pixelserv pixelserv - A Better One-pixel Webserver for Adblock

[Asad Ali]

I updated my entware packages (pixelserv 2.1.1-1, libopenssl 1.0.2o-1) and so far everything seems to be working properly. @kvic, does this libopenssl package have the modification from 1.0.2n-1c?

edit: this pixelserv build was compiled more recently than the one I was using before but I can't tell any differences

pixelserv - A Better One-pixel Webserver for Adblock

 

[Twiglets]

Don't forget to download the 'libopenssl_1.0.2n-1c_XXXX-2.6.ipk' file FIRST !!!
[Substitute XXXX with the right Architecture for your router]
Once the 'opkg --force-depends remove libopenssl' command is run it will prevent downloading of the new file.
Unless you install 'wget-nossl' FIRST which has no dependency on the ssl lib running and download the file using that.
[All info 'pulled together' from various posts in this thread , Thanks kvic ]

 

[jrmwvu04]

pixelserv - A Better One-pixel Webserver for Adblock

Whew. I even remember reading that when it was posted.

 

[pattiri]

up for more than 30 days and more than 1 million requests handled, 1.8% memory is being used and all of these are happened with no problem.

 

[kvic]

up for more than 30 days and more than 1 million requests handled, 1.8% memory is being used and all of these are happened with no problem.

View attachment 13466

Congrats on hitting one million!

To celebrate, I offer you and everyone a bug fix beta..

2.1.2-test.1

This test version fixed missing client IP addresses in some situations when you enable log LEVEL 2 to capture failed handshakes for security check.

This is helpful for people using a script (like mentioned here) to parse and highlight only new suspicious connections.

Pls use the usual one-liner script to install the beta.

 

[Asad Ali]

Congrats on hitting one million!

To celebrate, I offer you and everyone a bug fix beta..

2.1.2-test.1

This test version fixed missing client IP addresses in some situations when you enable log LEVEL 2 to capture failed handshakes for security check.

This is helpful for people using a script (like mentioned here) to parse and highlight only new suspicious connections.

Pls use the usual one-liner script to install the beta.

A new BETA so soon?? I thought you were on your well deserved vacation lol

 

[kvic]

A new BETA so soon?? I thought you were on your well deserved vacation lol

This version will be only a bug fix release. No new features. It resolves the missing client ip addresses like in the logs below:

Jun 10 10:29:36 Phaeo pixelserv-tls[949]: handshake failed: unknown cert. client :39171 server googleads.g.doubleclick.net
Jun 10 10:30:12 Phaeo pixelserv-tls[949]: handshake failed: unknown cert. client :39182 server t.appsflyer.com
Jun 10 10:30:23 Phaeo pixelserv-tls[949]: handshake failed: unknown cert. client :39188 server googleads.g.doubleclick.net

Putting up a beta so that more people could try and report its effectiveness. With this fix, known breaks could be suppressed in reports produced by scripts.

Do you parse logs to catch and check new breaks btw?

 

[Asad Ali]

Do you parse logs to catch and check new breaks btw?

Not yet but now I'm thinking I should also give it a try, can you also add me to the test group.

 

[kvic]

Not yet but now I'm thinking I should also give it a try, can you also add me to the test group.

Added. If you can't see previous messages, let me know.

 

[Asad Ali]

Added. If you can't see previous messages, let me know.

Perfect thank you, and the first message I see is your instructions post so I assume there's no previous messages before that.

 

[kvic]

In the past few days I accumulated mysterious increments on slu, so turned on log LEVEL 5 to inspect. Accidentally caught this:

Jun 14 21:17:34 Phaeo pixelserv-tls[17673]: handshake failed: client 192.168.1.104:62382 server ping.ublock.org. Lib(20) Func(138) Reason(227)

According to uBlock@76b89c0, this 'phone home' feature was added to uBlock (not uBlock Origin) back in April.

It seems always happen regardless uBlock enabled in your browser or not as long as it's installed. Time to move away from uBlock to uBlock Origin if you still need client side filtering.

Btw, the above pixelserv-tls log entry was moved to log LEVEL 5. I'm thinking of moving back to log LEVEL 2. A script can parse and gather some useful info out of such entries.

 

[strangeluck]

Time to move away from uBlock to uBlock Origin if you still need client side filtering.

uBlock Origin is the original uBlock extension, still maintained by the original developer. uBlock is a fork of uBlock Origin, perpetrated years ago in an attempt to defraud the original developer and monetize the extension by seeking donations and removing credit. No one should be using anything but uBlock Origin to begin with.

 

[Asad Ali]

A better criterion will be (client ip, server name) tuple that is only doable from within pixelserv-tls with a new feature implemented. This will be more precise on what to suppress. Other clients accessing the same server can still go though.

Can we expect to see this feature implemented in pixelserv-tls anytime soon lol?

 

[kvic]

Can we expect to see this feature implemented in pixelserv-tls anytime soon lol?

I thought the script is a better solution. pixelserv-tls for speedy capture of 'raw' data. The script handles parsing of 'raw' data and tabulation of info in batch mode.

 

[Asad Ali]

I thought the script is a better solution. pixelserv-tls for speedy capture of 'raw' data. The script handles parsing of 'raw' data and tabulation of info in batch mode. [emoji1]

Yup but that's cosmetic lol and still messed up the slu's since the actual rouge client/server tuple are not blocked.

 

[kvic]

Yup but that's cosmetic lol and still messed up the slu's since the actual rouge client/server tuple are not blocked.

It's not. In v2.1, clients without CA imported will register in both slu and uca.

So e.g. if people care about the "clean" slu (which is meaningless IMO), one can get it by slu - uca.

 

[Asad Ali]

It's not. In v2.1, clients without CA imported will register in both slu and uca.

So e.g. if people care about the "clean" slu (which is meaningless IMO), one can get it by slu - uca.

In that case why not remove "slu" counter all together to make it look clean.

 

[kvic]

In that case why not remove "slu" counter all together to make it look clean.

slu - all handshake errors that contains two sub-categories uca, uce.
uca - CA not honoured (including devices without CA imported)
uce - server cert not hnoured

slu > uca + uce

slu serves its purpose and will stay. In future, we may add further sub-categories.

 

[Asad Ali]

Hey @kvic or other guys can anyone of you who are using two instances of pixelserv-tls guide me a little on how to run/setup/install it on a single router?

Furthermore I'm using ABSolution as my blocking script so will it be compatible with this setup?

 

[Clark Griswald]

AB-Solution has option to install.
I did not know there was any reason to run two pixelserv within a network, as long as you are running on main router.
EDIT:
@Asad Ali Thank You for showing me another way this script is used.