Alawn/ShadowsocksX-NG
1
0
Fork 0
mirror of https://github.com/shadowsocks/ShadowsocksX-NG.git synced 2026-11-15 10:44:21 +00:00
Code Releases Activity

feat(system-proxy): write HTTP/HTTPS alongside SOCKS

Browse Source 
Apps honoring only the HTTP proxy family were never proxied under
the SOCKS-only projection. Point system HTTP and HTTPS at the
always-on sslocal HTTP inbound (CONNECT); reject documents lacking
that inbound instead of aiming at port 0. See ADR 0012.
This commit is contained in:
Qiu Yuzhou
2026-09-27 15:49:03 +08:00
parent effae048b8
commit 88af8bfdf2
13 changed files with 129 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/0012-system-proxy-covers-http-https.md
+7
View File
@@ -0,0 +1,7 @@
# Write HTTP and HTTPS system proxies alongside SOCKS
**Status**: accepted
Enabling the system proxy switch writes the macOS HTTP and HTTPS proxy entries in addition to the SOCKS entry (ADR-0007 had disabled the HTTP/HTTPS families and projected a SOCKS target only). All three families point at 2.0's own local inbounds: SOCKS at the SOCKS5 listener, and HTTP and HTTPS at the always-on local HTTP inbound — shadowsocks-rust serves HTTP CONNECT directly, so no Privoxy-style bridge returns. HTTPS and HTTP share one endpoint because both are served by the same CONNECT-capable inbound. Exceptions, PAC/auto-discovery suppression, and the ownership snapshot/restore protocol are unchanged.
The launch health gate already probes every configured inbound, so the HTTP endpoint must be reachable before any system proxy write happens. A runtime document without a usable HTTP inbound port is rejected by the mode projection (`invalidHTTPPort`) instead of pointing the system at an invalid port. NG2 has not shipped, so no migration of previously applied system-proxy state is required: the next convergence writes the new shape, and restore keeps returning the pre-app snapshot.