Widen the port window a test binds in where the kernel does not pick it

bindwithrange() honours a range by setting IP_LOCAL_PORT_RANGE where it
exists, which leaves the kernel to pick a port inside it and skip the ones
still closing. Everywhere else it binds a port out of the range at random,
ten times, and lets the system choose when all ten are taken.

A port which carried a connection cannot be bound again until that close
completes - four minutes of it on Windows - so a window of fifty ports
shared by three services in one configuration can have too few left, and
the connection then binds outside the range and the case fails. The window
is five hundred ports there instead. The Linux one is unchanged: the
kernel picks from it and needs no room to spare.

.github/workflows/build-ipk.yml

@@ -0,0 +1,139 @@
+name: OpenWrt ipk build
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  OPENWRT_RELEASE: 24.10.0
+
+jobs:
+  ipk:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    name: "${{ matrix.arch }}"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: ramips/mt7621
+            arch: mipsel_24kc
+          - target: ath79/generic
+            arch: mips_24kc
+          - target: ipq40xx/generic
+            arch: arm_cortex-a7_neon-vfpv4
+          - target: mediatek/filogic
+            arch: aarch64_cortex-a53
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+
+    - name: env
+      run: echo "RELEASE=$(tr -d ' \t\r\n' < RELEASE)" >> $GITHUB_ENV
+
+    - name: Install build dependencies
+      run: |
+       sudo apt-get update
+       sudo apt-get install -y build-essential libncurses-dev zlib1g-dev gawk git \
+         gettext libssl-dev xsltproc wget unzip python3 rsync file zstd
+
+    - name: Fetch SDK
+      run: |
+       BASE="https://downloads.openwrt.org/releases/$OPENWRT_RELEASE/targets/${{ matrix.target }}"
+       # The SDK file name carries the toolchain flavour, which differs between
+       # targets (musl vs musl_eabi), so take it from the directory listing.
+       NAME=$(curl -fsSL "$BASE/" | grep -oE 'openwrt-sdk-[^"]*\.tar\.zst' | head -1)
+       if [ -z "$NAME" ]; then echo "no SDK for ${{ matrix.target }}"; exit 1; fi
+       echo "fetching $NAME"
+       curl -fsSL "$BASE/$NAME" -o sdk.tar.zst
+       tar --zstd -xf sdk.tar.zst
+       mv "${NAME%.tar.zst}" sdk
+       rm sdk.tar.zst
+
+    - name: Stage the package
+      run: |
+       mkdir -p sdk/package/3proxy sdk/dl
+       cp -a scripts/openwrt/. sdk/package/3proxy/
+       # Build the checkout rather than a published tarball, so the workflow
+       # does not depend on the release archive existing yet.
+       git archive --format=tar.gz --prefix="3proxy-$RELEASE/" -o "sdk/dl/3proxy-$RELEASE.tar.gz" HEAD
+       HASH=$(sha256sum "sdk/dl/3proxy-$RELEASE.tar.gz" | cut -d' ' -f1)
+       sed -i "s|^PKG_VERSION:=.*|PKG_VERSION:=$RELEASE|" sdk/package/3proxy/Makefile
+       sed -i "s|^PKG_HASH:=.*|PKG_HASH:=$HASH|" sdk/package/3proxy/Makefile
+
+    - name: Build
+      run: |
+       cd sdk
+       ./scripts/feeds update base packages
+       ./scripts/feeds install libopenssl libpcre2
+       echo CONFIG_PACKAGE_3proxy=m >> .config
+       make defconfig
+       make package/3proxy/compile -j$(nproc)
+
+    - name: Collect
+      run: |
+       find sdk/bin -name '3proxy_*.ipk' -exec cp {} . \;
+       ls -l *.ipk
+       for f in *.ipk; do echo "$f"; done
+
+    - name: Get artifact ipk
+      uses: actions/upload-artifact@v7
+      with:
+       name: "3proxy-${{ env.RELEASE }}-${{ matrix.arch }}.ipk"
+       path: "*.ipk"
+
+    - name: Import signing key
+      if: github.event_name == 'release'
+      env:
+       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
+       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
+       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
+       gpgconf --kill gpg-agent || true
+       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
+       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
+       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
+       echo prime > /tmp/prime.txt
+       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
+       rm -f /tmp/prime.txt
+
+    - name: Checksums and detached signatures
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       # opkg verifies the signature of a feed index, never of a package file,
+       # so the checksums and their signature are what a manual install can be
+       # checked against.
+       sha256sum *.ipk > SHA256SUMS-openwrt-${{ matrix.arch }}
+       for f in *.ipk SHA256SUMS-openwrt-${{ matrix.arch }}; do
+         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
+             -u "$GPG_KEYID" --armor --detach-sign "$f"
+       done
+       sha256sum -c SHA256SUMS-openwrt-${{ matrix.arch }}
+       gpg --verify SHA256SUMS-openwrt-${{ matrix.arch }}.asc SHA256SUMS-openwrt-${{ matrix.arch }}
+
+    - name: Attest build provenance
+      if: github.event_name == 'release'
+      uses: actions/attest-build-provenance@v4
+      with:
+        subject-path: |
+          *.ipk
+
+    - name: Upload to release
+      if: github.event_name == 'release'
+      env:
+       GH_TOKEN: ${{ github.token }}
+       TAG: ${{ github.event.release.tag_name }}
+      run: |
+       gh release upload "$TAG" *.ipk *.ipk.asc \
+         SHA256SUMS-openwrt-${{ matrix.arch }} SHA256SUMS-openwrt-${{ matrix.arch }}.asc

.github/workflows/build-rpm-arm64.yml

@@ -175,7 +175,7 @@ jobs:
        gpg --verify SHA256SUMS-arm64.asc SHA256SUMS-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.rpm

.github/workflows/build-rpm-armhf.yml

@@ -107,7 +107,7 @@ jobs:
        gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.deb

.github/workflows/build-rpm-x86-64.yml

@@ -176,7 +176,7 @@ jobs:
        gpg --verify SHA256SUMS-x86_64.asc SHA256SUMS-x86_64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.rpm

.github/workflows/build-watcom.yml

@@ -106,7 +106,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-lite
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/build-win32.yml

@@ -121,7 +121,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-x86
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/build-win64.yml

@@ -122,7 +122,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-x64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/build-winarm64.yml

@@ -121,7 +121,7 @@ jobs:
        sha256sum -c SHA256SUMS-win-arm64
     - name: Attest build provenance
       if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@v4
       with:
         subject-path: |
           *.zip

.github/workflows/c-cpp-Linux.yml

@@ -2,9 +2,9 @@ name: C/C++ CI Linux
 
 on:
   push:
-    paths: [ '**.c', '**.h', 'Makefile.Linux', '.github/configs', '.github/workflows/c-cpp-Linux.yml' ]
+    paths: [ '**.c', '**.h', 'Makefile.Linux', 'tests/**', '.github/configs', '.github/workflows/c-cpp-Linux.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "Makefile.Linux", ".github/configs", ".github/workflows/c-cpp-Linux.yml" ]
+    paths: [ "**.c", "**.h", "Makefile.Linux", "tests/**", ".github/configs", ".github/workflows/c-cpp-Linux.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -28,6 +28,8 @@ jobs:
       run: sudo apt-get update && sudo apt-get install -y libssl-dev libpam-dev libpcre2-dev
     - name: make
       run: make -f Makefile.Linux
+    - name: regression tests
+      run: python3 tests/run.py
     - name: mkdir
       run: mkdir ~/3proxy
     - name: make install

.github/workflows/c-cpp-MacOS.yml

@@ -2,9 +2,9 @@ name: C/C++ CI MacOS
 
 on:
   push:
-    paths: [ '**.c', '**.h', 'Makefile.FreeBSD', '.github/configs', '.github/workflows/c-cpp-MacOS.yml' ]
+    paths: [ '**.c', '**.h', 'Makefile.FreeBSD', 'tests/**', '.github/configs', '.github/workflows/c-cpp-MacOS.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "Makefile.FreeBSD", ".github/configs", ".github/workflows/c-cpp-MacOS.yml" ]
+    paths: [ "**.c", "**.h", "Makefile.FreeBSD", "tests/**", ".github/configs", ".github/workflows/c-cpp-MacOS.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -29,5 +29,7 @@ jobs:
       env:
        LDFLAGS: "-L/usr/local/lib -L/opt/homebrew/lib -L/opt/homebrew/opt/openssl/lib"
        CFLAGS: "-I/usr/local/include -I/opt/homebrew/include -I/usr/local/opt/openssl/include -I/opt/homebrew/opt/openssl/include"
+    - name: regression tests
+      run: python3 tests/run.py
     - name: make clean MacOS
       run: make -f Makefile.FreeBSD clean

.github/workflows/c-cpp-Windows.yml

@@ -2,9 +2,9 @@ name: C/C++ CI Windows
 
 on:
   push:
-    paths: [ '**.c', '**.h', 'Makefile.msvc', '.github/configs', '.github/workflows/c-cpp-Windows.yml' ]
+    paths: [ '**.c', '**.h', 'Makefile.msvc', 'tests/**', '.github/configs', '.github/workflows/c-cpp-Windows.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "Makefile.msvc", ".github/configs", ".github/workflows/c-cpp-Windows.yml" ]
+    paths: [ "**.c", "**.h", "Makefile.msvc", "tests/**", ".github/configs", ".github/workflows/c-cpp-Windows.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -27,6 +27,10 @@ jobs:
       env:
        LDFLAGS: '-L "c:/msys64/mingw64/lib"'
        CFLAGS: '-I "c:/msys64/mingw64/include"'
+    - name: regression tests (MinGW)
+      run: |
+       $env:PATH = "c:\msys64\mingw64\bin;$env:PATH"
+       python tests\run.py --bin bin\3proxy.exe
     - name: make clean Windows
       run: make -f Makefile.win clean
     - name: Add msbuild to PATH
@@ -40,4 +44,6 @@ jobs:
        set "LIB=%LIB%;c:/vcpkg/installed/x64-windows-static/lib;c:/vcpkg/installed/x64-windows/lib"
        set "INCLUDE=%INCLUDE%;c:/vcpkg/installed/x64-windows-static/include;c:/vcpkg/installed/x64-windows/include"
        nmake /F Makefile.msvc WOLFSSL=1 || exit /b 1
+       set "PATH=%PATH%;c:/vcpkg/installed/x64-windows/bin"
+       python tests\run.py --bin bin\3proxy.exe || exit /b 1
        nmake /F Makefile.msvc clean

.github/workflows/c-cpp-cmake.yml

@@ -2,9 +2,9 @@ name: C/C++ CI cmake
 
 on:
   push:
-    paths: [ '**.c', '**.h', '**.cmake', 'CMakeLists.txt', '.github/configs', '.github/workflows/c-cpp-cmake.yml' ]
+    paths: [ '**.c', '**.h', '**.cmake', 'CMakeLists.txt', 'tests/**', '.github/configs', '.github/workflows/c-cpp-cmake.yml' ]
   pull_request:
-    paths: [ "**.c", "**.h", "**.cmake", "CMakeLists.txt", ".github/configs", ".github/workflows/c-cpp-cmake.yml" ]
+    paths: [ "**.c", "**.h", "**.cmake", "CMakeLists.txt", "tests/**", ".github/configs", ".github/workflows/c-cpp-cmake.yml" ]
   workflow_dispatch:
 
 permissions:
@@ -43,7 +43,9 @@ jobs:
        cmake --build .
        mkdir ~/3proxy
        DESTDIR=~/3proxy cmake --install .
-       cd .. && rm -rf build/
+       cd ..
+       python3 tests/run.py --bin build/bin/3proxy
+       rm -rf build/
     - name: make with CMake Win
       if: ${{ startsWith(matrix.target, 'windows') }}
       shell: cmd
@@ -56,6 +58,8 @@ jobs:
        dir
        cmake --build .
        cd ..
+       set "PATH=%PATH%;c:/vcpkg/installed/x64-windows/bin"
+       python tests\run.py || exit /b 1
        rmdir /s /q build
 
   wolfssl:
@@ -71,4 +75,6 @@ jobs:
        cd build
        cmake ..
        cmake --build .
-       cd .. && rm -rf build/
+       cd ..
+       python3 tests/run.py --bin build/bin/3proxy
+       rm -rf build/

.github/workflows/docker.yml

@@ -103,7 +103,7 @@ jobs:
             floating: minimal
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: /tmp/digests
           pattern: digests-${{ matrix.image }}-*
@@ -171,14 +171,14 @@ jobs:
           echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
 
       - name: Attest Docker Hub image
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.DOCKERHUB_IMAGE }}
           subject-digest: ${{ steps.digest.outputs.digest }}
           push-to-registry: false
 
       - name: Attest GHCR image
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.GHCR_IMAGE }}
           subject-digest: ${{ steps.digest.outputs.digest }}

.github/workflows/update-docs.yml

@@ -2,6 +2,7 @@ name: Update HTML documentation
 
 on:
   push:
+    branches: [master]
     paths:
       - 'man/**'
   workflow_dispatch:

.github/workflows/update-version.yml

@@ -4,6 +4,7 @@ on:
   push:
     paths:
       - RELEASE
+      - DEVEL
   workflow_dispatch:
 
 permissions:
@@ -19,12 +20,23 @@ jobs:
 
     - name: Regenerate version files
       run: |
-       RELEASE=$(tr -d ' \t\r\n' < RELEASE)
-       if [ -z "$RELEASE" ]; then echo "RELEASE is empty"; exit 1; fi
-       MAJOR=$(echo "$RELEASE" | cut -d . -f 1)
-       SUBMAJOR=$(echo "$RELEASE" | cut -d . -f 2)
-       MINOR=$(echo "$RELEASE" | cut -d . -f 3)
-       SUBMINOR=$(echo "$RELEASE" | cut -d . -f 4)
+       # A release branch carries RELEASE, a development branch DEVEL, whose
+       # version may have a suffix such as 2.0.0-devel.
+       if [ -f RELEASE ]; then VERFILE=RELEASE
+       elif [ -f DEVEL ]; then VERFILE=DEVEL
+       else echo "neither RELEASE nor DEVEL is present"; exit 1
+       fi
+       RELEASE=$(tr -d ' \t\r\n' < "$VERFILE")
+       if [ -z "$RELEASE" ]; then echo "$VERFILE is empty"; exit 1; fi
+       
+       # the numbered fields take the numeric part, the strings keep all of it
+       NUMBERS=${RELEASE%%[!0-9.]*}
+       NUMBERS=${NUMBERS%.}
+       if [ -z "$NUMBERS" ]; then echo "no version number in '$RELEASE'"; exit 1; fi
+       MAJOR=$(echo "$NUMBERS" | cut -d . -f 1)
+       SUBMAJOR=$(echo "$NUMBERS" | cut -d . -f 2)
+       MINOR=$(echo "$NUMBERS" | cut -d . -f 3)
+       SUBMINOR=$(echo "$NUMBERS" | cut -d . -f 4)
        [ -n "$SUBMAJOR" ] || SUBMAJOR=0
        [ -n "$MINOR" ] || MINOR=0
        [ -n "$SUBMINOR" ] || SUBMINOR=0
@@ -39,7 +51,10 @@ jobs:
        else
          BUILDDATE=$(date -u +%y%m%d%H%M%S)
        fi
-       echo "release $RELEASE -> $MAJOR $SUBMAJOR $MINOR $SUBMINOR, build date $BUILDDATE"
+       # rpm refuses a hyphen in Version, so a suffix becomes a tilde, which
+       # also sorts before the release of the same number
+       RPMVERSION=$(echo "$RELEASE" | tr '-' '~')
+       echo "$VERFILE $RELEASE -> $MAJOR $SUBMAJOR $MINOR $SUBMINOR, rpm $RPMVERSION, build date $BUILDDATE"
        SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
        YEAR=$(date -u -d @$SOURCE_DATE_EPOCH +%Y)
 
@@ -59,7 +74,7 @@ jobs:
 
        mv scripts/rh/3proxy.spec scripts/rh/3proxy.spec.old
        { echo "Name:           3proxy"
-         echo "Version:        $RELEASE"
+         echo "Version:        $RPMVERSION"
          echo "Release:        1%{?dist}"
          tail --lines=+4 scripts/rh/3proxy.spec.old
        } > scripts/rh/3proxy.spec
@@ -90,5 +105,5 @@ jobs:
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        git add debian/changelog scripts/rh/3proxy.spec src/version.h
-       git commit -m "Update version files for $(tr -d ' \t\r\n' < RELEASE)"
+       git commit -m "Update version files for $(tr -d ' \t\r\n' < $(test -f RELEASE && echo RELEASE || echo DEVEL))"
        git push

.github/workflows/update-wiki.yml

@@ -2,6 +2,7 @@ name: Update wiki
 
 on:
   push:
+    branches: [master]
     paths:
       - 'doc/html/**'
   workflow_run:
@@ -18,6 +19,8 @@ concurrency:
 
 jobs:
   wiki:
+    # the wiki mirrors master, so a run started by anything else is not for it
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.head_branch == 'master'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7

CMakeLists.txt

@@ -4,8 +4,20 @@
 
 cmake_minimum_required(VERSION 3.16)
 
-# Read version from RELEASE file
-file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/RELEASE" PROJECT_VERSION LIMIT_COUNT 1)
+# Read the version. A release branch carries RELEASE, a development branch
+# DEVEL, whose version may have a suffix that project() will not take.
+if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/RELEASE")
+    file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/RELEASE" PROJECT_VERSION_FULL LIMIT_COUNT 1)
+elseif(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/DEVEL")
+    file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/DEVEL" PROJECT_VERSION_FULL LIMIT_COUNT 1)
+else()
+    message(FATAL_ERROR "Neither RELEASE nor DEVEL found: cannot tell the version")
+endif()
+string(STRIP "${PROJECT_VERSION_FULL}" PROJECT_VERSION_FULL)
+string(REGEX MATCH "^[0-9]+(\\.[0-9]+)*" PROJECT_VERSION "${PROJECT_VERSION_FULL}")
+if(NOT PROJECT_VERSION)
+    message(FATAL_ERROR "No version number in '${PROJECT_VERSION_FULL}'")
+endif()
 
 project(3proxy
     VERSION ${PROJECT_VERSION}
@@ -55,7 +67,9 @@ option(3PROXY_USE_SPLICE "Build Linux splice() support, slower than read/write f
 option(3PROXY_USE_POLL "Use poll() instead of select() (Unix only)" ON)
 option(3PROXY_USE_WSAPOLL "Use WSAPoll instead of select() (Windows only)" ON)
 option(3PROXY_USE_NETFILTER "Enable Linux netfilter support (Linux only)" ON)
+option(3PROXY_USE_TRANSPARENT "Build transparent proxying support (Linux and BSD only)" ON)
 option(3PROXY_USE_UNIX_SOCKETS "Enable Unix domain socket support (Unix only)" ON)
+option(3PROXY_USE_HTTPSRV "Build the HTTP server and the admin interface on top of it" ON)
 
 if(NOT WIN32 AND NOT APPLE)
     option(3PROXY_STATIC_LINK "Statically link libraries using -Wl,-Bstatic (Linux/Unix only)" OFF)
@@ -101,6 +115,9 @@ set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 if(WIN32)
     # Windows-specific configuration
     add_compile_definitions(
+        # Windows does not take a recv and a send on one socket from two
+        # threads, so a UDP service answers from a socket of its own
+        NO_SHARE_UDP_SOCKET
         WIN32
         _WIN32
         _MBCS
@@ -152,7 +169,7 @@ if(WIN32)
     endif()
 
     # Windows libraries
-    set(WINDOWS_LIBS ws2_32 advapi32 user32 kernel32 gdi32 crypt32)
+    set(WINDOWS_LIBS ws2_32 mswsock advapi32 user32 kernel32 gdi32 crypt32)
 
     # Windows plugins (always built)
     set(DEFAULT_PLUGINS
@@ -192,7 +209,6 @@ elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux")
     set(DEFAULT_PLUGINS
         StringsPlugin
         TrafficPlugin
-        TransparentPlugin
         FilePlugin
     )
 
@@ -214,7 +230,6 @@ elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD|Darwin|OpenBSD|NetBSD")
     set(DEFAULT_PLUGINS
         StringsPlugin
         TrafficPlugin
-        TransparentPlugin
         FilePlugin
     )
 
@@ -231,11 +246,33 @@ else()
     set(DEFAULT_PLUGINS
         StringsPlugin
         TrafficPlugin
-        TransparentPlugin
         FilePlugin
     )
 endif()
 
+if(3PROXY_USE_HTTPSRV)
+    add_compile_definitions(WITH_HTTPSRV)
+endif()
+
+# Transparent proxying needs a redirection that leaves the original
+# destination where 3proxy reads it: the kernel on Linux, the socket on the
+# BSDs. That means netfilter, OpenBSD divert-to or FreeBSD ipfw fwd. NetBSD
+# and macOS rewrite the destination instead and are left out.
+if(3PROXY_USE_TRANSPARENT AND (CMAKE_SYSTEM_NAME STREQUAL "Linux"
+   OR CMAKE_SYSTEM_NAME MATCHES "FreeBSD|OpenBSD|NetBSD"))
+    add_compile_definitions(WITH_TRANSPARENT)
+    set(3PROXY_TRANSPARENT_BUILT ON)
+    # pf keeps the original destination in its state table, which is read
+    # through /dev/pf. macOS has the device but ships no header for it.
+    include(CheckIncludeFiles)
+    check_include_files("sys/types.h;sys/socket.h;net/if.h;net/pfvar.h" HAVE_PFVAR_H)
+    if(HAVE_PFVAR_H)
+        add_compile_definitions(WITH_PF)
+    endif()
+else()
+    set(3PROXY_TRANSPARENT_BUILT OFF)
+endif()
+
 # Unix domain sockets off: NO_UN also undefines WITH_UN if it arrives from
 # elsewhere, e.g. CFLAGS
 if(NOT 3PROXY_USE_UNIX_SOCKETS)
@@ -403,6 +440,7 @@ add_library(srv_modules OBJECT
     src/auto.c
     src/socks.c
     src/webadmin.c
+    src/httpsrv.c
     src/dnspr.c
 )
 
@@ -465,6 +503,10 @@ if(PCRE2_FOUND)
     target_sources(3proxy PRIVATE src/pcre.c)
 endif()
 
+if(3PROXY_TRANSPARENT_BUILT)
+    target_sources(3proxy PRIVATE src/transparent.c)
+endif()
+
 target_include_directories(3proxy PRIVATE
     ${CMAKE_CURRENT_SOURCE_DIR}/src
     ${CMAKE_CURRENT_SOURCE_DIR}/src/libs
@@ -911,7 +953,7 @@ endif()
 # Summary
 message(STATUS "")
 message(STATUS "3proxy configuration summary:")
-message(STATUS "  Version: ${PROJECT_VERSION}")
+message(STATUS "  Version: ${PROJECT_VERSION_FULL}")
 message(STATUS "  Platform: ${CMAKE_SYSTEM_NAME}")
 message(STATUS "  Compiler: ${CMAKE_C_COMPILER_ID} ${CMAKE_C_COMPILER_VERSION}")
 message(STATUS "  Build type: ${CMAKE_BUILD_TYPE}")
@@ -921,6 +963,7 @@ message(STATUS "    BUILD_SHARED:    ${3PROXY_BUILD_SHARED}")
 message(STATUS "    USE_WOLFSSL:    ${3PROXY_USE_WOLFSSL}")
 message(STATUS "    USE_OPENSSL:    ${3PROXY_USE_OPENSSL}")
 message(STATUS "    USE_PCRE2:       ${3PROXY_USE_PCRE2}")
+message(STATUS "    TRANSPARENT:     ${3PROXY_TRANSPARENT_BUILT}")
 message(STATUS "    USE_PAM:         ${3PROXY_USE_PAM}")
 message(STATUS "    USE_ODBC:        ${3PROXY_USE_ODBC}")
 message(STATUS "    USE_POLL:        ${3PROXY_USE_POLL}")

Makefile.FreeBSD

@@ -24,6 +24,11 @@ LDFLAGS += $(EXTRA_LDFLAGS)
 # -lpthreads may be reuiured on some platforms instead of -pthreads
 # -ldl or -lld may be required for some platforms
 DCFLAGS ?= -fPIC
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .so
 LIBS ?=
@@ -39,7 +44,20 @@ AFTERCLEAN = (find . -type f -name "*.o" -delete && find src/ -type f -name "Mak
 TYPECOMMAND = cat
 COMPATLIBS =
 MAKEFILE = Makefile.FreeBSD
-PLUGINS ?= StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS ?= StringsPlugin TrafficPlugin FilePlugin
+
+# Transparent proxying, built in. The destination of a redirected connection
+# comes from pf where its headers are available, and from the socket where a
+# redirection leaves it there (OpenBSD divert-to, FreeBSD ipfw fwd). macOS
+# has /dev/pf but ships no pfvar.h, so only the socket route is built there
+# and no macOS redirection leaves the address on the socket.
+CFLAGS += -DWITH_TRANSPARENT
+TRANSPARENT_OBJS = transparent$(OBJSUFFICS)
+
+PF_CHECK ?= $(shell printf "\#include <sys/types.h>\\n\#include <sys/socket.h>\\n\#include <net/if.h>\\n\#include <net/pfvar.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpf.o -c - 2>/dev/null && rm testpf.o && echo true||echo false)
+ifeq ($(PF_CHECK), true)
+    CFLAGS += -DWITH_PF
+endif
 ifeq ($(STATIC), true)
     LDFLAGS += -static
     CFLAGS += -DNOPLUGINS -DNOSTDRESOLVE -DNOCRYPT

Makefile.Linux

@@ -25,6 +25,13 @@ LDFLAGS += -fno-strict-aliasing -pthread
 # makefile, including the += above and the STATIC/LIBSTATIC handling below.
 CFLAGS += $(EXTRA_CFLAGS)
 LDFLAGS += $(EXTRA_LDFLAGS)
+# The HTTP server serves the endpoints declared by http lines. The admin
+# interface is built on top of it, so turning it off removes both.
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .ld.so
 # -lpthreads may be reuqired on some platforms instead of -pthreads
@@ -43,8 +50,12 @@ MAKEFILE = Makefile.Linux
 # PamAuth requires libpam, you may require pam-devel package to be installed
 # SSLPlugin requires  -lcrypto -lssl
 #LIBS = -lcrypto -lssl -ldl 
-#PLUGINS = SSLPlugin StringsPlugin TrafficPlugin PCREPlugin TransparentPlugin PamAuth
-PLUGINS ?= StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+#PLUGINS = StringsPlugin TrafficPlugin PamAuth LdapPlugin
+PLUGINS ?= StringsPlugin TrafficPlugin FilePlugin
+
+# Transparent proxying, built in: it needs the packet filter of the platform
+CFLAGS += -DWITH_TRANSPARENT
+TRANSPARENT_OBJS = transparent$(OBJSUFFICS)
 ifeq ($(STATIC), true)
     LDFLAGS += -static
     CFLAGS += -DNOPLUGINS -DNOSTDRESOLVE -DNOCRYPT

Makefile.Solaris

@@ -14,6 +14,11 @@ COUT = -o ./
 LN = $(CC)
 LDFLAGS = -xO3
 DCFLAGS = -fPIC
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS = -shared
 DLSUFFICS = .ld.so
 LIBS = -lpthread -lsocket -lnsl -lresolv -ldl
@@ -29,7 +34,7 @@ AFTERCLEAN = (find . -type f -name "*.o" -delete && find src/ -type f -name "Mak
 TYPECOMMAND = cat
 COMPATLIBS =
 MAKEFILE = Makefile.Solaris
-PLUGINS = StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS = StringsPlugin TrafficPlugin FilePlugin
 
 WOLFSSL_CHECK = $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testwssl testwssl.o -lwolfssl 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)

Makefile.msvc

@@ -18,13 +18,13 @@ SSL_LIBS = wolfssl.lib
 SSL_DEFS = /D "WITH_SSL"
 SSL_LIBS = libcrypto.lib libssl.lib
 !ENDIF
-CFLAGS = /nologo /MT /W3 /Ox /GS /EHs- /GA /GF /D "MSVC"  /D "WITH_WSAPOLL" /D "NDEBUG" /D "WIN32" $(SSL_DEFS) /D "WITH_PCRE" /D "WITH_ODBC" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /Fp"proxy.pch" /FD /c $(BUILDDATE) $(VERSION)
+CFLAGS = /D "WITH_HTTPSRV" /nologo /MT /W3 /Ox /GS /EHs- /GA /GF /D "MSVC"  /D "WITH_WSAPOLL" /D "NDEBUG" /D "WIN32" $(SSL_DEFS) /D "WITH_PCRE" /D "WITH_ODBC" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /D "NO_SHARE_UDP_SOCKET" /Fp"proxy.pch" /FD /c $(BUILDDATE) $(VERSION)
 COUT = /Fo
 LN = link
 LDFLAGS =  /nologo /subsystem:console /incremental:no
 DLFLAGS = /DLL
 DLSUFFICS = .dll
-LIBS = ws2_32.lib advapi32.lib odbc32.lib user32.lib kernel32.lib Gdi32.lib Crypt32.lib $(SSL_LIBS) pcre2-8.lib
+LIBS = ws2_32.lib mswsock.lib advapi32.lib odbc32.lib user32.lib kernel32.lib Gdi32.lib Crypt32.lib $(SSL_LIBS) pcre2-8.lib
 LIBSPREFIX =
 LIBSSUFFIX = .lib
 LIBEXT = .lib
@@ -40,6 +40,7 @@ MAKEFILE = Makefile.msvc
 PLUGINS = utf8tocp1251 WindowsAuthentication TrafficPlugin StringsPlugin FilePlugin
 SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
 PCRE_OBJS = pcre$(OBJSUFFICS)
+HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
 VERFILE = 3proxy.res $(VERFILE)
 VERSIONDEP = 3proxy.res $(VERSIONDEP)
 AFTERCLEAN = if exist src\*.res (del src\*.res) && if exist src\*.err (del src\*.err)

Makefile.unix

@@ -26,6 +26,11 @@ LDFLAGS += $(EXTRA_LDFLAGS)
 # -lpthreads may be reuqired on some platforms instead of -pthreads
 # -ldl or -lld may be required for some platforms
 DCFLAGS ?= -fPIC
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS ?= .ld.so
 LIBS ?=
@@ -41,7 +46,13 @@ AFTERCLEAN = (find . -type f -name "*.o" -delete && find src/ -type f -name "Mak
 TYPECOMMAND = cat
 COMPATLIBS =
 MAKEFILE = Makefile.unix
-PLUGINS ?= StringsPlugin TrafficPlugin TransparentPlugin FilePlugin
+PLUGINS ?= StringsPlugin TrafficPlugin FilePlugin
+
+# Transparent proxying is not built here: this makefile is for the systems
+# without a redirection 3proxy can read the original destination from. Where
+# the platform has one - OpenBSD divert-to is the case that fits - uncomment:
+#CFLAGS += -DWITH_TRANSPARENT
+#TRANSPARENT_OBJS = transparent$(OBJSUFFICS)
 ifeq ($(STATIC), true)
     LDFLAGS += -static
     CFLAGS += -DNOPLUGINS -DNOSTDRESOLVE -DNOCRYPT

Makefile.watcom

@@ -8,19 +8,20 @@ BUILDDIR = ../bin/
 PREFIX = 3proxy_
 CRYPT_PREFIX = 3proxy_
 CC = cl
-CFLAGS = /nologo /Ox /MT /D "NOIPV6" /D "NO_UN" /D "NODEBUG" /D "NORADIUS" /D"WATCOM" /D "MSVC"  /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /D "PRId64=\"I64d\"" /D "PRIu64=\"I64u\"" /D "SCNu64=\"I64u\"" /D "SCNx64=\"I64x\"" /D "SCNd64=\"I64d\"" /D "PRIx64=\"I64x\"" /c $(VERSION) $(BUILDDATE)
+CFLAGS = /D "WITH_HTTPSRV" /nologo /Ox /MT /D "NOIPV6" /D "NO_UN" /D "NODEBUG" /D "NORADIUS" /D"WATCOM" /D "NO_SHARE_UDP_SOCKET" /D "MSVC"  /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /D "PRId64=\"I64d\"" /D "PRIu64=\"I64u\"" /D "SCNu64=\"I64u\"" /D "SCNx64=\"I64x\"" /D "SCNd64=\"I64d\"" /D "PRIx64=\"I64x\"" /c $(VERSION) $(BUILDDATE)
 COUT = /Fo
 LN = link
 LDFLAGS = /nologo /subsystem:console /incremental:no 
 DLFLAGS = /DLL
 DLSUFFICS = .dll
-LIBS = ws2_32.lib advapi32.lib user32.lib kernel32.lib
+LIBS = ws2_32.lib mswsock.lib advapi32.lib user32.lib kernel32.lib
 LIBSPREFIX = 
 LIBSSUFFIX = .lib
 LIBEXT = .lib                                                                                               
 LNOUT = /out:
 EXESUFFICS = .exe
 OBJSUFFICS = .obj
+HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
 DEFINEOPTION = /D 
 COMPFILES = *.pch *.idb *.err
 REMOVECOMMAND = del 2>NUL >NUL

Makefile.win

@@ -11,6 +11,9 @@ CRYPT_PREFIX ?= $(PREFIX)
 CC ?= gcc
 CFLAGS ?= -O3 -flto
 CFLAGS += -fno-strict-aliasing -c -mthreads  -DWITH_WSAPOLL -DWITH_ODBC
+# Windows does not take a recv and a send on one socket from two threads,
+# so a UDP service answers from a socket of its own
+CFLAGS += -DNO_SHARE_UDP_SOCKET
 COUT = -o 
 LN ?= $(CC)
 LDFLAGS ?= -O3 -flto
@@ -20,9 +23,14 @@ LDFLAGS += -fno-strict-aliasing -mthreads
 # makefile, including the += above and the STATIC/LIBSTATIC handling below.
 CFLAGS += $(EXTRA_CFLAGS)
 LDFLAGS += $(EXTRA_LDFLAGS)
+HTTPSRV ?= true
+ifeq ($(HTTPSRV),true)
+    CFLAGS += -DWITH_HTTPSRV
+    HTTPSRV_OBJS = srvhttpsrv$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS)
+endif
 DLFLAGS ?= -shared
 DLSUFFICS = .dll
-LIBS += -lws2_32 -lodbc32 -ladvapi32 -luser32 -lbcrypt
+LIBS += -lws2_32 -lmswsock -lodbc32 -ladvapi32 -luser32 -lbcrypt
 LIBSPREFIX = -l
 LIBSSUFFIX =
 LNOUT = -o 

SECURITY.md

@@ -7,6 +7,25 @@
 | 0.9.8   | :white_check_mark: |
 | < 0.9.8 | :x:                |
 
+## Hardening a deployment
+
+Configuration is where most of the risk lives. The security recommendations are
+kept in [doc/html/securityen.html](doc/html/securityen.html), published at
+<https://3proxy.org/securityen.html>: how to run the service, what the
+ACLs have to cover, and the settings whose defaults are safe only until
+something else is enabled alongside them.
+
+Read it before exposing a service. Recurring points from it:
+
+- Run unprivileged, never suid, and chroot where the platform allows.
+- Name the internal and external interfaces explicitly, and limit sources and
+  destinations with ACLs rather than relying on defaults.
+- Enabling IPv6 makes ACLs written in IPv4 incomplete: the same host is
+  reachable through an IPv4-mapped address, and the IPv6 loopback is an
+  address of its own.
+- Anything that terminates or intercepts TLS holds key material and sees full
+  request URLs; both the key and the logs need protecting.
+
 ## Reporting a Vulnerability
 
 Report to 3proxy@3proxy.org or via [GitHub security reporting](https://github.com/3proxy/3proxy/security)

doc/html/howtoe.html

@@ -34,9 +34,11 @@
  <li><a href="#ISFTP">How to set up an FTP proxy</a></li>
  <li><a href="#TLSPR">How to set up an SNI proxy (tlspr)</a></li>
  <li><a href="#DNSPR">How to set up a DNS proxy (dnspr)</a></li>
+ <li><a href="#HTTPSRV">How to serve pages with the built-in HTTP server (httpsrv)</a></li>
  <li><a href="#SSLPLUGIN">How to set up TLS/SSL (https proxy, mTLS)</a></li>
  <li><a href="#CERTIFICATES">How to create CA and certificates for SSL</a></li>
  <li><a href="#PCRE">How to use PCRE filtering (regular expressions)</a></li>
+ <li><a href="#TRANSPARENT">How to proxy transparently</a></li>
  <li><A HREF="#AUTH">How to limit service access</a>
  <li><A HREF="#USERS">How to create a user list</a>
  <li><A HREF="#ACL">How to limit user access to resources</a>
@@ -726,6 +728,218 @@ nscache 65536
 nscache6 65536
 dnspr -p53 -F10.0.0.1
 </pre>
+ </p>
+ <li><a name="HTTPSRV"><i>How to serve pages with the built-in HTTP server (httpsrv)</i></a>
+<p>
+httpsrv answers requests itself instead of forwarding them. What it does with a
+request is decided by <code>http</code> rules written before the service, the way
+access rules are: the first rule whose host and URL both match handles the
+request. It is useful for a status page, a small static site, a block page for
+requests an ACL rejects, or a health check an upstream balancer can poll.
+</p><pre>
+http OPERATION HOST URL [PARAMETERS]
+</pre>
+<p>
+HOST is matched against the Host header, URL against the path with the query
+string removed. A minimal static site:
+</p><pre>
+auth iponly
+allow *
+
+http file * /           /usr/local/web/index.html
+http file * /*.html     "/usr/local/web/$1.html"
+http file * /css/*.css  "/usr/local/web/css/$1.css"
+http cache * /img/**    "/usr/local/web/img/$1" * 3600
+httpsrv -p80 -i127.0.0.1
+</pre>
+<p>
+<b>Patterns.</b> <code>*</code> stands for any run of characters within one
+element of the path and does not cross a <code>/</code>, so a rule cannot reach
+into a directory it did not name. <code>**</code> crosses them. Each star, and
+each group of a regular expression, is remembered in order: <code>$1</code>
+upwards stand for them in the path or location the rule builds, and
+<code>$0</code> for the whole request path. A <code>rewrite_host</code> rule
+uses the stars of its own host pattern instead, since that is what it is
+rewriting. With a PCRE build a pattern may be
+written as a regular expression with a <code>pcre:</code> prefix, for the URL and
+for the host alike:
+</p><pre>
+http file  * /d/*.txt       "/usr/local/web/$1.txt"
+http cache * "pcre:^/(.*)/pic/(.*)\.(gif|jpeg)$" "/usr/local/web/picts/$1/$2.$3"
+http file  status.example.com /**  "/usr/local/web/status/$1"
+http file  "pcre:^(www|web)\.example\.com$" /**  "/usr/local/web/$1"
+</pre>
+<p>
+Outside quotes a dollar begins the name of a file to include, so an argument
+holding one - a path built with <code>$1</code>, a regular expression anchored
+with <code>$</code> - is written in quotes, as above. <code>$$</code> stands for
+a single dollar and is not read as an include either.
+</p>
+<p>
+<b>Operations.</b>
+</p><pre>
+&#35; file - send the file, using sendfile/TransmitFile where the system can
+http file * /dl/**  "/usr/local/web/dl/$1"
+
+&#35; cache - read it into memory on the first request and answer from there
+http cache * /css/*.css "/usr/local/web/css/$1.css"
+
+&#35; redir - answer with a redirect, 302 unless a status is given
+http redir * /old/**  301 "https://example.org/$1"
+
+&#35; rewrite - change the path and hand the request to the rules after this one
+http rewrite * /alias/** "/w/$1"
+
+&#35; rewrite_host - the same for the host, which decides which rules match next
+http rewrite_host *.old.example ** "$1.new.example"
+
+&#35; reply - a status and nothing else
+http reply * /health**  200 "X-Health: ok"
+http reply * /down**    503 "Retry-After: 30"
+
+&#35; echo, data - describe the request, or generate content of a given size
+http echo * /echo**
+http data * /gen** size=1048576
+</pre>
+<p>
+<b>What a rule adds to the answer.</b> <code>file</code> and <code>cache</code>
+take, after the path, a content type, a max-age, headers to add and a status to
+answer with. Each may be left out or written as <code>*</code>:
+</p><pre>
+http OPERATION HOST URL PATH [TYPE [MAX-AGE [HEADERS [CODE]]]]
+
+&#35; type worked out from the name, cached by clients for an hour
+http file * /img/*.png "/usr/local/web/img/$1.png" * 3600
+
+&#35; a type of its own, and a header
+http file * /api/*.json "/usr/local/web/api/$1.json" application/json * "X-Api: 1"
+
+&#35; a file serving as the body of an error page
+http file * /err/** /usr/local/web/404.html text/html * * 404
+</pre>
+<p>
+HEADERS is one argument holding whole header lines, separated by a backslash and
+an n - the two characters, since a configuration line cannot carry a line
+ending. Quote it, headers contain spaces. A rule's headers and max-age go with
+whatever status that rule asked for, but not with a refusal the server itself
+decided on: a request for a file which is not there is answered 404 by the
+server, not by the rule.
+</p>
+<p>
+Types not known to the server are registered with
+<code>http_content_type</code>, and a type named by a rule is used whatever the
+name of the file says:
+</p><pre>
+http_content_type .webp image/webp
+http_content_type wasm  application/wasm
+</pre>
+<p>
+<b>Files and dates.</b> Only a full path is taken - a relative one would be read
+against whatever directory the service happens to be in - and a path holding
+<code>.</code> or <code>..</code> as an element, a line ending or a star is
+refused. On Windows a path must name a drive or a share (<code>"C:\web\$1"</code>
+or <code>"\\host\share\$1"</code>). A request which decodes to a path leaving the
+tree is refused before any of this. Every answer carries Last-Modified, and a
+request carrying If-Modified-Since is answered 304 with no body when the file
+has not changed.
+</p>
+<p>
+<b>Caching.</b> <code>cache</code> reads the file once and answers from memory
+afterwards; a file which has changed on disk is read again, and one larger than
+a megabyte is sent as <code>file</code> would. With a MAX-AGE the file is not
+looked at again for that long - the rule has already told clients the file may
+be treated as unchanged for that time - so a request costs nothing but the copy
+out. Without one every request stats the file and a change is picked up at once.
+</p>
+<p>
+<b>A block page.</b> A service which rejects a request with a redirect can send
+the client to an httpsrv running beside it:
+</p><pre>
+auth iponly
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow *
+proxy -p3128 -i192.168.1.1
+
+flush
+auth iponly
+allow *
+http file * /**  /usr/local/web/blocked.html text/html * * 403
+httpsrv -p8080 -i127.0.0.1
+</pre>
+<p>
+<b>Both a site and a proxy.</b> A request may arrive the way it arrives at a
+site - a path, with the name in the Host header - or the way it arrives at a
+proxy, naming the whole URL, or the host alone with CONNECT. Both are read. A
+proxy-form request authenticates with Proxy-Authorization and is refused with
+407, the way a proxy refuses one; a site-form request uses Authorization and
+401. What answers it is decided by the rules either way.
+</p>
+<p>
+<code>proxypass</code> is the rule which answers by fetching, so one service can
+serve what it has and proxy the rest:
+</p><pre>
+auth iponly
+allow *
+http file * /local/** "/usr/local/web/$1"
+http proxypass * /**
+httpsrv -p8080
+</pre>
+<p>
+An access rule redirecting to the local proxy does the same without a rule for
+it. The chain with no address is what "the local proxy" is written as, and the
+second <code>allow</code> is what the proxy matches on the pass it makes itself,
+since a rule carrying the chain is not taken twice:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow *
+http file * /local/** "/usr/local/web/$1"
+httpsrv -p8080
+</pre>
+<p>
+Authentication happens twice for the same reason - once for the service, once
+for the proxy - so a configuration which asks for credentials asks for them the
+way a proxy does.
+</p>
+<p>
+The access rules are read from the top on both passes, and the second one is
+where the request's destination is known. On the first pass the service is
+answering for itself, so an address or a port in a rule is matched against the
+address the client connected to; the name from the request is matched on both
+passes. On the second the destination is the one the request names, so rules
+written with an address, a port or a name decide what the proxy may fetch, and
+they decide it before it connects:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow * * * 80,443
+deny *
+httpsrv -p8080
+</pre>
+<p>
+Everything reaches the rules, only ports 80 and 443 are fetched, and a
+<code>deny</code> written before the rule carrying the chain applies on both
+passes just the same. The connection to the server is kept for the next request and
+closed when that request goes elsewhere, or when the server has closed it in the
+meantime.
+</p>
+<p>
+<b>Connections.</b> A client asking in HTTP/1.1 gets a 1.1 answer and the
+connection is kept for the next request, unless it sent
+<code>Connection: close</code>; a 1.0 client has to ask for keep-alive. The
+connection is only kept when the length of the answer is known exactly, which is
+true of every operation except the administration pages, so those are always the
+last thing on a connection. A request body the server cannot read to its end -
+one sent chunked, or one larger than a megabyte - ends the connection too.
+</p>
+<p>
+<b>Administration.</b> The <code>admin</code> service is httpsrv with the pages
+of the administration interface already declared, see
+<a href="#ADMIN">Administering and information analysis</a>. Rules may be added
+before it in the same way, and are taken first.
+</p>
  </p>
  <li><a name="SSLPLUGIN"><i>How to set up TLS/SSL (https proxy, mTLS)</i></a>
 <p>
@@ -828,12 +1042,32 @@ This creates an HTTPS proxy (ssl_serv) that accepts TLS connections from clients
 &#35; Generate CA private key
 openssl genrsa -out ca.key 4096
 
+&#35; Extensions that make the certificate usable as a CA
+cat > ca.ext << 'EOF'
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+
 &#35; Generate CA certificate (valid for 10 years)
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+openssl req -new -nodes -key ca.key \
     -subj "/C=US/ST=State/L=City/O=MyOrg/CN=My CA" \
-    -out ca.crt
+    -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 </pre>
 <p>
+The extensions are not optional. Without <b>basicConstraints=CA:TRUE</b> and
+<b>keyCertSign</b> the certificate is not accepted as a CA, and clients report
+that they cannot get the local issuer certificate. <b>subjectKeyIdentifier</b>
+is what certificates signed by this CA point back at.
+</p>
+<p>
+They are given in a file rather than with <b>-addext</b> because LibreSSL, the
+<b>openssl</b> command on macOS and some BSDs, does not apply -addext the same
+way OpenSSL does. The form above behaves the same on both.
+</p>
+<p>
 For MITM, import ca.crt into client browsers/OS as a trusted root CA.
 </p>
 <p>
@@ -866,8 +1100,18 @@ EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 \
     -extfile server.ext
+
+&#35; Check it the way a current client will
+openssl verify -x509_strict -CAfile ca.crt server.crt
 </pre>
 <p>
+Verify strictly, because that is what the client does. OpenSSL 3 adds the
+subject and authority key identifiers when it signs and LibreSSL does not,
+which is why the extensions file asks for them by name. Python has verified
+strictly since 3.13 and refuses a certificate carrying no
+<b>authorityKeyIdentifier</b>; other clients are moving the same way.
+</p>
+<p>
 For a public https:// proxy, use a CA like Let's Encrypt instead of self-signed.
 </p>
 <p>
@@ -886,6 +1130,8 @@ cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 
 &#35; Sign with CA
@@ -908,8 +1154,14 @@ Import client1.p12 into the client browser or OS certificate store.
 
 &#35; CA
 openssl genrsa -out ca.key 4096
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
-    -subj "/CN=3proxy CA" -out ca.crt
+cat > ca.ext << 'EOF'
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+openssl req -new -nodes -key ca.key -subj "/CN=3proxy CA" -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 
 &#35; Server
 openssl genrsa -out server.key 2048
@@ -919,6 +1171,8 @@ basicConstraints=CA:FALSE
 keyUsage = keyEncipherment
 extendedKeyUsage = serverAuth
 subjectAltName = DNS:localhost,DNS:proxy,IP:127.0.0.1
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
@@ -929,12 +1183,201 @@ openssl req -new -key client.key -subj "/CN=client" -out client.csr
 cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out client.crt -days 365 -sha256 -extfile client.ext
 openssl pkcs12 -export -out client.p12 -passout pass: \
     -inkey client.key -in client.crt -certfile ca.crt
+
+&#35; Both must pass the checks a current client applies
+openssl verify -x509_strict -CAfile ca.crt server.crt
+openssl verify -x509_strict -CAfile ca.crt client.crt
 </pre>
+
+ <li><a name="TRANSPARENT"><i>How to proxy transparently</i></a>
+<p>
+A transparent proxy serves clients that were never configured to use one. A
+packet filter redirects their connections to 3proxy, and the
+<b>transparent</b> command tells the service to take the destination from the
+filter instead of from the request. Every other feature applies as usual:
+access rules, parent proxies, limits and logging all see the real destination.
+It works on Linux and on the BSDs. Since 1.0.1 it is part of the binary; before
+that it was the separate TransparentPlugin, and the <b>plugin</b> line it
+needed is no longer required.
+</p>
+<p>
+The command supplies both the address and the port the client was trying to
+reach, so a service can serve whatever was redirected to it rather than one
+port with one target.
+</p>
+<p>
+Without it a service has to get a destination from somewhere else: an HTTP
+proxy falls back to the <b>Host</b> header, and a port mapper uses the address
+it was configured with. Taking the destination from the filter is what makes
+the other protocols work, and what makes the address authoritative rather than
+something the client claimed.
+</p>
+<p>
+<b>tlspr</b> is the clearest case. Nothing reaches it at all unless traffic is
+redirected to it, or the clients resolve the names to it through DNS. With a
+redirection it gets the address as well as the name from the handshake, and
+that is what lets access rules be written with host names: the name from the
+handshake is matched, and the connection still goes to the address the client
+was going to. Without the address it would have to resolve the name itself,
+which is a second lookup and a second answer.
+</p>
+<p>
+A configuration for web and TLS traffic:
+</p><pre>
+log /var/log/3proxy.log D
+auth iponly
+allow *
+
+&#35; the destination comes from the redirection for the services below
+transparent
+
+&#35; ordinary web traffic, redirected here from port 80
+proxy -p3129 -e192.0.2.10
+
+&#35; TLS, redirected here from port 443: tlspr would otherwise have only the
+&#35; name in the handshake, and this gives it the address as well
+tlspr -p3143 -e192.0.2.10
+
+notransparent
+</pre>
+<p>
+<b>-e</b> gives those services an address of their own to connect from. That
+address is what the redirection rules exclude, and excluding it is what stops
+the proxy's own connections from being redirected back into it. Without an
+exclusion the connection 3proxy makes to the origin matches the same rule,
+returns to 3proxy, and the traffic goes round until something gives out.
+Running 3proxy as its own account and excluding that account works too, and is
+the better choice when the machine has one address.
+</p>
+
+<p><b>Linux, iptables</b>. For traffic the machine forwards for others:
+</p><pre>
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80  -j REDIRECT --to-ports 3129
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+</pre>
+<p>
+Traffic the machine generates itself passes through OUTPUT instead, where the
+proxy's own connections have to be excluded:
+</p><pre>
+&#35; by the address the services connect from
+iptables -t nat -A OUTPUT -p tcp --dport 80 ! -s 192.0.2.10 -j REDIRECT --to-ports 3129
+
+&#35; or by the account 3proxy runs as
+iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner proxy3 \
+    -j REDIRECT --to-ports 3129
+</pre>
+
+<p><b>Linux, nftables</b> (Debian 11+, Ubuntu 22.04+, RHEL 8+, Fedora, Arch,
+where nftables is what iptables is a front end for):
+</p><pre>
+table ip proxy3 {
+	chain prerouting {
+		type nat hook prerouting priority dstnat; policy accept;
+		iif "eth0" tcp dport 80 redirect to :3129
+		iif "eth0" tcp dport 443 redirect to :3143
+	}
+
+	chain output {
+		type nat hook output priority dstnat; policy accept;
+		meta skuid != "proxy3" tcp dport 80 redirect to :3129
+		meta skuid != "proxy3" tcp dport 443 redirect to :3143
+	}
+}
+</pre>
+<p>
+Load it with <b>nft -f</b>, and keep it across reboots in
+<b>/etc/nftables.conf</b> (Debian, Ubuntu) or
+<b>/etc/sysconfig/nftables.conf</b> (RHEL, Fedora). A table name cannot begin
+with a digit, which is why the table above is not called 3proxy.
+</p>
+
+<p><b>Linux, firewalld</b> (RHEL, CentOS Stream, Fedora, openSUSE). Redirect an
+incoming port on a zone:
+</p><pre>
+firewall-cmd --permanent --zone=internal --add-forward-port=port=80:proto=tcp:toport=3129
+firewall-cmd --permanent --zone=internal --add-forward-port=port=443:proto=tcp:toport=3143
+firewall-cmd --reload
+</pre>
+<p>
+firewalld has no exclusion for the proxy's own traffic in that form, so put
+that part in a direct rule:
+</p><pre>
+firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 \
+    -p tcp --dport 80 -m owner ! --uid-owner proxy3 -j REDIRECT --to-ports 3129
+firewall-cmd --reload
+</pre>
+
+<p><b>Linux, ufw</b> (Ubuntu, Debian). ufw has no command for redirection;
+add the rules to <b>/etc/ufw/before.rules</b>, above the <b>*filter</b> block:
+</p><pre>
+*nat
+:PREROUTING ACCEPT [0:0]
+-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3129
+-A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+COMMIT
+</pre>
+
+<p>
+On Linux 3proxy asks the kernel where the connection was going. On the BSDs it
+asks pf, which keeps the original destination in its state table, through
+<b>/dev/pf</b> - so <b>rdr</b> rules work, and 3proxy has to be able to read
+that device. Where a redirection leaves the destination on the socket instead,
+that is used: OpenBSD <b>divert-to</b> and FreeBSD <b>ipfw fwd</b> both do.
+</p>
+<p>
+The mechanism is chosen automatically, and <b>transparent</b> takes an
+argument for the installations that need to pin it: <b>auto</b> (the default),
+<b>netfilter</b>, <b>pf</b>, or <b>socket</b> for reading it off the socket. A
+mode the build has no code for is refused, so a configuration written for
+another platform fails where it is wrong instead of quietly doing something
+else.
+</p>
+
+<p><b>FreeBSD, NetBSD and OpenBSD, pf</b>. Redirect in <b>/etc/pf.conf</b>,
+excluding the address the proxy connects from:
+</p><pre>
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 80  -&gt; 127.0.0.1 port 3129
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 443 -&gt; 127.0.0.1 port 3143
+</pre>
+<p>
+Load with <b>pfctl -f /etc/pf.conf</b>. 3proxy looks the destination up in pf's
+state table, so it needs to read <b>/dev/pf</b>: either run it as root, or give
+its account access to that device.
+</p>
+
+<p><b>OpenBSD, divert-to</b> is an alternative which leaves the destination on
+the socket, and needs no access to <b>/dev/pf</b>:
+</p><pre>
+pass in on em0 inet proto tcp to any port 80  divert-to 127.0.0.1 port 3129
+pass in on em0 inet proto tcp to any port 443 divert-to 127.0.0.1 port 3143
+</pre>
+
+<p><b>FreeBSD, ipfw</b>. <b>fwd</b> delivers the connection locally without
+rewriting it, which also leaves the destination on the socket:
+</p><pre>
+ipfw add fwd 127.0.0.1,3129 tcp from any to any 80  in recv em0
+ipfw add fwd 127.0.0.1,3143 tcp from any to any 443 in recv em0
+</pre>
+
+<p><b>macOS</b> has <b>/dev/pf</b> but ships no header for it, so a macOS build
+has no pf lookup, and macOS has neither <b>divert-to</b> nor ipfw to leave the
+address on the socket. Transparent proxying is not usable there, even though
+the commands exist in a macOS build.
+</p>
+
+<p>
+Check the result by asking for a host through a redirected port and reading
+the log: the request should appear with the address the client asked for,
+which is what it would look like through a configured proxy.
+</p>
+
  <li><a name="PCRE"><i>How to use PCRE filtering (regular expressions)</i></a>
 <p>
 Since version 0.9.7, PCRE (Perl Compatible Regular Expressions) filtering is built into
@@ -993,6 +1436,34 @@ pcre_extend deny * 192.168.0.1/16
 <p>
 <b>Note:</b> Regular expressions don't require authentication and cannot replace
 authentication and/or allow/deny ACLs.
+</p>
+<p>
+<b>Regular expressions in host names:</b> a host name in the target list of an
+access rule may be written as a regular expression instead of a wildmask, by
+giving it a <code>pcre:</code> prefix (<code>regex:</code> means the same). This
+needs a build with PCRE support, the same as the <code>pcre</code> commands
+above.
+</p><pre>
+&#35; Wildmask: a name may only be matched at its beginning and its end
+deny * * *ads.example.com
+
+&#35; Regular expression: anything PCRE can express
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow * * "pcre:^(www|api)\.example\.com$"
+</pre>
+<p>
+The name is lowercased and trailing dots are removed before the pattern is
+matched, so write patterns in lower case. Quote a pattern which ends in
+<code>$</code>, or write it as <code>$$</code>: outside quotes a lone dollar
+begins the name of a file to include. Only the target list takes names - the
+source list is addresses - and the name is only checked when the request
+carries one. A wildmask is cheaper and is enough for most rules; a regular
+expression is matched per request.
+</p>
+<p>
+The same prefix and the same patterns are used by the <code>http</code> command
+of the built-in HTTP server, for the host a rule answers for and for the URL it
+matches.
 </p>
  <li><A NAME="AUTH">How to limit service access</a>
 <p>

doc/html/howtor.html

@@ -34,9 +34,11 @@
  <li><a href="#ISFTP">Как настроить FTP прокси?</a></li>
  <li><a href="#TLSPR">Как настроить SNI proxy (tlspr)</a></li>
  <li><a href="#DNSPR">Как настроить DNS proxy (dnspr)</a></li>
+ <li><a href="#HTTPSRV">Как отдавать страницы встроенным HTTP-сервером (httpsrv)</a></li>
  <li><a href="#SSLPLUGIN">Как настроить TLS/SSL (https прокси, mTLS)</a></li>
  <li><a href="#CERTIFICATES">Как создать CA и сертификаты для SSL</a></li>
  <li><a href="#PCRE">Как использовать PCRE-фильтрацию (регулярные выражения)</a></li>
+ <li><a href="#TRANSPARENT">Как сделать транспарентный прокси</a></li>
  <li><a href="#AUTH">Как ограничить доступ к службе</a>
  <li><a href="#USERS">Как создать список пользователей</a>
  <li><a href="#ACL">Как ограничить доступ пользователей к ресурсам</a>
@@ -737,6 +739,217 @@ dnspr -p53 -F10.0.0.1
 </pre>
  </p>
 
+ <li><a name="HTTPSRV"><i>Как отдавать страницы встроенным HTTP-сервером (httpsrv)</i></a>
+<p>
+httpsrv отвечает на запросы сам, а не пересылает их. Что делать с запросом,
+определяют правила <code>http</code>, записанные перед сервисом, как и правила
+доступа: запрос обрабатывает первое правило, у которого совпали и хост, и URL.
+Это удобно для страницы состояния, небольшого статического сайта, страницы
+блокировки для запросов, отклонённых ACL, или health check, который опрашивает
+вышестоящий балансировщик.
+</p><pre>
+http ОПЕРАЦИЯ ХОСТ URL [ПАРАМЕТРЫ]
+</pre>
+<p>
+ХОСТ сопоставляется с заголовком Host, URL - с путём без строки запроса.
+Минимальный статический сайт:
+</p><pre>
+auth iponly
+allow *
+
+http file * /           /usr/local/web/index.html
+http file * /*.html     "/usr/local/web/$1.html"
+http file * /css/*.css  "/usr/local/web/css/$1.css"
+http cache * /img/**    "/usr/local/web/img/$1" * 3600
+httpsrv -p80 -i127.0.0.1
+</pre>
+<p>
+<b>Шаблоны.</b> <code>*</code> означает любую последовательность символов внутри
+одного элемента пути и не пересекает <code>/</code>, поэтому правило не может
+попасть в каталог, который не назван в нём. <code>**</code> пересекает.
+Каждая звёздочка и каждая группа регулярного выражения запоминаются по порядку:
+<code>$1</code> и далее подставляют их в путь или адрес, который строит правило,
+<code>$0</code> - весь путь запроса. Правило <code>rewrite_host</code>
+использует звёздочки собственного шаблона хоста, поскольку переписывает именно
+его. В сборке с PCRE шаблон можно записать
+регулярным выражением с префиксом <code>pcre:</code> - и для URL, и для хоста:
+</p><pre>
+http file  * /d/*.txt       "/usr/local/web/$1.txt"
+http cache * "pcre:^/(.*)/pic/(.*)\.(gif|jpeg)$" "/usr/local/web/picts/$1/$2.$3"
+http file  status.example.com /**  "/usr/local/web/status/$1"
+http file  "pcre:^(www|web)\.example\.com$" /**  "/usr/local/web/$1"
+</pre>
+<p>
+Вне кавычек доллар начинает имя включаемого файла, поэтому аргумент, содержащий
+доллар - путь с <code>$1</code>, регулярное выражение с якорем <code>$</code> -
+записывается в кавычках, как выше. <code>$$</code> означает один доллар и тоже
+не читается как включение файла.
+</p>
+<p>
+<b>Операции.</b>
+</p><pre>
+&#35; file - отдать файл, через sendfile/TransmitFile там, где система это умеет
+http file * /dl/**  "/usr/local/web/dl/$1"
+
+&#35; cache - прочитать в память при первом запросе и отвечать из неё
+http cache * /css/*.css "/usr/local/web/css/$1.css"
+
+&#35; redir - ответить редиректом, 302, если код не задан
+http redir * /old/**  301 "https://example.org/$1"
+
+&#35; rewrite - изменить путь и передать запрос следующим правилам
+http rewrite * /alias/** "/w/$1"
+
+&#35; rewrite_host - то же для хоста, от которого зависит выбор следующих правил
+http rewrite_host *.old.example ** "$1.new.example"
+
+&#35; reply - только код ответа, без тела
+http reply * /health**  200 "X-Health: ok"
+http reply * /down**    503 "Retry-After: 30"
+
+&#35; echo, data - описание запроса или генерация содержимого заданного размера
+http echo * /echo**
+http data * /gen** size=1048576
+</pre>
+<p>
+<b>Что правило добавляет в ответ.</b> <code>file</code> и <code>cache</code>
+принимают после пути тип содержимого, max-age, добавляемые заголовки и код
+ответа. Любой из них можно опустить или записать как <code>*</code>:
+</p><pre>
+http ОПЕРАЦИЯ ХОСТ URL ПУТЬ [ТИП [MAX-AGE [ЗАГОЛОВКИ [КОД]]]]
+
+&#35; тип определяется по имени файла, клиенты кэшируют час
+http file * /img/*.png "/usr/local/web/img/$1.png" * 3600
+
+&#35; собственный тип и заголовок
+http file * /api/*.json "/usr/local/web/api/$1.json" application/json * "X-Api: 1"
+
+&#35; файл как тело страницы ошибки
+http file * /err/** /usr/local/web/404.html text/html * * 404
+</pre>
+<p>
+ЗАГОЛОВКИ - один аргумент, содержащий целые строки заголовков, разделённые
+обратной косой чертой и n - двумя символами, поскольку строка конфигурации не
+может содержать конец строки. Аргумент нужно брать в кавычки, в заголовках есть
+пробелы. Заголовки и max-age правила отправляются с тем кодом, который правило
+задало, но не с отказом, который решил вернуть сам сервер: на запрос
+отсутствующего файла 404 отвечает сервер, а не правило.
+</p>
+<p>
+Неизвестные серверу типы регистрируются командой
+<code>http_content_type</code>, а тип, названный в правиле, используется
+независимо от имени файла:
+</p><pre>
+http_content_type .webp image/webp
+http_content_type wasm  application/wasm
+</pre>
+<p>
+<b>Файлы и даты.</b> Принимается только полный путь - относительный отсчитывался
+бы от того каталога, в котором оказался сервис, - а путь с элементом
+<code>.</code> или <code>..</code>, концом строки или звёздочкой отвергается. В
+Windows путь должен указывать диск или сетевой ресурс (<code>"C:\web\$1"</code>
+или <code>"\\host\share\$1"</code>). Запрос, который декодируется в путь за
+пределами дерева, отвергается раньше всего этого. Каждый ответ содержит
+Last-Modified, а запрос с If-Modified-Since получает 304 без тела, если файл не
+изменился.
+</p>
+<p>
+<b>Кэширование.</b> <code>cache</code> читает файл один раз и дальше отвечает из
+памяти; изменившийся на диске файл читается заново, а файл больше мегабайта
+отдаётся так же, как это сделал бы <code>file</code>. При заданном MAX-AGE файл
+не проверяется в течение этого времени - правило уже сообщило клиентам, что
+столько файл можно считать неизменным, - и запрос стоит только копирования
+наружу. Без MAX-AGE каждый запрос делает stat, и изменение подхватывается сразу.
+</p>
+<p>
+<b>Страница блокировки.</b> Сервис, отклоняющий запрос редиректом, может
+отправить клиента на httpsrv, работающий рядом:
+</p><pre>
+auth iponly
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow *
+proxy -p3128 -i192.168.1.1
+
+flush
+auth iponly
+allow *
+http file * /**  /usr/local/web/blocked.html text/html * * 403
+httpsrv -p8080 -i127.0.0.1
+</pre>
+<p>
+<b>И сайт, и прокси.</b> Запрос может прийти так, как приходит на сайт - путь,
+имя в заголовке Host, - или так, как приходит на прокси: с полным URL, либо, для
+туннеля, с одним именем хоста в CONNECT. Читается и то, и другое. Запрос в форме
+для прокси аутентифицируется через Proxy-Authorization и отклоняется кодом 407,
+как это делает прокси; запрос в форме для сайта - через Authorization и 401. Чем
+он будет обработан, в обоих случаях решают правила.
+</p>
+<p>
+<code>proxypass</code> - правило, которое отвечает, забирая ресурс, поэтому один
+сервис может отдавать своё и проксировать остальное:
+</p><pre>
+auth iponly
+allow *
+http file * /local/** "/usr/local/web/$1"
+http proxypass * /**
+httpsrv -p8080
+</pre>
+<p>
+Правило доступа с перенаправлением на локальный прокси делает то же самое без
+отдельного правила. Цепочка без адреса и означает "локальный прокси", а второй
+<code>allow</code> - то, с чем совпадает сам прокси на своём проходе, так как
+правило с цепочкой второй раз не берётся:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow *
+http file * /local/** "/usr/local/web/$1"
+httpsrv -p8080
+</pre>
+<p>
+Аутентификация по той же причине происходит дважды - для сервиса и для прокси, -
+поэтому конфигурация, требующая учётных данных, запрашивает их так, как это
+делает прокси.
+</p>
+<p>
+Правила доступа просматриваются с начала на обоих проходах, и назначение запроса
+известно на втором. На первом сервис отвечает сам за себя, поэтому адрес или порт
+в правиле сопоставляется с адресом, на который подключился клиент; имя из запроса
+сопоставляется на обоих проходах. На втором назначение - то, которое названо в
+запросе, поэтому правила с адресом, портом или именем определяют, что прокси
+разрешено забрать, и определяют это до установления соединения:
+</p><pre>
+auth iponly
+allow *
+parent 1000 http 0.0.0.0 0
+allow * * * 80,443
+deny *
+httpsrv -p8080
+</pre>
+<p>
+До правил доходит всё, забираются только порты 80 и 443, а <code>deny</code>,
+записанный до правила с цепочкой, действует на обоих проходах точно так же. Соединение с сервером сохраняется для следующего запроса и
+закрывается, если следующий запрос идёт в другое место или если сервер за это
+время его закрыл.
+</p>
+<p>
+<b>Соединения.</b> Клиент, обратившийся по HTTP/1.1, получает ответ 1.1, и
+соединение сохраняется для следующего запроса, если он не прислал
+<code>Connection: close</code>; клиенту 1.0 нужно запросить keep-alive явно.
+Соединение сохраняется только тогда, когда длина ответа известна точно - это
+верно для всех операций, кроме страниц администрирования, поэтому они всегда
+последнее, что отдаётся в соединении. Тело запроса, которое сервер не может
+дочитать до конца - присланное chunked или размером больше мегабайта, - тоже
+завершает соединение.
+</p>
+<p>
+<b>Администрирование.</b> Сервис <code>admin</code> - это httpsrv с уже
+объявленными страницами интерфейса администрирования, см.
+<a href="#ADMIN">Администрирование и анализ информации</a>. Правила можно
+добавлять перед ним так же, и они проверяются первыми.
+</p>
+ </p>
  <li><a name="SSLPLUGIN"><i>Как настроить TLS/SSL (https прокси, mTLS)</i></a>
 <p>
 Начиная с версии 0.9.7 поддержка TLS/SSL встроена в 3proxy при компиляции с OpenSSL
@@ -838,12 +1051,32 @@ ssl_nocli
 &#35; Генерация закрытого ключа CA
 openssl genrsa -out ca.key 4096
 
+&#35; Расширения, без которых сертификат не годится как CA
+cat > ca.ext << 'EOF'
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+
 &#35; Генерация сертификата CA (действителен 10 лет)
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+openssl req -new -nodes -key ca.key \
     -subj "/C=RU/ST=Region/L=City/O=MyOrg/CN=My CA" \
-    -out ca.crt
+    -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 </pre>
 <p>
+Расширения обязательны. Без <b>basicConstraints=CA:TRUE</b> и
+<b>keyCertSign</b> сертификат не принимается как CA, и клиент сообщает, что не
+может получить сертификат издателя. <b>subjectKeyIdentifier</b> — то, на что
+ссылаются подписанные этим CA сертификаты.
+</p>
+<p>
+Расширения задаются файлом, а не через <b>-addext</b>, потому что LibreSSL —
+команда <b>openssl</b> в macOS и некоторых BSD — обрабатывает -addext иначе,
+чем OpenSSL. Приведённый вариант одинаково работает в обоих.
+</p>
+<p>
 Для MITM импортируйте ca.crt в браузеры/ОС клиентов как доверенный корневой CA.
 </p>
 <p>
@@ -876,8 +1109,18 @@ EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 \
     -extfile server.ext
+
+&#35; Проверка так же, как это делает современный клиент
+openssl verify -x509_strict -CAfile ca.crt server.crt
 </pre>
 <p>
+Проверять следует строго, потому что именно так проверяет клиент. OpenSSL 3
+добавляет идентификаторы ключей при подписании, а LibreSSL — нет, поэтому файл
+расширений запрашивает их явно. Python начиная с 3.13 проверяет строго и
+отвергает сертификат без <b>authorityKeyIdentifier</b>; другие клиенты идут тем
+же путём.
+</p>
+<p>
 Для публичного https:// прокси используйте CA вроде Let's Encrypt вместо самоподписанного.
 </p>
 <p>
@@ -896,6 +1139,8 @@ cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 
 &#35; Подписание CA
@@ -918,8 +1163,14 @@ openssl pkcs12 -export -out client1.p12 \
 
 &#35; CA
 openssl genrsa -out ca.key 4096
-openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
-    -subj "/CN=3proxy CA" -out ca.crt
+cat > ca.ext << 'EOF'
+basicConstraints=critical,CA:TRUE
+keyUsage=critical,keyCertSign,cRLSign
+subjectKeyIdentifier=hash
+EOF
+openssl req -new -nodes -key ca.key -subj "/CN=3proxy CA" -out ca.csr
+openssl x509 -req -in ca.csr -signkey ca.key -sha256 -days 3650 \
+    -extfile ca.ext -out ca.crt
 
 &#35; Сервер
 openssl genrsa -out server.key 2048
@@ -929,6 +1180,8 @@ basicConstraints=CA:FALSE
 keyUsage = keyEncipherment
 extendedKeyUsage = serverAuth
 subjectAltName = DNS:localhost,DNS:proxy,IP:127.0.0.1
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out server.crt -days 365 -sha256 -extfile server.ext
@@ -939,13 +1192,189 @@ openssl req -new -key client.key -subj "/CN=client" -out client.csr
 cat > client.ext << 'EOF'
 basicConstraints=CA:FALSE
 extendedKeyUsage = clientAuth
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
 EOF
 openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
     -CAcreateserial -out client.crt -days 365 -sha256 -extfile client.ext
 openssl pkcs12 -export -out client.p12 -passout pass: \
     -inkey client.key -in client.crt -certfile ca.crt
+
+&#35; Оба должны пройти проверку, которую делает современный клиент
+openssl verify -x509_strict -CAfile ca.crt server.crt
+openssl verify -x509_strict -CAfile ca.crt client.crt
 </pre>
 
+
+ <li><a name="TRANSPARENT"><i>Как сделать транспарентный прокси</i></a>
+<p>
+Транспарентный прокси обслуживает клиентов, которые не настроены на работу
+через прокси. Пакетный фильтр перенаправляет их соединения на 3proxy, а команда
+<b>transparent</b> указывает сервису брать адрес назначения у фильтра, а не из
+запроса. Всё остальное работает как обычно: правила доступа, родительские
+прокси, ограничения и логирование видят настоящий адрес назначения. Работает в
+Linux и BSD. С версии 1.0.1 встроено в бинарник, раньше это был отдельный
+TransparentPlugin, и строка <b>plugin</b> больше не нужна.
+</p>
+<p>
+Команда даёт и адрес, и порт назначения, поэтому сервис обслуживает всё, что
+на него перенаправлено, а не один порт с одним адресом назначения.
+</p>
+<p>
+Без неё сервис берёт адрес откуда-то ещё: HTTP-прокси - из заголовка
+<b>Host</b>, порт-маппер - из своей конфигурации. Именно получение адреса от
+фильтра позволяет работать с остальными протоколами и делает адрес
+достоверным, а не заявленным клиентом.
+</p>
+<p>
+Нагляднее всего это с <b>tlspr</b>. Без перенаправления трафика (или без
+резолва имён на него через DNS) на него вообще ничего не попадёт. С
+перенаправлением он получает и имя из TLS handshake, и адрес назначения -
+именно это позволяет писать правила доступа по именам хостов: имя из handshake
+проверяется в ACL, а соединение идёт на тот адрес, куда шёл клиент. Без адреса
+пришлось бы резолвить имя самостоятельно, то есть делать ещё один запрос и
+получать ещё один ответ.
+</p>
+<p>
+Конфигурация для веб- и TLS-трафика:
+</p><pre>
+log /var/log/3proxy.log D
+auth iponly
+allow *
+
+&#35; для сервисов ниже адрес назначения берётся из перенаправления
+transparent
+
+&#35; обычный веб-трафик, перенаправленный сюда с порта 80
+proxy -p3129 -e192.0.2.10
+
+&#35; TLS, перенаправленный сюда с порта 443: без этого у tlspr было бы только
+&#35; имя из handshake, а так есть и адрес
+tlspr -p3143 -e192.0.2.10
+
+notransparent
+</pre>
+<p>
+<b>-e</b> задаёт сервисам собственный адрес для исходящих соединений. Именно
+этот адрес исключается в правилах перенаправления, и это исключение не даёт
+соединениям самого прокси попасть обратно в него. Без исключения соединение,
+которое 3proxy устанавливает к серверу назначения, попадает под то же правило,
+возвращается в 3proxy, и трафик зацикливается. Можно вместо этого запускать
+3proxy под отдельной учётной записью и исключать её - так лучше, если у машины
+один адрес.
+</p>
+
+<p><b>Linux, iptables</b>. Для транзитного трафика:
+</p><pre>
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80  -j REDIRECT --to-ports 3129
+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+</pre>
+<p>
+Трафик самой машины проходит через цепочку OUTPUT, где соединения прокси нужно
+исключить:
+</p><pre>
+&#35; по адресу, с которого сервисы устанавливают соединения
+iptables -t nat -A OUTPUT -p tcp --dport 80 ! -s 192.0.2.10 -j REDIRECT --to-ports 3129
+
+&#35; либо по учётной записи, под которой работает 3proxy
+iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner proxy3 \
+    -j REDIRECT --to-ports 3129
+</pre>
+
+<p><b>Linux, nftables</b> (Debian 11+, Ubuntu 22.04+, RHEL 8+, Fedora, Arch):
+</p><pre>
+table ip proxy3 {
+	chain prerouting {
+		type nat hook prerouting priority dstnat; policy accept;
+		iif "eth0" tcp dport 80 redirect to :3129
+		iif "eth0" tcp dport 443 redirect to :3143
+	}
+
+	chain output {
+		type nat hook output priority dstnat; policy accept;
+		meta skuid != "proxy3" tcp dport 80 redirect to :3129
+		meta skuid != "proxy3" tcp dport 443 redirect to :3143
+	}
+}
+</pre>
+<p>
+Загружается через <b>nft -f</b>, сохраняется в <b>/etc/nftables.conf</b>
+(Debian, Ubuntu) или <b>/etc/sysconfig/nftables.conf</b> (RHEL, Fedora). Имя
+таблицы не может начинаться с цифры, поэтому таблица называется не 3proxy.
+</p>
+
+<p><b>Linux, firewalld</b> (RHEL, CentOS Stream, Fedora, openSUSE):
+</p><pre>
+firewall-cmd --permanent --zone=internal --add-forward-port=port=80:proto=tcp:toport=3129
+firewall-cmd --permanent --zone=internal --add-forward-port=port=443:proto=tcp:toport=3143
+firewall-cmd --reload
+</pre>
+<p>
+Исключение для трафика самого прокси в таком виде не задаётся, для него нужно
+прямое правило:
+</p><pre>
+firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 \
+    -p tcp --dport 80 -m owner ! --uid-owner proxy3 -j REDIRECT --to-ports 3129
+firewall-cmd --reload
+</pre>
+
+<p><b>Linux, ufw</b> (Ubuntu, Debian). В ufw нет команды для перенаправления,
+правила добавляются в <b>/etc/ufw/before.rules</b> перед блоком <b>*filter</b>:
+</p><pre>
+*nat
+:PREROUTING ACCEPT [0:0]
+-A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3129
+-A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 3143
+COMMIT
+</pre>
+
+<p>
+В Linux 3proxy спрашивает у ядра, куда шло соединение. В BSD он спрашивает у pf,
+который хранит исходный адрес назначения в таблице состояний, через
+<b>/dev/pf</b> - поэтому работают правила <b>rdr</b>, и 3proxy должен иметь
+доступ к этому устройству. Если перенаправление оставляет адрес на самом сокете,
+используется он: так делают OpenBSD <b>divert-to</b> и FreeBSD <b>ipfw fwd</b>.
+</p>
+<p>
+Механизм выбирается автоматически, а команда <b>transparent</b> принимает
+аргумент для случаев, когда его надо зафиксировать: <b>auto</b> (по умолчанию),
+<b>netfilter</b>, <b>pf</b> или <b>socket</b> для чтения адреса с сокета. Режим,
+которого нет в сборке, отвергается, поэтому конфигурация, написанная для другой
+платформы, не запустится вместо того, чтобы молча делать что-то другое.
+</p>
+
+<p><b>FreeBSD, NetBSD, OpenBSD, pf</b>. Перенаправление в <b>/etc/pf.conf</b> с
+исключением адреса, с которого соединяется прокси:
+</p><pre>
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 80  -&gt; 127.0.0.1 port 3129
+rdr pass on em0 inet proto tcp from ! 192.0.2.10 to any port 443 -&gt; 127.0.0.1 port 3143
+</pre>
+<p>
+Загружается через <b>pfctl -f /etc/pf.conf</b>. 3proxy ищет адрес назначения в
+таблице состояний pf, поэтому ему нужен доступ на чтение к <b>/dev/pf</b>: либо
+запуск от root, либо права на устройство для его учётной записи.
+</p>
+
+<p><b>OpenBSD, divert-to</b> - альтернатива, оставляющая адрес на сокете, доступ
+к <b>/dev/pf</b> при этом не нужен:
+</p><pre>
+pass in on em0 inet proto tcp to any port 80  divert-to 127.0.0.1 port 3129
+pass in on em0 inet proto tcp to any port 443 divert-to 127.0.0.1 port 3143
+</pre>
+
+<p><b>FreeBSD, ipfw</b>. <b>fwd</b> доставляет соединение локально, не переписывая
+его, и адрес тоже остаётся на сокете:
+</p><pre>
+ipfw add fwd 127.0.0.1,3129 tcp from any to any 80  in recv em0
+ipfw add fwd 127.0.0.1,3143 tcp from any to any 443 in recv em0
+</pre>
+
+<p><b>macOS</b>: <b>/dev/pf</b> есть, но заголовочных файлов для него нет,
+поэтому в сборке под macOS нет обращения к pf, а ни <b>divert-to</b>, ни ipfw в
+macOS нет. Транспарентное проксирование там неприменимо, хотя команды в сборке
+присутствуют.
+</p>
+
  <li><a name="PCRE"><i>Как использовать PCRE-фильтрацию (регулярные выражения)</i></a>
 <p>
 Начиная с версии 0.9.7 фильтрация PCRE встроена в 3proxy при компиляции с поддержкой
@@ -1004,6 +1433,34 @@ pcre_extend deny * 192.168.0.1/16
 <p>
 <b>Примечание:</b> Регулярные выражения не требуют авторизации и не могут заменить
 авторизацию и/или ACL allow/deny.
+</p>
+<p>
+<b>Регулярные выражения в именах хостов:</b> имя хоста в списке назначения
+правила доступа может быть записано регулярным выражением вместо маски, для
+этого используется префикс <code>pcre:</code> (<code>regex:</code> означает то
+же самое). Требуется сборка с поддержкой PCRE, как и для команд
+<code>pcre</code> выше.
+</p><pre>
+&#35; Маска: имя сопоставляется только с начала и с конца
+deny * * *ads.example.com
+
+&#35; Регулярное выражение: всё, что выразимо средствами PCRE
+deny * * "pcre:^(ads|track)[0-9]*\.example\.(com|net)$"
+allow * * "pcre:^(www|api)\.example\.com$"
+</pre>
+<p>
+Перед сопоставлением имя приводится к нижнему регистру, завершающие точки
+удаляются, поэтому шаблоны пишутся в нижнем регистре. Шаблон, оканчивающийся на
+<code>$</code>, нужно взять в кавычки или записать как <code>$$</code>: вне
+кавычек одиночный доллар начинает имя включаемого файла. Имена допустимы только
+в списке назначения (список источника - адреса), и имя проверяется лишь тогда,
+когда оно присутствует в запросе. Маска обходится дешевле и достаточна для
+большинства правил, регулярное выражение сопоставляется на каждый запрос.
+</p>
+<p>
+Тот же префикс и те же шаблоны использует команда <code>http</code> встроенного
+HTTP-сервера - для хоста, на который отвечает правило, и для URL, который оно
+сопоставляет.
 </p>
 
  <li><a name="AUTH"><i>Как ограничить доступ к службе</i></a>

doc/html/man5/3proxy.cfg.5.html

@@ -18,6 +18,14 @@
 <a href="#PCRE FILTERING">PCRE FILTERING</a><br>
 <a href="#PCRE Commands">PCRE Commands</a><br>
 <a href="#PCRE Parameters">PCRE Parameters</a><br>
+<a href="#BUILT IN HTTP SERVER">BUILT IN HTTP SERVER</a><br>
+<a href="#Operations">Operations</a><br>
+<a href="#What a rule adds to the answer">What a rule adds to the answer</a><br>
+<a href="#Patterns">Patterns</a><br>
+<a href="#Both a site and a proxy">Both a site and a proxy</a><br>
+<a href="#Connections">Connections</a><br>
+<a href="#Paths a rule builds">Paths a rule builds</a><br>
+<a href="#Examples">Examples</a><br>
 <a href="#BUGS">BUGS</a><br>
 <a href="#SEE ALSO">SEE ALSO</a><br>
 <a href="#AUTHORS">AUTHORS</a><br>
@@ -77,8 +85,10 @@ characters) is treated as space character (arguments
 delimiter instead of end of command delimiter). Thus,
 include files are only useful to store long single-line
 commands (like userlist, network lists, etc). To use dollar
-sign somewhere in argument it must be quoted. Recursion is
-not allowed.</p>
+sign somewhere in argument it must be quoted or doubled:
+inside quotes a dollar is ordinary text, and <b>$$</b>
+stands for a single dollar and is not read as an include.
+Recursion is not allowed.</p>
 
 <p style="margin-left:9%; margin-top: 1em">Next commands
 start gateway services:</p>
@@ -124,7 +134,9 @@ udppm</b> UDP portmapper</p>
 <b><br>
 -6</b> Only resolve IPv6 addresses. IPv4 addresses are
 packed in IPv6 in IPV6_V6ONLY compatible way. <b><br>
--4</b> Only resolve IPv4 addresses <b><br>
+-4</b> Only resolve IPv4 addresses. This is the default: a
+service reaches an IPv6 address only when told to with
+<b>-6</b>, <b>-46</b> or <b>-64</b>. <b><br>
 -46</b> Prefer IPv4. Resolve IPv6 addresses if IPv4 address
 is not resolvable <b><br>
 -64</b> Prefer IPv6. Resolve IPv4 addresses if IPv6 address
@@ -292,16 +304,7 @@ Include config file</p>
 
 <p style="margin-left:9%; margin-top: 1em"><b>config</b>
 <i>&lt;path&gt;</i> <br>
-Path to configuration file to use on 3proxy restart or to
-save configuration.</p>
-
-<p style="margin-left:9%; margin-top: 1em"><b>writable</b>
-<br>
-ReOpens configuration file for write access via Web
-interface, and rereads it. Usually should be first command
-on config file but in combination with config it can be used
-anywhere to open alternate config file. Think twice before
-using it.</p>
+Path to configuration file to use on 3proxy restart.</p>
 
 <p style="margin-left:9%; margin-top: 1em"><b>end</b> <br>
 End of configuration</p>
@@ -504,14 +507,23 @@ the same as for nserver.</p>
 Cache <i>&lt;cachesize&gt;</i> records for name resolution
 (<b>nscache</b> for IPv4, <b>nscache6</b> for IPv6). The
 cache size should usually be large enough (for example,
-65536).</p>
+65536). The two are separate: a name that resolves to an
+IPv6 address, including one given with <b>nsrecord</b>, is
+only held when <b>nscache6</b> is configured, and
+<b>nscache</b> does nothing for it. Both caches are global
+rather than per-service.</p>
 
 <p style="margin-left:9%; margin-top: 1em"><b>nsrecord</b>
 <i>&lt;hostname&gt; &lt;hostaddr&gt;</i> <br>
 Adds static record to nscache. <b>nscache</b> must be
-enabled. If 0.0.0.0 is used as a hostaddr host will never
-resolve, it can be used to blacklist something or together
-with <b>dialer</b> command to set up UDL for dialing.</p>
+enabled and must come first, because the record is placed in
+the table it allocates - <b>nscache6</b> for a record naming
+an IPv6 address - and <b>nserver</b> must be set as well:
+without it the system resolver is used and static records
+are never consulted. If 0.0.0.0 is used as a hostaddr host
+will never resolve, it can be used to blacklist something or
+together with <b>dialer</b> command to set up UDL for
+dialing.</p>
 
 
 <p style="margin-left:9%; margin-top: 1em"><b>fakeresolve</b>
@@ -704,9 +716,24 @@ A.B.C.D - W.X.Y.Z (since 0.8) or CIDRs (W.X.Y.Z/L). Since
 addresses. It&acute;s possible to use a wildmask in the
 beginning and at the end of the hostname, e.g. *badsite.com
 or *badcontent*. The hostname is only checked if a hostname
-is present in the request. Targetportlist may contain ports
-(X) or port ranges lists (X-Y). For any field * sign means
-ANY. If access list is empty it&acute;s assumed to be <br>
+is present in the request. A name written with a
+<b>pcre:</b> prefix (<b>regex:</b> is the same thing) is a
+regular expression instead of a wildmask, in a build with
+PCRE support: <br>
+deny * *
+&quot;pcre:&#710;(ads|track)[0-9]*\.example\.(com|net)$&quot;
+<br>
+The name is lowercased and any trailing dots are removed
+before it is matched, so patterns are written in lower case.
+A pattern ending in <b>$</b> has to be quoted or written
+<b>$$</b>, since a lone dollar outside quotes begins the
+name of a file to include. The same patterns, and the same
+prefix, are used by the <b>http</b> command, see BUILT IN
+HTTP SERVER. Regular expressions are matched per request and
+cost more than a wildmask, which is enough for most rules.
+Targetportlist may contain ports (X) or port ranges lists
+(X-Y). For any field * sign means ANY. If access list is
+empty it&acute;s assumed to be <br>
 allow * <br>
 If access list is not empty last item in access list is
 assumed to be <br>
@@ -825,6 +852,31 @@ the external address for this request to <i>&lt;ip&gt;</i>.
 It can be chained with another parent type. It&rsquo;s
 useful to set the external IP based on ACL or make it
 random. <b><br>
+extport</b> does not redirect the request; it sets the range
+the local port of outgoing connections is taken from, given
+as <i>FIRST-LAST</i> inclusive in place of the port
+argument, with 0.0.0.0 as the address, for example <b>parent
+1000 extport 0.0.0.0 40000-40100</b>. Where the system can
+be asked to pick the port itself (Linux
+<b>IP_LOCAL_PORT_RANGE</b>) it does, otherwise a port is
+picked at random from the range and retried if it is already
+in use, up to ten times. On Linux the range has to lie
+within <i>net.ipv4.ip_local_port_range</i>, commonly
+32768-60999: the kernel ignores a range outside it and picks
+an ordinary ephemeral port instead. If no port in the range
+can be bound, an ephemeral port is used rather than failing
+the connection. It can be chained with another parent type,
+and the access rule it belongs to decides which requests it
+applies to, so <b>allow * * * * UDPASSOC</b> followed by
+<b>parent 1000 extport 0.0.0.0 40000-40100</b> limits it to
+UDP associations. The range is applied when the outgoing
+connection is made, so a kept alive connection carrying
+several requests uses the rule that matched when it was
+opened. <b><br>
+intport</b> is the same for sockets bound on the side facing
+the client: the port a UDP association tells the client to
+send its datagrams to, and the FTP proxy data connection.
+<b><br>
 tcp</b> simply redirect connection. TCP is always last in
 chain. This type of proxy is a simple TCP redirection, it
 does not support parent authentication. <b><br>
@@ -1088,6 +1140,57 @@ users &quot;test4:CR:$3$salt$G47yV9w....&quot; <br>
 Note: double quotes are required because the password
 contains a $ sign.</p>
 
+
+<p style="margin-left:9%; margin-top: 1em"><b>transparent</b>
+<i>[auto|netfilter|pf|socket]</i> <br>
+Take the destination of a connection, both address and port,
+from the packet filter that redirected it, instead of from
+the request. It applies to services declared after it, and
+<b>notransparent</b> turns it off again for the services
+after that. Built into the binary since 1.0.1, and
+previously the separate TransparentPlugin. <br>
+On Linux the kernel is asked, so <b>iptables</b> or
+<b>nftables</b> redirection is enough. On the BSDs pf is
+asked through <b>/dev/pf</b>, which 3proxy must be able to
+read, so <b>rdr</b> rules work; a redirection that leaves
+the destination on the socket is used where there is one, as
+<b>divert-to</b> on OpenBSD and <b>ipfw fwd</b> on FreeBSD
+do. macOS ships no header for pf and has neither of those,
+so the commands exist in a macOS build but cannot be used.
+<br>
+The mechanism is chosen automatically. The optional argument
+pins it for an installation that has more than one:
+<b>auto</b> is the default, <b>netfilter</b> asks the Linux
+kernel, <b>pf</b> looks the connection up in the packet
+filter, and <b>socket</b> reads the address off the socket.
+A mode the build has no code for is refused rather than
+ignored. <br>
+A connection that reaches a <b>socket</b> mode service
+without having been redirected is refused: its destination
+is the address the service listens on, and using that would
+send the service to itself. <br>
+A redirected connection carries no destination of its own,
+so without this the service uses whatever it would use
+otherwise: the <b>Host</b> header for an HTTP request, or
+the address a port mapper was configured with. <b>tlspr</b>
+receives nothing at all unless traffic is redirected to it
+or the clients resolve names to it, and with a redirection
+it has the address as well as the name from the handshake,
+which is what allows access rules to be written with host
+names. With it, every service reaches the address the client
+was trying to reach, and access rules, parents, limits and
+logging apply to it as usual. <br>
+The redirection rules must not match the connections the
+proxy itself makes to those destinations, or the traffic
+returns to the proxy and loops. Give the service an outgoing
+address with <b>-e</b> and exclude that address in the
+rules, or run 3proxy as its own user and exclude that user.
+See the <b>TRANSPARENT PROXYING</b> section of the
+documentation for rules per platform. <b><br>
+notransparent</b> <br>
+Stop taking the destination from the packet filter for the
+services declared after it.</p>
+
 <p style="margin-left:9%; margin-top: 1em"><b>flush</b>
 <br>
 empty the active access list. The access list must be
@@ -1328,7 +1431,7 @@ Apply a rule for matching regular expression. <b><br>
 pcre_rewrite</b> <i>TYPE FILTER_ACTION REGEXP
 REWRITE_EXPRESSION [ACE]</i> <br>
 Match and replace with rewrite expression. <b><br>
-pcre_extend</b> <i>FILTER_ACTION [ACE]</i> <br>
+pcre_extend</b> <i>ACE</i> <br>
 Extend the ACL of the last pcre or pcre_rewrite command by
 adding an additional ACE. <b><br>
 pcre_options</b> <i>OPTION1 [OPTION2 ...]</i> <br>
@@ -1350,8 +1453,17 @@ PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CALLOUT,
 PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART,
 PCRE_FIRSTLINE, PCRE_DUPNAMES, PCRE_NEWLINE_CR,
 PCRE_NEWLINE_LF, PCRE_NEWLINE_CRLF, PCRE_NEWLINE_ANY,
-PCRE_NEWLINE_ANYCRLF, PCRE_BSR_ANYCRLF,
-PCRE_BSR_UNICODE.</p>
+PCRE_NEWLINE_ANYCRLF, PCRE_BSR_ANYCRLF, PCRE_BSR_UNICODE.
+<br>
+These options apply to every pattern the configuration
+compiles, the host patterns of access rules and <b>http</b>
+rules included, so set them before the rules which are to
+use them. <br>
+Regular expressions are not only for these commands: a host
+name in the target list of an access rule, and the host and
+URL of an <b>http</b> rule, take one when it is written with
+a <b>pcre:</b> prefix. See <b>allow</b> and BUILT IN HTTP
+SERVER.</p>
 
 <h3>PCRE Parameters
 <a name="PCRE Parameters"></a>
@@ -1387,7 +1499,14 @@ required.</p>
 - substitution string. May contain Perl-style substrings $1,
 $2, etc. $0 means the whole matched string. \r and \n may be
 used to insert new lines; the string may be empty
-(&quot;&quot;).</p>
+(&quot;&quot;). <br>
+A rewritten request is what the server receives. The
+destination is chosen, and the access rules are applied to
+it, before the filters run, so a rewrite that names another
+host or changes the method is logged but not acted on: the
+request is still sent where the access rules allowed.
+Rewriting the path or the query works on a direct connection
+and through a parent alike.</p>
 
 <p style="margin-left:9%; margin-top: 1em">ACE - access
 control entry (user names, source IPs, destination IPs,
@@ -1397,6 +1516,264 @@ the connection data. Warning: Regular expressions
 don&rsquo;t require authentication and cannot replace
 authentication and/or allow/deny ACLs.</p>
 
+<h2>BUILT IN HTTP SERVER
+<a name="BUILT IN HTTP SERVER"></a>
+</h2>
+
+
+<p style="margin-left:9%; margin-top: 1em">The
+<b>httpsrv</b> service answers requests itself instead of
+forwarding them. What it does with a request is decided by
+<b>http</b> rules, which are taken in the order they are
+written: the first whose host and URL both match handles the
+request. Rules belong to the service that follows them, the
+way access rules do, and <b>admin</b> is <b>httpsrv</b> with
+a set of rules already in place.</p>
+
+<p style="margin-left:9%; margin-top: 1em"><b>http</b>
+<i>OPERATION HOST URL [PARAMETERS]</i> <br>
+Handle a request for <i>URL</i> on <i>HOST</i> with
+<i>OPERATION</i>. HOST is matched against the Host header,
+URL against the path, with the query string removed.</p>
+
+<h3>Operations
+<a name="Operations"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em"><b>file</b>
+<i>PATH [TYPE [MAX-AGE [HEADERS [CODE]]]]</i> - send the
+file at PATH. The file is handed to the socket by the system
+where it can do that (sendfile, TransmitFile) and read here
+where it cannot, as when the connection carries TLS. The
+arguments after PATH are described below, and each of them
+may be written as <b>*</b> to leave it out. <b><br>
+cache</b> <i>PATH [TYPE [MAX-AGE [HEADERS [CODE]]]]</i> -
+the same, but the file is read into memory on the first
+request and answered from there afterwards. A file that has
+changed on disk is read again, and one larger than a
+megabyte is sent as <b>file</b> would. With a MAX-AGE the
+file is not looked at again for that long: the rule has
+already told clients the file may be treated as unchanged
+for that time, so the server treats its own copy the same
+way and a request costs nothing but the copy out. Without
+one every request stats the file, so a change is picked up
+at once. <b><br>
+reply</b> <i>[CODE [HEADERS]]</i> - answer with a status and
+nothing else. CODE is the status to send, 200 without one. A
+status which carries no body of its own (1xx, 204, 304) is
+sent without a length; anything else is sent with a length
+of zero. <b><br>
+redir</b> <i>[CODE] LOCATION</i> - answer with a redirect.
+CODE is 301 or 302, or any status from 300 to 399; without
+one, 302 is used. <b><br>
+rewrite</b> <i>PATH</i> - change the path of the request and
+hand it to the rules that follow this one. <b><br>
+rewrite_host</b> <i>HOST</i> - the same for the host, which
+decides which of the rules after it match. <b>$1</b> upwards
+stand for what the stars, or the groups, of this
+rule&acute;s host pattern matched, the way they stand for
+those of the URL in a <b>rewrite</b>. What is built has to
+be a host name; the name the client sent is what access
+rules matched and what the log records. <b><br>
+echo</b> - answer with a description of the request: the
+method, path, query, host, and the address and port it came
+from. For testing. <b><br>
+data</b> <i>[size=N] [block=N] [status=N] [chunked=1]
+[delay=N]</i> - answer with generated content of the size
+asked for. For testing. <b><br>
+proxypass</b> - hand the request to the proxy code, which
+fetches it the way <b>proxy</b> would, see BOTH A SITE AND A
+PROXY. <b><br>
+admin</b>, <b>admin_counters</b>, <b>admin_reload</b>,
+<b>admin_services</b> - the pages of the administration
+interface.</p>
+
+<h3>What a rule adds to the answer
+<a name="What a rule adds to the answer"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em"><b>TYPE</b> is
+the content type to answer with. Without it, or with
+<b>*</b>, the type is worked out from the name of the file,
+see <b>http_content_type</b>. <b><br>
+MAX-AGE</b> is a number of seconds, and is sent as
+Cache-Control: max-age. Without it, or with <b>*</b>,
+nothing is said about caching. <b><br>
+HEADERS</b> is one argument holding whole header lines,
+separated by a backslash and an n - the two characters,
+since a configuration line cannot carry a line ending. Each
+becomes a real line ending in the answer. Quote the argument
+if any header holds a space, which they usually do. <b><br>
+CODE</b> is the status to answer with instead of 200, which
+is how a file serves as the body of an error page. <br>
+A rule&rsquo;s headers and MAX-AGE go with whatever status
+that rule asked for. They are not sent with a refusal the
+server itself decided on: a request for a file which is not
+there is answered 404 by the server, not by the rule.
+<b><br>
+file</b> and <b>cache</b> send Last-Modified, and answer a
+request carrying If-Modified-Since with 304 and no body when
+the file has not changed since the time it names. All three
+date formats HTTP allows are read; one which cannot be read
+is treated as no date at all. A rule answering with a CODE
+of its own is answering something other than the file, so it
+is never turned into a 304. <br>
+http file * /err/** &quot;/usr/local/web/404.html&quot;
+text/html * &quot;X-Served: static&quot; 404 <br>
+http reply * /health** 200 &quot;X-Health: ok&quot; <br>
+http reply * /down** 503 &quot;Retry-After: 30&quot;</p>
+
+
+<p style="margin-left:9%; margin-top: 1em"><b>http_content_type</b>
+<i>EXTENSION TYPE</i> <br>
+Answer for a file with that extension with that content
+type, in addition to the types already known. The extension
+may be written with or without its dot. A type named by a
+rule is used whatever this says, and a name the server knows
+nothing about is answered as application/octet-stream. <br>
+http_content_type .webp image/webp</p>
+
+<h3>Patterns
+<a name="Patterns"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em">A URL is matched
+with stars, or with a regular expression when it carries a
+<b>pcre:</b> prefix (<b>regex:</b> is taken as well). A host
+is matched the way an access list matches one, and takes the
+same prefix. <b><br>
+*</b> stands for any run of characters within one element of
+the path: it does not cross a <b>/</b>, so a rule cannot
+reach into a directory it did not name. <b><br>
+**</b> crosses them, and is what a rule which should match
+everything below a point, or everything at all, is written
+with. <br>
+Each star, and each group of a regular expression, is
+remembered in the order it appears. <b>$1</b> upwards stand
+for them in the path or location a rule builds, and
+<b>$0</b> for the whole request path. <br>
+Outside quotes a dollar begins the name of a file to
+include, so an argument holding one - a path or location
+built with <b>$1</b>, a regular expression anchored with
+<b>$</b> - is written in quotes. <b>$$</b> stands for a
+single dollar and is not read as an include either, which is
+how a dollar reaches a rule as text.</p>
+
+<h3>Both a site and a proxy
+<a name="Both a site and a proxy"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em">A request may
+arrive the way it arrives at a site, naming a path and a
+host in the Host header, or the way it arrives at a proxy,
+naming the whole URL, or, for a tunnel, the host alone with
+CONNECT. Both are read. A request in the proxy form
+authenticates with Proxy-Authorization and is refused with
+407, as a proxy refuses one; a request in the site form uses
+Authorization and 401. <br>
+What answers a request is still decided by the rules.
+<b>proxypass</b> is the rule which answers by fetching, so a
+service can serve what it has and proxy the rest: <br>
+http file * /local/** &quot;/usr/local/web/$1&quot; <br>
+http proxypass * /** <br>
+httpsrv -p8080 <br>
+The same happens without a rule for it where an access rule
+redirects to the local proxy, which is written as a chain of
+no address: the rules are asked first, and a request none of
+them answers is fetched. <br>
+allow * <br>
+parent 1000 http 0.0.0.0 0 <br>
+allow * <br>
+The second <b>allow</b> is what the proxy matches on the
+pass it makes itself: a rule carrying the chain is not taken
+twice. Authentication happens twice for the same reason,
+once for the service and once for the proxy, so a
+configuration asking for credentials asks for them as a
+proxy does. <br>
+The access rules are read from the top on both passes, and
+it is the second pass which describes where the request is
+going. On the first one the service is answering for itself,
+so the destination an address or a port is matched against
+is the address the client connected to; the name from the
+request is matched on both. On the second the destination is
+the one the request names, so rules written with an address,
+a port or a name decide what the proxy is allowed to fetch,
+and they decide it before the connection is made: <br>
+allow * <br>
+parent 1000 http 0.0.0.0 0 <br>
+allow * * * 80,443 <br>
+deny * <br>
+Everything reaches the rules, and only ports 80 and 443 are
+fetched. A rule before the one carrying the chain applies on
+both passes just the same, so a <b>deny</b> written there
+stops the request as well. <br>
+The connection to the server is kept for the request after
+it, and closed when the request after it goes somewhere
+else, or when the server has closed it in the meantime. A
+tunnel is fetched by the proxy code as well, which means the
+connection carrying it belongs to that request alone.</p>
+
+<h3>Connections
+<a name="Connections"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em">An answer is
+sent as HTTP/1.1 to a client which asked in HTTP/1.1, and
+the connection is kept for the next request unless the
+client sent <b>Connection: close</b>. A 1.0 client gets a
+1.0 answer, and the connection is kept only when it asked
+with <b>Connection: keep-alive</b>. <br>
+The connection is kept only when what was sent is framed
+exactly: every operation but the administration pages states
+a length, or sends a chunked body a 1.1 client can read, so
+the pages of <b>admin</b> are always the last thing on a
+connection. A request body which cannot be read to its end
+ends the connection as well: one sent with
+<b>Transfer-Encoding</b>, which this server does not read,
+and one longer than a megabyte, which it will not.</p>
+
+<h3>Paths a rule builds
+<a name="Paths a rule builds"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em">The path a rule
+builds is used as it is, so it is refused rather than
+corrected when it is not a plain full path. A relative path
+is refused: it would be read against whatever directory the
+service happens to be in. So is one holding <b>.</b> or
+<b>..</b> as an element, a carriage return, a newline or a
+star. On Windows a path must name a drive or a share, and is
+converted to the extended \\?\ form and opened through the
+wide interface, so a long path works. <br>
+A request is checked before any of this: a path which
+decodes to one leaving the tree is refused outright.</p>
+
+<h3>Examples
+<a name="Examples"></a>
+</h3>
+
+
+<p style="margin-left:9%; margin-top: 1em">http file
+example.com /my/webpath/*.html
+&quot;/usr/local/web/$1.html&quot; <br>
+http cache example.com
+&quot;pcre:&#710;/(.*)/pic/(.*).(gif|jpeg)$&quot;
+&quot;/usr/local/web/picts/$1/$2.$3&quot; <br>
+http redir * /old/** 301 &quot;https://example.org/$1&quot;
+<br>
+http rewrite * /alias/** &quot;/w/$1&quot; <br>
+http rewrite_host *.old.example **
+&quot;$1.new.example&quot; <br>
+http file * /static/** &quot;/usr/local/web/static/$1&quot;
+<br>
+httpsrv -p8080</p>
+
 <h2>BUGS
 <a name="BUGS"></a>
 </h2>

doc/html/plugins/TransparentPlugin.html

@@ -1,31 +1,56 @@
-<h3>3proxy TransparentPlugin (Linux/BSD only)</h3>
+<h3>3proxy transparent proxying (Linux/BSD only)</h3>
 
-This plugin can turn 3proxy into a transparent proxy for virtually any TCP-based protocol
-and use all 3proxy features - redirections, parent proxies, ACLs, traffic limitations,
-etc. The TransparentPlugin takes the destination IP:port from Linux and uses this
-information as the target IP in the proxy. An example usage:
+Transparent proxying is part of 3proxy itself since 1.0.1. It was the separate
+TransparentPlugin before that, and the <b>plugin</b> line that used to load it
+is no longer needed: the <b>transparent</b> and <b>notransparent</b> commands
+are always available on the platforms that can redirect a connection.
+
+<p>
+It turns 3proxy into a transparent proxy for virtually any TCP-based protocol,
+with the rest of 3proxy applying as usual - redirections, parent proxies, ACLs,
+traffic limitations and logging. The destination IP and port come from the
+packet filter that redirected the connection, and are used as the target of the
+proxied connection.
+</p>
 
 <pre>
-plugin /path/to/TransparentPlugin.ld.so transparent_plugin
 log /path/to/log
 auth iponly
 allow * * * 80
 parent 1000 http 0.0.0.0 0
 allow *
 parent 1000 socks5 SOCKS5_IP SOCKS5_PORT USER PASSWORD
+
 transparent
-tcppm -iLOCAL_IP 12345 127.0.0.1 11111
+tcppm -eLOCAL_IP 12345 127.0.0.1 11111
 notransparent
 proxy
 </pre>
-Now, any TCP traffic transparently redirected to port 12345 will be routed via
-the parent SOCKSv5 proxy and logged; all URLs for web requests are visible in logs.
-The parameters '127.0.0.1 11111' in this case are not used and are overwritten by
-the destination IP:port for each transparent connection.
 
-<h4>Download:</h4>
-<ul>
- <li>Plugin is included in 3proxy 0.8
-</li></ul>
+<p>
+Any TCP traffic redirected to port 12345 is routed through the parent SOCKSv5
+proxy and logged, with the URLs of web requests visible in the log. The
+'127.0.0.1 11111' arguments are not used in that case: they are replaced by the
+destination the client was trying to reach.
+</p>
+
+<p>
+The destination is looked up in pf on the BSDs, through <b>/dev/pf</b>, and
+asked of the kernel on Linux; a redirection that leaves the address on the
+socket is used where there is one. <b>transparent</b> takes an optional
+<b>auto</b>, <b>netfilter</b>, <b>pf</b> or <b>socket</b> to pin that choice.
+</p>
+<p>
+The redirection rules must not match the connections 3proxy itself makes, or
+the traffic returns to the proxy and loops. Give the service an address to
+connect from with <b>-e</b> and exclude it in the rules, or run 3proxy as its
+own account and exclude that account.
+</p>
+
+<p>
+Redirection rules for iptables, nftables, firewalld, ufw and pf are in
+<a href="../howtoe.html#TRANSPARENT">How to proxy transparently</a>, and the
+commands are described in 3proxy.cfg(5).
+</p>
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/plugins/TransparentPlugin.ru.html

@@ -1,33 +1,56 @@
-<h3>Плагин TransparentPlugin 3proxy (только для Linux/BSD)</h3>
+<h3>Транспарентное проксирование 3proxy (только для Linux/BSD)</h3>
 
-Плагин превращает 3proxy в транспарентный прокси для практически любых TCP-соединений
-и позволяет прозрачно для клиентов использовать весь фунционал прокси - редиректоры,
-родительские прокси, ACLи, ограничения трафика. TransparentPlugin получает IP:port
-назначения от Linux  и использует эту информацию в качестве конечного адреса назначения.
-<br>
-Пример использования:
+Начиная с 1.0.1 транспарентное проксирование встроено в 3proxy. Раньше это был
+отдельный TransparentPlugin, и строка <b>plugin</b>, которой он загружался,
+больше не нужна: команды <b>transparent</b> и <b>notransparent</b> доступны
+всегда на тех платформах, где соединение можно перенаправить.
+
+<p>
+3proxy становится транспарентным прокси практически для любых TCP-соединений,
+причём весь остальной функционал работает как обычно - редиректоры,
+родительские прокси, ACLи, ограничения трафика и логирование. IP и порт
+назначения берутся у пакетного фильтра, перенаправившего соединение, и
+используются как адрес назначения проксируемого соединения.
+</p>
 
 <pre>
-plugin /path/to/TransparentPlugin.ld.so transparent_plugin
 log /path/to/log
 auth iponly
 allow * * * 80
 parent 1000 http 0.0.0.0 0
 allow *
 parent 1000 socks5 SOCKS5_IP SOCKS5_PORT USER PASSWORD
+
 transparent
-tcppm -iLOCAL_IP 12345 127.0.0.1 11111
+tcppm -eLOCAL_IP 12345 127.0.0.1 11111
 notransparent
 proxy
 </pre>
-Теперь любые TCP-соединения транспарентно перенаправленные в локальный порт 12345 
-будут прологгированы и перенаправлены в родительский SOCKSv5 proxy, при этом для
-HTTP-запросов по порту TCP/80 будут видны параметры HTTP-запроса.
-Параметры '127.0.0.1 11111' в данном случае не оказывают влияния, т.к.
-будут перезаписываться IP и портом назначения для каждого TCP-соединения соответственно.
-<h4>Загрузить:</h4>
-<ul>
- <li>Плагин включен в дистрибутив 3proxy 0.8
-</li></ul>
+
+<p>
+Любой TCP-трафик, перенаправленный на порт 12345, пойдёт через родительский
+SOCKSv5 прокси и будет залогирован, URL веб-запросов видны в логе. Аргументы
+'127.0.0.1 11111' в этом случае не используются: они заменяются адресом, к
+которому обращался клиент.
+</p>
+
+<p>
+В BSD адрес назначения ищется в pf через <b>/dev/pf</b>, в Linux запрашивается у
+ядра; если перенаправление оставляет адрес на сокете, используется он. Команда
+<b>transparent</b> принимает необязательный аргумент <b>auto</b>,
+<b>netfilter</b>, <b>pf</b> или <b>socket</b>, чтобы зафиксировать выбор.
+</p>
+<p>
+Правила перенаправления не должны попадать на соединения, которые устанавливает
+сам 3proxy, иначе трафик возвращается в прокси и зацикливается. Задайте сервису
+адрес для исходящих соединений через <b>-e</b> и исключите его в правилах, либо
+запускайте 3proxy под отдельной учётной записью и исключайте её.
+</p>
+
+<p>
+Правила перенаправления для iptables, nftables, firewalld, ufw и pf приведены в
+<a href="../howtor.html#TRANSPARENT">описании транспарентного проксирования</a>,
+команды описаны в 3proxy.cfg(5).
+</p>
 
 &copy; Vladimir Dubrovin, License: BSD style

doc/html/securityen.html

@@ -19,6 +19,45 @@ authentication is currently available.
 <li>Always limit connections to the internal network and localhost (to 127.0.0.1 and
 all interfaces) with ACLs. Be careful, because the BIND command in SOCKS requires the
 BIND method with the external interface IP address to be allowed.
+<li>Services resolve IPv4 only unless told otherwise ('-4' is the default). Enabling
+IPv6 with '-6', '-46' or '-64' makes every ACL written in IPv4 incomplete, because the
+same host can be asked for in another way. A proxy that denies 127.0.0.1 but has IPv6
+enabled still reaches that host as '::ffff:127.0.0.1', and reaches the machine again as
+'::1', which is a different address the IPv4 rule never mentioned. When IPv6 is enabled,
+deny the mapped form '::ffff:0:0/96' as well unless it is needed, and deny the IPv6
+addresses that correspond to whatever the IPv4 rules protect: '::1' and '::' for the
+local machine, 'fe80::/10' for link-local and 'fc00::/7' for unique local addresses.
+Denying the IPv4 spelling alone is not enough.
+<li>With '-46' or '-64' a name resolves to either family, so a target ACL that names
+only one of a host's addresses does not limit that host. Names are resolved into
+separate caches, and a name that resolves to an IPv6 address is only cached when
+'nscache6' is configured.
+<li>The 'admin' service hands out counters, the list of running services and a way to
+trigger a configuration reload. Bind it to an internal interface, and put
+authentication and an ACL in front of it. The '-s' option limits what the pages offer
+but is not authentication.
+<li>The 'echo' and 'data' operations of the 'http' command exist for testing. 'data'
+returns a response of whatever size the request asks for, so a listener offering it to
+anyone is a traffic amplifier. Do not configure them on a public service.
+<li>'ssl_server_ca_key' is the private key of a certificate authority that clients have
+been told to trust. Anyone who obtains it can impersonate any site to those clients, so
+protect it as a signing key and use a CA created for this purpose only, never one that
+is trusted for anything else. Restrict the 'ssl_certcache' directory as well: it holds
+the certificates generated from that key.
+<li>Interception ('ssl_mitm') ends the guarantee the client believes it has. The full
+URL of every request inside the tunnel, query string included, becomes visible to the
+proxy and reaches the log, where a plain CONNECT would have shown only a host and a
+port. Treat those logs accordingly.
+<li>Certificates generated for interception by a build against wolfSSL carry no key
+identifiers, because that library cannot generate certificate extensions, and a client
+verifying strictly (OpenSSL 'x509_strict', which recent Python enables by default)
+rejects them. Builds against OpenSSL generate them. Where they are missing, turning
+verification off in the client removes the protection interception was supposed to
+preserve; use an OpenSSL build instead.
+<li>Regular expression rules ('pcre', 'pcre_rewrite') are matched without
+authentication and do not replace ACLs. A rewrite that would change the method or the
+destination of a request is ignored, because the destination was already authorized;
+do not rely on one to redirect traffic.
 <li>Before 3proxy 0.8, always use nserver and nscache under Unix; otherwise, a DoS attack is possible
 with an unreachable DNS server (because gethostbyname will block other threads).
 <li>Keep logs in a secure location, because some confidential information from

man/3proxy.cfg.5

@@ -39,7 +39,9 @@ For included file <CR> (end of line characters) is treated as space character
 (arguments delimiter instead of end of command delimiter). 
 Thus, include files are only useful to store long single-line commands
 (like userlist, network lists, etc).
-To use dollar sign somewhere in argument it must be quoted. 
+To use dollar sign somewhere in argument it must be quoted or doubled: inside
+quotes a dollar is ordinary text, and \fB$$\fR stands for a single dollar and is
+not read as an include.
 Recursion is not allowed.
 
 .br
@@ -132,7 +134,8 @@ change default server port to NUMBER
 Only resolve IPv6 addresses. IPv4 addresses are packed in IPv6 in IPV6_V6ONLY compatible way.
 .br
 .B -4
-Only resolve IPv4 addresses
+Only resolve IPv4 addresses. This is the default: a service reaches an IPv6
+address only when told to with \fB-6\fR, \fB-46\fR or \fB-64\fR.
 .br
 .B -46
 Prefer IPv4. Resolve IPv6 addresses if IPv4 address is not resolvable
@@ -282,16 +285,7 @@ proxy on a client with FTP proxy support. Username format is one of
 .BR config
 \fI<path>\fR
 .br
- Path to configuration file to use on 3proxy restart or to save configuration.
-
-.br
-.B writable
-.br
- ReOpens configuration file for write access via Web interface,
-and rereads it. Usually should be first command on config file
-but in combination with config
-it can be used anywhere to open
-alternate config file. Think twice before using it.
+ Path to configuration file to use on 3proxy restart.
 
 .br
 .B end
@@ -530,13 +524,20 @@ If not specified, nserver is used. The syntax is the same as for nserver.
 .br
  Cache \fI<cachesize>\fR records for name resolution (\fBnscache\fR for IPv4,
 \fBnscache6\fR for IPv6). The cache size should usually be large enough
-(for example, 65536).
+(for example, 65536). The two are separate: a name that resolves to an IPv6
+address, including one given with \fBnsrecord\fR, is only held when
+\fBnscache6\fR is configured, and \fBnscache\fR does nothing for it. Both
+caches are global rather than per-service.
 
 .br
 .BR nsrecord
 \fI<hostname>\fR \fI<hostaddr>\fR
 .br
- Adds static record to nscache. \fBnscache\fR must be enabled. If 0.0.0.0
+ Adds static record to nscache. \fBnscache\fR must be enabled and must come
+first, because the record is placed in the table it allocates - \fBnscache6\fR
+for a record naming an IPv6 address - and
+\fBnserver\fR must be set as well: without it the system resolver is used and
+static records are never consulted. If 0.0.0.0
 is used as a hostaddr host will never resolve, it can be used to
 blacklist something or together with 
 .B dialer
@@ -744,6 +745,17 @@ Since 0.6, the targetlist may also contain host names,
 instead of addresses. It\'s possible to use a wildmask in
 the beginning and at the end of the hostname, e.g. *badsite.com or *badcontent*.
 The hostname is only checked if a hostname is present in the request.
+A name written with a \fBpcre:\fR prefix (\fBregex:\fR is the same thing) is a
+regular expression instead of a wildmask, in a build with PCRE support:
+.br
+ deny * * "pcre:^(ads|track)[0-9]*\\.example\\.(com|net)$"
+.br
+ The name is lowercased and any trailing dots are removed before it is matched,
+so patterns are written in lower case. A pattern ending in \fB$\fR has to be
+quoted or written \fB$$\fR, since a lone dollar outside quotes begins the name
+of a file to include. The same patterns, and the same prefix, are used by the
+\fBhttp\fR command, see BUILT IN HTTP SERVER. Regular expressions are matched
+per request and cost more than a wildmask, which is enough for most rules.
 Targetportlist may contain ports (X) or port ranges lists (X-Y). For any field *
 sign means ANY. If access list is empty it\'s assumed to be
 .br
@@ -879,6 +891,10 @@ with probability of 0.7) for outgoing web connections. Chains are only applied t
  type is one of:
 .br
  \fBextip\fR does not actually redirect the request; it sets the external address for this request to \fI<ip>\fR. It can be chained with another parent type. It's useful to set the external IP based on ACL or make it random.
+.br
+ \fBextport\fR does not redirect the request; it sets the range the local port of outgoing connections is taken from, given as \fIFIRST-LAST\fR inclusive in place of the port argument, with 0.0.0.0 as the address, for example \fBparent 1000 extport 0.0.0.0 40000-40100\fR. Where the system can be asked to pick the port itself (Linux \fBIP_LOCAL_PORT_RANGE\fR) it does, otherwise a port is picked at random from the range and retried if it is already in use, up to ten times. On Linux the range has to lie within \fInet.ipv4.ip_local_port_range\fR, commonly 32768-60999: the kernel ignores a range outside it and picks an ordinary ephemeral port instead. If no port in the range can be bound, an ephemeral port is used rather than failing the connection. It can be chained with another parent type, and the access rule it belongs to decides which requests it applies to, so \fBallow * * * * UDPASSOC\fR followed by \fBparent 1000 extport 0.0.0.0 40000-40100\fR limits it to UDP associations. The range is applied when the outgoing connection is made, so a kept alive connection carrying several requests uses the rule that matched when it was opened.
+.br
+ \fBintport\fR is the same for sockets bound on the side facing the client: the port a UDP association tells the client to send its datagrams to, and the FTP proxy data connection.
 .br
  \fBtcp\fR simply redirect connection. TCP is always last in chain. This type of proxy is a simple TCP redirection, it does not support parent authentication.
 .br
@@ -1189,6 +1205,54 @@ the format:
  Note: double quotes are required because the password contains a $ sign.
 
 .br
+.BR transparent
+\fI[auto|netfilter|pf|socket]\fR
+.br
+ Take the destination of a connection, both address and port, from the packet
+filter that redirected it, instead of from the request. It applies to services declared after it, and
+\fBnotransparent\fR turns it off again for the services after that. Built into the
+binary since 1.0.1, and previously the separate TransparentPlugin.
+.br
+ On Linux the kernel is asked, so \fBiptables\fR or \fBnftables\fR
+redirection is enough. On the BSDs pf is asked through \fB/dev/pf\fR, which
+3proxy must be able to read, so \fBrdr\fR rules work; a redirection that
+leaves the destination on the socket is used where there is one, as
+\fBdivert-to\fR on OpenBSD and \fBipfw fwd\fR on FreeBSD do. macOS ships no
+header for pf and has neither of those, so the commands exist in a macOS build
+but cannot be used.
+.br
+ The mechanism is chosen automatically. The optional argument pins it for an
+installation that has more than one: \fBauto\fR is the default,
+\fBnetfilter\fR asks the Linux kernel, \fBpf\fR looks the connection up in
+the packet filter, and \fBsocket\fR reads the address off the socket. A mode
+the build has no code for is refused rather than ignored.
+.br
+ A connection that reaches a \fBsocket\fR mode service without having been
+redirected is refused: its destination is the address the service listens on,
+and using that would send the service to itself.
+.br
+ A redirected connection carries no destination of its own, so without this the
+service uses whatever it would use otherwise: the \fBHost\fR header for an
+HTTP request, or the address a port mapper was configured with. \fBtlspr\fR
+receives nothing at all unless traffic is redirected to it or the clients
+resolve names to it, and with a redirection it has the address as well as the
+name from the handshake, which is what allows access rules to be written with
+host names. With it, every service reaches the address the
+client was trying to reach, and access rules, parents, limits and logging apply
+to it as usual.
+.br
+ The redirection rules must not match the connections the proxy itself makes to
+those destinations, or the traffic returns to the proxy and loops. Give the
+service an outgoing address with \fB-e\fR and exclude that address in the rules,
+or run 3proxy as its own user and exclude that user. See the
+.B TRANSPARENT PROXYING
+section of the documentation for rules per platform.
+.br
+.BR notransparent
+.br
+ Stop taking the destination from the packet filter for the services declared
+after it.
+
 .B flush
 .br
  empty the active access list. The access list must be flushed every time you create a
@@ -1437,7 +1501,7 @@ Apply a rule for matching regular expression.
 Match and replace with rewrite expression.
 .br
 .BR pcre_extend
-\fIFILTER_ACTION [ACE]\fR
+\fIACE\fR
 .br
 Extend the ACL of the last pcre or pcre_rewrite command by adding an additional ACE.
 .br
@@ -1460,6 +1524,15 @@ PCRE_NOTEMPTY, PCRE_UTF8, PCRE_NO_AUTO_CAPTURE, PCRE_NO_UTF8_CHECK, PCRE_AUTO_CA
 PCRE_PARTIAL, PCRE_DFA_SHORTEST, PCRE_DFA_RESTART, PCRE_FIRSTLINE, PCRE_DUPNAMES,
 PCRE_NEWLINE_CR, PCRE_NEWLINE_LF, PCRE_NEWLINE_CRLF, PCRE_NEWLINE_ANY, PCRE_NEWLINE_ANYCRLF,
 PCRE_BSR_ANYCRLF, PCRE_BSR_UNICODE.
+.br
+ These options apply to every pattern the configuration compiles, the host
+patterns of access rules and \fBhttp\fR rules included, so set them before the
+rules which are to use them.
+.br
+ Regular expressions are not only for these commands: a host name in the target
+list of an access rule, and the host and URL of an \fBhttp\fR rule, take one
+when it is written with a \fBpcre:\fR prefix. See \fBallow\fR and BUILT IN
+HTTP SERVER.
 
 .SS PCRE Parameters
 TYPE - type of filtered data (comma-delimited list):
@@ -1487,6 +1560,12 @@ REGEXP - PCRE (Perl) regular expression. Use * if no regexp matching is required
 REWRITE_EXPRESSION - substitution string. May contain Perl-style substrings
 $1, $2, etc. $0 means the whole matched string. \er and \en may be used
 to insert new lines; the string may be empty ("").
+.br
+A rewritten request is what the server receives. The destination is chosen,
+and the access rules are applied to it, before the filters run, so a rewrite
+that names another host or changes the method is logged but not acted on:
+the request is still sent where the access rules allowed. Rewriting the path
+or the query works on a direct connection and through a parent alike.
 
 ACE - access control entry (user names, source IPs, destination IPs, ports, etc.),
 identical to allow/deny/bandlimin commands. The regular expression is only
@@ -1494,6 +1573,226 @@ matched if the ACL matches the connection data.
 Warning: Regular expressions don't require authentication and cannot replace
 authentication and/or allow/deny ACLs.
 
+.SH BUILT IN HTTP SERVER
+The \fBhttpsrv\fR service answers requests itself instead of forwarding them.
+What it does with a request is decided by \fBhttp\fR rules, which are taken in
+the order they are written: the first whose host and URL both match handles the
+request. Rules belong to the service that follows them, the way access rules do,
+and \fBadmin\fR is \fBhttpsrv\fR with a set of rules already in place.
+
+.BR http
+\fIOPERATION HOST URL [PARAMETERS]\fR
+.br
+ Handle a request for \fIURL\fR on \fIHOST\fR with \fIOPERATION\fR. HOST is
+matched against the Host header, URL against the path, with the query string
+removed.
+
+.SS Operations
+.br
+ \fBfile\fR \fIPATH [TYPE [MAX-AGE [HEADERS [CODE]]]]\fR - send the file at PATH.
+The file is handed to the socket by the system where it can do that (sendfile,
+TransmitFile) and read here where it cannot, as when the connection carries TLS.
+The arguments after PATH are described below, and each of them may be written as
+\fB*\fR to leave it out.
+.br
+ \fBcache\fR \fIPATH [TYPE [MAX-AGE [HEADERS [CODE]]]]\fR - the same, but the
+file is read into memory on the first request and answered from there afterwards.
+A file that has changed on disk is read again, and one larger than a megabyte is
+sent as \fBfile\fR would. With a MAX-AGE the file is not looked at again for
+that long: the rule has already told clients the file may be treated as
+unchanged for that time, so the server treats its own copy the same way and a
+request costs nothing but the copy out. Without one every request stats the
+file, so a change is picked up at once.
+.br
+ \fBreply\fR \fI[CODE [HEADERS]]\fR - answer with a status and nothing else.
+CODE is the status to send, 200 without one. A status which carries no body of
+its own (1xx, 204, 304) is sent without a length; anything else is sent with a
+length of zero.
+.br
+ \fBredir\fR \fI[CODE] LOCATION\fR - answer with a redirect. CODE is 301 or 302,
+or any status from 300 to 399; without one, 302 is used.
+.br
+ \fBrewrite\fR \fIPATH\fR - change the path of the request and hand it to the
+rules that follow this one.
+.br
+ \fBrewrite_host\fR \fIHOST\fR - the same for the host, which decides which of
+the rules after it match. \fB$1\fR upwards stand for what the stars, or the
+groups, of this rule\'s host pattern matched, the way they stand for those of
+the URL in a \fBrewrite\fR. What is built has to be a host name; the name the
+client sent is what access rules matched and what the log records.
+.br
+ \fBecho\fR - answer with a description of the request: the method, path, query,
+host, and the address and port it came from. For testing.
+.br
+ \fBdata\fR \fI[size=N] [block=N] [status=N] [chunked=1] [delay=N]\fR - answer
+with generated content of the size asked for. For testing.
+.br
+ \fBproxypass\fR - hand the request to the proxy code, which fetches it the
+way \fBproxy\fR would, see BOTH A SITE AND A PROXY.
+.br
+ \fBadmin\fR, \fBadmin_counters\fR, \fBadmin_reload\fR, \fBadmin_services\fR -
+the pages of the administration interface.
+
+.SS What a rule adds to the answer
+\fBTYPE\fR is the content type to answer with. Without it, or with \fB*\fR, the
+type is worked out from the name of the file, see \fBhttp_content_type\fR.
+.br
+ \fBMAX-AGE\fR is a number of seconds, and is sent as Cache-Control: max-age.
+Without it, or with \fB*\fR, nothing is said about caching.
+.br
+ \fBHEADERS\fR is one argument holding whole header lines, separated by a
+backslash and an n \- the two characters, since a configuration line cannot
+carry a line ending. Each becomes a real line ending in the answer. Quote the
+argument if any header holds a space, which they usually do.
+.br
+ \fBCODE\fR is the status to answer with instead of 200, which is how a file
+serves as the body of an error page.
+.br
+ A rule's headers and MAX-AGE go with whatever status that rule asked for. They
+are not sent with a refusal the server itself decided on: a request for a file
+which is not there is answered 404 by the server, not by the rule.
+.br
+ \fBfile\fR and \fBcache\fR send Last-Modified, and answer a request carrying
+If-Modified-Since with 304 and no body when the file has not changed since the
+time it names. All three date formats HTTP allows are read; one which cannot be
+read is treated as no date at all. A rule answering with a CODE of its own is
+answering something other than the file, so it is never turned into a 304.
+.br
+ http file * /err/** "/usr/local/web/404.html" text/html * "X-Served: static" 404
+.br
+ http reply * /health** 200 "X-Health: ok"
+.br
+ http reply * /down** 503 "Retry-After: 30"
+
+.BR http_content_type
+\fIEXTENSION TYPE\fR
+.br
+ Answer for a file with that extension with that content type, in addition to
+the types already known. The extension may be written with or without its dot.
+A type named by a rule is used whatever this says, and a name the server knows
+nothing about is answered as application/octet-stream.
+.br
+ http_content_type .webp image/webp
+
+.SS Patterns
+A URL is matched with stars, or with a regular expression when it carries a
+\fBpcre:\fR prefix (\fBregex:\fR is taken as well). A host is matched the way an
+access list matches one, and takes the same prefix.
+.br
+ \fB*\fR stands for any run of characters within one element of the path: it
+does not cross a \fB/\fR, so a rule cannot reach into a directory it did not
+name.
+.br
+ \fB**\fR crosses them, and is what a rule which should match everything below a
+point, or everything at all, is written with.
+.br
+ Each star, and each group of a regular expression, is remembered in the order
+it appears. \fB$1\fR upwards stand for them in the path or location a rule
+builds, and \fB$0\fR for the whole request path.
+.br
+ Outside quotes a dollar begins the name of a file to include, so an argument
+holding one \- a path or location built with \fB$1\fR, a regular expression
+anchored with \fB$\fR \- is written in quotes. \fB$$\fR stands for a single
+dollar and is not read as an include either, which is how a dollar reaches a
+rule as text.
+
+.SS Both a site and a proxy
+A request may arrive the way it arrives at a site, naming a path and a host in
+the Host header, or the way it arrives at a proxy, naming the whole URL, or, for
+a tunnel, the host alone with CONNECT. Both are read. A request in the proxy
+form authenticates with Proxy-Authorization and is refused with 407, as a proxy
+refuses one; a request in the site form uses Authorization and 401.
+.br
+ What answers a request is still decided by the rules. \fBproxypass\fR is the
+rule which answers by fetching, so a service can serve what it has and proxy the
+rest:
+.br
+ http file * /local/** "/usr/local/web/$1"
+.br
+ http proxypass * /**
+.br
+ httpsrv -p8080
+.br
+ The same happens without a rule for it where an access rule redirects to the
+local proxy, which is written as a chain of no address: the rules are asked
+first, and a request none of them answers is fetched.
+.br
+ allow *
+.br
+ parent 1000 http 0.0.0.0 0
+.br
+ allow *
+.br
+ The second \fBallow\fR is what the proxy matches on the pass it makes itself:
+a rule carrying the chain is not taken twice. Authentication happens twice for
+the same reason, once for the service and once for the proxy, so a configuration
+asking for credentials asks for them as a proxy does.
+.br
+ The access rules are read from the top on both passes, and it is the second
+pass which describes where the request is going. On the first one the service is
+answering for itself, so the destination an address or a port is matched against
+is the address the client connected to; the name from the request is matched on
+both. On the second the destination is the one the request names, so rules
+written with an address, a port or a name decide what the proxy is allowed to
+fetch, and they decide it before the connection is made:
+.br
+ allow *
+.br
+ parent 1000 http 0.0.0.0 0
+.br
+ allow * * * 80,443
+.br
+ deny *
+.br
+ Everything reaches the rules, and only ports 80 and 443 are fetched. A rule
+before the one carrying the chain applies on both passes just the same, so a
+\fBdeny\fR written there stops the request as well.
+.br
+ The connection to the server is kept for the request after it, and closed when
+the request after it goes somewhere else, or when the server has closed it in
+the meantime. A tunnel is fetched by the proxy code as well, which means the
+connection carrying it belongs to that request alone.
+
+.SS Connections
+An answer is sent as HTTP/1.1 to a client which asked in HTTP/1.1, and the
+connection is kept for the next request unless the client sent
+\fBConnection: close\fR. A 1.0 client gets a 1.0 answer, and the connection is
+kept only when it asked with \fBConnection: keep-alive\fR.
+.br
+ The connection is kept only when what was sent is framed exactly: every
+operation but the administration pages states a length, or sends a chunked body
+a 1.1 client can read, so the pages of \fBadmin\fR are always the last thing on
+a connection. A request body which cannot be read to its end ends the connection
+as well: one sent with \fBTransfer-Encoding\fR, which this server does not read,
+and one longer than a megabyte, which it will not.
+
+.SS Paths a rule builds
+The path a rule builds is used as it is, so it is refused rather than corrected
+when it is not a plain full path. A relative path is refused: it would be read
+against whatever directory the service happens to be in. So is one holding
+\fB.\fR or \fB..\fR as an element, a carriage return, a newline or a star. On
+Windows a path must name a drive or a share, and is converted to the extended
+\\\\?\\ form and opened through the wide interface, so a long path works.
+.br
+ A request is checked before any of this: a path which decodes to one leaving
+the tree is refused outright.
+
+.SS Examples
+.br
+ http file example.com /my/webpath/*.html "/usr/local/web/$1.html"
+.br
+ http cache example.com "pcre:^/(.*)/pic/(.*)\.(gif|jpeg)$" "/usr/local/web/picts/$1/$2.$3"
+.br
+ http redir * /old/** 301 "https://example.org/$1"
+.br
+ http rewrite * /alias/** "/w/$1"
+.br
+ http rewrite_host *.old.example ** "$1.new.example"
+.br
+ http file * /static/** "/usr/local/web/static/$1"
+.br
+ httpsrv -p8080
+
 .SH BUGS
 Report all bugs to
 .BR 3proxy@3proxy.org

rus.3ps

@@ -24,7 +24,6 @@ Content-type: text/html; charset=utf-8\n
 <A HREF='/C'>Счетчики</A><br><br>\n
 <A HREF='/R'>Перезагрузка конфигурации сервера</A><br><br>\n
 <A HREF='/S'>Запущенные сервисы</A><br><br>\n
-<A HREF='/F'>Настройка сервера</A>\n
 </td><td>
 <h2>%s %s Конфигурация</h2>
 [end]

scripts/openwrt/Makefile

@@ -0,0 +1,66 @@
+#
+# Copyright (C) 2026 3proxy.org
+#
+# This is free software, licensed under the BSD 3-Clause License.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=3proxy
+PKG_VERSION:=1.0.0
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+# A trailing ? tells the download helper the URL is complete and PKG_SOURCE
+# must not be appended to it.
+PKG_SOURCE_URL:=https://codeload.github.com/3proxy/3proxy/tar.gz/refs/tags/$(PKG_VERSION)?
+PKG_HASH:=35b07de1046f3aaeac4a7085101b7e5c453efa3527cbdc42a84690366c7ecfa8
+
+PKG_MAINTAINER:=Vladimir Dubrovin <vlad@3proxy.org>
+PKG_LICENSE:=BSD-3-Clause
+PKG_LICENSE_FILES:=copying
+PKG_CPE_ID:=cpe:/a:3proxy:3proxy
+
+PKG_BUILD_PARALLEL:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/3proxy
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Web Servers/Proxies
+  TITLE:=tiny free proxy server
+  URL:=https://3proxy.org/
+  DEPENDS:=+libopenssl +libpcre2
+endef
+
+define Package/3proxy/description
+  3proxy is a tiny free proxy server supporting HTTP, HTTPS, FTP, SOCKS v4/v4a/v5,
+  POP3, SMTP, IMAP, TCP and UDP port mapping, with access control, bandwidth
+  limiting and traffic accounting.
+endef
+
+define Package/3proxy/conffiles
+/etc/config/3proxy
+endef
+
+# Makefile.Linux appends to CFLAGS and LDFLAGS internally; the target flags have
+# to be added rather than substituted, or the defines it relies on are lost.
+define Build/Compile
+	$(MAKE) -C $(PKG_BUILD_DIR) -f Makefile.Linux \
+		CC="$(TARGET_CC)" \
+		EXTRA_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+		EXTRA_LDFLAGS="$(TARGET_LDFLAGS)" \
+		PLUGINS=
+endef
+
+define Package/3proxy/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/bin/3proxy $(1)/usr/bin/3proxy
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/3proxy.config $(1)/etc/config/3proxy
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/3proxy.init $(1)/etc/init.d/3proxy
+endef
+
+$(eval $(call BuildPackage,3proxy))

scripts/openwrt/files/3proxy.config

@@ -0,0 +1,59 @@
+config 3proxy 'global'
+	option enabled '0'
+	option nscache '65536'
+#	option nscache6 '65536'
+	# static records, added to the cache; 0.0.0.0 blackholes a name
+#	list nsrecord 'ads.example.com 0.0.0.0'
+	option maxconn '128'
+	option auth 'iponly'
+	option log 'syslog'
+#	option timeouts '1 5 30 60 180 1800 15 60 15 5 5'
+#	list include '/etc/3proxy/extra.cfg'
+	list nserver '8.8.8.8'
+	list nserver '8.8.4.4'
+#	list user 'admin:CL:password'
+#	list extra_config 'timeouts 1 5 30 60 180 1800 15 60'
+	# access list used by services which do not define their own
+	list acl 'lan'
+
+# Access rules are named sections referenced by services. The order of the
+# references decides precedence: 3proxy stops at the first rule that matches.
+config acl 'lan'
+	option action 'allow'
+	option src '192.168.1.0/24'
+
+config acl 'deny_private'
+	option action 'deny'
+	option dst '10.0.0.0/8,172.16.0.0/12,192.168.0.0/16'
+
+#config acl 'via_upstream'
+#	option action 'allow'
+#	list parent 'upstream'
+
+# Parent proxies extend an allow rule to build a chain. Weights group them:
+# parents whose weights sum to 1000 form one group and one is picked at random,
+# several groups are chained in order.
+#config parent 'upstream'
+#	option weight '1000'
+#	option type 'socks5'
+#	option ip '10.0.0.1'
+#	option port '1080'
+#	option username ''
+#	option password ''
+
+config service 'proxy'
+	option enabled '0'
+	option type 'proxy'
+	option port '3128'
+#	option bind ''
+#	option external ''
+#	option extra ''
+#	option auth 'strong'
+	list acl 'deny_private'
+	list acl 'lan'
+
+config service 'socks'
+	option enabled '0'
+	option type 'socks'
+	option port '1080'
+	list acl 'lan'

scripts/openwrt/files/3proxy.init

@@ -0,0 +1,460 @@
+#!/bin/sh /etc/rc.common
+
+START=50
+USE_PROCD=1
+
+CFGFILE=/var/etc/3proxy.cfg
+PROG=/usr/bin/3proxy
+
+# 3proxy.cfg is order dependent: authentication and access rules apply to the
+# service lines that follow them, and the access list has to be flushed before
+# each service. The file is written as one global block followed by one block
+# per service.
+
+acl_written=0
+
+append_line() {
+	echo "$1" >> "$CFGFILE"
+}
+
+append_include() {
+	echo "include $1" >> "$CFGFILE"
+}
+
+# The limiter directives carry their own ACL pattern rather than attaching to a
+# preceding allow rule, and 3proxy defaults every omitted field to *, so the
+# trailing wildcards are dropped again to keep the file readable.
+# logformat takes a single argument, so a format containing spaces has to be
+# quoted. Quotes already present in the UCI value are not doubled.
+append_logformat() {
+	local fmt="$1"
+
+	case "$fmt" in
+		'"'*'"') ;;
+		*) fmt="\"$fmt\"" ;;
+	esac
+
+	echo "logformat $fmt" >> "$CFGFILE"
+}
+
+limit_match() {
+	local users src dst ports ops weekdays periods out
+
+	config_get users "$1" users '*'
+	config_get src "$1" src '*'
+	config_get dst "$1" dst '*'
+	config_get ports "$1" ports '*'
+	config_get ops "$1" operations '*'
+	config_get weekdays "$1" weekdays '*'
+	config_get periods "$1" timeperiods '*'
+
+	out="$users $src $dst $ports $ops $weekdays $periods"
+	while [ "${out% \*}" != "$out" ]; do out="${out% \*}"; done
+
+	echo "$out"
+}
+
+append_limit() {
+	local type rate period number count_type limit match
+
+	config_get type "$1" type
+
+	case "$type" in
+		bandlimin|bandlimout|nobandlimin|nobandlimout|\
+		connlim|noconnlim|\
+		countin|countout|countall|nocountin|nocountout|nocountall) ;;
+		*)
+			echo "3proxy: limit '$1' has unknown type '$type', ignored" >&2
+			return 0
+			;;
+	esac
+
+	match=$(limit_match "$1")
+
+	case "$type" in
+		bandlimin|bandlimout)
+			config_get rate "$1" rate
+			[ -n "$rate" ] || {
+				echo "3proxy: limit '$1' needs a rate, ignored" >&2
+				return 0
+			}
+			echo "$type $rate $match" >> "$CFGFILE"
+			;;
+		connlim)
+			config_get rate "$1" rate
+			config_get period "$1" period 0
+			[ -n "$rate" ] || {
+				echo "3proxy: limit '$1' needs a rate, ignored" >&2
+				return 0
+			}
+			echo "$type $rate $period $match" >> "$CFGFILE"
+			;;
+		countin|countout|countall)
+			config_get number "$1" number
+			config_get count_type "$1" count_type
+			config_get limit "$1" limit
+			[ -n "$number" ] && [ -n "$count_type" ] && [ -n "$limit" ] || {
+				echo "3proxy: limit '$1' needs number, count_type and limit, ignored" >&2
+				return 0
+			}
+			echo "$type $number $count_type $limit $match" >> "$CFGFILE"
+			;;
+		*)
+			echo "$type $match" >> "$CFGFILE"
+			;;
+	esac
+
+	return 0
+}
+
+append_pcre_extend() {
+	echo "pcre_extend $1" >> "$CFGFILE"
+}
+
+append_pcre() {
+	local match_type action regexp rewrite ace
+
+	config_get match_type "$1" match_type
+	config_get action "$1" action
+	config_get regexp "$1" regexp
+	config_get rewrite "$1" rewrite
+	config_get ace "$1" ace
+
+	[ -n "$match_type" ] && [ -n "$action" ] && [ -n "$regexp" ] || {
+		echo "3proxy: pcre '$1' needs match_type, action and regexp, ignored" >&2
+		return 0
+	}
+
+	# Catch bad values here: 3proxy rejects the whole configuration on an
+	# unknown type or action, which would leave the router without a proxy.
+	case "$action" in
+		allow|deny|dunno) ;;
+		*)
+			echo "3proxy: pcre '$1' action '$action' is not allow, deny or dunno, ignored" >&2
+			return 0
+			;;
+	esac
+
+	local part
+	for part in $(echo "$match_type" | tr ',' ' '); do
+		case "$part" in
+			request|cliheader|srvheader|clidata|srvdata) ;;
+			*)
+				echo "3proxy: pcre '$1' match_type '$part' is unknown, ignored" >&2
+				return 0
+				;;
+		esac
+	done
+
+	if [ -n "$rewrite" ]; then
+		echo "pcre_rewrite $match_type $action $regexp $rewrite${ace:+ $ace}" >> "$CFGFILE"
+	else
+		echo "pcre $match_type $action $regexp${ace:+ $ace}" >> "$CFGFILE"
+	fi
+
+	config_list_foreach "$1" extend append_pcre_extend
+	return 0
+}
+
+append_nsrecord() {
+	set -- $1
+	if [ $# -ne 2 ]; then
+		echo "3proxy: nsrecord '$*' needs a hostname and an address, ignored" >&2
+		return 0
+	fi
+
+	echo "nsrecord $1 $2" >> "$CFGFILE"
+	nsrecord_written=1
+	return 0
+}
+
+append_nserver() {
+	echo "nserver $1" >> "$CFGFILE"
+}
+
+append_user() {
+	users="$users $1"
+}
+
+# $1 is the name of an acl section referenced by a service, or by the global
+# section as the default access list.
+append_acl() {
+	local action users src dst ports
+
+	config_get action "$1" action allow
+	config_get users "$1" users
+	config_get src "$1" src
+	config_get dst "$1" dst
+	config_get ports "$1" ports
+
+	case "$action" in
+		allow|deny) ;;
+		*)
+			echo "3proxy: acl '$1' has unknown action '$action', ignored" >&2
+			return 0
+			;;
+	esac
+
+	echo "$action ${users:-*} ${src:-*} ${dst:-*} ${ports:-*}" >> "$CFGFILE"
+	acl_written=1
+
+	if [ "$action" = "allow" ]; then
+		config_list_foreach "$1" parent append_parent
+	else
+		config_get _parent "$1" parent
+		[ -z "$_parent" ] || echo "3proxy: acl '$1' is a deny rule, its parents are ignored" >&2
+	fi
+
+	return 0
+}
+
+# $1 is the name of a parent section referenced by an acl. "parent" extends the
+# allow rule that precedes it, so these are emitted directly after their rule.
+append_parent() {
+	local weight type ip port username password line
+
+	config_get weight "$1" weight 1000
+	config_get type "$1" type
+	config_get ip "$1" ip
+	config_get port "$1" port
+	config_get username "$1" username
+	config_get password "$1" password
+
+	[ -n "$type" ] && [ -n "$ip" ] && [ -n "$port" ] || {
+		echo "3proxy: parent '$1' needs type, ip and port, ignored" >&2
+		return 0
+	}
+
+	line="parent $weight $type $ip $port"
+	if [ -n "$username" ]; then
+		line="$line $username"
+		[ -n "$password" ] && line="$line $password"
+	fi
+
+	echo "$line" >> "$CFGFILE"
+	return 0
+}
+
+# TLS parameters that take a value. The UCI option name is the directive name.
+SSL_VALUE_OPTIONS="ssl_server_cert ssl_server_key ssl_client_cert ssl_client_key
+	ssl_client_ciphersuites ssl_server_ciphersuites
+	ssl_client_cipher_list ssl_server_cipher_list
+	ssl_client_min_proto_version ssl_server_min_proto_version
+	ssl_client_max_proto_version ssl_server_max_proto_version
+	ssl_server_ca_file ssl_server_ca_key ssl_server_ca_dir ssl_server_ca_store
+	ssl_client_ca_file ssl_client_ca_dir ssl_client_ca_store
+	ssl_client_sni ssl_client_alpn ssl_client_mode ssl_certcache"
+
+# The TLS switches apply to every service below them, so they leak from one
+# service to the next unless turned back off. These track what is currently in
+# effect - all off, matching the defaults - so a directive is written only when
+# a service actually needs a different state.
+ssl_state_mitm=0
+ssl_state_server=0
+ssl_state_client=0
+ssl_state_client_verify=0
+ssl_state_server_verify=0
+
+# $1 section, $2 uci option, $3 state variable, $4 directive on, $5 directive off
+append_ssl_toggle() {
+	local want have
+
+	config_get_bool want "$1" "$2" 0
+	have=$(eval echo \$$3)
+
+	[ "$want" = "$have" ] && return 0
+
+	if [ "$want" -gt 0 ]; then
+		echo "$4" >> "$CFGFILE"
+	else
+		echo "$5" >> "$CFGFILE"
+	fi
+
+	eval "$3=$want"
+	return 0
+}
+
+append_ssl() {
+	local opt value mitm server cert key cverify
+
+	for opt in $SSL_VALUE_OPTIONS; do
+		config_get value "$1" "$opt"
+		[ -n "$value" ] && echo "$opt $value" >> "$CFGFILE"
+	done
+
+	append_ssl_toggle "$1" ssl_mitm ssl_state_mitm ssl_mitm ssl_nomitm
+	append_ssl_toggle "$1" ssl_server ssl_state_server ssl_serv ssl_noserv
+	append_ssl_toggle "$1" ssl_client ssl_state_client ssl_cli ssl_nocli
+	append_ssl_toggle "$1" ssl_client_verify ssl_state_client_verify \
+		ssl_client_verify ssl_client_no_verify
+	append_ssl_toggle "$1" ssl_server_verify ssl_state_server_verify \
+		ssl_server_verify ssl_server_no_verify
+
+	config_get_bool mitm "$1" ssl_mitm 0
+	config_get_bool cverify "$1" ssl_client_verify 0
+	[ "$mitm" -gt 0 ] && [ "$cverify" -gt 0 ] || [ "$mitm" -eq 0 ] || \
+		echo "3proxy: service '$1' spoofs certificates without ssl_client_verify, upstream certificates are not checked" >&2
+
+	config_get_bool server "$1" ssl_server 0
+	if [ "$server" -gt 0 ]; then
+		config_get cert "$1" ssl_server_cert
+		config_get key "$1" ssl_server_key
+		[ -n "$cert" ] && [ -n "$key" ] || \
+			echo "3proxy: service '$1' requires TLS from clients but has no ssl_server_cert/ssl_server_key" >&2
+	fi
+
+	return 0
+}
+
+append_service() {
+	local enabled type port bind external extra auth args
+	local bind_interface external_interface logformat
+
+	config_get_bool enabled "$1" enabled 0
+	[ "$enabled" -gt 0 ] || return 0
+
+	config_get type "$1" type
+	[ -n "$type" ] || {
+		echo "3proxy: service '$1' has no type, ignored" >&2
+		return 0
+	}
+
+	config_get port "$1" port
+	config_get bind "$1" bind
+	config_get external "$1" external
+	config_get extra "$1" extra
+	config_get bind_interface "$1" bind_interface
+	config_get external_interface "$1" external_interface
+	config_get logformat "$1" logformat
+	config_get auth "$1" auth "$global_auth"
+
+	echo "" >> "$CFGFILE"
+	echo "flush" >> "$CFGFILE"
+	[ -n "$auth" ] && echo "auth $auth" >> "$CFGFILE"
+
+	# Rules referenced by the service, in the order they are listed. A service
+	# without its own list falls back to the global one.
+	acl_written=0
+	config_list_foreach "$1" acl append_acl
+	[ "$acl_written" -gt 0 ] || config_list_foreach global acl append_acl
+
+	[ -n "$logformat" ] && append_logformat "$logformat"
+
+	append_ssl "$1"
+
+	args=""
+	[ -n "$port" ] && args="$args -p$port"
+	[ -n "$bind" ] && args="$args -i$bind"
+	[ -n "$external" ] && args="$args -e$external"
+	[ -n "$bind_interface" ] && args="$args -Di$bind_interface"
+	[ -n "$external_interface" ] && args="$args -De$external_interface"
+	[ -n "$extra" ] && args="$args $extra"
+
+	echo "$type$args" >> "$CFGFILE"
+	return 0
+}
+
+write_config() {
+	local nscache nscache6 maxconn log timeouts fakeresolve logformat
+	local authcache_type authcache_time authcache_size
+	local counter_file counter_type counter_name pcre_options
+
+	mkdir -p "$(dirname "$CFGFILE")"
+	: > "$CFGFILE"
+
+	config_get nscache global nscache
+	config_get nscache6 global nscache6
+	config_get maxconn global maxconn
+	config_get global_auth global auth iponly
+	config_get log global log syslog
+	config_get timeouts global timeouts
+	config_get logformat global logformat
+	config_get_bool fakeresolve global fakeresolve 0
+	config_get authcache_type global authcache_type
+	config_get authcache_time global authcache_time
+	config_get authcache_size global authcache_size
+	config_get counter_file global counter_file
+	config_get counter_type global counter_type
+	config_get counter_name global counter_name
+	config_get pcre_options global pcre_options
+
+	config_list_foreach global nserver append_nserver
+	[ -n "$nscache" ] && echo "nscache $nscache" >> "$CFGFILE"
+	[ -n "$nscache6" ] && echo "nscache6 $nscache6" >> "$CFGFILE"
+
+	# Static records are added to the cache, so they have to come after it.
+	nsrecord_written=0
+	config_list_foreach global nsrecord append_nsrecord
+	[ "$nsrecord_written" -eq 0 ] || [ -n "$nscache$nscache6" ] || \
+		echo "3proxy: nsrecord needs nscache or nscache6 to be set" >&2
+
+	case "$log" in
+		syslog) echo "log" >> "$CFGFILE" ;;
+		none|"") ;;
+		*) echo "log $log" >> "$CFGFILE" ;;
+	esac
+
+	users=""
+	config_list_foreach global user append_user
+	[ -n "$users" ] && echo "users$users" >> "$CFGFILE"
+
+	[ -n "$timeouts" ] && echo "timeouts $timeouts" >> "$CFGFILE"
+	[ "$fakeresolve" -gt 0 ] && echo "fakeresolve" >> "$CFGFILE"
+	[ -n "$logformat" ] && append_logformat "$logformat"
+
+	if [ -n "$authcache_type" ]; then
+		[ -n "$authcache_time" ] || authcache_time=600
+		echo "authcache $authcache_type $authcache_time${authcache_size:+ $authcache_size}" >> "$CFGFILE"
+	fi
+
+	if [ -n "$counter_file" ]; then
+		echo "counter $counter_file${counter_type:+ $counter_type}${counter_name:+ $counter_name}" >> "$CFGFILE"
+	fi
+
+	[ -n "$pcre_options" ] && echo "pcre_options $pcre_options" >> "$CFGFILE"
+
+	# Both lists are order sensitive: 3proxy stops at the first match, so the
+	# exempting rules (nobandlimin and friends) have to be listed first.
+	config_list_foreach global pcre append_pcre
+	config_list_foreach global limit append_limit
+
+	config_list_foreach global include append_include
+	config_list_foreach global extra_config append_line
+
+	[ -n "$maxconn" ] && echo "maxconn $maxconn" >> "$CFGFILE"
+
+	config_foreach append_service service
+
+	return 0
+}
+
+start_service() {
+	local enabled
+
+	config_load 3proxy
+	config_get_bool enabled global enabled 0
+
+	[ "$enabled" -gt 0 ] || {
+		echo "3proxy is disabled in /etc/config/3proxy" >&2
+		return 1
+	}
+
+	write_config
+
+	procd_open_instance
+	procd_set_param command "$PROG" "$CFGFILE"
+	procd_set_param file "$CFGFILE"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+service_triggers() {
+	procd_add_reload_trigger "3proxy"
+}
+
+reload_service() {
+	stop
+	start
+}

src/3proxy.c

@@ -13,6 +13,12 @@ void ssl_install(void);
 #ifdef WITH_PCRE
 void pcre_install(void);
 #endif
+#ifdef WITH_TRANSPARENT
+void transparent_install(void);
+#endif
+#ifdef WITH_HTTPSRV
+void httpsrv_init(void);
+#endif
 #ifndef _WIN32
 #include <sys/resource.h>
 #ifndef NOPLUGINS
@@ -28,7 +34,6 @@ void pcre_install(void);
 
 FILE * confopen();
 extern unsigned char *strings[];
-extern FILE *writable;
 extern struct counter_header cheader;
 extern struct counter_record crecord;
 
@@ -530,6 +535,12 @@ int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int
 #ifdef WITH_PCRE
   pcre_install();
 #endif
+#ifdef WITH_TRANSPARENT
+  transparent_install();
+#endif
+#ifdef WITH_HTTPSRV
+  httpsrv_init();
+#endif
 
   freeconf(&conf);
   initcommands();
@@ -537,7 +548,7 @@ int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int
   conf.version++;
 
   if(res) RETURN(res);
-  if(!writable){fclose(fp); fp = NULL;}
+  fclose(fp); fp = NULL;
 
 #ifdef _WIN32
   

src/Makefile.inc

@@ -116,6 +116,12 @@ srvsocks$(OBJSUFFICS): socks.c proxy.h structures.h
 srvwebadmin$(OBJSUFFICS): webadmin.c proxy.h structures.h
 	$(CC) $(COUT)srvwebadmin$(OBJSUFFICS) $(CFLAGS) webadmin.c
 
+transparent$(OBJSUFFICS): transparent.c proxy.h structures.h
+	$(CC) $(COUT)transparent$(OBJSUFFICS) $(CFLAGS) transparent.c
+
+srvhttpsrv$(OBJSUFFICS): httpsrv.c proxy.h structures.h
+	$(CC) $(COUT)srvhttpsrv$(OBJSUFFICS) $(CFLAGS) httpsrv.c
+
 srvudppm$(OBJSUFFICS): udppm.c proxy.h structures.h
 	$(CC) $(COUT)srvudppm$(OBJSUFFICS) $(CFLAGS) udppm.c
 
@@ -188,6 +194,6 @@ ssl$(OBJSUFFICS): ssl.c structures.h proxy.h ssl.h
 pcre$(OBJSUFFICS): pcre.c structures.h
 	$(CC) $(COUT)pcre$(OBJSUFFICS) $(CFLAGS) $(DEFINEOPTION)WITH_PCRE pcre.c
 
-$(BUILDDIR)3proxy$(EXESUFFICS): 3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) log$(OBJSUFFICS) datatypes$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(COMPATLIBS) $(VERSIONDEP)
-	$(LN) $(LNOUT)$(BUILDDIR)3proxy$(EXESUFFICS) $(LDFLAGS) $(VERFILE)  3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) datatypes$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(COMPATLIBS) $(LIBS) $(PCRE_LIBS)
+$(BUILDDIR)3proxy$(EXESUFFICS): 3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) log$(OBJSUFFICS) datatypes$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) $(HTTPSRV_OBJS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(TRANSPARENT_OBJS) $(COMPATLIBS) $(VERSIONDEP)
+	$(LN) $(LNOUT)$(BUILDDIR)3proxy$(EXESUFFICS) $(LDFLAGS) $(VERFILE)  3proxy$(OBJSUFFICS) mainfunc$(OBJSUFFICS) auth$(OBJSUFFICS) acl$(OBJSUFFICS) limiter$(OBJSUFFICS) redirect$(OBJSUFFICS) authradius$(OBJSUFFICS) hash$(OBJSUFFICS) hashtables$(OBJSUFFICS) resolve$(OBJSUFFICS) sql$(OBJSUFFICS) conf$(OBJSUFFICS) datatypes$(OBJSUFFICS) srvauto$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvimapp$(OBJSUFFICS) srvsmtpp$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvtlspr$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) udpsockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) common$(OBJSUFFICS) log$(OBJSUFFICS) 3proxy_crypt$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) blake2$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) stringtable$(OBJSUFFICS) $(HTTPSRV_OBJS) srvdnspr$(OBJSUFFICS) plugins$(OBJSUFFICS) mdhash$(OBJSUFFICS) $(SSL_OBJS) $(PCRE_OBJS) $(TRANSPARENT_OBJS) $(COMPATLIBS) $(LIBS) $(PCRE_LIBS)
 

src/acl.c

@@ -8,6 +8,247 @@
 
 #include "proxy.h"
 
+/* The pattern engine lives here rather than in common.c: common.c is linked
+   into the standalone binaries as well, and those carry neither the regular
+   expression code this calls nor a use for a host pattern. */
+/* Host lists in access rules have always accepted name, name*, *name and
+   *name*, with the leading and trailing star recorded as a match type rather
+   than kept in the string. The parser and the comparison are here so that
+   anything else matching a name against a pattern - the http command, and
+   whatever replaces the star with a regular expression later - behaves the same
+   way and gains the same syntax at the same time.
+ */
+/* A pattern written as a regular expression carries a prefix. Both spellings
+   are taken so a configuration reads the way its author thinks of it. */
+static unsigned char * regexprefix(unsigned char *arg)
+{
+	if(!strncmp((char *)arg, "pcre:", 5)) return arg + 5;
+	if(!strncmp((char *)arg, "regex:", 6)) return arg + 6;
+	return NULL;
+}
+
+/* Shared by every pattern the configuration can carry. Returns 0 on success. */
+static int compileregex(struct hostname *h, unsigned char *pattern)
+{
+#ifdef WITH_PCRE
+	char err[256];
+
+	h->re = pcre_pattern_compile(pattern, err, sizeof(err));
+	if(!h->re){
+		fprintf(stderr, "Bad regular expression '%s': %s\n", pattern, err);
+		return 1;
+	}
+	h->matchtype = MATCHREGEX;
+	h->name = (unsigned char *)strdup((char *)pattern);
+	return h->name? 0 : 1;
+#else
+	fprintf(stderr, "Regular expression '%s' needs a build with PCRE\n", pattern);
+	return 1;
+#endif
+}
+
+int parsepattern(struct hostname *h, unsigned char *arg)
+{
+	int arglen;
+	unsigned char *pattern;
+
+	h->re = NULL;
+	if((pattern = regexprefix(arg))) return compileregex(h, pattern);
+
+	arglen = (int)strlen((char *)arg);
+	h->matchtype = 3;
+	pattern = arg;
+
+	if(arglen && pattern[arglen-1] == '*'){
+		arglen--;
+		pattern[arglen] = 0;
+		h->matchtype ^= MATCHEND;
+	}
+	if(arglen && pattern[0] == '*'){
+		pattern++;
+		arglen--;
+		h->matchtype ^= MATCHBEGIN;
+	}
+
+	h->name = (unsigned char *)strdup((char *)pattern);
+	return h->name? 0 : 1;
+}
+
+/* Matches str against a pattern and reports the part a star stood for. Where a
+   pattern has a star at both ends the trailing one is reported, since that is
+   the part following the text that was matched. An exact pattern leaves an
+   empty span. */
+int patternmatchpos(const struct hostname *h, const unsigned char *str, int *start, int *len)
+{
+	int lname, lstr, pos = 0, match = 0;
+	char *found;
+
+	if(!h->name || !str) return 0;
+	if(h->matchtype == MATCHREGEX || h->matchtype == MATCHGLOB){
+		struct capture caps[MAXCAPTURES];
+
+		if(!patternmatchcaps(h, str, caps, NULL)) return 0;
+		if(start) *start = caps[1].start;
+		if(len) *len = caps[1].len;
+		return 1;
+	}
+
+	lname = (int)strlen((char *)h->name);
+	lstr = (int)strlen((char *)str);
+
+	switch(h->matchtype){
+		case 0:
+#ifndef _WIN32
+			found = strcasestr((char *)str, (char *)h->name);
+#else
+			found = strstr((char *)str, (char *)h->name);
+#endif
+			if(found){
+				match = 1;
+				pos = (int)(found - (char *)str) + lname;
+			}
+			break;
+
+		case 1:
+			if(!strncasecmp((char *)str, (char *)h->name, lname)){
+				match = 1;
+				pos = lname;
+			}
+			break;
+
+		case 2:
+			if(lstr >= lname &&
+			   !strncasecmp((char *)str + (lstr - lname), (char *)h->name, lname)){
+				match = 1;
+				pos = 0;
+				if(start) *start = 0;
+				if(len) *len = lstr - lname;
+				return 1;
+			}
+			break;
+
+		default:
+			if(!strcasecmp((char *)str, (char *)h->name)){
+				match = 1;
+				pos = lstr;
+			}
+			break;
+	}
+
+	if(!match) return 0;
+
+	if(start) *start = pos;
+	if(len) *len = lstr - pos;
+	return 1;
+}
+
+int patternmatch(const struct hostname *h, const unsigned char *str)
+{
+	return patternmatchcaps(h, str, NULL, NULL);
+}
+
+/* Match a glob, recording what each star stood for.
+
+   A single star stands for any run of characters within one element of the
+   path, so it stops at a slash; a double star crosses them. Stars are
+   numbered in the order they appear, which is how a template refers to them.
+ */
+static int globmatch(const unsigned char *pat, const unsigned char *str,
+	const unsigned char *subject, struct capture *caps, int maxcaps, int star)
+{
+	while(*pat){
+		if(*pat == '*'){
+			int crosses = (pat[1] == '*');
+			const unsigned char *rest = pat + (crosses? 2 : 1);
+			int len;
+
+			for(len = 0; ; len++){
+				if(star < maxcaps && caps){
+					caps[star].start = (int)(str - subject);
+					caps[star].len = len;
+				}
+				if(globmatch(rest, str + len, subject, caps, maxcaps, star + 1)) return 1;
+				if(!str[len]) return 0;
+				if(!crosses && str[len] == '/') return 0;
+			}
+		}
+		if(*pat != *str) return 0;
+		pat++;
+		str++;
+	}
+	return *str == 0;
+}
+
+/* Match a pattern of any kind and report what its stars or groups stood for.
+   caps may be NULL when only the yes or no answer is wanted. */
+int patternmatchcaps(const struct hostname *h, const unsigned char *str,
+	struct capture *caps, int *ncaps)
+{
+	int n = 0;
+
+	if(ncaps) *ncaps = 0;
+	if(!h || !str) return 0;
+
+	if(h->matchtype == MATCHREGEX){
+#ifdef WITH_PCRE
+		struct capture local[MAXCAPTURES];
+
+		n = pcre_pattern_match(h->re, str, caps? caps : local, MAXCAPTURES);
+		if(ncaps) *ncaps = n;
+		return n > 0;
+#else
+		return 0;
+#endif
+	}
+
+	if(h->matchtype == MATCHGLOB){
+		struct capture local[MAXCAPTURES];
+		struct capture *use = caps? caps : local;
+		int i;
+
+		for(i = 0; i < MAXCAPTURES; i++){
+			use[i].start = 0;
+			use[i].len = 0;
+		}
+		use[0].start = 0;
+		use[0].len = (int)strlen((char *)str);
+		if(!h->name) return 0;
+		if(!globmatch(h->name, str, str, use, MAXCAPTURES, 1)) return 0;
+		if(ncaps){
+			for(n = MAXCAPTURES - 1; n > 0 && !use[n].len && !use[n].start; n--);
+			*ncaps = n + 1;
+		}
+		return 1;
+	}
+
+	/* the star at one end or both, as an access rule has always written it */
+	if(caps){
+		int start = 0, len = 0;
+
+		if(!patternmatchpos(h, str, &start, &len)) return 0;
+		caps[0].start = 0;
+		caps[0].len = (int)strlen((char *)str);
+		caps[1].start = start;
+		caps[1].len = len;
+		if(ncaps) *ncaps = 2;
+		return 1;
+	}
+	return patternmatchpos(h, str, NULL, NULL);
+}
+
+/* A URL in an http rule: stars anywhere, or a regular expression. */
+int parsepathpattern(struct hostname *h, unsigned char *arg)
+{
+	unsigned char *pattern;
+
+	h->re = NULL;
+	if((pattern = regexprefix(arg))) return compileregex(h, pattern);
+
+	h->matchtype = MATCHGLOB;
+	h->name = (unsigned char *)strdup((char *)arg);
+	return h->name? 0 : 1;
+}
+
 int IPInentry(struct sockaddr *sa, struct iplist *ipentry){
 	int addrlen;
 	unsigned char *ip, *ipf, *ipt;
@@ -62,36 +303,7 @@ int ACLmatches(struct ace* acentry, struct clientparam * param){
 			}
 			while(i > 5 && param->hostname[i-1] == '.') param->hostname[i-1] = 0;
 			for(hstentry = acentry->dstnames; hstentry; hstentry = hstentry->next){
-				int lname, lhost;
-				switch(hstentry->matchtype){
-					case 0:
-#ifndef _WIN32
-					if(strcasestr((char *)param->hostname, (char *)hstentry->name)) match = 1;
-#else
-					if(strstr((char *)param->hostname, (char *)hstentry->name)) match = 1;
-#endif
-					break;
-
-					case 1:
-					if(!strncasecmp((char *)param->hostname, (char *)hstentry->name, strlen((char *)hstentry->name)))
-						match = 1;
-					break;
-
-					case 2:
-					lname = strlen((char *)hstentry->name);
-					lhost = strlen((char *)param->hostname);
-					if(lhost > lname){
-						if(!strncasecmp((char *)param->hostname + (lhost - lname),
-							(char *)hstentry->name,
-							lname))
-								match = 1;
-					}
-					break;
-
-					default:
-					if(!strcasecmp((char *)param->hostname, (char *)hstentry->name)) match = 1;
-					break;
-        			}
+				if(patternmatch(hstentry, param->hostname)) match = 1;
 				if(match) break;
 			}
 		 }
@@ -164,7 +376,10 @@ int checkACL(struct clientparam * param){
 					continue;
 				}
 				param->lastace = acentry;
-				if(param->preauth) return 2;
+				if(param->preauth) {
+					applyportranges(param, acentry);
+					return 2;
+				}
 				if((param->operation == UDPASSOC)? (param->ctrlsocksrv != INVALID_SOCKET) : (param->remsock != INVALID_SOCKET)) {
 					return 0;
 				}
@@ -187,3 +402,31 @@ int checkACL(struct clientparam * param){
 	}
 	return 3;
 }
+
+char * aceaction (int action){
+	switch (action) {
+		case ALLOW:
+		case REDIRECT:
+			return "allow";
+		case DENY:
+			return "deny";
+		case BANDLIM:
+			return "bandlim";
+		case NOBANDLIM:
+			return "nobandlim";
+		case COUNTIN:
+			return "countin";
+		case NOCOUNTIN:
+			return "nocountin";
+		case COUNTOUT:
+			return "countout";
+		case NOCOUNTOUT:
+			return "nocountout";
+		case COUNTALL:
+			return "countall";
+		case NOCOUNTALL:
+			return "nocountall";
+		default:
+			return "unknown";
+	}
+}

src/auth.c

@@ -18,7 +18,14 @@ int alwaysauth(struct clientparam * param){
 
 
 	if(conf.connlimiter && !param->connlim  && startconnlims(param)) return 10;
+#ifdef WITH_HTTPSRV
+	/* The http server answers the request itself, so authorization must not
+	   try to reach a destination that does not exist. A request it has handed
+	   to another child does have one, and that child needs it opened. */
+	res = (param->srv->service == S_HTTPSRV && !param->onerequest)? 0 : doconnect(param);
+#else
 	res = doconnect(param);
+#endif
 	if(!res){
 		if(conf.bandlimfunc && (conf.bandlimiter||conf.bandlimiterout)){
 			_3proxy_mutex_lock(&bandlim_mutex);

src/common.c

@@ -182,7 +182,7 @@ int timeouts[12] = {
    EINVAL below it and the thread silently gets the 8M system default stack.
  */
 size_t threadstacksize(int extra){
-	long size = BASESTACKSIZE + extra;
+	long size = BASESTACKSIZE + TLSSTACKSIZE + extra;
 
 	if(size < (long)PTHREAD_STACK_MIN) size = (long)PTHREAD_STACK_MIN;
 	return (size_t)size;
@@ -746,7 +746,7 @@ int doconnect(struct clientparam * param){
 #ifdef WITH_UN
 	if(*SAFAMILY(&param->sinsl) != AF_UNIX)
 #endif
-	if(param->srv->so._bind(param->sostate, param->remsock, (struct sockaddr*)&param->sinsl, SASIZE(&param->sinsl))==-1) {
+	if(bindwithrange(param, param->remsock, &param->sinsl, param->extport)==-1) {
 		return 12;
 	}
 	
@@ -767,6 +767,49 @@ int doconnect(struct clientparam * param){
  return 0;
 }
 
+/* Number of ports tried before giving up when the range has to be searched by
+ * hand. The kernel option picks a free port itself and needs no retries. */
+#define RANGETRIES 10
+
+/* Bind sock to sa, taking the local port from the range if one is set. The
+ * range is packed as first | last << 16.
+ *
+ * IP_LOCAL_PORT_RANGE leaves the choice to the kernel, which knows which ports
+ * are free. Where the option does not exist, or the kernel refuses it, or the
+ * address family is not one it covers, pick a port at random instead and retry
+ * on failure, since the one picked may already be taken.
+ */
+int bindwithrange(struct clientparam *param, SOCKET sock, PROXYSOCKADDRTYPE *sa, uint32_t range)
+{
+	uint16_t first, last;
+	int i;
+
+	if(!range) return param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa));
+
+#ifdef IP_LOCAL_PORT_RANGE
+	if(*SAFAMILY(sa) == AF_INET &&
+	   !param->srv->so._setsockopt(param->sostate, sock, IPPROTO_IP, IP_LOCAL_PORT_RANGE,
+		(char *)&range, sizeof(range))){
+		*SAPORT(sa) = 0;
+		return param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa));
+	}
+#endif
+
+	first = (uint16_t)(range & 0xffff);
+	last = (uint16_t)(range >> 16);
+
+	for(i = 0; i < RANGETRIES; i++){
+		*SAPORT(sa) = htons((uint16_t)(first + (myrand() % (unsigned)(last - first + 1))));
+		if(!param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa))) return 0;
+	}
+
+	/* Every port tried was taken. Fall back to an ephemeral one, which is
+	   what the kernel option above does when it cannot honour the range, so
+	   an exhausted range behaves the same way on every platform. */
+	*SAPORT(sa) = 0;
+	return param->srv->so._bind(param->sostate, sock, (struct sockaddr *)sa, SASIZE(sa));
+}
+
 int scanaddr(const unsigned char *s, uint32_t * ip, uint32_t * mask) {
 	unsigned d1, d2, d3, d4, m;
 	int res;

src/conf.c

@@ -7,6 +7,10 @@
 */
 
 #include "proxy.h"
+
+#ifdef WITH_HTTPSRV
+static int addhttprule(char *op, char *host, char *url, char *params);
+#endif
 #include "mdhash.h"
 #ifdef WITH_SSL
 void ssl_install(void);
@@ -14,6 +18,9 @@ void ssl_install(void);
 #ifdef WITH_PCRE
 void pcre_install(void);
 #endif
+#ifdef WITH_TRANSPARENT
+void transparent_install(void);
+#endif
 #ifndef _WIN32
 #include <sys/resource.h>
 #include <pwd.h>
@@ -35,7 +42,6 @@ _3proxy_mutex_t config_mutex;
 int haveerror = 0;
 int linenum = 0;
 
-FILE *writable;
 struct counter_header cheader = {"3CF", (time_t)0};
 struct counter_record crecord;
 
@@ -60,10 +66,6 @@ FILE * confopen(){
 			curconf += strlen(chrootp);
 	}
 #endif
-	if(writable) {
-		rewind(writable);
-		return writable;
-	}
 	return fopen(curconf, "r");
 }
 
@@ -158,7 +160,12 @@ int start_proxy_thread(struct child * chp){
 	pthread_attr_init(&pa);
 	pthread_attr_setstacksize(&pa,threadstacksize(conf.stacksize));
 	pthread_attr_setdetachstate(&pa,PTHREAD_CREATE_DETACHED);
-	pthread_create(&thread, &pa, startsrv, (void *)chp);
+	if(pthread_create(&thread, &pa, startsrv, (void *)chp)){
+		pthread_attr_destroy(&pa);
+		fprintf(stderr, "Failed to create service thread on line %d, try to set larger stacksize\n", linenum);
+		_3proxy_sem_unlock(conf.threadinit);
+		return(40);
+	}
 	pthread_attr_destroy(&pa);
 #endif
 	_3proxy_sem_lock(conf.threadinit);
@@ -253,12 +260,32 @@ static int h_proxy(int argc, unsigned char ** argv){
 		childdef.service = S_UDPPM;
 		childdef.helpmessage = " -s single packet UDP service for request/reply (DNS-like) services\n";
 	}
+#ifdef WITH_HTTPSRV
 	else if(!strcmp((char *)argv[0], "admin")) {
-		childdef.pf = adminchild;
+		/* The same service as httpsrv, with the administration pages
+		   declared for it. */
+		if(addhttprule("admin_counters", "*", "/C*", NULL) ||
+		   addhttprule("admin_reload", "*", "/R", NULL) ||
+		   addhttprule("admin_services", "*", "/S*", NULL) ||
+		   addhttprule("admin", "*", "**", NULL)){
+			fprintf(stderr, "Failed to declare the admin pages, line %d\n", linenum);
+			return 1;
+		}
+		childdef.pf = httpsrvchild;
 		childdef.port = 80;
 		childdef.isudp = 0;
-		childdef.service = S_ADMIN;
+		childdef.service = S_HTTPSRV;
 	}
+#endif
+#ifdef WITH_HTTPSRV
+	else if(!strcmp((char *)argv[0], "httpsrv")) {
+		childdef.pf = httpsrvchild;
+		childdef.port = 80;
+		childdef.isudp = 0;
+		childdef.service = S_HTTPSRV;
+		childdef.helpmessage = " HTTP server, /echo describes the connection, /data?size=N returns N bytes\n";
+	}
+#endif
 	else if(!strcmp((char *)argv[0], "dnspr")) {
 		childdef.pf = dnsprchild;
 		childdef.port = 53;
@@ -765,14 +792,117 @@ struct redirdesc redirs[] = {
     {R_SOCKS5P, "socks5+", sockschild},
     {R_SOCKS4B, "socks4b", sockschild},
     {R_SOCKS5B, "socks5b", sockschild},
-    {R_ADMIN, "admin", adminchild},
     {R_EXTIP, "extip", NULL},
+    {R_EXTPORT, "extport", NULL},
+    {R_INTPORT, "intport", NULL},
     {R_TLS, "tls", tlsprchild},
     {R_HA, "ha", NULL},
     {R_DNS, "dns", dnsprchild},
     {0, NULL, NULL}
 };
 
+#ifdef WITH_HTTPSRV
+/* Headers a rule adds are written as one argument, the lines separated by a
+   backslash and an n, because a configuration line cannot hold a line ending.
+   Those two characters become a real one here. A line ending which reached the
+   argument as itself is dropped: what goes on the wire is decided here and not
+   by whatever produced the string. */
+static unsigned char * parsehdrs(const unsigned char *arg)
+{
+	unsigned char *out, *o;
+	const unsigned char *p;
+	size_t len = strlen((char *)arg);
+
+	out = malloc(len * 2 + 3);
+	if(!out) return NULL;
+	for(p = arg, o = out; *p; p++){
+		if(*p == '\\' && p[1] == 'n'){
+			*o++ = '\r';
+			*o++ = '\n';
+			p++;
+			continue;
+		}
+		if(*p == '\r' || *p == '\n') continue;
+		*o++ = *p;
+	}
+	if(o == out || o[-1] != '\n'){
+		*o++ = '\r';
+		*o++ = '\n';
+	}
+	*o = 0;
+	return out;
+}
+
+/* An optional argument which a star, or nothing at all, leaves at its
+   default. */
+static int optnum(int argc, unsigned char **argv, int at, int def)
+{
+	if(argc <= at || !strcmp((char *)argv[at], "*")) return def;
+	return atoi((char *)argv[at]);
+}
+
+static void freehttprule(struct httprule *rule)
+{
+	if(rule->host.name) free(rule->host.name);
+	if(rule->url.name) free(rule->url.name);
+	if(rule->params) free(rule->params);
+	if(rule->ctype) free(rule->ctype);
+	if(rule->hdrs) free(rule->hdrs);
+	free(rule);
+}
+
+/* Installs one rule from code, for the pages a service predefines. */
+static int addhttprule(char *op, char *host, char *url, char *params)
+{
+    struct httprule *rule, *tail;
+    unsigned char hostbuf[64], urlbuf[128];
+
+	rule = malloc(sizeof(struct httprule));
+	if(!rule) return 1;
+	memset(rule, 0, sizeof(struct httprule));
+	rule->maxage = -1;
+
+	rule->op = httpopbyname((unsigned char *)op);
+	if(rule->op < 0){
+		free(rule);
+		return 1;
+	}
+
+	strcpy((char *)hostbuf, host);
+	strcpy((char *)urlbuf, url);
+	if(parsepattern(&rule->host, hostbuf) || parsepathpattern(&rule->url, urlbuf)){
+		free(rule->host.name);
+		free(rule);
+		return 1;
+	}
+	if(params) rule->params = (unsigned char *)strdup(params);
+
+	if(!conf.httprules) conf.httprules = rule;
+	else {
+		for(tail = conf.httprules; tail->next; tail = tail->next);
+		tail->next = rule;
+	}
+	return 0;
+}
+#endif
+
+/* Parses an inclusive FIRST-LAST local port range into first | last << 16. */
+static int parserange(unsigned char *arg, uint32_t *range)
+{
+	char *end;
+	unsigned long first, last;
+
+	first = strtoul((char *)arg, &end, 10);
+	if(end == (char *)arg || *end != '-' || !first || first > 65535) return 1;
+
+	arg = (unsigned char *)end + 1;
+	last = strtoul((char *)arg, &end, 10);
+	if(end == (char *)arg || *end || !last || last > 65535 || last < first) return 1;
+
+	*range = (uint32_t)first | ((uint32_t)last << 16);
+	return 0;
+}
+
 static int h_parent(int argc, unsigned char **argv){
   struct ace *acl = NULL;
   struct chain *chains;
@@ -838,7 +968,21 @@ static int h_parent(int argc, unsigned char **argv){
 		*cidr = '/';
 		chains->cidr = atoi(cidr + 1);
 	}
-	*SAPORT(&chains->addr) = htons((uint16_t)atoi((char *)argv[4]));
+	if(chains->type == R_EXTPORT || chains->type == R_INTPORT){
+		if(!SAISNULL(&chains->addr)){
+			fprintf(stderr, "Chaining error: chain type (%s) sets a local port range, it requires 0.0.0.0 as address on line %d\n", argv[2], linenum);
+			free(chains->exthost);
+			free(chains);
+			return(4);
+		}
+		if(parserange(argv[4], &chains->range)){
+			fprintf(stderr, "Chaining error: bad port range (%s) on line %d\n", argv[4], linenum);
+			free(chains->exthost);
+			free(chains);
+			return(3);
+		}
+	}
+	else *SAPORT(&chains->addr) = htons((uint16_t)atoi((char *)argv[4]));
 	switch(chains->type){
 	    case R_POP3:
 	    case R_SMTP:
@@ -872,6 +1016,103 @@ static int h_parent(int argc, unsigned char **argv){
 	
 }
 
+#ifdef WITH_HTTPSRV
+/* http <hostname> <url> <operation> [parameters]
+   Rules are matched in the order they are given, first match wins. */
+static int h_http(int argc, unsigned char **argv){
+    struct httprule *rule, *tail;
+    int op;
+
+	/* http OPERATION HOST URL [PARAMETERS] */
+	op = httpopbyname(argv[1]);
+	if(op < 0){
+		fprintf(stderr, "Unknown http operation: %s line %d\n", argv[1], linenum);
+		return(1);
+	}
+
+	rule = malloc(sizeof(struct httprule));
+	if(!rule) return(21);
+	memset(rule, 0, sizeof(struct httprule));
+	rule->op = op;
+	rule->maxage = -1;
+
+	if(parsepattern(&rule->host, argv[2]) || parsepathpattern(&rule->url, argv[3])){
+		fprintf(stderr, "No memory for http rule, line %d\n", linenum);
+		free(rule->host.name);
+		free(rule);
+		return(21);
+	}
+
+	if(argc > 4 && (!strcmp((char *)argv[1], "file") || !strcmp((char *)argv[1], "cache"))){
+		/* PATH [TYPE [MAX-AGE [HEADERS [CODE]]]]. A star, or nothing,
+		   leaves each of them out: the type is worked out from the name,
+		   nothing is said about caching, no headers are added and the
+		   answer is the usual 200. */
+		rule->params = (unsigned char *)strdup((char *)argv[4]);
+		if(argc > 5 && strcmp((char *)argv[5], "*"))
+			rule->ctype = (unsigned char *)strdup((char *)argv[5]);
+		rule->maxage = optnum(argc, argv, 6, -1);
+		if(argc > 7 && strcmp((char *)argv[7], "*"))
+			rule->hdrs = parsehdrs(argv[7]);
+		rule->code = optnum(argc, argv, 8, 0);
+		if(!rule->params
+		   || (argc > 5 && strcmp((char *)argv[5], "*") && !rule->ctype)
+		   || (argc > 7 && strcmp((char *)argv[7], "*") && !rule->hdrs)){
+			freehttprule(rule);
+			return(21);
+		}
+	}
+	else if(!strcmp((char *)argv[1], "reply")){
+		/* CODE [HEADERS], and no body at all. */
+		rule->code = optnum(argc, argv, 4, 200);
+		if(argc > 5 && strcmp((char *)argv[5], "*")){
+			rule->hdrs = parsehdrs(argv[5]);
+			if(!rule->hdrs){
+				freehttprule(rule);
+				return(21);
+			}
+		}
+	}
+	else if(argc > 4){
+		/* What follows the URL belongs to the operation, and an operation
+		   such as redir reads more than one word of it. */
+		int i, len = 0;
+
+		for(i = 4; i < argc; i++) len += (int)strlen((char *)argv[i]) + 1;
+		rule->params = malloc(len);
+		if(rule->params){
+			int at = 0;
+
+			for(i = 4; i < argc; i++)
+				at += sprintf((char *)rule->params + at, "%s%s",
+					i > 4? " " : "", argv[i]);
+		}
+		if(!rule->params){
+			freehttprule(rule);
+			return(21);
+		}
+	}
+
+	if(rule->code && (rule->code < 100 || rule->code > 599)){
+		fprintf(stderr, "Wrong http status: %d line %d\n", rule->code, linenum);
+		freehttprule(rule);
+		return(1);
+	}
+	if(rule->maxage < -1){
+		fprintf(stderr, "Wrong max-age, line %d\n", linenum);
+		freehttprule(rule);
+		return(1);
+	}
+
+	if(!conf.httprules) conf.httprules = rule;
+	else {
+		for(tail = conf.httprules; tail->next; tail = tail->next);
+		tail->next = rule;
+	}
+	return 0;
+}
+#endif
+
 static int h_nolog(int argc, unsigned char **argv){
   struct ace *acl = NULL;
 
@@ -1010,20 +1251,7 @@ struct ace * make_ace (int argc, unsigned char ** argv){
 					return(NULL);
 				}
 				memset(hostnamel, 0, sizeof(struct hostname));
-				hostnamel->matchtype = 3;
-				pattern = arg;
-				if(pattern[arglen-1] == '*'){
-					arglen --;
-					pattern[arglen] = 0;
-					hostnamel->matchtype ^= MATCHEND;
-				}
-				if(pattern[0] == '*'){
-					pattern++;
-					arglen--;
-					hostnamel->matchtype ^= MATCHBEGIN;
-				}
-				hostnamel->name = (unsigned char *) strdup( (char *)pattern);
-				if(!hostnamel->name) {
+				if(parsepattern(hostnamel, arg)) {
 					fprintf(stderr, "No memory for ACL entry, line %d\n", linenum);
 					return(NULL);
 				}
@@ -1370,7 +1598,7 @@ static int h_ace(int argc, unsigned char **argv){
 		tl->ace = acl;
 	
 		if((acl->action == COUNTIN)||(acl->action == COUNTOUT)||(acl->action == COUNTALL)) {
-			unsigned long lim;
+			uint64_t lim = 0;
 
 			tl->comment = ( char *)argv[1];
 			while(isdigit(*tl->comment))tl->comment++;
@@ -1378,9 +1606,9 @@ static int h_ace(int argc, unsigned char **argv){
 			tl->comment = strdup(tl->comment);
 
 			sscanf((char *)argv[1], "%u", &tl->number);
-			sscanf((char *)argv[3], "%lu", &lim);
+			if(sscanf((char *)argv[3], "%"SCNu64"", &lim) != 1) lim = 0;
 			tl->type = getrotate(*argv[2]);
-			tl->traflim64 =  ((uint64_t)lim)*(1024*1024);
+			tl->traflim64 =  lim*(1024*1024);
 			if(!tl->traflim64) {
 				free(tl);
 				freeacl(acl);
@@ -1499,6 +1727,11 @@ static int h_plugin(int argc, unsigned char **argv){
 		return 0;
 	}
 #endif
+#ifdef WITH_TRANSPARENT
+	if(argc >= 3 && !strcmp((char *)argv[2], "transparent_plugin")){
+		return 0;
+	}
+#endif
 #ifdef NOPLUGINS
 	return 999;
 #else
@@ -1671,6 +1904,13 @@ int h_server_verify(int argc, unsigned char **argv);
 int h_no_server_verify(int argc, unsigned char **argv);
 int h_client_mode(int argc, unsigned char **argv);
 #endif
+#ifdef WITH_HTTPSRV
+int h_http_content_type(int argc, unsigned char **argv);
+#endif
+#ifdef WITH_TRANSPARENT
+int h_transparent(int argc, unsigned char **argv);
+int h_notransparent(int argc, unsigned char **argv);
+#endif
 #ifdef WITH_PCRE
 int h_pcre(int argc, unsigned char **argv);
 int h_pcre_rewrite(int argc, unsigned char **argv);
@@ -1687,7 +1927,14 @@ struct commands commandhandlers[]={
 	{NULL,  "socks", h_proxy, 1, 0},
 	{NULL,  "tcppm", h_proxy, 4, 0},
 	{NULL,  "udppm", h_proxy, 4, 0},
+#ifdef WITH_HTTPSRV
 	{NULL,  "admin", h_proxy, 1, 0},
+#endif
+#ifdef WITH_HTTPSRV
+	{NULL,  "httpsrv", h_proxy, 1, 0},
+	{NULL,  "http", h_http, 4, 0},
+	{NULL,  "http_content_type", h_http_content_type, 3, 3},
+#endif
 	{NULL,  "dnspr", h_proxy, 1, 0},
 	{NULL,  "internal", h_internal, 2, 2},
 	{NULL, "external", h_external, 2, 2},
@@ -1794,6 +2041,10 @@ struct commands commandhandlers[]={
 	{NULL, "ssl_client_mode", h_client_mode, 1, 2},
 	{NULL, "ssl_certcache", h_certcache, 2, 2},
 #endif
+#ifdef WITH_TRANSPARENT
+	{NULL, "transparent", h_transparent, 1, 2},
+	{NULL, "notransparent", h_notransparent, 1, 1},
+#endif
 #ifdef WITH_PCRE
 	{NULL, "pcre", h_pcre, 4, 0},
 	{NULL, "pcre_rewrite", h_pcre_rewrite, 5, 0},
@@ -1838,6 +2089,21 @@ int parsestr (unsigned char *str, unsigned char **argm, int nitems, unsigned cha
 			argm[argc] = 0;
 			return argc;
 		case '$':
+			/* Two dollars stand for one. That is how a literal dollar is
+			   written where a file to include would otherwise be read, and
+			   the second one is dropped here as a quote character is. */
+			if(str[1] == '$'){
+				str1 = str;
+				do {
+					*str1 = *(str1 + 1);
+				}while(*(str1++));
+				if(space){
+					argm[argc++] = str;
+					if(argc >= nitems) return argc;
+					space = 0;
+				}
+				break;
+			}
 			if(comment){
 				if(space){
 					argm[argc++] = str;
@@ -1935,16 +2201,6 @@ int readconfig(FILE * fp){
 	if(!strcmp((char *)argv[0], "end") && argc == 1) {	
 		break;
 	}
-	else if(!strcmp((char *)argv[0], "writable") && argc == 1) {	
-		if(!writable){
-			writable = freopen(curconf, "r+", fp);
-			if(!writable){
-				fprintf(stderr, "Unable to reopen config for writing: %s\n", curconf);
-				return 1;
-			}
-		}
-		continue;
-	}
 
 	res = 1;
 	for(cm = commandhandlers; cm; cm = cm->next){
@@ -2094,6 +2350,9 @@ int reload (void){
 #endif
 #ifdef WITH_PCRE
 	pcre_install();
+#endif
+#ifdef WITH_TRANSPARENT
+	transparent_install();
 #endif
 	conf.paused++;
 	freeconf(&conf);
@@ -2106,7 +2365,7 @@ int reload (void){
 		if(error) {
 			 freeconf(&conf);
 		}
-		if(!writable)fclose(fp);
+		fclose(fp);
 	}
 	_3proxy_mutex_unlock(&config_mutex);
 	return error;

src/datatypes.c

@@ -391,8 +391,6 @@ static void * ef_ace_next(struct node * node){
 }
 
 
-char * aceaction (int action);
-
 static void * ef_ace_type(struct node * node){
 	return aceaction(((struct ace *)node->value) -> action);
 }

src/dnspr.c

@@ -45,7 +45,7 @@ void * dnsprchild(struct clientparam* param) {
  memcpy(buf, param->srv->udpbuf, i);
  _3proxy_sem_unlock(udpinit);
  semlocked = 0;
-#ifdef _WIN32
+#if defined(_WIN32) && !defined(SHARE_UDP_SOCKET)
 	if((param->clisock=param->srv->so._socket(param->sostate, AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) {
 		RETURN(818);
 	}
@@ -56,6 +56,8 @@ void * dnsprchild(struct clientparam* param) {
 	}
 
 #else
+	/* The reply has to come from the address the query was sent to, which
+	   is the listening socket. */
 	param->clisock = param->srv->srvsock;
 #endif
 
@@ -149,7 +151,7 @@ void * dnsprchild(struct clientparam* param) {
 	}
 	memset(&param->sinsl, 0, sizeof(param->sinsl));
 	*SAFAMILY(&param->sinsl) = *SAFAMILY(&nservers[0].addr);
-	if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl))) {
+	if(bindwithrange(param, param->remsock, &param->sinsl, param->extport)) {
 		RETURN(819);
 	}
 	param->sinsr = nservers[0].addr;
@@ -217,7 +219,8 @@ CLEANRET:
  }
  if(bbuf)free(bbuf);
  if(host)free(host);
-#ifndef _WIN32
+#if !defined(_WIN32) || defined(SHARE_UDP_SOCKET)
+ /* The socket belongs to the service, so the caller must not close it. */
  param->clisock = INVALID_SOCKET;
 #endif
  return (NULL);

src/ftppr.c

@@ -64,6 +64,13 @@ void * ftpprchild(struct clientparam* param) {
 
 	}
 	else if (!strncasecmp((char *)buf, "PASS ", 5)){
+		/* The user name carries the server to log in to, and it arrives
+		   with USER. Without it there is nothing to log in to, and what
+		   follows would read the name and the host as if there were. */
+		if(!param->hostname || !param->extusername){
+			socksend(param, param->ctrlsock, (unsigned char *)"503 Login with USER first\r\n", 27, conf.timeouts[STRING_S]);
+			RETURN(805);
+		}
 		param->extpassword = (unsigned char *)strdup((char *)buf+5);
 		inbuf = BUFSIZE;
 		res = ftplogin(param, (char *)buf, &inbuf);
@@ -121,7 +128,7 @@ void * ftpprchild(struct clientparam* param) {
 		}
 		if ((clidatasock=socket(SASOCK(&param->sincl), SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {RETURN(821);}
 		*SAPORT(&param->sincl) = 0;
-		if(param->srv->so._bind(param->sostate, clidatasock, (struct sockaddr *)&param->sincl, SASIZE(&param->sincl))){RETURN(822);}
+		if(bindwithrange(param, clidatasock, &param->sincl, param->intport)){RETURN(822);}
 		if (pasv) {
 			if(param->srv->so._listen(param->sostate, clidatasock, 1)) {RETURN(823);}
 			sasize = sizeof(param->sincl);

src/pcre.c

@@ -265,6 +265,9 @@ static FILTER_ACTION pcre_filter_client(void *fo, struct clientparam * param, vo
 	return (res)? CONTINUE:PASS;
 }
 
+/* What a rewritten buffer keeps free for its caller to append to. */
+#define PCRE_HEADROOM 1024
+
 static FILTER_ACTION pcre_filter_buffer(void *fc, struct clientparam *param, unsigned char ** buf_p, int * bufsize_p, int offset, int * length_p){
 	PCRE2_SIZE *ovector;
 	int count = 0;
@@ -277,7 +280,7 @@ static FILTER_ACTION pcre_filter_buffer(void *fc, struct clientparam *param, uns
 #define pcrefd ((struct pcre_filter_data *)fc)
 
 	for(acl = pcrefd->acl; acl; acl=acl->next){
-		if(pl->ACLMatches(pcrefd->acl, param)){
+		if(pl->ACLMatches(acl, param)){
 			match = 1;
 			break;
 		}
@@ -324,12 +327,17 @@ static FILTER_ACTION pcre_filter_buffer(void *fc, struct clientparam *param, uns
 			else if(*replace == '$' && isnumber(*(replace+1))){
 				replace ++;
 				num = atoi(replace);
+				/* Past the digits first, and only then decide whether
+				   the group is one to copy: the pass which measured
+				   this string did it in that order, and a reference it
+				   counted as nothing must not be written out as its
+				   own digits here. */
+				while(isnumber(*replace)) replace++;
 				if(num > (count - 1)) continue;
 				if(ovector[(num<<1)] == PCRE2_UNSET) continue;
 				if(ovector[(num<<1) + 1] > (PCRE2_SIZE)*length_p || ovector[(num<<1)] > ovector[(num<<1) + 1]) continue;
 				memcpy(target, *buf_p + ovector[(num<<1)], ovector[(num<<1) + 1] - ovector[(num<<1)]);
 				target += (ovector[(num<<1) + 1] - ovector[(num<<1)]);
-				while(isnumber(*replace)) replace++;
 			}
 			else {
 				*target++ = *replace++;
@@ -338,7 +346,13 @@ static FILTER_ACTION pcre_filter_buffer(void *fc, struct clientparam *param, uns
 		repsz = (int)(target - tmpbuf);
 		memcpy(target, *buf_p + ovector[1], *length_p - ovector[1]);
 		if((ovector[0] + replen + 1) > *bufsize_p){
-			newbuf = pl->mallocfunc(ovector[0] + replen + 1);
+			/* Room beyond what was produced: whoever asked for the
+			   filtering usually has something of its own to add, and a
+			   buffer sized to the last byte written leaves nowhere to
+			   put it. The size reported is the size allocated. */
+			int newsize = ovector[0] + replen + 1 + PCRE_HEADROOM;
+
+			newbuf = pl->mallocfunc(newsize);
 			if(!newbuf){
 				pl->freefunc(tmpbuf);
 				return CONTINUE;
@@ -346,7 +360,7 @@ static FILTER_ACTION pcre_filter_buffer(void *fc, struct clientparam *param, uns
 			memcpy(newbuf, *buf_p, ovector[0]);
 			pl->freefunc(*buf_p);
 			*buf_p = (unsigned char *)newbuf;
-			*bufsize_p = ovector[0] + replen + 1;
+			*bufsize_p = newsize;
 		}
 		memcpy(*buf_p + ovector[0], tmpbuf, replen);
 		pl->freefunc(tmpbuf);
@@ -629,6 +643,71 @@ static struct symbol regexp_symbols[] = {
 };
 
 
+/* Compiling and matching for patterns outside the pcre commands: a host name
+   or a URL in an http rule, an access rule naming a host. They go through the
+   same compile, with whatever pcre_options is set to, so one kind of regular
+   expression is understood everywhere.
+ */
+void * pcre_pattern_compile(const unsigned char *pattern, char *errbuf, int errlen)
+{
+	pcre2_code *re;
+	int errcode;
+	PCRE2_SIZE erroffset;
+
+	re = pcre2_compile((PCRE2_SPTR)pattern, PCRE2_ZERO_TERMINATED, pcre_options,
+		&errcode, &erroffset, NULL);
+	if(!re){
+		if(errbuf && errlen > 0){
+			PCRE2_UCHAR message[256];
+
+			pcre2_get_error_message(errcode, message, sizeof(message));
+			snprintf(errbuf, errlen, "%s at offset %d", (char *)message, (int)erroffset);
+		}
+		return NULL;
+	}
+	return re;
+}
+
+void pcre_pattern_free(void *re)
+{
+	if(re) pcre2_code_free((pcre2_code *)re);
+}
+
+/* Returns the number of captures placed, or 0 when the subject does not
+   match. Element 0 is the whole match. The match data is per call: a rule is
+   matched from several threads at once.
+ */
+int pcre_pattern_match(void *re, const unsigned char *subject, struct capture *caps, int maxcaps)
+{
+	pcre2_match_data *match_data;
+	PCRE2_SIZE *ovector;
+	int count, i, placed = 0;
+
+	if(!re || !subject) return 0;
+	match_data = pcre2_match_data_create_from_pattern((pcre2_code *)re, NULL);
+	if(!match_data) return 0;
+
+	count = pcre2_match((pcre2_code *)re, (PCRE2_SPTR)subject, PCRE2_ZERO_TERMINATED,
+		0, 0, match_data, NULL);
+	if(count > 0){
+		ovector = pcre2_get_ovector_pointer(match_data);
+		if(count > maxcaps) count = maxcaps;
+		for(i = 0; i < count; i++){
+			if(ovector[i*2] == PCRE2_UNSET){
+				caps[i].start = 0;
+				caps[i].len = 0;
+			}
+			else {
+				caps[i].start = (int)ovector[i*2];
+				caps[i].len = (int)(ovector[i*2+1] - ovector[i*2]);
+			}
+		}
+		placed = count;
+	}
+	pcre2_match_data_free(match_data);
+	return placed;
+}
+
 void pcre_install(void){
 
 	struct filter *flt, *tmpflt;

src/plugins.c

@@ -15,7 +15,9 @@ void decodeurl(unsigned char *s, int allowcr);
 int parsestr (unsigned char *str, unsigned char **argm, int nitems, unsigned char ** buff, int *inbuf, int *bufsize);
 struct ace * make_ace (int argc, unsigned char ** argv);
 extern char * proxy_stringtable[];
+#ifdef WITH_HTTPSRV
 extern char * admin_stringtable[];
+#endif
 extern struct schedule * schedule;
 int start_proxy_thread(struct child * chp);
 
@@ -59,7 +61,6 @@ struct symbol symbols[] = {
 	{symbols+34, "socks", (void *) sockschild},
 	{symbols+35, "tcppm", (void *) tcppmchild},
 	{symbols+36, "udppm", (void *) udppmchild},
-	{symbols+37, "admin", (void *) adminchild},
 	{symbols+38, "ftppr", (void *) ftpprchild},
 	{symbols+39, "smtpp", (void *) smtppchild},
 	{symbols+40, "auto", (void *) smtppchild},
@@ -121,7 +122,11 @@ struct pluginlink pluginlink = {
 	proxy_stringtable,
 	&schedule,
 	freeacl,
+#ifdef WITH_HTTPSRV
 	admin_stringtable,
+#else
+	NULL,
+#endif
 	&childdef,
 	start_proxy_thread,
 	freeparam,

src/plugins/TransparentPlugin/CMakeLists.txt

@@ -1,6 +0,0 @@
-# TransparentPlugin
-# Works on Linux (with netfilter), BSD and macOS (without netfilter support)
-
-add_3proxy_plugin(TransparentPlugin
-    SOURCES transparent_plugin.c
-)

src/plugins/TransparentPlugin/Makefile

@@ -1 +0,0 @@
-include Makefile.var

src/plugins/TransparentPlugin/Makefile.inc

@@ -1,10 +0,0 @@
-all: $(BUILDDIR)TransparentPlugin$(DLSUFFICS)
-
-
-
-transparent_plugin$(OBJSUFFICS): transparent_plugin.c
-	$(CC) $(CFLAGS) $(DCFLAGS) transparent_plugin.c
-
-
-$(BUILDDIR)TransparentPlugin$(DLSUFFICS): transparent_plugin$(OBJSUFFICS)
-	$(LN) $(LNOUT)../../$(BUILDDIR)TransparentPlugin$(DLSUFFICS) $(LDFLAGS) $(DLFLAGS) transparent_plugin$(OBJSUFFICS)

src/plugins/TransparentPlugin/transparent_plugin.c

@@ -1,128 +0,0 @@
-/*
-   3APA3A simplest proxy server
-   (c) 2002-2026 by Vladimir Dubrovin <vlad@3proxy.org>
-
-   please read License Agreement
-
-*/
-
-
-#ifdef WITH_NETFILTER
-#include <sys/utsname.h>
-#endif
-#include "../../structures.h"
-#include "../../proxy.h"
-#ifdef WITH_NETFILTER
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <limits.h>
-#include <linux/netfilter_ipv4.h>
-#endif
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-
-static struct pluginlink * pl;
-
-static int transparent_loaded = 0;
-
-static void* transparent_filter_open(void * idata, struct srvparam * param){
-	return idata;
-}
-
-static FILTER_ACTION transparent_filter_client(void *fo, struct clientparam * param, void** fc){
-
-	char addrbuf[64];
-
-#ifdef WITH_NETFILTER
-	socklen_t len;
-
-	len = sizeof(param->req);
-#ifdef SO_ORIGINAL_DST
-
-	if(getsockopt(param->clisock, 
-#ifndef NOIPV6
-#ifdef SOL_IPV6
-		*SAFAMILY(&param->sincr) == AF_INET6?SOL_IPV6:
-#endif
-#endif
-			SOL_IP, SO_ORIGINAL_DST,(struct sockaddr *) &param->req, &len) || !memcmp((char *)SAADDR(&param->req), "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0",  SAADDRLEN(&param->req))){
-		return PASS;
-	}
-#else
-#error No SO_ORIGINAL_DST defined
-       	param->srv->logfunc(param, (unsigned char *)"transparent_plugin: No SO_ORIGINAL_DST defined");
-	return REJECT;
-#endif
-#else
-	if(*SAFAMILY(&param->sincl) == AF_INET || *SAFAMILY(&param->sincl) == AF_INET6){
-	    param->req = param->sincl;
-	    param->sincl = param->srv->intsa;
-	}
-#endif
-	pl->myinet_ntop(*SAFAMILY(&param->req), SAADDR(&param->req), (char *)addrbuf, sizeof(addrbuf));
-	if(param->hostname) pl->freefunc(param->hostname);
-	param->hostname = (unsigned char *)pl->strdupfunc(addrbuf);
-	param->sinsr = param->req;
-	return PASS;
-}
-
-
-static void transparent_filter_clear(void *fo){
-}
-
-static void transparent_filter_close(void *fo){
-}
-
-static struct filter transparent_filter = {
-	NULL,
-	"Transparent filter",
-	"Transparent filter",
-	transparent_filter_open,
-	transparent_filter_client, 
-	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-	transparent_filter_clear, 
-	transparent_filter_close
-};
-
-static int h_transparent(int argc, unsigned char **argv){
-	transparent_filter.filter_open = transparent_filter_open;
-	return 0;
-}
-
-static int h_notransparent(int argc, unsigned char **argv){
-	transparent_filter.filter_open = NULL;
-	return 0;
-}
-
-static struct commands transparent_commandhandlers[] = {
-	{transparent_commandhandlers+1, "transparent", h_transparent, 1, 1},
-	{NULL, "notransparent", h_notransparent, 1, 1}
-};
-
-
-#ifdef WATCOM
-#pragma aux transparent_plugin "*" parm caller [ ] value struct float struct routine [eax] modify [eax ecx edx]
-#undef PLUGINCALL
-#define PLUGINCALL
-#endif
-
-
-PLUGINAPI int PLUGINCALL transparent_plugin (struct pluginlink * pluginlink, 
-					 int argc, char** argv){
-	pl = pluginlink;
-	if(!transparent_loaded){
-		transparent_loaded = 1;
-		transparent_filter.next = pl->conf->filters;
-		pl->conf->filters = &transparent_filter;
-		transparent_commandhandlers[1].next = pl->commandhandlers->next;
-		pl->commandhandlers->next = transparent_commandhandlers;
-	}
-	return 0;
-		
- }
-#ifdef  __cplusplus
-}
-#endif

src/proxy.c

@@ -132,6 +132,12 @@ char * proxy_stringtable[] = {
 };
 
 #define LINESIZE 32768
+/* "Content-Length: " plus 20 digits plus CRLF and a NUL, rounded up */
+#define CLHDRSIZE 48
+/* what the headers this proxy adds of its own can come to: a Forwarded or
+   Via with a host name in it, a Connection, a Proxy-support and a
+   Proxy-Authorization carrying an encoded user and password */
+#define HDRRESERVE 2048
 #define BUFSIZE (LINESIZE*2)
 #define FTPBUFSIZE 1536
 
@@ -151,11 +157,45 @@ static int send_st(struct clientparam *param, int idx){
 	return socksend(param, param->clisock, (unsigned char *)proxy_stringtable[idx], pst_len(idx), conf.timeouts[STRING_S]);
 }
 
+/* Makes room in a buffer whose size is tracked. A filter may hand back one
+   holding exactly what it produced, so nothing may be added to it without
+   asking for the room first. Returns 1 when the room cannot be had. */
+static int growbuf(unsigned char **buf, int *bufsize, int need){
+	unsigned char *newbuf;
+
+	if(need <= *bufsize) return 0;
+	need += BUFSIZE;		/* for what follows too, not just this */
+	if(!(newbuf = realloc(*buf, need))) return 1;
+	*buf = newbuf;
+	*bufsize = need;
+	return 0;
+}
+
 static void freeptr(void *p){
 	void **pp = (void **)p;
 	if(*pp) { free(*pp); *pp = NULL; }
 }
 
+#ifndef WITHMAIN
+/* Point at the path in a request line and report the authority it names.
+   Returns NULL if the line is not one we can put back together. */
+static unsigned char * reqpath(unsigned char *line, unsigned char **host, int *hostlen)
+{
+	unsigned char *sp, *p;
+
+	*host = NULL;
+	*hostlen = 0;
+	if(!line || !(sp = (unsigned char *)strchr((char *)line, ' '))) return NULL;
+	while(*sp == ' ') sp++;
+	if(*sp == '/') return sp;
+	if(strncasecmp((char *)sp, "http://", 7)) return NULL;
+	*host = p = sp + 7;
+	while(*p && *p != '/' && *p != ' ') p++;
+	*hostlen = (int)(p - *host);
+	return (*p == '/')? p : NULL;
+}
+#endif
+
 static void logurl(struct clientparam * param, char * buf, char * req, int ftp){
  char *sb;
  char *se;
@@ -254,6 +294,7 @@ void * proxychild(struct clientparam* param) {
  int sleeptime = 0;
 #ifndef WITHMAIN
  int reqsize, reqbufsize;
+ unsigned char *origreq = NULL;
 #endif
  int authenticate;
  struct pollfd fds[2];
@@ -577,16 +618,60 @@ for(;;){
 
 #ifndef WITHMAIN
 
+ /* Only worth keeping a copy when something can rewrite it. */
+ if(param->nreqfilters) origreq = (unsigned char *)strdup((char *)req);
  action = handlereqfilters(param, &req, &reqbufsize, 0, &reqsize);
  if(action == HANDLED){
+	freeptr(&origreq);
 	RETURN(0);
  }
- if(action != PASS) RETURN(517);
+ if(action != PASS){
+	freeptr(&origreq);
+	RETURN(517);
+ }
+
+ /* Only the copy in req was rewritten. On a direct connection the server is
+    sent the request line held in buf, which was parsed and reduced to its
+    path before the filters ran, so put the new path there as well.
+
+    The destination was chosen, and the access rules applied to it, before
+    the rewrite happened. A rewrite that changes the method or the authority
+    is therefore left alone: acting on it would send the request somewhere
+    the rules never saw. */
+ if(origreq && !isconnect && !ftp && strcmp((char *)req, (char *)origreq)){
+	unsigned char *oldhost, *newhost, *oldpath, *newpath;
+	int oldhostlen, newhostlen, methodlen;
+
+	methodlen = (int)(strchr((char *)origreq, ' ') - (char *)origreq);
+	oldpath = reqpath(origreq, &oldhost, &oldhostlen);
+	newpath = reqpath(req, &newhost, &newhostlen);
+	if(oldpath && newpath
+	   && methodlen > 0 && !strncmp((char *)req, (char *)origreq, methodlen)
+	   && req[methodlen] == ' '
+	   && oldhostlen == newhostlen
+	   && (!oldhostlen || !strncasecmp((char *)oldhost, (char *)newhost, oldhostlen))){
+		int newlen = (int)strlen((char *)newpath);
+		int delta = newlen - ((int)reqlen - ssoff);
+
+		if(ssoff > 0 && (int)reqlen >= ssoff && inbuf + delta < bufsize - 1){
+			memmove(buf + ssoff + newlen, buf + reqlen, inbuf - reqlen + 1);
+			memcpy(buf + ssoff, newpath, newlen);
+			inbuf += delta;
+			reqlen += delta;
+			buf[inbuf] = 0;
+		}
+	}
+ }
+ freeptr(&origreq);
  action = handlehdrfilterscli(param, &buf, &bufsize, 0, &inbuf);
  if(action == HANDLED){
 	RETURN(0);
  }
  if(action != PASS) RETURN(517);
+ /* A filter may have returned a buffer sized to exactly what it produced.
+    The headers this proxy adds of its own go in after it, so the room for
+    them is taken back before anything is written. */
+ if(growbuf(&buf, &bufsize, inbuf + HDRRESERVE)) RETURN(21);
  param->nolongdatfilter = 0;
 
 #endif
@@ -620,6 +705,7 @@ for(;;){
 	contentlength64 = param->cliinbuf;
 	param->nolongdatfilter = 1;
   }
+  if(growbuf(&buf, &bufsize, (int)strlen((char *)buf) + CLHDRSIZE)) RETURN(21);
   sprintf((char*)buf+strlen((char *)buf), "Content-Length: %"PRIu64"\r\n", contentlength64);
  }
 
@@ -1097,6 +1183,7 @@ for(;;){
 	RETURN(0);
  }
  if(action != PASS) RETURN(517);
+ if(growbuf(&buf, &bufsize, inbuf + HDRRESERVE)) RETURN(21);
 
  param->nolongdatfilter = 0;
 
@@ -1120,6 +1207,7 @@ for(;;){
 	}
 	if(action != PASS) RETURN(517);
 	contentlength64 = param->srvinbuf;
+	if(growbuf(&buf, &bufsize, (int)strlen((char *)buf) + CLHDRSIZE)) RETURN(21);
 	sprintf((char*)buf+strlen((char *)buf), "Content-Length: %"PRIu64"\r\n", contentlength64);
 	hascontent = 1;
   }
@@ -1210,6 +1298,16 @@ REQUESTEND:
 	RETURN(0);
  }
  if(param->transparent && (!ckeepalive || !keepalive)) {RETURN (0);}
+ /* Another service read this request and handed it here to be answered. It
+    keeps the connection and decides what the next request on it is, so this
+    one is done. Whatever was opened towards the server stays open in param
+    for the next one. */
+ if(param->onerequest){
+	/* 2 says the client connection may carry another request, 1 that it may
+	   not, which is what the service holding it needs to know. */
+	param->onerequest = (ckeepalive && keepalive)? 2 : 1;
+	RETURN(0);
+ }
  logurl(param, (char *)buf, (char *)req, ftp);
  param->status = 0;
 

src/proxy.h

@@ -135,8 +135,41 @@ void daemonize(void);
 #endif
 #endif
 
+/* wolfSSL reserves around 48K of static thread-local storage. glibc counts
+   that against the thread stack, so pthread_create() fails with EINVAL and
+   no thread starts at all. musl places the block next to the stack instead
+   of inside it and needs nothing extra, and OpenSSL has no static TLS.
+   musl identifies itself by no macro of its own, but it does not define
+   __GLIBC__, which any libc header pulled in above would have set.
+ */
+#ifndef TLSSTACKSIZE
+#if defined(__linux__) && !defined(__GLIBC__)
+#define TLSSTACKSIZE 0
+#elif defined(WITH_WOLFSSL)
+#define TLSSTACKSIZE 49152
+#else
+#define TLSSTACKSIZE 0
+#endif
+#endif
+
+/* A UDP service answers from the address the client sent to, so the reply has
+   to leave the listening socket. Sharing that socket with the request handler
+   is the simple way, and what every Unix build does.
+
+   Older Windows cannot have two operations in flight on one socket, so a
+   build for it binds a second socket to the same address instead, which needs
+   SO_REUSEADDR on the listening socket as well. A build for those versions
+   asks for that with NO_SHARE_UDP_SOCKET, as Makefile.watcom does.
+ */
+#ifndef SHARE_UDP_SOCKET
+#ifndef NO_SHARE_UDP_SOCKET
+#define SHARE_UDP_SOCKET
+#endif
+#endif
+
 #ifndef _WIN32
 size_t threadstacksize(int extra);
+
 #endif
 
 #ifdef WITH_ODBC
@@ -322,6 +355,7 @@ int parseusername(char *username, struct clientparam *param, int extpasswd);
 int parseconnusername(char *username, struct clientparam *param, int extpasswd, uint16_t port);
 int ACLmatches(struct ace* acentry, struct clientparam * param);
 int checkACL(struct clientparam * param);
+char * aceaction (int action);
 extern int havelog;
 uint32_t udpresolve(int af, unsigned char * name, unsigned char * value, uint32_t *retttl, struct clientparam* param, int makeauth);
 
@@ -352,6 +386,23 @@ unsigned char * dologname (unsigned char *buf, unsigned char *name, const unsign
 int readconfig(FILE * fp);
 void initcommands(void);
 int connectwithpoll(struct clientparam *param, SOCKET sock, struct sockaddr *sa, SASIZETYPE size, int to);
+int bindwithrange(struct clientparam *param, SOCKET sock, PROXYSOCKADDRTYPE *sa, uint32_t range);
+#ifdef WITH_PCRE
+/* One regular expression implementation for the whole program: the pcre
+   commands and every pattern that carries a pcre: prefix. */
+void * pcre_pattern_compile(const unsigned char *pattern, char *errbuf, int errlen);
+void pcre_pattern_free(void *re);
+int pcre_pattern_match(void *re, const unsigned char *subject, struct capture *caps, int maxcaps);
+#endif
+
+int pushbackcli(struct clientparam * param, const unsigned char * data, int len);
+int parsepattern(struct hostname *h, unsigned char *arg);
+int parsepathpattern(struct hostname *h, unsigned char *arg);
+int patternmatchcaps(const struct hostname *h, const unsigned char *str,
+	struct capture *caps, int *ncaps);
+int patternmatch(const struct hostname *h, const unsigned char *str);
+int patternmatchpos(const struct hostname *h, const unsigned char *str, int *start, int *len);
+void applyportranges(struct clientparam * param, struct ace * acentry);
 
 
 uint32_t myrand(void);
@@ -371,7 +422,18 @@ void * sockschild(struct clientparam * param);
 void * tcppmchild(struct clientparam * param);
 void * autochild(struct clientparam * param);
 void * udppmchild(struct clientparam * param);
-void * adminchild(struct clientparam * param);
+#ifdef WITH_HTTPSRV
+int op_admin(struct httpreq *r, const unsigned char *params);
+int op_admin_counters(struct httpreq *r, const unsigned char *params);
+int op_admin_reload(struct httpreq *r, const unsigned char *params);
+int op_admin_services(struct httpreq *r, const unsigned char *params);
+#endif
+#ifdef WITH_HTTPSRV
+void * httpsrvchild(struct clientparam * param);
+int httpopbyname(const unsigned char *name);
+int httpchunk(struct clientparam *param, const char *buf, int len);
+void freehttprules(struct httprule *rule);
+#endif
 void * ftpprchild(struct clientparam * param);
 void * tlsprchild(struct clientparam * param);
 /* Child functions return the child to redirect the request to, or NULL if

src/proxymain.c

@@ -414,6 +414,15 @@ int MODULEMAINFUNC (int argc, char** argv){
 #endif
  srv.service = defparam.service = childdef.service;
 
+#ifdef WITH_HTTPSRV
+ /* http lines accumulate until a service claims them, so each httpsrv takes
+    the rules written above it and the next one starts empty. */
+ if(srv.service == S_HTTPSRV){
+	srv.httprules = conf.httprules;
+	conf.httprules = NULL;
+ }
+#endif
+ 
 #ifndef STDMAIN
  if(conf.acl){
 	srv.acl = copyacl(conf.acl);
@@ -826,10 +835,21 @@ int MODULEMAINFUNC (int argc, char** argv){
    port there, and it only allows another local process to bind the same
    address and port, with undefined behaviour as to which socket receives the
    connections. Use -olSO_EXCLUSIVEADDRUSE to prevent that instead.
+
+   A Windows build which does not share the listening socket is the exception:
+   its UDP services bind a second socket to the same address to answer from,
+   and Windows only allows that when both sockets ask for it.
  */
 #ifndef _WIN32
 		opt = 1;
 		if(srv.so._setsockopt(srv.so.state, sock, SOL_SOCKET, SO_REUSEADDR, (char *)&opt, sizeof(int)))perror("setsockopt()");
+#else
+#ifndef SHARE_UDP_SOCKET
+		if(isudp){
+			opt = 1;
+			if(srv.so._setsockopt(srv.so.state, sock, SOL_SOCKET, SO_REUSEADDR, (char *)&opt, sizeof(int)))perror("setsockopt()");
+		}
+#endif
 #endif
 #ifdef SO_REUSEPORT
 		opt = 1;
@@ -1335,6 +1355,9 @@ void srvfree(struct srvparam * srv){
  }
 
  if(srv->acl)freeacl(srv->acl);
+#ifdef WITH_HTTPSRV
+ if(srv->httprules)freehttprules(srv->httprules);
+#endif
  if(srv->authfuncs)freeauth(srv->authfuncs);
 #endif
  _3proxy_mutex_destroy(&srv->counter_mutex);

src/redirect.c

@@ -259,6 +259,20 @@ int clientnegotiate(struct chain * redir, struct clientparam * param, struct soc
 }
 
 
+/* The local port ranges do not depend on the destination, so they can be taken
+ * as soon as a rule matches. UDP ASSOCIATE is authorized before the destination
+ * is known and returns before the chain is walked, which would otherwise leave
+ * the socket the client sends its datagrams to outside the configured range.
+ */
+void applyportranges(struct clientparam * param, struct ace * acentry){
+    struct chain *cur;
+
+	for(cur = acentry->chains; cur; cur = cur->next){
+		if(cur->type == R_EXTPORT) param->extport = cur->range;
+		else if(cur->type == R_INTPORT) param->intport = cur->range;
+	}
+}
+
 int handleredirect(struct clientparam * param, struct ace * acentry){
 	int connected = 0;
 	int weight = 1000;
@@ -285,7 +299,8 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 			}
 			continue;
 		}
-		if(cur->type != R_EXTIP && cur->type != R_HA) param->redirected++;
+		if(cur->type != R_EXTIP && cur->type != R_HA &&
+		   cur->type != R_EXTPORT && cur->type != R_INTPORT) param->redirected++;
 		done = 1;
 		if(weight <= 0) {
 			weight += 1000;
@@ -293,6 +308,12 @@ int handleredirect(struct clientparam * param, struct ace * acentry){
 			r2 = (myrand()%1000);
 		}
 		if(!connected){
+			if(cur->type == R_EXTPORT || cur->type == R_INTPORT){
+				if(cur->type == R_EXTPORT) param->extport = cur->range;
+				else param->intport = cur->range;
+				if(cur->next)continue;
+				return 0;
+			}
 			if(cur->type == R_EXTIP){
 				param->sinsl = cur->addr;
 				if(SAISNULL(&param->sinsl) && (*SAFAMILY(&param->sincr) == AF_INET || *SAFAMILY(&param->sincr) == AF_INET6))param->sinsl = param->sincr;

src/smtpp.c

@@ -159,7 +159,10 @@ void * smtppchild(struct clientparam* param) {
 	i = de64(buf,username,255);
 	if(i < 1) {RETURN(664);}
 	username[i] = 0;
-	parseconnusername((char *)username, param, 0, 587);
+	/* The name has to carry the host to connect to, and the answer says
+	   whether it did: without one there is nowhere to go, and what follows
+	   reads the name as if there were. */
+	if(parseconnusername((char *)username, param, 0, 587)) {RETURN(669);}
 	socksend(param, param->clisock, (unsigned char *)"334 UGFzc3dvcmQ6\r\n", 18,conf.timeouts[STRING_S]);	
 	i = sockgetlinebuf(param, CLIENT, buf, sizeof(buf) - 10, '\n', conf.timeouts[STRING_S]);
 	if(i < 2) {RETURN(665);}
@@ -184,7 +187,7 @@ void * smtppchild(struct clientparam* param) {
 	}
 	if(i < 3 || *username) {RETURN(668);}
 	username[i] = 0;
-	parseconnusername((char *)username+1, param, 0, 587);
+	if(parseconnusername((char *)username+1, param, 0, 587)) {RETURN(670);}
 	res = (int)strlen((char *)username+1) + 2;
 	if(res < i){
 		if(param->extpassword) free(param->extpassword);

src/sockgetchar.c

@@ -88,6 +88,35 @@ int sockgetcharcli(struct clientparam * param, int timeosec, int timeousec){
 	return (int)*param->clibuf;
 }
 
+/* Put bytes back in front of whatever the client has not been read yet, so a
+   service which has already taken a request off the socket can hand it to
+   another one, which reads it the way it reads anything else. */
+int pushbackcli(struct clientparam * param, const unsigned char * data, int len){
+	unsigned left = 0;
+	unsigned need;
+
+	if(len <= 0) return 0;
+	if(param->clibuf) left = param->cliinbuf - param->clioffset;
+	need = (unsigned)len + left;
+
+	if(!param->clibuf){
+		if(!(param->clibuf = malloc(need > SRVBUFSIZE? need : SRVBUFSIZE))) return 1;
+		param->clibufsize = need > SRVBUFSIZE? need : SRVBUFSIZE;
+	}
+	else if(param->clibufsize < need){
+		unsigned char *nb = realloc(param->clibuf, need);
+
+		if(!nb) return 1;
+		param->clibuf = nb;
+		param->clibufsize = need;
+	}
+	if(left) memmove(param->clibuf + len, param->clibuf + param->clioffset, left);
+	memcpy(param->clibuf, data, (size_t)len);
+	param->clioffset = 0;
+	param->cliinbuf = need;
+	return 0;
+}
+
 unsigned long sockfillbuffcli(struct clientparam * param, unsigned long size, int timeosec){
 	int len;
 

src/socks.c

@@ -218,7 +218,10 @@ void * sockschild(struct clientparam* param) {
 	if((res = udpbind(param))) {RETURN(res);}
  }
  else if(command == 2) {
-	if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl))) {
+	if(bindwithrange(param, param->remsock, &param->sinsl, param->extport)) {
+		/* a range has already been searched, retrying on any port would
+		   ignore what was asked for */
+		if(param->extport) RETURN (12);
 		*SAPORT(&param->sinsl) = 0;
 		if(param->srv->so._bind(param->sostate, param->remsock,(struct sockaddr *)&param->sinsl,SASIZE(&param->sinsl)))RETURN (12);
 #if SOCKSTRACE > 0
@@ -243,7 +246,8 @@ fflush(stderr);
 #endif
 		sin = param->sincl;
 		*SAPORT(&sin) = 0;
-		if(param->srv->so._bind(param->sostate, param->clisock,(struct sockaddr *)&sin,SASIZE(&sin))) {RETURN (12);}
+		/* the port the client is told to send its datagrams to */
+		if(bindwithrange(param, param->clisock, &sin, param->intport)) {RETURN (12);}
 		sasize = SASIZE(&sin);
 		param->srv->so._getsockname(param->sostate, param->clisock, (struct sockaddr *)&sin, &sasize);
 #if SOCKSTRACE > 0

src/ssllib.c

@@ -84,7 +84,11 @@ static int copy_ext(X509 *dst_cert, X509 *src_cert, int nid)
 }
 
 #ifndef WITH_WOLFSSL
-static int add_ext(X509 *cert, int nid, const char *value)
+/* issuer is the certificate the extension should describe as the issuer,
+ * which matters for an authority key identifier: it names the key that
+ * signs, not the key being signed.
+ */
+static int add_ext_issuer(X509 *cert, X509 *issuer, int nid, const char *value)
 {
 	X509_EXTENSION *ex;
 	X509V3_CTX ctx;
@@ -92,10 +96,8 @@ static int add_ext(X509 *cert, int nid, const char *value)
 	/* This sets the 'context' of the extensions. */
 	/* No configuration database */
 	X509V3_set_ctx_nodb(&ctx);
-	/* Issuer and subject certs: both the target since it is self signed,
-	 * no request and no CRL
-	 */
-	X509V3_set_ctx(&ctx, cert, cert, NULL, NULL, 0);
+	/* No request and no CRL */
+	X509V3_set_ctx(&ctx, issuer, cert, NULL, NULL, 0);
 	/* value is char * prior to OpenSSL 1.1.0 */
 	ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, (char *)value);
 	if (!ex)
@@ -105,6 +107,12 @@ static int add_ext(X509 *cert, int nid, const char *value)
 	X509_EXTENSION_free(ex);
 	return err > 0;
 }
+
+static int add_ext(X509 *cert, int nid, const char *value)
+{
+	/* Issuer and subject: both the target, for a self signed certificate */
+	return add_ext_issuer(cert, cert, nid, value);
+}
 #endif
 
 SSL_CERT ssl_copy_cert(SSL_CERT cert, SSL_CONFIG *config)
@@ -199,6 +207,16 @@ SSL_CERT ssl_copy_cert(SSL_CERT cert, SSL_CONFIG *config)
 		add_ext(dst_cert, NID_basic_constraints, "critical,CA:FALSE");
 	if(!copy_ext(dst_cert, src_cert, NID_ext_key_usage))
 		add_ext(dst_cert, NID_ext_key_usage, "serverAuth");
+	/* A verifier following RFC 5280 strictly looks for the issuer through a
+	 * key identifier and refuses a certificate carrying none: OpenSSL does
+	 * with x509_strict, and Python has since 3.13. The identifiers are
+	 * generated rather than copied, so they name the CA signing here
+	 * instead of the one that signed upstream. keyid,issuer keeps working
+	 * when the CA certificate has no subject key identifier of its own.
+	 */
+	add_ext(dst_cert, NID_subject_key_identifier, "hash");
+	add_ext_issuer(dst_cert, config->CA_cert, NID_authority_key_identifier,
+		"keyid,issuer");
 #else
 	copy_ext(dst_cert, src_cert, NID_basic_constraints);
 	copy_ext(dst_cert, src_cert, NID_ext_key_usage);

src/structures.h

@@ -216,6 +216,7 @@ typedef enum {
 	S_AUTO,
 	S_TLSPR,
 	S_IMAPP,
+	S_HTTPSRV,
 	S_ZOMBIE
 }PROXYSERVICE;
 
@@ -313,7 +314,9 @@ typedef enum {
 	R_TLS,
 	R_HA,
 	R_DNS,
-	R_IMAP
+	R_IMAP,
+	R_EXTPORT,
+	R_INTPORT
 } REDIRTYPE;
 
 struct redirdesc {
@@ -335,6 +338,8 @@ struct chain {
 	unsigned char * extpass;
 	unsigned short weight;
 	unsigned short cidr;
+	/* local port range for extport/intport, first in the low half */
+	uint32_t range;
 };
 
 struct period {
@@ -345,11 +350,71 @@ struct period {
 
 #define MATCHBEGIN 1
 #define MATCHEND 2
+/* A pattern is either the star form above, matched by matchtype, or a regular
+   expression compiled once when the configuration is read. */
+#define MATCHGLOB  4	/* stars anywhere: * within a path element, ** across */
+#define MATCHREGEX 5
+
+/* What a star or a capturing group stood for. Element 0 is the whole
+   subject, so a template writes it as $0 and the groups as $1 upwards. */
+#define MAXCAPTURES 10
+struct capture {
+	int start;
+	int len;
+};
 
 struct hostname {
 	struct hostname *next;
 	unsigned char * name;
 	int matchtype;
+	void * re;		/* compiled regular expression, MATCHREGEX only */
+};
+
+/* A request handed to an http operation. */
+struct httpreq {
+	struct capture caps[MAXCAPTURES];
+	int ncaps;
+	struct capture hostcaps[MAXCAPTURES];
+	int nhostcaps;
+	const char *ctype;
+	const char *hdrs;
+	int maxage;
+	int code;
+	time_t ims;		/* what If-Modified-Since asked about, or 0 */
+	int version;		/* 0 for HTTP/1.0, 1 for HTTP/1.1 */
+	int keepalive;		/* whether the connection carries another request */
+	int first;		/* the first request on this connection */
+	int chunkedreq;		/* a body this server does not know how to read */
+	int proxy;		/* the client asked the way it asks a proxy */
+	int connect;		/* and asked for a tunnel */
+	int mayproxy;		/* an access rule sent this to the local proxy */
+	unsigned char *raw;	/* the request as it arrived, for handing on */
+	int rawlen, rawsize;
+	int drained;		/* the body has been read and thrown away */
+	char *lasthost;		/* where the last request on this connection went */
+	void *handoff;		/* a child which takes the connection over */
+	struct clientparam *param;
+	char method[16];
+	char path[256];
+	char query[512];
+	char host[256];
+	uint64_t contentlen;
+	int globstart, globlen;
+};
+
+/* One "http" line: which host and url it answers for, which operation serves
+   it and the parameters that operation takes. Patterns use the same syntax and
+   the same matcher as host lists in access rules. */
+struct httprule {
+	struct httprule *next;
+	struct hostname host;
+	struct hostname url;
+	int op;
+	unsigned char *params;
+	unsigned char *ctype;	/* type named by the rule, or NULL to work it out */
+	unsigned char *hdrs;	/* headers the rule adds, already CRLF separated */
+	int maxage;		/* seconds to allow caching for, or -1 to say nothing */
+	int code;		/* status the rule answers with, or 0 for the usual */
 };
 
 struct ace {
@@ -579,6 +644,9 @@ struct srvparam {
 	struct auth *authenticate;
 	struct pollfd * srvfds;
 	struct ace *acl;
+#ifdef WITH_HTTPSRV
+	struct httprule *httprules;
+#endif
 	struct auth *authfuncs;
 	struct filter *filter;
 	unsigned char * logformat;
@@ -669,6 +737,7 @@ struct clientparam {
 			maxtrafout64;
 	PROXYSOCKADDRTYPE sincl, sincr;
 	PROXYSOCKADDRTYPE	sinsl, sinsr, req;
+	uint32_t	extport, intport;
 
 	uint64_t	statscli64,
 			statssrv64;
@@ -684,6 +753,12 @@ struct clientparam {
 	int udp_nhops;
 	struct ace *lastace;
 	time_t time_start;
+	/* Set by a service which read a request itself and handed it to another
+	   child to answer: that child answers this one request and returns,
+	   leaving the connection to the service which called it. Added last so
+	   that a plugin built against an older header still finds the fields it
+	   knows where they were. */
+	int onerequest;
 };
 
 struct filemon {
@@ -697,6 +772,9 @@ struct extparam {
 	_3proxy_sem_t threadinit;
 	int *timeouts;
 	struct ace * acl;
+#ifdef WITH_HTTPSRV
+	struct httprule *httprules;
+#endif
 	char * conffile;
 	struct bandlim * bandlimiter,  *bandlimiterout;
 	struct connlim * connlimiter;

src/transparent.c

@@ -0,0 +1,240 @@
+/*
+   3APA3A simplest proxy server
+   (c) 2002-2026 by Vladimir Dubrovin <vlad@3proxy.org>
+
+   please read License Agreement
+
+*/
+
+#include "structures.h"
+#include "proxy.h"
+
+#ifdef WITH_TRANSPARENT
+
+#ifdef WITH_NETFILTER
+#include <sys/utsname.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <limits.h>
+#include <linux/netfilter_ipv4.h>
+#endif
+
+#ifdef WITH_PF
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <net/if.h>
+#include <net/pfvar.h>
+#endif
+
+/* Where the address the client was trying to reach is read from.
+
+   AUTO uses what the platform offers, which is the only thing an
+   installation usually needs. The rest name one mechanism, for a machine
+   that has more than one and redirects with a particular one.
+ */
+#define TRANSPARENT_AUTO	0
+#define TRANSPARENT_NETFILTER	1
+#define TRANSPARENT_PF		2
+#define TRANSPARENT_SOCKET	3
+
+static struct pluginlink * pl;
+
+static int transparent_loaded = 0;
+static int transparent_mode = TRANSPARENT_AUTO;
+
+#ifdef WITH_PF
+static int pf_device = -1;
+
+/* Ask the packet filter what the connection was addressed to before it was
+   redirected. pf keeps that in its state table rather than on the socket,
+   so it has to be looked up with the addresses of both ends.
+ */
+static int transparent_pf(struct clientparam *param)
+{
+	struct pfioc_natlook nl;
+
+	if(pf_device < 0){
+		pf_device = open("/dev/pf", O_RDONLY);
+		if(pf_device < 0) return 1;
+	}
+	memset(&nl, 0, sizeof(nl));
+	nl.proto = IPPROTO_TCP;
+	nl.direction = PF_OUT;
+#ifndef NOIPV6
+	if(*SAFAMILY(&param->sincr) == AF_INET6){
+		nl.af = AF_INET6;
+		memcpy(&nl.saddr.v6, SAADDR(&param->sincr), 16);
+		memcpy(&nl.daddr.v6, SAADDR(&param->sincl), 16);
+	}
+	else
+#endif
+	{
+		nl.af = AF_INET;
+		memcpy(&nl.saddr.v4, SAADDR(&param->sincr), 4);
+		memcpy(&nl.daddr.v4, SAADDR(&param->sincl), 4);
+	}
+	nl.sport = *SAPORT(&param->sincr);
+	nl.dport = *SAPORT(&param->sincl);
+
+	if(ioctl(pf_device, DIOCNATLOOK, &nl)) return 1;
+
+	memset(&param->req, 0, sizeof(param->req));
+	*SAFAMILY(&param->req) = nl.af;
+#ifndef NOIPV6
+	if(nl.af == AF_INET6) memcpy(SAADDR(&param->req), &nl.rdaddr.v6, 16);
+	else
+#endif
+	memcpy(SAADDR(&param->req), &nl.rdaddr.v4, 4);
+	*SAPORT(&param->req) = nl.rdport;
+	return 0;
+}
+#endif
+
+#ifdef WITH_NETFILTER
+/* Linux keeps the original address for the connection it redirected. */
+static int transparent_netfilter(struct clientparam *param)
+{
+	socklen_t len = sizeof(param->req);
+
+#ifdef SO_ORIGINAL_DST
+	if(getsockopt(param->clisock,
+#ifndef NOIPV6
+#ifdef SOL_IPV6
+		*SAFAMILY(&param->sincr) == AF_INET6?SOL_IPV6:
+#endif
+#endif
+			SOL_IP, SO_ORIGINAL_DST, (struct sockaddr *) &param->req, &len)
+	   || !memcmp((char *)SAADDR(&param->req), "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", SAADDRLEN(&param->req))){
+		return 1;
+	}
+	return 0;
+#else
+#error No SO_ORIGINAL_DST defined
+#endif
+}
+#endif
+
+/* Some redirections leave the original address on the socket itself, so the
+   local address of the accepted connection is what the client asked for.
+
+   A connection which was not redirected at all arrives at the address the
+   service listens on, and taking that as the destination would send the
+   service to itself. Refuse instead of making the connection.
+ */
+static int transparent_socket(struct clientparam *param)
+{
+	if(*SAFAMILY(&param->sincl) != AF_INET && *SAFAMILY(&param->sincl) != AF_INET6)
+		return 1;
+	if(*SAPORT(&param->sincl) == *SAPORT(&param->srv->intsa)
+	   && (SAISNULL(&param->srv->intsa)
+	       || !memcmp(SAADDR(&param->sincl), SAADDR(&param->srv->intsa), SAADDRLEN(&param->sincl))))
+		return 2;
+	param->req = param->sincl;
+	param->sincl = param->srv->intsa;
+	return 0;
+}
+
+static void* transparent_filter_open(void * idata, struct srvparam * param){
+	return idata;
+}
+
+static FILTER_ACTION transparent_filter_client(void *fo, struct clientparam * param, void** fc){
+
+	char addrbuf[64];
+	int res = 1;
+
+#ifdef WITH_NETFILTER
+	if(transparent_mode == TRANSPARENT_AUTO || transparent_mode == TRANSPARENT_NETFILTER)
+		res = transparent_netfilter(param);
+#endif
+#ifdef WITH_PF
+	if(res && (transparent_mode == TRANSPARENT_AUTO || transparent_mode == TRANSPARENT_PF))
+		res = transparent_pf(param);
+#endif
+	if(res && (transparent_mode == TRANSPARENT_AUTO || transparent_mode == TRANSPARENT_SOCKET)){
+		res = transparent_socket(param);
+		if(res == 2){
+			param->srv->logfunc(param, (unsigned char *)"transparent: connection was not redirected");
+			return REJECT;
+		}
+	}
+	/* Nothing knows where this was going: leave the request alone, so the
+	   service decides as it would without the command. */
+	if(res) return PASS;
+
+	pl->myinet_ntop(*SAFAMILY(&param->req), SAADDR(&param->req), (char *)addrbuf, sizeof(addrbuf));
+	if(param->hostname) pl->freefunc(param->hostname);
+	param->hostname = (unsigned char *)pl->strdupfunc(addrbuf);
+	param->sinsr = param->req;
+	return PASS;
+}
+
+
+static void transparent_filter_clear(void *fo){
+}
+
+static void transparent_filter_close(void *fo){
+}
+
+static struct filter transparent_filter = {
+	NULL,
+	"Transparent filter",
+	"Transparent filter",
+	transparent_filter_open,
+	transparent_filter_client, 
+	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+	transparent_filter_clear, 
+	transparent_filter_close
+};
+
+int h_transparent(int argc, unsigned char **argv){
+	transparent_mode = TRANSPARENT_AUTO;
+	if(argc > 1){
+		if(!strcmp((char *)argv[1], "auto")) transparent_mode = TRANSPARENT_AUTO;
+		else if(!strcmp((char *)argv[1], "netfilter")){
+#ifndef WITH_NETFILTER
+			fprintf(stderr, "transparent: netfilter is not available in this build\n");
+			return 1;
+#else
+			transparent_mode = TRANSPARENT_NETFILTER;
+#endif
+		}
+		else if(!strcmp((char *)argv[1], "pf")){
+#ifndef WITH_PF
+			fprintf(stderr, "transparent: pf is not available in this build\n");
+			return 1;
+#else
+			transparent_mode = TRANSPARENT_PF;
+#endif
+		}
+		else if(!strcmp((char *)argv[1], "socket")) transparent_mode = TRANSPARENT_SOCKET;
+		else {
+			fprintf(stderr, "transparent: unknown mode %s, expected auto, netfilter, pf or socket\n", argv[1]);
+			return 1;
+		}
+	}
+	transparent_filter.filter_open = transparent_filter_open;
+	return 0;
+}
+
+int h_notransparent(int argc, unsigned char **argv){
+	transparent_filter.filter_open = NULL;
+	return 0;
+}
+
+void transparent_install(void){
+	pl = &pluginlink;
+	/* A reload runs this again: the filter is a single static entry, so it
+	   is only linked in once, and the commands decide whether it acts. */
+	if(!transparent_loaded){
+		transparent_loaded = 1;
+		transparent_filter.next = pl->conf->filters;
+		pl->conf->filters = &transparent_filter;
+	}
+	transparent_filter.filter_open = NULL;
+	transparent_mode = TRANSPARENT_AUTO;
+}
+
+#endif

src/udpsockmap.c

@@ -121,8 +121,12 @@ int udpbind(struct clientparam *param)
 	fcntl(s, F_SETFL, O_NONBLOCK | fcntl(s, F_GETFL));
 #endif
 	param->remsock = s;
-	if (param->srv->so._bind(param->sostate, param->remsock,
-			(struct sockaddr *)&param->sinsl, SASIZE(&param->sinsl))) {
+	if (bindwithrange(param, param->remsock, &param->sinsl, param->extport)) {
+		if (param->extport) {
+			param->srv->so._closesocket(param->sostate, param->remsock);
+			param->remsock = INVALID_SOCKET;
+			return 12;
+		}
 		*SAPORT(&param->sinsl) = 0;
 		if (param->srv->so._bind(param->sostate, param->remsock,
 				(struct sockaddr *)&param->sinsl, SASIZE(&param->sinsl))) {

src/webadmin.c

@@ -8,11 +8,12 @@
 
 #include "proxy.h"
 
+#ifdef WITH_HTTPSRV
+
 #define RETURN(xxx) { param->res = xxx; goto CLEANRET; }
 
 #define LINESIZE 65536
 
-extern FILE *writable;
 FILE * confopen();
 extern void decodeurl(unsigned char *s, int filter);
 
@@ -24,35 +25,6 @@ struct printparam {
 	struct clientparam *cp;
 };
 
-char * aceaction (int action){
-	switch (action) {
-		case ALLOW:
-		case REDIRECT:
-			return "allow";
-		case DENY:
-			return "deny";
-		case BANDLIM:
-			return "bandlim";
-		case NOBANDLIM:
-			return "nobandlim";
-		case COUNTIN:
-			return "countin";
-		case NOCOUNTIN:
-			return "nocountin";
-		case COUNTOUT:
-			return "countout";
-		case NOCOUNTOUT:
-			return "nocountout";
-		case COUNTALL:
-			return "countall";
-		case NOCOUNTALL:
-			return "nocountall";
-		default:
-			return "unknown";
-	}
-}
-
-
 static void stdpr(struct printparam* pp, char *buf, int inbuf){
 	if((pp->inbuf + inbuf > 1024) || !buf) {
 		socksend(pp->cp, pp->cp->clisock, (unsigned char *)pp->buf, pp->inbuf, conf.timeouts[STRING_S]);
@@ -211,8 +183,7 @@ char * admin_stringtable[]={
 	"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</h2>\r\n"
 	"<A HREF=\'/C'>Counters</A><br>\r\n"
 	"<A HREF=\'/R'>Reload</A><br>\r\n"
-	"<A HREF=\'/S'>Running Services</A><br>\r\n"
-	"<A HREF=\'/F'>Config</A>\r\n"
+	"<A HREF=\'/S'>Running Services</A>\r\n"
 	"</td><td>"
 	"<h2>%s %s configuration</h2>",
 
@@ -367,92 +338,62 @@ static int printiplist(char *buf, int bufsize, struct iplist* ipl, char * delim)
 	return printed;
 }
 
-void * adminchild(struct clientparam* param) {
- int i, res;
- char * buf;
- char username[256];
- char *sb;
- char *req = NULL;
- struct printparam pp;
- unsigned contentlen = 0;
- int isform = 0;
- int limited = 0;
+/* The admin pages are http operations: the service, request parsing and
+   authorization belong to httpsrv, and what is left here is the page itself.
+   A star in the url carries the selector the pages used to read out of the
+   path, so /C with a star gives D2 or S2 to disable or enable a counter. */
 
+static char * admin_open(struct printparam *pp, struct clientparam *param)
+{
+	char *buf;
 
- limited =param->srv->s_option;
- pp.inbuf = 0;
- pp.cp = param;
+	pp->inbuf = 0;
+	pp->cp = param;
 
 	buf = malloc(LINESIZE);
- if(!buf) {RETURN(555);}
- i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, LINESIZE - 1, '\n', conf.timeouts[STRING_S]);
- if(i<5 || ((buf[0]!='G' || buf[1]!='E' || buf[2]!='T' || buf[3]!=' ' || buf[4]!='/') && 
-	   (buf[0]!='P' || buf[1]!='O' || buf[2]!='S' || buf[3]!='T' || buf[4]!=' ' || buf[5]!='/')))
- {
-	RETURN(701);
- }
- buf[i] = 0;
- sb = strchr(buf+5, ' ');
- if(!sb){
-	RETURN(702);
- }
- *sb = 0;
- req = strdup(buf + ((*buf == 'P')? 6 : 5));
- while((i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, LINESIZE - 1, '\n', conf.timeouts[STRING_S])) > 2){
-	buf[i] = 0;
-	if(i > 19 && (!strncasecmp(buf, "authorization", 13))){
-		sb = strchr(buf, ':');
-		if(!sb)continue;
-		++sb;
-		while(isspace(*sb))sb++;
-		if(!*sb || strncasecmp(sb, "basic", 5)){
-			continue;
-		}
-		sb+=5;
-		while(isspace(*sb))sb++;
-		i = de64((unsigned char *)sb, (unsigned char *)username, 255);
-		if(i<=0)continue;
-		username[i] = 0;
-		sb = strchr((char *)username, ':');
-		if(sb){
-			*sb = 0;
-			if(param->password)free(param->password);
-			param->password = (unsigned char *)strdup(sb+1);
-		}
-		if(param->username) free(param->username);
-		param->username = (unsigned char *)strdup(username);
-		continue;
-	}
-	else if(i > 15 && (!strncasecmp(buf, "content-length:", 15))){
-		sb = buf + 15;
-		while(isspace(*sb))sb++;
-		sscanf(sb, "%u", &contentlen);
-		if(contentlen > LINESIZE*1024) contentlen = 0;
-	}
-	else if(i > 13 && (!strncasecmp(buf, "content-type:", 13))){
-		sb = buf + 13;
-		while(isspace(*sb))sb++;
-		if(!strncasecmp(sb, "x-www-form-urlencoded", 21)) isform = 1;
-	}
- }
- param->operation = ADMIN;
- if(isform && contentlen) {
-	printstr(&pp, "HTTP/1.0 100 Continue\r\n\r\n");
-	stdpr(&pp, NULL, 0);
- }
- res = (*param->srv->authfunc)(param);
- if(res && res != 10) {
-	printstr(&pp, authreq);
-	RETURN(res);
- }
- if(limited || param->redirected){
-	if(*req == 'C') req[1] = 0;
-	else *req = 0;
- }
- sprintf(buf, ok, conf.stringtable?(char *)conf.stringtable[2]:"3proxy", conf.stringtable?(char *)conf.stringtable[2]:"3[APA3A] tiny proxy", conf.stringtable?(char *)conf.stringtable[3]:"");
- if(*req != 'S') printstr(&pp, buf);
- switch(*req){
-	case 'C':
+	if(!buf) return NULL;
+
+	sprintf(buf, ok, conf.stringtable?(char *)conf.stringtable[2]:"3proxy",
+		conf.stringtable?(char *)conf.stringtable[2]:"3[APA3A] tiny proxy",
+		conf.stringtable?(char *)conf.stringtable[3]:"");
+	printstr(pp, buf);
+	return buf;
+}
+
+static void admin_close(struct printparam *pp, char *buf)
+{
+	printstr(pp, tail);
+	printstr(pp, NULL);
+	if(buf) free(buf);
+}
+
+int op_admin(struct httpreq *r, const unsigned char *params)
+{
+	struct printparam pp;
+	char *buf;
+
+	buf = admin_open(&pp, r->param);
+	if(!buf) return 1;
+	printstr(&pp, (char *)conf.stringtable[WEBBANNERS]);
+	admin_close(&pp, buf);
+	return 0;
+}
+
+int op_admin_counters(struct httpreq *r, const unsigned char *params)
+{
+	struct clientparam *param = r->param;
+	struct printparam pp;
+	char *buf;
+	const char *sel;
+	int limited;
+
+	limited = param->srv->s_option;
+	/* In limited mode a counter may be looked at but not switched. */
+	sel = limited? "" : r->path + r->globstart;
+
+	buf = admin_open(&pp, param);
+	if(!buf) return 1;
+
 		printstr(&pp, counters);
 		{
 			struct trafcount *cp; 
@@ -463,8 +404,8 @@ void * adminchild(struct clientparam* param) {
 			 if(cp->ace && (limited || param->redirected)){
 				if(!ACLmatches(cp->ace, param))continue;
 			 }
-			 if(req[1] == 'S' && atoi(req+2) == num) cp->disabled=0;
-			 if(req[1] == 'D' && atoi(req+2) == num) cp->disabled=1;
+			 if(sel[0] == 'S' && atoi(sel+1) == num) cp->disabled=0;
+			 if(sel[0] == 'D' && atoi(sel+1) == num) cp->disabled=1;
 			 inbuf += sprintf(buf,	"<tr><td>%s</td><td>", cp->ace?aceaction(cp->ace->action):"-");
 			 if(cp->number || cp->comment)
 				inbuf += sprintf(buf+inbuf, "%d/%s</td>" , cp->number,
@@ -535,85 +476,55 @@ void * adminchild(struct clientparam* param) {
 
 		}
 		printstr(&pp, counterstail);
-		break;
 
-	case 'R':
+	admin_close(&pp, buf);
+	return 0;
+}
+
+int op_admin_reload(struct httpreq *r, const unsigned char *params)
+{
+	struct printparam pp;
+	char *buf;
+
+	buf = admin_open(&pp, r->param);
+	if(!buf) return 1;
+
+	if(r->param->srv->s_option) printstr(&pp, (char *)conf.stringtable[WEBBANNERS]);
+	else {
 		conf.needreload = 1;
 		printstr(&pp, "<h3>Reload scheduled</h3>");
-		break;
-	case 'S':
-		{
-			if(req[1] == 'X'){
-				printstr(&pp, style);
-				break;
 	}
+
+	admin_close(&pp, buf);
+	return 0;
+}
+
+int op_admin_services(struct httpreq *r, const unsigned char *params)
+{
+	struct clientparam *param = r->param;
+	struct printparam pp;
+	char *buf;
+	const char *sel;
+
+	if(param->srv->s_option) return op_admin(r, params);
+
+	sel = r->path + r->globstart;
+
+	/* This page is xml, so it carries its own headers instead of the html
+	   wrapper the other pages share. */
+	pp.inbuf = 0;
+	pp.cp = param;
+	buf = NULL;
+
+	if(sel[0] == 'X') printstr(&pp, style);
+	else {
 		printstr(&pp, xml);
 		printval(conf.services, TYPE_SERVER, 0, &pp);
 		printstr(&pp, postxml);
 	}
-			break;
-	case 'F':
-		{
-			FILE *fp;
-			char buf[256];
-
-			fp = confopen();
-			if(!fp){
-				printstr(&pp, "<h3><font color=\"red\">Failed to open config file</font></h3>");
-				break;
-			}
-				printstr(&pp, "<h3>Please be careful editing config file remotely</h3>");
-				printstr(&pp, "<form method=\"POST\" action=\"/U\" enctype=\"application/x-www-form-urlencoded\"><textarea cols=\"80\" rows=\"30\" name=\"conffile\">");
-				while(fgets(buf, 256, fp)){
-					printstr(&pp, buf);
-				}
-				if(!writable) fclose(fp);
-				printstr(&pp, "</textarea><br><input type=\"Submit\"></form>");
-			break;
-		}
-	case 'U':
-		{
-			unsigned l=0;
-			int error = 0;
-
-			if(!writable || !contentlen || fseek(writable, 0, 0)){
-				error = 1;
-			}
-			while(l < contentlen && (i = sockgetlinebuf(param, CLIENT, (unsigned char *)buf, (contentlen - l) > LINESIZE - 1?LINESIZE - 1:contentlen - l, '+', conf.timeouts[STRING_S])) > 0){
-				if((unsigned)i > (contentlen - l)) i = (contentlen - l);
-				if(!l){
-					if(i<9 || strncasecmp(buf, "conffile=", 9)) error = 1;
-				}
-				if(!error){
-					buf[i] = 0;
-					decodeurl((unsigned char *)buf, 1);
-					fprintf(writable, "%s", l? buf : buf + 9);
-				}
-				l += i;
-			}
-			if(writable && !error){
-				fflush(writable);
-#ifndef _WINCE
-				if(ftruncate(fileno(writable), ftell(writable))){}
-#endif
-			}
-			printstr(&pp, error?    "<h3><font color=\"red\">Config file is not writable</font></h3>Make sure you have \"writable\" command in configuration file":
-						"<h3>Configuration updated</h3>");
-
-		}
-		break;
-	default:
-		printstr(&pp, (char *)conf.stringtable[WEBBANNERS]);
-		break;
- }
- if(*req != 'S') printstr(&pp, tail);
-
-CLEANRET:
-
 
 	printstr(&pp, NULL);
- if(buf) free(buf);
- dolog(param, (unsigned char *)req);
- if(req)free(req);
- return (NULL);
+	return 0;
 }
+
+#endif

tests/.gitignore

@@ -0,0 +1,2 @@
+__pycache__/
+*.pyc

tests/README.md

@@ -0,0 +1,164 @@
+# Regression tests
+
+    python3 tests/run.py                     # every case
+    python3 tests/run.py httpsrv             # cases whose name matches
+    python3 tests/run.py --bin build/bin/3proxy
+    python3 tests/run.py -v                  # print every check
+    python3 tests/run.py --keep              # keep the configurations and logs
+
+Python 3.6 or later and a built 3proxy are the only requirements: the suite
+is standard library throughout, so it runs wherever 3proxy builds. The TLS
+case additionally wants `openssl` on PATH to generate its key material, and
+skips itself when that is missing or the build has no TLS support. With no
+`--bin` it looks in `bin/`, then `build/bin/`, then the per-configuration
+directories a multi-configuration CMake generator uses.
+
+The proxy under test is also the origin server the tests talk to: the `http`
+command's `echo` operation reports back how a request arrived - method, path,
+query, host, and the source port it came from - and `data` generates a body
+of a requested size, framing, status and pace. So a case can state what a
+proxy should do to a request and then read off what actually reached the
+other side.
+
+## Adding a case
+
+A case is a module under `cases/` exporting `run(t)`. It writes the
+configurations it needs, starts them, and says what it expects:
+
+```python
+def run(t):
+    srv = t.free_port()
+    t.start("my_case", f"""
+        log
+        auth iponly
+        allow *
+        http * /echo echo
+        httpsrv -p{srv}
+    """, ports=[srv])
+
+    r = t.http(f"http://127.0.0.1:{srv}/echo")
+    t.eq(200, r.status, "the server answers")
+    t.contains(r, "method=GET", "the method is reported")
+```
+
+Servers are stopped for you when the case ends, whether or not it passed.
+
+`t` offers `http()` (direct, through an HTTP proxy, or over a CONNECT
+tunnel), `socks_http()` and `socks_connect()` for SOCKS4 and SOCKS5,
+`socks_udp_associate()`, `raw()` for bytes a real client would never send,
+and `run_config()` for configurations that are meant to be rejected.
+Assertions are `eq`, `ne`, `contains`, `not_contains`, `in_range`,
+`not_in_range`, plus `ok`, `fail` and `skip`. `harness.field()` and
+`int_field()` pull a single line out of an `echo` reply.
+
+For services with no TCP port to connect to, `t.udp_echo()` starts an echo
+server, `t.udp_exchange()` sends a datagram, `t.wait_udp()` waits for a UDP
+service to start answering, `t.socks_udp()` carries one through a SOCKS
+association, and `t.dns_query()` asks a DNS server for an A record.
+
+`t.certs()` generates a CA, a second unrelated CA, and a certificate for
+127.0.0.1, once per run and inside the run's temporary directory, so no key
+material lives in the tree. `t.https()`, `t.tls_proxy_http()` and
+`t.socks_http()` reach a server through TLS, a TLS-wrapped proxy, or SOCKS.
+Log records are written when a connection finishes rather than when the
+reply arrives, so assert on them through `t.wait_output(server, text)`.
+
+Note that access rules accumulate until `flush`, so a service section that
+means to stand on its own should start with one - otherwise an earlier
+`allow *` matches first and the rule under test is never reached.
+
+## What is not covered yet
+
+41 of the 112 configuration commands appear in a test, and the count says
+nothing about service options: the IPv6 case, for instance, exercises -4,
+-6, -46, -64 and -i without adding a command to it. What follows is
+roughly the order worth working through: how much of the product a gap
+covers, and how much of a fixture it needs.
+
+### Traffic limits and accounting
+
+`bandlimin` `bandlimout` `nobandlimin` `nobandlimout` `connlim` `noconnlim`
+`countin` `countout` `countall` and the `no*` forms, `maxconn`.
+
+Cheap and worth doing first: `data?size=` and a stopwatch measure a
+bandwidth limit, and the admin counters page already shows what a counter
+holds. `countin` appears in a configuration today but nothing checks that it
+counts. `connlim` and `maxconn` need concurrent connections.
+
+### The mail proxies
+
+`pop3p` `smtpp` `imapp`, and `ftppr`.
+
+The largest gap by volume: four protocol implementations with no coverage at
+all. Each needs a scripted server that speaks enough of the protocol,
+including the multi-line and challenge forms - a POP3 or IMAP server that
+only answers `+OK` will not exercise the interesting paths. Worth the
+fixture: this is also where known parent-chaining trouble lives, since
+`clientnegotiate()` has no case for R_POP3, R_SMTP or R_FTP.
+
+### Access rules and chaining
+
+`redirect` `weight` `parentretries` `force` `noforce` `include` `nolog`.
+
+Also the parts of an ACE never exercised: source addresses and masks, port
+ranges, time and weekday fields, and operation lists beyond the single
+`HTTP_CONNECT` used today. `weight` needs several parents and enough
+requests to see the split.
+
+### IPv6, what is left of it
+
+`tests/cases/ipv6.py` covers listening on `::1`, proxying to and from it,
+SOCKS with an IPv6 destination, rules naming an IPv6 address, and which
+family each of `-4 -6 -46 -64` will use. Still open: `extip` with an IPv6 CIDR, whose
+randomisation path has no coverage.
+
+### Authentication
+
+`authcache` `radius` `authnserver`, and the auth methods beyond `iponly` and
+`strong`: `none`, `nbname`, `dnsname`. `radius` needs a server to answer.
+
+### Plugins
+
+`plugin`. Nothing loads one, though `StringsPlugin`, `TrafficPlugin`,
+`TransparentPlugin` and `FilePlugin` are built in CI. StringsPlugin matters
+most: the admin string table is kept byte-compatible for it deliberately,
+and nothing proves that.
+
+### Logging
+
+`logformat` `rotate` `archiver` `logdump`.
+
+Tests read the log as free text, so a reordered field would pass every check
+here and break every downstream parser. `rotate` and `archiver` need control
+of the clock or a long run.
+
+### TLS options
+
+About 25 `ssl_client_*` and `ssl_server_*` commands: SNI, ALPN, protocol
+versions, cipher lists, `ssl_client_cert` and `ssl_client_key` for mTLS,
+`ssl_*_verify` and `ssl_*_no_verify`. The certificate fixture exists, so
+these are mostly a matter of writing them.
+
+### Process and lifecycle
+
+`daemon` `chroot` `setuid` `setgid` `pidfile` `stacksize` `backlog` `monitor`
+`system` `include` `timeouts` `maxseg` `external` `delimchar`
+`filtermaxsize`. Several need root or change the process in ways a test
+runner has to survive; `include`, `timeouts` and `pidfile` do not, and are
+easy.
+
+Reload is worth a case of its own: the admin page returns "Reload scheduled"
+and nothing checks that the configuration is re-read, that a changed rule
+takes effect, or that services come back.
+
+### DNS
+
+`fakeresolve` `nscache6` `dialer`.
+
+### Known limitations, deliberately not asserted
+
+A request rewrite that changes the method or the authority is ignored, and
+the manual says so; a test that pinned the current behaviour would have to
+change when that does. An intercepted certificate is verified strictly where the build can
+generate the key identifiers, and the case skips that one check on a wolfSSL
+build, which cannot. If wolfSSL gains the ability, the skip should go.

tests/cases/admin.py

@@ -0,0 +1,69 @@
+"""The admin interface, now a set of handlers on the HTTP server."""
+
+
+def run(t):
+    adm = t.free_port()
+    lim = t.free_port()
+    t.start("admin", f"""
+        log
+        auth iponly
+        allow *
+        countin 1 D 100 * * *
+        countin 2 D 200 * * *
+        admin -p{adm}
+
+        flush
+        auth iponly
+        allow *
+        admin -p{lim} -s1
+    """, ports=[adm, lim])
+
+    url = f"http://127.0.0.1:{adm}"
+
+    # --- the predefined pages -----------------------------------------
+    t.eq(200, t.http(url + "/").status, "the main page")
+    t.eq(200, t.http(url + "/C").status, "the counters page")
+    t.eq(200, t.http(url + "/R").status, "the reload page")
+    t.eq(200, t.http(url + "/S").status, "the services page")
+
+    counters = t.http(url + "/C")
+    t.contains(counters, "countin", "the counters page names the counter type")
+    t.contains(counters, "<tr>", "the counters page renders a table")
+    t.contains(t.http(url + "/R"), "Reload", "the reload page confirms the request")
+    t.contains(t.http(url + "/S"), "<", "the services page returns markup")
+
+    # --- the menu no longer offers the removed config editor -----------
+    main = t.http(url + "/")
+    t.contains(main, "HREF='/C'", "the menu links to the counters")
+    t.contains(main, "HREF='/R'", "the menu links to reload")
+    t.contains(main, "HREF='/S'", "the menu links to the services")
+    t.not_contains(main, "HREF='/F'",
+                   "the menu no longer links to the config editor")
+
+    # /F and /U are gone, so they fall through to the catch-all rule
+    t.eq(200, t.http(url + "/F").status, "the removed /F falls through")
+    t.eq(200, t.http(url + "/U").status, "the removed /U falls through")
+    t.contains(t.http(url + "/F"), "configuration", "/F yields the main page")
+
+    # --- counter control through the glob ------------------------------
+    # /C<action><number> is routed by the /C* rule, the action arriving as
+    # the glob
+    t.http(url + "/CD0")
+    t.contains(t.http(url + "/C"), ">NO<", "a counter can be disabled")
+    t.http(url + "/CS0")
+    t.contains(t.http(url + "/C"), ">YES<", "a counter can be enabled again")
+
+    # --- limited mode ---------------------------------------------------
+    limited = f"http://127.0.0.1:{lim}"
+    t.eq(200, t.http(limited + "/").status, "limited mode serves the main page")
+    t.eq(200, t.http(limited + "/C").status, "limited mode serves the counters")
+    t.not_contains(t.http(limited + "/R"), "Reload scheduled",
+                   "limited mode refuses a reload")
+
+    # --- the writable command is gone ------------------------------------
+    output = t.run_config("writable", f"""
+        log
+        writable
+        admin -p{t.free_port()}
+    """)
+    t.contains(output, "Unknown command", "the writable command is rejected")

tests/cases/auto.py

@@ -0,0 +1,74 @@
+"""auto: one port that works out which protocol the client is speaking.
+
+Two origins, because the protocols reach different places: an HTTP or SOCKS
+client names its own destination, while a TLS client names a host in the
+handshake and the service supplies the port.
+"""
+
+
+def run(t):
+    certs = t.certs()
+    plain = t.free_port()
+    port = t.free_port()
+    secure = t.free_port() if certs else None
+
+    tls_origin = ""
+    if certs:
+        tls_origin = f"""
+        flush
+        ssl_server_cert {certs.server}
+        ssl_server_key {certs.server_key}
+        ssl_serv
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{secure}
+        ssl_noserv"""
+
+    ports = [plain, port] + ([secure] if certs else [])
+    server = t.start("auto", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{plain}
+{tls_origin}
+
+        flush
+        nserver 127.0.0.1
+        nscache 1024
+        nsrecord sni.test 127.0.0.1
+        auth iponly
+        allow *
+        auto -p{port}{f' -P{secure}' if certs else ''}
+    """, ports=ports)
+
+    url = f"http://127.0.0.1:{plain}/echo"
+    at = f"127.0.0.1:{port}"
+
+    # --- as an HTTP proxy -------------------------------------------------
+    r = t.http(url, proxy=at)
+    t.eq(200, r.status, "the same port serves an HTTP proxy request")
+    t.contains(r, "path=/echo", "the origin sees it")
+    t.contains(t.http(url, proxy=at, method="POST", body="x=1"), "method=POST",
+               "a POST is recognised as HTTP too")
+
+    # --- as a SOCKS proxy --------------------------------------------------
+    r = t.socks_http(at, url)
+    t.eq(200, r.status, "the same port serves SOCKS5")
+    t.contains(r, "path=/echo", "the origin sees the SOCKS request")
+    t.eq(200, t.socks_http(at, url, socks4=True).status,
+         "and SOCKS4 on the same port")
+
+    # --- as a name-directed TLS proxy --------------------------------------
+    if certs and "Unknown command" not in server.output():
+        r = t.https(f"https://sni.test:{port}/echo", ca=certs.ca, strict=False,
+                    connect_to=("127.0.0.1", port))
+        t.eq(200, r.status, "and a TLS handshake, routed by the name it carries")
+        t.contains(r, "path=/echo", "which reaches the TLS origin")
+    else:
+        t.skip("auto over TLS (no SSL support, or no openssl to make certificates)")
+
+    # --- what it is not ----------------------------------------------------
+    t.not_contains(t.raw(port, "GIBBERISH\r\n\r\n"), "200 OK",
+                   "nonsense is not served as anything")

tests/cases/dnspr.py

@@ -0,0 +1,45 @@
+"""dnspr: a caching DNS proxy, answering from what it has been told."""
+
+import time
+
+
+def run(t):
+    port = t.free_port()
+    t.start("dnspr", f"""
+        log
+        flush
+        nserver 127.0.0.1
+        nscache 1024
+        nsrecord host.test 10.11.12.13
+        nsrecord other.test 10.11.12.14
+        nsrecord blocked.test 0.0.0.0
+        auth iponly
+        allow *
+        dnspr -p{port}
+    """)
+    # Wait for the service: a datagram sent too early is simply lost. Bound
+    # by the clock, not by a number of attempts, so a server that answers
+    # nothing costs seconds rather than minutes.
+    deadline = time.time() + 5
+    while time.time() < deadline:
+        if t.dns_query(port, "host.test"):
+            break
+
+    t.eq(["10.11.12.13"], t.dns_query(port, "host.test"),
+         "a static record is answered")
+    t.eq(["10.11.12.14"], t.dns_query(port, "other.test"),
+         "and so is another one")
+
+    # asking twice must give the same answer, which is what the cache is for
+    t.eq(["10.11.12.13"], t.dns_query(port, "host.test"),
+         "the same name answers the same way again")
+
+    # 0.0.0.0 is the documented way to make a name never resolve: the
+    # address is handed out, and it is the client that then gets nowhere
+    t.eq(["0.0.0.0"], t.dns_query(port, "blocked.test"),
+         "a name pointed at 0.0.0.0 answers with that address")
+
+    # a name it knows nothing about cannot be answered from here: the
+    # configured server does not exist, so there is nothing to forward to
+    t.ne(["10.11.12.13"], t.dns_query(port, "unknown.test") or [],
+         "an unknown name does not borrow another answer")

tests/cases/httpsrv_auth.py

@@ -0,0 +1,49 @@
+"""Authentication and access rules in front of the HTTP server."""
+
+
+def run(t):
+    srv = t.free_port()
+    openport = t.free_port()
+    t.start("httpsrv_auth", f"""
+        log
+        http echo * /echo
+        auth strong
+        users alice:CL:secret bob:CL:hunter2
+        allow alice
+        httpsrv -p{srv}
+
+        flush
+        http echo * /echo
+        auth iponly
+        allow *
+        httpsrv -p{openport}
+    """, ports=[srv, openport])
+
+    url = f"http://127.0.0.1:{srv}"
+
+    r = t.http(url + "/echo")
+    t.eq(401, r.status, "no credentials gives 401")
+    t.ne(None, r.header("WWW-Authenticate"),
+         "the 401 carries a WWW-Authenticate header")
+
+    t.eq(200, t.http(url + "/echo", auth=("alice", "secret")).status,
+         "valid credentials pass")
+    t.eq(401, t.http(url + "/echo", auth=("alice", "wrong")).status,
+         "a wrong password gives 401")
+    t.eq(401, t.http(url + "/echo", auth=("nobody", "secret")).status,
+         "an unknown user gives 401")
+
+    # bob authenticates, but no rule admits him
+    t.eq(403, t.http(url + "/echo", auth=("bob", "hunter2")).status,
+         "authenticated but not allowed gives 403")
+
+    # authentication comes before dispatch, so an unmatched URL still needs it
+    t.eq(401, t.http(url + "/nosuchpath").status,
+         "authentication precedes the rule lookup")
+
+    # the second service kept its own iponly authentication
+    t.eq(200, t.http(f"http://127.0.0.1:{openport}/echo").status,
+         "the open service needs no credentials")
+
+    t.contains(t.http(url + "/echo", auth=("alice", "secret")), "path=/echo",
+               "an authenticated request is dispatched")

tests/cases/httpsrv_files.py

@@ -0,0 +1,195 @@
+"""The operations that serve a filesystem: file, cache, redir and rewrite.
+
+A rule maps a request onto a path with a template, where $1 upwards stand for
+what the stars or the groups of a regular expression matched.
+"""
+
+import os
+
+
+def run(t):
+    root = os.path.join(t.tmpdir, "web")
+    os.makedirs(os.path.join(root, "picts", "set"), exist_ok=True)
+    with open(os.path.join(root, "a.html"), "w") as fp:
+        fp.write("<h1>hello</h1>")
+    with open(os.path.join(root, "big.bin"), "wb") as fp:
+        fp.write(b"x" * 300000)          # past a single send, and past the cache limit
+    with open(os.path.join(root, "picts", "set", "dog.gif"), "wb") as fp:
+        fp.write(b"GIF89a-pretend")
+
+    with open(os.path.join(root, "b.webp"), "wb") as fp:
+        fp.write(b"RIFF-pretend")
+
+    port = t.free_port()
+    t.start("httpsrv_files", f"""
+        log
+        auth iponly
+        allow *
+        http rewrite * /alias/** "/w/$1"
+        http file  * /w/*.html "{root}/$1.html"
+        http file  * /big       {root}/big.bin
+        http cache * /c/*.html  "{root}/$1.html"
+        http cache * "pcre:^/(.*)/pic/(.*)\\.(gif|jpeg)$" "{root}/picts/$1/$2.$3"
+        http redir * /old/**    301 "https://example.org/$1"
+        http redir * /moved     /w/a.html
+        http file  * /rel/*.html "web/$1.html"
+        http echo  * /echo
+
+        http_content_type .webp image/webp
+        http_content_type dat   application/x-mydata
+        http file * /ct/*.webp  "{root}/$1.webp"
+        http file * /named/*.html "{root}/$1.html" text/x-named
+        http file * /star/*.html  "{root}/$1.html" *
+        http cache * /ctc/*.webp  "{root}/$1.webp"
+
+        http file  * /aged/*.html  "{root}/$1.html" * 3600
+        http cache * /aged2/*.html "{root}/$1.html" * 60
+        http file  * /extra/*.html "{root}/$1.html" * * "X-One: 1\\nX-Two: two words"
+        http file  * /err/*.html   "{root}/$1.html" * * "X-Served: static" 404
+        http reply * /ok**
+        http reply * /nobody**  204
+        http reply * /down**    503 "Retry-After: 30"
+        http cache * /held/*.html "{root}/$1.html" * 30
+        httpsrv -p{port}
+    """, ports=[port])
+
+    url = f"http://127.0.0.1:{port}"
+
+    # --- file -------------------------------------------------------------
+    r = t.http(url + "/w/a.html")
+    t.eq(200, r.status, "a file is served")
+    t.contains(r, "<h1>hello</h1>", "with its content")
+    t.eq("text/html", r.header("Content-Type"), "and a type taken from the name")
+    t.eq(str(len("<h1>hello</h1>")), r.header("Content-Length"), "and its length")
+
+    t.eq(404, t.http(url + "/w/nosuch.html").status, "a missing file is not found")
+    big = t.http(url + "/big")
+    t.eq(300000, big.length, "a large file arrives whole")
+    t.eq("300000", big.header("Content-Length"), "and is announced by its length")
+    t.eq(None, big.header("Transfer-Encoding"),
+         "a file is never sent chunked")
+    t.eq("300000", t.http(url + "/big", method="HEAD").header("Content-Length"),
+         "HEAD gives the length without the body")
+    t.eq(200, t.http(url + "/w/a.html", method="HEAD").status, "HEAD is answered")
+    t.eq(0, t.http(url + "/w/a.html", method="HEAD").length, "HEAD carries no body")
+
+    # --- cache ------------------------------------------------------------
+    first = t.http(url + "/c/a.html")
+    second = t.http(url + "/c/a.html")
+    t.eq(200, first.status, "a cached file is served")
+    t.eq(first.text, second.text, "and the same on the next request")
+    t.contains(second, "<h1>hello</h1>", "from memory this time")
+
+    # a file changed on disk is noticed rather than served from before
+    with open(os.path.join(root, "a.html"), "w") as fp:
+        fp.write("<h1>changed</h1>")
+    t.contains(t.http(url + "/c/a.html"), "changed",
+               "a file replaced on disk is read again")
+
+    # --- what the stars stand for -----------------------------------------
+    r = t.http(url + "/set/pic/dog.gif")
+    t.eq(200, r.status, "a regular expression maps a request onto a path")
+    t.contains(r, "GIF89a", "and the file is served")
+    t.eq("image/gif", r.header("Content-Type"), "with the type of that name")
+
+    # --- redir ------------------------------------------------------------
+    r = t.http(url + "/old/thing")
+    t.eq(301, r.status, "a redirect uses the status it was given")
+    t.eq("https://example.org/thing", r.header("Location"),
+         "and a location built from the request")
+    t.eq(302, t.http(url + "/moved").status, "without a status it is 302")
+
+    # --- rewrite ----------------------------------------------------------
+    r = t.http(url + "/alias/a.html")
+    t.eq(200, r.status, "a rewritten request reaches the rule after it")
+    t.contains(r, "changed", "and is served from the path it was rewritten to")
+
+    # --- the type a reply carries -------------------------------------------
+    # Worked out from the name, using what the configuration has registered
+    # on top of what is built in, unless the rule says otherwise.
+    t.eq("image/webp", t.http(url + "/ct/b.webp").header("Content-Type"),
+         "a registered extension names the type")
+    t.eq("image/webp", t.http(url + "/ctc/b.webp").header("Content-Type"),
+         "and a cached file is answered the same way")
+    t.eq("text/x-named", t.http(url + "/named/a.html").header("Content-Type"),
+         "a rule may name the type itself")
+    t.eq("text/html", t.http(url + "/star/a.html").header("Content-Type"),
+         "and a star there leaves it to the name of the file")
+
+    # --- what a rule adds to the answer ------------------------------------
+    r = t.http(url + "/aged/a.html")
+    t.eq("max-age=3600", r.header("Cache-Control"), "a rule may describe caching")
+    t.eq("max-age=60", t.http(url + "/aged2/a.html").header("Cache-Control"),
+         "a cached file is answered the same way")
+    t.eq(None, t.http(url + "/w/a.html").header("Cache-Control"),
+         "and a rule which says nothing sends nothing")
+
+    r = t.http(url + "/extra/a.html")
+    t.eq("1", r.header("X-One"), "a rule may add headers")
+    t.eq("two words", r.header("X-Two"),
+         "the second of them arrives whole, spaces and all")
+
+    r = t.http(url + "/err/a.html")
+    t.eq(404, r.status, "a rule may answer with the status it names")
+    t.contains(r, "<h1>", "and the file is still the body")
+    t.eq("static", r.header("X-Served"),
+         "what the rule adds goes with the status the rule asked for")
+
+    # a refusal the server decided on is its own answer
+    r = t.http(url + "/err/nosuch.html")
+    t.eq(404, r.status, "a missing file is still not found")
+    t.eq(None, r.header("X-Served"), "and carries none of the rule's headers")
+    t.eq(None, t.http(url + "/aged/nosuch.html").header("Cache-Control"),
+         "nor what it said about caching")
+
+    # --- reply --------------------------------------------------------------
+    r = t.http(url + "/ok")
+    t.eq(200, r.status, "reply answers with 200 by default")
+    t.eq("0", r.header("Content-Length"), "with a length of zero")
+    t.eq(0, r.length, "and no body")
+
+    r = t.http(url + "/nobody")
+    t.eq(204, r.status, "reply answers with the status it was given")
+    t.eq(None, r.header("Content-Length"),
+         "and a status carrying no body is sent without a length")
+
+    r = t.http(url + "/down")
+    t.eq(503, r.status, "reply serves a refusal the configuration decided on")
+    t.eq("30", r.header("Retry-After"), "with the headers that go with it")
+
+    # --- a client which has the file already --------------------------------
+    r = t.http(url + "/w/a.html")
+    stamp = r.header("Last-Modified")
+    t.ne(None, stamp, "a file is answered with the time it was last changed")
+
+    r = t.http(url + "/w/a.html", headers={"If-Modified-Since": stamp})
+    t.eq(304, r.status, "and an unchanged file is answered 304")
+    t.eq(0, r.length, "which carries no body")
+    t.eq(None, r.header("Content-Length"), "and no length")
+    t.eq(stamp, r.header("Last-Modified"), "but still says when the file changed")
+
+    t.eq(200, t.http(url + "/w/a.html",
+                     headers={"If-Modified-Since": "Sun, 06 Nov 1994 08:49:37 GMT"}).status,
+         "an older date is answered with the file")
+    t.eq(200, t.http(url + "/w/a.html",
+                     headers={"If-Modified-Since": "not a date at all"}).status,
+         "and a date which cannot be read is treated as none")
+    t.eq(304, t.http(url + "/c/a.html", headers={"If-Modified-Since": stamp}).status,
+         "a file answered from memory is conditional in the same way")
+    t.eq(404, t.http(url + "/err/a.html", headers={"If-Modified-Since": stamp}).status,
+         "a rule with a status of its own is not turned into a 304")
+
+    # --- a rule which says how long its copy may be held --------------------
+    t.contains(t.http(url + "/held/a.html"), "changed", "a held file is served")
+    with open(os.path.join(root, "a.html"), "w") as fp:
+        fp.write("<h1>replaced</h1>")
+    t.not_contains(t.http(url + "/held/a.html"), "replaced",
+                   "and within its max-age the disk is not looked at again")
+    t.contains(t.http(url + "/c/a.html"), "replaced",
+               "while a rule without one notices the change at once")
+
+    # --- the paths a rule may not build ------------------------------------
+    t.eq(403, t.http(url + "/rel/a.html").status,
+         "a relative target is refused")
+    t.ne(200, t.http(url + "/w/../etc/passwd").status,
+         "a request climbing out of the tree is refused")

tests/cases/httpsrv_keepalive.py

@@ -0,0 +1,109 @@
+"""Keep-alive: which answers may be followed by another request.
+
+The next request begins where the last answer ended, so a connection is only
+kept when the length of what was sent is known exactly and the body of the
+request was read to its end. Everything else closes, which is the safe way to
+be wrong.
+"""
+
+import os
+
+
+def run(t):
+    root = os.path.join(t.tmpdir, "ka")
+    os.makedirs(root, exist_ok=True)
+    with open(os.path.join(root, "a.html"), "w") as fp:
+        fp.write("<h1>hello</h1>")
+
+    port = t.free_port()
+    t.start("httpsrv_keepalive", f"""
+        log
+        auth iponly
+        allow *
+        http file  * /w/*.html "{root}/$1.html"
+        http reply * /ok**  200
+        http echo  * /echo**
+        http data  * /chunked** size=100&chunked=1
+        httpsrv -p{port}
+    """, ports=[port])
+
+    def req(path, version="1.1", extra="", body=""):
+        head = (f"GET {path} HTTP/{version}\r\nHost: t\r\n{extra}\r\n")
+        if body:
+            head = head.replace("GET", "POST", 1)
+        return head + body
+
+    def session(*requests, quiet=0.5):
+        text, closed = t.raw_session(port, "".join(requests), quiet=quiet)
+        return text, closed, text.count("HTTP/1.")
+
+    # --- what keeps the connection ---------------------------------------
+    text, closed, n = session(req("/w/a.html"), req("/ok"),
+                              req("/w/a.html", extra="Connection: close\r\n"))
+    t.eq(3, n, "three 1.1 requests are answered on one connection")
+    t.eq(True, closed, "and the one asking to close ends it")
+    t.contains(text, "Connection: keep-alive", "the answers say the connection is kept")
+    t.eq(2, text.count("<h1>hello</h1>"), "each file arrives whole")
+
+    text, closed, n = session(req("/w/a.html", version="1.0"), req("/ok", version="1.0"))
+    t.eq(1, n, "a 1.0 request without the header is answered once")
+    t.eq(True, closed, "and the connection ends")
+    t.contains(text, "Connection: close", "which the answer says")
+
+    text, closed, n = session(req("/w/a.html", version="1.0",
+                                  extra="Connection: keep-alive\r\n"),
+                              req("/ok", version="1.0",
+                                  extra="Connection: close\r\n"))
+    t.eq(2, n, "a 1.0 client asking for keep-alive gets it")
+
+    # a request carrying a body: the next one begins after it
+    text, closed, n = session(req("/echo", extra="Content-Length: 5\r\n", body="hello"),
+                              req("/ok", extra="Connection: close\r\n"))
+    t.eq(2, n, "a body which was read to its end leaves the stream in place")
+    t.contains(text, "content.length=5", "and the body was seen")
+
+    # --- what ends it -----------------------------------------------------
+    text, closed, n = session(req("/echo", extra="Transfer-Encoding: chunked\r\n"),
+                              req("/ok"))
+    t.eq(1, n, "a request body this server cannot frame ends the connection")
+    t.eq(True, closed, "the connection is closed rather than left mid-body")
+
+    # A body longer than the server is willing to read leaves the rest of it
+    # in the stream, so the connection cannot carry another request. The send
+    # may not even finish - the server answers and closes part way through -
+    # which is the same answer from the other side.
+    big = "x" * 1500000
+    text, closed, n = session(req("/echo", extra="Content-Length: 1500000\r\n", body=big),
+                              quiet=2)
+    t.eq(1, n, "a body past what the server will read is answered once")
+    t.contains(text, "Connection: close",
+               "and the answer ends the connection rather than leaving the rest to be read")
+
+    # --- answers of other shapes -----------------------------------------
+    text, closed, n = session(req("/chunked"), req("/ok", extra="Connection: close\r\n"))
+    t.eq(2, n, "a chunked answer may be followed by another request")
+
+    text, closed, n = session(req("/chunked", version="1.0"), req("/ok", version="1.0"))
+    t.eq(1, n, "but not for a client which has no chunked encoding to read")
+
+    stamp = t.http(f"http://127.0.0.1:{port}/w/a.html").header("Last-Modified")
+    text, closed, n = session(req("/w/a.html", extra=f"If-Modified-Since: {stamp}\r\n"),
+                              req("/ok", extra="Connection: close\r\n"))
+    t.eq(2, n, "a 304 carries no body and the next request follows it")
+    t.contains(text, "304", "and it is a 304")
+
+    # --- the administration pages always close ---------------------------
+    aport = t.free_port()
+    t.start("httpsrv_keepalive_admin", f"""
+        log
+        auth iponly
+        allow *
+        http file * /w/*.html "{root}/$1.html"
+        admin -p{aport}
+    """, ports=[aport])
+
+    text, closed = t.raw_session(aport,
+        f"GET /w/a.html HTTP/1.1\r\nHost: t\r\n\r\nGET /C HTTP/1.1\r\nHost: t\r\n\r\n"
+        f"GET /w/a.html HTTP/1.1\r\nHost: t\r\n\r\n")
+    t.eq(2, text.count("HTTP/1."), "an administration page is the last thing on a connection")
+    t.eq(True, closed, "which the server closes, since the page states no length")

tests/cases/httpsrv_ops.py

@@ -0,0 +1,78 @@
+"""The built-in HTTP server: the echo and data operations."""
+
+import time
+
+
+def run(t):
+    srv = t.free_port()
+    t.start("httpsrv_ops", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http data * /data
+        http data * /small size=64
+        httpsrv -p{srv}
+    """, ports=[srv])
+
+    url = f"http://127.0.0.1:{srv}"
+
+    # --- echo: request introspection ---------------------------------
+    r = t.http(url + "/echo?a=1")
+    t.eq(200, r.status, "echo answers 200")
+    t.contains(r, "method=GET", "echo reports the method")
+    t.contains(r, "path=/echo", "echo reports the path")
+    t.contains(r, "query=a=1", "echo reports the query")
+    t.contains(r, "peer.addr=127.0.0.1", "echo reports the peer address")
+    t.contains(r, f"host=127.0.0.1:{srv}", "echo reports the Host header")
+
+    # the glob is the wildcard-matched tail, which is how admin routes its
+    # sub-pages
+    r = t.http(url + "/echoXYZ")
+    t.contains(r, "glob=XYZ", "echo reports the glob text")
+    t.contains(r, "glob.len=3", "echo reports the glob length")
+
+    # --- data: generated payload -------------------------------------
+    t.eq(1000, t.http(url + "/data?size=1000").length, "data honours size")
+    t.eq(0, t.http(url + "/data?size=0").length, "data size=0 sends an empty body")
+    t.eq(64, t.http(url + "/small").length, "data takes its size from the rule")
+    t.eq(1000, t.http(url + "/small?size=1000").length,
+         "the query overrides the rule parameters")
+
+    # a size past one block exercises the send loop
+    t.eq(70000, t.http(url + "/data?size=70000").length,
+         "data spans several blocks")
+    t.eq(70000, t.http(url + "/data?size=70000&block=1024").length,
+         "data honours the block size")
+
+    # --- status and framing ------------------------------------------
+    t.eq(404, t.http(url + "/data?size=10&status=404").status,
+         "data honours the status")
+    t.eq(503, t.http(url + "/data?size=10&status=503").status,
+         "data returns 503 when asked")
+    t.eq(200, t.http(url + "/data?size=10&status=99").status,
+         "an out-of-range status falls back to 200")
+
+    r = t.http(url + "/data?size=100")
+    t.eq("100", r.header("Content-Length"), "an identity reply sets Content-Length")
+
+    r = t.http(url + "/data?size=100&chunked=1")
+    t.eq("chunked", r.header("Transfer-Encoding"),
+         "a chunked reply sets Transfer-Encoding")
+    t.eq(None, r.header("Content-Length"),
+         "a chunked reply omits Content-Length")
+    t.eq(100, r.length, "a chunked body decodes to the size asked for")
+    t.eq(70000, t.http(url + "/data?size=70000&chunked=1").length,
+         "a chunked body spans several blocks")
+
+    # --- delay --------------------------------------------------------
+    start = time.time()
+    t.http(url + "/data?size=4096&block=1024&delay=100")
+    elapsed = time.time() - start
+    if elapsed >= 0.3:
+        t.ok("delay slows the transfer")
+    else:
+        t.fail("delay slows the transfer", ">=0.3s", f"{elapsed:.2f}s")
+
+    # --- unmatched ----------------------------------------------------
+    t.eq(404, t.http(url + "/nosuchthing").status, "an unmatched URL gives 404")

tests/cases/httpsrv_parsing.py

@@ -0,0 +1,89 @@
+"""Request parsing: decoding, path safety, malformed and oversized input.
+
+These go over a raw socket, because a well-behaved client would normalise
+most of them away before they ever reached the server.
+"""
+
+
+def run(t):
+    srv = t.free_port()
+    t.start("httpsrv_parsing", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http echo * /safe/**
+        httpsrv -p{srv}
+    """, ports=[srv])
+
+    def request(path, host="t", extra=""):
+        return t.raw(srv, f"GET {path} HTTP/1.0\r\nHost: {host}\r\n{extra}\r\n")
+
+    # --- percent-decoding ---------------------------------------------
+    reply = request("/%65cho")
+    t.contains(reply, "200 OK", "a percent-encoded path is decoded before matching")
+    t.contains(reply, "path=/echo", "the decoded path is what gets reported")
+    t.contains(request("/echo%20space"), "glob= space",
+               "an encoded space decodes into the glob")
+
+    # --- traversal -----------------------------------------------------
+    for path in ("/safe/../etc/passwd", "/safe/%2e%2e/etc", "/safe/..%2fetc",
+                 "/echo/../../x"):
+        t.not_contains(request(path), "200 OK", f"traversal is refused: {path}")
+
+    t.contains(request("/safe/./ok"), "200 OK",
+               "a harmless dot segment is still served")
+
+    # --- injection ------------------------------------------------------
+    t.not_contains(request("/echo%0d%0aInjected:%20yes"), "Injected: yes",
+                   "an encoded CRLF cannot inject a header")
+    t.not_contains(request("/echo%00cut"), "200 OK", "an encoded NUL is refused")
+
+    # a header value cannot smuggle a newline into the echoed output
+    reply = request("/echo", host="evil", extra="X-Injected: yes\r\n")
+    t.not_contains(reply, "host=evil\nX-Injected",
+                   "header values stay in their own fields")
+
+    # --- malformed ------------------------------------------------------
+    t.not_contains(t.raw(srv, "GARBAGE\r\n\r\n"), "200 OK",
+                   "a malformed request line is not served")
+    t.not_contains(t.raw(srv, "GET\r\n\r\n"), "200 OK",
+                   "a request line with no URL is not served")
+
+    # an over-long path has to be refused rather than quietly truncated to
+    # something shorter that might match another rule
+    t.not_contains(request("/echo" + "a" * 9000), "200 OK",
+                   "an over-long path is refused, not truncated")
+
+    # --- methods --------------------------------------------------------
+    url = f"http://127.0.0.1:{srv}"
+    t.eq(200, t.http(url + "/echo", method="HEAD").status, "HEAD is accepted")
+    r = t.http(url + "/echo", method="POST", body="payload=1",
+               headers={"Content-Type": "application/x-www-form-urlencoded"})
+    t.contains(r, "method=POST", "POST reaches the handler")
+    t.contains(r, "content.length=9", "the POST content length is parsed")
+
+    # --- dollars in the configuration ------------------------------------
+    # Outside quotes a dollar begins the name of a file to include, so an
+    # argument holding one is quoted. Two dollars stand for one, which is how
+    # a dollar reaches a rule as text.
+    dsrv = t.free_port()
+    t.start("httpsrv_dollar", f"""
+        log
+        auth iponly
+        allow *
+        http redir * /old** 301 "http://example.org/x$$y/$1"
+        http redir * "pcre:^/re/([a-z]+)$" 302 "http://example.org/re/$1"
+        http echo * /**
+        httpsrv -p{dsrv}
+    """, ports=[dsrv])
+
+    durl = f"http://127.0.0.1:{dsrv}"
+    r = t.http(durl + "/old/a")
+    t.eq(301, r.status, "a rule holding a doubled dollar loads")
+    t.eq("http://example.org/x$y//a", r.header("Location"),
+         "and two dollars reach the location as one")
+    t.eq(302, t.http(durl + "/re/abc").status,
+         "a quoted regular expression keeps its anchor")
+    t.eq(200, t.http(durl + "/re/ab9").status,
+         "and the anchor is real: what it excludes falls through")

tests/cases/httpsrv_proxypass.py

@@ -0,0 +1,203 @@
+"""A service which is both a site and a proxy.
+
+The rules answer what they have; anything else is handed to the proxy code,
+which authenticates as a proxy and fetches it. The same connection carries
+both kinds of request.
+"""
+
+import os
+
+
+def run(t):
+    root = os.path.join(t.tmpdir, "pp")
+    os.makedirs(root, exist_ok=True)
+    with open(os.path.join(root, "a.html"), "w") as fp:
+        fp.write("<h1>local</h1>")
+
+    # two origins, so a change of destination is visible
+    one = t.free_port()
+    two = t.free_port()
+    t.start("httpsrv_proxypass_origins", f"""
+        auth iponly
+        allow *
+        http echo * /**
+        httpsrv -p{one}
+
+        flush
+        auth iponly
+        allow *
+        http echo * /**
+        httpsrv -p{two}
+    """, ports=[one, two])
+
+    # --- the rule which hands a request on ---------------------------------
+    srv = t.free_port()
+    t.start("httpsrv_proxypass", f"""
+        log
+        auth iponly
+        allow *
+        http file * /local/*.html "{root}/$1.html"
+        http reply * /health** 200
+        http proxypass * /**
+        httpsrv -p{srv}
+    """, ports=[srv])
+
+    url = f"http://127.0.0.1:{srv}"
+    t.contains(t.http(url + "/local/a.html"), "<h1>local</h1>",
+               "a rule of its own is still answered here")
+    t.eq(200, t.http(url + "/health").status, "and so is another")
+
+    r = t.http(f"http://127.0.0.1:{one}/echo", proxy=f"127.0.0.1:{srv}")
+    t.eq(200, r.status, "a request the rules do not answer is proxied")
+    t.contains(r, "path=/echo", "and the origin sees it")
+
+    # a client which sends an origin-form request with a Host header reaches
+    # the same place: what decides is which rule matches, not the form
+    r = t.http(url + "/echo", headers={"Host": f"127.0.0.1:{one}"})
+    t.contains(r, "path=/echo", "an origin-form request is proxied the same way")
+
+    # --- an access rule which sends the rest to the proxy -------------------
+    # allow, with a chain to the local proxy, then a second rule for the pass
+    # the proxy itself makes
+    rsrv = t.free_port()
+    t.start("httpsrv_proxypass_acl", f"""
+        log
+        auth iponly
+        allow *
+        parent 1000 http 0.0.0.0 0
+        allow *
+        http file * /local/*.html "{root}/$1.html"
+        httpsrv -p{rsrv}
+    """, ports=[rsrv])
+
+    rurl = f"http://127.0.0.1:{rsrv}"
+    t.contains(t.http(rurl + "/local/a.html"), "<h1>local</h1>",
+               "a rule still wins over the redirect")
+    r = t.http(f"http://127.0.0.1:{one}/echo", proxy=f"127.0.0.1:{rsrv}")
+    t.eq(200, r.status, "and what no rule matches goes to the proxy the rule named")
+
+    # --- rules after the chain decide what the proxy may fetch -------------
+    # The service answers for itself on the first pass, so an address or a
+    # port there is the one the client connected to; on the pass the proxy
+    # makes, it is the one the request names.
+    gsrv = t.free_port()
+    t.start("httpsrv_proxypass_gate", f"""
+        log
+        auth iponly
+        allow *
+        parent 1000 http 0.0.0.0 0
+        allow * * 127.0.0.1/32 {one}
+        deny *
+        httpsrv -p{gsrv}
+    """, ports=[gsrv])
+
+    t.eq(200, t.http(f"http://127.0.0.1:{one}/echo", proxy=f"127.0.0.1:{gsrv}").status,
+         "a destination a later rule allows is fetched")
+    t.eq(403, t.http(f"http://127.0.0.1:{two}/echo", proxy=f"127.0.0.1:{gsrv}").status,
+         "and one no rule allows is refused")
+
+    # a deny written before the rule carrying the chain applies as well
+    bsrv = t.free_port()
+    t.start("httpsrv_proxypass_deny", f"""
+        log
+        auth iponly
+        deny * * 127.0.0.1/32 {two}
+        allow *
+        parent 1000 http 0.0.0.0 0
+        allow *
+        httpsrv -p{bsrv}
+    """, ports=[bsrv])
+
+    t.eq(200, t.http(f"http://127.0.0.1:{one}/echo", proxy=f"127.0.0.1:{bsrv}").status,
+         "what the deny does not name is still fetched")
+    t.eq(403, t.http(f"http://127.0.0.1:{two}/echo", proxy=f"127.0.0.1:{bsrv}").status,
+         "a deny before the chain stops the request too")
+
+    # --- one connection, both kinds of request -----------------------------
+    text, closed = t.raw_session(srv,
+        f"GET /local/a.html HTTP/1.1\r\nHost: t\r\n\r\n"
+        f"GET http://127.0.0.1:{one}/echo HTTP/1.1\r\nHost: 127.0.0.1:{one}\r\n\r\n"
+        f"GET http://127.0.0.1:{two}/echo HTTP/1.1\r\nHost: 127.0.0.1:{two}\r\n\r\n"
+        f"GET /local/a.html HTTP/1.1\r\nHost: t\r\nConnection: close\r\n\r\n",
+        quiet=2)
+    t.eq(4, text.count("HTTP/1."), "four requests are answered on one connection")
+    t.eq(2, text.count("<h1>local</h1>"), "two of them here")
+    t.eq(2, text.count("peer.addr="), "and two by the origins")
+    t.eq(True, closed, "the last one ends it")
+
+    # --- every kind of rule on the same connection --------------------------
+    with open(os.path.join(root, "f.html"), "w") as fp:
+        fp.write("FILEBODY")
+    with open(os.path.join(root, "c.html"), "w") as fp:
+        fp.write("CACHEBODY")
+
+    msrv = t.free_port()
+    t.start("httpsrv_proxypass_mix", f"""
+        log
+        auth iponly
+        allow *
+        http file  * /f/*.html "{root}/$1.html"
+        http cache * /c/*.html "{root}/$1.html"
+        http proxypass * /**
+        httpsrv -p{msrv}
+    """, ports=[msrv])
+
+    proxied = f"GET http://127.0.0.1:{one}/echo HTTP/1.1\r\nHost: 127.0.0.1:{one}\r\n\r\n"
+    text, closed = t.raw_session(msrv,
+        "GET /f/f.html HTTP/1.1\r\nHost: t\r\n\r\n"
+        "GET /c/c.html HTTP/1.1\r\nHost: t\r\n\r\n"
+        + proxied +
+        "GET /c/c.html HTTP/1.1\r\nHost: t\r\n\r\n"
+        + proxied +
+        "GET /f/f.html HTTP/1.1\r\nHost: t\r\nConnection: close\r\n\r\n",
+        quiet=2)
+    t.eq(6, text.count("HTTP/1."), "file, cache and proxypass share one connection")
+    t.eq(2, text.count("FILEBODY"), "both files arrive")
+    t.eq(2, text.count("CACHEBODY"), "both cached files arrive")
+    t.eq(2, text.count("peer.addr="), "and both proxied requests arrive")
+    t.eq(True, closed, "the request asking to close ends it")
+
+    # --- a proxied answer of unstated length ends the connection ------------
+    # Its body is delimited by the close, so nothing can follow it here
+    # either: the client has to ask again on a new connection.
+    closer = t.free_port()
+    stop = t.raw_server(closer,
+                        b"HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nCLOSEDELIMITED",
+                        close_after=True)
+    try:
+        text, closed = t.raw_session(msrv,
+            f"GET http://127.0.0.1:{closer}/x HTTP/1.1\r\nHost: 127.0.0.1:{closer}\r\n\r\n"
+            "GET /f/f.html HTTP/1.1\r\nHost: t\r\n\r\n", quiet=2)
+        t.eq(1, text.count("HTTP/1."), "the answer of unstated length is the last one")
+        t.contains(text, "CLOSEDELIMITED", "and its body still arrives whole")
+        t.eq(True, closed, "the connection ends with it")
+    finally:
+        stop()
+
+    # --- credentials go where a proxy expects them --------------------------
+    asrv = t.free_port()
+    t.start("httpsrv_proxypass_auth", f"""
+        log
+        users u:CL:p
+        auth strong
+        allow u
+        http file * /local/*.html "{root}/$1.html"
+        http proxypass * /**
+        httpsrv -p{asrv}
+    """, ports=[asrv])
+
+    aurl = f"http://127.0.0.1:{asrv}"
+    r = t.http(f"http://127.0.0.1:{one}/echo", proxy=f"127.0.0.1:{asrv}")
+    t.eq(407, r.status, "a proxy-style request with no credentials is asked for them")
+    t.contains(r.header("Proxy-Authenticate") or "", "Basic",
+               "with the header a proxy client reads")
+
+    r = t.http(f"http://127.0.0.1:{one}/echo", proxy=f"127.0.0.1:{asrv}",
+               proxy_auth=("u", "p"))
+    t.eq(200, r.status, "and is served once they are given")
+
+    r = t.http(aurl + "/local/a.html")
+    t.eq(401, r.status, "a request to the site itself is asked the site's way")
+    t.contains(r.header("WWW-Authenticate") or "", "Basic", "with its own header")
+    t.contains(t.http(aurl + "/local/a.html", auth=("u", "p")), "<h1>local</h1>",
+               "and answered once they are given")

tests/cases/httpsrv_rules.py

@@ -0,0 +1,98 @@
+"""Rule dispatch: host and URL patterns, and per-service rule sets."""
+
+
+def run(t):
+    srv = t.free_port()
+    srv2 = t.free_port()
+    t.start("httpsrv_rules", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /exact
+        http echo * /pre*
+        http echo * /deep/**
+        http echo * **.suffix
+        http echo * **mid**
+        http echo host.example.com /byhost
+        http echo *.wild.example.com /bywild
+        http echo * /only-first
+
+        http rewrite_host *.old.example ** "$1.new.example"
+        http rewrite_host "pcre:^legacy-(.*)$" ** "$1.new.example"
+        http rewrite_host * /badhost** "not a host name"
+        http echo one.new.example /**
+        httpsrv -p{srv}
+
+        flush
+        auth iponly
+        allow *
+        http echo * /only-second
+        httpsrv -p{srv2}
+    """, ports=[srv, srv2])
+
+    url = f"http://127.0.0.1:{srv}"
+
+    # --- URL patterns -------------------------------------------------
+    t.eq(200, t.http(url + "/exact").status, "an exact URL matches")
+    t.eq(404, t.http(url + "/exactly").status,
+         "an exact URL does not match a longer path")
+    t.eq(200, t.http(url + "/pre").status, "a prefix matches the bare prefix")
+    t.eq(200, t.http(url + "/pretty").status,
+         "a prefix matches a longer name in the same path element")
+
+    # a single star stays inside one element of the path, which is what keeps
+    # a rule from reaching into directories it did not name
+    t.eq(404, t.http(url + "/pretty/deep").status,
+         "a prefix does not cross a slash")
+    t.eq(200, t.http(url + "/deep/a/b/c").status,
+         "a double star does cross one")
+    t.eq(200, t.http(url + "/any.suffix").status, "a suffix matches")
+    t.eq(404, t.http(url + "/any.suffixx").status,
+         "a suffix is anchored at the end")
+    t.eq(200, t.http(url + "/xxmidxx").status, "a substring matches")
+    t.eq(404, t.http(url + "/nomatch").status, "an unmatched URL gives 404")
+
+    # --- host patterns ------------------------------------------------
+    def with_host(path, host):
+        return t.http(url + path, headers={"Host": host})
+
+    t.eq(200, with_host("/byhost", "host.example.com").status,
+         "an exact host matches")
+    t.eq(404, with_host("/byhost", "other.example.com").status,
+         "another host does not match")
+    t.eq(200, with_host("/bywild", "a.wild.example.com").status,
+         "a wildcard host matches")
+    t.eq(404, with_host("/bywild", "a.other.example.com").status,
+         "a wildcard host rejects another domain")
+
+    # the rules are ordered, and the first match wins
+    t.contains(t.http(url + "/exact"), "path=/exact",
+               "the first matching rule handles the request")
+
+    # --- per-service rule sets ----------------------------------------
+    # Rules accumulate until a service starts, which takes them; later rules
+    # belong to the next service only.
+    t.eq(200, t.http(f"http://127.0.0.1:{srv}/only-first").status,
+         "the first service has its own rules")
+    t.eq(404, t.http(f"http://127.0.0.1:{srv}/only-second").status,
+         "the first service does not have the later rules")
+    t.eq(200, t.http(f"http://127.0.0.1:{srv2}/only-second").status,
+         "the second service has its own rules")
+    t.eq(404, t.http(f"http://127.0.0.1:{srv2}/only-first").status,
+         "the second service does not have the earlier rules")
+
+    # --- a rule which changes the host --------------------------------
+    # The stars of the host pattern are what $1 upwards stand for here, the
+    # way the stars of the URL stand for themselves in a rewrite.
+    r = t.http(url + "/anything", headers={"Host": "one.old.example"})
+    t.eq(200, r.status, "a rewritten host reaches the rules after it")
+    t.contains(r, "host=one.new.example", "and the request carries the new name")
+
+    t.eq(200, t.http(url + "/anything", headers={"Host": "legacy-one"}).status,
+         "a regular expression names the part to keep")
+
+    t.eq(404, t.http(url + "/anything", headers={"Host": "other.example"}).status,
+         "a host no rule rewrites is left as it was")
+
+    t.eq(403, t.http(url + "/badhost", headers={"Host": "x"}).status,
+         "a rule may not build something which is not a host name")

tests/cases/ipv6.py

@@ -0,0 +1,232 @@
+"""IPv6: listening on it, reaching it, and the rules that mention it.
+
+A service resolves IPv4 only unless told otherwise, so the proxies that are
+meant to reach IPv6 carry a family flag. Names resolving to IPv6 need
+nscache6: nscache holds the IPv4 side and nothing else.
+"""
+
+
+def run(t):
+    if not t.has_ipv6():
+        t.skip("IPv6 (this machine has no IPv6 loopback)")
+        return
+
+    origin = t.free_port()
+    v6proxy = t.free_port()
+    mixed = t.free_port()
+    v4only = t.free_port()
+    socks6 = t.free_port()
+
+    t.start("ipv6", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http data * /data
+        httpsrv -p{origin} -i::1
+
+        # reached over IPv6, and allowed to reach IPv6
+        flush
+        auth iponly
+        allow *
+        proxy -p{v6proxy} -i::1 -6
+
+        # reached over IPv4, still able to reach IPv6
+        flush
+        auth iponly
+        allow *
+        proxy -p{mixed} -6
+
+        # asked for IPv4 only, so an IPv6 destination is not for it
+        flush
+        auth iponly
+        allow *
+        proxy -p{v4only} -4
+
+        flush
+        auth iponly
+        allow *
+        socks -p{socks6} -6
+    """, ports=[("::1", origin), ("::1", v6proxy), mixed, v4only, socks6])
+
+    url = f"http://[::1]:{origin}/echo"
+
+    # --- listening on IPv6 -------------------------------------------------
+    r = t.http(url)
+    t.eq(200, r.status, "a service bound to ::1 answers over IPv6")
+    t.contains(r, "peer.addr=::1", "the client is seen as an IPv6 address")
+    t.contains(r, "path=/echo", "and the request arrives intact")
+
+    # the Host header carries the address in brackets, and a rule matching
+    # any host still matches it
+    t.contains(r, "host=[::1]", "the host header keeps its brackets")
+
+    # --- proxying over IPv6 -------------------------------------------------
+    r = t.http(url, proxy=f"[::1]:{v6proxy}")
+    t.eq(200, r.status, "a proxy reached over IPv6 serves an IPv6 destination")
+    t.contains(r, "peer.addr=::1", "the proxy connects from IPv6 as well")
+
+    t.eq(20000, t.http(f"http://[::1]:{origin}/data?size=20000",
+                       proxy=f"[::1]:{v6proxy}").length,
+         "a body passes over IPv6")
+
+    t.eq(200, t.http(url, proxy=f"[::1]:{v6proxy}", tunnel=True).status,
+         "CONNECT works over IPv6")
+
+    # --- across the two families --------------------------------------------
+    r = t.http(url, proxy=f"127.0.0.1:{mixed}")
+    t.eq(200, r.status, "a client on IPv4 can be given an IPv6 destination")
+    t.contains(r, "peer.addr=::1", "and the far side is still reached over IPv6")
+
+    # a service told to use one family stays in it
+    t.ne(200, t.http(url, proxy=f"127.0.0.1:{v4only}").status,
+         "a service asked for IPv4 only refuses an IPv6 destination")
+
+    # --- SOCKS with an IPv6 destination -------------------------------------
+    r = t.socks_http(f"127.0.0.1:{socks6}", url)
+    t.eq(200, r.status, "SOCKS5 carries an IPv6 destination address")
+    t.contains(r, "peer.addr=::1", "which is reached over IPv6")
+
+    # --- which family a service will use --------------------------------------
+    # -46 and -64 both reach either family; -4 and -6 are each restricted to
+    # one; and nothing said means -46.
+    v4origin = t.free_port()
+    flags = {"nothing said": "", "-4": "-4", "-6": "-6", "-46": "-46", "-64": "-64"}
+    family_ports = {name: t.free_port() for name in flags}
+    sections = [f"""
+        flush
+        auth iponly
+        allow *
+        proxy -p{family_ports[name]} {flag}""" for name, flag in flags.items()]
+    t.start("ipv6_family", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{v4origin}
+        {"".join(sections)}
+    """, ports=[v4origin] + list(family_ports.values()))
+
+    expected = {
+        "nothing said": (200, None),      # -4 is the default
+        "-4": (200, None),
+        "-6": (None, 200),
+        "-46": (200, 200),
+        "-64": (200, 200),
+    }
+    for name, port in family_ports.items():
+        want4, want6 = expected[name]
+        got4 = t.http(f"http://127.0.0.1:{v4origin}/echo", proxy=f"127.0.0.1:{port}").status
+        got6 = t.http(url, proxy=f"127.0.0.1:{port}").status
+        if want4 == 200:
+            t.eq(200, got4, f"{name}: an IPv4 destination is reached")
+        else:
+            t.ne(200, got4, f"{name}: an IPv4 destination is refused")
+        if want6 == 200:
+            t.eq(200, got6, f"{name}: an IPv6 destination is reached")
+        else:
+            t.ne(200, got6, f"{name}: an IPv6 destination is refused")
+
+    # --- a name that resolves to an IPv6 address ------------------------------
+    # The two caches are separate, and the record is only kept in the one
+    # that matches the address family.
+    # separate processes: the caches belong to the process, not the service,
+    # so one section configuring nscache6 would answer for the other too
+    with_cache6 = t.free_port()
+    without = t.free_port()
+    t.start("ipv6_names", f"""
+        log
+        flush
+        nserver 127.0.0.1
+        nscache6 1024
+        nsrecord v6.test ::1
+        auth iponly
+        allow *
+        proxy -p{with_cache6} -6
+    """, ports=[with_cache6])
+    t.start("ipv6_names_nocache", f"""
+        log
+        flush
+        nserver 127.0.0.1
+        nsrecord v6.test ::1
+        auth iponly
+        allow *
+        proxy -p{without} -6
+    """, ports=[without])
+
+    t.eq(200, t.http(f"http://v6.test:{origin}/echo",
+                     proxy=f"127.0.0.1:{with_cache6}").status,
+         "a name kept in nscache6 resolves to its IPv6 address")
+    t.ne(200, t.http(f"http://v6.test:{origin}/echo",
+                     proxy=f"127.0.0.1:{without}").status,
+         "the same record without nscache6 is not there to be found")
+
+    # --- an address has more than one spelling --------------------------------
+    # Denying the IPv4 form does not deny the same host asked for as an
+    # IPv4-mapped address, nor the IPv6 loopback, which is why the security
+    # notes say to deny all of them. Both halves are checked so a change in
+    # either direction is noticed.
+    partial = t.free_port()
+    complete = t.free_port()
+    t.start("ipv6_deny", f"""
+        log
+        flush
+        auth iponly
+        deny * * 127.0.0.1
+        allow *
+        proxy -p{partial} -46
+
+        flush
+        auth iponly
+        deny * * 127.0.0.1
+        deny * * ::1
+        deny * * ::ffff:127.0.0.1
+        allow *
+        proxy -p{complete} -46
+    """, ports=[partial, complete])
+
+    v4url = f"http://127.0.0.1:{v4origin}/echo"
+    mapped = f"http://[::ffff:127.0.0.1]:{v4origin}/echo"
+
+    t.ne(200, t.http(v4url, proxy=f"127.0.0.1:{partial}").status,
+         "denying 127.0.0.1 denies the address as written")
+
+    # Whether the mapped form reaches the same host is up to the stack: it
+    # does where a mapped address is routed to IPv4, and that is the hazard
+    # the security notes describe. Where it does not, there is nothing to
+    # assert, but the rule that names every spelling still has to hold.
+    if t.http(mapped, proxy=f"127.0.0.1:{partial}").status == 200:
+        t.ok("the same host asked for as ::ffff:127.0.0.1 is still reached")
+    else:
+        t.skip("the mapped form (this stack does not route it to IPv4)")
+
+    t.eq(200, t.http(url, proxy=f"127.0.0.1:{partial}").status,
+         "and ::1 is reached, which the rule never mentioned")
+
+    t.ne(200, t.http(v4url, proxy=f"127.0.0.1:{complete}").status,
+         "naming every spelling denies the plain address")
+    t.ne(200, t.http(mapped, proxy=f"127.0.0.1:{complete}").status,
+         "and the mapped one, whether or not it would have been reachable")
+    t.ne(200, t.http(url, proxy=f"127.0.0.1:{complete}").status,
+         "and the IPv6 loopback")
+
+    # --- rules that name addresses ------------------------------------------
+    allowed = t.free_port()
+    refused = t.free_port()
+    t.start("ipv6_rules", f"""
+        log
+        flush
+        auth iponly
+        allow * ::1
+        proxy -p{allowed} -i::1 -6
+
+        flush
+        auth iponly
+        allow * 127.0.0.1
+        proxy -p{refused} -i::1 -6
+    """, ports=[("::1", allowed), ("::1", refused)])
+
+    t.eq(200, t.http(url, proxy=f"[::1]:{allowed}").status,
+         "a rule naming ::1 admits an IPv6 client")
+    t.ne(200, t.http(url, proxy=f"[::1]:{refused}").status,
+         "a rule naming only an IPv4 address does not")

tests/cases/parent_ports.py

@@ -0,0 +1,183 @@
+"""extport and intport: binding the local side of a connection to a range.
+
+Access rules accumulate until "flush": without it an earlier "allow *"
+matches first and the rule carrying the range is never reached.
+"""
+
+from harness import int_field
+
+
+def _windows():
+    """Pick port windows this platform will actually honour.
+
+    On Linux the kernel applies IP_LOCAL_PORT_RANGE only within
+    net.ipv4.ip_local_port_range; a window outside it is ignored and an
+    ordinary ephemeral port is used, so a fixed low window would be
+    measuring the kernel's own choice rather than the setting.
+
+    Everywhere else the range is honoured by binding a port out of it at
+    random, ten times before giving up and letting the system choose. A port
+    which carried a connection a moment ago cannot be bound again while it
+    waits out its close - four minutes of it on Windows - so the window has
+    to be wide enough that ten tries do not all land on one. The window the
+    kernel picks from on Linux needs no such room, since it skips them.
+    """
+    try:
+        with open("/proc/sys/net/ipv4/ip_local_port_range") as fp:
+            low, high = (int(part) for part in fp.read().split()[:2])
+    except (OSError, ValueError):
+        return (21400, 21899), (22000, 22499)
+    base = low + 1000 if low + 1150 <= high else low
+    return (base, base + 49), (base + 100, base + 149)
+
+
+(LOW, HIGH), (ILOW, IHIGH) = _windows()
+
+# Privileged ports: the kernel ignores such a range on Linux, since it is
+# outside net.ipv4.ip_local_port_range, and binding them fails outright
+# without privileges. Either way nothing in the range can be taken, which
+# is the case the fallback exists for.
+UNHONOURED = (1, 99)
+
+
+def run(t):
+    srv = t.free_port()
+    prx = t.free_port()
+    sks = t.free_port()
+    meth = t.free_port()
+
+    t.start("parent_ports", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{srv}
+
+        # every outgoing connection binds inside the range
+        flush
+        auth iponly
+        allow *
+        parent 1000 extport 0.0.0.0 {LOW}-{HIGH}
+        proxy -p{prx}
+
+        # the range applies only to CONNECT: an HTTP proxy CONNECT is
+        # HTTP_CONNECT, the bare CONNECT operation being the SOCKS one
+        flush
+        auth iponly
+        allow * * * * HTTP_CONNECT
+        parent 1000 extport 0.0.0.0 {LOW}-{HIGH}
+        allow *
+        proxy -p{meth}
+
+        # socks, for the same setting on another service
+        flush
+        auth iponly
+        allow *
+        parent 1000 extport 0.0.0.0 {LOW}-{HIGH}
+        socks -p{sks}
+    """, ports=[srv, prx, sks, meth])
+
+    origin = f"http://127.0.0.1:{srv}"
+    proxy = f"127.0.0.1:{prx}"
+
+    # --- extport ---------------------------------------------------------
+    # the origin reports the source port it actually saw
+    port = int_field(t.http(origin + "/echo", proxy=proxy), "peer.port")
+    t.in_range(port, LOW, HIGH, "the outgoing connection binds inside the range")
+
+    seen = []
+    for _ in range(5):
+        seen.append(int_field(t.http(origin + "/echo", proxy=proxy), "peer.port"))
+    outside = [p for p in seen if p is None or not LOW <= p <= HIGH]
+    t.eq([], outside, "repeated connections all bind inside the range")
+
+    port = int_field(t.socks_http(f"127.0.0.1:{sks}", origin + "/echo"),
+                     "peer.port")
+    t.in_range(port, LOW, HIGH,
+               "socks binds the outgoing connection inside the range")
+
+    # --- per-method scoping ------------------------------------------------
+    method_proxy = f"127.0.0.1:{meth}"
+    port = int_field(t.http(origin + "/echo", proxy=method_proxy, tunnel=True),
+                     "peer.port")
+    t.in_range(port, LOW, HIGH, "CONNECT uses the range its rule sets")
+
+    # a plain GET matches the later rule, which sets no range
+    port = int_field(t.http(origin + "/echo", proxy=method_proxy), "peer.port")
+    t.not_in_range(port, LOW, HIGH,
+                   "a method outside that rule keeps an ephemeral port")
+
+    # --- a range the platform cannot honour --------------------------------
+    # Linux ignores a range outside net.ipv4.ip_local_port_range, and any
+    # platform can run out of free ports in a range. Either way the
+    # connection falls back to an ephemeral port instead of failing.
+    unhonoured = t.free_port()
+    t.start("parent_unhonoured", f"""
+        log
+        flush
+        auth iponly
+        allow *
+        parent 1000 extport 0.0.0.0 {UNHONOURED[0]}-{UNHONOURED[1]}
+        proxy -p{unhonoured}
+    """, ports=[unhonoured])
+    r = t.http(origin + "/echo", proxy=f"127.0.0.1:{unhonoured}")
+    t.eq(200, r.status, "a range the platform cannot honour still connects")
+    t.ne(None, int_field(r, "peer.port"),
+         "the connection still has a source port")
+
+    # --- intport -----------------------------------------------------------
+    # A UDP association allocates its socket after the destination is known,
+    # so the range has to be applied when the rule matches rather than when
+    # the chain is walked.
+    udps = t.free_port()
+    t.start("parent_intport", f"""
+        log
+        flush
+        auth iponly
+        allow *
+        parent 1000 intport 0.0.0.0 {ILOW}-{IHIGH}
+        socks -p{udps}
+    """, ports=[udps])
+    t.in_range(t.socks_udp_associate(udps), ILOW, IHIGH,
+               "UDP ASSOCIATE binds inside the internal range")
+
+    # and the association still carries traffic while bound in the range
+    echo = t.udp_echo()
+    reply, bound = t.socks_udp(f"127.0.0.1:{udps}", "127.0.0.1", echo, b"data")
+    t.eq(b"echo:data", reply, "a range-bound association still relays")
+    t.in_range(bound, ILOW, IHIGH, "and the port it relays from is in the range")
+
+    # without a range the association still works, on an ephemeral port
+    udps2 = t.free_port()
+    t.start("parent_intport_none", f"""
+        log
+        flush
+        auth iponly
+        allow *
+        socks -p{udps2}
+    """, ports=[udps2])
+    t.ne(None, t.socks_udp_associate(udps2),
+         "UDP ASSOCIATE works without a range")
+
+    # --- configuration errors ------------------------------------------------
+    dead = t.free_port()
+    t.contains(t.run_config("badaddr", f"""
+        log
+        allow *
+        parent 1000 extport 127.0.0.1 {LOW}-{HIGH}
+        proxy -p{dead}
+    """), "requires 0.0.0.0", "a non-zero address with extport is rejected")
+
+    t.contains(t.run_config("badrange", f"""
+        log
+        allow *
+        parent 1000 extport 0.0.0.0 notaport
+        proxy -p{dead}
+    """), "bad port range", "a malformed range is rejected")
+
+    t.contains(t.run_config("badorder", f"""
+        log
+        allow *
+        parent 1000 extport 0.0.0.0 {HIGH}-{LOW}
+        proxy -p{dead}
+    """), "bad port range", "a reversed range is rejected")

tests/cases/pcre.py

@@ -0,0 +1,235 @@
+"""PCRE filtering: matching, rewriting, options and rule scope.
+
+A request rewrite is applied to the buffer the server is sent, so it works
+on a direct connection as well as through a parent. The destination was
+chosen, and the access rules applied to it, before the filter ran, so a
+rewrite that moves the request to another host or changes the method is
+ignored rather than acted on.
+"""
+
+
+def _has_pcre(t):
+    """Whether this build accepts the pcre commands at all.
+
+    The last line is nonsense on purpose: it makes 3proxy report and exit
+    instead of waiting, and what it says about the line above is the answer.
+    """
+    out = t.run_config("pcre_probe",
+                       'log\npcre request deny "x"\nnot_a_command\n')
+    return "'pcre'" not in out
+
+
+def run(t):
+    if not _has_pcre(t):
+        t.skip("PCRE (this build has no PCRE support)")
+        return
+
+    origin = t.free_port()
+    t.start("pcre_origin", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http echo * /secret**
+        http data * /data
+        httpsrv -p{origin}
+    """, ports=[origin])
+
+    url = f"http://127.0.0.1:{origin}"
+
+    def proxy_with(name, *rules):
+        port = t.free_port()
+        t.start(name, "\n".join([
+            "log", "flush", "auth iponly", "allow *", *rules, f"proxy -p{port}"]),
+            ports=[port])
+        return f"127.0.0.1:{port}"
+
+    # --- matching and denial ---------------------------------------------
+    p = proxy_with("deny", 'pcre request deny "/secret"')
+    t.eq(200, t.http(url + "/echo", proxy=p).status, "an unmatched request passes")
+    t.ne(200, t.http(url + "/secret/page", proxy=p).status, "a matched request is denied")
+
+    # the rules are ordered, and the first decision wins
+    p = proxy_with("allow_first", 'pcre request allow "/echo"', 'pcre request deny "/"')
+    t.eq(200, t.http(url + "/echo", proxy=p).status, "allow short-circuits a later deny")
+    p = proxy_with("deny_first", 'pcre request deny "/"', 'pcre request allow "/echo"')
+    t.ne(200, t.http(url + "/echo", proxy=p).status, "deny short-circuits a later allow")
+
+    # --- what the pattern is matched against ------------------------------
+    p = proxy_with("cliheader", 'pcre cliheader deny "BadBot"')
+    t.eq(200, t.http(url + "/echo", proxy=p).status, "a header rule ignores other requests")
+    t.ne(200, t.http(url + "/echo", proxy=p, headers={"User-Agent": "BadBot/1.0"}).status,
+         "a client header can be matched")
+
+    # --- options ------------------------------------------------------------
+    p = proxy_with("caseless", "pcre_options PCRE2_CASELESS",
+                   'pcre request deny "/SECRET"')
+    t.ne(200, t.http(url + "/secret/page", proxy=p).status,
+         "PCRE2_CASELESS makes the match case-insensitive")
+    p = proxy_with("cased", 'pcre request deny "/SECRET"')
+    t.eq(200, t.http(url + "/secret/page", proxy=p).status,
+         "without it the match is case-sensitive")
+
+    # --- the access rule a pcre rule carries --------------------------------
+    p = proxy_with("ace_here", f'pcre request deny "/echo" * * * {origin}')
+    t.ne(200, t.http(url + "/echo", proxy=p).status,
+         "a rule applies where its access rule matches")
+    p = proxy_with("ace_elsewhere", 'pcre request deny "/echo" * * * 1')
+    t.eq(200, t.http(url + "/echo", proxy=p).status,
+         "and not where it does not")
+
+    # pcre_extend appends another access rule to the one just defined
+    p = proxy_with("extend", 'pcre request deny "/echo" * * * 1',
+                   f"pcre_extend * * * {origin}")
+    t.ne(200, t.http(url + "/echo", proxy=p).status,
+         "pcre_extend widens the rule to another destination")
+    p = proxy_with("extend_other", 'pcre request deny "/echo" * * * 1',
+                   "pcre_extend * * * 2")
+    t.eq(200, t.http(url + "/echo", proxy=p).status,
+         "an extension that matches nothing changes nothing")
+
+    # --- a regular expression where a host name is expected -----------------
+    # The same prefix works in an access rule and in an http rule, so one
+    # kind of expression is understood wherever a name can be written.
+    named = t.free_port()
+    t.start("pcre_named", f"""
+        log
+        flush
+        nserver 127.0.0.1
+        nscache 1024
+        nsrecord host1.test 127.0.0.1
+        nsrecord other.test 127.0.0.1
+        auth iponly
+        allow * * "pcre:^host[0-9]+\\.test$"
+        proxy -p{named}
+    """, ports=[named])
+
+    t.eq(200, t.http(f"http://host1.test:{origin}/echo", proxy=f"127.0.0.1:{named}").status,
+         "a destination matching the expression is allowed")
+    t.ne(200, t.http(f"http://other.test:{origin}/echo", proxy=f"127.0.0.1:{named}").status,
+         "one that does not match is refused")
+
+    # --- rewriting the reply ------------------------------------------------
+    p = proxy_with("rewrite_srv",
+                   'pcre_rewrite srvheader dunno "text/plain" "text/rewritten"',
+                   'pcre_rewrite srvdata dunno "peer.addr" "PEER.ADDR"')
+    r = t.http(url + "/echo", proxy=p)
+    t.eq(200, r.status, "a rewritten reply still arrives")
+    t.eq("text/rewritten", r.header("Content-Type"), "a reply header can be rewritten")
+    t.contains(r, "PEER.ADDR", "reply data can be rewritten")
+    t.not_contains(r, "peer.addr", "the original text is gone")
+
+    # --- rewriting the request ------------------------------------------------
+    p = proxy_with("rewrite_req", 'pcre_rewrite request dunno "/echo/old" "/echo/new"')
+    r = t.http(url + "/echo/old", proxy=p)
+    t.eq(200, r.status, "a rewritten request still arrives")
+    t.contains(r, "path=/echo/new", "the origin sees the rewritten path")
+
+    # the replacement may be longer or shorter than what it replaces
+    p = proxy_with("rewrite_long", 'pcre_rewrite request dunno "/echo/x" "/echo/deeper/still"')
+    t.contains(t.http(url + "/echo/x", proxy=p), "path=/echo/deeper/still",
+               "a longer replacement is spliced in")
+    p = proxy_with("rewrite_short", 'pcre_rewrite request dunno "/echo/aaaaaaaaaa" "/echo/b"')
+    t.contains(t.http(url + "/echo/aaaaaaaaaa", proxy=p), "path=/echo/b",
+               "a shorter replacement is spliced in")
+
+    p = proxy_with("rewrite_query", 'pcre_rewrite request dunno "token=old" "token=new"')
+    t.contains(t.http(url + "/echo?token=old", proxy=p), "query=token=new",
+               "the query can be rewritten")
+
+    p = proxy_with("rewrite_none", 'pcre_rewrite request dunno "/nothing" "/else"')
+    t.contains(t.http(url + "/echo/keep", proxy=p), "path=/echo/keep",
+               "a request that does not match is left alone")
+
+    # what follows the request line has to survive the splice
+    p = proxy_with("rewrite_post", 'pcre_rewrite request dunno "/echo/old" "/echo/new"')
+    r = t.http(url + "/echo/old", proxy=p, method="POST", body="hello",
+               headers={"Content-Type": "text/plain"})
+    t.contains(r, "path=/echo/new", "a POST is rewritten too")
+    t.contains(r, "content.length=5", "its body is still described correctly")
+
+    conn = t.connection("127.0.0.1", origin, proxy=p)
+    try:
+        first = t.http(url + "/echo/old", proxy=p, conn=conn)
+        second = t.http(url + "/echo/old", proxy=p, conn=conn)
+        t.contains(first, "path=/echo/new", "the first of two on a connection is rewritten")
+        t.contains(second, "path=/echo/new", "and so is the second")
+    finally:
+        conn.close()
+
+    # --- rewrites that would change where the request goes --------------------
+    elsewhere = t.free_port()
+    t.start("pcre_elsewhere", f"""
+        log
+        flush
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{elsewhere}
+    """, ports=[elsewhere])
+
+    p = proxy_with("rewrite_host",
+                   f'pcre_rewrite request dunno "127.0.0.1:{origin}" "127.0.0.1:{elsewhere}"')
+    r = t.http(url + "/echo", proxy=p)
+    t.eq(200, r.status, "a rewrite naming another host still answers")
+    t.contains(r, f"host=127.0.0.1:{origin}",
+               "but the request goes where the access rules allowed")
+
+    p = proxy_with("rewrite_method", 'pcre_rewrite request dunno "^GET" "HEAD"')
+    t.contains(t.http(url + "/echo", proxy=p), "method=GET",
+               "a rewrite of the method is ignored")
+
+    # --- and the same rewrite through an HTTP parent --------------------------
+    parent = t.free_port()
+    t.start("pcre_parent", f"""
+        log
+        flush
+        auth iponly
+        allow *
+        proxy -p{parent}
+    """, ports=[parent])
+    p = proxy_with("rewrite_parent", 'pcre_rewrite request dunno "/echo/old" "/echo/new"',
+                   f"parent 1000 http 127.0.0.1 {parent}")
+    r = t.http(url + "/echo/old", proxy=p)
+    t.eq(200, r.status, "a rewritten request through a parent arrives")
+    t.contains(r, "path=/echo/new", "the origin sees the rewritten path through a parent")
+
+    # --- a rewrite which grows the headers ----------------------------------
+    # GHSA-h845-prxq-ww3q: a rewrite that doubles the client headers used to
+    # leave a buffer holding exactly what it produced, and the Content-Length
+    # the data filter regenerates was then written past the end of it.
+    # The origin here reads whatever it is sent and answers the same way every
+    # time: what is being tested is the proxy in the middle, not what a server
+    # is willing to accept in one request.
+    grown = t.free_port()
+    stop = t.raw_server(grown, b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok",
+                        drain=True)
+    try:
+        p = proxy_with("rewrite_grow",
+                       'pcre_rewrite cliheader dunno "(?s).*" "$0$0"',
+                       'pcre clidata dunno *')
+        big = "".join("X-%d: %s\r\n" % (i, chr(65 + i) * 20000) for i in range(5))
+        reply = t.raw_proxy_request(p, f"http://127.0.0.1:{grown}/x",
+                                    extra=big, body="z")
+        t.contains(reply, "200", "a doubled header block with a body is answered")
+        t.contains(t.raw_proxy_request(p, f"http://127.0.0.1:{grown}/x"), "200",
+                   "and the proxy is still there afterwards")
+    finally:
+        stop()
+
+    # A reference to a group the pattern does not have is dropped, and dropped
+    # by both the pass which measures the result and the pass which writes it.
+    p = proxy_with("rewrite_nogroup",
+                   'pcre_rewrite cliheader dunno "(?s)Host:" "$9$9$9$9$9$9$9$9"')
+    r = t.http(url + "/echo", proxy=p, headers={"X-Pad": "P" * 2000})
+    t.eq(200, r.status, "a reference to a group which did not match is left out")
+    t.contains(t.http(url + "/echo", proxy=p), "path=/echo",
+               "and that proxy is still there too")
+
+    # an optional group which took part on one request and not on the next
+    p = proxy_with("rewrite_optgroup",
+                   'pcre_rewrite cliheader dunno "X-Mark: (a)?(b)" "[$1][$2]"')
+    t.eq(200, t.http(url + "/echo", proxy=p, headers={"X-Mark": "ab"}).status,
+         "a group which matched is put in")
+    t.eq(200, t.http(url + "/echo", proxy=p, headers={"X-Mark": "b"}).status,
+         "and one which did not is left out")

tests/cases/portmap.py

@@ -0,0 +1,64 @@
+"""The port mappers: tcppm forwards a TCP port, udppm a UDP one."""
+
+
+def run(t):
+    # --- tcppm ---------------------------------------------------------
+    origin = t.free_port()
+    mapped = t.free_port()
+    refused = t.free_port()
+
+    t.start("portmap_tcp", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http data * /data
+        httpsrv -p{origin}
+
+        flush
+        auth iponly
+        allow *
+        tcppm {mapped} 127.0.0.1 {origin}
+
+        flush
+        auth iponly
+        deny *
+        tcppm {refused} 127.0.0.1 {origin}
+    """, ports=[origin, mapped, refused])
+
+    r = t.http(f"http://127.0.0.1:{mapped}/echo")
+    t.eq(200, r.status, "a mapped TCP port reaches the target")
+    t.contains(r, "path=/echo", "the target sees the request")
+    t.contains(r, "peer.addr=127.0.0.1", "the mapper makes the connection")
+
+    t.eq(20000, t.http(f"http://127.0.0.1:{mapped}/data?size=20000").length,
+         "a body passes through the mapper")
+
+    # the mapper is a service like any other, so its rules apply
+    r = t.http(f"http://127.0.0.1:{refused}/echo")
+    t.ne(200, r.status, "a mapper whose rules deny the client answers nothing")
+
+    t.stop_all()
+
+    # --- udppm ---------------------------------------------------------
+    # something has to be listening for the mapped datagrams to go anywhere
+    echo = t.udp_echo()
+    mapped = t.free_port()
+    t.start("portmap_udp", f"""
+        log
+        flush
+        auth iponly
+        allow *
+        udppm {mapped} 127.0.0.1 {echo}
+    """)
+    # a UDP service has no listening socket to wait for, so ask until it
+    # answers rather than racing it
+    t.wait_udp(mapped)
+    t.eq(b"echo:hello", t.udp_exchange(mapped, b"hello"),
+         "a datagram is relayed and the reply comes back")
+    t.eq(b"echo:second", t.udp_exchange(mapped, b"second"),
+         "a second datagram uses the mapping again")
+
+    big = b"x" * 2000
+    t.eq(b"echo:" + big, t.udp_exchange(mapped, big),
+         "a larger datagram survives the round trip")

tests/cases/proxy_http.py

@@ -0,0 +1,108 @@
+"""The HTTP proxy, with the built-in server as the origin.
+
+Access rules accumulate until "flush", so each service section here starts
+from a clean list.
+"""
+
+
+def run(t):
+    srv = t.free_port()
+    other = t.free_port()
+    prx = t.free_port()
+    deny = t.free_port()
+    auth = t.free_port()
+
+    t.start("proxy_http", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http data * /data
+        httpsrv -p{srv}
+
+        # a second origin, used as a destination the rules must keep out
+        flush
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{other}
+
+        # an open proxy
+        flush
+        auth iponly
+        allow *
+        proxy -p{prx}
+
+        # only the first origin is reachable
+        flush
+        auth iponly
+        allow * * * {srv}
+        proxy -p{deny}
+
+        # credentials required
+        flush
+        auth strong
+        users alice:CL:secret
+        allow alice
+        proxy -p{auth}
+    """, ports=[srv, other, prx, deny, auth])
+
+    origin = f"http://127.0.0.1:{srv}"
+    second = f"http://127.0.0.1:{other}"
+    open_proxy = f"127.0.0.1:{prx}"
+
+    # --- plain proxying -------------------------------------------------
+    r = t.http(origin + "/echo", proxy=open_proxy)
+    t.eq(200, r.status, "a GET through the proxy")
+    t.contains(r, "path=/echo", "the origin sees the proxied path")
+    t.contains(r, "peer.addr=127.0.0.1", "the origin sees the proxy as the peer")
+
+    t.eq(10000, t.http(origin + "/data?size=10000", proxy=open_proxy).length,
+         "a sized body survives proxying")
+    t.eq(10000,
+         t.http(origin + "/data?size=10000&chunked=1", proxy=open_proxy).length,
+         "a chunked body survives proxying")
+    t.eq(503, t.http(origin + "/data?size=5&status=503", proxy=open_proxy).status,
+         "the origin status is relayed")
+
+    # --- POST and keep-alive ---------------------------------------------
+    r = t.http(origin + "/echo", proxy=open_proxy, method="POST", body="x=1")
+    t.contains(r, "method=POST", "POST is proxied")
+
+    # two requests on one connection, which may carry different methods
+    conn = t.connection("127.0.0.1", srv, proxy=open_proxy)
+    try:
+        first = t.http(origin + "/echo", proxy=open_proxy, method="POST",
+                       body="x=1", conn=conn)
+        second_reply = t.http(origin + "/echo", proxy=open_proxy, conn=conn)
+        t.eq((200, 200), (first.status, second_reply.status),
+             "two requests on one proxied connection")
+    finally:
+        conn.close()
+
+    # --- CONNECT ----------------------------------------------------------
+    t.eq(200, t.http(origin + "/echo", proxy=open_proxy, tunnel=True).status,
+         "CONNECT tunnels to the origin")
+
+    # --- access control ----------------------------------------------------
+    denying = f"127.0.0.1:{deny}"
+    t.eq(200, t.http(origin + "/echo", proxy=denying).status,
+         "the permitted destination is reachable")
+    t.ne(200, t.http(second + "/echo", proxy=denying).status,
+         "a destination outside the rules is refused")
+    t.ne(200, t.http(second + "/echo", proxy=denying, tunnel=True).status,
+         "CONNECT to a destination outside the rules is refused")
+    # the open proxy still reaches it, so the refusal came from the rules
+    t.eq(200, t.http(second + "/echo", proxy=open_proxy).status,
+         "the same destination is reachable through the open proxy")
+
+    # --- proxy authentication -----------------------------------------------
+    needs_auth = f"127.0.0.1:{auth}"
+    t.eq(407, t.http(origin + "/echo", proxy=needs_auth).status,
+         "the proxy demands credentials")
+    t.eq(200, t.http(origin + "/echo", proxy=needs_auth,
+                     proxy_auth=("alice", "secret")).status,
+         "valid proxy credentials pass")
+    t.eq(407, t.http(origin + "/echo", proxy=needs_auth,
+                     proxy_auth=("alice", "wrong")).status,
+         "wrong proxy credentials are refused")

tests/cases/socks.py

@@ -0,0 +1,73 @@
+"""The SOCKS proxy, reaching the built-in server."""
+
+
+def run(t):
+    srv = t.free_port()
+    sks = t.free_port()
+    sauth = t.free_port()
+
+    t.start("socks", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http data * /data
+        httpsrv -p{srv}
+
+        flush
+        auth iponly
+        allow *
+        socks -p{sks}
+
+        flush
+        auth strong
+        users alice:CL:secret
+        allow alice
+        socks -p{sauth}
+    """, ports=[srv, sks, sauth])
+
+    origin = f"http://127.0.0.1:{srv}"
+    plain = f"127.0.0.1:{sks}"
+    guarded = f"127.0.0.1:{sauth}"
+
+    # --- SOCKS5 ---------------------------------------------------------
+    r = t.socks_http(plain, origin + "/echo")
+    t.eq(200, r.status, "a SOCKS5 connection")
+    t.contains(r, "path=/echo", "the origin sees the request made over SOCKS5")
+    t.eq(10000, t.socks_http(plain, origin + "/data?size=10000").length,
+         "a body survives SOCKS5")
+
+    # resolution delegated to the proxy
+    t.eq(200, t.socks_http(plain, f"http://localhost:{srv}/echo",
+                           remote_dns=True).status,
+         "SOCKS5 resolves the hostname itself")
+
+    # --- SOCKS4 -----------------------------------------------------------
+    t.eq(200, t.socks_http(plain, origin + "/echo", socks4=True).status,
+         "a SOCKS4 connection")
+
+    # --- the UDP association, and what goes through it ---------------------
+    # Binding the association is one thing; carrying a datagram is what it
+    # is for.
+    echo = t.udp_echo()
+    reply, bound = t.socks_udp(plain, "127.0.0.1", echo, b"ping")
+    t.eq(b"echo:ping", reply, "a datagram is relayed and answered")
+    t.ne(None, bound, "the association reports the port to send to")
+
+    reply, _ = t.socks_udp(plain, "127.0.0.1", echo, b"x" * 2000)
+    t.eq(b"echo:" + b"x" * 2000, reply, "a larger datagram survives the relay")
+
+    # each association gets its own socket
+    _, first = t.socks_udp(plain, "127.0.0.1", echo, b"one")
+    _, second = t.socks_udp(plain, "127.0.0.1", echo, b"two")
+    t.ne(first, second, "a second association binds its own port")
+
+    # --- authentication ----------------------------------------------------
+    t.eq(200, t.socks_http(guarded, origin + "/echo",
+                           auth=("alice", "secret")).status,
+         "valid SOCKS5 credentials pass")
+    t.ne(None, t.socks_connect(guarded, "127.0.0.1", srv,
+                               auth=("alice", "wrong")),
+         "wrong SOCKS5 credentials are refused")
+    t.ne(None, t.socks_connect(guarded, "127.0.0.1", srv),
+         "SOCKS5 without credentials is refused")

tests/cases/ssl.py

@@ -0,0 +1,203 @@
+"""TLS: a proxy wrapped in TLS, one chained to another over TLS, and MITM.
+
+The key material is generated for the run, so nothing long-lived lives in
+the tree. Cases skip when the build has no TLS or openssl is missing.
+"""
+
+
+def _no_tls(t, server):
+    """True when the binary rejected the TLS commands in a configuration."""
+    return "Unknown command" in server
+
+
+def run(t):
+    certs = t.certs()
+    if not certs:
+        t.skip("TLS (openssl is not available to generate certificates)")
+        return
+
+    # The key material has to be sound before anything is asked of the
+    # proxy, or every failure below points at the wrong thing.
+    if not certs.verified:
+        t.fail("the generated certificate chain verifies", "OK",
+               certs.verify_output or "openssl verify failed")
+        return
+    t.ok("the generated certificate chain verifies")
+
+    # --- a proxy wrapped in TLS (ssl_serv) ----------------------------
+    origin = t.free_port()
+    tlsproxy = t.free_port()
+
+    server = t.start("ssl_serv", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{origin}
+
+        flush
+        ssl_server_cert {certs.server}
+        ssl_server_key {certs.server_key}
+        ssl_serv
+        auth iponly
+        allow *
+        proxy -p{tlsproxy}
+    """, ports=[origin, tlsproxy])
+
+    if _no_tls(t, server.output()):
+        t.skip("TLS (this build has no SSL support)")
+        return
+
+    url = f"http://127.0.0.1:{origin}/echo"
+    r = t.tls_proxy_http(f"127.0.0.1:{tlsproxy}", url, ca=certs.ca)
+    t.eq(200, r.status, "a proxy wrapped in TLS serves a request")
+    t.contains(r, "path=/echo", "the origin sees the request made over TLS")
+
+    # a client holding a different CA must not accept the certificate
+    bad = t.tls_proxy_http(f"127.0.0.1:{tlsproxy}", url, ca=certs.other)
+    t.ne(200, bad.status, "a client that does not trust the CA is refused")
+    t.contains(bad, "CERTIFICATE_VERIFY_FAILED",
+               "the refusal is a certificate verification failure")
+
+    # and plain HTTP must not get through a TLS listener
+    t.ne(200, t.http(url, proxy=f"127.0.0.1:{tlsproxy}").status,
+         "a plain request to the TLS port is refused")
+
+    t.stop_all()
+
+    # --- a TLS client chained to a TLS server -------------------------
+    # The ssl_serv proxy is the parent; the ssl_cli proxy reaches it over
+    # TLS and verifies it against the CA.
+    origin = t.free_port()
+    parent = t.free_port()
+    client = t.free_port()
+
+    server = t.start("ssl_chain", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        http data * /data
+        httpsrv -p{origin}
+
+        flush
+        ssl_server_cert {certs.server}
+        ssl_server_key {certs.server_key}
+        ssl_serv
+        auth iponly
+        allow *
+        proxy -p{parent}
+
+        flush
+        ssl_noserv
+        auth iponly
+        allow *
+        parent 1000 connects 127.0.0.1 {parent}
+        ssl_client_mode 3
+        ssl_client_ca_file {certs.ca}
+        ssl_client_verify
+        ssl_cli
+        proxy -p{client}
+    """, ports=[origin, parent, client])
+
+    through = f"127.0.0.1:{client}"
+    r = t.http(f"http://127.0.0.1:{origin}/echo", proxy=through)
+    t.eq(200, r.status, "a request through the TLS chain arrives")
+    t.contains(r, "path=/echo", "the origin sees the chained request")
+
+    # the origin is reached by the parent, not by the client proxy
+    t.contains(r, "peer.addr=127.0.0.1", "the parent makes the final connection")
+
+    t.eq(10000, t.http(f"http://127.0.0.1:{origin}/data?size=10000",
+                       proxy=through).length,
+         "a body survives the TLS chain")
+    t.eq(10000, t.http(f"http://127.0.0.1:{origin}/data?size=10000&chunked=1",
+                       proxy=through).length,
+         "a chunked body survives the TLS chain")
+
+    t.stop_all()
+
+    # --- MITM ----------------------------------------------------------
+    # The origin runs in its own process so the proxy log holds only what
+    # the proxy saw, and an https origin gives the tunnel something real to
+    # carry.
+    origin = t.free_port()
+    t.start("ssl_mitm_origin", f"""
+        log
+        ssl_server_cert {certs.server}
+        ssl_server_key {certs.server_key}
+        ssl_serv
+        auth iponly
+        allow *
+        http echo * /secret**
+        httpsrv -p{origin}
+    """, ports=[origin])
+
+    mitm = t.free_port()
+    plain = t.free_port()
+    proxies = t.start("ssl_mitm", f"""
+        log
+        nserver 127.0.0.1
+        nscache 1024
+        nsrecord intercepted.test 127.0.0.1
+        ssl_server_ca_file {certs.ca}
+        ssl_server_ca_key {certs.ca_key}
+        ssl_certcache {certs.cache}
+        ssl_client_ca_file {certs.ca}
+        ssl_mitm
+        auth iponly
+        allow *
+        proxy -p{mitm}
+
+        flush
+        ssl_nomitm
+        ssl_nocli
+        auth iponly
+        allow *
+        proxy -p{plain}
+    """, ports=[mitm, plain])
+
+    # A name the proxy resolves itself through nsrecord, so the request
+    # carries a hostname the way a real one would, without depending on
+    # what the machine running the tests puts in its hosts file.
+    target = f"https://intercepted.test:{origin}/secret/page"
+
+    # The client trusts our CA, which is what signs the spoofed certificate,
+    # and checks it the way a current client does. The certificate names the
+    # upstream host rather than the one asked for, so the chain is verified
+    # but the name is not.
+    r = t.https(target, proxy=f"127.0.0.1:{mitm}", ca=certs.ca,
+                verify_name=False)
+    if r.status is None and "Authority Key Identifier" in (r.error or ""):
+        # A build against wolfSSL cannot generate certificate extensions,
+        # so the identifiers a strict verifier looks for are absent there.
+        t.skip("strict verification of an intercepted certificate "
+               "(this build cannot generate the key identifiers)")
+        r = t.https(target, proxy=f"127.0.0.1:{mitm}", ca=certs.ca,
+                    strict=False, verify_name=False)
+    else:
+        t.ok("the intercepted certificate satisfies a strict verifier")
+    t.eq(200, r.status, "MITM passes the request through")
+    t.contains(r, "path=/secret/page", "the intercepted request reaches the origin")
+
+    # the point of interception: the decrypted request line reaches the log
+    log = t.wait_output(proxies, "/secret/page")
+    t.contains(log, "/secret/page", "MITM puts the request URI in the log")
+    t.contains(log, "GET", "MITM logs the method")
+    t.contains(log, "intercepted.test", "MITM logs the host that was asked for")
+
+    # a client that does not trust the CA sees the substitution
+    refused = t.https(target, proxy=f"127.0.0.1:{mitm}", ca=certs.other,
+                      strict=False, verify_name=False)
+    t.ne(200, refused.status, "MITM is visible to a client with another CA")
+
+    # Without interception the same request is opaque: the proxy logs the
+    # CONNECT target and nothing from inside the tunnel.
+    before = len(proxies.output())
+    r = t.https(target, proxy=f"127.0.0.1:{plain}", ca=certs.ca,
+                verify_name=False)
+    t.eq(200, r.status, "the plain proxy tunnels the same request")
+    tunnelled = t.wait_output(proxies, "intercepted.test", since=before)
+    t.contains(tunnelled, "intercepted.test", "the tunnel logs the CONNECT target")
+    t.not_contains(tunnelled, "/secret/page",
+                   "a tunnelled request keeps its URI out of the log")

tests/cases/tlspr.py

@@ -0,0 +1,47 @@
+"""tlspr: the destination comes from the name in the TLS handshake."""
+
+
+def run(t):
+    certs = t.certs()
+    if not certs:
+        t.skip("tlspr (openssl is not available to generate certificates)")
+        return
+
+    origin = t.free_port()
+    sni = t.free_port()
+
+    server = t.start("tlspr", f"""
+        log
+        ssl_server_cert {certs.server}
+        ssl_server_key {certs.server_key}
+        ssl_serv
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{origin}
+
+        flush
+        ssl_noserv
+        nserver 127.0.0.1
+        nscache 1024
+        nsrecord sni.test 127.0.0.1
+        auth iponly
+        allow *
+        tlspr -p{sni} -P{origin}
+    """, ports=[origin, sni])
+
+    if "Unknown command" in server.output():
+        t.skip("tlspr (this build has no SSL support)")
+        return
+
+    # The certificate names sni.test, so the name in the handshake is both
+    # what picks the destination and what the client checks.
+    r = t.https(f"https://sni.test:{sni}/echo", ca=certs.ca, strict=False,
+                connect_to=("127.0.0.1", sni))
+    t.eq(200, r.status, "the name in the handshake reaches its destination")
+    t.contains(r, "path=/echo", "the request arrives at the origin")
+
+    # a name the proxy cannot resolve has nowhere to go
+    r = t.https(f"https://nowhere.test:{sni}/echo", ca=certs.ca, strict=False,
+                verify_name=False, connect_to=("127.0.0.1", sni))
+    t.ne(200, r.status, "a name that does not resolve is refused")

tests/cases/transparent.py

@@ -0,0 +1,164 @@
+"""Transparent proxying: the destination comes from the redirection.
+
+A redirected connection no longer says where it was going, so the proxy has
+to ask the packet filter. That means a real redirection rule, which needs
+privilege, so the case skips unless it can install one and remove it again.
+
+The rule must not catch the proxy's own connection to the origin, or the
+traffic goes round for ever. Here the proxy is given an outgoing address of
+its own and the rule excludes it, which is the arrangement the documentation
+recommends.
+"""
+
+import os
+import platform
+import shutil
+import subprocess
+
+ORIGIN_ADDR = "127.0.0.9"      # where the client believes it is going
+PROXY_ADDR = "127.0.0.8"       # the source the proxy connects from
+DECOY_ADDR = "127.0.0.7"       # a second server, to show where traffic went
+
+
+def _run(command):
+    done = subprocess.run(command, stdout=subprocess.PIPE,
+                          stderr=subprocess.STDOUT, timeout=30)
+    return done.returncode, done.stdout.decode("utf-8", "replace").strip()
+
+
+def _iptables_rule(action, origin_port, proxy_port):
+    return ["iptables", "-t", "nat", action, "OUTPUT",
+            "-p", "tcp", "-d", ORIGIN_ADDR, "--dport", str(origin_port),
+            "!", "-s", PROXY_ADDR,
+            "-j", "REDIRECT", "--to-ports", str(proxy_port)]
+
+
+def _config(t, name, body):
+    """Run a configuration that has no service, and return what it said."""
+    return t.run_config(name, body + "\nnot_a_command\n")
+
+
+def run(t):
+    # --- the command and its modes ------------------------------------
+    # These need no redirection, so they run wherever the feature is built.
+    out = _config(t, "transparent_probe", "log\ntransparent")
+    if "'transparent'" in out:
+        t.skip("transparent proxying (not built in this configuration)")
+        return
+
+    for mode in ("auto", "socket"):
+        t.not_contains(_config(t, "mode_" + mode, f"log\ntransparent {mode}"),
+                       "transparent:", f"the {mode} mode is accepted")
+
+    t.contains(_config(t, "mode_bogus", "log\ntransparent bogus"),
+               "unknown mode", "an unknown mode is refused")
+
+    # A mode the build has no code for is refused rather than ignored, so a
+    # configuration written for another platform fails where it is wrong
+    # instead of quietly doing something else.
+    for mode, built in (("netfilter", platform.system() == "Linux"), ("pf", False)):
+        out = _config(t, "mode_" + mode, f"log\ntransparent {mode}")
+        if built:
+            t.not_contains(out, "not available", f"the {mode} mode is accepted where it exists")
+        elif "not available" in out:
+            t.ok(f"the {mode} mode is refused where it does not exist")
+        else:
+            t.skip(f"the {mode} mode (built here, nothing to check)")
+
+    t.not_contains(_config(t, "notransparent", "log\ntransparent\nnotransparent"),
+                   "'notransparent'", "notransparent is accepted")
+
+    # A configuration written for the plugin still loads: the line that used
+    # to load it is accepted and does nothing, the way the ssl and pcre ones
+    # are, so an existing configuration does not have to be edited first.
+    out = _config(t, "plugin_line",
+                  "log\nplugin /usr/local/lib/TransparentPlugin.ld.so transparent_plugin")
+    t.not_contains(out, "failed", "loading the old plugin is accepted and ignored")
+    t.contains(_config(t, "plugin_missing", "log\nplugin /nope/NoSuch.so nosuch_plugin"),
+               "failed", "an unknown plugin still fails to load")
+
+    # --- and the redirection itself ------------------------------------
+    if platform.system() != "Linux":
+        # The BSDs need a redirection that leaves the original destination on
+        # the socket - divert-to on OpenBSD, ipfw fwd on FreeBSD - and macOS
+        # has neither, so there is nothing to set up here.
+        t.skip(f"transparent proxying (no redirection to set up on {platform.system()})")
+        return
+    if os.geteuid() != 0 or not shutil.which("iptables"):
+        t.skip("transparent proxying (needs root and iptables to redirect)")
+        return
+
+    origin_port = t.free_port()
+    decoy_port = t.free_port()
+    mapper_port = t.free_port()
+    plain_port = t.free_port()
+
+    t.start("transparent", f"""
+        log
+        auth iponly
+        allow *
+        http echo * /echo**
+        httpsrv -p{origin_port} -i{ORIGIN_ADDR}
+
+        # a second server, to tell apart where a connection actually went
+        flush
+        auth iponly
+        allow *
+        http data * * size=13
+        httpsrv -p{decoy_port} -i{DECOY_ADDR}
+
+        # a port mapper aimed at the decoy: with the destination taken from
+        # the redirection instead, it goes to the origin
+        flush
+        auth iponly
+        allow *
+        transparent
+        tcppm -e{PROXY_ADDR} {mapper_port} {DECOY_ADDR} {decoy_port}
+        notransparent
+
+        # the same mapper without it, which keeps going to the decoy
+        flush
+        auth iponly
+        allow *
+        tcppm -e{PROXY_ADDR} {plain_port} {DECOY_ADDR} {decoy_port}
+    """, ports=[(ORIGIN_ADDR, origin_port), (DECOY_ADDR, decoy_port),
+                mapper_port, plain_port])
+
+    code, out = _run(_iptables_rule("-A", origin_port, mapper_port))
+    if code:
+        t.skip(f"transparent proxying (could not add a redirect rule: {out})")
+        return
+
+    try:
+        # The client asks for the address it wants; the rule sends the
+        # connection to the mapper instead, and the mapper has to work out
+        # where it was headed.
+        r = t.http(f"http://{ORIGIN_ADDR}:{origin_port}/echo")
+        t.eq(200, r.status, "a redirected connection reaches its destination")
+        t.contains(r, "path=/echo", "the request arrives unchanged")
+        t.contains(r, f"host={ORIGIN_ADDR}:{origin_port}",
+                   "the client still believes it is talking to the origin")
+        t.contains(r, f"peer.addr={PROXY_ADDR}",
+                   "the origin is reached from the proxy's own address")
+
+        # That address is what the rule excludes, which is what stops the
+        # proxy's own connection from being redirected back into itself.
+        t.not_contains(r, "size=13", "the connection did not go to the decoy")
+
+        # Without the command the mapper has no reason to look, and goes
+        # where it was configured to go.
+        _run(_iptables_rule("-D", origin_port, mapper_port))
+        code, out = _run(_iptables_rule("-A", origin_port, plain_port))
+        if code:
+            t.skip("the mapper without the command (could not move the rule)")
+        else:
+            r = t.http(f"http://{ORIGIN_ADDR}:{origin_port}/echo")
+            t.eq(13, r.length,
+                 "without the command the connection goes to the configured target")
+            t.not_contains(r, "path=/echo",
+                           "and never reaches the address the client asked for")
+            _run(_iptables_rule("-D", origin_port, plain_port))
+    finally:
+        # leave the machine as it was found, whatever happened above
+        _run(_iptables_rule("-D", origin_port, mapper_port))
+        _run(_iptables_rule("-D", origin_port, plain_port))

tests/harness.py

@@ -0,0 +1,998 @@
+"""Support code for the 3proxy regression tests.
+
+Everything here is standard library, so the suite runs wherever 3proxy
+builds: no shell, no curl, no netcat.
+
+A test case is a module under tests/cases/ exporting run(t). It writes the
+configurations it needs, starts them, and states what it expects:
+
+    def run(t):
+        srv = t.free_port()
+        t.start("echo", f'''
+            log
+            auth iponly
+            allow *
+            http * /echo echo
+            httpsrv -p{srv}
+        ''', ports=[srv])
+        r = t.http(f"http://127.0.0.1:{srv}/echo")
+        t.eq(200, r.status, "the server answers")
+"""
+
+import base64
+import http.client
+import os
+import random
+import shutil
+import socket
+import ssl
+import struct
+import subprocess
+import sys
+import textwrap
+import threading
+import time
+
+
+# Ports handed out in this run: a service which has finished may still be
+# in TIME_WAIT, and another case binding the same port would fail for it.
+_PORTS_TAKEN = set()
+
+
+class Response:
+    """A reply, or the reason there wasn't one."""
+
+    def __init__(self, status=None, body=b"", headers=None, error=None):
+        self.status = status
+        self.body = body
+        self.headers = headers or {}
+        self.error = error
+
+    @property
+    def text(self):
+        return self.body.decode("utf-8", "replace")
+
+    @property
+    def length(self):
+        return len(self.body)
+
+    def header(self, name):
+        for k, v in self.headers.items():
+            if k.lower() == name.lower():
+                return v
+        return None
+
+    def __repr__(self):
+        if self.error:
+            return f"<no reply: {self.error}>"
+        return f"<{self.status}, {len(self.body)} bytes>"
+
+
+class Server:
+    """A running 3proxy, with the configuration it was given."""
+
+    def __init__(self, name, path, proc, logfile):
+        self.name = name
+        self.path = path
+        self.proc = proc
+        self.logfile = logfile
+
+    def output(self):
+        try:
+            with open(self.logfile, "rb") as fp:
+                return fp.read().decode("utf-8", "replace")
+        except OSError:
+            return ""
+
+    def stop(self):
+        if self.proc.poll() is None:
+            self.proc.terminate()
+            try:
+                self.proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self.proc.kill()
+                self.proc.wait(timeout=5)
+
+
+class Certs:
+    """A test CA, a certificate it signed, and somewhere to cache spoofed ones.
+
+    Paths use forward slashes: they are written into configurations read by
+    3proxy, and ssl_certcache insists on a trailing separator.
+    """
+
+    def __init__(self, directory):
+        self.dir = directory.replace("\\", "/")
+        self.ca = self.dir + "/ca.pem"
+        self.ca_key = self.dir + "/ca.key"
+        self.server = self.dir + "/server.pem"
+        self.server_key = self.dir + "/server.key"
+        # a second CA nothing is signed by, for the cases that must fail
+        self.other = self.dir + "/other.pem"
+        self.other_key = self.dir + "/other.key"
+        self.cache = self.dir + "/cache/"
+        self.verified = False
+        self.verify_output = ""
+
+
+class Failure(Exception):
+    """Raised when a case cannot go on, e.g. a server refused to start."""
+
+
+class Tester:
+    """The API a case runs against: start servers, make requests, assert."""
+
+    def __init__(self, binary, tmpdir, case):
+        self.binary = binary
+        self.tmpdir = tmpdir
+        self.case = case
+        self.servers = []
+        self.checks = []
+        self.timeout = 10
+        self._raw_kept = []
+        self._skipped = 0
+        self._certs = None
+        self.logs = []
+        self.udp_servers = []
+
+    # ---- servers -----------------------------------------------------
+
+    def has_ipv6(self):
+        """Whether this machine can use the IPv6 loopback at all."""
+        try:
+            sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+        except OSError:
+            return False
+        try:
+            sock.bind(("::1", 0))
+            return True
+        except OSError:
+            return False
+        finally:
+            sock.close()
+
+    def free_port(self):
+        """A port nothing is listening on, and nothing is likely to take.
+
+        Asking the system for an ephemeral port hands back one out of the
+        range it also draws outgoing connections from - 32768 up on Linux,
+        49152 up on Windows - so between the check here and the bind in the
+        service, a connection somewhere else in the suite can take it. That
+        shows up as a service which never listens, or a bind() error deep in
+        a case which has nothing to do with ports. Ports are taken from below
+        both ranges instead, and none is handed out twice in a run.
+        """
+        for _ in range(200):
+            port = random.randint(10000, 19999)
+            if port in _PORTS_TAKEN:
+                continue
+            sock = socket.socket()
+            try:
+                sock.bind(("127.0.0.1", port))
+            except OSError:
+                continue
+            finally:
+                sock.close()
+            _PORTS_TAKEN.add(port)
+            return port
+        raise RuntimeError("no free port in the range the suite uses")
+
+    def write_config(self, name, config):
+        path = os.path.join(self.tmpdir, name + ".cfg")
+        text = textwrap.dedent(config).strip() + "\n"
+        # newline="" keeps the line endings as written, rather than letting
+        # Windows turn them into CRLF behind the parser's back
+        with open(path, "w", newline="") as fp:
+            fp.write(text)
+        return path
+
+    def start(self, name, config, ports=()):
+        """Write a configuration, run it, and wait for its ports to open.
+
+        A port may be given as a number, or as (address, port) for a service
+        bound somewhere other than 127.0.0.1.
+        """
+        path = self.write_config(name, config)
+        logfile = os.path.join(self.tmpdir, name + ".out")
+        with open(logfile, "wb") as out:
+            proc = subprocess.Popen([self.binary, path], stdout=out,
+                                    stderr=subprocess.STDOUT)
+        server = Server(name, path, proc, logfile)
+        self.servers.append(server)
+
+        for entry in ports:
+            host, port = entry if isinstance(entry, tuple) else ("127.0.0.1", entry)
+            if not self.wait_port(port, host=host):
+                code = proc.poll()
+                if code is None:
+                    died = "the process is still running"
+                else:
+                    died = f"the process exited with code {code}"
+                    if os.name == "nt" and code is not None and code & 0xFFFFFFFF == 0xC0000135:
+                        died += " (a DLL it needs was not found)"
+                raise Failure(
+                    f"{name} never listened on port {port}: {died}\n"
+                    f"--- configuration ---\n{open(path).read()}"
+                    f"--- output ---\n{server.output()}")
+        return server
+
+    def run_config(self, name, config):
+        """Run a configuration expected to be rejected; return its output."""
+        path = self.write_config(name, config)
+        done = subprocess.run([self.binary, path], stdout=subprocess.PIPE,
+                              stderr=subprocess.STDOUT, timeout=15)
+        return done.stdout.decode("utf-8", "replace")
+
+    def wait_port(self, port, timeout=5.0, host="127.0.0.1"):
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            try:
+                with socket.create_connection((host, port), 0.25):
+                    return True
+            except OSError:
+                time.sleep(0.02)
+        return False
+
+    def wait_output(self, server, needle, timeout=5.0, since=0):
+        """Wait for a server to log something.
+
+        A record is written when the connection it describes finishes, not
+        when the reply reaches the client, so reading straight after a
+        request usually finds nothing yet.
+        """
+        deadline = time.time() + timeout
+        while True:
+            text = server.output()[since:]
+            if needle in text or time.time() > deadline:
+                return text
+            time.sleep(0.05)
+
+    def stop_all(self):
+        """Stop the servers, keeping what they printed for the report."""
+        for sock in self.udp_servers:
+            sock.close()
+        self.udp_servers = []
+        for server in self.servers:
+            server.stop()
+            self.logs.append((server.name, server.output()))
+        self.servers = []
+
+    # ---- requests ----------------------------------------------------
+
+    def http(self, url, proxy=None, socks=None, socks4=False,
+             remote_dns=False, method="GET", body=None, headers=None,
+             auth=None, proxy_auth=None, tunnel=False, conn=None):
+        """Make a request, directly or through a proxy, and read the reply.
+
+        proxy       "host:port" of an HTTP proxy
+        socks       "host:port" of a SOCKS proxy
+        tunnel      reach the origin with CONNECT rather than an absolute URI
+        conn        reuse a connection returned by connection()
+        """
+        host, port, path = self._split(url)
+        headers = dict(headers or {})
+        if auth:
+            headers["Authorization"] = self._basic(auth)
+        if proxy_auth:
+            headers["Proxy-Authorization"] = self._basic(proxy_auth)
+
+        own = conn is None
+        try:
+            if own:
+                conn = self.connection(host, port, proxy=proxy, socks=socks,
+                                       socks4=socks4, remote_dns=remote_dns,
+                                       tunnel=tunnel)
+            target = path
+            if proxy and not tunnel:
+                # an address with colons goes back in brackets, or the
+                # absolute URI cannot be read
+                authority = f"[{host}]" if ":" in host else host
+                target = f"http://{authority}:{port}{path}"
+            if body is not None and not isinstance(body, bytes):
+                body = body.encode()
+            conn.request(method, target, body=body, headers=headers)
+            reply = conn.getresponse()
+            data = reply.read()
+            return Response(reply.status, data, dict(reply.getheaders()))
+        except (OSError, http.client.HTTPException) as exc:
+            return Response(error=f"{type(exc).__name__}: {exc}")
+        finally:
+            if own and conn is not None:
+                try:
+                    conn.close()
+                except OSError:
+                    pass
+
+    def connection(self, host, port, proxy=None, socks=None, socks4=False,
+                   remote_dns=False, tunnel=False):
+        """A connection to an origin, kept open for reuse."""
+        if socks:
+            shost, sport = self._hostport(socks)
+            sock = self._socks_connect(shost, sport, host, port,
+                                       socks4=socks4, remote_dns=remote_dns)
+            conn = http.client.HTTPConnection(host, port, timeout=self.timeout)
+            conn.sock = sock
+            return conn
+        if proxy:
+            phost, pport = self._hostport(proxy)
+            conn = http.client.HTTPConnection(phost, pport, timeout=self.timeout)
+            if tunnel:
+                conn.set_tunnel(host, port)
+            return conn
+        return http.client.HTTPConnection(host, port, timeout=self.timeout)
+
+    def raw(self, port, request, host="127.0.0.1"):
+        """Send bytes as they are and return whatever comes back."""
+        if not isinstance(request, bytes):
+            request = request.encode("latin-1")
+        try:
+            with socket.create_connection((host, port), self.timeout) as sock:
+                sock.settimeout(self.timeout)
+                sock.sendall(request)
+                chunks = []
+                while True:
+                    try:
+                        piece = sock.recv(65536)
+                    except OSError:
+                        # a timeout, or a reset once the server is done:
+                        # either way keep whatever already arrived
+                        break
+                    if not piece:
+                        break
+                    chunks.append(piece)
+                return b"".join(chunks).decode("utf-8", "replace")
+        except OSError as exc:
+            return f"<no reply: {exc}>"
+
+    def raw_session(self, port, request, host="127.0.0.1", quiet=0.5):
+        """Send bytes and read until the server closes or goes quiet.
+
+        Returns (text, closed). closed says the server ended the connection
+        rather than leaving it open for another request, which is the whole
+        question a keep-alive test asks.
+        """
+        if not isinstance(request, bytes):
+            request = request.encode("latin-1")
+        closed = False
+        chunks = []
+        try:
+            with socket.create_connection((host, port), self.timeout) as sock:
+                try:
+                    sock.sendall(request)
+                except OSError:
+                    # the server answered and closed before taking all of it,
+                    # which is an answer in itself
+                    closed = True
+                sock.settimeout(quiet)
+                while True:
+                    try:
+                        piece = sock.recv(65536)
+                    except socket.timeout:
+                        break               # quiet: the connection is still open
+                    except OSError:
+                        closed = True       # reset: it is not
+                        break
+                    if not piece:
+                        closed = True
+                        break
+                    chunks.append(piece)
+        except OSError as exc:
+            return f"<no reply: {exc}>", True
+        return b"".join(chunks).decode("utf-8", "replace"), closed
+
+    def raw_proxy_request(self, proxy, url, extra="", body="", method=None):
+        """Send one absolute-URI request through a proxy, headers and all.
+
+        For the requests a client library will not send: an oversized header
+        block, or one whose exact bytes matter.
+        """
+        phost, pport = self._hostport(proxy)
+        host, port, path = self._split(url)
+        method = method or ("POST" if body else "GET")
+        request = (f"{method} http://{host}:{port}{path} HTTP/1.1\r\n"
+                   f"Host: {host}:{port}\r\n" + extra)
+        if body:
+            request += f"Content-Length: {len(body)}\r\n"
+        request += "\r\n" + body
+        text, _ = self.raw_session(pport, request, host=phost, quiet=2)
+        return text
+
+    def raw_server(self, port, reply, close_after=True, host="127.0.0.1",
+                   drain=False):
+        """Answer every connection with fixed bytes. Returns a stop function.
+
+        For the shapes a real server would have to be talked into: an answer
+        whose body is delimited by the close, or one which promises to stay
+        and does not. drain reads the whole request first, however large,
+        which is what a test of the sending side needs.
+        """
+        sock = socket.socket()
+        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        sock.bind((host, port))
+        sock.listen(8)
+        running = [True]
+
+        def serve():
+            while running[0]:
+                try:
+                    conn, _ = sock.accept()
+                except OSError:
+                    break
+                try:
+                    conn.settimeout(0.5 if drain else self.timeout)
+                    while True:
+                        try:
+                            if not conn.recv(65536) or not drain:
+                                break
+                        except socket.timeout:
+                            break       # it has stopped sending
+                    conn.sendall(reply)
+                    if close_after:
+                        conn.close()
+                    else:
+                        self._raw_kept.append(conn)
+                except OSError:
+                    pass
+
+        thread = threading.Thread(target=serve, daemon=True)
+        thread.start()
+
+        def stop():
+            running[0] = False
+            try:
+                sock.close()
+            except OSError:
+                pass
+
+        return stop
+
+    # ---- UDP ---------------------------------------------------------
+
+    def udp_echo(self, prefix=b"echo:"):
+        """Start a UDP server that echoes what it receives, and give its port.
+
+        Something has to be on the far side of a port mapper or a SOCKS
+        association for the data path to be visible at all.
+        """
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.bind(("127.0.0.1", 0))
+        port = sock.getsockname()[1]
+
+        def serve():
+            while True:
+                try:
+                    data, peer = sock.recvfrom(65536)
+                except OSError:
+                    return
+                try:
+                    sock.sendto(prefix + data, peer)
+                except OSError:
+                    return
+
+        thread = threading.Thread(target=serve, daemon=True)
+        thread.start()
+        self.udp_servers.append(sock)
+        return port
+
+    def udp_exchange(self, port, payload, host="127.0.0.1"):
+        """Send one datagram and return the reply, or None."""
+        if not isinstance(payload, bytes):
+            payload = payload.encode()
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(self.timeout)
+        try:
+            sock.sendto(payload, (host, port))
+            return sock.recvfrom(65536)[0]
+        except OSError:
+            return None
+        finally:
+            sock.close()
+
+    def wait_udp(self, port, payload=b"ping", timeout=5.0):
+        """Wait until a UDP service answers.
+
+        There is no socket to connect to, so readiness can only be found
+        out by asking; a datagram sent before the service is up is simply
+        lost.
+        """
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            if self.udp_exchange(port, payload) is not None:
+                return True
+            time.sleep(0.05)
+        return False
+
+    def socks_udp(self, socks, host, port, payload, keep=None):
+        """Relay a datagram through a SOCKS5 association.
+
+        Returns (reply payload, association port), or (None, port) if
+        nothing came back. The control connection has to stay open for the
+        association to live, so it is closed only on the way out.
+        """
+        if not isinstance(payload, bytes):
+            payload = payload.encode()
+        shost, sport = self._hostport(socks)
+        ctrl = None
+        udp = None
+        try:
+            ctrl = socket.create_connection((shost, sport), self.timeout)
+            ctrl.settimeout(self.timeout)
+            ctrl.sendall(b"\x05\x01\x00")
+            if self._recvall(ctrl, 2) != b"\x05\x00":
+                return None, None
+            ctrl.sendall(b"\x05\x03\x00\x01\x00\x00\x00\x00" + struct.pack("!H", 0))
+            reply = self._recvall(ctrl, 4)
+            if len(reply) < 4 or reply[1] != 0:
+                return None, None
+            _, bound = self._read_socks_addr(ctrl, reply[3])
+
+            udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+            udp.settimeout(self.timeout)
+            header = (b"\x00\x00\x00\x01" + socket.inet_aton(host) +
+                      struct.pack("!H", port))
+            udp.sendto(header + payload, (shost, bound))
+            try:
+                data = udp.recvfrom(65536)[0]
+            except OSError:
+                return None, bound
+            # the reply carries the same kind of header, which is not payload
+            if len(data) < 10 or data[3] != 1:
+                return None, bound
+            return data[10:], bound
+        except OSError:
+            return None, None
+        finally:
+            if udp:
+                udp.close()
+            if ctrl:
+                ctrl.close()
+
+    # ---- DNS ---------------------------------------------------------
+
+    def dns_query(self, port, name, host="127.0.0.1", timeout=2.0):
+        """Ask for an A record and return the addresses in the answer.
+
+        The default timeout is short: a name server on the loopback answers
+        at once or not at all, and waiting the full request timeout on every
+        attempt turns a server that answers nothing into a very slow run.
+        """
+        query = struct.pack("!HHHHHH", 0x2A2A, 0x0100, 1, 0, 0, 0)
+        for label in name.split("."):
+            query += bytes([len(label)]) + label.encode()
+        query += b"\x00" + struct.pack("!HH", 1, 1)
+
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(timeout)
+        try:
+            sock.sendto(query, (host, port))
+            data = sock.recvfrom(65536)[0]
+        except OSError:
+            return None
+        finally:
+            sock.close()
+
+        if len(data) < 12 or data[:2] != query[:2]:
+            return None
+        answers = struct.unpack("!H", data[6:8])[0]
+        addresses = []
+        pos = 12
+        while pos < len(data) and data[pos]:      # skip the question
+            pos += data[pos] + 1
+        pos += 5
+        for _ in range(answers):
+            if pos + 12 > len(data):
+                break
+            if data[pos] & 0xC0 == 0xC0:
+                pos += 2
+            else:
+                while pos < len(data) and data[pos]:
+                    pos += data[pos] + 1
+                pos += 1
+            rtype, _, _, rdlen = struct.unpack("!HHIH", data[pos:pos + 10])
+            pos += 10
+            if rtype == 1 and rdlen == 4:
+                addresses.append(socket.inet_ntoa(data[pos:pos + 4]))
+            pos += rdlen
+        return addresses
+
+    # ---- SOCKS -------------------------------------------------------
+
+    def _socks_connect(self, shost, sport, host, port, socks4=False,
+                       remote_dns=False, auth=None):
+        sock = socket.create_connection((shost, sport), self.timeout)
+        sock.settimeout(self.timeout)
+        try:
+            if socks4:
+                addr = socket.inet_aton(socket.gethostbyname(host))
+                sock.sendall(b"\x04\x01" + struct.pack("!H", port) + addr + b"\x00")
+                reply = self._recvall(sock, 8)
+                if len(reply) < 2 or reply[1] != 0x5a:
+                    raise OSError("SOCKS4 request refused")
+                return sock
+
+            if auth:
+                sock.sendall(b"\x05\x02\x00\x02")
+            else:
+                sock.sendall(b"\x05\x01\x00")
+            reply = self._recvall(sock, 2)
+            if len(reply) < 2 or reply[0] != 5:
+                raise OSError("SOCKS5 handshake failed")
+            if reply[1] == 0x02:
+                if not auth:
+                    raise OSError("SOCKS5 server demands credentials")
+                user, password = auth
+                sock.sendall(b"\x01" + bytes([len(user)]) + user.encode() +
+                             bytes([len(password)]) + password.encode())
+                status = self._recvall(sock, 2)
+                if len(status) < 2 or status[1] != 0:
+                    raise OSError("SOCKS5 credentials refused")
+            elif reply[1] != 0x00:
+                raise OSError("SOCKS5 offered no acceptable method")
+
+            if remote_dns:
+                target = b"\x03" + bytes([len(host)]) + host.encode()
+            elif ":" in host:
+                target = b"\x04" + socket.inet_pton(socket.AF_INET6, host)
+            else:
+                target = b"\x01" + socket.inet_aton(socket.gethostbyname(host))
+            sock.sendall(b"\x05\x01\x00" + target + struct.pack("!H", port))
+            reply = self._recvall(sock, 4)
+            if len(reply) < 4 or reply[1] != 0:
+                raise OSError("SOCKS5 request refused")
+            self._read_socks_addr(sock, reply[3])
+            return sock
+        except Exception:
+            sock.close()
+            raise
+
+    def socks_connect(self, socks, host, port, socks4=False, remote_dns=False,
+                      auth=None):
+        """Open a SOCKS connection, reporting failure rather than raising."""
+        shost, sport = self._hostport(socks)
+        try:
+            sock = self._socks_connect(shost, sport, host, port, socks4=socks4,
+                                       remote_dns=remote_dns, auth=auth)
+            sock.close()
+            return None
+        except OSError as exc:
+            return str(exc)
+
+    def socks_http(self, socks, url, auth=None, **kwargs):
+        """A request through SOCKS, with optional SOCKS credentials."""
+        host, port, path = self._split(url)
+        shost, sport = self._hostport(socks)
+        try:
+            sock = self._socks_connect(shost, sport, host, port, auth=auth,
+                                       **kwargs)
+        except OSError as exc:
+            return Response(error=str(exc))
+        conn = http.client.HTTPConnection(host, port, timeout=self.timeout)
+        conn.sock = sock
+        try:
+            conn.request("GET", path)
+            reply = conn.getresponse()
+            return Response(reply.status, reply.read(), dict(reply.getheaders()))
+        except (OSError, http.client.HTTPException) as exc:
+            return Response(error=str(exc))
+        finally:
+            conn.close()
+
+    def socks_udp_associate(self, port, host="127.0.0.1"):
+        """Ask for a UDP association and report the port handed back.
+
+        That socket is allocated per association, which is where an intport
+        range has to take effect.
+        """
+        try:
+            with socket.create_connection((host, port), self.timeout) as sock:
+                sock.settimeout(self.timeout)
+                sock.sendall(b"\x05\x01\x00")
+                if self._recvall(sock, 2) != b"\x05\x00":
+                    return None
+                sock.sendall(b"\x05\x03\x00\x01\x00\x00\x00\x00" +
+                             struct.pack("!H", 0))
+                reply = self._recvall(sock, 4)
+                if len(reply) < 4 or reply[1] != 0:
+                    return None
+                _, bound = self._read_socks_addr(sock, reply[3])
+                return bound
+        except OSError:
+            return None
+
+    def _read_socks_addr(self, sock, atyp):
+        if atyp == 1:
+            addr = socket.inet_ntoa(self._recvall(sock, 4))
+        elif atyp == 3:
+            length = self._recvall(sock, 1)[0]
+            addr = self._recvall(sock, length).decode()
+        elif atyp == 4:
+            addr = self._recvall(sock, 16).hex()
+        else:
+            raise OSError(f"unknown SOCKS address type {atyp}")
+        port = struct.unpack("!H", self._recvall(sock, 2))[0]
+        return addr, port
+
+    @staticmethod
+    def _recvall(sock, count):
+        data = b""
+        while len(data) < count:
+            piece = sock.recv(count - len(data))
+            if not piece:
+                break
+            data += piece
+        return data
+
+    # ---- TLS ---------------------------------------------------------
+
+    def certs(self):
+        """A CA and a certificate for 127.0.0.1, generated once per run.
+
+        Returns None when openssl is unavailable, so a case can skip rather
+        than fail on a machine that cannot make key material.
+        """
+        if self._certs is not None:
+            return self._certs or None
+        if not shutil.which("openssl"):
+            self._certs = False
+            return None
+
+        c = Certs(os.path.join(self.tmpdir, "certs"))
+        os.makedirs(c.cache, exist_ok=True)
+        csr = c.dir + "/server.csr"
+        ext = c.dir + "/server.ext"
+        ca_ext = c.dir + "/ca.ext"
+        # The key identifiers are spelled out because LibreSSL does not add
+        # them for a signed certificate the way OpenSSL 3 does, and Python
+        # rejects a chain with no Authority Key Identifier from 3.13.
+        with open(ext, "w") as fp:
+            fp.write("subjectAltName=IP:127.0.0.1,DNS:localhost,DNS:sni.test\n"
+                     "subjectKeyIdentifier=hash\n"
+                     "authorityKeyIdentifier=keyid,issuer\n")
+        # A CA without these is not usable as one. They go in a file rather
+        # than in -addext, which LibreSSL - the openssl on a stock macOS -
+        # does not apply the same way.
+        with open(ca_ext, "w") as fp:
+            fp.write("basicConstraints=critical,CA:TRUE\n"
+                     "keyUsage=critical,keyCertSign,cRLSign\n"
+                     "subjectKeyIdentifier=hash\n")
+
+        def ca_steps(key, csr_path, out, name):
+            return [
+                ["openssl", "genrsa", "-out", key, "2048"],
+                ["openssl", "req", "-new", "-nodes", "-key", key,
+                 "-subj", "/CN=" + name, "-out", csr_path],
+                ["openssl", "x509", "-req", "-in", csr_path, "-signkey", key,
+                 "-days", "3650", "-sha256", "-extfile", ca_ext, "-out", out],
+            ]
+
+        steps = (
+            ca_steps(c.ca_key, c.dir + "/ca.csr", c.ca, "3proxy-test-ca") +
+            ca_steps(c.other_key, c.dir + "/other.csr", c.other,
+                     "3proxy-test-other-ca") +
+            [
+                ["openssl", "genrsa", "-out", c.server_key, "2048"],
+                ["openssl", "req", "-new", "-key", c.server_key,
+                 "-subj", "/CN=127.0.0.1", "-out", csr],
+                ["openssl", "x509", "-req", "-in", csr, "-CA", c.ca,
+                 "-CAkey", c.ca_key, "-CAcreateserial", "-out", c.server,
+                 "-days", "3650", "-sha256", "-extfile", ext],
+            ])
+        for step in steps:
+            done = subprocess.run(step, stdout=subprocess.PIPE,
+                                  stderr=subprocess.STDOUT, timeout=60)
+            if done.returncode:
+                self._certs = False
+                return None
+
+        # If the chain does not verify, the fault is in the generation, not
+        # in whatever is about to present it.
+        # -x509_strict is what a current client applies, so check that here
+        # rather than discovering it in a handshake.
+        check = subprocess.run(["openssl", "verify", "-x509_strict",
+                                "-CAfile", c.ca, c.server],
+                               stdout=subprocess.PIPE,
+                               stderr=subprocess.STDOUT, timeout=60)
+        c.verified = check.returncode == 0
+        c.verify_output = check.stdout.decode("utf-8", "replace").strip()
+
+        self._certs = c
+        return c
+
+    def _context(self, ca=None, strict=True, verify_name=True):
+        """A client context.
+
+        strict=False drops the RFC 5280 checks Python turns on by default
+        from 3.13, which reject a certificate with no Authority Key
+        Identifier. verify_name=False keeps the chain check but ignores
+        which host the certificate names, for the intercepted connections
+        where that is the upstream identity rather than the one asked for.
+        """
+        if ca:
+            context = ssl.create_default_context(cafile=ca)
+            if not strict:
+                context.verify_flags &= ~getattr(ssl, "VERIFY_X509_STRICT", 0)
+            if not verify_name:
+                context.check_hostname = False
+            return context
+        context = ssl.create_default_context()
+        context.check_hostname = False
+        context.verify_mode = ssl.CERT_NONE
+        return context
+
+    def tls_proxy_http(self, proxy, url, ca=None, strict=True, method="GET",
+                       body=None, headers=None):
+        """A request to a proxy that is itself wrapped in TLS (ssl_serv)."""
+        host, port, path = self._split(url)
+        phost, pport = self._hostport(proxy)
+        try:
+            raw = socket.create_connection((phost, pport), self.timeout)
+            sock = self._context(ca, strict).wrap_socket(raw, server_hostname=phost)
+        except (OSError, ssl.SSLError) as exc:
+            return Response(error=f"{type(exc).__name__}: {exc}")
+
+        conn = http.client.HTTPConnection(host, port, timeout=self.timeout)
+        conn.sock = sock
+        try:
+            if body is not None and not isinstance(body, bytes):
+                body = body.encode()
+            authority = f"[{host}]" if ":" in host else host
+            conn.request(method, f"http://{authority}:{port}{path}", body=body,
+                         headers=headers or {})
+            reply = conn.getresponse()
+            return Response(reply.status, reply.read(), dict(reply.getheaders()))
+        except (OSError, http.client.HTTPException) as exc:
+            return Response(error=f"{type(exc).__name__}: {exc}")
+        finally:
+            conn.close()
+
+    def https(self, url, proxy=None, ca=None, strict=True, verify_name=True,
+              method="GET", headers=None, connect_to=None):
+        """An https:// request, optionally tunnelled through a proxy.
+
+        connect_to sends the handshake somewhere other than the name in the
+        URL, which is how a name-directed proxy is reached: the name still
+        goes out in the handshake and is what the certificate is checked
+        against.
+        """
+        host, port, path = self._split(url, default_port=443)
+        context = self._context(ca, strict, verify_name)
+        try:
+            if connect_to:
+                raw = socket.create_connection(connect_to, self.timeout)
+                conn = http.client.HTTPSConnection(host, port, context=context,
+                                                   timeout=self.timeout)
+                conn.sock = context.wrap_socket(raw, server_hostname=host)
+                conn.request(method, path, headers=headers or {})
+                reply = conn.getresponse()
+                return Response(reply.status, reply.read(),
+                                dict(reply.getheaders()))
+            if proxy:
+                phost, pport = self._hostport(proxy)
+                conn = http.client.HTTPSConnection(phost, pport, context=context,
+                                                   timeout=self.timeout)
+                conn.set_tunnel(host, port)
+            else:
+                conn = http.client.HTTPSConnection(host, port, context=context,
+                                                   timeout=self.timeout)
+            conn.request(method, path, headers=headers or {})
+            reply = conn.getresponse()
+            return Response(reply.status, reply.read(), dict(reply.getheaders()))
+        except (OSError, ssl.SSLError, http.client.HTTPException) as exc:
+            return Response(error=f"{type(exc).__name__}: {exc}")
+        finally:
+            try:
+                conn.close()
+            except (OSError, NameError, UnboundLocalError):
+                pass
+
+    # ---- helpers -----------------------------------------------------
+
+    @staticmethod
+    def _basic(credentials):
+        user, password = credentials
+        token = base64.b64encode(f"{user}:{password}".encode()).decode()
+        return "Basic " + token
+
+    @staticmethod
+    def _hostport(value):
+        if value.startswith("["):
+            host, _, rest = value[1:].partition("]")
+            return host, int(rest[1:])
+        host, _, port = value.rpartition(":")
+        return host or "127.0.0.1", int(port)
+
+    @staticmethod
+    def _split(url, default_port=80):
+        """Split a URL, understanding an address in brackets.
+
+        The brackets are dropped: they belong to the URL, not to the address
+        a socket call or a certificate check wants.
+        """
+        for prefix in ("http://", "https://"):
+            if url.startswith(prefix):
+                url = url[len(prefix):]
+                break
+        authority, _, path = url.partition("/")
+        if authority.startswith("["):
+            host, _, rest = authority[1:].partition("]")
+            port = rest[1:] if rest.startswith(":") else default_port
+        elif ":" in authority:
+            host, _, port = authority.rpartition(":")
+        else:
+            host, port = authority, default_port
+        return host or "127.0.0.1", int(port), "/" + path
+
+    # ---- assertions --------------------------------------------------
+
+    def _record(self, passed, label, expected=None, actual=None):
+        self.checks.append((passed, label, expected, actual))
+        return passed
+
+    def ok(self, label):
+        return self._record(True, label)
+
+    def fail(self, label, expected=None, actual=None):
+        return self._record(False, label, expected, actual)
+
+    def eq(self, expected, actual, label):
+        return self._record(expected == actual, label, expected, actual)
+
+    def ne(self, unexpected, actual, label):
+        return self._record(unexpected != actual, label,
+                            f"anything but {unexpected!r}", actual)
+
+    @staticmethod
+    def _as_text(value):
+        """A reply that never arrived has no text, so report the reason."""
+        if isinstance(value, Response):
+            if value.error:
+                return f"<no reply: {value.error}>"
+            if not value.body and value.status is not None:
+                return f"<{value.status}, empty body>"
+            return value.text
+        return value
+
+    def contains(self, haystack, needle, label):
+        haystack = self._as_text(haystack)
+        return self._record(needle in haystack, label,
+                            f"text containing {needle!r}", self._clip(haystack))
+
+    def not_contains(self, haystack, needle, label):
+        haystack = self._as_text(haystack)
+        return self._record(needle not in haystack, label,
+                            f"text without {needle!r}", self._clip(haystack))
+
+    def in_range(self, value, low, high, label):
+        good = isinstance(value, int) and low <= value <= high
+        return self._record(good, label, f"between {low} and {high}", value)
+
+    def not_in_range(self, value, low, high, label):
+        good = isinstance(value, int) and not (low <= value <= high)
+        return self._record(good, label, f"outside {low}-{high}", value)
+
+    def skip(self, label):
+        self._skipped += 1
+        self.checks.append((None, label, None, None))
+
+    @staticmethod
+    def _clip(text, limit=200):
+        text = str(text).replace("\r\n", " ").replace("\n", " ")
+        return text[:limit] + ("..." if len(text) > limit else "")
+
+
+def field(response, name):
+    """Pull one 'key=value' line out of an echo reply."""
+    text = response.text if isinstance(response, Response) else response
+    for line in text.splitlines():
+        key, _, value = line.partition("=")
+        if key == name:
+            return value
+    return None
+
+
+def int_field(response, name):
+    value = field(response, name)
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None

tests/run.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+"""Run the 3proxy regression tests.
+
+    python3 tests/run.py                 every case
+    python3 tests/run.py httpsrv         cases whose name matches
+    python3 tests/run.py --bin build/bin/3proxy
+    python3 tests/run.py --keep          leave the temporary files behind
+
+Each case under tests/cases/ defines the configurations it needs and the
+positive and negative scenarios expected from them.
+"""
+
+import argparse
+import importlib.util
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from harness import Failure, Tester  # noqa: E402
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+def default_binary():
+    """Find a built 3proxy: the Makefiles put it in bin/, CMake in build/bin/,
+    and multi-configuration generators one level below that again."""
+    name = "3proxy.exe" if os.name == "nt" else "3proxy"
+    candidates = [os.path.join(ROOT, "bin", name),
+                  os.path.join(ROOT, "build", "bin", name)]
+    for config in ("Release", "Debug", "RelWithDebInfo", "MinSizeRel"):
+        candidates.append(os.path.join(ROOT, "build", "bin", config, name))
+    for candidate in candidates:
+        if os.path.isfile(candidate):
+            return candidate
+    return candidates[0]
+
+
+def load_case(path):
+    name = os.path.splitext(os.path.basename(path))[0]
+    spec = importlib.util.spec_from_file_location("case_" + name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return name, module
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("pattern", nargs="?", default="",
+                        help="only run cases whose name contains this")
+    parser.add_argument("--bin", dest="binary", default=None,
+                        help="the 3proxy binary to test")
+    parser.add_argument("--keep", action="store_true",
+                        help="keep the temporary directory")
+    parser.add_argument("-v", "--verbose", action="store_true",
+                        help="print every check, not just the failures")
+    args = parser.parse_args()
+
+    binary = args.binary or os.environ.get("BIN") or default_binary()
+    binary = os.path.abspath(binary)
+    if not os.path.isfile(binary):
+        print(f"no 3proxy binary at {binary} (build first, or pass --bin)",
+              file=sys.stderr)
+        return 2
+
+    case_dir = os.path.join(ROOT, "tests", "cases")
+    paths = sorted(os.path.join(case_dir, f) for f in os.listdir(case_dir)
+                   if f.endswith(".py") and not f.startswith("_"))
+    paths = [p for p in paths if args.pattern in os.path.basename(p)]
+    if not paths:
+        print(f"no cases matched {args.pattern!r}", file=sys.stderr)
+        return 2
+
+    tmpdir = tempfile.mkdtemp(prefix="3proxy-tests.")
+    print(f"3proxy tests: {binary}")
+    print(f"working in:   {tmpdir}\n")
+
+    passed = failed = skipped = 0
+    failures = []
+
+    try:
+        for path in paths:
+            name, module = load_case(path)
+            print(f"  {name}")
+            tester = Tester(binary, tmpdir, name)
+            error = None
+            try:
+                module.run(tester)
+            except Failure as exc:
+                error = str(exc)
+            except Exception:
+                error = traceback.format_exc()
+            finally:
+                tester.stop_all()
+
+            for status, label, expected, actual in tester.checks:
+                if status is None:
+                    skipped += 1
+                    print(f"    skip {label}")
+                elif status:
+                    passed += 1
+                    if args.verbose:
+                        print(f"    ok   {label}")
+                else:
+                    failed += 1
+                    failures.append(f"{name}: {label}")
+                    print(f"    FAIL {label}")
+                    if expected is not None:
+                        print(f"         expected: {expected}")
+                    if actual is not None:
+                        print(f"         actual:   {actual}")
+
+            if tester.checks and any(status is False for status, _, _, _ in tester.checks):
+                for name, text in tester.logs:
+                    lines = [line for line in text.splitlines() if line.strip()]
+                    if not lines:
+                        continue
+                    print(f"    --- {name} said ---")
+                    for line in lines[-12:]:
+                        print(f"      {line}")
+
+            if error:
+                failed += 1
+                failures.append(f"{name}: case aborted")
+                print("    ERROR the case could not finish:")
+                for line in error.rstrip().splitlines():
+                    print(f"      {line}")
+            print()
+    finally:
+        if args.keep:
+            print(f"temporary files left in {tmpdir}")
+        else:
+            shutil.rmtree(tmpdir, ignore_errors=True)
+
+    print("-" * 41)
+    total = passed + failed
+    summary = f"cases: {len(paths)}   checks: {total}   passed: {passed}   failed: {failed}"
+    if skipped:
+        summary += f"   skipped: {skipped}"
+    print(summary)
+    for item in failures:
+        print(f"  FAIL {item}")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())