RFC: Add HTTP CONNECT protocol support to dynamic forwarding (-D)

[hsq]

At 2026-09-24 10:58:19, "Demi Marie Obenour" <demiobenour at gmail.com> wrote:
>On 9/23/26 08:34, Damien Miller wrote:
>> On Wed, 23 Sep 2026, hsq wrote:
>> 
>>> Hello OpenSSH developers,
>>>
>>> I would like to discuss a possible enhancement for ssh dynamic
>>> forwarding (-D).
>>>
>>> Currently, dynamic forwarding provides a SOCKS proxy interface.
>>> Applications connecting to the local forwarding port must speak
>>> SOCKS4/SOCKS5.
>>>
>>> The proposal is to allow the dynamic forwarding listener to also
>>> accept HTTP CONNECT proxy requests, with automatic protocol detection.
>> 
>> I'd rather not do this - the dynamic forwarding state machine is
>> complicated enough and adding parsing for a textual protocol would
>> just make it worse.
>> 
>> IMO a better approach is to write a CONNECT->SOCKS shim that can
>> accept HTTP CONNECT requests and translate them to SOCKS requests.
>> 
>> Please try https://github.com/djmdjm/connect-to-socks as a basic
>> example.
>Parsing HTTP CONNECT requests is not *that* hard, IMO.  That said,
>I've contributed patches to NGINX's HTTP parser, so I'm probably
>biased.
>
>I'd be willing to review a parser that was submitted at least.
>-- 
>Sincerely,
>Demi Marie Obenour (she/her/hers)

Hi Damien, Demi, and all,

Thanks for the feedback.

I understand the preference for an external shim and the concern about adding complexity to the dynamic forwarding state machine. I've attached a patch exploring the separation between protocol parsing and forwarding that I mentioned earlier.

The patch moves the existing SOCKS4/4A and SOCKS5 handling out of channels.c into protocol adapters, alongside a minimal HTTP CONNECT adapter. They share an interface that returns the destination host and port and queues the protocol replies. The channel code remains responsible for establishing and forwarding the connection.

HTTP CONNECT support is limited to local dynamic forwarding (-D / DynamicForward). It accepts HTTP/1.0 and HTTP/1.1 CONNECT requests, limits request headers to 8 KiB, and sends the success response only after channel open confirmation. Remote dynamic forwarding remains SOCKS-only.

The patch includes manual updates and regression tests for fragmented requests, pipelined tunnel data, malformed input, and forwarding permissions. The forwarding regressions and unit tests in fast mode pass, as do the new parser and adapter tests under ASan/UBSan.

Demi, thanks for offering to review the parser. I'd appreciate any feedback on it, as well as whether this separation addresses the concerns about the forwarding code.

I understand that an external shim may still be the preferred approach.

Thanks,
hsq

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-HTTP-CONNECT-support-to-local-dynamic-forwarding.zip
Type: application/zip
Size: 15470 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20260929/73632a62/attachment-0001.zip>