The 83rd version of the caching and anti-spam proxy server for personal use with flexible settings has been released.
Key features (fully customizable):
- filtering unwanted content (whitelists/blacklists for URLs, cookie restrictions);
- forced and indefinite caching of received data (mainly convenient for images and scripts);
- on-the-fly correction of web page content (editing the source code in C, there is an example for replacing the content of clone pages on stackoverflow with a link to the original);
- black/white lists of certificates and certificate pinning by list;
- IP address/domain/path/protocol spoofing of the HTTP request according to config (an extended version of /etc/hosts);
- HTTP/HTTPS-sniffer.
Perfect for browsing websites through slow internet or on a slow device (thanks to points 1 and 2, which were the original focus), but useful in any case.
The proxy server is divided into three parts for security and simplification of the logic: TLS server (terminating browser connections), central proxy module, and client, terminating outgoing connections.
The program is designed for personalized use, meaning all configurations and the directory with current proxy server data are tied to a specific user, or even to a specific browser profile. Running the proxy as a system-wide daemon is technically possible, but in this form, it is difficult to utilize one of its main functions — aggressive caching of everything, since cached data can be specific to each browser profile and must be isolated from one another for security.
Example of a blocklist:
deny nosub all share.yandex.ru browser-updater.yandex.net deny nosub all a.ria.ru # ? deny nosub spec vk.com query \/share.php deny nosub spec yastatic.net query \/pcode\/adfox\/loader.js query \/share2\/share.js deny nosub spec www.youtube.com query \/subscribe_widget deny nosub spec pano.img.ria.ru query \/adriver\/flashplagin\/movie.swf deny nosub spec a.ria.ru query \/ping deny nosub spec n-ssl.ria.ru query \/polling deny nosub spec apis.google.com query \/js\/plusone.js deny nosub spec yandex.ru pref \/clck\/safeclick\/ pref \/clck\/click\/ pref \/clck\/jclck\/ deny all spec query \/tnc # index.ru proxied counter exact \/tnc.js # index.ru proxied counter query \/pixel.gif # some spammers use this
Example of a routing list:
https:\/\/my.local.site set proxy none set target http:\/\/127.0.0.1:1234\/localsite set http_host new.host:1234 .intel.com resolve off set proxy socks5:\/\/127.0.0.1:3333
If updating from a version older than 78, you should convert the cache: enter the working directory of the proxy server from the user (uid/gid) of the proxy server and execute fproxy-cacheconv-78 (this program is not compiled by default).
Changes from the last published version (80):
- fproxy-dashboard now has an option to display content sizes in bytes instead of kilobytes;
- support for buggy servers that ignore the "Connection: close" header;
- support for buggy servers returning an incorrect "Content-Encoding: identity" header;
- sending TLS option ALPN;
- improved operation of the external side (client) TLS terminator: it now supports not only TLS but also regular connections, operates as an independent daemon receiving requests from the main proxy over the network, and can also route its outgoing connections through another proxy, thus allowing flexible task separation between nodes in conditions of poor internet connection and/or necessity to organize traffic "exit" somewhere on a remote server with varying levels of trust; the new version is also more user-friendly for manual use from the command line as a console TLS client with proxy support;
- simplified build, now there is a Makefile instead of shell scripts
- pre-packaged .deb packages are organized in the repository (for Debian versions 8-12)
- configuration file changes, backward-incompatible
- A new config for managing request routing, combining the previously separate resolv configs and enabling outgoing connection forwarding to a remote server, along with a number of new options: you can now select which client, which proxy, will be used for each URL (protocol, domain, port, path), through which DNS server the IP address will be resolved (including optional delegation of this task to an external HTTP or SOCKS5 proxy server), or specify the address manually, as well as change the protocol, port, or URL path prefix.
- Support for SAN certificates for IP addresses has been added in both the client and server (browsers have stopped accepting IP addresses in the CommonName field).
Future plans include:
- support for CGI/FastCGI/.so hooks for MITM processing of content received from sites.
- a manager for proxy profiles and configurations.
- interactive management of certificate verification for remote sites and block lists.
Source: linux.org.ru
