3proxy/CHANGELOG

3proxy-1.1.0-pre1 Released October, 24 2026

! Fix: a connect back service (-r) replaced by a configuration reload went on waiting up to 60 seconds for the go-ahead, holding a slot and a thread, and every reload left another connection in the queue of the far side (-R); a connection the -r side closed cost the -R side a client
! Fix: numbered traffic counters were reset by a configuration reload when no counter file was used
+ Configuration reload is atomic: a configuration with an error is refused and the one in force keeps running; a new service on the same address, network namespace and device takes over the old service's listening TCP or UDP socket, so no connection is refused or lost and UDP sessions go on; connections of the old services are re-authenticated against the new configuration (unless noforce), and closed if their service was removed or has no free slot; FTP commands and data connections are authorized by the rules in force
+ Services of one configuration on one address share its listening socket; the admin services page shows the clients and traffic of each listening socket, kept across reloads
+ Logs: each log is opened once and shared by every service using it, kept open over a reload while used and closed once unused; -l takes the same arguments as log; each log is written by a thread of its own from a queue, so a client never waits for a slow log (ODBC, RADIUS, a full disk); a record which finds the queue full is dropped, and dropped records and log failures are reported
+ minlogqueue / maxlogqueue: the records a log's queue keeps room for and holds at most (64 and 4096 by default)
+ ODBC log: the datasource alone names the log, username and password are its parameters, never shown in messages; a log with the same datasource and other credentials reconnects with them
+ threadpool <max_idle> [<idle_seconds>]: a thread whose connection ended waits for the next one of any service, with its memory, instead of ending; by default up to 32 threads per running service; the admin services page shows the pool
+ defaultresolve / sysresolve / fakeresolve apply to the services started after them: defaultresolve (the default) uses the name servers in force, sysresolve the system routines (the C library), as without nserver before
+ timeouts, filtermaxsize, parentretries, delimchar and maxseg apply to the services started after them, so services can have values of their own
+ ssl_ktls / ssl_noktls: kernel TLS (Linux, FreeBSD) with OpenSSL 3.0 or later built with kernel TLS; splice() works over kernel TLS
+ -s:MIN,STREAK,SMALL tunes when the automatic splice() mode splices a direction and when it copies again
+ filtermaxsize 0 removes the limit
+ UDP services (udppm, dnspr) run in one thread each, with no thread per client, using epoll on Linux; dnspr waits for name servers without holding a thread
+ Connection buffers are allocated with the connection structure, together with the thread pool fewer allocations per connection
+ Build-time defaults: -DLOGQUEUEMIN, -DLOGQUEUEMAX, -DDEFAULT_POOLMAX, -DPOOLPERSERVICE, -DDEFAULT_POOLTIMEOUT, -DDEFAULT_MAXCHILD
- splice() in the automatic mode is the default on Linux (-s0 turns it off); a service with data filters, or beginning or ending TLS without kernel TLS both ways, does not splice
- -ni / -ne (Linux network namespaces): threads stay in the namespace 3proxy was started in and enter the configured one only to create a socket; -ni covers the socket SOCKS UDP ASSOCIATE talks to the client on, -ne SOCKS BIND, the UDP sockets towards the destination and the connect back sockets; name resolution, logging and RADIUS stay in the original namespace; the path is opened when the service line is read, and one which is not a network namespace stops the service from starting
- Without nserver, names are resolved by 3proxy's own resolver with the system's name servers (up to 3 from /etc/resolv.conf, on Windows from the registry), answering names of the hosts file first, instead of the C library; both are checked for changes every 5 seconds, nsrecord takes precedence over the hosts file and dnspr forwards queries to them; the C library is used if no name server is found, or with sysresolve
- Dial on demand is removed: dialer is accepted and ignored