X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=doc%2Fsource%2Fuser-manual.sgml;h=dd1bebf9353fc6e472d9f516eef69d35a5e40acf;hp=408a61281a326995a3692f6833dd2e2d47040a2f;hb=4c292377c13c2648634249198c8aebdca5200b8c;hpb=0428133610c525457cb16f7ac6a54203a2743d6c

diff --git a/doc/source/user-manual.sgml b/doc/source/user-manual.sgml
index 408a6128..dd1bebf9 100644
--- a/doc/source/user-manual.sgml
+++ b/doc/source/user-manual.sgml
@@ -12,10 +12,10 @@
 <!entity p-authors SYSTEM "p-authors.sgml">
 <!entity config SYSTEM "p-config.sgml">
 <!entity p-version "3.0.18">
-<!entity p-status "UNRELEASED">
+<!entity p-status "stable">
 <!entity % p-authors-formal "INCLUDE"> <!-- include additional text, etc  -->
-<!entity % p-not-stable "INCLUDE">
-<!entity % p-stable "IGNORE">
+<!entity % p-not-stable "IGNORE">
+<!entity % p-stable "INCLUDE">
 <!entity % p-text "IGNORE">        <!-- define we are not a text only doc -->
 <!entity % p-doc "INCLUDE">        <!-- and we are a formal doc           -->
 <!entity % p-readme "IGNORE">
@@ -34,7 +34,7 @@
                 This file belongs into
                 ijbswa.sourceforge.net:/home/groups/i/ij/ijbswa/htdocs/
 
- $Id: user-manual.sgml,v 2.134 2011/08/18 11:45:02 fabiankeil Exp $
+ $Id: user-manual.sgml,v 2.143 2011/11/20 17:16:36 fabiankeil Exp $
 
  Copyright (C) 2001-2011 Privoxy Developers http://www.privoxy.org/
  See LICENSE.
@@ -60,7 +60,7 @@
  </subscript>
 </pubdate>
 
-<pubdate>$Id: user-manual.sgml,v 2.134 2011/08/18 11:45:02 fabiankeil Exp $</pubdate>
+<pubdate>$Id: user-manual.sgml,v 2.143 2011/11/20 17:16:36 fabiankeil Exp $</pubdate>
 
 <!--
 
@@ -437,515 +437,971 @@ How to install the binary packages depends on your operating system:
 <sect1 id="whatsnew">
 <title>What's New in this Release</title>
 <para>
- <application>Privoxy 3.0.17</application> is a stable release.
- The changes since 3.0.16 stable are:
+ <application>Privoxy 3.0.18</application> is a stable release.
+ The changes since 3.0.17 stable are:
 </para>
 
 <para>
  <itemizedlist>
-  <listitem>
-   <para>
-    Fixed last-chunk-detection for responses where the content was small
-    enough to be read with the body, causing Privoxy to wait for the
-    end of the content until the server closed the connection or the
-    request timed out. Reported by "Karsten" in #3028326.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Responses with status code 204 weren't properly detected as body-less
-    like RFC2616 mandates. Like the previous bug, this caused Privoxy to
-    wait for the end of the content until the server closed the connection
-    or the request timed out. Fixes #3022042 and #3025553, reported by a
-    user with no visible name. Most likely also fixes a bunch of other
-    AJAX-related problem reports that got closed in the past due to
-    insufficient information and lack of feedback.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Fixed an ACL bug that made it impossible to build a blacklist.
-    Usually the ACL directives are used in a whitelist, which worked
-    as expected, but blacklisting is still useful for public proxies
-    where one only needs to deny known abusers access.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Added LOG_LEVEL_RECEIVED to log the not-yet-parsed data read from the
-    network. This should make debugging various parsing issues a lot easier.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    The IPv6 code is enabled by default on Windows versions that support it.
-    Patch submitted by oCameLo in #2942729.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    In mingw32 versions, the user.filter file is reachable through the
-    GUI, just like default.filter is. Feature request 3040263.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Added the configure option --enable-large-file-support to set a few
-    defines that are required by platforms like GNU/Linux to support files
-    larger then 2GB. Mainly interesting for users without proper logfile
-    management.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Logging with "debug 16" no longer stops at the first nul byte which is
-    pretty useless. Non-printable characters are replaced with their hex value
-    so the result can't span multiple lines making parsing them harder then
-    necessary.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Privoxy logs when reading an action, filter or trust file.
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Fixed incorrect regression test markup which caused a test in
-    3.0.16 to fail while Privoxy itself was working correctly.
-    While Privoxy accepts hide-referer, too, the action name is actually
-    hide-referrer which is also the name used one the final results page,
-    where the test expected the alias.
-   </para>
-  </listitem>
-  <listitem>
+    <listitem>
    <para>
-    CGI interface improvements:
+    Bug fixes:
     <itemizedlist>
     <listitem>
      <para>
-      In finish_http_response(), continue to add the 'Connection: close'
-      header if the client connection will not be kept alive.
-      Anonymously pointed out in #2987454.
+      If a generated redirect URL contains characters RFC 3986 doesn't
+      permit, they are (re)encoded. Not doing this makes Privoxy versions
+      from 3.0.5 to 3.0.17 susceptible to HTTP response splitting (CWE-113)
+      attacks if the +fast-redirects{check-decoded-url} action is used.
      </para>
     </listitem>
     <listitem>
      <para>
-      Apostrophes in block messages no longer cause parse errors
-      when the blocked page is viewed with JavaScript enabled.
-      Reported by dg1727 in #3062296.
+      Fix a logic bug that could cause Privoxy to reuse a server
+      socket after it got tainted by a server-header-tagger-induced
+      block that was triggered before the whole server response had
+      been read. If keep-alive was enabled and the request following
+      the blocked one was to the same host and using the same forwarding
+      settings, Privoxy would send it on the tainted server socket.
+      While the server would simply treat it as a pipelined request,
+      Privoxy would later on fail to properly parse the server's
+      response as it would try to parse the unread data from the
+      first response as server headers for the second one.
+      Regression introduced in 3.0.17.
      </para>
     </listitem>
     <listitem>
      <para>
-      Fix a bunch of anchors that used underscores instead of dashes.
+      When implying keep-alive in client_connection(), remember that
+      the client didn't. Fixes a regression introduced in 3.0.13 that
+      would cause Privoxy to wait for additional client requests after
+      receiving a HTTP/1.1 request with "Connection: close" set
+      and connection sharing enabled.
+      With clients which terminates the client connection after detecting
+      that the whole body has been received it doesn't really matter,
+      but with clients that don't the connection would be kept open until
+      it timed out.
      </para>
     </listitem>
     <listitem>
      <para>
-      Allow to keep the client connection alive after crunching the previous request.
-      Already opened server connections can be kept alive, too.
+      Fix a subtle race condition between prepare_csp_for_next_request()
+      and sweep(). A thread preparing itself for the next client request
+      could briefly appear to be inactive.
+      If all other threads were already using more recent files,
+      the thread could get its files swept away under its feet.
+      So far this has only been reproduced while stress testing in
+      valgrind while touching action files in a loop. It's unlikely
+      to have caused any actual problems in the real world.
      </para>
     </listitem>
     <listitem>
      <para>
-      In cgi_show_url_info(), don't forget to prefix URLs that only contain
-      http:// or https:// in the path. Fixes #2975765 reported by Adam Piggott.
+      Disable filters if SDCH compression is used unless filtering is forced.
+      If SDCH was combined with a supported compression algorithm, Privoxy
+      previously could try to decompress it and ditch the Content-Encoding
+      header even though the SDCH compression wasn't dealt with.
+      Reported by zebul666 in #3225863.
      </para>
     </listitem>
     <listitem>
      <para>
-      Show the 404 CGI page if cgi_send_user_manual() is called while
-      local user manual delivery is disabled.
+      Make a copy of the --user value and only mess with that when splitting
+      user and group. On some operating systems modifying the value directly
+      is reflected in the output of ps and friends and can be misleading.
+      Reported by zepard in #3292710.
      </para>
     </listitem>
-   </itemizedlist>
+    <listitem>
+     <para>
+      If forwarded-connect-retries is set, only retry if Privoxy is actually
+      forwarding the request. Previously direct connections would be retried
+      as well.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Fixed a small memory leak when retrying connections with IPv6
+      support enabled.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Remove an incorrect assertion in compile_dynamic_pcrs_job_list()
+      It could be triggered by a pcrs job with an invalid pcre
+      pattern (for example one that contains a lone quantifier).
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      If the --user argument user[.group] contains a dot, always bail out
+      if no group has been specified. Previously the intended, but undocumented
+      (and apparently untested), behaviour was to try interpreting the whole
+      argument as user name, but the detection was flawed and checked for '0'
+      instead of '\0', thus merely preventing group names beginning with a zero.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In html_code_map[], use a numeric character reference instead of &apos;
+      which wasn't standardized before XHTML 1.0.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Fix an invalid free when compiled with FEATURE_GRACEFUL_TERMINATION
+      and shut down through http://config.privoxy.org/die
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In get_actions(), fix the "temporary" backwards compatibility hack
+      to accept block actions without reason.
+      It also covered other actions that should be rejected as invalid.
+      Reported by Billy Crook.
+     </para>
+     </listitem>
+    </itemizedlist>
    </para>
   </listitem>
   <listitem>
    <para>
-    Action file improvements:
+    General improvements:
     <itemizedlist>
     <listitem>
      <para>
-      Enable user.filter by default. Suggested by David White in #3001830.
+      Privoxy can (re)compress buffered content before delivering
+      it to the client. Disabled by default as most users wouldn't
+      benefit from it.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block .sitestat.com/. Reported by johnd16 in #3002725.
+      The +fast-redirects{check-decoded-url} action checks URL
+      segments separately. If there are other parameters behind
+      the redirect URL, this makes it unnecessary to cut them off
+      by additionally using a +redirect{} pcrs command.
+      Initial patch submitted by Jamie Zawinski in #3429848.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block .atemda.com/. Reported by johnd16 in #3002723.
+      When loading action sections, verify that the referenced filters
+      exist. Currently missing filters only result in an error message,
+      but eventually the severity will be upgraded to fatal.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block js.adlink.net/. Reported by johnd16 in #3002720.
+      Allow to bind to multiple separate addresses.
+      Patch set submitted by Petr Pisar in #3354485.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block .analytics.yahoo.com/. Reported by johnd16 in #3002713.
+      Set socket_error to errno if connecting fails in rfc2553_connect_to().
+      Previously rejected direct connections could be incorrectly reported
+      as DNS issues if Privoxy was compiled with IPv6 support.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block sb.scorecardresearch.com, too. Reported by dg1727 in #2992652.
+      Adjust url_code_map[] so spaces are replaced with %20 instead of '+'
+      While '+' can be used by client's submitting form data, this is not
+      actually what Privoxy is using the lookups for. This is more of a
+      cosmetic issue and doesn't fix any known problems.
      </para>
     </listitem>
     <listitem>
      <para>
-      Fix problems noticed on Yahoo mail and news pages.
+      When compiled without FEATURE_FAST_REDIRECTS, do not silently
+      ignore +fast-redirect{} directives
      </para>
     </listitem>
     <listitem>
      <para>
-      Remove the too broad yahoo section, only keeping the
-      fast-redirects exception as discussed on ijbswa-devel@.
+      Added a workaround for GNU libc's strptime() reporting negative
+      year values when the parsed year is only specified with two digits.
+      On affected systems cookies with such a date would not be turned
+      into session cookies by the +session-cookies-only action.
+      Reported by Vaeinoe in #3403560
      </para>
     </listitem>
     <listitem>
      <para>
-      Don't block adesklets.sourceforge.net. Reported in #2974204.
+      Fixed bind failures with certain GNU libc versions if no non-loopback
+      IP address has been configured on the system. This is mainly an issue
+      if the system is using DHCP and Privoxy is started before the network
+      is completely configured.
+      Reported by Raphael Marichez in #3349356.
+      Additional insight from Petr Pisar.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block chartbeat ping tracking. Reported in #2975895.
+      Privoxy log messages now use the ISO 8601 date format %Y-%m-%d.
+      It's only slightly longer than the old format, but contains
+      the full date including the year and allows sorting by date
+      (when grepping in multiple log files) without hassle.
      </para>
     </listitem>
     <listitem>
      <para>
-      Tag CSS and image requests with cautious and medium settings, too.
+      In get_last_url(), do not bother trying to decode URLs that do
+      not contain at least one '%' sign. It reduces the log noise and
+      a number of unnecessary memory allocations.
      </para>
     </listitem>
     <listitem>
      <para>
-      Don't handle view.atdmt.com as image. It's used for click-throughs
-      so users should be able to "go there anyway".
-      Reported by Adam Piggott in #2975927.
+      In case of SOCKS5 failures, dump the socks response in the log message.
      </para>
     </listitem>
     <listitem>
      <para>
-      Also let the refresh-tags filter remove invalid refresh tags where
-      the 'url=' part is missing. Anonymously reported in #2986382.
-      While at it, update the description to mention the fact that only
-      refresh tags with refresh times above 9 seconds are covered.
+      Simplify the signal setup in main().
      </para>
     </listitem>
     <listitem>
      <para>
-      javascript needs to be blocked with +handle-as-empty-document to
-      work around Firefox bug 492459.  So move .js blockers from
-      +block{Might be a web-bug.} -handle-as-empty-document to
-      +block{Might be a web-bug.} +handle-as-empty-document.
+      Streamline socks5_connect() slightly.
      </para>
     </listitem>
     <listitem>
      <para>
-      ijbswa-Feature Requests-3006719 - Block 160x578 Banners.
+      In socks5_connect(), require a complete socks response from the server.
+      Previously Privoxy didn't care how much data the server response
+      contained as long as the first two bytes contained the expected
+      values. While at it, shrink the buffer size so Privoxy can't read
+      more than a whole socks response.
      </para>
     </listitem>
     <listitem>
      <para>
-      Block another omniture tracking domain.
+      In chat(), do not bother to generate a client request in case of
+      direct CONNECT requests. It will not be used anyway.
      </para>
     </listitem>
     <listitem>
      <para>
-      Added a range-requests tagger.
+      Reduce server_last_modified()'s stack size.
      </para>
     </listitem>
     <listitem>
      <para>
-      Added two sections to get Flickr's Ajax interface working with
-      default pre-settings. If you change the configuration to block
-      cookies by default, you'll need additional exceptions.
-      Reported by Mathias Homann in #3101419 and by Patrick on ijbswa-users@.
+      Shorten get_http_time() by using strftime().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Constify the known_http_methods pointers in unknown_method().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Constify the time_formats pointers in parse_header_time().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Constify the formerly_valid_actions pointers in action_used_to_be_valid().
      </para>
     </listitem>
-    </itemizedlist>
-   </para>
-  </listitem>
-  <listitem>
-   <para>
-    Documentation improvements:
-    <itemizedlist>
     <listitem>
      <para>
-      Explicitly mention how to match all URLs.
+      Introduce a GNUMakefile MAN_PAGE variable that defaults to privoxy.1.
+      The Debian package uses section 8 for the man page and this
+      should simplify the patch.
      </para>
     </listitem>
     <listitem>
      <para>
-      Consistently recommend socks5 in the Tor FAQ entry and mention
-      its advantage compared to socks4a. Reported by David in #2960129.
+      Deduplicate the INADDR_NONE definition for Solaris by moving it to jbsockets.h
      </para>
     </listitem>
     <listitem>
      <para>
-      Slightly improve the explanation of why filtering may appear
-      slower than it is.
+      In block_url(), ditch the obsolete workaround for ancient Netscape versions
+      that supposedly couldn't properly deal with status code 403.
      </para>
     </listitem>
     <listitem>
      <para>
-      Grammar fixes for the ACL section.
+      Remove a useless NULL pointer check in load_trustfile().
      </para>
     </listitem>
     <listitem>
      <para>
-      Fixed a link to the 'intercepting' entry and add another one.
+      Remove two useless NULL pointer checks in load_one_re_filterfile().
      </para>
     </listitem>
     <listitem>
      <para>
-      Rename the 'Other' section to 'Mailing Lists' and reword it
-      to make it clear that nobody is forced to use the trackers
+      Change url_code_map[] from an array of pointers to an array of arrays
+      It removes an unnecessary layer of indirection and on 64bit system reduces
+      the size of the binary a bit.
      </para>
     </listitem>
     <listitem>
      <para>
-      Note that 'anonymously' posting on the trackers may not always
-      be possible.
+      Fix various typos. Fixes taken from Debian's 29_typos.dpatch by Roland Rosenfeld.
      </para>
     </listitem>
     <listitem>
      <para>
-      Suggest to enable debug 32768 when suspecting parsing problems.
+      Add a dok-tidy GNUMakefile target to clean up the messy HTML
+      generated by the other dok targets.
      </para>
     </listitem>
+    <listitem>
+     <para>
+      GNUisms in the GNUMakefile have been removed.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Change the HTTP version in static responses to 1.1
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Synced config.sub and config.guess with upstream
+      2011-11-11/386c7218162c145f5f9e1ff7f558a3fbb66c37c5.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Add a dedicated function to parse the values of toggles. Reduces duplicated
+      code in load_config() and provides better error handling. Invalid or missing
+      toggle values are now a fatal error instead of being silently ignored.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Terminate HTML lines in static error messages with \n instead of \r\n.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Simplify cgi_error_unknown() a bit.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In LogPutString(), don't bother looking at pszText when not
+      actually logging anything.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Change ssplit()'s fourth parameter from int to size_t.
+      Fixes a clang complaint.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Add a warning that the statistics currently can't be trusted.
+      Mention Privoxy-Log-Parser's --statistics option as
+      an alternative for the time being.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In rfc2553_connect_to(), start setting cgi->error_message on error.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Change the expected status code returned for http://p.p/die depending
+      on whether or not FEATURE_GRACEFUL_TERMINATION is available.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In cgi_die(), mark the client connection for closing.
+      If the client will fetch the style sheet through another connection
+      it gets the main thread out of the accept() state and should thus
+      trigger the actual shutdown.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Add a proper CGI message for cgi_die().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Don't enforce a logical line length limit in read_config_line().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Slightly refactor server_last_modified() to remove useless gmtime*() calls.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In get_content_type(), also recognize '.jpeg' as JPEG extension.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Add '.png' to the list of recognized file extensions in get_content_type().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In block_url(), consistently use the block reason "Request blocked by Privoxy"
+      In two places the reason was "Request for blocked URL" which hides the
+      fact that the request got blocked by Privoxy and isn't necessarily
+      correct as the block may be due to tags.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In listen_loop(), reload the configuration files after accepting
+      a new connection instead of before.
+      Previously the first connection that arrived after a configuration
+      change would still be handled with the old configuration.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In chat()'s receive-data loop, skip a client socket check if
+      the socket will be written to right away anyway. This can
+      increase the transfer speed for unfiltered content on fast
+      network connections.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      The socket timeout is used for SOCKS negotiations as well which
+      previously couldn't timeout.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Don't keep the client connection alive if any configuration file
+      changed since the time the connection came in. This is closer to
+      Privoxy's behaviour before keep-alive support for client connection
+      has been added and also less confusing in general.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Treat all Content-Type header values containing the pattern
+      'script' as a sign of text. Reported by pribog in #3134970.
+     </para>
+     </listitem>
     </itemizedlist>
    </para>
   </listitem>
   <listitem>
    <para>
-    Privoxy-Log-Parser improvements:
+    Action file improvements:
     <itemizedlist>
     <listitem>
      <para>
-      Gather statistics for ressources, methods, and HTTP versions
-      used by the client.
+      Moved the site-specific block pattern section below the one for the
+      generic patterns so for requests that are matched in both, the block
+      reason for the domain is shown which is usually more useful than showing
+      the one for the generic pattern.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Remove -prevent-compression from the fragile alias. It's no longer
+      used anywhere by default and isn't known to break stuff anyway.
      </para>
     </listitem>
     <listitem>
      <para>
-      Also gather statistics for blocked and redirected requests.
+      Add a (disabled) section to block various Facebook tracking URLs.
+      Reported by Dan Stahlke in #3421764.
      </para>
     </listitem>
     <listitem>
      <para>
-      Provide the percentage of keep-alive offers the client accepted.
+      Add a (disabled) section to rewrite and redirect click-tracking
+      URLs used on news.google.com.
+      Reported by Dan Stahlke in #3421755.
      </para>
     </listitem>
     <listitem>
      <para>
-      Add a --url-statistics-threshold option.
+      Unblock linuxcounter.net/.
+      Reported by Dan Stahlke in #3422612.
      </para>
     </listitem>
     <listitem>
      <para>
-      Add a --host-statistics-threshold option to also gather
-      statistics about how many request where made per host.
+      Block 'www91.intel.com/' which is used by Omniture.
+      Reported by Adam Piggott in #3167370.
      </para>
     </listitem>
     <listitem>
      <para>
-      Fix a bug in handle_loglevel_header() where a 'scan: ' got lost.
+      Disable the handle-as-empty-doc-returns-ok option and mark it as deprecated.
+      Reminded by tceverling in #2790091.
      </para>
     </listitem>
     <listitem>
      <para>
-      Add a --shorten-thread-ids option to replace the thread id with
-      a decimal number.
+      Add ".ivwbox.de/" to the "Cross-site user tracking" section.
+      Reported by Nettozahler in #3172525.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and ignore: Looks like we got the last chunk together
-      with the server headers. We better stop reading.
+      Unblock and fast-redirect ".awin1.com/.*=http://".
+      Reported by Adam Piggott in #3170921.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and ignore: Continue hack in da house.
+      Block "b.collective-media.net/".
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and higlight: Rejecting connection from 10.0.0.2.
-      Maximum number of connections reached.
+      Widen the Debian popcon exception to "qa.debian.org/popcon".
+      Seen in Debian's 05_default_action.dpatch by Roland Rosenfeld.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and highlight: Loading actions file: /usr/local/etc/privoxy/default.action
+      Block ".gemius.pl/" which only seems to be used for user tracking.
+      Reported by johnd16 in #3002731. Additional input from Lee and movax.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and highlight: Loading filter file: /usr/local/etc/privoxy/default.filter
+      Disable banners-by-size filters for '.thinkgeek.com/'.
+      The filter only seems to catch pictures of the inventory.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and highlight: Killed all-caps Host header line: HOST: bestproxydb.com
+      Block requests for 'go.idmnet.bbelements.com/please/showit/'.
+      Reported by kacperdominik in #3372959.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept and highlight: Reducing expected bytes to 0. Marking
-      the server socket tainted after throwing 4 bytes away.
+      Unblock adainitiative.org/.
      </para>
     </listitem>
     <listitem>
      <para>
-      Accept: Merged multiple header lines to: 'X-FORWARDED-PROTO: http X-HOST: 127.0.0.1'
+      Add a fast-redirects exception for '.googleusercontent.com/.*=cache'.
      </para>
     </listitem>
+    <listitem>
+     <para>
+      Add a fast-redirects exception for webcache.googleusercontent.com/.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Unblock http://adassier.wordpress.com/ and http://adassier.files.wordpress.com/.
+     </para>
+     </listitem>
+    </itemizedlist>
+   </para>
+  </listitem>
+  <listitem>
+   <para>
+    Filter file improvements:
+    <itemizedlist>
+    <listitem>
+     <para>
+      Let the yahoo filter hide '.ads'.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Let the msn filter hide overlay ads for Facebook 'likes' in search
+      results and elements with the id 's_notf_div'. They only seem to be
+      used to advertise site 'enhancements'.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Let the js-events filter additionally disarm setInterval().
+      Suggested by dg1727 in #3423775.
+     </para>
+     </listitem>
+    </itemizedlist>
+   </para>
+  </listitem>
+  <listitem>
+   <para>
+    Documentation improvements:
+    <itemizedlist>
+    <listitem>
+     <para>
+      Clarify the effect of compiling Privoxy with zlib support.
+      Suggested by dg1727 in #3423782.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Point out that the SourceForge messaging system works like a black
+      hole and should thus not be used to contact individual developers.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Mention some of the problems one can experience when not explicitly
+      configuring an IP addresses as listen address.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Explicitly mention that hostnames can be used instead of IP addresses
+      for the listen-address, that only the first address returned will be
+      used and what happens if the address is invalid.
+      Requested by Calestyo in #3302213.
+     </para>
+     </listitem>
     </itemizedlist>
    </para>
   </listitem>
   <listitem>
    <para>
-    Code cleanups:
+    Log message improvements:
     <itemizedlist>
     <listitem>
      <para>
-      Remove the next member from the client_state struct. Only the main
-      thread needs access to all client states so give it its own struct.
+      If only the server connection is kept alive, do not pretend to
+      wait for a new client request.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Remove a superfluous log message in forget_connection().
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In chat(), properly report missing server responses as such
+      instead of calling them empty.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In forwarded_connect(), fix a log message nobody should ever see.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Fix a log message in socks5_connect(), a failed write operation
+      was logged as failed read operation.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Let load_one_actions_file() properly complain about a missing
+      '{' at the beginning of the file.
+      Simply stating that a line is invalid isn't particularly helpful.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Do not claim to listen on a socket until Privoxy actually does.
+      Patch submitted by Petr Pisar #3354485
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Prevent a duplicated LOG_LEVEL_CLF message when sending out
+      the "no-server-data" response.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Also log the client socket when dropping a connection.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Include the destination host in the 'Request ... marked for
+      blocking. limit-connect{...} doesn't allow CONNECT ...' message
+      Patch submitted by Saperski in #3296250.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Prevent a duplicated log message if none of the resolved IP
+      addresses were reachable.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In connect_to(), do not pretend to retry if forwarded-connect-retries
+      is zero or unset.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      When a specified user or group can't be found, put the name in
+      single-quotes when logging it.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      In rfc2553_connect_to(), explain getnameinfo() errors better.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Remove a useless log message in chat().
      </para>
     </listitem>
     <listitem>
      <para>
-      Garbage-collect request_contains_null_bytes().
+      When retrying to connect, also log the maximum number of connection
+      attempts.
      </para>
     </listitem>
     <listitem>
      <para>
-      Ditch redundant code in unload_configfile().
+      Rephrase a log message in compile_dynamic_pcrs_job_list().
+      Divide the error code and its meaning with a colon. Call the pcrs
+      job dynamic and not the filter. Filters may contain dynamic and
+      non-dynamic pcrs jobs at the same time. Only mention the name of
+      the filter or tagger, but don't claim it's a filter when it could
+      be a tagger.
      </para>
     </listitem>
     <listitem>
      <para>
-      Ditch LogGetURLUnderCursor() which doesn't seem to be used anywhere.
+      In a fatal error message in load_one_actions_file(), cover both
+      URL and TAG patterns.
      </para>
     </listitem>
     <listitem>
      <para>
-      In write_socket(), remove the write-only variable write_len in
-      an ifdef __OS2__ block. Spotted by cppcheck.
+      In pcrs_strerror(), properly report unknown positive error code
+      values as such. Previously they were handled like 0 (no error).
      </para>
     </listitem>
     <listitem>
      <para>
-      In connect_to(), don't declare the variable 'flags' on OS/2 where
-      it isn't used. Spotted by cppcheck.
+      In compile_dynamic_pcrs_job_list(), also log the actual error code as
+      pcrs_strerror() doesn't handle all errors reported by pcre.
      </para>
     </listitem>
     <listitem>
      <para>
-      Limit the scope of various variables. Spotted by cppcheck.
+      Don't bother trying to continue chatting if the client didn't ask for it.
+      Reduces log noise a bit.
      </para>
     </listitem>
     <listitem>
      <para>
-      In add_to_iob(), turn an interestingly looking for loop into a
-      boring while loop.
+      Make two fatal error message in load_one_actions_file() more descriptive.
      </para>
     </listitem>
     <listitem>
      <para>
-      Code cleanup in preparation for external filters.
+      In cgi_send_user_manual(), log when rejecting a file name due to '/' or '..'.
      </para>
     </listitem>
     <listitem>
      <para>
-      In listen_loop(), mention the socket on which we accepted the
-      connection, not just the source IP address.
+      In load_file(), log a message if opening a file failed.
+      The CGI error message alone isn't too helpful.
      </para>
     </listitem>
     <listitem>
      <para>
-      In write_socket(), also log the socket we're writing to.
+      In connection_destination_matches(), improve two log messages
+      to help understand why the destinations don't match.
      </para>
     </listitem>
     <listitem>
      <para>
-      In log_error(), assert that escaped characters get logged
-      completely or not at all.
+      Rephrase a log message in serve(). Client request arrival
+      should be differentiated from closed client connections now.
      </para>
     </listitem>
     <listitem>
      <para>
-      In log_error(), assert that ival and sval have reasonable values.
-      There's no reason not to abort() if they don't.
+      In serve(), log if a client connection isn't reused due to a
+      configuration file change.
      </para>
     </listitem>
     <listitem>
      <para>
-      Remove an incorrect cgi_error_unknown() call in a
-      cannot-happen-situation in send_crunch_response().
+      Let mark_server_socket_tainted() always mark the server socket tainted,
+      just don't talk about it in cases where it has no effect. It doesn't change
+      Privoxy's behaviour, but makes understanding the log file easier.
+     </para>
+     </listitem>
+    </itemizedlist>
+   </para>
+  </listitem>
+  <listitem>
+   <para>
+    configure:
+    <itemizedlist>
+    <listitem>
+     <para>
+      Added a --disable-ipv6-support switch for platforms where support
+      is detected but doesn't actually work.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Do not check for the existence of strerror() and memmove() twice
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Remove a useless test for setpgrp(2). Privoxy doesn't need it and
+      it can cause problems when cross-compiling.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Rename the --disable-acl-files switch to --disable-acl-support.
+      Since about 2001, ACL directives are specified in the standard
+      config file.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Update the URL of the 'Removing outdated PCRE version after the
+      next stable release' posting. The old URL stopped working after
+      one of SF's recent site "optimizations". Reported by Han Liu.
+     </para>
+     </listitem>
+    </itemizedlist>
+   </para>
+  </listitem>
+  <listitem>
+   <para>
+    Privoxy-Regression-Test:
+    <itemizedlist>
+    <listitem>
+     <para>
+      Added --shuffle-tests option to increase the chances of detection race conditions.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Added a --local-test-file option that allows to use Privoxy-Regression-Test without Privoxy.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Added tests for missing socks4 and socks4a forwarders.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      The --privoxy-address option now works with IPv6 addresses containing brackets, too.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Perform limited sanity checks for parameters that are supposed to have numerical values.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Added a --sleep-time option to specify a number of seconds to
+      sleep between tests, defaults to 0.
      </para>
     </listitem>
     <listitem>
      <para>
-      Clean up white-space in http_response definition and
-      move the crunch_reason to the beginning.
+      Disable the range-requests tagger for tests that break if it's enabled.
      </para>
     </listitem>
     <listitem>
      <para>
-      Turn http_response.reason into an enum and rename it
-      to http_response.crunch_reason.
+      Log messages use the ISO 8601 date format %Y-%m-%d.
      </para>
     </listitem>
     <listitem>
      <para>
-      Silence a 'gcc (Debian 4.3.2-1.1) 4.3.2' warning on i686 GNU/Linux.
+      Fix spelling in two error messages.
      </para>
     </listitem>
     <listitem>
      <para>
-      Fix white-space in a log message in remove_chunked_transfer_coding().
-      While at it, add a note that the message doesn't seem to
-      be entirely correct and should be improved later on.
+      In the --help output, include a list of supported tests and their default levels.
      </para>
     </listitem>
+    <listitem>
+     <para>
+      Adjust the tests to properly deal with FEATURE_TOGGLE being disabled.
+     </para>
+     </listitem>
     </itemizedlist>
    </para>
   </listitem>
   <listitem>
    <para>
-    GNUmakefile improvements:
+    Privoxy-Log-Parser:
     <itemizedlist>
     <listitem>
      <para>
-      Use $(SSH) instead of ssh, so one only needs to specify a username once.
+      Perform limited sanity checks for command line parameters that
+      are supposed to have numerical values.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Implement a --unbreak-lines-only option to try to revert MUA breakage.
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Accept and highlight: Added header: Content-Encoding: deflate
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      Accept and highlight: Compressed content from 29258 to 8630 bytes.
      </para>
     </listitem>
     <listitem>
      <para>
-      Removed references to the action feedback thingy that hasn't been
-      working for years.
+      Accept and highlight: Client request arrived in time on socket 21.
      </para>
     </listitem>
     <listitem>
      <para>
-      Consistently use shell.sourceforge.net instead of shell.sf.net so
-      one doesn't need to check server fingerprints twice.
+      Highlight: Didn't receive data in time: a.fsdn.com:443
      </para>
     </listitem>
     <listitem>
      <para>
-      Removed GNUisms in the webserver and webactions targets so they
-      work with standard tar.
+      Accept log messages with ISO 8601 time stamps, too.
+     </para>
+     </listitem>
+    </itemizedlist>
+   </para>
+  </listitem>
+  <listitem>
+   <para>
+    uagen:
+    <itemizedlist>
+    <listitem>
+     <para>
+      Bump generated Firefox version to 8.0.
      </para>
     </listitem>
+    <listitem>
+     <para>
+      Only randomize the release date if the new --randomize-release-date
+      option is enabled. Firefox versions after 4 use a fixed date string
+      without meaning.
+     </para>
+     </listitem>
     </itemizedlist>
    </para>
   </listitem>
@@ -4117,9 +4573,19 @@ new action
    <para>
     This is a left-over from the time when <application>Privoxy</application>
     didn't support important HTTP/1.1 features well. It is left here for the
-    unlikely case that you experience HTTP/1.1 related problems with some server
-    out there. Not all HTTP/1.1 features and requirements are supported yet,
-    so there is a chance you might need this action.
+    unlikely case that you experience HTTP/1.1-related problems with some server
+    out there.
+   </para>
+   <para>
+    Note that enabling this action is only a workaround. It should not
+    be enabled for sites that work without it. While it shouldn't break
+    any pages, it has an (usually negative) performance impact.
+  </para>
+  <para>
+    If you come across a site where enabling this action helps, please report it,
+    so the cause of the problem can be analyzed. If the problem turns out to be
+    caused by a bug in  <application>Privoxy</application> it should be
+    fixed so the following release works without the work around.
    </para>
   </listitem>
  </varlistentry>
@@ -4356,10 +4822,10 @@ problem-host.example.com</screen>
     by defining appropriate <literal>-filter</literal> exceptions.
    </para>
    <para>
-    Compressed content can't be filtered either, unless &my-app;
-    is compiled with zlib support (requires at least &my-app; 3.0.7),
-    in which case &my-app; will decompress the content before filtering
-    it.
+    Compressed content can't be filtered either, but if &my-app;
+    is compiled with zlib support and a supported compression algorithm
+    is used (gzip or deflate), &my-app; can first decompress the content
+    and then filter it.
    </para>
    <para>
     If you use a &my-app; version without zlib support, but want filtering to work on
@@ -8914,6 +9380,38 @@ In file: user.action <guibutton>[ View ]</guibutton> <guibutton>[ Edit ]</guibut
  USA
 
  $Log: user-manual.sgml,v $
+ Revision 2.143  2011/11/20 17:16:36  fabiankeil
+ Last minute ChangeLog changes that didn't make it into the tarball
+
+ Revision 2.142  2011/11/20 12:43:38  fabiankeil
+ Update ChangeLog. Once more, with feeling.
+
+ Revision 2.141  2011/11/20 12:41:22  fabiankeil
+ Document the +fast-redirects{} HTTP response splitting fix
+
+ Revision 2.140  2011/11/19 15:18:02  fabiankeil
+ Update ChangeLog
+
+ Revision 2.139  2011/11/18 16:49:29  fabiankeil
+ Update ChangeLog
+
+ Revision 2.138  2011/11/13 17:03:54  fabiankeil
+ Bump entities for 3.0.18 stable
+
+ Revision 2.137  2011/11/13 17:02:59  fabiankeil
+ Import the first ChangeLog draft for 3.0.18 stable
+
+ Revision 2.136  2011/10/14 16:53:10  fabiankeil
+ Clarify the effect of compiling Privoxy with zlib support
+
+ Suggested by dg1727 in #3423782.
+
+ zlib support has been available for years now,
+ so drop the reference to Privoxy 3.0.7
+
+ Revision 2.135  2011/09/04 11:10:12  fabiankeil
+ Ditch trailing whitespace
+
  Revision 2.134  2011/08/18 11:45:02  fabiankeil
  Don't use unspecified MSN sites as examples for User-Agent-based descrimination