Download raw body.
[update] net/sniproxy 0.7.0
On 01/10/2025 17:45, Stuart Henderson wrote:
> On 2025/10/01 16:39, Renaud Allard wrote:
>> +@@ -635,8 +635,45 @@ initiate_server_connect(struct Connection *con, struct
>> + if (con->listener->transparent_proxy &&
>> + con->client.addr.ss_family == con->server.addr.ss_family) {
>> + #ifdef IP_TRANSPARENT
>> ++ int result;
>> ++ /* Make an IPv6 socket if necessary and purge ::ffff: from the v6-mapped address
>> ++ * We need to take out the ffff because otherwise it'll be IPv4 on the wire.
>
> this change is a noop on OpenBSD, IP_TRANSPARENT is not defined.
>
Indeed, that was not really designed specifically for OpenBSD.
>> +Index: tests/bad_dns_request_test
>> +--- tests/bad_dns_request_test.orig
>> ++++ tests/bad_dns_request_test
>> +@@ -60,7 +60,7 @@ sub http_client($$) {
>> + $socket->send($request);
>> +
>> + my $buffer;
>> +- $socket->recv($buffer, 4096);
>> ++ $socket->recv($buffer, 16388);
>
> typo?
Yes, good catch, it should be 16384.
>
> here's an updated diff with the IP_TRANSPARENT bit removed and switched
> to pcre2. I left bad_dns_request_test alone for now. I think I'll commit
> this as-is for now, so any further changes needed can be done via simpler
> diffs.
>
> I had some test failures but I have something on port 8080 already and
> didn't feel like changing the sniproxy tests to try a different port.
I have tested it on 5 servers with what I generally use it for and it
seems OK. I just didn't test for days, but the former diff I sent (with
my repo) has been running for about a week without any issue.
>
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/sniproxy/Makefile,v
> diff -u -p -r1.10 Makefile
> --- Makefile 14 Sep 2023 12:29:16 -0000 1.10
> +++ Makefile 1 Oct 2025 15:45:08 -0000
> @@ -1,12 +1,12 @@
> COMMENT = name-based proxying of HTTPS without decrypting traffic
>
> -GH_ACCOUNT = renaudallard
> +GH_ACCOUNT = dlundquist
> GH_PROJECT = sniproxy
> -GH_TAGNAME = 0.6.8
> +GH_TAGNAME = 0.7.0
>
> CATEGORIES = net
>
> -HOMEPAGE = https://github.com/renaudallard/sniproxy
> +HOMEPAGE = https://github.com/dlundquist/sniproxy
>
> MAINTAINER = Renaud Allard <renaud@allard.it>
>
> @@ -17,20 +17,21 @@ COMPILER = base-clang ports-gcc
> COMPILER_LANGS = c
>
> # use pledge()
> -WANTLIB += c ev pcre udns
> +WANTLIB += c ev pcre2-8 udns
>
> BUILD_DEPENDS = devel/gettext,-tools
>
> LIB_DEPENDS = net/udns \
> devel/libev \
> - devel/pcre
> + devel/pcre2
>
> -AUTOCONF_VERSION = 2.69
> +AUTOCONF_VERSION = 2.71
> AUTOMAKE_VERSION = 1.16
> CONFIGURE_STYLE = autoreconf
> AUTORECONF = ./autogen.sh
>
> -CONFIGURE_ARGS = --disable-rpath
> +CONFIGURE_ARGS = --disable-rpath \
> + --enable-dns
> CONFIGURE_ENV = CPPFLAGS="-I${LOCALBASE}/include" \
> LDFLAGS="${LDFLAGS} -L${LOCALBASE}/lib"
>
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/net/sniproxy/distinfo,v
> diff -u -p -r1.6 distinfo
> --- distinfo 14 Sep 2023 12:29:16 -0000 1.6
> +++ distinfo 1 Oct 2025 15:45:08 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (sniproxy-0.6.8.tar.gz) = 8LhjJQUNFaY7H5xqNuGsfHS6bx4dE3ARyBNTatw0Z2k=
> -SIZE (sniproxy-0.6.8.tar.gz) = 80608
> +SHA256 (sniproxy-0.7.0.tar.gz) = u+V5iGwa9g6FC4tb74UPELMX5uvjZssLVHaxIw8ocOQ=
> +SIZE (sniproxy-0.7.0.tar.gz) = 79685
> Index: patches/patch-README_md
> ===================================================================
> RCS file: patches/patch-README_md
> diff -N patches/patch-README_md
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-README_md 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,16 @@
> +Index: README.md
> +--- README.md.orig
> ++++ README.md
> +@@ -166,3 +166,12 @@ build without UDNS, but these features will be unavail
> + UDNS uses a single UDP socket for all queries, so it is recommended you use a
> + local caching DNS resolver (with a single socket each DNS query is protected by
> + spoofing by a single 16 bit query ID, which makes it relatively easy to spoof).
> ++
> ++
> ++OpenBSD specific behaviour
> ++--------------------------
> ++
> ++On OpenBSD, sniproxy is protected by pledge(2) and unveil(2).
> ++Therefore, the configuration file must be /etc/sniproxy.conf, unix sockets
> ++must be in /var/www/sockets and logs must be in /var/log. Also, sniproxy PID
> ++file must be /var/run/sniproxy.pid
> Index: patches/patch-sniproxy_conf
> ===================================================================
> RCS file: patches/patch-sniproxy_conf
> diff -N patches/patch-sniproxy_conf
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-sniproxy_conf 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,23 @@
> +Index: sniproxy.conf
> +--- sniproxy.conf.orig
> ++++ sniproxy.conf
> +@@ -2,8 +2,8 @@
> + # lines that start with # are comments
> + # lines with only white space are ignored
> +
> +-user nobody
> +-group nogroup
> ++user _sniproxy
> ++group _sniproxy
> +
> + # PID file, needs to be placed in directory writable by user
> + pidfile /var/run/sniproxy.pid
> +@@ -47,7 +47,7 @@ error_log {
> + # Global access log for all listeners
> + access_log {
> + # Same options as error_log
> +- filename /tmp/sniproxy-access.log
> ++ filename /var/log/sniproxy-access.log
> + }
> +
> + # blocks are delimited with {...}
> Index: patches/patch-src_cfg_tokenizer_c
> ===================================================================
> RCS file: patches/patch-src_cfg_tokenizer_c
> diff -N patches/patch-src_cfg_tokenizer_c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-src_cfg_tokenizer_c 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,21 @@
> +Index: src/cfg_tokenizer.c
> +--- src/cfg_tokenizer.c.orig
> ++++ src/cfg_tokenizer.c
> +@@ -62,7 +62,7 @@ next_token(FILE *config, char *buffer, size_t buffer_l
> + default:
> + /* Rewind one byte, so next_word() can fetch from
> + * the beginning of the word */
> +- fseek(config, -1, SEEK_CUR);
> ++ fseeko(config, -1, SEEK_CUR);
> +
> + token_len = next_word(config, buffer, buffer_len);
> + if (token_len <= 0)
> +@@ -116,7 +116,7 @@ next_word(FILE *file, char *buffer, int buffer_len) {
> + if (quoted == 0) {
> + /* rewind the file one character, so we don't eat
> + * part of the next token */
> +- fseek(file, -1, SEEK_CUR);
> ++ fseeko(file, -1, SEEK_CUR);
> +
> + buffer[len] = '\0';
> + len++;
> Index: patches/patch-src_config_c
> ===================================================================
> RCS file: patches/patch-src_config_c
> diff -N patches/patch-src_config_c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-src_config_c 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,21 @@
> +Index: src/config.c
> +--- src/config.c.orig
> ++++ src/config.c
> +@@ -238,13 +238,13 @@ init_config(const char *filename, struct ev_loop *loop
> + }
> +
> + if (parse_config(config, file, global_grammar) <= 0) {
> +- intmax_t whence = ftell(file);
> ++ off_t whence = ftello(file);
> + char line[256];
> +
> +- err("error parsing %s at %jd near:", filename, whence);
> +- fseek(file, -20, SEEK_CUR);
> ++ err("error parsing %s at %jd near:", filename, (intmax_t)whence);
> ++ fseeko(file, -20, SEEK_CUR);
> + for (int i = 0; i < 5; i++)
> +- err(" %jd\t%s", ftell(file), fgets(line, sizeof(line), file));
> ++ err(" %jd\t%s", (intmax_t)ftello(file), fgets(line, sizeof(line), file));
> +
> + free_config(config, loop);
> + config = NULL;
> Index: patches/patch-src_connection_c
> ===================================================================
> RCS file: patches/patch-src_connection_c
> diff -N patches/patch-src_connection_c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-src_connection_c 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,19 @@
> +Index: src/connection.c
> +--- src/connection.c.orig
> ++++ src/connection.c
> +@@ -812,13 +812,13 @@ new_connection(struct ev_loop *loop) {
> + con->query_handle = NULL;
> + con->use_proxy_header = 0;
> +
> +- con->client.buffer = new_buffer(4096, loop);
> ++ con->client.buffer = new_buffer(16384, loop);
> + if (con->client.buffer == NULL) {
> + free_connection(con);
> + return NULL;
> + }
> +
> +- con->server.buffer = new_buffer(4096, loop);
> ++ con->server.buffer = new_buffer(16384, loop);
> + if (con->server.buffer == NULL) {
> + free_connection(con);
> + return NULL;
> Index: patches/patch-src_sniproxy_c
> ===================================================================
> RCS file: patches/patch-src_sniproxy_c
> diff -N patches/patch-src_sniproxy_c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-src_sniproxy_c 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,39 @@
> +Index: src/sniproxy.c
> +--- src/sniproxy.c.orig
> ++++ src/sniproxy.c
> +@@ -71,6 +71,35 @@ main(int argc, char **argv) {
> + rlim_t max_nofiles = 65536;
> + int opt;
> +
> ++ #ifdef __OpenBSD__
> ++ if (unveil("/etc/sniproxy.conf", "r") != 0) {
> ++ perror("unveil /etc/sniproxy.conf");
> ++ exit(1);
> ++ }
> ++ if (unveil("/var/run/sniproxy.pid", "rwc") != 0) {
> ++ perror("unveil /var/run/sniproxy.pid");
> ++ exit(1);
> ++ }
> ++ if (unveil("/var/log", "rwc") != 0) {
> ++ perror("unveil /var/log");
> ++ exit(1);
> ++ }
> ++ if (unveil("/var/www/sockets", "rw") != 0) {
> ++ perror("unveil /var/www/sockets");
> ++ exit(1);
> ++ }
> ++ if (unveil(NULL, NULL) != 0) {
> ++ perror("unveil");
> ++ exit(1);
> ++ }
> ++
> ++ if (pledge("stdio getpw inet dns rpath proc id"
> ++ " wpath cpath unix", NULL) == -1) {
> ++ fprintf(stderr, "%s: pledge: %s\n", argv[0], strerror(errno));
> ++ exit(1);
> ++ }
> ++ #endif
> ++
> + while ((opt = getopt(argc, argv, "fc:n:V")) != -1) {
> + switch (opt) {
> + case 'c':
> Index: patches/patch-tests_bad_dns_request_test
> ===================================================================
> RCS file: patches/patch-tests_bad_dns_request_test
> diff -N patches/patch-tests_bad_dns_request_test
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-tests_bad_dns_request_test 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,12 @@
> +Index: tests/bad_dns_request_test
> +--- tests/bad_dns_request_test.orig
> ++++ tests/bad_dns_request_test
> +@@ -60,7 +60,7 @@ sub http_client($$) {
> + $socket->send($request);
> +
> + my $buffer;
> +- $socket->recv($buffer, 4096);
> ++ $socket->recv($buffer, 16388);
> +
> + $socket->close();
> +
> Index: patches/patch-tests_bad_request_test
> ===================================================================
> RCS file: patches/patch-tests_bad_request_test
> diff -N patches/patch-tests_bad_request_test
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-tests_bad_request_test 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,12 @@
> +Index: tests/bad_request_test
> +--- tests/bad_request_test.orig
> ++++ tests/bad_request_test
> +@@ -282,7 +282,7 @@ sub tls_client($$) {
> + $socket->send($request);
> +
> + my $buffer;
> +- $socket->recv($buffer, 4096);
> ++ $socket->recv($buffer, 16384);
> +
> + $socket->close();
> +
> Index: patches/patch-tests_buffer_test_c
> ===================================================================
> RCS file: patches/patch-tests_buffer_test_c
> diff -N patches/patch-tests_buffer_test_c
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-tests_buffer_test_c 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,21 @@
> +Index: tests/buffer_test.c
> +--- tests/buffer_test.c.orig
> ++++ tests/buffer_test.c
> +@@ -127,7 +127,7 @@ static void test4(void) {
> + struct Buffer *buffer;
> + int read_fd, write_fd;
> +
> +- buffer = new_buffer(4096, EV_DEFAULT);
> ++ buffer = new_buffer(16384, EV_DEFAULT);
> +
> + read_fd = open("/dev/zero", O_RDONLY);
> + if (read_fd < 0) {
> +@@ -155,7 +155,7 @@ static void test_buffer_coalesce(void) {
> + char output[sizeof(input)];
> + int len;
> +
> +- buffer = new_buffer(4096, EV_DEFAULT);
> ++ buffer = new_buffer(16384, EV_DEFAULT);
> + len = buffer_push(buffer, input, sizeof(input));
> + assert(len == sizeof(input));
> +
> Index: patches/patch-tests_connection_reset_test
> ===================================================================
> RCS file: patches/patch-tests_connection_reset_test
> diff -N patches/patch-tests_connection_reset_test
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-tests_connection_reset_test 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,27 @@
> +Index: tests/connection_reset_test
> +--- tests/connection_reset_test.orig
> ++++ tests/connection_reset_test
> +@@ -42,8 +42,8 @@ sub simple_server($) {
> + "\r\n");
> +
> + # Send a bunch of data (more that will be buffered by the kernel
> +- for (my $i = 0; $i < 4096; $i++) {
> +- $client->send('x' x 4096);
> ++ for (my $i = 0; $i < 16384; $i++) {
> ++ $client->send('x' x 16384);
> + }
> + $client->close();
> + exit;
> +@@ -76,9 +76,9 @@ sub bad_client($) {
> + "\r\n");
> +
> + my $buffer;
> +- $socket->recv($buffer, 4096);
> +- $socket->recv($buffer, 4096);
> +- $socket->recv($buffer, 4096);
> ++ $socket->recv($buffer, 16384);
> ++ $socket->recv($buffer, 16384);
> ++ $socket->recv($buffer, 16384);
> +
> + $socket->close();
> +
> Index: patches/patch-tests_fallback_test
> ===================================================================
> RCS file: patches/patch-tests_fallback_test
> diff -N patches/patch-tests_fallback_test
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-tests_fallback_test 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,12 @@
> +Index: tests/fallback_test
> +--- tests/fallback_test.orig
> ++++ tests/fallback_test
> +@@ -56,7 +56,7 @@ sub http10_client($$) {
> + $socket->send("GET /$path HTTP/1.0\r\n\r\n");
> +
> + my $buffer;
> +- $socket->recv($buffer, 4096);
> ++ $socket->recv($buffer, 16384);
> +
> + $socket->close();
> +
> Index: patches/patch-tests_slow_client_test
> ===================================================================
> RCS file: patches/patch-tests_slow_client_test
> diff -N patches/patch-tests_slow_client_test
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-tests_slow_client_test 1 Oct 2025 15:45:08 -0000
> @@ -0,0 +1,12 @@
> +Index: tests/slow_client_test
> +--- tests/slow_client_test.orig
> ++++ tests/slow_client_test
> +@@ -46,7 +46,7 @@ sub slow_client($$) {
> + }
> +
> + my $buffer;
> +- $socket->recv($buffer, 4096);
> ++ $socket->recv($buffer, 16384);
> +
> + $socket->close();
> +
[update] net/sniproxy 0.7.0