Skip to content

v1.2.0

Choose a tag to compare

View all tags
@DigitalCyberSoft DigitalCyberSoft released this 13 Mar 23:29
· 4 commits to main since this release
v1.2.0
41387b7

What's New

TLS Options Parity

Added constructor options matching PHP's stream context TLS capabilities (where applicable to QUIC/TLS 1.3):

  • ciphersuites — TLS 1.3 cipher suite selection (TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:...)
  • peer_name — Override hostname for SNI and certificate verification
  • verify_peer_name — Toggle hostname verification (default: true)
  • allow_self_signed — Accept self-signed certificates when verify_peer is enabled

Hostname Verification Fix

SSL_set1_host() is now called during connection when verify_peer and verify_peer_name are both enabled. Previously, hostname verification was silently skipped even with verify_peer => true.

SOCKS5 Proxy — Complete Rewrite

The previous SOCKS5 implementation only had a UDP relay BIO filter but was missing the entire TCP handshake, making it non-functional. This release adds:

  • Full RFC 1928 TCP control channel handshake
  • Auth negotiation: no-auth and RFC 1929 username/password (socks5_username, socks5_password)
  • UDP ASSOCIATE command with relay address parsing (IPv4, IPv6, domain ATYP)
  • Proper TCP control socket lifecycle (kept alive during relay, closed on disconnect)
  • Handles 0.0.0.0 relay addresses by falling back to the proxy IP

Tests

  • 033-ciphersuites — TLS 1.3 cipher selection and invalid cipher rejection
  • 034-peer-name — SNI override and hostname mismatch behavior
  • 035-verify-peer-name — Hostname verification toggle
  • 036-allow-self-signed — Self-signed certificate acceptance
  • 037-socks5-handshake-errors — SOCKS5 error paths (bad format, refused, unresolvable)
  • 038-socks5-functional — End-to-end SOCKS5 proxy test (requires microsocks)
Assets 2
Loading