alknet/tasks/server/channel-proxy.md at main

Files

glm-5.1 5c820a41e9 tasks: decompose Phase 0a ADR foundation and mark prior tasks completed

Add 10 new tasks under tasks/architecture/ for Phase 0a (ADR writing):
- 9 ADR tasks (026-034) with dependency-ordered structure
- 1 review checkpoint task before Phase 0b spec writing

ADR dependency graph (3 generations):
  Gen 1 (parallel): 026, 029, 030, 031, 032, 034
  Gen 2 (depends on 029): 027, 028
  Gen 3 (depends on 027+028): 033
  Gen 4: review checkpoint

Also mark all 34 prior implementation tasks as completed — they
were finished but still showing as pending in the taskgraph.

2026-06-07 08:55:33 +00:00

2.1 KiB

Raw Permalink Blame History

id, name, status, depends_on, scope, risk, impact, level

name

status

depends_on

scope

risk

impact

level

server/channel-proxy

Implement server channel proxy — direct TCP and outbound proxy connections

completed

server/handler

auth/error-types

moderate

medium

component

implementation

Description

Implement the server's channel proxy logic that makes outbound TCP connections on behalf of SSH clients. When channel_open_direct_tcpip(host, port) is called for a non-reserved destination:

Connect to host:port, either directly or via the configured outbound proxy
Run tokio::io::copy_bidirectional between the SSH channel stream and the outbound TCP stream
Clean up when either side disconnects

Supports three outbound proxy modes per server.md: Direct, SOCKS5 proxy, HTTP CONNECT proxy.

Acceptance Criteria

crates/alknet-core/src/server/channel_proxy.rs exports channel proxy functions
ProxyConfig enum: Direct, Socks5 { addr: SocketAddr }, HttpConnect { addr: SocketAddr }
connect_outbound(target: SocketAddr, proxy: &ProxyConfig) -> Result<TcpStream> — connects to target directly or via proxy
Direct mode: TcpStream::connect(target)
SOCKS5 proxy: establishes SOCKS5 handshake, sends CONNECT command for target
HTTP CONNECT proxy: sends CONNECT host:port HTTP/1.1 to proxy, reads 200 response
proxy_channel(channel: ChannelStream, target: SocketAddr, proxy: &ProxyConfig) — spawns bidirectional copy task
Channel errors (target unreachable, proxy failure) close that channel without affecting SSH session
No logging of tunnel destinations (ADR-006) — only transport/auth events are logged
Unit tests: direct connection proxy, SOCKS5 proxy handshake, HTTP CONNECT proxy handshake, target unreachable handling

References

docs/architecture/server.md — Channel Handling, Outbound Proxy Modes sections
docs/architecture/decisions/006-no-logging-of-tunnel-destinations.md — no destination logging
docs/architecture/decisions/019-proxy-dual-semantics.md — server --proxy meaning

Notes

To be filled by implementation agent

Summary

To be filled on completion

2.1 KiB Raw Permalink Blame History