CSHARP-734: SOCKS5 Proxy Support #1731

papafe · 2025-07-16T16:55:42Z

No description provided.

evergreen/evergreen.yml

sanych-sun · 2025-08-12T22:01:03Z

src/MongoDB.Driver/Core/Configuration/ConnectionString.cs

+                    }
+
+                    _proxyHost = value;
+                    if (_proxyHost.Length == 0)


string.IsNullOrEmpty(_proxyHost)?

If we reached here, we already validated the options with a regex, so the strings cannot be null.
They could be empty though if the connection string looks something like (with empty spaces):
....proxyHost= &proxyPort=2020.
So ideally we should only check that is not empty. We could also still use isNullOrEmpty for readability, but it's not necessary here.

This made me also realise that we should just check for null a couple of lines earlier, so I removed IsNullOrEmpty and added a test that verifies it.

Makes sense, I would probably prefer comparing to String.Empty then, but I'm not insisting on this.

And I would prefer if (_proxy == "") LOL

sanych-sun · 2025-08-12T22:02:26Z

src/MongoDB.Driver/Core/Configuration/ConnectionString.cs

+                    }
+
+                    var proxyPortValue = ParseInt32(name, value);
+                    if (proxyPortValue is < 0 or > 65535)


Is 0 legit value here?

It's a valid port number, but usually the port numbers less than 1024 are reserved. I tried to be more relaxed here with the validation, just excluding values that are definitely not valid.

0 is probably wrong value for the port, as it means "random available port" as far as I know.

I think you're right :)

src/MongoDB.Driver/MongoUrlBuilder.cs

sanych-sun · 2025-08-12T22:28:46Z

tests/MongoDB.Driver.Tests/Core/Configuration/ConnectionStringTests.cs

@@ -374,6 +374,10 @@ public void When_nothing_is_specified(string connectionString)
            subject.MaxPoolSize.Should().Be(null);
            subject.MinPoolSize.Should().Be(null);
            subject.Password.Should().BeNull();
+            subject.ProxyHost.Should().Be(null);


BeNull()?

So... BeNull can't be used with proxyPort because of the type constraints on the fluent assertions, but I'll change the others.

src/MongoDB.Driver/Core/Connections/Socks5AuthenticationSettings.cs

sanych-sun · 2025-08-12T23:04:13Z

src/MongoDB.Driver/Core/Connections/Socks5AuthenticationSettings.cs

+            return new Hasher()
+                .Hash(Username)
+                .Hash(Password)
+                .GetHashCode();


This class looks immutable, we can calculate the hashcode once.

I agree we could, but I suppose this method is method is going be called almost never. Do you think it's worth to cache it vs keeping the code shorter?

If this class is not used as a key (or part of the key) in some dictionaries, then probably it's OK to keep the code as is.

Yes, it should not be used in that way.

sanych-sun · 2025-08-12T23:18:20Z

src/MongoDB.Driver/Core/Connections/TcpStreamFactory.cs

@@ -48,19 +48,36 @@ public TcpStreamFactory(TcpStreamSettings settings)
        // methods
        public Stream CreateStream(EndPoint endPoint, CancellationToken cancellationToken)
        {
+            var socks5ProxySettings = _settings.Socks5ProxySettings;
+            var useProxy = socks5ProxySettings != null;
+            var targetEndpoint = useProxy ? new DnsEndPoint(socks5ProxySettings.Host, socks5ProxySettings.Port) : endPoint;


Am I right to think that proxy vs non-proxy scenario is different in 2 points:

What endpoint to connect

Do some additional logic after connecting the socket

If so - can we instead of tweaking the TcpStreamFactory class, create a new wrapper that will replace the endpoint, call the TcpStreamFactory.CreateStream as usual, and then do proxy negotiation after.
We are doing something similar in SslStreamFactory.

sanych-sun · 2025-08-13T16:49:00Z

evergreen/evergreen.yml

+          TARGET="TestSocks5Proxy" \
+            evergreen/run-tests.sh
+          OS=${OS} \
+            evergreen/cleanup-proxy.sh


You probably should add this script to cleanup-test-resources.sh or call the cleanup-proxy.sh from post steps. Otherwise we could skip on cleaning proxy if some previous step failed with an error.

sanych-sun · 2025-08-13T16:57:28Z

evergreen/cleanup-proxy.sh

+
+echo "Attempt to kill proxy server process if present on ${OS}"
+if [[ "$OS" =~ Windows|windows ]]; then
+  tasklist -FI "IMAGENAME eq python.exe"


Killing all Python processes might be too much. Let's investigate if there is anything else we can do.

sanych-sun · 2025-08-13T17:05:46Z

src/MongoDB.Driver/Core/Configuration/ConnectionString.cs

+                    var proxyPortValue = ParseInt32(name, value);
+                    if (proxyPortValue is < 1 or > 65535)
+                    {
+                        throw new MongoConfigurationException("proxyPort must be between 0 and 65535.");


I would probably suggest to change the error message to:
Invalid proxy port: {proxyPortValue}: must be between 1 and 65535, inclusive

Reasonable.

sanych-sun · 2025-08-13T17:08:08Z

src/MongoDB.Driver/Core/Configuration/ConnectionString.cs

+                    }
+
+                    _proxyHost = value;
+                    if (_proxyHost.Length == 0)


Makes sense, I would probably prefer comparing to String.Empty then, but I'm not insisting on this.

sanych-sun · 2025-08-13T17:20:46Z

src/MongoDB.Driver/Core/Configuration/ConnectionString.cs

+                    }
+
+                    var proxyPortValue = ParseInt32(name, value);
+                    if (proxyPortValue is < 0 or > 65535)


0 is probably wrong value for the port, as it means "random available port" as far as I know.

src/MongoDB.Driver/MongoUrlBuilder.cs

sanych-sun · 2025-08-13T17:45:26Z

src/MongoDB.Driver/Core/Connections/Socks5ProxySettings.cs

+        sb.Append(Authentication switch
+        {
+            Socks5AuthenticationSettings.UsernamePasswordAuthenticationSettings up =>
+                $"UsernamePassword (Username: {up.Username}, Password: {up.Password})",


MongoUrlBuilder.ToString is being used to build the Url from provided parameters, so having passwords there is probably the expected behavior (I suppose we ought to have another method for that, something like BuildUrl). However this class is user-facing settings class, there is a bigger chances it could be converted to string and logged or even worse outputted as a part of exception. I've checked MongoClientSettings - it does not look like it can leak passwords in the similar way.

sanych-sun · 2025-08-13T17:47:23Z

src/MongoDB.Driver/MongoUrlBuilder.cs

+            get => _proxyPort;
+            set
+            {
+                if (value is < 0 or > 65535)


We have Ensure.IsNullOrBetween if this is what you are looking for.

sanych-sun · 2025-08-13T17:50:02Z

src/MongoDB.Driver/Core/Connections/Socks5AuthenticationSettings.cs

+            return new Hasher()
+                .Hash(Username)
+                .Hash(Password)
+                .GetHashCode();


If this class is not used as a key (or part of the key) in some dictionaries, then probably it's OK to keep the code as is.

BorisDog

Looks great overall!

src/MongoDB.Driver/Core/Connections/Socks5ProxySettingsBuilder.cs

src/MongoDB.Driver/Core/Connections/Socks5ProxySettings.cs

BorisDog · 2025-08-13T18:53:55Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+    public static void PerformSocks5Handshake(Stream stream, EndPoint endPoint, Socks5AuthenticationSettings authenticationSettings, CancellationToken cancellationToken)
+    {
+        var (targetHost, targetPort) = endPoint.GetHostAndPort();
+        var buffer = ArrayPool<byte>.Shared.Rent(BufferSize);


We already have similar ThreadStaticBuffer that is used for smaller buffers. Do you know how it compares to ArrayPool.Shared ?

So, I didn't see ThreadStaticBuffer before, so it's good that you pointed it 😁
Regarding the use of it, I suppose the main disadvantage is here is that ThreadStaticBuffer is not thread safe, so we can't use it in the async version. Another advantage of ArrayPool.Shared is that you can "rent" as many buffer you need per thread.

ThreadStaticBuffer is designed to be threadsafe, leveraging the [ThreadStatic] technique, which I believe what ArrayPool<byte>.Shared does.
You are correct about the limitation for a single rent per thread, but looks like that's what is needed here.

I am thinking that if we don't have a good reason to use one over another, than we should fallback to consistency principle. But going forward, if ArrayPool<byte>.Shared is as performant, no reason not switch to it in all places in the future.
I do like the option of using in RentedBuffer, which eliminated the need for finally, so we still might want to create wrapper around ArrayPool<byte>.Shared.

If we want to use ConfigureAwait(false) in the async version, then we can't use ThreadStaticBuffer as it's not thread safe.

BorisDog · 2025-08-13T19:05:46Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+        }
+    }
+
+    private static int CreateGreetingRequest(byte[] buffer, bool useAuth)


Minor:
Looks like a static data, would it be simpler to create static buffers once?

byte[] __greetingNoAuth = [ProtocolVersion5, ..], byte[] __greetingAuth = [ProtocolVersion5, ..],

?

I suppose we could create the static buffer once, but then we're exchanging a very little time in needing to fill the rented array with the memory necessary to keep the static buffer.
I think it would make sense to keep it as it is.

BorisDog · 2025-08-13T19:06:32Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+    {
+        if (version != ProtocolVersion5)
+        {
+            throw new IOException("Invalid SOCKS version in response.");


Add actual and expected versions?

BorisDog · 2025-08-13T19:19:21Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+            await stream.ReadBytesAsync(buffer, 0, 2, cancellationToken).ConfigureAwait(false);
+            var acceptsUsernamePasswordAuth = ProcessGreetingResponse(buffer, useAuth);
+
+            // If we have username and password, but the proxy doesn't need them, we skip.


minor: Should comment say "we skip the authentication step" ?

BorisDog · 2025-08-13T19:29:06Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+
+        if (buffer[1] != Socks5Success)
+        {
+            throw new IOException($"SOCKS5 connect failed");


Add buffer[1] value?

BorisDog · 2025-08-13T19:29:20Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+    {
+        if (buffer[0] != SubnegotiationVersion || buffer[1] != Socks5Success)
+        {
+            throw new IOException("SOCKS5 authentication failed.");


Add buffer[1] value?

BorisDog · 2025-08-13T20:53:52Z

src/MongoDB.Driver/Core/Connections/Socks5Helper.cs

+            var acceptsUsernamePasswordAuth = ProcessGreetingResponse(buffer, useAuth);
+
+            // If we have username and password, but the proxy doesn't need them, we skip.
+            if (useAuth && acceptsUsernamePasswordAuth)


Looks like in the case of acceptsUsernamePasswordAuth, useAuth is validated in ProcessGreetingResponse.
So technically useAuth doesn't need to be checked here.
Should acceptsUsernamePasswordAuth be named something like useAuthenticationStep ?

Makes sense!

BorisDog · 2025-08-13T22:07:02Z

tests/MongoDB.Driver.Tests/Specifications/socks5-support/Socks5SupportProseTests.cs

+                    yield return [id, connectionString, expectedResult, useTls, isAsync];
+                }
+            }
+        }


minor: another way to write the same, if you'd prefer:

return from (connectionString, expectedResult) in testCases from useTls in new[] { true, false } from isAsync in new[] { true, false } select new object[] {..., useTls, isAsync};

I've used something similar now, hopefully it's readable enough.

papafe added 6 commits June 24, 2025 14:00

CSHARP-734: SOCKS5 Proxy Support

a09ba4f

Small fix

6696184

Added options to MongoClient settings

b3020b5

Added uri options test for proxy options

7931f70

Added additional checks on parsing.

186df67

Small fix

567bfa7

papafe added the feature label Jul 16, 2025

papafe added 23 commits July 17, 2025 11:49

Added base implementation

feaa948

Improvements plus initial tests

f8bd6a3

Various corrections

3665a29

Improvements

3845931

Various fixes

83cace4

Simplification

fad7d42

Added comments

2ca4b3f

First version of setting class

a715fef

Various fixes

e710b13

Small improvements

cbea41d

Added async version

d49fff5

Simplifications

74ade29

Removed unused

b9ceea0

Removed flush and simplified

d2cc5f9

Simplification

fda35a1

Fixed auth

a76dc1d

Removed unused parameters

8e7570f

Fixed whitespace

9d23395

Added use of async

3cfe101

Added comments and removed unused methods

896292d

File scoped namespaces

3d1d2bd

Added connection string tests

01dfdb1

Added MongoClientSettings test

6064af9

papafe added 12 commits August 5, 2025 17:39

Test improvements

d53fda2

Small improvements and fix

d84416e

Small fixes

58ffb77

Small fix

57e6354

Small fix

dfea13d

Added missing trait.

91fb165

Trying to add command check

bb34734

Corrected the command calculation

d8e1ecd

Corrected API

d8569f4

Small corrections

345614e

Smal fix

4402181

Various small corrections.

97a420d

papafe requested a review from sanych-sun August 12, 2025 14:54

papafe marked this pull request as ready for review August 12, 2025 14:54

papafe requested a review from a team as a code owner August 12, 2025 14:54

sanych-sun requested changes Aug 12, 2025

View reviewed changes

papafe added 8 commits August 13, 2025 09:53

Small corrections according to PR.

d4bfa81

Small fixes following PR.

188c274

Other small fixes.

f6163db

Added disposal of stream and socket

3f80519

Fix

286a281

Removed unnecessary test.

8f41748

Added cleanup stage

d94aaa5

Testing proxyStreamFactory as a wrapper

8930517

sanych-sun reviewed Aug 13, 2025

View reviewed changes

BorisDog requested changes Aug 13, 2025

View reviewed changes

BorisDog requested a review from vbabanin August 13, 2025 22:08

papafe added 3 commits August 14, 2025 10:56

Various small fixes

142e3fc

Use of LINQ

19b1e1a

Various fixes

4568065

CSHARP-734: SOCKS5 Proxy Support #1731

Are you sure you want to change the base?

CSHARP-734: SOCKS5 Proxy Support #1731

Conversation

papafe commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

papafe Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

papafe Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BorisDog left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

papafe commented Jul 16, 2025 •

edited

Loading

papafe Aug 13, 2025 •

edited

Loading

papafe Aug 13, 2025 •

edited

Loading