src/Makefile.inc0100644002537100244200000001624410236635111013263 0ustar vladmkgroup#$Id: Makefile.inc,v 1.6 2005/05/06 09:35:05 vlad Exp $ # # 3 proxy common Makefile # all: pre 3proxy$(EXESUFFICS) mycrypt$(EXESUFFICS) dighosts$(EXESUFFICS) pop3p$(EXESUFFICS) ftppr$(EXESUFFICS) tcppm$(EXESUFFICS) udppm$(EXESUFFICS) socks$(EXESUFFICS) proxy$(EXESUFFICS) pre: -cd .. && $(TYPECOMMAND) License $(PREMAKE) sockmap$(OBJSUFFICS): sockmap.c proxy.h $(CC) $(CFLAGS) sockmap.c common$(OBJSUFFICS): common.c proxy.h $(CC) $(CFLAGS) common.c myalloc$(OBJSUFFICS): myalloc.c proxy.h $(CC) $(CFLAGS) myalloc.c base64$(OBJSUFFICS): base64.c $(CC) $(CFLAGS) base64.c ftp$(OBJSUFFICS): ftp.c proxy.h $(CC) $(CFLAGS) ftp.c #$(COMPATLIBS): # $(CC) $(CFLAGS) strncasecmp.c sockgetchar$(OBJSUFFICS): sockgetchar.c proxy.h $(CC) $(CFLAGS) sockgetchar.c proxy$(OBJSUFFICS): proxy.c proxy.h proxymain.c $(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)NOPORTMAP $(DEFINEOPTION)ANONYMOUS proxy.c pop3p$(OBJSUFFICS): pop3p.c proxy.h proxymain.c $(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)NOPORTMAP pop3p.c ftppr$(OBJSUFFICS): ftppr.c proxy.h proxymain.c $(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)NOPORTMAP ftppr.c tcppm$(OBJSUFFICS): tcppm.c proxy.h proxymain.c $(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)PORTMAP tcppm.c socks$(OBJSUFFICS): socks.c proxy.h proxymain.c $(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)NOPORTMAP socks.c udppm$(OBJSUFFICS): udppm.c proxy.h proxymain.c $(CC) $(CFLAGS) $(DEFINEOPTION)WITHMAIN $(DEFINEOPTION)PORTMAP $(DEFINEOPTION)UDP udppm.c 3proxy$(OBJSUFFICS): 3proxy.c proxy.h $(CC) $(CFLAGS) 3proxy.c proxy$(EXESUFFICS): sockmap$(OBJSUFFICS) proxy$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LN) $(LNOUT)proxy$(EXESUFFICS) $(LDFLAGS) $(VERFILE) sockmap$(OBJSUFFICS) proxy$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LIBS) pop3p$(EXESUFFICS): sockmap$(OBJSUFFICS) pop3p$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LN) $(LNOUT)pop3p$(EXESUFFICS) $(LDFLAGS) $(VERFILE) sockmap$(OBJSUFFICS) pop3p$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LIBS) ftppr$(EXESUFFICS): sockmap$(OBJSUFFICS) ftppr$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LN) $(LNOUT)ftppr$(EXESUFFICS) $(LDFLAGS) $(VERFILE) sockmap$(OBJSUFFICS) ftppr$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) ftp$(OBJSUFFICS) $(COMPATLIBS) $(LIBS) socks$(EXESUFFICS): sockmap$(OBJSUFFICS) socks$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(LN) $(LNOUT)socks$(EXESUFFICS) $(LDFLAGS) $(VERFILE) sockmap$(OBJSUFFICS) socks$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(LIBS) tcppm$(EXESUFFICS): sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tcppm$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(LN) $(LNOUT)tcppm$(EXESUFFICS) $(LDFLAGS) $(VERFILE) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) tcppm$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(LIBS) udppm$(EXESUFFICS): sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) udppm$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(LN) $(LNOUT)udppm$(EXESUFFICS) $(LDFLAGS) $(VERFILE) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) udppm$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(LIBS) tcpmainfunc$(OBJSUFFICS): proxy.h proxymain.c $(CC) $(COUT)tcpmainfunc$(OBJSUFFICS) $(CFLAGS) $(DEFINEOPTION)MODULEMAINFUNC=tcpmainfunc proxymain.c udpmainfunc$(OBJSUFFICS): proxy.h proxymain.c $(CC) $(COUT)udpmainfunc$(OBJSUFFICS) $(CFLAGS) $(DEFINEOPTION)MODULEMAINFUNC=udpmainfunc $(DEFINEOPTION)UDP proxymain.c srvproxy$(OBJSUFFICS): proxy.c proxy.h $(CC) $(COUT)srvproxy$(OBJSUFFICS) $(CFLAGS) proxy.c srvpop3p$(OBJSUFFICS): pop3p.c proxy.h $(CC) $(COUT)srvpop3p$(OBJSUFFICS) $(CFLAGS) pop3p.c srvftppr$(OBJSUFFICS): ftppr.c proxy.h $(CC) $(COUT)srvftppr$(OBJSUFFICS) $(CFLAGS) ftppr.c srvtcppm$(OBJSUFFICS): tcppm.c proxy.h $(CC) $(COUT)srvtcppm$(OBJSUFFICS) $(CFLAGS) tcppm.c srvsocks$(OBJSUFFICS): socks.c proxy.h $(CC) $(COUT)srvsocks$(OBJSUFFICS) $(CFLAGS) socks.c srvwebadmin$(OBJSUFFICS): webadmin.c proxy.h $(CC) $(COUT)srvwebadmin$(OBJSUFFICS) $(CFLAGS) webadmin.c srvudppm$(OBJSUFFICS): udppm.c proxy.h $(CC) $(COUT)srvudppm$(OBJSUFFICS) $(CFLAGS) udppm.c srvdnspr$(OBJSUFFICS): dnspr.c proxy.h $(CC) $(COUT)srvdnspr$(OBJSUFFICS) $(CFLAGS) dnspr.c auth$(OBJSUFFICS): auth.c proxy.h $(CC) $(COUT)auth$(OBJSUFFICS) $(CFLAGS) auth.c datatypes$(OBJSUFFICS): datatypes.c proxy.h $(CC) $(COUT)datatypes$(OBJSUFFICS) $(CFLAGS) datatypes.c mycrypt$(OBJSUFFICS): mycrypt.c $(CC) $(COUT)mycrypt$(OBJSUFFICS) $(CFLAGS) mycrypt.c dighosts$(OBJSUFFICS): dighosts.c $(CC) $(COUT)dighosts$(OBJSUFFICS) $(CFLAGS) dighosts.c dighosts$(EXESUFFICS): dighosts$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LN) $(LNOUT)dighosts$(EXESUFFICS) $(LDFLAGS) $(VERFILE) dighosts$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) $(COMPATLIBS) $(LIBS) mycryptmain$(OBJSUFFICS): mycrypt.c $(CC) $(COUT)mycryptmain$(OBJSUFFICS) $(CFLAGS) $(DEFINEOPTION)WITHMAIN mycrypt.c mycrypt$(EXESUFFICS): md4$(OBJSUFFICS) md5$(OBJSUFFICS) mycryptmain$(OBJSUFFICS) base64$(OBJSUFFICS) $(LN) $(LNOUT)mycrypt$(EXESUFFICS) $(VERFILE) $(LDFLAGS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) base64$(OBJSUFFICS) mycryptmain$(OBJSUFFICS) md4$(OBJSUFFICS): libs/md4.h libs/md4.c $(CC) $(COUT)md4$(OBJSUFFICS) $(CFLAGS) libs/md4.c smbdes$(OBJSUFFICS): libs/smbdes.c $(CC) $(COUT)smbdes$(OBJSUFFICS) $(CFLAGS) libs/smbdes.c md5$(OBJSUFFICS): libs/md5.h libs/md5.c $(CC) $(COUT)md5$(OBJSUFFICS) $(CFLAGS) libs/md5.c ntlm$(OBJSUFFICS): ntlm.c $(CC) $(COUT)ntlm$(OBJSUFFICS) $(CFLAGS) ntlm.c stringtable$(OBJSUFFICS): stringtable.c $(CC) $(COUT)stringtable$(OBJSUFFICS) $(CFLAGS) stringtable.c 3proxy$(EXESUFFICS): 3proxy$(OBJSUFFICS) tcpmainfunc$(OBJSUFFICS) udpmainfunc$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) auth$(OBJSUFFICS) datatypes$(OBJSUFFICS) md4$(OBJSUFFICS) md5$(OBJSUFFICS) mycrypt$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) smbdes$(OBJSUFFICS) ntlm$(OBJSUFFICS) stringtable$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS) srvdnspr$(OBJSUFFICS) $(COMPATLIBS) $(LN) $(LNOUT)3proxy$(EXESUFFICS) $(LDFLAGS) $(VERFILE) 3proxy$(OBJSUFFICS) tcpmainfunc$(OBJSUFFICS) udpmainfunc$(OBJSUFFICS) auth$(OBJSUFFICS) datatypes$(OBJSUFFICS) srvproxy$(OBJSUFFICS) srvpop3p$(OBJSUFFICS) srvftppr$(OBJSUFFICS) srvsocks$(OBJSUFFICS) srvtcppm$(OBJSUFFICS) srvudppm$(OBJSUFFICS) sockmap$(OBJSUFFICS) sockgetchar$(OBJSUFFICS) myalloc$(OBJSUFFICS) common$(OBJSUFFICS) mycrypt$(OBJSUFFICS) md5$(OBJSUFFICS) md4$(OBJSUFFICS) base64$(OBJSUFFICS) ftp$(OBJSUFFICS) smbdes$(OBJSUFFICS) ntlm$(OBJSUFFICS) stringtable$(OBJSUFFICS) srvwebadmin$(OBJSUFFICS) srvdnspr$(OBJSUFFICS) $(COMPATLIBS) $(LIBS) clean: @$(REMOVECOMMAND) *$(OBJSUFFICS) $(COMPFILES) src/3proxy.c0100644002537100244200000012155710245102400012455 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: 3proxy.c,v 1.37 2005/05/25 14:00:32 vlad Exp $ */ #include "proxy.h" #ifndef DEFAULTCONFIG #define DEFAULTCONFIG stringtable[20] #endif typedef int (*MAINFUNC)(int, char**); pthread_mutex_t bandlim_mutex; pthread_mutex_t tc_mutex; pthread_mutex_t hash_mutex; pthread_mutex_t acl_mutex; #ifndef NOODBC pthread_mutex_t odbc_mutex; #endif int readconfig(FILE * fp); int haveerror = 0; int linenum = 0; int needreload = 0; char * conffile = NULL; struct counter_header { unsigned char sig[4]; time_t updated; } cheader = {"3CF", (time_t)0}; struct counter_record { unsigned long traf; unsigned long trafgb; time_t cleared; time_t updated; } crecord; struct child { int argc; unsigned char **argv; }; int udpmainfunc (int argc, char** argv); int tcpmainfunc (int argc, char** argv); struct proxydef childdef = {NULL, 0, 0, S_NONE, ""}; #define STRINGBUF 65535 #define NPARAMS 4096 time_t logtime = 0, t = 0; char tmpbuf[1024]; int bandlim_mutex_inited = 0; FILE *writable; extern unsigned char *strings[]; #ifndef _WIN32 char *chrootp = NULL; #endif char * curconf = NULL; FILE * confopen(){ curconf = conffile; #ifndef _WIN32 if(chrootp){ if(strstr(curconf, chrootp) == curconf) curconf += strlen(chrootp); } #endif if(writable) { rewind(writable); return writable; } return fopen(curconf, "r"); } static void * itfree(void *data, void * retval){ myfree(data); return retval; } void clearall(){ struct bandlim * bl; struct trafcount * tc; struct passwords *pw; struct ace *ac; struct ace *acls[256]; struct iplist *ipl; struct portlist *pl; struct userlist *ul; struct chain *ch; int counterd, archiverc; char *logname; unsigned char **archiver; int i; pthread_mutex_lock(&bandlim_mutex); bl = conf.bandlimiter; conf.bandlimiter = NULL; pthread_mutex_unlock(&bandlim_mutex); pthread_mutex_lock(&tc_mutex); tc = conf.trafcounter; conf.trafcounter = NULL; pthread_mutex_unlock(&tc_mutex); counterd = conf.counterd; conf.counterd = -1; logname = conf.logname; conf.logname = NULL; archiverc = conf.archiverc; conf.archiverc = 0; archiver = conf.archiver; conf.archiver = NULL; pthread_mutex_lock(&acl_mutex); for(i = 0; i < 256; i++) { acls[i] = conf.acls[i]; conf.acls[i] = NULL; } pw = conf.pwl; conf.pwl = NULL; pthread_mutex_unlock(&acl_mutex); conf.rotate = 0; conf.logtype = NONE; conf.countertype = NONE; conf.aclnum = 0; logtime = t = 0; conf.authfunc = doconnect; conf.bandlimfunc = NULL; conf.intip = conf.extip = 0; conf.intport = conf.extport = 0; conf.singlepacket = 0; conf.maxchild = 100; usleep(SLEEPTIME); for(; bl; bl = (struct bandlim *) itfree(bl, bl->next)); for(; tc; tc = (struct trafcount *) itfree(tc, tc->next)); for(; pw; pw = (struct passwords *)itfree(pw, pw->next)){ if(pw->user) myfree(pw->user); } if(counterd != -1) { close(counterd); } if(logname) { myfree(logname); } if(archiver) { for(i = 0; i < archiverc; i++) myfree(archiver[i]); myfree(archiver); } for(i = 0; i < 256; i++) { for(ac = acls[i]; ac; ac = (struct ace *) itfree(ac, ac->next)){ for(ipl = ac->src; ipl; ipl = (struct iplist *)itfree(ipl, ipl->next)); for(ipl = ac->dst; ipl; ipl = (struct iplist *)itfree(ipl,ipl->next)); for(pl = ac->ports; pl; pl = (struct portlist *)itfree(pl, pl->next)); for(ul = ac->users; ul && ul->next; ul = ul->next); if(ul) myfree(ul); for(ch = ac->chains; ch; ch = (struct chain *) itfree(ch, ch->next)){ if(ch->extuser) myfree(ch->extuser); if(ch->extpass) myfree(ch->extpass); } } } } int timetoexit = 0; #ifdef _WIN32 OSVERSIONINFO osv; int service = 0; void cyclestep(void); SERVICE_STATUS_HANDLE hSrv; DWORD dwCurrState; int SetStatus( DWORD dwState, DWORD dwExitCode, DWORD dwProgress ) { SERVICE_STATUS srvStatus; srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS; srvStatus.dwCurrentState = dwCurrState = dwState; srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN; srvStatus.dwWin32ExitCode = dwExitCode; srvStatus.dwServiceSpecificExitCode = 0; srvStatus.dwCheckPoint = dwProgress; srvStatus.dwWaitHint = 3000; return SetServiceStatus( hSrv, &srvStatus ); } void __stdcall CommandHandler( DWORD dwCommand ) { FILE *fp; int error; switch( dwCommand ) { case SERVICE_CONTROL_STOP: case SERVICE_CONTROL_SHUTDOWN: SetStatus( SERVICE_STOP_PENDING, 0, 1 ); paused++; timetoexit = 1; Sleep(2000); SetStatus( SERVICE_STOPPED, 0, 0 ); #ifndef NOODBC pthread_mutex_lock(&odbc_mutex); close_sql(); pthread_mutex_unlock(&odbc_mutex); #endif break; case SERVICE_CONTROL_PAUSE: SetStatus( SERVICE_PAUSE_PENDING, 0, 1 ); paused++; SetStatus( SERVICE_PAUSED, 0, 0 ); break; case SERVICE_CONTROL_CONTINUE: SetStatus( SERVICE_CONTINUE_PENDING, 0, 1 ); clearall(); fp = confopen(); if(fp){ error = readconfig(fp); if(error) { clearall(); } if(!writable)fclose(fp); } SetStatus( SERVICE_RUNNING, 0, 0 ); break; default: ; } } void __stdcall ServiceMain(int argc, unsigned char* argv[] ) { hSrv = RegisterServiceCtrlHandler(stringtable[1], (LPHANDLER_FUNCTION)CommandHandler); if( hSrv == 0 ) return; SetStatus( SERVICE_START_PENDING, 0, 1 ); SetStatus( SERVICE_RUNNING, 0, 0 ); cyclestep(); } #else void mysigusr1 (int sig){ needreload = 1; } int even = 0; void mysigpause (int sig){ paused++; even = !even; if(!even){ needreload = 1; } } void mysigterm (int sig){ paused++; usleep(2000*SLEEPTIME); #ifndef NOODBC pthread_mutex_lock(&odbc_mutex); close_sql(); pthread_mutex_unlock(&odbc_mutex); #endif timetoexit = 1; } #endif int reload (void){ FILE *fp; int error = -2; paused++; clearall(); paused++; fp = confopen(); if(fp){ error = readconfig(fp); if(error) { clearall(); } if(!writable)fclose(fp); } return error; } #ifdef _WIN32 DWORD WINAPI startsrv(LPVOID data) { #else void * startsrv(void * data) { #endif struct child *d = (struct child *)data; if(childdef.isudp) udpmainfunc(d->argc, (char **)d->argv); else tcpmainfunc(d->argc, (char **)d->argv); return 0; } int included =0; int parsestr (unsigned char *str, unsigned char **argm, int nitems, char * buf, int *inbuf, int *bufsize){ int argc = 0; int space = 1; int comment = 0; unsigned char * incbegin = 0; int fd; int res, len; int i = 1; unsigned char *str1; for(;;str++)switch(*str){ case '\0': if(comment) return -1; argm[argc] = 0; return argc; case '\"': if(comment && *(str+1) == '\"'){ str1 = str; do { *str1 = *(str1 + 1); }while(*(str1++)); } else { *str = 0; comment = !comment; break; } case '$': if(!comment && !included){ incbegin = str; *str = 0; } break; case '\r': case '\n': case '\t': case ' ': if(!comment){ *str = 0; space = 1; i = 0; if(incbegin){ argc--; if((fd = open((char *)incbegin+1, O_RDONLY)) <= 0){ fprintf(stderr, "Failed to open %s\n", incbegin+1); break; } if((*bufsize - *inbuf) = nitems) return argc; } } } unsigned char * dologname (unsigned char *buf, const unsigned char *name, const unsigned char *ext, ROTATION lt, time_t t) { struct tm *ts; ts = localtime(&t); switch(lt){ case NONE: sprintf((char *)buf, "%s", name); break; case ANNUALLY: sprintf((char *)buf, "%s.%04d", name, ts->tm_year+1900); break; case MONTHLY: sprintf((char *)buf, "%s.%04d.%02d", name, ts->tm_year+1900, ts->tm_mon+1); break; case WEEKLY: t = t - (ts->tm_wday * (60*60*24)); ts = localtime(&t); sprintf((char *)buf, "%s.%04d.%02d.%02d", name, ts->tm_year+1900, ts->tm_mon+1, ts->tm_mday); break; case DAILY: sprintf((char *)buf, "%s.%04d.%02d.%02d", name, ts->tm_year+1900, ts->tm_mon+1, ts->tm_mday); break; case HOURLY: sprintf((char *)buf, "%s.%04d.%02d.%02d-%02d", name, ts->tm_year+1900, ts->tm_mon+1, ts->tm_mday, ts->tm_hour); break; case MINUTELY: sprintf((char *)buf, "%s.%04d.%02d.%02d-%02d.%02d", name, ts->tm_year+1900, ts->tm_mon+1, ts->tm_mday, ts->tm_hour, ts->tm_min); break; default: break; } if(ext){ strcat((char *)buf, "."); strcat((char *)buf, (char *)ext); } return buf; } int wday = 0; time_t basetime = 0; int timechanged (time_t oldtime, time_t newtime, ROTATION lt){ struct tm tmold; struct tm *tm; tm = localtime(&oldtime); memcpy(&tmold, tm, sizeof(tmold)); tm = localtime(&newtime); switch(lt){ case MINUTELY: if(tm->tm_min != tmold.tm_min)return 1; break; case HOURLY: if(tm->tm_hour != tmold.tm_hour)return 1; break; case DAILY: if(tm->tm_yday != tmold.tm_yday)return 1; break; case MONTHLY: if(tm->tm_mon != tmold.tm_mon)return 1; break; case ANNUALLY: if(tm->tm_year != tmold.tm_year)return 1; break; case WEEKLY: if(((newtime - oldtime) > (60*60*24*7)) || tm->tm_wday < tmold.tm_wday || (tm->tm_wday == tmold.tm_wday && (newtime - oldtime) > (60*60*24*6)) )return 1; break; default: break; } return 0; } void cyclestep(void){ struct tm *tm; for(;;){ usleep(SLEEPTIME*1000); if(needreload) { reload(); needreload = 0; } t = time(0); fflush(stdlog); if(timechanged(basetime, t, DAILY)) { tm = localtime(&t); wday = (1 << tm->tm_wday); tm->tm_hour = tm->tm_min = tm->tm_sec = 0; basetime = mktime(tm); } if(conf.logname) { if(timechanged(logtime, t, conf.logtype)) { FILE *fp, *fp1; fp = fopen((char *)dologname (tmpbuf, conf.logname, NULL, conf.logtype, t), "a"); if (fp) { fp1 = stdlog; stdlog = fp; if(fp1) fclose(fp1); } fseek(stdout, 0L, SEEK_END); usleep(SLEEPTIME); logtime = t; if(conf.logtype != NONE && conf.rotate) { t = 1; switch(conf.logtype){ case ANNUALLY: t = t * 12; case MONTHLY: t = t * 4; case WEEKLY: t = t * 7; case DAILY: t = t * 24; case HOURLY: t = t * 60; case MINUTELY: t = t * 60; default: break; } dologname (tmpbuf, conf.logname, (conf.archiver)?conf.archiver[1]:NULL, conf.logtype, (logtime - t*conf.rotate)); remove ((char *)tmpbuf); if(conf.archiver) { int i; *tmpbuf = 0; for(i = 2; i < conf.archiverc && strlen((char *)tmpbuf) < 512; i++){ strcat((char *)tmpbuf, " "); if(!strcmp((char *)conf.archiver[i], "%A")){ strcat((char *)tmpbuf, "\""); dologname (tmpbuf + strlen((char *)tmpbuf), conf.logname, conf.archiver[1], conf.logtype, (logtime - t)); strcat((char *)tmpbuf, "\""); } else if(!strcmp((char *)conf.archiver[i], "%F")){ strcat((char *)tmpbuf, "\""); dologname (tmpbuf+strlen((char *)tmpbuf), conf.logname, NULL, conf.logtype, (logtime-t)); strcat((char *)tmpbuf, "\""); } else strcat((char *)tmpbuf, (char *)conf.archiver[i]); } system((char *)tmpbuf+1); } } } } if(conf.counterd >= 0) { time(&t); if(timechanged(cheader.updated, t, MINUTELY)){ struct trafcount *tl; if(conf.countertype && timechanged(cheader.updated, t, conf.countertype)){ FILE * cfp; cfp = fopen(dologname(tmpbuf, conf.counterfile, NULL, conf.countertype, t), "w"); if(cfp){ for(tl = conf.trafcounter; cfp && tl; tl = tl->next){ if(tl->type >= conf.countertype) fprintf(cfp, "%05d %010lu %010lu\n", tl->number, tl->trafgb, tl->traf); } fclose(cfp); } } for(tl = conf.trafcounter; tl; tl = tl->next){ if(tl->number){ if(tl->type!=NEVER && timechanged(tl->cleared, t, tl->type)){ tl->cleared = t; tl->traf = 0; tl->trafgb = 0; } lseek(conf.counterd, sizeof(struct counter_header) + (tl->number - 1) * sizeof(struct counter_record), SEEK_SET); crecord.traf = tl->traf; crecord.trafgb = tl->trafgb; crecord.cleared = tl->cleared; crecord.updated = tl->updated; write(conf.counterd, &crecord, sizeof(struct counter_record)); } } cheader.updated = t; lseek(conf.counterd, 0, SEEK_SET); write(conf.counterd, &cheader, sizeof(struct counter_header)); } } if(timetoexit)return; } } #define RETURN(x) {res = x; goto CLEARRETURN;} int readconfig(FILE * fp){ unsigned char ** args = NULL; unsigned char * buf = NULL; pthread_t thread; struct child chdata; struct child * ch=&chdata; int bufsize = STRINGBUF*2; int inbuf = 0; int cargc; struct ace *acl = NULL; struct passwords *pwl = NULL; struct chain *chains; unsigned char *arg; int res = 0; #ifdef _WIN32 HANDLE h; #endif if( !(buf = myalloc(bufsize)) || ! (args = myalloc(NPARAMS * sizeof(unsigned char *) + 1)) ) { fprintf(stderr, "No memory for configuration"); return(10); } ch->argv = args; for (linenum = 1; fgets((char *)buf, STRINGBUF, fp); linenum++){ if(!*buf || isspace(*buf) || (*buf) == '#')continue; inbuf = (strlen(buf) + 1); cargc = parsestr (buf, args, NPARAMS-1, buf, &inbuf, &bufsize); if(cargc < 1) { fprintf(stderr, "Parse error line %d\n", linenum); return(21); } ch->argv[cargc] = NULL; ch->argc = cargc; if(!strcmp((char *)ch->argv[0], "proxy")) { childdef.pf = proxychild; childdef.port = 3128; childdef.isudp = 0; childdef.service = S_PROXY; childdef.helpmessage = " -n - no NTLM support\n"; } else if(!strcmp((char *)ch->argv[0], "pop3p")) { childdef.pf = pop3pchild; childdef.port = 110; childdef.isudp = 0; childdef.service = S_POP3P; childdef.helpmessage = ""; } else if(!strcmp((char *)ch->argv[0], "ftppr")) { childdef.pf = ftpprchild; childdef.port = 21; childdef.isudp = 0; childdef.service = S_FTPPR; childdef.helpmessage = ""; } else if(!strcmp((char *)ch->argv[0], "socks")) { childdef.pf = sockschild; childdef.port = 1080; childdef.isudp = 0; childdef.service = S_SOCKS; childdef.helpmessage = " -n - no NTLM support\n"; } else if(!strcmp((char *)ch->argv[0], "tcppm")) { childdef.pf = tcppmchild; childdef.port = 0; childdef.isudp = 0; childdef.service = S_TCPPM; childdef.helpmessage = ""; } else if(!strcmp((char *)ch->argv[0], "udppm")) { childdef.pf = udppmchild; childdef.port = 0; childdef.isudp = 1; childdef.service = S_UDPPM; childdef.helpmessage = " -s single packet UDP service for request/reply (DNS-like) services\n"; } else if(!strcmp((char *)ch->argv[0], "admin")) { childdef.pf = adminchild; childdef.port = 80; childdef.isudp = 0; childdef.service = S_ADMIN; } else if(!strcmp((char *)ch->argv[0], "dnspr")) { childdef.pf = dnsprchild; childdef.port = 53; childdef.isudp = 1; childdef.service = S_DNSPR; } else if(!strcmp((char *)ch->argv[0], "internal") && ch->argc == 2) { conf.intip = getip((unsigned char *)ch->argv[1]); continue; } else if(!strcmp((char *)ch->argv[0], "external") && ch->argc == 2) { conf.extip = getip((unsigned char *)ch->argv[1]); continue; } else if(!strcmp((char *)ch->argv[0], "log") && ch->argc <= 3) { conf.logfunc = logstdout; if(ch->argc > 1) { if(*ch->argv[1]=='@'){ #ifndef _WIN32 openlog((char *)ch->argv[1]+1, LOG_PID, LOG_DAEMON); conf.logfunc = logsyslog; #endif } #ifndef NOODBC else if(*ch->argv[1]=='&'){ pthread_mutex_lock(&odbc_mutex); close_sql(); init_sql((char *)ch->argv[1]+1); pthread_mutex_unlock(&odbc_mutex); conf.logfunc = logsql; } #endif else { FILE *fp, *fp1; if(ch->argc > 2) { switch(*ch->argv[2]){ case 'd': case 'D': conf.logtype = DAILY; break; case 'w': case 'W': conf.logtype = WEEKLY; break; case 'y': case 'Y': conf.logtype = ANNUALLY; break; case 'm': case 'M': conf.logtype = MONTHLY; break; case 'h': case 'H': conf.logtype = HOURLY; break; case 'c': case 'C': conf.logtype = MINUTELY; break; default: break; } } logtime = time(0); conf.logname = mystrdup(ch->argv[1]); fp = fopen((char *)dologname (tmpbuf, conf.logname, NULL, conf.logtype, logtime), "a"); if(!fp){ perror("fopen()"); } else { fp1 = stdlog; stdlog = fp; if(fp1) fclose(fp1); } } } continue; } else if(!strcmp((char *)ch->argv[0], "service") && ch->argc == 1) { #ifdef _WIN32 if(osv.dwPlatformId == VER_PLATFORM_WIN32_NT) service = 1; else { if(!demon)daemonize(); demon = 1; } #endif continue; } else if(!strcmp((char *)ch->argv[0], "daemon") && ch->argc == 1) { if(!demon)daemonize(); demon = 1; continue; } else if(!strcmp((char *)ch->argv[0], "writable") && ch->argc == 1) { if(!writable){ writable = freopen(curconf, "r+", fp); if(!writable){ fprintf(stderr, "Unable to reopen config for writing: %s\n", curconf); return -28; } } continue; } else if(!strcmp((char *)ch->argv[0], "end") && ch->argc == 1) { break; } else if(!strcmp((char *)ch->argv[0], "config") && ch->argc == 2) { if(conffile)myfree(conffile); conffile = mystrdup(ch->argv[1]); continue; } else if(!strcmp((char *)ch->argv[0], "include") && ch->argc == 2) { FILE *fp1; fp1 = fopen(ch->argv[1], "r"); if(!fp1){ fprintf(stderr, "Unable to open included file: %s\n", ch->argv[1]); return -28; } res = readconfig(fp1); fclose(fp1); if(res) return res; continue; } else if(!strcmp((char *)ch->argv[0], "archiver") && ch->argc > 2) { int j; conf.archiver = myalloc(ch->argc * sizeof(char *)); if(conf.archiver) { conf.archiverc = ch->argc; for(j = 0; j < conf.archiverc; j++) conf.archiver[j] = mystrdup(ch->argv[j]); } continue; } else if(!strcmp((char *)ch->argv[0], "counter") && ch->argc >= 2) { if(conf.counterd >=0)close(conf.counterd); conf.counterd = open(ch->argv[1], O_BINARY|O_RDWR|O_CREAT, 0660); if(conf.counterd<0){ fprintf(stderr, "Unable to open counter file %s, line %d\n", ch->argv[1], linenum); return(18); } if(ch->argc >=4) { switch(*ch->argv[2]){ case 'd': case 'D': conf.countertype = DAILY; break; case 'w': case 'W': conf.countertype = WEEKLY; break; case 'y': case 'Y': conf.countertype = ANNUALLY; break; case 'm': case 'M': conf.countertype = MONTHLY; break; case 'h': case 'H': conf.countertype = HOURLY; break; case 'c': case 'C': conf.countertype = MINUTELY; break; default: fprintf(stderr, "Unknown counter type, line: %d\n", linenum); return(18); } conf.counterfile = mystrdup(ch->argv[3]); } continue; } else if(!strcmp((char *)ch->argv[0], "rotate") && ch->argc == 2) { conf.rotate = atoi((char *)ch->argv[1]); continue; } else if(!strcmp((char *)ch->argv[0], "logformat") && ch->argc == 2 && strlen((char *)ch->argv[1])) { if(conf.logformat) myfree(conf.logformat); conf.logformat = mystrdup(ch->argv[1]); continue; } else if(!strcmp((char *)ch->argv[0], "timeouts") && ch->argc > 1) { int j; for(j = 0; conf.timeouts[j] && j + 1 < ch->argc; j++) { if((conf.timeouts[j] = atoi((char *)ch->argv[j + 1])) <= 0 || conf.timeouts[j] > 2000000){ fprintf(stderr, "Invalid timeout: %s, line %d\n", ch->argv[j + 1], linenum); return(19); } } continue; } else if(!strcmp((char *)ch->argv[0], "auth") && ch->argc == 2) { if(!strcmp((char *)ch->argv[1], "none")){ conf.authfunc = alwaysauth; } else if (!strcmp((char *)ch->argv[1], "iponly")){ conf.authfunc = ipauth; } else if (!strcmp((char *)ch->argv[1], "nbname")){ conf.authfunc = nbnameauth; } else if (!strcmp((char *)ch->argv[1], "strong")){ conf.authfunc = strongauth; } else { fprintf(stderr, "Unknown auth type: '%s' line %d\n", ch->argv[1], linenum); return(22); } continue; } else if(!strcmp((char *)ch->argv[0], "maxconn") && ch->argc == 2) { conf.maxchild = atoi(ch->argv[1]); if(!conf.maxchild) { fprintf(stderr, "Invalid maxconn value, line %d\n", linenum); return(22); } continue; } else if (!strcmp((char *)ch->argv[0], "users") && ch->argc >= 2) { int j; for (j = 1; jargc; j++) { if(!conf.pwl)conf.pwl = pwl = myalloc(sizeof(struct passwords)); else { pwl->next = myalloc(sizeof(struct passwords)); pwl = pwl->next; } if(!pwl) { fprintf(stderr, "No memory for PWL entry, line %d\n", linenum); return(22); } memset(pwl, 0, sizeof(struct passwords)); pwl->user = mystrdup(ch->argv[j]); arg = (unsigned char *)strchr((char *)pwl->user, ':'); if(!arg||!arg[1]||!arg[2]||arg[3]!=':') { continue; } pwl->password = arg + 4; if(arg[1] == 'C' && arg[2] == 'L')pwl->pwtype = CL; else if(arg[1] == 'C' && arg[2] == 'R')pwl->pwtype = CR; else if(arg[1] == 'N' && arg[2] == 'T'){ pwl->pwtype = NT; fromhex(pwl->password, pwl->password, (strlen(pwl->password)>>1)); } else if(arg[1] == 'L' && arg[2] == 'M')pwl->pwtype = LM; else { continue; } *arg = 0; } continue; } else if (( (!strcmp((char *)ch->argv[0], "allow") && (res=ALLOW) == ALLOW) || (!strcmp((char *)ch->argv[0], "deny") && (res=DENY) == DENY) || (!strcmp((char *)ch->argv[0], "redirect") && ch->argc >= 3 && (res=REDIRECT) ==REDIRECT) || (!strcmp((char *)ch->argv[0], "bandlimin") && ch->argc >= 2 && (res=BANDLIM) ==BANDLIM) || (!strcmp((char *)ch->argv[0], "nobandlimin") && (res=NOBANDLIM) ==NOBANDLIM) || (!strcmp((char *)ch->argv[0], "countin") && ch->argc >= 4 && (res=COUNT) ==COUNT) || (!strcmp((char *)ch->argv[0], "nocountin") && (res=NOCOUNT) ==NOCOUNT) )) { int offset = 0; struct iplist *ipl=NULL; struct portlist *portl=NULL; struct userlist *userl=NULL; if(res == REDIRECT) offset = 2; else if(res == BANDLIM) offset = 1; else if(res == COUNT) offset = 3; acl = myalloc(sizeof(struct ace)); if(!acl) { fprintf(stderr, "No memory for ACL entry, line %d\n", linenum); return(22); } memset(acl, 0, sizeof(struct ace)); acl->action = res; if(res == 2){ acl->chains = myalloc(sizeof(struct chain)); if(!acl->chains) { fprintf(stderr, "No memory for ACL entry, line %d\n", linenum); return(22); } acl->chains->type = R_HTTP; acl->chains->redirip = getip(ch->argv[1]); acl->chains->redirport = htons((unsigned short)atoi((char *)ch->argv[2])); acl->chains->weight = 1000; acl->chains->extuser = NULL; acl->chains->extpass = NULL; acl->chains->next = NULL; } if(ch->argc - offset >= 2 && strcmp("*", (char *)ch->argv[1 + offset])) { arg = (unsigned char *)mystrdup((char *)ch->argv[1 + offset]); arg = (unsigned char *)strtok((char *)arg, ","); do { if(!acl->users) { acl->users = userl = myalloc(sizeof(struct userlist)); } else { userl->next = myalloc(sizeof(struct userlist)); userl = userl -> next; } if(!userl) { fprintf(stderr, "No memory for ACL entry, line %d\n", linenum); return(22); } memset(userl, 0, sizeof(struct userlist)); userl->user=arg; } while((arg = (unsigned char *)strtok((char *)NULL, ","))); } if(ch->argc - offset >= 3 && strcmp("*", (char *)ch->argv[2 + offset])) { arg = (unsigned char *)strtok((char *)ch->argv[2 + offset], ","); do { if(!acl->src) { acl->src = ipl = myalloc(sizeof(struct iplist)); } else { ipl->next = myalloc(sizeof(struct iplist)); ipl = ipl -> next; } if(!ipl) { fprintf(stderr, "No memory for ACL entry, line %d\n", linenum); return(22); } memset(ipl, 0, sizeof(struct iplist)); if (!scanaddr(arg, &ipl->ip, &ipl->mask)) { fprintf(stderr, "Invalid IP or CIDR, line %d\n", linenum); return(22); } } while((arg = (unsigned char *)strtok((char *)NULL, ","))); } if(ch->argc - offset >= 4 && strcmp("*", (char *)ch->argv[3 + offset])) { arg = (unsigned char *)strtok((char *)ch->argv[3 + offset], ","); do { if(!acl->dst) { acl->dst = ipl = myalloc(sizeof(struct iplist)); } else { ipl->next = myalloc(sizeof(struct iplist)); ipl = ipl -> next; } if(!ipl) { fprintf(stderr, "No memory for ACL entry, line %d\n", linenum); return(22); } memset(ipl, 0, sizeof(struct iplist)); if (!scanaddr(arg, &ipl->ip, &ipl->mask)) { fprintf(stderr, "Invalid IP or CIDR, line %d\n", linenum); return(22); } } while((arg = (unsigned char *)strtok((char *)NULL, ","))); } if(ch->argc - offset >= 5 && strcmp("*", (char *)ch->argv[4 + offset])) { arg = (unsigned char *)strtok((char *)ch->argv[4 + offset], ","); do { if(!acl->ports) { acl->ports = portl = myalloc(sizeof(struct portlist)); } else { portl->next = myalloc(sizeof(struct portlist)); portl = portl -> next; } if(!portl) { fprintf(stderr, "No memory for ACL entry, line %d\n", linenum); return(22); } memset(portl, 0, sizeof(struct portlist)); res = sscanf((char *)arg, "%hu-%hu", &portl->startport, &portl->endport); if(res < 1) { fprintf(stderr, "Invalid port or port range, line %d\n", linenum); return(23); } if (res == 1) portl->endport = portl->startport; } while((arg = (unsigned char *)strtok((char *)NULL, ","))); } if(ch->argc - offset >= 6 && strcmp("*", (char *)ch->argv[5 + offset])) { arg = (unsigned char *)strtok((char *)ch->argv[5 + offset], ","); do { if(!strcmp((char *)arg, "CONNECT")){ acl->operation |= CONNECT; } else if(!strcmp((char *)arg, "BIND")){ acl->operation |= BIND; } else if(!strcmp((char *)arg, "UDPASSOC")){ acl->operation |= UDPASSOC; } else if(!strcmp((char *)arg, "ICMPASSOC")){ acl->operation |= ICMPASSOC; } else if(!strcmp((char *)arg, "HTTP_GET")){ acl->operation |= HTTP_GET; } else if(!strcmp((char *)arg, "HTTP_PUT")){ acl->operation |= HTTP_PUT; } else if(!strcmp((char *)arg, "HTTP_POST")){ acl->operation |= HTTP_POST; } else if(!strcmp((char *)arg, "HTTP_HEAD")){ acl->operation |= HTTP_HEAD; } else if(!strcmp((char *)arg, "HTTP_OTHER")){ acl->operation |= HTTP_OTHER; } else if(!strcmp((char *)arg, "HTTP_CONNECT")){ acl->operation |= HTTP_CONNECT; } else if(!strcmp((char *)arg, "HTTP")){ acl->operation |= HTTP; } else if(!strcmp((char *)arg, "HTTPS")){ acl->operation |= HTTPS; } else if(!strcmp((char *)arg, "FTP_GET")){ acl->operation |= FTP_GET; } else if(!strcmp((char *)arg, "FTP_PUT")){ acl->operation |= FTP_PUT; } else if(!strcmp((char *)arg, "FTP_LIST")){ acl->operation |= FTP_LIST; } else if(!strcmp((char *)arg, "FTP")){ acl->operation |= FTP; } else if(!strcmp((char *)arg, "ADMIN")){ acl->operation |= ADMIN; } else { fprintf(stderr, "Unknown operation type: %s line %d\n", arg, linenum); return(31); } } while((arg = (unsigned char *)strtok((char *)NULL, ","))); } if(ch->argc - offset >= 7){ for(arg = ch->argv[6 + offset]; *arg;){ int val, val1; if(!isnumber(*arg)) continue; val1 = val = (*arg - '0'); arg++; if(*arg == '-' && isnumber(*(arg+1)) && (*(arg+1) - '0') > val) { val1 = (*(arg+1) - '0'); arg+=2; } for(; val<=val1; val++) acl->wdays |= (1 << (val % 7)); } } if(ch->argc - offset >= 8){ for(arg = ch->argv[7 + offset]; strlen(arg) >= 17 && isdigit(arg[0]) && isdigit(arg[1]) && isdigit(arg[3]) && isdigit(arg[4]) && isdigit(arg[6]) && isdigit(arg[7]) && isdigit(arg[9]) && isdigit(arg[10]) && isdigit(arg[12]) && isdigit(arg[13]) && isdigit(arg[15]) && isdigit(arg[16]) ; arg+=18){ int t1, t2; struct period *sp; t1 = (arg[0] - '0') * 10 + (arg[1] - '0'); t1 = (t1 * 60) + (arg[3] - '0') * 10 + (arg[4] - '0'); t1 = (t1 * 60) + (arg[6] - '0') * 10 + (arg[7] - '0'); t2 = (arg[9] - '0') * 10 + (arg[10] - '0'); t2 = (t2 * 60) + (arg[12] - '0') * 10 + (arg[13] - '0'); t2 = (t2 * 60) + (arg[15] - '0') * 10 + (arg[16] - '0'); if(t2 < t1) break; sp = myalloc(sizeof(struct period)); if(sp){ sp->fromtime = t1; sp->totime = t2; sp->next = acl->periods; acl->periods = sp; } if(arg[17]!=',') break; } } if(acl->action == ALLOW || acl->action == DENY || acl->action == REDIRECT) { pthread_mutex_lock(&acl_mutex); if(!conf.acls[conf.aclnum]){ conf.acls[conf.aclnum] = acl; } else { struct ace * acei; for(acei = conf.acls[conf.aclnum]; acei->next; acei = acei->next); acei->next = acl; } pthread_mutex_unlock(&acl_mutex); } else if (acl->action == BANDLIM || acl->action == NOBANDLIM) { struct bandlim * nbl; nbl = myalloc(sizeof(struct bandlim)); if(!nbl) { fprintf(stderr, "No memory to create band limit filter\n"); return(32); } memset(nbl, 0, sizeof(struct bandlim)); nbl->ace = acl; if(acl->action == BANDLIM) { sscanf(ch->argv[1], "%u", &nbl->rate); if(nbl->rate < 300) { fprintf(stderr, "Wrong bandwidth specified, line %d\n", linenum); return(33); } } pthread_mutex_lock(&bandlim_mutex); if(!conf.bandlimiter){ conf.bandlimiter = nbl; } else { struct bandlim * bli; for(bli = conf.bandlimiter; bli->next; bli = bli->next); bli->next = nbl; } pthread_mutex_unlock(&bandlim_mutex); } else if (acl->action == COUNT || acl->action == NOCOUNT) { struct trafcount * tl; tl = myalloc(sizeof(struct trafcount)); if(!tl) { fprintf(stderr, "No memory to create traffic limit filter\n"); return(32); } memset(tl, 0, sizeof(struct trafcount)); tl->ace = acl; if(acl->action == COUNT) { unsigned long lim; tl->comment = mystrdup(ch->argv[1]); while(isdigit(*tl->comment))tl->comment++; if(*tl->comment== '/')tl->comment++; sscanf(ch->argv[1], "%u", &tl->number); sscanf(ch->argv[3], "%lu", &lim); tl->traflimgb = (lim>>10); tl->traflim = ((lim - (tl->traflimgb<<10))<<20); switch(*ch->argv[2]){ case 'd': case 'D': tl->type = DAILY; break; case 'w': case 'W': tl->type = WEEKLY; break; case 'y': case 'Y': tl->type = ANNUALLY; break; case 'm': case 'M': tl->type = MONTHLY; break; case 'n': case 'N': tl->type = NEVER; break; default: fprintf(stderr, "Unknown rotation type, line: %d\n", linenum); return(34); } if(!tl->traflim && tl->traflimgb) { fprintf(stderr, "Wrong traffic limit specified, line %d\n", linenum); return(35); } if(tl->number != 0 && conf.counterd >= 0) { lseek(conf.counterd, sizeof(struct counter_header) + (tl->number - 1) * sizeof(struct counter_record), SEEK_SET); memset(&crecord, 0, sizeof(struct counter_record)); read(conf.counterd, &crecord, sizeof(struct counter_record)); tl->traf = crecord.traf; tl->trafgb = crecord.trafgb; tl->cleared = crecord.cleared; tl->updated = crecord.updated; } } pthread_mutex_lock(&tc_mutex); if(!conf.trafcounter){ conf.trafcounter = tl; } else { struct trafcount * ntl; for(ntl = conf.trafcounter; ntl->next; ntl = ntl->next); ntl->next = tl; } pthread_mutex_unlock(&tc_mutex); /* tl->next = conf.trafcounter; conf.trafcounter = tl; */ } continue; } else if(!strcmp((char *)ch->argv[0], "flush") && ch->argc == 1) { if (conf.aclnum<255) conf.aclnum++; continue; } else if(!strcmp((char *)ch->argv[0], "parent") && ch->argc >=5) { if(!acl || (acl->action && acl->action != 2)) { fprintf(stderr, "Chaining error: last ACL entry was not \"allow\" or \"redirect\" on line %d\n", linenum); return(41); } acl->action = 2; chains = NULL; if(!acl->chains) { chains = acl->chains = myalloc(sizeof(struct chain)); } else { chains = acl->chains; while(chains->next)chains = chains->next; chains->next = myalloc(sizeof(struct chain)); chains = chains->next; } memset(chains, 0, sizeof(struct chain)); if(!chains){ fprintf(stderr, "Chainig error: unable to allocate memory for chain\n"); return(44); } chains->weight = (unsigned)atoi((char *)ch->argv[1]); if(chains->weight == 0 || chains->weight >1000) { fprintf(stderr, "Chaining error: bad chain weight %u line %d\n", chains->weight, linenum); return(42); } if(!strcmp((char *)ch->argv[2], "tcp"))chains->type = R_TCP; else if(!strcmp((char *)ch->argv[2], "http"))chains->type = R_HTTP; else if(!strcmp((char *)ch->argv[2], "connect"))chains->type = R_CONNECT; else if(!strcmp((char *)ch->argv[2], "socks4"))chains->type = R_SOCKS4; else if(!strcmp((char *)ch->argv[2], "socks5"))chains->type = R_SOCKS5; else if(!strcmp((char *)ch->argv[2], "pop3"))chains->type = R_POP3; else if(!strcmp((char *)ch->argv[2], "ftp"))chains->type = R_FTP; else { fprintf(stderr, "Chaining error: bad chain type (%s)\n", ch->argv[2]); return(43); } chains->redirip = getip(ch->argv[3]); chains->redirport = htons((unsigned short)atoi((char *)ch->argv[4])); if(ch->argc > 5) chains->extuser = mystrdup(ch->argv[5]); if(ch->argc > 6) chains->extpass = mystrdup(ch->argv[6]); continue; } else if(!strcmp((char *)ch->argv[0], "nserver") && ch->argc == 2) { for(res = 0; nservers[res] && res < MAXNSERVERS; res++); if(res < MAXNSERVERS) { nservers[res] = getip(ch->argv[1]); } resolvfunc = myresolver; continue; } else if(!strcmp((char *)ch->argv[0], "fakeresolve") && ch->argc == 1) { resolvfunc = fakeresolver; continue; } else if(!strcmp((char *)ch->argv[0], "nscache") && ch->argc == 2) { res = atoi(ch->argv[1]); if(res < 256) { fprintf(stderr, "Invalid NS cache size: %d\n", res); } if(inithashtable((unsigned)res)){ fprintf(stderr, "Failed to initialize NS cache\n"); } continue; } else if(!strcmp((char *)ch->argv[0], "nsrecord") && ch->argc == 3) { hashadd(mystrdup(ch->argv[1]), getip(ch->argv[2]), (time_t)0xffffffff); continue; } else if(!strcmp((char *)ch->argv[0], "dialer") && ch->argc == 2) { demanddialprog = mystrdup(ch->argv[1]); continue; } else if(!strcmp((char *)ch->argv[0], "system") && ch->argc == 2) { if((res = system((char *)ch->argv[1])) == -1){ fprintf(stderr, "Failed to start %s\n", ch->argv[1]); return(33); } continue; } else if(!strcmp((char *)ch->argv[0], "pidfile") && ch->argc == 2) { FILE *pidf; if(!(pidf = fopen(ch->argv[1], "w"))){ fprintf(stderr, "Failed to open pid file %s\n", ch->argv[1]); return(34); } fprintf(pidf,"%u", (unsigned)getpid()); fclose(pidf); continue; } #ifndef _WIN32 else if(!strcmp((char *)ch->argv[0], "setuid") && ch->argc == 2) { res = atoi((char *)ch->argv[1]); if(!res || setuid(res)) { fprintf(stderr, "Unable to set uid %d", res); return(30); } continue; } else if(!strcmp((char *)ch->argv[0], "setgid") && ch->argc == 2) { res = atoi((char *)ch->argv[1]); if(!res || setgid(res)) { fprintf(stderr, "Unable to set gid %d", res); return(31); } continue; } else if(!strcmp((char *)ch->argv[0], "chroot") && ch->argc == 2) { if(!chrootp){ char *p; if(chroot((char *)ch->argv[1])) { fprintf(stderr, "Unable to chroot %s", ch->argv[1]); return(32); } p = (char *)ch->argv[1] + strlen((char *)ch->argv[1]) ; while (p > (char *)ch->argv[1] && p[-1] == '/'){ p--; *p = 0; } chrootp = strdup((char *)ch->argv[1]); } continue; } #endif else { fprintf(stderr, "Unknown command: '%s' line %d\n", ch->argv[0], linenum); return(22); } conf.threadinit = 1; #ifdef _WIN32 h = CreateThread((LPSECURITY_ATTRIBUTES )NULL, 0, startsrv, (void *) ch, (DWORD)0, &thread); if(h)CloseHandle(h); #else pthread_attr_init(&pa); pthread_attr_setstacksize(&pa,PTHREAD_STACK_MIN + 16384); pthread_attr_setdetachstate(&pa,PTHREAD_CREATE_DETACHED); pthread_create(&thread, &pa, startsrv, (void *)ch); #endif while(conf.threadinit)usleep(SLEEPTIME); if(haveerror) { fprintf(stderr, "Service not started on line: %d\n", linenum); return(40); } } myfree(buf); buf = NULL; myfree(args); args = NULL; return 0; } int main(int argc, char * argv[]) { int res = 0; FILE * fp = NULL; #ifdef _WIN32 unsigned char * arg; WSADATA wd; WSAStartup(MAKEWORD( 1, 1 ), &wd); osv.dwOSVersionInfoSize = sizeof(osv); GetVersionEx(&osv); #endif stringtable = strings; #ifdef _WIN32 if((argc == 2 || argc == 3)&& !strcmp((char *)argv[1], "--install")) { sprintf((char *)tmpbuf, "%s will be installed and started.\n" "By clicking Yes you confirm you read and accepted License Agreement.\n" "You can use Administration/Services to control %s service.", stringtable[1], stringtable[2]); if(MessageBox(NULL, tmpbuf, stringtable[2], MB_YESNO|MB_ICONASTERISK) != IDYES) return 1; *tmpbuf = '\"'; if (!(res = SearchPath(NULL, argv[0], ".exe", 256, tmpbuf+1, (char **)&arg))) { perror("Failed to find executable filename"); RETURN(102); } strcat((char *)tmpbuf, "\" \""); if(!(res = GetFullPathName ((argc == 3)?argv[2]:(char*)DEFAULTCONFIG, 256, tmpbuf+res+4, (char **)&arg))){ perror("Failed to find config filename"); RETURN(103); } strcat((char *)tmpbuf, "\""); if(osv.dwPlatformId == VER_PLATFORM_WIN32_NT){ SC_HANDLE sch; if(!(sch = OpenSCManager(NULL, NULL, GENERIC_WRITE|SERVICE_START ))){ perror("Failed to open Service Manager"); RETURN(101); } if (!(sch = CreateService(sch, stringtable[1], stringtable[2], GENERIC_EXECUTE, SERVICE_WIN32_OWN_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_IGNORE, tmpbuf, NULL, NULL, NULL, NULL, NULL))){ perror("Failed to create service"); RETURN(103); } if (!StartService(sch, 0, NULL)) { perror("Failed to start service"); RETURN(103); } } else { HKEY runsrv; if(RegOpenKeyEx( HKEY_LOCAL_MACHINE, "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices", 0, KEY_ALL_ACCESS, &runsrv) != ERROR_SUCCESS){ perror("Failed to open registry"); RETURN(104); } if(RegSetValueEx( runsrv, stringtable[1], 0, REG_EXPAND_SZ, tmpbuf, strlen(tmpbuf)+1)!=ERROR_SUCCESS){ perror("Failed to set registry value"); RETURN(105); } } return 0; } if((argc == 2 || argc == 3)&& !strcmp((char *)argv[1], "--remove")) { if(osv.dwPlatformId == VER_PLATFORM_WIN32_NT){ SC_HANDLE sch; if(!(sch = OpenSCManager(NULL, NULL, GENERIC_WRITE))){ perror("Failed to open Service Manager\n"); RETURN(106); } if (!(sch = OpenService(sch, stringtable[1], DELETE))){ perror("Failed to open service"); RETURN(107); } if (!DeleteService(sch)){ perror("Failed to delete service"); RETURN(108); } } else { HKEY runsrv; if(RegOpenKeyEx( HKEY_LOCAL_MACHINE, "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices", 0, KEY_ALL_ACCESS, &runsrv) != ERROR_SUCCESS){ perror("Failed to open registry"); RETURN(109); } if(RegDeleteValue(runsrv, stringtable[1]) != ERROR_SUCCESS){ perror("Failed to clear registry"); RETURN(110); } } RETURN(0); } #endif conffile = mystrdup((argc==2)?argv[1]:(char*)DEFAULTCONFIG); if(conffile && *conffile != '-') { fp = confopen(); #ifndef _WIN32 if(!fp) fp = stdin; #endif } if(argc > 2 || !(fp)) { fprintf(stderr, "Usage: %s [conffile]\n", argv[0]); #ifdef _WIN32 fprintf(stderr, "\n\t%s --install\n\tto install as service\n" "\n\t%s --remove\n\tto remove service\n", argv[0], argv[0]); #endif fprintf(stderr, "\n%s", copyright); return 1; } pthread_mutex_init(&acl_mutex, NULL); pthread_mutex_init(&bandlim_mutex, NULL); pthread_mutex_init(&hash_mutex, NULL); pthread_mutex_init(&tc_mutex, NULL); #ifndef NOODBC pthread_mutex_init(&odbc_mutex, NULL); #endif res = readconfig(fp); if(res) RETURN(res); if(!writable)fclose(fp); #ifdef _WIN32 if(service){ SERVICE_TABLE_ENTRY ste[] = { { stringtable[1], (LPSERVICE_MAIN_FUNCTION)ServiceMain}, { NULL, NULL } }; if(!StartServiceCtrlDispatcher( ste ))cyclestep(); } else { cyclestep(); } #else signal(SIGCONT, mysigpause); signal(SIGTERM, mysigterm); signal(SIGUSR1, mysigusr1); signal(SIGPIPE, SIG_IGN); cyclestep(); #endif CLEARRETURN: /* if(1) { char t[256]; sprintf(t, "echo result:%d lines: %d>c:\\result.txt", res, linenum); system(t); } */ return 0; } src/auth.c0100644002537100244200000006063310242077733012170 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: auth.c,v 1.35 2005/05/16 11:11:23 vlad Exp $ */ #include "proxy.h" #define HEADERSIZE 57 #define RECORDSIZE 18 unsigned char request[] = { 0xa2, 0x48, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x43, 0x4b, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x00, 0x00, 0x21, 0x00, 0x01}; unsigned char * getNetBIOSnamebyip(unsigned long ip){ unsigned char buf[1024]; struct sockaddr_in sins; int res; SOCKET sock; unsigned char * username = NULL; int i; int j; int nnames; int type; if ( (sock=socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP)) == INVALID_SOCKET) return NULL; sins.sin_family = AF_INET; sins.sin_port = htons(0); sins.sin_addr.s_addr = INADDR_ANY; if(bind(sock,(struct sockaddr *)&sins,sizeof(sins))) { closesocket(sock); return NULL; } sins.sin_family = AF_INET; sins.sin_addr.s_addr = ip; sins.sin_port = htons(137); res=socksendto(sock, &sins, request, sizeof(request), conf.timeouts[SINGLEBYTE_L]*1000); if(res <= 0) { closesocket(sock); return NULL; } res = sockrecvfrom(sock, &sins, buf, sizeof(buf), conf.timeouts[SINGLEBYTE_L]*1000); closesocket(sock); if(res < (HEADERSIZE + RECORDSIZE)) { return NULL; } nnames = buf[HEADERSIZE-1]; if (res < (HEADERSIZE + (nnames * RECORDSIZE))) return NULL; for (i = 0; i < nnames; i++){ type = buf[HEADERSIZE + (i*RECORDSIZE) + 15]; if( type == 3) { for(j = 14; j && buf[HEADERSIZE + (i*RECORDSIZE) + j] == ' '; j--) buf[HEADERSIZE + (i*RECORDSIZE) + j] = 0; if(username)myfree(username); username = (unsigned char *)mystrdup((char *)buf + HEADERSIZE + i*RECORDSIZE); } buf[HEADERSIZE + (i*RECORDSIZE) + 15] = 0; } return username; } int clientnegotiate(struct chain * redir, struct clientparam * param, unsigned long ip, unsigned short port){ unsigned char buf[1024]; struct in_addr ina; int res; unsigned char * user, *pass; ina.s_addr = ip; user = redir->extuser; pass = redir->extpass; if(user) { if (*user == '*') { if(!param->username) return 4; user = param->username; pass = param->password; } } switch(redir->type){ case R_TCP: case R_HTTP: return 0; case R_CONNECT: { sprintf((char *)buf, "CONNECT "); sprintf((char *)buf + 8 + myinet_ntoa(ina, buf+8), ":%hu HTTP/1.0\r\nProxy-Connection: keep-alive\r\n", ntohs(port)); if(user){ unsigned char username[256]; sprintf((char *)buf + strlen((char *)buf), "Proxy-authorization: basic "); sprintf((char *)username, "%.128s:%.64s", user, pass?pass:(unsigned char *)""); en64(username, buf+strlen((char *)buf), strlen((char *)username)); sprintf((char *)buf + strlen((char *)buf), "\r\n"); } sprintf((char *)buf + strlen((char *)buf), "\r\n"); if(socksend(param->remsock, buf, strlen((char *)buf), conf.timeouts[CHAIN_TO]) != (int)strlen((char *)buf)) return 31; if((res = sockgetlinebuf(param, SERVER,buf,13,'\n',conf.timeouts[CHAIN_TO])) < 13) return 32; if(buf[9] != '2') return 33; while((res = sockgetlinebuf(param, SERVER,buf,1023,'\n', conf.timeouts[CHAIN_TO])) > 2); if(res <= 0) return 34; return 0; } case R_SOCKS4: { buf[0] = 4; buf[1] = 1; memcpy(buf+2, &port, 2); memcpy(buf+4, &ip, 4); if(!user)user = (unsigned char *)"anonymous"; memcpy(buf+8, user, strlen((char *)user) + 1); if(socksend(param->remsock, buf, strlen((char *)user) + 9, conf.timeouts[CHAIN_TO]) < 9){ return 41; } if(sockgetlinebuf(param, SERVER, buf, 9, EOF, conf.timeouts[CHAIN_TO]) != 9){ return 42; } if(buf[1] != 90) { return 43; } } return 0; case R_SOCKS5: { int inbuf = 0; buf[0] = 5; buf[1] = 1; buf[2] = user? 2 : 0; if(socksend(param->remsock, buf, 3, conf.timeouts[CHAIN_TO]) != 3){ return 51; } if(sockgetlinebuf(param, SERVER, buf, 2, EOF, conf.timeouts[CHAIN_TO]) != 2){ return 52; } if(buf[0] != 5) { return 53; } if(buf[1] != 0 && !(buf[1] == 2 && user)){ return 54; } if(buf[1] == 2){ buf[inbuf++] = 1; buf[inbuf] = (unsigned char)strlen((char *)user); memcpy(buf+inbuf+1, user, buf[inbuf]); inbuf += buf[inbuf] + 1; buf[inbuf] = pass?(unsigned char)strlen((char *)pass):0; if(pass)memcpy(buf+inbuf+1, pass, buf[inbuf]); inbuf += buf[inbuf] + 1; if(socksend(param->remsock, buf, inbuf, conf.timeouts[CHAIN_TO]) != inbuf){ return 51; } if(sockgetlinebuf(param, SERVER, buf, 2, EOF, 60) != 2){ return 55; } if(buf[0] != 1 || buf[1] != 0) { return 56; } } buf[0] = 5; buf[1] = 1; buf[2] = 0; buf[3] = 1; memcpy(buf+4, &ip, 4); memcpy(buf+8, &port, 2); if(socksend(param->remsock, buf, 10, conf.timeouts[CHAIN_TO]) != 10){ return 51; } if(sockgetlinebuf(param, SERVER, buf, 10, EOF, conf.timeouts[CHAIN_TO]) != 10){ return 57; } if(buf[0] != 5) { return 53; } if(buf[1] != 0) { return 60 + (buf[1] % 10); } if(buf[3] != 1) { return 58; } return 0; } default: return 30; } } int handleredirect(struct clientparam * param, struct ace * acentry){ int connected = 0; int weight = 1000; int res; int done = 0; struct chain * cur; struct chain * redir = NULL; unsigned long targetip; unsigned short targetport; int r1, r2; if(!param->sins.sin_addr.s_addr && param->hostname) param->sins.sin_addr.s_addr = getip(param->hostname); targetip = param->sins.sin_addr.s_addr; targetport = param->sins.sin_port; if(!targetip || !targetport) return 100; if(param->remsock != INVALID_SOCKET) { return 0; } srand(randomizer); randomizer=rand(); for(cur = acentry->chains; cur; cur=cur->next){ if(done || (cur->weight < weight)) { r1 = (cur->weight * 12347)/weight; r2 = (rand()^targetip^targetport)%12347; if( done || (r1 < r2)) { weight -= cur->weight; if(weight <= 0) { weight = 1000; done = 0; } continue; } } param->redirected++; done = 1; weight -= cur->weight; if(weight <= 0) { weight = 1000; done = 0; } if(!connected){ if(cur->redirip) param->sins.sin_addr.s_addr = cur->redirip; if(cur->redirport) param->sins.sin_port = cur->redirport; if(!cur->redirip && !cur->redirport){ if(cur->extuser){ if(param->extusername) myfree(param->extusername); param->extusername = mystrdup((*cur->extuser == '*' && param->username)? param->username : cur->extuser); if(cur->extpass){ if(param->extpassword) myfree(param->extpassword); param->extpassword = mystrdup((*cur->extuser == '*' && param->password)?param->password : cur->extpass); } if(*cur->extuser == '*' && !param->username) return 4; } switch(cur->type){ case R_POP3: param->redirectfunc = pop3pchild; break; case R_FTP: param->redirectfunc = ftpprchild; break; default: param->redirectfunc = proxychild; } return 0; } if((res = alwaysauth(param))){ return (res == 10)? res : 60+res; } /* param->sins.sin_addr.s_addr = targetip; param->sins.sin_port = targetport; */ } else { res = redir?clientnegotiate(redir, param, cur->redirip, cur->redirport):0; if(res) return res; } redir = cur; param->redirtype = redir->type; if(redir->type == R_TCP || redir->type ==R_HTTP) { if(cur->extuser){ if(*cur -> extuser == '*' && !param->username) return 4; if(param->extusername) myfree(param->extusername); param->extusername = mystrdup((*cur->extuser == '*' && param->username)? param->username : cur->extuser); if(cur->extpass){ if(param->extpassword) myfree(param->extpassword); param->extpassword = mystrdup((*cur->extuser == '*' && param->password)?param->password : cur->extpass); } } return 0; } connected = 1; } randomizer=rand(); if(!connected) return 9; return redir?clientnegotiate(redir, param, targetip, targetport):0; } int ACLmatches(struct ace* acentry, struct clientparam * param){ struct userlist * userentry; struct iplist *ipentry; struct portlist *portentry; struct period *periodentry; unsigned char * username; username = param->username?param->username:(unsigned char *)"*"; if(acentry->src) { for(ipentry = acentry->src; ipentry; ipentry = ipentry->next) if(ipentry->ip == (param->sinc.sin_addr.s_addr & ipentry->mask)) { break; } if(!ipentry) return 0; } if(acentry->dst) { for(ipentry = acentry->dst; ipentry; ipentry = ipentry->next) if(ipentry->ip == (param->sins.sin_addr.s_addr & ipentry->mask)) { break; } if(!ipentry) return 0; } if(acentry->ports) { for (portentry = acentry->ports; portentry; portentry = portentry->next) if(ntohs(param->sins.sin_port) >= portentry->startport && ntohs(param->sins.sin_port) <= portentry->endport) { break; } if(!portentry) return 0; } if(acentry->wdays){ if(!(acentry -> wdays & wday)) return 0; } if(acentry->periods){ int start_time = param->time_start - basetime; for(periodentry = acentry->periods; periodentry; periodentry = periodentry -> next) if(start_time >= periodentry->fromtime && start_time < periodentry->totime){ break; } if(!periodentry) return 0; } if(acentry->users){ for(userentry = acentry->users; userentry; userentry = userentry->next) if(!strcmp((char *)username, (char *)userentry->user)){ break; } if(!userentry) return 0; } if(acentry->operation) { if((acentry->operation & param->operation) != param->operation){ return 0; } } return 1; } unsigned bandlimitfunc(struct clientparam *param, unsigned nbytes){ unsigned sleeptime = 0, nsleeptime; unsigned long sec; unsigned msec; unsigned now; int i; #ifdef _WIN32 struct timeb tb; ftime(&tb); sec = (unsigned)tb.time; msec = (unsigned)tb.millitm*1000; #else struct timeval tv; gettimeofday(&tv, NULL); sec = tv.tv_sec; msec = tv.tv_usec; #endif if(!nbytes) return 0; pthread_mutex_lock(&bandlim_mutex); if(param->version != paused){ struct bandlim * be; for(i = 0, be = conf.bandlimiter; be && inext) { if(ACLmatches(be->ace, param)){ if(be->ace->action == NOBANDLIM) { break; } param->bandlims[i++] = be; } } if(i < MAXBANDLIMS) param->bandlims[i++] = 0; } for(i=0; ibandlims[i]; i++){ if( !param->bandlims[i]->basetime || param->bandlims[i]->basetime > sec || param->bandlims[i]->basetime < (sec - 120) ) { param->bandlims[i]->basetime = sec; param->bandlims[i]->nexttime = 0; continue; } now = ((sec - param->bandlims[i]->basetime) * 1000000) + msec; nsleeptime = (param->bandlims[i]->nexttime > now)? param->bandlims[i]->nexttime - now : 0; sleeptime = (nsleeptime > sleeptime)? nsleeptime : sleeptime; param->bandlims[i]->basetime = sec; param->bandlims[i]->nexttime = msec + nsleeptime + ((param->bandlims[i]->rate > 1000000)? ((nbytes/32)*(256000000/param->bandlims[i]->rate)) : (nbytes * (8000000/param->bandlims[i]->rate))); } pthread_mutex_unlock(&bandlim_mutex); return sleeptime/1000; } void trafcountfunc(struct clientparam *param){ struct trafcount * tc; unsigned long val; pthread_mutex_lock(&tc_mutex); for(tc = conf.trafcounter; tc; tc = tc->next) { if(ACLmatches(tc->ace, param)){ time_t t; if(tc->ace->action == NOCOUNT) break; val = tc->traf + param->statssrv; if(val < tc->traf) tc->trafgb++; tc->traf = val; time(&t); tc->updated = t; } } pthread_mutex_unlock(&tc_mutex); } int alwaysauth(struct clientparam * param){ int res; int i = 0; struct bandlim * be; struct trafcount * tc; res = doconnect(param); if(!res){ if(param->version != paused) return 333; for(be = conf.bandlimiter; be && inext) { if(ACLmatches(be->ace, param)){ if(be->ace->action == NOBANDLIM) { break; } param->bandlims[i++] = be; param->bandlimfunc = bandlimitfunc; } } if(ibandlims[i] = NULL; if(conf.trafcounter) { for(tc = conf.trafcounter; tc; tc = tc->next) { if(tc->disabled) continue; if(ACLmatches(tc->ace, param)){ if(tc->ace->action == NOCOUNT) break; if((tc->traflimgb < tc->trafgb) || ((tc->traflimgb == tc->trafgb) && (tc->traflim < tc->traf)) ) return 10; param->trafcountfunc = trafcountfunc; if(tc->traflimgb - tc->trafgb < 2){ unsigned maxtraf = tc->traflim - tc->traf + ((tc->traflimgb - tc->trafgb) * 0x40000000); if(!param->maxtraf || param->maxtraf > maxtraf) param->maxtraf = maxtraf; } } } } } return res; } int checkACL(struct clientparam * param){ struct ace* acentry; if(param->remsock == INVALID_SOCKET && param->hostname && !param->sins.sin_addr.s_addr) param->sins.sin_addr.s_addr = getip(param->hostname); pthread_mutex_lock(&acl_mutex); if(!conf.acls[param->aclnum]) { pthread_mutex_unlock(&acl_mutex); return alwaysauth(param); } for(acentry = conf.acls[param->aclnum]; acentry; acentry = acentry->next) { if(ACLmatches(acentry, param)) { if(acentry->action == 2) { struct ace dup; if(param->operation < 256 && !(param->operation & CONNECT)){ continue; } if(param->redirected && acentry->chains && !acentry->chains->redirip && !acentry->chains->redirport) { continue; } memcpy(&dup, acentry, sizeof(struct ace)); pthread_mutex_unlock(&acl_mutex); return handleredirect(param, &dup); } pthread_mutex_unlock(&acl_mutex); return (acentry->action)?acentry->action:alwaysauth(param); } } pthread_mutex_unlock(&acl_mutex); return 3; } int ipauth(struct clientparam * param){ return checkACL(param); } int nbnameauth(struct clientparam * param){ unsigned char * name = getNetBIOSnamebyip(param->sinc.sin_addr.s_addr); if (param->username) myfree (param->username); param->username = name; return checkACL(param); } int strongauth(struct clientparam * param){ struct passwords * pwl; unsigned char buf[256]; if(!param->username) return 4; for(pwl = conf.pwl; pwl; pwl=pwl->next){ if(!strcmp((char *)pwl->user, (char *)param->username)) switch(pwl->pwtype) { case CL: if(!pwl->password || !*pwl->password){ break; } else if (!param->pwtype && param->password && !strcmp((char *)param->password, (char *)pwl->password)){ break; } else if (param->pwtype == 2 && param->password) { ntpwdhash(buf, pwl->password, 0); mschap(buf, param->password, buf + 16); if(!memcmp(buf+16, param->password+8, 24)) { break; } } return 6; case CR: if(param->password && !param->pwtype && !strcmp((char *)pwl->password, (char *)mycrypt(param->password, pwl->password,buf))) { break; } return 7; case NT: if(param->password && !param->pwtype && !memcmp(pwl->password, ntpwdhash(buf,param->password, 0), 16)) { break; } else if (param->pwtype == 2){ mschap(pwl->password, param->password, buf); if(!memcmp(buf, param->password+8, 24)) { break; } } return 8; default: return 999; } else continue; return checkACL(param); } return 5; } struct hashentry { char hash[sizeof(unsigned)*2]; unsigned long value; time_t expires; struct hashentry *next; }; struct hashentry ** hashtable = NULL; struct hashentry * hashvalues = NULL; struct hashentry * hashempty = NULL; unsigned hashsize = 0; void nametohash(const unsigned char * name, unsigned char *hash){ unsigned i, j; memset(hash, 0, sizeof(unsigned)*2); for(i=0, j=0; name[j]; j++){ hash[i] += toupper(name[j]) - 32; if(++i == sizeof(unsigned)*2) i = 0; } } unsigned hashindex(const unsigned char* hash){ unsigned t1, t2; t1 = *(unsigned *)hash; t2 = *(unsigned *)(hash + sizeof(unsigned)); return (t1 * 54321 + t2) % (hashsize >> 2); } void destroyhashtable(void){ pthread_mutex_lock(&hash_mutex); if(hashtable){ myfree(hashtable); hashtable = NULL; } if(hashvalues){ myfree(hashvalues); hashvalues = NULL; } pthread_mutex_unlock(&hash_mutex); } int inithashtable(unsigned nhashsize){ unsigned i; if(nhashsize<4) return 1; if(hashtable){ myfree(hashtable); hashtable = NULL; } if(hashvalues){ myfree(hashvalues); hashvalues = NULL; } hashsize = 0; if(!(hashtable = myalloc((nhashsize>>2) * sizeof(struct hashentry *)))){ return 2; } if(!(hashvalues = myalloc(nhashsize * sizeof(struct hashentry)))){ myfree(hashtable); hashtable = NULL; return 3; } hashsize = nhashsize; memset(hashtable, 0, (hashsize>>2) * sizeof(struct hashentry *)); memset(hashvalues, 0, hashsize * sizeof(struct hashentry)); for(i = 0; i< (hashsize - 1); i++) { (hashvalues + i)->next = hashvalues + i + 1; } hashempty = hashvalues; return 0; } void hashadd(const unsigned char* name, unsigned long value, time_t expires){ struct hashentry * he; unsigned index; if(!value||!name||!hashtable||!hashempty) return; pthread_mutex_lock(&hash_mutex); he = hashempty; hashempty = hashempty->next; nametohash(name, he->hash); he->value = value; he->expires = expires; he->next = NULL; index = hashindex(he->hash); if(!hashtable[index] || !memcmp(he->hash, hashtable[index]->hash, sizeof(he->hash))){ he->next = hashtable[index]; hashtable[index] = he; } else { memset(he, 0, sizeof(struct hashentry)); he->next = hashempty; hashempty = he; } pthread_mutex_unlock(&hash_mutex); } unsigned long hashresolv(const unsigned char* name, unsigned *ttl){ char hash[sizeof(unsigned)*2]; struct hashentry ** hep; struct hashentry *he; unsigned index; time_t t; if(!hashtable || !name) return 0; time(&t); nametohash(name, hash); index = hashindex(hash); pthread_mutex_lock(&hash_mutex); for(hep = hashtable + index; (he = *hep)!=NULL; ){ if((unsigned long)he->expires < (unsigned long)t) { (*hep) = he->next; he->expires = 0; he->next = hashempty; hashempty = he; } else if(!memcmp(hash, he->hash, sizeof(unsigned)*2)){ pthread_mutex_unlock(&hash_mutex); if(ttl) *ttl = (he->expires - t); return he->value; } else hep=&(he->next); } pthread_mutex_unlock(&hash_mutex); return 0; } unsigned long nservers[MAXNSERVERS] = {0, 0, 0, 0, 0}; unsigned long udpresolve(const unsigned char * name, unsigned *retttl, struct clientparam* param){ int i; unsigned long retval; if((retval = hashresolv(name, retttl))) { return retval; } for(i=0; isins : &sin; if((sock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) break; sinsp->sin_family = AF_INET; sinsp->sin_port = htons(0); sinsp->sin_addr.s_addr = htonl(0); if(bind(sock,(struct sockaddr *)sinsp,sizeof(struct sockaddr_in))) { shutdown(sock, SHUT_RDWR); closesocket(sock); break; } sinsp->sin_addr.s_addr = nservers[i]; sinsp->sin_port = htons(53); srand(randomizer^sinsp->sin_addr.s_addr); randomizer=rand(); nquery = rand(); randomizer=rand(); *(unsigned short*)buf = nquery; /* query id */ buf[2] = 1; /* recursive */ buf[3] = 0; buf[4] = 0; buf[5] = 1; /* 1 request */ buf[6] = buf[7] = 0; /* no replies */ buf[8] = buf[9] = 0; /* no ns count */ buf[10] = buf[11] = 0; /* no additional */ len = strlen((char *)name); if(len > 255) { len = 255; } memcpy(buf + 13, name, len); len += 13; buf[len] = 0; for(s2 = buf + 12; (s1 = (unsigned char *)strchr((char *)s2 + 1, '.')); s2 = s1)*s2 = (unsigned char)((s1 - s2) - 1); *s2 = (len - (s2 - buf)) - 1; len++; buf[len++] = 0; buf[len++] = 1; /* host address */ buf[len++] = 0; buf[len++] = 1; /* INET */ if(socksendto(sock, sinsp, buf, len, conf.timeouts[SINGLEBYTE_L]*1000) != len){ shutdown(sock, SHUT_RDWR); closesocket(sock); continue; } if(param) param->statscli += len; len = sockrecvfrom(sock, sinsp, buf, 4096, 15000); shutdown(sock, SHUT_RDWR); closesocket(sock); if(len <= 13) continue; if(param) param->statssrv += len; if(*(unsigned short *)buf != nquery)continue; if((na = buf[7] + (((unsigned short)buf[6])<<8)) < 1) { return 0; } nq = buf[5] + (((unsigned short)buf[4])<<8); if (nq != 1) { continue; /* we did only 1 request */ } for(k = 13; k= len) { continue; } k += 4; if(na > 255) na = 255; /* somebody is very evil */ for (j = 0; j < na; j++) { /* now there should be answers */ if((k+16) >= len) { break; } flen = buf[k+11] + (((unsigned short)buf[k+10])<<8); if((k+12+flen) > len) break; if(buf[k+2] != 0 || buf[k+3] != 1 || flen != 4) { k+= (12 + flen); continue; /* we need A IPv4 */ } retval = *(unsigned long *)(buf + k + 12); ttl = ntohl(*(unsigned long *)(buf + k + 6)); t = time(0); if(ttl < 60 || ((unsigned)t)+ttl < ttl) ttl = 300; if(ttl)hashadd(name, retval, ((unsigned)t)+ttl); if(retttl) *retttl = ttl; return retval; } } return 0; } unsigned long myresolver(const unsigned char * name){ return udpresolve(name, NULL, NULL); } unsigned long fakeresolver (const unsigned char *name){ return htonl(0x7F000002); } #ifndef NOODBC SQLHENV henv = NULL; SQLHSTMT hstmt = NULL; SQLHDBC hdbc = NULL; char * sqlstring = NULL; void close_sql(){ if(hstmt) { SQLFreeHandle(SQL_HANDLE_STMT, hstmt); hstmt = NULL; } if(hdbc){ SQLDisconnect(hdbc); SQLFreeHandle(SQL_HANDLE_DBC, hdbc); hdbc = NULL; } if(henv) { SQLFreeHandle(SQL_HANDLE_ENV, henv); henv = NULL; } } int init_sql(char * s){ SQLRETURN retcode; char * datasource; char * username; char * password; char * string; if(!s) return 0; if(!sqlstring || strcmp(sqlstring, s)){ string = sqlstring; sqlstring=mystrdup(s); if(string)myfree(string); } if(hstmt || hdbc || henv) close_sql(); if(!henv){ retcode = SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, &henv); if (!henv || (retcode != SQL_SUCCESS && retcode != SQL_SUCCESS_WITH_INFO)){ henv = NULL; return 0; } retcode = SQLSetEnvAttr(henv, SQL_ATTR_ODBC_VERSION, (void*)SQL_OV_ODBC3, 0); if (retcode != SQL_SUCCESS && retcode != SQL_SUCCESS_WITH_INFO) { return 0; } } if(!hdbc){ retcode = SQLAllocHandle(SQL_HANDLE_DBC, henv, &hdbc); if (!hdbc || (retcode != SQL_SUCCESS && retcode != SQL_SUCCESS_WITH_INFO)) { hdbc = NULL; SQLFreeHandle(SQL_HANDLE_ENV, henv); henv = NULL; return 0; } SQLSetConnectAttr(hdbc, SQL_LOGIN_TIMEOUT, (void*)15, 0); } string = mystrdup(sqlstring); if(!string) return 0; datasource = strtok(string, ","); username = strtok(NULL, ","); password = strtok(NULL, ","); /* Connect to data source */ retcode = SQLConnect(hdbc, (SQLCHAR*) datasource, (SQLSMALLINT)strlen(datasource), (SQLCHAR*) username, (SQLSMALLINT)((username)?strlen(username):0), (SQLCHAR*) password, (SQLSMALLINT)((password)?strlen(password):0)); myfree(string); if (retcode != SQL_SUCCESS && retcode != SQL_SUCCESS_WITH_INFO){ SQLFreeHandle(SQL_HANDLE_DBC, hdbc); hdbc = NULL; SQLFreeHandle(SQL_HANDLE_ENV, henv); henv = NULL; return 0; } retcode = SQLAllocHandle(SQL_HANDLE_STMT, hdbc, &hstmt); if (retcode != SQL_SUCCESS && retcode != SQL_SUCCESS_WITH_INFO){ close_sql(); return 0; } return 1; } void logsql(struct clientparam * param, const unsigned char *s) { unsigned char buf[4096]; SQLRETURN ret; int len; len = dobuf(param, buf, s, "\'"); #ifdef SAFESQL pthread_mutex_lock(&odbc_mutex); #endif if(!hstmt){ #ifndef SAFESQL pthread_mutex_lock(&odbc_mutex); #endif if(!init_sql(sqlstring)) { pthread_mutex_unlock(&odbc_mutex); return; } #ifndef SAFESQL pthread_mutex_unlock(&odbc_mutex); #endif } if(hstmt){ ret = SQLExecDirect(hstmt, (SQLCHAR *)buf, (SQLINTEGER)len); if(ret != SQL_SUCCESS && ret != SQL_SUCCESS_WITH_INFO){ #ifndef SAFESQL pthread_mutex_lock(&odbc_mutex); #endif close_sql(); if(!init_sql(sqlstring)){ pthread_mutex_unlock(&odbc_mutex); return; } #ifndef SAFESQL pthread_mutex_unlock(&odbc_mutex); #endif if(hstmt) SQLExecDirect(hstmt, (SQLCHAR *)buf, (SQLINTEGER)len); } } #ifdef SAFESQL pthread_mutex_unlock(&odbc_mutex); #endif } #endif #ifdef WITHMAIN int main(int argc, unsigned char * argv[]) { unsigned ip = 0; WSADATA wd; WSAStartup(MAKEWORD( 1, 1 ), &wd); if(argc == 2)ip=getip(argv[1]); if(!hp) { printf("Not found"); return 0; } printf("Name: '%s'\n", getnamebyip(ip); return 0; } #endif src/base64.c0100644002537100244200000000537510067060710012305 0ustar vladmkgroup/* * Copyright (c) 2000-2003 3APA3A * * please read License Agreement * * $Id: base64.c,v 1.1.1.1 2004/06/25 17:32:56 vlad Exp $ */ #include static const unsigned char base64digits[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; #define BAD 255 static const unsigned char base64val[] = { BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD,BAD, BAD,BAD,BAD, 62, BAD,BAD,BAD, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61,BAD,BAD, BAD,BAD,BAD,BAD, BAD, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,BAD, BAD,BAD,BAD,BAD, BAD, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51,BAD, BAD,BAD,BAD,BAD }; #define DECODE64(c) ((c > 32 && c<127)? base64val[(int)c] : BAD) unsigned char* en64 (const unsigned char *in, unsigned char *out, int inlen) { for (; inlen > 0; inlen -= 3, in+=3) { *out++ = base64digits[in[0] >> 2]; *out++ = base64digits[((in[0]&3)<<4) | ((inlen > 1)?(in[1]>>4):0)]; *out++ = (inlen > 1)? base64digits[((in[1] << 2) & 0x3c) | ((inlen > 2)? (in[2] >> 6) : 0)]: '='; *out++ = (inlen > 2)? base64digits[in[2] & 0x3f] : '='; } *out = '\0'; return out; } int de64 (const char *in, char *out, int maxlen) { int len = 0; register unsigned char digit1, digit2, digit3, digit4; if (in[0] == '+' && in[1] == ' ') in += 2; if (*in == '\r') return(0); do { digit1 = in[0]; if (DECODE64(digit1) == BAD) return(-1); digit2 = in[1]; if (DECODE64(digit2) == BAD) return(-1); digit3 = in[2]; if (digit3 != '=' && DECODE64(digit3) == BAD) return(-1); digit4 = in[3]; if (digit4 != '=' && DECODE64(digit4) == BAD) return(-1); in += 4; *out++ = (DECODE64(digit1) << 2) | (DECODE64(digit2) >> 4); ++len; if (digit3 != '=') { *out++ = ((DECODE64(digit2) << 4) & 0xf0) | (DECODE64(digit3) >> 2); ++len; if (digit4 != '=') { *out++ = ((DECODE64(digit3) << 6) & 0xc0) | DECODE64(digit4); ++len; } } } while (*in && *in != '\r' && digit4 != '=' && (maxlen-=4) >= 4); return (len); } unsigned char hex[] = "0123456789ABCDEF"; void tohex(unsigned char *in, unsigned char *out, int len){ int i; for (i=0; i>4)]; out[(i<<1) + 1] = hex[(in[i]&0x0F)]; } out[(i<<1)] = 0; } void fromhex(unsigned char *in, unsigned char *out, int len){ char *c1, *c2; for (; len > 0; len--) { c1 = strchr(hex, *in++); c2 = strchr(hex, *in++); if(c1 && c2){ *out++ = (((unsigned char *)c1 - hex) << 4) + ((unsigned char *)c2 - hex); } } } src/common.c0100644002537100244200000003663210235635413012516 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: common.c,v 1.30 2005/05/03 08:49:15 vlad Exp $ */ #include "proxy.h" char * copyright="(c)2000-2003 3APA3A, Vladimir Dubrovin & Security.Nnov\n" "Documentation and sources: http://www.security.nnov.ru/soft/3proxy\n" "Please read license agreement in \"License\" file.\n" "You may not use this program without accepting license agreement"; int paused = 0; int demon = 0; int randomizer = 1; #ifndef _WIN32 pthread_attr_t pa; #endif unsigned char **stringtable = NULL; int myinet_ntoa(struct in_addr in, char * buf){ unsigned u = ntohl(in.s_addr); return sprintf(buf, "%u.%u.%u.%u", ((u&0xFF000000)>>24), ((u&0x00FF0000)>>16), ((u&0x0000FF00)>>8), ((u&0x000000FF))); } struct extparam conf = { {1, 5, 30, 60, 180, 1800, 15, 60, 0, 0}, { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL }, NULL, NULL, NULL, NULL, 0, -1, 0, 0, 0, NULL, NULL, NONE, NONE, NULL, 0, NULL, 0, 100, INADDR_ANY, INADDR_ANY, 0, 0, 0, 0, NULL, doconnect, lognone, NULL, NULL }; #ifndef WITH_POLL int mypoll(struct mypollfd *fds, unsigned int nfds, int timeout){ fd_set readfd; fd_set writefd; fd_set oobfd; struct timeval tv; unsigned i; int num; SOCKET maxfd = 0; tv.tv_sec = timeout/1000; tv.tv_usec = (timeout%1000); FD_ZERO(&readfd); FD_ZERO(&writefd); FD_ZERO(&oobfd); for(i=0; i maxfd) maxfd = fds[i].fd; } if((num = select(maxfd+1, &readfd, &writefd, &oobfd, &tv)) < 1) return num; for(i=0; ihostname) myfree(param->hostname); param->hostname = mystrdup(hostname); if(sp){ port = atoi((char *)sp+1); *sp = ':'; } param->sins.sin_port = htons(port); return 0; } int parseusername(char *username, struct clientparam *param, int extpasswd){ char *sb = NULL, *se = NULL, *sp = NULL; if(!username || !*username) return 1; if((sb = strchr(username, ':')) && (se = strchr(sb + 1, ':')) && (!extpasswd || (sp = strchr(se + 1, ':')))){ *sb = 0; *se = 0; if(sp) *sp = 0; if(*(sb+1)) { if(param->password) myfree(param->password); param->password = (unsigned char *)mystrdup(sb+1); } if(*username) { if(param->username) myfree(param->username); param->username = (unsigned char *)mystrdup(username); } username = se+1; } if(extpasswd){ if(!sp) sp = strchr(username, ':'); if(sp){ *sp = 0; if(param->extpassword) myfree(param->extpassword); param->extpassword = (unsigned char *) mystrdup(sp+1); } } if(param->extusername) myfree(param->extusername); param->extusername = (unsigned char *)mystrdup(username); if(sb) *sb = ':'; if(se) *se = ':'; if(sp) *sp = ':'; return 0; } int parseconnusername(char *username, struct clientparam *param, int extpasswd, unsigned short port){ char *sb, *se; if(!username || !*username) return 1; if ((sb=strchr(username, '@')) == NULL) return 2; while ((se=strchr(sb+1, '@')))sb=se; *(sb) = 0; if(parseusername(username, param, extpasswd)) return 3; *(sb) = '@'; if(parsehostname(sb+1, param, port)) return 4; return 0; } char* demanddialprog = NULL; void clearstat(struct clientparam * param) { #ifdef _WIN32 struct timeb tb; ftime(&tb); param->time_start = (time_t)tb.time; param->msec_start = (unsigned)tb.millitm; #else struct timeval tv; struct timezone tz; gettimeofday(&tv, &tz); param->time_start = (time_t)tv.tv_sec; param->msec_start = (tv.tv_usec / 1000); #endif if(param->parent){ param->parent->statscli += param->statscli; param->parent->statssrv += param->statssrv; } param->statscli = param->statssrv = 0; } int dobuf(struct clientparam * param, unsigned char * buf, const unsigned char *s, const unsigned char * doublec){ struct tm* tm; int i, j; time_t sec; unsigned msec; unsigned delay; int timezone; int len; char * format; #ifdef _WIN32 struct timeb tb; ftime(&tb); sec = (time_t)tb.time; msec = (unsigned)tb.millitm; timezone = (int) tb.timezone; #else struct timeval tv; struct timezone tz; gettimeofday(&tv, &tz); sec = (time_t)tv.tv_sec; msec = tv.tv_usec / 1000; timezone = tz.tz_minuteswest; #endif if(!param) return 0; if(param->trafcountfunc)(*param->trafcountfunc)(param); delay = param->time_start?((unsigned) ((sec - param->time_start))*1000 + msec) - param->msec_start : 0; format = param->logformat; if(!format) format = "G%y%m%d%H%M%S.%. %p %E %U %C:%c %R:%r %O %I %h %T"; tm = (*format == 'G' || *format == 'g')? gmtime(&sec) : localtime(&sec); *buf = 0; for(i=0, j=1; format[j] && i < 4040; j++){ if(format[j] == '%' && format[j+1]){ j++; switch(format[j]){ case 'y': sprintf((char *)buf+i, "%.2d", tm->tm_year%100); i+=2; break; case 'Y': sprintf((char *)buf+i, "%.4d", tm->tm_year+1900); i+=4; break; case 'm': sprintf((char *)buf+i, "%.2d", tm->tm_mon+1); i+=2; break; case 'd': sprintf((char *)buf+i, "%.2d", tm->tm_mday); i+=2; break; case 'H': sprintf((char *)buf+i, "%.2d", tm->tm_hour); i+=2; break; case 'M': sprintf((char *)buf+i, "%.2d", tm->tm_min); i+=2; break; case 'S': sprintf((char *)buf+i, "%.2d", tm->tm_sec); i+=2; break; case 't': sprintf((char *)buf+i, "%.10u", (unsigned)sec); i+=10; break; case 'b': i+=sprintf((char *)buf+i, "%u", delay?(unsigned)(param->statscli * 1000./delay):0); break; case 'B': i+=sprintf((char *)buf+i, "%u", delay?(unsigned)(param->statssrv * 1000./delay):0); break; case 'D': i+=sprintf((char *)buf+i, "%u", delay); break; case '.': sprintf((char *)buf+i, "%.3u", msec); i+=3; break; case 'z': sprintf((char *)buf+i, "%+.2d%.2u", (int)(-timezone/60), (unsigned)(timezone%60)); i+=5; break; case 'U': if(param->username){ for(len = 0; i< 4000 && param->username[len]; len++){ buf[i] = param->username[len]; if(doublec && strchr(doublec, buf[i])) { buf[i+1] = buf[i]; i++; } if(param->nonprintable && (buf[i] < 32 || strchr(param->nonprintable, buf[i]))) buf[i] = param->replace; i++; } } else { buf[i++] = '-'; } break; case 'n': len = param->hostname? strlen(param->hostname) : 0; if(len && (len + i) < 4000) { memcpy(buf+i, param->hostname, len); i+=len; } else i += myinet_ntoa(param->sins.sin_addr, buf + i); break; case 'N': if(param->service >=0 && param->service < 15) { len = (stringtable)? strlen((char *)stringtable[SERVICES + param->service]) : 0; if(len > 20) len = 20; memcpy(buf+i, (len)?stringtable[SERVICES + param->service]:(unsigned char*)"-", (len)?len:1); i += (len)?len:1; } break; case 'E': sprintf((char *)buf+i, "%.03d", param->res); i += 3; break; case 'T': if(s){ for(len = 0; i<4000 && s[len]; len++){ buf[i] = s[len]; if(doublec && strchr(doublec, buf[i])) { buf[i+1] = buf[i]; i++; } if(param->nonprintable && (buf[i] < 32 || strchr(param->nonprintable, buf[i]))) buf[i] = param->replace; i++; } } break; case 'C': i += myinet_ntoa(param->sinc.sin_addr, buf + i); break; case 'R': i += myinet_ntoa(param->sins.sin_addr, buf + i); break; case 'p': sprintf((char *)buf+i, "%hu", ntohs(param->intport)); i += strlen((char *)buf+i); break; case 'c': sprintf((char *)buf+i, "%hu", ntohs(param->sinc.sin_port)); i += strlen((char *)buf+i); break; case 'r': sprintf((char *)buf+i, "%hu", ntohs(param->sins.sin_port)); i += strlen((char *)buf+i); break; case 'I': sprintf((char *)buf+i, "%lu", param->statssrv); i += strlen((char *)buf+i); break; case 'O': sprintf((char *)buf+i, "%lu", param->statscli); i += strlen((char *)buf+i); break; case 'h': sprintf((char *)buf+i, "%d", param->redirected); i += strlen((char *)buf+i); break; case '1': case '2': case '3': case '4': case '5': case '6': case '7': case '8': case '9': { int k, pmin=0, pmax=0; for (k = j; isnumber(format[k]); k++); if(format[k] == '-' && isnumber(format[k+1])){ pmin = atoi(format + j) - 1; k++; pmax = atoi(format + k) -1; for (; isnumber(format[k]); k++); j = k; } if(!s || format[k]!='T') break; for(k = 0, len = 0; s[len] && i < 4000; len++){ if(isspace(s[len])){ k++; while(isspace(s[len+1]))len++; if(k == pmin) continue; } if(k>=pmin && k<=pmax) { buf[i] = s[len]; if(doublec && strchr(doublec, buf[i])) { buf[i+1] = buf[i]; i++; } if(param->nonprintable && (buf[i] < 32 || strchr(param->nonprintable, buf[i]))) buf[i] = param->replace; i++; } } break; } default: buf[i++] = format[j]; } } else buf[i++] = format[j]; } buf[i] = 0; clearstat(param); return i; } void lognone(struct clientparam * param, const unsigned char *s) { if(param->trafcountfunc)(*param->trafcountfunc)(param); clearstat(param); } FILE * stdlog; void logstdout(struct clientparam * param, const unsigned char *s) { unsigned char buf[4096]; if(!stdlog)stdlog = stdout; dobuf(param, buf, s, NULL); if(fprintf(param->stdlog?param->stdlog:stdlog, "%s\n", buf) < 0) { perror("printf()"); }; if(!stringtable)fflush(param->stdlog?param->stdlog:stdlog); } #ifndef _WIN32 void logsyslog(struct clientparam * param, const unsigned char *s) { unsigned char buf[4096]; dobuf(param, buf, s, NULL); syslog(LOG_INFO, "%s", buf); } #endif int doconnect(struct clientparam * param){ SASIZETYPE size = sizeof(param->sins); struct sockaddr_in bindsa; if (param->remsock == INVALID_SOCKET && param->operation != DNSRESOLVE && param->operation !=ADMIN) { if(param->hostname && !param->sins.sin_addr.s_addr){ if(!(param->sins.sin_addr.s_addr = getip(param->hostname))){ return 100; } } if ((param->remsock=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {return (11);} bindsa.sin_family = AF_INET; bindsa.sin_port = param->extport; bindsa.sin_addr.s_addr = param->extip; if(bind(param->remsock, (struct sockaddr*)&bindsa, sizeof(bindsa))==-1) { return 12; } param->sins.sin_family = AF_INET; if(param->operation >= 256 || (param->operation & CONNECT)){ #ifdef _WIN32 unsigned long ul; #endif if(connect(param->remsock,(struct sockaddr *)¶m->sins,sizeof(param->sins))) {return (13);} #ifdef _WIN32 ioctlsocket(param->remsock, FIONBIO, &ul); #else fcntl(param->remsock,F_SETFL,O_NONBLOCK); #endif } else { if(getsockname(param->remsock, (struct sockaddr *)¶m->sins, &size)==-1) {return (15);} } } return 0; } void freeparam(struct clientparam * param) { if(param->res == 2) return; if(param->clibuf) myfree(param->clibuf); if(param->srvbuf) myfree(param->srvbuf); if(param->parent){ param->parent->statscli += param->statscli; param->parent->statssrv += param->statssrv; pthread_mutex_lock(param->counter_mutex); if(param->prev) param->prev->next = param->next; else param->parent->child = param->next; if (param->next) param->next->prev = param->prev; (*param->childcount)--; pthread_mutex_unlock(param->counter_mutex); } if(param->hostname) myfree(param->hostname); if(param->username) myfree(param->username); if(param->password) myfree(param->password); if(param->extusername) myfree(param->extusername); if(param->extpassword) myfree(param->extpassword); if(param->remsock != INVALID_SOCKET) { shutdown(param->remsock, SHUT_RDWR); closesocket(param->remsock); } if(param->clisock != INVALID_SOCKET) { shutdown(param->clisock, SHUT_RDWR); closesocket(param->clisock); } if(param->ctrlsock != INVALID_SOCKET) { shutdown(param->ctrlsock, SHUT_RDWR); closesocket(param->ctrlsock); } myfree(param); } int scanaddr(const unsigned char *s, unsigned long * ip, unsigned long * mask) { unsigned d1, d2, d3, d4, m; int res; if ((res = sscanf((char *)s, "%u.%u.%u.%u/%u", &d1, &d2, &d3, &d4, &m)) < 4) return 0; if(mask && res == 4) *mask = 0xFFFFFFFF; else if (mask) *mask = htonl(0xFFFFFFFF << (32 - m)); *ip = htonl ((d1<<24) ^ (d2<<16) ^ (d3<<8) ^ d4); return res; } RESOLVFUNC resolvfunc = NULL; #ifndef _WIN32 pthread_mutex_t gethostbyname_mutex; int ghbn_init = 0; #endif unsigned long getip(unsigned char *name){ unsigned long retval; int i; int ndots = 0; struct hostent *hp=NULL; if(strlen(name)>255)name[255] = 0; for(i=0; name[i]; i++){ if(name[i] == '.'){ if(++ndots > 3) break; continue; } if(name[i] <'0' || name[i] >'9') break; } if(!name[i] && ndots == 3){ unsigned long ip; if(scanaddr(name, &ip, NULL) == 4){ return ip; } } if(resolvfunc){ if((retval = (*resolvfunc)(name))) return retval; if(demanddialprog) system(demanddialprog); return (*resolvfunc)(name); } #ifndef _WIN32 if(!ghbn_init){ pthread_mutex_init(&gethostbyname_mutex, NULL); ghbn_init++; } pthread_mutex_lock(&gethostbyname_mutex); #endif hp=gethostbyname((char *)name); if (!hp && demanddialprog) { system(demanddialprog); hp=gethostbyname((char *)name); } retval = hp?*(unsigned long *)hp->h_addr:0; #ifndef _WIN32 pthread_mutex_unlock(&gethostbyname_mutex); #endif return retval; } src/datatypes.c0100644002537100244200000006035710153107261013217 0ustar vladmkgroup/* * Copyright (c) 2000-2004 3APA3A * * please read License Agreement * * $Id: datatypes.c,v 1.9 2004/11/30 15:16:01 vlad Exp $ */ #include "proxy.h" static void pr_integer(struct node *node, CBFUNC cbf, void*cb){ char buf[16]; if(node->value)(*cbf)(cb, buf, sprintf(buf, "%d", *(int *)node->value)); } static void pr_short(struct node *node, CBFUNC cbf, void*cb){ char buf[8]; if(node->value)(*cbf)(cb, buf, sprintf(buf, "%hu", *(unsigned short*)node->value)); } static void pr_char(struct node *node, CBFUNC cbf, void*cb){ if(node->value)(*cbf)(cb, (char *)node->value, 1); } static void pr_unsigned(struct node *node, CBFUNC cbf, void*cb){ char buf[16]; if(node->value)(*cbf)(cb, buf, sprintf(buf, "%u", *(unsigned *)node->value)); } static void pr_traffic(struct node *node, CBFUNC cbf, void*cb){ char buf[16]; unsigned long u1, u2; if(node->value){ u1 = ((unsigned long *)node->value)[0]; u2 = ((unsigned long *)node->value)[0]; (*cbf)(cb, buf, sprintf(buf, "%lu", (u1>>20) + (u2<<10))); } } static void pr_port(struct node *node, CBFUNC cbf, void*cb){ char buf[8]; if(node->value)(*cbf)(cb, buf, sprintf(buf, "%hu", ntohs(*(unsigned short*)node->value))); } static void pr_datetime(struct node *node, CBFUNC cbf, void*cb){ char *s; if(node->value){ s = ctime((time_t *)node->value); (*cbf)(cb, s, strlen(s)-1); } } int ipprint(char *buf, unsigned uu){ unsigned u = ntohl(uu); return sprintf(buf, "%u.%u.%u.%u", ((u&0xFF000000)>>24), ((u&0x00FF0000)>>16), ((u&0x0000FF00)>>8), ((u&0x000000FF))); } static void pr_ip(struct node *node, CBFUNC cbf, void*cb){ char buf[16]; if(node->value)(*cbf)(cb, buf, ipprint(buf, *(unsigned *)node -> value)); } static void pr_wdays(struct node *node, CBFUNC cbf, void*cb){ char buf[16]; int i, found = 0; if(node -> value)for(i = 0; i<8; i++){ if( (1< value ) { sprintf(buf, "%s%d", found?",":"", i); (*cbf)(cb, buf, found? 2:1); found = 1; } } } static void pr_time(struct node *node, CBFUNC cbf, void*cb){ char buf[16]; int t = *(int *)node; (*cbf)(cb, buf, sprintf(buf, "%02d:%02d:%02d", (t/3600)%24, (t/60)%60, t%60)); } int cidrprint(char *buf, unsigned long u){ unsigned long u1 = 0xffffffff; int i; u = ntohl(u); for(i = 32; i && (u1!=u); i--){ u1 = (u1 << 1); } if (i == 32) { return 0; } return sprintf(buf, "/%d", i); } static void pr_cidr(struct node *node, CBFUNC cbf, void*cb){ char buf[4]; int i; if(node->value){ if ((i = cidrprint(buf, *(unsigned *)node -> value))) (*cbf)(cb, buf, i); else (*cbf)(cb, "/32", 3); } } static void pr_string(struct node *node, CBFUNC cbf, void*cb){ if(node->value){ (*cbf)(cb, (char*)node->value, strlen((char*)node->value)); } else (*cbf)(cb, "(NULL)", 6); } static void pr_rotation(struct node *node, CBFUNC cbf, void*cb){ char * string = "NCHDWMN"; char ret[2]; int i; if(node->value && (i = *(int*)node->value) > 1 && i < 6){ ret[0] = string[i]; ret[1] = 0; (*cbf)(cb, ret, 1); } } static void pr_operations(struct node *node, CBFUNC cbf, void*cb){ char buf[64]; int operation; int delim = 0; *buf = 0; if(!node->value || !(operation = *(int*)node->value)){ (*cbf)(cb, "*", 1); return; } if(operation & HTTP){ if((operation & HTTP) == HTTP) (*cbf)(cb, buf, sprintf(buf, "HTTP")); else (*cbf)(cb, buf, sprintf(buf, "%s%s%s%s%s%s%s%s%s", (operation & HTTP_GET)? "HTTP_GET" : "", ((operation & HTTP_GET) && (operation & (HTTP_PUT|HTTP_POST|HTTP_HEAD|HTTP_OTHER)))? "," : "", (operation & HTTP_PUT)? "HTTP_PUT" : "", ((operation & HTTP_PUT) && (operation & (HTTP_POST|HTTP_HEAD|HTTP_OTHER)))? "," : "", (operation & HTTP_POST)? "HTTP_POST" : "", ((operation & HTTP_POST) && (operation & (HTTP_HEAD|HTTP_OTHER)))? "," : "", (operation & HTTP_HEAD)? "HTTP_HEAD" : "", ((operation & HTTP_HEAD) && (operation & HTTP_OTHER))? "," : "", (operation & HTTP_OTHER)? "HTTP_OTHER" : "")); delim = 1; } if(operation & HTTP_CONNECT){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "HTTP_CONNECT")); delim = 1; } if(operation & FTP) { if((operation & FTP) == FTP) (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "FTP")); else (*cbf)(cb, buf, sprintf(buf, "%s%s%s%s%s%s", delim? ",":"", (operation & FTP_GET)? "FTP_GET" : "", ((operation & FTP_GET) && (operation & (FTP_PUT|FTP_LIST)))? ",":"", (operation & FTP_PUT)? "FTP_PUT" : "", ((operation & FTP_PUT) && (operation & FTP_LIST))? ",":"", (operation & FTP_LIST)? "FTP_LIST" : "")); delim = 1; } if(operation & CONNECT){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "CONNECT")); delim = 1; } if(operation & BIND){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "BIND")); delim = 1; } if(operation & UDPASSOC){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "UDPASSOC")); delim = 1; } if(operation & ICMPASSOC){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "ICMPASSOC")); delim = 1; } if(operation & DNSRESOLVE){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "DNSRESOLVE")); delim = 1; } if(operation & ADMIN){ (*cbf)(cb, buf, sprintf(buf, "%s%s", delim?",":"", "ADMIN")); } } static void pr_portlist(struct node *node, CBFUNC cbf, void*cb){ struct portlist *pl= (struct portlist *)node->value; char buf[16]; if(!pl) { (*cbf)(cb, "*", 1); return; } for(; pl; pl = pl->next) { if(pl->startport == pl->endport) (*cbf)(cb, buf, sprintf(buf, "%hu", pl->startport)); else (*cbf)(cb, buf, sprintf(buf, "%hu-%hu", pl->startport, pl->endport)); if(pl->next)(*cbf)(cb, ",", 1); } } static void pr_userlist(struct node *node, CBFUNC cbf, void*cb){ struct userlist *ul= (struct userlist *)node->value; if(!ul) { (*cbf)(cb, "*", 1); return; } for(; ul; ul = ul->next){ (*cbf)(cb, ul->user, strlen(ul->user)); if(ul->next)(*cbf)(cb, ",", 1); } } static void pr_iplist(struct node *node, CBFUNC cbf, void*cb){ char buf[20]; int i; struct iplist *il = (struct iplist *)node->value; if(!il) { (*cbf)(cb, "*", 1); return; } for(; il; il = il->next){ i = ipprint(buf, il->ip); i += cidrprint(buf+i, il->mask); if(il->next)buf[i++] = ','; (*cbf)(cb, buf, i); } } static void * ef_portlist_next(struct node *node){ return (((struct portlist *)node->value) -> next); } static void * ef_portlist_start(struct node *node){ return &(((struct portlist *)node->value) -> startport); } static void * ef_portlist_end(struct node *node){ return &(((struct portlist *)node->value) -> endport); } static void * ef_iplist_next(struct node *node){ return (((struct iplist *)node->value) -> next); } static void * ef_iplist_ip(struct node *node){ return &(((struct iplist *)node->value) -> ip); } static void * ef_iplist_cidr(struct node *node){ return &(((struct iplist *)node->value) -> mask); } static void * ef_iplist_mask(struct node *node){ return &(((struct iplist *)node->value) -> mask); } static void * ef_userlist_next(struct node * node){ return (((struct userlist *)node->value) -> next); } static void * ef_userlist_user(struct node * node){ return (((struct userlist *)node->value) -> user); } static void * ef_pwlist_next(struct node * node){ return (((struct passwords *)node->value) -> next); } static void * ef_pwlist_user(struct node * node){ return (((struct passwords *)node->value) -> user); } static void * ef_pwlist_password(struct node * node){ return (((struct passwords *)node->value) -> password); } static void * ef_pwlist_type(struct node * node){ switch (((struct passwords *)node->value) -> pwtype) { case SYS: return "SYS"; case CL: return "CL"; case CR: return "CR"; case NT: return "NT"; case LM: return "LM"; default: return ""; } } static void * ef_chain_next(struct node * node){ return ((struct chain *)node->value) -> next; } static void * ef_chain_type(struct node * node){ switch (((struct chain *)node->value) -> type) { case R_TCP: return "tcp"; break; case R_CONNECT: return "connect"; break; case R_SOCKS4: return "socks4"; break; case R_SOCKS5: return "socks5"; break; case R_HTTP: return "http"; break; case R_FTP: return "ftp"; break; case R_POP3: return "pop3"; break; default: return ""; break; } return node; } static void * ef_chain_ip(struct node * node){ return &((struct chain *)node->value) -> redirip; } static void * ef_chain_port(struct node * node){ return &((struct chain *)node->value) -> redirport; } static void * ef_chain_weight(struct node * node){ return &((struct chain *)node->value) -> weight; } static void * ef_chain_user(struct node * node){ return ((struct chain *)node->value) -> extuser; } static void * ef_chain_password(struct node * node){ return ((struct chain *)node->value) -> extpass; } static void * ef_ace_next(struct node * node){ return ((struct ace *)node->value) -> next; } static void * ef_ace_type(struct node * node){ static char buf[16]; switch (((struct ace *)node->value) -> action) { case ALLOW: case REDIRECT: return "allow"; case DENY: return "deny"; case BANDLIM: return "bandlim"; case NOBANDLIM: return "nobandlim"; case COUNT: return "count"; case NOCOUNT: return "nocount"; default: sprintf(buf, "%d, %x", ((struct ace *)node->value) -> action, (unsigned)node->value); return buf; return ""; } } static void * ef_ace_operations(struct node * node){ if(!((struct ace *)node->value) -> operation) return NULL; return &((struct ace *)node->value) -> operation; } static void * ef_ace_users(struct node * node){ return ((struct ace *)node->value) -> users; } static void * ef_ace_src(struct node * node){ return ((struct ace *)node->value) -> src; } static void * ef_ace_dst(struct node * node){ return ((struct ace *)node->value) -> dst; } static void * ef_ace_ports(struct node * node){ return ((struct ace *)node->value) -> ports; } static void * ef_ace_chain(struct node * node){ return ((struct ace *)node->value) -> chains; } static void * ef_ace_weekdays(struct node * node){ return (((struct ace *)node->value) -> wdays) ? &((struct ace *)node->value) -> wdays : NULL; } static void * ef_ace_period(struct node * node){ return ((struct ace *)node->value) -> periods; } static void * ef_bandlimit_next(struct node * node){ return ((struct bandlim *)node->value) -> next; } static void * ef_bandlimit_ace(struct node * node){ return ((struct bandlim *)node->value) -> ace; } static void * ef_bandlimit_rate(struct node * node){ return &((struct bandlim *)node->value) -> rate; } static void * ef_trafcounter_next(struct node * node){ return ((struct trafcount *)node->value) -> next; } static void * ef_trafcounter_ace(struct node * node){ return ((struct trafcount *)node->value) -> ace; } static void * ef_trafcounter_number(struct node * node){ return &((struct trafcount *)node->value) -> number; } static void * ef_trafcounter_type(struct node * node){ return &((struct trafcount *)node->value) -> type; } static void * ef_trafcounter_traffic(struct node * node){ return &((struct trafcount *)node->value) -> traf; } static void * ef_trafcounter_limit(struct node * node){ return &((struct trafcount *)node->value) -> traflim; } static void * ef_trafcounter_cleared(struct node * node){ return &((struct trafcount *)node->value) -> cleared; } static void * ef_trafcounter_updated(struct node * node){ return &((struct trafcount *)node->value) -> updated; } static void * ef_trafcounter_comment(struct node * node){ return ((struct trafcount *)node->value) -> comment; } static void * ef_trafcounter_disabled(struct node * node){ return &((struct trafcount *)node->value) -> disabled; } static void * ef_client_next(struct node * node){ return ((struct clientparam *)node->value) -> next; } static void * ef_client_child(struct node * node){ return ((struct clientparam *)node->value) -> child; } static void * ef_client_maxtraf(struct node * node){ return &((struct clientparam *)node->value) -> maxtraf; } static void * ef_client_type(struct node * node){ int service = ((struct clientparam *)node->value) -> service; return (service>=0 && service < 15)? (void *)stringtable[SERVICES + service] : (void *)"unknown"; } static void * ef_client_auth(struct node * node){ AUTHFUNC af = ((struct clientparam *)node->value) -> authfunc; if(af == alwaysauth) return "none"; if(af == nbnameauth) return "nbname"; if(af == ipauth) return "iponly"; if(af == strongauth) return "strong"; return "uknown"; } static void * ef_client_childcount(struct node * node){ return ((struct clientparam *)node->value) -> childcount; } static void * ef_client_log(struct node * node){ if(((struct clientparam *)node->value) -> logfunc == logstdout) return ""; #ifndef _WIN32 if(((struct clientparam *)node->value) -> logfunc == logsyslog) return "@"; #endif #ifndef NOODBC if(((struct clientparam *)node->value) -> logfunc == logsql) return "&"; #endif return NULL; } static void * ef_client_logformat(struct node * node){ return ((struct clientparam *)node->value) -> logformat; } static void * ef_client_nonprintable(struct node * node){ return ((struct clientparam *)node->value) -> nonprintable; } static void * ef_client_replacement(struct node * node){ if(((struct clientparam *)node->value) -> nonprintable)return &((struct clientparam *)node->value) -> replace; return NULL; } static void * ef_client_logtarget(struct node * node){ return ((struct clientparam *)node->value) -> logtarget; } static void * ef_client_operation(struct node * node){ if(!((struct clientparam *)node->value) -> operation) return NULL; return &((struct clientparam *)node->value) -> operation; } static void * ef_client_redirected(struct node * node){ return &((struct clientparam *)node->value) -> redirected; } static void * ef_client_target(struct node * node){ return ((struct clientparam *)node->value) -> target; } static void * ef_client_targetport(struct node * node){ return &((struct clientparam *)node->value) -> targetport; } static void * ef_client_intip(struct node * node){ return &((struct clientparam *)node->value) -> intip; } static void * ef_client_extip(struct node * node){ return &((struct clientparam *)node->value) -> extip; } static void * ef_client_intport(struct node * node){ return &((struct clientparam *)node->value) -> intport; } static void * ef_client_extport(struct node * node){ return &((struct clientparam *)node->value) -> extport; } static void * ef_client_acl(struct node * node){ return conf.acls[((struct clientparam *)node->value) -> aclnum]; } static void * ef_client_aclnum(struct node * node){ return &((struct clientparam *)node->value) -> aclnum; } static void * ef_client_hostname(struct node * node){ return ((struct clientparam *)node->value) -> hostname; } static void * ef_client_username(struct node * node){ return ((struct clientparam *)node->value) -> username; } static void * ef_client_password(struct node * node){ return ((struct clientparam *)node->value) -> password; } static void * ef_client_extusername(struct node * node){ return ((struct clientparam *)node->value) -> extusername; } static void * ef_client_extpassword(struct node * node){ return ((struct clientparam *)node->value) -> extpassword; } static void * ef_client_cliip(struct node * node){ return &((struct clientparam *)node->value) -> sinc.sin_addr.s_addr; } static void * ef_client_srvip(struct node * node){ return &((struct clientparam *)node->value) -> sins.sin_addr.s_addr; } static void * ef_client_cliport(struct node * node){ return &((struct clientparam *)node->value) -> sinc.sin_port; } static void * ef_client_srvport(struct node * node){ return &((struct clientparam *)node->value) -> sins.sin_port; } static void * ef_client_bytesin(struct node * node){ return &((struct clientparam *)node->value) -> statssrv; } static void * ef_client_bytesout(struct node * node){ return &((struct clientparam *)node->value) -> statscli; } static void * ef_client_singlepacket(struct node * node){ return &((struct clientparam *)node->value) -> singlepacket; } static void * ef_client_usentlm(struct node * node){ return &((struct clientparam *)node->value) -> usentlm; } static void * ef_client_pwtype(struct node * node){ return &((struct clientparam *)node->value) -> pwtype; } static void * ef_client_threadid(struct node * node){ return &((struct clientparam *)node->value) -> threadid; } static void * ef_client_reqport(struct node * node){ return &((struct clientparam *)node->value) -> reqport; } static void * ef_client_starttime(struct node * node){ return &((struct clientparam *)node->value) -> time_start; } static void * ef_client_starttime_msec(struct node * node){ return &((struct clientparam *)node->value) -> msec_start; } static void * ef_period_fromtime(struct node * node){ return &((struct period *)node->value) -> fromtime; } static void * ef_period_totime(struct node * node){ return &((struct period *)node->value) -> totime; } static void * ef_period_next(struct node * node){ return ((struct period *)node->value) -> next; } static struct property prop_portlist[] = { {prop_portlist + 1, "start", ef_portlist_start, TYPE_PORT}, {prop_portlist + 2, "end", ef_portlist_end, TYPE_PORT}, {NULL, "next", ef_portlist_next, TYPE_PORTLIST} }; static struct property prop_userlist[] = { {prop_userlist+1, "user", ef_userlist_user, TYPE_STRING}, {NULL, "next", ef_userlist_next, TYPE_USERLIST} }; static struct property prop_pwlist[] = { {prop_pwlist + 1, "user", ef_pwlist_user, TYPE_STRING}, {prop_pwlist + 2, "password", ef_pwlist_password, TYPE_STRING}, {prop_pwlist + 3, "type", ef_pwlist_type, TYPE_STRING}, {NULL, "next", ef_pwlist_next, TYPE_PWLIST} }; static struct property prop_iplist[] = { {prop_iplist + 1, "ip", ef_iplist_ip, TYPE_IP}, {prop_iplist + 2, "cidr", ef_iplist_cidr, TYPE_CIDR}, {prop_iplist + 3, "mask", ef_iplist_mask, TYPE_IP}, {NULL, "next", ef_iplist_next, TYPE_IPLIST} }; static struct property prop_chain[] = { {prop_chain + 1, "ip", ef_chain_ip, TYPE_IP}, {prop_chain + 2, "port", ef_chain_port, TYPE_PORT}, {prop_chain + 3, "type", ef_chain_type, TYPE_STRING}, {prop_chain + 4, "weight", ef_chain_weight, TYPE_SHORT}, {prop_chain + 5, "user", ef_chain_user, TYPE_STRING}, {prop_chain + 6, "password", ef_chain_password, TYPE_STRING}, {NULL, "next", ef_chain_next, TYPE_CHAIN} }; static struct property prop_period[] = { {prop_period + 1, "fromtime", ef_period_fromtime, TYPE_TIME }, {prop_period + 2, "totime", ef_period_totime, TYPE_TIME }, {NULL, "next", ef_period_next, TYPE_PERIOD} }; static struct property prop_ace[] = { {prop_ace + 1, "type", ef_ace_type, TYPE_STRING}, {prop_ace + 2, "operations", ef_ace_operations, TYPE_OPERATIONS}, {prop_ace + 3, "users", ef_ace_users, TYPE_USERLIST}, {prop_ace + 4, "src", ef_ace_src, TYPE_IPLIST}, {prop_ace + 5, "dst", ef_ace_dst, TYPE_IPLIST}, {prop_ace + 6, "ports", ef_ace_ports, TYPE_PORTLIST}, {prop_ace + 7, "chain", ef_ace_chain, TYPE_CHAIN}, {prop_ace + 8, "wdays", ef_ace_weekdays, TYPE_WEEKDAYS}, {prop_ace + 9, "periods", ef_ace_period, TYPE_PERIOD}, {NULL, "next", ef_ace_next, TYPE_ACE} }; static struct property prop_bandlimit[] = { {prop_bandlimit + 1, "ace", ef_bandlimit_ace, TYPE_ACE}, {prop_bandlimit + 2, "rate", ef_bandlimit_rate, TYPE_UNSIGNED}, {NULL, "next", ef_bandlimit_next, TYPE_BANDLIMIT} }; static struct property prop_trafcounter[] = { {prop_trafcounter + 1, "disabled", ef_trafcounter_disabled, TYPE_INTEGER}, {prop_trafcounter + 2, "ace", ef_trafcounter_ace, TYPE_ACE}, {prop_trafcounter + 3, "number", ef_trafcounter_number, TYPE_UNSIGNED}, {prop_trafcounter + 4, "type", ef_trafcounter_type, TYPE_ROTATION}, {prop_trafcounter + 5, "traffic", ef_trafcounter_traffic, TYPE_TRAFFIC}, {prop_trafcounter + 6, "limit", ef_trafcounter_limit, TYPE_TRAFFIC}, {prop_trafcounter + 7, "cleared", ef_trafcounter_cleared, TYPE_DATETIME}, {prop_trafcounter + 8, "updated", ef_trafcounter_updated, TYPE_DATETIME}, {prop_trafcounter + 9, "comment", ef_trafcounter_comment, TYPE_STRING}, {NULL, "next", ef_trafcounter_next, TYPE_TRAFCOUNTER} }; static struct property prop_client[] = { {prop_client + 1, "type", ef_client_type, TYPE_STRING}, {prop_client + 2, "threadid", ef_client_threadid, TYPE_INTEGER}, {prop_client + 3, "starttime", ef_client_starttime, TYPE_DATETIME}, {prop_client + 4, "starttime_msec", ef_client_starttime_msec, TYPE_UNSIGNED}, {prop_client + 5, "auth", ef_client_auth, TYPE_STRING}, {prop_client + 6, "childcount", ef_client_childcount, TYPE_INTEGER}, {prop_client + 7, "log", ef_client_log, TYPE_STRING}, {prop_client + 8, "logformat", ef_client_logformat, TYPE_STRING}, {prop_client + 9, "nonprintable", ef_client_nonprintable, TYPE_STRING}, {prop_client + 10, "replacement", ef_client_replacement, TYPE_CHAR}, {prop_client + 11, "logtarget", ef_client_logtarget, TYPE_STRING}, {prop_client + 12, "operation", ef_client_logtarget, TYPE_OPERATIONS}, {prop_client + 13, "redirected", ef_client_redirected, TYPE_INTEGER}, {prop_client + 14, "target", ef_client_target, TYPE_STRING}, {prop_client + 15, "targetport", ef_client_targetport, TYPE_PORT}, {prop_client + 16, "operation", ef_client_operation, TYPE_OPERATIONS}, {prop_client + 17, "intip", ef_client_intip, TYPE_IP}, {prop_client + 18, "extip", ef_client_extip, TYPE_IP}, {prop_client + 19, "intport", ef_client_intport, TYPE_PORT}, {prop_client + 20, "extport", ef_client_extport, TYPE_PORT}, {prop_client + 21, "acl", ef_client_acl, TYPE_ACE}, {prop_client + 22, "aclnum", ef_client_aclnum, TYPE_INTEGER}, {prop_client + 23, "hostname", ef_client_hostname, TYPE_STRING}, {prop_client + 24, "username", ef_client_username, TYPE_STRING}, {prop_client + 25, "password", ef_client_password, TYPE_STRING}, {prop_client + 26, "extusername", ef_client_extusername, TYPE_STRING}, {prop_client + 27, "extpassword", ef_client_extpassword, TYPE_STRING}, {prop_client + 28, "cliip", ef_client_cliip, TYPE_IP}, {prop_client + 29, "cliport", ef_client_cliport, TYPE_PORT}, {prop_client + 30, "srvip", ef_client_srvip, TYPE_IP}, {prop_client + 31, "srvport", ef_client_srvport, TYPE_PORT}, {prop_client + 32, "bytesin", ef_client_bytesin, TYPE_UNSIGNED}, {prop_client + 33, "bytesout", ef_client_bytesout, TYPE_UNSIGNED}, {prop_client + 34, "singlepacket", ef_client_singlepacket, TYPE_INTEGER}, {prop_client + 35, "usentlm", ef_client_usentlm, TYPE_INTEGER}, {prop_client + 36, "pwtype", ef_client_pwtype, TYPE_INTEGER}, {prop_client + 37, "reqport", ef_client_reqport, TYPE_PORT}, {prop_client + 38, "child", ef_client_child, TYPE_CLIENT}, {prop_client + 39, "maxtraf", ef_client_maxtraf, TYPE_UNSIGNED}, {NULL, "next", ef_client_next, TYPE_CLIENT} }; struct datatype datatypes[64] = { {"integer", NULL, pr_integer, NULL}, {"short", NULL, pr_short, NULL}, {"char", NULL, pr_char, NULL}, {"unsigned", NULL, pr_unsigned, NULL}, {"traffic", NULL, pr_traffic, NULL}, {"port", NULL, pr_port, NULL}, {"ip", NULL, pr_ip, NULL}, {"cidr", NULL, pr_cidr, NULL}, {"string", NULL, pr_string, NULL}, {"datetime", NULL, pr_datetime, NULL}, {"operations", NULL, pr_operations, NULL}, {"rotation", NULL, pr_rotation, NULL}, {"portlist", ef_portlist_next, pr_portlist, prop_portlist}, {"iplist", ef_iplist_next, pr_iplist, prop_iplist}, {"userlist", ef_userlist_next, pr_userlist, prop_userlist}, {"pwlist", ef_pwlist_next, NULL, prop_pwlist}, {"chain", ef_chain_next, NULL, prop_chain}, {"ace", ef_ace_next, NULL, prop_ace}, {"bandlimit", ef_bandlimit_next, NULL, prop_bandlimit}, {"trafcounter", ef_trafcounter_next, NULL, prop_trafcounter}, {"client", ef_trafcounter_next, NULL, prop_client}, {"weekdays", NULL, pr_wdays, NULL}, {"time", NULL, pr_time, NULL}, {"period", ef_period_next, NULL, prop_period} }; src/dighosts.c0100644002537100244200000000726610231670720013047 0ustar vladmkgroup/* * Copyright (c) 2000-2004 3APA3A * * please read License Agreement * * $Id: dighosts.c,v 1.4 2005/04/21 09:26:40 vlad Exp $ */ #include "proxy.h" int sockgetchar(SOCKET sock, int timeosec, int timeousec){ unsigned char buf; fd_set fds; struct timeval tv; tv.tv_sec = timeosec; tv.tv_usec = timeousec; FD_ZERO(&fds); FD_SET(sock, &fds); if (select (sock+1, &fds, NULL, NULL, &tv)!=1) return EOF; if (recv(sock, &buf, 1, 0)!=1) return EOF; return((int)buf); } int sockgetline(SOCKET sock, unsigned char * buf, int bufsize, int delim, int to){ int c; int i=0, tos, tou; if(bufsize<2) return 0; c = sockgetchar(sock, to, 0); if (c == EOF) { return 0; } tos = to/16; tou = ((to * 1000) / bufsize)%1000; do { buf[i++] = c; if(delim != EOF && c == delim) break; }while(i < bufsize && (c = sockgetchar(sock, tos, tou)) != EOF); return i; } unsigned char request[] = "GET %.1024s HTTP/1.0\r\nHost: %.256s\r\n\r\n"; int main(int argc, char *argv[]){ unsigned char *host, *hostend; SOCKET sock; struct sockaddr_in sa; FILE *fp; unsigned char buf[16000]; int i; unsigned x,y,z,w,cidr, x1,y1,z1,w1, mask; int first = 1; #ifdef _WIN32 WSADATA wd; WSAStartup(MAKEWORD( 1, 1 ), &wd); #endif if(argc < 3 || argc > 4 || (argc == 4 && (argv[1][0] != '-' || argv[1][1] != 'm'))) { fprintf(stderr, "Usage: %s [-m] \n" " program retrieves requested and builds comma delimited list of networks\n" " list than stored in \n" " networks are searched in xxx.yyy.zzz.www/cidr format\n" " switches:\n" " -m networks are searched in xxx.yyy.zzz.www mmm.mmm.mmm.mmm format\n" "\n(c)2002 by 3APA3A\n", argv[0]); return 1; } if(strncasecmp(argv[argc-2], "http://", 7)) { fprintf(stderr, "URL must be HTTP://\n"); return 2; } hostend = (unsigned char *)strchr((char *)argv[argc-2] + 7, '/'); if(!hostend) { fprintf(stderr, "Wrong URL syntaxis\n"); return 3; } *hostend = 0; if(!(host = (unsigned char *)strdup((char *)argv[argc-2] + 7))) { return 4; } *hostend = '/'; if(!(sa.sin_addr.s_addr = getip(host))) { fprintf(stderr, "Unable to resolve %s\n", host); return 5; } sa.sin_port = htons(80); sa.sin_family = AF_INET; if((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) return 6; if(!(fp = fopen(argv[argc-1], "w"))) { fprintf(stderr, "Unable to open: %s\n", argv[2]); return 7; } sprintf((char *)buf, (char *)request, hostend, host); if(connect(sock,(struct sockaddr *)&sa,sizeof(sa))) { fprintf(stderr, "Unable to connect: %s\n", host); return 8; } if(send(sock, buf, strlen((char *)buf), 0) != (int)strlen((char *)buf)) return 9; while( (i = sockgetline(sock, buf, sizeof(buf) - 1, '\n', 30)) > 2); while( (i = sockgetline(sock, buf, sizeof(buf) - 1, '\n', 30)) > 0){ buf[i] = 0; for(i = 0; buf[i]; i++){ if((buf[i]<'0' || buf[i] > '9') && buf[i] != '.' && buf[i] != '/')buf[i] = ' '; } if(argc == 3){ if((i=sscanf((char *)buf, "%u.%u.%u.%u/%u", &x, &y, &z, &w, &cidr)) == 5 && x<256 && y<256 && z<256 && w<256 && cidr <= 32){ if(!first)fprintf(fp, ","); fprintf(fp, "%u.%u.%u.%u/%u", x, y, z, w, cidr); first = 0; } } else{ if((i = sscanf((char *)buf, "%u.%u.%u.%u %u.%u.%u.%u", &x, &y, &z, &w, &x1, &y1, &z1, &w1)) == 8 && x<256 && y<256 && z<256 && w<256 && x1<256 && y1<256 && z1<256 && w1<256 ){ mask = (x1<<24)|(y1<<16)|(z1<<8)|w1; for(cidr = 0; cidr <= 32; cidr++)if((((unsigned long)(0xFFFFFFFF))<<(32-cidr)) == mask) break; if(cidr > 32) continue; if(!first)fprintf(fp, ","); fprintf(fp, "%u.%u.%u.%u/%u", x, y, z, w, cidr); first = 0; } } } shutdown(sock, SHUT_RDWR); closesocket(sock); fclose(fp); return 0; } src/dnspr.c0100644002537100244200000000746710242371054012354 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: dnspr.c,v 1.9 2005/05/17 13:31:24 vlad Exp $ */ #include "proxy.h" #ifndef UDP #define UDP #endif #define RETURN(xxx) { param->res = xxx; goto CLEANRET; } #define BUFSIZE 4096 unsigned long udpresolve(const unsigned char * name, unsigned * retttl, struct clientparam* param); void * dnsprchild(void * data) { #define param ((struct clientparam*)data) unsigned long ip = 0; unsigned char *buf, *s1, *s2; char * host = NULL; unsigned char c; SASIZETYPE size; int res, i; int len; unsigned type=0; unsigned ttl; if(!(buf = myalloc(BUFSIZE))){ param->srvfds->events = POLLIN; RETURN (21); } size = sizeof(struct sockaddr_in); i = recvfrom(param->srvsock, buf, BUFSIZE, 0, (struct sockaddr *)¶m->sinc, &size); param->srvfds->events = POLLIN; if(i < 0) { RETURN(813); } buf[BUFSIZE - 1] = 0; if(i<=13 || i>1000){ RETURN (814); } param->operation = DNSRESOLVE; if((res = (*param->authfunc)(param))) {RETURN(res);} if(buf[4]!=0 || buf[5]!=1) RETURN(816); for(len = 12; len (i-4)) {RETURN(817);} host = mystrdup(buf+13); if(!host) {RETURN(21);} for(s2 = buf + 12; (s1 = (unsigned char *)strchr((char *)s2 + 1, '.')); s2 = s1)*s2 = (unsigned char)((s1 - s2) - 1); *s2 = (len - (s2 - buf)) - 1; type = ((unsigned)buf[len+1])*256 + (unsigned)buf[len+2]; if(type==1){ ip = udpresolve(host, &ttl, param); } len+=5; if(ip){ buf[2] = 0x85; buf[3] = 0x80; buf[6] = 0; buf[7] = 1; buf[8] = buf[9] = buf[10] = buf[11] = 0; memset(buf+len, 0, 16); buf[len] = 0xc0; buf[len+1] = 0x0c; buf[len+3] = 1; buf[len+5] = 1; ttl = htonl(ttl); memcpy(buf + len + 6, &ttl, 4); buf[len+11] = 4; memcpy(buf+len+12,(void *)&ip,4); len+=16; } if(type == 0x0c) { unsigned a, b, c, d; sscanf(host, "%u.%u.%u.%u", &a, &b, &c, &d); ip = htonl((d<<24) ^ (c<<16) ^ (b<<8) ^ a); if(ip == param->intip){ buf[2] = 0x85; buf[3] = 0x80; buf[6] = 0; buf[7] = 1; buf[8] = buf[9] = buf[10] = buf[11] = 0; memset(buf+len, 0, 20); buf[len] = 0xc0; buf[len+1] = 0x0c; buf[len+3] = 0x0c; buf[len+5] = 1; ttl = htonl(3600); memcpy(buf + len + 6, &ttl, 4); buf[len+11] = 7; buf[len+12] = 6; memcpy(buf+len+13,(void *)"3proxy",6); len+=20; } else ip = 0; } if(!ip && nservers[0] && type!=1){ if((param->remsock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) { RETURN(818); } param->sins.sin_family = AF_INET; param->sins.sin_port = htons(0); param->sins.sin_addr.s_addr = htonl(0); if(bind(param->remsock,(struct sockaddr *)¶m->sins,sizeof(struct sockaddr_in))) { RETURN(819); } param->sins.sin_addr.s_addr = nservers[0]; param->sins.sin_port = htons(53); if(socksendto(param->remsock, ¶m->sins, buf, i, conf.timeouts[SINGLEBYTE_L]*1000) != i){ RETURN(820); } param->statscli += i; len = sockrecvfrom(param->remsock, ¶m->sins, buf, BUFSIZE, 15000); if(len <= 13) { RETURN(821); } param->statssrv += len; if(buf[6] || buf[7]){ if(socksendto(param->srvsock, ¶m->sinc, buf, len, conf.timeouts[SINGLEBYTE_L]*1000) != len){ RETURN(822); } RETURN(0); } } if(!ip) { buf[2] = 0x85; buf[3] = 0x83; } res = socksendto(param->srvsock, ¶m->sinc, buf, len, conf.timeouts[SINGLEBYTE_L]*1000); if(res != len){RETURN(819);} if(!ip) {RETURN(888);} CLEANRET: if(param->res!=813){ sprintf(buf, "%04x/%s(%u.%u.%u.%u) ", (unsigned)type, host, (unsigned)(ntohl(ip)&0xff000000)>>24, (unsigned)(ntohl(ip)&0x00ff0000)>>16, (unsigned)(ntohl(ip)&0x0000ff00)>>8, (unsigned)(ntohl(ip)&0x000000ff) ); (*param->logfunc)(param, buf); } if(buf)myfree(buf); if(host)myfree(host); param->clisock = INVALID_SOCKET; freeparam(param); return (NULL); } src/ftp.c0100644002537100244200000001444410234747165012023 0ustar vladmkgroup/* * Copyright (c) 2002-2004 3APA3A * * please read License Agreement * * $Id: ftp.c,v 1.12 2005/04/30 18:29:09 vlad Exp $ */ #include "proxy.h" int ftplogin(struct clientparam *param, char *nbuf, int *innbuf) { char buf[1024]; int i; int inbuf = 0; while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ ; } if(i < 3) return 706; buf[3] = 0; if(atoi(buf)/100 != 2) return 702; sprintf(buf, "USER %.32s\r\n", param->extusername?param->extusername:(unsigned char *)"anonymous"); if((int)socksend(param->remsock, buf, strlen(buf), conf.timeouts[STRING_S]) != (int)strlen(buf)){ return 703; } param->statscli+=strlen(buf); while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 3) return 704; param->statssrv += i; buf[3] = 0; if(atoi(buf)/100 == 3){ sprintf(buf, "PASS %.64s\r\n", param->extusername? (param->extpassword? param->extpassword:(unsigned char *)"") :(unsigned char *)"3proxy@"); if((int)socksend(param->remsock, buf, strlen(buf), conf.timeouts[STRING_S]) != (int)strlen(buf)){ return 705; } param->statscli+=strlen(buf); while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0){ param->statssrv += i; if(nbuf && innbuf && inbuf + i< *innbuf && i > 6) { memcpy(nbuf + inbuf, buf, i); inbuf += i; } if(i > 3 && isnumber(*buf) && buf[3] != '-') break; } if(innbuf)*innbuf = inbuf; if(i < 3) return 701; buf[3] = 0; } if(buf[0] != '2') { return 700; } if(innbuf)*innbuf = inbuf; return 0; } int ftpcd(struct clientparam *param, unsigned char* path, char *nbuf, int *innbuf){ char buf[1024]; int i; int inbuf = 0; sprintf(buf, "CWD %.512s\r\n", path); if((int)socksend(param->remsock, buf, strlen(buf), conf.timeouts[STRING_S]) != (int)strlen(buf)){ return 711; } param->statscli+=strlen(buf); while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; if(nbuf && innbuf && inbuf + i < *innbuf && i > 6) { memcpy(nbuf + inbuf, buf, i); inbuf += i; } } if(innbuf)*innbuf = inbuf; if(i < 3) return 712; param->statssrv += i; buf[3] = 0; if(buf[0] != '2') return 710; return 0; } int ftpres(struct clientparam *param){ char buf[1024]; int i; while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 3) return 751; param->statssrv += i; buf[3] = 0; if(buf[0] != '2') return 750; return 0; } int ftpsyst(struct clientparam *param, unsigned char *buf, unsigned len){ int i; if(socksend(param->remsock, "SYST\r\n", 6, conf.timeouts[STRING_S]) != 6){ return 721; } param->statscli+=6; while((i = sockgetlinebuf(param, SERVER, buf, len - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 7) return 722; param->statssrv += i; buf[3] = 0; if(atoi(buf)/100 != 2) return 723; buf[i-2] = 0; strcpy(buf, buf+4); return 0; } int ftppwd(struct clientparam *param, unsigned char *buf, unsigned len){ int i; char *b, *e; if(socksend(param->remsock, "PWD\r\n", 5, conf.timeouts[STRING_S]) != 5){ return 731; } param->statscli += 5; while((i = sockgetlinebuf(param, SERVER, buf, len - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 7) return 732; param->statssrv += i; buf[3] = 0; if(atoi(buf)/100 != 2) return 733; buf[i-2] = 0; b = buf+4; if(*b == '\"' && (e = strchr(b+1, '\"'))){ b++; *e = 0; } strcpy(buf, b); return 0; } int ftptype(struct clientparam *param, unsigned char* f_type){ char buf[1024]; int i; sprintf(buf, "TYPE %.512s\r\n", f_type); if((int)socksend(param->remsock, buf, strlen(buf), conf.timeouts[STRING_S]) != (int)strlen(buf)){ return 741; } param->statscli+=strlen(buf); while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 3) return 742; param->statssrv += i; if(buf[0] != '2') return 740; return 0; } SOCKET ftpdata(struct clientparam *param){ char buf[1024]; int i; char *sb, *se; SOCKET s = INVALID_SOCKET; unsigned long b1, b2, b3, b4; unsigned short b5, b6; struct sockaddr_in sa; if(socksend(param->remsock, "PASV\r\n", 6, conf.timeouts[STRING_S]) != 6){ return INVALID_SOCKET; } param->statscli+=6; while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 7) return INVALID_SOCKET; param->statssrv += i; if(buf[0] != '2') return INVALID_SOCKET; buf[i-2] = 0; if(!(sb = strchr(buf+4, '(')) || !(se= strchr(sb, ')'))) return INVALID_SOCKET; if(sscanf(sb+1, "%lu,%lu,%lu,%lu,%hu,%hu", &b1, &b2, &b3, &b4, &b5, &b6)!=6) return INVALID_SOCKET; sa.sin_family = AF_INET; sa.sin_port = htons((unsigned short)((b5<<8)^b6)); sa.sin_addr.s_addr = htonl((b1<<24)^(b2<<16)^(b3<<8)^b4); if ((s=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) return INVALID_SOCKET; if( connect(s, (struct sockaddr *)&sa, sizeof(sa))){ closesocket(s); return INVALID_SOCKET; } return s; } SOCKET ftpcommand(struct clientparam *param, unsigned char * command, unsigned char *arg) { char buf[1024]; int i; SOCKET s; s = ftpdata(param); if(s==INVALID_SOCKET) return INVALID_SOCKET; sprintf(buf, "%.15s%s%.512s\r\n", command, arg? (unsigned char *)" ":(unsigned char *)"", arg?arg:(unsigned char *)""); if((int)socksend(param->remsock, buf, strlen(buf), conf.timeouts[STRING_S]) != (int)strlen(buf)){ close(s); return INVALID_SOCKET; } param->statscli+=strlen(buf); while((i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L])) > 0 && (i < 3 || !isnumber(*buf) || buf[3] == '-')){ param->statssrv += i; } if(i < 3) { close(s); return INVALID_SOCKET; } param->statssrv += i; if(buf[0] != '1') { close(s); return INVALID_SOCKET; } return s; } src/ftppr.c0100644002537100244200000001752210241100565012346 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: ftppr.c,v 1.16 2005/05/13 10:29:09 vlad Exp $ */ #include "proxy.h" #define RETURN(xxx) { param->res = xxx; goto CLEANRET; } #define BUFSIZE 2048 void * ftpprchild(void * data) { #define param ((struct clientparam*)data) int i=0, res; unsigned char buf[BUFSIZE]; unsigned char *se; int status = 0; int inbuf; int pasv = 0; SOCKET sc = INVALID_SOCKET, ss = INVALID_SOCKET, clidatasock = INVALID_SOCKET; SASIZETYPE sasize; char * req = NULL; struct linger lg; struct pollfd fds; param->ctrlsock = param->clisock; param->operation = CONNECT; lg.l_onoff = 1; lg.l_linger = 10; if(socksend(param->clisock, "220 Ready\r\n", 11, conf.timeouts[STRING_S])!=11) {RETURN (801);} for(;;){ i = sockgetlinebuf(param, CLIENT, buf, BUFSIZE - 10, '\n', conf.timeouts[CONNECTION_S]); if(!i) { RETURN(0); } if(i<4) {RETURN(802);} buf[i] = 0; if ((se=(unsigned char *)strchr((char *)buf, '\r'))) *se = 0; if (req) myfree (req); req = NULL; if (!strncasecmp((char *)buf, "OPEN ", 5)){ if(param->hostname) myfree(param->hostname); if(parsehostname(buf+5, param, 21)){RETURN(803);} if(param->remsock != INVALID_SOCKET) { shutdown(param->remsock, SHUT_RDWR); closesocket(param->remsock); param->remsock = INVALID_SOCKET; } if((res = (*param->authfunc)(param))) {RETURN(res);} if(socksend(param->ctrlsock, "220 Ready\r\n", 11, conf.timeouts[STRING_S])!=11) {RETURN (801);} status = 1; } else if (!strncasecmp((char *)buf, "USER ", 5)){ if(!param->hostname && param->remsock == INVALID_SOCKET) { if(parseconnusername((char *)buf +5, param, 0, 21)){RETURN(804);} } else if(parseusername((char *)buf + 5, param, 0)) {RETURN(805);} if(!status){ if((res = (*param->authfunc)(param))) {RETURN(res);} } if(socksend(param->ctrlsock, "331 ok\r\n", 8, conf.timeouts[STRING_S])!=8) {RETURN (807);} status = 2; } else if (!strncasecmp((char *)buf, "PASS ", 5)){ param->extpassword = mystrdup(buf+5); inbuf = BUFSIZE; res = ftplogin(param, buf, &inbuf); param->res = res; if(inbuf && inbuf != BUFSIZE && socksend(param->ctrlsock, buf, inbuf, conf.timeouts[STRING_S])!=inbuf) {RETURN (807);} if(!res) status = 3; sprintf(buf, "%.64s@%.128s%c%hu", param->extusername, param->hostname, (ntohs(param->sins.sin_port)==21)?0:':', ntohs(param->sins.sin_port)); req = mystrdup(buf); } else if (status >= 3 && ( (!strncasecmp((char *)buf, "PASV", 4) && (pasv = 1)) || (!strncasecmp((char *)buf, "PORT ", 5) && !(pasv = 0)) )){ if(sc != INVALID_SOCKET) { shutdown(sc, SHUT_RDWR); closesocket(sc); } if(ss != INVALID_SOCKET) { shutdown(ss, SHUT_RDWR); closesocket(ss); } if ((clidatasock=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {RETURN(821);} sasize = sizeof(struct sockaddr_in); if (pasv) { if(getsockname(param->clisock, (struct sockaddr *)¶m->sinc, &sasize)){RETURN(824);} param->sinc.sin_port = 0; if(bind(clidatasock, (struct sockaddr *)¶m->sinc, sasize)){RETURN(822);} if(listen(clidatasock, 1)) {RETURN(823);} if(getsockname(clidatasock, (struct sockaddr *)¶m->sinc, &sasize)){RETURN(824);} sprintf(buf, "227 OK (%u,%u,%u,%u,%u,%u)\r\n", (unsigned)(((unsigned char *)(¶m->sinc.sin_addr.s_addr))[0]), (unsigned)(((unsigned char *)(¶m->sinc.sin_addr.s_addr))[1]), (unsigned)(((unsigned char *)(¶m->sinc.sin_addr.s_addr))[2]), (unsigned)(((unsigned char *)(¶m->sinc.sin_addr.s_addr))[3]), (unsigned)(((unsigned char *)(¶m->sinc.sin_port))[0]), (unsigned)(((unsigned char *)(¶m->sinc.sin_port))[1]) ); if(socksend(param->clisock, buf, strlen(buf), conf.timeouts[STRING_S])!=strlen(buf)) {RETURN (825);} } else { unsigned long b1, b2, b3, b4; unsigned short b5, b6; if(sscanf(buf+5, "%lu,%lu,%lu,%lu,%hu,%hu", &b1, &b2, &b3, &b4, &b5, &b6)!=6) {RETURN(828);} param->sinc.sin_family = AF_INET; param->sinc.sin_port = htons((unsigned short)((b5<<8)^b6)); param->sinc.sin_addr.s_addr = htonl((b1<<24)^(b2<<16)^(b3<<8)^b4); if(connect(clidatasock, (struct sockaddr *)¶m->sinc, sasize)) { closesocket(clidatasock); RETURN(826); } if(socksend(param->clisock, "200 OK\r\n", 8, conf.timeouts[STRING_S]) != 8) {RETURN (827);} } status = 4; } else if (status == 4 && ( !strncasecmp((char *)buf, "RETR ", 5) || !strncasecmp((char *)buf, "LIST", 4) || !strncasecmp((char *)buf, "STOR ", 5) )){ int arg = (buf[4] && buf[5])? 1:0; if(pasv){ fds.fd = clidatasock; fds.events = POLLIN; res = poll (&fds, 1, conf.timeouts[STRING_L]*1000); if(res != 1) {RETURN(826);} sasize = sizeof(struct sockaddr_in); ss = accept(clidatasock, (struct sockaddr *)¶m->sinc, &sasize); shutdown(clidatasock, SHUT_RDWR); closesocket(clidatasock); clidatasock = ss; ss = INVALID_SOCKET; } if(clidatasock == INVALID_SOCKET){RETURN(828);} req = mystrdup(buf); buf[4] = 0; status = 3; ss = ftpcommand(param, buf, arg? buf+5 : NULL); if (ss == INVALID_SOCKET) { if(socksend(param->ctrlsock, "425 err\r\n", 9, conf.timeouts[STRING_S])!=9) {RETURN (831);} continue; } sc = param->remsock; param->remsock = ss; setsockopt(param->remsock, SOL_SOCKET, SO_LINGER, (unsigned char *)&lg, sizeof(lg)); setsockopt(clidatasock, SOL_SOCKET, SO_LINGER, (unsigned char *)&lg, sizeof(lg)); if(socksend(param->clisock, "101 data\r\n", 10, conf.timeouts[STRING_S]) != 10) { param->remsock = INVALID_SOCKET; RETURN (832); } param->clisock = clidatasock; res = sockmap(param, conf.timeouts[CONNECTION_S]); param->clisock = param->ctrlsock; if(param->remsock != INVALID_SOCKET) { shutdown (param->remsock, SHUT_RDWR); closesocket(param->remsock); } param->remsock = sc; sc = INVALID_SOCKET; ss = INVALID_SOCKET; if(clidatasock != INVALID_SOCKET){ shutdown (clidatasock, SHUT_RDWR); closesocket(clidatasock); clidatasock = INVALID_SOCKET; } while((i = sockgetlinebuf(param, SERVER, buf, BUFSIZE, '\n', conf.timeouts[STRING_L])) > 3){ param->statssrv += i; if(socksend(param->clisock, buf, i, conf.timeouts[STRING_S])!=i) {RETURN(833);} if(isnumber(*buf) && buf[3] != '-') break; } if(i < 3) {RETURN(834);} } else { if(status < 3) { if(socksend(param->remsock, "530 login\r\n", 11, conf.timeouts[STRING_S])!=1) {RETURN (810);} continue; } if(!strncasecmp((char *)buf, "QUIT", 4)) status = 5; if(!strncasecmp((char *)buf, "CWD ", 4)) req = mystrdup(buf); i = strlen(buf); buf[i++] = '\r'; buf[i++] = '\n'; if(socksend(param->remsock, buf, i, conf.timeouts[STRING_S])!=i) {RETURN (811);} param->statscli += i; while((i = sockgetlinebuf(param, SERVER, buf, BUFSIZE, '\n', conf.timeouts[STRING_L])) > 0){ param->statssrv += i; if(socksend(param->clisock, buf, i, conf.timeouts[STRING_S])!=i) {RETURN (812);} if(i > 4 && isnumber(*buf) && buf[3] != '-') break; } if(status == 5) {RETURN (0);} if(i < 3) {RETURN (813);} } sasize = sizeof(struct sockaddr_in); if(getpeername(param->ctrlsock, (struct sockaddr *)¶m->sinc, &sasize)){RETURN(819);} if(req && (param->statscli || param->statssrv)){ (*param->logfunc)(param, req); } } CLEANRET: if(sc != INVALID_SOCKET) { shutdown(sc, SHUT_RDWR); closesocket(sc); } if(ss != INVALID_SOCKET) { shutdown(ss, SHUT_RDWR); closesocket(ss); } if(clidatasock != INVALID_SOCKET) { shutdown(clidatasock, SHUT_RDWR); closesocket(clidatasock); } sasize = sizeof(struct sockaddr_in); getpeername(param->ctrlsock, (struct sockaddr *)¶m->sinc, &sasize); if(param->res != 0 || param->statscli || param->statssrv ){ (*param->logfunc)(param, (req && (param->res > 802))? req:NULL); } if(req) myfree(req); freeparam(param); return (NULL); } #ifdef WITHMAIN struct proxydef childdef = { ftpprchild, 21, 0, S_FTPPR, "" }; #include "proxymain.c" #endif src/myalloc.c0100644002537100244200000001666410140652067012670 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: myalloc.c,v 1.1.1.1 2004/06/25 17:32:56 vlad Exp $ */ #ifndef WITH_STD_MALLOC #include "proxy.h" #define MEM64K 65536 #define MEM16K 16384 #define MEM4K 4096 #define MEM1K 1024 #define MEM256 256 #define DEBUGLEVEL 1 struct mempage{ struct mempage *next; unsigned usable; unsigned char bitmap[32]; unsigned char data[MEM64K]; } * pages[] = {NULL, NULL, NULL, NULL, NULL, NULL}; unsigned memsizes[] = {MEM64K, MEM16K, MEM4K, MEM1K, MEM256, 0}; enum pagesizes { p64k, p16k, p4k, p1k, p256, nomem, }; pthread_mutex_t mem_mutex; int mem_init = 0; #ifdef _WIN32 HANDLE myheap; #define malloc(x) HeapAlloc(myheap, 0, x) #define free(x) HeapFree(myheap, 0, x) #endif void init_mem(void) { mem_init++; pthread_mutex_init(&mem_mutex, NULL); #if DEBUGLEVEL > 2 fprintf(stderr, "Memory initialized\n"); fflush(stderr); #endif #ifdef _WIN32 myheap = HeapCreate(0, MEM64K*16, 0); #endif } void * myalloc64k(){ struct mempage *newpage; if(!mem_init)init_mem(); if(!(newpage = (struct mempage *)malloc(sizeof(struct mempage)))){ #if DEBUGLEVEL > 0 fprintf(stderr, "Failed to allocate p64k\n"); fflush(stderr); #endif return NULL; } memset(newpage->bitmap, 0, 32); newpage->usable = 0; pthread_mutex_lock(&mem_mutex); newpage->next = pages[p64k]; pages[p64k] = newpage; pthread_mutex_unlock(&mem_mutex); #if DEBUGLEVEL > 2 fprintf(stderr, "New p64k created, address %X region: %X\n", newpage, newpage->data); fflush(stderr); #endif #if DEBUGLEVEL == 2 fprintf(stderr, "myalloc64 %p\n", newpage->data); fflush(stderr); #endif return newpage->data; } void * myalloc(size_t size){ struct mempage *newpage, *page; unsigned pagesize; unsigned i=0, j, k=0; int p; if(!mem_init)init_mem(); for(p = nomem; ; ) { if(!p){ #if DEBUGLEVEL > 2 fprintf(stderr, "Page is too large (%u), requesting malloc instead\n", size); fflush(stderr); #endif return malloc(size); } p--; if(size 2 fprintf(stderr, "Page will p64k\n"); fflush(stderr); #endif return myalloc64k(); } pagesize = memsizes[p]; #if DEBUGLEVEL > 2 fprintf(stderr, "Calculated pagesize: %u\n", pagesize); fflush(stderr); #endif pthread_mutex_lock(&mem_mutex); newpage = pages[p]; if(newpage && newpage->usable){ #if DEBUGLEVEL > 2 fprintf(stderr, "Useful page found: %X,", newpage); fflush(stderr); #endif for(j=0; j<32; j++){ register unsigned c = newpage->bitmap[j]; if(c){ for(k=0; ;k++)if(c & (1< 2 fprintf(stderr, "region: %X, offset %u, byte %u, %u, %u\n", newpage->data + i, i, j, k, newpage->bitmap[j]); fflush(stderr); #endif break; } } } else{ if(!(newpage = (struct mempage *)malloc(sizeof(struct mempage)))){ pthread_mutex_unlock(&mem_mutex); #if DEBUGLEVEL > 0 fprintf(stderr, "Failed to allocate p64k\n"); fflush(stderr); #endif return NULL; } #if DEBUGLEVEL > 2 fprintf(stderr, "New page used: %X,", newpage); fflush(stderr); #endif memset(newpage->bitmap, 0, 32); for(i = 0; i> 11); k = ((i & 0x000007FF) >> 8); newpage->bitmap[j] |= (1<next = pages[p]; newpage->usable = MEM64K; pages[p] = newpage; } #if DEBUGLEVEL > 2 fprintf(stderr, "Byte was %d/%d/%d\n", j, k, newpage->bitmap[j]); fflush(stderr); #endif newpage->bitmap[j] ^= (1< 2 fprintf(stderr, "Byte set %d/%d/%d\n", j, k, newpage->bitmap[j]); fflush(stderr); #endif newpage->usable -= pagesize; #if DEBUGLEVEL > 2 fprintf(stderr, "usable amount after allocation: %u\n", newpage->usable); fflush(stderr); #endif if(!newpage->usable){ #if DEBUGLEVEL > 2 fprintf(stderr, "No usable amount left\n", newpage->usable); fflush(stderr); #endif if((page = newpage->next) && page->usable){ #if DEBUGLEVEL > 2 fprintf(stderr, "Moving to end of list\n", newpage->usable); fflush(stderr); #endif pages[p] = page; while(page->next && page->next->usable)page = page->next; newpage->next = page->next; page->next = newpage; } } pthread_mutex_unlock(&mem_mutex); #if DEBUGLEVEL > 2 fprintf(stderr, "All done, returning: %x\n", newpage->data + i); fflush(stderr); #endif #if DEBUGLEVEL == 2 fprintf(stderr, "malloc %p\n", (void *)(newpage->data + i)); fflush(stderr); #endif return (void *)(newpage->data + i); } int myfindsize(void * p, struct mempage ***prevpagep, struct mempage **pagep){ int i; struct mempage *prevpage, *page; for (i=0; inext){ if( p >= (void *)page->data && p < (void *)(page->data + MEM64K))break; prevpage = page; } if(page){ if(pagep)*pagep = page; if(prevpagep)*prevpagep = prevpage?&prevpage->next:&pages[i]; #if DEBUGLEVEL > 2 fprintf(stderr, "%x belongs to page: %x with data %x\n", p, page, page->data); fflush(stderr); #endif break; } } return i; } void myfree(void *p){ struct mempage **prevpage, *page; int i; unsigned pagesize; unsigned size, j, k; #if DEBUGLEVEL == 2 fprintf(stderr, "free %p\n", p); fflush(stderr); #endif pthread_mutex_lock(&mem_mutex); i = myfindsize(p, &prevpage, &page); if (i == nomem) { #if DEBUGLEVEL > 2 fprintf(stderr, "Page does not exists, trying free()\n"); fflush(stderr); #endif pthread_mutex_unlock(&mem_mutex); free(p); return; } pagesize = memsizes[i]; #if DEBUGLEVEL > 2 fprintf(stderr, "Calculated pagesize: %u\n", pagesize); fflush(stderr); #endif size = (unsigned char*)p - page->data; if(size%pagesize) { #if DEBUGLEVEL > 0 fprintf(stderr, "Given address is not block aligned, ignoring\n"); fflush(stderr); #endif pthread_mutex_unlock(&mem_mutex); return; /* Hmmmmm */ } *prevpage = page->next; page->usable += pagesize; #if DEBUGLEVEL > 2 fprintf(stderr, "New usable space: %u\n", page->usable); fflush(stderr); #endif if(page->usable >= MEM64K && ((pagesize == MEM64K) || (pages[i] && pages[i]->usable))) { #if DEBUGLEVEL > 2 fprintf(stderr, "Free this page\n"); fflush(stderr); #endif free(page); } else { j = (size>>11); k = ((size & 0x000007FF) >> 8); k = ('\01'<bitmap[j] & k) { #if DEBUGLEVEL > 0 fprintf(stderr, "Error: double free() %d/%d/%d\n", j, k, page->bitmap[j]); fflush(stderr); #endif page->usable += pagesize; } page->bitmap[j] |= k; page->next = pages[i]; pages[i] = page; #if DEBUGLEVEL > 2 fprintf(stderr, "This page will be reused next time\n"); fflush(stderr); #endif } pthread_mutex_unlock(&mem_mutex); } char * mystrdup(const char *str){ unsigned l; char *p; if(!str) return NULL; l = strlen(str)+1; p = myalloc(l); if(p)memcpy(p, str, l); #if DEBUGLEVEL == 2 fprintf(stderr, "strdup %p\n", p); fflush(stderr); #endif return p; } void *myrealloc(void *ptr, size_t size){ unsigned l; void * p; l = myfindsize(ptr, NULL, NULL); if(size <= memsizes[l]) return ptr; p = myalloc(size); if(p){ memcpy(p,ptr,size); myfree(ptr); } return p; } #ifdef WITH_MAIN int main(){ void *p1, *p2, *p3, *p4, *p5, *p6, *p7, *p8, *p9, *p10, *p11, *p12, *p13; p1 = myalloc(5000); p2 = myalloc(5000); p3 = myalloc(5000); p4 = myalloc(5000); p5 = myalloc(5000); p6 = myalloc(5000); p7 = myalloc(5000); p8 = myalloc(5000); p9 = myalloc(5000); p10 = myalloc(5000); myfree(p2); myfree(p8); p11 = myalloc(5000); p12 = myalloc(5000); p13 = myalloc(5000); p2 = myalloc(5000); p8 = myalloc(5000); myalloc(5000); } #endif #endif src/mycrypt.c0100644002537100244200000001117610215300672012723 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2003 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: mycrypt.c,v 1.2 2005/03/14 12:21:14 vlad Exp $ */ #include "libs/md5.h" #include "libs/md4.h" #include #define MD5_SIZE 16 void tohex(unsigned char *in, unsigned char *out, int len); static unsigned char itoa64[] = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; void _crypt_to64(unsigned char *s, unsigned long v, int n) { while (--n >= 0) { *s++ = itoa64[v&0x3f]; v >>= 6; } } unsigned char * ntpwdhash (unsigned char *szHash, const unsigned char *szPassword, int ctohex) { unsigned char szUnicodePass[513]; unsigned int nPasswordLen; MD4_CTX ctx; unsigned int i; /* * NT passwords are unicode. Convert plain text password * to unicode by inserting a zero every other byte */ nPasswordLen = strlen((char *)szPassword); if(nPasswordLen > 255)nPasswordLen = 255; for (i = 0; i < nPasswordLen; i++) { szUnicodePass[i << 1] = szPassword[i]; szUnicodePass[(i << 1) + 1] = 0; } /* Encrypt Unicode password to a 16-byte MD4 hash */ MD4Init(&ctx); MD4Update(&ctx, szUnicodePass, (nPasswordLen<<1)); MD4Final(szUnicodePass, &ctx); if (ctohex){ tohex(szUnicodePass, szHash, 16); } else memcpy(szHash, szUnicodePass, 16); return szHash; } unsigned char * mycrypt(const unsigned char *pw, const unsigned char *salt, unsigned char *passwd){ const unsigned char *ep; if(salt[0] == '$' && salt[1] == '1' && salt[2] == '$' && (ep = (unsigned char *)strchr((char *)salt+3, '$'))) { static unsigned char *magic = (unsigned char *)"$1$"; unsigned char *p; const unsigned char *sp; unsigned char final[MD5_SIZE]; int sl,pl,i; MD5_CTX ctx,ctx1; unsigned long l; /* Refine the Salt first */ sp = salt +3; /* get the length of the true salt */ sl = ep - sp; MD5Init(&ctx); /* The password first, since that is what is most unknown */ MD5Update(&ctx,pw,strlen((char *)pw)); /* Then our magic string */ MD5Update(&ctx,magic,strlen((char *)magic)); /* Then the raw salt */ MD5Update(&ctx,sp,sl); /* Then just as many unsigned characters of the MD5(pw,salt,pw) */ MD5Init(&ctx1); MD5Update(&ctx1,pw,strlen((char *)pw)); MD5Update(&ctx1,sp,sl); MD5Update(&ctx1,pw,strlen((char *)pw)); MD5Final(final,&ctx1); for(pl = strlen((char *)pw); pl > 0; pl -= MD5_SIZE) MD5Update(&ctx,final,pl>MD5_SIZE ? MD5_SIZE : pl); /* Don't leave anything around in vm they could use. */ memset(final,0,sizeof final); /* Then something really weird... */ for (i = strlen((char *)pw); i ; i >>= 1) if(i&1) MD5Update(&ctx, final, 1); else MD5Update(&ctx, pw, 1); /* Now make the output string */ strcpy((char *)passwd,(char *)magic); strncat((char *)passwd,(char *)sp,sl); strcat((char *)passwd,"$"); MD5Final(final,&ctx); /* * and now, just to make sure things don't run too fast * On a 60 Mhz Pentium this takes 34 msec, so you would * need 30 seconds to build a 1000 entry dictionary... */ for(i=0;i<1000;i++) { MD5Init(&ctx1); if(i & 1) MD5Update(&ctx1,pw,strlen((char *)pw)); else MD5Update(&ctx1,final,MD5_SIZE); if(i % 3) MD5Update(&ctx1,sp,sl); if(i % 7) MD5Update(&ctx1,pw,strlen((char *)pw)); if(i & 1) MD5Update(&ctx1,final,MD5_SIZE); else MD5Update(&ctx1,pw,strlen((char *)pw)); MD5Final(final,&ctx1); } p = passwd + strlen((char *)passwd); l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; _crypt_to64(p,l,4); p += 4; l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; _crypt_to64(p,l,4); p += 4; l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; _crypt_to64(p,l,4); p += 4; l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; _crypt_to64(p,l,4); p += 4; l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; _crypt_to64(p,l,4); p += 4; l = final[11] ; _crypt_to64(p,l,2); p += 2; *p = '\0'; /* Don't leave anything around in vm they could use. */ memset(final,0,sizeof final); } else { *passwd = 0; } return passwd; } #ifdef WITHMAIN #include int main(int argc, char* argv[]){ unsigned char buf[1024]; unsigned i; if(argc < 2 || argc > 3) { fprintf(stderr, "usage: \n" "\t%s \n" "\t%s \n" "Performs NT crypt if no salt specified, MD5 crypt with salt\n", argv[0], argv[0]); return 1; } if(argc == 2) { printf("NT:%s\n", ntpwdhash(buf, (unsigned char *)argv[1], 1)); } else { i = strlen((char *)argv[1]); if (i > 64) argv[1][64] = 0; sprintf((char *)buf, "$1$%s$", argv[1]); printf("CR:%s\n", mycrypt((unsigned char *)argv[2], buf, buf+256)); } return 0; } #endif src/ntlm.c0100644002537100244200000000356410070040312012157 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: ntlm.c,v 1.2 2004/06/28 16:01:14 vlad Exp $ */ #include "proxy.h" struct ntlmchal { unsigned char sig[8]; unsigned char messtype[4]; unsigned char dom_len[2]; unsigned char dom_max_len[2]; unsigned char dom_offset[4]; unsigned char flags[4]; unsigned char challenge[8]; unsigned char reserved[8]; unsigned char addr_len[2]; unsigned char addr_max_len[2]; unsigned char addr_offset[4]; unsigned char data[1]; }; int text2unicode(const char * text, char * buf, int buflen){ int count = 0; buflen = ((buflen>>1)<<1); if(!text || !buflen) return 0; do { buf[count++] = toupper(*text++); buf[count++] = '\0'; } while (*text && count < buflen); return count; } void unicode2text(const char *unicode, char * buf, int len){ int i; if(!unicode || !len) return; for(i=0; isig, "NTLMSSP", 8); chal->messtype[0] = 2; gethostname(hostname, 128); hostname[15] = 0; len = (strlen(hostname) << 1); chal->dom_len[0] = len; chal->dom_max_len[0] = len; chal->dom_offset[0] = (unsigned)chal->data - (unsigned)chal; chal->flags[0] = 0x03; chal->flags[1] = 0x82; chal->flags[2] = 0x81; chal->flags[3] = 0xA0; text2unicode(hostname, chal->data, 64); time((time_t *)challenge); memcpy(challenge+4, ¶m->sinc.sin_addr.s_addr, 4); challenge[1]^=param->sinc.sin_port; srand(randomizer); randomizer = rand(); for(i = 0; i < 8; i++) challenge[i] ^= rand(); memcpy(chal->challenge, challenge, 8); en64(tmpbuf, buf, ((unsigned)chal->data - (unsigned)chal) + len); } src/pop3p.c0100644002537100244200000000423710231703443012256 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: pop3p.c,v 1.4 2005/04/21 10:57:39 vlad Exp $ */ #include "proxy.h" #define RETURN(xxx) { param->res = xxx; goto CLEANRET; } void * pop3pchild(void * data) { #define param ((struct clientparam*)data) int i=0, res; unsigned char buf[320]; unsigned char *se; if(socksend(param->clisock, "+OK Proxy\r\n", 11, conf.timeouts[STRING_S])!=11) {RETURN (611);} i = sockgetlinebuf(param, CLIENT, buf, sizeof(buf) - 10, '\n', conf.timeouts[STRING_S]); if(i<6) {RETURN(612);} buf[i] = 0; if ((se=(unsigned char *)strchr((char *)buf, '\r'))) *se = 0; if (strncasecmp((char *)buf, "USER ", 5)){RETURN (614);} if(!param->hostname && param->remsock == INVALID_SOCKET) { if(parseconnusername((char *)buf +5, param, 0, 110)){RETURN(615);} } else if(parseusername((char *)buf + 5, param, 0)) {RETURN(616);} param->operation = CONNECT; res = (*param->authfunc)(param); if(res) {RETURN(res);} i = sockgetlinebuf(param, SERVER, buf, sizeof(buf) - 1, '\n', conf.timeouts[STRING_L]); param->statssrv+=i; if( i < 3 ) {RETURN(621);} buf[i] = 0; if(strncasecmp((char *)buf, "+OK", 3)||!strncasecmp((char *)buf+4, "PROXY", 5)){RETURN(622);} if( socksend(param->remsock, "USER ", 5, conf.timeouts[STRING_S])!= 5 || socksend(param->remsock, param->extusername, strlen((char *)param->extusername), conf.timeouts[STRING_S]) <= 0 || socksend(param->remsock, "\r\n", 2, conf.timeouts[STRING_S])!=2) {RETURN(623);} param->statscli += (strlen((char *)param->extusername) + 7); RETURN (sockmap(param, 180)); CLEANRET: if(param->hostname&¶m->extusername) { sprintf(buf, "%.64s@%.128s%c%hu", param->extusername, param->hostname, (ntohs(param->sins.sin_port)==110)?0:':', ntohs(param->sins.sin_port)); (*param->logfunc)(param, buf); } else (*param->logfunc)(param, NULL); if(param->clisock != INVALID_SOCKET) { if (param->res > 611 && param->res <700) socksend(param->clisock, "-ERR\r\n", 6,conf.timeouts[STRING_S]); } freeparam(param); return (NULL); } #ifdef WITHMAIN struct proxydef childdef = { pop3pchild, 110, 0, S_POP3P }; #include "proxymain.c" #endif src/proxy.c0100644002537100244200000006144410245327177012414 0ustar vladmkgroup/* 3APA3A simpliest proxy server (c) 2002-2003 by ZARAZA <3APA3A@security.nnov.ru> please read License Agreement $Id: proxy.c,v 1.22 2005/05/25 14:00:35 vlad Exp $ */ #include "proxy.h" #define RETURN(xxx) { param->res = xxx; goto CLEANRET; } char * proxy_stringtable[] = { "HTTP/1.0 400 Bad Request\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "400 Bad Request\r\n" "

400 Bad Request

\r\n", "HTTP/1.0 502 Bad Gateway\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "502 Bad Gateway\r\n" "

502 Bad Gateway

Host Not Found or connection failed

\r\n", "HTTP/1.0 503 Service Unavailable\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "503 Service Unavailable\r\n" "

503 Service Unavailable

You have exceeded your traffic limit

\r\n", "HTTP/1.0 503 Service Unavailable\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "503 Service Unavailable\r\n" "

503 Service Unavailable

Recursion detected

\r\n", "HTTP/1.0 501 Not Implemented\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "501 Not Implemented\r\n" "

501 Not Implemented

Required action is not supported by proxy server

\r\n", "HTTP/1.0 502 Bad Gateway\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "502 Bad Gateway\r\n" "

502 Bad Gateway

Failed to connect parent proxy

\r\n", "HTTP/1.0 500 Internal Error\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "500 Internal Error\r\n" "

500 Internal Error

Internal proxy error during processing your request

\r\n", "HTTP/1.0 407 Proxy Authentication Required\r\n" "Proxy-Authenticate: Basic realm=\"proxy\"\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "407 Proxy Authentication Required\r\n" "

407 Proxy Authentication Required

Access to requested resource disallowed by administrator or you need valid username/password to use this resource

\r\n", "HTTP/1.0 200 Connection established\r\n\r\n", "HTTP/1.0 200 Connection established\r\n" "Content-Type: text/html\r\n\r\n", "HTTP/1.0 404 Not Found\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "404 Not Found\r\n" "

404 Not Found

File not found\r\n", "HTTP/1.0 403 Forbidden\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "403 Access Denied\r\n" "

403 Access Denied

Access control list denies you to access this resource\r\n", "HTTP/1.0 407 Proxy Authentication Required\r\n" "Proxy-Authenticate: basic realm=\"proxy\"\r\n" "Proxy-Authenticate: NTLM\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "407 Proxy Authentication Required\r\n" "

407 Proxy Authentication Required

Access to requested resource disallowed by administrator or you need valid username/password to use this resource

\r\n", "HTTP/1.0 407 Proxy Authentication Required\r\n" "Proxy-Connection: keep-alive\r\n" "Content-Length: 0\r\n" "Proxy-Authenticate: NTLM ", "HTTP/1.0 403 Forbidden\r\n" "Proxy-Connection: close\r\n" "Content-type: text/html; unsigned charset=us-ascii\r\n" "\r\n" "
",

};

struct datatable proxy_table = {
	STRINGTABLE,
	sizeof(proxy_stringtable)/sizeof(unsigned char *),
	(void *)proxy_stringtable
};

#define BUFSIZE 4096
#define LINESIZE 2048

void logurl(struct clientparam * param, char * req, int ftp){
 char *sb;
 char *se;
 char buf[LINESIZE];

 if(req) {
	strcpy(buf,req);
	sb = (unsigned char *)strchr((char *)buf, '\r');
	if(sb)*sb = 0;
	if(ftp && (se = strchr(buf + 10, ':')) && (sb = strchr(se, '@')) ) {
		strcpy(se, sb);
	}
 }
 if(param->res != 555)(*param->logfunc)(param, req?buf:NULL);
}

void decodeurl(unsigned char *s, int allowcr){
 unsigned char *d = s;
 unsigned u;

 while(*s){
	if(*s == '%' && ishex(s[1]) && ishex(s[2])){
		sscanf(s+1, "%2x", &u);
		if(allowcr && u != '\r')*d++ = u;
		else if (u != '\r' && u != '\n') {
			if (u == '\"' || u == '\\') *d++ = '\\';
			else if (u == 255) *d++ = 255;
			*d++ = u;
		}
		s+=3;
	}
	else if(!allowcr && *s == '?') {
		break;
	}
	else if(*s == '+') {
		*d++ = ' ';
		s++;
	}
	else {
		*d++ = *s++;
	}
 }
 *d = 0;
}

void file2url(unsigned char *sb, unsigned char *buf, unsigned bufsize, int * inbuf, int skip255){
 for(; *sb; sb++){
	if((bufsize - *inbuf)<16)break;
	if(*sb=='\r'||*sb=='\n')continue;
	if(isallowed(*sb))buf[(*inbuf)++]=*sb;
	else if(*sb == '\"'){
		memcpy(buf+*inbuf, "%5C%22", 6);
		(*inbuf)+=6;
	}
	else if(skip255 && *sb == 255 && *(sb+1) == 255) {
		memcpy(buf+*inbuf, "%ff", 3);
		(*inbuf)+=3;
		sb++;
        }
	else {
		sprintf(buf+*inbuf, "%%%.2x", (unsigned)*sb);
		(*inbuf)+=3;
	}
 }
}


void * proxychild(void * data) {
#define param ((struct clientparam*)data)
 int res=0, i=0;
 unsigned char* buf = NULL, *newbuf;
 unsigned int inbuf;
 unsigned bufsize, reqlen = 0;
 unsigned char *sb=NULL, *se=NULL, *sp=NULL, *req=NULL, *su=NULL, *ss = NULL;
 unsigned char *ftpbase=NULL;
 unsigned char username[1024];
 int keepalive = 0;
 int contentlength = -1;
 int isconnect = 0;
 int transparent = 0;
 int redirect = 0;
 int prefix = 0, ckeepalive=0;
 int ftp = 0;
 int anonymous;
 SOCKET ftps;
 SASIZETYPE sasize;



 
 if(!(buf = myalloc(BUFSIZE))) {RETURN(21);}
 bufsize = BUFSIZE;
 anonymous = param->singlepacket;
 param->singlepacket = 0;
for(;;){
 memset(buf, 0, BUFSIZE);
 inbuf = 0;
 i = sockgetlinebuf(param, CLIENT, buf, LINESIZE - 1, '\n', (keepalive)?conf.timeouts[CONNECTION_S]:conf.timeouts[STRING_S]);
 if(i<=0) {
	RETURN(keepalive? 555:509);
 }
 buf[i] = 0;
 if(req) {
	if(i<=prefix || strncasecmp((char *)buf, (char *)req, prefix)){
		ckeepalive = 0;
		if(param->remsock != INVALID_SOCKET){
			shutdown(param->remsock, SHUT_RDWR);
			closesocket(param->remsock);
		}
		param->sins.sin_addr.s_addr = 0;
		param->sins.sin_port = 0;
		param->remsock = INVALID_SOCKET;
	}
 	else if(ckeepalive && param->remsock!= INVALID_SOCKET){
		struct pollfd fds;

		fds.fd = param->remsock;
		fds.events = POLLIN;
		res = poll(&fds, 1, 0);
		if(res) {
			ckeepalive = 0;
			if(param->remsock != INVALID_SOCKET){
				shutdown(param->remsock, SHUT_RDWR);
				closesocket(param->remsock);
			}
			param->remsock = INVALID_SOCKET;
		}
	}
	myfree(req);
 }
 req = (unsigned char *)mystrdup((char *)buf);
 if(!req){RETURN(510);}
 if(i<10) {
	RETURN(511);
 }
 if(!strncasecmp((char *)buf, "CONNECT", 7))isconnect = 1;
 if ((sb=(unsigned char *)(unsigned char *)strchr((char *)buf, ' ')) == NULL) {RETURN(512);}
 ss = ++sb;
 if(!isconnect) {
	if (!strncasecmp((char *)sb, "http://", 7)) {
		sb += 7;
	}
	else if (!strncasecmp((char *)sb, "ftp://", 6)) {
		ftp = 1;
		sb += 6;
	}
	else if(*sb == '/') {
		transparent = 1;
	}
	else {
		RETURN (513);
	}
 }
 else {
	 if ((se=(unsigned char *)(unsigned char *)strchr((char *)sb, ' ')) == NULL || sb==se) {RETURN (514);}
	 *se = 0;
 }
 if(!transparent) {
	if(!isconnect) {
		if ((se=(unsigned char *)(unsigned char *)strchr((char *)sb, '/')) == NULL || sb==se) {RETURN (515);}
 		*se = 0;
	}
	prefix = se - buf;
	su = (unsigned char*)strchr((char *)sb, '@');
	if(su) parseconnusername(sb, param, 1, (ftp)? 21:80);
	else parsehostname(sb, param, (ftp)? 21:80);
	if(!isconnect){
		*se = '/';
		memcpy(ss, se, i - (se - sb) + 1);
	}
 }
 reqlen = i = strlen((char *)buf);
 if(!strncasecmp((char *)buf, "CONNECT", 7))param->operation = HTTP_CONNECT;
 else if(!strncasecmp((char *)buf, "GET", 3))param->operation = (ftp)?FTP_GET:HTTP_GET;
 else if(!strncasecmp((char *)buf, "PUT", 3))param->operation = (ftp)?FTP_PUT:HTTP_PUT;
 else if(!strncasecmp((char *)buf, "POST", 4))param->operation = HTTP_POST;
 else if(!strncasecmp((char *)buf, "HEAD", 4))param->operation = HTTP_HEAD;
 else param->operation = HTTP_OTHER;
 do {
	buf[inbuf+i]=0;
/*printf("Got: %s\n", buf+inbuf);*/
#ifndef WITHMAIN
	if(i > 25 && (!strncasecmp((char *)(buf+inbuf), "proxy-authorization", 19))){
		sb = (unsigned char *)strchr((char *)(buf+inbuf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		if(!*sb) continue;
		if(!strncasecmp((char *)sb, "basic", 5)){
			sb+=5;
			while(isspace(*sb))sb++;
			i = de64(sb, username, 255);
			if(i<=0)continue;
			username[i] = 0;
			sb = (unsigned char *)strchr((char *)username, ':');
			if(sb){
				*sb = 0;
				if(param->password)myfree(param->password);
				param->password = (unsigned char *)mystrdup((char *)sb+1);
				param->pwtype = 0;
			}
			if(param->username)myfree(param->username);
			param->username = (unsigned char *)mystrdup((char *)username);
			continue;
		}
		if(!strncasecmp((char *)sb, "ntlm", 4)){
			sb+=4;
			while(isspace(*sb))sb++;
			i = de64(sb, username, 1023);
			if(i<=16)continue;
			username[i] = 0;
			if(strncasecmp(username, "NTLMSSP", 8)) continue;
			if(username[8] == 1) {
				while( (i = sockgetlinebuf(param, CLIENT, buf, BUFSIZE - 1, '\n', conf.timeouts[STRING_S])) > 2);
				if(param->password)myfree(param->password);
				param->password = myalloc(32);
				param->pwtype = 2;
				i = strlen(proxy_stringtable[13]);
				memcpy(buf, proxy_stringtable[13], i);
				genchallenge(param, param->password, buf + i);
				memcpy(buf + strlen(buf), "\r\n\r\n", 5);
				socksend(param->clisock, buf, strlen(buf), conf.timeouts[STRING_S]);
				ckeepalive = keepalive = 1;
				goto REQUESTEND;
			}
			if(username[8] == 3 && param->pwtype == 2 && i>=80) {
				unsigned offset, len;

				len = username[20] + (((unsigned)username[21]) << 8);
				offset = username[24] + (((unsigned)username[25]) << 8);
				if(len != 24 || len + offset > (unsigned)i) continue;
				memcpy(param->password + 8, username + offset, 24);
				len = username[36] + (((unsigned)username[37]) << 8);
				offset = username[40] + (((unsigned)username[41]) << 8);
				if(len> 255 || len + offset > (unsigned)i) continue;
				if(param->username) myfree(param->username);
				unicode2text(username+offset, username+offset, (len>>1));
				param->username = mystrdup(username+offset);
			}
			continue;
		}
	}
#endif
	if(!isconnect && (
			(i> 25 && !transparent && !strncasecmp((char *)(buf+inbuf), "proxy-connection:", 17))
			||
			(i> 16 && transparent && (!strncasecmp((char *)(buf+inbuf), "connection:", 11)))
			)){
		sb = (unsigned char *)strchr((char *)(buf+inbuf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		if(!strncasecmp((char *)sb,"keep-alive", 10))keepalive = 1;
		continue; 
	}
	if(transparent && i > 6 && !strncasecmp((char *)buf + inbuf, "Host:", 5)){
		sb = (unsigned char *)strchr((char *)(buf+inbuf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		se = (unsigned char *)strchr((char *)sb, '\r');
		if(se) *se = 0;
		if(!ckeepalive){
			parsehostname(sb, param, param->reqport?ntohs(param->reqport):80);
		}
		newbuf = myalloc(strlen((char *)req) + strlen((char *)(buf+inbuf)) + 8);
		if(newbuf){
			sp = (unsigned char *)strchr((char *)req+1, '/');
			memcpy(newbuf, req, (sp - req));
			sprintf((char*)newbuf + (sp - req), "http://%s%s",sb,sp);
			myfree(req);
			req = newbuf;
		}
		if(se)*se = '\r';
	}
	if(i> 15 && (!strncasecmp((char *)(buf+inbuf), "content-length", 14))){
		sb = (unsigned char *)strchr((char *)(buf+inbuf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		contentlength = atoi((char *)sb);
		if(contentlength < 0)contentlength = 0;
	}
	inbuf += i;
	if((bufsize - inbuf) < LINESIZE){
		if (bufsize > 20000){
			RETURN (516);
		}
		if(!(newbuf = myrealloc(buf, bufsize + BUFSIZE))){RETURN (21);}
		buf = newbuf;
		bufsize += BUFSIZE;
	}
 } while( (i = sockgetlinebuf(param, CLIENT, buf + inbuf, LINESIZE - 2, '\n', conf.timeouts[STRING_S])) > 2);

 buf[inbuf] = 0;

 if((res = (*param->authfunc)(param))) {RETURN(res);}
 if (param->sins.sin_addr.s_addr == param->intip && param->sins.sin_port == param->intport) {
	RETURN(519);
 }
 sasize = sizeof(struct sockaddr_in);
 if(getpeername(param->remsock, (struct sockaddr *)¶m->sins, &sasize)){
	RETURN(520);
 }
#define FTPBUFSIZE 2048
 if(ftp && param->redirtype != R_HTTP){
	SOCKET s;
	int mode = 0;
	int i=0;
	unsigned char ftpbuf[FTPBUFSIZE];
	int inftpbuf = 0;

	if(!ckeepalive){
		inftpbuf = FTPBUFSIZE - 20;
		res = ftplogin(param, ftpbuf, &inftpbuf);
		if(res){
			if (res == 700 || res == 701){
				socksend(param->clisock, proxy_stringtable[14], strlen(proxy_stringtable[14]), conf.timeouts[STRING_S]);
				socksend(param->clisock, ftpbuf, inftpbuf, conf.timeouts[STRING_S]);
			}
			RETURN(res);
		}
	}
	ckeepalive = 1;
	if(ftpbase) myfree(ftpbase);
	ftpbase = NULL;
	if(!(sp = strchr(ss, ' '))){RETURN(799);}
	*sp = 0;

	decodeurl(ss, 0);
	i = strlen(ss);
	if(!(ftpbase = myalloc(i+2))){RETURN(21);}
	memcpy(ftpbase, ss, i);
	if(ftpbase[i-1] != '/') ftpbase[i++] = '/';
	ftpbase[i] = 0;
	memcpy(buf, "
\n", 10);
	inbuf = 10;
	if(inftpbuf) {
		memcpy(buf+inbuf, ftpbuf, inftpbuf);
		inbuf += inftpbuf;
		memcpy(buf+inbuf, "
", 4);
		inbuf += 4;
	}
	inftpbuf = FTPBUFSIZE - (20 + inftpbuf);
	res = ftpcd(param, ftpbase, ftpbuf, &inftpbuf);
	if(res){
		res = ftptype(param, "I");
		if(res)RETURN(res);
		ftpbase[--i] = 0;
		ftps = ftpcommand(param, "RETR", ftpbase);
	}
	else {
		if(inftpbuf){
			memcpy(buf+inbuf, ftpbuf, inftpbuf);
			inbuf += inftpbuf;
			memcpy(buf+inbuf, "
", 4);
			inbuf += 4;
		}
		ftps = ftpcommand(param, "LIST", NULL);
		mode = 1;
	}
	if(ftps == INVALID_SOCKET){RETURN(780);}
	if(!mode){
		socksend(param->clisock, proxy_stringtable[8], strlen(proxy_stringtable[8]), conf.timeouts[STRING_S]);
		s = param->remsock;
		param->remsock = ftps;
		res = sockmap(param, conf.timeouts[CONNECTION_L]);
		closesocket(ftps);
		param->remsock = s;
	}
	else {
		int headsent = 0;
		s = param->remsock;
		param->remsock = ftps;
		for(; (res = sockgetlinebuf(param, SERVER, ftpbuf, FTPBUFSIZE - 20, '\n', conf.timeouts[STRING_S])) > 0; i++){
			int isdir = 0;
			int islink = 0;
			int filetoken =-1;
			int sizetoken =-1;
			int modetoken =-1;
			int datetoken =-1;
			int spaces = 1;
			unsigned char * tokens[10];
			unsigned wordlen [10];
			unsigned char j=0;
			int space = 1;

			param->statssrv += res;
			ftpbuf[res] = 0;
			if(!i && ftpbuf[0] == 't' && ftpbuf[1] == 'o' && ftpbuf[2] == 't'){
				mode = 2;
				continue;
			}
			if(!isnumber(*ftpbuf) && mode == 1) mode = 2;
			for(sb=ftpbuf; *sb; sb++){
				if(!space && isspace(*sb)){
					space = 1;
					wordlen[j]=sb-tokens[j];
					j++;
				}
				if(space && !isspace(*sb)){
					space = 0;
					tokens[j] = sb;
					if(j==8)break;
				}				
			}
			if(mode == 1){
				if(j < 4) continue;
				if(!(isdir = !memcmp(tokens[2], "", wordlen[2])) && !isnumber(*tokens[2])){
					continue;
				}
				datetoken = 0;
				wordlen[datetoken] = tokens[1] - tokens[0] + wordlen[1];
				sizetoken = 2;
				filetoken = 3;
				spaces = 10;
			}
			else {
				if(j < 8 || wordlen[0]!=10) continue;
				if(j < 8 || !isnumber(*tokens[4])) mode = 3;
				if(*tokens[0] == 'd') isdir = 1;
				if(*tokens[0] == 'l') islink = 1;
				modetoken = 0;
				sizetoken = (mode == 2)? 4:3;
				filetoken = (mode == 2)? 8:7;
				datetoken = (mode == 2)? 5:4;
				tokens[filetoken] = tokens[filetoken-1];
				while(*tokens[filetoken] && !isspace(*tokens[filetoken]))tokens[filetoken]++;
				if(*tokens[filetoken]){
					tokens[filetoken]++;
				}
				wordlen[datetoken] = tokens[filetoken] - tokens[datetoken];
				wordlen[filetoken] = strlen(tokens[filetoken]);
			}

			if(modetoken >= 0) memcpy(buf+inbuf, tokens[modetoken], 11);
			else memcpy(buf+inbuf, "---------- ", 11);
			inbuf += 11;
			if(wordlen[datetoken]+256 > bufsize-inbuf) continue;
			memcpy(buf+inbuf, tokens[datetoken], wordlen[datetoken]);
			inbuf += wordlen[datetoken];
			if(isdir){
				memcpy(buf+inbuf, "       DIR", 10);
				inbuf+=10;
			}
			else if(islink){
				memcpy(buf+inbuf, "      LINK", 10);
				inbuf+=10;
			}
			else{
				unsigned k;
				if(wordlen[sizetoken]>10) wordlen[sizetoken] = 10;
				for(k=10; k > wordlen[sizetoken]; k--){
					buf[inbuf++] = ' ';
				}
				memcpy(buf+inbuf, tokens[sizetoken], wordlen[sizetoken]);
				inbuf+=wordlen[sizetoken];
			}
			memcpy(buf+inbuf, "  ");
			if(sb) sb+=4;

			else sb=tokens[filetoken]; 
			if(*sb != '/' && ftpbase)file2url(ftpbase, buf, bufsize, &inbuf, 1);
			file2url(sb, buf, bufsize, &inbuf, 0);

			if(isdir)buf[inbuf++] = '/';
			memcpy(buf+inbuf, "\">", 2);
			inbuf+=2;
			for(sb=tokens[filetoken]; *sb; sb++){
				if((bufsize - inbuf)<16)break;
				if(*sb == '<'){
					memcpy(buf+inbuf, "<", 4);
					inbuf+=4;
				}
				else if(*sb == '>'){
					memcpy(buf+inbuf, ">", 4);
					inbuf+=4;
				}
				else if(*sb == '\r' || *sb=='\n'){
					continue;
				}
				else if(islink && sb[0] == ' ' && sb[1] == '-' 
				 && sb[2] == '>'){
					memcpy(buf+inbuf, " ", 5);
					inbuf+=5;
				}
				else buf[inbuf++]=*sb;
			}
			if(islink!=2)memcpy(buf+inbuf, "", 4);
			inbuf+=4;
			buf[inbuf++] = '\n';

			if((bufsize - inbuf) < LINESIZE){
				if (bufsize > 20000){
					if(!headsent++){
						socksend(param->clisock, proxy_stringtable[9], strlen(proxy_stringtable[9]), conf.timeouts[STRING_S]);
					}
					if((unsigned)socksend(param->clisock, buf, inbuf, conf.timeouts[STRING_S]) != inbuf){
						RETURN(781);
					}
					inbuf = 0;
				}
				else {
					if(!(newbuf = myrealloc(buf, bufsize + BUFSIZE))){RETURN (21);}
					buf = newbuf;
					bufsize += BUFSIZE;
				}
			}
		}
		closesocket(ftps);
		param->remsock = s;
		if(inbuf){
			if(!headsent){
				sprintf(ftpbuf, 
					"HTTP/1.0 200 OK\r\n"
					"Content-Type: text/html\r\n"
					"Proxy-Connection: keep-alive\r\n"
					"Content-Length: %d\r\n\r\n",
					inbuf);
				socksend(param->clisock, ftpbuf, strlen(ftpbuf), conf.timeouts[STRING_S]);
			}
			socksend(param->clisock, buf, inbuf, conf.timeouts[STRING_S]);
			res = ftpres(param);
			if(res){RETURN(res);}
			if(!headsent)goto REQUESTEND;
		}
		RETURN(0);
	}
	RETURN(res);
 }

 if(isconnect) {
	socksend(param->clisock, proxy_stringtable[8], strlen(proxy_stringtable[8]), conf.timeouts[STRING_S]);
	RETURN(sockmap(param, conf.timeouts[CONNECTION_L]));
 }

 if(!req || param->redirtype != R_HTTP) {
	reqlen = 0;
 }

 else {
	 redirect = 1;
	 if(socksend(param->remsock, req , (res = strlen((char *)req)), conf.timeouts[STRING_S]) != res) {RETURN(518);}
	 param->statscli += res;
 }
 inbuf = 0;
#ifndef ANONYMOUS
 if(anonymous){
		sprintf((char*)buf+strlen((char *)buf), "Via: 1.1 ");
		gethostname((char *)(buf+strlen((char *)buf)), 256);
		sprintf((char*)buf+strlen((char *)buf), ":%d (%s %s)\r\nX-Forwarded-For: ", (int)ntohs(param->intport), stringtable?stringtable[2]:(unsigned char *)"", stringtable?stringtable[3]:(unsigned char *)"");
		myinet_ntoa(param->sinc.sin_addr, buf + strlen(buf));
		sprintf((char*)buf+strlen((char *)buf), "\r\n");
 }
#endif
 if(keepalive)sprintf((char*)buf+strlen((char *)buf), "%s: Keep-Alive\r\n", (redirect)?"Proxy-Connection":"Connection");
 if(param->extusername){
	sprintf((char*)buf + strlen((char *)buf), "%s: basic ", (redirect)?"Proxy-Authorization":"Authorization");
	sprintf((char*)username, "%.32s:%.64s", param->extusername, param->extpassword?param->extpassword:(unsigned char*)"");
	en64(username, buf+strlen((char *)buf), strlen((char *)username));
	sprintf((char*)buf + strlen((char *)buf), "\r\n");
 }
 sprintf((char*)buf+strlen((char *)buf), "\r\n");
 if ((res = socksend(param->remsock, buf+reqlen, strlen((char *)buf+reqlen), conf.timeouts[STRING_S])) != (int)strlen((char *)buf+reqlen)) {
	RETURN(518);
 }
 param->statscli += res;
/*
 if(!keepalive || isconnect){
	RETURN (sockmap(param, conf.timeouts[CONNECTION_S]));
 }
*/
 if(contentlength > 0){
	 param->waitclient = contentlength;
	 res = sockmap(param, conf.timeouts[CONNECTION_S]);
	 param->waitclient = 0;
	 if(res != 99) {
		RETURN(res);
	}
 }
 contentlength = -1;
 inbuf = 0;
 ckeepalive = 1;
 res = 0; 
 while( (i = sockgetlinebuf(param, SERVER, buf + inbuf, LINESIZE - 1, '\n', conf.timeouts[(res)?STRING_S:STRING_L])) > 2) {
	if(!res && i>9)res = atoi(buf + inbuf + 9);
	if(((i> 25 && redirect && !strncasecmp((char *)(buf+inbuf), "proxy-connection:", 17))
	   ||
	    (i> 16 && !redirect && !strncasecmp((char *)(buf+inbuf), "connection:", 11))
			)){
		sb = (unsigned char *)strchr((char *)(buf+inbuf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		if(!strncasecmp((char *)sb,"keep-alive", 10))ckeepalive = 1;
		else ckeepalive = 0;
		continue; 
	}
	if(i> 6 && (!strncasecmp((char *)(buf+inbuf), "proxy-", 6))){
		continue; 
	}
	if(i > 15 && (!strncasecmp((char *)(buf+inbuf), "content-length", 14))){
		buf[inbuf+i]=0;
		sb = (unsigned char *)strchr((char *)(buf+inbuf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		contentlength = atoi((char *)sb);
		if(contentlength < 0)contentlength = 0;
		if(param->maxtraf && (param->maxtraf < param->statssrv || (unsigned)contentlength > param->maxtraf - param->statssrv)){
			RETURN(10);
		}
	}
	inbuf += i;
	if((bufsize - inbuf) < LINESIZE){
		if (bufsize > 20000){
			RETURN (516);
		}
		if(!(newbuf = myrealloc(buf, bufsize + BUFSIZE))){RETURN (21);}
		buf = newbuf;
		bufsize += BUFSIZE;
	}
 }
 if(res < 200 || res > 499) {
	ckeepalive = 0;
 }
 param->statssrv += inbuf;
 buf[inbuf] = 0;
 if(inbuf < 9) {RETURN (520);}
 sprintf((char*)buf+strlen((char *)buf), "%s: %s\r\n", 
	(transparent)?"Connection":"Proxy-Connection",
	(contentlength >= 0 && ckeepalive)?"Keep-Alive":"Close"
 );
 sprintf((char*)buf + strlen((char *)buf), "\r\n");
 if(socksend(param->clisock, buf, strlen((char *)buf), conf.timeouts[STRING_S]) != (int)strlen((char *)buf)) {RETURN(518);}
 if(contentlength > 0 && param->operation != HTTP_HEAD && res != 204 && res != 304) {
	 param->waitserver = contentlength;
	 res = sockmap(param, conf.timeouts[CONNECTION_S]);
	 param->waitserver = 0;
	 if(res != 98) {
		RETURN(res);
	 }
 }
 else if(contentlength < 0) {
	RETURN(sockmap(param, conf.timeouts[CONNECTION_S]));
 }
 contentlength = -1;

REQUESTEND:

 if((!ckeepalive || !keepalive) && param->remsock != INVALID_SOCKET){
	shutdown(param->remsock, SHUT_RDWR);
	closesocket(param->remsock);
	param->remsock = INVALID_SOCKET;
	RETURN(0);
 }
 logurl(param, req, ftp);
}

CLEANRET:

 if(param->res != 555 && param->res && param->clisock != INVALID_SOCKET && (param->res < 90 || param->res >=800 || param->res == 100 ||(param->res > 701 && param->res< 800))) {
	if((param->res>=510 && param->res <=517) || param->res > 900) while( (i = sockgetlinebuf(param, CLIENT, buf, BUFSIZE - 1, '\n', conf.timeouts[STRING_S])) > 2);
	if(param->res == 10) {
		socksend(param->clisock, proxy_stringtable[2], strlen(proxy_stringtable[2]), conf.timeouts[STRING_S]);
	}
	else if(param->res == 100 || (param->res >10 && param->res < 20) || (param->res >701 && param->res <= 705)) {
		socksend(param->clisock, proxy_stringtable[1], strlen(proxy_stringtable[1]), conf.timeouts[STRING_S]);
	}
	else if(param->res >=20 && param->res < 30) {
		socksend(param->clisock, proxy_stringtable[6], strlen(proxy_stringtable[6]), conf.timeouts[STRING_S]);
	}
	else if(param->res >=30 && param->res < 80) {
		socksend(param->clisock, proxy_stringtable[5], strlen(proxy_stringtable[5]), conf.timeouts[STRING_S]);
	}
	else if(param->res == 1) {
		socksend(param->clisock, proxy_stringtable[11], strlen(proxy_stringtable[11]), conf.timeouts[STRING_S]);
	}
	else if(param->res < 10) {
		socksend(param->clisock, proxy_stringtable[param->usentlm?12:7], strlen(proxy_stringtable[param->usentlm?12:7]), conf.timeouts[STRING_S]);
	}
	else if(param->res == 999) {
		socksend(param->clisock, proxy_stringtable[4], strlen(proxy_stringtable[4]), conf.timeouts[STRING_S]);
	}
	else if(param->res == 519) {
		socksend(param->clisock, proxy_stringtable[3], strlen(proxy_stringtable[3]), conf.timeouts[STRING_S]);
	}
	else if(param->res == 780) {
		socksend(param->clisock, proxy_stringtable[10], strlen(proxy_stringtable[10]), conf.timeouts[STRING_S]);
	}
	else {
		socksend(param->clisock, proxy_stringtable[0], strlen(proxy_stringtable[0]), conf.timeouts[STRING_S]);
	}
 } 
 logurl(param, req, ftp);
 if(req)myfree(req);
 if(buf)myfree(buf);
 if(ftpbase)myfree(ftpbase);
 freeparam(param);
 return (NULL);
}

#ifdef WITHMAIN
struct proxydef childdef = {
	proxychild,
	3128,
	0,
	S_PROXY,
	"-a - anonymous proxy\r\n"
};
#include "proxymain.c"
#endif
src/proxymain.c0100644002537100244200000002352210245102403013233 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: proxymain.c,v 1.30 2005/05/25 14:00:35 vlad Exp $
*/

#include "proxy.h"
#ifndef MODULEMAINFUNC
#define MODULEMAINFUNC main
#define STDMAIN
#else
 extern int linenum;
 extern int haveerror;
#endif

int MODULEMAINFUNC (int argc, char** argv){

 SOCKET sock = INVALID_SOCKET;
 int i=0, isset;
 SASIZETYPE size;
 pthread_t thread;
 struct clientparam defparam;
 int demon=0;
 struct clientparam * newparam;
 char *s;
 int error = 0;
 unsigned sleeptime;
 struct extparam myconf;
 unsigned char buf[256];
 struct pollfd fds;
 int opt = 1;
 PROXYFUNC pf;
 FILE *fp = NULL;
 int maxchild;
 int silent = 0;
 int nlog = 5000;
 char loghelp[] =
#ifdef STDMAIN
	" -d go to background (daemon)\n"
#endif
	" -fFORMAT logging format (see documentation)\n"
	" -l log to stderr\n"
	" -lFILENAME log to FILENAME\n"
#ifndef _WIN32
	" -l@IDENT log to syslog IDENT\n"
#endif
	" -t be silenT (do not log service start/stop)\n"
	" -iIP ip address or internal interface (clients are expected to connect)\n"
	" -eIP ip address or external interface (outgoing connection will have this)\n";

 int childcount=0;
 pthread_mutex_t counter_mutex;


#ifndef UDP
 int new_sock = INVALID_SOCKET;
 struct linger lg;
#ifdef _WIN32
 unsigned long ul;
#endif
#endif
#ifdef _WIN32
 HANDLE h;
#endif
#ifdef STDMAIN
#ifdef _WIN32
 WSADATA wd;
 WSAStartup(MAKEWORD( 1, 1 ), &wd);
#else
 signal(SIGPIPE, SIG_IGN);

 pthread_attr_init(&pa);
 pthread_attr_setstacksize(&pa,PTHREAD_STACK_MIN + 16384);
 pthread_attr_setdetachstate(&pa,PTHREAD_CREATE_DETACHED);
#endif
#endif


 pf = childdef.pf;
 memcpy(&myconf, &conf, sizeof(myconf));
 memset(&defparam, 0, sizeof(struct clientparam));
 defparam.version = paused;
 defparam.childcount = &childcount;
 defparam.logfunc = myconf.logfunc;
 defparam.authfunc = myconf.authfunc;
 defparam.aclnum = myconf.aclnum;
 defparam.service = childdef.service;
 defparam.usentlm = 1;
 defparam.stdlog = NULL;
 defparam.time_start = time(NULL);
 maxchild = myconf.maxchild;

#ifndef STDMAIN
 if(!conf.services){
	conf.services = &defparam;
 }
 else {
	defparam.next = conf.services;
	conf.services = conf.services->prev = &defparam;
 }
#endif

 pthread_mutex_init(defparam.counter_mutex = &counter_mutex, NULL);

 for (i=1; i] "
			"  \n"
			"Available options are:\n"
			"%s"
			"%s"
			"\tExample: %s -d -i127.0.0.1 6666 serv.somehost.ru 6666\n\n"
			"%s", 
			argv[0], loghelp, childdef.helpmessage, argv[0],
#ifdef STDMAIN
			copyright
#else
			""
#endif
		);
		return (1);
	}
	defparam.target = (unsigned char *)mystrdup(argv[i+1]);
#endif
#ifndef STDMAIN
 }
#endif
 if(!defparam.logformat){
	defparam.logformat = myconf.logformat;
 }
 if(defparam.logformat){
	if(*defparam.logformat == '-' && (s = strchr(defparam.logformat + 1, '+')) && s[1]){
		*s = 0;
		defparam.nonprintable = mystrdup(defparam.logformat + 1);
		defparam.replace = s[1];
		defparam.logformat = mystrdup(s + 2);
		*s = '+';
	}
	else defparam.logformat = mystrdup(defparam.logformat);
 }
 defparam.sinc.sin_addr.s_addr = defparam.intip = myconf.intip;
 if(!myconf.intport)myconf.intport = childdef.port;
 defparam.sinc.sin_port = defparam.intport = htons(myconf.intport);
 defparam.sins.sin_addr.s_addr = defparam.extip = myconf.extip;
 defparam.sins.sin_port = defparam.extport = htons(myconf.extport);
 defparam.remsock = defparam.clisock = defparam.ctrlsock = INVALID_SOCKET;
 defparam.sins.sin_family = defparam.sinc.sin_family = AF_INET;
 defparam.singlepacket = myconf.singlepacket;
#ifndef STDMAIN
 conf.threadinit = 0;
#endif

#ifndef UDP
 lg.l_onoff = 1;
 lg.l_linger = 10;
 if( (sock=socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {
#else
 if( (sock=socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) { 
#endif
	perror("socket()");
	return -2;
 }
 defparam.srvsock = sock;
 if(setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (unsigned char *)&opt, sizeof(int)))perror("setsockopt()");

 size = sizeof(defparam.sinc);
 for(sleeptime = SLEEPTIME * 100; bind(sock, (struct sockaddr*)&defparam.sinc, size)==-1; usleep(sleeptime)) {
	sprintf((char *)buf, "bind(): %s", strerror(errno));
	(*defparam.logfunc)(&defparam, buf);	
	sleeptime = (sleeptime<<1);	
	if(!sleeptime) {
		closesocket(sock);
		return -3;
	}
 }
#ifndef UDP
 if(listen (sock, 1 + (maxchild>>4))==-1) {
	sprintf((char *)buf, "listen(): %s", strerror(errno));
	(*defparam.logfunc)(&defparam, buf);
	return -4;
 }
#else
 defparam.srvfds = &fds;
 defparam.clisock = sock;
#endif

 defparam.threadid = (unsigned)pthread_self();
 if(!silent){
	sprintf((char *)buf, "Accepting connections [%u/%u]", (unsigned)getpid(), (unsigned)pthread_self());
	(*defparam.logfunc)(&defparam, buf);
 }
 defparam.sinc.sin_addr.s_addr = defparam.sins.sin_addr.s_addr = 0;
 defparam.sinc.sin_port = defparam.sins.sin_port = 0;

 fds.fd = sock;
 fds.events = POLLIN;
 

 for (;;) {
	for(;;){
		while((paused == defparam.version && childcount >= myconf.maxchild)){
			nlog++;			
			if(nlog > 5000) {
				sprintf((char *)buf, "Warning: too many connected clients (%d/%d)", childcount, myconf.maxchild);
				(*defparam.logfunc)(&defparam, buf);
				nlog = 0;
			}
			usleep(SLEEPTIME);
		}
		if (paused != defparam.version) break;
		isset = (fds.events & POLLIN);
		if (isset) {
			error = poll(&fds, 1, 1000);
		}
		else {
			usleep(SLEEPTIME);
			continue;
		}
		if(isset) fds.events = POLLIN;
		if (error >= 1) break;
		if (error == 0) continue;
		sprintf((char *)buf, "poll(): %s/%d", strerror(errno), errno);
		(*defparam.logfunc)(&defparam, buf);
		if(errno != EAGAIN) break;
		continue;
	}
	if(paused != defparam.version) break;
#ifndef UDP
	size = sizeof(defparam.sinc);
	new_sock = accept(sock, (struct sockaddr*)&defparam.sinc, &size);
	if(new_sock == INVALID_SOCKET){
		sprintf((char *)buf, "accept(): %s", strerror(errno));
		(*defparam.logfunc)(&defparam, buf);
		continue;
	}
#ifdef _WIN32
	ioctlsocket(new_sock, FIONBIO, &ul);
#else
	fcntl(new_sock,F_SETFL,O_NONBLOCK);
#endif

	setsockopt(new_sock, SOL_SOCKET, SO_LINGER, (unsigned char *)&lg, sizeof(lg));
	setsockopt(new_sock, SOL_SOCKET, SO_OOBINLINE, (unsigned char *)&opt, sizeof(int));
#else

	fds.events = 0;
#endif
	if(! (newparam = myalloc (sizeof(defparam)))){
#ifndef UDP
		closesocket(new_sock);
#endif
		defparam.res = 21;
		(*defparam.logfunc)(&defparam, (unsigned char *)"Memory Allocation Failed");
		usleep(SLEEPTIME);
		continue;
	};
	memcpy(newparam, &defparam, sizeof(defparam));
	clearstat(newparam);
#ifndef UDP
	newparam->clisock = new_sock;
#endif
	newparam->child = newparam->prev = newparam->next = NULL;
	newparam->parent = &defparam;
	pthread_mutex_lock(&counter_mutex);
	if(!defparam.child)defparam.child = newparam;
	else {
		newparam->next = defparam.child;
		defparam.child = defparam.child->prev = newparam;
	}
#ifdef _WIN32
	h = CreateThread((LPSECURITY_ATTRIBUTES )NULL, 16384, (LPTHREAD_START_ROUTINE)pf, (void *) newparam, (DWORD)0, &thread);
	newparam->threadid = (unsigned)thread;
	if (h) {
		childcount++;
		CloseHandle(h);
	}
	else {
		myfree(newparam);
	}
#else
	if((error = pthread_create(&thread, &pa, pf, (void *)newparam))){
		sprintf((char *)buf, "pthread_create(): %s", strerror(error));
		(*defparam.logfunc)(&defparam, buf);
		freeparam(newparam);
	}
	else {
		childcount++;
		newparam->threadid = (unsigned)thread;
	}
#endif
	pthread_mutex_unlock(&counter_mutex);
	memset(&defparam.sinc, 0, sizeof(defparam.sinc));
#ifdef UDP
	while(!fds.events)usleep(SLEEPTIME);
#endif
 }
 if(defparam.srvsock != INVALID_SOCKET) closesocket(defparam.srvsock);
 if(!silent) defparam.logfunc(&defparam, "Exiting thread");
 defparam.service = S_ZOMBIE;
 while(defparam.child) usleep(SLEEPTIME * 100);
 defparam.threadid = 0;
 if(fp) fclose(fp);
 if(defparam.target) myfree(defparam.target);
 if(defparam.logtarget) myfree(defparam.logtarget);
 if(defparam.logformat) myfree(defparam.logformat);
 if(defparam.nonprintable) myfree(defparam.nonprintable);
#ifndef STDMAIN
 if(defparam.next)defparam.next->prev = defparam.prev;
 if(defparam.prev)defparam.prev->next = defparam.next;
 else conf.services = defparam.next;
#endif
 pthread_mutex_destroy(&counter_mutex);
 return 0;
}
src/sockgetchar.c0100644002537100244200000000606010243112546013507 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement
*/

#include "proxy.h"
#define BUFSIZE ((param->service == S_UDPPM)?UDPBUFSIZE:TCPBUFSIZE)


int socksend(SOCKET sock, unsigned char * buf, int bufsize, int to){
 int sent = 0;
 int res;
 struct pollfd fds;

 fds.fd = sock;
 fds.events = POLLOUT;
 do {
	res = poll(&fds, 1, to*1000);
	if(res < 1) break;
	res = send(sock, buf + sent, bufsize - sent, 0);
	if(res < 0) {
		if(errno !=  EAGAIN) break;
		continue;
	}
	sent += res;
 } while (sent < bufsize);
 return sent;
}

int socksendto(SOCKET sock, struct sockaddr_in * sin, unsigned char * buf, int bufsize, int to){
 int sent = 0;
 int res;
 struct pollfd fds;

 fds.fd = sock;
 fds.events = POLLOUT;
 do {
	res = poll(&fds, 1, to);
	if(res < 1) break;
	res = sendto(sock, buf + sent, bufsize - sent, 0,  (struct sockaddr *)sin, sizeof(struct sockaddr_in));
	if(res < 0) {
		if(errno !=  EAGAIN) break;
		continue;
	}
	sent += res;
 } while (sent < bufsize);
 return sent;
}

int sockrecvfrom(SOCKET sock, struct sockaddr_in * sin, unsigned char * buf, int bufsize, int to){
	struct pollfd fds;
	SASIZETYPE sasize;
	int res;

	fds.fd = sock;
	fds.events = POLLIN;
	if (poll(&fds, 1, to)<1) return 0;
	sasize = sizeof(struct sockaddr_in);
	do {
		res = recvfrom(sock, buf, bufsize, 0, (struct sockaddr *)sin, &sasize);
	} while (res < 0 && errno == EAGAIN);
	return res;
}

int sockgetcharcli(struct clientparam * param, int timeosec, int timeousec){
	int len;

	if(!param->clibuf){
		if(!(param->clibuf = myalloc(BUFSIZE))) return 0;
		param->clibufsize = BUFSIZE;
		param->clioffset = param->cliinbuf = 0;
	}
	if(param->cliinbuf && param->clioffset < param->cliinbuf){
		return (int)param->clibuf[param->clioffset++];
	}
	param->clioffset = 0;
	if ((len = sockrecvfrom(param->clisock, ¶m->sinc, param->clibuf, param->clibufsize, timeosec*1000 + timeousec))<=0) return EOF;
	param->cliinbuf = len;
	param->clioffset = 1;
	return (int)*param->clibuf;
}

int sockgetcharsrv(struct clientparam * param, int timeosec, int timeousec){
	int len;

	if(!param->srvbuf){
		if(!(param->srvbuf = myalloc(BUFSIZE))) return 0;
		param->srvbufsize = BUFSIZE;
		param->srvoffset = param->srvinbuf = 0;
	}
	if(param->srvinbuf && param->srvoffset < param->srvinbuf){
		return (int)param->srvbuf[param->srvoffset++];
	}
	param->srvoffset = 0;
	if ((len = sockrecvfrom(param->remsock, ¶m->sins, param->srvbuf, param->srvbufsize, timeosec*1000 + timeousec))<=0) return EOF;
	param->srvinbuf = len;
	param->srvoffset = 1;
	return (int)*param->srvbuf;
}

int sockgetlinebuf(struct clientparam * param, DIRECTION which, unsigned char * buf, int bufsize, int delim, int to){
 int c;
 int i=0, tos, tou;
 if(bufsize<2) return 0;
 c = (which)?sockgetcharsrv(param, to, 0):sockgetcharcli(param, to, 0);
 if (c == EOF) {
	return 0;
 }
 tos = to/16;
 tou = ((to * 1000) / bufsize)%1000;
 do {
	buf[i++] = c;
	if(delim != EOF && c == delim) break;
 }while(i < bufsize && (c = (which)?sockgetcharsrv(param, to, 0):sockgetcharcli(param, to, 0)) != EOF);
 return i;
}

src/sockmap.c0100644002537100244200000001006110243361677012656 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: sockmap.c,v 1.18 2005/05/20 13:18:55 vlad Exp $
*/

#include "proxy.h"

#define BUFSIZE ((param->service == S_UDPPM)?UDPBUFSIZE:TCPBUFSIZE)


int sockmap(struct clientparam * param, int timeo){
 int res=0, sent=0, received=0;
 SASIZETYPE sasize;
 struct pollfd fds[2];
 int sleeptime = 0, stop = 0;

 fds[0].fd = param->clisock;
 fds[1].fd = param->remsock;

 if(!param->waitclient){
	if(!param->srvbuf && (!(param->srvbuf=myalloc(BUFSIZE)) || !(param->srvbufsize = BUFSIZE))){
		return (21);
	}
 }
 if(!param->waitserver){
	if(!param->clibuf && (!(param->clibuf=myalloc(BUFSIZE)) || !(param->clibufsize = BUFSIZE))){
		return (21);
	}
 }

 for (;!stop;){
	sasize = sizeof(struct sockaddr_in);
	if(param->maxtraf && param->statssrv >= param->maxtraf){
		return (90);
	}
	fds[0].events = fds[1].events = 0;
	if(param->srvinbuf > param->srvoffset && !param->waitclient) {
		fds[0].events |= POLLOUT;
	}
	if(param->srvinbuf < param->srvbufsize && !param->waitclient) {
		fds[1].events |= POLLIN;
	}

	if(param->cliinbuf > param->clioffset && !param->singlepacket && !param->waitserver) {
		fds[1].events |= POLLOUT;
	}
    	if(param->cliinbuf < param->clibufsize && !param->singlepacket && !param->waitserver) {
		fds[0].events |= POLLIN;
	}
	if((res = poll(fds, 2, timeo*1000)) < 1){
		return res?91:92;
	}
	if((fds[0].revents & POLLOUT)){
		if(param->bandlimfunc) {
			sleeptime = (*param->bandlimfunc)(param, param->srvinbuf - param->srvoffset);
		}
		res = sendto(param->clisock, param->srvbuf + param->srvoffset, param->srvinbuf - param->srvoffset, 0, (struct sockaddr*)¶m->sinc, sasize);
		if(res < 0) {
			if(errno != EAGAIN) return 96;
			continue;
		}
		param->srvoffset += res;
		param->statssrv += res;
		received += res;
		if(param->srvoffset == param->srvinbuf) param->srvoffset = param->srvinbuf = 0;
		if(param->waitserver && param->waitserver<= received){
			return (98);
		}
	}
	if((fds[1].revents & POLLOUT)){
		res = sendto(param->remsock, param->clibuf + param->clioffset, param->cliinbuf - param->clioffset, 0, (struct sockaddr*)¶m->sins, sasize);
		if(res < 0) {
			if(errno != EAGAIN) return 97;
			continue;
		}
		param->clioffset += res;
		sent += res;
		param->statscli += res;
		if(param->clioffset == param->cliinbuf) param->clioffset = param->cliinbuf = 0;
		if(param->waitclient && param->waitclient<= sent) {
			return (99);
		}
	}
	if ((fds[0].revents & POLLIN)) {
		res = recvfrom(param->clisock, param->clibuf + param->cliinbuf, param->clibufsize - param->cliinbuf, 0, (struct sockaddr *)¶m->sinc, &sasize);
		if (res==0) {
			shutdown(param->clisock, SHUT_RDWR);
			closesocket(param->clisock);
			fds[0].fd = param->clisock = INVALID_SOCKET;
			stop = 1;
		}
		else {
			if (res < 0 && errno != EAGAIN) {
				return (94);
			}
			param->cliinbuf += res;
		}
	}
	if (!stop && (fds[1].revents & POLLIN)) {
		res = recvfrom(param->remsock, param->srvbuf + param->srvinbuf, param->srvbufsize - param->srvinbuf, 0, NULL, &sasize);
		if (res==0) {
			shutdown(param->remsock, SHUT_RDWR);
			closesocket(param->remsock);
			fds[1].fd = param->remsock = INVALID_SOCKET;
			stop = 1;
		}
		else {
			if (res < 0 && errno != EAGAIN) {
				return (93);
			}
			param->srvinbuf += res;
		}
	}
	if(sleeptime > 0) {
		if(sleeptime > (timeo * 1000)){return (95);}
		usleep(sleeptime * SLEEPTIME);
		sleeptime = 0;
	}
 }
 if(param->srvinbuf > param->srvoffset && fds[1].fd != INVALID_SOCKET){
	res = socksend(fds[1].fd, param->srvbuf + param->srvoffset, param->srvinbuf - param->srvoffset, conf.timeouts[STRING_S]);
	if(res > 0){
		param->srvoffset += res;
		if(param->srvoffset == param->srvinbuf) param->srvoffset = param->srvinbuf = 0;
	}
 } 
 if(param->cliinbuf > param->clioffset && fds[0].fd != INVALID_SOCKET){
	res = socksend(fds[0].fd, param->clibuf + param->clioffset, param->cliinbuf - param->clioffset, conf.timeouts[STRING_S]);
	if(res > 0){
		param->clioffset += res;
		if(param->cliinbuf == param->clioffset) param->cliinbuf = param->clioffset = 0;
	}
 } 
 return 0;
}
src/socks.c0100644002537100244200000003021310243615777012347 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: socks.c,v 1.15 2005/05/21 11:31:11 vlad Exp $
*/

#include "proxy.h"

#define RETURN(xxx) { param->res = xxx; goto CLEANRET; }

unsigned char * commands[] = {(unsigned char *)"UNKNOWN", (unsigned char *)"CONNECT", (unsigned char *)"BIND", (unsigned char *)"UDPMAP"};

struct datatable socks_table = {
	STRINGTABLE,
	sizeof(commands)/sizeof(unsigned char *),
	(void *)commands
};

#define BUFSIZE 1024
#define LARGEBUFSIZE 67000

void * sockschild(void * data) {
#define param ((struct clientparam*)data)
 int res;
 unsigned i=0;
 SOCKET s;
 unsigned size;
 SASIZETYPE sasize;
 unsigned char * buf=NULL;
 unsigned char c;
 unsigned char command=0;
 struct in_addr reqaddr;
 struct pollfd fds[3];
 int ver=0;
 int havepass = 0;
 struct sockaddr_in sin;
 int len;


 reqaddr.s_addr = 0;
 param->service = S_SOCKS;

 if(!(buf = myalloc(BUFSIZE))) {RETURN(21);}
 memset(buf, 0, BUFSIZE);
 if ((ver = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_L], 0)) != 5 && ver != 4) {
	RETURN(401);
 } /* version */
 param->service = ver;
 if(ver == 5){
	 if ((i = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);} /* nmethods */
	 for (; i; i--) {
		if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
		if (res == 2) {
			havepass = res;
		}
	 }
	 buf[0] = 5;
	 buf[1] = havepass;
	 if(socksend(param->clisock, buf, 2, conf.timeouts[STRING_S])!=2){RETURN(402);}
	 if (havepass) {
		if (((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_L], 0))) != 1) {
			RETURN(412);
		}
		if ((i = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
		if (i && (unsigned)(res = sockgetlinebuf(param, CLIENT, buf, i, 0, conf.timeouts[STRING_S])) != i){RETURN(411);};
		buf[i] = 0;
		if(!param->username)param->username = (unsigned char *)mystrdup((char *)buf);
		if ((i = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
		if (i && (unsigned)(res = sockgetlinebuf(param, CLIENT, buf, i, 0, conf.timeouts[STRING_S])) != i){RETURN(411);};
		buf[i] = 0;
		if(!param->password)param->password = (unsigned char *)mystrdup((char *)buf);
		buf[0] = 1;
		buf[1] = 0;
		if(socksend(param->clisock, buf, 2, conf.timeouts[STRING_S])!=2){RETURN(402);}
	 }
	 if ((c = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_L], 0)) != 5) {
		RETURN(421);
         } /* version */
 }
 if( (command = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) < 1 || command > 3){command = 0; RETURN(407);} /* command */
 if(ver == 5){
	 if (sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0) == EOF) {RETURN(411);} /* reserved */
	 c = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0); /* atype */
 }
 else {
	if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
	buf[0] = (unsigned char) res;
	if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
	buf[1] = (unsigned char) res;
	param->sins.sin_port = param->reqport = *(unsigned short*)buf;
	c = 1;
 }
 
 switch(c) {
	case 1:
		for (i = 0; i<4; i++){
			if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
			buf[i] = (unsigned char)res;
		}
		param->sins.sin_addr.s_addr = reqaddr.s_addr = *(unsigned long *)buf;
		if(command==1 && !reqaddr.s_addr) {
			RETURN(422);
		}
		myinet_ntoa(param->sins.sin_addr, buf);
		break;
	case 3:
		if ((size = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);} /* nmethods */
		for (i=0; istatscli++){ /* size < 256 */
			if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
			buf[i] = (unsigned char)res;
		}
		buf[i] = 0;
		param->sins.sin_addr.s_addr = reqaddr.s_addr = getip(buf);
		if(command==1 && !reqaddr.s_addr) {
			RETURN(423);
		}
		break;
	default:
		RETURN(998);
 }
 if(param->hostname)myfree(param->hostname);
 param->hostname = mystrdup(buf);
 if (ver == 5) {
	 if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
	 buf[0] = (unsigned char) res;
	 if ((res = sockgetcharcli(param, conf.timeouts[SINGLEBYTE_S], 0)) == EOF) {RETURN(411);}
	 buf[1] = (unsigned char) res;
	 param->sins.sin_port = param->reqport = *(unsigned short*)buf;
 }
 else {
	sockgetlinebuf(param, CLIENT, buf, BUFSIZE - 1, 0, conf.timeouts[STRING_S]);
	buf[127] = 0;
	if(*buf && !param->username)param->username = (unsigned char *)mystrdup((char *)buf);
	if(param->sins.sin_addr.s_addr && ntohl(param->sins.sin_addr.s_addr)<256){
		param->service = S_SOCKS45;
		sockgetlinebuf(param, CLIENT, buf, BUFSIZE - 1, 0, conf.timeouts[STRING_S]);
		buf[127] = 0;
		if(param->hostname)myfree(param->hostname);
		param->hostname = mystrdup(buf);
	}
 }
 if(command == 1 && !param->reqport) {RETURN(424);}
 param->sins.sin_family = AF_INET;
 switch(command) { 
	case 1:
	 param->operation = CONNECT;
	 break;
 	case 2:
	 param->sins.sin_addr.s_addr = param->extip;
	 param->sins.sin_port = param->extport?param->extport:param->sinc.sin_port;
	 if ((param->remsock=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == INVALID_SOCKET) {RETURN (11);}
	 param->operation = BIND;
	 break;
	case 3:
	 param->sins.sin_port = param->extport?param->extport:param->reqport;
	 param->sins.sin_addr.s_addr = param->extip;
	 if ((param->remsock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) {RETURN (11);}
	 param->operation = UDPASSOC;
	 break;
	default:
	 RETURN(997);
 }

 if((res = (*param->authfunc)(param))) {RETURN(res);}

 if(command > 1) {
	if(bind(param->remsock,(struct sockaddr *)¶m->sins,sizeof(param->sins))) {
		param->sins.sin_port = 0;
		if(bind(param->remsock,(struct sockaddr *)¶m->sins,sizeof(param->sins)))RETURN (12);
#if SOCKSTRACE > 0
fprintf(stderr, "%s:%hu binded to communicate with server\n",
			inet_ntoa(param->sins.sin_addr),
			ntohs(param->sins.sin_port)
	);
fflush(stderr);
#endif
	}
	sasize = sizeof(struct sockaddr_in);
	getsockname(param->remsock, (struct sockaddr *)¶m->sins,  &sasize);
	if(command == 3) {
		param->ctrlsock = param->clisock;
		param->clisock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
		if(param->clisock == INVALID_SOCKET) {RETURN(11);}
		sin.sin_family = AF_INET;
		sin.sin_addr.s_addr = param->intip;
		sin.sin_port = htons(0);
		if(bind(param->clisock,(struct sockaddr *)&sin,sizeof(struct sockaddr_in))) {RETURN (12);}
#if SOCKSTRACE > 0
fprintf(stderr, "%s:%hu binded to communicate with client\n",
			inet_ntoa(sin.sin_addr),
			ntohs(sin.sin_port)
	);
fflush(stderr);
#endif
	}
 }
 param->res = 0;

CLEANRET:

 if(param->clisock != INVALID_SOCKET){
	sasize = sizeof(struct sockaddr_in);
	if(command != 3) getsockname(param->remsock, (struct sockaddr *)&sin,  &sasize);
	else getsockname(param->clisock, (struct sockaddr *)&sin,  &sasize);
#if SOCKSTRACE > 0
fprintf(stderr, "Sending confirmation to client with code %d for %s with %s:%hu\n",
			param->res,
			commands[command],
			inet_ntoa(sin.sin_addr),
			ntohs(sin.sin_port)
	);
fflush(stderr);
#endif
	if(ver == 5){
		buf[0] = 5;
		buf[1] = param->res%10;
		buf[2] = 0;
		buf[3] = 1;
		memcpy(buf+4, &sin.sin_addr.s_addr, 4);
		memcpy(buf+8, &sin.sin_port, 2);
		socksend((command == 3)?param->ctrlsock:param->clisock, buf, 10, conf.timeouts[STRING_S]);
	}
	else{
		buf[0] = 0;
		buf[1] = 90 + (param->res%10);
		memcpy(buf+2, &sin.sin_port, 2);
		memcpy(buf+4, &sin.sin_addr.s_addr, 4);
		socksend(param->clisock, buf, 8, conf.timeouts[STRING_S]);
	}

	if (param->res == 0) {
		switch(command) {
			case 1:
				if(param->redirectfunc){
					if(buf)myfree(buf);
					return (*param->redirectfunc)(param);
				}
				param->res = sockmap(param, conf.timeouts[CONNECTION_L]);
				break;
			case 2:
				listen (param->remsock, 1);
				
				fds[0].fd = param->remsock;
				fds[1].fd = param->clisock;
				fds[0].events = fds[1].events = POLLIN;
				res = poll(fds, 2, conf.timeouts[(reqaddr.s_addr)?CONNECTION_S:CONNECTION_L] * 1000);
				if (res < 1 || fds[1].events) {
					res = 460;
					break;
				}
				sasize = sizeof(param->sins);
				s = accept(param->remsock, (struct sockaddr *)¶m->sins, &sasize);
				shutdown(param->remsock, SHUT_RDWR);
				closesocket(param->remsock);
				param->remsock = s;
				if(s == INVALID_SOCKET) {
					param->res = 462;
					break;
				}
				if(reqaddr.s_addr && reqaddr.s_addr != param->sins.sin_addr.s_addr) {
					param->res = 470;
					break;
				}
#if SOCKSTRACE > 0
fprintf(stderr, "Sending incoming connection to client with code %d for %s with %s:%hu\n",
			param->res,
			commands[command],
			inet_ntoa(param->sins.sin_addr),
			ntohs(param->sins.sin_port)
	);
fflush(stderr);
#endif
				if(ver == 5){
					memcpy (buf+4, ¶m->sins.sin_addr, 4);
					memcpy (buf+8, ¶m->sins.sin_port, 2);
					socksend(param->clisock, buf, 10, conf.timeouts[STRING_S]);
				}
				else {
					memcpy (buf+2, ¶m->sins.sin_port, 2);
					memcpy (buf+4, ¶m->sins.sin_addr, 4);
					socksend(param->clisock, buf, 8, conf.timeouts[STRING_S]);
				}

				param->res = sockmap(param, conf.timeouts[CONNECTION_S]);
				break;
			case 3:
				param->sins.sin_addr.s_addr = reqaddr.s_addr;
				param->sins.sin_port = param->reqport;
				myfree(buf);
				if(!(buf = myalloc(LARGEBUFSIZE))) {RETURN(21);}

				for(;;){
					fds[0].fd = param->remsock;
					fds[1].fd = param->clisock;
					fds[2].fd = param->ctrlsock;
					fds[2].events = fds[1].events = fds[0].events = POLLIN;

					res = poll(fds, 3, conf.timeouts[CONNECTION_L]*1000);
					if(res <= 0) {
						param->res = 463;
						break;
					}
					if (fds[2].events) {
						param->res = 0;
						break;
					}
					if (fds[1].events) {
						sasize = sizeof(struct sockaddr_in);
						if((len = recvfrom(param->clisock, buf, 65535, 0, (struct sockaddr *)&sin, &sasize)) <= 10) {
							param->res = 464;
							break;
						}
						if(sin.sin_addr.s_addr != param->sinc.sin_addr.s_addr){
							param->res = 465;
							break;
						}
						if(buf[0] || buf[1] || buf[2]) {
							param->res = 466;
							break;
						}
						switch(buf[3]) {
							case 1:
								i = 8;
								memcpy(¶m->sins.sin_addr.s_addr, buf+4, 4);
								break;
							case 3:
								size = buf[4];
								for (i=4; size; i++, size--){
									buf[i] = buf[i+1];
								}
								buf[i++] = 0;
								param->sins.sin_addr.s_addr = getip(buf+4);
								break;
							default:
								RETURN(996);
						 }

						memcpy(¶m->sins.sin_port, buf+i, 2);
						i+=2;

						sasize = sizeof(param->sins);
						if(len > (int)i){
							if(socksendto(param->remsock, ¶m->sins, buf+i, len - i, conf.timeouts[SINGLEBYTE_L]*1000) <= 0){
								param->res = 467;
								break;
							}
							param->statscli+=(len - i);
#if SOCKSTRACE > 1
fprintf(stderr, "UDP packet relayed from client to %s:%hu size %d, header %d\n",
			inet_ntoa(param->sins.sin_addr),
			ntohs(param->sins.sin_port),
			(len - i),
			i
	);
fprintf(stderr, "client address is assumed to be %s:%hu\n",
			inet_ntoa(sin.sin_addr),
			ntohs(sin.sin_port)
	);
fflush(stderr);
#endif
						}

					}
					if (fds[0].events) {
						sasize = sizeof(param->sins);
						buf[0]=buf[1]=buf[2]=0;
						buf[3]=1;
						if((len = recvfrom(param->remsock, buf+10, 65535 - 10, 0, NULL, &sasize)) <= 0) {
							param->res = 468;
							break;
						}
						memcpy(buf+4, &sin.sin_addr.s_addr, 4);
						memcpy(buf+8, &sin.sin_port, 2);
						if(socksendto(param->clisock, &sin, buf, len + 10, conf.timeouts[SINGLEBYTE_L]*1000) <=0){
							param->res = 469;
							break;
						}
#if SOCKSTRACE > 1
fprintf(stderr, "UDP packet relayed to client from %s:%hu size %d\n",
			inet_ntoa(sin.sin_addr),
			ntohs(sin.sin_port),
			len
	);
fflush(stderr);
#endif
						param->statssrv+=len;

					}
				}
				break;
			default:
				param->res = 417;
				break;
		}
	}
 }
 
 if(command > 3) command = 0;
 if(buf){
	 sprintf((char *)buf, "%s ", commands[command]);
	 if(param->hostname){
	  sprintf(buf + strlen(buf), "%.265s", param->hostname);
	 }
	 else myinet_ntoa(reqaddr, buf+strlen(buf));
         sprintf(buf+strlen(buf), ":%hu", ntohs(param->reqport));
	 (*param->logfunc)(param, buf);
	 myfree(buf);
 }
 freeparam(data);
 return (NULL);
}

#ifdef WITHMAIN
struct proxydef childdef = {
	sockschild,
	1080,
	0,
	S_SOCKS,
	""
};
#include "proxymain.c"
#endif
src/stringtable.c0100644002537100244200000000373110245105603013530 0ustar  vladmkgroup#include 

unsigned char * strings[] = {
/* 00 */	(unsigned char *)"3proxy tiny proxy server v0.5.1b stringtable file",
/* 01 */	(unsigned char *)"3proxy",
/* 02 */	(unsigned char *)"3proxy tiny proxy server",
/* 03 */	(unsigned char *)"0.5.1b-devel",
/* 04 */	NULL,
/* 05 */	(unsigned char *)"SERVR",
/* 06 */	(unsigned char *)"PROXY",
/* 07 */	(unsigned char *)"TCPPM",
/* 08 */	(unsigned char *)"POP3P",
/* 09 */	(unsigned char *)"SOCK4",
/* 10 */	(unsigned char *)"SOCK5",
/* 11 */	(unsigned char *)"UDPPM",
/* 12 */	(unsigned char *)"SOCKS",
/* 13 */	(unsigned char *)"SOC45",
/* 14 */	(unsigned char *)"ADMIN",
/* 15 */	(unsigned char *)"DNSPR",
/* 16 */	(unsigned char *)"FTPPR",
/* 17 */	(unsigned char *)"ZOMBIE",
/* 18 */	NULL,
/* 19 */	NULL,
#ifndef _WIN32
/* 20 */	(unsigned char *)"/usr/local/etc/3proxy.cfg",
#else
/* 20 */	(unsigned char *)"3proxy.cfg",
#endif
/* 21 */	NULL,
/* 22 */	NULL,
/* 23 */	NULL,
/* 24 */	NULL,
/* 25 */	NULL,
/* 26 */	NULL,
/* 27 */	NULL,
/* 28 */	NULL,
/* 29 */	NULL,
/* 30 */		
	"
\n"
	"
Welcome to 3proxy Web Interface
\n"
	"Probably you've notices that interface is currently very ugly.\n"
	"It's because you have development version of 3proxy and interface\n"
	"is coded right now. What you see is a part of work that is done\n"
	"already.\n"
	"
It's planned 0.6 release of 3proxy to have extandable template based\n"
	"web interface, to show all required information about current\n"
	"configuration and connected clients and allow some of administrative\n"
	"tasks.\n"
	"
Please send all your comments to\n"
	"3proxy@security.nnov.ru\n"
	"
Documentation:\n"
	"http://www.security.nnov.ru/soft/3proxy\n"
	"
",
/* 31 */	NULL,
/* 32 */	NULL,
/* 33 */	NULL,
/* 34 */	NULL,
/* 35 */	NULL,
/* 36 */	NULL,
/* 37 */	NULL,
/* 38 */	NULL,
/* 39 */	NULL,
};

int constants[] = {0,0};
src/tcppm.c0100644002537100244200000000147010102215771012333 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: tcppm.c,v 1.4 2004/07/29 15:47:05 vlad Exp $
*/

#include "proxy.h"

#ifndef PORTMAP
#define PORTMAP
#endif
#define RETURN(xxx) { param->res = xxx; goto CLEANRET; }

void * tcppmchild(void * data) {
#define param ((struct clientparam*)data)
 int res;

 param->hostname = param->target;
 param->sins.sin_port = param->targetport;
 param->operation = CONNECT;
 res = (*param->authfunc)(param);
 param->hostname = NULL;
 if(res) {RETURN(res);}
 RETURN (sockmap(param, conf.timeouts[CONNECTION_L]));
CLEANRET:
 
 (*param->logfunc)(param, NULL);
 freeparam(param);
 return (NULL);
}

#ifdef WITHMAIN
struct proxydef childdef = {
	tcppmchild,
	0,
	0,
	S_TCPPM,
	""
};
#include "proxymain.c"
#endif
src/udppm.c0100644002537100244200000000353710243356755012361 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: udppm.c,v 1.9 2005/05/20 12:54:05 vlad Exp $
*/

#include "proxy.h"

#ifndef PORTMAP
#define PORTMAP
#endif
#ifndef UDP
#define UDP
#endif
#define RETURN(xxx) { param->res = xxx; goto CLEANRET; }


void * udppmchild(void * data) {
#define param ((struct clientparam*)data)
 unsigned long ip;
 unsigned char *buf = NULL;
 SASIZETYPE size;
 int res, i;

 ip=getip(param->target);
 if (! ip) {RETURN (100);}
 param->sins.sin_family = AF_INET;
 param->sins.sin_port = htons(0);
 param->sins.sin_addr.s_addr = param->extip;
 if ((param->remsock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == INVALID_SOCKET) {RETURN (11);}
 if(bind(param->remsock,(struct sockaddr *)¶m->sins,sizeof(param->sins))) {RETURN (12);}
 param->sins.sin_addr.s_addr = ip;
 param->sins.sin_port = param->targetport;
 size = sizeof(param->sinc);
 if(!param->clibuf && (!(param->clibuf=myalloc(UDPBUFSIZE)) || !(param->clibufsize = UDPBUFSIZE))){
	RETURN (21);
 }
 param->cliinbuf = param->clioffset = 0;
 i = recvfrom(param->clisock, param->clibuf, param->clibufsize, 0, (struct sockaddr *)¶m->sinc, &size);
 if(param->singlepacket) param->srvfds->events = POLLIN;
 if(i<=0){RETURN (214);}
 param->cliinbuf = i;
 param->statscli+=i;
 param->operation = UDPASSOC;
 if((res = (*param->authfunc)(param))) {RETURN(res);}

 RETURN (sockmap(param, conf.timeouts[(param->singlepacket)?SINGLEBYTE_L:STRING_L]));
CLEANRET:

 if(buf)myfree(buf);
 if(!param->singlepacket) param->srvfds->events = POLLIN;
 (*param->logfunc)(param, NULL);
 param->clisock = INVALID_SOCKET;
 freeparam(param);
 return (NULL);
}

#ifdef WITHMAIN
struct proxydef childdef = {
	udppmchild,
	0,
	1,
	S_UDPPM,
	" -s single packet UDP service for request/reply (DNS-like) services\n"
};
#include "proxymain.c"
#endif
src/webadmin.c0100644002537100244200000003125510231703444013004 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: webadmin.c,v 1.14 2005/04/21 10:57:40 vlad Exp $
*/

#include "proxy.h"

#define RETURN(xxx) { param->res = xxx; goto CLEANRET; }

#define LINESIZE 2048

extern FILE *writable;
FILE * confopen();
extern void decodeurl(unsigned char *s, int filter);

struct printparam {
	char buf[1024];
	int inbuf;
	struct clientparam *cp;
};

static void stdpr(struct printparam* pp, char *buf, int inbuf){
	if((pp->inbuf + inbuf > 1024) || !buf) {
		socksend(pp->cp->clisock, pp->buf, pp->inbuf, conf.timeouts[STRING_S]);
		pp->inbuf = 0;
		if(!buf) return;
	}
	if(inbuf >= 1000){
		socksend(pp->cp->clisock, buf, inbuf, conf.timeouts[STRING_S]);		
	}
	else {
		memcpy(pp->buf + pp->inbuf, buf, inbuf);
		pp->inbuf += inbuf;
	}
}

static void stdcbf(void *cb, char *buf, int inbuf){
	int delay = 0;
	int i;

	for(i = 0; i < inbuf; i++){
		switch(buf[i]){
			case '&':
				if(delay){
					stdpr((struct printparam*)cb, buf+i-delay, delay);
					delay = 0;
				}
				stdpr((struct printparam*)cb, "&", 5);
				break;
			case '<':
				if(delay){
					stdpr((struct printparam*)cb, buf+i-delay, delay);
					delay = 0;
				}
				stdpr((struct printparam*)cb, "<", 4);
				break;
			case '>':
				if(delay){
					stdpr((struct printparam*)cb, buf+i-delay, delay);
					delay = 0;
				}
				stdpr((struct printparam*)cb, ">", 4);
				break;
			default:
				delay++;
				break;
		}
	}
	if(delay){
		stdpr((struct printparam*)cb, buf+i-delay, delay);
	}
}

static char * templateprint(struct printparam* pp, int *level, struct dictionary *dict, char * template){
	char *s, *s2;
	for(; template && *template; ){
		if(!( s = strchr(template, '<'))){
			stdpr(pp, template, strlen(template));
			return template + strlen(template);
		}
		if(s[1] != '%' || s[2] == '%'){
			stdpr(pp, template, (s - template) + 1);
			template = s + 1;
			continue;
		}
		if(s[2] == '/' && (s2 = strchr(s + 2, '>')) && *(s2 - 1) == '%'){
			if(--*level < 0) return NULL;
			return s2 + 1;
		}
	}
	return template;
}


static void printstr(struct printparam* pp, char* str){
	stdpr(pp, str, str?strlen(str):0);
}

static void printval(void *value, int type, int level, struct printparam* pp){
	struct node pn, cn;
	struct property *p;
	int i;

	pn.iteration = NULL;
	pn.parent = NULL;
	pn.type = type;
	pn.value =  value;

	for(p = datatypes[type].properties; p; ) {
		cn.iteration = NULL;
		cn.parent = &pn;
		cn.type = p->type;
		cn.value =  (*p->e_f)(&pn);
		if(cn.value){
			for(i = 0; i < level; i++) printstr(pp, "\t");
			if(strcmp(p->name, "next")){
				printstr(pp, p->name);
				printstr(pp, " [");
				printstr(pp, datatypes[p->type].type);
				printstr(pp, "]: ");
			}
			if(datatypes[p->type].p_f){
				(*datatypes[p->type].p_f)(&cn, stdcbf, pp);
				printstr(pp, "\n");
			}
			else {
				if(!strcmp(p->name, "next")){
					printstr(pp, "--------------------\n");
					p = datatypes[type].properties;
					pn.value = value = cn.value;
					continue;
				}
				else {
					printstr(pp, "\n");
					printval(cn.value, cn.type, level+1, pp);
				}
			}
		}
		p=p->next;
	}
}

char authreq[] = 
	"HTTP/1.0 401 Authentication Required\r\n"
	"WWW-Authenticate: Basic realm=\"proxy\"\r\n"
	"Proxy-Connection: close\r\n"
	"Content-type: text/html; unsigned charset=us-ascii\r\n"
	"\r\n"
	"401 Authentication Required\r\n"
	"
401 Authentication Required
Access to requested resource disallowed by administrator or you need valid username/password to use this resource
\r\n"
;

char ok[] =
	"HTTP/1.0 200 OK\r\n"
	"Connection: close\r\n"
	"Expires: Thu, 01 Dec 1994 16:00:00 GMT\r\n"
	"Cache-Control: no-cache\r\n"
	"Content-type: text/html\r\n"
	"\r\n"
	"%s configuration page\r\n"
	"\r\n"
	"
\r\n"
	"
         "
	"         
\r\n"
	"Counters
\r\n"
	"Reload
\r\n"
	"Statistics
\r\n"
	"Config\r\n"
	"		"
	"
%s %s configuration
"
;
char tail[] =
	"










\r\n"
	"(c)2000-2004 by 3APA3A\r\n"
	"
"
;

char counters[] = "
Counters
\r\n"
		"\r\n"
		""
		""
		""
		""
		"\r\n"
;

char counterstail[] = "
DescriptionActiveUsersSource AddressDestination AddressPortLimitUnitsValueResetUpdatedNum
\r\n";

char * rotations[] = {
	"",
	"/min",
	"/hour",
	"/day",
	"/week",
	"/month",
	""
};

static int printportlist(char *buf, int bufsize, struct portlist* pl, char * delim){
	int printed = 0;

	for(; pl; pl = pl->next){
		if(printed > (bufsize - 64)) break;
		if(pl->startport != pl->endport)
			printed += sprintf(buf+printed, "%hu-%hu%s", pl->startport, pl->endport, pl->next?delim:"");
		else {
			struct servent  *se;
			se = getservbyport((int)ntohs(pl->startport), NULL);
			printed += sprintf(buf+printed, "%hu(%s)%s", pl->startport, se?se->s_name:"unknown", pl->next?delim:"");
		}
		if(printed > (bufsize - 64)) {
			printed += sprintf(buf+printed, "...");
		}
	}
	return printed;
}


static int printuserlist(char *buf, int bufsize, struct userlist* ul, char * delim){
	int printed = 0;

	for(; ul; ul = ul->next){
		if(printed > (bufsize - 64)) break;
		printed += sprintf(buf+printed, "%s%s", ul->user, ul->next?delim:"");
		if(printed > (bufsize - 64)) {
			printed += sprintf(buf+printed, "...");
		}
	}
	return printed;
}

static int printiplist(char *buf, int bufsize, struct iplist* ipl, char * delim){
	int printed = 0;
	for(; ipl; ipl = ipl->next){
		if(printed > (bufsize - 64)) break;
		printed += sprintf(buf+printed, "%u.%u.%u.%u mask %u.%u.%u.%u%s",
			(unsigned)(ntohl(ipl->ip)&0xff000000)>>24,
			(unsigned)(ntohl(ipl->ip)&0x00ff0000)>>16,
			(unsigned)(ntohl(ipl->ip)&0x0000ff00)>>8,
			(unsigned)(ntohl(ipl->ip)&0x000000ff),
			(unsigned)(ntohl(ipl->mask)&0xff000000)>>24,
			(unsigned)(ntohl(ipl->mask)&0x00ff0000)>>16,
			(unsigned)(ntohl(ipl->mask)&0x0000ff00)>>8,
			(unsigned)(ntohl(ipl->mask)&0x000000ff),
			ipl->next?delim:"");
		if(printed > (bufsize - 64)) {
			printed += sprintf(buf+printed, "...");
		}
	}
	return printed;
}

void * adminchild(void * data) {
#define param ((struct clientparam*)data)
 int i, res;
 char * buf;
 char username[256];
 char *sb;
 char *req = NULL;
 struct printparam pp;
 int contentlen = 0;
 int isform = 0;

 pp.inbuf = 0;
 pp.cp = param;

 buf = myalloc(LINESIZE);
 if(!buf) {RETURN(555);}
 i = sockgetlinebuf(param, CLIENT, buf, LINESIZE - 1, '\n', conf.timeouts[STRING_S]);
 if(i<5 || ((buf[0]!='G' || buf[1]!='E' || buf[2]!='T' || buf[3]!=' ' || buf[4]!='/') && 
	   (buf[0]!='P' || buf[1]!='O' || buf[2]!='S' || buf[3]!='T' || buf[4]!=' ' || buf[5]!='/')))
 {
	RETURN(701);
 }
 buf[i] = 0;
 sb = strchr(buf+5, ' ');
 if(!sb){
	RETURN(702);
 }
 *sb = 0;
 req = mystrdup(buf + ((*buf == 'P')? 6 : 5));
 while((i = sockgetlinebuf(param, CLIENT, buf, LINESIZE - 1, '\n', conf.timeouts[STRING_S])) > 2){
	buf[i] = 0;
	if(i > 19 && (!strncasecmp((char *)(buf), "authorization", 13))){
		sb = (unsigned char *)strchr((char *)(buf), ':');
		if(!sb)continue;
		++sb;
		while(isspace(*sb))sb++;
		if(!*sb || strncasecmp((char *)sb, "basic", 5)){
			continue;
		}
		sb+=5;
		while(isspace(*sb))sb++;
		i = de64(sb, username, 255);
		if(i<=0)continue;
		username[i] = 0;
		sb = (unsigned char *)strchr((char *)username, ':');
		if(sb){
			*sb = 0;
			if(param->password)myfree(param->password);
			param->password = (unsigned char *)mystrdup((char *)sb+1);
		}
		if(param->username) myfree(param->username);
		param->username = (unsigned char *)mystrdup((char *)username);
		continue;
	}
	else if(i > 15 && (!strncasecmp((char *) buf, "content-length:", 15))){
		sb = buf + 15;
		while(isspace(*sb))sb++;
		contentlen = atoi(sb);
	}
	else if(i > 13 && (!strncasecmp((char *) buf, "content-type:", 13))){
		sb = buf + 13;
		while(isspace(*sb))sb++;
		if(!strncasecmp(sb, "x-www-form-urlencoded", 21)) isform = 1;
	}
 }
 param->remsock = 1;
 param->operation = ADMIN;
 if(isform && contentlen) {
	printstr(&pp, "HTTP/1.0 100 Continue\r\n\r\n");
	stdpr(&pp, NULL, 0);
 }
 res = (*param->authfunc)(param);
 param->remsock = INVALID_SOCKET;
 if(res && res != 10) {
	printstr(&pp, authreq);
	RETURN(res);
 }
 sprintf(buf, ok, stringtable?(char *)stringtable[2]:"3proxy", stringtable?(char *)stringtable[2]:"3[APA3A] tiny proxy", stringtable?(char *)stringtable[3]:"");
 printstr(&pp, buf);
 switch(*req){
	case 'C':
		printstr(&pp, counters);
		{
			struct trafcount *cp; 
			int num = 0;
			for(cp = conf.trafcounter; cp; cp = cp->next, num++){
			 int inbuf = 0;

			 if(req[1] == 'S' && atoi(req+2) == num) cp->disabled=0;
			 if(req[1] == 'D' && atoi(req+2) == num) cp->disabled=1;
			 inbuf += sprintf(buf,	""
						"%s%s",
						(cp->comment)?cp->comment:" ",
						(cp->disabled)?'S':'D',
						num,
						(cp->disabled)?"NO":"YES"
					);
			 if(!cp->ace || !cp->ace->users){
				inbuf += sprintf(buf+inbuf, "
ANY
");
			 }
			 else {
				inbuf += printuserlist(buf+inbuf, LINESIZE-800, cp->ace->users, ",
\r\n");
			 }
			 inbuf += sprintf(buf+inbuf, "");
			 if(!cp->ace || !cp->ace->src){
				inbuf += sprintf(buf+inbuf, "
ANY
");
			 }
			 else {
				inbuf += printiplist(buf+inbuf, LINESIZE-512, cp->ace->src, ",
\r\n");
			 }
			 inbuf += sprintf(buf+inbuf, "");
			 if(!cp->ace || !cp->ace->dst){
				inbuf += sprintf(buf+inbuf, "
ANY
");
			 }
			 else {
				inbuf += printiplist(buf+inbuf, LINESIZE-512, cp->ace->dst, ",
\r\n");
			 }
			 inbuf += sprintf(buf+inbuf, "");
			 if(!cp->ace || !cp->ace->ports){
				inbuf += sprintf(buf+inbuf, "
ANY
");
			 }
			 else {
				inbuf += printportlist(buf+inbuf, LINESIZE-128, cp->ace->ports, ",
\r\n");
			 }
			 if(cp->type == NONE) {
			  inbuf += sprintf(buf+inbuf,	
					"exclude from limitation\r\n"
				 );
			 }
			 else {
			  inbuf += sprintf(buf+inbuf,	
					"%lu"
					"Mb%s"
					"%.3f Mb"
					"%s",
				 (cp->traflimgb<<10) + (cp->traflim>>20),
				 rotations[cp->type],
				 1024.0 * cp->trafgb + cp->traf/1048576.0,
				 cp->cleared?ctime(&cp->cleared):"never"
				);
			 inbuf += sprintf(buf + inbuf,
					"%s"
					"%i"
					"\r\n",

				 cp->updated?ctime(&cp->updated):"never",
				 cp->number
				);
			 }
			 printstr(&pp, buf);
			}

		}
		printstr(&pp, counterstail);
		break;
		
	case 'R':
		if((res = reload())){
			sprintf(buf, "
reload failed: %d
", res);
			printstr(&pp, buf);
		}
		else {
			printstr(&pp, "
Reloaded
");
		}
		break;
	case 'S':
		{
			printstr(&pp, "
Running services:
");
			printval(conf.services, TYPE_CLIENT, 0, &pp);
			printstr(&pp, "
");
		}
			break;
	case 'F':
		{
			FILE *fp;
			char buf[256];

			fp = confopen();
			if(!fp){
				printstr(&pp, "
Failed to open config file
");
				break;
			}
				printstr(&pp, "
Please be careful editing config file remotely
");
				printstr(&pp, "

");
			break;
		}
	case 'U':
		{
			int l=0;
			int error = 0;

			if(!writable || fseek(writable, 0, 0)){
				error = 1;
			}
			while((i = sockgetlinebuf(param, CLIENT, buf, LINESIZE - 1, '+', conf.timeouts[STRING_S])) > 0){
				if(i > (contentlen - l)) i = (contentlen - l);
				buf[i] = 0;
				if(!l){
					if(strncasecmp(buf, "conffile=", 9)) error = 1;
				}
				if(!error){
					decodeurl(buf, 1);
					fprintf(writable, "%s", l? buf : buf + 9);
				}
				l += i;
				if(l >= contentlen) break;
			}
			if(writable && !error){
				fflush(writable);
				ftruncate(fileno(writable), ftell(writable));
			}
			printstr(&pp, error?    "
Config file is not writable
Make sure you have \"writable\" command in configuration file":
						"
Configuration updated
");

		}
		break;
	default:
		printstr(&pp, stringtable[WEBBANNERS]);
		break;
 }
 printstr(&pp, tail);

CLEANRET:


 printstr(&pp, NULL);
 if(buf) myfree(buf);
 (*param->logfunc)(param, req);
 if(req)myfree(req);
 freeparam(param);
 return (NULL);
}
src/proxy.h0100644002537100244200000003312410245102403012372 0ustar  vladmkgroup/*
   3APA3A simpliest proxy server
   (c) 2002-2004 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: proxy.h,v 1.29 2005/05/25 14:00:35 vlad Exp $
*/

#ifndef _3PROXY_H_
#define _3PROXY_H_
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 


#define MAXUSERNAME 128
#define _PASSWORD_LEN 256
#define MAXNSERVERS 5
#define MAXBANDLIMS 10

#define ALLOW		0
#define DENY		1
#define REDIRECT	2
#define BANDLIM		3
#define NOBANDLIM	4
#define COUNT		5
#define NOCOUNT		6

#define UDPBUFSIZE 16384
#define TCPBUFSIZE  4096


#ifdef _WIN32
#include 
#include 
#define SASIZETYPE int
#define SHUT_RDWR SD_BOTH
#else
#ifndef FD_SETSIZE
#define FD_SETSIZE 4096
#endif
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#define SASIZETYPE socklen_t
#define SOCKET int
#define INVALID_SOCKET  (-1)
#endif

#ifdef __CYGWIN__
#include 
#define daemonize() FreeConsole()
#define SLEEPTIME 1000
#undef _WIN32
#elif _WIN32
#ifdef errno
#undef errno
#endif
#define errno WSAGetLastError()
#define EAGAIN WSAEWOULDBLOCK
#define SLEEPTIME 1
#define usleep Sleep
#define pthread_self GetCurrentThreadId
#define getpid GetCurrentProcessId
#define pthread_t DWORD
#define daemonize() FreeConsole()
#define socket(x, y, z) WSASocket(x, y, z, NULL, 0, 0)
#define accept(x, y, z) WSAAccept(x, y, z, NULL, 0)
#define pthread_mutex_t CRITICAL_SECTION
#define pthread_mutex_init(x, y) InitializeCriticalSection(x)
#define pthread_mutex_lock(x) EnterCriticalSection(x)
#define pthread_mutex_unlock(x) LeaveCriticalSection(x)
#define pthread_mutex_destroy(x) DeleteCriticalSection(x)
#define ftruncate chsize
#else
#include 
#define daemonize() daemon(1,1)
#define SLEEPTIME 1000
#ifndef O_BINARY
#define O_BINARY 0
#endif
#endif

#ifndef NOODBC
#ifndef _WIN32
#include 
#endif
#include 
#include 
#endif

#ifdef WITH_POLL
#include 
#else
struct mypollfd {
 SOCKET    fd;       /* file descriptor */
 short  events;   /* events to look for */
 short  revents;  /* events returned */
};
int  mypoll(struct mypollfd *fds, unsigned int nfds, int timeout);
#ifndef POLLIN
#define POLLIN 1
#endif
#ifndef POLLOUT
#define POLLOUT 2
#endif
#ifndef POLLPRI
#define POLLPRI 4
#endif
#define pollfd mypollfd
#define poll mypoll

#endif

#ifndef _WIN32
#define closesocket close
extern pthread_attr_t pa;
#endif

#ifndef SOCKET_ERROR
#define SOCKET_ERROR -1
#endif

#ifndef isnumber
#define isnumber(n) (n >= '0' && n <= '9')
#endif

#ifndef ishex
#define ishex(n) ((n >= '0' && n <= '9') || (n >= 'a' && n<='f') || (n >= 'A' && n <= 'F'))
#endif

#define isallowed(n) ((n >= '0' && n <= '9') || (n >= 'a' && n <= 'z') || (n >= 'A' && n <= 'Z') || (n >= '*' && n <= '/') || n == '_')

#ifdef _WIN32
extern int strnicmp( const char *string1, const char *string2, size_t count );
extern int stricmp( const char *string1, const char *string2 );
#define strcasecmp stricmp
#define strncasecmp strnicmp
#endif

typedef enum {
	CLIENT,
	SERVER
} DIRECTION;

typedef enum {
	S_NONE,
	S_PROXY,
	S_TCPPM,
	S_POP3P,
	S_SOCKS4 = 4,	/* =4 */
	S_SOCKS5 = 5,	/* =5 */
	S_UDPPM,
	S_SOCKS,
	S_SOCKS45,
	S_ADMIN,
	S_DNSPR,
	S_FTPPR,
	S_ZOMBIE,
}PROXYSERVICE;

struct clientparam;
typedef void (*LOGFUNC)(struct clientparam * param, const unsigned char *);
typedef int (*AUTHFUNC)(struct clientparam * param);
typedef void * (*REDIRECTFUNC)(void *);
typedef unsigned long (*RESOLVFUNC)(const unsigned char *);
typedef unsigned (*BANDLIMFUNC)(struct clientparam * param, unsigned nbytes);
typedef void (*TRAFCOUNTFUNC)(struct clientparam * param);

extern RESOLVFUNC resolvfunc;

struct iplist {
	struct iplist *next;
	unsigned long ip;
	unsigned long mask;
};

struct portlist {
	struct portlist * next;
	unsigned short startport;
	unsigned short endport;
};

struct userlist {
	struct userlist * next;
	unsigned char * user;
};

typedef enum {
	SYS,
	CL,
	CR,
	NT,
	LM
}PWTYPE;

struct passwords {
	struct passwords *next;
	unsigned char * user;
	unsigned char * password;
	int pwtype;
};

typedef enum {
	R_TCP,
	R_CONNECT,
	R_SOCKS4,
	R_SOCKS5,
	R_HTTP,
	R_POP3,
	R_FTP,
} REDIRTYPE;

struct chain {
	struct chain * next;
	int type;
	unsigned long redirip;
	unsigned short redirport;
	unsigned short weight;
	unsigned char * extuser;
	unsigned char * extpass;
};

struct period {
	int fromtime;
	int totime;
	struct period *next;
};

extern int wday;
extern time_t basetime;


#define CONNECT 	0x00000001
#define BIND		0x00000002
#define UDPASSOC	0x00000004
#define ICMPASSOC	0x00000008	/* reserved */
#define HTTP_GET	0x00000100
#define HTTP_PUT	0x00000200
#define HTTP_POST	0x00000400
#define HTTP_HEAD	0x00000800
#define HTTP_CONNECT	0x00001000
#define HTTP_OTHER	0x00008000
#define HTTP		0x0000EF00	/* all except HTTP_CONNECT */
#define HTTPS		HTTP_CONNECT
#define FTP_GET		0x00010000
#define FTP_PUT		0x00020000
#define FTP_LIST	0x00040000
#define FTP		0x000F0000
#define DNSRESOLVE	0x00100000
#define ADMIN		0x01000000

struct ace {
	struct ace *next;
	int action;
	int operation;
	int wdays;
	struct period *periods;
	struct userlist *users;
	struct iplist *src, *dst;
	struct portlist *ports;
	struct chain *chains;
};

struct bandlim {
	struct bandlim *next;
	struct ace *ace;
	unsigned basetime;
	unsigned rate;
	unsigned nexttime;
};

typedef enum {NONE, MINUTELY, HOURLY, DAILY, WEEKLY, MONTHLY, ANNUALLY, NEVER} ROTATION;

struct trafcount {
	struct trafcount *next;
	struct ace *ace;
	unsigned number;
	ROTATION type;
	unsigned long traf;
	unsigned long trafgb;
	unsigned long traflim;
	unsigned long traflimgb;
	time_t cleared;
	time_t updated;
	char * comment;
	int disabled;
};

struct clientparam {
	struct clientparam *next;
	struct clientparam *prev;
	struct clientparam *child;
	struct clientparam *parent;
	PROXYSERVICE service;
	LOGFUNC logfunc;
	AUTHFUNC authfunc;
	REDIRECTFUNC redirectfunc;
	BANDLIMFUNC bandlimfunc;
	TRAFCOUNTFUNC trafcountfunc;
	SOCKET srvsock;
	int * childcount;
	SOCKET clisock;
	SOCKET remsock;
	SOCKET ctrlsock;
	REDIRTYPE redirtype;
	FILE *stdlog;
	int version;
	int redirected;
	int operation;
	unsigned char * target;
	unsigned short targetport;
	struct pollfd * srvfds;
	unsigned long intip;
	unsigned long extip;
	unsigned short intport;
	unsigned short extport;
	int aclnum;
	unsigned char * hostname;
	unsigned char * username;
	unsigned char * password;
	unsigned char * extusername;
	unsigned char * extpassword;
	unsigned char * clibuf;
	unsigned char * srvbuf;
	unsigned cliinbuf;
	unsigned srvinbuf;
	unsigned clioffset;
	unsigned srvoffset;
	unsigned clibufsize;
	unsigned srvbufsize;
	struct sockaddr_in sinc;
	struct sockaddr_in sins;
	int res;
	unsigned long statscli;
	unsigned long statssrv;
	int singlepacket;
	int waitclient;
	int waitserver;
	unsigned char * logformat;
	unsigned char * logtarget;
	pthread_mutex_t * counter_mutex;
	struct bandlim * bandlims[MAXBANDLIMS];
	unsigned char * nonprintable;
	int usentlm;
	int pwtype;
	int threadid;
	time_t time_start;
	unsigned maxtraf;
	unsigned msec_start;
	unsigned short reqport;
	unsigned char replace;
};

struct extparam {
	int timeouts[10];
	struct ace * acls[256];
	char * conffile;
	struct bandlim * bandlimiter;
	struct trafcount * trafcounter;
	struct clientparam *services;
	int threadinit;
	int counterd;
	int haveerror;
	int rotate;
	int paused;
	unsigned char *logname, **archiver;
	ROTATION logtype;
	ROTATION countertype;
	char * counterfile;
	int archiverc;
	char* demanddialprog;
	int demon;
	int maxchild;
	unsigned long intip;
	unsigned long extip;
	unsigned short intport;
	unsigned short extport;
	int singlepacket;
	int aclnum;
	struct passwords *pwl;
	AUTHFUNC authfunc;
	LOGFUNC logfunc;
	BANDLIMFUNC bandlimfunc;
	unsigned char * logformat;
};

typedef enum {
	UNKNOWN,
	INTTABLE,
	INTPAIRTABLE,
	STRINGTABLE,
	STRINGPAIRTABLE,
	STRINGREPLACETABLE,
	IPTABLE,
	IPRANGETABLE,
	ACLTABLE,
}TABLETYPE;

struct datatable {
	TABLETYPE type;
	int	n;
	void * data;
};


extern struct extparam conf;


int sockmap(struct clientparam * param, int timeo);
int socksend(SOCKET sock, unsigned char * buf, int bufsize, int to);
int socksendto(SOCKET sock, struct sockaddr_in * sin, unsigned char * buf, int bufsize, int to);
int sockrecvfrom(SOCKET sock, struct sockaddr_in * sin, unsigned char * buf, int bufsize, int to);


int sockgetcharcli(struct clientparam * param, int timeosec, int timeousec);
int sockgetcharsrv(struct clientparam * param, int timeosec, int timeousec);
int sockgetlinebuf(struct clientparam * param, DIRECTION which, unsigned char * buf, int bufsize, int delim, int to);




int dobuf(struct clientparam * param, unsigned char * buf, const unsigned char *s, const unsigned char * doublec);
extern FILE * stdlog;
void logstdout(struct clientparam * param, const unsigned char *s);
void logsyslog(struct clientparam * param, const unsigned char *s);
void lognone(struct clientparam * param, const unsigned char *s);
#ifndef NOSQL
void logsql(struct clientparam * param, const unsigned char *s);
int init_sql(char * s);
void close_sql();
#endif
int doconnect(struct clientparam * param);
int nbnameauth(struct clientparam * param);
int alwaysauth(struct clientparam * param);
int ipauth(struct clientparam * param);
int strongauth(struct clientparam * param);

int scanaddr(const unsigned char *s, unsigned long * ip, unsigned long * mask);
int myinet_ntoa(struct in_addr in, char * buf);
extern unsigned long nservers[MAXNSERVERS];
unsigned long getip(unsigned char *name);
unsigned long myresolver(const unsigned char *);
unsigned long fakeresolver (const unsigned char *name);
int inithashtable(unsigned nhashsize);
void hashadd(const unsigned char* name, unsigned long value, time_t expires);
void freeparam(struct clientparam * param);
void clearstat(struct clientparam * param);

typedef void * (* PROXYFUNC)(void * data);

struct proxydef {
	PROXYFUNC pf;
	unsigned short port;
	int isudp;
	int service;
	char * helpmessage;
};

extern struct proxydef childdef;

extern char* demanddialprog;
int reload (void);
extern int paused;
extern int demon;

typedef enum {
	SINGLEBYTE_S,
	SINGLEBYTE_L,
	STRING_S,
	STRING_L,
	CONNECTION_S,
	CONNECTION_L,
	DNS_TO,
	CHAIN_TO
}TIMEOUT;


unsigned char * mycrypt(const unsigned char *key, const unsigned char *salt, unsigned char *buf);
unsigned char * ntpwdhash (unsigned char *szHash, const unsigned char *szPassword, int tohex);
int de64 (const unsigned char *in, unsigned char *out, int maxlen);
unsigned char* en64 (const unsigned char *in, unsigned char *out, int inlen);
void tohex(unsigned char *in, unsigned char *out, int len);
void fromhex(unsigned char *in, unsigned char *out, int len);



extern unsigned char **stringtable;

int ftplogin(struct clientparam *param, char *buf, int *inbuf);
int ftpcd(struct clientparam *param, unsigned char* path, char *buf, int *inbuf);
int ftpsyst(struct clientparam *param, unsigned char *buf, unsigned len);
int ftppwd(struct clientparam *param, unsigned char *buf, unsigned len);
int ftptype(struct clientparam *param, unsigned char* f_type);
int ftpres(struct clientparam *param);
SOCKET ftpcommand(struct clientparam *param, unsigned char * command, unsigned char  *arg);


int text2unicode(const char * text, char * buf, int buflen);
void unicode2text(const char *unicode, char * buf, int len);
void genchallenge(struct clientparam *param, char * challenge, char *buf);
void mschap(const unsigned char *win_password,
		 const unsigned char *challenge, unsigned char *response);


int parsehostname(char *hostname, struct clientparam *param, unsigned short port);
int parseusername(char *username, struct clientparam *param, int extpasswd);
int parseconnusername(char *username, struct clientparam *param, int extpasswd, unsigned short port);

extern int randomizer;

#ifdef WITH_STD_MALLOC

#define myalloc malloc
#define myfree free
#define myrealloc realloc
#define mystrdup strdup

#else

void *myalloc(size_t size);
void myfree(void *ptr);
void *myrealloc(void *ptr, size_t size);
char * mystrdup(const char *str);

#endif

extern char *copyright;


#define SERVICES 5

void * dnsprchild(void * data);
void * pop3pchild(void * data);
void * proxychild(void * data);
void * sockschild(void * data);
void * tcppmchild(void * data);
void * udppmchild(void * data);
void * adminchild(void * data);
void * ftpprchild(void * data);


struct datatype;
struct dictionary;
struct node;
struct property;

typedef void * (*EXTENDFUNC) (struct node *node);
typedef void (*CBFUNC)(void *cb, char * buf, int inbuf);
typedef void (*PRINTFUNC) (struct node *node, CBFUNC cbf, void*cb);

extern pthread_mutex_t bandlim_mutex;
extern pthread_mutex_t hash_mutex;
extern pthread_mutex_t acl_mutex;
extern pthread_mutex_t tc_mutex;
#ifndef NOODBC
extern pthread_mutex_t odbc_mutex;
#endif


struct property {
	struct property * next;
	char * name;
	EXTENDFUNC e_f;
	int type;
};

struct datatype {
	char * type;
	EXTENDFUNC i_f;
	PRINTFUNC p_f;
	struct property * properties;
};

struct node {
	void * value;
	void * iteration;
	struct node * parent;
	int type;
};

struct dictionary {
	char * name;
	struct node * node;
	EXTENDFUNC array_f;
	int arraysize;
};


extern struct datatype datatypes[64];

typedef enum {
	TYPE_INTEGER,
	TYPE_SHORT,
	TYPE_CHAR,
	TYPE_UNSIGNED,
	TYPE_TRAFFIC,
	TYPE_PORT,
	TYPE_IP,
	TYPE_CIDR,
	TYPE_STRING,
	TYPE_DATETIME,
	TYPE_OPERATIONS,
	TYPE_ROTATION,
	TYPE_PORTLIST,
	TYPE_IPLIST,
	TYPE_USERLIST,
	TYPE_PWLIST,
	TYPE_CHAIN,
	TYPE_ACE,
	TYPE_BANDLIMIT,
	TYPE_TRAFCOUNTER,
	TYPE_CLIENT,
	TYPE_WEEKDAYS,
	TYPE_TIME,
	TYPE_PERIOD
}DATA_TYPE;

#define WEBBANNERS 30

#endif

src/libs/md4.c0100644002537100244200000002174710067060712012641 0ustar  vladmkgroup/*
 * md4c.c	MD4 message-digest algorithm
 *
 * Version:	$Id: md4.c,v 1.1.1.1 2004/06/25 17:32:58 vlad Exp $
 *
 *   License to copy and use this software is granted provided that it
 *   is identified as the "RSA Data Security, Inc. MD4 Message-Digest
 *   Algorithm" in all material mentioning or referencing this software
 *   or this function.
 *
 *   License is also granted to make and use derivative works provided
 *   that such works are identified as "derived from the RSA Data
 *   Security, Inc. MD4 Message-Digest Algorithm" in all material
 *   mentioning or referencing the derived work.
 *
 *   RSA Data Security, Inc. makes no representations concerning either
 *   the merchantability of this software or the suitability of this
 *   software for any particular purpose. It is provided "as is"
 *   without express or implied warranty of any kind.
 *
 *   These notices must be retained in any copies of any part of this
 *   documentation and/or software.
 *
 * Copyright 1990,1991,1992  RSA Data Security, Inc.
 */


#include "md4.h"

/* Constants for MD4Transform routine.
 */
#define S11 3
#define S12 7
#define S13 11
#define S14 19
#define S21 3
#define S22 5
#define S23 9
#define S24 13
#define S31 3
#define S32 9
#define S33 11
#define S34 15

static void MD4Transform PROTO_LIST ((UINT4 [4], unsigned char [64]));
static void Encode PROTO_LIST
  ((unsigned char *, UINT4 *, unsigned int));
static void Decode PROTO_LIST
  ((UINT4 *, unsigned char *, unsigned int));
static void MD4_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int));
static void MD4_memset PROTO_LIST ((POINTER, int, unsigned int));

static unsigned char PADDING[64] = {
  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* F, G and H are basic MD4 functions.
 */
#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))

/* ROTATE_LEFT rotates x left n bits.
 */
#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))

/* FF, GG and HH are transformations for rounds 1, 2 and 3 */
/* Rotation is separate from addition to prevent recomputation */

#define FF(a, b, c, d, x, s) { \
    (a) += F ((b), (c), (d)) + (x); \
    (a) = ROTATE_LEFT ((a), (s)); \
  }
#define GG(a, b, c, d, x, s) { \
    (a) += G ((b), (c), (d)) + (x) + (UINT4)0x5a827999; \
    (a) = ROTATE_LEFT ((a), (s)); \
  }
#define HH(a, b, c, d, x, s) { \
    (a) += H ((b), (c), (d)) + (x) + (UINT4)0x6ed9eba1; \
    (a) = ROTATE_LEFT ((a), (s)); \
  }

void md4_calc(output, input, inlen)
unsigned char *output;
unsigned char *input;                                /* input block */
unsigned int inlen;                     /* length of input block */
{
	MD4_CTX	context;

	MD4Init(&context);
	MD4Update(&context, input, inlen);
	MD4Final(output, &context);
}

/* MD4 initialization. Begins an MD4 operation, writing a new context.
 */
void MD4Init (context)
MD4_CTX *context;                                        /* context */
{
  context->count[0] = context->count[1] = 0;

  /* Load magic initialization constants.
   */
  context->state[0] = 0x67452301;
  context->state[1] = 0xefcdab89;
  context->state[2] = 0x98badcfe;
  context->state[3] = 0x10325476;
}

/* MD4 block update operation. Continues an MD4 message-digest
     operation, processing another message block, and updating the
     context.
 */
void MD4Update (context, input, inputLen)
MD4_CTX *context;                                        /* context */
unsigned char *input;                                /* input block */
unsigned int inputLen;                     /* length of input block */
{
  unsigned int i, index, partLen;

  /* Compute number of bytes mod 64 */
  index = (unsigned int)((context->count[0] >> 3) & 0x3F);
  /* Update number of bits */
  if ((context->count[0] += ((UINT4)inputLen << 3))
      < ((UINT4)inputLen << 3))
    context->count[1]++;
  context->count[1] += ((UINT4)inputLen >> 29);

  partLen = 64 - index;

  /* Transform as many times as possible.
   */
  if (inputLen >= partLen) {
    MD4_memcpy
      ((POINTER)&context->buffer[index], (POINTER)input, partLen);
    MD4Transform (context->state, context->buffer);

    for (i = partLen; i + 63 < inputLen; i += 64)
      MD4Transform (context->state, &input[i]);

    index = 0;
  }
  else
    i = 0;

  /* Buffer remaining input */
  MD4_memcpy
    ((POINTER)&context->buffer[index], (POINTER)&input[i],
     inputLen-i);
}

/* MD4 finalization. Ends an MD4 message-digest operation, writing the
     the message digest and zeroizing the context.
 */
void MD4Final (digest, context)
unsigned char digest[16];                         /* message digest */
MD4_CTX *context;                                        /* context */
{
  unsigned char bits[8];
  unsigned int index, padLen;

  /* Save number of bits */
  Encode (bits, context->count, 8);

  /* Pad out to 56 mod 64.
   */
  index = (unsigned int)((context->count[0] >> 3) & 0x3f);
  padLen = (index < 56) ? (56 - index) : (120 - index);
  MD4Update (context, PADDING, padLen);

  /* Append length (before padding) */
  MD4Update (context, bits, 8);
  /* Store state in digest */
  Encode (digest, context->state, 16);

  /* Zeroize sensitive information.
   */
  MD4_memset ((POINTER)context, 0, sizeof (*context));
}

/* MD4 basic transformation. Transforms state based on block.
 */
static void MD4Transform (state, block)
UINT4 state[4];
unsigned char block[64];
{
  UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16];

  Decode (x, block, 64);

  /* Round 1 */
  FF (a, b, c, d, x[ 0], S11); /* 1 */
  FF (d, a, b, c, x[ 1], S12); /* 2 */
  FF (c, d, a, b, x[ 2], S13); /* 3 */
  FF (b, c, d, a, x[ 3], S14); /* 4 */
  FF (a, b, c, d, x[ 4], S11); /* 5 */
  FF (d, a, b, c, x[ 5], S12); /* 6 */
  FF (c, d, a, b, x[ 6], S13); /* 7 */
  FF (b, c, d, a, x[ 7], S14); /* 8 */
  FF (a, b, c, d, x[ 8], S11); /* 9 */
  FF (d, a, b, c, x[ 9], S12); /* 10 */
  FF (c, d, a, b, x[10], S13); /* 11 */
  FF (b, c, d, a, x[11], S14); /* 12 */
  FF (a, b, c, d, x[12], S11); /* 13 */
  FF (d, a, b, c, x[13], S12); /* 14 */
  FF (c, d, a, b, x[14], S13); /* 15 */
  FF (b, c, d, a, x[15], S14); /* 16 */

  /* Round 2 */
  GG (a, b, c, d, x[ 0], S21); /* 17 */
  GG (d, a, b, c, x[ 4], S22); /* 18 */
  GG (c, d, a, b, x[ 8], S23); /* 19 */
  GG (b, c, d, a, x[12], S24); /* 20 */
  GG (a, b, c, d, x[ 1], S21); /* 21 */
  GG (d, a, b, c, x[ 5], S22); /* 22 */
  GG (c, d, a, b, x[ 9], S23); /* 23 */
  GG (b, c, d, a, x[13], S24); /* 24 */
  GG (a, b, c, d, x[ 2], S21); /* 25 */
  GG (d, a, b, c, x[ 6], S22); /* 26 */
  GG (c, d, a, b, x[10], S23); /* 27 */
  GG (b, c, d, a, x[14], S24); /* 28 */
  GG (a, b, c, d, x[ 3], S21); /* 29 */
  GG (d, a, b, c, x[ 7], S22); /* 30 */
  GG (c, d, a, b, x[11], S23); /* 31 */
  GG (b, c, d, a, x[15], S24); /* 32 */

  /* Round 3 */
  HH (a, b, c, d, x[ 0], S31); /* 33 */
  HH (d, a, b, c, x[ 8], S32); /* 34 */
  HH (c, d, a, b, x[ 4], S33); /* 35 */
  HH (b, c, d, a, x[12], S34); /* 36 */
  HH (a, b, c, d, x[ 2], S31); /* 37 */
  HH (d, a, b, c, x[10], S32); /* 38 */
  HH (c, d, a, b, x[ 6], S33); /* 39 */
  HH (b, c, d, a, x[14], S34); /* 40 */
  HH (a, b, c, d, x[ 1], S31); /* 41 */
  HH (d, a, b, c, x[ 9], S32); /* 42 */
  HH (c, d, a, b, x[ 5], S33); /* 43 */
  HH (b, c, d, a, x[13], S34); /* 44 */
  HH (a, b, c, d, x[ 3], S31); /* 45 */
  HH (d, a, b, c, x[11], S32); /* 46 */
  HH (c, d, a, b, x[ 7], S33); /* 47 */
  HH (b, c, d, a, x[15], S34); /* 48 */

  state[0] += a;
  state[1] += b;
  state[2] += c;
  state[3] += d;

  /* Zeroize sensitive information.
   */
  MD4_memset ((POINTER)x, 0, sizeof (x));
}

/* Encodes input (UINT4) into output (unsigned char). Assumes len is
     a multiple of 4.
 */
static void Encode (output, input, len)
unsigned char *output;
UINT4 *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4) {
    output[j] = (unsigned char)(input[i] & 0xff);
    output[j+1] = (unsigned char)((input[i] >> 8) & 0xff);
    output[j+2] = (unsigned char)((input[i] >> 16) & 0xff);
    output[j+3] = (unsigned char)((input[i] >> 24) & 0xff);
  }
}

/* Decodes input (unsigned char) into output (UINT4). Assumes len is
     a multiple of 4.
 */
static void Decode (output, input, len)

UINT4 *output;
unsigned char *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4)
    output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) |
      (((UINT4)input[j+2]) << 16) | (((UINT4)input[j+3]) << 24);
}

/* Note: Replace "for loop" with standard memcpy if possible.
 */
static void MD4_memcpy (output, input, len)
POINTER output;
POINTER input;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
    output[i] = input[i];
}

/* Note: Replace "for loop" with standard memset if possible.
 */
static void MD4_memset (output, value, len)
POINTER output;
int value;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
    ((char *)output)[i] = (char)value;
}
src/libs/md4.h0100644002537100244200000000505410067060712012637 0ustar  vladmkgroup#ifndef _LRAD_MD4_H
#define _LRAD_MD4_H

#ifndef _LRAD_PROTO_H
#define _LRAD_PROTO_H
/* GLOBAL.H - RSAREF types and constants
 */

/* PROTOTYPES should be set to one if and only if the compiler supports
  function argument prototyping.
  The following makes PROTOTYPES default to 0 if it has not already
  been defined with C compiler flags.
 */
#ifndef PROTOTYPES
#  if __STDC__
#    define PROTOTYPES 1
#  else
#    define PROTOTYPES 0
#  endif
#endif

/* POINTER defines a generic pointer type */
typedef unsigned char *POINTER;
#define _POINTER_T

/* UINT2 defines a two byte word */
typedef unsigned short int UINT2;
#define _UINT2_T

/* UINT4 defines a four byte word */
#if defined(__alpha) && (defined(__osf__) || defined(__linux__))
typedef unsigned int UINT4;
#else
typedef unsigned long int UINT4;
#endif
#define _UINT4_T

/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
   If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
  returns an empty list.
 */
#if PROTOTYPES
#define PROTO_LIST(list) list
#else
#define PROTO_LIST(list) ()
#endif
#endif /* _LRAD_PROTO_H */

/* MD4.H - header file for MD4C.C
 */

/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
   rights reserved.

   License to copy and use this software is granted provided that it
   is identified as the "RSA Data Security, Inc. MD4 Message-Digest
   Algorithm" in all material mentioning or referencing this software
   or this function.

   License is also granted to make and use derivative works provided
   that such works are identified as "derived from the RSA Data
   Security, Inc. MD4 Message-Digest Algorithm" in all material
   mentioning or referencing the derived work.

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

   These notices must be retained in any copies of any part of this
   documentation and/or software.
 */

/* MD4 context. */
typedef struct {
  UINT4 state[4];                                   /* state (ABCD) */
  UINT4 count[2];        /* number of bits, modulo 2^64 (lsb first) */
  unsigned char buffer[64];                         /* input buffer */
} MD4_CTX;

void md4_calc (unsigned char *, unsigned char *, unsigned int);
void MD4Init PROTO_LIST ((MD4_CTX *));
void MD4Update PROTO_LIST
  ((MD4_CTX *, unsigned char *, unsigned int));
void MD4Final PROTO_LIST ((unsigned char [16], MD4_CTX *));

#endif /* _LRAD_MD4_H */
src/libs/md5.c0100644002537100244200000002500710067060712012633 0ustar  vladmkgroup/* MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
 */

/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
rights reserved.

License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.

License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.

RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.

These notices must be retained in any copies of any part of this
documentation and/or software.
 */

#include "md5.h"

/* Constants for MD5Transform routine.
 */
#define S11 7
#define S12 12
#define S13 17
#define S14 22
#define S21 5
#define S22 9
#define S23 14
#define S24 20
#define S31 4
#define S32 11
#define S33 16
#define S34 23
#define S41 6
#define S42 10
#define S43 15
#define S44 21

void librad_md5_calc(unsigned char *output, unsigned char *input,
		     unsigned int inputlen);
static void MD5Transform PROTO_LIST ((UINT4 [4], const unsigned char [64]));
static void Encode PROTO_LIST
  ((unsigned char *, UINT4 *, unsigned int));
static void Decode PROTO_LIST
  ((UINT4 *, const unsigned char *, unsigned int));
static void MD5_memcpy PROTO_LIST ((POINTER, CONSTPOINTER, unsigned int));
static void MD5_memset PROTO_LIST ((POINTER, int, unsigned int));

static const unsigned char PADDING[64] = {
  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* F, G, H and I are basic MD5 functions.
 */
#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))
#define I(x, y, z) ((y) ^ ((x) | (~z)))

/* ROTATE_LEFT rotates x left n bits.
 */
#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))

/* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4.
Rotation is separate from addition to prevent recomputation.
 */
#define FF(a, b, c, d, x, s, ac) { \
 (a) += F ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }
#define GG(a, b, c, d, x, s, ac) { \
 (a) += G ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }
#define HH(a, b, c, d, x, s, ac) { \
 (a) += H ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }
#define II(a, b, c, d, x, s, ac) { \
 (a) += I ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }

void librad_md5_calc(unsigned char *output, unsigned char *input,
		     unsigned int inlen)
{
	MD5_CTX	context;

	MD5Init(&context);
	MD5Update(&context, input, inlen);
	MD5Final(output, &context);
}

/* MD5 initialization. Begins an MD5 operation, writing a new context.
 */
void MD5Init (context)
MD5_CTX *context;                                        /* context */
{
  context->count[0] = context->count[1] = 0;
  /* Load magic initialization constants.
*/
  context->state[0] = 0x67452301;
  context->state[1] = 0xefcdab89;
  context->state[2] = 0x98badcfe;
  context->state[3] = 0x10325476;
}

/* MD5 block update operation. Continues an MD5 message-digest
  operation, processing another message block, and updating the
  context.
 */
void MD5Update (context, input, inputLen)
MD5_CTX *context;                                        /* context */
const unsigned char *input;                                /* input block */
unsigned int inputLen;                     /* length of input block */
{
  unsigned int i, index, partLen;

  /* Compute number of bytes mod 64 */
  index = (unsigned int)((context->count[0] >> 3) & 0x3F);

  /* Update number of bits */
  if ((context->count[0] += ((UINT4)inputLen << 3))
   < ((UINT4)inputLen << 3))
 context->count[1]++;
  context->count[1] += ((UINT4)inputLen >> 29);

  partLen = 64 - index;

  /* Transform as many times as possible.
*/
  if (inputLen >= partLen) {
 MD5_memcpy
   ((POINTER)&context->buffer[index], (CONSTPOINTER)input, partLen);
 MD5Transform (context->state, context->buffer);

 for (i = partLen; i + 63 < inputLen; i += 64)
   MD5Transform (context->state, &input[i]);

 index = 0;
  }
  else
 i = 0;

  /* Buffer remaining input */
  MD5_memcpy
 ((POINTER)&context->buffer[index], (CONSTPOINTER)&input[i],
  inputLen-i);
}

/* MD5 finalization. Ends an MD5 message-digest operation, writing the
  the message digest and zeroizing the context.
 */
void MD5Final (digest, context)
unsigned char digest[16];                         /* message digest */
MD5_CTX *context;                                       /* context */
{
  unsigned char bits[8];
  unsigned int index, padLen;

  /* Save number of bits */
  Encode (bits, context->count, 8);

  /* Pad out to 56 mod 64.
*/
  index = (unsigned int)((context->count[0] >> 3) & 0x3f);
  padLen = (index < 56) ? (56 - index) : (120 - index);
  MD5Update (context, PADDING, padLen);

  /* Append length (before padding) */
  MD5Update (context, bits, 8);

  /* Store state in digest */
  Encode (digest, context->state, 16);

  /* Zeroize sensitive information.
*/
  MD5_memset ((POINTER)context, 0, sizeof (*context));
}

/* MD5 basic transformation. Transforms state based on block.
 */
static void MD5Transform (state, block)
UINT4 state[4];
const unsigned char block[64];
{
  UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16];

  Decode (x, block, 64);

  /* Round 1 */
  FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */
  FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */
  FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */
  FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */
  FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */
  FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */
  FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */
  FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */
  FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */
  FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */
  FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */
  FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */
  FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */
  FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */
  FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */
  FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */

 /* Round 2 */
  GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */
  GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */
  GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */
  GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */
  GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */
  GG (d, a, b, c, x[10], S22,  0x2441453); /* 22 */
  GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */
  GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */
  GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */
  GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */
  GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */
  GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */
  GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */
  GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */
  GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */
  GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */

  /* Round 3 */
  HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */
  HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */
  HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */
  HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */
  HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */
  HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */
  HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */
  HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */
  HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */
  HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */
  HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */
  HH (b, c, d, a, x[ 6], S34,  0x4881d05); /* 44 */
  HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */
  HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */
  HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */
  HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */

  /* Round 4 */
  II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */
  II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */
  II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */
  II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */
  II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */
  II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */
  II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */
  II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */
  II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */
  II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */
  II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */
  II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */
  II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */
  II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */
  II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */
  II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */

  state[0] += a;
  state[1] += b;
  state[2] += c;
  state[3] += d;

  /* Zeroize sensitive information.
*/
  MD5_memset ((POINTER)x, 0, sizeof (x));
}

/* Encodes input (UINT4) into output (unsigned char). Assumes len is
  a multiple of 4.
 */
static void Encode (output, input, len)
unsigned char *output;
UINT4 *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4) {
 output[j] = (unsigned char)(input[i] & 0xff);
 output[j+1] = (unsigned char)((input[i] >> 8) & 0xff);
 output[j+2] = (unsigned char)((input[i] >> 16) & 0xff);
 output[j+3] = (unsigned char)((input[i] >> 24) & 0xff);
  }
}

/* Decodes input (unsigned char) into output (UINT4). Assumes len is
  a multiple of 4.
 */
static void Decode (output, input, len)
UINT4 *output;
const unsigned char *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4)
 output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) |
   (((UINT4)input[j+2]) << 16) | (((UINT4)input[j+3]) << 24);
}

/* Note: Replace "for loop" with standard memcpy if possible.
 */

static void MD5_memcpy (output, input, len)
POINTER output;
CONSTPOINTER input;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
 output[i] = input[i];
}

/* Note: Replace "for loop" with standard memset if possible.
 */
static void MD5_memset (output, value, len)
POINTER output;
int value;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
 ((char *)output)[i] = (char)value;
}
src/libs/md5.h0100644002537100244200000000543710067060712012645 0ustar  vladmkgroup#ifndef _LRAD_MD5_H
#define _LRAD_MD5_H

#ifndef _LRAD_PROTO_H
#define _LRAD_PROTO_H
/* GLOBAL.H - RSAREF types and constants
 */

/* PROTOTYPES should be set to one if and only if the compiler supports
  function argument prototyping.
  The following makes PROTOTYPES default to 0 if it has not already
  been defined with C compiler flags.
 */
#ifndef PROTOTYPES
#  if __STDC__
#    define PROTOTYPES 1
#  else
#    define PROTOTYPES 0
#  endif
#endif

/* POINTER defines a generic pointer type */
#ifndef _POINTER_T
typedef unsigned char *POINTER;
#endif
typedef const unsigned char *CONSTPOINTER;

/* UINT2 defines a two byte word */
#ifndef _UINT2_T
typedef unsigned short int UINT2;
#endif

/* UINT4 defines a four byte word */
#ifndef _UINT4_T
#if defined(__alpha) && (defined(__osf__) || defined(__linux__))
typedef unsigned int UINT4;
#else
typedef unsigned long int UINT4;
#endif
#endif

/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
   If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
  returns an empty list.
 */
#if PROTOTYPES
#define PROTO_LIST(list) list
#else
#define PROTO_LIST(list) ()
#endif
#endif /* _LRAD_PROTO_H */

/*
 *  FreeRADIUS defines to ensure globally unique MD5 function names,
 *  so that we don't pick up vendor-specific broken MD5 libraries.
 */
#define MD5_CTX		librad_MD5_CTX
#define MD5Init		librad_MD5Init
#define MD5Update	librad_MD5Update
#define MD5Final       	librad_MD5Final

/* MD5.H - header file for MD5C.C
 */

/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
rights reserved.

License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.

License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.

RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.

These notices must be retained in any copies of any part of this
documentation and/or software.
 */

/* MD5 context. */
typedef struct {
  UINT4 state[4];                                   /* state (ABCD) */
  UINT4 count[2];        /* number of bits, modulo 2^64 (lsb first) */
  unsigned char buffer[64];                         /* input buffer */
} MD5_CTX;

void MD5Init PROTO_LIST ((MD5_CTX *));
void MD5Update PROTO_LIST
  ((MD5_CTX *, const unsigned char *, unsigned int));
void MD5Final PROTO_LIST ((unsigned char [16], MD5_CTX *));
#endif /* _LRAD_MD5_H */
src/libs/regex.c0100644002537100244200000027754710067060712013302 0ustar  vladmkgroup#include 
#include 
#include 
#include 
#include 
#include 
#include 

#include "regex.h"

/* utility definitions */
#ifdef _POSIX2_RE_DUP_MAX
#define	DUPMAX	_POSIX2_RE_DUP_MAX
#else
#define	DUPMAX	255
#endif
#define	INFINITY	(DUPMAX + 1)
#define	NC		(CHAR_MAX - CHAR_MIN + 1)
typedef unsigned char uch;

/* for old systems with bcopy() but no memmove() */
#ifdef USEBCOPY
#define	memmove(d, s, c)	bcopy(s, d, c)
#endif

#define	MAGIC1	((('r'^0200)<<8) | 'e')

/*
 * The internal representation is a *strip*, a sequence of
 * operators ending with an endmarker.  (Some terminology etc. is a
 * historical relic of earlier versions which used multiple strips.)
 * Certain oddities in the representation are there to permit running
 * the machinery backwards; in particular, any deviation from sequential
 * flow must be marked at both its source and its destination.  Some
 * fine points:
 *
 * - OPLUS_ and O_PLUS are *inside* the loop they create.
 * - OQUEST_ and O_QUEST are *outside* the bypass they create.
 * - OCH_ and O_CH are *outside* the multi-way branch they create, while
 *   OOR1 and OOR2 are respectively the end and the beginning of one of
 *   the branches.  Note that there is an implicit OOR2 following OCH_
 *   and an implicit OOR1 preceding O_CH.
 *
 * In state representations, an operator's bit is on to signify a state
 * immediately *preceding* "execution" of that operator.
 */
typedef long sop;		/* strip operator */
typedef long sopno;
#define	OPRMASK	0x7c000000
#define	OPDMASK	0x03ffffff
#define	OPSHIFT	(26)
#define	OP(n)	((n)&OPRMASK)
#define	OPND(n)	((n)&OPDMASK)
#define	SOP(op, opnd)	((op)|(opnd))
/* operators			   meaning	operand			*/
/*						(back, fwd are offsets)	*/
#define	OEND	(1< uch [csetsize] */
	uch mask;		/* bit within array */
	uch hash;		/* hash code */
	size_t smultis;
	char *multis;		/* -> char[smulti]  ab\0cd\0ef\0\0 */
} cset;
/* note that CHadd and CHsub are unsafe, and CHIN doesn't yield 0/1 */
#define	CHadd(cs, c)	((cs)->ptr[(uch)(c)] |= (cs)->mask, (cs)->hash += (c))
#define	CHsub(cs, c)	((cs)->ptr[(uch)(c)] &= ~(cs)->mask, (cs)->hash -= (c))
#define	CHIN(cs, c)	((cs)->ptr[(uch)(c)] & (cs)->mask)
#define	MCadd(p, cs, cp)	mcadd(p, cs, cp)	/* regcomp() internal fns */

/* stuff for character categories */
typedef unsigned char cat_t;

/*
 * main compiled-expression structure
 */
struct re_guts {
	int magic;
#		define	MAGIC2	((('R'^0200)<<8)|'E')
	sop *strip;		/* malloced area for strip */
	int csetsize;		/* number of bits in a cset vector */
	int ncsets;		/* number of csets in use */
	cset *sets;		/* -> cset [ncsets] */
	uch *setbits;		/* -> uch[csetsize][ncsets/CHAR_BIT] */
	int cflags;		/* copy of regcomp() cflags argument */
	sopno nstates;		/* = number of sops */
	sopno firststate;	/* the initial OEND (normally 0) */
	sopno laststate;	/* the final OEND */
	int iflags;		/* internal flags */
#		define	USEBOL	01	/* used ^ */
#		define	USEEOL	02	/* used $ */
#		define	BAD	04	/* something wrong */
	int nbol;		/* number of ^ used */
	int neol;		/* number of $ used */
	int ncategories;	/* how many character categories */
	cat_t *categories;	/* ->catspace[-CHAR_MIN] */
	char *must;		/* match must contain this string */
	int mlen;		/* length of must */
	size_t nsub;		/* copy of re_nsub */
	int backrefs;		/* does it use back references? */
	sopno nplus;		/* how deep does it nest +s? */
	/* catspace must be last */
	cat_t catspace[1];	/* actually [NC] */
};

/* misc utilities */
#define	OUT	(CHAR_MAX+1)	/* a non-character value */
#define	ISWORD(c)	(isalnum(c) || (c) == '_')


/* character-class table */
static struct cclass {
	char *name;
	char *chars;
	char *multis;
} cclasses[] = {
	{"alnum","ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",""},
	{"alpha",	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",	""},
	{"blank"," \t",	""},
	{"cntrl","\007\b\t\n\v\f\r\1\2\3\4\5\6\16\17\20\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37\177",""},
	{"digit","0123456789",""},
	{"graph","ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~",""},
	{"lower","abcdefghijklmnopqrstuvwxyz",""},
	{"print","ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~ ",""},
	{"punct","!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~",""},
	{"space","\t\n\v\f\r ",	""},
	{"upper","ABCDEFGHIJKLMNOPQRSTUVWXYZ",""},
	{"xdigit","0123456789ABCDEFabcdef",""},
	{NULL,NULL,""}
};

/* character-name table */
static struct cname {
	char *name;
	char code;
} cnames[] = {
	{"NUL",	'\0'},
	{"SOH",	'\001'},
	{"STX",	'\002'},
	{"ETX",	'\003'},
	{"EOT",	'\004'},
	{"ENQ",	'\005'},
	{"ACK",	'\006'},
	{"BEL",	'\007'},
	{"alert",	'\007'},
	{"BS",		'\010'},
	{"backspace",	'\b'},
	{"HT",		'\011'},
	{"tab",		'\t'},
	{"LF",		'\012'},
	{"newline",	'\n'},
	{"VT",		'\013'},
	{"vertical-tab",	'\v'},
	{"FF",		'\014'},
	{"form-feed",	'\f'},
	{"CR",		'\015'},
	{"carriage-return",	'\r'},
	{"SO",	'\016'},
	{"SI",	'\017'},
	{"DLE",	'\020'},
	{"DC1",	'\021'},
	{"DC2",	'\022'},
	{"DC3",	'\023'},
	{"DC4",	'\024'},
	{"NAK",	'\025'},
	{"SYN",	'\026'},
	{"ETB",	'\027'},
	{"CAN",	'\030'},
	{"EM",	'\031'},
	{"SUB",	'\032'},
	{"ESC",	'\033'},
	{"IS4",	'\034'},
	{"FS",	'\034'},
	{"IS3",	'\035'},
	{"GS",	'\035'},
	{"IS2",	'\036'},
	{"RS",	'\036'},
	{"IS1",	'\037'},
	{"US",	'\037'},
	{"space",		' '},
	{"exclamation-mark",	'!'},
	{"quotation-mark",	'"'},
	{"number-sign",		'#'},
	{"dollar-sign",		'$'},
	{"percent-sign",		'%'},
	{"ampersand",		'&'},
	{"apostrophe",		'\''},
	{"left-parenthesis",	'('},
	{"right-parenthesis",	')'},
	{"asterisk",	'*'},
	{"plus-sign",	'+'},
	{"comma",	','},
	{"hyphen",	'-'},
	{"hyphen-minus",	'-'},
	{"period",	'.'},
	{"full-stop",	'.'},
	{"slash",	'/'},
	{"solidus",	'/'},
	{"zero",		'0'},
	{"one",		'1'},
	{"two",		'2'},
	{"three",	'3'},
	{"four",		'4'},
	{"five",		'5'},
	{"six",		'6'},
	{"seven",	'7'},
	{"eight",	'8'},
	{"nine",		'9'},
	{"colon",	':'},
	{"semicolon",	';'},
	{"less-than-sign",	'<'},
	{"equals-sign",		'='},
	{"greater-than-sign",	'>'},
	{"question-mark",	'?'},
	{"commercial-at",	'@'},
	{"left-square-bracket",	'['},
	{"backslash",		'\\'},
	{"reverse-solidus",	'\\'},
	{"right-square-bracket",	']'},
	{"circumflex",		'^'},
	{"circumflex-accent",	'^'},
	{"underscore",		'_'},
	{"low-line",		'_'},
	{"grave-accent",		'`'},
	{"left-brace",		'{'},
	{"left-curly-bracket",	'{'},
	{"vertical-line",	'|'},
	{"right-brace",		'}'},
	{"right-curly-bracket",	'}'},
	{"tilde",		'~'},
	{"DEL",	'\177'},
	{NULL,	0}
};


/*
 * parse structure, passed up and down to avoid global variables and
 * other clumsinesses
 */
struct parse {
	char *next;		/* next character in RE */
	char *end;		/* end of string (-> NUL normally) */
	int error;		/* has an error been seen? */
	sop *strip;		/* malloced strip */
	sopno ssize;		/* malloced strip size (allocated) */
	sopno slen;		/* malloced strip length (used) */
	int ncsalloc;		/* number of csets allocated */
	struct re_guts *g;
#	define	NPAREN	10	/* we need to remember () 1-9 for back refs */
	sopno pbegin[NPAREN];	/* -> ( ([0] unused) */
	sopno pend[NPAREN];	/* -> ) ([0] unused) */
};

#ifdef __cplusplus
extern "C" {
#endif

static void p_ere(register struct parse *p, int stop);
static void p_ere_exp(register struct parse *p);
static void p_str(register struct parse *p);
static void p_bre(register struct parse *p, register int end1, register int end2);
static int p_simp_re(register struct parse *p, int starordinary);
static int p_count(register struct parse *p);
static void p_bracket(register struct parse *p);
static void p_b_term(register struct parse *p, register cset *cs);
static void p_b_cclass(register struct parse *p, register cset *cs);
static void p_b_eclass(register struct parse *p, register cset *cs);
static char p_b_symbol(register struct parse *p);
static char p_b_coll_elem(register struct parse *p, int endc);
static char othercase(int ch);
static void bothcases(register struct parse *p, int ch);
static void ordinary(register struct parse *p, register int ch);
static void nonnewline(register struct parse *p);
static void repeat(register struct parse *p, sopno start, int from, int to);
static int seterr(register struct parse *p, int e);
static cset *allocset(register struct parse *p);
static void freeset(register struct parse *p, register cset *cs);
static int freezeset(register struct parse *p, register cset *cs);
static int firstch(register struct parse *p, register cset *cs);
static int nch(register struct parse *p, register cset *cs);
static void mcadd(register struct parse *p, register cset *cs, register char *cp);
static void mcinvert(register struct parse *p, register cset *cs);
static void mccase(register struct parse *p, register cset *cs);
static int isinsets(register struct re_guts *g, int c);
static int samesets(register struct re_guts *g, int c1, int c2);
static void categorize(struct parse *p, register struct re_guts *g);
static sopno dupl(register struct parse *p, sopno start, sopno finish);
static void doemit(register struct parse *p, sop op, size_t opnd);
static void doinsert(register struct parse *p, sop op, size_t opnd, sopno pos);
static void dofwd(register struct parse *p, sopno pos, sop value);
static void enlarge(register struct parse *p, sopno size);
static void stripsnug(register struct parse *p, register struct re_guts *g);
static void findmust(register struct parse *p, register struct re_guts *g);
static sopno pluscount(register struct parse *p, register struct re_guts *g);

#ifdef __cplusplus
}
#endif

static char nuls[10];		/* place to point scanner in event of error */

/*
 * macros for use with parse structure
 * BEWARE:  these know that the parse structure is named `p' !!!
 */
#define	PEEK()	(*p->next)
#define	PEEK2()	(*(p->next+1))
#define	MORE()	(p->next < p->end)
#define	MORE2()	(p->next+1 < p->end)
#define	SEE(c)	(MORE() && PEEK() == (c))
#define	SEETWO(a, b)	(MORE() && MORE2() && PEEK() == (a) && PEEK2() == (b))
#define	EAT(c)	((SEE(c)) ? (NEXT(), 1) : 0)
#define	EATTWO(a, b)	((SEETWO(a, b)) ? (NEXT2(), 1) : 0)
#define	NEXT()	(p->next++)
#define	NEXT2()	(p->next += 2)
#define	NEXTn(n)	(p->next += (n))
#define	GETNEXT()	(*p->next++)
#define	SETERROR(e)	seterr(p, (e))
#define	REQUIRE(co, e)	((co) || SETERROR(e))
#define	MUSTSEE(c, e)	(REQUIRE(MORE() && PEEK() == (c), e))
#define	MUSTEAT(c, e)	(REQUIRE(MORE() && GETNEXT() == (c), e))
#define	MUSTNOTSEE(c, e)	(REQUIRE(!MORE() || PEEK() != (c), e))
#define	EMIT(op, sopnd)	doemit(p, (sop)(op), (size_t)(sopnd))
#define	INSERT(op, pos)	doinsert(p, (sop)(op), HERE()-(pos)+1, pos)
#define	AHEAD(pos)		dofwd(p, pos, HERE()-(pos))
#define	ASTERN(sop, pos)	EMIT(sop, HERE()-pos)
#define	HERE()		(p->slen)
#define	THERE()		(p->slen - 1)
#define	THERETHERE()	(p->slen - 2)
#define	DROP(n)	(p->slen -= (n))

#define	never	0		/* some s have bugs too */

int				/* 0 success, otherwise REG_something */
regcomp(preg, pattern, cflags)
regex_t *preg;
const char *pattern;
int cflags;
{
	struct parse pa;
	register struct re_guts *g;
	register struct parse *p = &pa;
	register int i;
	register size_t len;
#define	GOODFLAGS(f)	((f)&~REG_DUMP)

	cflags = GOODFLAGS(cflags);
	if ((cflags®_EXTENDED) && (cflags®_NOSPEC))
		return(REG_INVARG);

	if (cflags®_PEND) {
		if (preg->re_endp < pattern)
			return(REG_INVARG);
		len = preg->re_endp - pattern;
	} else
		len = strlen((char *)pattern);

	/* do the mallocs early so failure handling is easy */
	g = (struct re_guts *)malloc(sizeof(struct re_guts) +
							(NC-1)*sizeof(cat_t));
	if (g == NULL)
		return(REG_ESPACE);
	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
	p->slen = 0;
	if (p->strip == NULL) {
		free((char *)g);
		return(REG_ESPACE);
	}

	/* set things up */
	p->g = g;
	p->next = (char *)pattern;	/* convenience; we do not modify it */
	p->end = p->next + len;
	p->error = 0;
	p->ncsalloc = 0;
	for (i = 0; i < NPAREN; i++) {
		p->pbegin[i] = 0;
		p->pend[i] = 0;
	}
	g->csetsize = NC;
	g->sets = NULL;
	g->setbits = NULL;
	g->ncsets = 0;
	g->cflags = cflags;
	g->iflags = 0;
	g->nbol = 0;
	g->neol = 0;
	g->must = NULL;
	g->mlen = 0;
	g->nsub = 0;
	g->ncategories = 1;	/* category 0 is "everything else" */
	g->categories = &g->catspace[-(CHAR_MIN)];
	(void) memset((char *)g->catspace, 0, NC*sizeof(cat_t));
	g->backrefs = 0;

	/* do it */
	EMIT(OEND, 0);
	g->firststate = THERE();
	if (cflags®_EXTENDED)
		p_ere(p, OUT);
	else if (cflags®_NOSPEC)
		p_str(p);
	else
		p_bre(p, OUT, OUT);
	EMIT(OEND, 0);
	g->laststate = THERE();

	/* tidy up loose ends and fill things in */
	categorize(p, g);
	stripsnug(p, g);
	findmust(p, g);
	g->nplus = pluscount(p, g);
	g->magic = MAGIC2;
	preg->re_nsub = g->nsub;
	preg->re_g = g;
	preg->re_magic = MAGIC1;
	/* not debugging, so can't rely on the assert() in regexec() */
	if (g->iflags&BAD)
		SETERROR(REG_ASSERT);

	/* win or lose, we're done */
	if (p->error != 0)	/* lose */
		regfree(preg);
	return(p->error);
#undef GOODFLAGS
}

/*
 - p_ere - ERE parser top level, concatenation and alternation
 == static void p_ere(register struct parse *p, int stop);
 */
static void
p_ere(p, stop)
register struct parse *p;
int stop;			/* character this ERE should end at */
{
	register char c;
	register sopno prevback;
	register sopno prevfwd;
	register sopno conc;
	register int first = 1;		/* is this the first alternative? */

	for (;;) {
		/* do a bunch of concatenated expressions */
		conc = HERE();
		while (MORE() && (c = PEEK()) != '|' && c != stop)
			p_ere_exp(p);
		REQUIRE(HERE() != conc, REG_EMPTY);	/* require nonempty */

		if (!EAT('|'))
			break;		/* NOTE BREAK OUT */

		if (first) {
			INSERT(OCH_, conc);	/* offset is wrong */
			prevfwd = conc;
			prevback = conc;
			first = 0;
		}
		ASTERN(OOR1, prevback);
		prevback = THERE();
		AHEAD(prevfwd);			/* fix previous offset */
		prevfwd = HERE();
		EMIT(OOR2, 0);			/* offset is very wrong */
	}

	if (!first) {		/* tail-end fixups */
		AHEAD(prevfwd);
		ASTERN(O_CH, prevback);
	}

	assert(!MORE() || SEE(stop));
}

/*
 - p_ere_exp - parse one subERE, an atom possibly followed by a repetition op
 == static void p_ere_exp(register struct parse *p);
 */
static void
p_ere_exp(p)
register struct parse *p;
{
	register char c;
	register sopno pos;
	register int count;
	register int count2;
	register sopno subno;
	int wascaret = 0;

	assert(MORE());		/* caller should have ensured this */
	c = GETNEXT();

	pos = HERE();
	switch (c) {
	case '(':
		REQUIRE(MORE(), REG_EPAREN);
		p->g->nsub++;
		subno = p->g->nsub;
		if (subno < NPAREN)
			p->pbegin[subno] = HERE();
		EMIT(OLPAREN, subno);
		if (!SEE(')'))
			p_ere(p, ')');
		if (subno < NPAREN) {
			p->pend[subno] = HERE();
			assert(p->pend[subno] != 0);
		}
		EMIT(ORPAREN, subno);
		MUSTEAT(')', REG_EPAREN);
		break;
	case '^':
		EMIT(OBOL, 0);
		p->g->iflags |= USEBOL;
		p->g->nbol++;
		wascaret = 1;
		break;
	case '$':
		EMIT(OEOL, 0);
		p->g->iflags |= USEEOL;
		p->g->neol++;
		break;
	case '|':
		SETERROR(REG_EMPTY);
		break;
	case '*':
	case '+':
	case '?':
		SETERROR(REG_BADRPT);
		break;
	case '.':
		if (p->g->cflags®_NEWLINE)
			nonnewline(p);
		else
			EMIT(OANY, 0);
		break;
	case '[':
		p_bracket(p);
		break;
	case '\\':
		REQUIRE(MORE(), REG_EESCAPE);
		c = GETNEXT();
		ordinary(p, c);
		break;
	case '{':		/* okay as ordinary except if digit follows */
		REQUIRE(!MORE() || !isdigit(PEEK()), REG_BADRPT);
		/* FALLTHROUGH */
	default:
		ordinary(p, c);
		break;
	}

	if (!MORE())
		return;
	c = PEEK();
	/* we call { a repetition if followed by a digit */
	if (!( c == '*' || c == '+' || c == '?' ||
				(c == '{' && MORE2() && isdigit(PEEK2())) ))
		return;		/* no repetition, we're done */
	NEXT();

	REQUIRE(!wascaret, REG_BADRPT);
	switch (c) {
	case '*':	/* implemented as +? */
		/* this case does not require the (y|) trick, noKLUDGE */
		INSERT(OPLUS_, pos);
		ASTERN(O_PLUS, pos);
		INSERT(OQUEST_, pos);
		ASTERN(O_QUEST, pos);
		break;
	case '+':
		INSERT(OPLUS_, pos);
		ASTERN(O_PLUS, pos);
		break;
	case '?':
		/* KLUDGE: emit y? as (y|) until subtle bug gets fixed */
		INSERT(OCH_, pos);		/* offset slightly wrong */
		ASTERN(OOR1, pos);		/* this one's right */
		AHEAD(pos);			/* fix the OCH_ */
		EMIT(OOR2, 0);			/* offset very wrong... */
		AHEAD(THERE());			/* ...so fix it */
		ASTERN(O_CH, THERETHERE());
		break;
	case '{':
		count = p_count(p);
		if (EAT(',')) {
			if (isdigit(PEEK())) {
				count2 = p_count(p);
				REQUIRE(count <= count2, REG_BADBR);
			} else		/* single number with comma */
				count2 = INFINITY;
		} else		/* just a single number */
			count2 = count;
		repeat(p, pos, count, count2);
		if (!EAT('}')) {	/* error heuristics */
			while (MORE() && PEEK() != '}')
				NEXT();
			REQUIRE(MORE(), REG_EBRACE);
			SETERROR(REG_BADBR);
		}
		break;
	}

	if (!MORE())
		return;
	c = PEEK();
	if (!( c == '*' || c == '+' || c == '?' ||
				(c == '{' && MORE2() && isdigit(PEEK2())) ) )
		return;
	SETERROR(REG_BADRPT);
}

/*
 - p_str - string (no metacharacters) "parser"
 == static void p_str(register struct parse *p);
 */
static void
p_str(p)
register struct parse *p;
{
	REQUIRE(MORE(), REG_EMPTY);
	while (MORE())
		ordinary(p, GETNEXT());
}

/*
 - p_bre - BRE parser top level, anchoring and concatenation
 == static void p_bre(register struct parse *p, register int end1, \
 ==	register int end2);
 * Giving end1 as OUT essentially eliminates the end1/end2 check.
 *
 * This implementation is a bit of a kludge, in that a trailing $ is first
 * taken as an ordinary character and then revised to be an anchor.  The
 * only undesirable side effect is that '$' gets included as a character
 * category in such cases.  This is fairly harmless; not worth fixing.
 * The amount of lookahead needed to avoid this kludge is excessive.
 */
static void
p_bre(p, end1, end2)
register struct parse *p;
register int end1;		/* first terminating character */
register int end2;		/* second terminating character */
{
	register sopno start = HERE();
	register int first = 1;			/* first subexpression? */
	register int wasdollar = 0;

	if (EAT('^')) {
		EMIT(OBOL, 0);
		p->g->iflags |= USEBOL;
		p->g->nbol++;
	}
	while (MORE() && !SEETWO(end1, end2)) {
		wasdollar = p_simp_re(p, first);
		first = 0;
	}
	if (wasdollar) {	/* oops, that was a trailing anchor */
		DROP(1);
		EMIT(OEOL, 0);
		p->g->iflags |= USEEOL;
		p->g->neol++;
	}

	REQUIRE(HERE() != start, REG_EMPTY);	/* require nonempty */
}

/*
 - p_simp_re - parse a simple RE, an atom possibly followed by a repetition
 == static int p_simp_re(register struct parse *p, int starordinary);
 */
static int			/* was the simple RE an unbackslashed $? */
p_simp_re(p, starordinary)
register struct parse *p;
int starordinary;		/* is a leading * an ordinary character? */
{
	register int c;
	register int count;
	register int count2;
	register sopno pos;
	register int i;
	register sopno subno;
#	define	BACKSL	(1<g->cflags®_NEWLINE)
			nonnewline(p);
		else
			EMIT(OANY, 0);
		break;
	case '[':
		p_bracket(p);
		break;
	case BACKSL|'{':
		SETERROR(REG_BADRPT);
		break;
	case BACKSL|'(':
		p->g->nsub++;
		subno = p->g->nsub;
		if (subno < NPAREN)
			p->pbegin[subno] = HERE();
		EMIT(OLPAREN, subno);
		/* the MORE here is an error heuristic */
		if (MORE() && !SEETWO('\\', ')'))
			p_bre(p, '\\', ')');
		if (subno < NPAREN) {
			p->pend[subno] = HERE();
			assert(p->pend[subno] != 0);
		}
		EMIT(ORPAREN, subno);
		REQUIRE(EATTWO('\\', ')'), REG_EPAREN);
		break;
	case BACKSL|')':	/* should not get here -- must be user */
	case BACKSL|'}':
		SETERROR(REG_EPAREN);
		break;
	case BACKSL|'1':
	case BACKSL|'2':
	case BACKSL|'3':
	case BACKSL|'4':
	case BACKSL|'5':
	case BACKSL|'6':
	case BACKSL|'7':
	case BACKSL|'8':
	case BACKSL|'9':
		i = (c&~BACKSL) - '0';
		assert(i < NPAREN);
		if (p->pend[i] != 0) {
			assert(i <= p->g->nsub);
			EMIT(OBACK_, i);
			assert(p->pbegin[i] != 0);
			assert(OP(p->strip[p->pbegin[i]]) == OLPAREN);
			assert(OP(p->strip[p->pend[i]]) == ORPAREN);
			(void) dupl(p, p->pbegin[i]+1, p->pend[i]);
			EMIT(O_BACK, i);
		} else
			SETERROR(REG_ESUBREG);
		p->g->backrefs = 1;
		break;
	case '*':
		REQUIRE(starordinary, REG_BADRPT);
		/* FALLTHROUGH */
	default:
		ordinary(p, (char)c);	/* takes off BACKSL, if any */
		break;
	}

	if (EAT('*')) {		/* implemented as +? */
		/* this case does not require the (y|) trick, noKLUDGE */
		INSERT(OPLUS_, pos);
		ASTERN(O_PLUS, pos);
		INSERT(OQUEST_, pos);
		ASTERN(O_QUEST, pos);
	} else if (EATTWO('\\', '{')) {
		count = p_count(p);
		if (EAT(',')) {
			if (MORE() && isdigit(PEEK())) {
				count2 = p_count(p);
				REQUIRE(count <= count2, REG_BADBR);
			} else		/* single number with comma */
				count2 = INFINITY;
		} else		/* just a single number */
			count2 = count;
		repeat(p, pos, count, count2);
		if (!EATTWO('\\', '}')) {	/* error heuristics */
			while (MORE() && !SEETWO('\\', '}'))
				NEXT();
			REQUIRE(MORE(), REG_EBRACE);
			SETERROR(REG_BADBR);
		}
	} else if (c == (unsigned char)'$')	/* $ (but not \$) ends it */
		return(1);

	return(0);
}

/*
 - p_count - parse a repetition count
 == static int p_count(register struct parse *p);
 */
static int			/* the value */
p_count(p)
register struct parse *p;
{
	register int count = 0;
	register int ndigits = 0;

	while (MORE() && isdigit(PEEK()) && count <= DUPMAX) {
		count = count*10 + (GETNEXT() - '0');
		ndigits++;
	}

	REQUIRE(ndigits > 0 && count <= DUPMAX, REG_BADBR);
	return(count);
}

/*
 - p_bracket - parse a bracketed character list
 == static void p_bracket(register struct parse *p);
 *
 * Note a significant property of this code:  if the allocset() did SETERROR,
 * no set operations are done.
 */
static void
p_bracket(p)
register struct parse *p;
{
	register cset *cs = allocset(p);
	register int invert = 0;

	/* Dept of Truly Sickening Special-Case Kludges */
	if (p->next + 5 < p->end && strncmp(p->next, "[:<:]]", 6) == 0) {
		EMIT(OBOW, 0);
		NEXTn(6);
		return;
	}
	if (p->next + 5 < p->end && strncmp(p->next, "[:>:]]", 6) == 0) {
		EMIT(OEOW, 0);
		NEXTn(6);
		return;
	}

	if (EAT('^'))
		invert++;	/* make note to invert set at end */
	if (EAT(']'))
		CHadd(cs, ']');
	else if (EAT('-'))
		CHadd(cs, '-');
	while (MORE() && PEEK() != ']' && !SEETWO('-', ']'))
		p_b_term(p, cs);
	if (EAT('-'))
		CHadd(cs, '-');
	MUSTEAT(']', REG_EBRACK);

	if (p->error != 0)	/* don't mess things up further */
		return;

	if (p->g->cflags®_ICASE) {
		register int i;
		register int ci;

		for (i = p->g->csetsize - 1; i >= 0; i--)
			if (CHIN(cs, i) && isalpha(i)) {
				ci = othercase(i);
				if (ci != i)
					CHadd(cs, ci);
			}
		if (cs->multis != NULL)
			mccase(p, cs);
	}
	if (invert) {
		register int i;

		for (i = p->g->csetsize - 1; i >= 0; i--)
			if (CHIN(cs, i))
				CHsub(cs, i);
			else
				CHadd(cs, i);
		if (p->g->cflags®_NEWLINE)
			CHsub(cs, '\n');
		if (cs->multis != NULL)
			mcinvert(p, cs);
	}

	assert(cs->multis == NULL);		/* xxx */

	if (nch(p, cs) == 1) {		/* optimize singleton sets */
		ordinary(p, firstch(p, cs));
		freeset(p, cs);
	} else
		EMIT(OANYOF, freezeset(p, cs));
}

/*
 - p_b_term - parse one term of a bracketed character list
 == static void p_b_term(register struct parse *p, register cset *cs);
 */
static void
p_b_term(p, cs)
register struct parse *p;
register cset *cs;
{
	register char c;
	register char start, finish;
	register int i;

	/* classify what we've got */
	switch ((MORE()) ? PEEK() : '\0') {
	case '[':
		c = (MORE2()) ? PEEK2() : '\0';
		break;
	case '-':
		SETERROR(REG_ERANGE);
		return;			/* NOTE RETURN */
		break;
	default:
		c = '\0';
		break;
	}

	switch (c) {
	case ':':		/* character class */
		NEXT2();
		REQUIRE(MORE(), REG_EBRACK);
		c = PEEK();
		REQUIRE(c != '-' && c != ']', REG_ECTYPE);
		p_b_cclass(p, cs);
		REQUIRE(MORE(), REG_EBRACK);
		REQUIRE(EATTWO(':', ']'), REG_ECTYPE);
		break;
	case '=':		/* equivalence class */
		NEXT2();
		REQUIRE(MORE(), REG_EBRACK);
		c = PEEK();
		REQUIRE(c != '-' && c != ']', REG_ECOLLATE);
		p_b_eclass(p, cs);
		REQUIRE(MORE(), REG_EBRACK);
		REQUIRE(EATTWO('=', ']'), REG_ECOLLATE);
		break;
	default:		/* symbol, ordinary character, or range */
/* xxx revision needed for multichar stuff */
		start = p_b_symbol(p);
		if (SEE('-') && MORE2() && PEEK2() != ']') {
			/* range */
			NEXT();
			if (EAT('-'))
				finish = '-';
			else
				finish = p_b_symbol(p);
		} else
			finish = start;
/* xxx what about signed chars here... */
		REQUIRE(start <= finish, REG_ERANGE);
		for (i = start; i <= finish; i++)
			CHadd(cs, i);
		break;
	}
}

/*
 - p_b_cclass - parse a character-class name and deal with it
 == static void p_b_cclass(register struct parse *p, register cset *cs);
 */
static void
p_b_cclass(p, cs)
register struct parse *p;
register cset *cs;
{
	register char *sp = p->next;
	register struct cclass *cp;
	register size_t len;
	register char *u;
	register char c;

	while (MORE() && isalpha(PEEK()))
		NEXT();
	len = p->next - sp;
	for (cp = cclasses; cp->name != NULL; cp++)
		if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0')
			break;
	if (cp->name == NULL) {
		/* oops, didn't find it */
		SETERROR(REG_ECTYPE);
		return;
	}

	u = cp->chars;
	while ((c = *u++) != '\0')
		CHadd(cs, c);
	for (u = cp->multis; *u != '\0'; u += strlen(u) + 1)
		MCadd(p, cs, u);
}

/*
 - p_b_eclass - parse an equivalence-class name and deal with it
 == static void p_b_eclass(register struct parse *p, register cset *cs);
 *
 * This implementation is incomplete. xxx
 */
static void
p_b_eclass(p, cs)
register struct parse *p;
register cset *cs;
{
	register char c;

	c = p_b_coll_elem(p, '=');
	CHadd(cs, c);
}

/*
 - p_b_symbol - parse a character or [..]ed multicharacter collating symbol
 == static char p_b_symbol(register struct parse *p);
 */
static char			/* value of symbol */
p_b_symbol(p)
register struct parse *p;
{
	register char value;

	REQUIRE(MORE(), REG_EBRACK);
	if (!EATTWO('[', '.'))
		return(GETNEXT());

	/* collating symbol */
	value = p_b_coll_elem(p, '.');
	REQUIRE(EATTWO('.', ']'), REG_ECOLLATE);
	return(value);
}

/*
 - p_b_coll_elem - parse a collating-element name and look it up
 == static char p_b_coll_elem(register struct parse *p, int endc);
 */
static char			/* value of collating element */
p_b_coll_elem(p, endc)
register struct parse *p;
int endc;			/* name ended by endc,']' */
{
	register char *sp = p->next;
	register struct cname *cp;
	register int len;

	while (MORE() && !SEETWO(endc, ']'))
		NEXT();
	if (!MORE()) {
		SETERROR(REG_EBRACK);
		return(0);
	}
	len = p->next - sp;
	for (cp = cnames; cp->name != NULL; cp++)
		if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0')
			return(cp->code);	/* known name */
	if (len == 1)
		return(*sp);	/* single character */
	SETERROR(REG_ECOLLATE);			/* neither */
	return(0);
}

/*
 - othercase - return the case counterpart of an alphabetic
 == static char othercase(int ch);
 */
static char			/* if no counterpart, return ch */
othercase(ch)
int ch;
{
	assert(isalpha(ch));
	if (isupper(ch))
		return(tolower(ch));
	else if (islower(ch))
		return(toupper(ch));
	else			/* peculiar, but could happen */
		return(ch);
}

/*
 - bothcases - emit a dualcase version of a two-case character
 == static void bothcases(register struct parse *p, int ch);
 *
 * Boy, is this implementation ever a kludge...
 */
static void
bothcases(p, ch)
register struct parse *p;
int ch;
{
	register char *oldnext = p->next;
	register char *oldend = p->end;
	char bracket[3];

	assert(othercase(ch) != ch);	/* p_bracket() would recurse */
	p->next = bracket;
	p->end = bracket+2;
	bracket[0] = ch;
	bracket[1] = ']';
	bracket[2] = '\0';
	p_bracket(p);
	assert(p->next == bracket+2);
	p->next = oldnext;
	p->end = oldend;
}

/*
 - ordinary - emit an ordinary character
 == static void ordinary(register struct parse *p, register int ch);
 */
static void
ordinary(p, ch)
register struct parse *p;
register int ch;
{
	register cat_t *cap = p->g->categories;

	if ((p->g->cflags®_ICASE) && isalpha(ch) && othercase(ch) != ch)
		bothcases(p, ch);
	else {
		EMIT(OCHAR, (unsigned char)ch);
		if (cap[ch] == 0)
			cap[ch] = p->g->ncategories++;
	}
}

/*
 - nonnewline - emit REG_NEWLINE version of OANY
 == static void nonnewline(register struct parse *p);
 *
 * Boy, is this implementation ever a kludge...
 */
static void
nonnewline(p)
register struct parse *p;
{
	register char *oldnext = p->next;
	register char *oldend = p->end;
	char bracket[4];

	p->next = bracket;
	p->end = bracket+3;
	bracket[0] = '^';
	bracket[1] = '\n';
	bracket[2] = ']';
	bracket[3] = '\0';
	p_bracket(p);
	assert(p->next == bracket+3);
	p->next = oldnext;
	p->end = oldend;
}

/*
 - repeat - generate code for a bounded repetition, recursively if needed
 == static void repeat(register struct parse *p, sopno start, int from, int to);
 */
static void
repeat(p, start, from, to)
register struct parse *p;
sopno start;			/* operand from here to end of strip */
int from;			/* repeated from this number */
int to;				/* to this number of times (maybe INFINITY) */
{
	register sopno finish = HERE();
#	define	N	2
#	define	INF	3
#	define	REP(f, t)	((f)*8 + (t))
#	define	MAP(n)	(((n) <= 1) ? (n) : ((n) == INFINITY) ? INF : N)
	register sopno copy;

	if (p->error != 0)	/* head off possible runaway recursion */
		return;

	assert(from <= to);

	switch (REP(MAP(from), MAP(to))) {
	case REP(0, 0):			/* must be user doing this */
		DROP(finish-start);	/* drop the operand */
		break;
	case REP(0, 1):			/* as x{1,1}? */
	case REP(0, N):			/* as x{1,n}? */
	case REP(0, INF):		/* as x{1,}? */
		/* KLUDGE: emit y? as (y|) until subtle bug gets fixed */
		INSERT(OCH_, start);		/* offset is wrong... */
		repeat(p, start+1, 1, to);
		ASTERN(OOR1, start);
		AHEAD(start);			/* ... fix it */
		EMIT(OOR2, 0);
		AHEAD(THERE());
		ASTERN(O_CH, THERETHERE());
		break;
	case REP(1, 1):			/* trivial case */
		/* done */
		break;
	case REP(1, N):			/* as x?x{1,n-1} */
		/* KLUDGE: emit y? as (y|) until subtle bug gets fixed */
		INSERT(OCH_, start);
		ASTERN(OOR1, start);
		AHEAD(start);
		EMIT(OOR2, 0);			/* offset very wrong... */
		AHEAD(THERE());			/* ...so fix it */
		ASTERN(O_CH, THERETHERE());
		copy = dupl(p, start+1, finish+1);
		assert(copy == finish+4);
		repeat(p, copy, 1, to-1);
		break;
	case REP(1, INF):		/* as x+ */
		INSERT(OPLUS_, start);
		ASTERN(O_PLUS, start);
		break;
	case REP(N, N):			/* as xx{m-1,n-1} */
		copy = dupl(p, start, finish);
		repeat(p, copy, from-1, to-1);
		break;
	case REP(N, INF):		/* as xx{n-1,INF} */
		copy = dupl(p, start, finish);
		repeat(p, copy, from-1, to);
		break;
	default:			/* "can't happen" */
		SETERROR(REG_ASSERT);	/* just in case */
		break;
	}
}

/*
 - seterr - set an error condition
 == static int seterr(register struct parse *p, int e);
 */
static int			/* useless but makes type checking happy */
seterr(p, e)
register struct parse *p;
int e;
{
	if (p->error == 0)	/* keep earliest error condition */
		p->error = e;
	p->next = nuls;		/* try to bring things to a halt */
	p->end = nuls;
	return(0);		/* make the return value well-defined */
}

/*
 - allocset - allocate a set of characters for []
 == static cset *allocset(register struct parse *p);
 */
static cset *
allocset(p)
register struct parse *p;
{
	register int no = p->g->ncsets++;
	register size_t nc;
	register size_t nbytes;
	register cset *cs;
	register size_t css = (size_t)p->g->csetsize;
	register int i;

	if (no >= p->ncsalloc) {	/* need another column of space */
		p->ncsalloc += CHAR_BIT;
		nc = p->ncsalloc;
		assert(nc % CHAR_BIT == 0);
		nbytes = nc / CHAR_BIT * css;
		if (p->g->sets == NULL)
			p->g->sets = (cset *)malloc(nc * sizeof(cset));
		else
			p->g->sets = (cset *)realloc((char *)p->g->sets,
							nc * sizeof(cset));
		if (p->g->setbits == NULL)
			p->g->setbits = (uch *)malloc(nbytes);
		else {
			p->g->setbits = (uch *)realloc((char *)p->g->setbits,
								nbytes);
			/* xxx this isn't right if setbits is now NULL */
			for (i = 0; i < no; i++)
				p->g->sets[i].ptr = p->g->setbits + css*(i/CHAR_BIT);
		}
		if (p->g->sets != NULL && p->g->setbits != NULL)
			(void) memset((char *)p->g->setbits + (nbytes - css),
								0, css);
		else {
			no = 0;
			SETERROR(REG_ESPACE);
			/* caller's responsibility not to do set ops */
		}
	}

	assert(p->g->sets != NULL);	/* xxx */
	cs = &p->g->sets[no];
	cs->ptr = p->g->setbits + css*((no)/CHAR_BIT);
	cs->mask = 1 << ((no) % CHAR_BIT);
	cs->hash = 0;
	cs->smultis = 0;
	cs->multis = NULL;

	return(cs);
}

/*
 - freeset - free a now-unused set
 == static void freeset(register struct parse *p, register cset *cs);
 */
static void
freeset(p, cs)
register struct parse *p;
register cset *cs;
{
	register int i;
	register cset *top = &p->g->sets[p->g->ncsets];
	register size_t css = (size_t)p->g->csetsize;

	for (i = 0; i < css; i++)
		CHsub(cs, i);
	if (cs == top-1)	/* recover only the easy case */
		p->g->ncsets--;
}

/*
 - freezeset - final processing on a set of characters
 == static int freezeset(register struct parse *p, register cset *cs);
 *
 * The main task here is merging identical sets.  This is usually a waste
 * of time (although the hash code minimizes the overhead), but can win
 * big if REG_ICASE is being used.  REG_ICASE, by the way, is why the hash
 * is done using addition rather than xor -- all ASCII [aA] sets xor to
 * the same value!
 */
static int			/* set number */
freezeset(p, cs)
register struct parse *p;
register cset *cs;
{
	register uch h = cs->hash;
	register int i;
	register cset *top = &p->g->sets[p->g->ncsets];
	register cset *cs2;
	register size_t css = (size_t)p->g->csetsize;

	/* look for an earlier one which is the same */
	for (cs2 = &p->g->sets[0]; cs2 < top; cs2++)
		if (cs2->hash == h && cs2 != cs) {
			/* maybe */
			for (i = 0; i < css; i++)
				if (!!CHIN(cs2, i) != !!CHIN(cs, i))
					break;		/* no */
			if (i == css)
				break;			/* yes */
		}

	if (cs2 < top) {	/* found one */
		freeset(p, cs);
		cs = cs2;
	}

	return((int)(cs - p->g->sets));
}

/*
 - firstch - return first character in a set (which must have at least one)
 == static int firstch(register struct parse *p, register cset *cs);
 */
static int			/* character; there is no "none" value */
firstch(p, cs)
register struct parse *p;
register cset *cs;
{
	register int i;
	register size_t css = (size_t)p->g->csetsize;

	for (i = 0; i < css; i++)
		if (CHIN(cs, i))
			return((char)i);
	assert(never);
	return(0);		/* arbitrary */
}

/*
 - nch - number of characters in a set
 == static int nch(register struct parse *p, register cset *cs);
 */
static int
nch(p, cs)
register struct parse *p;
register cset *cs;
{
	register int i;
	register size_t css = (size_t)p->g->csetsize;
	register int n = 0;

	for (i = 0; i < css; i++)
		if (CHIN(cs, i))
			n++;
	return(n);
}

/*
 - mcadd - add a collating element to a cset
 == static void mcadd(register struct parse *p, register cset *cs, \
 ==	register char *cp);
 */
static void
mcadd(p, cs, cp)
register struct parse *p;
register cset *cs;
register char *cp;
{
	register size_t oldend = cs->smultis;

	cs->smultis += strlen(cp) + 1;
	if (cs->multis == NULL)
		cs->multis = malloc(cs->smultis);
	else
		cs->multis = realloc(cs->multis, cs->smultis);
	if (cs->multis == NULL) {
		SETERROR(REG_ESPACE);
		return;
	}

	(void) strcpy(cs->multis + oldend - 1, cp);
	cs->multis[cs->smultis - 1] = '\0';
}

/*
 - mcinvert - invert the list of collating elements in a cset
 == static void mcinvert(register struct parse *p, register cset *cs);
 *
 * This would have to know the set of possibilities.  Implementation
 * is deferred.
 */
static void
mcinvert(p, cs)
register struct parse *p;
register cset *cs;
{
	assert(cs->multis == NULL);	/* xxx */
}

/*
 - mccase - add case counterparts of the list of collating elements in a cset
 == static void mccase(register struct parse *p, register cset *cs);
 *
 * This would have to know the set of possibilities.  Implementation
 * is deferred.
 */
static void
mccase(p, cs)
register struct parse *p;
register cset *cs;
{
	assert(cs->multis == NULL);	/* xxx */
}

/*
 - isinsets - is this character in any sets?
 == static int isinsets(register struct re_guts *g, int c);
 */
static int			/* predicate */
isinsets(g, c)
register struct re_guts *g;
int c;
{
	register uch *col;
	register int i;
	register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
	register unsigned uc = (unsigned char)c;

	for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
		if (col[uc] != 0)
			return(1);
	return(0);
}

/*
 - samesets - are these two characters in exactly the same sets?
 == static int samesets(register struct re_guts *g, int c1, int c2);
 */
static int			/* predicate */
samesets(g, c1, c2)
register struct re_guts *g;
int c1;
int c2;
{
	register uch *col;
	register int i;
	register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
	register unsigned uc1 = (unsigned char)c1;
	register unsigned uc2 = (unsigned char)c2;

	for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
		if (col[uc1] != col[uc2])
			return(0);
	return(1);
}

/*
 - categorize - sort out character categories
 == static void categorize(struct parse *p, register struct re_guts *g);
 */
static void
categorize(p, g)
struct parse *p;
register struct re_guts *g;
{
	register cat_t *cats = g->categories;
	register int c;
	register int c2;
	register cat_t cat;

	/* avoid making error situations worse */
	if (p->error != 0)
		return;

	for (c = CHAR_MIN; c <= CHAR_MAX; c++)
		if (cats[c] == 0 && isinsets(g, c)) {
			cat = g->ncategories++;
			cats[c] = cat;
			for (c2 = c+1; c2 <= CHAR_MAX; c2++)
				if (cats[c2] == 0 && samesets(g, c, c2))
					cats[c2] = cat;
		}
}

/*
 - dupl - emit a duplicate of a bunch of sops
 == static sopno dupl(register struct parse *p, sopno start, sopno finish);
 */
static sopno			/* start of duplicate */
dupl(p, start, finish)
register struct parse *p;
sopno start;			/* from here */
sopno finish;			/* to this less one */
{
	register sopno ret = HERE();
	register sopno len = finish - start;

	assert(finish >= start);
	if (len == 0)
		return(ret);
	enlarge(p, p->ssize + len);	/* this many unexpected additions */
	assert(p->ssize >= p->slen + len);
	(void) memcpy((char *)(p->strip + p->slen),
		(char *)(p->strip + start), (size_t)len*sizeof(sop));
	p->slen += len;
	return(ret);
}

/*
 - doemit - emit a strip operator
 == static void doemit(register struct parse *p, sop op, size_t opnd);
 *
 * It might seem better to implement this as a macro with a function as
 * hard-case backup, but it's just too big and messy unless there are
 * some changes to the data structures.  Maybe later.
 */
static void
doemit(p, op, opnd)
register struct parse *p;
sop op;
size_t opnd;
{
	/* avoid making error situations worse */
	if (p->error != 0)
		return;

	/* deal with oversize operands ("can't happen", more or less) */
	assert(opnd < 1<slen >= p->ssize)
		enlarge(p, (p->ssize+1) / 2 * 3);	/* +50% */
	assert(p->slen < p->ssize);

	/* finally, it's all reduced to the easy case */
	p->strip[p->slen++] = SOP(op, opnd);
}

/*
 - doinsert - insert a sop into the strip
 == static void doinsert(register struct parse *p, sop op, size_t opnd, sopno pos);
 */
static void
doinsert(p, op, opnd, pos)
register struct parse *p;
sop op;
size_t opnd;
sopno pos;
{
	register sopno sn;
	register sop s;
	register int i;

	/* avoid making error situations worse */
	if (p->error != 0)
		return;

	sn = HERE();
	EMIT(op, opnd);		/* do checks, ensure space */
	assert(HERE() == sn+1);
	s = p->strip[sn];

	/* adjust paren pointers */
	assert(pos > 0);
	for (i = 1; i < NPAREN; i++) {
		if (p->pbegin[i] >= pos) {
			p->pbegin[i]++;
		}
		if (p->pend[i] >= pos) {
			p->pend[i]++;
		}
	}

	memmove((char *)&p->strip[pos+1], (char *)&p->strip[pos],
						(HERE()-pos-1)*sizeof(sop));
	p->strip[pos] = s;
}

/*
 - dofwd - complete a forward reference
 == static void dofwd(register struct parse *p, sopno pos, sop value);
 */
static void
dofwd(p, pos, value)
register struct parse *p;
register sopno pos;
sop value;
{
	/* avoid making error situations worse */
	if (p->error != 0)
		return;

	assert(value < 1<strip[pos] = OP(p->strip[pos]) | value;
}

/*
 - enlarge - enlarge the strip
 == static void enlarge(register struct parse *p, sopno size);
 */
static void
enlarge(p, size)
register struct parse *p;
register sopno size;
{
	register sop *sp;

	if (p->ssize >= size)
		return;

	sp = (sop *)realloc(p->strip, size*sizeof(sop));
	if (sp == NULL) {
		SETERROR(REG_ESPACE);
		return;
	}
	p->strip = sp;
	p->ssize = size;
}

/*
 - stripsnug - compact the strip
 == static void stripsnug(register struct parse *p, register struct re_guts *g);
 */
static void
stripsnug(p, g)
register struct parse *p;
register struct re_guts *g;
{
	g->nstates = p->slen;
	g->strip = (sop *)realloc((char *)p->strip, p->slen * sizeof(sop));
	if (g->strip == NULL) {
		SETERROR(REG_ESPACE);
		g->strip = p->strip;
	}
}

/*
 - findmust - fill in must and mlen with longest mandatory literal string
 == static void findmust(register struct parse *p, register struct re_guts *g);
 *
 * This algorithm could do fancy things like analyzing the operands of |
 * for common subsequences.  Someday.  This code is simple and finds most
 * of the interesting cases.
 *
 * Note that must and mlen got initialized during setup.
 */
static void
findmust(p, g)
struct parse *p;
register struct re_guts *g;
{
	register sop *scan;
	sop *start;
	register sop *newstart;
	register sopno newlen;
	register sop s;
	register char *cp;
	register sopno i;

	/* avoid making error situations worse */
	if (p->error != 0)
		return;

	/* find the longest OCHAR sequence in strip */
	newlen = 0;
	scan = g->strip + 1;
	do {
		s = *scan++;
		switch (OP(s)) {
		case OCHAR:		/* sequence member */
			if (newlen == 0)		/* new sequence */
				newstart = scan - 1;
			newlen++;
			break;
		case OPLUS_:		/* things that don't break one */
		case OLPAREN:
		case ORPAREN:
			break;
		case OQUEST_:		/* things that must be skipped */
		case OCH_:
			scan--;
			do {
				scan += OPND(s);
				s = *scan;
				/* assert() interferes w debug printouts */
				if (OP(s) != O_QUEST && OP(s) != O_CH &&
							OP(s) != OOR2) {
					g->iflags |= BAD;
					return;
				}
			} while (OP(s) != O_QUEST && OP(s) != O_CH);
			/* fallthrough */
		default:		/* things that break a sequence */
			if (newlen > g->mlen) {		/* ends one */
				start = newstart;
				g->mlen = newlen;
			}
			newlen = 0;
			break;
		}
	} while (OP(s) != OEND);

	if (g->mlen == 0)		/* there isn't one */
		return;

	/* turn it into a character string */
	g->must = malloc((size_t)g->mlen + 1);
	if (g->must == NULL) {		/* argh; just forget it */
		g->mlen = 0;
		return;
	}
	cp = g->must;
	scan = start;
	for (i = g->mlen; i > 0; i--) {
		while (OP(s = *scan++) != OCHAR)
			continue;
		assert(cp < g->must + g->mlen);
		*cp++ = (char)OPND(s);
	}
	assert(cp == g->must + g->mlen);
	*cp++ = '\0';		/* just on general principles */
}

/*
 - pluscount - count + nesting
 == static sopno pluscount(register struct parse *p, register struct re_guts *g);
 */
static sopno			/* nesting depth */
pluscount(p, g)
struct parse *p;
register struct re_guts *g;
{
	register sop *scan;
	register sop s;
	register sopno plusnest = 0;
	register sopno maxnest = 0;

	if (p->error != 0)
		return(0);	/* there may not be an OEND */

	scan = g->strip + 1;
	do {
		s = *scan++;
		switch (OP(s)) {
		case OPLUS_:
			plusnest++;
			break;
		case O_PLUS:
			if (plusnest > maxnest)
				maxnest = plusnest;
			plusnest--;
			break;
		}
	} while (OP(s) != OEND);
	if (plusnest != 0)
		g->iflags |= BAD;
	return(maxnest);
}

static int nope = 0;		/* for use in asserts; shuts lint up */

/* macros for manipulating states, small version */
#define	states	unsigned
#define	states1	unsigned	/* for later use in regexec() decision */
#define	CLEAR(v)	((v) = 0)
#define	SET0(v, n)	((v) &= ~((unsigned)1 << (n)))
#define	SET1(v, n)	((v) |= (unsigned)1 << (n))
#define	ISSET(v, n)	((v) & ((unsigned)1 << (n)))
#define	ASSIGN(d, s)	((d) = (s))
#define	EQ(a, b)	((a) == (b))
#define	STATEVARS	int dummy	/* dummy version */
#define	STATESETUP(m, n)	/* nothing */
#define	STATETEARDOWN(m)	/* nothing */
#define	SETUP(v)	((v) = 0)
#define	onestate	unsigned
#define	INIT(o, n)	((o) = (unsigned)1 << (n))
#define	INC(o)	((o) <<= 1)
#define	ISSTATEIN(v, o)	((v) & (o))
/* some abbreviations; note that some of these know variable names! */
/* do "if I'm here, I can also be there" etc without branches */
#define	FWD(dst, src, n)	((dst) |= ((unsigned)(src)&(here)) << (n))
#define	BACK(dst, src, n)	((dst) |= ((unsigned)(src)&(here)) >> (n))
#define	ISSETBACK(v, n)	((v) & ((unsigned)here >> (n)))
/* function names */
#define SNAMES			/* engine.c looks after details */

/*
 * The matching engine and friends.  This file is #included by regexec.c
 * after suitable #defines of a variety of macros used herein, so that
 * different state representations can be used without duplicating masses
 * of code.
 */

#ifdef SNAMES
#define	matcher	smatcher
#define	fast	sfast
#define	slow	sslow
#define	dissect	sdissect
#define	backref	sbackref
#define	step	sstep
#define	print	sprint
#define	at	sat
#define	match	smat
#endif
#ifdef LNAMES
#define	matcher	lmatcher
#define	fast	lfast
#define	slow	lslow
#define	dissect	ldissect
#define	backref	lbackref
#define	step	lstep
#define	print	lprint
#define	at	lat
#define	match	lmat
#endif

/* another structure passed up and down to avoid zillions of parameters */
struct match {
	struct re_guts *g;
	int eflags;
	regmatch_t *pmatch;	/* [nsub+1] (0 element unused) */
	char *offp;		/* offsets work from here */
	char *beginp;		/* start of string -- virtual NUL precedes */
	char *endp;		/* end of string -- virtual NUL here */
	char *coldp;		/* can be no match starting before here */
	char **lastpos;		/* [nplus+1] */
	STATEVARS;
	states st;		/* current states */
	states fresh;		/* states for a fresh start */
	states tmp;		/* temporary */
	states empty;		/* empty set of states */
};

static int matcher(register struct re_guts *g, char *string, size_t nmatch, regmatch_t pmatch[], int eflags);
static char *dissect(register struct match *m, char *start, char *stop, sopno startst, sopno stopst);
static char *backref(register struct match *m, char *start, char *stop, sopno startst, sopno stopst, sopno lev);
static char *fast(register struct match *m, char *start, char *stop, sopno startst, sopno stopst);
static char *slow(register struct match *m, char *start, char *stop, sopno startst, sopno stopst);
static states step(register struct re_guts *g, sopno start, sopno stop, register states bef, int ch, register states aft);
#define	BOL	(OUT+1)
#define	EOL	(BOL+1)
#define	BOLEOL	(BOL+2)
#define	NOTHING	(BOL+3)
#define	BOW	(BOL+4)
#define	EOW	(BOL+5)
#define	CODEMAX	(BOL+5)		/* highest code used */
#define	NONCHAR(c)	((c) > CHAR_MAX)
#define	NNONCHAR	(CODEMAX-CHAR_MAX)
#define	SP(t, s, c)	/* nothing */
#define	AT(t, p1, p2, s1, s2)	/* nothing */
#define	NOTE(s)	/* nothing */

/*
 - matcher - the actual matching engine
 == static int matcher(register struct re_guts *g, char *string, \
 ==	size_t nmatch, regmatch_t pmatch[], int eflags);
 */
static int			/* 0 success, REG_NOMATCH failure */
matcher(g, string, nmatch, pmatch, eflags)
register struct re_guts *g;
char *string;
size_t nmatch;
regmatch_t pmatch[];
int eflags;
{
	register char *endp;
	register int i;
	struct match mv;
	register struct match *m = &mv;
	register char *dp;
	const register sopno gf = g->firststate+1;	/* +1 for OEND */
	const register sopno gl = g->laststate;
	char *start;
	char *stop;

	/* simplify the situation where possible */
	if (g->cflags®_NOSUB)
		nmatch = 0;
	if (eflags®_STARTEND) {
		start = string + pmatch[0].rm_so;
		stop = string + pmatch[0].rm_eo;
	} else {
		start = string;
		stop = start + strlen(start);
	}
	if (stop < start)
		return(REG_INVARG);

	/* prescreening; this does wonders for this rather slow code */
	if (g->must != NULL) {
		for (dp = start; dp < stop; dp++)
			if (*dp == g->must[0] && stop - dp >= g->mlen &&
				memcmp(dp, g->must, (size_t)g->mlen) == 0)
				break;
		if (dp == stop)		/* we didn't find g->must */
			return(REG_NOMATCH);
	}

	/* match struct setup */
	m->g = g;
	m->eflags = eflags;
	m->pmatch = NULL;
	m->lastpos = NULL;
	m->offp = string;
	m->beginp = start;
	m->endp = stop;
	STATESETUP(m, 4);
	SETUP(m->st);
	SETUP(m->fresh);
	SETUP(m->tmp);
	SETUP(m->empty);
	CLEAR(m->empty);

	/* this loop does only one repetition except for backrefs */
	for (;;) {
		endp = fast(m, start, stop, gf, gl);
		if (endp == NULL) {		/* a miss */
			STATETEARDOWN(m);
			return(REG_NOMATCH);
		}
		if (nmatch == 0 && !g->backrefs)
			break;		/* no further info needed */

		/* where? */
		assert(m->coldp != NULL);
		for (;;) {
			NOTE("finding start");
			endp = slow(m, m->coldp, stop, gf, gl);
			if (endp != NULL)
				break;
			assert(m->coldp < m->endp);
			m->coldp++;
		}
		if (nmatch == 1 && !g->backrefs)
			break;		/* no further info needed */

		/* oh my, he wants the subexpressions... */
		if (m->pmatch == NULL)
			m->pmatch = (regmatch_t *)malloc((m->g->nsub + 1) *
							sizeof(regmatch_t));
		if (m->pmatch == NULL) {
			STATETEARDOWN(m);
			return(REG_ESPACE);
		}
		for (i = 1; i <= m->g->nsub; i++)
			m->pmatch[i].rm_so = m->pmatch[i].rm_eo = -1;
		if (!g->backrefs && !(m->eflags®_BACKR)) {
			NOTE("dissecting");
			dp = dissect(m, m->coldp, endp, gf, gl);
		} else {
			if (g->nplus > 0 && m->lastpos == NULL)
				m->lastpos = (char **)malloc((g->nplus+1) *
							sizeof(char *));
			if (g->nplus > 0 && m->lastpos == NULL) {
				free(m->pmatch);
				STATETEARDOWN(m);
				return(REG_ESPACE);
			}
			NOTE("backref dissect");
			dp = backref(m, m->coldp, endp, gf, gl, (sopno)0);
		}
		if (dp != NULL)
			break;

		/* uh-oh... we couldn't find a subexpression-level match */
		assert(g->backrefs);	/* must be back references doing it */
		assert(g->nplus == 0 || m->lastpos != NULL);
		for (;;) {
			if (dp != NULL || endp <= m->coldp)
				break;		/* defeat */
			NOTE("backoff");
			endp = slow(m, m->coldp, endp-1, gf, gl);
			if (endp == NULL)
				break;		/* defeat */
			/* try it on a shorter possibility */
			NOTE("backoff dissect");
			dp = backref(m, m->coldp, endp, gf, gl, (sopno)0);
		}
		assert(dp == NULL || dp == endp);
		if (dp != NULL)		/* found a shorter one */
			break;

		/* despite initial appearances, there is no match here */
		NOTE("false alarm");
		start = m->coldp + 1;	/* recycle starting later */
		assert(start <= stop);
	}

	/* fill in the details if requested */
	if (nmatch > 0) {
		pmatch[0].rm_so = m->coldp - m->offp;
		pmatch[0].rm_eo = endp - m->offp;
	}
	if (nmatch > 1) {
		assert(m->pmatch != NULL);
		for (i = 1; i < nmatch; i++)
			if (i <= m->g->nsub)
				pmatch[i] = m->pmatch[i];
			else {
				pmatch[i].rm_so = -1;
				pmatch[i].rm_eo = -1;
			}
	}

	if (m->pmatch != NULL)
		free((char *)m->pmatch);
	if (m->lastpos != NULL)
		free((char *)m->lastpos);
	STATETEARDOWN(m);
	return(0);
}

/*
 - dissect - figure out what matched what, no back references
 == static char *dissect(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst);
 */
static char *			/* == stop (success) always */
dissect(m, start, stop, startst, stopst)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
{
	register int i;
	register sopno ss;	/* start sop of current subRE */
	register sopno es;	/* end sop of current subRE */
	register char *sp;	/* start of string matched by it */
	register char *stp;	/* string matched by it cannot pass here */
	register char *rest;	/* start of rest of string */
	register char *tail;	/* string unmatched by rest of RE */
	register sopno ssub;	/* start sop of subsubRE */
	register sopno esub;	/* end sop of subsubRE */
	register char *ssp;	/* start of string matched by subsubRE */
	register char *sep;	/* end of string matched by subsubRE */
	register char *oldssp;	/* previous ssp */
	register char *dp;

	AT("diss", start, stop, startst, stopst);
	sp = start;
	for (ss = startst; ss < stopst; ss = es) {
		/* identify end of subRE */
		es = ss;
		switch (OP(m->g->strip[es])) {
		case OPLUS_:
		case OQUEST_:
			es += OPND(m->g->strip[es]);
			break;
		case OCH_:
			while (OP(m->g->strip[es]) != O_CH)
				es += OPND(m->g->strip[es]);
			break;
		}
		es++;

		/* figure out what it matched */
		switch (OP(m->g->strip[ss])) {
		case OEND:
			assert(nope);
			break;
		case OCHAR:
			sp++;
			break;
		case OBOL:
		case OEOL:
		case OBOW:
		case OEOW:
			break;
		case OANY:
		case OANYOF:
			sp++;
			break;
		case OBACK_:
		case O_BACK:
			assert(nope);
			break;
		/* cases where length of match is hard to find */
		case OQUEST_:
			stp = stop;
			for (;;) {
				/* how long could this one be? */
				rest = slow(m, sp, stp, ss, es);
				assert(rest != NULL);	/* it did match */
				/* could the rest match the rest? */
				tail = slow(m, rest, stop, es, stopst);
				if (tail == stop)
					break;		/* yes! */
				/* no -- try a shorter match for this one */
				stp = rest - 1;
				assert(stp >= sp);	/* it did work */
			}
			ssub = ss + 1;
			esub = es - 1;
			/* did innards match? */
			if (slow(m, sp, rest, ssub, esub) != NULL) {
				dp = dissect(m, sp, rest, ssub, esub);
				assert(dp == rest);
			} else		/* no */
				assert(sp == rest);
			sp = rest;
			break;
		case OPLUS_:
			stp = stop;
			for (;;) {
				/* how long could this one be? */
				rest = slow(m, sp, stp, ss, es);
				assert(rest != NULL);	/* it did match */
				/* could the rest match the rest? */
				tail = slow(m, rest, stop, es, stopst);
				if (tail == stop)
					break;		/* yes! */
				/* no -- try a shorter match for this one */
				stp = rest - 1;
				assert(stp >= sp);	/* it did work */
			}
			ssub = ss + 1;
			esub = es - 1;
			ssp = sp;
			oldssp = ssp;
			for (;;) {	/* find last match of innards */
				sep = slow(m, ssp, rest, ssub, esub);
				if (sep == NULL || sep == ssp)
					break;	/* failed or matched null */
				oldssp = ssp;	/* on to next try */
				ssp = sep;
			}
			if (sep == NULL) {
				/* last successful match */
				sep = ssp;
				ssp = oldssp;
			}
			assert(sep == rest);	/* must exhaust substring */
			assert(slow(m, ssp, sep, ssub, esub) == rest);
			dp = dissect(m, ssp, sep, ssub, esub);
			assert(dp == sep);
			sp = rest;
			break;
		case OCH_:
			stp = stop;
			for (;;) {
				/* how long could this one be? */
				rest = slow(m, sp, stp, ss, es);
				assert(rest != NULL);	/* it did match */
				/* could the rest match the rest? */
				tail = slow(m, rest, stop, es, stopst);
				if (tail == stop)
					break;		/* yes! */
				/* no -- try a shorter match for this one */
				stp = rest - 1;
				assert(stp >= sp);	/* it did work */
			}
			ssub = ss + 1;
			esub = ss + OPND(m->g->strip[ss]) - 1;
			assert(OP(m->g->strip[esub]) == OOR1);
			for (;;) {	/* find first matching branch */
				if (slow(m, sp, rest, ssub, esub) == rest)
					break;	/* it matched all of it */
				/* that one missed, try next one */
				assert(OP(m->g->strip[esub]) == OOR1);
				esub++;
				assert(OP(m->g->strip[esub]) == OOR2);
				ssub = esub + 1;
				esub += OPND(m->g->strip[esub]);
				if (OP(m->g->strip[esub]) == OOR2)
					esub--;
				else
					assert(OP(m->g->strip[esub]) == O_CH);
			}
			dp = dissect(m, sp, rest, ssub, esub);
			assert(dp == rest);
			sp = rest;
			break;
		case O_PLUS:
		case O_QUEST:
		case OOR1:
		case OOR2:
		case O_CH:
			assert(nope);
			break;
		case OLPAREN:
			i = OPND(m->g->strip[ss]);
			assert(0 < i && i <= m->g->nsub);
			m->pmatch[i].rm_so = sp - m->offp;
			break;
		case ORPAREN:
			i = OPND(m->g->strip[ss]);
			assert(0 < i && i <= m->g->nsub);
			m->pmatch[i].rm_eo = sp - m->offp;
			break;
		default:		/* uh oh */
			assert(nope);
			break;
		}
	}

	assert(sp == stop);
	return(sp);
}

/*
 - backref - figure out what matched what, figuring in back references
 == static char *backref(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst, sopno lev);
 */
static char *			/* == stop (success) or NULL (failure) */
backref(m, start, stop, startst, stopst, lev)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
sopno lev;			/* PLUS nesting level */
{
	register int i;
	register sopno ss;	/* start sop of current subRE */
	register char *sp;	/* start of string matched by it */
	register sopno ssub;	/* start sop of subsubRE */
	register sopno esub;	/* end sop of subsubRE */
	register char *ssp;	/* start of string matched by subsubRE */
	register char *dp;
	register size_t len;
	register int hard;
	register sop s;
	register regoff_t offsave;
	register cset *cs;

	AT("back", start, stop, startst, stopst);
	sp = start;

	/* get as far as we can with easy stuff */
	hard = 0;
	for (ss = startst; !hard && ss < stopst; ss++)
		switch (OP(s = m->g->strip[ss])) {
		case OCHAR:
			if (sp == stop || *sp++ != (char)OPND(s))
				return(NULL);
			break;
		case OANY:
			if (sp == stop)
				return(NULL);
			sp++;
			break;
		case OANYOF:
			cs = &m->g->sets[OPND(s)];
			if (sp == stop || !CHIN(cs, *sp++))
				return(NULL);
			break;
		case OBOL:
			if ( (sp == m->beginp && !(m->eflags®_NOTBOL)) ||
					(sp < m->endp && *(sp-1) == '\n' &&
						(m->g->cflags®_NEWLINE)) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case OEOL:
			if ( (sp == m->endp && !(m->eflags®_NOTEOL)) ||
					(sp < m->endp && *sp == '\n' &&
						(m->g->cflags®_NEWLINE)) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case OBOW:
			if (( (sp == m->beginp && !(m->eflags®_NOTBOL)) ||
					(sp < m->endp && *(sp-1) == '\n' &&
						(m->g->cflags®_NEWLINE)) ||
					(sp > m->beginp &&
							!ISWORD(*(sp-1))) ) &&
					(sp < m->endp && ISWORD(*sp)) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case OEOW:
			if (( (sp == m->endp && !(m->eflags®_NOTEOL)) ||
					(sp < m->endp && *sp == '\n' &&
						(m->g->cflags®_NEWLINE)) ||
					(sp < m->endp && !ISWORD(*sp)) ) &&
					(sp > m->beginp && ISWORD(*(sp-1))) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case O_QUEST:
			break;
		case OOR1:	/* matches null but needs to skip */
			ss++;
			s = m->g->strip[ss];
			do {
				assert(OP(s) == OOR2);
				ss += OPND(s);
			} while (OP(s = m->g->strip[ss]) != O_CH);
			/* note that the ss++ gets us past the O_CH */
			break;
		default:	/* have to make a choice */
			hard = 1;
			break;
		}
	if (!hard) {		/* that was it! */
		if (sp != stop)
			return(NULL);
		return(sp);
	}
	ss--;			/* adjust for the for's final increment */

	/* the hard stuff */
	AT("hard", sp, stop, ss, stopst);
	s = m->g->strip[ss];
	switch (OP(s)) {
	case OBACK_:		/* the vilest depths */
		i = OPND(s);
		assert(0 < i && i <= m->g->nsub);
		if (m->pmatch[i].rm_eo == -1)
			return(NULL);
		assert(m->pmatch[i].rm_so != -1);
		len = m->pmatch[i].rm_eo - m->pmatch[i].rm_so;
		assert(stop - m->beginp >= len);
		if (sp > stop - len)
			return(NULL);	/* not enough left to match */
		ssp = m->offp + m->pmatch[i].rm_so;
		if (memcmp(sp, ssp, len) != 0)
			return(NULL);
		while (m->g->strip[ss] != SOP(O_BACK, i))
			ss++;
		return(backref(m, sp+len, stop, ss+1, stopst, lev));
		break;
	case OQUEST_:		/* to null or not */
		dp = backref(m, sp, stop, ss+1, stopst, lev);
		if (dp != NULL)
			return(dp);	/* not */
		return(backref(m, sp, stop, ss+OPND(s)+1, stopst, lev));
		break;
	case OPLUS_:
		assert(m->lastpos != NULL);
		assert(lev+1 <= m->g->nplus);
		m->lastpos[lev+1] = sp;
		return(backref(m, sp, stop, ss+1, stopst, lev+1));
		break;
	case O_PLUS:
		if (sp == m->lastpos[lev])	/* last pass matched null */
			return(backref(m, sp, stop, ss+1, stopst, lev-1));
		/* try another pass */
		m->lastpos[lev] = sp;
		dp = backref(m, sp, stop, ss-OPND(s)+1, stopst, lev);
		if (dp == NULL)
			return(backref(m, sp, stop, ss+1, stopst, lev-1));
		else
			return(dp);
		break;
	case OCH_:		/* find the right one, if any */
		ssub = ss + 1;
		esub = ss + OPND(s) - 1;
		assert(OP(m->g->strip[esub]) == OOR1);
		for (;;) {	/* find first matching branch */
			dp = backref(m, sp, stop, ssub, esub, lev);
			if (dp != NULL)
				return(dp);
			/* that one missed, try next one */
			if (OP(m->g->strip[esub]) == O_CH)
				return(NULL);	/* there is none */
			esub++;
			assert(OP(m->g->strip[esub]) == OOR2);
			ssub = esub + 1;
			esub += OPND(m->g->strip[esub]);
			if (OP(m->g->strip[esub]) == OOR2)
				esub--;
			else
				assert(OP(m->g->strip[esub]) == O_CH);
		}
		break;
	case OLPAREN:		/* must undo assignment if rest fails */
		i = OPND(s);
		assert(0 < i && i <= m->g->nsub);
		offsave = m->pmatch[i].rm_so;
		m->pmatch[i].rm_so = sp - m->offp;
		dp = backref(m, sp, stop, ss+1, stopst, lev);
		if (dp != NULL)
			return(dp);
		m->pmatch[i].rm_so = offsave;
		return(NULL);
		break;
	case ORPAREN:		/* must undo assignment if rest fails */
		i = OPND(s);
		assert(0 < i && i <= m->g->nsub);
		offsave = m->pmatch[i].rm_eo;
		m->pmatch[i].rm_eo = sp - m->offp;
		dp = backref(m, sp, stop, ss+1, stopst, lev);
		if (dp != NULL)
			return(dp);
		m->pmatch[i].rm_eo = offsave;
		return(NULL);
		break;
	default:		/* uh oh */
		assert(nope);
		break;
	}

	/* "can't happen" */
	assert(nope);
	/* NOTREACHED */
	return((char *)NULL);	/* dummy */
}

/*
 - fast - step through the string at top speed
 == static char *fast(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst);
 */
static char *			/* where tentative match ended, or NULL */
fast(m, start, stop, startst, stopst)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
{
	register states st = m->st;
	register states fresh = m->fresh;
	register states tmp = m->tmp;
	register char *p = start;
	register int c = (start == m->beginp) ? OUT : *(start-1);
	register int lastc;	/* previous c */
	register int flagch;
	register int i;
	register char *coldp;	/* last p after which no match was underway */

	CLEAR(st);
	SET1(st, startst);
	st = step(m->g, startst, stopst, st, NOTHING, st);
	ASSIGN(fresh, st);
	SP("start", st, *p);
	coldp = NULL;
	for (;;) {
		/* next character */
		lastc = c;
		c = (p == m->endp) ? OUT : *p;
		if (EQ(st, fresh))
			coldp = p;

		/* is there an EOL and/or BOL between lastc and c? */
		flagch = '\0';
		i = 0;
		if ( (lastc == '\n' && m->g->cflags®_NEWLINE) ||
				(lastc == OUT && !(m->eflags®_NOTBOL)) ) {
			flagch = BOL;
			i = m->g->nbol;
		}
		if ( (c == '\n' && m->g->cflags®_NEWLINE) ||
				(c == OUT && !(m->eflags®_NOTEOL)) ) {
			flagch = (flagch == BOL) ? BOLEOL : EOL;
			i += m->g->neol;
		}
		if (i != 0) {
			for (; i > 0; i--)
				st = step(m->g, startst, stopst, st, flagch, st);
			SP("boleol", st, c);
		}

		/* how about a word boundary? */
		if ( (flagch == BOL || (lastc != OUT && !ISWORD(lastc))) &&
					(c != OUT && ISWORD(c)) ) {
			flagch = BOW;
		}
		if ( (lastc != OUT && ISWORD(lastc)) &&
				(flagch == EOL || (c != OUT && !ISWORD(c))) ) {
			flagch = EOW;
		}
		if (flagch == BOW || flagch == EOW) {
			st = step(m->g, startst, stopst, st, flagch, st);
			SP("boweow", st, c);
		}

		/* are we done? */
		if (ISSET(st, stopst) || p == stop)
			break;		/* NOTE BREAK OUT */

		/* no, we must deal with this character */
		ASSIGN(tmp, st);
		ASSIGN(st, fresh);
		assert(c != OUT);
		st = step(m->g, startst, stopst, tmp, c, st);
		SP("aft", st, c);
		assert(EQ(step(m->g, startst, stopst, st, NOTHING, st), st));
		p++;
	}

	assert(coldp != NULL);
	m->coldp = coldp;
	if (ISSET(st, stopst))
		return(p+1);
	else
		return(NULL);
}

/*
 - slow - step through the string more deliberately
 == static char *slow(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst);
 */
static char *			/* where it ended */
slow(m, start, stop, startst, stopst)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
{
	register states st = m->st;
	register states empty = m->empty;
	register states tmp = m->tmp;
	register char *p = start;
	register int c = (start == m->beginp) ? OUT : *(start-1);
	register int lastc;	/* previous c */
	register int flagch;
	register int i;
	register char *matchp;	/* last p at which a match ended */

	AT("slow", start, stop, startst, stopst);
	CLEAR(st);
	SET1(st, startst);
	SP("sstart", st, *p);
	st = step(m->g, startst, stopst, st, NOTHING, st);
	matchp = NULL;
	for (;;) {
		/* next character */
		lastc = c;
		c = (p == m->endp) ? OUT : *p;

		/* is there an EOL and/or BOL between lastc and c? */
		flagch = '\0';
		i = 0;
		if ( (lastc == '\n' && m->g->cflags®_NEWLINE) ||
				(lastc == OUT && !(m->eflags®_NOTBOL)) ) {
			flagch = BOL;
			i = m->g->nbol;
		}
		if ( (c == '\n' && m->g->cflags®_NEWLINE) ||
				(c == OUT && !(m->eflags®_NOTEOL)) ) {
			flagch = (flagch == BOL) ? BOLEOL : EOL;
			i += m->g->neol;
		}
		if (i != 0) {
			for (; i > 0; i--)
				st = step(m->g, startst, stopst, st, flagch, st);
			SP("sboleol", st, c);
		}

		/* how about a word boundary? */
		if ( (flagch == BOL || (lastc != OUT && !ISWORD(lastc))) &&
					(c != OUT && ISWORD(c)) ) {
			flagch = BOW;
		}
		if ( (lastc != OUT && ISWORD(lastc)) &&
				(flagch == EOL || (c != OUT && !ISWORD(c))) ) {
			flagch = EOW;
		}
		if (flagch == BOW || flagch == EOW) {
			st = step(m->g, startst, stopst, st, flagch, st);
			SP("sboweow", st, c);
		}

		/* are we done? */
		if (ISSET(st, stopst))
			matchp = p;
		if (EQ(st, empty) || p == stop)
			break;		/* NOTE BREAK OUT */

		/* no, we must deal with this character */
		ASSIGN(tmp, st);
		ASSIGN(st, empty);
		assert(c != OUT);
		st = step(m->g, startst, stopst, tmp, c, st);
		SP("saft", st, c);
		assert(EQ(step(m->g, startst, stopst, st, NOTHING, st), st));
		p++;
	}

	return(matchp);
}


/*
 - step - map set of states reachable before char to set reachable after
 == static states step(register struct re_guts *g, sopno start, sopno stop, \
 ==	register states bef, int ch, register states aft);
 == #define	BOL	(OUT+1)
 == #define	EOL	(BOL+1)
 == #define	BOLEOL	(BOL+2)
 == #define	NOTHING	(BOL+3)
 == #define	BOW	(BOL+4)
 == #define	EOW	(BOL+5)
 == #define	CODEMAX	(BOL+5)		// highest code used
 == #define	NONCHAR(c)	((c) > CHAR_MAX)
 == #define	NNONCHAR	(CODEMAX-CHAR_MAX)
 */
static states
step(g, start, stop, bef, ch, aft)
register struct re_guts *g;
sopno start;			/* start state within strip */
sopno stop;			/* state after stop state within strip */
register states bef;		/* states reachable before */
int ch;				/* character or NONCHAR code */
register states aft;		/* states already known reachable after */
{
	register cset *cs;
	register sop s;
	register sopno pc;
	register onestate here;		/* note, macros know this name */
	register sopno look;
	register long i;

	for (pc = start, INIT(here, pc); pc != stop; pc++, INC(here)) {
		s = g->strip[pc];
		switch (OP(s)) {
		case OEND:
			assert(pc == stop-1);
			break;
		case OCHAR:
			/* only characters can match */
			assert(!NONCHAR(ch) || ch != (char)OPND(s));
			if (ch == (char)OPND(s))
				FWD(aft, bef, 1);
			break;
		case OBOL:
			if (ch == BOL || ch == BOLEOL)
				FWD(aft, bef, 1);
			break;
		case OEOL:
			if (ch == EOL || ch == BOLEOL)
				FWD(aft, bef, 1);
			break;
		case OBOW:
			if (ch == BOW)
				FWD(aft, bef, 1);
			break;
		case OEOW:
			if (ch == EOW)
				FWD(aft, bef, 1);
			break;
		case OANY:
			if (!NONCHAR(ch))
				FWD(aft, bef, 1);
			break;
		case OANYOF:
			cs = &g->sets[OPND(s)];
			if (!NONCHAR(ch) && CHIN(cs, ch))
				FWD(aft, bef, 1);
			break;
		case OBACK_:		/* ignored here */
		case O_BACK:
			FWD(aft, aft, 1);
			break;
		case OPLUS_:		/* forward, this is just an empty */
			FWD(aft, aft, 1);
			break;
		case O_PLUS:		/* both forward and back */
			FWD(aft, aft, 1);
			i = ISSETBACK(aft, OPND(s));
			BACK(aft, aft, OPND(s));
			if (!i && ISSETBACK(aft, OPND(s))) {
				/* oho, must reconsider loop body */
				pc -= OPND(s) + 1;
				INIT(here, pc);
			}
			break;
		case OQUEST_:		/* two branches, both forward */
			FWD(aft, aft, 1);
			FWD(aft, aft, OPND(s));
			break;
		case O_QUEST:		/* just an empty */
			FWD(aft, aft, 1);
			break;
		case OLPAREN:		/* not significant here */
		case ORPAREN:
			FWD(aft, aft, 1);
			break;
		case OCH_:		/* mark the first two branches */
			FWD(aft, aft, 1);
			assert(OP(g->strip[pc+OPND(s)]) == OOR2);
			FWD(aft, aft, OPND(s));
			break;
		case OOR1:		/* done a branch, find the O_CH */
			if (ISSTATEIN(aft, here)) {
				for (look = 1;
						OP(s = g->strip[pc+look]) != O_CH;
						look += OPND(s))
					assert(OP(s) == OOR2);
				FWD(aft, aft, look);
			}
			break;
		case OOR2:		/* propagate OCH_'s marking */
			FWD(aft, aft, 1);
			if (OP(g->strip[pc+OPND(s)]) != O_CH) {
				assert(OP(g->strip[pc+OPND(s)]) == OOR2);
				FWD(aft, aft, OPND(s));
			}
			break;
		case O_CH:		/* just empty */
			FWD(aft, aft, 1);
			break;
		default:		/* ooooops... */
			assert(nope);
			break;
		}
	}

	return(aft);
}

#undef	matcher
#undef	fast
#undef	slow
#undef	dissect
#undef	backref
#undef	step
#undef	print
#undef	at
#undef	match

/* now undo things */
#undef	states
#undef	CLEAR
#undef	SET0
#undef	SET1
#undef	ISSET
#undef	ASSIGN
#undef	EQ
#undef	STATEVARS
#undef	STATESETUP
#undef	STATETEARDOWN
#undef	SETUP
#undef	onestate
#undef	INIT
#undef	INC
#undef	ISSTATEIN
#undef	FWD
#undef	BACK
#undef	ISSETBACK
#undef	SNAMES

/* macros for manipulating states, large version */
#define	states	char *
#define	CLEAR(v)	memset(v, 0, m->g->nstates)
#define	SET0(v, n)	((v)[n] = 0)
#define	SET1(v, n)	((v)[n] = 1)
#define	ISSET(v, n)	((v)[n])
#define	ASSIGN(d, s)	memcpy(d, s, m->g->nstates)
#define	EQ(a, b)	(memcmp(a, b, m->g->nstates) == 0)
#define	STATEVARS	int vn; char *space
#define	STATESETUP(m, nv)	{ (m)->space = malloc((nv)*(m)->g->nstates); \
				if ((m)->space == NULL) return(REG_ESPACE); \
				(m)->vn = 0; }
#define	STATETEARDOWN(m)	{ free((m)->space); }
#define	SETUP(v)	((v) = &m->space[m->vn++ * m->g->nstates])
#define	onestate	int
#define	INIT(o, n)	((o) = (n))
#define	INC(o)	((o)++)
#define	ISSTATEIN(v, o)	((v)[o])
/* some abbreviations; note that some of these know variable names! */
/* do "if I'm here, I can also be there" etc without branches */
#define	FWD(dst, src, n)	((dst)[here+(n)] |= (src)[here])
#define	BACK(dst, src, n)	((dst)[here-(n)] |= (src)[here])
#define	ISSETBACK(v, n)	((v)[here - (n)])
/* function names */
#define	LNAMES			/* flag */

/*
 * The matching engine and friends.  This file is #included by regexec.c
 * after suitable #defines of a variety of macros used herein, so that
 * different state representations can be used without duplicating masses
 * of code.
 */

#ifdef SNAMES
#define	matcher	smatcher
#define	fast	sfast
#define	slow	sslow
#define	dissect	sdissect
#define	backref	sbackref
#define	step	sstep
#define	print	sprint
#define	at	sat
#define	match	smat
#endif
#ifdef LNAMES
#define	matcher	lmatcher
#define	fast	lfast
#define	slow	lslow
#define	dissect	ldissect
#define	backref	lbackref
#define	step	lstep
#define	print	lprint
#define	at	lat
#define	match	lmat
#endif

/* another structure passed up and down to avoid zillions of parameters */
struct match {
	struct re_guts *g;
	int eflags;
	regmatch_t *pmatch;	/* [nsub+1] (0 element unused) */
	char *offp;		/* offsets work from here */
	char *beginp;		/* start of string -- virtual NUL precedes */
	char *endp;		/* end of string -- virtual NUL here */
	char *coldp;		/* can be no match starting before here */
	char **lastpos;		/* [nplus+1] */
	STATEVARS;
	states st;		/* current states */
	states fresh;		/* states for a fresh start */
	states tmp;		/* temporary */
	states empty;		/* empty set of states */
};

static int matcher(register struct re_guts *g, char *string, size_t nmatch, regmatch_t pmatch[], int eflags);
static char *dissect(register struct match *m, char *start, char *stop, sopno startst, sopno stopst);
static char *backref(register struct match *m, char *start, char *stop, sopno startst, sopno stopst, sopno lev);
static char *fast(register struct match *m, char *start, char *stop, sopno startst, sopno stopst);
static char *slow(register struct match *m, char *start, char *stop, sopno startst, sopno stopst);
static states step(register struct re_guts *g, sopno start, sopno stop, register states bef, int ch, register states aft);
#define	BOL	(OUT+1)
#define	EOL	(BOL+1)
#define	BOLEOL	(BOL+2)
#define	NOTHING	(BOL+3)
#define	BOW	(BOL+4)
#define	EOW	(BOL+5)
#define	CODEMAX	(BOL+5)		/* highest code used */
#define	NONCHAR(c)	((c) > CHAR_MAX)
#define	NNONCHAR	(CODEMAX-CHAR_MAX)
#define	SP(t, s, c)	/* nothing */
#define	AT(t, p1, p2, s1, s2)	/* nothing */
#define	NOTE(s)	/* nothing */

/*
 - matcher - the actual matching engine
 == static int matcher(register struct re_guts *g, char *string, \
 ==	size_t nmatch, regmatch_t pmatch[], int eflags);
 */
static int			/* 0 success, REG_NOMATCH failure */
matcher(g, string, nmatch, pmatch, eflags)
register struct re_guts *g;
char *string;
size_t nmatch;
regmatch_t pmatch[];
int eflags;
{
	register char *endp;
	register int i;
	struct match mv;
	register struct match *m = &mv;
	register char *dp;
	const register sopno gf = g->firststate+1;	/* +1 for OEND */
	const register sopno gl = g->laststate;
	char *start;
	char *stop;

	/* simplify the situation where possible */
	if (g->cflags®_NOSUB)
		nmatch = 0;
	if (eflags®_STARTEND) {
		start = string + pmatch[0].rm_so;
		stop = string + pmatch[0].rm_eo;
	} else {
		start = string;
		stop = start + strlen(start);
	}
	if (stop < start)
		return(REG_INVARG);

	/* prescreening; this does wonders for this rather slow code */
	if (g->must != NULL) {
		for (dp = start; dp < stop; dp++)
			if (*dp == g->must[0] && stop - dp >= g->mlen &&
				memcmp(dp, g->must, (size_t)g->mlen) == 0)
				break;
		if (dp == stop)		/* we didn't find g->must */
			return(REG_NOMATCH);
	}

	/* match struct setup */
	m->g = g;
	m->eflags = eflags;
	m->pmatch = NULL;
	m->lastpos = NULL;
	m->offp = string;
	m->beginp = start;
	m->endp = stop;
	STATESETUP(m, 4);
	SETUP(m->st);
	SETUP(m->fresh);
	SETUP(m->tmp);
	SETUP(m->empty);
	CLEAR(m->empty);

	/* this loop does only one repetition except for backrefs */
	for (;;) {
		endp = fast(m, start, stop, gf, gl);
		if (endp == NULL) {		/* a miss */
			STATETEARDOWN(m);
			return(REG_NOMATCH);
		}
		if (nmatch == 0 && !g->backrefs)
			break;		/* no further info needed */

		/* where? */
		assert(m->coldp != NULL);
		for (;;) {
			NOTE("finding start");
			endp = slow(m, m->coldp, stop, gf, gl);
			if (endp != NULL)
				break;
			assert(m->coldp < m->endp);
			m->coldp++;
		}
		if (nmatch == 1 && !g->backrefs)
			break;		/* no further info needed */

		/* oh my, he wants the subexpressions... */
		if (m->pmatch == NULL)
			m->pmatch = (regmatch_t *)malloc((m->g->nsub + 1) *
							sizeof(regmatch_t));
		if (m->pmatch == NULL) {
			STATETEARDOWN(m);
			return(REG_ESPACE);
		}
		for (i = 1; i <= m->g->nsub; i++)
			m->pmatch[i].rm_so = m->pmatch[i].rm_eo = -1;
		if (!g->backrefs && !(m->eflags®_BACKR)) {
			NOTE("dissecting");
			dp = dissect(m, m->coldp, endp, gf, gl);
		} else {
			if (g->nplus > 0 && m->lastpos == NULL)
				m->lastpos = (char **)malloc((g->nplus+1) *
							sizeof(char *));
			if (g->nplus > 0 && m->lastpos == NULL) {
				free(m->pmatch);
				STATETEARDOWN(m);
				return(REG_ESPACE);
			}
			NOTE("backref dissect");
			dp = backref(m, m->coldp, endp, gf, gl, (sopno)0);
		}
		if (dp != NULL)
			break;

		/* uh-oh... we couldn't find a subexpression-level match */
		assert(g->backrefs);	/* must be back references doing it */
		assert(g->nplus == 0 || m->lastpos != NULL);
		for (;;) {
			if (dp != NULL || endp <= m->coldp)
				break;		/* defeat */
			NOTE("backoff");
			endp = slow(m, m->coldp, endp-1, gf, gl);
			if (endp == NULL)
				break;		/* defeat */
			/* try it on a shorter possibility */
			NOTE("backoff dissect");
			dp = backref(m, m->coldp, endp, gf, gl, (sopno)0);
		}
		assert(dp == NULL || dp == endp);
		if (dp != NULL)		/* found a shorter one */
			break;

		/* despite initial appearances, there is no match here */
		NOTE("false alarm");
		start = m->coldp + 1;	/* recycle starting later */
		assert(start <= stop);
	}

	/* fill in the details if requested */
	if (nmatch > 0) {
		pmatch[0].rm_so = m->coldp - m->offp;
		pmatch[0].rm_eo = endp - m->offp;
	}
	if (nmatch > 1) {
		assert(m->pmatch != NULL);
		for (i = 1; i < nmatch; i++)
			if (i <= m->g->nsub)
				pmatch[i] = m->pmatch[i];
			else {
				pmatch[i].rm_so = -1;
				pmatch[i].rm_eo = -1;
			}
	}

	if (m->pmatch != NULL)
		free((char *)m->pmatch);
	if (m->lastpos != NULL)
		free((char *)m->lastpos);
	STATETEARDOWN(m);
	return(0);
}

/*
 - dissect - figure out what matched what, no back references
 == static char *dissect(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst);
 */
static char *			/* == stop (success) always */
dissect(m, start, stop, startst, stopst)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
{
	register int i;
	register sopno ss;	/* start sop of current subRE */
	register sopno es;	/* end sop of current subRE */
	register char *sp;	/* start of string matched by it */
	register char *stp;	/* string matched by it cannot pass here */
	register char *rest;	/* start of rest of string */
	register char *tail;	/* string unmatched by rest of RE */
	register sopno ssub;	/* start sop of subsubRE */
	register sopno esub;	/* end sop of subsubRE */
	register char *ssp;	/* start of string matched by subsubRE */
	register char *sep;	/* end of string matched by subsubRE */
	register char *oldssp;	/* previous ssp */
	register char *dp;

	AT("diss", start, stop, startst, stopst);
	sp = start;
	for (ss = startst; ss < stopst; ss = es) {
		/* identify end of subRE */
		es = ss;
		switch (OP(m->g->strip[es])) {
		case OPLUS_:
		case OQUEST_:
			es += OPND(m->g->strip[es]);
			break;
		case OCH_:
			while (OP(m->g->strip[es]) != O_CH)
				es += OPND(m->g->strip[es]);
			break;
		}
		es++;

		/* figure out what it matched */
		switch (OP(m->g->strip[ss])) {
		case OEND:
			assert(nope);
			break;
		case OCHAR:
			sp++;
			break;
		case OBOL:
		case OEOL:
		case OBOW:
		case OEOW:
			break;
		case OANY:
		case OANYOF:
			sp++;
			break;
		case OBACK_:
		case O_BACK:
			assert(nope);
			break;
		/* cases where length of match is hard to find */
		case OQUEST_:
			stp = stop;
			for (;;) {
				/* how long could this one be? */
				rest = slow(m, sp, stp, ss, es);
				assert(rest != NULL);	/* it did match */
				/* could the rest match the rest? */
				tail = slow(m, rest, stop, es, stopst);
				if (tail == stop)
					break;		/* yes! */
				/* no -- try a shorter match for this one */
				stp = rest - 1;
				assert(stp >= sp);	/* it did work */
			}
			ssub = ss + 1;
			esub = es - 1;
			/* did innards match? */
			if (slow(m, sp, rest, ssub, esub) != NULL) {
				dp = dissect(m, sp, rest, ssub, esub);
				assert(dp == rest);
			} else		/* no */
				assert(sp == rest);
			sp = rest;
			break;
		case OPLUS_:
			stp = stop;
			for (;;) {
				/* how long could this one be? */
				rest = slow(m, sp, stp, ss, es);
				assert(rest != NULL);	/* it did match */
				/* could the rest match the rest? */
				tail = slow(m, rest, stop, es, stopst);
				if (tail == stop)
					break;		/* yes! */
				/* no -- try a shorter match for this one */
				stp = rest - 1;
				assert(stp >= sp);	/* it did work */
			}
			ssub = ss + 1;
			esub = es - 1;
			ssp = sp;
			oldssp = ssp;
			for (;;) {	/* find last match of innards */
				sep = slow(m, ssp, rest, ssub, esub);
				if (sep == NULL || sep == ssp)
					break;	/* failed or matched null */
				oldssp = ssp;	/* on to next try */
				ssp = sep;
			}
			if (sep == NULL) {
				/* last successful match */
				sep = ssp;
				ssp = oldssp;
			}
			assert(sep == rest);	/* must exhaust substring */
			assert(slow(m, ssp, sep, ssub, esub) == rest);
			dp = dissect(m, ssp, sep, ssub, esub);
			assert(dp == sep);
			sp = rest;
			break;
		case OCH_:
			stp = stop;
			for (;;) {
				/* how long could this one be? */
				rest = slow(m, sp, stp, ss, es);
				assert(rest != NULL);	/* it did match */
				/* could the rest match the rest? */
				tail = slow(m, rest, stop, es, stopst);
				if (tail == stop)
					break;		/* yes! */
				/* no -- try a shorter match for this one */
				stp = rest - 1;
				assert(stp >= sp);	/* it did work */
			}
			ssub = ss + 1;
			esub = ss + OPND(m->g->strip[ss]) - 1;
			assert(OP(m->g->strip[esub]) == OOR1);
			for (;;) {	/* find first matching branch */
				if (slow(m, sp, rest, ssub, esub) == rest)
					break;	/* it matched all of it */
				/* that one missed, try next one */
				assert(OP(m->g->strip[esub]) == OOR1);
				esub++;
				assert(OP(m->g->strip[esub]) == OOR2);
				ssub = esub + 1;
				esub += OPND(m->g->strip[esub]);
				if (OP(m->g->strip[esub]) == OOR2)
					esub--;
				else
					assert(OP(m->g->strip[esub]) == O_CH);
			}
			dp = dissect(m, sp, rest, ssub, esub);
			assert(dp == rest);
			sp = rest;
			break;
		case O_PLUS:
		case O_QUEST:
		case OOR1:
		case OOR2:
		case O_CH:
			assert(nope);
			break;
		case OLPAREN:
			i = OPND(m->g->strip[ss]);
			assert(0 < i && i <= m->g->nsub);
			m->pmatch[i].rm_so = sp - m->offp;
			break;
		case ORPAREN:
			i = OPND(m->g->strip[ss]);
			assert(0 < i && i <= m->g->nsub);
			m->pmatch[i].rm_eo = sp - m->offp;
			break;
		default:		/* uh oh */
			assert(nope);
			break;
		}
	}

	assert(sp == stop);
	return(sp);
}

/*
 - backref - figure out what matched what, figuring in back references
 == static char *backref(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst, sopno lev);
 */
static char *			/* == stop (success) or NULL (failure) */
backref(m, start, stop, startst, stopst, lev)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
sopno lev;			/* PLUS nesting level */
{
	register int i;
	register sopno ss;	/* start sop of current subRE */
	register char *sp;	/* start of string matched by it */
	register sopno ssub;	/* start sop of subsubRE */
	register sopno esub;	/* end sop of subsubRE */
	register char *ssp;	/* start of string matched by subsubRE */
	register char *dp;
	register size_t len;
	register int hard;
	register sop s;
	register regoff_t offsave;
	register cset *cs;

	AT("back", start, stop, startst, stopst);
	sp = start;

	/* get as far as we can with easy stuff */
	hard = 0;
	for (ss = startst; !hard && ss < stopst; ss++)
		switch (OP(s = m->g->strip[ss])) {
		case OCHAR:
			if (sp == stop || *sp++ != (char)OPND(s))
				return(NULL);
			break;
		case OANY:
			if (sp == stop)
				return(NULL);
			sp++;
			break;
		case OANYOF:
			cs = &m->g->sets[OPND(s)];
			if (sp == stop || !CHIN(cs, *sp++))
				return(NULL);
			break;
		case OBOL:
			if ( (sp == m->beginp && !(m->eflags®_NOTBOL)) ||
					(sp < m->endp && *(sp-1) == '\n' &&
						(m->g->cflags®_NEWLINE)) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case OEOL:
			if ( (sp == m->endp && !(m->eflags®_NOTEOL)) ||
					(sp < m->endp && *sp == '\n' &&
						(m->g->cflags®_NEWLINE)) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case OBOW:
			if (( (sp == m->beginp && !(m->eflags®_NOTBOL)) ||
					(sp < m->endp && *(sp-1) == '\n' &&
						(m->g->cflags®_NEWLINE)) ||
					(sp > m->beginp &&
							!ISWORD(*(sp-1))) ) &&
					(sp < m->endp && ISWORD(*sp)) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case OEOW:
			if (( (sp == m->endp && !(m->eflags®_NOTEOL)) ||
					(sp < m->endp && *sp == '\n' &&
						(m->g->cflags®_NEWLINE)) ||
					(sp < m->endp && !ISWORD(*sp)) ) &&
					(sp > m->beginp && ISWORD(*(sp-1))) )
				{ /* yes */ }
			else
				return(NULL);
			break;
		case O_QUEST:
			break;
		case OOR1:	/* matches null but needs to skip */
			ss++;
			s = m->g->strip[ss];
			do {
				assert(OP(s) == OOR2);
				ss += OPND(s);
			} while (OP(s = m->g->strip[ss]) != O_CH);
			/* note that the ss++ gets us past the O_CH */
			break;
		default:	/* have to make a choice */
			hard = 1;
			break;
		}
	if (!hard) {		/* that was it! */
		if (sp != stop)
			return(NULL);
		return(sp);
	}
	ss--;			/* adjust for the for's final increment */

	/* the hard stuff */
	AT("hard", sp, stop, ss, stopst);
	s = m->g->strip[ss];
	switch (OP(s)) {
	case OBACK_:		/* the vilest depths */
		i = OPND(s);
		assert(0 < i && i <= m->g->nsub);
		if (m->pmatch[i].rm_eo == -1)
			return(NULL);
		assert(m->pmatch[i].rm_so != -1);
		len = m->pmatch[i].rm_eo - m->pmatch[i].rm_so;
		assert(stop - m->beginp >= len);
		if (sp > stop - len)
			return(NULL);	/* not enough left to match */
		ssp = m->offp + m->pmatch[i].rm_so;
		if (memcmp(sp, ssp, len) != 0)
			return(NULL);
		while (m->g->strip[ss] != SOP(O_BACK, i))
			ss++;
		return(backref(m, sp+len, stop, ss+1, stopst, lev));
		break;
	case OQUEST_:		/* to null or not */
		dp = backref(m, sp, stop, ss+1, stopst, lev);
		if (dp != NULL)
			return(dp);	/* not */
		return(backref(m, sp, stop, ss+OPND(s)+1, stopst, lev));
		break;
	case OPLUS_:
		assert(m->lastpos != NULL);
		assert(lev+1 <= m->g->nplus);
		m->lastpos[lev+1] = sp;
		return(backref(m, sp, stop, ss+1, stopst, lev+1));
		break;
	case O_PLUS:
		if (sp == m->lastpos[lev])	/* last pass matched null */
			return(backref(m, sp, stop, ss+1, stopst, lev-1));
		/* try another pass */
		m->lastpos[lev] = sp;
		dp = backref(m, sp, stop, ss-OPND(s)+1, stopst, lev);
		if (dp == NULL)
			return(backref(m, sp, stop, ss+1, stopst, lev-1));
		else
			return(dp);
		break;
	case OCH_:		/* find the right one, if any */
		ssub = ss + 1;
		esub = ss + OPND(s) - 1;
		assert(OP(m->g->strip[esub]) == OOR1);
		for (;;) {	/* find first matching branch */
			dp = backref(m, sp, stop, ssub, esub, lev);
			if (dp != NULL)
				return(dp);
			/* that one missed, try next one */
			if (OP(m->g->strip[esub]) == O_CH)
				return(NULL);	/* there is none */
			esub++;
			assert(OP(m->g->strip[esub]) == OOR2);
			ssub = esub + 1;
			esub += OPND(m->g->strip[esub]);
			if (OP(m->g->strip[esub]) == OOR2)
				esub--;
			else
				assert(OP(m->g->strip[esub]) == O_CH);
		}
		break;
	case OLPAREN:		/* must undo assignment if rest fails */
		i = OPND(s);
		assert(0 < i && i <= m->g->nsub);
		offsave = m->pmatch[i].rm_so;
		m->pmatch[i].rm_so = sp - m->offp;
		dp = backref(m, sp, stop, ss+1, stopst, lev);
		if (dp != NULL)
			return(dp);
		m->pmatch[i].rm_so = offsave;
		return(NULL);
		break;
	case ORPAREN:		/* must undo assignment if rest fails */
		i = OPND(s);
		assert(0 < i && i <= m->g->nsub);
		offsave = m->pmatch[i].rm_eo;
		m->pmatch[i].rm_eo = sp - m->offp;
		dp = backref(m, sp, stop, ss+1, stopst, lev);
		if (dp != NULL)
			return(dp);
		m->pmatch[i].rm_eo = offsave;
		return(NULL);
		break;
	default:		/* uh oh */
		assert(nope);
		break;
	}

	/* "can't happen" */
	assert(nope);
	/* NOTREACHED */
	return((char *)NULL);	/* dummy */
}

/*
 - fast - step through the string at top speed
 == static char *fast(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst);
 */
static char *			/* where tentative match ended, or NULL */
fast(m, start, stop, startst, stopst)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
{
	register states st = m->st;
	register states fresh = m->fresh;
	register states tmp = m->tmp;
	register char *p = start;
	register int c = (start == m->beginp) ? OUT : *(start-1);
	register int lastc;	/* previous c */
	register int flagch;
	register int i;
	register char *coldp;	/* last p after which no match was underway */

	CLEAR(st);
	SET1(st, startst);
	st = step(m->g, startst, stopst, st, NOTHING, st);
	ASSIGN(fresh, st);
	SP("start", st, *p);
	coldp = NULL;
	for (;;) {
		/* next character */
		lastc = c;
		c = (p == m->endp) ? OUT : *p;
		if (EQ(st, fresh))
			coldp = p;

		/* is there an EOL and/or BOL between lastc and c? */
		flagch = '\0';
		i = 0;
		if ( (lastc == '\n' && m->g->cflags®_NEWLINE) ||
				(lastc == OUT && !(m->eflags®_NOTBOL)) ) {
			flagch = BOL;
			i = m->g->nbol;
		}
		if ( (c == '\n' && m->g->cflags®_NEWLINE) ||
				(c == OUT && !(m->eflags®_NOTEOL)) ) {
			flagch = (flagch == BOL) ? BOLEOL : EOL;
			i += m->g->neol;
		}
		if (i != 0) {
			for (; i > 0; i--)
				st = step(m->g, startst, stopst, st, flagch, st);
			SP("boleol", st, c);
		}

		/* how about a word boundary? */
		if ( (flagch == BOL || (lastc != OUT && !ISWORD(lastc))) &&
					(c != OUT && ISWORD(c)) ) {
			flagch = BOW;
		}
		if ( (lastc != OUT && ISWORD(lastc)) &&
				(flagch == EOL || (c != OUT && !ISWORD(c))) ) {
			flagch = EOW;
		}
		if (flagch == BOW || flagch == EOW) {
			st = step(m->g, startst, stopst, st, flagch, st);
			SP("boweow", st, c);
		}

		/* are we done? */
		if (ISSET(st, stopst) || p == stop)
			break;		/* NOTE BREAK OUT */

		/* no, we must deal with this character */
		ASSIGN(tmp, st);
		ASSIGN(st, fresh);
		assert(c != OUT);
		st = step(m->g, startst, stopst, tmp, c, st);
		SP("aft", st, c);
		assert(EQ(step(m->g, startst, stopst, st, NOTHING, st), st));
		p++;
	}

	assert(coldp != NULL);
	m->coldp = coldp;
	if (ISSET(st, stopst))
		return(p+1);
	else
		return(NULL);
}

/*
 - slow - step through the string more deliberately
 == static char *slow(register struct match *m, char *start, \
 ==	char *stop, sopno startst, sopno stopst);
 */
static char *			/* where it ended */
slow(m, start, stop, startst, stopst)
register struct match *m;
char *start;
char *stop;
sopno startst;
sopno stopst;
{
	register states st = m->st;
	register states empty = m->empty;
	register states tmp = m->tmp;
	register char *p = start;
	register int c = (start == m->beginp) ? OUT : *(start-1);
	register int lastc;	/* previous c */
	register int flagch;
	register int i;
	register char *matchp;	/* last p at which a match ended */

	AT("slow", start, stop, startst, stopst);
	CLEAR(st);
	SET1(st, startst);
	SP("sstart", st, *p);
	st = step(m->g, startst, stopst, st, NOTHING, st);
	matchp = NULL;
	for (;;) {
		/* next character */
		lastc = c;
		c = (p == m->endp) ? OUT : *p;

		/* is there an EOL and/or BOL between lastc and c? */
		flagch = '\0';
		i = 0;
		if ( (lastc == '\n' && m->g->cflags®_NEWLINE) ||
				(lastc == OUT && !(m->eflags®_NOTBOL)) ) {
			flagch = BOL;
			i = m->g->nbol;
		}
		if ( (c == '\n' && m->g->cflags®_NEWLINE) ||
				(c == OUT && !(m->eflags®_NOTEOL)) ) {
			flagch = (flagch == BOL) ? BOLEOL : EOL;
			i += m->g->neol;
		}
		if (i != 0) {
			for (; i > 0; i--)
				st = step(m->g, startst, stopst, st, flagch, st);
			SP("sboleol", st, c);
		}

		/* how about a word boundary? */
		if ( (flagch == BOL || (lastc != OUT && !ISWORD(lastc))) &&
					(c != OUT && ISWORD(c)) ) {
			flagch = BOW;
		}
		if ( (lastc != OUT && ISWORD(lastc)) &&
				(flagch == EOL || (c != OUT && !ISWORD(c))) ) {
			flagch = EOW;
		}
		if (flagch == BOW || flagch == EOW) {
			st = step(m->g, startst, stopst, st, flagch, st);
			SP("sboweow", st, c);
		}

		/* are we done? */
		if (ISSET(st, stopst))
			matchp = p;
		if (EQ(st, empty) || p == stop)
			break;		/* NOTE BREAK OUT */

		/* no, we must deal with this character */
		ASSIGN(tmp, st);
		ASSIGN(st, empty);
		assert(c != OUT);
		st = step(m->g, startst, stopst, tmp, c, st);
		SP("saft", st, c);
		assert(EQ(step(m->g, startst, stopst, st, NOTHING, st), st));
		p++;
	}

	return(matchp);
}


static states
step(g, start, stop, bef, ch, aft)
register struct re_guts *g;
sopno start;			/* start state within strip */
sopno stop;			/* state after stop state within strip */
register states bef;		/* states reachable before */
int ch;				/* character or NONCHAR code */
register states aft;		/* states already known reachable after */
{
	register cset *cs;
	register sop s;
	register sopno pc;
	register onestate here;		/* note, macros know this name */
	register sopno look;
	register long i;

	for (pc = start, INIT(here, pc); pc != stop; pc++, INC(here)) {
		s = g->strip[pc];
		switch (OP(s)) {
		case OEND:
			assert(pc == stop-1);
			break;
		case OCHAR:
			/* only characters can match */
			assert(!NONCHAR(ch) || ch != (char)OPND(s));
			if (ch == (char)OPND(s))
				FWD(aft, bef, 1);
			break;
		case OBOL:
			if (ch == BOL || ch == BOLEOL)
				FWD(aft, bef, 1);
			break;
		case OEOL:
			if (ch == EOL || ch == BOLEOL)
				FWD(aft, bef, 1);
			break;
		case OBOW:
			if (ch == BOW)
				FWD(aft, bef, 1);
			break;
		case OEOW:
			if (ch == EOW)
				FWD(aft, bef, 1);
			break;
		case OANY:
			if (!NONCHAR(ch))
				FWD(aft, bef, 1);
			break;
		case OANYOF:
			cs = &g->sets[OPND(s)];
			if (!NONCHAR(ch) && CHIN(cs, ch))
				FWD(aft, bef, 1);
			break;
		case OBACK_:		/* ignored here */
		case O_BACK:
			FWD(aft, aft, 1);
			break;
		case OPLUS_:		/* forward, this is just an empty */
			FWD(aft, aft, 1);
			break;
		case O_PLUS:		/* both forward and back */
			FWD(aft, aft, 1);
			i = ISSETBACK(aft, OPND(s));
			BACK(aft, aft, OPND(s));
			if (!i && ISSETBACK(aft, OPND(s))) {
				/* oho, must reconsider loop body */
				pc -= OPND(s) + 1;
				INIT(here, pc);
			}
			break;
		case OQUEST_:		/* two branches, both forward */
			FWD(aft, aft, 1);
			FWD(aft, aft, OPND(s));
			break;
		case O_QUEST:		/* just an empty */
			FWD(aft, aft, 1);
			break;
		case OLPAREN:		/* not significant here */
		case ORPAREN:
			FWD(aft, aft, 1);
			break;
		case OCH_:		/* mark the first two branches */
			FWD(aft, aft, 1);
			assert(OP(g->strip[pc+OPND(s)]) == OOR2);
			FWD(aft, aft, OPND(s));
			break;
		case OOR1:		/* done a branch, find the O_CH */
			if (ISSTATEIN(aft, here)) {
				for (look = 1;
						OP(s = g->strip[pc+look]) != O_CH;
						look += OPND(s))
					assert(OP(s) == OOR2);
				FWD(aft, aft, look);
			}
			break;
		case OOR2:		/* propagate OCH_'s marking */
			FWD(aft, aft, 1);
			if (OP(g->strip[pc+OPND(s)]) != O_CH) {
				assert(OP(g->strip[pc+OPND(s)]) == OOR2);
				FWD(aft, aft, OPND(s));
			}
			break;
		case O_CH:		/* just empty */
			FWD(aft, aft, 1);
			break;
		default:		/* ooooops... */
			assert(nope);
			break;
		}
	}

	return(aft);
}

#undef	matcher
#undef	fast
#undef	slow
#undef	dissect
#undef	backref
#undef	step
#undef	print
#undef	at
#undef	match

int				/* 0 success, REG_NOMATCH failure */
regexec(preg, string, nmatch, pmatch, eflags)
const regex_t *preg;
const char *string;
size_t nmatch;
regmatch_t pmatch[];
int eflags;
{
	register struct re_guts *g = preg->re_g;
#define	GOODFLAGS(f)	((f)&(REG_NOTBOL|REG_NOTEOL|REG_STARTEND))

	if (preg->re_magic != MAGIC1 || g->magic != MAGIC2)
		return(REG_BADPAT);
	assert(!(g->iflags&BAD));
	if (g->iflags&BAD)		/* backstop for no-debug case */
		return(REG_BADPAT);
	eflags = GOODFLAGS(eflags);

	if (g->nstates <= CHAR_BIT*sizeof(states1) && !(eflags®_LARGE))
		return(smatcher(g, (char *)string, nmatch, pmatch, eflags));
	else
		return(lmatcher(g, (char *)string, nmatch, pmatch, eflags));
#undef GOODFLAGS
}
/*
 - regfree - free everything
 = extern void regfree(regex_t *);
 */
void
regfree(preg)
regex_t *preg;
{
	register struct re_guts *g;

	if (preg->re_magic != MAGIC1)	/* oops */
		return;			/* nice to complain, but hard */

	g = preg->re_g;
	if (g == NULL || g->magic != MAGIC2)	/* oops again */
		return;
	preg->re_magic = 0;		/* mark it invalid */
	g->magic = 0;			/* mark it invalid */

	if (g->strip != NULL)
		free((char *)g->strip);
	if (g->sets != NULL)
		free((char *)g->sets);
	if (g->setbits != NULL)
		free((char *)g->setbits);
	if (g->must != NULL)
		free(g->must);
	free((char *)g);
}

#ifdef WITH_MAIN
int main(int argc, char* argv[]){
 regex_t preg;
 int i, s;
 if(argc<2) return 1;
 if (regcomp(&preg, argv[1], REG_NOSUB)) {
	fprintf(stderr, "Failed to compile regex\n");
	return 2;
 }
 for (i = 2; i
#include 


#define uchar unsigned char

static const uchar perm1[56] = {57, 49, 41, 33, 25, 17,  9,
			 1, 58, 50, 42, 34, 26, 18,
			10,  2, 59, 51, 43, 35, 27,
			19, 11,  3, 60, 52, 44, 36,
			63, 55, 47, 39, 31, 23, 15,
			 7, 62, 54, 46, 38, 30, 22,
			14,  6, 61, 53, 45, 37, 29,
			21, 13,  5, 28, 20, 12,  4};

static const uchar perm2[48] = {14, 17, 11, 24,  1,  5,
                         3, 28, 15,  6, 21, 10,
                        23, 19, 12,  4, 26,  8,
                        16,  7, 27, 20, 13,  2,
                        41, 52, 31, 37, 47, 55,
                        30, 40, 51, 45, 33, 48,
                        44, 49, 39, 56, 34, 53,
                        46, 42, 50, 36, 29, 32};

static const uchar perm3[64] = {58, 50, 42, 34, 26, 18, 10,  2,
			60, 52, 44, 36, 28, 20, 12,  4,
			62, 54, 46, 38, 30, 22, 14,  6,
			64, 56, 48, 40, 32, 24, 16,  8,
			57, 49, 41, 33, 25, 17,  9,  1,
			59, 51, 43, 35, 27, 19, 11,  3,
			61, 53, 45, 37, 29, 21, 13,  5,
			63, 55, 47, 39, 31, 23, 15,  7};

static const uchar perm4[48] = {   32,  1,  2,  3,  4,  5,
                            4,  5,  6,  7,  8,  9,
                            8,  9, 10, 11, 12, 13,
                           12, 13, 14, 15, 16, 17,
                           16, 17, 18, 19, 20, 21,
                           20, 21, 22, 23, 24, 25,
                           24, 25, 26, 27, 28, 29,
                           28, 29, 30, 31, 32,  1};

static const uchar perm5[32] = {      16,  7, 20, 21,
                              29, 12, 28, 17,
                               1, 15, 23, 26,
                               5, 18, 31, 10,
                               2,  8, 24, 14,
                              32, 27,  3,  9,
                              19, 13, 30,  6,
                              22, 11,  4, 25};


static const uchar perm6[64] ={ 40,  8, 48, 16, 56, 24, 64, 32,
                        39,  7, 47, 15, 55, 23, 63, 31,
                        38,  6, 46, 14, 54, 22, 62, 30,
                        37,  5, 45, 13, 53, 21, 61, 29,
                        36,  4, 44, 12, 52, 20, 60, 28,
                        35,  3, 43, 11, 51, 19, 59, 27,
                        34,  2, 42, 10, 50, 18, 58, 26,
                        33,  1, 41,  9, 49, 17, 57, 25};


static const uchar sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1};

static const uchar sbox[8][4][16] = {
	{{14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7},
	 {0, 15,  7,  4, 14,  2, 13,  1, 10,  6, 12, 11,  9,  5,  3,  8},
	 {4,  1, 14,  8, 13,  6,  2, 11, 15, 12,  9,  7,  3, 10,  5,  0},
	 {15, 12,  8,  2,  4,  9,  1,  7,  5, 11,  3, 14, 10,  0,  6, 13}},

	{{15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10},
	 {3, 13,  4,  7, 15,  2,  8, 14, 12,  0,  1, 10,  6,  9, 11,  5},
	 {0, 14,  7, 11, 10,  4, 13,  1,  5,  8, 12,  6,  9,  3,  2, 15},
	 {13,  8, 10,  1,  3, 15,  4,  2, 11,  6,  7, 12,  0,  5, 14,  9}},

	{{10,  0,  9, 14,  6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8},
	 {13,  7,  0,  9,  3,  4,  6, 10,  2,  8,  5, 14, 12, 11, 15,  1},
	 {13,  6,  4,  9,  8, 15,  3,  0, 11,  1,  2, 12,  5, 10, 14,  7},
	 {1, 10, 13,  0,  6,  9,  8,  7,  4, 15, 14,  3, 11,  5,  2, 12}},

	{{7, 13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15},
	 {13,  8, 11,  5,  6, 15,  0,  3,  4,  7,  2, 12,  1, 10, 14,  9},
	 {10,  6,  9,  0, 12, 11,  7, 13, 15,  1,  3, 14,  5,  2,  8,  4},
	 {3, 15,  0,  6, 10,  1, 13,  8,  9,  4,  5, 11, 12,  7,  2, 14}},

	{{2, 12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9},
	 {14, 11,  2, 12,  4,  7, 13,  1,  5,  0, 15, 10,  3,  9,  8,  6},
	 {4,  2,  1, 11, 10, 13,  7,  8, 15,  9, 12,  5,  6,  3,  0, 14},
	 {11,  8, 12,  7,  1, 14,  2, 13,  6, 15,  0,  9, 10,  4,  5,  3}},

	{{12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11},
	 {10, 15,  4,  2,  7, 12,  9,  5,  6,  1, 13, 14,  0, 11,  3,  8},
	 {9, 14, 15,  5,  2,  8, 12,  3,  7,  0,  4, 10,  1, 13, 11,  6},
	 {4,  3,  2, 12,  9,  5, 15, 10, 11, 14,  1,  7,  6,  0,  8, 13}},

	{{4, 11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1},
	 {13,  0, 11,  7,  4,  9,  1, 10, 14,  3,  5, 12,  2, 15,  8,  6},
	 {1,  4, 11, 13, 12,  3,  7, 14, 10, 15,  6,  8,  0,  5,  9,  2},
	 {6, 11, 13,  8,  1,  4, 10,  7,  9,  5,  0, 15, 14,  2,  3, 12}},

	{{13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7},
	 {1, 15, 13,  8, 10,  3,  7,  4, 12,  5,  6, 11,  0, 14,  9,  2},
	 {7, 11,  4,  1,  9, 12, 14,  2,  0,  6, 10, 13, 15,  3,  5,  8},
	 {2,  1, 14,  7,  4, 10,  8, 13, 15, 12,  9,  0,  3,  5,  6, 11}}};

static void permute(char *out, const char *in, const uchar *p, int n)
{
	int i;
	for (i=0;i>1;
	key[1] = ((str[0]&0x01)<<6) | (str[1]>>2);
	key[2] = ((str[1]&0x03)<<5) | (str[2]>>3);
	key[3] = ((str[2]&0x07)<<4) | (str[3]>>4);
	key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5);
	key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6);
	key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7);
	key[7] = str[6]&0x7F;
	for (i=0;i<8;i++) {
		key[i] = (key[i]<<1);
	}
}


static void smbhash(unsigned char *out, const unsigned char *in, unsigned char *key)
{
	int i;
	char outb[64];
	char inb[64];
	char keyb[64];
	unsigned char key2[8];

	str_to_key(key, key2);

	for (i=0;i<64;i++) {
		inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
		keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0;
		outb[i] = 0;
	}

	dohash(outb, inb, keyb);

	for (i=0;i<8;i++) {
		out[i] = 0;
	}

	for (i=0;i<64;i++) {
		if (outb[i])
			out[i/8] |= (1<<(7-(i%8)));
	}
}

/*
 *	Converts the password to uppercase, and creates the LM
 *	password hash.
 */
void lmpwdhash(const unsigned char *password,unsigned char *lmhash)
{
	int i;
	unsigned char p14[14];
	static unsigned char sp8[8] = {0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25};

	memset(p14, 0, sizeof(p14));
	for (i = 0; i < 14 && password[i]; i++) {
		p14[i] = toupper((int) password[i]);
	}

	smbhash(lmhash, sp8, p14);
	smbhash(lmhash+8, sp8, p14+7);
}

/*
 *	Take the NT or LM password, and return the MSCHAP response
 *
 *	The win_password MUST be exactly 16 bytes long.
 */
void mschap(const unsigned char *win_password,
		 const unsigned char *challenge, unsigned char *response)
{
	unsigned char p21[21];

	memset(p21, 0, sizeof(p21));
	memcpy(p21, win_password, 16);

	smbhash(response, challenge, p21);
	smbhash(response+8, challenge, p21+7);
	smbhash(response+16, challenge, p21+14);
}
man/3proxy.80100644002537100244200000001022210156554424012372 0ustar  vladmkgroup.TH 3proxy "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B 3proxy
\- 3[APA3A] tiny proxy server, or trivial proxy server, or free proxy
server
.SH SYNOPSIS
.B 3proxy
.RI [ config_file ]
.br
.B 3proxy
.RI [ \-\-install ]
.br
.B 3proxy
.RI [ \-\-remove ]
.SH DESCRIPTION
.B 3proxy
is universal proxy server. It can be used to provide internal users wuth
fully controllable access to external resources or to provide external
users with access to internal resources. 3proxy is not developed to replace
.BR squid (8),
but it can extend functionality of existing cashing proxy.
It can be used to route requests between different types of clients and proxy
servers. Think about it as application level
gateway with configuration like hardware router has for network layer.
It can establish multiple
gateways with HTTP and HTTPS proxy with FTP over HTTP support, SOCKS v4,
v4.5 and v5, POP3 proxy, UDP and TCP portmappers. Each gateway is started
from configuration file like independant service 
.BR proxy (8)
.BR socks (8)
.BR pop3p (8)
.BR tcppm (8)
.BR udppm (8)
.BR ftppr (8)
.BR dnspr
but
.BR 3proxy
is not a kind of wrapper or superserver for this daemons. It just has same
code compiled in, but provides much more functionality. SOCKSv5
implementatation allows to use 3proxy with any UDP or TCP based client
applications designed without
proxy support (with
.IR SocksCAP ,
.I FreeCAP
or another client-side redirector under Windows of with socksification library
under Unix). So you can play your favourite games, listen music, exchange
files and messages and even accept incoming connections behind proxy server.
.PP
.I dnspr
does not exist like independant service. It\' DNS caching proxy (it requires
.I nscache
and
.I nserver
to be set in configuration. Curently is does only support for host name
resolution

.PP
Like network router, it supports access control lists (ACL) where source
and destination networks and destination port can be specified. In addition,
usernames and gateway action can be used in ACLs. In order to filter request
on username basis user must be authenticated somehow. There are few
authentication types including password authentication and authentication by
NetBIOS name for Windows clients (it\'s very like ident authentication).
Depending on ACL action request can be allowed, denied or redirected to another
host or to another proxy server or even to a chain of proxy servers.
.PP
It supports different types of logging: to logfiles, 
.BR syslog (3)
(only under Unix) or to ODBC database. Logging format is turnable to provide
compatibility with existing log file parsers.
.SH OPTIONS
.TP
.B config_file
Name of config file. See
.BR 3proxy.cfg (3)
for configuration file format. Under Windows, if config_file is not specified,
.BR 3proxy
looks for file named
.I 3proxy.cfg
in the default location (in same directory with executable file and in current
directory). Under Unix default location of config file will be
.I /usr/local/3proxy/3proxy.cfg
(is not currently implemented).
.TP
.B --install
(Windows NT family only) install 
.BR 3proxy
as a system service
.TP
.B --remove
(Windows NT family only) remove
.BR 3proxy
from system services
.SH SIGNALS
Under Unix there are few signals
.BR 3proxy
catches. See
.BR kill (1).
.TP
.B SIGTERM
cleanup connections and exit
.TP
.B SIGPAUSE
stop to accept new connections, on second signal - start and re-read
configuration
.TP
.B SIGCONT
start to accept new conenctions
.TP
.B SIGUSR1
reload configuration
.PP
Under Windows, if
.BR 3proxy
is installed as service you can standard service management to start, stop,
pause and continue 3proxy service, for example:
.br
.BR "net start 3proxy"
.br
.BR "net stop 3proxy"
.br
.BR "net pause 3proxy"
.br
.BR "net continue 3proxy"
.SH FILES
.TP
.I "/usr/local/3proxy/3proxy.cfg (3proxy.cfg)"
.BR 3proxy
configuration file
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy.cfg(3), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8),
kill(1), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH TRIVIA
3APA3A is pronounced as \`\`zaraza\'\'.
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/3proxy.conf.30100644002537100244200000004454010245102166013312 0ustar  vladmkgroup.TH 3proxy.conf "5" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B 3proxy.conf
\- 3proxy configuration file
.SH DESCRIPTION


Common structure:

Configuration file is a text file 3proxy reads configuration from. Each line
of the file is command and is executed immediately, as it was given from
console. Each line of the file is treated as a blank (space or tab) separated
command line. Additional space characters are ignored. 
Think about 3proxy as "application level router" with console interface.

Comments:

Any string beginning with space character or \'#\' character is comment. It\'s
ignored. s are ignored.  is end of command.


Quotation:

Quotation character is \" (double quote). Quotation must be used to quote
spaces or another special characters. To use quotation character inside
quotation character must be dubbed (BASIC convention). For example to use
HELLO \"WORLD\" as an argument you should use it as \"HELLO \"\"WORLD\"\"\"\.
Good practice is to quote any argument you use.

File inclusion:

You can include file by using $FILENAME macro (replace FILENAME with a path
to file, for example $/usr/local/etc/3proxy/conf.incl or 
 $"c:\\Program Files\\3proxy\\include.cfg" Quotation is
required in last example because path contains space character. 
For included file  (end of line characters) is treated as space character
(arguments delimiter instead of end of command delimiter). 
Thus, include files are only useful to store long signle-line commands
(like userlist, network lists, etc).
To use dollar sign somewhere in argument it must be quoted. 
Recursion is not allowed.

Commands:

.B   proxy
[options]
.br
.B   socks
[options]
.br
.B   pop3p
[options]
.br
.B   ftppr
[options]
.br
.B   admin
[options]
.br
.B   dnspr
[options]
.br
.B   tcppm
[options]
  
.br
.B   udppm
[options]
  

starts gateway services

.B proxy
\- HTTP/HTTPS proxy (default port 3128)
.br
.B socks
\- SOCKS 4/4.5/5 proxy (default port 1080)
.br
.B pop3p
\- POP3 proxy (default port 110)
.br
.B ftppr
\- FTP proxy (default port 21)
.br
.B admin
\- Web interface (default port 80)
.br
.B dnspr
\- caching DNS proxy (default port 53)
.br
.B tcppm
\- TCP portmapper
.br
.B udppm
\- UDP portmapper

Options:
.br
.B -pNUMBER
change default server port to NUMBER
.br
.B -n
disable NTLM authentication (required if passwords are stored in Unix crypt format.
.br
Also, all options mentioned for 
.BR proxy (8)
.BR socks (8)
.BR pop3p (8)
.BR tcppm (8)
.BR udppm (8)
.BR ftppr (8)
are also supported.

Portmapping services listen at SRCPORT and connect to DSTADDR:DSTPORT
HTTP and SOCKS proxies are standard. 

POP3 proxy must be configured as POP3 server and requires username in the form of:
pop3username@pop3server. If POP3 proxy access must be authenticated, you can
specify username as proxy_username:proxy_password:POP3_username@pop3server

DNS proxy is only capable to resolve hostnames (no MX, PTR, SRV, etc) and
requires nserver/nscache to be configured.

FTP proxy can be used as FTP server in any FTP client or configured as FTP
proxy on a client with FTP proxy support. Username format is one of
 FTPuser@FTPServer
 FTPuser:FTPpassword@FTPserver
 proxyuser:proxypassword:FTPuser:FTPpassword@FTPserver
.br
Please note, if you use FTP client interface for FTP proxy
do not add FTPpassword and FTPServer to username, because
FTP client does it for you. That is, if you use 3proxy with
authentication use
proxyuser:proxypassword:FTPuser
as FTP username, otherwise do not change original FTP user name	

.B include

.br
Include config file

.B config

.br
Path to configuration file to use on 3proxy restart or to save configuration.

.B writable
.br
ReOpens configuration file for write access via Web interface,
and re-reads it. Usually should be first command on config file
but in combination with "config" it can be used anywhere to open
alternate config file. Think twice before using it.

.B end
.br
End of configuration

.B log
[[@|&]logfile] []
.br
sets logfile for all gateways
 @ - (for Unix) use syslog, filename is used as ident name
 & - use ODBC, filename consists of comma-delimited datasource,username,password (username and password are optional)
 LOGTYPE is one of:
  M - Monthly
  W - Weekly (starting from Sunday)
  D - Daily
  H - Hourly
if logfile is not specified logging goes to stdout. You can specify individual logging options for gateway by using
-l option in gateway configuration.

.B rotate

how many archived log files to keep

.B logformat


Format for log record. First symbol in format must be L (local time)
or G (absolute Grinwitch time). 
It can be preceeded with -XXX+Y where XXX is list of characters to be
filtered in user input (any non-printable characters are filtered too
in this case) and Y is replacement character. For example, "-,%+ L" in
the beginning of logformat means comma and percent are replaced
with space and all time based elemnts are in local time zone.
You can use:

 %y - Year in 2 digit format
 %Y - Year in 4 digit format
 %m - Month number
 %d - Day
 %H - Hour
 %M - Minute
 %S - Second
 %t - Timstamp (in seconds since 01-Jan-1970)
 %. - milliseconds
 %z - timeZone (from Grinvitch)
 %D - request duration (in milliseconds)
 %b - average send rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.
 %B - average receive rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.
 %U - Username
 %N - service Name
 %p - service Port
 %E - Error code
 %C - Client IP
 %c - Client port
 %R - Remote IP
 %r - Remote port
 %n - requested hostname
 %I - bytes In
 %O - bytes Out
 %h - Hops (redirections) count
 %T - service specific Text
 %N1-N2T - (N1 and N2 are positive numbers) - log only fields from N1 thorugh N2 of service specific text
in case of ODBC logging logformat specifies SQL statement, for exmample:
   logformat "-'+_Linsert into log (l_date, l_user, l_service, l_in, l_out, l_descr) values ('%d-%m-%Y %H:%M:%S', '%U', '%N', %I, %O, '%T')"

.B archiver
 
.br
Archiver to use for log files.  is file extension produced by
archiver. Filename will be last argument to archiver, optionally you
can use %A as produced archive name and %F as filename.

.B timeouts
       
Sets timeout values
 BYTE_SHORT - short timeout for single byte, is usually used for receiving single byte from stream.
 BYTE_LONG - long timeout for single byte, is usually used for receiving first byte in frame (for example first byte in socks request).
 STRING_SHORT - short timeout, for character string within stream (for example to wait between 2 HTTP headers)
 STRING_LONG - long timeout, for first string in stream (for example to wait for HTTP request).
 CONNECTION_SHORT - inactivity timeout for short connections (HTTP, POP3, etc).
 CONNECTION_LONG - inactivity timeout for long connection (SOCKS, portmappers, etc).
 DNS - timeout for DNS request before requesting next server
 CHAIN - timeout for reading data from chained connection

.B nserver
 
.br
Nameserver to use for name resolutions. If none spcified system
or name server fails system routines for name resolution will be
used. It's better to specify nserver because gethostbyname() may
be thread unsafe.

.B nscache

.br

Cache  records for name resolution. Cachesize usually
should be large enougth (for example 65536).

.B nsrecord
 
.BR
Adds static record to nscache. nscache must be enabled. If 0.0.0.0
is used as a hostaddr host will never resolve, it can be used to
blacklist something or together with 
.B dialer
command to set up UDL for dialing.

.B fakeresolve
.BR
All names are resolved to 127.0.0.2 address. Usefull if all requests are
redirected to parent proxy.

.B dialer

.br
Execute progname if external name can't be resolved.
Hint: if you use nscache, dialer may not work, because names will
be resolved through cache. In this case you can use something like
http://dial.right.now/ from browser to set up connection.


.B internal

.br
sets ip address of internal interface. This IP address will be used
to bind gateways. Alternatively you can use -i option for individual
gateways

.B external

.br
sets ip address of external interface. This IP address will be source
address for all connections made by proxy. Alternatively you can use
-e option to specify individual address for gateway.
   
.B maxconn

.br
sets maximum number of simulationeous connections to each services
started after this command. Default is 100.

.B service
.br
Should be specified to launch as Windows 95/98/NT/2000/XP service, no effect for
Unix.

.B daemon
.br
Should be specified to close console (needn't for service).
At least under FreeBSD 'daemon' should preceed any proxy service
and log commands to avoid sockets problem. Always place it in the beginning
of the configuration file.

.B auth
.br
Type of user authorization. Currently supported:
 none - no authorization required. Note: is auth is none any ip based limitation, redirection, etc will not work. 
 iponly - authorization by source/destination IP and ports. Appropriate for most cases
 nbname - iponly + authorization by NetBIOS name. Messanger
service should be started on user's machine. Note, that
Windows 95/98 hosts do not have messanger service by default,
WinPopup program need to be started.
NB: there is no any password check, name may be spoofed.
Think about it as about ident for Windows.
 Q: Will ident authorization be implemented?
 A: Yes, as soon as it will be required by someone.
 strong - username/password authentication required. It will work with SOCKSv5, FTP, POP3 and HTTP proxy.

.B allow
    
 
.br
.B deny
    
 
.br
Access control entries. All lists are comma-separated, no spaces are
allowed. Usernames are case sensitive (if used with authtype nbname
username must be in uppercase). Source and target lists may contain
IP addresses (W.X.Y.Z) or CIDRs (W.X.Y.Z/L). Targetportlist may
contain ports (X) or port lists (X-Y).	For any field * sign means "ANY"
If access list is empty it's assumed to be
 allow *
If access list is not empty last item in access list is assumed to be
 deny *
You may want explicitly add "deny *" into the end of access list to prevent
HTTP proxy from requesting user's password.
Access lists are checked after user have requested any resource.
If you want 3proxy to reject connections from specific addresses
immediately without any conditions you should either bind proxy
to appropriate interface only or to use ip filters.

Operation is one of:
 CONNECT	- establish outgoing TCP connection
 BIND - bind TCP port for listening
 UDPASSOC - make UDP association
 ICMPASSOC - make ICMP association (for future use)
 HTTP_GET - HTTP GET request
 HTTP_PUT - HTTP PUT request
 HTTP_POST - HTTP POST request
 HTTP_HEAD - HTTP HEAD request
 HTTP_CONNECT - HTTP CONNECT request
 HTTP_OTHER - over HTTP request
 HTTP - matches any HTTP request except HTTP_CONNECT
 HTTPS - same as HTTP_CONNECT
 FTP_GET - FTP get request
 FTP_PUT - FTP put request
 FTP_LIST - FTP list request
 FTP - matches any FTP request

Weeksdays are week days numbers or periods (0 or 7 means Sunday, 1 is Monday,
1-5 means Monday through Friday). Timeperiodlists is a list of time
periods in HH:MM:SS-HH:MM:SS format. For example, 
 00:00:00-08:00:00,17:00:00-24:00:00
lists non-working hours.
	
.B parent
     
.br
this command may follow "allow" rule. It extends last allow rule to
build proxy chain. Proxy may be grouped. Proxy inside the
group is selected randomely. If few groups are specified one proxy
is randomely picked from each group and chain of proxies is created
(that is second proxy connected through first one and so on).
Weight is used to group proxies. Weigt is a number between 1 and 1000.
Weights are summed and proxies are grouped together untill weight of
group is 1000. That is:
 allow *
 parent 500 socks5 192.168.10.1 1080
 parent 500 connect 192.168.10.1 3128
makes 3proxy to randomely choose between 2 proxies for all outgoing
connections
 allow * * * 80
 parent 1000 socks5 192.168.10.1 1080
 parent 1000 connect 192.168.20.1 3128
 parent 300 socks4 192.168.30.1 1080
 parent 700 socks5 192.168.40.1 1080
creates chain of 3 proxies: 192.168.10.1, 192.168.20.1 and third
is (192.168.30.1 with probability of 0.3 or 192.168.40.1
with probability of 0.7) for outgoing web connections.

type is one of:
 tcp - simply redirect connection. TCP is always last in chain.
 http - redirect to HTTP proxy. HTTP is always last chain.
 pop3 - redirect to POP3 proxy (only local redirection is supported, can not be
used for chaining)
 ftp - redirect to FTP proxy (only local redirection is supported, can not be
used for chaining)
 connect - parent is HTTP CONNECT method proxy
 socks4 - parent is SOCKSv4 proxy
 socks5 - parent is SOCKSv5 proxy

IP and port are ip addres and port of parent proxy server.
If IP is zero, ip is taken from original request, only port is changed.
If port is zero, it's taken from original request, only IP is changed.
If both IP and port are zero - it's a special case of local redirection,
it works only with
.B
socks
proxy. In case of local redirection request is redirected to different service,
'ftp' locally redirects to
.B ftppr
'pop3' locally redirects to
.B pop3p
'http' locally redurects to
.B proxy .

Main purpose of local redirections is to have requested resource
(URL or POP3 username) logged and protocol-specific filters to be applied.
In case of local redirection ACLs are revied twice: first, by SOCKS proxy up to
'parent' command and then with gateway service connection is
redirected (HTTP, FTP or POP3) after 'parent' command. It means,
additional 'allow' command is required for redirected requests, for
example:
 allow * * * 80
 parent 1000 http 0.0.0.0 0
 allow * * * 80 HTTP_GET,HTTP_POST
 socks
redirects all SOCKS requests with target port 80 to local HTTP proxy,
local HTTP proxy parses requests and allows only GET and POST requests.

Optional username and password are used to authenticate on parent
proxy. Username of '*' means username must be supplied by user.

.B bandlimin
     
.br
.B nobandlimin
    
.br
bandlim sets bandwith limitation filter to  bps (bits per second)
(if you want to specife bytes per second - multiply your value to 8).
bandlim rules act in a same manner as allow/deny rules except
one thing: bandwidth limiting is applied to all services, not to some
specific service. 
bandlimin and nobandlimin applies to incoming traffic
bandlimout and nobandlimout applies to outgoing traffic
If tou want to ratelimit your clients with ip's 192.168.10.16/30 (4
addresses) to 57600 bps you have to specify 4 rules like
 bandlimin 57600 * 192.168.10.16
 bandlimin 57600 * 192.168.10.17
 bandlimin 57600 * 192.168.10.18
 bandlimin 57600 * 192.168.10.19
and every of you clients will have 56K channel.	if you specify
 bandlimin 57600 * 192.168.10.16/30
you will have 56K channel shared between all clients.
if you want, for example, to limit all speed ecept access to POP3 you can use
 nobandlimin * * * 110
before the rest of bandlim rules.

.B counter
  
.br
.B countin
       
.br
.B nocountin
    
.br

counter, countin, nocountin commands are used to set traffic limit
in MB for period of time (day, week or month). Filename is a path
to a special file where traffic information is permanently stored.
number is sequential number of record in this file. If number is 0
no traffic information  on this counter is saved in file (that is
if proxy restarted all information is loosed) overwise it should be
unique sequential number.
Type specifies a type of counter. Type is one of:
 D - counter is resetted daily
 W - counter is resetted weekly
 M - counter is resetted monthely
reporttype/repotname may be used to generate traffic reports.
Reporttype is one of D,W,M,H(hourly) and repotname specifies filename
template for reports. Report is text file with counter values in
format:
   
The rest of parameters is identical to bandlim/nobandlim.

.B users
username[:pwtype:password] ...
.br
pwtype is one of:
 none (empty) - use system authentication
 CL - password is cleartext
 CR - password is crypt-style password
 NT - password is NT password (in hex)
example:
 users test1:CL:password1 "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
 users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63
.br
(note: double quotes are requiered because password contains $ sign).	

.B flush
.br
empty active access list. Access list must be flushed avery time you creating
new access list for new service. For example:
 allow *
 pop3p
 flush
 allow * 192.168.1.0/24
 socks
sets different ACLs for
.B pop3p
and
.B socks

.B system
.br
execute system command

.B pidfile

.br
write pid of current process to file. It can be used to manipulate
3proxy with signals under Unix. Currently next signals are available:

.B setuid

.br
calls setuid(uid), uid must be numeric. Unix only.

.B setgid

.br
calls setgid(gid), gid must be numeric. Unix only.

.B chroot

.br
calls chroot(path). Unix only.
.SH SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH TRIVIA
3APA3A is pronounced as \`\`zaraza\'\'.
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/ftppr.80100644002537100244200000000354710156554452012276 0ustar  vladmkgroup.TH ftppr "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B ftppr
\- FTP proxy gateway service
.SH SYNOPSIS
.BR "ftppr " [ -d ]
.IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
.IB \fR[ -p port\fR]
.IB \fR[ -i internal_ip\fR]
.IB \fR[ -e external_ip\fR]
.SH DESCRIPTION
.B ftppr
is FTP gateway service to allow internal users to access external FTP
servers.
.SH OPTIONS
.TP
.B -d
Daemonise. Detach service from console and run in the background.
.TP
.B -e
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.
.TP
.B -i
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It\'s usually unsafe.
.TP
.B -p
Port. Port proxy listens for incoming connections. Default is 21.
.TP
.B -l
Log. By default logging is to stdout. If
.I logfile
is specified logging is to file. Under Unix, if
.RI \' @ \'
preceeds
.IR logfile ,
syslog is used for logging.
.SH CLIENTS
You can use any FTP client, regardless of FTP proxy support. For client with
FTP proxy support configure
.I internal_ip
and
.IR port
in FTP proxy parameters.
For clients without FTP proxy support use
.I internal_ip
and
.IR port
as FTP server. Address of real FTP server must be configured as a part of
FTP username. Format for username is
.IR username \fB@ server ,
where
.I server
is address of FTP server and
.I username
is user\'s login on this FTP server. Login itself may contain \'@\' sign.
Only cleartext authentication is currently supported.
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy(8), proxy(8), pop3p(8), socks(8), tcppm(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/pop3p.80100644002537100244200000000336510156554470012202 0ustar  vladmkgroup.TH pop3p "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B pop3p
\- POP3 proxy gateway service
.SH SYNOPSIS
.BR "pop3p " [ -d ]
.IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
.IB \fR[ -p port\fR]
.IB \fR[ -i internal_ip\fR]
.IB \fR[ -e external_ip\fR]
.SH DESCRIPTION
.B pop3p
is POP3 gateway service to allow internal users to access external POP3
servers.
.SH OPTIONS
.TP
.B -d
Daemonise. Detach service from console and run in the background.
.TP
.B -e
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.
.TP
.B -i
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It\'s usually unsafe.
.TP
.B -p
Port. Port proxy listens for incoming connections. Default is 110.
.TP
.B -l
Log. By default logging is to stdout. If
.I logfile
is specified logging is to file. Under Unix, if
.RI \' @ \'
preceeds
.IR logfile ,
syslog is used for logging.
.SH CLIENTS
You can use any MUA (Mail User Agent) with POP3 support. Set client to use
.I internal_ip
and
.IR port
as a POP3 server. Address of real POP3 server must be configured as a part of
POP3 username. Format for username is
.IR username \fB@ server ,
where
.I server
is address of POP3 server and
.I username
is user\'s login on this POP3 server. Login itself may contain \'@\' sign.
Only cleartext authentication is currently supported.
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy(8), ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/proxy.80100644002537100244200000000323110245102317012276 0ustar  vladmkgroup.TH proxy "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B proxy
\- HTTP proxy gateway service
.SH SYNOPSIS
.BR "proxy " [ -d ][ -a ]
.IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
.IB \fR[ -p port\fR]
.IB \fR[ -i internal_ip\fR]
.IB \fR[ -e external_ip\fR]
.SH DESCRIPTION
.B proxy
is HTTP gateway service with HTTPS and FTP over HTTPS support.
.SH OPTIONS
.TP
.B -d
Daemonise. Detach service from console and run in the background.
.TP
.B -e
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.
.TP
.B -i
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It\'s usually unsafe.
.TP
.B -a
Anonymous. Hide information about client.
.TP
.B -p
Port. Port proxy listens for incoming connections. Default is 3128.
.TP
.B -l
Log. By default logging is to stdout. If
.I logfile
is specified logging is to file. Under Unix, if
.RI \' @ \'
preceeds
.IR logfile ,
syslog is used for logging.
.SH CLIENTS
You should use client with HTTP proxy support or configure router to redirect
HTTP traffic to proxy (transparent proxy). Configure client to connect to
.I internal_ip
and
.IR port .
HTTPS support allows to use almost any TCP based protocol. If you need to
limit clients, use 
.BR 3proxy (8)
instead.
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/socks.80100644002537100244200000000363110156554512012254 0ustar  vladmkgroup.TH socks "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B socks
\- SOCKS 4/4.5/5 gateway service
.SH SYNOPSIS
.BR "socks " [ -d ]
.IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
.IB \fR[ -p port\fR]
.IB \fR[ -i internal_ip\fR]
.IB \fR[ -e external_ip\fR]
.SH DESCRIPTION
.B socks
is SOCKS server. It supports SOCKSv4, SOCKSv4.5 (extension to v4 for
server side name resolution) and SOCKSv5. SOCKSv5 specification allows both
outgoing and reverse TCP connections and UDP portmapping.
.SH OPTIONS
.TP
.B -d
Daemonise. Detach service from console and run in the background.
.TP
.B -e
External address. IP address of interface proxy should initiate connections
from. External IP must be specified if you need incoming connections.
By default system will deside which address to use in accordance
with routing table.
.TP
.B -i
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It\'s usually unsafe.
.TP
.B -p
Port. Port proxy listens for incoming connections. Default is 1080.
.TP
.B -l
Log. By default logging is to stdout. If
.I logfile
is specified logging is to file. Under Unix, if
.RI \' @ \'
preceeds
.IR logfile ,
syslog is used for logging.
.SH CLIENTS
You should use client with SOCKS support or use some socksification support
(for example
.I SocksCAP
or
.IR FreeCAP ).
Configure client to use
.I internal_ip
and
.IR port .
SOCKS allows to use almost any application protocol without limitation. This
implementation also allows to open priviledged port on server (if socks has
sufficient privileges). If you need to control access use
.BR 3proxy (8)
instead.
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy(8), proxy(8), ftppr(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/tcppm.80100644002537100244200000000313310156554523012254 0ustar  vladmkgroup.TH tcppm "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B tcppm
\- TCP port mapper
.SH SYNOPSIS
.BR "tcppm " [ -d ]
.IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
.IB \fR[ -i internal_ip\fR]
.IB \fR[ -e external_ip\fR]
.I local_port remote_host remote_port
.SH DESCRIPTION
.B tcppm
forwards connections from local to remote TCP port
.SH OPTIONS
.TP
.B -d
Daemonise. Detach service from console and run in the background.
.TP
.B -e
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.
.TP
.B -i
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It\'s usually unsafe.
.TP
.B -l
Log. By default logging is to stdout. If
.I logfile
is specified logging is to file. Under Unix, if
.RI \' @ \'
preceeds
.IR logfile ,
syslog is used for logging.
.SH ARGUMENTS
.TP
.I local_port
- port tcppm accepts connection
.TP
.I remote_host
- IP address of the host connection is forwarded to
.TP
.I remote_port
- remote port connection is forwarded to
.SH CLIENTS
Any TCP based application can be used as a client. Use
.I internal_ip
and
.I local_port
as a destination in client application. Connection is forwarded to
.IR remote_host : remote_port
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
man/udppm.80100644002537100244200000000354310156554535012266 0ustar  vladmkgroup.TH udppm "8" "December 2004" "3proxy 0.5b" "Universal proxy server"
.SH NAME
.B udppm
\- UDP port mapper
.SH SYNOPSIS
.BR "pop3p " [ -ds ]
.IB \fR[ -l \fR[ \fR[ @ \fR] logfile \fR]]
.IB \fR[ -i internal_ip\fR]
.IB \fR[ -e external_ip\fR]
.I local_port remote_host remote_port
.SH DESCRIPTION
.B udppm
forwards datagrams from local to remote UDP port
.SH OPTIONS
.TP
.B -d
Daemonise. Detach service from console and run in the background.
.TP
.B -e
External address. IP address of interface proxy should initiate datagrams
from. 
By default system will deside which address to use in accordance
with routing table.
.TP
.B -i
Internal address. IP address proxy accepts datagrams to.
By default connection to any interface is accepted. It\'s usually unsafe.
.TP
.B -l
Log. By default logging is to stdout. If
.I logfile
is specified logging is to file. Under Unix, if
.RI \' @ \'
preceeds
.IR logfile ,
syslog is used for logging.
.TP
.B -s
Single packet. By default only one client can use udppm service, but
if -s is specified only one packet will be forwarded between client and server.
It allows to share service between multiple clients for single packet services
(for example name lookups).
.SH ARGUMENTS
.TP
.I local_port
- port udppm accepts datagrams
.TP
.I remote_host
- IP address of the host datagrams are forwarded to
.TP
.I remote_port
- remote port datagrams are forwarded to
.SH CLIENTS
Any UDP based application can be used as a client. Use
.I internal_ip
and
.I local_port
as a destination in client application. All datagrams are forwarded to
.IR remote_host : remote_port
.SH BUGS
Report all bugs to
.BR 3proxy@security.nnov.ru
.SH SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),
.br
http://www.security.nnov.ru/soft/3proxy/
.SH AUTHORS
3proxy is designed by 3APA3A
.RI ( 3APA3A@security.nnov.ru ),
Vladimir Dubrovin
.RI ( vlad@sandy.ru )
Makefile.inc0100644002537100244200000000035510067062643012476 0ustar  vladmkgroup#$Id: Makefile.inc,v 1.2 2004/06/25 17:49:23 vlad Exp $
#
# 3 proxy common Makefile
#

all:
	$(TYPECOMMAND) $(MAKEFILE) > src/Makefile
	@cd src && $(MAKE)

clean:
	@$(REMOVECOMMAND) *$(OBJSUFFICS) $(COMPFILES)
	@cd src && $(MAKE) clean

Makefile.win0100644002537100244200000000102110067060706012507 0ustar  vladmkgroup#$Id: Makefile.win,v 1.1.1.1 2004/06/25 17:32:54 vlad Exp $
#
# 3 proxy Makefile for GCC/windows
#
# You can try to add -DWITH_STD_MALLOC to CFLAGS to use standard malloc
# libraries


CC = gcc
CFLAGS = -Wall -O2 -s -c -mno-cygwin -mthreads -DWITH_STD_MALLOC
COUT = -o 
LN = gcc
LDFLAGS = -Wall -O2 -s -mno-cygwin -mthreads
LIBS = -lws2_32 -lodbc32
LNOUT = -o 
EXESUFFICS = .exe
OBJSUFFICS = .o
DEFINEOPTION = -D
COMPFILES = *.tmp
REMOVECOMMAND = rm -f
TYPECOMMAND = cat
COMPATLIBS =
MAKEFILE = Makefile.win

include Makefile.incMakefile.msvc0100644002537100244200000000134210067060706012670 0ustar  vladmkgroup#$Id: Makefile.msvc,v 1.1.1.1 2004/06/25 17:32:54 vlad Exp $
#
# 3 proxy Makefile for Microsoft Visual C compiler (for both make and nmake)
#
# You can try to add /D "WITH_STD_MALLOC" to CFLAGS to use standard malloc
# libraries

CC = cl
CFLAGS = /nologo /MT /W3 /Ox /GX /G7 /GS /GA /GF /D "WITH_STD_MALLOC" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /Fp"proxy.pch" /YX /FD /c
COUT = /Fo
LN = link
LDFLAGS = /nologo /subsystem:console /incremental:no /machine:I386
LIBS = ws2_32.lib advapi32.lib odbc32.lib user32.lib
LNOUT = /out:
EXESUFFICS = .exe
OBJSUFFICS = .obj
DEFINEOPTION = /D 
COMPFILES = *.pch *.idb
REMOVECOMMAND = del 2>NUL >NUL
TYPECOMMAND = type
COMPATLIBS =
MAKEFILE = Makefile.msvc

include Makefile.inc
Makefile.unix0100644002537100244200000000124310234747154012710 0ustar  vladmkgroup#$Id: Makefile.unix,v 1.5 2005/04/30 18:29:00 vlad Exp $
#
# 3 proxy Makefile for GCC/Unix/Linux/Cygwin
#
# You can try to add -DWITH_STD_MALLOC to CFLAGS to use standard malloc
# libraries


CC = gcc

# you may need -L/usr/pkg/lib for older NetBSD versions
CFLAGS = -Wall -g -O2 -c -pthread -D_THREAD_SAFE -D_REENTRANT -DNOODBC -DWITH_STD_MALLOC -DFD_SETSIZE=4096 -DWITH_POLL
COUT = -o 
LN = gcc
LDFLAGS = -Wall -O2 -pthread
# -lpthreads may be reuqired on some platforms instead of -pthreads
LIBS =
LNOUT = -o 
EXESUFFICS =
OBJSUFFICS = .o
DEFINEOPTION = -D
COMPFILES = *~
REMOVECOMMAND = rm -f
TYPECOMMAND = cat
COMPATLIBS =
MAKEFILE = Makefile.unix

include Makefile.inc
Makefile.ccc0100644002537100244200000000101610234747154012453 0ustar  vladmkgroup#$Id: Makefile.ccc,v 1.2 2005/04/30 18:29:00 vlad Exp $
#
# 3 proxy Makefile for Compaq C Compiler
#
# You can try to add -DWITH_STD_MALLOC to CFLAGS to use standard malloc
# libraries

CC = ccc
CFLAGS = -Wall -O2 -c -pthread -D_THREAD_SAFE -DNOODBC -DWITH_STD_MALLOC -DFD_SETSIZE=4096 -WITH_POLL
COUT = -o 
LN = ccc
LDFLAGS = -Wall -O2 -pthread
LIBS =
LNOUT = -o 
EXESUFFICS =
OBJSUFFICS = .o
DEFINEOPTION = -D
COMPFILES = *~
REMOVECOMMAND = rm -f
TYPECOMMAND = cat
COMPATLIBS =
MAKEFILE = Makefile.ccc

include Makefile.inc
Makefile.intl0100644002537100244200000000132610067060706012670 0ustar  vladmkgroup#$Id: Makefile.intl,v 1.1.1.1 2004/06/25 17:32:54 vlad Exp $
#
# 3 proxy Makefile for Intel C compiler for Windows (for both make and nmake)
#
# You can try to add /D "WITH_STD_MALLOC" to CFLAGS to use standard malloc
# libraries


CC = icl
CFLAGS = /nologo /MT /W3 /G6 /GX /O2 /D "WITH_STD_MALLOC" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "_WIN32" /Fp"proxy.pch" /YX /FD /c
COUT = /Fo
LN = xilink
LDFLAGS = /nologo /subsystem:console /incremental:no /machine:I386
LIBS = ws2_32.lib advapi32.lib odbc32.lib user32.lib
LNOUT = /out:
EXESUFFICS = .exe
OBJSUFFICS = .obj
DEFINEOPTION = /D 
COMPFILES = *.pch *.idb
REMOVECOMMAND = del 2>NUL
TYPECOMMAND = type
COMPATLIBS =
MAKEFILE = Makefile.intl

include Makefile.inc
cfg/0.scenario.txt0100755002537100244200000000124010100211663013506 0ustar  vladmkgroupPlease read doc/config.txt before using 3proxy.

In all examples next scenario is used:

3proxy is installed on multihomed host. IP address of internal interface
is 192.168.1.1. IP address of external interface is 10.1.1.1.
Internal network has few subnetworks for 192.168.0.0/16.
Users are named user1, user2, etc.

You use external DNS server 10.1.2.1 and 10.1.2.2

Provider has networks with free access. A list of networks is published
on the provider's Web server.

Provider has proxy server 10.1.2.5. Traffic from proxy server is not free, but
is cheaper than traffic from non-free networks.

$Id: 0.scenario.txt,v 1.2 2004/07/23 13:33:39 vlad Exp $cfg/3proxy.cfg.sample0100755002537100244200000001400310075746000014223 0ustar  vladmkgroup#!/usr/local/bin/3proxy
# Yes, 3proxy.cfg can be executable, in this case you should place
# something like
#config /usr/local/3proxy/3proxy.cfg
# to show which configuration 3proxy should re-read on realod.

#system "echo Hello world!"
# you may use system to execute some external command if proxy starts

# We can configure nservers to avoid unsafe gethostbyname() usage
nserver 10.1.2.1
nserver 10.2.2.2
# nscache is good to save speed, traffic and bandwidth
nscache 65536

#nsrecord porno.security.nnov.ru 0.0.0.0
# nobody will be able to access porno.security.nnov.ru by the name.
#nsrecord wpad.security.nnov.ru www.security.nnov.ru
# wpad.security.nnov.ru will resolve to www.security.nnov.ru for
# clients


timeouts 1 5 30 60 180 1800 15 60
# Here we can change timeout values

users 3APA3A:CL:3apa3a "test:CR:$1$qwer$CHFTUFGqkjue9HyhcMHEe1"
# note that "" required, overvise $... is treated as include file name.
# $1$qwer$CHFTUFGqkjue9HyhcMHEe1 is 'test' in MD5 crypt format.
#users $/usr/local/etc/3proxy/passwd
# this example shows you how to include passwd file. For included files
#  and  are treated as field separators.

#daemon
# now we will not depend on any console (daemonize). daemon must be given
# before any significant command on *nix.

service
# service is required under NT if you want 3proxy to start as service

#log /usr/local/etc/3proxy/logs/3proxy.log D
log c:\3proxy\logs\3proxy.log D
# log allows to specify log file location and rotation, D means logfile
# is created daily

# in log file we want to have underscores instead of spaces
logformat "- +_L%t.%.  %N.%p %E %U %C:%c %R:%r %O %I %h %T"
#logformat "L%d-%m-%Y %H:%M:%S %z %N.%p %E %U %C:%c %R:%r %O %I %h %T"
#logformat "Linsert into log (l_date, l_user, l_service, l_in, l_out, l_descr) values ('%d-%m-%Y %H:%M:%S', '%U', '%N', %I, %O, '%T')"

#archiver gz /bin/gzip %F
#archiver zip zip -m -qq %A %F
#archiver zip pkzipc -add -silent -move %A %F
archiver rar rar a -df -inul %A %F
# if archiver specified log file will be compressed after closing.
# you should specify extension, path to archiver and command line, %A will be
# substituted with archive file name, %f - with original file name.
# Original file will not be removed, so archiver should care about it.

rotate 30
# We will keep last 30 log files

auth iponly
#auth nbname
#auth strong
# auth specifies type of user authentication. If you specify none proxy
# will not do anything to check name of the user. If you specify
# nbname proxy will send NetBIOS name request packet to UDP/137 of
# client and parse request for NetBIOS name of messanger service.
# Strong means that proxy will check password. For strong authentication
# unknown user will not be allowed to use proxy regardless of ACL.
# If you do not want username to be checked but wanna ACL to work you should
# specify auth iponly.


#allow ADMINISTRATOR,root
#allow * 127.0.0.1,192.168.1.1 * *
#redirect 192.168.1.2 80 * * * 80
#allow * 192.168.1.0/24 * 25,53,110,20-21,1024-65535
# we will allow everything if username matches ADMINISTRATOR or root or
# client ip is 127.0.0.1 or 192.168.1.1. Overwise we will redirect any request
# to port 80 to our Web-server 192.168.0.2.
# We will allow any outgoing connections from network 192.168.1.0/24 to
# SMTP, POP3, FTP, DNS and unprivileged ports.
# Note, that redirect may also be used with proxy or portmapper. It will
# allow you to redirect requests to different ports or different server
# for different clients.

#  sharing access to internet

external 10.1.1.1
# external is address 3proxy uses for outgoing connections. 0.0.0.0 means any
# interface. Using 0.0.0.0 is not good because it allows to connect to 127.0.0.1

internal 192.168.1.1
# internal is address of interface proxy will listen for incoming requests
# 127.0.0.1 means only localhost will be able to use this proxy. This is
# address you should specify for clients as proxy IP.
# You MAY use 0.0.0.0 but you shouldn't, because it's a chance for you to
# have open proxy in your network in this case.

auth none
# no authentication is requires

dnspr

# dnsproxy listens on UDP/53 to answer client's DNS requests. It requires
# nserver/nscache configuration.


#external $./external.ip
#internal $./internal.ip
# this is just an alternative form fo giving external and internal address
# allows you to read this addresses from files

auth strong
# We want to protect internal interface
deny * * 127.0.0.1,192.168.1.1
# and llow HTTP and HTTPS traffic.
allow * * * 80-88,8080-8088 HTTP
allow * * * 443,8443 HTTPS
proxy -n

auth none
# pop3p will be used without any authentication. It's bad choice
# because it's possible to use pop3p to access any port
pop3p

tcppm 25 mail.my.provider 25
#udppm -s 53 ns.my.provider 53
# we can portmap port TCP/25 to provider's SMTP server and UDP/53
# to provider's DNS.
# Now we can use our proxy as SMTP and DNS server.
# -s switch for UDP means "single packet" service - instead of setting
# association for period of time association will only be set for 1 packet.
# It's very userfull for services like DNS but not for some massive services
# like multimedia streams or online games.

auth strong
flush
allow 3APA3A,test
maxconn 20
socks
# for socks we will use password authentication and different access control -
# we flush previously configured ACL list and create new one to allow users
# test and 3APA3A to connect from any location


auth strong
flush
internal 127.0.0.1
allow 3APA3A 127.0.0.1
maxconn 3
admin
#only allow acces to admin interface for user 3APA3A from 127.0.0.1 address
#via 127.0.0.1 address.

# map external 80 and 443 ports to internal Web server
# examples below show how to use 3proxy to publish Web server in internal
# network to Internet. We must switch internal and external addresses and
# flush any ACLs

#auth none
#flush
#external $./internal.ip
#internal $./external.ip
#maxconn 300
#tcppm 80 websrv 80
#tcppm 443 websrv 443


#chroot /usr/local/jail
#setgid 65535
#setuid 65535
# now we needn't any root rights. We can chroot and setgid/setuid.


###$Id: 3proxy.cfg.sample,v 1.5 2004/07/16 12:37:20 vlad Exp $#######
cfg/counters.sample0100755002537100244200000000337710100211663014066 0ustar  vladmkgroup# Scenario:
# You're billed for traffic except internal networks 
# 192.168.0.0 mask 255.255.0.0 and 10.0.0.0 mask 255.0.0.0.
# If you exceed 2Gb limit you will have very high penalty
#
# You want to have daily report about common amount of external traffic.
# You also need to know amount of Web traffic for every user
# You want to limit Web traffic to 100Mb/day to whole campus and
# to 20MB/day to every user

# see explanations in 3proxy.cfg.sample
internal 192.168.1.1
external 10.1.1.1
nserver 10.1.2.1
nserver 10.2.2.2
nscache 65536
dnspr

# no logging will be used, only traffic reports

# use  d:\3proxy\3profy.3cf to store counters data
# generate daily traffic reports in d:\3proxy\traf\
counter "d:\3proxy\3profy.3cf" D "d:\3proxy\traf\traf"

# define users
users "user1:CL:password1" "user2:CL:password2" "user3:CL:password3"
users "user4:CL:password4" "user5:CL:password5" "user6:CL:password6"
# ...

# do not count traffic for 192.168.0.0/16,10.0.0.0/8
nocountin * * 192.168.0.0/16,10.0.0.0/8
# Count external traffic summary for all clients with limit to 100MB/day
countin "1/Test 1" D 100 *
# Count external Web traffic summary for all clients to 1Gb/month
countin "2/Test 2" M 1024 vlad,3APA3A,test 127.0.0.1 * 80,81,8080-8088
# For every user count and limit daily Web traffic to 20 Mb
# There is no way to configure it in a single line, we need a line
# for every user we have
countin "3/User 1" D 20 user1 * * 80,81,8080-8088
countin "4/User 2" D 20 user2 * * 80,81,8080-8088
# ...
countin "202/User 200" D 20 user200 * * 80,81,8080-8088

# enable proxy
auth strong
proxy

# enable administration to user1 from localhost
internal 127.0.0.1
allow user1
admin

#$Id: counters.sample,v 1.2 2004/07/23 13:33:39 vlad Exp $cfg/sql/3proxy.cfg0100755002537100244200000000252410100212066013534 0ustar  vladmkgroup# By Mark Dreuband
nserver 10.1.2.1
nscache 65536

# we can grab wpad file from provider and feed it to dighosts
# to build list of free networks
# system "c:\3proxy\dighosts.exe -m http://wpad.security.nnov.ru/wpad.dat c:\3proxy\freenetworks.net"

service

internal 192.168.1.1
external 10.1.1.1

dnspr

log &3proxylog,root
#log c:\3proxy\logs\proxy.log D
#logformat "Linsert into log (timestamp, username, service, clientip, remoteip, remoteport, bytesin, bytesout,request,error) values (
#logformat "%t '%U' '%N' '%C' '%R' %r %I %O '%T' %E"
logformat "Linsert into log (time, bytesin, bytesout, username, url, host, port, service) values ('%Y-%m-%d %H:%M:%S', %I, %O, '%U', '%T', '%n', %r, '%N');"
archiver zip c:\3proxy\zip.exe -m -qq %A %F
rotate 50


auth strong
users temp:CL:password root:CL:password

# access free networks directly
allow * * $c:\3proxy\freenetworks.net
# redirect web traffic for non-free networks to provider's proxy
allow * * * 80
parent 1000 http 10.1.2.5 3128 
# allow rest of traffic
allow *
proxy

flush

auth iponly
allow *
pop3p
tcppm 25 mail.security.nnov.ru 25

flush
# redirect port 80 traffic via SOCKS server to local HTTP proxy to
# have URLs logged
allow  * * * 80
parent 1000 http 0.0.0.0 0
allow *
socks

#daemon

#$Id: 3proxy.cfg,v 1.1 2004/07/23 13:35:50 vlad Exp $cfg/sql/create.sql0100755002537100244200000000401110100212067013565 0ustar  vladmkgroup# Connection: localhost
# Host: 127.0.0.1
# Saved: 2004-04-09 18:53:52
# 
# Host: 127.0.0.1
# Database: 3proxy
# Table: 'log'
# 
CREATE TABLE `log` (
  `time` datetime NOT NULL default '0000-00-00 00:00:00',
  `bytesin` int(11) NOT NULL default '0',
  `bytesout` int(11) NOT NULL default '0',
  `username` varchar(20) NOT NULL default '',
  `service` varchar(7) NOT NULL default '',
  `host` varchar(100) NOT NULL default '',
  `port` int(11) NOT NULL default '0',
  `url` varchar(255) NOT NULL default ''
) TYPE=MyISAM; 

CREATE TABLE `services` (
  `startport` int(11) NOT NULL default '0',
  `endport` int(11) NOT NULL default '0',
  `service` varchar(100) NOT NULL default '',
  `description` varchar(100) NOT NULL default ''
) TYPE=MyISAM; 

CREATE TABLE `timelimit` (
  `datefrom` datetime NOT NULL default '0000-00-00 00:00:00',
  `dateto` datetime NOT NULL default '0000-00-00 00:00:00'
) TYPE=MyISAM; 

INSERT INTO services (80, 80, NULL, 'Access to Web Server');

INSERT INTO services (443, 443, NULL, 'Secure Access to Web Server');

INSERT INTO services (3128, 3128, NULL, 'Access to Web server via external Proxy');
INSERT INTO services (1080, 1080, NULL, 'Access to external SOCKS server');
INSERT INTO services (5190, 5190, NULL, 'Access to ICQ');
INSERT INTO services (6666, 6668, NULL, 'Access to IRC');

INSERT INTO services (119, 119, NULL, 'Access to news server');
INSERT INTO services (25, 25, NULL, 'Sent Mail');

INSERT INTO services (0, 0, 'POP3P', 'Received Mail');
INSERT INTO services (0, 0, 'TCPPM', 'Access to external server via TCP mapping);
INSERT INTO services (0, 0, 'UDPPM', 'Access to external server via UDP mapping);
INSERT INTO services (0, 0, 'PROXY', 'Access to external server via Proxy');
INSERT INTO services (0, 0, 'SOCKS4', 'Access to external server via Socks v4');
INSERT INTO services (0, 0, 'SOCKS5', 'Access to external server via Socks v5');
INSERT INTO services (0, 0, 'DNSPR', 'Name resolution');
INSERT INTO services (0, 0, NULL, 'Unknown');


#$Id: create.sql,v 1.1 2004/07/23 13:35:51 vlad Exp $cfg/sql/report.xls0100755002537100244200000016100010075007400013652 0ustar  vladmkgroupÐÏࡱá>þÿ	BþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿýÿÿÿA	

 !"#$%&'()*+,-./0123456789:;<=>?@þÿÿÿPSDEFGHIJKLMNOQ_RTgUVWXYZ[\]^`eabcdfþÿÿÿhþÿÿÿijklmnoþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿRoot Entryÿÿÿÿÿÿÿÿ ÀF’Š1:öhÄÐk@§ˆjÄC@OWorkbookÿÿÿÿÿÿÿÿ|_VBA_PROJECT_CUR"€d ›öhÄÀ¯ì›öhÄVBAÿÿÿÿÿÿÿÿ`i§›öhÄàWÞ›öhÄ	ÍÉÀá°Áâ\pVladimir Dubrovin                                                                                            B°aÀ=Óº-B0=830œ¯¼=à-L,$8X@"·Ú1"ÈÿÌ	Arial Cyr1"ÈÿÌ	Arial Cyr1"ÈÿÌ	Arial Cyr1"ÈÿÌ	Arial Cyr1" ÿÌ	Arial Cyr1"Èÿ¼Ì	Arial Cyr1"ÈÌ	Arial Cyr1"È$Ì	Arial Cyr/#,##0"@.";\-#,##0"@."9#,##0"@.";[Red]\-#,##0"@.";#,##0.00"@.";\-#,##0.00"@."E #,##0.00"@.";[Red]\-#,##0.00"@."k*3_-* #,##0"@."_-;\-* #,##0"@."_-;_-* "-""@."_-;_-@_-k)3_-* #,##0_@_._-;\-* #,##0_@_._-;_-* "-"_@_._-;_-@_-{,;_-* #,##0.00"@."_-;\-* #,##0.00"@."_-;_-* "-"??"@."_-;_-@_-{+;_-* #,##0.00_@_._-;\-* #,##0.00_@_._-;_-* "-"??_@_._-;_-@_-;¤[$-FC19]d\ mmmm\ yyyy\ "3."
¥0.000àõÿ À àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ àõÿ ôÀ à À àôÿôÀ à,õÿ øÀ à*õÿ øÀ àôÿôÀ à	õÿ øÀ à+õÿ øÀ à)õÿ øÀ à À à À à XÀ ॠÀ ॠ\À ॠÀ à  À à $À à $À “€ÿ“€ÿ“€ÿ“€ÿ“€	ÿ“€ÿ“€ÿ“€ÿ`…Ü 8AB1…D48AB2…ÔL8AB3Œ®þÿþÿ!
;8$ExternalData_1:E%ExternalData_10:%ExternalData_10:>%ExternalData_11:%ExternalData_11:=%ExternalData_12:%ExternalData_12:=%ExternalData_13:%ExternalData_13:<%ExternalData_14:%ExternalData_14:;%ExternalData_15:
%ExternalData_15::%ExternalData_16:%ExternalData_16:9%ExternalData_17:%ExternalData_17:8%ExternalData_18:
%ExternalData_18:7%ExternalData_19:
%ExternalData_20:	%ExternalData_20:6%ExternalData_21:	%ExternalData_22:%ExternalData_22:5%ExternalData_23:%ExternalData_24:%ExternalData_24:5%ExternalData_25:%ExternalData_26:%ExternalData_26:5%ExternalData_27:%ExternalData_28:%ExternalData_28:4%ExternalData_29:$ExternalData_3<%ExternalData_30:%ExternalData_30:3%ExternalData_31:%ExternalData_32:%ExternalData_32:3%ExternalData_33:+%ExternalData_33:2%ExternalData_34:,%ExternalData_34:1%ExternalData_35:+%ExternalData_35:1%ExternalData_36:,%ExternalData_36:1%ExternalData_37:+%ExternalData_38:,%ExternalData_39:+%ExternalData_39:0$ExternalData_4<$ExternalData_4:D%ExternalData_40:,%ExternalData_41:+%ExternalData_41:0%ExternalData_42:,%ExternalData_42:/%ExternalData_43:/%ExternalData_44:.%ExternalData_45:-%ExternalData_46:,%ExternalData_47:+%ExternalData_48:+%ExternalData_49:*$ExternalData_5<$ExternalData_5:C%ExternalData_50:)%ExternalData_51:)%ExternalData_53:(%ExternalData_54:'%ExternalData_55:&%ExternalData_56:%%ExternalData_57:%%ExternalData_58:$%ExternalData_59:$$ExternalData_6<$ExternalData_6:B%ExternalData_60:#%ExternalData_61:#%ExternalData_62:"%ExternalData_63:!%ExternalData_64: %ExternalData_65: %ExternalData_66:%ExternalData_67:%ExternalData_68:%ExternalData_69:$ExternalData_7:$ExternalData_7:A%ExternalData_70:%ExternalData_71:%ExternalData_72:%ExternalData_73:%ExternalData_74:%ExternalData_75:%ExternalData_76:%ExternalData_77:%ExternalData_78:%ExternalData_79:$ExternalData_8:$ExternalData_8:@%ExternalData_80:%ExternalData_81:%ExternalData_82:%ExternalData_83:%ExternalData_84:
%ExternalData_85:%ExternalData_86:%ExternalData_87:
%ExternalData_88:	%ExternalData_89:$ExternalData_9:$ExternalData_9:?%ExternalData_90:%ExternalData_91:%ExternalData_92:%ExternalData_93:%ExternalData_94:%ExternalData_95:%ExternalData_96:Œset_time_limit@0?@>A_87_3proxylog;CÁÁ"¾ëbðZð 3ð¿AÀ@@ñ
÷üÀ""0B0 =0G0;0 >BG5B0'0B0 >:>=G0=8O >BG5B0 (=5 2:;NG8B5;L=>)ExternalData_65ExternalData_66ExternalData_67ExternalData_68ExternalData_69ExternalData_70ExternalData_71ExternalData_72ExternalData_73ExternalData_74ExternalData_75ExternalData_76ExternalData_77ExternalData_78ExternalData_79ExternalData_80ExternalData_81ExternalData_82ExternalData_83ExternalData_84ExternalData_85ExternalData_86ExternalData_87ExternalData_88ExternalData_89ExternalData_90ExternalData_91ExternalData_92ExternalData_93ExternalData_94ExternalData_95ExternalData_96ÿ*Ù½ðM€Ým  ccî
	ÍÉÀD¶$i*q/Q0
dü©ñÒMbP?_*+‚€%ÿÁƒ„M\\grand\HP LaserJet IIIÜ4Cï€	š4d,,A4ÿÿÿÿDINU"4_ÁúÉ¡"	d,,à?à?U}Û}Û}}¶M}¶M}}m}m}		’}

IL}m}$	>;L7>20B5;LàDÿ€ÿÿÿÿÿÿÿÿ	ÿ
ÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¾¾¾¾¾¾¾¾¾	¾
¾¾¾
¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾×D¸l
 ÿ!ÿ"ÿ#ÿ$ÿ%ÿ&ÿ'ÿ(ÿ)ÿ*ÿ+ÿ,ÿ-ÿ.ÿ/ÿ0ÿ1ÿ2ÿ3ÿ4ÿ5ÿ6ÿ7ÿ8ÿ9ÿ:ÿ;ÿ<ÿ=ÿ>ÿ?ÿ¾ ¾!¾"¾#¾$¾%¾&¾'¾(¾)¾*¾+¾,¾-¾.¾/¾0¾1¾2¾3¾4¾5¾6¾7¾8¾9¾:¾;¾<¾=¾>¾?×DÀl@ÿAÿBÿCÿ¾@¾A¾B¾C×˜<ìPðHðð0ð(	ð
ð>¶@CCÿ­5H0?@>A 87 3proxylogÜÍËÈselect username,sum(bytesin)/1048576,host,services.description  
from log,services,timelimit  
where bytesin>0  and log.service like services.service and 
log.port between services.startport and se͇„rvices.endport and
log.time between timelimit.datefrom and timelimit.dateto
group by host 
order by username asc, bytesin   desc;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;;0?@>A 87 3proxylog=3,C
username#sum(bytesin)/1048576	host
descriptionï7º
8AB1tt
	ÍÉÀ8‰:
dü©ñÒMbP?_*+‚€%ÿÁƒ„M\\grand\HP LaserJet IIIÜ4Cï€	š4d,,A4ÿÿÿÿDINU"4_ÁúÉ¡"	d,,à?à?U}’%}Û}$	}$	}$	}$}}		¶}

Û}’}Û}

}$}}¶
}}$	ÿÿý
~
 ˜â@:ÄqÿÿD÷ý$DÀAE.DÀAD.DÀACBP2004.4.8¾$ý
~
à˜â@:Øqÿÿþ$DÀAE.DÀAD.DÀACBP	2004.4.10¾$×K‘ìÎðÎ ðð¶ð(	ð
ðð~’
ð
£ð<€h„	…‹¿CƒC¿À@¿ðÀüÄð],@h„	8oÌ÷Ѓ	9}ì
ð¶$<>;CG8BL >BG5B<[>¶@­YExternalData_21ƒÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_21.5,		­YExternalData_22ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_22.5,­YExternalData_23ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_23.5,­YExternalData_24ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_24.5,­YExternalData_25ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_25.5,­YExternalData_26ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_26.5,­YExternalData_27ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_27.5,­YExternalData_28ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_28.5,­YExternalData_29ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_29.5,­YExternalData_30ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_30.5,­YExternalData_31ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_31.5,­YExternalData_32ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_32.5,ï7º
8AB2
	ÍÉÀM|O
dü©ñÒMbP?_*+‚€%ÿÁƒ„¡"ÿà?à?U!!ÿý
!ý
 ý
ý
ý
ý
ý
ý
ý
	ý

ý
ý
ý

ý
ý
ý
ý
ý
ý
ý
ý

ý
ý
ý

ý
	ý
ý
ý
ý
ý
ý
ý
 ×Ô>¶@­YExternalData_65ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_65.5,  ­YExternalData_66ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_66.5,­YExternalData_67ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_67.5,­YExternalData_68ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_68.5,­YExternalData_69ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_69.5,­YExternalData_70ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_70.5,­YExternalData_71ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_71.5,­YExternalData_72ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_72.5,­YExternalData_73ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_73.5,­YExternalData_74ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_74.5,­YExternalData_75ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_75.5,­YExternalData_76ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_76.5,­YExternalData_77ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_77.5,­YExternalData_78ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_78.5,­YExternalData_79ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_79.5,­YExternalData_80ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_80.5,­YExternalData_81ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_81.5,­YExternalData_82ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_82.5,­YExternalData_83ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_83.5,­YExternalData_84ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_84.5,

­YExternalData_85ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_85.5,­YExternalData_86ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_86.5,­YExternalData_87ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_87.5,

­YExternalData_88ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.9','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_88.5,		­YExternalData_89ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_89.5,­YExternalData_90ÜÍKHinsert into timelimit (datefrom, dateto) values ('2004.4.9','2004.4.9');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_90.5,­YExternalData_91ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_91.5,­YExternalData_92ÜÍKHinsert into timelimit (datefrom, dateto) values ('2004.4.1','2004.4.9');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_92.5,­YExternalData_93ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_93.5,­YExternalData_94ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.1','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_94.5,­YExternalData_95ÜÍdelete from timelimit;Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_95.5,­YExternalData_96ÜÍLIinsert into timelimit (datefrom, dateto) values ('2004.4.8','2004.4.10');Í~{DSN=3proxylog;DESC=MySQL ODBC 3.51 Driver DSN;DATABASE=3proxy;SERVER=localhost;UID=root;PASSWORD=;PORT=3306;OPTION=3;STMT=;$ExternalData_96.5,ï7º
8AB3
-B0=830ÿÿÿÿÿÿÿÿÔ8AB1ÿÿÿÿÿÿÿÿÐ8AB2ÿÿÿÿ u8AB3ÿÿÿÿÿÿÿÿÿÿÿÿRÐ	

þÿÿÿþÿÿÿ!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQþÿÿÿSTUVWXYZ[\]^_`aþÿÿÿcdefghijklmnopqrstuvwxyz{|}~€ðÄÔÿÿÿÿË¥vÝÿÿ#ˆ¶ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿxÿÿMEÿÿÿÿÿÿÿÿÿÿßÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ(SLÿÿÿÿSÿÿÿÿS”ÿÿÿÿ<ÿÿÿÿÿÿN0{00020819-0000-0000-C000-000000000046}ÿÿÿÿ8€þÿÿÿÿÿÿÿ(ÿÿÿÿÿÿÿÿÿÿ%ÿÿÿÿHÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿßþÊÿÿÿÿÿÿÿÿxÿÿÿÿ«°Attribute VB_Name = "ÝòàÊíèãà"

øBas|0{00020819-u 0C$0046}
|GlobalÈSpacA’FalsedC€reatablPredecla‰Id­Tru
B@ExposeTemplateD0eriv$’Bus`tomizD2ðÄÔÿÿÿÿË¥v!ÿÿ#ˆ¶ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿxÿÿMEÿÿÿÿÿÿÿÿÿÿßÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ(SLÿÿÿÿSÿÿÿÿS”ÿÿÿÿ<ÿÿÿÿÿÿN0{00020820-0000-0000-C000-000000000046}ÿÿÿÿ8€þÿÿÿÿÿÿÿ(ÿÿÿÿÿÿÿÿÿÿ%ÿÿÿÿHÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿßþÊÿÿÿÿÿÿÿÿxÿÿÿÿ§°Attribute VB_Name = "Ëèñ ò1"

àBasp0{0002`0820- C$0046}
|GlobalÂSpac’FalseÈCreatablPredeclaIdªTru
BExposeTemplateDeriv$’BustomizD2ð$Ôÿÿÿÿ,X	¥v>ÿÿ#ˆ¶ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿxÿÿMEÿÿÿÿÿÿÿÿÿÿßÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ(SLÿÿÿÿSÿÿÿÿS”ÿÿÿÿ<ÿÿ(ÿÿN0{00020820-0000-0000-C000-000000000046}ÿÿÿÿ˜ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ&” „&ÿÿÿÿÿÿÿÿX%€þÿÿÿÿÿÿÿˆÿÿ`ÿÿÿÿÿÿÿÿ%ÿÿÿÿhÿÿÿÿÿÿÿÿÿÿ`ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ`ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿßþÊ&"€	(
@€	&Px
€	& €	ÿÿÿÿ€	È€	ÿÿÿÿ€	ÿÿÿÿ€	ÿÿÿÿ€	àø€88€	hp€	(Ø€	<X`€	ÿÿÿÿZh8È<@H€	ÿÿÿÿ€	ÿÿÿÿ€	P€	*p€	 €	*Àðÿÿÿÿ–àÎ÷èñòêà ñîñåäíèõ ÿ÷ååê¶D1$B@H  B@"à    Selection.QueryTable.Delete¶E1$B@H  B@"à    Selection.QueryTable.DeleteàÏðèåì ïàðàìåòðîâàÂûïîëíåíèå çàïðîñà¶Ëèñò2$$B@Hÿÿ]ò@¶delete from timelimit;'*ÿÿ¶0ODBC;DSN=3proxylog;UID=root;PWD=;Database=3proxy',àasqlstring1 = "insert into timelimit (datefrom, dateto) values (" + datefrom + "," + dateto + ");"à"sqlstring = sqlstring + sqlstring1àMsgBox (datefrom)¦ ,Ñ4¶X300$Ñ6 *Ñ8 .!0%2õC@:qÿÿ˜¶2insert into timelimit (datefrom, dateto) values (' <¶',' >¶');'*¶0ODBC;DSN=3proxylog;UID=root;PWD=;Database=3proxy',¦ ,Ñ4¶X301$Ñ6 *Ñ8 .!0%2õC@:qÿÿ°àColumns("D:D").Selectà$Selection.EntireColumn.Hidden = TrueàColumns("E:E").Selectà$Selection.EntireColumn.Hidden = True¶B1$B@Høoÿÿðÿÿÿÿèÿÿÿÿ³Attribute VB_Name = "Ëèñ ò2"

àBasp0{0002`0820- C$0046}
|GlobalÂSpac’FalseÈCreatablPredeclaIdªTru
BExposeTemplateDeriv$’Bustomi6zD2P€€ Sub CommandButton1_Click(@)
'Î÷êà ñîñåäíèõ ÿ÷ååê
 Range("D1").ÀSelectƒƒion.ClearContents€&‡Quer¤yTI.Dt|+EL+€Ïðèåì ïàðàì€åòðîâ
,AÁ'Âûïîëíåíèå çà ïðîñàD4he0ets(Ä‘K;Dim qt As CÇ3C
sqls£n
g dB8 from timeli0mit;•conn‡
ODBC;DSN=3proxylog;UID=root;PàWD=;D”@¯'Æ1insert into1 (d€|!, Ato) values (" +Â(+ ",=€)+Ç€Ç8+ ÇÃ?'MsgBoxÇ”A;WithP Act¬SV.Ns.Add(@Œ&n@“@:=‡F, _ÃÁÁDest0inatÂ	DX300"), Sq8l:=.R@efreshC	Eønd Á££¦¿(Êm¯('Í(',F)~'&)ß>ß>¿) -o~n¿)¯) p¿)´)ã)'@ColumnÀgD:DL…'§Entirec.Hidxden0C•7ÇE¼:EßAÑäDB©‹¡@  
ðÄÔÿÿÿÿË¥vÿÿ#ˆ¶ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿxÿÿMEÿÿÿÿÿÿÿÿÿÿßÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ(SLÿÿÿÿSÿÿÿÿS”ÿÿÿÿ<ÿÿÿÿÿÿN0{00020820-0000-0000-C000-000000000046}ÿÿÿÿ8€þÿÿÿÿÿÿÿ(ÿÿÿÿÿÿÿÿÿÿ%ÿÿÿÿHÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿßþÊÿÿÿÿÿÿÿÿxÿÿÿÿ§°Attribute VB_Name = "Ëèñ ò3"

àBasp0{0002`0820- C$0046}
|GlobalÂSpac’FalseÈCreatablPredeclaIdªTru
BExposeTemplateDeriv$’BustomizD2ðÜÔ°ÿÿÿÿÛ¥vþIÿÿ¶ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿxÿÿMEÿÿÿÿÿÿÿÿÿÿßÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ(Module1
ÿÿÿÿb^__SRP_2ÿÿÿÿÿÿÿÿÿÿÿÿT__SRP_3ÿÿÿÿ’g_VBA_PROJECTÿÿÿÿÿÿÿÿÿÿÿÿ”ÿ
<ÿÿ(6
ÿÿÿÿ<ÿÿ<ÿÿÿÿÿÿÿÿÿÿ Dÿÿÿÿ`ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ##„ „&ÿÿÿÿÿÿÿÿX%ÿÿÿÿƒBÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ%ÿÿÿÿ`ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿhÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ`nöÒA$*\Rffff*064252f51bßþÊ#"
 €	&0€	Xpˆ€	 ÀЀ	è€	ÿÿÿÿ€	ÿÿÿÿ€	0€HP8p€	h¨€	(€	8:P˜€	ÿÿÿÿZ 8:8x€ˆ ¸Ðÿÿÿÿà–¶X:Y$B@H  B@"à    Selection.QueryTable.DeleteàÏðèåì ïàðàìåòðîâ¶Ëèñò2$$B@H‚ƒ„…†‡ˆ‰Š‹ŒŽþÿÿÿ‘þÿÿÿ“þÿÿÿ•–—˜™š›œžŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËþÿÿÿÍÎÏÐÑÒÓÔÕÖ×ØÙþÿÿÿÛÜÝÞßàáâãäåæçèéêëìíîïðñþÿÿÿóþÿÿÿõþÿÿÿ÷øùúûüýþÿ¶C1$B@HàDim datefrom As Integer.D F!H'<Ïð¶C2$B@HÂûàDim dateto As Integerø F!H'>@àÂûïîëíåíèå çàïðîñà¶Ëèñò3$$B@Hpr]ò@¶delete from timelimit;'*,¶0ODBC;DSN=3proxylog;UID=root;PWD=;Database=3proxy',àasqlstring1 = "insert into timelimit (datefrom, dateto) values (" + datefrom + "," + dateto + ");"à"sqlstring = sqlstring + sqlstring1àMsgBox (datefrom)¦ ,Ñ4¶B1$Ñ6 *Ñ8 .!0%2õC@:qÿÿ`¶2insert into timelimit (datefrom, dateto) values (' <¶',' >¶');'*¶0ODBC;DSN=3proxylog;UID=root;PWD=;Database=3proxy',¦ ,Ñ4¶B1$Ñ6 *Ñ8 .!0%2õC@:qÿÿx¶Ëèñò1$$B@H¶A2$B@H·ÑJ  !(B@:oÿÿ(ÿÿÿÿ ÿÿÿÿy²Attribute VB_Name = "Module1"
Sub set_time_limi@t()
 Range("X:Y").Select0ion.ClearContents
'l:QueryT@able.D>te!Ïðèåì ïàðàìåòðîâQheets€("Ëèñò2m	†C1'Dim datefro@m As I†gerQ= ActiveCellà.Valu€BS+ó
7+to*)+
rÂûïîëíåíèå çà ïðîñàs3g9fqt9›ƒsq¤lsángÜd¤n ‚yÙ‚Ø;€ã>connODBC;DSN=3proxylog;UID=root;PWD=;Dat`abase'Æ1inser0t in> (ÅW,‚`to) vÁVs (" +‡ep+ ",€)Ï+Ç€Ç8+ ÇÃ?€'MsgBoxǡħWithwSÁ.Ns.Add(M¦n­ª:=‡F, _ÃALÁDes`tinatÂ	„…B@›, Sql:='†#„.R@esÂhEnd #C—CF
òP'
Q',†ýƒQ'ÆQ?} )@K)þ )ãS)Bâ:ä‚í$5A
xòä5 Background‚E:=Fals ‚A8 ¡
rU€€€€~|		ÿÿÿÿkrU€€€	ÿÿÿÿÿÿÿÿ$`ýÿÿÿÿÿÿÿÿÿÿÿnÌasÿ	ãú*\G{000204EF-0000-0000-C000-000000000046}#4.0#9#F:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020813-0000-0000-C000-000000000046}#1.4#0#F:\Program Files\Microsoft Office\Office10\EXCEL.EXE#Microsoft Excel 10.0 Object Library¼*\G{00020430-0000-0000-C000-000000000046}#2.0#0#G:\WINDOWS\System32\STDOLE2.TLB#OLE Automation(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.2#0#G:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL#Microsoft Office 11.0 Object LibraryÞ*\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#F:\WINDOWS\System32\FM20.DLL#Microsoft Forms 2.0 Object Library*\G{FB99786F-F204-4F7B-BB73-FAC0F5923C35}#2.0#0#F:\DOCUME~1\vlad\LOCALS~1\Temp\Excel8.0\MSForms.exd#Microsoft Forms 2.0 Object Libraryá.E
à….`ŒM´
ÿÿÿÿÿÿÿÿnöÒAÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¥v-B0=830014252f4eeÿÿ-B0=830ÿÿÝ%ÿÿ
8AB1024252f4eeÿÿ
8AB1ÿÿ!%ÿÿ
8AB2034252f4eeÿÿ
8AB2ÿÿ>0^	ÿÿ
8AB3044252f4eeÿÿA
8AB3ÿÿH%ÿÿModule1064252f51bÿÿBModule1ÿÿþI`áÿÿx€ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿHÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ`ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿʨNÆjž@ŠšÞ	ýÅŒÿÿÿÿì+%D›V^N±w¥”d}Àÿÿÿÿ:¿ØÔÜLŠ"ý±µãjÿÿÿÿôÃߪ‡%@’çÒÃ÷ΚÇÿÿÿÿRÑÉ”IJG­`þƒ€T‡ÿÿÿÿÿÿÿÿ€%&ÿh)Excel€+0VBA÷â0Win160Win32Õ0Mac³²0VBA6­#0
VBAProject¾¿0stdole“`0Officeu0MSFormsC0ÝòàÊíèãà€]0	€ÿ_EvaluateÙ0Ëèñò1ô»0Ëèñò2õ»0CommandButton1_ClickäÁ0RangeÚ0	SelectionZ®0
ClearContents{Ü0Sheets
0qtÞ^0
QueryTable„:0	sqlstringìù0
connstringO;0ActiveSheet%N0QueryTables‹0Add÷r0
ConnectionÚØ0Destinationл0Sql"Õ0Refresh0datefromR§0datetoz^0Ëèñò3ö»0Module1b0set_time_limit.­0
ActiveCell½·0ValueäK0BackgroundQueryˆº0ÿÿ„ÿÿÿÿACÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿZK³€0*	pH‚dã
VBAProjeˆct4@j
=
r	nöÒA”J<
r€stdole>stdo€le
h%^*\G{00€020430-C
0046}#2.0#0#G:\WINDOWS\System32\STDOLE2.TLB# Automàation`ƒE Offic„EO¢f€ic‚Ež€”€E2DF8D0dirÿÿÿÿÿÿÿÿÿÿÿÿÌO__SRP_0ÿÿÿÿÿÿÿÿÿÿÿÿÚÉ__SRP_1
	ÿÿÿÿòRPROJECTwmÿÿÿÿÿÿÿÿÿÿÿÿôk4C-5BFA-101B-BD¤E5€EAA€C4€2ˆE€˜gram Files\CommonMicrosoft Shared\OFFICE11\M€SO.DLL#‡ƒM 11.0 ObÁ LibraŒryK€MSForms>„SF§€rms3€¦D452E€E1-E08F`A-8-02608C4D0BB
40FSFM20L'B À_Ì&/;ý"1ÀƒjIqAHq 00}#0Bq#À£€ž50¤€	†ÀAFB99786F-F€‹-4F7ÀfB73-FAC0F5923C35ˆ6DOCUME~1\    \@LOCALS@Temp\Exce0l8.0ÀbB7.e3
3Õ+
3(
3+
30
±'+
bmodulÖeà'cmo@—uB—a(Ý2„q	ïá€Am6þI!h6áC“K*sÿÿÿÿrU€€€~~~~~~~~k	É'7&R¯^KO…Îà9DmØØ	ãÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿé
ÿÿÿÿÿÿÿÿÿÿÿÿ	
ÿÿÿÿÿÿÿÿÿÿÿÿ!
ÿÿÿÿÿÿÿÿÿÿÿÿ9ˆ 	yÿÿÿÿÿÿÿÿQÿÿQ		)	
VBAProjectÝòàÊíèãàËèñò1Ëèñò2Ëèñò3Module1ïÀF/c:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLLVBA

iÿÿÿÿ	‘ù0ÀF4c:\Program Files\Microsoft Office\Office10\EXCEL.EXEExcel

aÿÿÿÿ‰@0ÀFc:\WINDOWS\System32\STDOLE2.TLBstdole

qÿÿÿÿ™áPLÐø-ú[½åªDÞR?c:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLLOffice

aÿÿÿÿ‰`á.E
à….`ŒM´c:\WINDOWS\System32\FM20.DLLMSForms

©ñpox™ûò{O»súÀõ’<5
3c:\DOCUME~1\    \LOCALS~1\Temp\Excel8.0\MSForms.exd

a‰ñ€set_time_limit

rU€€€
	ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ	tÝòàÊíèãà-B0=830Ëèñò18AB1Ëèñò28AB2Ëèñò38AB3Module1Module1ID="{548A76B9-A58F-4FB2-8196-0F5954241BE8}"
Document=ÝòàÊíèãà/&H00000000
Document=Ëèñò1/&H00000000
Document=Ëèñò2/&H00000000
PROJECTÿÿÿÿö¦SummaryInformation(ÿÿÿÿÿÿÿÿèDocumentSummaryInformation8ÿÿÿÿÿÿÿÿÿÿÿÿT
CompObjÿÿÿÿÿÿÿÿÿÿÿÿ;a
Document=Ëèñò3/&H00000000
Module=Module1
Package={AC9F2F90-E877-11CE-9F68-00AA00574A4F}
Name="VBAProject"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="7173A242A642A642A642A6"
DPB="E2E031C2A3C3A3C3A3"
GC="53518055F056F0560F"

[Host Extender Info]
&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000
&H00000002={00020818-0000-0000-C000-000000000046};Excel8.0;&H00000000

[Workspace]
ÝòàÊíèãà=0, 0, 0, 0, C
Ëèñò1=154, 154, 782, 612, 
Ëèñò2=132, 132, 760, 590, 
Ëèñò3=0, 0, þÿÿÿþÿÿÿ	

 !"#$%&'()*+,-./0123456789:þÿÿÿ<þÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0, 0, C
Module1=88, 88, 716, 546, Z
þÿà…ŸòùOh«‘+'³Ù0¸@Hd€˜
¤°ã                e                 eMicrosoft Excel@æ°taÄ@€bM›öhÄþÿÕÍÕœ.“—+,ù®0$
	PXhpx€ˆ
àãIPF RAN­
{Ëèñò1Ëèñò2Ëèñò3Ëèñò3!ExternalData_1Ëèñò2!ExternalData_10Ëèñò3!ExternalData_10Ëèñò2!ExternalData_11Ëèñò3!ExternalData_11Ëèñò2!ExternalData_12Ëèñò3!ExternalData_12Ëèñò2!ExternalData_13Ëèñò3!ExternalData_13Ëèñò2!ExternalData_14Ëèñò3!ExternalData_14Ëèñò2!ExternalData_15Ëèñò3!ExternalData_15Ëèñò2!ExternalData_16Ëèñò3!ExternalData_16Ëèñò2!ExternalData_17Ëèñò3!ExternalData_17Ëèñò2!ExternalData_18Ëèñò3!ExternalData_18Ëèñò2!ExternalData_19Ëèñò2!ExternalData_20Ëèñò3!ExternalData_20Ëèñò2!ExternalData_21Ëèñò2!ExternalData_22Ëèñò3!ExternalData_22Ëèñò2!ExternalData_23Ëèñò2!ExternalData_24Ëèñò3!ExternalData_24Ëèñò2!ExternalData_25Ëèñò2!ExternalData_26Ëèñò3!ExternalData_26Ëèñò2!ExternalData_27Ëèñò2!ExternalData_28Ëèñò3!ExternalData_28Ëèñò2!ExternalData_29Ëèñò2!ExternalData_30Ëèñò3!ExternalData_30Ëèñò2!ExternalData_31Ëèñò2!ExternalData_32Ëèñò3!ExternalData_32Ëèñò2!ExternalData_33Ëèñò3!ExternalData_33Ëèñò2!ExternalData_34Ëèñò3!ExternalData_34Ëèñò2!ExternalData_35Ëèñò3!ExternalData_35Ëèñò2!ExternalData_36Ëèñò3!ExternalData_36Ëèñò2!ExternalData_37Ëèñò2!ExternalData_38Ëèñò2!ExternalData_39Ëèñò3!ExternalData_39Ëèñò3!ExternalData_4Ëèñò2!ExternalData_40Ëèñò2!ExternalData_41Ëèñò3!ExternalData_41Ëèñò2!ExternalData_42Ëèñò3!ExternalData_42Ëèñò3!ExternalData_43Ëèñò3!ExternalData_44Ëèñò3!ExternalData_45Ëèñò3!ExternalData_46Ëèñò3!ExternalData_47Ëèñò3!ExternalData_48Ëèñò3!ExternalData_49Ëèñò3!ExternalData_5Ëèñò3!ExternalData_50Ëèñò3!ExternalData_51Ëèñò3!ExternalData_53Ëèñò3!ExternalData_54Ëèñò3!ExternalData_55Ëèñò3!ExternalData_56Ëèñò3!ExternalData_57Ëèñò3!ExternalData_58Ëèñò3!ExternalData_59Ëèñò3!ExternalData_6Ëèñò3!ExternalData_60Ëèñò3!ExternalData_61Ëèñò3!ExternalData_62Ëèñò3!ExternalData_63Ëèñò3!ExternalData_64Ëèñò3!ExternalData_65Ëèñò3!ExternalData_66Ëèñò3!ExternalData_67Ëèñò3!ExternalData_68Ëèñò3!ExternalData_69Ëèñò2!ExternalData_7Ëèñò3!ExternalData_7Ëèñò3!ExternalData_70Ëèñò3!ExternalData_71Ëèñò3!ExternalData_72Ëèñò3!ExternalData_73Ëèñò3!ExternalData_74Ëèñò3!ExternalData_75Ëèñò3!ExternalData_76Ëèñò3!ExternalData_77Ëèñò3!ExternalData_78Ëèñò3!ExternalData_79Ëèñò2!ExternalData_8Ëèñò3!ExternalData_8Ëèñò3!ExternalData_80Ëèñò3!ExternalData_81Ëèñò3!ExternalData_82Ëèñò3!ExternalData_83Ëèñò3!ExternalData_84Ëèñò3!ExternalData_85Ëèñò3!ExternalData_86Ëèñò3!ExternalData_87Ëèñò3!ExternalData_88Ëèñò3!ExternalData_89Ëèñò2!ExternalData_9Ëèñò3!ExternalData_9Ëèñò3!ExternalData_90Ëèñò3!ExternalData_91Ëèñò3!ExternalData_92Ëèñò3!ExternalData_93Ëèñò3!ExternalData_94Ëèñò3!ExternalData_95Ëèñò3!ExternalData_96Ëèñò1!Çàïðîñ_èç_3proxylogËèñòûÈìåíîâàííûå äèàïàçîíûxþÿ
ÿÿÿÿ ÀFËèñò Microsoft ExcelBiff8Excel.Sheet.8ô9²qdoc/ru/example1.txt0100755002537100244200000001103210100211671013714 0ustar  vladmkgroupKOI8-R

Kirill Lopuchov, lopuchov at mail ru

<3proxy>
äÏ×ÏÌØÎÏ ÞÁÓÔÏ ÐÅÒÅÄ ÓÉÓÔÅÍÎÙÍ ÁÄÍÉÎÉÓÔÒÁÔÏÒÏÍ ×ÓÔÁÅÔ ÚÁÄÁÞÁ ÐÒÅÄÏÓÔÁ×ÉÔØ ÄÏÓÔÕÐ Ë Internet ÒÅÓÕÒÓÁÍ ÇÒÕÐÐÅ ÐÏÌØÚÏ×ÁÔÅÌÅÊ (ÎÅÂÏÌØÛÏÊ ÏÆÉÓ,Internet ËÁÆÅ). äÁÎÎÕÀ ÚÁÄÁÞÕ ÍÏÖÎÏ ÒÅÛÉÔØ ÎÅÓËÏÌØËÉÍÉ ÓÐÏÓÏÂÁÍÉ, ÜÔÏ ÎÁÓÔÒÏÊËÁ ÎÁ Internet ÛÌÀÚÅ:
Á) proxy ÓÅÒ×ÅÒÁ
b) ÓÌÕÖÂÙ NAT (ÔÒÁÎÓÌÑÃÉÑ ÓÅÔÅ×ÙÈ ÁÄÒÅÓÏ×) 
c) ÒÁÚÄÁÔØ ËÁÖÄÏÍÕ ÐÏÌØÚÏ×ÁÔÅÌÀ ÒÅÁÌØÎÙÊ IP ÁÄÒÅÓ 

äÁ×ÁÊÔÅ ÒÁÓÓÍÏÔÒÉÍ ÐÅÒ×ÙÊ ÓÁÍÙÊ ÐÒÏÓÔÏÊ ÓÐÏÓÏ ÐÏÄËÌÀÞÅÎÉÑ, ÜÔÏ proxy ÓÅÒ×ÅÒ ÔÒÁÄÉÃÉÏÎÎÏ ÄÌÑ ÔÁËÉÈ ÃÅÌÅÊ ÐÒÉÍÅÎÑÅÔÓÑ ÐÏÐÕÌÑÒÎÙÊ proxy Squid, ÎÏ ÎÅ ×ÓÅÇÄÁ ÂÙ×ÁÅÔ ÎÅÏÂÈÏÄÉÍÏÓÔØ × ÓÔÏÌØ ÔÑÖÅÌÏ×ÁÔÏÊ ÐÒÏÇÒÁÍÍÅ :), ÄÁ É × squid
ÏÔÓÕÔÓÔ×ÕÅÔ ÔÁËÉÅ ÉÎÏÇÄÁ ÎÅÏÂÈÏÄÉÍÙÅ ×ÅÝÉ ËÁË SOCKS4/5 ÓÅÒ×ÅÒ, TCP/UP ÐÏÒÔ ÍÁÐÐÉÎÇ. ðÏÜÔÏÍÕ ×ÔÏÒÙÍ ÎÏÍÅÒÏÍ ÈÏÞÅÔÓÑ ÐÒÅÄÓÔÁ×ÉÔØ ×ÁÛÅÍÕ ×ÎÉÍÁÎÉÀ PROXY ÓÅÒ×ÅÒ, ÐÏ ÎÁÚ×ÁÎÉÅÍ "3proxy" ÁÄÒÅÓ ÓÁÊÔÁ http://www.security.nnov.ru/soft/3proxy/ ÒÁÚÒÁÂÏÔÁÎÎÙÊ ÎÁÛÉÍ ÐÒÏÇÒÁÍÍÉÓÔÏÍ ÉÚ Ç. îÉÖÎÉÊ îÏ×ÇÏÒÏÄ. ïÄÎÉÍ ÉÚ ÇÌÁ×ÎÙÈ ÅÇÏ ÄÏÓÔÏÉÎÓÔ× ÍÎÅ ËÁÖÅÔÓÑ ÜÔÏ ËÏÍÐÁËÔÎÏÓÔØ É ×ÙÓÏËÁÑ ÐÅÒÅÎÏÓÉÍÏÓÔØ. ëÏÄ ÓÅÒ×ÅÒÁ ÎÁÐÉÓÁÎ ÔÁË, ÞÔÏ ÌÅÇËÏ ËÏÍÐÉÌÉÒÕÅÔÓÑ ËÁË ÄÌÑ Win9x/2000/XP ÔÁË É ÄÌÑ Linux É FreeBSD.

óÅÒ×ÅÒ ÐÏÄÄÅÒÖÉ×ÁÅÔ ÓÌÅÄÕÀÝÉÅ ×ÏÚÍÏÖÎÏÓÔÉ:

HTTP(S) proxy 
FTP over HTTP proxy 
SOCKS4/5 proxy 
POP3 proxy 
TCP & UDP ÍÁÐÐÉÎÇ ÐÏÒÔÏ× 
ÌÉÓÔÙ ÄÏÓÔÕÐÁ Ë ÒÁÚÌÉÞÎÙÍ ÓÌÕÖÂÁÍ É ÁÄÒÅÓÁÍ 
ÏÇÒÁÎÉÞÅÎÉÅ ÐÒÏÐÕÓËÎÏÊ ÓÐÏÓÏÂÎÏÓÔÉ ËÁÎÁÌÁ ËÁÖÄÏÇÏ ÐÏÌØÚÏ×ÁÔÅÌÑ (ÞÔÏÂÙ ÐÏÌØÚÏ×ÁÔÅÌØ ÎÅ ÓßÅÌ ×ÅÓØ ËÁÎÁÌ 
ËÁÞÁÑ ËÕÞÕ ÆÁÊÌÏ× × ÎÅÓËÏÌØËÏ ÐÏÔÏËÏ× :) ) 
ÏÇÒÁÎÉÞÅÎÉÅ ÔÒÁÆÉËÁ ÐÏÌØÚÏ×ÁÔÅÌÑ ÎÁ ÄÅÎØ, ÎÅÄÅÌÀ É ÍÅÓÑà 
×ÅÄÅÎÉÅ ÖÕÒÎÁÌÏ× ÞÅÒÅÚ ODBC (ÐÏ ÍÏÅÍÕ ÔÁËÏÇÏ ÎÅÔ ÎÉ × ÏÄÎÏÍ proxy) É syslog É Ô.Ä 
Á×ÔÏÒÉÚÁÃÉÀ ÐÏÌØÚÏ×ÁÔÅÌÅÊ ËÏ ×ÓÅÍ proxy ÓÌÕÖÂÁÍ ÐÏ ÉÍÅÎÉ É ÐÁÒÏÌÀ ÉÌÉ ÐÏ ip ÁÄÒÅÓÁÍ 
ë ÎÅÄÏÓÔÁÔËÁÍ ÍÏÖÎÏ ÏÔÎÅÓÔÉ ÜÔÏ ÏÔÓÕÔÓÔ×ÉÅ ËÜÛÉÒÏ×ÁÎÉÑ ÉÎÆÏÒÍÁÃÉÉ :-|. îÏ × Ó ÐÏÓÌÅÄÎÅÅ ×ÒÅÍÑ Inernet ËÏÎÔÅÎÔ ÓÔÁÎÏ×ÉÔÓÑ ×ÓÅ ÂÏÌÅÅ ÄÉÎÁÍÉÞÅÓËÉÍ (ÔÏ ÅÓÔØ ÎÅ ÐÏÄÄÁÀÝÉÊÓÑ ËÜÛÉÒÏ×ÁÎÉÀ) É ÍÏÖÅÔ ÂÙÔØ ÄÌÑ ËÏÇÏ ÔÏ ÜËÏÎÏÍÉÑ × 25%
ÔÒÁÆÉËÁ ÚÁ ÓÞÅÔ ÅÇÏ ËÜÛÉÒÏ×ÁÎÉÑ ÎÅ ÂÕÄÅÔ ÓÔÏÌØ ËÒÉÔÉÞÎÁ. äÌÑ ÔÅÈ ËÏÍÕ ÖÅ ËÒÉÔÉÞÎÁ, Á×ÔÏÒ ÐÒÅÄÌÁÇÁÅÔ ÐÏËÁ ÉÓÐÏÌØÚÏ×ÁÔØ ÃÅÐÏÞËÕ ÉÚ 2È ÓÅÒ×ÅÒÏ× É × ËÁÞÅÓÔ×Å ËÜÛÁ ÔÁËÉÅ ÓÅÒ×ÅÒÁ ËÁË wwwoffle ÉÌÉ ÉÍ ÐÏÄÏÂÎÙÅ, ÌÉÂÏ ÖÄÁÔØ ÐÏÑ×ÌÅÎÉÑ ÐÏÄÄÅÒÖËÉ ËÅÛÁ × 3proxy :)

õÓÔÁÎÏ×ËÁ

# wget http://www.security.nnov.ru/soft/3proxy/current/3proxy.tgz
# tar -xvzf 3proxy.tgz
# cd 3proxy
# make -f Makefile.unix
# mkdir /usr/local/3proxy
# mkdir /usr/local/3proxy/logs
# mkdir /usr/local/3proxy/stat
# cp 3proxy /usr/local/3proxy
# cp 3proxy.cfg.sample /usr/local/3proxy/3proxy.cfg
# chown -R nobody:nogroup /usr/local/3proxy 
äÁÌÅÅ ÐÒÉ×ÅÄÕ ÎÅÂÏÌØÛÏÊ ÐÒÉÍÅÒ ËÏÎÆÉÇÕÒÁÃÉÏÎÎÏÇÏ ÆÁÊÌÁ 3proxy.cfg Ó 
ËÏÍÍÅÎÔÁÒÉÑÍÉ, ÂÏÌÅÅ ÐÏÄÒÏÂÎÕÀ ÉÎÆÏÒÍÁÃÉÀ ÐÏ ËÏÎÆÉÇÕÒÉÒÏ×ÁÎÉÀ ÍÏÖÎÏ 
ÎÁÊÔÉ ÆÁÊÌÅ 3proxy.cfg.sample ÉÌÉ × 
HowTo http://www.security.nnov.ru/soft/3proxy/howtor.asp
É FAQ http://www.security.nnov.ru/soft/3proxy/faqr.asp

-------------3proxy.cfg-------------
# ÷îéíáîéå !! ÎÅ ÄÏÌÖÎÙ ÂÙÔØ ÐÒÏÂÅÌÏ×
# ÐÅÒÅÄ ÌÀÂÙÍÉ ÏÐÃÉÑÍÉ ËÏÎÆÉÇÕÒÁÃÉÉ !!

# ip ÁÄÒÅÓ DNS ÓÅÒ×ÅÒÁ ÐÒÏ×ÁÊÄÅÒÁ ÉÌÉ ÌÏËÁÌØÎÏÇÏ
nserver 127.0.0.1
timeouts 1 5 30 60 180 1800 15 60

# ÓÏÚÄÁÅÍ Ä×ÕÈ ÐÏÌØÚÏ×ÁÔÅÌÅÊ vasia É petia 
# É ÎÁÚÎÁÞÁÅÍ ÉÍ ÐÁÒÏÌÉ 24555 , 14656 É 45455 ÓÏÏÔ×ÅÔÓÔ×ÅÎÎÏ
users vasia:CL:24555
users petia:CL:14656
users vova:CL:45455

# ÌÏÇ ÆÁÊÌ ÓÏ ÓÐÉÓËÏÍ ÚÁÐÒÏÓÏ× ÐÏÌØÚÏ×ÁÔÅÌÅÊ 
# ÂÕÄÅÔ ÓÏÚÄÁ×ÁÔØÓÑ ËÁÖÄÙÊ ÄÅÎØ ÎÏ×ÙÊ
log /usr/local/3proxy/logs/3proxy.log D
logformat "%d-%m-%Y %H:%M:%S %U %C:%c %R:%r %O %I %T"

# ×ÎÅÛÎÉÊ ÉÎÔÅÒÆÅÊÓ 
# (ÞÅÒÅÚ ËÏÔÏÒÙÊ ÂÕÄÕÔ ÕÈÏÄÉÔØ ÚÁÐÒÏÓÙ ÏÔ ÓÅÒ×ÅÒÁ)
external 10.1.1.1

# ip ÁÄÒÅÓ ÉÎÔÅÒÆÅÊÓÁ ÎÁ ËÏÔÏÒÏÍ ÂÕÄÕÔ ÐÒÉÎÉÍÁÔØÓÑ 
# ÚÁÐÒÏÓÙ ÏÔ ËÌÉÅÎÔÏ×
internal 192.168.1.1

# ÕÓÔÁÎÁ×ÌÉ×ÁÅÍ ÔÉÐ Á×ÔÏÒÉÚÁÃÉÉ ÐÏ ÉÍÅÎÉ É ÐÁÒÏÌÀ
auth strong
# ÒÁÚÒÅÛÁÅÍ ÄÏÓÔÕÐ Ë ÐÏÒÔÁÍ 80,8080-8088
allow * * * 80,8080-8088
# ÒÁÓÓËÏÍÅÎÔÉÒÏ×ÁÔØ ÓÅËÃÉÀ parent ÅÓÌÉ Õ ×ÁÓ ÅÓÔØ ÐÒÏËÓÉ ×ÅÒÈÎÅÇÏ 
# ÕÒÏ×ÎÑ É ÚÁÍÅÎÉÔØ ip,ÐÏÒÔ,ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ É ÐÁÒÏÌØ ÎÁ Ó×ÏÉ ÚÁÎÞÅÎÉÑ 
# parent 1000 http 192.168.0.1 8080 username passwd
# allow *
# ÚÁÐÕÓËÁÅÍ ÓÌÕÖÂÕ HTTP proxy ÎÁ ÐÏÒÔÕ (3128 É 
# -n c ÏÔËÌÀÞÅÎÎÏÊ NTLM Á×ÔÏÒÉÚÁÃÉÅÊ)
proxy -p3128 -n

# ÏÇÒÁÎÉÞÉ×ÁÅÍ ÔÏÌÛÉÎÕ ËÁÎÁÌÁ ÄÌÑ ËÁÖÄÏÇÏ 
# ÐÏÌØÚÏ×ÁÔÅÌÑ vasia É petia × 20000 bps
# Á ÄÌÑ vova 10000 bps
bandlimin 20000 vasia,petia
bandlimin 10000 vova 

# ÚÁÐÕÓËÁÅÍ ÓÅÒ×ÅÒ ÏÔ ÐÏÌØÚÏ×ÁÔÅÌÑ nobody 
# (×ÏÚÍÏÖÎÏ × ×ÁÛÅÊ ïó uid É gid ÐÏÌØÚÏ×ÁÔÅÌÑ nobody
# ÂÕÄÕÔ ÄÒÕÇÉÍÉ ÄÌÑ ÉÈ ÏÐÒÅÄÅÌÅÎÉÑ ×ÏÓÐÏÌØÚÕÊÔÅÓØ ËÏÍÍÁÎÄÏÊ id nobody) 
setgid 65534
setuid 65534
------------------------------------

ðÏÓÌÅ ÔÏÇÏ ËÁË ÍÙ ÓÏÚÄÁÌÉ ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÊ ÆÁÊÌ ÓÅÒ×ÅÒÁ , ÚÁÐÕÓËÁÅÍ 3proxy ËÏÍÁÎÄÏÊ:
/usr/local/3proxy/3proxy /usr/local/3proxy/3proxy.cfg

$Id: example1.txt,v 1.4 2004/07/23 13:33:45 vlad Exp $doc/ru/iodbc.txt0100755002537100244200000000614510100211672013272 0ustar  vladmkgroupKOI8-R

Kirill Lopuchov, lopuchov at mail ru

÷ÅÄÅÎÉÅ ÌÏÇÏ× ÓÅÒ×ÅÒÁ × SQL ÂÁÚÅ ÉÍÅÅÔ Ó×ÏÉ ÐÒÉÅÍÕÝÅÓÔ×Á  ÐÅÒÅÄ ÏÂÙÞÎÙÍÉ 
ÔÅËÓÔÏ×ÙÍÉ ÆÁÊÌÁÍÉ,3proxy ÐÏÄÄÅÒÖÉ×ÁÅÔ ×ÅÄÅÎÉÅ ÌÏÇÏ× ÞÅÒÅÚ ODBC ÍÅÎÅÄÖÅÒ × 
ÌÀÂÏÊ ÂÁÚÅ ÄÁÎÎÙÈ ÉÍÅÀÝÉÈ ODBC ÄÒÁÊ×ÅÒ.üÔÏÔ ÍÅÎÅÄÖÅÒ ÓÔÁÌ ÓÔÁÎÄÁÒÔÏÍ ÄÅ-ÆÁËÔÏ
× ÓÒÅÄÅ Windows , ÞÅÇÏ Ë ÓÏÖÁÌÅÎÉÀ ÎÅ ÓËÁÖÅÛ ÐÒÏ Unix, ÐÏ ÜÔÏÍÕ ÄÁÌÅÅ 
ÒÁÓÓÍÏÔÒÉÍ ÎÁ ÐÒÉÍÅÒÅ  FreeBSD ÎÁÓÔÒÏÊËÕ ×ÅÄÅÎÉÑ ÌÏÇÏ× × ÂÁÚÅ SQLite. üÔÁ 
ÂÁÚÁ ÄÁÎÎÙÈ ×ÙÂÒÁÎÁ × ËÁÞÅÓÔ×Å ÐÒÉÍÅÒÁ ÐÏÔÏÍÕ,  ÞÔÏ ÏÎÁ ÐÒÏÓÔÁ × ÕÓÔÁÎÏ×ËÅ
É ÎÁÓÔÒÏËÅ (×ÐÒÉÎÃÉÐÅ ÎÁÓÔÒÏÊËÁ ×ÅÄÅÎÉÑ ÌÏÇÏ× × ÌÀÂÏÊ ÄÒÕÇÏÊ ÂÁÚÅ mysql ÉÌÉ 
postgresql ÏÔÌÉÞÁÅÔÓÑ ÔÏÌØËÏ ÎÁÓÔÒÏÊËÏÊ ÅÇÏ odbc - ÄÒÁÊ×ÅÒÁ)
 
 õÓÔÁÎÁ×ÌÉ×ÁÅÍ SQLite
wget http://www.sqlite.org/sqlite-2.8.14.tar.gz
tar -xvzf sqlite-2.8.14.tar.gz
cd sqlite 
./configure
gmake 
gmake install

 õÓÔÁÎÁ×ÌÉ×ÁÅÍ iODBC ÍÅÎÅÄÖÅÒ
wget http://www.iodbc.org/libiodbc-3.51.2.tar.gz
tar -xvzf libiodbc-3.51.2.tar.gz
cd libiodbc-3.51.2
./configure --disable-gui --disable-gtktest
make 
make install

 õÓÔÁÎÁ×ÌÉ×ÁÅÍ odbc ÄÒÁÊ×ÅÒ SQLite
wget http://www.ch-werner.de/sqliteodbc/sqliteodbc-0.62.tar.gz
tar -xvzf sqliteodbc-0.62.tar.gz
cd sqliteodbc-0.62

./configure
 åÓÌÉ Õ ×ÁÓ ÓËÒÉÐÔ configure ×ÙÄÁÌ ÏÛÉÂËÕ : 
 (configure: error: SQLite library too old)
 ÔÏ ÅÅ ÍÏÖÎÏ ÐÏÐÒÏÂÏ×ÁÔØ ÏÂÏÊÔÉ ×ÓÔÁ×É× (SQLITE_COMPILE=1
 × ÓÔÒ. 5092 ÐÏÓÌÅ ÕÓÌÏ×ÉÑ if endif) × ÆÁÊÌÅ configure
make 
make install


 äÁÌÅÅ ÎÁÓÔÒÁÉ×ÁÅÍ ÚÁÐÉÓÉ ÄÌÑ iODBC ÍÅÎÅÄÖÅÒÁ ×
ÆÁÊÌÁÈ /etc/odbcinst.ini É /etc/odbc.ini

îÁÓÔÒÁÉ×ÁÅÍ odbc ÄÒÁÊ×ÅÒ 
--------------/etc/odbcinst.ini-------------
[ODBC Drivers]
SQLite=Installed

[SQLite]
Driver=/usr/local/lib/libsqliteodbc.so
---------------------------------------

óÏÚÄÁÅÍ DSN ÄÌÑ ÂÁÚÙ c ÉÍÅÎÅÍ "sqlite" ËÏÔÏÒÁÑ ÂÕÄÅÔ 
ÒÁÓÐÏÌÁÇÁÔØÓÑ × ËÁÔÁÌÏÇÅ: /usr/local/3proxy/logs.db

--------------/etc/odbc.ini----------------
[ODBC Data Sources]
sqlite=SQLite

[sqlite]
Driver=/usr/local/lib/libsqliteodbc.so
Description=SQLite test database
Database=/usr/local/3proxy/logs.db
# optional lock timeout in milliseconds
Timeout=2000
---------------------------------------

óÏÚÄÁÅÍ ÂÁÚÕ ÄÌÑ ÌÏÇÏ× É ÔÁÂÌÉÃÕ × ÆÏÒÍÁÔÅ (logformat 
ÓÍ. ÏÐÉÓÁÎÉÅ × 3proxy.cfg.sample )

sqlite /usr/local/3proxy/logs.db

SQLite version 2.8.14
Enter ".help" for instructions
sqlite>create table log (
   ...> l_date char (11), 
   ...> l_chour char (10), 
   ...> l_user char (30), 
   ...> l_service char (30), 
   ...> l_in  integer, 
   ...> l_out integer, 
   ...> l_descr char  (64000), 
   ...>);


äÏÂÁ×ÌÑÅÍ ÓÌÅÄÕÀÝÉÅ ÚÁÐÉÓÉ × ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÊ ÆÁÊÌ 3proxy.cfg
---------------3proxy.cfg-----------------   
log &sqlite

logformat "Linsert into log ( l_date, l_chour, l_user, l_service, l_in, l_out, 
l_descr)
values ('%d-%m-%Y', '%H:%M:%S', '%U', '%N', %I, %O, '%T')"
------------------------------------------

CÏÂÒÁÔØ 3proxy c ÐÏÄÄÒÅÖËÏÊ iODBC, ÄÌÑ ÜÔÏÇÏ × Makefile.unix ÐÏÍÅÎÑÔØ
 
CFLAGS = -Wall -O2 -c -pthread -D_THREAD_SAFE -D_REENTRANT -DWITH_STD_MALLOC -I/usr/local/include
LIBS = -L /usr/local/lib -lodbc

É ÄÁÔØ ËÏÍÁÎÄÙ

make clean
make -f Makefile.unix

$Id: iodbc.txt,v 1.2 2004/07/23 13:33:46 vlad Exp $doc/html/faqr.html0100755002537100244200000001462510161774552013632 0ustar  vladmkgroup
Ïî÷åìó íå ðàáîòàåò...


Q: Ïî÷åìó íåè÷åãî íå ðàáîòàåò?

A: Ïîòîìó, ÷òî äëÿ ðàáîòû íóæåí ïðàâèëüíûé ôàéë êîíôèãóðàöèè.


Q: Ïî÷åìó íå ðàáîòàþò îãðàíè÷åíèÿ äîñòóïà (ïåðåíàïðàâëåíèÿ, îãðàíè÷åíèÿ ïî ñêîðîñòè,
òðàôèêó è ò.ä.)

A: îáû÷íûå îøèáêè - èñïîëüçîâàíèå auth none (äëÿ ðàáîòû ëþáûõ
ôóíêöèé îñíîâàííûõ íà ACL òðåáóåòñÿ auth iponly, nbname èëè strong),
íàðóøåíèå ïîðÿäêà ââîäà êîìàíä (êîìàíäû âûïîëíÿþòñÿ ïîñëåäîâàòåëüíî,
çàïóñê ñåðâèñà proxy, socks, tcppm è ò.ä. äîëæåí îñóùåñòâëÿòüñÿ ïîñëå
òîãî, êàê óêàçàíà åãî êîíôèãóðàöèÿ), íåïðàâèëüíûé ïîðÿäîê çàïèñåé â ACL
(çàïèñè ïðîñìàòðèâàþòñÿ ïîñëåäîâàòåëüíî äî ïåðâîé óäîâëåòâîðÿþùåé
êðèòåðèÿì). Åñëè â ACL èìååòñÿ õîòÿ áû îäíà çàïèñü, òî ñ÷èòàåòñÿ, ÷òî
ïîñëåäíÿÿ çàïèñü â ACL ýòî íåÿâíàÿ deny *.


Q: Ïî÷åìó íå ðàáîòàåò âåäåíèå æóðíàëîâ â ODBC?

A: Óáåäèòåñü, ÷òî âûïîëíÿåòñÿ ïðàâèëüíûé SQL çàïðîñ. Íàèáîëåå
ðàñïðîñòðàíåííàÿ ïðîáëåìà ñâÿçàíà ñ îòñóòñòâèåì êàâû÷åê èëè íåïðàâèëüíûì
ôîðìàòîì äàííûõ. Ñàìûé ïðîñòîé ñïîñîá - ñäåëàòü âåäåíèå æóðíàëà â ôàéë èëè
íà ñòàíäàðòíûé âûâîä, ïðîñìîòðåòü âûäàâàåìûå SQL çàïðîñû è ïîïðîáîâàòü
äàòü òàêîé çàïðîñ âðó÷íóþ.


Q: Ïî÷åìó 3proxy íå çàïóñêàåòñÿ êàê ñëóæáà?

A: Íàèáîëåå âåðîÿòíûå ïðè÷èíû - îòñóòñòâèå êîìàíäû service â êîíôèãóðàöèè
èëè èñïîëüçîâàíèå îòíîñèòåëüíûõ (íåïîëíûõ) ïóòåé ôàéëîâ â ôàéëå êîíôèãóðàöèè.
Ïðè èñïîëüçîâàíèè ôàéëîâ æóðíàëîâ, ôàéëîâ âñòàâîê ($filename) èñïîëüçóéòå
ïîëíûå ïóòè, íàïðèìåð $"c:\3proxy\include files\networks.local".
Äëÿ îòëàäêè ëó÷øå çàïóñêàòü 3proxy ñ âåäåíèåì æóðíàëà íà ñòàíäàðòíûé âûâîä.
Íå çàáóäüòå â òàêîì ñëó÷àå îòêëþ÷èòü daemon è service â ôàéëå êîíôèãóðàöèè.
Äëÿ ÷èñòîòû ýêñïåðèìåíòà çàïóñêàòü 3proxy èç êîììàíäíîé ñòðîêè â òàêîì ñëó÷àå
ñëåäóò íàõîäÿñü â äðóãîé ïàïêå.


Ïåðåíàïðàâëåíèå socks ñîåäèíåíèé â ëîêàëüíûé ïðîêñè


Q: Äëÿ ÷åãî ýòî íàäî?

A: ×òîáû  èìåòü â ëîãàõ URL çàïðîñîâ åñëè ïîëüçîâàòåëü SOCKS ïîëüçóåòñÿ
Web, FTP èëè POP3


Q: Êàêèå íåäîñòàòêè?

A: Ïåðåíàïðàëåíèå  íåâîçìîæíî äëÿ web-ñåðâåðîâ èëè FTP âèñÿùèõ íà
íåñòàíäàðòíûõ ïîðòàõ,  äëÿ SOCKSv4 íå ïîääðæèâàåòñÿ àâòîðèçàöèÿ  ñ
ïàðîëåì  (IE  ïîääåðæèâàåò  òîëüêî SOCKSv4), íî ïðè ýòîì IE  ïåðåäàåò
èìÿ  ïîëüçîâàòåëÿ  ïî  SOCKSv4 (èìÿ ñ êîòîðûì ïîëüçîâàòåëü âîøåë â ñèñòåìó).
Äëÿ SOCKSv5 íå ïîääåðæèâàåòñÿ NTLM àâòîðèçàöèÿ, ïàðîëè ïåðåäàþòñÿ â îòêðûòîì
òåêñòå.


Q: Êàêèå ïðåèìóùåñòâà?

A: Äîñòàòî÷íî  â  íàñòðîéêàõ  IE  òîëüêî  óêàçàòü àäðåñ SOCKS ïðîêñè. Â
áîëüøèõ   ñåòÿõ   ìîæíî  äëÿ  ýòîãî  èñïîëüçîâàòü  WPAD  (àâòîìàòè÷åñêîå
îáíàðóæåíèå  ïðîêñè).    3proxy äîñòàòî÷íî çàïóñêàòü òîëüêî îäíó ñëóæáó
(socks).   Åñëè   èñïîëüçóåòñÿ   òîëüêî   Internet  Explorer,  òî  ìîæíî
àâòîìàòè÷åñêè   ïîëó÷àòü   èìÿ   ïîëüçîâàòåëÿ   â  ëîãàõ  íå  çàïðàøèâàÿ
ëîãèí/ïàðîëü.


Q: Êàê íàñòðàèâàåòñÿ?

A: Óêàçûâàåòñÿ parent http proxy ñî ñïåöèàëüíûì àäðåñîì 0.0.0.0 è ïîðòîì
0. Ïðèìåð:

allow * * * 80,8080-8088
parent 1000 http 0.0.0.0 0
allow * * * 80,8080-8088
#ïåðåíàïðàâèòü ñîåäèíåíèÿ ïî ïîðòàì 80 è 8080-8088 â ëîêàëüíûé
#http ïðîêñè. Âòîðàÿ êîìàíäà allow íåîáõîäèìà, ò.ê. êîíòðîëü äîñòóïà
#îñóùåñòâëÿåòñÿ 2 ðàçà - íà óðîâíå socks è íà óðîâíå HTTP ïðîêñè

allow * * * 21,2121
parent 1000 ftp 0.0.0.0 0
allow * * * 21,2121
#ïåðåíàïðàâèòü ñîåäèíåíèÿ ïî ïîðòàì 21 è 2121 â ëîêàëüíûé
#ftp ïðîêñè


allow *
#ïóñòèòü âñå ñîåäèíåíèÿ íàïðÿìóþ

socks



Q: êàê âçàèìîäåéñòâóåò ñ äðóãèìè ïðàâèëàìè â ACL?

A: Ïîñëå âíóòðåííåãî ïåðåíàïðàâëåíèÿ ïðàâèëà ðàññìàòðèâàþòñÿ åùå ðàç, çà
èñêëþ÷åíèåì  ñàìîãî ïðàâèëà ñ ïåðåíàïðàâëåíèåì (ò.å. îáðàáîòêà ïðàâèë íå
ïðåêðàùàåòñÿ).  Ýòî  ïîçâîëÿåò  ñäåëàòü  äàëüíåéøèå  ïåðåíàïðàâëåíèÿ  íà
âíåøíèé ïðîêñè. Ïî ýòîé æå ïðè÷èíå ëîêàëüíîå ïåðåíàïðàâëåíèå íå äîëæíî
áûòü ïîñëåäíèì ïðàâèëîì (ò.å. äîëæíî áûòü åùå õîòÿ áû ïðàâèëî allow
÷òîáû ðàçðåøèòü âíåøíèå ñîåäèíåíèÿ ÷åðåç HTTP ïðîêñè).
Íàïðèìåð

allow * * * 80,8080-8088
parent 1000 http 0.0.0.0 0
#ïåðåíàïðàâèòü âî âíóòðåííèé ïðîêñè

allow * * $c:\3proxy\local.nets 80,8080-8088
#ðàçðåøèòü ïðÿìîé web-äîñòóï ê ñåòÿì èç local.nets
allow * * * 80,8080-8088
parent 1000 http proxy.sandy.ru 3128
#âñå îñòàëüíûå âåá-çàïðîñû ïåðåíàïðàâèòü íà âíåøíèé ïðîêñè-ñåðâåð

allow *
#ðàçðåøèòü socks-çàïðîñû ïî äðóãèì ïîðòàì




À åñòü ëè...




ÑÌ> Ñóùåñòâóåò ëè ñåé÷àñ ïîääåðæêà FTP ïðîêñè â ïðîäóêòå.



Åñòü  ïîääåðæêà  êàê FTP ÷åðåç HTTP (òî ÷òî íàçûâàåòñÿ FTP ïðîêñè â Internet
Explorer, Netscape, Opera) òàê è íàñòîÿùåãî FTP ïðîêñè (òî ÷òî íàçûâàåòñÿ
FTP proxy â FAR è FTP êëèåíòàõ).




ÑÌ> Êàêèì îáðàçîì ìîæíî ïðèáèíäèòü ñåðâèñû íà ñâîé ïîðò, ê ïðèìåðó HTTP
ïðîêñè ê 8080 à íå 3128 êàê ïî óìîë÷àíèþ.



proxy -p8080



ÑÌ> Ìîæåò ïëîõî ñìîòðåë, íî íå óâèäåë ïàðàìåòðîâ îòâå÷àþùèõ çà îãðàíè÷åíèå
øèðèíû êàíàëà.



×èòàéòå HowTo http://www.security.nnov.ru/soft/3proxy/howtor.asp#BANDLIM


Ïî÷åìó òàê êðèâî...


Ïî÷åìó òàêàÿ êðèâàÿ êîíôèãóðàöèÿ, è íè÷åðòà íå ïîíÿòíî?

Åñòü íåñêîëüêî ïðè÷èí. Âî-ïåðâûõ äî âûõîäà ðåëèçà (ò.å. âåðñèè 1.0) ÿ áóäó èçî
âñåõ ñèë äîáèâàòüñÿ ñîâìåñòèìîñòè êîíôèãóðàöèè ìåæäó âåðñèÿìè. Âî-âòîðûõ
êîíôèãóðàöèÿ ñäåëàíà òàê, ÷òîáû åå ìîæíî áûëî ëåãêî ðàçáèðàòü ïðîãðàììíî.
Â-òðåòüèõ âñå òàì ïîíÿòíî. Ïðè æåëàíèè. Åñëè çíàòü êàê âñå ðàáîòàåò.

Ïî÷åìó òàê êðèâî íàïèñàí êîä, è íè÷åðòà íå ïîíÿòíî?

Åñòü íåñêîëüêî ïðè÷èí. Âî-ïåðâûõ ÿ íå ïðîãðàììèñò. Âî-âòîðûõ 3proxy èçíà÷àëüíî
ïèñàëñÿ íà êîëåíêå (â îòåò íà "ñëàáî" â îäíîé èç êîíôåðåíöèé). Íèêòî
íå ìîã ïðåäïîëîæèòü ÷òî èì êòî-òî ðåàëüíî áóäåò ïîëüçîâàòüñÿ. Â-òðåòüèõ ó ìíîãèõ
âîçíèêàåò æåëàíèå ðàçîáðàòüñÿ â êîäå 3proxy ÷òîáû âíåäðèòü åãî â êàêîé-íèáóäü
òðîÿí. Î÷åíü íå õî÷åòñÿ îáëåã÷àòü ýòó çàäà÷ó. Â-÷åòâåðòûõ ìíå íàäî äîáèòüñÿ
êîìïèëÿöèè êîäà â êàê ìîæíî áîëüøåì ÷èñëå ñèñòåì. Çàìå÷åíî, ÷òî ÷åì êðèâåå êîä â
C, òåì îí ëó÷øå ïåðåíîñèòñÿ.

Ïî÷åìó òàê ìíîãî strcpy, sprintf è ò.ä., ýòî æ äûðû, íè÷åðòà íå ïîíÿòíî?

Åñòü íåñêîëüêî ïðè÷èí. Âî-ïåðâûõ, íåñìîòðÿ íà äóðíîé òîí èñïîëüçîâàíèÿ ýòèõ
ôóíêöèé, îíè íàèáîëåå ñîâìåñòèìû ìåæäó ðàçíûìè ñèñòåìàìè è êîìïèëÿòîðàìè.
Âî-âòîðûõ ñàìî ïî ñåáå èõ èñïîëüçîâàíèå íå îçíà÷àåò ïðèñóòñòâèå äûðû, åñëè èõ
ïàðàìåòðû äîëæíûì îáðàçîì êîíòðîëèðóþòñÿ. Íàéäåòå äûðó - îáÿçàòåëüíî ñîîáùèòå.
 òðåòüèõ - ìîæåò áûòü ÿ óáåðó èõ ïåðåä êîíå÷íûì ðåëèçîì ÷òîáû íèêîãî íå
ïóãàòü.


$Id: faqr.html,v 1.5 2004/12/21 10:22:34 vlad Exp $
doc/html/howtoe.html0100755002537100244200000006670710233173573014212 0ustar  vladmkgroup
    
 
  • 3APA3A 3proxy tiny proxy server HowTo
 
    Under construction, very incomplete
 

    
 

    
	
  • Proxy server installation and removal

    
	
      
		
    • How to install/remove 3proxy under Windows NT/2000/XP

      
Unpack 3proxy.zip to any directory, for example
c:\Program Files\3proxy. If needed, create directory for storing log files,
ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (See Server configuration).
Add

      service

      
string into 3proxy.cfg. Now, start command prompt (cmd.exe).
Change directory to 3proxy installation and run 3proxy.exe --install:

      D:\>C:
C:\>cd C:\Program Files\3proxy
C:\Program Files\3proxy>3proxy.exe --install

      
Now, you should have 3proxy service installed and running. If service is not
started, remove "service" string from 3proxy.cfg, run 3proxy.exe manually
and correct all errors.

      
To remove 3proxy run 3proxy --remove:

      D:\>C:
C:\>cd C:\Program Files\3proxy
C:\Program Files\3proxy>net stop 3proxy
C:\Program Files\3proxy>3proxy.exe --remove

      
Now you can simply remove 3proxy installation directory.

      
		
    • How to install/remove 3proxy under Windows 95/98/ME

      
Unpack 3proxy.zip to any directory, for example
c:\Program Files\3proxy. If needed, create directory for storing log files,
ODBC sources, etc. Create 3proxy.cfg in the 3proxy installation directory (See Server configuration).
Remove string

      service

      
from 3proxy.cfg and add

      daemon

      
if you want 3proxy to run in background.
Create shortcut for 3proxy.exe and place it in autostart or add
to registry with regedit.exe:

      HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      
Type: String

      3proxy = "c:\Program Files\3proxy.exe" "C:\Program Files\3proxy.cfg"
      
You must use quotes if path contains space. If neccessary, restart Windows.
If service is not started, check log. Remove "daemon" command from 3proxy.cfg,
start 3proxy.exe manually and correct all errors.

      
		
    • How to install/remove 3proxy under Unix/Linux

      
Complie 3proxy (see Compilation). Copy
executables to any appropriate location (for example /usr/local/3proxy/sbin
for servers and /usr/local/3proxy/bin for utilities).
Create /usr/local/etc/3proxy.cfg. 
(see Server configuration).
You can change default configuration file location by specifing configuration file
in 3proxy command line.
Add 3proxy to system startup scripts.

      
	
    

    
	
  • Server configuration

    
	
      
		
    • Where to find configuration example

      
Server configuration example 3proxy.cfg.sample is in any 3proxy distribution.

      
		
    • How to set up logging

      
3proxy can log to stdout, file, ODBC datasource and
syslog (Unix/Linux/Cygwin only). For using ODBC under Unix/Linux you must
compile 3proxy with Unix ODBC libraries, see Compilation.
You can control logging from 3proxy.cfg for all services or you can control
logging of individual service, for example 
/usr/local/sbin/socks -l/var/log/socks.log starts SOCKS proxy with logging to file.
For universal proxy (3proxy) log file rotation and archiving is supported.
Log type is defined with "log" configuration file command or with
-l switch on individual service invokation. log or -l is stdout logging.

      	log filename

      
and

      	-lfilename

      
specify filename for logging

      	log @ident

      
and

      	-l@ident

      
specify ident for syslog logging

      	log &connstring

      

specifies ODBC connection string, connstring is in format
datasource,username,password (2 last are optional of
datasource does not require or already has authentication information). 
Also, you must specify logformat to build SQL query, to insert recod into
log, see How to setup logging format

      

      
Rotation and archiving may be set up with log, rotate ¨ archiver commands

      	log filename LOGTYPE

      
sets rotation type. LOGTYPE may be:

        
	
      • M, monthely
	
      • W, weekly
	
      • D, daily
	
      • H, hourly
	
      • ‘, minutely

      

      	rotate NUMBER

      
	specifies number of files in rotation (that is how many files to keep).

      	archiver EXT COMMAND PARAMETERS

      
	Sets external archiver. EXT is extention of archived files
	(for example zip, gz, Z, rar etc) COMMAND and PARAMETERS are command
	to execute and command line PARAMETERS. Originale file is not deleted by
	3proxy, this work is left for archiver.
	You can pass original filename to archiver with %F macro and archive filename with %A.
	Examples are located in
	3proxy.cfg.sample

      
		
    • How to setup logging format

      
	Since 0.3 version log format may be set with "logformat" command.
	First symbol of log format specifies format of date and time and
	should be L (LOCAL) or G (GMT - Grinwitch Meridian Time). Format
	string may contains some macro substitutions:
	
        

      • 	 %y - Year (2 digits)

      • 	 %Y - Year (4 digits)

      • 	 %m - Month (2 digits)

      • 	 %d - Day (2 digits)

      • 	 %H - Hour (2 digits)

      • 	 %M - Minute (2 digits)

      • 	 %S - Second (2 digits)

      • 	 %t - Timestamp (seconds since January, 1 1970 00:00:00 GMT)

      • 	 %. - Milliseconds

      • 	 %z - Timezone in mail format (from GMT, '+' east, '-' west HHMM), For example Moscow winter time is +0300.

      • 	 %U - Username ('-' if unknown).

      • 	 %N - Service name (PROXY, SOCKS, POP3P, etc)

      • 	 %p - Service port

      • 	 %E - Error code (see. Log error codes reference)

      • 	 %C - client IP

      • 	 %c - client port

      • 	 %R - target IP

      • 	 %r - target port

      • 	 %I - bytes received from target

      • 	 %O - bytes sent to target

      • 	 %h - hops  before target (if redirection or chaning is used).
	 see How to use chains and parent proxies)

      • 	 %T - service specific text (for example URL requested).
	
      
	ਬ¥à:

      logformat "L%t.%. %N.%p %E %U %C:%c %R:%r %O %I %h %T"

      
	generates something like

      
1042454727.0296 SOCK4.1080 000 3APA3A 127.0.0.1:4739 195.122.226.28:4739 505 18735 1 GET http://www.security.nnov.ru/ HTTP/1.1


      (no line breaks)

      

      
	If ODBC used, logformat should specify SQL command,
	to insert record into log, for example

      
logformat "GINSERT INTO proxystat  VALUES (%t, '%c', '%U', %I)"


      (no line breaks)

      
		
    • How to start any of proxy services (HTTP, SOCKS etc)

      
3proxy is distributed in 2 variants: as a set of standalone modules (proxy,
socks, pop3p, tcppm, udppm) and as universal proxy server. These services are
absolutely independant, and if you use 3proxy you needn't any of standalone
modules.

      Standalone modules are only configurable via command line interface while
3proxy uses configuration file. Many functions, such as ODBC logging, log
rotation, access control, etc are only available in 3proxy, not in standalone
proxies.
Standalone module may be started from command line, for example:

      $/sbin/socks -l/var/log/socks.log -i127.0.0.1

      
Starts SOCKS server binded to localhost ip, port 1080 with logging to
/var/log/socks.log.
You can get help for any standalone service with -? command line option.

      
If 3proxy is used you should start all services in 3proxy.cfg file. 3proxy.cfg
is executed by 3proxy as a batch file. Example of 3proxy.cfg and command syntaxys
can be found in
3proxy.cfg.sample.

      log /var/log/3proxy.log D
rotate 30
internal 127.0.0.1
external 192.168.1.1
proxy
socks -p3129
pop3p 

      
Starts 3 services: HTTP PROXY, SOCKS and POP3 PROXY. Each listens localhost
interface with default port (3128 for HTTP, 1080 for SOCKS and 110 for POP3P)
except socks started with port 3129.
All logs are in file /var/log/3proxy.log (with daily date modification and
rotation). 30 last files are stored.

      
		
    • How to limit service access

	
    


    
	
  • Client configuration

    

    
	
  • Administering and information analisys

    
	
      
		
    • How to obtain latest 3proxy version

      
Latest version of 3proxy may be obtained
here.
New version may have changes and incompatibilities with previous one in files
format or commands. Please, read CHANGELOG file and another documentation
before installing new version.

      
		
    • How to control 3proxy service under Windows NT/2000/XP

      
If installed as system service, 3proxy understands Windows service commands
for START, STOP, PAUSE and RESUME. If service is PAUSEd, no new connections
are accepted while older connections are processed. Currently there is no
support for dynamic configuration change, so, you have to restart service
completely if you have changed any configuration.

You can control 3proxy service via "Services" administration ot via "net" command:

      	net start 3proxy
	net stop 3proxy
	net pause 3proxy
	net continue 3proxy

      

      
		
    • Log error codes reference

      
	
        
		
      • 0 - Operation successfully complited (connection
			was closed by one of peers)
		
      • 1-9 - AUTHENTICATION ERRORS
		
      • 1 - Access denied by ACL (deny)
		
      • 2 - Redirection (should not appear)
		
      • 3 - No ACL found, denied by default
		
      • 4 - auth=strong and no username in request
		
      • 5 - auth=strong and no matching username in configuration
		
      • 6 - User found, wrong password (cleartext)
		
      • 7 - User found, wrong password (crypt)
		
      • 8 - User found, wrong password (NT)
		
      • 9 - Redirection data not found (should not appear)
		
      • 10 - Traffic limit exceeded
		
      • 11-19 - CONNECTION ERRORS
		
      • 11 - failed to create socket()
		
      • 12 - failed to bind()
		
      • 13 - failed to connect()
		
      • 14 - failed to getpeername()
		
      • 20-29 - COMMON ERRORS
		
      • 21 - memory allocation failed
		
      • 30-39 - CONNECT PROXY REDIRECTION ERRORS
		
      • 31 - failed to request HTTP CONNECT proxy
		
      • 32 - CONNECT proxy connection timed out or wrong reply
		
      • 33 - CONNECT proxy fails to establish connection
		
      • 34 - CONNECT proxy timed out or closed connection
		
      • 40-49 - SOCKS4 PROXY REDIRECTION ERRORS
		
      • 50-69 - SOCKS5 PROXY REDIRECTION ERRORS
		
      • 70-79 PARENT PROXY CONNECTION ERRORS (identical to 1x)
		
      • 90-99 - CONNECTION BROKEN ERRORS
		
      • 91 - connection was broken due to traffic limit
		
      • 91 - connection was broken by server
		
      • 92 - failed to send data
		
      • 93 - connection was broken by client
		
      • 94 - socket error
		
      • 97 - timeout
		
      • 98 - server data limit (should not appear)
		
      • 99 - client data limit (should not appear)
		
      • 100 - HOST NOT FOUND
		
      • 200-299 - UDP portmapper specific bugs
		
      • 300-399 - TCP portmapper specific bugs
		
      • 400-499 - SOCKS proxy specific bugs
		
      • 500-599 - HTTP proxy specific bugs
		
      • 600-699 - POP3 proxy specific bugs
		
      • 999 - NOT IMPLEMENTED
	
      

      
	
    

    
	
  • How To ask quiestion not in How To?

    
	Ask it in 3proxy phorum.
	Don't try to ask something you just misunderstood this How To, because
	you do not get better answer.
 





$Id: howtoe.html,v 1.7 2005/04/25 13:58:19 vlad Exp $
doc/html/howtor.html0100755002537100244200000012403410233173573014213 0ustar  vladmkgroup 3APA3A 3proxy tiny proxy server HowTo
 
 ñòàäèè ðàçðàáîòêè
 


 
    

    
	
  • Êîìïèëÿöèÿ

    
	
      
		
    • Êàê ñêîìïèëèðîâàòü 3proxy Visual C++

      
Èçâëåêèòå ôàéëû èç àðõèâà 3proxy.tgz (íàïðèìåð ñ ïîìîùüþ WinZip).
Èñïîëüçóéòå êîìàíäó nmake /f Makefile.msvc

      
		
    • Êàê ñêîìïèëèðîâàòü 3proxy GCC ïîä Windows
      • 

      
Èçâëåêèòå ôàéëû èç àðõèâà 3proxy.tgz (íàïðèìåð ñ ïîìîùüþ WinZip èëè, ïðè íàëè÷èè
CygWin tar -xzf 3proxy.tgz).
Èñïîëüçóéòå êîìàíäó make -f Makefile.win. Åñëè ïî êàêèì-òî ïðè÷èíàì âû õîòèòå èñïîëüçîâàòü
áèáëèîòåêó POSIX-ýìóëÿöèè Cygwin - Èñïîëüçóéòå make -f Makefile.unix.
Ïðèèñïîëüçîâàíèè CygWin ôóíêöèè ñïåöèôè÷íûå äëÿ Windows (òàêèå êàê çàïóñê â
êà÷åñòâå ñëóæáû) áóäóò íåäîñòóïíû.

      
		
    • Êàê ñêîìïèëèðîâàòü 3proxy GCC ïîä Unix/Linux
      • 

      
Èñïîëüçóéòå make -f Makefile.unix. Äîëæåí èñîïëüçîâàòüñÿ GNU make, íà
íåêîòîðûõ ñèñòåìàõ íåîáõîäèìî èñïîëüçîâàòü gmake âìåñòî make.

      Êîìïèëÿöèÿ ïðîâåðåíà â FreeBSD/i386, OpenBSD/i386, NetBSD/i386,
RH Linux/Alpha, Debian/i386, Gentoo/i386, Gentoo/PPC
íî äîëæíî ñîáèðàòüñÿ â ëþáûõ âåðñèÿõ *BSD/linux.
 äðóãèõ ñèñòåìàõ ìîæåò ïîòðåáîâàòüñÿ ìîäèôèêàöèÿ ôàéëà è/èëè èñõîäíûõ òåêñòîâ.

      
	
    

    
		
  • Êàê ñêîìïèëèðîâàòü 3proxy  Compaq C Compiler ïîä Unix/Linux
    • 

    
Èñïîëüçóéòå make -f Makefile.ccc

    Êîìïèëÿöèÿ ïðîâåðåíà â RH Linux 7.1/Alpha.
 äðóãèõ ñèñòåìàõ ìîæåò ïîòðåáîâàòüñÿ ìîäèôèêàöèÿ ôàéëà è/èëè èñõîäíûõ òåêñòîâ.

    
	



	
  • Èíñòàëëÿöèÿ ïðîêñè-ñåðâåðà

    
	
      
		
    • Êàê óñòàíîâèòü/óäàëèòü 3proxy ïîä Windows 95/98/ME/NT/2000/XP/2003 êàê ñëóæáó

      
Èçâëåêèòå ôàéëû èç àðõèâà 3proxy.zip â ëþáîé êàòàëîã 
(íàïðèìåð c:\Program Files\3proxy). Åñëè íåîáõîäèìî, ñîçäàéòå êàòàëîã äëÿ
õðàíåíèÿ ôàéëîâ æóðíàëîâ. Ñîçäàéòå ôàéë êîíôèãóðàöèè ïðîêñè 3proxy.cfg â
êàòàëîãå 3proxy (Ñì. ðàçäåë Êîíôèãóðàöèÿ ñåðâåðà).
Äîáàâüòå ñòðîêó

      service

      
â ôàéë 3proxy.cfg. Îòêðîéòå êîììàíäíóþ ñòðîêó (cmd.exe).
Ïåðåéäèòå â êàòàëîã ñ 3proxy è äàéòå êîìàíäó 3proxy.exe --install:

      D:\>C:
C:\>cd C:\Program Files\3proxy
C:\Program Files\3proxy>3proxy.exe --install

      
Ñåðâèñ äîëæåí áûòü óñòàíîâëåí è çàïóùåí. Åñëè ñåðâèñ íå çàïóñêàåòñÿ,
ïðîâåðüòå ñîäåðæèìîå ôàéëà æóðíàëà,
ïîïðîáóéòå óäàëèòü ñòðîêó service èç 3proxy.cfg, çàïóñòèòü 3proxy.exe âðó÷íóþ
è ïðîàíàëèçèðîâàòü ñîîáùåíèÿ îá îøèáêàõ.

      
Äëÿ óäàëåíèÿ 3proxy íåîáõîäèìî îñòàíîâèòü ñåðâèñ è äàòü
êîìàíäó 3proxy --remove:

      D:\>C:
C:\>cd C:\Program Files\3proxy
C:\Program Files\3proxy>net stop 3proxy
C:\Program Files\3proxy>3proxy.exe --remove

      
ïîñëå ÷åãî êàòàëîã 3proxy ìîæíî óäàëèòü.

      
Óñòàíîâêà â êà÷åñòâå ñèñòåìíîé ñëóæáû ïîä Windows 9x ïîääåðæèâàåòñÿ ñ âåðñèè 0.5

      
		
    • Êàê óñòàíîâèòü/óäàëèòü 3proxy ïîä Windows 95/98/ME

      
Èçâëåêèòå ôàéëû èç àðõèâà 3proxy.zip â ëþáîé êàòàëîã 
(íàïðèìåð c:\Program Files\3proxy). Åñëè íåîáõîäèìî, ñîçäàéòå êàòàëîã äëÿ
õðàíåíèÿ ôàéëîâ æóðíàëîâ. Ñîçäàéòå ôàéë êîíôèãóðàöèè ïðîêñè 3proxy.cfg â
êàòàëîãå 3proxy (Ñì. ðàçäåë Êîíôèãóðàöèÿ ñåðâåðà).
 ôàéëå êîíôèãóðàöèè óäàëèòå ñòðîêó

      service

      
è äîáàâüòå ñòðîêó

      daemon

      
Ñîçäàéòå ÿðëûê äëÿ 3proxy.exe è ïîìåñòèòå åãî â àòîçàãðóçêó, ëèáî ñ ïîìîùüþ
ðåäàêòîðà ðååñòðà regedit.exe äîáàâüòå â ðàçäåëå

      HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      
Ñòðîêîâûé ïàðàìåòð 

      3proxy = "c:\Program Files\3proxy.exe" "C:\Program Files\3proxy.cfg"
      
Èñïîëüçîâàíèå àïîñòðîôîâ ïðè íàëè÷èè â ïóòè ïðîáåëà îáÿçàòåëüíî.
Ïåðåçàãðóçèòåñü.
Åñëè ñåðâåð íå çàïóñêàåòñÿ,
ïðîâåðüòå ñîäåðæèìîå ôàéëà æóðíàëà,
ïîïðîáóéòå óäàëèòü ñòðîêó daemon èç 3proxy.cfg, çàïóñòèòü 3proxy.exe âðó÷íóþ
è ïðîàíàëèçèðîâàòü ñîîáùåíèÿ îá îøèáêàõ.


      
		
    • Êàê óñòàíîâèòü/óäàëèòü 3proxy ïîä Unix/Linux

      
Ñêîìïèëèðóéòå 3proxy (ñì. ðàçäåë Êîìïèëÿöèÿ). Ñêîïèðóéòå
èñïîëíÿåìûå ôàéëû â ïîäõîäÿùèé êàòàëîã (íàïðèìåð /usr/local/3proxy/sbin äëÿ
ñåðâåðíûõ ïðèëîæåíèé è /usr/local/3proxy/bin äëÿ êëèåíòñêèõ óòèëèò).
Ñîçäàéòå ôàéë /usr/local/etc/3proxy.cfg. 
(Ñì. ðàçäåë Êîíôèãóðàöèÿ ñåðâåðà).
Èçìåíèòü ðàñïîëîæåíèå ôàéëà êîíôèãóðàöèè ìîæíî çàäàâ ïàðàìåòð ïðè âûçîâå
3proxy èëè èçìåíèâ ïóòü â ôàéëå 3proxy.c äî êîìïèëÿöèè.
Äîáàâüòå âûçîâ 3proxy â ñêðèïòû íà÷àëüíîé èíèöèàëèçàöèè.

      
	
    

    
	
  • Êîíôèãóðàöèÿ ñåðâåðà

    
	
      
		
    • Êàê ïîñìîòðåòü ïðèìåð ôàéëà êîíôèãóðàöèè

      
Ïðèìåð ôàéëà êîíôèãóðàöèè 3proxy.cfg.sample ïîñòàâëÿåò ñ ëþáûì äèñòðèáóòèâîì
ïðîãðàììû.

      
		
    • Êàê íàñòðîèòü âåäåíèå æóðíàëà

      
3proxy ïîääåðæèâàåò âåäåíèå æóðíàëà íà ýêðàí (stdout), â ôàéë, ÷åðåç ODBC è ÷åðåç ñëóæáó
syslog (òîëüêî äëÿ Unix/Linux/Cygwin). Ìîæíî óïðàâëÿòü ëèáî îáùèì ôàéëîì
æóðíàëà, çàäàâàåìûì â ôàéëå êîíôèãóðàöèè 3proxy.cfg è åäèíûì äëÿ âñåõ ñëóæá
ëèáî èíäèâèäóàëüíûìè ôàéëàìè äëÿ îòäåëüíûõ ñëóæá (íàïðèìåð êîìàíäà 
socks -l/var/log/socks.log çàïóñêàåò SOCKS ïðîêñè
è çàäàåò äëÿ íåãî èíäèâèäóàëüíûé æóðíàë). Äëÿ îáùåãî ôàéëà æóðíàëà
ïîääåðæèâàåòñÿ ðîòàöèÿ (ò.å. ïåðèîäè÷åñêîå ñîçäàíèå íîâûõ ôàéëîâ æóðíàëà
ñ ïðåäîïðåäåëåííûìè èìåíàìè è óäàëåíèå ôàéëîâ ñòàðøå îïðåäåëåííîãî ñðîêà)
è àðõèâàöèÿ ôàéëîâ æóðíàëà.
Òèï æóðíàëà îïðåäåëÿåòñÿ ïàðàìåòðîì log â ôàéëå êîíôèãóðàöèè ëèáî êëþ÷åì
-l ïðè âûçîâå êîíêðåòíîé ñëóæáû (íàïðèìåð socks ñåðâåðà). log èëè -l áåç
ïàðàìåòðîâ ñîîòâåòñòâóþò âåäåíèþ æóðíàëà íà ýêðàí (stdout).

      	log filename

      
è

      	-lfilename

      
ñîîòâåòñòâóþò çàïèñè æóðíàëà â ôàéë filename.

      	log @ident

      
è

      	-l@ident

      
ñîîòâåòñòâóþò âåäåíèþ æóðíàëà ÷åðåç syslog ñ èäåíòèôèêàòîðîì ident.

      	log &connstring

      

ñîîòâåòñòâóåò âåäåíèþ æóðíàëà ÷åðåç ODBC, connstring çàäàåòñÿ â ôîðìàòå
datasource,username,password (ïîñëåäíèå äâà ïàðàìåòðà îïöèîíàëüíû, åñëè
datasource íå òðåáóåò èëè óæå ñîäåðæèò ñâåäåíèÿ äëÿ àâòîðèçàöèè). Ïðè ýòîì
êîìàíäà logformat äîëæíà çàäàâàòü SQL çàïðîñ, êîòîðûé íåîáõîäèìî âûïîëíèòü
äëÿ äîáàâëåíèÿ çàïèñè â æóðíàë, ñì Êàê íàñòðîèòü ôîðìàò æóðíàëà

      
Óïðàâëåíèå ðîòàöèåé îáùåãî ôàéëà æóðíàëà ïðîèñõîäèò ñ ïîìîùüþ êîìàíä ôàéëà
êîíôèãóðàöèè log, rotate è archiver.

      	log filename LOGTYPE

      
çàäàåò òèï ðîòàöèè. LOGTYPE ìîæåò ïðèíèìàòü çíà÷åíèÿ:

        
	
      • M, åæåìåñÿ÷íàÿ ðîòàöèÿ
	
      • W, åæåíåäåëüíàÿ ðîòàöèÿ
	
      • D, åæåäíåâíàÿ ðîòàöèÿ
	
      • H, åæå÷àñíàÿ ðîòàöèÿ
	
      • Ñ, åæåìèíóòíàÿ ðîòàöèÿ

      

      	rotate NUMBER

      
	óêàçûâàåò íà ÷èñëî ôàéëîâ ó÷àñòâóþùèõ â ðîòàöèè (ò.å. ñêîëüêî ïîñëåäíèõ
	æóðíàëîâ õðàíèòü).

      	archiver EXT COMMAND PARAMETERS

      
	çàäàåò ïàðàìåòðû àðõèâàöèè æóðíàëà. EXT óêàçûâàåò íà ðàñøèðåíèå
	àðõèâàòîðà (íàïðèìåð zip, gz, Z, rar è ò.ä.) COMMAND óêàçûâàåò íà
	ïðîãðàììó è PARAMETERS - íà ïàðàìåòðû êîììàíäíîé ñòðîêè. Àðõèâàòîð
	äîëæåí ñàì óäàëèòü èñõîäíûé ôàéë. Àðõèâàòîðó ìîæíî ïåðåäàòü èìÿ ôàéëà
	ñ ïîìîùüþ ìàêðîñà %F è îæèäàåìîå èìÿ àðõèâà ñ ïîìîùüþ ìàêðîñà %A.
	 êà÷åñòâå àðõèâàòîðà âïîëíå ìîæíî çàäàòü ïàêåòíûé ôàéë, êîòîðûé,
	íàïðèìåð, áóäåò çàãðóæàòü äàííûå èç æóðíàëà â áàçó äàííûõ.
	Ïðèìåðû êîìàíäû archiver äëÿ ïîïóëÿðíûõ àðõèâàòîðîâ ìîæíî íàéòè â
	3proxy.cfg.sample

      
		
    • Êàê íàñòðîèòü ôîðìàò æóðíàëà

      
	Íà÷èíàÿ ñ âåðñèè 0.3 ôîðìàò æóðíàëà ìîæåò áûòüíàñòðîåí ñ ìîìîùüþ
	êîìàíäû logformat ñî ñòðîêîé ôîðìàòà. Ïåðâûé ñèìâîë ñòðîêè äîëæåí
	áûòü L èëè G, ÷òî óêàçûâàåò íà ôîðìàò, â êîòîðîì áóäåò óêàçûâàòüñÿ
	âðåìÿ è äàòû, L - òåêóùåå ëîêàëüíîé âðåìÿ, G - àáñîëþòíîå âðåìÿ ïî
	Ãðèíâè÷ó. Ñòðîêà ôîðìàòà ìîæåò ñîäåðæàòü ñëåäóþùèå ìîäèôèêàòîðû:
	
        

      • 	 %y - Ãîä (ïîñëåäíèå äâå öèôðû)

      • 	 %Y - Ãîä (÷åòûðåõçíà÷íûé)

      • 	 %m - Íîìåð ìåñÿöà (01-12)

      • 	 %d - Äåíü (01-31)

      • 	 %H - ×àñ (00-23)

      • 	 %M - Ìèíóòà (00-59)

      • 	 %S - Ñåêóíäà (00-59)

      • 	 %t - Âðåìåííàÿ ìåòêà (÷èñëî ñåêóíä ñ 00:00:00 ïî Ãðèíâè÷ó 1 ÿíâàðÿ 1970ã)

      • 	 %. - Ìèëëèñåêóíäû

      • 	 %z - Âðåìåííàÿ çîíà â ïî÷òîâîì ôîðìàòå (îò Ãðèíâè÷à, '+' âîñòîê, '-' çàïàä ××ÌÌ), íàïðèìåð Ìîñêîâñêîå çèìíåå âðåìÿ +0300.

      • 	 %U - Èìÿ ïîëüçîâàòåëÿ ('-' åñëè îòñóòñòâóåò).

      • 	 %N - Íàçâàíèå ïðîêñè ñåðâèñà (PROXY, SOCKS, POP3P, etc)

      • 	 %p - Ïîðò ïðîêñè ñåðâèñà

      • 	 %E - Êîä îøèáêè (ñì. Êîäû îøèáîê â æóðíàëå)

      • 	 %C - IP êëèåíòà

      • 	 %c - Ïîðò êëèåíòà

      • 	 %R - IP ñåðâåðà (èñõîäÿùåãî ñîåäèíåíèÿ ïî çàïðîñó êëèåíòà)

      • 	 %r - Ïîðò ñåðâåðà (èñõîäÿùåãî ñîåäèíåíèÿ ïî çàïðîñó êëèåíòà)

      • 	 %I - Ïðèíÿòî áàéò îò ñåðâåðà

      • 	 %O - Ïîñëàíî áàéò íà ñåðâåð

      • 	 %n - Èìÿ õîñòà èç çàïðîñà

      • 	 %h - ×èñëî çâåíüåâ äî êîíå÷íîãî ñåðâåðà (ïðè èñïîëüçîâàíèè ïåðåíàïðàâëåíèé èëè ÷åéíèíãà,
	 ñì. Êàê ñîñòàâëÿòü öåïî÷êè ïðîêñè)

      • 	 %T - Òåêñò ñïåöèôè÷íûé äëÿ Proxy-Ñåðâèñà (íàïðèìåð çàïðîøåííûé URL).
	
      
	Ïðèìåð:

      logformat "L%t.%. %N.%p %E %U %C:%c %R:%r %O %I %h %T"

      
	áóäåò ãåíåðèðîâàòü â æóðíàëå çàïèñè òèïà

      
1042454727.0296 SOCK4.1080 000 3APA3A 127.0.0.1:4739 195.122.226.28:4739 505 18735 1 GET http://www.security.nnov.ru/ HTTP/1.1


      (áåç ïåðåíîñà ñòðîê)

      

      
	Ïðè èñîïëüçîâàíèè ODBC logformat äîëæåí çàäàâàòü ôîðìàò SQL êîìàíäû,
	êîòîðóþ íåîáõîäèìî äàòü äëÿ âíåñåíèÿ çàïèñè â æóðíàë, íàïðèìåð

      
logformat "GINSERT INTO proxystat  VALUES (%t, '%c', '%U', %I)"


      
		
    • Êàê çàïóñòèòü êîíêðåòíóþ ñëóæáó (HTTP, SOCKS è ò.ä)

      
3proxy ïîñòàâëÿåòñÿ â äâóõ âàðèàíòàõ: êàê íàáîð îòäåëüíûõ ìîäóëåé (proxy,
socks, pop3p, tcppm, udppm) è êàê óíèâåðñàëüíûé ïðîêñè-ñåðâåð (3proxy).
Óíèâåðñàëüíûé ïðîêñè ñåðâåð ýòî çàêîí÷åííàÿ ïðîãðàììà, êîòîðîé íå òðåáóþòñÿ
îòäåëüíûå ìîäóëè.

      Îòäåëüíûé ìîäóëü óïðàâëÿåòñÿ òîëüêî èç êîììàíäíîé ñòðîêè. Ïîýòîìó äëÿ
îòäåëüíîãî ìîäóëÿ íå ïîääåðæèâàþòñÿ ìíîãèå ôóíêöèè, òàêèå êàê óïðàâëåíèå
äîñòóïîì è ðîòàöèÿ æóðíàëà. Çàïóñê ìîäóëÿ îñóùåñòâëÿåòñÿ èç êîììàíäíîé ñòðîêè.
Íàïðèìåð:

      $/sbin/socks -l/var/log/socks.log -i127.0.0.1

      
çàïóñêàåò SOCKS íà ïîðòó 127.0.0.1:1080 ñ âåäåíèåì æóðíàëà /var/log/socks.log
Ñïðàâêó ïî îïöèÿì êîììàíäíîé ñòðîêè ìîæíî ïîëó÷èòü çàïóñòèâ ìîäóëü ñ êëþ÷åì -?.

      
Åñëè èñïîëüçóåòñÿ 3proxy òî çàïóñêàåìûå ñëóæáû óêàçûâàþòñÿ â ôàéëå 3proxy.cfg.
Ôàéë 3proxy.cfg ïðîñìàòðèâàåòñÿ 3proxy ïîñòðî÷íî, êàæäàÿ ñòðîêà ðàññìàòðèâàåòñÿ
êàê óïðàâëÿþùàÿ êîììàíäà. Ñèíòàêñèñ êîììàíä îïèñàí â 3proxy.cfg.sample. Íàïðèìåð

      log /var/log/3proxy.log D
rotate 30
internal 127.0.0.1
external 192.168.1.1
proxy
socks
pop3p -l/var/log/pop3proxy

      
Çàïóñêàåò 3 ñëóæáû - PROXY, SOCKS è POP3 Proxy. Êàæäàÿ ñëóøàåò íà èíòåðôåéñå
127.0.0.1 íà ïîðòó ïî-óìîë÷àíèþ (3128 äëÿ proxy, 1080 äëÿ socks è 110 äëÿ
pop3p). Æóðíàëû âñåõ ñëóæá êðîìå pop3p âåäóòñÿ â ôàéëå /var/log/3proxy.log
êîòîðûé åæåäíåâíî ìåíÿåòñÿ. Õðàíèòñÿ 30 ïîñëåäíèõ ôàéëîâ. Äëÿ pop3p âåäåòñÿ
îòäåëüíûé æóðíàë /var/log/pop3proxy (ñì. Êàê íàñòðîèòü âåäåíèå æóðíàëà).

      
		
    • Êàê îãðàíè÷èòü äîñòóï ê ñëóæáå

      
Âî-ïåðâûõ, äëÿ îãðàíè÷åíèÿ äîñòóïà íåîáõîäèìî óêàçàòü âíóòðåííèé èíòåðôåéñ,
íà êîòîðîì ïðîêñè-ñåðâåð áóäåò ïðèíèìàòü ñîåäèíåíèÿ. Âíóòðåííèé èíòåðôåéñ
óêàçûâàåòñÿ ñ ïîìîùüþ êîìàíäû internal ôàéëà êîíôèãóðàöèè èëè ñ ïîìîùüþ
êëþ÷à -i êîíêðåòíîãî ìîäóëÿ.
(ñì. Êàê çàïóñòèòü êîíêðåòíóþ ñëóæáó (HTTP, SOCKS è ò.ä)).
Îòñóòñòâèå óêàçàíèÿ âíóòðåíåãî óíòåðôåéñà ìîæåò ïðèâåñòè ê òîìó, ÷òî âàø
ïðîêñè áóäåò îòêðûòûì.

       Óêàçàíèå âíåøíåãî èíòåðôåéñà (ò.å. IP Ñ êîòîðîãî ñåðâåð áóäåò óñòàíàâëèâàòü
âíåøíèå ñîåäèíåíèÿ) òàê æå ÿâëÿåòñÿ ïîëåçíûì. Äëÿ ýòîãî ñëóæèò êîìàíäà external
è êëþ÷ -e ñîîòâåòñòâåííî.
Äëÿ óíèâåðñàëüíîãî ïðîêñè âîçìîæíà äîïîëíèòåëüíàÿ àâòîðèçàöèÿ äîñòóïà ñ ïîìîùüþ
èìåíè/ïàðîëÿ, NetBIOS èìåíè ïîëüçîâàòåëÿ è ïî ñïèñêàì äîñòóïà (ïî IP êëèåíòà,
IP è ïîðòó íàçíà÷åíèÿ, ñì. Êàê îãðàíè÷èòü äîñòóï ïîëüçîâàòåëåé ê ðåñóðñàì).
Òèï àâòîðèçàöèè óñòàíàâëèâàåòñÿ êîìàíäîé auth â ôàéëå êîíôèãóðàöèè.

      auth none

      
óêàçûâàåò íà îòñóòñòâèå êàêîé-ëèáî àâòîðèçàöèè. Ñïèñêè äîñòóïà íå ïðîâåðÿþòñÿ.

      auth iponly

      
Áóäåò èäòè ïðîâåðêà ïî ñïèñêó äîñòóïà ñ èñîïëüçîâàíèåì IP êëèåíòà, IP è íîìåðà
ïîðòà íàçíà÷åíèÿ.

      auth nbname

      
Ïåðåä ïðîâåðêîé ïî ñïèñêîì äîñòóïà áóäåò ïðîèçâåäåíà ïîïûòêà ïîëó÷èòü NetBIOS
èìÿ êëèåíòà. Äëÿ ýòîãî èñïîëüçóåòñÿ NetBIOS êîä ñëóæáû messanger (0x03). Åñëè
èìÿ îïðåäåëèòü íå óäàëîñü (ñëóæáà messanger äëÿ Windows NT/2000/XP èëè WinPopUP
äëÿ 95/98/ME íå çàïóùåíà), òî èìÿ áóäåò ñ÷èòàòüñÿ ïóñòûì. Äàëåå ñëåäóåò
ïðîâåðêà ïî ñïèñêàì äîñòóïà. Äàííûé òèï àâòîðèçàöèè íå çàâèñèò îò ïëàòôîðìû
ñåðâåðà (ò.å. ïðîêñè ñåðâåð çàïóùåííûé ïîä Unix ñìîæåò îïðåäåëÿòü NetBIOS
èìåíà). Åãî ðåêîìåíäóåòñÿ èñïîëüçîâàòü â îäíîðîäíûõ ñåòÿõ, ãäå íà âñåõ êëèåíòàõ
óñòàíîâëåíà Windows NT/2000/XP è ïîëüçîâàòåëè íå èìåþò äîñòóïà ê
ïðèâèëåãèðîâàííûì ó÷åòíûì çàïèñÿì. Ýòîò âèä àâòîðèçàöèè íå ÿâëÿåòñÿ íàäåæíûì.

      auth strong

      
Ïðîâåðÿåòñÿ èìÿ è ïàðîëü ïåðåäàííûå ïîëüçîâàòåëåì ïðè ïîäêëþ÷åíèè ê ïðîêñè.
Äàííûé âèä àâòîðèçàöèè ðàáîòàåò òîëüêî ñ proxy è socks. Íåîáõîäèìî çàäàíèå
ñïèñêà ïîëüçîâàòåëåé (ñì Êàê ñîçäàòü ñïèñîê ïîëüçîâàòåëåé).
Ñîåäèíåíèÿ îò íåèçâåñòíûõ ïîëüçîâàòåëåé íå ïðèíèìàþòñÿ. Ïîñëå ïðîâåðêè èìåíè
ïîëüçâîàòåëÿ è ïàðîëÿ ïðîèñõîäèò ïðîâåðêà ñïèñêîâ äîñòóïà.

      
Äëÿ ðàçíûõ ñëóæá ìîæíî óñòàíîâèòü ðàçëè÷íûå òèïû àâòîðèçàöèè, íàïðèìåð

      auth none
pop3p
auth iponly
proxy
auth strong
socks

      
Íå íàêëàäâàåò îãðàíè÷åíèé íà èñïîëüçîâàíèå POP3 Proxy, ïðîèçâîäèò ïðîâåðêó
ïî ñïèñêàì äîñòóïà äëÿ ïîëüçîâàòåëåé HTTP Proxy è òðåáóåò àâòîðèçàöèè ñ èìåíåì
è ïàðîëåì äëÿ SOCKS.

      
		
    • Êàê ñîçäàòü ñïèñîê ïîëüçîâàòåëåé

      
Ñïèñîê ïîëüçîâàòåëåé çàäàåòñÿ ñ ïîìîùüþ êîììàíäû users. 

      users USERDESC ...

      
Ñ ïîìîùüþ îäíîé êîììàíäû ìîæíî çàäàòü íåñêîëüêî ïîëüçîâàòåëåé, ìîæíî
äàâàòü íåñêîëüêî êîììàíä users. USERDESC - îïèñàíèå ïîëüçîâàòåëÿ. Îïèñàíèå
ïîëüçîâàòåëÿ ñîñòîèò èç òðåõ ïîëåé ðàçäåëåííûõ : (äâîåòî÷èåì) - èìåíè (login)
òèïà ïàðîëÿ è ïàðîëÿ. Íàïðèìåð:

      users admin:CL:bigsecret test:CL:password test1:CL:password1
users "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."
users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63

      
Îáðàòèòå âíèìàíèå íà äâîéíûå êàâû÷êè - îíè íåîáõîäèìû äëÿ âòîðîãî ïîëüçîâàòåëÿ,
ò.ê. â åãî ïàðîëå âñòðå÷àåòñÿ çíàê $, êîòîðûé äëÿ ôàéëà 3proxy.cfg îçíà÷àåò
âêëþ÷åíèå äðóãîãî ôàéëà. Ïîääåæèâàåòñÿ ñëåäóþùèå òèïû ïàðîëåé:

        
	
      • òèï íå óêàçàí - èñïîëüçîâàòü ñèñòåìíóþ àâòîðèçàöèþ äëÿ
	äàííîãî ïîëüçîâàòåëÿ (ïîêà íå ðåàëèçîâàíî).
	
      • CL - ïàðîëü â îòêðûòîì òåêñòå
	
      • CR - ïàðîëü â ôîðìàòå crypt() (òîëüêî MD5)
	
      • NT - ïàðîëü â ôîðìàòå NT â øåñòíàäöàòåðè÷íîé êîäèðîâêå

      
NT è crypt ïàðîëè ìîãóò áûòü èñïîëüçîâàíû äëÿ èìïîðòà ó÷åòíûõ çàïèñåé èç
Windows/Samba è Unix ñîîòâåòñòâåííî (äëÿ Windows ìîæíî èñïîëüçîâàòü óòèëèòû
ñåìåéñòâà pwdump).
Ó÷åòíûå çàïèñè óäîáíî õðàíèòü â îòäåëüíîì ôàéëå (â òàêîì ñëó÷àå ìîæíî õðàíèòü
èõ ïîñòðî÷íîá â ôîðìàòå òèïè÷íîì äëÿ ôàéëîâ ïàðîëåé). Âêëþ÷èòü ôàéë ìîæíî ñ
ïîìîùüþ ìàêðîñà $:

      users $/etc/.3proxypasswd

      
èëè

      users $"c:\Program Files\3proxy\passwords"

      
Øèôðîâàííûå NT è crypt ïàðîëè ìîæíî ñîçäàâàòü ñ ïîìîùüþ óòèëèòû mycrypt.

      Ñïèñîê ïîëüçîâàòåëåé åäèí äëÿ âñåõ ñëóæá. Ðàçãðàíè÷åíèå äîñòóïà ïî ñëóæáàì
íåîáõîäèìî ïðîèçâîäèòü ñ ïîìîùüþ ñïèñêîâ äîñòóïà.

      
		
    • Êàê îãðàíè÷èòü äîñòóï ïîëüçîâàòåëåé ê ðåñóðñàì

      
Äëÿ ïîñòðîåíèÿ ñïèñêîâ äîñòóïà èñïîëüçóþòñÿ êîìàíäû allow, deny, redirect è
flush. Êîìàíäû èìåþò ñëåäóþùóþ ñòðóêòóðó:

      
allow <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
		<weekdays> <timeperiodslist>

      deny <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
		<weekdays> <timeperiodslist>

      redirect redirect_ip redirect_port <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
		<weekdays> <timeperiodslist>

      flush
      

      
Óîìàíäà flush èñïîëüçóåòñÿ äëÿ ñáðîñà ñóùåñòâóþùåãî ñïèñêà äîñòóïà (ýòî
íåîáõîäèìî äëÿ òîãî, ÷òîûá ìîæíî áûëî çàäàòü ðàçëè÷íûå ñïèñêè äîñòóïà äëÿ
ðàçëè÷íûõ ñëóæá). Êîìàíäà redirect èñïîëüçóåòñÿ äëÿ ïåðåíàïðàâëåíèÿ ñîåäèíåíèÿ,
allow äëÿ ðàçðåøåíèÿ ñîåäèíåíèÿ, deny - äëÿ çàïðåòà ñîåäèíåíèÿ 
(î ïåðåíàïðàâëåíèè ñì. Êàê óïðàâëÿòü ïåðåíàïðàâëåíèÿìè).
 ìîìåíò óñòàíîâêè èñõîäÿùåãî ñîåäèíåíèÿ ïðîñìàòðèâàåòñÿ ñïèñîê äîñòóïà è
íàõîäèòñÿ ïåðâàÿ çàïèñü, ñîîòâåòñòâóþùàÿ çàïðîøåííîìó êëèåíòîì ñîåäèíåíèþ.
Åñëè çàïèñü ñîòòâåòñòâóåò allow - ñîåäèíåíèå ðàçðåøàåòñÿ, deny - çàïðåùàåòñÿ,
redirect - ïåðåíàïðàâëÿåòñÿ íà óêàçàííûé redirect_ip:redirect_port. Åñëè
ñïèñîê ïóñò, òî ñîåäèíåíèå ðàçðåøàåòñÿ. Åñëè ñïèñîê íå ïóñò, íî ïîäõîäÿùåé
çàïèñè íåò, òî ñîåäèíåíèå çàïðåùàåòñÿ. Ïðè ýòîì

        
	
      • <userlist> - ñïèñîê ëîãèíîâ ïîëüçîâàòåëåé ÷åðåç çàïÿòóþ
	
      • <sourcelist> - ñïèñîê ñåòåé êëèåíòîâ ÷åðåç çàïÿòóþ. Ñåòü
		çàäàåòñÿ â ôîðìàòå xxx.yyy.zzz.mmm/l, ãäå l - äëèíà ìàñêè
		ñåòè (êîëè÷åñòâî íåíóëåâûõ áàéò). Íàïðèìåð 192.168.1.0/24
		ñîîòâåòñòâóåò ñåòè ñ ìàñêîé 255.255.255.0.
	
      • <targetlist> - ñïèñîê ñåòåé íàçíà÷åíèÿ ÷åðåç çàïÿòóþ
	
      • <targetportlist> - ñïèñîê ïîðòîâ íàçíà÷åíèÿ ÷åðåç çàïÿòóþ.
		ìîæíî çàäàòü äèàïàçîí ïîðòîâ ÷åðåç -, íàïðèìåð 80,1024-65535
	
      • <commandlist> - ñïèñîê êîììàíä, ÷åðåç çàïÿòóþ, äëÿ êîòîðûõ ïðèìåíÿåòñÿ ïðàâèëî:

        		CONNECT	- óñòàíîâèòü èñõîäÿùåå TCP ñîåäèíåíèå (íàïðèìåð SOCKSv4/5, POP3 proxy, etc)

        		BIND - ðàçðåøèòü âõîäÿùåå TCP ñîåäèíåíèå (SOCKSv5)

        		UDPASSOC - ñîçäàòü UDP-àññîöèàöèþ (SOCKSv5)

        		ICMPASSOC - ñîçäàòü ICMP-àññîöèàöèþ (íå ðåàëèçîâàíî)

        		HTTP_GET - HTTP GET çàïðîñ (HTTP proxy)

        		HTTP_PUT - HTTP PUT çàïðîñ (HTTP proxy)

        		HTTP_POST - HTTP POST çàïðîñ (HTTP proxy)

        		HTTP_HEAD - HTTP HEAD çàïðîñ (HTTP proxy)

        		HTTP_CONNECT - HTTP CONNECT çàïðîñ (HTTP proxy)

        		HTTP_OTHER - äðóãîé HTTP çàïðîñ (HTTP proxy)

        		HTTP - ñîîòâåòñòâóåò ëþáîìó HTTP çàïðîñó êðîìå HTTP_CONNECT (HTTP proxy)

        		HTTPS - òîæå, ÷òî HTTP_CONNECT (HTTP proxy)

        		FTP_GET - FTP get çàïðîñ

        		FTP_PUT - FTP put çàïðîñ

        		FTP_LIST - FTP list çàïðîñ

        		FTP - ñîîòâåòñòâóåò ëþáîìó FTP çàïðîñó
	
      • <weekdays> çàäàåò ñïèñîê äíåé íåäåëè, 1 ñîîòâåòñòâóåò
		ïîíåäåëüíèêó, 0 èëè 7 - âîñêðåñåíüå. 1-5 îçíà÷àåò ñ ïîíåäåëüíèêà
		ïî ïÿòíèöó (âêëþ÷èòåëüíî). 1,3,5 çàäàåò íå÷åòíûå äíè íåäåëè.
	
      • <timeperiodslist> ñïèñîê èíòåðâàëîâ äíÿ â ôîðìàòå 
		××:ÌÌ:ÑÑ-××:ÌÌ:ÑÑ, íàïðèìåð 00:00:00-08:00:00,17:00:00-24:00:00
		çàäàåò íåðàáî÷åå âðåìÿ.
		

      
Ïðèìåðû èñïîëüçîâàíèÿ ëèñòîâ äîñòóïà ìîæíî íàéòè â ôàéëå 3proxy.cfg.sample.
Íóëåâîé àäðåñ èëè ïîðò ïåðåíàïðàâëåíè îçíà÷àåò, ÷òî îí íå äîëæåí èçìåíèòüñÿ.
Åñëè è àäðåñ è ïîðò íóëåâûå

      redirect 0.0.0.0 0

      
òî ýòî èìååò ñïåöèàëüíîå çíà÷åíèå ïðîçðà÷íîãî ïåðåíàïðàâëåíèÿ â ëîêàëüíûé
HTTP ïðîêñè (îáû÷íî èç SOCKS), ïðè ýòîì íå óñòàíàâëèâàåòñÿ íèêàêèõ
äîïîëíèòåëüíûõ ñîåäèíåíèé.

      
		
    • Êàê óïðàâëÿòü ïåðåíàïðàâëåíèÿìè

      
Ïåðåíàïðàâëåíèÿ èìååò ñìûñë èñïîëüçîâàòü, íàïðèìåð, ÷òîáû ïåðåíàïðàâèòü
îáðàùåíèÿ îïðåäåëåííûõ êëèåíòîâ èëè íà îïðåäåëííûå ñåðâåðà íà äðóãîé ñåðâåð
(íàïðèìåð ïðè ïîïûòêå äîñòóïà íà Web ñåðâåð ñ íåäîçâîëåííûì ìàòåðèàëîì
ïåðåíàïðàâèòü íà ñîáñòâåííûé Web ñåðâåð, èëè äëÿ òîãî, ÷òîáû â çàâèñèìîñòè
îò IP êëèåíòà ïåðåíàïðàâëÿòü åãî ñîåäèíåíèÿ íà ðàçíûå ñåðâåðà (îñîáåííî ïðè
îòîáðàæåíèè ïîðòîâ ÷åðåç tcppm). Êðîìå òîãî, ïåðåíàïðàâëåíèå ìîæåò áûòü
èñïîëüçîâàíî, íàïðèìåð, äëÿ ïåðåíàïðàâëåíèÿ âñå èñõîäÿùèõ HTTP çàïðîñîâ
ïîñëàííûõ ÷åðåç SOCKS íà HTTP ïðîêñè. Ïîñêîëüêó ôîðìàò çàïðîñà ê Web ñåðâåðó
è Proxy ðàçëè÷àåòñÿ, íå ëþáîé Proxy ñåðâåð ñïîñîáåí êîððåêòíî îáðàáîòàòü
ïåðåíàïðàâëåííûé çàïðîñ (HTTP proxy â êîìïëåêòå 3proxy íîðìàëüíî îáðàáàòûâàåò
ïåðåíàïðàâëåííûå çàïðîñû, ÷òî äåëàåò âîçìîæíûì åãî èñïîëüçîâàíèÿ â êà÷åñòâå
"ïðîçðà÷íîãî" ïðîêñè. Êðîìå òîãî, HTTP ïðîêñè îáíàðóæèâàåò ïåðåíàïðàâëåíèÿ
íà ðîäèòåëüñêèé ïðîêñè è ãåíåðèðóåò íîðìàëüíûå çàãîëîâêè. 

      
		
    • Êàê ñîñòàâëÿòü öåïî÷êè ïðîêñè

      
Äëÿ ñîñòàâëåíèÿ öåïî÷åê ïðîêñè ìîæíî èñïîëüçîâàòü êîìàíäó parent. parent
ÿâëÿåòñÿ ðàñøèðåíèåì êîìàíäû allow (ò.å. êîìàíäå parent äîëæíà ïðåäøåñòâîâàòü
êîìàíäà allow). Ñ ïîìîùüþ ýòîé êîìàíäû ìîæíî ñòðîèòü öåïî÷êè èç HTTPS
(HTTP CONNECT), SOCKS4 è SOCKS5 ïðîêñè (ò.å. ïîñëåäîâàòåëüíî ïîäêëþ÷àòüñÿ
÷åðåç íåñêîëüêî ïðîêñè), ïðè ýòîì âîçìîæíà àâòîðèçàöèÿ íà ðîäèòåëüñêîì ïðîêñè,
çâåíî öåïî÷êè ìîæåò âûáèðàòüñÿ ñëó÷àéíûì îáðàçîì èç íåñîëüêèõ çíà÷åíèé
ñ âåðîÿòíîñòüþ ñîãëàñíî èõ âåñó. Âåñ (îò 1 äî 1000) çàäàåòñÿ äëÿ êàæäîãî
ïðîêñè. Ñóììà âåñîâ ïî âñåì ïåðåíàïðàâëåíèÿì äîëæíà áûòü êðàòíà 1000.
Ïðîêñè ñ âåñàìè äî 1000 ãðóïïèðóþòñÿ, è ïðè ïîñòðîåíèè öåïî÷êè îäèí èç íèõ
âûáèðàåòñÿ ñëó÷àéíî ñîãëàñíî âåñó. Äëèíà öåïî÷êè îïðåäåëÿåòñÿ èç ñóììàðíîãî
âåñà. Íàïðèìåð, åñëè ñóììàðíûé âåñ öåïî÷êè 3000, â öåïî÷êå áóäåò 3 çâåíà.
Ñèíòàêñèñ êîìàíäû:

      parent <weight> <type> <ip> <port> <username> <password>

      
weight - âåñ ïðîêñè, type - òèï ïðîêñè (tcp - ïåðåíàïðàâëåíèå ñîåäèíåíèÿ,
ìîæåò áûòü òîëüêî ïîñëåäíèì â öåïî÷êå, http - ñèíîíèì tcp, connect - HTTP
CONNECT/HTTPS ïðîêñè, socks4 - SOCKSv4 ïðîêñè, socks5 - SOCKSv5 ïðîêñè),
ip - IP àäðåñ ïðîêñè, port - ïîðò ïðîêñè, username - èìÿ äëÿ àâòîðèçàöèè
íà ïðîêñè (îïöèîíàëüíî), password - ïàðîëü äëÿ àâòîðèçàöèè íà ïðîêñè
(îïöèîíàëüíî).

      Ïðèìåð:

      allow *
parent 500 socks5 192.168.10.1 1080
parent 500 connect 192.168.10.1 3128

      
Ñîçäàåò öåïî÷êó èç îäíîãî çâåíà (ñóììàðíûé âåñ 1000), â êîòîðîì îäèí èç äâóõ
ïðîêñè âûáèðàåòñÿ ñëó÷àéíî ñ ðàâíîé âåðîÿòíîñòüþ (âåñà ðàâíû).  öåïî÷êó
ïåðåíàïðàâëÿþòñÿ âñå èñõîäÿùèå ñîåäèíåíèÿ (îïðåäåëÿåòñÿ êîììàíäîé allow).

      allow * * * 80
parent 1000 socks5 192.168.10.1 1080
parent 1000 connect 192.168.20.1 3128
parent 300 socks4 192.168.30.1 1080
parent 700 socks5 192.168.40.1 1080

      
Ñîçäàåò öåïî÷êó èç òðåõ çâåíüåâ (ñóììàðíûé âåñ 3000). Ïåðâîå çâåíî -
192.168.10.1, âòîðîå - 192.168.20.1, à òðåòüå - ëèáî 192.168.30.1 ñ
âåðîÿòíîñòüþ 0.3 ëèáî 192.168.40.1 ñ âåðîÿòíîñòüþ 0.7

      Ïàðà êîììàíä

      allow <arg>
parent 1000 tcp <ip> <port>

      
ÿâëÿåòñÿ ïîëíûì àíàëîãîì êîìàíäû

      redirect <ip> <port> <arg>

      


      
		
    • Êàê îãðàíè÷èâàòü ñêîðîñòè ïðèåìà

      
3proxy ïîçâîëÿåò óñòàíàâëèâàòü ôèëüòðû øèðèíû ïîòðåáëÿåìîãî êàíàëà. Äëÿ ýòîãî
ñëóæàò êîìàíäû bandlimin è nobandlimin (in â êîìàíäå îçíà÷àåò, ÷òî ïðàâèëî
ïðèìåíÿåòñÿ ê âõîäÿùåìó òðàôèêó).

      
bandlimin <bitrate> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>

      nobandlimin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
      

      

      
bitrate óêàçûâàåò øèðèíó ïîòîêà â áèòàõ â ñåêóíäó (èìåííî â áèòàõ). Â îñòàëüíîì
êîìàíäû àíàëîãè÷íû êîìàíäàì allow/deny, ñ òåì îòëè÷èåì, ÷òî êîìàíäû bandlim
íå èìåþò ïðèâÿçêè ê êîíêðåòíîìó ñåðâèñó, òàêîìó êàê HTTP ïðîêñè èëè SOCKS
è äåéñòâóþò íà âñå ñåðâèñû, òðàôèê ïî âñåì ñîåäèíåíèÿì, ïîïàâøèì ïîä äåéñòâèå
ïðàâèëà ñóììèðóåòñÿ, íåçàâèñèìî îò òîãî, ÷åðåç êàêîé ñåðâèñ ýòî ñîåäèíåíèå
óñòàíîâëåíî.

        bandlimin 57600 * 192.168.10.16
  bandlimin 57600 * 192.168.10.17
  bandlimin 57600 * 192.168.10.18
  bandlimin 57600 * 192.168.10.19

      
óñòàíàâàëèåò êàíàë 57600 äëÿ êàæäîãî èç ÷åòûðåõ êëèåíòîâ,

        bandlimin 57600 * 192.168.10.16/30

      
óñòàíàâàëèàåò ñóììàðíûé êàíàë 57600 íà 4õ êëèåíòîâ. Åñëè íåîáõîäèìî, ÷òîáû íà
êàêîé-òî ñåðâèñ íå áûëî îãðàíè÷åíèÿ øèðèíû êàíàëà, ñëåäóåò óêàçàòü nobandlim
äëÿ ýòîãî ñåðâèñà, íàïðèìåð:

        nobandlimin * * * 110
  bandlimin 57600 * 192.168.10.16/32

      
ðàçðåøàåò êëèåíòàì íåîãðàíè÷åííûé ïî ñêîðîñòè äîñòóï ïî ïðîòîêîëó POP3.



      
		
    • Êàê îãðàíè÷èâàòü îáúåì ïðèíèìàåìîãî òðàôèêà

      

      
counter <filename>

      countin <number> <type> <amount> <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>

      nocountin <userlist> <sourcelist> <targetlist> <targetportlist> <commandlist>
      

      

      
	Êîìàíäû ïîçâîëÿþò óñòàíîâèòü ëèìèò òðàôèêà íà äåíü, íåäåëþ èëè ìåñÿö.
	Ñâåäåíèÿ î òðàôèêå ïîñòîÿííî ñîõðàíÿþòñÿ â ôàéëå, óêàçûâàåìîì êîìàíäîé
	counter, ÷òî äåëàåò ïîäñ÷åò òðàôèêà íåçàâèñèìûì îò ïåðåçàãðóçêè ïðîêñè.
	Äåéñòâèå êîìàíä countin/nocountin àíàëîãè÷íî äåéñòâèþ bandlimin/nobandlimin,
	number - çàäàåò ïîñëåäîâàòåëüíûé íîìåð ñ÷åò÷èêà, íîìåð äîëæåí áûòü
	óíèêàëüíûì ïîëîæèòåëüíûì ÷èñëîì. Çíà÷åíèå 0 óêàçûâàåò, ÷òî ñâåäåíèÿ
	äëÿ äàííîãî ñ÷åò÷èêà íå íàäî ñîõðàíÿòü â ôàéëå.
	
      
	type - òèï îãðàíè÷åíèÿ. D (Íà äåíü), W (íà íåäåëþ) èëè M (íà ìåñÿö).
	
      
	amount - îáúåì òðàôèêà íà óêàçàííûé ïåðèîä â ìåãàáàéòàõ.

      

		
    • Êàê ñòðîèòü ñïèñêè ñåòåé è ïîëüçîâàòåëåé

      
Î÷åíü ÷àñòî ñïèñêè ñåòåé è ïîëüçîâàòåëåé áûâàþò äîñòàòî÷íî ãðîìîçäêèìè.
3proxy íå ïîääåðæèâàåò ñîçäàíèå ãðóïï, íî ïîçâîëÿåò âêëþ÷åíèå ôàéëîâ. Ýòî
îçíà÷àåò, ÷òî äëÿ óäîáñòâà àäìèíèñòðèðîâàíèÿ âûãîäíî õðàíèòü ñïèñêè
ïîëüçîâàòåëåé è ñïèñêè ñåòåé â îòäåëüíûõ ôàéëàõ è, ïðè íåîáõîäèìîñòè äàòü
ïîëüçîâàòåëþ äîñòóï ê òîìó èëè èíîìó ðåñóðñó, ïðàâèòü ôàéë ñî ñïèñêîì
ïîëüçîâàòåëåé èëè ñåòåé âìåñòî òîãî, ÷òîáû ïðàâèòü ñàì ôàéë 3proxy.cfg. Â ôàéëå
3proxy.cfg ôàéë ñî ñïèñêîì ìîæíî âêëþ÷èòü ñ ïîìîùüþ ìàêðîñà $.
Ïîñêîëüêó â 3proxy åñòü îãðàíè÷åíèÿ íà ìàêñèìàëüíûé ðàçìåð ýëåìåíòà
êîíôèãóðàöèè, áîëüøèå ñïèñêè ñëåäóåò ðàçáèâàòü íà íåñêîëüêî ôàéëîâ è
èñïîëüçîâàòü íåñêîëüêî çàïèñåé ñïèñêà êîíòðîëÿ äîñòóïîì.
 êîìïëåêòå ñ 3proxy ïîñòàâëÿåòñÿ óòèëèòà dighosts, êîòîðàÿ ïîçâîëÿåò ïîñòðîèòü
ñïèñîê ñåòåé ïî ñòðàíèöå Web. Óòèëèòà ïîçâîëÿåò ïîèñê àäðåñîâ íà Web-ñòðàíèöå
â ôîðìàòå ÀÄÐÅÑ ÌÀÑÊÀ èëè ÀÄÐÅÑ/ÄËÈÍÀ. Óòèëèòó dighosts ìîæíî âûçâàòü âî âðåìÿ
ñòàðòà 3proxy èñïîëüçóÿ êîìàíäó system. Íàïðèìåð:

      system "dighosts http://provider/network.html local.nets"
allow * * $local.networks
redirect proxy.provider 3128 *
proxy
flush

      
 äàííîì ñëó÷àå â ôàéëå local.networks ãåíåðèðóåòñÿ ñïèñîê ëîêàëüíûõ ñåòåé ïî
ñòðàíèöå networklist.html. Äàëåå èñïîëüçóåòñÿ ñïèñîê êîíòðîëÿ äîñòóïà äëÿ òîãî,
÷òîáû ðàçðåøèòü ëîêàëüíîìó ïðîêñè-ñåðâåðó äîñòóï ê ëîêàëüíûì ñåòÿì íà ïðÿìóþ,
à âñå îñòàëüíûå çàïðîñû ïåðåíàïðàâèòü íà ïðîêñè-ñåðâåð ïðîâàéäåðà.

      
		
    • Êàê óïðàâëÿòü ðàçðåøåíèåì èìåí è êýøèðîâàíèåì DNS

      
	Äëÿ ðàçðåøåíèÿ èìåí è êýøèðîâàíèÿ ïðèìåíÿþòñÿ êîìàíäû nserver,
	nscache è nsrecord.

      	nserver 192.168.1.2
	nserver 192.168.1.3

      
	óêàçûâàåò 3proxy êàêèå ìàøèíû ñëåäóåò èñïîëüçâîàòü â êà÷åñòâå ñåðâåðà
	DNS.  Ñåðâåð 192.168.1.3 áóäåò èñïîëüçîâàòüñÿ òîëêüî ïðè íåäîñòèæèìîñòè
	192.168.1.2. Ìîæíî óêàçàòü äî 5 ñåðâåðîâ. Åñëè nserver íå óêàçàí, áóäóò
	èñïîëüçîâàíû ñèñòåìíûå ôóíêöèè ðàçðåøåíèÿ èìåí.

      	nscache 65535

      
	óêàçûâàåò ðàçìåð êýøà äëÿ ðàçðåøåíèÿ èìåí (îáû÷íî äîñòàòî÷íî áîëüøîé).
	Êýø èñîïëüçóåòñÿ òîëüêî ïðè ÿâíîì óêàçàíèè nserver.

      	nsrecord server.mycompany.com 192.168.1.1
	nsrecord www.porno.com 0.0.0.0

      
	äîáàâëÿåò ñòàòè÷åñêóþ çàïèñü â êýø. Åñëè èñïîëçîâàí àäðåñ 0.0.0.0 èìÿ
	íå áóäåò ðàçðåøàòüñÿ.

      
		
    • Êàê óñòàíàâëèâàòü ñîåäèíåíèå ïî òðåáîâàíèþ

      
	êîìàíäà dialer óñòàíàâëèâàåò ïðîãðàììó, êîòîðàÿ áóäåò çàïóñêàòüñÿ ïðè
	íåâîçìîæíîñòè ðàçðåøèòü èìÿ êîìïüþòåðà, íàïðèìåð:

      	dialer "rasdial PROVIDER"

      
	(îïèñàíèå rasdial ìîæíî íàéòè íà ñåðâåðå ïîääåðæêè Microsoft).
	Åñòü äâà àñïåêòà: íåâîçìîæíîñòü ðàçðåøåíèÿ èìåíè åùå íå ñâèäåòåëüñòâóåò
	îá îòñóòñòâèè ñîåäèíåíèÿ (ýòî äîëæíà ó÷èòûâàòü âûçûâàåìàÿ ïðîãðàììà),
	ïðè èñïîëüçîâàíèè nscache èìÿ ìîæåò ðàçðåøèòüñÿ ïðè îòñóòñòâèè
	ñîåäèíåíèÿ.  òàêèõ ñëó÷àÿõ ïîëåçíî çàïðàøèâàòü çàâåäîìî íåñóùåñòâóþùèé
	ðåñóðñ, íàïðèìåð http://dial.right.now/.

      	

	
    


    
	
  • Êîíôèãóðàöèÿ êëèåíòîâ

    
	
      
		
    • Êàê èñïîëüçîâàòü 3proxy ñ Internet Explorer èëè äðóãèì áðàóçåðîì?

      Ìû áóäåì ðàññìàòðèâàòü Interenet Explorer, ò.ê. ó íåãî áîëüøå îñîáåííîñòåé
íàñòðîéêè, ñ äðóãèìè áðàóçåðàìè äîëæíî âîçíèêàòü ìåíüøå âîïðîñîâ.

      Åñòü äâà îñíîâíûõ ñïîñîáà ðàáîòû ñ 3proxy - èñïîëüçîâàòü HTTP ïðîêñè (ñåðâèñ
proxy) èëè SOCKS ïðîêñè (ñåðâèñ socks). Îáû÷íî èñïîëüçóåòñÿ HTTP ïðîêñè. Äëÿ
SOCKS ïðîêñè ìîæíî èñïîëüçîâàòü âñòðîåííóþ ïîääåðæêó áðàóçåðà èëè
ïðîãðàììó-ñîêñèôèêàòîð (ñì.
Êàê èñïîëüçîâàòü 3proxy ñ ïðîãðàììîé íå ïîääåðæèâàþùåé ðàáîòó ñ ïðîêñè-ñåðâåðîì?)
åñëè âñòðîåííàÿ ïîääåðæêà SOCKS ÷åì-òî íå óñòðàèâàåò èëè òàê óäîáíåå. Íå âñå
ñîêñèôèêàòîðû ïîääåðæèâàþò âõîäÿùèå ñîåäèíåíèÿ, ÷òîáû íå áûëî ïðîáëåì ñ
ïðîòîêîëîì FTP ëó÷øå èñïîëüçîâàòü ïàññèâíûé ðåæèì (â Internet Explorer 5.5SP2
è âûøå "Èñïîëüçîâàòü ïàññèâíûé FTP-ïðîòîêîë").

      Äëÿ êîíôèãóðàöèè HTTP ïðîêñè íåîáõîäèìî óêàçàòü âíóòðåííèé àäðåñ è ïîðò
óñòàíîâëåíûé äëÿ ñëóæáû proxy â êîíôèãóðàöèè 3proxy (ëèáî êàê "Îäèí
ïðîêñè-ñåðâåð äëÿ âñåõ ïðîòîêîëîâ" ëèáî äëÿ HTTP, Secure, FTP). Ïîääåðæêà
Gopher â 3proxy â íàñòîÿùèé ìîìåíò íå ðåàëèçîâàíà, íî ýòîò óñòàðåâøèé ïðîòîêîë
â Internet ïðàêòè÷åñêè íå èñïîëüçóåòñÿ. Äëÿ íîðìàëüíîé ðàáîòû FTP ÷åðåç HTTP
ïðîêñè íåîáõîäèìî îòêëþ÷èòü ïðåäñòàâëåíèå äëÿ ïàïîê FTP (FTP folder view),
îí âêëþ÷åí ïî-óìîë÷àíèþ, ò.ê. èíà÷å FTP áóäåò ðàáîòàòü áåç èñïîëüçâàíèÿ HTTP
ïðîêñè. HTTP ïðîêñè èñïîëüçóåò ïàññèâíûé ðåæèì äëÿ ïðîòîêîëà FTP. Â íàñòðîéêàõ
3proxy ðåêîìåíäóåò ðàçðåøòü ìåòîä HTTP_CONNECT òîëüêî äëÿ ïîðòà íàçíà÷åíèÿ 443.
Åñëè ìåòîä HTTP_CONNECT íå ðàçðåøåí, òî íå áóäåò ðàáîòàòü ïðîòîêîë HTTPS, åñëè
îí ðàçðåøåí äëÿ âñåõ ïîðòîâ, òî ìîæíî îáîéòè æóðíàëèðîâàíèå çàïðîñîâ äëÿ
ïðîòîêîëà HTTP).
Äëÿ ðàáîòû ñ HTTP ïðîêñè ìîæåò èñïîëüçîâàòüñÿ àâòîðèçàöèÿ ïî ïàðîëþ (strong). 

      Äëÿ èñïîëüçîâàíèÿ SOCKS íåîáõîäèìî íàñòðîèòü òîëüêî SOCKS ïðîêñè (èíà÷å äëÿ
òåõ ïðîòîêîëîâ, äëÿ êîòîðûõ óêàçàí ïðîêñè ñåðâåð ïðêîñè ñåðâåð áóäåò
èñïîëüçîâàòüñÿ êàê HTTP ïðîêñè). Internet Explorer (âêëþ÷àÿ IE 6.0SP1)
ïîääåðæèâàåò òîëüêî SOCKSv4.  êà÷åñòâå èìåíè ïîëüçîâàòåëÿ ïåðåäàåòñÿ èìÿ
ïîëüçîâàòåëÿ èñïîëüçîâàííîå äëÿ âõîäà â ñèñòåìó. Ïåðåäà÷à ïàðîëÿ â SOCKSv4 íå
ïîääåðæâèàåòñÿ, ïîýòîìó àâòîðèçàöèÿ ïî ïàðîëþ (strong) íå äîñòóïíà. Ìîæíî
èñîïëüçîâàòü èìÿ ïîëüçîâàòåëÿ ïåðåäàííîå áðàóçåðîì â ACL äëÿ iponly-àâòîðèçàöèè,
íî ïðè ýòîì íåîáõîäèìî èìåòü ââèäó íåíàäåæíîñòü òàêîãî ñïîñîáà. Ïðè ðàáîòå ÷åðåç
SOCKS Internet Explorer (è áîëüøàÿ ÷àñòü äðóãèõ áðàóçåðîâ) èñïîëüçóþò ïàññèâíûé
ðåæèì ðàáîòû äëÿ FTP. Ïðè èñïîëüçîâàíèè SOCKS ìîæíî ïîëó÷èò â æóðíàëå (ëîãàõ)
URL çàïðàøèâàåìûõ ñòðàíèö, äëÿ ýòîãî íåîáõîäèìî ñîçäàòü âíóòðåííåå
ïåðåíàïðàâëåíèå â HTTP ïðîêñè äëÿ ïîðòà 80 (è äðóãèõ ïîðòîâ èñïîëüçóåìûõ äëÿ
HTTP) â ëîêàëüíûé HTTP ïðîêñè (proxy), ïîðò 21 (è äðóãèå ïîðòû èñïîëüçóåìûå
FTP) â FTP ïðîêñè. Ïðè ïåðåíàïðàâëåíèè ñîåäèíåíèé â FTP ïðîêñè, íóæíî èìåòü
ââèäó, ÷òî FTP ñîçäàåò âòîðè÷íûå ñîåäèíåíèÿ äëÿ ïåðåäà÷è äàííûõ. Äëÿ ýòîãî,
âî-ïåðâûõ, íåîáõîäèìî ðàçðåøèò äîñòóï ê âíóòðåííåìó èíòåðôåéñó ïðîêñè ñåðâåðà
÷åðåç SOCKS (÷òî íå î÷åíü áåçîïàñíî), âî-âòîðûõ ïðèíÿòü ìåðû, ÷òîáû â SOCKS
òàêèå ñîåäèíåíèÿ íà âíóòðåííèé èíòåðôåéñ íå òàðèôèöèðîâàëèñü (ò.ê. èíà÷å îíè
áóäóò òàðèôèöèðîâàòüñÿ äâàæäû - SOCKS è FTP ïðîêñè).

      Internet Explorer è äðóãèå ïðîäâèíóòûå áðàóçåðû ïîääåðæèâàþò àâòîìàòè÷åñêóþ
êîíôèãóðàöèþ ïðîêñè-ñåðâåðà â ïîëíîñòüþ àâòîìàòè÷åñêîì èëè ïîëóàâòîìàòè÷åñêîì
ðåæèìàõ. Àâòîìàòè÷åñêàÿ êîíôèãóðàöèÿ ïîçâîëÿåò çàäàòü äîñòàòî÷íî ñëîæíûå
ïðàâèëà, ïîçâîëÿþùèå êëèåíòàì èñïîëüçîâàòü (èë èíå èñïîëüçâîàòü) ðàçíûå
ïðîêñè-ñåðâåðû äëÿ äîñòóïà ê ðàçíûì ðåñóðñàì. Ýòà âîçìîæíîñòü ðàçáèðàåòñÿ â
ñòàòüÿõ

      Microsoft: Q296591 A Description of the Automatic Discovery Feature

      http://support.microsoft.com/default.aspx?scid=kb;EN-US;296591

      Netscape: Navigator Proxy Auto-Config File Format

      http://wp.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html

		
    • Êàê íàñòðàèâàòü FTP êëèåíòà?

      
Íàñòðîéêà FTP êëèåíòà äëÿ ðàáîòû ÷åðåç SOCKS ïðîêñè íå îòëè÷àåòñÿ îò íàñòðîéêè
áðàóçåðà.

      
Äëÿ ðàáîòû ñ FTP êëèåíòîì ÷åðåç FTP ïðîêñè (ftppr) åñòü íåñêîëüêî âîçìîæíîñòåé.
Äîïóñòèì, íàì íåîáõîäèìî ïîäêëþ÷èòüñÿ êî âíåøíåìó FTP Ñåðâåðó ñî ñëåäóþùèìè
ïàðàìåòðàìè:

      	Àäðåñ:		ftp.security.nnov.ru
	Username:	ftpuser
	Password:	********

      

      Ðàáîòà ñ êëèåíòîì íå ïîääåðæèâàþùèì FTP ïðîêñè.  êà÷åñòâå àäðåñà FTP
ñåðâåðà óêàçûâàåòñÿ àäðåñ ïðîêñè (íàïðèìåð proxy.security.nnov.ru).
 êà÷åñòâå èìåíè ïîëüçîâàòåëÿ
ftpuser@ftp.security.nnov.ru. Åñëè äëÿ äîñòóïà ê ñëóæáå ftppr òðåáóåòñÿ
àâòîðèçàöèÿ ïî èìåíè è ïàðîëþ ñ èìåíåì pruser è ïàðîëåì prpass, òî â êà÷åñòâå
èìåíè ïîëüçîâàòåëÿ íåîáõîäèìî óêàçàòü pruser:prpass:ftpuser@ftp.security.nnov.ru.
Åñëè FTP êëèåíò òðåáóåò óêàçàíèÿ ïîëíîé URL äëÿ ïîäêëþ÷åíèÿ ê ñåðâåðó, òî îíà
äîëæíà âûãëÿäåòü êàê

      
pruser:prpass:ftpuser@ftp.security.nnov.ru:********@proxy.security.nnov.ru

      
Íå âñå êëèåíòû îáðàáîòàþò ýòî êîððåêòíî, íî â áîëüøèíñòâå ñëó÷àåâ ýòîãî íå
òðåáóåòñÿ.

      Ðàáîòà ñ êëèåíòîì ïîääåðæèâàþùèì FTP ïðîêñè. À òàêîì ñëó÷àå, åñëè 3proxy
íå òðåáóåò àâòîðèçàöèè ïî ïàðîëþ, òî íàñòðîéêè ñòàíäàðòíû äëÿ êëèåíòà. Åñëè
òðåáóåòñÿ äîñòóï ïî ïàðîëþ, òî â êà÷åñòâå èìåíè ïîëüçîâàòåëÿ óêàçûâàåòñÿ
pruser:prpass:ftpuser.

		
    • Êàê èñïîëüçîâàòü SMTP ÷åðåç 3proxy
 áîëüøèíñòâå ñëó÷àåâ äîñòàòî÷íî óñòàíîâèòü îòîáðàæåíèå (tcppm) TCP ïîðòà 25 íà
àíàëîãè÷íûé ïîðò SMTP-Ñåðâåðà ïðîâàéäåðà.  êîíôèãóðàöèè êëèåíòà óêàçàòü
âíóòðåííèé àäðåñ ïðîêñè â êà÷åñòâå àäðåñà SMTP-ñåðâåðà.

		
    • Êàê èñïîëüçîâàòü POP3 proxy?

      
Ïðåäïîëîæèì, ó âàñ åñòü ñëåäóþùèå íàñòðîéêè äëÿ ïîëó÷åíèÿ ïî÷òû:

      	POP3 server:	pop3.security.nnov.ru
	Login:		user
	Password:	********

      
 íàñòðîéêàõ ïî÷òîâîé ïðîãðàììû ñëåäóåò óêàçàòü:

      	POP3 server:	(àäðåñ ïðîêñè-ñåðâåðà)
	Login:		user@pop3.security.nnov.ru
	Password:	********

      
Èìÿ ïîëüçîâàòåëÿ ìîæåò ñàìî ïî ñåáå ñîäåðæàòü çíàê '@'. Åñëè â ïðèìåðå âûøå
èìÿ ïîëüçîâàòåëÿ user@security.nnov.ru, èìÿ ïîëüçâîàòåëÿ äëÿ äîñòóïà ê
ïðîêñè-ñåðâåðó äîëæíî áûòü user@security.nnov.ru@pop3.security.nnov.ru. Åñëè
pop3pr òðåáóåò àâòîðèçàöèè ïî èìåíè/ïàðîëþ (íàïðèìåð pruser è prpass), òî èõ
íåîáõîäèìî óêàçàòü â íà÷àëå èìåíè ïîëüçîâàòåëÿ îòäåëè çíàêîì ':', ò.å, äëÿ
ñàìîãî òÿæåëîãî ñëó÷àÿ pruser:prpass:user@security.nnov.ru@pop3.security.nnov.ru
		
    • Êàê èñïîëüçîâàòü 3proxy ñ ïðîãðàììîé íå ïîääåðæèâàþùåé ðàáîòó ñ ïðîêñè-ñåðâåðîì?

      
Ìîæíî èñïîëüçîâàòü ëþáóþ ïðîãðàììó-ðåäèðåêòîð, íàïðèìåð
SocksCAP èëè
FreeCAP. 3proxy ïîääåðæèâàåò èñõîäÿùèå
è îáðàòíûå TCP è UDP ñîåäèíåíèÿ, íî ðåäèðåêòîðû ìîãóò èìåòü ñâîè îãðàíè÷åíèÿ,
êðîìå òîãî, íåêîòîðûå ïëîõî íàïèñàíûå ïðèëîæåíèÿ íå ïîääàþòñÿ "ñîêñèôèêàöèè".
Åñëè ïðîãðàììå òðåáóåòñÿ îáðàùàòüñÿ ê íåáîëüøîìó íàáîðó ñåðâåðîâ 
(íàïðèìåð èãðîâûõ), òî ïðîáëåìó ìîæíî ðåøèòü ñ ïîìîùüþ ïîðòìàïïèíãà.
		
    • Êàê èñïîëüçîâàòü 3proxy ñ èãðàìè?
Îïòèìàëüíûé âàðèíò - èñïîëüçîâàòü ñîêñèôèêàòîð (Êàê èñïîëüçîâàòü
3proxy ñ ïðîãðàììîé íå ïîääåðæèâàþùåé ðàáîòó ñ ïðîêñè-ñåðâåðîì?). 
FreeCap 3.13  ïðîâåðåí ñ èãðàìè íà äâèæêå
Unreal (âêëþ÷àÿ Unreal Tournament), Half-Life (âêëþ÷àÿ Counter Strike) è
äðóãèìè. Åñëè ïî êàêèì-òî ïðè÷èíàì ñîêñèôèêàòîð íå ðàáîòàåò èëè íåäîñòóïåí,
òî íåîáõîäèìî èñïîëüçîâàòü îòîáðàæåíèÿ ïîðòîâ (îáû÷íî èãðû, 
êðîìå mood-ïîäîáíûõ, ðàáîòàþò ïî ïðîòîêîëó UDP, íàäî èñîïëüçîâàòü udppr).
Íóæíî èìåòü ââèäó, ÷òî äëÿ udppr òðåáóåòñÿ îòäåëüíûé ìàïïèíã äëÿ êàæäîãî
ñåðâåðíîãî ïîðòà è êàæäîãî êëèåíòà. Íàïðèìåð, åñëè åñòü îäèí ñåðâåð ñ ïîðòàìè
2115 è 2116 è òðè êëèåíòà, òî íóæíî ñîçäàòü 6 ðàçíûõ ìàïïèíãîâ, íàïðèìåð

       12115 -> server:2115
 22115 -> server:2115
 32115 -> server:2115
 12116 -> server:2116
 22116 -> server:2116
 32116 -> server:2116

      
 èãðîâîì êëèåíò àäðåñ è ïîðò ñ ìàïïèíãîì ñëåäóåò óêàçûâàòü âìåñòî àäðåñà
è ïîðòà ñåðâåðà.

	
    

    
	
  • Àäìèíèñòðèðîâàíèå è àíàëèç èíôîðìàöèè

    
	
      
		
    • Ãäå âçÿòü ñâåæóþ âåðñèþ

      
Ñâåæóþ âåðñèþ âñåãäà ìîæíî âçÿòü
çäåñü, îáðàòèòå âíèìàíèå,
÷òî â íîâîé âåðñèè ìîæåò èçìåíèòüñÿ ïîðÿäîê ëèöåíçèðîâàíèÿ èëè êîììàíäû
êîíôèãóðàöèè, ïîýòîìó, ïðåæäå ÷åì óñòàíàâëèâàòü íîâóþ âåðñèè ïðîãðàììû,
îáÿçàòåëüíî îçíàêîìüòåñü ñ äîêóìåíòàöèåé.

      
		
    • Êàê óïðàâëÿòü ñëóæáîé 3proxy â Windows

      
Ïðè óñòàíîâêå 3proxy â êà÷åñòâå ñèñòåìíîé ñëóæáû, ñåðâåðîì ïîääåðæèâàþòñÿ
êîìàíäû çàïóñêà, îñòàíîâêè, âðåìåííîé ïðèîñòàíîâêè è ïðîäîëæåíèÿ.
Ïðè âðåìåííîé ïðèîñòàíîâêå ñåðâåð ïåðåñòàåò ïðèíèìàòü íîâûå çàïðîñû îò,
êëèåíòîâ íî îáðàáîòêà ðàíåå ïîñòóïèâøèõ çàïðîñîâ ïðîäîëæàåòñÿ. Ñåðâåð íå
ïîäåðæèâàåò äèíàìè÷åñêîå èçìåíåíèå êîíôèãóðàöèè, ò.å. ïîñëå èçìåíåíèÿ
êîíôèãóðàöèè 3proxy íåîáõîäèìî ïåðåçàïóñòèòü.
Óïðàâëÿòü çàïóñêîì, îñòàíîâêîé, ïðèîñòàíîâêîé è ïðîäîëæåíèåì ìîæíî ëèáî
÷åðåç ñëóæåáíóþ ïðîãðàììó "Ñëóæáû" (Services) ëèáî ÷åðåç êîìàíäó net:

      	net start 3proxy
	net stop 3proxy
	net pause 3proxy
	net continue 3proxy

      

      
		
    • Êîäû îøèáîê â æóðíàëå

      
	
        
		
      • 0 - îïåðàöèÿ çàâåðøåíà óñïåøíî (â ñëó÷àå óñòàíîâëåííîãî
			ñîåäèíåíèÿ - ñîåäèíåíèå çàêðûòî êîððåêòíî îäíîé èç
			ñòîðîí).
		
      • 1-9 - îøèáêè àâòîðèçàöèè
		
      • 1 - äîñòóï çàêðûò ACL (deny)
		
      • 2 - ïåðåíàïðàâëåíèå (íå äîëæíî áûòü â æóðíàëå)
		
      • 3 - íåò çàïèñè ACL äëÿ äàííîãî ñîåäèíåíèÿ
		
      • 4 - íå îïðåäåëåíî èìÿ ïîëüçîâàòåëÿ äëÿ auth strong
		
      • 5 - íå íàéäåíî èìÿ ïîëüçîâàòåëÿ äëÿ auth strong
		
      • 6 - íåâåðíûé ïàðîëü (îòêðûòûé òåêñò)
		
      • 7 - íåâåðíûé ïàðîëü (crypt)
		
      • 8 - íåâåðíûé ïàðîëü (NT)
		
      • 9 - íåäîñòàòî÷íî äàííûõ äëÿ ïåðåíàïðàâëåíèÿ (íå äîëæíî áûòü â æóðíàëå)
		
      • 10 - ïðåâûøåí ëèìèò òðàôèêà
		
      • 11-19 - îøèáêè ñîåäèíåíèÿ
		
      • 11 - íåâîçìîæíî ñîçäàòü ñîêåò socket()
		
      • 12 - íåâîçìîæíî âûáðàòü èíòåðôåéñ bind()
		
      • 13 - ñáîé ïîäêëþ÷åíèÿ connect()
		
      • 14 - ñáîé getpeername()
		
      • 20-29 - îáùèå îøèáêè
		
      • 21 - îøèáêà âûäåëåíèÿ ïàìÿòè
		
      • 30-39 - îøèáêè ïåðåíàïðàâëåíèÿ CONNECT
		
      • 31 - íåâîçìîæíî ïîñëàòü çàïðîñ ê CONNECT ïðîêñè
		
      • 32 - ïðåâûøåíî îæèäàíèå èëè íåêîððåêòíûé îòâåò CONNECT ïðîêñè
		
      • 33 - CONNECT ïðîêñè íå ìîæåò óñòàíîâèòü ñîåäèíåíèå
		
      • 34 - ïðåâûøåíî îæèäàíèå èëè îáðûâ ñîåäèíåíèÿ ïðè ñîãëàñîâàíèè CONNECT ñîåäèíåíèÿ
		
      • 40-49 - îøèáêè ïåðåíàïðàâëåíèÿ SOCKS4
		
      • 50-69 - îøèáêè ïåðåíàïðàâëåíèÿ SOCKS5
		
      • 70-79 îøèáêè óñòàíîâêè ðîäèòåëüñêîãî ñîåäèíåíèÿ, àíàëîãè÷íû 1x
		
      • 90-99 - îøèáêè ðàçðûâà ñîåäèíåíèÿ
		
      • 90 - ñîåäèíåíèå ïðåðâàíî èç-çà ïðåâûøåíèÿ òðàôèêà
		
      • 91 - ñîåäèíåíèå íåîæèäàííî ïðåðâàííî ñåðâåðîì
		
      • 92 - îøèáêà îòïðàâêè äàííûõ
		
      • 93 - ñîåäèíåíèå íåîæèäàííî ïðåðâàíî êëèåíòîì
		
      • 94 - îøèáêà ñîêåòà
		
      • 97 - èñòåêëî âðåìÿ îæèäàíèÿ
		
      • 98 - èñ÷åðïàí ëèìèò äàííûõ ñåðâåðà (íå äîëæíî áûòü â æóðíàëå)
		
      • 99 - èñ÷åðïàí ëèìèò äàííûõ êëèåíòà (íå äîëæíî áûòü â æóðíàëå)
		
      • 100 - íå íàéäåí IP àäðåñ ïî çàïðîñó êëèåíòà
		
      • 200-299 - îøèáêè UDP portmapper
		
      • 300-399 - îøèáêè TCP portmapper
		
      • 400-499 - îøèáêè SOCKS proxy
		
      • 500-599 - îøèáêè HTTP proxy
		
      • 600-699 - îøèáêè POP3 proxy
		
      • 999 - ôóíêöèÿ íå ðåàëèçîâàíà
	
      

      
	
    

    
	
  • Êàê çàäàòü âîïðîñ, êîòîðîãî íåò â How To?

    
	Çàäàéòå åãî íà ôîðóìå.
	Òîëüêî íå ïûòàéòåñü çàäàâàòü êàêèå-ëèáî âîïðîñû, åñëè âû ïðîñòî íå ïîíÿëè ýòîò
	How To.
                                        


    $Id: howtor.html,v 1.8 2005/04/25 13:58:19 vlad Exp $
    doc/html/index.html0100755002537100244200000000130710245327262013774 0ustar  vladmkgroup3proxy documentation
    3proxy documentation
    
Security recommendations
    
How To (English, very incomplete)
    
How To (Russian, Windows1251)
    
FAQ (Russian, Windows1251)

    Man pages:

    3proxy.8

    ftppr.8

    pop3p.8

    proxy.8

    socks.8

    tcppm.8

    udppm.8

    3proxy.conf.3

doc/html/securityen.html0100755002537100244200000000373110100216013015037 0ustar  vladmkgroup
    3proxy security considirations
    


      

    1. Never install 3proxy suid. If you need it to run suid write some
wrapper with fixed configuration file.

    2. Make configuration file only available to account 3proxy starts with.

    3. Under Windows NT/2000/XP/2003 if 3proxy is used as service create new
unprivileged local account without "logon locally" right. Assign this account
to 3proxy service.

    4. Under unix use chroot to jail 3proxy (make sure files included in
configuration file after 'chroot' command, if any, are available from jail)

    5. Under Unix, either start 3proxy with unprivileged account or, if you need
some privileged ports to be used by 3proxy, use setgid/setuid commands inside
3proxy.cfg immediately after last occurance of service binded to
privileged port in configuration file (setgid must preceed setuid).

    6. Allways use full paths in configuration file

    7. Try to avoid 'strong' authentication, because only cleartext
authentication method is currently available.

    8. Always specify internal and external interfaces for multihomed hosts.

    9. Always limit connections to internal network and localhost (to 127.0.0.1 and
all interfaces) with ACLs. Be carefull, because BIND command in SOCKS requies
BIND method with external interface IP address to be allowed.

    10.  Always use nserver and nscache under Unix, overwise DoS attack is possible
with unreachable DNS server (because gethostbyname will block over threads).

    11. Remember, that 'nbname' authentication is not reliable and can be spoofed.

    12. Keep logs in secure location, because some confidential information from
user's request can be logged.

    13. 3proxy comments out ' (single quote) sign during logging, it helps to
prevent SQL injection bugs. But in case you parse logs from text files be
carefull.

    14. Immediately report all service crashes to developers

    15. Participate in code audit :)

    
 


    


    $Id: securityen.html,v 1.2 2004/07/23 14:09:15 vlad Exp $
    doc/html/man8/3proxy.8.html0100755002537100244200000001435610245327261015151 0ustar  vladmkgroup
Manpage of 3proxy


    3proxy
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

3proxy

- 3[APA3A] tiny proxy server, or trivial proxy server, or free proxy
server
 

    SYNOPSIS
    

3proxy

[config_file]


    

3proxy

[--install]


    

3proxy

[--remove]

 

    DESCRIPTION
    

3proxy

is universal proxy server. It can be used to provide internal users wuth
fully controllable access to external resources or to provide external
users with access to internal resources. 3proxy is not developed to replace
squid(8),

but it can extend functionality of existing cashing proxy.
It can be used to route requests between different types of clients and proxy
servers. Think about it as application level
gateway with configuration like hardware router has for network layer.
It can establish multiple
gateways with HTTP and HTTPS proxy with FTP over HTTP support, SOCKS v4,
v4.5 and v5, POP3 proxy, UDP and TCP portmappers. Each gateway is started
from configuration file like independant service 
proxy(8)

socks(8)

pop3p(8)

tcppm(8)

udppm(8)

ftppr(8)

dnspr

but
3proxy

is not a kind of wrapper or superserver for this daemons. It just has same
code compiled in, but provides much more functionality. SOCKSv5
implementatation allows to use 3proxy with any UDP or TCP based client
applications designed without
proxy support (with
SocksCAP,

FreeCAP

or another client-side redirector under Windows of with socksification library
under Unix). So you can play your favourite games, listen music, exchange
files and messages and even accept incoming connections behind proxy server.

    

dnspr

does not exist like independant service. It' DNS caching proxy (it requires
nscache

and
nserver

to be set in configuration. Curently is does only support for host name
resolution

    

    

Like network router, it supports access control lists (ACL) where source
and destination networks and destination port can be specified. In addition,
usernames and gateway action can be used in ACLs. In order to filter request
on username basis user must be authenticated somehow. There are few
authentication types including password authentication and authentication by
NetBIOS name for Windows clients (it's very like ident authentication).
Depending on ACL action request can be allowed, denied or redirected to another
host or to another proxy server or even to a chain of proxy servers.

    

It supports different types of logging: to logfiles, 
syslog(3)

(only under Unix) or to ODBC database. Logging format is turnable to provide
compatibility with existing log file parsers.
 

    OPTIONS
    


    

    config_file


    
Name of config file. See
3proxy.cfg(3)

for configuration file format. Under Windows, if config_file is not specified,
3proxy

looks for file named
3proxy.cfg

in the default location (in same directory with executable file and in current
directory). Under Unix default location of config file will be
/usr/local/3proxy/3proxy.cfg

(is not currently implemented).

    --install


    
(Windows NT family only) install 
3proxy

as a system service

    --remove


    
(Windows NT family only) remove
3proxy

from system services

    
 

    SIGNALS
    

Under Unix there are few signals
3proxy

catches. See
kill(1).


    

    SIGTERM


    
cleanup connections and exit

    SIGPAUSE


    
stop to accept new connections, on second signal - start and re-read
configuration

    SIGCONT


    
start to accept new conenctions

    SIGUSR1


    
reload configuration

    

    

Under Windows, if
3proxy

is installed as service you can standard service management to start, stop,
pause and continue 3proxy service, for example:

    

net start 3proxy


    

net stop 3proxy


    

net pause 3proxy


    

net continue 3proxy

 

    FILES
    


    

    /usr/local/3proxy/3proxy.cfg (3proxy.cfg)


    
3proxy

configuration file

    
 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy.cfg(3), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8),
kill(1), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    TRIVIA
    

3APA3A is pronounced as ``zaraza''.
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    SIGNALS
    

    FILES
    

    BUGS
    

    SEE ALSO
    

    TRIVIA
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man8/3proxy.conf.3.html0100755002537100244200000006016210156557153016072 0ustar  vladmkgroup
Manpage of 3proxy.conf


    3proxy.conf
    
Section: Universal proxy server
 (5)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

3proxy.conf

- 3proxy configuration file
 

    DESCRIPTION
    



Common structure:

Configuration file is a text file 3proxy reads configuration from. Each line
of the file is command and is executed immediately, as it was given from
console. Each line of the file is treated as a blank (space or tab) separated
command line. Additional space characters are ignored. 
Think about 3proxy as "application level router" with console interface.

Comments:

Any string beginning with space character or '#' character is comment. It's
ignored. <LF>s are ignored. <CR> is end of command.


Quotation:

Quotation character is spaces or another special characters. To use quotation character inside
quotation character must be dubbed (BASIC convention). For example to use
HELLO Good practice is to quote any argument you use.

File inclusion:

You can include file by using $FILENAME macro (replace FILENAME with a path
to file, for example $/usr/local/etc/3proxy/conf.incl or 

     $"c:\Program Files\3proxy\include.cfg" Quotation is
required in last example because path contains space character. 
For included file <CR> (end of line characters) is treated as space character
(arguments delimiter instead of end of command delimiter). 
Thus, include files are only useful to store long signle-line commands
(like userlist, network lists, etc).
To use dollar sign somewhere in argument it must be quoted. 
Recursion is not allowed.

Commands:

proxy

[options]

    

socks

[options]

    

pop3p

[options]

    

ftppr

[options]

    

admin

[options]

    

dnspr

[options]

    

tcppm

[options]
<SRCPORT> <DSTADDR> <DSTPORT>

    

udppm

[options]
<SRCPORT> <DSTADDR> <DSTPORT>

starts gateway services

proxy

- HTTP/HTTPS proxy (default port 3128)

    

socks

- SOCKS 4/4.5/5 proxy (default port 1080)

    

pop3p

- POP3 proxy (default port 110)

    

ftppr

- FTP proxy (default port 21)

    

admin

- Web interface (default port 80)

    

dnspr

- caching DNS proxy (default port 53)

    

tcppm

- TCP portmapper

    

udppm

- UDP portmapper

Options:

    

-pNUMBER

change default server port to NUMBER

    

-n

disable NTLM authentication (required if passwords are stored in Unix crypt format.

    

Also, all options mentioned for 
proxy(8)

socks(8)

pop3p(8)

tcppm(8)

udppm(8)

ftppr(8)

are also supported.

Portmapping services listen at SRCPORT and connect to DSTADDR:DSTPORT
HTTP and SOCKS proxies are standard. 

POP3 proxy must be configured as POP3 server and requires username in the form of:
pop3username@pop3server. If POP3 proxy access must be authenticated, you can
specify username as proxy_username:proxy_password:POP3_username@pop3server

DNS proxy is only capable to resolve hostnames (no MX, PTR, SRV, etc) and
requires nserver/nscache to be configured.

FTP proxy can be used as FTP server in any FTP client or configured as FTP
proxy on a client with FTP proxy support. Username format is one of

     FTPuser@FTPServer

     FTPuser:FTPpassword@FTPserver

     proxyuser:proxypassword:FTPuser:FTPpassword@FTPserver

    

Please note, if you use FTP client interface for FTP proxy
do not add FTPpassword and FTPServer to username, because
FTP client does it for you. That is, if you use 3proxy with
authentication use
proxyuser:proxypassword:FTPuser
as FTP username, otherwise do not change original FTP user name 
    

config

<path>

    

Path to configuration file to use on 3proxy restart or to save configuration.

writable


    

ReOpens configuration file for write access via Web interface,
and re-reads it. Usually should be first command on config file
but in combination with "config" it can be used anywhere to open
alternate config file. Think twice before using it.

end


    

End of configuration

log

[[@|&]logfile] [<LOGTYPE>]

    

sets logfile for all gateways

     @ - (for Unix) use syslog, filename is used as ident name

     & - use ODBC, filename consists of comma-delimited datasource,username,password (username and password are optional)

     LOGTYPE is one of:

      M - Monthly

      W - Weekly (starting from Sunday)

      D - Daily

      H - Hourly
if logfile is not specified logging goes to stdout. You can specify individual logging options for gateway by using
-l option in gateway configuration.

rotate

<n>
how many archived log files to keep

logformat

<format>

Format for log record. First symbol in format must be L (local time)
or G (absolute Grinwitch time). 
It can be preceeded with -XXX+Y where XXX is list of characters to be
filtered in user input (any non-printable characters are filtered too
in this case) and Y is replacement character. For example, "-,%+ L" in
the beginning of logformat means comma and percent are replaced
with space and all time based elemnts are in local time zone.
You can use:


     %y - Year in 2 digit format

     %Y - Year in 4 digit format

     %m - Month number

     %d - Day

     %H - Hour

     %M - Minute

     %S - Second

     %t - Timstamp (in seconds since 01-Jan-1970)

     %. - milliseconds

     %z - timeZone (from Grinvitch)

     %D - request duration (in milliseconds)

     %b - average send rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.

     %B - average receive rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.

     %U - Username

     %N - service Name

     %p - service Port

     %E - Error code

     %C - Client IP

     %c - Client port

     %R - Remote IP

     %r - Remote port

     %n - requested hostname

     %I - bytes In

     %O - bytes Out

     %h - Hops (redirections) count

     %T - service specific Text

     %N1-N2T - (N1 and N2 are positive numbers) - log only fields from N1 thorugh N2 of service specific text
in case of ODBC logging logformat specifies SQL statement, for exmample:

       logformat "-'+_Linsert into log (l_date, l_user, l_service, l_in, l_out, l_descr) values ('%d-%m-%Y %H:%M:%S', '%U', '%N', %I, %O, '%T')"

archiver

<ext> <commandline>

    

Archiver to use for log files. <ext> is file extension produced by
archiver. Filename will be last argument to archiver, optionally you
can use %A as produced archive name and %F as filename.

timeouts

<BYTE_SHORT> <BYTE_LONG> <STRING_SHORT> <STRING_LONG> <CONNECTION_SHORT> <CONNECTION_LONG> <DNS> <CHAIN>
Sets timeout values

     BYTE_SHORT - short timeout for single byte, is usually used for receiving single byte from stream.

     BYTE_LONG - long timeout for single byte, is usually used for receiving first byte in frame (for example first byte in socks request).

     STRING_SHORT - short timeout, for character string within stream (for example to wait between 2 HTTP headers)

     STRING_LONG - long timeout, for first string in stream (for example to wait for HTTP request).

     CONNECTION_SHORT - inactivity timeout for short connections (HTTP, POP3, etc).

     CONNECTION_LONG - inactivity timeout for long connection (SOCKS, portmappers, etc).

     DNS - timeout for DNS request before requesting next server

     CHAIN - timeout for reading data from chained connection

nserver


     <ipaddr>

    

Nameserver to use for name resolutions. If none spcified system
or name server fails system routines for name resolution will be
used. It's better to specify nserver because gethostbyname() may
be thread unsafe.

nscache

<cachesize>

    


Cache <cachesize> records for name resolution. Cachesize usually
should be large enougth (for example 65536).

nsrecord

<hostname> <hostaddr>


Adds static record to nscache. nscache must be enabled. If 0.0.0.0
is used as a hostaddr host will never resolve, it can be used to
blacklist something or together with 
dialer

command to set up UDL for dialing.

dialer

<progname>

    

Execute progname if external name can't be resolved.
Hint: if you use nscache, dialer may not work, because names will
be resolved through cache. In this case you can use something like
http://dial.right.now/ from browser to set up connection.


internal

<ipaddr>

    

sets ip address of internal interface. This IP address will be used
to bind gateways. Alternatively you can use -i option for individual
gateways

external

<ipaddr>

    

sets ip address of external interface. This IP address will be source
address for all connections made by proxy. Alternatively you can use
-e option to specify individual address for gateway.

       
maxconn

<number>

    

sets maximum number of simulationeous connections to each services
started after this command. Default is 100.

service


    

Should be specified to launch as Windows 95/98/NT/2000/XP service, no effect for
Unix.

daemon


    

Should be specified to close console (needn't for service).
At least under FreeBSD 'daemon' should preceed any proxy service
and log commands to avoid sockets problem. Always place it in the beginning
of the configuration file.

auth


    

Type of user authorization. Currently supported:

     none - no authorization required. Note: is auth is none any ip based limitation, redirection, etc will not work. 

     iponly - authorization by source/destination IP and ports. Appropriate for most cases

     nbname - iponly + authorization by NetBIOS name. Messanger
service should be started on user's machine. Note, that
Windows 95/98 hosts do not have messanger service by default,
WinPopup program need to be started.
NB: there is no any password check, name may be spoofed.
Think about it as about ident for Windows.

     Q: Will ident authorization be implemented?

     A: Yes, as soon as it will be required by someone.

     strong - username/password authentication required. It will work with SOCKSv5, FTP, POP3 and HTTP proxy.

allow

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>

    

deny

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>

    

Access control entries. All lists are comma-separated, no spaces are
allowed. Usernames are case sensitive (if used with authtype nbname
username must be in uppercase). Source and target lists may contain
IP addresses (W.X.Y.Z) or CIDRs (W.X.Y.Z/L). Targetportlist may
contain ports (X) or port lists (X-Y).  For any field * sign means "ANY"
    
If access list is empty it's assumed to be

     allow *
If access list is not empty last item in access list is assumed to be

     deny *
You may want explicitly add "deny *" into the end of access list to prevent
HTTP proxy from requesting user's password.
Access lists are checked after user have requested any resource.
If you want 3proxy to reject connections from specific addresses
immediately without any conditions you should either bind proxy
to appropriate interface only or to use ip filters.

Operation is one of:

     CONNECT        - establish outgoing TCP connection
    

     BIND - bind TCP port for listening

     UDPASSOC - make UDP association

     ICMPASSOC - make ICMP association (for future use)

     HTTP_GET - HTTP GET request

     HTTP_PUT - HTTP PUT request

     HTTP_POST - HTTP POST request

     HTTP_HEAD - HTTP HEAD request

     HTTP_CONNECT - HTTP CONNECT request

     HTTP_OTHER - over HTTP request

     HTTP - matches any HTTP request except HTTP_CONNECT

     HTTPS - same as HTTP_CONNECT

     FTP_GET - FTP get request

     FTP_PUT - FTP put request

     FTP_LIST - FTP list request

     FTP - matches any FTP request

Weeksdays are week days numbers or periods (0 or 7 means Sunday, 1 is Monday,
1-5 means Monday through Friday). Timeperiodlists is a list of time
periods in HH:MM:SS-HH:MM:SS format. For example, 

     00:00:00-08:00:00,17:00:00-24:00:00
lists non-working hours.
        
    
parent

<weight> <type> <ip> <port> <username> <password>

    

this command may follow "allow" rule. It extends last allow rule to
build proxy chain. Proxy may be grouped. Proxy inside the
group is selected randomely. If few groups are specified one proxy
is randomely picked from each group and chain of proxies is created
(that is second proxy connected through first one and so on).
Weight is used to group proxies. Weigt is a number between 1 and 1000.
Weights are summed and proxies are grouped together untill weight of
group is 1000. That is:

     allow *

     parent 500 socks5 192.168.10.1 1080

     parent 500 connect 192.168.10.1 3128
makes 3proxy to randomely choose between 2 proxies for all outgoing
connections

     allow * * * 80

     parent 1000 socks5 192.168.10.1 1080

     parent 1000 connect 192.168.20.1 3128

     parent 300 socks4 192.168.30.1 1080

     parent 700 socks5 192.168.40.1 1080
creates chain of 3 proxies: 192.168.10.1, 192.168.20.1 and third
is (192.168.30.1 with probability of 0.3 or 192.168.40.1
with probability of 0.7) for outgoing web connections.

type is one of:

     tcp - simply redirect connection. TCP is always last in chain.

     http - redirect to HTTP proxy. HTTP is always last chain.

     pop3 - redirect to POP3 proxy (only local redirection is supported, can not be
used for chaining)

     ftp - redirect to FTP proxy (only local redirection is supported, can not be
used for chaining)

     connect - parent is HTTP CONNECT method proxy

     socks4 - parent is SOCKSv4 proxy

     socks5 - parent is SOCKSv5 proxy

IP and port are ip addres and port of parent proxy server.
If IP is zero, ip is taken from original request, only port is changed.
If port is zero, it's taken from original request, only IP is changed.
If both IP and port are zero - it's a special case of local redirection,
it works only with

socks
proxy. In case of local redirection request is redirected to different service,

ftppr


pop3p


proxy .


Main purpose of local redirections is to have requested resource
(URL or POP3 username) logged and protocol-specific filters to be applied.
In case of local redirection ACLs are revied twice: first, by SOCKS proxy up to

redirected (HTTP, FTP or POP3) after 'parent' command. It means,
additional 'allow' command is required for redirected requests, for
example:

     allow * * * 80

     parent 1000 http 0.0.0.0 0

     allow * * * 80 HTTP_GET,HTTP_POST

     socks
redirects all SOCKS requests with target port 80 to local HTTP proxy,
local HTTP proxy parses requests and allows only GET and POST requests.

Optional username and password are used to authenticate on parent
proxy. Username of '*' means username must be supplied by user.

bandlimin

<rate> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    

nobandlimin

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    

bandlim sets bandwith limitation filter to <rate> bps (bits per second)
(if you want to specife bytes per second - multiply your value to 8).
bandlim rules act in a same manner as allow/deny rules except
one thing: bandwidth limiting is applied to all services, not to some
specific service. 
bandlimin and nobandlimin applies to incoming traffic
bandlimout and nobandlimout applies to outgoing traffic
If tou want to ratelimit your clients with ip's 192.168.10.16/30 (4
addresses) to 57600 bps you have to specify 4 rules like

     bandlimin 57600 * 192.168.10.16

     bandlimin 57600 * 192.168.10.17

     bandlimin 57600 * 192.168.10.18

     bandlimin 57600 * 192.168.10.19
and every of you clients will have 56K channel. if you specify
    

     bandlimin 57600 * 192.168.10.16/30
you will have 56K channel shared between all clients.
if you want, for example, to limit all speed ecept access to POP3 you can use

     nobandlimin * * * 110
before the rest of bandlim rules.

counter

<filename> <reporttype> <repotname>

    

countin

<number> <type> <limit> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    

nocountin

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    


counter, countin, nocountin commands are used to set traffic limit
in MB for period of time (day, week or month). Filename is a path
to a special file where traffic information is permanently stored.
number is sequential number of record in this file. If number is 0
no traffic information  on this counter is saved in file (that is
if proxy restarted all information is loosed) overwise it should be
unique sequential number.
Type specifies a type of counter. Type is one of:

     D - counter is resetted daily

     W - counter is resetted weekly

     M - counter is resetted monthely
reporttype/repotname may be used to generate traffic reports.
Reporttype is one of D,W,M,H(hourly) and repotname specifies filename
template for reports. Report is text file with counter values in
format:

     <COUNTERNUMBER> <TRAF*4GB> <TRAF>
The rest of parameters is identical to bandlim/nobandlim.

users

username[:pwtype:password] ...

    

pwtype is one of:

     none (empty) - use system authentication

     CL - password is cleartext

     CR - password is crypt-style password

     NT - password is NT password (in hex)
example:

     users test1:CL:password1 "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."

     users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63

    

(note: double quotes are requiered because password contains $ sign).  
    

flush


    

empty active access list. Access list must be flushed avery time you creating
new access list for new service. For example:

     allow *

     pop3p

     flush

     allow * 192.168.1.0/24

     socks
sets different ACLs for
pop3p

and
socks


system


    

execute system command

pidfile

<filename>

    

write pid of current process to file. It can be used to manipulate
3proxy with signals under Unix. Currently next signals are available:

setuid

<uid>

    

calls setuid(uid), uid must be numeric. Unix only.

setgid

<gid>

    

calls setgid(gid), gid must be numeric. Unix only.

chroot

<path>

    

calls chroot(path). Unix only.
 

    SEE ALSO
    

3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    TRIVIA
    

3APA3A is pronounced as ``zaraza''.
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    DESCRIPTION
    

    SEE ALSO
    

    TRIVIA
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, December 11, 2004


doc/html/man8/ftppr.8.html0100755002537100244200000000647110245327261015037 0ustar  vladmkgroup
Manpage of ftppr


    ftppr
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

ftppr

- FTP proxy gateway service
 

    SYNOPSIS
    

ftppr [-d]

[-l[[@]logfile]]

[-pport]

[-iinternal_ip]

[-eexternal_ip]

 

    DESCRIPTION
    

ftppr

is FTP gateway service to allow internal users to access external FTP
servers.
 

    OPTIONS
    


    

    -d


    
Daemonise. Detach service from console and run in the background.

    -e


    
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.

    -i


    
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It's usually unsafe.

    -p


    
Port. Port proxy listens for incoming connections. Default is 21.

    -l


    
Log. By default logging is to stdout. If
logfile

is specified logging is to file. Under Unix, if
'@'

preceeds
logfile,

syslog is used for logging.

    
 

    CLIENTS
    

You can use any FTP client, regardless of FTP proxy support. For client with
FTP proxy support configure
internal_ip

and
port

in FTP proxy parameters.
For clients without FTP proxy support use
internal_ip

and
port

as FTP server. Address of real FTP server must be configured as a part of
FTP username. Format for username is
username@server,

where
server

is address of FTP server and
username

is user's login on this FTP server. Login itself may contain '@' sign.
Only cleartext authentication is currently supported.
 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy(8), proxy(8), pop3p(8), socks(8), tcppm(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    CLIENTS
    

    BUGS
    

    SEE ALSO
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man8/pop3p.8.html0100755002537100244200000000627610245327261014750 0ustar  vladmkgroup
Manpage of pop3p


    pop3p
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

pop3p

- POP3 proxy gateway service
 

    SYNOPSIS
    

pop3p [-d]

[-l[[@]logfile]]

[-pport]

[-iinternal_ip]

[-eexternal_ip]

 

    DESCRIPTION
    

pop3p

is POP3 gateway service to allow internal users to access external POP3
servers.
 

    OPTIONS
    


    

    -d


    
Daemonise. Detach service from console and run in the background.

    -e


    
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.

    -i


    
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It's usually unsafe.

    -p


    
Port. Port proxy listens for incoming connections. Default is 110.

    -l


    
Log. By default logging is to stdout. If
logfile

is specified logging is to file. Under Unix, if
'@'

preceeds
logfile,

syslog is used for logging.

    
 

    CLIENTS
    

You can use any MUA (Mail User Agent) with POP3 support. Set client to use
internal_ip

and
port

as a POP3 server. Address of real POP3 server must be configured as a part of
POP3 username. Format for username is
username@server,

where
server

is address of POP3 server and
username

is user's login on this POP3 server. Login itself may contain '@' sign.
Only cleartext authentication is currently supported.
 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy(8), ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    CLIENTS
    

    BUGS
    

    SEE ALSO
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man8/proxy.8.html0100755002537100244200000000620410245327261015057 0ustar  vladmkgroup
Manpage of proxy


    proxy
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

proxy

- HTTP proxy gateway service
 

    SYNOPSIS
    

proxy [-d][-a]

[-l[[@]logfile]]

[-pport]

[-iinternal_ip]

[-eexternal_ip]

 

    DESCRIPTION
    

proxy

is HTTP gateway service with HTTPS and FTP over HTTPS support.
 

    OPTIONS
    


    

    -d


    
Daemonise. Detach service from console and run in the background.

    -e


    
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.

    -i


    
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It's usually unsafe.

    -a


    
Anonymous. Hide information about client.

    -p


    
Port. Port proxy listens for incoming connections. Default is 3128.

    -l


    
Log. By default logging is to stdout. If
logfile

is specified logging is to file. Under Unix, if
'@'

preceeds
logfile,

syslog is used for logging.

    
 

    CLIENTS
    

You should use client with HTTP proxy support or configure router to redirect
HTTP traffic to proxy (transparent proxy). Configure client to connect to
internal_ip

and
port.

HTTPS support allows to use almost any TCP based protocol. If you need to
limit clients, use 
3proxy(8)

instead.
 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    CLIENTS
    

    BUGS
    

    SEE ALSO
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man8/socks.8.html0100755002537100244200000000657510245327262015034 0ustar  vladmkgroup
Manpage of socks


    socks
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

socks

- SOCKS 4/4.5/5 gateway service
 

    SYNOPSIS
    

socks [-d]

[-l[[@]logfile]]

[-pport]

[-iinternal_ip]

[-eexternal_ip]

 

    DESCRIPTION
    

socks

is SOCKS server. It supports SOCKSv4, SOCKSv4.5 (extension to v4 for
server side name resolution) and SOCKSv5. SOCKSv5 specification allows both
outgoing and reverse TCP connections and UDP portmapping.
 

    OPTIONS
    


    

    -d


    
Daemonise. Detach service from console and run in the background.

    -e


    
External address. IP address of interface proxy should initiate connections
from. External IP must be specified if you need incoming connections.
By default system will deside which address to use in accordance
with routing table.

    -i


    
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It's usually unsafe.

    -p


    
Port. Port proxy listens for incoming connections. Default is 1080.

    -l


    
Log. By default logging is to stdout. If
logfile

is specified logging is to file. Under Unix, if
'@'

preceeds
logfile,

syslog is used for logging.

    
 

    CLIENTS
    

You should use client with SOCKS support or use some socksification support
(for example
SocksCAP

or
FreeCAP).

Configure client to use
internal_ip

and
port.

SOCKS allows to use almost any application protocol without limitation. This
implementation also allows to open priviledged port on server (if socks has
sufficient privileges). If you need to control access use
3proxy(8)

instead.
 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy(8), proxy(8), ftppr(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    CLIENTS
    

    BUGS
    

    SEE ALSO
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man8/tcppm.8.html0100755002537100244200000000620310245327262015021 0ustar  vladmkgroup
Manpage of tcppm


    tcppm
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

tcppm

- TCP port mapper
 

    SYNOPSIS
    

tcppm [-d]

[-l[[@]logfile]]

[-iinternal_ip]

[-eexternal_ip]

local_port remote_host remote_port

 

    DESCRIPTION
    

tcppm

forwards connections from local to remote TCP port
 

    OPTIONS
    


    

    -d


    
Daemonise. Detach service from console and run in the background.

    -e


    
External address. IP address of interface proxy should initiate connections
from. 
By default system will deside which address to use in accordance
with routing table.

    -i


    
Internal address. IP address proxy accepts connections to.
By default connection to any interface is accepted. It's usually unsafe.

    -l


    
Log. By default logging is to stdout. If
logfile

is specified logging is to file. Under Unix, if
'@'

preceeds
logfile,

syslog is used for logging.

    
 

    ARGUMENTS
    


    

    local_port


    
- port tcppm accepts connection

    remote_host


    
- IP address of the host connection is forwarded to

    remote_port


    
- remote port connection is forwarded to

    
 

    CLIENTS
    

Any TCP based application can be used as a client. Use
internal_ip

and
local_port

as a destination in client application. Connection is forwarded to
remote_host:remote_port

 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    ARGUMENTS
    

    CLIENTS
    

    BUGS
    

    SEE ALSO
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man8/udppm.8.html0100755002537100244200000000662510245327262015033 0ustar  vladmkgroup
Manpage of udppm


    udppm
    
Section: Universal proxy server (8)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

udppm

- UDP port mapper
 

    SYNOPSIS
    

pop3p [-ds]

[-l[[@]logfile]]

[-iinternal_ip]

[-eexternal_ip]

local_port remote_host remote_port

 

    DESCRIPTION
    

udppm

forwards datagrams from local to remote UDP port
 

    OPTIONS
    


    

    -d


    
Daemonise. Detach service from console and run in the background.

    -e


    
External address. IP address of interface proxy should initiate datagrams
from. 
By default system will deside which address to use in accordance
with routing table.

    -i


    
Internal address. IP address proxy accepts datagrams to.
By default connection to any interface is accepted. It's usually unsafe.

    -l


    
Log. By default logging is to stdout. If
logfile

is specified logging is to file. Under Unix, if
'@'

preceeds
logfile,

syslog is used for logging.

    -s


    
Single packet. By default only one client can use udppm service, but
if -s is specified only one packet will be forwarded between client and server.
It allows to share service between multiple clients for single packet services
(for example name lookups).

    
 

    ARGUMENTS
    


    

    local_port


    
- port udppm accepts datagrams

    remote_host


    
- IP address of the host datagrams are forwarded to

    remote_port


    
- remote port datagrams are forwarded to

    
 

    CLIENTS
    

Any UDP based application can be used as a client. Use
internal_ip

and
local_port

as a destination in client application. All datagrams are forwarded to
remote_host:remote_port

 

    BUGS
    

Report all bugs to
3proxy@security.nnov.ru

 

    SEE ALSO
    

3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    SYNOPSIS
    

    DESCRIPTION
    

    OPTIONS
    

    ARGUMENTS
    

    CLIENTS
    

    BUGS
    

    SEE ALSO
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


doc/html/man3/3proxy.conf.3.html0100755002537100244200000006045010245327262016060 0ustar  vladmkgroup
Manpage of 3proxy.conf


    3proxy.conf
    
Section: Universal proxy server
 (5)
    Updated: December 2004
    Index
Return to Main Contents
    

 

    NAME
    

3proxy.conf

- 3proxy configuration file
 

    DESCRIPTION
    



Common structure:

Configuration file is a text file 3proxy reads configuration from. Each line
of the file is command and is executed immediately, as it was given from
console. Each line of the file is treated as a blank (space or tab) separated
command line. Additional space characters are ignored. 
Think about 3proxy as "application level router" with console interface.

Comments:

Any string beginning with space character or '#' character is comment. It's
ignored. <LF>s are ignored. <CR> is end of command.


Quotation:

Quotation character is spaces or another special characters. To use quotation character inside
quotation character must be dubbed (BASIC convention). For example to use
HELLO Good practice is to quote any argument you use.

File inclusion:

You can include file by using $FILENAME macro (replace FILENAME with a path
to file, for example $/usr/local/etc/3proxy/conf.incl or 

     $"c:\Program Files\3proxy\include.cfg" Quotation is
required in last example because path contains space character. 
For included file <CR> (end of line characters) is treated as space character
(arguments delimiter instead of end of command delimiter). 
Thus, include files are only useful to store long signle-line commands
(like userlist, network lists, etc).
To use dollar sign somewhere in argument it must be quoted. 
Recursion is not allowed.

Commands:

proxy

[options]

    

socks

[options]

    

pop3p

[options]

    

ftppr

[options]

    

admin

[options]

    

dnspr

[options]

    

tcppm

[options]
<SRCPORT> <DSTADDR> <DSTPORT>

    

udppm

[options]
<SRCPORT> <DSTADDR> <DSTPORT>

starts gateway services

proxy

- HTTP/HTTPS proxy (default port 3128)

    

socks

- SOCKS 4/4.5/5 proxy (default port 1080)

    

pop3p

- POP3 proxy (default port 110)

    

ftppr

- FTP proxy (default port 21)

    

admin

- Web interface (default port 80)

    

dnspr

- caching DNS proxy (default port 53)

    

tcppm

- TCP portmapper

    

udppm

- UDP portmapper

Options:

    

-pNUMBER

change default server port to NUMBER

    

-n

disable NTLM authentication (required if passwords are stored in Unix crypt format.

    

Also, all options mentioned for 
proxy(8)

socks(8)

pop3p(8)

tcppm(8)

udppm(8)

ftppr(8)

are also supported.

Portmapping services listen at SRCPORT and connect to DSTADDR:DSTPORT
HTTP and SOCKS proxies are standard. 

POP3 proxy must be configured as POP3 server and requires username in the form of:
pop3username@pop3server. If POP3 proxy access must be authenticated, you can
specify username as proxy_username:proxy_password:POP3_username@pop3server

DNS proxy is only capable to resolve hostnames (no MX, PTR, SRV, etc) and
requires nserver/nscache to be configured.

FTP proxy can be used as FTP server in any FTP client or configured as FTP
proxy on a client with FTP proxy support. Username format is one of

     FTPuser@FTPServer

     FTPuser:FTPpassword@FTPserver

     proxyuser:proxypassword:FTPuser:FTPpassword@FTPserver

    

Please note, if you use FTP client interface for FTP proxy
do not add FTPpassword and FTPServer to username, because
FTP client does it for you. That is, if you use 3proxy with
authentication use
proxyuser:proxypassword:FTPuser
as FTP username, otherwise do not change original FTP user name 
    

include

<path>

    

Include config file

config

<path>

    

Path to configuration file to use on 3proxy restart or to save configuration.

writable


    

ReOpens configuration file for write access via Web interface,
and re-reads it. Usually should be first command on config file
but in combination with "config" it can be used anywhere to open
alternate config file. Think twice before using it.

end


    

End of configuration

log

[[@|&]logfile] [<LOGTYPE>]

    

sets logfile for all gateways

     @ - (for Unix) use syslog, filename is used as ident name

     & - use ODBC, filename consists of comma-delimited datasource,username,password (username and password are optional)

     LOGTYPE is one of:

      M - Monthly

      W - Weekly (starting from Sunday)

      D - Daily

      H - Hourly
if logfile is not specified logging goes to stdout. You can specify individual logging options for gateway by using
-l option in gateway configuration.

rotate

<n>
how many archived log files to keep

logformat

<format>

Format for log record. First symbol in format must be L (local time)
or G (absolute Grinwitch time). 
It can be preceeded with -XXX+Y where XXX is list of characters to be
filtered in user input (any non-printable characters are filtered too
in this case) and Y is replacement character. For example, "-,%+ L" in
the beginning of logformat means comma and percent are replaced
with space and all time based elemnts are in local time zone.
You can use:


     %y - Year in 2 digit format

     %Y - Year in 4 digit format

     %m - Month number

     %d - Day

     %H - Hour

     %M - Minute

     %S - Second

     %t - Timstamp (in seconds since 01-Jan-1970)

     %. - milliseconds

     %z - timeZone (from Grinvitch)

     %D - request duration (in milliseconds)

     %b - average send rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.

     %B - average receive rate per request (in Bytes per second) this speed is typically below connection speed shown by download manager.

     %U - Username

     %N - service Name

     %p - service Port

     %E - Error code

     %C - Client IP

     %c - Client port

     %R - Remote IP

     %r - Remote port

     %n - requested hostname

     %I - bytes In

     %O - bytes Out

     %h - Hops (redirections) count

     %T - service specific Text

     %N1-N2T - (N1 and N2 are positive numbers) - log only fields from N1 thorugh N2 of service specific text
in case of ODBC logging logformat specifies SQL statement, for exmample:

       logformat "-'+_Linsert into log (l_date, l_user, l_service, l_in, l_out, l_descr) values ('%d-%m-%Y %H:%M:%S', '%U', '%N', %I, %O, '%T')"

archiver

<ext> <commandline>

    

Archiver to use for log files. <ext> is file extension produced by
archiver. Filename will be last argument to archiver, optionally you
can use %A as produced archive name and %F as filename.

timeouts

<BYTE_SHORT> <BYTE_LONG> <STRING_SHORT> <STRING_LONG> <CONNECTION_SHORT> <CONNECTION_LONG> <DNS> <CHAIN>
Sets timeout values

     BYTE_SHORT - short timeout for single byte, is usually used for receiving single byte from stream.

     BYTE_LONG - long timeout for single byte, is usually used for receiving first byte in frame (for example first byte in socks request).

     STRING_SHORT - short timeout, for character string within stream (for example to wait between 2 HTTP headers)

     STRING_LONG - long timeout, for first string in stream (for example to wait for HTTP request).

     CONNECTION_SHORT - inactivity timeout for short connections (HTTP, POP3, etc).

     CONNECTION_LONG - inactivity timeout for long connection (SOCKS, portmappers, etc).

     DNS - timeout for DNS request before requesting next server

     CHAIN - timeout for reading data from chained connection

nserver


     <ipaddr>

    

Nameserver to use for name resolutions. If none spcified system
or name server fails system routines for name resolution will be
used. It's better to specify nserver because gethostbyname() may
be thread unsafe.

nscache

<cachesize>

    


Cache <cachesize> records for name resolution. Cachesize usually
should be large enougth (for example 65536).

nsrecord

<hostname> <hostaddr>


Adds static record to nscache. nscache must be enabled. If 0.0.0.0
is used as a hostaddr host will never resolve, it can be used to
blacklist something or together with 
dialer

command to set up UDL for dialing.

fakeresolve



All names are resolved to 127.0.0.2 address. Usefull if all requests are
redirected to parent proxy.

dialer

<progname>

    

Execute progname if external name can't be resolved.
Hint: if you use nscache, dialer may not work, because names will
be resolved through cache. In this case you can use something like
http://dial.right.now/ from browser to set up connection.


internal

<ipaddr>

    

sets ip address of internal interface. This IP address will be used
to bind gateways. Alternatively you can use -i option for individual
gateways

external

<ipaddr>

    

sets ip address of external interface. This IP address will be source
address for all connections made by proxy. Alternatively you can use
-e option to specify individual address for gateway.

       
maxconn

<number>

    

sets maximum number of simulationeous connections to each services
started after this command. Default is 100.

service


    

Should be specified to launch as Windows 95/98/NT/2000/XP service, no effect for
Unix.

daemon


    

Should be specified to close console (needn't for service).
At least under FreeBSD 'daemon' should preceed any proxy service
and log commands to avoid sockets problem. Always place it in the beginning
of the configuration file.

auth


    

Type of user authorization. Currently supported:

     none - no authorization required. Note: is auth is none any ip based limitation, redirection, etc will not work. 

     iponly - authorization by source/destination IP and ports. Appropriate for most cases

     nbname - iponly + authorization by NetBIOS name. Messanger
service should be started on user's machine. Note, that
Windows 95/98 hosts do not have messanger service by default,
WinPopup program need to be started.
NB: there is no any password check, name may be spoofed.
Think about it as about ident for Windows.

     Q: Will ident authorization be implemented?

     A: Yes, as soon as it will be required by someone.

     strong - username/password authentication required. It will work with SOCKSv5, FTP, POP3 and HTTP proxy.

allow

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>

    

deny

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>
<weekdayslist> <timeperiodslist>

    

Access control entries. All lists are comma-separated, no spaces are
allowed. Usernames are case sensitive (if used with authtype nbname
username must be in uppercase). Source and target lists may contain
IP addresses (W.X.Y.Z) or CIDRs (W.X.Y.Z/L). Targetportlist may
contain ports (X) or port lists (X-Y).  For any field * sign means "ANY"
    
If access list is empty it's assumed to be

     allow *
If access list is not empty last item in access list is assumed to be

     deny *
You may want explicitly add "deny *" into the end of access list to prevent
HTTP proxy from requesting user's password.
Access lists are checked after user have requested any resource.
If you want 3proxy to reject connections from specific addresses
immediately without any conditions you should either bind proxy
to appropriate interface only or to use ip filters.

Operation is one of:

     CONNECT        - establish outgoing TCP connection
    

     BIND - bind TCP port for listening

     UDPASSOC - make UDP association

     ICMPASSOC - make ICMP association (for future use)

     HTTP_GET - HTTP GET request

     HTTP_PUT - HTTP PUT request

     HTTP_POST - HTTP POST request

     HTTP_HEAD - HTTP HEAD request

     HTTP_CONNECT - HTTP CONNECT request

     HTTP_OTHER - over HTTP request

     HTTP - matches any HTTP request except HTTP_CONNECT

     HTTPS - same as HTTP_CONNECT

     FTP_GET - FTP get request

     FTP_PUT - FTP put request

     FTP_LIST - FTP list request

     FTP - matches any FTP request

Weeksdays are week days numbers or periods (0 or 7 means Sunday, 1 is Monday,
1-5 means Monday through Friday). Timeperiodlists is a list of time
periods in HH:MM:SS-HH:MM:SS format. For example, 

     00:00:00-08:00:00,17:00:00-24:00:00
lists non-working hours.
        
    
parent

<weight> <type> <ip> <port> <username> <password>

    

this command may follow "allow" rule. It extends last allow rule to
build proxy chain. Proxy may be grouped. Proxy inside the
group is selected randomely. If few groups are specified one proxy
is randomely picked from each group and chain of proxies is created
(that is second proxy connected through first one and so on).
Weight is used to group proxies. Weigt is a number between 1 and 1000.
Weights are summed and proxies are grouped together untill weight of
group is 1000. That is:

     allow *

     parent 500 socks5 192.168.10.1 1080

     parent 500 connect 192.168.10.1 3128
makes 3proxy to randomely choose between 2 proxies for all outgoing
connections

     allow * * * 80

     parent 1000 socks5 192.168.10.1 1080

     parent 1000 connect 192.168.20.1 3128

     parent 300 socks4 192.168.30.1 1080

     parent 700 socks5 192.168.40.1 1080
creates chain of 3 proxies: 192.168.10.1, 192.168.20.1 and third
is (192.168.30.1 with probability of 0.3 or 192.168.40.1
with probability of 0.7) for outgoing web connections.

type is one of:

     tcp - simply redirect connection. TCP is always last in chain.

     http - redirect to HTTP proxy. HTTP is always last chain.

     pop3 - redirect to POP3 proxy (only local redirection is supported, can not be
used for chaining)

     ftp - redirect to FTP proxy (only local redirection is supported, can not be
used for chaining)

     connect - parent is HTTP CONNECT method proxy

     socks4 - parent is SOCKSv4 proxy

     socks5 - parent is SOCKSv5 proxy

IP and port are ip addres and port of parent proxy server.
If IP is zero, ip is taken from original request, only port is changed.
If port is zero, it's taken from original request, only IP is changed.
If both IP and port are zero - it's a special case of local redirection,
it works only with

socks
proxy. In case of local redirection request is redirected to different service,

ftppr


pop3p


proxy .


Main purpose of local redirections is to have requested resource
(URL or POP3 username) logged and protocol-specific filters to be applied.
In case of local redirection ACLs are revied twice: first, by SOCKS proxy up to

redirected (HTTP, FTP or POP3) after 'parent' command. It means,
additional 'allow' command is required for redirected requests, for
example:

     allow * * * 80

     parent 1000 http 0.0.0.0 0

     allow * * * 80 HTTP_GET,HTTP_POST

     socks
redirects all SOCKS requests with target port 80 to local HTTP proxy,
local HTTP proxy parses requests and allows only GET and POST requests.

Optional username and password are used to authenticate on parent
proxy. Username of '*' means username must be supplied by user.

bandlimin

<rate> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    

nobandlimin

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    

bandlim sets bandwith limitation filter to <rate> bps (bits per second)
(if you want to specife bytes per second - multiply your value to 8).
bandlim rules act in a same manner as allow/deny rules except
one thing: bandwidth limiting is applied to all services, not to some
specific service. 
bandlimin and nobandlimin applies to incoming traffic
bandlimout and nobandlimout applies to outgoing traffic
If tou want to ratelimit your clients with ip's 192.168.10.16/30 (4
addresses) to 57600 bps you have to specify 4 rules like

     bandlimin 57600 * 192.168.10.16

     bandlimin 57600 * 192.168.10.17

     bandlimin 57600 * 192.168.10.18

     bandlimin 57600 * 192.168.10.19
and every of you clients will have 56K channel. if you specify
    

     bandlimin 57600 * 192.168.10.16/30
you will have 56K channel shared between all clients.
if you want, for example, to limit all speed ecept access to POP3 you can use

     nobandlimin * * * 110
before the rest of bandlim rules.

counter

<filename> <reporttype> <repotname>

    

countin

<number> <type> <limit> <userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    

nocountin

<userlist> <sourcelist> <targetlist> <targetportlist> <operationlist>

    


counter, countin, nocountin commands are used to set traffic limit
in MB for period of time (day, week or month). Filename is a path
to a special file where traffic information is permanently stored.
number is sequential number of record in this file. If number is 0
no traffic information  on this counter is saved in file (that is
if proxy restarted all information is loosed) overwise it should be
unique sequential number.
Type specifies a type of counter. Type is one of:

     D - counter is resetted daily

     W - counter is resetted weekly

     M - counter is resetted monthely
reporttype/repotname may be used to generate traffic reports.
Reporttype is one of D,W,M,H(hourly) and repotname specifies filename
template for reports. Report is text file with counter values in
format:

     <COUNTERNUMBER> <TRAF*4GB> <TRAF>
The rest of parameters is identical to bandlim/nobandlim.

users

username[:pwtype:password] ...

    

pwtype is one of:

     none (empty) - use system authentication

     CL - password is cleartext

     CR - password is crypt-style password

     NT - password is NT password (in hex)
example:

     users test1:CL:password1 "test2:CR:$1$lFDGlder$pLRb4cU2D7GAT58YQvY49."

     users test3:NT:BD7DFBF29A93F93C63CB84790DA00E63

    

(note: double quotes are requiered because password contains $ sign).  
    

flush


    

empty active access list. Access list must be flushed avery time you creating
new access list for new service. For example:

     allow *

     pop3p

     flush

     allow * 192.168.1.0/24

     socks
sets different ACLs for
pop3p

and
socks


system


    

execute system command

pidfile

<filename>

    

write pid of current process to file. It can be used to manipulate
3proxy with signals under Unix. Currently next signals are available:

setuid

<uid>

    

calls setuid(uid), uid must be numeric. Unix only.

setgid

<gid>

    

calls setgid(gid), gid must be numeric. Unix only.

chroot

<path>

    

calls chroot(path). Unix only.
 

    SEE ALSO
    

3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),

    

http://www.security.nnov.ru/soft/3proxy/
 

    TRIVIA
    

3APA3A is pronounced as ``zaraza''.
 

    AUTHORS
    

3proxy is designed by 3APA3A
(3APA3A@security.nnov.ru),

Vladimir Dubrovin
(vlad@sandy.ru)


    


    
 
    Index
    

    

    NAME
    

    DESCRIPTION
    

    SEE ALSO
    

    TRIVIA
    

    AUTHORS
    

    

    
This document was created by
using the manual pages.
    
Time:  GMT, May 26, 2005


License0100755002537100244200000000237710067060706011602 0ustar  vladmkgroup3proxy 0.5 Public License Agreement

This software provided "as is" without any guaranties or support.

This software is FREEWARE. You can use it under terms of current version
of GNU GPL (General Public License) available from 
http://www.gnu.org/licenses/gpl.txt or under conditions below:

1. You are granted non-exclusive rights to compile, modify, use and
re-distribute this program.
2. In case this software is redistributed in binary form, source code
MUST be available for user for free.
3. In case this software redistributed embedded in hardware device or
pre-installed version of operation system and source code is not available,
documentation MUST refer to http://www.security.nnov.ru/ as a source of
software.
4. In case this software is modified or is used as a part of another project
license MUST NOT be modified.
5. Authors of this software MAY change terms of this license for future
versions of this product.

(c) 2000-2004 by 3APA3A (3APA3A@security.nnov.ru)
(c) 2000-2004 by SECURITY.NNOV (http://www.security.nnov.ru)
(c) 2000-2004 by Vladimir Dubrovin (vlad@sandy.ru)


This software uses:
  RSA Data Security, Inc. MD4 Message-Digest Algorithm
  RSA Data Security, Inc. MD5 Message-Digest Algorithm

$Id: License,v 1.1.1.1 2004/06/25 17:32:54 vlad Exp $
Readme0100755002537100244200000000416210233173567011414 0ustar  vladmkgroup/*
   3APA3A 3proxy tiny proxy server
   (c) 2002 by ZARAZA <3APA3A@security.nnov.ru>

   please read License Agreement

   $Id: Readme,v 1.5 2005/04/25 13:58:15 vlad Exp $
*/

Please read doc/config.txt
	    doc/html/index.html

3proxy    	Combined proxy server may be used as Windows 95/98/NT/2000/XP
		executable or Windows NT/2000/XP service (supports
		installation and removal). It uses config file to read
		it's configuration (see 3proxy.cfg.sample for details).
		--install installs and starts proxy as NT/2000/XP service
		(config file should be located in the same directory)
		--remove removes the service (should be stopped before via
		net stop 3proxy).
		3proxy.exe is all-in-one, it doesn't require all others .exe
		to work.
		See 3proxy.cfg.sample for configuration manual and examples
proxy    	HTTP proxy server, binds to port 3128
ftppr    	FTP proxy server, binds to port 21
socks    	SOCKS 4/5 proxy server, binds to port 1080
pop3p    	POP3 proxy server, binds to port 110. You must specify
		POP3 username as username@target.host.ip[:port]
		port is 110 by default.
		Exmple: in Username configuration for you e-mail reader
		set someuser@pop.somehost.ru, to obtains mail for someuser
		from pop.somehost.ru via proxy.
tcppm    	TCP port mapping. Maps some TCP port on local machine to
		TCP port on remote host.
udppm    	UDP port mapping. Maps some UDP port on local machine to
		UDP port on remote machine. Only one user simulationeously
		can use UDP mapping, so it cann't be used for public service
		in large networks. It's OK to use it to map to DNS server
		in small network or to map Counter-Strike server for single
		client (you can use few mappings on different ports for
		different clients in last case).
mycrypt    	Program to obtain crypted password fro cleartext. Supports
		both MD5/crypt and NT password.
			mycrypt password
		produces NT password
			mycrypt salt password
		produces MD5/crypt password with salt "salt".
dighosts    	Utility for building networks list from web page.


Run utility with --help option to obtain command line reference.

Latest version is available from http://www.security.nnov.ru/soft
Release.notes0100755002537100244200000000641210245106311012710 0ustar  vladmkgroup11/12/2004 3[APA3A]tiny proxy 0.5.1b
Bugfix release (see Changelog).

11/12/2004 3[APA3A]tiny proxy 0.5b
New features marked with !.

 Features:
  1. General
	+ HTTP/1.1 Proxy with keep-alive client and server support,
          transparent proxy support.
	+ FTP over HTTP support.
	+ DNS caching with built-in resolver
	+ HTTPS (CONNECT) proxy
	+ SOCKSv4/4.5 Proxy
	+ SOCKSv5 Proxy
	! UDP and bind support for SOCKSv5 (fully compatible with
	  SocksCAP/FreeCAP for UDP)
	+ Transparent SOCKS->HTTP redirection
	! Transparent SOCKS->FTP redirection
	! Transparent SOCKS->POP3 redirection
	+ POP3 Proxy
	! FTP proxy
	! DNS proxy
	+ TCP port mapper
	+ UDP port mapper
	+ Threaded application (no child process).
	! Web administration and statistics
  2. Proxy chaining
	+ Parent proxy support for any type of incoming connection
	+ Username/password authentication for parent proxy(s).
	+ HTTPS/SOCKS4/SOCKS5 and redirection parent support
	+ Random parent selection
	+ Chain building (multihop proxing)
  3. Logging
	+ turnable log format compatible with any log parser
	+ stdout logging
	+ file logging
	+ syslog logging (Unix)
	+ ODBC logging (Windows and Unix)
	+ log file rotation (hourly, daily, weekly, monthly)
	+ automatic log file comperssion with external archiver (for files)
	+ automatic removal of older log files
	! Character filtering for log files
	! different log files for different servces are supported
  4. Access control
	+ ACL-driven (user/source/destination/protocol/weekday/daytime or
	combined) bandwith limitation
	+ ACL-driven (user/source/destination/protocol/weekday/daytime or
	combined) traffic limitation per day, week or month
	+ User authorization by NetBIOS messanger name
	+ Access control by username, source IP, destination IP, destination
	port and destination action (POST, PUT, GET, etc), weekday and daytime.
	+ Access control by username/password for SOCKSv5 and HTTP/HTTPS/FTP
	+ Cleartext or encrypted (crypt/MD5 or NT) passwords.
	+ Connection redirection
	+ Access control by requested action (CONNECT/BIND, 
	  HTTP GET/POST/PUT/HEAD/OTHER).
	! NTLM authentication for HTTP proxy access
	! All access controle entries now support weekday and daytime
	limitations.
  5. Configuration
	+ support for configuration files
	+ support for includes in configuration files
	+ interface binding
	+ running as daemon process
	+ utility for automated networks list building
     Unix
	+ support for chroot
	+ support for setgid
	+ support for setuid
	! support for signals
     Windows NT/2K/XP/2K3
	+ support --install as service
	+ support --remove as service
	+ support for service START, STOP, PAUSE and CONTINUE commands (on
	PAUSE no new connection accepted, but active connections still in
	progress, on CONTINUE configuration is reloaded)
     Windows 95/98/ME
	! support --install as service
	! support --remove as service
  6. Compilation
	+ MSVC (msvcrt.dll)
	+ Intel Windows Compiler (msvcrt.dll)
	+ Windows/gcc (msvcrt.dll)
	+ Cygwin/gcc (cygwin.dll)
	+ Unix/gcc
	+ Unix/ccc

 Known bugs:

	report to 3proxy@security.nnov.ru

 Planned for future (0.6) release:
   - External modules API
   - Addon URL, antiviral, HTTP cache filters modules, authentication
     modules for different protocols (RADIUS, PAM, integrated system, etc).

$Id: Release.notes,v 1.5 2004/12/11 11:47:52 vlad Exp $Changelog0100755002537100244200000011551010245106617012101 0ustar  vladmkgroup25.05.2005
+ 'Y' (annually) option added to counters, logfile rotations, etc
+ -a (anonymous) option added to proxy server

21.05.2005
! socks: only allow UDP mapping from same IP with control connection
! socks: always log network parameters for control connection
! check timeout to be below 2000000

20.05.2005
! invalid sendto() argument fixed (may affect UDP mapping and sometimes
  TCP under very rare configurations)
! set sasize before sendto
! socks checks requested address to be non-zero
! socks checks requested port to be non-zero
! socks: do not change UDP client parameters before UDP packet received

19.05.2005
+ 'include' command added to 3proxy (include one config file from another
   config file)
! handle EAGAIN on send()/recv()

18.05.2005
! More detailed problem code in mapping code

17.05.2005
! Fixed typo with dnspr logging

16.05.2005
+ dnspr can now resolve records different from hostname (request is proxied to
  first DNS server in the list, reply is not cached).

14.05.2005
! Fixed: mishandled socket error in dnspr code

13.05.2005
! Few minor fixes in HTTP proxy code (timeout in initial handshake lefts
  some garbage in request buffer).
! Fixed short timeout in FTP proxy code
! Mapping code is changed to leave unsent data on buffer

06.05.2005
! Prevent race conditions with 100% CPU usage in socksmap (introduced 30.04)

03.05.2005
! Fixed: double free() in authentication (probably introduced on 04.04)
! Changed to POLLIN/POLLOUT/POLLPRI for more compatibility

30.04.2005
! Fixed: double free() in FTP over HTTP (probably introduced on 04.04)
! Fixed: in very rare situation may loose some data at the and of connection

27.04.2005
! stack size increased (reported problems under some OSs)
! Fixed: -l option for service executable leads to NULL-pointer reference
!!! Moved from select() to poll() on *nix. Please upgrade your Makefiles.

25.04.2005
! set thread stack size explicitly to prevent problems with some Linux 2.6
  kernels.

22.04.2005
! Never fallback to gethostbyname() if nameservers are configured to prevent
  locking on *nix platforms
!!Fixed: name resolution is called while mutex is locked in HTTP proxy
  leading to long lasting blocking.

21.04.2005
! Fixed: dnspr returns A record of invalid class (fails with some resolvers)
!! Socket I/O  is now non-blocking

19.04.2005
! bandlimits changed to avoid floating point operations

11.04.2005
+ Log if new connections delayed because of too many accepted connections

04.04.2005
! Fixed few minor rare memory leaks

03.04.2005
! Fixed: HTTP proxy should ignore Content-Length for 304 response

14.03.2005
! MD5 password hashin within mycrypt utility fixed
! dnspr logging now shows DNS server IP instead of resolved IP, resolver IP
  is shown in additional info

11.02.2005
! Configuration reload removed from signal handler

31.01.2005
! Limit for maximum log string size increased to ~4K
! large FD_SETSIZE and FD_SETSIZE check is not required under Windows

28.01.2005
! Fixed: -s options for udppm

17.01.2005
! Fixed: invalid IP may appear in logs and bandlimits on redirection

13.01.2005
+ fakeresolve option added

21.12.2004
! Fixed: traffic limits are set improperly for traffic over 1Gb

11.12.2004
! 0.6 development started

11.12.2004
Commited as 0.5b
11/12/2004 3[APA3A]tiny proxy 0.5b
New features marked with !.

 Features:
  1. General
	+ HTTP/1.1 Proxy with keep-alive client and server support,
          transparent proxy support.
	+ FTP over HTTP support.
	+ DNS caching with built-in resolver
	+ HTTPS (CONNECT) proxy
	+ SOCKSv4/4.5 Proxy
	+ SOCKSv5 Proxy
	! UDP and bind support for SOCKSv5 (fully compatible with
	  SocksCAP/FreeCAP for UDP)
	+ Transparent SOCKS->HTTP redirection
	! Transparent SOCKS->FTP redirection
	! Transparent SOCKS->POP3 redirection
	+ POP3 Proxy
	! FTP proxy
	! DNS proxy
	+ TCP port mapper
	+ UDP port mapper
	+ Threaded application (no child process).
	! Web administration and statistics
  2. Proxy chaining
	+ Parent proxy support for any type of incoming connection
	+ Username/password authentication for parent proxy(s).
	+ HTTPS/SOCKS4/SOCKS5 and redirection parent support
	+ Random parent selection
	+ Chain building (multihop proxing)
  3. Logging
	+ turnable log format compatible with any log parser
	+ stdout logging
	+ file logging
	+ syslog logging (Unix)
	+ ODBC logging (Windows and Unix)
	+ log file rotation (hourly, daily, weekly, monthly)
	+ automatic log file comperssion with external archiver (for files)
	+ automatic removal of older log files
	! Character filtering for log files
	! different log files for different servces are supported
  4. Access control
	+ ACL-driven (user/source/destination/protocol/weekday/daytime or
	combined) bandwith limitation
	+ ACL-driven (user/source/destination/protocol/weekday/daytime or
	combined) traffic limitation per day, week or month
	+ User authorization by NetBIOS messanger name
	+ Access control by username, source IP, destination IP, destination
	port and destination action (POST, PUT, GET, etc), weekday and daytime.
	+ Access control by username/password for SOCKSv5 and HTTP/HTTPS/FTP
	+ Cleartext or encrypted (crypt/MD5 or NT) passwords.
	+ Connection redirection
	+ Access control by requested action (CONNECT/BIND, 
	  HTTP GET/POST/PUT/HEAD/OTHER).
	! NTLM authentication for HTTP proxy access
	! All access controle entries now support weekday and daytime
	limitations.
  5. Configuration
	+ support for configuration files
	+ support for includes in configuration files
	+ interface binding
	+ running as daemon process
	+ utility for automated networks list building
     Unix
	+ support for chroot
	+ support for setgid
	+ support for setuid
	! support for signals
     Windows NT/2K/XP/2K3
	+ support --install as service
	+ support --remove as service
	+ support for service START, STOP, PAUSE and CONTINUE commands (on
	PAUSE no new connection accepted, but active connections still in
	progress, on CONTINUE configuration is reloaded)
     Windows 95/98/ME
	! support --install as service
	! support --remove as service
  6. Compilation
	+ MSVC (msvcrt.dll)
	+ Intel Windows Compiler (msvcrt.dll)
	+ Windows/gcc (msvcrt.dll)
	+ Cygwin/gcc (cygwin.dll)
	+ Unix/gcc
	+ Unix/ccc

 Known bugs:

	report to 3proxy@security.nnov.ru

 Planned for future (0.6) release:
   - External modules API
   - Addon URL, antiviral, HTTP cache filters modules, authentication
     modules for different protocols (RADIUS, PAM, integrated system, etc).

$Id: Changelog,v 1.107 2005/05/25 14:00:27 vlad Exp $

11.12.2004
+ man page for 3proxy.cfg added

09.12.2004
! restarting SQL on reloading configuration

08.12.2004
! Typo fixed in sockmap preventing portmappers from functioning

06.12.2004
+ Network input is now buffered, decreasing CPU usage
- Debugging printf() removed from ftppr

30.11.2004
!! Fixed: memory content may be leaked on FTP error in HTTP proxy
! Few race conditions with double socket closing fixed in FTP proxy
+ Content-Length is checked to do not allow traffic overdraft via HTTP proxy
+ Connection now can be aborted due to traffic limit (code 90)

24.11.2004
! 333 error removed - no longer required

23.11.2004
! Deadlock in checkACL() (introduced 18.11) fixed

20.11.2004
! All mutex operation are now atomic to prvent deadlocks
! Race conditions with bamdlimits on reload fixed

18.11.2004
! Mutex logic overwritten, should clear reload races completely
! Fixed socket leak on some failed FTP operations
! FD_SETSIZE increased, check for FD_SETSIZE added

04.11.2004
! Fixed: Maxconn limitation doesn't work, may lead to resource exhaustion
  attacks
! Fixed: reference to unallocated memory if fails to create new thread
  (may lead to crash together with previous bug).

03.11.2004
! Fixed: Wrong type for "ace.users" in datatypes.c
! Partially fixed: race conditions on reload in alwaysauth()

02.11.2004
! race condition in sql_init on reload fixed
! minor code cleanup
! typo with SQL deadlock introduced on last fix fixed
! checked few memory allocation calls missed with debug library (myalloc)

30.10.2004
! Fixed: minor memory leak on SQL error

28.10.2004
+ HTTP parent redirection for FTP requests

23.10.2004
! Fixed: access to free()'d memory in ODBC functions after few 
  configuration reloads
! Configuration reload is more (but not yet completely) thread safe 
  now.

17.10.2004
! Fixed: Content-Type: missed in web interface

16.10.2004
! Fixed: log may show invalid IP/port for parent proxy connection

12.10.2004
- Debug printing to stdout in webadmin removed

11.10.2004
! Race conditions fixed, could cause 3proxy to crash on configuration reload

28.09.2004
! Limitation for maximum string length in config file removed (for included files)

26.09.2004
! Typo corrected preventing compilation under *nix

18.09.2004
! URL decoding corrected (affect HTTP over FTP clients)
+ "writable" command added to allow config modification via Web interface
+ Config file can be edited via web interface

14.09.2004
! Crash on HTTP redirections introduced on 08.09 fixed.

11.09.2004
+ Weekday based access control is now possible
+ Time based access control added
! Speed improved in ACL checks

08.09.2004
+ * can be used as external username with a meaning of username should be
  requested from user.
+ %n1-n2T is now available in logformat to log only few field of service
  specific text
+ -t (silent start) option added

20.08.2004
! Yesterday fix was broken, corrected.

19.08.2004
! Fixed: target address is logged instead of proxy address in a case
  of redirection

09.08.2004
! Fixed: under *nix if service fails to bind() port for few hours it falls
  into endless loop with logging and high CPU usage.

03.08.2004
! Fixed: select() changes tv value on some Linux kernels (100% CPU usage)

02.08.2004
! Fixed: wrong initialization for counter descriptor (causes some stdout
  noise).
! Fixed: no HTTP proxy diagnostic message if host name doesn't resolve
! Fixed: NULL pointer crash if no format specified

30.07.2004
! Few bugs with counters and bandlimits introduced yesterday fixed

29.07.2004
! Fixed few memory leaks on restart
! Some code cleanup for configuration information storing
+ Statistics extended
+ Added "Zombie" threads support (service thread waiting for child shutdown
  to exit).
+ Every service can now have different log format and character filtering
+ It's now possible to set logformat for service from command line

28.07.2004
! Fixed: ACLs are not cleared on reload
! Fixed: bind() warnings on reload under *nix
!! Fixed potential race conditions DoS on some Unix systems with thread
   exit on aborted connection (accept(): Software caused connection abort)

24.07.2004
+ Web interface shows information about all currently running services and
  clients (plain format just for debugging, will be rewrtitten later)

23.07.2004
! Fixed: wrong external ip/port in logs sometimes on internal redirection
+ HowTo and FAQ (Russian) added to documentation, documentation corrected

22.07.2004
+ Added logging options for request duration and average send/recieve
  speed per request

20.07.2004
! Changed default password for anonymous FTP
! Improved diagnostic messages for FTP over HTTP errors

19.07.2004
! Changed FTP behaviour for some RFC ignorant sites

17.07.2004
+ services and clients are now registered for future extensions
! counters show wrong result problem introduced yesterday fixed
! fixed descriptor leak on configuration reload
! fixed theoretical problem with client number limitations
! few theoretical mutex leaks fixed

16.07.2004
+ 3proxy can now read configuration from stdin under *nix,
  3proxy.cfg can be executable 
+ 'config' command added to allow 3proxy reload configuration in chroot'ed
  environment or if configured from stdin.
+ 'end' command added
+ Man pages in HTML added

14.07.2004
! Minor casting issues, Unix compilation issues fixed
+ counters sample added

13.07.2004
+ Configuration improved and repacked

08.07.2004
! Problem introduced yesteday (after rotation logs do not print to
  logfile) fixed.

07.07.2004
! Fixed FTP behaviour on RFC ignoring FTP sites (ftp.drweb.ru).
! Config file example updated with FTP proxy service configuration
+ Logging changed to allow personal log files for every service (without
  rotation) and to work on older FreeBSD systems.

05.07.2004
! Fixed call to free'ed memory (could cause crash on reloading 3proxy
  configuration in 0.5b-devel after 28.06.2004)

30.06.2004
! Fixed redirection crash if parent username/password is not specified
! Fixed documentation buf (%h instead of %n for hostname in logformat)

28.06.2004
! Minor changes in error messages generation

25.06.2004
! distributive repacked, some Russian documentation by Kirill Lopuchov
  added

24.06.2004
! realm sometimes is not shown in proxy-authentication

23.06.2004
! fixed maxconn parameter was not set to default value on proxy reload.
! fixed typo in pop3p causing it to fail

22.06.2004
! ftppr.c typo corrected, preventing compilation under unix.

19.06.2004
+ FTP proxy (compatible with both USER and OPEN mode). Redirection to
  FTP proxy from SOCKS

18.06.2004
+ Local redirection to POP3 proxy is now awailable.
! Fixed race conditions with double socket closing in POP3 proxy

17.06.2004
!! Threading problem causing minor memory leak and preventing 3proxy
   from functioning under few OS versions (including Linux) after
   some number of requests fixed.

16.06.2004
! Authentication problem introduced on 05.06 fixed

15.06.2004
! FTP over HTTP proxy supports spaces, quotes and 0x255 in filenames.
!! Potential security risk fixed: FTP password may appear in log if
   URL ftp://user:password@server is used.

09.06.2004
! NTLM is enabled by default. Use proxy -n to disable NTLM for proxy service
  (for example, if crypt passwords are used).

05.06.2004
!! Potential security leak fixed: POP3 proxy password can appear in log if
   proxy username is configured as proxyuser:proxypassword:pop3user@pop3server
   in POP3 client program
! Child invocation code rewritten to avoid code dupclication.

27.05.2004
! Reloading is now fast (new thread starts before old one dies)
! Milliseconds are printed as .3 (not .4) in logs

22.05.2004
+ Reload command added to Web interface and SIGUSR1 handling
! Problem fixed: no mode is given to open() with O_CREAT for counter files,
  counter file can be created as read only under Windows or with invalid mask
  under Unix.
! Do not fail if bind() fails
! Setsockopt for integer options corrected
! REUSEADDR added to avoid "Address already in use" problem if restarted
  under Unix

18.05.2004
+ Installation/removal as a service under Windows 95/98/ME now supported.

17.05.2004
! Fixed: 3proxy hangs on socket error during config reading

14.05.2004
! For HTTP proxy NTLM authentication both ntlm and basic are now advertized
  to client for compatibility
! Optimization parameters are changed and stack protection is turned on for
  MSVC (Windows default) compilation.
! Fixed: exiting thread shows last client IP in log
  

27.04.2004
! Fixed: Microsoft domain authentication to web server may fail via
  transparent HTTP proxy with some IE versions.
! HTTP HEAD now recognized

23.04.2004
! Fixed compilation issues under Unix

22.04.2004
+ Configuration now can be dynamically reloaded with
  net pause 3proxy / net continue 3proxy or by sending SIGPAUSE twice
  without breaking connections
! 3proxy is now distributed compiled with Microsoft Visual C++, thanx
  to MS for releasing "Microsoft Visual C++ Toolkit 2003" for free.
! Few bugs introduced in latest versions (username/password for parent proxy,
  dnspr and single packet UDP are fixed)

13.04.2004
+ NTLM authentication for proxy server (yes, it works under *nix). It will
  not work with crypt password, only CL or NT. Use proxy -n to allow NTLM.
! potential DoS (NULL pointer) condition fixed in configuration with crypted
  passwords

08.04.2004
+ %n (hostname) added to logformat

05.04.04
! compilation problem under Unix fixed

01.04.04
! problem with portmappers fixed (introduced on last modification)

20.03.04
+ FTP messages are shown now
! FTP problem with links with absolute paths fixed
! No more authentication requested for user if ACL denies access to resource
  in HTTP proxy.
! ACLs are now stored in predefined container. It's required for future
  improvement (Cisco-like ACL configuration and configuration reload without
  restarting proxy). As a backside, number of ACLs is now limited to 256.
! Function for configuration reading implemented for future improvements.

12.03.2004
! error text generation changed for pthread_create (use return code
  instead of errno). Memory leak on failed pthread_create fixed.

02.03.2004
! Transparent proxy fixed to work with ports different from 80.
! Workarond for Internet Explorer invalid Host: header bug

28.02.2004
+ -+ options added to logformat for character filtering
! ' character now filtered only if logged via ODBC
! few bugs fixed in ODBC logging reliability code. Now 3proxy should better
  handle broken database connections.

26.02.2004
! user32 added to library list for MSVC

24.02.2004
! Ask installation confirmation before installation

23.02.2004
! ttl now is real for DNS proxy proxy reply

21.02.2004
+ dnspr - DNS caching proxy added to 3proxy module. Listens on UDP/53
  and answers hostname requests. Requires nserver/nscache to be configured.
! 3proxy wanrs user if installed as Windows service
! 3proxy child threads are now started faster

22.01.2004
! mutex deadlock fixed if gethostbyname() is used under Unix

19.01.2004
! compilation issue fixed for MSVC (definition inside code)

15.01.2004
! bug fixed in configuration reading getip() called befor WSAStartup
  (thanks to Kerd)
! bug fixed with parent CONNECT proxy (thanks to Kerd)

11.01.2003
+ Few man pages added

06.01.2003
+ now it's possible to use "" inside quotation for double quote sign (for
  example "say ""hello world"""

04.01.2004
+ maxconn configuration option added

19.12.2003
+ New "safe" memory allocation library implemented. It may slow down
  performance but is thread safe and never cause memory fragmentation.
! Memory leak in redirection SOCKS->HTTP fixed

11.12.2003
! Memory leak in UDPPM fixed

29.11.2003
+ Copyrights added to banners
!! Few signed/unsigned mismatches fixed (including potentially dangerous)

27.11.2003
! 'redirect' now can be used with hostname instead of ip address

21.11.2003
! POP3 proxy bug fixed

04.11.2003
! '@' situation in username for POP3 proxy corrected 
  (pop3name@pop3realm@pop3server)

03.11.2003
! One more bug with 'archiver' causing 3proxy to crash on log archieving
  fixed

29.10.2003
! Some threading safety is added for logging (inet_ntoa and ODBC
  re-initialisation)

28.10.2003
! Bug causing daily log filename to work as weekly fixed
! 'daemon' example moved to beginning of configuration file

16.10.2003
+ pidfile configuration option added
+ processing for SIGCONT (pause/resume) and SIGTERM (termination) added
  under Unix

01.10.2003
! Weekly log filename now is generated by the date of last Sunday.
! Do not strip executable for Unix (must be stripped during installation).

21.09.2003
! Bug fixed in "log" command processing (wrong buffer was used
  for filename generation)

16.09.2003
! socksmapping algorythm changed to handle incomlete send() (for *BSD).

15.09.2003
! mutex added to gethostbyname() to avoid thread unsafety. It slows
  down proxy if no nserver configured (it MUST be for *nix!) but prevents
  crashing on active usage.
! signal() handling is added for SIGPIPE. It seems to be some race conditions
  on FreeBSD between send() and gethostbyname() somewhere causing SIGPIPE on
  gethostbyname().

13.09.2003
! NULL reference corrected if rotate is given without archiver

11.09.2003
! Few additional checks added for open()/fopen() to do not crash on invalid
  files in config
! Buffer moved from stack to heap in socks.c to eliminate crash on FreeBSD

10.09.2003
! Bug in SOCKSv5 UDP mapping corrected. Now it works fine (checked with
  Unreal Tournament) with both SocksCAP and FreeCAP.

06.08.2003
! Algorithm for SOCKS5 bind/udp assoc port selection is now intellegent
  enough to allow server applications to use same port number on socks
  server if available and not denied by access list
! SOCKS5 bind/udp assoc now matches incoming connections/packet
  with IP address from request in accordance to RFC 1928 to improve
  security

04.08.2003
!!! Bug fixed sometimes causing 3proxy to crash if parent proxy is used
!!! UDP associate finaly completed and is fully functional
    (tested with SocksCAP on Unreal Tournament). 
!!! TCP bind code re-checked, and is probably working (doesn't work
    on SocksCAP because of SocksCAP bug
!!! Socket leak on nbname auth fixed

21.07.03
+ Web administration module created
+ Dynamic enable/disable for counters now available via web interface

19/07/2003 3[APA3A]tiny proxy 0.4
New features marked with !.

 Features:
  1. General
	+ HTTP/1.1 Proxy with keep-alive client and server support,
          transparent proxy support.
	! FTP over HTTP support.
	! DNS caching
	+ HTTPS (CONNECT) proxy
	+ SOCKSv4 Proxy
	+ SOCKSv5 Proxy (TCP only)
	+ Transparent SOCKS->HTTP redirection
	+ POP3 Proxy
	+ TCP port mapper
	+ UDP port mapper
	+ Threaded application (no child process).
  2. Proxy chaining
	+ Parent proxy support for any type of incoming connection
	+ Username/password authentication for parent proxy(s).
	+ HTTPS/SOCKS4/SOCKS5 and redirection parent support
	+ Random parent selecttion
	+ Chain building (multihop proxing)
  3. Logging
	+ turnable log format
	+ stdout logging
	+ file logging
	+ syslog logging (Unix)
	+ ODBC logging (Windows and Unix)
	+ log file rotation (hourly, daily, weekly, monthly)
	+ automatic log file comperssion with external archiver (for files)
	+ automatic removal of older log files
  4. Access control
	! ACL-driven (user/source/destination/protocol or combined) bandwith
	limitation
	! ACL-driven (user/source/destination/protocol or combined) traffic
	limitation per day, week or month
	+ User authorization by NetBIOS messanger name
	+ Access control by username, source IP, destination IP, destination
	port and destination action (POST, PUT, GET, etc).
	+ Access control by username/password for SOCKSv5 and HTTP/HTTPS/FTP
	+ Cleartext or encrypted (crypt/MD5 or NT) passwords.
	+ Connection redirection
	+ Access control by requested action (CONNECT/BIND, 
	  HTTP GET/POST/PUT/HEAD/OTHER).
  5. Configuration
	+ support for configuration files
	+ support for includes in configuration files
	+ interface binding
	+ running as daemon process
	+ utility for automated networks list building
     Unix
	+ support for chroot
	+ support for setgid
	+ support for setuid
     NT
	+ support --install as service
	+ support --remove as service
	+ support for service START, STOP, PAUSE and CONTINUE commands (on
	PAUSE no new connection accepted, but active connections still in
	progress)
  6. Compilation
	+ MSVC (msvcrt.dll)
	+ Intel Windows Compiler (msvcrt.dll)
	+ Windows/gcc (msvcrt.dll)
	+ Cygwin/gcc (cygwin.dll)
	+ Unix/gcc
	+ Unix/ccc

 Known bugs:

	- udppm doesn't work if compiled with cygwin. 

	  Cygwin doesn't support recvfrom()/sendto() on connected socket, so
	  recv/send is used instead... Not a big deal anyway.


 Planned for future release:
   - Web interface for configuration
   - Signal handling on Unix (for stop/pause/resume/configuration change)
   - External filter API
   - Addon URL, antiviral, HTTP cache filters

17.07.03
+ ODBC changed to re-establish broken connection

11.06.03
! #ifndef NOSQL changed to NOODBC

22.05.03
+ strong auth now supported for POP3 proxy. Now, username can be in format
  proxy_username:proxy_password:POP3_username@pop3server

30.04.03
! redirect function now do not change code of traffic limit error

24.04.2003
! -M changed to -D for *nix makefiles

18.04.2003
! HTTPS behaviour breaked by latest patches restored

15.04.2003
! fixed handling of special characters and non-existing files in
  FTP over HTTP proxy.

12.04.2003
! fixed behaviour of HTTP proxy on RFC-incompatible web servers (banners
  exchanges, price.ru, etc) - they terminate string with \n instead of
  \r\n.

10.04.2003
+ nsrecord and dialer commands added
! Name resolution now occures right before authorization to prevent
  unauthenticated users from performing NS lookups and demand dial.

05.04.2003
+ N (Never) option value added for counters refreshing

29.03.2003
+ !!! FTP support for HTTP proxy added. 

25.03.2003
! Socks 4 bug fixed (was visible in Netscape)
+ Socks 4.5 support added (not tested)
! !! UDP portmapper code fixed

24.03.2003
! Timeout, close on closed socket and FD bugs fixed in UDPPM

21.03.2003
+ Proxy-Authorization now works for CONNECT (HTTPS proxy).

07.03.2003
! counter command extended to allow traffic reports

02.03.2003
! Bandwidth/Traffic limiting problems fixed
! gethostbyname() argument limited to 256 characters. It may be significant
  for Windows

27.02.2003
+ !!! Traffic limitting feature added (counter/countin/nocountin)

26.02.2003
! nobandlim processing changed
! bandlim/nobamdlim commands renamed to bandlimin/nobandlimin

22.02.2003
+ !!! Bandwidth limiting features added (bandlim and nobandlim commands)

18.02.2003
+ Mutext support added for inter-thread data access. Should improve stability.
- debugging printf() removed from proxy, typo fixed in auth.c

10.02.2003
! Changed to use WSASocket()/WSAAccept() instead of socket()/accept() under
  Windows

30.01.2003 
! Version of gcc changed (3.2).
+ nscache option added to 3proxy configuration for DNS cache. For a while
  caching is primitive (with no expiration).

27.01.2003
- \n removed from perror() calls

27/01/2003 3[APA3A]tiny proxy 0.3b.
New features are marked with !.

 Features:
  1. General
	+ HTTP/1.1 Proxy with keep-alive client and server support,
          transparent proxy support.
	! HTTPS (CONNECT) proxy
	+ SOCKSv4 Proxy
	+ SOCKSv5 Proxy (TCP only)
	! Transparent SOCKS->HTTP redirection
	+ POP3 Proxy
	+ TCP port mapper
	+ UDP port mapper
	+ Threaded application (no child process).
  2. Proxy chaining
	! Parent proxy support for any type of incoming connection
	! Username/password authentication for parent proxy(s).
	! HTTPS/SOCKS4/SOCKS5 and redirection parent support
	! Random parent select
	! Chain building (multihop proxing)
  3. Logging
	! turnable log format
	+ stdout logging
	+ file logging
	+ syslog logging (Unix)
	! ODBC logging (Windows)
	+ log file rotation (hourly, daily, weekly, monthly)
	+ automatic log file comperssion with external archiver (for files)
	+ automatic removal of older log files
  4. Access control
	+ User authorization by NetBIOS messanger name
	+ Access control by username, source IP, destination IP and destination
	port
	+ Access control by username/password for SOCKSv5 and HTTP
	+ Cleartext or encrypted (crypt/MD5 or NT) passwords.
	+ Connection redirection
	! Access control by requested action (CONNECT/BIND, 
	  HTTP GET/POST/PUT/HEAD/OTHER).
  5. Configuration
	+ support for configuration files
	+ support for includes in configuration files
	+ interface binding
	+ running as daemon process
	! utility for networks list building
     Unix
	+ support for chroot
	+ support for setgid
	+ support for setuid
     NT
	+ support --install as service
	+ support --remove as service
	+ support for service START, STOP, PAUSE and CONTINUE commands (on
	PAUSE no new connection accepted, but active connections still in
	progress)
  6. Compilation
	+ MSVC (msvcrt.dll)
	! Intel Windows Compiler (msvcrt.dll)
	+ Windows/gcc (msvcrt.dll)
	+ Cygwin/gcc (cygwin.dll)
	+ Unix/gcc
	! Unix/ccc

 Known bugs:

	- udppm doesn't work if compiled with cygwin. 

	  Cygwin doesn't support recvfrom()/sendto() on connected socket, so
	  recv/send is used instead... Not a big deal anyway.


 Planned for future release:
   - FTP proxy support
   - Web interface for configuration
   - Signal handling on Unix (for stop/pause/resume/configuration change)
   - External filter API
   - Addon trafficshape, URL, antiviral, HTTP cache filters


27.01.2003
!!!!!!!!!!!!!!!!!!!
! Tagging as 0.3b !
!!!!!!!!!!!!!!!!!!!

24.01.2003
- Fixed to use INVALID_SOCKET instead of -1 (for Windows compatibility)
- Fixed problem with threading support under gcc. Now ODBC logging seems
  to work always.
! strncasecmp removed. Changed to use strnicmp for Windows.

21.01.2003
! 0.3 development frozen to only bugfixes
- bug fixed causing 3proxy to crash with NULL pointer reference on
  transparent web redirection
- SQL support removed from default (gcc) compilation

20.01.2003
+ ODBC logging (yeah!). For a while it works stable only if compiled with
  MSVC or Intel compiler.

17.01.2003
- bug introduced yesterday into CONNECT code cleaned

16.01.2003
+ timeouts command added

13.01.2003
- daemonizing code changed to work correctly on buggy libc (FreeBSD)
  (pthread_* doesn't work after daemon())
- logging code changed to work correctly on buggy libc (FreeBSD 4.4)
  (freopen "a" mode doesn't work as expected on stdout)

12.01.2003
! License is changed to prohibit modification and commercial use

11.01.2003
! All makefiles are made uniform
+ Makefiles for Compaq C complier (Makefile.ccc) and Intel C Compiler for
  Windows (Makefile.intl) added
+ Makefile.msvc added for Microsoft Visual C Compiler
! proxy.dsp removed

10.01.2003
+ Now checked to compile with Compaq C Compiler under linux on alpha platform
+ logformat configuration command added for custom log entry format
! Unix version changed to use gettimeofday instead of ftime to avoid -lcompat
  issue.

09.01.2003
! Randomizer changed for proxy chaining
! Code cleaned: Makefile, signed/unsigned conversions, etc.
! Typo fixed preventing from compilation under *nix

08.01.2003
+ dateformat command added
! Log format changed!!!
+ Control for different operations (CONNECT,BIND,HTTP_*, etc) added to ACL,
  see 3proxy.cfg.sample

25.12.2002
+ Proxy chaining now is fully operational!!!!!
+ SOCKSv4 and SOCKSv5 client code added for chaining
+ HTTP connect authentication added for chaining
+ Parent authentication for HTTP proxy added
- Problem with "Connection: close" resolved (if HTTP server time outs or closes
  connection).

24.12.2002
+ Proxy chaining works!!! (for a while only HTTP CONNECT proxies
  are supported and no parent authentication). Logging is updated to
  include number of redirections (parent proxies) in square brackets.
  See config.sample for example of "parent" command.

23.12.2002
! Transparent proxy operations improved, logging corrected
+ Added base code for proxy chaining
! Redirection code rewritten

23.12.2002
+ UDP ASSOCIATE added (but not tested) to SOCKS.
! Additional logging added to socks proxy
+ Local HTTP proxy redirection added (for SOCKS).

01.12.2002
! closesock() problem _finally_ patched...

30.11.2002
! Makefile.unix corrected
! Do not process $ in included files for 3proxy.cfg
! Common error codes are unified

29.11.2002
+ nserver example added to 3proxy.cfg.sample

28.11.2002
- fixed closesock() instead of close() call on 3proxy.cfg included files
  for native Windows.

27.11.2002
! Minor changes in docummentation
+ dighosts utility added

22.11.2002
- Few problems corrected in logfiles rotation

20.11.2002
- SOCKSv5 bind() reply corrected.

19.11.2002
+ internal resolver added to avoid usage of thread unsafe gethostbyname().
  nserver configuration option added to config file.
! HTTP proxy behaviour slightly changed to be more compatible.

06/11/2002 3[APA3A]tiny proxy 0.2b Initial release.

 Features:
  1. General
	+ HTTP/1.1 Proxy with keep-alive client and server support,
          transparent proxy support.
	+ SOCKSv4 Proxy
	+ SOCKSv5 Proxy (TCP only)
	+ POP3 Proxy
	+ TCP port mapper
	+ UDP port mapper
	+ Threaded application (no child process).
  2. Logging
	+ stdout logging
	+ file logging
	+ syslog logging (Unix)
	+ log file rotation (hourly, daily, weekly, monthly)
	+ automatic log file comperssion with external archiver (for files)
	+ automatic removal of older log files
  3. Access control
	+ User authorization by NetBIOS messanger name
	+ Access control by username, source IP, destination IP and destination
	port
	+ Access control by username/password for SOCKSv5 and HTTP
	+ Cleartext or encrypted (crypt/MD5 or NT) passwords.
  4. Configuration
	+ support for configuration files
	+ support for includes in configuration files
	+ interface binding
	+ running as daemon process
     Unix
	+ support for chroot
	+ support for setgid
	+ support for setuid
     NT
	+ support --install as service
	+ support --remove as service
	+ support for service START, STOP, PAUSE and CONTINUE commands (on
	PAUSE no new connection accepted, but active connections still in
	progress)
  5. Compilation
	+ Microsoft VC++ (msvcrt.dll)
	+ Windows/gcc (msvcrt.dll)
	+ Cygwin/gcc (cygwin.dll)
	+ Unix/gcc

 Known bugs:

	- udppm doesn't work if compiled with cygwin. 

	  Cygwin doesn't support recvfrom()/sendto() on connected socket, so
	  recv/send is used instead... Not a big deal anyway.

	- socks5 doesn't work with UDP

	  Not implemented yet

 Planned for future release:
   - UDP implementation in SOCKSv5
   - Signal handling on Unix (for pause/resume)
   - External filter API
   - Addon trafficshape, URL, antiviral, HTTP cache filters

06.11.2002
!!MARK IT 0.2beta
! Using UPX to compress 3proxy.exe


02.11.2002
+ HTTP proxy now supports kepp-alive connections to HTTP server or proxy.
  It dramatically decreases number of outgoing connections and amount of DNS
  traffic.

01.11.2002
+ Now proxy can catch Web server style requests. It means proxy
  may be used as a transparent proxy. Yes. It means you can redirect
  SOCKS requests with target 80 to HTTP proxy.
! Port check in ACL fixed
! Now proxy catches redirection by changed destination IP or port. If
  you redirect request to web server make sure it supports proxy style
  requests (IIS and Apache do).
+ HTTP proxy supports keep-alive. Now number of threads required
  significantly reduced.
+ HTTP CONNECT fully supported (both direct and redirected to another proxy).
  Now you can use our proxy for HTTPs. Or for spam :) Don't forget to set ACL
  for outgoing ports, cause now ports are not limited.

26.10.2002
+ mycrypt utility added for making crypted passwords in NT and crypt/MD5
! ACL check for strong auth corrected
+ HTTP proxy support for authentication (basic). Now you can use strong
  username/password authentication with proxy module.
+ Error messages added for HTTP proxy

25.10.2002
+ NT passwords are now supported in 3proxy.cfg
! Public License Agreement changed to be more clear

24.10.2002
! Fixed handle leak because of missed CloseHandle for threads in Windows

23.10.2002
! Fixed POP3 proxy bug
! Strong auth changed to allow rules with * for username
+ MD5 crypt format passwords is now supported... Do we ever need DES?
  I will not implement blowfish - it's huge and rarely used.
+ More comments added to 3proxy.cfg.sample

21.10.2002
! Fixed strongauth problem - ACL was not checked for authenticated
  SOCKSv5 users

16.10.2002
+ Added support for SOCKSv5 cleartext password authentication
+ "strong" authentication is now OK (use it only for SOCKS)
+ added "users" config file command to specify username and password. Only
  cleartext for a while.

20.09.2002
! Minor improvements in socket operations

17.09.2002
! HTTP proxy changed to do not strip hostname from URI if target port is not
  80. It allows to redirect requests to another proxy as well as redirect to
  different Web server via ACL. It will work for most servers (IIS, Apache)
  if target redirected to non-standard port of Web server, but may fail in
  some rare cases. Redirection to proxy should always work OK except if proxy
  is on TCP/80.
+ Added "redirect" ACL command. You can redirect request to another destination
  if ACL entry matches (that is by target or source IP, target port, username).
! Fixed documentation bug in 3proxy.cfg.sample ("authtype" instead of "auth")
! Fixed bug causing server to exit in native Win32 mode if "service"
  configuration option is not configured
! Outgoing SOCKS connections are handled in common way now.

07.09.2002
+ added binding to external interface for outgoing connections
! Fixed bug causing username check in ACL always fail
+ Added ACL check for UDP map
+ Added "Single packet" services to UDP portmap (-s switch). Allows unlimited
  number of clients to be handled by portmapper for single-packet services
  (like DNS).

06.09.2002 3[APA3A]tiny proxy 0.1b initial release

 Features:
  1. General
	+ HTTP/1.0 Proxy
	+ SOCKSv4 Proxy
	+ SOCKSv5 Proxy (TCP only)
	+ POP3 Proxy
	+ TCP port mapper
	+ UDP port mapper
	+ Threaded application (no child process).
  2. Logging
	+ stdout logging
	+ file logging
	+ syslog logging (Unix)
	+ log file rotation (hourly, daily, weekly, monthly)
	+ automatic log file comperssion with external archiver (for files)
	+ automatic removal of older log files
  3. Access control
	+ User authorization by NetBIOS messanger name
	+ Access control by username, source IP, destination IP and destination
	port
  4. Configuration
	+ support for configuration files
	+ support for includes in configuration files
	+ interface binding
	+ running as daemon process
     Unix
	+ support for chroot
	+ support for setgid
	+ support for setuid
     NT
	+ support --install as service
	+ support --remove as service
	+ support for service START, STOP, PAUSE and CONTINUE commands (on
	PAUSE no new connection accepted, but active connections still in
	progress)
  5. Compilation
	+ Microsoft VC++ (msvcrt.dll)
	+ Windows/gcc (msvcrt.dll)
	+ Cygwin/gcc (cygwin.dll)
	+ Unix/gcc

 Known bugs:

	- udppm doesn't work if compiled with cygwin. 

	  Cygwin doesn't support recvfrom()/sendto() on connected socket, so
	  recv/send is used instead... Not a big deal anyway.

	- udppm works without authentication

	  Will be patched later.

	- socks5 doesn't work with UDP

	  Not implemented yet

 Planned for future release:
   - Improvements to UDP portmapping
   - UDP implementation in SOCKSv5
   - Ident authorization
   - SOCKSv5 password authentication
   - Signal handling on Unix (for pause/resume)
   - External filter API
   - Addon trafficshape, URL, antiviral, HTTP cache filters
   - HTTP/1.1 support


$Id: Changelog,v 1.107 2005/05/25 14:00:27 vlad Exp $