bughz/3proxy
1
0
Fork 0
mirror of https://github.com/3proxy/3proxy.git synced 2026-08-26 09:55:48 +08:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity
1,112 Commits 5 Branches 36 Tags 3.9 MiB
7e1ddf2e84
Commit Graph

1112 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Vladimir Dubrovin
7e1ddf2e84 Document the package repository in README 2026-08-22 11:13:20 +03:00
Vladimir Dubrovin
5908695b0f Drop the Ed25519 release key 
No published release was ever signed with it - signing was introduced after
0.9.9 - so it verifies nothing and only adds a second key for users to reason
about.
 2026-08-22 10:43:32 +03:00
Vladimir Dubrovin
7807faa71b Build rpm packages against Enterprise Linux, not Ubuntu 
rpmbuild ran directly on the Ubuntu runner, so the packages carried Ubuntu's
ABI: glibc 2.38, libssl.so.3 and libpcre2-8. No RPM distribution can satisfy
that - RHEL 9 has glibc 2.34, RHEL 8 has 2.28 and OpenSSL 1.1 - so the rpms
were installable nowhere.

Build them in AlmaLinux 8, 9 and 10 containers instead, covering supported
AlmaLinux and CentOS Stream releases. Release: 1%{?dist} already in the spec
now expands, so the packages are named el8, el9 and el10 and can coexist.

Two spec changes are needed for a build outside Ubuntu:

debug_package is disabled. Enterprise Linux enables debuginfo extraction by
default while Ubuntu's rpm does not; the build produces no debug sources, so
rpmbuild aborted on an empty debugsourcefiles.list.

/bin/3proxy is excluded from automatic requires. The installed configuration
file is executable and begins with #!/bin/3proxy, so rpm generates a
dependency on it. rpm 4.16 and later canonicalise that to /usr/bin/3proxy
while %files declares /bin/3proxy, leaving a dependency that can never be
satisfied and making the package uninstallable on el9 and el10.

Enterprise Linux has no 32-bit ARM, so the armhf workflow now builds only the
deb package.
 2026-08-22 10:43:32 +03:00
Vladimir Dubrovin
d2fa99fbd4 Fix library detection under shells whose echo does not expand escapes 
The OpenSSL, wolfSSL, PCRE2 and PAM probes built their test program with
echo "...\n...". make runs recipes through /bin/sh, which is dash on Debian
and Ubuntu, where the builtin echo expands \n. On distributions where /bin/sh
is bash - every RPM based distribution, and macOS - it does not, so the probe
compiled

    #include <openssl/ssl.h>n int main(){return 0;}

which is not valid C. Every probe therefore failed and the build silently
dropped TLS, PCRE2 and PAM support with no diagnostic.

Use printf, which expands escapes the same way everywhere.
 2026-08-22 10:43:32 +03:00
Vladimir Dubrovin
1e019bad0e Switch release signing to an RSA-4096 key 
rpm 4.14 (RHEL/CentOS/Rocky 8) cannot import an Ed25519 public key at all:
the import fails and package verification reports SIGNATURES NOT OK. RHEL 8
is supported until 2029 and is a realistic target for a signed package repo,
so the Ed25519 key excludes a large part of the rpm audience.

Publish an RSA-4096 signing key as 3proxy-release-key.asc and keep the old
Ed25519 key as 3proxy-release-key-ed25519.asc so artifacts up to 0.9.9 stay
verifiable. Workflows derive the key id from the imported secret key, so no
workflow change is needed.
 2026-08-21 17:45:20 +03:00
Vladimir Dubrovin
86ad7263a6 rpm signing: accept non-RSA signature headers 
The release key is ed25519, so rpm stores the header signature in
DSAHEADER (EdDSA/SHA256) and RSAHEADER is empty. The verification only
looked at RSAHEADER and failed correctly signed packages.
 2026-08-21 15:34:30 +03:00
Vladimir Dubrovin
55761128b3 rpm signing: pass the passphrase explicitly, add diagnostics on failure 
Do not rely on the gpg-agent passphrase cache surviving between steps:
the signing command gets the passphrase from a file. A test signature is
made first, so a wrong passphrase or a key which can not sign fails with
a clear gpg error instead of an rpm which is silently left unsigned.
On failure the rpm version, the sign command and the key capabilities are
printed.
 2026-08-21 13:13:03 +03:00
Vladimir Dubrovin
b68887b6f9 Fix rpm signing: point %__gpg at the real gpg binary 
rpm on Debian/Ubuntu defaults %__gpg to /usr/bin/gpg2, which does not exist,
so rpm --addsign failed with 'Could not exec gpg' and packages were left
unsigned.
 2026-08-21 13:01:57 +03:00
Vladimir Dubrovin
e9b8f37053 publish PGP key 2026-08-21 11:23:51 +03:00
Vladimir Dubrovin
21346cb2ce Use latest tag in verification example on master 2026-08-21 11:08:11 +03:00
Vladimir Dubrovin
fa43cafd58 Sign packages, publish checksums, attest before upload, narrow permissions 
GPG signing of rpm packages and detached signatures for deb packages and
for the SHA256SUMS files, using GPG_PRIVATE_KEY / GPG_PASSPHRASE secrets.
Checksums are published as release assets.

Build provenance is attested before the assets are uploaded, so a failed
attestation does not leave unattested files published.

Workflow permissions are read-only, write permissions are requested per
job only where they are used.
 2026-08-21 11:07:54 +03:00
Vladimir Dubrovin
8f62e42e7d Update README.md 2026-08-20 20:13:41 +03:00
Vladimir Dubrovin
f4ad34c35a Rework docker workflow, add build provenance attestations 
Docker: single workflow, one job per image per platform instead of one
workflow per registry. Platforms are built in parallel and pushed by
digest, then combined into a manifest list pushed to Docker Hub and GHCR
at once, so both registries get identical digests. arm64 and arm/v7 build
on native arm runners, ppc64le is dropped.

Registry provenance/sbom attestations are disabled (they were shown as
unknown/unknown entries in the registries), build provenance is attested
with actions/attest-build-provenance instead and is verifiable with
'gh attestation verify oci://...'. Release binaries (rpm, deb, zip) are
attested the same way. cosign version is pinned and images are signed by
digest.
 2026-08-20 20:04:30 +03:00
Vladimir Dubrovin
ff3398c6a9 Commit as 0.9.9
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
Details
2026-08-20 18:32:25 +03:00
Vladimir Dubrovin
4fb5c95704 Print error on non-zero local redirection in conf
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
Details
2026-08-12 17:08:09 +03:00
Vladimir Dubrovin
13a57812e5 Fix: -Ne/-Ni, -4 / -6 handling for udp mapping in socks, mixed family support in udp 2026-08-12 16:25:12 +03:00
Vladimir Dubrovin
a43c95023d Check DNS reply source in udpresolve 2026-08-12 15:32:30 +03:00
Vladimir Dubrovin
75021a2003 Update highload.html 2026-08-12 14:49:44 +03:00
Vladimir Dubrovin
bebc3894e2 Support acls for UDP ASSOC, fix udppm via SOCKSv5
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-08-11 19:02:54 +03:00
Vladimir Dubrovin
ddb74a111c remove dead code
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-08-10 19:14:33 +03:00
Vladimir Dubrovin
1e47e74c49 FIx: support extip / ha for SOCKSv5 udp associate 2026-08-10 17:18:57 +03:00
Vladimir Dubrovin
eca362af81 FIx: UDPASSOC via parent broken after previous commits
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-08-10 11:18:56 +03:00
Vladimir Dubrovin
c31fe8367f Minor FilePlugin cleanup
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
Details
2026-08-08 23:06:36 +03:00
Vladimir Dubrovin
f480c9dfe8 Do not try non-SOCKSv5 proxies for UDPASSOC 2026-08-08 22:58:41 +03:00
Vladimir Dubrovin
8de2be3b3b fix socket leak on failed UDPASSOC parent 2026-08-08 22:11:25 +03:00
Vladimir Dubrovin
aea9ff8c94 Fix warnings 2026-08-08 21:58:53 +03:00
Vladimir Dubrovin
e7bc76da73 Restore half-close support by default (accidentally switched off in previous fixes) 2026-08-08 21:34:15 +03:00
Vladimir Dubrovin
207ddb7f02 Fix: descriptors leak in proxy.c 2026-08-08 21:31:54 +03:00
Vladimir Dubrovin
f5ff81d0bc remove dead code
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-08-08 21:10:57 +03:00
Vladimir Dubrovin
8c2ad56665 Use memmove for overlapping region 2026-08-08 20:46:52 +03:00
Vladimir Dubrovin
a986ed7a07 Add linger timeout 2026-08-08 19:13:02 +03:00
Vladimir Dubrovin
eceb5a22df Add outsize parameter to en64 2026-08-08 17:58:49 +03:00
Vladimir Dubrovin
7eba73fc8f
Create SECURITY.md 2026-08-08 17:29:57 +03:00
Vladimir Dubrovin
122ca26249 Fix windows build, re-submit as 0.9.8
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-08-07 19:16:00 +03:00
Vladimir Dubrovin
6369fe966e fix rh spec file for imapp 2026-08-07 18:00:43 +03:00
Vladimir Dubrovin
cb27ca5223 Commit as 0.9.8 2026-08-07 17:45:37 +03:00
Vladimir Dubrovin
932c4e3fd9 Fix use-after-free on ftp:// request path in proxychild() 
ss pointed into the buf request buffer and was never updated when buf
was realloc()ed while reading request headers (both in the header loop
and in handlehdrfilterscli()). The ftp:// branch then dereferenced the
stale pointer.

Store ss as an offset into buf and recompute it before use.

Requires authenticated access to proxy or configuration with
authentication disabled.

Reported by Calif.io in collaboration with Anthropic
(ref ANT-2026-FHVKZ7VQ).
 2026-08-07 16:36:51 +03:00
dependabot[bot]
6818872f63
Bump docker/build-push-action from 6 to 7 (#1261) 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:29:45 +03:00
dependabot[bot]
81a4e5bae3
Bump actions/checkout from 4 to 7 (#1260) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:29:06 +03:00
Vladimir Dubrovin
0ae2754c1e make html formatting compatible with .md
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Has been cancelled
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Has been cancelled
Details
2026-08-01 11:47:50 +03:00
Vladimir Dubrovin
05f83896bf Update 3proxy.cfg.5.html 2026-08-01 11:15:53 +03:00
Vladimir Dubrovin
f668a34910 Correct example in howto 2026-08-01 11:11:26 +03:00
Vladimir Dubrovin
763e21e053 Fixed: maxchild dropped to 100 on config reload if not explicitly set, system-specific tuning hints added to doc 2026-08-01 10:22:03 +03:00
Vladimir Dubrovin
7b85f6a684 Disable splice support
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-08-01 09:38:49 +03:00
Vladimir Dubrovin
92d3b08dd2 fix arm64 docker build
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-07-31 19:44:04 +03:00
Vladimir Dubrovin
4877b39f2c Fix deadcode / warnings / minor bugs 2026-07-31 18:55:59 +03:00
Vladimir Dubrovin
44c47ee7d9 replace recursion with loop for local redirects, fix wolfSSL build
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
Details
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
Details
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
Details
2026-07-31 15:44:22 +03:00
Vladimir Dubrovin
5f1ed7363b Fix: race conditions / stack overflow on FreeBSD / minor bugs 2026-07-31 13:27:33 +03:00
Vladimir Dubrovin
c370635fc4 fix wolfSSL, switch minimal/busybox to musl+wolfssl 2026-07-31 11:27:10 +03:00
Vladimir Dubrovin
3bfabb29f8 pass -fPIC for plugins (so) only
Some checks failed
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Has been cancelled
Details
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Has been cancelled
Details
2026-07-28 18:59:02 +03:00