From 5ee3e711d51e9fc40564f25fed2dccde2c76656c Mon Sep 17 00:00:00 2001 From: Fabian Keil Date: Tue, 4 Mar 2008 18:30:44 +0000 Subject: [PATCH] Remove the treat-forbidden-connects-like-blocks action. We now use the "blocked" page for forbidden CONNECT requests by default. --- ChangeLog | 3 ++ actionlist.h | 6 ++- actions.c | 28 ++++++++++- default.action.master | 13 +---- doc/source/user-manual.sgml | 91 +++------------------------------- jcc.c | 59 ++++++---------------- project.h | 10 ++-- standard.action | 3 +- templates/edit-actions-for-url | 21 ++------ 9 files changed, 67 insertions(+), 167 deletions(-) diff --git a/ChangeLog b/ChangeLog index 10275f88..da624222 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,9 @@ ChangeLog for Privoxy the show-status page hides the edit buttons and explains why. Previously the user would get the "this feature has been disabled" message after using the edit button. +- Forbidden CONNECT requests are treated like blocks by default. + The now-pointless treat-forbidden-connects-like-blocks action + has been removed. - Fixed false-positives with the link-by-url filter and URLs that contain the pattern "/jump/". - The less-download-windows filter no longer messes diff --git a/actionlist.h b/actionlist.h index 929b73d0..2bb89172 100644 --- a/actionlist.h +++ b/actionlist.h @@ -39,6 +39,10 @@ * * Revisions : * $Log: actionlist.h,v $ + * Revision 1.29 2008/03/01 14:00:43 fabiankeil + * Let the block action take the reason for the block + * as argument and show it on the "blocked" page. + * * Revision 1.28 2007/12/11 21:08:29 fabiankeil * Let the CGI editor suggest a forward-override * parameter whose syntax is actually valid. @@ -237,8 +241,6 @@ DEFINE_ACTION_STRING ("set-image-blocker", ACTION_IMAGE_BLOCKER, DEFINE_CGI_PARAM_RADIO ("set-image-blocker", ACTION_IMAGE_BLOCKER, ACTION_STRING_IMAGE_BLOCKER, "pattern", 1) DEFINE_CGI_PARAM_RADIO ("set-image-blocker", ACTION_IMAGE_BLOCKER, ACTION_STRING_IMAGE_BLOCKER, "blank", 0) DEFINE_CGI_PARAM_CUSTOM ("set-image-blocker", ACTION_IMAGE_BLOCKER, ACTION_STRING_IMAGE_BLOCKER, CGI_PREFIX "send-banner?type=pattern") -DEFINE_ACTION_BOOL ("treat-forbidden-connects-like-blocks", ACTION_TREAT_FORBIDDEN_CONNECTS_LIKE_BLOCKS) - #if DEFINE_ACTION_ALIAS diff --git a/actions.c b/actions.c index d5c02c48..2fb546f4 100644 --- a/actions.c +++ b/actions.c @@ -1,4 +1,4 @@ -const char actions_rcs[] = "$Id: actions.c,v 1.42 2008/02/09 15:15:38 fabiankeil Exp $"; +const char actions_rcs[] = "$Id: actions.c,v 1.43 2008/03/01 14:00:43 fabiankeil Exp $"; /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/actions.c,v $ @@ -33,6 +33,10 @@ const char actions_rcs[] = "$Id: actions.c,v 1.42 2008/02/09 15:15:38 fabiankeil * * Revisions : * $Log: actions.c,v $ + * Revision 1.43 2008/03/01 14:00:43 fabiankeil + * Let the block action take the reason for the block + * as argument and show it on the "blocked" page. + * * Revision 1.42 2008/02/09 15:15:38 fabiankeil * List active and inactive actions in the show-url-info's * "Final results" section separately. Patch submitted by Lee @@ -602,6 +606,23 @@ jb_err get_action_token(char **line, char **name, char **value) return JB_ERR_OK; } +/********************************************************************* + * + * Function : action_used_to_valid_ + * + * Description : Checks if unrecognized actions were valid in earlier + * releases. + * + * Parameters : + * 1 : action = The string containing the action to check. + * + * Returns : True if yes, otherwise false. + * + *********************************************************************/ +static int action_used_to_be_valid(const char *action) +{ + return (0 == strcmpic(action, "treat-forbidden-connects-like-blocks")); +} /********************************************************************* * @@ -781,6 +802,11 @@ jb_err get_actions(char *line, /* Found it */ merge_actions(cur_action, alias->action); } + else if ((2 < strlen(option)) && action_used_to_be_valid(option+1)) + { + log_error(LOG_LEVEL_ERROR, "Action '%s' is no longer valid " + "in this Privoxy release. Ignored.", option+1); + } else { /* Bad action name */ diff --git a/default.action.master b/default.action.master index 23433ebd..eeadb155 100644 --- a/default.action.master +++ b/default.action.master @@ -9,7 +9,7 @@ # # File : $Source: /cvsroot/ijbswa/current/default.action.master,v $ # -# $Id: default.action.master,v 1.113 2008/03/01 14:00:44 fabiankeil Exp $ +# $Id: default.action.master,v 1.114 2008/03/01 15:25:34 fabiankeil Exp $ # # Requires : This version requires Privoxy v3.0.9 or later due to # syntax changes. @@ -491,17 +491,6 @@ # This allows you to add an arbitrary cookie. Specify it multiple # times in order to add several cookies. # -# +treat-forbidden-connects-like-blocks -# If this action is enabled, Privoxy no longer makes a difference between -# forbidden connects and ordinary blocks. -# -# By default Privoxy answers forbidden "Connect" requests with a short -# error message inside the headers. If the browser doesn't display headers -# (most don't), you just see an empty page. With this action enabled, -# Privoxy displays the message that is used for ordinary blocks instead. If -# you decide to make an exception for the page in question, you can do so -# by following the "See why" link. -# ############################################################################# ############################################################################# diff --git a/doc/source/user-manual.sgml b/doc/source/user-manual.sgml index 6a07d878..bc82970c 100644 --- a/doc/source/user-manual.sgml +++ b/doc/source/user-manual.sgml @@ -33,7 +33,7 @@ This file belongs into ijbswa.sourceforge.net:/home/groups/i/ij/ijbswa/htdocs/ - $Id: user-manual.sgml,v 2.63 2008/02/22 05:50:37 markm68k Exp $ + $Id: user-manual.sgml,v 2.64 2008/03/01 14:10:28 fabiankeil Exp $ Copyright (C) 2001-2008 Privoxy Developers http://www.privoxy.org/ See LICENSE. @@ -59,7 +59,7 @@ -$Id: user-manual.sgml,v 2.63 2008/02/22 05:50:37 markm68k Exp $ +$Id: user-manual.sgml,v 2.64 2008/03/01 14:10:28 fabiankeil Exp $ - -treat-forbidden-connects-like-blocks - - - - Typical use: - - Block forbidden connects with an easy to find error message. - - - - - Effect: - - - If this action is enabled, Privoxy no longer - makes a difference between forbidden connects and ordinary blocks. - - - - - - Type: - - - Boolean - - - - - Parameter: - - N/A - - - - - Notes: - - - By default Privoxy answers - forbidden Connect requests - with a short error message inside the headers. If the browser doesn't display - headers (most don't), you just see an empty page. - - - With this action enabled, Privoxy displays - the message that is used for ordinary blocks instead. If you decide - to make an exception for the page in question, you can do so by - following the See why link. - - - For Connect requests the clients tell - Privoxy which host they are interested - in, but not which document they plan to get later. As a result, the - Go there anyway wouldn't work and is therefore suppressed. - - - - - - Example usage: - - - +treat-forbidden-connects-like-blocks - - - - - - - Summary @@ -8662,8 +8584,7 @@ In file: user.action [ View ] [ Edit ] + +set-image-blocker {pattern} @@ -8785,8 +8706,7 @@ In file: user.action [ View ] [ Edit ][ View ] [ Edit ]ssl) + if (http->ssl && connect_port_is_forbidden(csp)) { - if (connect_port_is_forbidden(csp)) - { - const char *acceptable_connect_ports = - csp->action->string[ACTION_STRING_LIMIT_CONNECT] ? - csp->action->string[ACTION_STRING_LIMIT_CONNECT] : - "443 (implied default)"; - if (csp->action->flags & ACTION_TREAT_FORBIDDEN_CONNECTS_LIKE_BLOCKS) - { - /* - * The response may confuse some clients, - * but makes unblocking easier. - * - * XXX: It seems to work with all major browsers, - * so we should consider returning a body by default someday ... - */ - log_error(LOG_LEVEL_INFO, "Request from %s marked for blocking. " - "limit-connect{%s} doesn't allow CONNECT requests to port %d.", - csp->ip_addr_str, acceptable_connect_ports, csp->http->port); - csp->action->flags |= ACTION_BLOCK; - http->ssl = 0; - } - else - { - write_socket(csp->cfd, CFORBIDDEN, strlen(CFORBIDDEN)); - log_error(LOG_LEVEL_INFO, "Request from %s denied. " - "limit-connect{%s} doesn't allow CONNECT requests to port %d.", - csp->ip_addr_str, acceptable_connect_ports, csp->http->port); - assert(NULL != csp->http->ocmd); - log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 403 0", csp->ip_addr_str, csp->http->ocmd); - - list_remove_all(csp->headers); - /* - * XXX: For consistency we might want to log a crunch message here. - */ - return; - } - } + const char *acceptable_connect_ports = + csp->action->string[ACTION_STRING_LIMIT_CONNECT] ? + csp->action->string[ACTION_STRING_LIMIT_CONNECT] : + "443 (implied default)"; + log_error(LOG_LEVEL_INFO, "Request from %s marked for blocking. " + "limit-connect{%s} doesn't allow CONNECT requests to port %d.", + csp->ip_addr_str, acceptable_connect_ports, csp->http->port); + csp->action->flags |= ACTION_BLOCK; + http->ssl = 0; } if (http->ssl == 0) diff --git a/project.h b/project.h index a01b5bfa..678f401d 100644 --- a/project.h +++ b/project.h @@ -1,7 +1,7 @@ #ifndef PROJECT_H_INCLUDED #define PROJECT_H_INCLUDED /** Version string. */ -#define PROJECT_H_VERSION "$Id: project.h,v 1.102 2008/02/03 13:46:14 fabiankeil Exp $" +#define PROJECT_H_VERSION "$Id: project.h,v 1.103 2008/03/01 14:00:45 fabiankeil Exp $" /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/project.h,v $ @@ -37,6 +37,10 @@ * * Revisions : * $Log: project.h,v $ + * Revision 1.103 2008/03/01 14:00:45 fabiankeil + * Let the block action take the reason for the block + * as argument and show it on the "blocked" page. + * * Revision 1.102 2008/02/03 13:46:14 fabiankeil * Add SOCKS5 support. Patch #1862863 by Eric M. Hopper with minor changes. * @@ -1055,10 +1059,8 @@ struct iob #define ACTION_HANDLE_AS_EMPTY_DOCUMENT 0x08000000UL /** Action bitmap: Redirect request. */ #define ACTION_REDIRECT 0x10000000UL -/** Action bitmap: Answer blocked Connects verbosely */ -#define ACTION_TREAT_FORBIDDEN_CONNECTS_LIKE_BLOCKS 0x20000000UL /** Action bitmap: Override the forward settings in the config file */ -#define ACTION_FORWARD_OVERRIDE 0x40000000UL +#define ACTION_FORWARD_OVERRIDE 0x20000000UL /** Action string index: How to deanimate GIFs */ diff --git a/standard.action b/standard.action index a02ff24c..8a45e827 100644 --- a/standard.action +++ b/standard.action @@ -2,7 +2,7 @@ # # File : $Source: /cvsroot/ijbswa/current/standard.action,v $ # -# $Id: standard.action,v 1.21 2007/09/01 11:06:04 fabiankeil Exp $ +# $Id: standard.action,v 1.22 2007/11/07 18:01:10 fabiankeil Exp $ # # Purpose : Provide prefedined sets of actions, see # http://www.privoxy.org/user-manual/actions-file.html @@ -90,6 +90,5 @@ standard.Medium +limit-connect{,} \ +overwrite-last-modified{randomize} \ +set-image-blocker{pattern} \ -+treat-forbidden-connects-like-blocks \ } standard.Advanced diff --git a/templates/edit-actions-for-url b/templates/edit-actions-for-url index 145ad50c..6a255d8e 100644 --- a/templates/edit-actions-for-url +++ b/templates/edit-actions-for-url @@ -32,6 +32,10 @@ # # Revisions : # $Log: edit-actions-for-url,v $ +# Revision 1.49 2008/03/01 14:00:47 fabiankeil +# Let the block action take the reason for the block +# as argument and show it on the "blocked" page. +# # Revision 1.48 2007/12/11 21:18:55 fabiankeil # Make forward-override accessible through the CGI editor. # @@ -1321,23 +1325,6 @@ function show_send_wafer_opts(tf) - - - - - treat-forbidden-connects-like-blocks - - Answer forbidden Connect requests with the usual block message. - Makes unblocking easier, but the go there anyway link will not work - as expected. - - -- 2.39.2