Privoxy

Support Requests item #1763091, was opened at 2007-07-29 12:23
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1763091&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: blocking
Group: None
>Status: Pending
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: online video streaming

Initial Comment:
privoxy blocks the online video players. Can you please tell me how to change the confugaration so it can play online videos.

regards

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-29 13:39

Message:
Logged In: YES 
user_id=875547
Originator: NO

Not without more information:
http://www.privoxy.org/faq/contact.html#REPORTING

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1763091&group_id=11118

Jim Ide <jimsmaillists@...> wrote:

> 1. I want to block access to any web site that has "game" anywhere
> in the URL.  I have added the following lines to /etc/privoxyuser.action:
>=20
> { +block +handle-as-empty-document }
> .game.
> *game*
> ^*game*$

> None of these are working.  What am I doing wrong?

You are only using domain patterns but need at least one path pattern as we=
ll.

See:
http://www.privoxy.org/user-manual/actions-file.html#AF-PATTERNS
for the details.

Also the third pattern "^*game*$" uses invalid syntax.
Domain patterns are very limited and don't support PCRE
features like anchors.

You should also verify that Privoxy is configured to
read /etc/privoxyuser.action, by default it doesn't.

Additionally blocking those requests with any empty page
isn't very user friendly.

> 2. Is there some way to make privoxy work, even if a user knows that he
> can disable privoxy by tweaking the settings in the Firefox preferences
> dialog?

Privoxy's CVS version can handle intercepted HTTP requests
that contain the host header (about 100% do). If the user's
traffic passes (or is send from) your system, you can use
your operating system's packet filter to intercept the requests
and deliver them trough Privoxy instead.

Privoxy 3.0.6 and earlier don't support intercepted requests,
but of course you can chain them behind another proxy that
does.

Fabian

On Thu, Jul 26, 2007 at 02:30:49PM -0700, Jim Ide wrote:
> Hello -
> 
> I am using Ubuntu Linux.

> 1. I want to block access to any web site that has "game" anywhere
> in the URL.  I have added the following lines to /etc/privoxyuser.action:
> 
> { +block +handle-as-empty-document }
> .game.
> *game*
> ^*game*$
> 
> None of these are working.  What am I doing wrong?

.*game*.
 

The '.' are significant. My example will match any hostname, since its
unanchored on the hostname end. Also, any tld (eg .com, .us) since its
unanchored on that end. And any domain name containing 'game', because
of the '*' on each end. The pattern matching is different for
host/domain/tld than the path path of a URI.

Its best to experiment with http://config.privoxy.org/show-url-info, which
will help quickly show you what works and what doesn't. 

> 2. Is there some way to make privoxy work, even if a user knows that he
> can disable privoxy by tweaking the settings in the Firefox preferences
> dialog?

The version in cvs has this ability. 3.0.6 does not. I am not sure how
well documented it is, but you will need to set up iptables to
redirect outbound http[s] traffic to privoxy. 

-- 
Hal

Support Requests item #1756112, was opened at 2007-07-18 12:51
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: 3.0.x
>Status: Pending
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
>Assigned to: Fabian Keil (fabiankeil)
Summary: Different ports with different configs?

Initial Comment:
I'm using privoxy 3.0.5 and tor 0.1.1.26 under opensuse linux 10.2. Browsing with tor is slow, so I want to use it only for pelicular things. On the other hand I want to use the other privoxy features like adblocking or user-agent-faking in every browsing session. So is there a way to set up privoxy in a way, that it listens to one port and routes it over tor and an other port only for doing its own stuff?
E.g.: Port 1234 goes thru privoxy and tor
Port 1235 goes thru privoxy and then into the net.

Hope it's understandable, what I want to do.

Mail: klei6b05@...

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 18:48

Message:
Logged In: YES 
user_id=875547
Originator: NO

This is currently not possible as Privoxy never
binds to multiple different ports at the same time.

With Privoxy's CVS versions, however, you can
influence the forwarding settings based on tags
and if your browser allows you to modify at least
one header, you can use it to toggle Tor usage.

If you're already using different browsers anyway,
you could simply tag based on the User-Agent.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Support Requests item #1756112, was opened at 2007-07-18 05:51
Message generated for change (Comment added) made by nobody
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: 3.0.x
Status: Pending
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Fabian Keil (fabiankeil)
Summary: Different ports with different configs?

Initial Comment:
I'm using privoxy 3.0.5 and tor 0.1.1.26 under opensuse linux 10.2. Browsing with tor is slow, so I want to use it only for pelicular things. On the other hand I want to use the other privoxy features like adblocking or user-agent-faking in every browsing session. So is there a way to set up privoxy in a way, that it listens to one port and routes it over tor and an other port only for doing its own stuff?
E.g.: Port 1234 goes thru privoxy and tor
Port 1235 goes thru privoxy and then into the net.

Hope it's understandable, what I want to do.

Mail: klei6b05@...

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-07-19 08:43

Message:
Logged In: NO 

Thanks for the help.
Maybe I can do something with virtualization or so....

----------------------------------------------------------------------

Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 11:48

Message:
Logged In: YES 
user_id=875547
Originator: NO

This is currently not possible as Privoxy never
binds to multiple different ports at the same time.

With Privoxy's CVS versions, however, you can
influence the forwarding settings based on tags
and if your browser allows you to modify at least
one header, you can use it to toggle Tor usage.

If you're already using different browsers anyway,
you could simply tag based on the User-Agent.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

SourceForge.net wrote:


> I'm using privoxy 3.0.5 and tor 0.1.1.26 under opensuse linux 10.2. Browsing with tor is slow, so I want to use it only for pelicular things. On the other hand I want to use the other privoxy features like adblocking or user-agent-faking in every browsing session. So is there a way to set up privoxy in a way, that it listens to one port and routes it over tor and an other port only for doing its own stuff?
> E.g.: Port 1234 goes thru privoxy and tor
> Port 1235 goes thru privoxy and then into the net.
> 
> Hope it's understandable, what I want to do.

You can run two instances of privoxy, each with separate config and
listening on different ports.

-- 

-John Thompson (john@...)
 Appleton WI USA

Support Requests item #1756112, was opened at 2007-07-18 12:51
Message generated for change (Comment added) made by icmp30
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: 3.0.x
Status: Open
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Fabian Keil (fabiankeil)
Summary: Different ports with different configs?

Initial Comment:
I'm using privoxy 3.0.5 and tor 0.1.1.26 under opensuse linux 10.2. Browsing with tor is slow, so I want to use it only for pelicular things. On the other hand I want to use the other privoxy features like adblocking or user-agent-faking in every browsing session. So is there a way to set up privoxy in a way, that it listens to one port and routes it over tor and an other port only for doing its own stuff?
E.g.: Port 1234 goes thru privoxy and tor
Port 1235 goes thru privoxy and then into the net.

Hope it's understandable, what I want to do.

Mail: klei6b05@...

----------------------------------------------------------------------

Comment By: icmp30 (icmp30)
Date: 2007-07-23 03:52

Message:
Logged In: YES 
user_id=1428111
Originator: NO

Use a proxy.pac file in your browser to dynamically select the proxy and
you can specify which sites go through privoxy & which sites go through
privoxy+tor.

Create two privoxy configs
#1 - regular privoxy: config.txt
      no "forward-socks" line in the config
      listen-address  127.0.0.1:8118
      logfile privoxy.log
      jarfile privoxy.jar

#2 - privoxy + TOR: privoxy+tor_config.txt
      listen-address      127.0.0.1:8181
      forward-socks4a  /  127.0.0.1:9050  .
      logfile privoxy+tor.log
      jarfile privoxy+tor.jar


create a privoxy+tor.pac file

------- begin privoxy+tor.pac --------
function FindProxyForURL(url,host) {
//  don't use a proxy for these sites:
  if( shExpMatch( host, "*sourceforge.net"))       return "DIRECT";
  if( shExpMatch( host, "*sourceforge.net:443"))   return "DIRECT";
  if( shExpMatch( host, "addons.mozilla.org:443")) return "DIRECT";


//  use Privoxy for these sites:
  if( shExpMatch( host, "*.google.com"))      return "PROXY
localhost:8118";
  if( shExpMatch( host, "*.yahoo.com"))       return "PROXY
localhost:8118";
  if( shExpMatch( host, "*.yimg.com"))        return "PROXY
localhost:8118";


//  use Privoxy + TOR for everything else
                                              return "PROXY
localhost:8181";
}

-------- end ------------------

start TOR and start your two copies of privoxy:
  privoxy -config config.txt
  privoxy -config privoxy+tor_config.txt

tell your browser to use the proxy config file - in Firefox it's
tools / options
advanced / network / settings
select 'Automatic proxy configuration URL:' and enter the filename
(I put the file in the root directory, so for me it's
  c:\privoxy+tor.pac
)

and you're all set!

Have fun!!


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-07-19 15:43

Message:
Logged In: NO 

Thanks for the help.
Maybe I can do something with virtualization or so....

----------------------------------------------------------------------

Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 18:48

Message:
Logged In: YES 
user_id=875547
Originator: NO

This is currently not possible as Privoxy never
binds to multiple different ports at the same time.

With Privoxy's CVS versions, however, you can
influence the forwarding settings based on tags
and if your browser allows you to modify at least
one header, you can use it to toggle Tor usage.

If you're already using different browsers anyway,
you could simply tag based on the User-Agent.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Support Requests item #1756112, was opened at 2007-07-18 05:51
Message generated for change (Comment added) made by nobody
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: 3.0.x
Status: Open
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Fabian Keil (fabiankeil)
Summary: Different ports with different configs?

Initial Comment:
I'm using privoxy 3.0.5 and tor 0.1.1.26 under opensuse linux 10.2. Browsing with tor is slow, so I want to use it only for pelicular things. On the other hand I want to use the other privoxy features like adblocking or user-agent-faking in every browsing session. So is there a way to set up privoxy in a way, that it listens to one port and routes it over tor and an other port only for doing its own stuff?
E.g.: Port 1234 goes thru privoxy and tor
Port 1235 goes thru privoxy and then into the net.

Hope it's understandable, what I want to do.

Mail: klei6b05@...

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-07-22 23:53

Message:
Logged In: NO 

Ah, OK. So I can start 2 instances of privox at the same time. That's what
I wanted to do. I'll try this. How can I start these 2 instances
automatically at system startup?
Th switching between the 2 instances I'll do using some Firefox-Extension
like FoxyProxy. So I don't have to use the pac-file (thanks anyway).

----------------------------------------------------------------------

Comment By: icmp30 (icmp30)
Date: 2007-07-22 20:52

Message:
Logged In: YES 
user_id=1428111
Originator: NO

Use a proxy.pac file in your browser to dynamically select the proxy and
you can specify which sites go through privoxy & which sites go through
privoxy+tor.

Create two privoxy configs
#1 - regular privoxy: config.txt
      no "forward-socks" line in the config
      listen-address  127.0.0.1:8118
      logfile privoxy.log
      jarfile privoxy.jar

#2 - privoxy + TOR: privoxy+tor_config.txt
      listen-address      127.0.0.1:8181
      forward-socks4a  /  127.0.0.1:9050  .
      logfile privoxy+tor.log
      jarfile privoxy+tor.jar


create a privoxy+tor.pac file

------- begin privoxy+tor.pac --------
function FindProxyForURL(url,host) {
//  don't use a proxy for these sites:
  if( shExpMatch( host, "*sourceforge.net"))       return "DIRECT";
  if( shExpMatch( host, "*sourceforge.net:443"))   return "DIRECT";
  if( shExpMatch( host, "addons.mozilla.org:443")) return "DIRECT";


//  use Privoxy for these sites:
  if( shExpMatch( host, "*.google.com"))      return "PROXY
localhost:8118";
  if( shExpMatch( host, "*.yahoo.com"))       return "PROXY
localhost:8118";
  if( shExpMatch( host, "*.yimg.com"))        return "PROXY
localhost:8118";


//  use Privoxy + TOR for everything else
                                              return "PROXY
localhost:8181";
}

-------- end ------------------

start TOR and start your two copies of privoxy:
  privoxy -config config.txt
  privoxy -config privoxy+tor_config.txt

tell your browser to use the proxy config file - in Firefox it's
tools / options
advanced / network / settings
select 'Automatic proxy configuration URL:' and enter the filename
(I put the file in the root directory, so for me it's
  c:\privoxy+tor.pac
)

and you're all set!

Have fun!!


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-07-19 08:43

Message:
Logged In: NO 

Thanks for the help.
Maybe I can do something with virtualization or so....

----------------------------------------------------------------------

Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 11:48

Message:
Logged In: YES 
user_id=875547
Originator: NO

This is currently not possible as Privoxy never
binds to multiple different ports at the same time.

With Privoxy's CVS versions, however, you can
influence the forwarding settings based on tags
and if your browser allows you to modify at least
one header, you can use it to toggle Tor usage.

If you're already using different browsers anyway,
you could simply tag based on the User-Agent.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Support Requests item #1756112, was opened at 2007-07-18 12:51
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: 3.0.x
>Status: Pending
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Fabian Keil (fabiankeil)
Summary: Different ports with different configs?

Initial Comment:
I'm using privoxy 3.0.5 and tor 0.1.1.26 under opensuse linux 10.2. Browsing with tor is slow, so I want to use it only for pelicular things. On the other hand I want to use the other privoxy features like adblocking or user-agent-faking in every browsing session. So is there a way to set up privoxy in a way, that it listens to one port and routes it over tor and an other port only for doing its own stuff?
E.g.: Port 1234 goes thru privoxy and tor
Port 1235 goes thru privoxy and then into the net.

Hope it's understandable, what I want to do.

Mail: klei6b05@...

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-25 18:34

Message:
Logged In: YES 
user_id=875547
Originator: NO

Just duplicate your Privoxy directory change the
configuration file and add another autostart entry.
Be sure to change the listening port to make sure
it doesn't conflict with the other Privoxy.

If you're careful, you can use a single installation
and share most of the files, but it's probably not
worth the hassle.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-07-23 06:53

Message:
Logged In: NO 

Ah, OK. So I can start 2 instances of privox at the same time. That's what
I wanted to do. I'll try this. How can I start these 2 instances
automatically at system startup?
Th switching between the 2 instances I'll do using some Firefox-Extension
like FoxyProxy. So I don't have to use the pac-file (thanks anyway).

----------------------------------------------------------------------

Comment By: icmp30 (icmp30)
Date: 2007-07-23 03:52

Message:
Logged In: YES 
user_id=1428111
Originator: NO

Use a proxy.pac file in your browser to dynamically select the proxy and
you can specify which sites go through privoxy & which sites go through
privoxy+tor.

Create two privoxy configs
#1 - regular privoxy: config.txt
      no "forward-socks" line in the config
      listen-address  127.0.0.1:8118
      logfile privoxy.log
      jarfile privoxy.jar

#2 - privoxy + TOR: privoxy+tor_config.txt
      listen-address      127.0.0.1:8181
      forward-socks4a  /  127.0.0.1:9050  .
      logfile privoxy+tor.log
      jarfile privoxy+tor.jar


create a privoxy+tor.pac file

------- begin privoxy+tor.pac --------
function FindProxyForURL(url,host) {
//  don't use a proxy for these sites:
  if( shExpMatch( host, "*sourceforge.net"))       return "DIRECT";
  if( shExpMatch( host, "*sourceforge.net:443"))   return "DIRECT";
  if( shExpMatch( host, "addons.mozilla.org:443")) return "DIRECT";


//  use Privoxy for these sites:
  if( shExpMatch( host, "*.google.com"))      return "PROXY
localhost:8118";
  if( shExpMatch( host, "*.yahoo.com"))       return "PROXY
localhost:8118";
  if( shExpMatch( host, "*.yimg.com"))        return "PROXY
localhost:8118";


//  use Privoxy + TOR for everything else
                                              return "PROXY
localhost:8181";
}

-------- end ------------------

start TOR and start your two copies of privoxy:
  privoxy -config config.txt
  privoxy -config privoxy+tor_config.txt

tell your browser to use the proxy config file - in Firefox it's
tools / options
advanced / network / settings
select 'Automatic proxy configuration URL:' and enter the filename
(I put the file in the root directory, so for me it's
  c:\privoxy+tor.pac
)

and you're all set!

Have fun!!


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2007-07-19 15:43

Message:
Logged In: NO 

Thanks for the help.
Maybe I can do something with virtualization or so....

----------------------------------------------------------------------

Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 18:48

Message:
Logged In: YES 
user_id=875547
Originator: NO

This is currently not possible as Privoxy never
binds to multiple different ports at the same time.

With Privoxy's CVS versions, however, you can
influence the forwarding settings based on tags
and if your browser allows you to modify at least
one header, you can use it to toggle Tor usage.

If you're already using different browsers anyway,
you could simply tag based on the User-Agent.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1756112&group_id=11118

Support Requests item #1760031, was opened at 2007-07-25 14:57
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760031&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: other
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Stephen Worthington (stephen_w)
Assigned to: Nobody/Anonymous (nobody)
Summary: NTLM proxy authentication does not work

Initial Comment:
Privoxy 3.0.6
Windows XP SP2
SeaMonkey 1.1.2
Internet Explorer 7.0.5730.11

My company (www.provenco.com) is in the process of implementing a new proxy server for http connections.  The current proxying setup uses a transparent Squid proxy, with all port 80 packets being sent to it by the company routers - you do not have to set up anything in your browsers.  The new setup uses browser settings to send the traffic to port 8080 on the proxy server box, and those settings are going to be automatically put in place by the group policies under Windows Active Directory.  The old proxy did not require authentication, but the new one does.  Both proxies are using the Squid software.

As I want to keep on using Privoxy, I thought I would try it out using the new setup, ahead of when everyone is going to be required to use it.  I added a forward line to config.txt to make Privoxy forward to the new proxy.  I know how to do forwarding, as I have that working at home where I run my own Squid proxy and have Privoxy set up to work through it.

Unfortunately, there are some problems with the proxy authentication using Privoxy with the new proxy.  If I set up my browsers to use the new proxy directly, they work, so I know the new proxy server is working.

SeaMonkey also works when using Privoxy ahead of the new proxy, but it asks first for authentication to use the Privoxy proxy, and I have to click "Cancel" on the popup box for that question, and then it asks for my user ID and password to authenticate with the new company proxy.  If I fill in the right details, SeaMonkey is then happy until it is shut down again.  Looking at the Privoxy logs (with full debug output), I can see that SeaMonkey is using "basic" authentication using a realm.  I do not know why SeaMonkey asks for a login to Privoxy, as it does not need to authenticate to use Privoxy.  There may be something that Privoxy is doing to the headers that is triggering that behaviour, or it may be a SeaMonkey problem.  Either way, it is just an annoyance, rather than a problem.

With Internet Explorer (and any other programs such as Stardock Central that use the Windows "Internet Settings" to talk to the Internet), the authentication does  not work.  The new Squid proxy offers the availability of two authentication methods, "basic" and "NTLM" with these headers:

  Proxy-Authenticate: NTLM
  Proxy-Authenticate: Basic realm="Provenco Proxy Server"

SeaMonkey chooses to use "basic", and that works.  IE7 (and the other programs that connect the same way) choose to use NTLM, and that fails.  From looking at the logs and using Ethereal to capture the packets when Privoxy is not being used, I have come up with a theory as to what might be going wrong.  Privoxy is making changes to the headers:

  Jul 24 15:08:14 Privoxy(000015f4) Header: crumble crunched: Proxy-Connection: Keep-Alive!
  Jul 24 15:08:14 Privoxy(000015f4) Header: Adding: Connection: close

The effect of these changes is that the connection is closed after each HTTP GET is done and the response is received.  When Privoxy is not used, IE7 keeps the connection open and when it receives a the first response saying that authentication is required, it sends its second GET containing the NTLM authentication header using the same connection.  Subsequent use of that same connection needs no further authentication.  So it looks as though keeping the connection open is a requirement for NTLM authentication.

So, does anyone know any more about this?  Will Privoxy be able to support NTLM authentication in the future?  I took a quick look at the Privoxy source code (3.0.6 and current CVS), and it seems that closing the connection is necessary for Privoxy to work at present.

I also had an idea about how to fix my problem in the short term - if I could get Privoxy to remove the header that offers NTLM authentication, maybe IE7 would then use "basic" authentication.  Is there a way to do that, with a filter maybe, or do I need to make a source code change to try it?  I would need the filter to work on all web pages.  I had a go to try to get a filter to do that, but I could not get it to work - it seemed to not be filtering the headers.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760031&group_id=11118

Support Requests item #1760031, was opened at 2007-07-25 14:57
Message generated for change (Comment added) made by stephen_w
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760031&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: other
Group: None
Status: Open
Priority: 5
Private: No
Submitted By: Stephen Worthington (stephen_w)
Assigned to: Nobody/Anonymous (nobody)
Summary: NTLM proxy authentication does not work

Initial Comment:
Privoxy 3.0.6
Windows XP SP2
SeaMonkey 1.1.2
Internet Explorer 7.0.5730.11

My company (www.provenco.com) is in the process of implementing a new proxy server for http connections.  The current proxying setup uses a transparent Squid proxy, with all port 80 packets being sent to it by the company routers - you do not have to set up anything in your browsers.  The new setup uses browser settings to send the traffic to port 8080 on the proxy server box, and those settings are going to be automatically put in place by the group policies under Windows Active Directory.  The old proxy did not require authentication, but the new one does.  Both proxies are using the Squid software.

As I want to keep on using Privoxy, I thought I would try it out using the new setup, ahead of when everyone is going to be required to use it.  I added a forward line to config.txt to make Privoxy forward to the new proxy.  I know how to do forwarding, as I have that working at home where I run my own Squid proxy and have Privoxy set up to work through it.

Unfortunately, there are some problems with the proxy authentication using Privoxy with the new proxy.  If I set up my browsers to use the new proxy directly, they work, so I know the new proxy server is working.

SeaMonkey also works when using Privoxy ahead of the new proxy, but it asks first for authentication to use the Privoxy proxy, and I have to click "Cancel" on the popup box for that question, and then it asks for my user ID and password to authenticate with the new company proxy.  If I fill in the right details, SeaMonkey is then happy until it is shut down again.  Looking at the Privoxy logs (with full debug output), I can see that SeaMonkey is using "basic" authentication using a realm.  I do not know why SeaMonkey asks for a login to Privoxy, as it does not need to authenticate to use Privoxy.  There may be something that Privoxy is doing to the headers that is triggering that behaviour, or it may be a SeaMonkey problem.  Either way, it is just an annoyance, rather than a problem.

With Internet Explorer (and any other programs such as Stardock Central that use the Windows "Internet Settings" to talk to the Internet), the authentication does  not work.  The new Squid proxy offers the availability of two authentication methods, "basic" and "NTLM" with these headers:

  Proxy-Authenticate: NTLM
  Proxy-Authenticate: Basic realm="Provenco Proxy Server"

SeaMonkey chooses to use "basic", and that works.  IE7 (and the other programs that connect the same way) choose to use NTLM, and that fails.  From looking at the logs and using Ethereal to capture the packets when Privoxy is not being used, I have come up with a theory as to what might be going wrong.  Privoxy is making changes to the headers:

  Jul 24 15:08:14 Privoxy(000015f4) Header: crumble crunched: Proxy-Connection: Keep-Alive!
  Jul 24 15:08:14 Privoxy(000015f4) Header: Adding: Connection: close

The effect of these changes is that the connection is closed after each HTTP GET is done and the response is received.  When Privoxy is not used, IE7 keeps the connection open and when it receives a the first response saying that authentication is required, it sends its second GET containing the NTLM authentication header using the same connection.  Subsequent use of that same connection needs no further authentication.  So it looks as though keeping the connection open is a requirement for NTLM authentication.

So, does anyone know any more about this?  Will Privoxy be able to support NTLM authentication in the future?  I took a quick look at the Privoxy source code (3.0.6 and current CVS), and it seems that closing the connection is necessary for Privoxy to work at present.

I also had an idea about how to fix my problem in the short term - if I could get Privoxy to remove the header that offers NTLM authentication, maybe IE7 would then use "basic" authentication.  Is there a way to do that, with a filter maybe, or do I need to make a source code change to try it?  I would need the filter to work on all web pages.  I had a go to try to get a filter to do that, but I could not get it to work - it seemed to not be filtering the headers.

----------------------------------------------------------------------

>Comment By: Stephen Worthington (stephen_w)
Date: 2007-07-25 15:03

Message:
Logged In: YES 
user_id=1726722
Originator: YES

Oops, I pushed the wrong button on my browser and managed to create a
duplicate - please delete this one.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760031&group_id=11118

Support Requests item #1760018, was opened at 2007-07-25 02:19
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760018&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: other
Group: None
>Status: Pending
Priority: 5
Private: No
Submitted By: Stephen Worthington (stephen_w)
>Assigned to: Fabian Keil (fabiankeil)
Summary: NTLM proxy authentication does not work

Initial Comment:
Privoxy 3.0.6
Windows XP SP2
SeaMonkey 1.1.2
Internet Explorer 7.0.5730.11

My company (www.provenco.com) is in the process of implementing a new proxy server for http connections.  The current proxying setup uses a transparent Squid proxy, with all port 80 packets being sent to it by the company routers - you do not have to set up anything in your browsers.  The new setup uses browser settings to send the traffic to port 8080 on the proxy server box, and those settings are going to be automatically put in place by the group policies under Windows Active Directory.  The old proxy did not require authentication, but the new one does.  Both proxies are using the Squid software.

As I want to keep on using Privoxy, I thought I would try it out using the new setup, ahead of when everyone is going to be required to use it.  I added a forward line to config.txt to make Privoxy forward to the new proxy.  I know how to do forwarding, as I have that working at home where I run my own Squid proxy and have Privoxy set up to work through it.

Unfortunately, there are some problems with the proxy authentication using Privoxy with the new proxy.  If I set up my browsers to use the new proxy directly, they work, so I know the new proxy server is working.

SeaMonkey also works when using Privoxy ahead of the new proxy, but it asks first for authentication to use the Privoxy proxy, and I have to click "Cancel" on the popup box for that question, and then it asks for my user ID and password to authenticate with the new company proxy.  If I fill in the right details, SeaMonkey is then happy until it is shut down again.  Looking at the Privoxy logs (with full debug output), I can see that SeaMonkey is using "basic" authentication using a realm.  I do not know why SeaMonkey asks for a login to Privoxy, as it does not need to authenticate to use Privoxy.  There may be something that Privoxy is doing to the headers that is triggering that behaviour, or it may be a SeaMonkey problem.  Either way, it is just an annoyance, rather than a problem.

With Internet Explorer (and any other programs such as Stardock Central that use the Windows "Internet Settings" to talk to the Internet), the authentication does  not work.  The new Squid proxy offers the availability of two authentication methods, "basic" and "NTLM" with these headers:

  Proxy-Authenticate: NTLM
  Proxy-Authenticate: Basic realm="Provenco Proxy Server"

SeaMonkey chooses to use "basic", and that works.  IE7 (and the other programs that connect the same way) choose to use NTLM, and that fails.  From looking at the logs and using Ethereal to capture the packets when Privoxy is not being used, I have come up with a theory as to what might be going wrong.  Privoxy is making changes to the headers:

  Jul 24 15:08:14 Privoxy(000015f4) Header: crumble crunched: Proxy-Connection: Keep-Alive!
  Jul 24 15:08:14 Privoxy(000015f4) Header: Adding: Connection: close

The effect of these changes is that the connection is closed after each HTTP GET is done and the response is received.  When Privoxy is not used, IE7 keeps the connection open and when it receives a the first response saying that authentication is required, it sends its second GET containing the NTLM authentication header using the same connection.  Subsequent use of that same connection needs no further authentication.  So it looks as though keeping the connection open is a requirement for NTLM authentication.

So, does anyone know any more about this?  Will Privoxy be able to support NTLM authentication in the future?  I took a quick look at the Privoxy source code (3.0.6 and current CVS), and it seems that closing the connection is necessary for Privoxy to work at present.

I also had an idea about how to fix my problem in the short term - if I could get Privoxy to remove the header that offers NTLM authentication, maybe IE7 would then use "basic" authentication.  Is there a way to do that, with a filter maybe, or do I need to make a source code change to try it?  I would need the filter to work on all web pages.  I had a go to try to get a filter to do that, but I could not get it to work - it seemed to not be filtering the headers.

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-25 18:24

Message:
Logged In: YES 
user_id=875547
Originator: NO

There are already some feature requests for NTLM
support:
https://sourceforge.net/tracker/index.php?func=detail&aid=620124&group_id=11118&atid=361118
is one of them.

Your diagnosis about the closed connection causing
the problem is correct, however I don't think that
NTLM requires full keep-alive support to work. It
could probably be done similar to the
"HTTP/1.1 100 Continue" hack, provided the browser
can cache or save the proxy password. Otherwise it
should still work, but would require a login for
every new request ...

I'm pretty sure Privoxy will support connection keep-alive
someday in the future (which is after all an infinite
amount of time), but probably not in the next release.

The mentioned NTLM hack would be a lot less
work (a few hours maybe) and could theoretically make
it into the next release, but given the age of the
other NTLM requests it doesn't look as if any
volunteer is interested in spending time to actually
implement it.

In the meantime, your idea to suppress the NTLM header
should work and should be possible with any Privoxy
version above 3.0.3 without changing the source code.

If your filter isn't applied to the headers, you probably
forgot to enable header filtering:
http://www.privoxy.org/user-manual/actions-file.html#FILTER-SERVER-HEADERS

However I'd suggest you use:
http://www.privoxy.org/user-manual/actions-file.html#CRUNCH-SERVER-HEADER
instead, or get Privoxy's CVS version which supports
dedicated header filters.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760018&group_id=11118

Support Requests item #1760031, was opened at 2007-07-25 02:57
Message generated for change (Settings changed) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760031&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: other
Group: None
>Status: Deleted
Priority: 5
Private: No
Submitted By: Stephen Worthington (stephen_w)
>Assigned to: Fabian Keil (fabiankeil)
Summary: NTLM proxy authentication does not work

Initial Comment:
Privoxy 3.0.6
Windows XP SP2
SeaMonkey 1.1.2
Internet Explorer 7.0.5730.11

My company (www.provenco.com) is in the process of implementing a new proxy server for http connections.  The current proxying setup uses a transparent Squid proxy, with all port 80 packets being sent to it by the company routers - you do not have to set up anything in your browsers.  The new setup uses browser settings to send the traffic to port 8080 on the proxy server box, and those settings are going to be automatically put in place by the group policies under Windows Active Directory.  The old proxy did not require authentication, but the new one does.  Both proxies are using the Squid software.

As I want to keep on using Privoxy, I thought I would try it out using the new setup, ahead of when everyone is going to be required to use it.  I added a forward line to config.txt to make Privoxy forward to the new proxy.  I know how to do forwarding, as I have that working at home where I run my own Squid proxy and have Privoxy set up to work through it.

Unfortunately, there are some problems with the proxy authentication using Privoxy with the new proxy.  If I set up my browsers to use the new proxy directly, they work, so I know the new proxy server is working.

SeaMonkey also works when using Privoxy ahead of the new proxy, but it asks first for authentication to use the Privoxy proxy, and I have to click "Cancel" on the popup box for that question, and then it asks for my user ID and password to authenticate with the new company proxy.  If I fill in the right details, SeaMonkey is then happy until it is shut down again.  Looking at the Privoxy logs (with full debug output), I can see that SeaMonkey is using "basic" authentication using a realm.  I do not know why SeaMonkey asks for a login to Privoxy, as it does not need to authenticate to use Privoxy.  There may be something that Privoxy is doing to the headers that is triggering that behaviour, or it may be a SeaMonkey problem.  Either way, it is just an annoyance, rather than a problem.

With Internet Explorer (and any other programs such as Stardock Central that use the Windows "Internet Settings" to talk to the Internet), the authentication does  not work.  The new Squid proxy offers the availability of two authentication methods, "basic" and "NTLM" with these headers:

  Proxy-Authenticate: NTLM
  Proxy-Authenticate: Basic realm="Provenco Proxy Server"

SeaMonkey chooses to use "basic", and that works.  IE7 (and the other programs that connect the same way) choose to use NTLM, and that fails.  From looking at the logs and using Ethereal to capture the packets when Privoxy is not being used, I have come up with a theory as to what might be going wrong.  Privoxy is making changes to the headers:

  Jul 24 15:08:14 Privoxy(000015f4) Header: crumble crunched: Proxy-Connection: Keep-Alive!
  Jul 24 15:08:14 Privoxy(000015f4) Header: Adding: Connection: close

The effect of these changes is that the connection is closed after each HTTP GET is done and the response is received.  When Privoxy is not used, IE7 keeps the connection open and when it receives a the first response saying that authentication is required, it sends its second GET containing the NTLM authentication header using the same connection.  Subsequent use of that same connection needs no further authentication.  So it looks as though keeping the connection open is a requirement for NTLM authentication.

So, does anyone know any more about this?  Will Privoxy be able to support NTLM authentication in the future?  I took a quick look at the Privoxy source code (3.0.6 and current CVS), and it seems that closing the connection is necessary for Privoxy to work at present.

I also had an idea about how to fix my problem in the short term - if I could get Privoxy to remove the header that offers NTLM authentication, maybe IE7 would then use "basic" authentication.  Is there a way to do that, with a filter maybe, or do I need to make a source code change to try it?  I would need the filter to work on all web pages.  I had a go to try to get a filter to do that, but I could not get it to work - it seemed to not be filtering the headers.

----------------------------------------------------------------------

Comment By: Stephen Worthington (stephen_w)
Date: 2007-07-25 03:03

Message:
Logged In: YES 
user_id=1726722
Originator: YES

Oops, I pushed the wrong button on my browser and managed to create a
duplicate - please delete this one.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1760031&group_id=11118

Support Requests item #1755934, was opened at 2007-07-18 07:59
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755934&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: None
>Status: Pending
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Multiple proxies.

Initial Comment:
Hi,

I'm using Privoxy 3.0.6 with Windows XP Home Edition SP 2 and IE 6.

I donnot understand the intructions for configuring multiple proxies.

I have a cashing proxy and the setting for it is HTTP Localhost: Port 8080. I have attached a file of my proxy settings window. A screenshot of my proxy settings window is also available at http://www.myfilestash.com/userfiles/downloads/proxyScrShot.doc

Privoxy works great when I set the proxy setting for HTTP 127.0.0.1: Port 8118. But I am unable to understand the directions in the user manual for setting multiple proxies.

Could you please tell me step-by-step what I need to do to assign settings for both proxies.

Thank you. Have a great day,

Charlie
downloads@...

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 17:26

Message:
Logged In: YES 
user_id=875547
Originator: NO

Simply following:
http://www.privoxy.org/user-manual/config.html#FORWARDING
and replacing "anon-proxy.example.org:8080" with the
address of your caching proxy should work if you want
to have Privoxy between the browser and the caching proxy.

Otherwise you'll have to check the documentation of
the other proxy to see if you can get it to forward
the requests to Privoxy.

Either way, in your browser you only specify the first
proxy in the proxy chain (the one that forwards to the other).

If you still don't get it working, please describe exactly
what you did so far and how it fails.

P.S.
Please don't use proprietary file formats on the internet.
If you think your screenshot is important enough to be looked at,
consider reposting it in a standard format like PNG.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755934&group_id=11118

Support Requests item #1755935, was opened at 2007-07-18 08:06
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755935&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: configuration
Group: None
>Status: Closed
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
>Assigned to: Fabian Keil (fabiankeil)
Summary: Multiple proxies

Initial Comment:
Hi,

I'm using Privoxy 3.0.6 with Windows XP Home Edition SP 2 and IE 6.

I donnot understand the intructions for configuring multiple proxies.

I have a cashing proxy and the setting for it is HTTP Localhost: Port 8080. I have attached a file of my proxy settings window. A screenshot of my proxy settings window is also available at http://www.myfilestash.com/userfiles/downloads/proxyScrShot.doc

Privoxy works great when I set the proxy setting for HTTP 127.0.0.1: Port 8118. But I am unable to understand the directions in the user manual for setting multiple proxies.

Could you please tell me step-by-step what I need to do to assign settings for both proxies.

Thank you. Have a great day,

Charlie
downloads@...

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-18 17:09

Message:
Logged In: YES 
user_id=875547
Originator: NO

Duplicate of:
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755934&group_id=11118

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755935&group_id=11118

Support Requests item #1755213, was opened at 2007-07-17 01:12
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755213&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: actions files
Group: 3.0.x
>Status: Pending
Priority: 5
Private: No
Submitted By: (* Steve *) (steve_hodges)
>Assigned to: Fabian Keil (fabiankeil)
Summary: Fails to parse +fast-redirects

Initial Comment:
Privoxy 3.06 on Debian Etch (from debian repository) running with updated default.actions fails to parse line 1144

{+fast-redirects -block}

This is documented as working in 3.06 and I'm not sure what I've done wrong :-(

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2007-07-17 16:21

Message:
Logged In: YES 
user_id=875547
Originator: NO

Where is it documented to work for 3.0.6 and what's the
source and revision of your default.actions file?

fast-redirects is parameterized since 3.0.5 beta,
you can no longer enable it 3.0.3-style without
specifying the decoding mode:
http://www.privoxy.org/user-manual/actions-file.html#FAST-REDIRECTS

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=211118&aid=1755213&group_id=11118