Domingo Dirutigliano
8ce9b21400
general fixes and old/new connection resilience for proxy filters
2026-09-26 09:52:20 +02:00
Domingo Dirutigliano
70373eb4f6
minor adjustments
2026-09-24 09:19:00 +02:00
Domingo Dirutigliano
0c52014606
minor changes and bug fixes
2026-09-23 11:21:51 +02:00
Domingo Dirutigliano
d94c08293a
added additional tests
2026-09-19 02:17:51 +02:00
Domingo Dirutigliano
440b7c91ec
docs and code minor fixing
2026-09-18 23:01:11 +02:00
Domingo Dirutigliano
4a87bf2184
fixes from main
2026-09-18 15:10:08 +02:00
Domingo Dirutigliano
4476da02bd
QUIC support and bug fixes
2026-09-18 09:34:44 +02:00
Domingo Dirutigliano
e491a14899
improved addr/int selection UI + change llhttp managment
2026-09-13 15:54:56 +02:00
Domingo Dirutigliano
9d2a4dc4bf
additional improves on UDP
2026-09-11 18:53:41 +02:00
Domingo Dirutigliano
a26bda5161
fixup packet been dropped in the first connection
2026-09-10 09:24:47 +02:00
Domingo Dirutigliano
9832e449c6
Initial commit for future 5.0.0 version: new UI, proxies and managment
2026-09-10 08:51:08 +02:00
Domingo Dirutigliano
2c3316b036
Harden the no-auth reverse-proxy mode
...
Rename the flag to --unsafe-disable-auth so the risk is visible at the call
site, and close the ways the mode could outlive itself:
- Keep an explicit -P/--startup-psw instead of dropping it. Without a password
in the database, --no-unsafe-disable-auth brought firegex up in its
initial-setup state, where anyone able to reach it could choose the password.
- Refuse /api/login, /api/set-password and /api/change-password while
authentication is disabled: an anonymous caller could otherwise plant a
credential that kept working once authentication was turned back on.
run.py config --password still works, writing to the database from the host.
- Print a banner on every start/restart with authentication disabled. The flag
is persisted in the config file, so a later bare `run.py start` inherits it.
- Report the change in `run.py config --unsafe-disable-auth`, which claimed
"No configuration changes specified" while persisting it, and stop that
command from nulling the stored port and host on the way.
- Expose the state as auth_disabled in /api/status and hide the logout button
and the change-password entry, which were silent no-ops in this mode.
Tests cover both directions of the toggle, the socket.io handler, the password
endpoints and the -P handling.
2026-09-03 01:07:51 +02:00
Savva Serebriakov
6fb08f41f6
CUT-22: add reverse-proxy support to firegex
2026-09-02 19:08:51 +03:00
Domingo Dirutigliano
0943aeaa01
enforced security over import backup, minor changes
2026-07-23 18:38:22 +02:00
Domingo Dirutigliano
bd55a7bc9c
integrated and refactore docs + minor changes
2026-07-23 16:53:09 +02:00
Domingo Dirutigliano
d27831c9ec
Merge branch 'dev' into dev-tmp
2026-07-23 13:45:25 +02:00
Domingo Dirutigliano
c37d2b31e8
graphics and TLS feature total refactoring
2026-07-23 13:39:01 +02:00
Domingo Dirutigliano
4125eff93f
minor adjustments + network address based access control
2026-07-22 07:54:38 +02:00
Sogoss
75c54f0155
Add transparent TLS proxying and certificate management for NFProxy and NFRegex
...
- Add Nginx stream proxy module for transparent TLS termination in NFProxy and NFRegex
- Add backend routes and SQLite schema for certificate management (upload, view, delete)
- Implement DNAT nftables redirection rules for deterministic TLS ports
- Add frontend React components (TLSConfigModal, TLSServiceFields) for certificate configuration
- Update Dockerfile and docker-entrypoint.sh to support Nginx stream module and sysctl forwarding
2026-07-20 12:25:30 +02:00
Domingo Dirutigliano
935a6a1574
auto-recognize version when using cloned firegex
2026-07-12 18:58:57 +02:00
Domingo Dirutigliano
cf2cbfea80
auto-recognize version when using cloned firegex
2026-07-12 18:46:35 +02:00
Domingo Dirutigliano
5bf000fdce
invalid request check on nfqueue updated
2026-06-18 21:00:30 +02:00
Domingo Dirutigliano
16d0bfd169
CRITICAL: fix possible path traversal
2026-04-10 14:52:22 +02:00
Domingo Dirutigliano
16f96aa6f6
using brotli 1.2 from pypi, fixed tests to py 3.14, removed from experimental pyproxy
2025-11-11 23:30:48 +01:00
Domingo Dirutigliano
49c6c14fe5
upgrade to py3.14 and fedora 43
2025-10-13 15:38:38 +02:00
Domingo Dirutigliano
f554ac558a
additional fixes to socket binding
2025-10-01 15:37:20 +02:00
Minei3oat
88f4f54b55
Allow binding to UNIX domain socket
...
UNIX domain sockets are the recommended configuration for proxying with Nginx:
https://uvicorn.dev/deployment/#running-behind-nginx
2025-10-01 01:49:28 +02:00
Domingo Dirutigliano
2362eb8045
password hashing customized and also set already hashed by run.py
2025-09-29 14:33:12 +02:00
Domingo Dirutigliano
aeb97062e2
bind firegex also on ipv6 by default
2025-09-29 13:15:09 +02:00
Domingo Dirutigliano
402be8c021
new crypto system for passwords, removed bcrypt
2025-09-29 12:53:05 +02:00
Domingo Dirutigliano
2798cd4f2a
Merge pull request #25 from Minei3oat/bcrypt
...
Restrict bcrypt version to <5
2025-09-29 00:03:27 +02:00
Minei3oat
907c85d85d
Add Content-Type=plain/text for metrics endpoint
...
Without the content type, prometheus will reject the metrics if no `fallback_scrape_protocol` is specified.
https://prometheus.io/docs/prometheus/3.0/migration/#scrape-protocols
https://prometheus.io/docs/instrumenting/exposition_formats/#text-based-format
2025-09-28 21:09:25 +02:00
Minei3oat
709de42ef2
Restrict bcrypt version to <5
...
Starting with version 5.0.0, bcrypt will throw a ValueError if the input is more than 72 bytes.
passlib's `hash` processes the input such that more than 72 bytes are passed to bcrypt, independently of the input length.
As a result, the backend of firegex breaks when calculating the hash in `set_psw`.
2025-09-28 20:43:46 +02:00
Domingo Dirutigliano
89b234e670
Pointed to a specific brotli version on google repo due to a tmp rollback
2025-09-15 10:19:31 +02:00
Domingo Dirutigliano
8d78c5df6a
using brotli version from google (merged from domysh/brotli)
2025-09-04 17:29:39 +02:00
Domingo Dirutigliano
760529e37a
firegex custom host and better port config managment
2025-08-17 16:23:49 +02:00
Domingo Dirutigliano
b49c42f06f
fixed: packet size of mnl including packet size it-self (was causing crash sometime) and frontend updates
2025-07-28 15:45:22 +02:00
Domingo Dirutigliano
d7f6eb7524
using name and id as pk for PyFilter when updating stats
2025-06-13 13:33:13 +02:00
Domingo Dirutigliano
ac1b2c9f76
removed constraint to prothijack
2025-05-05 19:11:21 +02:00
Domingo Dirutigliano
a109ee8067
websocket fix + starting firegex as root if capsh fails
2025-04-12 22:15:08 +02:00
Domingo Dirutigliano
ed85aa5430
changing prio on nf chains
2025-04-12 21:44:02 +02:00
Domingo Dirutigliano
129a262704
RST docs + connection error on test
2025-04-12 20:34:45 +02:00
Domingo Dirutigliano
d0b2c67554
Revert "using also bridge table on network hooking"
...
This reverts commit 33b22a174c
2025-04-12 20:32:52 +02:00
Domingo Dirutigliano
33b22a174c
using also bridge table on network hooking
2025-04-12 16:51:42 +02:00
Domingo Dirutigliano
c0a475a92f
using RST flag for closing connection
2025-04-12 12:50:22 +02:00
Domingo Dirutigliano
d4b2b6c72d
niceness on firegex process
2025-03-26 22:25:09 +01:00
Domingo Dirutigliano
8ddd8b44f2
pyhton and c related fixes on empty filters and mangling
2025-03-24 11:55:51 +01:00
Domingo Dirutigliano
81fb48c97c
minor code change
2025-03-23 11:04:30 +01:00
Domingo Dirutigliano
25d71c4b94
README: update
2025-03-09 23:52:34 +01:00
Domingo Dirutigliano
73c40d2f5d
data handler improves, written test for nfproxy, new option on parsing fail
2025-03-09 22:14:34 +01:00
