Proxomitron Reborn

[ProxRocks]

Yikes!
If I followed correctly, this affects at least a dozen filters in SIDKI 2019-01-26b1 with uNorm.

[JJoe]

(Jun. 07, 2024 09:06 PM)ProxRocks Wrote:  Yikes!
If I followed correctly, this affects at least a dozen filters in SIDKI 2019-01-26b1 with uNorm.

I think two maybe three.

<object(\s|") doesn't work in the test window.
I'll check outside the window later.

[amy]

(May. 18, 2024 03:40 AM)JJoe Wrote:  $RDIR and $JUMP appear to be broken but not always.

$RDIR and $JUMP interact badly with HTTPS filtering because in that case there are actually two requests, the first with a CONNECT method to open the encrypted tunnel, and then the "real" request is sent inside that. This also means outbound header filters are applied twice on each request, one for the outer and another for the inner. That first one with the CONNECT has no path, which explains the bug. I suspect this was something Scott didn't realise, since he didn't see HTTPS filtering as anything but an experimental feature. Thanks for the detailed test cases. This will be fixed in the next release.

The $NEST bug was actually there since the first Reborn 4.6.0.0 and it's a subtle one. I suspect the only reason Scott's code worked in that case was luck, since it turned out to be a "two wrongs make a right" type of situation. I "corrected" one of the bugs while not thinking the other was significant or related, and thus broke the $NEST parsing. Thanks for the detailed test cases. This will also be fixed in the next release.

(May. 18, 2024 09:18 PM)JJoe Wrote:  Some requests are using very long URLs. The Proxomitron limit appears be 2065.
Can this limit be increased?

It is currently 4096 for the total each request (request line + headers.) Increasing it is not trivial but has been on the list of things to improve for a while. I may make it configurable since this affects the memory usage of every connection.

[dsgfh543]

Please tell me where i can download Proxomitron Reborn 4.7.0.1
Can't find any links..

[DullFace]

It's on the first page.

[dsgfh543]

---
Attached File(s)

ProxomitronReborn_4600R.zip (Size: 144.19 KB / Downloads: 1474)
ProxomitronReborn_4700R.zip (Size: 968.49 KB / Downloads: 164)
ProxomitronReborn_4517R.zip (Size: 139.66 KB / Downloads: 862)
ProxomitronReborn_4701R.zip (Size: 972.37 KB / Downloads: 141)
ProxomitronReborn_4520R.zip (Size: 139.77 KB / Downloads: 901)
ProxomitronReborn_4601R.zip (Size: 144.4 KB / Downloads: 749)
ProxomitronReborn_4602R.zip (Size: 144.32 KB / Downloads: 795)
ProxomitronReborn_4603R.zip (Size: 144.48 KB / Downloads: 1002)
ProxomitronReborn_4604R.zip (Size: 144.7 KB / Downloads: 1097)
ProxomitronReborn_4605R.zip (Size: 145.47 KB / Downloads: 1959)
---
That is all. Don't see link on 4.7.0.1

[DullFace]

It's the least downloaded.

[dsgfh543]

Thanks a lot.

[rasczak]

Noticed a problem loading this site: www. fs.usda.gov

- Using reborn 4701 with new 3.0 openssl dlls
---- It looked like it would start to load normally, then it would ping-pong tcp 'keep alive' and 'window update' packets back and forth until my machine sent a tcp reset and then the site would stop responding with no resources transmitted to my browser (site doesn't load at all) and proxo keeps the connection open. (Abort button hangs proxo and requires killing the process.)

- Using reborn 4701 with old 1.0 openssl dlls
---- It looked like it would start to load normally, then it would ping-pong tcp 'keep alive' and 'window update' packets back and forth for a bit, then load the site. Then go back to ping-pong for a bit, then stop. Proxo wouldn't close the connection.

- Bypassing reborn 4701 loads the site normally.
- Old proxomitron and 1.0 openssl dlls loads the site normally..

[amy]

(Jul. 23, 2024 03:40 AM)rasczak Wrote:  Noticed a problem loading this site: www. fs.usda.gov

- Using reborn 4701 with new 3.0 openssl dlls
---- It looked like it would start to load normally, then it would ping-pong tcp 'keep alive' and 'window update' packets back and forth until my machine sent a tcp reset and then the site would stop responding with no resources transmitted to my browser (site doesn't load at all) and proxo keeps the connection open. (Abort button hangs proxo and requires killing the process.)

- Using reborn 4701 with old 1.0 openssl dlls
---- It looked like it would start to load normally, then it would ping-pong tcp 'keep alive' and 'window update' packets back and forth for a bit, then load the site. Then go back to ping-pong for a bit, then stop. Proxo wouldn't close the connection.

- Bypassing reborn 4701 loads the site normally.
- Old proxomitron and 1.0 openssl dlls loads the site normally..

That looks like a site which appears to discriminate based on user-agent header. If I don't send any UA header it hangs too, and if I send some non-standard or old UA, it also hangs. However, I can confirm that this one works:

Code:

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:45.0) Gecko/20100101 Firefox/80.0

A useful tip for troubleshooting is to bypass outgoing header filters, which lets Proxomitron still handle the TLS negotiation with the site and filter incoming content, but otherwise outgoing headers from the browser remain unfiltered. You can also bypass incoming and page filters if you suspect those are the cause. If bypassing all filtering doesn't work but "full" bypass (i.e. Bypass button) does, then it's probably some form of TLS fingerprinting (which I'm still working on a solution to); if a site works with outgoing header filtering bypassed, then it's probably some filter you have which is altering outgoing headers in a way that the remote server doesn't like.

[zoltan]

I've just upgraded to Firefox 115esr for reasons explained in another thread and Reborn is giving me nothing but security cert errors and won't load any site. I've gotten a version of ProxHTTPSProxy (REV3e) to work, so I'm guessing there's something in my files or config that isn't right. I like the concept of Reborn better so I'd like to get it working, hopefully without any SSL errors. Here's a view of the relevant folders and some config screencaps.

[amy]

What exact cert errors are you getting? That should tell you more precisely what's wrong.

[JJoe]

Also, try:
Setting the HTTPS port to 8443. You have 8080.
Add the "309" files from https://prxbx.com/forums/showthread.php?tid=2179&pid=18693#pid18693

(Feb. 02, 2025 03:29 AM)zoltan Wrote:  Here's a view of the relevant folders and some config screencaps.

[zoltan]

The errors were:
"site.com uses an invalid security certificate. The certifcate is not trusted because it was signed using a signature algorithm that was disabled because that algorithm is not secure."

After making JJoe's suggested changes, port 8443 & (libcrypto-3.dll and libssl-3.dll), the errors changed to:
"site.com uses an invalid security certificate. The certificate does not come from a trusted source. Error code: Mozilla PKIX error CA Cert used as end entity."

[JJoe]

I downloaded FirefoxPortableESR_115.11.0_English.paf.exe to Win10.
Set the FirefoxPortableESR HTTP and HTTPS proxies to 8080.
I have not seen any certificate errors, before (this was unexpected) or after I imported the Proxomitron's cert .

However, if I set the FirefoxPortableESR HTTPS proxy to 8443, I see

Quote:Secure Connection Failed

An error occurred during a connection to www.npr.org.

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

Check your browser's proxy settings.

(Feb. 02, 2025 06:20 AM)zoltan Wrote:  After making JJoe's suggested changes, port 8443 & (libcrypto-3.dll and libssl-3.dll), the errors changed to:
"site.com uses an invalid security certificate. The certificate does not come from a trusted source. Error code: Mozilla PKIX error CA Cert used as end entity."