Commit Graph

540 Commits

Author SHA1 Message Date
Vladimir Dubrovin
d26f27a87e fix makefiles 2026-04-02 19:13:53 +03:00
Vladimir Dubrovin
4747d69a62 fix makefiles 2026-04-02 19:06:26 +03:00
Vladimir Dubrovin
dc1dbf2ad5 move crypto and ssl libs to plugin makefile 2026-04-02 19:04:37 +03:00
Vladimir Dubrovin
17112334bc try to fix PCRE2 on win 2026-04-02 18:22:32 +03:00
Vladimir Dubrovin
5fd5eb55c6 switch PCREPlugin to PCRE2 2026-04-02 17:55:10 +03:00
BDBSAlive6one6
c7318a825c
fix(PamAuth): добавлен вызов pam_acct_mgmt(), исправлен pam_start() (#1203)
Добавлен вызов pam_acct_mgmt() после pam_authenticate() для проверки
прав доступа на уровне PAM (HBAC, истечение пароля, блокировка учётки)
Исправлена передача реального username в pam_start() вместо '3proxy@'

---

Added pam_acct_mgmt() call after pam_authenticate() to enable PAM
account checks (HBAC, password expiration, account lockout).
Fixed pam_start() to pass actual username instead of hardcoded '3proxy@'
Tested with FreeIPA 4.12 + SSSD Rocky Linux 9
2026-04-02 15:06:21 +03:00
Vladimir Dubrovin
5cb42abbb3 Move timeouts from conf
Some checks are pending
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Waiting to run
2026-04-01 19:37:33 +03:00
Vladimir Dubrovin
da0aebe31c Do not use applink.c 2026-03-31 10:58:32 +03:00
Vladimir Dubrovin
7f31a30f00 Fix TrafficPlugin 2026-03-30 15:18:18 +03:00
Vladimir Dubrovin
2e5dcb510b compile PCRE on Windows 2026-03-27 19:01:48 +03:00
Vladimir Dubrovin
c2f381d0cc Correct SSL functions for Windows 2026-03-27 18:36:16 +03:00
Vladimir Dubrovin
3a2223b798 Use external PCRE library 2026-03-27 17:56:56 +03:00
Vladimir Dubrovin
cbab9a2fe2 Use external PCRE library 2026-03-27 17:53:35 +03:00
Vladimir Dubrovin
4936ae0974 Fix warning 2026-03-27 16:12:30 +03:00
Vladimir Dubrovin
b0755ea482 Use 64 bit arithmetics for rate limits 2026-03-27 13:23:06 +03:00
Vladimir Dubrovin
cd79f31034 remove SSL_shutdown 2026-03-27 12:21:00 +03:00
Vladimir Dubrovin
6143dfcb18 Use quit shutdown for SSL to prevent races
Some checks are pending
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Waiting to run
2026-03-27 12:00:57 +03:00
Vladimir Dubrovin
a2edecfbad Fix potential use-after-free on filters, add SSL_shutdown in SSLPlugin
Some checks are pending
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Waiting to run
2026-03-26 20:46:54 +03:00
Vladimir Dubrovin
be8fa4542c SNI break (DPI bypass) added
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
-s option to tlspr (or tls type redirect), requires TCP_NODELAY to be set

auth iponly
allow *
parent 1000 tls 0.0.0.0 0
allow *
proxy -s -i127.0.0.1 -ocTCP_NODELAY -osTCP_NODELAY -p1443
2026-03-10 13:38:09 +03:00
Vladimir Dubrovin
12c9039ea4 Fixed: crash on invalid configuration file
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2026-01-28 19:40:58 +03:00
Vladimir Dubrovin
1a970c5c98 Fixed: memory corruptions on config parsing 2026-01-28 19:13:41 +03:00
Vladimir Dubrovin
fdeee233de ssl_client_mode added, code cleanup
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
ssl_client_mode
0 (default) - handshake immediately after connect() (with first parent or with destination if there is no parent)
1 - handshake with destination server (handshake after connection via parents is established)
2 - handshake after data channel is established (e.g. after CONNECT)
2025-12-31 19:56:52 +03:00
Vladimir Dubrovin
aab8531072 ssl_client_alpn added 2025-12-31 13:47:31 +03:00
Vladimir Dubrovin
d014bb1149 Use SSL_connect / SSL_accept in non-blocking mode
Some checks are pending
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Waiting to run
2025-12-30 17:57:23 +03:00
Vladimir Dubrovin
730fd96fb0 Fixed: allow ssl server and client on the same service 2025-12-30 15:40:03 +03:00
Vladimir Dubrovin
b5ab5b8906 client_sni command added; do not send hostname from request as SNI in SSL client configuration
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-12-12 19:08:26 +03:00
Vladimir Dubrovin
ec7004cd6f Close SSL on shutdown 2025-12-12 18:25:40 +03:00
Vladimir Dubrovin
fe53378596 maxseg / TCP_MAXSEG support added
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-11-29 15:05:29 +03:00
Vladimir Dubrovin
5450ca4cdf Fixed: invalid config value initializers 2025-11-29 14:46:01 +03:00
Alexey Suslov
7a1ca8d341
Fix HTTPS proxy for HTTPS addresses (#1175) 2025-11-17 15:31:54 +03:00
Vladimir Dubrovin
c5ba790d13 Fix: -P option for tlspr
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-10-03 17:06:11 +03:00
Vladimir Dubrovin
fe617048f1 Fix: WSAPoll fail in some Windows versions after e525ce913e
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-08-13 17:53:19 +03:00
Vladimir Dubrovin
724946a834 Fixed: ssl_server_cert doesn't read full certificate chain 2025-08-10 14:36:00 +03:00
Vladimir Dubrovin
2966836dfa Fixed: CONNECT does not work in standalone 'proxy' binary
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-08-05 17:39:11 +03:00
Vladimir Dubrovin
e525ce913e Fixed: Failed connect may result in success response on some Windows versions 2025-08-05 17:38:38 +03:00
Vladimir Dubrovin
db618f780b Fixed: invalid timeout in socksendto / sockrecvfrom 2025-08-05 15:07:50 +03:00
Vladimir Dubrovin
a3e13d8211 Convert PAMAUTH.TXT to UTF-8 2025-06-23 19:24:27 +03:00
Vladimir Dubrovin
dc4e8d3427 Fixed service name detection for auto / tlspr
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-05-06 18:59:04 +03:00
Vladimir Dubrovin
57841074b9 Avoid sleep on service thread sync
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-04-16 21:29:48 +03:00
Vladimir Dubrovin
7320094c11 SOCKSTRACE fixed
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-04-15 19:51:01 +03:00
Vladimir Dubrovin
43d48adeb9 ssl_server_verify, ssl_server_ca_dir, ssl_server_ca_store added, ssl_server / ssl_client aliases added to ssl_serv / ssl_cli 2025-04-15 19:18:14 +03:00
Vladimir Dubrovin
6355f9659b ssl_noserv fixed, ssl_cli/ssl_nocli/ssl_client_cert/ssl_client_key added
Some checks are pending
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Waiting to run
2025-04-14 21:40:59 +03:00
Vladimir Dubrovin
7aad0205e1 Remove legacy NTLMv1 code
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
2025-03-17 19:44:48 +03:00
Vladimir Dubrovin
89b45b1b2a Support HAProxy proxy v1 protocol
Some checks failed
C/C++ CI / ${{ matrix.target }} (macos-15) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
C/C++ CI / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Added:
-H option - expect HAProxy proxy v1 header, e.g. `proxy -H`

parent ha type - send HAProxy proxy v1 header (must be last in redirection), e.g.

allow *
parent 1000 ha
parent 1000 proxy 1.2.3.4 3128
socks
2025-03-15 15:54:29 +03:00
Vladimir Dubrovin
7888502cd5 Support tlspr in auto 2025-03-15 13:02:46 +03:00
Vladimir Dubrovin
e6f5f7b5e0 make compatible with openssl 1.x 2025-03-14 20:14:57 +03:00
Vladimir Dubrovin
d48f24ac84 rsa.h not required 2025-03-14 19:56:58 +03:00
Vladimir Dubrovin
4de45ff3a8
Use PCRE_STATIC pcre_plugin.c 2025-03-14 18:03:26 +03:00
Vladimir Dubrovin
74081c8146
use PCRE_STATIC 2025-03-14 17:55:09 +03:00
z3apa3a
bc92819572 Fix tlspr for compatibility with older compileres 2025-03-09 19:16:35 +03:00