update deps, pac, edit filters, other stuff - #44
Merged
Conversation
Lock current behavior of CSP augmentation, request-type detection, URL normalization, opaque-upgrade detection, TOML config round-trip, and CA-signed cert/server-config assembly so the dependency upgrade can be verified as behavior-preserving. build(deps): phase 1 — low-risk bumps (thiserror 2, toml 1, dirs 6) - privaxy: toml 0.8->1, thiserror 1->2, dirs 5->6, serde_with 3.8->3.21, env_logger 0.11.3->0.11.10, uluru 3.0->3.1, async-compression 0.4.11->0.4.42, tera pin relaxed to 1.x (argon2 kept on 0.5, tera on 1.x: latest are pre-releases, excluded per semver). - filterlists-api: thiserror 1->2, reqwest 0.12->0.13. - web_frontend: thiserror 1->2. - thiserror 2 dropped raw-identifier (r#type) support in #[error] format strings; updated FilterListAPIError accordingly. Also retains the reqwest client tcp_keepalive removal in server/lib.rs. Characterization tests remain green (cargo test -p privaxy --lib). feat(deps): phase 2 — migrate server to hyper 1.0 / rustls 0.23 / warp 0.4 Upgrades the proxy/web-server HTTP+TLS stack to current majors: - hyper 0.14 -> 1, http 0.2 -> 1, add hyper-util + http-body-util. - rustls 0.21 -> 0.23, tokio-rustls 0.24 -> 0.26, hyper-rustls 0.24 -> 0.27, all pinned to the ring provider (default-features=false) so the tier-3 MIPS/musl cross builds keep working (aws-lc-rs needs a C toolchain). - reqwest 0.11 -> 0.13 (rustls-no-provider + ring, process-default provider). Key code changes: - Install the ring CryptoProvider once at startup (rustls 0.23 requires a process default before any TLS config is built). - Replace hyper's removed Server/Client/Body: the proxy now hand-accepts connections and drives them with hyper-util's auto builder (HTTP/1+2 + upgrades), preserving header-case and tcp_keepalive(600s); the upgrade client uses hyper-util's legacy Client. Streaming response bodies use an mpsc + http_body_util::StreamBody channel (replacing hyper::body::Sender), wrapping upgraded streams in TokioIo. - cert.rs: rustls 0.23 CertificateDer/PrivateKeyDer + builder safe-defaults. - warp 0.3 -> 0.4 (built on hyper 1). warp 0.4 removed built-in TLS and the graceful-shutdown server, so the web GUI is now served via hyper-util with optional tokio-rustls termination (WebSocket live feeds still upgrade). - argon2: enable std feature to restore OsRng after feature unification shift. Characterization tests remain green (cargo test -p privaxy --lib). feat(deps): phase 3 — migrate frontend to yew 0.23 / gloo-net - yew 0.19 -> 0.23 (csr feature), yew-router 0.16 -> 0.20, gloo-utils 0.1 -> 0.3, gloo-timers 0.2 -> 0.4, web-sys 0.3.69 -> 0.3.77, wasm-bindgen -> 0.2.125. - Replace the deprecated reqwasm with gloo-net (http + websocket); gloo-net's RequestBuilder::body/json now return Result, so call sites unwrap and order header() before body(). - yew API migration: start_app -> Renderer::render; Component::changed gains the old_props parameter; <textarea> is now a void element (self-closing); Button's children prop made #[prop_or_default]; onsubmit handlers typed SubmitEvent instead of FocusEvent. - yew-router 0.20: Switch render takes the function directly (Switch::render removed) and switch fns take the route by value. Verified with: cargo build --target wasm32-unknown-unknown -p web_frontend. build(deps): phase 4 — ring-only TLS, formatting, clippy cleanups - Eliminate aws-lc-rs from the dependency tree: filterlists-api's reqwest was pulling default features (reqwest's aws-lc-rs-backed rustls), which unified the shared rustls crate onto aws-lc-rs and would break the MIPS/musl cross builds (aws-lc-sys needs cmake/C). Pin it to default-features=false + rustls-no-provider so the whole workspace uses ring only. - Use std::io::Error::other(..) for the hyper body/upgrade error mapping. - cargo fmt across the migrated files. Verified: cargo test -p privaxy --lib (14 passed); frontend wasm build; release musl cross-build (x86_64-unknown-linux-musl) succeeds with ring, proving the tier-3 cross targets keep working.
|
✅ No security or compliance issues detected. Reviewed everything up to 49ce8d2. Security Overview
Detected Code ChangesThe diff is too large to display a summary of code changes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
testing myself live for a few weeks now. no issues w/ changes so far
Known Issues
Changes
/wpad.dat, so DNS-based WPADauto-discovery (
http://wpad.<search domain>/wpad.dat) can point straightat Privaxy without needing a rewrite in a fronting reverse proxy.
network.gui_urlsetting: full base URL of the web GUI as reachable byclients, e.g.
gui_url = "http://proxy.example.lan"when the GUI sitsbehind a reverse proxy. Used verbatim for links back to the GUI on proxy
error pages (the "exclude this host" button), winning over
listen_urlandthe bound/dialed address. Fixes the exclude link pointing at an unreachable
container IP when Privaxy runs behind Docker NAT with the GUI fronted by a
reverse proxy on a different port. Editable from Settings → General
(network section) as "GUI URL"; must start with
http://orhttps://(validated in both the form and the API), and clearing the field unsets it.
Older API clients that omit the field keep the stored value.
subnet/22: the GUIstores the bare prefix length, which was emitted verbatim into
isInNet(host, subnet, "22")— an invalid mask for standard PAC engines,so those DIRECT rules silently never matched. Prefix lengths are now
converted to dotted-decimal masks at render time (already-dotted masks are
passed through), fixing existing configs without rewriting them.
URL, HTML error page, empty list) used to fail silently in the background
updater. Settings → Filters now shows a warning panel listing each
failing list with its error, last attempt time and consecutive failure
count, and offers per-entry Edit (fix the URL, title or category in a
prefilled modal) and Remove actions. The panel is hidden while every
list is healthy. Failures are tracked in memory (keyed by the filter's
file name) and reconciled on configuration changes, so disabling or
removing a list clears its entry.
serve a
text/plainlist with parseable rules) and keeps the entry'senabled state; a URL already used by another filter is rejected with a
409.fails to download: each list is now updated independently and failures
are recorded per list.
GET /api/filters/failuresandPATCH /api/filters./api/filtersroutes now match the exact pathonly, so stray sub-paths 404 instead of hitting the collection handlers.
to rename the list, change its category or URL, or delete it. Built-in
lists shipped with the package show no edit button and the API refuses to
edit (
PATCH) or remove (DELETE) them with a403— they can only beenabled/disabled. The failures panel follows the same rule: a failing
built-in list offers a Disable action instead of Edit/Remove.
GET /api/filtersresponses now include each filter'surland anis_defaultflag, andGET /api/filters/failuresentries carryis_defaulttoo.argon2 0.6.0-rcandtera 2.0.0-alphawere intentionally not adopted).hyper 0.14 → 1,http 0.2 → 1(now viahyper-util+http-body-util),rustls 0.21 → 0.23,tokio-rustls 0.24 → 0.26,hyper-rustls 0.24 → 0.27,reqwest 0.11 → 0.13,warp 0.3 → 0.4. The whole TLS stack is pinned tothe
ringcrypto provider so the MIPS/musl cross builds keep working(
aws-lc-rsneeds a C toolchain). AringCryptoProvideris installedonce at startup, as rustls 0.23 requires.
GUI is now served through
hyper-utilwith optionaltokio-rustlstermination; WebSocket live feeds continue to work via connection upgrades.
yew 0.19 → 0.23,yew-router 0.16 → 0.20,gloo-*bumped,web-sys/wasm-bindgenrefreshed, and the deprecatedreqwasmreplacedwith
gloo-net.thiserror 1 → 2,toml 0.8 → 1,dirs 5 → 6.lock the proxy's CSP/request-type/upgrade logic, the TOML config
round-trip, and CA-signed cert/server-config assembly.
"Exclude this host" button. The button is a plain link to the web UI's new
/exclude?host=…confirm page, so it rides the existing session auth:logged-in admins get a one-click confirm, everyone else lands on the login
page first (the URL survives login). Values substituted into the error
page are now HTML-escaped and the link's host is percent-encoded
(previously the error reason was inserted unescaped).
network.listen_urlwhen set, otherwise from the bind address — falling back to the IP the
client actually dialed when binding
0.0.0.0.clients that abort the interception handshake (typically certificate
pinning — e.g. banking apps, RCS messaging) can never be shown an error
page, so the proxy now records those hosts (deduplicated,
most-recent-first, capped at 100, in memory) and the panel offers
per-host Exclude and Ignore actions. Ignored hosts persist in the
config (
ignored_tls_failures) and survive restarts; existing configfiles without the field keep working.
GET /api/tls-failuresandPOST /api/tls-failures/ignore.