This file belongs into
ijbswa.sourceforge.net:/home/groups/i/ij/ijbswa/htdocs/
- $Id: user-manual.sgml,v 2.44 2007/11/15 03:30:20 hal9 Exp $
+ $Id: user-manual.sgml,v 2.48 2007/11/24 19:07:17 fabiankeil Exp $
Copyright (C) 2001-2007 Privoxy Developers http://www.privoxy.org/
See LICENSE.
</subscript>
</pubdate>
-<pubdate>$Id: user-manual.sgml,v 2.44 2007/11/15 03:30:20 hal9 Exp $</pubdate>
+<pubdate>$Id: user-manual.sgml,v 2.48 2007/11/24 19:07:17 fabiankeil Exp $</pubdate>
<!--
<para>
<itemizedlist>
+ <listitem>
+ <para>
+ The recommended way to upgrade &my-app; is to backup your old
+ configuration files, install the new ones, verify that &my-app;
+ is working correctly and finally merge back your changes using
+ <application>diff</application> and maybe <application>patch</application>.
+ </para>
+ <para>
+ There are a number of new features in each &my-app; release and
+ most of them have to be explicitly enabled in the configuration
+ files. Old configuration files obviously don't do that and due
+ to syntax changes using old configuration files with a new
+ &my-app; isn't always possible anyway.
+ </para>
+ </listitem>
<listitem>
<para>
- Some installers may remove earlier versions completely, including
- configuration files. Save any important configuration files!
+ Note that some installers remove earlier versions completely,
+ including configuration files, therefore you should really save
+ any important configuration files!
</para>
</listitem>
<listitem>
<para>
- On the other hand, other installers may not overwrite any existing configuration
- files, thinking you will want to do that. You may want to manually check
- your saved files against the newer versions to see if the improvements have
- merit, or whether there are new options that you may want to consider.
- There are a number of new features, but most won't be available unless
- these features are incorporated into your configuration somehow.
+ On the other hand, other installers don't overwrite existing configuration
+ files, thinking you will want to do that yourself.
</para>
</listitem>
<listitem>
Not all actions as before.
</para>
</listitem>
- <!--
<listitem>
- <para>
- See the full documentation on
- <literal><link linkend="fast-redirects">fast-redirects</link></literal>
- which has changed syntax, and will require adjustments to local configs,
- such as <filename>user.action</filename>. You must reference the new
- syntax:
- </para>
- <para>
- <screen>
- { +fast-redirects{check-decoded-url} }
- .example.com
- mybank.com
- .google.</screen>
-</para>
-
- </listitem>
- -->
- <listitem>
- <para>
- Logging is off by default now. If you need logging, it can be turned on
- in the <link linkend="logfile">config file</link>.
- </para>
- </listitem>
+ <para>
+ Logging is off by default now. If you need logging, it can be turned on
+ in the <link linkend="logfile">config file</link>. You may also want
+ to enable logging until you verified that the new &my-app; version
+ is working as expected.
+ </para>
+ </listitem>
<listitem>
<para>
Client-header filters are executed after the other header actions have finished
and use their output as input.
</para>
+ <para>
+ If the request URL gets changed, &my-app; will detect that and use the new
+ one. This can be used to rewrite the request destination behind the client's
+ back, for example to specify a Tor exit relay for certain requests.
+ </para>
<para>
Please refer to the <link linkend="filter-file">filter file chapter</link>
to learn which client-header filters are available by default, and how to
# This way you can continue to use Tor for your normal browsing,
# without overloading the Tor network with your FreeBSD ports updates
# or downloads of bigger files like ISOs.
+# Note that HTTP headers are easy to fake and therefore their
+# values are as (un)trustworthy as your clients and users.
{+forward-override{forward .} \
-hide-if-modified-since \
-overwrite-last-modified \
</para>
<para>
Randomizing the value of the <quote>If-Modified-Since:</quote> makes
- sure it isn't used as a cookie replacement, but you will run into
- caching problems if the random range is too high.
+ it less likely that the server can use the time as a cookie replacement,
+ but you will run into caching problems if the random range is too high.
</para>
<para>
It is a good idea to only use a small negative value and let
</para>
<para>
It is also recommended to use this action together with
- <literal><link linkend="crunch-if-none-match">crunch-if-none-match</link></literal>.
+ <literal><link linkend="crunch-if-none-match">crunch-if-none-match</link></literal>,
+ otherwise it's more or less pointless.
</para>
</listitem>
</varlistentry>
<term>Example usage (section):</term>
<listitem>
<para>
- <screen># Let the browser revalidate without being tracked across sessions
-{ +hide-if-modified-since{-60} \
+ <screen># Let the browser revalidate but make tracking based on the time less likely.
+{+hide-if-modified-since{-60} \
+overwrite-last-modified{randomize} \
+crunch-if-none-match}
/</screen>
<varlistentry>
<term>Typical use:</term>
<listitem>
- <para>Improve privacy by not embedding the source of the request in the HTTP headers.</para>
+ <para>Improve privacy by not forwarding the source of the request in the HTTP headers.</para>
</listitem>
</varlistentry>
<term>Effect:</term>
<listitem>
<para>
- Deletes any existing <quote>X-Forwarded-for:</quote> HTTP header from client requests,
- and prevents adding a new one.
+ Deletes any existing <quote>X-Forwarded-for:</quote> HTTP header from client requests.
</para>
</listitem>
</varlistentry>
<term>Notes:</term>
<listitem>
<para>
- It is safe to leave this on.
+ It is safe and recommended to leave this on.
</para>
</listitem>
</varlistentry>
<listitem>
<para><quote>conditional-block</quote> to delete the header completely if the host has changed.</para>
</listitem>
-<!--
<listitem>
<para><quote>conditional-forge</quote> to forge the header if the host has changed.</para>
</listitem>
--->
<listitem>
<para><quote>block</quote> to delete the header unconditionally.</para>
</listitem>
<para>
Always blocking the referrer, or using a custom one, can lead to
failures on servers that check the referrer before they answer any
- requests, in an attempt to prevent their valuable content from being
+ requests, in an attempt to prevent their content from being
embedded or linked to elsewhere.
</para>
<para>
<varlistentry>
<term>Typical use:</term>
<listitem>
- <para>Conceal your type of browser and client operating system</para>
+ <para>Try to conceal your type of browser and client operating system</para>
</listitem>
</varlistentry>
order to customize their content for different browsers (which, by the
way, is <emphasis>NOT</emphasis> the right thing to do: good web sites
work browser-independently).
- <!--
- <ulink url="http://www.javascriptkit.com/javaindex.shtml">smart way to do
- that</ulink>!).
- -->
</para>
</warning>
<para>
<!-- ~~~~~ New section ~~~~~ -->
<sect3 renderas="sect4" id="inspect-jpegs">
<title>inspect-jpegs</title>
-<!--
-new action
--->
<variablelist>
<varlistentry>
<term>Typical use:</term>
<listitem>
- <para>To protect against the MS buffer over-run in JPEG processing</para>
+ <para>Try to protect against a MS buffer over-run in JPEG processing</para>
</listitem>
</varlistentry>
allow execution of code on the target system, giving an attacker access
to the system in question by merely planting an altered JPEG image, which
would have no obvious indications of what lurks inside. This action
- prevents this exploit.
+ tries to prevent this exploit if delivered through unencrypted HTTP.
</para>
<para>
- Note that the described exploit is only one of many,
- using this action does not mean that you no longer
- have to patch the client.
+ Note that the exploit mentioned is several years old
+ and it's unlikely that your client is still vulnerable
+ against it. This action may be removed in one of the
+ next releases.
</para>
</listitem>
This action is most appropriate for browsers that don't have any controls
for unwanted pop-ups. Not recommended for general usage.
</para>
-
- <!--
<para>
- An alternate spelling is <literal>+kill-popup</literal>, which is
- interchangeable.
+ This action doesn't work very reliable and may be removed in future releases.
</para>
- -->
</listitem>
</varlistentry>
(<quote>https://</quote> URLs) through proxies. It works very simply:
the proxy connects to the server on the specified port, and then
short-circuits its connections to the client and to the remote server.
- This can be a big security hole, since CONNECT-enabled proxies can be
- abused as TCP relays very easily.
+ This means CONNECT-enabled proxies can be used as TCP relays very easily.
</para>
<para>
<application>Privoxy</application> relays HTTPS traffic without seeing
<para>
Again, at the start of matching, all actions are disabled, so there is
- no real need to disable any actions here, but we will do that nonetheless,
- to have a complete listing for your reference. (Remember: a <quote>+</quote>
+ no need to disable any actions here. (Remember: a <quote>+</quote>
preceding the action name enables the action, a <quote>-</quote> disables!).
Also note how this long line has been made more readable by splitting it into
multiple lines with line continuation.
# "Defaults" section:
##########################################################################
{ \
- -<link linkend="ADD-HEADER">add-header</link> \
- -<link linkend="CLIENT-HEADER-FILTER">client-header-filter{hide-tor-exit-notation}</link> \
- -<link linkend="BLOCK">block</link> \
- -<link linkend="CONTENT-TYPE-OVERWRITE">content-type-overwrite</link> \
- -<link linkend="CRUNCH-CLIENT-HEADER">crunch-client-header</link> \
- -<link linkend="CRUNCH-IF-NONE-MATCH">crunch-if-none-match</link> \
- -<link linkend="CRUNCH-INCOMING-COOKIES">crunch-incoming-cookies</link> \
- -<link linkend="CRUNCH-SERVER-HEADER">crunch-server-header</link> \
- -<link linkend="CRUNCH-OUTGOING-COOKIES">crunch-outgoing-cookies</link> \
+<link linkend="DEANIMATE-GIFS">deanimate-gifs</link> \
- -<link linkend="DOWNGRADE-HTTP-VERSION">downgrade-http-version</link> \
- -<link linkend="FAST-REDIRECTS">fast-redirects{check-decoded-url}</link> \
- -<link linkend="FILTER-JS-ANNOYANCES">filter{js-annoyances}</link> \
- -<link linkend="FILTER-JS-EVENTS">filter{js-events}</link> \
+<link linkend="FILTER-HTML-ANNOYANCES">filter{html-annoyances}</link> \
- -<link linkend="FILTER-CONTENT-COOKIES">filter{content-cookies}</link> \
+<link linkend="FILTER-REFRESH-TAGS">filter{refresh-tags}</link> \
- -<link linkend="FILTER-UNSOLICITED-POPUPS">filter{unsolicited-popups}</link> \
- -<link linkend="FILTER-ALL-POPUPS">filter{all-popups}</link> \
- -<link linkend="FILTER-IMG-REORDER">filter{img-reorder}</link> \
- -<link linkend="FILTER-BANNERS-BY-SIZE">filter{banners-by-size}</link> \
- -<link linkend="FILTER-BANNERS-BY-LINK">filter{banners-by-link}</link> \
+<link linkend="FILTER-WEBBUGS">filter{webbugs}</link> \
- -<link linkend="FILTER-TINY-TEXTFORMS">filter{tiny-textforms}</link> \
- -<link linkend="FILTER-JUMPING-WINDOWS">filter{jumping-windows}</link> \
- -<link linkend="FILTER-FRAMESET-BORDERS">filter{frameset-borders}</link> \
- -<link linkend="FILTER-DEMORONIZER">filter{demoronizer}</link> \
- -<link linkend="FILTER-SHOCKWAVE-FLASH">filter{shockwave-flash}</link> \
- -<link linkend="FILTER-QUICKTIME-KIOSKMODE">filter{quicktime-kioskmode}</link> \
- -<link linkend="FILTER-FUN">filter{fun}</link> \
- -<link linkend="FILTER-CRUDE-PARENTAL">filter{crude-parental}</link> \
+<link linkend="FILTER-IE-EXPLOITS">filter{ie-exploits}</link> \
- -<link linkend="FILTER-GOOGLE">filter{google}</link> \
- -<link linkend="FILTER-YAHOO">filter{yahoo}</link> \
- -<link linkend="FILTER-MSN">filter{msn}</link> \
- -<link linkend="FILTER-BLOGSPOT">filter{blogspot}</link> \
- -<link linkend="FILTER-NO-PING">filter{no-ping}</link> \
- -<link linkend="FORCE-TEXT-MODE">force-text-mode</link> \
- -<link linkend="HANDLE-AS-EMPTY-DOCUMENT">handle-as-empty-document</link> \
- -<link linkend="HANDLE-AS-IMAGE">handle-as-image</link> \
- -<link linkend="HIDE-ACCEPT-LANGUAGE">hide-accept-language</link> \
- -<link linkend="HIDE-CONTENT-DISPOSITION">hide-content-disposition</link> \
- -<link linkend="HIDE-IF-MODIFIED-SINCE">hide-if-modified-since</link> \
+<link linkend="HIDE-FORWARDED-FOR-HEADERS">hide-forwarded-for-headers</link> \
+<link linkend="HIDE-FROM-HEADER">hide-from-header{block}</link> \
+<link linkend="HIDE-REFERER">hide-referrer{forge}</link> \
- -<link linkend="HIDE-USER-AGENT">hide-user-agent</link> \
- -<link linkend="INSPECT-JPEGS">inspect-jpegs</link> \
- -<link linkend="KILL-POPUPS">kill-popups</link> \
- -<link linkend="LIMIT-CONNECT">limit-connect</link> \
+<link linkend="PREVENT-COMPRESSION">prevent-compression</link> \
- -<link linkend="OVERWRITE-LAST-MODIFIED">overwrite-last-modified</link> \
- -<link linkend="REDIRECT">redirect</link> \
- -<link linkend="SEND-VANILLA-WAFER">send-vanilla-wafer</link> \
- -<link linkend="SEND-WAFER">send-wafer</link> \
- -<link linkend="SERVER-HEADER-FILTER">server-header-filter{xml-to-html}</link> \
- -<link linkend="SERVER-HEADER-FILTER">server-header-filter{html-to-xml}</link> \
+<link linkend="SESSION-COOKIES-ONLY">session-cookies-only</link> \
+<link linkend="SET-IMAGE-BLOCKER">set-image-blocker{pattern}</link> \
- -<link linkend="TREAT-FORBIDDEN-CONNECTS-LIKE-BLOCKS">treat-forbidden-connects-like-blocks</link> \
}
/ # forward slash will match *all* potential URL patterns.</screen>
</para>
<para>
- The default behavior is now set. Note that some actions, like not hiding
+ The default behavior is now set.
+ <!--
+ This needs rewording, but it can wait for now.
+ fk 2007-11-17
+
+ Note that some actions, like not hiding
the user agent, are part of a <quote>general policy</quote> that applies
universally and won't get any exceptions defined later. Other choices,
like not blocking (which is <emphasis>understandably</emphasis> the
default!) need exceptions, i.e. we need to specify explicitly what we
want to block in later sections.
+ -->
</para>
<para>
<para>
<screen>
-# My user.action file. <fred@foobar.com></screen>
+# My user.action file. <fred@example.com></screen>
</para>
<para>
<screen>
{ +<link linkend="BLOCK">block</link> }
www.example.com/nasty-ads/sponsor\.gif
- another.popular.site.net/more/junk/here/</screen>
+ another.example.net/more/junk/here/</screen>
</para>
<para>
<para>
You like the <quote>fun</quote> text replacements in <filename>default.filter</filename>,
- but it is disabled in the distributed actions file. (My colleagues on the team just
- don't have a sense of humour, that's why! ;-). So you'd like to turn it on in your private,
+ but it is disabled in the distributed actions file.
+ So you'd like to turn it on in your private,
update-safe config, once and for all:
</para>
<literal><link linkend="client-header-filter">client-header-filter</link></literal>
to rewrite headers that are send by the client, and
<literal><link linkend="server-header-filter">server-header-filter</link></literal>
- to rewrite headers that are send by the server, and
+ to rewrite headers that are send by the server.
</para>
<para>
<para>
Multiple filter files can be defined through the <literal> <link
linkend="filterfile">filterfile</link></literal> config directive. The filters
- as supplied by the developers will be found in
+ as supplied by the developers are located in
<filename>default.filter</filename>. It is recommended that any locally
defined or modified filters go in a separately defined file such as
<filename>user.filter</filename>.
-
-</para>
+ </para>
<para>
- Command tasks for content filters are to eliminate common annoyances in
+ Common tasks for content filters are to eliminate common annoyances in
HTML and JavaScript, such as pop-up windows,
exit consoles, crippled windows without navigation tools, the
infamous <BLINK> tag etc, to suppress images with certain
</para>
<para>
- Content filtering works on any text-based document type, including
- HTML, JavaScript, CSS etc. (all <literal>text/*</literal>
- MIME types, <emphasis>except</emphasis> <literal>text/plain</literal>).
+ Enabled content filters are applied to any content whose
+ <quote>Content Type</quote> header is recognised as a sign
+ of text-based content, with the exception of <literal>text/plain</literal>.
+ Use the <link linkend="FORCE-TEXT-MODE">force-text-mode</link> action
+ to also filter other content.
+</para>
+
+<para>
Substitutions are made at the source level, so if you want to <quote>roll
your own</quote> filters, you should first be familiar with HTML syntax,
and, of course, regular expressions.
USA
$Log: user-manual.sgml,v $
+ Revision 2.48 2007/11/24 19:07:17 fabiankeil
+ - Mention request rewriting.
+ - Enable the conditional-forge paragraph.
+ - Minor rewordings.
+
+ Revision 2.47 2007/11/18 14:59:47 fabiankeil
+ A few "Note to Upgraders" updates.
+
+ Revision 2.46 2007/11/17 17:24:44 fabiankeil
+ - Use new action defaults.
+ - Minor fixes and rewordings.
+
+ Revision 2.45 2007/11/16 11:48:46 hal9
+ Fix one typo, and add a couple of small refinements.
+
Revision 2.44 2007/11/15 03:30:20 hal9
Results of spell check.
projects / privoxy.git / blobdiff