2026-09-29 16:55:51 +08:00
34 changed files with 957 additions and 1195 deletions
--- a/.github/workflows/build-rpm-arm64.yml
+++ b/.github/workflows/build-rpm-arm64.yml
@ -26,11 +26,7 @@ jobs:
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
-       BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h)
-       [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S)
-       echo "VERSION=$BUILDDATE" >> $GITHUB_ENV
-       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
-       echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV
+       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
    - name: echo env
      run: echo "release $RELEASE version $VERSION"
    - name: Linux libraries
@ -47,37 +43,11 @@ jobs:
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
    - name: rpmbuild
      run: |
-       mkdir -p rpmout
-       for EL in 8 9 10; do
-         docker run --rm \
-           -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \
-           -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \
-           -v "$PWD/rpmout:/out" \
-           -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \
-           -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
-           "almalinux:$EL" bash -c '
-             set -e
-             dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip
-             mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
-             cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz
-             ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
-             cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
+       ret=`pwd`
       cd ~/rpmbuild/SPECS
-             rpmbuild -ba \
-               --define "use_source_date_epoch_as_buildtime 1" \
-               --define "clamp_mtime_to_source_date_epoch 1" \
-               --define "_buildhost 3proxy.org" \
-               3proxy-$RELEASE.spec
-             cp ~/rpmbuild/RPMS/*/*.rpm /out/
-             chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm'
-       done
-       for f in rpmout/*.rpm; do
-         dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//')
-         arch=$(rpm -qp --qf '%{ARCH}' "$f")
-         mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm"
-       done
-       rmdir rpmout
-       ls -l *.rpm
+       rpmbuild -ba 3proxy-$RELEASE.spec
+       cd $ret
+       mv ~/rpmbuild/RPMS/aarch64/3proxy-$RELEASE-1.aarch64.rpm 3proxy-$RELEASE.arm64.rpm
    - name: Get artifact rpm
      uses: actions/upload-artifact@v7
      with:
@ -85,26 +55,18 @@ jobs:
       path: "*.rpm"
    - name: debbuild
      run: |
-        docker run --rm \
-          -v "$HOME/debian:/debian" \
-          -e RELEASE="$RELEASE" -e VERSION="$VERSION" \
-          -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
-          ubuntu:22.04 bash -c '
-            set -e
-            export DEBIAN_FRONTEND=noninteractive
-            apt-get update
-            apt-get install -y build-essential debhelper fakeroot libssl-dev libpcre2-dev libpam0g-dev
-            cd /debian
+        ret=`pwd`
+        cd ~/debian/
        tar xzf 3proxy_$RELEASE.orig.tar.gz
        cd 3proxy-$RELEASE
-            { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium"
-              echo " "
-              echo "  *3proxy $RELEASE build"
-              echo " "
-              echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
-              echo ""
-            } > debian/changelog
-            dpkg-buildpackage'
+        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
+        echo " " >>debian/changelog
+        echo "  *3proxy $RELEASE build" >>debian/changelog
+        echo " " >>debian/changelog
+        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
+        echo "">>debian/changelog
+        dpkg-buildpackage
+        cd $ret
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_arm64.deb ./3proxy-$RELEASE.arm64.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
--- a/.github/workflows/build-rpm-armhf.yml
+++ b/.github/workflows/build-rpm-armhf.yml
@ -1,4 +1,4 @@
-name: DEB build armhf
+name: RPM/DEB build armhf

 on:
  release:
@ -26,12 +26,35 @@ jobs:
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
-       BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h)
-       [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S)
-       echo "VERSION=$BUILDDATE" >> $GITHUB_ENV
-       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
-       echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV
-    - name: configure deb env
+       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
+    - name: Linux libraries
+      run: |
+       sudo apt update
+       sudo dpkg --add-architecture armhf
+       echo "Types: deb" > ~/ubuntu.sources
+       echo "URIs: http://archive.ubuntu.com/ubuntu/" >> ~/ubuntu.sources 
+       echo "Suites: noble noble-updates noble-backports" >> ~/ubuntu.sources 
+       echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources 
+       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources 
+       echo "Architectures: amd64" >> ~/ubuntu.sources 
+       echo "" >> ~/ubuntu.sources 
+       echo "Types: deb" >> ~/ubuntu.sources 
+       echo "URIs: http://security.ubuntu.com/ubuntu/" >> ~/ubuntu.sources 
+       echo "Suites: noble-security" >> ~/ubuntu.sources 
+       echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources 
+       echo "Architectures: amd64" >> ~/ubuntu.sources 
+       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources 
+       echo "" >> ~/ubuntu.sources 
+       echo "Types: deb" >>~/ubuntu.sources 
+       echo "URIs: http://ports.ubuntu.com/ubuntu-ports/" >>~/ubuntu.sources
+       echo "Suites: noble noble-updates" >>~/ubuntu.sources
+       echo "Components: main restricted universe multiverse" >>~/ubuntu.sources
+       echo "Architectures: armhf" >>~/ubuntu.sources
+       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >>~/ubuntu.sources
+       sudo cp ~/ubuntu.sources /etc/apt/sources.list.d/ubuntu.sources
+       sudo apt update
+       sudo apt install libssl3t64:armhf openssl:armhf libssl-dev:armhf libpam0g:armhf libpam0g-dev:armhf libpcre2-dev:armhf rpm crossbuild-essential-armhf build-essential debhelper
+    - name: configure rpm env
      run: |
       mkdir ~/debian
       mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
@ -39,37 +62,44 @@ jobs:
       ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
       cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
+    - name: rpmbuild
+      run: |
+       ret=`pwd`
+       cd ~/rpmbuild/SPECS
+       PATH=/usr/arm-linux-gnueabihf/bin:$PATH
+       export PATH=$PATH
+       CC=arm-linux-gnueabihf-gcc
+       export CC=$CC
+       export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
+       export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
+       rpmbuild -ba --define "PAMLIB pam0g" --define "_arch arm" --define "cross yes" --target=arm-linux-gnueabihf 3proxy-$RELEASE.spec
+       cd $ret
+       mv ~/rpmbuild/RPMS/arm/3proxy-$RELEASE-1.arm.rpm 3proxy-$RELEASE.arm.rpm
+    - name: Get artifact rpm
+      uses: actions/upload-artifact@v7
+      with:
+       name: "3proxy-${{ env.RELEASE }}-arm.rpm"
+       path: "*.rpm"
    - name: debbuild
      run: |
-        docker run --rm \
-          -v "$HOME/debian:/debian" \
-          -e RELEASE="$RELEASE" -e VERSION="$VERSION" \
-          -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
-          ubuntu:22.04 bash -c '
-            set -e
-            export DEBIAN_FRONTEND=noninteractive
-            dpkg --add-architecture armhf
-            sed -i "s|^deb |deb [arch=amd64] |" /etc/apt/sources.list
-            { echo "deb [arch=armhf] http://ports.ubuntu.com/ubuntu-ports jammy main restricted universe multiverse"
-              echo "deb [arch=armhf] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted universe multiverse"
-            } >> /etc/apt/sources.list
-            apt-get update
-            apt-get install -y crossbuild-essential-armhf build-essential debhelper fakeroot \
-                               libssl-dev:armhf libpcre2-dev:armhf libpam0g-dev:armhf
-            cd /debian
+        ret=`pwd`
+        cd ~/debian/
        tar xzf 3proxy_$RELEASE.orig.tar.gz
        cd 3proxy-$RELEASE
-            { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium"
-              echo " "
-              echo "  *3proxy $RELEASE build"
-              echo " "
-              echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
-              echo ""
-            } > debian/changelog
-            export PATH=/usr/arm-linux-gnueabihf/bin:$PATH
-            export CC=arm-linux-gnueabihf-gcc
+        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
+        echo " " >>debian/changelog
+        echo "  *3proxy $RELEASE build" >>debian/changelog
+        echo " " >>debian/changelog
+        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
+        echo "">>debian/changelog
+        PATH=/usr/arm-linux-gnueabihf/bin:$PATH
+        export PATH=$PATH
+        CC=arm-linux-gnueabihf-gcc
+        export CC=$CC
+        export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
        export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
-            dpkg-buildpackage'
+        dpkg-buildpackage
+        cd $ret
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_armhf.deb ./3proxy-$RELEASE.arm.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
@ -93,12 +123,45 @@ jobs:
       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
       rm -f /tmp/prime.txt
+    - name: Sign rpm
+      if: github.event_name == 'release'
+      env:
+       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      run: |
+       GPGBIN=$(command -v gpg)
+       if [ -z "$GPGBIN" ]; then echo "gpg not found"; exit 1; fi
+       umask 077
+       printf '%s' "$GPG_PASSPHRASE" > /tmp/gpgpass
+       echo test > /tmp/signtest
+       gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpgpass \
+           -u "$GPG_KEYID" --detach-sign -o /tmp/signtest.sig /tmp/signtest
+       echo "key can sign"
+       { echo "%_gpg_name $GPG_KEYID"
+         echo "%__gpg $GPGBIN"
+         echo '%__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --pinentry-mode loopback --passphrase-file /tmp/gpgpass --no-secmem-warning --digest-algo sha256 -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'
+       } > ~/.rpmmacros
+       rpm --addsign *.rpm
+       rm -f /tmp/gpgpass /tmp/signtest /tmp/signtest.sig
+       for f in *.rpm; do
+         sig=$(rpm -qp --qf '%{RSAHEADER:pgpsig}' "$f" 2>/dev/null)
+         case "$sig" in ""|"(none)")
+           sig=$(rpm -qp --qf '%{DSAHEADER:pgpsig}' "$f" 2>/dev/null) ;;
+         esac
+         case "$sig" in ""|"(none)")
+           echo "$f is not signed"
+           echo "--- rpm version ---"; rpm --version
+           echo "--- sign cmd ---"; rpm --eval '%{__gpg_sign_cmd}'
+           echo "--- secret keys ---"; gpg --list-secret-keys --with-colons | grep -E '^(sec|ssb):' || true
+           exit 1 ;;
+         esac
+         echo "$f: $sig"
+       done
    - name: Checksums and detached signatures
      if: github.event_name == 'release'
      env:
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
-       sha256sum *.deb > SHA256SUMS-arm
+       sha256sum *.rpm *.deb > SHA256SUMS-arm
       for f in *.deb SHA256SUMS-arm; do
         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
             -u "$GPG_KEYID" --armor --detach-sign "$f"
@ -110,10 +173,11 @@ jobs:
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
+          *.rpm
          *.deb
    - name: Upload to release
      if: github.event_name == 'release'
      env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.event.release.tag_name }}
-      run: gh release upload "$TAG" *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc
+      run: gh release upload "$TAG" *.rpm *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc
--- a/.github/workflows/build-rpm-x86-64.yml
+++ b/.github/workflows/build-rpm-x86-64.yml
@ -26,11 +26,7 @@ jobs:
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
-       BUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h)
-       [ -n "$BUILDDATE" ] || BUILDDATE=$(date -u +%y%m%d%H%M%S)
-       echo "VERSION=$BUILDDATE" >> $GITHUB_ENV
-       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
-       echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> $GITHUB_ENV
+       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
    - name: echo env
      run: echo "release $RELEASE version $VERSION"
    - name: Linux libraries
@ -47,37 +43,11 @@ jobs:
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
    - name: rpmbuild
      run: |
-       mkdir -p rpmout
-       for EL in 8 9 10; do
-         docker run --rm \
-           -v "$HOME/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz:/src.tar.gz:ro" \
-           -v "$PWD/scripts/rh/3proxy.spec:/3proxy.spec:ro" \
-           -v "$PWD/rpmout:/out" \
-           -e RELEASE="$RELEASE" -e HOSTUID="$(id -u)" -e HOSTGID="$(id -g)" \
-           -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
-           "almalinux:$EL" bash -c '
-             set -e
-             dnf -y install rpm-build gcc make openssl-devel pcre2-devel pam-devel tar gzip
-             mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
-             cp /src.tar.gz ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz
-             ln -sf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
-             cp /3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
+       ret=`pwd`
       cd ~/rpmbuild/SPECS
-             rpmbuild -ba \
-               --define "use_source_date_epoch_as_buildtime 1" \
-               --define "clamp_mtime_to_source_date_epoch 1" \
-               --define "_buildhost 3proxy.org" \
-               3proxy-$RELEASE.spec
-             cp ~/rpmbuild/RPMS/*/*.rpm /out/
-             chown "$HOSTUID:$HOSTGID" /out/*.rpm || chmod 0666 /out/*.rpm'
-       done
-       for f in rpmout/*.rpm; do
-         dist=$(rpm -qp --qf '%{RELEASE}' "$f" | sed 's/^1\.//')
-         arch=$(rpm -qp --qf '%{ARCH}' "$f")
-         mv "$f" "3proxy-$RELEASE.$dist.$arch.rpm"
-       done
-       rmdir rpmout
-       ls -l *.rpm
+       rpmbuild -ba 3proxy-$RELEASE.spec
+       cd $ret
+       mv ~/rpmbuild/RPMS/x86_64/3proxy-$RELEASE-1.x86_64.rpm 3proxy-$RELEASE.x86_64.rpm
    - name: Get artifact rpm
      uses: actions/upload-artifact@v7
      with:
@ -85,26 +55,18 @@ jobs:
       path: "*.rpm"
    - name: debbuild
      run: |
-        docker run --rm \
-          -v "$HOME/debian:/debian" \
-          -e RELEASE="$RELEASE" -e VERSION="$VERSION" \
-          -e SOURCE_DATE_EPOCH="$SOURCE_DATE_EPOCH" \
-          ubuntu:22.04 bash -c '
-            set -e
-            export DEBIAN_FRONTEND=noninteractive
-            apt-get update
-            apt-get install -y build-essential debhelper fakeroot libssl-dev libpcre2-dev libpam0g-dev
-            cd /debian
+        ret=`pwd`
+        cd ~/debian/
        tar xzf 3proxy_$RELEASE.orig.tar.gz
        cd 3proxy-$RELEASE
-            { echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium"
-              echo " "
-              echo "  *3proxy $RELEASE build"
-              echo " "
-              echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
-              echo ""
-            } > debian/changelog
-            dpkg-buildpackage'
+        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
+        echo " " >>debian/changelog
+        echo "  *3proxy $RELEASE build" >>debian/changelog
+        echo " " >>debian/changelog
+        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
+        echo "">>debian/changelog
+        dpkg-buildpackage
+        cd $ret
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_amd64.deb ./3proxy-$RELEASE.x86_64.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
--- a/.github/workflows/update-docs.yml
+++ b/.github/workflows/update-docs.yml
@ -1,51 +0,0 @@
-name: Update HTML documentation
-
-on:
-  push:
-    paths:
-      - 'man/**'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  docs:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v7
-
-    - name: Install groff
-      run: |
-       sudo apt-get update
-       sudo apt-get install -y groff
-
-    - name: Generate HTML from man pages
-      run: |
-       mkdir -p doc/html/man5 doc/html/man8
-       echo \<html\>\<title\>3proxy documentation\</title\>\<body\>\<h2\>3proxy documentation\</h2\> >doc/html/index.html
-       echo \<a href=\"securityen.html\"\>Security recommendations\</a\>\<br\> >>doc/html/index.html
-       echo \<a href=\"highload.html\"\>Optimizing 3proxy for high loads\</a\>\<br\> >>doc/html/index.html
-       echo \<a href=\"howtoe.html\"\>How To \(English, very incomplete\)\</a\>\<br\> >>doc/html/index.html
-       echo \<a href=\"howtor.html\"\>How To \(Russian\)\</a\>\<br\> >>doc/html/index.html
-       echo \<a href=\"devref.html\"\>Developer reference\</a\>\<br\> >>doc/html/index.html
-       echo \<h3\>Man pages:\</h3\> >>doc/html/index.html
-       cd man
-       for i in *.8; do ((bash -c "groff -mandoc -Thtml $i | grep -v DOCTYPE| grep -v text/css| grep -v 'meta ' | grep -v /style |  grep -v { |  grep -v /title | grep -v www.w3.org | grep -v CreationDate" > ../doc/html/man8/$i.html ) && echo \<br\>\<A HREF=\"man8/$i.html\"\>$i\</A\> >> ../doc/html/index.html); done
-       for i in *.5; do ((bash -c "groff -mandoc -Thtml $i | grep -v DOCTYPE| grep -v text/css| grep -v 'meta ' | grep -v /style |  grep -v { |  grep -v /title | grep -v www.w3.org | grep -v CreationDate" > ../doc/html/man5/$i.html ) && echo \<br\>\<A HREF=\"man5/$i.html\"\>$i\</A\> >> ../doc/html/index.html); done
-       cd ..
-       echo \</body\>\</html\> >>doc/html/index.html
-
-    - name: Commit
-      run: |
-       if [ -z "$(git status --porcelain doc/html)" ]; then
-         echo "documentation already up to date"
-         exit 0
-       fi
-       git config user.name "github-actions[bot]"
-       git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-       git add doc/html
-       git commit -m "Update HTML documentation from man pages"
-       git push
--- a/.github/workflows/update-version.yml
+++ b/.github/workflows/update-version.yml
@ -1,94 +0,0 @@
-name: Update version files
-
-on:
-  push:
-    paths:
-      - RELEASE
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  version:
-    permissions:
-      contents: write
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v7
-
-    - name: Regenerate version files
-      run: |
-       RELEASE=$(tr -d ' \t\r\n' < RELEASE)
-       if [ -z "$RELEASE" ]; then echo "RELEASE is empty"; exit 1; fi
-       MAJOR=$(echo "$RELEASE" | cut -d . -f 1)
-       SUBMAJOR=$(echo "$RELEASE" | cut -d . -f 2)
-       MINOR=$(echo "$RELEASE" | cut -d . -f 3)
-       SUBMINOR=$(echo "$RELEASE" | cut -d . -f 4)
-       [ -n "$SUBMAJOR" ] || SUBMAJOR=0
-       [ -n "$MINOR" ] || MINOR=0
-       [ -n "$SUBMINOR" ] || SUBMINOR=0
-
-       # The build date is minted once per release and then carried in
-       # version.h, so that rebuilding the same commit yields the same
-       # version string and the same package names.
-       OLDRELEASE=$(sed -n 's/^#define VERSION "3proxy-\(.*\)"$/\1/p' src/version.h 2>/dev/null)
-       OLDBUILDDATE=$(sed -n 's/^#define BUILDDATE "\(.*\)"$/\1/p' src/version.h 2>/dev/null)
-       if [ "$OLDRELEASE" = "$RELEASE" ] && [ -n "$OLDBUILDDATE" ]; then
-         BUILDDATE="$OLDBUILDDATE"
-       else
-         BUILDDATE=$(date -u +%y%m%d%H%M%S)
-       fi
-       echo "release $RELEASE -> $MAJOR $SUBMAJOR $MINOR $SUBMINOR, build date $BUILDDATE"
-       SOURCE_DATE_EPOCH=$(date -u -d "20${BUILDDATE:0:2}-${BUILDDATE:2:2}-${BUILDDATE:4:2} ${BUILDDATE:6:2}:${BUILDDATE:8:2}:${BUILDDATE:10:2}" +%s)
-       YEAR=$(date -u -d @$SOURCE_DATE_EPOCH +%Y)
-
-       DEBVERSION=$(head -1 debian/changelog | cut -d "(" -f 2 | cut -d ")" -f 1)
-       if [ "$DEBVERSION" != "$RELEASE-1" ]; then
-         mv debian/changelog debian/changelog.old
-         { echo "3proxy ($RELEASE-1) buster; urgency=medium"
-           echo ""
-           echo "  *3proxy $RELEASE initial build"
-           echo ""
-           echo " -- z3APA3A <3apa3a@3proxy.org>  $(date -R -u -d @$SOURCE_DATE_EPOCH)"
-           echo ""
-           cat debian/changelog.old
-         } > debian/changelog
-         rm -f debian/changelog.old
-       fi
-
-       mv scripts/rh/3proxy.spec scripts/rh/3proxy.spec.old
-       { echo "Name:           3proxy"
-         echo "Version:        $RELEASE"
-         echo "Release:        1%{?dist}"
-         tail --lines=+4 scripts/rh/3proxy.spec.old
-       } > scripts/rh/3proxy.spec
-       rm -f scripts/rh/3proxy.spec.old
-
-       { echo "#ifndef VERSION"
-         echo "#define VERSION \"3proxy-$RELEASE\""
-         echo "#endif"
-         echo "#ifndef BUILDDATE"
-         echo "#define BUILDDATE \"$BUILDDATE\""
-         echo "#endif"
-         echo "#define MAJOR3PROXY $MAJOR"
-         echo "#define SUBMAJOR3PROXY $SUBMAJOR"
-         echo "#define MINOR3PROXY $MINOR"
-         echo "#define SUBMINOR3PROXY $SUBMINOR"
-         echo "#define RELEASE3PROXY \"3proxy-$RELEASE(\" BUILDDATE \")\\0\""
-         echo "#ifndef YEAR3PROXY"
-         echo "#define YEAR3PROXY \"$YEAR\""
-         echo "#endif"
-       } > src/version.h
-
-    - name: Commit
-      run: |
-       if [ -z "$(git status --porcelain debian/changelog scripts/rh/3proxy.spec src/version.h)" ]; then
-         echo "version files already up to date"
-         exit 0
-       fi
-       git config user.name "github-actions[bot]"
-       git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-       git add debian/changelog scripts/rh/3proxy.spec src/version.h
-       git commit -m "Update version files for $(tr -d ' \t\r\n' < RELEASE)"
-       git push
--- a/.github/workflows/update-wiki.yml
+++ b/.github/workflows/update-wiki.yml
@ -1,72 +0,0 @@
-name: Update wiki
-
-on:
-  push:
-    paths:
-      - 'doc/html/**'
-  workflow_run:
-    workflows: ["Update HTML documentation"]
-    types: [completed]
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-concurrency:
-  group: update-wiki
-  cancel-in-progress: false
-
-jobs:
-  wiki:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v7
-      with:
-        ref: master
-
-    - name: Clone wiki
-      run: |
-       git clone --quiet \
-         "https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.wiki.git" wiki
-
-    - name: Copy documentation
-      run: |
-       cp -f doc/html/man8/3proxy.8.html        wiki/3proxy.md
-       cp -f doc/html/man8/3proxy_crypt.8.html  wiki/3proxy_crypt.md
-       cp -f doc/html/man8/ftppr.8.html         wiki/ftppr.md
-       cp -f doc/html/man8/pop3p.8.html         wiki/pop3p.md
-       cp -f doc/html/man8/imapp.8.html         wiki/imapp.md
-       cp -f doc/html/man8/proxy.8.html         wiki/proxy.md
-       cp -f doc/html/man8/smtpp.8.html         wiki/smtpp.md
-       cp -f doc/html/man8/socks.8.html         wiki/socks.md
-       cp -f doc/html/man8/tlspr.8.html         wiki/tlspr.md
-       cp -f doc/html/man8/tcppm.8.html         wiki/tcppm.md
-       cp -f doc/html/man8/udppm.8.html         wiki/udppm.md
-       cp -f doc/html/man5/3proxy.cfg.5.html    wiki/3proxy.cfg.md
-       cp -f doc/html/highload.html             wiki/High-Load.md
-       cp -f doc/html/howtoe.html               wiki/How-To.md
-       cp -f doc/html/howtor.html               "wiki/How-To-(русский).md"
-       cp -f doc/html/securityen.html           wiki/Security-recommendations.md
-       cp -f doc/html/devel/devref.html         wiki/DevelopeReference.md
-       cp -f doc/html/plugins/TransparentPlugin.html          wiki/TransparentPlugin.md
-       cp -f doc/html/plugins/StringsPlugin.html              wiki/StringsPlugin.md
-       cp -f doc/html/plugins/TrafficPlugin.html              wiki/TrafficPlugin.md
-       cp -f doc/html/plugins/WindowsAuthentication.html      wiki/WindowsAuthentication.md
-       cp -f doc/html/plugins/TransparentPlugin.ru.html       "wiki/TransparentPlugin-(русский).md"
-       cp -f doc/html/plugins/StringsPlugin.ru.html           "wiki/StringsPlugin-(русский).md"
-       cp -f doc/html/plugins/TrafficPlugin.ru.html           "wiki/TrafficPlugin-(русский).md"
-       cp -f doc/html/plugins/WindowsAuthentication.ru.html   "wiki/WindowsAuthentication-(русский).md"
-
-    - name: Commit
-      run: |
-       cd wiki
-       if [ -z "$(git status --porcelain)" ]; then
-         echo "wiki already up to date"
-         exit 0
-       fi
-       git status --short
-       git config user.name "github-actions[bot]"
-       git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-       git add -A
-       git commit -m "Update documentation from master"
-       git push
--- a/3proxy-release-key-ed25519.asc
+++ b/3proxy-release-key-ed25519.asc
@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEaogJthYJKwYBBAHaRw8BAQdA8rZ4l90kTOSrlosP0yyeX6jFGfiFFizawjS0
+vyQnmu60KjNwcm94eSByZWxlYXNlIHNpZ25pbmcgPDNwcm94eUAzcHJveHkub3Jn
+PoivBBMWCgBXFiEEvHxfo3tIuOfF5ScUw2JYsMbAg6oFAmqICbYbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
+AAoJEMNiWLDGwIOqBHIA/iRus5VEqL+v6nYQ+GDLDUZJzMfFcnDBI+BOOhiESnTp
+AP4s3uvhigRcdutxkYwSXBlJ+7wE1yZeuUmjPoJXvgNaDw==
+=Ngp2
+-----END PGP PUBLIC KEY BLOCK-----
--- a/29
+++ b/29
@ -1,13 +1,18 @@
-3proxy-1.0.0 Released August, 22 2026
+3proxy-0.9.9 Released August, 20 2026

-No changes in 3proxy code, this release only changes how packages are built, signed and published.
-
-! Fix: TLS, PCRE2 and PAM support was silently left out when 3proxy was built on a system whose /bin/sh is not dash, which is every RPM based distribution and macOS; the library checks built their test program with echo and escape sequences, which only dash expands, so every check failed and the features were dropped without a diagnostic
-! Fix: rpm packages were built on Ubuntu and required glibc 2.38, libssl.so.3 and libpcre2-8, which no RPM based distribution provides, so they could not be installed anywhere; they are built against AlmaLinux 8, 9 and 10 now and carry an el8, el9 or el10 tag, covering RHEL, AlmaLinux, Rocky and CentOS Stream of the same version
-! Fix: the rpm package depended on its own interpreter, /bin/3proxy, taken from the first line of the installed configuration file, and could not be installed on el9 or el10 because rpm resolves that dependency to /usr/bin/3proxy
-! Fix: deb packages required glibc 2.38 and libssl3t64 and installed on Ubuntu 24.04 and newer only; they are built against Ubuntu 22.04 now and install on Ubuntu 22.04 and later as well as Debian 12 and later
-+ Signed apt and dnf repositories are published at https://3proxy.org/repo/ in two channels: current, built from the master branch, and lts, built from the 0.9 branch; packages and repository metadata are both signed
-+ Release binaries are published with SHA256 checksums, an OpenPGP signature and a GitHub build provenance attestation; docker images are signed and attested as well
-+ The release signing key is an RSA-4096 key published as 3proxy-release-key.asc in the repository; rpm 4.14 and earlier can not import an Ed25519 key at all, which would leave RHEL 8 and its derivatives unable to verify anything
-+ Packages are reproducible: rebuilding a release produces byte identical deb and rpm files, every timestamp is derived from the build date recorded for the release
- 32-bit ARM (armhf) is published as a deb package only, Enterprise Linux has no 32-bit ARM build
+! Fix: DNS replies are validated now: a reply from an address other than the nameserver the query was sent to, and a reply with a question section not matching the query, are dropped; both were accepted before
+! Fix: socket leak with SOCKSv5 UDP ASSOCIATE through a parent proxy, sockets were accumulated in CLOSE_WAIT state until descriptors ran out
+! Fix: file descriptor leak in HTTP proxy on the ftp:// request path
+! Fix: crash with illegal instruction on some platforms (e.g. some musl based Linux builds), caused by a memcpy on overlapping buffers
+! Fix: extip and ha (HAProxy PROXY protocol) parents are applied to SOCKSv5 UDP ASSOCIATE now
+! Fix: only socks5 and socks5+ parents are tried for UDP ASSOCIATE, other parent types can not be used for UDP
+! Fix: udppm through a SOCKSv5 parent did not work
+! Fix: -Ne and -Ni options were never applied, the option letter was not parsed; -Ne is not applied to the UDP ASSOCIATE reply anymore, -Ni is applied to it
+! Fix: -4 / -6 handling for UDP in socks; a single UDP association can use both IPv4 and IPv6 destinations now
+! Fix: a datagram with a null destination address is dropped now
+! Fix: DNS over TCP: a reply which did not fit a single read was never processed
+! Documentation: "How to apply ACLs to UDP traffic" added to HOWTO; authentication cache, ACL and UDP notes added to "Optimizing 3proxy for High Load" and to security recommendations
+ SOCKSv5 UDP: the destination of every datagram is authorized, so ACLs limiting the destination address, host name or port apply to UDP traffic now; the parent proxy and the external address are selected for the destination of the datagram and not for the UDP ASSOCIATE request
+ socks: -U option to control what happens when the destination changes within an UDP association: log it, authorize it, both (default) or neither
+ -C option (for TCP services) to terminate the session as soon as any of the sides closes the connection; by default the session is kept until both sides close it (TCP half-close)
+ timeouts: LINGER value added (11th, default 5), used to deliver buffered data after one of the sides has closed its sending side and as SO_LINGER value on outgoing connections
--- a/CHANGELOG.rus
+++ b/CHANGELOG.rus
@ -1,13 +1,18 @@
-3proxy-1.0.0 Вышел 22 Августа 2026
+3proxy-0.9.9 Вышел 20 Августа 2026

-Изменений в коде 3proxy нет, этот выпуск меняет только сборку, подписывание и публикацию пакетов.
-
-! Исправление: поддержка TLS, PCRE2 и PAM молча не включалась при сборке в системах, где /bin/sh не dash, то есть во всех дистрибутивах на основе RPM и в macOS; проверки наличия библиотек формировали тестовую программу через echo с escape-последовательностями, которые раскрывает только dash, поэтому все проверки завершались неудачно и возможности отключались без каких-либо сообщений
-! Исправление: пакеты rpm собирались в Ubuntu и требовали glibc 2.38, libssl.so.3 и libpcre2-8, которых нет ни в одном дистрибутиве на основе RPM, поэтому установить их было невозможно нигде; теперь они собираются в AlmaLinux 8, 9 и 10 и содержат метку el8, el9 или el10, что покрывает RHEL, AlmaLinux, Rocky и CentOS Stream соответствующей версии
-! Исправление: пакет rpm зависел от собственного интерпретатора /bin/3proxy, взятого из первой строки устанавливаемого файла конфигурации, и не устанавливался в el9 и el10, поскольку rpm приводит эту зависимость к /usr/bin/3proxy
-! Исправление: пакеты deb требовали glibc 2.38 и libssl3t64 и устанавливались только в Ubuntu 24.04 и новее; теперь они собираются в Ubuntu 22.04 и устанавливаются в Ubuntu 22.04 и новее, а также в Debian 12 и новее
-+ Подписанные репозитории apt и dnf публикуются на https://3proxy.org/repo/ в двух каналах: current, собираемый из ветки master, и lts, собираемый из ветки 0.9; подписываются и пакеты, и метаданные репозитория
-+ Двоичные файлы релиза публикуются с контрольными суммами SHA256, подписью OpenPGP и подтверждением происхождения сборки GitHub (build provenance attestation); образы docker также подписываются и снабжаются подтверждением
-+ Ключ подписи релизов — RSA-4096, опубликован в репозитории как 3proxy-release-key.asc; rpm версии 4.14 и более ранние вообще не могут импортировать ключ Ed25519, что лишило бы RHEL 8 и производные от него возможности проверки
-+ Пакеты воспроизводимы: повторная сборка релиза даёт побайтово идентичные файлы deb и rpm, все отметки времени берутся из даты сборки, записанной для релиза
- Для 32-битной ARM (armhf) публикуется только пакет deb, в Enterprise Linux нет сборки для 32-битной ARM
+! Исправление: ответы DNS теперь проверяются: ответ с адреса, отличного от адреса сервера имён, которому был отправлен запрос, а также ответ с секцией вопроса, не совпадающей с запросом, отбрасываются; ранее оба принимались
+! Исправление: утечка сокетов при SOCKSv5 UDP ASSOCIATE через вышестоящий прокси, сокеты накапливались в состоянии CLOSE_WAIT до исчерпания дескрипторов
+! Исправление: утечка файловых дескрипторов в HTTP-прокси на пути обработки запроса ftp://
+! Исправление: аварийное завершение с недопустимой инструкцией на некоторых платформах (например, в некоторых сборках Linux на основе musl) из-за memcpy на перекрывающихся буферах
+! Исправление: родители типа extip и ha (HAProxy PROXY protocol) теперь применяются к SOCKSv5 UDP ASSOCIATE
+! Исправление: для UDP ASSOCIATE используются только родители socks5 и socks5+, остальные типы для UDP неприменимы
+! Исправление: udppm через вышестоящий прокси SOCKSv5 не работал
+! Исправление: опции -Ne и -Ni никогда не применялись, буква опции не разбиралась; -Ne больше не применяется к ответу на UDP ASSOCIATE, -Ni применяется к нему
+! Исправление: обработка -4 / -6 для UDP в socks; одна UDP-ассоциация теперь может использовать адреса назначения и IPv4, и IPv6
+! Исправление: датаграмма с нулевым адресом назначения теперь отбрасывается
+! Исправление: DNS поверх TCP: ответ, не помещавшийся в одно чтение, никогда не обрабатывался
+! Документация: в HOWTO добавлен раздел "Как применять ACL к UDP-трафику"; в "Optimizing 3proxy for High Load" и в рекомендации по безопасности добавлены заметки о кэше аутентификации, ACL и UDP
+ SOCKSv5 UDP: адрес назначения каждой датаграммы авторизуется, поэтому ACL, ограничивающие адрес назначения, имя хоста или порт, теперь применяются к UDP-трафику; вышестоящий прокси и внешний адрес выбираются для адреса назначения датаграммы, а не для запроса UDP ASSOCIATE
+ socks: опция -U для управления тем, что происходит при смене адреса назначения в рамках UDP-ассоциации: журналировать, авторизовать, и то и другое (по умолчанию) или ничего
+ Опция -C (для TCP-сервисов) завершает сессию, как только любая из сторон закрывает соединение; по умолчанию сессия сохраняется, пока соединение не закроют обе стороны (полузакрытие TCP)
+ timeouts: добавлено значение LINGER (11-е, по умолчанию 5), используется для доставки буферизованных данных после того, как одна из сторон закрыла свою передающую сторону, а также как значение SO_LINGER для исходящих соединений
--- a/Makefile.FreeBSD
+++ b/Makefile.FreeBSD
@ -52,14 +52,14 @@ ifeq ($(LIBSTATIC), true)
    STATIC_SUFFIX = -Wl,-Bdynamic
    ZLIB = -lz -lzstd
 endif
-WOLFSSL_CHECK ?= $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK ?= $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK ?= $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK ?= $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL
@ -68,13 +68,13 @@ else
    ZLIB :=
 endif
 endif
-PCRE_CHECK ?= $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -lpcre2-8 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK ?= $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -lpcre2-8 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
    PCRE_LIBS = $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX)
 endif
-PAM_CHECK ?= $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
+PAM_CHECK ?= $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
--- a/Makefile.Linux
+++ b/Makefile.Linux
@ -60,14 +60,14 @@ ifeq ($(LIBSTATIC), true)
    ZLIB = -lz -lzstd
 endif

-WOLFSSL_CHECK ?= $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK ?= $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK ?= $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK ?= $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL
@ -76,13 +76,13 @@ else
    ZLIB :=
 endif
 endif
-PCRE_CHECK ?= $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK ?= $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
    PCRE_LIBS = $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX)
 endif
-PAM_CHECK ?= $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
+PAM_CHECK ?= $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
--- a/Makefile.Solaris
+++ b/Makefile.Solaris
@ -31,20 +31,20 @@ COMPATLIBS =
 MAKEFILE = Makefile.Solaris
 PLUGINS = StringsPlugin TrafficPlugin TransparentPlugin FilePlugin

-WOLFSSL_CHECK = $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testwssl testwssl.o -lwolfssl 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK = $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testwssl testwssl.o -lwolfssl 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += -lwolfssl
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
 else
-OPENSSL_CHECK = $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testssl testssl.o -lcrypto -lssl 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK = $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testssl testssl.o -lcrypto -lssl 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += -l crypto -l ssl
    CFLAGS += -DWITH_SSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
 endif
 endif
-PCRE_CHECK = $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -Wl,-Bstatic -lpcre2-8 -Wl,-Bdynamic 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK = $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) -Wl,-Bstatic -lpcre2-8 -Wl,-Bdynamic 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
--- a/Makefile.unix
+++ b/Makefile.unix
@ -54,14 +54,14 @@ ifeq ($(LIBSTATIC), true)
    STATIC_SUFFIX = -Wl,-Bdynamic
    ZLIB = -lz -lzstd
 endif
-WOLFSSL_CHECK ?= $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
+WOLFSSL_CHECK ?= $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testwssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestwssl testwssl.o $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) 2>/dev/null && rm testwssl testwssl.o && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK ?= $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
+OPENSSL_CHECK ?= $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testssl.o - 2>/dev/null && $(CC) $(LDFLAGS) -otestssl testssl.o $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl  $(STATIC_SUFFIX) 2>/dev/null && rm testssl testssl.o && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -lcrypto -lssl $(STATIC_SUFFIX)
    CFLAGS += -DWITH_SSL
@ -70,13 +70,13 @@ else
    ZLIB :=
 endif
 endif
-PCRE_CHECK ?= $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
+PCRE_CHECK ?= $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n\#include <pcre2.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpcre.o - 2>/dev/null && $(CC) -o testpcre testpcre.o $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) 2>/dev/null && rm testpcre testpcre.o && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
    PCRE_LIBS = $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX)
 endif
-PAM_CHECK ?= $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
+PAM_CHECK ?= $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d \\\\ | $(CC) -x c $(CFLAGS) -o testpam.o - 2>/dev/null && $(CC) $(LDFLAGS) -o testpam testpam.o -lpam 2>/dev/null && rm testpam testpam.o && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
--- a/Makefile.win
+++ b/Makefile.win
@ -47,14 +47,14 @@ ifeq ($(LIBSTATIC), true)
    STATIC_SUFFIX = -Wl,-Bdynamic
    ZLIB = -lz
 endif
-WOLFSSL_CHECK = $(shell printf "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) -o testwssl - 2>/dev/null && rm testwssl && echo true||echo false)
+WOLFSSL_CHECK = $(shell echo "\#include <wolfssl/options.h>\\n\#include <wolfssl/openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) -o testwssl - 2>/dev/null && rm testwssl && echo true||echo false)
 ifeq ($(WOLFSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) -lwolfssl $(STATIC_SUFFIX) -lws2_32
    CFLAGS += -DWITH_SSL -DWITH_WOLFSSL
    SSL_OBJS = ssllib$(OBJSUFFICS) ssl$(OBJSUFFICS)
    ZLIB :=
 else
-OPENSSL_CHECK = $(shell printf "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX) -o testssl - 2>/dev/null && rm testssl && echo true||echo false)
+OPENSSL_CHECK = $(shell echo "\#include <openssl/ssl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX) -o testssl - 2>/dev/null && rm testssl && echo true||echo false)
 ifeq ($(OPENSSL_CHECK), true)
    LIBS += $(STATIC_PREFIX) $(ZLIB) -l crypto -l ssl $(STATIC_SUFFIX) -lcrypt32
    CFLAGS += -DWITH_SSL
@ -63,11 +63,11 @@ else
    ZLIB :=
 endif
 endif
-PAM_CHECK = $(shell printf "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) -l pam -o testpam - 2>/dev/null && rm testpam && echo true||echo false)
+PAM_CHECK = $(shell echo "\#include <security/pam_appl.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) -l pam -o testpam - 2>/dev/null && rm testpam && echo true||echo false)
 ifeq ($(PAM_CHECK), true)
    PLUGINS += PamAuth
 endif
-PCRE_CHECK = $(shell printf "\#define PCRE2_CODE_UNIT_WIDTH 8\\n#include <pcre2.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) -o testpcre - 2>/dev/null && rm testpcre && echo true||echo false)
+PCRE_CHECK = $(shell echo "\#define PCRE2_CODE_UNIT_WIDTH 8\\n#include <pcre2.h>\\n int main(){return 0;}" | tr -d '\\\\' | $(CC) -x c $(CFLAGS) $(LDFLAGS) $(STATIC_PREFIX) -lpcre2-8 $(STATIC_SUFFIX) -o testpcre - 2>/dev/null && rm testpcre && echo true||echo false)
 ifeq ($(PCRE_CHECK), true)
    CFLAGS += -DWITH_PCRE
    PCRE_OBJS = pcre$(OBJSUFFICS)
--- a/README.md
+++ b/README.md
@ -14,44 +14,6 @@

 https://github.com/3proxy/3proxy/releases

-### Package repository (apt / dnf)
-
-Signed apt and dnf repositories are published at https://3proxy.org/repo/ in
-two channels: `current` (master) and `lts` (0.9 branch).
-
-Debian 12 and Ubuntu 22.04 or newer:
-
-```
-sudo curl -fsSL https://3proxy.org/repo/3proxy-release-key.asc \
-     -o /usr/share/keyrings/3proxy.asc
-sudo tee /etc/apt/sources.list.d/3proxy.sources <<EOF
-Types: deb
-URIs: https://3proxy.org/repo/deb
-Suites: current
-Components: main
-Signed-By: /usr/share/keyrings/3proxy.asc
-EOF
-sudo apt update && sudo apt install 3proxy
-```
-
-AlmaLinux, RHEL, Rocky and CentOS Stream 8, 9 and 10:
-
-```
-sudo tee /etc/yum.repos.d/3proxy.repo <<EOF
-[3proxy]
-name=3proxy
-baseurl=https://3proxy.org/repo/rpm/current/el\$releasever/\$basearch/
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=https://3proxy.org/repo/3proxy-release-key.asc
-EOF
-sudo dnf install 3proxy
-```
-
-Both the packages and the repository metadata are signed. See
-https://3proxy.org/repo/ for the `lts` channel and for release key details.
-
 ### Docker images

 https://hub.docker.com/r/3proxy/3proxy
--- a/2
+++ b/2
@ -1 +1 @@
-1.0.0
+0.9.9
--- a/SECURITY.md
+++ b/SECURITY.md
@ -33,6 +33,12 @@ Import it once:
 gpg --import 3proxy-release-key.asc
 ```

+Releases up to and including 0.9.9 were signed with an Ed25519 key, kept as
+`3proxy-release-key-ed25519.asc` for verifying those older files. Note that
+rpm 4.14 and earlier (RHEL/CentOS 8 and older) cannot import an Ed25519 key
+and will report `SIGNATURES NOT OK`; use the RSA key and 0.9.9.1 or later on
+those systems.
+
 Checksums and the checksum file signature:

 ```
--- a/debian/changelog
+++ b/debian/changelog
@ -1,9 +1,3 @@
-3proxy (1.0.0-1) buster; urgency=medium
-
-  *3proxy 1.0.0 initial build
-
- -- z3APA3A <3apa3a@3proxy.org>  Sat, 22 Aug 2026 12:13:00 +0000
-
 3proxy (0.9.9-1) buster; urgency=medium

  *3proxy 0.9.9 initial build
--- a/doc/changelog/1/0/0
+++ b/doc/changelog/1/0/0
@ -1,11 +0,0 @@
-No changes in 3proxy code, this release only changes how packages are built, signed and published.
-
-! Fix: TLS, PCRE2 and PAM support was silently left out when 3proxy was built on a system whose /bin/sh is not dash, which is every RPM based distribution and macOS; the library checks built their test program with echo and escape sequences, which only dash expands, so every check failed and the features were dropped without a diagnostic
-! Fix: rpm packages were built on Ubuntu and required glibc 2.38, libssl.so.3 and libpcre2-8, which no RPM based distribution provides, so they could not be installed anywhere; they are built against AlmaLinux 8, 9 and 10 now and carry an el8, el9 or el10 tag, covering RHEL, AlmaLinux, Rocky and CentOS Stream of the same version
-! Fix: the rpm package depended on its own interpreter, /bin/3proxy, taken from the first line of the installed configuration file, and could not be installed on el9 or el10 because rpm resolves that dependency to /usr/bin/3proxy
-! Fix: deb packages required glibc 2.38 and libssl3t64 and installed on Ubuntu 24.04 and newer only; they are built against Ubuntu 22.04 now and install on Ubuntu 22.04 and later as well as Debian 12 and later
-+ Signed apt and dnf repositories are published at https://3proxy.org/repo/ in two channels: current, built from the master branch, and lts, built from the 0.9 branch; packages and repository metadata are both signed
-+ Release binaries are published with SHA256 checksums, an OpenPGP signature and a GitHub build provenance attestation; docker images are signed and attested as well
-+ The release signing key is an RSA-4096 key published as 3proxy-release-key.asc in the repository; rpm 4.14 and earlier can not import an Ed25519 key at all, which would leave RHEL 8 and its derivatives unable to verify anything
-+ Packages are reproducible: rebuilding a release produces byte identical deb and rpm files, every timestamp is derived from the build date recorded for the release
- 32-bit ARM (armhf) is published as a deb package only, Enterprise Linux has no 32-bit ARM build
--- a/doc/html/index.html
+++ b/doc/html/index.html
@ -5,8 +5,8 @@
 <a href="howtor.html">How To (Russian)</a><br>
 <a href="devref.html">Developer reference</a><br>
 <h3>Man pages:</h3>
-<br><A HREF="man8/3proxy.8.html">3proxy.8</A>
 <br><A HREF="man8/3proxy_crypt.8.html">3proxy_crypt.8</A>
+<br><A HREF="man8/3proxy.8.html">3proxy.8</A>
 <br><A HREF="man8/ftppr.8.html">ftppr.8</A>
 <br><A HREF="man8/imapp.8.html">imapp.8</A>
 <br><A HREF="man8/pop3p.8.html">pop3p.8</A>
--- a/doc/html/man5/3proxy.cfg.5.html
+++ b/doc/html/man5/3proxy.cfg.5.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -31,7 +31,7 @@



-<p style="margin-left:9%; margin-top: 1em"><b>3proxy.cfg</b>
+<p style="margin-left:6%; margin-top: 1em"><b>3proxy.cfg</b>
 3proxy configuration file</p>

 <h2>DESCRIPTION
@ -39,7 +39,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Common
+<p style="margin-left:6%; margin-top: 1em">Common
 structure: <br>
 Configuration file is a text file 3proxy reads configuration
 from. Each line of the file is a command executed
@ -51,12 +51,12 @@ command line. Additional space characters are ignored. Think
 about 3proxy as &quot;application level router&quot; with
 console interface.</p>

-<p style="margin-left:9%; margin-top: 1em">Comments: <br>
+<p style="margin-left:6%; margin-top: 1em">Comments: <br>
 Any line beginning with a space character or &acute;#&acute;
 character is a comment. It&acute;s ignored. &lt;LF&gt;s are
 ignored. &lt;CR&gt; is the end of a command.</p>

-<p style="margin-left:9%; margin-top: 1em">Quotation: <br>
+<p style="margin-left:6%; margin-top: 1em">Quotation: <br>
 The quotation character is &quot; (double quote). Quotation
 must be used to quote spaces or other special characters. To
 use a quotation character inside a quoted string, the
@ -65,7 +65,7 @@ to use HELLO &quot;WORLD&quot; as an argument, you should
 write it as &quot;HELLO &quot;&quot;WORLD&quot;&quot;&quot;.
 Good practice is to quote any argument you use.</p>

-<p style="margin-left:9%; margin-top: 1em">File inclusion:
+<p style="margin-left:6%; margin-top: 1em">File inclusion:
 <br>
 You can include file by using $FILENAME macro (replace
 FILENAME with a path to file, for example
@ -80,10 +80,10 @@ commands (like userlist, network lists, etc). To use dollar
 sign somewhere in argument it must be quoted. Recursion is
 not allowed.</p>

-<p style="margin-left:9%; margin-top: 1em">Next commands
+<p style="margin-left:6%; margin-top: 1em">Next commands
 start gateway services:</p>

-<p style="margin-left:9%; margin-top: 1em"><b>proxy</b>
+<p style="margin-left:6%; margin-top: 1em"><b>proxy</b>
 [options] <b><br>
 socks</b> [options] <b><br>
 pop3p</b> [options] <b><br>
@ -119,7 +119,7 @@ destination, the port number is ignored but must be
 specified for syntax compatibility. <b><br>
 udppm</b> UDP portmapper</p>

-<p style="margin-left:9%; margin-top: 1em">Options: <b><br>
+<p style="margin-left:6%; margin-top: 1em">Options: <b><br>
 -p</b><i>NUMBER</i> change default server port to NUMBER
 <b><br>
 -6</b> Only resolve IPv6 addresses. IPv4 addresses are
@ -286,16 +286,16 @@ FTP client does it for you. That is, if you use 3proxy with
 authentication use proxyuser:proxypassword:FTPuser as FTP
 username, otherwise do not change original FTP user name</p>

-<p style="margin-left:9%; margin-top: 1em"><b>include</b>
+<p style="margin-left:6%; margin-top: 1em"><b>include</b>
 <i>&lt;path&gt;</i> <br>
 Include config file</p>

-<p style="margin-left:9%; margin-top: 1em"><b>config</b>
+<p style="margin-left:6%; margin-top: 1em"><b>config</b>
 <i>&lt;path&gt;</i> <br>
 Path to configuration file to use on 3proxy restart or to
 save configuration.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>writable</b>
+<p style="margin-left:6%; margin-top: 1em"><b>writable</b>
 <br>
 ReOpens configuration file for write access via Web
 interface, and rereads it. Usually should be first command
@ -303,10 +303,10 @@ on config file but in combination with config it can be used
 anywhere to open alternate config file. Think twice before
 using it.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>end</b> <br>
+<p style="margin-left:6%; margin-top: 1em"><b>end</b> <br>
 End of configuration</p>

-<p style="margin-left:9%; margin-top: 1em"><b>log</b>
+<p style="margin-left:6%; margin-top: 1em"><b>log</b>
 [[@|&amp;]<i>logfile</i>] [<i>&lt;LOGTYPE&gt;</i>] <br>
 sets logfile for all gateways <br>
@ (for Unix) use syslog, filename is used as ident name <br>
@ -332,12 +332,12 @@ with &quot;logformat&quot; filename must begin with
 Grinwitch time zone for all time-based format
 specificators.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>rotate</b>
+<p style="margin-left:6%; margin-top: 1em"><b>rotate</b>
 <i>&lt;n&gt;</i> <br>
 how many archived log files to keep</p>


-<p style="margin-left:9%; margin-top: 1em"><b>logformat</b>
+<p style="margin-left:6%; margin-top: 1em"><b>logformat</b>
 <i>&lt;format&gt;</i> <br>
 Format for log record. First symbol in format must be L
 (local time) or G (absolute Grinwitch time). It can be
@ -349,7 +349,7 @@ logformat means comma and percent are replaced with space
 and all time based elemnts are in local time zone. <br>
 You can use:</p>

-<p style="margin-left:9%; margin-top: 1em">%y Year in 2
+<p style="margin-left:6%; margin-top: 1em">%y Year in 2
 digit format <br>
 %Y Year in 4 digit format <br>
 %m Month number <br>
@ -394,7 +394,7 @@ l_service, l_in, l_out, l_descr) values (&acute;%d-%m-%Y
 %H:%M:%S&acute;, &acute;%U&acute;, &acute;%N&acute;, %I, %O,
 &acute;%T&acute;)&quot;</p>

-<p style="margin-left:9%; margin-top: 1em"><b>logdump</b>
+<p style="margin-left:6%; margin-top: 1em"><b>logdump</b>
 <i>&lt;in_traffic_limit&gt; &lt;out_traffic_limit&gt;</i>
 <br>
 Immediately creates additional log records if given amount
@ -404,7 +404,7 @@ to prevent information about long-lasting downloads on
 server shutdown.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>delimchar</b>
+<p style="margin-left:6%; margin-top: 1em"><b>delimchar</b>
 <i>&lt;char&gt;</i> <br>
 Sets the delimiter character used to separate username from
 hostname in proxy authentication strings (e.g. for FTP, POP3
@ -412,14 +412,14 @@ proxies). Default is &acute;@&acute;. For example, to use
 &acute;#&acute; instead: delimchar #. This allows usernames
 to contain the &acute;@&acute; character.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>archiver</b>
+<p style="margin-left:6%; margin-top: 1em"><b>archiver</b>
 <i>&lt;ext&gt; &lt;commandline&gt;</i> <br>
 Archiver to use for log files. &lt;ext&gt; is file extension
 produced by archiver. Filename will be last argument to
 archiver, optionally you can use %A as produced archive name
 and %F as filename.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>timeouts</b>
+<p style="margin-left:6%; margin-top: 1em"><b>timeouts</b>
 <i>&lt;BYTE_SHORT&gt; &lt;BYTE_LONG&gt; &lt;STRING_SHORT&gt;
 &lt;STRING_LONG&gt; &lt;CONNECTION_SHORT&gt;
 &lt;CONNECTION_LONG&gt; &lt;DNS&gt; &lt;CHAIN&gt;
@ -450,14 +450,14 @@ tail of the data to be lost on slow connections, too large
 one delays release of the sockets. <br>
 default timeouts 1 5 30 60 180 1800 15 60 15 5 5</p>

-<p style="margin-left:9%; margin-top: 1em"><b>maxseg</b>
+<p style="margin-left:6%; margin-top: 1em"><b>maxseg</b>
 <i>&lt;value&gt;</i> <br>
 Sets TCP maximum segment size (MSS) for outgoing
 connections. This can be used to work around path MTU
 discovery issues or to optimize traffic for specific network
 conditions.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>radius</b>
+<p style="margin-left:6%; margin-top: 1em"><b>radius</b>
 <i>&lt;NAS_SECRET&gt;
 &lt;radius_server_1</i>[:<i>port</i>][/<i>local_address_1</i>]
 <i>&lt;radius_server_2</i>[:<i>port</i>][/<i>local_address_2</i>]
@ -484,7 +484,7 @@ user), Reply-Message. Use <b>authcache</b> to speedup
 authentication. RADIUS feature is currently
 experimental.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>nserver</b>
+<p style="margin-left:6%; margin-top: 1em"><b>nserver</b>
 <i>&lt;ipaddr&gt;</i>[:<i>port</i>][/<i>tcp</i>] <br>
 Nameserver to use for name resolutions. If none specified
 system routines for name resolution is used. Optional port
@ -492,13 +492,13 @@ number may be specified. If optional /tcp is added to IP
 address, name resolution is performed over TCP.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>authnserver</b>
+<p style="margin-left:6%; margin-top: 1em"><b>authnserver</b>
 <i>&lt;ipaddr&gt;</i>[:<i>port</i>][/<i>tcp</i>] <br>
 Nameserver to use for DNS-based authentication (e.g. dnsname
 auth type). If not specified, nserver is used. The syntax is
 the same as for nserver.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>nscache</b>
+<p style="margin-left:6%; margin-top: 1em"><b>nscache</b>
 <i>&lt;cachesize&gt;</i> <b>nscache6</b>
 <i>&lt;cachesize&gt;</i> <br>
 Cache <i>&lt;cachesize&gt;</i> records for name resolution
@ -506,7 +506,7 @@ Cache <i>&lt;cachesize&gt;</i> records for name resolution
 cache size should usually be large enough (for example,
 65536).</p>

-<p style="margin-left:9%; margin-top: 1em"><b>nsrecord</b>
+<p style="margin-left:6%; margin-top: 1em"><b>nsrecord</b>
 <i>&lt;hostname&gt; &lt;hostaddr&gt;</i> <br>
 Adds static record to nscache. <b>nscache</b> must be
 enabled. If 0.0.0.0 is used as a hostaddr host will never
@ -514,14 +514,14 @@ resolve, it can be used to blacklist something or together
 with <b>dialer</b> command to set up UDL for dialing.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>fakeresolve</b>
+<p style="margin-left:6%; margin-top: 1em"><b>fakeresolve</b>
 <br>
 All names are resolved to the 127.0.0.2 address. Useful if
 all requests are redirected to a parent proxy with
 <b>http</b>, <b>socks4+</b>, <b>connect+</b> or
 <b>socks5+</b>.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>dialer</b>
+<p style="margin-left:6%; margin-top: 1em"><b>dialer</b>
 <i>&lt;progname&gt;</i> <br>
 Execute progname if external name can&acute;t be resolved.
 Hint: if you use nscache, dialer may not work, because names
@ -529,7 +529,7 @@ will be resolved through cache. In this case you can use
 something like http://dial.right.now/ from browser to set up
 connection.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>internal</b>
+<p style="margin-left:6%; margin-top: 1em"><b>internal</b>
 <i>&lt;ipaddr&gt;</i> <br>
 sets ip address of internal interface. This IP address will
 be used to bind gateways. Alternatively you can use -i
@ -543,7 +543,7 @@ Unix sockets are supported with the syntax
 using Unix sockets, the socket file is automatically created
 and removed on service start/stop.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>external</b>
+<p style="margin-left:6%; margin-top: 1em"><b>external</b>
 <i>&lt;ipaddr&gt;</i> <br>
 sets ip address of external interface. This IP address will
 be source address for all connections made by proxy.
@ -552,7 +552,7 @@ address for gateway. Since 0.8 version External or <b>-e</b>
 can be given twice: once with IPv4 and once with IPv6
 address.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>maxconn</b>
+<p style="margin-left:6%; margin-top: 1em"><b>maxconn</b>
 <i>&lt;number&gt;</i> <br>
 sets the maximum number of simultaneous connections to each
 service started after this command at the network level.
@ -562,13 +562,13 @@ will silently ignore new connections, while <b>connlim</b>
 will report back to the client that the connection limit has
 been reached.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>backlog</b>
+<p style="margin-left:6%; margin-top: 1em"><b>backlog</b>
 <br>
 sets the listening socket backlog of new connections.
 Default is 1 + <b>maxconn</b>/8. Maximum value is capped by
 kernel tunable somaxconn.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>service</b>
+<p style="margin-left:6%; margin-top: 1em"><b>service</b>
 <br>
 (deprecated). Indicates that 3proxy should behave as a
 Windows 95/98/NT/2000/XP service; has no effect under Unix.
@ -576,7 +576,7 @@ Not required for 3proxy 0.6 and above. If you upgraded from
 a previous version of 3proxy, use --remove and --install to
 reinstall the service.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>daemon</b>
+<p style="margin-left:6%; margin-top: 1em"><b>daemon</b>
 <br>
 Should be specified to close the console. Do not use
 &acute;daemon&acute; with &acute;service&acute;. At least
@ -584,7 +584,7 @@ under FreeBSD, <b>daemon</b> should precede any proxy
 service and log commands to avoid socket problems. Always
 place it in the beginning of the configuration file.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>auth</b>
+<p style="margin-left:6%; margin-top: 1em"><b>auth</b>
 <i>&lt;authtype&gt;</i> [...] <br>
 Type of user authorization. Currently supported: <b><br>
 none</b> - no authentication or authorization required. <br>
@ -624,7 +624,7 @@ address is then restored from the cache entry. <b><br>
 radius</b> - authentication with RADIUS. <br>
 Plugins may add additional authentication types.</p>

-<p style="margin-left:9%; margin-top: 1em">It&acute;s
+<p style="margin-left:6%; margin-top: 1em">It&acute;s
 possible to use multiple authentication types in the same
 command. E.g. <br>
 auth iponly strong <br>
@ -638,7 +638,7 @@ for dedicated laptops and request a username/password for
 shared ones.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>authcache</b>
+<p style="margin-left:6%; margin-top: 1em"><b>authcache</b>
 <i>&lt;cachtype&gt; &lt;cachtime&gt; &lt;cachesize&gt;</i>
 <br>
 Cache authentication information for a given amount of time
@ -683,7 +683,7 @@ see <b>allow</b>. <br>
 Use auth type <b>cache</b> (or <b>cacheacl</b>) for cached
 authentication</p>

-<p style="margin-left:9%; margin-top: 1em"><b>allow</b>
+<p style="margin-left:6%; margin-top: 1em"><b>allow</b>
 <i>&lt;userlist&gt; &lt;sourcelist&gt; &lt;targetlist&gt;
 &lt;targetportlist&gt; &lt;operationlist&gt;
 &lt;weekdayslist&gt; &lt;timeperiodslist&gt;</i> <b><br>
@ -719,7 +719,7 @@ specific addresses immediately without any conditions you
 should either bind proxy to appropriate interface only or to
 use ip filters.</p>

-<p style="margin-left:9%; margin-top: 1em">Operation is one
+<p style="margin-left:6%; margin-top: 1em">Operation is one
 of: <b><br>
 CONNECT</b> establish outgoing TCP connection <b><br>
 BIND</b> bind TCP port for listening <b><br>
@ -743,7 +743,7 @@ remote side. <b><br>
 FTP</b> matches any FTP/FTP Data request <b><br>
 ADMIN</b> access to administration interface</p>

-<p style="margin-left:9%; margin-top: 1em">Weekdays are
+<p style="margin-left:6%; margin-top: 1em">Weekdays are
 week day numbers or periods, 0 or 7 means Sunday, 1 is
 Monday, 1-5 means Monday through Friday. <br>
 Timeperiodlists is a list of time periods in
@ -788,7 +788,7 @@ RADIUS or plugin authentication: <b>cacheacl</b> with the
 destination in the cache key if no parent proxy is used,
 <b>cache</b> otherwise, see <b>cacheacl</b>.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>parent</b>
+<p style="margin-left:6%; margin-top: 1em"><b>parent</b>
 <i>&lt;weight&gt; &lt;type&gt; &lt;ip&gt; &lt;port&gt;
 &lt;username&gt; &lt;password&gt;</i> <br>
 this command must follow &quot;allow&quot; rule. It extends
@ -818,7 +818,7 @@ connections. Chains are only applied to new connections,
 pipelined (keep-alive) requests in the same connection use
 the same chain.</p>

-<p style="margin-left:9%; margin-top: 1em">type is one of:
+<p style="margin-left:6%; margin-top: 1em">type is one of:
 <b><br>
 extip</b> does not actually redirect the request; it sets
 the external address for this request to <i>&lt;ip&gt;</i>.
@ -877,7 +877,7 @@ Requires SSL/TLS support (WITH_SSL) and is used with
 <b>ssl_client_mode 3</b>, which only handshakes TLS for
 <b>s</b>-suffixed parents.</p>

-<p style="margin-left:9%; margin-top: 1em">IP and port are
+<p style="margin-left:6%; margin-top: 1em">IP and port are
 ip addres and port of parent proxy server. If IP is zero, ip
 is taken from original request, only port is changed. If
 port is zero, it&acute;s taken from original request, only
@ -898,7 +898,7 @@ unix:@parent.proxy 3128). When using Unix sockets, the port
 number is ignored but must be specified for syntax
 compatibility.</p>

-<p style="margin-left:9%; margin-top: 1em">Main purpose of
+<p style="margin-left:6%; margin-top: 1em">Main purpose of
 local redirections is to have the requested resource (URL or
 POP3 username) logged and protocol-specific filters applied.
 In case of local redirection, ACLs are reviewed twice:
@ -923,19 +923,19 @@ parent proxy. Username of &acute;*&acute; means username
 must be supplied by user.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>parentretries</b>
+<p style="margin-left:6%; margin-top: 1em"><b>parentretries</b>
 <i>&lt;number&gt;</i> <br>
 Number of retries to connect to parent proxy. Default is
 1.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>nolog</b>
+<p style="margin-left:6%; margin-top: 1em"><b>nolog</b>
 <i>&lt;n&gt;</i> <br>
 extends last allow or deny command to prevent logging, e.g.
 <br>
 allow * * 192.168.1.1 <br>
 nolog</p>

-<p style="margin-left:9%; margin-top: 1em"><b>weight</b>
+<p style="margin-left:6%; margin-top: 1em"><b>weight</b>
 <i>&lt;n&gt;</i> <br>
 extends last allow or deny command to set weight for this
 request <br>
@ -943,7 +943,7 @@ allow * * 192.168.1.1 <br>
 weight 100 <br>
 Weight may be used for different purposes.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>force <br>
+<p style="margin-left:6%; margin-top: 1em"><b>force <br>
 noforce</b> <br>
 If force is specified for service, configuration reload will
 require all current sessions of this service to be
@ -953,7 +953,7 @@ closed. noforce allows to keep previously authenticated
 connections.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>bandlimin</b>
+<p style="margin-left:6%; margin-top: 1em"><b>bandlimin</b>
 <i>&lt;rate&gt; &lt;userlist&gt; &lt;sourcelist&gt;
 &lt;targetlist&gt; &lt;targetportlist&gt;
 &lt;operationlist&gt; &lt;weekdayslist&gt;
@ -995,7 +995,7 @@ POP3, you can use <br>
 nobandlimin * * * 110 <br>
 before the rest of bandlim rules.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>connlim</b>
+<p style="margin-left:6%; margin-top: 1em"><b>connlim</b>
 <i>&lt;rate&gt; &lt;period&gt; &lt;userlist&gt;
 &lt;sourcelist&gt; &lt;targetlist&gt; &lt;targetportlist&gt;
 &lt;operationlist&gt; &lt;weekdayslist&gt;
@ -1017,7 +1017,7 @@ required per client, a separate rule must be added for every
 client. Like with nobandlimin, noconnlim adds an
 exception.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>counter</b>
+<p style="margin-left:6%; margin-top: 1em"><b>counter</b>
 <i>&lt;filename&gt; &lt;reporttype&gt;
 &lt;reportname&gt;</i> <b><br>
 countin</b> <i>&lt;number&gt; &lt;type&gt; &lt;limit&gt;
@ -1045,7 +1045,7 @@ nocountall</b> <i>&lt;userlist&gt; &lt;sourcelist&gt;
 &lt;operationlist&gt; &lt;weekdayslist&gt;
 &lt;timeperiodslist&gt;</i></p>

-<p style="margin-left:9%; margin-top: 1em">counter,
+<p style="margin-left:6%; margin-top: 1em">counter,
 countin, nocountin, countout, nocountout, countall,
 nocountall commands are used to set a traffic limit in MB
 for a period of time (day, week or month). Filename is a
@ -1070,7 +1070,7 @@ report is a text file with counter values in the format:
 The rest of parameters is identical to
 <b>bandlim</b>/<b>nobandlim</b>.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>users</b>
+<p style="margin-left:6%; margin-top: 1em"><b>users</b>
 <i>username</i>[:<i>pwtype</i>:<i>password</i>] ... <br>
 pwtype is one of: <br>
 none (empty) - use system authentication <b><br>
@ -1088,7 +1088,7 @@ users &quot;test4:CR:$3$salt$G47yV9w....&quot; <br>
 Note: double quotes are required because the password
 contains a $ sign.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>flush</b>
+<p style="margin-left:6%; margin-top: 1em"><b>flush</b>
 <br>
 empty the active access list. The access list must be
 flushed every time you create a new access list for a new
@ -1100,35 +1100,35 @@ allow * 192.168.1.0/24 <br>
 socks <br>
 sets different ACLs for <b>pop3p</b> and <b>socks</b></p>

-<p style="margin-left:9%; margin-top: 1em"><b>system</b>
+<p style="margin-left:6%; margin-top: 1em"><b>system</b>
 <i>&lt;command&gt;</i> <br>
 execute system command</p>

-<p style="margin-left:9%; margin-top: 1em"><b>pidfile</b>
+<p style="margin-left:6%; margin-top: 1em"><b>pidfile</b>
 <i>&lt;filename&gt;</i> <br>
 write pid of current process to file. It can be used to
 manipulate 3proxy with signals under Unix. Currently next
 signals are available:</p>

-<p style="margin-left:9%; margin-top: 1em"><b>monitor</b>
+<p style="margin-left:6%; margin-top: 1em"><b>monitor</b>
 <i>&lt;filename&gt;</i> <br>
 If file monitored changes in modification time or size,
 3proxy reloads configuration within one minute. Any number
 of files may be monitored.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>setuid</b>
+<p style="margin-left:6%; margin-top: 1em"><b>setuid</b>
 <i>&lt;uid&gt;</i> <br>
 calls setuid(uid), uid can be numeric or since 0.9 username.
 Unix only. Warning: under some Linux kernels setuid() works
 for current thread only. It makes it impossible to suid for
 all threads.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>setgid</b>
+<p style="margin-left:6%; margin-top: 1em"><b>setgid</b>
 <i>&lt;gid&gt;</i> <br>
 calls setgid(gid), gid can be numeric or since 0.9
 groupname. Unix only.</p>

-<p style="margin-left:9%; margin-top: 1em"><b>chroot</b>
+<p style="margin-left:6%; margin-top: 1em"><b>chroot</b>
 <i>&lt;path&gt;</i> [<i>&lt;uid&gt;</i>]
 [<i>&lt;gid&gt;</i>] <br>
 calls chroot(path) and sets gid/uid. Unix only. uid/gid
@ -1136,7 +1136,7 @@ supported since 0.9, can be numeric or
 username/groupname</p>


-<p style="margin-left:9%; margin-top: 1em"><b>stacksize</b>
+<p style="margin-left:6%; margin-top: 1em"><b>stacksize</b>
 <i>&lt;value_to_add_to_default_stack_size&gt;</i> <br>
 Change the default size for thread stacks. May be required
 in some situations, e.g. with non-default plugins, or on
@ -1165,7 +1165,7 @@ disable the thread stack.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>plugin</b>
+<p style="margin-left:6%; margin-top: 1em"><b>plugin</b>
 <i>&lt;path_to_shared_library&gt;
 &lt;function_to_call&gt;</i> [<i>&lt;arg1&gt;</i> ...] <br>
 Loads specified library and calls given export function with
@ -1176,7 +1176,7 @@ function_to_call must return 0 in case of success, value
 &gt; 0 to indicate error.</p>


-<p style="margin-left:9%; margin-top: 1em"><b>filtermaxsize</b>
+<p style="margin-left:6%; margin-top: 1em"><b>filtermaxsize</b>
 <i>&lt;max_size_of_data_to_filter&gt;</i> <br>
 If Content-length (or another data length) is greater than
 the given value, no data filtering will be performed through
@ -1188,13 +1188,13 @@ Content-Length changing. Default is 1MB (1048576).</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">SSL/TLS support
+<p style="margin-left:6%; margin-top: 1em">SSL/TLS support
 is built into 3proxy (since 0.9.7) when compiled with
 OpenSSL (WITH_SSL). Previously available as SSLPlugin, the
 functionality is now integrated into the main binary. The
 plugin line is no longer required.</p>

-<p style="margin-left:9%; margin-top: 1em">SSL/TLS can be
+<p style="margin-left:6%; margin-top: 1em">SSL/TLS can be
 used for: - transparent MITM (Man-in-the-Middle) for TLS
 traffic inspection - https:// proxy (TLS-encrypted
 connection between client and proxy) - TLS client
@ -1207,7 +1207,7 @@ certificates</p>
 </h3>


-<p style="margin-left:9%; margin-top: 1em"><b>ssl_mitm</b>
+<p style="margin-left:6%; margin-top: 1em"><b>ssl_mitm</b>
 - spoof certificates for services started below. Usage
 without ssl_client_verify is insecure. <b><br>
 ssl_nomitm</b> - do not spoof certificates for services
@ -1218,7 +1218,7 @@ started below</p>
 </h3>


-<p style="margin-left:9%; margin-top: 1em"><b>ssl_serv</b>
+<p style="margin-left:6%; margin-top: 1em"><b>ssl_serv</b>
 (or ssl_server) - require TLS connection from clients for
 services below <b><br>
 ssl_noserv</b> (or ssl_noserver) - do not require TLS
@ -1229,7 +1229,7 @@ connection from clients for services below</p>
 </h3>


-<p style="margin-left:9%; margin-top: 1em"><b>ssl_cli</b>
+<p style="margin-left:6%; margin-top: 1em"><b>ssl_cli</b>
 (or ssl_client) - establish TLS connection to upstream
 server for services below <b><br>
 ssl_nocli</b> (or ssl_noclient) - do not establish TLS
@ -1241,7 +1241,7 @@ connection to upstream server for services below</p>



-<p style="margin-left:9%; margin-top: 1em"><b>ssl_server_cert</b>
+<p style="margin-left:6%; margin-top: 1em"><b>ssl_server_cert</b>
 <i>/path/to/cert</i> - Server certificate (should not be
 self-signed, must contain SAN) for ssl_serv <b><br>
 ssl_server_key</b> <i>/path/to/key</i> - Server certificate
@ -1306,14 +1306,14 @@ generated MITM certificates cache</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">PCRE (Perl
+<p style="margin-left:6%; margin-top: 1em">PCRE (Perl
 Compatible Regular Expressions) filtering is built into
 3proxy (since 0.9.7) when compiled with PCRE2 support
 (WITH_PCRE). Previously available as PCREPlugin, the
 functionality is now integrated into the main binary. The
 plugin line is no longer required.</p>

-<p style="margin-left:9%; margin-top: 1em">PCRE filtering
+<p style="margin-left:6%; margin-top: 1em">PCRE filtering
 allows creating matching and replacement rules with regular
 expressions for client requests, headers, and data.</p>

@ -1322,7 +1322,7 @@ expressions for client requests, headers, and data.</p>
 </h3>


-<p style="margin-left:9%; margin-top: 1em"><b>pcre</b>
+<p style="margin-left:6%; margin-top: 1em"><b>pcre</b>
 <i>TYPE FILTER_ACTION REGEXP [ACE]</i> <br>
 Apply a rule for matching regular expression. <b><br>
 pcre_rewrite</b> <i>TYPE FILTER_ACTION REGEXP
@ -1358,7 +1358,7 @@ PCRE_BSR_UNICODE.</p>
 </h3>


-<p style="margin-left:9%; margin-top: 1em">TYPE - type of
+<p style="margin-left:6%; margin-top: 1em">TYPE - type of
 filtered data (comma-delimited list): <br>
 request - content of the client&rsquo;s request (e.g., HTTP
 GET request string) <br>
@ -1369,7 +1369,7 @@ data) <br>
 srvdata - data received from the server (e.g., HTML
 page)</p>

-<p style="margin-left:9%; margin-top: 1em">FILTER_ACTION -
+<p style="margin-left:6%; margin-top: 1em">FILTER_ACTION -
 action on match: <br>
 allow - allow this request without checking the rest of the
 rules <br>
@ -1378,18 +1378,18 @@ rules <br>
 dunno - continue with the rest of the rules (useful with
 pcre_rewrite)</p>

-<p style="margin-left:9%; margin-top: 1em">REGEXP - PCRE
+<p style="margin-left:6%; margin-top: 1em">REGEXP - PCRE
 (Perl) regular expression. Use * if no regexp matching is
 required.</p>


-<p style="margin-left:9%; margin-top: 1em">REWRITE_EXPRESSION
+<p style="margin-left:6%; margin-top: 1em">REWRITE_EXPRESSION
 - substitution string. May contain Perl-style substrings $1,
 $2, etc. $0 means the whole matched string. \r and \n may be
 used to insert new lines; the string may be empty
 (&quot;&quot;).</p>

-<p style="margin-left:9%; margin-top: 1em">ACE - access
+<p style="margin-left:6%; margin-top: 1em">ACE - access
 control entry (user names, source IPs, destination IPs,
 ports, etc.), identical to allow/deny/bandlimin commands.
 The regular expression is only matched if the ACL matches
@ -1402,7 +1402,7 @@ authentication and/or allow/deny ACLs.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -1410,7 +1410,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 3proxy_crypt(8), proxy(8), ftppr(8), socks(8), pop3p(8),
 imapp(8), smtpp(8), tlspr(8), tcppm(8), udppm(8),
 syslogd(8), <br>
@ -1421,7 +1421,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/3proxy.8.html
+++ b/doc/html/man8/3proxy.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -25,7 +25,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>3proxy</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>3proxy</b> -
 3[APA3A] tiny proxy server, or trivial proxy server, or free
 proxy server</p>

@ -34,7 +34,7 @@ proxy server</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>3proxy</b>
+<p style="margin-left:6%; margin-top: 1em"><b>3proxy</b>
 [<i>config_file</i>] <b><br>
 3proxy</b> [<i>--install</i>] <b><br>
 3proxy</b> [<i>--remove</i>]</p>
@ -44,7 +44,7 @@ proxy server</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>3proxy</b> is
+<p style="margin-left:6%; margin-top: 1em"><b>3proxy</b> is
 a universal proxy server. It can be used to provide internal
 users with fully controllable access to external resources
 or to provide external users with access to internal
@ -71,7 +71,7 @@ under Unix). So you can play your favourite games, listen to
 music, exchange files and messages and even accept incoming
 connections behind a proxy server.</p>

-<p style="margin-left:9%; margin-top: 1em"><i>dnspr</i>
+<p style="margin-left:6%; margin-top: 1em"><i>dnspr</i>
 does not exist as an independent service. It&rsquo;s a DNS
 caching proxy (it requires <i>nscache</i> and <i>nserver</i>
 to be set in the configuration. Only A-records are cached.
@ -79,7 +79,7 @@ Please note that this caching is mostly a &rsquo;hack&rsquo;
 and has nothing to do with a real DNS server, but it works
 perfectly for SOHO networks.</p>

-<p style="margin-left:9%; margin-top: 1em">3proxy supports
+<p style="margin-left:6%; margin-top: 1em">3proxy supports
 access control lists (ACL) like network router. Source and
 destination networks and destination port can be specified.
 In addition, usernames and gateway action (for example GET
@ -92,7 +92,7 @@ ACL action request can be allowed, denied or redirected to
 another host or to another proxy server or even to a chain
 of proxy servers.</p>

-<p style="margin-left:9%; margin-top: 1em">It supports
+<p style="margin-left:6%; margin-top: 1em">It supports
 different types of logging: to logfiles, <b>syslog</b>(3)
 (only under Unix) or to an ODBC database. Logging format is
 tunable to provide compatibility with existing log file
@ -105,9 +105,9 @@ Apache or Squid log parsers.</p>



-<p style="margin-left:9%; margin-top: 1em"><b>config_file</b></p>
+<p style="margin-left:6%; margin-top: 1em"><b>config_file</b></p>

-<p style="margin-left:18%;">Name of config file. See
+<p style="margin-left:15%;">Name of config file. See
 <b>3proxy.cfg</b>(3) for configuration file format. Under
 Windows, if config_file is not specified, <b>3proxy</b>
 looks for a file named <i>3proxy.cfg</i> in the default
@ -119,14 +119,14 @@ script just by setting +x mode and adding <br>
 #!/usr/local/3proxy/3proxy <br>
 as a first line in 3proxy.cfg</p>

-<p style="margin-left:9%;"><b>--install</b></p>
+<p style="margin-left:6%;"><b>--install</b></p>

-<p style="margin-left:18%;">(Windows NT family only)
+<p style="margin-left:15%;">(Windows NT family only)
 install <b>3proxy</b> as a system service</p>

-<p style="margin-left:9%;"><b>--remove</b></p>
+<p style="margin-left:6%;"><b>--remove</b></p>

-<p style="margin-left:18%;">(Windows NT family only) remove
+<p style="margin-left:15%;">(Windows NT family only) remove
 <b>3proxy</b> from system services</p>

 <h2>SIGNALS
@ -134,29 +134,29 @@ install <b>3proxy</b> as a system service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Under Unix there
+<p style="margin-left:6%; margin-top: 1em">Under Unix there
 are a few signals <b>3proxy</b> catches. See <b>kill</b>(1).
 <b><br>
 SIGTERM</b></p>

-<p style="margin-left:18%;">clean up connections and
+<p style="margin-left:15%;">clean up connections and
 exit</p>

-<p style="margin-left:9%;"><b>SIGPAUSE</b></p>
+<p style="margin-left:6%;"><b>SIGPAUSE</b></p>

-<p style="margin-left:18%;">stop accepting new connections,
+<p style="margin-left:15%;">stop accepting new connections,
 on second signal - start and re-read configuration</p>

-<p style="margin-left:9%;"><b>SIGCONT</b></p>
+<p style="margin-left:6%;"><b>SIGCONT</b></p>

-<p style="margin-left:18%;">start to accept new
+<p style="margin-left:15%;">start to accept new
 connections</p>

-<p style="margin-left:9%;"><b>SIGUSR1</b></p>
+<p style="margin-left:6%;"><b>SIGUSR1</b></p>

-<p style="margin-left:18%;">reload configuration</p>
+<p style="margin-left:15%;">reload configuration</p>

-<p style="margin-left:9%; margin-top: 1em">Under Windows,
+<p style="margin-left:6%; margin-top: 1em">Under Windows,
 if <b>3proxy</b> is installed as a service you can use
 standard service management to start, stop, pause and
 continue the 3proxy service, for example: <b><br>
@ -165,7 +165,7 @@ net stop 3proxy <br>
 net pause 3proxy <br>
 net continue 3proxy</b></p>

-<p style="margin-left:9%; margin-top: 1em">Web admin
+<p style="margin-left:6%; margin-top: 1em">Web admin
 service can also be used to reload configuration. Use wget
 to automate this task.</p>

@ -175,10 +175,10 @@ to automate this task.</p>



-<p style="margin-left:9%; margin-top: 1em"><i>/usr/local/3proxy/3proxy.cfg
+<p style="margin-left:6%; margin-top: 1em"><i>/usr/local/3proxy/3proxy.cfg
 (3proxy.cfg)</i></p>

-<p style="margin-left:18%;"><b>3proxy</b> configuration
+<p style="margin-left:15%;"><b>3proxy</b> configuration
 file</p>

 <h2>BUGS
@ -186,7 +186,7 @@ file</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -194,7 +194,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy.cfg(5),
+<p style="margin-left:6%; margin-top: 1em">3proxy.cfg(5),
 proxy(8), ftppr(8), socks(8), pop3p(8), imapp(8), tcppm(8),
 udppm(8), kill(1), syslogd(8), <br>
 https://3proxy.org/</p>
@ -204,7 +204,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/3proxy_crypt.8.html
+++ b/doc/html/man8/3proxy_crypt.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -26,7 +26,7 @@



-<p style="margin-left:9%; margin-top: 1em"><b>3proxy_crypt</b>
+<p style="margin-left:6%; margin-top: 1em"><b>3proxy_crypt</b>
 - utility to generate encrypted passwords for 3proxy</p>

 <h2>SYNOPSIS
@ -35,7 +35,7 @@



-<p style="margin-left:9%; margin-top: 1em"><b>3proxy_crypt</b>
+<p style="margin-left:6%; margin-top: 1em"><b>3proxy_crypt</b>
 <i>password</i> <b><br>
 3proxy_crypt</b> <i>salt password</i></p>

@ -45,23 +45,23 @@



-<p style="margin-left:9%; margin-top: 1em"><i><b>3proxy_crypt</b></i>
+<p style="margin-left:6%; margin-top: 1em"><i><b>3proxy_crypt</b></i>
 is a utility to generate encrypted password hashes for use
 with 3proxy configuration. Encrypted passwords allow the
 system to avoid storing passwords in cleartext in
 configuration files.</p>

-<p style="margin-left:9%; margin-top: 1em">When invoked
+<p style="margin-left:6%; margin-top: 1em">When invoked
 with a single argument, it produces an NT password hash
 (MD4-based, suitable for NTLM authentication). The output is
 prefixed with <b>NT:</b>.</p>

-<p style="margin-left:9%; margin-top: 1em">When invoked
+<p style="margin-left:6%; margin-top: 1em">When invoked
 with two arguments (salt and password), it produces a
 BLAKE2b password hash. The salt length is limited to 64
 characters. The output is prefixed with <b>CR:</b>.</p>

-<p style="margin-left:9%; margin-top: 1em">The resulting
+<p style="margin-left:6%; margin-top: 1em">The resulting
 hash can be used in the 3proxy configuration file with the
 <b>users</b> directive instead of a cleartext password.</p>

@ -71,25 +71,25 @@ hash can be used in the 3proxy configuration file with the



-<p style="margin-left:9%; margin-top: 1em"><i>password</i></p>
+<p style="margin-left:6%; margin-top: 1em"><i>password</i></p>

-<p style="margin-left:18%;">Cleartext password to
+<p style="margin-left:15%;">Cleartext password to
 encrypt.</p>

 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="5%">


 <p><i>salt</i></p></td>
 <td width="4%"></td>
-<td width="67%">
+<td width="65%">


 <p>Salt string for BLAKE2b hashing (max 64 characters).</p></td>
-<td width="15%">
+<td width="20%">
 </td></tr>
 </table>

@ -98,30 +98,30 @@ encrypt.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Generate NT
+<p style="margin-left:6%; margin-top: 1em">Generate NT
 password hash:</p>

-<p style="margin-left:18%;">3proxy_crypt
+<p style="margin-left:15%;">3proxy_crypt
 MySecretPassword</p>

-<p style="margin-left:9%;">Result:</p>
+<p style="margin-left:6%;">Result:</p>


-<p style="margin-left:18%;">NT:3F7E6D8D96E8E7A9B0C1D2E3F4A5B6C7</p>
+<p style="margin-left:15%;">NT:3F7E6D8D96E8E7A9B0C1D2E3F4A5B6C7</p>

-<p style="margin-left:9%;">Generate BLAKE2b password hash
+<p style="margin-left:6%;">Generate BLAKE2b password hash
 with salt:</p>

-<p style="margin-left:18%;">3proxy_crypt MySalt
+<p style="margin-left:15%;">3proxy_crypt MySalt
 MySecretPassword</p>

-<p style="margin-left:9%;">Result:</p>
+<p style="margin-left:6%;">Result:</p>

-<p style="margin-left:18%;">CR:$3$MySalt$...</p>
+<p style="margin-left:15%;">CR:$3$MySalt$...</p>

-<p style="margin-left:9%;">Using in 3proxy.cfg:</p>
+<p style="margin-left:6%;">Using in 3proxy.cfg:</p>

-<p style="margin-left:18%;">users
+<p style="margin-left:15%;">users
 user1:CR:$3$MySalt$...</p>

 <h2>NOTES
@ -129,11 +129,11 @@ user1:CR:$3$MySalt$...</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">The NT hash uses
+<p style="margin-left:6%; margin-top: 1em">The NT hash uses
 the RSA MD4 Message-Digest Algorithm. The BLAKE2b hash uses
 the BLAKE2 cryptographic hash function.</p>

-<p style="margin-left:9%; margin-top: 1em">When a password
+<p style="margin-left:6%; margin-top: 1em">When a password
 hash is prefixed with <b>NT:</b> or <b>CR:</b>, 3proxy uses
 the corresponding algorithm to verify passwords instead of
 comparing cleartext strings.</p>
@ -143,7 +143,7 @@ comparing cleartext strings.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -151,7 +151,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 3proxy.cfg(5), <br>
 https://3proxy.org/</p>

@ -160,7 +160,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/ftppr.8.html
+++ b/doc/html/man8/ftppr.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>ftppr</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>ftppr</b> -
 FTP proxy gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ FTP proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>ftppr</b>
+<p style="margin-left:6%; margin-top: 1em"><b>ftppr</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@ -43,7 +43,7 @@ FTP proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>ftppr</b> is
+<p style="margin-left:6%; margin-top: 1em"><b>ftppr</b> is
 FTP gateway service to allow internal users to access
 external FTP servers.</p>

@ -55,80 +55,81 @@ external FTP servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never look for username authentication.</p></td></tr>
+<p style="margin-top: 1em">Never look for username
+authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -139,13 +140,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -155,55 +156,56 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/ftppr.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-h</b></p></td>
+<p style="margin-top: 1em"><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Default destination. It&rsquo;s used if the target
-address is not specified by the user.</p></td></tr>
+<p style="margin-top: 1em">Default destination. It&rsquo;s
+used if the target address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Port. Port proxy listens for incoming connections.
-Default is 21.</p></td></tr>
+<p style="margin-top: 1em">Port. Port proxy listens for
+incoming connections. Default is 21.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; precedes
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -211,7 +213,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You can use any
+<p style="margin-left:6%; margin-top: 1em">You can use any
 FTP client, regardless of FTP proxy support. For a client
 with FTP proxy support, configure <i>internal_ip</i> and
 <i>port</i> in the FTP proxy parameters. For clients without
@ -230,7 +232,7 @@ supported.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -238,7 +240,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 proxy(8), pop3p(8), socks(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -248,7 +250,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/imapp.8.html
+++ b/doc/html/man8/imapp.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>imapp</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>imapp</b> -
 IMAPv4 proxy gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ IMAPv4 proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>imapp</b>
+<p style="margin-left:6%; margin-top: 1em"><b>imapp</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@ -44,7 +44,7 @@ IMAPv4 proxy gateway service</p>



-<p style="margin-left:9%; margin-top: 1em"><i><b>imapp</b></i>
+<p style="margin-left:6%; margin-top: 1em"><i><b>imapp</b></i>
 is IMAPv4 (IMAP4rev1) gateway service to allow internal
 users to access external IMAP servers.</p>

@ -56,80 +56,81 @@ users to access external IMAP servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never look for username authentication.</p></td></tr>
+<p style="margin-top: 1em">Never look for username
+authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -140,13 +141,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -156,68 +157,69 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/imapp.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Port. Port proxy listens for incoming connections.
-Default is 143.</p></td></tr>
+<p style="margin-top: 1em">Port. Port proxy listens for
+incoming connections. Default is 143.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-h</b></p></td>
+<p style="margin-top: 1em"><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Default destination. It&rsquo;s used if the target
-address is not specified by the user.</p></td></tr>
+<p style="margin-top: 1em">Default destination. It&rsquo;s
+used if the target address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-x</b></p></td>
+<p style="margin-top: 1em"><b>-x</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Disable STARTTLS support. STARTTLS is not announced in
-the CAPABILITY response and the STARTTLS command is not
-accepted.</p> </td></tr>
+<p style="margin-top: 1em">Disable STARTTLS support.
+STARTTLS is not announced in the CAPABILITY response and the
+STARTTLS command is not accepted.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; precedes
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -225,7 +227,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You can use any
+<p style="margin-left:6%; margin-top: 1em">You can use any
 MUA (Mail User Agent) with IMAPv4 support. Set the client to
 use <i>internal_ip</i> and <i>port</i> as an IMAP server.
 The address of the real IMAP server must be configured as a
@ -260,7 +262,7 @@ fails.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -268,7 +270,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 ftppr(8), pop3p(8), proxy(8), smtpp(8), socks(8), tcppm(8),
 tlspr(8), udppm(8), syslogd(8), <br>
 https://3proxy.org/</p>
@ -278,7 +280,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/pop3p.8.html
+++ b/doc/html/man8/pop3p.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>pop3p</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>pop3p</b> -
 POP3 proxy gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ POP3 proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>pop3p</b>
+<p style="margin-left:6%; margin-top: 1em"><b>pop3p</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@ -44,7 +44,7 @@ POP3 proxy gateway service</p>



-<p style="margin-left:9%; margin-top: 1em"><i><b>pop3p</b></i>
+<p style="margin-left:6%; margin-top: 1em"><i><b>pop3p</b></i>
 is POP3 gateway service to allow internal users to access
 external POP3 servers.</p>

@ -56,80 +56,81 @@ external POP3 servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never look for username authentication.</p></td></tr>
+<p style="margin-top: 1em">Never look for username
+authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -140,13 +141,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -156,68 +157,69 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/pop3p.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Port. Port proxy listens for incoming connections.
-Default is 110.</p></td></tr>
+<p style="margin-top: 1em">Port. Port proxy listens for
+incoming connections. Default is 110.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-h</b></p></td>
+<p style="margin-top: 1em"><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Default destination. It&rsquo;s used if the target
-address is not specified by the user.</p></td></tr>
+<p style="margin-top: 1em">Default destination. It&rsquo;s
+used if the target address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-x</b></p></td>
+<p style="margin-top: 1em"><b>-x</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Disable STARTTLS (STLS) support. STLS is not announced
-in the CAPA response and the STLS command is not
-accepted.</p> </td></tr>
+<p style="margin-top: 1em">Disable STARTTLS (STLS) support.
+STLS is not announced in the CAPA response and the STLS
+command is not accepted.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; precedes
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -225,7 +227,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You can use any
+<p style="margin-left:6%; margin-top: 1em">You can use any
 MUA (Mail User Agent) with POP3 support. Set the client to
 use <i>internal_ip</i> and <i>port</i> as a POP3 server. The
 address of the real POP3 server must be configured as a part
@ -253,7 +255,7 @@ TLS handshake with the client fails.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -261,7 +263,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -271,7 +273,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/proxy.8.html
+++ b/doc/html/man8/proxy.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>proxy</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>proxy</b> -
 HTTP proxy gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ HTTP proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>proxy</b>
+<p style="margin-left:6%; margin-top: 1em"><b>proxy</b>
 [<b>-d</b>][<b>-a</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]</p>
@ -42,7 +42,7 @@ HTTP proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>proxy</b> is
+<p style="margin-left:6%; margin-top: 1em"><b>proxy</b> is
 HTTP gateway service with HTTPS and FTP over HTTPS
 support.</p>

@ -54,80 +54,81 @@ support.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never ask for username authentication</p></td></tr>
+<p style="margin-top: 1em">Never ask for username
+authentication</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -138,13 +139,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


 <p><b>-i</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -154,65 +155,68 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/proxy.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-a</b></p></td>
+<p style="margin-top: 1em"><b>-a</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Anonymous. Hide information about client.</p></td></tr>
+<p style="margin-top: 1em">Anonymous. Hide information
+about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-a1</b></p></td>
+<p style="margin-top: 1em"><b>-a1</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Anonymous. Show fake information about client.</p></td></tr>
+<p style="margin-top: 1em">Anonymous. Show fake information
+about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Port. Port proxy listens for incoming connections.
-Default is 3128.</p></td></tr>
+<p style="margin-top: 1em">Port. Port proxy listens for
+incoming connections. Default is 3128.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; preceeds <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; preceeds
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -220,7 +224,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You should use a
+<p style="margin-left:6%; margin-top: 1em">You should use a
 client with HTTP proxy support or configure a router to
 redirect HTTP traffic to the proxy (transparent proxy).
 Configure the client to connect to <i>internal_ip</i> and
@ -233,7 +237,7 @@ TCP-based protocol. If you need to limit clients, use
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -241,7 +245,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -251,7 +255,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/smtpp.8.html
+++ b/doc/html/man8/smtpp.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>smtpp</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>smtpp</b> -
 SMTP proxy gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ SMTP proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>smtpp</b>
+<p style="margin-left:6%; margin-top: 1em"><b>smtpp</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]
@ -44,7 +44,7 @@ SMTP proxy gateway service</p>



-<p style="margin-left:9%; margin-top: 1em"><i><b>smtpp</b></i>
+<p style="margin-left:6%; margin-top: 1em"><i><b>smtpp</b></i>
 is SMTP gateway service to allow internal users to access
 external SMTP servers.</p>

@ -56,80 +56,81 @@ external SMTP servers.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never look for username authentication.</p></td></tr>
+<p style="margin-top: 1em">Never look for username
+authentication.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -140,13 +141,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -156,68 +157,69 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/smtpp.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Port. Port proxy listens for incoming connections.
-Default is 587.</p></td></tr>
+<p style="margin-top: 1em">Port. Port proxy listens for
+incoming connections. Default is 587.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-h</b></p></td>
+<p style="margin-top: 1em"><b>-h</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Default destination. It&rsquo;s used if the target
-address is not specified by the user.</p></td></tr>
+<p style="margin-top: 1em">Default destination. It&rsquo;s
+used if the target address is not specified by the user.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-x</b></p></td>
+<p style="margin-top: 1em"><b>-x</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Disable STARTTLS support. STARTTLS is not announced in
-the EHLO response and the STARTTLS command is not
-accepted.</p> </td></tr>
+<p style="margin-top: 1em">Disable STARTTLS support.
+STARTTLS is not announced in the EHLO response and the
+STARTTLS command is not accepted.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; precedes
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -225,7 +227,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You can use any
+<p style="margin-left:6%; margin-top: 1em">You can use any
 MUA (Mail User Agent) with SMTP authentication support. Set
 the client to use <i>internal_ip</i> and <i>port</i> as an
 SMTP server. The address of the real SMTP server must be
@ -254,7 +256,7 @@ fails.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -262,7 +264,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -272,7 +274,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/socks.8.html
+++ b/doc/html/man8/socks.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>socks</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>socks</b> -
 SOCKS 4/4.5/5 gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ SOCKS 4/4.5/5 gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>socks</b>
+<p style="margin-left:6%; margin-top: 1em"><b>socks</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>port</i>] [<b>-i</b><i>internal_ip</i>]
 [<b>-e</b><i>external_ip</i>]</p>
@ -42,7 +42,7 @@ SOCKS 4/4.5/5 gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>socks</b> is
+<p style="margin-left:6%; margin-top: 1em"><b>socks</b> is
 SOCKS server. It supports SOCKSv4, SOCKSv4.5 (extension to
 v4 for server side name resolution) and SOCKSv5. SOCKSv5
 specification allows both outgoing and reverse TCP
@ -56,81 +56,82 @@ connections and UDP portmapping.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never ask for username authentication</p></td></tr>
+<p style="margin-top: 1em">Never ask for username
+authentication</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. External IP must be
-specified if you need incoming connections. By default, the
-system will decide which address to use in accordance with
-the routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from.
+External IP must be specified if you need incoming
+connections. By default, the system will decide which
+address to use in accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -141,13 +142,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


 <p><b>-Ne</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


 <p>External NAT address 3proxy reports to client for
@ -156,75 +157,77 @@ and destination server. By default, the external address is
 reported. It&rsquo;s only useful in the case of IP-IP NAT
 and does not work with port translation.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-Ni</b></p></td>
+<p style="margin-top: 1em"><b>-Ni</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Internal NAT address 3proxy reports to client for
-UDPASSOC. This is external address of the NAT between 3proxy
-and the client, client uses to connect to 3proxy. By
-default, the internal address is reported. It&rsquo;s only
-useful in the case of IP-IP NAT and does not work with port
-translation.</p> </td></tr>
+<p style="margin-top: 1em">Internal NAT address 3proxy
+reports to client for UDPASSOC. This is external address of
+the NAT between 3proxy and the client, client uses to
+connect to 3proxy. By default, the internal address is
+reported. It&rsquo;s only useful in the case of IP-IP NAT
+and does not work with port translation.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-i</b></p></td>
+<p style="margin-top: 1em"><b>-i</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Internal address. IP address the proxy accepts
-connections to. By default, connections to any interface are
-accepted. It&acute;s usually unsafe. Unix domain sockets can
-be specified with <i>-iunix:/path/to/socket</i> syntax
-(e.g., -iunix:/var/run/socks.sock). On Linux, abstract
-sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
+<p style="margin-top: 1em">Internal address. IP address the
+proxy accepts connections to. By default, connections to any
+interface are accepted. It&acute;s usually unsafe. Unix
+domain sockets can be specified with
+<i>-iunix:/path/to/socket</i> syntax (e.g.,
+-iunix:/var/run/socks.sock). On Linux, abstract sockets use
+<i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Port. Port proxy listens for incoming connections.
-Default is 1080.</p></td></tr>
+<p style="margin-top: 1em">Port. Port proxy listens for
+incoming connections. Default is 1080.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; preceeds <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; preceeds
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -232,7 +235,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You should use a
+<p style="margin-left:6%; margin-top: 1em">You should use a
 client with SOCKS support or use some socksification support
 (for example <i>SocksCAP</i> or <i>FreeCAP</i>). Configure
 client to use <i>internal_ip</i> and <i>port</i>. SOCKS
@ -247,7 +250,7 @@ privileges). If you need to control access, use
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -255,7 +258,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 proxy(8), ftppr(8), pop3p(8), tcppm(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -265,7 +268,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/tcppm.8.html
+++ b/doc/html/man8/tcppm.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -25,7 +25,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>tcppm</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>tcppm</b> -
 TCP port mapper</p>

 <h2>SYNOPSIS
@ -33,7 +33,7 @@ TCP port mapper</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>tcppm</b>
+<p style="margin-left:6%; margin-top: 1em"><b>tcppm</b>
 [<b>-d</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-i</b><i>internal_ip</i>] [<b>-e</b><i>external_ip</i>]
 <i>local_port remote_host remote_port</i></p>
@ -44,7 +44,7 @@ TCP port mapper</p>



-<p style="margin-left:9%; margin-top: 1em"><i><b>tcppm</b></i>
+<p style="margin-left:6%; margin-top: 1em"><i><b>tcppm</b></i>
 forwards connections from local to remote TCP port</p>

 <h2>OPTIONS
@ -55,69 +55,69 @@ forwards connections from local to remote TCP port</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -128,13 +128,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -144,31 +144,32 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/tcppm.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; precedes
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>ARGUMENTS
@ -177,23 +178,23 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>



-<p style="margin-left:9%; margin-top: 1em"><i>local_port</i></p>
+<p style="margin-left:6%; margin-top: 1em"><i>local_port</i></p>

-<p style="margin-left:18%;">- port tcppm accepts
+<p style="margin-left:15%;">- port tcppm accepts
 connections on</p>

-<p style="margin-left:9%;"><i>remote_host</i></p>
+<p style="margin-left:6%;"><i>remote_host</i></p>

-<p style="margin-left:18%;">- IP address of the host the
+<p style="margin-left:15%;">- IP address of the host the
 connection is forwarded to. Unix domain sockets can be
 specified with the syntax <i>unix:/path/to/socket</i> (e.g.,
 unix:/var/run/app.sock). On Linux, abstract (fileless) Unix
 sockets use the syntax <i>unix:@socketname</i> (e.g.,
 unix:@app.socket).</p>

-<p style="margin-left:9%;"><i>remote_port</i></p>
+<p style="margin-left:6%;"><i>remote_port</i></p>

-<p style="margin-left:18%;">- remote port the connection is
+<p style="margin-left:15%;">- remote port the connection is
 forwarded to. Ignored when using Unix socket destination,
 but must be specified (use any positive value) for syntax
 compatibility.</p>
@ -203,7 +204,7 @@ compatibility.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Any TCP-based
+<p style="margin-left:6%; margin-top: 1em">Any TCP-based
 application can be used as a client. Use <i>internal_ip</i>
 and <i>local_port</i> as the destination in the client
 application. The connection is forwarded to
@ -214,7 +215,7 @@ application. The connection is forwarded to
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -222,7 +223,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -232,7 +233,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/tlspr.8.html
+++ b/doc/html/man8/tlspr.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -24,7 +24,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b> -
 SNI proxy gateway service</p>

 <h2>SYNOPSIS
@ -32,7 +32,7 @@ SNI proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b>
+<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b>
 [<b>-d</b>][<b>-a</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-p</b><i>listening_port</i>]
 [<b>-P</b><i>destination_port</i>]
@ -45,7 +45,7 @@ SNI proxy gateway service</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b> is
+<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b> is
 an SNI gateway service (destination host is taken from TLS
 handshake). The destination port must be specified via the
 -P option (or it may be detected with the Transparent
@ -61,80 +61,81 @@ access control is required.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-u</b></p></td>
+<p style="margin-top: 1em"><b>-u</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Never ask for username authentication</p></td></tr>
+<p style="margin-top: 1em">Never ask for username
+authentication</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate connections from. By default, the system
-will decide which address to use in accordance with the
-routing table.</p></td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate connections from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -145,13 +146,13 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


 <p><b>-i</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts
@ -161,90 +162,93 @@ be specified with <i>-iunix:/path/to/socket</i> syntax
 (e.g., -iunix:/var/run/tlspr.sock). On Linux, abstract
 sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-a</b></p></td>
+<p style="margin-top: 1em"><b>-a</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Anonymous. Hide information about client.</p></td></tr>
+<p style="margin-top: 1em">Anonymous. Hide information
+about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-a1</b></p></td>
+<p style="margin-top: 1em"><b>-a1</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Anonymous. Show fake information about client.</p></td></tr>
+<p style="margin-top: 1em">Anonymous. Show fake information
+about client.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-p</b></p></td>
+<p style="margin-top: 1em"><b>-p</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>listening_port. Port proxy listens for incoming
-connections. Default is 1443.</p></td></tr>
+<p style="margin-top: 1em">listening_port. Port proxy
+listens for incoming connections. Default is 1443.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-P</b></p></td>
+<p style="margin-top: 1em"><b>-P</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>destination_port. Port to establish outgoing
-connections. Required unless the Transparent plugin is used,
-because the TLS handshake does not contain port information.
-Default is 443.</p></td></tr>
+<p style="margin-top: 1em">destination_port. Port to
+establish outgoing connections. Required unless the
+Transparent plugin is used, because the TLS handshake does
+not contain port information. Default is 443.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-c</b></p></td>
+<p style="margin-top: 1em"><b>-c</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>TLS_CHECK_LEVEL. 0 (default) - allow non-TLS traffic to
-pass, 1 - require TLS, only check client HELLO packet, 2 -
-require TLS, check both client and server HELLO, 3 - require
-TLS, check that the server sends a certificate (not
-compatible with TLS 1.3), 4 - require mutual TLS, check that
-the server sends a certificate request and the client sends
-a certificate (not compatible with TLS 1.3)</p></td></tr>
+<p style="margin-top: 1em">TLS_CHECK_LEVEL. 0 (default) -
+allow non-TLS traffic to pass, 1 - require TLS, only check
+client HELLO packet, 2 - require TLS, check both client and
+server HELLO, 3 - require TLS, check that the server sends a
+certificate (not compatible with TLS 1.3), 4 - require
+mutual TLS, check that the server sends a certificate
+request and the client sends a certificate (not compatible
+with TLS 1.3)</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="4%">


-<p><b>-s</b></p></td>
+<p style="margin-top: 1em"><b>-s</b></p></td>
 <td width="5%"></td>
-<td width="82%">
+<td width="85%">


-<p>Split the TLS Client HELLO packet across multiple TCP
-segments to make SNI-based DPI detection harder. An optional
-numeric value can follow (e.g. <b>-s1</b>) to control the
-splitting behaviour.</p></td></tr>
+<p style="margin-top: 1em">Split the TLS Client HELLO
+packet across multiple TCP segments to make SNI-based DPI
+detection harder. An optional numeric value can follow (e.g.
+<b>-s1</b>) to control the splitting behaviour.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-Ximap | -Xpop3 |
+<p style="margin-left:6%;"><b>-Ximap | -Xpop3 |
 -Xsmtp</b></p>

-<p style="margin-left:18%;">STARTTLS mode for the given
+<p style="margin-left:15%;">STARTTLS mode for the given
 protocol. The proxy speaks the plaintext protocol with the
 client (greeting, capability advertisement with STARTTLS
 only, STARTTLS command), then, after the client issues
@ -258,13 +262,13 @@ client fails.</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Log. By default logging is to stdout. If <i>logfile</i>
@ -272,17 +276,18 @@ is specified logging is to file. Under Unix, if
 &acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
 used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>CLIENTS
@ -290,7 +295,7 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">You should use a
+<p style="margin-left:6%; margin-top: 1em">You should use a
 client with TLS support or configure a router to redirect
 TLS traffic to the proxy (transparent proxy). Configure the
 client to connect to <i>internal_ip</i> and <i>port</i>. If
@ -301,7 +306,7 @@ you need to limit clients, use <b>3proxy</b>(8) instead.</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -309,7 +314,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 ftppr(8), proxy(8), socks(8), pop3p(8), smtpp(8), tcppm(8),
 udppm(8), syslogd(8), <br>
 https://3proxy.org/</p>
@ -319,7 +324,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/doc/html/man8/udppm.8.html
+++ b/doc/html/man8/udppm.8.html
@ -1,4 +1,4 @@
-<!-- Creator     : groff version 1.23.0 -->
+<!-- Creator     : groff version 1.24.1 -->
 <html>
 <head>

@ -25,7 +25,7 @@
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>udppm</b> -
+<p style="margin-left:6%; margin-top: 1em"><b>udppm</b> -
 UDP port mapper</p>

 <h2>SYNOPSIS
@ -33,7 +33,7 @@ UDP port mapper</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em"><b>udppm</b>
+<p style="margin-left:6%; margin-top: 1em"><b>udppm</b>
 [<b>-ds</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
 [<b>-i</b><i>internal_ip</i>] [<b>-e</b><i>external_ip</i>]
 <i>local_port remote_host remote_port</i></p>
@ -44,7 +44,7 @@ UDP port mapper</p>



-<p style="margin-left:9%; margin-top: 1em"><i><b>udppm</b></i>
+<p style="margin-left:6%; margin-top: 1em"><i><b>udppm</b></i>
 forwards datagrams from local to remote UDP port</p>

 <h2>OPTIONS
@ -55,69 +55,69 @@ forwards datagrams from local to remote UDP port</p>
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p style="margin-top: 1em"><b>-I</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p style="margin-top: 1em">Inetd mode. Standalone service
 only.</p> </td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-d</b></p></td>
+<p style="margin-top: 1em"><b>-d</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Daemonize. Detach service from console and run in the
-background.</p> </td></tr>
+<p style="margin-top: 1em">Daemonize. Detach service from
+console and run in the background.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-t</b></p></td>
+<p style="margin-top: 1em"><b>-t</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Be silenT. Do not log start/stop/accept error
-records.</p> </td></tr>
+<p style="margin-top: 1em">Be silenT. Do not log
+start/stop/accept error records.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-e</b></p></td>
+<p style="margin-top: 1em"><b>-e</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>External address. IP address of the interface the proxy
-should initiate datagrams from. By default, the system will
-decide which address to use in accordance with the routing
-table.</p> </td></tr>
+<p style="margin-top: 1em">External address. IP address of
+the interface the proxy should initiate datagrams from. By
+default, the system will decide which address to use in
+accordance with the routing table.</p></td></tr>
 </table>

-<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> before opening
 the listening socket. The current namespace is saved and
 restored immediately after binding, so outgoing connections
 run in the original namespace unless <b>-ne</b> is also
 given.</p>

-<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
+<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>

-<p style="margin-left:18%;">(Linux only) Switch to the
+<p style="margin-left:15%;">(Linux only) Switch to the
 network namespace identified by <i>PATH</i> after the
 listening socket has been bound (and after restoring from
 <b>-ni</b> if applicable). Both options accept any namespace
@ -128,59 +128,61 @@ file path (e.g. <i>/var/run/netns/myns</i> or
 <table width="100%" border="0" rules="none" frame="void"
       cellspacing="0" cellpadding="0">
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


 <p><b>-i</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


 <p>Internal address. IP address the proxy accepts datagrams
 to. By default, connections to any interface are accepted.
 It&acute;s usually unsafe.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-l</b></p></td>
+<p style="margin-top: 1em"><b>-l</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Log. By default logging is to stdout. If <i>logfile</i>
-is specified logging is to file. Under Unix, if
-&acute;<i>@</i>&acute; precedes <i>logfile</i>, syslog is
-used for logging.</p></td></tr>
+<p style="margin-top: 1em">Log. By default logging is to
+stdout. If <i>logfile</i> is specified logging is to file.
+Under Unix, if &acute;<i>@</i>&acute; precedes
+<i>logfile</i>, syslog is used for logging.</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-s</b></p></td>
+<p style="margin-top: 1em"><b>-s</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Single packet. By default, only one client can use the
-udppm service, but if -s is specified, only one packet will
-be forwarded between client and server. This allows the
-service to be shared between multiple clients for
-single-packet services (for example, name lookups).</p></td></tr>
+<p style="margin-top: 1em">Single packet. By default, only
+one client can use the udppm service, but if -s is
+specified, only one packet will be forwarded between client
+and server. This allows the service to be shared between
+multiple clients for single-packet services (for example,
+name lookups).</p></td></tr>
 <tr valign="top" align="left">
-<td width="9%"></td>
+<td width="6%"></td>
 <td width="3%">


-<p><b>-S</b></p></td>
+<p style="margin-top: 1em"><b>-S</b></p></td>
 <td width="6%"></td>
-<td width="82%">
+<td width="85%">


-<p>Increase or decrease stack size. You may want to try
-something like -S8192 if you experience 3proxy crashes.</p></td></tr>
+<p style="margin-top: 1em">Increase or decrease stack size.
+You may want to try something like -S8192 if you experience
+3proxy crashes.</p></td></tr>
 </table>

 <h2>ARGUMENTS
@ -189,19 +191,19 @@ something like -S8192 if you experience 3proxy crashes.</p></td></tr>



-<p style="margin-left:9%; margin-top: 1em"><i>local_port</i></p>
+<p style="margin-left:6%; margin-top: 1em"><i>local_port</i></p>

-<p style="margin-left:18%;">- port udppm accepts datagrams
+<p style="margin-left:15%;">- port udppm accepts datagrams
 on</p>

-<p style="margin-left:9%;"><i>remote_host</i></p>
+<p style="margin-left:6%;"><i>remote_host</i></p>

-<p style="margin-left:18%;">- IP address of the host
+<p style="margin-left:15%;">- IP address of the host
 datagrams are forwarded to</p>

-<p style="margin-left:9%;"><i>remote_port</i></p>
+<p style="margin-left:6%;"><i>remote_port</i></p>

-<p style="margin-left:18%;">- remote port datagrams are
+<p style="margin-left:15%;">- remote port datagrams are
 forwarded to</p>

 <h2>CLIENTS
@ -209,7 +211,7 @@ forwarded to</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Any UDP-based
+<p style="margin-left:6%; margin-top: 1em">Any UDP-based
 application can be used as a client. Use <i>internal_ip</i>
 and <i>local_port</i> as the destination in the client
 application. All datagrams are forwarded to
@ -220,7 +222,7 @@ application. All datagrams are forwarded to
 </h2>


-<p style="margin-left:9%; margin-top: 1em">Report all bugs
+<p style="margin-left:6%; margin-top: 1em">Report all bugs
 to <b>3proxy@3proxy.org</b></p>

 <h2>SEE ALSO
@ -228,7 +230,7 @@ to <b>3proxy@3proxy.org</b></p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy(8),
+<p style="margin-left:6%; margin-top: 1em">3proxy(8),
 proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8),
 syslogd(8), <br>
 https://3proxy.org/</p>
@ -238,7 +240,7 @@ https://3proxy.org/</p>
 </h2>


-<p style="margin-left:9%; margin-top: 1em">3proxy is
+<p style="margin-left:6%; margin-top: 1em">3proxy is
 designed by Vladimir Dubrovin &lt;vlad@3proxy.org&gt;</p>
 <hr>
 </body>
--- a/scripts/rh/3proxy.spec
+++ b/scripts/rh/3proxy.spec
@ -1,5 +1,5 @@
 Name:           3proxy
-Version:        1.0.0
+Version:        0.9.9
 Release:        1%{?dist}
 Summary:        3proxy tiny proxy server
 License:        GPL/LGPL/Apache/BSD
@ -9,9 +9,6 @@ Prefix:         %{_prefix}
 Packager: 	z3APA3A
 Source:		https://github.com/%{packager}/%{name}/archive/%{version}.tar.gz

-%global debug_package %{nil}
-%global __requires_exclude ^/(usr/)?bin/3proxy$
-
 %description
 3proxy is lightweight yet powerful proxy server

--- a/src/version.h
+++ b/src/version.h
@ -1,14 +1,14 @@
 #ifndef VERSION
-#define VERSION "3proxy-1.0.0"
+#define VERSION "3proxy-0.9.9"
 #endif
 #ifndef BUILDDATE
-#define BUILDDATE "260822121300"
+#define BUILDDATE ""
 #endif
-#define MAJOR3PROXY 1
-#define SUBMAJOR3PROXY 0
-#define MINOR3PROXY 0
+#define MAJOR3PROXY 0
+#define SUBMAJOR3PROXY 9
+#define MINOR3PROXY 9
 #define SUBMINOR3PROXY 0
-#define RELEASE3PROXY "3proxy-1.0.0(" BUILDDATE ")\0"
+#define RELEASE3PROXY "3proxy-0.9.9(" BUILDDATE ")\0"
 #ifndef YEAR3PROXY
 #define YEAR3PROXY "2026"
 #endif
 @ -1 +1 @@
 .0.0
 .9.9