mirror of
https://github.com/3proxy/3proxy.git
synced 2026-07-23 20:20:10 +08:00
305f9932ac
Some checks are pending
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI Linux / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI MacOS / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI Windows / ${{ matrix.target }} (windows-2022) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (macos-15) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-24.04-arm) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (ubuntu-latest) (push) Waiting to run
C/C++ CI cmake / ${{ matrix.target }} (windows-2022) (push) Waiting to run
C/C++ CI cmake / ubuntu-latest (wolfSSL) (push) Waiting to run
332 lines
8.2 KiB
HTML
332 lines
8.2 KiB
HTML
<!-- Creator : groff version 1.24.1 -->
|
|
<html>
|
|
<head>
|
|
|
|
</head>
|
|
<body>
|
|
|
|
<h1 align="center">tlspr</h1>
|
|
|
|
<a href="#NAME">NAME</a><br>
|
|
<a href="#SYNOPSIS">SYNOPSIS</a><br>
|
|
<a href="#DESCRIPTION">DESCRIPTION</a><br>
|
|
<a href="#OPTIONS">OPTIONS</a><br>
|
|
<a href="#CLIENTS">CLIENTS</a><br>
|
|
<a href="#BUGS">BUGS</a><br>
|
|
<a href="#SEE ALSO">SEE ALSO</a><br>
|
|
<a href="#AUTHORS">AUTHORS</a><br>
|
|
|
|
<hr>
|
|
|
|
|
|
<h2>NAME
|
|
<a name="NAME"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b> -
|
|
SNI proxy gateway service</p>
|
|
|
|
<h2>SYNOPSIS
|
|
<a name="SYNOPSIS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b>
|
|
[<b>-d</b>][<b>-a</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
|
|
[<b>-p</b><i>listening_port</i>]
|
|
[<b>-P</b><i>destination_port</i>]
|
|
[<b>-c</b><i>tls_check_level</i>]
|
|
[<b>-i</b><i>internal_ip</i>]
|
|
[<b>-e</b><i>external_ip</i>]</p>
|
|
|
|
<h2>DESCRIPTION
|
|
<a name="DESCRIPTION"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em"><b>tlspr</b> is
|
|
an SNI gateway service (destination host is taken from TLS
|
|
handshake). The destination port must be specified via the
|
|
-P option (or it may be detected with the Transparent
|
|
plugin). tlspr does not support user authentication; use
|
|
ACLs by client IP or a parent proxy with authentication if
|
|
access control is required.</p>
|
|
|
|
<h2>OPTIONS
|
|
<a name="OPTIONS"></a>
|
|
</h2>
|
|
|
|
|
|
<table width="100%" border="0" rules="none" frame="void"
|
|
cellspacing="0" cellpadding="0">
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-I</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Inetd mode. Standalone service
|
|
only.</p> </td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-d</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Daemonize. Detach service from
|
|
console and run in the background.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-t</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Be silenT. Do not log
|
|
start/stop/accept error records.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-u</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Never ask for username
|
|
authentication</p> </td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-e</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">External address. IP address of
|
|
the interface the proxy should initiate connections from. By
|
|
default, the system will decide which address to use in
|
|
accordance with the routing table.</p></td></tr>
|
|
</table>
|
|
|
|
<p style="margin-left:6%;"><b>-ni</b><i>PATH</i></p>
|
|
|
|
<p style="margin-left:15%;">(Linux only) Switch to the
|
|
network namespace identified by <i>PATH</i> before opening
|
|
the listening socket. The current namespace is saved and
|
|
restored immediately after binding, so outgoing connections
|
|
run in the original namespace unless <b>-ne</b> is also
|
|
given.</p>
|
|
|
|
<p style="margin-left:6%;"><b>-ne</b><i>PATH</i></p>
|
|
|
|
<p style="margin-left:15%;">(Linux only) Switch to the
|
|
network namespace identified by <i>PATH</i> after the
|
|
listening socket has been bound (and after restoring from
|
|
<b>-ni</b> if applicable). Both options accept any namespace
|
|
file path (e.g. <i>/var/run/netns/myns</i> or
|
|
<i>/proc/PID/ns/net</i>) and require
|
|
<b>CAP_SYS_ADMIN</b>.</p>
|
|
|
|
<table width="100%" border="0" rules="none" frame="void"
|
|
cellspacing="0" cellpadding="0">
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-i</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p>Internal address. IP address the proxy accepts
|
|
connections to. By default, connections to any interface are
|
|
accepted. It´s usually unsafe. Unix domain sockets can
|
|
be specified with <i>-iunix:/path/to/socket</i> syntax
|
|
(e.g., -iunix:/var/run/tlspr.sock). On Linux, abstract
|
|
sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-a</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Anonymous. Hide information
|
|
about client.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-a1</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Anonymous. Show fake information
|
|
about client.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-p</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">listening_port. Port proxy
|
|
listens for incoming connections. Default is 1443.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-P</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">destination_port. Port to
|
|
establish outgoing connections. Required unless the
|
|
Transparent plugin is used, because the TLS handshake does
|
|
not contain port information. Default is 443.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-c</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">TLS_CHECK_LEVEL. 0 (default) -
|
|
allow non-TLS traffic to pass, 1 - require TLS, only check
|
|
client HELLO packet, 2 - require TLS, check both client and
|
|
server HELLO, 3 - require TLS, check that the server sends a
|
|
certificate (not compatible with TLS 1.3), 4 - require
|
|
mutual TLS, check that the server sends a certificate
|
|
request and the client sends a certificate (not compatible
|
|
with TLS 1.3)</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-s</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Split the TLS Client HELLO
|
|
packet across multiple TCP segments to make SNI-based DPI
|
|
detection harder. An optional numeric value can follow (e.g.
|
|
<b>-s1</b>) to control the splitting behaviour.</p></td></tr>
|
|
</table>
|
|
|
|
<p style="margin-left:6%;"><b>-Ximap | -Xpop3 |
|
|
-Xsmtp</b></p>
|
|
|
|
<p style="margin-left:15%;">STARTTLS mode for the given
|
|
protocol. The proxy speaks the plaintext protocol with the
|
|
client (greeting, capability advertisement with STARTTLS
|
|
only, STARTTLS command), then, after the client issues
|
|
STARTTLS and sends a TLS Client HELLO, connects to the
|
|
destination taken from SNI (default port 143/110/587),
|
|
performs STARTTLS negotiation with the destination server
|
|
and transparently passes TLS traffic. If the destination
|
|
server does not support STARTTLS, the TLS handshake with the
|
|
client fails.</p>
|
|
|
|
<table width="100%" border="0" rules="none" frame="void"
|
|
cellspacing="0" cellpadding="0">
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-l</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p>Log. By default logging is to stdout. If <i>logfile</i>
|
|
is specified logging is to file. Under Unix, if
|
|
´<i>@</i>´ precedes <i>logfile</i>, syslog is
|
|
used for logging.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="6%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-S</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="85%">
|
|
|
|
|
|
<p style="margin-top: 1em">Increase or decrease stack size.
|
|
You may want to try something like -S8192 if you experience
|
|
3proxy crashes.</p></td></tr>
|
|
</table>
|
|
|
|
<h2>CLIENTS
|
|
<a name="CLIENTS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em">You should use a
|
|
client with TLS support or configure a router to redirect
|
|
TLS traffic to the proxy (transparent proxy). Configure the
|
|
client to connect to <i>internal_ip</i> and <i>port</i>. If
|
|
you need to limit clients, use <b>3proxy</b>(8) instead.</p>
|
|
|
|
<h2>BUGS
|
|
<a name="BUGS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em">Report all bugs
|
|
to <b>3proxy@3proxy.org</b></p>
|
|
|
|
<h2>SEE ALSO
|
|
<a name="SEE ALSO"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em">3proxy(8),
|
|
ftppr(8), proxy(8), socks(8), pop3p(8), smtpp(8), tcppm(8),
|
|
udppm(8), syslogd(8), <br>
|
|
https://3proxy.org/</p>
|
|
|
|
<h2>AUTHORS
|
|
<a name="AUTHORS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:6%; margin-top: 1em">3proxy is
|
|
designed by Vladimir Dubrovin <vlad@3proxy.org></p>
|
|
<hr>
|
|
</body>
|
|
</html>
|