To: feedback@ml.delegate.org
Date: 21 Jul 2014 14:47:36 GMT
Subject: DeleGate/9.9.10 (STABLE) -- fixes around chained HTTP and HTTPS proxy
From: feedback@delegate.org (Yutaka Sato)
Reply-To: feedback@delegate.org
Lines: 83
X-Seqno: 5097 (via ml.delegate.org)
MIME-Version: 1.0 (generated by vin4.0.2)
Content-Type: text/plain; charset=US-ASCII
X-Mailer: Vin 4.0.2/070321 on Linux/2.4.2-2
Organization: The DeleGate Project
Message-Id: <1JpFTo.feedback@delegate.org>
References: <_A5062@delegate-en.ML_> <_A5063@delegate-en.ML_>
        <_A5084@delegate-en.ML_> <_A5089@delegate-en.ML_>
X-Forwarded: by - (DeleGate/10.0.0-pre1)

Dear DeleGate users,

I inform you of the new release of DeleGate available as follows:
--------------------------------------------------------------------------
DeleGate/9.9.10 (STABLE) -- fixes around chained HTTP and HTTPS proxy
                                                            July 21, 2014
--------------------------------------------------------------------------
This release includes a fix to enable a HTTP-DeleGate proxy, chained
to upstream proxy, can forward non-HTTP protocols (HTTPS/SSL, FTP, NNTP,
etc) as well as HTTP.

HTTP (proxy chaining for multiple protocols)
  - Fixed relaying arbitrary protocols to upstream HTTP proxy (in HTTP
    protocol).
    DeleGate as an HTTP proxy can be chained to upstream HTTP proxy(ies)
    with the PROXY (or FORWARD) parameter(s).  With the PROXY
    parameter, it forward any protocol to the specified upstream proxy.
    But, unfortunately, since 9.9.8-pre21 (released Jan. 2013), only HTTP
    protocol is relayed in HTTP protocol, while other protocols
    were relayed in the DeleGate-specific protocol. Thus if the upstream
    proxy is not DeleGate, the relay fails.
  - A workaround in older versions to escape the problem is using not
    PROXY but FORWARD like FORWARD="http-proxy://Host:Port"

HTTPS (SSL-tunneling with non-SSL blocker)
  - Disabled non-half-duplex communication blocker over SSL-tunnel by
    default.  (It can be enabled with HTTPCONF="halfdup")
  - Relaxed the threshold for non-SSL detection and blocking, not to
    break normal SSL communications with long latency.
    The default has become HTTPCONF="tout-pack-intvl:10.0" (which was
    "3.0" seconds in older versions).
  - Excluded several HTTPS server domains (google and facebook) from
    the subjects of non-SSL blocker.  It is equivalent to
    CMAP="thru-CONNECT:HTTPCONF:https:*.google.com,*.facebook.com".
  - In older versions, especially when DeleGate as a HTTPS proxy is
    chained to the upstream proxy, the blocker can be so bad that makes
    connection to HTTPS server, for example Google Mail, frozen at the
    start.
  - This blocker can be bypassed totally by the "-Dst" option in any
    version of DeleGate.

SOCKS (core dump with CONNECT=socks option)
  - It hits a stale area on the stack to cause segmentation violation
    where both FORWARD=socks://host:port and CONNECT=socks is specified.
    The situation occurs after secondary SOCKS connection.

yysh (remote login shell of DeleGate)
  - Re-enabled the yysh server on Windows which was disabled in
    9.9.7-pre23 (Feb. 2010) due to the bug in the the supplementary
    program for Windows, "dgforkpty.exe".
  - Periodic sending of packets toward the yysh server to keep the
    connection alive.  A connection of yysh has been dropped often after
    no communication over it for several minutes.  It was so bad
    especially when logging into a remote host on a cloud service.
  - The interval of keep-alive packets can be specified with -tiT
    opther where T is 60 (seconds) by default.

SSL/Cygwin (dynamic linking of SSL libraries)
  - Made Cygwin version DeleGate use dynamic library of SSL for Cygwin
    named as "cygXXX.dll".
  - It is equivalent to specifying DYLIB="cyg%s-0.9.8.dll,+"
  - Cygwin version of DeleGate and SSL libraries is necessary for "yysh",
    the remote login shell of DeleGate, with STLS=fsv or "-ys" option.

--------------------------------------------------------------------------
  SITE: <URL:ftp://ftp.delegate.org/pub/DeleGate/>
  FILE: delegate9.9.10.tar.gz
  DATE: Jul 21 22:10 JST 2014
  TAR-SIZE: 8396800 bytes
  TAR-MD5:  0715ac4ac671f7e618cac7677370bf24
  PUBLIC-KEY: http://www.delegate.org/rsa-pubkey.pem
  SRCSIGN=9.9.10:20140721221012+0900:68d4c88072823f5b
  TAR-MD5-SIGN:
    r02Q53AMOC8SvONO6DzdiR9mXcFOuXsjKPtfZVg8Cw7QM7u66rRQ6uUlp07WapYvP//YRxdk
    HdKVb0Zt0z8tnxJ6vFeKmBvPHQGLwuapMQ6c9VqNlH5Z/uzbcbn6wqzWh6jfSxPHglaijtOA
    HiNJzBVAdbnvT/C5dXGRKzM5kqs=

Cheers from Japan,
Yutaka
--
  9 9   Yutaka Sato { Do the more with the less -- B. Fuller }
 ( ~ )  National Institute of Advanced Industrial Science and Technology
_<   >_ 1-1-4 Umezono, Tsukuba, Ibaraki, 305-8568 Japan
