|
|
@@ -1,3 +1,1086 @@
|
|
|
+Changes in version 0.4.1.2-alpha - 2019-06-06
|
|
|
+ Tor 0.4.1.2-alpha resolves numerous bugs--some of them from the
|
|
|
+ previous alpha, and some much older. It also contains minor testing
|
|
|
+ improvements, and an improvement to the security of our authenticated
|
|
|
+ SENDME implementation.
|
|
|
+
|
|
|
+ o Major bugfixes (bridges):
|
|
|
+ - Consider our directory information to have changed when our list
|
|
|
+ of bridges changes. Previously, Tor would not re-compute the
|
|
|
+ status of its directory information when bridges changed, and
|
|
|
+ therefore would not realize that it was no longer able to build
|
|
|
+ circuits. Fixes part of bug 29875.
|
|
|
+ - Do not count previously configured working bridges towards our
|
|
|
+ total of working bridges. Previously, when Tor's list of bridges
|
|
|
+ changed, it would think that the old bridges were still usable,
|
|
|
+ and delay fetching router descriptors for the new ones. Fixes part
|
|
|
+ of bug 29875; bugfix on 0.3.0.1-alpha.
|
|
|
+
|
|
|
+ o Major bugfixes (flow control, SENDME):
|
|
|
+ - Decrement the stream-level package window after packaging a cell.
|
|
|
+ Previously, it was done inside a log_debug() call, meaning that if
|
|
|
+ debug logs were not enabled, the decrement would never happen, and
|
|
|
+ thus the window would be out of sync with the other end point.
|
|
|
+ Fixes bug 30628; bugfix on 0.4.1.1-alpha.
|
|
|
+
|
|
|
+ o Major bugfixes (onion service reachability):
|
|
|
+ - Properly clean up the introduction point map and associated state
|
|
|
+ when circuits change purpose from onion service circuits to
|
|
|
+ pathbias, measurement, or other circuit types. This may fix some
|
|
|
+ instances of introduction point failure. Fixes bug 29034; bugfix
|
|
|
+ on 0.3.2.1-alpha.
|
|
|
+
|
|
|
+ o Minor features (authenticated SENDME):
|
|
|
+ - Ensure that there is enough randomness on every circuit to prevent
|
|
|
+ an attacker from successfully predicting the hashes they will need
|
|
|
+ to include in authenticated SENDME cells. At a random interval, if
|
|
|
+ we have not sent randomness already, we now leave some extra space
|
|
|
+ at the end of a cell that we can fill with random bytes. Closes
|
|
|
+ ticket 26846.
|
|
|
+
|
|
|
+ o Minor features (continuous integration):
|
|
|
+ - When running coverage builds on Travis, we now set
|
|
|
+ TOR_TEST_RNG_SEED, to avoid RNG-based coverage differences. Part
|
|
|
+ of ticket 28878.
|
|
|
+
|
|
|
+ o Minor features (maintenance):
|
|
|
+ - Add a new "make autostyle" target that developers can use to apply
|
|
|
+ all automatic Tor style and consistency conversions to the
|
|
|
+ codebase. Closes ticket 30539.
|
|
|
+
|
|
|
+ o Minor features (testing):
|
|
|
+ - The circuitpadding tests now use a reproducible RNG implementation,
|
|
|
+ so that if a test fails, we can learn why. Part of ticket 28878.
|
|
|
+ - Tor's tests now support an environment variable, TOR_TEST_RNG_SEED,
|
|
|
+ to set the RNG seed for tests that use a reproducible RNG. Part of
|
|
|
+ ticket 28878.
|
|
|
+ - When running tests in coverage mode, take additional care to make
|
|
|
+ our coverage deterministic, so that we can accurately track
|
|
|
+ changes in code coverage. Closes ticket 30519.
|
|
|
+
|
|
|
+ o Minor bugfixes (configuration, proxies):
|
|
|
+ - Fix a bug that prevented us from supporting SOCKS5 proxies that
|
|
|
+ want authentication along with configured (but unused!)
|
|
|
+ ClientTransportPlugins. Fixes bug 29670; bugfix on 0.2.6.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (controller):
|
|
|
+ - POSTDESCRIPTOR requests should work again. Previously, they were
|
|
|
+ broken if a "purpose=" flag was specified. Fixes bug 30580; bugfix
|
|
|
+ on 0.4.1.1-alpha.
|
|
|
+ - Repair the HSFETCH command so that it works again. Previously, it
|
|
|
+ expected a body when it shouldn't have. Fixes bug 30646; bugfix
|
|
|
+ on 0.4.1.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (developer tooling):
|
|
|
+ - Fix pre-push hook to allow fixup and squash commits when pushing
|
|
|
+ to non-upstream git remote. Fixes bug 30286; bugfix
|
|
|
+ on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (directory authority):
|
|
|
+ - Move the "bandwidth-file-headers" line in directory authority
|
|
|
+ votes so that it conforms to dir-spec.txt. Fixes bug 30316; bugfix
|
|
|
+ on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (NetBSD):
|
|
|
+ - Fix usage of minherit() on NetBSD and other platforms that define
|
|
|
+ MAP_INHERIT_{ZERO,NONE} instead of INHERIT_{ZERO,NONE}. Fixes bug
|
|
|
+ 30614; bugfix on 0.4.0.2-alpha. Patch from Taylor Campbell.
|
|
|
+
|
|
|
+ o Minor bugfixes (out-of-memory handler):
|
|
|
+ - When purging the DNS cache because of an out-of-memory condition,
|
|
|
+ try purging just the older entries at first. Previously, we would
|
|
|
+ always purge the whole thing. Fixes bug 29617; bugfix
|
|
|
+ on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (portability):
|
|
|
+ - Avoid crashing in our tor_vasprintf() implementation on systems
|
|
|
+ that define neither vasprintf() nor _vscprintf(). (This bug has
|
|
|
+ been here long enough that we question whether people are running
|
|
|
+ Tor on such systems, but we're applying the fix out of caution.)
|
|
|
+ Fixes bug 30561; bugfix on 0.2.8.2-alpha. Found and fixed by
|
|
|
+ Tobias Stoeckmann.
|
|
|
+
|
|
|
+ o Minor bugfixes (shutdown, libevent, memory safety):
|
|
|
+ - Avoid use-after-free bugs when shutting down, by making sure that
|
|
|
+ we shut down libevent only after shutting down all of its users.
|
|
|
+ We believe these are harmless in practice, since they only occur
|
|
|
+ on the shutdown path, and do not involve any attacker-controlled
|
|
|
+ data. Fixes bug 30629; bugfix on 0.4.1.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (static analysis):
|
|
|
+ - Fix several spurious Coverity warnings about the unit tests, to
|
|
|
+ lower our chances of missing real warnings in the future. Fixes
|
|
|
+ bug 30150; bugfix on 0.3.5.1-alpha and various other Tor versions.
|
|
|
+
|
|
|
+ o Testing:
|
|
|
+ - Specify torrc paths (with empty files) when launching tor in
|
|
|
+ integration tests; refrain from reading user and system torrcs.
|
|
|
+ Resolves issue 29702.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.4.1.1-alpha - 2019-05-22
|
|
|
+ This is the first alpha in the 0.4.1.x series. It introduces
|
|
|
+ lightweight circuit padding to make some onion-service circuits harder
|
|
|
+ to distinguish, includes a new "authenticated SENDME" feature to make
|
|
|
+ certain denial-of-service attacks more difficult, and improves
|
|
|
+ performance in several areas.
|
|
|
+
|
|
|
+ o Major features (circuit padding):
|
|
|
+ - Onion service clients now add padding cells at the start of their
|
|
|
+ INTRODUCE and RENDEZVOUS circuits, to make those circuits' traffic
|
|
|
+ look more like general purpose Exit traffic. The overhead for this
|
|
|
+ is 2 extra cells in each direction for RENDEZVOUS circuits, and 1
|
|
|
+ extra upstream cell and 10 downstream cells for INTRODUCE
|
|
|
+ circuits. This feature is only enabled when also supported by the
|
|
|
+ circuit's middle node. (Clients may specify fixed middle nodes
|
|
|
+ with the MiddleNodes option, and may force-disable this feature
|
|
|
+ with the CircuitPadding torrc.) Closes ticket 28634.
|
|
|
+
|
|
|
+ o Major features (code organization):
|
|
|
+ - Tor now includes a generic publish-subscribe message-passing
|
|
|
+ subsystem that we can use to organize intermodule dependencies. We
|
|
|
+ hope to use this to reduce dependencies between modules that don't
|
|
|
+ need to be related, and to generally simplify our codebase. Closes
|
|
|
+ ticket 28226.
|
|
|
+
|
|
|
+ o Major features (controller protocol):
|
|
|
+ - Controller commands are now parsed using a generalized parsing
|
|
|
+ subsystem. Previously, each controller command was responsible for
|
|
|
+ parsing its own input, which led to strange inconsistencies.
|
|
|
+ Closes ticket 30091.
|
|
|
+
|
|
|
+ o Major features (flow control):
|
|
|
+ - Implement authenticated SENDMEs as detailed in proposal 289. A
|
|
|
+ SENDME cell now includes the digest of the traffic that it
|
|
|
+ acknowledges, so that once an end point receives the SENDME, it
|
|
|
+ can confirm the other side's knowledge of the previous cells that
|
|
|
+ were sent, and prevent certain types of denial-of-service attacks.
|
|
|
+ This behavior is controlled by two new consensus parameters: see
|
|
|
+ the proposal for more details. Fixes ticket 26288.
|
|
|
+
|
|
|
+ o Major features (performance):
|
|
|
+ - Our node selection algorithm now excludes nodes in linear time.
|
|
|
+ Previously, the algorithm was quadratic, which could slow down
|
|
|
+ heavily used onion services. Closes ticket 30307.
|
|
|
+
|
|
|
+ o Major features (performance, RNG):
|
|
|
+ - Tor now constructs a fast secure pseudorandom number generator for
|
|
|
+ each thread, to use when performance is critical. This PRNG is
|
|
|
+ based on AES-CTR, using a buffering construction similar to
|
|
|
+ libottery and the (newer) OpenBSD arc4random() code. It
|
|
|
+ outperforms OpenSSL 1.1.1a's CSPRNG by roughly a factor of 100 for
|
|
|
+ small outputs. Although we believe it to be cryptographically
|
|
|
+ strong, we are only using it when necessary for performance.
|
|
|
+ Implements tickets 29023 and 29536.
|
|
|
+
|
|
|
+ o Major bugfixes (onion service v3):
|
|
|
+ - Fix an unreachable bug in which an introduction point could try to
|
|
|
+ send an INTRODUCE_ACK with a status code that Trunnel would refuse
|
|
|
+ to encode, leading the relay to assert(). We've consolidated the
|
|
|
+ ABI values into Trunnel now. Fixes bug 30454; bugfix
|
|
|
+ on 0.3.0.1-alpha.
|
|
|
+ - Clients can now handle unknown status codes from INTRODUCE_ACK
|
|
|
+ cells. (The NACK behavior will stay the same.) This will allow us
|
|
|
+ to extend status codes in the future without breaking the normal
|
|
|
+ client behavior. Fixes another part of bug 30454; bugfix
|
|
|
+ on 0.3.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor features (circuit padding):
|
|
|
+ - We now use a fast PRNG when scheduling circuit padding. Part of
|
|
|
+ ticket 28636.
|
|
|
+ - Allow the padding machine designer to pick the edges of their
|
|
|
+ histogram instead of trying to compute them automatically using an
|
|
|
+ exponential formula. Resolves some undefined behavior in the case
|
|
|
+ of small histograms and allows greater flexibility on machine
|
|
|
+ design. Closes ticket 29298; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Allow circuit padding machines to hold a circuit open until they
|
|
|
+ are done padding it. Closes ticket 28780.
|
|
|
+
|
|
|
+ o Minor features (compile-time modules):
|
|
|
+ - Add a "--list-modules" command to print a list of which compile-
|
|
|
+ time modules are enabled. Closes ticket 30452.
|
|
|
+
|
|
|
+ o Minor features (continuous integration):
|
|
|
+ - Remove sudo configuration lines from .travis.yml as they are no
|
|
|
+ longer needed with current Travis build environment. Resolves
|
|
|
+ issue 30213.
|
|
|
+ - In Travis, show stem's tor log after failure. Closes ticket 30234.
|
|
|
+
|
|
|
+ o Minor features (controller):
|
|
|
+ - Add onion service version 3 support to the HSFETCH command.
|
|
|
+ Previously, only version 2 onion services were supported. Closes
|
|
|
+ ticket 25417. Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor features (debugging):
|
|
|
+ - Introduce tor_assertf() and tor_assertf_nonfatal() to enable
|
|
|
+ logging of additional information during assert failure. Now we
|
|
|
+ can use format strings to include information for trouble
|
|
|
+ shooting. Resolves ticket 29662.
|
|
|
+
|
|
|
+ o Minor features (defense in depth):
|
|
|
+ - In smartlist_remove_keeporder(), set unused pointers to NULL, in
|
|
|
+ case a bug causes them to be used later. Closes ticket 30176.
|
|
|
+ Patch from Tobias Stoeckmann.
|
|
|
+ - Tor now uses a cryptographically strong PRNG even for decisions
|
|
|
+ that we do not believe are security-sensitive. Previously, for
|
|
|
+ performance reasons, we had used a trivially predictable linear
|
|
|
+ congruential generator algorithm for certain load-balancing and
|
|
|
+ statistical sampling decisions. Now we use our fast RNG in those
|
|
|
+ cases. Closes ticket 29542.
|
|
|
+
|
|
|
+ o Minor features (developer tools):
|
|
|
+ - Tor's "practracker" test script now checks for files and functions
|
|
|
+ that seem too long and complicated. Existing overlong functions
|
|
|
+ and files are accepted for now, but should eventually be
|
|
|
+ refactored. Closes ticket 29221.
|
|
|
+ - Add some scripts used for git maintenance to scripts/git. Closes
|
|
|
+ ticket 29391.
|
|
|
+ - Call practracker from pre-push and pre-commit git hooks to let
|
|
|
+ developers know if they made any code style violations. Closes
|
|
|
+ ticket 30051.
|
|
|
+ - Add a script to check that each header has a well-formed and
|
|
|
+ unique guard macro. Closes ticket 29756.
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the May 13 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 30522.
|
|
|
+
|
|
|
+ o Minor features (HTTP tunnel):
|
|
|
+ - Return an informative web page when the HTTPTunnelPort is used as
|
|
|
+ an HTTP proxy. Closes ticket 27821, patch by "eighthave".
|
|
|
+
|
|
|
+ o Minor features (IPv6, v3 onion services):
|
|
|
+ - Make v3 onion services put IPv6 addresses in service descriptors.
|
|
|
+ Before this change, service descriptors only contained IPv4
|
|
|
+ addresses. Implements 26992.
|
|
|
+
|
|
|
+ o Minor features (modularity):
|
|
|
+ - The "--disable-module-dirauth" compile-time option now disables
|
|
|
+ even more dirauth-only code. Closes ticket 30345.
|
|
|
+
|
|
|
+ o Minor features (performance):
|
|
|
+ - Use OpenSSL's implementations of SHA3 when available (in OpenSSL
|
|
|
+ 1.1.1 and later), since they tend to be faster than tiny-keccak.
|
|
|
+ Closes ticket 28837.
|
|
|
+
|
|
|
+ o Minor features (testing):
|
|
|
+ - Tor's unit test code now contains helper functions to replace the
|
|
|
+ PRNG with a deterministic or reproducible version for testing.
|
|
|
+ Previously, various tests implemented this in various ways.
|
|
|
+ Implements ticket 29732.
|
|
|
+ - We now have a script, cov-test-determinism.sh, to identify places
|
|
|
+ where our unit test coverage has become nondeterministic. Closes
|
|
|
+ ticket 29436.
|
|
|
+ - Check that representative subsets of values of `int` and `unsigned
|
|
|
+ int` can be represented by `void *`. Resolves issue 29537.
|
|
|
+
|
|
|
+ o Minor bugfixes (bridge authority):
|
|
|
+ - Bridge authorities now set bridges as running or non-running when
|
|
|
+ about to dump their status to a file. Previously, they set bridges
|
|
|
+ as running in response to a GETINFO command, but those shouldn't
|
|
|
+ modify data structures. Fixes bug 24490; bugfix on 0.2.0.13-alpha.
|
|
|
+ Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor bugfixes (channel padding statistics):
|
|
|
+ - Channel padding write totals and padding-enabled totals are now
|
|
|
+ counted properly in relay extrainfo descriptors. Fixes bug 29231;
|
|
|
+ bugfix on 0.3.1.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (circuit padding):
|
|
|
+ - Add a "CircuitPadding" torrc option to disable circuit padding.
|
|
|
+ Fixes bug 28693; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Allow circuit padding machines to specify that they do not
|
|
|
+ contribute much overhead, and provide consensus flags and torrc
|
|
|
+ options to force clients to only use these low overhead machines.
|
|
|
+ Fixes bug 29203; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Provide a consensus parameter to fully disable circuit padding, to
|
|
|
+ be used in emergency network overload situations. Fixes bug 30173;
|
|
|
+ bugfix on 0.4.0.1-alpha.
|
|
|
+ - The circuit padding subsystem will no longer schedule padding if
|
|
|
+ dormant mode is enabled. Fixes bug 28636; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Inspect a circuit-level cell queue before sending padding, to
|
|
|
+ avoid sending padding while too much data is already queued. Fixes
|
|
|
+ bug 29204; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Avoid calling monotime_absolute_usec() in circuit padding machines
|
|
|
+ that do not use token removal or circuit RTT estimation. Fixes bug
|
|
|
+ 29085; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (compilation, unusual configurations):
|
|
|
+ - Avoid failures when building with the ALL_BUGS_ARE_FATAL option
|
|
|
+ due to missing declarations of abort(), and prevent other such
|
|
|
+ failures in the future. Fixes bug 30189; bugfix on 0.3.4.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (controller protocol):
|
|
|
+ - Teach the controller parser to distinguish an object preceded by
|
|
|
+ an argument list from one without. Previously, it couldn't
|
|
|
+ distinguish an argument list from the first line of a multiline
|
|
|
+ object. Fixes bug 29984; bugfix on 0.2.3.8-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (directory authority, ipv6):
|
|
|
+ - Directory authorities with IPv6 support now always mark themselves
|
|
|
+ as reachable via IPv6. Fixes bug 24338; bugfix on 0.4.0.2-alpha.
|
|
|
+ Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor bugfixes (documentation):
|
|
|
+ - Improve the documentation for using MapAddress with ".exit". Fixes
|
|
|
+ bug 30109; bugfix on 0.1.0.1-rc.
|
|
|
+ - Improve the monotonic time module and function documentation to
|
|
|
+ explain what "monotonic" actually means, and document some results
|
|
|
+ that have surprised people. Fixes bug 29640; bugfix
|
|
|
+ on 0.2.9.1-alpha.
|
|
|
+ - Use proper formatting when providing an example on quoting options
|
|
|
+ that contain whitespace. Fixes bug 29635; bugfix on 0.2.3.18-rc.
|
|
|
+
|
|
|
+ o Minor bugfixes (logging):
|
|
|
+ - Do not log a warning when running with an OpenSSL version other
|
|
|
+ than the one Tor was compiled with, if the two versions should be
|
|
|
+ compatible. Previously, we would warn whenever the version was
|
|
|
+ different. Fixes bug 30190; bugfix on 0.2.4.2-alpha.
|
|
|
+ - Warn operators when the MyFamily option is set but ContactInfo is
|
|
|
+ missing, as the latter should be set too. Fixes bug 25110; bugfix
|
|
|
+ on 0.3.3.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (memory leak):
|
|
|
+ - Avoid a minor memory leak that could occur on relays when failing
|
|
|
+ to create a "keys" directory. Fixes bug 30148; bugfix
|
|
|
+ on 0.3.3.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion services):
|
|
|
+ - Avoid a GCC 9.1.1 warning (and possible crash depending on libc
|
|
|
+ implemenation) when failing to load an onion service client
|
|
|
+ authorization file. Fixes bug 30475; bugfix on 0.3.5.1-alpha.
|
|
|
+ - When refusing to launch a controller's HSFETCH request because of
|
|
|
+ rate-limiting, respond to the controller with a new response,
|
|
|
+ "QUERY_RATE_LIMITED". Previously, we would log QUERY_NO_HSDIR for
|
|
|
+ this case. Fixes bug 28269; bugfix on 0.3.1.1-alpha. Patch by
|
|
|
+ Neel Chauhan.
|
|
|
+ - When relaunching a circuit to a rendezvous service, mark the
|
|
|
+ circuit as needing high-uptime routers as appropriate. Fixes bug
|
|
|
+ 17357; bugfix on 0.4.0.2-alpha. Patch by Neel Chauhan.
|
|
|
+ - Stop ignoring IPv6 link specifiers sent to v3 onion services.
|
|
|
+ (IPv6 support for v3 onion services is still incomplete: see
|
|
|
+ ticket 23493 for details.) Fixes bug 23588; bugfix on
|
|
|
+ 0.3.2.1-alpha. Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion services, performance):
|
|
|
+ - When building circuits to onion services, call tor_addr_parse()
|
|
|
+ less often. Previously, we called tor_addr_parse() in
|
|
|
+ circuit_is_acceptable() even if its output wasn't used. This
|
|
|
+ change should improve performance when building circuits. Fixes
|
|
|
+ bug 22210; bugfix on 0.2.8.12. Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor bugfixes (performance):
|
|
|
+ - When checking whether a node is a bridge, use a fast check to make
|
|
|
+ sure that its identity is set. Previously, we used a constant-time
|
|
|
+ check, which is not necessary in this case. Fixes bug 30308;
|
|
|
+ bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (pluggable transports):
|
|
|
+ - Tor now sets TOR_PT_EXIT_ON_STDIN_CLOSE=1 for client transports as
|
|
|
+ well as servers. Fixes bug 25614; bugfix on 0.2.7.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (probability distributions):
|
|
|
+ - Refactor and improve parts of the probability distribution code
|
|
|
+ that made Coverity complain. Fixes bug 29805; bugfix
|
|
|
+ on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (python):
|
|
|
+ - Stop assuming that /usr/bin/python3 exists. For scripts that work
|
|
|
+ with python2, use /usr/bin/python. Otherwise, use /usr/bin/env
|
|
|
+ python3. Fixes bug 29913; bugfix on 0.2.5.3-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (relay):
|
|
|
+ - When running as a relay, if IPv6Exit is set to 1 while ExitRelay
|
|
|
+ is auto, act as if ExitRelay is 1. Previously, we would ignore
|
|
|
+ IPv6Exit if ExitRelay was 0 or auto. Fixes bug 29613; bugfix on
|
|
|
+ 0.3.5.1-alpha. Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor bugfixes (stats):
|
|
|
+ - When ExtraInfoStatistics is 0, stop including bandwidth usage
|
|
|
+ statistics, GeoIPFile hashes, ServerTransportPlugin lines, and
|
|
|
+ bridge statistics by country in extra-info documents. Fixes bug
|
|
|
+ 29018; bugfix on 0.2.4.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (testing):
|
|
|
+ - Call setrlimit() to disable core dumps in test_bt_cl.c. Previously
|
|
|
+ we used `ulimit -c` in test_bt.sh, which violates POSIX shell
|
|
|
+ compatibility. Fixes bug 29061; bugfix on 0.3.5.1-alpha.
|
|
|
+ - Fix some incorrect code in the v3 onion service unit tests. Fixes
|
|
|
+ bug 29243; bugfix on 0.3.2.1-alpha.
|
|
|
+ - In the "routerkeys/*" tests, check the return values of mkdir()
|
|
|
+ for possible failures. Fixes bug 29939; bugfix on 0.2.7.2-alpha.
|
|
|
+ Found by Coverity as CID 1444254.
|
|
|
+ - Split test_utils_general() into several smaller test functions.
|
|
|
+ This makes it easier to perform resource deallocation on assert
|
|
|
+ failure, and fixes Coverity warnings CID 1444117 and CID 1444118.
|
|
|
+ Fixes bug 29823; bugfix on 0.2.9.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (tor-resolve):
|
|
|
+ - Fix a memory leak in tor-resolve that could happen if Tor gave it
|
|
|
+ a malformed SOCKS response. (Memory leaks in tor-resolve don't
|
|
|
+ actually matter, but it's good to fix them anyway.) Fixes bug
|
|
|
+ 30151; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Code simplification and refactoring:
|
|
|
+ - Abstract out the low-level formatting of replies on the control
|
|
|
+ port. Implements ticket 30007.
|
|
|
+ - Add several assertions in an attempt to fix some Coverity
|
|
|
+ warnings. Closes ticket 30149.
|
|
|
+ - Introduce a connection_dir_buf_add() helper function that checks
|
|
|
+ for compress_state of dir_connection_t and automatically writes a
|
|
|
+ string to directory connection with or without compression.
|
|
|
+ Resolves issue 28816.
|
|
|
+ - Make the base32_decode() API return the number of bytes written,
|
|
|
+ for consistency with base64_decode(). Closes ticket 28913.
|
|
|
+ - Move most relay-only periodic events out of mainloop.c into the
|
|
|
+ relay subsystem. Closes ticket 30414.
|
|
|
+ - Refactor and encapsulate parts of the codebase that manipulate
|
|
|
+ crypt_path_t objects. Resolves issue 30236.
|
|
|
+ - Refactor several places in our code that Coverity incorrectly
|
|
|
+ believed might have memory leaks. Closes ticket 30147.
|
|
|
+ - Remove redundant return values in crypto_format, and the
|
|
|
+ associated return value checks elsewhere in the code. Make the
|
|
|
+ implementations in crypto_format consistent, and remove redundant
|
|
|
+ code. Resolves ticket 29660.
|
|
|
+ - Rename tor_mem_is_zero() to fast_mem_is_zero(), to emphasize that
|
|
|
+ it is not a constant-time function. Closes ticket 30309.
|
|
|
+ - Replace hs_desc_link_specifier_t with link_specifier_t, and remove
|
|
|
+ all hs_desc_link_specifier_t-specific code. Fixes bug 22781;
|
|
|
+ bugfix on 0.3.2.1-alpha.
|
|
|
+ - Simplify v3 onion service link specifier handling code. Fixes bug
|
|
|
+ 23576; bugfix on 0.3.2.1-alpha.
|
|
|
+ - Split crypto_digest.c into NSS code, OpenSSL code, and shared
|
|
|
+ code. Resolves ticket 29108.
|
|
|
+ - Split control.c into several submodules, in preparation for
|
|
|
+ distributing its current responsibilities throughout the codebase.
|
|
|
+ Closes ticket 29894.
|
|
|
+ - Start to move responsibility for knowing about periodic events to
|
|
|
+ the appropriate subsystems, so that the mainloop doesn't need to
|
|
|
+ know all the periodic events in the rest of the codebase.
|
|
|
+ Implements tickets 30293 and 30294.
|
|
|
+
|
|
|
+ o Documentation:
|
|
|
+ - Document how to find git commits and tags for bug fixes in
|
|
|
+ CodingStandards.md. Update some file documentation. Closes
|
|
|
+ ticket 30261.
|
|
|
+
|
|
|
+ o Removed features:
|
|
|
+ - Remove the linux-tor-prio.sh script from contrib/operator-tools
|
|
|
+ directory. Resolves issue 29434.
|
|
|
+ - Remove the obsolete OpenSUSE initscript. Resolves issue 30076.
|
|
|
+ - Remove the obsolete script at contrib/dist/tor.sh.in. Resolves
|
|
|
+ issue 30075.
|
|
|
+
|
|
|
+ o Code simplification and refactoring (shell scripts):
|
|
|
+ - Clean up many of our shell scripts to fix shellcheck warnings.
|
|
|
+ These include autogen.sh (ticket 26069), test_keygen.sh (ticket
|
|
|
+ 29062), test_switch_id.sh (ticket 29065), test_rebind.sh (ticket
|
|
|
+ 29063), src/test/fuzz/minimize.sh (ticket 30079), test_rust.sh
|
|
|
+ (ticket 29064), torify (ticket 29070), asciidoc-helper.sh (29926),
|
|
|
+ fuzz_multi.sh (30077), fuzz_static_testcases.sh (ticket 29059),
|
|
|
+ nagios-check-tor-authority-cert (ticket 29071),
|
|
|
+ src/test/fuzz/fixup_filenames.sh (ticket 30078), test-network.sh
|
|
|
+ (ticket 29060), test_key_expiration.sh (ticket 30002),
|
|
|
+ zero_length_keys.sh (ticket 29068), and test_workqueue_*.sh
|
|
|
+ (ticket 29067).
|
|
|
+
|
|
|
+ o Testing (chutney):
|
|
|
+ - In "make test-network-all", test IPv6-only v3 single onion
|
|
|
+ services, using the chutney network single-onion-v23-ipv6-md.
|
|
|
+ Closes ticket 27251.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.4.0.5 - 2019-05-02
|
|
|
+ This is the first stable release in the 0.4.0.x series. It contains
|
|
|
+ improvements for power management and bootstrap reporting, as well as
|
|
|
+ preliminary backend support for circuit padding to prevent some kinds
|
|
|
+ of traffic analysis. It also continues our work in refactoring Tor for
|
|
|
+ long-term maintainability.
|
|
|
+
|
|
|
+ Per our support policy, we will support the 0.4.0.x series for nine
|
|
|
+ months, or until three months after the release of a stable 0.4.1.x:
|
|
|
+ whichever is longer. If you need longer-term support, please stick
|
|
|
+ with 0.3.5.x, which will we plan to support until Feb 2022.
|
|
|
+
|
|
|
+ Below are the changes since 0.4.0.4-rc. For a complete list of changes
|
|
|
+ since 0.3.5.7, see the ReleaseNotes file.
|
|
|
+
|
|
|
+ o Minor features (continuous integration):
|
|
|
+ - In Travis, tell timelimit to use stem's backtrace signals, and
|
|
|
+ launch python directly from timelimit, so python receives the
|
|
|
+ signals from timelimit, rather than make. Closes ticket 30117.
|
|
|
+
|
|
|
+ o Minor features (diagnostic):
|
|
|
+ - Add more diagnostic log messages in an attempt to solve the issue
|
|
|
+ of NUL bytes appearing in a microdescriptor cache. Related to
|
|
|
+ ticket 28223.
|
|
|
+
|
|
|
+ o Minor features (testing):
|
|
|
+ - Use the approx_time() function when setting the "Expires" header
|
|
|
+ in directory replies, to make them more testable. Needed for
|
|
|
+ ticket 30001.
|
|
|
+
|
|
|
+ o Minor bugfixes (rust):
|
|
|
+ - Abort on panic in all build profiles, instead of potentially
|
|
|
+ unwinding into C code. Fixes bug 27199; bugfix on 0.3.3.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (shellcheck):
|
|
|
+ - Look for scripts in their correct locations during "make
|
|
|
+ shellcheck". Previously we had looked in the wrong place during
|
|
|
+ out-of-tree builds. Fixes bug 30263; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (testing):
|
|
|
+ - Check the time in the "Expires" header using approx_time(). Fixes
|
|
|
+ bug 30001; bugfix on 0.4.0.4-rc.
|
|
|
+
|
|
|
+ o Minor bugfixes (UI):
|
|
|
+ - Lower log level of unlink() errors during bootstrap. Fixes bug
|
|
|
+ 29930; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.4.0.4-rc - 2019-04-11
|
|
|
+ Tor 0.4.0.4-rc is the first release candidate in its series; it fixes
|
|
|
+ several bugs from earlier versions, including some that had affected
|
|
|
+ stability, and one that prevented relays from working with NSS.
|
|
|
+
|
|
|
+ o Major bugfixes (NSS, relay):
|
|
|
+ - When running with NSS, disable TLS 1.2 ciphersuites that use
|
|
|
+ SHA384 for their PRF. Due to an NSS bug, the TLS key exporters for
|
|
|
+ these ciphersuites don't work -- which caused relays to fail to
|
|
|
+ handshake with one another when these ciphersuites were enabled.
|
|
|
+ Fixes bug 29241; bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor features (bandwidth authority):
|
|
|
+ - Make bandwidth authorities ignore relays that are reported in the
|
|
|
+ bandwidth file with the flag "vote=0". This change allows us to
|
|
|
+ report unmeasured relays for diagnostic reasons without including
|
|
|
+ their bandwidth in the bandwidth authorities' vote. Closes
|
|
|
+ ticket 29806.
|
|
|
+ - When a directory authority is using a bandwidth file to obtain the
|
|
|
+ bandwidth values that will be included in the next vote, serve
|
|
|
+ this bandwidth file at /tor/status-vote/next/bandwidth. Closes
|
|
|
+ ticket 21377.
|
|
|
+
|
|
|
+ o Minor features (circuit padding):
|
|
|
+ - Stop warning about undefined behavior in the probability
|
|
|
+ distribution tests. Float division by zero may technically be
|
|
|
+ undefined behavior in C, but it's well defined in IEEE 754.
|
|
|
+ Partial backport of 29298. Closes ticket 29527; bugfix
|
|
|
+ on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor features (continuous integration):
|
|
|
+ - On Travis Rust builds, cleanup Rust registry and refrain from
|
|
|
+ caching the "target/" directory to speed up builds. Resolves
|
|
|
+ issue 29962.
|
|
|
+
|
|
|
+ o Minor features (dormant mode):
|
|
|
+ - Add a DormantCanceledByStartup option to tell Tor that it should
|
|
|
+ treat a startup event as cancelling any previous dormant state.
|
|
|
+ Integrators should use this option with caution: it should only be
|
|
|
+ used if Tor is being started because of something that the user
|
|
|
+ did, and not if Tor is being automatically started in the
|
|
|
+ background. Closes ticket 29357.
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the April 2 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 29992.
|
|
|
+
|
|
|
+ o Minor features (NSS, diagnostic):
|
|
|
+ - Try to log an error from NSS (if there is any) and a more useful
|
|
|
+ description of our situation if we are using NSS and a call to
|
|
|
+ SSL_ExportKeyingMaterial() fails. Diagnostic for ticket 29241.
|
|
|
+
|
|
|
+ o Minor bugfixes (security):
|
|
|
+ - Fix a potential double free bug when reading huge bandwidth files.
|
|
|
+ The issue is not exploitable in the current Tor network because
|
|
|
+ the vulnerable code is only reached when directory authorities
|
|
|
+ read bandwidth files, but bandwidth files come from a trusted
|
|
|
+ source (usually the authorities themselves). Furthermore, the
|
|
|
+ issue is only exploitable in rare (non-POSIX) 32-bit architectures,
|
|
|
+ which are not used by any of the current authorities. Fixes bug
|
|
|
+ 30040; bugfix on 0.3.5.1-alpha. Bug found and fixed by
|
|
|
+ Tobias Stoeckmann.
|
|
|
+ - Verify in more places that we are not about to create a buffer
|
|
|
+ with more than INT_MAX bytes, to avoid possible OOB access in the
|
|
|
+ event of bugs. Fixes bug 30041; bugfix on 0.2.0.16. Found and
|
|
|
+ fixed by Tobias Stoeckmann.
|
|
|
+
|
|
|
+ o Minor bugfix (continuous integration):
|
|
|
+ - Reset coverage state on disk after Travis CI has finished. This
|
|
|
+ should prevent future coverage merge errors from causing the test
|
|
|
+ suite for the "process" subsystem to fail. The process subsystem
|
|
|
+ was introduced in 0.4.0.1-alpha. Fixes bug 29036; bugfix
|
|
|
+ on 0.2.9.15.
|
|
|
+ - Terminate test-stem if it takes more than 9.5 minutes to run.
|
|
|
+ (Travis terminates the job after 10 minutes of no output.)
|
|
|
+ Diagnostic for 29437. Fixes bug 30011; bugfix on 0.3.5.4-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (bootstrap reporting):
|
|
|
+ - During bootstrap reporting, correctly distinguish pluggable
|
|
|
+ transports from plain proxies. Fixes bug 28925; bugfix
|
|
|
+ on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (C correctness):
|
|
|
+ - Fix an unlikely memory leak in consensus_diff_apply(). Fixes bug
|
|
|
+ 29824; bugfix on 0.3.1.1-alpha. This is Coverity warning
|
|
|
+ CID 1444119.
|
|
|
+
|
|
|
+ o Minor bugfixes (circuitpadding testing):
|
|
|
+ - Minor tweaks to avoid rare test failures related to timers and
|
|
|
+ monotonic time. Fixes bug 29500; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (directory authorities):
|
|
|
+ - Actually include the bandwidth-file-digest line in directory
|
|
|
+ authority votes. Fixes bug 29959; bugfix on 0.4.0.2-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (logging):
|
|
|
+ - On Windows, when errors cause us to reload a consensus from disk,
|
|
|
+ tell the user that we are retrying at log level "notice".
|
|
|
+ Previously we only logged this information at "info", which was
|
|
|
+ confusing because the errors themselves were logged at "warning".
|
|
|
+ Improves previous fix for 28614. Fixes bug 30004; bugfix
|
|
|
+ on 0.4.0.2-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (pluggable transports):
|
|
|
+ - Restore old behavior when it comes to discovering the path of a
|
|
|
+ given Pluggable Transport executable file. A change in
|
|
|
+ 0.4.0.1-alpha had broken this behavior on paths containing a
|
|
|
+ space. Fixes bug 29874; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (testing):
|
|
|
+ - Backport the 0.3.4 src/test/test-network.sh to 0.2.9. We need a
|
|
|
+ recent test-network.sh to use new chutney features in CI. Fixes
|
|
|
+ bug 29703; bugfix on 0.2.9.1-alpha.
|
|
|
+ - Fix a test failure on Windows caused by an unexpected "BUG"
|
|
|
+ warning in our tests for tor_gmtime_r(-1). Fixes bug 29922; bugfix
|
|
|
+ on 0.2.9.3-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (TLS protocol):
|
|
|
+ - When classifying a client's selection of TLS ciphers, if the
|
|
|
+ client ciphers are not yet available, do not cache the result.
|
|
|
+ Previously, we had cached the unavailability of the cipher list
|
|
|
+ and never looked again, which in turn led us to assume that the
|
|
|
+ client only supported the ancient V1 link protocol. This, in turn,
|
|
|
+ was causing Stem integration tests to stall in some cases. Fixes
|
|
|
+ bug 30021; bugfix on 0.2.4.8-alpha.
|
|
|
+
|
|
|
+ o Code simplification and refactoring:
|
|
|
+ - Introduce a connection_dir_buf_add() helper function that detects
|
|
|
+ whether compression is in use, and adds a string accordingly.
|
|
|
+ Resolves issue 28816.
|
|
|
+ - Refactor handle_get_next_bandwidth() to use
|
|
|
+ connection_dir_buf_add(). Implements ticket 29897.
|
|
|
+
|
|
|
+ o Documentation:
|
|
|
+ - Clarify that Tor performs stream isolation among *Port listeners
|
|
|
+ by default. Resolves issue 29121.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.4.0.3-alpha - 2019-03-22
|
|
|
+ Tor 0.4.0.3-alpha is the third in its series; it fixes several small
|
|
|
+ bugs from earlier versions.
|
|
|
+
|
|
|
+ o Minor features (address selection):
|
|
|
+ - Treat the subnet 100.64.0.0/10 as public for some purposes;
|
|
|
+ private for others. This subnet is the RFC 6598 (Carrier Grade
|
|
|
+ NAT) IP range, and is deployed by many ISPs as an alternative to
|
|
|
+ RFC 1918 that does not break existing internal networks. Tor now
|
|
|
+ blocks SOCKS and control ports on these addresses and warns users
|
|
|
+ if client ports or ExtORPorts are listening on a RFC 6598 address.
|
|
|
+ Closes ticket 28525. Patch by Neel Chauhan.
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the March 4 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 29666.
|
|
|
+
|
|
|
+ o Minor bugfixes (circuitpadding):
|
|
|
+ - Inspect the circuit-level cell queue before sending padding, to
|
|
|
+ avoid sending padding when too much data is queued. Fixes bug
|
|
|
+ 29204; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (logging):
|
|
|
+ - Correct a misleading error message when IPv4Only or IPv6Only is
|
|
|
+ used but the resolved address can not be interpreted as an address
|
|
|
+ of the specified IP version. Fixes bug 13221; bugfix on
|
|
|
+ 0.2.3.9-alpha. Patch from Kris Katterjohn.
|
|
|
+ - Log the correct port number for listening sockets when "auto" is
|
|
|
+ used to let Tor pick the port number. Previously, port 0 was
|
|
|
+ logged instead of the actual port number. Fixes bug 29144; bugfix
|
|
|
+ on 0.3.5.1-alpha. Patch from Kris Katterjohn.
|
|
|
+ - Stop logging a BUG() warning when Tor is waiting for exit
|
|
|
+ descriptors. Fixes bug 28656; bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (memory management):
|
|
|
+ - Refactor the shared random state's memory management so that it
|
|
|
+ actually takes ownership of the shared random value pointers.
|
|
|
+ Fixes bug 29706; bugfix on 0.2.9.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (memory management, testing):
|
|
|
+ - Stop leaking parts of the shared random state in the shared-random
|
|
|
+ unit tests. Fixes bug 29599; bugfix on 0.2.9.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (pluggable transports):
|
|
|
+ - Fix an assertion failure crash bug when a pluggable transport is
|
|
|
+ terminated during the bootstrap phase. Fixes bug 29562; bugfix
|
|
|
+ on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (Rust, protover):
|
|
|
+ - Add a missing "Padding" value to the Rust implementation of
|
|
|
+ protover. Fixes bug 29631; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (single onion services):
|
|
|
+ - Allow connections to single onion services to remain idle without
|
|
|
+ being disconnected. Previously, relays acting as rendezvous points
|
|
|
+ for single onion services were mistakenly closing idle rendezvous
|
|
|
+ circuits after 60 seconds, thinking that they were unused
|
|
|
+ directory-fetching circuits that had served their purpose. Fixes
|
|
|
+ bug 29665; bugfix on 0.2.1.26.
|
|
|
+
|
|
|
+ o Minor bugfixes (stats):
|
|
|
+ - When ExtraInfoStatistics is 0, stop including PaddingStatistics in
|
|
|
+ relay and bridge extra-info documents. Fixes bug 29017; bugfix
|
|
|
+ on 0.3.1.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (testing):
|
|
|
+ - Downgrade some LOG_ERR messages in the address/* tests to
|
|
|
+ warnings. The LOG_ERR messages were occurring when we had no
|
|
|
+ configured network. We were failing the unit tests, because we
|
|
|
+ backported 28668 to 0.3.5.8, but did not backport 29530. Fixes bug
|
|
|
+ 29530; bugfix on 0.3.5.8.
|
|
|
+ - Fix our gcov wrapper script to look for object files at the
|
|
|
+ correct locations. Fixes bug 29435; bugfix on 0.3.5.1-alpha.
|
|
|
+ - Decrease the false positive rate of stochastic probability
|
|
|
+ distribution tests. Fixes bug 29693; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (Windows, CI):
|
|
|
+ - Skip the Appveyor 32-bit Windows Server 2016 job, and 64-bit
|
|
|
+ Windows Server 2012 R2 job. The remaining 2 jobs still provide
|
|
|
+ coverage of 64/32-bit, and Windows Server 2016/2012 R2. Also set
|
|
|
+ fast_finish, so failed jobs terminate the build immediately. Fixes
|
|
|
+ bug 29601; bugfix on 0.3.5.4-alpha.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.3.5.8 - 2019-02-21
|
|
|
+ Tor 0.3.5.8 backports several fixes from later releases, including fixes
|
|
|
+ for an annoying SOCKS-parsing bug that affected users in earlier 0.3.5.x
|
|
|
+ releases.
|
|
|
+
|
|
|
+ It also includes a fix for a medium-severity security bug affecting Tor
|
|
|
+ 0.3.2.1-alpha and later. All Tor instances running an affected release
|
|
|
+ should upgrade to 0.3.3.12, 0.3.4.11, 0.3.5.8, or 0.4.0.2-alpha.
|
|
|
+
|
|
|
+ o Major bugfixes (cell scheduler, KIST, security):
|
|
|
+ - Make KIST consider the outbuf length when computing what it can
|
|
|
+ put in the outbuf. Previously, KIST acted as though the outbuf
|
|
|
+ were empty, which could lead to the outbuf becoming too full. It
|
|
|
+ is possible that an attacker could exploit this bug to cause a Tor
|
|
|
+ client or relay to run out of memory and crash. Fixes bug 29168;
|
|
|
+ bugfix on 0.3.2.1-alpha. This issue is also being tracked as
|
|
|
+ TROVE-2019-001 and CVE-2019-8955.
|
|
|
+
|
|
|
+ o Major bugfixes (networking, backport from 0.4.0.2-alpha):
|
|
|
+ - Gracefully handle empty username/password fields in SOCKS5
|
|
|
+ username/password auth message and allow SOCKS5 handshake to
|
|
|
+ continue. Previously, we had rejected these handshakes, breaking
|
|
|
+ certain applications. Fixes bug 29175; bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor features (compilation, backport from 0.4.0.2-alpha):
|
|
|
+ - Compile correctly when OpenSSL is built with engine support
|
|
|
+ disabled, or with deprecated APIs disabled. Closes ticket 29026.
|
|
|
+ Patches from "Mangix".
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the February 5 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 29478.
|
|
|
+
|
|
|
+ o Minor features (testing, backport from 0.4.0.2-alpha):
|
|
|
+ - Treat all unexpected ERR and BUG messages as test failures. Closes
|
|
|
+ ticket 28668.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion service v3, client, backport from 0.4.0.1-alpha):
|
|
|
+ - Stop logging a "BUG()" warning and stacktrace when we find a SOCKS
|
|
|
+ connection waiting for a descriptor that we actually have in the
|
|
|
+ cache. It turns out that this can actually happen, though it is
|
|
|
+ rare. Now, tor will recover and retry the descriptor. Fixes bug
|
|
|
+ 28669; bugfix on 0.3.2.4-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (IPv6, backport from 0.4.0.1-alpha):
|
|
|
+ - Fix tor_ersatz_socketpair on IPv6-only systems. Previously, the
|
|
|
+ IPv6 socket was bound using an address family of AF_INET instead
|
|
|
+ of AF_INET6. Fixes bug 28995; bugfix on 0.3.5.1-alpha. Patch from
|
|
|
+ Kris Katterjohn.
|
|
|
+
|
|
|
+ o Minor bugfixes (build, compatibility, rust, backport from 0.4.0.2-alpha):
|
|
|
+ - Update Cargo.lock file to match the version made by the latest
|
|
|
+ version of Rust, so that "make distcheck" will pass again. Fixes
|
|
|
+ bug 29244; bugfix on 0.3.3.4-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (client, clock skew, backport from 0.4.0.1-alpha):
|
|
|
+ - Select guards even if the consensus has expired, as long as the
|
|
|
+ consensus is still reasonably live. Fixes bug 24661; bugfix
|
|
|
+ on 0.3.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (compilation, backport from 0.4.0.1-alpha):
|
|
|
+ - Compile correctly on OpenBSD; previously, we were missing some
|
|
|
+ headers required in order to detect it properly. Fixes bug 28938;
|
|
|
+ bugfix on 0.3.5.1-alpha. Patch from Kris Katterjohn.
|
|
|
+
|
|
|
+ o Minor bugfixes (documentation, backport from 0.4.0.2-alpha):
|
|
|
+ - Describe the contents of the v3 onion service client authorization
|
|
|
+ files correctly: They hold public keys, not private keys. Fixes
|
|
|
+ bug 28979; bugfix on 0.3.5.1-alpha. Spotted by "Felixix".
|
|
|
+
|
|
|
+ o Minor bugfixes (logging, backport from 0.4.0.1-alpha):
|
|
|
+ - Rework rep_hist_log_link_protocol_counts() to iterate through all
|
|
|
+ link protocol versions when logging incoming/outgoing connection
|
|
|
+ counts. Tor no longer skips version 5, and we won't have to
|
|
|
+ remember to update this function when new link protocol version is
|
|
|
+ developed. Fixes bug 28920; bugfix on 0.2.6.10.
|
|
|
+
|
|
|
+ o Minor bugfixes (logging, backport from 0.4.0.2-alpha):
|
|
|
+ - Log more information at "warning" level when unable to read a
|
|
|
+ private key; log more information at "info" level when unable to
|
|
|
+ read a public key. We had warnings here before, but they were lost
|
|
|
+ during our NSS work. Fixes bug 29042; bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (misc, backport from 0.4.0.2-alpha):
|
|
|
+ - The amount of total available physical memory is now determined
|
|
|
+ using the sysctl identifier HW_PHYSMEM (rather than HW_USERMEM)
|
|
|
+ when it is defined and a 64-bit variant is not available. Fixes
|
|
|
+ bug 28981; bugfix on 0.2.5.4-alpha. Patch from Kris Katterjohn.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion services, backport from 0.4.0.2-alpha):
|
|
|
+ - Avoid crashing if ClientOnionAuthDir (incorrectly) contains more
|
|
|
+ than one private key for a hidden service. Fixes bug 29040; bugfix
|
|
|
+ on 0.3.5.1-alpha.
|
|
|
+ - In hs_cache_store_as_client() log an HSDesc we failed to parse at
|
|
|
+ "debug" level. Tor used to log it as a warning, which caused very
|
|
|
+ long log lines to appear for some users. Fixes bug 29135; bugfix
|
|
|
+ on 0.3.2.1-alpha.
|
|
|
+ - Stop logging "Tried to establish rendezvous on non-OR circuit..."
|
|
|
+ as a warning. Instead, log it as a protocol warning, because there
|
|
|
+ is nothing that relay operators can do to fix it. Fixes bug 29029;
|
|
|
+ bugfix on 0.2.5.7-rc.
|
|
|
+
|
|
|
+ o Minor bugfixes (tests, directory clients, backport from 0.4.0.1-alpha):
|
|
|
+ - Mark outdated dirservers when Tor only has a reasonably live
|
|
|
+ consensus. Fixes bug 28569; bugfix on 0.3.2.5-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (tests, backport from 0.4.0.2-alpha):
|
|
|
+ - Detect and suppress "bug" warnings from the util/time test on
|
|
|
+ Windows. Fixes bug 29161; bugfix on 0.2.9.3-alpha.
|
|
|
+ - Do not log an error-level message if we fail to find an IPv6
|
|
|
+ network interface from the unit tests. Fixes bug 29160; bugfix
|
|
|
+ on 0.2.7.3-rc.
|
|
|
+
|
|
|
+ o Minor bugfixes (usability, backport from 0.4.0.1-alpha):
|
|
|
+ - Stop saying "Your Guard ..." in pathbias_measure_{use,close}_rate().
|
|
|
+ Some users took this phrasing to mean that the mentioned guard was
|
|
|
+ under their control or responsibility, which it is not. Fixes bug
|
|
|
+ 28895; bugfix on Tor 0.3.0.1-alpha.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.3.4.11 - 2019-02-21
|
|
|
+ Tor 0.3.4.11 is the third stable release in its series. It includes
|
|
|
+ a fix for a medium-severity security bug affecting Tor 0.3.2.1-alpha and
|
|
|
+ later. All Tor instances running an affected release should upgrade to
|
|
|
+ 0.3.3.12, 0.3.4.11, 0.3.5.8, or 0.4.0.2-alpha.
|
|
|
+
|
|
|
+ o Major bugfixes (cell scheduler, KIST, security):
|
|
|
+ - Make KIST consider the outbuf length when computing what it can
|
|
|
+ put in the outbuf. Previously, KIST acted as though the outbuf
|
|
|
+ were empty, which could lead to the outbuf becoming too full. It
|
|
|
+ is possible that an attacker could exploit this bug to cause a Tor
|
|
|
+ client or relay to run out of memory and crash. Fixes bug 29168;
|
|
|
+ bugfix on 0.3.2.1-alpha. This issue is also being tracked as
|
|
|
+ TROVE-2019-001 and CVE-2019-8955.
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the February 5 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 29478.
|
|
|
+
|
|
|
+ o Minor bugfixes (build, compatibility, rust, backport from 0.4.0.2-alpha):
|
|
|
+ - Update Cargo.lock file to match the version made by the latest
|
|
|
+ version of Rust, so that "make distcheck" will pass again. Fixes
|
|
|
+ bug 29244; bugfix on 0.3.3.4-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion services, backport from 0.4.0.2-alpha):
|
|
|
+ - Stop logging "Tried to establish rendezvous on non-OR circuit..."
|
|
|
+ as a warning. Instead, log it as a protocol warning, because there
|
|
|
+ is nothing that relay operators can do to fix it. Fixes bug 29029;
|
|
|
+ bugfix on 0.2.5.7-rc.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.3.3.12 - 2019-02-21
|
|
|
+ Tor 0.3.3.12 fixes a medium-severity security bug affecting Tor
|
|
|
+ 0.3.2.1-alpha and later. All Tor instances running an affected release
|
|
|
+ should upgrade to 0.3.3.12, 0.3.4.11, 0.3.5.8, or 0.4.0.2-alpha.
|
|
|
+
|
|
|
+ This release marks the end of support for the Tor 0.3.3.x series. We
|
|
|
+ recommend that users switch to either the Tor 0.3.4 series (supported
|
|
|
+ until at least 10 June 2019), or the Tor 0.3.5 series, which will
|
|
|
+ receive long-term support until at least 1 Feb 2022.
|
|
|
+
|
|
|
+ o Major bugfixes (cell scheduler, KIST, security):
|
|
|
+ - Make KIST consider the outbuf length when computing what it can
|
|
|
+ put in the outbuf. Previously, KIST acted as though the outbuf
|
|
|
+ were empty, which could lead to the outbuf becoming too full. It
|
|
|
+ is possible that an attacker could exploit this bug to cause a Tor
|
|
|
+ client or relay to run out of memory and crash. Fixes bug 29168;
|
|
|
+ bugfix on 0.3.2.1-alpha. This issue is also being tracked as
|
|
|
+ TROVE-2019-001 and CVE-2019-8955.
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the February 5 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 29478.
|
|
|
+
|
|
|
+ o Minor bugfixes (build, compatibility, rust, backport from 0.4.0.2-alpha):
|
|
|
+ - Update Cargo.lock file to match the version made by the latest
|
|
|
+ version of Rust, so that "make distcheck" will pass again. Fixes
|
|
|
+ bug 29244; bugfix on 0.3.3.4-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion services, backport from 0.4.0.2-alpha):
|
|
|
+ - Stop logging "Tried to establish rendezvous on non-OR circuit..."
|
|
|
+ as a warning. Instead, log it as a protocol warning, because there
|
|
|
+ is nothing that relay operators can do to fix it. Fixes bug 29029;
|
|
|
+ bugfix on 0.2.5.7-rc.
|
|
|
+
|
|
|
+
|
|
|
+Changes in version 0.4.0.2-alpha - 2019-02-21
|
|
|
+ Tor 0.4.0.2-alpha is the second alpha in its series; it fixes several
|
|
|
+ bugs from earlier versions, including several that had broken
|
|
|
+ backward compatibility.
|
|
|
+
|
|
|
+ It also includes a fix for a medium-severity security bug affecting Tor
|
|
|
+ 0.3.2.1-alpha and later. All Tor instances running an affected release
|
|
|
+ should upgrade to 0.3.3.12, 0.3.4.11, 0.3.5.8, or 0.4.0.2-alpha.
|
|
|
+
|
|
|
+ o Major bugfixes (cell scheduler, KIST, security):
|
|
|
+ - Make KIST consider the outbuf length when computing what it can
|
|
|
+ put in the outbuf. Previously, KIST acted as though the outbuf
|
|
|
+ were empty, which could lead to the outbuf becoming too full. It
|
|
|
+ is possible that an attacker could exploit this bug to cause a Tor
|
|
|
+ client or relay to run out of memory and crash. Fixes bug 29168;
|
|
|
+ bugfix on 0.3.2.1-alpha. This issue is also being tracked as
|
|
|
+ TROVE-2019-001 and CVE-2019-8955.
|
|
|
+
|
|
|
+ o Major bugfixes (networking):
|
|
|
+ - Gracefully handle empty username/password fields in SOCKS5
|
|
|
+ username/password auth messsage and allow SOCKS5 handshake to
|
|
|
+ continue. Previously, we had rejected these handshakes, breaking
|
|
|
+ certain applications. Fixes bug 29175; bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Major bugfixes (windows, startup):
|
|
|
+ - When reading a consensus file from disk, detect whether it was
|
|
|
+ written in text mode, and re-read it in text mode if so. Always
|
|
|
+ write consensus files in binary mode so that we can map them into
|
|
|
+ memory later. Previously, we had written in text mode, which
|
|
|
+ confused us when we tried to map the file on windows. Fixes bug
|
|
|
+ 28614; bugfix on 0.4.0.1-alpha.
|
|
|
+
|
|
|
+ o Minor features (compilation):
|
|
|
+ - Compile correctly when OpenSSL is built with engine support
|
|
|
+ disabled, or with deprecated APIs disabled. Closes ticket 29026.
|
|
|
+ Patches from "Mangix".
|
|
|
+
|
|
|
+ o Minor features (developer tooling):
|
|
|
+ - Check that bugfix versions in changes files look like Tor versions
|
|
|
+ from the versions spec. Warn when bugfixes claim to be on a future
|
|
|
+ release. Closes ticket 27761.
|
|
|
+ - Provide a git pre-commit hook that disallows committing if we have
|
|
|
+ any failures in our code and changelog formatting checks. It is
|
|
|
+ now available in scripts/maint/pre-commit.git-hook. Implements
|
|
|
+ feature 28976.
|
|
|
+
|
|
|
+ o Minor features (directory authority):
|
|
|
+ - When a directory authority is using a bandwidth file to obtain
|
|
|
+ bandwidth values, include the digest of that file in the vote.
|
|
|
+ Closes ticket 26698.
|
|
|
+
|
|
|
+ o Minor features (geoip):
|
|
|
+ - Update geoip and geoip6 to the February 5 2019 Maxmind GeoLite2
|
|
|
+ Country database. Closes ticket 29478.
|
|
|
+
|
|
|
+ o Minor features (testing):
|
|
|
+ - Treat all unexpected ERR and BUG messages as test failures. Closes
|
|
|
+ ticket 28668.
|
|
|
+
|
|
|
+ o Minor bugfixes (build, compatibility, rust):
|
|
|
+ - Update Cargo.lock file to match the version made by the latest
|
|
|
+ version of Rust, so that "make distcheck" will pass again. Fixes
|
|
|
+ bug 29244; bugfix on 0.3.3.4-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (compilation):
|
|
|
+ - Fix compilation warnings in test_circuitpadding.c. Fixes bug
|
|
|
+ 29169; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Silence a compiler warning in test-memwipe.c on OpenBSD. Fixes bug
|
|
|
+ 29145; bugfix on 0.2.9.3-alpha. Patch from Kris Katterjohn.
|
|
|
+
|
|
|
+ o Minor bugfixes (documentation):
|
|
|
+ - Describe the contents of the v3 onion service client authorization
|
|
|
+ files correctly: They hold public keys, not private keys. Fixes
|
|
|
+ bug 28979; bugfix on 0.3.5.1-alpha. Spotted by "Felixix".
|
|
|
+
|
|
|
+ o Minor bugfixes (linux seccomp sandbox):
|
|
|
+ - Fix startup crash when experimental sandbox support is enabled.
|
|
|
+ Fixes bug 29150; bugfix on 0.4.0.1-alpha. Patch by Peter Gerber.
|
|
|
+
|
|
|
+ o Minor bugfixes (logging):
|
|
|
+ - Avoid logging that we are relaxing a circuit timeout when that
|
|
|
+ timeout is fixed. Fixes bug 28698; bugfix on 0.2.4.7-alpha.
|
|
|
+ - Log more information at "warning" level when unable to read a
|
|
|
+ private key; log more information at "info" level when unable to
|
|
|
+ read a public key. We had warnings here before, but they were lost
|
|
|
+ during our NSS work. Fixes bug 29042; bugfix on 0.3.5.1-alpha.
|
|
|
+
|
|
|
+ o Minor bugfixes (misc):
|
|
|
+ - The amount of total available physical memory is now determined
|
|
|
+ using the sysctl identifier HW_PHYSMEM (rather than HW_USERMEM)
|
|
|
+ when it is defined and a 64-bit variant is not available. Fixes
|
|
|
+ bug 28981; bugfix on 0.2.5.4-alpha. Patch from Kris Katterjohn.
|
|
|
+
|
|
|
+ o Minor bugfixes (onion services):
|
|
|
+ - Avoid crashing if ClientOnionAuthDir (incorrectly) contains more
|
|
|
+ than one private key for a hidden service. Fixes bug 29040; bugfix
|
|
|
+ on 0.3.5.1-alpha.
|
|
|
+ - In hs_cache_store_as_client() log an HSDesc we failed to parse at
|
|
|
+ "debug" level. Tor used to log it as a warning, which caused very
|
|
|
+ long log lines to appear for some users. Fixes bug 29135; bugfix
|
|
|
+ on 0.3.2.1-alpha.
|
|
|
+ - Stop logging "Tried to establish rendezvous on non-OR circuit..."
|
|
|
+ as a warning. Instead, log it as a protocol warning, because there
|
|
|
+ is nothing that relay operators can do to fix it. Fixes bug 29029;
|
|
|
+ bugfix on 0.2.5.7-rc.
|
|
|
+
|
|
|
+ o Minor bugfixes (scheduler):
|
|
|
+ - When re-adding channels to the pending list, check the correct
|
|
|
+ channel's sched_heap_idx. This issue has had no effect in mainline
|
|
|
+ Tor, but could have led to bugs down the road in improved versions
|
|
|
+ of our circuit scheduling code. Fixes bug 29508; bugfix
|
|
|
+ on 0.3.2.10.
|
|
|
+
|
|
|
+ o Minor bugfixes (tests):
|
|
|
+ - Fix intermittent failures on an adaptive padding test. Fixes one
|
|
|
+ case of bug 29122; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Disable an unstable circuit-padding test that was failing
|
|
|
+ intermittently because of an ill-defined small histogram. Such
|
|
|
+ histograms will be allowed again after 29298 is implemented. Fixes
|
|
|
+ a second case of bug 29122; bugfix on 0.4.0.1-alpha.
|
|
|
+ - Detect and suppress "bug" warnings from the util/time test on
|
|
|
+ Windows. Fixes bug 29161; bugfix on 0.2.9.3-alpha.
|
|
|
+ - Do not log an error-level message if we fail to find an IPv6
|
|
|
+ network interface from the unit tests. Fixes bug 29160; bugfix
|
|
|
+ on 0.2.7.3-rc.
|
|
|
+
|
|
|
+ o Documentation:
|
|
|
+ - In the manpage entry describing MapAddress torrc setting, use
|
|
|
+ example IP addresses from ranges specified for use in documentation
|
|
|
+ by RFC 5737. Resolves issue 28623.
|
|
|
+
|
|
|
+ o Removed features:
|
|
|
+ - Remove the old check-tor script. Resolves issue 29072.
|
|
|
+
|
|
|
+
|
|
|
Changes in version 0.4.0.1-alpha - 2019-01-18
|
|
|
Tor 0.4.0.1-alpha is the first release in the new 0.4.0.x series. It
|
|
|
introduces improved features for power and bandwidth conservation,
|
George Kadianakis