-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01
-Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
-<html>
- <head>
- <title>
- The Main Configuration File
- </title>
- <meta name="GENERATOR" content=
- "Modular DocBook HTML Stylesheet Version 1.79">
- <link rel="HOME" title="Privoxy 3.0.26 User Manual" href="index.html">
- <link rel="PREVIOUS" title="Privoxy Configuration" href=
- "configuration.html">
- <link rel="NEXT" title="Actions Files" href="actions-file.html">
- <link rel="STYLESHEET" type="text/css" href="../p_doc.css">
- <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
- <link rel="STYLESHEET" type="text/css" href="p_doc.css">
- </head>
- <body class="SECT1" bgcolor="#EEEEEE" text="#000000" link="#0000FF" vlink=
- "#840084" alink="#0000FF">
- <div class="NAVHEADER">
- <table summary="Header navigation table" width="100%" border="0"
- cellpadding="0" cellspacing="0">
- <tr>
- <th colspan="3" align="center">
- Privoxy 3.0.26 User Manual
- </th>
- </tr>
- <tr>
- <td width="10%" align="left" valign="bottom">
- <a href="configuration.html" accesskey="P">Prev</a>
- </td>
- <td width="80%" align="center" valign="bottom">
- </td>
- <td width="10%" align="right" valign="bottom">
- <a href="actions-file.html" accesskey="N">Next</a>
- </td>
- </tr>
- </table>
- <hr align="LEFT" width="100%">
- </div>
- <div class="SECT1">
- <h1 class="SECT1">
- <a name="CONFIG">7. The Main Configuration File</a>
- </h1>
- <p>
- By default, the main configuration file is named <tt class=
- "FILENAME">config</tt>, with the exception of Windows, where it is
- named <tt class="FILENAME">config.txt</tt>. Configuration lines
- consist of an initial keyword followed by a list of values, all
- separated by whitespace (any number of spaces or tabs). For example:
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">confdir /etc/privoxy</i></span></tt>
- </p>
-
- <p>
- Assigns the value <tt class="LITERAL">/etc/privoxy</tt> to the option
- <tt class="LITERAL">confdir</tt> and thus indicates that the
- configuration directory is named <span class=
- "QUOTE">"/etc/privoxy/"</span>.
- </p>
- <p>
- All options in the config file except for <tt class=
- "LITERAL">confdir</tt> and <tt class="LITERAL">logdir</tt> are
- optional. Watch out in the below description for what happens if you
- leave them unset.
- </p>
- <p>
- The main config file controls all aspects of <span class=
- "APPLICATION">Privoxy</span>'s operation that are not location
- dependent (i.e. they apply universally, no matter where you may be
- surfing). Like the filter and action files, the config file is a
- plain text file and can be modified with a text editor like emacs,
- vim or notepad.exe.
- </p>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="LOCAL-SET-UP">7.1. Local Set-up Documentation</a>
- </h2>
- <p>
- If you intend to operate <span class="APPLICATION">Privoxy</span>
- for more users than just yourself, it might be a good idea to let
- them know how to reach you, what you block and why you do that,
- your policies, etc.
- </p>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="USER-MANUAL">7.1.1. user-manual</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Location of the <span class="APPLICATION">Privoxy</span>
- User Manual.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- A fully qualified URI
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- <a href="https://www.privoxy.org/user-manual/" target=
- "_top">https://www.privoxy.org/<tt class=
- "REPLACEABLE"><i>version</i></tt>/user-manual/</a> will be
- used, where <tt class="REPLACEABLE"><i>version</i></tt> is
- the <span class="APPLICATION">Privoxy</span> version.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- The User Manual URI is the single best source of
- information on <span class="APPLICATION">Privoxy</span>,
- and is used for help links from some of the internal CGI
- pages. The manual itself is normally packaged with the
- binary distributions, so you probably want to set this to a
- locally installed copy.
- </p>
- <p>
- Examples:
- </p>
- <p>
- The best all purpose solution is simply to put the full
- local <tt class="LITERAL">PATH</tt> to where the <i class=
- "CITETITLE">User Manual</i> is located:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- user-manual /usr/share/doc/privoxy/user-manual
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- The User Manual is then available to anyone with access to
- <span class="APPLICATION">Privoxy</span>, by following the
- built-in URL: <tt class=
- "LITERAL">http://config.privoxy.org/user-manual/</tt> (or
- the shortcut: <tt class=
- "LITERAL">http://p.p/user-manual/</tt>).
- </p>
- <p>
- If the documentation is not on the local system, it can be
- accessed from a remote server, as:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- user-manual http://example.com/privoxy/user-manual/
-</pre>
- </td>
- </tr>
- </table>
-
- <div class="WARNING">
- <table class="WARNING" border="1" width="90%">
- <tr>
- <td align="CENTER">
- <b>Warning</b>
- </td>
- </tr>
- <tr>
- <td align="LEFT">
- <p>
- If set, this option should be <span class=
- "emphasis"><i class="EMPHASIS">the first option in
- the config file</i></span>, because it is used
- while the config file is being read on start-up.
- </p>
- </td>
- </tr>
- </table>
- </div>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TRUST-INFO-URL">7.1.2. trust-info-url</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- A URL to be displayed in the error page that users will see
- if access to an untrusted page is denied.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- URL
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No links are displayed on the "untrusted" error page.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- The value of this option only matters if the experimental
- trust mechanism has been activated. (See <a href=
- "config.html#TRUSTFILE"><span class="emphasis"><i class=
- "EMPHASIS">trustfile</i></span></a> below.)
- </p>
- <p>
- If you use the trust mechanism, it is a good idea to write
- up some on-line documentation about your trust policy and
- to specify the URL(s) here. Use multiple times for multiple
- URLs.
- </p>
- <p>
- The URL(s) should be added to the trustfile as well, so
- users don't end up locked out from the information on why
- they were locked out in the first place!
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ADMIN-ADDRESS">7.1.3. admin-address</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- An email address to reach the <span class=
- "APPLICATION">Privoxy</span> administrator.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Email address
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No email address is displayed on error pages and the CGI
- user interface.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- If both <tt class="LITERAL">admin-address</tt> and <tt
- class="LITERAL">proxy-info-url</tt> are unset, the whole
- "Local Privoxy Support" box on all generated pages will not
- be shown.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="PROXY-INFO-URL">7.1.4. proxy-info-url</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- A URL to documentation about the local <span class=
- "APPLICATION">Privoxy</span> setup, configuration or
- policies.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- URL
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No link to local documentation is displayed on error pages
- and the CGI user interface.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- If both <tt class="LITERAL">admin-address</tt> and <tt
- class="LITERAL">proxy-info-url</tt> are unset, the whole
- "Local Privoxy Support" box on all generated pages will not
- be shown.
- </p>
- <p>
- This URL shouldn't be blocked ;-)
- </p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="CONF-LOG-LOC">7.2. Configuration and Log File
- Locations</a>
- </h2>
- <p>
- <span class="APPLICATION">Privoxy</span> can (and normally does)
- use a number of other files for additional configuration, help and
- logging. This section of the configuration file tells <span class=
- "APPLICATION">Privoxy</span> where to find those other files.
- </p>
- <p>
- The user running <span class="APPLICATION">Privoxy</span>, must
- have read permission for all configuration files, and write
- permission to any files that would be modified, such as log files
- and actions files.
- </p>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="CONFDIR">7.2.1. confdir</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The directory where the other configuration files are
- located.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Path name
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- /etc/privoxy (Unix) <span class="emphasis"><i class=
- "EMPHASIS">or</i></span> <span class=
- "APPLICATION">Privoxy</span> installation dir (Windows)
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class=
- "EMPHASIS">Mandatory</i></span>
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- No trailing <span class="QUOTE">"<tt class=
- "LITERAL">/</tt>"</span>, please.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TEMPLDIR">7.2.2. templdir</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- An alternative directory where the templates are loaded
- from.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Path name
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- unset
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- The templates are assumed to be located in
- confdir/template.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- <span class="APPLICATION">Privoxy's</span> original
- templates are usually overwritten with each update. Use
- this option to relocate customized templates that should be
- kept. As template variables might change between updates,
- you shouldn't expect templates to work with <span class=
- "APPLICATION">Privoxy</span> releases other than the one
- they were part of, though.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TEMPORARY-DIRECTORY">7.2.3. temporary-directory</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- A directory where Privoxy can create temporary files.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Path name
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- unset
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No temporary files are created, external filters don't
- work.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- To execute <tt class="LITERAL"><a href=
- "actions-file.html#EXTERNAL-FILTER" target="_top">external
- filters</a></tt>, <span class="APPLICATION">Privoxy</span>
- has to create temporary files. This directive specifies the
- directory the temporary files should be written to.
- </p>
- <p>
- It should be a directory only <span class=
- "APPLICATION">Privoxy</span> (and trusted users) can
- access.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="LOGDIR">7.2.4. logdir</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The directory where all logging takes place (i.e. where the
- <tt class="FILENAME">logfile</tt> is located).
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Path name
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- /var/log/privoxy (Unix) <span class="emphasis"><i class=
- "EMPHASIS">or</i></span> <span class=
- "APPLICATION">Privoxy</span> installation dir (Windows)
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class=
- "EMPHASIS">Mandatory</i></span>
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- No trailing <span class="QUOTE">"<tt class=
- "LITERAL">/</tt>"</span>, please.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ACTIONSFILE">7.2.5. actionsfile</a>
- </h4>
- <a name="DEFAULT.ACTION"></a><a name="STANDARD.ACTION"></a><a name=
- "USER.ACTION"></a>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The <a href="actions-file.html">actions file(s)</a> to use
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Complete file name, relative to <tt class=
- "LITERAL">confdir</tt>
- </p>
- </dd>
- <dt>
- Default values:
- </dt>
- <dd>
- <table border="0">
- <tbody>
- <tr>
- <td>
- <p class="LITERALLAYOUT">
- match-all.action # Actions that are applied to all sites and maybe overruled later on.
- </p>
- </td>
- </tr>
- <tr>
- <td>
- <p class="LITERALLAYOUT">
- default.action # Main actions file
- </p>
- </td>
- </tr>
- <tr>
- <td>
- <p class="LITERALLAYOUT">
- user.action # User customizations
- </p>
- </td>
- </tr>
- </tbody>
- </table>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No actions are taken at all. More or less neutral proxying.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Multiple <tt class="LITERAL">actionsfile</tt> lines are
- permitted, and are in fact recommended!
- </p>
- <p>
- The default values are <tt class=
- "FILENAME">default.action</tt>, which is the <span class=
- "QUOTE">"main"</span> actions file maintained by the
- developers, and <tt class="FILENAME">user.action</tt>,
- where you can make your personal additions.
- </p>
- <p>
- Actions files contain all the per site and per URL
- configuration for ad blocking, cookie management, privacy
- considerations, etc.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="FILTERFILE">7.2.6. filterfile</a>
- </h4>
- <a name="DEFAULT.FILTER"></a>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The <a href="filter-file.html">filter file(s)</a> to use
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- File name, relative to <tt class="LITERAL">confdir</tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- default.filter (Unix) <span class="emphasis"><i class=
- "EMPHASIS">or</i></span> default.filter.txt (Windows)
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No textual content filtering takes place, i.e. all <tt
- class="LITERAL">+<a href=
- "actions-file.html#FILTER">filter</a>{<tt class=
- "REPLACEABLE"><i>name</i></tt>}</tt> actions in the actions
- files are turned neutral.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Multiple <tt class="LITERAL">filterfile</tt> lines are
- permitted.
- </p>
- <p>
- The <a href="filter-file.html">filter files</a> contain
- content modification rules that use <a href=
- "appendix.html#REGEX">regular expressions</a>. These rules
- permit powerful changes on the content of Web pages, and
- optionally the headers as well, e.g., you could try to
- disable your favorite JavaScript annoyances, re-write the
- actual displayed text, or just have some fun playing
- buzzword bingo with web pages.
- </p>
- <p>
- The <tt class="LITERAL">+<a href=
- "actions-file.html#FILTER">filter</a>{<tt class=
- "REPLACEABLE"><i>name</i></tt>}</tt> actions rely on the
- relevant filter (<tt class="REPLACEABLE"><i>name</i></tt>)
- to be defined in a filter file!
- </p>
- <p>
- A pre-defined filter file called <tt class=
- "FILENAME">default.filter</tt> that contains a number of
- useful filters for common problems is included in the
- distribution. See the section on the <tt class="LITERAL"><a
- href="actions-file.html#FILTER">filter</a></tt> action for
- a list.
- </p>
- <p>
- It is recommended to place any locally adapted filters into
- a separate file, such as <tt class=
- "FILENAME">user.filter</tt>.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="LOGFILE">7.2.7. logfile</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The log file to use
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- File name, relative to <tt class="LITERAL">logdir</tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset (commented
- out)</i></span>. When activated: logfile (Unix) <span
- class="emphasis"><i class="EMPHASIS">or</i></span>
- privoxy.log (Windows).
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- No logfile is written.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- The logfile is where all logging and error messages are
- written. The level of detail and number of messages are set
- with the <tt class="LITERAL">debug</tt> option (see below).
- The logfile can be useful for tracking down a problem with
- <span class="APPLICATION">Privoxy</span> (e.g., it's not
- blocking an ad you think it should block) and it can help
- you to monitor what your browser is doing.
- </p>
- <p>
- Depending on the debug options below, the logfile may be a
- privacy risk if third parties can get access to it. As most
- users will never look at it, <span class=
- "APPLICATION">Privoxy</span> only logs fatal errors by
- default.
- </p>
- <p>
- For most troubleshooting purposes, you will have to change
- that, please refer to the debugging section for details.
- </p>
- <p>
- Any log files must be writable by whatever user <span
- class="APPLICATION">Privoxy</span> is being run as (on
- Unix, default user id is <span class=
- "QUOTE">"privoxy"</span>).
- </p>
- <p>
- To prevent the logfile from growing indefinitely, it is
- recommended to periodically rotate or shorten it. Many
- operating systems support log rotation out of the box, some
- require additional software to do it. For details, please
- refer to the documentation for your operating system.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TRUSTFILE">7.2.8. trustfile</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The name of the trust file to use
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- File name, relative to <tt class="LITERAL">confdir</tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset (commented
- out)</i></span>. When activated: trust (Unix) <span class=
- "emphasis"><i class="EMPHASIS">or</i></span> trust.txt
- (Windows)
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- The entire trust mechanism is disabled.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- The trust mechanism is an experimental feature for building
- white-lists and should be used with care. It is <span
- class="emphasis"><i class="EMPHASIS">NOT</i></span>
- recommended for the casual user.
- </p>
- <p>
- If you specify a trust file, <span class=
- "APPLICATION">Privoxy</span> will only allow access to
- sites that are specified in the trustfile. Sites can be
- listed in one of two ways:
- </p>
- <p>
- Prepending a <tt class="LITERAL">~</tt> character limits
- access to this site only (and any sub-paths within this
- site), e.g. <tt class="LITERAL">~www.example.com</tt>
- allows access to <tt class=
- "LITERAL">~www.example.com/features/news.html</tt>, etc.
- </p>
- <p>
- Or, you can designate sites as <span class="emphasis"><i
- class="EMPHASIS">trusted referrers</i></span>, by
- prepending the name with a <tt class="LITERAL">+</tt>
- character. The effect is that access to untrusted sites
- will be granted -- but only if a link from this trusted
- referrer was used to get there. The link target will then
- be added to the <span class="QUOTE">"trustfile"</span> so
- that future, direct accesses will be granted. Sites added
- via this mechanism do not become trusted referrers
- themselves (i.e. they are added with a <tt class=
- "LITERAL">~</tt> designation). There is a limit of 512 such
- entries, after which new entries will not be made.
- </p>
- <p>
- If you use the <tt class="LITERAL">+</tt> operator in the
- trust file, it may grow considerably over time.
- </p>
- <p>
- It is recommended that <span class=
- "APPLICATION">Privoxy</span> be compiled with the <tt
- class="LITERAL">--disable-force</tt>, <tt class=
- "LITERAL">--disable-toggle</tt> and <tt class=
- "LITERAL">--disable-editor</tt> options, if this feature is
- to be used.
- </p>
- <p>
- Possible applications include limiting Internet access for
- children.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="DEBUGGING">7.3. Debugging</a>
- </h2>
- <p>
- These options are mainly useful when tracing a problem. Note that
- you might also want to invoke <span class=
- "APPLICATION">Privoxy</span> with the <tt class=
- "LITERAL">--no-daemon</tt> command line option when debugging.
- </p>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="DEBUG">7.3.1. debug</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Key values that determine what information gets logged.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Integer values
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0 (i.e.: only fatal errors (that cause Privoxy to exit) are
- logged)
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Default value is used (see above).
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- The available debug levels are:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- debug 1 # Log the destination for each request <span class=
-"APPLICATION">Privoxy</span> let through. See also debug 1024.
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
+<HTML
+><HEAD
+><TITLE
+>The Main Configuration File</TITLE
+><META
+NAME="GENERATOR"
+CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
+REL="HOME"
+TITLE="Privoxy 3.0.27 User Manual"
+HREF="index.html"><LINK
+REL="PREVIOUS"
+TITLE="Privoxy Configuration"
+HREF="configuration.html"><LINK
+REL="NEXT"
+TITLE="Actions Files"
+HREF="actions-file.html"><LINK
+REL="STYLESHEET"
+TYPE="text/css"
+HREF="../p_doc.css"><META
+HTTP-EQUIV="Content-Type"
+CONTENT="text/html;
+charset=ISO-8859-1">
+<LINK REL="STYLESHEET" TYPE="text/css" HREF="p_doc.css">
+</head
+><BODY
+CLASS="SECT1"
+BGCOLOR="#EEEEEE"
+TEXT="#000000"
+LINK="#0000FF"
+VLINK="#840084"
+ALINK="#0000FF"
+><DIV
+CLASS="NAVHEADER"
+><TABLE
+SUMMARY="Header navigation table"
+WIDTH="100%"
+BORDER="0"
+CELLPADDING="0"
+CELLSPACING="0"
+><TR
+><TH
+COLSPAN="3"
+ALIGN="center"
+>Privoxy 3.0.27 User Manual</TH
+></TR
+><TR
+><TD
+WIDTH="10%"
+ALIGN="left"
+VALIGN="bottom"
+><A
+HREF="configuration.html"
+ACCESSKEY="P"
+>Prev</A
+></TD
+><TD
+WIDTH="80%"
+ALIGN="center"
+VALIGN="bottom"
+></TD
+><TD
+WIDTH="10%"
+ALIGN="right"
+VALIGN="bottom"
+><A
+HREF="actions-file.html"
+ACCESSKEY="N"
+>Next</A
+></TD
+></TR
+></TABLE
+><HR
+ALIGN="LEFT"
+WIDTH="100%"></DIV
+><DIV
+CLASS="SECT1"
+><H1
+CLASS="SECT1"
+><A
+NAME="CONFIG"
+>7. The Main Configuration File</A
+></H1
+><P
+> By default, the main configuration file is named <TT
+CLASS="FILENAME"
+>config</TT
+>,
+ with the exception of Windows, where it is named <TT
+CLASS="FILENAME"
+>config.txt</TT
+>.
+ Configuration lines consist of an initial keyword followed by a list of
+ values, all separated by whitespace (any number of spaces or tabs). For
+ example:</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>confdir /etc/privoxy</I
+></SPAN
+></P
+><P
+> Assigns the value <TT
+CLASS="LITERAL"
+>/etc/privoxy</TT
+> to the option
+ <TT
+CLASS="LITERAL"
+>confdir</TT
+> and thus indicates that the configuration
+ directory is named <SPAN
+CLASS="QUOTE"
+>"/etc/privoxy/"</SPAN
+>.</P
+><P
+> All options in the config file except for <TT
+CLASS="LITERAL"
+>confdir</TT
+> and
+ <TT
+CLASS="LITERAL"
+>logdir</TT
+> are optional. Watch out in the below description
+ for what happens if you leave them unset.</P
+><P
+> The main config file controls all aspects of <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>'s
+ operation that are not location dependent (i.e. they apply universally, no matter
+ where you may be surfing). Like the filter and action files, the config file is
+ a plain text file and can be modified with a text editor like emacs, vim or
+ notepad.exe.</P
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="LOCAL-SET-UP"
+>7.1. Local Set-up Documentation</A
+></H2
+><P
+> If you intend to operate <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> for more users
+ than just yourself, it might be a good idea to let them know how to reach
+ you, what you block and why you do that, your policies, etc.
+ </P
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="USER-MANUAL"
+>7.1.1. user-manual</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Location of the <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> User Manual.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>A fully qualified URI</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> <A
+HREF="https://www.privoxy.org/user-manual/"
+TARGET="_top"
+>https://www.privoxy.org/<TT
+CLASS="REPLACEABLE"
+><I
+>version</I
+></TT
+>/user-manual/</A
+>
+ will be used, where <TT
+CLASS="REPLACEABLE"
+><I
+>version</I
+></TT
+> is the <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> version.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> The User Manual URI is the single best source of information on
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>, and is used for help links from some
+ of the internal CGI pages. The manual itself is normally packaged with the
+ binary distributions, so you probably want to set this to a locally
+ installed copy.
+ </P
+><P
+> Examples:
+ </P
+><P
+> The best all purpose solution is simply to put the full local
+ <TT
+CLASS="LITERAL"
+>PATH</TT
+> to where the <I
+CLASS="CITETITLE"
+>User Manual</I
+> is
+ located:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> user-manual /usr/share/doc/privoxy/user-manual</PRE
+></TD
+></TR
+></TABLE
+><P
+> The User Manual is then available to anyone with access to
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>, by following the built-in URL:
+ <TT
+CLASS="LITERAL"
+>http://config.privoxy.org/user-manual/</TT
+>
+ (or the shortcut: <TT
+CLASS="LITERAL"
+>http://p.p/user-manual/</TT
+>).
+ </P
+><P
+> If the documentation is not on the local system, it can be accessed
+ from a remote server, as:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> user-manual http://example.com/privoxy/user-manual/</PRE
+></TD
+></TR
+></TABLE
+><DIV
+CLASS="WARNING"
+><P
+></P
+><TABLE
+CLASS="WARNING"
+BORDER="1"
+WIDTH="90%"
+><TR
+><TD
+ALIGN="CENTER"
+><B
+>Warning</B
+></TD
+></TR
+><TR
+><TD
+ALIGN="LEFT"
+><P
+> If set, this option should be <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>the first option in the config
+ file</I
+></SPAN
+>, because it is used while the config file is being read
+ on start-up.
+ </P
+></TD
+></TR
+></TABLE
+></DIV
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TRUST-INFO-URL"
+>7.1.2. trust-info-url</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> A URL to be displayed in the error page that users will see if access to an untrusted page is denied.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>URL</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No links are displayed on the "untrusted" error page.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> The value of this option only matters if the experimental trust mechanism has been
+ activated. (See <A
+HREF="config.html#TRUSTFILE"
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>trustfile</I
+></SPAN
+></A
+> below.)
+ </P
+><P
+> If you use the trust mechanism, it is a good idea to write up some on-line
+ documentation about your trust policy and to specify the URL(s) here.
+ Use multiple times for multiple URLs.
+ </P
+><P
+> The URL(s) should be added to the trustfile as well, so users don't end up
+ locked out from the information on why they were locked out in the first place!
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ADMIN-ADDRESS"
+>7.1.3. admin-address</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> An email address to reach the <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> administrator.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Email address</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No email address is displayed on error pages and the CGI user interface.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> If both <TT
+CLASS="LITERAL"
+>admin-address</TT
+> and <TT
+CLASS="LITERAL"
+>proxy-info-url</TT
+>
+ are unset, the whole "Local Privoxy Support" box on all generated pages will
+ not be shown.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="PROXY-INFO-URL"
+>7.1.4. proxy-info-url</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> A URL to documentation about the local <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> setup,
+ configuration or policies.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>URL</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No link to local documentation is displayed on error pages and the CGI user interface.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> If both <TT
+CLASS="LITERAL"
+>admin-address</TT
+> and <TT
+CLASS="LITERAL"
+>proxy-info-url</TT
+>
+ are unset, the whole "Local Privoxy Support" box on all generated pages will
+ not be shown.
+ </P
+><P
+> This URL shouldn't be blocked ;-)
+ </P
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="CONF-LOG-LOC"
+>7.2. Configuration and Log File Locations</A
+></H2
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can (and normally does) use a number of
+ other files for additional configuration, help and logging.
+ This section of the configuration file tells <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ where to find those other files.</P
+><P
+> The user running <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>, must have read
+ permission for all configuration files, and write permission to any files
+ that would be modified, such as log files and actions files.</P
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="CONFDIR"
+>7.2.1. confdir</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+>The directory where the other configuration files are located.</P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Path name</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>/etc/privoxy (Unix) <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>or</I
+></SPAN
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> installation dir (Windows) </P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Mandatory</I
+></SPAN
+></P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> No trailing <SPAN
+CLASS="QUOTE"
+>"<TT
+CLASS="LITERAL"
+>/</TT
+>"</SPAN
+>, please.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TEMPLDIR"
+>7.2.2. templdir</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+>An alternative directory where the templates are loaded from.</P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Path name</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>unset</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+>The templates are assumed to be located in confdir/template.</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> original templates are usually
+ overwritten with each update. Use this option to relocate customized
+ templates that should be kept. As template variables might change
+ between updates, you shouldn't expect templates to work with
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> releases other than the one
+ they were part of, though.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TEMPORARY-DIRECTORY"
+>7.2.3. temporary-directory</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+>A directory where Privoxy can create temporary files.</P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Path name</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>unset</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+>No temporary files are created, external filters don't work.</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> To execute <TT
+CLASS="LITERAL"
+><A
+HREF="actions-file.html#EXTERNAL-FILTER"
+TARGET="_top"
+>external filters</A
+></TT
+>,
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> has to create temporary files.
+ This directive specifies the directory the temporary files should
+ be written to.
+ </P
+><P
+> It should be a directory only <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ (and trusted users) can access.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="LOGDIR"
+>7.2.4. logdir</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The directory where all logging takes place
+ (i.e. where the <TT
+CLASS="FILENAME"
+>logfile</TT
+> is located).
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Path name</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>/var/log/privoxy (Unix) <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>or</I
+></SPAN
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> installation dir (Windows) </P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Mandatory</I
+></SPAN
+></P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> No trailing <SPAN
+CLASS="QUOTE"
+>"<TT
+CLASS="LITERAL"
+>/</TT
+>"</SPAN
+>, please.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ACTIONSFILE"
+>7.2.5. actionsfile</A
+></H4
+><A
+NAME="DEFAULT.ACTION"
+></A
+><A
+NAME="STANDARD.ACTION"
+></A
+><A
+NAME="USER.ACTION"
+></A
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The <A
+HREF="actions-file.html"
+>actions file(s)</A
+> to use
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Complete file name, relative to <TT
+CLASS="LITERAL"
+>confdir</TT
+></P
+></DD
+><DT
+>Default values:</DT
+><DD
+><P
+></P
+><TABLE
+BORDER="0"
+><TBODY
+><TR
+><TD
+> <P
+CLASS="LITERALLAYOUT"
+> match-all.action # Actions that are applied to all sites and maybe overruled later on.</P
+>
+ </TD
+></TR
+><TR
+><TD
+> <P
+CLASS="LITERALLAYOUT"
+> default.action # Main actions file</P
+>
+ </TD
+></TR
+><TR
+><TD
+> <P
+CLASS="LITERALLAYOUT"
+> user.action # User customizations</P
+>
+ </TD
+></TR
+></TBODY
+></TABLE
+><P
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No actions are taken at all. More or less neutral proxying.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Multiple <TT
+CLASS="LITERAL"
+>actionsfile</TT
+> lines are permitted, and are in fact recommended!
+ </P
+><P
+> The default values are <TT
+CLASS="FILENAME"
+>default.action</TT
+>, which is the
+ <SPAN
+CLASS="QUOTE"
+>"main"</SPAN
+> actions file maintained by the developers, and
+ <TT
+CLASS="FILENAME"
+>user.action</TT
+>, where you can make your personal additions.
+ </P
+><P
+> Actions files contain all the per site and per URL configuration for
+ ad blocking, cookie management, privacy considerations, etc.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="FILTERFILE"
+>7.2.6. filterfile</A
+></H4
+><A
+NAME="DEFAULT.FILTER"
+></A
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The <A
+HREF="filter-file.html"
+>filter file(s)</A
+> to use
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>File name, relative to <TT
+CLASS="LITERAL"
+>confdir</TT
+></P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>default.filter (Unix) <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>or</I
+></SPAN
+> default.filter.txt (Windows)</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No textual content filtering takes place, i.e. all
+ <TT
+CLASS="LITERAL"
+>+<A
+HREF="actions-file.html#FILTER"
+>filter</A
+>{<TT
+CLASS="REPLACEABLE"
+><I
+>name</I
+></TT
+>}</TT
+>
+ actions in the actions files are turned neutral.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Multiple <TT
+CLASS="LITERAL"
+>filterfile</TT
+> lines are permitted.
+ </P
+><P
+> The <A
+HREF="filter-file.html"
+>filter files</A
+> contain content modification
+ rules that use <A
+HREF="appendix.html#REGEX"
+>regular expressions</A
+>. These rules permit
+ powerful changes on the content of Web pages, and optionally the headers
+ as well, e.g., you could try to disable your favorite JavaScript annoyances,
+ re-write the actual displayed text, or just have some fun
+ playing buzzword bingo with web pages.
+ </P
+><P
+> The
+ <TT
+CLASS="LITERAL"
+>+<A
+HREF="actions-file.html#FILTER"
+>filter</A
+>{<TT
+CLASS="REPLACEABLE"
+><I
+>name</I
+></TT
+>}</TT
+>
+ actions rely on the relevant filter (<TT
+CLASS="REPLACEABLE"
+><I
+>name</I
+></TT
+>)
+ to be defined in a filter file!
+ </P
+><P
+> A pre-defined filter file called <TT
+CLASS="FILENAME"
+>default.filter</TT
+> that contains
+ a number of useful filters for common problems is included in the distribution.
+ See the section on the <TT
+CLASS="LITERAL"
+><A
+HREF="actions-file.html#FILTER"
+>filter</A
+></TT
+>
+ action for a list.
+ </P
+><P
+> It is recommended to place any locally adapted filters into a separate
+ file, such as <TT
+CLASS="FILENAME"
+>user.filter</TT
+>.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="LOGFILE"
+>7.2.7. logfile</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The log file to use
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>File name, relative to <TT
+CLASS="LITERAL"
+>logdir</TT
+></P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset (commented out)</I
+></SPAN
+>. When activated: logfile (Unix) <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>or</I
+></SPAN
+> privoxy.log (Windows).</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No logfile is written.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> The logfile is where all logging and error messages are written. The level
+ of detail and number of messages are set with the <TT
+CLASS="LITERAL"
+>debug</TT
+>
+ option (see below). The logfile can be useful for tracking down a problem with
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> (e.g., it's not blocking an ad you
+ think it should block) and it can help you to monitor what your browser
+ is doing.
+ </P
+><P
+> Depending on the debug options below, the logfile may be a privacy risk
+ if third parties can get access to it. As most users will never look
+ at it, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> only logs fatal errors by default.
+ </P
+><P
+> For most troubleshooting purposes, you will have to change that,
+ please refer to the debugging section for details.
+ </P
+><P
+> Any log files must be writable by whatever user <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ is being run as (on Unix, default user id is <SPAN
+CLASS="QUOTE"
+>"privoxy"</SPAN
+>).
+ </P
+><P
+> To prevent the logfile from growing indefinitely, it is recommended to
+ periodically rotate or shorten it. Many operating systems support log
+ rotation out of the box, some require additional software to do it.
+ For details, please refer to the documentation for your operating system.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TRUSTFILE"
+>7.2.8. trustfile</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The name of the trust file to use
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>File name, relative to <TT
+CLASS="LITERAL"
+>confdir</TT
+></P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset (commented out)</I
+></SPAN
+>. When activated: trust (Unix) <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>or</I
+></SPAN
+> trust.txt (Windows)</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> The entire trust mechanism is disabled.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> The trust mechanism is an experimental feature for building white-lists and should
+ be used with care. It is <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>NOT</I
+></SPAN
+> recommended for the casual user.
+ </P
+><P
+> If you specify a trust file, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will only allow
+ access to sites that are specified in the trustfile. Sites can be listed
+ in one of two ways:
+ </P
+><P
+> Prepending a <TT
+CLASS="LITERAL"
+>~</TT
+> character limits access to this site
+ only (and any sub-paths within this site), e.g.
+ <TT
+CLASS="LITERAL"
+>~www.example.com</TT
+> allows access to
+ <TT
+CLASS="LITERAL"
+>~www.example.com/features/news.html</TT
+>, etc.
+ </P
+><P
+> Or, you can designate sites as <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>trusted referrers</I
+></SPAN
+>, by
+ prepending the name with a <TT
+CLASS="LITERAL"
+>+</TT
+> character. The effect is that
+ access to untrusted sites will be granted -- but only if a link from this
+ trusted referrer was used to get there. The link target will then be added
+ to the <SPAN
+CLASS="QUOTE"
+>"trustfile"</SPAN
+> so that future, direct accesses will be
+ granted. Sites added via this mechanism do not become trusted referrers
+ themselves (i.e. they are added with a <TT
+CLASS="LITERAL"
+>~</TT
+> designation).
+ There is a limit of 512 such entries, after which new entries will not be
+ made.
+ </P
+><P
+> If you use the <TT
+CLASS="LITERAL"
+>+</TT
+> operator in the trust file, it may grow
+ considerably over time.
+ </P
+><P
+> It is recommended that <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> be compiled with
+ the <TT
+CLASS="LITERAL"
+>--disable-force</TT
+>, <TT
+CLASS="LITERAL"
+>--disable-toggle</TT
+> and
+ <TT
+CLASS="LITERAL"
+> --disable-editor</TT
+> options, if this feature is to be
+ used.
+ </P
+><P
+> Possible applications include limiting Internet access for children.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="DEBUGGING"
+>7.3. Debugging</A
+></H2
+><P
+> These options are mainly useful when tracing a problem.
+ Note that you might also want to invoke
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> with the <TT
+CLASS="LITERAL"
+>--no-daemon</TT
+>
+ command line option when debugging.
+ </P
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="DEBUG"
+>7.3.1. debug</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Key values that determine what information gets logged.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Integer values</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0 (i.e.: only fatal errors (that cause Privoxy to exit) are logged)</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Default value is used (see above).
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> The available debug levels are:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> debug 1 # Log the destination for each request <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> let through. See also debug 1024.
debug 2 # show each connection status
debug 4 # show I/O status
debug 8 # show header parsing
debug 128 # debug redirects
debug 256 # debug GIF de-animation
debug 512 # Common Log Format
- debug 1024 # Log the destination for requests <span class=
-"APPLICATION">Privoxy</span> didn't let through, and the reason why.
+ debug 1024 # Log the destination for requests <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> didn't let through, and the reason why.
debug 2048 # CGI user interface
debug 4096 # Startup banner and warnings.
debug 8192 # Non-fatal errors
debug 32768 # log all data read from the network
- debug 65536 # Log the applying actions
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- To select multiple debug levels, you can either add them or
- use multiple <tt class="LITERAL">debug</tt> lines.
- </p>
- <p>
- A debug level of 1 is informative because it will show you
- each request as it happens. <span class="emphasis"><i
- class="EMPHASIS">1, 1024, 4096 and 8192 are
- recommended</i></span> so that you will notice when things
- go wrong. The other levels are probably only of interest if
- you are hunting down a specific problem. They can produce a
- hell of an output (especially 16).
- </p>
- <p>
- If you are used to the more verbose settings, simply enable
- the debug lines below again.
- </p>
- <p>
- If you want to use pure CLF (Common Log Format), you should
- set <span class="QUOTE">"debug 512"</span> <span class=
- "emphasis"><i class="EMPHASIS">ONLY</i></span> and not
- enable anything else.
- </p>
- <p>
- <span class="APPLICATION">Privoxy</span> has a hard-coded
- limit for the length of log messages. If it's reached,
- messages are logged truncated and marked with <span class=
- "QUOTE">"... [too long, truncated]"</span>.
- </p>
- <p>
- Please don't file any support requests without trying to
- reproduce the problem with increased debug level first.
- Once you read the log messages, you may even be able to
- solve the problem on your own.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="SINGLE-THREADED">7.3.2. single-threaded</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether to run only one server thread.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">1 or
- 0</i></span>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">0</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Multi-threaded (or, where unavailable: forked) operation,
- i.e. the ability to serve multiple requests simultaneously.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- This option is only there for debugging purposes. <span
- class="emphasis"><i class="EMPHASIS">It will drastically
- reduce performance.</i></span>
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="HOSTNAME">7.3.3. hostname</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The hostname shown on the CGI pages.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Text
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- The hostname provided by the operating system is used.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- On some misconfigured systems resolving the hostname fails
- or takes too much time and slows Privoxy down. Setting a
- fixed hostname works around the problem.
- </p>
- <p>
- In other circumstances it might be desirable to show a
- hostname other than the one returned by the operating
- system. For example if the system has several different
- hostnames and you don't want to use the first one.
- </p>
- <p>
- Note that Privoxy does not validate the specified hostname
- value.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="ACCESS-CONTROL">7.4. Access Control and Security</a>
- </h2>
- <p>
- This section of the config file controls the security-relevant
- aspects of <span class="APPLICATION">Privoxy</span>'s
- configuration.
- </p>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="LISTEN-ADDRESS">7.4.1. listen-address</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The address and TCP port on which <span class=
- "APPLICATION">Privoxy</span> will listen for client
- requests.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- [<tt class="REPLACEABLE"><i>IP-Address</i></tt>]:<tt class=
- "REPLACEABLE"><i>Port</i></tt>
- </p>
- <p>
- [<tt class="REPLACEABLE"><i>Hostname</i></tt>]:<tt class=
- "REPLACEABLE"><i>Port</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 127.0.0.1:8118
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Bind to 127.0.0.1 (IPv4 localhost), port 8118. This is
- suitable and recommended for home users who run <span
- class="APPLICATION">Privoxy</span> on the same machine as
- their browser.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- You will need to configure your browser(s) to this proxy
- address and port.
- </p>
- <p>
- If you already have another service running on port 8118,
- or if you want to serve requests from other machines (e.g.
- on your local network) as well, you will need to override
- the default.
- </p>
- <p>
- You can use this statement multiple times to make <span
- class="APPLICATION">Privoxy</span> listen on more ports or
- more <abbr class="ABBREV">IP</abbr> addresses. Suitable if
- your operating system does not support sharing <abbr class=
- "ABBREV">IPv6</abbr> and <abbr class="ABBREV">IPv4</abbr>
- protocols on the same socket.
- </p>
- <p>
- If a hostname is used instead of an IP address, <span
- class="APPLICATION">Privoxy</span> will try to resolve it
- to an IP address and if there are multiple, use the first
- one returned.
- </p>
- <p>
- If the address for the hostname isn't already known on the
- system (for example because it's in /etc/hostname), this
- may result in DNS traffic.
- </p>
- <p>
- If the specified address isn't available on the system, or
- if the hostname can't be resolved, <span class=
- "APPLICATION">Privoxy</span> will fail to start.
- </p>
- <p>
- IPv6 addresses containing colons have to be quoted by
- brackets. They can only be used if <span class=
- "APPLICATION">Privoxy</span> has been compiled with IPv6
- support. If you aren't sure if your version supports it,
- have a look at <tt class=
- "LITERAL">http://config.privoxy.org/show-status</tt>.
- </p>
- <p>
- Some operating systems will prefer IPv6 to IPv4 addresses
- even if the system has no IPv6 connectivity which is
- usually not expected by the user. Some even rely on DNS to
- resolve localhost which mean the "localhost" address used
- may not actually be local.
- </p>
- <p>
- It is therefore recommended to explicitly configure the
- intended IP address instead of relying on the operating
- system, unless there's a strong reason not to.
- </p>
- <p>
- If you leave out the address, <span class=
- "APPLICATION">Privoxy</span> will bind to all IPv4
- interfaces (addresses) on your machine and may become
- reachable from the Internet and/or the local network. Be
- aware that some GNU/Linux distributions modify that
- behaviour without updating the documentation. Check for
- non-standard patches if your <span class=
- "APPLICATION">Privoxy</span> version behaves differently.
- </p>
- <p>
- If you configure <span class="APPLICATION">Privoxy</span>
- to be reachable from the network, consider using <a href=
- "config.html#ACLS">access control lists</a> (ACL's, see
- below), and/or a firewall.
- </p>
- <p>
- If you open <span class="APPLICATION">Privoxy</span> to
- untrusted users, you will also want to make sure that the
- following actions are disabled: <tt class="LITERAL"><a
- href=
- "config.html#ENABLE-EDIT-ACTIONS">enable-edit-actions</a></tt>
- and <tt class="LITERAL"><a href=
- "config.html#ENABLE-REMOTE-TOGGLE">enable-remote-toggle</a></tt>
- </p>
- </dd>
- <dt>
- Example:
- </dt>
- <dd>
- <p>
- Suppose you are running <span class=
- "APPLICATION">Privoxy</span> on a machine which has the
- address 192.168.0.1 on your local private network
- (192.168.0.0) and has another outside connection with a
- different address. You want it to serve requests from
- inside only:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- listen-address 192.168.0.1:8118
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Suppose you are running <span class=
- "APPLICATION">Privoxy</span> on an IPv6-capable machine and
- you want it to listen on the IPv6 address of the loopback
- device:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- listen-address [::1]:8118
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TOGGLE">7.4.2. toggle</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Initial state of "toggle" status
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- 1 or 0
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 1
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Act as if toggled on
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- If set to 0, <span class="APPLICATION">Privoxy</span> will
- start in <span class="QUOTE">"toggled off"</span> mode,
- i.e. mostly behave like a normal, content-neutral proxy
- with both ad blocking and content filtering disabled. See
- <tt class="LITERAL">enable-remote-toggle</tt> below.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ENABLE-REMOTE-TOGGLE">7.4.3. enable-remote-toggle</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not the <a href=
- "http://config.privoxy.org/toggle" target="_top">web-based
- toggle feature</a> may be used
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- 0 or 1
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- The web-based toggle feature is disabled.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- When toggled off, <span class="APPLICATION">Privoxy</span>
- mostly acts like a normal, content-neutral proxy, i.e.
- doesn't block ads or filter content.
- </p>
- <p>
- Access to the toggle feature can <span class="emphasis"><i
- class="EMPHASIS">not</i></span> be controlled separately by
- <span class="QUOTE">"ACLs"</span> or HTTP authentication,
- so that everybody who can access <span class=
- "APPLICATION">Privoxy</span> (see <span class=
- "QUOTE">"ACLs"</span> and <tt class=
- "LITERAL">listen-address</tt> above) can toggle it for all
- users. So this option is <span class="emphasis"><i class=
- "EMPHASIS">not recommended</i></span> for multi-user
- environments with untrusted users.
- </p>
- <p>
- Note that malicious client side code (e.g Java) is also
- capable of using this option.
- </p>
- <p>
- As a lot of <span class="APPLICATION">Privoxy</span> users
- don't read documentation, this feature is disabled by
- default.
- </p>
- <p>
- Note that you must have compiled <span class=
- "APPLICATION">Privoxy</span> with support for this feature,
- otherwise this option has no effect.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ENABLE-REMOTE-HTTP-TOGGLE">7.4.4.
- enable-remote-http-toggle</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not Privoxy recognizes special HTTP headers to
- change its behaviour.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- 0 or 1
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Privoxy ignores special HTTP headers.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- When toggled on, the client can change <span class=
- "APPLICATION">Privoxy's</span> behaviour by setting special
- HTTP headers. Currently the only supported special header
- is <span class="QUOTE">"X-Filter: No"</span>, to disable
- filtering for the ongoing request, even if it is enabled in
- one of the action files.
- </p>
- <p>
- This feature is disabled by default. If you are using <span
- class="APPLICATION">Privoxy</span> in a environment with
- trusted clients, you may enable this feature at your
- discretion. Note that malicious client side code (e.g Java)
- is also capable of using this feature.
- </p>
- <p>
- This option will be removed in future releases as it has
- been obsoleted by the more general header taggers.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ENABLE-EDIT-ACTIONS">7.4.5. enable-edit-actions</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not the <a href=
- "http://config.privoxy.org/show-status" target=
- "_top">web-based actions file editor</a> may be used
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- 0 or 1
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- The web-based actions file editor is disabled.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Access to the editor can <span class="emphasis"><i class=
- "EMPHASIS">not</i></span> be controlled separately by <span
- class="QUOTE">"ACLs"</span> or HTTP authentication, so that
- everybody who can access <span class=
- "APPLICATION">Privoxy</span> (see <span class=
- "QUOTE">"ACLs"</span> and <tt class=
- "LITERAL">listen-address</tt> above) can modify its
- configuration for all users.
- </p>
- <p>
- This option is <span class="emphasis"><i class=
- "EMPHASIS">not recommended</i></span> for environments with
- untrusted users and as a lot of <span class=
- "APPLICATION">Privoxy</span> users don't read
- documentation, this feature is disabled by default.
- </p>
- <p>
- Note that malicious client side code (e.g Java) is also
- capable of using the actions editor and you shouldn't
- enable this options unless you understand the consequences
- and are sure your browser is configured correctly.
- </p>
- <p>
- Note that you must have compiled <span class=
- "APPLICATION">Privoxy</span> with support for this feature,
- otherwise this option has no effect.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ENFORCE-BLOCKS">7.4.6. enforce-blocks</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether the user is allowed to ignore blocks and can <span
- class="QUOTE">"go there anyway"</span>.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">0</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Blocks are not enforced.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- <span class="APPLICATION">Privoxy</span> is mainly used to
- block and filter requests as a service to the user, for
- example to block ads and other junk that clogs the pipes.
- <span class="APPLICATION">Privoxy's</span> configuration
- isn't perfect and sometimes innocent pages are blocked. In
- this situation it makes sense to allow the user to enforce
- the request and have <span class=
- "APPLICATION">Privoxy</span> ignore the block.
- </p>
- <p>
- In the default configuration <span class=
- "APPLICATION">Privoxy's</span> <span class=
- "QUOTE">"Blocked"</span> page contains a <span class=
- "QUOTE">"go there anyway"</span> link to adds a special
- string (the force prefix) to the request URL. If that link
- is used, <span class="APPLICATION">Privoxy</span> will
- detect the force prefix, remove it again and let the
- request pass.
- </p>
- <p>
- Of course <span class="APPLICATION">Privoxy</span> can also
- be used to enforce a network policy. In that case the user
- obviously should not be able to bypass any blocks, and
- that's what the <span class="QUOTE">"enforce-blocks"</span>
- option is for. If it's enabled, <span class=
- "APPLICATION">Privoxy</span> hides the <span class=
- "QUOTE">"go there anyway"</span> link. If the user adds the
- force prefix by hand, it will not be accepted and the
- circumvention attempt is logged.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- enforce-blocks 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ACLS">7.4.7. ACLs: permit-access and deny-access</a>
- </h4>
- <a name="PERMIT-ACCESS"></a><a name="DENY-ACCESS"></a>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Who can access what.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>src_addr</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>][/<tt class=
- "REPLACEABLE"><i>src_masklen</i></tt>] [<tt class=
- "REPLACEABLE"><i>dst_addr</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>][/<tt class=
- "REPLACEABLE"><i>dst_masklen</i></tt>]]
- </p>
- <p>
- Where <tt class="REPLACEABLE"><i>src_addr</i></tt> and <tt
- class="REPLACEABLE"><i>dst_addr</i></tt> are IPv4 addresses
- in dotted decimal notation or valid DNS names, <tt class=
- "REPLACEABLE"><i>port</i></tt> is a port number, and <tt
- class="REPLACEABLE"><i>src_masklen</i></tt> and <tt class=
- "REPLACEABLE"><i>dst_masklen</i></tt> are subnet masks in
- CIDR notation, i.e. integer values from 2 to 30
- representing the length (in bits) of the network address.
- The masks and the whole destination part are optional.
- </p>
- <p>
- If your system implements <a href=
- "http://tools.ietf.org/html/rfc3493" target="_top">RFC
- 3493</a>, then <tt class="REPLACEABLE"><i>src_addr</i></tt>
- and <tt class="REPLACEABLE"><i>dst_addr</i></tt> can be
- IPv6 addresses delimeted by brackets, <tt class=
- "REPLACEABLE"><i>port</i></tt> can be a number or a service
- name, and <tt class="REPLACEABLE"><i>src_masklen</i></tt>
- and <tt class="REPLACEABLE"><i>dst_masklen</i></tt> can be
- a number from 0 to 128.
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- <p>
- If no <tt class="REPLACEABLE"><i>port</i></tt> is
- specified, any port will match. If no <tt class=
- "REPLACEABLE"><i>src_masklen</i></tt> or <tt class=
- "REPLACEABLE"><i>src_masklen</i></tt> is given, the
- complete IP address has to match (i.e. 32 bits for IPv4 and
- 128 bits for IPv6).
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Don't restrict access further than implied by <tt class=
- "LITERAL">listen-address</tt>
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Access controls are included at the request of ISPs and
- systems administrators, and <span class="emphasis"><i
- class="EMPHASIS">are not usually needed by individual
- users</i></span>. For a typical home user, it will normally
- suffice to ensure that <span class=
- "APPLICATION">Privoxy</span> only listens on the localhost
- (127.0.0.1) or internal (home) network address by means of
- the <a href="config.html#LISTEN-ADDRESS"><span class=
- "emphasis"><i class=
- "EMPHASIS">listen-address</i></span></a> option.
- </p>
- <p>
- Please see the warnings in the FAQ that <span class=
- "APPLICATION">Privoxy</span> is not intended to be a
- substitute for a firewall or to encourage anyone to defer
- addressing basic security weaknesses.
- </p>
- <p>
- Multiple ACL lines are OK. If any ACLs are specified, <span
- class="APPLICATION">Privoxy</span> only talks to IP
- addresses that match at least one <tt class=
- "LITERAL">permit-access</tt> line and don't match any
- subsequent <tt class="LITERAL">deny-access</tt> line. In
- other words, the last match wins, with the default being
- <tt class="LITERAL">deny-access</tt>.
- </p>
- <p>
- If <span class="APPLICATION">Privoxy</span> is using a
- forwarder (see <tt class="LITERAL">forward</tt> below) for
- a particular destination URL, the <tt class=
- "REPLACEABLE"><i>dst_addr</i></tt> that is examined is the
- address of the forwarder and <span class="emphasis"><i
- class="EMPHASIS">NOT</i></span> the address of the ultimate
- target. This is necessary because it may be impossible for
- the local <span class="APPLICATION">Privoxy</span> to
- determine the IP address of the ultimate target (that's
- often what gateways are used for).
- </p>
- <p>
- You should prefer using IP addresses over DNS names,
- because the address lookups take time. All DNS names must
- resolve! You can <span class="emphasis"><i class=
- "EMPHASIS">not</i></span> use domain patterns like <span
- class="QUOTE">"*.org"</span> or partial domain names. If a
- DNS name resolves to multiple IP addresses, only the first
- one is used.
- </p>
- <p>
- Some systems allow IPv4 clients to connect to IPv6 server
- sockets. Then the client's IPv4 address will be translated
- by the system into IPv6 address space with special prefix
- ::ffff:0:0/96 (so called IPv4 mapped IPv6 address). <span
- class="APPLICATION">Privoxy</span> can handle it and maps
- such ACL addresses automatically.
- </p>
- <p>
- Denying access to particular sites by ACL may have
- undesired side effects if the site in question is hosted on
- a machine which also hosts other sites (most sites are).
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- Explicitly define the default behavior if no ACL and <tt
- class="LITERAL">listen-address</tt> are set: <span class=
- "QUOTE">"localhost"</span> is OK. The absence of a <tt
- class="REPLACEABLE"><i>dst_addr</i></tt> implies that <span
- class="emphasis"><i class="EMPHASIS">all</i></span>
- destination addresses are OK:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- permit-access localhost
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Allow any host on the same class C subnet as
- www.privoxy.org access to nothing but www.example.com (or
- other domains hosted on the same system):
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- permit-access www.privoxy.org/24 www.example.com/32
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Allow access from any host on the 26-bit subnet
- 192.168.45.64 to anywhere, with the exception that
- 192.168.45.73 may not access the IP address behind
- www.dirty-stuff.example.com:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- permit-access 192.168.45.64/26
- deny-access 192.168.45.73 www.dirty-stuff.example.com
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Allow access from the IPv4 network 192.0.2.0/24 even if
- listening on an IPv6 wild card address (not supported on
- all platforms):
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- permit-access 192.0.2.0/24
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- This is equivalent to the following line even if listening
- on an IPv4 address (not supported on all platforms):
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- permit-access [::ffff:192.0.2.0]/120
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="BUFFER-LIMIT">7.4.8. buffer-limit</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Maximum size of the buffer for content filtering.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- Size in Kbytes
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 4096
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Use a 4MB (4096 KB) limit.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- For content filtering, i.e. the <tt class=
- "LITERAL">+filter</tt> and <tt class=
- "LITERAL">+deanimate-gif</tt> actions, it is necessary that
- <span class="APPLICATION">Privoxy</span> buffers the entire
- document body. This can be potentially dangerous, since a
- server could just keep sending data indefinitely and wait
- for your RAM to exhaust -- with nasty consequences. Hence
- this option.
- </p>
- <p>
- When a document buffer size reaches the <tt class=
- "LITERAL">buffer-limit</tt>, it is flushed to the client
- unfiltered and no further attempt to filter the rest of the
- document is made. Remember that there may be multiple
- threads running, which might require up to <tt class=
- "LITERAL">buffer-limit</tt> Kbytes <span class=
- "emphasis"><i class="EMPHASIS">each</i></span>, unless you
- have enabled <span class="QUOTE">"single-threaded"</span>
- above.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ENABLE-PROXY-AUTHENTICATION-FORWARDING">7.4.9.
- enable-proxy-authentication-forwarding</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not proxy authentication through <span class=
- "APPLICATION">Privoxy</span> should work.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- 0 or 1
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Proxy authentication headers are removed.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Privoxy itself does not support proxy authentication, but
- can allow clients to authenticate against Privoxy's parent
- proxy.
- </p>
- <p>
- By default Privoxy (3.0.21 and later) don't do that and
- remove Proxy-Authorization headers in requests and
- Proxy-Authenticate headers in responses to make it harder
- for malicious sites to trick inexperienced users into
- providing login information.
- </p>
- <p>
- If this option is enabled the headers are forwarded.
- </p>
- <p>
- Enabling this option is <span class="emphasis"><i class=
- "EMPHASIS">not recommended</i></span> if there is no parent
- proxy that requires authentication or if the local network
- between Privoxy and the parent proxy isn't trustworthy. If
- proxy authentication is only required for some requests, it
- is recommended to use a client header filter to remove the
- authentication headers for requests where they aren't
- needed.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="FORWARDING">7.5. Forwarding</a>
- </h2>
- <p>
- This feature allows routing of HTTP requests through a chain of
- multiple proxies.
- </p>
- <p>
- Forwarding can be used to chain Privoxy with a caching proxy to
- speed up browsing. Using a parent proxy may also be necessary if
- the machine that <span class="APPLICATION">Privoxy</span> runs on
- has no direct Internet access.
- </p>
- <p>
- Note that parent proxies can severely decrease your privacy level.
- For example a parent proxy could add your IP address to the request
- headers and if it's a caching proxy it may add the <span class=
- "QUOTE">"Etag"</span> header to revalidation requests again, even
- though you configured Privoxy to remove it. It may also ignore
- Privoxy's header time randomization and use the original values
- which could be used by the server as cookie replacement to track
- your steps between visits.
- </p>
- <p>
- Also specified here are SOCKS proxies. <span class=
- "APPLICATION">Privoxy</span> supports the SOCKS 4 and SOCKS 4A
- protocols.
- </p>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="FORWARD">7.5.1. forward</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- To which parent HTTP proxy specific requests should be
- routed.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>target_pattern</i></tt> <tt
- class="REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>]
- </p>
- <p>
- where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
- a <a href="actions-file.html#AF-PATTERNS">URL pattern</a>
- that specifies to which requests (i.e. URLs) this forward
- rule shall apply. Use <tt class="LITERAL">/</tt> to denote
- <span class="QUOTE">"all URLs"</span>. <tt class=
- "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>] is the DNS name or IP
- address of the parent HTTP proxy through which the requests
- should be forwarded, optionally followed by its listening
- port (default: 8000). Use a single dot (<tt class=
- "LITERAL">.</tt>) to denote <span class="QUOTE">"no
- forwarding"</span>.
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Don't use parent HTTP proxies.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- If <tt class="REPLACEABLE"><i>http_parent</i></tt> is <span
- class="QUOTE">"."</span>, then requests are not forwarded
- to another HTTP proxy but are made directly to the web
- servers.
- </p>
- <p>
- <tt class="REPLACEABLE"><i>http_parent</i></tt> can be a
- numerical IPv6 address (if <a href=
- "http://tools.ietf.org/html/rfc3493" target="_top">RFC
- 3493</a> is implemented). To prevent clashes with the port
- delimiter, the whole IP address has to be put into
- brackets. On the other hand a <tt class=
- "REPLACEABLE"><i>target_pattern</i></tt> containing an IPv6
- address has to be put into angle brackets (normal brackets
- are reserved for regular expressions already).
- </p>
- <p>
- Multiple lines are OK, they are checked in sequence, and
- the last match wins.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- Everything goes to an example parent proxy, except SSL on
- port 443 (which it doesn't handle):
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward / parent-proxy.example.org:8080
- forward :443 .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Everything goes to our example ISP's caching proxy, except
- for requests to that ISP's sites:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward / caching-proxy.isp.example.net:8000
- forward .isp.example.net .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Parent proxy specified by an IPv6 address:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- forward / [2001:DB8::1]:8000
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Suppose your parent proxy doesn't support IPv6:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="PROGRAMLISTING">
- forward / parent-proxy.example.org:8000
+ debug 65536 # Log the applying actions</PRE
+></TD
+></TR
+></TABLE
+><P
+> To select multiple debug levels, you can either add them or use
+ multiple <TT
+CLASS="LITERAL"
+>debug</TT
+> lines.
+ </P
+><P
+> A debug level of 1 is informative because it will show you each request
+ as it happens. <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>1, 1024, 4096 and 8192 are recommended</I
+></SPAN
+>
+ so that you will notice when things go wrong. The other levels are
+ probably only of interest if you are hunting down a specific problem.
+ They can produce a hell of an output (especially 16).
+ </P
+><P
+> If you are used to the more verbose settings, simply enable the debug lines
+ below again.
+ </P
+><P
+> If you want to use pure CLF (Common Log Format), you should set <SPAN
+CLASS="QUOTE"
+>"debug
+ 512"</SPAN
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>ONLY</I
+></SPAN
+> and not enable anything else.
+ </P
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> has a hard-coded limit for the
+ length of log messages. If it's reached, messages are logged truncated
+ and marked with <SPAN
+CLASS="QUOTE"
+>"... [too long, truncated]"</SPAN
+>.
+ </P
+><P
+> Please don't file any support requests without trying to reproduce
+ the problem with increased debug level first. Once you read the log
+ messages, you may even be able to solve the problem on your own.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="SINGLE-THREADED"
+>7.3.2. single-threaded</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether to run only one server thread.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>1 or 0</I
+></SPAN
+></P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Multi-threaded (or, where unavailable: forked) operation, i.e. the ability to
+ serve multiple requests simultaneously.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This option is only there for debugging purposes.
+ <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>It will drastically reduce performance.</I
+></SPAN
+>
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="HOSTNAME"
+>7.3.3. hostname</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The hostname shown on the CGI pages.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Text</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> The hostname provided by the operating system is used.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> On some misconfigured systems resolving the hostname fails or
+ takes too much time and slows Privoxy down. Setting a fixed hostname
+ works around the problem.
+ </P
+><P
+> In other circumstances it might be desirable to show a hostname
+ other than the one returned by the operating system. For example
+ if the system has several different hostnames and you don't want
+ to use the first one.
+ </P
+><P
+> Note that Privoxy does not validate the specified hostname value.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="ACCESS-CONTROL"
+>7.4. Access Control and Security</A
+></H2
+><P
+> This section of the config file controls the security-relevant aspects
+ of <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>'s configuration.
+ </P
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="LISTEN-ADDRESS"
+>7.4.1. listen-address</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The address and TCP port on which <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will
+ listen for client requests.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>[<TT
+CLASS="REPLACEABLE"
+><I
+>IP-Address</I
+></TT
+>]:<TT
+CLASS="REPLACEABLE"
+><I
+>Port</I
+></TT
+></P
+><P
+>[<TT
+CLASS="REPLACEABLE"
+><I
+>Hostname</I
+></TT
+>]:<TT
+CLASS="REPLACEABLE"
+><I
+>Port</I
+></TT
+></P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>127.0.0.1:8118</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Bind to 127.0.0.1 (IPv4 localhost), port 8118. This is suitable and
+ recommended for home users who run <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> on
+ the same machine as their browser.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> You will need to configure your browser(s) to this proxy address and port.
+ </P
+><P
+> If you already have another service running on port 8118, or if you want to
+ serve requests from other machines (e.g. on your local network) as well, you
+ will need to override the default.
+ </P
+><P
+> You can use this statement multiple times to make
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> listen on more ports or more
+ <ABBR
+CLASS="ABBREV"
+>IP</ABBR
+> addresses. Suitable if your operating system does not
+ support sharing <ABBR
+CLASS="ABBREV"
+>IPv6</ABBR
+> and <ABBR
+CLASS="ABBREV"
+>IPv4</ABBR
+> protocols
+ on the same socket.
+ </P
+><P
+> If a hostname is used instead of an IP address, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ will try to resolve it to an IP address and if there are multiple, use the first
+ one returned.
+ </P
+><P
+> If the address for the hostname isn't already known on the system
+ (for example because it's in /etc/hostname), this may result in DNS
+ traffic.
+ </P
+><P
+> If the specified address isn't available on the system, or if the
+ hostname can't be resolved, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ will fail to start.
+ </P
+><P
+> IPv6 addresses containing colons have to be quoted by brackets.
+ They can only be used if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> has
+ been compiled with IPv6 support. If you aren't sure if your version
+ supports it, have a look at
+ <TT
+CLASS="LITERAL"
+>http://config.privoxy.org/show-status</TT
+>.
+ </P
+><P
+> Some operating systems will prefer IPv6 to IPv4 addresses even if the
+ system has no IPv6 connectivity which is usually not expected by the user.
+ Some even rely on DNS to resolve localhost which mean the "localhost" address
+ used may not actually be local.
+ </P
+><P
+> It is therefore recommended to explicitly configure the intended IP address
+ instead of relying on the operating system, unless there's a strong reason not to.
+ </P
+><P
+> If you leave out the address, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will bind to all
+ IPv4 interfaces (addresses) on your machine and may become reachable from the
+ Internet and/or the local network. Be aware that some GNU/Linux distributions
+ modify that behaviour without updating the documentation. Check for non-standard
+ patches if your <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> version behaves differently.
+ </P
+><P
+> If you configure <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> to be reachable from the
+ network, consider using <A
+HREF="config.html#ACLS"
+>access control lists</A
+>
+ (ACL's, see below), and/or a firewall.
+ </P
+><P
+> If you open <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> to untrusted users, you will
+ also want to make sure that the following actions are disabled: <TT
+CLASS="LITERAL"
+><A
+HREF="config.html#ENABLE-EDIT-ACTIONS"
+>enable-edit-actions</A
+></TT
+> and
+ <TT
+CLASS="LITERAL"
+><A
+HREF="config.html#ENABLE-REMOTE-TOGGLE"
+>enable-remote-toggle</A
+></TT
+>
+ </P
+></DD
+><DT
+>Example:</DT
+><DD
+><P
+> Suppose you are running <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> on
+ a machine which has the address 192.168.0.1 on your local private network
+ (192.168.0.0) and has another outside connection with a different address.
+ You want it to serve requests from inside only:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> listen-address 192.168.0.1:8118</PRE
+></TD
+></TR
+></TABLE
+><P
+> Suppose you are running <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> on an
+ IPv6-capable machine and you want it to listen on the IPv6 address
+ of the loopback device:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> listen-address [::1]:8118</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TOGGLE"
+>7.4.2. toggle</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Initial state of "toggle" status
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>1 or 0</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>1</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Act as if toggled on
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> If set to 0, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will start in
+ <SPAN
+CLASS="QUOTE"
+>"toggled off"</SPAN
+> mode, i.e. mostly behave like a normal,
+ content-neutral proxy with both ad blocking and content filtering
+ disabled. See <TT
+CLASS="LITERAL"
+>enable-remote-toggle</TT
+> below.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENABLE-REMOTE-TOGGLE"
+>7.4.3. enable-remote-toggle</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not the <A
+HREF="http://config.privoxy.org/toggle"
+TARGET="_top"
+>web-based toggle
+ feature</A
+> may be used
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>0 or 1</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> The web-based toggle feature is disabled.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> When toggled off, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> mostly acts like a normal,
+ content-neutral proxy, i.e. doesn't block ads or filter content.
+ </P
+><P
+> Access to the toggle feature can <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>not</I
+></SPAN
+> be
+ controlled separately by <SPAN
+CLASS="QUOTE"
+>"ACLs"</SPAN
+> or HTTP authentication,
+ so that everybody who can access <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> (see
+ <SPAN
+CLASS="QUOTE"
+>"ACLs"</SPAN
+> and <TT
+CLASS="LITERAL"
+>listen-address</TT
+> above) can
+ toggle it for all users. So this option is <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>not recommended</I
+></SPAN
+>
+ for multi-user environments with untrusted users.
+ </P
+><P
+> Note that malicious client side code (e.g Java) is also
+ capable of using this option.
+ </P
+><P
+> As a lot of <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> users don't read
+ documentation, this feature is disabled by default.
+ </P
+><P
+> Note that you must have compiled <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> with
+ support for this feature, otherwise this option has no effect.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENABLE-REMOTE-HTTP-TOGGLE"
+>7.4.4. enable-remote-http-toggle</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not Privoxy recognizes special HTTP headers to change its behaviour.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>0 or 1</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Privoxy ignores special HTTP headers.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> When toggled on, the client can change <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+>
+ behaviour by setting special HTTP headers. Currently the only supported
+ special header is <SPAN
+CLASS="QUOTE"
+>"X-Filter: No"</SPAN
+>, to disable filtering for
+ the ongoing request, even if it is enabled in one of the action files.
+ </P
+><P
+> This feature is disabled by default. If you are using
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> in a environment with trusted clients,
+ you may enable this feature at your discretion. Note that malicious client
+ side code (e.g Java) is also capable of using this feature.
+ </P
+><P
+> This option will be removed in future releases as it has been obsoleted
+ by the more general header taggers.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENABLE-EDIT-ACTIONS"
+>7.4.5. enable-edit-actions</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not the <A
+HREF="http://config.privoxy.org/show-status"
+TARGET="_top"
+>web-based actions
+ file editor</A
+> may be used
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>0 or 1</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> The web-based actions file editor is disabled.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Access to the editor can <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>not</I
+></SPAN
+> be
+ controlled separately by <SPAN
+CLASS="QUOTE"
+>"ACLs"</SPAN
+> or HTTP authentication,
+ so that everybody who can access <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> (see
+ <SPAN
+CLASS="QUOTE"
+>"ACLs"</SPAN
+> and <TT
+CLASS="LITERAL"
+>listen-address</TT
+> above) can
+ modify its configuration for all users.
+ </P
+><P
+> This option is <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>not recommended</I
+></SPAN
+> for environments
+ with untrusted users and as a lot of <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ users don't read documentation, this feature is disabled by default.
+ </P
+><P
+> Note that malicious client side code (e.g Java) is also
+ capable of using the actions editor and you shouldn't enable
+ this options unless you understand the consequences and are
+ sure your browser is configured correctly.
+ </P
+><P
+> Note that you must have compiled <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> with
+ support for this feature, otherwise this option has no effect.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENFORCE-BLOCKS"
+>7.4.6. enforce-blocks</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether the user is allowed to ignore blocks and can <SPAN
+CLASS="QUOTE"
+>"go there anyway"</SPAN
+>.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Blocks are not enforced.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> is mainly used to block and filter
+ requests as a service to the user, for example to block ads and other
+ junk that clogs the pipes. <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> configuration
+ isn't perfect and sometimes innocent pages are blocked. In this situation it
+ makes sense to allow the user to enforce the request and have
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> ignore the block.
+ </P
+><P
+> In the default configuration <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+>
+ <SPAN
+CLASS="QUOTE"
+>"Blocked"</SPAN
+> page contains a <SPAN
+CLASS="QUOTE"
+>"go there anyway"</SPAN
+>
+ link to adds a special string (the force prefix) to the request URL.
+ If that link is used, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will
+ detect the force prefix, remove it again and let the request pass.
+ </P
+><P
+> Of course <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can also be used to enforce
+ a network policy. In that case the user obviously should not be able to
+ bypass any blocks, and that's what the <SPAN
+CLASS="QUOTE"
+>"enforce-blocks"</SPAN
+>
+ option is for. If it's enabled, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> hides
+ the <SPAN
+CLASS="QUOTE"
+>"go there anyway"</SPAN
+> link. If the user adds the force
+ prefix by hand, it will not be accepted and the circumvention attempt
+ is logged.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> enforce-blocks 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ACLS"
+>7.4.7. ACLs: permit-access and deny-access</A
+></H4
+><A
+NAME="PERMIT-ACCESS"
+></A
+><A
+NAME="DENY-ACCESS"
+></A
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Who can access what.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>src_addr</I
+></TT
+>[:<TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+>][/<TT
+CLASS="REPLACEABLE"
+><I
+>src_masklen</I
+></TT
+>]
+ [<TT
+CLASS="REPLACEABLE"
+><I
+>dst_addr</I
+></TT
+>[:<TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+>][/<TT
+CLASS="REPLACEABLE"
+><I
+>dst_masklen</I
+></TT
+>]]
+ </P
+><P
+> Where <TT
+CLASS="REPLACEABLE"
+><I
+>src_addr</I
+></TT
+> and
+ <TT
+CLASS="REPLACEABLE"
+><I
+>dst_addr</I
+></TT
+> are IPv4 addresses in dotted decimal notation or valid
+ DNS names, <TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+> is a port
+ number, and <TT
+CLASS="REPLACEABLE"
+><I
+>src_masklen</I
+></TT
+> and
+ <TT
+CLASS="REPLACEABLE"
+><I
+>dst_masklen</I
+></TT
+> are subnet masks in CIDR notation, i.e. integer
+ values from 2 to 30 representing the length (in bits) of the network address. The masks and the whole
+ destination part are optional.
+ </P
+><P
+> If your system implements
+ <A
+HREF="http://tools.ietf.org/html/rfc3493"
+TARGET="_top"
+>RFC 3493</A
+>, then
+ <TT
+CLASS="REPLACEABLE"
+><I
+>src_addr</I
+></TT
+> and <TT
+CLASS="REPLACEABLE"
+><I
+>dst_addr</I
+></TT
+> can be IPv6 addresses delimeted by
+ brackets, <TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+> can be a number
+ or a service name, and
+ <TT
+CLASS="REPLACEABLE"
+><I
+>src_masklen</I
+></TT
+> and
+ <TT
+CLASS="REPLACEABLE"
+><I
+>dst_masklen</I
+></TT
+> can be a number
+ from 0 to 128.
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+><P
+> If no <TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+> is specified,
+ any port will match. If no <TT
+CLASS="REPLACEABLE"
+><I
+>src_masklen</I
+></TT
+> or
+ <TT
+CLASS="REPLACEABLE"
+><I
+>src_masklen</I
+></TT
+> is given, the complete IP
+ address has to match (i.e. 32 bits for IPv4 and 128 bits for IPv6).
+ </P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Don't restrict access further than implied by <TT
+CLASS="LITERAL"
+>listen-address</TT
+>
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Access controls are included at the request of ISPs and systems
+ administrators, and <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>are not usually needed by individual users</I
+></SPAN
+>.
+ For a typical home user, it will normally suffice to ensure that
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> only listens on the localhost
+ (127.0.0.1) or internal (home) network address by means of the
+ <A
+HREF="config.html#LISTEN-ADDRESS"
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>listen-address</I
+></SPAN
+></A
+>
+ option.
+ </P
+><P
+> Please see the warnings in the FAQ that <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ is not intended to be a substitute for a firewall or to encourage anyone
+ to defer addressing basic security weaknesses.
+ </P
+><P
+> Multiple ACL lines are OK.
+ If any ACLs are specified, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> only talks
+ to IP addresses that match at least one <TT
+CLASS="LITERAL"
+>permit-access</TT
+> line
+ and don't match any subsequent <TT
+CLASS="LITERAL"
+>deny-access</TT
+> line. In other words, the
+ last match wins, with the default being <TT
+CLASS="LITERAL"
+>deny-access</TT
+>.
+ </P
+><P
+> If <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> is using a forwarder (see <TT
+CLASS="LITERAL"
+>forward</TT
+> below)
+ for a particular destination URL, the <TT
+CLASS="REPLACEABLE"
+><I
+>dst_addr</I
+></TT
+>
+ that is examined is the address of the forwarder and <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>NOT</I
+></SPAN
+> the address
+ of the ultimate target. This is necessary because it may be impossible for the local
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> to determine the IP address of the
+ ultimate target (that's often what gateways are used for).
+ </P
+><P
+> You should prefer using IP addresses over DNS names, because the address lookups take
+ time. All DNS names must resolve! You can <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>not</I
+></SPAN
+> use domain patterns
+ like <SPAN
+CLASS="QUOTE"
+>"*.org"</SPAN
+> or partial domain names. If a DNS name resolves to multiple
+ IP addresses, only the first one is used.
+ </P
+><P
+> Some systems allow IPv4 clients to connect to IPv6 server sockets.
+ Then the client's IPv4 address will be translated by the system into
+ IPv6 address space with special prefix ::ffff:0:0/96 (so called IPv4
+ mapped IPv6 address). <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can handle it
+ and maps such ACL addresses automatically.
+ </P
+><P
+> Denying access to particular sites by ACL may have undesired side effects
+ if the site in question is hosted on a machine which also hosts other sites
+ (most sites are).
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> Explicitly define the default behavior if no ACL and
+ <TT
+CLASS="LITERAL"
+>listen-address</TT
+> are set: <SPAN
+CLASS="QUOTE"
+>"localhost"</SPAN
+>
+ is OK. The absence of a <TT
+CLASS="REPLACEABLE"
+><I
+>dst_addr</I
+></TT
+> implies that
+ <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>all</I
+></SPAN
+> destination addresses are OK:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> permit-access localhost</PRE
+></TD
+></TR
+></TABLE
+><P
+> Allow any host on the same class C subnet as www.privoxy.org access to
+ nothing but www.example.com (or other domains hosted on the same system):
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> permit-access www.privoxy.org/24 www.example.com/32</PRE
+></TD
+></TR
+></TABLE
+><P
+> Allow access from any host on the 26-bit subnet 192.168.45.64 to anywhere,
+ with the exception that 192.168.45.73 may not access the IP address behind
+ www.dirty-stuff.example.com:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> permit-access 192.168.45.64/26
+ deny-access 192.168.45.73 www.dirty-stuff.example.com</PRE
+></TD
+></TR
+></TABLE
+><P
+> Allow access from the IPv4 network 192.0.2.0/24 even if listening on
+ an IPv6 wild card address (not supported on all platforms):
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> permit-access 192.0.2.0/24</PRE
+></TD
+></TR
+></TABLE
+><P
+> This is equivalent to the following line even if listening on an
+ IPv4 address (not supported on all platforms):
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> permit-access [::ffff:192.0.2.0]/120</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="BUFFER-LIMIT"
+>7.4.8. buffer-limit</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Maximum size of the buffer for content filtering.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>Size in Kbytes</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>4096</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Use a 4MB (4096 KB) limit.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> For content filtering, i.e. the <TT
+CLASS="LITERAL"
+>+filter</TT
+> and
+ <TT
+CLASS="LITERAL"
+>+deanimate-gif</TT
+> actions, it is necessary that
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> buffers the entire document body.
+ This can be potentially dangerous, since a server could just keep sending
+ data indefinitely and wait for your RAM to exhaust -- with nasty consequences.
+ Hence this option.
+ </P
+><P
+> When a document buffer size reaches the <TT
+CLASS="LITERAL"
+>buffer-limit</TT
+>, it is
+ flushed to the client unfiltered and no further attempt to
+ filter the rest of the document is made. Remember that there may be multiple threads
+ running, which might require up to <TT
+CLASS="LITERAL"
+>buffer-limit</TT
+> Kbytes
+ <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>each</I
+></SPAN
+>, unless you have enabled <SPAN
+CLASS="QUOTE"
+>"single-threaded"</SPAN
+>
+ above.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENABLE-PROXY-AUTHENTICATION-FORWARDING"
+>7.4.9. enable-proxy-authentication-forwarding</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not proxy authentication through <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> should work.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>0 or 1</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Proxy authentication headers are removed.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Privoxy itself does not support proxy authentication, but can
+ allow clients to authenticate against Privoxy's parent proxy.
+ </P
+><P
+> By default Privoxy (3.0.21 and later) don't do that and remove
+ Proxy-Authorization headers in requests and Proxy-Authenticate
+ headers in responses to make it harder for malicious sites to
+ trick inexperienced users into providing login information.
+ </P
+><P
+> If this option is enabled the headers are forwarded.
+ </P
+><P
+> Enabling this option is <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>not recommended</I
+></SPAN
+> if there is
+ no parent proxy that requires authentication or if the local network between
+ Privoxy and the parent proxy isn't trustworthy. If proxy authentication is
+ only required for some requests, it is recommended to use a client header filter
+ to remove the authentication headers for requests where they aren't needed.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TRUSTED-CGI-REFERER"
+>7.4.10. trusted-cgi-referer</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> A trusted website or webpage whose links can be followed to reach sensitive CGI pages
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+>URL or URL prefix</P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>Unset</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No external pages are considered trusted referers.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Before <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> accepts configuration changes through CGI pages like
+ <A
+HREF="config.html#CLIENT-SPECIFIC-TAG"
+>client-tags</A
+> or the
+ <A
+HREF="config.html#ENABLE-REMOTE-TOGGLE"
+>remote toggle</A
+>, it checks
+ the Referer header to see if the request comes from a trusted source.
+ </P
+><P
+> By default only the webinterface domains
+ <A
+HREF="http://config.privoxy.org/"
+TARGET="_top"
+>config.privoxy.org</A
+>
+ and
+ <A
+HREF="http://p.p/"
+TARGET="_top"
+>p.p</A
+>
+ are considered trustworthy.
+ Requests originating from other domains are rejected to prevent
+ third-parties from modifiying Privoxy's state by e.g. embedding
+ images that result in CGI requests.
+ </P
+><P
+> In some environments it may be desirable to embed links to CGI pages
+ on external pages, for example on an Intranet homepage the Privoxy admin
+ controls.
+ </P
+><P
+> The <SPAN
+CLASS="QUOTE"
+>"trusted-cgi-referer"</SPAN
+> option can be used to add that page,
+ or the whole domain, as trusted source so the resulting requests aren't
+ rejected.
+ Requests are accepted if the specified trusted-cgi-refer is the prefix
+ of the Referer.
+ </P
+><DIV
+CLASS="WARNING"
+><P
+></P
+><TABLE
+CLASS="WARNING"
+BORDER="1"
+WIDTH="90%"
+><TR
+><TD
+ALIGN="CENTER"
+><B
+>Warning</B
+></TD
+></TR
+><TR
+><TD
+ALIGN="LEFT"
+><P
+> Declaring pages the admin doesn't control trustworthy may allow
+ malicious third parties to modify Privoxy's internal state against
+ the user's wishes and without the user's knowledge.
+ </P
+></TD
+></TR
+></TABLE
+></DIV
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="FORWARDING"
+>7.5. Forwarding</A
+></H2
+><P
+> This feature allows routing of HTTP requests through a chain of
+ multiple proxies.</P
+><P
+> Forwarding can be used to chain Privoxy with a caching proxy to speed
+ up browsing. Using a parent proxy may also be necessary if the machine
+ that <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> runs on has no direct Internet access.</P
+><P
+> Note that parent proxies can severely decrease your privacy level.
+ For example a parent proxy could add your IP address to the request
+ headers and if it's a caching proxy it may add the <SPAN
+CLASS="QUOTE"
+>"Etag"</SPAN
+>
+ header to revalidation requests again, even though you configured Privoxy
+ to remove it. It may also ignore Privoxy's header time randomization and use the
+ original values which could be used by the server as cookie replacement
+ to track your steps between visits.</P
+><P
+> Also specified here are SOCKS proxies. <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ supports the SOCKS 4 and SOCKS 4A protocols.</P
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="FORWARD"
+>7.5.1. forward</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> To which parent HTTP proxy specific requests should be routed.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>target_pattern</I
+></TT
+>
+ <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+>[:<TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+>]
+ </P
+><P
+> where <TT
+CLASS="REPLACEABLE"
+><I
+>target_pattern</I
+></TT
+> is a <A
+HREF="actions-file.html#AF-PATTERNS"
+>URL pattern</A
+>
+ that specifies to which requests (i.e. URLs) this forward rule shall apply. Use <TT
+CLASS="LITERAL"
+>/</TT
+> to
+ denote <SPAN
+CLASS="QUOTE"
+>"all URLs"</SPAN
+>.
+ <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+>[:<TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+>]
+ is the DNS name or IP address of the parent HTTP proxy through which the requests should be forwarded,
+ optionally followed by its listening port (default: 8000).
+ Use a single dot (<TT
+CLASS="LITERAL"
+>.</TT
+>) to denote <SPAN
+CLASS="QUOTE"
+>"no forwarding"</SPAN
+>.
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Don't use parent HTTP proxies.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> If <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+> is <SPAN
+CLASS="QUOTE"
+>"."</SPAN
+>, then requests are not
+ forwarded to another HTTP proxy but are made directly to the web servers.
+ </P
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+> can be a
+ numerical IPv6 address (if
+ <A
+HREF="http://tools.ietf.org/html/rfc3493"
+TARGET="_top"
+>RFC 3493</A
+> is
+ implemented). To prevent clashes with the port delimiter, the whole IP
+ address has to be put into brackets. On the other hand a <TT
+CLASS="REPLACEABLE"
+><I
+>target_pattern</I
+></TT
+> containing an IPv6 address
+ has to be put into angle brackets (normal brackets are reserved for
+ regular expressions already).
+ </P
+><P
+> Multiple lines are OK, they are checked in sequence, and the last match wins.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> Everything goes to an example parent proxy, except SSL on port 443 (which it doesn't handle):
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / parent-proxy.example.org:8080
+ forward :443 .</PRE
+></TD
+></TR
+></TABLE
+><P
+> Everything goes to our example ISP's caching proxy, except for requests
+ to that ISP's sites:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / caching-proxy.isp.example.net:8000
+ forward .isp.example.net .</PRE
+></TD
+></TR
+></TABLE
+><P
+> Parent proxy specified by an IPv6 address:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> forward / [2001:DB8::1]:8000</PRE
+></TD
+></TR
+></TABLE
+><P
+> Suppose your parent proxy doesn't support IPv6:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="PROGRAMLISTING"
+> forward / parent-proxy.example.org:8000
forward ipv6-server.example.org .
- forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> .
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="SOCKS">7.5.2. forward-socks4, forward-socks4a,
- forward-socks5 and forward-socks5t</a>
- </h4>
- <a name="FORWARD-SOCKS4"></a><a name="FORWARD-SOCKS4A"></a>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Through which SOCKS proxy (and optionally to which parent
- HTTP proxy) specific requests should be routed.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>target_pattern</i></tt> <tt
- class="REPLACEABLE"><i>socks_proxy</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>] <tt class=
- "REPLACEABLE"><i>http_parent</i></tt>[:<tt class=
- "REPLACEABLE"><i>port</i></tt>]
- </p>
- <p>
- where <tt class="REPLACEABLE"><i>target_pattern</i></tt> is
- a <a href="actions-file.html#AF-PATTERNS">URL pattern</a>
- that specifies to which requests (i.e. URLs) this forward
- rule shall apply. Use <tt class="LITERAL">/</tt> to denote
- <span class="QUOTE">"all URLs"</span>. <tt class=
- "REPLACEABLE"><i>http_parent</i></tt> and <tt class=
- "REPLACEABLE"><i>socks_proxy</i></tt> are IP addresses in
- dotted decimal notation or valid DNS names (<tt class=
- "REPLACEABLE"><i>http_parent</i></tt> may be <span class=
- "QUOTE">"."</span> to denote <span class="QUOTE">"no HTTP
- forwarding"</span>), and the optional <tt class=
- "REPLACEABLE"><i>port</i></tt> parameters are TCP ports,
- i.e. integer values from 1 to 65535
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">Unset</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Don't use SOCKS proxies.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Multiple lines are OK, they are checked in sequence, and
- the last match wins.
- </p>
- <p>
- The difference between <tt class=
- "LITERAL">forward-socks4</tt> and <tt class=
- "LITERAL">forward-socks4a</tt> is that in the SOCKS 4A
- protocol, the DNS resolution of the target hostname happens
- on the SOCKS server, while in SOCKS 4 it happens locally.
- </p>
- <p>
- With <tt class="LITERAL">forward-socks5</tt> the DNS
- resolution will happen on the remote server as well.
- </p>
- <p>
- <tt class="LITERAL">forward-socks5t</tt> works like vanilla
- <tt class="LITERAL">forward-socks5</tt> but lets <span
- class="APPLICATION">Privoxy</span> additionally use
- Tor-specific SOCKS extensions. Currently the only supported
- SOCKS extension is optimistic data which can reduce the
- latency for the first request made on a newly created
- connection.
- </p>
- <p>
- <tt class="REPLACEABLE"><i>socks_proxy</i></tt> and <tt
- class="REPLACEABLE"><i>http_parent</i></tt> can be a
- numerical IPv6 address (if <a href=
- "http://tools.ietf.org/html/rfc3493" target="_top">RFC
- 3493</a> is implemented). To prevent clashes with the port
- delimiter, the whole IP address has to be put into
- brackets. On the other hand a <tt class=
- "REPLACEABLE"><i>target_pattern</i></tt> containing an IPv6
- address has to be put into angle brackets (normal brackets
- are reserved for regular expressions already).
- </p>
- <p>
- If <tt class="REPLACEABLE"><i>http_parent</i></tt> is <span
- class="QUOTE">"."</span>, then requests are not forwarded
- to another HTTP proxy but are made (HTTP-wise) directly to
- the web servers, albeit through a SOCKS proxy.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- From the company example.com, direct connections are made
- to all <span class="QUOTE">"internal"</span> domains, but
- everything outbound goes through their ISP's proxy by way
- of example.com's corporate SOCKS 4A gateway to the
- Internet.
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080
- forward .example.com .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- A rule that uses a SOCKS 4 gateway for all destinations but
- no HTTP parent looks like this:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward-socks4 / socks-gw.example.com:1080 .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- To chain Privoxy and Tor, both running on the same system,
- you would use something like:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward-socks5t / 127.0.0.1:9050 .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Note that if you got Tor through one of the bundles, you
- may have to change the port from 9050 to 9150 (or even
- another one). For details, please check the documentation
- on the <a href="https://torproject.org/" target="_top">Tor
- website</a>.
- </p>
- <p>
- The public <span class="APPLICATION">Tor</span> network
- can't be used to reach your local network, if you need to
- access local servers you therefore might want to make some
- exceptions:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward 192.168.*.*/ .
- forward 10.*.*.*/ .
- forward 127.*.*.*/ .
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Unencrypted connections to systems in these address ranges
- will be as (un)secure as the local network is, but the
- alternative is that you can't reach the local network
- through <span class="APPLICATION">Privoxy</span> at all. Of
- course this may actually be desired and there is no reason
- to make these exceptions if you aren't sure you need them.
- </p>
- <p>
- If you also want to be able to reach servers in your local
- network by using their names, you will need additional
- exceptions that look like this:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward localhost/ .
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ADVANCED-FORWARDING-EXAMPLES">7.5.3. Advanced Forwarding
- Examples</a>
- </h4>
- <p>
- If you have links to multiple ISPs that provide various special
- content only to their subscribers, you can configure multiple
- <span class="APPLICATION">Privoxies</span> which have connections
- to the respective ISPs to act as forwarders to each other, so
- that <span class="emphasis"><i class="EMPHASIS">your</i></span>
- users can see the internal content of all ISPs.
- </p>
- <p>
- Assume that host-a has a PPP connection to isp-a.example.net. And
- host-b has a PPP connection to isp-b.example.org. Both run <span
- class="APPLICATION">Privoxy</span>. Their forwarding
- configuration can look like this:
- </p>
- <p>
- host-a:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward / .
- forward .isp-b.example.net host-b:8118
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- host-b:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward / .
- forward .isp-a.example.org host-a:8118
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- Now, your users can set their browser's proxy to use either
- host-a or host-b and be able to browse the internal content of
- both isp-a and isp-b.
- </p>
- <p>
- If you intend to chain <span class="APPLICATION">Privoxy</span>
- and <span class="APPLICATION">squid</span> locally, then chaining
- as <tt class="LITERAL">browser -> squid -> privoxy</tt> is
- the recommended way.
- </p>
- <p>
- Assuming that <span class="APPLICATION">Privoxy</span> and <span
- class="APPLICATION">squid</span> run on the same box, your <span
- class="APPLICATION">squid</span> configuration could then look
- like this:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
-<pre class="SCREEN">
- # Define Privoxy as parent proxy (without ICP)
+ forward <[2-3][0-9a-f][0-9a-f][0-9a-f]:*> .</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="SOCKS"
+>7.5.2. forward-socks4, forward-socks4a, forward-socks5 and forward-socks5t</A
+></H4
+><A
+NAME="FORWARD-SOCKS4"
+></A
+><A
+NAME="FORWARD-SOCKS4A"
+></A
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Through which SOCKS proxy (and optionally to which parent HTTP proxy) specific requests should be routed.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>target_pattern</I
+></TT
+>
+ <TT
+CLASS="REPLACEABLE"
+><I
+>socks_proxy</I
+></TT
+>[:<TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+>]
+ <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+>[:<TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+>]
+ </P
+><P
+> where <TT
+CLASS="REPLACEABLE"
+><I
+>target_pattern</I
+></TT
+> is a
+ <A
+HREF="actions-file.html#AF-PATTERNS"
+>URL pattern</A
+> that specifies to which
+ requests (i.e. URLs) this forward rule shall apply. Use <TT
+CLASS="LITERAL"
+>/</TT
+> to
+ denote <SPAN
+CLASS="QUOTE"
+>"all URLs"</SPAN
+>. <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+>
+ and <TT
+CLASS="REPLACEABLE"
+><I
+>socks_proxy</I
+></TT
+>
+ are IP addresses in dotted decimal notation or valid DNS names
+ (<TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+>
+ may be <SPAN
+CLASS="QUOTE"
+>"."</SPAN
+> to denote <SPAN
+CLASS="QUOTE"
+>"no HTTP forwarding"</SPAN
+>), and the optional
+ <TT
+CLASS="REPLACEABLE"
+><I
+>port</I
+></TT
+> parameters are TCP ports,
+ i.e. integer values from 1 to 65535
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>Unset</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Don't use SOCKS proxies.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Multiple lines are OK, they are checked in sequence, and the last match wins.
+ </P
+><P
+> The difference between <TT
+CLASS="LITERAL"
+>forward-socks4</TT
+> and <TT
+CLASS="LITERAL"
+>forward-socks4a</TT
+>
+ is that in the SOCKS 4A protocol, the DNS resolution of the target hostname happens on the SOCKS
+ server, while in SOCKS 4 it happens locally.
+ </P
+><P
+> With <TT
+CLASS="LITERAL"
+>forward-socks5</TT
+> the DNS resolution will happen on the remote server as well.
+ </P
+><P
+> <TT
+CLASS="LITERAL"
+>forward-socks5t</TT
+> works like vanilla <TT
+CLASS="LITERAL"
+>forward-socks5</TT
+> but
+ lets <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> additionally use Tor-specific SOCKS extensions. Currently the only supported
+ SOCKS extension is optimistic data which can reduce the latency for the first request made
+ on a newly created connection.
+ </P
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>socks_proxy</I
+></TT
+> and
+ <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+> can be a
+ numerical IPv6 address (if
+ <A
+HREF="http://tools.ietf.org/html/rfc3493"
+TARGET="_top"
+>RFC 3493</A
+> is
+ implemented). To prevent clashes with the port delimiter, the whole IP
+ address has to be put into brackets. On the other hand a <TT
+CLASS="REPLACEABLE"
+><I
+>target_pattern</I
+></TT
+> containing an IPv6 address
+ has to be put into angle brackets (normal brackets are reserved for
+ regular expressions already).
+ </P
+><P
+> If <TT
+CLASS="REPLACEABLE"
+><I
+>http_parent</I
+></TT
+> is <SPAN
+CLASS="QUOTE"
+>"."</SPAN
+>, then requests are not
+ forwarded to another HTTP proxy but are made (HTTP-wise) directly to the web servers, albeit through
+ a SOCKS proxy.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> From the company example.com, direct connections are made to all
+ <SPAN
+CLASS="QUOTE"
+>"internal"</SPAN
+> domains, but everything outbound goes through
+ their ISP's proxy by way of example.com's corporate SOCKS 4A gateway to
+ the Internet.
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward-socks4a / socks-gw.example.com:1080 www-cache.isp.example.net:8080
+ forward .example.com .</PRE
+></TD
+></TR
+></TABLE
+><P
+> A rule that uses a SOCKS 4 gateway for all destinations but no HTTP parent looks like this:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward-socks4 / socks-gw.example.com:1080 .</PRE
+></TD
+></TR
+></TABLE
+><P
+> To chain Privoxy and Tor, both running on the same system, you would use
+ something like:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward-socks5t / 127.0.0.1:9050 .</PRE
+></TD
+></TR
+></TABLE
+><P
+> Note that if you got Tor through one of the bundles, you may
+ have to change the port from 9050 to 9150 (or even another one).
+ For details, please check the documentation on the
+ <A
+HREF="https://torproject.org/"
+TARGET="_top"
+>Tor website</A
+>.
+ </P
+><P
+> The public <SPAN
+CLASS="APPLICATION"
+>Tor</SPAN
+> network can't be used to
+ reach your local network, if you need to access local servers you
+ therefore might want to make some exceptions:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward 192.168.*.*/ .
+ forward 10.*.*.*/ .
+ forward 127.*.*.*/ .</PRE
+></TD
+></TR
+></TABLE
+><P
+> Unencrypted connections to systems in these address ranges will
+ be as (un)secure as the local network is, but the alternative is that you
+ can't reach the local network through <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ at all. Of course this may actually be desired and there is no reason
+ to make these exceptions if you aren't sure you need them.
+ </P
+><P
+> If you also want to be able to reach servers in your local network by
+ using their names, you will need additional exceptions that look like
+ this:
+ </P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward localhost/ .</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ADVANCED-FORWARDING-EXAMPLES"
+>7.5.3. Advanced Forwarding Examples</A
+></H4
+><P
+> If you have links to multiple ISPs that provide various special content
+ only to their subscribers, you can configure multiple <SPAN
+CLASS="APPLICATION"
+>Privoxies</SPAN
+>
+ which have connections to the respective ISPs to act as forwarders to each other, so that
+ <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>your</I
+></SPAN
+> users can see the internal content of all ISPs.</P
+><P
+> Assume that host-a has a PPP connection to isp-a.example.net. And host-b has a PPP connection to
+ isp-b.example.org. Both run <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>. Their forwarding
+ configuration can look like this:</P
+><P
+> host-a:</P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / .
+ forward .isp-b.example.net host-b:8118</PRE
+></TD
+></TR
+></TABLE
+><P
+> host-b:</P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / .
+ forward .isp-a.example.org host-a:8118</PRE
+></TD
+></TR
+></TABLE
+><P
+> Now, your users can set their browser's proxy to use either
+ host-a or host-b and be able to browse the internal content
+ of both isp-a and isp-b.</P
+><P
+> If you intend to chain <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> and
+ <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+> locally, then chaining as
+ <TT
+CLASS="LITERAL"
+>browser -> squid -> privoxy</TT
+> is the recommended way.</P
+><P
+> Assuming that <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> and <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+>
+ run on the same box, your <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+> configuration could then look like this:</P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Define Privoxy as parent proxy (without ICP)
cache_peer 127.0.0.1 parent 8118 7 no-query
# Define ACL for protocol FTP
always_direct allow ftp
# Forward all the rest to Privoxy
- never_direct allow all
-</pre>
- </td>
- </tr>
- </table>
-
- <p>
- You would then need to change your browser's proxy settings to
- <span class="APPLICATION">squid</span>'s address and port. Squid
- normally uses port 3128. If unsure consult <tt class=
- "LITERAL">http_port</tt> in <tt class="FILENAME">squid.conf</tt>.
- </p>
- <p>
- You could just as well decide to only forward requests you
- suspect of leading to Windows executables through a
- virus-scanning parent proxy, say, on <tt class=
- "LITERAL">antivir.example.com</tt>, port 8010:
- </p>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="100%">
- <tr>
- <td>
-<pre class="SCREEN">
- forward / .
- forward /.*\.(exe|com|dll|zip)$ antivir.example.com:8010
-</pre>
- </td>
- </tr>
- </table>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="FORWARDED-CONNECT-RETRIES">7.5.4.
- forwarded-connect-retries</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- How often Privoxy retries if a forwarded connection request
- fails.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Number of retries.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">0</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Connections forwarded through other proxies are treated
- like direct connections and no retry attempts are made.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- <tt class=
- "REPLACEABLE"><i>forwarded-connect-retries</i></tt> is
- mainly interesting for socks4a connections, where <span
- class="APPLICATION">Privoxy</span> can't detect why the
- connections failed. The connection might have failed
- because of a DNS timeout in which case a retry makes sense,
- but it might also have failed because the server doesn't
- exist or isn't reachable. In this case the retry will just
- delay the appearance of Privoxy's error message.
- </p>
- <p>
- Note that in the context of this option, <span class=
- "QUOTE">"forwarded connections"</span> includes all
- connections that Privoxy forwards through other proxies.
- This option is not limited to the HTTP CONNECT method.
- </p>
- <p>
- Only use this option, if you are getting lots of
- forwarding-related error messages that go away when you try
- again manually. Start with a small value and check
- Privoxy's logfile from time to time, to see how many
- retries are usually needed.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- forwarded-connect-retries 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- </div>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="MISC">7.6. Miscellaneous</a>
- </h2>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ACCEPT-INTERCEPTED-REQUESTS">7.6.1.
- accept-intercepted-requests</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether intercepted requests should be treated as valid.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">0</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Only proxy requests are accepted, intercepted requests are
- treated as invalid.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- If you don't trust your clients and want to force them to
- use <span class="APPLICATION">Privoxy</span>, enable this
- option and configure your packet filter to redirect
- outgoing HTTP connections into <span class=
- "APPLICATION">Privoxy</span>.
- </p>
- <p>
- Note that intercepting encrypted connections (HTTPS) isn't
- supported.
- </p>
- <p>
- Make sure that <span class="APPLICATION">Privoxy's</span>
- own requests aren't redirected as well. Additionally take
- care that <span class="APPLICATION">Privoxy</span> can't
- intentionally connect to itself, otherwise you could run
- into redirection loops if <span class=
- "APPLICATION">Privoxy's</span> listening port is reachable
- by the outside or an attacker has access to the pages you
- visit.
- </p>
- <p>
- If you are running Privoxy as intercepting proxy without
- being able to intercept all client requests you may want to
- adjust the CGI templates to make sure they don't reference
- content from config.privoxy.org.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- accept-intercepted-requests 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ALLOW-CGI-REQUEST-CRUNCHING">7.6.2.
- allow-cgi-request-crunching</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether requests to <span class=
- "APPLICATION">Privoxy's</span> CGI pages can be blocked or
- redirected.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">0</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- <span class="APPLICATION">Privoxy</span> ignores block and
- redirect actions for its CGI pages.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- By default <span class="APPLICATION">Privoxy</span> ignores
- block or redirect actions for its CGI pages. Intercepting
- these requests can be useful in multi-user setups to
- implement fine-grained access control, but it can also
- render the complete web interface useless and make
- debugging problems painful if done without care.
- </p>
- <p>
- Don't enable this option unless you're sure that you really
- need it.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- allow-cgi-request-crunching 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="SPLIT-LARGE-FORMS">7.6.3. split-large-forms</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether the CGI interface should stay compatible with
- broken HTTP clients.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- <span class="emphasis"><i class="EMPHASIS">0</i></span>
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- The CGI form generate long GET URLs.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- <span class="APPLICATION">Privoxy's</span> CGI forms can
- lead to rather long URLs. This isn't a problem as far as
- the HTTP standard is concerned, but it can confuse clients
- with arbitrary URL length limitations.
- </p>
- <p>
- Enabling split-large-forms causes <span class=
- "APPLICATION">Privoxy</span> to divide big forms into
- smaller ones to keep the URL length down. It makes editing
- a lot less convenient and you can no longer submit all
- changes at once, but at least it works around this browser
- bug.
- </p>
- <p>
- If you don't notice any editing problems, there is no
- reason to enable this option, but if one of the submit
- buttons appears to be broken, you should give it a try.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- split-large-forms 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="KEEP-ALIVE-TIMEOUT">7.6.4. keep-alive-timeout</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Number of seconds after which an open connection will no
- longer be reused.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Time in seconds.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Connections are not kept alive.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- This option allows clients to keep the connection to <span
- class="APPLICATION">Privoxy</span> alive. If the server
- supports it, <span class="APPLICATION">Privoxy</span> will
- keep the connection to the server alive as well. Under
- certain circumstances this may result in speed-ups.
- </p>
- <p>
- By default, <span class="APPLICATION">Privoxy</span> will
- close the connection to the server if the client connection
- gets closed, or if the specified timeout has been reached
- without a new request coming in. This behaviour can be
- changed with the <a href="#CONNECTION-SHARING" target=
- "_top">connection-sharing</a> option.
- </p>
- <p>
- This option has no effect if <span class=
- "APPLICATION">Privoxy</span> has been compiled without
- keep-alive support.
- </p>
- <p>
- Note that a timeout of five seconds as used in the default
- configuration file significantly decreases the number of
- connections that will be reused. The value is used because
- some browsers limit the number of connections they open to
- a single host and apply the same limit to proxies. This can
- result in a single website <span class=
- "QUOTE">"grabbing"</span> all the connections the browser
- allows, which means connections to other websites can't be
- opened until the connections currently in use time out.
- </p>
- <p>
- Several users have reported this as a Privoxy bug, so the
- default value has been reduced. Consider increasing it to
- 300 seconds or even more if you think your browser can
- handle it. If your browser appears to be hanging, it
- probably can't.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- keep-alive-timeout 300
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TOLERATE-PIPELINING">7.6.5. tolerate-pipelining</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not pipelined requests should be served.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- If Privoxy receives more than one request at once, it
- terminates the client connection after serving the first
- one.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- <span class="APPLICATION">Privoxy</span> currently doesn't
- pipeline outgoing requests, thus allowing pipelining on the
- client connection is not guaranteed to improve the
- performance.
- </p>
- <p>
- By default <span class="APPLICATION">Privoxy</span> tries
- to discourage clients from pipelining by discarding
- aggressively pipelined requests, which forces the client to
- resend them through a new connection.
- </p>
- <p>
- This option lets <span class="APPLICATION">Privoxy</span>
- tolerate pipelining. Whether or not that improves
- performance mainly depends on the client configuration.
- </p>
- <p>
- If you are seeing problems with pages not properly loading,
- disabling this option could work around the problem.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- tolerate-pipelining 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="DEFAULT-SERVER-TIMEOUT">7.6.6.
- default-server-timeout</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Assumed server-side keep-alive timeout if not specified by
- the server.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Time in seconds.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Connections for which the server didn't specify the
- keep-alive timeout are not reused.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Enabling this option significantly increases the number of
- connections that are reused, provided the <a href=
- "#KEEP-ALIVE-TIMEOUT" target="_top">keep-alive-timeout</a>
- option is also enabled.
- </p>
- <p>
- While it also increases the number of connections problems
- when <span class="APPLICATION">Privoxy</span> tries to
- reuse a connection that already has been closed on the
- server side, or is closed while <span class=
- "APPLICATION">Privoxy</span> is trying to reuse it, this
- should only be a problem if it happens for the first
- request sent by the client. If it happens for requests on
- reused client connections, <span class=
- "APPLICATION">Privoxy</span> will simply close the
- connection and the client is supposed to retry the request
- without bothering the user.
- </p>
- <p>
- Enabling this option is therefore only recommended if the
- <a href="#CONNECTION-SHARING" target=
- "_top">connection-sharing</a> option is disabled.
- </p>
- <p>
- It is an error to specify a value larger than the <a href=
- "#KEEP-ALIVE-TIMEOUT" target="_top">keep-alive-timeout</a>
- value.
- </p>
- <p>
- This option has no effect if <span class=
- "APPLICATION">Privoxy</span> has been compiled without
- keep-alive support.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- default-server-timeout 60
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="CONNECTION-SHARING">7.6.7. connection-sharing</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not outgoing connections that have been kept
- alive should be shared between different incoming
- connections.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Connections are not shared.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- This option has no effect if <span class=
- "APPLICATION">Privoxy</span> has been compiled without
- keep-alive support, or if it's disabled.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Note that reusing connections doesn't necessary cause
- speedups. There are also a few privacy implications you
- should be aware of.
- </p>
- <p>
- If this option is effective, outgoing connections are
- shared between clients (if there are more than one) and
- closing the browser that initiated the outgoing connection
- does no longer affect the connection between <span class=
- "APPLICATION">Privoxy</span> and the server unless the
- client's request hasn't been completed yet.
- </p>
- <p>
- If the outgoing connection is idle, it will not be closed
- until either <span class="APPLICATION">Privoxy's</span> or
- the server's timeout is reached. While it's open, the
- server knows that the system running <span class=
- "APPLICATION">Privoxy</span> is still there.
- </p>
- <p>
- If there are more than one client (maybe even belonging to
- multiple users), they will be able to reuse each others
- connections. This is potentially dangerous in case of
- authentication schemes like NTLM where only the connection
- is authenticated, instead of requiring authentication for
- each request.
- </p>
- <p>
- If there is only a single client, and if said client can
- keep connections alive on its own, enabling this option has
- next to no effect. If the client doesn't support connection
- keep-alive, enabling this option may make sense as it
- allows <span class="APPLICATION">Privoxy</span> to keep
- outgoing connections alive even if the client itself
- doesn't support it.
- </p>
- <p>
- You should also be aware that enabling this option
- increases the likelihood of getting the "No server or
- forwarder data" error message, especially if you are using
- a slow connection to the Internet.
- </p>
- <p>
- This option should only be used by experienced users who
- understand the risks and can weight them against the
- benefits.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- connection-sharing 1
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="SOCKET-TIMEOUT">7.6.8. socket-timeout</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Number of seconds after which a socket times out if no data
- is received.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Time in seconds.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- A default value of 300 seconds is used.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- The default is quite high and you probably want to reduce
- it. If you aren't using an occasionally slow proxy like
- Tor, reducing it to a few seconds should be fine.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- socket-timeout 300
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="MAX-CLIENT-CONNECTIONS">7.6.9.
- max-client-connections</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Maximum number of client connections that will be served.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Positive number.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 128
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Connections are served until a resource limit is reached.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- <span class="APPLICATION">Privoxy</span> creates one thread
- (or process) for every incoming client connection that
- isn't rejected based on the access control settings.
- </p>
- <p>
- If the system is powerful enough, <span class=
- "APPLICATION">Privoxy</span> can theoretically deal with
- several hundred (or thousand) connections at the same time,
- but some operating systems enforce resource limits by
- shutting down offending processes and their default limits
- may be below the ones <span class=
- "APPLICATION">Privoxy</span> would require under heavy
- load.
- </p>
- <p>
- Configuring <span class="APPLICATION">Privoxy</span> to
- enforce a connection limit below the thread or process
- limit used by the operating system makes sure this doesn't
- happen. Simply increasing the operating system's limit
- would work too, but if <span class=
- "APPLICATION">Privoxy</span> isn't the only application
- running on the system, you may actually want to limit the
- resources used by <span class="APPLICATION">Privoxy</span>.
- </p>
- <p>
- If <span class="APPLICATION">Privoxy</span> is only used by
- a single trusted user, limiting the number of client
- connections is probably unnecessary. If there are multiple
- possibly untrusted users you probably still want to
- additionally use a packet filter to limit the maximal
- number of incoming connections per client. Otherwise a
- malicious user could intentionally create a high number of
- connections to prevent other users from using <span class=
- "APPLICATION">Privoxy</span>.
- </p>
- <p>
- Obviously using this option only makes sense if you choose
- a limit below the one enforced by the operating system.
- </p>
- <p>
- One most POSIX-compliant systems <span class=
- "APPLICATION">Privoxy</span> can't properly deal with more
- than FD_SETSIZE file descriptors at the same time and has
- to reject connections if the limit is reached. This will
- likely change in a future version, but currently this limit
- can't be increased without recompiling <span class=
- "APPLICATION">Privoxy</span> with a different FD_SETSIZE
- limit.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- max-client-connections 256
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="HANDLE-AS-EMPTY-DOC-RETURNS-OK">7.6.10.
- handle-as-empty-doc-returns-ok</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The status code Privoxy returns for pages blocked with <tt
- class="LITERAL"><a href=
- "actions-file.html#HANDLE-AS-EMPTY-DOCUMENT" target=
- "_top">+handle-as-empty-document</a></tt>.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Privoxy returns a status 403(forbidden) for all blocked
- pages.
- </p>
- </dd>
- <dt>
- Effect if set:
- </dt>
- <dd>
- <p>
- Privoxy returns a status 200(OK) for pages blocked with
- +handle-as-empty-document and a status 403(Forbidden) for
- all other blocked pages.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- This directive was added as a work-around for Firefox bug
- 492459: <span class="QUOTE">"Websites are no longer
- rendered if SSL requests for JavaScripts are blocked by a
- proxy."</span> (<a href=
- "https://bugzilla.mozilla.org/show_bug.cgi?id=492459"
- target=
- "_top">https://bugzilla.mozilla.org/show_bug.cgi?id=492459</a>),
- the bug has been fixed for quite some time, but this
- directive is also useful to make it harder for websites to
- detect whether or not resources are being blocked.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="ENABLE-COMPRESSION">7.6.11. enable-compression</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not buffered content is compressed before
- delivery.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or 1</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Effect if unset:
- </dt>
- <dd>
- <p>
- Privoxy does not compress buffered content.
- </p>
- </dd>
- <dt>
- Effect if set:
- </dt>
- <dd>
- <p>
- Privoxy compresses buffered content before delivering it to
- the client, provided the client supports it.
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- This directive is only supported if Privoxy has been
- compiled with FEATURE_COMPRESSION, which should not to be
- confused with FEATURE_ZLIB.
- </p>
- <p>
- Compressing buffered content is mainly useful if Privoxy
- and the client are running on different systems. If they
- are running on the same system, enabling compression is
- likely to slow things down. If you didn't measure
- otherwise, you should assume that it does and keep this
- option disabled.
- </p>
- <p>
- Privoxy will not compress buffered content below a certain
- length.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="COMPRESSION-LEVEL">7.6.12. compression-level</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The compression level that is passed to the zlib library
- when compressing buffered content.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Positive number ranging from 0
- to 9.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 1
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- Compressing the data more takes usually longer than
- compressing it less or not compressing it at all. Which
- level is best depends on the connection between Privoxy and
- the client. If you can't be bothered to benchmark it for
- yourself, you should stick with the default and keep
- compression disabled.
- </p>
- <p>
- If compression is disabled, the compression level is
- irrelevant.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- # Best speed (compared to the other levels)
+ never_direct allow all</PRE
+></TD
+></TR
+></TABLE
+><P
+> You would then need to change your browser's proxy settings to <SPAN
+CLASS="APPLICATION"
+>squid</SPAN
+>'s address and port.
+ Squid normally uses port 3128. If unsure consult <TT
+CLASS="LITERAL"
+>http_port</TT
+> in <TT
+CLASS="FILENAME"
+>squid.conf</TT
+>.</P
+><P
+> You could just as well decide to only forward requests you suspect
+ of leading to Windows executables through a virus-scanning parent proxy,
+ say, on <TT
+CLASS="LITERAL"
+>antivir.example.com</TT
+>, port 8010:</P
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="100%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> forward / .
+ forward /.*\.(exe|com|dll|zip)$ antivir.example.com:8010</PRE
+></TD
+></TR
+></TABLE
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="FORWARDED-CONNECT-RETRIES"
+>7.5.4. forwarded-connect-retries</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> How often Privoxy retries if a forwarded connection request fails.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Number of retries.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections forwarded through other proxies are treated like direct connections and no retry attempts are made.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>forwarded-connect-retries</I
+></TT
+> is mainly interesting
+ for socks4a connections, where <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can't detect why the connections failed.
+ The connection might have failed because of a DNS timeout in which case a retry makes sense,
+ but it might also have failed because the server doesn't exist or isn't reachable. In this
+ case the retry will just delay the appearance of Privoxy's error message.
+ </P
+><P
+> Note that in the context of this option, <SPAN
+CLASS="QUOTE"
+>"forwarded connections"</SPAN
+> includes all connections
+ that Privoxy forwards through other proxies. This option is not limited to the HTTP CONNECT method.
+ </P
+><P
+> Only use this option, if you are getting lots of forwarding-related error messages
+ that go away when you try again manually. Start with a small value and check Privoxy's
+ logfile from time to time, to see how many retries are usually needed.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> forwarded-connect-retries 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="MISC"
+>7.6. Miscellaneous</A
+></H2
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ACCEPT-INTERCEPTED-REQUESTS"
+>7.6.1. accept-intercepted-requests</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether intercepted requests should be treated as valid.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Only proxy requests are accepted, intercepted requests are treated as invalid.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> If you don't trust your clients and want to force them
+ to use <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>, enable this
+ option and configure your packet filter to redirect outgoing
+ HTTP connections into <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>.
+ </P
+><P
+> Note that intercepting encrypted connections (HTTPS) isn't supported.
+ </P
+><P
+> Make sure that <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> own requests
+ aren't redirected as well. Additionally take care that
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can't intentionally connect
+ to itself, otherwise you could run into redirection loops if
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> listening port is reachable
+ by the outside or an attacker has access to the pages you visit.
+ </P
+><P
+> If you are running Privoxy as intercepting proxy without being
+ able to intercept all client requests you may want to adjust
+ the CGI templates to make sure they don't reference content from
+ config.privoxy.org.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> accept-intercepted-requests 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ALLOW-CGI-REQUEST-CRUNCHING"
+>7.6.2. allow-cgi-request-crunching</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether requests to <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> CGI pages can be blocked or redirected.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> ignores block and redirect actions for its CGI pages.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> By default <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> ignores block or redirect actions
+ for its CGI pages. Intercepting these requests can be useful in multi-user
+ setups to implement fine-grained access control, but it can also render the complete
+ web interface useless and make debugging problems painful if done without care.
+ </P
+><P
+> Don't enable this option unless you're sure that you really need it.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> allow-cgi-request-crunching 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="SPLIT-LARGE-FORMS"
+>7.6.3. split-large-forms</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether the CGI interface should stay compatible with broken HTTP clients.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+><SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>0</I
+></SPAN
+></P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> The CGI form generate long GET URLs.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> CGI forms can lead to
+ rather long URLs. This isn't a problem as far as the HTTP
+ standard is concerned, but it can confuse clients with arbitrary
+ URL length limitations.
+ </P
+><P
+> Enabling split-large-forms causes <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ to divide big forms into smaller ones to keep the URL length down.
+ It makes editing a lot less convenient and you can no longer
+ submit all changes at once, but at least it works around this
+ browser bug.
+ </P
+><P
+> If you don't notice any editing problems, there is no reason
+ to enable this option, but if one of the submit buttons appears
+ to be broken, you should give it a try.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> split-large-forms 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="KEEP-ALIVE-TIMEOUT"
+>7.6.4. keep-alive-timeout</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Number of seconds after which an open connection will no longer be reused.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections are not kept alive.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This option allows clients to keep the connection to <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ alive. If the server supports it, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will keep
+ the connection to the server alive as well. Under certain
+ circumstances this may result in speed-ups.
+ </P
+><P
+> By default, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will close the connection to the server if
+ the client connection gets closed, or if the specified timeout
+ has been reached without a new request coming in. This behaviour
+ can be changed with the <A
+HREF="#CONNECTION-SHARING"
+TARGET="_top"
+>connection-sharing</A
+> option.
+ </P
+><P
+> This option has no effect if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ has been compiled without keep-alive support.
+ </P
+><P
+> Note that a timeout of five seconds as used in the default
+ configuration file significantly decreases the number of
+ connections that will be reused. The value is used because
+ some browsers limit the number of connections they open to
+ a single host and apply the same limit to proxies. This can
+ result in a single website <SPAN
+CLASS="QUOTE"
+>"grabbing"</SPAN
+> all the
+ connections the browser allows, which means connections to
+ other websites can't be opened until the connections currently
+ in use time out.
+ </P
+><P
+> Several users have reported this as a Privoxy bug, so the
+ default value has been reduced. Consider increasing it to
+ 300 seconds or even more if you think your browser can handle
+ it. If your browser appears to be hanging, it probably can't.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> keep-alive-timeout 300
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TOLERATE-PIPELINING"
+>7.6.5. tolerate-pipelining</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not pipelined requests should be served.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> If Privoxy receives more than one request at once, it terminates the
+ client connection after serving the first one.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> currently doesn't pipeline outgoing requests,
+ thus allowing pipelining on the client connection is not
+ guaranteed to improve the performance.
+ </P
+><P
+> By default <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> tries to discourage clients from pipelining
+ by discarding aggressively pipelined requests, which forces the
+ client to resend them through a new connection.
+ </P
+><P
+> This option lets <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> tolerate pipelining. Whether or not
+ that improves performance mainly depends on the client configuration.
+ </P
+><P
+> If you are seeing problems with pages not properly loading,
+ disabling this option could work around the problem.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> tolerate-pipelining 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="DEFAULT-SERVER-TIMEOUT"
+>7.6.6. default-server-timeout</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Assumed server-side keep-alive timeout if not specified by the server.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections for which the server didn't specify the keep-alive
+ timeout are not reused.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Enabling this option significantly increases the number of connections
+ that are reused, provided the <A
+HREF="#KEEP-ALIVE-TIMEOUT"
+TARGET="_top"
+>keep-alive-timeout</A
+> option
+ is also enabled.
+ </P
+><P
+> While it also increases the number of connections problems
+ when <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> tries to reuse a connection that already has
+ been closed on the server side, or is closed while <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ is trying to reuse it, this should only be a problem if it
+ happens for the first request sent by the client. If it happens
+ for requests on reused client connections, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will simply
+ close the connection and the client is supposed to retry the
+ request without bothering the user.
+ </P
+><P
+> Enabling this option is therefore only recommended if the
+ <A
+HREF="#CONNECTION-SHARING"
+TARGET="_top"
+>connection-sharing</A
+> option
+ is disabled.
+ </P
+><P
+> It is an error to specify a value larger than the <A
+HREF="#KEEP-ALIVE-TIMEOUT"
+TARGET="_top"
+>keep-alive-timeout</A
+> value.
+ </P
+><P
+> This option has no effect if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ has been compiled without keep-alive support.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> default-server-timeout 60
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="CONNECTION-SHARING"
+>7.6.7. connection-sharing</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not outgoing connections that have been kept alive
+ should be shared between different incoming connections.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections are not shared.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This option has no effect if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ has been compiled without keep-alive support, or if it's disabled.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Note that reusing connections doesn't necessary cause speedups.
+ There are also a few privacy implications you should be aware of.
+ </P
+><P
+> If this option is effective, outgoing connections are shared between
+ clients (if there are more than one) and closing the browser that initiated
+ the outgoing connection does no longer affect the connection between <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>
+ and the server unless the client's request hasn't been completed yet.
+ </P
+><P
+> If the outgoing connection is idle, it will not be closed until either
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy's</SPAN
+> or the server's timeout is reached.
+ While it's open, the server knows that the system running <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> is still
+ there.
+ </P
+><P
+> If there are more than one client (maybe even belonging to multiple users),
+ they will be able to reuse each others connections. This is potentially
+ dangerous in case of authentication schemes like NTLM where only the
+ connection is authenticated, instead of requiring authentication for
+ each request.
+ </P
+><P
+> If there is only a single client, and if said client can keep connections
+ alive on its own, enabling this option has next to no effect. If the client
+ doesn't support connection keep-alive, enabling this option may make sense
+ as it allows <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> to keep outgoing connections alive even if the client
+ itself doesn't support it.
+ </P
+><P
+> You should also be aware that enabling this option increases the likelihood
+ of getting the "No server or forwarder data" error message, especially if you
+ are using a slow connection to the Internet.
+ </P
+><P
+> This option should only be used by experienced users who
+ understand the risks and can weight them against the benefits.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> connection-sharing 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="SOCKET-TIMEOUT"
+>7.6.8. socket-timeout</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Number of seconds after which a socket times out if
+ no data is received.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> A default value of 300 seconds is used.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> The default is quite high and you probably want to reduce it.
+ If you aren't using an occasionally slow proxy like Tor, reducing
+ it to a few seconds should be fine.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> socket-timeout 300
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="MAX-CLIENT-CONNECTIONS"
+>7.6.9. max-client-connections</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Maximum number of client connections that will be served.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Positive number.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>128</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Connections are served until a resource limit is reached.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> creates one thread (or process) for every incoming client
+ connection that isn't rejected based on the access control settings.
+ </P
+><P
+> If the system is powerful enough, <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can theoretically deal with
+ several hundred (or thousand) connections at the same time, but some
+ operating systems enforce resource limits by shutting down offending
+ processes and their default limits may be below the ones <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> would
+ require under heavy load.
+ </P
+><P
+> Configuring <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> to enforce a connection limit below the thread
+ or process limit used by the operating system makes sure this doesn't
+ happen. Simply increasing the operating system's limit would work too,
+ but if <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> isn't the only application running on the system,
+ you may actually want to limit the resources used by <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>.
+ </P
+><P
+> If <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> is only used by a single trusted user, limiting the
+ number of client connections is probably unnecessary. If there
+ are multiple possibly untrusted users you probably still want to
+ additionally use a packet filter to limit the maximal number of
+ incoming connections per client. Otherwise a malicious user could
+ intentionally create a high number of connections to prevent other
+ users from using <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>.
+ </P
+><P
+> Obviously using this option only makes sense if you choose a limit
+ below the one enforced by the operating system.
+ </P
+><P
+> One most POSIX-compliant systems <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> can't properly deal with
+ more than FD_SETSIZE file descriptors at the same time and has to reject
+ connections if the limit is reached. This will likely change in a
+ future version, but currently this limit can't be increased without
+ recompiling <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> with a different FD_SETSIZE limit.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> max-client-connections 256
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="LISTEN-BACKLOG"
+>7.6.10. listen-backlog</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Connection queue length requested from the operating system.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Number.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>128</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> A connection queue length of 128 is requested from the operating system.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Under high load incoming connection may queue up before Privoxy
+ gets around to serve them. The queue length is limitted by the
+ operating system. Once the queue is full, additional connections
+ are dropped before Privoxy can accept and serve them.
+ </P
+><P
+> Increasing the queue length allows Privoxy to accept more
+ incomming connections that arrive roughly at the same time.
+ </P
+><P
+> Note that Privoxy can only request a certain queue length,
+ whether or not the requested length is actually used depends
+ on the operating system which may use a different length instead.
+ </P
+><P
+> On many operating systems a limit of -1 can be specified to
+ instruct the operating system to use the maximum queue length
+ allowed. Check the listen man page to see if your platform allows this.
+ </P
+><P
+> On some platforms you can use "netstat -Lan -p tcp" to see the effective
+ queue length.
+ </P
+><P
+> Effectively using a value above 128 usually requires changing
+ the system configuration as well. On FreeBSD-based system the
+ limit is controlled by the kern.ipc.soacceptqueue sysctl.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> listen-backlog 4096
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENABLE-ACCEPT-FILTER"
+>7.6.11. enable-accept-filter</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not Privoxy should use an accept filter
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> No accept filter is enabled.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Accept filters reduce the number of context switches by not
+ passing sockets for new connections to Privoxy until a complete
+ HTTP request is available.
+ </P
+><P
+> As a result, Privoxy can process the whole request right away
+ without having to wait for additional data first.
+ </P
+><P
+> For this option to work, Privoxy has to be compiled with
+ FEATURE_ACCEPT_FILTER and the operating system has to support
+ it (which may require loading a kernel module).
+ </P
+><P
+> Currently accept filters are only supported on FreeBSD-based
+ systems. Check the
+ <A
+HREF="https://www.freebsd.org/cgi/man.cgi?query=accf_http"
+TARGET="_top"
+>accf_http(9)
+ man page</A
+>
+ to learn how to enable the support in the operating system.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><P
+> enable-accept-filter 1
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="HANDLE-AS-EMPTY-DOC-RETURNS-OK"
+>7.6.12. handle-as-empty-doc-returns-ok</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The status code Privoxy returns for pages blocked with
+
+ <TT
+CLASS="LITERAL"
+><A
+HREF="actions-file.html#HANDLE-AS-EMPTY-DOCUMENT"
+TARGET="_top"
+>+handle-as-empty-document</A
+></TT
+>.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Privoxy returns a status 403(forbidden) for all blocked pages.
+ </P
+></DD
+><DT
+>Effect if set:</DT
+><DD
+><P
+> Privoxy returns a status 200(OK) for pages blocked with +handle-as-empty-document
+ and a status 403(Forbidden) for all other blocked pages.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This directive was added as a work-around for Firefox bug 492459:
+ <SPAN
+CLASS="QUOTE"
+>"Websites are no longer rendered if SSL requests for JavaScripts are blocked by a proxy."</SPAN
+>
+ (<A
+HREF="https://bugzilla.mozilla.org/show_bug.cgi?id=492459"
+TARGET="_top"
+> https://bugzilla.mozilla.org/show_bug.cgi?id=492459</A
+>),
+ the bug has been fixed for quite some time, but this directive is also useful
+ to make it harder for websites to detect whether or not resources are being
+ blocked.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="ENABLE-COMPRESSION"
+>7.6.13. enable-compression</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not buffered content is compressed before delivery.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or 1</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Effect if unset:</DT
+><DD
+><P
+> Privoxy does not compress buffered content.
+ </P
+></DD
+><DT
+>Effect if set:</DT
+><DD
+><P
+> Privoxy compresses buffered content before delivering it to the client,
+ provided the client supports it.
+ </P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> This directive is only supported if Privoxy has been compiled with
+ FEATURE_COMPRESSION, which should not to be confused with FEATURE_ZLIB.
+ </P
+><P
+> Compressing buffered content is mainly useful if Privoxy and the
+ client are running on different systems. If they are running on the
+ same system, enabling compression is likely to slow things down.
+ If you didn't measure otherwise, you should assume that it does
+ and keep this option disabled.
+ </P
+><P
+> Privoxy will not compress buffered content below a certain length.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="COMPRESSION-LEVEL"
+>7.6.14. compression-level</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The compression level that is passed to the zlib library when compressing buffered content.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Positive number ranging from 0 to 9.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>1</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Compressing the data more takes usually longer than compressing
+ it less or not compressing it at all. Which level is best depends
+ on the connection between Privoxy and the client. If you can't
+ be bothered to benchmark it for yourself, you should stick with
+ the default and keep compression disabled.
+ </P
+><P
+> If compression is disabled, the compression level is irrelevant.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Best speed (compared to the other levels)
compression-level 1
+
# Best compression
compression-level 9
+
# No compression. Only useful for testing as the added header
# slightly increases the amount of data that has to be sent.
# If your benchmark shows that using this compression level
# is superior to using no compression at all, the benchmark
# is likely to be flawed.
- compression-level 0
-
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="CLIENT-HEADER-ORDER">7.6.13. client-header-order</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The order in which client headers are sorted before
- forwarding them.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Client header names delimited by
- spaces or tabs</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <p>
- By default <span class="APPLICATION">Privoxy</span> leaves
- the client headers in the order they were sent by the
- client. Headers are modified in-place, new headers are
- added at the end of the already existing headers.
- </p>
- <p>
- The header order can be used to fingerprint client requests
- independently of other headers like the User-Agent.
- </p>
- <p>
- This directive allows to sort the headers differently to
- better mimic a different User-Agent. Client headers will be
- emitted in the order given, headers whose name isn't
- explicitly specified are added at the end.
- </p>
- <p>
- Note that sorting headers in an uncommon way will make
- fingerprinting actually easier. Encrypted headers are not
- affected by this directive.
- </p>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="CLIENT-SPECIFIC-TAG">7.6.14. client-specific-tag</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- The name of a tag that will always be set for clients that
- requested it through the webinterface.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Tag name followed by a
- description that will be shown in the webinterface</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- None
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <div class="WARNING">
- <table class="WARNING" border="1" width="90%">
- <tr>
- <td align="CENTER">
- <b>Warning</b>
- </td>
- </tr>
- <tr>
- <td align="LEFT">
- <p>
- This is an experimental feature. The syntax is
- likely to change in future versions.
- </p>
- </td>
- </tr>
- </table>
- </div>
- <p>
- Client-specific tags allow Privoxy admins to create
- different profiles and let the users chose which one they
- want without impacting other users.
- </p>
- <p>
- One use case is allowing users to circumvent certain blocks
- without having to allow them to circumvent all blocks. This
- is not possible with the <a href=
- "config.html#ENABLE-REMOTE-TOGGLE">enable-remote-toggle
- feature</a> because it would bluntly disable all blocks for
- all users and also affect other actions like filters. It
- also is set globally which renders it useless in most
- multi-user setups.
- </p>
- <p>
- After a client-specific tag has been defined with the
- client-specific-tag directive, action sections can be
- activated based on the tag by using a <a href=
- "actions-file.html#CLIENT-TAG-PATTERN" target=
- "_top">CLIENT-TAG</a> pattern. The CLIENT-TAG pattern is
- evaluated at the same priority as URL patterns, as a result
- the last matching pattern wins. Tags that are created based
- on client or server headers are evaluated later on and can
- overrule CLIENT-TAG and URL patterns!
- </p>
- <p>
- The tag is set for all requests that come from clients that
- requested it to be set. Note that "clients" are
- differentiated by IP address, if the IP address changes the
- tag has to be requested again.
- </p>
- <p>
- Clients can request tags to be set by using the CGI
- interface <a href="http://config.privoxy.org/client-tags"
- target="_top">http://config.privoxy.org/client-tags</a>.
- The specific tag description is only used on the web page
- and should be phrased in away that the user understand the
- effect of the tag.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- # Define a couple of tags, the described effect requires action sections
+ compression-level 0</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="CLIENT-HEADER-ORDER"
+>7.6.15. client-header-order</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The order in which client headers are sorted before forwarding them.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Client header names delimited by spaces or tabs</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> By default <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> leaves the client headers in the order they
+ were sent by the client. Headers are modified in-place, new headers
+ are added at the end of the already existing headers.
+ </P
+><P
+> The header order can be used to fingerprint client requests
+ independently of other headers like the User-Agent.
+ </P
+><P
+> This directive allows to sort the headers differently to better
+ mimic a different User-Agent. Client headers will be emitted
+ in the order given, headers whose name isn't explicitly specified
+ are added at the end.
+ </P
+><P
+> Note that sorting headers in an uncommon way will make fingerprinting
+ actually easier. Encrypted headers are not affected by this directive.
+ </P
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="CLIENT-SPECIFIC-TAG"
+>7.6.16. client-specific-tag</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The name of a tag that will always be set for clients that
+ requested it through the webinterface.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Tag name followed by a description that will be shown in the webinterface</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>None</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><DIV
+CLASS="WARNING"
+><P
+></P
+><TABLE
+CLASS="WARNING"
+BORDER="1"
+WIDTH="90%"
+><TR
+><TD
+ALIGN="CENTER"
+><B
+>Warning</B
+></TD
+></TR
+><TR
+><TD
+ALIGN="LEFT"
+><P
+> This is an experimental feature. The syntax is likely to change
+ in future versions.
+ </P
+></TD
+></TR
+></TABLE
+></DIV
+><P
+> Client-specific tags allow Privoxy admins to create different
+ profiles and let the users chose which one they want without
+ impacting other users.
+ </P
+><P
+> One use case is allowing users to circumvent certain blocks
+ without having to allow them to circumvent all blocks.
+ This is not possible with the
+ <A
+HREF="config.html#ENABLE-REMOTE-TOGGLE"
+>enable-remote-toggle feature</A
+>
+ because it would bluntly disable all blocks for all users and also affect
+ other actions like filters.
+ It also is set globally which renders it useless in most multi-user setups.
+ </P
+><P
+> After a client-specific tag has been defined with the client-specific-tag
+ directive, action sections can be activated based on the tag by using a
+ <A
+HREF="actions-file.html#CLIENT-TAG-PATTERN"
+TARGET="_top"
+>CLIENT-TAG</A
+> pattern.
+ The CLIENT-TAG pattern is evaluated at the same priority
+ as URL patterns, as a result the last matching pattern wins.
+ Tags that are created based on client or server headers are evaluated
+ later on and can overrule CLIENT-TAG and URL patterns!
+ </P
+><P
+> The tag is set for all requests that come from clients that requested
+ it to be set.
+ Note that "clients" are differentiated by IP address,
+ if the IP address changes the tag has to be requested again.
+ </P
+><P
+> Clients can request tags to be set by using the CGI interface <A
+HREF="http://config.privoxy.org/client-tags"
+TARGET="_top"
+>http://config.privoxy.org/client-tags</A
+>.
+ The specific tag description is only used on the web page and should
+ be phrased in away that the user understand the effect of the tag.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Define a couple of tags, the described effect requires action sections
# that are enabled based on CLIENT-TAG patterns.
client-specific-tag circumvent-blocks Overrule blocks but do not affect other actions
- disable-content-filters Disable content-filters but do not affect other actions
-
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="CLIENT-TAG-LIFETIME">7.6.15. client-tag-lifetime</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- How long a temporarily enabled tag remains enabled.
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>Time in seconds.</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 60
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <div class="WARNING">
- <table class="WARNING" border="1" width="90%">
- <tr>
- <td align="CENTER">
- <b>Warning</b>
- </td>
- </tr>
- <tr>
- <td align="LEFT">
- <p>
- This is an experimental feature. The syntax is
- likely to change in future versions.
- </p>
- </td>
- </tr>
- </table>
- </div>
- <p>
- In case of some tags users may not want to enable them
- permanently, but only for a short amount of time, for
- example to circumvent a block that is the result of an
- overly-broad URL pattern.
- </p>
- <p>
- The CGI interface <a href=
- "http://config.privoxy.org/client-tags" target=
- "_top">http://config.privoxy.org/client-tags</a> therefore
- provides a "enable this tag temporarily" option. If it is
- used, the tag will be set until the client-tag-lifetime is
- over.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- # Increase the time to life for temporarily enabled tags to 3 minutes
- client-tag-lifetime 180
-
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- <div class="SECT3">
- <h4 class="SECT3">
- <a name="TRUST-X-FORWARDED-FOR">7.6.16. trust-x-forwarded-for</a>
- </h4>
- <div class="VARIABLELIST">
- <dl>
- <dt>
- Specifies:
- </dt>
- <dd>
- <p>
- Whether or not Privoxy should use IP addresses specified
- with the X-Forwarded-For header
- </p>
- </dd>
- <dt>
- Type of value:
- </dt>
- <dd>
- <p>
- <tt class="REPLACEABLE"><i>0 or one</i></tt>
- </p>
- </dd>
- <dt>
- Default value:
- </dt>
- <dd>
- <p>
- 0
- </p>
- </dd>
- <dt>
- Notes:
- </dt>
- <dd>
- <div class="WARNING">
- <table class="WARNING" border="1" width="90%">
- <tr>
- <td align="CENTER">
- <b>Warning</b>
- </td>
- </tr>
- <tr>
- <td align="LEFT">
- <p>
- This is an experimental feature. The syntax is
- likely to change in future versions.
- </p>
- </td>
- </tr>
- </table>
- </div>
- <p>
- If clients reach Privoxy through another proxy, for example
- a load balancer, Privoxy can't tell the client's IP address
- from the connection. If multiple clients use the same
- proxy, they will share the same client tag settings which
- is usually not desired.
- </p>
- <p>
- This option lets Privoxy use the X-Forwarded-For header
- value as client IP address. If the proxy sets the header,
- multiple clients using the same proxy do not share the same
- client tag settings.
- </p>
- <p>
- This option should only be enabled if Privoxy can only be
- reached through a proxy and if the proxy can be trusted to
- set the header correctly. It is recommended that ACL are
- used to make sure only trusted systems can reach Privoxy.
- </p>
- <p>
- If access to Privoxy isn't limited to trusted systems, this
- option would allow malicious clients to change the client
- tags for other clients or increase Privoxy's memory
- requirements by registering lots of client tag settings for
- clients that don't exist.
- </p>
- </dd>
- <dt>
- Examples:
- </dt>
- <dd>
- <p>
- </p>
- <table border="0" bgcolor="#E0E0E0" width="90%">
- <tr>
- <td>
-<pre class="SCREEN">
- # Allow systems that can reach Privoxy to provide the client
+ disable-content-filters Disable content-filters but do not affect other actions</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="CLIENT-TAG-LIFETIME"
+>7.6.17. client-tag-lifetime</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> How long a temporarily enabled tag remains enabled.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Time in seconds.</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>60</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><DIV
+CLASS="WARNING"
+><P
+></P
+><TABLE
+CLASS="WARNING"
+BORDER="1"
+WIDTH="90%"
+><TR
+><TD
+ALIGN="CENTER"
+><B
+>Warning</B
+></TD
+></TR
+><TR
+><TD
+ALIGN="LEFT"
+><P
+> This is an experimental feature. The syntax is likely to change
+ in future versions.
+ </P
+></TD
+></TR
+></TABLE
+></DIV
+><P
+> In case of some tags users may not want to enable them permanently,
+ but only for a short amount of time, for example to circumvent a block
+ that is the result of an overly-broad URL pattern.
+ </P
+><P
+> The CGI interface <A
+HREF="http://config.privoxy.org/client-tags"
+TARGET="_top"
+>http://config.privoxy.org/client-tags</A
+>
+ therefore provides a "enable this tag temporarily" option.
+ If it is used, the tag will be set until the client-tag-lifetime
+ is over.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Increase the time to life for temporarily enabled tags to 3 minutes
+ client-tag-lifetime 180</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="TRUST-X-FORWARDED-FOR"
+>7.6.18. trust-x-forwarded-for</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> Whether or not Privoxy should use IP addresses specified with the X-Forwarded-For header
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>0 or one</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>0</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><DIV
+CLASS="WARNING"
+><P
+></P
+><TABLE
+CLASS="WARNING"
+BORDER="1"
+WIDTH="90%"
+><TR
+><TD
+ALIGN="CENTER"
+><B
+>Warning</B
+></TD
+></TR
+><TR
+><TD
+ALIGN="LEFT"
+><P
+> This is an experimental feature. The syntax is likely to change
+ in future versions.
+ </P
+></TD
+></TR
+></TABLE
+></DIV
+><P
+> If clients reach Privoxy through another proxy, for example a load
+ balancer, Privoxy can't tell the client's IP address from the connection.
+ If multiple clients use the same proxy, they will share the same
+ client tag settings which is usually not desired.
+ </P
+><P
+> This option lets Privoxy use the X-Forwarded-For header value as
+ client IP address. If the proxy sets the header, multiple clients
+ using the same proxy do not share the same client tag settings.
+ </P
+><P
+> This option should only be enabled if Privoxy can only be reached
+ through a proxy and if the proxy can be trusted to set the header
+ correctly. It is recommended that ACL are used to make sure only
+ trusted systems can reach Privoxy.
+ </P
+><P
+> If access to Privoxy isn't limited to trusted systems, this option
+ would allow malicious clients to change the client tags for other
+ clients or increase Privoxy's memory requirements by registering
+ lots of client tag settings for clients that don't exist.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Allow systems that can reach Privoxy to provide the client
# IP address with a X-Forwarded-For header.
- trust-x-forwarded-for 1
-
-</pre>
- </td>
- </tr>
- </table>
- </dd>
- </dl>
- </div>
- </div>
- </div>
- <div class="SECT2">
- <h2 class="SECT2">
- <a name="WINDOWS-GUI">7.7. Windows GUI Options</a>
- </h2>
- <p>
- <span class="APPLICATION">Privoxy</span> has a number of options
- specific to the Windows GUI interface:
- </p>
- <a name="ACTIVITY-ANIMATION"></a>
- <p>
- If <span class="QUOTE">"activity-animation"</span> is set to 1, the
- <span class="APPLICATION">Privoxy</span> icon will animate when
- <span class="QUOTE">"Privoxy"</span> is active. To turn off, set to
- 0.
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">activity-animation 1</i></span><br>
- </tt>
- </p>
- <a name="LOG-MESSAGES"></a>
- <p>
- If <span class="QUOTE">"log-messages"</span> is set to 1, <span
- class="APPLICATION">Privoxy</span> copies log messages to the
- console window. The log detail depends on the <a href=
- "config.html#DEBUG">debug</a> directive.
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">log-messages 1</i></span><br>
- </tt>
- </p>
- <a name="LOG-BUFFER-SIZE"></a>
- <p>
- If <span class="QUOTE">"log-buffer-size"</span> is set to 1, the
- size of the log buffer, i.e. the amount of memory used for the log
- messages displayed in the console window, will be limited to <span
- class="QUOTE">"log-max-lines"</span> (see below).
- </p>
- <p>
- Warning: Setting this to 0 will result in the buffer to grow
- infinitely and eat up all your memory!
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">log-buffer-size 1</i></span><br>
- </tt>
- </p>
- <a name="LOG-MAX-LINES"></a>
- <p>
- <span class="APPLICATION">log-max-lines</span> is the maximum
- number of lines held in the log buffer. See above.
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">log-max-lines 200</i></span><br>
- </tt>
- </p>
- <a name="LOG-HIGHLIGHT-MESSAGES"></a>
- <p>
- If <span class="QUOTE">"log-highlight-messages"</span> is set to 1,
- <span class="APPLICATION">Privoxy</span> will highlight portions of
- the log messages with a bold-faced font:
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">log-highlight-messages 1</i></span><br>
- </tt>
- </p>
- <a name="LOG-FONT-NAME"></a>
- <p>
- The font used in the console window:
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">log-font-name Comic Sans MS</i></span><br>
- </tt>
- </p>
- <a name="LOG-FONT-SIZE"></a>
- <p>
- Font size used in the console window:
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">log-font-size 8</i></span><br>
- </tt>
- </p>
- <a name="SHOW-ON-TASK-BAR"></a>
- <p>
- <span class="QUOTE">"show-on-task-bar"</span> controls whether or
- not <span class="APPLICATION">Privoxy</span> will appear as a
- button on the Task bar when minimized:
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">show-on-task-bar 0</i></span><br>
- </tt>
- </p>
- <a name="CLOSE-BUTTON-MINIMIZES"></a>
- <p>
- If <span class="QUOTE">"close-button-minimizes"</span> is set to 1,
- the Windows close button will minimize <span class=
- "APPLICATION">Privoxy</span> instead of closing the program (close
- with the exit option on the File menu).
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> <span class="emphasis"><i class=
- "EMPHASIS">close-button-minimizes 1</i></span><br>
- </tt>
- </p>
- <a name="HIDE-CONSOLE"></a>
- <p>
- The <span class="QUOTE">"hide-console"</span> option is specific to
- the MS-Win console version of <span class=
- "APPLICATION">Privoxy</span>. If this option is used, <span class=
- "APPLICATION">Privoxy</span> will disconnect from and hide the
- command console.
- </p>
- <p>
- </p>
- <p class="LITERALLAYOUT">
- <tt class="LITERAL"> #<span class="emphasis"><i class=
- "EMPHASIS">hide-console</i></span><br>
- </tt>
- </p>
- </div>
- </div>
- <div class="NAVFOOTER">
- <hr align="LEFT" width="100%">
- <table summary="Footer navigation table" width="100%" border="0"
- cellpadding="0" cellspacing="0">
- <tr>
- <td width="33%" align="left" valign="top">
- <a href="configuration.html" accesskey="P">Prev</a>
- </td>
- <td width="34%" align="center" valign="top">
- <a href="index.html" accesskey="H">Home</a>
- </td>
- <td width="33%" align="right" valign="top">
- <a href="actions-file.html" accesskey="N">Next</a>
- </td>
- </tr>
- <tr>
- <td width="33%" align="left" valign="top">
- Privoxy Configuration
- </td>
- <td width="34%" align="center" valign="top">
-
- </td>
- <td width="33%" align="right" valign="top">
- Actions Files
- </td>
- </tr>
- </table>
- </div>
- </body>
-</html>
-
+ trust-x-forwarded-for 1</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+><DIV
+CLASS="SECT3"
+><H4
+CLASS="SECT3"
+><A
+NAME="RECEIVE-BUFFER-SIZE"
+>7.6.19. receive-buffer-size</A
+></H4
+><P
+></P
+><DIV
+CLASS="VARIABLELIST"
+><DL
+><DT
+>Specifies:</DT
+><DD
+><P
+> The size of the buffer Privoxy uses to receive data from the server.
+ </P
+></DD
+><DT
+>Type of value:</DT
+><DD
+><P
+> <TT
+CLASS="REPLACEABLE"
+><I
+>Size in bytes</I
+></TT
+>
+ </P
+></DD
+><DT
+>Default value:</DT
+><DD
+><P
+>5000</P
+></DD
+><DT
+>Notes:</DT
+><DD
+><P
+> Increasing the receive-buffer-size increases Privoxy's memory usage but
+ can lower the number of context switches and thereby reduce the
+ cpu usage and potentially increase the throughput.
+ </P
+><P
+> This is mostly relevant for fast network connections and
+ large downloads that don't require filtering.
+ </P
+><P
+> Reducing the buffer size reduces the amount of memory Privoxy
+ needs to handle the request but increases the number of systemcalls
+ and may reduce the throughput.
+ </P
+><P
+> A dtrace command like:
+ <SPAN
+CLASS="QUOTE"
+>"sudo dtrace -n 'syscall::read:return /execname == "privoxy"/ { @[execname] = llquantize(arg0, 10, 0, 5, 20); @m = max(arg0)}'"</SPAN
+>
+ can be used to properly tune the receive-buffer-size.
+ On systems without dtrace, strace or truss may be used as
+ less convenient alternatives.
+ </P
+><P
+> If the buffer is too large it will increase Privoxy's memory
+ footprint without any benefit. As the memory is (currently)
+ cleared before using it, a buffer that is too large can
+ actually reduce the throughput.
+ </P
+></DD
+><DT
+>Examples:</DT
+><DD
+><TABLE
+BORDER="0"
+BGCOLOR="#E0E0E0"
+WIDTH="90%"
+><TR
+><TD
+><PRE
+CLASS="SCREEN"
+> # Increase the receive buffer size
+ receive-buffer-size 32768</PRE
+></TD
+></TR
+></TABLE
+></DD
+></DL
+></DIV
+></DIV
+></DIV
+><DIV
+CLASS="SECT2"
+><H2
+CLASS="SECT2"
+><A
+NAME="WINDOWS-GUI"
+>7.7. Windows GUI Options</A
+></H2
+><P
+> <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> has a number of options specific to the
+ Windows GUI interface:</P
+><A
+NAME="ACTIVITY-ANIMATION"
+></A
+><P
+> If <SPAN
+CLASS="QUOTE"
+>"activity-animation"</SPAN
+> is set to 1, the
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> icon will animate when
+ <SPAN
+CLASS="QUOTE"
+>"Privoxy"</SPAN
+> is active. To turn off, set to 0.</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>activity-animation 1</I
+></SPAN
+></P
+><A
+NAME="LOG-MESSAGES"
+></A
+><P
+> If <SPAN
+CLASS="QUOTE"
+>"log-messages"</SPAN
+> is set to 1,
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> copies log messages to the console
+ window.
+ The log detail depends on the <A
+HREF="config.html#DEBUG"
+>debug</A
+> directive.</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>log-messages 1</I
+></SPAN
+></P
+><A
+NAME="LOG-BUFFER-SIZE"
+></A
+><P
+> If <SPAN
+CLASS="QUOTE"
+>"log-buffer-size"</SPAN
+> is set to 1, the size of the log buffer,
+ i.e. the amount of memory used for the log messages displayed in the
+ console window, will be limited to <SPAN
+CLASS="QUOTE"
+>"log-max-lines"</SPAN
+> (see below).</P
+><P
+> Warning: Setting this to 0 will result in the buffer to grow infinitely and
+ eat up all your memory!</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>log-buffer-size 1</I
+></SPAN
+></P
+><A
+NAME="LOG-MAX-LINES"
+></A
+><P
+> <SPAN
+CLASS="APPLICATION"
+>log-max-lines</SPAN
+> is the maximum number of lines held
+ in the log buffer. See above.</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>log-max-lines 200</I
+></SPAN
+></P
+><A
+NAME="LOG-HIGHLIGHT-MESSAGES"
+></A
+><P
+> If <SPAN
+CLASS="QUOTE"
+>"log-highlight-messages"</SPAN
+> is set to 1,
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will highlight portions of the log
+ messages with a bold-faced font:</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>log-highlight-messages 1</I
+></SPAN
+></P
+><A
+NAME="LOG-FONT-NAME"
+></A
+><P
+> The font used in the console window:</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>log-font-name Comic Sans MS</I
+></SPAN
+></P
+><A
+NAME="LOG-FONT-SIZE"
+></A
+><P
+> Font size used in the console window:</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>log-font-size 8</I
+></SPAN
+></P
+><A
+NAME="SHOW-ON-TASK-BAR"
+></A
+><P
+> <SPAN
+CLASS="QUOTE"
+>"show-on-task-bar"</SPAN
+> controls whether or not
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will appear as a button on the Task bar
+ when minimized:</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>show-on-task-bar 0</I
+></SPAN
+></P
+><A
+NAME="CLOSE-BUTTON-MINIMIZES"
+></A
+><P
+> If <SPAN
+CLASS="QUOTE"
+>"close-button-minimizes"</SPAN
+> is set to 1, the Windows close
+ button will minimize <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> instead of closing
+ the program (close with the exit option on the File menu).</P
+><P
+CLASS="LITERALLAYOUT"
+> <SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>close-button-minimizes 1</I
+></SPAN
+></P
+><A
+NAME="HIDE-CONSOLE"
+></A
+><P
+> The <SPAN
+CLASS="QUOTE"
+>"hide-console"</SPAN
+> option is specific to the MS-Win console
+ version of <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+>. If this option is used,
+ <SPAN
+CLASS="APPLICATION"
+>Privoxy</SPAN
+> will disconnect from and hide the
+ command console.</P
+><P
+CLASS="LITERALLAYOUT"
+> #<SPAN
+CLASS="emphasis"
+><I
+CLASS="EMPHASIS"
+>hide-console</I
+></SPAN
+></P
+></DIV
+></DIV
+><DIV
+CLASS="NAVFOOTER"
+><HR
+ALIGN="LEFT"
+WIDTH="100%"><TABLE
+SUMMARY="Footer navigation table"
+WIDTH="100%"
+BORDER="0"
+CELLPADDING="0"
+CELLSPACING="0"
+><TR
+><TD
+WIDTH="33%"
+ALIGN="left"
+VALIGN="top"
+><A
+HREF="configuration.html"
+ACCESSKEY="P"
+>Prev</A
+></TD
+><TD
+WIDTH="34%"
+ALIGN="center"
+VALIGN="top"
+><A
+HREF="index.html"
+ACCESSKEY="H"
+>Home</A
+></TD
+><TD
+WIDTH="33%"
+ALIGN="right"
+VALIGN="top"
+><A
+HREF="actions-file.html"
+ACCESSKEY="N"
+>Next</A
+></TD
+></TR
+><TR
+><TD
+WIDTH="33%"
+ALIGN="left"
+VALIGN="top"
+>Privoxy Configuration</TD
+><TD
+WIDTH="34%"
+ALIGN="center"
+VALIGN="top"
+> </TD
+><TD
+WIDTH="33%"
+ALIGN="right"
+VALIGN="top"
+>Actions Files</TD
+></TR
+></TABLE
+></DIV
+></BODY
+></HTML
+>
\ No newline at end of file
projects / privoxy.git / blobdiff