v5.5.7r segfaults on transparent MITM and openwrt 23

34 views
Skip to first unread message

Dustin Wilt

unread,
Mar 1, 2025, 6:20:29 PMMar 1
to e2guardian
Hey guys, wanted to start a clean thread and provide some info to try to help troubleshoot.

This is running in MITM mode with transparent proxy mode...

Running in debug_low mode...
e2guardian 5.5.7r

Built with:  '--target=x86_64-openwrt-linux' '--host=x86_64-openwrt-linux' '--build=x86_64-pc-linux-gnu' '--di
sable-dependency-tracking' '--program-prefix=' '--program-suffix=' '--exec-prefix=/usr' '--bindir=/usr/bin' '-
-sbindir=/usr/sbin' '--libexecdir=/usr/lib' '--sysconfdir=/etc' '--datadir=/usr/share' '--localstatedir=/var'
'--mandir=/usr/man' '--infodir=/usr/info' '--disable-nls' '--prefix=/usr' '--with-proxyuser=e2guardian' '--wit
h-proxygroup=e2guardian' '--with-piddir=/tmp' '--enable-icap=yes' '--enable-pcre=yes' '--with-logdir=/tmp' '--
with-debug_high=on' '--with-debug_low=on' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=x86_64-openwrt-linux'
'target_alias=x86_64-openwrt-linux' 'CXX=x86_64-openwrt-linux-musl-g++' 'CXXFLAGS=-Os -pipe -fno-caller-saves
-fno-plt -fhonour-copts -ffile-prefix-map=/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Lin
ux-x86_64/build_dir/target-x86_64_musl/e2guardian-5.5.7r=e2guardian-5.5.7r -Wformat -Werror=format-security -f
stack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro ' 'LDFLAGS=-L/home/wiltd/Downloads/openwrt-sdk-23.
05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/staging_dir/toolchain-x86_64_gcc-12.3.0_musl/usr/lib -L/home/wiltd/Do
wnloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/staging_dir/toolchain-x86_64_gcc-12.3.0_musl/l
ib -znow -zrelro ' 'CPPFLAGS=-I/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/s
taging_dir/toolchain-x86_64_gcc-12.3.0_musl/usr/include -I/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc
-12.3.0_musl.Linux-x86_64/staging_dir/toolchain-x86_64_gcc-12.3.0_musl/include/fortify -I/home/wiltd/Downloads
/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/staging_dir/toolchain-x86_64_gcc-12.3.0_musl/include
' 'CC=x86_64-openwrt-linux-musl-gcc' 'CFLAGS=-Os -pipe -fno-caller-saves -fno-plt -fhonour-copts -ffile-prefix
-map=/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/build_dir/target-x86_64_mus
l/e2guardian-5.5.7r=e2guardian-5.5.7r -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -
Wl,-z,now -Wl,-z,relro ' 'PKG_CONFIG=/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x8
6_64/staging_dir/host/bin/pkg-config' 'PKG_CONFIG_PATH=/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12
.3.0_musl.Linux-x86_64/staging_dir/target-x86_64_musl/usr/lib/pkgconfig:/home/wiltd/Downloads/openwrt-sdk-23.0
5.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/staging_dir/target-x86_64_musl/usr/share/pkgconfig' 'PKG_CONFIG_LIBDIR
=/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/staging_dir/target-x86_64_musl/
usr/lib/pkgconfig:/home/wiltd/Downloads/openwrt-sdk-23.05.5-x86-64_gcc-12.3.0_musl.Linux-x86_64/staging_dir/ta
rget-x86_64_musl/usr/share/pkgconfig'


root@OpenWrt:~# grep " = " /etc/e2guardian/e2guardian.conf  
language = 'ukenglish'
#dockermode = off
# nodaemon = on
# set_info = 'stderr'
# set_error = 'stderr'
# set_warning = 'stderr'
# set_accesslog = 'stdout'
checkip = 127.0.0.1
checkip = 192.168.2.10
#checkip = 2nd ip of server
#checkip = VIP of server
#extracheckports = 3128
transparenthttpsport = 8443
# packets to this port and ssl must be enabled with enablessl = on
#icapport = 1344
#proxyip = 127.0.0.1
#proxyport = 3128
#filtergroups = 1
#defaultfiltergroup = 1;
enablessl = on
# servername = 'my_name"
daemonuser = 'e2guardian'
daemongroup = 'e2guardian'
languagedir = '/usr/share/e2guardian/languages'
#preauthstoryboard = '/etc/e2guardian/preauth.story'
# perroomdirectory = '__LISTDIR__/../rooms/'
# set_error = 'stderr'
# set_info = 'stdout'
# set_warning = 'stderr'
# set_error = 'syslog:LOG_ERR'
# set_info = 'syslog:LOG_INFO'
# set_warning = 'syslog:LOG_WARNING'
#filterports = 8080
#filterports = 8080:8081:8082
tlsfilterports = 8090
#tlsfilterports = 8090:9091
#tlsproxycn = 192.168.1.25
#tlsproxycn = mye2g.anydomain
#tlsproxycn = 192.168.1.25:mye2g.anydomain:mye2g.internal.domain  # v5.5.6 onwards
#proxyport = 3128
#   Check these settings if enablessl = on
#sslcertificatepath = ''
cacertificatepath = '/etc/e2guardian/ssl/my_rootCA.crt'
caprivatekeypath = '/etc/e2guardian/ssl/private_root.pem'
certprivatekeypath = '/etc/e2guardian/ssl/private_cert.pem'
generatedcertpath = '/tmp/generatedcerts/'
# generatedcertstart = auto
#useopensslconf = off
# opensslconffile = '/etc/e2guardian/openssl.conf'
# only used if useopensslconf = on
# setcipherlist = "HIGH:!ADH:!MD5:!RC4:!SRP:!PSK:!DSS"
sitelist = 'name=nomitm,path=__LISTDIR__/nomitmsitelist'
ipsitelist = 'name=nomitm,path=__LISTDIR__/nomitmsiteiplist'
#defaulticapfiltergroup = 1
#icapreqmodurl = 'request'
#icapresmodurl = 'response'
#defaulttransparentfiltergroup = 1;
#useoriginalip = on
# default = on (linux) ignored (bsd)
#authplugin = '/etc/e2guardian/authplugins/ident.conf'
#authplugin = '/etc/e2guardian/authplugins/ip.conf'
#authplugin = '/etc/e2guardian/authplugins/port.conf'
#authplugin = '/etc/e2guardian/authplugins/dnsauth.conf'
#authplugin = '/etc/e2guardian/authplugins/pf-basic.conf'
#authplugin = '/etc/e2guardian/authplugins/proxy-header.conf'
#authplugin = '/etc/e2guardian/authplugins/proxy-basic.conf'
#authplugin = '/etc/e2guardian/authplugins/proxy-digest.conf'
#@NTLMSUPPORT@authplugin = '/etc/e2guardian/authplugins/proxy-ntlm.conf'
maplist = 'name=defaultusermap, path=__LISTDIR__/../authplugins/filtergroupslist'
ipmaplist = 'name=ipmap, path=__LISTDIR__/../authplugins/ipgroups'
maplist = 'name=portmap, path=__LISTDIR__/../authplugins/portgroups'
# authrequiresuserandgroup = off
iplist = 'name=bannedclient,messageno=100,logmessageno=103,path=__LISTDIR__/bannediplist'
iplist = 'name=exceptionclient,messageno=600,path=__LISTDIR__/exceptioniplist'
reverseclientiplookups = off
#sitelist = 'name=bannedclient,messageno=100,logmessageno=104,path=__LISTDIR__/bannedclientlist'
#sitelist = 'name=exceptionclient,messageno=631,path=__LISTDIR__/exceptionclientlist'
ipsitelist = 'name=authexception,messageno=602,path=__LISTDIR__/authexceptioniplist'
sitelist = 'name=authexception,messageno=602,path=__LISTDIR__/authexceptionsitelist'
urllist = 'name=authexception,messageno=603,path=__LISTDIR__/authexceptionurllist'
regexpboollist = 'name=browser,path=__LISTDIR__/browserregexplist'
set_accesslog = 'file:/tmp/access.log'
#set_accesslog = 'syslog:LOG_INFO'
#set_accesslog = 'stderr'
#loglocation = '/tmp/access.log'
#logsyslog = off
#namesuffix = ""
logfileformat = 4
# 1 = Dansguardian format (space delimited)
# 2 = CSV-style format
# 3 = Squid Log File Format
# 4 = Tab delimited
# 5 = Protex format
# 6 = Protex format with server field blanked
# 7 = Same as 5, but with searchterms and EXTFLAGS added
# 8 = Same as 7, but with server field blanked
#anonymizelogs = off
#tag_logs = on
loglevel = 2
# 0 = none  1 = just denied  2 = all text based  3 = all requests
#logexceptionhits = 2
# 0 = never log exceptions
# 1 = log exceptions, but do not explicitly mark them as such
# 2 = always log & mark exceptions (default)
logadblocks = on
showweightedfound = off
#showallweightedfound = off
#logclienthostnames = off
#loguseragent = off
#logclientnameandip = on
#dnsuserloggingdomain = ""
#usedashforblank = on
#logtimestamp = off
#logid1 = ""
#logid2 = ""
#productid = '2'
#addECHtoFlags = on
#maxlogitemlength = 2000
set_dstatslog = 'file:/tmp/dstats.log'
dstatlocation = '/tmp/dstats.log'
#dstatinterval = 300  # = 5 minutes
statshumanreadable = on
# internaltesturl = 'internal.test.e2guardian.org'
# internalstatusurl = 'internal.status.e2guardian.org'
# monitorflagprefix = '/tmp/e2g_flag_'
reverseaddresslookups = off
# abortiflistmissing = off   
#searchsitelistforip = on
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/clamdscan.conf'
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/avastdscan.conf'
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/kavdscan.conf'
#contentscanner = '/etc/e2guardian/contentscanners/icapscan.conf'
#!! Not compiled !! contentscanner = '/etc/e2guardian/contentscanners/commandlinescan.conf'
#contentscannertimeout = 60
#addforwardedfor = off
# forwardedfor = off
usexforwardedfor = off
# maxheaderlines = 2000
#reportinglevel = 3
# -1 = log, but do not block - Stealth mode
#  0 = just say 'Access Denied'
#  1 = report why but not what denied phrase
#  2 = report fully
#  3 = use HTML template file (accessdeniedaddress ignored) - recommended
#usecustombannedimage = on
#custombannedimagefile = '/usr/share/e2guardian/transparent1x1.gif'
#usecustombannedflash = on
#custombannedflashfile = '/usr/share/e2guardian/blockedflash.swf'
#downloadmanager = '/etc/e2guardian/downloadmanagers/trickle.conf'
downloadmanager = '/etc/e2guardian/downloadmanagers/default.conf'
#filecachedir = '/tmp'
#deletedownloadedtempfiles = on
#initialtrickledelay = 20
#trickledelay = 10
weightedphrasemode = 1
# 0 = off = do not use the weighted phrase feature.
# 1 = on, normal = normal weighted phrase operation.
# 2 = on, singular = each weighted phrase found only counts once on a page.
phrasefiltermode = 2
# 0 = raw only
# 1 = smart only
# 2 = both of the above  
# 3 = meta/title
#preservecase = 0
# 0 = force lower case (default)
# 1 = do not change case
# 2 = scan first in lower case, then in original case
#hexdecodecontent = off
# off = disabled (default)
# on = enabled
#forcequicksearch = off
#httpworkers = 500
#maxcontentfiltersize = 2048
# The size is in Kibibytes - eg 2048 = 2Mb
#maxcontentramcachescansize = 2048
# The size is in Kibibytes - eg 10240 = 10Mb
#maxcontentfilecachescansize = 20000
# The size is in Kibibytes - eg 10240 = 10Mb
#proxytimeout = 5
#connecttimeout = 10
# connectretries = 1
#proxyexchange = 61
#pcontimeout = 55
# udp_source_port = 39000
# storyboardtrace = on
#set_storytrace = "file:/tmp/storytrace.txt"
logsslerrors = on
logconnectionhandlingerrors = on
#set_requestlog = 'none'
#set_requestlog = 'file:/tmp/request.log'
#rqloglocation = '/tmp/request.log'
#set_responselog = 'none'
#set_responselog = 'file:/tmp/response.log'
#set_alertlog = 'none'
#set_alertlog = 'file:/tmp/alert.log'
## debuglevel = 'debugtypes[:destination[:filename|sysloglevel|host:udp_port]]'
#debuglevel = 'icap:file:/var/log/e2guardian/icap.log'
#debuglevel = 'ALL:syslog,LOG_DEBUG'
#debuglevel = 'icap,network:stderr'
#debuglevel = 'ALL,-icap'
#debuglevel = 'ALL,-icap,-network'
# debugformat = 1
#pidfilename = '/tmp/e2guardian.pid'
#nodaemon = off
##!! Not compiled !!mailer = '/usr/sbin/sendmail -t'    
originalip = off
# contentscanexceptions = off
#mapportstoips = off
#mapauthtoports = off
# logheadervalue = 'proxy-authorization:'
#statlocation = ""  
#blockedcontentstore = ""  
#softrestart = off
#proxyfailureloginterval = 0
#scancleancache = true
#urlcachenumber = 0
#groupnamesfile = ''
#recheckreplacedurls = off - option does not work - may be removed in v5.5
# monitorhelper = '/usr/local/bin/mymonitor' - to remove in v5.5
# sitelist = 'name=banned,path=x...'
# urllist = 'name=banned,path=y...'
# sitelist = 'name=banned,path=x...'
# sitelist = 'name=banned,path=z...'

root@OpenWrt:~# grep " = " /etc/e2guardian/e2guardianf1.conf  
### Comment out .define.., and storyboard = lines below.
#groupname = 'my_name_for_group'
storyboard = '/etc/e2guardian/examplef1.story'   # comment out for production
naughtynesslimit = 130
sslmitm = on
# mitmcheckcert = on
sitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsitelist'
ipsitelist = 'name=nocheckcert,path=__LISTDIR__/nocheckcertsiteiplist'
automitm = on
sitelist = 'name=greyssl,path=__LISTDIR__/greysslsitelist'
ipsitelist = 'name=greyssl,path=__LISTDIR__/greysslsiteiplist'
sitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsitelist'
#ipsitelist = 'name=localgreyssl,path=__LISTDIR__/localgreysslsiteiplist'
#deepurlanalysis = off
# (on|off) default = off
sitelist = 'name=semiexception,messageno=602,path=__LISTDIR__/semiexceptionsitelist'
ipsitelist = 'name=semiexception,messageno=602,path=__LISTDIR__/semiexceptionsiteiplist'
sitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsitelist'
ipsitelist = 'name=exception,messageno=602,path=__LISTDIR__/exceptionsiteiplist'
urllist = 'name=exception,messageno=603,path=__LISTDIR__/exceptionurllist'
regexpboollist = 'name=exception,messageno=609,path=__LISTDIR__/exceptionregexpurllist'
sitelist = 'name=grey,path=__LISTDIR__/greysitelist'
ipsitelist = 'name=grey,path=__LISTDIR__/greysiteiplist'
urllist = 'name=grey,path=__LISTDIR__/greyurllist'
sitelist = 'name=banned,messageno=500,path=__LISTDIR__/bannedsitelist'
ipsitelist = 'name=banned,messageno=510,path=__LISTDIR__/bannedsiteiplist'
urllist = 'name=banned,messageno=501,path=__LISTDIR__/bannedurllist'
regexpboollist = 'name=banned,messageno=503,path=__LISTDIR__/bannedregexpurllist'
#sitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsitelist'
#ipsitelist = 'name=bannedssl,messageno=520,path=__LISTDIR__/bannedsslsiteiplist'
sitelist = 'name=localsemiexception,messageno=602,path=__LISTDIR__/localsemiexceptionsitelist'
ipsitelist = 'name=localsemiexception,messageno=602,path=__LISTDIR__/localsemiexceptionsiteiplist'
sitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsitelist'
ipsitelist = 'name=localexception,messageno=662,path=__LISTDIR__/localexceptionsiteiplist'
urllist = 'name=localexception,messageno=663,path=__LISTDIR__/localexceptionurllist'
sitelist = 'name=localgrey,path=__LISTDIR__/localgreysitelist'
ipsitelist = 'name=localgrey,path=__LISTDIR__/localgreysiteiplist'
urllist = 'name=localgrey,path=__LISTDIR__/localgreyurllist'
sitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsitelist'
ipsitelist = 'name=localbanned,messageno=560,path=__LISTDIR__/localbannedsiteiplist'
urllist = 'name=localbanned,messageno=561,path=__LISTDIR__/localbannedurllist'
#sitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsitelist'
#ipsitelist = 'name=localbannedssl,messageno=580,path=__LISTDIR__/localbannedsslsiteiplist'
#fileextlist = 'name=exceptionextension,path=__LISTDIR__/exceptionextensionlist'
#mimelist = 'name=exceptionmime,path=__LISTDIR__/exceptionmimetypelist'
fileextlist = 'name=bannedextension,messageno=900,path=__LISTDIR__/bannedextensionlist'
mimelist = 'name=bannedmime,messageno=800,path=__LISTDIR__/bannedmimetypelist'
sitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesitelist'
ipsitelist = 'name=exceptionfile,path=__LISTDIR__/exceptionfilesiteiplist'
urllist = 'name=exceptionfile,path=__LISTDIR__/exceptionfileurllist'
#timelist = 'name=blankettimes,messageno=122,path=__LISTDIR__/blankettimelist'
#sitelist = 'name=allowedtld,path=__LISTDIR__/allowedtldlist'
#sitelist = 'name=blanketblocktld,messageno=752,path=__LISTDIR__/blanketblocktldlist'
#timelist = 'name=bannedtimes,messageno=122,path=__LISTDIR__/bannedtimelist'
regexpboollist = 'name=banneduseragent,messageno=522,path=__LISTDIR__/bannedregexpuseragentlist'
regexpboollist = 'name=exceptionuseragent,messageno=610,path=__LISTDIR__/exceptionregexpuseragentlist'
sitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsitelist'
ipsitelist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionsiteiplist'
urllist = 'name=refererexception,messageno=620,path=__LISTDIR__/refererexceptionurllist'
sitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersitelist'
ipsitelist = 'name=embededreferer,path=__LISTDIR__/../common/embededreferersiteiplist'
urllist = 'name=embededreferer,path=__LISTDIR__/../common/embededrefererurllist'
regexpreplacelist = 'name=change,path=__LISTDIR__/urlregexplist'
regexpreplacelist = 'name=sslreplace,path=__LISTDIR__/sslsiteregexplist'
regexpreplacelist = 'name=redirect,path=__LISTDIR__/urlredirectregexplist'
#sitelist = 'name=log,path=__LISTDIR__/logsitelist'
#ipsitelist = 'name=log,path=__LISTDIR__/logsiteiplist'
#urllist = 'name=log,path=__LISTDIR__/logurllist'
#regexpboollist = 'name=log,path=__LISTDIR__/logregexpurllist'
#maxuploadsize = -1
# use higher (e.g. 512 = 512Kbytes) for limiting
#maxuploadsize = 512
#maxuploadsize = 0
sitelist = 'name=nolog,path=__LISTDIR__//../common/nologsitelist'
ipsitelist = 'name=nolog,path=__LISTDIR__//../common/nologsiteiplist'
urllist = 'name=nolog,path=__LISTDIR__//../common/nologurllist'
regexpboollist = 'name=nolog,path=__LISTDIR__//../common/nologregexpurllist'
fileextlist = 'name=nolog,path=__LISTDIR__//../common/nologextensionlist'
categorylist = 'name=alert,path=__LISTDIR__/alertcategorylist'
#weightedphrasemode = 0
# textmimetypes = 'application/xhtml+xml,application/xml,application/json,application/javascript,application/x
-javascript'
# stoptextmimetypes = 'text/javascript'
categorydisplaythreshold = 0
# -1 = display only the highest scoring category
# 0 = display all categories (default)
# > 0 = minimum score for a category to be displayed
bannedphraselist = '__LISTDIR__/bannedphraselist'
weightedphraselist = '__LISTDIR__/weightedphraselist'
exceptionphraselist = '__LISTDIR__/exceptionphraselist'
#bannedphraselist = '__LISTDIR__/oldbannedphraselist'
#weightedphraselist = '__LISTDIR__/oldweightedphraselist'
#exceptionphraselist = '__LISTDIR__/oldexceptionphraselist'
regexpreplacelist = 'name=searchterms,path=__LISTDIR__/../common/searchregexplist'
regexpboollist = 'name=searchtermexceptions, path=__LISTDIR__/../common/searchexceptionregexplist'
searchlist = 'name=banned,path=__LISTDIR__/bannedsearchlist'
searchlist = 'name=override,path=__LISTDIR__/bannedsearchoveridelist'
searchlist = 'name=localbanned,messageno=581,path=__LISTDIR__/localbannedsearchlist'
searchtermlimit = 3
#bannedsearchtermlist = '__LISTDIR__/bannedsearchtermlist'
#weightedsearchtermlist = '__LISTDIR__/weightedsearchtermlist'
#exceptionsearchtermlist = '__LISTDIR__/exceptionsearchtermlist'
#disablecontentscan = off
# (on|off) default = off.
#disablecontentscanerror = off
# (on|off) default = off. (default and highly recommended)
#contentscanexceptions = off
# (on|off) default = off
#mimelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusmimetypelist'
#fileextlist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusextensionlist'
#sitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussitelist'
#ipsitelist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirussiteiplist'
#urllist = 'name=exceptionvirus,path=__LISTDIR__/../contentscanners/exceptionvirusurllist'
#regexpboollist = 'name=trickleuseragent,path=/etc/e2guardian/lists/downloadmanagers/trickleregexpuseragentlis
t'
#mimelist = 'name=trickleallow,path=/etc/e2guardian/lists/downloadmanagers/tricklemimetypelist'
#fileextlist = 'name=trickleallow,path=/etc/e2guardian/lists/downloadmanagers/trickleexttypelist'
#regexpboollist = 'name=fancyuseragent,path=/etc/e2guardian/lists/downloadmanagers/fancyregexpuseragentlist'
#mimelist = 'name=fancyallow,path=/etc/e2guardian/lists/downloadmanagers/fancymimetypelist'
#fileextlist = 'name=fancyallow,path=/etc/e2guardian/lists/downloadmanagers/fancyexttypelist'
regexpreplacelist = 'name=headermods,path=__LISTDIR__/headerregexplist'
regexpboollist = 'name=bannedheader,path=__LISTDIR__/bannedregexpheaderlist'
regexpboollist = 'name=exceptionheader,path=__LISTDIR__/exceptionregexpheaderlist'
regexpreplacelist = 'name=addheader,path=__LISTDIR__/addheaderregexplist'
regexpreplacelist = 'name=responseheadermods,path=__LISTDIR__/responseheaderregexplist'
#reportinglevel = 3
# -1 = log, but do not block - Stealth mode
#  0 = just say 'Access Denied'
#  1 = report why but not what denied phrase
#  2 = report fully
#  3 = use HTML template file (accessdeniedaddress ignored) - recommended
#accessdeniedaddress = 'http://YOURSERVER.YOURDOMAIN/cgi-bin/e2guardian.pl'
#nonstandarddelimiter = off
#htmltemplate = 'custom.html'
#neterrtemplate = 'custom_neterr_template.html'  
bypass = 300
# 300 = enable for 5 minutes
# 0 = disable ( defaults to 0 )
bypassversion = 1
# cgibypass = 'off'
bypasskey = 'NotForKidsEyes'
# '' = generate a random one (recommended and default)
# 'Mary had a little lamb.' = an example
# '76b42abc1cd0fdcaf6e943dcbc93b826' = an example
cgikey = 'you must change this text in order to be secure'
sitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/domainsnobypass'
#ipsitelist = 'name=bannedbypass,messageno=500,path=__LISTDIR__/ipnobypass'
#urllist = 'name=bannedbypass,messageno=501,path=__LISTDIR__/urlnobypass'
#infectionbypass = 0
# 300 = enable for 5 minutes
# 0 = disable (default)
# cgiinfectionbypass = 'off'
#infectionbypasskey = ''
#infectionbypasserrorsonly = on
# on = enable (default and highly recommended)
# off = disable
##!! Not compiled !!usesmtp = off   #NOT YET TESTED
# default usesmtp = off
##!! Not compiled !!mailfrom = ''
# example: mailfrom = 'e2gua...@mycompany.com'
##!! Not compiled !!avadmin = ''
# example: avadmin = 'ad...@mycompany.com'
##!! Not compiled !!contentadmin = ''
# example: contentadmin = 'ad...@mycompany.com'
##!! Not compiled !!avsubject = 'e2guardian virus block'
# default avsubject = 'e2guardian virus block'
##!! Not compiled !!contentsubject = 'e2guardian violation'
# default contentsubject = 'e2guardian violation'
##!! Not compiled !!notifyav = off
##!! Not compiled !!notifycontent = off
##!! Not compiled !!thresholdbyuser = off
##!! Not compiled !!violations = 0
##!! Not compiled !!threshold = 0
# groupmode = 1 #DISABLED
# ssllegacylogic = off
#sslcertcheck = off - NOT implemented in V5 yet
# bannedregexwithblanketblock = off
#blockdownloads = off
#embeddedurlweight = 0
#onlymitmsslgrey = off  - ignored in V5
#contentregexplist = '__LISTDIR__/contentregexplist'


root@OpenWrt:~# cat /tmp/access.log  
2025.03.01 18:00:40             192.168.1.141   https://www.yahoo.com   *DENIED* Failed to negotiate ssl conne
ction to client         0       0       SSL SITE        1       403             192.168.1.141   group1       -
-
2025.03.01 18:00:40             192.168.1.141   https://www.yahoo.com   *DENIED* Failed to negotiate ssl conne
ction to client         0       0       SSL SITE        1       403             192.168.1.141   group1       -
-







e2guardian -N -d ALL:

1740870564 hw3: Found Header: Content-Security-Policy: frame-ancestors 'self' https://*.builtbygirls.com https
://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.techcrunch.com
https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.
com https://*.pnr.ouryahoo.com https://pnr.ouryahoo.com https://*.search.aol.com https://*.search.huffpost.com
https://*.onesearch.com https://*.verizonmedia.com https://*.publishing.oath.com https://cdn.taboola.com http
s://ads.taboola.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-s
andbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&
out():HTTPHeader.cpp:1672tivmg0j&partner=;
1740870564 hw9: ListCheck:localsemiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw3: Header written - pstdata_len:0 out():HTTPHeader.cpp:1715
1740870564 hw3: Returning from header:out  out():HTTPHeader.cpp:1730
1740870564 hw9: ListCheck:localexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: ListCheck:localgreyssl NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: ListCheck:localgrey NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: ListCheck:localbanned NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw3: who: - from: 192.168.1.141 doLog():ConnectionHandler.cpp:1420
1740870564 hw3:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw3: inURLList: www.yahoo.com/_nca/api/weather/all?lang=en-us&region=us&unit=f&appid=nca&woeid=1276
4690 inURLList():ListMeta.cpp:542
1740870564 hw3: inURLList (processed): www.yahoo.com/_nca/api/weather/all?lang=en-us&region=us&unit=f&appid=nc
a&woeid=12764690 inURLList():ListMeta.cpp:558
1740870564 hw9: ListCheck:semiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw3: ListCheck:nolog NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw3:  -Handling connections inside ssl tunnel: done goMITM():ConnectionHandler.cpp:2626
1740870564 hw3:  -Shutting down ssl to proxy goMITM():ConnectionHandler.cpp:2642
1740870564 hw9: ListCheck:exception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: HeaderCheck runFunct():StoryBoard.cpp:513
1740870564 hw9: ListCheck:exceptionuseragent NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: ListCheck:nocheckcert NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: ListCheck:sslreplace NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw9: After StoryB thttps-checkrequest isException: 0 mess_no 0 handleTHTTPSConnection():ConnectionH
andler.cpp:3302
1740870564 hw9: May_be_loop = 0  port 443 connectUpstream():ConnectionHandler.cpp:412
1740870564 hw9: Connecting to IP 69.147.82.60 port 443 connectUpstream():ConnectionHandler.cpp:518
1740870564 hw3:  -Shutting down ssl to client goMITM():ConnectionHandler.cpp:2645
1740870564 hw3: handle_peer returned: 0 handle_connections():FatController.cpp:390
1740870564 hw3:  waiting connection on http_worker_Q  handle_connections():FatController.cpp:374
1740870564 hw6: Got connection upfailure is 0 connectUpstream():ConnectionHandler.cpp:522
1740870564 hw6:  Start goMITM nf 0 upfail 0 goMITM():ConnectionHandler.cpp:2483
1740870564 hw6:  -Intercepting HTTPS connection goMITM():ConnectionHandler.cpp:2486
1740870564 hw6:  -Getting ssl certificate for client connection goMITM():ConnectionHandler.cpp:2504
1740870564 hw6: Generating serial no for ncp-gw-frontpage.media.yahoo.com getSerial():CertificateAuthority.cpp
:220
1740870564 hw6: Serial no is 7A8A6CD6437B0FD8D3AC1A6133F8E00F getSerial():CertificateAuthority.cpp:258
1740870564 hw6: looking for cert /tmp/generatedcerts//7A/8A/6C/D6437B0FD8D3AC1A6133F8E00F getServerCertificate
():CertificateAuthority.cpp:508
1740870564 hw6: Certificate found getServerCertificate():CertificateAuthority.cpp:514
1740870564 hw6:  -Going SSL on the peer connection goMITM():ConnectionHandler.cpp:2542
1740870564 hw6:  nf 0 upfail 0 goMITM():ConnectionHandler.cpp:2580
1740870564 hw6:  -Going SSL on upstream connection  goMITM():ConnectionHandler.cpp:2583
1740870564 hw9: Got connection upfailure is 0 connectUpstream():ConnectionHandler.cpp:522
1740870564 hw9:  Start goMITM nf 0 upfail 0 goMITM():ConnectionHandler.cpp:2483
1740870564 hw9:  -Intercepting HTTPS connection goMITM():ConnectionHandler.cpp:2486
1740870564 hw9:  -Getting ssl certificate for client connection goMITM():ConnectionHandler.cpp:2504
1740870564 hw9: Generating serial no for nexus-gateway-prod.media.yahoo.com getSerial():CertificateAuthority.c
pp:220
1740870564 hw9: Serial no is 0A120F291AFEA042E0535EB763B2028B getSerial():CertificateAuthority.cpp:258
1740870564 hw9: looking for cert /tmp/generatedcerts//0A/12/0F/291AFEA042E0535EB763B2028B getServerCertificate
():CertificateAuthority.cpp:508
1740870564 hw9: Certificate found getServerCertificate():CertificateAuthority.cpp:514
1740870564 hw9:  -Going SSL on the peer connection goMITM():ConnectionHandler.cpp:2542
1740870564 listen_2_thttps: 2: got connection from accept accept_connections():FatController.cpp:1231
1740870564 listen_2_thttps: 2: pushed connection to http_worker_Q accept_connections():FatController.cpp:1240
1740870564 hw8:  popped connection from http_worker_Q handle_connections():FatController.cpp:377
1740870564 hw8:  handleTHTTPSConnection():ConnectionHandler.cpp:3067
1740870564 hw8: decoding url decode():HTTPHeader.cpp:1413
1740870564 hw8:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw8: ListCheck:nomitm NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: inIPList  no match for 192.168.1.141 inIPList():ListContainer.cpp:2227
1740870564 hw8: ListCheck:bannedclient NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: inIPList  no match for 192.168.1.141 inIPList():ListContainer.cpp:2227
1740870564 hw8: ListCheck:exceptionclient NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:authexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8:  -Not got persistent credentials for this connection - querying auth plugins doAuth():Connecti
onHandler.cpp:2674
1740870564 hw8: Check StoryB thttps-checkrequest handleTHTTPSConnection():ConnectionHandler.cpp:3300
1740870564 hw8:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw8: ListCheck:localsemiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:localexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:localgreyssl NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:localgrey NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:localbanned NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:semiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:exception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: HeaderCheck runFunct():StoryBoard.cpp:513
1740870564 hw8: ListCheck:exceptionuseragent NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:nocheckcert NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: ListCheck:sslreplace NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw8: After StoryB thttps-checkrequest isException: 0 mess_no 0 handleTHTTPSConnection():ConnectionH
andler.cpp:3302
1740870564 hw8: May_be_loop = 0  port 443 connectUpstream():ConnectionHandler.cpp:412
1740870564 hw8: Connecting to IP 69.147.82.60 port 443 connectUpstream():ConnectionHandler.cpp:518
1740870564 hw9:  nf 0 upfail 0 goMITM():ConnectionHandler.cpp:2580
1740870564 hw9:  -Going SSL on upstream connection  goMITM():ConnectionHandler.cpp:2583
1740870564 listen_2_thttps: 2: got connection from accept accept_connections():FatController.cpp:1231
1740870564 listen_2_thttps: 2: pushed connection to http_worker_Q accept_connections():FatController.cpp:1240
1740870564 hw11:  popped connection from http_worker_Q handle_connections():FatController.cpp:377
1740870564 hw11:  handleTHTTPSConnection():ConnectionHandler.cpp:3067
1740870564 hw11: decoding url decode():HTTPHeader.cpp:1413
1740870564 hw11:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw11: ListCheck:nomitm NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: inIPList  no match for 192.168.1.141 inIPList():ListContainer.cpp:2227
1740870564 hw11: ListCheck:bannedclient NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: inIPList  no match for 192.168.1.141 inIPList():ListContainer.cpp:2227
1740870564 hw11: ListCheck:exceptionclient NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:authexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11:  -Not got persistent credentials for this connection - querying auth plugins doAuth():Connect
ionHandler.cpp:2674
1740870564 hw11: Check StoryB thttps-checkrequest handleTHTTPSConnection():ConnectionHandler.cpp:3300
1740870564 hw11:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw11: ListCheck:localsemiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:localexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:localgreyssl NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:localgrey NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:localbanned NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:semiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:exception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: HeaderCheck runFunct():StoryBoard.cpp:513
1740870564 hw11: ListCheck:exceptionuseragent NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:nocheckcert NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: ListCheck:sslreplace NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw11: After StoryB thttps-checkrequest isException: 0 mess_no 0 handleTHTTPSConnection():Connection
Handler.cpp:3302
1740870564 hw11: May_be_loop = 0  port 443 connectUpstream():ConnectionHandler.cpp:412
1740870564 hw11: Connecting to IP 69.147.82.60 port 443 connectUpstream():ConnectionHandler.cpp:518
1740870564 listen_2_thttps: 2: got connection from accept accept_connections():FatController.cpp:1231
1740870564 hw12:  popped connection from http_worker_Q handle_connections():FatController.cpp:377
1740870564 listen_2_thttps: 2: pushed connection to http_worker_Q accept_connections():FatController.cpp:1240
1740870564 hw12:  handleTHTTPSConnection():ConnectionHandler.cpp:3067
1740870564 hw5: firstime: header:in after getLine  in():HTTPHeader.cpp:1819
1740870564 hw5: header:size =  19 in():HTTPHeader.cpp:1891
in():HTTPHeader.cpp:1893e =  HTTP/1.1 200 OK
checkheader():HTTPHeader.cpp:951 client: content-type: application/json;charset=utf-8
checkheader():HTTPHeader.cpp:951 client: access-control-allow-origin: https://www.yahoo.com
checkheader():HTTPHeader.cpp:951 client: access-control-allow-credentials: true
checkheader():HTTPHeader.cpp:951 client: y-rid: 2s88m8ljs74t4,2s88m8ljs74t4
checkheader():HTTPHeader.cpp:951 client: x-yahoo-request-id: 2s88m8ljs74t4,2s88m8ljs74t4
1740870564 hw5: Header value from client: x-request-id: 7ebe6f2d-3ae0-4d63-aea8-08a5681f4221,7ebe6f2d-3ae0-4d6
checkheader():HTTPHeader.cpp:951
checkheader():HTTPHeader.cpp:951 client: vary: Accept-Encoding,Origin
checkheader():HTTPHeader.cpp:951 client: content-encoding: gzip
checkheader():HTTPHeader.cpp:951 client: x-envoy-upstream-service-time: 34
checkheader():HTTPHeader.cpp:951 client: date: Sat, 01 Mar 2025 23:09:24 GMT
checkheader():HTTPHeader.cpp:951 client: server: ATS
checkheader():HTTPHeader.cpp:951 client: Age: 0
checkheader():HTTPHeader.cpp:951 client: Transfer-Encoding: chunked
checkheader():HTTPHeader.cpp:951 client: Connection: keep-alive
checkheader():HTTPHeader.cpp:951 client: Strict-Transport-Security: max-age=31536000
checkheader():HTTPHeader.cpp:951 client: Referrer-Policy: no-referrer-when-downgrade
checkheader():HTTPHeader.cpp:951 client: X-Content-Type-Options: nosniff
checkheader():HTTPHeader.cpp:951 client: X-XSS-Protection: 1; mode=block
1740870564 hw5: CheckHeader: HTTP/1.1 detected checkheader():HTTPHeader.cpp:958
1740870564 hw5: CheckHeader flags before normalisation:  AP=1 PPC=1 1.1=1 connectionclose=0 CL=0 checkheader()
:HTTPHeader.cpp:1008
1740870564 hw5: CheckHeader flags after normalisation:  AP=1 WP=0 checkheader():HTTPHeader.cpp:1034
1740870564 hw5: isProxyRequest is 0 in():HTTPHeader.cpp:1897
1740870564 hw5:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw5: HeaderCheck runFunct():StoryBoard.cpp:513
1740870564 hw5: inURLList: ncp-gw-frontpage.media.yahoo.com/api/v1/gql/stream_view?count=5&id=main-stream&name
space=creators&snippetcount=5&thumbnailimagesizes=74x74%7c2%7c95&version=v1 inURLList():ListMeta.cpp:542
1740870564 hw5: inURLList (processed): ncp-gw-frontpage.media.yahoo.com/api/v1/gql/stream_view?count=5&id=main
-stream&namespace=creators&snippetcount=5&thumbnailimagesizes=74x74|2|95&version=v1 inURLList():ListMeta.cpp:5
58
1740870564 hw5: ListCheck:exceptionfile NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: decoding url decode():HTTPHeader.cpp:1413
1740870564 hw12:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw5: ListCheck:bannedmime NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:nomitm NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw5: mime type: application/json isContentType():HTTPHeader.cpp:219
1740870564 hw5: mimes result : false ! isContentType():HTTPHeader.cpp:241
1740870564 hw5: mime type: application/json isContentType():HTTPHeader.cpp:219
1740870564 hw5: mimes result : false ! isContentType():HTTPHeader.cpp:241
1740870564 hw5: End content check isitNaughty is  0 check_content():ConnectionHandler.cpp:2980
1740870564 hw12: inIPList  no match for 192.168.1.141 inIPList():ListContainer.cpp:2227
1740870564 hw5: response headerout:HTTP/1.1 200 OK
out():HTTPHeader.cpp:1623
1740870564 hw12: ListCheck:bannedclient NOT FOUND runFunct():StoryBoard.cpp:584
timeout:61000 out():HTTPHeader.cpp:1658 200 OK
1740870564 hw12: inIPList  no match for 192.168.1.141 inIPList():ListContainer.cpp:2227
out():HTTPHeader.cpp:1672er: content-type: application/json;charset=utf-8
1740870564 hw12: ListCheck:exceptionclient NOT FOUND runFunct():StoryBoard.cpp:584
out():HTTPHeader.cpp:1672er: access-control-allow-origin: https://www.yahoo.com
out():HTTPHeader.cpp:1672er: access-control-allow-credentials: true
out():HTTPHeader.cpp:1672er: y-rid: 2s88m8ljs74t4,2s88m8ljs74t4
out():HTTPHeader.cpp:1672er: x-yahoo-request-id: 2s88m8ljs74t4,2s88m8ljs74t4
1740870564 hw5: Found Header: x-request-id: 7ebe6f2d-3ae0-4d63-aea8-08a5681f4221,7ebe6f2d-3ae0-4d63-aea8-08a56
out():HTTPHeader.cpp:1672
1740870564 hw12: ListCheck:authexception NOT FOUND runFunct():StoryBoard.cpp:584
out():HTTPHeader.cpp:1672er: vary: Accept-Encoding,Origin
out():HTTPHeader.cpp:1672er: content-encoding: gzip
1740870564 hw12:  -Not got persistent credentials for this connection - querying auth plugins doAuth():Connect
ionHandler.cpp:2674
out():HTTPHeader.cpp:1672er: x-envoy-upstream-service-time: 34
out():HTTPHeader.cpp:1672er: date: Sat, 01 Mar 2025 23:09:24 GMT
1740870564 hw12: Check StoryB thttps-checkrequest handleTHTTPSConnection():ConnectionHandler.cpp:3300
out():HTTPHeader.cpp:16721740870564 hw12:  runFunctEntry():StoryBoard.cpp:880

out():HTTPHeader.cpp:1672er: Age: 0
out():HTTPHeader.cpp:1672er: Transfer-Encoding: chunked
out():HTTPHeader.cpp:1672er: Connection: keep-alive
out():HTTPHeader.cpp:1672er: Strict-Transport-Security: max-age=31536000
out():HTTPHeader.cpp:1672er: Referrer-Policy: no-referrer-when-downgrade
out():HTTPHeader.cpp:1672er: X-Content-Type-Options: nosniff
out():HTTPHeader.cpp:1672er: X-XSS-Protection: 1; mode=block
1740870564 hw12: ListCheck:localsemiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:localexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:localgreyssl NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw5: Header written - pstdata_len:0 out():HTTPHeader.cpp:1715
1740870564 hw5: Returning from header:out  out():HTTPHeader.cpp:1730
1740870564 hw12: ListCheck:localgrey NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:localbanned NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:semiexception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:exception NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: HeaderCheck runFunct():StoryBoard.cpp:513
1740870564 hw12: ListCheck:exceptionuseragent NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:nocheckcert NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: ListCheck:sslreplace NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw12: After StoryB thttps-checkrequest isException: 0 mess_no 0 handleTHTTPSConnection():Connection
Handler.cpp:3302
1740870564 hw12: May_be_loop = 0  port 443 connectUpstream():ConnectionHandler.cpp:412
1740870564 hw12: Connecting to IP 67.195.204.151 port 443 connectUpstream():ConnectionHandler.cpp:518
1740870564 hw1: firstime: header:in after getLine  in():HTTPHeader.cpp:1819
1740870564 hw1: header:size =  19 in():HTTPHeader.cpp:1891
in():HTTPHeader.cpp:1893e =  HTTP/1.1 200 OK
checkheader():HTTPHeader.cpp:951 client: content-type: application/json;charset=utf-8
checkheader():HTTPHeader.cpp:951 client: access-control-allow-origin: https://www.yahoo.com
checkheader():HTTPHeader.cpp:951 client: access-control-allow-credentials: true
checkheader():HTTPHeader.cpp:951 client: y-rid: 5gdcjb5js74t4,5gdcjb5js74t4
checkheader():HTTPHeader.cpp:951 client: x-yahoo-request-id: 5gdcjb5js74t4,5gdcjb5js74t4
1740870564 hw1: Header value from client: x-request-id: 4b0b2070-779c-4c23-8c00-4fa6ea2e65a1,4b0b2070-779c-4c2
checkheader():HTTPHeader.cpp:951
checkheader():HTTPHeader.cpp:951 client: vary: Accept-Encoding,Origin
checkheader():HTTPHeader.cpp:951 client: content-encoding: gzip
checkheader():HTTPHeader.cpp:902h: 1196
1740870564 hw1: tp =1196 Contentlen.int =1196 checkheader():HTTPHeader.cpp:909
checkheader():HTTPHeader.cpp:951 client: content-length: 1196
checkheader():HTTPHeader.cpp:951 client: x-envoy-upstream-service-time: 33
checkheader():HTTPHeader.cpp:951 client: date: Sat, 01 Mar 2025 23:09:24 GMT
checkheader():HTTPHeader.cpp:951 client: server: ATS
checkheader():HTTPHeader.cpp:951 client: Age: 0
checkheader():HTTPHeader.cpp:951 client: Connection: keep-alive
checkheader():HTTPHeader.cpp:951 client: Strict-Transport-Security: max-age=31536000
checkheader():HTTPHeader.cpp:951 client: Referrer-Policy: no-referrer-when-downgrade
checkheader():HTTPHeader.cpp:951 client: X-Content-Type-Options: nosniff
checkheader():HTTPHeader.cpp:951 client: X-XSS-Protection: 1; mode=block
1740870564 hw1: CheckHeader: HTTP/1.1 detected checkheader():HTTPHeader.cpp:958
1740870564 hw1: CheckHeader flags before normalisation:  AP=1 PPC=1 1.1=1 connectionclose=0 CL=1 checkheader()
:HTTPHeader.cpp:1008
1740870564 hw1: CheckHeader flags after normalisation:  AP=1 WP=1 checkheader():HTTPHeader.cpp:1034
1740870564 hw1: isProxyRequest is 0 in():HTTPHeader.cpp:1897
1740870564 hw1:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw1: HeaderCheck runFunct():StoryBoard.cpp:513
1740870564 hw1: inURLList: ncp-gw-frontpage.media.yahoo.com/api/v1/gql/stream_view?count=1&id=ntk-assetlist-st
ream&listid=446fc51c-cca1-4680-9ead-1317388a7654&namespace=media&site=news&version=v1 inURLList():ListMeta.cpp
:542
1740870564 hw1: inURLList (processed): ncp-gw-frontpage.media.yahoo.com/api/v1/gql/stream_view?count=1&id=ntk-
assetlist-stream&listid=446fc51c-cca1-4680-9ead-1317388a7654&namespace=media&site=news&version=v1 inURLList():
ListMeta.cpp:558
1740870564 hw1: ListCheck:exceptionfile NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw1: ListCheck:bannedmime NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw1: mime type: application/json isContentType():HTTPHeader.cpp:219
1740870564 hw1: mimes result : false ! isContentType():HTTPHeader.cpp:241
1740870564 hw1: mime type: application/json isContentType():HTTPHeader.cpp:219
1740870564 hw1: mimes result : false ! isContentType():HTTPHeader.cpp:241
1740870564 hw1: End content check isitNaughty is  0 check_content():ConnectionHandler.cpp:2980
1740870564 hw1: response headerout:HTTP/1.1 200 OK
out():HTTPHeader.cpp:1623
timeout:61000 out():HTTPHeader.cpp:1658 200 OK
out():HTTPHeader.cpp:1672er: content-type: application/json;charset=utf-8
out():HTTPHeader.cpp:1672er: access-control-allow-origin: https://www.yahoo.com
out():HTTPHeader.cpp:1672er: access-control-allow-credentials: true
out():HTTPHeader.cpp:1672er: y-rid: 5gdcjb5js74t4,5gdcjb5js74t4
out():HTTPHeader.cpp:1672er: x-yahoo-request-id: 5gdcjb5js74t4,5gdcjb5js74t4
1740870564 hw1: Found Header: x-request-id: 4b0b2070-779c-4c23-8c00-4fa6ea2e65a1,4b0b2070-779c-4c23-8c00-4fa6e
out():HTTPHeader.cpp:1672
out():HTTPHeader.cpp:1672er: vary: Accept-Encoding,Origin
out():HTTPHeader.cpp:1672er: content-encoding: gzip
out():HTTPHeader.cpp:1672er: content-length: 1196
out():HTTPHeader.cpp:1672er: x-envoy-upstream-service-time: 33
out():HTTPHeader.cpp:1672er: date: Sat, 01 Mar 2025 23:09:24 GMT
out():HTTPHeader.cpp:1672er: server: ATS
out():HTTPHeader.cpp:1672er: Age: 0
out():HTTPHeader.cpp:1672er: Connection: keep-alive
out():HTTPHeader.cpp:1672er: Strict-Transport-Security: max-age=31536000
out():HTTPHeader.cpp:1672er: Referrer-Policy: no-referrer-when-downgrade
out():HTTPHeader.cpp:1672er: X-Content-Type-Options: nosniff
out():HTTPHeader.cpp:1672er: X-XSS-Protection: 1; mode=block
1740870564 hw1: Header written - pstdata_len:0 out():HTTPHeader.cpp:1715
1740870564 hw1: Returning from header:out  out():HTTPHeader.cpp:1730
1740870564 hw1: who: - from: 192.168.1.141 doLog():ConnectionHandler.cpp:1420
1740870564 hw1:  runFunctEntry():StoryBoard.cpp:880
1740870564 hw1: inURLList: ncp-gw-frontpage.media.yahoo.com/api/v1/gql/stream_view?count=1&id=ntk-assetlist-st
ream&listid=446fc51c-cca1-4680-9ead-1317388a7654&namespace=media&site=news&version=v1 inURLList():ListMeta.cpp
:542
1740870564 hw1: inURLList (processed): ncp-gw-frontpage.media.yahoo.com/api/v1/gql/stream_view?count=1&id=ntk-
assetlist-stream&listid=446fc51c-cca1-4680-9ead-1317388a7654&namespace=media&site=news&version=v1 inURLList():
ListMeta.cpp:558
1740870564 hw1: ListCheck:nolog NOT FOUND runFunct():StoryBoard.cpp:584
1740870564 hw1: Start of request header:in in():HTTPHeader.cpp:1796
1740870564 hw1: header:in before getLine - timeout:55000 in():HTTPHeader.cpp:1817
1740870564 hw6: Adding hostname to check:ncp-gw-frontpage.media.yahoo.com: startSslClient():Socket.cpp:353
Segmentation fault


[   64.133066] traps: e2guardian[1911] general protection fault ip:7f9ffc8183a3 sp:7f9ffbb7c868 error:0 in lib
c.so[7f9ffc80c000+4c000]
[  585.098419] e2guardian[4728]: segfault at 3b8 ip 00007f67418bafd0 sp 00007f6740f1d668 error 4 in libssl.so.
3[7f67418a9000+5a000]
[  585.099921] Code: ea 00 00 00 eb be 48 63 c2 90 49 c7 04 c7 00 00 00 00 41 c6 04 06 00 48 83 c0 01 39 04 24
7f ea e9 6d ff ff ff 0f 1f 44 00 00 <48> 8b bf b8 01 00 00 ff 25 7b f6 06 00 0f 1f 00 48 8b bf d8 04 00



strace e2guardian

1740870881 hw29: ListCheck:exceptionfile NOT FOUND runFunct():StoryBoard.cpp:584
1740870881 hw29: ListCheck:bannedmime NOT FOUND runFunct():StoryBoard.cpp:584
1740870881 hw29: mime type: application/json isContentType():HTTPHeader.cpp:219
1740870881 hw29: mimes result : false ! isContentType():HTTPHeader.cpp:241
1740870881 hw29: mime type: application/json isContentType():HTTPHeader.cpp:219
1740870881 hw29: mimes result : false ! isContentType():HTTPHeader.cpp:241
1740870881 hw29: End content check isitNaughty is  0 check_content():ConnectionHandler.cpp:2980
1740870881 hw29: response headerout:HTTP/1.1 200 OK
out():HTTPHeader.cpp:1623
timeout:61000 out():HTTPHeader.cpp:16581 200 OK
1740870881 hw29: Found Header: x-amz-id-2: zln+TpjGYIaUKaWdESdU6rI3IJoGALdOSPjP41128k3VaxLhoXg4hd+aZzHfkSORdhw
out():HTTPHeader.cpp:1672
out():HTTPHeader.cpp:1672der: x-amz-request-id: RTXDDMWYK7C2V6RQ
out():HTTPHeader.cpp:1672der: Date: Sat, 01 Mar 2025 22:48:15 GMT
out():HTTPHeader.cpp:1672der: Access-Control-Allow-Origin: *
out():HTTPHeader.cpp:1672der: Access-Control-Allow-Methods: GET, HEAD
out():HTTPHeader.cpp:1672der: Access-Control-Expose-Headers: Access-Control-Allow-Origin
out():HTTPHeader.cpp:1672der: Access-Control-Max-Age: 3000
1740870881 hw35:  -Going SSL on the peer connection goMITM():ConnectionHandler.cpp:2542
1740870881 hw29: Found Header: Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Ac
out():HTTPHeader.cpp:1672
out():HTTPHeader.cpp:1672der: Last-Modified: Fri, 28 Feb 2025 16:16:22 GMT
out():HTTPHeader.cpp:1672der: x-amz-server-side-encryption: AES256
out():HTTPHeader.cpp:1672der: Cache-Control: public,max-age=1800
out():HTTPHeader.cpp:1672der: Accept-Ranges: bytes
out():HTTPHeader.cpp:1672der: Content-Type: application/json
out():HTTPHeader.cpp:1672der: Server: ATS
out():HTTPHeader.cpp:1672der: Referrer-Policy: no-referrer-when-downgrade
out():HTTPHeader.cpp:1672der: Etag: "d9a9d64eac302d5a938d9c9fa60dfd94-df"
out():HTTPHeader.cpp:1672der: Age: 1587
out():HTTPHeader.cpp:1672der: ATS-Carp-Promotion: 1
out():HTTPHeader.cpp:1672der: Content-Encoding: gzip
out():HTTPHeader.cpp:1672der: Content-Length: 4303
out():HTTPHeader.cpp:1672der: Connection: keep-alive
out():HTTPHeader.cpp:1672der: Strict-Transport-Security: max-age=31536000
out():HTTPHeader.cpp:1672der: ATS-Carp-Promotion: 1
1740870881 hw29: Header written - pstdata_len:0 out():HTTPHeader.cpp:1715
1740870881 hw29: Returning from header:out  out():HTTPHeader.cpp:1730
1740870881 hw29: inURLList: s.yimg.com/eh/prebid-config/fp-us-desktop.json inURLList():ListMeta.cpp:542
1740870881 hw29: inURLList (processed): s.yimg.com/eh/prebid-config/fp-us-desktop.json inURLList():ListMeta.cp
p:558
1740870881 hw29: ListCheck:nolog NOT FOUND runFunct():StoryBoard.cpp:584
1740870881 hw29: Start of request header:in in():HTTPHeader.cpp:1796
1740870881 hw29: header:in before getLine - timeout:55000 in():HTTPHeader.cpp:1817
1740870881 hw29: firstime: header:in after getLine  in():HTTPHeader.cpp:1819
1740870881 hw29: firstime: header:in after getLine: rc: 0 truncated: 1 in():HTTPHeader.cpp:1822
1740870881 hw29:  -Handling connections inside ssl tunnel: done goMITM():ConnectionHandler.cpp:2626
1740870881 hw29:  -Shutting down ssl to proxy goMITM():ConnectionHandler.cpp:2642
1740870881 hw29:  -Shutting down ssl to client goMITM():ConnectionHandler.cpp:2645
<unfinished ...>) = ?
+++ killed by SIGSEGV +++
Segmentation fault


this happens on openwrt 22 & 23.  I tried to compile in 24 but openwrt outmodes libpcre so i didn't test with it.

It happens with many versions of 5.4.x, 5.5.x and 5.6.


Hopefully this excerts are help, please let me know if you need anything else to figure this out.

Thanks,


Reply all
Reply to author
Forward
0 new messages