A living, proposed plan for closing the remaining gaps with Dante and pushing past it. See the comparison in the README for the current feature delta, and the CHANGELOG for what has shipped.
Guiding principle: reach parity where it matters (the gaps real deployments hit), and differentiate with modern strengths — safety, cross-platform reach, observability, and a cloud-native operations story — rather than chasing every legacy Dante feature. SOCKS4 and GSSAPI are intentionally low priority.
Effort is a rough order of magnitude: S ≈ days, M ≈ 1–2 weeks, L ≈ multi-week. Value is the expected impact on real deployments.
The initial release delivered the core proxy: SOCKS5 TCP CONNECT and UDP
ASSOCIATE (dual-stack, IPv4-mapped clients, configurable udp.portrange),
deny-by-default client/socks ACLs with username/password (Argon2id) auth, a
DNS resolution policy, optional TLS listener and Prometheus metrics, text/JSON
logging, per-client abuse controls, hot reload (SIGHUP / Windows SCM), Windows
Service integration, a Linux systemd lifecycle manager, and a configuration
wizard. See the CHANGELOG for the full list.
| Item | Value | Effort | Notes |
|---|---|---|---|
| — | — | Shipped — socks rule to: accepts .example.com (domain + subdomains) and exact hostnames, matched against the requested host before resolution. |
|
| — | — | Shipped (command form) — auth.command verifies credentials via an external program (username/password on stdin, exit 0 = allow), covering LDAP/OIDC/PAM via a script. A native HTTP-webhook form remains a possible follow-up. |
|
| PAM / system auth (Unix) | Med | M | Native PAM backend for Unix deployments that expect it. Follows the external-auth hook. |
| BIND command | Med | L | RFC 1928 §6 two-stage reverse connect (active FTP, callbacks). Security-sensitive — gated off by default, restricted by socks rules. |
| SOCKS4 / 4a | Low | S | Cheap, but legacy; modern clients use SOCKS5. Add only on demand. |
| GSSAPI / Kerberos | Low | L | Complex and niche; SOCKS-over-TLS already covers channel security. Revisit only if asked. |
| Item | Value | Effort | Notes |
|---|---|---|---|
| — | — | Shipped — proxyprotocol accepts v1/v2 headers from trusted upstream CIDRs, keying rules, limits, metrics, and logs on the real client. |
|
| — | — | Shipped — ratelimit.byterate is now a smooth per-client token-bucket throttle (TCP shaped, UDP policed), plus a per-rule bandwidth: selector that throttles each matching CONNECT session. Slows rather than drops/tears down. |
|
| — | — | Shipped — tls.acme.* obtains and auto-renews certificates via the TLS-ALPN-01 challenge on the TLS listener (port 443), no certbot/cron. Dante has no TLS at all. |
|
| Geo / ASN access rules | Med | M | from/to by country or ASN (optional MaxMind dataset). Modern access control Dante lacks natively. |
| Audit log + OpenTelemetry | Med | S–M | Per-rule metrics, a structured audit stream (who → where, rule hit, bytes), and optional OTel traces. Extends an existing strength. |
| Transparent / intercept mode (Linux) | Med | L | TPROXY/redirect ingress so unmodified apps are proxied without SOCKS awareness — the modern answer to Dante's socksify preload library. |
| Happy Eyeballs (RFC 8305) for CONNECT | Med | M | Concurrent dual-stack dialing for faster, more robust connects (builds on the existing all-address fallback). |
| Item | Value | Effort | Notes |
|---|---|---|---|
| — | — | Shipped — aarch64 Linux and Windows ARM64 are in the release matrix, validated on every change by a CI cross-build job. |
|
| *macOS / BSD as first-class | Med | M | CI coverage, a launchd plist, and docs — closes the portability gap that keeps Dante ahead on Unix. |
| — | — | Shipped (image) — official multi-arch distroless image on GHCR, built from source. Helm chart / compose examples remain a follow-up. | |
| Native packages | Med | M | deb/rpm, Homebrew, and winget for first-class install. |
Ordered for value-to-effort while leaning into Alighieri's identity
(hostname / domain ACL rules, PROXY protocol ingress,
external auth hook, token-bucket bandwidth throttle, and
ARM64 builds + container image have shipped):
The first wave is complete. Next up: BIND, geo/ASN rules, macOS/BSD first-class, audit/OTel, native packages (deb/rpm/Homebrew/winget), and a Helm chart / compose examples. Deprioritized unless requested: SOCKS4, GSSAPI.
This is a proposal, not a commitment — priorities and scope are open to change. Items can be promoted to tracked GitHub issues/milestones as they are picked up.