make html formatting compatible with .md

doc/html/faqe.html

@@ -1,2 +1,2 @@
 
-<H2><A href="howtoe.html">See HowTo:</a></H2>
+<H2><A href="howtoe.html">See HowTo:</a></h2>

doc/html/faqr.html

@@ -1,2 +1,2 @@
 
-<H2><A href="howtoe.html">См. HowTo</a></H2>
+<H2><A href="howtoe.html">См. HowTo</a></h2>

doc/html/highload.html

@@ -123,7 +123,7 @@ persistent in <tt>/etc/sysctl.d/</tt>. Defaults given in parentheses are from a
 <p><b>File descriptors.</b> 3proxy needs 2 descriptors per connection (4 for FTP), plus
 one per service, plus temporary ones for name resolution and RADIUS.
 <pre>
-fs.nr_open = 1048576          # (1048576) upper bound for any process' RLIMIT_NOFILE
+fs.nr_open = 1048576          &#35; (1048576) upper bound for any process' RLIMIT_NOFILE
 </pre>
 <tt>ulimit -n</tt> (RLIMIT_NOFILE) is the limit that actually applies and is commonly
 left at 1024; it must be raised for the 3proxy process itself, see "Setting ulimits"
@@ -134,9 +134,9 @@ changing.
 reached earlier with 3proxy than with event-driven servers. Each thread also consumes
 one or two mappings, so <tt>vm.max_map_count</tt> matters too.
 <pre>
-kernel.threads-max = 200000   # (~60000 on a 16G host, scales with RAM)
+kernel.threads-max = 200000   &#35; (~60000 on a 16G host, scales with RAM)
-kernel.pid_max = 4194304      # (4194304)
+kernel.pid_max = 4194304      &#35; (4194304)
-vm.max_map_count = 1048576    # (1048576)
+vm.max_map_count = 1048576    &#35; (1048576)
 </pre>
 RLIMIT_NPROC (<tt>ulimit -u</tt>) limits threads per user and must be raised as well.
 Check the actual thread count with <tt>grep Threads /proc/PID/status</tt>.
@@ -145,28 +145,28 @@ Check the actual thread count with <tt>grep Threads /proc/PID/status</tt>.
 'backlog' command is given, so a large 'maxconn' does not automatically give a large
 queue, and the kernel caps it at somaxconn:
 <pre>
-net.core.somaxconn = 4096          # (4096)
+net.core.somaxconn = 4096          &#35; (4096)
-net.ipv4.tcp_max_syn_backlog = 4096 # (512) raise for bursty connection rates
+net.ipv4.tcp_max_syn_backlog = 4096 &#35; (512) raise for bursty connection rates
-net.ipv4.tcp_syncookies = 1        # (1) keep enabled
+net.ipv4.tcp_syncookies = 1        &#35; (1) keep enabled
 </pre>
 
 <p><b>Ephemeral ports and TIME_WAIT.</b> See "Extending the Ephemeral Port Range" above
 for the multi-IP case. The range gives about 28000 outgoing connections per
 destination address by default:
 <pre>
-net.ipv4.ip_local_port_range = 10240 65535   # (32768 60999)
+net.ipv4.ip_local_port_range = 10240 65535   &#35; (32768 60999)
-net.ipv4.tcp_tw_reuse = 2                    # (2) reuse TIME_WAIT for outgoing connections
+net.ipv4.tcp_tw_reuse = 2                    &#35; (2) reuse TIME_WAIT for outgoing connections
-net.ipv4.tcp_fin_timeout = 30                # (60)
+net.ipv4.tcp_fin_timeout = 30                &#35; (60)
 </pre>
 Do not enable tcp_tw_recycle; it was removed in kernel 4.12 and breaks NAT clients.
 
 <p><b>Socket buffers.</b> Autotuning is usually right. Buffer memory is per connection,
 so raising the maximums with tens of thousands of connections costs a lot of RAM:
 <pre>
-net.core.rmem_max = 4194304     # (212992)
+net.core.rmem_max = 4194304     &#35; (212992)
-net.core.wmem_max = 4194304     # (212992)
+net.core.wmem_max = 4194304     &#35; (212992)
-net.ipv4.tcp_rmem = 4096 131072 6291456   # (same) min default max
+net.ipv4.tcp_rmem = 4096 131072 6291456   &#35; (same) min default max
-net.ipv4.tcp_wmem = 4096 16384 4194304    # (same)
+net.ipv4.tcp_wmem = 4096 16384 4194304    &#35; (same)
 </pre>
 Raise these only for high bandwidth-delay product links, and prefer raising the third
 (max) value and leaving the default alone.
@@ -177,8 +177,8 @@ it does, the table is exhausted long before 3proxy's own limits, with
 <pre>
 net.netfilter.nf_conntrack_max = 1048576
 net.netfilter.nf_conntrack_buckets = 262144
-net.netfilter.nf_conntrack_tcp_timeout_established = 3600   # (432000, i.e. 5 days)
+net.netfilter.nf_conntrack_tcp_timeout_established = 3600   &#35; (432000, i.e. 5 days)
-net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30       # (120)
+net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30       &#35; (120)
 </pre>
 nf_conntrack_max defaults to nf_conntrack_buckets, which itself is derived from the
 amount of RAM, so it is often much lower than expected on small machines. Each

doc/html/howtoe.html

@@ -2,20 +2,20 @@
  <li>3APA3A 3proxy Tiny Proxy Server HowTo
  <br>Under construction, very incomplete
  <ul>
-	<li><A HREF="#COMPILE">Compilation</A>
+ <li><A HREF="#COMPILE">Compilation</a>
  <ul>
-		<li><A HREF="#MSVC">How to compile 3proxy with Visual C++</A>
+ <li><A HREF="#MSVC">How to compile 3proxy with Visual C++</a>
-		<li><A HREF="#CMAKE">How to compile 3proxy with CMake</A>
+ <li><A HREF="#CMAKE">How to compile 3proxy with CMake</a>
-		<li><A HREF="#GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A>
+ <li><A HREF="#GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</a>
  </ul>
-	<li><A HREF="#INSTALL">Proxy server installation and removal</A>
+ <li><A HREF="#INSTALL">Proxy server installation and removal</a>
  <ul>
-		<li><A HREF="#INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</A>
+ <li><A HREF="#INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</a>
-		<li><A HREF="#INSTUNIX">How to install/remove 3proxy under Unix/Linux</A>
+ <li><A HREF="#INSTUNIX">How to install/remove 3proxy under Unix/Linux</a>
-		<li><A HREF="#INSTMACOS">How to install/remove 3proxy under macOS</A>
+ <li><A HREF="#INSTMACOS">How to install/remove 3proxy under macOS</a>
-		<li><A HREF="#INSTDOCKER">How to use 3proxy with Docker</A>
+ <li><A HREF="#INSTDOCKER">How to use 3proxy with Docker</a>
  </ul>
-	<li><A HREF="#SERVER">Server configuration</A>
+ <li><A HREF="#SERVER">Server configuration</a>
  <ul>
  <li><a href="#NOTHING">How to make 3proxy start</a></li>
  <li><a href="#LIMITS">How to make limitations (access, bandwidth, traffic, connections) work</a></li>
@@ -24,11 +24,11 @@
  <li><a href="#ODBC">How to make ODBC logging work?</a></li>
  <li><a href="#IPV6">How to make IPv6 work</a></li>
  <li><a href="#CRASH">How to fix 3proxy crashes</a></li>
-  		<li><A HREF="#SAMPLE">Where to find a configuration example</A>
+ <li><A HREF="#SAMPLE">Where to find a configuration example</a>
-		<li><A HREF="#LOGGING">How to set up logging</A>
+ <li><A HREF="#LOGGING">How to set up logging</a>
-		<li><A HREF="#LOGFORMAT">How to set up logging format</A>
+ <li><A HREF="#LOGFORMAT">How to set up logging format</a>
-		<li><A HREF="#LOGANALIZERS">How to use log analyzers with 3proxy</A>
+ <li><A HREF="#LOGANALIZERS">How to use log analyzers with 3proxy</a>
-		<li><A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</A>
+ <li><A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</a>
  <li><a href="#BIND">How to bind a service to a specific interface or port</a>
  <li><a href="#NAMES">How to resolve names through a parent proxy</a></li>
  <li><a href="#ISFTP">How to set up an FTP proxy</a></li>
@@ -37,39 +37,39 @@
  <li><a href="#SSLPLUGIN">How to set up TLS/SSL (https proxy, mTLS)</a></li>
  <li><a href="#CERTIFICATES">How to create CA and certificates for SSL</a></li>
  <li><a href="#PCRE">How to use PCRE filtering (regular expressions)</a></li>
-		<li><A HREF="#AUTH">How to limit service access</A>
+ <li><A HREF="#AUTH">How to limit service access</a>
-		<li><A HREF="#USERS">How to create a user list</A>
+ <li><A HREF="#USERS">How to create a user list</a>
-		<li><A HREF="#ACL">How to limit user access to resources</A>
+ <li><A HREF="#ACL">How to limit user access to resources</a>
-		<li><A HREF="#REDIR">How to manage redirections</A>
+ <li><A HREF="#REDIR">How to manage redirections</a>
  <li><a href="#SOCKSREDIR">How to manage local redirections</a>
-		<li><A HREF="#ROUNDROBIN">How to balance traffic between multiple external channels?</A>
+ <li><A HREF="#ROUNDROBIN">How to balance traffic between multiple external channels?</a>
-		<li><A HREF="#CHAIN">How to manage proxy chains</A>
+ <li><A HREF="#CHAIN">How to manage proxy chains</a>
-		<li><A HREF="#BANDLIM">How to limit bandwidth</A>
+ <li><A HREF="#BANDLIM">How to limit bandwidth</a>
-		<li><A HREF="#TRAFLIM">How to limit traffic amount</A>
+ <li><A HREF="#TRAFLIM">How to limit traffic amount</a>
  <li><a href="#TRAF">How to fix incorrect traffic accounting</a>
-		<li><A HREF="#NETLIST">How to build network lists</A>
+ <li><A HREF="#NETLIST">How to build network lists</a>
  <li><a href="#NSCACHING">How to configure name resolution and DNS caching</a>
  <li><a href="#IPV6">How to use IPv6</a>
  <li><a href="#CONNBACK">How to use connect back</a>
  <li><a href="#HAPROXY">How to use HAProxy PROXY protocol</a>
  <li><a href="#MAXSEG">How to set TCP maximum segment size (MSS)</a>
  </ul>
-	<li><A HREF="#CLIENT">Client configuration</A>
+ <li><A HREF="#CLIENT">Client configuration</a>
-	<li><A HREF="#ADMIN">Administering and information analysis</A>
+ <li><A HREF="#ADMIN">Administering and information analysis</a>
  <ul>
-		<li><A HREF="#NEWVERSION">How to obtain the latest 3proxy version</A>
+ <li><A HREF="#NEWVERSION">How to obtain the latest 3proxy version</a>
-		<li><A HREF="#NTSERVICE">How to control the 3proxy service under Windows NT/2000/XP</A>
+ <li><A HREF="#NTSERVICE">How to control the 3proxy service under Windows NT/2000/XP</a>
-		<li><A HREF="#ERRORS">Log error codes reference</A>
+ <li><A HREF="#ERRORS">Log error codes reference</a>
  </ul>
-	<li><A HREF="#QUEST">How to ask a question not in How To?</A>
+ <li><A HREF="#QUEST">How to ask a question not in How To?</a>
  </ul>
 <br>
  <ul>
 <hr>
-	<li><A NAME="COMPILE">Compilation</A>
+ <li><A NAME="COMPILE">Compilation</a>
 <p>
  <ul>
-		<li><A NAME="MSVC">How to compile 3proxy with Visual C++</A>
+ <li><A NAME="MSVC">How to compile 3proxy with Visual C++</a>
 <p>
 Extract source code files from 3proxy.tgz (with WinZip or another utility) or use git.
 
@@ -78,7 +78,7 @@ nmake /f Makefile.msvc
 </pre>
 Binaries will be placed in the <code>bin/</code> directory.
 </p>
-		<li><A NAME="CMAKE">How to compile 3proxy with CMake</A>
+ <li><A NAME="CMAKE">How to compile 3proxy with CMake</a>
 <p>
 CMake provides a cross-platform build system. It works on Windows (MSVC, MinGW), Linux, macOS, and BSD.
 <br>Basic build steps:
@@ -100,7 +100,7 @@ cmake -D3PROXY_USE_OPENSSL=ON -D3PROXY_USE_PCRE2=ON ..
 Available options: 3PROXY_USE_OPENSSL, 3PROXY_USE_PCRE2, 3PROXY_USE_PAM, 3PROXY_USE_ODBC.
 <br>Binaries will be placed in the <code>build/bin/</code> directory.
 </p>
-		<li><A NAME="GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</A></li>
+ <li><A NAME="GCCUNIX">How to compile 3proxy with GCC under Unix/Linux</a></li>
 <p>
 For Linux, use:
 <pre>
@@ -121,14 +121,14 @@ and add the ODBC library to the linker variable.
 </p>
  </ul>
 <hr>
-	<li><A NAME="INSTALL">Proxy server installation and removal</A>
+ <li><A NAME="INSTALL">Proxy server installation and removal</a>
 <p>
  <ul>
-		<li><A NAME="INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</A>
+ <li><A NAME="INSTNT">How to install/remove 3proxy under Windows NT/2000/XP</a>
 <p>
 Unpack 3proxy.zip to any directory, for example
 c:\Program Files\3proxy. If needed, create a directory for storing log files,
-ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (see <A HREF="#SERVER">Server configuration</A>).
+ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (see <A HREF="#SERVER">Server configuration</a>).
 Now, start a command prompt (cmd.exe).
 Change to the 3proxy installation directory and run 3proxy.exe --install:
 <pre>
@@ -148,10 +148,10 @@ C:\Program Files\3proxy>3proxy.exe --remove
 </pre>
 Now you can simply remove the 3proxy installation directory.
 </p>
-		<li><A NAME="INSTUNIX">How to install/remove 3proxy under Unix/Linux</A>
+ <li><A NAME="INSTUNIX">How to install/remove 3proxy under Unix/Linux</a>
 <p>
 <b>Using Makefile:</b>
-<br>Compile 3proxy (see <A HREF="#COMPILE">Compilation</A>) then run:
+<br>Compile 3proxy (see <A HREF="#COMPILE">Compilation</a>) then run:
 <pre>
 sudo make install
 </pre>
@@ -186,7 +186,7 @@ sudo systemctl enable 3proxy
 sudo systemctl start 3proxy
 </pre>
 </p>
-		<li><A NAME="INSTMACOS">How to install/remove 3proxy under macOS</A>
+ <li><A NAME="INSTMACOS">How to install/remove 3proxy under macOS</a>
 <p>
 <b>Using CMake (recommended):</b>
 <pre>
@@ -216,22 +216,22 @@ This installs binaries to <code>/usr/local/3proxy/bin/</code> and configuration
 <b>Service management with launchd:</b>
 <br>After installation via cmake, the service can be managed with launchctl:
 <pre>
-# Load and start the service
+&#35; Load and start the service
 sudo launchctl load /Library/LaunchDaemons/org.3proxy.3proxy.plist
 
-# Stop the service
+&#35; Stop the service
 sudo launchctl stop org.3proxy.3proxy
 
-# Start the service
+&#35; Start the service
 sudo launchctl start org.3proxy.3proxy
 
-# Unload and disable the service
+&#35; Unload and disable the service
 sudo launchctl unload /Library/LaunchDaemons/org.3proxy.3proxy.plist
 </pre>
 The service runs as user <code>proxy</code> (created during installation).
 Configuration file: <code>/etc/3proxy/3proxy.cfg</code>
 </p>
-		<li><A NAME="INSTDOCKER">How to use 3proxy with Docker</A>
+ <li><A NAME="INSTDOCKER">How to use 3proxy with Docker</a>
 <p>
 <b>Using pre-built images from GitHub Container Registry:</b>
 <pre>
@@ -264,7 +264,7 @@ For non-chroot execution, mount config to <code>/etc/3proxy</code>.
 </p>
  </ul>
 <hr>
-	<li><A NAME="SERVER">Server configuration</A>
+ <li><A NAME="SERVER">Server configuration</a>
 <p>
  <ul>
  <li><a name="NOTHING">How to make 3proxy start</a>
@@ -293,7 +293,7 @@ location as 3proxy.exe). For an alternative configuration file location, use
 
 </ul>
 
-<p><A NAME="INTEXT">How to understand internal and external</A>
+<p><A NAME="INTEXT">How to understand internal and external</a>
 <p>
 Both internal and external IPs are IPs of the host running 3proxy itself.
 This configuration option is useful in situations where 3proxy is running on a
@@ -344,15 +344,15 @@ The best solution is to enable the option to resolve hostnames via the proxy on
  The problem can be resolved with the 'stacksize' command or '-S' option starting with 3proxy 0.8.4.
 
 
-		<li><A NAME="SAMPLE">Where to find a configuration example</A>
+ <li><A NAME="SAMPLE">Where to find a configuration example</a>
 <p>
 A server configuration example, 3proxy.cfg.sample, is included in every 3proxy distribution.
 </p>
-		<li><A NAME="LOGGING">How to set up logging</A>
+ <li><A NAME="LOGGING">How to set up logging</a>
 <p>
 3proxy can log to stdout, a file, an ODBC datasource, or
 syslog (Unix/Linux/Cygwin only). To use ODBC under Unix/Linux, you must
-compile 3proxy with Unix ODBC libraries; see <A HREF="#COMPILE">Compilation</A>.
+compile 3proxy with Unix ODBC libraries; see <A HREF="#COMPILE">Compilation</a>.
 You can control logging from 3proxy.cfg for all services, or you can control
 logging for an individual service. For example,
 /usr/local/sbin/socks -l/var/log/socks.log starts a SOCKS proxy with logging to a file.
@@ -379,14 +379,14 @@ specify an ident for syslog logging. If the filename within the "log" command co
 log c:\3proxy\logs\%y%m%d.log D creates a file like c:\3proxy\logs\060729.log;
 the date is generated based on local time.
 <pre>
-	log &connstring
+ log &connstring;
 </pre>
 
 specifies an ODBC connection string; connstring is in the format
 datasource,username,password (the last two are optional if the
 datasource does not require or already has authentication information).
 Also, you must specify logformat to build the SQL query to insert a record into
-the log; see <A HREF="#LOGFORMAT">How to set up logging format</A>
+the log; see <A HREF="#LOGFORMAT">How to set up logging format</a>
 </p>
 <p>
 Rotation and archiving may be set up with log, rotate, and archiver commands.
@@ -416,7 +416,7 @@ sets the rotation type. LOGTYPE may be:
  Examples are located in
  3proxy.cfg.sample
 </p>
-		<li><A NAME="LOGFORMAT">How to set up logging format</A>
+ <li><A NAME="LOGFORMAT">How to set up logging format</a>
 <p>
  Since version 0.3, the log format may be set with the "logformat" command.
  The first symbol of the log format specifies the format of the date and time and
@@ -437,7 +437,7 @@ sets the rotation type. LOGTYPE may be:
 <li>  %U - Username ('-' if unknown).
 <li>  %N - Service name (PROXY, SOCKS, POP3P, etc.)
 <li>  %p - Service port
-<li>	 %E - Error code (see <A HREF="#ERRORS">Log error codes reference</A>)
+<li>  %E - Error code (see <A HREF="#ERRORS">Log error codes reference</a>)
 <li>  %C - client IP
 <li>  %c - client port
 <li>  %R - target IP
@@ -449,7 +449,7 @@ sets the rotation type. LOGTYPE may be:
 <li>  %O - bytes sent to the target
 <li>  %n - hostname from the request
 <li>  %h - hops before the target (if redirection or chaining is used);
-	 see <A HREF="#CHAIN">How to use chains and parent proxies</A>)
+ see <A HREF="#CHAIN">How to use chains and parent proxies</a>)
 <li>  %T - service-specific text (for example, the requested URL). %X-YT,
  where X and Y are positive numbers, only displays fields
  (space-delimited) X to Y of the text. An example is %1-2T.
@@ -472,7 +472,7 @@ logformat "-\'+_GINSERT INTO proxystat  VALUES (%t, '%c', '%U', %I)"</pre>
 <br>(no line breaks)
 <br>-\'+_ instructs to replace characters \ and ' with _
 </p>
-		<li><A NAME="LOGANALIZERS">How to use log analyzers with 3proxy</A>
+ <li><A NAME="LOGANALIZERS">How to use log analyzers with 3proxy</a>
 <p>
 Just make the format of 3proxy logs compatible with a format supported by your
 favorite log analyzer. Examples of compatible logformats are:
@@ -515,7 +515,7 @@ or a more compatible format without the error code:
 <p><font face="courier">
 &quot;-&quot;&quot;+_L%C - %U [%d/%o/%Y:%H:%M:%S %z] &quot;&quot;%T&quot;&quot; 200 %I&quot;
 </p>
-		<li><A NAME="LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</A>
+ <li><A NAME="LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</a>
 <p>
 3proxy is distributed in 2 variants: as a set of standalone modules (proxy,
 socks, pop3p, tcppm, udppm) and as a universal proxy server. These services are
@@ -552,7 +552,7 @@ except socks, which is started with port 3129.
 All logs are in the file /var/log/3proxy.log (with daily date modification and
 rotation). The 30 most recent files are stored.
 </p>
-		<li><A NAME="BIND">How to bind a service to a specific interface and port?</A>
+ <li><A NAME="BIND">How to bind a service to a specific interface and port?</a>
 <p>
 The -i option specifies the internal interface; -p specifies the listening port. No spaces are
 allowed. To bind the 'proxy' service to port 8080 on interfaces 192.168.1.1
@@ -606,17 +606,17 @@ tlspr supports both: for implicit TLS the destination host is taken from SNI and
 the -X option makes tlspr speak the plaintext protocol phase with the client (greeting, STARTTLS command) before
 upgrading both sides to TLS. Example:
 </p><pre>
-# https (implicit)
+&#35; https (implicit)
 tlspr -p443 -P443 -c1
-# imaps (implicit)
+&#35; imaps (implicit)
 tlspr -p993 -P993 -c1
-# submissions (implicit)
+&#35; submissions (implicit)
 tlspr -p465 -P465 -c1
-# imap STARTTLS (explicit)
+&#35; imap STARTTLS (explicit)
 tlspr -p143 -P143 -Ximap
-# submission STARTTLS (explicit)
+&#35; submission STARTTLS (explicit)
 tlspr -p587 -P587 -Xsmtp
-# pop3 STLS (explicit)
+&#35; pop3 STLS (explicit)
 tlspr -p110 -P110 -Xpop3
 </pre>
 <p>
@@ -705,15 +705,15 @@ nscache 65536
 nscache6 65536
 dnspr -p53
 
-# google
+&#35; google
 nsrecord smtp.gmail.com 10.0.0.1
 nsrecord imap.gmail.com 10.0.0.1
 nsrecord pop.gmail.com 10.0.0.1
-# mail.ru
+&#35; mail.ru
 nsrecord smtp.mail.ru 10.0.0.1
 nsrecord imap.mail.ru 10.0.0.1
 nsrecord pop.mail.ru 10.0.0.1
-# yandex.ru
+&#35; yandex.ru
 nsrecord smtp.yandex.ru 10.0.0.1
 nsrecord imap.yandex.ru 10.0.0.1
 nsrecord pop.yandex.ru 10.0.0.1
@@ -825,10 +825,10 @@ This creates an HTTPS proxy (ssl_serv) that accepts TLS connections from clients
 <b>Creating a Certificate Authority (CA):</b>
 <br>For MITM or mTLS, you need a CA. Generate a CA private key and certificate:
 </p><pre>
-# Generate CA private key
+&#35; Generate CA private key
 openssl genrsa -out ca.key 4096
 
-# Generate CA certificate (valid for 10 years)
+&#35; Generate CA certificate (valid for 10 years)
 openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
     -subj "/C=US/ST=State/L=City/O=MyOrg/CN=My CA" \
     -out ca.crt
@@ -840,15 +840,15 @@ For MITM, import ca.crt into client browsers/OS as a trusted root CA.
 <b>Creating a server certificate for https:// proxy:</b>
 <br>The server certificate must have proper Subject Alternative Names (SAN):
 </p><pre>
-# Generate server private key
+&#35; Generate server private key
 openssl genrsa -out server.key 2048
 
-# Create a certificate signing request (CSR)
+&#35; Create a certificate signing request (CSR)
 openssl req -new -key server.key \
     -subj "/C=US/ST=State/L=City/O=MyOrg/CN=proxy.example.com" \
     -out server.csr
 
-# Create extensions file for SAN
+&#35; Create extensions file for SAN
 cat > server.ext << 'EOF'
 authorityKeyIdentifier=keyid,issuer
 basicConstraints=CA:FALSE
@@ -862,7 +862,7 @@ DNS.2 = proxy
 IP.1 = 192.168.1.100
 EOF
 
-# Sign the certificate with CA
+&#35; Sign the certificate with CA
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 \
     -extfile server.ext
@@ -873,27 +873,27 @@ For a public https:// proxy, use a CA like Let's Encrypt instead of self-signed.
 <p>
 <b>Creating a client certificate for mTLS:</b>
 </p><pre>
-# Generate client private key
+&#35; Generate client private key
 openssl genrsa -out client1.key 2048
 
-# Create CSR
+&#35; Create CSR
 openssl req -new -key client1.key \
     -subj "/C=US/ST=State/L=City/O=MyOrg/CN=client1" \
     -out client1.csr
 
-# Create extensions file
+&#35; Create extensions file
 cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment
 extendedKeyUsage = clientAuth
 EOF
 
-# Sign with CA
+&#35; Sign with CA
 openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out client1.crt -days 365 -sha256 \
     -extfile client.ext
 
-# Create PKCS#12 bundle for browser import
+&#35; Create PKCS&#35;12 bundle for browser import
 openssl pkcs12 -export -out client1.p12 \
     -inkey client1.key -in client1.crt -certfile ca.crt
 </pre>
@@ -903,15 +903,15 @@ Import client1.p12 into the client browser or OS certificate store.
 <p>
 <b>Quick setup script for development/testing:</b>
 </p><pre>
-#!/bin/sh
+&#35;!/bin/sh
-# Creates CA, server, and client certificates for SSLPlugin testing
+&#35; Creates CA, server, and client certificates for SSLPlugin testing
 
-# CA
+&#35; CA
 openssl genrsa -out ca.key 4096
 openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
     -subj "/CN=3proxy CA" -out ca.crt
 
-# Server
+&#35; Server
 openssl genrsa -out server.key 2048
 openssl req -new -key server.key -subj "/CN=localhost" -out server.csr
 cat > server.ext << 'EOF'
@@ -923,7 +923,7 @@ EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
 
-# Client
+&#35; Client
 openssl genrsa -out client.key 2048
 openssl req -new -key client.key -subj "/CN=client" -out client.csr
 cat > client.ext << 'EOF'
@@ -980,13 +980,13 @@ matches the connection data.
 <p>
 <b>Examples:</b>
 </p><pre>
-# Block requests containing specific keywords for certain users
+&#35; Block requests containing specific keywords for certain users
 pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16
 
-# Block responses with specific content type
+&#35; Block responses with specific content type
 pcre srvheader deny "Content-type: application"
 
-# Replace content in both directions (censorship)
+&#35; Replace content in both directions (censorship)
 pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser
 pcre_extend deny * 192.168.0.1/16
 </pre>
@@ -994,11 +994,11 @@ pcre_extend deny * 192.168.0.1/16
 <b>Note:</b> Regular expressions don't require authentication and cannot replace
 authentication and/or allow/deny ACLs.
 </p>
-		<li><A NAME="AUTH">How to limit service access</A>
+ <li><A NAME="AUTH">How to limit service access</a>
 <p>
 First, always specify the internal interface to accept incoming connections with the
 'internal' configuration command or '-i' service command. (See
-<A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</A>). If
+<A HREF="#LAUNCH">How to start any of the proxy services (HTTP, SOCKS, etc.)</a>). If
 no internal interface is specified, your proxy will act as an open proxy.
 <p>It's also important to specify the external interface to prevent access to the
 internal network with 'external' or -e.
@@ -1040,7 +1040,7 @@ socks
 
 It's possible to authorize access by client IP address, IP address or requested resource,
 target port, time, etc., after authentication.
-(See <A HREF="#ACL">How to limit resource access</A>).
+(See <A HREF="#ACL">How to limit resource access</a>).
 </p><p>Since version 0.6, double authentication is possible, e.g.:
 <pre>
 auth iponly strong
@@ -1079,7 +1079,7 @@ critical resources, such as web administration.
   auth cache strong</pre>
  the user will not be able to use more than a single IP during the cache time (120 sec).
  </p>
-		<li><A NAME="USERS">How to create a user list</A>
+ <li><A NAME="USERS">How to create a user list</a>
 <p>
 The user list is created with the 'users' command.
 <pre>
@@ -1118,7 +1118,7 @@ It's possible to create NT and crypt passwords with the 3proxy_crypt utility inc
 in the distribution.
 <br>The user list is system-wide. To manage user access to a specific service, use ACLs.
 </p>
-		<li><A NAME="ACL">How to limit user access to resources</A>
+ <li><A NAME="ACL">How to limit user access to resources</a>
 <p>
 The commands allow, deny, and flush are used to manage ACLs:
 <p><font face="courier">
@@ -1130,7 +1130,7 @@ allow &lt;userlist&gt; &lt;sourcelist&gt; &lt;targetlist&gt; &lt;targetportlist&
 The 'flush' command is used to finish with the existing ACL and start a new one.
 It's required to have different ACLs for different services.
 'allow' is used to allow a connection, and 'deny' to deny a connection. The 'allow'
-command can be extended by the 'parent' command to manage redirections (see <A href="#REDIR">How to manage redirections</A>). If the ACL
+command can be extended by the 'parent' command to manage redirections (see <A href="#REDIR">How to manage redirections</a>). If the ACL
 is empty, it allows everything. If the ACL is not empty, the first matching ACL entry
 is searched for the user request, and the ACL action (allow or deny) is performed. If
 no matching record is found, the connection is denied, and the user will be asked to
@@ -1178,7 +1178,7 @@ add 'deny *' to the end of the list.
 * in an ACL means &quot;any&quot;.
 Usage examples can be found in 3proxy.cfg.sample.
 </p>
-		<li><A NAME="REDIR">How to manage redirections</A>
+ <li><A NAME="REDIR">How to manage redirections</a>
 <p>
 Redirections are useful to, e.g., forward requests from specific clients
 to different servers or proxy servers. Additionally, redirections are useful
@@ -1237,22 +1237,22 @@ auth iponly
 allow * * * 80,8080-8088
 parent 1000 http 0.0.0.0 0
 allow * * * 80,8080-8088
-#redirect ports 80 and 8080-8088 to local HTTP proxy
+&#35;redirect ports 80 and 8080-8088 to local HTTP proxy
-#Second allow is required, because ACLs are checked
+&#35;Second allow is required, because ACLs are checked
-#twice: first time by socks and second by http proxy.
+&#35;twice: first time by socks and second by http proxy.
 
 allow * * * 21,2121
 parent 1000 ftp 0.0.0.0 0
 allow * * * 21,2121
-#redirect ports 21 and 2121 to local
+&#35;redirect ports 21 and 2121 to local
-#ftp proxy
+&#35;ftp proxy
 
 
 allow *
-#allow the rest of connections directly
+&#35;allow the rest of connections directly
 
 socks
-#now let the socks server start
+&#35;now let the socks server start
 </pre>
 
 <p><i>Q: How does it affect different ACL rules?</i></p>
@@ -1260,20 +1260,20 @@ A: After local redirections, rules are applied again to the protocol-level reque
 <pre>
 allow * * * 80,8080-8088
 parent 1000 http 0.0.0.0 0
-#redirect http traffic to internal proxy
+&#35;redirect http traffic to internal proxy
 
 allow * * $c:\3proxy\local.nets 80,8080-8088
-#allow direct access to local.nets networks
+&#35;allow direct access to local.nets networks
 allow * * * 80,8080-8088
 parent 1000 http proxy.3proxy.org 3128
-#use parent caching proxy for the rest of the networks
+&#35;use parent caching proxy for the rest of the networks
 
 allow *
-#allow direct connections for the rest of socks
+&#35;allow direct connections for the rest of socks
-#requests
+&#35;requests
 </pre>
 
-		<li><A NAME="ROUNDROBIN">How to balance traffic between multiple external channels?</A>
+ <li><A NAME="ROUNDROBIN">How to balance traffic between multiple external channels?</a>
 <p>
 The proxy itself doesn't manage network-level routing. The only way to control
 the outgoing channel is to select the external interface. It's possible to make
@@ -1302,7 +1302,7 @@ for Windows:
 If you don't have a second address yet, just add it. Under Linux/Unix, it's better
 to use source routing.
 </p>
-		<li><A NAME="CHAIN">How to manage proxy chains</A>
+ <li><A NAME="CHAIN">How to manage proxy chains</a>
 <p>
 The parent command may also be used to build proxy chains. In this case,
 multiple 'parent' commands are used for a single 'allow' rule with different
@@ -1338,7 +1338,7 @@ the second hop is 192.168.20.1, and the 3rd one is either 192.168.30.1 with a pr
 of 30% or 192.168.40.1 with a probability of 70%.
 </p>
 
-		<li><A NAME="BANDLIM">How to limit bandwidth</A>
+ <li><A NAME="BANDLIM">How to limit bandwidth</a>
 <p>
 3proxy supports bandwidth filters. Use the bandlimin/bandlimout and
 nobandlimin/nobandlimout commands to manage filters. 'in' means incoming and 'out' means outgoing traffic.
@@ -1368,7 +1368,7 @@ In this example:
 mail traffic from POP3 servers bypasses the pipe and has no bandwidth
 limitation.
 </p>
-		<li><A NAME="TRAFLIM">How to limit traffic amount</A>
+ <li><A NAME="TRAFLIM">How to limit traffic amount</a>
 <p>
 <p><font face="courier">
 counter &lt;filename&gt; &lt;type&gt; &lt;reportpath&gt;
@@ -1502,21 +1502,21 @@ proxy -p3128 -OcTCP_NODELAY,TCP_MAXSEG -OsTCP_NODELAY,TCP_MAXSEG
  </ul>
 
 <hr>
-	<li><A NAME="CLIENT">Client configuration</A>
+ <li><A NAME="CLIENT">Client configuration</a>
 <p>
 <hr>
-	<li><A NAME="ADMIN">Administering and information analysis</A>
+ <li><A NAME="ADMIN">Administering and information analysis</a>
 <p>
  <ul>
-		<li><A NAME="NEWVERSION">How to obtain latest 3proxy version</A>
+ <li><A NAME="NEWVERSION">How to obtain latest 3proxy version</a>
 <p>
 The latest version of 3proxy may be obtained
-<A HREF="https://3proxy.org/">here</A>.
+<A HREF="https://3proxy.org/">here</a>.
 A new version may have changes and incompatibilities with the previous one in file
 formats or commands. Please read the CHANGELOG file and other documentation
 before installing a new version.
 </p>
-		<li><A NAME="NTSERVICE">How to control 3proxy service under Windows NT/2000/XP</A>
+ <li><A NAME="NTSERVICE">How to control 3proxy service under Windows NT/2000/XP</a>
 <p>
 If installed as a system service, 3proxy understands Windows service commands
 for START, STOP, PAUSE, and RESUME. If the service is PAUSEd, no new connections
@@ -1532,7 +1532,7 @@ You can control the 3proxy service via "Services" administration or via the "net
  net continue 3proxy
 </pre>
 </p>
-		<li><A NAME="ERRORS">Log error codes reference</A>
+ <li><A NAME="ERRORS">Log error codes reference</a>
 <p>
  <ul>
  <li>0 - Operation successfully completed (connection
@@ -1595,9 +1595,9 @@ You can control the 3proxy service via "Services" administration or via the "net
 </p>
  </ul>
 <hr>
-	<li><A NAME="QUEST">How to ask a question not in How To?</A>
+ <li><A NAME="QUEST">How to ask a question not in How To?</a>
 <p>
-	Ask it in <A HREF="https://github.com/z3APA3A/3proxy/issues">Github</A>.
+ Ask it in <A HREF="https://github.com/z3APA3A/3proxy/issues">Github</a>.
  Please read this document before asking a question.
  </ul>
 

doc/html/howtor.html

@@ -210,16 +210,16 @@
  <b>Управление службой через launchd:</b>
  <br>После установки через cmake службой можно управлять с помощью launchctl:
   <pre>
-  # Загрузить и запустить службу
+  &#35; Загрузить и запустить службу
   sudo launchctl load /Library/LaunchDaemons/org.3proxy.3proxy.plist
 
-  # Остановить службу
+  &#35; Остановить службу
   sudo launchctl stop org.3proxy.3proxy
 
-  # Запустить службу
+  &#35; Запустить службу
   sudo launchctl start org.3proxy.3proxy
 
-  # Выгрузить и отключить службу
+  &#35; Выгрузить и отключить службу
   sudo launchctl unload /Library/LaunchDaemons/org.3proxy.3proxy.plist</pre>
  Служба запускается от имени пользователя <code>proxy</code> (создаётся при установке).
  Файл конфигурации: <code>/etc/3proxy/3proxy.cfg</code>
@@ -388,7 +388,7 @@
   -l@ident</pre>
  соответствуют ведению журнала через syslog с идентификатором ident.
   <pre>
-  log &connstring</pre>
+  log &connstring;</pre>
  соответствует ведению журнала через ODBC, connstring задается в формате
  datasource,username,password (последние два параметра опциональны, если
  datasource не требует или уже содержит сведения для авторизации). При этом
@@ -614,17 +614,17 @@ tlspr поддерживает оба варианта: для implicit TLS хо
 опция -X заставляет tlspr говорить с клиентом на plaintext-фазе протокола (приветствие, команда STARTTLS) перед
 поднятием TLS с обеих сторон. Пример:
 </p><pre>
-# https (implicit)
+&#35; https (implicit)
 tlspr -p443 -P443 -c1
-# imaps (implicit)
+&#35; imaps (implicit)
 tlspr -p993 -P993 -c1
-# submissions (implicit)
+&#35; submissions (implicit)
 tlspr -p465 -P465 -c1
-# imap STARTTLS (explicit)
+&#35; imap STARTTLS (explicit)
 tlspr -p143 -P143 -Ximap
-# submission STARTTLS (explicit)
+&#35; submission STARTTLS (explicit)
 tlspr -p587 -P587 -Xsmtp
-# pop3 STLS (explicit)
+&#35; pop3 STLS (explicit)
 tlspr -p110 -P110 -Xpop3
 </pre>
 <p>
@@ -714,15 +714,15 @@ nscache 65536
 nscache6 65536
 dnspr -p53
 
-# google
+&#35; google
 nsrecord smtp.gmail.com 10.0.0.1
 nsrecord imap.gmail.com 10.0.0.1
 nsrecord pop.gmail.com 10.0.0.1
-# mail.ru
+&#35; mail.ru
 nsrecord smtp.mail.ru 10.0.0.1
 nsrecord imap.mail.ru 10.0.0.1
 nsrecord pop.mail.ru 10.0.0.1
-# yandex.ru
+&#35; yandex.ru
 nsrecord smtp.yandex.ru 10.0.0.1
 nsrecord imap.yandex.ru 10.0.0.1
 nsrecord pop.yandex.ru 10.0.0.1
@@ -835,10 +835,10 @@ ssl_nocli
 <b>Создание удостоверяющего центра (CA):</b>
 <br>Для MITM или mTLS требуется CA. Сгенерируйте закрытый ключ CA и сертификат:
 </p><pre>
-# Генерация закрытого ключа CA
+&#35; Генерация закрытого ключа CA
 openssl genrsa -out ca.key 4096
 
-# Генерация сертификата CA (действителен 10 лет)
+&#35; Генерация сертификата CA (действителен 10 лет)
 openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
     -subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=My CA" \
     -out ca.crt
@@ -850,15 +850,15 @@ openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
 <b>Создание серверного сертификата для https:// прокси:</b>
 <br>Серверный сертификат должен иметь правильные альтернативные имена (SAN):
 </p><pre>
-# Генерация закрытого ключа сервера
+&#35; Генерация закрытого ключа сервера
 openssl genrsa -out server.key 2048
 
-# Создание запроса на подпись сертификата (CSR)
+&#35; Создание запроса на подпись сертификата (CSR)
 openssl req -new -key server.key \
     -subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=proxy.example.com" \
     -out server.csr
 
-# Создание файла расширений для SAN
+&#35; Создание файла расширений для SAN
 cat > server.ext << 'EOF'
 authorityKeyIdentifier=keyid,issuer
 basicConstraints=CA:FALSE
@@ -872,7 +872,7 @@ DNS.2 = proxy
 IP.1 = 192.168.1.100
 EOF
 
-# Подписание сертификата CA
+&#35; Подписание сертификата CA
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 \
     -extfile server.ext
@@ -883,27 +883,27 @@ openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
 <p>
 <b>Создание клиентского сертификата для mTLS:</b>
 </p><pre>
-# Генерация закрытого ключа клиента
+&#35; Генерация закрытого ключа клиента
 openssl genrsa -out client1.key 2048
 
-# Создание CSR
+&#35; Создание CSR
 openssl req -new -key client1.key \
     -subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=client1" \
     -out client1.csr
 
-# Создание файла расширений
+&#35; Создание файла расширений
 cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment
 extendedKeyUsage = clientAuth
 EOF
 
-# Подписание CA
+&#35; Подписание CA
 openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out client1.crt -days 365 -sha256 \
     -extfile client.ext
 
-# Создание PKCS#12 для импорта в браузер
+&#35; Создание PKCS&#35;12 для импорта в браузер
 openssl pkcs12 -export -out client1.p12 \
     -inkey client1.key -in client1.crt -certfile ca.crt
 </pre>
@@ -913,15 +913,15 @@ openssl pkcs12 -export -out client1.p12 \
 <p>
 <b>Скрипт быстрой настройки для разработки/тестирования:</b>
 </p><pre>
-#!/bin/sh
+&#35;!/bin/sh
-# Создаёт CA, серверный и клиентский сертификаты для тестирования SSLPlugin
+&#35; Создаёт CA, серверный и клиентский сертификаты для тестирования SSLPlugin
 
-# CA
+&#35; CA
 openssl genrsa -out ca.key 4096
 openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
     -subj "/CN=3proxy CA" -out ca.crt
 
-# Сервер
+&#35; Сервер
 openssl genrsa -out server.key 2048
 openssl req -new -key server.key -subj "/CN=localhost" -out server.csr
 cat > server.ext << 'EOF'
@@ -933,7 +933,7 @@ EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
 
-# Клиент
+&#35; Клиент
 openssl genrsa -out client.key 2048
 openssl req -new -key client.key -subj "/CN=client" -out client.csr
 cat > client.ext << 'EOF'
@@ -991,13 +991,13 @@ IP назначения, порты и т.д.), аналогичный кома
 <p>
 <b>Примеры:</b>
 </p><pre>
-# Блокировать запросы с определёнными ключевыми словами для некоторых пользователей
+&#35; Блокировать запросы с определёнными ключевыми словами для некоторых пользователей
 pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16
 
-# Блокировать ответы с определённым content-type
+&#35; Блокировать ответы с определённым content-type
 pcre srvheader deny "Content-type: application"
 
-# Замена содержимого в обоих направлениях (цензура)
+&#35; Замена содержимого в обоих направлениях (цензура)
 pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser
 pcre_extend deny * 192.168.0.1/16
 </pre>
@@ -1268,16 +1268,16 @@ pcre_extend deny * 192.168.0.1/16
   allow * * * 80,8080-8088
   parent 1000 http 0.0.0.0 0
   allow * * * 80,8080-8088
-  #перенаправить соединения по портам 80 и 8080-8088 в локальный
+  &#35;перенаправить соединения по портам 80 и 8080-8088 в локальный
-  #http прокси. Вторая команда allow необходима, т.к. контроль доступа
+  &#35;http прокси. Вторая команда allow необходима, т.к. контроль доступа
-  #осуществляется 2 раза - на уровне socks и на уровне HTTP прокси
+  &#35;осуществляется 2 раза - на уровне socks и на уровне HTTP прокси
   allow * * * 21,2121
   parent 1000 ftp 0.0.0.0 0
   allow * * * 21,2121
-  #перенаправить соединения по портам 21 и 2121 в локальный
+  &#35;перенаправить соединения по портам 21 и 2121 в локальный
-  #ftp прокси
+  &#35;ftp прокси
   allow *
-  #пустить все соединения напрямую
+  &#35;пустить все соединения напрямую
   socks</pre>
  </p>
  <li><a name="REDIINTER"><i>Q: Как взаимодействует с другими правилами в ACL?</i></a></li>
@@ -1292,14 +1292,14 @@ pcre_extend deny * 192.168.0.1/16
   <pre>
   allow * * * 80,8080-8088
   parent 1000 http 0.0.0.0 0
-  #перенаправить во внутренний прокси
+  &#35;перенаправить во внутренний прокси
   allow * * $c:\3proxy\local.nets 80,8080-8088
-  #разрешить прямой web-доступ к сетям из local.nets
+  &#35;разрешить прямой web-доступ к сетям из local.nets
   allow * * * 80,8080-8088
   parent 1000 http proxy.3proxy.ru 3128
-  #все остальные веб-запросы перенаправить на внешний прокси-сервер
+  &#35;все остальные веб-запросы перенаправить на внешний прокси-сервер
   allow *
-  #разрешить socks-запросы по другим портам</pre>
+  &#35;разрешить socks-запросы по другим портам</pre>
  </p>
 </ul>
  <li><a name="ROUNDROBIN"><i>Как организовать балансировку между несоклькими каналами</i></a>