SockSlender

Lightweight, Multi-Protocol Proxy Router, Chain Manager & Network Manipulation Engine

SockSlender is a programmable proxy multiplexer written in V. It combines multiple proxy servers into routing chains with path selection, automatic failover, and smart server selection. It intercepts connections, applies network-layer and application-layer manipulations, and routes traffic through the optimal path.

---

Quick Install

apt update -y && apt install -y git clang make && if ! command -v v >/dev/null 2>&1; then git clone --depth=1 https://github.com/vlang/v && cd v && make && ./v symlink && cd ..; fi && git clone --depth=1 https://github.com/tailsmails/sockslender && v install --git https://github.com/tailsmails/vnm && cd sockslender && v -enable-globals -prod sockslender.v -o sockslender && ln -sf $(pwd)/sockslender $PREFIX/bin/sockslender

---

Core Capabilities

• Multi-Protocol Support: SOCKS5 (Full TCP & UDP Associate support), HTTP CONNECT, and DNS (UDP Forwarding).
• Authentication: Username/Password support for both local listeners and upstream proxies.
• Chain Architecture: Connect unlimited proxies sequentially using the + operator.
• Macros & Mid-Chain Listeners: Save chain segments as variables (-xNAME), or spawn listeners mid-chain (-x).
• Multi-Box Routing: Run completely isolated proxy instances inside a single process using the :: boundary separator.
• Dynamic Proxychains Integration: Automatically generates isolated configuration files to wrap background commands via proxychains over specified upstream nodes (-in).
• Zero Dependencies: Compiles into a single static binary. Auto-tunes File Descriptor (FD) limits on Linux and macOS.

---

Path Optimization & Machine Learning Engine

SockSlender implements an adaptive decision engine to maintain stable routing under dynamic network conditions:

• Evasion Model (Multi-Armed Bandit): Uses an Upper Confidence Bound (UCB) exploration-exploitation algorithm with dynamic decay to choose the optimal proxy chain path based on real-time performance.
• Deep Neural Network Watchdog: Features a 3-layer Neural Network (21-unit input vector, 48 and 24-unit hidden layers with Swish activation, and an input attention weight layer) that predicts the stability of path variations.
• Feature Integration: Inputs include tokenized command n-grams, moving averages of throughput (BPS), packet size metrics, estimated jitter, and historic latency/success counts.
• Experience Replay Buffer: Stores the last 100 interaction states and trains the model continuously in mini-batches to optimize adaptation speed.

---

Resilient Connection Hedging & Request Queuing

• Adaptive Hedging: Initiates up to 6 parallel connection attempts (--hedge <delay_ms>) when network conditions or chain scores degrade, utilizing the first successful path and gracefully cleaning up late-arriving sockets.
• Asynchronous Request Queue: When all pathways fail or are congested, client connections are held in a size-limited queue instead of being dropped immediately. It retries pending requests up to 15 times before returning an error to the client.

---

Resource Guarding & Socket Janitor

• Socket Monitoring: A dedicated SocketMonitor tracks active sockets, warning the operator when limits are near.
• TCP Keepalive Tuning: Automatically applies custom TCP socket tuning (Keepidle, Keepintvl, Keepcnt) on Unix platforms to quickly detect dead sockets.
• Automated Janitor & Emergency Cleanup: Runs a background garbage collection thread to terminate idle or stalled connections. If socket consumption reaches 90% of the limit, an emergency routine forcefully reclaims older or queued resources to preserve system stability.

---

CLI Reference

Flag	Function	Example
-l URI	Add listener	-l socks5://user:pass@0.0.0.0:1080
-u CHAIN	Add global upstream	-u socks5://a:1010+socks5://b:2020
-i CHAIN	Add isolated chain	-i proxy:1010+-xsocks5://0.0.0.0:2020
-o CHAIN	Append to all chains	-o socks5://exit:9050
-in CHAIN	Define input proxy chain for Watchdog wrapping	-in socks5://127.0.0.1:9050
--hedge MS	Adjust hedging delay (minimum 50ms)	--hedge 150
::	Isolate Boxes	-l ... -u ... :: -l ... -u ...

---

Script Engine (L7 / L3)

Rules are injected directly into the URI between ? markers (e.g., socks5://proxy:1080?l3:ttl=64?).

L7: Payload Byte Patching (Cross-Platform)

Modify payload bytes unconditionally, conditionally (if/el), or via AOB pattern matching.

• ?0-1=0505? (Unconditional patch)
• ?3-3=01 if 0-1=0500 el 7-7=FF? (If/Else patch)
• ?1603__01 if 2-2=03? (AOB pattern match with wildcards __)

L3: Network Layer (Linux/macOS)

Control IP/TCP header behaviors via system socket options.

• No Root Required: ttl (Time to Live), tos (DSCP/QoS), df (Don't Fragment), nodelay (TCP_NODELAY), keepalive, delay (simulated delay).
• Root Required: mark (iptables fwmark), bind (force interface, e.g., tun0), tproxy.

---

Processing Pipeline

1. TCP Connection Initialization
2. L3 Socket Tuning: Apply configured socket options (setsockopt for TTL, TOS, MARK, BIND, NODELAY, and Keepalives) based on parsed L3 script rules.
3. Protocol Handshake: Execute SOCKS5/HTTP negotiations.
4. Active Relay Loop:
   • Apply L7 byte patches/AOB matching on data packets passing through the relay.
   • Continuously update the UCB bandit stats and feed real-time performance indicators (BPS, packet size) back to the Neural Network.