Local SOCKS5 proxy (CONNECT)

SOCKS5 server on 127.0.0.1 on top of lwIP raw TCP: CONNECT, IPv4 destinations only.
Reject ATYP 3 (domain, no DNS in the stack) and ATYP 4 (IPv6) with proper reply codes; reject BIND/UDP ASSOCIATE.
Reject destinations without a route via the tunnel (DHCP client with option 121/249 and route table #5) and connections before an address is bound.
Optional RFC 1929 username/password (any local process can otherwise use the proxy).
Flow control between the local socket and the lwIP PCB (no unbounded buffering).
Acceptance: curl --socks5 127.0.0.1:<port> http://<device behind the server>/.

Add local SOCKS5 proxy and port forwarding over lwIP

Done in ab5ab5c (netcore/proxy.c).

Bench acceptance (bench/bench.sh proxy-test, 16/16, also clean under ASan/UBSan with leak detection and on big-endian MIPS unit tests):

SOCKS5 CONNECT → HTTP 200; IPv4 literal in the domain field accepted; host name → 8, IPv6 → 8, no route → 3, closed port → 5
curl --socks5 OK
forward: 20 MiB download sha256 OK (~110–140 MiB/s), 8 MiB TCP echo both directions intact (~70–100 MiB/s), RTSP OPTIONS OK, forward to a closed port closes the local connection
8 parallel 20 MiB downloads via SOCKS5 intact (~55 MiB/s total with curl)
SOCKS5 user/password: no-auth client gets 0xFF, wrong password refused, correct one works

Navigation Menu