2 releases 11 tags

RSS feed

• v0.5.0 17ffdb3b2d

  Compare

  v0.5.0 Stable

  mikluko released this 2026-10-26 23:04:14 +00:00 | 0 commits to main since this release

  Added

  • headers.Rule.SetFunc computes headers per request; an error answers the request with 502 Bad Gateway instead of forwarding it.
  • handlers.ConnectAcceptor lets a ResponseWriter answer an accepted CONNECT in its own protocol; Tunnel and MITMHandler use it where present, behind Unwrap too.
  • issuer.Cache keeps the certificates another Issuer issues, per common name, and issues again past NotAfter.
  • The proxy package assembles a complete proxy from host patterns, an Issuer, middleware and loggers with proxy.New.
  • router.Router.HandleConnectHost takes * as the fallback for hosts no other pattern matches.
  • -upstream-ca trusts a private CA for intercepted upstreams, and -upstream-insecure accepts any upstream certificate.
  • proxy.Config.Transport sets the transport for upstream requests.

  Changed

  • Breaking: socks5.Server no longer offers Hijack on its ResponseWriter; a handler accepts the connection with AcceptConnect instead of hijacking it and writing 200 OK.
  • Breaking: MITMHandler.CertCacheSize is removed and MITMHandler keeps no certificates itself; an Issuer you set is called on every CONNECT unless you wrap it in issuer.Cache.
  • Breaking: intercepted upstreams must present a certificate that verifies against the system roots, or 502 Bad Gateway is answered; handlers.DefaultTransport verifies. Add -upstream-ca for a private CA, or -upstream-insecure for the old behaviour.
  • Breaking: issuer names the proxy CA a CA instead of a root: NewRoot is NewCA, RootTemplate is CATemplate, SelfSignedCA.RootBitSize and RootTmpl are CABitSize and CATmpl, and DefaultIssuerRootBitSize and DefaultIssuerRootTmpl are DefaultIssuerCABitSize and DefaultIssuerCATmpl.
  • A proxy CA that multiproxy creates is named multiproxy CA, of organization multiproxy, instead of root.example.org of Multiproxy Root Org; a CA read from -ca-cert keeps its name.
  • The default templates carry no placeholder DNS name, OCSP server or issuer name on the proxy CA, and no country on leaf certificates.

  Fixed

  • Responses to intercepted requests stream to the client instead of reaching it only once complete.
  • Every request pipelined on an intercepted connection is answered, where requests after the first could be lost.
  • A client that starts its TLS handshake before reading the CONNECT response is intercepted instead of stalling.
  • A certificate that cannot be issued refuses the CONNECT request with 500, where the client was told the connection was established first.
  • Access records carry the status and byte count of every response, including errors multiproxy answers itself and refused CONNECT requests.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads