mirror of
https://github.com/3proxy/3proxy.git
synced 2026-08-26 09:55:48 +08:00
327 lines
7.7 KiB
HTML
327 lines
7.7 KiB
HTML
<!-- Creator : groff version 1.23.0 -->
|
|
<html>
|
|
<head>
|
|
|
|
</head>
|
|
<body>
|
|
|
|
<h1 align="center">tlspr</h1>
|
|
|
|
<a href="#NAME">NAME</a><br>
|
|
<a href="#SYNOPSIS">SYNOPSIS</a><br>
|
|
<a href="#DESCRIPTION">DESCRIPTION</a><br>
|
|
<a href="#OPTIONS">OPTIONS</a><br>
|
|
<a href="#CLIENTS">CLIENTS</a><br>
|
|
<a href="#BUGS">BUGS</a><br>
|
|
<a href="#SEE ALSO">SEE ALSO</a><br>
|
|
<a href="#AUTHORS">AUTHORS</a><br>
|
|
|
|
<hr>
|
|
|
|
|
|
<h2>NAME
|
|
<a name="NAME"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b> -
|
|
SNI proxy gateway service</p>
|
|
|
|
<h2>SYNOPSIS
|
|
<a name="SYNOPSIS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b>
|
|
[<b>-d</b>][<b>-a</b>] [<b>-l</b>[[<i>@</i>]<i>logfile</i>]]
|
|
[<b>-p</b><i>listening_port</i>]
|
|
[<b>-P</b><i>destination_port</i>]
|
|
[<b>-c</b><i>tls_check_level</i>]
|
|
[<b>-i</b><i>internal_ip</i>]
|
|
[<b>-e</b><i>external_ip</i>]</p>
|
|
|
|
<h2>DESCRIPTION
|
|
<a name="DESCRIPTION"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em"><b>tlspr</b> is
|
|
an SNI gateway service (destination host is taken from TLS
|
|
handshake). The destination port must be specified via the
|
|
-P option (or it may be detected with the Transparent
|
|
plugin). tlspr does not support user authentication; use
|
|
ACLs by client IP or a parent proxy with authentication if
|
|
access control is required.</p>
|
|
|
|
<h2>OPTIONS
|
|
<a name="OPTIONS"></a>
|
|
</h2>
|
|
|
|
|
|
<table width="100%" border="0" rules="none" frame="void"
|
|
cellspacing="0" cellpadding="0">
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p style="margin-top: 1em"><b>-I</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p style="margin-top: 1em">Inetd mode. Standalone service
|
|
only.</p> </td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-d</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Daemonize. Detach service from console and run in the
|
|
background.</p> </td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-t</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Be silenT. Do not log start/stop/accept error
|
|
records.</p> </td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-u</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Never ask for username authentication</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-e</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>External address. IP address of the interface the proxy
|
|
should initiate connections from. By default, the system
|
|
will decide which address to use in accordance with the
|
|
routing table.</p></td></tr>
|
|
</table>
|
|
|
|
<p style="margin-left:9%;"><b>-ni</b><i>PATH</i></p>
|
|
|
|
<p style="margin-left:18%;">(Linux only) Switch to the
|
|
network namespace identified by <i>PATH</i> before opening
|
|
the listening socket. The current namespace is saved and
|
|
restored immediately after binding, so outgoing connections
|
|
run in the original namespace unless <b>-ne</b> is also
|
|
given.</p>
|
|
|
|
<p style="margin-left:9%;"><b>-ne</b><i>PATH</i></p>
|
|
|
|
<p style="margin-left:18%;">(Linux only) Switch to the
|
|
network namespace identified by <i>PATH</i> after the
|
|
listening socket has been bound (and after restoring from
|
|
<b>-ni</b> if applicable). Both options accept any namespace
|
|
file path (e.g. <i>/var/run/netns/myns</i> or
|
|
<i>/proc/PID/ns/net</i>) and require
|
|
<b>CAP_SYS_ADMIN</b>.</p>
|
|
|
|
<table width="100%" border="0" rules="none" frame="void"
|
|
cellspacing="0" cellpadding="0">
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-i</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Internal address. IP address the proxy accepts
|
|
connections to. By default, connections to any interface are
|
|
accepted. It´s usually unsafe. Unix domain sockets can
|
|
be specified with <i>-iunix:/path/to/socket</i> syntax
|
|
(e.g., -iunix:/var/run/tlspr.sock). On Linux, abstract
|
|
sockets use <i>-iunix:@socketname</i> syntax.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-a</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Anonymous. Hide information about client.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-a1</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Anonymous. Show fake information about client.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-p</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>listening_port. Port proxy listens for incoming
|
|
connections. Default is 1443.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-P</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>destination_port. Port to establish outgoing
|
|
connections. Required unless the Transparent plugin is used,
|
|
because the TLS handshake does not contain port information.
|
|
Default is 443.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-c</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>TLS_CHECK_LEVEL. 0 (default) - allow non-TLS traffic to
|
|
pass, 1 - require TLS, only check client HELLO packet, 2 -
|
|
require TLS, check both client and server HELLO, 3 - require
|
|
TLS, check that the server sends a certificate (not
|
|
compatible with TLS 1.3), 4 - require mutual TLS, check that
|
|
the server sends a certificate request and the client sends
|
|
a certificate (not compatible with TLS 1.3)</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="4%">
|
|
|
|
|
|
<p><b>-s</b></p></td>
|
|
<td width="5%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Split the TLS Client HELLO packet across multiple TCP
|
|
segments to make SNI-based DPI detection harder. An optional
|
|
numeric value can follow (e.g. <b>-s1</b>) to control the
|
|
splitting behaviour.</p></td></tr>
|
|
</table>
|
|
|
|
<p style="margin-left:9%;"><b>-Ximap | -Xpop3 |
|
|
-Xsmtp</b></p>
|
|
|
|
<p style="margin-left:18%;">STARTTLS mode for the given
|
|
protocol. The proxy speaks the plaintext protocol with the
|
|
client (greeting, capability advertisement with STARTTLS
|
|
only, STARTTLS command), then, after the client issues
|
|
STARTTLS and sends a TLS Client HELLO, connects to the
|
|
destination taken from SNI (default port 143/110/587),
|
|
performs STARTTLS negotiation with the destination server
|
|
and transparently passes TLS traffic. If the destination
|
|
server does not support STARTTLS, the TLS handshake with the
|
|
client fails.</p>
|
|
|
|
<table width="100%" border="0" rules="none" frame="void"
|
|
cellspacing="0" cellpadding="0">
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-l</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Log. By default logging is to stdout. If <i>logfile</i>
|
|
is specified logging is to file. Under Unix, if
|
|
´<i>@</i>´ precedes <i>logfile</i>, syslog is
|
|
used for logging.</p></td></tr>
|
|
<tr valign="top" align="left">
|
|
<td width="9%"></td>
|
|
<td width="3%">
|
|
|
|
|
|
<p><b>-S</b></p></td>
|
|
<td width="6%"></td>
|
|
<td width="82%">
|
|
|
|
|
|
<p>Increase or decrease stack size. You may want to try
|
|
something like -S8192 if you experience 3proxy crashes.</p></td></tr>
|
|
</table>
|
|
|
|
<h2>CLIENTS
|
|
<a name="CLIENTS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em">You should use a
|
|
client with TLS support or configure a router to redirect
|
|
TLS traffic to the proxy (transparent proxy). Configure the
|
|
client to connect to <i>internal_ip</i> and <i>port</i>. If
|
|
you need to limit clients, use <b>3proxy</b>(8) instead.</p>
|
|
|
|
<h2>BUGS
|
|
<a name="BUGS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em">Report all bugs
|
|
to <b>3proxy@3proxy.org</b></p>
|
|
|
|
<h2>SEE ALSO
|
|
<a name="SEE ALSO"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em">3proxy(8),
|
|
ftppr(8), proxy(8), socks(8), pop3p(8), smtpp(8), tcppm(8),
|
|
udppm(8), syslogd(8), <br>
|
|
https://3proxy.org/</p>
|
|
|
|
<h2>AUTHORS
|
|
<a name="AUTHORS"></a>
|
|
</h2>
|
|
|
|
|
|
<p style="margin-left:9%; margin-top: 1em">3proxy is
|
|
designed by Vladimir Dubrovin <vlad@3proxy.org></p>
|
|
<hr>
|
|
</body>
|
|
</html>
|