X-Git-Url: http://www.privoxy.org/gitweb/?a=blobdiff_plain;f=doc%2Fsource%2Fchangelog.sgml;h=7025d15588220c41d38e244551ed96bd0b20fc75;hb=3f9f7065e662a7c78f93d3f97ebe40452605976a;hp=b106f57fc7508b4c1831b8613cc0501a8d9d09f5;hpb=5837b662cd10aac7b62b1dcaaaadd28fa81e00c8;p=privoxy.git diff --git a/doc/source/changelog.sgml b/doc/source/changelog.sgml index b106f57f..7025d155 100644 --- a/doc/source/changelog.sgml +++ b/doc/source/changelog.sgml @@ -3,7 +3,7 @@ Purpose : Entity included in other project documents. - Copyright (C) 2013-2018 Privoxy Developers https://www.privoxy.org/ + Copyright (C) 2013-2023 Privoxy Developers https://www.privoxy.org/ See LICENSE. ====================================================================== @@ -24,13 +24,14 @@ --> - Privoxy 3.0.30 fixes a couple of bugs - and introduces a few new features. + Privoxy 3.0.34 fixes a few + minor bugs and comes with a couple of general improvements + and new features. - - Changes in Privoxy 3.0.30 stable: - - + + Changes in Privoxy 3.0.34 stable: + + @@ -38,59 +39,68 @@ - Check the actual URL for redirects when https inspecting requests. - Previously Privoxy would only check the path which resulted in - rewrite results being rejected as invalid URLs. - Reported by withoutname in #1736. + Improve the handling of chunk-encoded responses by buffering the data + even if filters are disabled and properly keeping track of where the + various chunks are supposed to start and end. Previously Privoxy would + merely check the last bytes received to see if they looked like the + last-chunk. This failed to work if the last-chunk wasn't received in one + read and could also result in actual data being misdetected + as last-chunk. + Should fix: SF support request #1739. + Reported by: withoutname. - Let the hide-referrer code tolerate Referer headers with https:// URLs. - Previously they would always be treated like a changed host. + remove_chunked_transfer_coding(): Refuse to de-chunk invalid data + Previously the data could get corrupted even further. + Now we simply pass the unmodified data to the client. - Use the https headers if the show-request handler is reached through - https://. Previously Privoxy would use the http headers which - may be empty on a reused connection. + gif_deanimate(): Tolerate multiple image extensions in a row. + This allows to deanimate all the gifs on: + https://commons.wikimedia.org/wiki/Category:Animated_smilies + Fixes SF bug #795 reported by Celejar. - Make CGI_PREFIX protocol-relative when building with FEATURE_HTTPS_INSPECTION. - This unbreaks (at least) https://config.privoxy.org/client-tags whose - buttons would previously use a http:// URL resulting in browser warnings. + OpenSSL generate_host_certificate(): Use X509_get_subject_name() + instead of X509_get_issuer_name() to get the issuer for generated + website certificates so there are no warnings in the browser when using + an intermediate CA certificate instead of a self-signed root certificate. + Problem reported and patch submitted by Chakib Benziane. - Support using https-inspection and client-header-order at the same time. - Previously Privoxy would crash. - Reported by: Kai Raven + can_filter_request_body(): Fix a log message that contained a spurious u. - Properly reject rewrites from http to https as they currently - aren't supported. Previously Privoxy would wait for the client - to establish an encrypted connection which obviously would not happen. + handle_established_connection(): Check for pending TLS data from the client + before checking if data is available on the connection. + The TLS library may have already consumed all the data from the client + response in which case poll() and select() will not detect that data is + available to be read. + Sponsored by: Robert Klemme. - When https inspection is enabled and Privoxy has been compiled with - FEATURE_GRACEFUL_TERMINATION (not recommended for production builds), - the TLS backend resources are free'd later on and only if no active - connections are left. Prevents crashes when exiting "gracefully" at the - wrong time. + ssl_send_certificate_error(): Don't crash if there's no certificate + information available. This is only relevant when Privoxy is built with + wolfSSL 5.0.0 or later (code not yet published). Earlier wolfSSL versions + or the other TLS backends don't seem to trigger the crash. - + - Let the uninstall target remove the config file even if DESTDIR - is set and properly announce the deletion of the configuration files. + socks5_connect(): Add support for target hosts specified as IPv4 address + Previously the IP address was sent as domain. @@ -102,173 +112,74 @@ - Allow to rewrite the request destination for https-inspected - requests behind the client's back. The documentation already sort - of claimed that it was supported by not especially mentioning that - it didn't work for https-inspected requests. - Fixes SF bug #923 reported by withoutname. - - - - - Add support for filtering client request bodies by using - CLIENT-BODY-FILTER filters which can be enabled with the - client-body-filter action. - Patch submitted by Maxim Antonov. - Sponsored by: Robert Klemme - - - - - Add the new action suppress-tag{} which can be used to prevent - a tagger from adding a tag. Patch submitted by Maxim Antonov. - Sponsored by: Robert Klemme - - - - - Gracefully handle existing website keys without matching certificates. - This can happen if Privoxy was previously running with an invalid - TLS configuration that didn't allow it to create a certificate. - - - - - Recycle debug bit 4 for Tagging-related messages. - - - - - Improve the message shown when the client-tags CGI page - is requested with no tags configured. - - - - - Shorten the 'donate' and 'participate' links used by templates - using redirects. Currently the redirects lead to the FAQ entries - but in the future we may want to relocate the content and using - redirects makes this more convenient. - - - - - Log an error when a PCRE-HOST-PATTERN is used with - FEATURE_PCRE_HOST_PATTERNS disabled. Don't treat this a - fatal error so the regression tests can be used with and - without FEATURE_PCRE_HOST_PATTERNS. - - - - - The code compiles with older C compilers again. - - - - - The chdir() return code is checked to fix a compiler warning. - - - - - The packages feed has been removed from the source tarball. - It's usually out of date when the source tarball is generated - for the release. - - - - - Fixed harmless compiler warnings from GCC9 with -D_FORTIFY_SOURCE=2. - - - - - windows: Remove obsolete '$(DEST)/doc/images' target. - - - - - windows: Install the images referenced in the user manual. - - - - - Remove obsolete 'gnu_regex.@OBJEXT@' target. - - - - - When installing from the GNUMAkefile, don't create an 'images' - directory which is no longer used. The images were relocated to - the user-manual directory years ago. - - - - - Add new FEATURES to the show-status page and resort list. + Add a client-body-tagger action which creates tags based on + the content of the request body. + Sponsored by: Robert Klemme. - Remove unused variable in the OpenSSL-specific code. + When client-body filters are enabled, buffer the whole request + before opening a connection to the server. + Makes it less likely that the server connection times out + and we don't open a connection if the buffering fails anyway. + Sponsored by: Robert Klemme. - Update bug tracker URL in cgi_error_unknown(). + Add periods to a couple of log messages. - Saved a couple of memory allocations when sorting client headers. + accept_connection(): Add missing space to a log message. - Improved a couple of error messages. + Initialize ca-related defaults with strdup_or_die() so errors + aren't silently ignored. - Saved memory allocations when using OpenSSL and checking if a - key already exists. + make_path: Use malloc_or_die() in cases where allocation errors + were already fatal anyway. - The configure script will bail out if OpenSSL and mbedTLS are - enabled at the same time. + handle_established_connection(): Improve an error message slightly. - Log a message right before exiting gracefully. + receive_client_request(): Reject https URLs without CONNECT request. - A couple of structures have been rearranged to require slightly - less memory. + Include all requests in the statistics if mutexes are available. + Previously in case of reused connections only the last request got + counted. The statistics still aren't perfect but it's an improvement. - When https inspection is enabled and the certificate is invalid - the error message is now sent with status code 403 instead of 200. + Add read_socks_reply() and start using it in socks5_connect() + to apply the socket timeout more consistently. - The Slackware rc script template has been renamed to - slackware/rc.privoxy.in to silence complaints when building - Debian packages. + socks5_connect(): Deal with domain names in the socks reply - When building with MbedTLS support, mbedtls_md5_ret() is used - instead of mbedtls_md5() which is deprecated and causes a warning - on Debian GNU/Linux. + Add a filter for bundeswehr.de that hides the cookie and + privacy info banner. @@ -280,121 +191,89 @@ - Block requests to eu-tlp03.kameleoon.com/. + Disable filter{banners-by-size} for .freiheitsfoo.de/. - Unblock metrics.sr.ht/. + Disable filter{banners-by-size} for freebsdfoundation.org/. - Disable fast-redirects for .fsf.org/. + Disable fast-redirects for consent.youtube.com/. - Disable fast-redirects for .gravater.com/. + Block requests to ups.xplosion.de/. - Disable fast-redirects for .ksta.de/. + Block requests for elsa.memoinsights.com/t. - Block requests to tag.crsspxl.com/. + Fix a typo in a test. - Block requests to analytics.slashdotmedia.com/. + Disable fast-redirects for launchpad.net/. - Block requests to ml314.com/. + Unblock .eff.org/. - Block requests to .adroll.com/. + Stop unblocking .org/.*(image|banner) which appears to be too generous + The example URL http://www.gnu.org/graphics/gnu-head-banner.png is + already unblocked due to .gnu.org being unblocked. - Block requests to fastlane.rubiconproject.com/. + Unblock adfd.org/. - Block requests to api.theadex.com/. + Disable filter{banners-by-link} for .eff.org/. - Block requests to ih.adscale.de/. + Block requests to odb.outbrain.com/. - Block requests to .s400.meetrics.net/. + Disable fast-redirects for .gandi.net/. - Block requests for pp.lp4.io/. - - - - - Block requests for trc-events.taboola.com/. - - - - - - - - Filter file improvements: - - - - A allow-autocompletion filter has been added which changes - autocomplete="off" to "on" on input fields to allow autocompletion. - Requested by Jamie Zawinski in #370. - Filter based on a submission by Aaron Linville. + Disable fast-redirects{} for .onion/.*/status/. - Added an imdb filter. + Disable fast-redirects{} for twitter.com/.*/status/. - Added a sourceforge filter that reduces the amount of ads - for proprietary software. + Unblock pinkstinks.de/. - Added a github filter that removes the annoying "Sign-Up" - banner and the Cookie disclaimer. - - - - - Removed a duplicated pcrs command from the js-annoyances filter. - - - - - The crude-parental filter now provides a short reason when blocking, - inserts a link to Privoxy's webinterface and adds a new line at - the end of the generated page. + Disable fast-redirects for .hagalil.com/. @@ -406,101 +285,21 @@ - Highlight a few more messages. - - - - - Add a handler for tagging messages. - - - - - Properly deal with 'Certificate error' crunches - Previously the error description was highlighted as 'host'. - - - - - Log truncated LOG_LEVEL_CLF messages more gracefully - and note that the statistics will be imprecise. - - - - - Fixed perldoc typo. - - - - - Bump version to 0.9.2. - - - - - - - - Privoxy-Regression-Test: - - - - Use http://127.0.0.1:8118/ as default Privoxy address - unless http_proxy is set through the environment. - - - - - Add a --privoxy-cgi-prefix option that specifies the prefix - to use when building URLs that are supposed to reach Privoxy's - CGI interface. If it's not set, http://p.p/ is used, which is - supposed to work with the default Privoxy configuration. - If Privoxy has been built with FEATURE_HTTPS_INSPECTION enabled, - and if https inspection is activated with the +https-inspection - action, this option can be used with "https://p.p/" provided the - system running Privoxy-Regression-Test has been configured to - trust the certificate used by Privoxy. - Note that there are currently two tests in the official - regression-tests.action file that are expected to fail - when using "https://p.p/" as privoxy-cgi-prefix. - - - - - Skip the connection-established response in get_status_code() - when looking for the status code with a CGI prefix - that starts with https://. We care about the status code - sent by the impersonated web server. - - - - - Use --proxy-header when using a CGI prefix with https:// - and a "Host:" header. + Bump version to 0.9.5. - Allow '|' in tokens and values to allow tag patterns like - "TAG:^(application|text)/(x-)?javascript$". + Highlight more log messages. - When get_cgi_page_or_else() fails, include the URL of the - requested page in the log message. - - - - - Added a --check-bad-ssl option that can be used to verify that - Privoxy detects certificate problems when accessing the test - sites from badssl.com. - - - - - Bumped version to 0.7.2 + Highlight the Crunch reason only once. Previously the "crunch reason" + could also be highlighted when the URL contained a matching string. + The real crunch reason only occurs once per line, so there's no need + to continue looking for it after it has been found once. + While at it, add a comment with an example log line. @@ -512,267 +311,44 @@ - Update example output. - - - - - Recommend the use of the https-inspection action in the documentation. - - - - - Upgrade a couple of URLs to https://. - - - - - Add ElectroBSD to the list of operating systems. - - - - - Bumped generated Firefox version to 78 (ESR). - - - - - Bumped version to 1.2.2. - - - - - - - - User documentation: - - - - Remove reference to 'How to Report Bugs Effectively'. - It was only rendered as text without URL in the README anyway - and there's no indication that users read it ... - - - - - Let the dok-readme target fix the location embedded into the - README file. This used to be done by CVS but since the git migration - it has to be done through other means. - - - - - Remove 'experimental' warning for client-specific-tag-related directives. - They seem to work reliably and there is no obvious reason - why we would change the syntax in the near future. - - - - - Describe how to check if Privoxy has been built with - FEATURE_HTTPS_INSPECTION. - - - - - Add a link to the trusted-cas-file documentation - that explains how the user can create the file herself. - - - - - Don't explicitly mention the license for the code coming from - 'Anonymous Coders' and Junkbusters. It's obviously licensed under - the GNU GPL like the rest of Privoxy or we wouldn't be allowed to - distribute it. - - - - - Update the +hide-user-agent example with uagen output. - - - - - Slightly improve the wording of the ca-key-file documentation. - - - - - Explicitly mention Windows 10 as supported so search engines and - users looking for it can find it. - - - - - Import a bunch of contributors from the ChangeLog. - - - - - Remove obsolete doc/gpl.html. - - - - - Upgrade a couple of links to https://. - - - - - Don't prefer the SourceForge patch tracker over the - privoxy-devel mailing list. While at it, link to the - SourceForge patch tracker. - - - - - Mention http-inspection in the 'my browser warns me about - unauthenticated content' FAQ entry. - - - - - Simplify the 'Is there is a license or fee?' FAQ entry. - - - - - Add another +redirect{} example. - - - - - Explicitly mention that interested sponsors should include - the link target in their first mail. - - - - - Clarify that only Privoxy team members can object to new sponsors - and link to the list of current team members. - - - - - Note that sponsor URLs may not contain keyword spam. - - - - - Garbage collect doc/webserver/images which isn't referenced anymore. - - - - - Update the method to reach the proxy settings in Firefox. - - - - - Update proxy_setup.jpg description to refer to Firefox. - - - - - Regenerate proxy_setup.jpg with a more recent Firefox (78.0). - - - - - Regenerate files-in-use.jpg without obsolete standard.action - with modern colors and a slightly better quality. - - - - - Update URL to the actionsfile tracker. - - - - - Update a support request URL. - - - - - Rephrase the 'Can Privoxy run as service' FAQ entry and - remove an obsolete paragraph. - - - - - Let the 'Where can I get updated Actions Files?' entry link to - the gitweb version of default.action.master. - - - - - Update a link to the default.action file. - - - - - Update URLs for trackers and mailing lists. - - - - - Replace CVS reference with git. - - - - - Mention regression-tests.action in the config file. - - - - - Explicitly mention in the config file that access to the - CA key should be limited to Privoxy. + Bump version to 1.2.4. - List more client-specific-tag examples for inspiration. + Update BROWSER_VERSION and BROWSER_REVISION to 102.0 + to match the User-Agent of the current Firefox ESR. - Add additional headers to the client-header-order example. + Explicitly document that changing the 'Gecko token' is suspicious. - Note that actions aren't updated after rewrites. + Consistently use a lower-case 'c' as copyright symbol. - Explicitly mention that upgrading from http to https with - a client-header filter is not supported + Bump copyright. - Note that protocol and host have to be added when rewriting - the destination host for https-inspected requests. + Add 'aarch64' as Linux architecture. - Explicitly mention that the CA key is used to sign certificates. + Add OpenBSD architecture 'arm64'. - Put openssl command in 'command' tags. - - - - - The man page has been moved from section 1 to man section 8. + Stop using sparc64 as FreeBSD architecture. + It hasn't been supported for a while now. @@ -780,147 +356,19 @@ - Developer manual: + Build system: - Flesh out the build instructions for Debian. - - - - - Remove the packaging instructions for RPM-based systems. - They don't work and we don't release RPM packages anymore anyway. - - - - - Remove the packaging instructions for Solaris. - They don't work and we don't release Solaris packages anymore anyway. - - - - - Update the suggested subject for the announce mails. - - - - - Update upload instructions. - ftp://upload.sourceforge.net is no longer functional. - - - - - Remove a couple of package-dependent upload instructions - that don't actually work. - - - - - Remove 'cd current' that no longer works. - - - - - Add regression-tests.action to the list of files that should be installed. + Makefile: Add a 'dok' target that depends on the 'error' target + to show the "You are not using GNU make or did nor run configure" + message. - Stop claiming that there are text versions of the manuals. - We stopped building them in 2008 (9ed36a3c5e6f12). - - - - - Note that the 'webserver' target creates the link needed for the user-manual. - - - - - Suggest to use the master branch as reference when creating - the ChangeLog so the steps work when the current branch differs - from master which is likely as the developer manual - suggests to use a local branch for development. - - - - - Add the -s flag to the suggested 'git tag' command. We prefer signed tags. - - - - - Mention that merges into 'master' should be avoided. - - - - - Add git commands that should result in a merge-free history. - - - - - Mention Privoxy-Regression-Test. - - - - - Add a section id to reduce link churn. - - - - - Recommend the dok-tidy target when building docs for the webserver. - - - - - Add another plug for the privoxy-devel mailing list. - - - - - Let the intro link the copyright section in the user manual instead - of giving an incomplete summary of the license status. - - - - - Clarify that the webserver target uploads to the SourceForge webserver. - - - - - Mark the documentation for the Mac OS X installers as out of date and - change the SCM name back to CVS. - - - - - Fix the location of the installer modules for Mac OS X. - They are not actually available through git (yet). - - - - - Don't speak of Privoxy version 3 in the past tense. - - - - - Update the list of programs required for the release process. - - - - - Update description of the webserver target which uses ssh, not scp. - - - - - Remove obsolete reference to config.new. + configure: Fix --with-msan option. + Also (probably) reported by Andrew Savchenko. @@ -928,94 +376,42 @@ - Tests: + macOS build system: - Add another hide-referrer{conditional-block} test. - - - - - Add another hide-referrer{conditional-forge} test. - - - - - Fix a hide-referrer{conditional-forge} test - that expected an acceptable header to be forged. + Enable HTTPS inspection when building the macOS binary + (using OpenSSL as TLS library). - - - - Fix a hide-referrer{conditional-block} test - that expected an acceptable Referer to be removed. - - - - - Explain why the "Set Header = Host: whatever.example.org" test is - expected to fail when using a CGI prefix that starts with "https://". - - - - - Explain why a connection-sharing test is known to fail - when using "https://p.p/" as CGI prefix. - - - - - Add a link to Privoxy-Regression-Test to regression-tests.action - in case it isn't packaged. - - - - - Add regression tests for pcre host patterns. - - - - - Fixed a regression test that is executed when - FEATURE_GRACEFUL_TERMINATION is enabled. - - + - Privoxy infrastructure: + Documentation: - Import a Privoxy logo for the website. - - - - - Update Tor onion service to HiddenServiceVersion 3. - - - - - Display the "model" photos in a single row and remove placeholder images. + Add OpenSSL to the list of libraries that may be licensed under the + Apache 2.0 license in which case the linked Privoxy binary has to be + distributed under the GPLv3 or later. - Regenerate homepage with updated sponsor list. + config: Fix the documented ca-directory default value. + Reported by avoidr. - Use the '/sponsor' redirect for the link to the sponsor page. + Rebuild developer-manual and tidy with 'HTML Tidy for FreeBSD version 5.8.0'. - Git commit messages are sent to the Privoxy-commits mailing list. + Update developer manual with new macOS packaging instructions.