715 Commits

Author	SHA1	Message	Date
Vladimir Dubrovin	f265ea0b52	Fix rewrite and over-long header handling on Windows ... op_rewrite checked what it built with targetunsafe(), which describes a path on this machine: on Windows it must name a drive or a share, so a rewritten request path was refused and every rewrite rule failed there. A rewrite produces a request path and is checked as one. The header loop stopped at HTTPSRV_MAXHDR and answered anyway, leaving the rest of the request in the stream for the next one to be read out of. It refuses the request instead. A header longer than the buffer arrives as several lines, so the count bounds what is read rather than what a client may send in one header. The test for the buffer growth after a PCRE rewrite sent its request through to an httpsrv origin, which stops reading at that same cap; it uses an origin which reads whatever it is sent, since what is under test is the proxy in the middle.	2026-08-29 20:37:12 +03:00
Vladimir Dubrovin	da2b8b3c1a	Fix: proxy buffer may be insufficient after PCRE rewrite	2026-08-29 19:09:54 +03:00
Vladimir Dubrovin	ee0de3613a	support proxypass in web server	2026-08-29 19:09:54 +03:00
Vladimir Dubrovin	8971fcf991	Move patternmatch from common.c	2026-08-29 19:09:54 +03:00
Vladimir Dubrovin	9529a1dfcf	http server implemented, pcre support for hostnames in acls implemented	2026-08-29 19:09:54 +03:00
Vladimir Dubrovin	ea4b2cc3a2	Guard attempts to load TransparentPlugin ... (cherry picked from commit 7bc34002df)	2026-08-26 17:08:13 +03:00
Vladimir Dubrovin	efa6f6560c	Fix dnspr for Windows ... (cherry picked from commit a194f207ba)	2026-08-26 16:48:09 +03:00
Vladimir Dubrovin	da66016c7f	Transparent moved to main code (TransparentPlugin removed), BSD pf support added ... (cherry picked from commit 88b3225bdf)	2026-08-26 16:48:08 +03:00
Vladimir Dubrovin	c0c51357d9	Fix MitM for MacOS clients (openssl only)	2026-08-26 11:54:04 +03:00
Vladimir Dubrovin	fdd303ee32	Apply a request rewrite to what the server is sent ... A rewrite only reached the copy of the request kept for logging. On a direct connection the server is sent the request line held in the header buffer, which was parsed and reduced to its path before the filters ran, so the rewrite showed up in the log and nowhere else. Through an HTTP parent the rewritten copy is what goes out, which is why it appeared to work there. Splice the new path back into that buffer. The destination was chosen, and the access rules applied to it, before the rewrite happened, so a rewrite that changes the method or the authority is left alone: acting on it would send the request somewhere the rules never saw. Say so in the manual. The copy needed to notice a rewrite is only taken when a request filter exists, so a proxy without one does no extra work.	2026-08-26 10:28:02 +03:00
Vladimir Dubrovin	cdbd47dc5b	Make pcre_extend work, and cover PCRE filtering with tests ... The filter walked its list of access rules but tested the first entry each time round, so anything pcre_extend appended was never consulted and the command did nothing at all. Test the entry the loop is on. pcre_extend takes an ACE and no FILTER_ACTION - the rule keeps the action it was given - so correct the manual, which documented an argument the command does not read. The tests cover matching and denial, rule order, client headers, matching options, the access rule a pcre rule carries, pcre_extend, and rewriting a reply header and reply data. Request rewriting is covered through an HTTP parent, which is the path where it reaches the wire.	2026-08-26 10:16:12 +03:00
Vladimir Dubrovin	488317da1d	Read the request body before replying, and generate certificates portably ... httpsrv parsed Content-Length and never read what followed. The reply is followed by a close, and closing a socket that still holds unread data resets the connection instead of ending it, so a POST could cost the client the reply it was about to read. Windows does that reliably; the same test passes on Linux and macOS, which is why it looked flaky. Drain the body, bounded at a megabyte. The test CA was built with -addext, which LibreSSL - the openssl on a stock macOS - does not apply the same way, leaving a certificate that is not usable as a CA and a client that cannot build a chain to it. Put the extensions in a file both accept, and verify the generated chain before any of it is handed to a proxy, so a failure there is not read as a fault in the proxy.	2026-08-26 09:28:46 +03:00
Vladimir Dubrovin	cb9effab9b	Fix: insufficient default stack for wolfSSL with glibc	2026-08-25 19:07:20 +03:00
Vladimir Dubrovin	7f430ccc79	Fix non-linux cmake	2026-08-25 17:32:02 +03:00
Vladimir Dubrovin	3526759e59	implement small http server for admin and testing	2026-08-25 17:21:33 +03:00
Vladimir Dubrovin	6ca4a2686d	port range support (parent extport / intport)	2026-08-25 14:23:33 +03:00
github-actions[bot]	f6963ea302	Update version files for 1.0.0	2026-08-22 12:13:00 +00:00
Vladimir Dubrovin	ff3398c6a9	Commit as 0.9.9	2026-08-20 18:32:25 +03:00
Vladimir Dubrovin	4fb5c95704	Print error on non-zero local redirection in conf	2026-08-12 17:08:09 +03:00
Vladimir Dubrovin	13a57812e5	Fix: -Ne/-Ni, -4 / -6 handling for udp mapping in socks, mixed family support in udp	2026-08-12 16:25:12 +03:00
Vladimir Dubrovin	a43c95023d	Check DNS reply source in udpresolve	2026-08-12 15:32:30 +03:00
Vladimir Dubrovin	bebc3894e2	Support acls for UDP ASSOC, fix udppm via SOCKSv5	2026-08-11 19:02:54 +03:00
Vladimir Dubrovin	1e47e74c49	FIx: support extip / ha for SOCKSv5 udp associate	2026-08-10 17:18:57 +03:00
Vladimir Dubrovin	eca362af81	FIx: UDPASSOC via parent broken after previous commits	2026-08-10 11:18:56 +03:00
Vladimir Dubrovin	c31fe8367f	Minor FilePlugin cleanup	2026-08-08 23:06:36 +03:00
Vladimir Dubrovin	f480c9dfe8	Do not try non-SOCKSv5 proxies for UDPASSOC	2026-08-08 22:58:41 +03:00
Vladimir Dubrovin	8de2be3b3b	fix socket leak on failed UDPASSOC parent	2026-08-08 22:11:25 +03:00
Vladimir Dubrovin	aea9ff8c94	Fix warnings	2026-08-08 21:58:53 +03:00
Vladimir Dubrovin	e7bc76da73	Restore half-close support by default (accidentally switched off in previous fixes)	2026-08-08 21:34:15 +03:00
Vladimir Dubrovin	207ddb7f02	Fix: descriptors leak in proxy.c	2026-08-08 21:31:54 +03:00
Vladimir Dubrovin	f5ff81d0bc	remove dead code	2026-08-08 21:10:57 +03:00
Vladimir Dubrovin	8c2ad56665	Use memmove for overlapping region	2026-08-08 20:46:52 +03:00
Vladimir Dubrovin	a986ed7a07	Add linger timeout	2026-08-08 19:13:02 +03:00
Vladimir Dubrovin	eceb5a22df	Add outsize parameter to en64	2026-08-08 17:58:49 +03:00
Vladimir Dubrovin	122ca26249	Fix windows build, re-submit as 0.9.8	2026-08-07 19:16:00 +03:00
Vladimir Dubrovin	cb27ca5223	Commit as 0.9.8	2026-08-07 17:45:37 +03:00
Vladimir Dubrovin	932c4e3fd9	Fix use-after-free on ftp:// request path in proxychild() ... ss pointed into the buf request buffer and was never updated when buf was realloc()ed while reading request headers (both in the header loop and in handlehdrfilterscli()). The ftp:// branch then dereferenced the stale pointer. Store ss as an offset into buf and recompute it before use. Requires authenticated access to proxy or configuration with authentication disabled. Reported by Calif.io in collaboration with Anthropic (ref ANT-2026-FHVKZ7VQ).	2026-08-07 16:36:51 +03:00
Vladimir Dubrovin	763e21e053	Fixed: maxchild dropped to 100 on config reload if not explicitly set, system-specific tuning hints added to doc	2026-08-01 10:22:03 +03:00
Vladimir Dubrovin	7b85f6a684	Disable splice support	2026-08-01 09:38:49 +03:00
Vladimir Dubrovin	4877b39f2c	Fix deadcode / warnings / minor bugs	2026-07-31 18:55:59 +03:00
Vladimir Dubrovin	44c47ee7d9	replace recursion with loop for local redirects, fix wolfSSL build	2026-07-31 15:44:22 +03:00
Vladimir Dubrovin	5f1ed7363b	Fix: race conditions / stack overflow on FreeBSD / minor bugs	2026-07-31 13:27:33 +03:00
Vladimir Dubrovin	c370635fc4	fix wolfSSL, switch minimal/busybox to musl+wolfssl	2026-07-31 11:27:10 +03:00
Vladimir Dubrovin	3bfabb29f8	pass -fPIC for plugins (so) only	2026-07-28 18:59:02 +03:00
Vladimir Dubrovin	e4a5a7252c	Fix: buffer overflow in radsend (log radius or combination of auth radius with fakeresolve must be enabled, RADIUS feature is experimental)	2026-07-28 11:31:06 +03:00
Vladimir Dubrovin	4af02c9268	Fix: pcre/ssl command handlers broken in last commits	2026-07-26 15:51:55 +03:00
Vladimir Dubrovin	ed5103d176	Optimize sockgetchar functions	2026-07-24 15:04:27 +03:00
Nirmal Khanal	75dedeff28	Fix: short CL cleartext passwords failed authentication ... strongauth() compared short CL passwords over pwl_table.recsize-1 bytes, reading past the client password buffer (strdup of pwlen+1) and rejecting valid passwords whenever trailing heap bytes were non-zero. Zero-pad the provided password to the record width and compare in constant time, like the long-password BLAKE2 path. Fixes #1254	2026-07-24 15:00:00 +03:00
Vladimir Dubrovin	c60af54c98	Minor bugfixes	2026-07-23 19:43:47 +03:00
Nirmal Khanal	01f85cf755	Fix parent negotiation after sending PROXY protocol header ... After 'parent ha' sends the PROXY v1 header, continue negotiating the real parent protocol (SOCKS5/CONNECT/etc.) instead of returning early. 'ha' used alone still sends the header and relays plain TCP.	2026-07-23 10:55:07 +03:00