host
eae60cf3d7
- AppArmor network rules must use socket types (stream/dgram), not protocol names (tcp/udp/icmp): the parser rejected the profile (Invalid network entry) until fixed. - Tinyproxy has no 'Upstream none' syntax; the line failed the service at startup. Direct connection is the default, so the line is removed. - Tinyproxy Filter is POSIX BASIC regex, not extended: the extended-style anchored patterns denied even allowed domains (verified: xcmapi.org got 403). Rewritten in basic syntax (\(...\)* groups); the anchored form still blocks evilgithub.com and xcmapi.org.evil.com (verified on host). - Filter file must be world-readable (was 640 root:root, so tinyproxy could not read it and exited on reload); install steps now chmod 644 (documented in the filter header via the install note in tinyproxy.conf). Host already runs these exact files (proxy allow/block verified: xcmapi/github/api.github 200, example/evilgithub/ xcmapi.org.evil.com 403).
24 lines
1.1 KiB
Plaintext
24 lines
1.1 KiB
Plaintext
# Tinyproxy Filter: ONE regex per line, matched against the bare
|
|
# domain for CONNECT requests (the log shows e.g. filtered domain
|
|
# "xcmapi.org" -- no scheme, no :port suffix).
|
|
#
|
|
# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
|
|
# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
|
|
# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
|
|
# verified on 2026-10-26 to deny even xcmapi.org itself, while the
|
|
# basic-syntax equivalent below allows it. In basic regex, groups
|
|
# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
|
|
# literal characters. Do NOT "modernize" these patterns.
|
|
#
|
|
# Each entry is anchored (^...$) to the domain and its subdomains
|
|
# only: a bare substring "github.com" would also match
|
|
# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
|
|
# "label." segments, so xcmapi.org and api.xcmapi.org match, while
|
|
# notxcmapi.org and xcmapi.org.evil.com do not.
|
|
^\(.*\.\)*xcmapi\.org$
|
|
^\(.*\.\)*github\.com$
|
|
^\(.*\.\)*githubusercontent\.com$
|
|
^\(.*\.\)*pypi\.org$
|
|
^\(.*\.\)*pythonhosted\.org$
|
|
^\(.*\.\)*npmjs\.org$
|