pixelserv pixelserv - A Better One-pixel Webserver for Adblock

[jrmwvu04]

I am in an Apple iOS scenario.
So, if iOS13 breaks pixelserv, what is the result if I have to remove pixelserv?
Does that in turn reduce the use of Diversion?

No, that’s what I was getting at earlier. Even if the tls handshake is failing, dropped pixelserv connections are preferable to other solutions.

 

[Jack Yaz]

No, that’s what I was getting at earlier. Even if the tls handshake is failing, dropped pixelserv connections are preferable to other solutions.

I'm taking a stab at patching this

EDIT: For anyone with a Linux box and is comfortable building software: https://github.com/jackyaz/pixelserv-tls

 

[Delusion]

I'm taking a stab at patching this

EDIT: For anyone with a Linux box and is comfortable building software: https://github.com/jackyaz/pixelserv-tls

How? I clone the git, enter the folder, what next?

 

[mrchow]

How? I clone the git, enter the folder, what next?

the steps are described within the repo readme under build from source.

 

[XIII]

the steps are described within the repo readme under build from source.

But don't we need to cross-compile to run it on our routers? (How?)

 

[Delusion]

But don't we need to cross-compile to run it on our routers? (How?)

it says: but it fails...
2) Use the old Makefile-XC. E.g. to build for ASUSWRT,
make -f Makefile-XC arm

 

[jrmwvu04]

I'm taking a stab at patching this

EDIT: For anyone with a Linux box and is comfortable building software: https://github.com/jackyaz/pixelserv-tls

Looks good, thanks. Comment should change to 2 years.

(x509), 63072000L); // cert valid for 10yrs

If anyone builds a binary for armv7, feel free to share.

 

[Jack Yaz]

it says: but it fails...
2) Use the old Makefile-XC. E.g. to build for ASUSWRT,
make -f Makefile-XC arm

You probably need toolchains etc.?

I'm afraid my skillset is limited when it comes to cross compiling (and compiling in general!)

 

[gattaca]

Here's what the current result is from the latest pixelserv build widely available. 10 years, 1024 bit, etc. despite the supplied certificate being changed.

Thinking about this example posted above, with that being from pixelserv, are the only things which NEED to be changed:
a) Key length 1024 -> 2048 bits
b) Days - 3650 --> 825
c) Are the other fields ok as is to keep pixelserv functional and in compliance with Apples new rules? IDK, I'm asking?

 

[jrmwvu04]

Thinking about this example posted above, with that being from pixelserv, are the only things which NEED to be changed:
a) Key length 1024 -> 2048 bits
b) Days - 3650 --> 825
c) Are the other fields ok as is to keep pixelserv functional and in compliance with Apples new rules? IDK, I'm asking?

Without the proper testing which I have not done I can’t say definitively, but I assume the ExtendedKeyUsage extension will also need to be present. I hit a ton of snags trying to get a build environment going last night (Catalina breaks quite a bit of software).

 

[Jack Yaz]

Without the proper testing which I have not done I can’t say definitively, but I assume the ExtendedKeyUsage extension will also need to be present. I hit a ton of snags trying to get a build environment going last night (Catalina breaks quite a bit of software).

if my version works, it should do this

 

[gattaca]

Without the proper testing which I have not done I can’t say definitively, but I assume the ExtendedKeyUsage extension will also need to be present. I hit a ton of snags trying to get a build environment going last night (Catalina breaks quite a bit of software).

Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Something akin to this?
Issued to : 192.168.301.5
SAN : 192.168.301.5 router.asus.com 1212-30105-AC86 1212-30105-AC86.mydomain.com
Issued by : 192.168.301.5
Expires on : 2028/5/5

 

[Jack Yaz]

Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Something akin to this?
Issued to : 192.168.301.5
SAN : 192.168.301.5 router.asus.com 1212-30105-AC86 1212-30105-AC86.mydomain.com
Issued by : 192.168.301.5
Expires on : 2028/5/5

There's no eku for tls server auth which is a requirement from Apple

 

[jrmwvu04]

Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

I'm not an expert on any of this. Some of the stuff I've dealt with enough to manipulate, some of it I have a working understanding, and some of it I've heard about for the first time this week.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Whatever that is, it has nothing to do with pixelserv or the new tighter iOS/macOS rules

 

[gattaca]

There's no eku for tls server auth which is a requirement from Apple

Ah ok. Not sure I understand EKU+SAN.
I was talking about the default cert showing the Extension+ SAN + "DNS Name" in this earlier posting https://www.snbforums.com/threads/p...server-for-adblock.26114/page-148#post-511588

 

[elorimer]

There's no eku for tls server auth which is a requirement from Apple

Is it as simple as this:

Not Critical 
TLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1) 
TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2)

In other words, just that OID indicating what the certificate is used for? I took this from Cloudflare's certificate for snbforums.com

 

[Jack Yaz]

Is it as simple as this:

Not Critical
TLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1)
TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2)

In other words, just that OID indicating what the certificate is used for? I took this from Cloudflare's certificate for snbforums.com

Not sure client is needed, but in my forked pixelserv I add the server auth eku

 

[gattaca]

Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Something akin to this?
Issued to : 192.168.301.5
SAN : 192.168.301.5 router.asus.com 1212-30105-AC86 1212-30105-AC86.mydomain.com
Issued by : 192.168.301.5
Expires on : 2028/5/5

This is how/where I think that originated.. not 100% now --> https://github.com/kvic-z/pixelserv-tls/wiki/[ASUSWRT]-Use-Pixelserv-CA-to-issue-a-certificate-for-WebGUI
I had forgotten about his github page with lots of help.. so this is the one to externally generate a self-signed key and import it outside of pixelserv's nice neat way to stay outta the whole cert nightmare and quicksand!! --> https://github.com/kvic-z/pixelserv-tls/wiki/Create-and-Import-the-CA-Certificate

So if we can get the input strings correct + OpenSSL, we can generate the certs and import them?

But the rub still is the code actually checks for 1024.. length so that needs to be changed or just removed completely and any other checks along similar lines?

 

[thelonelycoder]

@Jack Yaz or anyone smarter and better with compiling than me: I would like to be prepared for the iOS 13 release.
I would need the usual ARM, Mipsel and AARCH releases in zip format, just like @kvic usually does.
A new version number would help too.
I could then modify the ps beta install script and code it into Diversion/amtm.

Any volunteers?

 

[thelonelycoder]

Looks like 13 could indeed be a bad number....