[EXTERNAL] Re: RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

[Sands, Daniel N.]

It's not so much a question of being hard to parse, but of appropriateness.  SOCKS5 is a binary protocol.  HTTP is a text protocol.  Could the two be differentiated, possibly trivially?  Yeah.  But as someone in the HTTP world, I'm sure you would balk at the number of things these days that are now being done over HTTP rather than a more streamlined protocol, sometimes to get around security restrictions such as paranoid firewalls (which defeats the purpose of the paranoia), and sometimes just because HTTP seems to be the hammer that drives in all nails, screws, and bolts.

An HTTP proxy that connects to your SOCKS5 dynamic channel would be a fairly trivial ask.  Something like Claude could probably spit something out in short order.

-----Original Message-----
From: openssh-unix-dev <openssh-unix-dev-bounces+dnsands=sandia.gov at mindrot.org> On Behalf Of Demi Marie Obenour
Sent: Wednesday, September 23, 2026 8:58 PM
To: Damien Miller <djm at mindrot.org>; hsq <nahuat at 163.com>
Cc: openssh-unix-dev at mindrot.org
Subject: [EXTERNAL] Re: RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

On 9/23/26 08:34, Damien Miller wrote:
> On Wed, 23 Sep 2026, hsq wrote:
>
>> Hello OpenSSH developers,
>>
>> I would like to discuss a possible enhancement for ssh dynamic
>> forwarding (-D).
>>
>> Currently, dynamic forwarding provides a SOCKS proxy interface.
>> Applications connecting to the local forwarding port must speak
>> SOCKS4/SOCKS5.
>>
>> The proposal is to allow the dynamic forwarding listener to also
>> accept HTTP CONNECT proxy requests, with automatic protocol detection.
>
> I'd rather not do this - the dynamic forwarding state machine is
> complicated enough and adding parsing for a textual protocol would
> just make it worse.
>
> IMO a better approach is to write a CONNECT->SOCKS shim that can
> accept HTTP CONNECT requests and translate them to SOCKS requests.
>
> Please try
> https://github.com/djmdjm/connect-to-socks as a basic example.
Parsing HTTP CONNECT requests is not *that* hard, IMO.  That said, I've contributed patches to NGINX's HTTP parser, so I'm probably biased.

I'd be willing to review a parser that was submitted at least.
--
Sincerely,
Demi Marie Obenour (she/her/hers)