golang.org/x/net v0.17.0: proxy.SOCKS5

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify proxy.SOCKS5 in pkg:golang/golang.org/x/net@v0.17.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/net@v0.17.0
Demonstrate these symbols/APIs:
  - proxy.SOCKS5

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:57ca81512c9a36107b17fb026ea0afe677d6c5893dfdb2583df35f4064555651","contract":["proxy.SOCKS5 creates a SOCKS5 dialer for TCP network with optional direct forwarder and nil auth","proxy.SOCKS5 creates an authenticated SOCKS5 dialer with username and password credentials","proxy.SOCKS5 dialer successfully establishes connection and proxies data to target server"],"goal":"verify proxy.SOCKS5 in pkg:golang/golang.org/x/net@v0.17.0","kind":"HOW","packages":["pkg:golang/golang.org/x/net@v0.17.0"],"schemaVersion":1,"symbols":["proxy.SOCKS5"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/net@v0.17.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/net@v0.17.0","symbols":["proxy.SOCKS5"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.25.0

require golang.org/x/net v0.17.0

golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=

package main

import (
	"bufio"
	"fmt"
	"io"
	"log"
	"net"
	"time"

	"golang.org/x/net/proxy"
)

type mockSOCKS5Server struct {
	listener net.Listener
	user     string
	password string
}

func startMockSOCKS5(user, password string) (*mockSOCKS5Server, error) {
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		return nil, err
	}
	s := &mockSOCKS5Server{listener: ln, user: user, password: password}
	go s.serve()
	return s, nil
}

func (s *mockSOCKS5Server) Addr() string {
	return s.listener.Addr().String()
}

func (s *mockSOCKS5Server) Close() error {
	return s.listener.Close()
}

func (s *mockSOCKS5Server) serve() {
	for {
		conn, err := s.listener.Accept()
		if err != nil {
			return
		}
		go s.handleConn(conn)
	}
}

func (s *mockSOCKS5Server) handleConn(c net.Conn) {
	defer c.Close()

	r := bufio.NewReader(c)

	// SOCKS version & auth negotiation
	ver, err := r.ReadByte()
	if err != nil || ver != 5 {
		return
	}
	nmethods, err := r.ReadByte()
	if err != nil || nmethods == 0 {
		return
	}
	methods := make([]byte, int(nmethods))
	if _, err := io.ReadFull(r, methods); err != nil {
		return
	}

	var chosenMethod byte = 0xFF
	if s.user == "" && s.password == "" {
		for _, m := range methods {
			if m == 0x00 {
				chosenMethod = 0x00
				break
			}
		}
	} else {
		for _, m := range methods {
			if m == 0x02 {
				chosenMethod = 0x02
				break
			}
		}
	}

	if _, err := c.Write([]byte{5, chosenMethod}); err != nil || chosenMethod == 0xFF {
		return
	}

	// Username/Password authentication
	if chosenMethod == 0x02 {
		authVer, err := r.ReadByte()
		if err != nil || authVer != 1 {
			return
		}
		uLen, err := r.ReadByte()
		if err != nil {
			return
		}
		userBytes := make([]byte, int(uLen))
		if _, err := io.ReadFull(r, userBytes); err != nil {
			return
		}
		pLen, err := r.ReadByte()
		if err != nil {
			return
		}
		passBytes := make([]byte, int(pLen))
		if _, err := io.ReadFull(r, passBytes); err != nil {
			return
		}

		if string(userBytes) != s.user || string(passBytes) != s.password {
			c.Write([]byte{1, 1})
			return
		}
		if _, err := c.Write([]byte{1, 0}); err != nil {
			return
		}
	}

	// Connect request
	reqVer, err := r.ReadByte()
	if err != nil || reqVer != 5 {
		return
	}
	cmd, err := r.ReadByte()
	if err != nil || cmd != 1 {
		c.Write([]byte{5, 7, 0, 1, 0, 0, 0, 0, 0, 0})
		return
	}
	_, err = r.ReadByte() // RSV
	if err != nil {
		return
	}
	atyp, err := r.ReadByte()
	if err != nil {
		return
	}

	var host string
	switch atyp {
	case 1: // IPv4
		var ip [4]byte
		if _, err := io.ReadFull(r, ip[:]); err != nil {
			return
		}
		host = net.IP(ip[:]).String()
	case 3: // Domain name
		dLen, err := r.ReadByte()
		if err != nil {
			return
		}
		dom := make([]byte, int(dLen))
		if _, err := io.ReadFull(r, dom); err != nil {
			return
		}
		host = string(dom)
	case 4: // IPv6
		var ip [16]byte
		if _, err := io.ReadFull(r, ip[:]); err != nil {
			return
		}
		host = net.IP(ip[:]).String()
	default:
		c.Write([]byte{5, 8, 0, 1, 0, 0, 0, 0, 0, 0})
		return
	}

	var portBytes [2]byte
	if _, err := io.ReadFull(r, portBytes[:]); err != nil {
		return
	}
	port := int(portBytes[0])<<8 | int(portBytes[1])
	targetAddr := fmt.Sprintf("%s:%d", host, port)

	destConn, err := net.DialTimeout("tcp", targetAddr, 2*time.Second)
	if err != nil {
		c.Write([]byte{5, 5, 0, 1, 0, 0, 0, 0, 0, 0})
		return
	}
	defer destConn.Close()

	if _, err := c.Write([]byte{5, 0, 0, 1, 127, 0, 0, 1, 0, 0}); err != nil {
		return
	}

	done := make(chan struct{}, 2)
	go func() {
		io.Copy(destConn, r)
		if cw, ok := destConn.(interface{ CloseWrite() error }); ok {
			cw.CloseWrite()
		}
		done <- struct{}{}
	}()
	go func() {
		io.Copy(c, destConn)
		if cw, ok := c.(interface{ CloseWrite() error }); ok {
			cw.CloseWrite()
		}
		done <- struct{}{}
	}()
	<-done
}

func startEchoServer() (net.Listener, error) {
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		return nil, err
	}
	go func() {
		for {
			conn, err := ln.Accept()
			if err != nil {
				return
			}
			go func(c net.Conn) {
				defer c.Close()
				io.Copy(c, c)
			}(conn)
		}
	}()
	return ln, nil
}

func main() {
	echoServer, err := startEchoServer()
	if err != nil {
		log.Fatalf("failed to start echo server: %v", err)
	}
	defer echoServer.Close()

	socksServer, err := startMockSOCKS5("demouser", "demopass")
	if err != nil {
		log.Fatalf("failed to start socks5 server: %v", err)
	}
	defer socksServer.Close()

	auth := &proxy.Auth{
		User:     "demouser",
		Password: "demopass",
	}

	dialer, err := proxy.SOCKS5("tcp", socksServer.Addr(), auth, proxy.Direct)
	if err != nil {
		log.Fatalf("failed to create socks5 dialer: %v", err)
	}

	conn, err := dialer.Dial("tcp", echoServer.Addr().String())
	if err != nil {
		log.Fatalf("failed to dial through socks5 proxy: %v", err)
	}
	defer conn.Close()

	message := "Hello SOCKS5 Proxy\n"
	if _, err := fmt.Fprint(conn, message); err != nil {
		log.Fatalf("failed to send data: %v", err)
	}

	reader := bufio.NewReader(conn)
	reply, err := reader.ReadString('\n')
	if err != nil {
		log.Fatalf("failed to read reply: %v", err)
	}

	fmt.Printf("Received echo through SOCKS5 proxy: %s", reply)
}

{
  "schemaVersion": 1,
  "goal": "verify proxy.SOCKS5 in pkg:golang/golang.org/x/net@v0.17.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/net@v0.17.0"
  ],
  "symbols": [
    "proxy.SOCKS5"
  ]
}

package main

import (
	"bufio"
	"bytes"
	"context"
	"fmt"
	"io"
	"net"
	"os"
	"time"

	"golang.org/x/net/proxy"
)

type mockSOCKS5Server struct {
	listener net.Listener
	user     string
	password string
}

func startMockSOCKS5(user, password string) (*mockSOCKS5Server, error) {
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		return nil, err
	}
	s := &mockSOCKS5Server{listener: ln, user: user, password: password}
	go s.serve()
	return s, nil
}

func (s *mockSOCKS5Server) Addr() string {
	return s.listener.Addr().String()
}

func (s *mockSOCKS5Server) Close() error {
	return s.listener.Close()
}

func (s *mockSOCKS5Server) serve() {
	for {
		conn, err := s.listener.Accept()
		if err != nil {
			return
		}
		go s.handleConn(conn)
	}
}

func (s *mockSOCKS5Server) handleConn(c net.Conn) {
	defer c.Close()

	r := bufio.NewReader(c)

	// SOCKS version & auth negotiation
	ver, err := r.ReadByte()
	if err != nil || ver != 5 {
		return
	}
	nmethods, err := r.ReadByte()
	if err != nil || nmethods == 0 {
		return
	}
	methods := make([]byte, int(nmethods))
	if _, err := io.ReadFull(r, methods); err != nil {
		return
	}

	var chosenMethod byte = 0xFF
	if s.user == "" && s.password == "" {
		for _, m := range methods {
			if m == 0x00 {
				chosenMethod = 0x00
				break
			}
		}
	} else {
		for _, m := range methods {
			if m == 0x02 {
				chosenMethod = 0x02
				break
			}
		}
	}

	if _, err := c.Write([]byte{5, chosenMethod}); err != nil || chosenMethod == 0xFF {
		return
	}

	// Username/Password authentication
	if chosenMethod == 0x02 {
		authVer, err := r.ReadByte()
		if err != nil || authVer != 1 {
			return
		}
		uLen, err := r.ReadByte()
		if err != nil {
			return
		}
		userBytes := make([]byte, int(uLen))
		if _, err := io.ReadFull(r, userBytes); err != nil {
			return
		}
		pLen, err := r.ReadByte()
		if err != nil {
			return
		}
		passBytes := make([]byte, int(pLen))
		if _, err := io.ReadFull(r, passBytes); err != nil {
			return
		}

		if string(userBytes) != s.user || string(passBytes) != s.password {
			c.Write([]byte{1, 1})
			return
		}
		if _, err := c.Write([]byte{1, 0}); err != nil {
			return
		}
	}

	// Connect request
	reqVer, err := r.ReadByte()
	if err != nil || reqVer != 5 {
		return
	}
	cmd, err := r.ReadByte()
	if err != nil || cmd != 1 {
		c.Write([]byte{5, 7, 0, 1, 0, 0, 0, 0, 0, 0})
		return
	}
	_, err = r.ReadByte() // RSV
	if err != nil {
		return
	}
	atyp, err := r.ReadByte()
	if err != nil {
		return
	}

	var host string
	switch atyp {
	case 1: // IPv4
		var ip [4]byte
		if _, err := io.ReadFull(r, ip[:]); err != nil {
			return
		}
		host = net.IP(ip[:]).String()
	case 3: // Domain name
		dLen, err := r.ReadByte()
		if err != nil {
			return
		}
		dom := make([]byte, int(dLen))
		if _, err := io.ReadFull(r, dom); err != nil {
			return
		}
		host = string(dom)
	case 4: // IPv6
		var ip [16]byte
		if _, err := io.ReadFull(r, ip[:]); err != nil {
			return
		}
		host = net.IP(ip[:]).String()
	default:
		c.Write([]byte{5, 8, 0, 1, 0, 0, 0, 0, 0, 0})
		return
	}

	var portBytes [2]byte
	if _, err := io.ReadFull(r, portBytes[:]); err != nil {
		return
	}
	port := int(portBytes[0])<<8 | int(portBytes[1])
	targetAddr := fmt.Sprintf("%s:%d", host, port)

	destConn, err := net.DialTimeout("tcp", targetAddr, 2*time.Second)
	if err != nil {
		c.Write([]byte{5, 5, 0, 1, 0, 0, 0, 0, 0, 0})
		return
	}
	defer destConn.Close()

	if _, err := c.Write([]byte{5, 0, 0, 1, 127, 0, 0, 1, 0, 0}); err != nil {
		return
	}

	done := make(chan struct{}, 2)
	go func() {
		io.Copy(destConn, r)
		if cw, ok := destConn.(interface{ CloseWrite() error }); ok {
			cw.CloseWrite()
		}
		done <- struct{}{}
	}()
	go func() {
		io.Copy(c, destConn)
		if cw, ok := c.(interface{ CloseWrite() error }); ok {
			cw.CloseWrite()
		}
		done <- struct{}{}
	}()
	<-done
}

func startEchoServer() (net.Listener, error) {
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		return nil, err
	}
	go func() {
		for {
			conn, err := ln.Accept()
			if err != nil {
				return
			}
			go func(c net.Conn) {
				defer c.Close()
				io.Copy(c, c)
			}(conn)
		}
	}()
	return ln, nil
}

func main() {
	// Assertion 1: proxy.SOCKS5 creates a SOCKS5 dialer for TCP network with optional direct forwarder and nil auth
	{
		echoServer, err := startEchoServer()
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: start echo server: %v\n", err)
			os.Exit(1)
		}
		defer echoServer.Close()

		socksServer, err := startMockSOCKS5("", "")
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: start socks5 server: %v\n", err)
			os.Exit(1)
		}
		defer socksServer.Close()

		dialer, err := proxy.SOCKS5("tcp", socksServer.Addr(), nil, proxy.Direct)
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: proxy.SOCKS5 returned error: %v\n", err)
			os.Exit(1)
		}
		if dialer == nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: dialer is nil\n")
			os.Exit(1)
		}

		conn, err := dialer.Dial("tcp", echoServer.Addr().String())
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: dial failed: %v\n", err)
			os.Exit(1)
		}
		defer conn.Close()

		payload := []byte("ping-unauth\n")
		if _, err := conn.Write(payload); err != nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: write payload: %v\n", err)
			os.Exit(1)
		}

		buf := make([]byte, len(payload))
		if _, err := io.ReadFull(conn, buf); err != nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: read response: %v\n", err)
			os.Exit(1)
		}
		if !bytes.Equal(buf, payload) {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: got %q, want %q\n", string(buf), string(payload))
			os.Exit(1)
		}
	}

	// Assertion 2: proxy.SOCKS5 creates an authenticated SOCKS5 dialer with username and password credentials
	{
		echoServer, err := startEchoServer()
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: start echo server: %v\n", err)
			os.Exit(1)
		}
		defer echoServer.Close()

		socksServer, err := startMockSOCKS5("user1", "pass1")
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: start socks5 server: %v\n", err)
			os.Exit(1)
		}
		defer socksServer.Close()

		auth := &proxy.Auth{
			User:     "user1",
			Password: "pass1",
		}
		dialer, err := proxy.SOCKS5("tcp", socksServer.Addr(), auth, proxy.Direct)
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: proxy.SOCKS5 returned error: %v\n", err)
			os.Exit(1)
		}

		conn, err := dialer.Dial("tcp", echoServer.Addr().String())
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: dial with valid auth failed: %v\n", err)
			os.Exit(1)
		}
		defer conn.Close()

		payload := []byte("ping-auth\n")
		if _, err := conn.Write(payload); err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: write payload: %v\n", err)
			os.Exit(1)
		}

		buf := make([]byte, len(payload))
		if _, err := io.ReadFull(conn, buf); err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: read response: %v\n", err)
			os.Exit(1)
		}
		if !bytes.Equal(buf, payload) {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: got %q, want %q\n", string(buf), string(payload))
			os.Exit(1)
		}

		// Test bad credentials reject
		badAuth := &proxy.Auth{
			User:     "user1",
			Password: "wrongpassword",
		}
		badDialer, err := proxy.SOCKS5("tcp", socksServer.Addr(), badAuth, proxy.Direct)
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 2 failed: badDialer create failed: %v\n", err)
			os.Exit(1)
		}
		badConn, err := badDialer.Dial("tcp", echoServer.Addr().String())
		if err == nil {
			badConn.Close()
			fmt.Fprintf(os.Stderr, "assertion 2 failed: dial with bad auth should have failed\n")
			os.Exit(1)
		}
	}

	// Assertion 3: proxy.SOCKS5 dialer successfully establishes connection and proxies data to target server
	{
		echoServer, err := startEchoServer()
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: start echo server: %v\n", err)
			os.Exit(1)
		}
		defer echoServer.Close()

		socksServer, err := startMockSOCKS5("", "")
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: start socks5 server: %v\n", err)
			os.Exit(1)
		}
		defer socksServer.Close()

		dialer, err := proxy.SOCKS5("tcp", socksServer.Addr(), nil, proxy.Direct)
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: proxy.SOCKS5 failed: %v\n", err)
			os.Exit(1)
		}

		ctxDialer, ok := dialer.(proxy.ContextDialer)
		if !ok {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: dialer does not implement proxy.ContextDialer\n")
			os.Exit(1)
		}

		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
		defer cancel()

		conn, err := ctxDialer.DialContext(ctx, "tcp", echoServer.Addr().String())
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: DialContext failed: %v\n", err)
			os.Exit(1)
		}
		defer conn.Close()

		testData := []byte("SOCKS5 Context Dial Test Data\n")
		if _, err := conn.Write(testData); err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: write testData: %v\n", err)
			os.Exit(1)
		}

		resp := make([]byte, len(testData))
		if _, err := io.ReadFull(conn, resp); err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: read resp: %v\n", err)
			os.Exit(1)
		}
		if !bytes.Equal(resp, testData) {
			fmt.Fprintf(os.Stderr, "assertion 3 failed: got %q, want %q\n", string(resp), string(testData))
			os.Exit(1)
		}
	}

	fmt.Println("PASS: proxy.SOCKS5 contract passed")
}