CONNECT-session seam: handlers.ConnectAcceptor #44

Merged

mikluko merged 1 commit from refactor/connect-seam into main

2026-10-26 22:05:25 +00:00

mikluko commented

2026-10-26 22:04:06 +00:00

Owner

Candidate 2 of the architecture review.

Tunnel and MITM announced an accepted CONNECT by writing HTTP/1.1 200 OK after hijacking, and the SOCKS5 server parsed that status line back to pick its reply. The seam is now explicit: a ResponseWriter implementing handlers.ConnectAcceptor answers in its own protocol, found directly or behind Unwrap, as http.ResponseController does. Hijack-and-200 remains the HTTP adapter. With two adapters, it is a real seam.

The SOCKS5 server implements AcceptConnect, so its status-line interception, statusOf and the ReadFrom workaround are deleted. Refusals still travel as HTTP status codes through WriteHeader.

Along the way:

the tunnel copies upstream bytes straight to the client connection, since through bufio.Writer.ReadFrom they stalled over any conn without ReadFrom, which the new pipe-based test exposed
MITM issues the certificate before accepting, so a failure refuses the CONNECT with 500 instead of after telling the client it is connected

Breaking for library users: socks5.Server's ResponseWriter no longer offers Hijack.

TestConnectAcceptor drives both handlers through an acceptor, directly and behind Unwrap. The command's SOCKS test runs through otelhttp's wrapper. The suite passes three times in a row under -race.

Candidate 2 of the architecture review. Tunnel and MITM announced an accepted `CONNECT` by writing `HTTP/1.1 200 OK` after hijacking, and the SOCKS5 server parsed that status line back to pick its reply. The seam is now explicit: a ResponseWriter implementing `handlers.ConnectAcceptor` answers in its own protocol, found directly or behind `Unwrap`, as `http.ResponseController` does. Hijack-and-200 remains the HTTP adapter. With two adapters, it is a real seam. The SOCKS5 server implements `AcceptConnect`, so its status-line interception, `statusOf` and the `ReadFrom` workaround are deleted. Refusals still travel as HTTP status codes through `WriteHeader`. Along the way: - the tunnel copies upstream bytes straight to the client connection, since through `bufio.Writer.ReadFrom` they stalled over any conn without `ReadFrom`, which the new pipe-based test exposed - MITM issues the certificate before accepting, so a failure refuses the `CONNECT` with 500 instead of after telling the client it is connected Breaking for library users: `socks5.Server`'s ResponseWriter no longer offers `Hijack`. `TestConnectAcceptor` drives both handlers through an acceptor, directly and behind `Unwrap`. The command's SOCKS test runs through otelhttp's wrapper. The suite passes three times in a row under `-race`.

mikluko added 1 commit

2026-10-26 22:04:06 +00:00

CONNECT-session seam: handlers.ConnectAcceptor

CI / changelog (pull_request) Successful in 6s

Details

CI / test (pull_request) Successful in 55s

Details

65586a8680

Tunnel and MITM announced an accepted CONNECT by writing HTTP/1.1 200 OK
after hijacking, and the SOCKS5 server parsed that status line back. A
ResponseWriter implementing ConnectAcceptor now answers in its own protocol;
HTTP CONNECT keeps hijack-and-200 as the other adapter. The SOCKS5 server
loses its status-line interception, statusOf and the ReadFrom workaround.

The tunnel copies upstream bytes straight to the client conn: through the
bufio.Writer they stalled over a conn without ReadFrom. MITM issues the
certificate before accepting, so a failure refuses the CONNECT.

mikluko merged commit 677294f569 into main

2026-10-26 22:05:25 +00:00

mikluko referenced this pull request from a commit

2026-10-26 22:05:25 +00:00

Merge pull request 'CONNECT-session seam: handlers.ConnectAcceptor' (#44) from refactor/connect-seam into main

mikluko deleted branch refactor/connect-seam

2026-10-26 22:05:25 +00:00