2 releases 11 tags

RSS feed

• v0.5.0 17ffdb3b2d

  Compare

  v0.5.0 Stable

  mikluko released this 2026-10-26 23:04:14 +00:00 | 0 commits to main since this release

  Added

  • headers.Rule.SetFunc computes headers per request; an error answers the request with 502 Bad Gateway instead of forwarding it.
  • handlers.ConnectAcceptor lets a ResponseWriter answer an accepted CONNECT in its own protocol; Tunnel and MITMHandler use it where present, behind Unwrap too.
  • issuer.Cache keeps the certificates another Issuer issues, per common name, and issues again past NotAfter.
  • The proxy package assembles a complete proxy from host patterns, an Issuer, middleware and loggers with proxy.New.
  • router.Router.HandleConnectHost takes * as the fallback for hosts no other pattern matches.
  • -upstream-ca trusts a private CA for intercepted upstreams, and -upstream-insecure accepts any upstream certificate.
  • proxy.Config.Transport sets the transport for upstream requests.

  Changed

  • Breaking: socks5.Server no longer offers Hijack on its ResponseWriter; a handler accepts the connection with AcceptConnect instead of hijacking it and writing 200 OK.
  • Breaking: MITMHandler.CertCacheSize is removed and MITMHandler keeps no certificates itself; an Issuer you set is called on every CONNECT unless you wrap it in issuer.Cache.
  • Breaking: intercepted upstreams must present a certificate that verifies against the system roots, or 502 Bad Gateway is answered; handlers.DefaultTransport verifies. Add -upstream-ca for a private CA, or -upstream-insecure for the old behaviour.
  • Breaking: issuer names the proxy CA a CA instead of a root: NewRoot is NewCA, RootTemplate is CATemplate, SelfSignedCA.RootBitSize and RootTmpl are CABitSize and CATmpl, and DefaultIssuerRootBitSize and DefaultIssuerRootTmpl are DefaultIssuerCABitSize and DefaultIssuerCATmpl.
  • A proxy CA that multiproxy creates is named multiproxy CA, of organization multiproxy, instead of root.example.org of Multiproxy Root Org; a CA read from -ca-cert keeps its name.
  • The default templates carry no placeholder DNS name, OCSP server or issuer name on the proxy CA, and no country on leaf certificates.

  Fixed

  • Responses to intercepted requests stream to the client instead of reaching it only once complete.
  • Every request pipelined on an intercepted connection is answered, where requests after the first could be lost.
  • A client that starts its TLS handshake before reading the CONNECT response is intercepted instead of stalling.
  • A certificate that cannot be issued refuses the CONNECT request with 500, where the client was told the connection was established first.
  • Access records carry the status and byte count of every response, including errors multiproxy answers itself and refused CONNECT requests.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v0.4.0 df41bc415f

  Compare

  v0.4.0 Stable

  mikluko released this 2026-10-26 21:32:24 +00:00 | 24 commits to main since this release

  Added

  • -leaf-key selects RSA or ECDSA P-256 keys for MITM certificates, and SelfSignedCA.KeyAlgorithm does the same in the library.
  • -leaf-validity and SelfSignedCA.Validity set how long MITM certificates stay valid.
  • -ca-cert and -ca-key read the CA from PEM files, and create both when neither exists.
  • -ca-name and -ca-org set the subject of a generated CA.
  • -print-ca prints the CA certificate as PEM and exits.
  • issuer.RootTemplate, issuer.NewRoot, issuer.LoadOrCreate and issuer.WriteFiles create, read and write a CA.
  • -set-header and -del-header set and strip headers on plain-HTTP and MITM requests to matching hosts.
  • The headers middleware package rewrites request headers per host pattern.
  • router.MatchHost matches a hostname against a host pattern.
  • -socks opens a SOCKS5 listener routed by the same -mitm and -tunnel rules as CONNECT requests.
  • The socks5 package serves SOCKS5 connections as CONNECT requests to an http.Handler.
  • Traces, metrics and logs are exported through the OpenTelemetry SDK, configured by the standard OTEL_* environment variables and exporting over OTLP to localhost by default.
  • Log records written while a request is traced carry trace_id and span_id, and log.TraceHandler adds them to any slog.Handler.
  • The command stops on SIGINT and SIGTERM, flushing telemetry before it exits.

  Changed

  • Breaking: the module path is sarak.sh/mikluko/multiproxy; imports of github.com/akabos/multiproxy change to it.
  • Breaking: building requires Go 1.26 or later.
  • Breaking: router.Router answers a plain-HTTP request with 403 unless a host pattern matches its host or Connect is set, so -mitm and -tunnel restrict plain HTTP as well as CONNECT.
  • Breaking: the log middleware package is built on log/slog: log.Middleware takes an access and a server *slog.Logger, and the helpers take slog key-value arguments instead of zap.Field.
  • Logs are written by log/slog: JSON records carry time instead of ts, and server records carry upper-case levels.
  • With telemetry enabled, an upstream request carries the proxy's span in its traceparent header in place of the client's.

  Removed

  • The Docker image is no longer published.
  • Breaking: log.DefaultAccessLogEncoderConfig, log.DefaultServerLogEncoderConfig and log.Fatal; the zap dependency is gone.

  Fixed

  • MITM certificates name the requested hostname as a subject alternative name, so Go clients accept them.
  • MITM certificate keys honour SelfSignedCA.BitSize, which defaults to 2048 bits instead of 1024.
  • MITM certificates are valid for 30 days by default instead of 10 years, and are issued again once expired.
  • MITM certificates carry random serial numbers instead of all sharing serial 1.
  • A generated CA is signed with SHA-256 instead of SHA-1, and carries a random serial number.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads