Fabian Keil [Tue, 3 Mar 2020 10:04:34 +0000 (11:04 +0100)]
send_https_request(): Don't call close_client_and_server_ssl_connections()
... inconsistenly. The caller already does it.
Sponsored by: Robert Klemme
Fabian Keil [Mon, 2 Mar 2020 15:45:22 +0000 (16:45 +0100)]
Add a missing call to close_client_and_server_ssl_connections()
Not calling it caused memory leaks.
Sponsored by: Robert Klemme
Fabian Keil [Mon, 2 Mar 2020 17:14:29 +0000 (18:14 +0100)]
decompress_iob(): Free the temporary buffer when the buffer limit is reached
... instead of leaking it.
Sponsored by: Robert Klemme
Fabian Keil [Mon, 2 Mar 2020 12:05:13 +0000 (13:05 +0100)]
free_csp_resources(): Destroy csp->client_tags
Fixes a memory leak when client tags are active.
Sponsored by: Robert Klemme
Fabian Keil [Mon, 2 Mar 2020 11:36:40 +0000 (12:36 +0100)]
unload_configfile(): Use unload_forward_spec() instead of doing the work itself
... poorly. Previously the socks user name and password were leaked.
Sponsored by: Robert Klemme
Fabian Keil [Mon, 2 Mar 2020 11:27:47 +0000 (12:27 +0100)]
unload_configfile(): free config->cors_allowed_origin
Fixes a small memory leak when reloading the config.
Sponsored by: Robert Klemme
Fabian Keil [Sun, 1 Mar 2020 15:40:01 +0000 (16:40 +0100)]
free_csp_resources(): Destroy csp->https_headers
Fixes a memory leak.
Sponsored by: Robert Klemme
Fabian Keil [Sun, 1 Mar 2020 14:31:24 +0000 (15:31 +0100)]
handle_established_connection(): Don't mess with csp->ssl_with_(server|client)_is_opened
This was a mismerge in
2111876638. The original code did
it in chat() were it doesn't hurt. Actually we don't need
to do it at all, as the variables are initialized to 0.
Zeroing the variables in handle_established_connection()
caused memory leaks as close_server_ssl_connection() and
close_client_ssl_connection() returned early,
Sponsored by: Robert Klemme
Fabian Keil [Sat, 29 Feb 2020 20:05:37 +0000 (21:05 +0100)]
handle_established_connection(): Remove pointless code
Sponsored by: Robert Klemme
Fabian Keil [Sun, 1 Mar 2020 08:53:34 +0000 (09:53 +0100)]
load_config(): Plug memory leaks
Sponsored by: Robert Klemme
root [Fri, 28 Feb 2020 08:16:49 +0000 (08:16 +0000)]
Set the "Subject Alt Name" extension to when generating certificates
This is apparently required for the certificates to
be accepted by Chromium-based browsers.
Based on a patch by Nedžad Hrnjica.
Sponsored by: Robert Klemme
Fabian Keil [Sat, 29 Feb 2020 08:49:39 +0000 (09:49 +0100)]
finish_http_response(): Plug memory leak with CORS enabled
Introduced in
9fd58c0d, not in any release.
Fixes CID 267166 "Resource leaks".
Fabian Keil [Fri, 28 Feb 2020 12:39:58 +0000 (13:39 +0100)]
get_certificate_serial(): Remove dead code
Fixes CID 267164 "Logically dead code".
Sponsored by: Robert Klemme
Fabian Keil [Fri, 28 Feb 2020 12:12:38 +0000 (13:12 +0100)]
handle_established_connection(): Remove pointless increments of n
Fixes CID267170 "Uninitialized scalar variable".
Sponsored by: Robert Klemme
Fabian Keil [Fri, 28 Feb 2020 07:42:05 +0000 (08:42 +0100)]
Only execute the dumb CONNECT method test when FEATURE_HTTPS_INSPECTION is unavailable
With FEATURE_HTTPS_INSPECTION the test is aborted with
a timeout because Privoxy is waiting for an encrypted
request which doesn't come.
Sponsored by: Robert Klemme
Fabian Keil [Fri, 28 Feb 2020 07:32:49 +0000 (08:32 +0100)]
Unblock 'ada*.'
Fabian Keil [Wed, 26 Feb 2020 07:50:27 +0000 (08:50 +0100)]
If the amount of encrypted POST data left is known, don't read more than this
Sponsored by: Robert Klemme
Fabian Keil [Thu, 27 Feb 2020 10:43:35 +0000 (11:43 +0100)]
generate_webpage_certificate(): Include the time in the serial number
... to make sure the serial number changes when the certificate
is regenerated.
Sponsored by: Robert Klemme
Fabian Keil [Thu, 27 Feb 2020 10:29:18 +0000 (11:29 +0100)]
generate_webpage_certificate(): Return earlier if a valid certificate already exists
If the certificate is no longer valid, clear the key file, too.
Sponsored by: Robert Klemme
Fabian Keil [Thu, 27 Feb 2020 09:55:07 +0000 (10:55 +0100)]
Generate the "valid from" and "valid to" date of certificates based on the current time
Previously certificates were always valid until 2040 which
seems a tad long.
Now the certificates are valid for 90 days.
Sponsored by: Robert Klemme
Fabian Keil [Thu, 27 Feb 2020 08:56:01 +0000 (09:56 +0100)]
Detect invalid certificates and create new ones
Currently certificates are considered valid if they can
be parsed and have a "valid to" date in the future.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 16:52:39 +0000 (17:52 +0100)]
Bump copyright
Fabian Keil [Wed, 26 Feb 2020 14:42:48 +0000 (15:42 +0100)]
sed_https(): Clear the existing tags before calling sed()
This makes sure tagging based on the encrypted client
headers works even if a tag has already been set based
on the unencrypted ones.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 14:35:28 +0000 (15:35 +0100)]
sed_https(): Unset CSP_FLAG_CLIENT_HEADER_PARSING_DONE
... to make sure we're applying client header taggers and filters.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 13:57:38 +0000 (14:57 +0100)]
ssl_send_certificate_error(): Don't sleep
Supposedly some clients once apon a time needed
the delay but it's unclear which. Let's see if
any show up.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 13:28:18 +0000 (14:28 +0100)]
ssl_send_certificate_error(): Be more precise
An invalid certificate is only one of the reasons
why the certificate verification may fail.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 13:02:48 +0000 (14:02 +0100)]
When logging that the certificate verifcation failed, mention the host
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 09:07:05 +0000 (10:07 +0100)]
Only use certificate_mutex and rng_mutex when needed
Previously they were defined and initialized unconditionally.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 09:02:11 +0000 (10:02 +0100)]
Use a single mutex for the certificate generation
It is fast enough so there is no need to complicate
things with up to 65536 different mutexes.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 08:49:03 +0000 (09:49 +0100)]
Turn lack of md5 support in mbedTLS into a compile error
Previously the TLS code simply wouldn't work properly.
Sponsored by: Robert Klemme
Fabian Keil [Wed, 26 Feb 2020 08:07:57 +0000 (09:07 +0100)]
Remove #95 which is obsolete now that we support proper https inspection
Fabian Keil [Tue, 25 Feb 2020 21:18:37 +0000 (22:18 +0100)]
Rebuild config file
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 21:13:48 +0000 (22:13 +0100)]
Rebuild docs
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 21:07:41 +0000 (22:07 +0100)]
Rename +enable-https-filtering to +https-inspection
... which is more precise.
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 20:51:59 +0000 (21:51 +0100)]
Rename FEATURE_HTTPS_FILTERING to FEATURE_HTTPS_INSPECTION
... which is more precise.
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 19:45:19 +0000 (20:45 +0100)]
Note that enable-https-filtering{} has to be enabled based on the CONNECT request
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 17:17:47 +0000 (18:17 +0100)]
process_encrypted_request(): Log applied actions when requested
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 17:11:47 +0000 (18:11 +0100)]
process_encrypted_request(): Don't call init_current_action() when toggled off
By the time the function is called the actions are already
initialized.
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 16:54:34 +0000 (17:54 +0100)]
get_url_actions(): Don't initialize actions when called the second time
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 15:34:41 +0000 (16:34 +0100)]
Fix location of curly brace and normalize white space
Fabian Keil [Tue, 25 Feb 2020 15:27:09 +0000 (16:27 +0100)]
Bump copyright
Fabian Keil [Tue, 25 Feb 2020 12:37:22 +0000 (13:37 +0100)]
Deal with invalid certificates in case of forwarded requests
... by sending the details of the verification failure
and the certificates.
Sponsored by: Robert Klemme
Fabian Keil [Sun, 23 Feb 2020 12:00:04 +0000 (13:00 +0100)]
create_server_ssl_connection(): If the certificate is invalid, log the details
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 12:35:37 +0000 (13:35 +0100)]
Remove obsolete comment
Fabian Keil [Tue, 25 Feb 2020 12:23:32 +0000 (13:23 +0100)]
free_server_ssl_structures(): Mark the correct socket as invalid
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 12:20:54 +0000 (13:20 +0100)]
Add a missing 'the' to a log message
Fabian Keil [Mon, 24 Feb 2020 12:12:39 +0000 (13:12 +0100)]
Add receive_and_send_encrypted_post_data()
... to deal with POST data that isn't read together
with the request headers.
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 11:52:39 +0000 (12:52 +0100)]
ssl_send_data(): Log the data before writing
Sponsored by: Robert Klemme
Fabian Keil [Tue, 25 Feb 2020 11:50:48 +0000 (12:50 +0100)]
ssl_recv_data(): Log the received data
Sponsored by: Robert Klemme
Fabian Keil [Sun, 23 Feb 2020 11:13:40 +0000 (12:13 +0100)]
Fix a comment typo
Fabian Keil [Sun, 23 Feb 2020 11:07:26 +0000 (12:07 +0100)]
Fix a comment typo
Fabian Keil [Sat, 22 Feb 2020 22:19:02 +0000 (23:19 +0100)]
Reduce spaces
Fabian Keil [Sat, 22 Feb 2020 21:56:32 +0000 (22:56 +0100)]
Fix a comment typo
Fabian Keil [Sat, 22 Feb 2020 21:50:27 +0000 (22:50 +0100)]
Improve a comment
Fabian Keil [Sat, 22 Feb 2020 21:49:01 +0000 (22:49 +0100)]
Bump copyright
Fabian Keil [Sat, 22 Feb 2020 21:02:16 +0000 (22:02 +0100)]
ssl_send_data(): Consistently return -1 in case of errors
... instead of passing on the MBEDTLS_ERR_* value which
the caller doesn't need to know.
Sponsored by: Robert Klemme
Fabian Keil [Sat, 22 Feb 2020 19:53:48 +0000 (20:53 +0100)]
ssl_recv_data(): Properly handle MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY
Previously ssl_recv_data() would pass it to the caller
which would treat it as an error.
Sponsored by: Robert Klemme
Fabian Keil [Sat, 22 Feb 2020 16:28:31 +0000 (17:28 +0100)]
Unbreak the build without FEATURE_HTTPS_FILTERING
Fabian Keil [Sat, 22 Feb 2020 13:38:16 +0000 (14:38 +0100)]
Don't crash when blocking a CONNECT request with https filtering enabled
Previously ssl_send_data() was called before the TLS context was
setup which resulted in a segfault in mbedtls_ssl_get_max_frag_len().
Fabian Keil [Fri, 21 Feb 2020 15:48:51 +0000 (16:48 +0100)]
Bump copyright
Fabian Keil [Fri, 21 Feb 2020 15:41:33 +0000 (16:41 +0100)]
Regenerate docs
Fabian Keil [Fri, 21 Feb 2020 15:40:47 +0000 (16:40 +0100)]
Properly link to the TLS section of the config file
Fabian Keil [Fri, 21 Feb 2020 15:35:23 +0000 (16:35 +0100)]
Fix links to the enable-https-filtering action
Fabian Keil [Fri, 21 Feb 2020 15:32:35 +0000 (16:32 +0100)]
Add a missing anchor
Fabian Keil [Thu, 20 Feb 2020 16:38:54 +0000 (17:38 +0100)]
Rebuild config file
Fabian Keil [Thu, 20 Feb 2020 16:37:19 +0000 (17:37 +0100)]
Rebuild docs
Fabian Keil [Fri, 21 Feb 2020 14:49:20 +0000 (15:49 +0100)]
config: Fix typo
Fabian Keil [Fri, 21 Feb 2020 14:48:29 +0000 (15:48 +0100)]
config: Mention that the certificate-directory is only used when https filtering
Fabian Keil [Fri, 21 Feb 2020 14:44:35 +0000 (15:44 +0100)]
config: Improve the description of the ca-cert-file directive
Fabian Keil [Thu, 20 Feb 2020 16:31:52 +0000 (17:31 +0100)]
config: Note that Privoxy does not automatically clear website certiificates
... when the CA key and certificate are changed.
Fabian Keil [Wed, 19 Feb 2020 16:36:25 +0000 (17:36 +0100)]
Bump coypright
Fabian Keil [Wed, 19 Feb 2020 14:01:45 +0000 (15:01 +0100)]
Note that access to certificate-directory and ca-directory should be limited
... to Privoxy and the Privoxy admin.
Fabian Keil [Wed, 19 Feb 2020 12:17:16 +0000 (13:17 +0100)]
generate_key(): Change argument order to be more consistent
Fabian Keil [Fri, 21 Feb 2020 14:30:55 +0000 (15:30 +0100)]
pcrs.h: Add copyright and license
Fabian Keil [Tue, 18 Feb 2020 16:23:33 +0000 (17:23 +0100)]
Change license for pcrs.c to GPLv2+
... after getting the permission from Andreas.
This allows to redistribute Privoxy under the GPLv3
which is required when linking to mbedTLS which is
licensed under the Apache 2.0 license.
Fabian Keil [Mon, 17 Feb 2020 23:19:22 +0000 (00:19 +0100)]
Regenerate docs
Fabian Keil [Tue, 18 Feb 2020 11:36:04 +0000 (12:36 +0100)]
Remove cooltechzone.com from the sponsor list
They were unhappy with the link change.
Fabian Keil [Mon, 17 Feb 2020 23:17:56 +0000 (00:17 +0100)]
Revert "Clarify that Privoxy can also be used under the terms of a license later than the GPLv2"
The current license of pcrs.c actually prevents the license upgrade.
This reverts commit
d74933268d8eee2037691f5db776b2103eb13945.
Fabian Keil [Sun, 16 Feb 2020 17:44:15 +0000 (18:44 +0100)]
Change 'GIT' to 'Git'
Fabian Keil [Sat, 15 Feb 2020 13:15:03 +0000 (14:15 +0100)]
Bump copyright
Fabian Keil [Sat, 15 Feb 2020 13:14:26 +0000 (14:14 +0100)]
Bump copyright
Fabian Keil [Sat, 15 Feb 2020 13:02:18 +0000 (14:02 +0100)]
Rebuild docs with updated license info
Fabian Keil [Sat, 15 Feb 2020 12:56:08 +0000 (13:56 +0100)]
Clarify that Privoxy can also be used under the terms of a license later than the GPLv2
Fabian Keil [Fri, 14 Feb 2020 13:32:55 +0000 (14:32 +0100)]
Regenerate developer manual
Fabian Keil [Fri, 14 Feb 2020 13:22:14 +0000 (14:22 +0100)]
Developer manual: Bump copyright
Fabian Keil [Fri, 14 Feb 2020 13:21:19 +0000 (14:21 +0100)]
Developer manual: Document how ot access the git repository through https
Fabian Keil [Fri, 23 Jun 2017 18:27:37 +0000 (20:27 +0200)]
Strip trailing whitespace
Fabian Keil [Fri, 23 Jun 2017 18:27:37 +0000 (20:27 +0200)]
Strip trailing whitespace
Fabian Keil [Wed, 5 Feb 2020 16:02:37 +0000 (17:02 +0100)]
free_certificate_chain(): Fix memset() target
Fabian Keil [Thu, 30 Jan 2020 15:49:10 +0000 (16:49 +0100)]
Remove SourceForge references in copyright headers
Fabian Keil [Thu, 30 Jan 2020 15:46:10 +0000 (16:46 +0100)]
Upgrade a bunch of links to the homepage to https://
Fabian Keil [Wed, 11 Dec 2019 12:05:24 +0000 (13:05 +0100)]
Declare generate_webpage_certificate() static
Fabian Keil [Mon, 2 Dec 2019 12:06:29 +0000 (13:06 +0100)]
Fix comment typos
Fabian Keil [Mon, 3 Feb 2020 16:38:39 +0000 (17:38 +0100)]
Regenerate homepage with silver sponsor https://vpnranks.com/
Fabian Keil [Mon, 3 Feb 2020 16:37:43 +0000 (17:37 +0100)]
Add https://www.vpnranks.com/ as silver sponsor
Fabian Keil [Mon, 3 Feb 2020 16:39:29 +0000 (17:39 +0100)]
Adjust cooltechzone.com sponsor link to look less manipulative
Fabian Keil [Thu, 30 Jan 2020 12:43:43 +0000 (13:43 +0100)]
Rebuild homepage
Fabian Keil [Thu, 30 Jan 2020 12:43:28 +0000 (13:43 +0100)]
Adjust cooltechzone.com sponsor link to look less manipulative
Fabian Keil [Fri, 27 Dec 2019 11:03:50 +0000 (12:03 +0100)]
Regenerate homepage with new sponsor cooltechzone.com
Fabian Keil [Fri, 27 Dec 2019 11:02:47 +0000 (12:02 +0100)]
Add cooltechzone.com as sponsor