Documentation
¶
Overview ¶
Package mixnet opens TCP streams through the Nym mixnet.
It speaks SOCKS5 (RFC 1928, no auth) to a local nym-socks5-client, which turns every stream into Sphinx packets that cross the mixnet to an exit gateway's network requester. Nothing in this package ever opens a direct connection to a destination: if the SOCKS5 proxy is not listening, dialing fails with ErrProxyUnreachable and there is no clearnet fallback.
Index ¶
- Constants
- Variables
- func EncodeAddr(host string) ([]byte, error)
- func HostPort(s string, defPort int) (string, error)
- func ParseProxy(spec string) (string, error)
- type Dialer
- func (d *Dialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error)
- func (d *Dialer) DialTLS(ctx context.Context, addr string, cfg *tls.Config) (*tls.Conn, error)
- func (d *Dialer) HTTPClient(timeout time.Duration) *http.Client
- func (d *Dialer) Resolve(ctx context.Context, host string) ([]string, error)
- type SocksError
- type Tracer
Constants ¶
const ( // DNSDoH resolves names with DNS-over-HTTPS sent *through the mixnet* // (Cloudflare 1.1.1.1, then Google 8.8.8.8, both reached by IP literal), // then asks the exit for an IPv4 address. Some exit gateways have broken // IPv6 routes; when the exit resolves a dual-stack name itself it can pick // an unreachable AAAA record and stall (seen live with mixpool, 2026-10-10). DNSDoH = "doh" // DNSExit hands the hostname to the exit gateway's network requester. DNSExit = "exit" )
DNS modes.
Variables ¶
var ErrProxyUnreachable = errors.New("no SOCKS5 proxy (nym-socks5-client) listening; refusing to fall back to a direct connection")
ErrProxyUnreachable means no SOCKS5 proxy is listening. Callers must not fall back to a direct connection.
Functions ¶
func EncodeAddr ¶
EncodeAddr encodes host as SOCKS5 ATYP + address bytes. Hostnames are sent as names (ATYP 3) so they are never resolved locally.
func HostPort ¶
HostPort normalises "host", "host:port" or "https://host:port" to host:port, using defPort when none is given.
func ParseProxy ¶
ParseProxy accepts "host:port", "socks5://host:port", "socks5h://host:port", or a bare host (port 1080).
Types ¶
type Dialer ¶
type Dialer struct {
Proxy string // host:port of nym-socks5-client
DNS string // DNSDoH (default) or DNSExit
Timeout time.Duration // per-stream SOCKS handshake timeout (mixnet round trips are slow)
Trace Tracer
// RootCAs for the DoH resolvers (nil = system roots). Tests override it.
RootCAs *x509.CertPool
// Resolvers overrides the DoH resolver list (tests).
Resolvers []string
// contains filtered or unexported fields
}
Dialer opens TCP streams through the Nym mixnet (SOCKS5 to nym-socks5-client). The local resolver is never used: names are resolved over the mixnet.
func (*Dialer) DialContext ¶
DialContext opens a TCP stream to addr ("host:port") through the mixnet. It has the signature net/http and gRPC expect.
func (*Dialer) DialTLS ¶
DialTLS opens a stream through the mixnet and runs TLS end to end with the destination: the exit gateway only relays ciphertext. The certificate is verified against serverName (defaults to the host in addr).
func (*Dialer) HTTPClient ¶
HTTPClient returns an http.Client whose every connection goes through the mixnet. Proxy settings from the environment are ignored on purpose.
type SocksError ¶
SocksError is a refusal or protocol error reported by the SOCKS5 proxy.
func (*SocksError) Error ¶
func (e *SocksError) Error() string
Source Files