alknet/tasks/client/socks5-server.md at 596c89ce24ac5974512a57ccd0380bde81818af8

Files

glm-5.1 596c89ce24 refactor!: rebrand wraith to alknet

Rename all crates, CLI commands, constants, type names, doc comments,
and documentation from wraith to alknet. Includes wire-protocol changes:
ALPN wraith-ssh -> alknet-ssh, reserved destination prefix wraith- ->
alknet-, SSH auth username wraith -> alknet.

2026-06-05 10:04:32 +00:00

2.2 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level

name

status

depends_on

scope

risk

impact

level

client/socks5-server

Implement SOCKS5 server — local proxy that forwards through SSH channels

pending

auth/client-auth-handler

transport/trait-and-types

auth/error-types

moderate

medium

component

implementation

Description

Implement the local SOCKS5 proxy server — the primary client interface (ADR-005). Listens on a local port (default 127.0.0.1:1080), accepts SOCKS5 connections, and for each connection:

Reads the SOCKS5 handshake (auth method negotiation, target address)
Opens channel_open_direct_tcpip(target_host, target_port, originator_addr, originator_port) on the SSH session
Converts the SSH channel to a stream via channel.into_stream()
Runs tokio::io::copy_bidirectional(&mut local_socket, &mut ssh_stream) to proxy data

Supports SOCKS5h (domain names resolved server-side) by default. This prevents DNS leaks — the client never resolves target hostnames locally (ADR-006).

Acceptance Criteria

crates/alknet-core/src/socks5/mod.rs exports Socks5Server
Socks5Server binds to configurable listen address (default 127.0.0.1:1080)
SOCKS5 handshake: method negotiation (no-auth only), target address parsing (IPv4, IPv6, domain name)
Domain name targets (SOCKS5h) sent unresolved to server — no local DNS resolution
For each SOCKS5 connection, opens SSH direct_tcpip channel and proxies bytes bidirectionally
Connection errors (SSH session down, channel open failed) result in SOCKS5 error response to client
No logging of SOCKS5 request targets (ADR-006) — only connection-level events logged
SOCKS5 server always enabled when alknet connect runs (per client.md constraint)
Unit tests: SOCKS5 handshake parsing, address type handling, bidirectional proxy flow (with mock transport)

References

docs/architecture/client.md — SOCKS5 Server section
docs/architecture/decisions/005-socks5-before-tun.md — SOCKS5 as primary interface
docs/architecture/decisions/006-no-logging-of-tunnel-destinations.md — no DNS leak, no logging

Notes

To be filled by implementation agent

Summary

To be filled on completion

2.2 KiB Raw Blame History