2 releases 11 tags

RSS feed

• v0.4.0 df41bc415f

  Compare

  v0.4.0 Stable

  mikluko released this 2026-10-26 21:32:24 +00:00 | 24 commits to main since this release

  Added

  • -leaf-key selects RSA or ECDSA P-256 keys for MITM certificates, and SelfSignedCA.KeyAlgorithm does the same in the library.
  • -leaf-validity and SelfSignedCA.Validity set how long MITM certificates stay valid.
  • -ca-cert and -ca-key read the CA from PEM files, and create both when neither exists.
  • -ca-name and -ca-org set the subject of a generated CA.
  • -print-ca prints the CA certificate as PEM and exits.
  • issuer.RootTemplate, issuer.NewRoot, issuer.LoadOrCreate and issuer.WriteFiles create, read and write a CA.
  • -set-header and -del-header set and strip headers on plain-HTTP and MITM requests to matching hosts.
  • The headers middleware package rewrites request headers per host pattern.
  • router.MatchHost matches a hostname against a host pattern.
  • -socks opens a SOCKS5 listener routed by the same -mitm and -tunnel rules as CONNECT requests.
  • The socks5 package serves SOCKS5 connections as CONNECT requests to an http.Handler.
  • Traces, metrics and logs are exported through the OpenTelemetry SDK, configured by the standard OTEL_* environment variables and exporting over OTLP to localhost by default.
  • Log records written while a request is traced carry trace_id and span_id, and log.TraceHandler adds them to any slog.Handler.
  • The command stops on SIGINT and SIGTERM, flushing telemetry before it exits.

  Changed

  • Breaking: the module path is sarak.sh/mikluko/multiproxy; imports of github.com/akabos/multiproxy change to it.
  • Breaking: building requires Go 1.26 or later.
  • Breaking: router.Router answers a plain-HTTP request with 403 unless a host pattern matches its host or Connect is set, so -mitm and -tunnel restrict plain HTTP as well as CONNECT.
  • Breaking: the log middleware package is built on log/slog: log.Middleware takes an access and a server *slog.Logger, and the helpers take slog key-value arguments instead of zap.Field.
  • Logs are written by log/slog: JSON records carry time instead of ts, and server records carry upper-case levels.
  • With telemetry enabled, an upstream request carries the proxy's span in its traceparent header in place of the client's.

  Removed

  • The Docker image is no longer published.
  • Breaking: log.DefaultAccessLogEncoderConfig, log.DefaultServerLogEncoderConfig and log.Fatal; the zap dependency is gone.

  Fixed

  • MITM certificates name the requested hostname as a subject alternative name, so Go clients accept them.
  • MITM certificate keys honour SelfSignedCA.BitSize, which defaults to 2048 bits instead of 1024.
  • MITM certificates are valid for 30 days by default instead of 10 years, and are issued again once expired.
  • MITM certificates carry random serial numbers instead of all sharing serial 1.
  • A generated CA is signed with SHA-256 instead of SHA-1, and carries a random serial number.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads