RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

[SCOTT FIELDS]

Not sure what source you're using, but most HTTP transport mechanisms natively support a socks tunnel option.
________________________________
From: openssh-unix-dev <openssh-unix-dev-bounces+scott.fields=kyndryl.com at mindrot.org> on behalf of Damien Miller <djm at mindrot.org>
Sent: Wednesday, September 23, 2026 7:34 AM
To: hsq <nahuat at 163.com>
Cc: openssh-unix-dev at mindrot.org <openssh-unix-dev at mindrot.org>
Subject: [EXTERNAL] Re: RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

On Wed, 23 Sep 2026, hsq wrote:

> Hello OpenSSH developers,
>
> I would like to discuss a possible enhancement for ssh dynamic
> forwarding (-D).
>
> Currently, dynamic forwarding provides a SOCKS proxy interface.
> Applications connecting to the local forwarding port must speak
> SOCKS4/SOCKS5.
>
> The proposal is to allow the dynamic forwarding listener to also
> accept HTTP CONNECT proxy requests, with automatic protocol detection.

I'd rather not do this - the dynamic forwarding state machine is
complicated enough and adding parsing for a textual protocol would
just make it worse.

IMO a better approach is to write a CONNECT->SOCKS shim that can
accept HTTP CONNECT requests and translate them to SOCKS requests.

Please try https://urldefense.com/v3/__https://github.com/djmdjm/connect-to-socks__;!!Dq81_Y1A2Q!3W-dBqBv6QM0VZ-UjRZqogc59QwiMFh6dWkDKiuBfpZRIcjr6816cnsIQ0rdbdcD36YM6n9cumhM8wTd$  as a basic
example.

-d
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev at mindrot.org
https://urldefense.com/v3/__https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev__;!!Dq81_Y1A2Q!3W-dBqBv6QM0VZ-UjRZqogc59QwiMFh6dWkDKiuBfpZRIcjr6816cnsIQ0rdbdcD36YM6n9cuhaMnbmy$