Release as 1.1.0-pre1

CHANGELOG

@@ -1,13 +1,22 @@
-3proxy-1.0.0 Released August, 22 2026
+3proxy-1.1.0-pre1 Released October, 24 2026
 
-No changes in 3proxy code, this release only changes how packages are built, signed and published.
-
-! Fix: TLS, PCRE2 and PAM support was silently left out when 3proxy was built on a system whose /bin/sh is not dash, which is every RPM based distribution and macOS; the library checks built their test program with echo and escape sequences, which only dash expands, so every check failed and the features were dropped without a diagnostic
-! Fix: rpm packages were built on Ubuntu and required glibc 2.38, libssl.so.3 and libpcre2-8, which no RPM based distribution provides, so they could not be installed anywhere; they are built against AlmaLinux 8, 9 and 10 now and carry an el8, el9 or el10 tag, covering RHEL, AlmaLinux, Rocky and CentOS Stream of the same version
-! Fix: the rpm package depended on its own interpreter, /bin/3proxy, taken from the first line of the installed configuration file, and could not be installed on el9 or el10 because rpm resolves that dependency to /usr/bin/3proxy
-! Fix: deb packages required glibc 2.38 and libssl3t64 and installed on Ubuntu 24.04 and newer only; they are built against Ubuntu 22.04 now and install on Ubuntu 22.04 and later as well as Debian 12 and later
-+ Signed apt and dnf repositories are published at https://3proxy.org/repo/ in two channels: current, built from the master branch, and lts, built from the 0.9 branch; packages and repository metadata are both signed
-+ Release binaries are published with SHA256 checksums, an OpenPGP signature and a GitHub build provenance attestation; docker images are signed and attested as well
-+ The release signing key is an RSA-4096 key published as 3proxy-release-key.asc in the repository; rpm 4.14 and earlier can not import an Ed25519 key at all, which would leave RHEL 8 and its derivatives unable to verify anything
-+ Packages are reproducible: rebuilding a release produces byte identical deb and rpm files, every timestamp is derived from the build date recorded for the release
-- 32-bit ARM (armhf) is published as a deb package only, Enterprise Linux has no 32-bit ARM build
+! Fix: a connect back service (-r) replaced by a configuration reload went on waiting up to 60 seconds for the go-ahead, holding a slot and a thread, and every reload left another connection in the queue of the far side (-R); a connection the -r side closed cost the -R side a client
+! Fix: numbered traffic counters were reset by a configuration reload when no counter file was used
++ Configuration reload is atomic: a configuration with an error is refused and the one in force keeps running; a new service on the same address, network namespace and device takes over the old service's listening TCP or UDP socket, so no connection is refused or lost and UDP sessions go on; connections of the old services are re-authenticated against the new configuration (unless noforce), and closed if their service was removed or has no free slot; FTP commands and data connections are authorized by the rules in force
++ Services of one configuration on one address share its listening socket; the admin services page shows the clients and traffic of each listening socket, kept across reloads
++ Logs: each log is opened once and shared by every service using it, kept open over a reload while used and closed once unused; -l takes the same arguments as log; each log is written by a thread of its own from a queue, so a client never waits for a slow log (ODBC, RADIUS, a full disk); a record which finds the queue full is dropped, and dropped records and log failures are reported
++ minlogqueue / maxlogqueue: the records a log's queue keeps room for and holds at most (64 and 4096 by default)
++ ODBC log: the datasource alone names the log, username and password are its parameters, never shown in messages; a log with the same datasource and other credentials reconnects with them
++ threadpool <max_idle> [<idle_seconds>]: a thread whose connection ended waits for the next one of any service, with its memory, instead of ending; by default up to 32 threads per running service; the admin services page shows the pool
++ defaultresolve / sysresolve / fakeresolve apply to the services started after them: defaultresolve (the default) uses the name servers in force, sysresolve the system routines (the C library), as without nserver before
++ timeouts, filtermaxsize, parentretries, delimchar and maxseg apply to the services started after them, so services can have values of their own
++ ssl_ktls / ssl_noktls: kernel TLS (Linux, FreeBSD) with OpenSSL 3.0 or later built with kernel TLS; splice() works over kernel TLS
++ -s:MIN,STREAK,SMALL tunes when the automatic splice() mode splices a direction and when it copies again
++ filtermaxsize 0 removes the limit
++ UDP services (udppm, dnspr) run in one thread each, with no thread per client, using epoll on Linux; dnspr waits for name servers without holding a thread
++ Connection buffers are allocated with the connection structure, together with the thread pool fewer allocations per connection
++ Build-time defaults: -DLOGQUEUEMIN, -DLOGQUEUEMAX, -DDEFAULT_POOLMAX, -DPOOLPERSERVICE, -DDEFAULT_POOLTIMEOUT, -DDEFAULT_MAXCHILD
+- splice() in the automatic mode is the default on Linux (-s0 turns it off); a service with data filters, or beginning or ending TLS without kernel TLS both ways, does not splice
+- -ni / -ne (Linux network namespaces): threads stay in the namespace 3proxy was started in and enter the configured one only to create a socket; -ni covers the socket SOCKS UDP ASSOCIATE talks to the client on, -ne SOCKS BIND, the UDP sockets towards the destination and the connect back sockets; name resolution, logging and RADIUS stay in the original namespace; the path is opened when the service line is read, and one which is not a network namespace stops the service from starting
+- Without nserver, names are resolved by 3proxy's own resolver with the system's name servers (up to 3 from /etc/resolv.conf, on Windows from the registry), answering names of the hosts file first, instead of the C library; both are checked for changes every 5 seconds, nsrecord takes precedence over the hosts file and dnspr forwards queries to them; the C library is used if no name server is found, or with sysresolve
+- Dial on demand is removed: dialer is accepted and ignored

CHANGELOG.rus

@@ -1,13 +1,22 @@
-3proxy-1.0.0 Вышел 22 Августа 2026
+3proxy-1.1.0-pre1 Вышел 24 Октября 2026
 
-Изменений в коде 3proxy нет, этот выпуск меняет только сборку, подписывание и публикацию пакетов.
-
-! Исправление: поддержка TLS, PCRE2 и PAM молча не включалась при сборке в системах, где /bin/sh не dash, то есть во всех дистрибутивах на основе RPM и в macOS; проверки наличия библиотек формировали тестовую программу через echo с escape-последовательностями, которые раскрывает только dash, поэтому все проверки завершались неудачно и возможности отключались без каких-либо сообщений
-! Исправление: пакеты rpm собирались в Ubuntu и требовали glibc 2.38, libssl.so.3 и libpcre2-8, которых нет ни в одном дистрибутиве на основе RPM, поэтому установить их было невозможно нигде; теперь они собираются в AlmaLinux 8, 9 и 10 и содержат метку el8, el9 или el10, что покрывает RHEL, AlmaLinux, Rocky и CentOS Stream соответствующей версии
-! Исправление: пакет rpm зависел от собственного интерпретатора /bin/3proxy, взятого из первой строки устанавливаемого файла конфигурации, и не устанавливался в el9 и el10, поскольку rpm приводит эту зависимость к /usr/bin/3proxy
-! Исправление: пакеты deb требовали glibc 2.38 и libssl3t64 и устанавливались только в Ubuntu 24.04 и новее; теперь они собираются в Ubuntu 22.04 и устанавливаются в Ubuntu 22.04 и новее, а также в Debian 12 и новее
-+ Подписанные репозитории apt и dnf публикуются на https://3proxy.org/repo/ в двух каналах: current, собираемый из ветки master, и lts, собираемый из ветки 0.9; подписываются и пакеты, и метаданные репозитория
-+ Двоичные файлы релиза публикуются с контрольными суммами SHA256, подписью OpenPGP и подтверждением происхождения сборки GitHub (build provenance attestation); образы docker также подписываются и снабжаются подтверждением
-+ Ключ подписи релизов — RSA-4096, опубликован в репозитории как 3proxy-release-key.asc; rpm версии 4.14 и более ранние вообще не могут импортировать ключ Ed25519, что лишило бы RHEL 8 и производные от него возможности проверки
-+ Пакеты воспроизводимы: повторная сборка релиза даёт побайтово идентичные файлы deb и rpm, все отметки времени берутся из даты сборки, записанной для релиза
-- Для 32-битной ARM (armhf) публикуется только пакет deb, в Enterprise Linux нет сборки для 32-битной ARM
+! Исправление: служба обратного соединения (-r), заменённая при перезагрузке конфигурации, продолжала до 60 секунд ждать разрешения, занимая место и поток, и каждая перезагрузка оставляла ещё одно соединение в очереди другой стороны (-R); соединение, закрытое стороной -r, стоило стороне -R клиента
+! Исправление: нумерованные счётчики трафика сбрасывались при перезагрузке конфигурации, если файл счётчиков не использовался
++ Перезагрузка конфигурации атомарна: конфигурация с ошибкой отвергается, и действующая продолжает работать; новая служба на том же адресе, в том же сетевом пространстве имён и на том же устройстве принимает слушающий сокет TCP или UDP старой службы, так что ни одно соединение не отвергается и не теряется, а сессии UDP продолжаются; соединения старых служб заново проходят аутентификацию по новой конфигурации (если не задан noforce) и закрываются, если их служба удалена или в ней нет свободного места; команды и соединения данных FTP авторизуются по действующим правилам
++ Службы одной конфигурации на одном адресе разделяют его слушающий сокет; страница служб admin показывает клиентов и трафик каждого слушающего сокета, сохраняемые при перезагрузке
++ Журналы: каждый журнал открывается один раз и используется всеми службами, которые в него пишут, остаётся открытым при перезагрузке, пока используется, и закрывается, когда больше не нужен; -l принимает те же аргументы, что и log; каждый журнал пишется отдельным потоком из очереди, так что клиент никогда не ждёт медленного журнала (ODBC, RADIUS, заполненный диск); запись, заставшая очередь заполненной, отбрасывается, об отброшенных записях и сбоях журнала сообщается
++ minlogqueue / maxlogqueue: сколько записей очередь журнала держит наготове и сколько вмещает самое большее (по умолчанию 64 и 4096)
++ Журнал ODBC: журнал называется только источником данных, имя пользователя и пароль — его параметры и никогда не выводятся в сообщениях; журнал с тем же источником данных и другими учётными данными переподключается с ними
++ threadpool <max_idle> [<idle_seconds>]: поток, соединение которого закончилось, вместо завершения ждёт следующего соединения любой службы, сохраняя свою память; по умолчанию до 32 потоков на каждую работающую службу; пул показывается на странице служб admin
++ defaultresolve / sysresolve / fakeresolve действуют на службы, запущенные после них: defaultresolve (по умолчанию) использует действующие серверы имён, sysresolve — системные функции (библиотеку C), как раньше без nserver
++ timeouts, filtermaxsize, parentretries, delimchar и maxseg действуют на службы, запущенные после них, так что у служб могут быть свои значения
++ ssl_ktls / ssl_noktls: TLS в ядре (Linux, FreeBSD) с OpenSSL 3.0 и новее, собранным с поддержкой TLS в ядре; splice() работает поверх TLS в ядре
++ -s:MIN,STREAK,SMALL настраивает, когда автоматический режим splice() включает splice() для направления и когда возвращается к копированию
++ filtermaxsize 0 снимает ограничение
++ Службы UDP (udppm, dnspr) работают каждая в одном потоке, без потока на клиента, в Linux через epoll; dnspr ждёт ответа серверов имён, не занимая поток
++ Буферы соединения выделяются вместе со структурой соединения; вместе с пулом потоков — меньше выделений памяти на соединение
++ Значения по умолчанию при сборке: -DLOGQUEUEMIN, -DLOGQUEUEMAX, -DDEFAULT_POOLMAX, -DPOOLPERSERVICE, -DDEFAULT_POOLTIMEOUT, -DDEFAULT_MAXCHILD
+- Автоматический режим splice() включён по умолчанию в Linux (-s0 выключает его); служба с фильтрами данных, а также начинающая или завершающая TLS без TLS в ядре в обе стороны, splice() не использует
+- -ni / -ne (сетевые пространства имён Linux): потоки остаются в пространстве имён, в котором запущен 3proxy, и входят в заданное только для создания сокета; -ni относится и к сокету, через который SOCKS UDP ASSOCIATE общается с клиентом, -ne — к SOCKS BIND, сокетам UDP в сторону назначения и сокетам обратного соединения; разрешение имён, журналы и RADIUS остаются в исходном пространстве имён; путь открывается при чтении строки службы, и путь, не являющийся сетевым пространством имён, не даёт службе запуститься
+- Без nserver имена разрешаются собственным резолвером 3proxy с системными серверами имён (до 3 из /etc/resolv.conf, в Windows из реестра), имена из файла hosts отвечаются в первую очередь, вместо библиотеки C; оба проверяются на изменения каждые 5 секунд, nsrecord имеет приоритет над файлом hosts, и dnspr передаёт запросы этим серверам; библиотека C используется, если сервер имён не найден, или с sysresolve
+- Набор номера по требованию (dial on demand) удалён: команда dialer принимается и игнорируется

DEVEL

@@ -1 +1 @@
-2.0.0-devel
+1.1.0-pre1

README.md

@@ -8,7 +8,8 @@
 
 - **Master** (current/latest) branch - 3proxy 1.0
 - **0.9** (LTS) branch - 3proxy 0.9.9.x
-- **Devel** branch - 3proxy 2.0-devel (don't use it)
+- **Devel** branch - 3proxy 1.1 (development, don't use it in production)
+- **Experimental** branch - 3proxy 2.0 (experimental, don't use it)
 
 ### Binaries (deb / rpm / Windows zip)
 

SECURITY.md

@@ -4,8 +4,9 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.9.8   | :white_check_mark: |
-| < 0.9.8 | :x:                |
+| 0.9.9.x (LTS)  | :white_check_mark: |
+| 1.0.x (Main)  | :white_check_mark: |
+| <= 0.9.8 | :x:                |
 
 ## Hardening a deployment
 

doc/changelog/1/0/1

@@ -0,0 +1,23 @@
+! Fix: crash (segmentation fault) on configuration reload (SIGUSR1) on a busy server: a closing session could still use its service after the reload had freed it; the race existed since 0.9.7, the 5 second linger added in 0.9.9 made it much more likely (#1278)
+! Fix: -Di and -De (bind to interface) were not applied to SOCKSv5 UDP ASSOCIATE and BIND sockets, the FTP proxy data connection and connect back (#1277)
+! Fix: SOCKSv5 UDP ASSOCIATE over IPv6: the source address of a datagram was truncated and the reply was sent to the wrong address (#1279)
+! Fix: SOCKSv5 UDP ASSOCIATE: an access rule with host names matched any datagram sent to a literal address; the address is used as the host name now, as it is for TCP requests
+! Fix: a request rewritten with pcre_rewrite was only logged and was sent unchanged to the server on a direct connection; the rewritten path and query are what the server receives now
+! Fix: buffer could be insufficient for the headers the HTTP proxy adds after a pcre_rewrite had grown the request
+! Fix: heap buffer overflow in pcre_rewrite: a $N reference to a group which did not match was written out as its digits, which the space allocated for the result did not count
+! Fix: pcre_extend did nothing, the rules it appended were never consulted; the manual described an argument the command does not take
+! Fix: certificates generated for TLS MitM (openssl) carried no subject and authority key identifiers and were refused by strict verifiers, including macOS clients, OpenSSL with x509_strict and Python 3.13
+! Fix: null pointer dereference in ftppr on PASS without USER and in smtpp on a user name without a host
+! Fix: no service started with wolfSSL on glibc: the default thread stack was too small for wolfSSL thread-local storage, pthread_create() failed and the failure was not reported
+! Fix: dnspr did not work on Windows; Windows builds answer UDP from a socket of their own again
++ Built-in HTTP server: httpsrv service with http rules to serve files (cached or with sendfile / TransmitFile), redirects, rewrites, fixed replies and proxypass to forward requests as the proxy does, so one port can serve both a site and a proxy; admin is httpsrv with the administration pages
++ Host names in access rules may be regular expressions with a pcre: (or regex:) prefix
++ transparent / notransparent commands: transparent proxying is built in (netfilter on Linux, pf on BSD, socket for divert-to and ipfw fwd), TransparentPlugin is removed and a configuration loading it keeps working
++ parent: weight may be written as a fraction (.5) or a percentage (50%); weight 0 is a fallback parent used only when every weighted parent of its group has failed; a failed parent is left out of the next attempt of the same connection
++ parent extport / intport: range of local ports for outgoing connections and for sockets facing the client (UDP ASSOCIATE, FTP data)
++ A parent given by host name is resolved for each connection when nserver is used, instead of once on configuration load
++ $$ in the configuration stands for a single dollar sign, a dollar inside quotes is ordinary text
++ OpenWrt package (procd init script, UCI configuration) and OpenWrt builds for mipsel_24kc, mips_24kc, arm_cortex-a7_neon-vfpv4 and aarch64_cortex-a53
+- pop3p, imapp, smtpp and ftppr are not in a default build: build with MAILPROXY=true and FTP=true (CMake: 3PROXY_USE_MAILPROXY, 3PROXY_USE_FTP); without them the mail proxies run as tlspr negotiating STARTTLS, and ftppr refuses clients
+- FTP over HTTP proxy (ftp:// URLs) is not in a default build either and has to be enabled explicitly: build with FTP=true (CMake: 3PROXY_USE_FTP), without it the HTTP proxy does not fetch ftp:// URLs
+- Windows binaries are no longer signed with a self-signed Authenticode certificate, it gave no trust and triggered antivirus false positives

doc/changelog/1/0/2

@@ -0,0 +1,23 @@
+! Fix: dnspr relayed to the client whatever came first to the socket it asked the name server from, from any address and under any id, so a forged answer could be passed on; the query now goes out under a random id, and only an answer from the name server asked, with that id and the same question, is relayed
+! Fix: a client sending a part of a TLS record and then nothing kept a thread taking all of a CPU, and the read never timed out
+! Fix: without -Ne, the reply to SOCKS CONNECT and BIND gave the address of the client's connection to the proxy instead of the socket towards the destination: a BIND client was told the proxy's own port and the peer could never reach it (since 0.9.6)
+! Fix: a client which shut down its sending side (half-close) could get the answer cut short, megabytes short with large answers; likewise an upload after the server half-closed
+! Fix: with chroot every local time was UTC and every syslog message was lost: the time zone is loaded and syslog connected before chroot; the chroot entry of 3proxy.cfg(5) lists what PAM, LDAP and ODBC still need inside the chroot
+! Fix: the HTTP proxy closed the server connection of a kept-alive client and opened another one when only the request method changed (a POST after a GET to the same host)
+! Fix: the last ssl_client_mode in the configuration applied to every service, and a reload changed it for the services still running
+! Fix: memory leaks: on every refused configuration reload, on every failed TLS handshake, the server CA paths of every TLS service, compiled pcre: / regex: host names of access rules and patterns of httpsrv rules
+! Fix: Unix sockets: on Linux a proxy listening on a Unix socket relayed only the first bytes of an answer (result 95); an abstract socket (unix:@NAME) was bound under a name padded with zeros, which clients did not reach; tcppm refused port 0 for a unix: target, as given in the manual's example; on a reload the socket file of a listening service was removed
+! Fix: SIGPIPE could kill 3proxy when a client was gone while services were starting, and standalone services (proxy, socks, ...) at any time; sends use MSG_NOSIGNAL where the system has it
+! Fix: TLS MitM failed for every connection with wolfSSL built with WOLFSSL_QT (wolfSSL 5.9.1 of Ubuntu 26.04): the source certificate's serial number could not be copied; a serial number made from the hash of the source certificate is used then
+! Fix: Windows: closing a connection could leave its socket open (SO_LINGER on a non-blocking socket) or reset it while the peer still sent, so the end of an answer could be lost
+! Fix: httpsrv: the body of a request answered without being read (for example when authentication is required) was read as the next request; a client still sending when a connection without keep-alive closed could get a reset instead of the answer
+! Fix: httpsrv on Windows: UNC paths (\\server\share) did not work
+! Fix: httpsrv and admin services and their clients were named ZOMBIE on the admin services page, in %N of logs and in RADIUS
+! Fix: the Watcom (lite) build did not compile, 1.0.1 had no binaries for it
++ -s (splice) per direction: -s1 splices what the server sends (downloads), -s2 what the client sends (uploads), -s3 both; -s alone splices only where it pays (large bodies, long streams); pipes are kept with the connection for its next requests. splice() is built by default on Linux again and is used only by services given -s
++ Socket options (-oc, -os, -ol, -or, -oR) take NAME=VALUE; NAME=0 turns an option off, also one set by default; an unknown name or a value which is not a number is an error
++ The HTTP proxy frees its 64 KB request buffer while a CONNECT tunnel relays data and while a kept-alive connection waits for its next request: 2000 tunnels take 213 MB instead of 339 MB
++ TLS records are read ahead with OpenSSL 1.1.0 and later: decrypting takes 9-14% less CPU
++ Faster service stop and configuration reload, no fixed delays; a connection waiting for a free maxconn slot gets it at once
+- TCP_NODELAY is set by default on proxy-to-client and proxy-to-server sockets; -ocTCP_NODELAY=0 / -osTCP_NODELAY=0 turns it off
+- The HTTP proxy fetches ftp:// URLs only when the service is given the new -Xftp option (in a build with FTP=true)

doc/changelog/1/1/0

@@ -0,0 +1,20 @@
+! Fix: a connect back service (-r) replaced by a configuration reload went on waiting up to 60 seconds for the go-ahead, holding a slot and a thread, and every reload left another connection in the queue of the far side (-R); a connection the -r side closed cost the -R side a client
+! Fix: numbered traffic counters were reset by a configuration reload when no counter file was used
++ Configuration reload is atomic: a configuration with an error is refused and the one in force keeps running; a new service on the same address, network namespace and device takes over the old service's listening TCP or UDP socket, so no connection is refused or lost and UDP sessions go on; connections of the old services are re-authenticated against the new configuration (unless noforce), and closed if their service was removed or has no free slot; FTP commands and data connections are authorized by the rules in force
++ Services of one configuration on one address share its listening socket; the admin services page shows the clients and traffic of each listening socket, kept across reloads
++ Logs: each log is opened once and shared by every service using it, kept open over a reload while used and closed once unused; -l takes the same arguments as log; each log is written by a thread of its own from a queue, so a client never waits for a slow log (ODBC, RADIUS, a full disk); a record which finds the queue full is dropped, and dropped records and log failures are reported
++ minlogqueue / maxlogqueue: the records a log's queue keeps room for and holds at most (64 and 4096 by default)
++ ODBC log: the datasource alone names the log, username and password are its parameters, never shown in messages; a log with the same datasource and other credentials reconnects with them
++ threadpool <max_idle> [<idle_seconds>]: a thread whose connection ended waits for the next one of any service, with its memory, instead of ending; by default up to 32 threads per running service; the admin services page shows the pool
++ defaultresolve / sysresolve / fakeresolve apply to the services started after them: defaultresolve (the default) uses the name servers in force, sysresolve the system routines (the C library), as without nserver before
++ timeouts, filtermaxsize, parentretries, delimchar and maxseg apply to the services started after them, so services can have values of their own
++ ssl_ktls / ssl_noktls: kernel TLS (Linux, FreeBSD) with OpenSSL 3.0 or later built with kernel TLS; splice() works over kernel TLS
++ -s:MIN,STREAK,SMALL tunes when the automatic splice() mode splices a direction and when it copies again
++ filtermaxsize 0 removes the limit
++ UDP services (udppm, dnspr) run in one thread each, with no thread per client, using epoll on Linux; dnspr waits for name servers without holding a thread
++ Connection buffers are allocated with the connection structure, together with the thread pool fewer allocations per connection
++ Build-time defaults: -DLOGQUEUEMIN, -DLOGQUEUEMAX, -DDEFAULT_POOLMAX, -DPOOLPERSERVICE, -DDEFAULT_POOLTIMEOUT, -DDEFAULT_MAXCHILD
+- splice() in the automatic mode is the default on Linux (-s0 turns it off); a service with data filters, or beginning or ending TLS without kernel TLS both ways, does not splice
+- -ni / -ne (Linux network namespaces): threads stay in the namespace 3proxy was started in and enter the configured one only to create a socket; -ni covers the socket SOCKS UDP ASSOCIATE talks to the client on, -ne SOCKS BIND, the UDP sockets towards the destination and the connect back sockets; name resolution, logging and RADIUS stay in the original namespace; the path is opened when the service line is read, and one which is not a network namespace stops the service from starting
+- Without nserver, names are resolved by 3proxy's own resolver with the system's name servers (up to 3 from /etc/resolv.conf, on Windows from the registry), answering names of the hosts file first, instead of the C library; both are checked for changes every 5 seconds, nsrecord takes precedence over the hosts file and dnspr forwards queries to them; the C library is used if no name server is found, or with sysresolve
+- Dial on demand is removed: dialer is accepted and ignored