Default deny_private to yes

Author: renaudallard

README.md

@@ -115,7 +115,7 @@ See `thinproxy.conf.example` for a full example.
 
 | Directive | Description | Default |
 |-----------|-------------|---------|
-| `deny_private <yes\|no>` | Block connections to private/reserved addresses | `no` |
+| `deny_private <yes\|no>` | Block connections to private/reserved addresses | `yes` |
 | `connect_port <port>` | Allowed CONNECT port (whitelist, repeatable) | all |
 | `allow <ip[/prefix]>` | Allow source address (whitelist mode) | |
 | `deny <ip[/prefix]>` | Deny source address (blacklist mode) | |

thinproxy.8

@@ -118,7 +118,10 @@ shared address space (100.64/10), unique local IPv6 (fc00::/7),
 multicast, and reserved ranges.
 IPv4-mapped IPv6 addresses are also checked.
 The default is
-.Cm no .
+.Cm yes .
+Set to
+.Cm no
+to allow connections to private addresses.
 .It Cm connect_port Ar port
 Restrict the CONNECT method to the specified
 .Ar port .

thinproxy.c

@@ -149,7 +149,7 @@ static char			cfg_port[8] = DEFAULT_PORT;
 static char			cfg_user[64];
 static int			cfg_maxconns = MAX_CONNS;
 static int			cfg_timeout = 300;
-static int			cfg_deny_private;
+static int			cfg_deny_private = 1;
 static int			cfg_maxconns_per_ip = 32;
 
 /* ACL */

thinproxy.conf.example

@@ -26,7 +26,7 @@ port 8080
 # Close idle connections after this many seconds (default: 300)
 #idle_timeout 300
 
-# Block connections to private/reserved addresses (default: no)
+# Block connections to private/reserved addresses (default: yes)
 # Prevents SSRF by denying RFC 1918, loopback, link-local, etc.
 #deny_private yes