Address Copilot review: socket error handling, SOCKS5 method validation, cleanup fixes

- SocksPeerConnector.h: Check getsockopt/setsockopt return values, fail
  negotiation if timeout setup fails, validate socket restore on cleanup
- SocksPeerConnector.h: Explicitly reject unsupported SOCKS5 auth methods
  (e.g. GSSAPI) instead of falling through
- generate.php: Remove URL-encoding of SOCKS credentials (RFC1929 uses raw)
- squid-build-test.yml: Replace `kill %1` with `pkill -f` for reliable
  background process cleanup across steps
- container-release.yml: Lowercase repository owner for GHCR image name

https://claude.ai/code/session_01Tfy3kPd51qRgxpCFXjb2g9

Author: claude

.github/workflows/container-release.yml

@@ -20,7 +20,7 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository_owner }}/squid-socks
+  IMAGE_NAME: squid-socks
 
 jobs:
   build-and-push:
@@ -46,11 +46,14 @@ jobs:
       - name: Prepare tags
         id: tags
         run: |
-          TAGS="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version }}"
+          OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          FULL_IMAGE="${{ env.REGISTRY }}/${OWNER}/${{ env.IMAGE_NAME }}"
+          TAGS="${FULL_IMAGE}:${{ inputs.version }}"
           if [ "${{ inputs.push_latest }}" = "true" ] && [ "${{ inputs.version }}" != "latest" ]; then
-            TAGS="${TAGS},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
+            TAGS="${TAGS},${FULL_IMAGE}:latest"
           fi
           echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "image=${FULL_IMAGE}" >> "$GITHUB_OUTPUT"
           echo "Tags to push: ${TAGS}"
 
       - name: Build and push
@@ -71,6 +74,6 @@ jobs:
 
       - name: Verify pushed image
         run: |
-          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version }}
-          docker run --rm ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version }} squid -v
+          docker pull ${{ steps.tags.outputs.image }}:${{ inputs.version }}
+          docker run --rm ${{ steps.tags.outputs.image }}:${{ inputs.version }} squid -v
           echo "--- Image verification OK ---"

.github/workflows/squid-build-test.yml

@@ -284,7 +284,7 @@ jobs:
         run: |
           docker rm -f squid-test 2>/dev/null || true
           pkill microsocks 2>/dev/null || true
-          kill %1 2>/dev/null || true
+          pkill -f 'python3 -m http.server' 2>/dev/null || true
 
   # ------------------------------------------------------------------
   # 4. Test: SOCKS5 with authentication
@@ -442,7 +442,7 @@ jobs:
         run: |
           docker rm -f squid-auth 2>/dev/null || true
           pkill microsocks 2>/dev/null || true
-          kill %1 2>/dev/null || true
+          pkill -f 'python3 -m http.server' 2>/dev/null || true
 
   # ------------------------------------------------------------------
   # 5. Test: generate.php produces correct config

setup/generate.php

@@ -45,9 +45,10 @@
         // Native SOCKS support via Squid cache_peer patch (no Gost needed)
         $socksOpt = $proxyInfo['scheme'];  // "socks4" or "socks5"
         if ($proxyInfo['user'] && $proxyInfo['pass']) {
+            // SOCKS5 RFC1929 uses raw username/password; do not URL-encode.
             $socksOpt .= sprintf(' socks-user=%s socks-pass=%s',
-                urlencode($proxyInfo['user']),
-                urlencode($proxyInfo['pass'])
+                $proxyInfo['user'],
+                $proxyInfo['pass']
             );
         }
         $squid_conf[] = sprintf($squid_socks,

squid_patch/src/SocksPeerConnector.h

@@ -181,10 +181,11 @@ static inline bool socks5Connect(int fd,
         if (aResp[0] != 0x01 || aResp[1] != 0x00)
             return false;   /* auth failed or wrong sub-negotiation version */
 
-    } else if (gResp[1] == 0xFF) {
-        return false;       /* no acceptable method */
+    } else if (gResp[1] == 0x00) {
+        /* no auth required */
+    } else {
+        return false;       /* unsupported or unacceptable method (includes 0xFF) */
     }
-    /* else gResp[1] == 0x00 → no auth required */
 
     /* --- connect request --------------------------------------------- */
     uint8_t connReq[263];
@@ -286,26 +287,34 @@ static inline bool negotiate(int fd, SocksPeerType type,
     /* save original timeouts and set a 10 s limit for the handshake */
     struct timeval origRecvTv = {0, 0}, origSendTv = {0, 0};
     socklen_t tvLen = sizeof(struct timeval);
-    getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &origRecvTv, &tvLen);
-    tvLen = sizeof(struct timeval);
-    getsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &origSendTv, &tvLen);
+    if (getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &origRecvTv, &tvLen) < 0 ||
+        getsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &origSendTv, &tvLen) < 0) {
+        fcntl(fd, F_SETFL, flags);
+        return false;
+    }
 
     struct timeval tv;
     tv.tv_sec  = 10;
     tv.tv_usec = 0;
-    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
-    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+    if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) < 0 ||
+        setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)) < 0) {
+        fcntl(fd, F_SETFL, flags);
+        return false;
+    }
 
     bool ok = false;
     if (type == SOCKS_V4)
         ok = socks4Connect(fd, targetHost, targetPort, user);
     else if (type == SOCKS_V5)
         ok = socks5Connect(fd, targetHost, targetPort, user, pass);
 
-    /* restore original flags and timeouts */
-    fcntl(fd, F_SETFL, flags);
-    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &origRecvTv, sizeof(origRecvTv));
-    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &origSendTv, sizeof(origSendTv));
+    /* restore original flags and timeouts (best-effort, log-worthy but not fatal) */
+    int restoreOk = 0;
+    restoreOk |= fcntl(fd, F_SETFL, flags);
+    restoreOk |= setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &origRecvTv, sizeof(origRecvTv));
+    restoreOk |= setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &origSendTv, sizeof(origSendTv));
+    if (restoreOk < 0 && ok)
+        return false;   /* negotiation succeeded but socket is in bad state */
 
     return ok;
 }