From 305f9932aca75e0841560548ef1db0273f5bd2b2 Mon Sep 17 00:00:00 2001 From: Vladimir Dubrovin <3proxy@3proxy.ru> Date: Wed, 22 Jul 2026 18:47:11 +0300 Subject: [PATCH] Update docs --- doc/html/index.html | 1 + doc/html/man5/3proxy.cfg.5.html | 14 +- doc/html/man8/3proxy.8.html | 14 +- doc/html/man8/imapp.8.html | 287 ++++++++++++++++++++++++++++++++ doc/html/man8/pop3p.8.html | 33 +++- doc/html/man8/smtpp.8.html | 34 +++- doc/html/man8/tlspr.8.html | 40 +++-- 7 files changed, 391 insertions(+), 32 deletions(-) create mode 100644 doc/html/man8/imapp.8.html diff --git a/doc/html/index.html b/doc/html/index.html index e4c60c4..dd33882 100644 --- a/doc/html/index.html +++ b/doc/html/index.html @@ -8,6 +8,7 @@
3proxy_crypt.8
3proxy.8
ftppr.8 +
imapp.8
pop3p.8
proxy.8
smtpp.8 diff --git a/doc/html/man5/3proxy.cfg.5.html b/doc/html/man5/3proxy.cfg.5.html index 62f30a0..847c159 100644 --- a/doc/html/man5/3proxy.cfg.5.html +++ b/doc/html/man5/3proxy.cfg.5.html @@ -87,6 +87,7 @@ start gateway services:

[options]
socks [options]
pop3p [options]
+imapp [options]
smtpp [options]
ftppr [options]
admin [options]
@@ -104,6 +105,7 @@ handshake), may be used to redirect any TLS-based traffic auto Proxy with protocol autoselection between proxy / socks / tlspr
pop3p POP3 proxy (default port 110)
+imapp IMAPv4 proxy (default port 143)
smtpp SMTP proxy (default port 25)
ftppr FTP proxy (default port 21)
admin Web interface (default port 80)
@@ -220,8 +222,8 @@ information reported)
-a2 (for proxy) generate Via: and X-Forwarded-For: instead of Forwarded:
Also, all options mentioned for proxy(8) -socks(8) pop3p(8) tcppm(8) -udppm(8) ftppr(8)
+socks(8) pop3p(8) imapp(8) +tcppm(8) udppm(8) ftppr(8)
are also supported.
Portmapping services listen at SRCPORT and connect to DSTADDR:DSTPORT HTTP and SOCKS proxies are standard.
@@ -779,8 +781,9 @@ special case of local redirection, it works only with socks proxy. In case of local redirection request is redirected to different service, ftp locally redirects to ftppr pop3 locally redirects to pop3p -http locally redirects to proxy admin locally -redirects to the admin -s service.
+imap locally redirects to imapp http locally +redirects to proxy admin locally redirects to the +admin -s service.
Unix domain sockets can be used instead of IP address with the syntax unix:/path/to/socket (e.g., parent 1000 socks5 unix:/var/run/parent.sock 1080). On Linux, abstract @@ -1294,7 +1297,8 @@ to 3proxy@3proxy.org

3proxy(8), 3proxy_crypt(8), proxy(8), ftppr(8), socks(8), pop3p(8), -smtpp(8), tlspr(8), tcppm(8), udppm(8), syslogd(8),
+imapp(8), smtpp(8), tlspr(8), tcppm(8), udppm(8), +syslogd(8),
https://3proxy.org/

AUTHORS diff --git a/doc/html/man8/3proxy.8.html b/doc/html/man8/3proxy.8.html index 6d78fee..359eb98 100644 --- a/doc/html/man8/3proxy.8.html +++ b/doc/html/man8/3proxy.8.html @@ -58,11 +58,11 @@ multiple gateways with HTTP and HTTPS proxy with FTP over HTTP support, SOCKS v4, v4.5 and v5, POP3 proxy, UDP and TCP portmappers. Each gateway is started from the configuration file like an independent service proxy(8) -socks(8) pop3p(8) tcppm(8) -udppm(8) ftppr(8) dnspr but -3proxy is not a kind of wrapper or superserver for -these daemons. It just has the same code compiled in, but -provides much more functionality. SOCKSv5 implementation +socks(8) pop3p(8) imapp(8) +tcppm(8) udppm(8) ftppr(8) dnspr +but 3proxy is not a kind of wrapper or superserver +for these daemons. It just has the same code compiled in, +but provides much more functionality. SOCKSv5 implementation allows you to use 3proxy with any UDP or TCP based client applications designed without proxy support (with SocksCAP, FreeCAP or another client-side @@ -195,8 +195,8 @@ to 3proxy@3proxy.org

3proxy.cfg(5), -proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), -kill(1), syslogd(8),
+proxy(8), ftppr(8), socks(8), pop3p(8), imapp(8), tcppm(8), +udppm(8), kill(1), syslogd(8),
https://3proxy.org/

AUTHORS diff --git a/doc/html/man8/imapp.8.html b/doc/html/man8/imapp.8.html new file mode 100644 index 0000000..1305554 --- /dev/null +++ b/doc/html/man8/imapp.8.html @@ -0,0 +1,287 @@ + + + + + + + +

imapp

+ +NAME
+SYNOPSIS
+DESCRIPTION
+OPTIONS
+CLIENTS
+BUGS
+SEE ALSO
+AUTHORS
+ +
+ + +

NAME + +

+ + +

imapp - +IMAPv4 proxy gateway service

+ +

SYNOPSIS + +

+ + +

imapp +[-d] [-l[[@]logfile]] +[-pport] [-iinternal_ip] +[-eexternal_ip] +[-hdefault_ip[:port]] [-x]

+ +

DESCRIPTION + +

+ + + +

imapp +is IMAPv4 (IMAP4rev1) gateway service to allow internal +users to access external IMAP servers.

+ +

OPTIONS + +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +

-I

 + + +

Inetd mode. Standalone service +only.

+ + +

-d

 + + +

Daemonize. Detach service from +console and run in the background.

+ + +

-t

 + + +

Be silenT. Do not log +start/stop/accept error records.

+ + +

-u

 + + +

Never look for username +authentication.

+ + +

-e

 + + +

External address. IP address of +the interface the proxy should initiate connections from. By +default, the system will decide which address to use in +accordance with the routing table.

+ +

-niPATH

+ +

(Linux only) Switch to the +network namespace identified by PATH before opening +the listening socket. The current namespace is saved and +restored immediately after binding, so outgoing connections +run in the original namespace unless -ne is also +given.

+ +

-nePATH

+ +

(Linux only) Switch to the +network namespace identified by PATH after the +listening socket has been bound (and after restoring from +-ni if applicable). Both options accept any namespace +file path (e.g. /var/run/netns/myns or +/proc/PID/ns/net) and require +CAP_SYS_ADMIN.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+ + +

-i

 + + +

Internal address. IP address the proxy accepts +connections to. By default, connections to any interface are +accepted. It´s usually unsafe. Unix domain sockets can +be specified with -iunix:/path/to/socket syntax +(e.g., -iunix:/var/run/imapp.sock). On Linux, abstract +sockets use -iunix:@socketname syntax.

+ + +

-p

 + + +

Port. Port proxy listens for +incoming connections. Default is 143.

+ + +

-h

 + + +

Default destination. It’s +used if the target address is not specified by the user.

+ + +

-x

 + + +

Disable STARTTLS support. +STARTTLS is not announced in the CAPABILITY response and the +STARTTLS command is not accepted.

+ + +

-l

 + + +

Log. By default logging is to +stdout. If logfile is specified logging is to file. +Under Unix, if ´@´ precedes +logfile, syslog is used for logging.

+ + +

-S

 + + +

Increase or decrease stack size. +You may want to try something like -S8192 if you experience +3proxy crashes.

+ +

CLIENTS + +

+ + +

You can use any +MUA (Mail User Agent) with IMAPv4 support. Set the client to +use internal_ip and port as an IMAP server. +The address of the real IMAP server must be configured as a +part of the IMAP username. The format for the username is +username@server, where server is the +address of the IMAP server and username is the +user´s login on this IMAP server. The login itself may +contain an ´@´ sign. Supported client +authentication methods are the LOGIN command, AUTHENTICATE +PLAIN and AUTHENTICATE LOGIN. With the server, the proxy +authenticates using the method chosen by the client if the +server supports it (as advertised in the CAPABILITY +response); otherwise it falls back to AUTHENTICATE LOGIN, +AUTHENTICATE PLAIN or the LOGIN command, in this order of +preference. Challenge-response authentication (CRAM-MD5, +etc.) is not supported, because it requires a challenge from +the server before we know which server to connect to. When +running as a 3proxy service (not as a standalone binary), +STARTTLS is supported and announced in the CAPABILITY +response unless disabled with -x. After the client +issues STARTTLS, the connection is handled by +tlspr(8): the destination host is taken from the SNI +of the client TLS handshake (or from the -h option), the +proxy performs STARTTLS negotiation with the destination +server, and then transparently passes TLS traffic between +the client and the server. If the destination server does +not support STARTTLS, the TLS handshake with the client +fails.

+ +

BUGS + +

+ + +

Report all bugs +to 3proxy@3proxy.org

+ +

SEE ALSO + +

+ + +

3proxy(8), +ftppr(8), pop3p(8), proxy(8), smtpp(8), socks(8), tcppm(8), +tlspr(8), udppm(8), syslogd(8),
+https://3proxy.org/

+ +

AUTHORS + +

+ + +

3proxy is +designed by Vladimir Dubrovin <vlad@3proxy.org>

+
+ + diff --git a/doc/html/man8/pop3p.8.html b/doc/html/man8/pop3p.8.html index 40b3d0e..2c7cb60 100644 --- a/doc/html/man8/pop3p.8.html +++ b/doc/html/man8/pop3p.8.html @@ -36,15 +36,16 @@ POP3 proxy gateway service

[-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip] -[-hdefault_ip[:port]]

+[-hdefault_ip[:port]] [-x]

DESCRIPTION

-

pop3p is -POP3 gateway service to allow internal users to access + +

pop3p +is POP3 gateway service to allow internal users to access external POP3 servers.

OPTIONS @@ -184,6 +185,19 @@ used if the target address is not specified by the user.

+

-x

+ + + + +

Disable STARTTLS (STLS) support. +STLS is not announced in the CAPA response and the STLS +command is not accepted.

+ + + + +

-l

@@ -224,8 +238,17 @@ user´s login on this POP3 server. The login itself may contain an ´@´ sign. Only cleartext authentication is supported, because challenge-response authentication (APOP, CRAM-MD5, etc.) requires a challenge -from the server before we know which server to connect -to.

+from the server before we know which server to connect to. +When running as a 3proxy service (not as a standalone +binary), STLS is supported and announced in the CAPA +response unless disabled with -x. After the client +issues STLS, the connection is handled by tlspr(8): +the destination host is taken from the SNI of the client TLS +handshake (or from the -h option), the proxy performs STLS +negotiation with the destination server, and then +transparently passes TLS traffic between the client and the +server. If the destination server does not support STLS, the +TLS handshake with the client fails.

BUGS diff --git a/doc/html/man8/smtpp.8.html b/doc/html/man8/smtpp.8.html index 2c640db..5b2b6b0 100644 --- a/doc/html/man8/smtpp.8.html +++ b/doc/html/man8/smtpp.8.html @@ -36,15 +36,16 @@ SMTP proxy gateway service

[-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip] -[-hdefault_ip[:port]]

+[-hdefault_ip[:port]] [-x]

DESCRIPTION

-

smtpp is -SMTP gateway service to allow internal users to access + +

smtpp +is SMTP gateway service to allow internal users to access external SMTP servers.

OPTIONS @@ -166,7 +167,7 @@ sockets use -iunix:@socketname syntax.

Port. Port proxy listens for -incoming connections. Default is 25.

+incoming connections. Default is 587.

@@ -184,6 +185,19 @@ used if the target address is not specified by the user.

+

-x

+ + + + +

Disable STARTTLS support. +STARTTLS is not announced in the EHLO response and the +STARTTLS command is not accepted.

+ + + + +

-l

@@ -225,7 +239,17 @@ server. The login itself may contain an ´@´ sign. Only cleartext authentication is supported, because challenge-response authentication (CRAM-MD5, SPA, etc.) requires a challenge from the server before we know which -server to connect to.

+server to connect to. When running as a 3proxy service (not +as a standalone binary), STARTTLS is supported and announced +in the EHLO response unless disabled with -x. After +the client issues STARTTLS, the connection is handled by +tlspr(8): the destination host is taken from the SNI +of the client TLS handshake (or from the -h option), the +proxy performs STARTTLS negotiation with the destination +server, and then transparently passes TLS traffic between +the client and the server. If the destination server does +not support STARTTLS, the TLS handshake with the client +fails.

BUGS diff --git a/doc/html/man8/tlspr.8.html b/doc/html/man8/tlspr.8.html index 83de805..3b3e51d 100644 --- a/doc/html/man8/tlspr.8.html +++ b/doc/html/man8/tlspr.8.html @@ -49,7 +49,9 @@ SNI proxy gateway service

an SNI gateway service (destination host is taken from TLS handshake). The destination port must be specified via the -P option (or it may be detected with the Transparent -plugin).

+plugin). tlspr does not support user authentication; use +ACLs by client IP or a parent proxy with authentication if +access control is required.

OPTIONS @@ -241,27 +243,45 @@ with TLS 1.3)

packet across multiple TCP segments to make SNI-based DPI detection harder. An optional numeric value can follow (e.g. -s1) to control the splitting behaviour.

+ + +

-Ximap | -Xpop3 | +-Xsmtp

+ +

STARTTLS mode for the given +protocol. The proxy speaks the plaintext protocol with the +client (greeting, capability advertisement with STARTTLS +only, STARTTLS command), then, after the client issues +STARTTLS and sends a TLS Client HELLO, connects to the +destination taken from SNI (default port 143/110/587), +performs STARTTLS negotiation with the destination server +and transparently passes TLS traffic. If the destination +server does not support STARTTLS, the TLS handshake with the +client fails.

+ + - - +

-l

+ +

Log. By default logging is to stdout. If logfile +is specified logging is to file. Under Unix, if +´@´ precedes logfile, syslog is +used for logging.

- - +
+ -

-l

 -

Log. By default logging is to -stdout. If logfile is specified logging is to file. -Under Unix, if ´@´ precedes -logfile, syslog is used for logging.

+

-S