RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

[Damien Miller]

On Wed, 23 Sep 2026, hsq wrote:

> Hello OpenSSH developers,
> 
> I would like to discuss a possible enhancement for ssh dynamic
> forwarding (-D).
> 
> Currently, dynamic forwarding provides a SOCKS proxy interface.
> Applications connecting to the local forwarding port must speak
> SOCKS4/SOCKS5.
> 
> The proposal is to allow the dynamic forwarding listener to also
> accept HTTP CONNECT proxy requests, with automatic protocol detection.

I'd rather not do this - the dynamic forwarding state machine is
complicated enough and adding parsing for a textual protocol would
just make it worse.

IMO a better approach is to write a CONNECT->SOCKS shim that can
accept HTTP CONNECT requests and translate them to SOCKS requests.

Please try https://github.com/djmdjm/connect-to-socks as a basic
example.

-d