| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744574557465747574857495750575157525753575457555756575757585759576057615762576357645765576657675768576957705771577257735774577557765777577857795780578157825783578457855786578757885789579057915792579357945795579657975798579958005801580258035804580558065807580858095810581158125813581458155816581758185819582058215822582358245825582658275828582958305831583258335834583558365837583858395840584158425843584458455846584758485849585058515852585358545855585658575858585958605861586258635864586558665867586858695870587158725873587458755876587758785879588058815882588358845885588658875888588958905891589258935894589558965897589858995900590159025903590459055906590759085909591059115912591359145915591659175918591959205921592259235924592559265927592859295930593159325933593459355936593759385939594059415942594359445945594659475948594959505951595259535954595559565957595859595960596159625963596459655966596759685969597059715972597359745975597659775978597959805981598259835984598559865987598859895990599159925993599459955996599759985999600060016002600360046005600660076008600960106011601260136014601560166017601860196020602160226023602460256026602760286029603060316032603360346035603660376038603960406041604260436044604560466047604860496050605160526053605460556056605760586059606060616062606360646065606660676068606960706071607260736074607560766077607860796080608160826083608460856086608760886089609060916092609360946095609660976098609961006101610261036104610561066107610861096110611161126113611461156116611761186119612061216122612361246125612661276128612961306131613261336134613561366137613861396140614161426143614461456146614761486149615061516152615361546155615661576158615961606161616261636164616561666167616861696170617161726173617461756176617761786179618061816182618361846185618661876188618961906191619261936194619561966197619861996200620162026203620462056206620762086209621062116212621362146215621662176218621962206221622262236224622562266227622862296230623162326233623462356236623762386239624062416242624362446245624662476248624962506251625262536254625562566257625862596260626162626263626462656266626762686269627062716272627362746275627662776278627962806281628262836284628562866287628862896290629162926293629462956296629762986299630063016302630363046305630663076308630963106311631263136314631563166317631863196320632163226323632463256326632763286329633063316332633363346335633663376338633963406341634263436344634563466347634863496350635163526353635463556356635763586359636063616362636363646365636663676368636963706371637263736374637563766377637863796380638163826383638463856386638763886389639063916392639363946395639663976398639964006401640264036404640564066407640864096410641164126413641464156416641764186419642064216422642364246425642664276428642964306431643264336434643564366437643864396440644164426443644464456446644764486449645064516452645364546455645664576458645964606461646264636464646564666467646864696470647164726473647464756476647764786479648064816482648364846485648664876488648964906491649264936494649564966497649864996500650165026503650465056506650765086509651065116512651365146515651665176518651965206521652265236524652565266527652865296530653165326533653465356536653765386539654065416542654365446545654665476548654965506551655265536554655565566557655865596560656165626563656465656566656765686569657065716572657365746575657665776578657965806581658265836584658565866587658865896590659165926593659465956596659765986599660066016602660366046605660666076608660966106611661266136614661566166617661866196620662166226623662466256626662766286629663066316632663366346635663666376638663966406641664266436644664566466647664866496650665166526653665466556656665766586659666066616662666366646665666666676668666966706671667266736674667566766677667866796680668166826683668466856686668766886689669066916692669366946695669666976698669967006701670267036704670567066707670867096710671167126713671467156716671767186719672067216722672367246725672667276728672967306731673267336734673567366737673867396740674167426743674467456746674767486749675067516752675367546755675667576758675967606761676267636764676567666767676867696770677167726773677467756776677767786779678067816782678367846785678667876788678967906791679267936794679567966797679867996800680168026803680468056806680768086809681068116812681368146815681668176818681968206821682268236824682568266827682868296830683168326833683468356836683768386839684068416842684368446845684668476848684968506851685268536854685568566857685868596860686168626863686468656866686768686869687068716872687368746875687668776878687968806881688268836884688568866887688868896890689168926893689468956896689768986899690069016902690369046905690669076908690969106911691269136914691569166917691869196920692169226923692469256926692769286929693069316932693369346935693669376938693969406941694269436944694569466947694869496950695169526953695469556956695769586959696069616962696369646965696669676968696969706971697269736974697569766977697869796980698169826983698469856986698769886989699069916992699369946995699669976998699970007001700270037004700570067007700870097010701170127013701470157016701770187019702070217022702370247025702670277028702970307031703270337034703570367037703870397040704170427043704470457046704770487049705070517052705370547055705670577058705970607061706270637064706570667067706870697070707170727073707470757076707770787079708070817082708370847085708670877088708970907091709270937094709570967097709870997100710171027103710471057106710771087109711071117112711371147115711671177118711971207121712271237124712571267127712871297130713171327133713471357136713771387139714071417142714371447145714671477148714971507151715271537154715571567157715871597160716171627163716471657166716771687169717071717172717371747175717671777178717971807181718271837184718571867187718871897190719171927193719471957196719771987199720072017202720372047205720672077208720972107211721272137214721572167217721872197220722172227223722472257226722772287229723072317232723372347235723672377238723972407241724272437244724572467247724872497250725172527253725472557256725772587259726072617262726372647265726672677268726972707271727272737274727572767277727872797280728172827283728472857286728772887289729072917292729372947295729672977298729973007301730273037304730573067307730873097310731173127313731473157316731773187319732073217322732373247325732673277328732973307331733273337334733573367337733873397340734173427343734473457346734773487349735073517352735373547355735673577358735973607361736273637364736573667367736873697370737173727373737473757376737773787379738073817382738373847385738673877388738973907391739273937394739573967397739873997400740174027403740474057406740774087409741074117412741374147415741674177418741974207421742274237424742574267427742874297430743174327433743474357436743774387439744074417442744374447445744674477448744974507451745274537454745574567457745874597460746174627463746474657466746774687469747074717472747374747475747674777478747974807481748274837484748574867487748874897490749174927493749474957496749774987499750075017502750375047505750675077508750975107511751275137514751575167517751875197520752175227523752475257526752775287529753075317532753375347535753675377538753975407541754275437544754575467547754875497550755175527553755475557556755775587559756075617562756375647565756675677568756975707571757275737574757575767577757875797580758175827583758475857586758775887589759075917592759375947595759675977598759976007601760276037604760576067607760876097610761176127613761476157616761776187619762076217622762376247625762676277628762976307631763276337634763576367637763876397640764176427643764476457646764776487649765076517652765376547655765676577658765976607661766276637664766576667667766876697670767176727673767476757676767776787679768076817682768376847685768676877688768976907691769276937694769576967697769876997700770177027703770477057706770777087709771077117712771377147715771677177718771977207721772277237724772577267727772877297730773177327733773477357736773777387739774077417742774377447745774677477748774977507751775277537754775577567757775877597760776177627763776477657766776777687769777077717772777377747775777677777778777977807781778277837784778577867787778877897790779177927793779477957796779777987799780078017802780378047805780678077808780978107811781278137814781578167817781878197820782178227823782478257826782778287829783078317832783378347835783678377838783978407841784278437844784578467847784878497850785178527853785478557856785778587859786078617862786378647865786678677868786978707871787278737874787578767877787878797880788178827883788478857886788778887889789078917892789378947895789678977898789979007901790279037904790579067907790879097910791179127913791479157916791779187919792079217922792379247925792679277928792979307931793279337934793579367937793879397940794179427943794479457946794779487949795079517952795379547955795679577958795979607961796279637964796579667967796879697970797179727973797479757976797779787979798079817982798379847985798679877988798979907991799279937994799579967997799879998000800180028003800480058006800780088009801080118012801380148015801680178018801980208021802280238024802580268027802880298030803180328033803480358036803780388039804080418042804380448045804680478048804980508051805280538054805580568057805880598060806180628063806480658066806780688069807080718072807380748075807680778078807980808081808280838084808580868087808880898090809180928093809480958096809780988099810081018102810381048105810681078108810981108111811281138114811581168117811881198120812181228123812481258126812781288129813081318132813381348135813681378138813981408141814281438144814581468147814881498150815181528153815481558156815781588159816081618162816381648165816681678168816981708171817281738174817581768177817881798180818181828183818481858186818781888189819081918192819381948195819681978198819982008201820282038204820582068207820882098210821182128213821482158216821782188219822082218222822382248225822682278228822982308231823282338234823582368237823882398240824182428243824482458246824782488249825082518252825382548255825682578258825982608261826282638264826582668267826882698270827182728273827482758276827782788279828082818282828382848285828682878288828982908291829282938294829582968297829882998300830183028303830483058306830783088309831083118312831383148315831683178318831983208321832283238324832583268327832883298330833183328333833483358336833783388339834083418342834383448345834683478348834983508351835283538354835583568357835883598360836183628363836483658366836783688369837083718372837383748375837683778378837983808381838283838384838583868387838883898390839183928393839483958396839783988399840084018402840384048405840684078408840984108411841284138414841584168417841884198420842184228423842484258426842784288429843084318432843384348435843684378438843984408441844284438444844584468447844884498450845184528453845484558456845784588459846084618462846384648465846684678468846984708471847284738474847584768477847884798480848184828483848484858486848784888489849084918492849384948495849684978498849985008501850285038504850585068507850885098510851185128513851485158516851785188519852085218522852385248525852685278528852985308531853285338534853585368537853885398540854185428543854485458546854785488549855085518552855385548555855685578558855985608561856285638564856585668567856885698570857185728573857485758576857785788579858085818582858385848585858685878588858985908591859285938594859585968597859885998600860186028603860486058606860786088609861086118612861386148615861686178618861986208621862286238624862586268627862886298630863186328633863486358636863786388639864086418642864386448645864686478648864986508651865286538654865586568657865886598660866186628663866486658666866786688669867086718672867386748675867686778678867986808681868286838684868586868687868886898690869186928693869486958696869786988699870087018702870387048705870687078708870987108711871287138714871587168717871887198720872187228723872487258726872787288729873087318732873387348735873687378738873987408741874287438744874587468747874887498750875187528753875487558756875787588759876087618762876387648765876687678768876987708771877287738774877587768777877887798780878187828783878487858786878787888789879087918792879387948795879687978798879988008801880288038804880588068807880888098810881188128813881488158816881788188819882088218822882388248825882688278828882988308831883288338834883588368837883888398840884188428843884488458846884788488849885088518852885388548855885688578858885988608861886288638864886588668867886888698870887188728873887488758876887788788879888088818882888388848885888688878888888988908891889288938894889588968897889888998900890189028903890489058906890789088909891089118912891389148915891689178918891989208921892289238924892589268927892889298930893189328933893489358936893789388939894089418942894389448945894689478948894989508951895289538954895589568957895889598960896189628963896489658966896789688969897089718972897389748975897689778978897989808981898289838984898589868987898889898990899189928993899489958996899789988999900090019002900390049005900690079008900990109011901290139014901590169017901890199020902190229023902490259026902790289029903090319032903390349035903690379038903990409041904290439044904590469047904890499050905190529053905490559056905790589059906090619062906390649065906690679068906990709071907290739074907590769077907890799080908190829083908490859086908790889089909090919092909390949095909690979098909991009101910291039104910591069107910891099110911191129113911491159116911791189119912091219122912391249125912691279128912991309131913291339134913591369137913891399140914191429143914491459146914791489149915091519152915391549155915691579158915991609161916291639164916591669167916891699170917191729173917491759176917791789179918091819182918391849185918691879188918991909191919291939194919591969197919891999200920192029203920492059206920792089209921092119212921392149215921692179218921992209221922292239224922592269227922892299230923192329233923492359236923792389239924092419242924392449245924692479248924992509251925292539254925592569257925892599260926192629263926492659266926792689269927092719272927392749275927692779278927992809281928292839284928592869287928892899290929192929293929492959296929792989299930093019302930393049305930693079308930993109311931293139314931593169317931893199320932193229323932493259326932793289329933093319332933393349335933693379338933993409341934293439344934593469347934893499350935193529353935493559356935793589359936093619362936393649365936693679368936993709371937293739374937593769377937893799380938193829383938493859386938793889389939093919392939393949395939693979398939994009401940294039404940594069407940894099410941194129413941494159416941794189419942094219422942394249425942694279428942994309431943294339434943594369437943894399440944194429443944494459446944794489449945094519452945394549455945694579458945994609461946294639464946594669467946894699470947194729473947494759476947794789479948094819482948394849485948694879488948994909491949294939494949594969497949894999500950195029503950495059506950795089509951095119512951395149515951695179518951995209521952295239524952595269527952895299530953195329533953495359536953795389539954095419542954395449545954695479548954995509551955295539554955595569557955895599560956195629563956495659566956795689569957095719572957395749575957695779578957995809581958295839584958595869587958895899590959195929593959495959596959795989599960096019602960396049605960696079608960996109611961296139614961596169617961896199620962196229623962496259626962796289629963096319632963396349635963696379638963996409641964296439644964596469647964896499650965196529653965496559656965796589659966096619662966396649665966696679668966996709671967296739674967596769677967896799680968196829683968496859686968796889689969096919692969396949695969696979698969997009701970297039704970597069707970897099710971197129713971497159716971797189719972097219722972397249725972697279728972997309731973297339734973597369737973897399740974197429743974497459746974797489749975097519752975397549755975697579758975997609761976297639764976597669767976897699770977197729773977497759776977797789779978097819782978397849785978697879788978997909791979297939794979597969797979897999800980198029803980498059806980798089809981098119812981398149815981698179818981998209821982298239824982598269827982898299830983198329833983498359836983798389839984098419842984398449845984698479848984998509851985298539854985598569857985898599860986198629863986498659866986798689869987098719872987398749875987698779878987998809881988298839884988598869887988898899890989198929893989498959896989798989899990099019902990399049905990699079908990999109911991299139914991599169917991899199920992199229923992499259926992799289929993099319932993399349935993699379938993999409941994299439944994599469947994899499950995199529953995499559956995799589959996099619962996399649965996699679968996999709971997299739974997599769977997899799980998199829983998499859986998799889989999099919992999399949995999699979998999910000100011000210003100041000510006100071000810009100101001110012100131001410015100161001710018100191002010021100221002310024100251002610027100281002910030100311003210033100341003510036100371003810039100401004110042100431004410045100461004710048100491005010051100521005310054100551005610057100581005910060100611006210063100641006510066100671006810069100701007110072100731007410075100761007710078100791008010081100821008310084100851008610087100881008910090100911009210093100941009510096100971009810099101001010110102101031010410105101061010710108101091011010111101121011310114101151011610117101181011910120101211012210123101241012510126101271012810129101301013110132101331013410135101361013710138101391014010141101421014310144101451014610147101481014910150101511015210153101541015510156101571015810159101601016110162101631016410165101661016710168101691017010171101721017310174101751017610177101781017910180101811018210183101841018510186101871018810189101901019110192101931019410195101961019710198101991020010201102021020310204102051020610207102081020910210102111021210213102141021510216102171021810219102201022110222102231022410225102261022710228102291023010231102321023310234102351023610237102381023910240102411024210243102441024510246102471024810249102501025110252102531025410255102561025710258102591026010261102621026310264102651026610267102681026910270102711027210273102741027510276102771027810279102801028110282102831028410285102861028710288102891029010291102921029310294102951029610297102981029910300103011030210303103041030510306103071030810309103101031110312103131031410315103161031710318103191032010321103221032310324103251032610327103281032910330103311033210333103341033510336103371033810339103401034110342103431034410345103461034710348103491035010351103521035310354103551035610357103581035910360103611036210363103641036510366103671036810369103701037110372103731037410375103761037710378103791038010381103821038310384103851038610387103881038910390103911039210393103941039510396103971039810399104001040110402104031040410405104061040710408104091041010411104121041310414104151041610417104181041910420104211042210423104241042510426104271042810429104301043110432104331043410435104361043710438104391044010441104421044310444104451044610447104481044910450104511045210453104541045510456104571045810459104601046110462104631046410465104661046710468104691047010471104721047310474104751047610477104781047910480104811048210483104841048510486104871048810489104901049110492104931049410495104961049710498104991050010501105021050310504105051050610507105081050910510105111051210513105141051510516105171051810519105201052110522105231052410525105261052710528105291053010531105321053310534105351053610537105381053910540105411054210543105441054510546105471054810549105501055110552105531055410555105561055710558105591056010561105621056310564105651056610567105681056910570105711057210573105741057510576105771057810579105801058110582105831058410585105861058710588105891059010591105921059310594105951059610597105981059910600106011060210603106041060510606106071060810609106101061110612106131061410615106161061710618106191062010621106221062310624106251062610627106281062910630106311063210633106341063510636106371063810639106401064110642106431064410645106461064710648106491065010651106521065310654106551065610657106581065910660106611066210663106641066510666106671066810669106701067110672106731067410675106761067710678106791068010681106821068310684106851068610687106881068910690106911069210693106941069510696106971069810699107001070110702107031070410705107061070710708107091071010711107121071310714107151071610717107181071910720107211072210723107241072510726107271072810729107301073110732107331073410735107361073710738107391074010741107421074310744107451074610747107481074910750107511075210753107541075510756107571075810759107601076110762107631076410765107661076710768107691077010771107721077310774107751077610777107781077910780107811078210783107841078510786107871078810789107901079110792107931079410795107961079710798107991080010801108021080310804108051080610807108081080910810108111081210813108141081510816108171081810819108201082110822108231082410825108261082710828108291083010831108321083310834108351083610837108381083910840108411084210843108441084510846108471084810849108501085110852108531085410855108561085710858108591086010861108621086310864108651086610867108681086910870108711087210873108741087510876108771087810879108801088110882108831088410885108861088710888108891089010891108921089310894108951089610897108981089910900109011090210903109041090510906109071090810909109101091110912109131091410915109161091710918109191092010921109221092310924109251092610927109281092910930109311093210933109341093510936109371093810939109401094110942109431094410945109461094710948109491095010951109521095310954109551095610957109581095910960109611096210963109641096510966109671096810969109701097110972109731097410975109761097710978109791098010981109821098310984109851098610987109881098910990109911099210993109941099510996109971099810999110001100111002110031100411005110061100711008110091101011011110121101311014110151101611017110181101911020110211102211023110241102511026110271102811029110301103111032110331103411035110361103711038110391104011041110421104311044110451104611047110481104911050110511105211053110541105511056110571105811059110601106111062110631106411065110661106711068110691107011071110721107311074110751107611077110781107911080110811108211083110841108511086110871108811089110901109111092110931109411095110961109711098110991110011101111021110311104111051110611107111081110911110111111111211113111141111511116111171111811119111201112111122111231112411125111261112711128111291113011131111321113311134111351113611137111381113911140111411114211143111441114511146111471114811149111501115111152111531115411155111561115711158111591116011161111621116311164111651116611167111681116911170111711117211173111741117511176111771117811179111801118111182111831118411185111861118711188111891119011191111921119311194111951119611197111981119911200112011120211203112041120511206112071120811209112101121111212112131121411215112161121711218112191122011221112221122311224112251122611227112281122911230112311123211233112341123511236112371123811239112401124111242112431124411245112461124711248112491125011251112521125311254112551125611257112581125911260112611126211263112641126511266112671126811269112701127111272112731127411275112761127711278112791128011281112821128311284112851128611287112881128911290112911129211293112941129511296112971129811299113001130111302113031130411305113061130711308113091131011311113121131311314113151131611317113181131911320113211132211323113241132511326113271132811329113301133111332113331133411335113361133711338113391134011341113421134311344113451134611347113481134911350113511135211353113541135511356113571135811359113601136111362113631136411365113661136711368113691137011371113721137311374113751137611377113781137911380113811138211383113841138511386113871138811389113901139111392113931139411395113961139711398113991140011401114021140311404114051140611407114081140911410114111141211413114141141511416114171141811419114201142111422114231142411425114261142711428114291143011431114321143311434114351143611437114381143911440114411144211443114441144511446114471144811449114501145111452114531145411455114561145711458114591146011461114621146311464114651146611467114681146911470114711147211473114741147511476114771147811479114801148111482114831148411485114861148711488114891149011491114921149311494114951149611497114981149911500115011150211503115041150511506115071150811509115101151111512115131151411515115161151711518115191152011521115221152311524115251152611527115281152911530115311153211533115341153511536115371153811539115401154111542115431154411545115461154711548115491155011551115521155311554115551155611557115581155911560115611156211563115641156511566115671156811569115701157111572115731157411575115761157711578115791158011581115821158311584115851158611587115881158911590115911159211593115941159511596115971159811599116001160111602116031160411605116061160711608116091161011611116121161311614116151161611617116181161911620116211162211623116241162511626116271162811629116301163111632116331163411635116361163711638116391164011641116421164311644116451164611647116481164911650116511165211653116541165511656116571165811659116601166111662116631166411665116661166711668116691167011671116721167311674116751167611677116781167911680116811168211683116841168511686116871168811689116901169111692116931169411695116961169711698116991170011701117021170311704117051170611707117081170911710117111171211713117141171511716117171171811719117201172111722117231172411725117261172711728117291173011731117321173311734117351173611737117381173911740117411174211743117441174511746117471174811749117501175111752117531175411755117561175711758117591176011761117621176311764117651176611767117681176911770117711177211773117741177511776117771177811779117801178111782117831178411785117861178711788117891179011791117921179311794117951179611797117981179911800118011180211803118041180511806118071180811809118101181111812118131181411815118161181711818118191182011821118221182311824118251182611827118281182911830118311183211833118341183511836118371183811839118401184111842118431184411845118461184711848118491185011851118521185311854118551185611857118581185911860118611186211863118641186511866118671186811869118701187111872118731187411875118761187711878118791188011881118821188311884118851188611887118881188911890118911189211893118941189511896118971189811899119001190111902119031190411905119061190711908119091191011911119121191311914119151191611917119181191911920119211192211923119241192511926119271192811929119301193111932119331193411935119361193711938119391194011941119421194311944119451194611947119481194911950119511195211953119541195511956119571195811959119601196111962119631196411965119661196711968119691197011971119721197311974119751197611977119781197911980119811198211983119841198511986119871198811989119901199111992119931199411995119961199711998119991200012001120021200312004120051200612007120081200912010120111201212013120141201512016120171201812019120201202112022120231202412025120261202712028120291203012031120321203312034120351203612037120381203912040120411204212043120441204512046120471204812049120501205112052120531205412055120561205712058120591206012061120621206312064120651206612067120681206912070120711207212073120741207512076120771207812079120801208112082120831208412085120861208712088120891209012091120921209312094120951209612097120981209912100121011210212103121041210512106121071210812109121101211112112121131211412115121161211712118121191212012121121221212312124121251212612127121281212912130121311213212133121341213512136121371213812139121401214112142121431214412145121461214712148121491215012151121521215312154121551215612157121581215912160121611216212163121641216512166121671216812169121701217112172121731217412175121761217712178121791218012181121821218312184121851218612187121881218912190121911219212193121941219512196121971219812199122001220112202122031220412205122061220712208122091221012211122121221312214122151221612217122181221912220122211222212223122241222512226122271222812229122301223112232122331223412235122361223712238122391224012241122421224312244122451224612247122481224912250122511225212253122541225512256122571225812259122601226112262122631226412265122661226712268122691227012271122721227312274122751227612277122781227912280122811228212283122841228512286122871228812289122901229112292122931229412295122961229712298122991230012301123021230312304123051230612307123081230912310123111231212313123141231512316123171231812319123201232112322123231232412325123261232712328123291233012331123321233312334123351233612337123381233912340123411234212343123441234512346123471234812349123501235112352123531235412355123561235712358123591236012361123621236312364123651236612367123681236912370123711237212373123741237512376123771237812379123801238112382123831238412385123861238712388123891239012391123921239312394123951239612397123981239912400124011240212403124041240512406124071240812409124101241112412124131241412415124161241712418124191242012421124221242312424124251242612427124281242912430124311243212433124341243512436124371243812439124401244112442124431244412445124461244712448124491245012451124521245312454124551245612457124581245912460124611246212463124641246512466124671246812469124701247112472124731247412475124761247712478124791248012481124821248312484124851248612487124881248912490124911249212493124941249512496124971249812499125001250112502125031250412505125061250712508125091251012511125121251312514125151251612517125181251912520125211252212523125241252512526125271252812529125301253112532125331253412535125361253712538125391254012541125421254312544125451254612547125481254912550125511255212553125541255512556125571255812559125601256112562125631256412565125661256712568125691257012571125721257312574125751257612577125781257912580125811258212583125841258512586125871258812589125901259112592125931259412595125961259712598125991260012601126021260312604126051260612607126081260912610126111261212613126141261512616126171261812619126201262112622126231262412625126261262712628126291263012631126321263312634126351263612637126381263912640126411264212643126441264512646126471264812649126501265112652126531265412655126561265712658126591266012661126621266312664126651266612667126681266912670126711267212673126741267512676126771267812679126801268112682126831268412685126861268712688126891269012691126921269312694126951269612697126981269912700127011270212703127041270512706127071270812709127101271112712127131271412715127161271712718127191272012721127221272312724127251272612727127281272912730127311273212733127341273512736127371273812739127401274112742127431274412745127461274712748127491275012751127521275312754127551275612757127581275912760127611276212763127641276512766127671276812769127701277112772127731277412775127761277712778127791278012781127821278312784127851278612787127881278912790127911279212793127941279512796127971279812799128001280112802128031280412805128061280712808128091281012811128121281312814128151281612817128181281912820128211282212823128241282512826128271282812829128301283112832128331283412835128361283712838128391284012841128421284312844128451284612847128481284912850128511285212853128541285512856128571285812859128601286112862128631286412865128661286712868128691287012871128721287312874128751287612877128781287912880128811288212883128841288512886128871288812889128901289112892128931289412895128961289712898128991290012901129021290312904129051290612907129081290912910129111291212913129141291512916129171291812919129201292112922129231292412925129261292712928129291293012931129321293312934129351293612937129381293912940129411294212943129441294512946129471294812949129501295112952129531295412955129561295712958129591296012961129621296312964129651296612967129681296912970129711297212973129741297512976129771297812979129801298112982129831298412985129861298712988129891299012991129921299312994129951299612997129981299913000130011300213003130041300513006130071300813009130101301113012130131301413015130161301713018130191302013021130221302313024130251302613027130281302913030130311303213033130341303513036130371303813039130401304113042130431304413045130461304713048130491305013051130521305313054130551305613057130581305913060130611306213063130641306513066130671306813069130701307113072130731307413075130761307713078130791308013081130821308313084130851308613087130881308913090130911309213093130941309513096130971309813099131001310113102131031310413105131061310713108131091311013111131121311313114131151311613117131181311913120131211312213123131241312513126131271312813129131301313113132131331313413135131361313713138131391314013141131421314313144131451314613147131481314913150131511315213153131541315513156131571315813159131601316113162131631316413165131661316713168131691317013171131721317313174131751317613177131781317913180131811318213183131841318513186131871318813189131901319113192131931319413195131961319713198131991320013201132021320313204132051320613207132081320913210132111321213213132141321513216132171321813219132201322113222132231322413225132261322713228132291323013231132321323313234132351323613237132381323913240132411324213243132441324513246132471324813249132501325113252132531325413255132561325713258132591326013261132621326313264132651326613267132681326913270132711327213273132741327513276132771327813279132801328113282132831328413285132861328713288132891329013291132921329313294132951329613297132981329913300133011330213303133041330513306133071330813309133101331113312133131331413315133161331713318133191332013321133221332313324133251332613327133281332913330133311333213333133341333513336133371333813339133401334113342133431334413345133461334713348133491335013351133521335313354133551335613357133581335913360133611336213363133641336513366133671336813369133701337113372133731337413375133761337713378133791338013381133821338313384133851338613387133881338913390133911339213393133941339513396133971339813399134001340113402134031340413405134061340713408134091341013411134121341313414134151341613417134181341913420134211342213423134241342513426134271342813429134301343113432134331343413435134361343713438134391344013441134421344313444134451344613447134481344913450134511345213453134541345513456134571345813459134601346113462134631346413465134661346713468134691347013471134721347313474134751347613477134781347913480134811348213483134841348513486134871348813489134901349113492134931349413495134961349713498134991350013501135021350313504135051350613507135081350913510135111351213513135141351513516135171351813519135201352113522135231352413525135261352713528135291353013531135321353313534135351353613537135381353913540135411354213543135441354513546135471354813549135501355113552135531355413555135561355713558135591356013561135621356313564135651356613567135681356913570135711357213573135741357513576135771357813579135801358113582135831358413585135861358713588135891359013591135921359313594135951359613597135981359913600136011360213603136041360513606136071360813609136101361113612136131361413615136161361713618136191362013621136221362313624136251362613627136281362913630136311363213633136341363513636136371363813639136401364113642136431364413645136461364713648136491365013651136521365313654136551365613657136581365913660136611366213663136641366513666136671366813669136701367113672136731367413675136761367713678136791368013681136821368313684136851368613687136881368913690136911369213693136941369513696136971369813699137001370113702137031370413705137061370713708137091371013711137121371313714137151371613717137181371913720137211372213723137241372513726137271372813729137301373113732137331373413735137361373713738137391374013741137421374313744137451374613747137481374913750137511375213753137541375513756137571375813759137601376113762137631376413765137661376713768137691377013771137721377313774137751377613777137781377913780137811378213783137841378513786137871378813789137901379113792137931379413795137961379713798137991380013801138021380313804138051380613807138081380913810138111381213813138141381513816138171381813819138201382113822138231382413825138261382713828138291383013831138321383313834138351383613837138381383913840138411384213843138441384513846138471384813849138501385113852138531385413855138561385713858138591386013861138621386313864138651386613867138681386913870138711387213873138741387513876138771387813879138801388113882138831388413885138861388713888138891389013891138921389313894138951389613897138981389913900139011390213903139041390513906139071390813909139101391113912139131391413915139161391713918139191392013921139221392313924139251392613927139281392913930139311393213933139341393513936139371393813939139401394113942139431394413945139461394713948139491395013951139521395313954139551395613957139581395913960139611396213963139641396513966139671396813969139701397113972139731397413975139761397713978139791398013981139821398313984139851398613987139881398913990139911399213993139941399513996139971399813999140001400114002140031400414005140061400714008140091401014011140121401314014140151401614017140181401914020140211402214023140241402514026140271402814029140301403114032140331403414035140361403714038140391404014041140421404314044140451404614047140481404914050140511405214053140541405514056140571405814059140601406114062140631406414065140661406714068140691407014071140721407314074140751407614077140781407914080140811408214083140841408514086140871408814089140901409114092140931409414095140961409714098140991410014101141021410314104141051410614107141081410914110141111411214113141141411514116141171411814119141201412114122141231412414125141261412714128141291413014131141321413314134141351413614137141381413914140141411414214143141441414514146141471414814149141501415114152141531415414155141561415714158141591416014161141621416314164141651416614167141681416914170141711417214173141741417514176141771417814179141801418114182141831418414185141861418714188141891419014191141921419314194141951419614197141981419914200142011420214203142041420514206142071420814209142101421114212142131421414215142161421714218142191422014221142221422314224142251422614227142281422914230142311423214233142341423514236142371423814239142401424114242142431424414245142461424714248142491425014251142521425314254142551425614257142581425914260142611426214263142641426514266142671426814269142701427114272142731427414275142761427714278142791428014281142821428314284142851428614287142881428914290142911429214293142941429514296142971429814299143001430114302 |
- Changes in version 0.2.4.6-alpha - 2012-11-13
- Tor 0.2.4.6-alpha fixes an assert bug that has been plaguing relays,
- makes our defense-in-depth memory wiping more reliable, and begins to
- count IPv6 addresses in bridge statistics,
- o Major bugfixes:
- - Fix an assertion failure that could occur when closing a connection
- with a spliced rendezvous circuit. Fix for bug 7212; bugfix on
- Tor 0.2.4.4-alpha.
- - Tor tries to wipe potentially sensitive data after using it, so
- that if some subsequent security failure exposes Tor's memory,
- the damage will be limited. But we had a bug where the compiler
- was eliminating these wipe operations when it decided that the
- memory was no longer visible to a (correctly running) program,
- hence defeating our attempt at defense in depth. We fix that
- by using OpenSSL's OPENSSL_cleanse() operation, which a compiler
- is unlikely to optimize away. Future versions of Tor may use
- a less ridiculously heavy approach for this. Fixes bug 7352.
- Reported in an article by Andrey Karpov.
- o Minor features:
- - Add GeoIP database for IPv6 addresses. The new config option
- is GeoIPv6File.
- - Bridge statistics now count bridge clients connecting over IPv6:
- bridge statistics files now list "bridge-ip-versions" and
- extra-info documents list "geoip6-db-digest". The control protocol
- "CLIENTS_SEEN" and "ip-to-country" queries now support IPv6. Initial
- implementation by "shkoo", addressing ticket 5055.
- o Minor bugfixes:
- - Warn when we are binding low ports when hibernation is enabled;
- previously we had warned when we were _advertising_ low ports with
- hibernation enabled. Fixes bug 7285; bugfix on 0.2.3.9-alpha.
- - Fix a harmless bug when opting against publishing a relay descriptor
- because DisableNetwork is set. Fixes bug 7464; bugfix on
- 0.2.3.9-alpha.
- - Add warning message when a managed proxy dies during configuration.
- Fixes bug 7195; bugfix on 0.2.4.2-alpha.
- - Fix a linking error when building tor-fw-helper without miniupnp.
- Fixes bug 7235; bugfix on 0.2.4.2-alpha. Fix by Anthony G. Basile.
- - Check for closing an or_connection_t without going through correct
- channel functions; emit a warning and then call
- connection_or_close_for_error() so we don't assert as in bugs 7212
- and 7267.
- - Compile correctly on compilers without C99 designated initializer
- support. Fixes bug 7286; bugfix on 0.2.4.4-alpha.
- - Avoid a possible assert that can occur when channel_send_destroy() is
- called on a channel in CHANNEL_STATE_CLOSING, CHANNEL_STATE_CLOSED,
- or CHANNEL_STATE_ERROR when the Tor process is resumed after being
- blocked for a long interval. Fixes bug 7350; bugfix on 0.2.4.4-alpha.
- - Fix a memory leak on failing cases of channel_tls_process_certs_cell.
- Fixes bug 7422; bugfix on 0.2.4.4-alpha.
- o Code simplification and refactoring:
- - Start using OpenBSD's implementation of queue.h, so that we don't
- need to hand-roll our own pointer and list structures whenever we
- need them. (We can't rely on a sys/queue.h, since some operating
- systems don't have them, and the ones that do have them don't all
- present the same extensions.)
- Changes in version 0.2.4.5-alpha - 2012-10-25
- Tor 0.2.4.5-alpha comes hard at the heels of 0.2.4.4-alpha, to fix
- two important security vulnerabilities that could lead to remotely
- triggerable relay crashes, fix a major bug that was preventing clients
- from choosing suitable exit nodes, and refactor some of our code.
- o Major bugfixes (security, also in 0.2.3.24-rc):
- - Fix a group of remotely triggerable assertion failures related to
- incorrect link protocol negotiation. Found, diagnosed, and fixed
- by "some guy from France". Fix for CVE-2012-2250; bugfix on
- 0.2.3.6-alpha.
- - Fix a denial of service attack by which any directory authority
- could crash all the others, or by which a single v2 directory
- authority could crash everybody downloading v2 directory
- information. Fixes bug 7191; bugfix on 0.2.0.10-alpha.
- o Major bugfixes (also in 0.2.3.24-rc):
- - When parsing exit policy summaries from microdescriptors, we had
- previously been ignoring the last character in each one, so that
- "accept 80,443,8080" would be treated by clients as indicating
- a node that allows access to ports 80, 443, and 808. That would
- lead to clients attempting connections that could never work,
- and ignoring exit nodes that would support their connections. Now
- clients parse these exit policy summaries correctly. Fixes bug 7192;
- bugfix on 0.2.3.1-alpha.
- o Minor bugfixes (also in 0.2.3.24-rc):
- - Clients now consider the ClientRejectInternalAddresses config option
- when using a microdescriptor consensus stanza to decide whether
- an exit relay would allow exiting to an internal address. Fixes
- bug 7190; bugfix on 0.2.3.1-alpha.
- o Minor bugfixes:
- - Only disable TLS session ticket support when running as a TLS
- server. Now clients will blend better with regular Firefox
- connections. Fixes bug 7189; bugfix on Tor 0.2.3.23-rc.
- o Code simplification and refactoring:
- - Start using OpenBSD's implementation of queue.h (originally by
- Niels Provos).
- - Move the entry node code from circuitbuild.c to its own file.
- - Move the circuit build timeout tracking code from circuitbuild.c
- to its own file.
- Changes in version 0.2.3.24-rc - 2012-10-25
- Tor 0.2.3.24-rc fixes two important security vulnerabilities that
- could lead to remotely triggerable relay crashes, and fixes
- a major bug that was preventing clients from choosing suitable exit
- nodes.
- o Major bugfixes (security):
- - Fix a group of remotely triggerable assertion failures related to
- incorrect link protocol negotiation. Found, diagnosed, and fixed
- by "some guy from France". Fix for CVE-2012-2250; bugfix on
- 0.2.3.6-alpha.
- - Fix a denial of service attack by which any directory authority
- could crash all the others, or by which a single v2 directory
- authority could crash everybody downloading v2 directory
- information. Fixes bug 7191; bugfix on 0.2.0.10-alpha.
- o Major bugfixes:
- - When parsing exit policy summaries from microdescriptors, we had
- previously been ignoring the last character in each one, so that
- "accept 80,443,8080" would be treated by clients as indicating
- a node that allows access to ports 80, 443, and 808. That would
- lead to clients attempting connections that could never work,
- and ignoring exit nodes that would support their connections. Now
- clients parse these exit policy summaries correctly. Fixes bug 7192;
- bugfix on 0.2.3.1-alpha.
- o Minor bugfixes:
- - Clients now consider the ClientRejectInternalAddresses config option
- when using a microdescriptor consensus stanza to decide whether
- an exit relay would allow exiting to an internal address. Fixes
- bug 7190; bugfix on 0.2.3.1-alpha.
- Changes in version 0.2.4.4-alpha - 2012-10-20
- Tor 0.2.4.4-alpha adds a new v3 directory authority, fixes a privacy
- vulnerability introduced by a change in OpenSSL, fixes a remotely
- triggerable assert, and adds new channel_t and circuitmux_t abstractions
- that will make it easier to test new connection transport and cell
- scheduling algorithms.
- o New directory authorities (also in 0.2.3.23-rc):
- - Add Faravahar (run by Sina Rabbani) as the ninth v3 directory
- authority. Closes ticket 5749.
- o Major bugfixes (security/privacy, also in 0.2.3.23-rc):
- - Disable TLS session tickets. OpenSSL's implementation was giving
- our TLS session keys the lifetime of our TLS context objects, when
- perfect forward secrecy would want us to discard anything that
- could decrypt a link connection as soon as the link connection
- was closed. Fixes bug 7139; bugfix on all versions of Tor linked
- against OpenSSL 1.0.0 or later. Found by Florent Daignière.
- - Discard extraneous renegotiation attempts once the V3 link
- protocol has been initiated. Failure to do so left us open to
- a remotely triggerable assertion failure. Fixes CVE-2012-2249;
- bugfix on 0.2.3.6-alpha. Reported by "some guy from France".
- o Internal abstraction features:
- - Introduce new channel_t abstraction between circuits and
- or_connection_t to allow for implementing alternate OR-to-OR
- transports. A channel_t is an abstract object which can either be a
- cell-bearing channel, which is responsible for authenticating and
- handshaking with the remote OR and transmitting cells to and from
- it, or a listening channel, which spawns new cell-bearing channels
- at the request of remote ORs. Implements part of ticket 6465.
- - Also new is the channel_tls_t subclass of channel_t, adapting it
- to the existing or_connection_t code. The V2/V3 protocol handshaking
- code which formerly resided in command.c has been moved below the
- channel_t abstraction layer and may be found in channeltls.c now.
- Implements the rest of ticket 6465.
- - Introduce new circuitmux_t storing the queue of circuits for
- a channel; this encapsulates and abstracts the queue logic and
- circuit selection policy, and allows the latter to be overridden
- easily by switching out a policy object. The existing EWMA behavior
- is now implemented as a circuitmux_policy_t. Resolves ticket 6816.
- o Required libraries:
- - Tor now requires OpenSSL 0.9.8 or later. OpenSSL 1.0.0 or later is
- strongly recommended.
- o Minor features:
- - Warn users who run hidden services on a Tor client with
- UseEntryGuards disabled that their hidden services will be
- vulnerable to http://freehaven.net/anonbib/#hs-attack06 (the
- attack which motivated Tor to support entry guards in the first
- place). Resolves ticket 6889.
- - Tor now builds correctly on Bitrig, an OpenBSD fork. Patch from
- dhill. Resolves ticket 6982.
- - Option OutboundBindAddress can be specified multiple times and
- accepts IPv6 addresses. Resolves ticket 6876.
- o Minor bugfixes (also in 0.2.3.23-rc):
- - Don't serve or accept v2 hidden service descriptors over a
- relay's DirPort. It's never correct to do so, and disabling it
- might make it more annoying to exploit any bugs that turn up in the
- descriptor-parsing code. Fixes bug 7149.
- - Fix two cases in src/or/transports.c where we were calling
- fmt_addr() twice in a parameter list. Bug found by David
- Fifield. Fixes bug 7014; bugfix on 0.2.3.9-alpha.
- - Fix memory leaks whenever we logged any message about the "path
- bias" detection. Fixes bug 7022; bugfix on 0.2.3.21-rc.
- - When relays refuse a "create" cell because their queue of pending
- create cells is too big (typically because their cpu can't keep up
- with the arrival rate), send back reason "resource limit" rather
- than reason "internal", so network measurement scripts can get a
- more accurate picture. Fixes bug 7037; bugfix on 0.1.1.11-alpha.
- o Minor bugfixes:
- - Command-line option "--version" implies "--quiet". Fixes bug 6997.
- - Free some more still-in-use memory at exit, to make hunting for
- memory leaks easier. Resolves bug 7029.
- - When a Tor client gets a "truncated" relay cell, the first byte of
- its payload specifies why the circuit was truncated. We were
- ignoring this 'reason' byte when tearing down the circuit, resulting
- in the controller not being told why the circuit closed. Now we
- pass the reason from the truncated cell to the controller. Bugfix
- on 0.1.2.3-alpha; fixes bug 7039.
- - Downgrade "Failed to hand off onionskin" messages to "debug"
- severity, since they're typically redundant with the "Your computer
- is too slow" messages. Fixes bug 7038; bugfix on 0.2.2.16-alpha.
- - Make clients running with IPv6 bridges connect over IPv6 again,
- even without setting new config options ClientUseIPv6 and
- ClientPreferIPv6ORPort. Fixes bug 6757; bugfix on 0.2.4.1-alpha.
- - Use square brackets around IPv6 addresses in numerous places
- that needed them, including log messages, HTTPS CONNECT proxy
- requests, TransportProxy statefile entries, and pluggable transport
- extra-info lines. Fixes bug 7011; patch by David Fifield.
- o Code refactoring and cleanup:
- - Source files taken from other packages now reside in src/ext;
- previously they were scattered around the rest of Tor.
- - Avoid use of reserved identifiers in our C code. The C standard
- doesn't like us declaring anything that starts with an
- underscore, so let's knock it off before we get in trouble. Fix
- for bug 1031; bugfix on the first Tor commit.
- Changes in version 0.2.3.23-rc - 2012-10-20
- Tor 0.2.3.23-rc adds a new v3 directory authority, fixes a privacy
- vulnerability introduced by a change in OpenSSL, and fixes a variety
- of smaller bugs in preparation for the release.
- o New directory authorities:
- - Add Faravahar (run by Sina Rabbani) as the ninth v3 directory
- authority. Closes ticket 5749.
- o Major bugfixes (security/privacy):
- - Disable TLS session tickets. OpenSSL's implementation was giving
- our TLS session keys the lifetime of our TLS context objects, when
- perfect forward secrecy would want us to discard anything that
- could decrypt a link connection as soon as the link connection
- was closed. Fixes bug 7139; bugfix on all versions of Tor linked
- against OpenSSL 1.0.0 or later. Found by Florent Daignière.
- - Discard extraneous renegotiation attempts once the V3 link
- protocol has been initiated. Failure to do so left us open to
- a remotely triggerable assertion failure. Fixes CVE-2012-2249;
- bugfix on 0.2.3.6-alpha. Reported by "some guy from France".
- o Major bugfixes:
- - Fix a possible crash bug when checking for deactivated circuits
- in connection_or_flush_from_first_active_circuit(). Fixes bug 6341;
- bugfix on 0.2.2.7-alpha. Bug report and fix received pseudonymously.
- o Minor bugfixes (on 0.2.3.x):
- - Fix two cases in src/or/transports.c where we were calling
- fmt_addr() twice in a parameter list. Bug found by David
- Fifield. Fixes bug 7014; bugfix on 0.2.3.9-alpha.
- - Convert an assert in the pathbias code to a log message. The assert
- appears to only be triggerable by Tor2Web mode. Fixes bug 6866;
- bugfix on 0.2.3.17-beta.
- - Fix memory leaks whenever we logged any message about the "path
- bias" detection. Fixes bug 7022; bugfix on 0.2.3.21-rc.
- o Minor bugfixes (on 0.2.2.x and earlier):
- - Don't serve or accept v2 hidden service descriptors over a relay's
- DirPort. It's never correct to do so, and disabling it might
- make it more annoying to exploit any bugs that turn up in the
- descriptor-parsing code. Fixes bug 7149.
- - When relays refuse a "create" cell because their queue of pending
- create cells is too big (typically because their cpu can't keep up
- with the arrival rate), send back reason "resource limit" rather
- than reason "internal", so network measurement scripts can get a
- more accurate picture. Bugfix on 0.1.1.11-alpha; fixes bug 7037.
- - Correct file sizes when reading binary files on Cygwin, to avoid
- a bug where Tor would fail to read its state file. Fixes bug 6844;
- bugfix on 0.1.2.7-alpha.
- - Avoid undefined behaviour when parsing the list of supported
- rendezvous/introduction protocols in a hidden service descriptor.
- Previously, Tor would have confused (as-yet-unused) protocol version
- numbers greater than 32 with lower ones on many platforms. Fixes
- bug 6827; bugfix on 0.2.0.10-alpha. Found by George Kadianakis.
- o Documentation fixes:
- - Clarify that hidden services are TCP only. Fixes bug 6024.
- Changes in version 0.2.4.3-alpha - 2012-09-22
- Tor 0.2.4.3-alpha fixes another opportunity for a remotely triggerable
- assertion, resumes letting relays test reachability of their DirPort,
- and cleans up a bunch of smaller bugs.
- o Security fixes:
- - Fix an assertion failure in tor_timegm() that could be triggered
- by a badly formatted directory object. Bug found by fuzzing with
- Radamsa. Fixes bug 6811; bugfix on 0.2.0.20-rc.
- o Major bugfixes:
- - Fix a possible crash bug when checking for deactivated circuits
- in connection_or_flush_from_first_active_circuit(). Fixes bug 6341;
- bugfix on 0.2.2.7-alpha. Bug report and fix received pseudonymously.
- - Allow routers to detect that their own DirPorts are running. When
- we removed support for versions_supports_begindir, we also
- accidentally removed the mechanism we used to self-test our
- DirPort. Diagnosed with help from kargig. Fixes bugs 6814 and 6815;
- bugfix on 0.2.4.2-alpha.
- o Security features:
- - Switch to a completely time-invariant approach for picking nodes
- weighted by bandwidth. Our old approach would run through the
- part of the loop after it had made its choice slightly slower
- than it ran through the part of the loop before it had made its
- choice. Addresses ticket 6538.
- - Disable the use of Guard nodes when in Tor2WebMode. Guard usage
- by tor2web clients allows hidden services to identity tor2web
- clients through their repeated selection of the same rendezvous
- and introduction point circuit endpoints (their guards). Resolves
- ticket 6888.
- o Minor features:
- - Enable Tor to read configuration, state, and key information from
- a FIFO. Previously Tor would only read from files with a positive
- stat.st_size. Code from meejah; fixes bug 6044.
- o Minor bugfixes:
- - Correct file sizes when reading binary files on Cygwin, to avoid
- a bug where Tor would fail to read its state file. Fixes bug 6844;
- bugfix on 0.1.2.7-alpha.
- - Correctly handle votes with more than 31 flags. Fixes bug 6853;
- bugfix on 0.2.0.3-alpha.
- - When complaining about a client port on a public address, log
- which address we're complaining about. Fixes bug 4020; bugfix on
- 0.2.3.3-alpha. Patch by Tom Fitzhenry.
- - Convert an assert in the pathbias code to a log message. The assert
- appears to only be triggerable by Tor2Web mode. Fixes bug 6866;
- bugfix on 0.2.3.17-beta.
- - Our new buildsystem was overzealous about rebuilding manpages: it
- would rebuild them all whenever any one of them changed. Now our
- dependency checking should be correct. Fixes bug 6843; bugfix on
- 0.2.4.1-alpha.
- - Don't do reachability testing over IPv6 unless AuthDirPublishIPv6
- is set. Fixes bug 6880. Bugfix on 0.2.4.1-alpha.
- - Correct log printout about which address family is preferred
- when connecting to a bridge with both an IPv4 and IPv6 OR port.
- Fixes bug 6884; bugfix on 0.2.4.1-alpha.
- o Minor bugfixes (code cleanliness):
- - Fix round_to_power_of_2() so it doesn't invoke undefined behavior
- with large values. This situation was untriggered, but nevertheless
- incorrect. Fixes bug 6831; bugfix on 0.2.0.1-alpha.
- - Reject consensus votes with more than 64 known-flags. We aren't even
- close to that limit yet, and our code doesn't handle it correctly.
- Fixes bug 6833; bugfix on 0.2.0.1-alpha.
- - Avoid undefined behaviour when parsing the list of supported
- rendezvous/introduction protocols in a hidden service descriptor.
- Previously, Tor would have confused (as-yet-unused) protocol version
- numbers greater than 32 with lower ones on many platforms. Fixes
- bug 6827; bugfix on 0.2.0.10-alpha. Found by George Kadianakis.
- - Fix handling of rendezvous client authorization types over 8.
- Fixes bug 6861; bugfix on 0.2.1.5-alpha.
- - Fix building with older versions of GCC (2.95, for one) that don't
- like preprocessor directives inside macro arguments. Found by
- grarpamp. Fixes bug 6842; bugfix on 0.2.4.2-alpha.
- - Switch weighted node selection rule from using a list of doubles
- to using a list of int64_t. This change should make the process
- slightly easier to debug and maintain. Needed to finish ticket 6538.
- o Code simplification and refactoring:
- - Move the generic "config" code into a new file, and have "config.c"
- hold only torrc- and state-related code. Resolves ticket 6823.
- - Move the core of our "choose a weighted element at random" logic
- into its own function, and give it unit tests. Now the logic is
- testable, and a little less fragile too.
- - Removed the testing_since field of node_t, which hasn't been used
- for anything since 0.2.0.9-alpha.
- o Documentation fixes:
- - Clarify that hidden services are TCP only. Fixes bug 6024.
- - Resolve a typo in torrc.sample.in. Fixes bug 6819; bugfix on
- 0.2.3.14-alpha.
- Changes in version 0.2.3.22-rc - 2012-09-11
- Tor 0.2.3.22-rc fixes another opportunity for a remotely triggerable
- assertion.
- o Security fixes:
- - Fix an assertion failure in tor_timegm() that could be triggered
- by a badly formatted directory object. Bug found by fuzzing with
- Radamsa. Fixes bug 6811; bugfix on 0.2.0.20-rc.
- o Minor bugfixes:
- - Avoid segfault when starting up having run with an extremely old
- version of Tor and parsing its state file. Fixes bug 6801; bugfix
- on 0.2.2.23-alpha.
- Changes in version 0.2.2.39 - 2012-09-11
- Tor 0.2.2.39 fixes two more opportunities for remotely triggerable
- assertions.
- o Security fixes:
- - Fix an assertion failure in tor_timegm() that could be triggered
- by a badly formatted directory object. Bug found by fuzzing with
- Radamsa. Fixes bug 6811; bugfix on 0.2.0.20-rc.
- - Do not crash when comparing an address with port value 0 to an
- address policy. This bug could have been used to cause a remote
- assertion failure by or against directory authorities, or to
- allow some applications to crash clients. Fixes bug 6690; bugfix
- on 0.2.1.10-alpha.
- Changes in version 0.2.4.2-alpha - 2012-09-10
- Tor 0.2.4.2-alpha enables port forwarding for pluggable transports,
- raises the default rate limiting even more, and makes the bootstrapping
- log messages less noisy.
- o Major features:
- - Automatically forward the TCP ports of pluggable transport
- proxies using tor-fw-helper if PortForwarding is enabled. Implements
- ticket 4567.
- o Major bugfixes:
- - Raise the default BandwidthRate/BandwidthBurst values from 5MB/10MB
- to 1GB/1GB. The previous defaults were intended to be "basically
- infinite", but it turns out they're now limiting our 100mbit+
- relays and bridges. Fixes bug 6605; bugfix on 0.2.0.10-alpha (the
- last time we raised it).
- o Minor features:
- - Detect when we're running with a version of OpenSSL other than the
- one we compiled with. This has occasionally given people hard-to-
- track-down errors.
- - Log fewer lines at level "notice" about our OpenSSL and Libevent
- versions and capabilities when everything is going right. Resolves
- part of ticket 6736.
- - Directory authorities no long accept descriptors for any version of
- Tor before 0.2.2.35, or for any 0.2.3 release before 0.2.3.10-alpha.
- These versions are insecure, unsupported, or both. Implements
- ticket 6789.
- o Minor bugfixes:
- - Rename the (internal-use-only) UsingTestingNetworkDefaults option
- to start with a triple-underscore so the controller won't touch it.
- Patch by Meejah. Fixes bug 3155. Bugfix on 0.2.2.23-alpha.
- - Avoid segfault when starting up having run with an extremely old
- version of Tor and parsing its state file. Fixes bug 6801; bugfix
- on 0.2.2.23-alpha.
- - Rename the (testing-use-only) _UseFilteringSSLBufferevents option
- so it doesn't start with _. Fixes bug 3155. Bugfix on 0.2.3.1-alpha.
- - Don't follow the NULL pointer if microdescriptor generation fails.
- (This does not appear to be triggerable, but it's best to be safe.)
- Found by "f. tp.". Fixes bug 6797; bugfix on 0.2.4.1-alpha.
- - Fix mis-declared dependencies on src/common/crypto.c and
- src/or/tor_main.c that could break out-of-tree builds under some
- circumstances. Fixes bug 6778; bugfix on 0.2.4.1-alpha.
- - Avoid a warning when building common_sha1.i out of tree. Fixes bug
- 6778; bugfix on 0.2.4.1-alpha.
- - Fix a harmless (in this case) build warning for implicitly
- converting a strlen() to an int. Bugfix on 0.2.4.1-alpha.
- o Removed features:
- - Now that all versions before 0.2.2.x are disallowed, we no longer
- need to work around their missing features. Thus we can remove a
- bunch of compatibility code.
- o Code refactoring:
- - Tweak tor-fw-helper to accept an arbitrary amount of arbitrary
- TCP ports to forward. In the past it only accepted two ports:
- the ORPort and the DirPort.
- Changes in version 0.2.4.1-alpha - 2012-09-05
- Tor 0.2.4.1-alpha lets bridges publish their pluggable transports to
- bridgedb; lets relays use IPv6 addresses and directory authorities
- advertise them; and switches to a cleaner build interface.
- This is the first alpha release in a new series, so expect there to
- be bugs. Users who would rather test out a more stable branch should
- stay with 0.2.3.x for now.
- o Major features (bridges):
- - Bridges now report the pluggable transports they support to the
- bridge authority, so it can pass the supported transports on to
- bridgedb and/or eventually do reachability testing. Implements
- ticket 3589.
- o Major features (IPv6):
- - Bridge authorities now accept IPv6 bridge addresses and include
- them in network status documents. Implements ticket 5534.
- - Clients who set "ClientUseIPv6 1" may connect to entry nodes over
- IPv6. Set "ClientPreferIPv6ORPort 1" to make this even more likely
- to happen. Implements ticket 5535.
- - All kind of relays, not just bridges, can now advertise an IPv6
- OR port. Implements ticket 6362.
- - Directory authorities vote on IPv6 OR ports using the new consensus
- method 14. Implements ticket 6363.
- o Major features (build):
- - Switch to a nonrecursive Makefile structure. Now instead of each
- Makefile.am invoking other Makefile.am's, there is a master
- Makefile.am that includes the others. This change makes our build
- process slightly more maintainable, and improves parallelism for
- building with make -j. Original patch by Stewart Smith; various
- fixes by Jim Meyering.
- - Where available, we now use automake's "silent" make rules by
- default, so that warnings are easier to spot. You can get the old
- behavior with "make V=1". Patch by Stewart Smith for ticket 6522.
- o Minor features (code security and spec conformance):
- - Clear keys and key-derived material left on the stack in
- rendservice.c and rendclient.c. Check return value of
- crypto_pk_write_private_key_to_string() in end_service_load_keys().
- These fixes should make us more forward-secure against cold-boot
- attacks and the like. Fixes bug 2385.
- - Reject EXTEND cells sent to nonexistent streams. According to the
- spec, an EXTEND cell sent to _any_ nonzero stream ID is invalid, but
- we were only checking for stream IDs that were currently in use.
- Found while hunting for more instances of bug 6271. Bugfix on
- 0.0.2pre8, which introduced incremental circuit construction.
- o Minor features (streamlining);
- - No longer include the "opt" prefix when generating routerinfos
- or v2 directories: it has been needless since Tor 0.1.2. Closes
- ticket 5124.
- - Remove some now-needless code that tried to aggressively flush
- OR connections as data was added to them. Since 0.2.0.1-alpha, our
- cell queue logic has saved us from the failure mode that this code
- was supposed to prevent. Removing this code will limit the number
- of baroque control flow paths through Tor's network logic. Reported
- pseudonymously on IRC. Fixes bug 6468; bugfix on 0.2.0.1-alpha.
- o Minor features (controller):
- - Add a "GETINFO signal/names" control port command. Implements
- ticket 3842.
- - Provide default values for all options via "GETINFO config/defaults".
- Implements ticket 4971.
- o Minor features (IPv6):
- - New config option "AuthDirHasIPv6Connectivity 1" that directory
- authorities should set if they have IPv6 connectivity and want to
- do reachability tests for IPv6 relays. Implements feature 5974.
- - A relay with an IPv6 OR port now sends that address in NETINFO
- cells (in addition to its other address). Implements ticket 6364.
- o Minor features (log messages):
- - Omit the first heartbeat log message, because it never has anything
- useful to say, and it clutters up the bootstrapping messages.
- Resolves ticket 6758.
- - Don't log about reloading the microdescriptor cache at startup. Our
- bootstrap warnings are supposed to tell the user when there's a
- problem, and our bootstrap notices say when there isn't. Resolves
- ticket 6759; bugfix on 0.2.2.6-alpha.
- - Don't log "I learned some more directory information" when we're
- reading cached directory information. Reserve it for when new
- directory information arrives in response to a fetch. Resolves
- ticket 6760.
- - Prevent rounding error in path bias counts when scaling
- them down, and use the correct scale factor default. Also demote
- some path bias related log messages down a level and make others
- less scary sounding. Fixes bug 6647. Bugfix against 0.2.3.17-beta.
- - We no longer warn so much when generating manpages from their
- asciidoc source.
- o Code simplifications and refactoring:
- - Enhance our internal sscanf replacement so that we can eliminate
- the last remaining uses of the system sscanf. (Though those uses
- of sscanf were safe, sscanf itself is generally error prone, so
- we want to eliminate when we can.) Fixes ticket 4195 and Coverity
- CID 448.
- - Move ipv6_preferred from routerinfo_t to node_t. Addresses bug 4620.
- - Move last_reachable and testing_since from routerinfo_t to node_t.
- Implements ticket 5529.
- - Add replaycache_t structure, functions and unit tests, then refactor
- rend_service_introduce() to be more clear to read, improve, debug,
- and test. Resolves bug 6177.
- - Finally remove support for malloc_good_size and malloc_usable_size.
- We had hoped that these functions would let us eke a little more
- memory out of our malloc implementation. Unfortunately, the only
- implementations that provided these functions are also ones that
- are already efficient about not overallocation: they never got us
- more than 7 or so bytes per allocation. Removing them saves us a
- little code complexity and a nontrivial amount of build complexity.
- o New requirements:
- - Tor maintainers now require Automake version 1.9 or later to build
- Tor from the Git repository. (Automake is not required when building
- from a source distribution.)
- Changes in version 0.2.3.21-rc - 2012-09-05
- Tor 0.2.3.21-rc is the fourth release candidate for the Tor 0.2.3.x
- series. It fixes a trio of potential security bugs, fixes a bug where
- we were leaving some of the fast relays out of the microdescriptor
- consensus, resumes interpreting "ORPort 0" and "DirPort 0" correctly,
- and cleans up other smaller issues.
- o Major bugfixes (security):
- - Tear down the circuit if we get an unexpected SENDME cell. Clients
- could use this trick to make their circuits receive cells faster
- than our flow control would have allowed, or to gum up the network,
- or possibly to do targeted memory denial-of-service attacks on
- entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor --
- from July 2002, before the release of Tor 0.0.0. We had committed
- this patch previously, but we had to revert it because of bug 6271.
- Now that 6271 is fixed, this patch appears to work.
- - Reject any attempt to extend to an internal address. Without
- this fix, a router could be used to probe addresses on an internal
- network to see whether they were accepting connections. Fixes bug
- 6710; bugfix on 0.0.8pre1.
- - Do not crash when comparing an address with port value 0 to an
- address policy. This bug could have been used to cause a remote
- assertion failure by or against directory authorities, or to
- allow some applications to crash clients. Fixes bug 6690; bugfix
- on 0.2.1.10-alpha.
- o Major bugfixes:
- - Remove the upper bound on microdescriptor length. We were hitting
- the limit for routers with complex exit policies or family
- declarations, causing clients to not use them. Fixes the first
- piece of bug 6404; fix on 0.2.2.6-alpha.
- - Detect "ORPort 0" as meaning, uniformly, that we're not running
- as a relay. Previously, some of our code would treat the presence
- of any ORPort line as meaning that we should act like a relay,
- even though our new listener code would correctly not open any
- ORPorts for ORPort 0. Similar bugs in other Port options are also
- fixed. Fixes the first half of bug 6507; bugfix on 0.2.3.3-alpha.
- o Minor bugfixes:
- - Avoid a pair of double-free and use-after-mark bugs that can
- occur with certain timings in canceled and re-received DNS
- requests. Fixes bug 6472; bugfix on 0.0.7rc1.
- - Fix build and 64-bit compile warnings from --enable-openbsd-malloc.
- Fixes bug 6379. Bugfix on 0.2.0.20-rc.
- - Allow one-hop directory fetching circuits the full "circuit build
- timeout" period, rather than just half of it, before failing them
- and marking the relay down. This fix should help reduce cases where
- clients declare relays (or worse, bridges) unreachable because
- the TLS handshake takes a few seconds to complete. Fixes bug 6743;
- bugfix on 0.2.2.2-alpha, where we changed the timeout from a static
- 30 seconds.
- - Authorities no longer include any router in their microdescriptor
- consensuses for which they couldn't generate or agree on a
- microdescriptor. Fixes the second piece of bug 6404; fix on
- 0.2.2.6-alpha.
- - Detect and reject attempts to specify both "FooPort" and
- "FooPort 0" in the same configuration domain. (It's still okay
- to have a FooPort in your configuration file, and use "FooPort 0"
- on the command line to disable it.) Fixes the second half of bug
- 6507; bugfix on 0.2.3.3-alpha.
- - Make wildcarded addresses (that is, ones beginning with "*.") work
- when provided via the controller's MapAddress command. Previously,
- they were accepted, but we never actually noticed that they were
- wildcards. Fixes bug 6244; bugfix on 0.2.3.9-alpha.
- - Avoid crashing on a malformed state file where EntryGuardPathBias
- precedes EntryGuard. Fix for bug 6774; bugfix on 0.2.3.17-beta.
- - Add a (probably redundant) memory clear between iterations of
- the router status voting loop, to prevent future coding errors
- where data might leak between iterations of the loop. Resolves
- ticket 6514.
- o Minor bugfixes (log messages):
- - Downgrade "set buildtimeout to low value" messages to "info"
- severity; they were never an actual problem, there was never
- anything reasonable to do about them, and they tended to spam logs
- from time to time. Fixes bug 6251; bugfix on 0.2.2.2-alpha.
- - Downgrade path-bias warning messages to "info". We'll try to get
- them working better in 0.2.4. Add internal circuit construction
- state to protect against the noisy warn message "Unexpectedly high
- circuit_successes". Also add some additional rate-limited notice
- messages to help determine the root cause of the warn. Fixes bug
- 6475. Bugfix against 0.2.3.17-beta.
- - Move log message when unable to find a microdesc in a routerstatus
- entry to parse time. Previously we'd spam this warning every time
- we tried to figure out which microdescriptors to download. Fixes
- the third piece of bug 6404; fix on 0.2.3.18-rc.
- o Minor features:
- - Consider new, removed or changed IPv6 OR ports a non-cosmetic
- change when the authority is deciding whether to accept a newly
- uploaded descriptor. Implements ticket 6423.
- - Add missing documentation for consensus and microdesc files.
- Resolves ticket 6732.
- Changes in version 0.2.2.38 - 2012-08-12
- Tor 0.2.2.38 fixes a remotely triggerable crash bug, and fixes a timing
- attack that could in theory leak path information.
- o Security fixes:
- - Avoid an uninitialized memory read when reading a vote or consensus
- document that has an unrecognized flavor name. This read could
- lead to a remote crash bug. Fixes bug 6530; bugfix on 0.2.2.6-alpha.
- - Try to leak less information about what relays a client is
- choosing to a side-channel attacker. Previously, a Tor client would
- stop iterating through the list of available relays as soon as it
- had chosen one, thus finishing a little earlier when it picked
- a router earlier in the list. If an attacker can recover this
- timing information (nontrivial but not proven to be impossible),
- they could learn some coarse-grained information about which relays
- a client was picking (middle nodes in particular are likelier to
- be affected than exits). The timing attack might be mitigated by
- other factors (see bug 6537 for some discussion), but it's best
- not to take chances. Fixes bug 6537; bugfix on 0.0.8rc1.
- Changes in version 0.2.3.20-rc - 2012-08-05
- Tor 0.2.3.20-rc is the third release candidate for the Tor 0.2.3.x
- series. It fixes a pair of code security bugs and a potential anonymity
- issue, updates our RPM spec files, and cleans up other smaller issues.
- o Security fixes:
- - Avoid read-from-freed-memory and double-free bugs that could occur
- when a DNS request fails while launching it. Fixes bug 6480;
- bugfix on 0.2.0.1-alpha.
- - Avoid an uninitialized memory read when reading a vote or consensus
- document that has an unrecognized flavor name. This read could
- lead to a remote crash bug. Fixes bug 6530; bugfix on 0.2.2.6-alpha.
- - Try to leak less information about what relays a client is
- choosing to a side-channel attacker. Previously, a Tor client would
- stop iterating through the list of available relays as soon as it
- had chosen one, thus finishing a little earlier when it picked
- a router earlier in the list. If an attacker can recover this
- timing information (nontrivial but not proven to be impossible),
- they could learn some coarse-grained information about which relays
- a client was picking (middle nodes in particular are likelier to
- be affected than exits). The timing attack might be mitigated by
- other factors (see bug 6537 for some discussion), but it's best
- not to take chances. Fixes bug 6537; bugfix on 0.0.8rc1.
- o Minor features:
- - Try to make the warning when giving an obsolete SOCKSListenAddress
- a little more useful.
- - Terminate active server managed proxies if Tor stops being a
- relay. Addresses parts of bug 6274; bugfix on 0.2.3.6-alpha.
- - Provide a better error message about possible OSX Asciidoc failure
- reasons. Fixes bug 6436.
- - Warn when Tor is configured to use accounting in a way that can
- link a hidden service to some other hidden service or public
- address. Resolves ticket 6490.
- o Minor bugfixes:
- - Check return value of fputs() when writing authority certificate
- file. Fixes Coverity issue 709056; bugfix on 0.2.0.1-alpha.
- - Ignore ServerTransportPlugin lines when Tor is not configured as
- a relay. Fixes bug 6274; bugfix on 0.2.3.6-alpha.
- - When disabling guards for having too high a proportion of failed
- circuits, make sure to look at each guard. Fixes bug 6397; bugfix
- on 0.2.3.17-beta.
- o Packaging (RPM):
- - Update our default RPM spec files to work with mock and rpmbuild
- on RHEL/Fedora. They have an updated set of dependencies and
- conflicts, a fix for an ancient typo when creating the "_tor"
- user, and better instructions. Thanks to Ondrej Mikle for the
- patch series. Fixes bug 6043.
- o Testing:
- - Make it possible to set the TestingTorNetwork configuration
- option using AlternateDirAuthority and AlternateBridgeAuthority
- as an alternative to setting DirServer. Addresses ticket 6377.
- o Documentation:
- - Clarify the documentation for the Alternate*Authority options.
- Fixes bug 6387.
- - Fix some typos in the manpages. Patch from A. Costa. Fixes bug 6500.
- o Code simplification and refactoring:
- - Do not use SMARTLIST_FOREACH for any loop whose body exceeds
- 10 lines. Also, don't nest them. Doing so in the past has
- led to hard-to-debug code. The new style is to use the
- SMARTLIST_FOREACH_{BEGIN,END} pair. Addresses issue 6400.
- Changes in version 0.2.3.19-rc - 2012-07-06
- Tor 0.2.3.19-rc is the second release candidate for the Tor 0.2.3.x
- series. It fixes the compile on Windows, reverts to a GeoIP database
- that isn't as broken, and fixes a flow control bug that has been around
- since the beginning of Tor.
- o Major bugfixes:
- - Fix a bug handling SENDME cells on nonexistent streams that could
- result in bizarre window values. Report and patch contributed
- pseudonymously. Fixes part of bug 6271. This bug was introduced
- before the first Tor release, in svn commit r152.
- - Revert to the May 1 2012 Maxmind GeoLite Country database. In the
- June 2012 database, Maxmind marked many Tor relays as country "A1",
- which will cause risky behavior for clients that set EntryNodes
- or ExitNodes. Addresses bug 6334; bugfix on 0.2.3.17-beta.
- - Instead of ENOBUFS on Windows, say WSAENOBUFS. Fixes compilation
- on Windows. Fixes bug 6296; bugfix on 0.2.3.18-rc.
- o Minor bugfixes:
- - Fix wrong TCP port range in parse_port_range(). Fixes bug 6218;
- bugfix on 0.2.1.10-alpha.
- Changes in version 0.2.3.18-rc - 2012-06-28
- Tor 0.2.3.18-rc is the first release candidate for the Tor 0.2.3.x
- series. It fixes a few smaller bugs, but generally appears stable.
- Please test it and let us know whether it is!
- o Major bugfixes:
- - Allow wildcarded mapaddress targets to be specified on the
- controlport. Partially fixes bug 6244; bugfix on 0.2.3.9-alpha.
- - Make our linker option detection code more robust against linkers
- such as on FreeBSD 8, where a bad combination of options completes
- successfully but makes an unrunnable binary. Fixes bug 6173;
- bugfix on 0.2.3.17-beta.
- o Minor bugfixes (on 0.2.2.x and earlier):
- - Avoid a false positive in the util/threads unit test by increasing
- the maximum timeout time. Fixes bug 6227; bugfix on 0.2.0.4-alpha.
- - Replace "Sending publish request" log messages with "Launching
- upload", so that they no longer confusingly imply that we're
- sending something to a directory we might not even be connected
- to yet. Fixes bug 3311; bugfix on 0.2.0.10-alpha.
- - Make sure to set *socket_error in all error cases in
- connection_connect(), so it can't produce a warning about
- errno being zero from errno_to_orconn_end_reason(). Bugfix on
- 0.2.1.1-alpha; resolves ticket 6028.
- - Downgrade "Got a certificate, but we already have it" log messages
- from warning to info, except when we're a dirauth. Fixes bug 5238;
- bugfix on 0.2.1.7-alpha.
- - When checking for requested signatures on the latest consensus
- before serving it to a client, make sure to check the right
- consensus flavor. Bugfix on 0.2.2.6-alpha.
- - Downgrade "eventdns rejected address" message to LOG_PROTOCOL_WARN.
- Fixes bug 5932; bugfix on 0.2.2.7-alpha.
- o Minor bugfixes (on 0.2.3.x):
- - Make format_helper_exit_status() avoid unnecessary space padding
- and stop confusing log_from_pipe(). Fixes ticket 5557; bugfix
- on 0.2.3.1-alpha.
- - Downgrade a message about cleaning the microdescriptor cache to
- "info" from "notice". Fixes bug 6238; bugfix on 0.2.3.1-alpha.
- - Log a BUG message at severity INFO if we have a networkstatus with
- a missing entry for some microdescriptor. Continues on a patch
- to 0.2.3.2-alpha.
- - Improve the log message when a managed proxy fails to launch. Fixes
- bug 5099; bugfix on 0.2.3.6-alpha.
- - Don't do DNS lookups when parsing corrupted managed proxy protocol
- messages. Fixes bug 6226; bugfix on 0.2.3.6-alpha.
- - When formatting wildcarded address mappings for the controller,
- be sure to include "*." as appropriate. Partially fixes bug 6244;
- bugfix on 0.2.3.9-alpha.
- - Avoid a warning caused by using strcspn() from glibc with clang 3.0.
- Bugfix on 0.2.3.13-alpha.
- - Stop logging messages about running with circuit timeout learning
- enabled at severity LD_BUG. Fixes bug 6169; bugfix on 0.2.3.17-beta.
- - Disable a spurious warning about reading on a marked and flushing
- connection. We shouldn't be doing that, but apparently we
- sometimes do. Fixes bug 6203; bugfix on 0.2.3.17-beta.
- - Fix a bug that stopped AllowDotExit from working on addresses
- that had an entry in the DNS cache. Fixes bug 6211; bugfix on
- 0.2.3.17-beta.
- o Code simplification, refactoring, unit tests:
- - Move tor_gettimeofday_cached() into compat_libevent.c, and use
- Libevent's notion of cached time when possible.
- - Remove duplicate code for invoking getrlimit() from control.c.
- - Add a unit test for the environment_variable_names_equal function.
- o Documentation:
- - Document the --defaults-torrc option, and the new (in 0.2.3)
- semantics for overriding, extending, and clearing lists of
- options. Closes bug 4748.
- Changes in version 0.2.3.17-beta - 2012-06-15
- Tor 0.2.3.17-beta enables compiler and linker hardening by default,
- gets our TLS handshake back on track for being able to blend in with
- Firefox, fixes a big bug in 0.2.3.16-alpha that broke Tor's interaction
- with Vidalia, and otherwise continues to get us closer to a release
- candidate.
- o Major features:
- - Enable gcc and ld hardening by default. Resolves ticket 5210.
- - Update TLS cipher list to match Firefox 8 and later. Resolves
- ticket 4744.
- - Implement the client side of proposal 198: remove support for
- clients falsely claiming to support standard ciphersuites that
- they can actually provide. As of modern OpenSSL versions, it's not
- necessary to fake any standard ciphersuite, and doing so prevents
- us from using better ciphersuites in the future, since servers
- can't know whether an advertised ciphersuite is really supported or
- not. Some hosts -- notably, ones with very old versions of OpenSSL
- or where OpenSSL has been built with ECC disabled -- will stand
- out because of this change; TBB users should not be affected.
- o Major bugfixes:
- - Change the default value for DynamicDHGroups (introduced in
- 0.2.3.9-alpha) to 0. This feature can make Tor relays less
- identifiable by their use of the mod_ssl DH group, but at
- the cost of some usability (#4721) and bridge tracing (#6087)
- regressions. Resolves ticket 5598.
- - Send a CRLF at the end of each STATUS_* control protocol event. This
- bug tickled a bug in Vidalia which would make it freeze. Fixes
- bug 6094; bugfix on 0.2.3.16-alpha.
- o Minor bugfixes:
- - Disable writing on marked-for-close connections when they are
- blocked on bandwidth, to prevent busy-looping in Libevent. Fixes
- bug 5263; bugfix on 0.0.2pre13, where we first added a special
- case for flushing marked connections.
- - Detect SSL handshake even when the initial attempt to write the
- server hello fails. Fixes bug 4592; bugfix on 0.2.0.13-alpha.
- - Change the AllowDotExit rules so they should actually work.
- We now enforce AllowDotExit only immediately after receiving an
- address via SOCKS or DNSPort: other sources are free to provide
- .exit addresses after the resolution occurs. Fixes bug 3940;
- bugfix on 0.2.2.1-alpha.
- - Fix a (harmless) integer overflow in cell statistics reported by
- some fast relays. Fixes bug 5849; bugfix on 0.2.2.1-alpha.
- - Make sure circuitbuild.c checks LearnCircuitBuildTimeout in all the
- right places and never depends on the consensus parameters or
- computes adaptive timeouts when it is disabled. Fixes bug 5049;
- bugfix on 0.2.2.14-alpha.
- - When building Tor on Windows with -DUNICODE (not default), ensure
- that error messages, filenames, and DNS server names are always
- NUL-terminated when we convert them to a single-byte encoding.
- Fixes bug 5909; bugfix on 0.2.2.16-alpha.
- - Make Tor build correctly again with -DUNICODE -D_UNICODE defined.
- Fixes bug 6097; bugfix on 0.2.2.16-alpha.
- - Fix an edge case where TestingTorNetwork is set but the authorities
- and relays all have an uptime of zero, where the private Tor network
- could briefly lack support for hidden services. Fixes bug 3886;
- bugfix on 0.2.2.18-alpha.
- - Correct the manpage's descriptions for the default values of
- DirReqStatistics and ExtraInfoStatistics. Fixes bug 2865; bugfix
- on 0.2.3.1-alpha.
- - Fix the documentation for the --hush and --quiet command line
- options, which changed their behavior back in 0.2.3.3-alpha.
- - Fix compilation warning with clang 3.1. Fixes bug 6141; bugfix on
- 0.2.3.11-alpha.
- o Minor features:
- - Rate-limit the "Weighted bandwidth is 0.000000" message, and add
- more information to it, so that we can track it down in case it
- returns again. Mitigates bug 5235.
- - Check CircuitBuildTimeout and LearnCircuitBuildTimeout in
- options_validate(); warn if LearnCircuitBuildTimeout is disabled and
- CircuitBuildTimeout is set unreasonably low. Resolves ticket 5452.
- - Warn the user when HTTPProxy, but no other proxy type, is
- configured. This can cause surprising behavior: it doesn't send
- all of Tor's traffic over the HTTPProxy -- it sends unencrypted
- directory traffic only. Resolves ticket 4663.
- - Issue a notice if a guard completes less than 40% of your circuits.
- Threshold is configurable by torrc option PathBiasNoticeRate and
- consensus parameter pb_noticepct. There is additional, off-by-
- default code to disable guards which fail too many circuits.
- Addresses ticket 5458.
- - Update to the June 6 2012 Maxmind GeoLite Country database.
- o Code simplifications and refactoring:
- - Remove validate_pluggable_transports_config(): its warning
- message is now handled by connection_or_connect().
- Changes in version 0.2.2.37 - 2012-06-06
- Tor 0.2.2.37 introduces a workaround for a critical renegotiation
- bug in OpenSSL 1.0.1 (where 20% of the Tor network can't talk to itself
- currently).
- o Major bugfixes:
- - Work around a bug in OpenSSL that broke renegotiation with TLS
- 1.1 and TLS 1.2. Without this workaround, all attempts to speak
- the v2 Tor connection protocol when both sides were using OpenSSL
- 1.0.1 would fail. Resolves ticket 6033.
- - When waiting for a client to renegotiate, don't allow it to add
- any bytes to the input buffer. This fixes a potential DoS issue.
- Fixes bugs 5934 and 6007; bugfix on 0.2.0.20-rc.
- - Fix an edge case where if we fetch or publish a hidden service
- descriptor, we might build a 4-hop circuit and then use that circuit
- for exiting afterwards -- even if the new last hop doesn't obey our
- ExitNodes config option. Fixes bug 5283; bugfix on 0.2.0.10-alpha.
- o Minor bugfixes:
- - Fix a build warning with Clang 3.1 related to our use of vasprintf.
- Fixes bug 5969. Bugfix on 0.2.2.11-alpha.
- o Minor features:
- - Tell GCC and Clang to check for any errors in format strings passed
- to the tor_v*(print|scan)f functions.
- Changes in version 0.2.3.16-alpha - 2012-06-05
- Tor 0.2.3.16-alpha introduces a workaround for a critical renegotiation
- bug in OpenSSL 1.0.1 (where 20% of the Tor network can't talk to itself
- currently). It also fixes a variety of smaller bugs and other cleanups
- that get us closer to a release candidate.
- o Major bugfixes (general):
- - Work around a bug in OpenSSL that broke renegotiation with TLS
- 1.1 and TLS 1.2. Without this workaround, all attempts to speak
- the v2 Tor connection protocol when both sides were using OpenSSL
- 1.0.1 would fail. Resolves ticket 6033.
- - When waiting for a client to renegotiate, don't allow it to add
- any bytes to the input buffer. This fixes a potential DoS issue.
- Fixes bugs 5934 and 6007; bugfix on 0.2.0.20-rc.
- - Pass correct OR address to managed proxies (like obfsproxy),
- even when ORListenAddress is used. Fixes bug 4865; bugfix on
- 0.2.3.9-alpha.
- - The advertised platform of a router now includes only its operating
- system's name (e.g., "Linux", "Darwin", "Windows 7"), and not its
- service pack level (for Windows) or its CPU architecture (for Unix).
- We also no longer include the "git-XYZ" tag in the version. Resolves
- part of bug 2988.
- o Major bugfixes (clients):
- - If we are unable to find any exit that supports our predicted ports,
- stop calling them predicted, so that we don't loop and build
- hopeless circuits indefinitely. Fixes bug 3296; bugfix on 0.0.9pre6,
- which introduced predicted ports.
- - Fix an edge case where if we fetch or publish a hidden service
- descriptor, we might build a 4-hop circuit and then use that circuit
- for exiting afterwards -- even if the new last hop doesn't obey our
- ExitNodes config option. Fixes bug 5283; bugfix on 0.2.0.10-alpha.
- - Check at each new consensus whether our entry guards were picked
- long enough ago that we should rotate them. Previously, we only
- did this check at startup, which could lead to us holding a guard
- indefinitely. Fixes bug 5380; bugfix on 0.2.1.14-rc.
- - When fetching a bridge descriptor from a bridge authority,
- always do so anonymously, whether we have been able to open
- circuits or not. Partial fix for bug 1938; bugfix on 0.2.0.7-alpha.
- This behavior makes it *safer* to use UpdateBridgesFromAuthority,
- but we'll need to wait for bug 6010 before it's actually usable.
- o Major bugfixes (directory authorities):
- - When computing weight parameters, behave more robustly in the
- presence of a bad bwweightscale value. Previously, the authorities
- would crash if they agreed on a sufficiently broken weight_scale
- value: now, they use a reasonable default and carry on. Partial
- fix for 5786; bugfix on 0.2.2.17-alpha.
- - Check more thoroughly to prevent a rogue authority from
- double-voting on any consensus directory parameter. Previously,
- authorities would crash in this case if the total number of
- votes for any parameter exceeded the number of active voters,
- but would let it pass otherwise. Partial fix for bug 5786; bugfix
- on 0.2.2.2-alpha.
- o Minor features:
- - Rate-limit log messages when asked to connect anonymously to
- a private address. When these hit, they tended to hit fast and
- often. Also, don't bother trying to connect to addresses that we
- are sure will resolve to 127.0.0.1: getting 127.0.0.1 in a directory
- reply makes us think we have been lied to, even when the address the
- client tried to connect to was "localhost." Resolves ticket 2822.
- - Allow packagers to insert an extra string in server descriptor
- platform lines by setting the preprocessor variable TOR_BUILD_TAG.
- Resolves the rest of ticket 2988.
- - Raise the threshold of server descriptors needed (75%) and exit
- server descriptors needed (50%) before we will declare ourselves
- bootstrapped. This will make clients start building circuits a
- little later, but makes the initially constructed circuits less
- skewed and less in conflict with further directory fetches. Fixes
- ticket 3196.
- - Close any connection that sends unrecognized junk before the
- handshake. Solves an issue noted in bug 4369.
- - Improve log messages about managed transports. Resolves ticket 5070.
- - Tag a bridge's descriptor as "never to be sent unencrypted".
- This shouldn't matter, since bridges don't open non-anonymous
- connections to the bridge authority and don't allow unencrypted
- directory connections from clients, but we might as well make
- sure. Closes bug 5139.
- - Expose our view of whether we have gone dormant to the controller,
- via a new "GETINFO dormant" value. Torbutton and other controllers
- can use this to avoid doing periodic requests through Tor while
- it's dormant (bug 4718). Fixes bug 5954.
- - Tell GCC and Clang to check for any errors in format strings passed
- to the tor_v*(print|scan)f functions.
- - Update to the May 1 2012 Maxmind GeoLite Country database.
- o Minor bugfixes (already included in 0.2.2.36):
- - Reject out-of-range times like 23:59:61 in parse_rfc1123_time().
- Fixes bug 5346; bugfix on 0.0.8pre3.
- - Correct parsing of certain date types in parse_http_time().
- Without this patch, If-Modified-Since would behave
- incorrectly. Fixes bug 5346; bugfix on 0.2.0.2-alpha. Patch from
- Esteban Manchado Velázques.
- - Make our number-parsing functions always treat too-large values
- as an error, even when those values exceed the width of the
- underlying type. Previously, if the caller provided these
- functions with minima or maxima set to the extreme values of the
- underlying integer type, these functions would return those
- values on overflow rather than treating overflow as an error.
- Fixes part of bug 5786; bugfix on 0.0.9.
- - If we hit the error case where routerlist_insert() replaces an
- existing (old) server descriptor, make sure to remove that
- server descriptor from the old_routers list. Fix related to bug
- 1776. Bugfix on 0.2.2.18-alpha.
- - Clarify the behavior of MaxCircuitDirtiness with hidden service
- circuits. Fixes issue 5259.
- o Minor bugfixes (coding cleanup, on 0.2.2.x and earlier):
- - Prevent a null-pointer dereference when receiving a data cell
- for a nonexistent stream when the circuit in question has an
- empty deliver window. We don't believe this is triggerable,
- since we don't currently allow deliver windows to become empty,
- but the logic is tricky enough that it's better to make the code
- robust. Fixes bug 5541; bugfix on 0.0.2pre14.
- - Fix a memory leak when trying to launch a DNS request when the
- network is disabled or the nameservers are unconfigurable. Fixes
- bug 5916; bugfix on Tor 0.1.2.1-alpha (for the unconfigurable
- nameserver case) and on 0.2.3.9-alpha (for the DisableNetwork case).
- - Don't hold a Windows file handle open for every file mapping;
- the file mapping handle is sufficient. Fixes bug 5951; bugfix on
- 0.1.2.1-alpha.
- - Avoid O(n^2) performance characteristics when parsing a large
- extrainfo cache. Fixes bug 5828; bugfix on 0.2.0.1-alpha.
- - Format more doubles with %f, not %lf. Patch from grarpamp to make
- Tor build correctly on older BSDs again. Fixes bug 3894; bugfix on
- Tor 0.2.0.8-alpha.
- - Make our replacement implementation of strtok_r() compatible with
- the standard behavior of strtok_r(). Patch by nils. Fixes bug 5091;
- bugfix on 0.2.2.1-alpha.
- - Fix a NULL-pointer dereference on a badly formed
- SETCIRCUITPURPOSE command. Found by mikeyc. Fixes bug 5796;
- bugfix on 0.2.2.9-alpha.
- - Fix a build warning with Clang 3.1 related to our use of vasprintf.
- Fixes bug 5969. Bugfix on 0.2.2.11-alpha.
- - Defensively refactor rend_mid_rendezvous() so that protocol
- violations and length checks happen in the beginning. Fixes
- bug 5645.
- - Set _WIN32_WINNT to 0x0501 consistently throughout the code, so
- that IPv6 stuff will compile on MSVC, and compilation issues
- will be easier to track down. Fixes bug 5861.
- o Minor bugfixes (correctness, on 0.2.2.x and earlier):
- - Exit nodes now correctly report EADDRINUSE and EADDRNOTAVAIL as
- resource exhaustion, so that clients can adjust their load to
- try other exits. Fixes bug 4710; bugfix on 0.1.0.1-rc, which
- started using END_STREAM_REASON_RESOURCELIMIT.
- - Don't check for whether the address we're using for outbound
- connections has changed until after the outbound connection has
- completed. On Windows, getsockname() doesn't succeed until the
- connection is finished. Fixes bug 5374; bugfix on 0.1.1.14-alpha.
- - If the configuration tries to set MyFamily on a bridge, refuse to
- do so, and warn about the security implications. Fixes bug 4657;
- bugfix on 0.2.0.3-alpha.
- - If the client fails to set a reasonable set of ciphersuites
- during its v2 handshake renegotiation, allow the renegotiation to
- continue nevertheless (i.e. send all the required certificates).
- Fixes bug 4591; bugfix on 0.2.0.20-rc.
- - When we receive a SIGHUP and the controller __ReloadTorrcOnSIGHUP
- option is set to 0 (which Vidalia version 0.2.16 now does when
- a SAVECONF attempt fails), perform other actions that SIGHUP
- usually causes (like reopening the logs). Fixes bug 5095; bugfix
- on 0.2.1.9-alpha.
- - If we fail to write a microdescriptor to the disk cache, do not
- continue replacing the old microdescriptor file. Fixes bug 2954;
- bugfix on 0.2.2.6-alpha.
- - Exit nodes don't need to fetch certificates for authorities that
- they don't recognize; only directory authorities, bridges,
- and caches need to do that. Fixes part of bug 2297; bugfix on
- 0.2.2.11-alpha.
- - Correctly handle checking the permissions on the parent
- directory of a control socket in the root directory. Bug found
- by Esteban Manchado Velázquez. Fixes bug 5089; bugfix on Tor
- 0.2.2.26-beta.
- - When told to add a bridge with the same digest as a preexisting
- bridge but a different addr:port, change the addr:port as
- requested. Previously we would not notice the change. Fixes half
- of bug 5603; fix on 0.2.2.26-beta.
- - End AUTHCHALLENGE error messages (in the control protocol) with
- a CRLF. Fixes bug 5760; bugfix on 0.2.2.36 and 0.2.3.13-alpha.
- o Minor bugfixes (on 0.2.3.x):
- - Turn an assertion (that the number of handshakes received as a
- server is not < 1) into a warning. Fixes bug 4873; bugfix on
- 0.2.3.1-alpha.
- - Format IPv4 addresses correctly in ADDRMAP events. (Previously,
- we had reversed them when the answer was cached.) Fixes bug
- 5723; bugfix on 0.2.3.1-alpha.
- - Work correctly on Linux systems with accept4 support advertised in
- their headers, but without accept4 support in the kernel. Fix
- by murb. Fixes bug 5762; bugfix on 0.2.3.1-alpha.
- - When told to add a bridge with the same addr:port as a preexisting
- bridge but a different transport, change the transport as
- requested. Previously we would not notice the change. Fixes half
- of bug 5603; fix on 0.2.3.2-alpha.
- - Avoid a "double-reply" warning when replying to a SOCKS request
- with a parse error. Patch from Fabian Keil. Fixes bug 4108;
- bugfix on 0.2.3.4-alpha.
- - Fix a bug where a bridge authority crashes if it has seen no
- directory requests when it's time to write statistics to disk.
- Fixes bug 5891; bugfix on 0.2.3.6-alpha. Also fixes bug 5508 in
- a better way.
- - Don't try to open non-control listeners when DisableNetwork is set.
- Previously, we'd open all listeners, then immediately close them.
- Fixes bug 5604; bugfix on 0.2.3.9-alpha.
- - Don't abort the managed proxy protocol if the managed proxy
- sends us an unrecognized line; ignore it instead. Fixes bug
- 5910; bugfix on 0.2.3.9-alpha.
- - Fix a compile warning in crypto.c when compiling with clang 3.1.
- Fixes bug 5969, bugfix on 0.2.3.9-alpha.
- - Fix a compilation issue on GNU Hurd, which doesn't have PATH_MAX.
- Fixes bug 5355; bugfix on 0.2.3.11-alpha.
- - Remove bogus definition of "_WIN32" from src/win32/orconfig.h, to
- unbreak the MSVC build. Fixes bug 5858; bugfix on 0.2.3.12-alpha.
- - Resolve numerous small warnings and build issues with MSVC. Resolves
- bug 5859.
- o Documentation fixes:
- - Improve the manual's documentation for the NT Service command-line
- options. Addresses ticket 3964.
- - Clarify SessionGroup documentation slightly; resolves ticket 5437.
- - Document the changes to the ORPort and DirPort options, and the
- fact that {OR/Dir}ListenAddress is now unnecessary (and
- therefore deprecated). Resolves ticket 5597.
- o Removed files:
- - Remove the torrc.bridge file: we don't use it for anything, and
- it had become badly desynchronized from torrc.sample. Resolves
- bug 5622.
- Changes in version 0.2.2.36 - 2012-05-24
- Tor 0.2.2.36 updates the addresses for two of the eight directory
- authorities, fixes some potential anonymity and security issues,
- and fixes several crash bugs.
- Tor 0.2.1.x has reached its end-of-life. Those Tor versions have many
- known flaws, and nobody should be using them. You should upgrade. If
- you're using a Linux or BSD and its packages are obsolete, stop using
- those packages and upgrade anyway.
- o Directory authority changes:
- - Change IP address for maatuska (v3 directory authority).
- - Change IP address for ides (v3 directory authority), and rename
- it to turtles.
- o Security fixes:
- - When building or running with any version of OpenSSL earlier
- than 0.9.8s or 1.0.0f, disable SSLv3 support. These OpenSSL
- versions have a bug (CVE-2011-4576) in which their block cipher
- padding includes uninitialized data, potentially leaking sensitive
- information to any peer with whom they make a SSLv3 connection. Tor
- does not use SSL v3 by default, but a hostile client or server
- could force an SSLv3 connection in order to gain information that
- they shouldn't have been able to get. The best solution here is to
- upgrade to OpenSSL 0.9.8s or 1.0.0f (or later). But when building
- or running with a non-upgraded OpenSSL, we disable SSLv3 entirely
- to make sure that the bug can't happen.
- - Never use a bridge or a controller-supplied node as an exit, even
- if its exit policy allows it. Found by wanoskarnet. Fixes bug
- 5342. Bugfix on 0.1.1.15-rc (for controller-purpose descriptors)
- and 0.2.0.3-alpha (for bridge-purpose descriptors).
- - Only build circuits if we have a sufficient threshold of the total
- descriptors that are marked in the consensus with the "Exit"
- flag. This mitigates an attack proposed by wanoskarnet, in which
- all of a client's bridges collude to restrict the exit nodes that
- the client knows about. Fixes bug 5343.
- - Provide controllers with a safer way to implement the cookie
- authentication mechanism. With the old method, if another locally
- running program could convince a controller that it was the Tor
- process, then that program could trick the controller into telling
- it the contents of an arbitrary 32-byte file. The new "SAFECOOKIE"
- authentication method uses a challenge-response approach to prevent
- this attack. Fixes bug 5185; implements proposal 193.
- o Major bugfixes:
- - Avoid logging uninitialized data when unable to decode a hidden
- service descriptor cookie. Fixes bug 5647; bugfix on 0.2.1.5-alpha.
- - Avoid a client-side assertion failure when receiving an INTRODUCE2
- cell on a general purpose circuit. Fixes bug 5644; bugfix on
- 0.2.1.6-alpha.
- - Fix builds when the path to sed, openssl, or sha1sum contains
- spaces, which is pretty common on Windows. Fixes bug 5065; bugfix
- on 0.2.2.1-alpha.
- - Correct our replacements for the timeradd() and timersub() functions
- on platforms that lack them (for example, Windows). The timersub()
- function is used when expiring circuits, while timeradd() is
- currently unused. Bug report and patch by Vektor. Fixes bug 4778;
- bugfix on 0.2.2.24-alpha.
- - Fix the SOCKET_OK test that we use to tell when socket
- creation fails so that it works on Win64. Fixes part of bug 4533;
- bugfix on 0.2.2.29-beta. Bug found by wanoskarnet.
- o Minor bugfixes:
- - Reject out-of-range times like 23:59:61 in parse_rfc1123_time().
- Fixes bug 5346; bugfix on 0.0.8pre3.
- - Make our number-parsing functions always treat too-large values
- as an error, even when those values exceed the width of the
- underlying type. Previously, if the caller provided these
- functions with minima or maxima set to the extreme values of the
- underlying integer type, these functions would return those
- values on overflow rather than treating overflow as an error.
- Fixes part of bug 5786; bugfix on 0.0.9.
- - Older Linux kernels erroneously respond to strange nmap behavior
- by having accept() return successfully with a zero-length
- socket. When this happens, just close the connection. Previously,
- we would try harder to learn the remote address: but there was
- no such remote address to learn, and our method for trying to
- learn it was incorrect. Fixes bugs 1240, 4745, and 4747. Bugfix
- on 0.1.0.3-rc. Reported and diagnosed by "r1eo".
- - Correct parsing of certain date types in parse_http_time().
- Without this patch, If-Modified-Since would behave
- incorrectly. Fixes bug 5346; bugfix on 0.2.0.2-alpha. Patch from
- Esteban Manchado Velázques.
- - Change the BridgePassword feature (part of the "bridge community"
- design, which is not yet implemented) to use a time-independent
- comparison. The old behavior might have allowed an adversary
- to use timing to guess the BridgePassword value. Fixes bug 5543;
- bugfix on 0.2.0.14-alpha.
- - Detect and reject certain misformed escape sequences in
- configuration values. Previously, these values would cause us
- to crash if received in a torrc file or over an authenticated
- control port. Bug found by Esteban Manchado Velázquez, and
- independently by Robert Connolly from Matta Consulting who further
- noted that it allows a post-authentication heap overflow. Patch
- by Alexander Schrijver. Fixes bugs 5090 and 5402 (CVE 2012-1668);
- bugfix on 0.2.0.16-alpha.
- - Fix a compile warning when using the --enable-openbsd-malloc
- configure option. Fixes bug 5340; bugfix on 0.2.0.20-rc.
- - During configure, detect when we're building with clang version
- 3.0 or lower and disable the -Wnormalized=id and -Woverride-init
- CFLAGS. clang doesn't support them yet.
- - When sending an HTTP/1.1 proxy request, include a Host header.
- Fixes bug 5593; bugfix on 0.2.2.1-alpha.
- - Fix a NULL-pointer dereference on a badly formed SETCIRCUITPURPOSE
- command. Found by mikeyc. Fixes bug 5796; bugfix on 0.2.2.9-alpha.
- - If we hit the error case where routerlist_insert() replaces an
- existing (old) server descriptor, make sure to remove that
- server descriptor from the old_routers list. Fix related to bug
- 1776. Bugfix on 0.2.2.18-alpha.
- o Minor bugfixes (documentation and log messages):
- - Fix a typo in a log message in rend_service_rendezvous_has_opened().
- Fixes bug 4856; bugfix on Tor 0.0.6.
- - Update "ClientOnly" man page entry to explain that there isn't
- really any point to messing with it. Resolves ticket 5005.
- - Document the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays
- directory authority option (introduced in Tor 0.2.2.34).
- - Downgrade the "We're missing a certificate" message from notice
- to info: people kept mistaking it for a real problem, whereas it
- is seldom the problem even when we are failing to bootstrap. Fixes
- bug 5067; bugfix on 0.2.0.10-alpha.
- - Correctly spell "connect" in a log message on failure to create a
- controlsocket. Fixes bug 4803; bugfix on 0.2.2.26-beta.
- - Clarify the behavior of MaxCircuitDirtiness with hidden service
- circuits. Fixes issue 5259.
- o Minor features:
- - Directory authorities now reject versions of Tor older than
- 0.2.1.30, and Tor versions between 0.2.2.1-alpha and 0.2.2.20-alpha
- inclusive. These versions accounted for only a small fraction of
- the Tor network, and have numerous known security issues. Resolves
- issue 4788.
- - Update to the May 1 2012 Maxmind GeoLite Country database.
- - Feature removal:
- - When sending or relaying a RELAY_EARLY cell, we used to convert
- it to a RELAY cell if the connection was using the v1 link
- protocol. This was a workaround for older versions of Tor, which
- didn't handle RELAY_EARLY cells properly. Now that all supported
- versions can handle RELAY_EARLY cells, and now that we're enforcing
- the "no RELAY_EXTEND commands except in RELAY_EARLY cells" rule,
- remove this workaround. Addresses bug 4786.
- Changes in version 0.2.3.15-alpha - 2012-04-30
- Tor 0.2.3.15-alpha fixes a variety of smaller bugs, including making
- the development branch build on Windows again.
- o Minor bugfixes (on 0.2.2.x and earlier):
- - Make sure that there are no unhandled pending TLS errors before
- reading from a TLS stream. We had checks in 0.1.0.3-rc, but
- lost them in 0.1.0.5-rc when we refactored read_to_buf_tls().
- Bugfix on 0.1.0.5-rc; fixes bug 4528.
- - Fix an assert that directory authorities could trigger on sighup
- during some configuration state transitions. We now don't treat
- it as a fatal error when the new descriptor we just generated in
- init_keys() isn't accepted. Fixes bug 4438; bugfix on 0.2.1.9-alpha.
- - After we pick a directory mirror, we would refuse to use it if
- it's in our ExcludeExitNodes list, resulting in mysterious failures
- to bootstrap for people who just wanted to avoid exiting from
- certain locations. Fixes bug 5623; bugfix on 0.2.2.25-alpha.
- - When building with --enable-static-tor on OpenBSD, do not
- erroneously attempt to link -lrt. Fixes bug 5103.
- o Minor bugfixes (on 0.2.3.x):
- - When Tor is built with kernel headers from a recent (last few
- years) Linux kernel, do not fail to run on older (pre-2.6.28
- Linux kernels). Fixes bug 5112; bugfix on 0.2.3.1-alpha.
- - Fix cross-compilation issues with mingw. Bugfixes on 0.2.3.6-alpha
- and 0.2.3.12-alpha.
- - Fix compilation with miniupnpc version 1.6; patch from
- Anthony G. Basile. Fixes bug 5434; bugfix on 0.2.3.12-alpha.
- - Fix compilation with MSVC, which had defined MS_WINDOWS. Bugfix
- on 0.2.3.13-alpha; found and fixed by Gisle Vanem.
- - Fix compilation on platforms without unistd.h, or where environ
- is defined in stdlib.h. Fixes bug 5704; bugfix on 0.2.3.13-alpha.
- o Minor features:
- - Directory authorities are now a little more lenient at accepting
- older router descriptors, or newer router descriptors that don't
- make big changes. This should help ameliorate past and future
- issues where routers think they have uploaded valid descriptors,
- but the authorities don't think so. Fix for ticket 2479.
- - Make the code that clients use to detect an address change be
- IPv6-aware, so that it won't fill clients' logs with error
- messages when trying to get the IPv4 address of an IPv6
- connection. Implements ticket 5537.
- o Removed features:
- - Remove the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays option;
- authorities needed to use it for a while to keep the network working
- as people upgraded to 0.2.1.31, 0.2.2.34, or 0.2.3.6-alpha, but
- that was six months ago. As of now, it should no longer be needed
- or used.
- Changes in version 0.2.3.14-alpha - 2012-04-23
- Tor 0.2.3.14-alpha fixes yet more bugs to get us closer to a release
- candidate. It also dramatically speeds up AES: fast relays should
- consider switching to the newer OpenSSL library.
- o Directory authority changes:
- - Change IP address for ides (v3 directory authority), and rename
- it to turtles.
- o Major bugfixes:
- - Avoid logging uninitialized data when unable to decode a hidden
- service descriptor cookie. Fixes bug 5647; bugfix on 0.2.1.5-alpha.
- - Avoid a client-side assertion failure when receiving an INTRODUCE2
- cell on a general purpose circuit. Fixes bug 5644; bugfix on
- 0.2.1.6-alpha.
- - If authorities are unable to get a v2 consensus document from other
- directory authorities, they no longer fall back to fetching
- them from regular directory caches. Fixes bug 5635; bugfix on
- 0.2.2.26-beta, where routers stopped downloading v2 consensus
- documents entirely.
- - When we start a Tor client with a normal consensus already cached,
- be willing to download a microdescriptor consensus. Fixes bug 4011;
- fix on 0.2.3.1-alpha.
- o Major features (performance):
- - When built to use OpenSSL 1.0.1, and built for an x86 or x86_64
- instruction set, take advantage of OpenSSL's AESNI, bitsliced, or
- vectorized AES implementations as appropriate. These can be much,
- much faster than other AES implementations.
- o Minor bugfixes (0.2.2.x and earlier):
- - Don't launch more than 10 service-side introduction-point circuits
- for a hidden service in five minutes. Previously, we would consider
- launching more introduction-point circuits if at least one second
- had passed without any introduction-point circuits failing. Fixes
- bug 4607; bugfix on 0.0.7pre1.
- - Change the BridgePassword feature (part of the "bridge community"
- design, which is not yet implemented) to use a time-independent
- comparison. The old behavior might have allowed an adversary
- to use timing to guess the BridgePassword value. Fixes bug 5543;
- bugfix on 0.2.0.14-alpha.
- - Enforce correct return behavior of tor_vsscanf() when the '%%'
- pattern is used. Fixes bug 5558. Bugfix on 0.2.1.13.
- - When sending an HTTP/1.1 proxy request, include a Host header.
- Fixes bug 5593; bugfix on 0.2.2.1-alpha.
- - Don't log that we have "decided to publish new relay descriptor"
- unless we are actually publishing a descriptor. Fixes bug 3942;
- bugfix on 0.2.2.28-beta.
- o Minor bugfixes (0.2.3.x):
- - Fix a bug where a bridge authority crashes (on a failed assert)
- if it has seen no directory requests when it's time to write
- statistics to disk. Fixes bug 5508. Bugfix on 0.2.3.6-alpha.
- - Fix bug stomping on ORPort option NoListen and ignoring option
- NoAdvertise. Fixes bug 5151; bugfix on 0.2.3.9-alpha.
- - In the testsuite, provide a large enough buffer in the tor_sscanf
- unit test. Otherwise we'd overrun that buffer and crash during
- the unit tests. Found by weasel. Fixes bug 5449; bugfix on
- 0.2.3.12-alpha.
- - Make sure we create the keys directory if it doesn't exist and we're
- about to store the dynamic Diffie-Hellman parameters. Fixes bug
- 5572; bugfix on 0.2.3.13-alpha.
- - Fix a small memory leak when trying to decode incorrect base16
- authenticator during SAFECOOKIE authentication. Found by
- Coverity Scan. Fixes CID 507. Bugfix on 0.2.3.13-alpha.
- o Minor features:
- - Add more information to a log statement that might help track down
- bug 4091. If you're seeing "Bug: tor_addr_is_internal() called with a
- non-IP address" messages (or any Bug messages, for that matter!),
- please let us know about it.
- - Relays now understand an IPv6 address when they get one from a
- directory server. Resolves ticket 4875.
- - Resolve IPv6 addresses in bridge and entry statistics to country
- code "??" which means we at least count them. Resolves ticket 5053;
- improves on 0.2.3.9-alpha.
- - Update to the April 3 2012 Maxmind GeoLite Country database.
- - Begin a doc/state-contents.txt file to explain the contents of
- the Tor state file. Fixes bug 2987.
- o Default torrc changes:
- - Stop listing "socksport 9050" in torrc.sample. We open a socks
- port on 9050 by default anyway, so this should not change anything
- in practice.
- - Stop mentioning the deprecated *ListenAddress options in
- torrc.sample. Fixes bug 5438.
- - Document unit of bandwidth related options in sample torrc.
- Fixes bug 5621.
- o Removed features:
- - The "torify" script no longer supports the "tsocks" socksifier
- tool, since tsocks doesn't support DNS and UDP right for Tor.
- Everyone should be using torsocks instead. Fixes bugs 3530 and
- 5180. Based on a patch by "ugh".
- o Code refactoring:
- - Change the symmetric cipher interface so that creating and
- initializing a stream cipher are no longer separate functions.
- - Remove all internal support for unpadded RSA. We never used it, and
- it would be a bad idea to start.
- Changes in version 0.2.3.13-alpha - 2012-03-26
- Tor 0.2.3.13-alpha fixes a variety of stability and correctness bugs
- in managed pluggable transports, as well as providing other cleanups
- that get us closer to a release candidate.
- o Directory authority changes:
- - Change IP address for maatuska (v3 directory authority).
- o Security fixes:
- - Provide controllers with a safer way to implement the cookie
- authentication mechanism. With the old method, if another locally
- running program could convince a controller that it was the Tor
- process, then that program could trick the controller into telling
- it the contents of an arbitrary 32-byte file. The new "SAFECOOKIE"
- authentication method uses a challenge-response approach to prevent
- this attack. Fixes bug 5185, implements proposal 193.
- - Never use a bridge or a controller-supplied node as an exit, even
- if its exit policy allows it. Found by wanoskarnet. Fixes bug
- 5342. Bugfix on 0.1.1.15-rc (for controller-purpose descriptors)
- and 0.2.0.3-alpha (for bridge-purpose descriptors).
- - Only build circuits if we have a sufficient threshold of the total
- descriptors that are marked in the consensus with the "Exit"
- flag. This mitigates an attack proposed by wanoskarnet, in which
- all of a client's bridges collude to restrict the exit nodes that
- the client knows about. Fixes bug 5343.
- o Major bugfixes (on Tor 0.2.3.x):
- - Avoid an assert when managed proxies like obfsproxy are configured,
- and we receive HUP signals or setconf attempts too rapidly. This
- situation happens most commonly when Vidalia tries to attach to
- Tor or tries to configure the Tor it's attached to. Fixes bug 5084;
- bugfix on 0.2.3.6-alpha.
- - Fix a relay-side pluggable transports bug where managed proxies were
- unreachable from the Internet, because Tor asked them to bind on
- localhost. Fixes bug 4725; bugfix on 0.2.3.9-alpha.
- - Stop discarding command-line arguments when TestingTorNetwork
- is set. Discovered by Kevin Bauer. Fixes bug 5373; bugfix on
- 0.2.3.9-alpha, where task 4552 added support for two layers of
- torrc files.
- - Resume allowing the unit tests to run in gdb. This was accidentally
- made impossible when the DisableDebuggerAttachment option was
- introduced. Fixes bug 5448; bugfix on 0.2.3.9-alpha.
- - Resume building with nat-pmp support. Fixes bug 4955; bugfix on
- 0.2.3.11-alpha. Reported by Anthony G. Basile.
- o Minor bugfixes (on 0.2.2.x and earlier):
- - Ensure we don't cannibalize circuits that are longer than three hops
- already, so we don't end up making circuits with 5 or more
- hops. Patch contributed by wanoskarnet. Fixes bug 5231; bugfix on
- 0.1.0.1-rc which introduced cannibalization.
- - Detect and reject certain misformed escape sequences in
- configuration values. Previously, these values would cause us
- to crash if received in a torrc file or over an authenticated
- control port. Bug found by Esteban Manchado Velázquez, and
- independently by Robert Connolly from Matta Consulting who further
- noted that it allows a post-authentication heap overflow. Patch
- by Alexander Schrijver. Fixes bugs 5090 and 5402 (CVE 2012-1668);
- bugfix on 0.2.0.16-alpha.
- - Fix a compile warning when using the --enable-openbsd-malloc
- configure option. Fixes bug 5340; bugfix on 0.2.0.20-rc.
- - Directory caches no longer refuse to clean out descriptors because
- of missing v2 networkstatus documents, unless they're configured
- to retrieve v2 networkstatus documents. Fixes bug 4838; bugfix on
- 0.2.2.26-beta. Patch by Daniel Bryg.
- - Update to the latest version of the tinytest unit testing framework.
- This includes a couple of bugfixes that can be relevant for
- running forked unit tests on Windows, and removes all reserved
- identifiers.
- o Minor bugfixes (on 0.2.3.x):
- - On a failed pipe() call, don't leak file descriptors. Fixes bug
- 4296; bugfix on 0.2.3.1-alpha.
- - Spec conformance: on a v3 handshake, do not send a NETINFO cell
- until after we have received a CERTS cell. Fixes bug 4361; bugfix
- on 0.2.3.6-alpha. Patch by "frosty".
- - When binding to an IPv6 address, set the IPV6_V6ONLY socket
- option, so that the IP stack doesn't decide to use it for IPv4
- too. Fixes bug 4760; bugfix on 0.2.3.9-alpha.
- - Ensure that variables set in Tor's environment cannot override
- environment variables that Tor passes to a managed
- pluggable-transport proxy. Previously, Tor would pass every
- variable in its environment to managed proxies along with the new
- ones, in such a way that on many operating systems, the inherited
- environment variables would override those which Tor tried to
- explicitly set. Bugfix on 0.2.3.12-alpha for most Unixoid systems;
- bugfix on 0.2.3.9-alpha for Windows.
- o Minor features:
- - A wide variety of new unit tests by Esteban Manchado Velázquez.
- - Shorten links in the tor-exit-notice file. Patch by Christian Kujau.
- - Update to the March 6 2012 Maxmind GeoLite Country database.
- Changes in version 0.2.3.12-alpha - 2012-02-13
- Tor 0.2.3.12-alpha lets fast exit relays scale better, allows clients
- to use bridges that run Tor 0.2.2.x, and resolves several big bugs
- when Tor is configured to use a pluggable transport like obfsproxy.
- o Major bugfixes:
- - Fix builds when the path to sed, openssl, or sha1sum contains
- spaces, which is pretty common on Windows. Fixes bug 5065; bugfix
- on 0.2.2.1-alpha.
- - Set the SO_REUSEADDR socket option before we call bind() on outgoing
- connections. This change should allow busy exit relays to stop
- running out of available sockets as quickly. Fixes bug 4950;
- bugfix on 0.2.2.26-beta.
- - Allow 0.2.3.x clients to use 0.2.2.x bridges. Previously the client
- would ask the bridge for microdescriptors, which are only supported
- in 0.2.3.x, and then fail to bootstrap when it didn't get the
- answers it wanted. Fixes bug 4013; bugfix on 0.2.3.2-alpha.
- - Properly set up obfsproxy's environment when in managed mode. The
- Tor Browser Bundle needs LD_LIBRARY_PATH to be passed to obfsproxy,
- and when you run your Tor as a daemon, there's no HOME. Fixes bugs
- 5076 and 5082; bugfix on 0.2.3.6-alpha.
- o Minor features:
- - Use the dead_strip option when building Tor on OS X. This reduces
- binary size by almost 19% when linking openssl and libevent
- statically, which we do for Tor Browser Bundle.
- - Fix broken URLs in the sample torrc file, and tell readers about
- the OutboundBindAddress, ExitPolicyRejectPrivate, and
- PublishServerDescriptor options. Addresses bug 4652.
- - Update to the February 7 2012 Maxmind GeoLite Country database.
- o Minor bugfixes:
- - Downgrade the "We're missing a certificate" message from notice
- to info: people kept mistaking it for a real problem, whereas it
- is seldom the problem even when we are failing to bootstrap. Fixes
- bug 5067; bugfix on 0.2.0.10-alpha.
- - Don't put "TOR_PT_EXTENDED_SERVER_PORT=127.0.0.1:4200" in a
- managed pluggable transport server proxy's environment.
- Previously, we would put it there, even though Tor doesn't
- implement an 'extended server port' yet, and even though Tor
- almost certainly isn't listening at that address. For now, we set
- it to an empty string to avoid crashing older obfsproxies. Bugfix
- on 0.2.3.6-alpha.
- - Log the heartbeat message every HeartbeatPeriod seconds, not every
- HeartbeatPeriod + 1 seconds. Fixes bug 4942; bugfix on
- 0.2.3.1-alpha. Bug reported by Scott Bennett.
- - Calculate absolute paths correctly on Windows. Fixes bug 4973;
- bugfix on 0.2.3.11-alpha.
- - Update "ClientOnly" man page entry to explain that there isn't
- really any point to messing with it. Resolves ticket 5005.
- - Use the correct CVE number for CVE-2011-4576 in our comments and
- log messages. Found by "fermenthor". Resolves bug 5066; bugfix on
- 0.2.3.11-alpha.
- o Code simplifications and refactoring:
- - Use the _WIN32 macro throughout our code to detect Windows.
- (Previously we had used the obsolete 'WIN32' and the idiosyncratic
- 'MS_WINDOWS'.)
- Changes in version 0.2.3.11-alpha - 2012-01-22
- Tor 0.2.3.11-alpha marks feature-freeze for the 0.2.3 tree. It deploys
- the last step of the plan to limit maximum circuit length, includes
- a wide variety of hidden service performance and correctness fixes,
- works around an OpenSSL security flaw if your distro is too stubborn
- to upgrade, and fixes a bunch of smaller issues.
- o Major features:
- - Now that Tor 0.2.0.x is completely deprecated, enable the final
- part of "Proposal 110: Avoiding infinite length circuits" by
- refusing all circuit-extend requests that do not use a relay_early
- cell. This change helps Tor resist a class of denial-of-service
- attacks by limiting the maximum circuit length.
- - Adjust the number of introduction points that a hidden service
- will try to maintain based on how long its introduction points
- remain in use and how many introductions they handle. Fixes
- part of bug 3825.
- - Try to use system facilities for enumerating local interface
- addresses, before falling back to our old approach (which was
- binding a UDP socket, and calling getsockname() on it). That
- approach was scaring OS X users whose draconian firewall
- software warned about binding to UDP sockets, regardless of
- whether packets were sent. Now we try to use getifaddrs(),
- SIOCGIFCONF, or GetAdaptersAddresses(), depending on what the
- system supports. Resolves ticket 1827.
- o Major security workaround:
- - When building or running with any version of OpenSSL earlier
- than 0.9.8s or 1.0.0f, disable SSLv3 support. These OpenSSL
- versions have a bug (CVE-2011-4576) in which their block cipher
- padding includes uninitialized data, potentially leaking sensitive
- information to any peer with whom they make a SSLv3 connection. Tor
- does not use SSL v3 by default, but a hostile client or server
- could force an SSLv3 connection in order to gain information that
- they shouldn't have been able to get. The best solution here is to
- upgrade to OpenSSL 0.9.8s or 1.0.0f (or later). But when building
- or running with a non-upgraded OpenSSL, we disable SSLv3 entirely
- to make sure that the bug can't happen.
- o Major bugfixes:
- - Fix the SOCKET_OK test that we use to tell when socket
- creation fails so that it works on Win64. Fixes part of bug 4533;
- bugfix on 0.2.2.29-beta. Bug found by wanoskarnet.
- - Correct our replacements for the timeradd() and timersub() functions
- on platforms that lack them (for example, Windows). The timersub()
- function is used when expiring circuits, while timeradd() is
- currently unused. Bug report and patch by Vektor. Fixes bug 4778;
- bugfix on 0.2.2.24-alpha and 0.2.3.1-alpha.
- - Do not use OpenSSL 1.0.0's counter mode: it has a critical bug
- that was fixed in OpenSSL 1.0.0a. We test for the counter mode
- bug at runtime, not compile time, because some distributions hack
- their OpenSSL to mis-report its version. Fixes bug 4779; bugfix
- on 0.2.3.9-alpha. Found by Pascal.
- o Minor features (controller):
- - Use absolute path names when reporting the torrc filename in the
- control protocol, so a controller can more easily find the torrc
- file. Resolves bug 1101.
- - Extend the control protocol to report flags that control a circuit's
- path selection in CIRC events and in replies to 'GETINFO
- circuit-status'. Implements part of ticket 2411.
- - Extend the control protocol to report the hidden service address
- and current state of a hidden-service-related circuit in CIRC
- events and in replies to 'GETINFO circuit-status'. Implements part
- of ticket 2411.
- - When reporting the path to the cookie file to the controller,
- give an absolute path. Resolves ticket 4881.
- - Allow controllers to request an event notification whenever a
- circuit is cannibalized or its purpose is changed. Implements
- part of ticket 3457.
- - Include the creation time of a circuit in CIRC and CIRC2
- control-port events and the list produced by the 'GETINFO
- circuit-status' control-port command.
- o Minor features (directory authorities):
- - Directory authorities now reject versions of Tor older than
- 0.2.1.30, and Tor versions between 0.2.2.1-alpha and 0.2.2.20-alpha
- inclusive. These versions accounted for only a small fraction of
- the Tor network, and have numerous known security issues. Resolves
- issue 4788.
- - Authority operators can now vote for all relays in a given
- set of countries to be BadDir/BadExit/Invalid/Rejected.
- - Provide two consensus parameters (FastFlagMinThreshold and
- FastFlagMaxThreshold) to control the range of allowable bandwidths
- for the Fast directory flag. These allow authorities to run
- experiments on appropriate requirements for being a "Fast" node.
- The AuthDirFastGuarantee config value still applies. Implements
- ticket 3946.
- - Document the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays
- directory authority option (introduced in Tor 0.2.2.34).
- o Minor features (other):
- - Don't disable the DirPort when we cannot exceed our AccountingMax
- limit during this interval because the effective bandwidthrate is
- low enough. This is useful in a situation where AccountMax is only
- used as an additional safeguard or to provide statistics.
- - Prepend an informative header to generated dynamic_dh_params files.
- - If EntryNodes are given, but UseEntryGuards is set to 0, warn that
- EntryNodes will have no effect. Resolves issue 2571.
- - Log more useful messages when we fail to disable debugger
- attachment.
- - Log which authority we're missing votes from when we go to fetch
- them from the other auths.
- - Log (at debug level) whenever a circuit's purpose is changed.
- - Add missing documentation for the MaxClientCircuitsPending,
- UseMicrodescriptors, UserspaceIOCPBuffers, and
- _UseFilteringSSLBufferevents options, all introduced during
- the 0.2.3.x series.
- - Update to the January 3 2012 Maxmind GeoLite Country database.
- o Minor bugfixes (hidden services):
- - Don't close hidden service client circuits which have almost
- finished connecting to their destination when they reach
- the normal circuit-build timeout. Previously, we would close
- introduction circuits which are waiting for an acknowledgement
- from the introduction point, and rendezvous circuits which have
- been specified in an INTRODUCE1 cell sent to a hidden service,
- after the normal CBT. Now, we mark them as 'timed out', and launch
- another rendezvous attempt in parallel. This behavior change can
- be disabled using the new CloseHSClientCircuitsImmediatelyOnTimeout
- option. Fixes part of bug 1297; bugfix on 0.2.2.2-alpha.
- - Don't close hidden-service-side rendezvous circuits when they
- reach the normal circuit-build timeout. This behaviour change can
- be disabled using the new
- CloseHSServiceRendCircuitsImmediatelyOnTimeout option. Fixes the
- remaining part of bug 1297; bugfix on 0.2.2.2-alpha.
- - Make sure we never mark the wrong rendezvous circuit as having
- had its introduction cell acknowleged by the introduction-point
- relay. Previously, when we received an INTRODUCE_ACK cell on a
- client-side hidden-service introduction circuit, we might have
- marked a rendezvous circuit other than the one we specified in
- the INTRODUCE1 cell as INTRO_ACKED, which would have produced
- a warning message and interfered with the hidden service
- connection-establishment process. Fixes bug 4759; bugfix on
- 0.2.3.3-alpha, when we added the stream-isolation feature which
- might cause Tor to open multiple rendezvous circuits for the same
- hidden service.
- - Don't trigger an assertion failure when we mark a new client-side
- hidden-service introduction circuit for close during the process
- of creating it. Fixes bug 4796; bugfix on 0.2.3.6-alpha. Reported
- by murb.
- o Minor bugfixes (log messages):
- - Correctly spell "connect" in a log message on failure to create a
- controlsocket. Fixes bug 4803; bugfix on 0.2.2.26-beta and
- 0.2.3.2-alpha.
- - Fix a typo in a log message in rend_service_rendezvous_has_opened().
- Fixes bug 4856; bugfix on Tor 0.0.6.
- - Fix the log message describing how we work around discovering
- that our version is the ill-fated OpenSSL 0.9.8l. Fixes bug
- 4837; bugfix on 0.2.2.9-alpha.
- - When logging about a disallowed .exit name, do not also call it
- an "invalid onion address". Fixes bug 3325; bugfix on 0.2.2.9-alpha.
- o Minor bugfixes (build fixes):
- - During configure, detect when we're building with clang version
- 3.0 or lower and disable the -Wnormalized=id and -Woverride-init
- CFLAGS. clang doesn't support them yet.
- - During configure, search for library containing cos function as
- libm lives in libcore on some platforms (BeOS/Haiku). Linking
- against libm was hard-coded before. Fixes the first part of bug
- 4727; bugfix on 0.2.2.2-alpha. Patch and analysis by Martin Hebnes
- Pedersen.
- - Detect attempts to build Tor on (as yet hypothetical) versions
- of Windows where sizeof(intptr_t) != sizeof(SOCKET). Partial
- fix for bug 4533. Bugfix on 0.2.2.28-beta.
- - Preprocessor directives should not be put inside the arguments
- of a macro. This would break compilation with GCC releases prior
- to version 3.3. We would never recommend such an old GCC version,
- but it is apparently required for binary compatibility on some
- platforms (namely, certain builds of Haiku). Fixes the other part
- of bug 4727; bugfix on 0.2.3.3-alpha. Patch and analysis by Martin
- Hebnes Pedersen.
- o Minor bugfixes (other):
- - Older Linux kernels erroneously respond to strange nmap behavior
- by having accept() return successfully with a zero-length
- socket. When this happens, just close the connection. Previously,
- we would try harder to learn the remote address: but there was
- no such remote address to learn, and our method for trying to
- learn it was incorrect. Fixes bugs 1240, 4745, and 4747. Bugfix
- on 0.1.0.3-rc. Reported and diagnosed by "r1eo".
- - Fix null-pointer access that could occur if TLS allocation failed.
- Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un". This was
- erroneously listed as fixed in 0.2.3.9-alpha, but the fix had
- accidentally been reverted.
- - Fix our implementation of crypto_random_hostname() so it can't
- overflow on ridiculously large inputs. (No Tor version has ever
- provided this kind of bad inputs, but let's be correct in depth.)
- Fixes bug 4413; bugfix on 0.2.2.9-alpha. Fix by Stephen Palmateer.
- - Find more places in the code that should have been testing for
- invalid sockets using the SOCKET_OK macro. Required for a fix
- for bug 4533. Bugfix on 0.2.2.28-beta.
- - Fix an assertion failure when, while running with bufferevents, a
- connection finishes connecting after it is marked for close, but
- before it is closed. Fixes bug 4697; bugfix on 0.2.3.1-alpha.
- - test_util_spawn_background_ok() hardcoded the expected value
- for ENOENT to 2. This isn't portable as error numbers are
- platform specific, and particularly the hurd has ENOENT at
- 0x40000002. Construct expected string at runtime, using the correct
- value for ENOENT. Fixes bug 4733; bugfix on 0.2.3.1-alpha.
- - Reject attempts to disable DisableDebuggerAttachment while Tor is
- running. Fixes bug 4650; bugfix on 0.2.3.9-alpha.
- - Use an appropriate-width type for sockets in tor-fw-helper on
- win64. Fixes bug 1983 at last. Bugfix on 0.2.3.9-alpha.
- o Feature removal:
- - When sending or relaying a RELAY_EARLY cell, we used to convert
- it to a RELAY cell if the connection was using the v1 link
- protocol. This was a workaround for older versions of Tor, which
- didn't handle RELAY_EARLY cells properly. Now that all supported
- versions can handle RELAY_EARLY cells, and now that we're enforcing
- the "no RELAY_EXTEND commands except in RELAY_EARLY cells" rule,
- remove this workaround. Addresses bug 4786.
- o Code simplifications and refactoring:
- - Use OpenSSL's built-in SSL_state_string_long() instead of our
- own homebrewed ssl_state_to_string() replacement. Patch from
- Emile Snyder. Fixes bug 4653.
- - Use macros to indicate OpenSSL versions, so we don't need to worry
- about accidental hexadecimal bit shifts.
- - Remove some workaround code for OpenSSL 0.9.6 (which is no longer
- supported).
- - Convert more instances of tor_snprintf+tor_strdup into tor_asprintf.
- - Use the smartlist_add_asprintf() alias more consistently.
- - Use a TOR_INVALID_SOCKET macro when initializing a socket to an
- invalid value, rather than just -1.
- - Rename a handful of old identifiers, mostly related to crypto
- structures and crypto functions. By convention, our "create an
- object" functions are called "type_new()", our "free an object"
- functions are called "type_free()", and our types indicate that
- they are types only with a final "_t". But a handful of older
- types and functions broke these rules, with function names like
- "type_create" or "subsystem_op_type", or with type names like
- type_env_t.
- Changes in version 0.2.3.10-alpha - 2011-12-16
- Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in
- Tor's buffers code. Absolutely everybody should upgrade.
- The bug relied on an incorrect calculation when making data continuous
- in one of our IO buffers, if the first chunk of the buffer was
- misaligned by just the wrong amount. The miscalculation would allow an
- attacker to overflow a piece of heap-allocated memory. To mount this
- attack, the attacker would need to either open a SOCKS connection to
- Tor's SocksPort (usually restricted to localhost), or target a Tor
- instance configured to make its connections through a SOCKS proxy
- (which Tor does not do by default).
- Good security practice requires that all heap-overflow bugs should be
- presumed to be exploitable until proven otherwise, so we are treating
- this as a potential code execution attack. Please upgrade immediately!
- This bug does not affect bufferevents-based builds of Tor. Special
- thanks to "Vektor" for reporting this issue to us!
- This release also contains a few minor bugfixes for issues discovered
- in 0.2.3.9-alpha.
- o Major bugfixes:
- - Fix a heap overflow bug that could occur when trying to pull
- data into the first chunk of a buffer, when that chunk had
- already had some data drained from it. Fixes CVE-2011-2778;
- bugfix on 0.2.0.16-alpha. Reported by "Vektor".
- o Minor bugfixes:
- - If we can't attach streams to a rendezvous circuit when we
- finish connecting to a hidden service, clear the rendezvous
- circuit's stream-isolation state and try to attach streams
- again. Previously, we cleared rendezvous circuits' isolation
- state either too early (if they were freshly built) or not at all
- (if they had been built earlier and were cannibalized). Bugfix on
- 0.2.3.3-alpha; fixes bug 4655.
- - Fix compilation of the libnatpmp helper on non-Windows. Bugfix on
- 0.2.3.9-alpha; fixes bug 4691. Reported by Anthony G. Basile.
- - Fix an assertion failure when a relay with accounting enabled
- starts up while dormant. Fixes bug 4702; bugfix on 0.2.3.9-alpha.
- o Minor features:
- - Update to the December 6 2011 Maxmind GeoLite Country database.
- Changes in version 0.2.2.35 - 2011-12-16
- Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's
- buffers code. Absolutely everybody should upgrade.
- The bug relied on an incorrect calculation when making data continuous
- in one of our IO buffers, if the first chunk of the buffer was
- misaligned by just the wrong amount. The miscalculation would allow an
- attacker to overflow a piece of heap-allocated memory. To mount this
- attack, the attacker would need to either open a SOCKS connection to
- Tor's SocksPort (usually restricted to localhost), or target a Tor
- instance configured to make its connections through a SOCKS proxy
- (which Tor does not do by default).
- Good security practice requires that all heap-overflow bugs should be
- presumed to be exploitable until proven otherwise, so we are treating
- this as a potential code execution attack. Please upgrade immediately!
- This bug does not affect bufferevents-based builds of Tor. Special
- thanks to "Vektor" for reporting this issue to us!
- Tor 0.2.2.35 also fixes several bugs in previous versions, including
- crash bugs for unusual configurations, and a long-term bug that
- would prevent Tor from starting on Windows machines with draconian
- AV software.
- With this release, we remind everyone that 0.2.0.x has reached its
- formal end-of-life. Those Tor versions have many known flaws, and
- nobody should be using them. You should upgrade -- ideally to the
- 0.2.2.x series. If you're using a Linux or BSD and its packages are
- obsolete, stop using those packages and upgrade anyway.
- The Tor 0.2.1.x series is also approaching its end-of-life: it will no
- longer receive support after some time in early 2012.
- o Major bugfixes:
- - Fix a heap overflow bug that could occur when trying to pull
- data into the first chunk of a buffer, when that chunk had
- already had some data drained from it. Fixes CVE-2011-2778;
- bugfix on 0.2.0.16-alpha. Reported by "Vektor".
- - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so
- that it doesn't attempt to allocate a socketpair. This could cause
- some problems on Windows systems with overzealous firewalls. Fix for
- bug 4457; workaround for Libevent versions 2.0.1-alpha through
- 2.0.15-stable.
- - If we mark an OR connection for close based on a cell we process,
- don't process any further cells on it. We already avoid further
- reads on marked-for-close connections, but now we also discard the
- cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha,
- which was the first version where we might mark a connection for
- close based on processing a cell on it.
- - Correctly sanity-check that we don't underflow on a memory
- allocation (and then assert) for hidden service introduction
- point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
- bugfix on 0.2.1.5-alpha.
- - Fix a memory leak when we check whether a hidden service
- descriptor has any usable introduction points left. Fixes bug
- 4424. Bugfix on 0.2.2.25-alpha.
- - Don't crash when we're running as a relay and don't have a GeoIP
- file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix
- we've had in the 0.2.3.x branch already.
- - When running as a client, do not print a misleading (and plain
- wrong) log message that we're collecting "directory request"
- statistics: clients don't collect statistics. Also don't create a
- useless (because empty) stats file in the stats/ directory. Fixes
- bug 4353; bugfix on 0.2.2.34.
- o Minor bugfixes:
- - Detect failure to initialize Libevent. This fix provides better
- detection for future instances of bug 4457.
- - Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers
- function. This was eating up hideously large amounts of time on some
- busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
- - Resolve an integer overflow bug in smartlist_ensure_capacity().
- Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by
- Mansour Moufid.
- - Don't warn about unused log_mutex in log.c when building with
- --disable-threads using a recent GCC. Fixes bug 4437; bugfix on
- 0.1.0.6-rc which introduced --disable-threads.
- - When configuring, starting, or stopping an NT service, stop
- immediately after the service configuration attempt has succeeded
- or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
- - When sending a NETINFO cell, include the original address
- received for the other side, not its canonical address. Found
- by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
- - Fix a typo in a hibernation-related log message. Fixes bug 4331;
- bugfix on 0.2.2.23-alpha; found by "tmpname0901".
- - Fix a memory leak in launch_direct_bridge_descriptor_fetch() that
- occurred when a client tried to fetch a descriptor for a bridge
- in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
- - Backport fixes for a pair of compilation warnings on Windows.
- Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta.
- - If we had ever tried to call tor_addr_to_str on an address of
- unknown type, we would have done a strdup on an uninitialized
- buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha.
- Reported by "troll_un".
- - Correctly detect and handle transient lookup failures from
- tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha.
- Reported by "troll_un".
- - Fix null-pointer access that could occur if TLS allocation failed.
- Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
- - Use tor_socket_t type for listener argument to accept(). Fixes bug
- 4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
- o Minor features:
- - Add two new config options for directory authorities:
- AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the
- Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold
- that is always sufficient to satisfy the bandwidth requirement for
- the Guard flag. Now it will be easier for researchers to simulate
- Tor networks with different values. Resolves ticket 4484.
- - When Tor ignores a hidden service specified in its configuration,
- include the hidden service's directory in the warning message.
- Previously, we would only tell the user that some hidden service
- was ignored. Bugfix on 0.0.6; fixes bug 4426.
- - Update to the December 6 2011 Maxmind GeoLite Country database.
- o Packaging changes:
- - Make it easier to automate expert package builds on Windows,
- by removing an absolute path from makensis.exe command.
- Changes in version 0.2.1.32 - 2011-12-16
- Tor 0.2.1.32 backports important security and privacy fixes for
- oldstable. This release is intended only for package maintainers and
- others who cannot use the 0.2.2 stable series. All others should be
- using Tor 0.2.2.x or newer.
- The Tor 0.2.1.x series will reach formal end-of-life some time in
- early 2012; we will stop releasing patches for it then.
- o Major bugfixes (also included in 0.2.2.x):
- - Correctly sanity-check that we don't underflow on a memory
- allocation (and then assert) for hidden service introduction
- point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
- bugfix on 0.2.1.5-alpha.
- - Fix a heap overflow bug that could occur when trying to pull
- data into the first chunk of a buffer, when that chunk had
- already had some data drained from it. Fixes CVE-2011-2778;
- bugfix on 0.2.0.16-alpha. Reported by "Vektor".
- o Minor features:
- - Update to the December 6 2011 Maxmind GeoLite Country database.
- Changes in version 0.2.3.9-alpha - 2011-12-08
- Tor 0.2.3.9-alpha introduces initial IPv6 support for bridges, adds
- a "DisableNetwork" security feature that bundles can use to avoid
- touching the network until bridges are configured, moves forward on
- the pluggable transport design, fixes a flaw in the hidden service
- design that unnecessarily prevented clients with wrong clocks from
- reaching hidden services, and fixes a wide variety of other issues.
- o Major features:
- - Clients can now connect to private bridges over IPv6. Bridges
- still need at least one IPv4 address in order to connect to
- other relays. Note that we don't yet handle the case where the
- user has two bridge lines for the same bridge (one IPv4, one
- IPv6). Implements parts of proposal 186.
- - New "DisableNetwork" config option to prevent Tor from launching any
- connections or accepting any connections except on a control port.
- Bundles and controllers can set this option before letting Tor talk
- to the rest of the network, for example to prevent any connections
- to a non-bridge address. Packages like Orbot can also use this
- option to instruct Tor to save power when the network is off.
- - Clients and bridges can now be configured to use a separate
- "transport" proxy. This approach makes the censorship arms race
- easier by allowing bridges to use protocol obfuscation plugins. It
- implements the "managed proxy" part of proposal 180 (ticket 3472).
- - When using OpenSSL 1.0.0 or later, use OpenSSL's counter mode
- implementation. It makes AES_CTR about 7% faster than our old one
- (which was about 10% faster than the one OpenSSL used to provide).
- Resolves ticket 4526.
- - Add a "tor2web mode" for clients that want to connect to hidden
- services non-anonymously (and possibly more quickly). As a safety
- measure to try to keep users from turning this on without knowing
- what they are doing, tor2web mode must be explicitly enabled at
- compile time, and a copy of Tor compiled to run in tor2web mode
- cannot be used as a normal Tor client. Implements feature 2553.
- - Add experimental support for running on Windows with IOCP and no
- kernel-space socket buffers. This feature is controlled by a new
- "UserspaceIOCPBuffers" config option (off by default), which has
- no effect unless Tor has been built with support for bufferevents,
- is running on Windows, and has enabled IOCP. This may, in the long
- run, help solve or mitigate bug 98.
- - Use a more secure consensus parameter voting algorithm. Now at
- least three directory authorities or a majority of them must
- vote on a given parameter before it will be included in the
- consensus. Implements proposal 178.
- o Major bugfixes:
- - Hidden services now ignore the timestamps on INTRODUCE2 cells.
- They used to check that the timestamp was within 30 minutes
- of their system clock, so they could cap the size of their
- replay-detection cache, but that approach unnecessarily refused
- service to clients with wrong clocks. Bugfix on 0.2.1.6-alpha, when
- the v3 intro-point protocol (the first one which sent a timestamp
- field in the INTRODUCE2 cell) was introduced; fixes bug 3460.
- - Only use the EVP interface when AES acceleration is enabled,
- to avoid a 5-7% performance regression. Resolves issue 4525;
- bugfix on 0.2.3.8-alpha.
- o Privacy/anonymity features (bridge detection):
- - Make bridge SSL certificates a bit more stealthy by using random
- serial numbers, in the same fashion as OpenSSL when generating
- self-signed certificates. Implements ticket 4584.
- - Introduce a new config option "DynamicDHGroups", enabled by
- default, which provides each bridge with a unique prime DH modulus
- to be used during SSL handshakes. This option attempts to help
- against censors who might use the Apache DH modulus as a static
- identifier for bridges. Addresses ticket 4548.
- o Minor features (new/different config options):
- - New configuration option "DisableDebuggerAttachment" (on by default)
- to prevent basic debugging attachment attempts by other processes.
- Supports Mac OS X and Gnu/Linux. Resolves ticket 3313.
- - Allow MapAddress directives to specify matches against super-domains,
- as in "MapAddress *.torproject.org *.torproject.org.torserver.exit".
- Implements issue 933.
- - Slightly change behavior of "list" options (that is, config
- options that can appear more than once) when they appear both in
- torrc and on the command line. Previously, the command-line options
- would be appended to the ones from torrc. Now, the command-line
- options override the torrc options entirely. This new behavior
- allows the user to override list options (like exit policies and
- ports to listen on) from the command line, rather than simply
- appending to the list.
- - You can get the old (appending) command-line behavior for "list"
- options by prefixing the option name with a "+".
- - You can remove all the values for a "list" option from the command
- line without adding any new ones by prefixing the option name
- with a "/".
- - Add experimental support for a "defaults" torrc file to be parsed
- before the regular torrc. Torrc options override the defaults file's
- options in the same way that the command line overrides the torrc.
- The SAVECONF controller command saves only those options which
- differ between the current configuration and the defaults file. HUP
- reloads both files. (Note: This is an experimental feature; its
- behavior will probably be refined in future 0.2.3.x-alpha versions
- to better meet packagers' needs.) Implements task 4552.
- o Minor features:
- - Try to make the introductory warning message that Tor prints on
- startup more useful for actually finding help and information.
- Resolves ticket 2474.
- - Running "make version" now displays the version of Tor that
- we're about to build. Idea from katmagic; resolves issue 4400.
- - Expire old or over-used hidden service introduction points.
- Required by fix for bug 3460.
- - Move the replay-detection cache for the RSA-encrypted parts of
- INTRODUCE2 cells to the introduction point data structures.
- Previously, we would use one replay-detection cache per hidden
- service. Required by fix for bug 3460.
- - Reduce the lifetime of elements of hidden services' Diffie-Hellman
- public key replay-detection cache from 60 minutes to 5 minutes. This
- replay-detection cache is now used only to detect multiple
- INTRODUCE2 cells specifying the same rendezvous point, so we can
- avoid launching multiple simultaneous attempts to connect to it.
- o Minor bugfixes (on Tor 0.2.2.x and earlier):
- - Resolve an integer overflow bug in smartlist_ensure_capacity().
- Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by
- Mansour Moufid.
- - Fix a minor formatting issue in one of tor-gencert's error messages.
- Fixes bug 4574.
- - Prevent a false positive from the check-spaces script, by disabling
- the "whitespace between function name and (" check for functions
- named 'op()'.
- - Fix a log message suggesting that people contact a non-existent
- email address. Fixes bug 3448.
- - Fix null-pointer access that could occur if TLS allocation failed.
- Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
- - Report a real bootstrap problem to the controller on router
- identity mismatch. Previously we just said "foo", which probably
- made a lot of sense at the time. Fixes bug 4169; bugfix on
- 0.2.1.1-alpha.
- - If we had ever tried to call tor_addr_to_str() on an address of
- unknown type, we would have done a strdup() on an uninitialized
- buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha.
- Reported by "troll_un".
- - Correctly detect and handle transient lookup failures from
- tor_addr_lookup(). Fixes bug 4530; bugfix on 0.2.1.5-alpha.
- Reported by "troll_un".
- - Use tor_socket_t type for listener argument to accept(). Fixes bug
- 4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
- - Initialize conn->addr to a valid state in spawn_cpuworker(). Fixes
- bug 4532; found by "troll_un".
- o Minor bugfixes (on Tor 0.2.3.x):
- - Fix a compile warning in tor_inet_pton(). Bugfix on 0.2.3.8-alpha;
- fixes bug 4554.
- - Don't send two ESTABLISH_RENDEZVOUS cells when opening a new
- circuit for use as a hidden service client's rendezvous point.
- Fixes bugs 4641 and 4171; bugfix on 0.2.3.3-alpha. Diagnosed
- with help from wanoskarnet.
- - Restore behavior of overriding SocksPort, ORPort, and similar
- options from the command line. Bugfix on 0.2.3.3-alpha.
- o Build fixes:
- - Properly handle the case where the build-tree is not the same
- as the source tree when generating src/common/common_sha1.i,
- src/or/micro-revision.i, and src/or/or_sha1.i. Fixes bug 3953;
- bugfix on 0.2.0.1-alpha.
- o Code simplifications, cleanups, and refactorings:
- - Remove the pure attribute from all functions that used it
- previously. In many cases we assigned it incorrectly, because the
- functions might assert or call impure functions, and we don't have
- evidence that keeping the pure attribute is worthwhile. Implements
- changes suggested in ticket 4421.
- - Remove some dead code spotted by coverity. Fixes cid 432.
- Bugfix on 0.2.3.1-alpha, closes bug 4637.
- Changes in version 0.2.3.8-alpha - 2011-11-22
- Tor 0.2.3.8-alpha fixes some crash and assert bugs, including a
- socketpair-related bug that has been bothering Windows users. It adds
- support to serve microdescriptors to controllers, so Vidalia's network
- map can resume listing relays (once Vidalia implements its side),
- and adds better support for hardware AES acceleration. Finally, it
- starts the process of adjusting the bandwidth cutoff for getting the
- "Fast" flag from 20KB to (currently) 32KB -- preliminary results show
- that tiny relays harm performance more than they help network capacity.
- o Major bugfixes:
- - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so
- that it doesn't attempt to allocate a socketpair. This could cause
- some problems on Windows systems with overzealous firewalls. Fix for
- bug 4457; workaround for Libevent versions 2.0.1-alpha through
- 2.0.15-stable.
- - Correctly sanity-check that we don't underflow on a memory
- allocation (and then assert) for hidden service introduction
- point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
- bugfix on 0.2.1.5-alpha.
- - Remove the artificially low cutoff of 20KB to guarantee the Fast
- flag. In the past few years the average relay speed has picked
- up, and while the "top 7/8 of the network get the Fast flag" and
- "all relays with 20KB or more of capacity get the Fast flag" rules
- used to have the same result, now the top 7/8 of the network has
- a capacity more like 32KB. Bugfix on 0.2.1.14-rc. Fixes bug 4489.
- - Fix a rare assertion failure when checking whether a v0 hidden
- service descriptor has any usable introduction points left, and
- we don't have enough information to build a circuit to the first
- intro point named in the descriptor. The HS client code in
- 0.2.3.x no longer uses v0 HS descriptors, but this assertion can
- trigger on (and crash) v0 HS authorities. Fixes bug 4411.
- Bugfix on 0.2.3.1-alpha; diagnosed by frosty_un.
- - Make bridge authorities not crash when they are asked for their own
- descriptor. Bugfix on 0.2.3.7-alpha, reported by Lucky Green.
- - When running as a client, do not print a misleading (and plain
- wrong) log message that we're collecting "directory request"
- statistics: clients don't collect statistics. Also don't create a
- useless (because empty) stats file in the stats/ directory. Fixes
- bug 4353; bugfix on 0.2.2.34 and 0.2.3.7-alpha.
- o Major features:
- - Allow Tor controllers like Vidalia to obtain the microdescriptor
- for a relay by identity digest or nickname. Previously,
- microdescriptors were only available by their own digests, so a
- controller would have to ask for and parse the whole microdescriptor
- consensus in order to look up a single relay's microdesc. Fixes
- bug 3832; bugfix on 0.2.3.1-alpha.
- - Use OpenSSL's EVP interface for AES encryption, so that all AES
- operations can use hardware acceleration (if present). Resolves
- ticket 4442.
- o Minor bugfixes (on 0.2.2.x and earlier):
- - Detect failure to initialize Libevent. This fix provides better
- detection for future instances of bug 4457.
- - Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers
- function. This was eating up hideously large amounts of time on some
- busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
- - Don't warn about unused log_mutex in log.c when building with
- --disable-threads using a recent GCC. Fixes bug 4437; bugfix on
- 0.1.0.6-rc which introduced --disable-threads.
- - Allow manual 'authenticate' commands to the controller interface
- from netcat (nc) as well as telnet. We were rejecting them because
- they didn't come with the expected whitespace at the end of the
- command. Bugfix on 0.1.1.1-alpha; fixes bug 2893.
- - Fix some (not actually triggerable) buffer size checks in usage of
- tor_inet_ntop. Fixes bug 4434; bugfix on Tor 0.2.0.1-alpha. Patch
- by Anders Sundman.
- - Fix parsing of some corner-cases with tor_inet_pton(). Fixes
- bug 4515; bugfix on 0.2.0.1-alpha; fix by Anders Sundman.
- - When configuring, starting, or stopping an NT service, stop
- immediately after the service configuration attempt has succeeded
- or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
- - When sending a NETINFO cell, include the original address
- received for the other side, not its canonical address. Found
- by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
- - Rename the bench_{aes,dmap} functions to test_*, so that tinytest
- can pick them up when the tests aren't disabled. Bugfix on
- 0.2.2.4-alpha which introduced tinytest.
- - Fix a memory leak when we check whether a hidden service
- descriptor has any usable introduction points left. Fixes bug
- 4424. Bugfix on 0.2.2.25-alpha.
- - Fix a memory leak in launch_direct_bridge_descriptor_fetch() that
- occurred when a client tried to fetch a descriptor for a bridge
- in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
- o Minor bugfixes (on 0.2.3.x):
- - Make util unit tests build correctly with MSVC. Bugfix on
- 0.2.3.3-alpha. Patch by Gisle Vanem.
- - Successfully detect AUTH_CHALLENGE cells with no recognized
- authentication type listed. Fixes bug 4367; bugfix on 0.2.3.6-alpha.
- Found by frosty_un.
- - If a relay receives an AUTH_CHALLENGE cell it can't answer,
- it should still send a NETINFO cell to allow the connection to
- become open. Fixes bug 4368; fix on 0.2.3.6-alpha; bug found by
- "frosty".
- - Log less loudly when we get an invalid authentication certificate
- from a source other than a directory authority: it's not unusual
- to see invalid certs because of clock skew. Fixes bug 4370; bugfix
- on 0.2.3.6-alpha.
- - Tolerate servers with more clock skew in their authentication
- certificates than previously. Fixes bug 4371; bugfix on
- 0.2.3.6-alpha.
- - Fix a couple of compile warnings on Windows. Fixes bug 4469; bugfix
- on 0.2.3.4-alpha and 0.2.3.6-alpha.
- o Minor features:
- - Add two new config options for directory authorities:
- AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the
- Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold
- that is always sufficient to satisfy the bandwidth requirement for
- the Guard flag. Now it will be easier for researchers to simulate
- Tor networks with different values. Resolves ticket 4484.
- - When Tor ignores a hidden service specified in its configuration,
- include the hidden service's directory in the warning message.
- Previously, we would only tell the user that some hidden service
- was ignored. Bugfix on 0.0.6; fixes bug 4426.
- - When we fail to initialize Libevent, retry with IOCP disabled so we
- don't need to turn on multi-threading support in Libevent, which in
- turn requires a working socketpair(). This is a workaround for bug
- 4457, which affects Libevent versions from 2.0.1-alpha through
- 2.0.15-stable.
- - Detect when we try to build on a platform that doesn't define
- AF_UNSPEC to 0. We don't work there, so refuse to compile.
- - Update to the November 1 2011 Maxmind GeoLite Country database.
- o Packaging changes:
- - Make it easier to automate expert package builds on Windows,
- by removing an absolute path from makensis.exe command.
- o Code simplifications and refactoring:
- - Remove some redundant #include directives throughout the code.
- Patch from Andrea Gelmini.
- - Unconditionally use OpenSSL's AES implementation instead of our
- old built-in one. OpenSSL's AES has been better for a while, and
- relatively few servers should still be on any version of OpenSSL
- that doesn't have good optimized assembly AES.
- - Use the name "CERTS" consistently to refer to the new cell type;
- we were calling it CERT in some places and CERTS in others.
- o Testing:
- - Numerous new unit tests for functions in util.c and address.c by
- Anders Sundman.
- - The long-disabled benchmark tests are now split into their own
- ./src/test/bench binary.
- - The benchmark tests can now use more accurate timers than
- gettimeofday() when such timers are available.
- Changes in version 0.2.3.7-alpha - 2011-10-30
- Tor 0.2.3.7-alpha fixes a crash bug in 0.2.3.6-alpha introduced by
- the new v3 handshake. It also resolves yet another bridge address
- enumeration issue.
- o Major bugfixes:
- - If we mark an OR connection for close based on a cell we process,
- don't process any further cells on it. We already avoid further
- reads on marked-for-close connections, but now we also discard the
- cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha,
- which was the first version where we might mark a connection for
- close based on processing a cell on it.
- - Fix a double-free bug that would occur when we received an invalid
- certificate in a CERT cell in the new v3 handshake. Fixes bug 4343;
- bugfix on 0.2.3.6-alpha.
- - Bridges no longer include their address in NETINFO cells on outgoing
- OR connections, to allow them to blend in better with clients.
- Removes another avenue for enumerating bridges. Reported by
- "troll_un". Fixes bug 4348; bugfix on 0.2.0.10-alpha, when NETINFO
- cells were introduced.
- o Trivial fixes:
- - Fixed a typo in a hibernation-related log message. Fixes bug 4331;
- bugfix on 0.2.2.23-alpha; found by "tmpname0901".
- Changes in version 0.2.3.6-alpha - 2011-10-26
- Tor 0.2.3.6-alpha includes the fix from 0.2.2.34 for a critical
- anonymity vulnerability where an attacker can deanonymize Tor
- users. Everybody should upgrade.
- This release also features support for a new v3 connection handshake
- protocol, and fixes to make hidden service connections more robust.
- o Major features:
- - Implement a new handshake protocol (v3) for authenticating Tors to
- each other over TLS. It should be more resistant to fingerprinting
- than previous protocols, and should require less TLS hacking for
- future Tor implementations. Implements proposal 176.
- - Allow variable-length padding cells to disguise the length of
- Tor's TLS records. Implements part of proposal 184.
- o Privacy/anonymity fixes (clients):
- - Clients and bridges no longer send TLS certificate chains on
- outgoing OR connections. Previously, each client or bridge would
- use the same cert chain for all outgoing OR connections until
- its IP address changes, which allowed any relay that the client
- or bridge contacted to determine which entry guards it is using.
- Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by "frosty_un".
- - If a relay receives a CREATE_FAST cell on a TLS connection, it
- no longer considers that connection as suitable for satisfying a
- circuit EXTEND request. Now relays can protect clients from the
- CVE-2011-2768 issue even if the clients haven't upgraded yet.
- - Directory authorities no longer assign the Guard flag to relays
- that haven't upgraded to the above "refuse EXTEND requests
- to client connections" fix. Now directory authorities can
- protect clients from the CVE-2011-2768 issue even if neither
- the clients nor the relays have upgraded yet. There's a new
- "GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays" config option
- to let us transition smoothly, else tomorrow there would be no
- guard relays.
- o Major bugfixes (hidden services):
- - Improve hidden service robustness: when an attempt to connect to
- a hidden service ends, be willing to refetch its hidden service
- descriptors from each of the HSDir relays responsible for them
- immediately. Previously, we would not consider refetching the
- service's descriptors from each HSDir for 15 minutes after the last
- fetch, which was inconvenient if the hidden service was not running
- during the first attempt. Bugfix on 0.2.0.18-alpha; fixes bug 3335.
- - When one of a hidden service's introduction points appears to be
- unreachable, stop trying it. Previously, we would keep trying
- to build circuits to the introduction point until we lost the
- descriptor, usually because the user gave up and restarted Tor.
- Partly fixes bug 3825.
- - Don't launch a useless circuit after failing to use one of a
- hidden service's introduction points. Previously, we would
- launch a new introduction circuit, but not set the hidden service
- which that circuit was intended to connect to, so it would never
- actually be used. A different piece of code would then create a
- new introduction circuit correctly. Bug reported by katmagic and
- found by Sebastian Hahn. Bugfix on 0.2.1.13-alpha; fixes bug 4212.
- o Major bugfixes (other):
- - Bridges now refuse CREATE or CREATE_FAST cells on OR connections
- that they initiated. Relays could distinguish incoming bridge
- connections from client connections, creating another avenue for
- enumerating bridges. Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha.
- Found by "frosty_un".
- - Don't update the AccountingSoftLimitHitAt state file entry whenever
- tor gets started. This prevents a wrong average bandwidth
- estimate, which would cause relays to always start a new accounting
- interval at the earliest possible moment. Fixes bug 2003; bugfix
- on 0.2.2.7-alpha. Reported by BryonEldridge, who also helped
- immensely in tracking this bug down.
- - Fix a crash bug when changing node restrictions while a DNS lookup
- is in-progress. Fixes bug 4259; bugfix on 0.2.2.25-alpha. Bugfix
- by "Tey'".
- o Minor bugfixes (on 0.2.2.x and earlier):
- - When a hidden service turns an extra service-side introduction
- circuit into a general-purpose circuit, free the rend_data and
- intro_key fields first, so we won't leak memory if the circuit
- is cannibalized for use as another service-side introduction
- circuit. Bugfix on 0.2.1.7-alpha; fixes bug 4251.
- - Rephrase the log message emitted if the TestSocks check is
- successful. Patch from Fabian Keil; fixes bug 4094.
- - Bridges now skip DNS self-tests, to act a little more stealthily.
- Fixes bug 4201; bugfix on 0.2.0.3-alpha, which first introduced
- bridges. Patch by "warms0x".
- - Remove a confusing dollar sign from the example fingerprint in the
- man page, and also make the example fingerprint a valid one. Fixes
- bug 4309; bugfix on 0.2.1.3-alpha.
- - Fix internal bug-checking logic that was supposed to catch
- failures in digest generation so that it will fail more robustly
- if we ask for a nonexistent algorithm. Found by Coverity Scan.
- Bugfix on 0.2.2.1-alpha; fixes Coverity CID 479.
- - Report any failure in init_keys() calls launched because our
- IP address has changed. Spotted by Coverity Scan. Bugfix on
- 0.1.1.4-alpha; fixes CID 484.
- o Minor bugfixes (on 0.2.3.x):
- - Fix a bug in configure.in that kept it from building a configure
- script with autoconf versions earlier than 2.61. Fixes bug 2430;
- bugfix on 0.2.3.1-alpha.
- - Don't warn users that they are exposing a client port to the
- Internet if they have specified an RFC1918 address. Previously,
- we would warn if the user had specified any non-loopback
- address. Bugfix on 0.2.3.3-alpha. Fixes bug 4018; reported by Tas.
- - Fix memory leaks in the failing cases of the new SocksPort and
- ControlPort code. Found by Coverity Scan. Bugfix on 0.2.3.3-alpha;
- fixes coverity CIDs 485, 486, and 487.
- o Minor features:
- - When a hidden service's introduction point times out, consider
- trying it again during the next attempt to connect to the
- HS. Previously, we would not try it again unless a newly fetched
- descriptor contained it. Required by fixes for bugs 1297 and 3825.
- - The next version of Windows will be called Windows 8, and it has
- a major version of 6, minor version of 2. Correctly identify that
- version instead of calling it "Very recent version". Resolves
- ticket 4153; reported by funkstar.
- - The Bridge Authority now writes statistics on how many bridge
- descriptors it gave out in total, and how many unique descriptors
- it gave out. It also lists how often the most and least commonly
- fetched descriptors were given out, as well as the median and
- 25th/75th percentile. Implements tickets 4200 and 4294.
- - Update to the October 4 2011 Maxmind GeoLite Country database.
- o Code simplifications and refactoring:
- - Remove some old code to remember statistics about which descriptors
- we've served as a directory mirror. The feature wasn't used and
- is outdated now that microdescriptors are around.
- - Rename Tor functions that turn strings into addresses, so that
- "parse" indicates that no hostname resolution occurs, and
- "lookup" indicates that hostname resolution may occur. This
- should help prevent mistakes in the future. Fixes bug 3512.
- Changes in version 0.2.2.34 - 2011-10-26
- Tor 0.2.2.34 fixes a critical anonymity vulnerability where an attacker
- can deanonymize Tor users. Everybody should upgrade.
- The attack relies on four components: 1) Clients reuse their TLS cert
- when talking to different relays, so relays can recognize a user by
- the identity key in her cert. 2) An attacker who knows the client's
- identity key can probe each guard relay to see if that identity key
- is connected to that guard relay right now. 3) A variety of active
- attacks in the literature (starting from "Low-Cost Traffic Analysis
- of Tor" by Murdoch and Danezis in 2005) allow a malicious website to
- discover the guard relays that a Tor user visiting the website is using.
- 4) Clients typically pick three guards at random, so the set of guards
- for a given user could well be a unique fingerprint for her. This
- release fixes components #1 and #2, which is enough to block the attack;
- the other two remain as open research problems. Special thanks to
- "frosty_un" for reporting the issue to us!
- Clients should upgrade so they are no longer recognizable by the TLS
- certs they present. Relays should upgrade so they no longer allow a
- remote attacker to probe them to test whether unpatched clients are
- currently connected to them.
- This release also fixes several vulnerabilities that allow an attacker
- to enumerate bridge relays. Some bridge enumeration attacks still
- remain; see for example proposal 188.
- o Privacy/anonymity fixes (clients):
- - Clients and bridges no longer send TLS certificate chains on
- outgoing OR connections. Previously, each client or bridge would
- use the same cert chain for all outgoing OR connections until
- its IP address changes, which allowed any relay that the client
- or bridge contacted to determine which entry guards it is using.
- Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by "frosty_un".
- - If a relay receives a CREATE_FAST cell on a TLS connection, it
- no longer considers that connection as suitable for satisfying a
- circuit EXTEND request. Now relays can protect clients from the
- CVE-2011-2768 issue even if the clients haven't upgraded yet.
- - Directory authorities no longer assign the Guard flag to relays
- that haven't upgraded to the above "refuse EXTEND requests
- to client connections" fix. Now directory authorities can
- protect clients from the CVE-2011-2768 issue even if neither
- the clients nor the relays have upgraded yet. There's a new
- "GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays" config option
- to let us transition smoothly, else tomorrow there would be no
- guard relays.
- o Privacy/anonymity fixes (bridge enumeration):
- - Bridge relays now do their directory fetches inside Tor TLS
- connections, like all the other clients do, rather than connecting
- directly to the DirPort like public relays do. Removes another
- avenue for enumerating bridges. Fixes bug 4115; bugfix on 0.2.0.35.
- - Bridges relays now build circuits for themselves in a more similar
- way to how clients build them. Removes another avenue for
- enumerating bridges. Fixes bug 4124; bugfix on 0.2.0.3-alpha,
- when bridges were introduced.
- - Bridges now refuse CREATE or CREATE_FAST cells on OR connections
- that they initiated. Relays could distinguish incoming bridge
- connections from client connections, creating another avenue for
- enumerating bridges. Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha.
- Found by "frosty_un".
- o Major bugfixes:
- - Fix a crash bug when changing node restrictions while a DNS lookup
- is in-progress. Fixes bug 4259; bugfix on 0.2.2.25-alpha. Bugfix
- by "Tey'".
- - Don't launch a useless circuit after failing to use one of a
- hidden service's introduction points. Previously, we would
- launch a new introduction circuit, but not set the hidden service
- which that circuit was intended to connect to, so it would never
- actually be used. A different piece of code would then create a
- new introduction circuit correctly. Bug reported by katmagic and
- found by Sebastian Hahn. Bugfix on 0.2.1.13-alpha; fixes bug 4212.
- o Minor bugfixes:
- - Change an integer overflow check in the OpenBSD_Malloc code so
- that GCC is less likely to eliminate it as impossible. Patch
- from Mansour Moufid. Fixes bug 4059.
- - When a hidden service turns an extra service-side introduction
- circuit into a general-purpose circuit, free the rend_data and
- intro_key fields first, so we won't leak memory if the circuit
- is cannibalized for use as another service-side introduction
- circuit. Bugfix on 0.2.1.7-alpha; fixes bug 4251.
- - Bridges now skip DNS self-tests, to act a little more stealthily.
- Fixes bug 4201; bugfix on 0.2.0.3-alpha, which first introduced
- bridges. Patch by "warms0x".
- - Fix internal bug-checking logic that was supposed to catch
- failures in digest generation so that it will fail more robustly
- if we ask for a nonexistent algorithm. Found by Coverity Scan.
- Bugfix on 0.2.2.1-alpha; fixes Coverity CID 479.
- - Report any failure in init_keys() calls launched because our
- IP address has changed. Spotted by Coverity Scan. Bugfix on
- 0.1.1.4-alpha; fixes CID 484.
- o Minor bugfixes (log messages and documentation):
- - Remove a confusing dollar sign from the example fingerprint in the
- man page, and also make the example fingerprint a valid one. Fixes
- bug 4309; bugfix on 0.2.1.3-alpha.
- - The next version of Windows will be called Windows 8, and it has
- a major version of 6, minor version of 2. Correctly identify that
- version instead of calling it "Very recent version". Resolves
- ticket 4153; reported by funkstar.
- - Downgrade log messages about circuit timeout calibration from
- "notice" to "info": they don't require or suggest any human
- intervention. Patch from Tom Lowenthal. Fixes bug 4063;
- bugfix on 0.2.2.14-alpha.
- o Minor features:
- - Turn on directory request statistics by default and include them in
- extra-info descriptors. Don't break if we have no GeoIP database.
- Backported from 0.2.3.1-alpha; implements ticket 3951.
- - Update to the October 4 2011 Maxmind GeoLite Country database.
- Changes in version 0.2.1.31 - 2011-10-26
- Tor 0.2.1.31 backports important security and privacy fixes for
- oldstable. This release is intended only for package maintainers and
- others who cannot use the 0.2.2 stable series. All others should be
- using Tor 0.2.2.x or newer.
- o Security fixes (also included in 0.2.2.x):
- - Replace all potentially sensitive memory comparison operations
- with versions whose runtime does not depend on the data being
- compared. This will help resist a class of attacks where an
- adversary can use variations in timing information to learn
- sensitive data. Fix for one case of bug 3122. (Safe memcmp
- implementation by Robert Ransom based partially on code by DJB.)
- - Fix an assert in parsing router descriptors containing IPv6
- addresses. This one took down the directory authorities when
- somebody tried some experimental code. Bugfix on 0.2.1.3-alpha.
- o Privacy/anonymity fixes (also included in 0.2.2.x):
- - Clients and bridges no longer send TLS certificate chains on
- outgoing OR connections. Previously, each client or bridge would
- use the same cert chain for all outgoing OR connections until
- its IP address changes, which allowed any relay that the client
- or bridge contacted to determine which entry guards it is using.
- Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by "frosty_un".
- - If a relay receives a CREATE_FAST cell on a TLS connection, it
- no longer considers that connection as suitable for satisfying a
- circuit EXTEND request. Now relays can protect clients from the
- CVE-2011-2768 issue even if the clients haven't upgraded yet.
- - Bridges now refuse CREATE or CREATE_FAST cells on OR connections
- that they initiated. Relays could distinguish incoming bridge
- connections from client connections, creating another avenue for
- enumerating bridges. Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha.
- Found by "frosty_un".
- - When receiving a hidden service descriptor, check that it is for
- the hidden service we wanted. Previously, Tor would store any
- hidden service descriptors that a directory gave it, whether it
- wanted them or not. This wouldn't have let an attacker impersonate
- a hidden service, but it did let directories pre-seed a client
- with descriptors that it didn't want. Bugfix on 0.0.6.
- - Avoid linkability based on cached hidden service descriptors: forget
- all hidden service descriptors cached as a client when processing a
- SIGNAL NEWNYM command. Fixes bug 3000; bugfix on 0.0.6.
- - Make the bridge directory authority refuse to answer directory
- requests for "all" descriptors. It used to include bridge
- descriptors in its answer, which was a major information leak.
- Found by "piebeer". Bugfix on 0.2.0.3-alpha.
- - Don't attach new streams to old rendezvous circuits after SIGNAL
- NEWNYM. Previously, we would keep using an existing rendezvous
- circuit if it remained open (i.e. if it were kept open by a
- long-lived stream, or if a new stream were attached to it before
- Tor could notice that it was old and no longer in use). Bugfix on
- 0.1.1.15-rc; fixes bug 3375.
- o Minor bugfixes (also included in 0.2.2.x):
- - When we restart our relay, we might get a successful connection
- from the outside before we've started our reachability tests,
- triggering a warning: "ORPort found reachable, but I have no
- routerinfo yet. Failing to inform controller of success." This
- bug was harmless unless Tor is running under a controller
- like Vidalia, in which case the controller would never get a
- REACHABILITY_SUCCEEDED status event. Bugfix on 0.1.2.6-alpha;
- fixes bug 1172.
- - Build correctly on OSX with zlib 1.2.4 and higher with all warnings
- enabled. Fixes bug 1526.
- - Remove undocumented option "-F" from tor-resolve: it hasn't done
- anything since 0.2.1.16-rc.
- - Avoid signed/unsigned comparisons by making SIZE_T_CEILING unsigned.
- None of the cases where we did this before were wrong, but by making
- this change we avoid warnings. Fixes bug 2475; bugfix on 0.2.1.28.
- - Fix a rare crash bug that could occur when a client was configured
- with a large number of bridges. Fixes bug 2629; bugfix on
- 0.2.1.2-alpha. Bugfix by trac user "shitlei".
- - Correct the warning displayed when a rendezvous descriptor exceeds
- the maximum size. Fixes bug 2750; bugfix on 0.2.1.5-alpha. Found by
- John Brooks.
- - Fix an uncommon assertion failure when running with DNSPort under
- heavy load. Fixes bug 2933; bugfix on 0.2.0.1-alpha.
- - When warning about missing zlib development packages during compile,
- give the correct package names. Bugfix on 0.2.0.1-alpha.
- - Require that introduction point keys and onion keys have public
- exponent 65537. Bugfix on 0.2.0.10-alpha.
- - Do not crash when our configuration file becomes unreadable, for
- example due to a permissions change, between when we start up
- and when a controller calls SAVECONF. Fixes bug 3135; bugfix
- on 0.0.9pre6.
- - Fix warnings from GCC 4.6's "-Wunused-but-set-variable" option.
- Fixes bug 3208.
- - Always NUL-terminate the sun_path field of a sockaddr_un before
- passing it to the kernel. (Not a security issue: kernels are
- smart enough to reject bad sockaddr_uns.) Found by Coverity;
- CID #428. Bugfix on Tor 0.2.0.3-alpha.
- - Don't stack-allocate the list of supplementary GIDs when we're
- about to log them. Stack-allocating NGROUPS_MAX gid_t elements
- could take up to 256K, which is way too much stack. Found by
- Coverity; CID #450. Bugfix on 0.2.1.7-alpha.
- o Minor bugfixes (only in 0.2.1.x):
- - Resume using micro-version numbers in 0.2.1.x: our Debian packages
- rely on them. Bugfix on 0.2.1.30.
- - Use git revisions instead of svn revisions when generating our
- micro-version numbers. Bugfix on 0.2.1.15-rc; fixes bug 2402.
- o Minor features (also included in 0.2.2.x):
- - Adjust the expiration time on our SSL session certificates to
- better match SSL certs seen in the wild. Resolves ticket 4014.
- - Allow nameservers with IPv6 address. Resolves bug 2574.
- - Update to the October 4 2011 Maxmind GeoLite Country database.
- Changes in version 0.2.3.5-alpha - 2011-09-28
- Tor 0.2.3.5-alpha fixes two bugs that make it possible to enumerate
- bridge relays; fixes an assertion error that many users started hitting
- today; and adds the ability to refill token buckets more often than
- once per second, allowing significant performance improvements.
- o Security fixes:
- - Bridge relays now do their directory fetches inside Tor TLS
- connections, like all the other clients do, rather than connecting
- directly to the DirPort like public relays do. Removes another
- avenue for enumerating bridges. Fixes bug 4115; bugfix on 0.2.0.35.
- - Bridges relays now build circuits for themselves in a more similar
- way to how clients build them. Removes another avenue for
- enumerating bridges. Fixes bug 4124; bugfix on 0.2.0.3-alpha,
- when bridges were introduced.
- o Major bugfixes:
- - Fix an "Assertion md->held_by_node == 1 failed" error that could
- occur when the same microdescriptor was referenced by two node_t
- objects at once. Fix for bug 4118; bugfix on Tor 0.2.3.1-alpha.
- o Major features (networking):
- - Add a new TokenBucketRefillInterval option to refill token buckets
- more frequently than once per second. This should improve network
- performance, alleviate queueing problems, and make traffic less
- bursty. Implements proposal 183; closes ticket 3630. Design by
- Florian Tschorsch and Björn Scheuermann; implementation by
- Florian Tschorsch.
- o Minor bugfixes:
- - Change an integer overflow check in the OpenBSD_Malloc code so
- that GCC is less likely to eliminate it as impossible. Patch
- from Mansour Moufid. Fixes bug 4059.
- o Minor bugfixes (usability):
- - Downgrade log messages about circuit timeout calibration from
- "notice" to "info": they don't require or suggest any human
- intervention. Patch from Tom Lowenthal. Fixes bug 4063;
- bugfix on 0.2.2.14-alpha.
- o Minor features (diagnostics):
- - When the system call to create a listener socket fails, log the
- error message explaining why. This may help diagnose bug 4027.
- Changes in version 0.2.3.4-alpha - 2011-09-13
- Tor 0.2.3.4-alpha includes the fixes from 0.2.2.33, including a slight
- tweak to Tor's TLS handshake that makes relays and bridges that run
- this new version reachable from Iran again. It also fixes a few new
- bugs in 0.2.3.x, and teaches relays to recognize when they're not
- listed in the network consensus and republish.
- o Major bugfixes (also part of 0.2.2.33):
- - Avoid an assertion failure when reloading a configuration with
- TrackExitHosts changes. Found and fixed by 'laruldan'. Fixes bug
- 3923; bugfix on 0.2.2.25-alpha.
- o Minor features (security, also part of 0.2.2.33):
- - Check for replays of the public-key encrypted portion of an
- INTRODUCE1 cell, in addition to the current check for replays of
- the g^x value. This prevents a possible class of active attacks
- by an attacker who controls both an introduction point and a
- rendezvous point, and who uses the malleability of AES-CTR to
- alter the encrypted g^x portion of the INTRODUCE1 cell. We think
- that these attacks is infeasible (requiring the attacker to send
- on the order of zettabytes of altered cells in a short interval),
- but we'd rather block them off in case there are any classes of
- this attack that we missed. Reported by Willem Pinckaers.
- o Minor features (also part of 0.2.2.33):
- - Adjust the expiration time on our SSL session certificates to
- better match SSL certs seen in the wild. Resolves ticket 4014.
- - Change the default required uptime for a relay to be accepted as
- a HSDir (hidden service directory) from 24 hours to 25 hours.
- Improves on 0.2.0.10-alpha; resolves ticket 2649.
- - Add a VoteOnHidServDirectoriesV2 config option to allow directory
- authorities to abstain from voting on assignment of the HSDir
- consensus flag. Related to bug 2649.
- - Update to the September 6 2011 Maxmind GeoLite Country database.
- o Minor bugfixes (also part of 0.2.2.33):
- - Demote the 'replay detected' log message emitted when a hidden
- service receives the same Diffie-Hellman public key in two different
- INTRODUCE2 cells to info level. A normal Tor client can cause that
- log message during its normal operation. Bugfix on 0.2.1.6-alpha;
- fixes part of bug 2442.
- - Demote the 'INTRODUCE2 cell is too {old,new}' log message to info
- level. There is nothing that a hidden service's operator can do
- to fix its clients' clocks. Bugfix on 0.2.1.6-alpha; fixes part
- of bug 2442.
- - Clarify a log message specifying the characters permitted in
- HiddenServiceAuthorizeClient client names. Previously, the log
- message said that "[A-Za-z0-9+-_]" were permitted; that could have
- given the impression that every ASCII character between "+" and "_"
- was permitted. Now we say "[A-Za-z0-9+_-]". Bugfix on 0.2.1.5-alpha.
- o Build fixes (also part of 0.2.2.33):
- - Clean up some code issues that prevented Tor from building on older
- BSDs. Fixes bug 3894; reported by "grarpamp".
- - Search for a platform-specific version of "ar" when cross-compiling.
- Should fix builds on iOS. Resolves bug 3909, found by Marco Bonetti.
- o Major bugfixes:
- - Fix a bug where the SocksPort option (for example) would get
- ignored and replaced by the default if a SocksListenAddress
- option was set. Bugfix on 0.2.3.3-alpha; fixes bug 3936. Fix by
- Fabian Keil.
- o Major features:
- - Relays now try regenerating and uploading their descriptor more
- frequently if they are not listed in the consensus, or if the
- version of their descriptor listed in the consensus is too
- old. This fix should prevent situations where a server declines
- to re-publish itself because it has done so too recently, even
- though the authorities decided not to list its recent-enough
- descriptor. Fix for bug 3327.
- o Minor features:
- - Relays now include a reason for regenerating their descriptors
- in an HTTP header when uploading to the authorities. This will
- make it easier to debug descriptor-upload issues in the future.
- - When starting as root and then changing our UID via the User
- control option, and we have a ControlSocket configured, make sure
- that the ControlSocket is owned by the same account that Tor will
- run under. Implements ticket 3421; fix by Jérémy Bobbio.
- o Minor bugfixes:
- - Abort if tor_vasprintf fails in connection_printf_to_buf (a
- utility function used in the control-port code). This shouldn't
- ever happen unless Tor is completely out of memory, but if it did
- happen and Tor somehow recovered from it, Tor could have sent a log
- message to a control port in the middle of a reply to a controller
- command. Fixes part of bug 3428; bugfix on 0.1.2.3-alpha.
- - Make 'FetchUselessDescriptors' cause all descriptor types and
- all consensus types (including microdescriptors) to get fetched.
- Fixes bug 3851; bugfix on 0.2.3.1-alpha.
- o Code refactoring:
- - Make a new "entry connection" struct as an internal subtype of "edge
- connection", to simplify the code and make exit connections smaller.
- Changes in version 0.2.2.33 - 2011-09-13
- Tor 0.2.2.33 fixes several bugs, and includes a slight tweak to Tor's
- TLS handshake that makes relays and bridges that run this new version
- reachable from Iran again.
- o Major bugfixes:
- - Avoid an assertion failure when reloading a configuration with
- TrackExitHosts changes. Found and fixed by 'laruldan'. Fixes bug
- 3923; bugfix on 0.2.2.25-alpha.
- o Minor features (security):
- - Check for replays of the public-key encrypted portion of an
- INTRODUCE1 cell, in addition to the current check for replays of
- the g^x value. This prevents a possible class of active attacks
- by an attacker who controls both an introduction point and a
- rendezvous point, and who uses the malleability of AES-CTR to
- alter the encrypted g^x portion of the INTRODUCE1 cell. We think
- that these attacks are infeasible (requiring the attacker to send
- on the order of zettabytes of altered cells in a short interval),
- but we'd rather block them off in case there are any classes of
- this attack that we missed. Reported by Willem Pinckaers.
- o Minor features:
- - Adjust the expiration time on our SSL session certificates to
- better match SSL certs seen in the wild. Resolves ticket 4014.
- - Change the default required uptime for a relay to be accepted as
- a HSDir (hidden service directory) from 24 hours to 25 hours.
- Improves on 0.2.0.10-alpha; resolves ticket 2649.
- - Add a VoteOnHidServDirectoriesV2 config option to allow directory
- authorities to abstain from voting on assignment of the HSDir
- consensus flag. Related to bug 2649.
- - Update to the September 6 2011 Maxmind GeoLite Country database.
- o Minor bugfixes (documentation and log messages):
- - Correct the man page to explain that HashedControlPassword and
- CookieAuthentication can both be set, in which case either method
- is sufficient to authenticate to Tor. Bugfix on 0.2.0.7-alpha,
- when we decided to allow these config options to both be set. Issue
- raised by bug 3898.
- - Demote the 'replay detected' log message emitted when a hidden
- service receives the same Diffie-Hellman public key in two different
- INTRODUCE2 cells to info level. A normal Tor client can cause that
- log message during its normal operation. Bugfix on 0.2.1.6-alpha;
- fixes part of bug 2442.
- - Demote the 'INTRODUCE2 cell is too {old,new}' log message to info
- level. There is nothing that a hidden service's operator can do
- to fix its clients' clocks. Bugfix on 0.2.1.6-alpha; fixes part
- of bug 2442.
- - Clarify a log message specifying the characters permitted in
- HiddenServiceAuthorizeClient client names. Previously, the log
- message said that "[A-Za-z0-9+-_]" were permitted; that could have
- given the impression that every ASCII character between "+" and "_"
- was permitted. Now we say "[A-Za-z0-9+_-]". Bugfix on 0.2.1.5-alpha.
- o Build fixes:
- - Provide a substitute implementation of lround() for MSVC, which
- apparently lacks it. Patch from Gisle Vanem.
- - Clean up some code issues that prevented Tor from building on older
- BSDs. Fixes bug 3894; reported by "grarpamp".
- - Search for a platform-specific version of "ar" when cross-compiling.
- Should fix builds on iOS. Resolves bug 3909, found by Marco Bonetti.
- Changes in version 0.2.3.3-alpha - 2011-09-01
- Tor 0.2.3.3-alpha adds a new "stream isolation" feature to improve Tor's
- security, and provides client-side support for the microdescriptor
- and optimistic data features introduced earlier in the 0.2.3.x
- series. It also includes numerous critical bugfixes in the (optional)
- bufferevent-based networking backend.
- o Major features (stream isolation):
- - You can now configure Tor so that streams from different
- applications are isolated on different circuits, to prevent an
- attacker who sees your streams as they leave an exit node from
- linking your sessions to one another. To do this, choose some way
- to distinguish the applications: have them connect to different
- SocksPorts, or have one of them use SOCKS4 while the other uses
- SOCKS5, or have them pass different authentication strings to the
- SOCKS proxy. Then, use the new SocksPort syntax to configure the
- degree of isolation you need. This implements Proposal 171.
- - There's a new syntax for specifying multiple client ports (such as
- SOCKSPort, TransPort, DNSPort, NATDPort): you can now just declare
- multiple *Port entries with full addr:port syntax on each.
- The old *ListenAddress format is still supported, but you can't
- mix it with the new *Port syntax.
- o Major features (other):
- - Enable microdescriptor fetching by default for clients. This allows
- clients to download a much smaller amount of directory information.
- To disable it (and go back to the old-style consensus and
- descriptors), set "UseMicrodescriptors 0" in your torrc file.
- - Tor's firewall-helper feature, introduced in 0.2.3.1-alpha (see the
- "PortForwarding" config option), now supports Windows.
- - When using an exit relay running 0.2.3.x, clients can now
- "optimistically" send data before the exit relay reports that
- the stream has opened. This saves a round trip when starting
- connections where the client speaks first (such as web browsing).
- This behavior is controlled by a consensus parameter (currently
- disabled). To turn it on or off manually, use the "OptimisticData"
- torrc option. Implements proposal 181; code by Ian Goldberg.
- o Major bugfixes (bufferevents, fixes on 0.2.3.1-alpha):
- - When using IOCP on Windows, we need to enable Libevent windows
- threading support.
- - The IOCP backend now works even when the user has not specified
- the (internal, debugging-only) _UseFilteringSSLBufferevents option.
- Fixes part of bug 3752.
- - Correctly record the bytes we've read and written when using
- bufferevents, so that we can include them in our bandwidth history
- and advertised bandwidth. Fixes bug 3803.
- - Apply rate-limiting only at the bottom of a chain of filtering
- bufferevents. This prevents us from filling up internal read
- buffers and violating rate-limits when filtering bufferevents
- are enabled. Fixes part of bug 3804.
- - Add high-watermarks to the output buffers for filtered
- bufferevents. This prevents us from filling up internal write
- buffers and wasting CPU cycles when filtering bufferevents are
- enabled. Fixes part of bug 3804.
- - Correctly notice when data has been written from a bufferevent
- without flushing it completely. Fixes bug 3805.
- - Fix a bug where server-side tunneled bufferevent-based directory
- streams would get closed prematurely. Fixes bug 3814.
- - Fix a use-after-free error with per-connection rate-limiting
- buckets. Fixes bug 3888.
- o Major bugfixes (also part of 0.2.2.31-rc):
- - If we're configured to write our ControlPorts to disk, only write
- them after switching UID and creating the data directory. This way,
- we don't fail when starting up with a nonexistent DataDirectory
- and a ControlPortWriteToFile setting based on that directory. Fixes
- bug 3747; bugfix on Tor 0.2.2.26-beta.
- o Minor features:
- - Added a new CONF_CHANGED event so that controllers can be notified
- of any configuration changes made by other controllers, or by the
- user. Implements ticket 1692.
- - Use evbuffer_copyout() in inspect_evbuffer(). This fixes a memory
- leak when using bufferevents, and lets Libevent worry about how to
- best copy data out of a buffer.
- - Replace files in stats/ rather than appending to them. Now that we
- include statistics in extra-info descriptors, it makes no sense to
- keep old statistics forever. Implements ticket 2930.
- o Minor features (build compatibility):
- - Limited, experimental support for building with nmake and MSVC.
- - Provide a substitute implementation of lround() for MSVC, which
- apparently lacks it. Patch from Gisle Vanem.
- o Minor features (also part of 0.2.2.31-rc):
- - Update to the August 2 2011 Maxmind GeoLite Country database.
- o Minor bugfixes (on 0.2.3.x-alpha):
- - Fix a spurious warning when parsing SOCKS requests with
- bufferevents enabled. Fixes bug 3615; bugfix on 0.2.3.2-alpha.
- - Get rid of a harmless warning that could happen on relays running
- with bufferevents. The warning was caused by someone doing an http
- request to a relay's orport. Also don't warn for a few related
- non-errors. Fixes bug 3700; bugfix on 0.2.3.1-alpha.
- o Minor bugfixes (on 2.2.x and earlier):
- - Correct the man page to explain that HashedControlPassword and
- CookieAuthentication can both be set, in which case either method
- is sufficient to authenticate to Tor. Bugfix on 0.2.0.7-alpha,
- when we decided to allow these config options to both be set. Issue
- raised by bug 3898.
- - The "--quiet" and "--hush" options now apply not only to Tor's
- behavior before logs are configured, but also to Tor's behavior in
- the absense of configured logs. Fixes bug 3550; bugfix on
- 0.2.0.10-alpha.
- o Minor bugfixes (also part of 0.2.2.31-rc):
- - Write several files in text mode, on OSes that distinguish text
- mode from binary mode (namely, Windows). These files are:
- 'buffer-stats', 'dirreq-stats', and 'entry-stats' on relays
- that collect those statistics; 'client_keys' and 'hostname' for
- hidden services that use authentication; and (in the tor-gencert
- utility) newly generated identity and signing keys. Previously,
- we wouldn't specify text mode or binary mode, leading to an
- assertion failure. Fixes bug 3607. Bugfix on 0.2.1.1-alpha (when
- the DirRecordUsageByCountry option which would have triggered
- the assertion failure was added), although this assertion failure
- would have occurred in tor-gencert on Windows in 0.2.0.1-alpha.
- - Selectively disable deprecation warnings on OS X because Lion
- started deprecating the shipped copy of openssl. Fixes bug 3643.
- - Remove an extra pair of quotation marks around the error
- message in control-port STATUS_GENERAL BUG events. Bugfix on
- 0.1.2.6-alpha; fixes bug 3732.
- - When unable to format an address as a string, report its value
- as "???" rather than reusing the last formatted address. Bugfix
- on 0.2.1.5-alpha.
- o Code simplifications and refactoring:
- - Rewrite the listener-selection logic so that parsing which ports
- we want to listen on is now separate from binding to the ports
- we want.
- o Build changes:
- - Building Tor with bufferevent support now requires Libevent
- 2.0.13-stable or later. Previous versions of Libevent had bugs in
- SSL-related bufferevents and related issues that would make Tor
- work badly with bufferevents. Requiring 2.0.13-stable also allows
- Tor with bufferevents to take advantage of Libevent APIs
- introduced after 2.0.8-rc.
- Changes in version 0.2.2.32 - 2011-08-27
- The Tor 0.2.2 release series is dedicated to the memory of Andreas
- Pfitzmann (1958-2010), a pioneer in anonymity and privacy research,
- a founder of the PETS community, a leader in our field, a mentor,
- and a friend. He left us with these words: "I had the possibility
- to contribute to this world that is not as it should be. I hope I
- could help in some areas to make the world a better place, and that
- I could also encourage other people to be engaged in improving the
- world. Please, stay engaged. This world needs you, your love, your
- initiative -- now I cannot be part of that anymore."
- Tor 0.2.2.32, the first stable release in the 0.2.2 branch, is finally
- ready. More than two years in the making, this release features improved
- client performance and hidden service reliability, better compatibility
- for Android, correct behavior for bridges that listen on more than
- one address, more extensible and flexible directory object handling,
- better reporting of network statistics, improved code security, and
- many many other features and bugfixes.
- Changes in version 0.2.2.31-rc - 2011-08-17
- Tor 0.2.2.31-rc is the second and hopefully final release candidate
- for the Tor 0.2.2.x series.
- o Major bugfixes:
- - Remove an extra pair of quotation marks around the error
- message in control-port STATUS_GENERAL BUG events. Bugfix on
- 0.1.2.6-alpha; fixes bug 3732.
- - If we're configured to write our ControlPorts to disk, only write
- them after switching UID and creating the data directory. This way,
- we don't fail when starting up with a nonexistent DataDirectory
- and a ControlPortWriteToFile setting based on that directory. Fixes
- bug 3747; bugfix on Tor 0.2.2.26-beta.
- o Minor features:
- - Update to the August 2 2011 Maxmind GeoLite Country database.
- o Minor bugfixes:
- - Allow GETINFO fingerprint to return a fingerprint even when
- we have not yet built a router descriptor. Fixes bug 3577;
- bugfix on 0.2.0.1-alpha.
- - Write several files in text mode, on OSes that distinguish text
- mode from binary mode (namely, Windows). These files are:
- 'buffer-stats', 'dirreq-stats', and 'entry-stats' on relays
- that collect those statistics; 'client_keys' and 'hostname' for
- hidden services that use authentication; and (in the tor-gencert
- utility) newly generated identity and signing keys. Previously,
- we wouldn't specify text mode or binary mode, leading to an
- assertion failure. Fixes bug 3607. Bugfix on 0.2.1.1-alpha (when
- the DirRecordUsageByCountry option which would have triggered
- the assertion failure was added), although this assertion failure
- would have occurred in tor-gencert on Windows in 0.2.0.1-alpha.
- - Selectively disable deprecation warnings on OS X because Lion
- started deprecating the shipped copy of openssl. Fixes bug 3643.
- - When unable to format an address as a string, report its value
- as "???" rather than reusing the last formatted address. Bugfix
- on 0.2.1.5-alpha.
- Changes in version 0.2.3.2-alpha - 2011-07-18
- Tor 0.2.3.2-alpha introduces two new experimental features:
- microdescriptors and pluggable transports. It also continues cleaning
- up a variety of recently introduced features.
- o Major features:
- - Clients can now use microdescriptors instead of regular descriptors
- to build circuits. Microdescriptors are authority-generated
- summaries of regular descriptors' contents, designed to change
- very rarely (see proposal 158 for details). This feature is
- designed to save bandwidth, especially for clients on slow internet
- connections. It's off by default for now, since nearly no caches
- support it, but it will be on-by-default for clients in a future
- version. You can use the UseMicrodescriptors option to turn it on.
- - Tor clients using bridges can now be configured to use a separate
- 'transport' proxy for each bridge. This approach helps to resist
- censorship by allowing bridges to use protocol obfuscation
- plugins. It implements part of proposal 180. Implements ticket 2841.
- - While we're trying to bootstrap, record how many TLS connections
- fail in each state, and report which states saw the most failures
- in response to any bootstrap failures. This feature may speed up
- diagnosis of censorship events. Implements ticket 3116.
- o Major bugfixes (on 0.2.3.1-alpha):
- - When configuring a large set of nodes in EntryNodes (as with
- 'EntryNodes {cc}' or 'EntryNodes 1.1.1.1/16'), choose only a
- random subset to be guards, and choose them in random
- order. Fixes bug 2798.
- - Tor could crash when remembering a consensus in a non-used consensus
- flavor without having a current consensus set. Fixes bug 3361.
- - Comparing an unknown address to a microdescriptor's shortened exit
- policy would always give a "rejected" result. Fixes bug 3599.
- - Using microdescriptors as a client no longer prevents Tor from
- uploading and downloading hidden service descriptors. Fixes
- bug 3601.
- o Minor features:
- - Allow nameservers with IPv6 address. Resolves bug 2574.
- - Accept attempts to include a password authenticator in the
- handshake, as supported by SOCKS5. This handles SOCKS clients that
- don't know how to omit a password when authenticating. Resolves
- bug 1666.
- - When configuring a large set of nodes in EntryNodes, and there are
- enough of them listed as Guard so that we don't need to consider
- the non-guard entries, prefer the ones listed with the Guard flag.
- - Check for and recover from inconsistency in the microdescriptor
- cache. This will make it harder for us to accidentally free a
- microdescriptor without removing it from the appropriate data
- structures. Fixes issue 3135; issue noted by "wanoskarnet".
- - Log SSL state transitions at log level DEBUG, log domain
- HANDSHAKE. This can be useful for debugging censorship events.
- Implements ticket 3264.
- - Add port 6523 (Gobby) to LongLivedPorts. Patch by intrigeri;
- implements ticket 3439.
- o Minor bugfixes (on 0.2.3.1-alpha):
- - Do not free all general-purpose regular descriptors just
- because microdescriptor use is enabled. Fixes bug 3113.
- - Correctly link libevent_openssl when --enable-static-libevent
- is passed to configure. Fixes bug 3118.
- - Bridges should not complain during their heartbeat log messages that
- they are unlisted in the consensus: that's more or less the point
- of being a bridge. Fixes bug 3183.
- - Report a SIGNAL event to controllers when acting on a delayed
- SIGNAL NEWNYM command. Previously, we would report a SIGNAL
- event to the controller if we acted on a SIGNAL NEWNYM command
- immediately, and otherwise not report a SIGNAL event for the
- command at all. Fixes bug 3349.
- - Fix a crash when handling the SIGNAL controller command or
- reporting ERR-level status events with bufferevents enabled. Found
- by Robert Ransom. Fixes bug 3367.
- - Always ship the tor-fw-helper manpage in our release tarballs.
- Fixes bug 3389. Reported by Stephen Walker.
- - Fix a class of double-mark-for-close bugs when bufferevents
- are enabled. Fixes bug 3403.
- - Update tor-fw-helper to support libnatpmp-20110618. Fixes bug 3434.
- - Add SIGNAL to the list returned by the 'GETINFO events/names'
- control-port command. Fixes part of bug 3465.
- - Prevent using negative indices during unit test runs when read_all()
- fails. Spotted by coverity.
- - Fix a rare memory leak when checking the nodelist without it being
- present. Found by coverity.
- - Only try to download a microdescriptor-flavored consensus from
- a directory cache that provides them.
- o Minor bugfixes (on 0.2.2.x and earlier):
- - Assert that hidden-service-related operations are not performed
- using single-hop circuits. Previously, Tor would assert that
- client-side streams are not attached to single-hop circuits,
- but not that other sensitive operations on the client and service
- side are not performed using single-hop circuits. Fixes bug 3332;
- bugfix on 0.0.6.
- - Don't publish a new relay descriptor when we reload our onion key,
- unless the onion key has actually changed. Fixes bug 3263 and
- resolves another cause of bug 1810. Bugfix on 0.1.1.11-alpha.
- - Allow GETINFO fingerprint to return a fingerprint even when
- we have not yet built a router descriptor. Fixes bug 3577;
- bugfix on 0.2.0.1-alpha.
- - Make 'tor --digests' list hashes of all Tor source files. Bugfix
- on 0.2.2.4-alpha; fixes bug 3427.
- o Code simplification and refactoring:
- - Use tor_sscanf() in place of scanf() in more places through the
- code. This makes us a little more locale-independent, and
- should help shut up code-analysis tools that can't tell
- a safe sscanf string from a dangerous one.
- - Use tt_assert(), not tor_assert(), for checking for test failures.
- This makes the unit tests more able to go on in the event that
- one of them fails.
- - Split connection_about_to_close() into separate functions for each
- connection type.
- o Build changes:
- - On Windows, we now define the _WIN32_WINNT macros only if they
- are not already defined. This lets the person building Tor decide,
- if they want, to require a later version of Windows.
- Changes in version 0.2.2.30-rc - 2011-07-07
- Tor 0.2.2.30-rc is the first release candidate for the Tor 0.2.2.x
- series. It fixes a few smaller bugs, but generally appears stable.
- Please test it and let us know whether it is!
- o Minor bugfixes:
- - Send a SUCCEEDED stream event to the controller when a reverse
- resolve succeeded. Fixes bug 3536; bugfix on 0.0.8pre1. Issue
- discovered by katmagic.
- - Always NUL-terminate the sun_path field of a sockaddr_un before
- passing it to the kernel. (Not a security issue: kernels are
- smart enough to reject bad sockaddr_uns.) Found by Coverity;
- CID #428. Bugfix on Tor 0.2.0.3-alpha.
- - Don't stack-allocate the list of supplementary GIDs when we're
- about to log them. Stack-allocating NGROUPS_MAX gid_t elements
- could take up to 256K, which is way too much stack. Found by
- Coverity; CID #450. Bugfix on 0.2.1.7-alpha.
- - Add BUILDTIMEOUT_SET to the list returned by the 'GETINFO
- events/names' control-port command. Bugfix on 0.2.2.9-alpha;
- fixes part of bug 3465.
- - Fix a memory leak when receiving a descriptor for a hidden
- service we didn't ask for. Found by Coverity; CID #30. Bugfix
- on 0.2.2.26-beta.
- o Minor features:
- - Update to the July 1 2011 Maxmind GeoLite Country database.
- Changes in version 0.2.2.29-beta - 2011-06-20
- Tor 0.2.2.29-beta reverts an accidental behavior change for users who
- have bridge lines in their torrc but don't want to use them; gets
- us closer to having the control socket feature working on Debian;
- and fixes a variety of smaller bugs.
- o Major bugfixes:
- - Revert the UseBridges option to its behavior before 0.2.2.28-beta.
- When we changed the default behavior to "use bridges if any
- are listed in the torrc", we surprised users who had bridges
- in their torrc files but who didn't actually want to use them.
- Partial resolution for bug 3354.
- o Privacy fixes:
- - Don't attach new streams to old rendezvous circuits after SIGNAL
- NEWNYM. Previously, we would keep using an existing rendezvous
- circuit if it remained open (i.e. if it were kept open by a
- long-lived stream, or if a new stream were attached to it before
- Tor could notice that it was old and no longer in use). Bugfix on
- 0.1.1.15-rc; fixes bug 3375.
- o Minor bugfixes:
- - Fix a bug when using ControlSocketsGroupWritable with User. The
- directory's group would be checked against the current group, not
- the configured group. Patch by Jérémy Bobbio. Fixes bug 3393;
- bugfix on 0.2.2.26-beta.
- - Make connection_printf_to_buf()'s behaviour sane. Its callers
- expect it to emit a CRLF iff the format string ends with CRLF;
- it actually emitted a CRLF iff (a) the format string ended with
- CRLF or (b) the resulting string was over 1023 characters long or
- (c) the format string did not end with CRLF *and* the resulting
- string was 1021 characters long or longer. Bugfix on 0.1.1.9-alpha;
- fixes part of bug 3407.
- - Make send_control_event_impl()'s behaviour sane. Its callers
- expect it to always emit a CRLF at the end of the string; it
- might have emitted extra control characters as well. Bugfix on
- 0.1.1.9-alpha; fixes another part of bug 3407.
- - Make crypto_rand_int() check the value of its input correctly.
- Previously, it accepted values up to UINT_MAX, but could return a
- negative number if given a value above INT_MAX+1. Found by George
- Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14.
- - Avoid a segfault when reading a malformed circuit build state
- with more than INT_MAX entries. Found by wanoskarnet. Bugfix on
- 0.2.2.4-alpha.
- - When asked about a DNS record type we don't support via a
- client DNSPort, reply with NOTIMPL rather than an empty
- reply. Patch by intrigeri. Fixes bug 3369; bugfix on 2.0.1-alpha.
- - Fix a rare memory leak during stats writing. Found by coverity.
- o Minor features:
- - Update to the June 1 2011 Maxmind GeoLite Country database.
- o Code simplifications and refactoring:
- - Remove some dead code as indicated by coverity.
- - Remove a few dead assignments during router parsing. Found by
- coverity.
- - Add some forgotten return value checks during unit tests. Found
- by coverity.
- - Don't use 1-bit wide signed bit fields. Found by coverity.
- Changes in version 0.2.2.28-beta - 2011-06-04
- Tor 0.2.2.28-beta makes great progress towards a new stable release: we
- fixed a big bug in whether relays stay in the consensus consistently,
- we moved closer to handling bridges and hidden services correctly,
- and we started the process of better handling the dreaded "my Vidalia
- died, and now my Tor demands a password when I try to reconnect to it"
- usability issue.
- o Major bugfixes:
- - Don't decide to make a new descriptor when receiving a HUP signal.
- This bug has caused a lot of 0.2.2.x relays to disappear from the
- consensus periodically. Fixes the most common case of triggering
- bug 1810; bugfix on 0.2.2.7-alpha.
- - Actually allow nameservers with IPv6 addresses. Fixes bug 2574.
- - Don't try to build descriptors if "ORPort auto" is set and we
- don't know our actual ORPort yet. Fix for bug 3216; bugfix on
- 0.2.2.26-beta.
- - Resolve a crash that occurred when setting BridgeRelay to 1 with
- accounting enabled. Fixes bug 3228; bugfix on 0.2.2.18-alpha.
- - Apply circuit timeouts to opened hidden-service-related circuits
- based on the correct start time. Previously, we would apply the
- circuit build timeout based on time since the circuit's creation;
- it was supposed to be applied based on time since the circuit
- entered its current state. Bugfix on 0.0.6; fixes part of bug 1297.
- - Use the same circuit timeout for client-side introduction
- circuits as for other four-hop circuits, rather than the timeout
- for single-hop directory-fetch circuits; the shorter timeout may
- have been appropriate with the static circuit build timeout in
- 0.2.1.x and earlier, but caused many hidden service access attempts
- to fail with the adaptive CBT introduced in 0.2.2.2-alpha. Bugfix
- on 0.2.2.2-alpha; fixes another part of bug 1297.
- - In ticket 2511 we fixed a case where you could use an unconfigured
- bridge if you had configured it as a bridge the last time you ran
- Tor. Now fix another edge case: if you had configured it as a bridge
- but then switched to a different bridge via the controller, you
- would still be willing to use the old one. Bugfix on 0.2.0.1-alpha;
- fixes bug 3321.
- o Major features:
- - Add an __OwningControllerProcess configuration option and a
- TAKEOWNERSHIP control-port command. Now a Tor controller can ensure
- that when it exits, Tor will shut down. Implements feature 3049.
- - If "UseBridges 1" is set and no bridges are configured, Tor will
- now refuse to build any circuits until some bridges are set.
- If "UseBridges auto" is set, Tor will use bridges if they are
- configured and we are not running as a server, but otherwise will
- make circuits as usual. The new default is "auto". Patch by anonym,
- so the Tails LiveCD can stop automatically revealing you as a Tor
- user on startup.
- o Minor bugfixes:
- - Fix warnings from GCC 4.6's "-Wunused-but-set-variable" option.
- - Remove a trailing asterisk from "exit-policy/default" in the
- output of the control port command "GETINFO info/names". Bugfix
- on 0.1.2.5-alpha.
- - Use a wide type to hold sockets when built for 64-bit Windows builds.
- Fixes bug 3270.
- - Warn when the user configures two HiddenServiceDir lines that point
- to the same directory. Bugfix on 0.0.6 (the version introducing
- HiddenServiceDir); fixes bug 3289.
- - Remove dead code from rend_cache_lookup_v2_desc_as_dir. Fixes
- part of bug 2748; bugfix on 0.2.0.10-alpha.
- - Log malformed requests for rendezvous descriptors as protocol
- warnings, not warnings. Also, use a more informative log message
- in case someone sees it at log level warning without prior
- info-level messages. Fixes the other part of bug 2748; bugfix
- on 0.2.0.10-alpha.
- - Clear the table recording the time of the last request for each
- hidden service descriptor from each HS directory on SIGNAL NEWNYM.
- Previously, we would clear our HS descriptor cache on SIGNAL
- NEWNYM, but if we had previously retrieved a descriptor (or tried
- to) from every directory responsible for it, we would refuse to
- fetch it again for up to 15 minutes. Bugfix on 0.2.2.25-alpha;
- fixes bug 3309.
- - Fix a log message that said "bits" while displaying a value in
- bytes. Found by wanoskarnet. Fixes bug 3318; bugfix on
- 0.2.0.1-alpha.
- - When checking for 1024-bit keys, check for 1024 bits, not 128
- bytes. This allows Tor to correctly discard keys of length 1017
- through 1023. Bugfix on 0.0.9pre5.
- o Minor features:
- - Relays now log the reason for publishing a new relay descriptor,
- so we have a better chance of hunting down instances of bug 1810.
- Resolves ticket 3252.
- - Revise most log messages that refer to nodes by nickname to
- instead use the "$key=nickname at address" format. This should be
- more useful, especially since nicknames are less and less likely
- to be unique. Resolves ticket 3045.
- - Log (at info level) when purging pieces of hidden-service-client
- state because of SIGNAL NEWNYM.
- o Removed options:
- - Remove undocumented option "-F" from tor-resolve: it hasn't done
- anything since 0.2.1.16-rc.
- Changes in version 0.2.2.27-beta - 2011-05-18
- Tor 0.2.2.27-beta fixes a bridge-related stability bug in the previous
- release, and also adds a few more general bugfixes.
- o Major bugfixes:
- - Fix a crash bug when changing bridges in a running Tor process.
- Fixes bug 3213; bugfix on 0.2.2.26-beta.
- - When the controller configures a new bridge, don't wait 10 to 60
- seconds before trying to fetch its descriptor. Bugfix on
- 0.2.0.3-alpha; fixes bug 3198 (suggested by 2355).
- o Minor bugfixes:
- - Require that onion keys have exponent 65537 in microdescriptors too.
- Fixes more of bug 3207; bugfix on 0.2.2.26-beta.
- - Tor used to limit HttpProxyAuthenticator values to 48 characters.
- Changed the limit to 512 characters by removing base64 newlines.
- Fixes bug 2752. Fix by Michael Yakubovich.
- - When a client starts or stops using bridges, never use a circuit
- that was built before the configuration change. This behavior could
- put at risk a user who uses bridges to ensure that her traffic
- only goes to the chosen addresses. Bugfix on 0.2.0.3-alpha; fixes
- bug 3200.
- Changes in version 0.2.2.26-beta - 2011-05-17
- Tor 0.2.2.26-beta fixes a variety of potential privacy problems. It
- also introduces a new "socksport auto" approach that should make it
- easier to run multiple Tors on the same system, and does a lot of
- cleanup to get us closer to a release candidate.
- o Security/privacy fixes:
- - Replace all potentially sensitive memory comparison operations
- with versions whose runtime does not depend on the data being
- compared. This will help resist a class of attacks where an
- adversary can use variations in timing information to learn
- sensitive data. Fix for one case of bug 3122. (Safe memcmp
- implementation by Robert Ransom based partially on code by DJB.)
- - When receiving a hidden service descriptor, check that it is for
- the hidden service we wanted. Previously, Tor would store any
- hidden service descriptors that a directory gave it, whether it
- wanted them or not. This wouldn't have let an attacker impersonate
- a hidden service, but it did let directories pre-seed a client
- with descriptors that it didn't want. Bugfix on 0.0.6.
- - On SIGHUP, do not clear out all TrackHostExits mappings, client
- DNS cache entries, and virtual address mappings: that's what
- NEWNYM is for. Fixes bug 1345; bugfix on 0.1.0.1-rc.
- o Major features:
- - The options SocksPort, ControlPort, and so on now all accept a
- value "auto" that opens a socket on an OS-selected port. A
- new ControlPortWriteToFile option tells Tor to write its
- actual control port or ports to a chosen file. If the option
- ControlPortFileGroupReadable is set, the file is created as
- group-readable. Now users can run two Tor clients on the same
- system without needing to manually mess with parameters. Resolves
- part of ticket 3076.
- - Set SO_REUSEADDR on all sockets, not just listeners. This should
- help busy exit nodes avoid running out of useable ports just
- because all the ports have been used in the near past. Resolves
- issue 2850.
- o Minor features:
- - New "GETINFO net/listeners/(type)" controller command to return
- a list of addresses and ports that are bound for listeners for a
- given connection type. This is useful when the user has configured
- "SocksPort auto" and the controller needs to know which port got
- chosen. Resolves another part of ticket 3076.
- - Add a new ControlSocketsGroupWritable configuration option: when
- it is turned on, ControlSockets are group-writeable by the default
- group of the current user. Patch by Jérémy Bobbio; implements
- ticket 2972.
- - Tor now refuses to create a ControlSocket in a directory that is
- world-readable (or group-readable if ControlSocketsGroupWritable
- is 0). This is necessary because some operating systems do not
- enforce permissions on an AF_UNIX sockets. Permissions on the
- directory holding the socket, however, seems to work everywhere.
- - Rate-limit a warning about failures to download v2 networkstatus
- documents. Resolves part of bug 1352.
- - Backport code from 0.2.3.x that allows directory authorities to
- clean their microdescriptor caches. Needed to resolve bug 2230.
- - When an HTTPS proxy reports "403 Forbidden", we now explain
- what it means rather than calling it an unexpected status code.
- Closes bug 2503. Patch from Michael Yakubovich.
- - Update to the May 1 2011 Maxmind GeoLite Country database.
- o Minor bugfixes:
- - Authorities now clean their microdesc cache periodically and when
- reading from disk initially, not only when adding new descriptors.
- This prevents a bug where we could lose microdescriptors. Bugfix
- on 0.2.2.6-alpha. Fixes bug 2230.
- - Do not crash when our configuration file becomes unreadable, for
- example due to a permissions change, between when we start up
- and when a controller calls SAVECONF. Fixes bug 3135; bugfix
- on 0.0.9pre6.
- - Avoid a bug that would keep us from replacing a microdescriptor
- cache on Windows. (We would try to replace the file while still
- holding it open. That's fine on Unix, but Windows doesn't let us
- do that.) Bugfix on 0.2.2.6-alpha; bug found by wanoskarnet.
- - Add missing explanations for the authority-related torrc options
- RephistTrackTime, BridgePassword, and V3AuthUseLegacyKey in the
- man page. Resolves issue 2379.
- - As an authority, do not upload our own vote or signature set to
- ourself. It would tell us nothing new, and as of 0.2.2.24-alpha,
- it would get flagged as a duplicate. Resolves bug 3026.
- - Accept hidden service descriptors if we think we might be a hidden
- service directory, regardless of what our consensus says. This
- helps robustness, since clients and hidden services can sometimes
- have a more up-to-date view of the network consensus than we do,
- and if they think that the directory authorities list us a HSDir,
- we might actually be one. Related to bug 2732; bugfix on
- 0.2.0.10-alpha.
- - When a controller changes TrackHostExits, remove mappings for
- hosts that should no longer have their exits tracked. Bugfix on
- 0.1.0.1-rc.
- - When a controller changes VirtualAddrNetwork, remove any mappings
- for hosts that were automapped to the old network. Bugfix on
- 0.1.1.19-rc.
- - When a controller changes one of the AutomapHosts* options, remove
- any mappings for hosts that should no longer be automapped. Bugfix
- on 0.2.0.1-alpha.
- - Do not reset the bridge descriptor download status every time we
- re-parse our configuration or get a configuration change. Fixes
- bug 3019; bugfix on 0.2.0.3-alpha.
- o Minor bugfixes (code cleanup):
- - When loading the microdesc journal, remember its current size.
- In 0.2.2, this helps prevent the microdesc journal from growing
- without limit on authorities (who are the only ones to use it in
- 0.2.2). Fixes a part of bug 2230; bugfix on 0.2.2.6-alpha.
- Fix posted by "cypherpunks."
- - The microdesc journal is supposed to get rebuilt only if it is
- at least _half_ the length of the store, not _twice_ the length
- of the store. Bugfix on 0.2.2.6-alpha; fixes part of bug 2230.
- - Fix a potential null-pointer dereference while computing a
- consensus. Bugfix on tor-0.2.0.3-alpha, found with the help of
- clang's analyzer.
- - Avoid a possible null-pointer dereference when rebuilding the mdesc
- cache without actually having any descriptors to cache. Bugfix on
- 0.2.2.6-alpha. Issue discovered using clang's static analyzer.
- - If we fail to compute the identity digest of a v3 legacy keypair,
- warn, and don't use a buffer-full of junk instead. Bugfix on
- 0.2.1.1-alpha; fixes bug 3106.
- - Resolve an untriggerable issue in smartlist_string_num_isin(),
- where if the function had ever in the future been used to check
- for the presence of a too-large number, it would have given an
- incorrect result. (Fortunately, we only used it for 16-bit
- values.) Fixes bug 3175; bugfix on 0.1.0.1-rc.
- - Require that introduction point keys and onion handshake keys
- have a public exponent of 65537. Starts to fix bug 3207; bugfix
- on 0.2.0.10-alpha.
- o Removed features:
- - Caches no longer download and serve v2 networkstatus documents
- unless FetchV2Networkstatus flag is set: these documents haven't
- haven't been used by clients or relays since 0.2.0.x. Resolves
- bug 3022.
- Changes in version 0.2.3.1-alpha - 2011-05-05
- Tor 0.2.3.1-alpha adds some new experimental features, including support
- for an improved network IO backend, IOCP networking on Windows,
- microdescriptor caching, "fast-start" support for streams, and automatic
- home router configuration. There are also numerous internal improvements
- to try to make the code easier for developers to work with.
- This is the first alpha release in a new series, so expect there to be
- bugs. Users who would rather test out a more stable branch should
- stay with 0.2.2.x for now.
- o Major features:
- - Tor can now optionally build with the "bufferevents" buffered IO
- backend provided by Libevent 2. To use this feature, make sure you
- have the latest possible version of Libevent, and pass the
- --enable-bufferevents flag to configure when building Tor from
- source. This feature will make our networking code more flexible,
- let us stack layers on each other, and let us use more efficient
- zero-copy transports where available.
- - As an experimental feature, Tor can use IOCP for networking on Windows.
- Once this code is tuned and optimized, it promises much better
- performance than the select-based backend we've used in the past. To
- try this feature, you must build Tor with Libevent 2, configure Tor
- with the "bufferevents" buffered IO backend, and add "DisableIOCP 0" to
- your torrc. There are known bugs here: only try this if you can help
- debug it as it breaks.
- - The EntryNodes option can now include country codes like {de} or IP
- addresses or network masks. Previously we had disallowed these options
- because we didn't have an efficient way to keep the list up to
- date. Fixes bug 1982, but see bug 2798 for an unresolved issue here.
- - Exit nodes now accept and queue data on not-yet-connected streams.
- Previously, the client wasn't allowed to send data until the stream was
- connected, which slowed down all connections. This change will enable
- clients to perform a "fast-start" on streams and send data without
- having to wait for a confirmation that the stream has opened. (Patch
- from Ian Goldberg; implements the server side of Proposal 174.)
- - Tor now has initial support for automatic port mapping on the many
- home routers that support NAT-PMP or UPnP. (Not yet supported on
- Windows). To build the support code, you'll need to have libnatpnp
- library and/or the libminiupnpc library, and you'll need to enable the
- feature specifically by passing "--enable-upnp" and/or
- "--enable-natpnp" to configure. To turn it on, use the new
- PortForwarding option.
- - Caches now download, cache, and serve multiple "flavors" of the
- consensus, including a flavor that describes microdescriptors.
- - Caches now download, cache, and serve microdescriptors -- small
- summaries of router descriptors that are authenticated by all of the
- directory authorities. Once enough caches are running this code,
- clients will be able to save significant amounts of directory bandwidth
- by downloading microdescriptors instead of router descriptors.
- o Minor features:
- - Make logging resolution configurable with a new LogTimeGranularity
- option, and change the default from 1 millisecond to 1 second.
- Implements enhancement 1668.
- - We log which torrc file we're using on startup. Implements ticket
- 2444.
- - Ordinarily, Tor does not count traffic from private addresses (like
- 127.0.0.1 or 10.0.0.1) when calculating rate limits or accounting.
- There is now a new option, CountPrivateBandwidth, to disable this
- behavior. Patch from Daniel Cagara.
- - New --enable-static-tor configure option for building Tor as
- statically as possible. Idea, general hackery and thoughts from
- Alexei Czeskis, John Gilmore, Jacob Appelbaum. Implements ticket
- 2702.
- - If you set the NumCPUs option to 0, Tor will now try to detect how
- many CPUs you have. This is the new default behavior.
- - Turn on directory request statistics by default and include them in
- extra-info descriptors. Don't break if we have no GeoIP database.
- - Relays that set "ConnDirectionStatistics 1" write statistics on the
- bidirectional use of connections to disk every 24 hours.
- - Add a GeoIP file digest to the extra-info descriptor. Implements
- enhancement 1883.
- - The NodeFamily option -- which let you declare that you want to
- consider nodes to be part of a family whether they list themselves
- that way or not -- now allows IP address ranges and country codes.
- - Add a new 'Heartbeat' log message type to periodically log a message
- describing Tor's status at level Notice. This feature is meant for
- operators who log at notice, and want to make sure that their Tor
- server is still working. Implementation by George Kadianakis.
- o Minor bugfixes (on 0.2.2.25-alpha):
- - When loading the microdesc journal, remember its current size.
- In 0.2.2, this helps prevent the microdesc journal from growing
- without limit on authorities (who are the only ones to use it in
- 0.2.2). Fixes a part of bug 2230; bugfix on 0.2.2.6-alpha.
- Fix posted by "cypherpunks."
- - The microdesc journal is supposed to get rebuilt only if it is
- at least _half_ the length of the store, not _twice_ the length
- of the store. Bugfix on 0.2.2.6-alpha; fixes part of bug 2230.
- - If as an authority we fail to compute the identity digest of a v3
- legacy keypair, warn, and don't use a buffer-full of junk instead.
- Bugfix on 0.2.1.1-alpha; fixes bug 3106.
- - Authorities now clean their microdesc cache periodically and when
- reading from disk initially, not only when adding new descriptors.
- This prevents a bug where we could lose microdescriptors. Bugfix
- on 0.2.2.6-alpha.
- o Minor features (controller):
- - Add a new SIGNAL event to the controller interface so that
- controllers can be notified when Tor handles a signal. Resolves
- issue 1955. Patch by John Brooks.
- - Add a new GETINFO option to get total bytes read and written. Patch
- from pipe, revised by atagar. Resolves ticket 2345.
- - Implement some GETINFO controller fields to provide information about
- the Tor process's pid, euid, username, and resource limits.
- o Build changes:
- - Our build system requires automake 1.6 or later to create the
- Makefile.in files. Previously, you could have used 1.4.
- This only affects developers and people building Tor from git;
- people who build Tor from the source distribution without changing
- the Makefile.am files should be fine.
- - Our autogen.sh script uses autoreconf to launch autoconf, automake, and
- so on. This is more robust against some of the failure modes
- associated with running the autotools pieces on their own.
- o Minor packaging issues:
- - On OpenSUSE, create the /var/run/tor directory on startup if it is not
- already created. Patch from Andreas Stieger. Fixes bug 2573.
- o Code simplifications and refactoring:
- - A major revision to our internal node-selecting and listing logic.
- Tor already had at least two major ways to look at the question of
- "which Tor servers do we know about": a list of router descriptors,
- and a list of entries in the current consensus. With
- microdescriptors, we're adding a third. Having so many systems
- without an abstraction layer over them was hurting the codebase.
- Now, we have a new "node_t" abstraction that presents a consistent
- interface to a client's view of a Tor node, and holds (nearly) all
- of the mutable state formerly in routerinfo_t and routerstatus_t.
- - The helper programs tor-gencert, tor-resolve, and tor-checkkey
- no longer link against Libevent: they never used it, but
- our library structure used to force them to link it.
- o Removed features:
- - Remove some old code to work around even older versions of Tor that
- used forked processes to handle DNS requests. Such versions of Tor
- are no longer in use as servers.
- o Documentation fixes:
- - Correct a broken faq link in the INSTALL file. Fixes bug 2307.
- - Add missing documentation for the authority-related torrc options
- RephistTrackTime, BridgePassword, and V3AuthUseLegacyKey. Resolves
- issue 2379.
- Changes in version 0.2.2.25-alpha - 2011-04-29
- Tor 0.2.2.25-alpha fixes many bugs: hidden service clients are more
- robust, routers no longer overreport their bandwidth, Win7 should crash
- a little less, and NEWNYM (as used by Vidalia's "new identity" button)
- now prevents hidden service-related activity from being linkable. It
- provides more information to Vidalia so you can see if your bridge is
- working. Also, 0.2.2.25-alpha revamps the Entry/Exit/ExcludeNodes and
- StrictNodes configuration options to make them more reliable, more
- understandable, and more regularly applied. If you use those options,
- please see the revised documentation for them in the manual page.
- o Major bugfixes:
- - Relays were publishing grossly inflated bandwidth values because
- they were writing their state files wrong--now they write the
- correct value. Also, resume reading bandwidth history from the
- state file correctly. Fixes bug 2704; bugfix on 0.2.2.23-alpha.
- - Improve hidden service robustness: When we find that we have
- extended a hidden service's introduction circuit to a relay not
- listed as an introduction point in the HS descriptor we currently
- have, retry with an introduction point from the current
- descriptor. Previously we would just give up. Fixes bugs 1024 and
- 1930; bugfix on 0.2.0.10-alpha.
- - Clients now stop trying to use an exit node associated with a given
- destination by TrackHostExits if they fail to reach that exit node.
- Fixes bug 2999. Bugfix on 0.2.0.20-rc.
- - Fix crash bug on platforms where gmtime and localtime can return
- NULL. Windows 7 users were running into this one. Fixes part of bug
- 2077. Bugfix on all versions of Tor. Found by boboper.
- o Security and stability fixes:
- - Don't double-free a parsable, but invalid, microdescriptor, even if
- it is followed in the blob we're parsing by an unparsable
- microdescriptor. Fixes an issue reported in a comment on bug 2954.
- Bugfix on 0.2.2.6-alpha; fix by "cypherpunks".
- - If the Nickname configuration option isn't given, Tor would pick a
- nickname based on the local hostname as the nickname for a relay.
- Because nicknames are not very important in today's Tor and the
- "Unnamed" nickname has been implemented, this is now problematic
- behavior: It leaks information about the hostname without being
- useful at all. Fixes bug 2979; bugfix on 0.1.2.2-alpha, which
- introduced the Unnamed nickname. Reported by tagnaq.
- - Fix an uncommon assertion failure when running with DNSPort under
- heavy load. Fixes bug 2933; bugfix on 0.2.0.1-alpha.
- - Avoid linkability based on cached hidden service descriptors: forget
- all hidden service descriptors cached as a client when processing a
- SIGNAL NEWNYM command. Fixes bug 3000; bugfix on 0.0.6.
- o Major features:
- - Export GeoIP information on bridge usage to controllers even if we
- have not yet been running for 24 hours. Now Vidalia bridge operators
- can get more accurate and immediate feedback about their
- contributions to the network.
- o Major features and bugfixes (node selection):
- - Revise and reconcile the meaning of the ExitNodes, EntryNodes,
- ExcludeEntryNodes, ExcludeExitNodes, ExcludeNodes, and StrictNodes
- options. Previously, we had been ambiguous in describing what
- counted as an "exit" node, and what operations exactly "StrictNodes
- 0" would permit. This created confusion when people saw nodes built
- through unexpected circuits, and made it hard to tell real bugs from
- surprises. Now the intended behavior is:
- . "Exit", in the context of ExitNodes and ExcludeExitNodes, means
- a node that delivers user traffic outside the Tor network.
- . "Entry", in the context of EntryNodes, means a node used as the
- first hop of a multihop circuit. It doesn't include direct
- connections to directory servers.
- . "ExcludeNodes" applies to all nodes.
- . "StrictNodes" changes the behavior of ExcludeNodes only. When
- StrictNodes is set, Tor should avoid all nodes listed in
- ExcludeNodes, even when it will make user requests fail. When
- StrictNodes is *not* set, then Tor should follow ExcludeNodes
- whenever it can, except when it must use an excluded node to
- perform self-tests, connect to a hidden service, provide a
- hidden service, fulfill a .exit request, upload directory
- information, or fetch directory information.
- Collectively, the changes to implement the behavior fix bug 1090.
- - ExcludeNodes now takes precedence over EntryNodes and ExitNodes: if
- a node is listed in both, it's treated as excluded.
- - ExcludeNodes now applies to directory nodes -- as a preference if
- StrictNodes is 0, or an absolute requirement if StrictNodes is 1.
- Don't exclude all the directory authorities and set StrictNodes to 1
- unless you really want your Tor to break.
- - ExcludeNodes and ExcludeExitNodes now override exit enclaving.
- - ExcludeExitNodes now overrides .exit requests.
- - We don't use bridges listed in ExcludeNodes.
- - When StrictNodes is 1:
- . We now apply ExcludeNodes to hidden service introduction points
- and to rendezvous points selected by hidden service users. This
- can make your hidden service less reliable: use it with caution!
- . If we have used ExcludeNodes on ourself, do not try relay
- reachability self-tests.
- . If we have excluded all the directory authorities, we will not
- even try to upload our descriptor if we're a relay.
- . Do not honor .exit requests to an excluded node.
- - Remove a misfeature that caused us to ignore the Fast/Stable flags
- when ExitNodes is set. Bugfix on 0.2.2.7-alpha.
- - When the set of permitted nodes changes, we now remove any mappings
- introduced via TrackExitHosts to now-excluded nodes. Bugfix on
- 0.1.0.1-rc.
- - We never cannibalize a circuit that had excluded nodes on it, even
- if StrictNodes is 0. Bugfix on 0.1.0.1-rc.
- - Revert a change where we would be laxer about attaching streams to
- circuits than when building the circuits. This was meant to prevent
- a set of bugs where streams were never attachable, but our improved
- code here should make this unnecessary. Bugfix on 0.2.2.7-alpha.
- - Keep track of how many times we launch a new circuit to handle a
- given stream. Too many launches could indicate an inconsistency
- between our "launch a circuit to handle this stream" logic and our
- "attach this stream to one of the available circuits" logic.
- - Improve log messages related to excluded nodes.
- o Minor bugfixes:
- - Fix a spurious warning when moving from a short month to a long
- month on relays with month-based BandwidthAccounting. Bugfix on
- 0.2.2.17-alpha; fixes bug 3020.
- - When a client finds that an origin circuit has run out of 16-bit
- stream IDs, we now mark it as unusable for new streams. Previously,
- we would try to close the entire circuit. Bugfix on 0.0.6.
- - Add a forgotten cast that caused a compile warning on OS X 10.6.
- Bugfix on 0.2.2.24-alpha.
- - Be more careful about reporting the correct error from a failed
- connect() system call. Under some circumstances, it was possible to
- look at an incorrect value for errno when sending the end reason.
- Bugfix on 0.1.0.1-rc.
- - Correctly handle an "impossible" overflow cases in connection byte
- counting, where we write or read more than 4GB on an edge connection
- in a single second. Bugfix on 0.1.2.8-beta.
- - Correct the warning displayed when a rendezvous descriptor exceeds
- the maximum size. Fixes bug 2750; bugfix on 0.2.1.5-alpha. Found by
- John Brooks.
- - Clients and hidden services now use HSDir-flagged relays for hidden
- service descriptor downloads and uploads even if the relays have no
- DirPort set and the client has disabled TunnelDirConns. This will
- eventually allow us to give the HSDir flag to relays with no
- DirPort. Fixes bug 2722; bugfix on 0.2.1.6-alpha.
- - Downgrade "no current certificates known for authority" message from
- Notice to Info. Fixes bug 2899; bugfix on 0.2.0.10-alpha.
- - Make the SIGNAL DUMP control-port command work on FreeBSD. Fixes bug
- 2917. Bugfix on 0.1.1.1-alpha.
- - Only limit the lengths of single HS descriptors, even when multiple
- HS descriptors are published to an HSDir relay in a single POST
- operation. Fixes bug 2948; bugfix on 0.2.1.5-alpha. Found by hsdir.
- - Write the current time into the LastWritten line in our state file,
- rather than the time from the previous write attempt. Also, stop
- trying to use a time of -1 in our log statements. Fixes bug 3039;
- bugfix on 0.2.2.14-alpha.
- - Be more consistent in our treatment of file system paths. "~" should
- get expanded to the user's home directory in the Log config option.
- Fixes bug 2971; bugfix on 0.2.0.1-alpha, which introduced the
- feature for the -f and --DataDirectory options.
- o Minor features:
- - Make sure every relay writes a state file at least every 12 hours.
- Previously, a relay could go for weeks without writing its state
- file, and on a crash could lose its bandwidth history, capacity
- estimates, client country statistics, and so on. Addresses bug 3012.
- - Send END_STREAM_REASON_NOROUTE in response to EHOSTUNREACH errors.
- Clients before 0.2.1.27 didn't handle NOROUTE correctly, but such
- clients are already deprecated because of security bugs.
- - Don't allow v0 hidden service authorities to act as clients.
- Required by fix for bug 3000.
- - Ignore SIGNAL NEWNYM commands on relay-only Tor instances. Required
- by fix for bug 3000.
- - Ensure that no empty [dirreq-](read|write)-history lines are added
- to an extrainfo document. Implements ticket 2497.
- o Code simplification and refactoring:
- - Remove workaround code to handle directory responses from servers
- that had bug 539 (they would send HTTP status 503 responses _and_
- send a body too). Since only server versions before
- 0.2.0.16-alpha/0.1.2.19 were affected, there is no longer reason to
- keep the workaround in place.
- - Remove the old 'fuzzy time' logic. It was supposed to be used for
- handling calculations where we have a known amount of clock skew and
- an allowed amount of unknown skew. But we only used it in three
- places, and we never adjusted the known/unknown skew values. This is
- still something we might want to do someday, but if we do, we'll
- want to do it differently.
- - Avoid signed/unsigned comparisons by making SIZE_T_CEILING unsigned.
- None of the cases where we did this before were wrong, but by making
- this change we avoid warnings. Fixes bug 2475; bugfix on 0.2.1.28.
- - Use GetTempDir to find the proper temporary directory location on
- Windows when generating temporary files for the unit tests. Patch by
- Gisle Vanem.
- Changes in version 0.2.2.24-alpha - 2011-04-08
- Tor 0.2.2.24-alpha fixes a variety of bugs, including a big bug that
- prevented Tor clients from effectively using "multihomed" bridges,
- that is, bridges that listen on multiple ports or IP addresses so users
- can continue to use some of their addresses even if others get blocked.
- o Major bugfixes:
- - Fix a bug where bridge users who configure the non-canonical
- address of a bridge automatically switch to its canonical
- address. If a bridge listens at more than one address, it should be
- able to advertise those addresses independently and any non-blocked
- addresses should continue to work. Bugfix on Tor 0.2.0.x. Fixes
- bug 2510.
- - If you configured Tor to use bridge A, and then quit and
- configured Tor to use bridge B instead, it would happily continue
- to use bridge A if it's still reachable. While this behavior is
- a feature if your goal is connectivity, in some scenarios it's a
- dangerous bug. Bugfix on Tor 0.2.0.1-alpha; fixes bug 2511.
- - Directory authorities now use data collected from their own
- uptime observations when choosing whether to assign the HSDir flag
- to relays, instead of trusting the uptime value the relay reports in
- its descriptor. This change helps prevent an attack where a small
- set of nodes with frequently-changing identity keys can blackhole
- a hidden service. (Only authorities need upgrade; others will be
- fine once they do.) Bugfix on 0.2.0.10-alpha; fixes bug 2709.
- o Minor bugfixes:
- - When we restart our relay, we might get a successful connection
- from the outside before we've started our reachability tests,
- triggering a warning: "ORPort found reachable, but I have no
- routerinfo yet. Failing to inform controller of success." This
- bug was harmless unless Tor is running under a controller
- like Vidalia, in which case the controller would never get a
- REACHABILITY_SUCCEEDED status event. Bugfix on 0.1.2.6-alpha;
- fixes bug 1172.
- - Make directory authorities more accurate at recording when
- relays that have failed several reachability tests became
- unreachable, so we can provide more accuracy at assigning Stable,
- Guard, HSDir, etc flags. Bugfix on 0.2.0.6-alpha. Resolves bug 2716.
- - Fix an issue that prevented static linking of libevent on
- some platforms (notably Linux). Fixes bug 2698; bugfix on
- versions 0.2.1.23/0.2.2.8-alpha (the versions introducing
- the --with-static-libevent configure option).
- - We now ask the other side of a stream (the client or the exit)
- for more data on that stream when the amount of queued data on
- that stream dips low enough. Previously, we wouldn't ask the
- other side for more data until either it sent us more data (which
- it wasn't supposed to do if it had exhausted its window!) or we
- had completely flushed all our queued data. This flow control fix
- should improve throughput. Fixes bug 2756; bugfix on the earliest
- released versions of Tor (svn commit r152).
- - Avoid a double-mark-for-free warning when failing to attach a
- transparent proxy connection. (We thought we had fixed this in
- 0.2.2.23-alpha, but it turns out our fix was checking the wrong
- connection.) Fixes bug 2757; bugfix on 0.1.2.1-alpha (the original
- bug) and 0.2.2.23-alpha (the incorrect fix).
- - When warning about missing zlib development packages during compile,
- give the correct package names. Bugfix on 0.2.0.1-alpha.
- o Minor features:
- - Directory authorities now log the source of a rejected POSTed v3
- networkstatus vote.
- - Make compilation with clang possible when using
- --enable-gcc-warnings by removing two warning options that clang
- hasn't implemented yet and by fixing a few warnings. Implements
- ticket 2696.
- - When expiring circuits, use microsecond timers rather than
- one-second timers. This can avoid an unpleasant situation where a
- circuit is launched near the end of one second and expired right
- near the beginning of the next, and prevent fluctuations in circuit
- timeout values.
- - Use computed circuit-build timeouts to decide when to launch
- parallel introduction circuits for hidden services. (Previously,
- we would retry after 15 seconds.)
- - Update to the April 1 2011 Maxmind GeoLite Country database.
- o Packaging fixes:
- - Create the /var/run/tor directory on startup on OpenSUSE if it is
- not already created. Patch from Andreas Stieger. Fixes bug 2573.
- o Documentation changes:
- - Modernize the doxygen configuration file slightly. Fixes bug 2707.
- - Resolve all doxygen warnings except those for missing documentation.
- Fixes bug 2705.
- - Add doxygen documentation for more functions, fields, and types.
- Changes in version 0.2.2.23-alpha - 2011-03-08
- Tor 0.2.2.23-alpha lets relays record their bandwidth history so when
- they restart they don't lose their bandwidth capacity estimate. This
- release also fixes a diverse set of user-facing bugs, ranging from
- relays overrunning their rate limiting to clients falsely warning about
- clock skew to bridge descriptor leaks by our bridge directory authority.
- o Major bugfixes:
- - Stop sending a CLOCK_SKEW controller status event whenever
- we fetch directory information from a relay that has a wrong clock.
- Instead, only inform the controller when it's a trusted authority
- that claims our clock is wrong. Bugfix on 0.1.2.6-alpha; fixes
- the rest of bug 1074.
- - Fix an assert in parsing router descriptors containing IPv6
- addresses. This one took down the directory authorities when
- somebody tried some experimental code. Bugfix on 0.2.1.3-alpha.
- - Make the bridge directory authority refuse to answer directory
- requests for "all" descriptors. It used to include bridge
- descriptors in its answer, which was a major information leak.
- Found by "piebeer". Bugfix on 0.2.0.3-alpha.
- - If relays set RelayBandwidthBurst but not RelayBandwidthRate,
- Tor would ignore their RelayBandwidthBurst setting,
- potentially using more bandwidth than expected. Bugfix on
- 0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug 2470.
- - Ignore and warn if the user mistakenly sets "PublishServerDescriptor
- hidserv" in her torrc. The 'hidserv' argument never controlled
- publication of hidden service descriptors. Bugfix on 0.2.0.1-alpha.
- o Major features:
- - Relays now save observed peak bandwidth throughput rates to their
- state file (along with total usage, which was already saved)
- so that they can determine their correct estimated bandwidth on
- restart. Resolves bug 1863, where Tor relays would reset their
- estimated bandwidth to 0 after restarting.
- - Directory authorities now take changes in router IP address and
- ORPort into account when determining router stability. Previously,
- if a router changed its IP or ORPort, the authorities would not
- treat it as having any downtime for the purposes of stability
- calculation, whereas clients would experience downtime since the
- change could take a while to propagate to them. Resolves issue 1035.
- - Enable Address Space Layout Randomization (ASLR) and Data Execution
- Prevention (DEP) by default on Windows to make it harder for
- attackers to exploit vulnerabilities. Patch from John Brooks.
- o Minor bugfixes (on 0.2.1.x and earlier):
- - Fix a rare crash bug that could occur when a client was configured
- with a large number of bridges. Fixes bug 2629; bugfix on
- 0.2.1.2-alpha. Bugfix by trac user "shitlei".
- - Avoid a double mark-for-free warning when failing to attach a
- transparent proxy connection. Bugfix on 0.1.2.1-alpha. Fixes
- bug 2279.
- - Correctly detect failure to allocate an OpenSSL BIO. Fixes bug 2378;
- found by "cypherpunks". This bug was introduced before the first
- Tor release, in svn commit r110.
- - Country codes aren't supported in EntryNodes until 0.2.3.x, so
- don't mention them in the manpage. Fixes bug 2450; issue
- spotted by keb and G-Lo.
- - Fix a bug in bandwidth history state parsing that could have been
- triggered if a future version of Tor ever changed the timing
- granularity at which bandwidth history is measured. Bugfix on
- Tor 0.1.1.11-alpha.
- - When a relay decides that its DNS is too broken for it to serve
- as an exit server, it advertised itself as a non-exit, but
- continued to act as an exit. This could create accidental
- partitioning opportunities for users. Instead, if a relay is
- going to advertise reject *:* as its exit policy, it should
- really act with exit policy "reject *:*". Fixes bug 2366.
- Bugfix on Tor 0.1.2.5-alpha. Bugfix by user "postman" on trac.
- - In the special case where you configure a public exit relay as your
- bridge, Tor would be willing to use that exit relay as the last
- hop in your circuit as well. Now we fail that circuit instead.
- Bugfix on 0.2.0.12-alpha. Fixes bug 2403. Reported by "piebeer".
- - Fix a bug with our locking implementation on Windows that couldn't
- correctly detect when a file was already locked. Fixes bug 2504,
- bugfix on 0.2.1.6-alpha.
- - Fix IPv6-related connect() failures on some platforms (BSD, OS X).
- Bugfix on 0.2.0.3-alpha; fixes first part of bug 2660. Patch by
- "piebeer".
- - Set target port in get_interface_address6() correctly. Bugfix
- on 0.1.1.4-alpha and 0.2.0.3-alpha; fixes second part of bug 2660.
- - Directory authorities are now more robust to hops back in time
- when calculating router stability. Previously, if a run of uptime
- or downtime appeared to be negative, the calculation could give
- incorrect results. Bugfix on 0.2.0.6-alpha; noticed when fixing
- bug 1035.
- - Fix an assert that got triggered when using the TestingTorNetwork
- configuration option and then issuing a GETINFO config-text control
- command. Fixes bug 2250; bugfix on 0.2.1.2-alpha.
- o Minor bugfixes (on 0.2.2.x):
- - Clients should not weight BadExit nodes as Exits in their node
- selection. Similarly, directory authorities should not count BadExit
- bandwidth as Exit bandwidth when computing bandwidth-weights.
- Bugfix on 0.2.2.10-alpha; fixes bug 2203.
- - Correctly clear our dir_read/dir_write history when there is an
- error parsing any bw history value from the state file. Bugfix on
- Tor 0.2.2.15-alpha.
- - Resolve a bug in verifying signatures of directory objects
- with digests longer than SHA1. Bugfix on 0.2.2.20-alpha.
- Fixes bug 2409. Found by "piebeer".
- - Bridge authorities no longer crash on SIGHUP when they try to
- publish their relay descriptor to themselves. Fixes bug 2572. Bugfix
- on 0.2.2.22-alpha.
- o Minor features:
- - Log less aggressively about circuit timeout changes, and improve
- some other circuit timeout messages. Resolves bug 2004.
- - Log a little more clearly about the times at which we're no longer
- accepting new connections. Resolves bug 2181.
- - Reject attempts at the client side to open connections to private
- IP addresses (like 127.0.0.1, 10.0.0.1, and so on) with
- a randomly chosen exit node. Attempts to do so are always
- ill-defined, generally prevented by exit policies, and usually
- in error. This will also help to detect loops in transparent
- proxy configurations. You can disable this feature by setting
- "ClientRejectInternalAddresses 0" in your torrc.
- - Always treat failure to allocate an RSA key as an unrecoverable
- allocation error.
- - Update to the March 1 2011 Maxmind GeoLite Country database.
- o Minor features (log subsystem):
- - Add documentation for configuring logging at different severities in
- different log domains. We've had this feature since 0.2.1.1-alpha,
- but for some reason it never made it into the manpage. Fixes
- bug 2215.
- - Make it simpler to specify "All log domains except for A and B".
- Previously you needed to say "[*,~A,~B]". Now you can just say
- "[~A,~B]".
- - Add a "LogMessageDomains 1" option to include the domains of log
- messages along with the messages. Without this, there's no way
- to use log domains without reading the source or doing a lot
- of guessing.
- o Packaging changes:
- - Stop shipping the Tor specs files and development proposal documents
- in the tarball. They are now in a separate git repository at
- git://git.torproject.org/torspec.git
- Changes in version 0.2.1.30 - 2011-02-23
- Tor 0.2.1.30 fixes a variety of less critical bugs. The main other
- change is a slight tweak to Tor's TLS handshake that makes relays
- and bridges that run this new version reachable from Iran again.
- We don't expect this tweak will win the arms race long-term, but it
- buys us time until we roll out a better solution.
- o Major bugfixes:
- - Stop sending a CLOCK_SKEW controller status event whenever
- we fetch directory information from a relay that has a wrong clock.
- Instead, only inform the controller when it's a trusted authority
- that claims our clock is wrong. Bugfix on 0.1.2.6-alpha; fixes
- the rest of bug 1074.
- - Fix a bounds-checking error that could allow an attacker to
- remotely crash a directory authority. Bugfix on 0.2.1.5-alpha.
- Found by "piebeer".
- - If relays set RelayBandwidthBurst but not RelayBandwidthRate,
- Tor would ignore their RelayBandwidthBurst setting,
- potentially using more bandwidth than expected. Bugfix on
- 0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug 2470.
- - Ignore and warn if the user mistakenly sets "PublishServerDescriptor
- hidserv" in her torrc. The 'hidserv' argument never controlled
- publication of hidden service descriptors. Bugfix on 0.2.0.1-alpha.
- o Minor features:
- - Adjust our TLS Diffie-Hellman parameters to match those used by
- Apache's mod_ssl.
- - Update to the February 1 2011 Maxmind GeoLite Country database.
- o Minor bugfixes:
- - Check for and reject overly long directory certificates and
- directory tokens before they have a chance to hit any assertions.
- Bugfix on 0.2.1.28. Found by "doorss".
- - Bring the logic that gathers routerinfos and assesses the
- acceptability of circuits into line. This prevents a Tor OP from
- getting locked in a cycle of choosing its local OR as an exit for a
- path (due to a .exit request) and then rejecting the circuit because
- its OR is not listed yet. It also prevents Tor clients from using an
- OR running in the same instance as an exit (due to a .exit request)
- if the OR does not meet the same requirements expected of an OR
- running elsewhere. Fixes bug 1859; bugfix on 0.1.0.1-rc.
- o Packaging changes:
- - Stop shipping the Tor specs files and development proposal documents
- in the tarball. They are now in a separate git repository at
- git://git.torproject.org/torspec.git
- - Do not include Git version tags as though they are SVN tags when
- generating a tarball from inside a repository that has switched
- between branches. Bugfix on 0.2.1.15-rc; fixes bug 2402.
- Changes in version 0.2.2.22-alpha - 2011-01-25
- Tor 0.2.2.22-alpha fixes a few more less-critical security issues. The
- main other change is a slight tweak to Tor's TLS handshake that makes
- relays and bridges that run this new version reachable from Iran again.
- We don't expect this tweak will win the arms race long-term, but it
- will buy us a bit more time until we roll out a better solution.
- o Major bugfixes:
- - Fix a bounds-checking error that could allow an attacker to
- remotely crash a directory authority. Bugfix on 0.2.1.5-alpha.
- Found by "piebeer".
- - Don't assert when changing from bridge to relay or vice versa
- via the controller. The assert happened because we didn't properly
- initialize our keys in this case. Bugfix on 0.2.2.18-alpha; fixes
- bug 2433. Reported by bastik.
- o Minor features:
- - Adjust our TLS Diffie-Hellman parameters to match those used by
- Apache's mod_ssl.
- - Provide a log message stating which geoip file we're parsing
- instead of just stating that we're parsing the geoip file.
- Implements ticket 2432.
- o Minor bugfixes:
- - Check for and reject overly long directory certificates and
- directory tokens before they have a chance to hit any assertions.
- Bugfix on 0.2.1.28 / 0.2.2.20-alpha. Found by "doorss".
- Changes in version 0.2.2.21-alpha - 2011-01-15
- Tor 0.2.2.21-alpha includes all the patches from Tor 0.2.1.29, which
- continues our recent code security audit work. The main fix resolves
- a remote heap overflow vulnerability that can allow remote code
- execution (CVE-2011-0427). Other fixes address a variety of assert
- and crash bugs, most of which we think are hard to exploit remotely.
- o Major bugfixes (security), also included in 0.2.1.29:
- - Fix a heap overflow bug where an adversary could cause heap
- corruption. This bug probably allows remote code execution
- attacks. Reported by "debuger". Fixes CVE-2011-0427. Bugfix on
- 0.1.2.10-rc.
- - Prevent a denial-of-service attack by disallowing any
- zlib-compressed data whose compression factor is implausibly
- high. Fixes part of bug 2324; reported by "doorss".
- - Zero out a few more keys in memory before freeing them. Fixes
- bug 2384 and part of bug 2385. These key instances found by
- "cypherpunks", based on Andrew Case's report about being able
- to find sensitive data in Tor's memory space if you have enough
- permissions. Bugfix on 0.0.2pre9.
- o Major bugfixes (crashes), also included in 0.2.1.29:
- - Prevent calls to Libevent from inside Libevent log handlers.
- This had potential to cause a nasty set of crashes, especially
- if running Libevent with debug logging enabled, and running
- Tor with a controller watching for low-severity log messages.
- Bugfix on 0.1.0.2-rc. Fixes bug 2190.
- - Add a check for SIZE_T_MAX to tor_realloc() to try to avoid
- underflow errors there too. Fixes the other part of bug 2324.
- - Fix a bug where we would assert if we ever had a
- cached-descriptors.new file (or another file read directly into
- memory) of exactly SIZE_T_CEILING bytes. Fixes bug 2326; bugfix
- on 0.2.1.25. Found by doorss.
- - Fix some potential asserts and parsing issues with grossly
- malformed router caches. Fixes bug 2352; bugfix on Tor 0.2.1.27.
- Found by doorss.
- o Minor bugfixes (other), also included in 0.2.1.29:
- - Fix a bug with handling misformed replies to reverse DNS lookup
- requests in DNSPort. Bugfix on Tor 0.2.0.1-alpha. Related to a
- bug reported by doorss.
- - Fix compilation on mingw when a pthreads compatibility library
- has been installed. (We don't want to use it, so we shouldn't
- be including pthread.h.) Fixes bug 2313; bugfix on 0.1.0.1-rc.
- - Fix a bug where we would declare that we had run out of virtual
- addresses when the address space was only half-exhausted. Bugfix
- on 0.1.2.1-alpha.
- - Correctly handle the case where AutomapHostsOnResolve is set but
- no virtual addresses are available. Fixes bug 2328; bugfix on
- 0.1.2.1-alpha. Bug found by doorss.
- - Correctly handle wrapping around when we run out of virtual
- address space. Found by cypherpunks; bugfix on 0.2.0.5-alpha.
- o Minor features, also included in 0.2.1.29:
- - Update to the January 1 2011 Maxmind GeoLite Country database.
- - Introduce output size checks on all of our decryption functions.
- o Build changes, also included in 0.2.1.29:
- - Tor does not build packages correctly with Automake 1.6 and earlier;
- added a check to Makefile.am to make sure that we're building with
- Automake 1.7 or later.
- - The 0.2.1.28 tarball was missing src/common/OpenBSD_malloc_Linux.c
- because we built it with a too-old version of automake. Thus that
- release broke ./configure --enable-openbsd-malloc, which is popular
- among really fast exit relays on Linux.
- o Major bugfixes, new in 0.2.2.21-alpha:
- - Prevent crash/heap corruption when the cbtnummodes consensus
- parameter is set to 0 or large values. Fixes bug 2317; bugfix
- on 0.2.2.14-alpha.
- o Major features, new in 0.2.2.21-alpha:
- - Introduce minimum/maximum values that clients will believe
- from the consensus. Now we'll have a better chance to avoid crashes
- or worse when a consensus param has a weird value.
- o Minor features, new in 0.2.2.21-alpha:
- - Make sure to disable DirPort if running as a bridge. DirPorts aren't
- used on bridges, and it makes bridge scanning somewhat easier.
- - If writing the state file to disk fails, wait up to an hour before
- retrying again, rather than trying again each second. Fixes bug
- 2346; bugfix on Tor 0.1.1.3-alpha.
- - Make Libevent log messages get delivered to controllers later,
- and not from inside the Libevent log handler. This prevents unsafe
- reentrant Libevent calls while still letting the log messages
- get through.
- - Detect platforms that brokenly use a signed size_t, and refuse to
- build there. Found and analyzed by doorss and rransom.
- - Fix a bunch of compile warnings revealed by mingw with gcc 4.5.
- Resolves bug 2314.
- o Minor bugfixes, new in 0.2.2.21-alpha:
- - Handle SOCKS messages longer than 128 bytes long correctly, rather
- than waiting forever for them to finish. Fixes bug 2330; bugfix
- on 0.2.0.16-alpha. Found by doorss.
- - Add assertions to check for overflow in arguments to
- base32_encode() and base32_decode(); fix a signed-unsigned
- comparison there too. These bugs are not actually reachable in Tor,
- but it's good to prevent future errors too. Found by doorss.
- - Correctly detect failures to create DNS requests when using Libevent
- versions before v2. (Before Libevent 2, we used our own evdns
- implementation. Its return values for Libevent's evdns_resolve_*()
- functions are not consistent with those from Libevent.) Fixes bug
- 2363; bugfix on 0.2.2.6-alpha. Found by "lodger".
- o Documentation, new in 0.2.2.21-alpha:
- - Document the default socks host and port (127.0.0.1:9050) for
- tor-resolve.
- Changes in version 0.2.1.29 - 2011-01-15
- Tor 0.2.1.29 continues our recent code security audit work. The main
- fix resolves a remote heap overflow vulnerability that can allow remote
- code execution. Other fixes address a variety of assert and crash bugs,
- most of which we think are hard to exploit remotely.
- o Major bugfixes (security):
- - Fix a heap overflow bug where an adversary could cause heap
- corruption. This bug probably allows remote code execution
- attacks. Reported by "debuger". Fixes CVE-2011-0427. Bugfix on
- 0.1.2.10-rc.
- - Prevent a denial-of-service attack by disallowing any
- zlib-compressed data whose compression factor is implausibly
- high. Fixes part of bug 2324; reported by "doorss".
- - Zero out a few more keys in memory before freeing them. Fixes
- bug 2384 and part of bug 2385. These key instances found by
- "cypherpunks", based on Andrew Case's report about being able
- to find sensitive data in Tor's memory space if you have enough
- permissions. Bugfix on 0.0.2pre9.
- o Major bugfixes (crashes):
- - Prevent calls to Libevent from inside Libevent log handlers.
- This had potential to cause a nasty set of crashes, especially
- if running Libevent with debug logging enabled, and running
- Tor with a controller watching for low-severity log messages.
- Bugfix on 0.1.0.2-rc. Fixes bug 2190.
- - Add a check for SIZE_T_MAX to tor_realloc() to try to avoid
- underflow errors there too. Fixes the other part of bug 2324.
- - Fix a bug where we would assert if we ever had a
- cached-descriptors.new file (or another file read directly into
- memory) of exactly SIZE_T_CEILING bytes. Fixes bug 2326; bugfix
- on 0.2.1.25. Found by doorss.
- - Fix some potential asserts and parsing issues with grossly
- malformed router caches. Fixes bug 2352; bugfix on Tor 0.2.1.27.
- Found by doorss.
- o Minor bugfixes (other):
- - Fix a bug with handling misformed replies to reverse DNS lookup
- requests in DNSPort. Bugfix on Tor 0.2.0.1-alpha. Related to a
- bug reported by doorss.
- - Fix compilation on mingw when a pthreads compatibility library
- has been installed. (We don't want to use it, so we shouldn't
- be including pthread.h.) Fixes bug 2313; bugfix on 0.1.0.1-rc.
- - Fix a bug where we would declare that we had run out of virtual
- addresses when the address space was only half-exhausted. Bugfix
- on 0.1.2.1-alpha.
- - Correctly handle the case where AutomapHostsOnResolve is set but
- no virtual addresses are available. Fixes bug 2328; bugfix on
- 0.1.2.1-alpha. Bug found by doorss.
- - Correctly handle wrapping around to when we run out of virtual
- address space. Found by cypherpunks, bugfix on 0.2.0.5-alpha.
- - The 0.2.1.28 tarball was missing src/common/OpenBSD_malloc_Linux.c
- because we built it with a too-old version of automake. Thus that
- release broke ./configure --enable-openbsd-malloc, which is popular
- among really fast exit relays on Linux.
- o Minor features:
- - Update to the January 1 2011 Maxmind GeoLite Country database.
- - Introduce output size checks on all of our decryption functions.
- o Build changes:
- - Tor does not build packages correctly with Automake 1.6 and earlier;
- added a check to Makefile.am to make sure that we're building with
- Automake 1.7 or later.
- Changes in version 0.2.2.20-alpha - 2010-12-17
- Tor 0.2.2.20-alpha does some code cleanup to reduce the risk of remotely
- exploitable bugs. We also fix a variety of other significant bugs,
- change the IP address for one of our directory authorities, and update
- the minimum version that Tor relays must run to join the network.
- o Major bugfixes:
- - Fix a remotely exploitable bug that could be used to crash instances
- of Tor remotely by overflowing on the heap. Remote-code execution
- hasn't been confirmed, but can't be ruled out. Everyone should
- upgrade. Bugfix on the 0.1.1 series and later.
- - Fix a bug that could break accounting on 64-bit systems with large
- time_t values, making them hibernate for impossibly long intervals.
- Fixes bug 2146. Bugfix on 0.0.9pre6; fix by boboper.
- - Fix a logic error in directory_fetches_from_authorities() that
- would cause all _non_-exits refusing single-hop-like circuits
- to fetch from authorities, when we wanted to have _exits_ fetch
- from authorities. Fixes more of 2097. Bugfix on 0.2.2.16-alpha;
- fix by boboper.
- - Fix a stream fairness bug that would cause newer streams on a given
- circuit to get preference when reading bytes from the origin or
- destination. Fixes bug 2210. Fix by Mashael AlSabah. This bug was
- introduced before the first Tor release, in svn revision r152.
- o Directory authority changes:
- - Change IP address and ports for gabelmoo (v3 directory authority).
- o Minor bugfixes:
- - Avoid crashes when AccountingMax is set on clients. Fixes bug 2235.
- Bugfix on 0.2.2.18-alpha. Diagnosed by boboper.
- - Fix an off-by-one error in calculating some controller command
- argument lengths. Fortunately, this mistake is harmless since
- the controller code does redundant NUL termination too. Found by
- boboper. Bugfix on 0.1.1.1-alpha.
- - Do not dereference NULL if a bridge fails to build its
- extra-info descriptor. Found by an anonymous commenter on
- Trac. Bugfix on 0.2.2.19-alpha.
- o Minor features:
- - Update to the December 1 2010 Maxmind GeoLite Country database.
- - Directory authorities now reject relays running any versions of
- Tor between 0.2.1.3-alpha and 0.2.1.18 inclusive; they have
- known bugs that keep RELAY_EARLY cells from working on rendezvous
- circuits. Followup to fix for bug 2081.
- - Directory authorities now reject relays running any version of Tor
- older than 0.2.0.26-rc. That version is the earliest that fetches
- current directory information correctly. Fixes bug 2156.
- - Report only the top 10 ports in exit-port stats in order not to
- exceed the maximum extra-info descriptor length of 50 KB. Implements
- task 2196.
- Changes in version 0.2.1.28 - 2010-12-17
- Tor 0.2.1.28 does some code cleanup to reduce the risk of remotely
- exploitable bugs. We also took this opportunity to change the IP address
- for one of our directory authorities, and to update the geoip database
- we ship.
- o Major bugfixes:
- - Fix a remotely exploitable bug that could be used to crash instances
- of Tor remotely by overflowing on the heap. Remote-code execution
- hasn't been confirmed, but can't be ruled out. Everyone should
- upgrade. Bugfix on the 0.1.1 series and later.
- o Directory authority changes:
- - Change IP address and ports for gabelmoo (v3 directory authority).
- o Minor features:
- - Update to the December 1 2010 Maxmind GeoLite Country database.
- Changes in version 0.2.1.27 - 2010-11-23
- Yet another OpenSSL security patch broke its compatibility with Tor:
- Tor 0.2.1.27 makes relays work with openssl 0.9.8p and 1.0.0.b. We
- also took this opportunity to fix several crash bugs, integrate a new
- directory authority, and update the bundled GeoIP database.
- o Major bugfixes:
- - Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
- No longer set the tlsext_host_name extension on server SSL objects;
- but continue to set it on client SSL objects. Our goal in setting
- it was to imitate a browser, not a vhosting server. Fixes bug 2204;
- bugfix on 0.2.1.1-alpha.
- - Do not log messages to the controller while shrinking buffer
- freelists. Doing so would sometimes make the controller connection
- try to allocate a buffer chunk, which would mess up the internals
- of the freelist and cause an assertion failure. Fixes bug 1125;
- fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
- - Learn our external IP address when we're a relay or bridge, even if
- we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
- where we introduced bridge relays that don't need to publish to
- be useful. Fixes bug 2050.
- - Do even more to reject (and not just ignore) annotations on
- router descriptors received anywhere but from the cache. Previously
- we would ignore such annotations at first, but cache them to disk
- anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
- - When you're using bridges and your network goes away and your
- bridges get marked as down, recover when you attempt a new socks
- connection (if the network is back), rather than waiting up to an
- hour to try fetching new descriptors for your bridges. Bugfix on
- 0.2.0.3-alpha; fixes bug 1981.
- o Major features:
- - Move to the November 2010 Maxmind GeoLite country db (rather
- than the June 2009 ip-to-country GeoIP db) for our statistics that
- count how many users relays are seeing from each country. Now we'll
- have more accurate data, especially for many African countries.
- o New directory authorities:
- - Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
- authority.
- o Minor bugfixes:
- - Fix an assertion failure that could occur in directory caches or
- bridge users when using a very short voting interval on a testing
- network. Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on
- 0.2.0.8-alpha.
- - Enforce multiplicity rules when parsing annotations. Bugfix on
- 0.2.0.8-alpha. Found by piebeer.
- - Allow handshaking OR connections to take a full KeepalivePeriod
- seconds to handshake. Previously, we would close them after
- IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
- were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
- for analysis help.
- - When building with --enable-gcc-warnings on OpenBSD, disable
- warnings in system headers. This makes --enable-gcc-warnings
- pass on OpenBSD 4.8.
- o Minor features:
- - Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
- and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
- stream ending reason for this case: END_STREAM_REASON_NOROUTE.
- Servers can start sending this code when enough clients recognize
- it. Bugfix on 0.1.0.1-rc; fixes part of bug 1793.
- - Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
- Patch from mingw-san.
- o Removed files:
- - Remove the old debian/ directory from the main Tor distribution.
- The official Tor-for-debian git repository lives at the URL
- https://git.torproject.org/debian/tor.git
- - Stop shipping the old doc/website/ directory in the tarball. We
- changed the website format in late 2010, and what we shipped in
- 0.2.1.26 really wasn't that useful anyway.
- Changes in version 0.2.2.19-alpha - 2010-11-22
- Yet another OpenSSL security patch broke its compatibility with Tor:
- Tor 0.2.2.19-alpha makes relays work with OpenSSL 0.9.8p and 1.0.0.b.
- o Major bugfixes:
- - Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
- No longer set the tlsext_host_name extension on server SSL objects;
- but continue to set it on client SSL objects. Our goal in setting
- it was to imitate a browser, not a vhosting server. Fixes bug 2204;
- bugfix on 0.2.1.1-alpha.
- o Minor bugfixes:
- - Try harder not to exceed the maximum length of 50 KB when writing
- statistics to extra-info descriptors. This bug was triggered by very
- fast relays reporting exit-port, entry, and dirreq statistics.
- Reported by Olaf Selke. Bugfix on 0.2.2.1-alpha. Fixes bug 2183.
- - Publish a router descriptor even if generating an extra-info
- descriptor fails. Previously we would not publish a router
- descriptor without an extra-info descriptor; this can cause fast
- exit relays collecting exit-port statistics to drop from the
- consensus. Bugfix on 0.1.2.9-rc; fixes bug 2195.
- Changes in version 0.2.2.18-alpha - 2010-11-16
- Tor 0.2.2.18-alpha fixes several crash bugs that have been nagging
- us lately, makes unpublished bridge relays able to detect their IP
- address, and fixes a wide variety of other bugs to get us much closer
- to a stable release.
- o Major bugfixes:
- - Do even more to reject (and not just ignore) annotations on
- router descriptors received anywhere but from the cache. Previously
- we would ignore such annotations at first, but cache them to disk
- anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
- - Do not log messages to the controller while shrinking buffer
- freelists. Doing so would sometimes make the controller connection
- try to allocate a buffer chunk, which would mess up the internals
- of the freelist and cause an assertion failure. Fixes bug 1125;
- fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
- - Learn our external IP address when we're a relay or bridge, even if
- we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
- where we introduced bridge relays that don't need to publish to
- be useful. Fixes bug 2050.
- - Maintain separate TLS contexts and certificates for incoming and
- outgoing connections in bridge relays. Previously we would use the
- same TLS contexts and certs for incoming and outgoing connections.
- Bugfix on 0.2.0.3-alpha; addresses bug 988.
- - Maintain separate identity keys for incoming and outgoing TLS
- contexts in bridge relays. Previously we would use the same
- identity keys for incoming and outgoing TLS contexts. Bugfix on
- 0.2.0.3-alpha; addresses the other half of bug 988.
- - Avoid an assertion failure when we as an authority receive a
- duplicate upload of a router descriptor that we already have,
- but which we previously considered an obsolete descriptor.
- Fixes another case of bug 1776. Bugfix on 0.2.2.16-alpha.
- - Avoid a crash bug triggered by looking at a dangling pointer while
- setting the network status consensus. Found by Robert Ransom.
- Bugfix on 0.2.2.17-alpha. Fixes bug 2097.
- - Fix a logic error where servers that _didn't_ act as exits would
- try to keep their server lists more aggressively up to date than
- exits, when it was supposed to be the other way around. Bugfix
- on 0.2.2.17-alpha.
- o Minor bugfixes (on Tor 0.2.1.x and earlier):
- - When we're trying to guess whether we know our IP address as
- a relay, we would log various ways that we failed to guess
- our address, but never log that we ended up guessing it
- successfully. Now add a log line to help confused and anxious
- relay operators. Bugfix on 0.1.2.1-alpha; fixes bug 1534.
- - Bring the logic that gathers routerinfos and assesses the
- acceptability of circuits into line. This prevents a Tor OP from
- getting locked in a cycle of choosing its local OR as an exit for a
- path (due to a .exit request) and then rejecting the circuit because
- its OR is not listed yet. It also prevents Tor clients from using an
- OR running in the same instance as an exit (due to a .exit request)
- if the OR does not meet the same requirements expected of an OR
- running elsewhere. Fixes bug 1859; bugfix on 0.1.0.1-rc.
- - Correctly describe errors that occur when generating a TLS object.
- Previously we would attribute them to a failure while generating a
- TLS context. Patch by Robert Ransom. Bugfix on 0.1.0.4-rc; fixes
- bug 1994.
- - Enforce multiplicity rules when parsing annotations. Bugfix on
- 0.2.0.8-alpha. Found by piebeer.
- - Fix warnings that newer versions of autoconf produced during
- ./autogen.sh. These warnings appear to be harmless in our case,
- but they were extremely verbose. Fixes bug 2020.
- o Minor bugfixes (on Tor 0.2.2.x):
- - Enable protection of small arrays whenever we build with gcc
- hardening features, not only when also building with warnings
- enabled. Fixes bug 2031; bugfix on 0.2.2.14-alpha. Reported by keb.
- o Minor features:
- - Make hidden services work better in private Tor networks by not
- requiring any uptime to join the hidden service descriptor
- DHT. Implements ticket 2088.
- - Rate-limit the "your application is giving Tor only an IP address"
- warning. Addresses bug 2000; bugfix on 0.0.8pre2.
- - When AllowSingleHopExits is set, print a warning to explain to the
- relay operator why most clients are avoiding her relay.
- - Update to the November 1 2010 Maxmind GeoLite Country database.
- o Code simplifications and refactoring:
- - When we fixed bug 1038 we had to put in a restriction not to send
- RELAY_EARLY cells on rend circuits. This was necessary as long
- as relays using Tor 0.2.1.3-alpha through 0.2.1.18-alpha were
- active. Now remove this obsolete check. Resolves bug 2081.
- - Some options used different conventions for uppercasing of acronyms
- when comparing manpage and source. Fix those in favor of the
- manpage, as it makes sense to capitalize acronyms.
- - Remove the torrc.complete file. It hasn't been kept up to date
- and users will have better luck checking out the manpage.
- - Remove the obsolete "NoPublish" option; it has been flagged
- as obsolete and has produced a warning since 0.1.1.18-rc.
- - Remove everything related to building the expert bundle for OS X.
- It has confused many users, doesn't work right on OS X 10.6,
- and is hard to get rid of once installed. Resolves bug 1274.
- Changes in version 0.2.2.17-alpha - 2010-09-30
- Tor 0.2.2.17-alpha introduces a feature to make it harder for clients
- to use one-hop circuits (which can put the exit relays at higher risk,
- plus unbalance the network); fixes a big bug in bandwidth accounting
- for relays that want to limit their monthly bandwidth use; fixes a
- big pile of bugs in how clients tolerate temporary network failure;
- and makes our adaptive circuit build timeout feature (which improves
- client performance if your network is fast while not breaking things
- if your network is slow) better handle bad networks.
- o Major features:
- - Exit relays now try harder to block exit attempts from unknown
- relays, to make it harder for people to use them as one-hop proxies
- a la tortunnel. Controlled by the refuseunknownexits consensus
- parameter (currently enabled), or you can override it on your
- relay with the RefuseUnknownExits torrc option. Resolves bug 1751.
- o Major bugfixes (0.2.1.x and earlier):
- - Fix a bug in bandwidth accounting that could make us use twice
- the intended bandwidth when our interval start changes due to
- daylight saving time. Now we tolerate skew in stored vs computed
- interval starts: if the start of the period changes by no more than
- 50% of the period's duration, we remember bytes that we transferred
- in the old period. Fixes bug 1511; bugfix on 0.0.9pre5.
- - Always search the Windows system directory for system DLLs, and
- nowhere else. Bugfix on 0.1.1.23; fixes bug 1954.
- - When you're using bridges and your network goes away and your
- bridges get marked as down, recover when you attempt a new socks
- connection (if the network is back), rather than waiting up to an
- hour to try fetching new descriptors for your bridges. Bugfix on
- 0.2.0.3-alpha; fixes bug 1981.
- o Major bugfixes (on 0.2.2.x):
- - Fix compilation on Windows. Bugfix on 0.2.2.16-alpha; related to
- bug 1797.
- - Fix a segfault that could happen when operating a bridge relay with
- no GeoIP database set. Fixes bug 1964; bugfix on 0.2.2.15-alpha.
- - The consensus bandwidth-weights (used by clients to choose fast
- relays) entered an unexpected edge case in September where
- Exits were much scarcer than Guards, resulting in bad weight
- recommendations. Now we compute them using new constraints that
- should succeed in all cases. Also alter directory authorities to
- not include the bandwidth-weights line if they fail to produce
- valid values. Fixes bug 1952; bugfix on 0.2.2.10-alpha.
- - When weighting bridges during path selection, we used to trust
- the bandwidths they provided in their descriptor, only capping them
- at 10MB/s. This turned out to be problematic for two reasons:
- Bridges could claim to handle a lot more traffic then they
- actually would, thus making more clients pick them and have a
- pretty effective DoS attack. The other issue is that new bridges
- that might not have a good estimate for their bw capacity yet
- would not get used at all unless no other bridges are available
- to a client. Fixes bug 1912; bugfix on 0.2.2.7-alpha.
- o Major bugfixes (on the circuit build timeout feature, 0.2.2.x):
- - Ignore cannibalized circuits when recording circuit build times.
- This should provide for a minor performance improvement for hidden
- service users using 0.2.2.14-alpha, and should remove two spurious
- notice log messages. Bugfix on 0.2.2.14-alpha; fixes bug 1740.
- - Simplify the logic that causes us to decide if the network is
- unavailable for purposes of recording circuit build times. If we
- receive no cells whatsoever for the entire duration of a circuit's
- full measured lifetime, the network is probably down. Also ignore
- one-hop directory fetching circuit timeouts when calculating our
- circuit build times. These changes should hopefully reduce the
- cases where we see ridiculous circuit build timeouts for people
- with spotty wireless connections. Fixes part of bug 1772; bugfix
- on 0.2.2.2-alpha.
- - Prevent the circuit build timeout from becoming larger than
- the maximum build time we have ever seen. Also, prevent the time
- period for measurement circuits from becoming larger than twice that
- value. Fixes the other part of bug 1772; bugfix on 0.2.2.2-alpha.
- o Minor features:
- - When we run out of directory information such that we can't build
- circuits, but then get enough that we can build circuits, log when
- we actually construct a circuit, so the user has a better chance of
- knowing what's going on. Fixes bug 1362.
- - Be more generous with how much bandwidth we'd use up (with
- accounting enabled) before entering "soft hibernation". Previously,
- we'd refuse new connections and circuits once we'd used up 95% of
- our allotment. Now, we use up 95% of our allotment, AND make sure
- that we have no more than 500MB (or 3 hours of expected traffic,
- whichever is lower) remaining before we enter soft hibernation.
- - If we've configured EntryNodes and our network goes away and/or all
- our entrynodes get marked down, optimistically retry them all when
- a new socks application request appears. Fixes bug 1882.
- - Add some more defensive programming for architectures that can't
- handle unaligned integer accesses. We don't know of any actual bugs
- right now, but that's the best time to fix them. Fixes bug 1943.
- - Support line continuations in the torrc config file. If a line
- ends with a single backslash character, the newline is ignored, and
- the configuration value is treated as continuing on the next line.
- Resolves bug 1929.
- o Minor bugfixes (on 0.2.1.x and earlier):
- - For bandwidth accounting, calculate our expected bandwidth rate
- based on the time during which we were active and not in
- soft-hibernation during the last interval. Previously, we were
- also considering the time spent in soft-hibernation. If this
- was a long time, we would wind up underestimating our bandwidth
- by a lot, and skewing our wakeup time towards the start of the
- accounting interval. Fixes bug 1789. Bugfix on 0.0.9pre5.
- o Minor bugfixes (on 0.2.2.x):
- - Resume generating CIRC FAILED REASON=TIMEOUT control port messages,
- which were disabled by the circuit build timeout changes in
- 0.2.2.14-alpha. Bugfix on 0.2.2.14-alpha; fixes bug 1739.
- - Make sure we don't warn about missing bandwidth weights when
- choosing bridges or other relays not in the consensus. Bugfix on
- 0.2.2.10-alpha; fixes bug 1805.
- - In our logs, do not double-report signatures from unrecognized
- authorities both as "from unknown authority" and "not
- present". Fixes bug 1956, bugfix on 0.2.2.16-alpha.
- Changes in version 0.2.2.16-alpha - 2010-09-17
- Tor 0.2.2.16-alpha fixes a variety of old stream fairness bugs (most
- evident at exit relays), and also continues to resolve all the little
- bugs that have been filling up trac lately.
- o Major bugfixes (stream-level fairness):
- - When receiving a circuit-level SENDME for a blocked circuit, try
- to package cells fairly from all the streams that had previously
- been blocked on that circuit. Previously, we had started with the
- oldest stream, and allowed each stream to potentially exhaust
- the circuit's package window. This gave older streams on any
- given circuit priority over newer ones. Fixes bug 1937. Detected
- originally by Camilo Viecco. This bug was introduced before the
- first Tor release, in svn commit r152: it is the new winner of
- the longest-lived bug prize.
- - When the exit relay got a circuit-level sendme cell, it started
- reading on the exit streams, even if had 500 cells queued in the
- circuit queue already, so the circuit queue just grew and grew in
- some cases. We fix this by not re-enabling reading on receipt of a
- sendme cell when the cell queue is blocked. Fixes bug 1653. Bugfix
- on 0.2.0.1-alpha. Detected by Mashael AlSabah. Original patch by
- "yetonetime".
- - Newly created streams were allowed to read cells onto circuits,
- even if the circuit's cell queue was blocked and waiting to drain.
- This created potential unfairness, as older streams would be
- blocked, but newer streams would gladly fill the queue completely.
- We add code to detect this situation and prevent any stream from
- getting more than one free cell. Bugfix on 0.2.0.1-alpha. Partially
- fixes bug 1298.
- o Minor features:
- - Update to the September 1 2010 Maxmind GeoLite Country database.
- - Warn when CookieAuthFileGroupReadable is set but CookieAuthFile is
- not. This would lead to a cookie that is still not group readable.
- Closes bug 1843. Suggested by katmagic.
- - When logging a rate-limited warning, we now mention how many messages
- got suppressed since the last warning.
- - Add new "perconnbwrate" and "perconnbwburst" consensus params to
- do individual connection-level rate limiting of clients. The torrc
- config options with the same names trump the consensus params, if
- both are present. Replaces the old "bwconnrate" and "bwconnburst"
- consensus params which were broken from 0.2.2.7-alpha through
- 0.2.2.14-alpha. Closes bug 1947.
- - When a router changes IP address or port, authorities now launch
- a new reachability test for it. Implements ticket 1899.
- - Make the formerly ugly "2 unknown, 7 missing key, 0 good, 0 bad,
- 2 no signature, 4 required" messages about consensus signatures
- easier to read, and make sure they get logged at the same severity
- as the messages explaining which keys are which. Fixes bug 1290.
- - Don't warn when we have a consensus that we can't verify because
- of missing certificates, unless those certificates are ones
- that we have been trying and failing to download. Fixes bug 1145.
- - If you configure your bridge with a known identity fingerprint,
- and the bridge authority is unreachable (as it is in at least
- one country now), fall back to directly requesting the descriptor
- from the bridge. Finishes the feature started in 0.2.0.10-alpha;
- closes bug 1138.
- - When building with --enable-gcc-warnings on OpenBSD, disable
- warnings in system headers. This makes --enable-gcc-warnings
- pass on OpenBSD 4.8.
- o Minor bugfixes (on 0.2.1.x and earlier):
- - Authorities will now attempt to download consensuses if their
- own efforts to make a live consensus have failed. This change
- means authorities that restart will fetch a valid consensus, and
- it means authorities that didn't agree with the current consensus
- will still fetch and serve it if it has enough signatures. Bugfix
- on 0.2.0.9-alpha; fixes bug 1300.
- - Ensure DNS requests launched by "RESOLVE" commands from the
- controller respect the __LeaveStreamsUnattached setconf options. The
- same goes for requests launched via DNSPort or transparent
- proxying. Bugfix on 0.2.0.1-alpha; fixes bug 1525.
- - Allow handshaking OR connections to take a full KeepalivePeriod
- seconds to handshake. Previously, we would close them after
- IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
- were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
- for analysis help.
- - Rate-limit "Failed to hand off onionskin" warnings.
- - Never relay a cell for a circuit we have already destroyed.
- Between marking a circuit as closeable and finally closing it,
- it may have been possible for a few queued cells to get relayed,
- even though they would have been immediately dropped by the next
- OR in the circuit. Fixes bug 1184; bugfix on 0.2.0.1-alpha.
- - Never queue a cell for a circuit that's already been marked
- for close.
- - Never vote for a server as "Running" if we have a descriptor for
- it claiming to be hibernating, and that descriptor was published
- more recently than our last contact with the server. Bugfix on
- 0.2.0.3-alpha; fixes bug 911.
- - Squash a compile warning on OpenBSD. Reported by Tas; fixes
- bug 1848.
- o Minor bugfixes (on 0.2.2.x):
- - Fix a regression introduced in 0.2.2.7-alpha that marked relays
- down if a directory fetch fails and you've configured either
- bridges or EntryNodes. The intent was to mark the relay as down
- _unless_ you're using bridges or EntryNodes, since if you are
- then you could quickly run out of entry points.
- - Fix the Windows directory-listing code. A bug introduced in
- 0.2.2.14-alpha could make Windows directory servers forget to load
- some of their cached v2 networkstatus files.
- - Really allow clients to use relays as bridges. Fixes bug 1776;
- bugfix on 0.2.2.15-alpha.
- - Demote a warn to info that happens when the CellStatistics option
- was just enabled. Bugfix on 0.2.2.15-alpha; fixes bug 1921.
- Reported by Moritz Bartl.
- - On Windows, build correctly either with or without Unicode support.
- This is necessary so that Tor can support fringe platforms like
- Windows 98 (which has no Unicode), or Windows CE (which has no
- non-Unicode). Bugfix on 0.2.2.14-alpha; fixes bug 1797.
- o Testing
- - Add a unit test for cross-platform directory-listing code.
- Changes in version 0.2.2.15-alpha - 2010-08-18
- Tor 0.2.2.15-alpha fixes a big bug in hidden service availability,
- fixes a variety of other bugs that were preventing performance
- experiments from moving forward, fixes several bothersome memory leaks,
- and generally closes a lot of smaller bugs that have been filling up
- trac lately.
- o Major bugfixes:
- - Stop assigning the HSDir flag to relays that disable their
- DirPort (and thus will refuse to answer directory requests). This
- fix should dramatically improve the reachability of hidden services:
- hidden services and hidden service clients pick six HSDir relays
- to store and retrieve the hidden service descriptor, and currently
- about half of the HSDir relays will refuse to work. Bugfix on
- 0.2.0.10-alpha; fixes part of bug 1693.
- - The PerConnBWRate and Burst config options, along with the
- bwconnrate and bwconnburst consensus params, initialized each conn's
- token bucket values only when the connection is established. Now we
- update them if the config options change, and update them every time
- we get a new consensus. Otherwise we can encounter an ugly edge
- case where we initialize an OR conn to client-level bandwidth,
- but then later the relay joins the consensus and we leave it
- throttled. Bugfix on 0.2.2.7-alpha; fixes bug 1830.
- - Fix a regression that caused Tor to rebind its ports if it receives
- SIGHUP while hibernating. Bugfix in 0.1.1.6-alpha; closes bug 919.
- o Major features:
- - Lower the maximum weighted-fractional-uptime cutoff to 98%. This
- should give us approximately 40-50% more Guard-flagged nodes,
- improving the anonymity the Tor network can provide and also
- decreasing the dropoff in throughput that relays experience when
- they first get the Guard flag.
- - Allow enabling or disabling the *Statistics config options while
- Tor is running.
- o Minor features:
- - Update to the August 1 2010 Maxmind GeoLite Country database.
- - Have the controller interface give a more useful message than
- "Internal Error" in response to failed GETINFO requests.
- - Warn when the same option is provided more than once in a torrc
- file, on the command line, or in a single SETCONF statement, and
- the option is one that only accepts a single line. Closes bug 1384.
- - Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
- Patch from mingw-san.
- - Add support for the country code "{??}" in torrc options like
- ExcludeNodes, to indicate all routers of unknown country. Closes
- bug 1094.
- - Relays report the number of bytes spent on answering directory
- requests in extra-info descriptors similar to {read,write}-history.
- Implements enhancement 1790.
- o Minor bugfixes (on 0.2.1.x and earlier):
- - Complain if PublishServerDescriptor is given multiple arguments that
- include 0 or 1. This configuration will be rejected in the future.
- Bugfix on 0.2.0.1-alpha; closes bug 1107.
- - Disallow BridgeRelay 1 and ORPort 0 at once in the configuration.
- Bugfix on 0.2.0.13-alpha; closes bug 928.
- - Change "Application request when we're believed to be offline."
- notice to "Application request when we haven't used client
- functionality lately.", to clarify that it's not an error. Bugfix
- on 0.0.9.3; fixes bug 1222.
- - Fix a bug in the controller interface where "GETINFO ns/asdaskljkl"
- would return "551 Internal error" rather than "552 Unrecognized key
- ns/asdaskljkl". Bugfix on 0.1.2.3-alpha.
- - Users can't configure a regular relay to be their bridge. It didn't
- work because when Tor fetched the bridge descriptor, it found
- that it already had it, and didn't realize that the purpose of the
- descriptor had changed. Now we replace routers with a purpose other
- than bridge with bridge descriptors when fetching them. Bugfix on
- 0.1.1.9-alpha. Bug 1776 not yet fixed because now we immediately
- refetch the descriptor with router purpose 'general', disabling
- it as a bridge.
- - Fix a rare bug in rend_fn unit tests: we would fail a test when
- a randomly generated port is 0. Diagnosed by Matt Edman. Bugfix
- on 0.2.0.10-alpha; fixes bug 1808.
- - Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
- and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
- stream ending reason for this case: END_STREAM_REASON_NOROUTE.
- Servers can start sending this code when enough clients recognize
- it. Also update the spec to reflect this new reason. Bugfix on
- 0.1.0.1-rc; fixes part of bug 1793.
- - Delay geoip stats collection by bridges for 6 hours, not 2 hours,
- when we switch from being a public relay to a bridge. Otherwise
- there will still be clients that see the relay in their consensus,
- and the stats will end up wrong. Bugfix on 0.2.1.15-rc; fixes bug
- 932 even more.
- - Instead of giving an assertion failure on an internal mismatch
- on estimated freelist size, just log a BUG warning and try later.
- Mitigates but does not fix bug 1125.
- - Fix an assertion failure that could occur in caches or bridge users
- when using a very short voting interval on a testing network.
- Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on 0.2.0.8-alpha.
- o Minor bugfixes (on 0.2.2.x):
- - Alter directory authorities to always consider Exit-flagged nodes
- as potential Guard nodes in their votes. The actual decision to
- use Exits as Guards is done in the consensus bandwidth weights.
- Fixes bug 1294; bugfix on 0.2.2.10-alpha.
- - When the controller is reporting the purpose of circuits that
- didn't finish building before the circuit build timeout, it was
- printing UNKNOWN_13. Now print EXPIRED. Bugfix on 0.2.2.14-alpha.
- - Our libevent version parsing code couldn't handle versions like
- 1.4.14b-stable and incorrectly warned the user about using an
- old and broken version of libevent. Treat 1.4.14b-stable like
- 1.4.14-stable when parsing the version. Fixes bug 1731; bugfix
- on 0.2.2.1-alpha.
- - Don't use substitution references like $(VAR:MOD) when
- $(asciidoc_files) is empty -- make(1) on NetBSD transforms
- '$(:x)' to 'x' rather than the empty string. This bites us in
- doc/ when configured with --disable-asciidoc. Bugfix on
- 0.2.2.9-alpha; fixes bug 1773.
- - Remove a spurious hidden service server-side log notice about
- "Ancient non-dirty circuits". Bugfix on 0.2.2.14-alpha; fixes
- bug 1741.
- - Fix compilation with --with-dmalloc set. Bugfix on 0.2.2.6-alpha;
- fixes bug 1832.
- - Correctly report written bytes on linked connections. Found while
- implementing 1790. Bugfix on 0.2.2.4-alpha.
- - Fix three memory leaks: one in circuit_build_times_parse_state(),
- one in dirvote_add_signatures_to_pending_consensus(), and one every
- time we parse a v3 network consensus. Bugfixes on 0.2.2.14-alpha,
- 0.2.2.6-alpha, and 0.2.2.10-alpha respectively; fixes bug 1831.
- o Code simplifications and refactoring:
- - Take a first step towards making or.h smaller by splitting out
- function definitions for all source files in src/or/. Leave
- structures and defines in or.h for now.
- - Remove a bunch of unused function declarations as well as a block of
- #if 0'd code from the unit tests. Closes bug 1824.
- - New unit tests for exit-port history statistics; refactored exit
- statistics code to be more easily tested.
- - Remove the old debian/ directory from the main Tor distribution.
- The official Tor-for-debian git repository lives at the URL
- https://git.torproject.org/debian/tor.git
- Changes in version 0.2.2.14-alpha - 2010-07-12
- Tor 0.2.2.14-alpha greatly improves client-side handling of
- circuit build timeouts, which are used to estimate speed and improve
- performance. We also move to a much better GeoIP database, port Tor to
- Windows CE, introduce new compile flags that improve code security,
- add an eighth v3 directory authority, and address a lot of more
- minor issues.
- o Major bugfixes:
- - Tor directory authorities no longer crash when started with a
- cached-microdesc-consensus file in their data directory. Bugfix
- on 0.2.2.6-alpha; fixes bug 1532.
- - Treat an unset $HOME like an empty $HOME rather than triggering an
- assert. Bugfix on 0.0.8pre1; fixes bug 1522.
- - Ignore negative and large circuit build timeout values that can
- happen during a suspend or hibernate. These values caused various
- asserts to fire. Bugfix on 0.2.2.2-alpha; fixes bug 1245.
- - Alter calculation of Pareto distribution parameter 'Xm' for
- Circuit Build Timeout learning to use the weighted average of the
- top N=3 modes (because we have three entry guards). Considering
- multiple modes should improve the timeout calculation in some cases,
- and prevent extremely high timeout values. Bugfix on 0.2.2.2-alpha;
- fixes bug 1335.
- - Alter calculation of Pareto distribution parameter 'Alpha' to use a
- right censored distribution model. This approach improves over the
- synthetic timeout generation approach that was producing insanely
- high timeout values. Now we calculate build timeouts using truncated
- times. Bugfix on 0.2.2.2-alpha; fixes bugs 1245 and 1335.
- - Do not close circuits that are under construction when they reach
- the circuit build timeout. Instead, leave them building (but do not
- use them) for up until the time corresponding to the 95th percentile
- on the Pareto CDF or 60 seconds, whichever is greater. This is done
- to provide better data for the new Pareto model. This percentile
- can be controlled by the consensus.
- o Major features:
- - Move to the June 2010 Maxmind GeoLite country db (rather than the
- June 2009 ip-to-country GeoIP db) for our statistics that count
- how many users relays are seeing from each country. Now we have
- more accurate data for many African countries.
- - Port Tor to build and run correctly on Windows CE systems, using
- the wcecompat library. Contributed by Valerio Lupi.
- - New "--enable-gcc-hardening" ./configure flag (off by default)
- to turn on gcc compile time hardening options. It ensures
- that signed ints have defined behavior (-fwrapv), enables
- -D_FORTIFY_SOURCE=2 (requiring -O2), adds stack smashing protection
- with canaries (-fstack-protector-all), turns on ASLR protection if
- supported by the kernel (-fPIE, -pie), and adds additional security
- related warnings. Verified to work on Mac OS X and Debian Lenny.
- - New "--enable-linker-hardening" ./configure flag (off by default)
- to turn on ELF specific hardening features (relro, now). This does
- not work with Mac OS X or any other non-ELF binary format.
- o New directory authorities:
- - Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
- authority.
- o Minor features:
- - New config option "WarnUnsafeSocks 0" disables the warning that
- occurs whenever Tor receives a socks handshake using a version of
- the socks protocol that can only provide an IP address (rather
- than a hostname). Setups that do DNS locally over Tor are fine,
- and we shouldn't spam the logs in that case.
- - Convert the HACKING file to asciidoc, and add a few new sections
- to it, explaining how we use Git, how we make changelogs, and
- what should go in a patch.
- - Add a TIMEOUT_RATE keyword to the BUILDTIMEOUT_SET control port
- event, to give information on the current rate of circuit timeouts
- over our stored history.
- - Add ability to disable circuit build time learning via consensus
- parameter and via a LearnCircuitBuildTimeout config option. Also
- automatically disable circuit build time calculation if we are
- either a AuthoritativeDirectory, or if we fail to write our state
- file. Fixes bug 1296.
- - More gracefully handle corrupt state files, removing asserts
- in favor of saving a backup and resetting state.
- - Rename the "log.h" header to "torlog.h" so as to conflict with fewer
- system headers.
- o Minor bugfixes:
- - Build correctly on OSX with zlib 1.2.4 and higher with all warnings
- enabled.
- - When a2x fails, mention that the user could disable manpages instead
- of trying to fix their asciidoc installation.
- - Where available, use Libevent 2.0's periodic timers so that our
- once-per-second cleanup code gets called even more closely to
- once per second than it would otherwise. Fixes bug 943.
- - If you run a bridge that listens on multiple IP addresses, and
- some user configures a bridge address that uses a different IP
- address than your bridge writes in its router descriptor, and the
- user doesn't specify an identity key, their Tor would discard the
- descriptor because "it isn't one of our configured bridges", and
- fail to bootstrap. Now believe the descriptor and bootstrap anyway.
- Bugfix on 0.2.0.3-alpha.
- - If OpenSSL fails to make a duplicate of a private or public key, log
- an error message and try to exit cleanly. May help with debugging
- if bug 1209 ever remanifests.
- - Save a couple bytes in memory allocation every time we escape
- certain characters in a string. Patch from Florian Zumbiehl.
- - Make it explicit that we don't cannibalize one-hop circuits. This
- happens in the wild, but doesn't turn out to be a problem because
- we fortunately don't use those circuits. Many thanks to outofwords
- for the initial analysis and to swissknife who confirmed that
- two-hop circuits are actually created.
- - Make directory mirrors report non-zero dirreq-v[23]-shares again.
- Fixes bug 1564; bugfix on 0.2.2.9-alpha.
- - Eliminate a case where a circuit build time warning was displayed
- after network connectivity resumed. Bugfix on 0.2.2.2-alpha.
- Changes in version 0.2.1.26 - 2010-05-02
- Tor 0.2.1.26 addresses the recent connection and memory overload
- problems we've been seeing on relays, especially relays with their
- DirPort open. If your relay has been crashing, or you turned it off
- because it used too many resources, give this release a try.
- This release also fixes yet another instance of broken OpenSSL libraries
- that was causing some relays to drop out of the consensus.
- o Major bugfixes:
- - Teach relays to defend themselves from connection overload. Relays
- now close idle circuits early if it looks like they were intended
- for directory fetches. Relays are also more aggressive about closing
- TLS connections that have no circuits on them. Such circuits are
- unlikely to be re-used, and tens of thousands of them were piling
- up at the fast relays, causing the relays to run out of sockets
- and memory. Bugfix on 0.2.0.22-rc (where clients started tunneling
- their directory fetches over TLS).
- - Fix SSL renegotiation behavior on OpenSSL versions like on Centos
- that claim to be earlier than 0.9.8m, but which have in reality
- backported huge swaths of 0.9.8m or 0.9.8n renegotiation
- behavior. Possible fix for some cases of bug 1346.
- - Directory mirrors were fetching relay descriptors only from v2
- directory authorities, rather than v3 authorities like they should.
- Only 2 v2 authorities remain (compared to 7 v3 authorities), leading
- to a serious bottleneck. Bugfix on 0.2.0.9-alpha. Fixes bug 1324.
- o Minor bugfixes:
- - Finally get rid of the deprecated and now harmful notion of "clique
- mode", where directory authorities maintain TLS connections to
- every other relay.
- o Testsuite fixes:
- - In the util/threads test, no longer free the test_mutex before all
- worker threads have finished. Bugfix on 0.2.1.6-alpha.
- - The master thread could starve the worker threads quite badly on
- certain systems, causing them to run only partially in the allowed
- window. This resulted in test failures. Now the master thread sleeps
- occasionally for a few microseconds while the two worker-threads
- compete for the mutex. Bugfix on 0.2.0.1-alpha.
- Changes in version 0.2.2.13-alpha - 2010-04-24
- Tor 0.2.2.13-alpha addresses the recent connection and memory overload
- problems we've been seeing on relays, especially relays with their
- DirPort open. If your relay has been crashing, or you turned it off
- because it used too many resources, give this release a try.
- o Major bugfixes:
- - Teach relays to defend themselves from connection overload. Relays
- now close idle circuits early if it looks like they were intended
- for directory fetches. Relays are also more aggressive about closing
- TLS connections that have no circuits on them. Such circuits are
- unlikely to be re-used, and tens of thousands of them were piling
- up at the fast relays, causing the relays to run out of sockets
- and memory. Bugfix on 0.2.0.22-rc (where clients started tunneling
- their directory fetches over TLS).
- o Minor features:
- - Finally get rid of the deprecated and now harmful notion of "clique
- mode", where directory authorities maintain TLS connections to
- every other relay.
- - Directory authorities now do an immediate reachability check as soon
- as they hear about a new relay. This change should slightly reduce
- the time between setting up a relay and getting listed as running
- in the consensus. It should also improve the time between setting
- up a bridge and seeing use by bridge users.
- - Directory authorities no longer launch a TLS connection to every
- relay as they startup. Now that we have 2k+ descriptors cached,
- the resulting network hiccup is becoming a burden. Besides,
- authorities already avoid voting about Running for the first half
- hour of their uptime.
- Changes in version 0.2.2.12-alpha - 2010-04-20
- Tor 0.2.2.12-alpha fixes a critical bug in how directory authorities
- handle and vote on descriptors. It was causing relays to drop out of
- the consensus.
- o Major bugfixes:
- - Many relays have been falling out of the consensus lately because
- not enough authorities know about their descriptor for them to get
- a majority of votes. When we deprecated the v2 directory protocol,
- we got rid of the only way that v3 authorities can hear from each
- other about other descriptors. Now authorities examine every v3
- vote for new descriptors, and fetch them from that authority. Bugfix
- on 0.2.1.23.
- - Fix two typos in tor_vasprintf() that broke the compile on Windows,
- and a warning in or.h related to bandwidth_weight_rule_t that
- prevented clean compile on OS X. Fixes bug 1363; bugfix on
- 0.2.2.11-alpha.
- - Fix a segfault on relays when DirReqStatistics is enabled
- and 24 hours pass. Bug found by keb. Fixes bug 1365; bugfix on
- 0.2.2.11-alpha.
- o Minor bugfixes:
- - Demote a confusing TLS warning that relay operators might get when
- someone tries to talk to their OrPort. It is neither the operator's
- fault nor can they do anything about it. Fixes bug 1364; bugfix
- on 0.2.0.14-alpha.
- Changes in version 0.2.2.11-alpha - 2010-04-15
- Tor 0.2.2.11-alpha fixes yet another instance of broken OpenSSL
- libraries that was causing some relays to drop out of the consensus.
- o Major bugfixes:
- - Directory mirrors were fetching relay descriptors only from v2
- directory authorities, rather than v3 authorities like they should.
- Only 2 v2 authorities remain (compared to 7 v3 authorities), leading
- to a serious bottleneck. Bugfix on 0.2.0.9-alpha. Fixes bug 1324.
- - Fix a parsing error that made every possible value of
- CircPriorityHalflifeMsec get treated as "1 msec". Bugfix
- on 0.2.2.7-alpha. Rename CircPriorityHalflifeMsec to
- CircuitPriorityHalflifeMsec, so authorities can tell newer relays
- about the option without breaking older ones.
- - Fix SSL renegotiation behavior on OpenSSL versions like on Centos
- that claim to be earlier than 0.9.8m, but which have in reality
- backported huge swaths of 0.9.8m or 0.9.8n renegotiation
- behavior. Possible fix for some cases of bug 1346.
- o Minor features:
- - Experiment with a more aggressive approach to preventing clients
- from making one-hop exit streams. Exit relays who want to try it
- out can set "RefuseUnknownExits 1" in their torrc, and then look
- for "Attempt by %s to open a stream" log messages. Let us know
- how it goes!
- - Add support for statically linking zlib by specifying
- --enable-static-zlib, to go with our support for statically linking
- openssl and libevent. Resolves bug 1358.
- o Minor bugfixes:
- - Fix a segfault that happens whenever a Tor client that is using
- libevent2's bufferevents gets a hup signal. Bugfix on 0.2.2.5-alpha;
- fixes bug 1341.
- - When we cleaned up the contrib/tor-exit-notice.html file, we left
- out the first line. Fixes bug 1295.
- - When building the manpage from a tarball, we required asciidoc, but
- the asciidoc -> roff/html conversion was already done for the
- tarball. Make 'make' complain only when we need asciidoc (either
- because we're compiling directly from git, or because we altered
- the asciidoc manpage in the tarball). Bugfix on 0.2.2.9-alpha.
- - When none of the directory authorities vote on any params, Tor
- segfaulted when trying to make the consensus from the votes. We
- didn't trigger the bug in practice, because authorities do include
- params in their votes. Bugfix on 0.2.2.10-alpha; fixes bug 1322.
- o Testsuite fixes:
- - In the util/threads test, no longer free the test_mutex before all
- worker threads have finished. Bugfix on 0.2.1.6-alpha.
- - The master thread could starve the worker threads quite badly on
- certain systems, causing them to run only partially in the allowed
- window. This resulted in test failures. Now the master thread sleeps
- occasionally for a few microseconds while the two worker-threads
- compete for the mutex. Bugfix on 0.2.0.1-alpha.
- Changes in version 0.2.2.10-alpha - 2010-03-07
- Tor 0.2.2.10-alpha fixes a regression introduced in 0.2.2.9-alpha that
- could prevent relays from guessing their IP address correctly. It also
- starts the groundwork for another client-side performance boost, since
- currently we're not making efficient use of relays that have both the
- Guard flag and the Exit flag.
- o Major bugfixes:
- - Fix a regression from our patch for bug 1244 that caused relays
- to guess their IP address incorrectly if they didn't set Address
- in their torrc and/or their address fails to resolve. Bugfix on
- 0.2.2.9-alpha; fixes bug 1269.
- o Major features (performance):
- - Directory authorities now compute consensus weightings that instruct
- clients how to weight relays flagged as Guard, Exit, Guard+Exit,
- and no flag. Clients that use these weightings will distribute
- network load more evenly across these different relay types. The
- weightings are in the consensus so we can change them globally in
- the future. Extra thanks to "outofwords" for finding some nasty
- security bugs in the first implementation of this feature.
- o Minor features (performance):
- - Always perform router selections using weighted relay bandwidth,
- even if we don't need a high capacity circuit at the time. Non-fast
- circuits now only differ from fast ones in that they can use relays
- not marked with the Fast flag. This "feature" could turn out to
- be a horrible bug; we should investigate more before it goes into
- a stable release.
- o Minor features:
- - Allow disabling building of the manpages. Skipping the manpage
- speeds up the build considerably.
- o Minor bugfixes (on 0.2.2.x):
- - Fix a memleak in the EXTENDCIRCUIT logic. Spotted by coverity.
- Bugfix on 0.2.2.9-alpha.
- - Disallow values larger than INT32_MAX for PerConnBWRate|Burst
- config option. Bugfix on 0.2.2.7-alpha.
- - Ship the asciidoc-helper file in the tarball, so that people can
- build from source if they want to, and touching the .1.txt files
- doesn't break the build. Bugfix on 0.2.2.9-alpha.
- o Minor bugfixes (on 0.2.1.x or earlier):
- - Fix a dereference-then-NULL-check sequence when publishing
- descriptors. Bugfix on 0.2.1.5-alpha. Discovered by ekir; fixes
- bug 1255.
- - Fix another dereference-then-NULL-check sequence. Bugfix on
- 0.2.1.14-rc. Discovered by ekir; fixes bug 1256.
- - Make sure we treat potentially not NUL-terminated strings correctly.
- Bugfix on 0.1.1.13-alpha. Discovered by rieo; fixes bug 1257.
- o Code simplifications and refactoring:
- - Fix some urls in the exit notice file and make it XHTML1.1 strict
- compliant. Based on a patch from Christian Kujau.
- - Don't use sed in asciidoc-helper anymore.
- - Make the build process fail if asciidoc cannot be found and
- building with asciidoc isn't disabled.
- Changes in version 0.2.2.9-alpha - 2010-02-22
- Tor 0.2.2.9-alpha makes Tor work again on the latest OS X, updates the
- location of a directory authority, and cleans up a bunch of small bugs.
- o Directory authority changes:
- - Change IP address for dannenberg (v3 directory authority), and
- remove moria2 (obsolete v1, v2 directory authority and v0 hidden
- service directory authority) from the list.
- o Major bugfixes:
- - Make Tor work again on the latest OS X: when deciding whether to
- use strange flags to turn TLS renegotiation on, detect the OpenSSL
- version at run-time, not compile time. We need to do this because
- Apple doesn't update its dev-tools headers when it updates its
- libraries in a security patch.
- - Fix a potential buffer overflow in lookup_last_hid_serv_request()
- that could happen on 32-bit platforms with 64-bit time_t. Also fix
- a memory leak when requesting a hidden service descriptor we've
- requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found
- by aakova.
- - Authorities could be tricked into giving out the Exit flag to relays
- that didn't allow exiting to any ports. This bug could screw
- with load balancing and stats. Bugfix on 0.1.1.6-alpha; fixes bug
- 1238. Bug discovered by Martin Kowalczyk.
- - When freeing a session key, zero it out completely. We only zeroed
- the first ptrsize bytes. Bugfix on 0.0.2pre8. Discovered and
- patched by ekir. Fixes bug 1254.
- o Minor bugfixes:
- - Fix static compilation by listing the openssl libraries in the right
- order. Bugfix on Tor 0.2.2.8-alpha; fixes bug 1237.
- - Resume handling .exit hostnames in a special way: originally we
- stripped the .exit part and used the requested exit relay. In
- 0.2.2.1-alpha we stopped treating them in any special way, meaning
- if you use a .exit address then Tor will pass it on to the exit
- relay. Now we reject the .exit stream outright, since that behavior
- might be more expected by the user. Found and diagnosed by Scott
- Bennett and Downie on or-talk.
- - Don't spam the controller with events when we have no file
- descriptors available. Bugfix on 0.2.1.5-alpha. (Rate-limiting
- for log messages was already solved from bug 748.)
- - Avoid a bogus overlapped memcpy in tor_addr_copy(). Reported by
- "memcpyfail".
- - Make the DNSPort option work with libevent 2.x. Don't alter the
- behaviour for libevent 1.x. Fixes bug 1143. Found by SwissTorExit.
- - Emit a GUARD DROPPED controller event for a case we missed.
- - Make more fields in the controller protocol case-insensitive, since
- control-spec.txt said they were.
- - Refactor resolve_my_address() to not use gethostbyname() anymore.
- Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik.
- - Fix a spec conformance issue: the network-status-version token
- must be the first token in a v3 consensus or vote. Discovered by
- parakeep. Bugfix on 0.2.0.3-alpha.
- o Code simplifications and refactoring:
- - Generate our manpage and HTML documentation using Asciidoc. This
- change should make it easier to maintain the documentation, and
- produce nicer HTML.
- - Remove the --enable-iphone option. According to reports from Marco
- Bonetti, Tor builds fine without any special tweaking on recent
- iPhone SDK versions.
- - Removed some unnecessary files from the source distribution. The
- AUTHORS file has now been merged into the people page on the
- website. The roadmaps and design doc can now be found in the
- projects directory in svn.
- - Enabled various circuit build timeout constants to be controlled
- by consensus parameters. Also set better defaults for these
- parameters based on experimentation on broadband and simulated
- high latency links.
- o Minor features:
- - The 'EXTENDCIRCUIT' control port command can now be used with
- a circ id of 0 and no path. This feature will cause Tor to build
- a new 'fast' general purpose circuit using its own path selection
- algorithms.
- - Added a BUILDTIMEOUT_SET controller event to describe changes
- to the circuit build timeout.
- - Future-proof the controller protocol a bit by ignoring keyword
- arguments we do not recognize.
- - Expand homedirs passed to tor-checkkey. This should silence a
- coverity complaint about passing a user-supplied string into
- open() without checking it.
- Changes in version 0.2.1.25 - 2010-03-16
- Tor 0.2.1.25 fixes a regression introduced in 0.2.1.23 that could
- prevent relays from guessing their IP address correctly. It also fixes
- several minor potential security bugs.
- o Major bugfixes:
- - Fix a regression from our patch for bug 1244 that caused relays
- to guess their IP address incorrectly if they didn't set Address
- in their torrc and/or their address fails to resolve. Bugfix on
- 0.2.1.23; fixes bug 1269.
- - When freeing a session key, zero it out completely. We only zeroed
- the first ptrsize bytes. Bugfix on 0.0.2pre8. Discovered and
- patched by ekir. Fixes bug 1254.
- o Minor bugfixes:
- - Fix a dereference-then-NULL-check sequence when publishing
- descriptors. Bugfix on 0.2.1.5-alpha. Discovered by ekir; fixes
- bug 1255.
- - Fix another dereference-then-NULL-check sequence. Bugfix on
- 0.2.1.14-rc. Discovered by ekir; fixes bug 1256.
- - Make sure we treat potentially not NUL-terminated strings correctly.
- Bugfix on 0.1.1.13-alpha. Discovered by rieo; fixes bug 1257.
- Changes in version 0.2.1.24 - 2010-02-21
- Tor 0.2.1.24 makes Tor work again on the latest OS X -- this time
- for sure!
- o Minor bugfixes:
- - Work correctly out-of-the-box with even more vendor-patched versions
- of OpenSSL. In particular, make it so Debian and OS X don't need
- customized patches to run/build.
- Changes in version 0.2.1.23 - 2010-02-13
- Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work
- again on the latest OS X, and updates the location of a directory
- authority.
- o Major bugfixes (performance):
- - We were selecting our guards uniformly at random, and then weighting
- which of our guards we'd use uniformly at random. This imbalance
- meant that Tor clients were severely limited on throughput (and
- probably latency too) by the first hop in their circuit. Now we
- select guards weighted by currently advertised bandwidth. We also
- automatically discard guards picked using the old algorithm. Fixes
- bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry.
- o Major bugfixes:
- - Make Tor work again on the latest OS X: when deciding whether to
- use strange flags to turn TLS renegotiation on, detect the OpenSSL
- version at run-time, not compile time. We need to do this because
- Apple doesn't update its dev-tools headers when it updates its
- libraries in a security patch.
- - Fix a potential buffer overflow in lookup_last_hid_serv_request()
- that could happen on 32-bit platforms with 64-bit time_t. Also fix
- a memory leak when requesting a hidden service descriptor we've
- requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found
- by aakova.
- o Directory authority changes:
- - Change IP address for dannenberg (v3 directory authority), and
- remove moria2 (obsolete v1, v2 directory authority and v0 hidden
- service directory authority) from the list.
- o Minor bugfixes:
- - Refactor resolve_my_address() to not use gethostbyname() anymore.
- Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik.
- o Minor features:
- - Avoid a mad rush at the beginning of each month when each client
- rotates half of its guards. Instead we spread the rotation out
- throughout the month, but we still avoid leaving a precise timestamp
- in the state file about when we first picked the guard. Improves
- over the behavior introduced in 0.1.2.17.
- Changes in version 0.2.2.8-alpha - 2010-01-26
- Tor 0.2.2.8-alpha fixes a crash bug in 0.2.2.7-alpha that has been
- causing bridge relays to disappear. If you're running a bridge,
- please upgrade.
- o Major bugfixes:
- - Fix a memory corruption bug on bridges that occured during the
- inclusion of stats data in extra-info descriptors. Also fix the
- interface for geoip_get_bridge_stats* to prevent similar bugs in
- the future. Diagnosis by Tas, patch by Karsten and Sebastian.
- Fixes bug 1208; bugfix on 0.2.2.7-alpha.
- o Minor bugfixes:
- - Ignore OutboundBindAddress when connecting to localhost.
- Connections to localhost need to come _from_ localhost, or else
- local servers (like DNS and outgoing HTTP/SOCKS proxies) will often
- refuse to listen.
- Changes in version 0.2.2.7-alpha - 2010-01-19
- Tor 0.2.2.7-alpha fixes a huge client-side performance bug, as well
- as laying the groundwork for further relay-side performance fixes. It
- also starts cleaning up client behavior with respect to the EntryNodes,
- ExitNodes, and StrictNodes config options.
- This release also rotates two directory authority keys, due to a
- security breach of some of the Torproject servers.
- o Directory authority changes:
- - Rotate keys (both v3 identity and relay identity) for moria1
- and gabelmoo.
- o Major features (performance):
- - We were selecting our guards uniformly at random, and then weighting
- which of our guards we'd use uniformly at random. This imbalance
- meant that Tor clients were severely limited on throughput (and
- probably latency too) by the first hop in their circuit. Now we
- select guards weighted by currently advertised bandwidth. We also
- automatically discard guards picked using the old algorithm. Fixes
- bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry.
- - When choosing which cells to relay first, relays can now favor
- circuits that have been quiet recently, to provide lower latency
- for low-volume circuits. By default, relays enable or disable this
- feature based on a setting in the consensus. You can override
- this default by using the new "CircuitPriorityHalflife" config
- option. Design and code by Ian Goldberg, Can Tang, and Chris
- Alexander.
- - Add separate per-conn write limiting to go with the per-conn read
- limiting. We added a global write limit in Tor 0.1.2.5-alpha,
- but never per-conn write limits.
- - New consensus params "bwconnrate" and "bwconnburst" to let us
- rate-limit client connections as they enter the network. It's
- controlled in the consensus so we can turn it on and off for
- experiments. It's starting out off. Based on proposal 163.
- o Major features (relay selection options):
- - Switch to a StrictNodes config option, rather than the previous
- "StrictEntryNodes" / "StrictExitNodes" separation that was missing a
- "StrictExcludeNodes" option.
- - If EntryNodes, ExitNodes, ExcludeNodes, or ExcludeExitNodes
- change during a config reload, mark and discard all our origin
- circuits. This fix should address edge cases where we change the
- config options and but then choose a circuit that we created before
- the change.
- - If EntryNodes or ExitNodes are set, be more willing to use an
- unsuitable (e.g. slow or unstable) circuit. The user asked for it,
- they get it.
- - Make EntryNodes config option much more aggressive even when
- StrictNodes is not set. Before it would prepend your requested
- entrynodes to your list of guard nodes, but feel free to use others
- after that. Now it chooses only from your EntryNodes if any of
- those are available, and only falls back to others if a) they're
- all down and b) StrictNodes is not set.
- - Now we refresh your entry guards from EntryNodes at each consensus
- fetch -- rather than just at startup and then they slowly rot as
- the network changes.
- o Major bugfixes:
- - Stop bridge directory authorities from answering dbg-stability.txt
- directory queries, which would let people fetch a list of all
- bridge identities they track. Bugfix on 0.2.1.6-alpha.
- o Minor features:
- - Log a notice when we get a new control connection. Now it's easier
- for security-conscious users to recognize when a local application
- is knocking on their controller door. Suggested by bug 1196.
- - New config option "CircuitStreamTimeout" to override our internal
- timeout schedule for how many seconds until we detach a stream from
- a circuit and try a new circuit. If your network is particularly
- slow, you might want to set this to a number like 60.
- - New controller command "getinfo config-text". It returns the
- contents that Tor would write if you send it a SAVECONF command,
- so the controller can write the file to disk itself.
- - New options for SafeLogging to allow scrubbing only log messages
- generated while acting as a relay.
- - Ship the bridges spec file in the tarball too.
- - Avoid a mad rush at the beginning of each month when each client
- rotates half of its guards. Instead we spread the rotation out
- throughout the month, but we still avoid leaving a precise timestamp
- in the state file about when we first picked the guard. Improves
- over the behavior introduced in 0.1.2.17.
- o Minor bugfixes (compiling):
- - Fix compilation on OS X 10.3, which has a stub mlockall() but
- hides it. Bugfix on 0.2.2.6-alpha.
- - Fix compilation on Solaris by removing support for the
- DisableAllSwap config option. Solaris doesn't have an rlimit for
- mlockall, so we cannot use it safely. Fixes bug 1198; bugfix on
- 0.2.2.6-alpha.
- o Minor bugfixes (crashes):
- - Do not segfault when writing buffer stats when we haven't observed
- a single circuit to report about. Found by Fabian Lanze. Bugfix on
- 0.2.2.1-alpha.
- - If we're in the pathological case where there's no exit bandwidth
- but there is non-exit bandwidth, or no guard bandwidth but there
- is non-guard bandwidth, don't crash during path selection. Bugfix
- on 0.2.0.3-alpha.
- - Fix an impossible-to-actually-trigger buffer overflow in relay
- descriptor generation. Bugfix on 0.1.0.15.
- o Minor bugfixes (privacy):
- - Fix an instance where a Tor directory mirror might accidentally
- log the IP address of a misbehaving Tor client. Bugfix on
- 0.1.0.1-rc.
- - Don't list Windows capabilities in relay descriptors. We never made
- use of them, and maybe it's a bad idea to publish them. Bugfix
- on 0.1.1.8-alpha.
- o Minor bugfixes (other):
- - Resolve an edge case in path weighting that could make us misweight
- our relay selection. Fixes bug 1203; bugfix on 0.0.8rc1.
- - Fix statistics on client numbers by country as seen by bridges that
- were broken in 0.2.2.1-alpha. Also switch to reporting full 24-hour
- intervals instead of variable 12-to-48-hour intervals.
- - After we free an internal connection structure, overwrite it
- with a different memory value than we use for overwriting a freed
- internal circuit structure. Should help with debugging. Suggested
- by bug 1055.
- - Update our OpenSSL 0.9.8l fix so that it works with OpenSSL 0.9.8m
- too.
- o Removed features:
- - Remove the HSAuthorityRecordStats option that version 0 hidden
- service authorities could have used to track statistics of overall
- hidden service usage.
- Changes in version 0.2.1.22 - 2010-01-19
- Tor 0.2.1.22 fixes a critical privacy problem in bridge directory
- authorities -- it would tell you its whole history of bridge descriptors
- if you make the right directory request. This stable update also
- rotates two of the seven v3 directory authority keys and locations.
- o Directory authority changes:
- - Rotate keys (both v3 identity and relay identity) for moria1
- and gabelmoo.
- o Major bugfixes:
- - Stop bridge directory authorities from answering dbg-stability.txt
- directory queries, which would let people fetch a list of all
- bridge identities they track. Bugfix on 0.2.1.6-alpha.
- Changes in version 0.2.1.21 - 2009-12-21
- Tor 0.2.1.21 fixes an incompatibility with the most recent OpenSSL
- library. If you use Tor on Linux / Unix and you're getting SSL
- renegotiation errors, upgrading should help. We also recommend an
- upgrade if you're an exit relay.
- o Major bugfixes:
- - Work around a security feature in OpenSSL 0.9.8l that prevents our
- handshake from working unless we explicitly tell OpenSSL that we
- are using SSL renegotiation safely. We are, of course, but OpenSSL
- 0.9.8l won't work unless we say we are.
- - Avoid crashing if the client is trying to upload many bytes and the
- circuit gets torn down at the same time, or if the flip side
- happens on the exit relay. Bugfix on 0.2.0.1-alpha; fixes bug 1150.
- o Minor bugfixes:
- - Do not refuse to learn about authority certs and v2 networkstatus
- documents that are older than the latest consensus. This bug might
- have degraded client bootstrapping. Bugfix on 0.2.0.10-alpha.
- Spotted and fixed by xmux.
- - Fix a couple of very-hard-to-trigger memory leaks, and one hard-to-
- trigger platform-specific option misparsing case found by Coverity
- Scan.
- - Fix a compilation warning on Fedora 12 by removing an impossible-to-
- trigger assert. Fixes bug 1173.
- Changes in version 0.2.2.6-alpha - 2009-11-19
- Tor 0.2.2.6-alpha lays the groundwork for many upcoming features:
- support for the new lower-footprint "microdescriptor" directory design,
- future-proofing our consensus format against new hash functions or
- other changes, and an Android port. It also makes Tor compatible with
- the upcoming OpenSSL 0.9.8l release, and fixes a variety of bugs.
- o Major features:
- - Directory authorities can now create, vote on, and serve multiple
- parallel formats of directory data as part of their voting process.
- Partially implements Proposal 162: "Publish the consensus in
- multiple flavors".
- - Directory authorities can now agree on and publish small summaries
- of router information that clients can use in place of regular
- server descriptors. This transition will eventually allow clients
- to use far less bandwidth for downloading information about the
- network. Begins the implementation of Proposal 158: "Clients
- download consensus + microdescriptors".
- - The directory voting system is now extensible to use multiple hash
- algorithms for signatures and resource selection. Newer formats
- are signed with SHA256, with a possibility for moving to a better
- hash algorithm in the future.
- - New DisableAllSwap option. If set to 1, Tor will attempt to lock all
- current and future memory pages via mlockall(). On supported
- platforms (modern Linux and probably BSD but not Windows or OS X),
- this should effectively disable any and all attempts to page out
- memory. This option requires that you start your Tor as root --
- if you use DisableAllSwap, please consider using the User option
- to properly reduce the privileges of your Tor.
- - Numerous changes, bugfixes, and workarounds from Nathan Freitas
- to help Tor build correctly for Android phones.
- o Major bugfixes:
- - Work around a security feature in OpenSSL 0.9.8l that prevents our
- handshake from working unless we explicitly tell OpenSSL that we
- are using SSL renegotiation safely. We are, but OpenSSL 0.9.8l
- won't work unless we say we are.
- o Minor bugfixes:
- - Fix a crash bug when trying to initialize the evdns module in
- Libevent 2. Bugfix on 0.2.1.16-rc.
- - Stop logging at severity 'warn' when some other Tor client tries
- to establish a circuit with us using weak DH keys. It's a protocol
- violation, but that doesn't mean ordinary users need to hear about
- it. Fixes the bug part of bug 1114. Bugfix on 0.1.0.13.
- - Do not refuse to learn about authority certs and v2 networkstatus
- documents that are older than the latest consensus. This bug might
- have degraded client bootstrapping. Bugfix on 0.2.0.10-alpha.
- Spotted and fixed by xmux.
- - Fix numerous small code-flaws found by Coverity Scan Rung 3.
- - If all authorities restart at once right before a consensus vote,
- nobody will vote about "Running", and clients will get a consensus
- with no usable relays. Instead, authorities refuse to build a
- consensus if this happens. Bugfix on 0.2.0.10-alpha; fixes bug 1066.
- - If your relay can't keep up with the number of incoming create
- cells, it would log one warning per failure into your logs. Limit
- warnings to 1 per minute. Bugfix on 0.0.2pre10; fixes bug 1042.
- - Bridges now use "reject *:*" as their default exit policy. Bugfix
- on 0.2.0.3-alpha; fixes bug 1113.
- - Fix a memory leak on directory authorities during voting that was
- introduced in 0.2.2.1-alpha. Found via valgrind.
- Changes in version 0.2.1.20 - 2009-10-15
- Tor 0.2.1.20 fixes a crash bug when you're accessing many hidden
- services at once, prepares for more performance improvements, and
- fixes a bunch of smaller bugs.
- The Windows and OS X bundles also include a more recent Vidalia,
- and switch from Privoxy to Polipo.
- The OS X installers are now drag and drop. It's best to un-install
- Tor/Vidalia and then install this new bundle, rather than upgrade. If
- you want to upgrade, you'll need to update the paths for Tor and Polipo
- in the Vidalia Settings window.
- o Major bugfixes:
- - Send circuit or stream sendme cells when our window has decreased
- by 100 cells, not when it has decreased by 101 cells. Bug uncovered
- by Karsten when testing the "reduce circuit window" performance
- patch. Bugfix on the 54th commit on Tor -- from July 2002,
- before the release of Tor 0.0.0. This is the new winner of the
- oldest-bug prize.
- - Fix a remotely triggerable memory leak when a consensus document
- contains more than one signature from the same voter. Bugfix on
- 0.2.0.3-alpha.
- - Avoid segfault in rare cases when finishing an introduction circuit
- as a client and finding out that we don't have an introduction key
- for it. Fixes bug 1073. Reported by Aaron Swartz.
- o Major features:
- - Tor now reads the "circwindow" parameter out of the consensus,
- and uses that value for its circuit package window rather than the
- default of 1000 cells. Begins the implementation of proposal 168.
- o New directory authorities:
- - Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
- authority.
- - Move moria1 and tonga to alternate IP addresses.
- o Minor bugfixes:
- - Fix a signed/unsigned compile warning in 0.2.1.19.
- - Fix possible segmentation fault on directory authorities. Bugfix on
- 0.2.1.14-rc.
- - Fix an extremely rare infinite recursion bug that could occur if
- we tried to log a message after shutting down the log subsystem.
- Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
- - Fix an obscure bug where hidden services on 64-bit big-endian
- systems might mis-read the timestamp in v3 introduce cells, and
- refuse to connect back to the client. Discovered by "rotor".
- Bugfix on 0.2.1.6-alpha.
- - We were triggering a CLOCK_SKEW controller status event whenever
- we connect via the v2 connection protocol to any relay that has
- a wrong clock. Instead, we should only inform the controller when
- it's a trusted authority that claims our clock is wrong. Bugfix
- on 0.2.0.20-rc; starts to fix bug 1074. Reported by SwissTorExit.
- - We were telling the controller about CHECKING_REACHABILITY and
- REACHABILITY_FAILED status events whenever we launch a testing
- circuit or notice that one has failed. Instead, only tell the
- controller when we want to inform the user of overall success or
- overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075. Reported
- by SwissTorExit.
- - Don't warn when we're using a circuit that ends with a node
- excluded in ExcludeExitNodes, but the circuit is not used to access
- the outside world. This should help fix bug 1090. Bugfix on
- 0.2.1.6-alpha.
- - Work around a small memory leak in some versions of OpenSSL that
- stopped the memory used by the hostname TLS extension from being
- freed.
- o Minor features:
- - Add a "getinfo status/accepted-server-descriptor" controller
- command, which is the recommended way for controllers to learn
- whether our server descriptor has been successfully received by at
- least on directory authority. Un-recommend good-server-descriptor
- getinfo and status events until we have a better design for them.
- Changes in version 0.2.2.5-alpha - 2009-10-11
- Tor 0.2.2.5-alpha fixes a few compile problems in 0.2.2.4-alpha.
- o Major bugfixes:
- - Make the tarball compile again. Oops. Bugfix on 0.2.2.4-alpha.
- o Directory authorities:
- - Temporarily (just for this release) move dizum to an alternate
- IP address.
- Changes in version 0.2.2.4-alpha - 2009-10-10
- Tor 0.2.2.4-alpha fixes more crash bugs in 0.2.2.2-alpha. It also
- introduces a new unit test framework, shifts directry authority
- addresses around to reduce the impact from recent blocking events,
- and fixes a few smaller bugs.
- o Major bugfixes:
- - Fix several more asserts in the circuit_build_times code, for
- example one that causes Tor to fail to start once we have
- accumulated 5000 build times in the state file. Bugfixes on
- 0.2.2.2-alpha; fixes bug 1108.
- o New directory authorities:
- - Move moria1 and Tonga to alternate IP addresses.
- o Minor features:
- - Log SSL state transitions at debug level during handshake, and
- include SSL states in error messages. This may help debug future
- SSL handshake issues.
- - Add a new "Handshake" log domain for activities that happen
- during the TLS handshake.
- - Revert to the "June 3 2009" ip-to-country file. The September one
- seems to have removed most US IP addresses.
- - Directory authorities now reject Tor relays with versions less than
- 0.1.2.14. This step cuts out four relays from the current network,
- none of which are very big.
- o Minor bugfixes:
- - Fix a couple of smaller issues with gathering statistics. Bugfixes
- on 0.2.2.1-alpha.
- - Fix two memory leaks in the error case of
- circuit_build_times_parse_state(). Bugfix on 0.2.2.2-alpha.
- - Don't count one-hop circuits when we're estimating how long it
- takes circuits to build on average. Otherwise we'll set our circuit
- build timeout lower than we should. Bugfix on 0.2.2.2-alpha.
- - Directory authorities no longer change their opinion of, or vote on,
- whether a router is Running, unless they have themselves been
- online long enough to have some idea. Bugfix on 0.2.0.6-alpha.
- Fixes bug 1023.
- o Code simplifications and refactoring:
- - Revise our unit tests to use the "tinytest" framework, so we
- can run tests in their own processes, have smarter setup/teardown
- code, and so on. The unit test code has moved to its own
- subdirectory, and has been split into multiple modules.
- Changes in version 0.2.2.3-alpha - 2009-09-23
- Tor 0.2.2.3-alpha fixes a few crash bugs in 0.2.2.2-alpha.
- o Major bugfixes:
- - Fix an overzealous assert in our new circuit build timeout code.
- Bugfix on 0.2.2.2-alpha; fixes bug 1103.
- o Minor bugfixes:
- - If the networkstatus consensus tells us that we should use a
- negative circuit package window, ignore it. Otherwise we'll
- believe it and then trigger an assert. Bugfix on 0.2.2.2-alpha.
- Changes in version 0.2.2.2-alpha - 2009-09-21
- Tor 0.2.2.2-alpha introduces our latest performance improvement for
- clients: Tor tracks the average time it takes to build a circuit, and
- avoids using circuits that take too long to build. For fast connections,
- this feature can cut your expected latency in half. For slow or flaky
- connections, it could ruin your Tor experience. Let us know if it does!
- o Major features:
- - Tor now tracks how long it takes to build client-side circuits
- over time, and adapts its timeout to local network performance.
- Since a circuit that takes a long time to build will also provide
- bad performance, we get significant latency improvements by
- discarding the slowest 20% of circuits. Specifically, Tor creates
- circuits more aggressively than usual until it has enough data
- points for a good timeout estimate. Implements proposal 151.
- We are especially looking for reports (good and bad) from users with
- both EDGE and broadband connections that can move from broadband
- to EDGE and find out if the build-time data in the .tor/state gets
- reset without loss of Tor usability. You should also see a notice
- log message telling you that Tor has reset its timeout.
- - Directory authorities can now vote on arbitary integer values as
- part of the consensus process. This is designed to help set
- network-wide parameters. Implements proposal 167.
- - Tor now reads the "circwindow" parameter out of the consensus,
- and uses that value for its circuit package window rather than the
- default of 1000 cells. Begins the implementation of proposal 168.
- o Major bugfixes:
- - Fix a remotely triggerable memory leak when a consensus document
- contains more than one signature from the same voter. Bugfix on
- 0.2.0.3-alpha.
- o Minor bugfixes:
- - Fix an extremely rare infinite recursion bug that could occur if
- we tried to log a message after shutting down the log subsystem.
- Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
- - Fix parsing for memory or time units given without a space between
- the number and the unit. Bugfix on 0.2.2.1-alpha; fixes bug 1076.
- - A networkstatus vote must contain exactly one signature. Spec
- conformance issue. Bugfix on 0.2.0.3-alpha.
- - Fix an obscure bug where hidden services on 64-bit big-endian
- systems might mis-read the timestamp in v3 introduce cells, and
- refuse to connect back to the client. Discovered by "rotor".
- Bugfix on 0.2.1.6-alpha.
- - We were triggering a CLOCK_SKEW controller status event whenever
- we connect via the v2 connection protocol to any relay that has
- a wrong clock. Instead, we should only inform the controller when
- it's a trusted authority that claims our clock is wrong. Bugfix
- on 0.2.0.20-rc; starts to fix bug 1074. Reported by SwissTorExit.
- - We were telling the controller about CHECKING_REACHABILITY and
- REACHABILITY_FAILED status events whenever we launch a testing
- circuit or notice that one has failed. Instead, only tell the
- controller when we want to inform the user of overall success or
- overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075. Reported
- by SwissTorExit.
- - Don't warn when we're using a circuit that ends with a node
- excluded in ExcludeExitNodes, but the circuit is not used to access
- the outside world. This should help fix bug 1090, but more problems
- remain. Bugfix on 0.2.1.6-alpha.
- - Work around a small memory leak in some versions of OpenSSL that
- stopped the memory used by the hostname TLS extension from being
- freed.
- - Make our 'torify' script more portable; if we have only one of
- 'torsocks' or 'tsocks' installed, don't complain to the user;
- and explain our warning about tsocks better.
- o Minor features:
- - Add a "getinfo status/accepted-server-descriptor" controller
- command, which is the recommended way for controllers to learn
- whether our server descriptor has been successfully received by at
- least on directory authority. Un-recommend good-server-descriptor
- getinfo and status events until we have a better design for them.
- - Update to the "September 4 2009" ip-to-country file.
- Changes in version 0.2.2.1-alpha - 2009-08-26
- Tor 0.2.2.1-alpha disables ".exit" address notation by default, allows
- Tor clients to bootstrap on networks where only port 80 is reachable,
- makes it more straightforward to support hardware crypto accelerators,
- and starts the groundwork for gathering stats safely at relays.
- o Security fixes:
- - Start the process of disabling ".exit" address notation, since it
- can be used for a variety of esoteric application-level attacks
- on users. To reenable it, set "AllowDotExit 1" in your torrc. Fix
- on 0.0.9rc5.
- o New directory authorities:
- - Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
- authority.
- o Major features:
- - New AccelName and AccelDir options add support for dynamic OpenSSL
- hardware crypto acceleration engines.
- - Tor now supports tunneling all of its outgoing connections over
- a SOCKS proxy, using the SOCKS4Proxy and/or SOCKS5Proxy
- configuration options. Code by Christopher Davis.
- o Major bugfixes:
- - Send circuit or stream sendme cells when our window has decreased
- by 100 cells, not when it has decreased by 101 cells. Bug uncovered
- by Karsten when testing the "reduce circuit window" performance
- patch. Bugfix on the 54th commit on Tor -- from July 2002,
- before the release of Tor 0.0.0. This is the new winner of the
- oldest-bug prize.
- o New options for gathering stats safely:
- - Directory mirrors that set "DirReqStatistics 1" write statistics
- about directory requests to disk every 24 hours. As compared to the
- --enable-geoip-stats flag in 0.2.1.x, there are a few improvements:
- 1) stats are written to disk exactly every 24 hours; 2) estimated
- shares of v2 and v3 requests are determined as mean values, not at
- the end of a measurement period; 3) unresolved requests are listed
- with country code '??'; 4) directories also measure download times.
- - Exit nodes that set "ExitPortStatistics 1" write statistics on the
- number of exit streams and transferred bytes per port to disk every
- 24 hours.
- - Relays that set "CellStatistics 1" write statistics on how long
- cells spend in their circuit queues to disk every 24 hours.
- - Entry nodes that set "EntryStatistics 1" write statistics on the
- rough number and origins of connecting clients to disk every 24
- hours.
- - Relays that write any of the above statistics to disk and set
- "ExtraInfoStatistics 1" include the past 24 hours of statistics in
- their extra-info documents.
- o Minor features:
- - New --digests command-line switch to output the digests of the
- source files Tor was built with.
- - The "torify" script now uses torsocks where available.
- - The memarea code now uses a sentinel value at the end of each area
- to make sure nothing writes beyond the end of an area. This might
- help debug some conceivable causes of bug 930.
- - Time and memory units in the configuration file can now be set to
- fractional units. For example, "2.5 GB" is now a valid value for
- AccountingMax.
- - Certain Tor clients (such as those behind check.torproject.org) may
- want to fetch the consensus in an extra early manner. To enable this
- a user may now set FetchDirInfoExtraEarly to 1. This also depends on
- setting FetchDirInfoEarly to 1. Previous behavior will stay the same
- as only certain clients who must have this information sooner should
- set this option.
- - Instead of adding the svn revision to the Tor version string, report
- the git commit (when we're building from a git checkout).
- o Minor bugfixes:
- - If any of the v3 certs we download are unparseable, we should
- actually notice the failure so we don't retry indefinitely. Bugfix
- on 0.2.0.x; reported by "rotator".
- - If the cached cert file is unparseable, warn but don't exit.
- - Fix possible segmentation fault on directory authorities. Bugfix on
- 0.2.1.14-rc.
- - When Tor fails to parse a descriptor of any kind, dump it to disk.
- Might help diagnosing bug 1051.
- o Deprecated and removed features:
- - The controller no longer accepts the old obsolete "addr-mappings/"
- or "unregistered-servers-" GETINFO values.
- - Hidden services no longer publish version 0 descriptors, and clients
- do not request or use version 0 descriptors. However, the old hidden
- service authorities still accept and serve version 0 descriptors
- when contacted by older hidden services/clients.
- - The EXTENDED_EVENTS and VERBOSE_NAMES controller features are now
- always on; using them is necessary for correct forward-compatible
- controllers.
- - Remove support for .noconnect style addresses. Nobody was using
- them, and they provided another avenue for detecting Tor users
- via application-level web tricks.
- o Packaging changes:
- - Upgrade Vidalia from 0.1.15 to 0.2.3 in the Windows and OS X
- installer bundles. See
- https://trac.vidalia-project.net/browser/vidalia/tags/vidalia-0.2.3/CHANGELOG
- for details of what's new in Vidalia 0.2.3.
- - Windows Vidalia Bundle: update Privoxy from 3.0.6 to 3.0.14-beta.
- - OS X Vidalia Bundle: move to Polipo 1.0.4 with Tor specific
- configuration file, rather than the old Privoxy.
- - OS X Vidalia Bundle: Vidalia, Tor, and Polipo are compiled as
- x86-only for better compatibility with OS X 10.6, aka Snow Leopard.
- - OS X Tor Expert Bundle: Tor is compiled as x86-only for
- better compatibility with OS X 10.6, aka Snow Leopard.
- - OS X Vidalia Bundle: The multi-package installer is now replaced
- by a simple drag and drop to the /Applications folder. This change
- occurred with the upgrade to Vidalia 0.2.3.
- Changes in version 0.2.1.19 - 2009-07-28
- Tor 0.2.1.19 fixes a major bug with accessing and providing hidden
- services on Tor 0.2.1.3-alpha through 0.2.1.18.
- o Major bugfixes:
- - Make accessing hidden services on 0.2.1.x work right again.
- Bugfix on 0.2.1.3-alpha; workaround for bug 1038. Diagnosis and
- part of patch provided by "optimist".
- o Minor features:
- - When a relay/bridge is writing out its identity key fingerprint to
- the "fingerprint" file and to its logs, write it without spaces. Now
- it will look like the fingerprints in our bridges documentation,
- and confuse fewer users.
- o Minor bugfixes:
- - Relays no longer publish a new server descriptor if they change
- their MaxAdvertisedBandwidth config option but it doesn't end up
- changing their advertised bandwidth numbers. Bugfix on 0.2.0.28-rc;
- fixes bug 1026. Patch from Sebastian.
- - Avoid leaking memory every time we get a create cell but we have
- so many already queued that we refuse it. Bugfix on 0.2.0.19-alpha;
- fixes bug 1034. Reported by BarkerJr.
- Changes in version 0.2.1.18 - 2009-07-24
- Tor 0.2.1.18 lays the foundations for performance improvements,
- adds status events to help users diagnose bootstrap problems, adds
- optional authentication/authorization for hidden services, fixes a
- variety of potential anonymity problems, and includes a huge pile of
- other features and bug fixes.
- o Build fixes:
- - Add LIBS=-lrt to Makefile.am so the Tor RPMs use a static libevent.
- Changes in version 0.2.1.17-rc - 2009-07-07
- Tor 0.2.1.17-rc marks the fourth -- and hopefully last -- release
- candidate for the 0.2.1.x series. It lays the groundwork for further
- client performance improvements, and also fixes a big bug with directory
- authorities that were causing them to assign Guard and Stable flags
- poorly.
- The Windows bundles also finally include the geoip database that we
- thought we'd been shipping since 0.2.0.x (oops), and the OS X bundles
- should actually install Torbutton rather than giving you a cryptic
- failure message (oops).
- o Major features:
- - Clients now use the bandwidth values in the consensus, rather than
- the bandwidth values in each relay descriptor. This approach opens
- the door to more accurate bandwidth estimates once the directory
- authorities start doing active measurements. Implements more of
- proposal 141.
- o Major bugfixes:
- - When Tor clients restart after 1-5 days, they discard all their
- cached descriptors as too old, but they still use the cached
- consensus document. This approach is good for robustness, but
- bad for performance: since they don't know any bandwidths, they
- end up choosing at random rather than weighting their choice by
- speed. Fixed by the above feature of putting bandwidths in the
- consensus. Bugfix on 0.2.0.x.
- - Directory authorities were neglecting to mark relays down in their
- internal histories if the relays fall off the routerlist without
- ever being found unreachable. So there were relays in the histories
- that haven't been seen for eight months, and are listed as being
- up for eight months. This wreaked havoc on the "median wfu"
- and "median mtbf" calculations, in turn making Guard and Stable
- flags very wrong, hurting network performance. Fixes bugs 696 and
- 969. Bugfix on 0.2.0.6-alpha.
- o Minor bugfixes:
- - Serve the DirPortFrontPage page even when we have been approaching
- our quotas recently. Fixes bug 1013; bugfix on 0.2.1.8-alpha.
- - The control port would close the connection before flushing long
- replies, such as the network consensus, if a QUIT command was issued
- before the reply had completed. Now, the control port flushes all
- pending replies before closing the connection. Also fixed a spurious
- warning when a QUIT command is issued after a malformed or rejected
- AUTHENTICATE command, but before the connection was closed. Patch
- by Marcus Griep. Bugfix on 0.2.0.x; fixes bugs 1015 and 1016.
- - When we can't find an intro key for a v2 hidden service descriptor,
- fall back to the v0 hidden service descriptor and log a bug message.
- Workaround for bug 1024.
- - Fix a log message that did not respect the SafeLogging option.
- Resolves bug 1027.
- o Minor features:
- - If we're a relay and we change our IP address, be more verbose
- about the reason that made us change. Should help track down
- further bugs for relays on dynamic IP addresses.
- Changes in version 0.2.0.35 - 2009-06-24
- o Security fix:
- - Avoid crashing in the presence of certain malformed descriptors.
- Found by lark, and by automated fuzzing.
- - Fix an edge case where a malicious exit relay could convince a
- controller that the client's DNS question resolves to an internal IP
- address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.
- o Major bugfixes:
- - Finally fix the bug where dynamic-IP relays disappear when their
- IP address changes: directory mirrors were mistakenly telling
- them their old address if they asked via begin_dir, so they
- never got an accurate answer about their new address, so they
- just vanished after a day. For belt-and-suspenders, relays that
- don't set Address in their config now avoid using begin_dir for
- all direct connections. Should fix bugs 827, 883, and 900.
- - Fix a timing-dependent, allocator-dependent, DNS-related crash bug
- that would occur on some exit nodes when DNS failures and timeouts
- occurred in certain patterns. Fix for bug 957.
- o Minor bugfixes:
- - When starting with a cache over a few days old, do not leak
- memory for the obsolete router descriptors in it. Bugfix on
- 0.2.0.33; fixes bug 672.
- - Hidden service clients didn't use a cached service descriptor that
- was older than 15 minutes, but wouldn't fetch a new one either,
- because there was already one in the cache. Now, fetch a v2
- descriptor unless the same descriptor was added to the cache within
- the last 15 minutes. Fixes bug 997; reported by Marcus Griep.
- Changes in version 0.2.1.16-rc - 2009-06-20
- Tor 0.2.1.16-rc speeds up performance for fast exit relays, and fixes
- a bunch of minor bugs.
- o Security fixes:
- - Fix an edge case where a malicious exit relay could convince a
- controller that the client's DNS question resolves to an internal IP
- address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.
- o Major performance improvements (on 0.2.0.x):
- - Disable and refactor some debugging checks that forced a linear scan
- over the whole server-side DNS cache. These accounted for over 50%
- of CPU time on a relatively busy exit node's gprof profile. Found
- by Jacob.
- - Disable some debugging checks that appeared in exit node profile
- data.
- o Minor features:
- - Update to the "June 3 2009" ip-to-country file.
- - Do not have tor-resolve automatically refuse all .onion addresses;
- if AutomapHostsOnResolve is set in your torrc, this will work fine.
- o Minor bugfixes (on 0.2.0.x):
- - Log correct error messages for DNS-related network errors on
- Windows.
- - Fix a race condition that could cause crashes or memory corruption
- when running as a server with a controller listening for log
- messages.
- - Avoid crashing when we have a policy specified in a DirPolicy or
- SocksPolicy or ReachableAddresses option with ports set on it,
- and we re-load the policy. May fix bug 996.
- - Hidden service clients didn't use a cached service descriptor that
- was older than 15 minutes, but wouldn't fetch a new one either,
- because there was already one in the cache. Now, fetch a v2
- descriptor unless the same descriptor was added to the cache within
- the last 15 minutes. Fixes bug 997; reported by Marcus Griep.
- o Minor bugfixes (on 0.2.1.x):
- - Don't warn users about low port and hibernation mix when they
- provide a *ListenAddress directive to fix that. Bugfix on
- 0.2.1.15-rc.
- - When switching back and forth between bridge mode, do not start
- gathering GeoIP data until two hours have passed.
- - Do not complain that the user has requested an excluded node as
- an exit when the node is not really an exit. This could happen
- because the circuit was for testing, or an introduction point.
- Fix for bug 984.
- Changes in version 0.2.1.15-rc - 2009-05-25
- Tor 0.2.1.15-rc marks the second release candidate for the 0.2.1.x
- series. It fixes a major bug on fast exit relays, as well as a variety
- of more minor bugs.
- o Major bugfixes (on 0.2.0.x):
- - Fix a timing-dependent, allocator-dependent, DNS-related crash bug
- that would occur on some exit nodes when DNS failures and timeouts
- occurred in certain patterns. Fix for bug 957.
- o Minor bugfixes (on 0.2.0.x):
- - Actually return -1 in the error case for read_bandwidth_usage().
- Harmless bug, since we currently don't care about the return value
- anywhere. Bugfix on 0.2.0.9-alpha.
- - Provide a more useful log message if bug 977 (related to buffer
- freelists) ever reappears, and do not crash right away.
- - Fix an assertion failure on 64-bit platforms when we allocated
- memory right up to the end of a memarea, then realigned the memory
- one step beyond the end. Fixes a possible cause of bug 930.
- - Protect the count of open sockets with a mutex, so we can't
- corrupt it when two threads are closing or opening sockets at once.
- Fix for bug 939. Bugfix on 0.2.0.1-alpha.
- - Don't allow a bridge to publish its router descriptor to a
- non-bridge directory authority. Fixes part of bug 932.
- - When we change to or from being a bridge, reset our counts of
- client usage by country. Fixes bug 932.
- - Fix a bug that made stream bandwidth get misreported to the
- controller.
- - Stop using malloc_usable_size() to use more area than we had
- actually allocated: it was safe, but made valgrind really unhappy.
- - Fix a memory leak when v3 directory authorities load their keys
- and cert from disk. Bugfix on 0.2.0.1-alpha.
- o Minor bugfixes (on 0.2.1.x):
- - Fix use of freed memory when deciding to mark a non-addable
- descriptor as never-downloadable. Bugfix on 0.2.1.9-alpha.
- Changes in version 0.2.1.14-rc - 2009-04-12
- Tor 0.2.1.14-rc marks the first release candidate for the 0.2.1.x
- series. It begins fixing some major performance problems, and also
- finally addresses the bug that was causing relays on dynamic IP
- addresses to fall out of the directory.
- o Major features:
- - Clients replace entry guards that were chosen more than a few months
- ago. This change should significantly improve client performance,
- especially once more people upgrade, since relays that have been
- a guard for a long time are currently overloaded.
- o Major bugfixes (on 0.2.0):
- - Finally fix the bug where dynamic-IP relays disappear when their
- IP address changes: directory mirrors were mistakenly telling
- them their old address if they asked via begin_dir, so they
- never got an accurate answer about their new address, so they
- just vanished after a day. For belt-and-suspenders, relays that
- don't set Address in their config now avoid using begin_dir for
- all direct connections. Should fix bugs 827, 883, and 900.
- - Relays were falling out of the networkstatus consensus for
- part of a day if they changed their local config but the
- authorities discarded their new descriptor as "not sufficiently
- different". Now directory authorities accept a descriptor as changed
- if bandwidthrate or bandwidthburst changed. Partial fix for bug 962;
- patch by Sebastian.
- - Avoid crashing in the presence of certain malformed descriptors.
- Found by lark, and by automated fuzzing.
- o Minor features:
- - When generating circuit events with verbose nicknames for
- controllers, try harder to look up nicknames for routers on a
- circuit. (Previously, we would look in the router descriptors we had
- for nicknames, but not in the consensus.) Partial fix for bug 941.
- - If the bridge config line doesn't specify a port, assume 443.
- This makes bridge lines a bit smaller and easier for users to
- understand.
- - Raise the minimum bandwidth to be a relay from 20000 bytes to 20480
- bytes (aka 20KB/s), to match our documentation. Also update
- directory authorities so they always assign the Fast flag to relays
- with 20KB/s of capacity. Now people running relays won't suddenly
- find themselves not seeing any use, if the network gets faster
- on average.
- - Update to the "April 3 2009" ip-to-country file.
- o Minor bugfixes:
- - Avoid trying to print raw memory to the logs when we decide to
- give up on downloading a given relay descriptor. Bugfix on
- 0.2.1.9-alpha.
- - In tor-resolve, when the Tor client to use is specified by
- <hostname>:<port>, actually use the specified port rather than
- defaulting to 9050. Bugfix on 0.2.1.6-alpha.
- - Make directory usage recording work again. Bugfix on 0.2.1.6-alpha.
- - When starting with a cache over a few days old, do not leak
- memory for the obsolete router descriptors in it. Bugfix on
- 0.2.0.33.
- - Avoid double-free on list of successfully uploaded hidden
- service discriptors. Fix for bug 948. Bugfix on 0.2.1.6-alpha.
- - Change memarea_strndup() implementation to work even when
- duplicating a string at the end of a page. This bug was
- harmless for now, but could have meant crashes later. Fix by
- lark. Bugfix on 0.2.1.1-alpha.
- - Limit uploaded directory documents to be 16M rather than 500K.
- The directory authorities were refusing v3 consensus votes from
- other authorities, since the votes are now 504K. Fixes bug 959;
- bugfix on 0.0.2pre17 (where we raised it from 50K to 500K ;).
- - Directory authorities should never send a 503 "busy" response to
- requests for votes or keys. Bugfix on 0.2.0.8-alpha; exposed by
- bug 959.
- Changes in version 0.2.1.13-alpha - 2009-03-09
- Tor 0.2.1.13-alpha includes another big pile of minor bugfixes and
- cleanups. We're finally getting close to a release candidate.
- o Major bugfixes:
- - Correctly update the list of which countries we exclude as
- exits, when the GeoIP file is loaded or reloaded. Diagnosed by
- lark. Bugfix on 0.2.1.6-alpha.
- o Minor bugfixes (on 0.2.0.x and earlier):
- - Automatically detect MacOSX versions earlier than 10.4.0, and
- disable kqueue from inside Tor when running with these versions.
- We previously did this from the startup script, but that was no
- help to people who didn't use the startup script. Resolves bug 863.
- - When we had picked an exit node for a connection, but marked it as
- "optional", and it turned out we had no onion key for the exit,
- stop wanting that exit and try again. This situation may not
- be possible now, but will probably become feasible with proposal
- 158. Spotted by rovv. Fixes another case of bug 752.
- - Clients no longer cache certificates for authorities they do not
- recognize. Bugfix on 0.2.0.9-alpha.
- - When we can't transmit a DNS request due to a network error, retry
- it after a while, and eventually transmit a failing response to
- the RESOLVED cell. Bugfix on 0.1.2.5-alpha.
- - If the controller claimed responsibility for a stream, but that
- stream never finished making its connection, it would live
- forever in circuit_wait state. Now we close it after SocksTimeout
- seconds. Bugfix on 0.1.2.7-alpha; reported by Mike Perry.
- - Drop begin cells to a hidden service if they come from the middle
- of a circuit. Patch from lark.
- - When we erroneously receive two EXTEND cells for the same circuit
- ID on the same connection, drop the second. Patch from lark.
- - Fix a crash that occurs on exit nodes when a nameserver request
- timed out. Bugfix on 0.1.2.1-alpha; our CLEAR debugging code had
- been suppressing the bug since 0.1.2.10-alpha. Partial fix for
- bug 929.
- - Do not assume that a stack-allocated character array will be
- 64-bit aligned on platforms that demand that uint64_t access is
- aligned. Possible fix for bug 604.
- - Parse dates and IPv4 addresses in a locale- and libc-independent
- manner, to avoid platform-dependent behavior on malformed input.
- - Build correctly when configured to build outside the main source
- path. Patch from Michael Gold.
- - We were already rejecting relay begin cells with destination port
- of 0. Now also reject extend cells with destination port or address
- of 0. Suggested by lark.
- o Minor bugfixes (on 0.2.1.x):
- - Don't re-extend introduction circuits if we ran out of RELAY_EARLY
- cells. Bugfix on 0.2.1.3-alpha. Fixes more of bug 878.
- - If we're an exit node, scrub the IP address to which we are exiting
- in the logs. Bugfix on 0.2.1.8-alpha.
- o Minor features:
- - On Linux, use the prctl call to re-enable core dumps when the user
- is option is set.
- - New controller event NEWCONSENSUS that lists the networkstatus
- lines for every recommended relay. Now controllers like Torflow
- can keep up-to-date on which relays they should be using.
- - Update to the "February 26 2009" ip-to-country file.
- Changes in version 0.2.0.34 - 2009-02-08
- Tor 0.2.0.34 features several more security-related fixes. You should
- upgrade, especially if you run an exit relay (remote crash) or a
- directory authority (remote infinite loop), or you're on an older
- (pre-XP) or not-recently-patched Windows (remote exploit).
- This release marks end-of-life for Tor 0.1.2.x. Those Tor versions
- have many known flaws, and nobody should be using them. You should
- upgrade. If you're using a Linux or BSD and its packages are obsolete,
- stop using those packages and upgrade anyway.
- o Security fixes:
- - Fix an infinite-loop bug on handling corrupt votes under certain
- circumstances. Bugfix on 0.2.0.8-alpha.
- - Fix a temporary DoS vulnerability that could be performed by
- a directory mirror. Bugfix on 0.2.0.9-alpha; reported by lark.
- - Avoid a potential crash on exit nodes when processing malformed
- input. Remote DoS opportunity. Bugfix on 0.2.0.33.
- - Do not accept incomplete ipv4 addresses (like 192.168.0) as valid.
- Spec conformance issue. Bugfix on Tor 0.0.2pre27.
- o Minor bugfixes:
- - Fix compilation on systems where time_t is a 64-bit integer.
- Patch from Matthias Drochner.
- - Don't consider expiring already-closed client connections. Fixes
- bug 893. Bugfix on 0.0.2pre20.
- Changes in version 0.2.1.12-alpha - 2009-02-08
- Tor 0.2.1.12-alpha features several more security-related fixes. You
- should upgrade, especially if you run an exit relay (remote crash) or
- a directory authority (remote infinite loop), or you're on an older
- (pre-XP) or not-recently-patched Windows (remote exploit). It also
- includes a big pile of minor bugfixes and cleanups.
- o Security fixes:
- - Fix an infinite-loop bug on handling corrupt votes under certain
- circumstances. Bugfix on 0.2.0.8-alpha.
- - Fix a temporary DoS vulnerability that could be performed by
- a directory mirror. Bugfix on 0.2.0.9-alpha; reported by lark.
- - Avoid a potential crash on exit nodes when processing malformed
- input. Remote DoS opportunity. Bugfix on 0.2.1.7-alpha.
- o Minor bugfixes:
- - Let controllers actually ask for the "clients_seen" event for
- getting usage summaries on bridge relays. Bugfix on 0.2.1.10-alpha;
- reported by Matt Edman.
- - Fix a compile warning on OSX Panther. Fixes bug 913; bugfix against
- 0.2.1.11-alpha.
- - Fix a bug in address parsing that was preventing bridges or hidden
- service targets from being at IPv6 addresses.
- - Solve a bug that kept hardware crypto acceleration from getting
- enabled when accounting was turned on. Fixes bug 907. Bugfix on
- 0.0.9pre6.
- - Remove a bash-ism from configure.in to build properly on non-Linux
- platforms. Bugfix on 0.2.1.1-alpha.
- - Fix code so authorities _actually_ send back X-Descriptor-Not-New
- headers. Bugfix on 0.2.0.10-alpha.
- - Don't consider expiring already-closed client connections. Fixes
- bug 893. Bugfix on 0.0.2pre20.
- - Fix another interesting corner-case of bug 891 spotted by rovv:
- Previously, if two hosts had different amounts of clock drift, and
- one of them created a new connection with just the wrong timing,
- the other might decide to deprecate the new connection erroneously.
- Bugfix on 0.1.1.13-alpha.
- - Resolve a very rare crash bug that could occur when the user forced
- a nameserver reconfiguration during the middle of a nameserver
- probe. Fixes bug 526. Bugfix on 0.1.2.1-alpha.
- - Support changing value of ServerDNSRandomizeCase during SIGHUP.
- Bugfix on 0.2.1.7-alpha.
- - If we're using bridges and our network goes away, be more willing
- to forgive our bridges and try again when we get an application
- request. Bugfix on 0.2.0.x.
- o Minor features:
- - Support platforms where time_t is 64 bits long. (Congratulations,
- NetBSD!) Patch from Matthias Drochner.
- - Add a 'getinfo status/clients-seen' controller command, in case
- controllers want to hear clients_seen events but connect late.
- o Build changes:
- - Disable GCC's strict alias optimization by default, to avoid the
- likelihood of its introducing subtle bugs whenever our code violates
- the letter of C99's alias rules.
- Changes in version 0.2.0.33 - 2009-01-21
- Tor 0.2.0.33 fixes a variety of bugs that were making relays less
- useful to users. It also finally fixes a bug where a relay or client
- that's been off for many days would take a long time to bootstrap.
- This update also fixes an important security-related bug reported by
- Ilja van Sprundel. You should upgrade. (We'll send out more details
- about the bug once people have had some time to upgrade.)
- o Security fixes:
- - Fix a heap-corruption bug that may be remotely triggerable on
- some platforms. Reported by Ilja van Sprundel.
- o Major bugfixes:
- - When a stream at an exit relay is in state "resolving" or
- "connecting" and it receives an "end" relay cell, the exit relay
- would silently ignore the end cell and not close the stream. If
- the client never closes the circuit, then the exit relay never
- closes the TCP connection. Bug introduced in Tor 0.1.2.1-alpha;
- reported by "wood".
- - When sending CREATED cells back for a given circuit, use a 64-bit
- connection ID to find the right connection, rather than an addr:port
- combination. Now that we can have multiple OR connections between
- the same ORs, it is no longer possible to use addr:port to uniquely
- identify a connection.
- - Bridge relays that had DirPort set to 0 would stop fetching
- descriptors shortly after startup, and then briefly resume
- after a new bandwidth test and/or after publishing a new bridge
- descriptor. Bridge users that try to bootstrap from them would
- get a recent networkstatus but would get descriptors from up to
- 18 hours earlier, meaning most of the descriptors were obsolete
- already. Reported by Tas; bugfix on 0.2.0.13-alpha.
- - Prevent bridge relays from serving their 'extrainfo' document
- to anybody who asks, now that extrainfo docs include potentially
- sensitive aggregated client geoip summaries. Bugfix on
- 0.2.0.13-alpha.
- - If the cached networkstatus consensus is more than five days old,
- discard it rather than trying to use it. In theory it could be
- useful because it lists alternate directory mirrors, but in practice
- it just means we spend many minutes trying directory mirrors that
- are long gone from the network. Also discard router descriptors as
- we load them if they are more than five days old, since the onion
- key is probably wrong by now. Bugfix on 0.2.0.x. Fixes bug 887.
- o Minor bugfixes:
- - Do not mark smartlist_bsearch_idx() function as ATTR_PURE. This bug
- could make gcc generate non-functional binary search code. Bugfix
- on 0.2.0.10-alpha.
- - Build correctly on platforms without socklen_t.
- - Compile without warnings on solaris.
- - Avoid potential crash on internal error during signature collection.
- Fixes bug 864. Patch from rovv.
- - Correct handling of possible malformed authority signing key
- certificates with internal signature types. Fixes bug 880.
- Bugfix on 0.2.0.3-alpha.
- - Fix a hard-to-trigger resource leak when logging credential status.
- CID 349.
- - When we can't initialize DNS because the network is down, do not
- automatically stop Tor from starting. Instead, we retry failed
- dns_init() every 10 minutes, and change the exit policy to reject
- *:* until one succeeds. Fixes bug 691.
- - Use 64 bits instead of 32 bits for connection identifiers used with
- the controller protocol, to greatly reduce risk of identifier reuse.
- - When we're choosing an exit node for a circuit, and we have
- no pending streams, choose a good general exit rather than one that
- supports "all the pending streams". Bugfix on 0.1.1.x. Fix by rovv.
- - Fix another case of assuming, when a specific exit is requested,
- that we know more than the user about what hosts it allows.
- Fixes one case of bug 752. Patch from rovv.
- - Clip the MaxCircuitDirtiness config option to a minimum of 10
- seconds. Warn the user if lower values are given in the
- configuration. Bugfix on 0.1.0.1-rc. Patch by Sebastian.
- - Clip the CircuitBuildTimeout to a minimum of 30 seconds. Warn the
- user if lower values are given in the configuration. Bugfix on
- 0.1.1.17-rc. Patch by Sebastian.
- - Fix a memory leak when we decline to add a v2 rendezvous descriptor to
- the cache because we already had a v0 descriptor with the same ID.
- Bugfix on 0.2.0.18-alpha.
- - Fix a race condition when freeing keys shared between main thread
- and CPU workers that could result in a memory leak. Bugfix on
- 0.1.0.1-rc. Fixes bug 889.
- - Send a valid END cell back when a client tries to connect to a
- nonexistent hidden service port. Bugfix on 0.1.2.15. Fixes bug
- 840. Patch from rovv.
- - Check which hops rendezvous stream cells are associated with to
- prevent possible guess-the-streamid injection attacks from
- intermediate hops. Fixes another case of bug 446. Based on patch
- from rovv.
- - If a broken client asks a non-exit router to connect somewhere,
- do not even do the DNS lookup before rejecting the connection.
- Fixes another case of bug 619. Patch from rovv.
- - When a relay gets a create cell it can't decrypt (e.g. because it's
- using the wrong onion key), we were dropping it and letting the
- client time out. Now actually answer with a destroy cell. Fixes
- bug 904. Bugfix on 0.0.2pre8.
- o Minor bugfixes (hidden services):
- - Do not throw away existing introduction points on SIGHUP. Bugfix on
- 0.0.6pre1. Patch by Karsten. Fixes bug 874.
- o Minor features:
- - Report the case where all signatures in a detached set are rejected
- differently than the case where there is an error handling the
- detached set.
- - When we realize that another process has modified our cached
- descriptors, print out a more useful error message rather than
- triggering an assertion. Fixes bug 885. Patch from Karsten.
- - Implement the 0x20 hack to better resist DNS poisoning: set the
- case on outgoing DNS requests randomly, and reject responses that do
- not match the case correctly. This logic can be disabled with the
- ServerDNSRamdomizeCase setting, if you are using one of the 0.3%
- of servers that do not reliably preserve case in replies. See
- "Increased DNS Forgery Resistance through 0x20-Bit Encoding"
- for more info.
- - Check DNS replies for more matching fields to better resist DNS
- poisoning.
- - Never use OpenSSL compression: it wastes RAM and CPU trying to
- compress cells, which are basically all encrypted, compressed, or
- both.
- Changes in version 0.2.1.11-alpha - 2009-01-20
- Tor 0.2.1.11-alpha finishes fixing the "if your Tor is off for a
- week it will take a long time to bootstrap again" bug. It also fixes
- an important security-related bug reported by Ilja van Sprundel. You
- should upgrade. (We'll send out more details about the bug once people
- have had some time to upgrade.)
- o Security fixes:
- - Fix a heap-corruption bug that may be remotely triggerable on
- some platforms. Reported by Ilja van Sprundel.
- o Major bugfixes:
- - Discard router descriptors as we load them if they are more than
- five days old. Otherwise if Tor is off for a long time and then
- starts with cached descriptors, it will try to use the onion
- keys in those obsolete descriptors when building circuits. Bugfix
- on 0.2.0.x. Fixes bug 887.
- o Minor features:
- - Try to make sure that the version of Libevent we're running with
- is binary-compatible with the one we built with. May address bug
- 897 and others.
- - Make setting ServerDNSRandomizeCase to 0 actually work. Bugfix
- for bug 905. Bugfix on 0.2.1.7-alpha.
- - Add a new --enable-local-appdata configuration switch to change
- the default location of the datadir on win32 from APPDATA to
- LOCAL_APPDATA. In the future, we should migrate to LOCAL_APPDATA
- entirely. Patch from coderman.
- o Minor bugfixes:
- - Make outbound DNS packets respect the OutboundBindAddress setting.
- Fixes the bug part of bug 798. Bugfix on 0.1.2.2-alpha.
- - When our circuit fails at the first hop (e.g. we get a destroy
- cell back), avoid using that OR connection anymore, and also
- tell all the one-hop directory requests waiting for it that they
- should fail. Bugfix on 0.2.1.3-alpha.
- - In the torify(1) manpage, mention that tsocks will leak your
- DNS requests.
- Changes in version 0.2.1.10-alpha - 2009-01-06
- Tor 0.2.1.10-alpha fixes two major bugs in bridge relays (one that
- would make the bridge relay not so useful if it had DirPort set to 0,
- and one that could let an attacker learn a little bit of information
- about the bridge's users), and a bug that would cause your Tor relay
- to ignore a circuit create request it can't decrypt (rather than reply
- with an error). It also fixes a wide variety of other bugs.
- o Major bugfixes:
- - If the cached networkstatus consensus is more than five days old,
- discard it rather than trying to use it. In theory it could
- be useful because it lists alternate directory mirrors, but in
- practice it just means we spend many minutes trying directory
- mirrors that are long gone from the network. Helps bug 887 a bit;
- bugfix on 0.2.0.x.
- - Bridge relays that had DirPort set to 0 would stop fetching
- descriptors shortly after startup, and then briefly resume
- after a new bandwidth test and/or after publishing a new bridge
- descriptor. Bridge users that try to bootstrap from them would
- get a recent networkstatus but would get descriptors from up to
- 18 hours earlier, meaning most of the descriptors were obsolete
- already. Reported by Tas; bugfix on 0.2.0.13-alpha.
- - Prevent bridge relays from serving their 'extrainfo' document
- to anybody who asks, now that extrainfo docs include potentially
- sensitive aggregated client geoip summaries. Bugfix on
- 0.2.0.13-alpha.
- o Minor features:
- - New controller event "clients_seen" to report a geoip-based summary
- of which countries we've seen clients from recently. Now controllers
- like Vidalia can show bridge operators that they're actually making
- a difference.
- - Build correctly against versions of OpenSSL 0.9.8 or later built
- without support for deprecated functions.
- - Update to the "December 19 2008" ip-to-country file.
- o Minor bugfixes (on 0.2.0.x):
- - Authorities now vote for the Stable flag for any router whose
- weighted MTBF is at least 5 days, regardless of the mean MTBF.
- - Do not remove routers as too old if we do not have any consensus
- document. Bugfix on 0.2.0.7-alpha.
- - Do not accept incomplete ipv4 addresses (like 192.168.0) as valid.
- Spec conformance issue. Bugfix on Tor 0.0.2pre27.
- - When an exit relay resolves a stream address to a local IP address,
- do not just keep retrying that same exit relay over and
- over. Instead, just close the stream. Addresses bug 872. Bugfix
- on 0.2.0.32. Patch from rovv.
- - If a hidden service sends us an END cell, do not consider
- retrying the connection; just close it. Patch from rovv.
- - When we made bridge authorities stop serving bridge descriptors over
- unencrypted links, we also broke DirPort reachability testing for
- bridges. So bridges with a non-zero DirPort were printing spurious
- warns to their logs. Bugfix on 0.2.0.16-alpha. Fixes bug 709.
- - When a relay gets a create cell it can't decrypt (e.g. because it's
- using the wrong onion key), we were dropping it and letting the
- client time out. Now actually answer with a destroy cell. Fixes
- bug 904. Bugfix on 0.0.2pre8.
- - Squeeze 2-5% out of client performance (according to oprofile) by
- improving the implementation of some policy-manipulation functions.
- o Minor bugfixes (on 0.2.1.x):
- - Make get_interface_address() function work properly again; stop
- guessing the wrong parts of our address as our address.
- - Do not cannibalize a circuit if we're out of RELAY_EARLY cells to
- send on that circuit. Otherwise we might violate the proposal-110
- limit. Bugfix on 0.2.1.3-alpha. Partial fix for bug 878. Diagnosis
- thanks to Karsten.
- - When we're sending non-EXTEND cells to the first hop in a circuit,
- for example to use an encrypted directory connection, we don't need
- to use RELAY_EARLY cells: the first hop knows what kind of cell
- it is, and nobody else can even see the cell type. Conserving
- RELAY_EARLY cells makes it easier to cannibalize circuits like
- this later.
- - Stop logging nameserver addresses in reverse order.
- - If we are retrying a directory download slowly over and over, do
- not automatically give up after the 254th failure. Bugfix on
- 0.2.1.9-alpha.
- - Resume reporting accurate "stream end" reasons to the local control
- port. They were lost in the changes for Proposal 148. Bugfix on
- 0.2.1.9-alpha.
- o Deprecated and removed features:
- - The old "tor --version --version" command, which would print out
- the subversion "Id" of most of the source files, is now removed. It
- turned out to be less useful than we'd expected, and harder to
- maintain.
- o Code simplifications and refactoring:
- - Change our header file guard macros to be less likely to conflict
- with system headers. Adam Langley noticed that we were conflicting
- with log.h on Android.
- - Tool-assisted documentation cleanup. Nearly every function or
- static variable in Tor should have its own documentation now.
- Changes in version 0.2.1.9-alpha - 2008-12-25
- Tor 0.2.1.9-alpha fixes many more bugs, some of them security-related.
- o New directory authorities:
- - gabelmoo (the authority run by Karsten Loesing) now has a new
- IP address.
- o Security fixes:
- - Never use a connection with a mismatched address to extend a
- circuit, unless that connection is canonical. A canonical
- connection is one whose address is authenticated by the router's
- identity key, either in a NETINFO cell or in a router descriptor.
- - Avoid a possible memory corruption bug when receiving hidden service
- descriptors. Bugfix on 0.2.1.6-alpha.
- o Major bugfixes:
- - Fix a logic error that would automatically reject all but the first
- configured DNS server. Bugfix on 0.2.1.5-alpha. Possible fix for
- part of bug 813/868. Bug spotted by coderman.
- - When a stream at an exit relay is in state "resolving" or
- "connecting" and it receives an "end" relay cell, the exit relay
- would silently ignore the end cell and not close the stream. If
- the client never closes the circuit, then the exit relay never
- closes the TCP connection. Bug introduced in 0.1.2.1-alpha;
- reported by "wood".
- - When we can't initialize DNS because the network is down, do not
- automatically stop Tor from starting. Instead, retry failed
- dns_init() every 10 minutes, and change the exit policy to reject
- *:* until one succeeds. Fixes bug 691.
- o Minor features:
- - Give a better error message when an overzealous init script says
- "sudo -u username tor --user username". Makes Bug 882 easier for
- users to diagnose.
- - When a directory authority gives us a new guess for our IP address,
- log which authority we used. Hopefully this will help us debug
- the recent complaints about bad IP address guesses.
- - Detect svn revision properly when we're using git-svn.
- - Try not to open more than one descriptor-downloading connection
- to an authority at once. This should reduce load on directory
- authorities. Fixes bug 366.
- - Add cross-certification to newly generated certificates, so that
- a signing key is enough information to look up a certificate.
- Partial implementation of proposal 157.
- - Start serving certificates by <identity digest, signing key digest>
- pairs. Partial implementation of proposal 157.
- - Clients now never report any stream end reason except 'MISC'.
- Implements proposal 148.
- - On platforms with a maximum syslog string length, truncate syslog
- messages to that length ourselves, rather than relying on the
- system to do it for us.
- - Optimize out calls to time(NULL) that occur for every IO operation,
- or for every cell. On systems where time() is a slow syscall,
- this fix will be slightly helpful.
- - Exit servers can now answer resolve requests for ip6.arpa addresses.
- - When we download a descriptor that we then immediately (as
- a directory authority) reject, do not retry downloading it right
- away. Should save some bandwidth on authorities. Fix for bug
- 888. Patch by Sebastian Hahn.
- - When a download gets us zero good descriptors, do not notify
- Tor that new directory information has arrived.
- - Avoid some nasty corner cases in the logic for marking connections
- as too old or obsolete or noncanonical for circuits. Partial
- bugfix on bug 891.
- o Minor features (controller):
- - New CONSENSUS_ARRIVED event to note when a new consensus has
- been fetched and validated.
- - When we realize that another process has modified our cached
- descriptors file, print out a more useful error message rather
- than triggering an assertion. Fixes bug 885. Patch from Karsten.
- - Add an internal-use-only __ReloadTorrcOnSIGHUP option for
- controllers to prevent SIGHUP from reloading the
- configuration. Fixes bug 856.
- o Minor bugfixes:
- - Resume using the correct "REASON=" stream when telling the
- controller why we closed a stream. Bugfix in 0.2.1.1-alpha.
- - When a canonical connection appears later in our internal list
- than a noncanonical one for a given OR ID, always use the
- canonical one. Bugfix on 0.2.0.12-alpha. Fixes bug 805.
- Spotted by rovv.
- - Clip the MaxCircuitDirtiness config option to a minimum of 10
- seconds. Warn the user if lower values are given in the
- configuration. Bugfix on 0.1.0.1-rc. Patch by Sebastian.
- - Clip the CircuitBuildTimeout to a minimum of 30 seconds. Warn the
- user if lower values are given in the configuration. Bugfix on
- 0.1.1.17-rc. Patch by Sebastian.
- - Fix a race condition when freeing keys shared between main thread
- and CPU workers that could result in a memory leak. Bugfix on
- 0.1.0.1-rc. Fixes bug 889.
- o Minor bugfixes (hidden services):
- - Do not throw away existing introduction points on SIGHUP (bugfix on
- 0.0.6pre1); also, do not stall hidden services because we're
- throwing away introduction points; bugfix on 0.2.1.7-alpha. Spotted
- by John Brooks. Patch by Karsten. Fixes bug 874.
- - Fix a memory leak when we decline to add a v2 rendezvous
- descriptor to the cache because we already had a v0 descriptor
- with the same ID. Bugfix on 0.2.0.18-alpha.
- o Deprecated and removed features:
- - RedirectExits has been removed. It was deprecated since
- 0.2.0.3-alpha.
- - Finally remove deprecated "EXTENDED_FORMAT" controller feature. It
- has been called EXTENDED_EVENTS since 0.1.2.4-alpha.
- - Cell pools are now always enabled; --disable-cell-pools is ignored.
- o Code simplifications and refactoring:
- - Rename the confusing or_is_obsolete field to the more appropriate
- is_bad_for_new_circs, and move it to or_connection_t where it
- belongs.
- - Move edge-only flags from connection_t to edge_connection_t: not
- only is this better coding, but on machines of plausible alignment,
- it should save 4-8 bytes per connection_t. "Every little bit helps."
- - Rename ServerDNSAllowBrokenResolvConf to ServerDNSAllowBrokenConfig
- for consistency; keep old option working for backward compatibility.
- - Simplify the code for finding connections to use for a circuit.
- Changes in version 0.2.1.8-alpha - 2008-12-08
- Tor 0.2.1.8-alpha fixes some crash bugs in earlier alpha releases,
- builds better on unusual platforms like Solaris and old OS X, and
- fixes a variety of other issues.
- o Major features:
- - New DirPortFrontPage option that takes an html file and publishes
- it as "/" on the DirPort. Now relay operators can provide a
- disclaimer without needing to set up a separate webserver. There's
- a sample disclaimer in contrib/tor-exit-notice.html.
- o Security fixes:
- - When the client is choosing entry guards, now it selects at most
- one guard from a given relay family. Otherwise we could end up with
- all of our entry points into the network run by the same operator.
- Suggested by Camilo Viecco. Fix on 0.1.1.11-alpha.
- o Major bugfixes:
- - Fix a DOS opportunity during the voting signature collection process
- at directory authorities. Spotted by rovv. Bugfix on 0.2.0.x.
- - Fix a possible segfault when establishing an exit connection. Bugfix
- on 0.2.1.5-alpha.
- o Minor bugfixes:
- - Get file locking working on win32. Bugfix on 0.2.1.6-alpha. Fixes
- bug 859.
- - Made Tor a little less aggressive about deleting expired
- certificates. Partial fix for bug 854.
- - Stop doing unaligned memory access that generated bus errors on
- sparc64. Bugfix on 0.2.0.10-alpha. Fix for bug 862.
- - Fix a crash bug when changing EntryNodes from the controller. Bugfix
- on 0.2.1.6-alpha. Fix for bug 867. Patched by Sebastian.
- - Make USR2 log-level switch take effect immediately. Bugfix on
- 0.1.2.8-beta.
- - If one win32 nameserver fails to get added, continue adding the
- rest, and don't automatically fail.
- - Use fcntl() for locking when flock() is not available. Should fix
- compilation on Solaris. Should fix Bug 873. Bugfix on 0.2.1.6-alpha.
- - Do not mark smartlist_bsearch_idx() function as ATTR_PURE. This bug
- could make gcc generate non-functional binary search code. Bugfix
- on 0.2.0.10-alpha.
- - Build correctly on platforms without socklen_t.
- - Avoid potential crash on internal error during signature collection.
- Fixes bug 864. Patch from rovv.
- - Do not use C's stdio library for writing to log files. This will
- improve logging performance by a minute amount, and will stop
- leaking fds when our disk is full. Fixes bug 861.
- - Stop erroneous use of O_APPEND in cases where we did not in fact
- want to re-seek to the end of a file before every last write().
- - Correct handling of possible malformed authority signing key
- certificates with internal signature types. Fixes bug 880. Bugfix
- on 0.2.0.3-alpha.
- - Fix a hard-to-trigger resource leak when logging credential status.
- CID 349.
- o Minor features:
- - Directory mirrors no longer fetch the v1 directory or
- running-routers files. They are obsolete, and nobody asks for them
- anymore. This is the first step to making v1 authorities obsolete.
- o Minor features (controller):
- - Return circuit purposes in response to GETINFO circuit-status. Fixes
- bug 858.
- Changes in version 0.2.0.32 - 2008-11-20
- Tor 0.2.0.32 fixes a major security problem in Debian and Ubuntu
- packages (and maybe other packages) noticed by Theo de Raadt, fixes
- a smaller security flaw that might allow an attacker to access local
- services, further improves hidden service performance, and fixes a
- variety of other issues.
- o Security fixes:
- - The "User" and "Group" config options did not clear the
- supplementary group entries for the Tor process. The "User" option
- is now more robust, and we now set the groups to the specified
- user's primary group. The "Group" option is now ignored. For more
- detailed logging on credential switching, set CREDENTIAL_LOG_LEVEL
- in common/compat.c to LOG_NOTICE or higher. Patch by Jacob Appelbaum
- and Steven Murdoch. Bugfix on 0.0.2pre14. Fixes bug 848 and 857.
- - The "ClientDNSRejectInternalAddresses" config option wasn't being
- consistently obeyed: if an exit relay refuses a stream because its
- exit policy doesn't allow it, we would remember what IP address
- the relay said the destination address resolves to, even if it's
- an internal IP address. Bugfix on 0.2.0.7-alpha; patch by rovv.
- o Major bugfixes:
- - Fix a DOS opportunity during the voting signature collection process
- at directory authorities. Spotted by rovv. Bugfix on 0.2.0.x.
- o Major bugfixes (hidden services):
- - When fetching v0 and v2 rendezvous service descriptors in parallel,
- we were failing the whole hidden service request when the v0
- descriptor fetch fails, even if the v2 fetch is still pending and
- might succeed. Similarly, if the last v2 fetch fails, we were
- failing the whole hidden service request even if a v0 fetch is
- still pending. Fixes bug 814. Bugfix on 0.2.0.10-alpha.
- - When extending a circuit to a hidden service directory to upload a
- rendezvous descriptor using a BEGIN_DIR cell, almost 1/6 of all
- requests failed, because the router descriptor has not been
- downloaded yet. In these cases, do not attempt to upload the
- rendezvous descriptor, but wait until the router descriptor is
- downloaded and retry. Likewise, do not attempt to fetch a rendezvous
- descriptor from a hidden service directory for which the router
- descriptor has not yet been downloaded. Fixes bug 767. Bugfix
- on 0.2.0.10-alpha.
- o Minor bugfixes:
- - Fix several infrequent memory leaks spotted by Coverity.
- - When testing for libevent functions, set the LDFLAGS variable
- correctly. Found by Riastradh.
- - Avoid a bug where the FastFirstHopPK 0 option would keep Tor from
- bootstrapping with tunneled directory connections. Bugfix on
- 0.1.2.5-alpha. Fixes bug 797. Found by Erwin Lam.
- - When asked to connect to A.B.exit:80, if we don't know the IP for A
- and we know that server B rejects most-but-not all connections to
- port 80, we would previously reject the connection. Now, we assume
- the user knows what they were asking for. Fixes bug 752. Bugfix
- on 0.0.9rc5. Diagnosed by BarkerJr.
- - If we overrun our per-second write limits a little, count this as
- having used up our write allocation for the second, and choke
- outgoing directory writes. Previously, we had only counted this when
- we had met our limits precisely. Fixes bug 824. Patch from by rovv.
- Bugfix on 0.2.0.x (??).
- - Remove the old v2 directory authority 'lefkada' from the default
- list. It has been gone for many months.
- - Stop doing unaligned memory access that generated bus errors on
- sparc64. Bugfix on 0.2.0.10-alpha. Fixes bug 862.
- - Make USR2 log-level switch take effect immediately. Bugfix on
- 0.1.2.8-beta.
- o Minor bugfixes (controller):
- - Make DNS resolved events into "CLOSED", not "FAILED". Bugfix on
- 0.1.2.5-alpha. Fix by Robert Hogan. Resolves bug 807.
- Changes in version 0.2.1.7-alpha - 2008-11-08
- Tor 0.2.1.7-alpha fixes a major security problem in Debian and Ubuntu
- packages (and maybe other packages) noticed by Theo de Raadt, fixes
- a smaller security flaw that might allow an attacker to access local
- services, adds better defense against DNS poisoning attacks on exit
- relays, further improves hidden service performance, and fixes a
- variety of other issues.
- o Security fixes:
- - The "ClientDNSRejectInternalAddresses" config option wasn't being
- consistently obeyed: if an exit relay refuses a stream because its
- exit policy doesn't allow it, we would remember what IP address
- the relay said the destination address resolves to, even if it's
- an internal IP address. Bugfix on 0.2.0.7-alpha; patch by rovv.
- - The "User" and "Group" config options did not clear the
- supplementary group entries for the Tor process. The "User" option
- is now more robust, and we now set the groups to the specified
- user's primary group. The "Group" option is now ignored. For more
- detailed logging on credential switching, set CREDENTIAL_LOG_LEVEL
- in common/compat.c to LOG_NOTICE or higher. Patch by Jacob Appelbaum
- and Steven Murdoch. Bugfix on 0.0.2pre14. Fixes bug 848.
- - Do not use or believe expired v3 authority certificates. Patch
- from Karsten. Bugfix in 0.2.0.x. Fixes bug 851.
- o Minor features:
- - Now NodeFamily and MyFamily config options allow spaces in
- identity fingerprints, so it's easier to paste them in.
- Suggested by Lucky Green.
- - Implement the 0x20 hack to better resist DNS poisoning: set the
- case on outgoing DNS requests randomly, and reject responses that do
- not match the case correctly. This logic can be disabled with the
- ServerDNSRandomizeCase setting, if you are using one of the 0.3%
- of servers that do not reliably preserve case in replies. See
- "Increased DNS Forgery Resistance through 0x20-Bit Encoding"
- for more info.
- - Preserve case in replies to DNSPort requests in order to support
- the 0x20 hack for resisting DNS poisoning attacks.
- o Hidden service performance improvements:
- - When the client launches an introduction circuit, retry with a
- new circuit after 30 seconds rather than 60 seconds.
- - Launch a second client-side introduction circuit in parallel
- after a delay of 15 seconds (based on work by Christian Wilms).
- - Hidden services start out building five intro circuits rather
- than three, and when the first three finish they publish a service
- descriptor using those. Now we publish our service descriptor much
- faster after restart.
- o Minor bugfixes:
- - Minor fix in the warning messages when you're having problems
- bootstrapping; also, be more forgiving of bootstrap problems when
- we're still making incremental progress on a given bootstrap phase.
- - When we're choosing an exit node for a circuit, and we have
- no pending streams, choose a good general exit rather than one that
- supports "all the pending streams". Bugfix on 0.1.1.x. Fix by rovv.
- - Send a valid END cell back when a client tries to connect to a
- nonexistent hidden service port. Bugfix on 0.1.2.15. Fixes bug
- 840. Patch from rovv.
- - If a broken client asks a non-exit router to connect somewhere,
- do not even do the DNS lookup before rejecting the connection.
- Fixes another case of bug 619. Patch from rovv.
- - Fix another case of assuming, when a specific exit is requested,
- that we know more than the user about what hosts it allows.
- Fixes another case of bug 752. Patch from rovv.
- - Check which hops rendezvous stream cells are associated with to
- prevent possible guess-the-streamid injection attacks from
- intermediate hops. Fixes another case of bug 446. Based on patch
- from rovv.
- - Avoid using a negative right-shift when comparing 32-bit
- addresses. Possible fix for bug 845 and bug 811.
- - Make the assert_circuit_ok() function work correctly on circuits that
- have already been marked for close.
- - Fix read-off-the-end-of-string error in unit tests when decoding
- introduction points.
- - Fix uninitialized size field for memory area allocation: may improve
- memory performance during directory parsing.
- - Treat duplicate certificate fetches as failures, so that we do
- not try to re-fetch an expired certificate over and over and over.
- - Do not say we're fetching a certificate when we'll in fact skip it
- because of a pending download.
- Changes in version 0.2.1.6-alpha - 2008-09-30
- Tor 0.2.1.6-alpha further improves performance and robustness of
- hidden services, starts work on supporting per-country relay selection,
- and fixes a variety of smaller issues.
- o Major features:
- - Implement proposal 121: make it possible to build hidden services
- that only certain clients are allowed to connect to. This is
- enforced at several points, so that unauthorized clients are unable
- to send INTRODUCE cells to the service, or even (depending on the
- type of authentication) to learn introduction points. This feature
- raises the bar for certain kinds of active attacks against hidden
- services. Code by Karsten Loesing.
- - Relays now store and serve v2 hidden service descriptors by default,
- i.e., the new default value for HidServDirectoryV2 is 1. This is
- the last step in proposal 114, which aims to make hidden service
- lookups more reliable.
- - Start work to allow node restrictions to include country codes. The
- syntax to exclude nodes in a country with country code XX is
- "ExcludeNodes {XX}". Patch from Robert Hogan. It still needs some
- refinement to decide what config options should take priority if
- you ask to both use a particular node and exclude it.
- - Allow ExitNodes list to include IP ranges and country codes, just
- like the Exclude*Nodes lists. Patch from Robert Hogan.
- o Major bugfixes:
- - Fix a bug when parsing ports in tor_addr_port_parse() that caused
- Tor to fail to start if you had it configured to use a bridge
- relay. Fixes bug 809. Bugfix on 0.2.1.5-alpha.
- - When extending a circuit to a hidden service directory to upload a
- rendezvous descriptor using a BEGIN_DIR cell, almost 1/6 of all
- requests failed, because the router descriptor had not been
- downloaded yet. In these cases, we now wait until the router
- descriptor is downloaded, and then retry. Likewise, clients
- now skip over a hidden service directory if they don't yet have
- its router descriptor, rather than futilely requesting it and
- putting mysterious complaints in the logs. Fixes bug 767. Bugfix
- on 0.2.0.10-alpha.
- - When fetching v0 and v2 rendezvous service descriptors in parallel,
- we were failing the whole hidden service request when the v0
- descriptor fetch fails, even if the v2 fetch is still pending and
- might succeed. Similarly, if the last v2 fetch fails, we were
- failing the whole hidden service request even if a v0 fetch is
- still pending. Fixes bug 814. Bugfix on 0.2.0.10-alpha.
- - DNS replies need to have names matching their requests, but
- these names should be in the questions section, not necessarily
- in the answers section. Fixes bug 823. Bugfix on 0.2.1.5-alpha.
- o Minor features:
- - Update to the "September 1 2008" ip-to-country file.
- - Allow ports 465 and 587 in the default exit policy again. We had
- rejected them in 0.1.0.15, because back in 2005 they were commonly
- misconfigured and ended up as spam targets. We hear they are better
- locked down these days.
- - Use a lockfile to make sure that two Tor processes are not
- simultaneously running with the same datadir.
- - Serve the latest v3 networkstatus consensus via the control
- port. Use "getinfo dir/status-vote/current/consensus" to fetch it.
- - Better logging about stability/reliability calculations on directory
- servers.
- - Drop the requirement to have an open dir port for storing and
- serving v2 hidden service descriptors.
- - Directory authorities now serve a /tor/dbg-stability.txt URL to
- help debug WFU and MTBF calculations.
- - Implement most of Proposal 152: allow specialized servers to permit
- single-hop circuits, and clients to use those servers to build
- single-hop circuits when using a specialized controller. Patch
- from Josh Albrecht. Resolves feature request 768.
- - Add a -p option to tor-resolve for specifying the SOCKS port: some
- people find host:port too confusing.
- - Make TrackHostExit mappings expire a while after their last use, not
- after their creation. Patch from Robert Hogan.
- - Provide circuit purposes along with circuit events to the controller.
- o Minor bugfixes:
- - Fix compile on OpenBSD 4.4-current. Bugfix on 0.2.1.5-alpha.
- Reported by Tas.
- - Fixed some memory leaks -- some quite frequent, some almost
- impossible to trigger -- based on results from Coverity.
- - When testing for libevent functions, set the LDFLAGS variable
- correctly. Found by Riastradh.
- - Fix an assertion bug in parsing policy-related options; possible fix
- for bug 811.
- - Catch and report a few more bootstrapping failure cases when Tor
- fails to establish a TCP connection. Cleanup on 0.2.1.x.
- - Avoid a bug where the FastFirstHopPK 0 option would keep Tor from
- bootstrapping with tunneled directory connections. Bugfix on
- 0.1.2.5-alpha. Fixes bug 797. Found by Erwin Lam.
- - When asked to connect to A.B.exit:80, if we don't know the IP for A
- and we know that server B rejects most-but-not all connections to
- port 80, we would previously reject the connection. Now, we assume
- the user knows what they were asking for. Fixes bug 752. Bugfix
- on 0.0.9rc5. Diagnosed by BarkerJr.
- - If we are not using BEGIN_DIR cells, don't attempt to contact hidden
- service directories if they have no advertised dir port. Bugfix
- on 0.2.0.10-alpha.
- - If we overrun our per-second write limits a little, count this as
- having used up our write allocation for the second, and choke
- outgoing directory writes. Previously, we had only counted this when
- we had met our limits precisely. Fixes bug 824. Patch by rovv.
- Bugfix on 0.2.0.x (??).
- - Avoid a "0 divided by 0" calculation when calculating router uptime
- at directory authorities. Bugfix on 0.2.0.8-alpha.
- - Make DNS resolved controller events into "CLOSED", not
- "FAILED". Bugfix on 0.1.2.5-alpha. Fix by Robert Hogan. Resolves
- bug 807.
- - Fix a bug where an unreachable relay would establish enough
- reachability testing circuits to do a bandwidth test -- if
- we already have a connection to the middle hop of the testing
- circuit, then it could establish the last hop by using the existing
- connection. Bugfix on 0.1.2.2-alpha, exposed when we made testing
- circuits no longer use entry guards in 0.2.1.3-alpha.
- - If we have correct permissions on $datadir, we complain to stdout
- and fail to start. But dangerous permissions on
- $datadir/cached-status/ would cause us to open a log and complain
- there. Now complain to stdout and fail to start in both cases. Fixes
- bug 820, reported by seeess.
- - Remove the old v2 directory authority 'lefkada' from the default
- list. It has been gone for many months.
- o Code simplifications and refactoring:
- - Revise the connection_new functions so that a more typesafe variant
- exists. This will work better with Coverity, and let us find any
- actual mistakes we're making here.
- - Refactor unit testing logic so that dmalloc can be used sensibly
- with unit tests to check for memory leaks.
- - Move all hidden-service related fields from connection and circuit
- structure to substructures: this way they won't eat so much memory.
- Changes in version 0.2.0.31 - 2008-09-03
- Tor 0.2.0.31 addresses two potential anonymity issues, starts to fix
- a big bug we're seeing where in rare cases traffic from one Tor stream
- gets mixed into another stream, and fixes a variety of smaller issues.
- o Major bugfixes:
- - Make sure that two circuits can never exist on the same connection
- with the same circuit ID, even if one is marked for close. This
- is conceivably a bugfix for bug 779. Bugfix on 0.1.0.4-rc.
- - Relays now reject risky extend cells: if the extend cell includes
- a digest of all zeroes, or asks to extend back to the relay that
- sent the extend cell, tear down the circuit. Ideas suggested
- by rovv.
- - If not enough of our entry guards are available so we add a new
- one, we might use the new one even if it overlapped with the
- current circuit's exit relay (or its family). Anonymity bugfix
- pointed out by rovv.
- o Minor bugfixes:
- - Recover 3-7 bytes that were wasted per memory chunk. Fixes bug
- 794; bug spotted by rovv. Bugfix on 0.2.0.1-alpha.
- - Correctly detect the presence of the linux/netfilter_ipv4.h header
- when building against recent kernels. Bugfix on 0.1.2.1-alpha.
- - Pick size of default geoip filename string correctly on windows.
- Fixes bug 806. Bugfix on 0.2.0.30.
- - Make the autoconf script accept the obsolete --with-ssl-dir
- option as an alias for the actually-working --with-openssl-dir
- option. Fix the help documentation to recommend --with-openssl-dir.
- Based on a patch by "Dave". Bugfix on 0.2.0.1-alpha.
- - When using the TransPort option on OpenBSD, and using the User
- option to change UID and drop privileges, make sure to open
- /dev/pf before dropping privileges. Fixes bug 782. Patch from
- Christopher Davis. Bugfix on 0.1.2.1-alpha.
- - Try to attach connections immediately upon receiving a RENDEZVOUS2
- or RENDEZVOUS_ESTABLISHED cell. This can save a second or two
- on the client side when connecting to a hidden service. Bugfix
- on 0.0.6pre1. Found and fixed by Christian Wilms; resolves bug 743.
- - When closing an application-side connection because its circuit is
- getting torn down, generate the stream event correctly. Bugfix on
- 0.1.2.x. Anonymous patch.
- Changes in version 0.2.1.5-alpha - 2008-08-31
- Tor 0.2.1.5-alpha moves us closer to handling IPv6 destinations, puts
- in a lot of the infrastructure for adding authorization to hidden
- services, lays the groundwork for having clients read their load
- balancing information out of the networkstatus consensus rather than
- the individual router descriptors, addresses two potential anonymity
- issues, and fixes a variety of smaller issues.
- o Major features:
- - Convert many internal address representations to optionally hold
- IPv6 addresses.
- - Generate and accept IPv6 addresses in many protocol elements.
- - Make resolver code handle nameservers located at ipv6 addresses.
- - Begin implementation of proposal 121 ("Client authorization for
- hidden services"): configure hidden services with client
- authorization, publish descriptors for them, and configure
- authorization data for hidden services at clients. The next
- step is to actually access hidden services that perform client
- authorization.
- - More progress toward proposal 141: Network status consensus
- documents and votes now contain bandwidth information for each
- router and a summary of that router's exit policy. Eventually this
- will be used by clients so that they do not have to download every
- known descriptor before building circuits.
- o Major bugfixes (on 0.2.0.x and before):
- - When sending CREATED cells back for a given circuit, use a 64-bit
- connection ID to find the right connection, rather than an addr:port
- combination. Now that we can have multiple OR connections between
- the same ORs, it is no longer possible to use addr:port to uniquely
- identify a connection.
- - Relays now reject risky extend cells: if the extend cell includes
- a digest of all zeroes, or asks to extend back to the relay that
- sent the extend cell, tear down the circuit. Ideas suggested
- by rovv.
- - If not enough of our entry guards are available so we add a new
- one, we might use the new one even if it overlapped with the
- current circuit's exit relay (or its family). Anonymity bugfix
- pointed out by rovv.
- o Minor bugfixes:
- - Recover 3-7 bytes that were wasted per memory chunk. Fixes bug
- 794; bug spotted by rovv. Bugfix on 0.2.0.1-alpha.
- - When using the TransPort option on OpenBSD, and using the User
- option to change UID and drop privileges, make sure to open /dev/pf
- before dropping privileges. Fixes bug 782. Patch from Christopher
- Davis. Bugfix on 0.1.2.1-alpha.
- - Correctly detect the presence of the linux/netfilter_ipv4.h header
- when building against recent kernels. Bugfix on 0.1.2.1-alpha.
- - Add a missing safe_str() call for a debug log message.
- - Use 64 bits instead of 32 bits for connection identifiers used with
- the controller protocol, to greatly reduce risk of identifier reuse.
- - Make the autoconf script accept the obsolete --with-ssl-dir
- option as an alias for the actually-working --with-openssl-dir
- option. Fix the help documentation to recommend --with-openssl-dir.
- Based on a patch by "Dave". Bugfix on 0.2.0.1-alpha.
- o Minor features:
- - Rate-limit too-many-sockets messages: when they happen, they happen
- a lot. Resolves bug 748.
- - Resist DNS poisoning a little better by making sure that names in
- answer sections match.
- - Print the SOCKS5 error message string as well as the error code
- when a tor-resolve request fails. Patch from Jacob.
- Changes in version 0.2.1.4-alpha - 2008-08-04
- Tor 0.2.1.4-alpha fixes a pair of crash bugs in 0.2.1.3-alpha.
- o Major bugfixes:
- - The address part of exit policies was not correctly written
- to router descriptors. This generated router descriptors that failed
- their self-checks. Noticed by phobos, fixed by Karsten. Bugfix
- on 0.2.1.3-alpha.
- - Tor triggered a false assert when extending a circuit to a relay
- but we already have a connection open to that relay. Noticed by
- phobos, fixed by Karsten. Bugfix on 0.2.1.3-alpha.
- o Minor bugfixes:
- - Fix a hidden service logging bug: in some edge cases, the router
- descriptor of a previously picked introduction point becomes
- obsolete and we need to give up on it rather than continually
- complaining that it has become obsolete. Observed by xiando. Bugfix
- on 0.2.1.3-alpha.
- o Removed features:
- - Take out the TestVia config option, since it was a workaround for
- a bug that was fixed in Tor 0.1.1.21.
- Changes in version 0.2.1.3-alpha - 2008-08-03
- Tor 0.2.1.3-alpha implements most of the pieces to prevent
- infinite-length circuit attacks (see proposal 110); fixes a bug that
- might cause exit relays to corrupt streams they send back; allows
- address patterns (e.g. 255.128.0.0/16) to appear in ExcludeNodes and
- ExcludeExitNodes config options; and fixes a big pile of bugs.
- o Bootstrapping bugfixes (on 0.2.1.x-alpha):
- - Send a bootstrap problem "warn" event on the first problem if the
- reason is NO_ROUTE (that is, our network is down).
- o Major features:
- - Implement most of proposal 110: The first K cells to be sent
- along a circuit are marked as special "early" cells; only K "early"
- cells will be allowed. Once this code is universal, we can block
- certain kinds of DOS attack by requiring that EXTEND commands must
- be sent using an "early" cell.
- o Major bugfixes:
- - Try to attach connections immediately upon receiving a RENDEZVOUS2
- or RENDEZVOUS_ESTABLISHED cell. This can save a second or two
- on the client side when connecting to a hidden service. Bugfix
- on 0.0.6pre1. Found and fixed by Christian Wilms; resolves bug 743.
- - Ensure that two circuits can never exist on the same connection
- with the same circuit ID, even if one is marked for close. This
- is conceivably a bugfix for bug 779; fixes a bug on 0.1.0.4-rc.
- o Minor features:
- - When relays do their initial bandwidth measurement, don't limit
- to just our entry guards for the test circuits. Otherwise we tend
- to have multiple test circuits going through a single entry guard,
- which makes our bandwidth test less accurate. Fixes part of bug 654;
- patch contributed by Josh Albrecht.
- - Add an ExcludeExitNodes option so users can list a set of nodes
- that should be be excluded from the exit node position, but
- allowed elsewhere. Implements proposal 151.
- - Allow address patterns (e.g., 255.128.0.0/16) to appear in
- ExcludeNodes and ExcludeExitNodes lists.
- - Change the implementation of ExcludeNodes and ExcludeExitNodes to
- be more efficient. Formerly it was quadratic in the number of
- servers; now it should be linear. Fixes bug 509.
- - Save 16-22 bytes per open circuit by moving the n_addr, n_port,
- and n_conn_id_digest fields into a separate structure that's
- only needed when the circuit has not yet attached to an n_conn.
- o Minor bugfixes:
- - Change the contrib/tor.logrotate script so it makes the new
- logs as "_tor:_tor" rather than the default, which is generally
- "root:wheel". Fixes bug 676, reported by Serge Koksharov.
- - Stop using __attribute__((nonnull)) with GCC: it can give us useful
- warnings (occasionally), but it can also cause the compiler to
- eliminate error-checking code. Suggested by Peter Gutmann.
- - When a hidden service is giving up on an introduction point candidate
- that was not included in the last published rendezvous descriptor,
- don't reschedule publication of the next descriptor. Fixes bug 763.
- Bugfix on 0.0.9.3.
- - Mark RendNodes, RendExcludeNodes, HiddenServiceNodes, and
- HiddenServiceExcludeNodes as obsolete: they never worked properly,
- and nobody claims to be using them. Fixes bug 754. Bugfix on
- 0.1.0.1-rc. Patch from Christian Wilms.
- - Fix a small alignment and memory-wasting bug on buffer chunks.
- Spotted by rovv.
- o Minor bugfixes (controller):
- - When closing an application-side connection because its circuit
- is getting torn down, generate the stream event correctly.
- Bugfix on 0.1.2.x. Anonymous patch.
- o Removed features:
- - Remove all backward-compatibility code to support relays running
- versions of Tor so old that they no longer work at all on the
- Tor network.
- Changes in version 0.2.0.30 - 2008-07-15
- o Minor bugfixes:
- - Stop using __attribute__((nonnull)) with GCC: it can give us useful
- warnings (occasionally), but it can also cause the compiler to
- eliminate error-checking code. Suggested by Peter Gutmann.
- Changes in version 0.2.0.29-rc - 2008-07-08
- Tor 0.2.0.29-rc fixes two big bugs with using bridges, fixes more
- hidden-service performance bugs, and fixes a bunch of smaller bugs.
- o Major bugfixes:
- - If you have more than one bridge but don't know their keys,
- you would only launch a request for the descriptor of the first one
- on your list. (Tor considered launching requests for the others, but
- found that it already had a connection on the way for $0000...0000
- so it didn't open another.) Bugfix on 0.2.0.x.
- - If you have more than one bridge but don't know their keys, and the
- connection to one of the bridges failed, you would cancel all
- pending bridge connections. (After all, they all have the same
- digest.) Bugfix on 0.2.0.x.
- - When a hidden service was trying to establish an introduction point,
- and Tor had built circuits preemptively for such purposes, we
- were ignoring all the preemptive circuits and launching a new one
- instead. Bugfix on 0.2.0.14-alpha.
- - When a hidden service was trying to establish an introduction point,
- and Tor *did* manage to reuse one of the preemptively built
- circuits, it didn't correctly remember which one it used,
- so it asked for another one soon after, until there were no
- more preemptive circuits, at which point it launched one from
- scratch. Bugfix on 0.0.9.x.
- - Make directory servers include the X-Your-Address-Is: http header in
- their responses even for begin_dir conns. Now clients who only
- ever use begin_dir connections still have a way to learn their IP
- address. Fixes bug 737; bugfix on 0.2.0.22-rc. Reported by goldy.
- o Minor bugfixes:
- - Fix a macro/CPP interaction that was confusing some compilers:
- some GCCs don't like #if/#endif pairs inside macro arguments.
- Fixes bug 707.
- - Fix macro collision between OpenSSL 0.9.8h and Windows headers.
- Fixes bug 704; fix from Steven Murdoch.
- - When opening /dev/null in finish_daemonize(), do not pass the
- O_CREAT flag. Fortify was complaining, and correctly so. Fixes
- bug 742; fix from Michael Scherer. Bugfix on 0.0.2pre19.
- - Correctly detect transparent proxy support on Linux hosts that
- require in.h to be included before netfilter_ipv4.h. Patch
- from coderman.
- - Disallow session resumption attempts during the renegotiation
- stage of the v2 handshake protocol. Clients should never be trying
- session resumption at this point, but apparently some did, in
- ways that caused the handshake to fail. Bugfix on 0.2.0.20-rc. Bug
- found by Geoff Goodell.
- Changes in version 0.2.1.2-alpha - 2008-06-20
- Tor 0.2.1.2-alpha includes a new "TestingTorNetwork" config option to
- make it easier to set up your own private Tor network; fixes several
- big bugs with using more than one bridge relay; fixes a big bug with
- offering hidden services quickly after Tor starts; and uses a better
- API for reporting potential bootstrapping problems to the controller.
- o Major features:
- - New TestingTorNetwork config option to allow adjustment of
- previously constant values that, while reasonable, could slow
- bootstrapping. Implements proposal 135. Patch from Karsten.
- o Major bugfixes:
- - If you have more than one bridge but don't know their digests,
- you would only learn a request for the descriptor of the first one
- on your list. (Tor considered launching requests for the others, but
- found that it already had a connection on the way for $0000...0000
- so it didn't open another.) Bugfix on 0.2.0.x.
- - If you have more than one bridge but don't know their digests,
- and the connection to one of the bridges failed, you would cancel
- all pending bridge connections. (After all, they all have the
- same digest.) Bugfix on 0.2.0.x.
- - When establishing a hidden service, introduction points that
- originate from cannibalized circuits are completely ignored and not
- included in rendezvous service descriptors. This might be another
- reason for delay in making a hidden service available. Bugfix
- from long ago (0.0.9.x?)
- o Minor features:
- - Allow OpenSSL to use dynamic locks if it wants.
- - When building a consensus, do not include routers that are down.
- This will cut down 30% to 40% on consensus size. Implements
- proposal 138.
- - In directory authorities' approved-routers files, allow
- fingerprints with or without space.
- - Add a "GETINFO /status/bootstrap-phase" controller option, so the
- controller can query our current bootstrap state in case it attaches
- partway through and wants to catch up.
- - Send an initial "Starting" bootstrap status event, so we have a
- state to start out in.
- o Minor bugfixes:
- - Asking for a conditional consensus at .../consensus/<fingerprints>
- would crash a dirserver if it did not already have a
- consensus. Bugfix on 0.2.1.1-alpha.
- - Clean up some macro/CPP interactions: some GCC versions don't like
- #if/#endif pairs inside macro arguments. Fixes bug 707. Bugfix on
- 0.2.0.x.
- o Bootstrapping bugfixes (on 0.2.1.1-alpha):
- - Directory authorities shouldn't complain about bootstrapping
- problems just because they do a lot of reachability testing and
- some of the connection attempts fail.
- - Start sending "count" and "recommendation" key/value pairs in
- bootstrap problem status events, so the controller can hear about
- problems even before Tor decides they're worth reporting for sure.
- - If you're using bridges, generate "bootstrap problem" warnings
- as soon as you run out of working bridges, rather than waiting
- for ten failures -- which will never happen if you have less than
- ten bridges.
- - If we close our OR connection because there's been a circuit
- pending on it for too long, we were telling our bootstrap status
- events "REASON=NONE". Now tell them "REASON=TIMEOUT".
- Changes in version 0.2.1.1-alpha - 2008-06-13
- Tor 0.2.1.1-alpha fixes a lot of memory fragmentation problems that
- were making the Tor process bloat especially on Linux; makes our TLS
- handshake blend in better; sends "bootstrap phase" status events to
- the controller, so it can keep the user informed of progress (and
- problems) fetching directory information and establishing circuits;
- and adds a variety of smaller features.
- o Major features:
- - More work on making our TLS handshake blend in: modify the list
- of ciphers advertised by OpenSSL in client mode to even more
- closely resemble a common web browser. We cheat a little so that
- we can advertise ciphers that the locally installed OpenSSL doesn't
- know about.
- - Start sending "bootstrap phase" status events to the controller,
- so it can keep the user informed of progress fetching directory
- information and establishing circuits. Also inform the controller
- if we think we're stuck at a particular bootstrap phase. Implements
- proposal 137.
- - Resume using OpenSSL's RAND_poll() for better (and more portable)
- cross-platform entropy collection again. We used to use it, then
- stopped using it because of a bug that could crash systems that
- called RAND_poll when they had a lot of fds open. It looks like the
- bug got fixed in late 2006. Our new behavior is to call RAND_poll()
- at startup, and to call RAND_poll() when we reseed later only if
- we have a non-buggy OpenSSL version.
- o Major bugfixes:
- - When we choose to abandon a new entry guard because we think our
- older ones might be better, close any circuits pending on that
- new entry guard connection. This fix should make us recover much
- faster when our network is down and then comes back. Bugfix on
- 0.1.2.8-beta; found by lodger.
- o Memory fixes and improvements:
- - Add a malloc_good_size implementation to OpenBSD_malloc_linux.c,
- to avoid unused RAM in buffer chunks and memory pools.
- - Speed up parsing and cut down on memory fragmentation by using
- stack-style allocations for parsing directory objects. Previously,
- this accounted for over 40% of allocations from within Tor's code
- on a typical directory cache.
- - Use a Bloom filter rather than a digest-based set to track which
- descriptors we need to keep around when we're cleaning out old
- router descriptors. This speeds up the computation significantly,
- and may reduce fragmentation.
- - Reduce the default smartlist size from 32 to 16; it turns out that
- most smartlists hold around 8-12 elements tops.
- - Make dumpstats() log the fullness and size of openssl-internal
- buffers.
- - If the user has applied the experimental SSL_MODE_RELEASE_BUFFERS
- patch to their OpenSSL, turn it on to save memory on servers. This
- patch will (with any luck) get included in a mainline distribution
- before too long.
- - Never use OpenSSL compression: it wastes RAM and CPU trying to
- compress cells, which are basically all encrypted, compressed,
- or both.
- o Minor bugfixes:
- - Stop reloading the router list from disk for no reason when we
- run out of reachable directory mirrors. Once upon a time reloading
- it would set the 'is_running' flag back to 1 for them. It hasn't
- done that for a long time.
- - In very rare situations new hidden service descriptors were
- published earlier than 30 seconds after the last change to the
- service. (We currently think that a hidden service descriptor
- that's been stable for 30 seconds is worth publishing.)
- o Minor features:
- - Allow separate log levels to be configured for different logging
- domains. For example, this allows one to log all notices, warnings,
- or errors, plus all memory management messages of level debug or
- higher, with: Log [MM] debug-err [*] notice-err file /var/log/tor.
- - Add a couple of extra warnings to --enable-gcc-warnings for GCC 4.3,
- and stop using a warning that had become unfixably verbose under
- GCC 4.3.
- - New --hush command-line option similar to --quiet. While --quiet
- disables all logging to the console on startup, --hush limits the
- output to messages of warning and error severity.
- - Servers support a new URL scheme for consensus downloads that
- allows the client to specify which authorities are trusted.
- The server then only sends the consensus if the client will trust
- it. Otherwise a 404 error is sent back. Clients use this
- new scheme when the server supports it (meaning it's running
- 0.2.1.1-alpha or later). Implements proposal 134.
- - New configure/torrc options (--enable-geoip-stats,
- DirRecordUsageByCountry) to record how many IPs we've served
- directory info to in each country code, how many status documents
- total we've sent to each country code, and what share of the total
- directory requests we should expect to see.
- - Use the TLS1 hostname extension to more closely resemble browser
- behavior.
- - Lots of new unit tests.
- - Add a macro to implement the common pattern of iterating through
- two parallel lists in lockstep.
- Changes in version 0.2.0.28-rc - 2008-06-13
- Tor 0.2.0.28-rc fixes an anonymity-related bug, fixes a hidden-service
- performance bug, and fixes a bunch of smaller bugs.
- o Anonymity fixes:
- - Fix a bug where, when we were choosing the 'end stream reason' to
- put in our relay end cell that we send to the exit relay, Tor
- clients on Windows were sometimes sending the wrong 'reason'. The
- anonymity problem is that exit relays may be able to guess whether
- the client is running Windows, thus helping partition the anonymity
- set. Down the road we should stop sending reasons to exit relays,
- or otherwise prevent future versions of this bug.
- o Major bugfixes:
- - While setting up a hidden service, some valid introduction circuits
- were overlooked and abandoned. This might be the reason for
- the long delay in making a hidden service available. Bugfix on
- 0.2.0.14-alpha.
- o Minor features:
- - Update to the "June 9 2008" ip-to-country file.
- - Run 'make test' as part of 'make dist', so we stop releasing so
- many development snapshots that fail their unit tests.
- o Minor bugfixes:
- - When we're checking if we have enough dir info for each relay
- to begin establishing circuits, make sure that we actually have
- the descriptor listed in the consensus, not just any descriptor.
- Bugfix on 0.1.2.x.
- - Bridge relays no longer print "xx=0" in their extrainfo document
- for every single country code in the geoip db. Bugfix on
- 0.2.0.27-rc.
- - Only warn when we fail to load the geoip file if we were planning to
- include geoip stats in our extrainfo document. Bugfix on 0.2.0.27-rc.
- - If we change our MaxAdvertisedBandwidth and then reload torrc,
- Tor won't realize it should publish a new relay descriptor. Fixes
- bug 688, reported by mfr. Bugfix on 0.1.2.x.
- - When we haven't had any application requests lately, don't bother
- logging that we have expired a bunch of descriptors. Bugfix
- on 0.1.2.x.
- - Make relay cells written on a connection count as non-padding when
- tracking how long a connection has been in use. Bugfix on
- 0.2.0.1-alpha. Spotted by lodger.
- - Fix unit tests in 0.2.0.27-rc.
- - Fix compile on Windows.
- Changes in version 0.2.0.27-rc - 2008-06-03
- Tor 0.2.0.27-rc adds a few features we left out of the earlier
- release candidates. In particular, we now include an IP-to-country
- GeoIP database, so controllers can easily look up what country a
- given relay is in, and so bridge relays can give us some sanitized
- summaries about which countries are making use of bridges. (See proposal
- 126-geoip-fetching.txt for details.)
- o Major features:
- - Include an IP-to-country GeoIP file in the tarball, so bridge
- relays can report sanitized summaries of the usage they're seeing.
- o Minor features:
- - Add a "PURPOSE=" argument to "STREAM NEW" events, as suggested by
- Robert Hogan. Fixes the first part of bug 681.
- - Make bridge authorities never serve extrainfo docs.
- - Add support to detect Libevent versions in the 1.4.x series
- on mingw.
- - Fix build on gcc 4.3 with --enable-gcc-warnings set.
- - Include a new contrib/tor-exit-notice.html file that exit relay
- operators can put on their website to help reduce abuse queries.
- o Minor bugfixes:
- - When tunneling an encrypted directory connection, and its first
- circuit fails, do not leave it unattached and ask the controller
- to deal. Fixes the second part of bug 681.
- - Make bridge authorities correctly expire old extrainfo documents
- from time to time.
- Changes in version 0.2.0.26-rc - 2008-05-13
- Tor 0.2.0.26-rc fixes a major security vulnerability caused by a bug
- in Debian's OpenSSL packages. All users running any 0.2.0.x version
- should upgrade, whether they're running Debian or not.
- o Major security fixes:
- - Use new V3 directory authority keys on the tor26, gabelmoo, and
- moria1 V3 directory authorities. The old keys were generated with
- a vulnerable version of Debian's OpenSSL package, and must be
- considered compromised. Other authorities' keys were not generated
- with an affected version of OpenSSL.
- o Major bugfixes:
- - List authority signatures as "unrecognized" based on DirServer
- lines, not on cert cache. Bugfix on 0.2.0.x.
- o Minor features:
- - Add a new V3AuthUseLegacyKey option to make it easier for
- authorities to change their identity keys if they have to.
- Changes in version 0.2.0.25-rc - 2008-04-23
- Tor 0.2.0.25-rc makes Tor work again on OS X and certain BSDs.
- o Major bugfixes:
- - Remember to initialize threading before initializing logging.
- Otherwise, many BSD-family implementations will crash hard on
- startup. Fixes bug 671. Bugfix on 0.2.0.24-rc.
- o Minor bugfixes:
- - Authorities correctly free policies on bad servers on
- exit. Fixes bug 672. Bugfix on 0.2.0.x.
- Changes in version 0.2.0.24-rc - 2008-04-22
- Tor 0.2.0.24-rc adds dizum (run by Alex de Joode) as the new sixth
- v3 directory authority, makes relays with dynamic IP addresses and no
- DirPort notice more quickly when their IP address changes, fixes a few
- rare crashes and memory leaks, and fixes a few other miscellaneous bugs.
- o New directory authorities:
- - Take lefkada out of the list of v3 directory authorities, since
- it has been down for months.
- - Set up dizum (run by Alex de Joode) as the new sixth v3 directory
- authority.
- o Major bugfixes:
- - Detect address changes more quickly on non-directory mirror
- relays. Bugfix on 0.2.0.18-alpha; fixes bug 652.
- o Minor features (security):
- - Reject requests for reverse-dns lookup of names that are in
- a private address space. Patch from lodger.
- - Non-exit relays no longer allow DNS requests. Fixes bug 619. Patch
- from lodger.
- o Minor bugfixes (crashes):
- - Avoid a rare assert that can trigger when Tor doesn't have much
- directory information yet and it tries to fetch a v2 hidden
- service descriptor. Fixes bug 651, reported by nwf.
- - Initialize log mutex before initializing dmalloc. Otherwise,
- running with dmalloc would crash. Bugfix on 0.2.0.x-alpha.
- - Use recursive pthread mutexes in order to avoid deadlock when
- logging debug-level messages to a controller. Bug spotted by nwf,
- bugfix on 0.2.0.16-alpha.
- o Minor bugfixes (resource management):
- - Keep address policies from leaking memory: start their refcount
- at 1, not 2. Bugfix on 0.2.0.16-alpha.
- - Free authority certificates on exit, so they don't look like memory
- leaks. Bugfix on 0.2.0.19-alpha.
- - Free static hashtables for policy maps and for TLS connections on
- shutdown, so they don't look like memory leaks. Bugfix on 0.2.0.x.
- - Avoid allocating extra space when computing consensuses on 64-bit
- platforms. Bug spotted by aakova.
- o Minor bugfixes (misc):
- - Do not read the configuration file when we've only been told to
- generate a password hash. Fixes bug 643. Bugfix on 0.0.9pre5. Fix
- based on patch from Sebastian Hahn.
- - Exit relays that are used as a client can now reach themselves
- using the .exit notation, rather than just launching an infinite
- pile of circuits. Fixes bug 641. Reported by Sebastian Hahn.
- - When attempting to open a logfile fails, tell us why.
- - Fix a dumb bug that was preventing us from knowing that we should
- preemptively build circuits to handle expected directory requests.
- Fixes bug 660. Bugfix on 0.1.2.x.
- - Warn less verbosely about clock skew from netinfo cells from
- untrusted sources. Fixes bug 663.
- - Make controller stream events for DNS requests more consistent,
- by adding "new stream" events for DNS requests, and removing
- spurious "stream closed" events" for cached reverse resolves.
- Patch from mwenge. Fixes bug 646.
- - Correctly notify one-hop connections when a circuit build has
- failed. Possible fix for bug 669. Found by lodger.
- Changes in version 0.2.0.23-rc - 2008-03-24
- Tor 0.2.0.23-rc is the fourth release candidate for the 0.2.0 series. It
- makes bootstrapping faster if the first directory mirror you contact
- is down. The bundles also include the new Vidalia 0.1.2 release.
- o Major bugfixes:
- - When a tunneled directory request is made to a directory server
- that's down, notice after 30 seconds rather than 120 seconds. Also,
- fail any begindir streams that are pending on it, so they can
- retry elsewhere. This was causing multi-minute delays on bootstrap.
- Changes in version 0.2.0.22-rc - 2008-03-18
- Tor 0.2.0.22-rc is the third release candidate for the 0.2.0 series. It
- enables encrypted directory connections by default for non-relays, fixes
- some broken TLS behavior we added in 0.2.0.20-rc, and resolves many
- other bugs. The bundles also include Vidalia 0.1.1 and Torbutton 1.1.17.
- o Major features:
- - Enable encrypted directory connections by default for non-relays,
- so censor tools that block Tor directory connections based on their
- plaintext patterns will no longer work. This means Tor works in
- certain censored countries by default again.
- o Major bugfixes:
- - Make sure servers always request certificates from clients during
- TLS renegotiation. Reported by lodger; bugfix on 0.2.0.20-rc.
- - Do not enter a CPU-eating loop when a connection is closed in
- the middle of client-side TLS renegotiation. Fixes bug 622. Bug
- diagnosed by lodger; bugfix on 0.2.0.20-rc.
- - Fix assertion failure that could occur when a blocked circuit
- became unblocked, and it had pending client DNS requests. Bugfix
- on 0.2.0.1-alpha. Fixes bug 632.
- o Minor bugfixes (on 0.1.2.x):
- - Generate "STATUS_SERVER" events rather than misspelled
- "STATUS_SEVER" events. Caught by mwenge.
- - When counting the number of bytes written on a TLS connection,
- look at the BIO actually used for writing to the network, not
- at the BIO used (sometimes) to buffer data for the network.
- Looking at different BIOs could result in write counts on the
- order of ULONG_MAX. Fixes bug 614.
- - On Windows, correctly detect errors when listing the contents of
- a directory. Fix from lodger.
- o Minor bugfixes (on 0.2.0.x):
- - Downgrade "sslv3 alert handshake failure" message to INFO.
- - If we set RelayBandwidthRate and RelayBandwidthBurst very high but
- left BandwidthRate and BandwidthBurst at the default, we would be
- silently limited by those defaults. Now raise them to match the
- RelayBandwidth* values.
- - Fix the SVK version detection logic to work correctly on a branch.
- - Make --enable-openbsd-malloc work correctly on Linux with alpha
- CPUs. Fixes bug 625.
- - Logging functions now check that the passed severity is sane.
- - Use proper log levels in the testsuite call of
- get_interface_address6().
- - When using a nonstandard malloc, do not use the platform values for
- HAVE_MALLOC_GOOD_SIZE or HAVE_MALLOC_USABLE_SIZE.
- - Make the openbsd malloc code use 8k pages on alpha CPUs and
- 16k pages on ia64.
- - Detect mismatched page sizes when using --enable-openbsd-malloc.
- - Avoid double-marked-for-close warning when certain kinds of invalid
- .in-addr.arpa addresses are passed to the DNSPort. Part of a fix
- for bug 617. Bugfix on 0.2.0.1-alpha.
- - Make sure that the "NULL-means-reject *:*" convention is followed by
- all the policy manipulation functions, avoiding some possible crash
- bugs. Bug found by lodger. Bugfix on 0.2.0.16-alpha.
- - Fix the implementation of ClientDNSRejectInternalAddresses so that it
- actually works, and doesn't warn about every single reverse lookup.
- Fixes the other part of bug 617. Bugfix on 0.2.0.1-alpha.
- o Minor features:
- - Only log guard node status when guard node status has changed.
- - Downgrade the 3 most common "INFO" messages to "DEBUG". This will
- make "INFO" 75% less verbose.
- Changes in version 0.2.0.21-rc - 2008-03-02
- Tor 0.2.0.21-rc is the second release candidate for the 0.2.0 series. It
- makes Tor work well with Vidalia again, fixes a rare assert bug,
- and fixes a pair of more minor bugs. The bundles also include Vidalia
- 0.1.0 and Torbutton 1.1.16.
- o Major bugfixes:
- - The control port should declare that it requires password auth
- when HashedControlSessionPassword is set too. Patch from Matt Edman;
- bugfix on 0.2.0.20-rc. Fixes bug 615.
- - Downgrade assert in connection_buckets_decrement() to a log message.
- This may help us solve bug 614, and in any case will make its
- symptoms less severe. Bugfix on 0.2.0.20-rc. Reported by fredzupy.
- - We were sometimes miscounting the number of bytes read from the
- network, causing our rate limiting to not be followed exactly.
- Bugfix on 0.2.0.16-alpha. Reported by lodger.
- o Minor bugfixes:
- - Fix compilation with OpenSSL 0.9.8 and 0.9.8a. All other supported
- OpenSSL versions should have been working fine. Diagnosis and patch
- from lodger, Karsten Loesing, and Sebastian Hahn. Fixes bug 616.
- Bugfix on 0.2.0.20-rc.
- Changes in version 0.2.0.20-rc - 2008-02-24
- Tor 0.2.0.20-rc is the first release candidate for the 0.2.0 series. It
- makes more progress towards normalizing Tor's TLS handshake, makes
- hidden services work better again, helps relays bootstrap if they don't
- know their IP address, adds optional support for linking in openbsd's
- allocator or tcmalloc, allows really fast relays to scale past 15000
- sockets, and fixes a bunch of minor bugs reported by Veracode.
- o Major features:
- - Enable the revised TLS handshake based on the one designed by
- Steven Murdoch in proposal 124, as revised in proposal 130. It
- includes version negotiation for OR connections as described in
- proposal 105. The new handshake is meant to be harder for censors
- to fingerprint, and it adds the ability to detect certain kinds of
- man-in-the-middle traffic analysis attacks. The version negotiation
- feature will allow us to improve Tor's link protocol more safely
- in the future.
- - Choose which bridge to use proportional to its advertised bandwidth,
- rather than uniformly at random. This should speed up Tor for
- bridge users. Also do this for people who set StrictEntryNodes.
- - When a TrackHostExits-chosen exit fails too many times in a row,
- stop using it. Bugfix on 0.1.2.x; fixes bug 437.
- o Major bugfixes:
- - Resolved problems with (re-)fetching hidden service descriptors.
- Patch from Karsten Loesing; fixes problems with 0.2.0.18-alpha
- and 0.2.0.19-alpha.
- - If we only ever used Tor for hidden service lookups or posts, we
- would stop building circuits and start refusing connections after
- 24 hours, since we falsely believed that Tor was dormant. Reported
- by nwf; bugfix on 0.1.2.x.
- - Servers that don't know their own IP address should go to the
- authorities for their first directory fetch, even if their DirPort
- is off or if they don't know they're reachable yet. This will help
- them bootstrap better. Bugfix on 0.2.0.18-alpha; fixes bug 609.
- - When counting the number of open sockets, count not only the number
- of sockets we have received from the socket() call, but also
- the number we've gotten from accept() and socketpair(). This bug
- made us fail to count all sockets that we were using for incoming
- connections. Bugfix on 0.2.0.x.
- - Fix code used to find strings within buffers, when those strings
- are not in the first chunk of the buffer. Bugfix on 0.2.0.x.
- - Fix potential segfault when parsing HTTP headers. Bugfix on 0.2.0.x.
- - Add a new __HashedControlSessionPassword option for controllers
- to use for one-off session password hashes that shouldn't get
- saved to disk by SAVECONF --- Vidalia users were accumulating a
- pile of HashedControlPassword lines in their torrc files, one for
- each time they had restarted Tor and then clicked Save. Make Tor
- automatically convert "HashedControlPassword" to this new option but
- only when it's given on the command line. Partial fix for bug 586.
- o Minor features (performance):
- - Tune parameters for cell pool allocation to minimize amount of
- RAM overhead used.
- - Add OpenBSD malloc code from phk as an optional malloc
- replacement on Linux: some glibc libraries do very poorly
- with Tor's memory allocation patterns. Pass
- --enable-openbsd-malloc to get the replacement malloc code.
- - Add a --with-tcmalloc option to the configure script to link
- against tcmalloc (if present). Does not yet search for
- non-system include paths.
- - Stop imposing an arbitrary maximum on the number of file descriptors
- used for busy servers. Bug reported by Olaf Selke; patch from
- Sebastian Hahn.
- o Minor features (other):
- - When SafeLogging is disabled, log addresses along with all TLS
- errors.
- - When building with --enable-gcc-warnings, check for whether Apple's
- warning "-Wshorten-64-to-32" is available.
- - Add a --passphrase-fd argument to the tor-gencert command for
- scriptability.
- o Minor bugfixes (memory leaks and code problems):
- - We were leaking a file descriptor if Tor started with a zero-length
- cached-descriptors file. Patch by freddy77; bugfix on 0.1.2.
- - Detect size overflow in zlib code. Reported by Justin Ferguson and
- Dan Kaminsky.
- - We were comparing the raw BridgePassword entry with a base64'ed
- version of it, when handling a "/tor/networkstatus-bridges"
- directory request. Now compare correctly. Noticed by Veracode.
- - Recover from bad tracked-since value in MTBF-history file.
- Should fix bug 537.
- - Alter the code that tries to recover from unhandled write
- errors, to not try to flush onto a socket that's given us
- unhandled errors. Bugfix on 0.1.2.x.
- - Make Unix controlsockets work correctly on OpenBSD. Patch from
- tup. Bugfix on 0.2.0.3-alpha.
- o Minor bugfixes (other):
- - If we have an extra-info document for our server, always make
- it available on the control port, even if we haven't gotten
- a copy of it from an authority yet. Patch from mwenge.
- - Log the correct memory chunk sizes for empty RAM chunks in mempool.c.
- - Directory mirrors no longer include a guess at the client's IP
- address if the connection appears to be coming from the same /24
- network; it was producing too many wrong guesses.
- - Make the new hidden service code respect the SafeLogging setting.
- Bugfix on 0.2.0.x. Patch from Karsten.
- - When starting as an authority, do not overwrite all certificates
- cached from other authorities. Bugfix on 0.2.0.x. Fixes bug 606.
- - If we're trying to flush the last bytes on a connection (for
- example, when answering a directory request), reset the
- time-to-give-up timeout every time we manage to write something
- on the socket. Bugfix on 0.1.2.x.
- - Change the behavior of "getinfo status/good-server-descriptor"
- so it doesn't return failure when any authority disappears.
- - Even though the man page said that "TrackHostExits ." should
- work, nobody had ever implemented it. Bugfix on 0.1.0.x.
- - Report TLS "zero return" case as a "clean close" and "IO error"
- as a "close". Stop calling closes "unexpected closes": existing
- Tors don't use SSL_close(), so having a connection close without
- the TLS shutdown handshake is hardly unexpected.
- - Send NAMESERVER_STATUS messages for a single failed nameserver
- correctly.
- o Code simplifications and refactoring:
- - Remove the tor_strpartition function: its logic was confused,
- and it was only used for one thing that could be implemented far
- more easily.
- Changes in version 0.2.0.19-alpha - 2008-02-09
- Tor 0.2.0.19-alpha makes more progress towards normalizing Tor's TLS
- handshake, makes path selection for relays more secure and IP address
- guessing more robust, and generally fixes a lot of bugs in preparation
- for calling the 0.2.0 branch stable.
- o Major features:
- - Do not include recognizeable strings in the commonname part of
- Tor's x509 certificates.
- o Major bugfixes:
- - If we're a relay, avoid picking ourselves as an introduction point,
- a rendezvous point, or as the final hop for internal circuits. Bug
- reported by taranis and lodger. Bugfix on 0.1.2.x.
- - Patch from "Andrew S. Lists" to catch when we contact a directory
- mirror at IP address X and he says we look like we're coming from
- IP address X. Bugfix on 0.1.2.x.
- o Minor features (security):
- - Be more paranoid about overwriting sensitive memory on free(),
- as a defensive programming tactic to ensure forward secrecy.
- o Minor features (directory authority):
- - Actually validate the options passed to AuthDirReject,
- AuthDirInvalid, AuthDirBadDir, and AuthDirBadExit.
- - Reject router descriptors with out-of-range bandwidthcapacity or
- bandwidthburst values.
- o Minor features (controller):
- - Reject controller commands over 1MB in length. This keeps rogue
- processes from running us out of memory.
- o Minor features (misc):
- - Give more descriptive well-formedness errors for out-of-range
- hidden service descriptor/protocol versions.
- - Make memory debugging information describe more about history
- of cell allocation, so we can help reduce our memory use.
- o Deprecated features (controller):
- - The status/version/num-versioning and status/version/num-concurring
- GETINFO options are no longer useful in the v3 directory protocol:
- treat them as deprecated, and warn when they're used.
- o Minor bugfixes:
- - When our consensus networkstatus has been expired for a while, stop
- being willing to build circuits using it. Fixes bug 401. Bugfix
- on 0.1.2.x.
- - Directory caches now fetch certificates from all authorities
- listed in a networkstatus consensus, even when they do not
- recognize them. Fixes bug 571. Bugfix on 0.2.0.x.
- - When connecting to a bridge without specifying its key, insert
- the connection into the identity-to-connection map as soon as
- a key is learned. Fixes bug 574. Bugfix on 0.2.0.x.
- - Detect versions of OS X where malloc_good_size() is present in the
- library but never actually declared. Resolves bug 587. Bugfix
- on 0.2.0.x.
- - Stop incorrectly truncating zlib responses to directory authority
- signature download requests. Fixes bug 593. Bugfix on 0.2.0.x.
- - Stop recommending that every server operator send mail to tor-ops.
- Resolves bug 597. Bugfix on 0.1.2.x.
- - Don't trigger an assert if we start a directory authority with a
- private IP address (like 127.0.0.1).
- - Avoid possible failures when generating a directory with routers
- with over-long versions strings, or too many flags set. Bugfix
- on 0.1.2.x.
- - If an attempt to launch a DNS resolve request over the control
- port fails because we have overrun the limit on the number of
- connections, tell the controller that the request has failed.
- - Avoid using too little bandwidth when our clock skips a few
- seconds. Bugfix on 0.1.2.x.
- - Fix shell error when warning about missing packages in configure
- script, on Fedora or Red Hat machines. Bugfix on 0.2.0.x.
- - Do not become confused when receiving a spurious VERSIONS-like
- cell from a confused v1 client. Bugfix on 0.2.0.x.
- - Re-fetch v2 (as well as v0) rendezvous descriptors when all
- introduction points for a hidden service have failed. Patch from
- Karsten Loesing. Bugfix on 0.2.0.x.
- o Code simplifications and refactoring:
- - Remove some needless generality from cpuworker code, for improved
- type-safety.
- - Stop overloading the circuit_t.onionskin field for both "onionskin
- from a CREATE cell that we are waiting for a cpuworker to be
- assigned" and "onionskin from an EXTEND cell that we are going to
- send to an OR as soon as we are connected". Might help with bug 600.
- - Add an in-place version of aes_crypt() so that we can avoid doing a
- needless memcpy() call on each cell payload.
- Changes in version 0.2.0.18-alpha - 2008-01-25
- Tor 0.2.0.18-alpha adds a sixth v3 directory authority run by CCC,
- fixes a big memory leak in 0.2.0.17-alpha, and adds new config options
- that can warn or reject connections to ports generally associated with
- vulnerable-plaintext protocols.
- o New directory authorities:
- - Set up dannenberg (run by CCC) as the sixth v3 directory
- authority.
- o Major bugfixes:
- - Fix a major memory leak when attempting to use the v2 TLS
- handshake code. Bugfix on 0.2.0.x; fixes bug 589.
- - We accidentally enabled the under-development v2 TLS handshake
- code, which was causing log entries like "TLS error while
- renegotiating handshake". Disable it again. Resolves bug 590.
- - We were computing the wrong Content-Length: header for directory
- responses that need to be compressed on the fly, causing clients
- asking for those items to always fail. Bugfix on 0.2.0.x; partially
- fixes bug 593.
- o Major features:
- - Avoid going directly to the directory authorities even if you're a
- relay, if you haven't found yourself reachable yet or if you've
- decided not to advertise your dirport yet. Addresses bug 556.
- - If we've gone 12 hours since our last bandwidth check, and we
- estimate we have less than 50KB bandwidth capacity but we could
- handle more, do another bandwidth test.
- - New config options WarnPlaintextPorts and RejectPlaintextPorts so
- Tor can warn and/or refuse connections to ports commonly used with
- vulnerable-plaintext protocols. Currently we warn on ports 23,
- 109, 110, and 143, but we don't reject any.
- o Minor bugfixes:
- - When we setconf ClientOnly to 1, close any current OR and Dir
- listeners. Reported by mwenge.
- - When we get a consensus that's been signed by more people than
- we expect, don't log about it; it's not a big deal. Reported
- by Kyle Williams.
- o Minor features:
- - Don't answer "/tor/networkstatus-bridges" directory requests if
- the request isn't encrypted.
- - Make "ClientOnly 1" config option disable directory ports too.
- - Patches from Karsten Loesing to make v2 hidden services more
- robust: work even when there aren't enough HSDir relays available;
- retry when a v2 rend desc fetch fails; but don't retry if we
- already have a usable v0 rend desc.
- Changes in version 0.2.0.17-alpha - 2008-01-17
- Tor 0.2.0.17-alpha makes the tarball build cleanly again (whoops).
- o Compile fixes:
- - Make the tor-gencert man page get included correctly in the tarball.
- Changes in version 0.2.0.16-alpha - 2008-01-17
- Tor 0.2.0.16-alpha adds a fifth v3 directory authority run by Karsten
- Loesing, and generally cleans up a lot of features and minor bugs.
- o New directory authorities:
- - Set up gabelmoo (run by Karsten Loesing) as the fifth v3 directory
- authority.
- o Major performance improvements:
- - Switch our old ring buffer implementation for one more like that
- used by free Unix kernels. The wasted space in a buffer with 1mb
- of data will now be more like 8k than 1mb. The new implementation
- also avoids realloc();realloc(); patterns that can contribute to
- memory fragmentation.
- o Minor features:
- - Configuration files now accept C-style strings as values. This
- helps encode characters not allowed in the current configuration
- file format, such as newline or #. Addresses bug 557.
- - Although we fixed bug 539 (where servers would send HTTP status 503
- responses _and_ send a body too), there are still servers out
- there that haven't upgraded. Therefore, make clients parse such
- bodies when they receive them.
- - When we're not serving v2 directory information, there is no reason
- to actually keep any around. Remove the obsolete files and directory
- on startup if they are very old and we aren't going to serve them.
- o Minor performance improvements:
- - Reference-count and share copies of address policy entries; only 5%
- of them were actually distinct.
- - Never walk through the list of logs if we know that no log is
- interested in a given message.
- o Minor bugfixes:
- - When an authority has not signed a consensus, do not try to
- download a nonexistent "certificate with key 00000000". Bugfix
- on 0.2.0.x. Fixes bug 569.
- - Fix a rare assert error when we're closing one of our threads:
- use a mutex to protect the list of logs, so we never write to the
- list as it's being freed. Bugfix on 0.1.2.x. Fixes the very rare
- bug 575, which is kind of the revenge of bug 222.
- - Patch from Karsten Loesing to complain less at both the client
- and the relay when a relay used to have the HSDir flag but doesn't
- anymore, and we try to upload a hidden service descriptor.
- - Stop leaking one cert per TLS context. Fixes bug 582. Bugfix on
- 0.2.0.15-alpha.
- - Do not try to download missing certificates until we have tried
- to check our fallback consensus. Fixes bug 583.
- - Make bridges round reported GeoIP stats info up to the nearest
- estimate, not down. Now we can distinguish between "0 people from
- this country" and "1 person from this country".
- - Avoid a spurious free on base64 failure. Bugfix on 0.1.2.
- - Avoid possible segfault if key generation fails in
- crypto_pk_hybrid_encrypt. Bugfix on 0.2.0.
- - Avoid segfault in the case where a badly behaved v2 versioning
- directory sends a signed networkstatus with missing client-versions.
- Bugfix on 0.1.2.
- - Avoid segfaults on certain complex invocations of
- router_get_by_hexdigest(). Bugfix on 0.1.2.
- - Correct bad index on array access in parse_http_time(). Bugfix
- on 0.2.0.
- - Fix possible bug in vote generation when server versions are present
- but client versions are not.
- - Fix rare bug on REDIRECTSTREAM control command when called with no
- port set: it could erroneously report an error when none had
- happened.
- - Avoid bogus crash-prone, leak-prone tor_realloc when we're
- compressing large objects and find ourselves with more than 4k
- left over. Bugfix on 0.2.0.
- - Fix a small memory leak when setting up a hidden service.
- - Fix a few memory leaks that could in theory happen under bizarre
- error conditions.
- - Fix an assert if we post a general-purpose descriptor via the
- control port but that descriptor isn't mentioned in our current
- network consensus. Bug reported by Jon McLachlan; bugfix on
- 0.2.0.9-alpha.
- o Minor features (controller):
- - Get NS events working again. Patch from tup.
- - The GETCONF command now escapes and quotes configuration values
- that don't otherwise fit into the torrc file.
- - The SETCONF command now handles quoted values correctly.
- o Minor features (directory authorities):
- - New configuration options to override default maximum number of
- servers allowed on a single IP address. This is important for
- running a test network on a single host.
- - Actually implement the -s option to tor-gencert.
- - Add a manual page for tor-gencert.
- o Minor features (bridges):
- - Bridge authorities no longer serve bridge descriptors over
- unencrypted connections.
- o Minor features (other):
- - Add hidden services and DNSPorts to the list of things that make
- Tor accept that it has running ports. Change starting Tor with no
- ports from a fatal error to a warning; we might change it back if
- this turns out to confuse anybody. Fixes bug 579.
- Changes in version 0.1.2.19 - 2008-01-17
- Tor 0.1.2.19 fixes a huge memory leak on exit relays, makes the default
- exit policy a little bit more conservative so it's safer to run an
- exit relay on a home system, and fixes a variety of smaller issues.
- o Security fixes:
- - Exit policies now reject connections that are addressed to a
- relay's public (external) IP address too, unless
- ExitPolicyRejectPrivate is turned off. We do this because too
- many relays are running nearby to services that trust them based
- on network address.
- o Major bugfixes:
- - When the clock jumps forward a lot, do not allow the bandwidth
- buckets to become negative. Fixes bug 544.
- - Fix a memory leak on exit relays; we were leaking a cached_resolve_t
- on every successful resolve. Reported by Mike Perry.
- - Purge old entries from the "rephist" database and the hidden
- service descriptor database even when DirPort is zero.
- - Stop thinking that 0.1.2.x directory servers can handle "begin_dir"
- requests. Should ease bugs 406 and 419 where 0.1.2.x relays are
- crashing or mis-answering these requests.
- - When we decide to send a 503 response to a request for servers, do
- not then also send the server descriptors: this defeats the whole
- purpose. Fixes bug 539.
- o Minor bugfixes:
- - Changing the ExitPolicyRejectPrivate setting should cause us to
- rebuild our server descriptor.
- - Fix handling of hex nicknames when answering controller requests for
- networkstatus by name, or when deciding whether to warn about
- unknown routers in a config option. (Patch from mwenge.)
- - Fix a couple of hard-to-trigger autoconf problems that could result
- in really weird results on platforms whose sys/types.h files define
- nonstandard integer types.
- - Don't try to create the datadir when running --verify-config or
- --hash-password. Resolves bug 540.
- - If we were having problems getting a particular descriptor from the
- directory caches, and then we learned about a new descriptor for
- that router, we weren't resetting our failure count. Reported
- by lodger.
- - Although we fixed bug 539 (where servers would send HTTP status 503
- responses _and_ send a body too), there are still servers out there
- that haven't upgraded. Therefore, make clients parse such bodies
- when they receive them.
- - Run correctly on systems where rlim_t is larger than unsigned long.
- This includes some 64-bit systems.
- - Run correctly on platforms (like some versions of OS X 10.5) where
- the real limit for number of open files is OPEN_FILES, not rlim_max
- from getrlimit(RLIMIT_NOFILES).
- - Avoid a spurious free on base64 failure.
- - Avoid segfaults on certain complex invocations of
- router_get_by_hexdigest().
- - Fix rare bug on REDIRECTSTREAM control command when called with no
- port set: it could erroneously report an error when none had
- happened.
- Changes in version 0.2.0.15-alpha - 2007-12-25
- Tor 0.2.0.14-alpha and 0.2.0.15-alpha fix a bunch of bugs with the
- features added in 0.2.0.13-alpha.
- o Major bugfixes:
- - Fix several remotely triggerable asserts based on DirPort requests
- for a v2 or v3 networkstatus object before we were prepared. This
- was particularly bad for 0.2.0.13 and later bridge relays, who
- would never have a v2 networkstatus and would thus always crash
- when used. Bugfixes on 0.2.0.x.
- - Estimate the v3 networkstatus size more accurately, rather than
- estimating it at zero bytes and giving it artificially high priority
- compared to other directory requests. Bugfix on 0.2.0.x.
- o Minor bugfixes:
- - Fix configure.in logic for cross-compilation.
- - When we load a bridge descriptor from the cache, and it was
- previously unreachable, mark it as retriable so we won't just
- ignore it. Also, try fetching a new copy immediately. Bugfixes
- on 0.2.0.13-alpha.
- - The bridge GeoIP stats were counting other relays, for example
- self-reachability and authority-reachability tests.
- o Minor features:
- - Support compilation to target iPhone; patch from cjacker huang.
- To build for iPhone, pass the --enable-iphone option to configure.
- Changes in version 0.2.0.14-alpha - 2007-12-23
- o Major bugfixes:
- - Fix a crash on startup if you install Tor 0.2.0.13-alpha fresh
- without a datadirectory from a previous Tor install. Reported
- by Zax.
- - Fix a crash when we fetch a descriptor that turns out to be
- unexpected (it used to be in our networkstatus when we started
- fetching it, but it isn't in our current networkstatus), and we
- aren't using bridges. Bugfix on 0.2.0.x.
- - Fix a crash when accessing hidden services: it would work the first
- time you use a given introduction point for your service, but
- on subsequent requests we'd be using garbage memory. Fixed by
- Karsten Loesing. Bugfix on 0.2.0.13-alpha.
- - Fix a crash when we load a bridge descriptor from disk but we don't
- currently have a Bridge line for it in our torrc. Bugfix on
- 0.2.0.13-alpha.
- o Major features:
- - If bridge authorities set BridgePassword, they will serve a
- snapshot of known bridge routerstatuses from their DirPort to
- anybody who knows that password. Unset by default.
- o Minor bugfixes:
- - Make the unit tests build again.
- - Make "GETINFO/desc-annotations/id/<OR digest>" actually work.
- - Make PublishServerDescriptor default to 1, so the default doesn't
- have to change as we invent new directory protocol versions.
- - Fix test for rlim_t on OSX 10.3: sys/resource.h doesn't want to
- be included unless sys/time.h is already included. Fixes
- bug 553. Bugfix on 0.2.0.x.
- - If we receive a general-purpose descriptor and then receive an
- identical bridge-purpose descriptor soon after, don't discard
- the next one as a duplicate.
- o Minor features:
- - If BridgeRelay is set to 1, then the default for
- PublishServerDescriptor is now "bridge" rather than "v2,v3".
- - If the user sets RelayBandwidthRate but doesn't set
- RelayBandwidthBurst, then make them equal rather than erroring out.
- Changes in version 0.2.0.13-alpha - 2007-12-21
- Tor 0.2.0.13-alpha adds a fourth v3 directory authority run by Geoff
- Goodell, fixes many more bugs, and adds a lot of infrastructure for
- upcoming features.
- o New directory authorities:
- - Set up lefkada (run by Geoff Goodell) as the fourth v3 directory
- authority.
- o Major bugfixes:
- - Only update guard status (usable / not usable) once we have
- enough directory information. This was causing us to always pick
- two new guards on startup (bugfix on 0.2.0.9-alpha), and it was
- causing us to discard all our guards on startup if we hadn't been
- running for a few weeks (bugfix on 0.1.2.x). Fixes bug 448.
- - Purge old entries from the "rephist" database and the hidden
- service descriptor databases even when DirPort is zero. Bugfix
- on 0.1.2.x.
- - We were ignoring our RelayBandwidthRate for the first 30 seconds
- after opening a circuit -- even a relayed circuit. Bugfix on
- 0.2.0.3-alpha.
- - Stop thinking that 0.1.2.x directory servers can handle "begin_dir"
- requests. Should ease bugs 406 and 419 where 0.1.2.x relays are
- crashing or mis-answering these types of requests.
- - Relays were publishing their server descriptor to v1 and v2
- directory authorities, but they didn't try publishing to v3-only
- authorities. Fix this; and also stop publishing to v1 authorities.
- Bugfix on 0.2.0.x.
- - When we were reading router descriptors from cache, we were ignoring
- the annotations -- so for example we were reading in bridge-purpose
- descriptors as general-purpose descriptors. Bugfix on 0.2.0.8-alpha.
- - When we decided to send a 503 response to a request for servers, we
- were then also sending the server descriptors: this defeats the
- whole purpose. Fixes bug 539; bugfix on 0.1.2.x.
- o Major features:
- - Bridge relays now behave like clients with respect to time
- intervals for downloading new consensus documents -- otherwise they
- stand out. Bridge users now wait until the end of the interval,
- so their bridge relay will be sure to have a new consensus document.
- - Three new config options (AlternateDirAuthority,
- AlternateBridgeAuthority, and AlternateHSAuthority) that let the
- user selectively replace the default directory authorities by type,
- rather than the all-or-nothing replacement that DirServer offers.
- - Tor can now be configured to read a GeoIP file from disk in one
- of two formats. This can be used by controllers to map IP addresses
- to countries. Eventually, it may support exit-by-country.
- - When possible, bridge relays remember which countries users
- are coming from, and report aggregate information in their
- extra-info documents, so that the bridge authorities can learn
- where Tor is blocked.
- - Bridge directory authorities now do reachability testing on the
- bridges they know. They provide router status summaries to the
- controller via "getinfo ns/purpose/bridge", and also dump summaries
- to a file periodically.
- - Stop fetching directory info so aggressively if your DirPort is
- on but your ORPort is off; stop fetching v2 dir info entirely.
- You can override these choices with the new FetchDirInfoEarly
- config option.
- o Minor bugfixes:
- - The fix in 0.2.0.12-alpha cleared the "hsdir" flag in v3 network
- consensus documents when there are too many relays at a single
- IP address. Now clear it in v2 network status documents too, and
- also clear it in routerinfo_t when the relay is no longer listed
- in the relevant networkstatus document.
- - Don't crash if we get an unexpected value for the
- PublishServerDescriptor config option. Reported by Matt Edman;
- bugfix on 0.2.0.9-alpha.
- - Our new v2 hidden service descriptor format allows descriptors
- that have no introduction points. But Tor crashed when we tried
- to build a descriptor with no intro points (and it would have
- crashed if we had tried to parse one). Bugfix on 0.2.0.x; patch
- by Karsten Loesing.
- - Fix building with dmalloc 5.5.2 with glibc.
- - Reject uploaded descriptors and extrainfo documents if they're
- huge. Otherwise we'll cache them all over the network and it'll
- clog everything up. Reported by Aljosha Judmayer.
- - Check for presence of s6_addr16 and s6_addr32 fields in in6_addr
- via autoconf. Should fix compile on solaris. Bugfix on 0.2.0.x.
- - When the DANGEROUS_VERSION controller status event told us we're
- running an obsolete version, it used the string "OLD" to describe
- it. Yet the "getinfo" interface used the string "OBSOLETE". Now use
- "OBSOLETE" in both cases. Bugfix on 0.1.2.x.
- - If we can't expand our list of entry guards (e.g. because we're
- using bridges or we have StrictEntryNodes set), don't mark relays
- down when they fail a directory request. Otherwise we're too quick
- to mark all our entry points down. Bugfix on 0.1.2.x.
- - Fix handling of hex nicknames when answering controller requests for
- networkstatus by name, or when deciding whether to warn about unknown
- routers in a config option. Bugfix on 0.1.2.x. (Patch from mwenge.)
- - Fix a couple of hard-to-trigger autoconf problems that could result
- in really weird results on platforms whose sys/types.h files define
- nonstandard integer types. Bugfix on 0.1.2.x.
- - Fix compilation with --disable-threads set. Bugfix on 0.2.0.x.
- - Don't crash on name lookup when we have no current consensus. Fixes
- bug 538; bugfix on 0.2.0.x.
- - Only Tors that want to mirror the v2 directory info should
- create the "cached-status" directory in their datadir. (All Tors
- used to create it.) Bugfix on 0.2.0.9-alpha.
- - Directory authorities should only automatically download Extra Info
- documents if they're v1, v2, or v3 authorities. Bugfix on 0.1.2.x.
- o Minor features:
- - On the USR1 signal, when dmalloc is in use, log the top 10 memory
- consumers. (We already do this on HUP.)
- - Authorities and caches fetch the v2 networkstatus documents
- less often, now that v3 is encouraged.
- - Add a new config option BridgeRelay that specifies you want to
- be a bridge relay. Right now the only difference is that it makes
- you answer begin_dir requests, and it makes you cache dir info,
- even if your DirPort isn't on.
- - Add "GETINFO/desc-annotations/id/<OR digest>" so controllers can
- ask about source, timestamp of arrival, purpose, etc. We need
- something like this to help Vidalia not do GeoIP lookups on bridge
- addresses.
- - Allow multiple HashedControlPassword config lines, to support
- multiple controller passwords.
- - Authorities now decide whether they're authoritative for a given
- router based on the router's purpose.
- - New config options AuthDirBadDir and AuthDirListBadDirs for
- authorities to mark certain relays as "bad directories" in the
- networkstatus documents. Also supports the "!baddir" directive in
- the approved-routers file.
- Changes in version 0.2.0.12-alpha - 2007-11-16
- This twelfth development snapshot fixes some more build problems as
- well as a few minor bugs.
- o Compile fixes:
- - Make it build on OpenBSD again. Patch from tup.
- - Substitute BINDIR and LOCALSTATEDIR in scripts. Fixes
- package-building for Red Hat, OS X, etc.
- o Minor bugfixes (on 0.1.2.x):
- - Changing the ExitPolicyRejectPrivate setting should cause us to
- rebuild our server descriptor.
- o Minor bugfixes (on 0.2.0.x):
- - When we're lacking a consensus, don't try to perform rendezvous
- operations. Reported by Karsten Loesing.
- - Fix a small memory leak whenever we decide against using a
- newly picked entry guard. Reported by Mike Perry.
- - When authorities detected more than two relays running on the same
- IP address, they were clearing all the status flags but forgetting
- to clear the "hsdir" flag. So clients were being told that a
- given relay was the right choice for a v2 hsdir lookup, yet they
- never had its descriptor because it was marked as 'not running'
- in the consensus.
- - If we're trying to fetch a bridge descriptor and there's no way
- the bridge authority could help us (for example, we don't know
- a digest, or there is no bridge authority), don't be so eager to
- fall back to asking the bridge authority.
- - If we're using bridges or have strictentrynodes set, and our
- chosen exit is in the same family as all our bridges/entry guards,
- then be flexible about families.
- o Minor features:
- - When we negotiate a v2 link-layer connection (not yet implemented),
- accept RELAY_EARLY cells and turn them into RELAY cells if we've
- negotiated a v1 connection for their next step. Initial code for
- proposal 110.
- Changes in version 0.2.0.11-alpha - 2007-11-12
- This eleventh development snapshot fixes some build problems with
- the previous snapshot. It also includes a more secure-by-default exit
- policy for relays, fixes an enormous memory leak for exit relays, and
- fixes another bug where servers were falling out of the directory list.
- o Security fixes:
- - Exit policies now reject connections that are addressed to a
- relay's public (external) IP address too, unless
- ExitPolicyRejectPrivate is turned off. We do this because too
- many relays are running nearby to services that trust them based
- on network address. Bugfix on 0.1.2.x.
- o Major bugfixes:
- - Fix a memory leak on exit relays; we were leaking a cached_resolve_t
- on every successful resolve. Reported by Mike Perry; bugfix
- on 0.1.2.x.
- - On authorities, never downgrade to old router descriptors simply
- because they're listed in the consensus. This created a catch-22
- where we wouldn't list a new descriptor because there was an
- old one in the consensus, and we couldn't get the new one in the
- consensus because we wouldn't list it. Possible fix for bug 548.
- Also, this might cause bug 543 to appear on authorities; if so,
- we'll need a band-aid for that. Bugfix on 0.2.0.9-alpha.
- o Packaging fixes on 0.2.0.10-alpha:
- - We were including instructions about what to do with the
- src/config/fallback-consensus file, but we weren't actually
- including it in the tarball. Disable all of that for now.
- o Minor features:
- - Allow people to say PreferTunnelledDirConns rather than
- PreferTunneledDirConns, for those alternate-spellers out there.
- o Minor bugfixes:
- - Don't reevaluate all the information from our consensus document
- just because we've downloaded a v2 networkstatus that we intend
- to cache. Fixes bug 545; bugfix on 0.2.0.x.
- Changes in version 0.2.0.10-alpha - 2007-11-10
- This tenth development snapshot adds a third v3 directory authority
- run by Mike Perry, adds most of Karsten Loesing's new hidden service
- descriptor format, fixes a bad crash bug and new bridge bugs introduced
- in 0.2.0.9-alpha, fixes many bugs with the v3 directory implementation,
- fixes some minor memory leaks in previous 0.2.0.x snapshots, and
- addresses many more minor issues.
- o New directory authorities:
- - Set up ides (run by Mike Perry) as the third v3 directory authority.
- o Major features:
- - Allow tunnelled directory connections to ask for an encrypted
- "begin_dir" connection or an anonymized "uses a full Tor circuit"
- connection independently. Now we can make anonymized begin_dir
- connections for (e.g.) more secure hidden service posting and
- fetching.
- - More progress on proposal 114: code from Karsten Loesing to
- implement new hidden service descriptor format.
- - Raise the default BandwidthRate/BandwidthBurst to 5MB/10MB, to
- accommodate the growing number of servers that use the default
- and are reaching it.
- - Directory authorities use a new formula for selecting which nodes
- to advertise as Guards: they must be in the top 7/8 in terms of
- how long we have known about them, and above the median of those
- nodes in terms of weighted fractional uptime.
- - Make "not enough dir info yet" warnings describe *why* Tor feels
- it doesn't have enough directory info yet.
- o Major bugfixes:
- - Stop servers from crashing if they set a Family option (or
- maybe in other situations too). Bugfix on 0.2.0.9-alpha; reported
- by Fabian Keil.
- - Make bridge users work again -- the move to v3 directories in
- 0.2.0.9-alpha had introduced a number of bugs that made bridges
- no longer work for clients.
- - When the clock jumps forward a lot, do not allow the bandwidth
- buckets to become negative. Bugfix on 0.1.2.x; fixes bug 544.
- o Major bugfixes (v3 dir, bugfixes on 0.2.0.9-alpha):
- - When the consensus lists a router descriptor that we previously were
- mirroring, but that we considered non-canonical, reload the
- descriptor as canonical. This fixes bug 543 where Tor servers
- would start complaining after a few days that they don't have
- enough directory information to build a circuit.
- - Consider replacing the current consensus when certificates arrive
- that make the pending consensus valid. Previously, we were only
- considering replacement when the new certs _didn't_ help.
- - Fix an assert error on startup if we didn't already have the
- consensus and certs cached in our datadirectory: we were caching
- the consensus in consensus_waiting_for_certs but then free'ing it
- right after.
- - Avoid sending a request for "keys/fp" (for which we'll get a 400 Bad
- Request) if we need more v3 certs but we've already got pending
- requests for all of them.
- - Correctly back off from failing certificate downloads. Fixes
- bug 546.
- - Authorities don't vote on the Running flag if they have been running
- for less than 30 minutes themselves. Fixes bug 547, where a newly
- started authority would vote that everyone was down.
- o New requirements:
- - Drop support for OpenSSL version 0.9.6. Just about nobody was using
- it, it had no AES, and it hasn't seen any security patches since
- 2004.
- o Minor features:
- - Clients now hold circuitless TLS connections open for 1.5 times
- MaxCircuitDirtiness (15 minutes), since it is likely that they'll
- rebuild a new circuit over them within that timeframe. Previously,
- they held them open only for KeepalivePeriod (5 minutes).
- - Use "If-Modified-Since" to avoid retrieving consensus
- networkstatuses that we already have.
- - When we have no consensus, check FallbackNetworkstatusFile (defaults
- to $PREFIX/share/tor/fallback-consensus) for a consensus. This way
- we start knowing some directory caches.
- - When we receive a consensus from the future, warn about skew.
- - Improve skew reporting: try to give the user a better log message
- about how skewed they are, and how much this matters.
- - When we have a certificate for an authority, believe that
- certificate's claims about the authority's IP address.
- - New --quiet command-line option to suppress the default console log.
- Good in combination with --hash-password.
- - Authorities send back an X-Descriptor-Not-New header in response to
- an accepted-but-discarded descriptor upload. Partially implements
- fix for bug 535.
- - Make the log message for "tls error. breaking." more useful.
- - Better log messages about certificate downloads, to attempt to
- track down the second incarnation of bug 546.
- o Minor features (bridges):
- - If bridge users set UpdateBridgesFromAuthority, but the digest
- they ask for is a 404 from the bridge authority, they now fall
- back to trying the bridge directly.
- - Bridges now use begin_dir to publish their server descriptor to
- the bridge authority, even when they haven't set TunnelDirConns.
- o Minor features (controller):
- - When reporting clock skew, and we know that the clock is _at least
- as skewed_ as some value, but we don't know the actual value,
- report the value as a "minimum skew."
- o Utilities:
- - Update linux-tor-prio.sh script to allow QoS based on the uid of
- the Tor process. Patch from Marco Bonetti with tweaks from Mike
- Perry.
- o Minor bugfixes:
- - Refuse to start if both ORPort and UseBridges are set. Bugfix
- on 0.2.0.x, suggested by Matt Edman.
- - Don't stop fetching descriptors when FetchUselessDescriptors is
- set, even if we stop asking for circuits. Bugfix on 0.1.2.x;
- reported by tup and ioerror.
- - Better log message on vote from unknown authority.
- - Don't log "Launching 0 request for 0 router" message.
- o Minor bugfixes (memory leaks):
- - Stop leaking memory every time we parse a v3 certificate. Bugfix
- on 0.2.0.1-alpha.
- - Stop leaking memory every time we load a v3 certificate. Bugfix
- on 0.2.0.1-alpha. Fixes bug 536.
- - Stop leaking a cached networkstatus on exit. Bugfix on
- 0.2.0.3-alpha.
- - Stop leaking voter information every time we free a consensus.
- Bugfix on 0.2.0.3-alpha.
- - Stop leaking signed data every time we check a voter signature.
- Bugfix on 0.2.0.3-alpha.
- - Stop leaking a signature every time we fail to parse a consensus or
- a vote. Bugfix on 0.2.0.3-alpha.
- - Stop leaking v2_download_status_map on shutdown. Bugfix on
- 0.2.0.9-alpha.
- - Stop leaking conn->nickname every time we make a connection to a
- Tor relay without knowing its expected identity digest (e.g. when
- using bridges). Bugfix on 0.2.0.3-alpha.
- - Minor bugfixes (portability):
- - Run correctly on platforms where rlim_t is larger than unsigned
- long, and/or where the real limit for number of open files is
- OPEN_FILES, not rlim_max from getrlimit(RLIMIT_NOFILES). In
- particular, these may be needed for OS X 10.5.
- Changes in version 0.1.2.18 - 2007-10-28
- Tor 0.1.2.18 fixes many problems including crash bugs, problems with
- hidden service introduction that were causing huge delays, and a big
- bug that was causing some servers to disappear from the network status
- lists for a few hours each day.
- o Major bugfixes (crashes):
- - If a connection is shut down abruptly because of something that
- happened inside connection_flushed_some(), do not call
- connection_finished_flushing(). Should fix bug 451:
- "connection_stop_writing: Assertion conn->write_event failed"
- Bugfix on 0.1.2.7-alpha.
- - Fix possible segfaults in functions called from
- rend_process_relay_cell().
- o Major bugfixes (hidden services):
- - Hidden services were choosing introduction points uniquely by
- hexdigest, but when constructing the hidden service descriptor
- they merely wrote the (potentially ambiguous) nickname.
- - Clients now use the v2 intro format for hidden service
- connections: they specify their chosen rendezvous point by identity
- digest rather than by (potentially ambiguous) nickname. These
- changes could speed up hidden service connections dramatically.
- o Major bugfixes (other):
- - Stop publishing a new server descriptor just because we get a
- HUP signal. This led (in a roundabout way) to some servers getting
- dropped from the networkstatus lists for a few hours each day.
- - When looking for a circuit to cannibalize, consider family as well
- as identity. Fixes bug 438. Bugfix on 0.1.0.x (which introduced
- circuit cannibalization).
- - When a router wasn't listed in a new networkstatus, we were leaving
- the flags for that router alone -- meaning it remained Named,
- Running, etc -- even though absence from the networkstatus means
- that it shouldn't be considered to exist at all anymore. Now we
- clear all the flags for routers that fall out of the networkstatus
- consensus. Fixes bug 529.
- o Minor bugfixes:
- - Don't try to access (or alter) the state file when running
- --list-fingerprint or --verify-config or --hash-password. Resolves
- bug 499.
- - When generating information telling us how to extend to a given
- router, do not try to include the nickname if it is
- absent. Resolves bug 467.
- - Fix a user-triggerable segfault in expand_filename(). (There isn't
- a way to trigger this remotely.)
- - When sending a status event to the controller telling it that an
- OR address is reachable, set the port correctly. (Previously we
- were reporting the dir port.)
- - Fix a minor memory leak whenever a controller sends the PROTOCOLINFO
- command. Bugfix on 0.1.2.17.
- - When loading bandwidth history, do not believe any information in
- the future. Fixes bug 434.
- - When loading entry guard information, do not believe any information
- in the future.
- - When we have our clock set far in the future and generate an
- onion key, then re-set our clock to be correct, we should not stop
- the onion key from getting rotated.
- - On some platforms, accept() can return a broken address. Detect
- this more quietly, and deal accordingly. Fixes bug 483.
- - It's not actually an error to find a non-pending entry in the DNS
- cache when canceling a pending resolve. Don't log unless stuff
- is fishy. Resolves bug 463.
- - Don't reset trusted dir server list when we set a configuration
- option. Patch from Robert Hogan.
- - Don't try to create the datadir when running --verify-config or
- --hash-password. Resolves bug 540.
- Changes in version 0.2.0.9-alpha - 2007-10-24
- This ninth development snapshot switches clients to the new v3 directory
- system; allows servers to be listed in the network status even when they
- have the same nickname as a registered server; and fixes many other
- bugs including a big one that was causing some servers to disappear
- from the network status lists for a few hours each day.
- o Major features (directory system):
- - Clients now download v3 consensus networkstatus documents instead
- of v2 networkstatus documents. Clients and caches now base their
- opinions about routers on these consensus documents. Clients only
- download router descriptors listed in the consensus.
- - Authorities now list servers who have the same nickname as
- a different named server, but list them with a new flag,
- "Unnamed". Now we can list servers that happen to pick the same
- nickname as a server that registered two years ago and then
- disappeared. Partially implements proposal 122.
- - If the consensus lists a router as "Unnamed", the name is assigned
- to a different router: do not identify the router by that name.
- Partially implements proposal 122.
- - Authorities can now come to a consensus on which method to use to
- compute the consensus. This gives us forward compatibility.
- o Major bugfixes:
- - Stop publishing a new server descriptor just because we HUP or
- when we find our DirPort to be reachable but won't actually publish
- it. New descriptors without any real changes are dropped by the
- authorities, and can screw up our "publish every 18 hours" schedule.
- Bugfix on 0.1.2.x.
- - When a router wasn't listed in a new networkstatus, we were leaving
- the flags for that router alone -- meaning it remained Named,
- Running, etc -- even though absence from the networkstatus means
- that it shouldn't be considered to exist at all anymore. Now we
- clear all the flags for routers that fall out of the networkstatus
- consensus. Fixes bug 529; bugfix on 0.1.2.x.
- - Fix awful behavior in DownloadExtraInfo option where we'd fetch
- extrainfo documents and then discard them immediately for not
- matching the latest router. Bugfix on 0.2.0.1-alpha.
- o Minor features (v3 directory protocol):
- - Allow tor-gencert to generate a new certificate without replacing
- the signing key.
- - Allow certificates to include an address.
- - When we change our directory-cache settings, reschedule all voting
- and download operations.
- - Reattempt certificate downloads immediately on failure, as long as
- we haven't failed a threshold number of times yet.
- - Delay retrying consensus downloads while we're downloading
- certificates to verify the one we just got. Also, count getting a
- consensus that we already have (or one that isn't valid) as a failure,
- and count failing to get the certificates after 20 minutes as a
- failure.
- - Build circuits and download descriptors even if our consensus is a
- little expired. (This feature will go away once authorities are
- more reliable.)
- o Minor features (router descriptor cache):
- - If we find a cached-routers file that's been sitting around for more
- than 28 days unmodified, then most likely it's a leftover from
- when we upgraded to 0.2.0.8-alpha. Remove it. It has no good
- routers anyway.
- - When we (as a cache) download a descriptor because it was listed
- in a consensus, remember when the consensus was supposed to expire,
- and don't expire the descriptor until then.
- o Minor features (performance):
- - Call routerlist_remove_old_routers() much less often. This should
- speed startup, especially on directory caches.
- - Don't try to launch new descriptor downloads quite so often when we
- already have enough directory information to build circuits.
- - Base64 decoding was actually showing up on our profile when parsing
- the initial descriptor file; switch to an in-process all-at-once
- implementation that's about 3.5x times faster than calling out to
- OpenSSL.
- o Minor features (compilation):
- - Detect non-ASCII platforms (if any still exist) and refuse to
- build there: some of our code assumes that 'A' is 65 and so on.
- o Minor bugfixes (v3 directory authorities, bugfixes on 0.2.0.x):
- - Make the "next period" votes into "current period" votes immediately
- after publishing the consensus; avoid a heisenbug that made them
- stick around indefinitely.
- - When we discard a vote as a duplicate, do not report this as
- an error.
- - Treat missing v3 keys or certificates as an error when running as a
- v3 directory authority.
- - When we're configured to be a v3 authority, but we're only listed
- as a non-v3 authority in our DirServer line for ourself, correct
- the listing.
- - If an authority doesn't have a qualified hostname, just put
- its address in the vote. This fixes the problem where we referred to
- "moria on moria:9031."
- - Distinguish between detached signatures for the wrong period, and
- detached signatures for a divergent vote.
- - Fix a small memory leak when computing a consensus.
- - When there's no concensus, we were forming a vote every 30
- minutes, but writing the "valid-after" line in our vote based
- on our configured V3AuthVotingInterval: so unless the intervals
- matched up, we immediately rejected our own vote because it didn't
- start at the voting interval that caused us to construct a vote.
- o Minor bugfixes (v3 directory protocol, bugfixes on 0.2.0.x):
- - Delete unverified-consensus when the real consensus is set.
- - Consider retrying a consensus networkstatus fetch immediately
- after one fails: don't wait 60 seconds to notice.
- - When fetching a consensus as a cache, wait until a newer consensus
- should exist before trying to replace the current one.
- - Use a more forgiving schedule for retrying failed consensus
- downloads than for other types.
- o Minor bugfixes (other directory issues):
- - Correct the implementation of "download votes by digest." Bugfix on
- 0.2.0.8-alpha.
- - Authorities no longer send back "400 you're unreachable please fix
- it" errors to Tor servers that aren't online all the time. We're
- supposed to tolerate these servers now. Bugfix on 0.1.2.x.
- o Minor bugfixes (controller):
- - Don't reset trusted dir server list when we set a configuration
- option. Patch from Robert Hogan; bugfix on 0.1.2.x.
- - Respond to INT and TERM SIGNAL commands before we execute the
- signal, in case the signal shuts us down. We had a patch in
- 0.1.2.1-alpha that tried to do this by queueing the response on
- the connection's buffer before shutting down, but that really
- isn't the same thing at all. Bug located by Matt Edman.
- o Minor bugfixes (misc):
- - Correctly check for bad options to the "PublishServerDescriptor"
- config option. Bugfix on 0.2.0.1-alpha; reported by Matt Edman.
- - Stop leaking memory on failing case of base32_decode, and make
- it accept upper-case letters. Bugfixes on 0.2.0.7-alpha.
- - Don't try to download extrainfo documents when we're trying to
- fetch enough directory info to build a circuit: having enough
- info should get priority. Bugfix on 0.2.0.x.
- - Don't complain that "your server has not managed to confirm that its
- ports are reachable" if we haven't been able to build any circuits
- yet. Bug found by spending four hours without a v3 consensus. Bugfix
- on 0.1.2.x.
- - Detect the reason for failing to mmap a descriptor file we just
- wrote, and give a more useful log message. Fixes bug 533. Bugfix
- on 0.1.2.x.
- o Code simplifications and refactoring:
- - Remove support for the old bw_accounting file: we've been storing
- bandwidth accounting information in the state file since
- 0.1.2.5-alpha. This may result in bandwidth accounting errors
- if you try to upgrade from 0.1.1.x or earlier, or if you try to
- downgrade to 0.1.1.x or earlier.
- - New convenience code to locate a file within the DataDirectory.
- - Move non-authority functionality out of dirvote.c.
- - Refactor the arguments for router_pick_{directory_|trusteddir}server
- so that they all take the same named flags.
- o Utilities
- - Include the "tor-ctrl.sh" bash script by Stefan Behte to provide
- Unix users an easy way to script their Tor process (e.g. by
- adjusting bandwidth based on the time of the day).
- Changes in version 0.2.0.8-alpha - 2007-10-12
- This eighth development snapshot fixes a crash bug that's been bothering
- us since February 2007, lets bridge authorities store a list of bridge
- descriptors they've seen, gets v3 directory voting closer to working,
- starts caching v3 directory consensus documents on directory mirrors,
- and fixes a variety of smaller issues including some minor memory leaks.
- o Major features (router descriptor cache):
- - Store routers in a file called cached-descriptors instead of in
- cached-routers. Initialize cached-descriptors from cached-routers
- if the old format is around. The new format allows us to store
- annotations along with descriptors.
- - Use annotations to record the time we received each descriptor, its
- source, and its purpose.
- - Disable the SETROUTERPURPOSE controller command: it is now
- obsolete.
- - Controllers should now specify cache=no or cache=yes when using
- the +POSTDESCRIPTOR command.
- - Bridge authorities now write bridge descriptors to disk, meaning
- we can export them to other programs and begin distributing them
- to blocked users.
- o Major features (directory authorities):
- - When a v3 authority is missing votes or signatures, it now tries
- to fetch them.
- - Directory authorities track weighted fractional uptime as well as
- weighted mean-time-between failures. WFU is suitable for deciding
- whether a node is "usually up", while MTBF is suitable for deciding
- whether a node is "likely to stay up." We need both, because
- "usually up" is a good requirement for guards, while "likely to
- stay up" is a good requirement for long-lived connections.
- o Major features (v3 directory system):
- - Caches now download v3 network status documents as needed,
- and download the descriptors listed in them.
- - All hosts now attempt to download and keep fresh v3 authority
- certificates, and re-attempt after failures.
- - More internal-consistency checks for vote parsing.
- o Major bugfixes (crashes):
- - If a connection is shut down abruptly because of something that
- happened inside connection_flushed_some(), do not call
- connection_finished_flushing(). Should fix bug 451. Bugfix on
- 0.1.2.7-alpha.
- o Major bugfixes (performance):
- - Fix really bad O(n^2) performance when parsing a long list of
- routers: Instead of searching the entire list for an "extra-info "
- string which usually wasn't there, once for every routerinfo
- we read, just scan lines forward until we find one we like.
- Bugfix on 0.2.0.1.
- - When we add data to a write buffer in response to the data on that
- write buffer getting low because of a flush, do not consider the
- newly added data as a candidate for immediate flushing, but rather
- make it wait until the next round of writing. Otherwise, we flush
- and refill recursively, and a single greedy TLS connection can
- eat all of our bandwidth. Bugfix on 0.1.2.7-alpha.
- o Minor features (v3 authority system):
- - Add more ways for tools to download the votes that lead to the
- current consensus.
- - Send a 503 when low on bandwidth and a vote, consensus, or
- certificate is requested.
- - If-modified-since is now implemented properly for all kinds of
- certificate requests.
- o Minor bugfixes (network statuses):
- - Tweak the implementation of proposal 109 slightly: allow at most
- two Tor servers on the same IP address, except if it's the location
- of a directory authority, in which case allow five. Bugfix on
- 0.2.0.3-alpha.
- o Minor bugfixes (controller):
- - When sending a status event to the controller telling it that an
- OR address is reachable, set the port correctly. (Previously we
- were reporting the dir port.) Bugfix on 0.1.2.x.
- o Minor bugfixes (v3 directory system):
- - Fix logic to look up a cert by its signing key digest. Bugfix on
- 0.2.0.7-alpha.
- - Only change the reply to a vote to "OK" if it's not already
- set. This gets rid of annoying "400 OK" log messages, which may
- have been masking some deeper issue. Bugfix on 0.2.0.7-alpha.
- - When we get a valid consensus, recompute the voting schedule.
- - Base the valid-after time of a vote on the consensus voting
- schedule, not on our preferred schedule.
- - Make the return values and messages from signature uploads and
- downloads more sensible.
- - Fix a memory leak when serving votes and consensus documents, and
- another when serving certificates.
- o Minor bugfixes (performance):
- - Use a slightly simpler string hashing algorithm (copying Python's
- instead of Java's) and optimize our digest hashing algorithm to take
- advantage of 64-bit platforms and to remove some possibly-costly
- voodoo.
- - Fix a minor memory leak whenever we parse guards from our state
- file. Bugfix on 0.2.0.7-alpha.
- - Fix a minor memory leak whenever we write out a file. Bugfix on
- 0.2.0.7-alpha.
- - Fix a minor memory leak whenever a controller sends the PROTOCOLINFO
- command. Bugfix on 0.2.0.5-alpha.
- o Minor bugfixes (portability):
- - On some platforms, accept() can return a broken address. Detect
- this more quietly, and deal accordingly. Fixes bug 483.
- - Stop calling tor_strlower() on uninitialized memory in some cases.
- Bugfix in 0.2.0.7-alpha.
- o Minor bugfixes (usability):
- - Treat some 403 responses from directory servers as INFO rather than
- WARN-severity events.
- - It's not actually an error to find a non-pending entry in the DNS
- cache when canceling a pending resolve. Don't log unless stuff is
- fishy. Resolves bug 463.
- o Minor bugfixes (anonymity):
- - Never report that we've used more bandwidth than we're willing to
- relay: it leaks how much non-relay traffic we're using. Resolves
- bug 516.
- - When looking for a circuit to cannibalize, consider family as well
- as identity. Fixes bug 438. Bugfix on 0.1.0.x (which introduced
- circuit cannibalization).
- o Code simplifications and refactoring:
- - Make a bunch of functions static. Remove some dead code.
- - Pull out about a third of the really big routerlist.c; put it in a
- new module, networkstatus.c.
- - Merge the extra fields in local_routerstatus_t back into
- routerstatus_t: we used to need one routerstatus_t for each
- authority's opinion, plus a local_routerstatus_t for the locally
- computed consensus opinion. To save space, we put the locally
- modified fields into local_routerstatus_t, and only the common
- stuff into routerstatus_t. But once v3 directories are in use,
- clients and caches will no longer need to hold authority opinions;
- thus, the rationale for keeping the types separate is now gone.
- - Make the code used to reschedule and reattempt downloads more
- uniform.
- - Turn all 'Are we a directory server/mirror?' logic into a call to
- dirserver_mode().
- - Remove the code to generate the oldest (v1) directory format.
- The code has been disabled since 0.2.0.5-alpha.
- Changes in version 0.2.0.7-alpha - 2007-09-21
- This seventh development snapshot makes bridges work again, makes bridge
- authorities work for the first time, fixes two huge performance flaws
- in hidden services, and fixes a variety of minor issues.
- o New directory authorities:
- - Set up moria1 and tor26 as the first v3 directory authorities. See
- doc/spec/dir-spec.txt for details on the new directory design.
- o Major bugfixes (crashes):
- - Fix possible segfaults in functions called from
- rend_process_relay_cell(). Bugfix on 0.1.2.x.
- o Major bugfixes (bridges):
- - Fix a bug that made servers send a "404 Not found" in response to
- attempts to fetch their server descriptor. This caused Tor servers
- to take many minutes to establish reachability for their DirPort,
- and it totally crippled bridges. Bugfix on 0.2.0.5-alpha.
- - Make "UpdateBridgesFromAuthority" torrc option work: when bridge
- users configure that and specify a bridge with an identity
- fingerprint, now they will lookup the bridge descriptor at the
- default bridge authority via a one-hop tunnel, but once circuits
- are established they will switch to a three-hop tunnel for later
- connections to the bridge authority. Bugfix in 0.2.0.3-alpha.
- o Major bugfixes (hidden services):
- - Hidden services were choosing introduction points uniquely by
- hexdigest, but when constructing the hidden service descriptor
- they merely wrote the (potentially ambiguous) nickname.
- - Clients now use the v2 intro format for hidden service
- connections: they specify their chosen rendezvous point by identity
- digest rather than by (potentially ambiguous) nickname. Both
- are bugfixes on 0.1.2.x, and they could speed up hidden service
- connections dramatically. Thanks to Karsten Loesing.
- o Minor features (security):
- - As a client, do not believe any server that tells us that an
- address maps to an internal address space.
- - Make it possible to enable HashedControlPassword and
- CookieAuthentication at the same time.
- o Minor features (guard nodes):
- - Tag every guard node in our state file with the version that
- we believe added it, or with our own version if we add it. This way,
- if a user temporarily runs an old version of Tor and then switches
- back to a new one, she doesn't automatically lose her guards.
- o Minor features (speed):
- - When implementing AES counter mode, update only the portions of the
- counter buffer that need to change, and don't keep separate
- network-order and host-order counters when they are the same (i.e.,
- on big-endian hosts.)
- o Minor features (controller):
- - Accept LF instead of CRLF on controller, since some software has a
- hard time generating real Internet newlines.
- - Add GETINFO values for the server status events
- "REACHABILITY_SUCCEEDED" and "GOOD_SERVER_DESCRIPTOR". Patch from
- Robert Hogan.
- o Removed features:
- - Routers no longer include bandwidth-history lines in their
- descriptors; this information is already available in extra-info
- documents, and including it in router descriptors took up 60%
- (!) of compressed router descriptor downloads. Completes
- implementation of proposal 104.
- - Remove the contrib scripts ExerciseServer.py, PathDemo.py,
- and TorControl.py, as they use the old v0 controller protocol,
- and are obsoleted by TorFlow anyway.
- - Drop support for v1 rendezvous descriptors, since we never used
- them anyway, and the code has probably rotted by now. Based on
- patch from Karsten Loesing.
- - On OSX, stop warning the user that kqueue support in libevent is
- "experimental", since it seems to have worked fine for ages.
- o Minor bugfixes:
- - When generating information telling us how to extend to a given
- router, do not try to include the nickname if it is absent. Fixes
- bug 467. Bugfix on 0.2.0.3-alpha.
- - Fix a user-triggerable (but not remotely-triggerable) segfault
- in expand_filename(). Bugfix on 0.1.2.x.
- - Fix a memory leak when freeing incomplete requests from DNSPort.
- Found by Niels Provos with valgrind. Bugfix on 0.2.0.1-alpha.
- - Don't try to access (or alter) the state file when running
- --list-fingerprint or --verify-config or --hash-password. (Resolves
- bug 499.) Bugfix on 0.1.2.x.
- - Servers used to decline to publish their DirPort if their
- BandwidthRate, RelayBandwidthRate, or MaxAdvertisedBandwidth
- were below a threshold. Now they only look at BandwidthRate and
- RelayBandwidthRate. Bugfix on 0.1.2.x.
- - Remove an optimization in the AES counter-mode code that assumed
- that the counter never exceeded 2^68. When the counter can be set
- arbitrarily as an IV (as it is by Karsten's new hidden services
- code), this assumption no longer holds. Bugfix on 0.1.2.x.
- - Resume listing "AUTHORITY" flag for authorities in network status.
- Bugfix on 0.2.0.3-alpha; reported by Alex de Joode.
- o Code simplifications and refactoring:
- - Revamp file-writing logic so we don't need to have the entire
- contents of a file in memory at once before we write to disk. Tor,
- meet stdio.
- - Turn "descriptor store" into a full-fledged type.
- - Move all NT services code into a separate source file.
- - Unify all code that computes medians, percentile elements, etc.
- - Get rid of a needless malloc when parsing address policies.
- Changes in version 0.1.2.17 - 2007-08-30
- Tor 0.1.2.17 features a new Vidalia version in the Windows and OS
- X bundles. Vidalia 0.0.14 makes authentication required for the
- ControlPort in the default configuration, which addresses important
- security risks. Everybody who uses Vidalia (or another controller)
- should upgrade.
- In addition, this Tor update fixes major load balancing problems with
- path selection, which should speed things up a lot once many people
- have upgraded.
- o Major bugfixes (security):
- - We removed support for the old (v0) control protocol. It has been
- deprecated since Tor 0.1.1.1-alpha, and keeping it secure has
- become more of a headache than it's worth.
- o Major bugfixes (load balancing):
- - When choosing nodes for non-guard positions, weight guards
- proportionally less, since they already have enough load. Patch
- from Mike Perry.
- - Raise the "max believable bandwidth" from 1.5MB/s to 10MB/s. This
- will allow fast Tor servers to get more attention.
- - When we're upgrading from an old Tor version, forget our current
- guards and pick new ones according to the new weightings. These
- three load balancing patches could raise effective network capacity
- by a factor of four. Thanks to Mike Perry for measurements.
- o Major bugfixes (stream expiration):
- - Expire not-yet-successful application streams in all cases if
- they've been around longer than SocksTimeout. Right now there are
- some cases where the stream will live forever, demanding a new
- circuit every 15 seconds. Fixes bug 454; reported by lodger.
- o Minor features (controller):
- - Add a PROTOCOLINFO controller command. Like AUTHENTICATE, it
- is valid before any authentication has been received. It tells
- a controller what kind of authentication is expected, and what
- protocol is spoken. Implements proposal 119.
- o Minor bugfixes (performance):
- - Save on most routerlist_assert_ok() calls in routerlist.c, thus
- greatly speeding up loading cached-routers from disk on startup.
- - Disable sentinel-based debugging for buffer code: we squashed all
- the bugs that this was supposed to detect a long time ago, and now
- its only effect is to change our buffer sizes from nice powers of
- two (which platform mallocs tend to like) to values slightly over
- powers of two (which make some platform mallocs sad).
- o Minor bugfixes (misc):
- - If exit bandwidth ever exceeds one third of total bandwidth, then
- use the correct formula to weight exit nodes when choosing paths.
- Based on patch from Mike Perry.
- - Choose perfectly fairly among routers when choosing by bandwidth and
- weighting by fraction of bandwidth provided by exits. Previously, we
- would choose with only approximate fairness, and correct ourselves
- if we ran off the end of the list.
- - If we require CookieAuthentication but we fail to write the
- cookie file, we would warn but not exit, and end up in a state
- where no controller could authenticate. Now we exit.
- - If we require CookieAuthentication, stop generating a new cookie
- every time we change any piece of our config.
- - Refuse to start with certain directory authority keys, and
- encourage people using them to stop.
- - Terminate multi-line control events properly. Original patch
- from tup.
- - Fix a minor memory leak when we fail to find enough suitable
- servers to choose a circuit.
- - Stop leaking part of the descriptor when we run into a particularly
- unparseable piece of it.
- Changes in version 0.2.0.6-alpha - 2007-08-26
- This sixth development snapshot features a new Vidalia version in the
- Windows and OS X bundles. Vidalia 0.0.14 makes authentication required for
- the ControlPort in the default configuration, which addresses important
- security risks.
- In addition, this snapshot fixes major load balancing problems
- with path selection, which should speed things up a lot once many
- people have upgraded. The directory authorities also use a new
- mean-time-between-failure approach to tracking which servers are stable,
- rather than just looking at the most recent uptime.
- o New directory authorities:
- - Set up Tonga as the default bridge directory authority.
- o Major features:
- - Directory authorities now track servers by weighted
- mean-times-between-failures. When we have 4 or more days of data,
- use measured MTBF rather than declared uptime to decide whether
- to call a router Stable. Implements proposal 108.
- o Major bugfixes (load balancing):
- - When choosing nodes for non-guard positions, weight guards
- proportionally less, since they already have enough load. Patch
- from Mike Perry.
- - Raise the "max believable bandwidth" from 1.5MB/s to 10MB/s. This
- will allow fast Tor servers to get more attention.
- - When we're upgrading from an old Tor version, forget our current
- guards and pick new ones according to the new weightings. These
- three load balancing patches could raise effective network capacity
- by a factor of four. Thanks to Mike Perry for measurements.
- o Major bugfixes (descriptor parsing):
- - Handle unexpected whitespace better in malformed descriptors. Bug
- found using Benedikt Boss's new Tor fuzzer! Bugfix on 0.2.0.x.
- o Minor features:
- - There is now an ugly, temporary "desc/all-recent-extrainfo-hack"
- GETINFO for Torstat to use until it can switch to using extrainfos.
- - Optionally (if built with -DEXPORTMALLINFO) export the output
- of mallinfo via http, as tor/mallinfo.txt. Only accessible
- from localhost.
- o Minor bugfixes:
- - Do not intermix bridge routers with controller-added
- routers. (Bugfix on 0.2.0.x)
- - Do not fail with an assert when accept() returns an unexpected
- address family. Addresses but does not wholly fix bug 483. (Bugfix
- on 0.2.0.x)
- - Let directory authorities startup even when they can't generate
- a descriptor immediately, e.g. because they don't know their
- address.
- - Stop putting the authentication cookie in a file called "0"
- in your working directory if you don't specify anything for the
- new CookieAuthFile option. Reported by Matt Edman.
- - Make it possible to read the PROTOCOLINFO response in a way that
- conforms to our control-spec. Reported by Matt Edman.
- - Fix a minor memory leak when we fail to find enough suitable
- servers to choose a circuit. Bugfix on 0.1.2.x.
- - Stop leaking part of the descriptor when we run into a particularly
- unparseable piece of it. Bugfix on 0.1.2.x.
- - Unmap the extrainfo cache file on exit.
- Changes in version 0.2.0.5-alpha - 2007-08-19
- This fifth development snapshot fixes compilation on Windows again;
- fixes an obnoxious client-side bug that slowed things down and put
- extra load on the network; gets us closer to using the v3 directory
- voting scheme; makes it easier for Tor controllers to use cookie-based
- authentication; and fixes a variety of other bugs.
- o Removed features:
- - Version 1 directories are no longer generated in full. Instead,
- authorities generate and serve "stub" v1 directories that list
- no servers. This will stop Tor versions 0.1.0.x and earlier from
- working, but (for security reasons) nobody should be running those
- versions anyway.
- o Major bugfixes (compilation, 0.2.0.x):
- - Try to fix Win32 compilation again: improve checking for IPv6 types.
- - Try to fix MSVC compilation: build correctly on platforms that do
- not define s6_addr16 or s6_addr32.
- - Fix compile on platforms without getaddrinfo: bug found by Li-Hui
- Zhou.
- o Major bugfixes (stream expiration):
- - Expire not-yet-successful application streams in all cases if
- they've been around longer than SocksTimeout. Right now there are
- some cases where the stream will live forever, demanding a new
- circuit every 15 seconds. Bugfix on 0.1.2.7-alpha; fixes bug 454;
- reported by lodger.
- o Minor features (directory servers):
- - When somebody requests a list of statuses or servers, and we have
- none of those, return a 404 rather than an empty 200.
- o Minor features (directory voting):
- - Store v3 consensus status consensuses on disk, and reload them
- on startup.
- o Minor features (security):
- - Warn about unsafe ControlPort configurations.
- - Refuse to start with certain directory authority keys, and
- encourage people using them to stop.
- o Minor features (controller):
- - Add a PROTOCOLINFO controller command. Like AUTHENTICATE, it
- is valid before any authentication has been received. It tells
- a controller what kind of authentication is expected, and what
- protocol is spoken. Implements proposal 119.
- - New config option CookieAuthFile to choose a new location for the
- cookie authentication file, and config option
- CookieAuthFileGroupReadable to make it group-readable.
- o Minor features (unit testing):
- - Add command-line arguments to unit-test executable so that we can
- invoke any chosen test from the command line rather than having
- to run the whole test suite at once; and so that we can turn on
- logging for the unit tests.
- o Minor bugfixes (on 0.1.2.x):
- - If we require CookieAuthentication but we fail to write the
- cookie file, we would warn but not exit, and end up in a state
- where no controller could authenticate. Now we exit.
- - If we require CookieAuthentication, stop generating a new cookie
- every time we change any piece of our config.
- - When loading bandwidth history, do not believe any information in
- the future. Fixes bug 434.
- - When loading entry guard information, do not believe any information
- in the future.
- - When we have our clock set far in the future and generate an
- onion key, then re-set our clock to be correct, we should not stop
- the onion key from getting rotated.
- - Clean up torrc sample config file.
- - Do not automatically run configure from autogen.sh. This
- non-standard behavior tended to annoy people who have built other
- programs.
- o Minor bugfixes (on 0.2.0.x):
- - Fix a bug with AutomapHostsOnResolve that would always cause
- the second request to fail. Bug reported by Kate. Bugfix on
- 0.2.0.3-alpha.
- - Fix a bug in ADDRMAP controller replies that would sometimes
- try to print a NULL. Patch from tup.
- - Read v3 directory authority keys from the right location.
- - Numerous bugfixes to directory voting code.
- Changes in version 0.1.2.16 - 2007-08-01
- Tor 0.1.2.16 fixes a critical security vulnerability that allows a
- remote attacker in certain situations to rewrite the user's torrc
- configuration file. This can completely compromise anonymity of users
- in most configurations, including those running the Vidalia bundles,
- TorK, etc. Or worse.
- o Major security fixes:
- - Close immediately after missing authentication on control port;
- do not allow multiple authentication attempts.
- Changes in version 0.2.0.4-alpha - 2007-08-01
- This fourth development snapshot fixes a critical security vulnerability
- for most users, specifically those running Vidalia, TorK, etc. Everybody
- should upgrade to either 0.1.2.16 or 0.2.0.4-alpha.
- o Major security fixes:
- - Close immediately after missing authentication on control port;
- do not allow multiple authentication attempts.
- o Major bugfixes (compilation):
- - Fix win32 compilation: apparently IN_ADDR and IN6_ADDR are already
- defined there.
- o Minor features (performance):
- - Be even more aggressive about releasing RAM from small
- empty buffers. Thanks to our free-list code, this shouldn't be too
- performance-intensive.
- - Disable sentinel-based debugging for buffer code: we squashed all
- the bugs that this was supposed to detect a long time ago, and
- now its only effect is to change our buffer sizes from nice
- powers of two (which platform mallocs tend to like) to values
- slightly over powers of two (which make some platform mallocs sad).
- - Log malloc statistics from mallinfo() on platforms where it
- exists.
- Changes in version 0.2.0.3-alpha - 2007-07-29
- This third development snapshot introduces new experimental
- blocking-resistance features and a preliminary version of the v3
- directory voting design, and includes many other smaller features
- and bugfixes.
- o Major features:
- - The first pieces of our "bridge" design for blocking-resistance
- are implemented. People can run bridge directory authorities;
- people can run bridges; and people can configure their Tor clients
- with a set of bridges to use as the first hop into the Tor network.
- See http://archives.seul.org/or/talk/Jul-2007/msg00249.html for
- details.
- - Create listener connections before we setuid to the configured
- User and Group. Now non-Windows users can choose port values
- under 1024, start Tor as root, and have Tor bind those ports
- before it changes to another UID. (Windows users could already
- pick these ports.)
- - Added a new ConstrainedSockets config option to set SO_SNDBUF and
- SO_RCVBUF on TCP sockets. Hopefully useful for Tor servers running
- on "vserver" accounts. (Patch from coderman.)
- - Be even more aggressive about separating local traffic from relayed
- traffic when RelayBandwidthRate is set. (Refines proposal 111.)
- o Major features (experimental):
- - First cut of code for "v3 dir voting": directory authorities will
- vote on a common network status document rather than each publishing
- their own opinion. This code needs more testing and more corner-case
- handling before it's ready for use.
- o Security fixes:
- - Directory authorities now call routers Fast if their bandwidth is
- at least 100KB/s, and consider their bandwidth adequate to be a
- Guard if it is at least 250KB/s, no matter the medians. This fix
- complements proposal 107. [Bugfix on 0.1.2.x]
- - Directory authorities now never mark more than 3 servers per IP as
- Valid and Running. (Implements proposal 109, by Kevin Bauer and
- Damon McCoy.)
- - Minor change to organizationName and commonName generation
- procedures in TLS certificates during Tor handshakes, to invalidate
- some earlier censorware approaches. This is not a long-term
- solution, but applying it will give us a bit of time to look into
- the epidemiology of countermeasures as they spread.
- o Major bugfixes (directory):
- - Rewrite directory tokenization code to never run off the end of
- a string. Fixes bug 455. Patch from croup. [Bugfix on 0.1.2.x]
- o Minor features (controller):
- - Add a SOURCE_ADDR field to STREAM NEW events so that controllers can
- match requests to applications. (Patch from Robert Hogan.)
- - Report address and port correctly on connections to DNSPort. (Patch
- from Robert Hogan.)
- - Add a RESOLVE command to launch hostname lookups. (Original patch
- from Robert Hogan.)
- - Add GETINFO status/enough-dir-info to let controllers tell whether
- Tor has downloaded sufficient directory information. (Patch
- from Tup.)
- - You can now use the ControlSocket option to tell Tor to listen for
- controller connections on Unix domain sockets on systems that
- support them. (Patch from Peter Palfrader.)
- - STREAM NEW events are generated for DNSPort requests and for
- tunneled directory connections. (Patch from Robert Hogan.)
- - New "GETINFO address-mappings/*" command to get address mappings
- with expiry information. "addr-mappings/*" is now deprecated.
- (Patch from Tup.)
- o Minor features (misc):
- - Merge in some (as-yet-unused) IPv6 address manipulation code. (Patch
- from croup.)
- - The tor-gencert tool for v3 directory authorities now creates all
- files as readable to the file creator only, and write-protects
- the authority identity key.
- - When dumping memory usage, list bytes used in buffer memory
- free-lists.
- - When running with dmalloc, dump more stats on hup and on exit.
- - Directory authorities now fail quickly and (relatively) harmlessly
- if they generate a network status document that is somehow
- malformed.
- o Traffic load balancing improvements:
- - If exit bandwidth ever exceeds one third of total bandwidth, then
- use the correct formula to weight exit nodes when choosing paths.
- (Based on patch from Mike Perry.)
- - Choose perfectly fairly among routers when choosing by bandwidth and
- weighting by fraction of bandwidth provided by exits. Previously, we
- would choose with only approximate fairness, and correct ourselves
- if we ran off the end of the list. [Bugfix on 0.1.2.x]
- o Performance improvements:
- - Be more aggressive with freeing buffer RAM or putting it on the
- memory free lists.
- - Use Critical Sections rather than Mutexes for synchronizing threads
- on win32; Mutexes are heavier-weight, and designed for synchronizing
- between processes.
- o Deprecated and removed features:
- - RedirectExits is now deprecated.
- - Stop allowing address masks that do not correspond to bit prefixes.
- We have warned about these for a really long time; now it's time
- to reject them. (Patch from croup.)
- o Minor bugfixes (directory):
- - Fix another crash bug related to extra-info caching. (Bug found by
- Peter Palfrader.) [Bugfix on 0.2.0.2-alpha]
- - Directories no longer return a "304 not modified" when they don't
- have the networkstatus the client asked for. Also fix a memory
- leak when returning 304 not modified. [Bugfixes on 0.2.0.2-alpha]
- - We had accidentally labelled 0.1.2.x directory servers as not
- suitable for begin_dir requests, and had labelled no directory
- servers as suitable for uploading extra-info documents. [Bugfix
- on 0.2.0.1-alpha]
- o Minor bugfixes (dns):
- - Fix a crash when DNSPort is set more than once. (Patch from Robert
- Hogan.) [Bugfix on 0.2.0.2-alpha]
- - Add DNSPort connections to the global connection list, so that we
- can time them out correctly. (Bug found by Robert Hogan.) [Bugfix
- on 0.2.0.2-alpha]
- - Fix a dangling reference that could lead to a crash when DNSPort is
- changed or closed (Patch from Robert Hogan.) [Bugfix on
- 0.2.0.2-alpha]
- o Minor bugfixes (controller):
- - Provide DNS expiry times in GMT, not in local time. For backward
- compatibility, ADDRMAP events only provide GMT expiry in an extended
- field. "GETINFO address-mappings" always does the right thing.
- - Use CRLF line endings properly in NS events.
- - Terminate multi-line control events properly. (Original patch
- from tup.) [Bugfix on 0.1.2.x-alpha]
- - Do not include spaces in SOURCE_ADDR fields in STREAM
- events. Resolves bug 472. [Bugfix on 0.2.0.x-alpha]
- Changes in version 0.1.2.15 - 2007-07-17
- Tor 0.1.2.15 fixes several crash bugs, fixes some anonymity-related
- problems, fixes compilation on BSD, and fixes a variety of other
- bugs. Everybody should upgrade.
- o Major bugfixes (compilation):
- - Fix compile on FreeBSD/NetBSD/OpenBSD. Oops.
- o Major bugfixes (crashes):
- - Try even harder not to dereference the first character after
- an mmap(). Reported by lodger.
- - Fix a crash bug in directory authorities when we re-number the
- routerlist while inserting a new router.
- - When the cached-routers file is an even multiple of the page size,
- don't run off the end and crash. (Fixes bug 455; based on idea
- from croup.)
- - Fix eventdns.c behavior on Solaris: It is critical to include
- orconfig.h _before_ sys/types.h, so that we can get the expected
- definition of _FILE_OFFSET_BITS.
- o Major bugfixes (security):
- - Fix a possible buffer overrun when using BSD natd support. Bug
- found by croup.
- - When sending destroy cells from a circuit's origin, don't include
- the reason for tearing down the circuit. The spec says we didn't,
- and now we actually don't. Reported by lodger.
- - Keep streamids from different exits on a circuit separate. This
- bug may have allowed other routers on a given circuit to inject
- cells into streams. Reported by lodger; fixes bug 446.
- - If there's a never-before-connected-to guard node in our list,
- never choose any guards past it. This way we don't expand our
- guard list unless we need to.
- o Minor bugfixes (guard nodes):
- - Weight guard selection by bandwidth, so that low-bandwidth nodes
- don't get overused as guards.
- o Minor bugfixes (directory):
- - Correctly count the number of authorities that recommend each
- version. Previously, we were under-counting by 1.
- - Fix a potential crash bug when we load many server descriptors at
- once and some of them make others of them obsolete. Fixes bug 458.
- o Minor bugfixes (hidden services):
- - Stop tearing down the whole circuit when the user asks for a
- connection to a port that the hidden service didn't configure.
- Resolves bug 444.
- o Minor bugfixes (misc):
- - On Windows, we were preventing other processes from reading
- cached-routers while Tor was running. Reported by janbar.
- - Fix a possible (but very unlikely) bug in picking routers by
- bandwidth. Add a log message to confirm that it is in fact
- unlikely. Patch from lodger.
- - Backport a couple of memory leak fixes.
- - Backport miscellaneous cosmetic bugfixes.
- Changes in version 0.2.0.2-alpha - 2007-06-02
- o Major bugfixes on 0.2.0.1-alpha:
- - Fix an assertion failure related to servers without extra-info digests.
- Resolves bugs 441 and 442.
- o Minor features (directory):
- - Support "If-Modified-Since" when answering HTTP requests for
- directories, running-routers documents, and network-status documents.
- (There's no need to support it for router descriptors, since those
- are downloaded by descriptor digest.)
- o Minor build issues:
- - Clear up some MIPSPro compiler warnings.
- - When building from a tarball on a machine that happens to have SVK
- installed, report the micro-revision as whatever version existed
- in the tarball, not as "x".
- Changes in version 0.2.0.1-alpha - 2007-06-01
- This early development snapshot provides new features for people running
- Tor as both a client and a server (check out the new RelayBandwidth
- config options); lets Tor run as a DNS proxy; and generally moves us
- forward on a lot of fronts.
- o Major features, server usability:
- - New config options RelayBandwidthRate and RelayBandwidthBurst:
- a separate set of token buckets for relayed traffic. Right now
- relayed traffic is defined as answers to directory requests, and
- OR connections that don't have any local circuits on them.
- o Major features, client usability:
- - A client-side DNS proxy feature to replace the need for
- dns-proxy-tor: Just set "DNSPort 9999", and Tor will now listen
- for DNS requests on port 9999, use the Tor network to resolve them
- anonymously, and send the reply back like a regular DNS server.
- The code still only implements a subset of DNS.
- - Make PreferTunneledDirConns and TunnelDirConns work even when
- we have no cached directory info. This means Tor clients can now
- do all of their connections protected by TLS.
- o Major features, performance and efficiency:
- - Directory authorities accept and serve "extra info" documents for
- routers. These documents contain fields from router descriptors
- that aren't usually needed, and that use a lot of excess
- bandwidth. Once these fields are removed from router descriptors,
- the bandwidth savings should be about 60%. [Partially implements
- proposal 104.]
- - Servers upload extra-info documents to any authority that accepts
- them. Authorities (and caches that have been configured to download
- extra-info documents) download them as needed. [Partially implements
- proposal 104.]
- - Change the way that Tor buffers data that it is waiting to write.
- Instead of queueing data cells in an enormous ring buffer for each
- client->OR or OR->OR connection, we now queue cells on a separate
- queue for each circuit. This lets us use less slack memory, and
- will eventually let us be smarter about prioritizing different kinds
- of traffic.
- - Use memory pools to allocate cells with better speed and memory
- efficiency, especially on platforms where malloc() is inefficient.
- - Stop reading on edge connections when their corresponding circuit
- buffers are full; start again as the circuits empty out.
- o Major features, other:
- - Add an HSAuthorityRecordStats option that hidden service authorities
- can use to track statistics of overall hidden service usage without
- logging information that would be very useful to an attacker.
- - Start work implementing multi-level keys for directory authorities:
- Add a standalone tool to generate key certificates. (Proposal 103.)
- o Security fixes:
- - Directory authorities now call routers Stable if they have an
- uptime of at least 30 days, even if that's not the median uptime
- in the network. Implements proposal 107, suggested by Kevin Bauer
- and Damon McCoy.
- o Minor fixes (resource management):
- - Count the number of open sockets separately from the number
- of active connection_t objects. This will let us avoid underusing
- our allocated connection limit.
- - We no longer use socket pairs to link an edge connection to an
- anonymous directory connection or a DirPort test connection.
- Instead, we track the link internally and transfer the data
- in-process. This saves two sockets per "linked" connection (at the
- client and at the server), and avoids the nasty Windows socketpair()
- workaround.
- - Keep unused 4k and 16k buffers on free lists, rather than wasting 8k
- for every single inactive connection_t. Free items from the
- 4k/16k-buffer free lists when they haven't been used for a while.
- o Minor features (build):
- - Make autoconf search for libevent, openssl, and zlib consistently.
- - Update deprecated macros in configure.in.
- - When warning about missing headers, tell the user to let us
- know if the compile succeeds anyway, so we can downgrade the
- warning.
- - Include the current subversion revision as part of the version
- string: either fetch it directly if we're in an SVN checkout, do
- some magic to guess it if we're in an SVK checkout, or use
- the last-detected version if we're building from a .tar.gz.
- Use this version consistently in log messages.
- o Minor features (logging):
- - Always prepend "Bug: " to any log message about a bug.
- - Put a platform string (e.g. "Linux i686") in the startup log
- message, so when people paste just their logs, we know if it's
- OpenBSD or Windows or what.
- - When logging memory usage, break down memory used in buffers by
- buffer type.
- o Minor features (directory system):
- - New config option V2AuthoritativeDirectory that all directory
- authorities should set. This will let future authorities choose
- not to serve V2 directory information.
- - Directory authorities allow multiple router descriptors and/or extra
- info documents to be uploaded in a single go. This will make
- implementing proposal 104 simpler.
- o Minor features (controller):
- - Add a new config option __DisablePredictedCircuits designed for
- use by the controller, when we don't want Tor to build any circuits
- preemptively.
- - Let the controller specify HOP=%d as an argument to ATTACHSTREAM,
- so we can exit from the middle of the circuit.
- - Implement "getinfo status/circuit-established".
- - Implement "getinfo status/version/..." so a controller can tell
- whether the current version is recommended, and whether any versions
- are good, and how many authorities agree. (Patch from shibz.)
- o Minor features (hidden services):
- - Allow multiple HiddenServicePort directives with the same virtual
- port; when they occur, the user is sent round-robin to one
- of the target ports chosen at random. Partially fixes bug 393 by
- adding limited ad-hoc round-robining.
- o Minor features (other):
- - More unit tests.
- - Add a new AutomapHostsOnResolve option: when it is enabled, any
- resolve request for hosts matching a given pattern causes Tor to
- generate an internal virtual address mapping for that host. This
- allows DNSPort to work sensibly with hidden service users. By
- default, .exit and .onion addresses are remapped; the list of
- patterns can be reconfigured with AutomapHostsSuffixes.
- - Add an "-F" option to tor-resolve to force a resolve for a .onion
- address. Thanks to the AutomapHostsOnResolve option, this is no
- longer a completely silly thing to do.
- - If Tor is invoked from something that isn't a shell (e.g. Vidalia),
- now we expand "-f ~/.tor/torrc" correctly. Suggested by Matt Edman.
- - Treat "2gb" when given in torrc for a bandwidth as meaning 2gb,
- minus 1 byte: the actual maximum declared bandwidth.
- o Removed features:
- - Removed support for the old binary "version 0" controller protocol.
- This has been deprecated since 0.1.1, and warnings have been issued
- since 0.1.2. When we encounter a v0 control message, we now send
- back an error and close the connection.
- - Remove the old "dns worker" server DNS code: it hasn't been default
- since 0.1.2.2-alpha, and all the servers seem to be using the new
- eventdns code.
- o Minor bugfixes (portability):
- - Even though Windows is equally happy with / and \ as path separators,
- try to use \ consistently on Windows and / consistently on Unix: it
- makes the log messages nicer.
- - Correctly report platform name on Windows 95 OSR2 and Windows 98 SE.
- - Read resolv.conf files correctly on platforms where read() returns
- partial results on small file reads.
- o Minor bugfixes (directory):
- - Correctly enforce that elements of directory objects do not appear
- more often than they are allowed to appear.
- - When we are reporting the DirServer line we just parsed, we were
- logging the second stanza of the key fingerprint, not the first.
- o Minor bugfixes (logging):
- - When we hit an EOF on a log (probably because we're shutting down),
- don't try to remove the log from the list: just mark it as
- unusable. (Bulletproofs against bug 222.)
- o Minor bugfixes (other):
- - In the exitlist script, only consider the most recently published
- server descriptor for each server. Also, when the user requests
- a list of servers that _reject_ connections to a given address,
- explicitly exclude the IPs that also have servers that accept
- connections to that address. (Resolves bug 405.)
- - Stop allowing hibernating servers to be "stable" or "fast".
- - On Windows, we were preventing other processes from reading
- cached-routers while Tor was running. (Reported by janbar)
- - Make the NodeFamilies config option work. (Reported by
- lodger -- it has never actually worked, even though we added it
- in Oct 2004.)
- - Check return values from pthread_mutex functions.
- - Don't save non-general-purpose router descriptors to the disk cache,
- because we have no way of remembering what their purpose was when
- we restart.
- - Add even more asserts to hunt down bug 417.
- - Build without verbose warnings even on (not-yet-released) gcc 4.2.
- - Fix a possible (but very unlikely) bug in picking routers by bandwidth.
- Add a log message to confirm that it is in fact unlikely.
- o Minor bugfixes (controller):
- - Make 'getinfo fingerprint' return a 551 error if we're not a
- server, so we match what the control spec claims we do. Reported
- by daejees.
- - Fix a typo in an error message when extendcircuit fails that
- caused us to not follow the \r\n-based delimiter protocol. Reported
- by daejees.
- o Code simplifications and refactoring:
- - Stop passing around circuit_t and crypt_path_t pointers that are
- implicit in other procedure arguments.
- - Drop the old code to choke directory connections when the
- corresponding OR connections got full: thanks to the cell queue
- feature, OR conns don't get full any more.
- - Make dns_resolve() handle attaching connections to circuits
- properly, so the caller doesn't have to.
- - Rename wants_to_read and wants_to_write to read/write_blocked_on_bw.
- - Keep the connection array as a dynamic smartlist_t, rather than as
- a fixed-sized array. This is important, as the number of connections
- is becoming increasingly decoupled from the number of sockets.
- Changes in version 0.1.2.14 - 2007-05-25
- Tor 0.1.2.14 changes the addresses of two directory authorities (this
- change especially affects those who serve or use hidden services),
- and fixes several other crash- and security-related bugs.
- o Directory authority changes:
- - Two directory authorities (moria1 and moria2) just moved to new
- IP addresses. This change will particularly affect those who serve
- or use hidden services.
- o Major bugfixes (crashes):
- - If a directory server runs out of space in the connection table
- as it's processing a begin_dir request, it will free the exit stream
- but leave it attached to the circuit, leading to unpredictable
- behavior. (Reported by seeess, fixes bug 425.)
- - Fix a bug in dirserv_remove_invalid() that would cause authorities
- to corrupt memory under some really unlikely scenarios.
- - Tighten router parsing rules. (Bugs reported by Benedikt Boss.)
- - Avoid segfaults when reading from mmaped descriptor file. (Reported
- by lodger.)
- o Major bugfixes (security):
- - When choosing an entry guard for a circuit, avoid using guards
- that are in the same family as the chosen exit -- not just guards
- that are exactly the chosen exit. (Reported by lodger.)
- o Major bugfixes (resource management):
- - If a directory authority is down, skip it when deciding where to get
- networkstatus objects or descriptors. Otherwise we keep asking
- every 10 seconds forever. Fixes bug 384.
- - Count it as a failure if we fetch a valid network-status but we
- don't want to keep it. Otherwise we'll keep fetching it and keep
- not wanting to keep it. Fixes part of bug 422.
- - If all of our dirservers have given us bad or no networkstatuses
- lately, then stop hammering them once per minute even when we
- think they're failed. Fixes another part of bug 422.
- o Minor bugfixes:
- - Actually set the purpose correctly for descriptors inserted with
- purpose=controller.
- - When we have k non-v2 authorities in our DirServer config,
- we ignored the last k authorities in the list when updating our
- network-statuses.
- - Correctly back-off from requesting router descriptors that we are
- having a hard time downloading.
- - Read resolv.conf files correctly on platforms where read() returns
- partial results on small file reads.
- - Don't rebuild the entire router store every time we get 32K of
- routers: rebuild it when the journal gets very large, or when
- the gaps in the store get very large.
- o Minor features:
- - When routers publish SVN revisions in their router descriptors,
- authorities now include those versions correctly in networkstatus
- documents.
- - Warn when using a version of libevent before 1.3b to run a server on
- OSX or BSD: these versions interact badly with userspace threads.
- Changes in version 0.1.2.13 - 2007-04-24
- This release features some major anonymity fixes, such as safer path
- selection; better client performance; faster bootstrapping, better
- address detection, and better DNS support for servers; write limiting as
- well as read limiting to make servers easier to run; and a huge pile of
- other features and bug fixes. The bundles also ship with Vidalia 0.0.11.
- Tor 0.1.2.13 is released in memory of Rob Levin (1955-2006), aka lilo
- of the Freenode IRC network, remembering his patience and vision for
- free speech on the Internet.
- o Minor fixes:
- - Fix a memory leak when we ask for "all" networkstatuses and we
- get one we don't recognize.
- - Add more asserts to hunt down bug 417.
- - Disable kqueue on OS X 10.3 and earlier, to fix bug 371.
- Changes in version 0.1.2.12-rc - 2007-03-16
- o Major bugfixes:
- - Fix an infinite loop introduced in 0.1.2.7-alpha when we serve
- directory information requested inside Tor connections (i.e. via
- begin_dir cells). It only triggered when the same connection was
- serving other data at the same time. Reported by seeess.
- o Minor bugfixes:
- - When creating a circuit via the controller, send a 'launched'
- event when we're done, so we follow the spec better.
- Changes in version 0.1.2.11-rc - 2007-03-15
- o Minor bugfixes (controller), reported by daejees:
- - Correct the control spec to match how the code actually responds
- to 'getinfo addr-mappings/*'.
- - The control spec described a GUARDS event, but the code
- implemented a GUARD event. Standardize on GUARD, but let people
- ask for GUARDS too.
- Changes in version 0.1.2.10-rc - 2007-03-07
- o Major bugfixes (Windows):
- - Do not load the NT services library functions (which may not exist)
- just to detect if we're a service trying to shut down. Now we run
- on Win98 and friends again.
- o Minor bugfixes (other):
- - Clarify a couple of log messages.
- - Fix a misleading socks5 error number.
- Changes in version 0.1.2.9-rc - 2007-03-02
- o Major bugfixes (Windows):
- - On MinGW, use "%I64u" to printf/scanf 64-bit integers, instead
- of the usual GCC "%llu". This prevents a bug when saving 64-bit
- int configuration values: the high-order 32 bits would get
- truncated. In particular, we were being bitten by the default
- MaxAdvertisedBandwidth of 128 TB turning into 0. (Fixes bug 400
- and maybe also bug 397.)
- o Minor bugfixes (performance):
- - Use OpenSSL's AES implementation on platforms where it's faster.
- This could save us as much as 10% CPU usage.
- o Minor bugfixes (server):
- - Do not rotate onion key immediately after setting it for the first
- time.
- o Minor bugfixes (directory authorities):
- - Stop calling servers that have been hibernating for a long time
- "stable". Also, stop letting hibernating or obsolete servers affect
- uptime and bandwidth cutoffs.
- - Stop listing hibernating servers in the v1 directory.
- o Minor bugfixes (hidden services):
- - Upload hidden service descriptors slightly less often, to reduce
- load on authorities.
- o Minor bugfixes (other):
- - Fix an assert that could trigger if a controller quickly set then
- cleared EntryNodes. Bug found by Udo van den Heuvel.
- - On architectures where sizeof(int)>4, still clamp declarable bandwidth
- to INT32_MAX.
- - Fix a potential race condition in the rpm installer. Found by
- Stefan Nordhausen.
- - Try to fix eventdns warnings once and for all: do not treat a dns rcode
- of 2 as indicating that the server is completely bad; it sometimes
- means that the server is just bad for the request in question. (may fix
- the last of bug 326.)
- - Disable encrypted directory connections when we don't have a server
- descriptor for the destination. We'll get this working again in
- the 0.2.0 branch.
- Changes in version 0.1.2.8-beta - 2007-02-26
- o Major bugfixes (crashes):
- - Stop crashing when the controller asks us to resetconf more than
- one config option at once. (Vidalia 0.0.11 does this.)
- - Fix a crash that happened on Win98 when we're given command-line
- arguments: don't try to load NT service functions from advapi32.dll
- except when we need them. (Bug introduced in 0.1.2.7-alpha;
- resolves bug 389.)
- - Fix a longstanding obscure crash bug that could occur when
- we run out of DNS worker processes. (Resolves bug 390.)
- o Major bugfixes (hidden services):
- - Correctly detect whether hidden service descriptor downloads are
- in-progress. (Suggested by Karsten Loesing; fixes bug 399.)
- o Major bugfixes (accounting):
- - When we start during an accounting interval before it's time to wake
- up, remember to wake up at the correct time. (May fix bug 342.)
- o Minor bugfixes (controller):
- - Give the controller END_STREAM_REASON_DESTROY events _before_ we
- clear the corresponding on_circuit variable, and remember later
- that we don't need to send a redundant CLOSED event. Resolves part
- 3 of bug 367.
- - Report events where a resolve succeeded or where we got a socks
- protocol error correctly, rather than calling both of them
- "INTERNAL".
- - Change reported stream target addresses to IP consistently when
- we finally get the IP from an exit node.
- - Send log messages to the controller even if they happen to be very
- long.
- o Minor bugfixes (other):
- - Display correct results when reporting which versions are
- recommended, and how recommended they are. (Resolves bug 383.)
- - Improve our estimates for directory bandwidth to be less random:
- guess that an unrecognized directory will have the average bandwidth
- from all known directories, not that it will have the average
- bandwidth from those directories earlier than it on the list.
- - If we start a server with ClientOnly 1, then set ClientOnly to 0
- and hup, stop triggering an assert based on an empty onion_key.
- - On platforms with no working mmap() equivalent, don't warn the
- user when cached-routers doesn't exist.
- - Warn the user when mmap() [or its equivalent] fails for some reason
- other than file-not-found.
- - Don't warn the user when cached-routers.new doesn't exist: that's
- perfectly fine when starting up for the first time.
- - When EntryNodes are configured, rebuild the guard list to contain,
- in order: the EntryNodes that were guards before; the rest of the
- EntryNodes; the nodes that were guards before.
- - Mask out all signals in sub-threads; only the libevent signal
- handler should be processing them. This should prevent some crashes
- on some machines using pthreads. (Patch from coderman.)
- - Fix switched arguments on memset in the implementation of
- tor_munmap() for systems with no mmap() call.
- - When Tor receives a router descriptor that it asked for, but
- no longer wants (because it has received fresh networkstatuses
- in the meantime), do not warn the user. Cache the descriptor if
- we're a cache; drop it if we aren't.
- - Make earlier entry guards _really_ get retried when the network
- comes back online.
- - On a malformed DNS reply, always give an error to the corresponding
- DNS request.
- - Build with recent libevents on platforms that do not define the
- nonstandard types "u_int8_t" and friends.
- o Minor features (controller):
- - Warn the user when an application uses the obsolete binary v0
- control protocol. We're planning to remove support for it during
- the next development series, so it's good to give people some
- advance warning.
- - Add STREAM_BW events to report per-entry-stream bandwidth
- use. (Patch from Robert Hogan.)
- - Rate-limit SIGNEWNYM signals in response to controllers that
- impolitely generate them for every single stream. (Patch from
- mwenge; closes bug 394.)
- - Make REMAP stream events have a SOURCE (cache or exit), and
- make them generated in every case where we get a successful
- connected or resolved cell.
- o Minor bugfixes (performance):
- - Call router_have_min_dir_info half as often. (This is showing up in
- some profiles, but not others.)
- - When using GCC, make log_debug never get called at all, and its
- arguments never get evaluated, when no debug logs are configured.
- (This is showing up in some profiles, but not others.)
- o Minor features:
- - Remove some never-implemented options. Mark PathlenCoinWeight as
- obsolete.
- - Implement proposal 106: Stop requiring clients to have well-formed
- certificates; stop checking nicknames in certificates. (Clients
- have certificates so that they can look like Tor servers, but in
- the future we might want to allow them to look like regular TLS
- clients instead. Nicknames in certificates serve no purpose other
- than making our protocol easier to recognize on the wire.)
- - Revise messages on handshake failure again to be even more clear about
- which are incoming connections and which are outgoing.
- - Discard any v1 directory info that's over 1 month old (for
- directories) or over 1 week old (for running-routers lists).
- - Do not warn when individual nodes in the configuration's EntryNodes,
- ExitNodes, etc are down: warn only when all possible nodes
- are down. (Fixes bug 348.)
- - Always remove expired routers and networkstatus docs before checking
- whether we have enough information to build circuits. (Fixes
- bug 373.)
- - Put a lower-bound on MaxAdvertisedBandwidth.
- Changes in version 0.1.2.7-alpha - 2007-02-06
- o Major bugfixes (rate limiting):
- - Servers decline directory requests much more aggressively when
- they're low on bandwidth. Otherwise they end up queueing more and
- more directory responses, which can't be good for latency.
- - But never refuse directory requests from local addresses.
- - Fix a memory leak when sending a 503 response for a networkstatus
- request.
- - Be willing to read or write on local connections (e.g. controller
- connections) even when the global rate limiting buckets are empty.
- - If our system clock jumps back in time, don't publish a negative
- uptime in the descriptor. Also, don't let the global rate limiting
- buckets go absurdly negative.
- - Flush local controller connection buffers periodically as we're
- writing to them, so we avoid queueing 4+ megabytes of data before
- trying to flush.
- o Major bugfixes (NT services):
- - Install as NT_AUTHORITY\LocalService rather than as SYSTEM; add a
- command-line flag so that admins can override the default by saying
- "tor --service install --user "SomeUser"". This will not affect
- existing installed services. Also, warn the user that the service
- will look for its configuration file in the service user's
- %appdata% directory. (We can't do the 'hardwire the user's appdata
- directory' trick any more, since we may not have read access to that
- directory.)
- o Major bugfixes (other):
- - Previously, we would cache up to 16 old networkstatus documents
- indefinitely, if they came from nontrusted authorities. Now we
- discard them if they are more than 10 days old.
- - Fix a crash bug in the presence of DNS hijacking (reported by Andrew
- Del Vecchio).
- - Detect and reject malformed DNS responses containing circular
- pointer loops.
- - If exits are rare enough that we're not marking exits as guards,
- ignore exit bandwidth when we're deciding the required bandwidth
- to become a guard.
- - When we're handling a directory connection tunneled over Tor,
- don't fill up internal memory buffers with all the data we want
- to tunnel; instead, only add it if the OR connection that will
- eventually receive it has some room for it. (This can lead to
- slowdowns in tunneled dir connections; a better solution will have
- to wait for 0.2.0.)
- o Minor bugfixes (dns):
- - Add some defensive programming to eventdns.c in an attempt to catch
- possible memory-stomping bugs.
- - Detect and reject DNS replies containing IPv4 or IPv6 records with
- an incorrect number of bytes. (Previously, we would ignore the
- extra bytes.)
- - Fix as-yet-unused reverse IPv6 lookup code so it sends nybbles
- in the correct order, and doesn't crash.
- - Free memory held in recently-completed DNS lookup attempts on exit.
- This was not a memory leak, but may have been hiding memory leaks.
- - Handle TTL values correctly on reverse DNS lookups.
- - Treat failure to parse resolv.conf as an error.
- o Minor bugfixes (other):
- - Fix crash with "tor --list-fingerprint" (reported by seeess).
- - When computing clock skew from directory HTTP headers, consider what
- time it was when we finished asking for the directory, not what
- time it is now.
- - Expire socks connections if they spend too long waiting for the
- handshake to finish. Previously we would let them sit around for
- days, if the connecting application didn't close them either.
- - And if the socks handshake hasn't started, don't send a
- "DNS resolve socks failed" handshake reply; just close it.
- - Stop using C functions that OpenBSD's linker doesn't like.
- - Don't launch requests for descriptors unless we have networkstatuses
- from at least half of the authorities. This delays the first
- download slightly under pathological circumstances, but can prevent
- us from downloading a bunch of descriptors we don't need.
- - Do not log IPs with TLS failures for incoming TLS
- connections. (Fixes bug 382.)
- - If the user asks to use invalid exit nodes, be willing to use
- unstable ones.
- - Stop using the reserved ac_cv namespace in our configure script.
- - Call stat() slightly less often; use fstat() when possible.
- - Refactor the way we handle pending circuits when an OR connection
- completes or fails, in an attempt to fix a rare crash bug.
- - Only rewrite a conn's address based on X-Forwarded-For: headers
- if it's a parseable public IP address; and stop adding extra quotes
- to the resulting address.
- o Major features:
- - Weight directory requests by advertised bandwidth. Now we can
- let servers enable write limiting but still allow most clients to
- succeed at their directory requests. (We still ignore weights when
- choosing a directory authority; I hope this is a feature.)
- o Minor features:
- - Create a new file ReleaseNotes which was the old ChangeLog. The
- new ChangeLog file now includes the summaries for all development
- versions too.
- - Check for addresses with invalid characters at the exit as well
- as at the client, and warn less verbosely when they fail. You can
- override this by setting ServerDNSAllowNonRFC953Addresses to 1.
- - Adapt a patch from goodell to let the contrib/exitlist script
- take arguments rather than require direct editing.
- - Inform the server operator when we decide not to advertise a
- DirPort due to AccountingMax enabled or a low BandwidthRate. It
- was confusing Zax, so now we're hopefully more helpful.
- - Bring us one step closer to being able to establish an encrypted
- directory tunnel without knowing a descriptor first. Still not
- ready yet. As part of the change, now assume we can use a
- create_fast cell if we don't know anything about a router.
- - Allow exit nodes to use nameservers running on ports other than 53.
- - Servers now cache reverse DNS replies.
- - Add an --ignore-missing-torrc command-line option so that we can
- get the "use sensible defaults if the configuration file doesn't
- exist" behavior even when specifying a torrc location on the command
- line.
- o Minor features (controller):
- - Track reasons for OR connection failure; make these reasons
- available via the controller interface. (Patch from Mike Perry.)
- - Add a SOCKS_BAD_HOSTNAME client status event so controllers
- can learn when clients are sending malformed hostnames to Tor.
- - Clean up documentation for controller status events.
- - Add a REMAP status to stream events to note that a stream's
- address has changed because of a cached address or a MapAddress
- directive.
- Changes in version 0.1.2.6-alpha - 2007-01-09
- o Major bugfixes:
- - Fix an assert error introduced in 0.1.2.5-alpha: if a single TLS
- connection handles more than 4 gigs in either direction, we crash.
- - Fix an assert error introduced in 0.1.2.5-alpha: if we're an
- advertised exit node, somebody might try to exit from us when
- we're bootstrapping and before we've built our descriptor yet.
- Refuse the connection rather than crashing.
- o Minor bugfixes:
- - Warn if we (as a server) find that we've resolved an address that we
- weren't planning to resolve.
- - Warn that using select() on any libevent version before 1.1 will be
- unnecessarily slow (even for select()).
- - Flush ERR-level controller status events just like we currently
- flush ERR-level log events, so that a Tor shutdown doesn't prevent
- the controller from learning about current events.
- o Minor features (more controller status events):
- - Implement EXTERNAL_ADDRESS server status event so controllers can
- learn when our address changes.
- - Implement BAD_SERVER_DESCRIPTOR server status event so controllers
- can learn when directories reject our descriptor.
- - Implement SOCKS_UNKNOWN_PROTOCOL client status event so controllers
- can learn when a client application is speaking a non-socks protocol
- to our SocksPort.
- - Implement DANGEROUS_SOCKS client status event so controllers
- can learn when a client application is leaking DNS addresses.
- - Implement BUG general status event so controllers can learn when
- Tor is unhappy about its internal invariants.
- - Implement CLOCK_SKEW general status event so controllers can learn
- when Tor thinks the system clock is set incorrectly.
- - Implement GOOD_SERVER_DESCRIPTOR and ACCEPTED_SERVER_DESCRIPTOR
- server status events so controllers can learn when their descriptors
- are accepted by a directory.
- - Implement CHECKING_REACHABILITY and REACHABILITY_{SUCCEEDED|FAILED}
- server status events so controllers can learn about Tor's progress in
- deciding whether it's reachable from the outside.
- - Implement BAD_LIBEVENT general status event so controllers can learn
- when we have a version/method combination in libevent that needs to
- be changed.
- - Implement NAMESERVER_STATUS, NAMESERVER_ALL_DOWN, DNS_HIJACKED,
- and DNS_USELESS server status events so controllers can learn
- about changes to DNS server status.
- o Minor features (directory):
- - Authorities no longer recommend exits as guards if this would shift
- too much load to the exit nodes.
- Changes in version 0.1.2.5-alpha - 2007-01-06
- o Major features:
- - Enable write limiting as well as read limiting. Now we sacrifice
- capacity if we're pushing out lots of directory traffic, rather
- than overrunning the user's intended bandwidth limits.
- - Include TLS overhead when counting bandwidth usage; previously, we
- would count only the bytes sent over TLS, but not the bytes used
- to send them.
- - Support running the Tor service with a torrc not in the same
- directory as tor.exe and default to using the torrc located in
- the %appdata%\Tor\ of the user who installed the service. Patch
- from Matt Edman.
- - Servers now check for the case when common DNS requests are going to
- wildcarded addresses (i.e. all getting the same answer), and change
- their exit policy to reject *:* if it's happening.
- - Implement BEGIN_DIR cells, so we can connect to the directory
- server via TLS to do encrypted directory requests rather than
- plaintext. Enable via the TunnelDirConns and PreferTunneledDirConns
- config options if you like.
- o Minor features (config and docs):
- - Start using the state file to store bandwidth accounting data:
- the bw_accounting file is now obsolete. We'll keep generating it
- for a while for people who are still using 0.1.2.4-alpha.
- - Try to batch changes to the state file so that we do as few
- disk writes as possible while still storing important things in
- a timely fashion.
- - The state file and the bw_accounting file get saved less often when
- the AvoidDiskWrites config option is set.
- - Make PIDFile work on Windows (untested).
- - Add internal descriptions for a bunch of configuration options:
- accessible via controller interface and in comments in saved
- options files.
- - Reject *:563 (NNTPS) in the default exit policy. We already reject
- NNTP by default, so this seems like a sensible addition.
- - Clients now reject hostnames with invalid characters. This should
- avoid some inadvertent info leaks. Add an option
- AllowNonRFC953Hostnames to disable this behavior, in case somebody
- is running a private network with hosts called @, !, and #.
- - Add a maintainer script to tell us which options are missing
- documentation: "make check-docs".
- - Add a new address-spec.txt document to describe our special-case
- addresses: .exit, .onion, and .noconnnect.
- o Minor features (DNS):
- - Ongoing work on eventdns infrastructure: now it has dns server
- and ipv6 support. One day Tor will make use of it.
- - Add client-side caching for reverse DNS lookups.
- - Add support to tor-resolve tool for reverse lookups and SOCKS5.
- - When we change nameservers or IP addresses, reset and re-launch
- our tests for DNS hijacking.
- o Minor features (directory):
- - Authorities now specify server versions in networkstatus. This adds
- about 2% to the size of compressed networkstatus docs, and allows
- clients to tell which servers support BEGIN_DIR and which don't.
- The implementation is forward-compatible with a proposed future
- protocol version scheme not tied to Tor versions.
- - DirServer configuration lines now have an orport= option so
- clients can open encrypted tunnels to the authorities without
- having downloaded their descriptors yet. Enabled for moria1,
- moria2, tor26, and lefkada now in the default configuration.
- - Directory servers are more willing to send a 503 "busy" if they
- are near their write limit, especially for v1 directory requests.
- Now they can use their limited bandwidth for actual Tor traffic.
- - Clients track responses with status 503 from dirservers. After a
- dirserver has given us a 503, we try not to use it until an hour has
- gone by, or until we have no dirservers that haven't given us a 503.
- - When we get a 503 from a directory, and we're not a server, we don't
- count the failure against the total number of failures allowed
- for the thing we're trying to download.
- - Report X-Your-Address-Is correctly from tunneled directory
- connections; don't report X-Your-Address-Is when it's an internal
- address; and never believe reported remote addresses when they're
- internal.
- - Protect against an unlikely DoS attack on directory servers.
- - Add a BadDirectory flag to network status docs so that authorities
- can (eventually) tell clients about caches they believe to be
- broken.
- o Minor features (controller):
- - Have GETINFO dir/status/* work on hosts with DirPort disabled.
- - Reimplement GETINFO so that info/names stays in sync with the
- actual keys.
- - Implement "GETINFO fingerprint".
- - Implement "SETEVENTS GUARD" so controllers can get updates on
- entry guard status as it changes.
- o Minor features (clean up obsolete pieces):
- - Remove some options that have been deprecated since at least
- 0.1.0.x: AccountingMaxKB, LogFile, DebugLogFile, LogLevel, and
- SysLog. Use AccountingMax instead of AccountingMaxKB, and use Log
- to set log options.
- - We no longer look for identity and onion keys in "identity.key" and
- "onion.key" -- these were replaced by secret_id_key and
- secret_onion_key in 0.0.8pre1.
- - We no longer require unrecognized directory entries to be
- preceded by "opt".
- o Major bugfixes (security):
- - Stop sending the HttpProxyAuthenticator string to directory
- servers when directory connections are tunnelled through Tor.
- - Clients no longer store bandwidth history in the state file.
- - Do not log introduction points for hidden services if SafeLogging
- is set.
- - When generating bandwidth history, round down to the nearest
- 1k. When storing accounting data, round up to the nearest 1k.
- - When we're running as a server, remember when we last rotated onion
- keys, so that we will rotate keys once they're a week old even if
- we never stay up for a week ourselves.
- o Major bugfixes (other):
- - Fix a longstanding bug in eventdns that prevented the count of
- timed-out resolves from ever being reset. This bug caused us to
- give up on a nameserver the third time it timed out, and try it
- 10 seconds later... and to give up on it every time it timed out
- after that.
- - Take out the '5 second' timeout from the connection retry
- schedule. Now the first connect attempt will wait a full 10
- seconds before switching to a new circuit. Perhaps this will help
- a lot. Based on observations from Mike Perry.
- - Fix a bug on the Windows implementation of tor_mmap_file() that
- would prevent the cached-routers file from ever loading. Reported
- by John Kimble.
- o Minor bugfixes:
- - Fix an assert failure when a directory authority sets
- AuthDirRejectUnlisted and then receives a descriptor from an
- unlisted router. Reported by seeess.
- - Avoid a double-free when parsing malformed DirServer lines.
- - Fix a bug when a BSD-style PF socket is first used. Patch from
- Fabian Keil.
- - Fix a bug in 0.1.2.2-alpha that prevented clients from asking
- to resolve an address at a given exit node even when they ask for
- it by name.
- - Servers no longer ever list themselves in their "family" line,
- even if configured to do so. This makes it easier to configure
- family lists conveniently.
- - When running as a server, don't fall back to 127.0.0.1 when no
- nameservers are configured in /etc/resolv.conf; instead, make the
- user fix resolv.conf or specify nameservers explicitly. (Resolves
- bug 363.)
- - Stop accepting certain malformed ports in configured exit policies.
- - Don't re-write the fingerprint file every restart, unless it has
- changed.
- - Stop warning when a single nameserver fails: only warn when _all_ of
- our nameservers have failed. Also, when we only have one nameserver,
- raise the threshold for deciding that the nameserver is dead.
- - Directory authorities now only decide that routers are reachable
- if their identity keys are as expected.
- - When the user uses bad syntax in the Log config line, stop
- suggesting other bad syntax as a replacement.
- - Correctly detect ipv6 DNS capability on OpenBSD.
- o Minor bugfixes (controller):
- - Report the circuit number correctly in STREAM CLOSED events. Bug
- reported by Mike Perry.
- - Do not report bizarre values for results of accounting GETINFOs
- when the last second's write or read exceeds the allotted bandwidth.
- - Report "unrecognized key" rather than an empty string when the
- controller tries to fetch a networkstatus that doesn't exist.
- Changes in version 0.1.1.26 - 2006-12-14
- o Security bugfixes:
- - Stop sending the HttpProxyAuthenticator string to directory
- servers when directory connections are tunnelled through Tor.
- - Clients no longer store bandwidth history in the state file.
- - Do not log introduction points for hidden services if SafeLogging
- is set.
- o Minor bugfixes:
- - Fix an assert failure when a directory authority sets
- AuthDirRejectUnlisted and then receives a descriptor from an
- unlisted router (reported by seeess).
- Changes in version 0.1.2.4-alpha - 2006-12-03
- o Major features:
- - Add support for using natd; this allows FreeBSDs earlier than
- 5.1.2 to have ipfw send connections through Tor without using
- SOCKS. (Patch from Zajcev Evgeny with tweaks from tup.)
- o Minor features:
- - Make all connections to addresses of the form ".noconnect"
- immediately get closed. This lets application/controller combos
- successfully test whether they're talking to the same Tor by
- watching for STREAM events.
- - Make cross.sh cross-compilation script work even when autogen.sh
- hasn't been run. (Patch from Michael Mohr.)
- - Statistics dumped by -USR2 now include a breakdown of public key
- operations, for profiling.
- o Major bugfixes:
- - Fix a major leak when directory authorities parse their
- approved-routers list, a minor memory leak when we fail to pick
- an exit node, and a few rare leaks on errors.
- - Handle TransPort connections even when the server sends data before
- the client sends data. Previously, the connection would just hang
- until the client sent data. (Patch from tup based on patch from
- Zajcev Evgeny.)
- - Avoid assert failure when our cached-routers file is empty on
- startup.
- o Minor bugfixes:
- - Don't log spurious warnings when we see a circuit close reason we
- don't recognize; it's probably just from a newer version of Tor.
- - Have directory authorities allow larger amounts of drift in uptime
- without replacing the server descriptor: previously, a server that
- restarted every 30 minutes could have 48 "interesting" descriptors
- per day.
- - Start linking to the Tor specification and Tor reference manual
- correctly in the Windows installer.
- - Add Vidalia to the OS X uninstaller script, so when we uninstall
- Tor/Privoxy we also uninstall Vidalia.
- - Resume building on Irix64, and fix a lot of warnings from its
- MIPSpro C compiler.
- - Don't corrupt last_guessed_ip in router_new_address_suggestion()
- when we're running as a client.
- Changes in version 0.1.1.25 - 2006-11-04
- o Major bugfixes:
- - When a client asks us to resolve (rather than connect to)
- an address, and we have a cached answer, give them the cached
- answer. Previously, we would give them no answer at all.
- - We were building exactly the wrong circuits when we predict
- hidden service requirements, meaning Tor would have to build all
- its circuits on demand.
- - If none of our live entry guards have a high uptime, but we
- require a guard with a high uptime, try adding a new guard before
- we give up on the requirement. This patch should make long-lived
- connections more stable on average.
- - When testing reachability of our DirPort, don't launch new
- tests when there's already one in progress -- unreachable
- servers were stacking up dozens of testing streams.
- o Security bugfixes:
- - When the user sends a NEWNYM signal, clear the client-side DNS
- cache too. Otherwise we continue to act on previous information.
- o Minor bugfixes:
- - Avoid a memory corruption bug when creating a hash table for
- the first time.
- - Avoid possibility of controller-triggered crash when misusing
- certain commands from a v0 controller on platforms that do not
- handle printf("%s",NULL) gracefully.
- - Avoid infinite loop on unexpected controller input.
- - Don't log spurious warnings when we see a circuit close reason we
- don't recognize; it's probably just from a newer version of Tor.
- - Add Vidalia to the OS X uninstaller script, so when we uninstall
- Tor/Privoxy we also uninstall Vidalia.
- Changes in version 0.1.2.3-alpha - 2006-10-29
- o Minor features:
- - Prepare for servers to publish descriptors less often: never
- discard a descriptor simply for being too old until either it is
- recommended by no authorities, or until we get a better one for
- the same router. Make caches consider retaining old recommended
- routers for even longer.
- - If most authorities set a BadExit flag for a server, clients
- don't think of it as a general-purpose exit. Clients only consider
- authorities that advertise themselves as listing bad exits.
- - Directory servers now provide 'Pragma: no-cache' and 'Expires'
- headers for content, so that we can work better in the presence of
- caching HTTP proxies.
- - Allow authorities to list nodes as bad exits by fingerprint or by
- address.
- o Minor features, controller:
- - Add a REASON field to CIRC events; for backward compatibility, this
- field is sent only to controllers that have enabled the extended
- event format. Also, add additional reason codes to explain why
- a given circuit has been destroyed or truncated. (Patches from
- Mike Perry)
- - Add a REMOTE_REASON field to extended CIRC events to tell the
- controller about why a remote OR told us to close a circuit.
- - Stream events also now have REASON and REMOTE_REASON fields,
- working much like those for circuit events.
- - There's now a GETINFO ns/... field so that controllers can ask Tor
- about the current status of a router.
- - A new event type "NS" to inform a controller when our opinion of
- a router's status has changed.
- - Add a GETINFO events/names and GETINFO features/names so controllers
- can tell which events and features are supported.
- - A new CLEARDNSCACHE signal to allow controllers to clear the
- client-side DNS cache without expiring circuits.
- o Security bugfixes:
- - When the user sends a NEWNYM signal, clear the client-side DNS
- cache too. Otherwise we continue to act on previous information.
- o Minor bugfixes:
- - Avoid sending junk to controllers or segfaulting when a controller
- uses EVENT_NEW_DESC with verbose nicknames.
- - Stop triggering asserts if the controller tries to extend hidden
- service circuits (reported by mwenge).
- - Avoid infinite loop on unexpected controller input.
- - When the controller does a "GETINFO network-status", tell it
- about even those routers whose descriptors are very old, and use
- long nicknames where appropriate.
- - Change NT service functions to be loaded on demand. This lets us
- build with MinGW without breaking Tor for Windows 98 users.
- - Do DirPort reachability tests less often, since a single test
- chews through many circuits before giving up.
- - In the hidden service example in torrc.sample, stop recommending
- esoteric and discouraged hidden service options.
- - When stopping an NT service, wait up to 10 sec for it to actually
- stop. Patch from Matt Edman; resolves bug 295.
- - Fix handling of verbose nicknames with ORCONN controller events:
- make them show up exactly when requested, rather than exactly when
- not requested.
- - When reporting verbose nicknames in entry_guards_getinfo(), avoid
- printing a duplicate "$" in the keys we send (reported by mwenge).
- - Correctly set maximum connection limit on Cygwin. (This time
- for sure!)
- - Try to detect Windows correctly when cross-compiling.
- - Detect the size of the routers file correctly even if it is
- corrupted (on systems without mmap) or not page-aligned (on systems
- with mmap). This bug was harmless.
- - Sometimes we didn't bother sending a RELAY_END cell when an attempt
- to open a stream fails; now we do in more cases. This should
- make clients able to find a good exit faster in some cases, since
- unhandleable requests will now get an error rather than timing out.
- - Resolve two memory leaks when rebuilding the on-disk router cache
- (reported by fookoowa).
- - Clean up minor code warnings suggested by the MIPSpro C compiler,
- and reported by some Centos users.
- - Controller signals now work on non-Unix platforms that don't define
- SIGUSR1 and SIGUSR2 the way we expect.
- - Patch from Michael Mohr to contrib/cross.sh, so it checks more
- values before failing, and always enables eventdns.
- - Libevent-1.2 exports, but does not define in its headers, strlcpy.
- Try to fix this in configure.in by checking for most functions
- before we check for libevent.
- Changes in version 0.1.2.2-alpha - 2006-10-07
- o Major features:
- - Make our async eventdns library on-by-default for Tor servers,
- and plan to deprecate the separate dnsworker threads.
- - Add server-side support for "reverse" DNS lookups (using PTR
- records so clients can determine the canonical hostname for a given
- IPv4 address). Only supported by servers using eventdns; servers
- now announce in their descriptors whether they support eventdns.
- - Specify and implement client-side SOCKS5 interface for reverse DNS
- lookups (see doc/socks-extensions.txt).
- - Add a BEGIN_DIR relay cell type for an easier in-protocol way to
- connect to directory servers through Tor. Previously, clients needed
- to find Tor exits to make private connections to directory servers.
- - Avoid choosing Exit nodes for entry or middle hops when the
- total bandwidth available from non-Exit nodes is much higher than
- the total bandwidth available from Exit nodes.
- - Workaround for name servers (like Earthlink's) that hijack failing
- DNS requests and replace the no-such-server answer with a "helpful"
- redirect to an advertising-driven search portal. Also work around
- DNS hijackers who "helpfully" decline to hijack known-invalid
- RFC2606 addresses. Config option "ServerDNSDetectHijacking 0"
- lets you turn it off.
- - Send out a burst of long-range padding cells once we've established
- that we're reachable. Spread them over 4 circuits, so hopefully
- a few will be fast. This exercises our bandwidth and bootstraps
- us into the directory more quickly.
- o New/improved config options:
- - Add new config option "ResolvConf" to let the server operator
- choose an alternate resolve.conf file when using eventdns.
- - Add an "EnforceDistinctSubnets" option to control our "exclude
- servers on the same /16" behavior. It's still on by default; this
- is mostly for people who want to operate private test networks with
- all the machines on the same subnet.
- - If one of our entry guards is on the ExcludeNodes list, or the
- directory authorities don't think it's a good guard, treat it as
- if it were unlisted: stop using it as a guard, and throw it off
- the guards list if it stays that way for a long time.
- - Allow directory authorities to be marked separately as authorities
- for the v1 directory protocol, the v2 directory protocol, and
- as hidden service directories, to make it easier to retire old
- authorities. V1 authorities should set "HSAuthoritativeDir 1"
- to continue being hidden service authorities too.
- - Remove 8888 as a LongLivedPort, and add 6697 (IRCS).
- o Minor features, controller:
- - Fix CIRC controller events so that controllers can learn the
- identity digests of non-Named servers used in circuit paths.
- - Let controllers ask for more useful identifiers for servers. Instead
- of learning identity digests for un-Named servers and nicknames
- for Named servers, the new identifiers include digest, nickname,
- and indication of Named status. Off by default; see control-spec.txt
- for more information.
- - Add a "getinfo address" controller command so it can display Tor's
- best guess to the user.
- - New controller event to alert the controller when our server
- descriptor has changed.
- - Give more meaningful errors on controller authentication failure.
- o Minor features, other:
- - When asked to resolve a hostname, don't use non-exit servers unless
- requested to do so. This allows servers with broken DNS to be
- useful to the network.
- - Divide eventdns log messages into warn and info messages.
- - Reserve the nickname "Unnamed" for routers that can't pick
- a hostname: any router can call itself Unnamed; directory
- authorities will never allocate Unnamed to any particular router;
- clients won't believe that any router is the canonical Unnamed.
- - Only include function names in log messages for info/debug messages.
- For notice/warn/err, the content of the message should be clear on
- its own, and printing the function name only confuses users.
- - Avoid some false positives during reachability testing: don't try
- to test via a server that's on the same /24 as us.
- - If we fail to build a circuit to an intended enclave, and it's
- not mandatory that we use that enclave, stop wanting it.
- - When eventdns is enabled, allow multithreaded builds on NetBSD and
- OpenBSD. (We had previously disabled threads on these platforms
- because they didn't have working thread-safe resolver functions.)
- o Major bugfixes, anonymity/security:
- - If a client asked for a server by name, and there's a named server
- in our network-status but we don't have its descriptor yet, we
- could return an unnamed server instead.
- - Fix NetBSD bug that could allow someone to force uninitialized RAM
- to be sent to a server's DNS resolver. This only affects NetBSD
- and other platforms that do not bounds-check tolower().
- - Reject (most) attempts to use Tor circuits with length one. (If
- many people start using Tor as a one-hop proxy, exit nodes become
- a more attractive target for compromise.)
- - Just because your DirPort is open doesn't mean people should be
- able to remotely teach you about hidden service descriptors. Now
- only accept rendezvous posts if you've got HSAuthoritativeDir set.
- o Major bugfixes, other:
- - Don't crash on race condition in dns.c: tor_assert(!resolve->expire)
- - When a client asks the server to resolve (not connect to)
- an address, and it has a cached answer, give them the cached answer.
- Previously, the server would give them no answer at all.
- - Allow really slow clients to not hang up five minutes into their
- directory downloads (suggested by Adam J. Richter).
- - We were building exactly the wrong circuits when we anticipated
- hidden service requirements, meaning Tor would have to build all
- its circuits on demand.
- - Avoid crashing when we mmap a router cache file of size 0.
- - When testing reachability of our DirPort, don't launch new
- tests when there's already one in progress -- unreachable
- servers were stacking up dozens of testing streams.
- o Minor bugfixes, correctness:
- - If we're a directory mirror and we ask for "all" network status
- documents, we would discard status documents from authorities
- we don't recognize.
- - Avoid a memory corruption bug when creating a hash table for
- the first time.
- - Avoid controller-triggered crash when misusing certain commands
- from a v0 controller on platforms that do not handle
- printf("%s",NULL) gracefully.
- - Don't crash when a controller sends a third argument to an
- "extendcircuit" request.
- - Controller protocol fixes: fix encoding in "getinfo addr-mappings"
- response; fix error code when "getinfo dir/status/" fails.
- - Avoid crash when telling controller stream-status and a stream
- is detached.
- - Patch from Adam Langley to fix assert() in eventdns.c.
- - Fix a debug log message in eventdns to say "X resolved to Y"
- instead of "X resolved to X".
- - Make eventdns give strings for DNS errors, not just error numbers.
- - Track unreachable entry guards correctly: don't conflate
- 'unreachable by us right now' with 'listed as down by the directory
- authorities'. With the old code, if a guard was unreachable by
- us but listed as running, it would clog our guard list forever.
- - Behave correctly in case we ever have a network with more than
- 2GB/s total advertised capacity.
- - Make TrackExitHosts case-insensitive, and fix the behavior of
- ".suffix" TrackExitHosts items to avoid matching in the middle of
- an address.
- - Finally fix the openssl warnings from newer gccs that believe that
- ignoring a return value is okay, but casting a return value and
- then ignoring it is a sign of madness.
- - Prevent the contrib/exitlist script from printing the same
- result more than once.
- - Patch from Steve Hildrey: Generate network status correctly on
- non-versioning dirservers.
- - Don't listen to the X-Your-Address-Is hint if you did the lookup
- via Tor; otherwise you'll think you're the exit node's IP address.
- o Minor bugfixes, performance:
- - Two small performance improvements on parsing descriptors.
- - Major performance improvement on inserting descriptors: change
- algorithm from O(n^2) to O(n).
- - Make the common memory allocation path faster on machines where
- malloc(0) returns a pointer.
- - Start remembering X-Your-Address-Is directory hints even if you're
- a client, so you can become a server more smoothly.
- - Avoid duplicate entries on MyFamily line in server descriptor.
- o Packaging, features:
- - Remove architecture from OS X builds. The official builds are
- now universal binaries.
- - The Debian package now uses --verify-config when (re)starting,
- to distinguish configuration errors from other errors.
- - Update RPMs to require libevent 1.1b.
- o Packaging, bugfixes:
- - Patches so Tor builds with MinGW on Windows.
- - Patches so Tor might run on Cygwin again.
- - Resume building on non-gcc compilers and ancient gcc. Resume
- building with the -O0 compile flag. Resume building cleanly on
- Debian woody.
- - Run correctly on OS X platforms with case-sensitive filesystems.
- - Correct includes for net/if.h and net/pfvar.h on OpenBSD (from Tup).
- - Add autoconf checks so Tor can build on Solaris x86 again.
- o Documentation
- - Documented (and renamed) ServerDNSSearchDomains and
- ServerDNSResolvConfFile options.
- - Be clearer that the *ListenAddress directives can be repeated
- multiple times.
- Changes in version 0.1.1.24 - 2006-09-29
- o Major bugfixes:
- - Allow really slow clients to not hang up five minutes into their
- directory downloads (suggested by Adam J. Richter).
- - Fix major performance regression from 0.1.0.x: instead of checking
- whether we have enough directory information every time we want to
- do something, only check when the directory information has changed.
- This should improve client CPU usage by 25-50%.
- - Don't crash if, after a server has been running for a while,
- it can't resolve its hostname.
- o Minor bugfixes:
- - Allow Tor to start when RunAsDaemon is set but no logs are set.
- - Don't crash when the controller receives a third argument to an
- "extendcircuit" request.
- - Controller protocol fixes: fix encoding in "getinfo addr-mappings"
- response; fix error code when "getinfo dir/status/" fails.
- - Fix configure.in to not produce broken configure files with
- more recent versions of autoconf. Thanks to Clint for his auto*
- voodoo.
- - Fix security bug on NetBSD that could allow someone to force
- uninitialized RAM to be sent to a server's DNS resolver. This
- only affects NetBSD and other platforms that do not bounds-check
- tolower().
- - Warn user when using libevent 1.1a or earlier with win32 or kqueue
- methods: these are known to be buggy.
- - If we're a directory mirror and we ask for "all" network status
- documents, we would discard status documents from authorities
- we don't recognize.
- Changes in version 0.1.2.1-alpha - 2006-08-27
- o Major features:
- - Add "eventdns" async dns library from Adam Langley, tweaked to
- build on OSX and Windows. Only enabled if you pass the
- --enable-eventdns argument to configure.
- - Allow servers with no hostname or IP address to learn their
- IP address by asking the directory authorities. This code only
- kicks in when you would normally have exited with a "no address"
- error. Nothing's authenticated, so use with care.
- - Rather than waiting a fixed amount of time between retrying
- application connections, we wait only 5 seconds for the first,
- 10 seconds for the second, and 15 seconds for each retry after
- that. Hopefully this will improve the expected user experience.
- - Patch from Tup to add support for transparent AP connections:
- this basically bundles the functionality of trans-proxy-tor
- into the Tor mainline. Now hosts with compliant pf/netfilter
- implementations can redirect TCP connections straight to Tor
- without diverting through SOCKS. Needs docs.
- - Busy directory servers save lots of memory by spooling server
- descriptors, v1 directories, and v2 networkstatus docs to buffers
- as needed rather than en masse. Also mmap the cached-routers
- files, so we don't need to keep the whole thing in memory too.
- - Automatically avoid picking more than one node from the same
- /16 network when constructing a circuit.
- - Revise and clean up the torrc.sample that we ship with; add
- a section for BandwidthRate and BandwidthBurst.
- o Minor features:
- - Split circuit_t into origin_circuit_t and or_circuit_t, and
- split connection_t into edge, or, dir, control, and base structs.
- These will save quite a bit of memory on busy servers, and they'll
- also help us track down bugs in the code and bugs in the spec.
- - Experimentally re-enable kqueue on OSX when using libevent 1.1b
- or later. Log when we are doing this, so we can diagnose it when
- it fails. (Also, recommend libevent 1.1b for kqueue and
- win32 methods; deprecate libevent 1.0b harder; make libevent
- recommendation system saner.)
- - Start being able to build universal binaries on OS X (thanks
- to Phobos).
- - Export the default exit policy via the control port, so controllers
- don't need to guess what it is / will be later.
- - Add a man page entry for ProtocolWarnings.
- - Add TestVia config option to the man page.
- - Remove even more protocol-related warnings from Tor server logs,
- such as bad TLS handshakes and malformed begin cells.
- - Stop fetching descriptors if you're not a dir mirror and you
- haven't tried to establish any circuits lately. [This currently
- causes some dangerous behavior, because when you start up again
- you'll use your ancient server descriptors.]
- - New DirPort behavior: if you have your dirport set, you download
- descriptors aggressively like a directory mirror, whether or not
- your ORPort is set.
- - Get rid of the router_retry_connections notion. Now routers
- no longer try to rebuild long-term connections to directory
- authorities, and directory authorities no longer try to rebuild
- long-term connections to all servers. We still don't hang up
- connections in these two cases though -- we need to look at it
- more carefully to avoid flapping, and we likely need to wait til
- 0.1.1.x is obsolete.
- - Drop compatibility with obsolete Tors that permit create cells
- to have the wrong circ_id_type.
- - Re-enable per-connection rate limiting. Get rid of the "OP
- bandwidth" concept. Lay groundwork for "bandwidth classes" --
- separate global buckets that apply depending on what sort of conn
- it is.
- - Start publishing one minute or so after we find our ORPort
- to be reachable. This will help reduce the number of descriptors
- we have for ourselves floating around, since it's quite likely
- other things (e.g. DirPort) will change during that minute too.
- - Fork the v1 directory protocol into its own spec document,
- and mark dir-spec.txt as the currently correct (v2) spec.
- o Major bugfixes:
- - When we find our DirPort to be reachable, publish a new descriptor
- so we'll tell the world (reported by pnx).
- - Publish a new descriptor after we hup/reload. This is important
- if our config has changed such that we'll want to start advertising
- our DirPort now, etc.
- - Allow Tor to start when RunAsDaemon is set but no logs are set.
- - When we have a state file we cannot parse, tell the user and
- move it aside. Now we avoid situations where the user starts
- Tor in 1904, Tor writes a state file with that timestamp in it,
- the user fixes her clock, and Tor refuses to start.
- - Fix configure.in to not produce broken configure files with
- more recent versions of autoconf. Thanks to Clint for his auto*
- voodoo.
- - "tor --verify-config" now exits with -1(255) or 0 depending on
- whether the config options are bad or good.
- - Resolve bug 321 when using dnsworkers: append a period to every
- address we resolve at the exit node, so that we do not accidentally
- pick up local addresses, and so that failing searches are retried
- in the resolver search domains. (This is already solved for
- eventdns.) (This breaks Blossom servers for now.)
- - If we are using an exit enclave and we can't connect, e.g. because
- its webserver is misconfigured to not listen on localhost, then
- back off and try connecting from somewhere else before we fail.
- o Minor bugfixes:
- - Start compiling on MinGW on Windows (patches from Mike Chiussi).
- - Start compiling on MSVC6 on Windows (patches from Frediano Ziglio).
- - Fix bug 314: Tor clients issued "unsafe socks" warnings even
- when the IP address is mapped through MapAddress to a hostname.
- - Start passing "ipv4" hints to getaddrinfo(), so servers don't do
- useless IPv6 DNS resolves.
- - Patch suggested by Karsten Loesing: respond to SIGNAL command
- before we execute the signal, in case the signal shuts us down.
- - Clean up AllowInvalidNodes man page entry.
- - Claim a commonname of Tor, rather than TOR, in TLS handshakes.
- - Add more asserts to track down an assert error on a windows Tor
- server with connection_add being called with socket == -1.
- - Handle reporting OR_CONN_EVENT_NEW events to the controller.
- - Fix misleading log messages: an entry guard that is "unlisted",
- as well as not known to be "down" (because we've never heard
- of it), is not therefore "up".
- - Remove code to special-case "-cvs" ending, since it has not
- actually mattered since 0.0.9.
- - Make our socks5 handling more robust to broken socks clients:
- throw out everything waiting on the buffer in between socks
- handshake phases, since they can't possibly (so the theory
- goes) have predicted what we plan to respond to them.
- Changes in version 0.1.1.23 - 2006-07-30
- o Major bugfixes:
- - Fast Tor servers, especially exit nodes, were triggering asserts
- due to a bug in handling the list of pending DNS resolves. Some
- bugs still remain here; we're hunting them.
- - Entry guards could crash clients by sending unexpected input.
- - More fixes on reachability testing: if you find yourself reachable,
- then don't ever make any client requests (so you stop predicting
- circuits), then hup or have your clock jump, then later your IP
- changes, you won't think circuits are working, so you won't try to
- test reachability, so you won't publish.
- o Minor bugfixes:
- - Avoid a crash if the controller does a resetconf firewallports
- and then a setconf fascistfirewall=1.
- - Avoid an integer underflow when the dir authority decides whether
- a router is stable: we might wrongly label it stable, and compute
- a slightly wrong median stability, when a descriptor is published
- later than now.
- - Fix a place where we might trigger an assert if we can't build our
- own server descriptor yet.
- Changes in version 0.1.1.22 - 2006-07-05
- o Major bugfixes:
- - Fix a big bug that was causing servers to not find themselves
- reachable if they changed IP addresses. Since only 0.1.1.22+
- servers can do reachability testing correctly, now we automatically
- make sure to test via one of these.
- - Fix to allow clients and mirrors to learn directory info from
- descriptor downloads that get cut off partway through.
- - Directory authorities had a bug in deciding if a newly published
- descriptor was novel enough to make everybody want a copy -- a few
- servers seem to be publishing new descriptors many times a minute.
- o Minor bugfixes:
- - Fix a rare bug that was causing some servers to complain about
- "closing wedged cpuworkers" and skip some circuit create requests.
- - Make the Exit flag in directory status documents actually work.
- Changes in version 0.1.1.21 - 2006-06-10
- o Crash and assert fixes from 0.1.1.20:
- - Fix a rare crash on Tor servers that have enabled hibernation.
- - Fix a seg fault on startup for Tor networks that use only one
- directory authority.
- - Fix an assert from a race condition that occurs on Tor servers
- while exiting, where various threads are trying to log that they're
- exiting, and delete the logs, at the same time.
- - Make our unit tests pass again on certain obscure platforms.
- o Other fixes:
- - Add support for building SUSE RPM packages.
- - Speed up initial bootstrapping for clients: if we are making our
- first ever connection to any entry guard, then don't mark it down
- right after that.
- - When only one Tor server in the network is labelled as a guard,
- and we've already picked him, we would cycle endlessly picking him
- again, being unhappy about it, etc. Now we specifically exclude
- current guards when picking a new guard.
- - Servers send create cells more reliably after the TLS connection
- is established: we were sometimes forgetting to send half of them
- when we had more than one pending.
- - If we get a create cell that asks us to extend somewhere, but the
- Tor server there doesn't match the expected digest, we now send
- a destroy cell back, rather than silently doing nothing.
- - Make options->RedirectExit work again.
- - Make cookie authentication for the controller work again.
- - Stop being picky about unusual characters in the arguments to
- mapaddress. It's none of our business.
- - Add a new config option "TestVia" that lets you specify preferred
- middle hops to use for test circuits. Perhaps this will let me
- debug the reachability problems better.
- o Log / documentation fixes:
- - If we're a server and some peer has a broken TLS certificate, don't
- log about it unless ProtocolWarnings is set, i.e., we want to hear
- about protocol violations by others.
- - Fix spelling of VirtualAddrNetwork in man page.
- - Add a better explanation at the top of the autogenerated torrc file
- about what happened to our old torrc.
- Changes in version 0.1.1.20 - 2006-05-23
- o Bugfixes:
- - Downgrade a log severity where servers complain that they're
- invalid.
- - Avoid a compile warning on FreeBSD.
- - Remove string size limit on NEWDESC messages; solve bug 291.
- - Correct the RunAsDaemon entry in the man page; ignore RunAsDaemon
- more thoroughly when we're running on windows.
- Changes in version 0.1.1.19-rc - 2006-05-03
- o Minor bugs:
- - Regenerate our local descriptor if it's dirty and we try to use
- it locally (e.g. if it changes during reachability detection).
- - If we setconf our ORPort to 0, we continued to listen on the
- old ORPort and receive connections.
- - Avoid a second warning about machine/limits.h on Debian
- GNU/kFreeBSD.
- - Be willing to add our own routerinfo into the routerlist.
- Now authorities will include themselves in their directories
- and network-statuses.
- - Stop trying to upload rendezvous descriptors to every
- directory authority: only try the v1 authorities.
- - Servers no longer complain when they think they're not
- registered with the directory authorities. There were too many
- false positives.
- - Backport dist-rpm changes so rpms can be built without errors.
- o Features:
- - Implement an option, VirtualAddrMask, to set which addresses
- get handed out in response to mapaddress requests. This works
- around a bug in tsocks where 127.0.0.0/8 is never socksified.
- Changes in version 0.1.1.18-rc - 2006-04-10
- o Major fixes:
- - Work harder to download live network-statuses from all the
- directory authorities we know about. Improve the threshold
- decision logic so we're more robust to edge cases.
- - When fetching rendezvous descriptors, we were willing to ask
- v2 authorities too, which would always return 404.
- o Minor fixes:
- - Stop listing down or invalid nodes in the v1 directory. This will
- reduce its bulk by about 1/3, and reduce load on directory
- mirrors.
- - When deciding whether a router is Fast or Guard-worthy, consider
- his advertised BandwidthRate and not just the BandwidthCapacity.
- - No longer ship INSTALL and README files -- they are useless now.
- - Force rpmbuild to behave and honor target_cpu.
- - Avoid warnings about machine/limits.h on Debian GNU/kFreeBSD.
- - Start to include translated versions of the tor-doc-*.html
- files, along with the screenshots. Still needs more work.
- - Start sending back 512 and 451 errors if mapaddress fails,
- rather than not sending anything back at all.
- - When we fail to bind or listen on an incoming or outgoing
- socket, we should close it before failing. otherwise we just
- leak it. (thanks to weasel for finding.)
- - Allow "getinfo dir/status/foo" to work, as long as your DirPort
- is enabled. (This is a hack, and will be fixed in 0.1.2.x.)
- - Make NoPublish (even though deprecated) work again.
- - Fix a minor security flaw where a versioning auth dirserver
- could list a recommended version many times in a row to make
- clients more convinced that it's recommended.
- - Fix crash bug if there are two unregistered servers running
- with the same nickname, one of them is down, and you ask for
- them by nickname in your EntryNodes or ExitNodes. Also, try
- to pick the one that's running rather than an arbitrary one.
- - Fix an infinite loop we could hit if we go offline for too long.
- - Complain when we hit WSAENOBUFS on recv() or write() too.
- Perhaps this will help us hunt the bug.
- - If you're not a versioning dirserver, don't put the string
- "client-versions \nserver-versions \n" in your network-status.
- - Lower the minimum required number of file descriptors to 1000,
- so we can have some overhead for Valgrind on Linux, where the
- default ulimit -n is 1024.
- o New features:
- - Add tor.dizum.com as the fifth authoritative directory server.
- - Add a new config option FetchUselessDescriptors, off by default,
- for when you plan to run "exitlist" on your client and you want
- to know about even the non-running descriptors.
- Changes in version 0.1.1.17-rc - 2006-03-28
- o Major fixes:
- - Clients and servers since 0.1.1.10-alpha have been expiring
- connections whenever they are idle for 5 minutes and they *do*
- have circuits on them. Oops. With this new version, clients will
- discard their previous entry guard choices and avoid choosing
- entry guards running these flawed versions.
- - Fix memory leak when uncompressing concatenated zlib streams. This
- was causing substantial leaks over time on Tor servers.
- - The v1 directory was including servers as much as 48 hours old,
- because that's how the new routerlist->routers works. Now only
- include them if they're 20 hours old or less.
- o Minor fixes:
- - Resume building on irix64, netbsd 2.0, etc.
- - On non-gcc compilers (e.g. solaris), use "-g -O" instead of
- "-Wall -g -O2".
- - Stop writing the "router.desc" file, ever. Nothing uses it anymore,
- and it is confusing some users.
- - Mirrors stop caching the v1 directory so often.
- - Make the max number of old descriptors that a cache will hold
- rise with the number of directory authorities, so we can scale.
- - Change our win32 uname() hack to be more forgiving about what
- win32 versions it thinks it's found.
- o New features:
- - Add lefkada.eecs.harvard.edu as a fourth authoritative directory
- server.
- - When the controller's *setconf commands fail, collect an error
- message in a string and hand it back to the controller.
- - Make the v2 dir's "Fast" flag based on relative capacity, just
- like "Stable" is based on median uptime. Name everything in the
- top 7/8 Fast, and only the top 1/2 gets to be a Guard.
- - Log server fingerprint on startup, so new server operators don't
- have to go hunting around their filesystem for it.
- - Return a robots.txt on our dirport to discourage google indexing.
- - Let the controller ask for GETINFO dir/status/foo so it can ask
- directly rather than connecting to the dir port. Only works when
- dirport is set for now.
- o New config options rather than constants in the code:
- - SocksTimeout: How long do we let a socks connection wait
- unattached before we fail it?
- - CircuitBuildTimeout: Cull non-open circuits that were born
- at least this many seconds ago.
- - CircuitIdleTimeout: Cull open clean circuits that were born
- at least this many seconds ago.
- Changes in version 0.1.1.16-rc - 2006-03-18
- o Bugfixes on 0.1.1.15-rc:
- - Fix assert when the controller asks to attachstream a connect-wait
- or resolve-wait stream.
- - Now do address rewriting when the controller asks us to attach
- to a particular circuit too. This will let Blossom specify
- "moria2.exit" without having to learn what moria2's IP address is.
- - Make the "tor --verify-config" command-line work again, so people
- can automatically check if their torrc will parse.
- - Authoritative dirservers no longer require an open connection from
- a server to consider him "reachable". We need this change because
- when we add new auth dirservers, old servers won't know not to
- hang up on them.
- - Let Tor build on Sun CC again.
- - Fix an off-by-one buffer size in dirserv.c that magically never
- hit our three authorities but broke sjmurdoch's own tor network.
- - If we as a directory mirror don't know of any v1 directory
- authorities, then don't try to cache any v1 directories.
- - Stop warning about unknown servers in our family when they are
- given as hex digests.
- - Stop complaining as quickly to the server operator that he
- hasn't registered his nickname/key binding.
- - Various cleanups so we can add new V2 Auth Dirservers.
- - Change "AllowUnverifiedNodes" to "AllowInvalidNodes", to
- reflect the updated flags in our v2 dir protocol.
- - Resume allowing non-printable characters for exit streams (both
- for connecting and for resolving). Now we tolerate applications
- that don't follow the RFCs. But continue to block malformed names
- at the socks side.
- o Bugfixes on 0.1.0.x:
- - Fix assert bug in close_logs(): when we close and delete logs,
- remove them all from the global "logfiles" list.
- - Fix minor integer overflow in calculating when we expect to use up
- our bandwidth allocation before hibernating.
- - Fix a couple of bugs in OpenSSL detection. Also, deal better when
- there are multiple SSLs installed with different versions.
- - When we try to be a server and Address is not explicitly set and
- our hostname resolves to a private IP address, try to use an
- interface address if it has a public address. Now Windows machines
- that think of themselves as localhost can work by default.
- o New features:
- - Let the controller ask for GETINFO dir/server/foo so it can ask
- directly rather than connecting to the dir port.
- - Let the controller tell us about certain router descriptors
- that it doesn't want Tor to use in circuits. Implement
- SETROUTERPURPOSE and modify +POSTDESCRIPTOR to do this.
- - New config option SafeSocks to reject all application connections
- using unsafe socks protocols. Defaults to off.
- Changes in version 0.1.1.15-rc - 2006-03-11
- o Bugfixes and cleanups:
- - When we're printing strings from the network, don't try to print
- non-printable characters. This protects us against shell escape
- sequence exploits, and also against attacks to fool humans into
- misreading their logs.
- - Fix a bug where Tor would fail to establish any connections if you
- left it off for 24 hours and then started it: we were happy with
- the obsolete network statuses, but they all referred to router
- descriptors that were too old to fetch, so we ended up with no
- valid router descriptors.
- - Fix a seg fault in the controller's "getinfo orconn-status"
- command while listing status on incoming handshaking connections.
- Introduce a status name "NEW" for these connections.
- - If we get a linelist or linelist_s config option from the torrc
- (e.g. ExitPolicy) and it has no value, warn and skip rather than
- silently resetting it to its default.
- - Don't abandon entry guards until they've been down or gone for
- a whole month.
- - Cleaner and quieter log messages.
- o New features:
- - New controller signal NEWNYM that makes new application requests
- use clean circuits.
- - Add a new circuit purpose 'controller' to let the controller ask
- for a circuit that Tor won't try to use. Extend the EXTENDCIRCUIT
- controller command to let you specify the purpose if you're
- starting a new circuit. Add a new SETCIRCUITPURPOSE controller
- command to let you change a circuit's purpose after it's been
- created.
- - Accept "private:*" in routerdesc exit policies; not generated yet
- because older Tors do not understand it.
- - Add BSD-style contributed startup script "rc.subr" from Peter
- Thoenen.
- Changes in version 0.1.1.14-alpha - 2006-02-20
- o Bugfixes on 0.1.1.x:
- - Don't die if we ask for a stdout or stderr log (even implicitly)
- and we're set to RunAsDaemon -- just warn.
- - We still had a few bugs in the OR connection rotation code that
- caused directory servers to slowly aggregate connections to other
- fast Tor servers. This time for sure!
- - Make log entries on Win32 include the name of the function again.
- - We were treating a pair of exit policies if they were equal even
- if one said accept and the other said reject -- causing us to
- not always publish a new descriptor since we thought nothing
- had changed.
- - Retry pending server downloads as well as pending networkstatus
- downloads when we unexpectedly get a socks request.
- - We were ignoring the IS_FAST flag in the directory status,
- meaning we were willing to pick trivial-bandwidth nodes for "fast"
- connections.
- - If the controller's SAVECONF command fails (e.g. due to file
- permissions), let the controller know that it failed.
- o Features:
- - If we're trying to be a Tor server and running Windows 95/98/ME
- as a server, explain that we'll likely crash.
- - When we're a server, a client asks for an old-style directory,
- and our write bucket is empty, don't give it to him. This way
- small servers can continue to serve the directory *sometimes*,
- without getting overloaded.
- - Compress exit policies even more -- look for duplicate lines
- and remove them.
- - Clients now honor the "guard" flag in the router status when
- picking entry guards, rather than looking at is_fast or is_stable.
- - Retain unrecognized lines in $DATADIR/state file, so that we can
- be forward-compatible.
- - Generate 18.0.0.0/8 address policy format in descs when we can;
- warn when the mask is not reducible to a bit-prefix.
- - Let the user set ControlListenAddress in the torrc. This can be
- dangerous, but there are some cases (like a secured LAN) where it
- makes sense.
- - Split ReachableAddresses into ReachableDirAddresses and
- ReachableORAddresses, so we can restrict Dir conns to port 80
- and OR conns to port 443.
- - Now we can target arch and OS in rpm builds (contributed by
- Phobos). Also make the resulting dist-rpm filename match the
- target arch.
- - New config options to help controllers: FetchServerDescriptors
- and FetchHidServDescriptors for whether to fetch server
- info and hidserv info or let the controller do it, and
- PublishServerDescriptor and PublishHidServDescriptors.
- - Also let the controller set the __AllDirActionsPrivate config
- option if you want all directory fetches/publishes to happen via
- Tor (it assumes your controller bootstraps your circuits).
- Changes in version 0.1.0.17 - 2006-02-17
- o Crash bugfixes on 0.1.0.x:
- - When servers with a non-zero DirPort came out of hibernation,
- sometimes they would trigger an assert.
- o Other important bugfixes:
- - On platforms that don't have getrlimit (like Windows), we were
- artificially constraining ourselves to a max of 1024
- connections. Now just assume that we can handle as many as 15000
- connections. Hopefully this won't cause other problems.
- o Backported features:
- - When we're a server, a client asks for an old-style directory,
- and our write bucket is empty, don't give it to him. This way
- small servers can continue to serve the directory *sometimes*,
- without getting overloaded.
- - Whenever you get a 503 in response to a directory fetch, try
- once more. This will become important once servers start sending
- 503's whenever they feel busy.
- - Fetch a new directory every 120 minutes, not every 40 minutes.
- Now that we have hundreds of thousands of users running the old
- directory algorithm, it's starting to hurt a lot.
- - Bump up the period for forcing a hidden service descriptor upload
- from 20 minutes to 1 hour.
- Changes in version 0.1.1.13-alpha - 2006-02-09
- o Crashes in 0.1.1.x:
- - When you tried to setconf ORPort via the controller, Tor would
- crash. So people using TorCP to become a server were sad.
- - Solve (I hope) the stack-smashing bug that we were seeing on fast
- servers. The problem appears to be something do with OpenSSL's
- random number generation, or how we call it, or something. Let me
- know if the crashes continue.
- - Turn crypto hardware acceleration off by default, until we find
- somebody smart who can test it for us. (It appears to produce
- seg faults in at least some cases.)
- - Fix a rare assert error when we've tried all intro points for
- a hidden service and we try fetching the service descriptor again:
- "Assertion conn->state != AP_CONN_STATE_RENDDESC_WAIT failed"
- o Major fixes:
- - Fix a major load balance bug: we were round-robining in 16 KB
- chunks, and servers with bandwidthrate of 20 KB, while downloading
- a 600 KB directory, would starve their other connections. Now we
- try to be a bit more fair.
- - Dir authorities and mirrors were never expiring the newest
- descriptor for each server, causing memory and directory bloat.
- - Fix memory-bloating and connection-bloating bug on servers: We
- were never closing any connection that had ever had a circuit on
- it, because we were checking conn->n_circuits == 0, yet we had a
- bug that let it go negative.
- - Make Tor work using squid as your http proxy again -- squid
- returns an error if you ask for a URL that's too long, and it uses
- a really generic error message. Plus, many people are behind a
- transparent squid so they don't even realize it.
- - On platforms that don't have getrlimit (like Windows), we were
- artificially constraining ourselves to a max of 1024
- connections. Now just assume that we can handle as many as 15000
- connections. Hopefully this won't cause other problems.
- - Add a new config option ExitPolicyRejectPrivate which defaults to
- 1. This means all exit policies will begin with rejecting private
- addresses, unless the server operator explicitly turns it off.
- o Major features:
- - Clients no longer download descriptors for non-running
- descriptors.
- - Before we add new directory authorities, we should make it
- clear that only v1 authorities should receive/publish hidden
- service descriptors.
- o Minor features:
- - As soon as we've fetched some more directory info, immediately
- try to download more server descriptors. This way we don't have
- a 10 second pause during initial bootstrapping.
- - Remove even more loud log messages that the server operator can't
- do anything about.
- - When we're running an obsolete or un-recommended version, make
- the log message more clear about what the problem is and what
- versions *are* still recommended.
- - Provide a more useful warn message when our onion queue gets full:
- the CPU is too slow or the exit policy is too liberal.
- - Don't warn when we receive a 503 from a dirserver/cache -- this
- will pave the way for them being able to refuse if they're busy.
- - When we fail to bind a listener, try to provide a more useful
- log message: e.g., "Is Tor already running?"
- - Adjust tor-spec to parameterize cell and key lengths. Now Ian
- Goldberg can prove things about our handshake protocol more
- easily.
- - MaxConn has been obsolete for a while now. Document the ConnLimit
- config option, which is a *minimum* number of file descriptors
- that must be available else Tor refuses to start.
- - Apply Matt Ghali's --with-syslog-facility patch to ./configure
- if you log to syslog and want something other than LOG_DAEMON.
- - Make dirservers generate a separate "guard" flag to mean,
- "would make a good entry guard". Make clients parse it and vote
- on it. Not used by clients yet.
- - Implement --with-libevent-dir option to ./configure. Also, improve
- search techniques to find libevent, and use those for openssl too.
- - Bump the default bandwidthrate to 3 MB, and burst to 6 MB
- - Only start testing reachability once we've established a
- circuit. This will make startup on dirservers less noisy.
- - Don't try to upload hidden service descriptors until we have
- established a circuit.
- - Fix the controller's "attachstream 0" command to treat conn like
- it just connected, doing address remapping, handling .exit and
- .onion idioms, and so on. Now we're more uniform in making sure
- that the controller hears about new and closing connections.
- Changes in version 0.1.1.12-alpha - 2006-01-11
- o Bugfixes on 0.1.1.x:
- - The fix to close duplicate server connections was closing all
- Tor client connections if they didn't establish a circuit
- quickly enough. Oops.
- - Fix minor memory issue (double-free) that happened on exit.
- o Bugfixes on 0.1.0.x:
- - Tor didn't warn when it failed to open a log file.
- Changes in version 0.1.1.11-alpha - 2006-01-10
- o Crashes in 0.1.1.x:
- - Include all the assert/crash fixes from 0.1.0.16.
- - If you start Tor and then quit very quickly, there were some
- races that tried to free things that weren't allocated yet.
- - Fix a rare memory stomp if you're running hidden services.
- - Fix segfault when specifying DirServer in config without nickname.
- - Fix a seg fault when you finish connecting to a server but at
- that moment you dump his server descriptor.
- - Extendcircuit and Attachstream controller commands would
- assert/crash if you don't give them enough arguments.
- - Fix an assert error when we're out of space in the connection_list
- and we try to post a hidden service descriptor (reported by weasel).
- - If you specify a relative torrc path and you set RunAsDaemon in
- your torrc, then it chdir()'s to the new directory. If you HUP,
- it tries to load the new torrc location, fails, and exits.
- The fix: no longer allow a relative path to torrc using -f.
- o Major features:
- - Implement "entry guards": automatically choose a handful of entry
- nodes and stick with them for all circuits. Only pick new guards
- when the ones you have are unsuitable, and if the old guards
- become suitable again, switch back. This will increase security
- dramatically against certain end-point attacks. The EntryNodes
- config option now provides some hints about which entry guards you
- want to use most; and StrictEntryNodes means to only use those.
- - New directory logic: download by descriptor digest, not by
- fingerprint. Caches try to download all listed digests from
- authorities; clients try to download "best" digests from caches.
- This avoids partitioning and isolating attacks better.
- - Make the "stable" router flag in network-status be the median of
- the uptimes of running valid servers, and make clients pay
- attention to the network-status flags. Thus the cutoff adapts
- to the stability of the network as a whole, making IRC, IM, etc
- connections more reliable.
- o Major fixes:
- - Tor servers with dynamic IP addresses were needing to wait 18
- hours before they could start doing reachability testing using
- the new IP address and ports. This is because they were using
- the internal descriptor to learn what to test, yet they were only
- rebuilding the descriptor once they decided they were reachable.
- - Tor 0.1.1.9 and 0.1.1.10 had a serious bug that caused clients
- to download certain server descriptors, throw them away, and then
- fetch them again after 30 minutes. Now mirrors throw away these
- server descriptors so clients can't get them.
- - We were leaving duplicate connections to other ORs open for a week,
- rather than closing them once we detect a duplicate. This only
- really affected authdirservers, but it affected them a lot.
- - Spread the authdirservers' reachability testing over the entire
- testing interval, so we don't try to do 500 TLS's at once every
- 20 minutes.
- o Minor fixes:
- - If the network is down, and we try to connect to a conn because
- we have a circuit in mind, and we timeout (30 seconds) because the
- network never answers, we were expiring the circuit, but we weren't
- obsoleting the connection or telling the entry_guards functions.
- - Some Tor servers process billions of cells per day. These statistics
- need to be uint64_t's.
- - Check for integer overflows in more places, when adding elements
- to smartlists. This could possibly prevent a buffer overflow
- on malicious huge inputs. I don't see any, but I haven't looked
- carefully.
- - ReachableAddresses kept growing new "reject *:*" lines on every
- setconf/reload.
- - When you "setconf log" via the controller, it should remove all
- logs. We were automatically adding back in a "log notice stdout".
- - Newly bootstrapped Tor networks couldn't establish hidden service
- circuits until they had nodes with high uptime. Be more tolerant.
- - We were marking servers down when they could not answer every piece
- of the directory request we sent them. This was far too harsh.
- - Fix the torify (tsocks) config file to not use Tor for localhost
- connections.
- - Directory authorities now go to the proper authority when asking for
- a networkstatus, even when they want a compressed one.
- - Fix a harmless bug that was causing Tor servers to log
- "Got an end because of misc error, but we're not an AP. Closing."
- - Authorities were treating their own descriptor changes as cosmetic,
- meaning the descriptor available in the network-status and the
- descriptor that clients downloaded were different.
- - The OS X installer was adding a symlink for tor_resolve but
- the binary was called tor-resolve (reported by Thomas Hardly).
- - Workaround a problem with some http proxies where they refuse GET
- requests that specify "Content-Length: 0" (reported by Adrian).
- - Fix wrong log message when you add a "HiddenServiceNodes" config
- line without any HiddenServiceDir line (reported by Chris Thomas).
- o Minor features:
- - Write the TorVersion into the state file so we have a prayer of
- keeping forward and backward compatibility.
- - Revive the FascistFirewall config option rather than eliminating it:
- now it's a synonym for ReachableAddresses *:80,*:443.
- - Clients choose directory servers from the network status lists,
- not from their internal list of router descriptors. Now they can
- go to caches directly rather than needing to go to authorities
- to bootstrap.
- - Directory authorities ignore router descriptors that have only
- cosmetic differences: do this for 0.1.0.x servers now too.
- - Add a new flag to network-status indicating whether the server
- can answer v2 directory requests too.
- - Authdirs now stop whining so loudly about bad descriptors that
- they fetch from other dirservers. So when there's a log complaint,
- it's for sure from a freshly uploaded descriptor.
- - Reduce memory requirements in our structs by changing the order
- of fields.
- - There used to be two ways to specify your listening ports in a
- server descriptor: on the "router" line and with a separate "ports"
- line. Remove support for the "ports" line.
- - New config option "AuthDirRejectUnlisted" for auth dirservers as
- a panic button: if we get flooded with unusable servers we can
- revert to only listing servers in the approved-routers file.
- - Auth dir servers can now mark a fingerprint as "!reject" or
- "!invalid" in the approved-routers file (as its nickname), to
- refuse descriptors outright or include them but marked as invalid.
- - Servers store bandwidth history across restarts/crashes.
- - Add reasons to DESTROY and RELAY_TRUNCATED cells, so clients can
- get a better idea of why their circuits failed. Not used yet.
- - Directory mirrors now cache up to 16 unrecognized network-status
- docs. Now we can add new authdirservers and they'll be cached too.
- - When picking a random directory, prefer non-authorities if any
- are known.
- - New controller option "getinfo desc/all-recent" to fetch the
- latest server descriptor for every router that Tor knows about.
- Changes in version 0.1.0.16 - 2006-01-02
- o Crash bugfixes on 0.1.0.x:
- - On Windows, build with a libevent patch from "I-M Weasel" to avoid
- corrupting the heap, losing FDs, or crashing when we need to resize
- the fd_sets. (This affects the Win32 binaries, not Tor's sources.)
- - It turns out sparc64 platforms crash on unaligned memory access
- too -- so detect and avoid this.
- - Handle truncated compressed data correctly (by detecting it and
- giving an error).
- - Fix possible-but-unlikely free(NULL) in control.c.
- - When we were closing connections, there was a rare case that
- stomped on memory, triggering seg faults and asserts.
- - Avoid potential infinite recursion when building a descriptor. (We
- don't know that it ever happened, but better to fix it anyway.)
- - We were neglecting to unlink marked circuits from soon-to-close OR
- connections, which caused some rare scribbling on freed memory.
- - Fix a memory stomping race bug when closing the joining point of two
- rendezvous circuits.
- - Fix an assert in time parsing found by Steven Murdoch.
- o Other bugfixes on 0.1.0.x:
- - When we're doing reachability testing, provide more useful log
- messages so the operator knows what to expect.
- - Do not check whether DirPort is reachable when we are suppressing
- advertising it because of hibernation.
- - When building with -static or on Solaris, we sometimes needed -ldl.
- - When we're deciding whether a stream has enough circuits around
- that can handle it, count the freshly dirty ones and not the ones
- that are so dirty they won't be able to handle it.
- - When we're expiring old circuits, we had a logic error that caused
- us to close new rendezvous circuits rather than old ones.
- - Give a more helpful log message when you try to change ORPort via
- the controller: you should upgrade Tor if you want that to work.
- - We were failing to parse Tor versions that start with "Tor ".
- - Tolerate faulty streams better: when a stream fails for reason
- exitpolicy, stop assuming that the router is lying about his exit
- policy. When a stream fails for reason misc, allow it to retry just
- as if it was resolvefailed. When a stream has failed three times,
- reset its failure count so we can try again and get all three tries.
- Changes in version 0.1.1.10-alpha - 2005-12-11
- o Correctness bugfixes on 0.1.0.x:
- - On Windows, build with a libevent patch from "I-M Weasel" to avoid
- corrupting the heap, losing FDs, or crashing when we need to resize
- the fd_sets. (This affects the Win32 binaries, not Tor's sources.)
- - Stop doing the complex voodoo overkill checking for insecure
- Diffie-Hellman keys. Just check if it's in [2,p-2] and be happy.
- - When we were closing connections, there was a rare case that
- stomped on memory, triggering seg faults and asserts.
- - We were neglecting to unlink marked circuits from soon-to-close OR
- connections, which caused some rare scribbling on freed memory.
- - When we're deciding whether a stream has enough circuits around
- that can handle it, count the freshly dirty ones and not the ones
- that are so dirty they won't be able to handle it.
- - Recover better from TCP connections to Tor servers that are
- broken but don't tell you (it happens!); and rotate TLS
- connections once a week.
- - When we're expiring old circuits, we had a logic error that caused
- us to close new rendezvous circuits rather than old ones.
- - Fix a scary-looking but apparently harmless bug where circuits
- would sometimes start out in state CIRCUIT_STATE_OR_WAIT at
- servers, and never switch to state CIRCUIT_STATE_OPEN.
- - When building with -static or on Solaris, we sometimes needed to
- build with -ldl.
- - Give a useful message when people run Tor as the wrong user,
- rather than telling them to start chowning random directories.
- - We were failing to inform the controller about new .onion streams.
- o Security bugfixes on 0.1.0.x:
- - Refuse server descriptors if the fingerprint line doesn't match
- the included identity key. Tor doesn't care, but other apps (and
- humans) might actually be trusting the fingerprint line.
- - We used to kill the circuit when we receive a relay command we
- don't recognize. Now we just drop it.
- - Start obeying our firewall options more rigorously:
- . If we can't get to a dirserver directly, try going via Tor.
- . Don't ever try to connect (as a client) to a place our
- firewall options forbid.
- . If we specify a proxy and also firewall options, obey the
- firewall options even when we're using the proxy: some proxies
- can only proxy to certain destinations.
- - Fix a bug found by Lasse Overlier: when we were making internal
- circuits (intended to be cannibalized later for rendezvous and
- introduction circuits), we were picking them so that they had
- useful exit nodes. There was no need for this, and it actually
- aids some statistical attacks.
- - Start treating internal circuits and exit circuits separately.
- It's important to keep them separate because internal circuits
- have their last hops picked like middle hops, rather than like
- exit hops. So exiting on them will break the user's expectations.
- o Bugfixes on 0.1.1.x:
- - Take out the mis-feature where we tried to detect IP address
- flapping for people with DynDNS, and chose not to upload a new
- server descriptor sometimes.
- - Try to be compatible with OpenSSL 0.9.6 again.
- - Log fix: when the controller is logging about .onion addresses,
- sometimes it didn't include the ".onion" part of the address.
- - Don't try to modify options->DirServers internally -- if the
- user didn't specify any, just add the default ones directly to
- the trusted dirserver list. This fixes a bug where people running
- controllers would use SETCONF on some totally unrelated config
- option, and Tor would start yelling at them about changing their
- DirServer lines.
- - Let the controller's redirectstream command specify a port, in
- case the controller wants to change that too.
- - When we requested a pile of server descriptors, we sometimes
- accidentally launched a duplicate request for the first one.
- - Bugfix for trackhostexits: write down the fingerprint of the
- chosen exit, not its nickname, because the chosen exit might not
- be verified.
- - When parsing foo.exit, if foo is unknown, and we are leaving
- circuits unattached, set the chosen_exit field and leave the
- address empty. This matters because controllers got confused
- otherwise.
- - Directory authorities no longer try to download server
- descriptors that they know they will reject.
- o Features and updates:
- - Replace balanced trees with hash tables: this should make stuff
- significantly faster.
- - Resume using the AES counter-mode implementation that we ship,
- rather than OpenSSL's. Ours is significantly faster.
- - Many other CPU and memory improvements.
- - Add a new config option FastFirstHopPK (on by default) so clients
- do a trivial crypto handshake for their first hop, since TLS has
- already taken care of confidentiality and authentication.
- - Add a new config option TestSocks so people can see if their
- applications are using socks4, socks4a, socks5-with-ip, or
- socks5-with-hostname. This way they don't have to keep mucking
- with tcpdump and wondering if something got cached somewhere.
- - Warn when listening on a public address for socks. I suspect a
- lot of people are setting themselves up as open socks proxies,
- and they have no idea that jerks on the Internet are using them,
- since they simply proxy the traffic into the Tor network.
- - Add "private:*" as an alias in configuration for policies. Now
- you can simplify your exit policy rather than needing to list
- every single internal or nonroutable network space.
- - Add a new controller event type that allows controllers to get
- all server descriptors that were uploaded to a router in its role
- as authoritative dirserver.
- - Start shipping socks-extensions.txt, tor-doc-unix.html,
- tor-doc-server.html, and stylesheet.css in the tarball.
- - Stop shipping tor-doc.html in the tarball.
- Changes in version 0.1.1.9-alpha - 2005-11-15
- o Usability improvements:
- - Start calling it FooListenAddress rather than FooBindAddress,
- since few of our users know what it means to bind an address
- or port.
- - Reduce clutter in server logs. We're going to try to make
- them actually usable now. New config option ProtocolWarnings that
- lets you hear about how _other Tors_ are breaking the protocol. Off
- by default.
- - Divide log messages into logging domains. Once we put some sort
- of interface on this, it will let people looking at more verbose
- log levels specify the topics they want to hear more about.
- - Make directory servers return better http 404 error messages
- instead of a generic "Servers unavailable".
- - Check for even more Windows version flags when writing the platform
- string in server descriptors, and note any we don't recognize.
- - Clean up more of the OpenSSL memory when exiting, so we can detect
- memory leaks better.
- - Make directory authorities be non-versioning, non-naming by
- default. Now we can add new directory servers without requiring
- their operators to pay close attention.
- - When logging via syslog, include the pid whenever we provide
- a log entry. Suggested by Todd Fries.
- o Performance improvements:
- - Directory servers now silently throw away new descriptors that
- haven't changed much if the timestamps are similar. We do this to
- tolerate older Tor servers that upload a new descriptor every 15
- minutes. (It seemed like a good idea at the time.)
- - Inline bottleneck smartlist functions; use fast versions by default.
- - Add a "Map from digest to void*" abstraction digestmap_t so we
- can do less hex encoding/decoding. Use it in router_get_by_digest()
- to resolve a performance bottleneck.
- - Allow tor_gzip_uncompress to extract as much as possible from
- truncated compressed data. Try to extract as many
- descriptors as possible from truncated http responses (when
- DIR_PURPOSE_FETCH_ROUTERDESC).
- - Make circ->onionskin a pointer, not a static array. moria2 was using
- 125000 circuit_t's after it had been up for a few weeks, which
- translates to 20+ megs of wasted space.
- - The private half of our EDH handshake keys are now chosen out
- of 320 bits, not 1024 bits. (Suggested by Ian Goldberg.)
- o Security improvements:
- - Start making directory caches retain old routerinfos, so soon
- clients can start asking by digest of descriptor rather than by
- fingerprint of server.
- - Add half our entropy from RAND_poll in OpenSSL. This knows how
- to use egd (if present), openbsd weirdness (if present), vms/os2
- weirdness (if we ever port there), and more in the future.
- o Bugfixes on 0.1.0.x:
- - Do round-robin writes of at most 16 kB per write. This might be
- more fair on loaded Tor servers, and it might resolve our Windows
- crash bug. It might also slow things down.
- - Our TLS handshakes were generating a single public/private
- keypair for the TLS context, rather than making a new one for
- each new connections. Oops. (But we were still rotating them
- periodically, so it's not so bad.)
- - When we were cannibalizing a circuit with a particular exit
- node in mind, we weren't checking to see if that exit node was
- already present earlier in the circuit. Oops.
- - When a Tor server's IP changes (e.g. from a dyndns address),
- upload a new descriptor so clients will learn too.
- - Really busy servers were keeping enough circuits open on stable
- connections that they were wrapping around the circuit_id
- space. (It's only two bytes.) This exposed a bug where we would
- feel free to reuse a circuit_id even if it still exists but has
- been marked for close. Try to fix this bug. Some bug remains.
- - If we would close a stream early (e.g. it asks for a .exit that
- we know would refuse it) but the LeaveStreamsUnattached config
- option is set by the controller, then don't close it.
- o Bugfixes on 0.1.1.8-alpha:
- - Fix a big pile of memory leaks, some of them serious.
- - Do not try to download a routerdesc if we would immediately reject
- it as obsolete.
- - Resume inserting a newline between all router descriptors when
- generating (old style) signed directories, since our spec says
- we do.
- - When providing content-type application/octet-stream for
- server descriptors using .z, we were leaving out the
- content-encoding header. Oops. (Everything tolerated this just
- fine, but that doesn't mean we need to be part of the problem.)
- - Fix a potential seg fault in getconf and getinfo using version 1
- of the controller protocol.
- - Avoid crash: do not check whether DirPort is reachable when we
- are suppressing it because of hibernation.
- - Make --hash-password not crash on exit.
- Changes in version 0.1.1.8-alpha - 2005-10-07
- o New features (major):
- - Clients don't download or use the directory anymore. Now they
- download and use network-statuses from the trusted dirservers,
- and fetch individual server descriptors as needed from mirrors.
- See dir-spec.txt for all the gory details.
- - Be more conservative about whether to advertise our DirPort.
- The main change is to not advertise if we're running at capacity
- and either a) we could hibernate or b) our capacity is low and
- we're using a default DirPort.
- - Use OpenSSL's AES when OpenSSL has version 0.9.7 or later.
- o New features (minor):
- - Try to be smart about when to retry network-status and
- server-descriptor fetches. Still needs some tuning.
- - Stop parsing, storing, or using running-routers output (but
- mirrors still cache and serve it).
- - Consider a threshold of versioning dirservers (dirservers who have
- an opinion about which Tor versions are still recommended) before
- deciding whether to warn the user that he's obsolete.
- - Dirservers can now reject/invalidate by key and IP, with the
- config options "AuthDirInvalid" and "AuthDirReject". This is
- useful since currently we automatically list servers as running
- and usable even if we know they're jerks.
- - Provide dire warnings to any users who set DirServer; move it out
- of torrc.sample and into torrc.complete.
- - Add MyFamily to torrc.sample in the server section.
- - Add nicknames to the DirServer line, so we can refer to them
- without requiring all our users to memorize their IP addresses.
- - When we get an EOF or a timeout on a directory connection, note
- how many bytes of serverdesc we are dropping. This will help
- us determine whether it is smart to parse incomplete serverdesc
- responses.
- - Add a new function to "change pseudonyms" -- that is, to stop
- using any currently-dirty circuits for new streams, so we don't
- link new actions to old actions. Currently it's only called on
- HUP (or SIGNAL RELOAD).
- - On sighup, if UseHelperNodes changed to 1, use new circuits.
- - Start using RAND_bytes rather than RAND_pseudo_bytes from
- OpenSSL. Also, reseed our entropy every hour, not just at
- startup. And entropy in 512-bit chunks, not 160-bit chunks.
- o Fixes on 0.1.1.7-alpha:
- - Nobody ever implemented EVENT_ADDRMAP for control protocol
- version 0, so don't let version 0 controllers ask for it.
- - If you requested something with too many newlines via the
- v1 controller protocol, you could crash tor.
- - Fix a number of memory leaks, including some pretty serious ones.
- - Re-enable DirPort testing again, so Tor servers will be willing
- to advertise their DirPort if it's reachable.
- - On TLS handshake, only check the other router's nickname against
- its expected nickname if is_named is set.
- o Fixes forward-ported from 0.1.0.15:
- - Don't crash when we don't have any spare file descriptors and we
- try to spawn a dns or cpu worker.
- - Make the numbers in read-history and write-history into uint64s,
- so they don't overflow and publish negatives in the descriptor.
- o Fixes on 0.1.0.x:
- - For the OS X package's modified privoxy config file, comment
- out the "logfile" line so we don't log everything passed
- through privoxy.
- - We were whining about using socks4 or socks5-with-local-lookup
- even when it's an IP in the "virtual" range we designed exactly
- for this case.
- - We were leaking some memory every time the client changes IPs.
- - Never call free() on tor_malloc()d memory. This will help us
- use dmalloc to detect memory leaks.
- - Check for named servers when looking them up by nickname;
- warn when we'recalling a non-named server by its nickname;
- don't warn twice about the same name.
- - Try to list MyFamily elements by key, not by nickname, and warn
- if we've not heard of the server.
- - Make windows platform detection (uname equivalent) smarter.
- - It turns out sparc64 doesn't like unaligned access either.
- Changes in version 0.1.0.15 - 2005-09-23
- o Bugfixes on 0.1.0.x:
- - Reject ports 465 and 587 (spam targets) in default exit policy.
- - Don't crash when we don't have any spare file descriptors and we
- try to spawn a dns or cpu worker.
- - Get rid of IgnoreVersion undocumented config option, and make us
- only warn, never exit, when we're running an obsolete version.
- - Don't try to print a null string when your server finds itself to
- be unreachable and the Address config option is empty.
- - Make the numbers in read-history and write-history into uint64s,
- so they don't overflow and publish negatives in the descriptor.
- - Fix a minor memory leak in smartlist_string_remove().
- - We were only allowing ourselves to upload a server descriptor at
- most every 20 minutes, even if it changed earlier than that.
- - Clean up log entries that pointed to old URLs.
- Changes in version 0.1.1.7-alpha - 2005-09-14
- o Fixes on 0.1.1.6-alpha:
- - Exit servers were crashing when people asked them to make a
- connection to an address not in their exit policy.
- - Looking up a non-existent stream for a v1 control connection would
- cause a segfault.
- - Fix a seg fault if we ask a dirserver for a descriptor by
- fingerprint but he doesn't know about him.
- - SETCONF was appending items to linelists, not clearing them.
- - SETCONF SocksBindAddress killed Tor if it fails to bind. Now back
- out and refuse the setconf if it would fail.
- - Downgrade the dirserver log messages when whining about
- unreachability.
- o New features:
- - Add Peter Palfrader's check-tor script to tor/contrib/
- It lets you easily check whether a given server (referenced by
- nickname) is reachable by you.
- - Numerous changes to move towards client-side v2 directories. Not
- enabled yet.
- o Fixes on 0.1.0.x:
- - If the user gave tor an odd number of command-line arguments,
- we were silently ignoring the last one. Now we complain and fail.
- [This wins the oldest-bug prize -- this bug has been present since
- November 2002, as released in Tor 0.0.0.]
- - Do not use unaligned memory access on alpha, mips, or mipsel.
- It *works*, but is very slow, so we treat them as if it doesn't.
- - Retry directory requests if we fail to get an answer we like
- from a given dirserver (we were retrying before, but only if
- we fail to connect).
- - When writing the RecommendedVersions line, sort them first.
- - When the client asked for a rendezvous port that the hidden
- service didn't want to provide, we were sending an IP address
- back along with the end cell. Fortunately, it was zero. But stop
- that anyway.
- - Correct "your server is reachable" log entries to indicate that
- it was self-testing that told us so.
- Changes in version 0.1.1.6-alpha - 2005-09-09
- o Fixes on 0.1.1.5-alpha:
- - We broke fascistfirewall in 0.1.1.5-alpha. Oops.
- - Fix segfault in unit tests in 0.1.1.5-alpha. Oops.
- - Fix bug with tor_memmem finding a match at the end of the string.
- - Make unit tests run without segfaulting.
- - Resolve some solaris x86 compile warnings.
- - Handle duplicate lines in approved-routers files without warning.
- - Fix bug where as soon as a server refused any requests due to his
- exit policy (e.g. when we ask for localhost and he tells us that's
- 127.0.0.1 and he won't do it), we decided he wasn't obeying his
- exit policy using him for any exits.
- - Only do openssl hardware accelerator stuff if openssl version is
- at least 0.9.7.
- o New controller features/fixes:
- - Add a "RESETCONF" command so you can set config options like
- AllowUnverifiedNodes and LongLivedPorts to "". Also, if you give
- a config option in the torrc with no value, then it clears it
- entirely (rather than setting it to its default).
- - Add a "GETINFO config-file" to tell us where torrc is.
- - Avoid sending blank lines when GETINFO replies should be empty.
- - Add a QUIT command for the controller (for using it manually).
- - Fix a bug in SAVECONF that was adding default dirservers and
- other redundant entries to the torrc file.
- o Start on the new directory design:
- - Generate, publish, cache, serve new network-status format.
- - Publish individual descriptors (by fingerprint, by "all", and by
- "tell me yours").
- - Publish client and server recommended versions separately.
- - Allow tor_gzip_uncompress() to handle multiple concatenated
- compressed strings. Serve compressed groups of router
- descriptors. The compression logic here could be more
- memory-efficient.
- - Distinguish v1 authorities (all currently trusted directories)
- from v2 authorities (all trusted directories).
- - Change DirServers config line to note which dirs are v1 authorities.
- - Add configuration option "V1AuthoritativeDirectory 1" which
- moria1, moria2, and tor26 should set.
- - Remove option when getting directory cache to see whether they
- support running-routers; they all do now. Replace it with one
- to see whether caches support v2 stuff.
- o New features:
- - Dirservers now do their own external reachability testing of each
- Tor server, and only list them as running if they've been found to
- be reachable. We also send back warnings to the server's logs if
- it uploads a descriptor that we already believe is unreachable.
- - Implement exit enclaves: if we know an IP address for the
- destination, and there's a running Tor server at that address
- which allows exit to the destination, then extend the circuit to
- that exit first. This provides end-to-end encryption and end-to-end
- authentication. Also, if the user wants a .exit address or enclave,
- use 4 hops rather than 3, and cannibalize a general circ for it
- if you can.
- - Permit transitioning from ORPort=0 to ORPort!=0, and back, from the
- controller. Also, rotate dns and cpu workers if the controller
- changes options that will affect them; and initialize the dns
- worker cache tree whether or not we start out as a server.
- - Only upload a new server descriptor when options change, 18
- hours have passed, uptime is reset, or bandwidth changes a lot.
- - Check [X-]Forwarded-For headers in HTTP requests when generating
- log messages. This lets people run dirservers (and caches) behind
- Apache but still know which IP addresses are causing warnings.
- o Config option changes:
- - Replace (Fascist)Firewall* config options with a new
- ReachableAddresses option that understands address policies.
- For example, "ReachableAddresses *:80,*:443"
- - Get rid of IgnoreVersion undocumented config option, and make us
- only warn, never exit, when we're running an obsolete version.
- - Make MonthlyAccountingStart config option truly obsolete now.
- o Fixes on 0.1.0.x:
- - Reject ports 465 and 587 in the default exit policy, since
- people have started using them for spam too.
- - It turns out we couldn't bootstrap a network since we added
- reachability detection in 0.1.0.1-rc. Good thing the Tor network
- has never gone down. Add an AssumeReachable config option to let
- servers and dirservers bootstrap. When we're trying to build a
- high-uptime or high-bandwidth circuit but there aren't enough
- suitable servers, try being less picky rather than simply failing.
- - Our logic to decide if the OR we connected to was the right guy
- was brittle and maybe open to a mitm for unverified routers.
- - We weren't cannibalizing circuits correctly for
- CIRCUIT_PURPOSE_C_ESTABLISH_REND and
- CIRCUIT_PURPOSE_S_ESTABLISH_INTRO, so we were being forced to
- build those from scratch. This should make hidden services faster.
- - Predict required circuits better, with an eye toward making hidden
- services faster on the service end.
- - Retry streams if the exit node sends back a 'misc' failure. This
- should result in fewer random failures. Also, after failing
- from resolve failed or misc, reset the num failures, so we give
- it a fair shake next time we try.
- - Clean up the rendezvous warn log msgs, and downgrade some to info.
- - Reduce severity on logs about dns worker spawning and culling.
- - When we're shutting down and we do something like try to post a
- server descriptor or rendezvous descriptor, don't complain that
- we seem to be unreachable. Of course we are, we're shutting down.
- - Add TTLs to RESOLVED, CONNECTED, and END_REASON_EXITPOLICY cells.
- We don't use them yet, but maybe one day our DNS resolver will be
- able to discover them.
- - Make ContactInfo mandatory for authoritative directory servers.
- - Require server descriptors to list IPv4 addresses -- hostnames
- are no longer allowed. This also fixes some potential security
- problems with people providing hostnames as their address and then
- preferentially resolving them to partition users.
- - Change log line for unreachability to explicitly suggest /etc/hosts
- as the culprit. Also make it clearer what IP address and ports we're
- testing for reachability.
- - Put quotes around user-supplied strings when logging so users are
- more likely to realize if they add bad characters (like quotes)
- to the torrc.
- - Let auth dir servers start without specifying an Address config
- option.
- - Make unit tests (and other invocations that aren't the real Tor)
- run without launching listeners, creating subdirectories, and so on.
- Changes in version 0.1.1.5-alpha - 2005-08-08
- o Bugfixes included in 0.1.0.14.
- o Bugfixes on 0.1.0.x:
- - If you write "HiddenServicePort 6667 127.0.0.1 6668" in your
- torrc rather than "HiddenServicePort 6667 127.0.0.1:6668",
- it would silently using ignore the 6668.
- Changes in version 0.1.0.14 - 2005-08-08
- o Bugfixes on 0.1.0.x:
- - Fix the other half of the bug with crypto handshakes
- (CVE-2005-2643).
- - Fix an assert trigger if you send a 'signal term' via the
- controller when it's listening for 'event info' messages.
- Changes in version 0.1.1.4-alpha - 2005-08-04
- o Bugfixes included in 0.1.0.13.
- o Features:
- - Improve tor_gettimeofday() granularity on windows.
- - Make clients regenerate their keys when their IP address changes.
- - Implement some more GETINFO goodness: expose helper nodes, config
- options, getinfo keys.
- Changes in version 0.1.0.13 - 2005-08-04
- o Bugfixes on 0.1.0.x:
- - Fix a critical bug in the security of our crypto handshakes.
- - Fix a size_t underflow in smartlist_join_strings2() that made
- it do bad things when you hand it an empty smartlist.
- - Fix Windows installer to ship Tor license (thanks to Aphex for
- pointing out this oversight) and put a link to the doc directory
- in the start menu.
- - Explicitly set no-unaligned-access for sparc: it turns out the
- new gcc's let you compile broken code, but that doesn't make it
- not-broken.
- Changes in version 0.1.1.3-alpha - 2005-07-23
- o Bugfixes on 0.1.1.2-alpha:
- - Fix a bug in handling the controller's "post descriptor"
- function.
- - Fix several bugs in handling the controller's "extend circuit"
- function.
- - Fix a bug in handling the controller's "stream status" event.
- - Fix an assert failure if we have a controller listening for
- circuit events and we go offline.
- - Re-allow hidden service descriptors to publish 0 intro points.
- - Fix a crash when generating your hidden service descriptor if
- you don't have enough intro points already.
- o New features on 0.1.1.2-alpha:
- - New controller function "getinfo accounting", to ask how
- many bytes we've used in this time period.
- - Experimental support for helper nodes: a lot of the risk from
- a small static adversary comes because users pick new random
- nodes every time they rebuild a circuit. Now users will try to
- stick to the same small set of entry nodes if they can. Not
- enabled by default yet.
- o Bugfixes on 0.1.0.12:
- - If you're an auth dir server, always publish your dirport,
- even if you haven't yet found yourself to be reachable.
- - Fix a size_t underflow in smartlist_join_strings2() that made
- it do bad things when you hand it an empty smartlist.
- Changes in version 0.1.0.12 - 2005-07-18
- o New directory servers:
- - tor26 has changed IP address.
- o Bugfixes on 0.1.0.x:
- - Fix a possible double-free in tor_gzip_uncompress().
- - When --disable-threads is set, do not search for or link against
- pthreads libraries.
- - Don't trigger an assert if an authoritative directory server
- claims its dirport is 0.
- - Fix bug with removing Tor as an NT service: some people were
- getting "The service did not return an error." Thanks to Matt
- Edman for the fix.
- Changes in version 0.1.1.2-alpha - 2005-07-15
- o New directory servers:
- - tor26 has changed IP address.
- o Bugfixes on 0.1.0.x, crashes/leaks:
- - Port the servers-not-obeying-their-exit-policies fix from
- 0.1.0.11.
- - Fix an fd leak in start_daemon().
- - On Windows, you can't always reopen a port right after you've
- closed it. So change retry_listeners() to only close and re-open
- ports that have changed.
- - Fix a possible double-free in tor_gzip_uncompress().
- o Bugfixes on 0.1.0.x, usability:
- - When tor_socketpair() fails in Windows, give a reasonable
- Windows-style errno back.
- - Let people type "tor --install" as well as "tor -install" when
- they
- want to make it an NT service.
- - NT service patch from Matt Edman to improve error messages.
- - When the controller asks for a config option with an abbreviated
- name, give the full name in our response.
- - Correct the man page entry on TrackHostExitsExpire.
- - Looks like we were never delivering deflated (i.e. compressed)
- running-routers lists, even when asked. Oops.
- - When --disable-threads is set, do not search for or link against
- pthreads libraries.
- o Bugfixes on 0.1.1.x:
- - Fix a seg fault with autodetecting which controller version is
- being used.
- o Features:
- - New hidden service descriptor format: put a version in it, and
- let people specify introduction/rendezvous points that aren't
- in "the directory" (which is subjective anyway).
- - Allow the DEBUG controller event to work again. Mark certain log
- entries as "don't tell this to controllers", so we avoid cycles.
- Changes in version 0.1.0.11 - 2005-06-30
- o Bugfixes on 0.1.0.x:
- - Fix major security bug: servers were disregarding their
- exit policies if clients behaved unexpectedly.
- - Make OS X init script check for missing argument, so we don't
- confuse users who invoke it incorrectly.
- - Fix a seg fault in "tor --hash-password foo".
- - The MAPADDRESS control command was broken.
- Changes in version 0.1.1.1-alpha - 2005-06-29
- o Bugfixes:
- - Make OS X init script check for missing argument, so we don't
- confuse users who invoke it incorrectly.
- - Fix a seg fault in "tor --hash-password foo".
- - Fix a possible way to DoS dirservers.
- - When we complain that your exit policy implicitly allows local or
- private address spaces, name them explicitly so operators can
- fix it.
- - Make the log message less scary when all the dirservers are
- temporarily unreachable.
- - We were printing the number of idle dns workers incorrectly when
- culling them.
- o Features:
- - Revised controller protocol (version 1) that uses ascii rather
- than binary. Add supporting libraries in python and java so you
- can use the controller from your applications without caring how
- our protocol works.
- - Spiffy new support for crypto hardware accelerators. Can somebody
- test this?
- Changes in version 0.0.9.10 - 2005-06-16
- o Bugfixes on 0.0.9.x (backported from 0.1.0.10):
- - Refuse relay cells that claim to have a length larger than the
- maximum allowed. This prevents a potential attack that could read
- arbitrary memory (e.g. keys) from an exit server's process
- (CVE-2005-2050).
- Changes in version 0.1.0.10 - 2005-06-14
- o Allow a few EINVALs from libevent before dying. Warn on kqueue with
- libevent before 1.1a.
- Changes in version 0.1.0.9-rc - 2005-06-09
- o Bugfixes:
- - Reset buf->highwater every time buf_shrink() is called, not just on
- a successful shrink. This was causing significant memory bloat.
- - Fix buffer overflow when checking hashed passwords.
- - Security fix: if seeding the RNG on Win32 fails, quit.
- - Allow seeding the RNG on Win32 even when you're not running as
- Administrator.
- - Disable threading on Solaris too. Something is wonky with it,
- cpuworkers, and reentrant libs.
- - Reenable the part of the code that tries to flush as soon as an
- OR outbuf has a full TLS record available. Perhaps this will make
- OR outbufs not grow as huge except in rare cases, thus saving lots
- of CPU time plus memory.
- - Reject malformed .onion addresses rather then passing them on as
- normal web requests.
- - Adapt patch from Adam Langley: fix possible memory leak in
- tor_lookup_hostname().
- - Initialize libevent later in the startup process, so the logs are
- already established by the time we start logging libevent warns.
- - Use correct errno on win32 if libevent fails.
- - Check and warn about known-bad/slow libevent versions.
- - Pay more attention to the ClientOnly config option.
- - Have torctl.in/tor.sh.in check for location of su binary (needed
- on FreeBSD)
- - Correct/add man page entries for LongLivedPorts, ExitPolicy,
- KeepalivePeriod, ClientOnly, NoPublish, HttpProxy, HttpsProxy,
- HttpProxyAuthenticator
- - Stop warning about sigpipes in the logs. We're going to
- pretend that getting these occassionally is normal and fine.
- - Resolve OS X installer bugs: stop claiming to be 0.0.9.2 in
- certain
- installer screens; and don't put stuff into StartupItems unless
- the user asks you to.
- - Require servers that use the default dirservers to have public IP
- addresses. We have too many servers that are configured with private
- IPs and their admins never notice the log entries complaining that
- their descriptors are being rejected.
- - Add OSX uninstall instructions. An actual uninstall script will
- come later.
- Changes in version 0.1.0.8-rc - 2005-05-23
- o Bugfixes:
- - It turns out that kqueue on OS X 10.3.9 was causing kernel
- panics. Disable kqueue on all OS X Tors.
- - Fix RPM: remove duplicate line accidentally added to the rpm
- spec file.
- - Disable threads on openbsd too, since its gethostaddr is not
- reentrant either.
- - Tolerate libevent 0.8 since it still works, even though it's
- ancient.
- - Enable building on Red Hat 9.0 again.
- - Allow the middle hop of the testing circuit to be running any
- version, now that most of them have the bugfix to let them connect
- to unknown servers. This will allow reachability testing to work
- even when 0.0.9.7-0.0.9.9 become obsolete.
- - Handle relay cells with rh.length too large. This prevents
- a potential attack that could read arbitrary memory (maybe even
- keys) from the exit server's process.
- - We screwed up the dirport reachability testing when we don't yet
- have a cached version of the directory. Hopefully now fixed.
- - Clean up router_load_single_router() (used by the controller),
- so it doesn't seg fault on error.
- - Fix a minor memory leak when somebody establishes an introduction
- point at your Tor server.
- - If a socks connection ends because read fails, don't warn that
- you're not sending a socks reply back.
- o Features:
- - Add HttpProxyAuthenticator config option too, that works like
- the HttpsProxyAuthenticator config option.
- - Encode hashed controller passwords in hex instead of base64,
- to make it easier to write controllers.
- Changes in version 0.1.0.7-rc - 2005-05-17
- o Bugfixes:
- - Fix a bug in the OS X package installer that prevented it from
- installing on Tiger.
- - Fix a script bug in the OS X package installer that made it
- complain during installation.
- - Find libevent even if it's hiding in /usr/local/ and your
- CFLAGS and LDFLAGS don't tell you to look there.
- - Be able to link with libevent as a shared library (the default
- after 1.0d), even if it's hiding in /usr/local/lib and even
- if you haven't added /usr/local/lib to your /etc/ld.so.conf,
- assuming you're running gcc. Otherwise fail and give a useful
- error message.
- - Fix a bug in the RPM packager: set home directory for _tor to
- something more reasonable when first installing.
- - Free a minor amount of memory that is still reachable on exit.
- Changes in version 0.1.0.6-rc - 2005-05-14
- o Bugfixes:
- - Implement --disable-threads configure option. Disable threads on
- netbsd by default, because it appears to have no reentrant resolver
- functions.
- - Apple's OS X 10.4.0 ships with a broken kqueue. The new libevent
- release (1.1) detects and disables kqueue if it's broken.
- - Append default exit policy before checking for implicit internal
- addresses. Now we don't log a bunch of complaints on startup
- when using the default exit policy.
- - Some people were putting "Address " in their torrc, and they had
- a buggy resolver that resolved " " to 0.0.0.0. Oops.
- - If DataDir is ~/.tor, and that expands to /.tor, then default to
- LOCALSTATEDIR/tor instead.
- - Fix fragmented-message bug in TorControl.py.
- - Resolve a minor bug which would prevent unreachable dirports
- from getting suppressed in the published descriptor.
- - When the controller gave us a new descriptor, we weren't resolving
- it immediately, so Tor would think its address was 0.0.0.0 until
- we fetched a new directory.
- - Fix an uppercase/lowercase case error in suppressing a bogus
- libevent warning on some Linuxes.
- o Features:
- - Begin scrubbing sensitive strings from logs by default. Turn off
- the config option SafeLogging if you need to do debugging.
- - Switch to a new buffer management algorithm, which tries to avoid
- reallocing and copying quite as much. In first tests it looks like
- it uses *more* memory on average, but less cpu.
- - First cut at support for "create-fast" cells. Clients can use
- these when extending to their first hop, since the TLS already
- provides forward secrecy and authentication. Not enabled on
- clients yet.
- - When dirservers refuse a router descriptor, we now log its
- contactinfo, platform, and the poster's IP address.
- - Call tor_free_all instead of connections_free_all after forking, to
- save memory on systems that need to fork.
- - Whine at you if you're a server and you don't set your contactinfo.
- - Implement --verify-config command-line option to check if your torrc
- is valid without actually launching Tor.
- - Rewrite address "serifos.exit" to "localhost.serifos.exit"
- rather than just rejecting it.
- Changes in version 0.1.0.5-rc - 2005-04-27
- o Bugfixes:
- - Stop trying to print a null pointer if an OR conn fails because
- we didn't like its cert.
- o Features:
- - Switch our internal buffers implementation to use a ring buffer,
- to hopefully improve performance for fast servers a lot.
- - Add HttpsProxyAuthenticator support (basic auth only), based
- on patch from Adam Langley.
- - Bump the default BandwidthRate from 1 MB to 2 MB, to accommodate
- the fast servers that have been joining lately.
- - Give hidden service accesses extra time on the first attempt,
- since 60 seconds is often only barely enough. This might improve
- robustness more.
- - Improve performance for dirservers: stop re-parsing the whole
- directory every time you regenerate it.
- - Add more debugging info to help us find the weird dns freebsd
- pthreads bug; cleaner debug messages to help track future issues.
- Changes in version 0.0.9.9 - 2005-04-23
- o Bugfixes on 0.0.9.x:
- - If unofficial Tor clients connect and send weird TLS certs, our
- Tor server triggers an assert. This release contains a minimal
- backport from the broader fix that we put into 0.1.0.4-rc.
- Changes in version 0.1.0.4-rc - 2005-04-23
- o Bugfixes:
- - If unofficial Tor clients connect and send weird TLS certs, our
- Tor server triggers an assert. Stop asserting, and start handling
- TLS errors better in other situations too.
- - When the controller asks us to tell it about all the debug-level
- logs, it turns out we were generating debug-level logs while
- telling it about them, which turns into a bad loop. Now keep
- track of whether you're sending a debug log to the controller,
- and don't log when you are.
- - Fix the "postdescriptor" feature of the controller interface: on
- non-complete success, only say "done" once.
- o Features:
- - Clients are now willing to load balance over up to 2mB, not 1mB,
- of advertised bandwidth capacity.
- - Add a NoPublish config option, so you can be a server (e.g. for
- testing running Tor servers in other Tor networks) without
- publishing your descriptor to the primary dirservers.
- Changes in version 0.1.0.3-rc - 2005-04-08
- o Improvements on 0.1.0.2-rc:
- - Client now retries when streams end early for 'hibernating' or
- 'resource limit' reasons, rather than failing them.
- - More automated handling for dirserver operators:
- - Automatically approve nodes running 0.1.0.2-rc or later,
- now that the the reachability detection stuff is working.
- - Now we allow two unverified servers with the same nickname
- but different keys. But if a nickname is verified, only that
- nickname+key are allowed.
- - If you're an authdirserver connecting to an address:port,
- and it's not the OR you were expecting, forget about that
- descriptor. If he *was* the one you were expecting, then forget
- about all other descriptors for that address:port.
- - Allow servers to publish descriptors from 12 hours in the future.
- Corollary: only whine about clock skew from the dirserver if
- he's a trusted dirserver (since now even verified servers could
- have quite wrong clocks).
- - Adjust maximum skew and age for rendezvous descriptors: let skew
- be 48 hours rather than 90 minutes.
- - Efficiency improvements:
- - Keep a big splay tree of (circid,orconn)->circuit mappings to make
- it much faster to look up a circuit for each relay cell.
- - Remove most calls to assert_all_pending_dns_resolves_ok(),
- since they're eating our cpu on exit nodes.
- - Stop wasting time doing a case insensitive comparison for every
- dns name every time we do any lookup. Canonicalize the names to
- lowercase and be done with it.
- - Start sending 'truncated' cells back rather than destroy cells,
- if the circuit closes in front of you. This means we won't have
- to abandon partially built circuits.
- - Only warn once per nickname from add_nickname_list_to_smartlist
- per failure, so an entrynode or exitnode choice that's down won't
- yell so much.
- - Put a note in the torrc about abuse potential with the default
- exit policy.
- - Revise control spec and implementation to allow all log messages to
- be sent to controller with their severities intact (suggested by
- Matt Edman). Update TorControl to handle new log event types.
- - Provide better explanation messages when controller's POSTDESCRIPTOR
- fails.
- - Stop putting nodename in the Platform string in server descriptors.
- It doesn't actually help, and it is confusing/upsetting some people.
- o Bugfixes on 0.1.0.2-rc:
- - We were printing the host mask wrong in exit policies in server
- descriptors. This isn't a critical bug though, since we were still
- obeying the exit policy internally.
- - Fix Tor when compiled with libevent but without pthreads: move
- connection_unregister() from _connection_free() to
- connection_free().
- - Fix an assert trigger (already fixed in 0.0.9.x): when we have
- the rare mysterious case of accepting a conn on 0.0.0.0:0, then
- when we look through the connection array, we'll find any of the
- cpu/dnsworkers. This is no good.
- o Bugfixes on 0.0.9.8:
- - Fix possible bug on threading platforms (e.g. win32) which was
- leaking a file descriptor whenever a cpuworker or dnsworker died.
- - When using preferred entry or exit nodes, ignore whether the
- circuit wants uptime or capacity. They asked for the nodes, they
- get the nodes.
- - chdir() to your datadirectory at the *end* of the daemonize process,
- not the beginning. This was a problem because the first time you
- run tor, if your datadir isn't there, and you have runasdaemon set
- to 1, it will try to chdir to it before it tries to create it. Oops.
- - Handle changed router status correctly when dirserver reloads
- fingerprint file. We used to be dropping all unverified descriptors
- right then. The bug was hidden because we would immediately
- fetch a directory from another dirserver, which would include the
- descriptors we just dropped.
- - When we're connecting to an OR and he's got a different nickname/key
- than we were expecting, only complain loudly if we're an OP or a
- dirserver. Complaining loudly to the OR admins just confuses them.
- - Tie MAX_DIR_SIZE to MAX_BUF_SIZE, so now directory sizes won't get
- artificially capped at 500kB.
- Changes in version 0.0.9.8 - 2005-04-07
- o Bugfixes on 0.0.9.x:
- - We have a bug that I haven't found yet. Sometimes, very rarely,
- cpuworkers get stuck in the 'busy' state, even though the cpuworker
- thinks of itself as idle. This meant that no new circuits ever got
- established. Here's a workaround to kill any cpuworker that's been
- busy for more than 100 seconds.
- Changes in version 0.1.0.2-rc - 2005-04-01
- o Bugfixes on 0.1.0.1-rc:
- - Fixes on reachability detection:
- - Don't check for reachability while hibernating.
- - If ORPort is reachable but DirPort isn't, still publish the
- descriptor, but zero out DirPort until it's found reachable.
- - When building testing circs for ORPort testing, use only
- high-bandwidth nodes, so fewer circuits fail.
- - Complain about unreachable ORPort separately from unreachable
- DirPort, so the user knows what's going on.
- - Make sure we only conclude ORPort reachability if we didn't
- initiate the conn. Otherwise we could falsely conclude that
- we're reachable just because we connected to the guy earlier
- and he used that same pipe to extend to us.
- - Authdirservers shouldn't do ORPort reachability detection,
- since they're in clique mode, so it will be rare to find a
- server not already connected to them.
- - When building testing circuits, always pick middle hops running
- Tor 0.0.9.7, so we avoid the "can't extend to unknown routers"
- bug. (This is a kludge; it will go away when 0.0.9.x becomes
- obsolete.)
- - When we decide we're reachable, actually publish our descriptor
- right then.
- - Fix bug in redirectstream in the controller.
- - Fix the state descriptor strings so logs don't claim edge streams
- are in a different state than they actually are.
- - Use recent libevent features when possible (this only really affects
- win32 and osx right now, because the new libevent with these
- features hasn't been released yet). Add code to suppress spurious
- libevent log msgs.
- - Prevent possible segfault in connection_close_unattached_ap().
- - Fix newlines on torrc in win32.
- - Improve error msgs when tor-resolve fails.
- o Improvements on 0.0.9.x:
- - New experimental script tor/contrib/ExerciseServer.py (needs more
- work) that uses the controller interface to build circuits and
- fetch pages over them. This will help us bootstrap servers that
- have lots of capacity but haven't noticed it yet.
- - New experimental script tor/contrib/PathDemo.py (needs more work)
- that uses the controller interface to let you choose whole paths
- via addresses like
- "<hostname>.<path,separated by dots>.<length of path>.path"
- - When we've connected to an OR and handshaked but didn't like
- the result, we were closing the conn without sending destroy
- cells back for pending circuits. Now send those destroys.
- Changes in version 0.0.9.7 - 2005-04-01
- o Bugfixes on 0.0.9.x:
- - Fix another race crash bug (thanks to Glenn Fink for reporting).
- - Compare identity to identity, not to nickname, when extending to
- a router not already in the directory. This was preventing us from
- extending to unknown routers. Oops.
- - Make sure to create OS X Tor user in <500 range, so we aren't
- creating actual system users.
- - Note where connection-that-hasn't-sent-end was marked, and fix
- a few really loud instances of this harmless bug (it's fixed more
- in 0.1.0.x).
- Changes in version 0.1.0.1-rc - 2005-03-28
- o New features:
- - Add reachability testing. Your Tor server will automatically try
- to see if its ORPort and DirPort are reachable from the outside,
- and it won't upload its descriptor until it decides they are.
- - Handle unavailable hidden services better. Handle slow or busy
- hidden services better.
- - Add support for CONNECTing through https proxies, with "HttpsProxy"
- config option.
- - New exit policy: accept most low-numbered ports, rather than
- rejecting most low-numbered ports.
- - More Tor controller support (still experimental). See
- http://tor.eff.org/doc/control-spec.txt for all the new features,
- including signals to emulate unix signals from any platform;
- redirectstream; extendcircuit; mapaddress; getinfo; postdescriptor;
- closestream; closecircuit; etc.
- - Make nt services work and start on startup on win32 (based on
- patch by Matt Edman).
- - Add a new AddressMap config directive to rewrite incoming socks
- addresses. This lets you, for example, declare an implicit
- required exit node for certain sites.
- - Add a new TrackHostExits config directive to trigger addressmaps
- for certain incoming socks addresses -- for sites that break when
- your exit keeps changing (based on patch by Mike Perry).
- - Redo the client-side dns cache so it's just an addressmap too.
- - Notice when our IP changes, and reset stats/uptime/reachability.
- - When an application is using socks5, give him the whole variety of
- potential socks5 responses (connect refused, host unreachable, etc),
- rather than just "success" or "failure".
- - A more sane version numbering system. See
- http://tor.eff.org/cvs/tor/doc/version-spec.txt for details.
- - New contributed script "exitlist": a simple python script to
- parse directories and find Tor nodes that exit to listed
- addresses/ports.
- - New contributed script "privoxy-tor-toggle" to toggle whether
- Privoxy uses Tor. Seems to be configured for Debian by default.
- - Report HTTP reasons to client when getting a response from directory
- servers -- so you can actually know what went wrong.
- - New config option MaxAdvertisedBandwidth which lets you advertise
- a low bandwidthrate (to not attract as many circuits) while still
- allowing a higher bandwidthrate in reality.
- o Robustness/stability fixes:
- - Make Tor use Niels Provos's libevent instead of its current
- poll-but-sometimes-select mess. This will let us use faster async
- cores (like epoll, kpoll, and /dev/poll), and hopefully work better
- on Windows too.
- - pthread support now too. This was forced because when we forked,
- we ended up wasting a lot of duplicate ram over time. Also switch
- to foo_r versions of some library calls to allow reentry and
- threadsafeness.
- - Better handling for heterogeneous / unreliable nodes:
- - Annotate circuits w/ whether they aim to contain high uptime nodes
- and/or high capacity nodes. When building circuits, choose
- appropriate nodes.
- - This means that every single node in an intro rend circuit,
- not just the last one, will have a minimum uptime.
- - New config option LongLivedPorts to indicate application streams
- that will want high uptime circuits.
- - Servers reset uptime when a dir fetch entirely fails. This
- hopefully reflects stability of the server's network connectivity.
- - If somebody starts his tor server in Jan 2004 and then fixes his
- clock, don't make his published uptime be a year.
- - Reset published uptime when you wake up from hibernation.
- - Introduce a notion of 'internal' circs, which are chosen without
- regard to the exit policy of the last hop. Intro and rendezvous
- circs must be internal circs, to avoid leaking information. Resolve
- and connect streams can use internal circs if they want.
- - New circuit pooling algorithm: make sure to have enough circs around
- to satisfy any predicted ports, and also make sure to have 2 internal
- circs around if we've required internal circs lately (and with high
- uptime if we've seen that lately too).
- - Split NewCircuitPeriod option into NewCircuitPeriod (30 secs),
- which describes how often we retry making new circuits if current
- ones are dirty, and MaxCircuitDirtiness (10 mins), which describes
- how long we're willing to make use of an already-dirty circuit.
- - Cannibalize GENERAL circs to be C_REND, C_INTRO, S_INTRO, and S_REND
- circ as necessary, if there are any completed ones lying around
- when we try to launch one.
- - Make hidden services try to establish a rendezvous for 30 seconds,
- rather than for n (where n=3) attempts to build a circuit.
- - Change SHUTDOWN_WAIT_LENGTH from a fixed 30 secs to a config option
- "ShutdownWaitLength".
- - Try to be more zealous about calling connection_edge_end when
- things go bad with edge conns in connection.c.
- - Revise tor-spec to add more/better stream end reasons.
- - Revise all calls to connection_edge_end to avoid sending "misc",
- and to take errno into account where possible.
- o Bug fixes:
- - Fix a race condition that can trigger an assert, when we have a
- pending create cell and an OR connection fails right then.
- - Fix several double-mark-for-close bugs, e.g. where we were finding
- a conn for a cell even if that conn is already marked for close.
- - Make sequence of log messages when starting on win32 with no config
- file more reasonable.
- - When choosing an exit node for a new non-internal circ, don't take
- into account whether it'll be useful for any pending x.onion
- addresses -- it won't.
- - Turn addr_policy_compare from a tristate to a quadstate; this should
- help address our "Ah, you allow 1.2.3.4:80. You are a good choice
- for google.com" problem.
- - Make "platform" string in descriptor more accurate for Win32 servers,
- so it's not just "unknown platform".
- - Fix an edge case in parsing config options (thanks weasel).
- If they say "--" on the commandline, it's not an option.
- - Reject odd-looking addresses at the client (e.g. addresses that
- contain a colon), rather than having the server drop them because
- they're malformed.
- - tor-resolve requests were ignoring .exit if there was a working circuit
- they could use instead.
- - REUSEADDR on normal platforms means you can rebind to the port
- right after somebody else has let it go. But REUSEADDR on win32
- means to let you bind to the port _even when somebody else
- already has it bound_! So, don't do that on Win32.
- - Change version parsing logic: a version is "obsolete" if it is not
- recommended and (1) there is a newer recommended version in the
- same series, or (2) there are no recommended versions in the same
- series, but there are some recommended versions in a newer series.
- A version is "new" if it is newer than any recommended version in
- the same series.
- - Stop most cases of hanging up on a socks connection without sending
- the socks reject.
- o Helpful fixes:
- - Require BandwidthRate to be at least 20kB/s for servers.
- - When a dirserver causes you to give a warn, mention which dirserver
- it was.
- - New config option DirAllowPrivateAddresses for authdirservers.
- Now by default they refuse router descriptors that have non-IP or
- private-IP addresses.
- - Stop publishing socksport in the directory, since it's not
- actually meant to be public. For compatibility, publish a 0 there
- for now.
- - Change DirFetchPeriod/StatusFetchPeriod to have a special "Be
- smart" value, that is low for servers and high for clients.
- - If our clock jumps forward by 100 seconds or more, assume something
- has gone wrong with our network and abandon all not-yet-used circs.
- - Warn when exit policy implicitly allows local addresses.
- - If we get an incredibly skewed timestamp from a dirserver mirror
- that isn't a verified OR, don't warn -- it's probably him that's
- wrong.
- - Since we ship our own Privoxy on OS X, tweak it so it doesn't write
- cookies to disk and doesn't log each web request to disk. (Thanks
- to Brett Carrington for pointing this out.)
- - When a client asks us for a dir mirror and we don't have one,
- launch an attempt to get a fresh one.
- - If we're hibernating and we get a SIGINT, exit immediately.
- - Add --with-dmalloc ./configure option, to track memory leaks.
- - And try to free all memory on closing, so we can detect what
- we're leaking.
- - Cache local dns resolves correctly even when they're .exit
- addresses.
- - Give a better warning when some other server advertises an
- ORPort that is actually an apache running ssl.
- - Add "opt hibernating 1" to server descriptor to make it clearer
- whether the server is hibernating.
- Changes in version 0.0.9.6 - 2005-03-24
- o Bugfixes on 0.0.9.x (crashes and asserts):
- - Add new end stream reasons to maintainance branch. Fix bug where
- reason (8) could trigger an assert. Prevent bug from recurring.
- - Apparently win32 stat wants paths to not end with a slash.
- - Fix assert triggers in assert_cpath_layer_ok(), where we were
- blowing away the circuit that conn->cpath_layer points to, then
- checking to see if the circ is well-formed. Backport check to make
- sure we dont use the cpath on a closed connection.
- - Prevent circuit_resume_edge_reading_helper() from trying to package
- inbufs for marked-for-close streams.
- - Don't crash on hup if your options->address has become unresolvable.
- - Some systems (like OS X) sometimes accept() a connection and tell
- you the remote host is 0.0.0.0:0. If this happens, due to some
- other mis-features, we get confused; so refuse the conn for now.
- o Bugfixes on 0.0.9.x (other):
- - Fix harmless but scary "Unrecognized content encoding" warn message.
- - Add new stream error reason: TORPROTOCOL reason means "you are not
- speaking a version of Tor I understand; say bye-bye to your stream."
- - Be willing to cache directories from up to ROUTER_MAX_AGE seconds
- into the future, now that we are more tolerant of skew. This
- resolves a bug where a Tor server would refuse to cache a directory
- because all the directories it gets are too far in the future;
- yet the Tor server never logs any complaints about clock skew.
- - Mac packaging magic: make man pages useable, and do not overwrite
- existing torrc files.
- - Make OS X log happily to /var/log/tor/tor.log
- Changes in version 0.0.9.5 - 2005-02-22
- o Bugfixes on 0.0.9.x:
- - Fix an assert race at exit nodes when resolve requests fail.
- - Stop picking unverified dir mirrors--it only leads to misery.
- - Patch from Matt Edman to make NT services work better. Service
- support is still not compiled into the executable by default.
- - Patch from Dmitri Bely so the Tor service runs better under
- the win32 SYSTEM account.
- - Make tor-resolve actually work (?) on Win32.
- - Fix a sign bug when getrlimit claims to have 4+ billion
- file descriptors available.
- - Stop refusing to start when bandwidthburst == bandwidthrate.
- - When create cells have been on the onion queue more than five
- seconds, just send back a destroy and take them off the list.
- Changes in version 0.0.9.4 - 2005-02-03
- o Bugfixes on 0.0.9:
- - Fix an assert bug that took down most of our servers: when
- a server claims to have 1 GB of bandwidthburst, don't
- freak out.
- - Don't crash as badly if we have spawned the max allowed number
- of dnsworkers, or we're out of file descriptors.
- - Block more file-sharing ports in the default exit policy.
- - MaxConn is now automatically set to the hard limit of max
- file descriptors we're allowed (ulimit -n), minus a few for
- logs, etc.
- - Give a clearer message when servers need to raise their
- ulimit -n when they start running out of file descriptors.
- - SGI Compatibility patches from Jan Schaumann.
- - Tolerate a corrupt cached directory better.
- - When a dirserver hasn't approved your server, list which one.
- - Go into soft hibernation after 95% of the bandwidth is used,
- not 99%. This is especially important for daily hibernators who
- have a small accounting max. Hopefully it will result in fewer
- cut connections when the hard hibernation starts.
- - Load-balance better when using servers that claim more than
- 800kB/s of capacity.
- - Make NT services work (experimental, only used if compiled in).
- Changes in version 0.0.9.3 - 2005-01-21
- o Bugfixes on 0.0.9:
- - Backport the cpu use fixes from main branch, so busy servers won't
- need as much processor time.
- - Work better when we go offline and then come back, or when we
- run Tor at boot before the network is up. We do this by
- optimistically trying to fetch a new directory whenever an
- application request comes in and we think we're offline -- the
- human is hopefully a good measure of when the network is back.
- - Backport some minimal hidserv bugfixes: keep rend circuits open as
- long as you keep using them; actually publish hidserv descriptors
- shortly after they change, rather than waiting 20-40 minutes.
- - Enable Mac startup script by default.
- - Fix duplicate dns_cancel_pending_resolve reported by Giorgos Pallas.
- - When you update AllowUnverifiedNodes or FirewallPorts via the
- controller's setconf feature, we were always appending, never
- resetting.
- - When you update HiddenServiceDir via setconf, it was screwing up
- the order of reading the lines, making it fail.
- - Do not rewrite a cached directory back to the cache; otherwise we
- will think it is recent and not fetch a newer one on startup.
- - Workaround for webservers that lie about Content-Encoding: Tor
- now tries to autodetect compressed directories and compression
- itself. This lets us Proxypass dir fetches through apache.
- Changes in version 0.0.9.2 - 2005-01-04
- o Bugfixes on 0.0.9 (crashes and asserts):
- - Fix an assert on startup when the disk is full and you're logging
- to a file.
- - If you do socks4 with an IP of 0.0.0.x but *don't* provide a socks4a
- style address, then we'd crash.
- - Fix an assert trigger when the running-routers string we get from
- a dirserver is broken.
- - Make worker threads start and run on win32. Now win32 servers
- may work better.
- - Bandaid (not actually fix, but now it doesn't crash) an assert
- where the dns worker dies mysteriously and the main Tor process
- doesn't remember anything about the address it was resolving.
- o Bugfixes on 0.0.9 (Win32):
- - Workaround for brain-damaged __FILE__ handling on MSVC: keep Nick's
- name out of the warning/assert messages.
- - Fix a superficial "unhandled error on read" bug on win32.
- - The win32 installer no longer requires a click-through for our
- license, since our Free Software license grants rights but does not
- take any away.
- - Win32: When connecting to a dirserver fails, try another one
- immediately. (This was already working for non-win32 Tors.)
- - Stop trying to parse $HOME on win32 when hunting for default
- DataDirectory.
- - Make tor-resolve.c work on win32 by calling network_init().
- o Bugfixes on 0.0.9 (other):
- - Make 0.0.9.x build on Solaris again.
- - Due to a fencepost error, we were blowing away the \n when reporting
- confvalue items in the controller. So asking for multiple config
- values at once couldn't work.
- - When listing circuits that are pending on an opening OR connection,
- if we're an OR we were listing circuits that *end* at us as
- being pending on every listener, dns/cpu worker, etc. Stop that.
- - Dirservers were failing to create 'running-routers' or 'directory'
- strings if we had more than some threshold of routers. Fix them so
- they can handle any number of routers.
- - Fix a superficial "Duplicate mark for close" bug.
- - Stop checking for clock skew for OR connections, even for servers.
- - Fix a fencepost error that was chopping off the last letter of any
- nickname that is the maximum allowed nickname length.
- - Update URLs in log messages so they point to the new website.
- - Fix a potential problem in mangling server private keys while
- writing to disk (not triggered yet, as far as we know).
- - Include the licenses for other free software we include in Tor,
- now that we're shipping binary distributions more regularly.
- Changes in version 0.0.9.1 - 2004-12-15
- o Bugfixes on 0.0.9:
- - Make hibernation actually work.
- - Make HashedControlPassword config option work.
- - When we're reporting event circuit status to a controller,
- don't use the stream status code.
- Changes in version 0.0.9 - 2004-12-12
- o Cleanups:
- - Clean up manpage and torrc.sample file.
- - Clean up severities and text of log warnings.
- o Mistakes:
- - Make servers trigger an assert when they enter hibernation.
- Changes in version 0.0.9rc7 - 2004-12-08
- o Bugfixes on 0.0.9rc:
- - Fix a stack-trashing crash when an exit node begins hibernating.
- - Avoid looking at unallocated memory while considering which
- ports we need to build circuits to cover.
- - Stop a sigpipe: when an 'end' cell races with eof from the app,
- we shouldn't hold-open-until-flush if the eof arrived first.
- - Fix a bug with init_cookie_authentication() in the controller.
- - When recommending new-format log lines, if the upper bound is
- LOG_ERR, leave it implicit.
- o Bugfixes on 0.0.8.1:
- - Fix a whole slew of memory leaks.
- - Fix isspace() and friends so they still make Solaris happy
- but also so they don't trigger asserts on win32.
- - Fix parse_iso_time on platforms without strptime (eg win32).
- - win32: tolerate extra "readable" events better.
- - win32: when being multithreaded, leave parent fdarray open.
- - Make unit tests work on win32.
- Changes in version 0.0.9rc6 - 2004-12-06
- o Bugfixes on 0.0.9pre:
- - Clean up some more integer underflow opportunities (not exploitable
- we think).
- - While hibernating, hup should not regrow our listeners.
- - Send an end to the streams we close when we hibernate, rather
- than just chopping them off.
- - React to eof immediately on non-open edge connections.
- o Bugfixes on 0.0.8.1:
- - Calculate timeout for waiting for a connected cell from the time
- we sent the begin cell, not from the time the stream started. If
- it took a long time to establish the circuit, we would time out
- right after sending the begin cell.
- - Fix router_compare_addr_to_addr_policy: it was not treating a port
- of * as always matching, so we were picking reject *:* nodes as
- exit nodes too. Oops.
- o Features:
- - New circuit building strategy: keep a list of ports that we've
- used in the past 6 hours, and always try to have 2 circuits open
- or on the way that will handle each such port. Seed us with port
- 80 so web users won't complain that Tor is "slow to start up".
- - Make kill -USR1 dump more useful stats about circuits.
- - When warning about retrying or giving up, print the address, so
- the user knows which one it's talking about.
- - If you haven't used a clean circuit in an hour, throw it away,
- just to be on the safe side. (This means after 6 hours a totally
- unused Tor client will have no circuits open.)
- Changes in version 0.0.9rc5 - 2004-12-01
- o Bugfixes on 0.0.8.1:
- - Disallow NDEBUG. We don't ever want anybody to turn off debug.
- - Let resolve conns retry/expire also, rather than sticking around
- forever.
- - If we are using select, make sure we stay within FD_SETSIZE.
- o Bugfixes on 0.0.9pre:
- - Fix integer underflow in tor_vsnprintf() that may be exploitable,
- but doesn't seem to be currently; thanks to Ilja van Sprundel for
- finding it.
- - If anybody set DirFetchPostPeriod, give them StatusFetchPeriod
- instead. Impose minima and maxima for all *Period options; impose
- even tighter maxima for fetching if we are a caching dirserver.
- Clip rather than rejecting.
- - Fetch cached running-routers from servers that serve it (that is,
- authdirservers and servers running 0.0.9rc5-cvs or later.)
- o Features:
- - Accept *:706 (silc) in default exit policy.
- - Implement new versioning format for post 0.1.
- - Support "foo.nickname.exit" addresses, to let Alice request the
- address "foo" as viewed by exit node "nickname". Based on a patch
- by Geoff Goodell.
- - Make tor --version --version dump the cvs Id of every file.
- Changes in version 0.0.9rc4 - 2004-11-28
- o Bugfixes on 0.0.8.1:
- - Make windows sockets actually non-blocking (oops), and handle
- win32 socket errors better.
- o Bugfixes on 0.0.9rc1:
- - Actually catch the -USR2 signal.
- Changes in version 0.0.9rc3 - 2004-11-25
- o Bugfixes on 0.0.8.1:
- - Flush the log file descriptor after we print "Tor opening log file",
- so we don't see those messages days later.
- o Bugfixes on 0.0.9rc1:
- - Make tor-resolve work again.
- - Avoid infinite loop in tor-resolve if tor hangs up on it.
- - Fix an assert trigger for clients/servers handling resolves.
- Changes in version 0.0.9rc2 - 2004-11-24
- o Bugfixes on 0.0.9rc1:
- - I broke socks5 support while fixing the eof bug.
- - Allow unitless bandwidths and intervals; they default to bytes
- and seconds.
- - New servers don't start out hibernating; they are active until
- they run out of bytes, so they have a better estimate of how
- long it takes, and so their operators can know they're working.
- Changes in version 0.0.9rc1 - 2004-11-23
- o Bugfixes on 0.0.8.1:
- - Finally fix a bug that's been plaguing us for a year:
- With high load, circuit package window was reaching 0. Whenever
- we got a circuit-level sendme, we were reading a lot on each
- socket, but only writing out a bit. So we would eventually reach
- eof. This would be noticed and acted on even when there were still
- bytes sitting in the inbuf.
- - When poll() is interrupted, we shouldn't believe the revents values.
- o Bugfixes on 0.0.9pre6:
- - Fix hibernate bug that caused pre6 to be broken.
- - Don't keep rephist info for routers that haven't had activity for
- 24 hours. (This matters now that clients have keys, since we track
- them too.)
- - Never call close_temp_logs while validating log options.
- - Fix backslash-escaping on tor.sh.in and torctl.in.
- o Features:
- - Implement weekly/monthly/daily accounting: now you specify your
- hibernation properties by
- AccountingMax N bytes|KB|MB|GB|TB
- AccountingStart day|week|month [day] HH:MM
- Defaults to "month 1 0:00".
- - Let bandwidth and interval config options be specified as 5 bytes,
- kb, kilobytes, etc; and as seconds, minutes, hours, days, weeks.
- - kill -USR2 now moves all logs to loglevel debug (kill -HUP to
- get back to normal.)
- - If your requested entry or exit node has advertised bandwidth 0,
- pick it anyway.
- - Be more greedy about filling up relay cells -- we try reading again
- once we've processed the stuff we read, in case enough has arrived
- to fill the last cell completely.
- - Apply NT service patch from Osamu Fujino. Still needs more work.
- Changes in version 0.0.9pre6 - 2004-11-15
- o Bugfixes on 0.0.8.1:
- - Fix assert failure on malformed socks4a requests.
- - Use identity comparison, not nickname comparison, to choose which
- half of circuit-ID-space each side gets to use. This is needed
- because sometimes we think of a router as a nickname, and sometimes
- as a hex ID, and we can't predict what the other side will do.
- - Catch and ignore SIGXFSZ signals when log files exceed 2GB; our
- write() call will fail and we handle it there.
- - Add a FAST_SMARTLIST define to optionally inline smartlist_get
- and smartlist_len, which are two major profiling offenders.
- o Bugfixes on 0.0.9pre5:
- - Fix a bug in read_all that was corrupting config files on windows.
- - When we're raising the max number of open file descriptors to
- 'unlimited', don't log that we just raised it to '-1'.
- - Include event code with events, as required by control-spec.txt.
- - Don't give a fingerprint when clients do --list-fingerprint:
- it's misleading, because it will never be the same again.
- - Stop using strlcpy in tor_strndup, since it was slowing us
- down a lot.
- - Remove warn on startup about missing cached-directory file.
- - Make kill -USR1 work again.
- - Hibernate if we start tor during the "wait for wakeup-time" phase
- of an accounting interval. Log our hibernation plans better.
- - Authoritative dirservers now also cache their directory, so they
- have it on start-up.
- o Features:
- - Fetch running-routers; cache running-routers; compress
- running-routers; serve compressed running-routers.z
- - Add NSI installer script contributed by J Doe.
- - Commit VC6 and VC7 workspace/project files.
- - Commit a tor.spec for making RPM files, with help from jbash.
- - Add contrib/torctl.in contributed by Glenn Fink.
- - Implement the control-spec's SAVECONF command, to write your
- configuration to torrc.
- - Get cookie authentication for the controller closer to working.
- - Include control-spec.txt in the tarball.
- - When set_conf changes our server descriptor, upload a new copy.
- But don't upload it too often if there are frequent changes.
- - Document authentication config in man page, and document signals
- we catch.
- - Clean up confusing parts of man page and torrc.sample.
- - Make expand_filename handle ~ and ~username.
- - Use autoconf to enable largefile support where necessary. Use
- ftello where available, since ftell can fail at 2GB.
- - Distinguish between TOR_TLS_CLOSE and TOR_TLS_ERROR, so we can
- log more informatively.
- - Give a slightly more useful output for "tor -h".
- - Refuse application socks connections to port 0.
- - Check clock skew for verified servers, but allow unverified
- servers and clients to have any clock skew.
- - Break DirFetchPostPeriod into:
- - DirFetchPeriod for fetching full directory,
- - StatusFetchPeriod for fetching running-routers,
- - DirPostPeriod for posting server descriptor,
- - RendPostPeriod for posting hidden service descriptors.
- - Make sure the hidden service descriptors are at a random offset
- from each other, to hinder linkability.
- Changes in version 0.0.9pre5 - 2004-11-09
- o Bugfixes on 0.0.9pre4:
- - Fix a seg fault in unit tests (doesn't affect main program).
- - Fix an assert bug where a hidden service provider would fail if
- the first hop of his rendezvous circuit was down.
- - Hidden service operators now correctly handle version 1 style
- INTRODUCE1 cells (nobody generates them still, so not a critical
- bug).
- - If do_hup fails, actually notice.
- - Handle more errnos from accept() without closing the listener.
- Some OpenBSD machines were closing their listeners because
- they ran out of file descriptors.
- - Send resolve cells to exit routers that are running a new
- enough version of the resolve code to work right.
- - Better handling of winsock includes on non-MSV win32 compilers.
- - Some people had wrapped their tor client/server in a script
- that would restart it whenever it died. This did not play well
- with our "shut down if your version is obsolete" code. Now people
- don't fetch a new directory if their local cached version is
- recent enough.
- - Make our autogen.sh work on ksh as well as bash.
- o Major Features:
- - Hibernation: New config option "AccountingMaxKB" lets you
- set how many KBytes per month you want to allow your server to
- consume. Rather than spreading those bytes out evenly over the
- month, we instead hibernate for some of the month and pop up
- at a deterministic time, work until the bytes are consumed, then
- hibernate again. Config option "MonthlyAccountingStart" lets you
- specify which day of the month your billing cycle starts on.
- - Control interface: a separate program can now talk to your
- client/server over a socket, and get/set config options, receive
- notifications of circuits and streams starting/finishing/dying,
- bandwidth used, etc. The next step is to get some GUIs working.
- Let us know if you want to help out. See doc/control-spec.txt .
- - Ship a contrib/tor-control.py as an example script to interact
- with the control port.
- - "tor --hash-password zzyxz" will output a salted password for
- use in authenticating to the control interface.
- - New log format in config:
- "Log minsev[-maxsev] stdout|stderr|syslog" or
- "Log minsev[-maxsev] file /var/foo"
- o Minor Features:
- - DirPolicy config option, to let people reject incoming addresses
- from their dirserver.
- - "tor --list-fingerprint" will list your identity key fingerprint
- and then exit.
- - Add "pass" target for RedirectExit, to make it easier to break
- out of a sequence of RedirectExit rules.
- - Clients now generate a TLS cert too, in preparation for having
- them act more like real nodes.
- - Ship src/win32/ in the tarball, so people can use it to build.
- - Make old win32 fall back to CWD if SHGetSpecialFolderLocation
- is broken.
- - New "router-status" line in directory, to better bind each verified
- nickname to its identity key.
- - Deprecate unofficial config option abbreviations, and abbreviations
- not on the command line.
- - Add a pure-C tor-resolve implementation.
- - Use getrlimit and friends to ensure we can reach MaxConn (currently
- 1024) file descriptors.
- o Code security improvements, inspired by Ilja:
- - Replace sprintf with snprintf. (I think they were all safe, but
- hey.)
- - Replace strcpy/strncpy with strlcpy in more places.
- - Avoid strcat; use snprintf or strlcat instead.
- - snprintf wrapper with consistent (though not C99) overflow behavior.
- Changes in version 0.0.9pre4 - 2004-10-17
- o Bugfixes on 0.0.9pre3:
- - If the server doesn't specify an exit policy, use the real default
- exit policy, not reject *:*.
- - Ignore fascistfirewall when uploading/downloading hidden service
- descriptors, since we go through Tor for those; and when using
- an HttpProxy, since we assume it can reach them all.
- - When looking for an authoritative dirserver, use only the ones
- configured at boot. Don't bother looking in the directory.
- - The rest of the fix for get_default_conf_file() on older win32.
- - Make 'Routerfile' config option obsolete.
- o Features:
- - New 'MyFamily nick1,...' config option for a server to
- specify other servers that shouldn't be used in the same circuit
- with it. Only believed if nick1 also specifies us.
- - New 'NodeFamily nick1,nick2,...' config option for a client to
- specify nodes that it doesn't want to use in the same circuit.
- - New 'Redirectexit pattern address:port' config option for a
- server to redirect exit connections, e.g. to a local squid.
- Changes in version 0.0.9pre3 - 2004-10-13
- o Bugfixes on 0.0.8.1:
- - Better torrc example lines for dirbindaddress and orbindaddress.
- - Improved bounds checking on parsed ints (e.g. config options and
- the ones we find in directories.)
- - Better handling of size_t vs int, so we're more robust on 64
- bit platforms.
- - Fix the rest of the bug where a newly started OR would appear
- as unverified even after we've added his fingerprint and hupped
- the dirserver.
- - Fix a bug from 0.0.7: when read() failed on a stream, we would
- close it without sending back an end. So 'connection refused'
- would simply be ignored and the user would get no response.
- o Bugfixes on 0.0.9pre2:
- - Serving the cached-on-disk directory to people is bad. We now
- provide no directory until we've fetched a fresh one.
- - Workaround for bug on windows where cached-directories get crlf
- corruption.
- - Make get_default_conf_file() work on older windows too.
- - If we write a *:* exit policy line in the descriptor, don't write
- any more exit policy lines.
- o Features:
- - Use only 0.0.9pre1 and later servers for resolve cells.
- - Make the dirservers file obsolete.
- - Include a dir-signing-key token in directories to tell the
- parsing entity which key is being used to sign.
- - Remove the built-in bulky default dirservers string.
- - New config option "Dirserver %s:%d [fingerprint]", which can be
- repeated as many times as needed. If no dirservers specified,
- default to moria1,moria2,tor26.
- - Make moria2 advertise a dirport of 80, so people behind firewalls
- will be able to get a directory.
- - Http proxy support
- - Dirservers translate requests for http://%s:%d/x to /x
- - You can specify "HttpProxy %s[:%d]" and all dir fetches will
- be routed through this host.
- - Clients ask for /tor/x rather than /x for new enough dirservers.
- This way we can one day coexist peacefully with apache.
- - Clients specify a "Host: %s%d" http header, to be compatible
- with more proxies, and so running squid on an exit node can work.
- Changes in version 0.0.8.1 - 2004-10-13
- o Bugfixes:
- - Fix a seg fault that can be triggered remotely for Tor
- clients/servers with an open dirport.
- - Fix a rare assert trigger, where routerinfos for entries in
- our cpath would expire while we're building the path.
- - Fix a bug in OutboundBindAddress so it (hopefully) works.
- - Fix a rare seg fault for people running hidden services on
- intermittent connections.
- - Fix a bug in parsing opt keywords with objects.
- - Fix a stale pointer assert bug when a stream detaches and
- reattaches.
- - Fix a string format vulnerability (probably not exploitable)
- in reporting stats locally.
- - Fix an assert trigger: sometimes launching circuits can fail
- immediately, e.g. because too many circuits have failed recently.
- - Fix a compile warning on 64 bit platforms.
- Changes in version 0.0.9pre2 - 2004-10-03
- o Bugfixes:
- - Make fetching a cached directory work for 64-bit platforms too.
- - Make zlib.h a required header, not an optional header.
- Changes in version 0.0.9pre1 - 2004-10-01
- o Bugfixes:
- - Stop using separate defaults for no-config-file and
- empty-config-file. Now you have to explicitly turn off SocksPort,
- if you don't want it open.
- - Fix a bug in OutboundBindAddress so it (hopefully) works.
- - Improve man page to mention more of the 0.0.8 features.
- - Fix a rare seg fault for people running hidden services on
- intermittent connections.
- - Change our file IO stuff (especially wrt OpenSSL) so win32 is
- happier.
- - Fix more dns related bugs: send back resolve_failed and end cells
- more reliably when the resolve fails, rather than closing the
- circuit and then trying to send the cell. Also attach dummy resolve
- connections to a circuit *before* calling dns_resolve(), to fix
- a bug where cached answers would never be sent in RESOLVED cells.
- - When we run out of disk space, or other log writing error, don't
- crash. Just stop logging to that log and continue.
- - We were starting to daemonize before we opened our logs, so if
- there were any problems opening logs, we would complain to stderr,
- which wouldn't work, and then mysteriously exit.
- - Fix a rare bug where sometimes a verified OR would connect to us
- before he'd uploaded his descriptor, which would cause us to
- assign conn->nickname as though he's unverified. Now we look through
- the fingerprint list to see if he's there.
- - Fix a rare assert trigger, where routerinfos for entries in
- our cpath would expire while we're building the path.
- o Features:
- - Clients can ask dirservers for /dir.z to get a compressed version
- of the directory. Only works for servers running 0.0.9, of course.
- - Make clients cache directories and use them to seed their router
- lists at startup. This means clients have a datadir again.
- - Configuration infrastructure support for warning on obsolete
- options.
- - Respond to content-encoding headers by trying to uncompress as
- appropriate.
- - Reply with a deflated directory when a client asks for "dir.z".
- We could use allow-encodings instead, but allow-encodings isn't
- specified in HTTP 1.0.
- - Raise the max dns workers from 50 to 100.
- - Discourage people from setting their dirfetchpostperiod more often
- than once per minute.
- - Protect dirservers from overzealous descriptor uploading -- wait
- 10 seconds after directory gets dirty, before regenerating.
- Changes in version 0.0.8 - 2004-08-25
- o Port it to SunOS 5.9 / Athena
- Changes in version 0.0.8rc2 - 2004-08-20
- o Make it compile on cygwin again.
- o When picking unverified routers, skip those with low uptime and/or
- low bandwidth, depending on what properties you care about.
- Changes in version 0.0.8rc1 - 2004-08-18
- o Changes from 0.0.7.3:
- - Bugfixes:
- - Fix assert triggers: if the other side returns an address 0.0.0.0,
- don't put it into the client dns cache.
- - If a begin failed due to exit policy, but we believe the IP address
- should have been allowed, switch that router to exitpolicy reject *:*
- until we get our next directory.
- - Features:
- - Clients choose nodes proportional to advertised bandwidth.
- - Avoid using nodes with low uptime as introduction points.
- - Handle servers with dynamic IP addresses: don't replace
- options->Address with the resolved one at startup, and
- detect our address right before we make a routerinfo each time.
- - 'FascistFirewall' option to pick dirservers and ORs on specific
- ports; plus 'FirewallPorts' config option to tell FascistFirewall
- which ports are open. (Defaults to 80,443)
- - Be more aggressive about trying to make circuits when the network
- has changed (e.g. when you unsuspend your laptop).
- - Check for time skew on http headers; report date in response to
- "GET /".
- - If the entrynode config line has only one node, don't pick it as
- an exitnode.
- - Add strict{entry|exit}nodes config options. If set to 1, then
- we refuse to build circuits that don't include the specified entry
- or exit nodes.
- - OutboundBindAddress config option, to bind to a specific
- IP address for outgoing connect()s.
- - End truncated log entries (e.g. directories) with "[truncated]".
- o Patches to 0.0.8preX:
- - Bugfixes:
- - Patches to compile and run on win32 again (maybe)?
- - Fix crash when looking for ~/.torrc with no $HOME set.
- - Fix a race bug in the unit tests.
- - Handle verified/unverified name collisions better when new
- routerinfo's arrive in a directory.
- - Sometimes routers were getting entered into the stats before
- we'd assigned their identity_digest. Oops.
- - Only pick and establish intro points after we've gotten a
- directory.
- - Features:
- - AllowUnverifiedNodes config option to let circuits choose no-name
- routers in entry,middle,exit,introduction,rendezvous positions.
- Allow middle and rendezvous positions by default.
- - Add a man page for tor-resolve.
- Changes in version 0.0.7.3 - 2004-08-12
- o Stop dnsworkers from triggering an assert failure when you
- ask them to resolve the host "".
- Changes in version 0.0.8pre3 - 2004-08-09
- o Changes from 0.0.7.2:
- - Allow multiple ORs with same nickname in routerlist -- now when
- people give us one identity key for a nickname, then later
- another, we don't constantly complain until the first expires.
- - Remember used bandwidth (both in and out), and publish 15-minute
- snapshots for the past day into our descriptor.
- - You can now fetch $DIRURL/running-routers to get just the
- running-routers line, not the whole descriptor list. (But
- clients don't use this yet.)
- - When people mistakenly use Tor as an http proxy, point them
- at the tor-doc.html rather than the INSTALL.
- - Remove our mostly unused -- and broken -- hex_encode()
- function. Use base16_encode() instead. (Thanks to Timo Lindfors
- for pointing out this bug.)
- - Rotate onion keys every 12 hours, not every 2 hours, so we have
- fewer problems with people using the wrong key.
- - Change the default exit policy to reject the default edonkey,
- kazaa, gnutella ports.
- - Add replace_file() to util.[ch] to handle win32's rename().
- o Changes from 0.0.8preX:
- - Fix two bugs in saving onion keys to disk when rotating, so
- hopefully we'll get fewer people using old onion keys.
- - Fix an assert error that was making SocksPolicy not work.
- - Be willing to expire routers that have an open dirport -- it's
- just the authoritative dirservers we want to not forget.
- - Reject tor-resolve requests for .onion addresses early, so we
- don't build a whole rendezvous circuit and then fail.
- - When you're warning a server that he's unverified, don't cry
- wolf unpredictably.
- - Fix a race condition: don't try to extend onto a connection
- that's still handshaking.
- - For servers in clique mode, require the conn to be open before
- you'll choose it for your path.
- - Fix some cosmetic bugs about duplicate mark-for-close, lack of
- end relay cell, etc.
- - Measure bandwidth capacity over the last 24 hours, not just 12
- - Bugfix: authoritative dirservers were making and signing a new
- directory for each client, rather than reusing the cached one.
- Changes in version 0.0.8pre2 - 2004-08-04
- o Changes from 0.0.7.2:
- - Security fixes:
- - Check directory signature _before_ you decide whether you're
- you're running an obsolete version and should exit.
- - Check directory signature _before_ you parse the running-routers
- list to decide who's running or verified.
- - Bugfixes and features:
- - Check return value of fclose while writing to disk, so we don't
- end up with broken files when servers run out of disk space.
- - Log a warning if the user uses an unsafe socks variant, so people
- are more likely to learn about privoxy or socat.
- - Dirservers now include RFC1123-style dates in the HTTP headers,
- which one day we will use to better detect clock skew.
- o Changes from 0.0.8pre1:
- - Make it compile without warnings again on win32.
- - Log a warning if you're running an unverified server, to let you
- know you might want to get it verified.
- - Only pick a default nickname if you plan to be a server.
- Changes in version 0.0.8pre1 - 2004-07-23
- o Bugfixes:
- - Made our unit tests compile again on OpenBSD 3.5, and tor
- itself compile again on OpenBSD on a sparc64.
- - We were neglecting milliseconds when logging on win32, so
- everything appeared to happen at the beginning of each second.
- o Protocol changes:
- - 'Extend' relay cell payloads now include the digest of the
- intended next hop's identity key. Now we can verify that we're
- extending to the right router, and also extend to routers we
- hadn't heard of before.
- o Features:
- - Tor nodes can now act as relays (with an advertised ORPort)
- without being manually verified by the dirserver operators.
- - Uploaded descriptors of unverified routers are now accepted
- by the dirservers, and included in the directory.
- - Verified routers are listed by nickname in the running-routers
- list; unverified routers are listed as "$<fingerprint>".
- - We now use hash-of-identity-key in most places rather than
- nickname or addr:port, for improved security/flexibility.
- - To avoid Sybil attacks, paths still use only verified servers.
- But now we have a chance to play around with hybrid approaches.
- - Nodes track bandwidth usage to estimate capacity (not used yet).
- - ClientOnly option for nodes that never want to become servers.
- - Directory caching.
- - "AuthoritativeDir 1" option for the official dirservers.
- - Now other nodes (clients and servers) will cache the latest
- directory they've pulled down.
- - They can enable their DirPort to serve it to others.
- - Clients will pull down a directory from any node with an open
- DirPort, and check the signature/timestamp correctly.
- - Authoritative dirservers now fetch directories from other
- authdirservers, to stay better synced.
- - Running-routers list tells who's down also, along with noting
- if they're verified (listed by nickname) or unverified (listed
- by hash-of-key).
- - Allow dirservers to serve running-router list separately.
- This isn't used yet.
- - ORs connect-on-demand to other ORs
- - If you get an extend cell to an OR you're not connected to,
- connect, handshake, and forward the create cell.
- - The authoritative dirservers stay connected to everybody,
- and everybody stays connected to 0.0.7 servers, but otherwise
- clients/servers expire unused connections after 5 minutes.
- - When servers get a sigint, they delay 30 seconds (refusing new
- connections) then exit. A second sigint causes immediate exit.
- - File and name management:
- - Look for .torrc if no CONFDIR "torrc" is found.
- - If no datadir is defined, then choose, make, and secure ~/.tor
- as datadir.
- - If torrc not found, exitpolicy reject *:*.
- - Expands ~/ in filenames to $HOME/ (but doesn't yet expand ~arma).
- - If no nickname is defined, derive default from hostname.
- - Rename secret key files, e.g. identity.key -> secret_id_key,
- to discourage people from mailing their identity key to tor-ops.
- - Refuse to build a circuit before the directory has arrived --
- it won't work anyway, since you won't know the right onion keys
- to use.
- - Try other dirservers immediately if the one you try is down. This
- should tolerate down dirservers better now.
- - Parse tor version numbers so we can do an is-newer-than check
- rather than an is-in-the-list check.
- - New socks command 'resolve', to let us shim gethostbyname()
- locally.
- - A 'tor_resolve' script to access the socks resolve functionality.
- - A new socks-extensions.txt doc file to describe our
- interpretation and extensions to the socks protocols.
- - Add a ContactInfo option, which gets published in descriptor.
- - Publish OR uptime in descriptor (and thus in directory) too.
- - Write tor version at the top of each log file
- - New docs in the tarball:
- - tor-doc.html.
- - Document that you should proxy your SSL traffic too.
- Changes in version 0.0.7.2 - 2004-07-07
- o A better fix for the 0.0.0.0 problem, that will hopefully
- eliminate the remaining related assertion failures.
- Changes in version 0.0.7.1 - 2004-07-04
- o When an address resolves to 0.0.0.0, treat it as a failed resolve,
- since internally we use 0.0.0.0 to signify "not yet resolved".
- Changes in version 0.0.7 - 2004-06-07
- o Updated the man page to reflect the new features.
- Changes in version 0.0.7rc2 - 2004-06-06
- o Changes from 0.0.7rc1:
- - Make it build on Win32 again.
- o Changes from 0.0.6.2:
- - Rotate dnsworkers and cpuworkers on SIGHUP, so they get new config
- settings too.
- Changes in version 0.0.7rc1 - 2004-06-02
- o Bugfixes:
- - On sighup, we were adding another log without removing the first
- one. So log messages would get duplicated n times for n sighups.
- - Several cases of using a connection after we'd freed it. The
- problem was that connections that are pending resolve are in both
- the pending_resolve tree, and also the circuit's resolving_streams
- list. When you want to remove one, you must remove it from both.
- - Fix a double-mark-for-close where an end cell arrived for a
- resolving stream, and then the resolve failed.
- - Check directory signatures based on name of signer, not on whom
- we got the directory from. This will let us cache directories more
- easily.
- o Features:
- - Crank up some of our constants to handle more users.
- Changes in version 0.0.7pre1 - 2004-06-02
- o Fixes for crashes and other obnoxious bugs:
- - Fix an epipe bug: sometimes when directory connections failed
- to connect, we would give them a chance to flush before closing
- them.
- - When we detached from a circuit because of resolvefailed, we
- would immediately try the same circuit twice more, and then
- give up on the resolve thinking we'd tried three different
- exit nodes.
- - Limit the number of intro circuits we'll attempt to build for a
- hidden service per 15-minute period.
- - Check recommended-software string *early*, before actually parsing
- the directory. Thus we can detect an obsolete version and exit,
- even if the new directory format doesn't parse.
- o Fixes for security bugs:
- - Remember which nodes are dirservers when you startup, and if a
- random OR enables his dirport, don't automatically assume he's
- a trusted dirserver.
- o Other bugfixes:
- - Directory connections were asking the wrong poll socket to
- start writing, and not asking themselves to start writing.
- - When we detached from a circuit because we sent a begin but
- didn't get a connected, we would use it again the first time;
- but after that we would correctly switch to a different one.
- - Stop warning when the first onion decrypt attempt fails; they
- will sometimes legitimately fail now that we rotate keys.
- - Override unaligned-access-ok check when $host_cpu is ia64 or
- arm. Apparently they allow it but the kernel whines.
- - Dirservers try to reconnect periodically too, in case connections
- have failed.
- - Fix some memory leaks in directory servers.
- - Allow backslash in Win32 filenames.
- - Made Tor build complain-free on FreeBSD, hopefully without
- breaking other BSD builds. We'll see.
- o Features:
- - Doxygen markup on all functions and global variables.
- - Make directory functions update routerlist, not replace it. So
- now directory disagreements are not so critical a problem.
- - Remove the upper limit on number of descriptors in a dirserver's
- directory (not that we were anywhere close).
- - Allow multiple logfiles at different severity ranges.
- - Allow *BindAddress to specify ":port" rather than setting *Port
- separately. Allow multiple instances of each BindAddress config
- option, so you can bind to multiple interfaces if you want.
- - Allow multiple exit policy lines, which are processed in order.
- Now we don't need that huge line with all the commas in it.
- - Enable accept/reject policies on SOCKS connections, so you can bind
- to 0.0.0.0 but still control who can use your OP.
- Changes in version 0.0.6.2 - 2004-05-16
- o Our integrity-checking digest was checking only the most recent cell,
- not the previous cells like we'd thought.
- Thanks to Stefan Mark for finding the flaw!
- Changes in version 0.0.6.1 - 2004-05-06
- o Fix two bugs in our AES counter-mode implementation (this affected
- onion-level stream encryption, but not TLS-level). It turns
- out we were doing something much more akin to a 16-character
- polyalphabetic cipher. Oops.
- Thanks to Stefan Mark for finding the flaw!
- o Retire moria3 as a directory server, and add tor26 as a directory
- server.
- Changes in version 0.0.6 - 2004-05-02
- [version bump only]
- Changes in version 0.0.6rc4 - 2004-05-01
- o Update the built-in dirservers list to use the new directory format
- o Fix a rare seg fault: if a node offering a hidden service attempts
- to build a circuit to Alice's rendezvous point and fails before it
- reaches the last hop, it retries with a different circuit, but
- then dies.
- o Handle windows socket errors correctly.
- Changes in version 0.0.6rc3 - 2004-04-28
- o Don't expire non-general excess circuits (if we had enough
- circuits open, we were expiring rendezvous circuits -- even
- when they had a stream attached. oops.)
- o Fetch randomness from /dev/urandom better (not via fopen/fread)
- o Better debugging for tls errors
- o Some versions of openssl have an SSL_pending function that erroneously
- returns bytes when there is a non-application record pending.
- o Set Content-Type on the directory and hidserv descriptor.
- o Remove IVs from cipher code, since AES-ctr has none.
- o Win32 fixes. Tor now compiles on win32 with no warnings/errors.
- o We were using an array of length zero in a few places.
- o win32's gethostbyname can't resolve an IP to an IP.
- o win32's close can't close a socket.
- Changes in version 0.0.6rc2 - 2004-04-26
- o Fix a bug where we were closing tls connections intermittently.
- It turns out openssl keeps its errors around -- so if an error
- happens, and you don't ask about it, and then another openssl
- operation happens and succeeds, and you ask if there was an error,
- it tells you about the first error. Fun fun.
- o Fix a bug that's been lurking since 27 may 03 (!)
- When passing back a destroy cell, we would use the wrong circ id.
- 'Mostly harmless', but still worth fixing.
- o Since we don't support truncateds much, don't bother sending them;
- just close the circ.
- o check for <machine/limits.h> so we build on NetBSD again (I hope).
- o don't crash if a conn that sent a begin has suddenly lost its circuit
- (this was quite rare).
- Changes in version 0.0.6rc1 - 2004-04-25
- o We now rotate link (tls context) keys and onion keys.
- o CREATE cells now include oaep padding, so you can tell
- if you decrypted them correctly.
- o Add bandwidthburst to server descriptor.
- o Directories now say which dirserver signed them.
- o Use a tor_assert macro that logs failed assertions too.
- Changes in version 0.0.6pre5 - 2004-04-18
- o changes from 0.0.6pre4:
- - make tor build on broken freebsd 5.2 installs
- - fix a failed assert when you try an intro point, get a nack, and try
- a second one and it works.
- - when alice uses a port that the hidden service doesn't accept,
- it now sends back an end cell (denied by exit policy). otherwise
- alice would just have to wait to time out.
- - fix another rare bug: when we had tried all the intro
- points for a hidden service, we fetched the descriptor
- again, but we left our introcirc thinking it had already
- sent an intro, so it kept waiting for a response...
- - bugfix: when you sleep your hidden-service laptop, as soon
- as it wakes up it tries to upload a service descriptor, but
- socketpair fails for some reason (localhost not up yet?).
- now we simply give up on that upload, and we'll try again later.
- i'd still like to find the bug though.
- - if an intro circ waiting for an ack dies before getting one, then
- count it as a nack
- - we were reusing stale service descriptors and refetching usable
- ones. oops.
- Changes in version 0.0.6pre4 - 2004-04-14
- o changes from 0.0.6pre3:
- - when bob fails to connect to the rendezvous point, and his
- circ didn't fail because of the rendezvous point itself, then
- he retries a couple of times
- - we expire introduction and rendezvous circs more thoroughly
- (sometimes they were hanging around forever)
- - we expire unattached rendezvous streams that have been around
- too long (they were sticking around forever).
- - fix a measly fencepost error that was crashing everybody with
- a strict glibc.
- Changes in version 0.0.6pre3 - 2004-04-14
- o changes from 0.0.6pre2:
- - make hup work again
- - fix some memory leaks for dirservers
- - allow more skew in rendezvous descriptor timestamps, to help
- handle people like blanu who don't know what time it is
- - normal circs are 3 hops, but some rend/intro circs are 4, if
- the initiator doesn't get to choose the last hop
- - send acks for introductions, so alice can know whether to try
- again
- - bob publishes intro points more correctly
- o changes from 0.0.5:
- - fix an assert trigger that's been plaguing us since the days
- of 0.0.2prexx (thanks weasel!)
- - retry stream correctly when we fail to connect because of
- exit-policy-reject (should try another) or can't-resolve-address
- (also should try another, because dns on random internet servers
- is flaky).
- - when we hup a dirserver and we've *removed* a server from the
- approved-routers list, now we remove that server from the
- in-memory directories too
- Changes in version 0.0.6pre2 - 2004-04-08
- o We fixed our base32 implementation. Now it works on all architectures.
- Changes in version 0.0.6pre1 - 2004-04-08
- o Features:
- - Hidden services and rendezvous points are implemented. Go to
- http://6sxoyfb3h2nvok2d.onion/ for an index of currently available
- hidden services. (This only works via a socks4a proxy such as
- Privoxy, and currently it's quite slow.)
- Changes in version 0.0.5 - 2004-03-30
- [version bump only]
- Changes in version 0.0.5rc3 - 2004-03-29
- o Install torrc as torrc.sample -- we no longer clobber your
- torrc. (Woo!)
- o Re-enable recommendedversion checking (we broke it in rc2, oops)
- o Add in a 'notice' log level for things the operator should hear
- but that aren't warnings
- Changes in version 0.0.5rc2 - 2004-03-29
- o Hold socks connection open until reply is flushed (if possible)
- o Make exit nodes resolve IPs to IPs immediately, rather than asking
- the dns farm to do it.
- o Fix c99 aliasing warnings in rephist.c
- o Don't include server descriptors that are older than 24 hours in the
- directory.
- o Give socks 'reject' replies their whole 15s to attempt to flush,
- rather than seeing the 60s timeout and assuming the flush had failed.
- o Clean automake droppings from the cvs repository
- Changes in version 0.0.5rc1 - 2004-03-28
- o Fix mangled-state bug in directory fetching (was causing sigpipes).
- o Only build circuits after we've fetched the directory: clients were
- using only the directory servers before they'd fetched a directory.
- This also means longer startup time; so it goes.
- o Fix an assert trigger where an OP would fail to handshake, and we'd
- expect it to have a nickname.
- o Work around a tsocks bug: do a socks reject when AP connection dies
- early, else tsocks goes into an infinite loop.
- Changes in version 0.0.4 - 2004-03-26
- o When connecting to a dirserver or OR and the network is down,
- we would crash.
- Changes in version 0.0.3 - 2004-03-26
- o Warn and fail if server chose a nickname with illegal characters
- o Port to Solaris and Sparc:
- - include missing header fcntl.h
- - have autoconf find -lsocket -lnsl automatically
- - deal with hardware word alignment
- - make uname() work (solaris has a different return convention)
- - switch from using signal() to sigaction()
- o Preliminary work on reputation system:
- - Keep statistics on success/fail of connect attempts; they're published
- by kill -USR1 currently.
- - Add a RunTesting option to try to learn link state by creating test
- circuits, even when SocksPort is off.
- - Remove unused open circuits when there are too many.
- Changes in version 0.0.2 - 2004-03-19
- - Include strlcpy and strlcat for safer string ops
- - define INADDR_NONE so we compile (but still not run) on solaris
- Changes in version 0.0.2pre27 - 2004-03-14
- o Bugfixes:
- - Allow internal tor networks (we were rejecting internal IPs,
- now we allow them if they're set explicitly).
- - And fix a few endian issues.
- Changes in version 0.0.2pre26 - 2004-03-14
- o New features:
- - If a stream times out after 15s without a connected cell, don't
- try that circuit again: try a new one.
- - Retry streams at most 4 times. Then give up.
- - When a dirserver gets a descriptor from an unknown router, it
- logs its fingerprint (so the dirserver operator can choose to
- accept it even without mail from the server operator).
- - Inform unapproved servers when we reject their descriptors.
- - Make tor build on Windows again. It works as a client, who knows
- about as a server.
- - Clearer instructions in the torrc for how to set up a server.
- - Be more efficient about reading fd's when our global token bucket
- (used for rate limiting) becomes empty.
- o Bugfixes:
- - Stop asserting that computers always go forward in time. It's
- simply not true.
- - When we sent a cell (e.g. destroy) and then marked an OR connection
- expired, we might close it before finishing a flush if the other
- side isn't reading right then.
- - Don't allow dirservers to start if they haven't defined
- RecommendedVersions
- - We were caching transient dns failures. Oops.
- - Prevent servers from publishing an internal IP as their address.
- - Address a strcat vulnerability in circuit.c
- Changes in version 0.0.2pre25 - 2004-03-04
- o New features:
- - Put the OR's IP in its router descriptor, not its fqdn. That way
- we'll stop being stalled by gethostbyname for nodes with flaky dns,
- e.g. poblano.
- o Bugfixes:
- - If the user typed in an address that didn't resolve, the server
- crashed.
- Changes in version 0.0.2pre24 - 2004-03-03
- o Bugfixes:
- - Fix an assertion failure in dns.c, where we were trying to dequeue
- a pending dns resolve even if it wasn't pending
- - Fix a spurious socks5 warning about still trying to write after the
- connection is finished.
- - Hold certain marked_for_close connections open until they're finished
- flushing, rather than losing bytes by closing them too early.
- - Correctly report the reason for ending a stream
- - Remove some duplicate calls to connection_mark_for_close
- - Put switch_id and start_daemon earlier in the boot sequence, so it
- will actually try to chdir() to options.DataDirectory
- - Make 'make test' exit(1) if a test fails; fix some unit tests
- - Make tor fail when you use a config option it doesn't know about,
- rather than warn and continue.
- - Make --version work
- - Bugfixes on the rpm spec file and tor.sh, so it's more up to date
- Changes in version 0.0.2pre23 - 2004-02-29
- o New features:
- - Print a statement when the first circ is finished, so the user
- knows it's working.
- - If a relay cell is unrecognized at the end of the circuit,
- send back a destroy. (So attacks to mutate cells are more
- clearly thwarted.)
- - New config option 'excludenodes' to avoid certain nodes for circuits.
- - When it daemonizes, it chdir's to the DataDirectory rather than "/",
- so you can collect coredumps there.
- o Bugfixes:
- - Fix a bug in tls flushing where sometimes data got wedged and
- didn't flush until more data got sent. Hopefully this bug was
- a big factor in the random delays we were seeing.
- - Make 'connected' cells include the resolved IP, so the client
- dns cache actually gets populated.
- - Disallow changing from ORPort=0 to ORPort>0 on hup.
- - When we time-out on a stream and detach from the circuit, send an
- end cell down it first.
- - Only warn about an unknown router (in exitnodes, entrynodes,
- excludenodes) after we've fetched a directory.
- Changes in version 0.0.2pre22 - 2004-02-26
- o New features:
- - Servers publish less revealing uname information in descriptors.
- - More memory tracking and assertions, to crash more usefully when
- errors happen.
- - If the default torrc isn't there, just use some default defaults.
- Plus provide an internal dirservers file if they don't have one.
- - When the user tries to use Tor as an http proxy, give them an http
- 501 failure explaining that we're a socks proxy.
- - Dump a new router.desc on hup, to help confused people who change
- their exit policies and then wonder why router.desc doesn't reflect
- it.
- - Clean up the generic tor.sh init script that we ship with.
- o Bugfixes:
- - If the exit stream is pending on the resolve, and a destroy arrives,
- then the stream wasn't getting removed from the pending list. I
- think this was the one causing recent server crashes.
- - Use a more robust poll on OSX 10.3, since their poll is flaky.
- - When it couldn't resolve any dirservers, it was useless from then on.
- Now it reloads the RouterFile (or default dirservers) if it has no
- dirservers.
- - Move the 'tor' binary back to /usr/local/bin/ -- it turns out
- many users don't even *have* a /usr/local/sbin/.
- Changes in version 0.0.2pre21 - 2004-02-18
- o New features:
- - There's a ChangeLog file that actually reflects the changelog.
- - There's a 'torify' wrapper script, with an accompanying
- tor-tsocks.conf, that simplifies the process of using tsocks for
- tor. It even has a man page.
- - The tor binary gets installed to sbin rather than bin now.
- - Retry streams where the connected cell hasn't arrived in 15 seconds
- - Clean up exit policy handling -- get the default out of the torrc,
- so we can update it without forcing each server operator to fix
- his/her torrc.
- - Allow imaps and pop3s in default exit policy
- o Bugfixes:
- - Prevent picking middleman nodes as the last node in the circuit
- Changes in version 0.0.2pre20 - 2004-01-30
- o New features:
- - We now have a deb package, and it's in debian unstable. Go to
- it, apt-getters. :)
- - I've split the TotalBandwidth option into BandwidthRate (how many
- bytes per second you want to allow, long-term) and
- BandwidthBurst (how many bytes you will allow at once before the cap
- kicks in). This better token bucket approach lets you, say, set
- BandwidthRate to 10KB/s and BandwidthBurst to 10MB, allowing good
- performance while not exceeding your monthly bandwidth quota.
- - Push out a tls record's worth of data once you've got it, rather
- than waiting until you've read everything waiting to be read. This
- may improve performance by pipelining better. We'll see.
- - Add an AP_CONN_STATE_CONNECTING state, to allow streams to detach
- from failed circuits (if they haven't been connected yet) and attach
- to new ones.
- - Expire old streams that haven't managed to connect. Some day we'll
- have them reattach to new circuits instead.
- o Bugfixes:
- - Fix several memory leaks that were causing servers to become bloated
- after a while.
- - Fix a few very rare assert triggers. A few more remain.
- - Setuid to User _before_ complaining about running as root.
- Changes in version 0.0.2pre19 - 2004-01-07
- o Bugfixes:
- - Fix deadlock condition in dns farm. We were telling a child to die by
- closing the parent's file descriptor to him. But newer children were
- inheriting the open file descriptor from the parent, and since they
- weren't closing it, the socket never closed, so the child never read
- eof, so he never knew to exit. Similarly, dns workers were holding
- open other sockets, leading to all sorts of chaos.
- - New cleaner daemon() code for forking and backgrounding.
- - If you log to a file, it now prints an entry at the top of the
- logfile so you know it's working.
- - The onionskin challenge length was 30 bytes longer than necessary.
- - Started to patch up the spec so it's not quite so out of date.
- Changes in version 0.0.2pre18 - 2004-01-02
- o Bugfixes:
- - Fix endian issues with the 'integrity' field in the relay header.
- - Fix a potential bug where connections in state
- AP_CONN_STATE_CIRCUIT_WAIT might unexpectedly ask to write.
- Changes in version 0.0.2pre17 - 2003-12-30
- o Bugfixes:
- - Made --debuglogfile (or any second log file, actually) work.
- - Resolved an edge case in get_unique_circ_id_by_conn where a smart
- adversary could force us into an infinite loop.
- o Features:
- - Each onionskin handshake now includes a hash of the computed key,
- to prove the server's identity and help perfect forward secrecy.
- - Changed cell size from 256 to 512 bytes (working toward compatibility
- with MorphMix).
- - Changed cell length to 2 bytes, and moved it to the relay header.
- - Implemented end-to-end integrity checking for the payloads of
- relay cells.
- - Separated streamid from 'recognized' (otherwise circuits will get
- messed up when we try to have streams exit from the middle). We
- use the integrity-checking to confirm that a cell is addressed to
- this hop.
- - Randomize the initial circid and streamid values, so an adversary who
- breaks into a node can't learn how many circuits or streams have
- been made so far.
- Changes in version 0.0.2pre16 - 2003-12-14
- o Bugfixes:
- - Fixed a bug that made HUP trigger an assert
- - Fixed a bug where a circuit that immediately failed wasn't being
- counted as a failed circuit in counting retries.
- o Features:
- - Now we close the circuit when we get a truncated cell: otherwise we're
- open to an anonymity attack where a bad node in the path truncates
- the circuit and then we open streams at him.
- - Add port ranges to exit policies
- - Add a conservative default exit policy
- - Warn if you're running tor as root
- - on HUP, retry OR connections and close/rebind listeners
- - options.EntryNodes: try these nodes first when picking the first node
- - options.ExitNodes: if your best choices happen to include any of
- your preferred exit nodes, you choose among just those preferred
- exit nodes.
- - options.ExcludedNodes: nodes that are never picked in path building
- Changes in version 0.0.2pre15 - 2003-12-03
- o Robustness and bugfixes:
- - Sometimes clients would cache incorrect DNS resolves, which would
- really screw things up.
- - An OP that goes offline would slowly leak all its sockets and stop
- working.
- - A wide variety of bugfixes in exit node selection, exit policy
- handling, and processing pending streams when a new circuit is
- established.
- - Pick nodes for a path only from those the directory says are up
- - Choose randomly from all running dirservers, not always the first one
- - Increase allowed http header size for directory fetch.
- - Stop writing to stderr (if we're daemonized it will be closed).
- - Enable -g always, so cores will be more useful to me.
- - Switch "-lcrypto -lssl" to "-lssl -lcrypto" for broken distributions.
- o Documentation:
- - Wrote a man page. It lists commonly used options.
- o Configuration:
- - Change default loglevel to warn.
- - Make PidFile default to null rather than littering in your CWD.
- - OnionRouter config option is now obsolete. Instead it just checks
- ORPort>0.
- - Moved to a single unified torrc file for both clients and servers.
- Changes in version 0.0.2pre14 - 2003-11-29
- o Robustness and bugfixes:
- - Force the admin to make the DataDirectory himself
- - to get ownership/permissions right
- - so clients no longer make a DataDirectory and then never use it
- - fix bug where a client who was offline for 45 minutes would never
- pull down a directory again
- - fix (or at least hide really well) the dns assert bug that was
- causing server crashes
- - warnings and improved robustness wrt clockskew for certs
- - use the native daemon(3) to daemonize, when available
- - exit if bind() fails
- - exit if neither socksport nor orport is defined
- - include our own tor_timegm (Win32 doesn't have its own)
- - bugfix for win32 with lots of connections
- - fix minor bias in PRNG
- - make dirserver more robust to corrupt cached directory
- o Documentation:
- - Wrote the design document (woo)
- o Circuit building and exit policies:
- - Circuits no longer try to use nodes that the directory has told them
- are down.
- - Exit policies now support bitmasks (18.0.0.0/255.0.0.0) and
- bitcounts (18.0.0.0/8).
- - Make AP connections standby for a circuit if no suitable circuit
- exists, rather than failing
- - Circuits choose exit node based on addr/port, exit policies, and
- which AP connections are standing by
- - Bump min pathlen from 2 to 3
- - Relay end cells have a payload to describe why the stream ended.
- - If the stream failed because of exit policy, try again with a new
- circuit.
- - Clients have a dns cache to remember resolved addresses.
- - Notice more quickly when we have no working circuits
- o Configuration:
- - APPort is now called SocksPort
- - SocksBindAddress, ORBindAddress, DirBindAddress let you configure
- where to bind
- - RecommendedVersions is now a config variable rather than
- hardcoded (for dirservers)
- - Reloads config on HUP
- - Usage info on -h or --help
- - If you set User and Group config vars, it'll setu/gid to them.
- Changes in version 0.0.2pre13 - 2003-10-19
- o General stability:
- - SSL_write no longer fails when it returns WANTWRITE and the number
- of bytes in the buf has changed by the next SSL_write call.
- - Fix segfault fetching directory when network is down
- - Fix a variety of minor memory leaks
- - Dirservers reload the fingerprints file on HUP, so I don't have
- to take down the network when I approve a new router
- - Default server config file has explicit Address line to specify fqdn
- o Buffers:
- - Buffers grow and shrink as needed (Cut process size from 20M to 2M)
- - Make listener connections not ever alloc bufs
- o Autoconf improvements:
- - don't clobber an external CFLAGS in ./configure
- - Make install now works
- - create var/lib/tor on make install
- - autocreate a tor.sh initscript to help distribs
- - autocreate the torrc and sample-server-torrc with correct paths
- o Log files and Daemonizing now work:
- - If --DebugLogFile is specified, log to it at -l debug
- - If --LogFile is specified, use it instead of commandline
- - If --RunAsDaemon is set, tor forks and backgrounds on startup
|
