X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=doc%2Fsource%2Fp-config.sgml;h=e2946ef19c4dbc0ffea9eabbd011d4c84753ebc5;hp=9ed8f15cc033db621547953a33e9cd18746fd5ec;hb=100ba4ab71cd6200f12ba086576dc569c277c186;hpb=df9616f1dacac74ba9469d6c334d0105a6effe15 diff --git a/doc/source/p-config.sgml b/doc/source/p-config.sgml index 9ed8f15c..e2946ef1 100644 --- a/doc/source/p-config.sgml +++ b/doc/source/p-config.sgml @@ -3,7 +3,7 @@ Purpose : Used with other docs and files only. - $Id: p-config.sgml,v 2.43 2009/03/28 15:33:41 fabiankeil Exp $ + $Id: p-config.sgml,v 2.52 2009/06/03 18:30:18 fabiankeil Exp $ Copyright (C) 2001-2009 Privoxy Developers http://www.privoxy.org/ See LICENSE. @@ -81,7 +81,9 @@ The main config file controls all aspects of Privoxy's operation that are not location dependent (i.e. they apply universally, no matter - where you may be surfing). + where you may be surfing). Like the filter and action files, the config file is + a plain text file and can be modified with a text editor like emacs, vim or + notepad.exe. ]]> @@ -95,7 +97,7 @@ Sample Configuration File for Privoxy v&p-version; - $Id: p-config.sgml,v 2.43 2009/03/28 15:33:41 fabiankeil Exp $ + $Id: p-config.sgml,v 2.52 2009/06/03 18:30:18 fabiankeil Exp $ Copyright (C) 2001-2009 Privoxy Developers http://www.privoxy.org/ @@ -1231,14 +1233,16 @@ actionsfile will need to override the default. - IPv6 address containing colons has to be quoted by brackets. + IPv6 addresses containing colons have to be quoted by brackets. If you leave out the IP address, Privoxy will - bind to all interfaces (addresses) on your machine and may become reachable + bind to all IPv4 interfaces (addresses) on your machine and may become reachable from the Internet. In that case, consider using access control lists (ACL's, see below), and/or - a firewall. + a firewall. If the hostname is localhost, Privoxy + will explicitly try to bind to an IPv4 address. For other hostnames it depends + on the operating system which IP version will be used. If you open Privoxy to untrusted users, you will @@ -1263,8 +1267,9 @@ actionsfile - Suppose you are running Privoxy on IPv6 capable - machine and you want to listen on IPv6 loopback device: + Suppose you are running Privoxy on an + IPv6-capable machine and you want it to listen on the IPv6 address + of the loopback device: @@ -1629,7 +1634,7 @@ ACLs: permit-access and deny-access Where src_addr and dst_addr are IPv4 addresses in dotted decimal notation or valid - DNS names, port is port + DNS names, port is a port number, and src_masklen and dst_masklen are subnet masks in CIDR notation, i.e. integer values from 2 to 30 representing the length (in bits) of the network address. The masks and the whole @@ -1640,10 +1645,10 @@ ACLs: permit-access and deny-access RFC 3493, then src_addr and dst_addr can be IPv6 addresses delimeted by - brackets, port can be number - or service name, and + brackets, port can be a number + or a service name, and src_masklen and - dst_masklen can be number + dst_masklen can be a number from 0 to 128. @@ -1653,10 +1658,10 @@ ACLs: permit-access and deny-access Unset - No port means match any port - and no src_masklen or - no src_masklen means exactly - given IP address (i.e. 32 for IPv4 and 128 for IPv6). + If no port is specified, + any port will match. If no src_masklen or + src_masklen is given, the complete IP + address has to match (i.e. 32 bits for IPv4 and 128 bits for IPv6). @@ -1709,7 +1714,7 @@ ACLs: permit-access and deny-access Some systems allows IPv4 client to connect to IPv6 server socket. Then the client's IPv4 address will be translated by system into - IPv6 address space with special prefix ::ffff/96 (so called IPv4 + IPv6 address space with special prefix ::ffff:0:0/96 (so called IPv4 mapped IPv6 address). Privoxy can handle it and maps such ACL addresses automatically. @@ -1755,8 +1760,8 @@ ACLs: permit-access and deny-access - Allow access from IPv4 network 192.0.2.0/24 even if listening on - IPv6 wild card address (where supported by operating system): + Allow access from the IPv4 network 192.0.2.0/24 even if listening on + an IPv6 wild card address (not supported on all platforms): @@ -1764,8 +1769,8 @@ ACLs: permit-access and deny-access - This is equivalent to the following line even if listening on IPv4 - address (where supported by operating system): + This is equivalent to the following line even if listening on an + IPv4 address (not supported on all platforms): @@ -1920,14 +1925,14 @@ ACLs: permit-access and deny-access forwarded to another HTTP proxy but are made directly to the web servers. - http_parent can be IPv6 - numerical address (if + http_parent can be a + numerical IPv6 address (if RFC 3493 is - implemented). However not to clash with port delimiter, quote - whole IP address with brackets. On the other hand target_pattern containing IPv6 address - must be delimited by angle brackets (normal brackets are reserved for - regular expression already). + implemented). To prevent clashes with the port delimiter, the whole IP + address has to be put into brackets. On the other hand a target_pattern containing an IPv6 address + has to be put into angle brackets (normal brackets are reserved for + regular expressions already). Multiple lines are OK, they are checked in sequence, and the last match wins. @@ -1957,7 +1962,7 @@ ACLs: permit-access and deny-access - Parent proxy specified by IPv6 address: + Parent proxy specified by an IPv6 address: @@ -1969,7 +1974,7 @@ ACLs: permit-access and deny-access - forward / parent-proxy.example.org:8000 + forward / parent-proxy.example.org:8000 forward ipv6-server.example.org . forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> . @@ -2047,15 +2052,14 @@ forward-socks4, forward-socks4a and forward-socks5 socks_proxy and - http_parent can be IPv6 - numerical address (if + http_parent can be a + numerical IPv6 address (if RFC 3493 is - implemented). However not to clash with port - delimiter, quote whole IP address with brackets. On the other - hand target_pattern containing - IPv6 address must be delimited by angle brackets (normal brackets are - reserved for regular expression already). The only exception is SOCKS 4 - version where only IPv4 is suppored. + implemented). To prevent clashes with the port delimiter, the whole IP + address has to be put into brackets. On the other hand a target_pattern containing an IPv6 address + has to be put into angle brackets (normal brackets are reserved for + regular expressions already). If http_parent is ., then requests are not @@ -2289,6 +2293,11 @@ forward-socks4, forward-socks4a and forward-socks5 @@forwarded-connect-retries 0]]> + + + +Miscellaneous + accept-intercepted-requests @@ -2505,19 +2514,87 @@ forward-socks4, forward-socks4a and forward-socks5 Effect if unset: - Connections are not reused. + Connections are not kept alive. Notes: + + This option allows clients to keep the connection to &my-app; + alive. If the server supports it, &my-app; will keep + the connection to the server alive as well. Under certain + circumstances this may result in speed-ups. + + + By default, &my-app; will close the connection to the server if + the client connection gets closed, or if the specified timeout + has been reached without a new request coming in. This behaviour + can be changed with the connection-sharing option. + This option has no effect if Privoxy has been compiled without keep-alive support. + + Examples: + + + keep-alive-timeout 300 + + + + +@@keep-alive-timeout 300]]> + + + +connection-sharing + + + Specifies: + + + Whether or not outgoing connections that have been kept alive + should be shared between different incoming connections. + + + + + Type of value: + + + 0 or 1 + + + + + Default value: + + None + + + + Effect if unset: + + + Connections are not shared. + + + + + Notes: + + + This option has no effect if Privoxy + has been compiled without keep-alive support, or if it's disabled. + + + Notes: @@ -2526,13 +2603,39 @@ forward-socks4, forward-socks4a and forward-socks5 There are also a few privacy implications you should be aware of. - Outgoing connections are shared between clients (if there are more - than one) and closing the client that initiated the outgoing connection - does not affect the connection between &my-app; and the server unless - the client's request hasn't been completed yet. If the outgoing connection - is idle, it will not be closed until either Privoxy's - or the server's timeout is reached. While it's open, the server knows - that the system running &my-app; is still there. + If this option is effective, outgoing connections are shared between + clients (if there are more than one) and closing the browser that initiated + the outgoing connection does no longer affect the connection between &my-app; + and the server unless the client's request hasn't been completed yet. + + + If the outgoing connection is idle, it will not be closed until either + Privoxy's or the server's timeout is reached. + While it's open, the server knows that the system running &my-app; is still + there. + + + If there are more than one client (maybe even belonging to multiple users), + they will be able to reuse each others connections. This is potentially + dangerous in case of authentication schemes like NTLM where only the + connection is authenticated, instead of requiring authentication for + each request. + + + If there is only a single client, and if said client can keep connections + alive on its own, enabling this option has next to no effect. If the client + doesn't support connection keep-alive, enabling this option may make sense + as it allows &my-app; to keep outgoing connections alive even if the client + itself doesn't support it. + + + You should also be aware that enabling this option increases the likelihood + of getting the "No server or forwarder data" error message, especially if you + are using a slow connection to the Internet. + + + This option should only be used by experienced users who + understand the risks and can weight them against the benefits. @@ -2540,12 +2643,12 @@ forward-socks4, forward-socks4a and forward-socks5 Examples: - keep-alive-timeout 300 + connection-sharing 1 -@@keep-alive-timeout 300]]> +@@#connection-sharing 1]]> @@ -2605,6 +2708,87 @@ forward-socks4, forward-socks4a and forward-socks5 +max-client-connections + + + Specifies: + + + Maximum number of client connections that will be served. + + + + + Type of value: + + + Positive number. + + + + + Default value: + + None + + + + Effect if unset: + + + Connections are served until a resource limit is reached. + + + + + Notes: + + + &my-app; creates one thread (or process) for every incoming client + connection that isn't rejected based on the access control settings. + + + If the system is powerful enough, &my-app; can theoretically deal with + several hundred (or thousand) connections at the same time, but some + operating systems enforce resource limits by shutting down offending + processes and their default limits may be below the ones &my-app; would + require under heavy load. + + + Configuring &my-app; to enforce a connection limit below the thread + or process limit used by the operating system makes sure this doesn't + happen. Simply increasing the operating system's limit would work too, + but if &my-app; isn't the only application running on the system, + you may actually want to limit the resources used by &my-app;. + + + If &my-app; is only used by a single trusted user, limiting the + number of client connections is probably unnecessary. If there + are multiple possibly untrusted users you probably still want to + additionally use a packet filter to limit the maximal number of + incoming connections per client. Otherwise a malicious user could + intentionally create a high number of connections to prevent other + users from using &my-app;. + + + Obviously using this option only makes sense if you choose a limit + below the one enforced by the operating system. + + + + + Examples: + + + max-client-connections 256 + + + + +@@#max-client-connections 256]]> + + +