X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=doc%2Fsource%2Fp-config.sgml;h=780198238c19032dc8b12f8baf5aee32f91cf19b;hp=5c02fefb556431cd36d390377fd217750352e76f;hb=f903dd17a79cbafcff8610a7025b027af7991467;hpb=07b35a87c4fc709390efc2c1f34b9fe3f9fd07f7 diff --git a/doc/source/p-config.sgml b/doc/source/p-config.sgml index 5c02fefb..78019823 100644 --- a/doc/source/p-config.sgml +++ b/doc/source/p-config.sgml @@ -3,9 +3,9 @@ Purpose : Used with other docs and files only. - $Id: p-config.sgml,v 2.7 2006/09/04 18:09:06 hal9 Exp $ + $Id: p-config.sgml,v 2.13 2007/01/27 13:13:44 fabiankeil Exp $ - Copyright (C) 2001-2006 Privoxy Developers + Copyright (C) 2001-2007 Privoxy Developers http://www.privoxy.org/ See LICENSE. ======================================================================== @@ -95,10 +95,10 @@ Sample Configuration File for Privoxy v&p-version; - $Id: p-config.sgml,v 2.7 2006/09/04 18:09:06 hal9 Exp $ + $Id: p-config.sgml,v 2.13 2007/01/27 13:13:44 fabiankeil Exp $ -Copyright (C) 2001-2006 Privoxy Developers http://privoxy.org +Copyright (C) 2001-2007 Privoxy Developers http://www.privoxy.org/ @@ -110,8 +110,8 @@ Copyright (C) 2001-2006 Privoxy Developers http://privoxy.org I. INTRODUCTION # II. FORMAT OF THE CONFIGURATION FILE # # - 1. CONFIGURATION AND LOG FILE LOCATIONS # - 2. LOCAL SET-UP DOCUMENTATION # + 1. LOCAL SET-UP DOCUMENTATION # + 2. CONFIGURATION AND LOG FILE LOCATIONS # 3. DEBUGGING # 4. ACCESS CONTROL AND SECURITY # 5. FORWARDING # @@ -125,15 +125,21 @@ Copyright (C) 2001-2006 Privoxy Developers http://privoxy.org =============== - This file holds the Privoxy configuration. If you modify this - file, you will need to send a couple of requests (of any kind) to the proxy - before any changes take effect. + This file holds Privoxy's main configuration. Privoxy detects + configuration changes automatically, so you don't have to restart it + unless you want to load a different configuration file. - When starting Privoxy on Unix systems, give the name of this - file as an argument. On Windows systems, Privoxy will look for - this file with the name 'config.txt' in the same directory where - Privoxy is installed. + The configuration will be reloaded with the first request after the + change was done, this request itself will still use the old configuration, + though. In other words: it takes two requests before you see the result of + your changes. Requests that are dropped due to ACL don't trigger reloads. + + + When starting Privoxy on Unix systems, give the location of this + file as last argument. On Windows systems, Privoxy will look for + this file with the name 'config.txt' in the current working directory + of the Privoxy process. @@ -160,10 +166,11 @@ II. FORMAT OF THE CONFIGURATION FILE Thus, by placing a # at the start of an existing configuration line, you can make it a comment and it will be treated as if it weren't there. - This is called "commenting out" an option and can be useful. + This is called "commenting out" an option and can be useful. Removing + the # again is called "uncommenting". - Note that commenting out and option and leaving it at its default + Note that commenting out an option and leaving it at its default are two completely different things! Most options behave very differently when unset. See the the "Effect if unset" explanation in each option's description for details. @@ -179,226 +186,271 @@ II. FORMAT OF THE CONFIGURATION FILE - - -Configuration and Log File Locations - - Privoxy can (and normally does) use a number of - other files for additional configuration, help and logging. - This section of the configuration file tells Privoxy - where to find those other files. - + + +Local Set-up Documentation - - The user running Privoxy, must have read - permission for all configuration files, and write permission to any files - that would be modified, such as log files and actions files. - + + If you intend to operate Privoxy for more users + than just yourself, it might be a good idea to let them know how to reach + you, what you block and why you do that, your policies, etc. + -confdir - +user-manual Specifies: - The directory where the other configuration files are located + + Location of the Privoxy User Manual. + Type of value: - Path name + A fully qualified URI Default value: - /etc/privoxy (Unix) or Privoxy installation dir (Windows) + Unset Effect if unset: - Mandatory + + http://www.privoxy.org/version/user-manual/ + will be used, where version is the Privoxy version. + Notes: + + The User Manual URI is the single best source of information on + Privoxy, and is used for help links from some + of the internal CGI pages. The manual itself is normally packaged with the + binary distributions, so you probably want to set this to a locally + installed copy. + - No trailing /, please + Examples: + + + + The best all purpose solution is simply to put the full local + PATH to where the User Manual is + located: + + +   user-manual  /usr/share/doc/privoxy/user-manual + + + The User Manual is then available to anyone with access to the proxy, by + following the built-in URL: http://config.privoxy.org/user-manual/ + (or the shortcut: http://p.p/user-manual/). + + + If the documentation is not on the local system, it can be accessed + from a remote server, as: + + +   user-manual  http://example.com/privoxy/user-manual/ + + + + + If set, this option should be the first option in the config + file, because it is used while the config file is being read + on start-up. + + ]]> + + - When development goes modular and multi-user, the blocker, filter, and - per-user config will be stored in subdirectories of confdir. - For now, the configuration directory structure is flat, except for - confdir/templates, where the HTML templates for CGI - output reside (e.g. Privoxy's 404 error page). + WARNING!!! - +
+ + If set, this option should be the first option in the config + file, because it is used while the config file is being read. + +
+ ]]> + + -@@confdir .]]> +@@#user-manual http://www.privoxy.org/user-manual/]]> -logdir +trust-info-url Specifies: - The directory where all logging takes place (i.e. where logfile and - jarfile are located) + A URL to be displayed in the error page that users will see if access to an untrusted page is denied. Type of value: - Path name + URL Default value: - /var/log/privoxy (Unix) or Privoxy installation dir (Windows) + Two example URL are provided Effect if unset: - Mandatory + + No links are displayed on the "untrusted" error page. + Notes: - No trailing /, please + The value of this option only matters if the experimental trust mechanism has been + activated. (See trustfile above.) + + + If you use the trust mechanism, it is a good idea to write up some on-line + documentation about your trust policy and to specify the URL(s) here. + Use multiple times for multiple URLs. + + + The URL(s) should be added to the trustfile as well, so users don't end up + locked out from the information on why they were locked out in the first place! -@@logdir .]]> +@@trust-info-url http://www.example.com/why_we_block.html]]> +@@trust-info-url http://www.example.com/what_we_allow.html]]> - -actionsfile - - - - - +admin-address + Specifies: - The actions file(s) to use + An email address to reach the proxy administrator. Type of value: - File name, relative to confdir, without the .action suffix + Email address - Default values: + Default value: - - - standard # Internal purposes, no editing recommended - - - default # Main actions file - - - user # User customizations - - + Unset Effect if unset: - No actions are taken at all. Simple neutral proxying. + No email address is displayed on error pages and the CGI user interface. Notes: - - Multiple actionsfile lines are permitted, and are in fact recommended! - - - The default values include standard.action, which is used for internal - purposes and should be loaded, default.action, which is the - main actions file maintained by the developers, and - user.action, where you can make your personal additions. - - - Actions files are where all the per site and per URL configuration is done for - ad blocking, cookie management, privacy considerations, etc. - There is no point in using Privoxy without at - least one actions file. - + + If both admin-address and proxy-info-url + are unset, the whole "Local Privoxy Support" box on all generated pages will + not be shown. + - - -@@actionsfile standard # Internal purpose, recommended]]> -@@actionsfile default # Main actions file]]> -@@actionsfile user # User customizations]]> +@@#admin-address privoxy-admin@example.com]]> + -filterfile - +proxy-info-url + Specifies: - The filter file(s) to use + A URL to documentation about the local Privoxy setup, + configuration or policies. Type of value: - File name, relative to confdir + URL Default value: - default.filter (Unix) or default.filter.txt (Windows) + Unset Effect if unset: - No textual content filtering takes place, i.e. all - +filter{name} - actions in the actions files are turned neutral. + No link to local documentation is displayed on error pages and the CGI user interface. @@ -406,491 +458,485 @@ actionsfile Notes: - Multiple filterfile lines are permitted. - - - The filter files contain content modification - rules that use regular expressions. These rules permit - powerful changes on the content of Web pages, and optionally the headers - as well, e.g., you could disable your favorite JavaScript annoyances, - re-write the actual displayed text, or just have some fun - playing buzzword bingo with web pages. - - - The - +filter{name} - actions rely on the relevant filter (name) - to be defined in a filter file! - - - A pre-defined filter file called default.filter that contains - a number of useful filters for common problems is included in the distribution. - See the section on the filter - action for a list. - + If both admin-address and proxy-info-url + are unset, the whole "Local Privoxy Support" box on all generated pages will + not be shown. + - It is recommended to place any locally adapted filters into a separate - file, such as user.filter. - + This URL shouldn't be blocked ;-) + -@@filterfile default.filter]]> -@@#filterfile user.filter # User customizations]]> +@@#proxy-info-url http://www.example.com/proxy-service.html]]> + + + + -logfile - - - Specifies: - - - The log file to use - - - - - Type of value: - - File name, relative to logdir - - - - Default value: - - logfile (Unix) or privoxy.log (Windows) + +Configuration and Log File Locations + + + Privoxy can (and normally does) use a number of + other files for additional configuration, help and logging. + This section of the configuration file tells Privoxy + where to find those other files. + + + + The user running Privoxy, must have read + permission for all configuration files, and write permission to any files + that would be modified, such as log files and actions files. + + + + +confdir + + + + Specifies: + + The directory where the other configuration files are located + + + + Type of value: + + Path name + + + + Default value: + + /etc/privoxy (Unix) or Privoxy installation dir (Windows) Effect if unset: - - No log file is used, all log messages go to the console (STDERR). - + Mandatory Notes: - - The logfile is where all logging and error messages are written. The level - of detail and number of messages are set with the debug - option (see below). The logfile can be useful for tracking down a problem with - Privoxy (e.g., it's not blocking an ad you - think it should block) but in most cases you probably will never look at it. - - - Your logfile will grow indefinitely, and you will probably want to - periodically remove it. On Unix systems, you can do this with a cron job - (see man cron). For Red Hat, a logrotate - script has been included. - - - On SuSE Linux systems, you can place a line like /var/log/privoxy.* - +1024k 644 nobody.nogroup in /etc/logfiles, with - the effect that cron.daily will automatically archive, gzip, and empty the - log, when it exceeds 1M size. + No trailing /, please + -@@logfile logfile]]> +@@confdir .]]> - -jarfile +templdir Specifies: - - The file to store intercepted cookies in - + An alternative directory where the templates are loaded from Type of value: - File name, relative to logdir + Path name Default value: - Unset (commented out). When activated: jarfile (Unix) or privoxy.jar (Windows) + unset Effect if unset: - - Intercepted cookies are not stored in a dedicated log file. - + The templates are assumed to be located in confdir/template. Notes: - The jarfile may grow to ridiculous sizes over time. - - - If debug 8 (show header parsing) is enabled, cookies are - written to the logfile with the rest of the headers. + Privoxy's original templates are usually overwritten + with each update. Use this option to relocate customized templates + that should be kept. Note that you might be missing new features + if you use outdated templates. -@@#jarfile jarfile]]> +@@#templdir .]]> -trustfile +logdir + Specifies: - The trust file to use + The directory where all logging takes place (i.e. where logfile and + jarfile are located) Type of value: - File name, relative to confdir + Path name Default value: - Unset (commented out). When activated: trust (Unix) or trust.txt (Windows) + /var/log/privoxy (Unix) or Privoxy installation dir (Windows) Effect if unset: - - The entire trust mechanism is turned off. - + Mandatory Notes: - The trust mechanism is an experimental feature for building white-lists and should - be used with care. It is NOT recommended for the casual user. - - - If you specify a trust file, Privoxy will only allow - access to sites that are specified in the trustfile. Sites can be listed - in one of two ways: + No trailing /, please + + + + +@@logdir .]]> + + + + + +actionsfile + + + + + + + + Specifies: + - Prepending a ~ character limits access to this site - only (and any sub-paths within this site), e.g. - ~www.example.com. + The actions file(s) to use + + + + Type of value: + + File name, relative to confdir, without the .action suffix + + + + Default values: + + + + standard # Internal purposes, no editing recommended + + + default # Main actions file + + + user # User customizations + + + + + + Effect if unset: + - Or, you can designate sites as trusted referrers, by - prepending the name with a + character. The effect is that - access to untrusted sites will be granted -- but only if a link from this - trusted referrer was used. The link target will then be added to the - trustfile so that future, direct accesses will be granted. - Sites added via this mechanism do not become trusted referrers themselves - (i.e. they are added with a ~ designation). + No actions are taken at all. Simple neutral proxying. + + + + Notes: + - If you use the + operator in the trust file, it may grow - considerably over time. + Multiple actionsfile lines are permitted, and are in fact recommended! - - It is recommended that Privoxy be compiled with - the --disable-force, --disable-toggle and - --disable-editor options, if this feature is to be - used. + + The default values include standard.action, which is used for internal + purposes and should be loaded, default.action, which is the + main actions file maintained by the developers, and + user.action, where you can make your personal additions. - - Possible applications include limiting Internet access for children. + + Actions files are where all the per site and per URL configuration is done for + ad blocking, cookie management, privacy considerations, etc. + There is no point in using Privoxy without at + least one actions file. - -@@#trustfile trust]]> + + +@@actionsfile standard # Internal purpose, recommended]]> +@@actionsfile default # Main actions file]]> +@@actionsfile user # User customizations]]> - - - - - -Local Set-up Documentation - - - If you intend to operate Privoxy for more users - than just yourself, it might be a good idea to let them know how to reach - you, what you block and why you do that, your policies, etc. - - - - -user-manual +filterfile + Specifies: - Location of the Privoxy User Manual. + The filter file(s) to use Type of value: - A fully qualified URI + File name, relative to confdir Default value: - Unset + default.filter (Unix) or default.filter.txt (Windows) Effect if unset: - http://www.privoxy.org/version/user-manual/ - will be used, where version is the Privoxy version. + No textual content filtering takes place, i.e. all + +filter{name} + actions in the actions files are turned neutral. Notes: - - The User Manual URI is used for help links from some of the internal CGI pages. - The manual itself is normally packaged with the binary distributions, so you probably want - to set this to a locally installed copy. For multi-user setups, you could provide a copy on - a local webserver for all your users and use the corresponding URL here. + + Multiple filterfile lines are permitted. - Examples: + The filter files contain content modification + rules that use regular expressions. These rules permit + powerful changes on the content of Web pages, and optionally the headers + as well, e.g., you could disable your favorite JavaScript annoyances, + re-write the actual displayed text, or just have some fun + playing buzzword bingo with web pages. - - Unix, in local filesystem: - - -   user-manual  file:///usr/share/doc/privoxy-&p-version;/user-manual/ - - - Windows, in local filesystem, must use forward slash notation: - - -   user-manual  file:/c:/some-dir/privoxy-&p-version;/user-manual/ - - - Windows, UNC notation (with forward slashes): - - -   user-manual  file://///some-server/some-path/privoxy-&p-version;/user-manual/ - - - Any platform, on local webserver (called local-webserver): - - -   user-manual  http://local-webserver/privoxy-user-manual/ - - - - If set, this option should be the first option in the config - file, because it is used while the config file is being read. + The + +filter{name} + actions rely on the relevant filter (name) + to be defined in a filter file! - - ]]> - - - WARNING!!! + A pre-defined filter file called default.filter that contains + a number of useful filters for common problems is included in the distribution. + See the section on the filter + action for a list. -
- - If set, this option should be the first option in the config - file, because it is used while the config file is being read. - -
- ]]> - - + + It is recommended to place any locally adapted filters into a separate + file, such as user.filter. + + -@@#user-manual http://www.privoxy.org/user-manual/]]> +@@filterfile default.filter]]> +@@#filterfile user.filter # User customizations]]> -trust-info-url +logfile Specifies: - A URL to be displayed in the error page that users will see if access to an untrusted page is denied. + The log file to use Type of value: - URL + File name, relative to logdir Default value: - Two example URL are provided + logfile (Unix) or privoxy.log (Windows) Effect if unset: - No links are displayed on the "untrusted" error page. + No log file is used, all log messages go to the console (STDERR). Notes: + - If you use the trust mechanism, it is a good idea to write up some on-line - documentation about your trust policy and to specify the URL(s) here. - Use multiple times for multiple URLs. + The logfile is where all logging and error messages are written. The level + of detail and number of messages are set with the debug + option (see below). The logfile can be useful for tracking down a problem with + Privoxy (e.g., it's not blocking an ad you + think it should block) but in most cases you probably will never look at it. - The URL(s) should be added to the trustfile as well, so users don't end up - locked out from the information on why they were locked out in the first place! + Your logfile will grow indefinitely, and you will probably want to + periodically remove it. On Unix systems, you can do this with a cron job + (see man cron). For Red Hat, a logrotate + script has been included. + + + On SuSE Linux systems, you can place a line like /var/log/privoxy.* + +1024k 644 nobody.nogroup in /etc/logfiles, with + the effect that cron.daily will automatically archive, gzip, and empty the + log, when it exceeds 1M size. + + + Any log files must be writable by whatever user Privoxy + is being run as (default on UNIX, user id is privoxy). -@@trust-info-url http://www.example.com/why_we_block.html]]> -@@trust-info-url http://www.example.com/what_we_allow.html]]> +@@logfile logfile]]> -admin-address +jarfile Specifies: - An email address to reach the proxy administrator. + The file to store intercepted cookies in Type of value: - Email address + File name, relative to logdir Default value: - Unset + Unset (commented out). When activated: jarfile (Unix) or privoxy.jar (Windows) Effect if unset: - No email address is displayed on error pages and the CGI user interface. + Intercepted cookies are not stored in a dedicated log file. Notes: - - If both admin-address and proxy-info-url - are unset, the whole "Local Privoxy Support" box on all generated pages will - not be shown. - + + The jarfile may grow to ridiculous sizes over time. + + + If debug 8 (show header parsing) is enabled, cookies are + written to the logfile with the rest of the headers. + -@@#admin-address privoxy-admin@example.com]]> +@@#jarfile jarfile]]> -proxy-info-url - +trustfile Specifies: - A URL to documentation about the local Privoxy setup, - configuration or policies. + The name of the trust file to use Type of value: - URL + File name, relative to confdir Default value: - Unset + Unset (commented out). When activated: trust (Unix) or trust.txt (Windows) Effect if unset: - No link to local documentation is displayed on error pages and the CGI user interface. + The entire trust mechanism is disabled. @@ -898,21 +944,53 @@ actionsfile Notes: - If both admin-address and proxy-info-url - are unset, the whole "Local Privoxy Support" box on all generated pages will - not be shown. - + The trust mechanism is an experimental feature for building white-lists and should + be used with care. It is NOT recommended for the casual user. + + + If you specify a trust file, Privoxy will only allow + access to sites that are specified in the trustfile. Sites can be listed + in one of two ways: + + + Prepending a ~ character limits access to this site + only (and any sub-paths within this site), e.g. + ~www.example.com allows access to + ~www.example.com/features/news.html, etc. + + + Or, you can designate sites as trusted referrers, by + prepending the name with a + character. The effect is that + access to untrusted sites will be granted -- but only if a link from this + trusted referrer was used to get there. The link target will then be added + to the trustfile so that future, direct accesses will be + granted. Sites added via this mechanism do not become trusted referrers + themselves (i.e. they are added with a ~ designation). + There is a limit of 512 such entries, after which new entries will not be + made. + + + If you use the + operator in the trust file, it may grow + considerably over time. + + + It is recommended that Privoxy be compiled with + the --disable-force, --disable-toggle and + --disable-editor options, if this feature is to be + used. + - This URL shouldn't be blocked ;-) - + Possible applications include limiting Internet access for children. + + -@@#proxy-info-url http://www.example.com/proxy-service.html]]> +@@#trustfile trust]]> - + @@ -970,10 +1048,10 @@ actionsfile debug 2 # show each connection status debug 4 # show I/O status debug 8 # show header parsing - debug 16 # log all data into the logfile + debug 16 # log all data written to the network into the logfile debug 32 # debug force feature - debug 64 # debug regular expression filter - debug 128 # debug fast redirects + debug 64 # debug regular expression filters + debug 128 # debug redirects debug 256 # debug GIF de-animation debug 512 # Common Log Format debug 1024 # debug kill pop-ups @@ -995,13 +1073,18 @@ actionsfile - The reporting of fatal errors (i.e. ones which crash - Privoxy) is always on and cannot be disabled. + The reporting of fatal errors (i.e. ones which causes + Privoxy to exit) is always on and cannot be disabled. If you want to use CLF (Common Log Format), you should set debug 512 ONLY and not enable anything else. + + Privoxy has a hard-coded limit for the + length of log messages. If it's reached, messages are logged truncated + and marked with ... [too long, truncated]. + @@ -1196,8 +1279,8 @@ actionsfile If set to 0, Privoxy will start in - toggled off mode, i.e. behave like a normal, content-neutral - proxy where all ad blocking, filtering, etc are disabled. See + toggled off mode, i.e. mostly behave like a normal, + content-neutral proxy where all ad blocking, filtering, etc are disabled. See enable-remote-toggle below. This is not really useful anymore, since toggling is much easier via the web interface than via @@ -1251,7 +1334,7 @@ actionsfile Notes: - When toggled off, Privoxy acts like a normal, + When toggled off, Privoxy mostly acts like a normal, content-neutral proxy, i.e. it acts as if none of the actions applied to any URL. @@ -1275,6 +1358,60 @@ actionsfile + +enable-remote-http-toggle + + + Specifies: + + + Whether or not Privoxy recognizes special HTTP headers to change its behaviour. + + + + + Type of value: + + 0 or 1 + + + + Default value: + + 1 + + + + Effect if unset: + + + Privoxy ignores special HTTP headers. + + + + + Notes: + + + When toggled on, the client can change Privoxy's + behaviour by setting special HTTP headers. Currently the only supported + special header is X-Filter: No, to disable filtering for + the ongoing request, even if it is enabled in one of the action files. + + + If you are using Privoxy in a + multi-user environment or with untrustworthy clients and want to + enforce filtering, you will have to disable this option, + otherwise you can ignore it. + + + + + +@@enable-remote-http-toggle 1]]> + + + enable-edit-actions @@ -1329,6 +1466,81 @@ actionsfile @@enable-edit-actions 1]]> + +enforce-blocks + + + Specifies: + + + Whether the user is allowed to ignore blocks and can go there anyway. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + 0 + + + + Effect if unset: + + + Blocks are not enforced. + + + + + Notes: + + + Privoxy is mainly used to block and filter + requests as a service to the user, for example to block ads and other + junk that clogs the pipes. Privoxy's configuration + isn't perfect and sometimes innocent pages are blocked. In this situation it + makes sense to allow the user to enforce the request and have + Privoxy ignore the block. + + + In the default configuration Privoxy's + Blocked page contains a go there anyway + link to adds a special string (the force prefix) to the request URL. + If that link is used, Privoxy will + detect the force prefix, remove it again and let the request pass. + + + Of course Privoxy can also be used to enforce + a network policy. In that case the user obviously should not be able to + bypass any blocks, and that's what the enforce-blocks + option is for. If it's enabled, Privoxy hides + the go there anyway link. If the user adds the force + prefix by hand, it will not be accepted and the circumvention attempt + is logged. + + + + + Examples: + + + enforce-blocks 1 + + + + +@@enforce-blocks 0]]> + + + ACLs: permit-access and deny-access @@ -1394,8 +1606,8 @@ ACLs: permit-access and deny-access Multiple ACL lines are OK. - If any ACLs are specified, then the Privoxy - talks only to IP addresses that match at least one permit-access line + If any ACLs are specified, Privoxy only talks + to IP addresses that match at least one permit-access line and don't match any subsequent deny-access line. In other words, the last match wins, with the default being deny-access. @@ -1415,7 +1627,8 @@ ACLs: permit-access and deny-access Denying access to particular sites by ACL may have undesired side effects - if the site in question is hosted on a machine which also hosts other sites. + if the site in question is hosted on a machine which also hosts other sites + (most sites are). @@ -1435,7 +1648,7 @@ ACLs: permit-access and deny-access Allow any host on the same class C subnet as www.privoxy.org access to - nothing but www.example.com: + nothing but www.example.com (or other domains hosted on the same system): @@ -1444,7 +1657,8 @@ ACLs: permit-access and deny-access Allow access from any host on the 26-bit subnet 192.168.45.64 to anywhere, - with the exception that 192.168.45.73 may not access www.dirty-stuff.example.com: + with the exception that 192.168.45.73 may not access the IP address behind + www.dirty-stuff.example.com: @@ -1529,13 +1743,20 @@ ACLs: permit-access and deny-access This feature allows routing of HTTP requests through a chain of multiple proxies. - It can be used to better protect privacy and confidentiality when - accessing specific domains by routing requests to those domains - through an anonymous public proxy (see e.g. http://www.multiproxy.org/anon_list.htm) - Or to use a caching proxy to speed up browsing. Or chaining to a parent - proxy may be necessary because the machine that Privoxy - runs on has no direct Internet access. + + + Forwarding can be used to chain Privoxy with a caching proxy to speed + up browsing. Using a parent proxy may also be necessary if the machine + that Privoxy runs on has no direct Internet access. + + + Note that parent proxies can severely decrease your privacy level. + For example a parent proxy could add your IP address to the request + headers and if it's a caching proxy it may add the Etag + header to revalidation requests again, even though you configured Privoxy + to remove it. It may also ignore Privoxy's header time randomization and use the + original values which could be used by the server as cookie replacement + to track your steps between visits. @@ -1601,11 +1822,11 @@ ACLs: permit-access and deny-access Examples: - Everything goes to an example anonymizing proxy, except SSL on port 443 (which it doesn't handle): + Everything goes to an example parent proxy, except SSL on port 443 (which it doesn't handle): - forward / anon-proxy.example.org:8080 + forward / parent-proxy.example.org:8080 forward :443 . @@ -1636,7 +1857,7 @@ forward-socks4 and forward-socks4a Specifies: - Through which SOCKS proxy (and to which parent HTTP proxy) specific requests should be routed. + Through which SOCKS proxy (and optionally to which parent HTTP proxy) specific requests should be routed. @@ -1847,6 +2068,197 @@ forward-socks4 and forward-socks4a ]]> +forwarded-connect-retries + + + Specifies: + + + How often Privoxy retries if a forwarded connection request fails. + + + + + Type of value: + + + Number of retries. + + + + + Default value: + + 0 + + + + Effect if unset: + + + Forwarded connections are treated like direct connections and no retry attempts are made. + + + + + Notes: + + + forwarded-connect-retries is mainly interesting + for socks4a connections, where Privoxy can't detect why the connections failed. + The connection might have failed because of a DNS timeout in which case a retry makes sense, + but it might also have failed because the server doesn't exist or isn't reachable. In this + case the retry will just delay the appearance of Privoxy's error message. + + + Only use this option, if you are getting many forwarding related error messages, + that go away when you try again manually. Start with a small value and check Privoxy's + logfile from time to time, to see how many retries are usually needed. + + + + + Examples: + + + forwarded-connect-retries 1 + + + + +@@forwarded-connect-retries 0]]> + + +accept-intercepted-requests + + + Specifies: + + + Whether intercepted requests should be treated as valid. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + 0 + + + + Effect if unset: + + + Only proxy requests are accepted, intercepted requests are treated as invalid. + + + + + Notes: + + + If you don't trust your clients and want to force them + to use Privoxy, enable this + option and configure your packet filter to redirect outgoing + HTTP connections into Privoxy. + + + Make sure that Privoxy's own requests + aren't redirected as well. Additionally take care that + Privoxy can't intentionally connect + to itself, otherwise you could run into redirection loops if + Privoxy's listening port is reachable + by the outside or an attacker has access to the pages you visit. + + + + + Examples: + + + accept-intercepted-requests 1 + + + + +@@accept-intercepted-requests 0]]> + + +split-large-forms + + + Specifies: + + + Whether the CGI interface should stay compatible with broken HTTP clients. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + 0 + + + + Effect if unset: + + + The CGI form generate long GET URLs. + + + + + Notes: + + + Privoxy's CGI forms can lead to + rather long URLs. This isn't a problem as far as the HTTP + standard is concerned, but it can confuse clients with arbitrary + URL lenght limitations. + + + Enabling split-large-forms causes Privoxy + to devide big forms into smaller ones to keep the URL length down. + It makes editing a lot less convenient and you can no longer + submit all changes at once, but at least it works around this + browser bug. + + + If you don't notice any editing problems, there is no reason + to enable this option, but if one of the submit buttons appears + to be broken, you should give it a try. + + + + + Examples: + + + split-large-forms 1 + + + + +@@split-large-forms 0]]> + +