Four tools that already used flags.Parse (and therefore already had
-proxy registered transparently) still reached out via net.Dial* or
ran DNS resolution past the proxy. Migrate the network calls:
- tools/GetADComputers: custom net.Resolver now dials via
transport.DialContext, so UDP DNS through the DC surfaces
ErrUDPUnderProxy cleanly rather than bypassing -proxy.
- tools/changepasswd: kpasswd TCP dial now uses transport.DialTimeout.
- tools/smbexec: getLocalIP() short-circuits when
transport.IsProxyConfigured(). The "dial UDP to find the local
source address" trick has no meaning when traffic flows through a
SOCKS5 proxy.
- tools/raiseChild: the DNS forest-FQDN fallback (net.LookupHost) is
skipped under -proxy with a message pointing the user to -parent-dc,
since net.LookupHost goes to the OS resolver and would leak DNS.
- pkg/relay/http_client.go, winrm_client.go: swap the http.Transport
DialContext from &net.Dialer{Timeout: 10s}.DialContext to a closure
that calls transport.DialContext. NTLM relay now respects -proxy.
- pkg/relay/socks.go: add a comment on the HTTP DNS passthrough path
explaining why it intentionally uses net.DialTimeout rather than
transport. That path is the outbound leg of our own SOCKS5 server,
so routing it through -proxy would double-tunnel the operator's
proxy through the operator's proxy.
- pkg/tds/sqlr.go: SQL Server Browser discovery (UDP 1434) now uses
transport.DialUDP, which surfaces ErrUDPUnderProxy when a proxy is
configured rather than silently bypassing it.
Introduces three exports in pkg/flags:
- ProxyFlagUsage: the shared -proxy usage string, so tools that hand-roll
their flag setup render identical help text to Parse().
- ConfigureProxy(url): calls transport.Configure and exits on error.
Centralizes the "fail loud on bad -proxy" behavior.
- RegisterProxyFlag(): registers -proxy on the default flag.CommandLine
and returns a finalizer to call after flag.Parse(). Two-line
integration for tools that don't use flags.Parse().
Parse() now uses these internally. It also calls ConfigureProxy and
applies Debug/Timestamp unconditionally rather than returning early when
NArg == 0; tools that take all their config via flags (listeners, etc.)
were previously losing -proxy because the early return skipped Configure.
Splits pkg/transport into a router (tcp.go) plus two platform-specific
direct dialers: direct_libc.go preserves the existing cgo libc connect()
path on Unix (so proxychains can still hook it), and direct_portable.go
provides a pure-Go fallback for CGO_ENABLED=0 and Windows builds.
Adds proxy.go with:
- Configure(Options) / ConfigureProxy to wire a SOCKS5 URL (socks5 or
socks5h), with ALL_PROXY / all_proxy env fallback read directly via
os.Getenv (not proxy.FromEnvironment, whose sync.Once cache is not
test-friendly).
- DialContext routing through the configured proxy, or directDial.
- DialUDP returning ErrUDPUnderProxy when proxied, rather than silently
leaking UDP packets past the SOCKS5.
- IsProxyConfigured and ProxyURL for callers that need to short-circuit
features that can't be tunneled.
- libcForwarder so the TCP leg to the SOCKS5 proxy itself still goes
through libc, enabling proxychains -> gopacket -> -proxy chaining.
Tests:
- export_test.go exposes ResetForTest for test isolation (Configure
panics on double-call, so each test resets package state).
- socks5_server_test.go hand-rolls a minimal in-process SOCKS5 server
(CONNECT + no-auth, ~130 LOC, no new deps).
- proxy_test.go covers invalid scheme rejection, socks5/socks5h accept,
ALL_PROXY env fallback, double-call panic, default state,
DialUDP/DialContext UDP rejection, credential redaction, direct-path
behavior when unconfigured, and an end-to-end round-trip through the
in-process SOCKS5.
psycep