x/net/proxy: SOCKS5 proxy should allow empty password

[iseki0]

What version of Go are you using (go version)?

$ go version
go version go1.19 windows/amd64

Does this issue reproduce with the latest release?

Yes, it reproduced

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\iseki\AppData\Local\go-build
set GOENV=C:\Users\iseki\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\iseki\go\pkg\mod
set GONOPROXY=git.murphy-int.com
set GONOSUMDB=git.murphy-int.com
set GOOS=windows
set GOPATH=C:\Users\iseki\go
set GOPRIVATE=git.murphy-int.com
set GOPROXY=https://goproxy.cn,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.19
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=0
set GOMOD=NUL
set GOWORK=
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=C:\Users\iseki\AppData\Local\Temp\go-build1840084022=/tmp/go-build -gno-record-gcc-switches

What did you do?

I use an empty-password socks5 URL, like: socks5://username:@127.0.0.1. The connection closed after server negotiation.

What did you expect to see?

The connection should be established.

What did you see instead?

I found the problem code might be here:

go/src/net/http/socks_bundle.go

Line 448 in b16e94d

if len(up.Username) == 0 || len(up.Username) > 255 || len(up.Password) == 0 || len(up.Password) > 255 {

After read the RFC, I found there is no limitation to empty password string. And both curl and git is ok in my test.
So I think it's a bug and should be fixed.

If it's ok, I will create a PR for that.

[seankhliao]

cc @neild

[gopherbot]

Change https://go.dev/cl/457155 mentions this issue: net/http: SOCKS5 proxy with empty password should be allowed

[gopherbot]

Change https://go.dev/cl/457355 mentions this issue: socks: SOCKS5 proxy with empty password should be allowed

[aojea]

From the RFC https://www.rfc-editor.org/rfc/rfc1929 I interpret that username and password are always >0 <=255

[iseki0]

It's only noted at graph, I missed it. But it's supported widely. 🥹

[geovex]

Also we can allow empty username.

[iseki0]

@geovex

Also we can allow empty username.

In my opinion, it is. But I'm afraid it's too aggressively