From 5af6147a4116e49398b2a0a9129943930925f24f Mon Sep 17 00:00:00 2001
From: Vladimir Dubrovin <3proxy@3proxy.ru>
Date: Sat, 29 Aug 2026 23:53:59 +0300
Subject: [PATCH] -Xftp flag for http proxy

---
 man/3proxy.cfg.5 | 9 ++++++++-
 src/conf.c       | 3 +++
 src/proxy.c      | 4 ++++
 src/proxymain.c  | 6 ++++++
 src/structures.h | 1 +
 5 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/man/3proxy.cfg.5 b/man/3proxy.cfg.5
index 950ba4c..fc2e38c 100644
--- a/man/3proxy.cfg.5
+++ b/man/3proxy.cfg.5
@@ -244,6 +244,12 @@ Never ask for username/password
 .br
 .B -a2
 (for proxy) generate Via: and X-Forwarded-For: instead of Forwarded:
+.br
+.B -Xftp
+(for proxy) fetch \fBftp://\fR URLs, in a build with FTP support. Without
+this the scheme is not one the service knows, whatever the build: fetching it
+opens a second connection and builds a listing, which a service serving http
+has no use for.
 .br
  Also, all options mentioned for 
 .BR proxy (8)
@@ -1580,7 +1586,8 @@ authentication and/or allow/deny ACLs.
 The mail proxies and FTP are built when they are asked for, and are not in a
 default build. \fBMAILPROXY=true\fR builds \fBpop3p\fR, \fBimapp\fR and
 \fBsmtpp\fR, and \fBFTP=true\fR builds \fBftppr\fR and the \fBftp://\fR
-scheme of the HTTP proxy; with CMake the switches are
+scheme of the HTTP proxy, which a \fBproxy\fR service then still has to ask
+for with \fB-Xftp\fR; with CMake the switches are
 \fB-D3PROXY_USE_MAILPROXY=ON\fR and \fB-D3PROXY_USE_FTP=ON\fR. The standalone
 binaries of those services are built with them and not without.
 .br
diff --git a/src/conf.c b/src/conf.c
index 1771159..227611f 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -187,6 +187,9 @@ static int h_proxy(int argc, unsigned char ** argv){
 		childdef.port = 3128;
 		childdef.isudp = 0;
 		childdef.service = S_PROXY;
+#ifdef WITH_FTP
+		childdef.helpmessage = " -Xftp - fetch ftp:// URLs\n";
+#endif
 #ifdef NOIPV6
 		if(!resolvfunc || (resolvfunc == myresolver && !dns_table.poolsize)){
 			fprintf(stderr, "[line %d] Warning: no nserver/nscache configured, proxy may run very slow\n", linenum);
diff --git a/src/proxy.c b/src/proxy.c
index 811f0af..c8e7183 100644
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -387,6 +387,7 @@ for(;;){
 	}
 #ifdef WITH_FTP
 	else if (!strncasecmp((char *)sb, "ftp://", 6)) {
+		if(!param->srv->allowftp) RETURN(513);
 		ftp = 1;
 		sb += 6;
 	}
@@ -1357,6 +1358,9 @@ struct proxydef childdef = {
 	S_PROXY,
 	"-a - anonymous proxy\r\n"
 	"-a1 - anonymous proxy with random client IP spoofing\r\n"
+#ifdef WITH_FTP
+	"-Xftp - fetch ftp:// URLs\r\n"
+#endif
 };
 #include "proxymain.c"
 #endif
diff --git a/src/proxymain.c b/src/proxymain.c
index 89c14c2..b494a97 100644
--- a/src/proxymain.c
+++ b/src/proxymain.c
@@ -584,6 +584,12 @@ int MODULEMAINFUNC (int argc, char** argv){
 			if(!strncasecmp(argv[i]+2, "imap", 4)) srv.srvstarttls = S_IMAPP;
 			else if(!strncasecmp(argv[i]+2, "pop3", 4)) srv.srvstarttls = S_POP3P;
 			else if(!strncasecmp(argv[i]+2, "smtp", 4)) srv.srvstarttls = S_SMTPP;
+#ifdef WITH_FTP
+			/* The http proxy fetches ftp:// only where it was asked to:
+			   the protocol brings a second connection and a listing to
+			   build, which a service serving http has no use for. */
+			else if(!strncasecmp(argv[i]+2, "ftp", 3)) srv.allowftp = 1;
+#endif
 			else error = 1;
 			break;
 		 case 'F':
diff --git a/src/structures.h b/src/structures.h
index 459a6a5..c647c7f 100644
--- a/src/structures.h
+++ b/src/structures.h
@@ -611,6 +611,7 @@ struct srvparam {
 	int haproxy;
 	int nostarttls;
 	PROXYSERVICE srvstarttls;
+	int allowftp;		/* the http proxy fetches ftp:// for this service */
 	uint32_t fakeip;
 	unsigned char fakeip6[16];
 #ifdef WITHSPLICE