCKS-only support is
preferred.


Thanks.