NTLM authentication of proxy clients was gone but for what was left of
it: the 407 answer offering NTLM before Basic (12, under NOCRYPT, which
nothing else used) and the one for its handshake (13), sent by nothing,
and the prototypes of genchallenge() and mschap(), defined nowhere. The
strings after them in proxy_stringtable move up two: 403 with <pre> is
12, 503 13, 401 of the FTP server 14, 100 Continue 15.
rus.3ps, StringsPlugin's translation, follows: the two strings go, the
403 with <pre> is UTF-8 as the rest, the XML of the running services
has its Content-disposition, and the table of counters the columns of
its rows (Action and #/Description were one).
NT: passwords, MD4 hashes as Windows keeps them, stay. The documents
no longer tell to give proxy -n to turn off NTLM.
Plugin binary compatibility: a plugin indexing proxy_stringtable finds
the strings from 12 on two places earlier, and a .3ps file of its own
with the NTLM strings has two more than 3proxy (StringsPlugin warns).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Names are resolved with getaddrinfo(), thread-safe everywhere: what was
left of gethostbyname() (my_gethostbyname() over gethostbyname_r(), in
its glibc and Solaris forms, GETHOSTBYNAME_R, the mutex for the plain
one) served only the IPv4-only resolver already gone. Makefile.Solaris
(Sun's compiler, _SOLARIS) and Makefile.unix go: CMake builds for the
other systems; the documents say so, and their examples use
Makefile.FreeBSD.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tlspr splits the ClientHello it passes in the middle of the server name
(SNI) when the service has s_option, set by -s. In builds with splice()
(Linux, the default there) -s is splice for every service but UDP ones,
admin and httpsrv, so the split was never made, and the How-To's SNI
break did nothing on Linux.
-B sets it whatever the build: for TCP services but admin and httpsrv,
where s_option has a meaning of its own. -s still does it where it is
not splice. The How-To, 3proxy.cfg(5) and tlspr(8) give -B.
Fixes#1283
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nserver and authnserver parse their argument with parsehost(), which reads
the first colon as the address/port separator, so a bare IPv6 address picks
up a bogus port number. Document the bracket form in 3proxy.cfg(5) and in
both HOWTOs.
Refs #1275, #460
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The CA was created with no extensions, so it is not usable as a CA and
clients report that they cannot get the local issuer certificate. Add
basicConstraints, keyCertSign and a subject key identifier, in a file
rather than through -addext, which LibreSSL - the openssl on macOS and some
BSDs - does not apply the same way.
Ask for the key identifiers on the signed certificates too: OpenSSL 3 adds
them when it signs and LibreSSL does not, and Python has verified strictly
since 3.13, refusing a chain whose certificate carries no
authorityKeyIdentifier. Finish with openssl verify -x509_strict, which is
the check the client will make.
Both recipes were run against OpenSSL 3.6 and LibreSSL 3.3: the old one
fails strict verification, the new one passes on both.
After 'parent ha' sends the PROXY v1 header, continue negotiating the
real parent protocol (SOCKS5/CONNECT/etc.) instead of returning early.
'ha' used alone still sends the header and relays plain TCP.
- sockmapping rewritten from stratch to minimilse polling. poll() is now
only called if blocking is actually expected, splice pipes are now
polled if splice fails, buffers flushing is much more accurate.
- logging code moved to separate files
- signal masks added to client threads to prevent unneeded interruptions
- bandwidth limitation will not delay the thread after client or server
shutdown
