allow
<userlist> <sourcelist> <targetlist>
@@ -746,8 +761,14 @@ ha send HAProxy PROXY protocol v1 header to parent
proxy. Must be the last in the proxy chain. Useful for
passing client IP information to the parent proxy. Example:
parent 1000 ha
-Use "+" proxy only with fakeresolve
-option
IP and port are
ip addres and port of parent proxy server. If IP is zero, ip
@@ -946,12 +967,16 @@ The rest of parameters is identical to
pwtype is one of:
none (empty) - use system authentication
CL - password is cleartext
-CR - password is crypt-style password
+CR - password is crypt-style password. $1$ prefix
+uses MD5-crypt (requires OpenSSL), $3$ prefix uses
+BLAKE2b-crypt (always available, see 3proxy_crypt(8))
+
NT - password is NT password (in hex)
example:
users test1:CL:password1
"test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
+users "test4:CR:$3$salt$G47yV9w...."
Note: double quotes are required because the password
contains a $ sign.
3proxy(8),
-proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8),
-syslogd(8),
+3proxy_crypt(8), proxy(8), ftppr(8), socks(8), pop3p(8),
+smtpp(8), tlspr(8), tcppm(8), udppm(8), syslogd(8),
https://3proxy.org/
-s
Split the TLS Client HELLO +packet across multiple TCP segments to make SNI-based DPI +detection harder. An optional numeric value can follow (e.g. +-s1) to control the splitting behaviour.
-l
Note: Since version 0.9.7, PCRE filtering is built into 3proxy and does not require -a separate plugin. All pcre_* commands are available directly when 3proxy is compiled with -PCRE2 support (WITH_PCRE). The plugin line is no longer needed.
- -This filtering functionality can be used to create matching and replacement -rules with regular expressions for client requests, client and -server headers, and client and server data. It adds 3 additional -configuration commands:
- --pcre TYPE FILTER_ACTION REGEXP [ACE] -pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE] -pcre_extend FILTER_ACTION [ACE] -pcre_options OPTION1 [...] --pcre - allows applying a rule for matching -
-pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 -pcre srvheader deny "Content-type: application" -pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser -pcre_extend deny * 192.168.0.1/16 -- -© Vladimir Dubrovin, License: BSD style diff --git a/doc/html/plugins/PCREPlugin.ru.html b/doc/html/plugins/PCREPlugin.ru.html deleted file mode 100644 index cff579e..0000000 --- a/doc/html/plugins/PCREPlugin.ru.html +++ /dev/null @@ -1,89 +0,0 @@ -
Примечание: Начиная с версии 0.9.7 фильтрация PCRE встроена в 3proxy и не требует -отдельного плагина. Все команды pcre_* доступны напрямую при компиляции 3proxy с поддержкой -PCRE2 (WITH_PCRE). Строка plugin больше не нужна.
- -Фильтрующий плагин используется для создания правил поиска и замены -регулярных выражений в запросе, заголовков запроса и ответа и данных. -Добавляет поддержку 3х новых команд в файле конфигурации:
- --pcre TYPE FILTER_ACTION REGEXP [ACE] -pcre_rewrite TYPE FILTER_ACTION REGEXP REWRITE_EXPRESSION [ACE] -pcre_extend FILTER_ACTION [ACE] -pcre_options OPTION1 [...] --pcre - позволяет искать совпадения -
-pcre request deny "porn|sex" user1,user2,user3 192.168.0.0/16 -pcre srvheader deny "Content-type: application" -pcre_rewrite clidata,srvdata dunno "porn|sex|pussy" "***" baduser -pcre_extend deny * 192.168.0.1/16 -- -© Vladimir Dubrovin, License: BSD style diff --git a/doc/html/plugins/SSLPlugin.html b/doc/html/plugins/SSLPlugin.html deleted file mode 100644 index b33c070..0000000 --- a/doc/html/plugins/SSLPlugin.html +++ /dev/null @@ -1,124 +0,0 @@ -
Note: Since version 0.9.7, SSL/TLS support is built into 3proxy and does not require -a separate plugin. All ssl_* commands are available directly when 3proxy is compiled with -OpenSSL support (WITH_SSL). The plugin line is no longer needed.
- -SSL/TLS support can be used to transparently decrypt SSL/TLS data, provide TLS encryption -for proxy traffic, and authenticate using client certificates.
- --ssl_server_ca_file /path/to/cafile -ssl_server_ca_key /path/to/cakey -ssl_mitm -proxy -p3128 -ssl_nomitm -proxy -p3129 --MITM's traffic with a spoofed certificate for the port 3128 proxy. - -
-ssl_server_cert path_to_cert -ssl_server_key path_to_key -ssl_serv -proxy -p33128 -ssl_noserv -proxy -p3128 --Creates an https:// proxy on port 33128 and an http:// proxy on port 3128 - -
-ssl_client_cert /path/to/client.crt -ssl_client_key /path/to/client.key -ssl_client_verify -ssl_client_ca_file /path/to/ca.crt -ssl_cli -proxy -p3128 --Creates an HTTP proxy that connects to upstream servers via TLS with client certificate authentication. - -
-ssl_server_cert /path/to/server.crt -ssl_server_key /path/to/key -ssl_client_mode 3 - -auth strong -allow user1 -parent 1000 https parent1.example.com 443 -allow user2 -parent 1000 socks5 parent2.example.com 1080 -ssl_serv -ssl_cli -proxy -p3128 -ssl_noserv -ssl_nocli --Creates an HTTP proxy on port 3128 that uses TLS for client connections (ssl_serv). With ssl_client_mode 3, TLS handshake to parent proxy is performed only if the parent type ends with 's' (secure types). In this example, user1's traffic goes through an https parent proxy with TLS encryption, while user2's traffic goes through a regular socks5 parent without TLS. Secure parent types include: tcps, https, connects, connect+s, socks4s, socks5s, socks4+s, socks5+s, pop3s, smtps, ftps. - -
-ssl_server_cert /path/to/server.crt -ssl_server_key /path/to/server.key -ssl_server_ca_file /path/to/ca.crt -ssl_server_verify -ssl_serv -proxy -p3128 --Creates an https:// proxy that requires client certificate authentication. - -© Vladimir Dubrovin, License: BSD style diff --git a/doc/html/plugins/SSLPlugin.ru.html b/doc/html/plugins/SSLPlugin.ru.html deleted file mode 100644 index dc9238b..0000000 --- a/doc/html/plugins/SSLPlugin.ru.html +++ /dev/null @@ -1,120 +0,0 @@ -
Примечание: Начиная с версии 0.9.7 поддержка SSL/TLS встроена в 3proxy и не требует -отдельного плагина. Все команды ssl_* доступны напрямую при компиляции 3proxy с поддержкой -OpenSSL (WITH_SSL). Строка plugin больше не нужна.
- -Плагин можно использовать для перехвата и дешифровки SSL/TLS трафика, для шифрования трафика прокси-сервера и аутентификации с помощью клиентских сертификатов.
- --ssl_server_ca_file /path/to/cafile -ssl_server_ca_key /path/to/cakey -ssl_mitm -proxy -p3128 -ssl_nomitm -proxy -p3129 --Перехватывается трафик в прокси на порту 3128. - -
-ssl_server_cert path_to_cert -ssl_server_key path_to_key -ssl_serv -proxy -p33128 -ssl_noserv -proxy -p3128 --На порту 33128 создается https:// прокси, на порту 3128 - http:// прокси. - -
-ssl_client_cert /path/to/client.crt -ssl_client_key /path/to/client.key -ssl_client_verify -ssl_client_ca_file /path/to/ca.crt -ssl_cli -proxy -p3128 --Создается HTTP-прокси, который соединяется с вышестоящими серверами через TLS с аутентификацией по клиентскому сертификату. - -
-ssl_server_cert /path/to/server.crt -ssl_server_key /path/to/key -ssl_client_mode 3 - -auth strong -allow user1 -parent 1000 https parent1.example.com 443 -allow user2 -parent 1000 socks5 parent2.example.com 1080 -ssl_serv -ssl_cli -proxy -p3128 -ssl_noserv -ssl_nocli --Создается HTTP-прокси на порту 3128, использующий TLS для клиентских соединений (ssl_serv). При ssl_client_mode 3 TLS-рукопожатие с родительским прокси выполняется только если тип parent прокси заканчивается на 's' (защищённые типы). В данном примере трафик user1 идёт через https родительский прокси с TLS-шифрованием, а трафик user2 — через обычный socks5 родитель без TLS. Защищённые типы parent прокси: tcps, https, connects, connect+s, socks4s, socks5s, socks4+s, socks5+s, pop3s, smtps, ftps. - -
-ssl_server_cert /path/to/server.crt -ssl_server_key /path/to/server.key -ssl_server_ca_file /path/to/ca.crt -ssl_server_verify -ssl_serv -proxy -p3128 --Создается https:// прокси, требующий аутентификацию по клиентскому сертификату. - -© Vladimir Dubrovin, License: BSD style diff --git a/man/3proxy.cfg.5 b/man/3proxy.cfg.5 index f536b41..d238a65 100644 --- a/man/3proxy.cfg.5 +++ b/man/3proxy.cfg.5 @@ -591,8 +591,7 @@ This is the default authentication type Appropriate for most cases .br \fBuseronly\fR - authentication by username without checking for any password with -authorization by ACLs. Useful for e.g. SOCKSv4 proxy and icqpr (icqpr set UIN / -AOL screen name as a username) +authorization by ACLs. Useful for e.g. SOCKSv4 proxy. .br \fBdnsname\fR - authentication by DNS hostname with authorization by ACLs. The DNS hostname is resolved via a PTR (reverse) record and validated (the resolved @@ -604,6 +603,11 @@ NB: there is no password check; the name may be spoofed. SOCKSv5, FTP, POP3 and HTTP proxy. .br \fBcache\fR - cached authentication, may be used with \'authcache\'. +.br + \fBcacheacl\fR - cached authentication, same as \fBcache\fR but the ACL +authorization result is also cached and not re-evaluated on each request. Faster +than \fBcache\fR, but ACL changes do not take effect for cached users until the +cache entry expires. Use \fBcache\fR if ACLs may change during the cache lifetime. .br \fBradius\fR - authentication with RADIUS. .br @@ -641,11 +645,25 @@ assigned to the same user without actual authentication. .br \fBlimit\fR - limit user to use only one ip, \'ip\' and \'user\' are required .br - \fBack\fR - only use cached auth if user access service with same ACL + \fBacl\fR - only use cached auth if user access service with same ACL .br \fBext\fR - cache external IP .br -Use auth type \fBcache\fR for cached authentication + \fBdstaddr\fR - cache by destination IP address +.br + \fBdstport\fR - cache by destination port +.br + \fBdsthost\fR - cache by destination hostname +.br + \fBdstoper\fR - cache by destination operation (e.g. HTTP method) +.br + \fBsrvaddr\fR - cache by service (listener) address +.br + \fBsrvport\fR - cache by service (listener) port +.br +Multiple types can be combined (e.g. \fBip,user,dstaddr,dstport\fR). +.br +Use auth type \fBcache\fR (or \fBcacheacl\fR) for cached authentication .br .BR allow @@ -808,6 +826,12 @@ in the proxy chain. Useful for passing client IP information to the parent proxy Example: parent 1000 ha .br Use "+" proxy only with \fBfakeresolve\fR option +.br +Any parent type above can be suffixed with \fBs\fR (e.g. \fBhttps\fR, +\fBtcps\fR, \fBsocks5s\fR, \fBconnect+s\fR) to establish a TLS-encrypted +connection to the parent proxy. Requires SSL/TLS support (WITH_SSL) and is +used with \fBssl_client_mode 3\fR, which only handshakes TLS for \fBs\fR-suffixed +parents. .br IP and port are ip addres and port of parent proxy server. @@ -1047,7 +1071,9 @@ the format: .br \fBCL\fR - password is cleartext .br - \fBCR\fR - password is crypt-style password + \fBCR\fR - password is crypt-style password. \fB$1$\fR prefix uses MD5-crypt +(requires OpenSSL), \fB$3$\fR prefix uses BLAKE2b-crypt (always available, see +.BR 3proxy_crypt (8)) .br \fBNT\fR - password is NT password (in hex) .br @@ -1056,6 +1082,8 @@ the format: users test1:CL:password1 "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49." .br users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63 +.br + users "test4:CR:$3$salt$G47yV9w...." .br Note: double quotes are required because the password contains a $ sign. @@ -1356,7 +1384,7 @@ authentication and/or allow/deny ACLs. Report all bugs to .BR 3proxy@3proxy.org .SH SEE ALSO -3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8), +3proxy(8), 3proxy_crypt(8), proxy(8), ftppr(8), socks(8), pop3p(8), smtpp(8), tlspr(8), tcppm(8), udppm(8), syslogd(8), .br https://3proxy.org/ .SH AUTHORS diff --git a/man/tlspr.8 b/man/tlspr.8 index d9a30c9..ede7847 100644 --- a/man/tlspr.8 +++ b/man/tlspr.8 @@ -75,6 +75,9 @@ destination_port. Port to establish outgoing connections. Required unless the Tr .B -c TLS_CHECK_LEVEL. 0 (default) - allow non-TLS traffic to pass, 1 - require TLS, only check client HELLO packet, 2 - require TLS, check both client and server HELLO, 3 - require TLS, check that the server sends a certificate (not compatible with TLS 1.3), 4 - require mutual TLS, check that the server sends a certificate request and the client sends a certificate (not compatible with TLS 1.3) .TP +.B -s +Split the TLS Client HELLO packet across multiple TCP segments to make SNI-based DPI detection harder. An optional numeric value can follow (e.g. \fB-s1\fR) to control the splitting behaviour. +.TP .B -l Log. By default logging is to stdout. If .I logfile