I'm trying to understand at what layer does the SOCKS proxy receive. For example, if I visit a website and make a HTTP get to the web server it is passed through via SOCKS to make the request.
At the SOCKS server or Onion Proxy, after the circuit creation, key exchanges, etc., what does it receive and how does Tor package/wrap the HTTP get request into its cell. I ask this because I created a SOCKS server and read the buffer and it outputted the application data (host, user-agent), so does Tor split those (application byte stream) into 512 bytes cells and add the respective cell headers?
Then what about the TCP handshake (SYN, SYN-ACK, ACK) or TCP data transfer. Do those need to be packaged into cells as well? I ask this because does the client connect the TCP handshake or does the exit node handle that? I never quite understood the initiation process. If it's the first, then are the syn, syn-ack, ack packets sent via onion routing individually or if its the latter then does the exit node just pass the data down the stream, so that there is two connections: client onion routing to exit and exit to web server?
Relating to questioon 1, how does the web server receive and interpret those cells? I'm assuming the exit node's SOCKS proxy server handling the incoming (?) and outgoing traffic somehow strips the cell data. But not really sure on the details.
Apologies for the lengthy questioning, any insights would be appreciated.