X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=doc%2Fsource%2Fp-config.sgml;h=016c827af920ae0b1d426a3509d21ae72a369160;hp=2a90843008c6e3607fd1d0e20fa0a19febfc213b;hb=98f0dc63af857bfe0d54966898a0d3a33821d4f6;hpb=27c1cc4148ed61a32edfdd6e6e3562da7be7bf44 diff --git a/doc/source/p-config.sgml b/doc/source/p-config.sgml index 2a908430..016c827a 100644 --- a/doc/source/p-config.sgml +++ b/doc/source/p-config.sgml @@ -3,9 +3,9 @@ Purpose : Used with other docs and files only. - $Id: p-config.sgml,v 2.27 2008/01/17 01:49:51 hal9 Exp $ + $Id: p-config.sgml,v 2.62 2010/02/15 15:07:56 fabiankeil Exp $ - Copyright (C) 2001-2008 Privoxy Developers http://www.privoxy.org/ + Copyright (C) 2001-2010 Privoxy Developers http://www.privoxy.org/ See LICENSE. ======================================================================== @@ -81,7 +81,9 @@ The main config file controls all aspects of Privoxy's operation that are not location dependent (i.e. they apply universally, no matter - where you may be surfing). + where you may be surfing). Like the filter and action files, the config file is + a plain text file and can be modified with a text editor like emacs, vim or + notepad.exe. ]]> @@ -95,10 +97,10 @@ Sample Configuration File for Privoxy v&p-version; - $Id: p-config.sgml,v 2.27 2008/01/17 01:49:51 hal9 Exp $ + $Id: p-config.sgml,v 2.62 2010/02/15 15:07:56 fabiankeil Exp $ -Copyright (C) 2001-2008 Privoxy Developers http://www.privoxy.org/ +Copyright (C) 2001-2010 Privoxy Developers http://www.privoxy.org/ @@ -338,7 +340,7 @@ II. FORMAT OF THE CONFIGURATION FILE Default value: - Two example URLs are provided + Unset @@ -369,8 +371,8 @@ II. FORMAT OF THE CONFIGURATION FILE -@@trust-info-url http://www.example.com/why_we_block.html]]> -@@trust-info-url http://www.example.com/what_we_allow.html]]> +@@#trust-info-url http://www.example.com/why_we_block.html]]> +@@#trust-info-url http://www.example.com/what_we_allow.html]]> @@ -604,8 +606,7 @@ II. FORMAT OF THE CONFIGURATION FILE The directory where all logging takes place - (i.e. where logfile and - jarfile are located). + (i.e. where the logfile is located). @@ -669,13 +670,13 @@ actionsfile - standard.action # Internal purposes, no editing recommended + match-all.action # Actions that are applied to all sites and maybe overruled later on. - default.action # Main actions file + default.action # Main actions file - user.action # User customizations + user.action # User customizations @@ -695,9 +696,8 @@ actionsfile Multiple actionsfile lines are permitted, and are in fact recommended! - The default values include standard.action, which is used - for internal purposes and should be loaded, default.action, - which is the main actions file maintained by the developers, and + The default values are default.action, which is the + main actions file maintained by the developers, and user.action, where you can make your personal additions. @@ -717,7 +717,7 @@ actionsfile -@@actionsfile standard.action # Internal purpose, recommended]]> +@@actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on.]]> @@actionsfile default.action # Main actions file]]> -jarfile - - - - Specifies: - - - The file to store intercepted cookies in - - - - - Type of value: - - File name, relative to logdir - - - - Default value: - - Unset (commented out). When activated: jarfile (Unix) or privoxy.jar (Windows). - - - - Effect if unset: - - - Intercepted cookies are not stored in a dedicated log file. - - - - - Notes: - - - The jarfile may grow to ridiculous sizes over time. - - - If debug 8 (show header parsing) is enabled, cookies are - also written to the logfile with the rest of the headers. - Therefore this option isn't very useful and may be removed - in future releases. Please report to the developers if you - are still using it. - - - - - -@@#jarfile jarfile]]> - - - trustfile @@ -1058,20 +1005,20 @@ actionsfile - debug 1 # log each request destination (and the crunch reason if &my-app; intercepted the request) - debug 2 # show each connection status - debug 4 # show I/O status - debug 8 # show header parsing - debug 16 # log all data written to the network into the logfile - debug 32 # debug force feature - debug 64 # debug regular expression filters - debug 128 # debug redirects - debug 256 # debug GIF de-animation - debug 512 # Common Log Format - debug 1024 # debug kill pop-ups - debug 2048 # CGI user interface - debug 4096 # Startup banner and warnings. - debug 8192 # Non-fatal errors + debug 1 # Log the destination for each request &my-app; let through. See also debug 1024. + debug 2 # show each connection status + debug 4 # show I/O status + debug 8 # show header parsing + debug 16 # log all data written to the network into the logfile + debug 32 # debug force feature + debug 64 # debug regular expression filters + debug 128 # debug redirects + debug 256 # debug GIF de-animation + debug 512 # Common Log Format + debug 1024 # Log the destination for requests &my-app; didn't let through, and the reason why. + debug 2048 # CGI user interface + debug 4096 # Startup banner and warnings. + debug 8192 # Non-fatal errors @@ -1080,7 +1027,7 @@ actionsfile A debug level of 1 is informative because it will show you each request - as it happens. 1, 4096 and 8192 are recommended + as it happens. 1, 1024, 4096 and 8192 are recommended so that you will notice when things go wrong. The other levels are probably only of interest if you are hunting down a specific problem. They can produce a hell of an output (especially 16). @@ -1113,9 +1060,10 @@ actionsfile -@@#debug 1 # log each request destination (and the crunch reason if &my-app; intercepted the request)]]> -@@#debug 4096 # Startup banner and warnings]]> -@@#debug 8192 # Non-fatal errors]]> +@@#debug 1 # Log the destination for each request &my-app; let through.]]> +@@#debug 1024 # Log the destination for requests &my-app; didn't let through, and the reason why.]]> +@@#debug 4096 # Startup banner and warnings]]> +@@#debug 8192 # Non-fatal errors]]> @@ -1166,6 +1114,62 @@ actionsfile @@#single-threaded]]> + +hostname + + + + Specifies: + + + The hostname shown on the CGI pages. + + + + + Type of value: + + Text + + + + Default value: + + Unset + + + + Effect if unset: + + + The hostname provided by the operating system is used. + + + + + Notes: + + + On some misconfigured systems resolving the hostname fails or + takes too much time and slows Privoxy down. Setting a fixed hostname + works around the problem. + + + In other circumstances it might be desirable to show a hostname + other than the one returned by the operating system. For example + if the system has several different hostnames and you don't want + to use the first one. + + + Note that Privoxy does not validate the specified hostname value. + + + + + +@@#hostname hostname.example.org]]> + + @@ -1211,9 +1215,9 @@ actionsfile Effect if unset: - Bind to 127.0.0.1 (localhost), port 8118. This is suitable and recommended for - home users who run Privoxy on the same machine as - their browser. + Bind to 127.0.0.1 (IPv4 localhost), port 8118. This is suitable and + recommended for home users who run Privoxy on + the same machine as their browser. @@ -1228,9 +1232,12 @@ actionsfile serve requests from other machines (e.g. on your local network) as well, you will need to override the default. + + IPv6 addresses containing colons have to be quoted by brackets. + If you leave out the IP address, Privoxy will - bind to all interfaces (addresses) on your machine and may become reachable + bind to all IPv4 interfaces (addresses) on your machine and may become reachable from the Internet. In that case, consider using access control lists (ACL's, see below), and/or a firewall. @@ -1255,6 +1262,16 @@ actionsfile listen-address 192.168.0.1:8118 + + + + Suppose you are running Privoxy on an + IPv6-capable machine and you want it to listen on the IPv6 address + of the loopback device: + + + + listen-address [::1]:8118 @@ -1609,23 +1626,41 @@ ACLs: permit-access and deny-access Type of value: - src_addr[/src_masklen] - [dst_addr[/dst_masklen]] + src_addr[:port][/src_masklen] + [dst_addr[:port][/dst_masklen]] Where src_addr and - dst_addr are IP addresses in dotted decimal notation or valid - DNS names, and src_masklen and + dst_addr are IPv4 addresses in dotted decimal notation or valid + DNS names, port is a port + number, and src_masklen and dst_masklen are subnet masks in CIDR notation, i.e. integer values from 2 to 30 representing the length (in bits) of the network address. The masks and the whole destination part are optional. + + If your system implements + RFC 3493, then + src_addr and dst_addr can be IPv6 addresses delimeted by + brackets, port can be a number + or a service name, and + src_masklen and + dst_masklen can be a number + from 0 to 128. + Default value: Unset + + If no port is specified, + any port will match. If no src_masklen or + src_masklen is given, the complete IP + address has to match (i.e. 32 bits for IPv4 and 128 bits for IPv6). + @@ -1674,6 +1709,13 @@ ACLs: permit-access and deny-access like *.org or partial domain names. If a DNS name resolves to multiple IP addresses, only the first one is used. + + Some systems allows IPv4 client to connect to IPv6 server socket. + Then the client's IPv4 address will be translated by system into + IPv6 address space with special prefix ::ffff:0:0/96 (so called IPv4 + mapped IPv6 address). Privoxy can handle it + and maps such ACL addresses automatically. + Denying access to particular sites by ACL may have undesired side effects if the site in question is hosted on a machine which also hosts other sites @@ -1715,6 +1757,24 @@ ACLs: permit-access and deny-access deny-access 192.168.45.73 www.dirty-stuff.example.com + + Allow access from the IPv4 network 192.0.2.0/24 even if listening on + an IPv6 wild card address (not supported on all platforms): + + + + permit-access 192.0.2.0/24 + + + + This is equivalent to the following line even if listening on an + IPv4 address (not supported on all platforms): + + + + permit-access [::ffff:192.0.2.0]/120 + + @@ -1836,7 +1896,7 @@ ACLs: permit-access and deny-access denote all URLs. http_parent[:port] is the DNS name or IP address of the parent HTTP proxy through which the requests should be forwarded, - optionally followed by its listening port (default: 8080). + optionally followed by its listening port (default: 8000). Use a single dot (.) to denote no forwarding. @@ -1862,6 +1922,16 @@ ACLs: permit-access and deny-access If http_parent is ., then requests are not forwarded to another HTTP proxy but are made directly to the web servers. + + http_parent can be a + numerical IPv6 address (if + RFC 3493 is + implemented). To prevent clashes with the port delimiter, the whole IP + address has to be put into brackets. On the other hand a target_pattern containing an IPv6 address + has to be put into angle brackets (normal brackets are reserved for + regular expressions already). + Multiple lines are OK, they are checked in sequence, and the last match wins. @@ -1889,6 +1959,24 @@ ACLs: permit-access and deny-access forward .isp.example.net . + + Parent proxy specified by an IPv6 address: + + + + foward / [2001:DB8::1]:8000 + + + + Suppose your parent proxy doesn't support IPv6: + + + + forward / parent-proxy.example.org:8000 + forward ipv6-server.example.org . + forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> . + + @@ -1960,6 +2048,17 @@ forward-socks4, forward-socks4a and forward-socks5 With forward-socks5 the DNS resolution will happen on the remote server as well. + + socks_proxy and + http_parent can be a + numerical IPv6 address (if + RFC 3493 is + implemented). To prevent clashes with the port delimiter, the whole IP + address has to be put into brackets. On the other hand a target_pattern containing an IPv6 address + has to be put into angle brackets (normal brackets are reserved for + regular expressions already). + If http_parent is ., then requests are not forwarded to another HTTP proxy but are made (HTTP-wise) directly to the web servers, albeit through @@ -1997,7 +2096,7 @@ forward-socks4, forward-socks4a and forward-socks5 - forward-socks4a / 127.0.0.1:9050 . + forward-socks5 / 127.0.0.1:9050 . @@ -2178,6 +2277,10 @@ forward-socks4, forward-socks4a and forward-socks5 that go away when you try again manually. Start with a small value and check Privoxy's logfile from time to time, to see how many retries are usually needed. + + Due to a bug, this option currently also causes Privoxy to + retry in case of certain problems with direct connections. + @@ -2192,6 +2295,11 @@ forward-socks4, forward-socks4a and forward-socks5 @@forwarded-connect-retries 0]]> + + + +Miscellaneous + accept-intercepted-requests @@ -2380,6 +2488,468 @@ forward-socks4, forward-socks4a and forward-socks5 @@split-large-forms 0]]> +keep-alive-timeout + + + Specifies: + + + Number of seconds after which an open connection will no longer be reused. + + + + + Type of value: + + + Time in seconds. + + + + + Default value: + + None + + + + Effect if unset: + + + Connections are not kept alive. + + + + + Notes: + + + This option allows clients to keep the connection to &my-app; + alive. If the server supports it, &my-app; will keep + the connection to the server alive as well. Under certain + circumstances this may result in speed-ups. + + + By default, &my-app; will close the connection to the server if + the client connection gets closed, or if the specified timeout + has been reached without a new request coming in. This behaviour + can be changed with the connection-sharing option. + + + This option has no effect if Privoxy + has been compiled without keep-alive support. + + + Note that a timeout of five seconds as used in the default + configuration file significantly decreases the number of + connections that will be reused. The value is used because + some browsers limit the number of connections they open to + a single host and apply the same limit to proxies. This can + result in a single website grabbing all the + connections the browser allows, which means connections to + other websites can't be opened until the connections currently + in use time out. + + + Several users have reported this as a Privoxy bug, so the + default value has been reduced. Consider increasing it to + 300 seconds or even more if you think your browser can handle + it. If your browser appears to be hanging it can't. + + + + + Examples: + + + keep-alive-timeout 300 + + + + +@@keep-alive-timeout 5]]> + + + +default-server-timeout + + + Specifies: + + + Assumed server-side keep-alive timeout if not specified by the server. + + + + + Type of value: + + + Time in seconds. + + + + + Default value: + + None + + + + Effect if unset: + + + Connections for which the server didn't specify the keep-alive + timeout are not reused. + + + + + Notes: + + + Enabling this option significantly increases the number of connections + that are reused, provided the keep-alive-timeout option + is also enabled. + + + While it also increases the number of connections problems + when &my-app; tries to reuse a connection that already has + been closed on the server side, or is closed while &my-app; + is trying to reuse it, this should only be a problem if it + happens for the first request sent by the client. If it happens + for requests on reused client connections, &my-app; will simply + close the connection and the client is supposed to retry the + request without bothering the user. + + + Enabling this option is therefore only recommended if the + connection-sharing option + is disabled. + + + It is an error to specify a value larger than the keep-alive-timeout value. + + + This option has no effect if Privoxy + has been compiled without keep-alive support. + + + + + Examples: + + + default-server-timeout 60 + + + + +@@#default-server-timeout 60]]> + + + +connection-sharing + + + Specifies: + + + Whether or not outgoing connections that have been kept alive + should be shared between different incoming connections. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + None + + + + Effect if unset: + + + Connections are not shared. + + + + + Notes: + + + This option has no effect if Privoxy + has been compiled without keep-alive support, or if it's disabled. + + + + + Notes: + + + Note that reusing connections doesn't necessary cause speedups. + There are also a few privacy implications you should be aware of. + + + If this option is effective, outgoing connections are shared between + clients (if there are more than one) and closing the browser that initiated + the outgoing connection does no longer affect the connection between &my-app; + and the server unless the client's request hasn't been completed yet. + + + If the outgoing connection is idle, it will not be closed until either + Privoxy's or the server's timeout is reached. + While it's open, the server knows that the system running &my-app; is still + there. + + + If there are more than one client (maybe even belonging to multiple users), + they will be able to reuse each others connections. This is potentially + dangerous in case of authentication schemes like NTLM where only the + connection is authenticated, instead of requiring authentication for + each request. + + + If there is only a single client, and if said client can keep connections + alive on its own, enabling this option has next to no effect. If the client + doesn't support connection keep-alive, enabling this option may make sense + as it allows &my-app; to keep outgoing connections alive even if the client + itself doesn't support it. + + + You should also be aware that enabling this option increases the likelihood + of getting the "No server or forwarder data" error message, especially if you + are using a slow connection to the Internet. + + + This option should only be used by experienced users who + understand the risks and can weight them against the benefits. + + + + + Examples: + + + connection-sharing 1 + + + + +@@#connection-sharing 1]]> + + + +socket-timeout + + + Specifies: + + + Number of seconds after which a socket times out if + no data is received. + + + + + Type of value: + + + Time in seconds. + + + + + Default value: + + None + + + + Effect if unset: + + + A default value of 300 seconds is used. + + + + + Notes: + + + For SOCKS requests the timeout currently doesn't start until + the SOCKS server accepted the request. This will be fixed in + the next release. + + + + + Examples: + + + socket-timeout 300 + + + + +@@socket-timeout 300]]> + + + +max-client-connections + + + Specifies: + + + Maximum number of client connections that will be served. + + + + + Type of value: + + + Positive number. + + + + + Default value: + + None + + + + Effect if unset: + + + Connections are served until a resource limit is reached. + + + + + Notes: + + + &my-app; creates one thread (or process) for every incoming client + connection that isn't rejected based on the access control settings. + + + If the system is powerful enough, &my-app; can theoretically deal with + several hundred (or thousand) connections at the same time, but some + operating systems enforce resource limits by shutting down offending + processes and their default limits may be below the ones &my-app; would + require under heavy load. + + + Configuring &my-app; to enforce a connection limit below the thread + or process limit used by the operating system makes sure this doesn't + happen. Simply increasing the operating system's limit would work too, + but if &my-app; isn't the only application running on the system, + you may actually want to limit the resources used by &my-app;. + + + If &my-app; is only used by a single trusted user, limiting the + number of client connections is probably unnecessary. If there + are multiple possibly untrusted users you probably still want to + additionally use a packet filter to limit the maximal number of + incoming connections per client. Otherwise a malicious user could + intentionally create a high number of connections to prevent other + users from using &my-app;. + + + Obviously using this option only makes sense if you choose a limit + below the one enforced by the operating system. + + + + + Examples: + + + max-client-connections 256 + + + + +@@#max-client-connections 256]]> + + + +handle-as-empty-doc-returns-ok + + + Note: + + + This is a work-around for Firefox bug 492459: + + Websites are no longer rendered if SSL requests for JavaScripts are blocked by a proxy. + + (https://bugzilla.mozilla.org/show_bug.cgi?id=492459) + + + + + Specifies: + + + The status code Privoxy returns for pages blocked with + + +handle-as-empty-document. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + 0 + + + + Effect if unset: + + + Privoxy returns a status 403(forbidden) for all blocked pages. + + + + + Effect if set: + + + Privoxy returns a status 200(OK) for pages blocked with +handle-as-empty-document + and a status 403(Forbidden) for all other blocked pages. + + + + +@@handle-as-empty-doc-returns-ok 1]]> + + +