Fabian Keil [Sun, 31 Mar 2024 11:50:02 +0000 (13:50 +0200)]
wolfSSL: Make it more obvious that Subject Alternative Name support is mandatory
Fabian Keil [Sun, 31 Mar 2024 11:15:33 +0000 (13:15 +0200)]
Add Juliusz Sosinowicz as contributor
Fabian Keil [Sun, 31 Mar 2024 11:11:59 +0000 (13:11 +0200)]
wolfSSL: Include wolfssl/openssl/pem.h
Apparently this is needed on some systems including Linux Mint 21.2.
Reported by by Juliusz Sosinowicz.
Fabian Keil [Sun, 31 Mar 2024 10:54:25 +0000 (12:54 +0200)]
wolfSSL: Use WOLFSSL_X509_V_OK instead of X509_V_OK
They have the same value but X509_V_OK may need
an additional header.
Reported by withoutname in #1765.
Fabian Keil [Sun, 17 Mar 2024 18:00:25 +0000 (19:00 +0100)]
privoxy-log-parser: Bump copyright
Fabian Keil [Sun, 17 Mar 2024 18:00:05 +0000 (19:00 +0100)]
privoxy-log-parser: Highlight 'Keeping chunk offset at 0 despite flushing 31 bytes.'
Fabian Keil [Sun, 17 Mar 2024 17:59:35 +0000 (18:59 +0100)]
handle_established_connection(): Add a period to a log message
Fabian Keil [Fri, 10 Jun 2022 15:56:44 +0000 (17:56 +0200)]
Add test scenario acl-destination-permitted
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 10 Jun 2022 15:45:12 +0000 (17:45 +0200)]
Add test scenario acl-destination-denied
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 10 Jun 2022 15:15:52 +0000 (17:15 +0200)]
Add test scenario acl-ip-address-denied
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 10 Jun 2022 15:15:42 +0000 (17:15 +0200)]
Add test scenario acl-ip-address-permitted
Sponsored by: Privoxy project funds collected at SPI
Roland Rosenfeld [Wed, 1 Jun 2022 11:26:55 +0000 (13:26 +0200)]
tests/cts: When there's lots of POST data, read it from a file
... instead of the command line (two more tests affected).
Fabian Keil [Tue, 24 May 2022 06:07:40 +0000 (08:07 +0200)]
tests/cts: When there's lots of POST data, read it from a file
... instead of the command line.
Makes it less likely that the curl executions fails due
to the argument list being too long.
Reported by: Roland
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Wed, 10 Mar 2021 15:05:04 +0000 (16:05 +0100)]
Add test scenario chunked-transfer-encoding-https
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 17 Mar 2024 18:11:19 +0000 (19:11 +0100)]
Test scenario chunked-transfer-encoding: Skip tests that require 'writesize' support
... in the curl test framework as the patch hasn't been upstreamed yet.
Fabian Keil [Sat, 23 Jan 2021 14:22:03 +0000 (15:22 +0100)]
Add test scenario chunked-transfer-encoding
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Tue, 8 Feb 2022 12:22:11 +0000 (13:22 +0100)]
Add test scenario blocked-https-requests
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 6 Feb 2021 10:57:24 +0000 (11:57 +0100)]
Add test scenario gif-deanimation
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 28 Mar 2021 09:09:29 +0000 (11:09 +0200)]
Add test scenario client-tags
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 28 Mar 2021 01:05:37 +0000 (03:05 +0200)]
Add test scenario client-body-tagger-https
Sponsored by: Robert Klemme
Fabian Keil [Sat, 27 Mar 2021 14:04:11 +0000 (15:04 +0100)]
Add test scenario client-body-tagger
Sponsored by: Robert Klemme
Fabian Keil [Fri, 26 Mar 2021 11:01:28 +0000 (12:01 +0100)]
Add test scenario client-body-filter-https
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 26 Mar 2021 06:06:07 +0000 (07:06 +0100)]
Add test scenario client-body-filter
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Tue, 9 Mar 2021 16:40:54 +0000 (17:40 +0100)]
Add test scenario forward-to-socks-proxy
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Tue, 9 Mar 2021 09:16:06 +0000 (10:16 +0100)]
Add test scenario forward-to-http-proxy
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 5 Mar 2021 07:19:04 +0000 (08:19 +0100)]
Add test scenario pac-file-delivery
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Wed, 3 Feb 2021 10:41:43 +0000 (11:41 +0100)]
Add test scenario user-manual-https
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Wed, 3 Feb 2021 10:36:51 +0000 (11:36 +0100)]
Add test scenario user-manual-http
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Thu, 28 Jan 2021 13:56:59 +0000 (14:56 +0100)]
Add test scenario gzip compression
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 22 Jan 2021 15:32:10 +0000 (16:32 +0100)]
Add test scenario header-filters
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Tue, 19 Jan 2021 17:54:50 +0000 (18:54 +0100)]
Add test scenario content-filters
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 10 Jan 2021 15:18:17 +0000 (16:18 +0100)]
Add upstream-tests scenario
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 10 Jan 2021 09:17:30 +0000 (10:17 +0100)]
Add tests for redirects for https-inspected requests
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 10 Jan 2021 08:48:35 +0000 (09:48 +0100)]
Add redirect tests
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 9 Jan 2021 18:54:09 +0000 (19:54 +0100)]
Add tests for destination rewrite
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 10 Jan 2021 03:37:16 +0000 (04:37 +0100)]
Add tests for rewrite behind the client's back with https
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 9 Jan 2021 18:05:53 +0000 (19:05 +0100)]
Add tests for client-header-order with https-inspection enabled
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 9 Jan 2021 15:49:29 +0000 (16:49 +0100)]
Add client-header-order tests
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 27 Feb 2021 09:54:18 +0000 (10:54 +0100)]
Add a README for the tests based on the curl test suite (cts)
Contains improvements made after feedback from Roland.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 10 Jan 2021 05:50:06 +0000 (06:50 +0100)]
Add run-privoxy-tests.sh
... which takes care of starting Privoxy before running tests.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Fri, 22 Jan 2021 08:25:39 +0000 (09:25 +0100)]
Add logs directory for the tests based on the curl test suite
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 12 Jul 2014 12:15:23 +0000 (14:15 +0200)]
Add a generated test manifest file
.. to skip curl tests that aren't relevant for Privoxy or
are known not to work for other reasons.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 17 Nov 2012 14:02:18 +0000 (15:02 +0100)]
Add a script to generate a runtests.pl exclude file for Privoxy
curl tests that are known not to work with Privoxy are skipped.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sat, 9 Jan 2021 15:49:08 +0000 (16:49 +0100)]
Add runtests-wrapper.sh
A wrapper around curl's runtests.pl.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 15 Jun 2014 16:28:51 +0000 (18:28 +0200)]
Add privoxy-runtests.pm
Overwrites some of the functions used by curl's runtests.pl
to let it properly deal with Privoxy being used as proxy.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Sun, 17 Mar 2024 13:11:01 +0000 (14:11 +0100)]
Add Fabrice Fontaine as contributor
Fabrice Fontaine [Sun, 17 Mar 2024 11:36:31 +0000 (12:36 +0100)]
GNUmakefile.in: Don't exit if configuration files are installed as root
... as this can be considered acceptable when cross-compiling
Privoxy inside an autobuilder with only a root user.
Fabian Keil [Wed, 28 Feb 2024 16:52:37 +0000 (17:52 +0100)]
Disable fast-redirect for syndication.twitter.com/
Fabian Keil [Thu, 4 Jan 2024 04:44:12 +0000 (05:44 +0100)]
Unblock .datenschmutz.de/
Fabian Keil [Thu, 11 Mar 2021 17:08:11 +0000 (18:08 +0100)]
user-manual: List wolfSSL as potential dependency
... in the 'Third-party licenses and copyrights' section.
Sponsored by: Privoxy project funds collected at SPI
Fabian Keil [Tue, 12 Jan 2021 07:12:38 +0000 (08:12 +0100)]
Allow to use wolfSSL for https inspection
It's licensed under GPlv2 or later and unlike mbedTLS
there don't seem to be plans to change the license.
As a bonus, wolfSSL supports TLS 1.3 and can be significantly
faster than mbedTLS. Mainly tested on ElectroBSD amd64 where
it can compete with OpenSSL and LibreSSL:
https://www.fabiankeil.de/gehacktes/privoxy-tls-benchmarks/
To enable the support, install wolfSSL and run ./configure
with the --with-wolfssl option.
Privoxy users and packagers that currently build Privoxy
binaries with mbedTLS may want to consider using wolfSSL
in the future once it has been properly tested.
Sponsored by: Privoxy project funds collected at SPI
Roland Rosenfeld [Tue, 2 Jan 2024 18:29:06 +0000 (19:29 +0100)]
Merge Debian 3.0.34-2/3 into Upstream tree.
This fixes the build dependency on libpcre2-dev, since upstream alreay
uses pcre2.
Roland Rosenfeld [Tue, 2 Jan 2024 18:21:44 +0000 (19:21 +0100)]
Remove ./ prefix from tarball-dist files.
Fabian Keil [Mon, 18 Dec 2023 13:58:37 +0000 (14:58 +0100)]
Bump copyright
Fabian Keil [Mon, 18 Dec 2023 13:07:12 +0000 (14:07 +0100)]
Add Florian Weimer as contributor
Fabian Keil [Tue, 19 Dec 2023 10:48:37 +0000 (11:48 +0100)]
configure.in: Fix argument types in gmtime_r() and localtime_r() probes
Otherwise these probes always fail with stricter compilers
even if there is C library support for these functions.
Patch submitted by Florian Weimer in SF#149.
Fabian Keil [Sun, 26 Nov 2023 00:16:39 +0000 (01:16 +0100)]
receive_encrypted_request_headers(): Add periods to a couple of log messages
Fabian Keil [Thu, 16 Nov 2023 13:27:17 +0000 (14:27 +0100)]
Bump copyright
Fabian Keil [Thu, 16 Nov 2023 13:17:42 +0000 (14:17 +0100)]
Add Ingo Blechschmidt as contributor
Ingo Blechschmidt [Sun, 5 Nov 2023 22:43:54 +0000 (23:43 +0100)]
Fix socks4 and socks4a support under glibc's source fortification
With glib'c source fortification, gcc offers the compilation warning
gateway.c: In function 'socks4_connect':
gateway.c:840:4: warning: 'strlcpy' writing 4988 bytes into a region of size 1 overflows the destination
840 | strlcpy(&(c->userid), socks_userid, sizeof(buf) - sizeof(struct socks_op));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
gateway.c:112:9: note: destination object 'userid' of size 1
112 | char userid; /* first byte of userid */
| ^~~~~~
resulting in a runtime abort() when using a socks4 or socks4a upstream proxy:
$ privoxy --no-daemon <(echo 'forward-socks4 / 127.0.0.1:9050 .')
7fef77483740 Info: Privoxy version 3.0.34
7fef77483740 Info: Program name: privoxy
*** buffer overflow detected ***: terminated
rc: line 3: 321835 Aborted (core dumped) privoxy --no-daemon <(echo 'forward-socks4 / 127.0.0.1:9050 .')
Despite the warning, the strlcpy() call in question is fine: gcc
misidentifies the size of the destination buffer, estimating to hold
only a single char while in fact the buffer stretches beyond the end of
the struct socks_op.
This commit fixes this issue in a way which is in line with the second
strlcpy() call in the socks4_connect(). Alternatively, we could also
remove the padding member and promote userid to a trailing flexible array
member. However, this would necessitate further adjustments because that
way the size of struct socks_op would change.
The issue was originally reported in the NixOS issue tracker at
https://github.com/NixOS/nixpkgs/issues/265654
prompted by an upgrade of glibc from 2.37-39 to 2.38-0, and the fix is
joint work with @esclear and @richi235.
Fabian Keil [Mon, 30 Oct 2023 20:13:50 +0000 (21:13 +0100)]
create_client_ssl_connection(): Make it more obviours from an error message that a function failed
Fabian Keil [Fri, 27 Oct 2023 19:18:51 +0000 (21:18 +0200)]
privoxy-log-parser: Highlight: 'Couldn't deliver the error message for [...]'
Fabian Keil [Tue, 17 Oct 2023 16:44:08 +0000 (18:44 +0200)]
Bump copyright
Fabian Keil [Mon, 16 Oct 2023 19:22:40 +0000 (21:22 +0200)]
privoxy-log-parser: Bump copyright
Fabian Keil [Mon, 16 Oct 2023 19:10:31 +0000 (21:10 +0200)]
privoxy-log-parser: Highlight 'Failed to accept() incoming connection: Software caused connection abort'
Fabian Keil [Mon, 16 Oct 2023 19:09:07 +0000 (21:09 +0200)]
listen_loop(): Improve an error message
Fabian Keil [Sun, 10 Sep 2023 08:16:30 +0000 (10:16 +0200)]
Bump copyright
Fabian Keil [Sun, 10 Sep 2023 07:44:10 +0000 (09:44 +0200)]
Use stringify() instead of section_target()
... and remove section_target(). Like the XXX comment suggested
this could be done my moving the hash into the templates which
seems preferable anyway.
Fabian Keil [Thu, 28 Sep 2023 16:37:22 +0000 (18:37 +0200)]
Block requests to secure-eu.nmrodam.com/
Fabian Keil [Sat, 9 Sep 2023 11:27:24 +0000 (13:27 +0200)]
Block requests to o2.mouseflow.com/
Fabian Keil [Sun, 8 Oct 2023 14:21:42 +0000 (16:21 +0200)]
uagen: Bump copyright
Fabian Keil [Sun, 8 Oct 2023 14:11:06 +0000 (16:11 +0200)]
uagen: Bump version
Fabian Keil [Sun, 8 Oct 2023 14:09:12 +0000 (16:09 +0200)]
uagen: Bump BROWSER_VERSION and BROWSER_REVISION
... to match Firefox ESR 115.
I don't know why the BROWSER_REVISION is still at 109
but that's what Firefox ESR 115 uses when compiled
on ElectroBSD.
Fabian Keil [Mon, 11 Sep 2023 18:10:56 +0000 (20:10 +0200)]
Disable fast-redirects for /wp-content/plugins/pdf-viewer-for-elementor
Fabian Keil [Sat, 9 Sep 2023 09:59:25 +0000 (11:59 +0200)]
Bump MAX_FILTER_TYPES
... which should have been done in
d128e6aa41 when introducing
the client-body-tagger{} action.
Prevents an assertion in cgi_edit_actions_for_url() from triggering
after
e32d03e0 when using the CGI editor with assertions enabled.
Fabian Keil [Sat, 9 Sep 2023 07:06:44 +0000 (09:06 +0200)]
Add Aaron Li as contributor
Fabian Keil [Sat, 9 Sep 2023 06:55:33 +0000 (08:55 +0200)]
Add missing client-body-tagger data to the action_type_info[] struct
... so lookups based on the action index work correctly again.
Prevents assertion failures or segfaults when trying to edit
an action file with the CGI editor.
The type of failure depended on whether or not assertions
were enabled and on whether or not Privoxy had been compiled
with FEATURE_EXTERNAL_FILTERS.
Regression introduced in Privoxy 3.0.34.
Patch submitted by Aaron Li in #940.
Fabian Keil [Sat, 9 Sep 2023 06:41:37 +0000 (08:41 +0200)]
cgi_edit_actions_for_url(): Wrap line sooner
Fabian Keil [Sat, 9 Sep 2023 06:17:52 +0000 (08:17 +0200)]
action_render_string_actions_template(): Assert that the multi action index is valid
Fabian Keil [Sat, 9 Sep 2023 06:16:08 +0000 (08:16 +0200)]
cgi_edit_actions_for_url(): Assert that the multi action index is valid
Fabian Keil [Sat, 9 Sep 2023 06:14:31 +0000 (08:14 +0200)]
cgi_edit_actions_for_url(): Add missing space
Fabian Keil [Sat, 9 Sep 2023 06:11:30 +0000 (08:11 +0200)]
action_render_string_actions_template: Fix spelling in description and re-flow
Fabian Keil [Sat, 9 Sep 2023 06:08:34 +0000 (08:08 +0200)]
action_render_string_actions_template(): Adjust space around function parameters
Fabian Keil [Sun, 27 Aug 2023 10:39:22 +0000 (12:39 +0200)]
Add a regression test for left-anchored path patterns
Fabian Keil [Sun, 27 Aug 2023 10:26:02 +0000 (12:26 +0200)]
pcre2 compile_pattern(): Actually pass the anchored pattern to pcre2_compile()
Previously the un-anchoring pattern was compiled resulting
in incorrect matches.
For example requests to:
https://www.privoxy.org/user-manual/config.html
were redirected because of the default.action section:
{+redirect{http://config.privoxy.org/}}
# Sticky Actions = +redirect{http://config.privoxy.org/}
# URL = http://www.privoxy.org/config
# Redirected URL = http://www.privoxy.org/config
# Redirect Destination = http://config.privoxy.org/
.privoxy.org/config
As the path pattern is left-anchored it should not match.
Fabian Keil [Sun, 27 Aug 2023 10:13:48 +0000 (12:13 +0200)]
configure: Fix --disable-pcre2
Previously it would result in neither pcre library being detected:
checking for getnameinfo... (cached) yes
configure: WARNING: Ignoring pcre2 even if it's available
test: =: unexpected operator
Enabling support for client-specific tags.
checking for zlibVersion in -lz... (cached) yes
Enabling compression support.
test: =: unexpected operator
test: =: unexpected operator
configure: error: Detected neither pcre2 nor pcre library.
Fabian Keil [Wed, 23 Aug 2023 10:11:22 +0000 (12:11 +0200)]
Disable fast-redirects for services.akteneinsichtsportal.de/
Fabian Keil [Wed, 16 Aug 2023 07:24:32 +0000 (09:24 +0200)]
Add #205: Document how commit messages should look like
Fabian Keil [Tue, 11 Jul 2023 16:18:53 +0000 (18:18 +0200)]
Add #204: Make the Privoxy website available over IPv6.
Fabian Keil [Tue, 11 Jul 2023 16:07:29 +0000 (18:07 +0200)]
Add #203: Add HTTP/2 support
Fabian Keil [Tue, 11 Jul 2023 16:02:29 +0000 (18:02 +0200)]
Remove TODO item #164
The PCRE2 code uses the native API as the POSIX API resulted in crashes.
Fabian Keil [Tue, 11 Jul 2023 04:22:16 +0000 (06:22 +0200)]
Add regex_matches() to reduce HAVE_PCRE2 ifdefs
Fabian Keil [Sat, 18 Feb 2023 10:50:22 +0000 (11:50 +0100)]
trust: Use the words 'allowlists' and 'blocklists'
... instead of "whitelists" and "blacklists" which some
people consider to be less inclusive.
Fabian Keil [Thu, 17 Aug 2023 04:50:33 +0000 (06:50 +0200)]
Rebuild homepage without former sponsor Scrubtheweb.com
Fabian Keil [Thu, 17 Aug 2023 04:32:32 +0000 (06:32 +0200)]
Remove sponsor Scrubtheweb.com as they canceled the subscription
Fabian Keil [Wed, 9 Aug 2023 04:58:56 +0000 (06:58 +0200)]
ssl_send_certificate_error(): Remove a 'dead nested assignment'
Fabian Keil [Wed, 9 Aug 2023 04:53:59 +0000 (06:53 +0200)]
pcrs_execute_single_command(): Remove a 'dead assignment'
Lee [Wed, 9 Aug 2023 08:42:15 +0000 (04:42 -0400)]
fix gcc maybe-uninitialized compiler warnings in acl_addr
I can't tell if they're false positives or not, but compiling with
no warnings is better than seeing this:
filters.c: In function ‘acl_addr’:
filters.c:465:31: warning: ‘addr_len’ may be used uninitialized in this function [-Wmaybe-uninitialized]
465 | for (i = 0; (i < addr_len) && masklength; i++)
| ~~~~~~~~~~~~~~~^~~~~~~~~~~~~
filters.c:454:18: warning: ‘mask_port’ may be used uninitialized in this function [-Wmaybe-uninitialized]
454 | *mask_port = 1;
| ~~~~~~~~~~~^~~
filters.c:479:19: warning: ‘mask_data’ may be used uninitialized in this function [-Wmaybe-uninitialized]
479 | mask_data[i] = (uint8_t)~((1 << (8 - masklength)) - 1);
| ^
Lee [Wed, 9 Aug 2023 08:34:55 +0000 (04:34 -0400)]
fix gcc maybe-uninitialized compiler warnings in match_sockaddr
I can't tell if they're false positives or not, but compiling with
no warnings is better than seeing this:
filters.c: In function ‘match_sockaddr’:
filters.c:205:42: warning: ‘address_port’ may be used uninitialized in this function [-Wmaybe-uninitialized]
205 | if (*netmask_port && *network_port != *address_port)
| ^~~~~~~~~~~~~
filters.c:214:24: warning: ‘address_addr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
214 | (address_addr[i] & netmask_addr[i]))
| ~~~~~~~~~~~~^~~
filters.c:205:8: warning: ‘netmask_port’ may be used uninitialized in this function [-Wmaybe-uninitialized]
205 | if (*netmask_port && *network_port != *address_port)
| ^~~~~~~~~~~~~
filters.c:200:20: warning: ‘netmask_addr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
200 | netmask_addr += 12;
| ^~
filters.c:205:25: warning: ‘network_port’ may be used uninitialized in this function [-Wmaybe-uninitialized]
205 | if (*netmask_port && *network_port != *address_port)
| ^~~~~~~~~~~~~
filters.c:172:17: warning: ‘addr_len’ may be used uninitialized in this function [-Wmaybe-uninitialized]
172 | unsigned int addr_len;
| ^~~~~~~~
Lee [Wed, 9 Aug 2023 08:00:28 +0000 (04:00 -0400)]
windows/MYconfigure: enable building Privoxy with OpenSSL on Windows.
way too many warnings in openssl.c about RSA deprecated-declarations
so add -Wno-deprecated-declarations to get rid of them.
make it easier to specify "--with-mbedtls" or "--with-openssl"