Show HN: Socks Protocol Version 5 Library in Go | Hacker News Reader

Show HN: Socks Protocol Version 5 Library in Go

github.com

54 pointstxthinking21 comments

Next time someone says to me that language's popularity doesn't matter for it's utility, I'll remember how Go's socks library appears on the front page of HN, while my pull request the Haskell's socks library (which implements the most basic feature that author added to the top of TODO list himself) is sitting unmerged and uncommented now for almost a year.(1) (If I sound bitter it's because I am.)

Seriously though, such "boring" libraries that you just need in your toolbox are a great way to evaluate the health of the whole ecosystem.

[1][https://github.com/vincenthz/hs-socks/pull/24]

Maybe the author died?

I will always say this was a complete hack to a specific time in history. Having SOCKS in your toolbelt of tricks is always handy and can make hard things surprisingly easy.

Last time was I needed to tunnel a request from my development environment into a production VPN to contact a service which had IP access restrictions.

I'm curious was this a situation where ssh port-forwarding would not have worked?

It was an SSL connection with a custom cert chain. So I could easily wrap the HTTP side of things with a SOCKS forwarder which then SOCKS proxied into the VPN and then back out to the other site.

There might have been another way to do it, but given that wrapping HTTP in a SOCKS proxy is easy and ssh has a built in SOCKS proxy, this was quick win.

ps. It's SOCKS and not Socks - for the subject line of this story.

the thing is, port forwarding works for a specific port, whereas socksproxy is a general tunnel.

if you point firefox to use a remote ssh host as socks proxy then you can browse internet as if you were in the ssh host subnet.

it's basically a poor man's vpn, but if all you do is www browsing it works perfectly.

Just a note: if you're forwarding for something that can use socks5, ssh can do that (can be used to share an outgoing VPN from a server you can ssh into, for example - by pointing your browser to your local ssh socks5 proxy. Or for testing a rest/soap/graphql service that's not exposed to the internet).

https://man.openbsd.org/ssh#D

If I only want the client side, does this add anything over https://godoc.org/golang.org/x/net/proxy ?

Honest question: What do people use Socks for? Personally I haven’t used it since Firesheep...

use it with SSH forwarding.

I use it for network-isolating my bubblewrap-containers (in lieu of sane documentation on securing user-dbus-sessions...). Just socat the socks-socket into a filesystems socket, pass that into the mount-namespace, run the reverse-socat-operation, pass the port to proxychains → internet in the container!

it's a no-conf-required vpn:

   ssh -D 8000 -q -C -N user@sshhost

point firefox to use localhost:8000 as socksproxy, and all your internet traffic appears to have originate from sshhost.

Chain three of them together, and you have a TOR-like circuit. Of course, since SSH doesn't work as a SOCKS5 client (last time I checked, at least), you'd have to forward some local ports to remote 22's and point SSH clients at localhost (forcing them to check the specific host key is also a fun challenge). Sadly, SSH doesn't support using port 0 for chosing a random local port.

    ssh -L 60001:host2:22 -N user1@host1 &
    ssh -L 60002:host3:22 -p 60001 -N user2@localhost &
    ssh -D 8000 -p 60002 -N user3@localhost &

> SSH doesn't work as a SOCKS5 client

1) That's what the ProxyCommand config option is for. Most systems will have netcat or nc installed which do provide SOCKS client support

2) Or just use the -J option argument, which IIRC was originally implemented as a transformation to -oProxyCommand='ssh ... [netcat/nc]' but now is a simple transformation to the newer -W option argument, which doesn't depend on netcat/nc being installed on the intermediate host.

When I was looking into this problem neither -J nor -W options existed (that was a really long time ago).

What if I have a bash script that needs to contact sshhost - how do I point that script to localhost:8000?

I'm sorry but I didn't understand your question -- could you elaborate on that a bit more?

Except for DNS? And anything else that doesn't use the proxy.

You can apparently set the firefox flag "network.proxy.socks_remote_dns"

Never tried it myself!

Now, perhaps firefox does not need to do a lookup; it sends the hostname to the remote end.

But best be safe?

I didn't try, but I think that DNS over Https gets forwarded too.

Ok I checked -- you can tell firefox to proxy dns too when using socks proxy.

Last time I needed a SOCKS5 server + client in Go, I remember using github.com/getlantern/go-socks5. What does this offer above that?

Reply on news.ycombinator.com