Skip to content

ProxiFyre-v2.4.0

Latest
Latest

Choose a tag to compare

View all tags
@wiresock wiresock released this 19 Jul 08:51
v2.4.0
dd15128
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ProxiFyre 2.4.0

ProxiFyre can now connect directly to SOCKS5-over-TLS proxy servers. This protects your proxy credentials and TCP traffic between ProxiFyre and the upstream proxy, without requiring a separate TLS wrapper.

The new transport is compatible with Alighieri TLS listeners. Existing configurations continue to work unchanged because regular SOCKS5 over TCP remains the default.

What's new

  • Native SOCKS5-over-TLS support using Windows SChannel.
  • TLS protection for SOCKS5 authentication, TCP CONNECT negotiation, and relayed TCP traffic.
  • TLS protection for the UDP ASSOCIATE control connection.
  • Certificate chain and hostname validation for public certificates.
  • SHA-256 certificate pinning for known or self-signed certificates.
  • Faster connection setup under load through bounded TCP workers and parallel UDP association workers.
  • Automatic detection and replacement of stale UDP associations after proxy idle timeouts.
  • Continued support for IPv4 and IPv6 destinations over both TCP and UDP.

The implementation was validated with live TCP and UDP traffic through an Alighieri SOCKS5Tls server. Packet-capture review confirmed that authentication and TCP relay traffic remain encrypted on the wire.

Quick start

Add "socks5Transport": "TLS" to a proxy entry:

{
  "appNames": ["chrome"],
  "socks5ProxyEndpoint": "proxy.example.com:443",
  "username": "alice",
  "password": "your-password",
  "socks5Transport": "TLS",
  "tlsServerName": "proxy.example.com",
  "supportedProtocols": ["TCP", "UDP"],
  "supportedAddressFamilies": ["IPv4", "IPv6"]
}

For a publicly trusted certificate, tlsServerName is normally all you need. It defaults to the hostname in socks5ProxyEndpoint when omitted.

For a self-signed certificate, set tlsPinnedSha256 to the certificate's 64-character SHA-256 fingerprint. Avoid tlsAllowInvalidCertificate outside temporary testing because it disables normal upstream identity verification.

Username and password must either both be present or both be omitted. See the README configuration guide for all options.

Important UDP note

SOCKS5 UDP traffic uses a separate standard UDP relay and is not wrapped in the TLS control connection. The authentication and UDP ASSOCIATE negotiation are encrypted, but destination metadata and UDP datagrams remain visible between ProxiFyre and the proxy.

Applications using QUIC or another encrypted protocol still protect their own payloads. Applications that send plaintext UDP should not treat SOCKS5Tls as payload encryption for that traffic.

Compatibility

  • No configuration migration is required for existing plain SOCKS5 users.
  • The TLS transport currently negotiates TLS 1.2.
  • The proxy endpoint must be IPv4 or a hostname with an IPv4 address. Proxied destinations can be IPv4, IPv6, or both.
  • Choose the x64, x86, or ARM64 archive matching your Windows installation.
  • Every archive contains signed and timestamped copies of both ProxiFyre.exe and socksify.dll.

Implementation: Native SOCKS5-over-TLS transport (#160)

Full changelog: v2.3.0...v2.4.0

Assets 5
Loading