X-Git-Url: http://www.privoxy.org/gitweb/gpl.html?a=blobdiff_plain;f=doc%2Fwebserver%2Fannounce.txt;h=446acf299ba5128bd2e1398ff33c7694f9d1fecb;hb=7622d8a504b5c9c22fac96f24f02c14c0225bd37;hp=376a67b1a33f3ede428c88cddeaefa5ce634ad51;hpb=04acd2f3876f02e309f8ae940c5fe8df1b244024;p=privoxy.git diff --git a/doc/webserver/announce.txt b/doc/webserver/announce.txt index 376a67b1..446acf29 100644 --- a/doc/webserver/announce.txt +++ b/doc/webserver/announce.txt @@ -1,306 +1,149 @@ - Announcing Privoxy 3.0.30 stable + Announcing Privoxy 3.0.34 stable -------------------------------------------------------------------- -Privoxy 3.0.30 stable fixes a couple of bugs and introduces -a few new features. +Privoxy 3.0.34 fixes a few minor bugs and comes with a couple of +general improvements and new features. + +Please note that Google started to bounce messages from the Privoxy +mailing lists a couple of months ago. As a result gmail users have +been unsubscribed by Mailman. If you are affected by this, please +resubscribe with a different mail address. The Privoxy project has +limited resources and limited time to investigate an issue that +only affects gmail addresses. -------------------------------------------------------------------- -ChangeLog for Privoxy 3.0.30 +ChangeLog for Privoxy 3.0.34 -------------------------------------------------------------------- - - Bug fixes: - - Check the actual URL for redirects when https inspecting requests. - Previously Privoxy would only check the path which resulted in - rewrite results being rejected as invalid URLs. - Reported by withoutname in #1736. - - Let the hide-referrer code tolerate Referer headers with https:// URLs. - Previously they would always be treated like a changed host. - - Use the https headers if the show-request handler is reached through - https://. Previously Privoxy would use the http headers which - may be empty on a reused connection. - - Make CGI_PREFIX protocol-relative when building with FEATURE_HTTPS_INSPECTION. - This unbreaks (at least) https://config.privoxy.org/client-tags whose - buttons would previously use a http:// URL resulting in browser warnings. - - Support using https-inspection and client-header-order at the same time. - Previously Privoxy would crash. - Reported by: Kai Raven - - Properly reject rewrites from http to https as they currently - aren't supported. Previously Privoxy would wait for the client - to establish an encrypted connection which obviously would not happen. - - When https inspection is enabled and Privoxy has been compiled with - FEATURE_GRACEFUL_TERMINATION (not recommended for production builds), - the TLS backend resources are free'd later on and only if no active - connections are left. Prevents crashes when exiting "gracefully" at the - wrong time. + - Improve the handling of chunk-encoded responses by buffering the data + even if filters are disabled and properly keeping track of where the + various chunks are supposed to start and end. Previously Privoxy would + merely check the last bytes received to see if they looked like the + last-chunk. This failed to work if the last-chunk wasn't received in one + read and could also result in actual data being misdetected + as last-chunk. + Should fix: SF support request #1739. + Reported by: withoutname. + - remove_chunked_transfer_coding(): Refuse to de-chunk invalid data + Previously the data could get corrupted even further. + Now we simply pass the unmodified data to the client. + - gif_deanimate(): Tolerate multiple image extensions in a row. + This allows to deanimate all the gifs on: + https://commons.wikimedia.org/wiki/Category:Animated_smilies + Fixes SF bug #795 reported by Celejar. + - OpenSSL generate_host_certificate(): Use X509_get_subject_name() + instead of X509_get_issuer_name() to get the issuer for generated + website certificates so there are no warnings in the browser when using + an intermediate CA certificate instead of a self-signed root certificate. + Problem reported and patch submitted by Chakib Benziane. + - can_filter_request_body(): Fix a log message that contained a spurious u. + - handle_established_connection(): Check for pending TLS data from the client + before checking if data is available on the connection. + The TLS library may have already consumed all the data from the client + response in which case poll() and select() will not detect that data is + available to be read. + Sponsored by: Robert Klemme. + - ssl_send_certificate_error(): Don't crash if there's no certificate + information available. This is only relevant when Privoxy is built with + wolfSSL 5.0.0 or later (code not yet published). Earlier wolfSSL versions + or the other TLS backends don't seem to trigger the crash. + - socks5_connect(): Add support for target hosts specified as IPv4 address + Previously the IP address was sent as domain. - General improvements: - - Allow to rewrite the request destination for https-inspected - requests behind the client's back. The documentation already sort - of claimed that it was supported by not especially mentioning that - it didn't work for https-inspected requests. - Fixes SF bug #923 reported by withoutname. - - Add support for filtering client request bodies by using - CLIENT-BODY-FILTER filters which can be enabled with the - client-body-filter action. - Patch submitted by Maxim Antonov. - Sponsored by: Robert Klemme - - Add the new action suppress-tag{} which can be used to prevent - a tagger from adding a tag. Patch submitted by Maxim Antonov. - Sponsored by: Robert Klemme - - Gracefully handle existing website keys without matching certificates. - This can happen if Privoxy was previously running with an invalid - TLS configuration that didn't allow it to create a certificate. - - Recycle debug bit 4 for Tagging-related messages. - - Improve the message shown when the client-tags CGI page - is requested with no tags configured. - - Shorten the 'donate' and 'participate' links used by templates - using redirects. Currently the redirects lead to the FAQ entries - but in the future we may want to relocate the content and using - redirects makes this more convenient. - - Log an error when a PCRE-HOST-PATTERN is used with - FEATURE_PCRE_HOST_PATTERNS disabled. Don't treat this a - fatal error so the regression tests can be used with and - without FEATURE_PCRE_HOST_PATTERNS. - - The code compiles with older C compilers again. - - The chdir() return code is checked to fix a compiler warning. - - The packages feed has been removed from the source tarball. - It's usually out of date when the source tarball is generated - for the release. - - Fixed harmless compiler warnings from GCC9 with -D_FORTIFY_SOURCE=2. - - windows: Remove obsolete '$(DEST)/doc/images' target. - - windows: Install the images referenced in the user manual. - - Remove obsolete 'gnu_regex.@OBJEXT@' target. - - When installing from the GNUMAkefile, don't create an 'images' - directory which is no longer used. The images were relocated to - the user-manual directory years ago. - - Add new FEATURES to the show-status page and resort list. - - Remove unused variable in the OpenSSL-specific code. - - Update bug tracker URL in cgi_error_unknown(). - - Saved a couple of memory allocations when sorting client headers. - - Improved a couple of error messages. - - Saved memory allocations when using OpenSSL and checking if a - key already exists. - - The configure script will bail out if OpenSSL and mbedTLS are - enabled at the same time. - - Log a message right before exiting gracefully. - - A couple of structures have been rearranged to require slightly - less memory. - - When https inspection is enabled and the certificate is invalid - the error message is now sent with status code 403 instead of 200. - - The Slackware rc script template has been renamed to - slackware/rc.privoxy.in to silence complaints when building - Debian packages. - - When building with MbedTLS support, mbedtls_md5_ret() is used - instead of mbedtls_md5() which is deprecated and causes a warning - on Debian GNU/Linux. + - Add a client-body-tagger action which creates tags based on + the content of the request body. + Sponsored by: Robert Klemme. + - When client-body filters are enabled, buffer the whole request + before opening a connection to the server. + Makes it less likely that the server connection times out + and we don't open a connection if the buffering fails anyway. + Sponsored by: Robert Klemme. + - Add periods to a couple of log messages. + - accept_connection(): Add missing space to a log message. + - Initialize ca-related defaults with strdup_or_die() so errors + aren't silently ignored. + - make_path: Use malloc_or_die() in cases where allocation errors + were already fatal anyway. + - handle_established_connection(): Improve an error message slightly. + - receive_client_request(): Reject https URLs without CONNECT request. + - Include all requests in the statistics if mutexes are available. + Previously in case of reused connections only the last request got + counted. The statistics still aren't perfect but it's an improvement. + - Add read_socks_reply() and start using it in socks5_connect() + to apply the socket timeout more consistently. + - socks5_connect(): Deal with domain names in the socks reply + - Add a filter for bundeswehr.de that hides the cookie and + privacy info banner. - Action file improvements: - - Block requests to eu-tlp03.kameleoon.com/. - - Unblock metrics.sr.ht/. - - Disable fast-redirects for .fsf.org/. - - Disable fast-redirects for .gravater.com/. - - Disable fast-redirects for .ksta.de/. - - Block requests to tag.crsspxl.com/. - - Block requests to analytics.slashdotmedia.com/. - - Block requests to ml314.com/. - - Block requests to .adroll.com/. - - Block requests to fastlane.rubiconproject.com/. - - Block requests to api.theadex.com/. - - Block requests to ih.adscale.de/. - - Block requests to .s400.meetrics.net/. - - Block requests for pp.lp4.io/. - - Block requests for trc-events.taboola.com/. - -- Filter file improvements: - - A allow-autocompletion filter has been added which changes - autocomplete="off" to "on" on input fields to allow autocompletion. - Requested by Jamie Zawinski in #370. - Filter based on a submission by Aaron Linville. - - Added an imdb filter. - - Added a sourceforge filter that reduces the amount of ads - for proprietary software. - - Added a github filter that removes the annoying "Sign-Up" - banner and the Cookie disclaimer. - - Removed a duplicated pcrs command from the js-annoyances filter. - - The crude-parental filter now provides a short reason when blocking, - inserts a link to Privoxy's webinterface and adds a new line at - the end of the generated page. + - Disable filter{banners-by-size} for .freiheitsfoo.de/. + - Disable filter{banners-by-size} for freebsdfoundation.org/. + - Disable fast-redirects for consent.youtube.com/. + - Block requests to ups.xplosion.de/. + - Block requests for elsa.memoinsights.com/t. + - Fix a typo in a test. + - Disable fast-redirects for launchpad.net/. + - Unblock .eff.org/. + - Stop unblocking .org/.*(image|banner) which appears to be too generous + It let requests like: + https://stats.noblogs.org/piwik.php?action_name=anti%20gentrifizierungs%20fest&idsite=10175&rec=1&r=220192&h=17&m=7&s=44&url=https%3A%2F%2Fmuellemcalling.noblogs.org%2F&urlref=https%3A%2F%2Fmuellemcalling.noblogs.org%2Finfostande%2F&_id=&_idn=1&_refts=0&send_image=0&cookie=1&res=1366x768&pv_id=eqr7jX&pf_net=7&pf_srv=3&pf_tfr=2281&pf_dm1=156 + pass. + The example URL http://www.gnu.org/graphics/gnu-head-banner.png is + already unblocked due to .gnu.org being unblocked. + - Unblock adfd.org/. + - Disable filter{banners-by-link} for .eff.org/. + - Block requests to odb.outbrain.com/. + - Disable fast-redirects for .gandi.net/. + - Disable fast-redirects{} for .onion/.*/status/. + - Disable fast-redirects{} for twitter.com/.*/status/. + - Unblock pinkstinks.de/. + - Disable fast-redirects for .hagalil.com/. - Privoxy-Log-Parser: - - Highlight a few more messages. - - Add a handler for tagging messages. - - Properly deal with 'Certificate error' crunches - Previously the error description was highlighted as 'host'. - - Log truncated LOG_LEVEL_CLF messages more gracefully - and note that the statistics will be imprecise. - - Fixed perldoc typo. - - Bump version to 0.9.2. - -- Privoxy-Regression-Test: - - Use http://127.0.0.1:8118/ as default Privoxy address - unless http_proxy is set through the environment. - - Add a --privoxy-cgi-prefix option that specifies the prefix - to use when building URLs that are supposed to reach Privoxy's - CGI interface. If it's not set, http://p.p/ is used, which is - supposed to work with the default Privoxy configuration. - If Privoxy has been built with FEATURE_HTTPS_INSPECTION enabled, - and if https inspection is activated with the +https-inspection - action, this option can be used with "https://p.p/" provided the - system running Privoxy-Regression-Test has been configured to - trust the certificate used by Privoxy. - Note that there are currently two tests in the official - regression-tests.action file that are expected to fail - when using "https://p.p/" as privoxy-cgi-prefix. - - Skip the connection-established response in get_status_code() - when looking for the status code with a CGI prefix - that starts with https://. We care about the status code - sent by the impersonated web server. - - Use --proxy-header when using a CGI prefix with https:// - and a "Host:" header. - - Allow '|' in tokens and values to allow tag patterns like - "TAG:^(application|text)/(x-)?javascript$". - - When get_cgi_page_or_else() fails, include the URL of the - requested page in the log message. - - Added a --check-bad-ssl option that can be used to verify that - Privoxy detects certificate problems when accessing the test - sites from badssl.com. - - Bumped version to 0.7.2 + - Bump version to 0.9.5. + - Highlight more log messages. + - Highlight the Crunch reason only once. Previously the "crunch reason" + could also be highlighted when the URL contained a matching string. + The real crunch reason only occurs once per line, so there's no need + to continue looking for it after it has been found once. + While at it, add a comment with an example log line. - uagen: - - Update example output. - - Recommend the use of the https-inspection action in the documentation. - - Upgrade a couple of URLs to https://. - - Add ElectroBSD to the list of operating systems. - - Bumped generated Firefox version to 78 (ESR). - - Bumped version to 1.2.2. - - - User documentation: - - Remove reference to 'How to Report Bugs Effectively'. - It was only rendered as text without URL in the README anyway - and there's no indication that users read it ... - - Let the dok-readme target fix the location embedded into the - README file. This used to be done by CVS but since the git migration - it has to be done through other means. - - Remove 'experimental' warning for client-specific-tag-related directives. - They seem to work reliably and there is no obvious reason - why we would change the syntax in the near future. - - Describe how to check if Privoxy has been built with - FEATURE_HTTPS_INSPECTION. - - Add a link to the trusted-cas-file documentation - that explains how the user can create the file herself. - - Don't explicitly mention the license for the code coming from - 'Anonymous Coders' and Junkbusters. It's obviously licensed under - the GNU GPL like the rest of Privoxy or we wouldn't be allowed to - distribute it. - - Update the +hide-user-agent example with uagen output. - - Slightly improve the wording of the ca-key-file documentation. - - Explicitly mention Windows 10 as supported so search engines and - users looking for it can find it. - - Import a bunch of contributors from the ChangeLog. - - Remove obsolete doc/gpl.html. - - Upgrade a couple of links to https://. - - Don't prefer the SourceForge patch tracker over the - privoxy-devel mailing list. While at it, link to the - SourceForge patch tracker. - - Mention http-inspection in the 'my browser warns me about - unauthenticated content' FAQ entry. - - Simplify the 'Is there is a license or fee?' FAQ entry. - - Add another +redirect{} example. - - Explicitly mention that interested sponsors should include - the link target in their first mail. - - Clarify that only Privoxy team members can object to new sponsors - and link to the list of current team members. - - Note that sponsor URLs may not contain keyword spam. - - Garbage collect doc/webserver/images which isn't referenced anymore. - - Update the method to reach the proxy settings in Firefox. - - Update proxy_setup.jpg description to refer to Firefox. - - Regenerate proxy_setup.jpg with a more recent Firefox (78.0). - - Regenerate files-in-use.jpg without obsolete standard.action - with modern colors and a slightly better quality. - - Update URL to the actionsfile tracker. - - Update a support request URL. - - Rephrase the 'Can Privoxy run as service' FAQ entry and - remove an obsolete paragraph. - - Let the 'Where can I get updated Actions Files?' entry link to - the gitweb version of default.action.master. - - Update a link to the default.action file. - - Update URLs for trackers and mailing lists. - - Replace CVS reference with git. - - Mention regression-tests.action in the config file. - - Explicitly mention in the config file that access to the - CA key should be limited to Privoxy. - - List more client-specific-tag examples for inspiration. - - Add additional headers to the client-header-order example. - - Note that actions aren't updated after rewrites. - - Explicitly mention that upgrading from http to https with - a client-header filter is not supported - - Note that protocol and host have to be added when rewriting - the destination host for https-inspected requests. - - Explicitly mention that the CA key is used to sign certificates. - - Put openssl command in 'command' tags. - - The man page has been moved from section 1 to man section 8. - -- Developer manual: - - Flesh out the build instructions for Debian. - - Remove the packaging instructions for RPM-based systems. - They don't work and we don't release RPM packages anymore anyway. - - Remove the packaging instructions for Solaris. - They don't work and we don't release Solaris packages anymore anyway. - - Update the suggested subject for the announce mails. - - Update upload instructions. - ftp://upload.sourceforge.net is no longer functional. - - Remove a couple of package-dependent upload instructions - that don't actually work. - - Remove 'cd current' that no longer works. - - Add regression-tests.action to the list of files that should be installed. - - Stop claiming that there are text versions of the manuals. - We stopped building them in 2008 (9ed36a3c5e6f12). - - Note that the 'webserver' target creates the link needed for the user-manual. - - Suggest to use the master branch as reference when creating - the ChangeLog so the steps work when the current branch differs - from master which is likely as the developer manual - suggests to use a local branch for development. - - Add the -s flag to the suggested 'git tag' command. We prefer signed tags. - - Mention that merges into 'master' should be avoided. - - Add git commands that should result in a merge-free history. - - Mention Privoxy-Regression-Test. - - Add a section id to reduce link churn. - - Recommend the dok-tidy target when building docs for the webserver. - - Add another plug for the privoxy-devel mailing list. - - Let the intro link the copyright section in the user manual instead - of giving an incomplete summary of the license status. - - Clarify that the webserver target uploads to the SourceForge webserver. - - Mark the documentation for the Mac OS X installers as out of date and - change the SCM name back to CVS. - - Fix the location of the installer modules for Mac OS X. - They are not actually available through git (yet). - - Don't speak of Privoxy version 3 in the past tense. - - Update the list of programs required for the release process. - - Update description of the webserver target which uses ssh, not scp. - - Remove obsolete reference to config.new. - -- Tests: - - Add another hide-referrer{conditional-block} test. - - Add another hide-referrer{conditional-forge} test. - - Fix a hide-referrer{conditional-forge} test - that expected an acceptable header to be forged. - - Fix a hide-referrer{conditional-block} test - that expected an acceptable Referer to be removed. - - Explain why the "Set Header = Host: whatever.example.org" test is - expected to fail when using a CGI prefix that starts with "https://". - - Explain why a connection-sharing test is known to fail - when using "https://p.p/" as CGI prefix. - - Add a link to Privoxy-Regression-Test to regression-tests.action - in case it isn't packaged. - - Add regression tests for pcre host patterns. - -- Privoxy infrastructure: - - Import a Privoxy logo for the website. - - Update Tor onion service to HiddenServiceVersion 3. - - Display the "model" photos in a single row and remove placeholder images. - - Regenerate homepage with updated sponsor list. - - Use the '/sponsor' redirect for the link to the sponsor page. - - Git commit messages are sent to the Privoxy-commits mailing list. + - Bump version to 1.2.4. + - Update BROWSER_VERSION and BROWSER_REVISION to 102.0 + to match the User-Agent of the current Firefox ESR. + - Explicitly document that changing the 'Gecko token' is suspicious. + - Consistently use a lower-case 'c' as copyright symbol. + - Bump copyright. + - Add 'aarch64' as Linux architecture. + - Add OpenBSD architecture 'arm64'. + - Stop using sparc64 as FreeBSD architecture. + It hasn't been supported for a while now. + +- Build system: + - Makefile: Add a 'dok' target that depends on the 'error' target + to show the "You are not using GNU make or did nor run configure" + message. + - configure: Fix --with-msan option. + Also (probably) reported by Andrew Savchenko. + +- macOS build system: + - Enable HTTPS inspection when building the macOS binary + (using OpenSSL as TLS library). + +- Documentation: + - Add OpenSSL to the list of libraries that may be licensed under the + Apache 2.0 license in which case the linked Privoxy binary has to be + distributed under the GPLv3 or later. + - config: Fix the documented ca-directory default value. + Reported by avoidr. + - Rebuild developer-manual and tidy with 'HTML Tidy for FreeBSD version 5.8.0'. + - Update developer manual with new macOS packaging instructions. + - Note that the FreeBSD installation instructions work for + ElectroBSD as well. + - Note that FreeBSD/ElectroBSD users can try to install Privoxy + as binary package using 'pkg'. ----------------------------------------------------------------- About Privoxy: @@ -313,7 +156,7 @@ flexible configuration and can be customized to suit individual needs and tastes. It has application for both stand-alone systems and multi-user networks. -Privoxy is Free Software and licensed under the GNU GPLv2. +Privoxy is Free Software and licensed under the GNU GPLv2 or later. Our TODO list is rather long. Helping hands and donations are welcome: