pixelserv pixelserv - A Better One-pixel Webserver for Adblock

[Milan]

have someone issue to update to 2.2.1-1 static beta via amtm? on latestmerlin fw and Diversion ?

 

[thelonelycoder]

have someone issue to update to 2.2.1-1 static beta via amtm? on latestmerlin fw and Diversion ?

I have done that, no issues here.

 

[elorimer]

I'm a little unclear on something: is entware now at OpenSSL 1.1.1a or 1.1.1b? If at alpha b there isn't a lot of reason to load the static beta is there?

 

[visortgw]

I'm a little unclear on something: is entware now at OpenSSL 1.1.1a or 1.1.1b? If at alpha b there isn't a lot of reason to load the static beta is there?

Not alpha or beta -- just iterative bug fix releases.

 

[elorimer]

Sorry, I was overly cryptic. The prior static "beta" that would be installed was linked to OpenSSL 1.1.1a, and the entware build was linked to 1.0.2, so there was a big reason to install the beta. The most recent beta is linked to OpenSSL 1.1.1b. Now that the entware dynamic version is linked to OpenSSL 1.1.1, the only reason to install the beta would be if entware is at 1.1.1a, not 1.1.1b. (I can't judge whether the bug fix in 1.1.1b (handling the post handshake messaging) is significant.) Thus my question.

EDIT: From the changelog looks to be 1.1.1a

 

[joe68000]

I am running pixelserv-tls 2.2.1 (compiled: Feb 27 2019 13:10:51 flags: tls1_3) installed with Diversion and have just noticed my tave has jumped from ~5-10ms to over 700 ms since Diversion 4.1.1 - is this expected?

 

[heysoundude]

I am running pixelserv-tls 2.2.1 (compiled: Feb 27 2019 13:10:51 flags: tls1_3) installed with Diversion and have just noticed my tave has jumped from ~5-10ms to over 700 ms since Diversion 4.1.1 - is this expected?

I’m not certain(and/or can’t remember why), but there’s been an issue with pixelserv for a while now. I think kvic pulled it down when that became clear, and may be working on a fix as we speak. You should look around some for better info/more details.


Sent from my iPhone using Tapatalk

 

[L&LD]

I’m not certain(and/or can’t remember why), but there’s been an issue with pixelserv for a while now. I think kvic pulled it down when that became clear, and may be working on a fix as we speak. You should look around some for better info/more details.


Sent from my iPhone using Tapatalk

Link?

 

[heysoundude]

Link?

As I said, they’ll have to poke around some. Maybe on the amtm thread?


Sent from my iPhone using Tapatalk

 

[heysoundude]

As I said, they’ll have to poke around some. Maybe on the amtm thread?


Sent from my iPhone using Tapatalk

And if I’m mistaken, when I had issues setting it up, kvic helped me directly via inbox convo when we both happened to be online concurrently. OP might try that too.


Sent from my iPhone using Tapatalk

 

[dave14305]

As I said, they’ll have to poke around some. Maybe on the amtm thread?


Sent from my iPhone using Tapatalk

The beta available through amtm was removed because it was promoted to the release channel on Entware, so no need for the special beta install anymore. Could that be what you’re thinking of?

 

[thelonelycoder]

I am running pixelserv-tls 2.2.1 (compiled: Feb 27 2019 13:10:51 flags: tls1_3) installed with Diversion and have just noticed my tave has jumped from ~5-10ms to over 700 ms since Diversion 4.1.1 - is this expected?

That's not very typical. On the routers I have up, the tav is 8, 8 and 7 ms and I've had Diversion 4.1.0 with the new blocking list format running on them for a while. Diversion 4.1.1 did not change anything in that area at all.

 

[elorimer]

Two things. One, on my 87U with Diversion 4.1.1, my tav is 7 ms.

Two, the current pixelserv-tls 2.2.1 in the entware channel is "(compiled: Mar 22 2019 19:41:34 flags: tls1_3)", the dynamic build with Openssl 1.1.1a. I think the February build is the version with the static build with 1.1.1b.

I'm not aware there was any issue with pixelserv-tls. We were all mistaken that the static build had a memory optimization feature not present with the dynamic build but @merlin straigtened that out. But pixelserv-tls, perfect, fast and utterly stable. What a great contribution.

I think @kvic was working on an improvement using unbound, but I haven't heard anything from him for a while.

 

[joe68000]

Two, the current pixelserv-tls 2.2.1 in the entware channel is "(compiled: Mar 22 2019 19:41:34 flags: tls1_3)", the dynamic build with Openssl 1.1.1a. I think the February build is the version with the static build with 1.1.1b.

What is the correct way to update pixelserv-tls to the March build?

 

[Butterfly Bones]

What is the correct way to update pixelserv-tls to the March build?

Try this.
https://www.snbforums.com/threads/diversion-the-router-ad-blocker.48538/page-132#post-483781

 

[joe68000]

Try this.
https://www.snbforums.com/threads/diversion-the-router-ad-blocker.48538/page-132#post-483781

Worked like a charm... pixelserv-tls 2.2.1 (compiled: Mar 22 2019 19:41:34 flags: tls1_3) Thanks!

Unfortunately, tav is is still super high ~475ms

 

[Protik]

Hi all,

I have dockerized the pixelserv-tls for a Raspberry Pi. Give this a spin if you are curious.

 

[Makaveli]

That's not very typical. On the routers I have up, the tav is 8, 8 and 7 ms and I've had Diversion 4.1.0 with the new blocking list format running on them for a while. Diversion 4.1.1 did not change anything in that area at all.

I have no issue with it also.

tav 12 ms average processing time (per request)
tmx 63 ms longest processing time (per request)

 

[joe68000]

Worked like a charm... pixelserv-tls 2.2.1 (compiled: Mar 22 2019 19:41:34 flags: tls1_3) Thanks!

Unfortunately, tav is is still super high ~475ms

Well, I found this post:

2.1.3-test.1 is available

This version enhances the uniqueness of serial numbers created for generated certificates. This is an essential update for Firefox users, especially running pixelserv-tls on a "fast" router such as 86U or a PC.

The issue

With a fast processor, previous versions will very likely generate two certificates with the same serial number. Firefox has historically treated such certificates as invalid. Hence, TLS handshake will fail, and boost your slu count (significantly if the problematic certificates are frequently used).

Install

Use the same one-liner script to install.

Then delete all existing generated certificates with the following commands or otherwise:

cd /opt/var/cache/pixelserv
mv ca.* ..
rm *
mv ../ca.* .

@Asad Ali contributed to the discovering of this issue

So I figured I'd clear the cached certs (preserving my generated certs) and restart. That fixed it. My tav is back to ~50 ms.

 

[elorimer]

have dockerized the pixelserv-tls for a Raspberry Pi. Give this a spin if you are curious.

When last I logged in to discord, the channels I had been on where you and @kvic were discussing this had gone away. Are you still in touch on discord?