pixelserv pixelserv - A Better One-pixel Webserver for Adblock

jrmwvu04 · Aug 24, 2019

Treadler said:
I am in an Apple iOS scenario.
So, if iOS13 breaks pixelserv, what is the result if I have to remove pixelserv?
Does that in turn reduce the use of Diversion?

No, that’s what I was getting at earlier. Even if the tls handshake is failing, dropped pixelserv connections are preferable to other solutions.

Jack Yaz · Aug 25, 2019

jrmwvu04 said:
No, that’s what I was getting at earlier. Even if the tls handshake is failing, dropped pixelserv connections are preferable to other solutions.

I'm taking a stab at patching this

EDIT: For anyone with a Linux box and is comfortable building software: https://github.com/jackyaz/pixelserv-tls

Delusion · Aug 25, 2019

Jack Yaz said:
I'm taking a stab at patching this

EDIT: For anyone with a Linux box and is comfortable building software: https://github.com/jackyaz/pixelserv-tls

How? I clone the git, enter the folder, what next?

mrchow · Aug 25, 2019

Delusion said:
How? I clone the git, enter the folder, what next?

the steps are described within the repo readme under build from source.

XIII · Aug 25, 2019

mrchow said:
the steps are described within the repo readme under build from source.

But don't we need to cross-compile to run it on our routers? (How?)

Delusion · Aug 25, 2019

XIII said:
But don't we need to cross-compile to run it on our routers? (How?)

it says: but it fails...
2) Use the old Makefile-XC. E.g. to build for ASUSWRT,
make -f Makefile-XC arm

jrmwvu04 · Aug 25, 2019

Jack Yaz said:
I'm taking a stab at patching this

EDIT: For anyone with a Linux box and is comfortable building software: https://github.com/jackyaz/pixelserv-tls

Looks good, thanks. Comment should change to 2 years.

Code:

(x509), 63072000L); // cert valid for 10yrs

If anyone builds a binary for armv7, feel free to share.

Jack Yaz · Aug 25, 2019

Delusion said:
it says: but it fails...
2) Use the old Makefile-XC. E.g. to build for ASUSWRT,
make -f Makefile-XC arm

You probably need toolchains etc.?

I'm afraid my skillset is limited when it comes to cross compiling (and compiling in general!)

gattaca · Aug 26, 2019

jrmwvu04 said:
Here's what the current result is from the latest pixelserv build widely available. 10 years, 1024 bit, etc. despite the supplied certificate being changed.

Thinking about this example posted above, with that being from pixelserv, are the only things which NEED to be changed:
a) Key length 1024 -> 2048 bits
b) Days - 3650 --> 825
c) Are the other fields ok as is to keep pixelserv functional and in compliance with Apples new rules? IDK, I'm asking?

jrmwvu04 · Aug 26, 2019

gattaca said:
Thinking about this example posted above, with that being from pixelserv, are the only things which NEED to be changed:
a) Key length 1024 -> 2048 bits
b) Days - 3650 --> 825
c) Are the other fields ok as is to keep pixelserv functional and in compliance with Apples new rules? IDK, I'm asking?

Without the proper testing which I have not done I can’t say definitively, but I assume the ExtendedKeyUsage extension will also need to be present. I hit a ton of snags trying to get a build environment going last night (Catalina breaks quite a bit of software).

Jack Yaz · Aug 26, 2019

jrmwvu04 said:
Without the proper testing which I have not done I can’t say definitively, but I assume the ExtendedKeyUsage extension will also need to be present. I hit a ton of snags trying to get a build environment going last night (Catalina breaks quite a bit of software).

if my version works, it should do this

gattaca · Aug 27, 2019

jrmwvu04 said:
Without the proper testing which I have not done I can’t say definitively, but I assume the ExtendedKeyUsage extension will also need to be present. I hit a ton of snags trying to get a build environment going last night (Catalina breaks quite a bit of software).

Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Something akin to this?
Issued to : 192.168.301.5
SAN : 192.168.301.5 router.asus.com 1212-30105-AC86 1212-30105-AC86.mydomain.com
Issued by : 192.168.301.5
Expires on : 2028/5/5

Jack Yaz · Aug 27, 2019

gattaca said:
Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Something akin to this?
Issued to : 192.168.301.5
SAN : 192.168.301.5 router.asus.com 1212-30105-AC86 1212-30105-AC86.mydomain.com
Issued by : 192.168.301.5
Expires on : 2028/5/5

There's no eku for tls server auth which is a requirement from Apple

jrmwvu04 · Aug 27, 2019

gattaca said:
Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

I'm not an expert on any of this. Some of the stuff I've dealt with enough to manipulate, some of it I have a working understanding, and some of it I've heard about for the first time this week.

gattaca said:
Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Whatever that is, it has nothing to do with pixelserv or the new tighter iOS/macOS rules

gattaca · Aug 27, 2019

Jack Yaz said:
There's no eku for tls server auth which is a requirement from Apple

Ah ok. Not sure I understand EKU+SAN.
I was talking about the default cert showing the Extension+ SAN + "DNS Name" in this earlier posting https://www.snbforums.com/threads/p...server-for-adblock.26114/page-148#post-511588

elorimer · Aug 27, 2019

Jack Yaz said:
There's no eku for tls server auth which is a requirement from Apple

Is it as simple as this:

Code:

Not Critical 
TLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1) 
TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2)

In other words, just that OID indicating what the certificate is used for? I took this from Cloudflare's certificate for snbforums.com

Jack Yaz · Aug 27, 2019

elorimer said:
Is it as simple as this:

Code:

Not Critical TLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1) TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2)

In other words, just that OID indicating what the certificate is used for? I took this from Cloudflare's certificate for snbforums.com

Not sure client is needed, but in my forked pixelserv I add the server auth eku

gattaca · Aug 27, 2019

gattaca said:
Looking at that default cert again, it already has an EKU+SAN with a single DNS entry (*.bing.com). This is the part I do not understand. Is that the default cert generated b/c of the pixelserv code and is that fine with the rules or would each setup we have (say the router name) need to be pulled in as part of the cert? I just do not know.

Login to your router, then do Administration > System > Installed Server Certificate. What do you see? I think I recall there being instructions on using pixelserv to gen this cert which I did so it's another example. And yes it defaulted to 10 years.

Something akin to this?
Issued to : 192.168.301.5
SAN : 192.168.301.5 router.asus.com 1212-30105-AC86 1212-30105-AC86.mydomain.com
Issued by : 192.168.301.5
Expires on : 2028/5/5

This is how/where I think that originated.. not 100% now --> https://github.com/kvic-z/pixelserv-tls/wiki/[ASUSWRT]-Use-Pixelserv-CA-to-issue-a-certificate-for-WebGUI
I had forgotten about his github page with lots of help.. so this is the one to externally generate a self-signed key and import it outside of pixelserv's nice neat way to stay outta the whole cert nightmare and quicksand!! --> https://github.com/kvic-z/pixelserv-tls/wiki/Create-and-Import-the-CA-Certificate

So if we can get the input strings correct + OpenSSL, we can generate the certs and import them?

But the rub still is the code actually checks for 1024.. length so that needs to be changed or just removed completely and any other checks along similar lines?

thelonelycoder · Aug 29, 2019

@Jack Yaz or anyone smarter and better with compiling than me: I would like to be prepared for the iOS 13 release.
I would need the usual ARM, Mipsel and AARCH releases in zip format, just like @kvic usually does.
A new version number would help too.
I could then modify the ps beta install script and code it into Diversion/amtm.

Any volunteers?

thelonelycoder · Aug 29, 2019

Looks like 13 could indeed be a bad number....

pixelserv pixelserv - A Better One-pixel Webserver for Adblock

Very Senior Member

Part of the Furniture

Senior Member

Occasional Visitor

Part of the Furniture

Senior Member

Very Senior Member

Part of the Furniture

Senior Member

Very Senior Member

Part of the Furniture

Senior Member

Part of the Furniture

Very Senior Member

Senior Member

Part of the Furniture

Part of the Furniture

Senior Member

Part of the Furniture

Part of the Furniture

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest

We value your privacy