v2.0.0-rc1

[mosajjal]

What's Changed

• Bump docker/metadata-action from 4.3.0 to 4.4.0 by @dependabot in Bump docker/metadata-action from 4.3.0 to 4.4.0 #37
• V2 by @mosajjal in V2 #48

Full Changelog: v1.0.1-beta...v2.0.0-rc1

IMPORTANT: sniproxy v2 is a complete overhaul over v1. no more command line option or JSON configs, everything is configured through a YAML file (and some CSV files). refer to the default config for all the configuration documents

---

This discussion was created from the release v2.0.0-rc1.

[holygrolli]

as udp dns and https sni proxying is working fine now I tried to further improve my setup by setting up DoH. But this does not work when I am using a socks5 server.

2023-05-13T22:24:40Z DBG app/https.go:49 > overriding destination IP <nil> with 127.0.0.1:39085 service=https
2023-05-13T22:24:40Z INF app/https.go:65 > establishing connection to 127.0.0.1:39085 from clientip:51045 with SNI doh.myhost.example service=https
2023-05-13T22:24:40Z INF app/https.go:82 > could not connect to target with error: socks connect tcp socks5ip:1080->127.0.0.1:39085: unknown error connection not allowed by ruleset service=https
2023-05-13T22:24:40Z INF app/https.go:82 > could not connect to target with error: socks connect tcp socks5ip:1080->127.0.0.1:39085: unknown error connection not allowed by ruleset service=https

So as I understand the override rule the Decision is set to override and the https package is then trying to call through the socks5 like with every outgoing request. On a quick search I didn't find a hint on how to teach ther Dialer.Socks5 to not use the proxy for any IPs. I tried to set NO_PROXY=127.0.0.1 but this did not work.

[mosajjal]

interesting issue. technically, it's possible to exclude localhost from SOCKS5 upstream and always go direct. shouldn't be a big change. it'd be good if we could add unit tests for these too actually.

[mosajjal]

sorry for posting here several times but I had time to dig through the code and found out the doh_sni host is not enough for the DoH client, we have to add /dns-query to the host. now cURL can resolve the IP but it is trying to do a HTTP connect (is this DoH spec or cURL related, I don't know) which itself is being rejected by sniproxy because of

sniproxy/httpproxy.go

Line 70 in ee70cab

if connInfo.Decision == acl.Reject || connInfo.Decision == acl.ProxyIP || err != nil {

and Decision being ProxyIP. Is there a reason?
I will test further

the proxyIP is prohibited to prevent sniproxy going into a loop of requesting itself forever. Don't think it effects DoH though. Can't really tell without the full config. there's a chance that if your SOCKS5 is running on localhost, sniproxy outright rejects it to prevent such loops.

[holygrolli]

your last change in caa674f has broken my working basic udp dns setup with external socks5 proxy.

2023-05-15T20:53:00Z DBG app/acl/domain.go:151 > domain going through proxy: proxy.com acl=domain
2023-05-15T20:53:00Z WRN app/https.go:55 > read udp 172.18.0.2:48230->100.80.14.76:56193: i/o timeout service=https

while 100.80.14.76 being my socks5 on a different host. rolling back to my last self-compiled sniproxy it simply works:

2023-05-15T20:54:30Z DBG workspaces/sniproxy/acl/domain.go:151 > domain going through proxy: proxy.com acl=domain
2023-05-15T20:54:30Z INF workspaces/sniproxy/https.go:65 > establishing connection to targetip:443 from clientip:50064 with SNI proxy.com service=https

[mosajjal]

wondering if your SOCKS supports UDP or not. DNS used to be always direct and not proxied, now it is (experimentally). have you tested UDP connectivity on your SOCKS over Tailscale?

[holygrolli]

wondering if your SOCKS supports UDP or not. DNS used to be always direct and not proxied, now it is (experimentally). have you tested UDP connectivity on your SOCKS over Tailscale?

I haven't tested it explicitly, but Dante is able to as I found out. This is in my logs:

Mai 15 20:11:24 ntflxproxy danted[22285]: May 15 20:11:24 (1684174284.006802) danted[22285]: info: pass(2): udp/udpassociate [: 0.0.0.0.0 100.80.14.76.56193
Mai 15 20:11:24 ntflxproxy danted[22285]: May 15 20:11:24 (1684174284.006802) danted[22285]: info: pass(2): udp/udpassociate [: 0.0.0.0.0 100.80.14.76.56193
Mai 15 20:11:24 ntflxproxy danted[23162]: May 15 20:11:24 (1684174284.014327) danted[23162]: notice: run_io(): 12 unexpected bytes over control connection from client 100.97.244.58.33292: \0\0\0\0\377\377\0\0\0\0\0\0
Mai 15 20:11:24 ntflxproxy danted[23162]: May 15 20:11:24 (1684174284.014327) danted[23162]: notice: run_io(): 12 unexpected bytes over control connection from client 100.97.244.58.33292: \0\0\0\0\377\377\0\0\0\0\0\0

can we make it configurable in the config like upstream_dns_over_socks5: false? I personally only need to transfer ProxyIP traffic through the socks5.

[mosajjal]

yeah we can do that. reckon that'll come in handy. ironically, I think if you have used a SOCKS that didn't support UDP it would've worked since I fall back to direct connection in those cases.