- <dd>
- <p>Act as if toggled on</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>If set to 0, <span class="APPLICATION">Privoxy</span> will
- start in <span class="QUOTE">"toggled off"</span> mode, i.e.
- mostly behave like a normal, content-neutral proxy with both ad
- blocking and content filtering disabled. See <tt class=
- "LITERAL">enable-remote-toggle</tt> below.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ENABLE-REMOTE-TOGGLE" id=
- "ENABLE-REMOTE-TOGGLE">7.4.3. enable-remote-toggle</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not the <a href=
- "http://config.privoxy.org/toggle" target="_top">web-based
- toggle feature</a> may be used</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p>0 or 1</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>0</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>The web-based toggle feature is disabled.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>When toggled off, <span class="APPLICATION">Privoxy</span>
- mostly acts like a normal, content-neutral proxy, i.e. doesn't
- block ads or filter content.</p>
-
- <p>Access to the toggle feature can <span class=
- "emphasis"><i class="EMPHASIS">not</i></span> be controlled
- separately by <span class="QUOTE">"ACLs"</span> or HTTP
- authentication, so that everybody who can access <span class=
- "APPLICATION">Privoxy</span> (see <span class=
- "QUOTE">"ACLs"</span> and <tt class=
- "LITERAL">listen-address</tt> above) can toggle it for all
- users. So this option is <span class="emphasis"><i class=
- "EMPHASIS">not recommended</i></span> for multi-user
- environments with untrusted users.</p>
-
- <p>Note that malicious client side code (e.g Java) is also
- capable of using this option.</p>
-
- <p>As a lot of <span class="APPLICATION">Privoxy</span> users
- don't read documentation, this feature is disabled by
- default.</p>
-
- <p>Note that you must have compiled <span class=
- "APPLICATION">Privoxy</span> with support for this feature,
- otherwise this option has no effect.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ENABLE-REMOTE-HTTP-TOGGLE" id=
- "ENABLE-REMOTE-HTTP-TOGGLE">7.4.4. enable-remote-http-toggle</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not Privoxy recognizes special HTTP headers to
- change its behaviour.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p>0 or 1</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>0</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Privoxy ignores special HTTP headers.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>When toggled on, the client can change <span class=
- "APPLICATION">Privoxy's</span> behaviour by setting special
- HTTP headers. Currently the only supported special header is
- <span class="QUOTE">"X-Filter: No"</span>, to disable filtering
- for the ongoing request, even if it is enabled in one of the
- action files.</p>
-
- <p>This feature is disabled by default. If you are using
- <span class="APPLICATION">Privoxy</span> in a environment with
- trusted clients, you may enable this feature at your
- discretion. Note that malicious client side code (e.g Java) is
- also capable of using this feature.</p>
-
- <p>This option will be removed in future releases as it has
- been obsoleted by the more general header taggers.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ENABLE-EDIT-ACTIONS" id=
- "ENABLE-EDIT-ACTIONS">7.4.5. enable-edit-actions</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not the <a href=
- "http://config.privoxy.org/show-status" target="_top">web-based
- actions file editor</a> may be used</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p>0 or 1</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>0</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>The web-based actions file editor is disabled.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Access to the editor can <span class="emphasis"><i class=
- "EMPHASIS">not</i></span> be controlled separately by
- <span class="QUOTE">"ACLs"</span> or HTTP authentication, so
- that everybody who can access <span class=
- "APPLICATION">Privoxy</span> (see <span class=
- "QUOTE">"ACLs"</span> and <tt class=
- "LITERAL">listen-address</tt> above) can modify its
- configuration for all users.</p>
-
- <p>This option is <span class="emphasis"><i class=
- "EMPHASIS">not recommended</i></span> for environments with
- untrusted users and as a lot of <span class=
- "APPLICATION">Privoxy</span> users don't read documentation,
- this feature is disabled by default.</p>
-
- <p>Note that malicious client side code (e.g Java) is also
- capable of using the actions editor and you shouldn't enable
- this options unless you understand the consequences and are
- sure your browser is configured correctly.</p>
-
- <p>Note that you must have compiled <span class=
- "APPLICATION">Privoxy</span> with support for this feature,
- otherwise this option has no effect.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ENFORCE-BLOCKS" id="ENFORCE-BLOCKS">7.4.6.
- enforce-blocks</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether the user is allowed to ignore blocks and can
- <span class="QUOTE">"go there anyway"</span>.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Blocks are not enforced.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p><span class="APPLICATION">Privoxy</span> is mainly used to
- block and filter requests as a service to the user, for example
- to block ads and other junk that clogs the pipes. <span class=
- "APPLICATION">Privoxy's</span> configuration isn't perfect and
- sometimes innocent pages are blocked. In this situation it
- makes sense to allow the user to enforce the request and have
- <span class="APPLICATION">Privoxy</span> ignore the block.</p>
-
- <p>In the default configuration <span class=
- "APPLICATION">Privoxy's</span> <span class=
- "QUOTE">"Blocked"</span> page contains a <span class=
- "QUOTE">"go there anyway"</span> link to adds a special string
- (the force prefix) to the request URL. If that link is used,
- <span class="APPLICATION">Privoxy</span> will detect the force
- prefix, remove it again and let the request pass.</p>
-
- <p>Of course <span class="APPLICATION">Privoxy</span> can also
- be used to enforce a network policy. In that case the user
- obviously should not be able to bypass any blocks, and that's
- what the <span class="QUOTE">"enforce-blocks"</span> option is
- for. If it's enabled, <span class="APPLICATION">Privoxy</span>
- hides the <span class="QUOTE">"go there anyway"</span> link. If
- the user adds the force prefix by hand, it will not be accepted
- and the circumvention attempt is logged.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>enforce-blocks 1</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ACLS" id="ACLS">7.4.7. ACLs: permit-access
- and deny-access</a></h4><a name="PERMIT-ACCESS" id=
- "PERMIT-ACCESS"></a><a name="DENY-ACCESS" id="DENY-ACCESS"></a>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Who can access what.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>src_addr</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>][/<tt class=
- "REPLACEABLE"><i>src_masklen</i></tt>] [<tt class=
- "REPLACEABLE"><i>dst_addr</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>][/<tt class=
- "REPLACEABLE"><i>dst_masklen</i></tt>]]</p>
-
- <p>Where <tt class="REPLACEABLE"><i>src_addr</i></tt> and
- <tt class="REPLACEABLE"><i>dst_addr</i></tt> are IPv4 addresses
- in dotted decimal notation or valid DNS names, <tt class=
- "REPLACEABLE"><i>port</i></tt> is a port number, and <tt class=
- "REPLACEABLE"><i>src_masklen</i></tt> and <tt class=
- "REPLACEABLE"><i>dst_masklen</i></tt> are subnet masks in CIDR
- notation, i.e. integer values from 2 to 30 representing the
- length (in bits) of the network address. The masks and the
- whole destination part are optional.</p>
-
- <p>If your system implements <a href=
- "http://tools.ietf.org/html/rfc3493" target="_top">RFC
- 3493</a>, then <tt class="REPLACEABLE"><i>src_addr</i></tt> and
- <tt class="REPLACEABLE"><i>dst_addr</i></tt> can be IPv6
- addresses delimeted by brackets, <tt class=
- "REPLACEABLE"><i>port</i></tt> can be a number or a service
- name, and <tt class="REPLACEABLE"><i>src_masklen</i></tt> and
- <tt class="REPLACEABLE"><i>dst_masklen</i></tt> can be a number
- from 0 to 128.</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class=
- "EMPHASIS">Unset</i></span></p>
-
- <p>If no <tt class="REPLACEABLE"><i>port</i></tt> is specified,
- any port will match. If no <tt class=
- "REPLACEABLE"><i>src_masklen</i></tt> or <tt class=
- "REPLACEABLE"><i>src_masklen</i></tt> is given, the complete IP
- address has to match (i.e. 32 bits for IPv4 and 128 bits for
- IPv6).</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Don't restrict access further than implied by <tt class=
- "LITERAL">listen-address</tt></p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Access controls are included at the request of ISPs and
- systems administrators, and <span class="emphasis"><i class=
- "EMPHASIS">are not usually needed by individual
- users</i></span>. For a typical home user, it will normally
- suffice to ensure that <span class="APPLICATION">Privoxy</span>
- only listens on the localhost (127.0.0.1) or internal (home)
- network address by means of the <a href=
- "config.html#LISTEN-ADDRESS"><span class="emphasis"><i class=
- "EMPHASIS">listen-address</i></span></a> option.</p>
-
- <p>Please see the warnings in the FAQ that <span class=
- "APPLICATION">Privoxy</span> is not intended to be a substitute
- for a firewall or to encourage anyone to defer addressing basic
- security weaknesses.</p>
-
- <p>Multiple ACL lines are OK. If any ACLs are specified,
- <span class="APPLICATION">Privoxy</span> only talks to IP
- addresses that match at least one <tt class=
- "LITERAL">permit-access</tt> line and don't match any
- subsequent <tt class="LITERAL">deny-access</tt> line. In other
- words, the last match wins, with the default being <tt class=
- "LITERAL">deny-access</tt>.</p>
-
- <p>If <span class="APPLICATION">Privoxy</span> is using a
- forwarder (see <tt class="LITERAL">forward</tt> below) for a
- particular destination URL, the <tt class=
- "REPLACEABLE"><i>dst_addr</i></tt> that is examined is the
- address of the forwarder and <span class="emphasis"><i class=
- "EMPHASIS">NOT</i></span> the address of the ultimate target.
- This is necessary because it may be impossible for the local
- <span class="APPLICATION">Privoxy</span> to determine the IP
- address of the ultimate target (that's often what gateways are
- used for).</p>
-
- <p>You should prefer using IP addresses over DNS names, because
- the address lookups take time. All DNS names must resolve! You
- can <span class="emphasis"><i class="EMPHASIS">not</i></span>
- use domain patterns like <span class="QUOTE">"*.org"</span> or
- partial domain names. If a DNS name resolves to multiple IP
- addresses, only the first one is used.</p>
-
- <p>Some systems allow IPv4 clients to connect to IPv6 server
- sockets. Then the client's IPv4 address will be translated by
- the system into IPv6 address space with special prefix
- ::ffff:0:0/96 (so called IPv4 mapped IPv6 address).
- <span class="APPLICATION">Privoxy</span> can handle it and maps
- such ACL addresses automatically.</p>
-
- <p>Denying access to particular sites by ACL may have undesired
- side effects if the site in question is hosted on a machine
- which also hosts other sites (most sites are).</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>Explicitly define the default behavior if no ACL and
- <tt class="LITERAL">listen-address</tt> are set: <span class=
- "QUOTE">"localhost"</span> is OK. The absence of a <tt class=
- "REPLACEABLE"><i>dst_addr</i></tt> implies that <span class=
- "emphasis"><i class="EMPHASIS">all</i></span> destination
- addresses are OK:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- permit-access localhost
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Allow any host on the same class C subnet as www.privoxy.org
- access to nothing but www.example.com (or other domains hosted
- on the same system):</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- permit-access www.privoxy.org/24 www.example.com/32
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Allow access from any host on the 26-bit subnet
- 192.168.45.64 to anywhere, with the exception that
- 192.168.45.73 may not access the IP address behind
- www.dirty-stuff.example.com:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- permit-access 192.168.45.64/26
- deny-access 192.168.45.73 www.dirty-stuff.example.com
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Allow access from the IPv4 network 192.0.2.0/24 even if
- listening on an IPv6 wild card address (not supported on all
- platforms):</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="PROGRAMLISTING">
- permit-access 192.0.2.0/24
-</pre>
- </td>
- </tr>
- </table>
-
- <p>This is equivalent to the following line even if listening
- on an IPv4 address (not supported on all platforms):</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="PROGRAMLISTING">
- permit-access [::ffff:192.0.2.0]/120
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="BUFFER-LIMIT" id="BUFFER-LIMIT">7.4.8.
- buffer-limit</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Maximum size of the buffer for content filtering.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p>Size in Kbytes</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>4096</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Use a 4MB (4096 KB) limit.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>For content filtering, i.e. the <tt class=
- "LITERAL">+filter</tt> and <tt class=
- "LITERAL">+deanimate-gif</tt> actions, it is necessary that
- <span class="APPLICATION">Privoxy</span> buffers the entire
- document body. This can be potentially dangerous, since a
- server could just keep sending data indefinitely and wait for
- your RAM to exhaust -- with nasty consequences. Hence this
- option.</p>
-
- <p>When a document buffer size reaches the <tt class=
- "LITERAL">buffer-limit</tt>, it is flushed to the client
- unfiltered and no further attempt to filter the rest of the
- document is made. Remember that there may be multiple threads
- running, which might require up to <tt class=
- "LITERAL">buffer-limit</tt> Kbytes <span class=
- "emphasis"><i class="EMPHASIS">each</i></span>, unless you have
- enabled <span class="QUOTE">"single-threaded"</span> above.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ENABLE-PROXY-AUTHENTICATION-FORWARDING"
- id="ENABLE-PROXY-AUTHENTICATION-FORWARDING">7.4.9.
- enable-proxy-authentication-forwarding</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not proxy authentication through <span class=
- "APPLICATION">Privoxy</span> should work.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p>0 or 1</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>0</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Proxy authentication headers are removed.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Privoxy itself does not support proxy authentication, but
- can allow clients to authenticate against Privoxy's parent
- proxy.</p>
-
- <p>By default Privoxy (3.0.21 and later) don't do that and
- remove Proxy-Authorization headers in requests and
- Proxy-Authenticate headers in responses to make it harder for
- malicious sites to trick inexperienced users into providing
- login information.</p>
-
- <p>If this option is enabled the headers are forwarded.</p>
-
- <p>Enabling this option is <span class="emphasis"><i class=
- "EMPHASIS">not recommended</i></span> if there is no parent
- proxy that requires authentication or if the local network
- between Privoxy and the parent proxy isn't trustworthy. If
- proxy authentication is only required for some requests, it is
- recommended to use a client header filter to remove the
- authentication headers for requests where they aren't
- needed.</p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
-
- <div class="SECT2">
- <h2 class="SECT2"><a name="FORWARDING" id="FORWARDING">7.5.
- Forwarding</a></h2>
-
- <p>This feature allows routing of HTTP requests through a chain of
- multiple proxies.</p>
-
- <p>Forwarding can be used to chain Privoxy with a caching proxy to
- speed up browsing. Using a parent proxy may also be necessary if the
- machine that <span class="APPLICATION">Privoxy</span> runs on has no
- direct Internet access.</p>
-
- <p>Note that parent proxies can severely decrease your privacy level.
- For example a parent proxy could add your IP address to the request
- headers and if it's a caching proxy it may add the <span class=
- "QUOTE">"Etag"</span> header to revalidation requests again, even
- though you configured Privoxy to remove it. It may also ignore
- Privoxy's header time randomization and use the original values which
- could be used by the server as cookie replacement to track your steps
- between visits.</p>
-
- <p>Also specified here are SOCKS proxies. <span class=
- "APPLICATION">Privoxy</span> supports the SOCKS 4 and SOCKS 4A
- protocols.</p>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="FORWARD" id="FORWARD">7.5.1.
- forward</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>To which parent HTTP proxy specific requests should be
- routed.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>target_pattern</i></tt>
- <tt class="REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>]</p>
-
- <p>where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
- a <a href="actions-file.html#AF-PATTERNS">URL pattern</a> that
- specifies to which requests (i.e. URLs) this forward rule shall
- apply. Use <tt class="LITERAL">/</tt> to denote <span class=
- "QUOTE">"all URLs"</span>. <tt class=
- "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>] is the DNS name or IP address
- of the parent HTTP proxy through which the requests should be
- forwarded, optionally followed by its listening port (default:
- 8000). Use a single dot (<tt class="LITERAL">.</tt>) to denote
- <span class="QUOTE">"no forwarding"</span>.</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class=
- "EMPHASIS">Unset</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Don't use parent HTTP proxies.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>If <tt class="REPLACEABLE"><i>http_parent</i></tt> is
- <span class="QUOTE">"."</span>, then requests are not forwarded
- to another HTTP proxy but are made directly to the web
- servers.</p>
-
- <p><tt class="REPLACEABLE"><i>http_parent</i></tt> can be a
- numerical IPv6 address (if <a href=
- "http://tools.ietf.org/html/rfc3493" target="_top">RFC 3493</a>
- is implemented). To prevent clashes with the port delimiter,
- the whole IP address has to be put into brackets. On the other
- hand a <tt class="REPLACEABLE"><i>target_pattern</i></tt>
- containing an IPv6 address has to be put into angle brackets
- (normal brackets are reserved for regular expressions
- already).</p>
-
- <p>Multiple lines are OK, they are checked in sequence, and the
- last match wins.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>Everything goes to an example parent proxy, except SSL on
- port 443 (which it doesn't handle):</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward / parent-proxy.example.org:8080
- forward :443 .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Everything goes to our example ISP's caching proxy, except
- for requests to that ISP's sites:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward / caching-proxy.isp.example.net:8000
- forward .isp.example.net .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Parent proxy specified by an IPv6 address:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="PROGRAMLISTING">
- forward / [2001:DB8::1]:8000
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Suppose your parent proxy doesn't support IPv6:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="PROGRAMLISTING">
- forward / parent-proxy.example.org:8000
- forward ipv6-server.example.org .
- forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> .
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="SOCKS" id="SOCKS">7.5.2. forward-socks4,
- forward-socks4a, forward-socks5 and forward-socks5t</a></h4><a name=
- "FORWARD-SOCKS4" id="FORWARD-SOCKS4"></a><a name="FORWARD-SOCKS4A"
- id="FORWARD-SOCKS4A"></a>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Through which SOCKS proxy (and optionally to which parent
- HTTP proxy) specific requests should be routed.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>target_pattern</i></tt>
- <tt class="REPLACEABLE"><i>socks_proxy</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>] <tt class=
- "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>]</p>
-
- <p>where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
- a <a href="actions-file.html#AF-PATTERNS">URL pattern</a> that
- specifies to which requests (i.e. URLs) this forward rule shall
- apply. Use <tt class="LITERAL">/</tt> to denote <span class=
- "QUOTE">"all URLs"</span>. <tt class=
- "REPLACEABLE"><i>http_parent</i></tt> and <tt class=
- "REPLACEABLE"><i>socks_proxy</i></tt> are IP addresses in
- dotted decimal notation or valid DNS names (<tt class=
- "REPLACEABLE"><i>http_parent</i></tt> may be <span class=
- "QUOTE">"."</span> to denote <span class="QUOTE">"no HTTP
- forwarding"</span>), and the optional <tt class=
- "REPLACEABLE"><i>port</i></tt> parameters are TCP ports, i.e.
- integer values from 1 to 65535</p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class=
- "EMPHASIS">Unset</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Don't use SOCKS proxies.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Multiple lines are OK, they are checked in sequence, and the
- last match wins.</p>
-
- <p>The difference between <tt class=
- "LITERAL">forward-socks4</tt> and <tt class=
- "LITERAL">forward-socks4a</tt> is that in the SOCKS 4A
- protocol, the DNS resolution of the target hostname happens on
- the SOCKS server, while in SOCKS 4 it happens locally.</p>
-
- <p>With <tt class="LITERAL">forward-socks5</tt> the DNS
- resolution will happen on the remote server as well.</p>
-
- <p><tt class="LITERAL">forward-socks5t</tt> works like vanilla
- <tt class="LITERAL">forward-socks5</tt> but lets <span class=
- "APPLICATION">Privoxy</span> additionally use Tor-specific
- SOCKS extensions. Currently the only supported SOCKS extension
- is optimistic data which can reduce the latency for the first
- request made on a newly created connection.</p>
-
- <p><tt class="REPLACEABLE"><i>socks_proxy</i></tt> and
- <tt class="REPLACEABLE"><i>http_parent</i></tt> can be a
- numerical IPv6 address (if <a href=
- "http://tools.ietf.org/html/rfc3493" target="_top">RFC 3493</a>
- is implemented). To prevent clashes with the port delimiter,
- the whole IP address has to be put into brackets. On the other
- hand a <tt class="REPLACEABLE"><i>target_pattern</i></tt>
- containing an IPv6 address has to be put into angle brackets
- (normal brackets are reserved for regular expressions
- already).</p>
-
- <p>If <tt class="REPLACEABLE"><i>http_parent</i></tt> is
- <span class="QUOTE">"."</span>, then requests are not forwarded
- to another HTTP proxy but are made (HTTP-wise) directly to the
- web servers, albeit through a SOCKS proxy.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>From the company example.com, direct connections are made to
- all <span class="QUOTE">"internal"</span> domains, but
- everything outbound goes through their ISP's proxy by way of
- example.com's corporate SOCKS 4A gateway to the Internet.</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080
- forward .example.com .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>A rule that uses a SOCKS 4 gateway for all destinations but
- no HTTP parent looks like this:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward-socks4 / socks-gw.example.com:1080 .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>To chain Privoxy and Tor, both running on the same system,
- you would use something like:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward-socks5 / 127.0.0.1:9050 .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>The public <span class="APPLICATION">Tor</span> network
- can't be used to reach your local network, if you need to
- access local servers you therefore might want to make some
- exceptions:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward 192.168.*.*/ .
- forward 10.*.*.*/ .
- forward 127.*.*.*/ .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Unencrypted connections to systems in these address ranges
- will be as (un)secure as the local network is, but the
- alternative is that you can't reach the local network through
- <span class="APPLICATION">Privoxy</span> at all. Of course this
- may actually be desired and there is no reason to make these
- exceptions if you aren't sure you need them.</p>
-
- <p>If you also want to be able to reach servers in your local
- network by using their names, you will need additional
- exceptions that look like this:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward localhost/ .
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ADVANCED-FORWARDING-EXAMPLES" id=
- "ADVANCED-FORWARDING-EXAMPLES">7.5.3. Advanced Forwarding
- Examples</a></h4>
-
- <p>If you have links to multiple ISPs that provide various special
- content only to their subscribers, you can configure multiple
- <span class="APPLICATION">Privoxies</span> which have connections to
- the respective ISPs to act as forwarders to each other, so that
- <span class="emphasis"><i class="EMPHASIS">your</i></span> users can
- see the internal content of all ISPs.</p>
-
- <p>Assume that host-a has a PPP connection to isp-a.example.net. And
- host-b has a PPP connection to isp-b.example.org. Both run
- <span class="APPLICATION">Privoxy</span>. Their forwarding
- configuration can look like this:</p>
-
- <p>host-a:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward / .
- forward .isp-b.example.net host-b:8118
-</pre>
- </td>
- </tr>
- </table>
-
- <p>host-b:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward / .
- forward .isp-a.example.org host-a:8118
-</pre>
- </td>
- </tr>
- </table>
-
- <p>Now, your users can set their browser's proxy to use either host-a
- or host-b and be able to browse the internal content of both isp-a
- and isp-b.</p>
-
- <p>If you intend to chain <span class="APPLICATION">Privoxy</span>
- and <span class="APPLICATION">squid</span> locally, then chaining as
- <tt class="LITERAL">browser -> squid -> privoxy</tt> is the
- recommended way.</p>
-
- <p>Assuming that <span class="APPLICATION">Privoxy</span> and
- <span class="APPLICATION">squid</span> run on the same box, your
- <span class="APPLICATION">squid</span> configuration could then look
- like this:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
- <pre class="SCREEN">
- # Define Privoxy as parent proxy (without ICP)
- cache_peer 127.0.0.1 parent 8118 7 no-query
-
- # Define ACL for protocol FTP
- acl ftp proto FTP
-
- # Do not forward FTP requests to Privoxy
- always_direct allow ftp
-
- # Forward all the rest to Privoxy
- never_direct allow all
-</pre>
- </td>
- </tr>
- </table>
-
- <p>You would then need to change your browser's proxy settings to
- <span class="APPLICATION">squid</span>'s address and port. Squid
- normally uses port 3128. If unsure consult <tt class=
- "LITERAL">http_port</tt> in <tt class="FILENAME">squid.conf</tt>.</p>
-
- <p>You could just as well decide to only forward requests you suspect
- of leading to Windows executables through a virus-scanning parent
- proxy, say, on <tt class="LITERAL">antivir.example.com</tt>, port
- 8010:</p>
-
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
- <pre class="SCREEN">
- forward / .
- forward /.*\.(exe|com|dll|zip)$ antivir.example.com:8010
-</pre>
- </td>
- </tr>
- </table>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="FORWARDED-CONNECT-RETRIES" id=
- "FORWARDED-CONNECT-RETRIES">7.5.4. forwarded-connect-retries</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>How often Privoxy retries if a forwarded connection request
- fails.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>Number of retries.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Connections forwarded through other proxies are treated like
- direct connections and no retry attempts are made.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p><tt class=
- "REPLACEABLE"><i>forwarded-connect-retries</i></tt> is mainly
- interesting for socks4a connections, where <span class=
- "APPLICATION">Privoxy</span> can't detect why the connections
- failed. The connection might have failed because of a DNS
- timeout in which case a retry makes sense, but it might also
- have failed because the server doesn't exist or isn't
- reachable. In this case the retry will just delay the
- appearance of Privoxy's error message.</p>
-
- <p>Note that in the context of this option, <span class=
- "QUOTE">"forwarded connections"</span> includes all connections
- that Privoxy forwards through other proxies. This option is not
- limited to the HTTP CONNECT method.</p>
-
- <p>Only use this option, if you are getting lots of
- forwarding-related error messages that go away when you try
- again manually. Start with a small value and check Privoxy's
- logfile from time to time, to see how many retries are usually
- needed.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>forwarded-connect-retries 1</p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
-
- <div class="SECT2">
- <h2 class="SECT2"><a name="MISC" id="MISC">7.6. Miscellaneous</a></h2>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ACCEPT-INTERCEPTED-REQUESTS" id=
- "ACCEPT-INTERCEPTED-REQUESTS">7.6.1.
- accept-intercepted-requests</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether intercepted requests should be treated as valid.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Only proxy requests are accepted, intercepted requests are
- treated as invalid.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>If you don't trust your clients and want to force them to
- use <span class="APPLICATION">Privoxy</span>, enable this
- option and configure your packet filter to redirect outgoing
- HTTP connections into <span class=
- "APPLICATION">Privoxy</span>.</p>
-
- <p>Make sure that <span class="APPLICATION">Privoxy's</span>
- own requests aren't redirected as well. Additionally take care
- that <span class="APPLICATION">Privoxy</span> can't
- intentionally connect to itself, otherwise you could run into
- redirection loops if <span class="APPLICATION">Privoxy's</span>
- listening port is reachable by the outside or an attacker has
- access to the pages you visit.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>accept-intercepted-requests 1</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ALLOW-CGI-REQUEST-CRUNCHING" id=
- "ALLOW-CGI-REQUEST-CRUNCHING">7.6.2.
- allow-cgi-request-crunching</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether requests to <span class=
- "APPLICATION">Privoxy's</span> CGI pages can be blocked or
- redirected.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p><span class="APPLICATION">Privoxy</span> ignores block and
- redirect actions for its CGI pages.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>By default <span class="APPLICATION">Privoxy</span> ignores
- block or redirect actions for its CGI pages. Intercepting these
- requests can be useful in multi-user setups to implement
- fine-grained access control, but it can also render the
- complete web interface useless and make debugging problems
- painful if done without care.</p>
-
- <p>Don't enable this option unless you're sure that you really
- need it.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>allow-cgi-request-crunching 1</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="SPLIT-LARGE-FORMS" id=
- "SPLIT-LARGE-FORMS">7.6.3. split-large-forms</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether the CGI interface should stay compatible with broken
- HTTP clients.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p><span class="emphasis"><i class="EMPHASIS">0</i></span></p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>The CGI form generate long GET URLs.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p><span class="APPLICATION">Privoxy's</span> CGI forms can
- lead to rather long URLs. This isn't a problem as far as the
- HTTP standard is concerned, but it can confuse clients with
- arbitrary URL length limitations.</p>
-
- <p>Enabling split-large-forms causes <span class=
- "APPLICATION">Privoxy</span> to divide big forms into smaller
- ones to keep the URL length down. It makes editing a lot less
- convenient and you can no longer submit all changes at once,
- but at least it works around this browser bug.</p>
-
- <p>If you don't notice any editing problems, there is no reason
- to enable this option, but if one of the submit buttons appears
- to be broken, you should give it a try.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>split-large-forms 1</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="KEEP-ALIVE-TIMEOUT" id=
- "KEEP-ALIVE-TIMEOUT">7.6.4. keep-alive-timeout</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Number of seconds after which an open connection will no
- longer be reused.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>Time in seconds.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>None</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Connections are not kept alive.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>This option allows clients to keep the connection to
- <span class="APPLICATION">Privoxy</span> alive. If the server
- supports it, <span class="APPLICATION">Privoxy</span> will keep
- the connection to the server alive as well. Under certain
- circumstances this may result in speed-ups.</p>
-
- <p>By default, <span class="APPLICATION">Privoxy</span> will
- close the connection to the server if the client connection
- gets closed, or if the specified timeout has been reached
- without a new request coming in. This behaviour can be changed
- with the <a href="#CONNECTION-SHARING" target=
- "_top">connection-sharing</a> option.</p>
-
- <p>This option has no effect if <span class=
- "APPLICATION">Privoxy</span> has been compiled without
- keep-alive support.</p>
-
- <p>Note that a timeout of five seconds as used in the default
- configuration file significantly decreases the number of
- connections that will be reused. The value is used because some
- browsers limit the number of connections they open to a single
- host and apply the same limit to proxies. This can result in a
- single website <span class="QUOTE">"grabbing"</span> all the
- connections the browser allows, which means connections to
- other websites can't be opened until the connections currently
- in use time out.</p>
-
- <p>Several users have reported this as a Privoxy bug, so the
- default value has been reduced. Consider increasing it to 300
- seconds or even more if you think your browser can handle it.
- If your browser appears to be hanging, it probably can't.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>keep-alive-timeout 300</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="TOLERATE-PIPELINING" id=
- "TOLERATE-PIPELINING">7.6.5. tolerate-pipelining</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not pipelined requests should be served.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>None</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>If Privoxy receives more than one request at once, it
- terminates the client connection after serving the first
- one.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p><span class="APPLICATION">Privoxy</span> currently doesn't
- pipeline outgoing requests, thus allowing pipelining on the
- client connection is not guaranteed to improve the
- performance.</p>
-
- <p>By default <span class="APPLICATION">Privoxy</span> tries to
- discourage clients from pipelining by discarding aggressively
- pipelined requests, which forces the client to resend them
- through a new connection.</p>
-
- <p>This option lets <span class="APPLICATION">Privoxy</span>
- tolerate pipelining. Whether or not that improves performance
- mainly depends on the client configuration.</p>
-
- <p>If you are seeing problems with pages not properly loading,
- disabling this option could work around the problem.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>tolerate-pipelining 1</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="DEFAULT-SERVER-TIMEOUT" id=
- "DEFAULT-SERVER-TIMEOUT">7.6.6. default-server-timeout</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Assumed server-side keep-alive timeout if not specified by
- the server.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>Time in seconds.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>None</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Connections for which the server didn't specify the
- keep-alive timeout are not reused.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Enabling this option significantly increases the number of
- connections that are reused, provided the <a href=
- "#KEEP-ALIVE-TIMEOUT" target="_top">keep-alive-timeout</a>
- option is also enabled.</p>
-
- <p>While it also increases the number of connections problems
- when <span class="APPLICATION">Privoxy</span> tries to reuse a
- connection that already has been closed on the server side, or
- is closed while <span class="APPLICATION">Privoxy</span> is
- trying to reuse it, this should only be a problem if it happens
- for the first request sent by the client. If it happens for
- requests on reused client connections, <span class=
- "APPLICATION">Privoxy</span> will simply close the connection
- and the client is supposed to retry the request without
- bothering the user.</p>
-
- <p>Enabling this option is therefore only recommended if the
- <a href="#CONNECTION-SHARING" target=
- "_top">connection-sharing</a> option is disabled.</p>
-
- <p>It is an error to specify a value larger than the <a href=
- "#KEEP-ALIVE-TIMEOUT" target="_top">keep-alive-timeout</a>
- value.</p>
-
- <p>This option has no effect if <span class=
- "APPLICATION">Privoxy</span> has been compiled without
- keep-alive support.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>default-server-timeout 60</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="CONNECTION-SHARING" id=
- "CONNECTION-SHARING">7.6.7. connection-sharing</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not outgoing connections that have been kept
- alive should be shared between different incoming
- connections.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>None</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Connections are not shared.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>This option has no effect if <span class=
- "APPLICATION">Privoxy</span> has been compiled without
- keep-alive support, or if it's disabled.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Note that reusing connections doesn't necessary cause
- speedups. There are also a few privacy implications you should
- be aware of.</p>
-
- <p>If this option is effective, outgoing connections are shared
- between clients (if there are more than one) and closing the
- browser that initiated the outgoing connection does no longer
- affect the connection between <span class=
- "APPLICATION">Privoxy</span> and the server unless the client's
- request hasn't been completed yet.</p>
-
- <p>If the outgoing connection is idle, it will not be closed
- until either <span class="APPLICATION">Privoxy's</span> or the
- server's timeout is reached. While it's open, the server knows
- that the system running <span class=
- "APPLICATION">Privoxy</span> is still there.</p>
-
- <p>If there are more than one client (maybe even belonging to
- multiple users), they will be able to reuse each others
- connections. This is potentially dangerous in case of
- authentication schemes like NTLM where only the connection is
- authenticated, instead of requiring authentication for each
- request.</p>
-
- <p>If there is only a single client, and if said client can
- keep connections alive on its own, enabling this option has
- next to no effect. If the client doesn't support connection
- keep-alive, enabling this option may make sense as it allows
- <span class="APPLICATION">Privoxy</span> to keep outgoing
- connections alive even if the client itself doesn't support
- it.</p>
-
- <p>You should also be aware that enabling this option increases
- the likelihood of getting the "No server or forwarder data"
- error message, especially if you are using a slow connection to
- the Internet.</p>
-
- <p>This option should only be used by experienced users who
- understand the risks and can weight them against the
- benefits.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>connection-sharing 1</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="SOCKET-TIMEOUT" id="SOCKET-TIMEOUT">7.6.8.
- socket-timeout</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Number of seconds after which a socket times out if no data
- is received.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>Time in seconds.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>None</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>A default value of 300 seconds is used.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>The default is quite high and you probably want to reduce
- it. If you aren't using an occasionally slow proxy like Tor,
- reducing it to a few seconds should be fine.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>socket-timeout 300</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="MAX-CLIENT-CONNECTIONS" id=
- "MAX-CLIENT-CONNECTIONS">7.6.9. max-client-connections</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Maximum number of client connections that will be
- served.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>Positive number.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>128</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Connections are served until a resource limit is
- reached.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p><span class="APPLICATION">Privoxy</span> creates one thread
- (or process) for every incoming client connection that isn't
- rejected based on the access control settings.</p>
-
- <p>If the system is powerful enough, <span class=
- "APPLICATION">Privoxy</span> can theoretically deal with
- several hundred (or thousand) connections at the same time, but
- some operating systems enforce resource limits by shutting down
- offending processes and their default limits may be below the
- ones <span class="APPLICATION">Privoxy</span> would require
- under heavy load.</p>
-
- <p>Configuring <span class="APPLICATION">Privoxy</span> to
- enforce a connection limit below the thread or process limit
- used by the operating system makes sure this doesn't happen.
- Simply increasing the operating system's limit would work too,
- but if <span class="APPLICATION">Privoxy</span> isn't the only
- application running on the system, you may actually want to
- limit the resources used by <span class=
- "APPLICATION">Privoxy</span>.</p>
-
- <p>If <span class="APPLICATION">Privoxy</span> is only used by
- a single trusted user, limiting the number of client
- connections is probably unnecessary. If there are multiple
- possibly untrusted users you probably still want to
- additionally use a packet filter to limit the maximal number of
- incoming connections per client. Otherwise a malicious user
- could intentionally create a high number of connections to
- prevent other users from using <span class=
- "APPLICATION">Privoxy</span>.</p>
-
- <p>Obviously using this option only makes sense if you choose a
- limit below the one enforced by the operating system.</p>
-
- <p>One most POSIX-compliant systems <span class=
- "APPLICATION">Privoxy</span> can't properly deal with more than
- FD_SETSIZE file descriptors at the same time and has to reject
- connections if the limit is reached. This will likely change in
- a future version, but currently this limit can't be increased
- without recompiling <span class="APPLICATION">Privoxy</span>
- with a different FD_SETSIZE limit.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <p>max-client-connections 256</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="HANDLE-AS-EMPTY-DOC-RETURNS-OK" id=
- "HANDLE-AS-EMPTY-DOC-RETURNS-OK">7.6.10.
- handle-as-empty-doc-returns-ok</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>The status code Privoxy returns for pages blocked with
- <tt class="LITERAL"><a href=
- "actions-file.html#HANDLE-AS-EMPTY-DOCUMENT" target=
- "_top">+handle-as-empty-document</a></tt>.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>0</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Privoxy returns a status 403(forbidden) for all blocked
- pages.</p>
- </dd>
-
- <dt>Effect if set:</dt>
-
- <dd>
- <p>Privoxy returns a status 200(OK) for pages blocked with
- +handle-as-empty-document and a status 403(Forbidden) for all
- other blocked pages.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>This is a work-around for Firefox bug 492459: <span class=
- "QUOTE">" Websites are no longer rendered if SSL requests for
- JavaScripts are blocked by a proxy. "</span> (<a href=
- "https://bugzilla.mozilla.org/show_bug.cgi?id=492459" target=
- "_top">https://bugzilla.mozilla.org/show_bug.cgi?id=492459</a>)
- As the bug has been fixed for quite some time this option
- should no longer be needed and will be removed in a future
- release. Please speak up if you have a reason why the option
- should be kept around.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="ENABLE-COMPRESSION" id=
- "ENABLE-COMPRESSION">7.6.11. enable-compression</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>Whether or not buffered content is compressed before
- delivery.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>0 or 1</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>0</p>
- </dd>
-
- <dt>Effect if unset:</dt>
-
- <dd>
- <p>Privoxy does not compress buffered content.</p>
- </dd>
-
- <dt>Effect if set:</dt>
-
- <dd>
- <p>Privoxy compresses buffered content before delivering it to
- the client, provided the client supports it.</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>This directive is only supported if Privoxy has been
- compiled with FEATURE_COMPRESSION, which should not to be
- confused with FEATURE_ZLIB.</p>
-
- <p>Compressing buffered content is mainly useful if Privoxy and
- the client are running on different systems. If they are
- running on the same system, enabling compression is likely to
- slow things down. If you didn't measure otherwise, you should
- assume that it does and keep this option disabled.</p>
-
- <p>Privoxy will not compress buffered content below a certain
- length.</p>
- </dd>
- </dl>
- </div>
- </div>
-
- <div class="SECT3">
- <h4 class="SECT3"><a name="COMPRESSION-LEVEL" id=
- "COMPRESSION-LEVEL">7.6.12. compression-level</a></h4>
-
- <div class="VARIABLELIST">
- <dl>
- <dt>Specifies:</dt>
-
- <dd>
- <p>The compression level that is passed to the zlib library
- when compressing buffered content.</p>
- </dd>
-
- <dt>Type of value:</dt>
-
- <dd>
- <p><tt class="REPLACEABLE"><i>Positive number ranging from 0 to
- 9.</i></tt></p>
- </dd>
-
- <dt>Default value:</dt>
-
- <dd>
- <p>1</p>
- </dd>
-
- <dt>Notes:</dt>
-
- <dd>
- <p>Compressing the data more takes usually longer than
- compressing it less or not compressing it at all. Which level
- is best depends on the connection between Privoxy and the
- client. If you can't be bothered to benchmark it for yourself,
- you should stick with the default and keep compression
- disabled.</p>
-
- <p>If compression is disabled, the compression level is
- irrelevant.</p>
- </dd>
-
- <dt>Examples:</dt>
-
- <dd>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
- <pre class="SCREEN">
- # Best speed (compared to the other levels)
- compression-level 1
- # Best compression
- compression-level 9