RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

[Demi Marie Obenour]

On 9/23/26 08:34, Damien Miller wrote:
> On Wed, 23 Sep 2026, hsq wrote:
> 
>> Hello OpenSSH developers,
>>
>> I would like to discuss a possible enhancement for ssh dynamic
>> forwarding (-D).
>>
>> Currently, dynamic forwarding provides a SOCKS proxy interface.
>> Applications connecting to the local forwarding port must speak
>> SOCKS4/SOCKS5.
>>
>> The proposal is to allow the dynamic forwarding listener to also
>> accept HTTP CONNECT proxy requests, with automatic protocol detection.
> 
> I'd rather not do this - the dynamic forwarding state machine is
> complicated enough and adding parsing for a textual protocol would
> just make it worse.
> 
> IMO a better approach is to write a CONNECT->SOCKS shim that can
> accept HTTP CONNECT requests and translate them to SOCKS requests.
> 
> Please try https://github.com/djmdjm/connect-to-socks as a basic
> example.
Parsing HTTP CONNECT requests is not *that* hard, IMO.  That said,
I've contributed patches to NGINX's HTTP parser, so I'm probably
biased.

I'd be willing to review a parser that was submitted at least.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20260923/cd80d489/attachment-0001.asc>