Name the HTTPSRV service in the string table

S_HTTPSRV, the type of admin and httpsrv services, was added before
S_ZOMBIE without a name in the string table, so its index held
"ZOMBIE": the admin services page, %N in logs and RADIUS named admin
and httpsrv services and their clients ZOMBIE, and a zombie service had
no name at all (NULL). Index 21 is now "HTTPSRV", 22 "ZOMBIE"; 22 was
unused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/build-ipk.yml

@@ -124,7 +124,7 @@ jobs:
 
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.ipk

.github/workflows/build-rpm-arm64.yml

@@ -175,7 +175,7 @@ jobs:
        gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.rpm

.github/workflows/build-rpm-armhf.yml

@@ -107,7 +107,7 @@ jobs:
        gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.deb

.github/workflows/build-rpm-x86-64.yml

@@ -176,7 +176,7 @@ jobs:
        gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.rpm

.github/workflows/build-watcom.yml

@@ -40,6 +40,8 @@ jobs:
       run: |
        echo "volatile char VerSion[]=^"3APA3A-3proxy-Internal-Build: 3proxy-%RELEASE%-%NOW%\r\n^";" >>src/3proxy.c
        nmake /F Makefile.watcom
+       if errorlevel 1 exit /b 1
+       if not exist bin\3proxy.exe (echo bin\3proxy.exe was not built & exit /b 1)
     - name: make dist dir
       shell: cmd
       run: |
@@ -95,7 +97,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-lite
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/build-win32.yml

@@ -101,7 +101,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-x86
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/build-win64.yml

@@ -102,7 +102,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-x64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/build-winarm64.yml

@@ -101,7 +101,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/c-cpp-Linux.yml

@@ -2,9 +2,9 @@ name: C/C++ CI Linux
 
 on:
   push:
-    paths: [ '**.c', '**.h', 'Makefile.Linux', '.github/configs', '.github/workflows/c-cpp-Linux.yml' ]
+    paths: [ '**.c', '**.h', 'Makefile.Linux', 'tests/**', '.github/configs', '.github/workflows/c-cpp-Linux.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "Makefile.Linux", ".github/configs", ".github/workflows/c-cpp-Linux.yml" ]
+    paths: [ "**.c", "**.h", "Makefile.Linux", "tests/**", ".github/configs", ".github/workflows/c-cpp-Linux.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -27,7 +27,9 @@ jobs:
       if: ${{ startsWith(matrix.target, 'ubuntu') }}
       run: sudo apt-get update && sudo apt-get install -y libssl-dev libpam-dev libpcre2-dev
     - name: make
-      run: make -f Makefile.Linux
+      run: make -f Makefile.Linux MAILPROXY=true FTP=true
+    - name: regression tests
+      run: python3 tests/run.py
     - name: mkdir
       run: mkdir ~/3proxy
     - name: make install

.github/workflows/c-cpp-MacOS.yml

@@ -2,9 +2,9 @@ name: C/C++ CI MacOS
 
 on:
   push:
-    paths: [ '**.c', '**.h', 'Makefile.FreeBSD', '.github/configs', '.github/workflows/c-cpp-MacOS.yml' ]
+    paths: [ '**.c', '**.h', 'Makefile.FreeBSD', 'tests/**', '.github/configs', '.github/workflows/c-cpp-MacOS.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "Makefile.FreeBSD", ".github/configs", ".github/workflows/c-cpp-MacOS.yml" ]
+    paths: [ "**.c", "**.h", "Makefile.FreeBSD", "tests/**", ".github/configs", ".github/workflows/c-cpp-MacOS.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -29,5 +29,7 @@ jobs:
       env:
        LDFLAGS: "-L/usr/local/lib -L/opt/homebrew/lib -L/opt/homebrew/opt/openssl/lib"
        CFLAGS: "-I/usr/local/include -I/opt/homebrew/include -I/usr/local/opt/openssl/include -I/opt/homebrew/opt/openssl/include"
+    - name: regression tests
+      run: python3 tests/run.py
     - name: make clean MacOS
       run: make -f Makefile.FreeBSD clean

.github/workflows/c-cpp-Windows.yml

@@ -2,9 +2,9 @@ name: C/C++ CI Windows
 
 on:
   push:
-    paths: [ '**.c', '**.h', 'Makefile.msvc', '.github/configs', '.github/workflows/c-cpp-Windows.yml' ]
+    paths: [ '**.c', '**.h', 'Makefile.msvc', 'tests/**', '.github/configs', '.github/workflows/c-cpp-Windows.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "Makefile.msvc", ".github/configs", ".github/workflows/c-cpp-Windows.yml" ]
+    paths: [ "**.c", "**.h", "Makefile.msvc", "tests/**", ".github/configs", ".github/workflows/c-cpp-Windows.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -27,6 +27,10 @@ jobs:
       env:
        LDFLAGS: '-L "c:/msys64/mingw64/lib"'
        CFLAGS: '-I "c:/msys64/mingw64/include"'
+    - name: regression tests (MinGW)
+      run: |
+       $env:PATH = "c:\msys64\mingw64\bin;$env:PATH"
+       python tests\run.py --bin bin\3proxy.exe
     - name: make clean Windows
       run: make -f Makefile.win clean
     - name: Add msbuild to PATH
@@ -40,4 +44,6 @@ jobs:
        set "LIB=%LIB%;c:/vcpkg/installed/x64-windows-static/lib;c:/vcpkg/installed/x64-windows/lib"
        set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x64-windows-static/include;c:/vcpkg/installed/x64-windows/include"
        nmake /F Makefile.msvc WOLFSSL=1 || exit /b 1
+       set "PATH=%PATH%;c:/vcpkg/installed/x64-windows/bin"
+       python tests\run.py --bin bin\3proxy.exe || exit /b 1
        nmake /F Makefile.msvc clean

.github/workflows/c-cpp-cmake.yml

@@ -2,9 +2,9 @@ name: C/C++ CI cmake
 
 on:
   push:
-    paths: [ '**.c', '**.h', '**.cmake', 'CMakeLists.txt', '.github/configs', '.github/workflows/c-cpp-cmake.yml' ]
+    paths: [ '**.c', '**.h', '**.cmake', 'CMakeLists.txt', 'tests/**', '.github/configs', '.github/workflows/c-cpp-cmake.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "**.cmake", "CMakeLists.txt", ".github/configs", ".github/workflows/c-cpp-cmake.yml" ]
+    paths: [ "**.c", "**.h", "**.cmake", "CMakeLists.txt", "tests/**", ".github/configs", ".github/workflows/c-cpp-cmake.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -43,7 +43,9 @@ jobs:
        cmake --build .
        mkdir ~/3proxy
        DESTDIR=~/3proxy cmake --install .
-       cd .. && rm -rf build/
+       cd ..
+       python3 tests/run.py --bin build/bin/3proxy
+       rm -rf build/
     - name: make with CMake Win
       if: ${{ startsWith(matrix.target, 'windows') }}
       shell: cmd
@@ -56,6 +58,8 @@ jobs:
        dir
        cmake --build .
        cd ..
+       set "PATH=%PATH%;c:/vcpkg/installed/x64-windows/bin"
+       python tests\run.py || exit /b 1
        rmdir /s /q build
 
   wolfssl:
@@ -71,4 +75,6 @@ jobs:
        cd build
        cmake ..
        cmake --build .
-       cd .. && rm -rf build/
+       cd ..
+       python3 tests/run.py --bin build/bin/3proxy
+       rm -rf build/

.github/workflows/docker.yml

@@ -94,16 +94,16 @@ jobs:
         include:
           - image: full
             suffix: ''
-            floating: lts
+            floating: latest
           - image: busybox
             suffix: .busybox
-            floating: lts-busybox
+            floating: busybox
           - image: minimal
             suffix: .minimal
-            floating: lts-minimal
+            floating: minimal
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: /tmp/digests
           pattern: digests-${{ matrix.image }}-*
@@ -171,14 +171,14 @@ jobs:
           echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
 
       - name: Attest Docker Hub image
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.DOCKERHUB_IMAGE }}
           subject-digest: ${{ steps.digest.outputs.digest }}
           push-to-registry: false
 
       - name: Attest GHCR image
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.GHCR_IMAGE }}
           subject-digest: ${{ steps.digest.outputs.digest }}

.github/workflows/update-docs.yml

@@ -0,0 +1,52 @@
+name: Update HTML documentation
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'man/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  docs:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+
+    - name: Install groff
+      run: |
+       sudo apt-get update
+       sudo apt-get install -y groff
+
+    - name: Generate HTML from man pages
+      run: |
+       mkdir -p doc/html/man5 doc/html/man8
+       echo \<html\>\<title\>3proxy documentation\</title\>\<body\>\<h2\>3proxy documentation\</h2\> >doc/html/index.html
+       echo \<a href=\"securityen.html\"\>Security recommendations\</a\>\<br\> >>doc/html/index.html
+       echo \<a href=\"highload.html\"\>Optimizing 3proxy for high loads\</a\>\<br\> >>doc/html/index.html
+       echo \<a href=\"howtoe.html\"\>How To \(English, very incomplete\)\</a\>\<br\> >>doc/html/index.html
+       echo \<a href=\"howtor.html\"\>How To \(Russian\)\</a\>\<br\> >>doc/html/index.html
+       echo \<a href=\"devref.html\"\>Developer reference\</a\>\<br\> >>doc/html/index.html
+       echo \<h3\>Man pages:\</h3\> >>doc/html/index.html
+       cd man
+       for i in *.8; do ((bash -c "groff -mandoc -Thtml $i | grep -v DOCTYPE| grep -v text/css| grep -v 'meta ' | grep -v /style |  grep -v { |  grep -v /title | grep -v www.w3.org | grep -v CreationDate" > ../doc/html/man8/$i.html ) && echo \<br\>\<A HREF=\"man8/$i.html\"\>$i\</A\> >> ../doc/html/index.html); done
+       for i in *.5; do ((bash -c "groff -mandoc -Thtml $i | grep -v DOCTYPE| grep -v text/css| grep -v 'meta ' | grep -v /style |  grep -v { |  grep -v /title | grep -v www.w3.org | grep -v CreationDate" > ../doc/html/man5/$i.html ) && echo \<br\>\<A HREF=\"man5/$i.html\"\>$i\</A\> >> ../doc/html/index.html); done
+       cd ..
+       echo \</body\>\</html\> >>doc/html/index.html
+
+    - name: Commit
+      run: |
+       if [ -z "$(git status --porcelain doc/html)" ]; then
+         echo "documentation already up to date"
+         exit 0
+       fi
+       git config user.name "github-actions[bot]"
+       git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+       git add doc/html
+       git commit -m "Update HTML documentation from man pages"
+       git push

.github/workflows/update-version.yml

@@ -4,6 +4,7 @@ on:
   push:
     paths:
       - RELEASE
+      - DEVEL
   workflow_dispatch:
 
 permissions:
@@ -19,12 +20,23 @@ jobs:
 
     - name: Regenerate version files
       run: |
-       RELEASE=$(tr -d ' \t\r\n' < RELEASE)
+       # A release branch carries RELEASE, a development branch DEVEL, whose
-       if [ -z "$RELEASE" ]; then echo "RELEASE is empty"; exit 1; fi
+       # version may have a suffix such as 2.0.0-devel.
-       MAJOR=$(echo "$RELEASE" | cut -d . -f 1)
+       if [ -f RELEASE ]; then VERFILE=RELEASE
-       SUBMAJOR=$(echo "$RELEASE" | cut -d . -f 2)
+       elif [ -f DEVEL ]; then VERFILE=DEVEL
-       MINOR=$(echo "$RELEASE" | cut -d . -f 3)
+       else echo "neither RELEASE nor DEVEL is present"; exit 1
-       SUBMINOR=$(echo "$RELEASE" | cut -d . -f 4)
+       fi
+       RELEASE=$(tr -d ' \t\r\n' < "$VERFILE")
+       if [ -z "$RELEASE" ]; then echo "$VERFILE is empty"; exit 1; fi
+       
+       # the numbered fields take the numeric part, the strings keep all of it
+       NUMBERS=${RELEASE%%[!0-9.]*}
+       NUMBERS=${NUMBERS%.}
+       if [ -z "$NUMBERS" ]; then echo "no version number in '$RELEASE'"; exit 1; fi
+       MAJOR=$(echo "$NUMBERS" | cut -d . -f 1)
+       SUBMAJOR=$(echo "$NUMBERS" | cut -d . -f 2)
+       MINOR=$(echo "$NUMBERS" | cut -d . -f 3)
+       SUBMINOR=$(echo "$NUMBERS" | cut -d . -f 4)
        [ -n "$SUBMAJOR" ] || SUBMAJOR=0
        [ -n "$MINOR" ] || MINOR=0
        [ -n "$SUBMINOR" ] || SUBMINOR=0
@@ -39,7 +51,10 @@ jobs:
        else
          BUILDDATE=$(date -u +%y%m%d%H%M%S)
        fi
-       echo "release $RELEASE -> $MAJOR $SUBMAJOR $MINOR $SUBMINOR, build date $BUILDDATE"
+       # rpm refuses a hyphen in Version, so a suffix becomes a tilde, which
+       # also sorts before the release of the same number
+       RPMVERSION=$(echo "$RELEASE" | tr '-' '~')
+       echo "$VERFILE $RELEASE -> $MAJOR $SUBMAJOR $MINOR $SUBMINOR, rpm $RPMVERSION, build date $BUILDDATE"
        SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
        YEAR=$(date -u -d @$SOURCE_DATE_EPOCH +%Y)
 
@@ -59,7 +74,7 @@ jobs:
 
        mv scripts/rh/3proxy.spec scripts/rh/3proxy.spec.old
        { echo "Name:           3proxy"
-         echo "Version:        $RELEASE"
+         echo "Version:        $RPMVERSION"
          echo "Release:        1%{?dist}"
          tail --lines=+4 scripts/rh/3proxy.spec.old
        } > scripts/rh/3proxy.spec
@@ -90,5 +105,5 @@ jobs:
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        git add debian/changelog scripts/rh/3proxy.spec src/version.h
-       git commit -m "Update version files for $(tr -d ' \t\r\n' < RELEASE)"
+       git commit -m "Update version files for $(tr -d ' \t\r\n' < $(test -f RELEASE && echo RELEASE || echo DEVEL))"
        git push

.github/workflows/update-wiki.yml

@@ -0,0 +1,75 @@
+name: Update wiki
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'doc/html/**'
+  workflow_run:
+    workflows: ["Update HTML documentation"]
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: update-wiki
+  cancel-in-progress: false
+
+jobs:
+  wiki:
+    # the wiki mirrors master, so a run started by anything else is not for it
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.head_branch == 'master'
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        ref: master
+
+    - name: Clone wiki
+      run: |
+       git clone --quiet \
+         "https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.wiki.git" wiki
+
+    - name: Copy documentation
+      run: |
+       cp -f doc/html/man8/3proxy.8.html        wiki/3proxy.md
+       cp -f doc/html/man8/3proxy_crypt.8.html  wiki/3proxy_crypt.md
+       cp -f doc/html/man8/ftppr.8.html         wiki/ftppr.md
+       cp -f doc/html/man8/pop3p.8.html         wiki/pop3p.md
+       cp -f doc/html/man8/imapp.8.html         wiki/imapp.md
+       cp -f doc/html/man8/proxy.8.html         wiki/proxy.md
+       cp -f doc/html/man8/smtpp.8.html         wiki/smtpp.md
+       cp -f doc/html/man8/socks.8.html         wiki/socks.md
+       cp -f doc/html/man8/tlspr.8.html         wiki/tlspr.md
+       cp -f doc/html/man8/tcppm.8.html         wiki/tcppm.md
+       cp -f doc/html/man8/udppm.8.html         wiki/udppm.md
+       cp -f doc/html/man5/3proxy.cfg.5.html    wiki/3proxy.cfg.md
+       cp -f doc/html/highload.html             wiki/High-Load.md
+       cp -f doc/html/howtoe.html               wiki/How-To.md
+       cp -f doc/html/howtor.html               "wiki/How-To-(русский).md"
+       cp -f doc/html/securityen.html           wiki/Security-recommendations.md
+       cp -f doc/html/devel/devref.html         wiki/DevelopeReference.md
+       cp -f doc/html/plugins/TransparentPlugin.html          wiki/TransparentPlugin.md
+       cp -f doc/html/plugins/StringsPlugin.html              wiki/StringsPlugin.md
+       cp -f doc/html/plugins/TrafficPlugin.html              wiki/TrafficPlugin.md
+       cp -f doc/html/plugins/WindowsAuthentication.html      wiki/WindowsAuthentication.md
+       cp -f doc/html/plugins/TransparentPlugin.ru.html       "wiki/TransparentPlugin-(русский).md"
+       cp -f doc/html/plugins/StringsPlugin.ru.html           "wiki/StringsPlugin-(русский).md"
+       cp -f doc/html/plugins/TrafficPlugin.ru.html           "wiki/TrafficPlugin-(русский).md"
+       cp -f doc/html/plugins/WindowsAuthentication.ru.html   "wiki/WindowsAuthentication-(русский).md"
+
+    - name: Commit
+      run: |
+       cd wiki
+       if [ -z "$(git status --porcelain)" ]; then
+         echo "wiki already up to date"
+         exit 0
+       fi
+       git status --short
+       git config user.name "github-actions[bot]"
+       git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+       git add -A
+       git commit -m "Update documentation from master"
+       git push

CHANGELOG

@@ -1,14 +1,25 @@
-3proxy-0.9.9.1 Released October, 10 2026
+3proxy-1.0.1 Released October, 10 2026
 
 ! Fix: crash (segmentation fault) on configuration reload (SIGUSR1) on a busy server: a closing session could still use its service after the reload had freed it; the race existed since 0.9.7, the 5 second linger added in 0.9.9 made it much more likely (#1278)
 ! Fix: -Di and -De (bind to interface) were not applied to SOCKSv5 UDP ASSOCIATE and BIND sockets, the FTP proxy data connection and connect back (#1277)
 ! Fix: SOCKSv5 UDP ASSOCIATE over IPv6: the source address of a datagram was truncated and the reply was sent to the wrong address (#1279)
 ! Fix: SOCKSv5 UDP ASSOCIATE: an access rule with host names matched any datagram sent to a literal address; the address is used as the host name now, as it is for TCP requests
+! Fix: a request rewritten with pcre_rewrite was only logged and was sent unchanged to the server on a direct connection; the rewritten path and query are what the server receives now
 ! Fix: buffer could be insufficient for the headers the HTTP proxy adds after a pcre_rewrite had grown the request
 ! Fix: heap buffer overflow in pcre_rewrite: a $N reference to a group which did not match was written out as its digits, which the space allocated for the result did not count
-! Fix: pcre_extend did nothing, the rules it appended were never consulted
+! Fix: pcre_extend did nothing, the rules it appended were never consulted; the manual described an argument the command does not take
 ! Fix: certificates generated for TLS MitM (openssl) carried no subject and authority key identifiers and were refused by strict verifiers, including macOS clients, OpenSSL with x509_strict and Python 3.13
 ! Fix: null pointer dereference in ftppr on PASS without USER and in smtpp on a user name without a host
 ! Fix: no service started with wolfSSL on glibc: the default thread stack was too small for wolfSSL thread-local storage, pthread_create() failed and the failure was not reported
-! Fix: dnspr did not work on Windows, the socket it answers from could not be bound
+! Fix: dnspr did not work on Windows; Windows builds answer UDP from a socket of their own again
++ Built-in HTTP server: httpsrv service with http rules to serve files (cached or with sendfile / TransmitFile), redirects, rewrites, fixed replies and proxypass to forward requests as the proxy does, so one port can serve both a site and a proxy; admin is httpsrv with the administration pages
++ Host names in access rules may be regular expressions with a pcre: (or regex:) prefix
++ transparent / notransparent commands: transparent proxying is built in (netfilter on Linux, pf on BSD, socket for divert-to and ipfw fwd), TransparentPlugin is removed and a configuration loading it keeps working
++ parent: weight may be written as a fraction (.5) or a percentage (50%); weight 0 is a fallback parent used only when every weighted parent of its group has failed; a failed parent is left out of the next attempt of the same connection
++ parent extport / intport: range of local ports for outgoing connections and for sockets facing the client (UDP ASSOCIATE, FTP data)
++ A parent given by host name is resolved for each connection when nserver is used, instead of once on configuration load
++ $$ in the configuration stands for a single dollar sign, a dollar inside quotes is ordinary text
++ OpenWrt package (procd init script, UCI configuration) and OpenWrt builds for mipsel_24kc, mips_24kc, arm_cortex-a7_neon-vfpv4 and aarch64_cortex-a53
+- pop3p, imapp, smtpp and ftppr are not in a default build: build with MAILPROXY=true and FTP=true (CMake: 3PROXY_USE_MAILPROXY, 3PROXY_USE_FTP); without them the mail proxies run as tlspr negotiating STARTTLS, and ftppr refuses clients
+- FTP over HTTP proxy (ftp:// URLs) is not in a default build either and has to be enabled explicitly: build with FTP=true (CMake: 3PROXY_USE_FTP), without it the HTTP proxy does not fetch ftp:// URLs
 - Windows binaries are no longer signed with a self-signed Authenticode certificate, it gave no trust and triggered antivirus false positives

CHANGELOG.rus

@@ -1,14 +1,25 @@
-3proxy-0.9.9.1 Вышел 10 Октября 2026
+3proxy-1.0.1 Вышел 10 Октября 2026
 
 ! Исправление: падение (segmentation fault) при перезагрузке конфигурации (SIGUSR1) на нагруженном сервере: закрывающаяся сессия могла обращаться к службе после того, как перезагрузка её освободила; гонка существовала с 0.9.7, а добавленная в 0.9.9 задержка закрытия (linger) в 5 секунд сделала её гораздо вероятнее (#1278)
 ! Исправление: -Di и -De (привязка к интерфейсу) не применялись к сокетам SOCKSv5 UDP ASSOCIATE и BIND, к соединению данных FTP прокси и к обратному соединению (connect back) (#1277)
 ! Исправление: SOCKSv5 UDP ASSOCIATE по IPv6: адрес отправителя датаграммы обрезался, и ответ отправлялся не на тот адрес (#1279)
 ! Исправление: SOCKSv5 UDP ASSOCIATE: правило доступа с именами хостов срабатывало для любой датаграммы, отправленной на адрес, а не на имя; теперь адрес используется как имя хоста, так же как для запросов TCP
+! Исправление: запрос, изменённый pcre_rewrite, только записывался в журнал, а при прямом соединении серверу отправлялся без изменений; теперь сервер получает изменённые путь и строку запроса
 ! Исправление: буфера могло не хватить для заголовков, добавляемых HTTP прокси, после того как pcre_rewrite увеличил запрос
 ! Исправление: переполнение буфера в куче в pcre_rewrite: ссылка $N на группу, не участвовавшую в совпадении, выводилась своими цифрами, которые не учитывались при выделении памяти под результат
-! Исправление: pcre_extend ничего не делал, добавленные им правила никогда не проверялись
+! Исправление: pcre_extend ничего не делал, добавленные им правила никогда не проверялись; в документации был описан аргумент, который команда не принимает
 ! Исправление: сертификаты, создаваемые для TLS MitM (openssl), не содержали идентификаторов ключа субъекта и издателя и отвергались строгой проверкой, в том числе клиентами macOS, OpenSSL с x509_strict и Python 3.13
 ! Исправление: обращение по нулевому указателю в ftppr при PASS без USER и в smtpp при имени пользователя без хоста
 ! Исправление: с wolfSSL на glibc не запускалась ни одна служба: стека потока по умолчанию не хватало для thread-local памяти wolfSSL, pthread_create() завершался ошибкой, о которой не сообщалось
-! Исправление: dnspr не работал в Windows, сокет, с которого он отвечает, не удавалось привязать
+! Исправление: dnspr не работал в Windows; сборки для Windows снова отвечают по UDP с отдельного сокета
++ Встроенный HTTP сервер: служба httpsrv с правилами http для отдачи файлов (из кэша или через sendfile / TransmitFile), перенаправлений, перезаписи, фиксированных ответов и proxypass для передачи запроса прокси, так что один порт может обслуживать и сайт, и прокси; admin — это httpsrv со страницами администрирования
++ Имена хостов в правилах доступа могут быть регулярными выражениями с префиксом pcre: (или regex:)
++ Команды transparent / notransparent: прозрачное проксирование встроено в 3proxy (netfilter в Linux, pf в BSD, socket для divert-to и ipfw fwd), TransparentPlugin удалён, конфигурация, загружающая его, продолжает работать
++ parent: вес можно задавать дробью (.5) или в процентах (50%); вес 0 означает резервный parent, который используется только когда отказали все parent его группы с ненулевым весом; отказавший parent исключается из следующей попытки того же соединения
++ parent extport / intport: диапазон локальных портов для исходящих соединений и для сокетов на стороне клиента (UDP ASSOCIATE, данные FTP)
++ parent, заданный именем хоста, разрешается для каждого соединения, если используется nserver, а не один раз при загрузке конфигурации
++ $$ в конфигурации обозначает одиночный знак доллара, доллар в кавычках — обычный символ
++ Пакет для OpenWrt (скрипт запуска procd, конфигурация UCI) и сборки OpenWrt для mipsel_24kc, mips_24kc, arm_cortex-a7_neon-vfpv4 и aarch64_cortex-a53
+- pop3p, imapp, smtpp и ftppr не входят в сборку по умолчанию: собирайте с MAILPROXY=true и FTP=true (CMake: 3PROXY_USE_MAILPROXY, 3PROXY_USE_FTP); без них почтовые прокси работают как tlspr с согласованием STARTTLS, а ftppr отказывает клиентам
+- FTP через HTTP прокси (адреса ftp://) также не входит в сборку по умолчанию и должен быть включён явно: собирайте с FTP=true (CMake: 3PROXY_USE_FTP), без этого HTTP прокси не обрабатывает адреса ftp://
 - Двоичные файлы для Windows больше не подписываются самоподписанным сертификатом Authenticode: доверия он не давал и вызывал ложные срабатывания антивирусов

CMakeLists.txt

@@ -4,8 +4,20 @@
 
 cmake_minimum_required(VERSION 3.16)
 
-# Read version from RELEASE file
+# Read the version. A release branch carries RELEASE, a development branch
-file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/RELEASE" PROJECT_VERSION LIMIT_COUNT 1)
+# DEVEL, whose version may have a suffix that project() will not take.
+if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/RELEASE")
+    file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/RELEASE" PROJECT_VERSION_FULL LIMIT_COUNT 1)
+elseif(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/DEVEL")
+    file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/DEVEL" PROJECT_VERSION_FULL LIMIT_COUNT 1)
+else()
+    message(FATAL_ERROR "Neither RELEASE nor DEVEL found: cannot tell the version")
+endif()
+string(STRIP "${PROJECT_VERSION_FULL}" PROJECT_VERSION_FULL)
+string(REGEX MATCH "^[0-9]+(\\.[0-9]+)*" PROJECT_VERSION "${PROJECT_VERSION_FULL}")
+if(NOT PROJECT_VERSION)
+    message(FATAL_ERROR "No version number in '${PROJECT_VERSION_FULL}'")
+endif()
 
 project(3proxy
     VERSION ${PROJECT_VERSION}
@@ -51,11 +63,15 @@ option(3PROXY_USE_OPENSSL "Enable TLS/SSL support via OpenSSL (fallback when wol
 option(3PROXY_USE_PCRE2 "Enable PCRE2 regex filtering" ON)
 option(3PROXY_USE_PAM "Enable PAM/PamAuth" ON)
 option(3PROXY_USE_ODBC "Enable ODBC support (Unix only, always ON on Windows)" OFF)
-option(3PROXY_USE_SPLICE "Build Linux splice() support, slower than read/write for most traffic (Linux only)" OFF)
+option(3PROXY_USE_SPLICE "Build Linux splice() support, used by services given -s (Linux only)" ON)
 option(3PROXY_USE_POLL "Use poll() instead of select() (Unix only)" ON)
 option(3PROXY_USE_WSAPOLL "Use WSAPoll instead of select() (Windows only)" ON)
 option(3PROXY_USE_NETFILTER "Enable Linux netfilter support (Linux only)" ON)
+option(3PROXY_USE_TRANSPARENT "Build transparent proxying support (Linux and BSD only)" ON)
 option(3PROXY_USE_UNIX_SOCKETS "Enable Unix domain socket support (Unix only)" ON)
+option(3PROXY_USE_HTTPSRV "Build the HTTP server and the admin interface on top of it" ON)
+option(3PROXY_USE_MAILPROXY "Build the pop3p, imapp and smtpp proxies" OFF)
+option(3PROXY_USE_FTP "Build FTP support: the ftppr service and ftp:// in the HTTP proxy" OFF)
 
 if(NOT WIN32 AND NOT APPLE)
     option(3PROXY_STATIC_LINK "Statically link libraries using -Wl,-Bstatic (Linux/Unix only)" OFF)
@@ -69,10 +85,13 @@ set(3PROXY_BINARY_PREFIX "3proxy_" CACHE STRING "Prefix for standalone module an
 option(3PROXY_BUILD_NONE   "Do not build standalone binaries"   OFF)
 option(3PROXY_BUILD_PROXY  "Build standalone proxy binary"  ON)
 option(3PROXY_BUILD_SOCKS  "Build standalone socks binary"  ON)
-option(3PROXY_BUILD_POP3P  "Build standalone pop3p binary"  ON)
+# The mail proxies and FTP are asked for rather than assumed: without them
-option(3PROXY_BUILD_IMAPP  "Build standalone imapp binary"  ON)
+# pop3p, imapp and smtpp are the STARTTLS proxy under those names, and ftp
-option(3PROXY_BUILD_SMTPP  "Build standalone smtpp binary"  ON)
+# is not spoken at all. A standalone binary needs the support it is made of.
-option(3PROXY_BUILD_FTPPR  "Build standalone ftppr binary"  ON)
+option(3PROXY_BUILD_POP3P  "Build standalone pop3p binary"  OFF)
+option(3PROXY_BUILD_IMAPP  "Build standalone imapp binary"  OFF)
+option(3PROXY_BUILD_SMTPP  "Build standalone smtpp binary"  OFF)
+option(3PROXY_BUILD_FTPPR  "Build standalone ftppr binary"  OFF)
 option(3PROXY_BUILD_TCPPM  "Build standalone tcppm binary"  ON)
 option(3PROXY_BUILD_UDPPM  "Build standalone udppm binary"  ON)
 option(3PROXY_BUILD_TLSPR  "Build standalone tlspr binary"  ON)
@@ -101,6 +120,9 @@ set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 if(WIN32)
     # Windows-specific configuration
     add_compile_definitions(
+        # Windows does not take a recv and a send on one socket from two
+        # threads, so a UDP service answers from a socket of its own
+        NO_SHARE_UDP_SOCKET
         WIN32
         _WIN32
         _MBCS
@@ -152,7 +174,7 @@ if(WIN32)
     endif()
 
     # Windows libraries
-    set(WINDOWS_LIBS ws2_32 advapi32 user32 kernel32 gdi32 crypt32)
+    set(WINDOWS_LIBS ws2_32 mswsock advapi32 user32 kernel32 gdi32 crypt32)
 
     # Windows plugins (always built)
     set(DEFAULT_PLUGINS
@@ -192,7 +214,6 @@ elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux")
     set(DEFAULT_PLUGINS
         StringsPlugin
         TrafficPlugin
-        TransparentPlugin
         FilePlugin
     )
 
@@ -214,7 +235,6 @@ elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD|Darwin|OpenBSD|NetBSD")
     set(DEFAULT_PLUGINS
         StringsPlugin
         TrafficPlugin
-        TransparentPlugin
         FilePlugin
     )
 
@@ -231,11 +251,41 @@ else()
     set(DEFAULT_PLUGINS
         StringsPlugin
         TrafficPlugin
-        TransparentPlugin
         FilePlugin
     )
 endif()
 
+if(3PROXY_USE_MAILPROXY)
+    add_compile_definitions(WITH_POP3P WITH_IMAPP WITH_SMTPP)
+endif()
+
+if(3PROXY_USE_FTP)
+    add_compile_definitions(WITH_FTP)
+endif()
+
+if(3PROXY_USE_HTTPSRV)
+    add_compile_definitions(WITH_HTTPSRV)
+endif()
+
+# Transparent proxying needs a redirection that leaves the original
+# destination where 3proxy reads it: the kernel on Linux, the socket on the
+# BSDs. That means netfilter, OpenBSD divert-to or FreeBSD ipfw fwd. NetBSD
+# and macOS rewrite the destination instead and are left out.
+if(3PROXY_USE_TRANSPARENT AND (CMAKE_SYSTEM_NAME STREQUAL "Linux"
+   OR CMAKE_SYSTEM_NAME MATCHES "FreeBSD|OpenBSD|NetBSD"))
+    add_compile_definitions(WITH_TRANSPARENT)
+    set(3PROXY_TRANSPARENT_BUILT ON)
+    # pf keeps the original destination in its state table, which is read
+    # through /dev/pf. macOS has the device but ships no header for it.
+    include(CheckIncludeFiles)
+    check_include_files("sys/types.h;sys/socket.h;net/if.h;net/pfvar.h" HAVE_PFVAR_H)
+    if(HAVE_PFVAR_H)
+        add_compile_definitions(WITH_PF)
+    endif()
+else()
+    set(3PROXY_TRANSPARENT_BUILT OFF)
+endif()
+
 # Unix domain sockets off: NO_UN also undefines WITH_UN if it arrives from
 # elsewhere, e.g. CFLAGS
 if(NOT 3PROXY_USE_UNIX_SOCKETS)
@@ -365,11 +415,12 @@ set(3PROXY_CORE_SOURCES
 # Object libraries for common sources (shared between executables)
 # ============================================================================
 
-# Common object library (sockmap, sockgetchar, common, log)
+# Common object library (sockmap, sockgetchar, common, sem, log)
 add_library(common_obj OBJECT
     src/sockmap.c
     src/sockgetchar.c
     src/common.c
+    src/sem.c
     src/log.c
 )
 target_include_directories(common_obj PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src)
@@ -403,6 +454,7 @@ add_library(srv_modules OBJECT
     src/auto.c
     src/socks.c
     src/webadmin.c
+    src/httpsrv.c
     src/dnspr.c
 )
 
@@ -465,6 +517,10 @@ if(PCRE2_FOUND)
     target_sources(3proxy PRIVATE src/pcre.c)
 endif()
 
+if(3PROXY_TRANSPARENT_BUILT)
+    target_sources(3proxy PRIVATE src/transparent.c)
+endif()
+
 target_include_directories(3proxy PRIVATE
     ${CMAKE_CURRENT_SOURCE_DIR}/src
     ${CMAKE_CURRENT_SOURCE_DIR}/src/libs
@@ -642,6 +698,15 @@ foreach(PROXY_NAME proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr)
         continue()
     endif()
 
+    # A binary of nothing: without the support built, these files hold the
+    # stand-in the main binary uses and no service of their own.
+    if(NOT 3PROXY_USE_MAILPROXY AND PROXY_NAME MATCHES "^(pop3p|imapp|smtpp)$")
+        continue()
+    endif()
+    if(NOT 3PROXY_USE_FTP AND PROXY_NAME STREQUAL "ftppr")
+        continue()
+    endif()
+
     if(PROXY_NAME STREQUAL "ftppr" OR PROXY_NAME STREQUAL "proxy")
         # ftppr and proxy use ftp_obj
         add_executable(${PROXY_NAME}
@@ -664,12 +729,12 @@ foreach(PROXY_NAME proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr)
         ${CMAKE_CURRENT_SOURCE_DIR}/src
     )
 
-    target_compile_definitions(${PROXY_NAME} PRIVATE
+    target_compile_definitions(${PROXY_NAME} PRIVATE WITHMAIN)
-        WITHMAIN
-        NOPORTMAP
-    )
 
-    if(NOT PROXY_NAME STREQUAL "udppm")
+    # each takes the main loop of its kind only: udppm UDP, the others TCP
+    if(PROXY_NAME STREQUAL "udppm")
+        target_compile_definitions(${PROXY_NAME} PRIVATE NOTCPMAIN)
+    else()
         target_compile_definitions(${PROXY_NAME} PRIVATE NOUDPMAIN)
     endif()
 
@@ -679,8 +744,12 @@ foreach(PROXY_NAME proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr)
         target_compile_definitions(${PROXY_NAME} PRIVATE ANONYMOUS)
     endif()
 
+    # port mappers take port, host and port as arguments, the others options
+    # only; one of the two is defined, as in src/Makefile.inc
     if(PROXY_NAME STREQUAL "tcppm" OR PROXY_NAME STREQUAL "udppm" OR PROXY_NAME STREQUAL "tlspr")
         target_compile_definitions(${PROXY_NAME} PRIVATE PORTMAP)
+    else()
+        target_compile_definitions(${PROXY_NAME} PRIVATE NOPORTMAP)
     endif()
 
     if(WIN32)
@@ -911,7 +980,7 @@ endif()
 # Summary
 message(STATUS "")
 message(STATUS "3proxy configuration summary:")
-message(STATUS "  Version: ${PROJECT_VERSION}")
+message(STATUS "  Version: ${PROJECT_VERSION_FULL}")
 message(STATUS "  Platform: ${CMAKE_SYSTEM_NAME}")
 message(STATUS "  Compiler: ${CMAKE_C_COMPILER_ID} ${CMAKE_C_COMPILER_VERSION}")
 message(STATUS "  Build type: ${CMAKE_BUILD_TYPE}")
@@ -921,6 +990,7 @@ message(STATUS "    BUILD_SHARED:    ${3PROXY_BUILD_SHARED}")
 message(STATUS "    USE_WOLFSSL:    ${3PROXY_USE_WOLFSSL}")
 message(STATUS "    USE_OPENSSL:    ${3PROXY_USE_OPENSSL}")
 message(STATUS "    USE_PCRE2:       ${3PROXY_USE_PCRE2}")
+message(STATUS "    TRANSPARENT:     ${3PROXY_TRANSPARENT_BUILT}")
 message(STATUS "    USE_PAM:         ${3PROXY_USE_PAM}")
 message(STATUS "    USE_ODBC:        ${3PROXY_USE_ODBC}")
 message(STATUS "    USE_POLL:        ${3PROXY_USE_POLL}")

Dockerfile.busybox

@@ -35,7 +35,7 @@ RUN TAG=$(curl -s https://api.github.com/repos/wolfSSL/wolfssl/releases/latest \
     make -j$(nproc) && make install
 
 FROM docker.io/alpine:latest AS buildenv
-RUN apk add --no-cache gcc make musl-dev pcre2-dev
+RUN apk add --no-cache gcc make musl-dev linux-headers pcre2-dev
 COPY --from=wolfssl /usr/local /usr/local
 COPY . 3proxy
 RUN cd 3proxy && mkdir -p bin &&\

Dockerfile.minimal

@@ -41,7 +41,7 @@ RUN TAG=$(curl -s https://api.github.com/repos/wolfSSL/wolfssl/releases/latest \
     make -j$(nproc) && make install
 
 FROM docker.io/alpine:latest AS buildenv
-RUN apk add --no-cache gcc make musl-dev
+RUN apk add --no-cache gcc make musl-dev linux-headers
 COPY --from=wolfssl /usr/local /usr/local
 COPY . 3proxy
 RUN cd 3proxy && mkdir -p bin &&\

Makefile.FreeBSD

@@ -24,6 +24,21 @@ LDFLAGS += $(EXTRA_LDFLAGS)
 # -lpthreads may be reuiured on some platforms instead of -pthreads
 # -ldl or -lld may be required for some platforms
 DCFLAGS ?= -fPIC
+MAILPROXY ?= false
+ifeq ($(MAILPROXY),true)
+    CFLAGS += -DWITH_POP3P -DWITH_IMAPP -DWITH_SMTPP
+    MAIL_EXES = $(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS)
+endif
+FTP ?= false
+ifeq ($(FTP),true)
+    CFLAGS += -DWITH_FTP
+    FTP_EXES = $(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS)
+endif
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .so
 LIBS ?=
@@ -39,7 +54,20 @@ AFTERCLEAN = (find . -type f -name "*.o" -delete && find src/ -type f -name "Mak
 TYPECOMMAND = cat
 COMPATLIBS =
 MAKEFILE = Makefile.FreeBSD
-PLUGINS ?= StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS ?= StringsPlugin TrafficPlugin FilePlugin
+
+# Transparent proxying, built in. The destination of a redirected connection
+# comes from pf where its headers are available, and from the socket where a
+# redirection leaves it there (OpenBSD divert-to, FreeBSD ipfw fwd). macOS
+# has /dev/pf but ships no pfvar.h, so only the socket route is built there
+# and no macOS redirection leaves the address on the socket.
+CFLAGS += -DWITH_TRANSPARENT
+TRANSPARENT_OBJS = transparent$(OBJSUFFICS)
+
+PF_CHECK ?= $(shell printf "\#include <sys/types.h>\\n\#include <sys/socket.h>\\n\#include <net/if.h>\\n\#include <net/pfvar.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpf.o -c - 2>/dev/null && rm testpf.o && echo true||echo false)
+ifeq ($(PF_CHECK), true)
+    CFLAGS += -DWITH_PF
+endif
 ifeq ($(STATIC), true)
     LDFLAGS += -static
     CFLAGS += -DNOPLUGINS -DNOSTDRESOLVE -DNOCRYPT
@@ -107,7 +135,7 @@ install: all
 	install -d $(DESTDIR)$(MANDIR)/man8
 	install -m 644 man/3proxy.8 $(DESTDIR)$(MANDIR)/man8/3proxy.8
 	for f in proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr; do \
-	  if [ -f man/$$f.8 ]; then install -m 644 man/$$f.8 $(DESTDIR)$(MANDIR)/man8/$(PREFIX)$$f.8; fi; \
+	  if [ -f man/$$f.8 ] && [ -f bin/$(PREFIX)$$f ]; then install -m 644 man/$$f.8 $(DESTDIR)$(MANDIR)/man8/$(PREFIX)$$f.8; fi; \
 	done
 	install -m 644 man/3proxy_crypt.8 $(DESTDIR)$(MANDIR)/man8/$(CRYPT_PREFIX)crypt.8
 	install -d $(DESTDIR)$(MANDIR)/man5

Makefile.Linux

@@ -4,9 +4,9 @@
 # add -DWITH_ODBC to CFLAGS and -lodbc to LIBS to compile with ODBC
 # library support. Add -DSAFESQL for poorely written ODBC library / drivers.
 #
-# Linux splice() support is not built by default, it is slower than the
+# Linux splice() support is built, but used only by services given the -s
-# read/write path for most traffic. Add -DWITHSPLICE to CFLAGS to build it,
+# option: it is faster for large transfers and slower for small requests.
-# it must additionally be enabled per service with the -s option.
+# Remove -DWITHSPLICE from CFLAGS to build without it.
 
 BUILDDIR = ../bin/
 PREFIX ?= 3proxy_
@@ -14,7 +14,7 @@ CRYPT_PREFIX ?= $(PREFIX)
 CC ?= gcc
 
 CFLAGS ?= -O3 -flto
-CFLAGS += -fno-strict-aliasing -c -pthread -D_GNU_SOURCE -DGETHOSTBYNAME_R -D_THREAD_SAFE -D_REENTRANT -DFD_SETSIZE=4096 -DWITH_POLL -DWITH_NETFILTER -D WITH_UN
+CFLAGS += -fno-strict-aliasing -c -pthread -DWITHSPLICE -D_GNU_SOURCE -DGETHOSTBYNAME_R -D_THREAD_SAFE -D_REENTRANT -DFD_SETSIZE=4096 -DWITH_POLL -DWITH_NETFILTER -D WITH_UN
 COUT = -o 
 LN ?= ${CC}
 DCFLAGS ?= -fPIC
@@ -25,6 +25,23 @@ LDFLAGS += -fno-strict-aliasing -pthread
 # makefile, including the += above and the STATIC/LIBSTATIC handling below.
 CFLAGS += $(EXTRA_CFLAGS)
 LDFLAGS += $(EXTRA_LDFLAGS)
+# The HTTP server serves the endpoints declared by http lines. The admin
+# interface is built on top of it, so turning it off removes both.
+MAILPROXY ?= false
+ifeq ($(MAILPROXY),true)
+    CFLAGS += -DWITH_POP3P -DWITH_IMAPP -DWITH_SMTPP
+    MAIL_EXES = $(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS)
+endif
+FTP ?= false
+ifeq ($(FTP),true)
+    CFLAGS += -DWITH_FTP
+    FTP_EXES = $(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS)
+endif
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .ld.so
 # -lpthreads may be reuqired on some platforms instead of -pthreads
@@ -43,8 +60,12 @@ MAKEFILE = Makefile.Linux
 # PamAuth requires libpam, you may require pam-devel package to be installed
 # SSLPlugin requires  -lcrypto -lssl
 #LIBS = -lcrypto -lssl -ldl 
-#PLUGINS = SSLPlugin StringsPlugin TrafficPlugin PCREPlugin TransparentPlugin PamAuth
+#PLUGINS = StringsPlugin TrafficPlugin PamAuth LdapPlugin
-PLUGINS ?= StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS ?= StringsPlugin TrafficPlugin FilePlugin
+
+# Transparent proxying, built in: it needs the packet filter of the platform
+CFLAGS += -DWITH_TRANSPARENT
+TRANSPARENT_OBJS = transparent$(OBJSUFFICS)
 ifeq ($(STATIC), true)
     LDFLAGS += -static
     CFLAGS += -DNOPLUGINS -DNOSTDRESOLVE -DNOCRYPT
@@ -102,15 +123,18 @@ INSTALL_BIN	= $(INSTALL) -m 755
 INSTALL_DATA	= $(INSTALL) -m 644
 INSTALL_OBJS	= bin/3proxy \
 		  bin/$(CRYPT_PREFIX)crypt \
-		  bin/$(PREFIX)ftppr \
-		  bin/$(PREFIX)imapp \
-		  bin/$(PREFIX)pop3p \
 		  bin/$(PREFIX)proxy \
-		  bin/$(PREFIX)smtpp \
 		  bin/$(PREFIX)socks \
 		  bin/$(PREFIX)tcppm \
 		  bin/$(PREFIX)tlspr \
 		  bin/$(PREFIX)udppm
+# the mail proxies and ftppr are only there when they were built
+ifeq ($(MAILPROXY),true)
+INSTALL_OBJS	+= bin/$(PREFIX)imapp bin/$(PREFIX)pop3p bin/$(PREFIX)smtpp
+endif
+ifeq ($(FTP),true)
+INSTALL_OBJS	+= bin/$(PREFIX)ftppr
+endif
 		  
 
 INSTALL_CFG	 = scripts/3proxy.cfg.chroot
@@ -168,7 +192,7 @@ install-man:
 	$(INSTALL_DATA) man/3proxy.cfg.5 $(MANDIR5)
 	$(INSTALL_DATA) man/3proxy.8 $(MANDIR8)
 	for f in proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr; do \
-	  if [ -f man/$$f.8 ]; then $(INSTALL_DATA) man/$$f.8 $(MANDIR8)/$(PREFIX)$$f.8; fi; \
+	  if [ -f man/$$f.8 ] && [ -f bin/$(PREFIX)$$f ]; then $(INSTALL_DATA) man/$$f.8 $(MANDIR8)/$(PREFIX)$$f.8; fi; \
 	done
 	$(INSTALL_DATA) man/3proxy_crypt.8 $(MANDIR8)/$(CRYPT_PREFIX)crypt.8
 

Makefile.Solaris

@@ -14,6 +14,21 @@ COUT = -o ./
 LN = $(CC)
 LDFLAGS = -xO3
 DCFLAGS = -fPIC
+MAILPROXY ?= false
+ifeq ($(MAILPROXY),true)
+    CFLAGS += -DWITH_POP3P -DWITH_IMAPP -DWITH_SMTPP
+    MAIL_EXES = $(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS)
+endif
+FTP ?= false
+ifeq ($(FTP),true)
+    CFLAGS += -DWITH_FTP
+    FTP_EXES = $(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS)
+endif
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS = -shared
 DLSUFFICS = .ld.so
 LIBS = -lpthread -lsocket -lnsl -lresolv -ldl
@@ -29,7 +44,7 @@ AFTERCLEAN = (find . -type f -name "*.o" -delete && find src/ -type f -name "Mak
 TYPECOMMAND = cat
 COMPATLIBS =
 MAKEFILE = Makefile.Solaris
-PLUGINS = StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS = StringsPlugin TrafficPlugin FilePlugin
 
 WOLFSSL_CHECK = $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testwssl testwssl.o -lwolfssl 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)

Makefile.msvc

@@ -18,13 +18,13 @@ SSL_LIBS = wolfssl.lib
 SSL_DEFS = /D "WITH_SSL"
 SSL_LIBS = libcrypto.lib libssl.lib
 !ENDIF
-CFLAGS = /nologo /MT /W3 /Ox /GS /EHs- /GA /GF /D "MSVC"  /D "WITH_WSAPOLL" /D "NDEBUG" /D "WIN32" $(SSL_DEFS) /D "WITH_PCRE" /D "WITH_ODBC" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /Fp"proxy.pch" /FD /c $(BUILDDATE) $(VERSION)
+CFLAGS = /D "WITH_HTTPSRV" /nologo /MT /W3 /Ox /GS /EHs- /GA /GF /D "MSVC"  /D "WITH_WSAPOLL" /D "NDEBUG" /D "WIN32" $(SSL_DEFS) /D "WITH_PCRE" /D "WITH_ODBC" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /D "NO_SHARE_UDP_SOCKET" /Fp"proxy.pch" /FD /c $(BUILDDATE) $(VERSION)
 COUT = /Fo
 LN = link
 LDFLAGS =  /nologo /subsystem:console /incremental:no
 DLFLAGS = /DLL
 DLSUFFICS = .dll
-LIBS = ws2_32.lib advapi32.lib odbc32.lib user32.lib kernel32.lib Gdi32.lib Crypt32.lib $(SSL_LIBS) pcre2-8.lib
+LIBS = ws2_32.lib mswsock.lib advapi32.lib odbc32.lib user32.lib kernel32.lib Gdi32.lib Crypt32.lib $(SSL_LIBS) pcre2-8.lib
 LIBSPREFIX =
 LIBSSUFFIX = .lib
 LIBEXT = .lib
@@ -40,6 +40,7 @@ MAKEFILE = Makefile.msvc
 PLUGINS = utf8tocp1251 WindowsAuthentication TrafficPlugin StringsPlugin FilePlugin
 SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
 PCRE_OBJS = pcre$(OBJSUFFICS)
+HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
 VERFILE = 3proxy.res $(VERFILE)
 VERSIONDEP = 3proxy.res $(VERSIONDEP)
 AFTERCLEAN = if exist src\*.res (del src\*.res) && if exist src\*.err (del src\*.err)

Makefile.unix

@@ -26,6 +26,21 @@ LDFLAGS += $(EXTRA_LDFLAGS)
 # -lpthreads may be reuqired on some platforms instead of -pthreads
 # -ldl or -lld may be required for some platforms
 DCFLAGS ?= -fPIC
+MAILPROXY ?= false
+ifeq ($(MAILPROXY),true)
+    CFLAGS += -DWITH_POP3P -DWITH_IMAPP -DWITH_SMTPP
+    MAIL_EXES = $(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS)
+endif
+FTP ?= false
+ifeq ($(FTP),true)
+    CFLAGS += -DWITH_FTP
+    FTP_EXES = $(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS)
+endif
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS ?= .ld.so
 LIBS ?=
@@ -41,7 +56,13 @@ AFTERCLEAN = (find . -type f -name "*.o" -delete && find src/ -type f -name "Mak
 TYPECOMMAND = cat
 COMPATLIBS =
 MAKEFILE = Makefile.unix
-PLUGINS ?= StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS ?= StringsPlugin TrafficPlugin FilePlugin
+
+# Transparent proxying is not built here: this makefile is for the systems
+# without a redirection 3proxy can read the original destination from. Where
+# the platform has one - OpenBSD divert-to is the case that fits - uncomment:
+#CFLAGS += -DWITH_TRANSPARENT
+#TRANSPARENT_OBJS = transparent$(OBJSUFFICS)
 ifeq ($(STATIC), true)
     LDFLAGS += -static
     CFLAGS += -DNOPLUGINS -DNOSTDRESOLVE -DNOCRYPT
@@ -109,7 +130,7 @@ install: all
 	install -d $(DESTDIR)$(MANDIR)/man8
 	install -m 644 man/3proxy.8 $(DESTDIR)$(MANDIR)/man8/3proxy.8
 	for f in proxy socks pop3p imapp smtpp ftppr tcppm udppm tlspr; do \
-	  if [ -f man/$$f.8 ]; then install -m 644 man/$$f.8 $(DESTDIR)$(MANDIR)/man8/$(PREFIX)$$f.8; fi; \
+	  if [ -f man/$$f.8 ] && [ -f bin/$(PREFIX)$$f ]; then install -m 644 man/$$f.8 $(DESTDIR)$(MANDIR)/man8/$(PREFIX)$$f.8; fi; \
 	done
 	install -m 644 man/3proxy_crypt.8 $(DESTDIR)$(MANDIR)/man8/$(CRYPT_PREFIX)crypt.8
 	install -d $(DESTDIR)$(MANDIR)/man5

Makefile.watcom

@@ -8,19 +8,20 @@ BUILDDIR = ../bin/
 PREFIX = 3proxy_
 CRYPT_PREFIX = 3proxy_
 CC = cl
-CFLAGS = /nologo /Ox /MT /D "NOIPV6" /D "NO_UN" /D "NODEBUG" /D "NORADIUS" /D"WATCOM" /D "MSVC"  /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /D "PRId64=\"I64d\"" /D "PRIu64=\"I64u\"" /D "SCNu64=\"I64u\"" /D "SCNx64=\"I64x\"" /D "SCNd64=\"I64d\"" /D "PRIx64=\"I64x\"" /c $(VERSION) $(BUILDDATE)
+CFLAGS = /D "WITH_HTTPSRV" /nologo /Ox /MT /D "NOIPV6" /D "NO_UN" /D "NODEBUG" /D "NORADIUS" /D"WATCOM" /D "NO_SHARE_UDP_SOCKET" /D "MSVC"  /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /D "PRId64=\"I64d\"" /D "PRIu64=\"I64u\"" /D "SCNu64=\"I64u\"" /D "SCNx64=\"I64x\"" /D "SCNd64=\"I64d\"" /D "PRIx64=\"I64x\"" /c $(VERSION) $(BUILDDATE)
 COUT = /Fo
 LN = link
 LDFLAGS = /nologo /subsystem:console /incremental:no 
 DLFLAGS = /DLL
 DLSUFFICS = .dll
-LIBS = ws2_32.lib advapi32.lib user32.lib kernel32.lib
+LIBS = ws2_32.lib mswsock.lib advapi32.lib user32.lib kernel32.lib
 LIBSPREFIX = 
 LIBSSUFFIX = .lib
 LIBEXT = .lib                                                                                               
 LNOUT = /out:
 EXESUFFICS = .exe
 OBJSUFFICS = .obj
+HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
 DEFINEOPTION = /D 
 COMPFILES = *.pch *.idb *.err
 REMOVECOMMAND = del 2>NUL >NUL

Makefile.win

@@ -11,6 +11,9 @@ CRYPT_PREFIX ?= $(PREFIX)
 CC ?= gcc
 CFLAGS ?= -O3 -flto
 CFLAGS += -fno-strict-aliasing -c -mthreads  -DWITH_WSAPOLL -DWITH_ODBC
+# Windows does not take a recv and a send on one socket from two threads,
+# so a UDP service answers from a socket of its own
+CFLAGS += -DNO_SHARE_UDP_SOCKET
 COUT = -o 
 LN ?= $(CC)
 LDFLAGS ?= -O3 -flto
@@ -20,9 +23,24 @@ LDFLAGS += -fno-strict-aliasing -mthreads
 # makefile, including the += above and the STATIC/LIBSTATIC handling below.
 CFLAGS += $(EXTRA_CFLAGS)
 LDFLAGS += $(EXTRA_LDFLAGS)
+MAILPROXY ?= false
+ifeq ($(MAILPROXY),true)
+    CFLAGS += -DWITH_POP3P -DWITH_IMAPP -DWITH_SMTPP
+    MAIL_EXES = $(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS)
+endif
+FTP ?= false
+ifeq ($(FTP),true)
+    CFLAGS += -DWITH_FTP
+    FTP_EXES = $(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS)
+endif
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .dll
-LIBS += -lws2_32 -lodbc32 -ladvapi32 -luser32 -lbcrypt
+LIBS += -lws2_32 -lmswsock -lodbc32 -ladvapi32 -luser32 -lbcrypt
 LIBSPREFIX = -l
 LIBSSUFFIX =
 LNOUT = -o 

README.md

@@ -6,8 +6,8 @@
 
 ### Branches
 
-- **Master** (stable) branch - 3proxy 1.0
+- **Master** (current/latest) branch - 3proxy 1.0
-- **0.9** (LTS) branch - 3proxy 0.9 maintenance branch, this branch
+- **0.9** (LTS) branch - 3proxy 0.9.9.x
 - **Devel** branch - 3proxy 2.0-devel (don't use it)
 
 ### Binaries (deb / rpm / Windows zip)
@@ -17,7 +17,7 @@ https://github.com/3proxy/3proxy/releases
 ### Package repository (apt / dnf)
 
 Signed apt and dnf repositories are published at https://3proxy.org/repo/ in
-two channels: `lts` (0.9 branch) and `current` (master).
+two channels: `current` (master) and `lts` (0.9 branch).
 
 Debian 12 and Ubuntu 22.04 or newer:
 
@@ -27,7 +27,7 @@ sudo curl -fsSL https://3proxy.org/repo/3proxy-release-key.asc \
 sudo tee /etc/apt/sources.list.d/3proxy.sources <<EOF
 Types: deb
 URIs: https://3proxy.org/repo/deb
-Suites: lts
+Suites: current
 Components: main
 Signed-By: /usr/share/keyrings/3proxy.asc
 EOF
@@ -40,7 +40,7 @@ AlmaLinux, RHEL, Rocky and CentOS Stream 8, 9 and 10:
 sudo tee /etc/yum.repos.d/3proxy.repo <<EOF
 [3proxy]
 name=3proxy
-baseurl=https://3proxy.org/repo/rpm/lts/el\$releasever/\$basearch/
+baseurl=https://3proxy.org/repo/rpm/current/el\$releasever/\$basearch/
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1
@@ -50,7 +50,7 @@ sudo dnf install 3proxy
 ```
 
 Both the packages and the repository metadata are signed. See
-https://3proxy.org/repo/ for the `current` channel and for release key details.
+https://3proxy.org/repo/ for the `lts` channel and for release key details.
 
 ### Docker images
 
@@ -68,9 +68,11 @@ Documentation (man pages and HTML) available with download, on https://3proxy.or
 
 ## Docker images
 
-3 docker configurations are provided, default (full) also tagged as `:lts`, `:lts-busybox` and `:lts-minimal`, all refer to newest 0.9 LTS version. Images built from this branch use the `lts` tags, images built from the master branch use `:latest`, `:busybox` and `:minimal`. Use the `lts` tags to stay on the 0.9 branch, use a version tag (e.g. `:0.9.9`) to pin an exact version. Except busybox, images are distroless and contain only binaries, you can not sh inside the container. `:lts-busybox` contains busybox shell.
+3 docker configurations are provided, default (full) also tagged as `:latest`, `:busybox` and `:minimal`, all refer to newest stable version. Except busybox, images are distroless and contain only binaries, you can not sh inside the container. `:busybox` contains busybox shell. Images are based on current (master) branch.
 
-### Default image (`:lts`):
+Images marked as LTS (`:lts`, `:lts-busybox`, `:lts-minimal`) are built from LTS branch (0.9.9.x)
+
+### Default image (`:latest`):
 
 Full installation requires to mount /etc/3proxy/3proxy.cfg files.
 
@@ -81,7 +83,7 @@ echo "log
 nserver 8.8.8.8
 nscache 65536
 proxy -p3129" | docker config create 3proxy
-docker run --read-only -p 3129:3129 --config source=3proxy,target=/etc/3proxy/3proxy.cfg --name 3proxy.full docker.io/3proxy/3proxy:lts
+docker run --read-only -p 3129:3129 --config source=3proxy,target=/etc/3proxy/3proxy.cfg --name 3proxy.full docker.io/3proxy/3proxy
 ```
 
  `podman` does not support `config` as above.
@@ -99,13 +101,13 @@ podman run --read-only -p 3129:3129 -v /path/to/local/config/directory/3proxy.cf
  use `log` without pathname in config to log to stdout.
  plugins are located in /usr/local/3proxy/libexec (/libexec for chroot config) and since 0.9.6 symlinked by /lib and /lib64 in both chroot and non-chroot configurations, so no full path is required in `plugin` command. Use e.g. `plugin SSLPlugin.ls.so ssl_plugin`. SSLPlugin is supported since 0.9.6. Some proxy types (e.g. SOCKSv5 UDPASSCOC, SOCKSv5 BIND functionality,  ftp proxy) require access to ephemeral port, you may use e.g. -`-network host` mode or `-P` for `docker run`.
 
-since 0.9.6 images are distroless (except :lts-busybox) it's recommended to use with read only file system, there are no benefits from chroot. For compatibility, you still can use chroot installation by mounting directory with 3proxy.cfg to /usr/local/3proxy/config.
+since 0.9.6 images are distroless (except :busybox) it's recommended to use with read only file system, there are no benefits from chroot. For compatibility, you still can use chroot installation by mounting directory with 3proxy.cfg to /usr/local/3proxy/config.
 
-### Busybox image (`:lts-busybox`):
+### Busybox image (`:busybox`):
 
 `full` with busybox added, to allow `sh` and few more commands like `sed` inside container. All libraries are in /lib, so chroot configuration can not use plugins.
 
-### Interactive `:lts-minimal` image:
+### Interactive `:minimal` image:
 
  Dockerfile for "interactive" minimal 3proxy execution, no configuration mounting is required, configuration
  is accepted from stdin. Use `end` command to indicate the end of configuration. Use `log` for stdout logging.
@@ -115,7 +117,7 @@ since 0.9.6 images are distroless (except :lts-busybox) it's recommended to use
 
  Run example:
 
- `docker run --read-only -i -p 3129:3129 --name 3proxy docker.io/3proxy/3proxy:lts-minimal`
+ `docker run --read-only -i -p 3129:3129 --name 3proxy docker.io/3proxy/3proxy:minimal`
 or
  `docker start -ai 3proxy` to start existing container
 
@@ -131,7 +133,7 @@ end
 
 Some proxy types (e.g. SOCKSv5 UDPASSCOC, SOCKSv5 BIND functionality,  ftp proxy) require access to ephemeral port, you may use e.g. `--network host` mode or `-P` to `docker run`.
 
-`:lts-minimal` without version specified uses current 0.9 LTS version.
+`:minimal` without version specified uses current stable version.
 
 ## Building and installation
 

RELEASE

@@ -1 +1 @@
-0.9.9.1
+1.0.1

SECURITY.md

@@ -7,6 +7,25 @@
 | 0.9.8   | :white_check_mark: |
 | < 0.9.8 | :x:                |
 
+## Hardening a deployment
+
+Configuration is where most of the risk lives. The security recommendations are
+kept in [doc/html/securityen.html](doc/html/securityen.html), published at
+<https://3proxy.org/securityen.html>: how to run the service, what the
+ACLs have to cover, and the settings whose defaults are safe only until
+something else is enabled alongside them.
+
+Read it before exposing a service. Recurring points from it:
+
+- Run unprivileged, never suid, and chroot where the platform allows.
+- Name the internal and external interfaces explicitly, and limit sources and
+  destinations with ACLs rather than relying on defaults.
+- Enabling IPv6 makes ACLs written in IPv4 incomplete: the same host is
+  reachable through an IPv4-mapped address, and the IPv6 loopback is an
+  address of its own.
+- Anything that terminates or intercepts TLS holds key material and sees full
+  request URLs; both the key and the logs need protecting.
+
 ## Reporting a Vulnerability
 
 Report to 3proxy@3proxy.org or via [GitHub security reporting](https://github.com/3proxy/3proxy/security)
@@ -70,5 +89,5 @@ verified with the GitHub CLI:
 
 ```
 gh attestation verify 3proxy-0.9.9.x86_64.rpm --owner 3proxy
-gh attestation verify oci://docker.io/3proxy/3proxy:lts --owner 3proxy
+gh attestation verify oci://docker.io/3proxy/3proxy:latest --owner 3proxy
 ```

debian/changelog

@@ -1,14 +1,14 @@
-3proxy (0.9.9.1-1) buster; urgency=medium
+3proxy (1.0.1-1) buster; urgency=medium
 
-  *3proxy 0.9.9.1 initial build
+  *3proxy 1.0.1 initial build
 
- -- z3APA3A <3apa3a@3proxy.org>  Sat, 10 Oct 2026 16:57:17 +0000
+ -- z3APA3A <3apa3a@3proxy.org>  Sat, 10 Oct 2026 16:21:01 +0000
 
-3proxy (0.9.9.0-1) buster; urgency=medium
+3proxy (1.0.0-1) buster; urgency=medium
 
-  *3proxy 0.9.9.0 initial build
+  *3proxy 1.0.0 initial build
 
- -- z3APA3A <3apa3a@3proxy.org>  Thu, 20 Aug 2026 19:12:35 +0300
+ -- z3APA3A <3apa3a@3proxy.org>  Sat, 22 Aug 2026 12:13:00 +0000
 
 3proxy (0.9.9-1) buster; urgency=medium
 

debian/control

@@ -14,5 +14,5 @@ Depends: ${shlibs:Depends}, ${misc:Depends}
 Description: tiny free proxy server
  3Proxy tiny free proxy server is really tiny freeware proxy servers set. 
  It includes HTTP proxy with HTTPS and FTP support, SOCKSv4/SOCKSv4.5/SOCKSv5 proxy (socks/socks.exe), POP3 proxy, SMTP proxy, FTP proxy, caching DNS proxy, TCP and UDP portmappers.
- You can use every proxy as a standalone program (socks, proxy, tcppm, udppm, pop3p) or use combined program (3proxy). Combined proxy additionally supports features like access control, bandwidth limiting, limiting daily/weekly/monthly traffic amount, proxy chaining, log rotation, syslog and ODBC logging, etc.
+ You can use every proxy as a standalone program (socks, proxy, tcppm, udppm, tlspr) or use combined program (3proxy). Combined proxy additionally supports features like access control, bandwidth limiting, limiting daily/weekly/monthly traffic amount, proxy chaining, log rotation, syslog and ODBC logging, etc.
  It's created to be small, simple and yet very functional. 

doc/changelog/0/9/9/1

@@ -1,12 +0,0 @@
-! Fix: crash (segmentation fault) on configuration reload (SIGUSR1) on a busy server: a closing session could still use its service after the reload had freed it; the race existed since 0.9.7, the 5 second linger added in 0.9.9 made it much more likely (#1278)
-! Fix: -Di and -De (bind to interface) were not applied to SOCKSv5 UDP ASSOCIATE and BIND sockets, the FTP proxy data connection and connect back (#1277)
-! Fix: SOCKSv5 UDP ASSOCIATE over IPv6: the source address of a datagram was truncated and the reply was sent to the wrong address (#1279)
-! Fix: SOCKSv5 UDP ASSOCIATE: an access rule with host names matched any datagram sent to a literal address; the address is used as the host name now, as it is for TCP requests
-! Fix: buffer could be insufficient for the headers the HTTP proxy adds after a pcre_rewrite had grown the request
-! Fix: heap buffer overflow in pcre_rewrite: a $N reference to a group which did not match was written out as its digits, which the space allocated for the result did not count
-! Fix: pcre_extend did nothing, the rules it appended were never consulted
-! Fix: certificates generated for TLS MitM (openssl) carried no subject and authority key identifiers and were refused by strict verifiers, including macOS clients, OpenSSL with x509_strict and Python 3.13
-! Fix: null pointer dereference in ftppr on PASS without USER and in smtpp on a user name without a host
-! Fix: no service started with wolfSSL on glibc: the default thread stack was too small for wolfSSL thread-local storage, pthread_create() failed and the failure was not reported
-! Fix: dnspr did not work on Windows, the socket it answers from could not be bound
-- Windows binaries are no longer signed with a self-signed Authenticode certificate, it gave no trust and triggered antivirus false positives

doc/changelog/1/0/0

@@ -0,0 +1,11 @@
+No changes in 3proxy code, this release only changes how packages are built, signed and published.
+
+! Fix: TLS, PCRE2 and PAM support was silently left out when 3proxy was built on a system whose /bin/sh is not dash, which is every RPM based distribution and macOS; the library checks built their test program with echo and escape sequences, which only dash expands, so every check failed and the features were dropped without a diagnostic
+! Fix: rpm packages were built on Ubuntu and required glibc 2.38, libssl.so.3 and libpcre2-8, which no RPM based distribution provides, so they could not be installed anywhere; they are built against AlmaLinux 8, 9 and 10 now and carry an el8, el9 or el10 tag, covering RHEL, AlmaLinux, Rocky and CentOS Stream of the same version
+! Fix: the rpm package depended on its own interpreter, /bin/3proxy, taken from the first line of the installed configuration file, and could not be installed on el9 or el10 because rpm resolves that dependency to /usr/bin/3proxy
+! Fix: deb packages required glibc 2.38 and libssl3t64 and installed on Ubuntu 24.04 and newer only; they are built against Ubuntu 22.04 now and install on Ubuntu 22.04 and later as well as Debian 12 and later
++ Signed apt and dnf repositories are published at https://3proxy.org/repo/ in two channels: current, built from the master branch, and lts, built from the 0.9 branch; packages and repository metadata are both signed
++ Release binaries are published with SHA256 checksums, an OpenPGP signature and a GitHub build provenance attestation; docker images are signed and attested as well
++ The release signing key is an RSA-4096 key published as 3proxy-release-key.asc in the repository; rpm 4.14 and earlier can not import an Ed25519 key at all, which would leave RHEL 8 and its derivatives unable to verify anything
++ Packages are reproducible: rebuilding a release produces byte identical deb and rpm files, every timestamp is derived from the build date recorded for the release
+- 32-bit ARM (armhf) is published as a deb package only, Enterprise Linux has no 32-bit ARM build

doc/changelog/1/0/1

@@ -0,0 +1,23 @@
+! Fix: crash (segmentation fault) on configuration reload (SIGUSR1) on a busy server: a closing session could still use its service after the reload had freed it; the race existed since 0.9.7, the 5 second linger added in 0.9.9 made it much more likely (#1278)
+! Fix: -Di and -De (bind to interface) were not applied to SOCKSv5 UDP ASSOCIATE and BIND sockets, the FTP proxy data connection and connect back (#1277)
+! Fix: SOCKSv5 UDP ASSOCIATE over IPv6: the source address of a datagram was truncated and the reply was sent to the wrong address (#1279)
+! Fix: SOCKSv5 UDP ASSOCIATE: an access rule with host names matched any datagram sent to a literal address; the address is used as the host name now, as it is for TCP requests
+! Fix: a request rewritten with pcre_rewrite was only logged and was sent unchanged to the server on a direct connection; the rewritten path and query are what the server receives now
+! Fix: buffer could be insufficient for the headers the HTTP proxy adds after a pcre_rewrite had grown the request
+! Fix: heap buffer overflow in pcre_rewrite: a $N reference to a group which did not match was written out as its digits, which the space allocated for the result did not count
+! Fix: pcre_extend did nothing, the rules it appended were never consulted; the manual described an argument the command does not take
+! Fix: certificates generated for TLS MitM (openssl) carried no subject and authority key identifiers and were refused by strict verifiers, including macOS clients, OpenSSL with x509_strict and Python 3.13
+! Fix: null pointer dereference in ftppr on PASS without USER and in smtpp on a user name without a host
+! Fix: no service started with wolfSSL on glibc: the default thread stack was too small for wolfSSL thread-local storage, pthread_create() failed and the failure was not reported
+! Fix: dnspr did not work on Windows; Windows builds answer UDP from a socket of their own again
++ Built-in HTTP server: httpsrv service with http rules to serve files (cached or with sendfile / TransmitFile), redirects, rewrites, fixed replies and proxypass to forward requests as the proxy does, so one port can serve both a site and a proxy; admin is httpsrv with the administration pages
++ Host names in access rules may be regular expressions with a pcre: (or regex:) prefix
++ transparent / notransparent commands: transparent proxying is built in (netfilter on Linux, pf on BSD, socket for divert-to and ipfw fwd), TransparentPlugin is removed and a configuration loading it keeps working
++ parent: weight may be written as a fraction (.5) or a percentage (50%); weight 0 is a fallback parent used only when every weighted parent of its group has failed; a failed parent is left out of the next attempt of the same connection
++ parent extport / intport: range of local ports for outgoing connections and for sockets facing the client (UDP ASSOCIATE, FTP data)
++ A parent given by host name is resolved for each connection when nserver is used, instead of once on configuration load
++ $$ in the configuration stands for a single dollar sign, a dollar inside quotes is ordinary text
++ OpenWrt package (procd init script, UCI configuration) and OpenWrt builds for mipsel_24kc, mips_24kc, arm_cortex-a7_neon-vfpv4 and aarch64_cortex-a53
+- pop3p, imapp, smtpp and ftppr are not in a default build: build with MAILPROXY=true and FTP=true (CMake: 3PROXY_USE_MAILPROXY, 3PROXY_USE_FTP); without them the mail proxies run as tlspr negotiating STARTTLS, and ftppr refuses clients
+- FTP over HTTP proxy (ftp:// URLs) is not in a default build either and has to be enabled explicitly: build with FTP=true (CMake: 3PROXY_USE_FTP), without it the HTTP proxy does not fetch ftp:// URLs
+- Windows binaries are no longer signed with a self-signed Authenticode certificate, it gave no trust and triggered antivirus false positives

doc/html/highload.html

@@ -34,7 +34,8 @@ Each connected client requires:
 <ul>
 <li>1 thread (process)
 <li>2 sockets (file descriptors). For FTP, 4 sockets are required.
-<br>Up to 128K of kernel buffer memory. This is the theoretical maximum; actual numbers depend on connection quality and traffic amount.
+<br>With splice() (Linux, -s), a pipe (2 file descriptors) for each spliced direction: up to 4 more file descriptors, 6 for FTP.
+<br>Up to 128K (up to 256K with splice()) of kernel buffer memory. This is the theoretical maximum; actual numbers depend on connection quality and traffic amount.
 <br>1 additional socket (file descriptor) during name resolution for non-cached names
 <br>1 additional socket during authentication or logging for RADIUS authentication or logging.
 <li>1 ephemeral port (3 ephemeral ports for FTP connections).
@@ -279,6 +280,8 @@ tuning anything else.
 
 If 3proxy is used in a VPS environment, there can be additional limitations.
 For example, kernel resources, system CPU usage, and IOCTLs can be limited differently, and this can become a bottleneck.
+splice() (see below) moves work into the kernel, so where the hosting limits kernel resources
+(seen as nearly 100% CPU usage without any real activity of the application) do not enable it.
 
 <h4>Extending the Ephemeral Port Range</h4>
 
@@ -641,17 +644,42 @@ monitor "/some/path/3proxy/3proxy.ver"
 e.g., with "touch /some/path/3proxy/3proxy.ver".
 </ol>
 
-<h4>Use TCP_NODELAY to Speed Up Connections with Small Amounts of Data</h4>
+<h4>TCP_NODELAY for Connections with Small Amounts of Data</h4>
 
-If most requests require an exchange with a small amount of data in both directions
+TCP_NODELAY is set by default on client (oc) and server (os)
-without the need for bandwidth, e.g., messengers or small web requests,
+connections: without it, Nagle's algorithm holds back a short write until the
-you can eliminate Nagle's algorithm delay with the TCP_NODELAY flag. Usage example:
+previous one is acknowledged, and a peer delays its acknowledgement, so a reply
+written in more than one part (e.g. HTTP headers, then a short body) waits tens
+of milliseconds. On slow connections with high delays, where the bandwidth is the
+bottleneck and fewer packets matter more than latency, it can be turned off:
 <pre>
-proxy -osTCP_NODELAY -ocTCP_NODELAY
+proxy -osTCP_NODELAY=0 -ocTCP_NODELAY=0
 </pre>
-sets TCP_NODELAY for client (oc) and server (os) connections.
+
-<p>Do not use TCP_NODELAY on slow connections with high delays when
+<h4>Use Splice to Speed Up Large Data Transfers</h4>
-connection bandwidth is a bottleneck.
+
+On Linux, splice() passes data between the client and the server connections
+through a kernel pipe, without copying it into the 3proxy process. Linux builds
+include it, but a service uses it only when given the -s option:
+<pre>
+proxy -s
+socks -s
+tcppm -s3 8080 192.168.1.1 80
+</pre>
+-s alone splices both directions where it pays: an HTTP body of known length if at
+least 16K of it is left to read, a stream (CONNECT, SOCKS, tcppm) once it carries
+large reads, going back to copying when they turn small. -s1 always splices what the
+server sends to the client (downloads), -s2 what the client sends to the server
+(uploads), -s3 both; -s5, -s6 and -s7 (the same as -s) do it for those directions
+only where it pays. -s0, the default, turns it off. In builds without it (CMake option 3PROXY_USE_SPLICE=OFF,
+or -DWITHSPLICE removed from the Makefile) -s is accepted and ignored.
+<p>splice() pays off when most of the traffic is large transfers: in the
+<a href="https://github.com/3proxy/3proxy/blob/devel/bench/RESULTS.md">benchmarks</a> it moved
+1.3 to 2.1 times more data than the read/write path at 40-55% less CPU per gigabyte.
+It does not help small requests and short connections, which go slower with it, and
+every spliced direction needs a pipe (two file descriptors) and more kernel
+buffer memory. Data filters are not applied to spliced data.
+<p>TCP_NODELAY and splice() do not conflict and can be combined on high-speed connections.
 
 <h4>Add Grace Delay to Reduce System Calls</h4>
 
@@ -661,7 +689,7 @@ the minimal number of packets in the same direction to apply the algorithm,
 and the last value is the delay added after polling and prior to reading data.
 The example above adds a 10-millisecond delay before reading data if the average
 polling size is below 8000 bytes and 3 read operations have been made in the same
-direction. <pre>logdump 1 1</pre> is useful
+direction. It's especially useful with splice. <pre>logdump 1 1</pre> is useful
 to see how grace delays work; choose a delay value to avoid filling the read
 buffer (typically 64K) but keep the request sizes close to the chosen average
 on large file uploads/downloads.

doc/html/howtoe.html

@@ -34,9 +34,11 @@
  <li><a href="#ISFTP">How to set up an FTP proxy</a></li>
  <li><a href="#TLSPR">How to set up an SNI proxy (tlspr)</a></li>
  <li><a href="#DNSPR">How to set up a DNS proxy (dnspr)</a></li>
+ <li><a href="#HTTPSRV">How to serve pages with the built-in HTTP server (httpsrv)</a></li>
  <li><a href="#SSLPLUGIN">How to set up TLS/SSL (https proxy, mTLS)</a></li>
  <li><a href="#CERTIFICATES">How to create CA and certificates for SSL</a></li>
  <li><a href="#PCRE">How to use PCRE filtering (regular expressions)</a></li>
+ <li><a href="#TRANSPARENT">How to proxy transparently</a></li>
  <li><A HREF="#AUTH">How to limit service access</a>
  <li><A HREF="#USERS">How to create a user list</a>
  <li><A HREF="#ACL">How to limit user access to resources</a>
@@ -726,6 +728,218 @@ nscache 65536
 nscache6 65536
 dnspr -p53 -F10.0.0.1
 </pre>
+ </p>
+ <li><a name="HTTPSRV"><i>How to serve pages with the built-in HTTP server (httpsrv)</i></a>
+<p>
+httpsrv answers requests itself instead of forwarding them. What it does with a
+request is decided by <code>http</code> rules written before the service, the way
+access rules are: the first rule whose host and URL both match handles the
+request. It is useful for a status page, a small static site, a block page for
+requests an ACL rejects, or a health check an upstream balancer can poll.
+</p><pre>
+http OPERATION HOST URL [PARAMETERS]
+</pre>
+<p>
+HOST is matched against the Host header, URL against the path with the query
+string removed. A minimal static site:
+</p><pre>
+auth iponly
+allow *
+
+http file * /           /usr/local/web/index.html
+http file * /*.html     "/usr/local/web/$1.html"
+http file * /css/*.css  "/usr/local/web/css/$1.css"
+http cache * /img/**    "/usr/local/web/img/$1" * 3600
+httpsrv -p80 -i127.0.0.1
+</pre>
+<p>
+<b>Patterns.</b> <code>*</code> stands for any run of characters within one
+element of the path and does not cross a <code>/</code>, so a rule cannot reach
+into a directory it did not name. <code>**</code> crosses them. Each star, and
+each group of a regular expression, is remembered in order: <code>$1</code>
+upwards stand for them in the path or location the rule builds, and
+<code>$0</code> for the whole request path. A <code>rewrite_host</code> rule
+uses the stars of its own host pattern instead, since that is what it is
+rewriting. With a PCRE build a pattern may be
+written as a regular expression with a <code>pcre:</code> prefix, for the URL and
+for the host alike:
+</p><pre>
+http file  * /d/*.txt       "/usr/local/web/$1.txt"
+http cache * "pcre:^/(.*)/pic/(.*)\.(gif|jpeg)$" "/usr/local/web/picts/$1/$2.$3"
+http file  status.example.com /**  "/usr/local/web/status/$1"
+http file  "pcre:^(www|web)\.example\.com$" /**  "/usr/local/web/$1"
+</pre>
+<p>
+Outside quotes a dollar begins the name of a file to include, so an argument
+holding one - a path built with <code>$1</code>, a regular expression anchored
+with <code>$</code> - is written in quotes, as above. <code>$$</code> stands for
+a single dollar and is not read as an include either.
+</p>
+<p>
+<b>Operations.</b>
+</p><pre>
+&#35; file - send the file, using sendfile/TransmitFile where the system can
+http file * /dl/**  "/usr/local/web/dl/$1"
+
+&#35; cache - read it into memory on the first request and answer from there
+http cache * /css/*.css "/usr/local/web/css/$1.css"
+
+&#35; redir - answer with a redirect, 302 unless a status is given
+http redir * /old/**  301 "https://example.org/$1"
+
+&#35; rewrite - change the path and hand the request to the rules after this one
+http rewrite * /alias/** "/w/$1"
+
+&#35; rewrite_host - the same for the host, which decides which rules match next
+http rewrite_host *.old.example ** "$1.new.example"
+
+&#35; reply - a status and nothing else
+http reply * /health**  200 "X-Health: ok"
+http reply * /down**    503 "Retry-After: 30"
+
+&#35; echo, data - describe the request, or generate content of a given size
+http echo * /echo**
+http data * /gen** size=1048576
+</pre>
+<p>
+<b>What a rule adds to the answer.</b> <code>file</code> and <code>cache</code>
+take, after the path, a content type, a max-age, headers to add and a status to
+answer with. Each may be left out or written as <code>*</code>:
+</p><pre>
+http OPERATION HOST URL PATH [TYPE [MAX-AGE [HEADERS [CODE]]]]
+
+&#35; type worked out from the name, cached by clients for an hour
+http file * /img/*.png "/usr/local/web/img/$1.png" * 3600
+
+&#35; a type of its own, and a header
+http file * /api/*.json "/usr/local/web/api/$1.json" application/json * "X-Api: 1"
+
+&#35; a file serving as the body of an error page
+http file * /err/** /usr/local/web/404.html text/html * * 404
+</pre>
+<p>
+HEADERS is one argument holding whole header lines, separated by a backslash and
+an n - the two characters, since a configuration line cannot carry a line
+ending. Quote it, headers contain spaces. A rule's headers and max-age go with
+whatever status that rule asked for, but not with a refusal the server itself
+decided on: a request for a file which is not there is answered 404 by the
+server, not by the rule.
+</p>
+<p>
+Types not known to the server are registered with
+<code>http_content_type</code>, and a type named by a rule is used whatever the
+name of the file says:
+</p><pre>
+http_content_type .webp image/webp
+http_content_type wasm  application/wasm
+</pre>
+<p>
+<b>Files and dates.</b> Only a full path is taken - a relative one would be read
+against whatever directory the service happens to be in - and a path holding
+<code>.</code> or <code>..</code> as an element, a line ending or a star is
+refused. On Windows a path must name a drive or a share (<code>"C:\web\$1"</code>
+or <code>"\\host\share\$1"</code>). A request which decodes to a path leaving the
+tree is refused before any of this. Every answer carries Last-Modified, and a
+request carrying If-Modified-Since is answered 304 with no body when the file
+has not changed.
+</p>
+<p>
+<b>Caching.</b> <code>cache</code> reads the file once and answers from memory
+afterwards; a file which has changed on disk is read again, and one larger than
+a megabyte is sent as <code>file</code> would. With a MAX-AGE the file is not
+looked at again for that long - the rule has already told clients the file may
+be treated as unchanged for that time - so a request costs nothing but the copy
+out. Without one every request stats the file and a change is picked up at once.
+</p>
+<p>
+<b>A block page.</b> A service which rejects a request with a redirect can send
+the client to an httpsrv running beside it:
+</p><pre>
+auth iponly
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow *
+proxy -p3128 -i192.168.1.1
+
+flush
+auth iponly
+allow *
+http file * /**  /usr/local/web/blocked.html text/html * * 403
+httpsrv -p8080 -i127.0.0.1
+</pre>
+<p>
+<b>Both a site and a proxy.</b> A request may arrive the way it arrives at a
+site - a path, with the name in the Host header - or the way it arrives at a
+proxy, naming the whole URL, or the host alone with CONNECT. Both are read. A
+proxy-form request authenticates with Proxy-Authorization and is refused with
+407, the way a proxy refuses one; a site-form request uses Authorization and
+401. What answers it is decided by the rules either way.
+</p>
+<p>
+<code>proxypass</code> is the rule which answers by fetching, so one service can
+serve what it has and proxy the rest:
+</p><pre>
+auth iponly
+allow *
+http file * /local/** "/usr/local/web/$1"
+http proxypass * /**
+httpsrv -p8080
+</pre>
+<p>
+An access rule redirecting to the local proxy does the same without a rule for
+it. The chain with no address is what "the local proxy" is written as, and the
+second <code>allow</code> is what the proxy matches on the pass it makes itself,
+since a rule carrying the chain is not taken twice:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow *
+http file * /local/** "/usr/local/web/$1"
+httpsrv -p8080
+</pre>
+<p>
+Authentication happens twice for the same reason - once for the service, once
+for the proxy - so a configuration which asks for credentials asks for them the
+way a proxy does.
+</p>
+<p>
+The access rules are read from the top on both passes, and the second one is
+where the request's destination is known. On the first pass the service is
+answering for itself, so an address or a port in a rule is matched against the
+address the client connected to; the name from the request is matched on both
+passes. On the second the destination is the one the request names, so rules
+written with an address, a port or a name decide what the proxy may fetch, and
+they decide it before it connects:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow * * * 80,443
+deny *
+httpsrv -p8080
+</pre>
+<p>
+Everything reaches the rules, only ports 80 and 443 are fetched, and a
+<code>deny</code> written before the rule carrying the chain applies on both
+passes just the same. The connection to the server is kept for the next request and
+closed when that request goes elsewhere, or when the server has closed it in the
+meantime.
+</p>
+<p>
+<b>Connections.</b> A client asking in HTTP/1.1 gets a 1.1 answer and the
+connection is kept for the next request, unless it sent
+<code>Connection: close</code>; a 1.0 client has to ask for keep-alive. The
+connection is only kept when the length of the answer is known exactly, which is
+true of every operation except the administration pages, so those are always the
+last thing on a connection. A request body the server cannot read to its end -
+one sent chunked, or one larger than a megabyte - ends the connection too.
+</p>
+<p>
+<b>Administration.</b> The <code>admin</code> service is httpsrv with the pages
+of the administration interface already declared, see
+<a href="#ADMIN">Administering and information analysis</a>. Rules may be added
+before it in the same way, and are taken first.
+</p>
  </p>
  <li><a name="SSLPLUGIN"><i>How to set up TLS/SSL (https proxy, mTLS)</i></a>
 <p>
@@ -828,12 +1042,32 @@ This creates an HTTPS proxy (ssl_serv) that accepts TLS connections from clients
 &#35; Generate CA private key
 openssl genrsa -out ca.key 4096
 
+&#35; Extensions that make the certificate usable as a CA
+cat > ca.ext << 'EOF'
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+
 &#35; Generate CA certificate (valid for 10 years)
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+openssl req -new -nodes -key ca.key \
     -subj "/C=US/ST=State/L=City/O=MyOrg/CN=My CA" \
-    -out ca.crt
+    -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 </pre>
 <p>
+The extensions are not optional. Without <b>basicConstraints=CA:TRUE</b> and
+<b>keyCertSign</b> the certificate is not accepted as a CA, and clients report
+that they cannot get the local issuer certificate. <b>subjectKeyIdentifier</b>
+is what certificates signed by this CA point back at.
+</p>
+<p>
+They are given in a file rather than with <b>-addext</b> because LibreSSL, the
+<b>openssl</b> command on macOS and some BSDs, does not apply -addext the same
+way OpenSSL does. The form above behaves the same on both.
+</p>
+<p>
 For MITM, import ca.crt into client browsers/OS as a trusted root CA.
 </p>
 <p>
@@ -866,8 +1100,18 @@ EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 \
     -extfile server.ext
+
+&#35; Check it the way a current client will
+openssl verify -x509_strict -CAfile ca.crt server.crt
 </pre>
 <p>
+Verify strictly, because that is what the client does. OpenSSL 3 adds the
+subject and authority key identifiers when it signs and LibreSSL does not,
+which is why the extensions file asks for them by name. Python has verified
+strictly since 3.13 and refuses a certificate carrying no
+<b>authorityKeyIdentifier</b>; other clients are moving the same way.
+</p>
+<p>
 For a public https:// proxy, use a CA like Let's Encrypt instead of self-signed.
 </p>
 <p>
@@ -886,6 +1130,8 @@ cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 
 &#35; Sign with CA
@@ -908,8 +1154,14 @@ Import client1.p12 into the client browser or OS certificate store.
 
 &#35; CA
 openssl genrsa -out ca.key 4096
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+cat > ca.ext << 'EOF'
-    -subj "/CN=3proxy CA" -out ca.crt
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+openssl req -new -nodes -key ca.key -subj "/CN=3proxy CA" -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 
 &#35; Server
 openssl genrsa -out server.key 2048
@@ -919,6 +1171,8 @@ basicConstraints=CA:FALSE
 keyUsage = keyEncipherment
 extendedKeyUsage = serverAuth
 subjectAltName = DNS:localhost,DNS:proxy,IP:127.0.0.1
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
@@ -929,12 +1183,201 @@ openssl req -new -key client.key -subj "/CN=client" -out client.csr
 cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out client.crt -days 365 -sha256 -extfile client.ext
 openssl pkcs12 -export -out client.p12 -passout pass: \
     -inkey client.key -in client.crt -certfile ca.crt
+
+&#35; Both must pass the checks a current client applies
+openssl verify -x509_strict -CAfile ca.crt server.crt
+openssl verify -x509_strict -CAfile ca.crt client.crt
 </pre>
+
+ <li><a name="TRANSPARENT"><i>How to proxy transparently</i></a>
+<p>
+A transparent proxy serves clients that were never configured to use one. A
+packet filter redirects their connections to 3proxy, and the
+<b>transparent</b> command tells the service to take the destination from the
+filter instead of from the request. Every other feature applies as usual:
+access rules, parent proxies, limits and logging all see the real destination.
+It works on Linux and on the BSDs. Since 1.0.1 it is part of the binary; before
+that it was the separate TransparentPlugin, and the <b>plugin</b> line it
+needed is no longer required.
+</p>
+<p>
+The command supplies both the address and the port the client was trying to
+reach, so a service can serve whatever was redirected to it rather than one
+port with one target.
+</p>
+<p>
+Without it a service has to get a destination from somewhere else: an HTTP
+proxy falls back to the <b>Host</b> header, and a port mapper uses the address
+it was configured with. Taking the destination from the filter is what makes
+the other protocols work, and what makes the address authoritative rather than
+something the client claimed.
+</p>
+<p>
+<b>tlspr</b> is the clearest case. Nothing reaches it at all unless traffic is
+redirected to it, or the clients resolve the names to it through DNS. With a
+redirection it gets the address as well as the name from the handshake, and
+that is what lets access rules be written with host names: the name from the
+handshake is matched, and the connection still goes to the address the client
+was going to. Without the address it would have to resolve the name itself,
+which is a second lookup and a second answer.
+</p>
+<p>
+A configuration for web and TLS traffic:
+</p><pre>
+log /var/log/3proxy.log D
+auth iponly
+allow *
+
+&#35; the destination comes from the redirection for the services below
+transparent
+
+&#35; ordinary web traffic, redirected here from port 80
+proxy -p3129 -e192.0.2.10
+
+&#35; TLS, redirected here from port 443: tlspr would otherwise have only the
+&#35; name in the handshake, and this gives it the address as well
+tlspr -p3143 -e192.0.2.10
+
+notransparent
+</pre>
+<p>
+<b>-e</b> gives those services an address of their own to connect from. That
+address is what the redirection rules exclude, and excluding it is what stops
+the proxy's own connections from being redirected back into it. Without an
+exclusion the connection 3proxy makes to the origin matches the same rule,
+returns to 3proxy, and the traffic goes round until something gives out.
+Running 3proxy as its own account and excluding that account works too, and is
+the better choice when the machine has one address.
+</p>
+
+<p><b>Linux, iptables</b>. For traffic the machine forwards for others:
+</p><pre>
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80  -j REDIRECT --to-ports 3129
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+</pre>
+<p>
+Traffic the machine generates itself passes through OUTPUT instead, where the
+proxy's own connections have to be excluded:
+</p><pre>
+&#35; by the address the services connect from
+iptables -t nat -A OUTPUT -p tcp --dport 80 ! -s 192.0.2.10 -j REDIRECT --to-ports 3129
+
+&#35; or by the account 3proxy runs as
+iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner proxy3 \
+    -j REDIRECT --to-ports 3129
+</pre>
+
+<p><b>Linux, nftables</b> (Debian 11+, Ubuntu 22.04+, RHEL 8+, Fedora, Arch,
+where nftables is what iptables is a front end for):
+</p><pre>
+table ip proxy3 {
+	chain prerouting {
+		type nat hook prerouting priority dstnat; policy accept;
+		iif "eth0" tcp dport 80 redirect to :3129
+		iif "eth0" tcp dport 443 redirect to :3143
+	}
+
+	chain output {
+		type nat hook output priority dstnat; policy accept;
+		meta skuid != "proxy3" tcp dport 80 redirect to :3129
+		meta skuid != "proxy3" tcp dport 443 redirect to :3143
+	}
+}
+</pre>
+<p>
+Load it with <b>nft -f</b>, and keep it across reboots in
+<b>/etc/nftables.conf</b> (Debian, Ubuntu) or
+<b>/etc/sysconfig/nftables.conf</b> (RHEL, Fedora). A table name cannot begin
+with a digit, which is why the table above is not called 3proxy.
+</p>
+
+<p><b>Linux, firewalld</b> (RHEL, CentOS Stream, Fedora, openSUSE). Redirect an
+incoming port on a zone:
+</p><pre>
+firewall-cmd --permanent --zone=internal --add-forward-port=port=80:proto=tcp:toport=3129
+firewall-cmd --permanent --zone=internal --add-forward-port=port=443:proto=tcp:toport=3143
+firewall-cmd --reload
+</pre>
+<p>
+firewalld has no exclusion for the proxy's own traffic in that form, so put
+that part in a direct rule:
+</p><pre>
+firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 \
+    -p tcp --dport 80 -m owner ! --uid-owner proxy3 -j REDIRECT --to-ports 3129
+firewall-cmd --reload
+</pre>
+
+<p><b>Linux, ufw</b> (Ubuntu, Debian). ufw has no command for redirection;
+add the rules to <b>/etc/ufw/before.rules</b>, above the <b>*filter</b> block:
+</p><pre>
+*nat
+:PREROUTING ACCEPT [0:0]
+-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3129
+-A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+COMMIT
+</pre>
+
+<p>
+On Linux 3proxy asks the kernel where the connection was going. On the BSDs it
+asks pf, which keeps the original destination in its state table, through
+<b>/dev/pf</b> - so <b>rdr</b> rules work, and 3proxy has to be able to read
+that device. Where a redirection leaves the destination on the socket instead,
+that is used: OpenBSD <b>divert-to</b> and FreeBSD <b>ipfw fwd</b> both do.
+</p>
+<p>
+The mechanism is chosen automatically, and <b>transparent</b> takes an
+argument for the installations that need to pin it: <b>auto</b> (the default),
+<b>netfilter</b>, <b>pf</b>, or <b>socket</b> for reading it off the socket. A
+mode the build has no code for is refused, so a configuration written for
+another platform fails where it is wrong instead of quietly doing something
+else.
+</p>
+
+<p><b>FreeBSD, NetBSD and OpenBSD, pf</b>. Redirect in <b>/etc/pf.conf</b>,
+excluding the address the proxy connects from:
+</p><pre>
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 80  -&gt; 127.0.0.1 port 3129
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 443 -&gt; 127.0.0.1 port 3143
+</pre>
+<p>
+Load with <b>pfctl -f /etc/pf.conf</b>. 3proxy looks the destination up in pf's
+state table, so it needs to read <b>/dev/pf</b>: either run it as root, or give
+its account access to that device.
+</p>
+
+<p><b>OpenBSD, divert-to</b> is an alternative which leaves the destination on
+the socket, and needs no access to <b>/dev/pf</b>:
+</p><pre>
+pass in on em0 inet proto tcp to any port 80  divert-to 127.0.0.1 port 3129
+pass in on em0 inet proto tcp to any port 443 divert-to 127.0.0.1 port 3143
+</pre>
+
+<p><b>FreeBSD, ipfw</b>. <b>fwd</b> delivers the connection locally without
+rewriting it, which also leaves the destination on the socket:
+</p><pre>
+ipfw add fwd 127.0.0.1,3129 tcp from any to any 80  in recv em0
+ipfw add fwd 127.0.0.1,3143 tcp from any to any 443 in recv em0
+</pre>
+
+<p><b>macOS</b> has <b>/dev/pf</b> but ships no header for it, so a macOS build
+has no pf lookup, and macOS has neither <b>divert-to</b> nor ipfw to leave the
+address on the socket. Transparent proxying is not usable there, even though
+the commands exist in a macOS build.
+</p>
+
+<p>
+Check the result by asking for a host through a redirected port and reading
+the log: the request should appear with the address the client asked for,
+which is what it would look like through a configured proxy.
+</p>
+
  <li><a name="PCRE"><i>How to use PCRE filtering (regular expressions)</i></a>
 <p>
 Since version 0.9.7, PCRE (Perl Compatible Regular Expressions) filtering is built into
@@ -993,6 +1436,34 @@ pcre_extend deny * 192.168.0.1/16
 <p>
 <b>Note:</b> Regular expressions don't require authentication and cannot replace
 authentication and/or allow/deny ACLs.
+</p>
+<p>
+<b>Regular expressions in host names:</b> a host name in the target list of an
+access rule may be written as a regular expression instead of a wildmask, by
+giving it a <code>pcre:</code> prefix (<code>regex:</code> means the same). This
+needs a build with PCRE support, the same as the <code>pcre</code> commands
+above.
+</p><pre>
+&#35; Wildmask: a name may only be matched at its beginning and its end
+deny * * *ads.example.com
+
+&#35; Regular expression: anything PCRE can express
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow * * "pcre:^(www|api)\.example\.com$"
+</pre>
+<p>
+The name is lowercased and trailing dots are removed before the pattern is
+matched, so write patterns in lower case. Quote a pattern which ends in
+<code>$</code>, or write it as <code>$$</code>: outside quotes a lone dollar
+begins the name of a file to include. Only the target list takes names - the
+source list is addresses - and the name is only checked when the request
+carries one. A wildmask is cheaper and is enough for most rules; a regular
+expression is matched per request.
+</p>
+<p>
+The same prefix and the same patterns are used by the <code>http</code> command
+of the built-in HTTP server, for the host a rule answers for and for the URL it
+matches.
 </p>
  <li><A NAME="AUTH">How to limit service access</a>
 <p>

doc/html/howtor.html

@@ -34,9 +34,11 @@
  <li><a href="#ISFTP">Как настроить FTP прокси?</a></li>
  <li><a href="#TLSPR">Как настроить SNI proxy (tlspr)</a></li>
  <li><a href="#DNSPR">Как настроить DNS proxy (dnspr)</a></li>
+ <li><a href="#HTTPSRV">Как отдавать страницы встроенным HTTP-сервером (httpsrv)</a></li>
  <li><a href="#SSLPLUGIN">Как настроить TLS/SSL (https прокси, mTLS)</a></li>
  <li><a href="#CERTIFICATES">Как создать CA и сертификаты для SSL</a></li>
  <li><a href="#PCRE">Как использовать PCRE-фильтрацию (регулярные выражения)</a></li>
+ <li><a href="#TRANSPARENT">Как сделать транспарентный прокси</a></li>
  <li><a href="#AUTH">Как ограничить доступ к службе</a>
  <li><a href="#USERS">Как создать список пользователей</a>
  <li><a href="#ACL">Как ограничить доступ пользователей к ресурсам</a>
@@ -737,6 +739,217 @@ dnspr -p53 -F10.0.0.1
 </pre>
  </p>
 
+ <li><a name="HTTPSRV"><i>Как отдавать страницы встроенным HTTP-сервером (httpsrv)</i></a>
+<p>
+httpsrv отвечает на запросы сам, а не пересылает их. Что делать с запросом,
+определяют правила <code>http</code>, записанные перед сервисом, как и правила
+доступа: запрос обрабатывает первое правило, у которого совпали и хост, и URL.
+Это удобно для страницы состояния, небольшого статического сайта, страницы
+блокировки для запросов, отклонённых ACL, или health check, который опрашивает
+вышестоящий балансировщик.
+</p><pre>
+http ОПЕРАЦИЯ ХОСТ URL [ПАРАМЕТРЫ]
+</pre>
+<p>
+ХОСТ сопоставляется с заголовком Host, URL - с путём без строки запроса.
+Минимальный статический сайт:
+</p><pre>
+auth iponly
+allow *
+
+http file * /           /usr/local/web/index.html
+http file * /*.html     "/usr/local/web/$1.html"
+http file * /css/*.css  "/usr/local/web/css/$1.css"
+http cache * /img/**    "/usr/local/web/img/$1" * 3600
+httpsrv -p80 -i127.0.0.1
+</pre>
+<p>
+<b>Шаблоны.</b> <code>*</code> означает любую последовательность символов внутри
+одного элемента пути и не пересекает <code>/</code>, поэтому правило не может
+попасть в каталог, который не назван в нём. <code>**</code> пересекает.
+Каждая звёздочка и каждая группа регулярного выражения запоминаются по порядку:
+<code>$1</code> и далее подставляют их в путь или адрес, который строит правило,
+<code>$0</code> - весь путь запроса. Правило <code>rewrite_host</code>
+использует звёздочки собственного шаблона хоста, поскольку переписывает именно
+его. В сборке с PCRE шаблон можно записать
+регулярным выражением с префиксом <code>pcre:</code> - и для URL, и для хоста:
+</p><pre>
+http file  * /d/*.txt       "/usr/local/web/$1.txt"
+http cache * "pcre:^/(.*)/pic/(.*)\.(gif|jpeg)$" "/usr/local/web/picts/$1/$2.$3"
+http file  status.example.com /**  "/usr/local/web/status/$1"
+http file  "pcre:^(www|web)\.example\.com$" /**  "/usr/local/web/$1"
+</pre>
+<p>
+Вне кавычек доллар начинает имя включаемого файла, поэтому аргумент, содержащий
+доллар - путь с <code>$1</code>, регулярное выражение с якорем <code>$</code> -
+записывается в кавычках, как выше. <code>$$</code> означает один доллар и тоже
+не читается как включение файла.
+</p>
+<p>
+<b>Операции.</b>
+</p><pre>
+&#35; file - отдать файл, через sendfile/TransmitFile там, где система это умеет
+http file * /dl/**  "/usr/local/web/dl/$1"
+
+&#35; cache - прочитать в память при первом запросе и отвечать из неё
+http cache * /css/*.css "/usr/local/web/css/$1.css"
+
+&#35; redir - ответить редиректом, 302, если код не задан
+http redir * /old/**  301 "https://example.org/$1"
+
+&#35; rewrite - изменить путь и передать запрос следующим правилам
+http rewrite * /alias/** "/w/$1"
+
+&#35; rewrite_host - то же для хоста, от которого зависит выбор следующих правил
+http rewrite_host *.old.example ** "$1.new.example"
+
+&#35; reply - только код ответа, без тела
+http reply * /health**  200 "X-Health: ok"
+http reply * /down**    503 "Retry-After: 30"
+
+&#35; echo, data - описание запроса или генерация содержимого заданного размера
+http echo * /echo**
+http data * /gen** size=1048576
+</pre>
+<p>
+<b>Что правило добавляет в ответ.</b> <code>file</code> и <code>cache</code>
+принимают после пути тип содержимого, max-age, добавляемые заголовки и код
+ответа. Любой из них можно опустить или записать как <code>*</code>:
+</p><pre>
+http ОПЕРАЦИЯ ХОСТ URL ПУТЬ [ТИП [MAX-AGE [ЗАГОЛОВКИ [КОД]]]]
+
+&#35; тип определяется по имени файла, клиенты кэшируют час
+http file * /img/*.png "/usr/local/web/img/$1.png" * 3600
+
+&#35; собственный тип и заголовок
+http file * /api/*.json "/usr/local/web/api/$1.json" application/json * "X-Api: 1"
+
+&#35; файл как тело страницы ошибки
+http file * /err/** /usr/local/web/404.html text/html * * 404
+</pre>
+<p>
+ЗАГОЛОВКИ - один аргумент, содержащий целые строки заголовков, разделённые
+обратной косой чертой и n - двумя символами, поскольку строка конфигурации не
+может содержать конец строки. Аргумент нужно брать в кавычки, в заголовках есть
+пробелы. Заголовки и max-age правила отправляются с тем кодом, который правило
+задало, но не с отказом, который решил вернуть сам сервер: на запрос
+отсутствующего файла 404 отвечает сервер, а не правило.
+</p>
+<p>
+Неизвестные серверу типы регистрируются командой
+<code>http_content_type</code>, а тип, названный в правиле, используется
+независимо от имени файла:
+</p><pre>
+http_content_type .webp image/webp
+http_content_type wasm  application/wasm
+</pre>
+<p>
+<b>Файлы и даты.</b> Принимается только полный путь - относительный отсчитывался
+бы от того каталога, в котором оказался сервис, - а путь с элементом
+<code>.</code> или <code>..</code>, концом строки или звёздочкой отвергается. В
+Windows путь должен указывать диск или сетевой ресурс (<code>"C:\web\$1"</code>
+или <code>"\\host\share\$1"</code>). Запрос, который декодируется в путь за
+пределами дерева, отвергается раньше всего этого. Каждый ответ содержит
+Last-Modified, а запрос с If-Modified-Since получает 304 без тела, если файл не
+изменился.
+</p>
+<p>
+<b>Кэширование.</b> <code>cache</code> читает файл один раз и дальше отвечает из
+памяти; изменившийся на диске файл читается заново, а файл больше мегабайта
+отдаётся так же, как это сделал бы <code>file</code>. При заданном MAX-AGE файл
+не проверяется в течение этого времени - правило уже сообщило клиентам, что
+столько файл можно считать неизменным, - и запрос стоит только копирования
+наружу. Без MAX-AGE каждый запрос делает stat, и изменение подхватывается сразу.
+</p>
+<p>
+<b>Страница блокировки.</b> Сервис, отклоняющий запрос редиректом, может
+отправить клиента на httpsrv, работающий рядом:
+</p><pre>
+auth iponly
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow *
+proxy -p3128 -i192.168.1.1
+
+flush
+auth iponly
+allow *
+http file * /**  /usr/local/web/blocked.html text/html * * 403
+httpsrv -p8080 -i127.0.0.1
+</pre>
+<p>
+<b>И сайт, и прокси.</b> Запрос может прийти так, как приходит на сайт - путь,
+имя в заголовке Host, - или так, как приходит на прокси: с полным URL, либо, для
+туннеля, с одним именем хоста в CONNECT. Читается и то, и другое. Запрос в форме
+для прокси аутентифицируется через Proxy-Authorization и отклоняется кодом 407,
+как это делает прокси; запрос в форме для сайта - через Authorization и 401. Чем
+он будет обработан, в обоих случаях решают правила.
+</p>
+<p>
+<code>proxypass</code> - правило, которое отвечает, забирая ресурс, поэтому один
+сервис может отдавать своё и проксировать остальное:
+</p><pre>
+auth iponly
+allow *
+http file * /local/** "/usr/local/web/$1"
+http proxypass * /**
+httpsrv -p8080
+</pre>
+<p>
+Правило доступа с перенаправлением на локальный прокси делает то же самое без
+отдельного правила. Цепочка без адреса и означает "локальный прокси", а второй
+<code>allow</code> - то, с чем совпадает сам прокси на своём проходе, так как
+правило с цепочкой второй раз не берётся:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow *
+http file * /local/** "/usr/local/web/$1"
+httpsrv -p8080
+</pre>
+<p>
+Аутентификация по той же причине происходит дважды - для сервиса и для прокси, -
+поэтому конфигурация, требующая учётных данных, запрашивает их так, как это
+делает прокси.
+</p>
+<p>
+Правила доступа просматриваются с начала на обоих проходах, и назначение запроса
+известно на втором. На первом сервис отвечает сам за себя, поэтому адрес или порт
+в правиле сопоставляется с адресом, на который подключился клиент; имя из запроса
+сопоставляется на обоих проходах. На втором назначение - то, которое названо в
+запросе, поэтому правила с адресом, портом или именем определяют, что прокси
+разрешено забрать, и определяют это до установления соединения:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow * * * 80,443
+deny *
+httpsrv -p8080
+</pre>
+<p>
+До правил доходит всё, забираются только порты 80 и 443, а <code>deny</code>,
+записанный до правила с цепочкой, действует на обоих проходах точно так же. Соединение с сервером сохраняется для следующего запроса и
+закрывается, если следующий запрос идёт в другое место или если сервер за это
+время его закрыл.
+</p>
+<p>
+<b>Соединения.</b> Клиент, обратившийся по HTTP/1.1, получает ответ 1.1, и
+соединение сохраняется для следующего запроса, если он не прислал
+<code>Connection: close</code>; клиенту 1.0 нужно запросить keep-alive явно.
+Соединение сохраняется только тогда, когда длина ответа известна точно - это
+верно для всех операций, кроме страниц администрирования, поэтому они всегда
+последнее, что отдаётся в соединении. Тело запроса, которое сервер не может
+дочитать до конца - присланное chunked или размером больше мегабайта, - тоже
+завершает соединение.
+</p>
+<p>
+<b>Администрирование.</b> Сервис <code>admin</code> - это httpsrv с уже
+объявленными страницами интерфейса администрирования, см.
+<a href="#ADMIN">Администрирование и анализ информации</a>. Правила можно
+добавлять перед ним так же, и они проверяются первыми.
+</p>
+ </p>
  <li><a name="SSLPLUGIN"><i>Как настроить TLS/SSL (https прокси, mTLS)</i></a>
 <p>
 Начиная с версии 0.9.7 поддержка TLS/SSL встроена в 3proxy при компиляции с OpenSSL
@@ -838,12 +1051,32 @@ ssl_nocli
 &#35; Генерация закрытого ключа CA
 openssl genrsa -out ca.key 4096
 
+&#35; Расширения, без которых сертификат не годится как CA
+cat > ca.ext << 'EOF'
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+
 &#35; Генерация сертификата CA (действителен 10 лет)
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+openssl req -new -nodes -key ca.key \
     -subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=My CA" \
-    -out ca.crt
+    -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 </pre>
 <p>
+Расширения обязательны. Без <b>basicConstraints=CA:TRUE</b> и
+<b>keyCertSign</b> сертификат не принимается как CA, и клиент сообщает, что не
+может получить сертификат издателя. <b>subjectKeyIdentifier</b> — то, на что
+ссылаются подписанные этим CA сертификаты.
+</p>
+<p>
+Расширения задаются файлом, а не через <b>-addext</b>, потому что LibreSSL —
+команда <b>openssl</b> в macOS и некоторых BSD — обрабатывает -addext иначе,
+чем OpenSSL. Приведённый вариант одинаково работает в обоих.
+</p>
+<p>
 Для MITM импортируйте ca.crt в браузеры/ОС клиентов как доверенный корневой CA.
 </p>
 <p>
@@ -876,8 +1109,18 @@ EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 \
     -extfile server.ext
+
+&#35; Проверка так же, как это делает современный клиент
+openssl verify -x509_strict -CAfile ca.crt server.crt
 </pre>
 <p>
+Проверять следует строго, потому что именно так проверяет клиент. OpenSSL 3
+добавляет идентификаторы ключей при подписании, а LibreSSL — нет, поэтому файл
+расширений запрашивает их явно. Python начиная с 3.13 проверяет строго и
+отвергает сертификат без <b>authorityKeyIdentifier</b>; другие клиенты идут тем
+же путём.
+</p>
+<p>
 Для публичного https:// прокси используйте CA вроде Let's Encrypt вместо самоподписанного.
 </p>
 <p>
@@ -896,6 +1139,8 @@ cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 
 &#35; Подписание CA
@@ -918,8 +1163,14 @@ openssl pkcs12 -export -out client1.p12 \
 
 &#35; CA
 openssl genrsa -out ca.key 4096
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+cat > ca.ext << 'EOF'
-    -subj "/CN=3proxy CA" -out ca.crt
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+openssl req -new -nodes -key ca.key -subj "/CN=3proxy CA" -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 
 &#35; Сервер
 openssl genrsa -out server.key 2048
@@ -929,6 +1180,8 @@ basicConstraints=CA:FALSE
 keyUsage = keyEncipherment
 extendedKeyUsage = serverAuth
 subjectAltName = DNS:localhost,DNS:proxy,IP:127.0.0.1
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
@@ -939,13 +1192,189 @@ openssl req -new -key client.key -subj "/CN=client" -out client.csr
 cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out client.crt -days 365 -sha256 -extfile client.ext
 openssl pkcs12 -export -out client.p12 -passout pass: \
     -inkey client.key -in client.crt -certfile ca.crt
+
+&#35; Оба должны пройти проверку, которую делает современный клиент
+openssl verify -x509_strict -CAfile ca.crt server.crt
+openssl verify -x509_strict -CAfile ca.crt client.crt
 </pre>
 
+
+ <li><a name="TRANSPARENT"><i>Как сделать транспарентный прокси</i></a>
+<p>
+Транспарентный прокси обслуживает клиентов, которые не настроены на работу
+через прокси. Пакетный фильтр перенаправляет их соединения на 3proxy, а команда
+<b>transparent</b> указывает сервису брать адрес назначения у фильтра, а не из
+запроса. Всё остальное работает как обычно: правила доступа, родительские
+прокси, ограничения и логирование видят настоящий адрес назначения. Работает в
+Linux и BSD. С версии 1.0.1 встроено в бинарник, раньше это был отдельный
+TransparentPlugin, и строка <b>plugin</b> больше не нужна.
+</p>
+<p>
+Команда даёт и адрес, и порт назначения, поэтому сервис обслуживает всё, что
+на него перенаправлено, а не один порт с одним адресом назначения.
+</p>
+<p>
+Без неё сервис берёт адрес откуда-то ещё: HTTP-прокси - из заголовка
+<b>Host</b>, порт-маппер - из своей конфигурации. Именно получение адреса от
+фильтра позволяет работать с остальными протоколами и делает адрес
+достоверным, а не заявленным клиентом.
+</p>
+<p>
+Нагляднее всего это с <b>tlspr</b>. Без перенаправления трафика (или без
+резолва имён на него через DNS) на него вообще ничего не попадёт. С
+перенаправлением он получает и имя из TLS handshake, и адрес назначения -
+именно это позволяет писать правила доступа по именам хостов: имя из handshake
+проверяется в ACL, а соединение идёт на тот адрес, куда шёл клиент. Без адреса
+пришлось бы резолвить имя самостоятельно, то есть делать ещё один запрос и
+получать ещё один ответ.
+</p>
+<p>
+Конфигурация для веб- и TLS-трафика:
+</p><pre>
+log /var/log/3proxy.log D
+auth iponly
+allow *
+
+&#35; для сервисов ниже адрес назначения берётся из перенаправления
+transparent
+
+&#35; обычный веб-трафик, перенаправленный сюда с порта 80
+proxy -p3129 -e192.0.2.10
+
+&#35; TLS, перенаправленный сюда с порта 443: без этого у tlspr было бы только
+&#35; имя из handshake, а так есть и адрес
+tlspr -p3143 -e192.0.2.10
+
+notransparent
+</pre>
+<p>
+<b>-e</b> задаёт сервисам собственный адрес для исходящих соединений. Именно
+этот адрес исключается в правилах перенаправления, и это исключение не даёт
+соединениям самого прокси попасть обратно в него. Без исключения соединение,
+которое 3proxy устанавливает к серверу назначения, попадает под то же правило,
+возвращается в 3proxy, и трафик зацикливается. Можно вместо этого запускать
+3proxy под отдельной учётной записью и исключать её - так лучше, если у машины
+один адрес.
+</p>
+
+<p><b>Linux, iptables</b>. Для транзитного трафика:
+</p><pre>
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80  -j REDIRECT --to-ports 3129
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+</pre>
+<p>
+Трафик самой машины проходит через цепочку OUTPUT, где соединения прокси нужно
+исключить:
+</p><pre>
+&#35; по адресу, с которого сервисы устанавливают соединения
+iptables -t nat -A OUTPUT -p tcp --dport 80 ! -s 192.0.2.10 -j REDIRECT --to-ports 3129
+
+&#35; либо по учётной записи, под которой работает 3proxy
+iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner proxy3 \
+    -j REDIRECT --to-ports 3129
+</pre>
+
+<p><b>Linux, nftables</b> (Debian 11+, Ubuntu 22.04+, RHEL 8+, Fedora, Arch):
+</p><pre>
+table ip proxy3 {
+	chain prerouting {
+		type nat hook prerouting priority dstnat; policy accept;
+		iif "eth0" tcp dport 80 redirect to :3129
+		iif "eth0" tcp dport 443 redirect to :3143
+	}
+
+	chain output {
+		type nat hook output priority dstnat; policy accept;
+		meta skuid != "proxy3" tcp dport 80 redirect to :3129
+		meta skuid != "proxy3" tcp dport 443 redirect to :3143
+	}
+}
+</pre>
+<p>
+Загружается через <b>nft -f</b>, сохраняется в <b>/etc/nftables.conf</b>
+(Debian, Ubuntu) или <b>/etc/sysconfig/nftables.conf</b> (RHEL, Fedora). Имя
+таблицы не может начинаться с цифры, поэтому таблица называется не 3proxy.
+</p>
+
+<p><b>Linux, firewalld</b> (RHEL, CentOS Stream, Fedora, openSUSE):
+</p><pre>
+firewall-cmd --permanent --zone=internal --add-forward-port=port=80:proto=tcp:toport=3129
+firewall-cmd --permanent --zone=internal --add-forward-port=port=443:proto=tcp:toport=3143
+firewall-cmd --reload
+</pre>
+<p>
+Исключение для трафика самого прокси в таком виде не задаётся, для него нужно
+прямое правило:
+</p><pre>
+firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 \
+    -p tcp --dport 80 -m owner ! --uid-owner proxy3 -j REDIRECT --to-ports 3129
+firewall-cmd --reload
+</pre>
+
+<p><b>Linux, ufw</b> (Ubuntu, Debian). В ufw нет команды для перенаправления,
+правила добавляются в <b>/etc/ufw/before.rules</b> перед блоком <b>*filter</b>:
+</p><pre>
+*nat
+:PREROUTING ACCEPT [0:0]
+-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3129
+-A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+COMMIT
+</pre>
+
+<p>
+В Linux 3proxy спрашивает у ядра, куда шло соединение. В BSD он спрашивает у pf,
+который хранит исходный адрес назначения в таблице состояний, через
+<b>/dev/pf</b> - поэтому работают правила <b>rdr</b>, и 3proxy должен иметь
+доступ к этому устройству. Если перенаправление оставляет адрес на самом сокете,
+используется он: так делают OpenBSD <b>divert-to</b> и FreeBSD <b>ipfw fwd</b>.
+</p>
+<p>
+Механизм выбирается автоматически, а команда <b>transparent</b> принимает
+аргумент для случаев, когда его надо зафиксировать: <b>auto</b> (по умолчанию),
+<b>netfilter</b>, <b>pf</b> или <b>socket</b> для чтения адреса с сокета. Режим,
+которого нет в сборке, отвергается, поэтому конфигурация, написанная для другой
+платформы, не запустится вместо того, чтобы молча делать что-то другое.
+</p>
+
+<p><b>FreeBSD, NetBSD, OpenBSD, pf</b>. Перенаправление в <b>/etc/pf.conf</b> с
+исключением адреса, с которого соединяется прокси:
+</p><pre>
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 80  -&gt; 127.0.0.1 port 3129
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 443 -&gt; 127.0.0.1 port 3143
+</pre>
+<p>
+Загружается через <b>pfctl -f /etc/pf.conf</b>. 3proxy ищет адрес назначения в
+таблице состояний pf, поэтому ему нужен доступ на чтение к <b>/dev/pf</b>: либо
+запуск от root, либо права на устройство для его учётной записи.
+</p>
+
+<p><b>OpenBSD, divert-to</b> - альтернатива, оставляющая адрес на сокете, доступ
+к <b>/dev/pf</b> при этом не нужен:
+</p><pre>
+pass in on em0 inet proto tcp to any port 80  divert-to 127.0.0.1 port 3129
+pass in on em0 inet proto tcp to any port 443 divert-to 127.0.0.1 port 3143
+</pre>
+
+<p><b>FreeBSD, ipfw</b>. <b>fwd</b> доставляет соединение локально, не переписывая
+его, и адрес тоже остаётся на сокете:
+</p><pre>
+ipfw add fwd 127.0.0.1,3129 tcp from any to any 80  in recv em0
+ipfw add fwd 127.0.0.1,3143 tcp from any to any 443 in recv em0
+</pre>
+
+<p><b>macOS</b>: <b>/dev/pf</b> есть, но заголовочных файлов для него нет,
+поэтому в сборке под macOS нет обращения к pf, а ни <b>divert-to</b>, ни ipfw в
+macOS нет. Транспарентное проксирование там неприменимо, хотя команды в сборке
+присутствуют.
+</p>
+
  <li><a name="PCRE"><i>Как использовать PCRE-фильтрацию (регулярные выражения)</i></a>
 <p>
 Начиная с версии 0.9.7 фильтрация PCRE встроена в 3proxy при компиляции с поддержкой
@@ -1004,6 +1433,34 @@ pcre_extend deny * 192.168.0.1/16
 <p>
 <b>Примечание:</b> Регулярные выражения не требуют авторизации и не могут заменить
 авторизацию и/или ACL allow/deny.
+</p>
+<p>
+<b>Регулярные выражения в именах хостов:</b> имя хоста в списке назначения
+правила доступа может быть записано регулярным выражением вместо маски, для
+этого используется префикс <code>pcre:</code> (<code>regex:</code> означает то
+же самое). Требуется сборка с поддержкой PCRE, как и для команд
+<code>pcre</code> выше.
+</p><pre>
+&#35; Маска: имя сопоставляется только с начала и с конца
+deny * * *ads.example.com
+
+&#35; Регулярное выражение: всё, что выразимо средствами PCRE
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow * * "pcre:^(www|api)\.example\.com$"
+</pre>
+<p>
+Перед сопоставлением имя приводится к нижнему регистру, завершающие точки
+удаляются, поэтому шаблоны пишутся в нижнем регистре. Шаблон, оканчивающийся на
+<code>$</code>, нужно взять в кавычки или записать как <code>$$</code>: вне
+кавычек одиночный доллар начинает имя включаемого файла. Имена допустимы только
+в списке назначения (список источника - адреса), и имя проверяется лишь тогда,
+когда оно присутствует в запросе. Маска обходится дешевле и достаточна для
+большинства правил, регулярное выражение сопоставляется на каждый запрос.
+</p>
+<p>
+Тот же префикс и те же шаблоны использует команда <code>http</code> встроенного
+HTTP-сервера - для хоста, на который отвечает правило, и для URL, который оно
+сопоставляет.
 </p>
 
  <li><a name="AUTH"><i>Как ограничить доступ к службе</i></a>

doc/html/index.html

@@ -5,8 +5,8 @@
 <a href="howtor.html">How To (Russian)</a><br>
 <a href="devref.html">Developer reference</a><br>
 <h3>Man pages:</h3>
-<br><A HREF="man8/3proxy_crypt.8.html">3proxy_crypt.8</A>
 <br><A HREF="man8/3proxy.8.html">3proxy.8</A>
+<br><A HREF="man8/3proxy_crypt.8.html">3proxy_crypt.8</A>
 <br><A HREF="man8/ftppr.8.html">ftppr.8</A>
 <br><A HREF="man8/imapp.8.html">imapp.8</A>
 <br><A HREF="man8/pop3p.8.html">pop3p.8</A>

doc/html/man8/3proxy.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -25,7 +25,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>3proxy</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>3proxy</b> -
 3[APA3A] tiny proxy server, or trivial proxy server, or free
 proxy server</p>
 
@@ -34,7 +34,7 @@ proxy server</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>3proxy</b>
+<p style="margin-left:9%; margin-top: 1em"><b>3proxy</b>
 [<i>config_file</i>] <b><br>
 3proxy</b> [<i>--install</i>] <b><br>
 3proxy</b> [<i>--remove</i>]</p>
@@ -44,7 +44,7 @@ proxy server</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>3proxy</b> is
+<p style="margin-left:9%; margin-top: 1em"><b>3proxy</b> is
 a universal proxy server. It can be used to provide internal
 users with fully controllable access to external resources
 or to provide external users with access to internal
@@ -71,7 +71,7 @@ under Unix). So you can play your favourite games, listen to
 music, exchange files and messages and even accept incoming
 connections behind a proxy server.</p>
 
-<p style="margin-left:6%; margin-top: 1em"><i>dnspr</i>
+<p style="margin-left:9%; margin-top: 1em"><i>dnspr</i>
 does not exist as an independent service. It&rsquo;s a DNS
 caching proxy (it requires <i>nscache</i> and <i>nserver</i>
 to be set in the configuration. Only A-records are cached.
@@ -79,7 +79,7 @@ Please note that this caching is mostly a &rsquo;hack&rsquo;
 and has nothing to do with a real DNS server, but it works
 perfectly for SOHO networks.</p>
 
-<p style="margin-left:6%; margin-top: 1em">3proxy supports
+<p style="margin-left:9%; margin-top: 1em">3proxy supports
 access control lists (ACL) like network router. Source and
 destination networks and destination port can be specified.
 In addition, usernames and gateway action (for example GET
@@ -92,7 +92,7 @@ ACL action request can be allowed, denied or redirected to
 another host or to another proxy server or even to a chain
 of proxy servers.</p>
 
-<p style="margin-left:6%; margin-top: 1em">It supports
+<p style="margin-left:9%; margin-top: 1em">It supports
 different types of logging: to logfiles, <b>syslog</b>(3)
 (only under Unix) or to an ODBC database. Logging format is
 tunable to provide compatibility with existing log file
@@ -105,9 +105,9 @@ Apache or Squid log parsers.</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>config_file</b></p>
+<p style="margin-left:9%; margin-top: 1em"><b>config_file</b></p>
 
-<p style="margin-left:15%;">Name of config file. See
+<p style="margin-left:18%;">Name of config file. See
 <b>3proxy.cfg</b>(3) for configuration file format. Under
 Windows, if config_file is not specified, <b>3proxy</b>
 looks for a file named <i>3proxy.cfg</i> in the default
@@ -119,14 +119,14 @@ script just by setting +x mode and adding <br>
 #!/usr/local/3proxy/3proxy <br>
 as a first line in 3proxy.cfg</p>
 
-<p style="margin-left:6%;"><b>--install</b></p>
+<p style="margin-left:9%;"><b>--install</b></p>
 
-<p style="margin-left:15%;">(Windows NT family only)
+<p style="margin-left:18%;">(Windows NT family only)
 install <b>3proxy</b> as a system service</p>
 
-<p style="margin-left:6%;"><b>--remove</b></p>
+<p style="margin-left:9%;"><b>--remove</b></p>
 
-<p style="margin-left:15%;">(Windows NT family only) remove
+<p style="margin-left:18%;">(Windows NT family only) remove
 <b>3proxy</b> from system services</p>
 
 <h2>SIGNALS
@@ -134,29 +134,29 @@ install <b>3proxy</b> as a system service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Under Unix there
+<p style="margin-left:9%; margin-top: 1em">Under Unix there
 are a few signals <b>3proxy</b> catches. See <b>kill</b>(1).
 <b><br>
 SIGTERM</b></p>
 
-<p style="margin-left:15%;">clean up connections and
+<p style="margin-left:18%;">clean up connections and
 exit</p>
 
-<p style="margin-left:6%;"><b>SIGPAUSE</b></p>
+<p style="margin-left:9%;"><b>SIGPAUSE</b></p>
 
-<p style="margin-left:15%;">stop accepting new connections,
+<p style="margin-left:18%;">stop accepting new connections,
 on second signal - start and re-read configuration</p>
 
-<p style="margin-left:6%;"><b>SIGCONT</b></p>
+<p style="margin-left:9%;"><b>SIGCONT</b></p>
 
-<p style="margin-left:15%;">start to accept new
+<p style="margin-left:18%;">start to accept new
 connections</p>
 
-<p style="margin-left:6%;"><b>SIGUSR1</b></p>
+<p style="margin-left:9%;"><b>SIGUSR1</b></p>
 
-<p style="margin-left:15%;">reload configuration</p>
+<p style="margin-left:18%;">reload configuration</p>
 
-<p style="margin-left:6%; margin-top: 1em">Under Windows,
+<p style="margin-left:9%; margin-top: 1em">Under Windows,
 if <b>3proxy</b> is installed as a service you can use
 standard service management to start, stop, pause and
 continue the 3proxy service, for example: <b><br>
@@ -165,7 +165,7 @@ net stop 3proxy <br>
 net pause 3proxy <br>
 net continue 3proxy</b></p>
 
-<p style="margin-left:6%; margin-top: 1em">Web admin
+<p style="margin-left:9%; margin-top: 1em">Web admin
 service can also be used to reload configuration. Use wget
 to automate this task.</p>
 
@@ -175,10 +175,10 @@ to automate this task.</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i>/usr/local/3proxy/3proxy.cfg
+<p style="margin-left:9%; margin-top: 1em"><i>/usr/local/3proxy/3proxy.cfg
 (3proxy.cfg)</i></p>
 
-<p style="margin-left:15%;"><b>3proxy</b> configuration
+<p style="margin-left:18%;"><b>3proxy</b> configuration
 file</p>
 
 <h2>BUGS
@@ -186,7 +186,7 @@ file</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -194,7 +194,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy.cfg(5),
+<p style="margin-left:9%; margin-top: 1em">3proxy.cfg(5),
 proxy(8), ftppr(8), socks(8), pop3p(8), imapp(8), tcppm(8),
 udppm(8), kill(1), syslogd(8), <br>
 https://3proxy.org/</p>
@@ -204,7 +204,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/3proxy_crypt.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -26,7 +26,7 @@
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>3proxy_crypt</b>
+<p style="margin-left:9%; margin-top: 1em"><b>3proxy_crypt</b>
 - utility to generate encrypted passwords for 3proxy</p>
 
 <h2>SYNOPSIS
@@ -35,7 +35,7 @@
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>3proxy_crypt</b>
+<p style="margin-left:9%; margin-top: 1em"><b>3proxy_crypt</b>
 <i>password</i> <b><br>
 3proxy_crypt</b> <i>salt password</i></p>
 
@@ -45,23 +45,23 @@
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i><b>3proxy_crypt</b></i>
+<p style="margin-left:9%; margin-top: 1em"><i><b>3proxy_crypt</b></i>
 is a utility to generate encrypted password hashes for use
 with 3proxy configuration. Encrypted passwords allow the
 system to avoid storing passwords in cleartext in
 configuration files.</p>
 
-<p style="margin-left:6%; margin-top: 1em">When invoked
+<p style="margin-left:9%; margin-top: 1em">When invoked
 with a single argument, it produces an NT password hash
 (MD4-based, suitable for NTLM authentication). The output is
 prefixed with <b>NT:</b>.</p>
 
-<p style="margin-left:6%; margin-top: 1em">When invoked
+<p style="margin-left:9%; margin-top: 1em">When invoked
 with two arguments (salt and password), it produces a
 BLAKE2b password hash. The salt length is limited to 64
 characters. The output is prefixed with <b>CR:</b>.</p>
 
-<p style="margin-left:6%; margin-top: 1em">The resulting
+<p style="margin-left:9%; margin-top: 1em">The resulting
 hash can be used in the 3proxy configuration file with the
 <b>users</b> directive instead of a cleartext password.</p>
 
@@ -71,25 +71,25 @@ hash can be used in the 3proxy configuration file with the
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i>password</i></p>
+<p style="margin-left:9%; margin-top: 1em"><i>password</i></p>
 
-<p style="margin-left:15%;">Cleartext password to
+<p style="margin-left:18%;">Cleartext password to
 encrypt.</p>
 
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="5%">
 
 
 <p><i>salt</i></p></td>
 <td width="4%"></td>
-<td width="65%">
+<td width="67%">
 
 
 <p>Salt string for BLAKE2b hashing (max 64 characters).</p></td>
-<td width="20%">
+<td width="15%">
 </td></tr>
 </table>
 
@@ -98,30 +98,30 @@ encrypt.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Generate NT
+<p style="margin-left:9%; margin-top: 1em">Generate NT
 password hash:</p>
 
-<p style="margin-left:15%;">3proxy_crypt
+<p style="margin-left:18%;">3proxy_crypt
 MySecretPassword</p>
 
-<p style="margin-left:6%;">Result:</p>
+<p style="margin-left:9%;">Result:</p>
 
 
-<p style="margin-left:15%;">NT:3F7E6D8D96E8E7A9B0C1D2E3F4A5B6C7</p>
+<p style="margin-left:18%;">NT:3F7E6D8D96E8E7A9B0C1D2E3F4A5B6C7</p>
 
-<p style="margin-left:6%;">Generate BLAKE2b password hash
+<p style="margin-left:9%;">Generate BLAKE2b password hash
 with salt:</p>
 
-<p style="margin-left:15%;">3proxy_crypt MySalt
+<p style="margin-left:18%;">3proxy_crypt MySalt
 MySecretPassword</p>
 
-<p style="margin-left:6%;">Result:</p>
+<p style="margin-left:9%;">Result:</p>
 
-<p style="margin-left:15%;">CR:$3$MySalt$...</p>
+<p style="margin-left:18%;">CR:$3$MySalt$...</p>
 
-<p style="margin-left:6%;">Using in 3proxy.cfg:</p>
+<p style="margin-left:9%;">Using in 3proxy.cfg:</p>
 
-<p style="margin-left:15%;">users
+<p style="margin-left:18%;">users
 user1:CR:$3$MySalt$...</p>
 
 <h2>NOTES
@@ -129,11 +129,11 @@ user1:CR:$3$MySalt$...</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">The NT hash uses
+<p style="margin-left:9%; margin-top: 1em">The NT hash uses
 the RSA MD4 Message-Digest Algorithm. The BLAKE2b hash uses
 the BLAKE2 cryptographic hash function.</p>
 
-<p style="margin-left:6%; margin-top: 1em">When a password
+<p style="margin-left:9%; margin-top: 1em">When a password
 hash is prefixed with <b>NT:</b> or <b>CR:</b>, 3proxy uses
 the corresponding algorithm to verify passwords instead of
 comparing cleartext strings.</p>
@@ -143,7 +143,7 @@ comparing cleartext strings.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -151,7 +151,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 3proxy.cfg(5), <br>
 https://3proxy.org/</p>
 
@@ -160,7 +160,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/ftppr.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>ftppr</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>ftppr</b> -
 FTP proxy gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ FTP proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>ftppr</b>
+<p style="margin-left:9%; margin-top: 1em"><b>ftppr</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@@ -43,7 +43,7 @@ FTP proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>ftppr</b> is
+<p style="margin-left:9%; margin-top: 1em"><b>ftppr</b> is
 FTP gateway service to allow internal users to access
 external FTP servers.</p>
 
@@ -55,81 +55,80 @@ external FTP servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never look for username
+<p>Never look for username authentication.</p></td></tr>
-authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -140,13 +139,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -156,56 +155,55 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/ftppr.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-h</b></p></td>
+<p><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Default destination. It&rsquo;s
+<p>Default destination. It&rsquo;s used if the target
-used if the target address is not specified by the user.</p></td></tr>
+address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Port. Port proxy listens for
+<p>Port. Port proxy listens for incoming connections.
-incoming connections. Default is 21.</p></td></tr>
+Default is 21.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; precedes
+&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -213,7 +211,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You can use any
+<p style="margin-left:9%; margin-top: 1em">You can use any
 FTP client, regardless of FTP proxy support. For a client
 with FTP proxy support, configure <i>internal_ip</i> and
 <i>port</i> in the FTP proxy parameters. For clients without
@@ -232,7 +230,7 @@ supported.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -240,7 +238,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 proxy(8), pop3p(8), socks(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -250,7 +248,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/imapp.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>imapp</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>imapp</b> -
 IMAPv4 proxy gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ IMAPv4 proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>imapp</b>
+<p style="margin-left:9%; margin-top: 1em"><b>imapp</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@@ -44,7 +44,7 @@ IMAPv4 proxy gateway service</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i><b>imapp</b></i>
+<p style="margin-left:9%; margin-top: 1em"><i><b>imapp</b></i>
 is IMAPv4 (IMAP4rev1) gateway service to allow internal
 users to access external IMAP servers.</p>
 
@@ -56,81 +56,80 @@ users to access external IMAP servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never look for username
+<p>Never look for username authentication.</p></td></tr>
-authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -141,13 +140,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -157,69 +156,68 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/imapp.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Port. Port proxy listens for
+<p>Port. Port proxy listens for incoming connections.
-incoming connections. Default is 143.</p></td></tr>
+Default is 143.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-h</b></p></td>
+<p><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Default destination. It&rsquo;s
+<p>Default destination. It&rsquo;s used if the target
-used if the target address is not specified by the user.</p></td></tr>
+address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-x</b></p></td>
+<p><b>-x</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Disable STARTTLS support.
+<p>Disable STARTTLS support. STARTTLS is not announced in
-STARTTLS is not announced in the CAPABILITY response and the
+the CAPABILITY response and the STARTTLS command is not
-STARTTLS command is not accepted.</p></td></tr>
+accepted.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; precedes
+&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -227,7 +225,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You can use any
+<p style="margin-left:9%; margin-top: 1em">You can use any
 MUA (Mail User Agent) with IMAPv4 support. Set the client to
 use <i>internal_ip</i> and <i>port</i> as an IMAP server.
 The address of the real IMAP server must be configured as a
@@ -262,7 +260,7 @@ fails.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -270,7 +268,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 ftppr(8), pop3p(8), proxy(8), smtpp(8), socks(8), tcppm(8),
 tlspr(8), udppm(8), syslogd(8), <br>
 https://3proxy.org/</p>
@@ -280,7 +278,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/pop3p.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>pop3p</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>pop3p</b> -
 POP3 proxy gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ POP3 proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>pop3p</b>
+<p style="margin-left:9%; margin-top: 1em"><b>pop3p</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@@ -44,7 +44,7 @@ POP3 proxy gateway service</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i><b>pop3p</b></i>
+<p style="margin-left:9%; margin-top: 1em"><i><b>pop3p</b></i>
 is POP3 gateway service to allow internal users to access
 external POP3 servers.</p>
 
@@ -56,81 +56,80 @@ external POP3 servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never look for username
+<p>Never look for username authentication.</p></td></tr>
-authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -141,13 +140,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -157,69 +156,68 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/pop3p.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Port. Port proxy listens for
+<p>Port. Port proxy listens for incoming connections.
-incoming connections. Default is 110.</p></td></tr>
+Default is 110.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-h</b></p></td>
+<p><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Default destination. It&rsquo;s
+<p>Default destination. It&rsquo;s used if the target
-used if the target address is not specified by the user.</p></td></tr>
+address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-x</b></p></td>
+<p><b>-x</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Disable STARTTLS (STLS) support.
+<p>Disable STARTTLS (STLS) support. STLS is not announced
-STLS is not announced in the CAPA response and the STLS
+in the CAPA response and the STLS command is not
-command is not accepted.</p></td></tr>
+accepted.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; precedes
+&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -227,7 +225,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You can use any
+<p style="margin-left:9%; margin-top: 1em">You can use any
 MUA (Mail User Agent) with POP3 support. Set the client to
 use <i>internal_ip</i> and <i>port</i> as a POP3 server. The
 address of the real POP3 server must be configured as a part
@@ -255,7 +253,7 @@ TLS handshake with the client fails.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -263,7 +261,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -273,7 +271,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/proxy.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>proxy</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>proxy</b> -
 HTTP proxy gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ HTTP proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>proxy</b>
+<p style="margin-left:9%; margin-top: 1em"><b>proxy</b>
 [<b>-d</b>][<b>-a</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]</p>
@@ -42,7 +42,7 @@ HTTP proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>proxy</b> is
+<p style="margin-left:9%; margin-top: 1em"><b>proxy</b> is
 HTTP gateway service with HTTPS and FTP over HTTPS
 support.</p>
 
@@ -54,81 +54,80 @@ support.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never ask for username
+<p>Never ask for username authentication</p></td></tr>
-authentication</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -139,13 +138,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
 <p><b>-i</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -155,68 +154,65 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/proxy.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-a</b></p></td>
+<p><b>-a</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Anonymous. Hide information
+<p>Anonymous. Hide information about client.</p></td></tr>
-about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-a1</b></p></td>
+<p><b>-a1</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Anonymous. Show fake information
+<p>Anonymous. Show fake information about client.</p></td></tr>
-about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Port. Port proxy listens for
+<p>Port. Port proxy listens for incoming connections.
-incoming connections. Default is 3128.</p></td></tr>
+Default is 3128.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; preceeds
+&acute;<i>@</i>&acute; preceeds <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -224,7 +220,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You should use a
+<p style="margin-left:9%; margin-top: 1em">You should use a
 client with HTTP proxy support or configure a router to
 redirect HTTP traffic to the proxy (transparent proxy).
 Configure the client to connect to <i>internal_ip</i> and
@@ -237,7 +233,7 @@ TCP-based protocol. If you need to limit clients, use
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -245,7 +241,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -255,7 +251,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/smtpp.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>smtpp</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>smtpp</b> -
 SMTP proxy gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ SMTP proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>smtpp</b>
+<p style="margin-left:9%; margin-top: 1em"><b>smtpp</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@@ -44,7 +44,7 @@ SMTP proxy gateway service</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i><b>smtpp</b></i>
+<p style="margin-left:9%; margin-top: 1em"><i><b>smtpp</b></i>
 is SMTP gateway service to allow internal users to access
 external SMTP servers.</p>
 
@@ -56,81 +56,80 @@ external SMTP servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never look for username
+<p>Never look for username authentication.</p></td></tr>
-authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -141,13 +140,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -157,69 +156,68 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/smtpp.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Port. Port proxy listens for
+<p>Port. Port proxy listens for incoming connections.
-incoming connections. Default is 587.</p></td></tr>
+Default is 587.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-h</b></p></td>
+<p><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Default destination. It&rsquo;s
+<p>Default destination. It&rsquo;s used if the target
-used if the target address is not specified by the user.</p></td></tr>
+address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-x</b></p></td>
+<p><b>-x</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Disable STARTTLS support.
+<p>Disable STARTTLS support. STARTTLS is not announced in
-STARTTLS is not announced in the EHLO response and the
+the EHLO response and the STARTTLS command is not
-STARTTLS command is not accepted.</p></td></tr>
+accepted.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; precedes
+&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -227,7 +225,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You can use any
+<p style="margin-left:9%; margin-top: 1em">You can use any
 MUA (Mail User Agent) with SMTP authentication support. Set
 the client to use <i>internal_ip</i> and <i>port</i> as an
 SMTP server. The address of the real SMTP server must be
@@ -256,7 +254,7 @@ fails.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -264,7 +262,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -274,7 +272,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/socks.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>socks</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>socks</b> -
 SOCKS 4/4.5/5 gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ SOCKS 4/4.5/5 gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>socks</b>
+<p style="margin-left:9%; margin-top: 1em"><b>socks</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]</p>
@@ -42,7 +42,7 @@ SOCKS 4/4.5/5 gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>socks</b> is
+<p style="margin-left:9%; margin-top: 1em"><b>socks</b> is
 SOCKS server. It supports SOCKSv4, SOCKSv4.5 (extension to
 v4 for server side name resolution) and SOCKSv5. SOCKSv5
 specification allows both outgoing and reverse TCP
@@ -56,82 +56,81 @@ connections and UDP portmapping.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never ask for username
+<p>Never ask for username authentication</p></td></tr>
-authentication</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from.
+should initiate connections from. External IP must be
-External IP must be specified if you need incoming
+specified if you need incoming connections. By default, the
-connections. By default, the system will decide which
+system will decide which address to use in accordance with
-address to use in accordance with the routing table.</p></td></tr>
+the routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -142,13 +141,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
 <p><b>-Ne</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>External NAT address 3proxy reports to client for
@@ -157,77 +156,75 @@ and destination server. By default, the external address is
 reported. It&rsquo;s only useful in the case of IP-IP NAT
 and does not work with port translation.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-Ni</b></p></td>
+<p><b>-Ni</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Internal NAT address 3proxy
+<p>Internal NAT address 3proxy reports to client for
-reports to client for UDPASSOC. This is external address of
+UDPASSOC. This is external address of the NAT between 3proxy
-the NAT between 3proxy and the client, client uses to
+and the client, client uses to connect to 3proxy. By
-connect to 3proxy. By default, the internal address is
+default, the internal address is reported. It&rsquo;s only
-reported. It&rsquo;s only useful in the case of IP-IP NAT
+useful in the case of IP-IP NAT and does not work with port
-and does not work with port translation.</p></td></tr>
+translation.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-i</b></p></td>
+<p><b>-i</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Internal address. IP address the
+<p>Internal address. IP address the proxy accepts
-proxy accepts connections to. By default, connections to any
+connections to. By default, connections to any interface are
-interface are accepted. It&acute;s usually unsafe. Unix
+accepted. It&acute;s usually unsafe. Unix domain sockets can
-domain sockets can be specified with
+be specified with <i>-iunix:/path/to/socket</i> syntax
-<i>-iunix:/path/to/socket</i> syntax (e.g.,
+(e.g., -iunix:/var/run/socks.sock). On Linux, abstract
--iunix:/var/run/socks.sock). On Linux, abstract sockets use
+sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
-<i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Port. Port proxy listens for
+<p>Port. Port proxy listens for incoming connections.
-incoming connections. Default is 1080.</p></td></tr>
+Default is 1080.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; preceeds
+&acute;<i>@</i>&acute; preceeds <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -235,7 +232,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You should use a
+<p style="margin-left:9%; margin-top: 1em">You should use a
 client with SOCKS support or use some socksification support
 (for example <i>SocksCAP</i> or <i>FreeCAP</i>). Configure
 client to use <i>internal_ip</i> and <i>port</i>. SOCKS
@@ -250,7 +247,7 @@ privileges). If you need to control access, use
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -258,7 +255,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 proxy(8), ftppr(8), pop3p(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -268,7 +265,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/tcppm.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -25,7 +25,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>tcppm</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>tcppm</b> -
 TCP port mapper</p>
 
 <h2>SYNOPSIS
@@ -33,7 +33,7 @@ TCP port mapper</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>tcppm</b>
+<p style="margin-left:9%; margin-top: 1em"><b>tcppm</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-i</b><i>internal_ip</i>] [<b>-e</b><i>external_ip</i>]
 <i>local_port remote_host remote_port</i></p>
@@ -44,7 +44,7 @@ TCP port mapper</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i><b>tcppm</b></i>
+<p style="margin-left:9%; margin-top: 1em"><i><b>tcppm</b></i>
 forwards connections from local to remote TCP port</p>
 
 <h2>OPTIONS
@@ -55,69 +55,69 @@ forwards connections from local to remote TCP port</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -128,13 +128,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -144,32 +144,31 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/tcppm.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; precedes
+&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>ARGUMENTS
@@ -178,23 +177,23 @@ You may want to try something like -S8192 if you experience
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i>local_port</i></p>
+<p style="margin-left:9%; margin-top: 1em"><i>local_port</i></p>
 
-<p style="margin-left:15%;">- port tcppm accepts
+<p style="margin-left:18%;">- port tcppm accepts
 connections on</p>
 
-<p style="margin-left:6%;"><i>remote_host</i></p>
+<p style="margin-left:9%;"><i>remote_host</i></p>
 
-<p style="margin-left:15%;">- IP address of the host the
+<p style="margin-left:18%;">- IP address of the host the
 connection is forwarded to. Unix domain sockets can be
 specified with the syntax <i>unix:/path/to/socket</i> (e.g.,
 unix:/var/run/app.sock). On Linux, abstract (fileless) Unix
 sockets use the syntax <i>unix:@socketname</i> (e.g.,
 unix:@app.socket).</p>
 
-<p style="margin-left:6%;"><i>remote_port</i></p>
+<p style="margin-left:9%;"><i>remote_port</i></p>
 
-<p style="margin-left:15%;">- remote port the connection is
+<p style="margin-left:18%;">- remote port the connection is
 forwarded to. Ignored when using Unix socket destination,
 but must be specified (use any positive value) for syntax
 compatibility.</p>
@@ -204,7 +203,7 @@ compatibility.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Any TCP-based
+<p style="margin-left:9%; margin-top: 1em">Any TCP-based
 application can be used as a client. Use <i>internal_ip</i>
 and <i>local_port</i> as the destination in the client
 application. The connection is forwarded to
@@ -215,7 +214,7 @@ application. The connection is forwarded to
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -223,7 +222,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -233,7 +232,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/tlspr.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -24,7 +24,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b> -
 SNI proxy gateway service</p>
 
 <h2>SYNOPSIS
@@ -32,7 +32,7 @@ SNI proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b>
+<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b>
 [<b>-d</b>][<b>-a</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>listening_port</i>]
 [<b>-P</b><i>destination_port</i>]
@@ -45,7 +45,7 @@ SNI proxy gateway service</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b> is
+<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b> is
 an SNI gateway service (destination host is taken from TLS
 handshake). The destination port must be specified via the
 -P option (or it may be detected with the Transparent
@@ -61,81 +61,80 @@ access control is required.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-u</b></p></td>
+<p><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Never ask for username
+<p>Never ask for username authentication</p></td></tr>
-authentication</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate connections from. By
+should initiate connections from. By default, the system
-default, the system will decide which address to use in
+will decide which address to use in accordance with the
-accordance with the routing table.</p></td></tr>
+routing table.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -146,13 +145,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
 <p><b>-i</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts
@@ -162,93 +161,90 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/tlspr.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-a</b></p></td>
+<p><b>-a</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Anonymous. Hide information
+<p>Anonymous. Hide information about client.</p></td></tr>
-about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-a1</b></p></td>
+<p><b>-a1</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Anonymous. Show fake information
+<p>Anonymous. Show fake information about client.</p></td></tr>
-about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-p</b></p></td>
+<p><b>-p</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">listening_port. Port proxy
+<p>listening_port. Port proxy listens for incoming
-listens for incoming connections. Default is 1443.</p></td></tr>
+connections. Default is 1443.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-P</b></p></td>
+<p><b>-P</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">destination_port. Port to
+<p>destination_port. Port to establish outgoing
-establish outgoing connections. Required unless the
+connections. Required unless the Transparent plugin is used,
-Transparent plugin is used, because the TLS handshake does
+because the TLS handshake does not contain port information.
-not contain port information. Default is 443.</p></td></tr>
+Default is 443.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-c</b></p></td>
+<p><b>-c</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">TLS_CHECK_LEVEL. 0 (default) -
+<p>TLS_CHECK_LEVEL. 0 (default) - allow non-TLS traffic to
-allow non-TLS traffic to pass, 1 - require TLS, only check
+pass, 1 - require TLS, only check client HELLO packet, 2 -
-client HELLO packet, 2 - require TLS, check both client and
+require TLS, check both client and server HELLO, 3 - require
-server HELLO, 3 - require TLS, check that the server sends a
+TLS, check that the server sends a certificate (not
-certificate (not compatible with TLS 1.3), 4 - require
+compatible with TLS 1.3), 4 - require mutual TLS, check that
-mutual TLS, check that the server sends a certificate
+the server sends a certificate request and the client sends
-request and the client sends a certificate (not compatible
+a certificate (not compatible with TLS 1.3)</p></td></tr>
-with TLS 1.3)</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="4%">
 
 
-<p style="margin-top: 1em"><b>-s</b></p></td>
+<p><b>-s</b></p></td>
 <td width="5%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Split the TLS Client HELLO
+<p>Split the TLS Client HELLO packet across multiple TCP
-packet across multiple TCP segments to make SNI-based DPI
+segments to make SNI-based DPI detection harder. An optional
-detection harder. An optional numeric value can follow (e.g.
+numeric value can follow (e.g. <b>-s1</b>) to control the
-<b>-s1</b>) to control the splitting behaviour.</p></td></tr>
+splitting behaviour.</p></td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-Ximap | -Xpop3 |
+<p style="margin-left:9%;"><b>-Ximap | -Xpop3 |
 -Xsmtp</b></p>
 
-<p style="margin-left:15%;">STARTTLS mode for the given
+<p style="margin-left:18%;">STARTTLS mode for the given
 protocol. The proxy speaks the plaintext protocol with the
 client (greeting, capability advertisement with STARTTLS
 only, STARTTLS command), then, after the client issues
@@ -262,13 +258,13 @@ client fails.</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Log. By default logging is to stdout. If <i>logfile</i>
@@ -276,18 +272,17 @@ is specified logging is to file. Under Unix, if
 &acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
 used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>CLIENTS
@@ -295,7 +290,7 @@ You may want to try something like -S8192 if you experience
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">You should use a
+<p style="margin-left:9%; margin-top: 1em">You should use a
 client with TLS support or configure a router to redirect
 TLS traffic to the proxy (transparent proxy). Configure the
 client to connect to <i>internal_ip</i> and <i>port</i>. If
@@ -306,7 +301,7 @@ you need to limit clients, use <b>3proxy</b>(8) instead.</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -314,7 +309,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 ftppr(8), proxy(8), socks(8), pop3p(8), smtpp(8), tcppm(8),
 udppm(8), syslogd(8), <br>
 https://3proxy.org/</p>
@@ -324,7 +319,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/man8/udppm.8.html

@@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.24.1 -->
+<!-- Creator     : groff version 1.23.0 -->
 <html>
 <head>
 
@@ -25,7 +25,7 @@
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>udppm</b> -
+<p style="margin-left:9%; margin-top: 1em"><b>udppm</b> -
 UDP port mapper</p>
 
 <h2>SYNOPSIS
@@ -33,7 +33,7 @@ UDP port mapper</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em"><b>udppm</b>
+<p style="margin-left:9%; margin-top: 1em"><b>udppm</b>
 [<b>-ds</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-i</b><i>internal_ip</i>] [<b>-e</b><i>external_ip</i>]
 <i>local_port remote_host remote_port</i></p>
@@ -44,7 +44,7 @@ UDP port mapper</p>
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i><b>udppm</b></i>
+<p style="margin-left:9%; margin-top: 1em"><i><b>udppm</b></i>
 forwards datagrams from local to remote UDP port</p>
 
 <h2>OPTIONS
@@ -55,69 +55,69 @@ forwards datagrams from local to remote UDP port</p>
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-d</b></p></td>
+<p><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Daemonize. Detach service from
+<p>Daemonize. Detach service from console and run in the
-console and run in the background.</p></td></tr>
+background.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-t</b></p></td>
+<p><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Be silenT. Do not log
+<p>Be silenT. Do not log start/stop/accept error
-start/stop/accept error records.</p></td></tr>
+records.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-e</b></p></td>
+<p><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">External address. IP address of
+<p>External address. IP address of the interface the proxy
-the interface the proxy should initiate datagrams from. By
+should initiate datagrams from. By default, the system will
-default, the system will decide which address to use in
+decide which address to use in accordance with the routing
-accordance with the routing table.</p></td></tr>
+table.</p> </td></tr>
 </table>
 
-<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>
 
-<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
 
-<p style="margin-left:15%;">(Linux only) Switch to the
+<p style="margin-left:18%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@@ -128,61 +128,59 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
        cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
 <p>Internal address. IP address the proxy accepts datagrams
 to. By default, connections to any interface are accepted.
 It&acute;s usually unsafe.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-l</b></p></td>
+<p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Log. By default logging is to
+<p>Log. By default logging is to stdout. If <i>logfile</i>
-stdout. If <i>logfile</i> is specified logging is to file.
+is specified logging is to file. Under Unix, if
-Under Unix, if &acute;<i>@</i>&acute; precedes
+&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-<i>logfile</i>, syslog is used for logging.</p></td></tr>
+used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-s</b></p></td>
+<p><b>-s</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Single packet. By default, only
+<p>Single packet. By default, only one client can use the
-one client can use the udppm service, but if -s is
+udppm service, but if -s is specified, only one packet will
-specified, only one packet will be forwarded between client
+be forwarded between client and server. This allows the
-and server. This allows the service to be shared between
+service to be shared between multiple clients for
-multiple clients for single-packet services (for example,
+single-packet services (for example, name lookups).</p></td></tr>
-name lookups).</p></td></tr>
 <tr valign="top" align="left">
-<td width="6%"></td>
+<td width="9%"></td>
 <td width="3%">
 
 
-<p style="margin-top: 1em"><b>-S</b></p></td>
+<p><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="85%">
+<td width="82%">
 
 
-<p style="margin-top: 1em">Increase or decrease stack size.
+<p>Increase or decrease stack size. You may want to try
-You may want to try something like -S8192 if you experience
+something like -S8192 if you experience 3proxy crashes.</p></td></tr>
-3proxy crashes.</p></td></tr>
 </table>
 
 <h2>ARGUMENTS
@@ -191,19 +189,19 @@ You may want to try something like -S8192 if you experience
 
 
 
-<p style="margin-left:6%; margin-top: 1em"><i>local_port</i></p>
+<p style="margin-left:9%; margin-top: 1em"><i>local_port</i></p>
 
-<p style="margin-left:15%;">- port udppm accepts datagrams
+<p style="margin-left:18%;">- port udppm accepts datagrams
 on</p>
 
-<p style="margin-left:6%;"><i>remote_host</i></p>
+<p style="margin-left:9%;"><i>remote_host</i></p>
 
-<p style="margin-left:15%;">- IP address of the host
+<p style="margin-left:18%;">- IP address of the host
 datagrams are forwarded to</p>
 
-<p style="margin-left:6%;"><i>remote_port</i></p>
+<p style="margin-left:9%;"><i>remote_port</i></p>
 
-<p style="margin-left:15%;">- remote port datagrams are
+<p style="margin-left:18%;">- remote port datagrams are
 forwarded to</p>
 
 <h2>CLIENTS
@@ -211,7 +209,7 @@ forwarded to</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Any UDP-based
+<p style="margin-left:9%; margin-top: 1em">Any UDP-based
 application can be used as a client. Use <i>internal_ip</i>
 and <i>local_port</i> as the destination in the client
 application. All datagrams are forwarded to
@@ -222,7 +220,7 @@ application. All datagrams are forwarded to
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">Report all bugs
+<p style="margin-left:9%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>
 
 <h2>SEE ALSO
@@ -230,7 +228,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy(8),
+<p style="margin-left:9%; margin-top: 1em">3proxy(8),
 proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@@ -240,7 +238,7 @@ https://3proxy.org/</p>
 </h2>
 
 
-<p style="margin-left:6%; margin-top: 1em">3proxy is
+<p style="margin-left:9%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>

doc/html/plugins/TransparentPlugin.html

@@ -1,31 +1,56 @@
-<h3>3proxy TransparentPlugin (Linux/BSD only)</h3>
+<h3>3proxy transparent proxying (Linux/BSD only)</h3>
 
-This plugin can turn 3proxy into a transparent proxy for virtually any TCP-based protocol
+Transparent proxying is part of 3proxy itself since 1.0.1. It was the separate
-and use all 3proxy features - redirections, parent proxies, ACLs, traffic limitations,
+TransparentPlugin before that, and the <b>plugin</b> line that used to load it
-etc. The TransparentPlugin takes the destination IP:port from Linux and uses this
+is no longer needed: the <b>transparent</b> and <b>notransparent</b> commands
-information as the target IP in the proxy. An example usage:
+are always available on the platforms that can redirect a connection.
+
+<p>
+It turns 3proxy into a transparent proxy for virtually any TCP-based protocol,
+with the rest of 3proxy applying as usual - redirections, parent proxies, ACLs,
+traffic limitations and logging. The destination IP and port come from the
+packet filter that redirected the connection, and are used as the target of the
+proxied connection.
+</p>
 
 <pre>
-plugin /path/to/TransparentPlugin.ld.so transparent_plugin
 log /path/to/log
 auth iponly
 allow * * * 80
 parent 1000 http 0.0.0.0 0
 allow *
 parent 1000 socks5 SOCKS5_IP SOCKS5_PORT USER PASSWORD
+
 transparent
-tcppm -iLOCAL_IP 12345 127.0.0.1 11111
+tcppm -eLOCAL_IP 12345 127.0.0.1 11111
 notransparent
 proxy
 </pre>
-Now, any TCP traffic transparently redirected to port 12345 will be routed via
-the parent SOCKSv5 proxy and logged; all URLs for web requests are visible in logs.
-The parameters '127.0.0.1 11111' in this case are not used and are overwritten by
-the destination IP:port for each transparent connection.
 
-<h4>Download:</h4>
+<p>
-<ul>
+Any TCP traffic redirected to port 12345 is routed through the parent SOCKSv5
- <li>Plugin is included in 3proxy 0.8
+proxy and logged, with the URLs of web requests visible in the log. The
-</li></ul>
+'127.0.0.1 11111' arguments are not used in that case: they are replaced by the
+destination the client was trying to reach.
+</p>
+
+<p>
+The destination is looked up in pf on the BSDs, through <b>/dev/pf</b>, and
+asked of the kernel on Linux; a redirection that leaves the address on the
+socket is used where there is one. <b>transparent</b> takes an optional
+<b>auto</b>, <b>netfilter</b>, <b>pf</b> or <b>socket</b> to pin that choice.
+</p>
+<p>
+The redirection rules must not match the connections 3proxy itself makes, or
+the traffic returns to the proxy and loops. Give the service an address to
+connect from with <b>-e</b> and exclude it in the rules, or run 3proxy as its
+own account and exclude that account.
+</p>
+
+<p>
+Redirection rules for iptables, nftables, firewalld, ufw and pf are in
+<a href="../howtoe.html#TRANSPARENT">How to proxy transparently</a>, and the
+commands are described in 3proxy.cfg(5).
+</p>
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/plugins/TransparentPlugin.ru.html

@@ -1,33 +1,56 @@
-<h3>Плагин TransparentPlugin 3proxy (только для Linux/BSD)</h3>
+<h3>Транспарентное проксирование 3proxy (только для Linux/BSD)</h3>
 
-Плагин превращает 3proxy в транспарентный прокси для практически любых TCP-соединений
+Начиная с 1.0.1 транспарентное проксирование встроено в 3proxy. Раньше это был
-и позволяет прозрачно для клиентов использовать весь фунционал прокси - редиректоры,
+отдельный TransparentPlugin, и строка <b>plugin</b>, которой он загружался,
-родительские прокси, ACLи, ограничения трафика. TransparentPlugin получает IP:port
+больше не нужна: команды <b>transparent</b> и <b>notransparent</b> доступны
-назначения от Linux  и использует эту информацию в качестве конечного адреса назначения.
+всегда на тех платформах, где соединение можно перенаправить.
-<br>
+
-Пример использования:
+<p>
+3proxy становится транспарентным прокси практически для любых TCP-соединений,
+причём весь остальной функционал работает как обычно - редиректоры,
+родительские прокси, ACLи, ограничения трафика и логирование. IP и порт
+назначения берутся у пакетного фильтра, перенаправившего соединение, и
+используются как адрес назначения проксируемого соединения.
+</p>
 
 <pre>
-plugin /path/to/TransparentPlugin.ld.so transparent_plugin
 log /path/to/log
 auth iponly
 allow * * * 80
 parent 1000 http 0.0.0.0 0
 allow *
 parent 1000 socks5 SOCKS5_IP SOCKS5_PORT USER PASSWORD
+
 transparent
-tcppm -iLOCAL_IP 12345 127.0.0.1 11111
+tcppm -eLOCAL_IP 12345 127.0.0.1 11111
 notransparent
 proxy
 </pre>
-Теперь любые TCP-соединения транспарентно перенаправленные в локальный порт 12345 
+
-будут прологгированы и перенаправлены в родительский SOCKSv5 proxy, при этом для
+<p>
-HTTP-запросов по порту TCP/80 будут видны параметры HTTP-запроса.
+Любой TCP-трафик, перенаправленный на порт 12345, пойдёт через родительский
-Параметры '127.0.0.1 11111' в данном случае не оказывают влияния, т.к.
+SOCKSv5 прокси и будет залогирован, URL веб-запросов видны в логе. Аргументы
-будут перезаписываться IP и портом назначения для каждого TCP-соединения соответственно.
+'127.0.0.1 11111' в этом случае не используются: они заменяются адресом, к
-<h4>Загрузить:</h4>
+которому обращался клиент.
-<ul>
+</p>
- <li>Плагин включен в дистрибутив 3proxy 0.8
+
-</li></ul>
+<p>
+В BSD адрес назначения ищется в pf через <b>/dev/pf</b>, в Linux запрашивается у
+ядра; если перенаправление оставляет адрес на сокете, используется он. Команда
+<b>transparent</b> принимает необязательный аргумент <b>auto</b>,
+<b>netfilter</b>, <b>pf</b> или <b>socket</b>, чтобы зафиксировать выбор.
+</p>
+<p>
+Правила перенаправления не должны попадать на соединения, которые устанавливает
+сам 3proxy, иначе трафик возвращается в прокси и зацикливается. Задайте сервису
+адрес для исходящих соединений через <b>-e</b> и исключите его в правилах, либо
+запускайте 3proxy под отдельной учётной записью и исключайте её.
+</p>
+
+<p>
+Правила перенаправления для iptables, nftables, firewalld, ufw и pf приведены в
+<a href="../howtor.html#TRANSPARENT">описании транспарентного проксирования</a>,
+команды описаны в 3proxy.cfg(5).
+</p>
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/securityen.html

@@ -19,6 +19,45 @@ authentication is currently available.
 <li>Always limit connections to the internal network and localhost (to 127.0.0.1 and
 all interfaces) with ACLs. Be careful, because the BIND command in SOCKS requires the
 BIND method with the external interface IP address to be allowed.
+<li>Services resolve IPv4 only unless told otherwise ('-4' is the default). Enabling
+IPv6 with '-6', '-46' or '-64' makes every ACL written in IPv4 incomplete, because the
+same host can be asked for in another way. A proxy that denies 127.0.0.1 but has IPv6
+enabled still reaches that host as '::ffff:127.0.0.1', and reaches the machine again as
+'::1', which is a different address the IPv4 rule never mentioned. When IPv6 is enabled,
+deny the mapped form '::ffff:0:0/96' as well unless it is needed, and deny the IPv6
+addresses that correspond to whatever the IPv4 rules protect: '::1' and '::' for the
+local machine, 'fe80::/10' for link-local and 'fc00::/7' for unique local addresses.
+Denying the IPv4 spelling alone is not enough.
+<li>With '-46' or '-64' a name resolves to either family, so a target ACL that names
+only one of a host's addresses does not limit that host. Names are resolved into
+separate caches, and a name that resolves to an IPv6 address is only cached when
+'nscache6' is configured.
+<li>The 'admin' service hands out counters, the list of running services and a way to
+trigger a configuration reload. Bind it to an internal interface, and put
+authentication and an ACL in front of it. The '-s' option limits what the pages offer
+but is not authentication.
+<li>The 'echo' and 'data' operations of the 'http' command exist for testing. 'data'
+returns a response of whatever size the request asks for, so a listener offering it to
+anyone is a traffic amplifier. Do not configure them on a public service.
+<li>'ssl_server_ca_key' is the private key of a certificate authority that clients have
+been told to trust. Anyone who obtains it can impersonate any site to those clients, so
+protect it as a signing key and use a CA created for this purpose only, never one that
+is trusted for anything else. Restrict the 'ssl_certcache' directory as well: it holds
+the certificates generated from that key.
+<li>Interception ('ssl_mitm') ends the guarantee the client believes it has. The full
+URL of every request inside the tunnel, query string included, becomes visible to the
+proxy and reaches the log, where a plain CONNECT would have shown only a host and a
+port. Treat those logs accordingly.
+<li>Certificates generated for interception by a build against wolfSSL carry no key
+identifiers, because that library cannot generate certificate extensions, and a client
+verifying strictly (OpenSSL 'x509_strict', which recent Python enables by default)
+rejects them. Builds against OpenSSL generate them. Where they are missing, turning
+verification off in the client removes the protection interception was supposed to
+preserve; use an OpenSSL build instead.
+<li>Regular expression rules ('pcre', 'pcre_rewrite') are matched without
+authentication and do not replace ACLs. A rewrite that would change the method or the
+destination of a request is ignored, because the destination was already authorized;
+do not rely on one to redirect traffic.
 <li>Before 3proxy 0.8, always use nserver and nscache under Unix; otherwise, a DoS attack is possible
 with an unreachable DNS server (because gethostbyname will block other threads).
 <li>Keep logs in a secure location, because some confidential information from

man/3proxy.cfg.5

@@ -39,7 +39,9 @@ For included file <CR> (end of line characters) is treated as space character
 (arguments delimiter instead of end of command delimiter). 
 Thus, include files are only useful to store long single-line commands
 (like userlist, network lists, etc).
-To use dollar sign somewhere in argument it must be quoted. 
+To use dollar sign somewhere in argument it must be quoted or doubled: inside
+quotes a dollar is ordinary text, and \fB$$\fR stands for a single dollar and is
+not read as an include.
 Recursion is not allowed.
 
 .br
@@ -93,16 +95,19 @@ SNI proxy (destination address is taken from TLS handshake), may be used to redi
 Proxy with protocol autoselection between proxy / socks / tlspr
 .br
 .B pop3p
-POP3 proxy (default port 110)
+POP3 proxy (default port 110), in a build which has one: otherwise the
+service is \fBtlspr\fR speaking POP3 to negotiate STARTTLS, under this name.
 .br
 .B imapp
-IMAPv4 proxy (default port 143)
+IMAPv4 proxy (default port 143), or \fBtlspr\fR speaking IMAP, as above.
 .br
 .B smtpp
-SMTP proxy (default port 25)
+SMTP proxy (default port 25), or \fBtlspr\fR speaking SMTP, as above.
 .br
 .B ftppr
-FTP proxy (default port 21)
+FTP proxy (default port 21), in a build with FTP support. Without it the
+service is known but answers nothing, and \fBftp://\fR is not a URL the HTTP
+proxy fetches.
 .br
 .B admin
 Web interface (default port 80)
@@ -132,7 +137,8 @@ change default server port to NUMBER
 Only resolve IPv6 addresses. IPv4 addresses are packed in IPv6 in IPV6_V6ONLY compatible way.
 .br
 .B -4
-Only resolve IPv4 addresses
+Only resolve IPv4 addresses. This is the default: a service reaches an IPv6
+address only when told to with \fB-6\fR, \fB-46\fR or \fB-64\fR.
 .br
 .B -46
 Prefer IPv4. Resolve IPv6 addresses if IPv4 address is not resolvable
@@ -178,8 +184,10 @@ connect to given remote HOST:port instead of listening local connection on -p or
 .br
 .B -oc\fIOPTIONS\fB, -os\fIOPTIONS\fB, -ol\fIOPTIONS\fB, -or\fIOPTIONS\fB, -oR\fIOPTIONS\fR
 options for proxy-to-client (\fB-oc\fR), proxy-to-server (\fB-os\fR), proxy listening (\fB-ol\fR), connect back client (\fB-or\fR), connect back listening (\fB-oR\fR) sockets.
+\fIOPTIONS\fR is a comma separated list of \fINAME\fR or \fINAME\fR=\fIVALUE\fR; a name alone sets the option to 1 (TCP_MAXSEG to the value of \fBmaxseg\fR), and \fINAME\fR=0 turns it off. Options add to the defaults and to the options given earlier for the same socket. An unknown name or a value which is not a number is an error.
+TCP_NODELAY is set by default on proxy-to-client and proxy-to-server sockets, so a reply written in several parts is not delayed by Nagle's algorithm; use \fB-ocTCP_NODELAY=0\fR or \fB-osTCP_NODELAY=0\fR to turn it off, e.g. to send fewer packets on slow links.
 Options like TCP_CORK, TCP_NODELAY, TCP_DEFER_ACCEPT, TCP_QUICKACK, TCP_TIMESTAMPS, TCP_FASTOPEN, SO_REUSEADDR, SO_REUSEPORT, SO_EXCLUSIVEADDRUSE, SO_PORT_SCALABILITY, SO_REUSE_UNICASTPORT, SO_KEEPALIVE, SO_DONTROUTE may be supported depending on OS.
-SO_REUSEADDR and SO_REUSEPORT are set on the listening socket by default on Unix. On Windows SO_REUSEADDR is not set: it is not required to rebind a listening port and it only lets another local process bind the same address and port. Use SO_EXCLUSIVEADDRUSE (Windows) on the listening socket (\fB-ol\fR) to prevent that.
+SO_REUSEADDR and SO_REUSEPORT are set by default on the listening sockets (\fB-ol\fR, \fB-oR\fR) on Unix; \fB-olSO_REUSEPORT=0\fR turns one off. On Windows SO_REUSEADDR is not set: it is not required to rebind a listening port and it only lets another local process bind the same address and port. Use SO_EXCLUSIVEADDRUSE (Windows) on the listening socket (\fB-ol\fR) to prevent that.
 .br
 .B -H
 (for all services) Expect HAProxy PROXY protocol v1 header on incoming connection.
@@ -194,11 +202,18 @@ delay GRACE_DELAY milliseconds before polling if average polling size is below G
  (for admin) secure, allow only secure operations, currently only traffic counters
 view without ability to reset.
 .br
- (for TCP services, Linux) enable splice(). splice() is not built by default and
+ (for TCP services, Linux) use splice() to pass data between the client and the
-is disabled even when built, because current Linux does not implement
+server without copying it through 3proxy. \fB-s\fR alone splices both directions where
-SPLICE_F_MOVE, so no real zero-copy takes place and the read/write path is faster
+it pays: a body of known length if at least 16K of it is left to read, a stream
-for most traffic. Rebuild with -DWITHSPLICE to make -s available, -s0 disables it
+once it carries large reads, back to copying when they turn small. \fB-s1\fR always
-explicitly.
+splices what the server sends to the client (downloads), \fB-s2\fR what the client
+sends (uploads), \fB-s3\fR both; adding 4 (\fB-s5\fR, \fB-s6\fR, \fB-s7\fR, the last the same as
+\fB-s\fR) splices those directions only where it pays. \fB-s0\fR, the default, turns it
+off. splice() suits large transfers: they go faster and use less CPU; small
+requests go slower with it. A spliced direction needs a pipe (two file
+descriptors), made when first needed and kept for the connection, and more
+kernel memory; data filters are not applied to spliced data. Available in builds
+with WITHSPLICE, the default on Linux.
 .br
 .B -C
  (for TCP services) a connection closed by any of the sides terminates the
@@ -238,6 +253,12 @@ Never ask for username/password
 .br
 .B -a2
 (for proxy) generate Via: and X-Forwarded-For: instead of Forwarded:
+.br
+.B -Xftp
+(for proxy) fetch \fBftp://\fR URLs, in a build with FTP support. Without
+this the scheme is not one the service knows, whatever the build: fetching it
+opens a second connection and builds a listing, which a service serving http
+has no use for.
 .br
  Also, all options mentioned for 
 .BR proxy (8)
@@ -282,16 +303,7 @@ proxy on a client with FTP proxy support. Username format is one of
 .BR config
 \fI<path>\fR
 .br
- Path to configuration file to use on 3proxy restart or to save configuration.
+ Path to configuration file to use on 3proxy restart.
-
-.br
-.B writable
-.br
- ReOpens configuration file for write access via Web interface,
-and rereads it. Usually should be first command on config file
-but in combination with config
-it can be used anywhere to open
-alternate config file. Think twice before using it.
 
 .br
 .B end
@@ -537,13 +549,20 @@ If not specified, nserver is used. The syntax is the same as for nserver.
 .br
  Cache \fI<cachesize>\fR records for name resolution (\fBnscache\fR for IPv4,
 \fBnscache6\fR for IPv6). The cache size should usually be large enough
-(for example, 65536).
+(for example, 65536). The two are separate: a name that resolves to an IPv6
+address, including one given with \fBnsrecord\fR, is only held when
+\fBnscache6\fR is configured, and \fBnscache\fR does nothing for it. Both
+caches are global rather than per-service.
 
 .br
 .BR nsrecord
 \fI<hostname>\fR \fI<hostaddr>\fR
 .br
- Adds static record to nscache. \fBnscache\fR must be enabled. If 0.0.0.0
+ Adds static record to nscache. \fBnscache\fR must be enabled and must come
+first, because the record is placed in the table it allocates - \fBnscache6\fR
+for a record naming an IPv6 address - and
+\fBnserver\fR must be set as well: without it the system resolver is used and
+static records are never consulted. If 0.0.0.0
 is used as a hostaddr host will never resolve, it can be used to
 blacklist something or together with 
 .B dialer
@@ -751,6 +770,17 @@ Since 0.6, the targetlist may also contain host names,
 instead of addresses. It\'s possible to use a wildmask in
 the beginning and at the end of the hostname, e.g. *badsite.com or *badcontent*.
 The hostname is only checked if a hostname is present in the request.
+A name written with a \fBpcre:\fR prefix (\fBregex:\fR is the same thing) is a
+regular expression instead of a wildmask, in a build with PCRE support:
+.br
+ deny * * "pcre:^(ads|track)[0-9]*\\.example\\.(com|net)$"
+.br
+ The name is lowercased and any trailing dots are removed before it is matched,
+so patterns are written in lower case. A pattern ending in \fB$\fR has to be
+quoted or written \fB$$\fR, since a lone dollar outside quotes begins the name
+of a file to include. The same patterns, and the same prefix, are used by the
+\fBhttp\fR command, see BUILT IN HTTP SERVER. Regular expressions are matched
+per request and cost more than a wildmask, which is enough for most rules.
 Targetportlist may contain ports (X) or port ranges lists (X-Y). For any field *
 sign means ANY. If access list is empty it\'s assumed to be
 .br
@@ -855,9 +885,35 @@ build proxy chain. Proxies may be grouped. Proxy inside the
 group is selected randomly. If few groups are specified one proxy
 is randomly picked from each group and chain of proxies is created
 (that is second proxy connected through first one and so on).
-Weight is used to group proxies. Weight is a number between 1 and 1000.
+Weight is used to group proxies. A weight is a share of the whole, written
-Weights are summed and proxies are grouped together until the weight of
+either as a fraction of one, anything beginning with 0 or with a point, or the
-the group is 1000. That is:
+old way, in thousandths:
+.br
+ \fB.5\fR and \fB0.5\fR and \fB500\fR are all a half
+.br
+ \fB.333\fR and \fB333\fR are both 333 thousandths
+.br
+ \fB1000\fR and \fB1.0\fR and \fB100%\fR are all the whole share
+.br
+ \fB50.5%\fR and \fB.505\fR and \fB505\fR are all the same share
+.br
+ \fB0\fR is a fallback, described below
+.br
+ A fraction takes up to nine digits after the point, \fB.333333333\fR being
+the finest share there is, and the old notation may now carry further digits
+after a point of its own, so \fB123.456\fR means the same as \fB.123456\fR.
+Weights are scanned as integers, nothing is read as a floating point number.
+\fB1.0\fR, with as many zeroes after the point as you care to write, is the
+one weight read as it looks rather than in thousandths, so that the whole
+share can be written as a fraction too: a bare \fB1\fR is still a thousandth
+of it, and \fB1.5\fR still one and a half of them. A weight ending in
+\fB%\fR is a percentage, and takes up to seven digits after the point.
+.br
+ Weights are summed and proxies are grouped together until the weight of
+the group is the whole share. A group which falls short of it by no more than
+a thousandth, which three weights of \fB333\fR do, is taken for a whole one
+rather than for a group with a remainder, so a share which cannot be divided
+evenly needs no adjusting by hand. That is:
 .br
  allow *
 .br
@@ -866,7 +922,8 @@ the group is 1000. That is:
  parent 500 connect 192.168.10.1 3128
 .br
  makes 3proxy to randomly choose between 2 proxies for all outgoing
-connections. These 2 proxies form 1 group (summarized weight is 1000).
+connections. These 2 proxies form 1 group (their weights are the whole share
+between them).
 .br
  allow * * * 80
 .br
@@ -886,6 +943,10 @@ with probability of 0.7) for outgoing web connections. Chains are only applied t
  type is one of:
 .br
  \fBextip\fR does not actually redirect the request; it sets the external address for this request to \fI<ip>\fR. It can be chained with another parent type. It's useful to set the external IP based on ACL or make it random.
+.br
+ \fBextport\fR does not redirect the request; it sets the range the local port of outgoing connections is taken from, given as \fIFIRST-LAST\fR inclusive in place of the port argument, with 0.0.0.0 as the address, for example \fBparent 1000 extport 0.0.0.0 40000-40100\fR. Where the system can be asked to pick the port itself (Linux \fBIP_LOCAL_PORT_RANGE\fR) it does, otherwise a port is picked at random from the range and retried if it is already in use, up to ten times. A port which binds but whose pair with the destination is still closing from an earlier connection, which Windows refuses at the connect, is retried in the same way and out of the same ten tries, so a repeated connection to one destination does not fail for a port it has just used. On Linux the range has to lie within \fInet.ipv4.ip_local_port_range\fR, commonly 32768-60999: the kernel ignores a range outside it and picks an ordinary ephemeral port instead. If no port in the range can be bound, an ephemeral port is used rather than failing the connection. It can be chained with another parent type, and the access rule it belongs to decides which requests it applies to, so \fBallow * * * * UDPASSOC\fR followed by \fBparent 1000 extport 0.0.0.0 40000-40100\fR limits it to UDP associations. The range is applied when the outgoing connection is made, so a kept alive connection carrying several requests uses the rule that matched when it was opened.
+.br
+ \fBintport\fR is the same for sockets bound on the side facing the client: the port a UDP association tells the client to send its datagrams to, and the FTP proxy data connection.
 .br
  \fBtcp\fR simply redirect connection. TCP is always last in chain. This type of proxy is a simple TCP redirection, it does not support parent authentication.
 .br
@@ -995,12 +1056,37 @@ local HTTP proxy parses requests and allows only GET and POST requests.
 .br
  Optional username and password are used to authenticate on parent
 proxy. Username of \'*\' means username must be supplied by user.
+.br
+ A parent which fails is taken out of the choice for the rest of that
+connection, so the next attempt, see \fBparentretries\fR, goes to another
+member of the group instead of the same parent again. Its share is spread over
+the parents of the group which are left, in proportion to their weights.
+.br
+ Weight 0 marks a fallback parent. Such a parent takes no share of the random
+choice, and none of the share left over by a parent which failed, and is only
+used once every weighted parent of its group has failed,
+which is how a parent used only when another one is down is configured:
+.br
+ allow *
+.br
+ parent 1000 socks5 192.168.10.1 1080
+.br
+ parent 0 socks5 192.168.20.1 1080
+.br
+ Several fallbacks are tried in the order they are written. Reaching a fallback
+costs an attempt, so \fBparentretries\fR has to be at least as large as the
+number of parents to try.
+.br
+ When every parent of a group has failed the request fails as well, rather
+than being sent without a parent.
 
 .br
 .BR parentretries
 \fI<number>\fR
 .br
- Number of retries to connect to parent proxy. Default is 1.
+ Number of attempts to reach a parent proxy. Default is 2. Each attempt
+picks a parent again, leaving out the ones which already failed, so this is
+also the number of different parents a request may be tried through.
 
 
 .br
@@ -1196,6 +1282,54 @@ the format:
  Note: double quotes are required because the password contains a $ sign.
 
 .br
+.BR transparent
+\fI[auto|netfilter|pf|socket]\fR
+.br
+ Take the destination of a connection, both address and port, from the packet
+filter that redirected it, instead of from the request. It applies to services declared after it, and
+\fBnotransparent\fR turns it off again for the services after that. Built into the
+binary since 1.0.1, and previously the separate TransparentPlugin.
+.br
+ On Linux the kernel is asked, so \fBiptables\fR or \fBnftables\fR
+redirection is enough. On the BSDs pf is asked through \fB/dev/pf\fR, which
+3proxy must be able to read, so \fBrdr\fR rules work; a redirection that
+leaves the destination on the socket is used where there is one, as
+\fBdivert-to\fR on OpenBSD and \fBipfw fwd\fR on FreeBSD do. macOS ships no
+header for pf and has neither of those, so the commands exist in a macOS build
+but cannot be used.
+.br
+ The mechanism is chosen automatically. The optional argument pins it for an
+installation that has more than one: \fBauto\fR is the default,
+\fBnetfilter\fR asks the Linux kernel, \fBpf\fR looks the connection up in
+the packet filter, and \fBsocket\fR reads the address off the socket. A mode
+the build has no code for is refused rather than ignored.
+.br
+ A connection that reaches a \fBsocket\fR mode service without having been
+redirected is refused: its destination is the address the service listens on,
+and using that would send the service to itself.
+.br
+ A redirected connection carries no destination of its own, so without this the
+service uses whatever it would use otherwise: the \fBHost\fR header for an
+HTTP request, or the address a port mapper was configured with. \fBtlspr\fR
+receives nothing at all unless traffic is redirected to it or the clients
+resolve names to it, and with a redirection it has the address as well as the
+name from the handshake, which is what allows access rules to be written with
+host names. With it, every service reaches the address the
+client was trying to reach, and access rules, parents, limits and logging apply
+to it as usual.
+.br
+ The redirection rules must not match the connections the proxy itself makes to
+those destinations, or the traffic returns to the proxy and loops. Give the
+service an outgoing address with \fB-e\fR and exclude that address in the rules,
+or run 3proxy as its own user and exclude that user. See the
+.B TRANSPARENT PROXYING
+section of the documentation for rules per platform.
+.br
+.BR notransparent
+.br
+ Stop taking the destination from the packet filter for the services declared
+after it.
+
 .B flush
 .br
  empty the active access list. The access list must be flushed every time you create a
@@ -1254,7 +1388,12 @@ for all threads.
 .BR chroot
 \fI<path>\fR [\fI<uid>\fR] [\fI<gid>\fR]
 .br
- calls chroot(path) and sets gid/uid. Unix only. uid/gid supported since 0.9, can be numeric or username/groupname
+ calls chroot(path) and sets gid/uid. Unix only. uid/gid supported since 0.9, can be numeric or username/groupname.
+The time zone and the syslog connection are set up before the call.
+Plugins which read their own configuration or load modules while running need them inside the chroot:
+PAM (\fI/etc/pam.d\fR and the modules it names, read for every authentication),
+LDAP (\fIldap.conf\fR and, for ldaps, the CA certificates),
+ODBC (\fIodbc.ini\fR, \fIodbcinst.ini\fR and the driver libraries, loaded again whenever the connection is reopened).
 
 .br
 .BR stacksize
@@ -1444,7 +1583,7 @@ Apply a rule for matching regular expression.
 Match and replace with rewrite expression.
 .br
 .BR pcre_extend
-\fIFILTER_ACTION [ACE]\fR
+\fIACE\fR
 .br
 Extend the ACL of the last pcre or pcre_rewrite command by adding an additional ACE.
 .br
@@ -1467,6 +1606,15 @@ PCRE_NOTEMPTY, PCRE_UTF8, PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CA
 PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART, PCRE_FIRSTLINE, PCRE_DUPNAMES,
 PCRE_NEWLINE_CR, PCRE_NEWLINE_LF, PCRE_NEWLINE_CRLF, PCRE_NEWLINE_ANY, PCRE_NEWLINE_ANYCRLF,
 PCRE_BSR_ANYCRLF, PCRE_BSR_UNICODE.
+.br
+ These options apply to every pattern the configuration compiles, the host
+patterns of access rules and \fBhttp\fR rules included, so set them before the
+rules which are to use them.
+.br
+ Regular expressions are not only for these commands: a host name in the target
+list of an access rule, and the host and URL of an \fBhttp\fR rule, take one
+when it is written with a \fBpcre:\fR prefix. See \fBallow\fR and BUILT IN
+HTTP SERVER.
 
 .SS PCRE Parameters
 TYPE - type of filtered data (comma-delimited list):
@@ -1494,6 +1642,12 @@ REGEXP - PCRE (Perl) regular expression. Use * if no regexp matching is required
 REWRITE_EXPRESSION - substitution string. May contain Perl-style substrings
 $1, $2, etc. $0 means the whole matched string. \er and \en may be used
 to insert new lines; the string may be empty ("").
+.br
+A rewritten request is what the server receives. The destination is chosen,
+and the access rules are applied to it, before the filters run, so a rewrite
+that names another host or changes the method is logged but not acted on:
+the request is still sent where the access rules allowed. Rewriting the path
+or the query works on a direct connection and through a parent alike.
 
 ACE - access control entry (user names, source IPs, destination IPs, ports, etc.),
 identical to allow/deny/bandlimin commands. The regular expression is only
@@ -1501,6 +1655,242 @@ matched if the ACL matches the connection data.
 Warning: Regular expressions don't require authentication and cannot replace
 authentication and/or allow/deny ACLs.
 
+.SH OPTIONAL SERVICES
+The mail proxies and FTP are built when they are asked for, and are not in a
+default build. \fBMAILPROXY=true\fR builds \fBpop3p\fR, \fBimapp\fR and
+\fBsmtpp\fR, and \fBFTP=true\fR builds \fBftppr\fR and the \fBftp://\fR
+scheme of the HTTP proxy, which a \fBproxy\fR service then still has to ask
+for with \fB-Xftp\fR; with CMake the switches are
+\fB-D3PROXY_USE_MAILPROXY=ON\fR and \fB-D3PROXY_USE_FTP=ON\fR. The standalone
+binaries of those services are built with them and not without.
+.br
+ A configuration naming a service which was not built is still read. The three
+mail proxies become \fBtlspr\fR negotiating STARTTLS in that protocol, which
+is what most of their use amounts to now that the mail protocols are used over
+TLS, and a \fBparent\fR chain naming \fBpop3\fR, \fBimap\fR or \fBsmtp\fR
+does the same. \fBftppr\fR is answered by nothing: a client reaching it is
+turned away and the refusal logged, since there is no protocol to fall back on.
+
+.SH BUILT IN HTTP SERVER
+The \fBhttpsrv\fR service answers requests itself instead of forwarding them.
+What it does with a request is decided by \fBhttp\fR rules, which are taken in
+the order they are written: the first whose host and URL both match handles the
+request. Rules belong to the service that follows them, the way access rules do,
+and \fBadmin\fR is \fBhttpsrv\fR with a set of rules already in place.
+
+.BR http
+\fIOPERATION HOST URL [PARAMETERS]\fR
+.br
+ Handle a request for \fIURL\fR on \fIHOST\fR with \fIOPERATION\fR. HOST is
+matched against the Host header, URL against the path, with the query string
+removed.
+
+.SS Operations
+.br
+ \fBfile\fR \fIPATH [TYPE [MAX-AGE [HEADERS [CODE]]]]\fR - send the file at PATH.
+The file is handed to the socket by the system where it can do that (sendfile,
+TransmitFile) and read here where it cannot, as when the connection carries TLS.
+The arguments after PATH are described below, and each of them may be written as
+\fB*\fR to leave it out.
+.br
+ \fBcache\fR \fIPATH [TYPE [MAX-AGE [HEADERS [CODE]]]]\fR - the same, but the
+file is read into memory on the first request and answered from there afterwards.
+A file that has changed on disk is read again, and one larger than a megabyte is
+sent as \fBfile\fR would. With a MAX-AGE the file is not looked at again for
+that long: the rule has already told clients the file may be treated as
+unchanged for that time, so the server treats its own copy the same way and a
+request costs nothing but the copy out. Without one every request stats the
+file, so a change is picked up at once.
+.br
+ \fBreply\fR \fI[CODE [HEADERS]]\fR - answer with a status and nothing else.
+CODE is the status to send, 200 without one. A status which carries no body of
+its own (1xx, 204, 304) is sent without a length; anything else is sent with a
+length of zero.
+.br
+ \fBredir\fR \fI[CODE] LOCATION\fR - answer with a redirect. CODE is 301 or 302,
+or any status from 300 to 399; without one, 302 is used.
+.br
+ \fBrewrite\fR \fIPATH\fR - change the path of the request and hand it to the
+rules that follow this one.
+.br
+ \fBrewrite_host\fR \fIHOST\fR - the same for the host, which decides which of
+the rules after it match. \fB$1\fR upwards stand for what the stars, or the
+groups, of this rule\'s host pattern matched, the way they stand for those of
+the URL in a \fBrewrite\fR. What is built has to be a host name; the name the
+client sent is what access rules matched and what the log records.
+.br
+ \fBecho\fR - answer with a description of the request: the method, path, query,
+host, and the address and port it came from. For testing.
+.br
+ \fBdata\fR \fI[size=N] [block=N] [status=N] [chunked=1] [delay=N]\fR - answer
+with generated content of the size asked for. For testing.
+.br
+ \fBproxypass\fR - hand the request to the proxy code, which fetches it the
+way \fBproxy\fR would, see BOTH A SITE AND A PROXY.
+.br
+ \fBadmin\fR, \fBadmin_counters\fR, \fBadmin_reload\fR, \fBadmin_services\fR -
+the pages of the administration interface.
+
+.SS What a rule adds to the answer
+\fBTYPE\fR is the content type to answer with. Without it, or with \fB*\fR, the
+type is worked out from the name of the file, see \fBhttp_content_type\fR.
+.br
+ \fBMAX-AGE\fR is a number of seconds, and is sent as Cache-Control: max-age.
+Without it, or with \fB*\fR, nothing is said about caching.
+.br
+ \fBHEADERS\fR is one argument holding whole header lines, separated by a
+backslash and an n \- the two characters, since a configuration line cannot
+carry a line ending. Each becomes a real line ending in the answer. Quote the
+argument if any header holds a space, which they usually do.
+.br
+ \fBCODE\fR is the status to answer with instead of 200, which is how a file
+serves as the body of an error page.
+.br
+ A rule's headers and MAX-AGE go with whatever status that rule asked for. They
+are not sent with a refusal the server itself decided on: a request for a file
+which is not there is answered 404 by the server, not by the rule.
+.br
+ \fBfile\fR and \fBcache\fR send Last-Modified, and answer a request carrying
+If-Modified-Since with 304 and no body when the file has not changed since the
+time it names. All three date formats HTTP allows are read; one which cannot be
+read is treated as no date at all. A rule answering with a CODE of its own is
+answering something other than the file, so it is never turned into a 304.
+.br
+ http file * /err/** "/usr/local/web/404.html" text/html * "X-Served: static" 404
+.br
+ http reply * /health** 200 "X-Health: ok"
+.br
+ http reply * /down** 503 "Retry-After: 30"
+
+.BR http_content_type
+\fIEXTENSION TYPE\fR
+.br
+ Answer for a file with that extension with that content type, in addition to
+the types already known. The extension may be written with or without its dot.
+A type named by a rule is used whatever this says, and a name the server knows
+nothing about is answered as application/octet-stream.
+.br
+ http_content_type .webp image/webp
+
+.SS Patterns
+A URL is matched with stars, or with a regular expression when it carries a
+\fBpcre:\fR prefix (\fBregex:\fR is taken as well). A host is matched the way an
+access list matches one, and takes the same prefix.
+.br
+ \fB*\fR stands for any run of characters within one element of the path: it
+does not cross a \fB/\fR, so a rule cannot reach into a directory it did not
+name.
+.br
+ \fB**\fR crosses them, and is what a rule which should match everything below a
+point, or everything at all, is written with.
+.br
+ Each star, and each group of a regular expression, is remembered in the order
+it appears. \fB$1\fR upwards stand for them in the path or location a rule
+builds, and \fB$0\fR for the whole request path.
+.br
+ Outside quotes a dollar begins the name of a file to include, so an argument
+holding one \- a path or location built with \fB$1\fR, a regular expression
+anchored with \fB$\fR \- is written in quotes. \fB$$\fR stands for a single
+dollar and is not read as an include either, which is how a dollar reaches a
+rule as text.
+
+.SS Both a site and a proxy
+A request may arrive the way it arrives at a site, naming a path and a host in
+the Host header, or the way it arrives at a proxy, naming the whole URL, or, for
+a tunnel, the host alone with CONNECT. Both are read. A request in the proxy
+form authenticates with Proxy-Authorization and is refused with 407, as a proxy
+refuses one; a request in the site form uses Authorization and 401.
+.br
+ What answers a request is still decided by the rules. \fBproxypass\fR is the
+rule which answers by fetching, so a service can serve what it has and proxy the
+rest:
+.br
+ http file * /local/** "/usr/local/web/$1"
+.br
+ http proxypass * /**
+.br
+ httpsrv -p8080
+.br
+ The same happens without a rule for it where an access rule redirects to the
+local proxy, which is written as a chain of no address: the rules are asked
+first, and a request none of them answers is fetched.
+.br
+ allow *
+.br
+ parent 1000 http 0.0.0.0 0
+.br
+ allow *
+.br
+ The second \fBallow\fR is what the proxy matches on the pass it makes itself:
+a rule carrying the chain is not taken twice. Authentication happens twice for
+the same reason, once for the service and once for the proxy, so a configuration
+asking for credentials asks for them as a proxy does.
+.br
+ The access rules are read from the top on both passes, and it is the second
+pass which describes where the request is going. On the first one the service is
+answering for itself, so the destination an address or a port is matched against
+is the address the client connected to; the name from the request is matched on
+both. On the second the destination is the one the request names, so rules
+written with an address, a port or a name decide what the proxy is allowed to
+fetch, and they decide it before the connection is made:
+.br
+ allow *
+.br
+ parent 1000 http 0.0.0.0 0
+.br
+ allow * * * 80,443
+.br
+ deny *
+.br
+ Everything reaches the rules, and only ports 80 and 443 are fetched. A rule
+before the one carrying the chain applies on both passes just the same, so a
+\fBdeny\fR written there stops the request as well.
+.br
+ The connection to the server is kept for the request after it, and closed when
+the request after it goes somewhere else, or when the server has closed it in
+the meantime. A tunnel is fetched by the proxy code as well, which means the
+connection carrying it belongs to that request alone.
+
+.SS Connections
+An answer is sent as HTTP/1.1 to a client which asked in HTTP/1.1, and the
+connection is kept for the next request unless the client sent
+\fBConnection: close\fR. A 1.0 client gets a 1.0 answer, and the connection is
+kept only when it asked with \fBConnection: keep-alive\fR.
+.br
+ The connection is kept only when what was sent is framed exactly: every
+operation but the administration pages states a length, or sends a chunked body
+a 1.1 client can read, so the pages of \fBadmin\fR are always the last thing on
+a connection. A request body which cannot be read to its end ends the connection
+as well: one sent with \fBTransfer-Encoding\fR, which this server does not read,
+and one longer than a megabyte, which it will not.
+
+.SS Paths a rule builds
+The path a rule builds is used as it is, so it is refused rather than corrected
+when it is not a plain full path. A relative path is refused: it would be read
+against whatever directory the service happens to be in. So is one holding
+\fB.\fR or \fB..\fR as an element, a carriage return, a newline or a star. On
+Windows a path must name a drive or a share, and is converted to the extended
+\\\\?\\ form and opened through the wide interface, so a long path works.
+.br
+ A request is checked before any of this: a path which decodes to one leaving
+the tree is refused outright.
+
+.SS Examples
+.br
+ http file example.com /my/webpath/*.html "/usr/local/web/$1.html"
+.br
+ http cache example.com "pcre:^/(.*)/pic/(.*)\.(gif|jpeg)$" "/usr/local/web/picts/$1/$2.$3"
+.br
+ http redir * /old/** 301 "https://example.org/$1"
+.br
+ http rewrite * /alias/** "/w/$1"
+.br
+ http rewrite_host *.old.example ** "$1.new.example"
+.br
+ http file * /static/** "/usr/local/web/static/$1"
+.br
+ httpsrv -p8080
+
 .SH BUGS
 Report all bugs to
 .BR 3proxy@3proxy.org

rus.3ps

@@ -24,7 +24,6 @@ Content-type: text/html; charset=utf-8\n
 <A HREF='/C'>Счетчики</A><br><br>\n
 <A HREF='/R'>Перезагрузка конфигурации сервера</A><br><br>\n
 <A HREF='/S'>Запущенные сервисы</A><br><br>\n
-<A HREF='/F'>Настройка сервера</A>\n
 </td><td>
 <h2>%s %s Конфигурация</h2>
 [end]

scripts/openwrt/Makefile

@@ -7,14 +7,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=3proxy
-PKG_VERSION:=0.9.9.0
+PKG_VERSION:=1.0.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 # A trailing ? tells the download helper the URL is complete and PKG_SOURCE
 # must not be appended to it.
 PKG_SOURCE_URL:=https://codeload.github.com/3proxy/3proxy/tar.gz/refs/tags/$(PKG_VERSION)?
-PKG_HASH:=5af253fa734f61af6d5fe3790022130a14caf25bfce24a6aefd415797d351dd3
+PKG_HASH:=35b07de1046f3aaeac4a7085101b7e5c453efa3527cbdc42a84690366c7ecfa8
 
 PKG_MAINTAINER:=Vladimir Dubrovin <vlad@3proxy.org>
 PKG_LICENSE:=BSD-3-Clause

scripts/rh/3proxy.spec

@@ -1,5 +1,5 @@
 Name:           3proxy
-Version:        0.9.9.1
+Version:        1.0.1
 Release:        1%{?dist}
 Summary:        3proxy tiny proxy server
 License:        GPL/LGPL/Apache/BSD
@@ -36,11 +36,7 @@ make clean
 %files
 /bin/3proxy
 /bin/3proxy_crypt
-/bin/3proxy_ftppr
-/bin/3proxy_imapp
-/bin/3proxy_pop3p
 /bin/3proxy_proxy
-/bin/3proxy_smtpp
 /bin/3proxy_socks
 /bin/3proxy_tcppm
 /bin/3proxy_tlspr

src/3proxy.c

@@ -13,6 +13,12 @@ void ssl_install(void);
 #ifdef WITH_PCRE
 void pcre_install(void);
 #endif
+#ifdef WITH_TRANSPARENT
+void transparent_install(void);
+#endif
+#ifdef WITH_HTTPSRV
+void httpsrv_init(void);
+#endif
 #ifndef _WIN32
 #include <sys/resource.h>
 #ifndef NOPLUGINS
@@ -28,7 +34,6 @@ void pcre_install(void);
 
 FILE * confopen();
 extern unsigned char *strings[];
-extern FILE *writable;
 extern struct counter_header cheader;
 extern struct counter_record crecord;
 
@@ -69,13 +74,8 @@ void __stdcall CommandHandler( DWORD dwCommand )
         SetStatus( SERVICE_STOP_PENDING, 0, 1 );
 	conf.timetoexit = 1;
 	conf.paused++;
-	Sleep(2000);
+	/* ServiceMain() reports the service stopped once cyclestep() has
-        SetStatus( SERVICE_STOPPED, 0, 0 );
+	   seen this and the services are done */
-#ifdef WITH_ODBC
-	_3proxy_mutex_lock(&log_mutex);
-	close_sql();
-	_3proxy_mutex_unlock(&log_mutex);
-#endif
         break;
     case SERVICE_CONTROL_PAUSE:
         SetStatus( SERVICE_PAUSE_PENDING, 0, 1 );
@@ -101,6 +101,13 @@ void __stdcall ServiceMain(int argc, unsigned char* argv[] )
     SetStatus( SERVICE_START_PENDING, 0, 1 );
     SetStatus( SERVICE_RUNNING, 0, 0 );
     cyclestep();
+#ifdef WITH_ODBC
+    _3proxy_mutex_lock(&log_mutex);
+    close_sql();
+    _3proxy_mutex_unlock(&log_mutex);
+#endif
+    /* the last thing: the process may be ended once this is reported */
+    SetStatus( SERVICE_STOPPED, 0, 0 );
 }
 #endif
 
@@ -235,6 +242,39 @@ void dumpcounters(struct trafcount *tlin, int counterd){
  }
 }
 
+/* Lets the services finish before the process exits, for EXITWAIT ms at
+   most: each one waits for its connections, and a connection may hang on
+   its peer. Posts left over from reloads are consumed on the way, the
+   count decides. */
+#define EXITWAIT 3000
+static unsigned long nowms(void){
+#ifdef _WIN32
+ return (unsigned long)GetTickCount();
+#else
+ struct timeval tv;
+
+ gettimeofday(&tv, NULL);
+ return (unsigned long)tv.tv_sec * 1000 + tv.tv_usec / 1000;
+#endif
+}
+
+static void waitservices(void){
+ unsigned long start = nowms(), passed;
+
+ for(;;){
+	int n;
+
+	_3proxy_mutex_lock(&runningservices_mutex);
+	n = runningservices;
+	_3proxy_mutex_unlock(&runningservices_mutex);
+	if(!n) return;
+	/* a clock set back makes this huge, which ends the wait as well */
+	passed = nowms() - start;
+	if(passed >= EXITWAIT) return;
+	if(_3proxy_sem_timedlock(serviceexited, (unsigned)(EXITWAIT - passed))) return;
+ }
+}
+
 void cyclestep(void){
  struct tm *tm;
  time_t minutecounter;
@@ -331,9 +371,7 @@ void cyclestep(void){
 	if(conf.timetoexit){
 		conf.paused++;
 		doschedule();
-		usleep(SLEEPTIME*999);
+		waitservices();
-		usleep(SLEEPTIME*999);
-		usleep(SLEEPTIME*999);
 		return;
 	}
 		
@@ -512,6 +550,7 @@ int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int
   }
 
   _3proxy_mutex_init(&config_mutex);
+  _3proxy_mutex_init(&runningservices_mutex);
   _3proxy_mutex_init(&bandlim_mutex);
   _3proxy_mutex_init(&connlim_mutex);
   _3proxy_mutex_init(&tc_mutex);
@@ -519,7 +558,7 @@ int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int
 #ifndef NORADIUS
   _3proxy_mutex_init(&rad_mutex);
 #endif
-  if(_3proxy_sem_init(conf.threadinit, 1, 1)){
+  if(_3proxy_sem_init_timed(serviceexited, 0, 0x7fffffff)){
     fprintf(stderr, "semaphore init failed\n");
     return 1;
   }
@@ -530,14 +569,22 @@ int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int
 #ifdef WITH_PCRE
   pcre_install();
 #endif
+#ifdef WITH_TRANSPARENT
+  transparent_install();
+#endif
+#ifdef WITH_HTTPSRV
+  httpsrv_init();
+#endif
 
   freeconf(&conf);
   initcommands();
   res = readconfig(fp);
   conf.version++;
 
-  if(res) RETURN(res);
+  /* readconfig() names the failing line, which an exit status would cut
-  if(!writable){fclose(fp); fp = NULL;}
+     to 8 bits: a failed configuration exits with 1 */
+  if(res) RETURN(1);
+  fclose(fp); fp = NULL;
 
 #ifdef _WIN32
   
@@ -569,6 +616,6 @@ int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int
 CLEARRETURN:
 
  if(fp && fp != stdin) {fclose(fp); fp = NULL;}
- return 0;
+ return res;
 
 }

src/Makefile.inc

@@ -2,7 +2,7 @@
 # 3 proxy common Makefile
 #
 
-all:	$(BUILDDIR)3proxy$(EXESUFFICS) $(BUILDDIR)$(CRYPT_PREFIX)crypt$(EXESUFFICS) $(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS) $(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS) $(BUILDDIR)$(PREFIX)tcppm$(EXESUFFICS) $(BUILDDIR)$(PREFIX)udppm$(EXESUFFICS) $(BUILDDIR)$(PREFIX)tlspr$(EXESUFFICS) $(BUILDDIR)$(PREFIX)socks$(EXESUFFICS) $(BUILDDIR)$(PREFIX)proxy$(EXESUFFICS) allplugins
+all:	$(BUILDDIR)3proxy$(EXESUFFICS) $(BUILDDIR)$(CRYPT_PREFIX)crypt$(EXESUFFICS) $(MAIL_EXES) $(FTP_EXES) $(BUILDDIR)$(PREFIX)tcppm$(EXESUFFICS) $(BUILDDIR)$(PREFIX)udppm$(EXESUFFICS) $(BUILDDIR)$(PREFIX)tlspr$(EXESUFFICS) $(BUILDDIR)$(PREFIX)socks$(EXESUFFICS) $(BUILDDIR)$(PREFIX)proxy$(EXESUFFICS) allplugins
 
 sockmap$(OBJSUFFICS): sockmap.c proxy.h structures.h
 	$(CC) $(CFLAGS) sockmap.c
@@ -13,6 +13,9 @@ udpsockmap$(OBJSUFFICS): udpsockmap.c proxy.h structures.h
 common$(OBJSUFFICS): common.c proxy.h structures.h
 	$(CC) $(CFLAGS) common.c
 
+sem$(OBJSUFFICS): sem.c proxy.h structures.h
+	$(CC) $(CFLAGS) sem.c
+
 plugins$(OBJSUFFICS): plugins.c proxy.h structures.h
 	$(CC) $(CFLAGS) plugins.c
 
@@ -44,7 +47,7 @@ tcppm$(OBJSUFFICS): tcppm.c proxy.h structures.h proxymain.c
 	$(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)PORTMAP $(DEFINEOPTION)NOUDPMAIN tcppm.c
 
 udppm$(OBJSUFFICS): udppm.c proxy.h structures.h proxymain.c
-	$(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)PORTMAP udppm.c
+	$(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)PORTMAP $(DEFINEOPTION)NOTCPMAIN udppm.c
 
 tlspr$(OBJSUFFICS): tlspr.c proxy.h structures.h proxymain.c
 	$(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)PORTMAP $(DEFINEOPTION)NOUDPMAIN tlspr.c
@@ -56,32 +59,32 @@ socks$(OBJSUFFICS): socks.c proxy.h structures.h proxymain.c
 3proxy$(OBJSUFFICS): 3proxy.c proxy.h structures.h
 	$(CC) $(CFLAGS) 3proxy.c
 
-$(BUILDDIR)$(PREFIX)proxy$(EXESUFFICS): sockmap$(OBJSUFFICS) proxy$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS)
+$(BUILDDIR)$(PREFIX)proxy$(EXESUFFICS): sockmap$(OBJSUFFICS) proxy$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)proxy$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) proxy$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)proxy$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) proxy$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS): sockmap$(OBJSUFFICS) pop3p$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) $(COMPATLIBS)
+$(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS): sockmap$(OBJSUFFICS) pop3p$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) $(COMPATLIBS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) pop3p$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)pop3p$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) pop3p$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS): sockmap$(OBJSUFFICS) imapp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) base64$(OBJSUFFICS) $(COMPATLIBS)
+$(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS): sockmap$(OBJSUFFICS) imapp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) base64$(OBJSUFFICS) $(COMPATLIBS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) imapp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) base64$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)imapp$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) imapp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) base64$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS): sockmap$(OBJSUFFICS) smtpp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) base64$(OBJSUFFICS) $(COMPATLIBS)
+$(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS): sockmap$(OBJSUFFICS) smtpp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) base64$(OBJSUFFICS) $(COMPATLIBS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) smtpp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) base64$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)smtpp$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) smtpp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) base64$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS): sockmap$(OBJSUFFICS) ftppr$(OBJSUFFICS) ftp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) $(COMPATLIBS)
+$(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS): sockmap$(OBJSUFFICS) ftppr$(OBJSUFFICS) ftp$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) $(COMPATLIBS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) ftppr$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)ftppr$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) ftppr$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)socks$(EXESUFFICS): sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) socks$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS)
+$(BUILDDIR)$(PREFIX)socks$(EXESUFFICS): sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) socks$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)socks$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) socks$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)socks$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) socks$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)tcppm$(EXESUFFICS): sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tcppm$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS)
+$(BUILDDIR)$(PREFIX)tcppm$(EXESUFFICS): sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tcppm$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)tcppm$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tcppm$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)tcppm$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tcppm$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)udppm$(EXESUFFICS): sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) udppm$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) hash$(OBJSUFFICS)
+$(BUILDDIR)$(PREFIX)udppm$(EXESUFFICS): sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) udppm$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) hash$(OBJSUFFICS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)udppm$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) udppm$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) hash$(OBJSUFFICS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)udppm$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) udppm$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) hash$(OBJSUFFICS) $(LIBS)
 
-$(BUILDDIR)$(PREFIX)tlspr$(EXESUFFICS): sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tlspr$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS)
+$(BUILDDIR)$(PREFIX)tlspr$(EXESUFFICS): sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tlspr$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS)
-	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)tlspr$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tlspr$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) $(LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)$(PREFIX)tlspr$(EXESUFFICS) $(LDFLAGS) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tlspr$(OBJSUFFICS) log$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) $(LIBS)
 
 mainfunc$(OBJSUFFICS): proxy.h structures.h proxymain.c
 	$(CC) $(COUT)mainfunc$(OBJSUFFICS) $(CFLAGS) $(DEFINEOPTION)MODULEMAINFUNC=mainfunc proxymain.c
@@ -116,6 +119,12 @@ srvsocks$(OBJSUFFICS): socks.c proxy.h structures.h
 srvwebadmin$(OBJSUFFICS): webadmin.c proxy.h structures.h
 	$(CC) $(COUT)srvwebadmin$(OBJSUFFICS) $(CFLAGS) webadmin.c
 
+transparent$(OBJSUFFICS): transparent.c proxy.h structures.h
+	$(CC) $(COUT)transparent$(OBJSUFFICS) $(CFLAGS) transparent.c
+
+srvhttpsrv$(OBJSUFFICS): httpsrv.c proxy.h structures.h
+	$(CC) $(COUT)srvhttpsrv$(OBJSUFFICS) $(CFLAGS) httpsrv.c
+
 srvudppm$(OBJSUFFICS): udppm.c proxy.h structures.h
 	$(CC) $(COUT)srvudppm$(OBJSUFFICS) $(CFLAGS) udppm.c
 
@@ -188,6 +197,6 @@ ssl$(OBJSUFFICS): ssl.c structures.h proxy.h ssl.h
 pcre$(OBJSUFFICS): pcre.c structures.h
 	$(CC) $(COUT)pcre$(OBJSUFFICS) $(CFLAGS) $(DEFINEOPTION)WITH_PCRE pcre.c
 
-$(BUILDDIR)3proxy$(EXESUFFICS): 3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) log$(OBJSUFFICS) datatypes$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(COMPATLIBS) $(VERSIONDEP)
+$(BUILDDIR)3proxy$(EXESUFFICS): 3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) log$(OBJSUFFICS) datatypes$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) $(HTTPSRV_OBJS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(TRANSPARENT_OBJS) $(COMPATLIBS) $(VERSIONDEP)
-	$(LN) $(LNOUT)$(BUILDDIR)3proxy$(EXESUFFICS) $(LDFLAGS) $(VERFILE)  3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) datatypes$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(COMPATLIBS) $(LIBS) $(PCRE_LIBS)
+	$(LN) $(LNOUT)$(BUILDDIR)3proxy$(EXESUFFICS) $(LDFLAGS) $(VERFILE)  3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) datatypes$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) sem$(OBJSUFFICS) log$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) $(HTTPSRV_OBJS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(TRANSPARENT_OBJS) $(COMPATLIBS) $(LIBS) $(PCRE_LIBS)
 

src/acl.c

@@ -8,6 +8,247 @@
 
 #include "proxy.h"
 
+/* The pattern engine lives here rather than in common.c: common.c is linked
+   into the standalone binaries as well, and those carry neither the regular
+   expression code this calls nor a use for a host pattern. */
+/* Host lists in access rules have always accepted name, name*, *name and
+   *name*, with the leading and trailing star recorded as a match type rather
+   than kept in the string. The parser and the comparison are here so that
+   anything else matching a name against a pattern - the http command, and
+   whatever replaces the star with a regular expression later - behaves the same
+   way and gains the same syntax at the same time.
+ */
+/* A pattern written as a regular expression carries a prefix. Both spellings
+   are taken so a configuration reads the way its author thinks of it. */
+static unsigned char * regexprefix(unsigned char *arg)
+{
+	if(!strncmp((char *)arg, "pcre:", 5)) return arg + 5;
+	if(!strncmp((char *)arg, "regex:", 6)) return arg + 6;
+	return NULL;
+}
+
+/* Shared by every pattern the configuration can carry. Returns 0 on success. */
+static int compileregex(struct hostname *h, unsigned char *pattern)
+{
+#ifdef WITH_PCRE
+	char err[256];
+
+	h->re = pcre_pattern_compile(pattern, err, sizeof(err));
+	if(!h->re){
+		fprintf(stderr, "Bad regular expression '%s': %s\n", pattern, err);
+		return 1;
+	}
+	h->matchtype = MATCHREGEX;
+	h->name = (unsigned char *)strdup((char *)pattern);
+	return h->name? 0 : 1;
+#else
+	fprintf(stderr, "Regular expression '%s' needs a build with PCRE\n", pattern);
+	return 1;
+#endif
+}
+
+int parsepattern(struct hostname *h, unsigned char *arg)
+{
+	int arglen;
+	unsigned char *pattern;
+
+	h->re = NULL;
+	if((pattern = regexprefix(arg))) return compileregex(h, pattern);
+
+	arglen = (int)strlen((char *)arg);
+	h->matchtype = 3;
+	pattern = arg;
+
+	if(arglen && pattern[arglen-1] == '*'){
+		arglen--;
+		pattern[arglen] = 0;
+		h->matchtype ^= MATCHEND;
+	}
+	if(arglen && pattern[0] == '*'){
+		pattern++;
+		arglen--;
+		h->matchtype ^= MATCHBEGIN;
+	}
+
+	h->name = (unsigned char *)strdup((char *)pattern);
+	return h->name? 0 : 1;
+}
+
+/* Matches str against a pattern and reports the part a star stood for. Where a
+   pattern has a star at both ends the trailing one is reported, since that is
+   the part following the text that was matched. An exact pattern leaves an
+   empty span. */
+int patternmatchpos(const struct hostname *h, const unsigned char *str, int *start, int *len)
+{
+	int lname, lstr, pos = 0, match = 0;
+	char *found;
+
+	if(!h->name || !str) return 0;
+	if(h->matchtype == MATCHREGEX || h->matchtype == MATCHGLOB){
+		struct capture caps[MAXCAPTURES];
+
+		if(!patternmatchcaps(h, str, caps, NULL)) return 0;
+		if(start) *start = caps[1].start;
+		if(len) *len = caps[1].len;
+		return 1;
+	}
+
+	lname = (int)strlen((char *)h->name);
+	lstr = (int)strlen((char *)str);
+
+	switch(h->matchtype){
+		case 0:
+#ifndef _WIN32
+			found = strcasestr((char *)str, (char *)h->name);
+#else
+			found = strstr((char *)str, (char *)h->name);
+#endif
+			if(found){
+				match = 1;
+				pos = (int)(found - (char *)str) + lname;
+			}
+			break;
+
+		case 1:
+			if(!strncasecmp((char *)str, (char *)h->name, lname)){
+				match = 1;
+				pos = lname;
+			}
+			break;
+
+		case 2:
+			if(lstr >= lname &&
+			   !strncasecmp((char *)str + (lstr - lname), (char *)h->name, lname)){
+				match = 1;
+				pos = 0;
+				if(start) *start = 0;
+				if(len) *len = lstr - lname;
+				return 1;
+			}
+			break;
+
+		default:
+			if(!strcasecmp((char *)str, (char *)h->name)){
+				match = 1;
+				pos = lstr;
+			}
+			break;
+	}
+
+	if(!match) return 0;
+
+	if(start) *start = pos;
+	if(len) *len = lstr - pos;
+	return 1;
+}
+
+int patternmatch(const struct hostname *h, const unsigned char *str)
+{
+	return patternmatchcaps(h, str, NULL, NULL);
+}
+
+/* Match a glob, recording what each star stood for.
+
+   A single star stands for any run of characters within one element of the
+   path, so it stops at a slash; a double star crosses them. Stars are
+   numbered in the order they appear, which is how a template refers to them.
+ */
+static int globmatch(const unsigned char *pat, const unsigned char *str,
+	const unsigned char *subject, struct capture *caps, int maxcaps, int star)
+{
+	while(*pat){
+		if(*pat == '*'){
+			int crosses = (pat[1] == '*');
+			const unsigned char *rest = pat + (crosses? 2 : 1);
+			int len;
+
+			for(len = 0; ; len++){
+				if(star < maxcaps && caps){
+					caps[star].start = (int)(str - subject);
+					caps[star].len = len;
+				}
+				if(globmatch(rest, str + len, subject, caps, maxcaps, star + 1)) return 1;
+				if(!str[len]) return 0;
+				if(!crosses && str[len] == '/') return 0;
+			}
+		}
+		if(*pat != *str) return 0;
+		pat++;
+		str++;
+	}
+	return *str == 0;
+}
+
+/* Match a pattern of any kind and report what its stars or groups stood for.
+   caps may be NULL when only the yes or no answer is wanted. */
+int patternmatchcaps(const struct hostname *h, const unsigned char *str,
+	struct capture *caps, int *ncaps)
+{
+	int n = 0;
+
+	if(ncaps) *ncaps = 0;
+	if(!h || !str) return 0;
+
+	if(h->matchtype == MATCHREGEX){
+#ifdef WITH_PCRE
+		struct capture local[MAXCAPTURES];
+
+		n = pcre_pattern_match(h->re, str, caps? caps : local, MAXCAPTURES);
+		if(ncaps) *ncaps = n;
+		return n > 0;
+#else
+		return 0;
+#endif
+	}
+
+	if(h->matchtype == MATCHGLOB){
+		struct capture local[MAXCAPTURES];
+		struct capture *use = caps? caps : local;
+		int i;
+
+		for(i = 0; i < MAXCAPTURES; i++){
+			use[i].start = 0;
+			use[i].len = 0;
+		}
+		use[0].start = 0;
+		use[0].len = (int)strlen((char *)str);
+		if(!h->name) return 0;
+		if(!globmatch(h->name, str, str, use, MAXCAPTURES, 1)) return 0;
+		if(ncaps){
+			for(n = MAXCAPTURES - 1; n > 0 && !use[n].len && !use[n].start; n--);
+			*ncaps = n + 1;
+		}
+		return 1;
+	}
+
+	/* the star at one end or both, as an access rule has always written it */
+	if(caps){
+		int start = 0, len = 0;
+
+		if(!patternmatchpos(h, str, &start, &len)) return 0;
+		caps[0].start = 0;
+		caps[0].len = (int)strlen((char *)str);
+		caps[1].start = start;
+		caps[1].len = len;
+		if(ncaps) *ncaps = 2;
+		return 1;
+	}
+	return patternmatchpos(h, str, NULL, NULL);
+}
+
+/* A URL in an http rule: stars anywhere, or a regular expression. */
+int parsepathpattern(struct hostname *h, unsigned char *arg)
+{
+	unsigned char *pattern;
+
+	h->re = NULL;
+	if((pattern = regexprefix(arg))) return compileregex(h, pattern);
+
+	h->matchtype = MATCHGLOB;
+	h->name = (unsigned char *)strdup((char *)arg);
+	return h->name? 0 : 1;
+}
+
 int IPInentry(struct sockaddr *sa, struct iplist *ipentry){
 	int addrlen;
 	unsigned char *ip, *ipf, *ipt;
@@ -62,36 +303,7 @@ int ACLmatches(struct ace* acentry, struct clientparam * param){
 			}
 			while(i > 5 && param->hostname[i-1] == '.') param->hostname[i-1] = 0;
 			for(hstentry = acentry->dstnames; hstentry; hstentry = hstentry->next){
-				int lname, lhost;
+				if(patternmatch(hstentry, param->hostname)) match = 1;
-				switch(hstentry->matchtype){
-					case 0:
-#ifndef _WIN32
-					if(strcasestr((char *)param->hostname, (char *)hstentry->name)) match = 1;
-#else
-					if(strstr((char *)param->hostname, (char *)hstentry->name)) match = 1;
-#endif
-					break;
-
-					case 1:
-					if(!strncasecmp((char *)param->hostname, (char *)hstentry->name, strlen((char *)hstentry->name)))
-						match = 1;
-					break;
-
-					case 2:
-					lname = strlen((char *)hstentry->name);
-					lhost = strlen((char *)param->hostname);
-					if(lhost > lname){
-						if(!strncasecmp((char *)param->hostname + (lhost - lname),
-							(char *)hstentry->name,
-							lname))
-								match = 1;
-					}
-					break;
-
-					default:
-					if(!strcasecmp((char *)param->hostname, (char *)hstentry->name)) match = 1;
-					break;
-        			}
 				if(match) break;
 			}
 		 }
@@ -164,7 +376,10 @@ int checkACL(struct clientparam * param){
 					continue;
 				}
 				param->lastace = acentry;
-				if(param->preauth) return 2;
+				if(param->preauth) {
+					applyportranges(param, acentry);
+					return 2;
+				}
 				if((param->operation == UDPASSOC)? (param->ctrlsocksrv != INVALID_SOCKET) : (param->remsock != INVALID_SOCKET)) {
 					return 0;
 				}
@@ -187,3 +402,31 @@ int checkACL(struct clientparam * param){
 	}
 	return 3;
 }
+
+char * aceaction (int action){
+	switch (action) {
+		case ALLOW:
+		case REDIRECT:
+			return "allow";
+		case DENY:
+			return "deny";
+		case BANDLIM:
+			return "bandlim";
+		case NOBANDLIM:
+			return "nobandlim";
+		case COUNTIN:
+			return "countin";
+		case NOCOUNTIN:
+			return "nocountin";
+		case COUNTOUT:
+			return "countout";
+		case NOCOUNTOUT:
+			return "nocountout";
+		case COUNTALL:
+			return "countall";
+		case NOCOUNTALL:
+			return "nocountall";
+		default:
+			return "unknown";
+	}
+}

src/auth.c

@@ -18,7 +18,14 @@ int alwaysauth(struct clientparam * param){
 
 
 	if(conf.connlimiter && !param->connlim  && startconnlims(param)) return 10;
+#ifdef WITH_HTTPSRV
+	/* The http server answers the request itself, so authorization must not
+	   try to reach a destination that does not exist. A request it has handed
+	   to another child does have one, and that child needs it opened. */
+	res = (param->srv->service == S_HTTPSRV && !param->onerequest)? 0 : doconnect(param);
+#else
 	res = doconnect(param);
+#endif
 	if(!res){
 		if(conf.bandlimfunc && (conf.bandlimiter||conf.bandlimiterout)){
 			_3proxy_mutex_lock(&bandlim_mutex);

src/common.c

@@ -187,33 +187,6 @@ size_t threadstacksize(int extra){
 	if(size < (long)PTHREAD_STACK_MIN) size = (long)PTHREAD_STACK_MIN;
 	return (size_t)size;
 }
-
-int _3proxy_sem_init_f(_3proxy_sem_t *sem, unsigned count, unsigned maxcount){
-	sem->count = count;
-	sem->maxcount = maxcount;
-	if(pthread_mutex_init(&sem->mutex, NULL)) return 1;
-	if(pthread_cond_init(&sem->cond, NULL)){
-		pthread_mutex_destroy(&sem->mutex);
-		return 1;
-	}
-	return 0;
-}
-
-void _3proxy_sem_lock_f(_3proxy_sem_t *sem){
-	pthread_mutex_lock(&sem->mutex);
-	while(!sem->count) pthread_cond_wait(&sem->cond, &sem->mutex);
-	sem->count--;
-	pthread_mutex_unlock(&sem->mutex);
-}
-
-void _3proxy_sem_unlock_f(_3proxy_sem_t *sem){
-	pthread_mutex_lock(&sem->mutex);
-	if(sem->count < sem->maxcount){
-		sem->count++;
-		pthread_cond_signal(&sem->cond);
-	}
-	pthread_mutex_unlock(&sem->mutex);
-}
 #endif
 
 struct extparam conf = {
@@ -414,7 +387,6 @@ int
 	return shutdown(s, how);
     }
     int WINAPI def_closesocket(void* state, SOCKET s){
-	usleep(SLEEPTIME);
 	return closesocket(s);
     }
 #else
@@ -677,6 +649,12 @@ int connectwithpoll(struct clientparam *param, SOCKET sock, struct sockaddr *sa,
 }
 
 
+/* Number of ports tried before giving up when the range has to be searched by
+ * hand. The kernel option picks a free port itself and needs no retries. */
+#define RANGETRIES 10
+
+static int bindrange(struct clientparam *param, SOCKET sock, PROXYSOCKADDRTYPE *sa, uint32_t range, int *tries);
+
 /* -Di / -De: ties a socket to the interface asked for, for TCP and UDP alike.
    Where the option is set per protocol, family is the one of the address the
    socket will be bound to. */
@@ -736,7 +714,10 @@ int doconnect(struct clientparam * param){
 	if(param->srv->so._getpeername(param->sostate, param->remsock, (struct sockaddr *)&param->sinsr, &size)==-1) {return (14);}
  }
  else {
+#ifndef _WIN32
 	struct linger lg = {1,conf.timeouts[LINGER_TO]};
+#endif
+	int tries = RANGETRIES;
 
 	if(SAISNULL(&param->sinsr)){
 		if(SAISNULL(&param->req)) {
@@ -746,6 +727,7 @@ int doconnect(struct clientparam * param){
 		memcpy(SAADDR(&param->sinsr), SAADDR(&param->req), SAADDRLEN(&param->req)); 
 	}
 	if(!*SAPORT(&param->sinsr))*SAPORT(&param->sinsr) = *SAPORT(&param->req);
+	for(;;){
 	if ((param->remsock=param->srv->so._socket(param->sostate, SASOCK(&param->sinsr), SOCK_STREAM, 
 #ifdef WITH_UN
 	    *SAFAMILY(&param->sinsr) == AF_UNIX? 0 :
@@ -764,21 +746,34 @@ int doconnect(struct clientparam * param){
 			param->sinsl = param->srv->extsa;
 	}
 	*SAPORT(&param->sinsl) = 0;
-	setopts(param->remsock, param->srv->srvsockopts);
+	setopts(param->remsock, &param->srv->srvsockopts);
 
+#ifndef _WIN32
+	/* not on Windows, see the accepting side in proxymain.c */
 	param->srv->so._setsockopt(param->sostate, param->remsock, SOL_SOCKET, SO_LINGER, (char *)&lg, sizeof(lg));
+#endif
 	if(extbindtodevice(param, param->remsock)) return 12;
 #ifdef WITH_UN
 	if(*SAFAMILY(&param->sinsl) != AF_UNIX)
 #endif
-	if(param->srv->so._bind(param->sostate, param->remsock, (struct sockaddr*)&param->sinsl, SASIZE(&param->sinsl))==-1) {
+	if(bindrange(param, param->remsock, &param->sinsl, param->extport, &tries)==-1) {
 		return 12;
 	}
 	
-	if(param->operation >= 256 || (param->operation & CONNECT) || param->redirected){
+	if(!(param->operation >= 256 || (param->operation & CONNECT) || param->redirected)) break;
-		if(connectwithpoll(param, param->remsock,(struct sockaddr *)&param->sinsr,SASIZE(&param->sinsr),conf.timeouts[CONNECT_TO])) {
+	if(!connectwithpoll(param, param->remsock,(struct sockaddr *)&param->sinsr,SASIZE(&param->sinsr),conf.timeouts[CONNECT_TO])) break;
-			return 13;
+	/* The port was free to bind, but the pair it makes with the destination
-		}
+	   is still closing from an earlier connection through the same range,
+	   which Windows refuses. Another port out of the range may do. Anything
+	   else is the destination's own answer, and is not worth a second port.
+	   The ports come out of the allowance the bind is already spending, so
+	   the range is not searched any harder than one bind would search it and
+	   the attempts parentretries makes are not multiplied. Counted here as
+	   well, since the kernel option hands out a port without spending any of
+	   the allowance. */
+	if(!param->extport || errno != EADDRINUSE || --tries <= 0) return 13;
+	param->srv->so._closesocket(param->sostate, param->remsock);
+	param->remsock = INVALID_SOCKET;
 	}
 	size = sizeof(param->sinsl);
 	if(param->srv->so._getsockname(param->sostate, param->remsock, (struct sockaddr *)&param->sinsl, &size)==-1) {return (15);}
@@ -792,6 +787,57 @@ int doconnect(struct clientparam * param){
  return 0;
 }
 
+/* Bind sock to sa, taking the local port from the range if one is set. The
+ * range is packed as first | last << 16.
+ *
+ * IP_LOCAL_PORT_RANGE leaves the choice to the kernel, which knows which ports
+ * are free. Where the option does not exist, or the kernel refuses it, or the
+ * address family is not one it covers, pick a port at random instead and retry
+ * on failure, since the one picked may already be taken.
+ *
+ * *tries is how many ports may still be taken out of the range. A caller which
+ * has to come back for another port, because the one it was given turned out
+ * to be unusable for the connection it wanted, carries the same count along
+ * and so cannot spend more attempts than one call would.
+ */
+static int bindrange(struct clientparam *param, SOCKET sock, PROXYSOCKADDRTYPE *sa, uint32_t range, int *tries)
+{
+	uint16_t first, last;
+
+	if(!range) return param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa));
+
+#ifdef IP_LOCAL_PORT_RANGE
+	if(*SAFAMILY(sa) == AF_INET &&
+	   !param->srv->so._setsockopt(param->sostate, sock, IPPROTO_IP, IP_LOCAL_PORT_RANGE,
+		(char *)&range, sizeof(range))){
+		*SAPORT(sa) = 0;
+		return param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa));
+	}
+#endif
+
+	first = (uint16_t)(range & 0xffff);
+	last = (uint16_t)(range >> 16);
+
+	while(*tries > 0){
+		(*tries)--;
+		*SAPORT(sa) = htons((uint16_t)(first + (myrand() % (unsigned)(last - first + 1))));
+		if(!param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa))) return 0;
+	}
+
+	/* Every port tried was taken. Fall back to an ephemeral one, which is
+	   what the kernel option above does when it cannot honour the range, so
+	   an exhausted range behaves the same way on every platform. */
+	*SAPORT(sa) = 0;
+	return param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa));
+}
+
+int bindwithrange(struct clientparam *param, SOCKET sock, PROXYSOCKADDRTYPE *sa, uint32_t range)
+{
+	int tries = RANGETRIES;
+
+	return bindrange(param, sock, sa, range, &tries);
+}
+
 int scanaddr(const unsigned char *s, uint32_t * ip, uint32_t * mask) {
 	unsigned d1, d2, d3, d4, m;
 	int res;

src/conf.c

@@ -7,6 +7,10 @@
 */
 
 #include "proxy.h"
+
+#ifdef WITH_HTTPSRV
+static int addhttprule(char *op, char *host, char *url, char *params);
+#endif
 #include "mdhash.h"
 #ifdef WITH_SSL
 void ssl_install(void);
@@ -14,6 +18,9 @@ void ssl_install(void);
 #ifdef WITH_PCRE
 void pcre_install(void);
 #endif
+#ifdef WITH_TRANSPARENT
+void transparent_install(void);
+#endif
 #ifndef _WIN32
 #include <sys/resource.h>
 #include <pwd.h>
@@ -31,15 +38,18 @@ _3proxy_mutex_t bandlim_mutex;
 _3proxy_mutex_t connlim_mutex;
 _3proxy_mutex_t tc_mutex;
 _3proxy_mutex_t config_mutex;
+int runningservices = 0;
+_3proxy_mutex_t runningservices_mutex;
+_3proxy_sem_t serviceexited;
 
-int haveerror = 0;
 int linenum = 0;
 
-FILE *writable;
 struct counter_header cheader = {"3CF", (time_t)0};
 struct counter_record crecord;
 
-int mainfunc (int argc, char** argv);
+int mainprepare(int argc, char** argv, void **service);
+int mainrun(void *service);
+void maindrop(void *service);
 
 struct proxydef childdef = {NULL, 0, 0, S_NOSERVICE, ""};
 
@@ -60,10 +70,6 @@ FILE * confopen(){
 			curconf += strlen(chrootp);
 	}
 #endif
-	if(writable) {
-		rewind(writable);
-		return writable;
-	}
 	return fopen(curconf, "r");
 }
 
@@ -73,8 +79,12 @@ DWORD WINAPI startsrv(LPVOID data) {
 #else
 void * startsrv(void * data) {
 #endif
-  struct child *d = (struct child *)data;
+  /* counted by start_proxy_thread() before the thread is created */
-  mainfunc(d->argc, (char **)d->argv);
+  mainrun(data);
+  _3proxy_mutex_lock(&runningservices_mutex);
+  runningservices--;
+  _3proxy_mutex_unlock(&runningservices_mutex);
+  _3proxy_sem_unlock(serviceexited);
   return 0;
 }
 
@@ -140,36 +150,45 @@ unsigned char * dologname (unsigned char *buf, unsigned char *name, const unsign
 	return buf;
 }
 
+/* The service is set up here, in the thread reading the configuration, so
+   an error in its options stops the configuration; its own thread then
+   listens and serves. */
 int start_proxy_thread(struct child * chp){
   pthread_t thread;
+  void *service;
+  int res;
 #ifdef _WIN32
   HANDLE h;
 #endif
 
-	_3proxy_sem_lock(conf.threadinit);
+	if((res = mainprepare(chp->argc, (char **)chp->argv, &service))) {
+		fprintf(stderr, "Service not started on line: %d%s\n", linenum, res == 2? ": insufficient memory":"");
+		return(40);
+	}
+	_3proxy_mutex_lock(&runningservices_mutex);
+	runningservices++;
+	_3proxy_mutex_unlock(&runningservices_mutex);
 #ifdef _WIN32
 #ifndef _WINCE
-	h = (HANDLE)_beginthreadex((LPSECURITY_ATTRIBUTES )NULL, 16384+conf.stacksize, (void *)startsrv, (void *) chp, (DWORD)0, &thread);
+	h = (HANDLE)_beginthreadex((LPSECURITY_ATTRIBUTES )NULL, 16384+conf.stacksize, (void *)startsrv, service, (DWORD)0, &thread);
 #else
-	h = (HANDLE)CreateThread((LPSECURITY_ATTRIBUTES )NULL, 16384+conf.stacksize, (void *)startsrv, (void *) chp, (DWORD)0, &thread);
+	h = (HANDLE)CreateThread((LPSECURITY_ATTRIBUTES )NULL, 16384+conf.stacksize, (void *)startsrv, service, (DWORD)0, &thread);
 #endif
 	if(h)CloseHandle(h);
+	else {
 #else
 	pthread_attr_init(&pa);
 	pthread_attr_setstacksize(&pa,threadstacksize(conf.stacksize));
 	pthread_attr_setdetachstate(&pa,PTHREAD_CREATE_DETACHED);
-	if(pthread_create(&thread, &pa, startsrv, (void *)chp)){
+	res = pthread_create(&thread, &pa, startsrv, service);
-		pthread_attr_destroy(&pa);
-		fprintf(stderr, "Failed to create service thread on line %d, try to set larger stacksize\n", linenum);
-		_3proxy_sem_unlock(conf.threadinit);
-		return(40);
-	}
 	pthread_attr_destroy(&pa);
+	if(res){
 #endif
-	_3proxy_sem_lock(conf.threadinit);
+		_3proxy_mutex_lock(&runningservices_mutex);
-	_3proxy_sem_unlock(conf.threadinit);
+		runningservices--;
-	if(haveerror)  {
+		_3proxy_mutex_unlock(&runningservices_mutex);
-		fprintf(stderr, "Service not started on line: %d%s\n", linenum, haveerror == 2? ": insufficient memory":"");
+		maindrop(service);
+		fprintf(stderr, "Failed to create service thread on line %d, try to set larger stacksize\n", linenum);
 		return(40);
 	}
 	return 0;
@@ -185,6 +204,9 @@ static int h_proxy(int argc, unsigned char ** argv){
 		childdef.port = 3128;
 		childdef.isudp = 0;
 		childdef.service = S_PROXY;
+#ifdef WITH_FTP
+		childdef.helpmessage = " -Xftp - fetch ftp:// URLs\n";
+#endif
 #ifdef NOIPV6
 		if(!resolvfunc || (resolvfunc == myresolver && !dns_table.poolsize)){
 			fprintf(stderr, "[line %d] Warning: no nserver/nscache configured, proxy may run very slow\n", linenum);
@@ -258,12 +280,32 @@ static int h_proxy(int argc, unsigned char ** argv){
 		childdef.service = S_UDPPM;
 		childdef.helpmessage = " -s single packet UDP service for request/reply (DNS-like) services\n";
 	}
+#ifdef WITH_HTTPSRV
 	else if(!strcmp((char *)argv[0], "admin")) {
-		childdef.pf = adminchild;
+		/* The same service as httpsrv, with the administration pages
+		   declared for it. */
+		if(addhttprule("admin_counters", "*", "/C*", NULL) ||
+		   addhttprule("admin_reload", "*", "/R", NULL) ||
+		   addhttprule("admin_services", "*", "/S*", NULL) ||
+		   addhttprule("admin", "*", "**", NULL)){
+			fprintf(stderr, "Failed to declare the admin pages, line %d\n", linenum);
+			return 1;
+		}
+		childdef.pf = httpsrvchild;
 		childdef.port = 80;
 		childdef.isudp = 0;
-		childdef.service = S_ADMIN;
+		childdef.service = S_HTTPSRV;
 	}
+#endif
+#ifdef WITH_HTTPSRV
+	else if(!strcmp((char *)argv[0], "httpsrv")) {
+		childdef.pf = httpsrvchild;
+		childdef.port = 80;
+		childdef.isudp = 0;
+		childdef.service = S_HTTPSRV;
+		childdef.helpmessage = " HTTP server, /echo describes the connection, /data?size=N returns N bytes\n";
+	}
+#endif
 	else if(!strcmp((char *)argv[0], "dnspr")) {
 		childdef.pf = dnsprchild;
 		childdef.port = 53;
@@ -336,7 +378,8 @@ static int h_log(int argc, unsigned char ** argv){
 #ifndef _WIN32
 			conf.logfunc = logsyslog;
 			if(notchanged) return 0;
-			openlog((char *)conf.logtarget+1, LOG_PID, LOG_DAEMON);
+			/* connected now: after a chroot there is no /dev/log to find */
+			openlog((char *)conf.logtarget+1, LOG_PID | LOG_NDELAY, LOG_DAEMON);
 #endif
 		}
 #ifdef WITH_ODBC
@@ -770,14 +813,193 @@ struct redirdesc redirs[] = {
     {R_SOCKS5P, "socks5+", sockschild},
     {R_SOCKS4B, "socks4b", sockschild},
     {R_SOCKS5B, "socks5b", sockschild},
-    {R_ADMIN, "admin", adminchild},
     {R_EXTIP, "extip", NULL},
+    {R_EXTPORT, "extport", NULL},
+    {R_INTPORT, "intport", NULL},
     {R_TLS, "tls", tlsprchild},
     {R_HA, "ha", NULL},
     {R_DNS, "dns", dnsprchild},
     {0, NULL, NULL}
 };
 
+#ifdef WITH_HTTPSRV
+/* Headers a rule adds are written as one argument, the lines separated by a
+   backslash and an n, because a configuration line cannot hold a line ending.
+   Those two characters become a real one here. A line ending which reached the
+   argument as itself is dropped: what goes on the wire is decided here and not
+   by whatever produced the string. */
+static unsigned char * parsehdrs(const unsigned char *arg)
+{
+	unsigned char *out, *o;
+	const unsigned char *p;
+	size_t len = strlen((char *)arg);
+
+	out = malloc(len * 2 + 3);
+	if(!out) return NULL;
+	for(p = arg, o = out; *p; p++){
+		if(*p == '\\' && p[1] == 'n'){
+			*o++ = '\r';
+			*o++ = '\n';
+			p++;
+			continue;
+		}
+		if(*p == '\r' || *p == '\n') continue;
+		*o++ = *p;
+	}
+	if(o == out || o[-1] != '\n'){
+		*o++ = '\r';
+		*o++ = '\n';
+	}
+	*o = 0;
+	return out;
+}
+
+/* An optional argument which a star, or nothing at all, leaves at its
+   default. */
+static int optnum(int argc, unsigned char **argv, int at, int def)
+{
+	if(argc <= at || !strcmp((char *)argv[at], "*")) return def;
+	return atoi((char *)argv[at]);
+}
+
+static void freehttprule(struct httprule *rule)
+{
+	if(rule->host.name) free(rule->host.name);
+	if(rule->url.name) free(rule->url.name);
+	if(rule->params) free(rule->params);
+	if(rule->ctype) free(rule->ctype);
+	if(rule->hdrs) free(rule->hdrs);
+	free(rule);
+}
+
+/* Installs one rule from code, for the pages a service predefines. */
+static int addhttprule(char *op, char *host, char *url, char *params)
+{
+    struct httprule *rule, *tail;
+    unsigned char hostbuf[64], urlbuf[128];
+
+	rule = malloc(sizeof(struct httprule));
+	if(!rule) return 1;
+	memset(rule, 0, sizeof(struct httprule));
+	rule->maxage = -1;
+
+	rule->op = httpopbyname((unsigned char *)op);
+	if(rule->op < 0){
+		free(rule);
+		return 1;
+	}
+
+	strcpy((char *)hostbuf, host);
+	strcpy((char *)urlbuf, url);
+	if(parsepattern(&rule->host, hostbuf) || parsepathpattern(&rule->url, urlbuf)){
+		free(rule->host.name);
+		free(rule);
+		return 1;
+	}
+	if(params) rule->params = (unsigned char *)strdup(params);
+
+	if(!conf.httprules) conf.httprules = rule;
+	else {
+		for(tail = conf.httprules; tail->next; tail = tail->next);
+		tail->next = rule;
+	}
+	return 0;
+}
+#endif
+
+/* Parses an inclusive FIRST-LAST local port range into first | last << 16. */
+static int parserange(unsigned char *arg, uint32_t *range)
+{
+	char *end;
+	unsigned long first, last;
+
+	first = strtoul((char *)arg, &end, 10);
+	if(end == (char *)arg || *end != '-' || !first || first > 65535) return 1;
+
+	arg = (unsigned char *)end + 1;
+	last = strtoul((char *)arg, &end, 10);
+	if(end == (char *)arg || *end || !last || last > 65535 || last < first) return 1;
+
+	*range = (uint32_t)first | ((uint32_t)last << 16);
+	return 0;
+}
+
+/* Scan a parent weight into its share of WEIGHTSCALE, as an integer: there is
+ * no floating point anywhere near a configuration file.
+ *
+ * A weight starting with 0 or . is a fraction of one, so .333 and 0.333 are
+ * both a third. Anything else is the old notation, thousandths, where 1000 is
+ * the whole share, and it may now carry more digits after a dot: 123.456 means
+ * the same as .123456. Either way at most 9 digits are kept, which is the
+ * resolution weights are held at.
+ *
+ * 1 followed by a point and nothing but zeroes is the one weight read as it
+ * looks rather than as thousandths: 1.0 is the whole share, where a bare 1 is
+ * a thousandth of it.
+ *
+ * A weight may also be written as a percentage, which is what a trailing %
+ * makes it: 50.5% is .505 is 505.
+ */
+static int parseweight(unsigned char * s, unsigned * weight){
+  static const unsigned pow10[10] = {1, 10, 100, 1000, 10000, 100000,
+				     1000000, 10000000, 100000000, 1000000000};
+  unsigned char *p, *end;
+  uint64_t val = 0, res;
+  int ndigits = 0, atpoint = -1, after, percent = 0, fraction;
+
+	if(!s || !*s) return 1;
+	end = s + strlen((char *)s);
+	if(end[-1] == '%'){
+		percent = 1;
+		if(--end == s) return 1;
+	}
+	/* 1.0, with as many zeroes after it as anyone cares to write, is the one
+	   weight read as it looks rather than as thousandths: the whole share,
+	   where a bare 1 is a thousandth of it */
+	if(!percent && s[0] == '1' && s[1] == '.' && s[2]){
+		for(p = s + 2; *p == '0'; p++);
+		if(!*p){
+			*weight = WEIGHTSCALE;
+			return 0;
+		}
+	}
+	fraction = (*s == '.' || *s == '0');
+	for(p = s; p < end; p++){
+		if(*p == '.'){
+			if(atpoint >= 0) return 1;
+			atpoint = ndigits;
+			continue;
+		}
+		if(*p < '0' || *p > '9') return 1;
+		if(ndigits == 18) return 1;
+		val = (val * 10) + (unsigned)(*p - '0');
+		ndigits++;
+	}
+	if(!ndigits || val > WEIGHTSCALE) return 1;
+	after = (atpoint < 0)? 0 : ndigits - atpoint;
+	if(percent){
+		/* a hundredth of the whole share for every 1% */
+		if(after > 7) return 1;
+		res = val * pow10[7 - after];
+	}
+	else if(fraction){
+		/* the digits before the point are the leading zero and add
+		   nothing, so only the ones after it say what the share is */
+		if(atpoint < 0) return val? 1 : (*weight = 0, 0);
+		if(after > 9) return 1;
+		res = val * pow10[9 - after];
+	}
+	else {
+		/* thousandths, with the digits after the point carrying on
+		   from them: three digits of a whole share, six more after */
+		if(after > 6) return 1;
+		res = val * pow10[6 - after];
+	}
+	if(res > WEIGHTSCALE) return 1;
+	*weight = (unsigned)res;
+	return 0;
+}
+
 static int h_parent(int argc, unsigned char **argv){
   struct ace *acl = NULL;
   struct chain *chains;
@@ -797,9 +1019,10 @@ static int h_parent(int argc, unsigned char **argv){
 		return(21);
 	}
 	memset(chains, 0, sizeof(struct chain));
-	chains->weight = (unsigned)atoi((char *)argv[1]);
+	/* 0 is the fallback weight: such a parent is only used once every
-	if(chains->weight == 0 || chains->weight >1000) {
+	   weighted parent of its group has failed */
-		fprintf(stderr, "Chaining error: bad chain weight %u line %d\n", chains->weight, linenum);
+	if(parseweight(argv[1], &chains->weight)) {
+		fprintf(stderr, "Chaining error: bad chain weight %s line %d\n", argv[1], linenum);
 		free(chains);
 		return(3);
 	}
@@ -843,7 +1066,21 @@ static int h_parent(int argc, unsigned char **argv){
 		*cidr = '/';
 		chains->cidr = atoi(cidr + 1);
 	}
-	*SAPORT(&chains->addr) = htons((uint16_t)atoi((char *)argv[4]));
+	if(chains->type == R_EXTPORT || chains->type == R_INTPORT){
+		if(!SAISNULL(&chains->addr)){
+			fprintf(stderr, "Chaining error: chain type (%s) sets a local port range, it requires 0.0.0.0 as address on line %d\n", argv[2], linenum);
+			free(chains->exthost);
+			free(chains);
+			return(4);
+		}
+		if(parserange(argv[4], &chains->range)){
+			fprintf(stderr, "Chaining error: bad port range (%s) on line %d\n", argv[4], linenum);
+			free(chains->exthost);
+			free(chains);
+			return(3);
+		}
+	}
+	else *SAPORT(&chains->addr) = htons((uint16_t)atoi((char *)argv[4]));
 	switch(chains->type){
 	    case R_POP3:
 	    case R_SMTP:
@@ -877,6 +1114,103 @@ static int h_parent(int argc, unsigned char **argv){
 	
 }
 
+#ifdef WITH_HTTPSRV
+/* http <hostname> <url> <operation> [parameters]
+   Rules are matched in the order they are given, first match wins. */
+static int h_http(int argc, unsigned char **argv){
+    struct httprule *rule, *tail;
+    int op;
+
+	/* http OPERATION HOST URL [PARAMETERS] */
+	op = httpopbyname(argv[1]);
+	if(op < 0){
+		fprintf(stderr, "Unknown http operation: %s line %d\n", argv[1], linenum);
+		return(1);
+	}
+
+	rule = malloc(sizeof(struct httprule));
+	if(!rule) return(21);
+	memset(rule, 0, sizeof(struct httprule));
+	rule->op = op;
+	rule->maxage = -1;
+
+	if(parsepattern(&rule->host, argv[2]) || parsepathpattern(&rule->url, argv[3])){
+		fprintf(stderr, "No memory for http rule, line %d\n", linenum);
+		free(rule->host.name);
+		free(rule);
+		return(21);
+	}
+
+	if(argc > 4 && (!strcmp((char *)argv[1], "file") || !strcmp((char *)argv[1], "cache"))){
+		/* PATH [TYPE [MAX-AGE [HEADERS [CODE]]]]. A star, or nothing,
+		   leaves each of them out: the type is worked out from the name,
+		   nothing is said about caching, no headers are added and the
+		   answer is the usual 200. */
+		rule->params = (unsigned char *)strdup((char *)argv[4]);
+		if(argc > 5 && strcmp((char *)argv[5], "*"))
+			rule->ctype = (unsigned char *)strdup((char *)argv[5]);
+		rule->maxage = optnum(argc, argv, 6, -1);
+		if(argc > 7 && strcmp((char *)argv[7], "*"))
+			rule->hdrs = parsehdrs(argv[7]);
+		rule->code = optnum(argc, argv, 8, 0);
+		if(!rule->params
+		   || (argc > 5 && strcmp((char *)argv[5], "*") && !rule->ctype)
+		   || (argc > 7 && strcmp((char *)argv[7], "*") && !rule->hdrs)){
+			freehttprule(rule);
+			return(21);
+		}
+	}
+	else if(!strcmp((char *)argv[1], "reply")){
+		/* CODE [HEADERS], and no body at all. */
+		rule->code = optnum(argc, argv, 4, 200);
+		if(argc > 5 && strcmp((char *)argv[5], "*")){
+			rule->hdrs = parsehdrs(argv[5]);
+			if(!rule->hdrs){
+				freehttprule(rule);
+				return(21);
+			}
+		}
+	}
+	else if(argc > 4){
+		/* What follows the URL belongs to the operation, and an operation
+		   such as redir reads more than one word of it. */
+		int i, len = 0;
+
+		for(i = 4; i < argc; i++) len += (int)strlen((char *)argv[i]) + 1;
+		rule->params = malloc(len);
+		if(rule->params){
+			int at = 0;
+
+			for(i = 4; i < argc; i++)
+				at += sprintf((char *)rule->params + at, "%s%s",
+					i > 4? " " : "", argv[i]);
+		}
+		if(!rule->params){
+			freehttprule(rule);
+			return(21);
+		}
+	}
+
+	if(rule->code && (rule->code < 100 || rule->code > 599)){
+		fprintf(stderr, "Wrong http status: %d line %d\n", rule->code, linenum);
+		freehttprule(rule);
+		return(1);
+	}
+	if(rule->maxage < -1){
+		fprintf(stderr, "Wrong max-age, line %d\n", linenum);
+		freehttprule(rule);
+		return(1);
+	}
+
+	if(!conf.httprules) conf.httprules = rule;
+	else {
+		for(tail = conf.httprules; tail->next; tail = tail->next);
+		tail->next = rule;
+	}
+	return 0;
+}
+#endif
+
 static int h_nolog(int argc, unsigned char **argv){
   struct ace *acl = NULL;
 
@@ -1015,20 +1349,7 @@ struct ace * make_ace (int argc, unsigned char ** argv){
 					return(NULL);
 				}
 				memset(hostnamel, 0, sizeof(struct hostname));
-				hostnamel->matchtype = 3;
+				if(parsepattern(hostnamel, arg)) {
-				pattern = arg;
-				if(pattern[arglen-1] == '*'){
-					arglen --;
-					pattern[arglen] = 0;
-					hostnamel->matchtype ^= MATCHEND;
-				}
-				if(pattern[0] == '*'){
-					pattern++;
-					arglen--;
-					hostnamel->matchtype ^= MATCHBEGIN;
-				}
-				hostnamel->name = (unsigned char *) strdup( (char *)pattern);
-				if(!hostnamel->name) {
 					fprintf(stderr, "No memory for ACL entry, line %d\n", linenum);
 					return(NULL);
 				}
@@ -1274,7 +1595,7 @@ static int h_ace(int argc, unsigned char **argv){
 			return 5;
 		}
 		*SAPORT(&acl->chains->addr) = htons((uint16_t)atoi((char *)argv[2]));
-		acl->chains->weight = 1000;
+		acl->chains->weight = WEIGHTSCALE;
 	case ALLOW:
 	case DENY:
 		if(!conf.acl){
@@ -1375,7 +1696,7 @@ static int h_ace(int argc, unsigned char **argv){
 		tl->ace = acl;
 	
 		if((acl->action == COUNTIN)||(acl->action == COUNTOUT)||(acl->action == COUNTALL)) {
-			unsigned long lim;
+			uint64_t lim = 0;
 
 			tl->comment = ( char *)argv[1];
 			while(isdigit(*tl->comment))tl->comment++;
@@ -1383,9 +1704,9 @@ static int h_ace(int argc, unsigned char **argv){
 			tl->comment = strdup(tl->comment);
 
 			sscanf((char *)argv[1], "%u", &tl->number);
-			sscanf((char *)argv[3], "%lu", &lim);
+			if(sscanf((char *)argv[3], "%"SCNu64"", &lim) != 1) lim = 0;
 			tl->type = getrotate(*argv[2]);
-			tl->traflim64 =  ((uint64_t)lim)*(1024*1024);
+			tl->traflim64 =  lim*(1024*1024);
 			if(!tl->traflim64) {
 				free(tl);
 				freeacl(acl);
@@ -1504,6 +1825,11 @@ static int h_plugin(int argc, unsigned char **argv){
 		return 0;
 	}
 #endif
+#ifdef WITH_TRANSPARENT
+	if(argc >= 3 && !strcmp((char *)argv[2], "transparent_plugin")){
+		return 0;
+	}
+#endif
 #ifdef NOPLUGINS
 	return 999;
 #else
@@ -1596,6 +1922,14 @@ static int h_setgid(int argc, unsigned char **argv){
 }
 
 
+/* What the C library reads on first use from files a chroot hides, read
+   while they can still be found: the time zone, without which every time
+   is UTC. Names looked up through the system cannot be helped this way, the
+   hosts file and resolv.conf are read again for lookups to come. */
+static void prechroot(void){
+	tzset();
+}
+
 static int h_chroot(int argc, unsigned char **argv){
 	uid_t uid = 0;
 	gid_t gid = 0;
@@ -1615,6 +1949,8 @@ static int h_chroot(int argc, unsigned char **argv){
         }
 	if(!chrootp){
 		char *p;
+
+		prechroot();
 		if(chroot((char *)argv[1])) {
 			fprintf(stderr, "Unable to chroot %s", argv[1]);
 			return(1);
@@ -1676,6 +2012,13 @@ int h_server_verify(int argc, unsigned char **argv);
 int h_no_server_verify(int argc, unsigned char **argv);
 int h_client_mode(int argc, unsigned char **argv);
 #endif
+#ifdef WITH_HTTPSRV
+int h_http_content_type(int argc, unsigned char **argv);
+#endif
+#ifdef WITH_TRANSPARENT
+int h_transparent(int argc, unsigned char **argv);
+int h_notransparent(int argc, unsigned char **argv);
+#endif
 #ifdef WITH_PCRE
 int h_pcre(int argc, unsigned char **argv);
 int h_pcre_rewrite(int argc, unsigned char **argv);
@@ -1692,7 +2035,14 @@ struct commands commandhandlers[]={
 	{NULL,  "socks", h_proxy, 1, 0},
 	{NULL,  "tcppm", h_proxy, 4, 0},
 	{NULL,  "udppm", h_proxy, 4, 0},
+#ifdef WITH_HTTPSRV
 	{NULL,  "admin", h_proxy, 1, 0},
+#endif
+#ifdef WITH_HTTPSRV
+	{NULL,  "httpsrv", h_proxy, 1, 0},
+	{NULL,  "http", h_http, 4, 0},
+	{NULL,  "http_content_type", h_http_content_type, 3, 3},
+#endif
 	{NULL,  "dnspr", h_proxy, 1, 0},
 	{NULL,  "internal", h_internal, 2, 2},
 	{NULL, "external", h_external, 2, 2},
@@ -1799,6 +2149,10 @@ struct commands commandhandlers[]={
 	{NULL, "ssl_client_mode", h_client_mode, 1, 2},
 	{NULL, "ssl_certcache", h_certcache, 2, 2},
 #endif
+#ifdef WITH_TRANSPARENT
+	{NULL, "transparent", h_transparent, 1, 2},
+	{NULL, "notransparent", h_notransparent, 1, 1},
+#endif
 #ifdef WITH_PCRE
 	{NULL, "pcre", h_pcre, 4, 0},
 	{NULL, "pcre_rewrite", h_pcre_rewrite, 5, 0},
@@ -1843,6 +2197,21 @@ int parsestr (unsigned char *str, unsigned char **argm, int nitems, unsigned cha
 			argm[argc] = 0;
 			return argc;
 		case '$':
+			/* Two dollars stand for one. That is how a literal dollar is
+			   written where a file to include would otherwise be read, and
+			   the second one is dropped here as a quote character is. */
+			if(str[1] == '$'){
+				str1 = str;
+				do {
+					*str1 = *(str1 + 1);
+				}while(*(str1++));
+				if(space){
+					argm[argc++] = str;
+					if(argc >= nitems) return argc;
+					space = 0;
+				}
+				break;
+			}
 			if(comment){
 				if(space){
 					argm[argc++] = str;
@@ -1925,6 +2294,7 @@ int readconfig(FILE * fp){
 
   if( !(buf = malloc(bufsize)) || ! (argv = malloc((NPARAMS + 1) * sizeof(unsigned char *))) ) {
 		fprintf(stderr, "No memory for configuration");
+		if(buf) free(buf);
 		return(10);
   }
   for (linenum = 1; fgets((char *)buf, STRINGBUF, fp); linenum++){
@@ -1934,45 +2304,41 @@ int readconfig(FILE * fp){
 	argc = parsestr (buf, argv, NPARAMS-1, &buf, &inbuf, &bufsize);
 	if(argc < 1) {
 		fprintf(stderr, "Parse error line %d\n", linenum);
-		return(11);
+		res = 11;
+		goto DONE;
 	}
 	argv[argc] = NULL;
 	if(!strcmp((char *)argv[0], "end") && argc == 1) {	
 		break;
 	}
-	else if(!strcmp((char *)argv[0], "writable") && argc == 1) {	
-		if(!writable){
-			writable = freopen(curconf, "r+", fp);
-			if(!writable){
-				fprintf(stderr, "Unable to reopen config for writing: %s\n", curconf);
-				return 1;
-			}
-		}
-		continue;
-	}
 
 	res = 1;
 	for(cm = commandhandlers; cm; cm = cm->next){
 		if(!strcmp((char *)argv[0], (char *)cm->command)){
 		    if(argc < cm->minargs || (cm->maxargs && argc > cm->maxargs)){
 			fprintf(stderr, "Command: '%s' wrong number of arguments , line %d\n", argv[0], linenum);
-			return(linenum);
+			res = linenum;
+			goto DONE;
 		    }
 		    res = (*cm->handler)(argc, argv);
 		    if(res > 0){
 			fprintf(stderr, "Command: '%s' failed with code %d, line %d\n", argv[0], res, linenum);
-			return(linenum);
+			res = linenum;
+			goto DONE;
 		    }
 		    if(!res) break;
 		}
 	}
 	if(res != 1)continue;
 	fprintf(stderr, "Unknown command: '%s' line %d\n", argv[0], linenum);
-	return(linenum);
+	res = linenum;
+	goto DONE;
   }
+  res = 0;
+DONE:
   free(buf);
   free(argv);
-  return 0;
+  return res;
 
 }
 
@@ -2099,6 +2465,9 @@ int reload (void){
 #endif
 #ifdef WITH_PCRE
 	pcre_install();
+#endif
+#ifdef WITH_TRANSPARENT
+	transparent_install();
 #endif
 	conf.paused++;
 	freeconf(&conf);
@@ -2111,7 +2480,7 @@ int reload (void){
 		if(error) {
 			 freeconf(&conf);
 		}
-		if(!writable)fclose(fp);
+		fclose(fp);
 	}
 	_3proxy_mutex_unlock(&config_mutex);
 	return error;

src/datatypes.c

@@ -391,8 +391,6 @@ static void * ef_ace_next(struct node * node){
 }
 
 
-char * aceaction (int action);
-
 static void * ef_ace_type(struct node * node){
 	return aceaction(((struct ace *)node->value) -> action);
 }
@@ -804,7 +802,7 @@ static struct property prop_pwlist[] = {
 static struct property prop_chain[] = {
 	{"addr", ef_chain_addr, TYPE_SA, "parent address"},
 	{"type", ef_chain_type, TYPE_STRING, "parent type"},
-	{"weight", ef_chain_weight, TYPE_SHORT, "parent weight 0-1000"},
+	{"weight", ef_chain_weight, TYPE_INTEGER, "parent weight, 1000000000 is the whole share, 0 is a fallback"},
 	{"user", ef_chain_user, TYPE_STRING, "parent login"},
 	{"password", ef_chain_password, TYPE_PASSWORD, "parent password"},
 	{"secure", ef_chain_secure, TYPE_INTEGER, "secure mode"},

src/dnspr.c

@@ -45,7 +45,7 @@ void * dnsprchild(struct clientparam* param) {
  memcpy(buf, param->srv->udpbuf, i);
  _3proxy_sem_unlock(udpinit);
  semlocked = 0;
-#ifdef _WIN32
+#if defined(_WIN32) && !defined(SHARE_UDP_SOCKET)
 	if((param->clisock=param->srv->so._socket(param->sostate, AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) {
 		RETURN(818);
 	}
@@ -56,6 +56,8 @@ void * dnsprchild(struct clientparam* param) {
 	}
 
 #else
+	/* The reply has to come from the address the query was sent to, which
+	   is the listening socket. */
 	param->clisock = param->srv->srvsock;
 #endif
 
@@ -149,7 +151,7 @@ void * dnsprchild(struct clientparam* param) {
 	}
 	memset(&param->sinsl, 0, sizeof(param->sinsl));
 	*SAFAMILY(&param->sinsl) = *SAFAMILY(&nservers[0].addr);
-	if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl))) {
+	if(bindwithrange(param, param->remsock, &param->sinsl, param->extport)) {
 		RETURN(819);
 	}
 	param->sinsr = nservers[0].addr;
@@ -217,7 +219,8 @@ CLEANRET:
  }
  if(bbuf)free(bbuf);
  if(host)free(host);
-#ifndef _WIN32
+#if !defined(_WIN32) || defined(SHARE_UDP_SOCKET)
+ /* The socket belongs to the service, so the caller must not close it. */
  param->clisock = INVALID_SOCKET;
 #endif
  return (NULL);

src/ftp.c

@@ -7,6 +7,8 @@
 
 #include "proxy.h"
 
+#ifdef WITH_FTP
+
 /*
  * Read one FTP server response, skipping continuation lines (lines whose
  * 4th character is '-' per RFC 959). Returns the line length on success,
@@ -249,3 +251,5 @@ SOCKET ftpcommand(struct clientparam *param, unsigned char * command, unsigned c
 	}
 	return s;
 }
+
+#endif

src/ftppr.c

@@ -8,6 +8,8 @@
 
 #include "proxy.h"
 
+#ifdef WITH_FTP
+
 #define RETURN(xxx) { param->res = xxx; goto CLEANRET; }
 #define BUFSIZE 2048
 
@@ -21,14 +23,18 @@ void * ftpprchild(struct clientparam* param) {
  SOCKET sc = INVALID_SOCKET, ss = INVALID_SOCKET, clidatasock = INVALID_SOCKET;
  SASIZETYPE sasize;
  char * req = NULL;
+#ifndef _WIN32
  struct linger lg;
+#endif
  struct pollfd fds;
 
  if(!(buf = malloc(BUFSIZE))) RETURN(876);
  param->ctrlsock = param->clisock;
  param->operation = CONNECT;
+#ifndef _WIN32
  lg.l_onoff = 1;
- lg.l_linger = conf.timeouts[STRING_L];;
+ lg.l_linger = conf.timeouts[STRING_L];
+#endif
  if(socksend(param, param->ctrlsock, (unsigned char *)"220 Ready\r\n", 11, conf.timeouts[STRING_S])!=11) {RETURN (801);}
  for(;;){
 	i = sockgetlinebuf(param, CLIENT, buf, BUFSIZE - 10, '\n', conf.timeouts[CONNECTION_S]);
@@ -129,7 +135,7 @@ void * ftpprchild(struct clientparam* param) {
 		if ((clidatasock=socket(SASOCK(&param->sincl), SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {RETURN(821);}
 		if(intbindtodevice(param, clidatasock)){RETURN(822);}
 		*SAPORT(&param->sincl) = 0;
-		if(param->srv->so._bind(param->sostate, clidatasock, (struct sockaddr *)&param->sincl, SASIZE(&param->sincl))){RETURN(822);}
+		if(bindwithrange(param, clidatasock, &param->sincl, param->intport)){RETURN(822);}
 		if (pasv) {
 			if(param->srv->so._listen(param->sostate, clidatasock, 1)) {RETURN(823);}
 			sasize = sizeof(param->sincl);
@@ -260,8 +266,11 @@ void * ftpprchild(struct clientparam* param) {
 		}
 		sc = param->remsock;
 		param->remsock = ss;
+#ifndef _WIN32
+		/* not on Windows, see the accepting side in proxymain.c */
 		param->srv->so._setsockopt(param->sostate, param->remsock, SOL_SOCKET, SO_LINGER, (char *)&lg, sizeof(lg));
 		param->srv->so._setsockopt(param->sostate, clidatasock, SOL_SOCKET, SO_LINGER, (char *)&lg, sizeof(lg));
+#endif
 		param->clisock = clidatasock;
 		res = mapsocket(param, conf.timeouts[CONNECTION_S]);
 		if(param->remsock != INVALID_SOCKET) {
@@ -346,3 +355,16 @@ struct proxydef childdef = {
 };
 #include "proxymain.c"
 #endif
+
+#else
+
+/* Built without FTP support. The service and the redirect naming it are
+   still known, so a configuration carrying them is read rather than
+   refused, and a client reaching one is turned away. */
+void * ftpprchild(struct clientparam * param){
+	param->res = 878;
+	dolog(param, (unsigned char *)"ftp support is not built in");
+	return NULL;
+}
+
+#endif

src/imapp.c

@@ -8,6 +8,8 @@
 
 #include "proxy.h"
 
+#ifdef WITH_IMAPP
+
 #define RETURN(xxx) { param->res = xxx; goto CLEANRET; }
 
 #define CL_LOGINCMD 0
@@ -250,3 +252,15 @@ struct proxydef childdef = {
 };
 #include "proxymain.c"
 #endif
+#else
+
+/* Built without this proxy of its own. The command and the redirect
+   naming it are the STARTTLS proxy speaking that protocol, which
+   negotiates the same way and passes the session on: what "tlspr -Ximap"
+   does, under the name a configuration already uses. */
+void * imappchild(struct clientparam * param){
+	param->starttls = S_IMAPP;
+	return (void *)tlsprchild;
+}
+
+#endif

src/pcre.c

@@ -643,6 +643,71 @@ static struct symbol regexp_symbols[] = {
 };
 
 
+/* Compiling and matching for patterns outside the pcre commands: a host name
+   or a URL in an http rule, an access rule naming a host. They go through the
+   same compile, with whatever pcre_options is set to, so one kind of regular
+   expression is understood everywhere.
+ */
+void * pcre_pattern_compile(const unsigned char *pattern, char *errbuf, int errlen)
+{
+	pcre2_code *re;
+	int errcode;
+	PCRE2_SIZE erroffset;
+
+	re = pcre2_compile((PCRE2_SPTR)pattern, PCRE2_ZERO_TERMINATED, pcre_options,
+		&errcode, &erroffset, NULL);
+	if(!re){
+		if(errbuf && errlen > 0){
+			PCRE2_UCHAR message[256];
+
+			pcre2_get_error_message(errcode, message, sizeof(message));
+			snprintf(errbuf, errlen, "%s at offset %d", (char *)message, (int)erroffset);
+		}
+		return NULL;
+	}
+	return re;
+}
+
+void pcre_pattern_free(void *re)
+{
+	if(re) pcre2_code_free((pcre2_code *)re);
+}
+
+/* Returns the number of captures placed, or 0 when the subject does not
+   match. Element 0 is the whole match. The match data is per call: a rule is
+   matched from several threads at once.
+ */
+int pcre_pattern_match(void *re, const unsigned char *subject, struct capture *caps, int maxcaps)
+{
+	pcre2_match_data *match_data;
+	PCRE2_SIZE *ovector;
+	int count, i, placed = 0;
+
+	if(!re || !subject) return 0;
+	match_data = pcre2_match_data_create_from_pattern((pcre2_code *)re, NULL);
+	if(!match_data) return 0;
+
+	count = pcre2_match((pcre2_code *)re, (PCRE2_SPTR)subject, PCRE2_ZERO_TERMINATED,
+		0, 0, match_data, NULL);
+	if(count > 0){
+		ovector = pcre2_get_ovector_pointer(match_data);
+		if(count > maxcaps) count = maxcaps;
+		for(i = 0; i < count; i++){
+			if(ovector[i*2] == PCRE2_UNSET){
+				caps[i].start = 0;
+				caps[i].len = 0;
+			}
+			else {
+				caps[i].start = (int)ovector[i*2];
+				caps[i].len = (int)(ovector[i*2+1] - ovector[i*2]);
+			}
+		}
+		placed = count;
+	}
+	pcre2_match_data_free(match_data);
+	return placed;
+}
+
 void pcre_install(void){
 
 	struct filter *flt, *tmpflt;

src/plugins.c

@@ -15,7 +15,9 @@ void decodeurl(unsigned char *s, int allowcr);
 int parsestr (unsigned char *str, unsigned char **argm, int nitems, unsigned char ** buff, int *inbuf, int *bufsize);
 struct ace * make_ace (int argc, unsigned char ** argv);
 extern char * proxy_stringtable[];
+#ifdef WITH_HTTPSRV
 extern char * admin_stringtable[];
+#endif
 extern struct schedule * schedule;
 int start_proxy_thread(struct child * chp);
 
@@ -59,7 +61,6 @@ struct symbol symbols[] = {
 	{symbols+34, "socks", (void *) sockschild},
 	{symbols+35, "tcppm", (void *) tcppmchild},
 	{symbols+36, "udppm", (void *) udppmchild},
-	{symbols+37, "admin", (void *) adminchild},
 	{symbols+38, "ftppr", (void *) ftpprchild},
 	{symbols+39, "smtpp", (void *) smtppchild},
 	{symbols+40, "auto", (void *) smtppchild},
@@ -121,7 +122,11 @@ struct pluginlink pluginlink = {
 	proxy_stringtable,
 	&schedule,
 	freeacl,
+#ifdef WITH_HTTPSRV
 	admin_stringtable,
+#else
+	NULL,
+#endif
 	&childdef,
 	start_proxy_thread,
 	freeparam,

src/plugins/TransparentPlugin/CMakeLists.txt

@@ -1,6 +0,0 @@
-# TransparentPlugin
-# Works on Linux (with netfilter), BSD and macOS (without netfilter support)
-
-add_3proxy_plugin(TransparentPlugin
-    SOURCES transparent_plugin.c
-)

src/plugins/TransparentPlugin/Makefile

@@ -1 +0,0 @@
-include Makefile.var

src/plugins/TransparentPlugin/Makefile.inc

@@ -1,10 +0,0 @@
-all: $(BUILDDIR)TransparentPlugin$(DLSUFFICS)
-
-
-
-transparent_plugin$(OBJSUFFICS): transparent_plugin.c
-	$(CC) $(CFLAGS) $(DCFLAGS) transparent_plugin.c
-
-
-$(BUILDDIR)TransparentPlugin$(DLSUFFICS): transparent_plugin$(OBJSUFFICS)
-	$(LN) $(LNOUT)../../$(BUILDDIR)TransparentPlugin$(DLSUFFICS) $(LDFLAGS) $(DLFLAGS) transparent_plugin$(OBJSUFFICS)

src/plugins/TransparentPlugin/transparent_plugin.c

@@ -1,128 +0,0 @@
-/*
-   3APA3A simplest proxy server
-   (c) 2002-2026 by Vladimir Dubrovin <vlad@3proxy.org>
-
-   please read License Agreement
-
-*/
-
-
-#ifdef WITH_NETFILTER
-#include <sys/utsname.h>
-#endif
-#include "../../structures.h"
-#include "../../proxy.h"
-#ifdef WITH_NETFILTER
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <limits.h>
-#include <linux/netfilter_ipv4.h>
-#endif
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-
-static struct pluginlink * pl;
-
-static int transparent_loaded = 0;
-
-static void* transparent_filter_open(void * idata, struct srvparam * param){
-	return idata;
-}
-
-static FILTER_ACTION transparent_filter_client(void *fo, struct clientparam * param, void** fc){
-
-	char addrbuf[64];
-
-#ifdef WITH_NETFILTER
-	socklen_t len;
-
-	len = sizeof(param->req);
-#ifdef SO_ORIGINAL_DST
-
-	if(getsockopt(param->clisock, 
-#ifndef NOIPV6
-#ifdef SOL_IPV6
-		*SAFAMILY(&param->sincr) == AF_INET6?SOL_IPV6:
-#endif
-#endif
-			SOL_IP, SO_ORIGINAL_DST,(struct sockaddr *) &param->req, &len) || !memcmp((char *)SAADDR(&param->req), "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0",  SAADDRLEN(&param->req))){
-		return PASS;
-	}
-#else
-#error No SO_ORIGINAL_DST defined
-       	param->srv->logfunc(param, (unsigned char *)"transparent_plugin: No SO_ORIGINAL_DST defined");
-	return REJECT;
-#endif
-#else
-	if(*SAFAMILY(&param->sincl) == AF_INET || *SAFAMILY(&param->sincl) == AF_INET6){
-	    param->req = param->sincl;
-	    param->sincl = param->srv->intsa;
-	}
-#endif
-	pl->myinet_ntop(*SAFAMILY(&param->req), SAADDR(&param->req), (char *)addrbuf, sizeof(addrbuf));
-	if(param->hostname) pl->freefunc(param->hostname);
-	param->hostname = (unsigned char *)pl->strdupfunc(addrbuf);
-	param->sinsr = param->req;
-	return PASS;
-}
-
-
-static void transparent_filter_clear(void *fo){
-}
-
-static void transparent_filter_close(void *fo){
-}
-
-static struct filter transparent_filter = {
-	NULL,
-	"Transparent filter",
-	"Transparent filter",
-	transparent_filter_open,
-	transparent_filter_client, 
-	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-	transparent_filter_clear, 
-	transparent_filter_close
-};
-
-static int h_transparent(int argc, unsigned char **argv){
-	transparent_filter.filter_open = transparent_filter_open;
-	return 0;
-}
-
-static int h_notransparent(int argc, unsigned char **argv){
-	transparent_filter.filter_open = NULL;
-	return 0;
-}
-
-static struct commands transparent_commandhandlers[] = {
-	{transparent_commandhandlers+1, "transparent", h_transparent, 1, 1},
-	{NULL, "notransparent", h_notransparent, 1, 1}
-};
-
-
-#ifdef WATCOM
-#pragma aux transparent_plugin "*" parm caller [ ] value struct float struct routine [eax] modify [eax ecx edx]
-#undef PLUGINCALL
-#define PLUGINCALL
-#endif
-
-
-PLUGINAPI int PLUGINCALL transparent_plugin (struct pluginlink * pluginlink, 
-					 int argc, char** argv){
-	pl = pluginlink;
-	if(!transparent_loaded){
-		transparent_loaded = 1;
-		transparent_filter.next = pl->conf->filters;
-		pl->conf->filters = &transparent_filter;
-		transparent_commandhandlers[1].next = pl->commandhandlers->next;
-		pl->commandhandlers->next = transparent_commandhandlers;
-	}
-	return 0;
-		
- }
-#ifdef  __cplusplus
-}
-#endif

src/pop3p.c

@@ -8,6 +8,8 @@
 
 #include "proxy.h"
 
+#ifdef WITH_POP3P
+
 #define RETURN(xxx) { param->res = xxx; goto CLEANRET; }
 
 #ifdef WITHMAIN
@@ -88,3 +90,15 @@ struct proxydef childdef = {
 };
 #include "proxymain.c"
 #endif
+#else
+
+/* Built without this proxy of its own. The command and the redirect
+   naming it are the STARTTLS proxy speaking that protocol, which
+   negotiates the same way and passes the session on: what "tlspr -Xpop3"
+   does, under the name a configuration already uses. */
+void * pop3pchild(struct clientparam * param){
+	param->starttls = S_POP3P;
+	return (void *)tlsprchild;
+}
+
+#endif

src/proxy.c

@@ -171,11 +171,45 @@ static int growbuf(unsigned char **buf, int *bufsize, int need){
 	return 0;
 }
 
+/* Whether a request line names the host the previous one did, whatever its
+   method: the connection to the server is kept for the same host only, and
+   a POST after a GET to it is no reason to open another one. */
+static int samehost(const unsigned char *line, int len, const unsigned char *host, int hostlen){
+	const unsigned char *p = (const unsigned char *)memchr(line, ' ', len);
+
+	if(!p || hostlen <= 0) return 0;
+	p++;
+	if(!strncasecmp((const char *)p, "http://", 7)) p += 7;
+	if((int)(p - line) + hostlen >= len || strncasecmp((const char *)p, (const char *)host, hostlen))
+		return 0;
+	return p[hostlen] == '/' || p[hostlen] == ' ';
+}
+
 static void freeptr(void *p){
 	void **pp = (void **)p;
 	if(*pp) { free(*pp); *pp = NULL; }
 }
 
+#ifndef WITHMAIN
+/* Point at the path in a request line and report the authority it names.
+   Returns NULL if the line is not one we can put back together. */
+static unsigned char * reqpath(unsigned char *line, unsigned char **host, int *hostlen)
+{
+	unsigned char *sp, *p;
+
+	*host = NULL;
+	*hostlen = 0;
+	if(!line || !(sp = (unsigned char *)strchr((char *)line, ' '))) return NULL;
+	while(*sp == ' ') sp++;
+	if(*sp == '/') return sp;
+	if(strncasecmp((char *)sp, "http://", 7)) return NULL;
+	*host = p = sp + 7;
+	while(*p && *p != '/' && *p != ' ') p++;
+	*hostlen = (int)(p - *host);
+	return (*p == '/')? p : NULL;
+}
+#endif
+
 static void logurl(struct clientparam * param, char * buf, char * req, int ftp){
  char *sb;
  char *se;
@@ -265,7 +299,7 @@ void * proxychild(struct clientparam* param) {
  int clhdrofs_req = -1;
  int isconnect = 0;
  int redirect = 0;
- int prefix = 0, ckeepalive=0;
+ int prefix = 0, hostofs = 0, ckeepalive=0;
  int ftp = 0;
  int ssoff = 0;
 #ifndef ANONYMOUS
@@ -274,6 +308,7 @@ void * proxychild(struct clientparam* param) {
  int sleeptime = 0;
 #ifndef WITHMAIN
  int reqsize, reqbufsize;
+ unsigned char *origreq = NULL;
 #endif
  int authenticate;
  struct pollfd fds[2];
@@ -333,7 +368,7 @@ for(;;){
  buf[i] = 0;
  
  if(req) {
-	if(!param->transparent && !param->srv->transparent && (i<=prefix || strncasecmp((char *)buf, (char *)req, prefix))){
+	if(!param->transparent && !param->srv->transparent && !samehost(buf, i, req + hostofs, prefix - hostofs)){
 		ckeepalive = 0;
 		if(param->remsock != INVALID_SOCKET){
 			param->srv->so._shutdown(param->sostate, param->remsock, SHUT_RDWR);
@@ -364,10 +399,13 @@ for(;;){
 	if (!strncasecmp((char *)sb, "http://", 7)) {
 		sb += 7;
 	}
+#ifdef WITH_FTP
 	else if (!strncasecmp((char *)sb, "ftp://", 6)) {
+		if(!param->srv->allowftp) RETURN(513);
 		ftp = 1;
 		sb += 6;
 	}
+#endif
 	else if(*sb == '/') {
 		param->transparent = 1;
 	}
@@ -388,6 +426,7 @@ for(;;){
  		*se = 0;
 	}
 	prefix = (int)(se - buf);
+	hostofs = (int)(sb - buf);
 	su = (unsigned char*)strrchr((char *)sb, '@');
 	if(su) {
 		su = (unsigned char *)strdup((char *)sb);
@@ -597,11 +636,51 @@ for(;;){
 
 #ifndef WITHMAIN
 
+ /* Only worth keeping a copy when something can rewrite it. */
+ if(param->nreqfilters) origreq = (unsigned char *)strdup((char *)req);
  action = handlereqfilters(param, &req, &reqbufsize, 0, &reqsize);
  if(action == HANDLED){
+	freeptr(&origreq);
 	RETURN(0);
  }
- if(action != PASS) RETURN(517);
+ if(action != PASS){
+	freeptr(&origreq);
+	RETURN(517);
+ }
+
+ /* Only the copy in req was rewritten. On a direct connection the server is
+    sent the request line held in buf, which was parsed and reduced to its
+    path before the filters ran, so put the new path there as well.
+
+    The destination was chosen, and the access rules applied to it, before
+    the rewrite happened. A rewrite that changes the method or the authority
+    is therefore left alone: acting on it would send the request somewhere
+    the rules never saw. */
+ if(origreq && !isconnect && !ftp && strcmp((char *)req, (char *)origreq)){
+	unsigned char *oldhost, *newhost, *oldpath, *newpath;
+	int oldhostlen, newhostlen, methodlen;
+
+	methodlen = (int)(strchr((char *)origreq, ' ') - (char *)origreq);
+	oldpath = reqpath(origreq, &oldhost, &oldhostlen);
+	newpath = reqpath(req, &newhost, &newhostlen);
+	if(oldpath && newpath
+	   && methodlen > 0 && !strncmp((char *)req, (char *)origreq, methodlen)
+	   && req[methodlen] == ' '
+	   && oldhostlen == newhostlen
+	   && (!oldhostlen || !strncasecmp((char *)oldhost, (char *)newhost, oldhostlen))){
+		int newlen = (int)strlen((char *)newpath);
+		int delta = newlen - ((int)reqlen - ssoff);
+
+		if(ssoff > 0 && (int)reqlen >= ssoff && inbuf + delta < bufsize - 1){
+			memmove(buf + ssoff + newlen, buf + reqlen, inbuf - reqlen + 1);
+			memcpy(buf + ssoff, newpath, newlen);
+			inbuf += delta;
+			reqlen += delta;
+			buf[inbuf] = 0;
+		}
+	}
+ }
+ freeptr(&origreq);
  action = handlehdrfilterscli(param, &buf, &bufsize, 0, &inbuf);
  if(action == HANDLED){
 	RETURN(0);
@@ -651,6 +730,7 @@ for(;;){
 #endif
 
 
+#ifdef WITH_FTP
  if(ftp && param->redirtype != R_HTTP){
 	SOCKET s;
 	int mode = 0;
@@ -902,6 +982,7 @@ for(;;){
 	}
 	RETURN(res);
  }
+#endif
 
  if(isconnect && param->redirtype != R_HTTP) {
 	if(param->redirectfunc) {
@@ -1237,6 +1318,16 @@ REQUESTEND:
 	RETURN(0);
  }
  if(param->transparent && (!ckeepalive || !keepalive)) {RETURN (0);}
+ /* Another service read this request and handed it here to be answered. It
+    keeps the connection and decides what the next request on it is, so this
+    one is done. Whatever was opened towards the server stays open in param
+    for the next one. */
+ if(param->onerequest){
+	/* 2 says the client connection may carry another request, 1 that it may
+	   not, which is what the service holding it needs to know. */
+	param->onerequest = (ckeepalive && keepalive)? 2 : 1;
+	RETURN(0);
+ }
  logurl(param, (char *)buf, (char *)req, ftp);
  param->status = 0;
 
@@ -1282,6 +1373,9 @@ struct proxydef childdef = {
 	S_PROXY,
 	"-a - anonymous proxy\r\n"
 	"-a1 - anonymous proxy with random client IP spoofing\r\n"
+#ifdef WITH_FTP
+	"-Xftp - fetch ftp:// URLs\r\n"
+#endif
 };
 #include "proxymain.c"
 #endif

src/proxy.h

@@ -86,6 +86,10 @@
 #ifndef EINPROGRESS
 #define EINPROGRESS WSAEWOULDBLOCK
 #endif
+#ifdef EADDRINUSE
+#undef EADDRINUSE
+#endif
+#define EADDRINUSE WSAEADDRINUSE
 #define EINTR WSAEWOULDBLOCK
 #define SLEEPTIME 1
 #define usleep Sleep
@@ -152,8 +156,24 @@ void daemonize(void);
 #endif
 #endif
 
+/* A UDP service answers from the address the client sent to, so the reply has
+   to leave the listening socket. Sharing that socket with the request handler
+   is the simple way, and what every Unix build does.
+
+   Older Windows cannot have two operations in flight on one socket, so a
+   build for it binds a second socket to the same address instead, which needs
+   SO_REUSEADDR on the listening socket as well. A build for those versions
+   asks for that with NO_SHARE_UDP_SOCKET, as Makefile.watcom does.
+ */
+#ifndef SHARE_UDP_SOCKET
+#ifndef NO_SHARE_UDP_SOCKET
+#define SHARE_UDP_SOCKET
+#endif
+#endif
+
 #ifndef _WIN32
 size_t threadstacksize(int extra);
+
 #endif
 
 #ifdef WITH_ODBC
@@ -219,6 +239,11 @@ extern struct extparam conf;
 
 extern int timeouts[12];
 
+/* directions sockmap() passes with splice(): -s1, -s2, -s3; with
+   SPLICE_AUTO (-s alone, -s5 to -s7) only when it pays */
+#define SPLICE_DOWNLOAD 1
+#define SPLICE_UPLOAD 2
+#define SPLICE_AUTO 4
 int sockmap(struct clientparam * param, int timeo, int usesplice);
 int udpsockmap(struct clientparam * param, int timeo);
 int udpbind(struct clientparam * param);
@@ -302,13 +327,23 @@ extern _3proxy_sem_t udpinit;
 #define _3proxy_sem_init(x, count, maxcount) (((x) = CreateSemaphore(NULL, (count), (maxcount), NULL))? 0 : 1)
 #define _3proxy_sem_lock(x) WaitForSingleObject(x, INFINITE)
 #define _3proxy_sem_unlock(x) ReleaseSemaphore(x, 1, NULL)
+#define _3proxy_sem_init_timed(x, count, maxcount) _3proxy_sem_init(x, (count), (maxcount))
+#define _3proxy_sem_timedlock(x, ms) (WaitForSingleObject(x, ms) != WAIT_OBJECT_0)
+#define _3proxy_sem_destroy(x) CloseHandle(x)
 #else
-int _3proxy_sem_init_f(_3proxy_sem_t *sem, unsigned count, unsigned maxcount);
+int _3proxy_sem_init_f(_3proxy_sem_t *sem, unsigned count, unsigned maxcount, int timed);
 void _3proxy_sem_lock_f(_3proxy_sem_t *sem);
+int _3proxy_sem_timedlock_f(_3proxy_sem_t *sem, unsigned ms);
 void _3proxy_sem_unlock_f(_3proxy_sem_t *sem);
-#define _3proxy_sem_init(x, count, maxcount) _3proxy_sem_init_f(&x, (count), (maxcount))
+void _3proxy_sem_destroy_f(_3proxy_sem_t *sem);
+#define _3proxy_sem_init(x, count, maxcount) _3proxy_sem_init_f(&x, (count), (maxcount), 0)
+/* for a semaphore waited on with a timeout: the wait is not stretched or cut
+   short by the system time being changed, where the platform allows it */
+#define _3proxy_sem_init_timed(x, count, maxcount) _3proxy_sem_init_f(&x, (count), (maxcount), 1)
 #define _3proxy_sem_lock(x) _3proxy_sem_lock_f(&x)
+#define _3proxy_sem_timedlock(x, ms) _3proxy_sem_timedlock_f(&x, (ms))
 #define _3proxy_sem_unlock(x) _3proxy_sem_unlock_f(&x)
+#define _3proxy_sem_destroy(x) _3proxy_sem_destroy_f(&x)
 #endif
 
 
@@ -339,6 +374,7 @@ int parseusername(char *username, struct clientparam *param, int extpasswd);
 int parseconnusername(char *username, struct clientparam *param, int extpasswd, uint16_t port);
 int ACLmatches(struct ace* acentry, struct clientparam * param);
 int checkACL(struct clientparam * param);
+char * aceaction (int action);
 extern int havelog;
 uint32_t udpresolve(int af, unsigned char * name, unsigned char * value, uint32_t *retttl, struct clientparam* param, int makeauth);
 
@@ -369,9 +405,26 @@ unsigned char * dologname (unsigned char *buf, unsigned char *name, const unsign
 int readconfig(FILE * fp);
 void initcommands(void);
 int connectwithpoll(struct clientparam *param, SOCKET sock, struct sockaddr *sa, SASIZETYPE size, int to);
+int bindwithrange(struct clientparam *param, SOCKET sock, PROXYSOCKADDRTYPE *sa, uint32_t range);
 int bindtodevice(struct sockfuncs *sf, void *state, SOCKET sock, const char *device, int family);
 int extbindtodevice(struct clientparam *param, SOCKET sock);
 int intbindtodevice(struct clientparam *param, SOCKET sock);
+#ifdef WITH_PCRE
+/* One regular expression implementation for the whole program: the pcre
+   commands and every pattern that carries a pcre: prefix. */
+void * pcre_pattern_compile(const unsigned char *pattern, char *errbuf, int errlen);
+void pcre_pattern_free(void *re);
+int pcre_pattern_match(void *re, const unsigned char *subject, struct capture *caps, int maxcaps);
+#endif
+
+int pushbackcli(struct clientparam * param, const unsigned char * data, int len);
+int parsepattern(struct hostname *h, unsigned char *arg);
+int parsepathpattern(struct hostname *h, unsigned char *arg);
+int patternmatchcaps(const struct hostname *h, const unsigned char *str,
+	struct capture *caps, int *ncaps);
+int patternmatch(const struct hostname *h, const unsigned char *str);
+int patternmatchpos(const struct hostname *h, const unsigned char *str, int *start, int *len);
+void applyportranges(struct clientparam * param, struct ace * acentry);
 
 
 uint32_t myrand(void);
@@ -391,7 +444,18 @@ void * sockschild(struct clientparam * param);
 void * tcppmchild(struct clientparam * param);
 void * autochild(struct clientparam * param);
 void * udppmchild(struct clientparam * param);
-void * adminchild(struct clientparam * param);
+#ifdef WITH_HTTPSRV
+int op_admin(struct httpreq *r, const unsigned char *params);
+int op_admin_counters(struct httpreq *r, const unsigned char *params);
+int op_admin_reload(struct httpreq *r, const unsigned char *params);
+int op_admin_services(struct httpreq *r, const unsigned char *params);
+#endif
+#ifdef WITH_HTTPSRV
+void * httpsrvchild(struct clientparam * param);
+int httpopbyname(const unsigned char *name);
+int httpchunk(struct clientparam *param, const char *buf, int len);
+void freehttprules(struct httprule *rule);
+#endif
 void * ftpprchild(struct clientparam * param);
 void * tlsprchild(struct clientparam * param);
 /* Child functions return the child to redirect the request to, or NULL if
@@ -408,6 +472,10 @@ struct dictionary;
 struct node;
 struct property;
 extern _3proxy_mutex_t config_mutex;
+/* services running, and a post each time one of them has finished */
+extern int runningservices;
+extern _3proxy_mutex_t runningservices_mutex;
+extern _3proxy_sem_t serviceexited;
 extern _3proxy_mutex_t bandlim_mutex;
 extern _3proxy_mutex_t connlim_mutex;
 extern _3proxy_mutex_t tc_mutex;
@@ -418,7 +486,7 @@ extern struct datatype datatypes[64];
 extern struct commands commandhandlers[];
 
 #ifdef WITHSPLICE
-#define mapsocket(a,b) ((a->srv->usesplice && !a->ndatfilterssrv && !a->ndatfilterscli)?sockmap(a,b,1):sockmap(a,b,0))
+#define mapsocket(a,b) ((a->srv->usesplice && !a->ndatfilterssrv && !a->ndatfilterscli)?sockmap(a,b,a->srv->usesplice):sockmap(a,b,0))
 #else
 #define mapsocket(a,b) sockmap(a,b, 0)
 #endif
@@ -438,7 +506,8 @@ extern struct socketoptions {
 	int opt;
 	char * optname;
 } sockopts[];
-void setopts(SOCKET s, int opts);
+int getopts(const char *s, struct sockoptset *opts);
+void setopts(SOCKET s, const struct sockoptset *opts);
 char * printopts(char *sep);
 
 #ifdef _WINCE

src/redirect.c

@@ -259,40 +259,137 @@ int clientnegotiate(struct chain * redir, struct clientparam * param, struct soc
 }
 
 
+/* The local port ranges do not depend on the destination, so they can be taken
+ * as soon as a rule matches. UDP ASSOCIATE is authorized before the destination
+ * is known and returns before the chain is walked, which would otherwise leave
+ * the socket the client sends its datagrams to outside the configured range.
+ */
+void applyportranges(struct clientparam * param, struct ace * acentry){
+    struct chain *cur;
+
+	for(cur = acentry->chains; cur; cur = cur->next){
+		if(cur->type == R_EXTPORT) param->extport = cur->range;
+		else if(cur->type == R_INTPORT) param->intport = cur->range;
+	}
+}
+
+static void chainaddr(struct chain * cur, PROXYSOCKADDRTYPE * sa){
+	PROXYSOCKADDRTYPE fresh;
+
+	*sa = cur->addr;
+	if(resolvfunc != myresolver) return;
+	if(!cur->exthost || SAISNULL(&cur->addr)) return;
+#ifdef WITH_UN
+	if(*SAFAMILY(&cur->addr) == AF_UNIX) return;
+#endif
+	if(afdetect(cur->exthost) != -1) return;
+	memset(&fresh, 0, sizeof(fresh));
+	if(!getip46(46, cur->exthost, (struct sockaddr *)&fresh)) return;
+	*SAPORT(&fresh) = *SAPORT(&cur->addr);
+	*sa = fresh;
+}
+
+static int parentfailed(struct clientparam * param, struct chain * ch){
+	int i;
+
+	for(i = 0; i < param->nfailedparents; i++)
+		if(param->failedparents[i] == ch) return 1;
+	return 0;
+}
+
+/* Remember a parent which could not be used for this connection, so that a
+ * retry picks another member of its group. The list is per connection: a
+ * parent which is down for one client is not taken away from the others.
+ */
+static void parentfail(struct clientparam * param, struct chain * ch){
+	if(!ch || param->nfailedparents >= MAXFAILEDPARENTS) return;
+	if(parentfailed(param, ch)) return;
+	param->failedparents[param->nfailedparents++] = ch;
+}
+
+/* Pick the parent to use for one group.
+ *
+ * A group is the members whose weights add up to WEIGHTSCALE, together with
+ * the zero weight members among them. *after is left pointing at the group
+ * after this one, or at NULL. A group which lands within WEIGHTFUZZ of the
+ * whole share counts as a whole one, so that 333 three times over is a group
+ * rather than a group and a remainder of a thousandth.
+ *
+ * A member which already failed for this connection is not offered again and
+ * its weight is given to the others, so a retry goes somewhere else. Zero
+ * weight members are the fallback: they are only offered once every weighted
+ * member of the group has failed, and they never take part in the share.
+ * Where the weights add up to plainly less than the whole share the remainder
+ * keeps its meaning of "no parent at all" and is still counted, so such a
+ * group can still leave the connection direct.
+ *
+ * Returns NULL when the group adds no parent. *exhausted tells the two cases
+ * apart: it is set when the group had parents and all of them are gone, which
+ * is a failure rather than a reason to connect directly.
+ */
+static struct chain * pickchain(struct clientparam * param, struct chain * group,
+				struct chain ** after, int * exhausted){
+	struct chain *cur;
+	uint64_t total = 0, avail = 0, slack;
+	uint64_t r;
+
+	*exhausted = 0;
+	for(cur = group; cur; cur = cur->next){
+		if(total + WEIGHTFUZZ >= WEIGHTSCALE && cur->weight) break;
+		total += cur->weight;
+		if(cur->weight && !parentfailed(param, cur)) avail += cur->weight;
+	}
+	*after = cur;
+
+	if(avail){
+		slack = (total + WEIGHTFUZZ < WEIGHTSCALE)? WEIGHTSCALE - total : 0;
+		r = ((uint64_t)myrand() << 32 | myrand()) % (avail + slack);
+		for(cur = group; cur != *after; cur = cur->next){
+			if(!cur->weight || parentfailed(param, cur)) continue;
+			if(r < cur->weight) return cur;
+			r -= cur->weight;
+		}
+		return NULL;
+	}
+	for(cur = group; cur != *after; cur = cur->next){
+		if(!cur->weight && !parentfailed(param, cur)) return cur;
+	}
+	if(total) *exhausted = 1;
+	return NULL;
+}
+
 int handleredirect(struct clientparam * param, struct ace * acentry){
 	int connected = 0;
-	int weight = 1000;
 	int res;
-	int done = 0;
 	int ha = 0;
 	struct chain * cur;
+	struct chain * after;
 	struct chain * redir = NULL;
-	int r2;
 	int saved = 0;
 
 	if((SAISNULL(&param->req) || !*SAPORT(&param->req)) && param->operation != UDPASSOC) {
 		return 100;
 	}
 
-	r2 = (myrand()%1000);
+	for(cur = acentry->chains; cur; cur = after){
+		struct chain * sel;
+		int exhausted;
 
-	for(cur = acentry->chains; cur; cur=cur->next){
+		sel = pickchain(param, cur, &after, &exhausted);
-		if(((weight = weight - cur->weight) > r2)|| done) {
+		/* every parent of the group is gone: connecting direct instead
-			if(weight <= 0) {
+		   would be a way around the rule, so the request fails */
-				weight += 1000;
+		if(exhausted) return 13;
-				done = 0;
+		if(!sel) continue;
-				r2 = (myrand()%1000);
+		cur = sel;
-			}
+		if(cur->type != R_EXTIP && cur->type != R_HA &&
-			continue;
+		   cur->type != R_EXTPORT && cur->type != R_INTPORT) param->redirected++;
-		}
-		if(cur->type != R_EXTIP && cur->type != R_HA) param->redirected++;
-		done = 1;
-		if(weight <= 0) {
-			weight += 1000;
-			done = 0;
-			r2 = (myrand()%1000);
-		}
 		if(!connected){
+			if(cur->type == R_EXTPORT || cur->type == R_INTPORT){
+				if(cur->type == R_EXTPORT) param->extport = cur->range;
+				else param->intport = cur->range;
+				if(after)continue;
+				return 0;
+			}
 			if(cur->type == R_EXTIP){
 				param->sinsl = cur->addr;
 				if(SAISNULL(&param->sinsl) && (*SAFAMILY(&param->sincr) == AF_INET || *SAFAMILY(&param->sincr) == AF_INET6))param->sinsl = param->sincr;
@@ -312,7 +409,7 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 					}
 				}
 #endif
-				if(cur->next)continue;
+				if(after)continue;
 				return 0;
 			}
 			else if(SAISNULL(&cur->addr) && !*SAPORT(&cur->addr)){
@@ -338,18 +435,18 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 				if(cur->type == R_HA){
 				    ha = 1;
 				}
-				if(cur->next)continue;
+				if(after)continue;
 				if(!ha) return 0;
 				if(param->operation == UDPASSOC) return 0;
 			}
 			else if(!*SAPORT(&cur->addr) && !SAISNULL(&cur->addr)) {
 				uint16_t port = *SAPORT(&param->sinsr);
-				param->sinsr = cur->addr;
+				chainaddr(cur, &param->sinsr);
 				*SAPORT(&param->sinsr) = port;
 			}
 			else if(SAISNULL(&cur->addr) && *SAPORT(&cur->addr)) *SAPORT(&param->sinsr) = *SAPORT(&cur->addr);
 			else {
-				param->sinsr = cur->addr;
+				chainaddr(cur, &param->sinsr);
 			}
 			if(param->operation == UDPASSOC){
 			    SOCKET s;
@@ -360,6 +457,7 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 			    saved = 1;
 			}
 			if((res = alwaysauth(param))){
+				parentfail(param, cur);
 				return (res >= 10)? res : 60+res;
 			}
 			if(ha) {
@@ -379,8 +477,14 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 			}
 		}
 		else {
-			res = (redir)?clientnegotiate(redir, param, (struct sockaddr *)&cur->addr, cur->exthost):0;
+			PROXYSOCKADDRTYPE next;
-			if(res) return res;
+
+			chainaddr(cur, &next);
+			res = (redir)?clientnegotiate(redir, param, (struct sockaddr *)&next, cur->exthost):0;
+			if(res) {
+				parentfail(param, cur);
+				return res;
+			}
 		}
 		redir = cur;
 		param->redirtype = redir->type;
@@ -404,6 +508,7 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 
 	if(!connected || !redir) return 0;
 	res =  clientnegotiate(redir, param, (struct sockaddr *)&param->req, param->hostname);
+	if(res) parentfail(param, redir);
 	if(saved){
 	    SOCKET s;
 

src/sem.c

@@ -0,0 +1,110 @@
+/*
+   3APA3A simplest proxy server
+   (c) 2002-2026 by Vladimir Dubrovin <vlad@3proxy.org>
+
+   please read License Agreement
+
+*/
+
+/* Counting semaphores for POSIX systems, built on a mutex and a condition
+   variable: unnamed POSIX semaphores are not available everywhere (macOS)
+   and have no timed wait there. Windows uses its own semaphores, see proxy.h. */
+
+#include "proxy.h"
+
+#ifndef _WIN32
+/* macOS has CLOCK_MONOTONIC but no pthread_condattr_setclock(); a relative
+   wait is used there instead, which the system time does not affect either */
+#if defined(CLOCK_MONOTONIC) && !defined(__APPLE__)
+#define SEM_MONOTONIC
+#endif
+
+int _3proxy_sem_init_f(_3proxy_sem_t *sem, unsigned count, unsigned maxcount, int timed){
+	int res;
+
+	sem->count = count;
+	sem->maxcount = maxcount;
+	sem->monotonic = 0;
+	if(pthread_mutex_init(&sem->mutex, NULL)) return 1;
+#ifdef SEM_MONOTONIC
+	if(timed){
+		pthread_condattr_t attr;
+
+		if(!pthread_condattr_init(&attr)){
+			if(!pthread_condattr_setclock(&attr, CLOCK_MONOTONIC)) sem->monotonic = 1;
+			res = pthread_cond_init(&sem->cond, &attr);
+			pthread_condattr_destroy(&attr);
+		}
+		else res = pthread_cond_init(&sem->cond, NULL);
+	}
+	else
+#endif
+	res = pthread_cond_init(&sem->cond, NULL);
+	if(res){
+		pthread_mutex_destroy(&sem->mutex);
+		return 1;
+	}
+	return 0;
+}
+
+void _3proxy_sem_lock_f(_3proxy_sem_t *sem){
+	pthread_mutex_lock(&sem->mutex);
+	while(!sem->count) pthread_cond_wait(&sem->cond, &sem->mutex);
+	sem->count--;
+	pthread_mutex_unlock(&sem->mutex);
+}
+
+/* Returns 0 with the semaphore taken, nonzero if ms passed first. */
+int _3proxy_sem_timedlock_f(_3proxy_sem_t *sem, unsigned ms){
+	struct timespec ts;
+	int res = 0;
+
+#ifdef __APPLE__
+	ts.tv_sec = ms / 1000;
+	ts.tv_nsec = (long)(ms % 1000) * 1000000;
+	pthread_mutex_lock(&sem->mutex);
+	while(!sem->count && !res) res = pthread_cond_timedwait_relative_np(&sem->cond, &sem->mutex, &ts);
+#else
+	/* the deadline is on the clock the condition variable was set up with */
+#ifdef SEM_MONOTONIC
+	if(sem->monotonic) clock_gettime(CLOCK_MONOTONIC, &ts);
+	else
+#endif
+	{
+		struct timeval tv;
+
+		gettimeofday(&tv, NULL);
+		ts.tv_sec = tv.tv_sec;
+		ts.tv_nsec = tv.tv_usec * 1000;
+	}
+	ts.tv_sec += ms / 1000;
+	ts.tv_nsec += (long)(ms % 1000) * 1000000;
+	if(ts.tv_nsec >= 1000000000){
+		ts.tv_sec++;
+		ts.tv_nsec -= 1000000000;
+	}
+	pthread_mutex_lock(&sem->mutex);
+	while(!sem->count && !res) res = pthread_cond_timedwait(&sem->cond, &sem->mutex, &ts);
+#endif
+	if(sem->count){
+		sem->count--;
+		res = 0;
+	}
+	pthread_mutex_unlock(&sem->mutex);
+	return res;
+}
+
+void _3proxy_sem_unlock_f(_3proxy_sem_t *sem){
+	pthread_mutex_lock(&sem->mutex);
+	if(sem->count < sem->maxcount){
+		sem->count++;
+		pthread_cond_signal(&sem->cond);
+	}
+	pthread_mutex_unlock(&sem->mutex);
+}
+
+void _3proxy_sem_destroy_f(_3proxy_sem_t *sem){
+	pthread_cond_destroy(&sem->cond);
+	pthread_mutex_destroy(&sem->mutex);
+}
+#endif

src/smtpp.c

@@ -8,6 +8,8 @@
 
 #include "proxy.h"
 
+#ifdef WITH_SMTPP
+
 #define RETURN(xxx) { param->res = xxx; goto CLEANRET; }
 
 #ifdef WITHMAIN
@@ -342,3 +344,15 @@ struct proxydef childdef = {
 };
 #include "proxymain.c"
 #endif
+#else
+
+/* Built without this proxy of its own. The command and the redirect
+   naming it are the STARTTLS proxy speaking that protocol, which
+   negotiates the same way and passes the session on: what "tlspr -Xsmtp"
+   does, under the name a configuration already uses. */
+void * smtppchild(struct clientparam * param){
+	param->starttls = S_SMTPP;
+	return (void *)tlsprchild;
+}
+
+#endif

src/sockgetchar.c

@@ -88,6 +88,35 @@ int sockgetcharcli(struct clientparam * param, int timeosec, int timeousec){
 	return (int)*param->clibuf;
 }
 
+/* Put bytes back in front of whatever the client has not been read yet, so a
+   service which has already taken a request off the socket can hand it to
+   another one, which reads it the way it reads anything else. */
+int pushbackcli(struct clientparam * param, const unsigned char * data, int len){
+	unsigned left = 0;
+	unsigned need;
+
+	if(len <= 0) return 0;
+	if(param->clibuf) left = param->cliinbuf - param->clioffset;
+	need = (unsigned)len + left;
+
+	if(!param->clibuf){
+		if(!(param->clibuf = malloc(need > SRVBUFSIZE? need : SRVBUFSIZE))) return 1;
+		param->clibufsize = need > SRVBUFSIZE? need : SRVBUFSIZE;
+	}
+	else if(param->clibufsize < need){
+		unsigned char *nb = realloc(param->clibuf, need);
+
+		if(!nb) return 1;
+		param->clibuf = nb;
+		param->clibufsize = need;
+	}
+	if(left) memmove(param->clibuf + len, param->clibuf + param->clioffset, left);
+	memcpy(param->clibuf, data, (size_t)len);
+	param->clioffset = 0;
+	param->cliinbuf = need;
+	return 0;
+}
+
 unsigned long sockfillbuffcli(struct clientparam * param, unsigned long size, int timeosec){
 	int len;
 

src/sockmap.c

@@ -39,6 +39,18 @@ ssize_t splice(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, size_t le
 
 #define MAXSPLICE 65536
 
+/* With SPLICE_AUTO, when a direction allowed to splice actually does
+   (without it, an allowed direction always does).
+   A body of known length is spliced if at least SPLICE_MIN of it is left
+   to read once what is already buffered is counted: a smaller one, or one
+   read whole with its headers, is cheaper to copy.
+   A stream of unknown length starts copied and is spliced after
+   SPLICE_STREAK reads in a row of at least SPLICE_MIN each, and goes back to
+   copying after SPLICE_STREAK+1 splices in a row of less than SPLICE_SMALL. */
+#define SPLICE_MIN 16384
+#define SPLICE_SMALL 4096
+#define SPLICE_STREAK 2
+
 #endif
 
 #define MIN(a,b) ((a>b)?b:a)
@@ -49,6 +61,31 @@ ssize_t splice(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, size_t le
    before the sockets are closed. */
 #define SESSIONEND (!halfclose && (CLIENTTERMREAD || SERVERTERMREAD))
 
+/* A hang-up on a socket there is data to write to. With poll() it comes
+   once both sides are shut down, and the write tried then fails, which ends
+   it. WSAPoll reports it as soon as the peer has half-closed, a peer still
+   reading, and keeps reporting it whether the socket has room or not: room
+   is waited for with select() then, up to timeo seconds. Returns whether to
+   try the write. */
+static int hupwrite(SOCKET s, short revents, int timeo){
+#ifdef _WIN32
+	if(!(revents & POLLOUT)){
+		fd_set wfd;
+		struct timeval tv;
+
+		FD_ZERO(&wfd);
+		FD_SET(s, &wfd);
+		tv.tv_sec = timeo;
+		tv.tv_usec = 0;
+		if(select(0, NULL, &wfd, NULL, &tv) < 1) return 0;
+	}
+#endif
+	return 1;
+}
+
+/* usesplice is a mask of the directions passed with splice() rather than
+   through a buffer: SPLICE_DOWNLOAD, server to client, and SPLICE_UPLOAD,
+   client to server. */
 int sockmap(struct clientparam * param, int timeo, int usesplice){
  int halfclose = param->srv->halfclose;
  uint64_t fromclient=0x7fffffffffffffff, fromserver =0x7fffffffffffffff;
@@ -60,6 +97,10 @@ int sockmap(struct clientparam * param, int timeo, int usesplice){
 #endif
  int HASERROR=0;
  int CLIENTTERMREAD = 0, CLIENTTERMWRITE = 0, SERVERTERMREAD = 0, SERVERTERMWRITE = 0;
+ /* the side has hung up: closed by the peer after its own was shut down */
+ int CLIENTHUP = 0, SERVERHUP = 0;
+ /* whether the side's socket is in this round's poll() */
+ int clipolled = 1, srvpolled = 1;
  int after = 0;
  struct pollfd fds[8];
  int fdsc = 0;
@@ -76,16 +117,30 @@ int sockmap(struct clientparam * param, int timeo, int usesplice){
 #ifdef WITHSPLICE
  uint64_t inclientpipe = 0, inserverpipe = 0;
  int TOCLIENTPIPE = 0, FROMCLIENTPIPE = 0, TOSERVERPIPE = 0, FROMSERVERPIPE = 0;
- int pipesrv[2] = {-1,-1};
+ /* The client's data goes through pipecli, the server's through pipesrv.
- int pipecli[2] = {-1,-1};
+    They belong to the connection: made when first needed, kept for the
+    next mapping, closed with the connection. */
+ int *pipecli = param->pipecli, *pipesrv = param->pipesrv;
+ /* allowed to splice (-s), splicing now, and a run of reads counted
+    towards switching; wantbuf: go back to copying once the pipe is empty */
+ int allowcli = 0, allowsrv = 0, splicecli = 0, splicesrv = 0, autosplice;
+ int streakcli = 0, streaksrv = 0, wantbufcli = 0, wantbufsrv = 0;
 
  if((!param->nolongdatfilter && (param->ndatfilterscli > 0 || param->ndatfilterssrv))) usesplice = 0;
- if(usesplice){
+ allowcli = (usesplice & SPLICE_UPLOAD) != 0;
-	TOCLIENTPIPE = FROMCLIENTPIPE = TOSERVERPIPE = FROMSERVERPIPE = 1;
+ allowsrv = (usesplice & SPLICE_DOWNLOAD) != 0;
-	TOCLIENTBUF = TOSERVERBUF = 0;
+ autosplice = (usesplice & SPLICE_AUTO) != 0;
-	if(pipe2(pipecli, O_NONBLOCK) < 0) RETURN (21);
+ if(!autosplice){
-	if(pipe2(pipesrv, O_NONBLOCK) < 0) RETURN (21);
+	splicecli = allowcli;
+	splicesrv = allowsrv;
  }
+ TOCLIENTPIPE = FROMCLIENTPIPE = allowcli;
+ TOSERVERPIPE = FROMSERVERPIPE = allowsrv;
+#else
+#define splicecli 0
+#define splicesrv 0
+#define wantbufcli 0
+#define wantbufsrv 0
 #endif
 
  inserverbuf = param->srvinbuf - param->srvoffset;
@@ -108,17 +163,17 @@ int sockmap(struct clientparam * param, int timeo, int usesplice){
  if(inserverbuf >= fromserver) FROMSERVER = 0;
  if(inclientbuf >= fromclient) FROMCLIENT = 0;
 #ifdef WITHSPLICE
- if(!usesplice)
+ /* a body of known length large enough is spliced from the start */
+ if(autosplice && allowsrv && param->waitserver64 && fromserver > inserverbuf && fromserver - inserverbuf >= SPLICE_MIN) splicesrv = 1;
+ if(autosplice && allowcli && param->waitclient64 && fromclient > inclientbuf && fromclient - inclientbuf >= SPLICE_MIN) splicecli = 1;
 #endif
- {
+ /* a spliced direction needs no buffer, only what was read before */
-	if(fromserver && !param->srvbuf && (!(param->srvbuf=malloc(SRVBUFSIZE)) || !(param->srvbufsize = SRVBUFSIZE))){
+ if(!splicesrv && fromserver && !param->srvbuf && (!(param->srvbuf=malloc(SRVBUFSIZE)) || !(param->srvbufsize = SRVBUFSIZE))){
 	RETURN (21);
  }
-	if(fromclient && !param->clibuf && (!(param->clibuf=malloc(SRVBUFSIZE)) || !(param->clibufsize = SRVBUFSIZE))){
+ if(!splicecli && fromclient && !param->clibuf && (!(param->clibuf=malloc(SRVBUFSIZE)) || !(param->clibufsize = SRVBUFSIZE))){
 	RETURN (21);
  }
-
- }
  if(param->srvinbuf == param->srvoffset) param->srvinbuf =param->srvoffset = 0;
  if(param->cliinbuf == param->clioffset) param->cliinbuf =param->clioffset = 0;
  if(param->clibufsize == param->cliinbuf) TOCLIENTBUF = 0;
@@ -292,8 +347,21 @@ log("done send to client from buf");
 		}
 	}
 #ifdef WITHSPLICE
-	if(usesplice){
+	/* a direction going back to copying does once its pipe is empty */
-		if(inclientpipe && !inclientbuf && FROMCLIENTPIPE && TOSERVER){
+	if(wantbufcli && !inclientpipe){
+		splicecli = wantbufcli = streakcli = 0;
+		if(!param->clibuf && (!(param->clibuf=malloc(SRVBUFSIZE)) || !(param->clibufsize = SRVBUFSIZE))) RETURN (21);
+		if(param->cliinbuf < param->clibufsize) TOCLIENTBUF = 1;
+	}
+	if(wantbufsrv && !inserverpipe){
+		splicesrv = wantbufsrv = streaksrv = 0;
+		if(!param->srvbuf && (!(param->srvbuf=malloc(SRVBUFSIZE)) || !(param->srvbufsize = SRVBUFSIZE))) RETURN (21);
+		if(param->srvinbuf < param->srvbufsize) TOSERVERBUF = 1;
+	}
+	{
+		/* each direction goes through its pipe if spliced, through its
+		   buffer otherwise; what was in the buffer before is sent first */
+		if(splicecli && inclientpipe && !inclientbuf && FROMCLIENTPIPE && TOSERVER){
 #ifdef WITHLOG
 log("send to server from pipe");
 #endif
@@ -330,7 +398,7 @@ log(logbuf);
 				}
 			}
 		}
-		if(inserverpipe && !inserverbuf && FROMSERVERPIPE && TOCLIENT){
+		if(splicesrv && inserverpipe && !inserverbuf && FROMSERVERPIPE && TOCLIENT){
 #ifdef WITHLOG
 log("send to client from pipe");
 #endif
@@ -360,12 +428,17 @@ log(logbuf);
 				}
 			}
 		}
-		if(fromclient>inclientpipe && FROMCLIENT && TOCLIENTPIPE && !SESSIONEND){
+		if(splicecli && !wantbufcli && fromclient>inclientpipe && FROMCLIENT && TOCLIENTPIPE && !SESSIONEND){
-			int error;
-			socklen_t len=sizeof(error);
 #ifdef WITHLOG
 log("read from client to pipe");
 #endif
+			if(pipecli[0] < 0 && pipe2(pipecli, O_NONBLOCK) < 0){
+				/* no pipe to be had: copy instead */
+				allowcli = splicecli = TOCLIENTPIPE = FROMCLIENTPIPE = 0;
+				if(!param->clibuf && (!(param->clibuf=malloc(SRVBUFSIZE)) || !(param->clibufsize = SRVBUFSIZE))) RETURN (21);
+				if(param->cliinbuf < param->clibufsize) TOCLIENTBUF = 1;
+				continue;
+			}
 			errno = 0;
 			res = splice(param->clisock, NULL, pipecli[1], NULL, (int)MIN((uint64_t)MAXSPLICE - inclientpipe, (uint64_t)fromclient-inclientpipe), SPLICE_F_NONBLOCK|SPLICE_F_MOVE);
 #ifdef WITHLOG
@@ -396,19 +469,27 @@ log("done read from client to pipe");
 				graceclinum++;
 				graceclitraf += res;
 				gracesrvnum = gracesrvtraf = 0;
+				if(autosplice && !param->waitclient64){
+					if(res >= SPLICE_SMALL) streakcli = 0;
+					else if(++streakcli > SPLICE_STREAK) wantbufcli = 1;
+				}
 				inclientpipe += res;
 				if(inclientpipe >= MAXSPLICE) TOCLIENTPIPE = 0;
 				needaction = 0;
 				continue;
 			}
 		}
-		if(fromserver > inserverpipe && FROMSERVER && TOSERVERPIPE && !SESSIONEND){
+		if(splicesrv && !wantbufsrv && fromserver > inserverpipe && FROMSERVER && TOSERVERPIPE && !SESSIONEND){
-			int error; 
-			socklen_t len=sizeof(error);
-			errno = 0;
 #ifdef WITHLOG
 log("read from server to pipe\n");
 #endif
+			if(pipesrv[0] < 0 && pipe2(pipesrv, O_NONBLOCK) < 0){
+				allowsrv = splicesrv = TOSERVERPIPE = FROMSERVERPIPE = 0;
+				if(!param->srvbuf && (!(param->srvbuf=malloc(SRVBUFSIZE)) || !(param->srvbufsize = SRVBUFSIZE))) RETURN (21);
+				if(param->srvinbuf < param->srvbufsize) TOSERVERBUF = 1;
+				continue;
+			}
+			errno = 0;
 			res = splice(param->remsock, NULL, pipesrv[1], NULL, MIN(MAXSPLICE - inserverpipe, fromserver - inserverpipe), SPLICE_F_NONBLOCK|SPLICE_F_MOVE);
 #ifdef WITHLOG
 log("server to pipe splice finished\n");
@@ -438,6 +519,10 @@ log("done read from server to pipe\n");
 				gracesrvnum++;
 				gracesrvtraf += res;
 				graceclinum = graceclitraf = 0;
+				if(autosplice && !param->waitserver64){
+					if(res >= SPLICE_SMALL) streaksrv = 0;
+					else if(++streaksrv > SPLICE_STREAK) wantbufsrv = 1;
+				}
 			    	param->nreads++;
 				param->statssrv64 += res;
 				inserverpipe += res;
@@ -452,10 +537,9 @@ log("done read from server to pipe\n");
 			}
 		}
 	}
-	else
 #endif
 	{
-		if(fromclient > inclientbuf && FROMCLIENT && TOCLIENTBUF && !SESSIONEND){
+		if(!splicecli && fromclient > inclientbuf && FROMCLIENT && TOCLIENTBUF && !SESSIONEND){
 #ifdef WITHLOG
 log("read from client to buf");
 #endif
@@ -480,6 +564,17 @@ log("done read from client to buf");
 				graceclinum++;
 				graceclitraf += res;
 				gracesrvnum = gracesrvtraf = 0;
+#ifdef WITHSPLICE
+				if(autosplice && allowcli && !param->waitclient64){
+					if(res < SPLICE_MIN) streakcli = 0;
+					else if(++streakcli >= SPLICE_STREAK){
+						/* a stream: splice from now on, after what is
+						   buffered has been sent */
+						splicecli = TOCLIENTPIPE = FROMCLIENTPIPE = 1;
+						streakcli = 0;
+					}
+				}
+#endif
 				inclientbuf += res;
 				param->cliinbuf += res;
 				if(param->clibufsize == param->cliinbuf) TOCLIENTBUF = 0;
@@ -488,7 +583,7 @@ log("done read from client to buf");
 			}
 		}
 
-		if(fromserver > inserverbuf && FROMSERVER && TOSERVERBUF && !SESSIONEND){
+		if(!splicesrv && fromserver > inserverbuf && FROMSERVER && TOSERVERBUF && !SESSIONEND){
 #ifdef WITHLOG
 log("read from server to buf");
 #endif
@@ -513,6 +608,15 @@ log("done read from server to buf");
 				gracesrvnum++;
 				gracesrvtraf += res;
 				graceclinum = graceclitraf = 0;
+#ifdef WITHSPLICE
+				if(autosplice && allowsrv && !param->waitserver64){
+					if(res < SPLICE_MIN) streaksrv = 0;
+					else if(++streaksrv >= SPLICE_STREAK){
+						splicesrv = TOSERVERPIPE = FROMSERVERPIPE = 1;
+						streaksrv = 0;
+					}
+				}
+#endif
 			    	param->nreads++;
 				param->statssrv64 += res;
 				inserverbuf += res;
@@ -553,15 +657,8 @@ log("done read from server to buf");
 //		if(!CLIENTTERMREAD || !CLIENTTERMWRITE){
 			if(!after){
 				fds[fdsc].fd = param->clisock;
-				if(fromclient && !CLIENTTERMREAD && !FROMCLIENT && !SESSIONEND && ((
+				if(fromclient && !CLIENTTERMREAD && !FROMCLIENT && !SESSIONEND &&
-#ifdef WITHSPLICE
+					((!splicecli && TOCLIENTBUF) || (splicecli && !wantbufcli)))
-					!usesplice &&
-#endif
-					TOCLIENTBUF)
-#ifdef WITHSPLICE
-					|| (usesplice)
-#endif
-						))
 					cli_events |= POLLIN;
 				if(!TOCLIENT && !CLIENTTERMWRITE && (inserverbuf
 #ifdef WITHSPLICE
@@ -569,6 +666,11 @@ log("done read from server to buf");
 #endif
 						))
 					cli_events |= POLLOUT;
+				/* poll() reports a hang-up whatever is asked, and would
+				   return at once every time: the socket is left out then,
+				   rather than given as an invalid one, which WSAPoll takes
+				   for an error */
+				clipolled = cli_events || !CLIENTHUP;
 				if(cli_events){
 					fds[fdsc].fd = param->clisock;
 					fds[fdsc].events = cli_events;
@@ -580,6 +682,8 @@ log("wait writing to client");
 #endif
 				}
 			}
+			else if(!clipolled){
+			}
 			else if(cli_events){
 				if(fds[fdsc].revents &  (POLLERR|POLLNVAL)) {
 					CLIENTTERMREAD = 1;
@@ -601,27 +705,27 @@ log("ready to write to client");
 					}
 					if(fds[fdsc].revents &  (POLLHUP)) {
 						if(fds[fdsc].events & POLLIN) FROMCLIENT = 1;
-						if(fds[fdsc].events & POLLOUT) CLIENTTERMWRITE = 1;
+						if(fds[fdsc].events & POLLOUT){
+							if(hupwrite(param->clisock, fds[fdsc].revents, timeo)) TOCLIENT = 1;
+							else CLIENTTERMWRITE = 1;
 						}
 					}
-			} else if(fds[fdsc].revents & (POLLERR|POLLNVAL|POLLHUP)) {
+				}
+			} else if(fds[fdsc].revents & (POLLERR|POLLNVAL)) {
 				CLIENTTERMREAD = 1;
 				CLIENTTERMWRITE = 1;
+			} else if(fds[fdsc].revents & POLLHUP) {
+				/* what the client sent before it closed is still to be
+				   read, once the buffer has room for it */
+				CLIENTHUP = 1;
 			}
-			fdsc++;
+			if(clipolled) fdsc++;
 
 //		if(!SERVERTERMREAD || !SERVERTERMWRITE){
 			if(!after){
 				fds[fdsc].fd = param->remsock;
-				if(fromserver && !SERVERTERMREAD && !FROMSERVER && !SESSIONEND && ((
+				if(fromserver && !SERVERTERMREAD && !FROMSERVER && !SESSIONEND &&
-#ifdef WITHSPLICE
+					((!splicesrv && TOSERVERBUF) || (splicesrv && !wantbufsrv)))
-					!usesplice &&
-#endif
-					TOSERVERBUF)
-#ifdef WITHSPLICE
-					|| (usesplice)
-#endif
-						))
 					srv_events |= POLLIN;
 				if(!TOSERVER && !SERVERTERMWRITE && (inclientbuf
 #ifdef WITHSPLICE
@@ -629,6 +733,7 @@ log("ready to write to client");
 #endif
 						))
 					srv_events |= POLLOUT;
+				srvpolled = srv_events || !SERVERHUP;
 				if(srv_events){
 					fds[fdsc].fd = param->remsock;
 					fds[fdsc].events = srv_events;
@@ -640,6 +745,8 @@ log("wait writing from server");
 #endif
 				}
 			}
+			else if(!srvpolled){
+			}
 			else if(srv_events){
 				if(fds[fdsc].revents &  (POLLERR|POLLNVAL)) {
 #ifdef WITHLOG
@@ -668,18 +775,24 @@ log("ready to write to server");
 log("server terminated connection");
 #endif
 						if(fds[fdsc].events & POLLIN) FROMSERVER = 1;
-						if(fds[fdsc].events & POLLOUT) SERVERTERMWRITE = 1;
+						if(fds[fdsc].events & POLLOUT){
+							if(hupwrite(param->remsock, fds[fdsc].revents, timeo)) TOSERVER = 1;
+							else SERVERTERMWRITE = 1;
 						}
 					}
-			} else if(fds[fdsc].revents & (POLLERR|POLLNVAL|POLLHUP)) {
+				}
+			} else if(fds[fdsc].revents & (POLLERR|POLLNVAL)) {
 				SERVERTERMREAD = 1;
 				SERVERTERMWRITE = 1;
+			} else if(fds[fdsc].revents & POLLHUP) {
+				/* the rest of the answer may still be waiting to be read */
+				SERVERHUP = 1;
 			}
-			fdsc++;
+			if(srvpolled) fdsc++;
 //		}
 #ifdef WITHSPLICE
-		if(usesplice){
+		{
-			if(fromclient>inclientpipe && !TOCLIENTPIPE && inclientpipe < MAXSPLICE){
+			if(splicecli && fromclient>inclientpipe && !TOCLIENTPIPE && inclientpipe < MAXSPLICE){
 				if(!after){
 #ifdef WITHLOG
 log("wait writing to client pipe");
@@ -700,7 +813,7 @@ log("ready to write to client pipe");
 				}
 				fdsc++;
 			}
-			if(inclientpipe && !FROMCLIENTPIPE){
+			if(splicecli && inclientpipe && !FROMCLIENTPIPE){
 				if(!after){
 #ifdef WITHLOG
 log("wait reading from client pipe");
@@ -719,7 +832,7 @@ log("ready reading from client pipe");
 				}
 				fdsc++;
 			}
-			if(fromserver>inserverpipe && !TOSERVERPIPE && inserverpipe < MAXSPLICE){
+			if(splicesrv && fromserver>inserverpipe && !TOSERVERPIPE && inserverpipe < MAXSPLICE){
 				if(!after){
 #ifdef WITHLOG
 log("wait writing to server pipe");
@@ -738,7 +851,7 @@ log("ready writing to server pipe");
 				}
 				fdsc++;
 			}
-			if(inserverpipe && !FROMSERVERPIPE){
+			if(splicesrv && inserverpipe && !FROMSERVERPIPE){
 				if(!after){
 #ifdef WITHLOG
 log("wait reading from server pipe");
@@ -819,18 +932,29 @@ log("timeout");
  else if(inclientpipe || inserverpipe) res = 94;
 #endif
 
- if((param->nwrites > 0 && !SERVERTERMWRITE) || (param->nreads > 0 && !CLIENTTERMWRITE))
-	usleep(SLEEPTIME * 10);
-
 CLEANRET:
 
 #ifdef WITHSPLICE
- if(pipecli[0] >= 0) close(pipecli[0]);
+ /* empty pipes stay with the connection for its next mapping; one still
- if(pipecli[1] >= 0) close(pipecli[1]);
+    holding data, left by an error or a timeout, cannot be used again */
- if(pipesrv[0] >= 0) close(pipesrv[0]);
+ if(inclientpipe && pipecli[0] >= 0){
- if(pipesrv[1] >= 0) close(pipesrv[1]);
+	close(pipecli[0]);
+	close(pipecli[1]);
+	pipecli[0] = pipecli[1] = -1;
+ }
+ if(inserverpipe && pipesrv[0] >= 0){
+	close(pipesrv[0]);
+	close(pipesrv[1]);
+	pipesrv[0] = pipesrv[1] = -1;
+ }
 #endif
 
  return res;
 }
 #undef SESSIONEND
+#ifndef WITHSPLICE
+#undef splicecli
+#undef splicesrv
+#undef wantbufcli
+#undef wantbufsrv
+#endif

src/socks.c

@@ -184,7 +184,7 @@ void * sockschild(struct clientparam* param) {
 	 param->operation = command == 2?BIND:UDPASSOC;
 	 if(command == 2){
 		if ((param->remsock=param->srv->so._socket(param->sostate, SASOCK(&param->req), SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {RETURN (11);}
-		setopts(param->remsock, param->srv->lissockopts);
+		setopts(param->remsock, &param->srv->lissockopts);
 		if(extbindtodevice(param, param->remsock)) {RETURN (12);}
 	 }
 	 break;
@@ -219,7 +219,10 @@ void * sockschild(struct clientparam* param) {
 	if((res = udpbind(param))) {RETURN(res);}
  }
  else if(command == 2) {
-	if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl))) {
+	if(bindwithrange(param, param->remsock, &param->sinsl, param->extport)) {
+		/* a range has already been searched, retrying on any port would
+		   ignore what was asked for */
+		if(param->extport) RETURN (12);
 		*SAPORT(&param->sinsl) = 0;
 		if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl)))RETURN (12);
 #if SOCKSTRACE > 0
@@ -245,7 +248,8 @@ fflush(stderr);
 		if(intbindtodevice(param, param->clisock)) {RETURN (12);}
 		sin = param->sincl;
 		*SAPORT(&sin) = 0;
-		if(param->srv->so._bind(param->sostate, param->clisock,(struct sockaddr *)&sin,SASIZE(&sin))) {RETURN (12);}
+		/* the port the client is told to send its datagrams to */
+		if(bindwithrange(param, param->clisock, &sin, param->intport)) {RETURN (12);}
 		sasize = SASIZE(&sin);
 		param->srv->so._getsockname(param->sostate, param->clisock, (struct sockaddr *)&sin, &sasize);
 #if SOCKSTRACE > 0
@@ -268,13 +272,18 @@ CLEANRET:
 	int repcode;
 
 	sasize = sizeof(sin);
-	if(command != 3 && param->remsock != INVALID_SOCKET) param->srv->so._getsockname(param->sostate, param->remsock, (struct sockaddr *)&sin,  &sasize);
+	/* CONNECT and BIND report the address of the socket towards the
-	if(command != 3 && !SAISNULL(&param->srv->extNat)){
+	   destination, UDP ASSOCIATE the one the client sends its datagrams
+	   to, as does a request which never got a socket of its own */
+	if(command != 3 && param->remsock != INVALID_SOCKET){
+	    param->srv->so._getsockname(param->sostate, param->remsock, (struct sockaddr *)&sin,  &sasize);
+	    if(!SAISNULL(&param->srv->extNat)){
 		uint16_t port;
 		port = *SAPORT(&sin);
 		sin = param->srv->extNat;
 		*SAPORT(&sin) = port;
 	    }
+	}
 	else {
 	    param->srv->so._getsockname(param->sostate, param->clisock, (struct sockaddr *)&sin,  &sasize);
 	    if(command == 3 && !SAISNULL(&param->srv->intNat)){

src/ssl.c

@@ -779,7 +779,7 @@ static FILTER_ACTION ssl_filter_client(void *fo, struct clientparam * param, voi
 }
 
 static FILTER_ACTION ssl_filter_connect(void *fc, struct clientparam * param){
-	if(PCONF->cli && !client_mode) {
+	if(PCONF->cli && !PCONF->client_mode) {
 	    if(docli(param)) {
 		return REJECT;
 	    }
@@ -788,7 +788,7 @@ static FILTER_ACTION ssl_filter_connect(void *fc, struct clientparam * param){
 }
 
 static FILTER_ACTION ssl_filter_afterauth(void *fc, struct clientparam * param){
-	if(PCONF->cli && client_mode == 1) {
+	if(PCONF->cli && PCONF->client_mode == 1) {
 	    if(docli(param)) {
 		return REJECT;
 	    }
@@ -806,7 +806,7 @@ static FILTER_ACTION ssl_filter_predata(void *fc, struct clientparam * param){
 	    if(!param->redirectfunc) param->redirectfunc = proxyfunc;
 	    return CONTINUE;
 	}
-	else if(PCONF->cli && client_mode == 2) {
+	else if(PCONF->cli && PCONF->client_mode == 2) {
 	    if(docli(param)) {
 		return REJECT;
 	    }
@@ -815,7 +815,7 @@ static FILTER_ACTION ssl_filter_predata(void *fc, struct clientparam * param){
 }
 
 static FILTER_ACTION ssl_parent(struct clientparam * param){
-	if(PCONF->cli && client_mode == 3) {
+	if(PCONF->cli && PCONF->client_mode == 3) {
 	    if(docli(param)) {
 		return REJECT;
 	    }
@@ -867,6 +867,9 @@ static void ssl_filter_close(void *fo){
     free(CONFIG->client_ca_file);
     free(CONFIG->client_ca_dir);
     free(CONFIG->client_ca_store);
+    free(CONFIG->server_ca_file);
+    free(CONFIG->server_ca_dir);
+    free(CONFIG->server_ca_store);
     free(CONFIG->client_sni);
     if(CONFIG->client_alpn_protos.protos_len){
 	free(CONFIG->client_alpn_protos.protos);

src/stringtable.c

@@ -31,8 +31,8 @@ unsigned char * strings[] = {
 /* 18 */	(unsigned char *)"AUTO",
 /* 19 */	(unsigned char *)"TLSPR",
 /* 20 */	(unsigned char *)"IMAPP",
-/* 21 */	(unsigned char *)"ZOMBIE",
+/* 21 */	(unsigned char *)"HTTPSRV",
-/* 22 */	NULL,
+/* 22 */	(unsigned char *)"ZOMBIE",
 /* 23 */	NULL,
 /* 24 */	NULL,
 #ifndef TPROXY_CONF

src/structures.h

@@ -47,6 +47,7 @@ typedef struct _3proxy_sem_s {
 	pthread_cond_t cond;
 	unsigned count;
 	unsigned maxcount;
+	int monotonic;		/* timed waits measured on CLOCK_MONOTONIC */
 } _3proxy_sem_t;
 #else
 #include <winsock2.h>
@@ -62,6 +63,13 @@ typedef struct _3proxy_sem_s {
 #endif
 #endif
 #define MAXBANDLIMS 10
+#define MAXFAILEDPARENTS 16
+/* Parent weights are kept as a share of WEIGHTSCALE, which is what the
+   weights of a group add up to. WEIGHTFUZZ is how far short of it a group may
+   fall and still be taken for a whole one, a thousandth of the share: three
+   weights of 333, or of .333333333, otherwise leave a remainder. */
+#define WEIGHTSCALE 1000000000u
+#define WEIGHTFUZZ 1000000u
 
 #ifdef WITH_POLL
 #include <poll.h>
@@ -216,6 +224,7 @@ typedef enum {
 	S_AUTO,
 	S_TLSPR,
 	S_IMAPP,
+	S_HTTPSRV,
 	S_ZOMBIE
 }PROXYSERVICE;
 
@@ -313,7 +322,9 @@ typedef enum {
 	R_TLS,
 	R_HA,
 	R_DNS,
-	R_IMAP
+	R_IMAP,
+	R_EXTPORT,
+	R_INTPORT
 } REDIRTYPE;
 
 struct redirdesc {
@@ -333,8 +344,10 @@ struct chain {
 	unsigned char * exthost;
 	unsigned char * extuser;
 	unsigned char * extpass;
-	unsigned short weight;
+	unsigned weight;
 	unsigned short cidr;
+	/* local port range for extport/intport, first in the low half */
+	uint32_t range;
 };
 
 struct period {
@@ -345,11 +358,71 @@ struct period {
 
 #define MATCHBEGIN 1
 #define MATCHEND 2
+/* A pattern is either the star form above, matched by matchtype, or a regular
+   expression compiled once when the configuration is read. */
+#define MATCHGLOB  4	/* stars anywhere: * within a path element, ** across */
+#define MATCHREGEX 5
+
+/* What a star or a capturing group stood for. Element 0 is the whole
+   subject, so a template writes it as $0 and the groups as $1 upwards. */
+#define MAXCAPTURES 10
+struct capture {
+	int start;
+	int len;
+};
 
 struct hostname {
 	struct hostname *next;
 	unsigned char * name;
 	int matchtype;
+	void * re;		/* compiled regular expression, MATCHREGEX only */
+};
+
+/* A request handed to an http operation. */
+struct httpreq {
+	struct capture caps[MAXCAPTURES];
+	int ncaps;
+	struct capture hostcaps[MAXCAPTURES];
+	int nhostcaps;
+	const char *ctype;
+	const char *hdrs;
+	int maxage;
+	int code;
+	time_t ims;		/* what If-Modified-Since asked about, or 0 */
+	int version;		/* 0 for HTTP/1.0, 1 for HTTP/1.1 */
+	int keepalive;		/* whether the connection carries another request */
+	int first;		/* the first request on this connection */
+	int chunkedreq;		/* a body this server does not know how to read */
+	int proxy;		/* the client asked the way it asks a proxy */
+	int connect;		/* and asked for a tunnel */
+	int mayproxy;		/* an access rule sent this to the local proxy */
+	unsigned char *raw;	/* the request as it arrived, for handing on */
+	int rawlen, rawsize;
+	int drained;		/* the body has been read and thrown away */
+	char *lasthost;		/* where the last request on this connection went */
+	void *handoff;		/* a child which takes the connection over */
+	struct clientparam *param;
+	char method[16];
+	char path[256];
+	char query[512];
+	char host[256];
+	uint64_t contentlen;
+	int globstart, globlen;
+};
+
+/* One "http" line: which host and url it answers for, which operation serves
+   it and the parameters that operation takes. Patterns use the same syntax and
+   the same matcher as host lists in access rules. */
+struct httprule {
+	struct httprule *next;
+	struct hostname host;
+	struct hostname url;
+	int op;
+	unsigned char *params;
+	unsigned char *ctype;	/* type named by the rule, or NULL to work it out */
+	unsigned char *hdrs;	/* headers the rule adds, already CRLF separated */
+	int maxage;		/* seconds to allow caching for, or -1 to say nothing */
+	int code;		/* status the rule answers with, or 0 for the usual */
 };
 
 struct ace {
@@ -456,6 +529,14 @@ struct filterp {
 
 #define MAX_FILTERS 16
 
+/* Socket options for one kind of socket, -oc and the like: which of
+   sockopts[] are given, by their index there, and the value of each. */
+#define MAXSOCKOPTS 32
+struct sockoptset {
+	unsigned set;
+	int value[MAXSOCKOPTS];
+};
+
 
 struct sockfuncs {
 	void * state;
@@ -540,12 +621,13 @@ struct srvparam {
 	int stacksize;
 	int noforce;
 	int anonymous;
-	int clisockopts, srvsockopts, lissockopts, cbcsockopts, cbssockopts;
+	struct sockoptset clisockopts, srvsockopts, lissockopts, cbcsockopts, cbssockopts;
 	int gracetraf, gracenum, gracedelay;
 	int requirecert;
 	int haproxy;
 	int nostarttls;
 	PROXYSERVICE srvstarttls;
+	int allowftp;		/* the http proxy fetches ftp:// for this service */
 	uint32_t fakeip;
 	unsigned char fakeip6[16];
 #ifdef WITHSPLICE
@@ -562,6 +644,7 @@ struct srvparam {
 #endif
 	PROXYSOCKADDRTYPE extsa;
 	_3proxy_mutex_t counter_mutex;
+	_3proxy_sem_t childslots;	/* maxchild of them, one held by each child */
 	struct pollfd fds;
 	FILE *stdlog;
 	unsigned char * target;
@@ -579,6 +662,9 @@ struct srvparam {
 	struct auth *authenticate;
 	struct pollfd * srvfds;
 	struct ace *acl;
+#ifdef WITH_HTTPSRV
+	struct httprule *httprules;
+#endif
 	struct auth *authfuncs;
 	struct filter *filter;
 	unsigned char * logformat;
@@ -657,6 +743,11 @@ struct clientparam {
 			*clibuf,
 			*srvbuf;
 
+	/* splice() pipes for the client's and the server's data, -1 until
+	   made; kept for the life of the connection */
+	int	pipecli[2],
+		pipesrv[2];
+
 	unsigned 	cliinbuf,
 			srvinbuf,
 			clioffset,
@@ -669,6 +760,7 @@ struct clientparam {
 			maxtrafout64;
 	PROXYSOCKADDRTYPE sincl, sincr;
 	PROXYSOCKADDRTYPE	sinsl, sinsr, req;
+	uint32_t	extport, intport;
 
 	uint64_t	statscli64,
 			statssrv64;
@@ -684,6 +776,21 @@ struct clientparam {
 	int udp_nhops;
 	struct ace *lastace;
 	time_t time_start;
+	/* Set by a service which read a request itself and handed it to another
+	   child to answer: that child answers this one request and returns,
+	   leaving the connection to the service which called it. Added last so
+	   that a plugin built against an older header still finds the fields it
+	   knows where they were. */
+	int onerequest;
+	/* A STARTTLS protocol to speak before the session is wrapped, set for
+	   one connection rather than for the service, which is how a redirect
+	   and a service name standing in for a mail proxy reach tlspr. */
+	PROXYSERVICE starttls;
+	/* Parents which failed for this connection. A retry picks another
+	   member of the group instead of the same one again, and a zero weight
+	   member is only reached once every weighted one is in here. */
+	struct chain *failedparents[MAXFAILEDPARENTS];
+	int nfailedparents;
 };
 
 struct filemon {
@@ -694,9 +801,11 @@ struct filemon {
 
 
 struct extparam {
-	_3proxy_sem_t threadinit;
 	int *timeouts;
 	struct ace * acl;
+#ifdef WITH_HTTPSRV
+	struct httprule *httprules;
+#endif
 	char * conffile;
 	struct bandlim * bandlimiter,  *bandlimiterout;
 	struct connlim * connlimiter;

src/tlspr.c

@@ -334,7 +334,8 @@ void * tlsprchild(struct clientparam* param) {
  int lv=-1;
  char proto[PROTOLEN]="-";
  int snipos = 0;
- PROXYSERVICE stlsproto = param->clientstarttls? param->clientstarttls : param->srv->srvstarttls;
+ PROXYSERVICE stlsproto = param->clientstarttls? param->clientstarttls :
+	(param->starttls? param->starttls : param->srv->srvstarttls);
 
  if(!param->clientstarttls && stlsproto){
     res = clistarttls(param, stlsproto);

src/transparent.c

@@ -0,0 +1,240 @@
+/*
+   3APA3A simplest proxy server
+   (c) 2002-2026 by Vladimir Dubrovin <vlad@3proxy.org>
+
+   please read License Agreement
+
+*/
+
+#include "structures.h"
+#include "proxy.h"
+
+#ifdef WITH_TRANSPARENT
+
+#ifdef WITH_NETFILTER
+#include <sys/utsname.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <limits.h>
+#include <linux/netfilter_ipv4.h>
+#endif
+
+#ifdef WITH_PF
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <net/if.h>
+#include <net/pfvar.h>
+#endif
+
+/* Where the address the client was trying to reach is read from.
+
+   AUTO uses what the platform offers, which is the only thing an
+   installation usually needs. The rest name one mechanism, for a machine
+   that has more than one and redirects with a particular one.
+ */
+#define TRANSPARENT_AUTO	0
+#define TRANSPARENT_NETFILTER	1
+#define TRANSPARENT_PF		2
+#define TRANSPARENT_SOCKET	3
+
+static struct pluginlink * pl;
+
+static int transparent_loaded = 0;
+static int transparent_mode = TRANSPARENT_AUTO;
+
+#ifdef WITH_PF
+static int pf_device = -1;
+
+/* Ask the packet filter what the connection was addressed to before it was
+   redirected. pf keeps that in its state table rather than on the socket,
+   so it has to be looked up with the addresses of both ends.
+ */
+static int transparent_pf(struct clientparam *param)
+{
+	struct pfioc_natlook nl;
+
+	if(pf_device < 0){
+		pf_device = open("/dev/pf", O_RDONLY);
+		if(pf_device < 0) return 1;
+	}
+	memset(&nl, 0, sizeof(nl));
+	nl.proto = IPPROTO_TCP;
+	nl.direction = PF_OUT;
+#ifndef NOIPV6
+	if(*SAFAMILY(&param->sincr) == AF_INET6){
+		nl.af = AF_INET6;
+		memcpy(&nl.saddr.v6, SAADDR(&param->sincr), 16);
+		memcpy(&nl.daddr.v6, SAADDR(&param->sincl), 16);
+	}
+	else
+#endif
+	{
+		nl.af = AF_INET;
+		memcpy(&nl.saddr.v4, SAADDR(&param->sincr), 4);
+		memcpy(&nl.daddr.v4, SAADDR(&param->sincl), 4);
+	}
+	nl.sport = *SAPORT(&param->sincr);
+	nl.dport = *SAPORT(&param->sincl);
+
+	if(ioctl(pf_device, DIOCNATLOOK, &nl)) return 1;
+
+	memset(&param->req, 0, sizeof(param->req));
+	*SAFAMILY(&param->req) = nl.af;
+#ifndef NOIPV6
+	if(nl.af == AF_INET6) memcpy(SAADDR(&param->req), &nl.rdaddr.v6, 16);
+	else
+#endif
+	memcpy(SAADDR(&param->req), &nl.rdaddr.v4, 4);
+	*SAPORT(&param->req) = nl.rdport;
+	return 0;
+}
+#endif
+
+#ifdef WITH_NETFILTER
+/* Linux keeps the original address for the connection it redirected. */
+static int transparent_netfilter(struct clientparam *param)
+{
+	socklen_t len = sizeof(param->req);
+
+#ifdef SO_ORIGINAL_DST
+	if(getsockopt(param->clisock,
+#ifndef NOIPV6
+#ifdef SOL_IPV6
+		*SAFAMILY(&param->sincr) == AF_INET6?SOL_IPV6:
+#endif
+#endif
+			SOL_IP, SO_ORIGINAL_DST, (struct sockaddr *) &param->req, &len)
+	   || !memcmp((char *)SAADDR(&param->req), "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", SAADDRLEN(&param->req))){
+		return 1;
+	}
+	return 0;
+#else
+#error No SO_ORIGINAL_DST defined
+#endif
+}
+#endif
+
+/* Some redirections leave the original address on the socket itself, so the
+   local address of the accepted connection is what the client asked for.
+
+   A connection which was not redirected at all arrives at the address the
+   service listens on, and taking that as the destination would send the
+   service to itself. Refuse instead of making the connection.
+ */
+static int transparent_socket(struct clientparam *param)
+{
+	if(*SAFAMILY(&param->sincl) != AF_INET && *SAFAMILY(&param->sincl) != AF_INET6)
+		return 1;
+	if(*SAPORT(&param->sincl) == *SAPORT(&param->srv->intsa)
+	   && (SAISNULL(&param->srv->intsa)
+	       || !memcmp(SAADDR(&param->sincl), SAADDR(&param->srv->intsa), SAADDRLEN(&param->sincl))))
+		return 2;
+	param->req = param->sincl;
+	param->sincl = param->srv->intsa;
+	return 0;
+}
+
+static void* transparent_filter_open(void * idata, struct srvparam * param){
+	return idata;
+}
+
+static FILTER_ACTION transparent_filter_client(void *fo, struct clientparam * param, void** fc){
+
+	char addrbuf[64];
+	int res = 1;
+
+#ifdef WITH_NETFILTER
+	if(transparent_mode == TRANSPARENT_AUTO || transparent_mode == TRANSPARENT_NETFILTER)
+		res = transparent_netfilter(param);
+#endif
+#ifdef WITH_PF
+	if(res && (transparent_mode == TRANSPARENT_AUTO || transparent_mode == TRANSPARENT_PF))
+		res = transparent_pf(param);
+#endif
+	if(res && (transparent_mode == TRANSPARENT_AUTO || transparent_mode == TRANSPARENT_SOCKET)){
+		res = transparent_socket(param);
+		if(res == 2){
+			param->srv->logfunc(param, (unsigned char *)"transparent: connection was not redirected");
+			return REJECT;
+		}
+	}
+	/* Nothing knows where this was going: leave the request alone, so the
+	   service decides as it would without the command. */
+	if(res) return PASS;
+
+	pl->myinet_ntop(*SAFAMILY(&param->req), SAADDR(&param->req), (char *)addrbuf, sizeof(addrbuf));
+	if(param->hostname) pl->freefunc(param->hostname);
+	param->hostname = (unsigned char *)pl->strdupfunc(addrbuf);
+	param->sinsr = param->req;
+	return PASS;
+}
+
+
+static void transparent_filter_clear(void *fo){
+}
+
+static void transparent_filter_close(void *fo){
+}
+
+static struct filter transparent_filter = {
+	NULL,
+	"Transparent filter",
+	"Transparent filter",
+	transparent_filter_open,
+	transparent_filter_client, 
+	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+	transparent_filter_clear, 
+	transparent_filter_close
+};
+
+int h_transparent(int argc, unsigned char **argv){
+	transparent_mode = TRANSPARENT_AUTO;
+	if(argc > 1){
+		if(!strcmp((char *)argv[1], "auto")) transparent_mode = TRANSPARENT_AUTO;
+		else if(!strcmp((char *)argv[1], "netfilter")){
+#ifndef WITH_NETFILTER
+			fprintf(stderr, "transparent: netfilter is not available in this build\n");
+			return 1;
+#else
+			transparent_mode = TRANSPARENT_NETFILTER;
+#endif
+		}
+		else if(!strcmp((char *)argv[1], "pf")){
+#ifndef WITH_PF
+			fprintf(stderr, "transparent: pf is not available in this build\n");
+			return 1;
+#else
+			transparent_mode = TRANSPARENT_PF;
+#endif
+		}
+		else if(!strcmp((char *)argv[1], "socket")) transparent_mode = TRANSPARENT_SOCKET;
+		else {
+			fprintf(stderr, "transparent: unknown mode %s, expected auto, netfilter, pf or socket\n", argv[1]);
+			return 1;
+		}
+	}
+	transparent_filter.filter_open = transparent_filter_open;
+	return 0;
+}
+
+int h_notransparent(int argc, unsigned char **argv){
+	transparent_filter.filter_open = NULL;
+	return 0;
+}
+
+void transparent_install(void){
+	pl = &pluginlink;
+	/* A reload runs this again: the filter is a single static entry, so it
+	   is only linked in once, and the commands decide whether it acts. */
+	if(!transparent_loaded){
+		transparent_loaded = 1;
+		transparent_filter.next = pl->conf->filters;
+		pl->conf->filters = &transparent_filter;
+	}
+	transparent_filter.filter_open = NULL;
+	transparent_mode = TRANSPARENT_AUTO;
+}
+
+#endif

src/udpsockmap.c

@@ -126,8 +126,12 @@ int udpbind(struct clientparam *param)
 		param->remsock = INVALID_SOCKET;
 		return 12;
 	}
-	if (param->srv->so._bind(param->sostate, param->remsock,
+	if (bindwithrange(param, param->remsock, &param->sinsl, param->extport)) {
-			(struct sockaddr *)&param->sinsl, SASIZE(&param->sinsl))) {
+		if (param->extport) {
+			param->srv->so._closesocket(param->sostate, param->remsock);
+			param->remsock = INVALID_SOCKET;
+			return 12;
+		}
 		*SAPORT(&param->sinsl) = 0;
 		if (param->srv->so._bind(param->sostate, param->remsock,
 				(struct sockaddr *)&param->sinsl, SASIZE(&param->sinsl))) {

src/version.h

@@ -1,14 +1,14 @@
 #ifndef VERSION
-#define VERSION "3proxy-0.9.9.1"
+#define VERSION "3proxy-1.0.1"
 #endif
 #ifndef BUILDDATE
-#define BUILDDATE "261010165717"
+#define BUILDDATE "261010162101"
 #endif
-#define MAJOR3PROXY 0
+#define MAJOR3PROXY 1
-#define SUBMAJOR3PROXY 9
+#define SUBMAJOR3PROXY 0
-#define MINOR3PROXY 9
+#define MINOR3PROXY 1
-#define SUBMINOR3PROXY 1
+#define SUBMINOR3PROXY 0
-#define RELEASE3PROXY "3proxy-0.9.9.1(" BUILDDATE ")\0"
+#define RELEASE3PROXY "3proxy-1.0.1(" BUILDDATE ")\0"
 #ifndef YEAR3PROXY
 #define YEAR3PROXY "2026"
 #endif

src/webadmin.c

@@ -8,11 +8,12 @@
 
 #include "proxy.h"
 
+#ifdef WITH_HTTPSRV
+
 #define RETURN(xxx) { param->res = xxx; goto CLEANRET; }
 
 #define LINESIZE 65536
 
-extern FILE *writable;
 FILE * confopen();
 extern void decodeurl(unsigned char *s, int filter);
 
@@ -24,35 +25,6 @@ struct printparam {
 	struct clientparam *cp;
 };
 
-char * aceaction (int action){
-	switch (action) {
-		case ALLOW:
-		case REDIRECT:
-			return "allow";
-		case DENY:
-			return "deny";
-		case BANDLIM:
-			return "bandlim";
-		case NOBANDLIM:
-			return "nobandlim";
-		case COUNTIN:
-			return "countin";
-		case NOCOUNTIN:
-			return "nocountin";
-		case COUNTOUT:
-			return "countout";
-		case NOCOUNTOUT:
-			return "nocountout";
-		case COUNTALL:
-			return "countall";
-		case NOCOUNTALL:
-			return "nocountall";
-		default:
-			return "unknown";
-	}
-}
-
-
 static void stdpr(struct printparam* pp, char *buf, int inbuf){
 	if((pp->inbuf + inbuf > 1024) || !buf) {
 		socksend(pp->cp, pp->cp->clisock, (unsigned char *)pp->buf, pp->inbuf, conf.timeouts[STRING_S]);
@@ -211,8 +183,7 @@ char * admin_stringtable[]={
 	"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</h2>\r\n"
 	"<A HREF=\'/C'>Counters</A><br>\r\n"
 	"<A HREF=\'/R'>Reload</A><br>\r\n"
-	"<A HREF=\'/S'>Running Services</A><br>\r\n"
+	"<A HREF=\'/S'>Running Services</A>\r\n"
-	"<A HREF=\'/F'>Config</A>\r\n"
 	"</td><td>"
 	"<h2>%s %s configuration</h2>",
 
@@ -367,92 +338,62 @@ static int printiplist(char *buf, int bufsize, struct iplist* ipl, char * delim)
 	return printed;
 }
 
-void * adminchild(struct clientparam* param) {
+/* The admin pages are http operations: the service, request parsing and
- int i, res;
+   authorization belong to httpsrv, and what is left here is the page itself.
- char * buf;
+   A star in the url carries the selector the pages used to read out of the
- char username[256];
+   path, so /C with a star gives D2 or S2 to disable or enable a counter. */
- char *sb;
- char *req = NULL;
- struct printparam pp;
- unsigned contentlen = 0;
- int isform = 0;
- int limited = 0;
 
+static char * admin_open(struct printparam *pp, struct clientparam *param)
+{
+	char *buf;
 
- limited =param->srv->s_option;
+	pp->inbuf = 0;
- pp.inbuf = 0;
+	pp->cp = param;
- pp.cp = param;
 
 	buf = malloc(LINESIZE);
- if(!buf) {RETURN(555);}
+	if(!buf) return NULL;
- i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, LINESIZE - 1, '\n', conf.timeouts[STRING_S]);
+
- if(i<5 || ((buf[0]!='G' || buf[1]!='E' || buf[2]!='T' || buf[3]!=' ' || buf[4]!='/') && 
+	sprintf(buf, ok, conf.stringtable?(char *)conf.stringtable[2]:"3proxy",
-	   (buf[0]!='P' || buf[1]!='O' || buf[2]!='S' || buf[3]!='T' || buf[4]!=' ' || buf[5]!='/')))
+		conf.stringtable?(char *)conf.stringtable[2]:"3[APA3A] tiny proxy",
- {
+		conf.stringtable?(char *)conf.stringtable[3]:"");
-	RETURN(701);
+	printstr(pp, buf);
- }
+	return buf;
- buf[i] = 0;
+}
- sb = strchr(buf+5, ' ');
+
- if(!sb){
+static void admin_close(struct printparam *pp, char *buf)
-	RETURN(702);
+{
- }
+	printstr(pp, tail);
- *sb = 0;
+	printstr(pp, NULL);
- req = strdup(buf + ((*buf == 'P')? 6 : 5));
+	if(buf) free(buf);
- while((i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, LINESIZE - 1, '\n', conf.timeouts[STRING_S])) > 2){
+}
-	buf[i] = 0;
+
-	if(i > 19 && (!strncasecmp(buf, "authorization", 13))){
+int op_admin(struct httpreq *r, const unsigned char *params)
-		sb = strchr(buf, ':');
+{
-		if(!sb)continue;
+	struct printparam pp;
-		++sb;
+	char *buf;
-		while(isspace(*sb))sb++;
+
-		if(!*sb || strncasecmp(sb, "basic", 5)){
+	buf = admin_open(&pp, r->param);
-			continue;
+	if(!buf) return 1;
-		}
+	printstr(&pp, (char *)conf.stringtable[WEBBANNERS]);
-		sb+=5;
+	admin_close(&pp, buf);
-		while(isspace(*sb))sb++;
+	return 0;
-		i = de64((unsigned char *)sb, (unsigned char *)username, 255);
+}
-		if(i<=0)continue;
+
-		username[i] = 0;
+int op_admin_counters(struct httpreq *r, const unsigned char *params)
-		sb = strchr((char *)username, ':');
+{
-		if(sb){
+	struct clientparam *param = r->param;
-			*sb = 0;
+	struct printparam pp;
-			if(param->password)free(param->password);
+	char *buf;
-			param->password = (unsigned char *)strdup(sb+1);
+	const char *sel;
-		}
+	int limited;
-		if(param->username) free(param->username);
+
-		param->username = (unsigned char *)strdup(username);
+	limited = param->srv->s_option;
-		continue;
+	/* In limited mode a counter may be looked at but not switched. */
-	}
+	sel = limited? "" : r->path + r->globstart;
-	else if(i > 15 && (!strncasecmp(buf, "content-length:", 15))){
+
-		sb = buf + 15;
+	buf = admin_open(&pp, param);
-		while(isspace(*sb))sb++;
+	if(!buf) return 1;
-		sscanf(sb, "%u", &contentlen);
+
-		if(contentlen > LINESIZE*1024) contentlen = 0;
-	}
-	else if(i > 13 && (!strncasecmp(buf, "content-type:", 13))){
-		sb = buf + 13;
-		while(isspace(*sb))sb++;
-		if(!strncasecmp(sb, "x-www-form-urlencoded", 21)) isform = 1;
-	}
- }
- param->operation = ADMIN;
- if(isform && contentlen) {
-	printstr(&pp, "HTTP/1.0 100 Continue\r\n\r\n");
-	stdpr(&pp, NULL, 0);
- }
- res = (*param->srv->authfunc)(param);
- if(res && res != 10) {
-	printstr(&pp, authreq);
-	RETURN(res);
- }
- if(limited || param->redirected){
-	if(*req == 'C') req[1] = 0;
-	else *req = 0;
- }
- sprintf(buf, ok, conf.stringtable?(char *)conf.stringtable[2]:"3proxy", conf.stringtable?(char *)conf.stringtable[2]:"3[APA3A] tiny proxy", conf.stringtable?(char *)conf.stringtable[3]:"");
- if(*req != 'S') printstr(&pp, buf);
- switch(*req){
-	case 'C':
 		printstr(&pp, counters);
 		{
 			struct trafcount *cp; 
@@ -463,8 +404,8 @@ void * adminchild(struct clientparam* param) {
 			 if(cp->ace && (limited || param->redirected)){
 				if(!ACLmatches(cp->ace, param))continue;
 			 }
-			 if(req[1] == 'S' && atoi(req+2) == num) cp->disabled=0;
+			 if(sel[0] == 'S' && atoi(sel+1) == num) cp->disabled=0;
-			 if(req[1] == 'D' && atoi(req+2) == num) cp->disabled=1;
+			 if(sel[0] == 'D' && atoi(sel+1) == num) cp->disabled=1;
 			 inbuf += sprintf(buf,	"<tr><td>%s</td><td>", cp->ace?aceaction(cp->ace->action):"-");
 			 if(cp->number || cp->comment)
 				inbuf += sprintf(buf+inbuf, "%d/%s</td>" , cp->number,
@@ -535,85 +476,55 @@ void * adminchild(struct clientparam* param) {
 
 		}
 		printstr(&pp, counterstail);
-		break;
 
-	case 'R':
+	admin_close(&pp, buf);
+	return 0;
+}
+
+int op_admin_reload(struct httpreq *r, const unsigned char *params)
+{
+	struct printparam pp;
+	char *buf;
+
+	buf = admin_open(&pp, r->param);
+	if(!buf) return 1;
+
+	if(r->param->srv->s_option) printstr(&pp, (char *)conf.stringtable[WEBBANNERS]);
+	else {
 		conf.needreload = 1;
 		printstr(&pp, "<h3>Reload scheduled</h3>");
-		break;
-	case 'S':
-		{
-			if(req[1] == 'X'){
-				printstr(&pp, style);
-				break;
 	}
+
+	admin_close(&pp, buf);
+	return 0;
+}
+
+int op_admin_services(struct httpreq *r, const unsigned char *params)
+{
+	struct clientparam *param = r->param;
+	struct printparam pp;
+	char *buf;
+	const char *sel;
+
+	if(param->srv->s_option) return op_admin(r, params);
+
+	sel = r->path + r->globstart;
+
+	/* This page is xml, so it carries its own headers instead of the html
+	   wrapper the other pages share. */
+	pp.inbuf = 0;
+	pp.cp = param;
+	buf = NULL;
+
+	if(sel[0] == 'X') printstr(&pp, style);
+	else {
 		printstr(&pp, xml);
 		printval(conf.services, TYPE_SERVER, 0, &pp);
 		printstr(&pp, postxml);
 	}
-			break;
-	case 'F':
-		{
-			FILE *fp;
-			char buf[256];
-
-			fp = confopen();
-			if(!fp){
-				printstr(&pp, "<h3><font color=\"red\">Failed to open config file</font></h3>");
-				break;
-			}
-				printstr(&pp, "<h3>Please be careful editing config file remotely</h3>");
-				printstr(&pp, "<form method=\"POST\" action=\"/U\" enctype=\"application/x-www-form-urlencoded\"><textarea cols=\"80\" rows=\"30\" name=\"conffile\">");
-				while(fgets(buf, 256, fp)){
-					printstr(&pp, buf);
-				}
-				if(!writable) fclose(fp);
-				printstr(&pp, "</textarea><br><input type=\"Submit\"></form>");
-			break;
-		}
-	case 'U':
-		{
-			unsigned l=0;
-			int error = 0;
-
-			if(!writable || !contentlen || fseek(writable, 0, 0)){
-				error = 1;
-			}
-			while(l < contentlen && (i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, (contentlen - l) > LINESIZE - 1?LINESIZE - 1:contentlen - l, '+', conf.timeouts[STRING_S])) > 0){
-				if((unsigned)i > (contentlen - l)) i = (contentlen - l);
-				if(!l){
-					if(i<9 || strncasecmp(buf, "conffile=", 9)) error = 1;
-				}
-				if(!error){
-					buf[i] = 0;
-					decodeurl((unsigned char *)buf, 1);
-					fprintf(writable, "%s", l? buf : buf + 9);
-				}
-				l += i;
-			}
-			if(writable && !error){
-				fflush(writable);
-#ifndef _WINCE
-				if(ftruncate(fileno(writable), ftell(writable))){}
-#endif
-			}
-			printstr(&pp, error?    "<h3><font color=\"red\">Config file is not writable</font></h3>Make sure you have \"writable\" command in configuration file":
-						"<h3>Configuration updated</h3>");
-
-		}
-		break;
-	default:
-		printstr(&pp, (char *)conf.stringtable[WEBBANNERS]);
-		break;
- }
- if(*req != 'S') printstr(&pp, tail);
-
-CLEANRET:
-
 
 	printstr(&pp, NULL);
- if(buf) free(buf);
+	return 0;
- dolog(param, (unsigned char *)req);
- if(req)free(req);
- return (NULL);
 }
+
+#endif

tests/.gitignore

@@ -0,0 +1,2 @@
+__pycache__/
+*.pyc

tests/README.md

@@ -0,0 +1,165 @@
+# Regression tests
+
+    python3 tests/run.py                     # every case
+    python3 tests/run.py httpsrv             # cases whose name matches
+    python3 tests/run.py --bin build/bin/3proxy
+    python3 tests/run.py -v                  # print every check
+    python3 tests/run.py --keep              # keep the configurations and logs
+
+Python 3.6 or later and a built 3proxy are the only requirements: the suite
+is standard library throughout, so it runs wherever 3proxy builds. The TLS
+case additionally wants `openssl` on PATH to generate its key material, and
+skips itself when that is missing or the build has no TLS support. With no
+`--bin` it looks in `bin/`, then `build/bin/`, then the per-configuration
+directories a multi-configuration CMake generator uses.
+
+The proxy under test is also the origin server the tests talk to: the `http`
+command's `echo` operation reports back how a request arrived - method, path,
+query, host, and the source port it came from - and `data` generates a body
+of a requested size, framing, status and pace. So a case can state what a
+proxy should do to a request and then read off what actually reached the
+other side.
+
+## Adding a case
+
+A case is a module under `cases/` exporting `run(t)`. It writes the
+configurations it needs, starts them, and says what it expects:
+
+```python
+def run(t):
+    srv = t.free_port()
+    t.start("my_case", f"""
+        log
+        auth iponly
+        allow *
+        http * /echo echo
+        httpsrv -p{srv}
+    """, ports=[srv])
+
+    r = t.http(f"http://127.0.0.1:{srv}/echo")
+    t.eq(200, r.status, "the server answers")
+    t.contains(r, "method=GET", "the method is reported")
+```
+
+Servers are stopped for you when the case ends, whether or not it passed.
+
+`t` offers `http()` (direct, through an HTTP proxy, or over a CONNECT
+tunnel), `socks_http()` and `socks_connect()` for SOCKS4 and SOCKS5,
+`socks_udp_associate()`, `raw()` for bytes a real client would never send,
+and `run_config()` for configurations that are meant to be rejected.
+Assertions are `eq`, `ne`, `contains`, `not_contains`, `in_range`,
+`not_in_range`, plus `ok`, `fail` and `skip`. `harness.field()` and
+`int_field()` pull a single line out of an `echo` reply.
+
+For services with no TCP port to connect to, `t.udp_echo()` starts an echo
+server, `t.udp_exchange()` sends a datagram, `t.wait_udp()` waits for a UDP
+service to start answering, `t.socks_udp()` carries one through a SOCKS
+association, and `t.dns_query()` asks a DNS server for an A record.
+
+`t.certs()` generates a CA, a second unrelated CA, and a certificate for
+127.0.0.1, once per run and inside the run's temporary directory, so no key
+material lives in the tree. `t.https()`, `t.tls_proxy_http()` and
+`t.socks_http()` reach a server through TLS, a TLS-wrapped proxy, or SOCKS.
+Log records are written when a connection finishes rather than when the
+reply arrives, so assert on them through `t.wait_output(server, text)`.
+
+Note that access rules accumulate until `flush`, so a service section that
+means to stand on its own should start with one - otherwise an earlier
+`allow *` matches first and the rule under test is never reached.
+
+## What is not covered yet
+
+42 of the 112 configuration commands appear in a test, and the count says
+nothing about service options: the IPv6 case, for instance, exercises -4,
+-6, -46, -64 and -i without adding a command to it. What follows is
+roughly the order worth working through: how much of the product a gap
+covers, and how much of a fixture it needs.
+
+### Traffic limits and accounting
+
+`bandlimin` `bandlimout` `nobandlimin` `nobandlimout` `connlim` `noconnlim`
+`countin` `countout` `countall` and the `no*` forms.
+
+Cheap and worth doing first: `data?size=` and a stopwatch measure a
+bandwidth limit, and the admin counters page already shows what a counter
+holds. `countin` appears in a configuration today but nothing checks that it
+counts. `connlim` needs concurrent connections, held open the way the
+`maxconn` case holds them.
+
+### The mail proxies
+
+`pop3p` `smtpp` `imapp`, and `ftppr`.
+
+The largest gap by volume: four protocol implementations with no coverage at
+all. Each needs a scripted server that speaks enough of the protocol,
+including the multi-line and challenge forms - a POP3 or IMAP server that
+only answers `+OK` will not exercise the interesting paths. Worth the
+fixture: this is also where known parent-chaining trouble lives, since
+`clientnegotiate()` has no case for R_POP3, R_SMTP or R_FTP.
+
+### Access rules and chaining
+
+`redirect` `weight` `parentretries` `force` `noforce` `include` `nolog`.
+
+Also the parts of an ACE never exercised: source addresses and masks, port
+ranges, time and weekday fields, and operation lists beyond the single
+`HTTP_CONNECT` used today. `weight` needs several parents and enough
+requests to see the split.
+
+### IPv6, what is left of it
+
+`tests/cases/ipv6.py` covers listening on `::1`, proxying to and from it,
+SOCKS with an IPv6 destination, rules naming an IPv6 address, and which
+family each of `-4 -6 -46 -64` will use. Still open: `extip` with an IPv6 CIDR, whose
+randomisation path has no coverage.
+
+### Authentication
+
+`authcache` `radius` `authnserver`, and the auth methods beyond `iponly` and
+`strong`: `none`, `nbname`, `dnsname`. `radius` needs a server to answer.
+
+### Plugins
+
+`plugin`. Nothing loads one, though `StringsPlugin`, `TrafficPlugin`,
+`TransparentPlugin` and `FilePlugin` are built in CI. StringsPlugin matters
+most: the admin string table is kept byte-compatible for it deliberately,
+and nothing proves that.
+
+### Logging
+
+`logformat` `rotate` `archiver` `logdump`.
+
+Tests read the log as free text, so a reordered field would pass every check
+here and break every downstream parser. `rotate` and `archiver` need control
+of the clock or a long run.
+
+### TLS options
+
+About 25 `ssl_client_*` and `ssl_server_*` commands: SNI, ALPN, protocol
+versions, cipher lists, `ssl_client_cert` and `ssl_client_key` for mTLS,
+`ssl_*_verify` and `ssl_*_no_verify`. The certificate fixture exists, so
+these are mostly a matter of writing them.
+
+### Process and lifecycle
+
+`daemon` `chroot` `setuid` `setgid` `pidfile` `stacksize` `backlog` `monitor`
+`system` `include` `timeouts` `maxseg` `external` `delimchar`
+`filtermaxsize`. Several need root or change the process in ways a test
+runner has to survive; `include`, `timeouts` and `pidfile` do not, and are
+easy.
+
+Reload is worth a case of its own: the admin page returns "Reload scheduled"
+and nothing checks that the configuration is re-read, that a changed rule
+takes effect, or that services come back.
+
+### DNS
+
+`fakeresolve` `nscache6` `dialer`.
+
+### Known limitations, deliberately not asserted
+
+A request rewrite that changes the method or the authority is ignored, and
+the manual says so; a test that pinned the current behaviour would have to
+change when that does. An intercepted certificate is verified strictly where the build can
+generate the key identifiers, and the case skips that one check on a wolfSSL
+build, which cannot. If wolfSSL gains the ability, the skip should go.

tests/cases/admin.py

@@ -0,0 +1,94 @@
+"""The admin interface, now a set of handlers on the HTTP server."""
+
+import time
+
+
+def run(t):
+    adm = t.free_port()
+    lim = t.free_port()
+    server = t.start("admin", f"""
+        log
+        auth iponly
+        allow *
+        countin 1 D 100 * * *
+        countin 2 D 200 * * *
+        admin -p{adm}
+
+        flush
+        auth iponly
+        allow *
+        admin -p{lim} -s1
+    """, ports=[adm, lim])
+
+    url = f"http://127.0.0.1:{adm}"
+
+    def reload(path):
+        """Ask for a reload and wait for it to be done. It happens on the next
+        tick of the main loop, at most a second later; both old services stop
+        and the new ones start, and a request in between is refused (Windows
+        cannot bind a port still listening) or reset."""
+        before = server.output()
+        accepting = before.count("Accepting connections")
+        exiting = before.count("Exiting thread")
+        reply = t.http(url + path)
+        deadline = time.time() + 10
+        while time.time() < deadline:
+            now = server.output()
+            if (now.count("Accepting connections") >= accepting + 2
+                    and now.count("Exiting thread") >= exiting + 2):
+                break
+            time.sleep(0.05)
+        return reply
+
+    # --- the predefined pages -----------------------------------------
+    t.eq(200, t.http(url + "/").status, "the main page")
+    t.eq(200, t.http(url + "/C").status, "the counters page")
+    t.eq(200, reload("/R").status, "the reload page")
+    t.eq(200, t.http(url + "/S").status, "the services page")
+
+    counters = t.http(url + "/C")
+    t.contains(counters, "countin", "the counters page names the counter type")
+    t.contains(counters, "<tr>", "the counters page renders a table")
+    t.contains(reload("/R"), "Reload", "the reload page confirms the request")
+    t.contains(t.http(url + "/S"), "<", "the services page returns markup")
+    # admin and httpsrv services are of type HTTPSRV, named as such, not as
+    # the zombie a stopped service is
+    services = t.http(url + "/S")
+    t.contains(services, "CDATA[HTTPSRV]", "the services page names the admin service HTTPSRV")
+    t.not_contains(services, "CDATA[ZOMBIE]", "and no running service a zombie")
+
+    # --- the menu no longer offers the removed config editor -----------
+    main = t.http(url + "/")
+    t.contains(main, "HREF='/C'", "the menu links to the counters")
+    t.contains(main, "HREF='/R'", "the menu links to reload")
+    t.contains(main, "HREF='/S'", "the menu links to the services")
+    t.not_contains(main, "HREF='/F'",
+                   "the menu no longer links to the config editor")
+
+    # /F and /U are gone, so they fall through to the catch-all rule
+    t.eq(200, t.http(url + "/F").status, "the removed /F falls through")
+    t.eq(200, t.http(url + "/U").status, "the removed /U falls through")
+    t.contains(t.http(url + "/F"), "configuration", "/F yields the main page")
+
+    # --- counter control through the glob ------------------------------
+    # /C<action><number> is routed by the /C* rule, the action arriving as
+    # the glob
+    t.http(url + "/CD0")
+    t.contains(t.http(url + "/C"), ">NO<", "a counter can be disabled")
+    t.http(url + "/CS0")
+    t.contains(t.http(url + "/C"), ">YES<", "a counter can be enabled again")
+
+    # --- limited mode ---------------------------------------------------
+    limited = f"http://127.0.0.1:{lim}"
+    t.eq(200, t.http(limited + "/").status, "limited mode serves the main page")
+    t.eq(200, t.http(limited + "/C").status, "limited mode serves the counters")
+    t.not_contains(t.http(limited + "/R"), "Reload scheduled",
+                   "limited mode refuses a reload")
+
+    # --- the writable command is gone ------------------------------------
+    output = t.run_config("writable", f"""
+        log
+        writable
+        admin -p{t.free_port()}
+    """)
+    t.contains(output, "Unknown command", "the writable command is rejected")

tests/cases/auto.py

@@ -0,0 +1,74 @@
+"""auto: one port that works out which protocol the client is speaking.
+
+Two origins, because the protocols reach different places: an HTTP or SOCKS
+client names its own destination, while a TLS client names a host in the
+handshake and the service supplies the port.
+"""
+
+
+def run(t):
+    certs = t.certs()
+    plain = t.free_port()
+    port = t.free_port()
+    secure = t.free_port() if certs else None
+
+    tls_origin = ""
+    if certs:
+        tls_origin = f"""
+        flush
+        ssl_server_cert {certs.server}
+        ssl_server_key {certs.server_key}
+        ssl_serv
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{secure}
+        ssl_noserv"""
+
+    ports = [plain, port] + ([secure] if certs else [])
+    server = t.start("auto", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{plain}
+{tls_origin}
+
+        flush
+        nserver 127.0.0.1
+        nscache 1024
+        nsrecord sni.test 127.0.0.1
+        auth iponly
+        allow *
+        auto -p{port}{f' -P{secure}' if certs else ''}
+    """, ports=ports)
+
+    url = f"http://127.0.0.1:{plain}/echo"
+    at = f"127.0.0.1:{port}"
+
+    # --- as an HTTP proxy -------------------------------------------------
+    r = t.http(url, proxy=at)
+    t.eq(200, r.status, "the same port serves an HTTP proxy request")
+    t.contains(r, "path=/echo", "the origin sees it")
+    t.contains(t.http(url, proxy=at, method="POST", body="x=1"), "method=POST",
+               "a POST is recognised as HTTP too")
+
+    # --- as a SOCKS proxy --------------------------------------------------
+    r = t.socks_http(at, url)
+    t.eq(200, r.status, "the same port serves SOCKS5")
+    t.contains(r, "path=/echo", "the origin sees the SOCKS request")
+    t.eq(200, t.socks_http(at, url, socks4=True).status,
+         "and SOCKS4 on the same port")
+
+    # --- as a name-directed TLS proxy --------------------------------------
+    if certs and "Unknown command" not in server.output():
+        r = t.https(f"https://sni.test:{port}/echo", ca=certs.ca, strict=False,
+                    connect_to=("127.0.0.1", port))
+        t.eq(200, r.status, "and a TLS handshake, routed by the name it carries")
+        t.contains(r, "path=/echo", "which reaches the TLS origin")
+    else:
+        t.skip("auto over TLS (no SSL support, or no openssl to make certificates)")
+
+    # --- what it is not ----------------------------------------------------
+    t.not_contains(t.raw(port, "GIBBERISH\r\n\r\n"), "200 OK",
+                   "nonsense is not served as anything")