sync with main repo

.env → .env.example

@@ -1,3 +1,2 @@
 PROXY_USER=someuser
 PROXY_PASSWORD=somepass
-PROXY_PORT=1080

Changelog.md

@@ -3,12 +3,21 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased - available on :latest tag for docker image]
 ### Changed
-- Migrate to distroless docker image from scratch
-- 
 ### Added
-- New ALLOWED_DEST_FQDN config env paramteter for filtering dest FQND based on regex patterns
-- New SetIPWhitelist config env paramteter for setting whitelist set of ip addresses which allowed to use proxy connection 
-- Dependabot version updates automation
+
+## [v0.0.4] - 2025-10-07
+
+**Important:** :warning: Starting with this release, the proxy requires authentication by default. The `REQUIRE_AUTH` parameter is now set to `true` by default. Please refer to the documentation for details on this change.
+
+### Changed
+- Migrated to a distroless Docker image from scratch.
+- Moved go-socks5 to a modified forked repository at https://github.com/serjs/go-socks5 as a dependency.
+
+### Added
+- Added `REQUIRE_AUTH` parameter with a default value of `true` to enforce authentication for the proxy.
+- Added `ALLOWED_DEST_FQDN` config environment parameter for filtering destination FQDNs based on regex patterns.
+- Added `SetIPWhitelist` config environment parameter for setting a whitelist of IP addresses allowed to use the proxy connection.
+- Implemented Dependabot version updates automation.
 
 ## [v0.0.3] - 2021-07-07
 ### Added

Dockerfile

@@ -1,4 +1,4 @@
-ARG GOLANG_VERSION="1.19.1"
+ARG GOLANG_VERSION="1.25"
 
 FROM golang:$GOLANG_VERSION-alpine as builder
 RUN apk --no-cache add tzdata

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Sergey Bogatyrets
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,7 +1,6 @@
 # go-socks5-proxy
 
 ![Latest tag from master branch](https://github.com/serjs/socks5-server/workflows/Latest%20tag%20from%20master%20branch/badge.svg)
-![Release tag](https://github.com/serjs/socks5-server/workflows/Release%20tag/badge.svg)
 
 Simple socks5 server using go-socks5 with authentication, allowed ips list and destination FQDNs filtering
 
@@ -11,16 +10,15 @@ Simple socks5 server using go-socks5 with authentication, allowed ips list and d
 
     ```docker run -d --name socks5 -p 1080:1080 -e PROXY_USER=<PROXY_USER> -e PROXY_PASSWORD=<PROXY_PASSWORD>  serjs/go-socks5-proxy```
 
-    - Leave `PROXY_USER` and `PROXY_PASSWORD` empty for skip authentication options while running socks5 server, see example below
+- Run docker container using specific container port and expose it to host port 1090
 
-- Run docker container using specifit container port and expose it to host port 1090, without auth creds
-
-    ```docker run -d --name socks5 -p 1090:9090 -e PROXY_PORT=9090 serjs/go-socks5-proxy```
+    ```docker run -d --name socks5 -p 1090:9090 -e PROXY_USER=<PROXY_USER> -e PROXY_PASSWORD=<PROXY_PASSWORD> -e PROXY_PORT=9090 serjs/go-socks5-proxy```
 
 # List of supported config parameters
 
 |ENV variable|Type|Default|Description|
 |------------|----|-------|-----------|
+|REQUIRE_AUTH|String|true|Allow accepting socks5 connections without auth creds. Not recommended untill you use other protections mechanisms like Whitelists Subnets using Firewall or Proxy itself|
 |PROXY_USER|String|EMPTY|Set proxy user (also required existed PROXY_PASS)|
 |PROXY_PASSWORD|String|EMPTY|Set proxy password for auth, used with PROXY_USER|
 |PROXY_PORT|String|1080|Set listen port for application inside docker container|
@@ -30,27 +28,27 @@ Simple socks5 server using go-socks5 with authentication, allowed ips list and d
 
 # Build your own image:
 `docker-compose -f docker-compose.build.yml up -d`\
-Just don't forget to set parameters in the `.env` file.
+Just don't forget to set parameters in the `.env` file (`cp .env.example .env)` and edit it with your config parameters
 
 # Test running service
 
 Assuming that you are using container on 1080 host docker port
 
 ## Without authentication
 
-```curl --socks5 <docker host ip>:1080  https://ifcfg.co``` - result must show docker host ip (for bridged network)
+```curl --socks5 <docker host ip>:1080  https://ipinfo.io``` - result must show docker host ip (for bridged network)
 
 or
 
-```docker run --rm curlimages/curl:7.65.3 -s --socks5 <docker host ip>:1080 https://ifcfg.co```
+```docker run --rm curlimages/curl:7.65.3 -s --socks5 <docker host ip>:1080 https://ipinfo.io```
 
 ## With authentication
 
-```curl --socks5 <docker host ip>:1080 -U <PROXY_USER>:<PROXY_PASSWORD> http://ifcfg.co```
+```curl --socks5 <docker host ip>:1080 -U <PROXY_USER>:<PROXY_PASSWORD> https://ipinfo.io```
 
 or
 
-```docker run --rm curlimages/curl:7.65.3 -s --socks5 <PROXY_USER>:<PROXY_PASSWORD>@<docker host ip>:1080 http://ifcfg.co```
+```docker run --rm curlimages/curl:7.65.3 -s --socks5 <PROXY_USER>:<PROXY_PASSWORD>@<docker host ip>:1080 https://ipinfo.io```
 
 # Authors
 

go.mod

@@ -1,10 +1,12 @@
 module github.com/serjs/socks5-server
 
-go 1.19
+go 1.24.0
 
 require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/caarlos0/env/v6 v6.10.1
 )
 
-require golang.org/x/net v0.1.0 // indirect
+require golang.org/x/net v0.46.0
+
+replace github.com/armon/go-socks5 => github.com/serjs/go-socks5 v0.0.0-20250923183437-3920b97ee0d2

go.sum

@@ -1,6 +1,6 @@
-github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
-github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/caarlos0/env/v6 v6.10.1 h1:t1mPSxNpei6M5yAeu1qtRdPAK29Nbcf/n3G7x+b3/II=
 github.com/caarlos0/env/v6 v6.10.1/go.mod h1:hvp/ryKXKipEkcuYjs9mI4bBCg+UI0Yhgm5Zu0ddvwc=
-golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+github.com/serjs/go-socks5 v0.0.0-20250923183437-3920b97ee0d2 h1:dIXY/Lrkd1rGXcN60Fc0M2x0p5/C2XcbBbtPCvVvAa4=
+github.com/serjs/go-socks5 v0.0.0-20250923183437-3920b97ee0d2/go.mod h1:N2PhU16m3olAb71DduLys4mYR3oQboD4uLJmSXCSuMA=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=

server.go

@@ -4,7 +4,6 @@ import (
 	"log"
 	"net"
 	"os"
-
 	"github.com/armon/go-socks5"
 	"github.com/caarlos0/env/v6"
 )
@@ -15,6 +14,8 @@ type params struct {
 	Port            string    `env:"PROXY_PORT" envDefault:"1080"`
 	AllowedDestFqdn string    `env:"ALLOWED_DEST_FQDN" envDefault:""`
 	AllowedIPs      []string  `env:"ALLOWED_IPS" envSeparator:"," envDefault:""`
+	ListenIP 		string 	  `env:"PROXY_LISTEN_IP" envDefault:"0.0.0.0"`
+	RequireAuth		bool      `env:"REQUIRE_AUTH" envDefault:"true"`
 }
 
 func main() {
@@ -30,12 +31,17 @@ func main() {
 		Logger: log.New(os.Stdout, "", log.LstdFlags),
 	}
 
-	if cfg.User+cfg.Password != "" {
+	if cfg.RequireAuth {
+		if cfg.User == "" || cfg.Password == "" {
+			log.Fatalln("Error: REQUIRE_AUTH is true, but PROXY_USER and PROXY_PASSWORD are not set.  The application will now exit.")
+		}
 		creds := socks5.StaticCredentials{
-			os.Getenv("PROXY_USER"): os.Getenv("PROXY_PASSWORD"),
+			cfg.User: cfg.Password,
 		}
 		cator := socks5.UserPassAuthenticator{Credentials: creds}
 		socks5conf.AuthMethods = []socks5.Authenticator{cator}
+	} else {
+		log.Println("Warning: Running the proxy server without authentication. This is NOT recommended for public servers.")
 	}
 
 	if cfg.AllowedDestFqdn != "" {
@@ -56,8 +62,14 @@ func main() {
 		server.SetIPWhitelist(whitelist)
 	}
 
-	log.Printf("Start listening proxy service on port %s\n", cfg.Port)
-	if err := server.ListenAndServe("tcp", ":"+cfg.Port); err != nil {
+	listenAddr := ":" + cfg.Port
+	if cfg.ListenIP != "" {
+		listenAddr = cfg.ListenIP + ":" + cfg.Port
+	}
+
+
+	log.Printf("Start listening proxy service on %s\n", listenAddr)
+	if err := server.ListenAndServe("tcp", listenAddr); err != nil {
 		log.Fatal(err)
 	}
 }