Bugfixes, more speed, less CPU/memory usage.
! Fix: dnspr relayed to the client whatever came first to the socket it asked the name server from, from any address and under any id, so a forged answer could be passed on; the query now goes out under a random id, and only an answer from the name server asked, with that id and the same question, is relayed
! Fix: a client sending a part of a TLS record and then nothing kept a thread taking all of a CPU, and the read never timed out
! Fix: without -Ne, the reply to SOCKS CONNECT and BIND gave the address of the client's connection to the proxy instead of the socket towards the destination: a BIND client was told the proxy's own port and the peer could never reach it (since 0.9.6)
! Fix: a client which shut down its sending side (half-close) could get the answer cut short, megabytes short with large answers; likewise an upload after the server half-closed
! Fix: with chroot every local time was UTC and every syslog message was lost: the time zone is loaded and syslog connected before chroot; the chroot entry of 3proxy.cfg(5) lists what PAM, LDAP and ODBC still need inside the chroot
! Fix: the HTTP proxy closed the server connection of a kept-alive client and opened another one when only the request method changed (a POST after a GET to the same host)
! Fix: the last ssl_client_mode in the configuration applied to every service, and a reload changed it for the services still running
! Fix: memory leaks: on every refused configuration reload, on every failed TLS handshake, the server CA paths of every TLS service, compiled pcre: / regex: host names of access rules and patterns of httpsrv rules
! Fix: Unix sockets: on Linux a proxy listening on a Unix socket relayed only the first bytes of an answer (result 95); an abstract socket (unix:@name) was bound under a name padded with zeros, which clients did not reach; tcppm refused port 0 for a unix: target, as given in the manual's example; on a reload the socket file of a listening service was removed
! Fix: SIGPIPE could kill 3proxy when a client was gone while services were starting, and standalone services (proxy, socks, ...) at any time; sends use MSG_NOSIGNAL where the system has it
! Fix: TLS MitM failed for every connection with wolfSSL built with WOLFSSL_QT (wolfSSL 5.9.1 of Ubuntu 26.04): the source certificate's serial number could not be copied; a serial number made from the hash of the source certificate is used then
! Fix: Windows: closing a connection could leave its socket open (SO_LINGER on a non-blocking socket) or reset it while the peer still sent, so the end of an answer could be lost
! Fix: httpsrv: the body of a request answered without being read (for example when authentication is required) was read as the next request; a client still sending when a connection without keep-alive closed could get a reset instead of the answer
! Fix: httpsrv on Windows: UNC paths (\server\share) did not work
! Fix: httpsrv and admin services and their clients were named ZOMBIE on the admin services page, in %N of logs and in RADIUS
! Fix: the Watcom (lite) build did not compile, 1.0.1 had no binaries for it
+ -s (splice) per direction: -s1 splices what the server sends (downloads), -s2 what the client sends (uploads), -s3 both; -s alone splices only where it pays (large bodies, long streams); pipes are kept with the connection for its next requests. splice() is built by default on Linux again and is used only by services given -s
+ Socket options (-oc, -os, -ol, -or, -oR) take NAME=VALUE; NAME=0 turns an option off, also one set by default; an unknown name or a value which is not a number is an error
+ The HTTP proxy frees its 64 KB request buffer while a CONNECT tunnel relays data and while a kept-alive connection waits for its next request: 2000 tunnels take 213 MB instead of 339 MB
+ TLS records are read ahead with OpenSSL 1.1.0 and later: decrypting takes 9-14% less CPU
+ Faster service stop and configuration reload, no fixed delays; a connection waiting for a free maxconn slot gets it at once
- TCP_NODELAY is set by default on proxy-to-client and proxy-to-server sockets; -ocTCP_NODELAY=0 / -osTCP_NODELAY=0 turns it off
- The HTTP proxy fetches ftp:// URLs only when the service is given the new -Xftp option (in a build with FTP=true)
3proxy-1.0.2-x64.zip - Win64 version
3proxy-1.0.2-x86.zip - Win32 version
3proxy-1.0.2-arm64.zip - Windows for ARM64 (ARMv8) version
3proxy-1.0.2-lite.zip - Win32 binaries for older Windows version (Windows Vista and below)
3proxy-1.0.2.x86_64.deb - x86 64 bit (amd64) DEB package
3proxy-1.0.2.arm64.deb - 64 bit ARM (ARMv8, aarch64) DEB package
3proxy-1.0.2.arm.deb - 32 bit ARM (ARMv7, armhf) DEB package
3proxy-1.0.2.el8.x86_64.rpm - x86 64 bit RPM for EL8 (RHEL/AlmaLinux/Rocky 8)
3proxy-1.0.2.el9.x86_64.rpm - x86 64 bit RPM for EL9
3proxy-1.0.2.el10.x86_64.rpm - x86 64 bit RPM for EL10
3proxy-1.0.2.el8.aarch64.rpm - 64 bit ARM RPM for EL8
3proxy-1.0.2.el9.aarch64.rpm - 64 bit ARM RPM for EL9
3proxy-1.0.2.el10.aarch64.rpm - 64 bit ARM RPM for EL10
3proxy_1.0.2-r1_mipsel_24kc.ipk - OpenWrt, MediaTek MT7620/MT7621 (ramips)
3proxy_1.0.2-r1_mips_24kc.ipk - OpenWrt, Atheros/QCA (ath79)
3proxy_1.0.2-r1_arm_cortex-a7_neon-vfpv4.ipk - OpenWrt, 32 bit ARM (ipq40xx)
3proxy_1.0.2-r1_aarch64_cortex-a53.ipk - OpenWrt, 64 bit ARM (mediatek filogic)
3proxy-1.0.2.tar.gz - source code, signed (SHA256SUMS-src, SHA256SUMS-src.asc)
SHA256SUMS-* - checksums for each build
SHA256SUMS-*.asc - OpenPGP signature of the checksums
Verify with the release key 3proxy-release-key.asc in the repository, see SECURITY.md.
The OpenWrt packages are built against OpenWrt 24.10 and depend on its
libopenssl and libpcre2. Install with opkg install ./<file>.ipk. The
package ships a UCI configuration in /etc/config/3proxy and a procd init
script; no service is enabled until you enable it there.