tinyproxy.conf.5: explain what a site_spec looks like

if tinyproxy serves as a HTTP server (i.e. when serving stats),
use error code 401, else error code 407.

fixes #532

.github/workflows/main.yml

@@ -27,8 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
-    - name: install valgrind
-      run: sudo apt-get install --assume-yes valgrind
+    - run: sudo apt update
+    - run: sudo apt install --assume-yes valgrind
     - run: ./autogen.sh
     - run: ./configure --enable-debug --enable-transparent --enable-reverse
     - run: make

.github/workflows/release_tarball.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         submodules: recursive
 
@@ -26,36 +26,15 @@ jobs:
         PKGNAME="tinyproxy-$VERSION"
         ./configure
         make dist
-        echo "::set-output name=tarball_xz::${PKGNAME}.tar.xz"
-        echo "::set-output name=tarball_gz::${PKGNAME}.tar.gz"
-        echo "::set-output name=tarball_bz2::${PKGNAME}.tar.bz2"
+        echo "tarball_xz=${PKGNAME}.tar.xz" >> "$GITHUB_OUTPUT"
+        echo "tarball_gz=${PKGNAME}.tar.gz" >> "$GITHUB_OUTPUT"
+        echo "tarball_bz2=${PKGNAME}.tar.bz2" >> "$GITHUB_OUTPUT"
 
-    - name: upload tarball_xz
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: upload tarballs
+      uses: softprops/action-gh-release@v2
       with:
-        upload_url: ${{ github.event.release.upload_url }}
-        asset_path: ./${{ steps.archive.outputs.tarball_xz }}
-        asset_name: ${{ steps.archive.outputs.tarball_xz }}
-        asset_content_type: application/x-xz
+        files: |
+          ${{ steps.archive.outputs.tarball_xz }}
+          ${{ steps.archive.outputs.tarball_gz }}
+          ${{ steps.archive.outputs.tarball_bz2 }}
 
-    - name: upload tarball_gz
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ github.event.release.upload_url }}
-        asset_path: ./${{ steps.archive.outputs.tarball_gz }}
-        asset_name: ${{ steps.archive.outputs.tarball_gz }}
-        asset_content_type: application/x-gzip
-
-    - name: upload tarball_bz2
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ github.event.release.upload_url }}
-        asset_path: ./${{ steps.archive.outputs.tarball_bz2 }}
-        asset_name: ${{ steps.archive.outputs.tarball_bz2 }}
-        asset_content_type: application/x-bzip2

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version   | Supported          |
+| --------- | ------------------ |
+| 1.11.x    | :white_check_mark: |
+| <= 1.10.x | :x:                |
+
+## Reporting a Vulnerability
+
+Open a public issue on github. The issue will most likely be fixed
+within a day, unless all maintainers happen to just be taking a
+vacation at the same time, which is unlikely.
+
+Even then, having the bug publicly known will allow competent people
+to come up with custom patches for distros, most likely quicker
+than black hats can craft a remote execution exploit.
+
+If you really really do not want to make the issue public, come
+to the tinyproxy IRC channel and ask for a maintainer, which you
+can then contact via private messages.
+
+Do not, however, like ["TALOS Intelligence"](https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889)
+pull a random email address out of git log, then send an email
+nobody reads or responds to, and wait for 6 months for publication.
+this only gives black hats plenty time to sell, use and circulate
+zero days and get the best possible ROI.

VERSION

@@ -1 +1 @@
-1.11.1
+1.11.2

configure.ac

@@ -173,6 +173,9 @@ fi
 dnl
 dnl Substitute the variables into the various Makefiles
 dnl
+# runstatedir isn't available for Autoconf < 2.70
+AS_IF([test -z "${runstatedir}"], [runstatedir='${localstatedir}/run'])
+AC_SUBST([runstatedir])
 AC_SUBST(CFLAGS)
 AC_SUBST(LDFLAGS)
 AC_SUBST(CPPFLAGS)
@@ -220,7 +223,6 @@ docs/Makefile
 docs/man5/Makefile
 docs/man5/tinyproxy.conf.txt
 docs/man8/Makefile
-docs/man8/tinyproxy.txt
 m4macros/Makefile
 tests/Makefile
 tests/scripts/Makefile

data/templates/debug.html

@@ -30,9 +30,6 @@
   <dt>clienthost</dt>
   <dd>{clienthost}</dd>
 
-  <dt>version</dt>
-  <dd>{version}</dd>
-
   <dt>package</dt>
   <dd>{package}</dd>
 
@@ -49,7 +46,7 @@
 
 <hr />
 
-<p><em>Generated by <a href="{website}">{package}</a> version {version}.</em></p>
+<p><em>Generated by <a href="{website}">{package}</a>.</em></p>
 
 </body>
 

data/templates/default.html

@@ -16,7 +16,7 @@
 
 <hr />
 
-<p><em>Generated by <a href="{website}">{package}</a> version {version}.</em></p>
+<p><em>Generated by <a href="{website}">{package}</a>.</em></p>
 
 </body>
 

data/templates/stats.html

@@ -2,7 +2,7 @@
 
 <html lang="en">
   <head>
-    <title>Stats [{package} v{version}]</title>
+    <title>Stats [{package}]</title>
     <meta charset="UTF-8" />
     <style type="text/css">
       body {
@@ -62,7 +62,7 @@
       <div id="inner">
         <table>
           <tr>
-            <th colspan="2">{package} v{version} statistics</th>
+            <th colspan="2">{package} statistics</th>
           </tr>
           <tr class="odd">
             <td class="right">Open connections</td>

docs/man5/tinyproxy.conf.txt.in

@@ -22,8 +22,8 @@ configuration file.
 The Tinyproxy configuration file contains key-value pairs, one per
 line. Lines starting with `#` and empty lines are comments and are
 ignored. Keywords are case-insensitive, whereas values are
-case-sensitive. Values may be enclosed in double-quotes (") if they
-contain spaces.
+case-sensitive. Some string values must be enclosed in double
+quotes (") as noted below.
 
 The possible keywords and their descriptions are as follows:
 
@@ -57,7 +57,7 @@ only on one specific address.
 =item B<Bind>
 
 This allows you to specify which address Tinyproxy will bind
-to for outgoing connections to web servers or upstream proxies.
+to for outgoing connections.
 This parameter may be specified multiple times, then Tinyproxy
 will try all the specified addresses in order.
 
@@ -76,29 +76,29 @@ allowed to have before it is closed by Tinyproxy.
 
 This parameter controls which HTML file Tinyproxy returns when a
 given HTTP error occurs. It takes two arguments, the error number
-and the location of the HTML error file.
+and the location of the HTML error file. Enclose the file location
+in double quotes.
 
 =item B<DefaultErrorFile>
 
-This parameter controls the HTML template file returned when an
-error occurs for which no specific error file has been set.
+The HTML template file returned when an error occurs for which no
+specific error file has been set. Enclose in double quotes.
 
 =item B<StatHost>
 
-This configures the host name or IP address that is treated
-as the `stat host`: Whenever a request for this host is received,
-Tinyproxy will return an internal statistics page instead of
-forwarding the request to that host. The template for this
-page can be configured with the `StatFile` configuration option.
-The default value of `StatHost` is `@TINYPROXY_STATHOST@`.
+The host name or IP address that is treated as the `stat host`.
+Enclose in double quotes. Whenever Tinyproxy receives a request for
+the `stat host` it returns an internal statistics page instead of
+forwarding the request to that host. The template for this page can be
+configured with the `StatFile` configuration option. The default value
+of `StatHost` is `@TINYPROXY_STATHOST@`.
 
 =item B<StatFile>
 
-This configures the HTML file that Tinyproxy sends when
-a request for the stathost is received. If this parameter is
-not set, Tinyproxy returns a hard-coded basic statistics page.
-See the STATHOST section in the L<tinyproxy(8)> manual page
-for details.
+The HTML file that Tinyproxy sends in response to a request for the
+`stat host`. Enclose in double quotes. If this parameter is not set,
+Tinyproxy returns a hard-coded basic statistics page. See the STATHOST
+section in the L<tinyproxy(8)> manual page for details.
 
 Note that the StatFile and the error files configured with ErrorFile
 and DefaultErrorFile are template files that can contain a few
@@ -109,9 +109,9 @@ manual page contains a description of all template variables.
 
 =item B<LogFile>
 
-This controls the location of the file to which Tinyproxy
-writes its debug output. Alternatively, Tinyproxy can log
-to syslog -- see the Syslog option.
+The location of the file to which Tinyproxy writes its debug output.
+Enclose in double quotes. Alternatively, Tinyproxy can log to syslog
+-- see the Syslog option.
 
 =item B<Syslog>
 
@@ -144,8 +144,8 @@ and below would be suppressed. Allowed values are:
 
 =item B<PidFile>
 
-This option controls the location of the file where the main
-Tinyproxy process stores its process ID for signaling purposes.
+The location of the file where the main Tinyproxy process stores its
+process ID for signaling purposes. Enclose in double quotes.
 
 =item B<XTinyproxy>
 
@@ -173,12 +173,20 @@ turns on the upstream proxy for the sites matching `site_spec`.
 
 `type` can be one of `http`, `socks4`, `socks5`, `none`.
 
+a `site_spec` is either a full domain name, a domain name starting with a
+`.`, in which case it is treated as a suffix, or an ip/mask tuple.
+the `site_spec` needs to be double-quoted.
+
 =item * I<upstream none "site_spec">
 turns off upstream support for sites matching `site_spec`, that means the
 connection is done directly.
 
 =back
 
+It's recommended to use raw IP addresses to specify the upstream host, so
+no costly DNS lookup has to be done everytime it is used.
+IPv6 addresses need to be enclosed in square brackets.
+
 The site can be specified in various forms as a hostname, domain
 name or as an IP range:
 
@@ -235,6 +243,14 @@ access is only granted for authenticated users.
 
     BasicAuth user password
 
+=item B<BasicAuthRealm>
+
+In case "BasicAuth" is configured, the "realm" information.
+"Proxy Authentication Required" status http 407 "error-response" can be
+customized.
+
+- defaults in code to "Tinyproxy" (PACKAGE_NAME), if not configured.
+
 =item B<AddHeader>
 
 Configure one or more HTTP request headers to be added to outgoing
@@ -250,7 +266,8 @@ RFC 2616 requires proxies to add a `Via` header to the HTTP
 requests, but using the real host name can be a security
 concern. If the `ViaProxyname` option is present, then its
 string value will be used as the host name in the Via header.
-Otherwise, the server's host name will be used.
+Otherwise, the server's host name will be used. Enclose in double
+quotes.
 
 =item B<DisableViaHeader>
 
@@ -344,7 +361,7 @@ If an `Anonymous` keyword is present, then anonymous proxying
 is enabled.  The headers listed with `Anonymous` are allowed
 through, while all others are denied. If no Anonymous keyword
 is present, then all headers are allowed through.  You must
-include quotes around the headers.
+include double quotes around the headers.
 
 Most sites require cookies to be enabled for them to work correctly, so
 you will need to allow cookies through if you access those sites.
@@ -415,7 +432,7 @@ This manpage was written by the Tinyproxy project team.
 
 =head1 COPYRIGHT
 
-Copyright (c) 1998-2020 the Tinyproxy authors.
+Copyright (c) 1998-2024 the Tinyproxy authors.
 
 This program is distributed under the terms of the GNU General Public
 License version 2 or above. See the COPYING file for additional

docs/man8/Makefile.am

@@ -9,6 +9,17 @@ M_NAME=TINYPROXY
 man_MANS = \
 	$(MAN8_FILES:.txt=.8)
 
+edit = sed \
+	-e 's|@localstatedir[@]|$(localstatedir)|g' \
+	-e 's|@runstatedir[@]|$(runstatedir)|g' \
+	-e 's|@sysconfdir[@]|$(sysconfdir)|g' \
+	-e 's|@TINYPROXY_STATHOST[@]|$(TINYPROXY_STATHOST)|g'
+
+tinyproxy.txt: $(top_srcdir)/docs/man8/tinyproxy.txt.in Makefile
+	@rm -f $@ $@.tmp
+	$(AM_V_GEN) $(edit) $(top_srcdir)/docs/man8/$@.in > $@.tmp
+	@mv $@.tmp $@
+
 .txt.8:
 if HAVE_POD2MAN
 	$(AM_V_GEN) $(POD2MAN) --center="Tinyproxy manual" \

docs/man8/tinyproxy.txt.in

@@ -156,7 +156,11 @@ configuration variable `StatFile`.
 
 =head1 FILES
 
-`/etc/tinyproxy/tinyproxy.conf`, `/var/run/tinyproxy/tinyproxy.pid`, `/var/log/tinyproxy/tinyproxy.log`
+F<@sysconfdir@/tinyproxy/tinyproxy.conf>
+
+F<@runstatedir@/tinyproxy/tinyproxy.pid>
+
+F<@localstatedir@/log/tinyproxy/tinyproxy.log>
 
 =head1 BUGS
 

docs/web/tp.html.head

@@ -41,25 +41,27 @@
 
 <p>Tinyproxy requires only a <strong>minimal POSIX environment</strong> to build and operate. It can use additional libraries to add functionality though.</p>
 
-<p>Tinyproxy allows forwarding of <strong>HTTPS connections</strong> without modifying traffic in any way through the <code>CONNECT</code> method (see the <code>ConnectPort</code> directive).</p>
+<p>Tinyproxy allows forwarding of <strong>HTTPS connections</strong> without modifying traffic in any way through the <code>CONNECT</code> method (see the <code>ConnectPort</code> directive, which you should disable, unless you want to restrict the users).</p>
 
 <p>Tinyproxy supports being configured as a <strong>transparent proxy</strong>, so that a proxy can be used without requiring any client-side configuration. You can also use it as a <strong>reverse proxy</strong> front-end to your websites.</p>
 
-<p>Using the <code>AddHeader</code> directive, you can <strong>add/insert HTTP headers</strong> to outgoing traffic.</p>
+<p>Using the <code>AddHeader</code> directive, you can <strong>add/insert HTTP headers</strong> to outgoing traffic (HTTP only).</p>
 
 <p>If you're looking to build a custom web proxy, Tinyproxy is <strong>easy to modify</strong> to your custom needs. The source is straightforward, adhering to the KISS principle. As such, it can be used as a foundation for anything you may need a web proxy to do.</p>
 
-<p>Tinyproxy has <strong>privacy features</strong> which can let you configure which HTTP headers should be allowed through, and which should be blocked. This allows you to restrict both what data comes to your web browser from the HTTP server (e.g., cookies), and to restrict what data is allowed through from your web browser to the HTTP server (e.g., version information).</p>
+<p>Tinyproxy has <strong>privacy features</strong> which can let you configure which HTTP headers should be allowed through, and which should be blocked. This allows you to restrict both what data comes to your web browser from the HTTP server (e.g., cookies), and to restrict what data is allowed through from your web browser to the HTTP server (e.g., version information). Note that these features do not affect HTTPS connections.</p>
 
 <p>Using the <strong>remote monitoring</strong> facility, you can access proxy statistics from afar, letting you know exactly how busy the proxy is.</p>
 
 <p>You can configure Tinyproxy to <strong>control access</strong> by only allowing requests from a certain subnet, or from a certain interface, thus ensuring that random, unauthorized people will not be using your proxy.</p>
 
-<p>With a bit of configuration (specifically, making Tinyproxy created files owned by a non-root user and running it on a port greater than 1024), Tinyproxy can be made to run without any special privileges, thus minimizing the chance of system compromise. Furthermore, it was designed with an eye towards preventing buffer overflows. The simplicity of the code ensures it remains easy to spot such bugs.</p>
+<p>With a bit of configuration (specifically, making Tinyproxy created files owned by a non-root user and running it on a port greater than 1024), Tinyproxy can be made to run without any special privileges, thus minimizing the chance of system compromise. In fact, it is <b>recommended</b> to run it as a regular/restricted user. Furthermore, it was designed with an eye towards preventing buffer overflows. The simplicity of the code ensures it remains easy to spot such bugs.</p>
 
 <h2>
 <a id="downloads" class="anchor" href="#downloads" aria-hidden="true"><span class="octicon octicon-link"></span></a>Downloads</h2>
 
+<p>Note that many distributions ship horribly outdated versions of tinyproxy, therefore it is recommended to compile it from source.</p>
+
 <ul>
 <li>On Red Hat Enterprise Linux, or its derivatives such as CentOS, install Tinyproxy from the EPEL repository by running yum install tinyproxy.</li>
 <li>On Fedora, install Tinyproxy by running yum install tinyproxy.</li>
@@ -70,7 +72,7 @@
 <li>Mac OS X users can check MacPorts to see if the Tinyproxy port there is recent enough.</li>
 </ul>
 
-<p>If you feel that the Tinyproxy binary package in your operating system is not recent, please contact the package maintainer for that particular operating system. If this fails, you can always compile the latest stable version from source code.</p>
+<p>If you feel that the Tinyproxy binary package in your operating system is not recent (likely), please contact the package maintainer for that particular operating system. If this fails, you can always compile the latest stable, or even better, the latest git master version, from source code.</p>
 
 <p>We distribute Tinyproxy in source code form, and it has to be compiled in order to be used on your system. Please see the INSTALL file in the source code tree for build instructions. The current stable version of Tinyproxy is available on the <a href="https://github.com/tinyproxy/tinyproxy/releases">releases page</a>. The Tinyproxy NEWS file contains the release notes. You can verify the tarball using its PGP signature. You can also browse the older releases of Tinyproxy.</p>
 
@@ -78,5 +80,19 @@
 
 <p>git clone <a href="https://github.com/tinyproxy/tinyproxy.git">https://github.com/tinyproxy/tinyproxy.git</a></p>
 
+<h2>
+<a id="quickstart" class="anchor" href="#quickstart" aria-hidden="true"><span class="octicon octicon-link"></span></a>Quickstart</h2>
+
+<p>The quickest way to get started is using a minimal config file like the below:</p>
+
+<pre><code>
+Port 8888
+Listen 127.0.0.1
+Timeout 600
+Allow 127.0.0.1
+</code></pre>
+
+<p>And then simply run <code>tinyproxy -d -c tinyproxy.conf</code> as your current user. This starts tinyproxy in foreground mode with <code>tinyproxy.conf</code> as its config, while logging to stdout. Now, all programs supporting a HTTP proxy can use 127.0.0.1:8888 as a proxy. You can try it out using <code>http_proxy=127.0.0.1:8888 curl example.com</code>.</p>
+
 <h2>
 <a id="documentation" class="anchor" href="#documentation" aria-hidden="true"><span class="octicon octicon-link"></span></a>Documentation</h2>

etc/Makefile.am

@@ -12,6 +12,7 @@ edit = sed \
 	-e 's|@datarootdir[@]|$(datarootdir)|g' \
 	-e 's|@pkgsysconfdir[@]|$(pkgsysconfdir)|g' \
 	-e 's|@localstatedir[@]|$(localstatedir)|g' \
+	-e 's|@runstatedir[@]|$(runstatedir)|g' \
 	-e 's|@pkgdatadir[@]|$(pkgdatadir)|g' \
 	-e 's|@prefix[@]|$(prefix)|g' \
 	-e 's|@TINYPROXY_STATHOST[@]|$(TINYPROXY_STATHOST)|g'

etc/tinyproxy.conf.in

@@ -3,7 +3,7 @@
 ##
 ## This example tinyproxy.conf file contains example settings
 ## with explanations in comments. For decriptions of all
-## parameters, see the tinproxy.conf(5) manual page.
+## parameters, see the tinyproxy.conf(5) manual page.
 ##
 
 #
@@ -124,7 +124,7 @@ LogLevel Info
 # can be used for signalling purposes.
 # If not specified, no pidfile will be written.
 #
-#PidFile "@localstatedir@/run/tinyproxy/tinyproxy.pid"
+#PidFile "@runstatedir@/tinyproxy/tinyproxy.pid"
 
 #
 # XTinyproxy: Tell Tinyproxy to include the X-Tinyproxy header, which
@@ -205,6 +205,13 @@ Allow ::1
 # users.
 #BasicAuth user password
 
+# BasicAuthRealm : In case BasicAuth is configured, the "realm" information.
+# "Proxy Authentication Required" status http 407 "error-response" can be
+# customized.
+#
+# - defaults in code to "Tinyproxy" (PACKAGE_NAME), if not configured.
+#BasicAuthRealm "Tinyproxy"
+
 #
 # AddHeader: Adds the specified headers to outgoing HTTP requests that
 # Tinyproxy makes. Note that this option will not work for HTTPS
@@ -320,6 +327,3 @@ ViaProxyName "tinyproxy"
 # If not set then no rewriting occurs.
 #
 #ReverseBaseURL "http://localhost:8888/"
-
-
-

src/child.c

@@ -81,7 +81,7 @@ void child_main_loop (void)
         int connfd;
         union sockaddr_union cliaddr_storage;
         struct sockaddr *cliaddr = (void*) &cliaddr_storage;
-        socklen_t clilen = sizeof(cliaddr_storage);
+        socklen_t clilen;
         int nfds = sblist_getsize(listen_fds);
         pollfd_struct *fds = safecalloc(nfds, sizeof *fds);
         ssize_t i;
@@ -167,6 +167,7 @@ void child_main_loop (void)
                  * Continue handling this connection.
                  */
 
+                clilen = sizeof(cliaddr_storage);
                 connfd = accept (listenfd, cliaddr, &clilen);
 
 

src/conf-tokens.c

@@ -57,6 +57,7 @@ config_directive_find (register const char *str, register size_t len)
       {"connectport", CD_connectport},
       {"logfile", CD_logfile},
       {"basicauth", CD_basicauth},
+      {"basicauthrealm", CD_basicauthrealm},
       {"addheader", CD_addheader},
       {"maxrequestsperchild", CD_maxrequestsperchild}
     };

src/conf-tokens.gperf

@@ -44,6 +44,7 @@ allow, CD_allow
 deny, CD_deny
 bind, CD_bind
 basicauth, CD_basicauth
+basicauthrealm, CD_basicauthrealm
 errorfile, CD_errorfile
 addheader, CD_addheader
 filter, CD_filter

src/conf-tokens.h

@@ -29,6 +29,7 @@ CD_allow,
 CD_deny,
 CD_bind,
 CD_basicauth,
+CD_basicauthrealm,
 CD_errorfile,
 CD_addheader,
 CD_filter,

src/conf.c

@@ -66,9 +66,10 @@
 #define PASSWORD "([^@]*)"
 #define IP "((([0-9]{1,3})\\.){3}[0-9]{1,3})"
 #define IPMASK "(" IP "(/" DIGIT "+)?)"
+#define IPV6SCOPE "((%[^ \t\\/]{1,16})?)"
 #define IPV6 "(" \
-        "(([0-9a-f:]{2,39}))|" \
-        "(([0-9a-f:]{0,29}:" IP "))" \
+        "([0-9a-f:]{2,39})" IPV6SCOPE "|" \
+        "([0-9a-f:]{0,29}:" IP ")" IPV6SCOPE \
         ")"
 
 #define IPV6MASK "(" IPV6 "(/" DIGIT "+)?)"
@@ -80,7 +81,7 @@
  * number.  Given the usual structure of the configuration file, sixteen
  * substring matches should be plenty.
  */
-#define RE_MAX_MATCHES 24
+#define RE_MAX_MATCHES 33
 
 #define CP_WARN(FMT, ...) \
         log_message (LOG_WARNING, "line %lu: " FMT, lineno, __VA_ARGS__)
@@ -121,6 +122,7 @@ static HANDLE_FUNC (handle_disabled_feature)
 
 static HANDLE_FUNC (handle_allow);
 static HANDLE_FUNC (handle_basicauth);
+static HANDLE_FUNC (handle_basicauthrealm);
 static HANDLE_FUNC (handle_anonymous);
 static HANDLE_FUNC (handle_bind);
 static HANDLE_FUNC (handle_bindsame);
@@ -192,6 +194,7 @@ struct {
         regex_t *cre;
 } directives[] = {
         /* string arguments */
+        STDCONF (basicauthrealm, STR, handle_basicauthrealm),
         STDCONF (logfile, STR, handle_logfile),
         STDCONF (pidfile, STR, handle_pidfile),
         STDCONF (anonymous, STR, handle_anonymous),
@@ -224,7 +227,7 @@ struct {
                  handle_deny),
         STDCONF (bind, "(" IP "|" IPV6 ")", handle_bind),
         /* other */
-        STDCONF (basicauth, ALNUM WS ALNUM, handle_basicauth),
+        STDCONF (basicauth, USERNAME WS PASSWORD, handle_basicauth),
         STDCONF (errorfile, INT WS STR, handle_errorfile),
         STDCONF (addheader,  STR WS STR, handle_addheader),
 
@@ -249,7 +252,7 @@ struct {
                  "(" "(none)" WS STR ")|" \
                  "(" "(http|socks4|socks5)" WS \
                      "(" USERNAME /*username*/ ":" PASSWORD /*password*/ "@" ")?"
-                     "(" IP "|" ALNUM ")"
+                     "(" IP "|" "\\[(" IPV6 ")\\]" "|" ALNUM ")"
                      ":" INT "(" WS STR ")?" ")", handle_upstream),
 #endif
         /* loglevel */
@@ -293,6 +296,7 @@ void free_config (struct config_s *conf)
         char *k;
         htab_value *v;
         size_t it;
+        safefree (conf->basicauth_realm);
         safefree (conf->logf_name);
         safefree (conf->stathost);
         safefree (conf->user);
@@ -427,7 +431,7 @@ static int config_parse (struct config_s *conf, FILE * f)
                 while(isspace(*p))p++;
                 if(!*p) continue;
                 q = p;
-                while(!isspace(*q))q++;
+                while(*q && !isspace(*q))q++;
                 c = *q;
                 *q = 0;
                 e = config_directive_find(p, strlen(p));
@@ -480,6 +484,7 @@ static void initialize_config_defaults (struct config_s *conf)
          * (FIXME: Should have a better API for all this)
          */
         conf->errorpages = NULL;
+        conf->basicauth_realm = safestrdup (PACKAGE_NAME);
         conf->stathost = safestrdup (TINYPROXY_STATHOST);
         conf->idletimeout = MAX_IDLE_TIME;
         conf->logf_name = NULL;
@@ -633,6 +638,11 @@ set_int_arg (unsigned int *var, const char *line, regmatch_t * match)
  *
  ***********************************************************************/
 
+static HANDLE_FUNC (handle_basicauthrealm)
+{
+        return set_string_arg (&conf->basicauth_realm, line, &match[2]);
+}
+
 static HANDLE_FUNC (handle_logfile)
 {
         return set_string_arg (&conf->logf_name, line, &match[2]);
@@ -1008,7 +1018,7 @@ static HANDLE_FUNC (handle_filtertype)
         if (!type) return -1;
 
         for(i=0;i<sizeof(ftmap)/sizeof(ftmap[0]);++i)
-                if(!strcmp(ftmap[i].type, type))
+                if(!strcasecmp(ftmap[i].type, type))
                         conf->filter_opts |= ftmap[i].flag;
 
         safefree (type);
@@ -1114,10 +1124,13 @@ static HANDLE_FUNC (handle_upstream)
                 pass = get_string_arg (line, &match[mi]);
         mi++;
 
-        ip = get_string_arg (line, &match[mi]);
+        if (match[mi+4].rm_so != -1) /* IPv6 address in square brackets */
+                ip = get_string_arg (line, &match[mi+4]);
+        else
+                ip = get_string_arg (line, &match[mi]);
         if (!ip)
                 return -1;
-        mi += 5;
+        mi += 16;
 
         port = (int) get_long_arg (line, &match[mi]);
         mi += 3;

src/conf.h

@@ -39,6 +39,7 @@ typedef struct {
  */
 struct config_s {
         sblist *basicauth_list;
+        char *basicauth_realm;
         char *logf_name;
         unsigned int syslog;    /* boolean */
         unsigned int port;

src/hsearch.c

@@ -80,9 +80,10 @@ static int resize(struct htab *htab, size_t nel)
 {
 	size_t newsize;
 	size_t i, j;
+	size_t oldmask = htab->mask;
 	struct elem *e, *newe;
 	struct elem *oldtab = htab->elems;
-	struct elem *oldend = htab->elems + htab->mask + 1;
+	struct elem *oldend;
 
 	if (nel > MAXSIZE)
 		nel = MAXSIZE;
@@ -95,6 +96,8 @@ static int resize(struct htab *htab, size_t nel)
 	htab->mask = newsize - 1;
 	if (!oldtab)
 		return 1;
+
+	oldend = oldtab + oldmask + 1;
 	for (e = oldtab; e < oldend; e++)
 		if (e->item.key) {
 			for (i=e->hash,j=1; ; i+=j++) {

src/html-error.c

@@ -140,14 +140,14 @@ int send_http_headers (
 {
         const char headers[] =
             "HTTP/1.%u %d %s\r\n"
-            "Server: %s/%s\r\n"
+            "Server: %s\r\n"
             "Content-Type: text/html\r\n"
             "%s"
             "Connection: close\r\n" "\r\n";
 
         return (write_message (connptr->client_fd, headers,
                                connptr->protocol.major != 1 ? 0 : connptr->protocol.minor,
-                               code, message, PACKAGE, VERSION,
+                               code, message, PACKAGE,
                                extra));
 }
 
@@ -169,24 +169,34 @@ int send_http_error_message (struct conn_s *connptr)
             "<h1>%s</h1>\n"
             "<p>%s</p>\n"
             "<hr />\n"
-            "<p><em>Generated by %s version %s.</em></p>\n" "</body>\n"
+            "<p><em>Generated by %s.</em></p>\n" "</body>\n"
             "</html>\n";
 
-        const char p_auth_str[] =
-            "Proxy-Authenticate: Basic realm=\""
-            PACKAGE_NAME "\"\r\n";
-
-        const char w_auth_str[] =
-            "WWW-Authenticate: Basic realm=\""
-            PACKAGE_NAME "\"\r\n";
-
 	/* according to rfc7235, the 407 error must be accompanied by
            a Proxy-Authenticate header field. */
-        const char *add = connptr->error_number == 407 ? p_auth_str :
-                          (connptr->error_number == 401 ? w_auth_str : "");
+        const char *auth_str_type = 
+                connptr->error_number == 407 ? "Proxy-Authenticate" :
+                (connptr->error_number == 401 ? "WWW-Authenticate" : "");
+
+        const char auth_str_tpl[] = "%s: Basic realm=\"%s\"\r\n";
+        char* auth_str_add = NULL;
+
+        if (auth_str_type[0] != 0) {
+                int auth_str_size = snprintf (NULL, 0, auth_str_tpl, 
+                                        auth_str_type, config->basicauth_realm) + 1;
+                if (auth_str_size > 0) {
+                        auth_str_add = safemalloc (auth_str_size);
+                        if (auth_str_add != NULL) {
+                                snprintf (auth_str_add, auth_str_size, auth_str_tpl,
+                                        auth_str_type, config->basicauth_realm);
+                        }
+                }
+        }
 
         send_http_headers (connptr, connptr->error_number,
-                           connptr->error_string, add);
+                           connptr->error_string, auth_str_add ? auth_str_add : "");
+
+        if (auth_str_add) safefree (auth_str_add);
 
         error_file = get_html_file (connptr->error_number);
         if (!error_file || !(infile = fopen (error_file, "r"))) {
@@ -199,7 +209,7 @@ int send_http_error_message (struct conn_s *connptr)
                                        connptr->error_number,
                                        connptr->error_string,
                                        connptr->error_string,
-                                       detail, PACKAGE, VERSION));
+                                       detail, PACKAGE));
         }
 
         ret = send_html_file (infile, connptr);

src/main.c

@@ -257,7 +257,7 @@ int reload_config (int reload_logging)
         int ret, ret2;
         struct config_s *c_next = get_next_config();
 
-        log_message (LOG_NOTICE, "Reloading config file");
+        log_message (LOG_NOTICE, "Reloading config file (%s)", config_file);
 
         if (reload_logging) shutdown_logging ();
 

src/reqs.c

@@ -301,21 +301,16 @@ establish_http_connection (struct conn_s *connptr, struct request_s *request)
 }
 
 /*
- * These two defines are for the SSL tunnelling.
+ * Send the appropriate response to the client to establish a
+ * connection via CONNECT method.
  */
-#define SSL_CONNECTION_RESPONSE "HTTP/1.0 200 Connection established"
-#define PROXY_AGENT "Proxy-agent: " PACKAGE "/" VERSION
-
-/*
- * Send the appropriate response to the client to establish a SSL
- * connection.
- */
-static int send_ssl_response (struct conn_s *connptr)
+static int send_connect_method_response (struct conn_s *connptr)
 {
         return write_message (connptr->client_fd,
-                              "%s\r\n"
-                              "%s\r\n"
-                              "\r\n", SSL_CONNECTION_RESPONSE, PROXY_AGENT);
+                              "HTTP/1.%u 200 Connection established\r\n"
+                              "Proxy-agent: " PACKAGE "\r\n"
+                              "\r\n", connptr->protocol.major != 1 ? 0 :
+                                      connptr->protocol.minor);
 }
 
 /*
@@ -327,9 +322,11 @@ static struct request_s *process_request (struct conn_s *connptr,
 {
         char *url;
         struct request_s *request;
-        int ret;
+        int ret, skip_trans;
         size_t request_len;
 
+        skip_trans = 0;
+
         /* NULL out all the fields so frees don't cause segfaults. */
         request =
             (struct request_s *) safecalloc (1, sizeof (struct request_s));
@@ -346,8 +343,12 @@ static struct request_s *process_request (struct conn_s *connptr,
                 goto fail;
         }
 
+        /* zero-terminate the strings so they don't contain junk in error page */
+        request->method[0] = url[0] = request->protocol[0] = 0;
+
         ret = sscanf (connptr->request_line, "%[^ ] %[^ ] %[^ ]",
                       request->method, url, request->protocol);
+
         if (ret == 2 && !strcasecmp (request->method, "GET")) {
                 request->protocol[0] = 0;
 
@@ -402,6 +403,7 @@ BAD_REQUEST_ERROR:
                         }
                         safefree (url);
                         url = reverse_url;
+                        skip_trans = 1;
                 } else if (config->reverseonly) {
                         log_message (LOG_ERR,
                                      "Bad request, no mapping for '%s' found",
@@ -451,11 +453,13 @@ BAD_REQUEST_ERROR:
                 connptr->connect_method = TRUE;
         } else {
 #ifdef TRANSPARENT_PROXY
-                if (!do_transparent_proxy
-                    (connptr, hashofheaders, request, config, &url)) {
-                        goto fail;
-                }
-#else
+                if (!skip_trans) {
+                        if (!do_transparent_proxy
+                            (connptr, hashofheaders, request, config, &url))
+                                goto fail;
+                } else
+#endif
+                {
                 indicate_http_error (connptr, 501, "Not Implemented",
                                      "detail",
                                      "Unknown method or unsupported protocol.",
@@ -463,7 +467,7 @@ BAD_REQUEST_ERROR:
                 log_message (LOG_INFO, "Unknown method (%s) or protocol (%s)",
                              request->method, url);
                 goto fail;
-#endif
+                }
         }
 
 #ifdef FILTER_ENABLE
@@ -775,7 +779,7 @@ static int remove_connection_headers (orderedmap hashofheaders)
         char *data;
         char *ptr;
         ssize_t len;
-        int i;
+        int i,j,df;
 
         for (i = 0; i != (sizeof (headers) / sizeof (char *)); ++i) {
                 /* Look for the connection header.  If it's not found, return. */
@@ -800,7 +804,12 @@ static int remove_connection_headers (orderedmap hashofheaders)
                  */
                 ptr = data;
                 while (ptr < data + len) {
-                        orderedmap_remove (hashofheaders, ptr);
+                        df = 0;
+                        /* check that ptr isn't one of headers to prevent
+                           double-free (CVE-2023-49606) */
+                        for (j = 0; j != (sizeof (headers) / sizeof (char *)); ++j)
+                                if(!strcasecmp(ptr, headers[j])) df = 1;
+                        if (!df) orderedmap_remove (hashofheaders, ptr);
 
                         /* Advance ptr to the next token */
                         ptr += strlen (ptr) + 1;
@@ -872,15 +881,14 @@ write_via_header (int fd, orderedmap hashofheaders,
         data = orderedmap_find (hashofheaders, "via");
         if (data) {
                 ret = write_message (fd,
-                                     "Via: %s, %hu.%hu %s (%s/%s)\r\n",
-                                     data, major, minor, hostname, PACKAGE,
-                                     VERSION);
+                                     "Via: %s, %hu.%hu %s (%s)\r\n",
+                                     data, major, minor, hostname, PACKAGE);
 
                 orderedmap_remove (hashofheaders, "via");
         } else {
                 ret = write_message (fd,
-                                     "Via: %hu.%hu %s (%s/%s)\r\n",
-                                     major, minor, hostname, PACKAGE, VERSION);
+                                     "Via: %hu.%hu %s (%s)\r\n",
+                                     major, minor, hostname, PACKAGE);
         }
 
 done:
@@ -1278,6 +1286,7 @@ static void relay_connection (struct conn_s *connptr)
         return;
 }
 
+#ifdef UPSTREAM_SUPPORT
 static int
 connect_to_upstream_proxy(struct conn_s *connptr, struct request_s *request)
 {
@@ -1394,7 +1403,7 @@ connect_to_upstream_proxy(struct conn_s *connptr, struct request_s *request)
 
 	return establish_http_connection(connptr, request);
 }
-
+#endif
 
 /*
  * Establish a connection to the upstream proxy server.
@@ -1550,6 +1559,19 @@ static void handle_connection_failure(struct conn_s *connptr, int got_headers)
         }
 }
 
+static void auth_error(struct conn_s *connptr, int code) {
+        const char *tit = code == 401 ? "Unauthorized" : "Proxy Authentication Required";
+        const char *msg = code == 401 ?
+        "The administrator of this proxy has not configured it to service requests from you." :
+        "This proxy requires authentication.";
+
+        update_stats (STAT_DENIED);
+        log_message (LOG_INFO,
+                     "Failed auth attempt (file descriptor: %d), ip %s",
+                     connptr->client_fd,
+                     connptr->client_ip_addr);
+        indicate_http_error (connptr, code, tit, "detail", msg, NULL);
+}
 
 /*
  * This is the main drive for each connection. As you can tell, for the
@@ -1668,12 +1690,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr)
                 }
 
                 if (!authstring) {
-                        if (stathost_connect) goto e401;
-                        update_stats (STAT_DENIED);
-                        indicate_http_error (connptr, 407, "Proxy Authentication Required",
-                                             "detail",
-                                             "This proxy requires authentication.",
-                                             NULL);
+                        auth_error(connptr, stathost_connect ? 401 : 407);
                         HC_FAIL();
                 }
                 if ( /* currently only "basic" auth supported */
@@ -1682,13 +1699,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr)
                         basicauth_check (config->basicauth_list, authstring + 6) == 1)
                                 failure = 0;
                 if(failure) {
-e401:
-                        update_stats (STAT_DENIED);
-                        indicate_http_error (connptr, 401, "Unauthorized",
-                                             "detail",
-                                             "The administrator of this proxy has not configured "
-                                             "it to service requests from you.",
-                                             NULL);
+                        auth_error(connptr, stathost_connect ? 401 : 407);
                         HC_FAIL();
                 }
                 orderedmap_remove (hashofheaders, "proxy-authorization");
@@ -1762,10 +1773,10 @@ e401:
                         HC_FAIL();
                 }
         } else {
-                if (send_ssl_response (connptr) < 0) {
+                if (send_connect_method_response (connptr) < 0) {
                         log_message (LOG_ERR,
-                                     "handle_connection: Could not send SSL greeting "
-                                     "to client.");
+                                     "handle_connection: Could not send CONNECT"
+                                     " method greeting to client.");
                         update_stats (STAT_BADCONN);
                         HC_FAIL();
                 }

src/stats.c

@@ -87,9 +87,9 @@ err_minus_one:
                    "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.1//EN\" "
                    "\"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd\">\n"
                    "<html>\n"
-                   "<head><title>%s version %s run-time statistics</title></head>\n"
+                   "<head><title>%s run-time statistics</title></head>\n"
                    "<body>\n"
-                   "<h1>%s version %s run-time statistics</h1>\n"
+                   "<h1>%s run-time statistics</h1>\n"
                    "<p>\n"
                    "Number of open connections: %lu<br />\n"
                    "Number of requests: %lu<br />\n"
@@ -98,13 +98,13 @@ err_minus_one:
                    "Number of refused connections due to high load: %lu\n"
                    "</p>\n"
                    "<hr />\n"
-                   "<p><em>Generated by %s version %s.</em></p>\n" "</body>\n"
+                   "<p><em>Generated by %s.</em></p>\n" "</body>\n"
                    "</html>\n",
-                   PACKAGE, VERSION, PACKAGE, VERSION,
+                   PACKAGE, PACKAGE,
                    stats->num_open,
                    stats->num_reqs,
                    stats->num_badcons, stats->num_denied,
-                   stats->num_refused, PACKAGE, VERSION);
+                   stats->num_refused, PACKAGE);
 
                 if (send_http_message (connptr, 200, "OK",
                                        message_buffer) < 0) {

src/utils.c

@@ -39,7 +39,7 @@ send_http_message (struct conn_s *connptr, int http_code,
                    const char *error_title, const char *message)
 {
         static const char *headers[] = {
-                "Server: " PACKAGE "/" VERSION,
+                "Server: " PACKAGE,
                 "Content-type: text/html",
                 "Connection: close"
         };

tests/scripts/webclient.pl

@@ -26,9 +26,8 @@ use Pod::Usage;
 
 my $EOL = "\015\012";
 
-my $VERSION = "0.1";
 my $NAME = "Tinyproxy-Web-Client";
-my $user_agent = "$NAME/$VERSION";
+my $user_agent = "$NAME";
 my $user_agent_header = "User-Agent: $user_agent$EOL";
 my $http_version = "1.0";
 my $method = "GET";

tests/scripts/webserver.pl

@@ -31,9 +31,8 @@ use Getopt::Long;
 use Pod::Usage;
 use Fcntl ':flock'; # import LOCK_* constants
 
-my $VERSION = "0.1";
 my $NAME = "Tinyproxy-Test-Web-Server";
-my $server_header = "Server: $NAME/$VERSION";
+my $server_header = "Server: $NAME";
 
 my $EOL = "\015\012";