Repository navigation
feat: --proxy and --source-addr on every connecting command; go-modbus v1.14.2 - #32
Merged
Merged
Conversation
…s v1.14.1 Every client command (sunspec included) and discover take --proxy (socks5:// or socks5h://, RFC 1928 CONNECT, no auth) and --source-addr, set as modbus.Config.Dialer. --proxy applies to tcp, tcp+tls, rtuovertcp and asciiovertcp; with udp or rtuoverudp it is invalid input, as is either flag with rtu:// or ascii://, and discover --resolve-mac with --proxy. --source-addr binds a UDP address for udp transports. TLS verification stays against the URL host. The SOCKS5 dialer and the scripted test proxy are ported from otfabric/s7commctl#23. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
boeboe
changed the title
boeboe
added a commit
that referenced
this pull request
Nov 9, 2026
Invalid --proxy/--source-addr in buildDeviceClientConfig, openDeviceLink, openRecordingLink and CollectDiscover, the dialer set or left nil, and CollectDiscover through the test proxy (follow-up to #32). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every command that connects to a device (all
clientcommands,client sunspecincluded, anddiscover) gets--proxyand--source-addr, set as go-modbus v1.14.2'sConfig.Dialer. Modelled on otfabric/s7commctl#23.--proxy socks5://host:port/socks5h://(MODBUSCTL_PROXY): SOCKS5 CONNECT (RFC 1928), no auth, no new dependency (internal/netdial, ported from s7commctl).--source-addr <ip>(MODBUSCTL_SOURCE_ADDR): binds aTCPAddrfor tcp transports and aUDPAddrfor udp ones; with--proxy, the connection to the proxy is the one bound.config.ValidateDialConfig, checked invalidateModbusEndpointbefore anything is sent):--proxy:tcp,tcp+tls,rtuovertcp,asciiovertcp. Withudporrtuoverudpit is rejected, because SOCKS5 UDP ASSOCIATE is not implemented.--source-addr: every network transport.rtu:///ascii://.tcp+tls://handshakes end to end through the proxy. The certificate is checked against the URL host; a test confirms this.discover: the only dialing outside go-modbus isconnectDiscovery, and it now uses the same dialer.--resolve-macwith--proxyis rejected, since ARP cannot see hosts behind the proxy.healthcheck/main.godials the local server only and is unchanged.Exit code: invalid values exit 3 (
invalid_input), not 2. That is how this repo treats invalid flag values, the TLS flags included (docs/exitcodes.md). Exit 2 here is for parser and usage errors only. A proxy that is down or refuses the connection exits 4 and names the proxy and its reply. No test depends on go-modbus's dial message text.Tests
internal/netdial,internal/socks5test: both 100 % coverage. They include the UDP source binding.cmd/client: each connecting command goes through the scripted proxy to the fake device at a TEST-NET address that only the proxy forwards. Also tested:rtuovertcp/asciiovertcp/tcp+tlsoversocks5h--source-addron tcp, udp and with the proxy, plus an unassignable addresscmd/discover: a /30 discovered through the proxy,--source-addr, and the invalid combinations.internal/validate,internal/config: per-transport tables and env loading.make checkis green (total coverage 96.8 %, per-package floor met), andmake e2epasses.Docs
The README has a new transport section, two env-table rows and a discover note. SECURITY.md has a Proxies section, and RELEASE.md has a
## v3.7.0section. Not released.🤖 Generated with Claude Code