To: feedback@ml.delegate.org
Date: Mon Jul 21 21:10:43 JST 2014
Subject: DeleGate/9.9.10 (STABLE) -- fixes around chained HTTP and HTTPS proxy
From: feedback@delegate.org (Yutaka Sato)
Reply-To: feedback@delegate.org
Organization: The DeleGate Project
Message-Id: <1JpFTo.feedback@delegate.org>
References: <_A5062@delegate-en.ML_> <_A5063@delegate-en.ML_>
        <_A5084@delegate-en.ML_> <_A5089@delegate-en.ML_>

DeleGate/9.9.10 STABLE is released including a fix to enable a HTTP-
DeleGate proxy, chained to upstream proxy, can forward non-HTTP
protocols (HTTPS/SSL, FTP, NNTP, etc) as well as HTTP.

HTTP (proxy chaining for multiple protocols)
  - Fixed relaying arbitrary protocols to upstream HTTP proxy (in HTTP
    protocol).
    DeleGate as an HTTP proxy can be chained to upstream HTTP proxy(ies)
    with the PROXY (or FORWARD) parameter(s).  With the PROXY
    parameter, it forward any protocol to the specified upstream proxy.
    But, unfortunately, since 9.9.8-pre21 (released Jan. 2013), only HTTP
    protocol is relayed in HTTP protocol, while other protocols
    were relayed in the DeleGate-specific protocol. Thus if the upstream
    proxy is not DeleGate, the relay fails.
  - A workaround in older versions to escape the problem is using not
    PROXY but FORWARD like FORWARD="http-proxy://Host:Port"

HTTPS (SSL-tunneling with non-SSL blocker)
  - Disabled non-half-duplex communication blocker over SSL-tunnel by
    default.  (It can be enabled with HTTPCONF="halfdup")
  - Relaxed the threshold for non-SSL detection and blocking, not to
    break normal SSL communications with long latency.
    The default has become HTTPCONF="tout-pack-intvl:10.0" (which was
    "3.0" seconds in older versions).
  - Excluded several HTTPS server domains (google and facebook) from
    the subjects of non-SSL blocker.  It is equivalent to
    CMAP="thru-CONNECT:HTTPCONF:https:*.google.com,*.facebook.com".
  - In older versions, especially when DeleGate as a HTTPS proxy is
    chained to the upstream proxy, the blocker can be so bad that makes
    connection to HTTPS server, for example Google Mail, frozen at the
    start.
  - This blocker can be bypassed totally by the "-Dst" option in any
    version of DeleGate.

SOCKS (core dump with CONNECT=socks option)
  - It hits a stale area on the stack to cause segmentation violation
    where both FORWARD=socks://host:port and CONNECT=socks is specified.
    The situation occurs after secondary SOCKS connection.

yysh (remote login shell of DeleGate)
  - Re-enabled the yysh server on Windows which was disabled in
    9.9.7-pre23 (Feb. 2010) due to the bug in the the supplementary
    program for Windows, "dgforkpty.exe".
  - Periodic sending of packets toward the yysh server to keep the
    connection alive.  A connection of yysh has been dropped often after
    no communication over it for several minutes.  It was so bad
    especially when logging into a remote host on a cloud service.
  - The interval of keep-alive packets can be specified with -tiT
    opther where T is 60 (seconds) by default.

SSL/Cygwin (dynamic linking of SSL libraries)
  - Made Cygwin version DeleGate use dynamic library of SSL for Cygwin
    named as "cygXXX.dll".
  - It is equivalent to specifying DYLIB="cyg%s-0.9.8.dll,+"
  - Cygwin version of DeleGate and SSL libraries is necessary for "yysh",
    the remote login shell of DeleGate, with STLS=fsv or "-ys" option.

Cheers from Japan,
Yutaka
--
  9 9   Yutaka Sato { Do the more with the less -- B. Fuller }
 ( ~ )  National Institute of Advanced Industrial Science and Technology
_<   >_ 1-1-4 Umezono, Tsukuba, Ibaraki, 305-8568 Japan
