SOCKS4/4a/5 proxy support in SocketsHttpHandler

src/libraries/System.Net.Http/src/System.Net.Http.csproj

@@ -176,6 +176,7 @@
     <Compile Include="System\Net\Http\HttpTelemetry.AnyOS.cs" />
     <Compile Include="System\Net\Http\HttpUtilities.AnyOS.cs" />
     <Compile Include="System\Net\Http\SocketsHttpHandler\SystemProxyInfo.cs" />
+    <Compile Include="System\Net\Http\SocketsHttpHandler\SocksHelper.cs" />
     <Compile Include="$(CommonPath)System\Net\NTAuthentication.Common.cs"
              Link="Common\System\Net\NTAuthentication.Common.cs" />
     <Compile Include="$(CommonPath)System\Net\ContextFlagsPal.cs"

src/libraries/System.Net.Http/src/System/Net/Http/HttpUtilities.cs

@@ -34,6 +34,14 @@ internal static bool IsNonSecureWebSocketScheme(string scheme) =>
         internal static bool IsSecureWebSocketScheme(string scheme) =>
             string.Equals(scheme, "wss", StringComparison.OrdinalIgnoreCase);
 
+        internal static bool IsSupportedProxyScheme(string scheme) =>
+            string.Equals(scheme, "http", StringComparison.OrdinalIgnoreCase) || IsSocksScheme(scheme);
+
+        internal static bool IsSocksScheme(string scheme) =>
+            string.Equals(scheme, "socks5", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(scheme, "socks4a", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(scheme, "socks4", StringComparison.OrdinalIgnoreCase);
+
         // Always specify TaskScheduler.Default to prevent us from using a user defined TaskScheduler.Current.
         //
         // Since we're not doing any CPU and/or I/O intensive operations, continue on the same thread.

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnectionKind.cs

@@ -10,6 +10,8 @@ internal enum HttpConnectionKind : byte
         Proxy,              // HTTP proxy usage for non-secure (HTTP) requests.
         ProxyTunnel,        // Non-secure websocket (WS) connection using CONNECT tunneling through proxy.
         SslProxyTunnel,     // HTTP proxy usage for secure (HTTPS/WSS) requests using SSL and proxy CONNECT.
-        ProxyConnect        // Connection used for proxy CONNECT. Tunnel will be established on top of this.
+        ProxyConnect,       // Connection used for proxy CONNECT. Tunnel will be established on top of this.
+        SocksTunnel,        // SOCKS proxy usage for HTTP requests.
+        SslSocksTunnel      // SOCKS proxy usage for HTTPS requests.
     }
 }

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnectionPool.cs

@@ -178,8 +178,26 @@ public HttpConnectionPool(HttpConnectionPoolManager poolManager, HttpConnectionK
                     _http3Enabled = false;
                     break;
 
+                case HttpConnectionKind.SocksTunnel:
+                    Debug.Assert(host != null);
+                    Debug.Assert(port != 0);
+                    Debug.Assert(sslHostName == null);
+                    Debug.Assert(proxyUri != null);
+
+                    _http3Enabled = false;
+                    break;
+
+                case HttpConnectionKind.SslSocksTunnel:
+                    Debug.Assert(host != null);
+                    Debug.Assert(port != 0);
+                    Debug.Assert(sslHostName != null);
+                    Debug.Assert(proxyUri != null);
+
+                    _http3Enabled = false; // TODO: SOCKS supports UDP and may be used for HTTP3
+                    break;
+
                 default:
-                    Debug.Fail("Unkown HttpConnectionKind in HttpConnectionPool.ctor");
+                    Debug.Fail("Unknown HttpConnectionKind in HttpConnectionPool.ctor");
                     break;
             }
 
@@ -289,7 +307,7 @@ private static SslClientAuthenticationOptions ConstructSslOptions(HttpConnection
         public HttpAuthority? OriginAuthority => _originAuthority;
         public HttpConnectionSettings Settings => _poolManager.Settings;
         public HttpConnectionKind Kind => _kind;
-        public bool IsSecure => _kind == HttpConnectionKind.Https || _kind == HttpConnectionKind.SslProxyTunnel;
+        public bool IsSecure => _kind == HttpConnectionKind.Https || _kind == HttpConnectionKind.SslProxyTunnel || _kind == HttpConnectionKind.SslSocksTunnel;
         public bool AnyProxyKind => (_proxyUri != null);
         public Uri? ProxyUri => _proxyUri;
         public ICredentials? ProxyCredentials => _poolManager.ProxyCredentials;
@@ -312,10 +330,10 @@ public byte[] Http2AltSvcOriginUri
 
                     Debug.Assert(_originAuthority != null);
                     sb
-                        .Append(_kind == HttpConnectionKind.Https ? "https://" : "http://")
+                        .Append(IsSecure ? "https://" : "http://")
                         .Append(_originAuthority.IdnHost);
 
-                    if (_originAuthority.Port != (_kind == HttpConnectionKind.Https ? DefaultHttpsPort : DefaultHttpPort))
+                    if (_originAuthority.Port != (IsSecure ? DefaultHttpsPort : DefaultHttpPort))
                     {
                         sb
                             .Append(':')
@@ -541,7 +559,7 @@ private static bool IsUsableHttp11Connection(HttpConnection connection, long now
         private async ValueTask<(HttpConnectionBase? connection, bool isNewConnection, HttpResponseMessage? failureResponse)>
             GetHttp2ConnectionAsync(HttpRequestMessage request, bool async, CancellationToken cancellationToken)
         {
-            Debug.Assert(_kind == HttpConnectionKind.Https || _kind == HttpConnectionKind.SslProxyTunnel || _kind == HttpConnectionKind.Http);
+            Debug.Assert(_kind == HttpConnectionKind.Https || _kind == HttpConnectionKind.SslProxyTunnel || _kind == HttpConnectionKind.Http || _kind == HttpConnectionKind.SocksTunnel || _kind == HttpConnectionKind.SslSocksTunnel);
 
             // See if we have an HTTP2 connection
             Http2Connection? http2Connection = GetExistingHttp2Connection();
@@ -603,7 +621,7 @@ private static bool IsUsableHttp11Connection(HttpConnection connection, long now
 
                     sslStream = stream as SslStream;
 
-                    if (_kind == HttpConnectionKind.Http)
+                    if (!IsSecure)
                     {
                         http2Connection = await ConstructHttp2ConnectionAsync(stream, request, cancellationToken).ConfigureAwait(false);
 
@@ -1130,14 +1148,14 @@ internal void BlocklistAuthority(HttpAuthority badAuthority)
             Debug.Assert(_altSvcBlocklistTimerCancellation != null);
             if (added)
             {
-               _ = Task.Delay(AltSvcBlocklistTimeoutInMilliseconds)
-                    .ContinueWith(t =>
-                    {
-                        lock (altSvcBlocklist)
-                        {
-                            altSvcBlocklist.Remove(badAuthority);
-                        }
-                    }, _altSvcBlocklistTimerCancellation.Token, TaskContinuationOptions.ExecuteSynchronously, TaskScheduler.Default);
+                _ = Task.Delay(AltSvcBlocklistTimeoutInMilliseconds)
+                     .ContinueWith(t =>
+                     {
+                         lock (altSvcBlocklist)
+                         {
+                             altSvcBlocklist.Remove(badAuthority);
+                         }
+                     }, _altSvcBlocklistTimerCancellation.Token, TaskContinuationOptions.ExecuteSynchronously, TaskScheduler.Default);
             }
 
             if (disabled)
@@ -1252,6 +1270,30 @@ public ValueTask<HttpResponseMessage> SendAsync(HttpRequestMessage request, bool
                             return (null, null, response);
                         }
                         break;
+
+                    case HttpConnectionKind.SocksTunnel:
+                    case HttpConnectionKind.SslSocksTunnel:
+                        Debug.Assert(_originAuthority != null);
+                        Debug.Assert(_proxyUri != null);
+                        stream = await ConnectToTcpHostAsync(_proxyUri.IdnHost, _proxyUri.Port, request, async, cancellationToken).ConfigureAwait(false);
+
+                        if (string.Equals(_proxyUri.Scheme, "socks5", StringComparison.OrdinalIgnoreCase))
+                        {
+                            await SocksHelper.EstablishSocks5TunnelAsync(stream, _originAuthority.IdnHost, _originAuthority.Port, _proxyUri, ProxyCredentials, cancellationToken).ConfigureAwait(false);
+                        }
+                        else if (string.Equals(_proxyUri.Scheme, "socks4a", StringComparison.OrdinalIgnoreCase))
+                        {
+                            await SocksHelper.EstablishSocks4TunnelAsync(stream, true, _originAuthority.IdnHost, _originAuthority.Port, _proxyUri, ProxyCredentials, cancellationToken).ConfigureAwait(false);
+                        }
+                        else if (string.Equals(_proxyUri.Scheme, "socks4", StringComparison.OrdinalIgnoreCase))
+                        {
+                            await SocksHelper.EstablishSocks4TunnelAsync(stream, false, _originAuthority.IdnHost, _originAuthority.Port, _proxyUri, ProxyCredentials, cancellationToken).ConfigureAwait(false);
+                        }
+                        else
+                        {
+                            Debug.Fail("Bad socks version.");
+                        }
+                        break;
                 }
 
                 Debug.Assert(stream != null);

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnectionPoolManager.cs

@@ -282,8 +282,20 @@ private HttpConnectionKey GetConnectionKey(HttpRequestMessage request, Uri? prox
 
             if (proxyUri != null)
             {
-                Debug.Assert(HttpUtilities.IsSupportedNonSecureScheme(proxyUri.Scheme));
-                if (sslHostName == null)
+                Debug.Assert(HttpUtilities.IsSupportedProxyScheme(proxyUri.Scheme));
+                if (HttpUtilities.IsSocksScheme(proxyUri.Scheme))
+                {
+                    // Socks proxy
+                    if (sslHostName != null)
+                    {
+                        return new HttpConnectionKey(HttpConnectionKind.SslSocksTunnel, uri.IdnHost, uri.Port, sslHostName, proxyUri, identity);
+                    }
+                    else
+                    {
+                        return new HttpConnectionKey(HttpConnectionKind.SocksTunnel, uri.IdnHost, uri.Port, null, proxyUri, identity);
+                    }
+                }
+                else if (sslHostName == null)
                 {
                     if (HttpUtilities.IsNonSecureWebSocketScheme(uri.Scheme))
                     {
@@ -394,7 +406,7 @@ public ValueTask<HttpResponseMessage> SendAsync(HttpRequestMessage request, bool
                 if (NetEventSource.Log.IsEnabled()) NetEventSource.Error(this, $"Exception from {_proxy.GetType().Name}.GetProxy({request.RequestUri}): {ex}");
             }
 
-            if (proxyUri != null && proxyUri.Scheme != UriScheme.Http)
+            if (proxyUri != null && !HttpUtilities.IsSupportedProxyScheme(proxyUri.Scheme))
             {
                 throw new NotSupportedException(SR.net_http_invalid_proxy_scheme);
             }