2011-07-18 19:18:46 +02:00
|
|
|
Changes in version 0.2.3.2-alpha - 2011-07-18
|
2011-07-18 19:39:01 +02:00
|
|
|
Tor 0.2.3.2-alpha introduces two new experimental features:
|
|
|
|
|
microdescriptors and pluggable transports. It also continues cleaning
|
|
|
|
|
up a variety of recently introduced features.
|
|
|
|
|
|
2011-07-18 19:18:46 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Clients can now use microdescriptors instead of regular descriptors
|
2011-07-18 19:39:01 +02:00
|
|
|
to build circuits. Microdescriptors are authority-generated
|
|
|
|
|
summaries of regular descriptors' contents, designed to change
|
|
|
|
|
very rarely (see proposal 158 for details). This feature is
|
|
|
|
|
designed to save bandwidth, especially for clients on slow internet
|
|
|
|
|
connections. It's off by default for now, since nearly no caches
|
|
|
|
|
support it, but it will be on-by-default for clients in a future
|
|
|
|
|
version. You can use the UseMicrodescriptors option to turn it on.
|
2011-07-18 19:18:46 +02:00
|
|
|
- Tor clients using bridges can now be configured to use a separate
|
|
|
|
|
'transport' proxy for each bridge. This approach helps to resist
|
|
|
|
|
censorship by allowing bridges to use protocol obfuscation
|
|
|
|
|
plugins. It implements part of proposal 180. Implements ticket 2841.
|
|
|
|
|
- While we're trying to bootstrap, record how many TLS connections
|
|
|
|
|
fail in each state, and report which states saw the most failures
|
|
|
|
|
in response to any bootstrap failures. This feature may speed up
|
|
|
|
|
diagnosis of censorship events. Implements ticket 3116.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (on 0.2.3.1-alpha):
|
|
|
|
|
- When configuring a large set of nodes in EntryNodes (as with
|
|
|
|
|
'EntryNodes {cc}' or 'EntryNodes 1.1.1.1/16'), choose only a
|
|
|
|
|
random subset to be guards, and choose them in random
|
|
|
|
|
order. Fixes bug 2798.
|
2011-07-18 19:39:01 +02:00
|
|
|
- Tor could crash when remembering a consensus in a non-used consensus
|
|
|
|
|
flavor without having a current consensus set. Fixes bug 3361.
|
|
|
|
|
- Comparing an unknown address to a microdescriptor's shortened exit
|
|
|
|
|
policy would always give a "rejected" result. Fixes bug 3599.
|
|
|
|
|
- Using microdescriptors as a client no longer prevents Tor from
|
|
|
|
|
uploading and downloading hidden service descriptors. Fixes
|
|
|
|
|
bug 3601.
|
2011-07-18 19:18:46 +02:00
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Allow nameservers with IPv6 address. Resolves bug 2574.
|
|
|
|
|
- Accept attempts to include a password authenticator in the
|
|
|
|
|
handshake, as supported by SOCKS5. This handles SOCKS clients that
|
|
|
|
|
don't know how to omit a password when authenticating. Resolves
|
|
|
|
|
bug 1666.
|
|
|
|
|
- When configuring a large set of nodes in EntryNodes, and there are
|
|
|
|
|
enough of them listed as Guard so that we don't need to consider
|
|
|
|
|
the non-guard entries, prefer the ones listed with the Guard flag.
|
|
|
|
|
- Check for and recover from inconsistency in the microdescriptor
|
|
|
|
|
cache. This will make it harder for us to accidentally free a
|
|
|
|
|
microdescriptor without removing it from the appropriate data
|
|
|
|
|
structures. Fixes issue 3135; issue noted by "wanoskarnet".
|
|
|
|
|
- Log SSL state transitions at log level DEBUG, log domain
|
|
|
|
|
HANDSHAKE. This can be useful for debugging censorship events.
|
|
|
|
|
Implements ticket 3264.
|
|
|
|
|
- Add port 6523 (Gobby) to LongLivedPorts. Patch by intrigeri;
|
|
|
|
|
implements ticket 3439.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.3.1-alpha):
|
|
|
|
|
- Do not free all general-purpose regular descriptors just
|
|
|
|
|
because microdescriptor use is enabled. Fixes bug 3113.
|
|
|
|
|
- Correctly link libevent_openssl when --enable-static-libevent
|
|
|
|
|
is passed to configure. Fixes bug 3118.
|
2011-07-18 19:39:01 +02:00
|
|
|
- Bridges should not complain during their heartbeat log messages that
|
|
|
|
|
they are unlisted in the consensus: that's more or less the point
|
|
|
|
|
of being a bridge. Fixes bug 3183.
|
2011-07-18 19:18:46 +02:00
|
|
|
- Report a SIGNAL event to controllers when acting on a delayed
|
2011-07-18 19:39:01 +02:00
|
|
|
SIGNAL NEWNYM command. Previously, we would report a SIGNAL
|
2011-07-18 19:18:46 +02:00
|
|
|
event to the controller if we acted on a SIGNAL NEWNYM command
|
|
|
|
|
immediately, and otherwise not report a SIGNAL event for the
|
|
|
|
|
command at all. Fixes bug 3349.
|
|
|
|
|
- Fix a crash when handling the SIGNAL controller command or
|
|
|
|
|
reporting ERR-level status events with bufferevents enabled. Found
|
|
|
|
|
by Robert Ransom. Fixes bug 3367.
|
|
|
|
|
- Always ship the tor-fw-helper manpage in our release tarballs.
|
|
|
|
|
Fixes bug 3389. Reported by Stephen Walker.
|
|
|
|
|
- Fix a class of double-mark-for-close bugs when bufferevents
|
|
|
|
|
are enabled. Fixes bug 3403.
|
2011-07-18 19:39:01 +02:00
|
|
|
- Update tor-fw-helper to support libnatpmp-20110618. Fixes bug 3434.
|
2011-07-18 19:18:46 +02:00
|
|
|
- Add SIGNAL to the list returned by the 'GETINFO events/names'
|
|
|
|
|
control-port command. Fixes part of bug 3465.
|
|
|
|
|
- Prevent using negative indices during unit test runs when read_all()
|
|
|
|
|
fails. Spotted by coverity.
|
|
|
|
|
- Fix a rare memory leak when checking the nodelist without it being
|
|
|
|
|
present. Found by coverity.
|
|
|
|
|
- Only try to download a microdescriptor-flavored consensus from
|
|
|
|
|
a directory cache that provides them.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.2.x and earlier):
|
|
|
|
|
- Assert that hidden-service-related operations are not performed
|
|
|
|
|
using single-hop circuits. Previously, Tor would assert that
|
|
|
|
|
client-side streams are not attached to single-hop circuits,
|
|
|
|
|
but not that other sensitive operations on the client and service
|
|
|
|
|
side are not performed using single-hop circuits. Fixes bug 3332;
|
|
|
|
|
bugfix on 0.0.6.
|
|
|
|
|
- Don't publish a new relay descriptor when we reload our onion key,
|
|
|
|
|
unless the onion key has actually changed. Fixes bug 3263 and
|
|
|
|
|
resolves another cause of bug 1810. Bugfix on 0.1.1.11-alpha.
|
|
|
|
|
- Allow GETINFO fingerprint to return a fingerprint even when
|
|
|
|
|
we have not yet built a router descriptor. Fixes bug 3577;
|
|
|
|
|
bugfix on 0.2.0.1-alpha.
|
2011-07-18 19:39:01 +02:00
|
|
|
- Make 'tor --digests' list hashes of all Tor source files. Bugfix
|
|
|
|
|
on 0.2.2.4-alpha; fixes bug 3427.
|
2011-07-18 19:18:46 +02:00
|
|
|
|
|
|
|
|
o Code simplification and refactoring:
|
|
|
|
|
- Use tor_sscanf() in place of scanf() in more places through the
|
|
|
|
|
code. This makes us a little more locale-independent, and
|
|
|
|
|
should help shut up code-analysis tools that can't tell
|
|
|
|
|
a safe sscanf string from a dangerous one.
|
|
|
|
|
- Use tt_assert(), not tor_assert(), for checking for test failures.
|
|
|
|
|
This makes the unit tests more able to go on in the event that
|
|
|
|
|
one of them fails.
|
|
|
|
|
- Split connection_about_to_close() into separate functions for each
|
|
|
|
|
connection type.
|
|
|
|
|
|
|
|
|
|
o Build changes:
|
|
|
|
|
- On Windows, we now define the _WIN32_WINNT macros only if they
|
|
|
|
|
are not already defined. This lets the person building Tor decide,
|
|
|
|
|
if they want, to require a later version of Windows.
|
|
|
|
|
|
|
|
|
|
|
2011-07-18 18:16:11 +02:00
|
|
|
Changes in version 0.2.2.30-rc - 2011-07-07
|
|
|
|
|
Tor 0.2.2.30-rc is the first release candidate for the Tor 0.2.2.x
|
|
|
|
|
series. It fixes a few smaller bugs, but generally appears stable.
|
|
|
|
|
Please test it and let us know whether it is!
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Send a SUCCEEDED stream event to the controller when a reverse
|
|
|
|
|
resolve succeeded. Fixes bug 3536; bugfix on 0.0.8pre1. Issue
|
|
|
|
|
discovered by katmagic.
|
|
|
|
|
- Always NUL-terminate the sun_path field of a sockaddr_un before
|
|
|
|
|
passing it to the kernel. (Not a security issue: kernels are
|
|
|
|
|
smart enough to reject bad sockaddr_uns.) Found by Coverity;
|
|
|
|
|
CID #428. Bugfix on Tor 0.2.0.3-alpha.
|
|
|
|
|
- Don't stack-allocate the list of supplementary GIDs when we're
|
|
|
|
|
about to log them. Stack-allocating NGROUPS_MAX gid_t elements
|
|
|
|
|
could take up to 256K, which is way too much stack. Found by
|
|
|
|
|
Coverity; CID #450. Bugfix on 0.2.1.7-alpha.
|
|
|
|
|
- Add BUILDTIMEOUT_SET to the list returned by the 'GETINFO
|
|
|
|
|
events/names' control-port command. Bugfix on 0.2.2.9-alpha;
|
|
|
|
|
fixes part of bug 3465.
|
|
|
|
|
- Fix a memory leak when receiving a descriptor for a hidden
|
|
|
|
|
service we didn't ask for. Found by Coverity; CID #30. Bugfix
|
|
|
|
|
on 0.2.2.26-beta.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the July 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
|
2011-06-21 07:18:58 +02:00
|
|
|
Changes in version 0.2.2.29-beta - 2011-06-20
|
|
|
|
|
Tor 0.2.2.29-beta reverts an accidental behavior change for users who
|
|
|
|
|
have bridge lines in their torrc but don't want to use them; gets
|
|
|
|
|
us closer to having the control socket feature working on Debian;
|
|
|
|
|
and fixes a variety of smaller bugs.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Revert the UseBridges option to its behavior before 0.2.2.28-beta.
|
|
|
|
|
When we changed the default behavior to "use bridges if any
|
|
|
|
|
are listed in the torrc", we surprised users who had bridges
|
|
|
|
|
in their torrc files but who didn't actually want to use them.
|
|
|
|
|
Partial resolution for bug 3354.
|
|
|
|
|
|
|
|
|
|
o Privacy fixes:
|
|
|
|
|
- Don't attach new streams to old rendezvous circuits after SIGNAL
|
|
|
|
|
NEWNYM. Previously, we would keep using an existing rendezvous
|
|
|
|
|
circuit if it remained open (i.e. if it were kept open by a
|
|
|
|
|
long-lived stream, or if a new stream were attached to it before
|
|
|
|
|
Tor could notice that it was old and no longer in use). Bugfix on
|
|
|
|
|
0.1.1.15-rc; fixes bug 3375.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a bug when using ControlSocketsGroupWritable with User. The
|
|
|
|
|
directory's group would be checked against the current group, not
|
|
|
|
|
the configured group. Patch by Jérémy Bobbio. Fixes bug 3393;
|
|
|
|
|
bugfix on 0.2.2.26-beta.
|
|
|
|
|
- Make connection_printf_to_buf()'s behaviour sane. Its callers
|
|
|
|
|
expect it to emit a CRLF iff the format string ends with CRLF;
|
|
|
|
|
it actually emitted a CRLF iff (a) the format string ended with
|
|
|
|
|
CRLF or (b) the resulting string was over 1023 characters long or
|
|
|
|
|
(c) the format string did not end with CRLF *and* the resulting
|
|
|
|
|
string was 1021 characters long or longer. Bugfix on 0.1.1.9-alpha;
|
|
|
|
|
fixes part of bug 3407.
|
|
|
|
|
- Make send_control_event_impl()'s behaviour sane. Its callers
|
|
|
|
|
expect it to always emit a CRLF at the end of the string; it
|
|
|
|
|
might have emitted extra control characters as well. Bugfix on
|
|
|
|
|
0.1.1.9-alpha; fixes another part of bug 3407.
|
|
|
|
|
- Make crypto_rand_int() check the value of its input correctly.
|
|
|
|
|
Previously, it accepted values up to UINT_MAX, but could return a
|
|
|
|
|
negative number if given a value above INT_MAX+1. Found by George
|
|
|
|
|
Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14.
|
|
|
|
|
- Avoid a segfault when reading a malformed circuit build state
|
|
|
|
|
with more than INT_MAX entries. Found by wanoskarnet. Bugfix on
|
|
|
|
|
0.2.2.4-alpha.
|
|
|
|
|
- When asked about a DNS record type we don't support via a
|
|
|
|
|
client DNSPort, reply with NOTIMPL rather than an empty
|
|
|
|
|
reply. Patch by intrigeri. Fixes bug 3369; bugfix on 2.0.1-alpha.
|
|
|
|
|
- Fix a rare memory leak during stats writing. Found by coverity.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the June 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Remove some dead code as indicated by coverity.
|
|
|
|
|
- Remove a few dead assignments during router parsing. Found by
|
|
|
|
|
coverity.
|
|
|
|
|
- Add some forgotten return value checks during unit tests. Found
|
|
|
|
|
by coverity.
|
|
|
|
|
- Don't use 1-bit wide signed bit fields. Found by coverity.
|
|
|
|
|
|
|
|
|
|
|
2011-06-05 07:46:13 +02:00
|
|
|
Changes in version 0.2.2.28-beta - 2011-06-04
|
|
|
|
|
Tor 0.2.2.28-beta makes great progress towards a new stable release: we
|
|
|
|
|
fixed a big bug in whether relays stay in the consensus consistently,
|
|
|
|
|
we moved closer to handling bridges and hidden services correctly,
|
|
|
|
|
and we started the process of better handling the dreaded "my Vidalia
|
|
|
|
|
died, and now my Tor demands a password when I try to reconnect to it"
|
|
|
|
|
usability issue.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Don't decide to make a new descriptor when receiving a HUP signal.
|
|
|
|
|
This bug has caused a lot of 0.2.2.x relays to disappear from the
|
|
|
|
|
consensus periodically. Fixes the most common case of triggering
|
|
|
|
|
bug 1810; bugfix on 0.2.2.7-alpha.
|
|
|
|
|
- Actually allow nameservers with IPv6 addresses. Fixes bug 2574.
|
|
|
|
|
- Don't try to build descriptors if "ORPort auto" is set and we
|
|
|
|
|
don't know our actual ORPort yet. Fix for bug 3216; bugfix on
|
|
|
|
|
0.2.2.26-beta.
|
|
|
|
|
- Resolve a crash that occurred when setting BridgeRelay to 1 with
|
|
|
|
|
accounting enabled. Fixes bug 3228; bugfix on 0.2.2.18-alpha.
|
|
|
|
|
- Apply circuit timeouts to opened hidden-service-related circuits
|
|
|
|
|
based on the correct start time. Previously, we would apply the
|
|
|
|
|
circuit build timeout based on time since the circuit's creation;
|
|
|
|
|
it was supposed to be applied based on time since the circuit
|
|
|
|
|
entered its current state. Bugfix on 0.0.6; fixes part of bug 1297.
|
|
|
|
|
- Use the same circuit timeout for client-side introduction
|
|
|
|
|
circuits as for other four-hop circuits, rather than the timeout
|
|
|
|
|
for single-hop directory-fetch circuits; the shorter timeout may
|
|
|
|
|
have been appropriate with the static circuit build timeout in
|
|
|
|
|
0.2.1.x and earlier, but caused many hidden service access attempts
|
|
|
|
|
to fail with the adaptive CBT introduced in 0.2.2.2-alpha. Bugfix
|
|
|
|
|
on 0.2.2.2-alpha; fixes another part of bug 1297.
|
|
|
|
|
- In ticket 2511 we fixed a case where you could use an unconfigured
|
|
|
|
|
bridge if you had configured it as a bridge the last time you ran
|
|
|
|
|
Tor. Now fix another edge case: if you had configured it as a bridge
|
|
|
|
|
but then switched to a different bridge via the controller, you
|
|
|
|
|
would still be willing to use the old one. Bugfix on 0.2.0.1-alpha;
|
|
|
|
|
fixes bug 3321.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Add an __OwningControllerProcess configuration option and a
|
|
|
|
|
TAKEOWNERSHIP control-port command. Now a Tor controller can ensure
|
|
|
|
|
that when it exits, Tor will shut down. Implements feature 3049.
|
|
|
|
|
- If "UseBridges 1" is set and no bridges are configured, Tor will
|
|
|
|
|
now refuse to build any circuits until some bridges are set.
|
|
|
|
|
If "UseBridges auto" is set, Tor will use bridges if they are
|
|
|
|
|
configured and we are not running as a server, but otherwise will
|
|
|
|
|
make circuits as usual. The new default is "auto". Patch by anonym,
|
|
|
|
|
so the Tails LiveCD can stop automatically revealing you as a Tor
|
|
|
|
|
user on startup.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix warnings from GCC 4.6's "-Wunused-but-set-variable" option.
|
|
|
|
|
- Remove a trailing asterisk from "exit-policy/default" in the
|
|
|
|
|
output of the control port command "GETINFO info/names". Bugfix
|
|
|
|
|
on 0.1.2.5-alpha.
|
|
|
|
|
- Use a wide type to hold sockets when built for 64-bit Windows builds.
|
|
|
|
|
Fixes bug 3270.
|
|
|
|
|
- Warn when the user configures two HiddenServiceDir lines that point
|
|
|
|
|
to the same directory. Bugfix on 0.0.6 (the version introducing
|
|
|
|
|
HiddenServiceDir); fixes bug 3289.
|
|
|
|
|
- Remove dead code from rend_cache_lookup_v2_desc_as_dir. Fixes
|
|
|
|
|
part of bug 2748; bugfix on 0.2.0.10-alpha.
|
|
|
|
|
- Log malformed requests for rendezvous descriptors as protocol
|
|
|
|
|
warnings, not warnings. Also, use a more informative log message
|
|
|
|
|
in case someone sees it at log level warning without prior
|
|
|
|
|
info-level messages. Fixes the other part of bug 2748; bugfix
|
|
|
|
|
on 0.2.0.10-alpha.
|
|
|
|
|
- Clear the table recording the time of the last request for each
|
|
|
|
|
hidden service descriptor from each HS directory on SIGNAL NEWNYM.
|
|
|
|
|
Previously, we would clear our HS descriptor cache on SIGNAL
|
|
|
|
|
NEWNYM, but if we had previously retrieved a descriptor (or tried
|
|
|
|
|
to) from every directory responsible for it, we would refuse to
|
|
|
|
|
fetch it again for up to 15 minutes. Bugfix on 0.2.2.25-alpha;
|
|
|
|
|
fixes bug 3309.
|
|
|
|
|
- Fix a log message that said "bits" while displaying a value in
|
|
|
|
|
bytes. Found by wanoskarnet. Fixes bug 3318; bugfix on
|
|
|
|
|
0.2.0.1-alpha.
|
|
|
|
|
- When checking for 1024-bit keys, check for 1024 bits, not 128
|
|
|
|
|
bytes. This allows Tor to correctly discard keys of length 1017
|
|
|
|
|
through 1023. Bugfix on 0.0.9pre5.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Relays now log the reason for publishing a new relay descriptor,
|
|
|
|
|
so we have a better chance of hunting down instances of bug 1810.
|
|
|
|
|
Resolves ticket 3252.
|
|
|
|
|
- Revise most log messages that refer to nodes by nickname to
|
|
|
|
|
instead use the "$key=nickname at address" format. This should be
|
|
|
|
|
more useful, especially since nicknames are less and less likely
|
|
|
|
|
to be unique. Resolves ticket 3045.
|
|
|
|
|
- Log (at info level) when purging pieces of hidden-service-client
|
|
|
|
|
state because of SIGNAL NEWNYM.
|
|
|
|
|
|
|
|
|
|
o Removed options:
|
|
|
|
|
- Remove undocumented option "-F" from tor-resolve: it hasn't done
|
|
|
|
|
anything since 0.2.1.16-rc.
|
|
|
|
|
|
|
|
|
|
|
2011-05-20 03:39:09 +02:00
|
|
|
Changes in version 0.2.2.27-beta - 2011-05-18
|
|
|
|
|
Tor 0.2.2.27-beta fixes a bridge-related stability bug in the previous
|
|
|
|
|
release, and also adds a few more general bugfixes.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a crash bug when changing bridges in a running Tor process.
|
|
|
|
|
Fixes bug 3213; bugfix on 0.2.2.26-beta.
|
|
|
|
|
- When the controller configures a new bridge, don't wait 10 to 60
|
|
|
|
|
seconds before trying to fetch its descriptor. Bugfix on
|
|
|
|
|
0.2.0.3-alpha; fixes bug 3198 (suggested by 2355).
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Require that onion keys have exponent 65537 in microdescriptors too.
|
|
|
|
|
Fixes more of bug 3207; bugfix on 0.2.2.26-beta.
|
|
|
|
|
- Tor used to limit HttpProxyAuthenticator values to 48 characters.
|
|
|
|
|
Changed the limit to 512 characters by removing base64 newlines.
|
|
|
|
|
Fixes bug 2752. Fix by Michael Yakubovich.
|
|
|
|
|
- When a client starts or stops using bridges, never use a circuit
|
|
|
|
|
that was built before the configuration change. This behavior could
|
|
|
|
|
put at risk a user who uses bridges to ensure that her traffic
|
|
|
|
|
only goes to the chosen addresses. Bugfix on 0.2.0.3-alpha; fixes
|
|
|
|
|
bug 3200.
|
|
|
|
|
|
|
|
|
|
|
2011-05-18 03:26:13 +02:00
|
|
|
Changes in version 0.2.2.26-beta - 2011-05-17
|
|
|
|
|
Tor 0.2.2.26-beta fixes a variety of potential privacy problems. It
|
|
|
|
|
also introduces a new "socksport auto" approach that should make it
|
|
|
|
|
easier to run multiple Tors on the same system, and does a lot of
|
|
|
|
|
cleanup to get us closer to a release candidate.
|
|
|
|
|
|
|
|
|
|
o Security/privacy fixes:
|
|
|
|
|
- Replace all potentially sensitive memory comparison operations
|
|
|
|
|
with versions whose runtime does not depend on the data being
|
|
|
|
|
compared. This will help resist a class of attacks where an
|
|
|
|
|
adversary can use variations in timing information to learn
|
|
|
|
|
sensitive data. Fix for one case of bug 3122. (Safe memcmp
|
|
|
|
|
implementation by Robert Ransom based partially on code by DJB.)
|
|
|
|
|
- When receiving a hidden service descriptor, check that it is for
|
|
|
|
|
the hidden service we wanted. Previously, Tor would store any
|
|
|
|
|
hidden service descriptors that a directory gave it, whether it
|
|
|
|
|
wanted them or not. This wouldn't have let an attacker impersonate
|
|
|
|
|
a hidden service, but it did let directories pre-seed a client
|
|
|
|
|
with descriptors that it didn't want. Bugfix on 0.0.6.
|
|
|
|
|
- On SIGHUP, do not clear out all TrackHostExits mappings, client
|
|
|
|
|
DNS cache entries, and virtual address mappings: that's what
|
|
|
|
|
NEWNYM is for. Fixes bug 1345; bugfix on 0.1.0.1-rc.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- The options SocksPort, ControlPort, and so on now all accept a
|
|
|
|
|
value "auto" that opens a socket on an OS-selected port. A
|
|
|
|
|
new ControlPortWriteToFile option tells Tor to write its
|
|
|
|
|
actual control port or ports to a chosen file. If the option
|
|
|
|
|
ControlPortFileGroupReadable is set, the file is created as
|
|
|
|
|
group-readable. Now users can run two Tor clients on the same
|
|
|
|
|
system without needing to manually mess with parameters. Resolves
|
|
|
|
|
part of ticket 3076.
|
|
|
|
|
- Set SO_REUSEADDR on all sockets, not just listeners. This should
|
|
|
|
|
help busy exit nodes avoid running out of useable ports just
|
|
|
|
|
because all the ports have been used in the near past. Resolves
|
|
|
|
|
issue 2850.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- New "GETINFO net/listeners/(type)" controller command to return
|
|
|
|
|
a list of addresses and ports that are bound for listeners for a
|
|
|
|
|
given connection type. This is useful when the user has configured
|
|
|
|
|
"SocksPort auto" and the controller needs to know which port got
|
|
|
|
|
chosen. Resolves another part of ticket 3076.
|
|
|
|
|
- Add a new ControlSocketsGroupWritable configuration option: when
|
|
|
|
|
it is turned on, ControlSockets are group-writeable by the default
|
|
|
|
|
group of the current user. Patch by Jérémy Bobbio; implements
|
|
|
|
|
ticket 2972.
|
|
|
|
|
- Tor now refuses to create a ControlSocket in a directory that is
|
|
|
|
|
world-readable (or group-readable if ControlSocketsGroupWritable
|
|
|
|
|
is 0). This is necessary because some operating systems do not
|
|
|
|
|
enforce permissions on an AF_UNIX sockets. Permissions on the
|
|
|
|
|
directory holding the socket, however, seems to work everywhere.
|
|
|
|
|
- Rate-limit a warning about failures to download v2 networkstatus
|
|
|
|
|
documents. Resolves part of bug 1352.
|
|
|
|
|
- Backport code from 0.2.3.x that allows directory authorities to
|
|
|
|
|
clean their microdescriptor caches. Needed to resolve bug 2230.
|
|
|
|
|
- When an HTTPS proxy reports "403 Forbidden", we now explain
|
|
|
|
|
what it means rather than calling it an unexpected status code.
|
|
|
|
|
Closes bug 2503. Patch from Michael Yakubovich.
|
|
|
|
|
- Update to the May 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Authorities now clean their microdesc cache periodically and when
|
|
|
|
|
reading from disk initially, not only when adding new descriptors.
|
|
|
|
|
This prevents a bug where we could lose microdescriptors. Bugfix
|
2011-08-01 21:53:13 +02:00
|
|
|
on 0.2.2.6-alpha. Fixes bug 2230.
|
2011-05-18 03:26:13 +02:00
|
|
|
- Do not crash when our configuration file becomes unreadable, for
|
|
|
|
|
example due to a permissions change, between when we start up
|
|
|
|
|
and when a controller calls SAVECONF. Fixes bug 3135; bugfix
|
|
|
|
|
on 0.0.9pre6.
|
|
|
|
|
- Avoid a bug that would keep us from replacing a microdescriptor
|
|
|
|
|
cache on Windows. (We would try to replace the file while still
|
|
|
|
|
holding it open. That's fine on Unix, but Windows doesn't let us
|
|
|
|
|
do that.) Bugfix on 0.2.2.6-alpha; bug found by wanoskarnet.
|
|
|
|
|
- Add missing explanations for the authority-related torrc options
|
|
|
|
|
RephistTrackTime, BridgePassword, and V3AuthUseLegacyKey in the
|
|
|
|
|
man page. Resolves issue 2379.
|
|
|
|
|
- As an authority, do not upload our own vote or signature set to
|
|
|
|
|
ourself. It would tell us nothing new, and as of 0.2.2.24-alpha,
|
|
|
|
|
it would get flagged as a duplicate. Resolves bug 3026.
|
|
|
|
|
- Accept hidden service descriptors if we think we might be a hidden
|
|
|
|
|
service directory, regardless of what our consensus says. This
|
|
|
|
|
helps robustness, since clients and hidden services can sometimes
|
|
|
|
|
have a more up-to-date view of the network consensus than we do,
|
|
|
|
|
and if they think that the directory authorities list us a HSDir,
|
|
|
|
|
we might actually be one. Related to bug 2732; bugfix on
|
|
|
|
|
0.2.0.10-alpha.
|
|
|
|
|
- When a controller changes TrackHostExits, remove mappings for
|
|
|
|
|
hosts that should no longer have their exits tracked. Bugfix on
|
|
|
|
|
0.1.0.1-rc.
|
|
|
|
|
- When a controller changes VirtualAddrNetwork, remove any mappings
|
|
|
|
|
for hosts that were automapped to the old network. Bugfix on
|
|
|
|
|
0.1.1.19-rc.
|
|
|
|
|
- When a controller changes one of the AutomapHosts* options, remove
|
|
|
|
|
any mappings for hosts that should no longer be automapped. Bugfix
|
|
|
|
|
on 0.2.0.1-alpha.
|
|
|
|
|
- Do not reset the bridge descriptor download status every time we
|
|
|
|
|
re-parse our configuration or get a configuration change. Fixes
|
|
|
|
|
bug 3019; bugfix on 0.2.0.3-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (code cleanup):
|
|
|
|
|
- When loading the microdesc journal, remember its current size.
|
|
|
|
|
In 0.2.2, this helps prevent the microdesc journal from growing
|
|
|
|
|
without limit on authorities (who are the only ones to use it in
|
|
|
|
|
0.2.2). Fixes a part of bug 2230; bugfix on 0.2.2.6-alpha.
|
|
|
|
|
Fix posted by "cypherpunks."
|
|
|
|
|
- The microdesc journal is supposed to get rebuilt only if it is
|
|
|
|
|
at least _half_ the length of the store, not _twice_ the length
|
|
|
|
|
of the store. Bugfix on 0.2.2.6-alpha; fixes part of bug 2230.
|
|
|
|
|
- Fix a potential null-pointer dereference while computing a
|
|
|
|
|
consensus. Bugfix on tor-0.2.0.3-alpha, found with the help of
|
|
|
|
|
clang's analyzer.
|
|
|
|
|
- Avoid a possible null-pointer dereference when rebuilding the mdesc
|
|
|
|
|
cache without actually having any descriptors to cache. Bugfix on
|
|
|
|
|
0.2.2.6-alpha. Issue discovered using clang's static analyzer.
|
|
|
|
|
- If we fail to compute the identity digest of a v3 legacy keypair,
|
|
|
|
|
warn, and don't use a buffer-full of junk instead. Bugfix on
|
|
|
|
|
0.2.1.1-alpha; fixes bug 3106.
|
|
|
|
|
- Resolve an untriggerable issue in smartlist_string_num_isin(),
|
|
|
|
|
where if the function had ever in the future been used to check
|
|
|
|
|
for the presence of a too-large number, it would have given an
|
|
|
|
|
incorrect result. (Fortunately, we only used it for 16-bit
|
|
|
|
|
values.) Fixes bug 3175; bugfix on 0.1.0.1-rc.
|
|
|
|
|
- Require that introduction point keys and onion handshake keys
|
|
|
|
|
have a public exponent of 65537. Starts to fix bug 3207; bugfix
|
|
|
|
|
on 0.2.0.10-alpha.
|
|
|
|
|
|
|
|
|
|
o Removed features:
|
|
|
|
|
- Caches no longer download and serve v2 networkstatus documents
|
|
|
|
|
unless FetchV2Networkstatus flag is set: these documents haven't
|
|
|
|
|
haven't been used by clients or relays since 0.2.0.x. Resolves
|
|
|
|
|
bug 3022.
|
|
|
|
|
|
|
|
|
|
|
2011-06-05 07:45:42 +02:00
|
|
|
Changes in version 0.2.3.1-alpha - 2011-05-05
|
|
|
|
|
Tor 0.2.3.1-alpha adds some new experimental features, including support
|
|
|
|
|
for an improved network IO backend, IOCP networking on Windows,
|
|
|
|
|
microdescriptor caching, "fast-start" support for streams, and automatic
|
|
|
|
|
home router configuration. There are also numerous internal improvements
|
|
|
|
|
to try to make the code easier for developers to work with.
|
|
|
|
|
|
|
|
|
|
This is the first alpha release in a new series, so expect there to be
|
|
|
|
|
bugs. Users who would rather test out a more stable branch should
|
|
|
|
|
stay with 0.2.2.x for now.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Tor can now optionally build with the "bufferevents" buffered IO
|
|
|
|
|
backend provided by Libevent 2. To use this feature, make sure you
|
|
|
|
|
have the latest possible version of Libevent, and pass the
|
|
|
|
|
--enable-bufferevents flag to configure when building Tor from
|
|
|
|
|
source. This feature will make our networking code more flexible,
|
|
|
|
|
let us stack layers on each other, and let us use more efficient
|
|
|
|
|
zero-copy transports where available.
|
|
|
|
|
- As an experimental feature, Tor can use IOCP for networking on Windows.
|
|
|
|
|
Once this code is tuned and optimized, it promises much better
|
|
|
|
|
performance than the select-based backend we've used in the past. To
|
|
|
|
|
try this feature, you must build Tor with Libevent 2, configure Tor
|
|
|
|
|
with the "bufferevents" buffered IO backend, and add "DisableIOCP 0" to
|
|
|
|
|
your torrc. There are known bugs here: only try this if you can help
|
|
|
|
|
debug it as it breaks.
|
|
|
|
|
- The EntryNodes option can now include country codes like {de} or IP
|
|
|
|
|
addresses or network masks. Previously we had disallowed these options
|
|
|
|
|
because we didn't have an efficient way to keep the list up to
|
|
|
|
|
date. Fixes bug 1982, but see bug 2798 for an unresolved issue here.
|
|
|
|
|
- Exit nodes now accept and queue data on not-yet-connected streams.
|
|
|
|
|
Previously, the client wasn't allowed to send data until the stream was
|
|
|
|
|
connected, which slowed down all connections. This change will enable
|
|
|
|
|
clients to perform a "fast-start" on streams and send data without
|
|
|
|
|
having to wait for a confirmation that the stream has opened. (Patch
|
|
|
|
|
from Ian Goldberg; implements the server side of Proposal 174.)
|
|
|
|
|
- Tor now has initial support for automatic port mapping on the many
|
|
|
|
|
home routers that support NAT-PMP or UPnP. (Not yet supported on
|
|
|
|
|
Windows). To build the support code, you'll need to have libnatpnp
|
|
|
|
|
library and/or the libminiupnpc library, and you'll need to enable the
|
|
|
|
|
feature specifically by passing "--enable-upnp" and/or
|
|
|
|
|
"--enable-natpnp" to configure. To turn it on, use the new
|
|
|
|
|
PortForwarding option.
|
|
|
|
|
- Caches now download, cache, and serve multiple "flavors" of the
|
|
|
|
|
consensus, including a flavor that describes microdescriptors.
|
|
|
|
|
- Caches now download, cache, and serve microdescriptors -- small
|
|
|
|
|
summaries of router descriptors that are authenticated by all of the
|
|
|
|
|
directory authorities. Once enough caches are running this code,
|
|
|
|
|
clients will be able to save significant amounts of directory bandwidth
|
|
|
|
|
by downloading microdescriptors instead of router descriptors.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
2011-06-24 05:54:34 +02:00
|
|
|
- Make logging resolution configurable with a new LogTimeGranularity
|
|
|
|
|
option, and change the default from 1 millisecond to 1 second.
|
|
|
|
|
Implements enhancement 1668.
|
2011-06-05 07:45:42 +02:00
|
|
|
- We log which torrc file we're using on startup. Implements ticket
|
|
|
|
|
2444.
|
|
|
|
|
- Ordinarily, Tor does not count traffic from private addresses (like
|
|
|
|
|
127.0.0.1 or 10.0.0.1) when calculating rate limits or accounting.
|
|
|
|
|
There is now a new option, CountPrivateBandwidth, to disable this
|
|
|
|
|
behavior. Patch from Daniel Cagara.
|
|
|
|
|
- New --enable-static-tor configure option for building Tor as
|
|
|
|
|
statically as possible. Idea, general hackery and thoughts from
|
|
|
|
|
Alexei Czeskis, John Gilmore, Jacob Appelbaum. Implements ticket
|
|
|
|
|
2702.
|
|
|
|
|
- If you set the NumCPUs option to 0, Tor will now try to detect how
|
|
|
|
|
many CPUs you have. This is the new default behavior.
|
|
|
|
|
- Turn on directory request statistics by default and include them in
|
|
|
|
|
extra-info descriptors. Don't break if we have no GeoIP database.
|
|
|
|
|
- Relays that set "ConnDirectionStatistics 1" write statistics on the
|
|
|
|
|
bidirectional use of connections to disk every 24 hours.
|
|
|
|
|
- Add a GeoIP file digest to the extra-info descriptor. Implements
|
|
|
|
|
enhancement 1883.
|
2011-06-10 07:04:12 +02:00
|
|
|
- The NodeFamily option -- which let you declare that you want to
|
|
|
|
|
consider nodes to be part of a family whether they list themselves
|
|
|
|
|
that way or not -- now allows IP address ranges and country codes.
|
2011-06-05 07:45:42 +02:00
|
|
|
- Add a new 'Heartbeat' log message type to periodically log a message
|
|
|
|
|
describing Tor's status at level Notice. This feature is meant for
|
|
|
|
|
operators who log at notice, and want to make sure that their Tor
|
|
|
|
|
server is still working. Implementation by George Kadianakis.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.2.25-alpha):
|
|
|
|
|
- When loading the microdesc journal, remember its current size.
|
|
|
|
|
In 0.2.2, this helps prevent the microdesc journal from growing
|
|
|
|
|
without limit on authorities (who are the only ones to use it in
|
|
|
|
|
0.2.2). Fixes a part of bug 2230; bugfix on 0.2.2.6-alpha.
|
|
|
|
|
Fix posted by "cypherpunks."
|
|
|
|
|
- The microdesc journal is supposed to get rebuilt only if it is
|
|
|
|
|
at least _half_ the length of the store, not _twice_ the length
|
|
|
|
|
of the store. Bugfix on 0.2.2.6-alpha; fixes part of bug 2230.
|
|
|
|
|
- If as an authority we fail to compute the identity digest of a v3
|
|
|
|
|
legacy keypair, warn, and don't use a buffer-full of junk instead.
|
|
|
|
|
Bugfix on 0.2.1.1-alpha; fixes bug 3106.
|
|
|
|
|
- Authorities now clean their microdesc cache periodically and when
|
|
|
|
|
reading from disk initially, not only when adding new descriptors.
|
|
|
|
|
This prevents a bug where we could lose microdescriptors. Bugfix
|
|
|
|
|
on 0.2.2.6-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor features (controller):
|
|
|
|
|
- Add a new SIGNAL event to the controller interface so that
|
|
|
|
|
controllers can be notified when Tor handles a signal. Resolves
|
|
|
|
|
issue 1955. Patch by John Brooks.
|
|
|
|
|
- Add a new GETINFO option to get total bytes read and written. Patch
|
|
|
|
|
from pipe, revised by atagar. Resolves ticket 2345.
|
|
|
|
|
- Implement some GETINFO controller fields to provide information about
|
|
|
|
|
the Tor process's pid, euid, username, and resource limits.
|
|
|
|
|
|
|
|
|
|
o Build changes:
|
|
|
|
|
- Our build system requires automake 1.6 or later to create the
|
|
|
|
|
Makefile.in files. Previously, you could have used 1.4.
|
|
|
|
|
This only affects developers and people building Tor from git;
|
|
|
|
|
people who build Tor from the source distribution without changing
|
|
|
|
|
the Makefile.am files should be fine.
|
|
|
|
|
- Our autogen.sh script uses autoreconf to launch autoconf, automake, and
|
|
|
|
|
so on. This is more robust against some of the failure modes
|
|
|
|
|
associated with running the autotools pieces on their own.
|
|
|
|
|
|
|
|
|
|
o Minor packaging issues:
|
|
|
|
|
- On OpenSUSE, create the /var/run/tor directory on startup if it is not
|
|
|
|
|
already created. Patch from Andreas Stieger. Fixes bug 2573.
|
|
|
|
|
|
|
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- A major revision to our internal node-selecting and listing logic.
|
|
|
|
|
Tor already had at least two major ways to look at the question of
|
|
|
|
|
"which Tor servers do we know about": a list of router descriptors,
|
|
|
|
|
and a list of entries in the current consensus. With
|
|
|
|
|
microdescriptors, we're adding a third. Having so many systems
|
|
|
|
|
without an abstraction layer over them was hurting the codebase.
|
|
|
|
|
Now, we have a new "node_t" abstraction that presents a consistent
|
|
|
|
|
interface to a client's view of a Tor node, and holds (nearly) all
|
|
|
|
|
of the mutable state formerly in routerinfo_t and routerstatus_t.
|
|
|
|
|
- The helper programs tor-gencert, tor-resolve, and tor-checkkey
|
|
|
|
|
no longer link against Libevent: they never used it, but
|
|
|
|
|
our library structure used to force them to link it.
|
|
|
|
|
|
|
|
|
|
o Removed features:
|
|
|
|
|
- Remove some old code to work around even older versions of Tor that
|
|
|
|
|
used forked processes to handle DNS requests. Such versions of Tor
|
|
|
|
|
are no longer in use as servers.
|
|
|
|
|
|
|
|
|
|
o Documentation fixes:
|
|
|
|
|
- Correct a broken faq link in the INSTALL file. Fixes bug 2307.
|
|
|
|
|
- Add missing documentation for the authority-related torrc options
|
|
|
|
|
RephistTrackTime, BridgePassword, and V3AuthUseLegacyKey. Resolves
|
|
|
|
|
issue 2379.
|
|
|
|
|
|
|
|
|
|
|
2011-04-29 05:31:42 +02:00
|
|
|
Changes in version 0.2.2.25-alpha - 2011-04-29
|
|
|
|
|
Tor 0.2.2.25-alpha fixes many bugs: hidden service clients are more
|
|
|
|
|
robust, routers no longer overreport their bandwidth, Win7 should crash
|
|
|
|
|
a little less, and NEWNYM (as used by Vidalia's "new identity" button)
|
|
|
|
|
now prevents hidden service-related activity from being linkable. It
|
|
|
|
|
provides more information to Vidalia so you can see if your bridge is
|
|
|
|
|
working. Also, 0.2.2.25-alpha revamps the Entry/Exit/ExcludeNodes and
|
|
|
|
|
StrictNodes configuration options to make them more reliable, more
|
|
|
|
|
understandable, and more regularly applied. If you use those options,
|
|
|
|
|
please see the revised documentation for them in the manual page.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Relays were publishing grossly inflated bandwidth values because
|
|
|
|
|
they were writing their state files wrong--now they write the
|
|
|
|
|
correct value. Also, resume reading bandwidth history from the
|
|
|
|
|
state file correctly. Fixes bug 2704; bugfix on 0.2.2.23-alpha.
|
|
|
|
|
- Improve hidden service robustness: When we find that we have
|
|
|
|
|
extended a hidden service's introduction circuit to a relay not
|
|
|
|
|
listed as an introduction point in the HS descriptor we currently
|
|
|
|
|
have, retry with an introduction point from the current
|
|
|
|
|
descriptor. Previously we would just give up. Fixes bugs 1024 and
|
|
|
|
|
1930; bugfix on 0.2.0.10-alpha.
|
|
|
|
|
- Clients now stop trying to use an exit node associated with a given
|
|
|
|
|
destination by TrackHostExits if they fail to reach that exit node.
|
|
|
|
|
Fixes bug 2999. Bugfix on 0.2.0.20-rc.
|
|
|
|
|
- Fix crash bug on platforms where gmtime and localtime can return
|
|
|
|
|
NULL. Windows 7 users were running into this one. Fixes part of bug
|
|
|
|
|
2077. Bugfix on all versions of Tor. Found by boboper.
|
|
|
|
|
|
|
|
|
|
o Security and stability fixes:
|
|
|
|
|
- Don't double-free a parsable, but invalid, microdescriptor, even if
|
|
|
|
|
it is followed in the blob we're parsing by an unparsable
|
|
|
|
|
microdescriptor. Fixes an issue reported in a comment on bug 2954.
|
|
|
|
|
Bugfix on 0.2.2.6-alpha; fix by "cypherpunks".
|
|
|
|
|
- If the Nickname configuration option isn't given, Tor would pick a
|
|
|
|
|
nickname based on the local hostname as the nickname for a relay.
|
|
|
|
|
Because nicknames are not very important in today's Tor and the
|
|
|
|
|
"Unnamed" nickname has been implemented, this is now problematic
|
|
|
|
|
behavior: It leaks information about the hostname without being
|
|
|
|
|
useful at all. Fixes bug 2979; bugfix on 0.1.2.2-alpha, which
|
|
|
|
|
introduced the Unnamed nickname. Reported by tagnaq.
|
|
|
|
|
- Fix an uncommon assertion failure when running with DNSPort under
|
|
|
|
|
heavy load. Fixes bug 2933; bugfix on 0.2.0.1-alpha.
|
|
|
|
|
- Avoid linkability based on cached hidden service descriptors: forget
|
|
|
|
|
all hidden service descriptors cached as a client when processing a
|
|
|
|
|
SIGNAL NEWNYM command. Fixes bug 3000; bugfix on 0.0.6.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Export GeoIP information on bridge usage to controllers even if we
|
|
|
|
|
have not yet been running for 24 hours. Now Vidalia bridge operators
|
|
|
|
|
can get more accurate and immediate feedback about their
|
|
|
|
|
contributions to the network.
|
|
|
|
|
|
|
|
|
|
o Major features and bugfixes (node selection):
|
|
|
|
|
- Revise and reconcile the meaning of the ExitNodes, EntryNodes,
|
|
|
|
|
ExcludeEntryNodes, ExcludeExitNodes, ExcludeNodes, and StrictNodes
|
|
|
|
|
options. Previously, we had been ambiguous in describing what
|
|
|
|
|
counted as an "exit" node, and what operations exactly "StrictNodes
|
|
|
|
|
0" would permit. This created confusion when people saw nodes built
|
|
|
|
|
through unexpected circuits, and made it hard to tell real bugs from
|
|
|
|
|
surprises. Now the intended behavior is:
|
|
|
|
|
. "Exit", in the context of ExitNodes and ExcludeExitNodes, means
|
|
|
|
|
a node that delivers user traffic outside the Tor network.
|
|
|
|
|
. "Entry", in the context of EntryNodes, means a node used as the
|
|
|
|
|
first hop of a multihop circuit. It doesn't include direct
|
|
|
|
|
connections to directory servers.
|
|
|
|
|
. "ExcludeNodes" applies to all nodes.
|
|
|
|
|
. "StrictNodes" changes the behavior of ExcludeNodes only. When
|
|
|
|
|
StrictNodes is set, Tor should avoid all nodes listed in
|
|
|
|
|
ExcludeNodes, even when it will make user requests fail. When
|
|
|
|
|
StrictNodes is *not* set, then Tor should follow ExcludeNodes
|
|
|
|
|
whenever it can, except when it must use an excluded node to
|
|
|
|
|
perform self-tests, connect to a hidden service, provide a
|
|
|
|
|
hidden service, fulfill a .exit request, upload directory
|
|
|
|
|
information, or fetch directory information.
|
|
|
|
|
Collectively, the changes to implement the behavior fix bug 1090.
|
|
|
|
|
- ExcludeNodes now takes precedence over EntryNodes and ExitNodes: if
|
|
|
|
|
a node is listed in both, it's treated as excluded.
|
|
|
|
|
- ExcludeNodes now applies to directory nodes -- as a preference if
|
|
|
|
|
StrictNodes is 0, or an absolute requirement if StrictNodes is 1.
|
|
|
|
|
Don't exclude all the directory authorities and set StrictNodes to 1
|
|
|
|
|
unless you really want your Tor to break.
|
|
|
|
|
- ExcludeNodes and ExcludeExitNodes now override exit enclaving.
|
|
|
|
|
- ExcludeExitNodes now overrides .exit requests.
|
|
|
|
|
- We don't use bridges listed in ExcludeNodes.
|
|
|
|
|
- When StrictNodes is 1:
|
|
|
|
|
. We now apply ExcludeNodes to hidden service introduction points
|
|
|
|
|
and to rendezvous points selected by hidden service users. This
|
|
|
|
|
can make your hidden service less reliable: use it with caution!
|
|
|
|
|
. If we have used ExcludeNodes on ourself, do not try relay
|
|
|
|
|
reachability self-tests.
|
|
|
|
|
. If we have excluded all the directory authorities, we will not
|
|
|
|
|
even try to upload our descriptor if we're a relay.
|
|
|
|
|
. Do not honor .exit requests to an excluded node.
|
|
|
|
|
- Remove a misfeature that caused us to ignore the Fast/Stable flags
|
|
|
|
|
when ExitNodes is set. Bugfix on 0.2.2.7-alpha.
|
|
|
|
|
- When the set of permitted nodes changes, we now remove any mappings
|
|
|
|
|
introduced via TrackExitHosts to now-excluded nodes. Bugfix on
|
|
|
|
|
0.1.0.1-rc.
|
|
|
|
|
- We never cannibalize a circuit that had excluded nodes on it, even
|
|
|
|
|
if StrictNodes is 0. Bugfix on 0.1.0.1-rc.
|
|
|
|
|
- Revert a change where we would be laxer about attaching streams to
|
|
|
|
|
circuits than when building the circuits. This was meant to prevent
|
|
|
|
|
a set of bugs where streams were never attachable, but our improved
|
|
|
|
|
code here should make this unnecessary. Bugfix on 0.2.2.7-alpha.
|
|
|
|
|
- Keep track of how many times we launch a new circuit to handle a
|
|
|
|
|
given stream. Too many launches could indicate an inconsistency
|
|
|
|
|
between our "launch a circuit to handle this stream" logic and our
|
|
|
|
|
"attach this stream to one of the available circuits" logic.
|
|
|
|
|
- Improve log messages related to excluded nodes.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a spurious warning when moving from a short month to a long
|
|
|
|
|
month on relays with month-based BandwidthAccounting. Bugfix on
|
|
|
|
|
0.2.2.17-alpha; fixes bug 3020.
|
|
|
|
|
- When a client finds that an origin circuit has run out of 16-bit
|
|
|
|
|
stream IDs, we now mark it as unusable for new streams. Previously,
|
|
|
|
|
we would try to close the entire circuit. Bugfix on 0.0.6.
|
|
|
|
|
- Add a forgotten cast that caused a compile warning on OS X 10.6.
|
|
|
|
|
Bugfix on 0.2.2.24-alpha.
|
|
|
|
|
- Be more careful about reporting the correct error from a failed
|
|
|
|
|
connect() system call. Under some circumstances, it was possible to
|
|
|
|
|
look at an incorrect value for errno when sending the end reason.
|
|
|
|
|
Bugfix on 0.1.0.1-rc.
|
|
|
|
|
- Correctly handle an "impossible" overflow cases in connection byte
|
|
|
|
|
counting, where we write or read more than 4GB on an edge connection
|
|
|
|
|
in a single second. Bugfix on 0.1.2.8-beta.
|
|
|
|
|
- Correct the warning displayed when a rendezvous descriptor exceeds
|
|
|
|
|
the maximum size. Fixes bug 2750; bugfix on 0.2.1.5-alpha. Found by
|
|
|
|
|
John Brooks.
|
|
|
|
|
- Clients and hidden services now use HSDir-flagged relays for hidden
|
|
|
|
|
service descriptor downloads and uploads even if the relays have no
|
|
|
|
|
DirPort set and the client has disabled TunnelDirConns. This will
|
|
|
|
|
eventually allow us to give the HSDir flag to relays with no
|
|
|
|
|
DirPort. Fixes bug 2722; bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- Downgrade "no current certificates known for authority" message from
|
|
|
|
|
Notice to Info. Fixes bug 2899; bugfix on 0.2.0.10-alpha.
|
|
|
|
|
- Make the SIGNAL DUMP control-port command work on FreeBSD. Fixes bug
|
|
|
|
|
2917. Bugfix on 0.1.1.1-alpha.
|
|
|
|
|
- Only limit the lengths of single HS descriptors, even when multiple
|
|
|
|
|
HS descriptors are published to an HSDir relay in a single POST
|
|
|
|
|
operation. Fixes bug 2948; bugfix on 0.2.1.5-alpha. Found by hsdir.
|
|
|
|
|
- Write the current time into the LastWritten line in our state file,
|
|
|
|
|
rather than the time from the previous write attempt. Also, stop
|
|
|
|
|
trying to use a time of -1 in our log statements. Fixes bug 3039;
|
|
|
|
|
bugfix on 0.2.2.14-alpha.
|
|
|
|
|
- Be more consistent in our treatment of file system paths. "~" should
|
|
|
|
|
get expanded to the user's home directory in the Log config option.
|
|
|
|
|
Fixes bug 2971; bugfix on 0.2.0.1-alpha, which introduced the
|
|
|
|
|
feature for the -f and --DataDirectory options.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Make sure every relay writes a state file at least every 12 hours.
|
|
|
|
|
Previously, a relay could go for weeks without writing its state
|
|
|
|
|
file, and on a crash could lose its bandwidth history, capacity
|
|
|
|
|
estimates, client country statistics, and so on. Addresses bug 3012.
|
|
|
|
|
- Send END_STREAM_REASON_NOROUTE in response to EHOSTUNREACH errors.
|
|
|
|
|
Clients before 0.2.1.27 didn't handle NOROUTE correctly, but such
|
|
|
|
|
clients are already deprecated because of security bugs.
|
|
|
|
|
- Don't allow v0 hidden service authorities to act as clients.
|
|
|
|
|
Required by fix for bug 3000.
|
|
|
|
|
- Ignore SIGNAL NEWNYM commands on relay-only Tor instances. Required
|
|
|
|
|
by fix for bug 3000.
|
|
|
|
|
- Ensure that no empty [dirreq-](read|write)-history lines are added
|
|
|
|
|
to an extrainfo document. Implements ticket 2497.
|
|
|
|
|
|
|
|
|
|
o Code simplification and refactoring:
|
|
|
|
|
- Remove workaround code to handle directory responses from servers
|
|
|
|
|
that had bug 539 (they would send HTTP status 503 responses _and_
|
|
|
|
|
send a body too). Since only server versions before
|
|
|
|
|
0.2.0.16-alpha/0.1.2.19 were affected, there is no longer reason to
|
|
|
|
|
keep the workaround in place.
|
|
|
|
|
- Remove the old 'fuzzy time' logic. It was supposed to be used for
|
|
|
|
|
handling calculations where we have a known amount of clock skew and
|
|
|
|
|
an allowed amount of unknown skew. But we only used it in three
|
|
|
|
|
places, and we never adjusted the known/unknown skew values. This is
|
|
|
|
|
still something we might want to do someday, but if we do, we'll
|
|
|
|
|
want to do it differently.
|
|
|
|
|
- Avoid signed/unsigned comparisons by making SIZE_T_CEILING unsigned.
|
|
|
|
|
None of the cases where we did this before were wrong, but by making
|
|
|
|
|
this change we avoid warnings. Fixes bug 2475; bugfix on 0.2.1.28.
|
|
|
|
|
- Use GetTempDir to find the proper temporary directory location on
|
|
|
|
|
Windows when generating temporary files for the unit tests. Patch by
|
|
|
|
|
Gisle Vanem.
|
|
|
|
|
|
|
|
|
|
|
2011-04-12 05:26:27 +02:00
|
|
|
Changes in version 0.2.2.24-alpha - 2011-04-08
|
|
|
|
|
Tor 0.2.2.24-alpha fixes a variety of bugs, including a big bug that
|
|
|
|
|
prevented Tor clients from effectively using "multihomed" bridges,
|
|
|
|
|
that is, bridges that listen on multiple ports or IP addresses so users
|
|
|
|
|
can continue to use some of their addresses even if others get blocked.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a bug where bridge users who configure the non-canonical
|
|
|
|
|
address of a bridge automatically switch to its canonical
|
|
|
|
|
address. If a bridge listens at more than one address, it should be
|
|
|
|
|
able to advertise those addresses independently and any non-blocked
|
|
|
|
|
addresses should continue to work. Bugfix on Tor 0.2.0.x. Fixes
|
|
|
|
|
bug 2510.
|
|
|
|
|
- If you configured Tor to use bridge A, and then quit and
|
|
|
|
|
configured Tor to use bridge B instead, it would happily continue
|
|
|
|
|
to use bridge A if it's still reachable. While this behavior is
|
|
|
|
|
a feature if your goal is connectivity, in some scenarios it's a
|
|
|
|
|
dangerous bug. Bugfix on Tor 0.2.0.1-alpha; fixes bug 2511.
|
|
|
|
|
- Directory authorities now use data collected from their own
|
|
|
|
|
uptime observations when choosing whether to assign the HSDir flag
|
|
|
|
|
to relays, instead of trusting the uptime value the relay reports in
|
|
|
|
|
its descriptor. This change helps prevent an attack where a small
|
|
|
|
|
set of nodes with frequently-changing identity keys can blackhole
|
|
|
|
|
a hidden service. (Only authorities need upgrade; others will be
|
|
|
|
|
fine once they do.) Bugfix on 0.2.0.10-alpha; fixes bug 2709.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When we restart our relay, we might get a successful connection
|
|
|
|
|
from the outside before we've started our reachability tests,
|
|
|
|
|
triggering a warning: "ORPort found reachable, but I have no
|
|
|
|
|
routerinfo yet. Failing to inform controller of success." This
|
|
|
|
|
bug was harmless unless Tor is running under a controller
|
|
|
|
|
like Vidalia, in which case the controller would never get a
|
|
|
|
|
REACHABILITY_SUCCEEDED status event. Bugfix on 0.1.2.6-alpha;
|
|
|
|
|
fixes bug 1172.
|
|
|
|
|
- Make directory authorities more accurate at recording when
|
|
|
|
|
relays that have failed several reachability tests became
|
|
|
|
|
unreachable, so we can provide more accuracy at assigning Stable,
|
|
|
|
|
Guard, HSDir, etc flags. Bugfix on 0.2.0.6-alpha. Resolves bug 2716.
|
|
|
|
|
- Fix an issue that prevented static linking of libevent on
|
|
|
|
|
some platforms (notably Linux). Fixes bug 2698; bugfix on
|
|
|
|
|
versions 0.2.1.23/0.2.2.8-alpha (the versions introducing
|
|
|
|
|
the --with-static-libevent configure option).
|
|
|
|
|
- We now ask the other side of a stream (the client or the exit)
|
|
|
|
|
for more data on that stream when the amount of queued data on
|
|
|
|
|
that stream dips low enough. Previously, we wouldn't ask the
|
|
|
|
|
other side for more data until either it sent us more data (which
|
|
|
|
|
it wasn't supposed to do if it had exhausted its window!) or we
|
|
|
|
|
had completely flushed all our queued data. This flow control fix
|
|
|
|
|
should improve throughput. Fixes bug 2756; bugfix on the earliest
|
|
|
|
|
released versions of Tor (svn commit r152).
|
|
|
|
|
- Avoid a double-mark-for-free warning when failing to attach a
|
|
|
|
|
transparent proxy connection. (We thought we had fixed this in
|
|
|
|
|
0.2.2.23-alpha, but it turns out our fix was checking the wrong
|
|
|
|
|
connection.) Fixes bug 2757; bugfix on 0.1.2.1-alpha (the original
|
|
|
|
|
bug) and 0.2.2.23-alpha (the incorrect fix).
|
|
|
|
|
- When warning about missing zlib development packages during compile,
|
|
|
|
|
give the correct package names. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Directory authorities now log the source of a rejected POSTed v3
|
|
|
|
|
networkstatus vote.
|
|
|
|
|
- Make compilation with clang possible when using
|
|
|
|
|
--enable-gcc-warnings by removing two warning optionss that clang
|
|
|
|
|
hasn't implemented yet and by fixing a few warnings. Implements
|
|
|
|
|
ticket 2696.
|
|
|
|
|
- When expiring circuits, use microsecond timers rather than
|
|
|
|
|
one-second timers. This can avoid an unpleasant situation where a
|
|
|
|
|
circuit is launched near the end of one second and expired right
|
|
|
|
|
near the beginning of the next, and prevent fluctuations in circuit
|
|
|
|
|
timeout values.
|
|
|
|
|
- Use computed circuit-build timeouts to decide when to launch
|
|
|
|
|
parallel introduction circuits for hidden services. (Previously,
|
|
|
|
|
we would retry after 15 seconds.)
|
|
|
|
|
- Update to the April 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
o Packaging fixes:
|
|
|
|
|
- Create the /var/run/tor directory on startup on OpenSUSE if it is
|
|
|
|
|
not already created. Patch from Andreas Stieger. Fixes bug 2573.
|
|
|
|
|
|
|
|
|
|
o Documentation changes:
|
|
|
|
|
- Modernize the doxygen configuration file slightly. Fixes bug 2707.
|
|
|
|
|
- Resolve all doxygen warnings except those for missing documentation.
|
|
|
|
|
Fixes bug 2705.
|
|
|
|
|
- Add doxygen documentation for more functions, fields, and types.
|
|
|
|
|
|
|
|
|
|
|
2011-03-09 00:59:48 +01:00
|
|
|
Changes in version 0.2.2.23-alpha - 2011-03-08
|
|
|
|
|
Tor 0.2.2.23-alpha lets relays record their bandwidth history so when
|
|
|
|
|
they restart they don't lose their bandwidth capacity estimate. This
|
|
|
|
|
release also fixes a diverse set of user-facing bugs, ranging from
|
|
|
|
|
relays overrunning their rate limiting to clients falsely warning about
|
|
|
|
|
clock skew to bridge descriptor leaks by our bridge directory authority.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop sending a CLOCK_SKEW controller status event whenever
|
|
|
|
|
we fetch directory information from a relay that has a wrong clock.
|
|
|
|
|
Instead, only inform the controller when it's a trusted authority
|
|
|
|
|
that claims our clock is wrong. Bugfix on 0.1.2.6-alpha; fixes
|
|
|
|
|
the rest of bug 1074.
|
|
|
|
|
- Fix an assert in parsing router descriptors containing IPv6
|
|
|
|
|
addresses. This one took down the directory authorities when
|
|
|
|
|
somebody tried some experimental code. Bugfix on 0.2.1.3-alpha.
|
|
|
|
|
- Make the bridge directory authority refuse to answer directory
|
|
|
|
|
requests for "all" descriptors. It used to include bridge
|
|
|
|
|
descriptors in its answer, which was a major information leak.
|
|
|
|
|
Found by "piebeer". Bugfix on 0.2.0.3-alpha.
|
|
|
|
|
- If relays set RelayBandwidthBurst but not RelayBandwidthRate,
|
|
|
|
|
Tor would ignore their RelayBandwidthBurst setting,
|
|
|
|
|
potentially using more bandwidth than expected. Bugfix on
|
|
|
|
|
0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug 2470.
|
|
|
|
|
- Ignore and warn if the user mistakenly sets "PublishServerDescriptor
|
|
|
|
|
hidserv" in her torrc. The 'hidserv' argument never controlled
|
|
|
|
|
publication of hidden service descriptors. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Relays now save observed peak bandwidth throughput rates to their
|
|
|
|
|
state file (along with total usage, which was already saved)
|
|
|
|
|
so that they can determine their correct estimated bandwidth on
|
|
|
|
|
restart. Resolves bug 1863, where Tor relays would reset their
|
|
|
|
|
estimated bandwidth to 0 after restarting.
|
|
|
|
|
- Directory authorities now take changes in router IP address and
|
|
|
|
|
ORPort into account when determining router stability. Previously,
|
|
|
|
|
if a router changed its IP or ORPort, the authorities would not
|
|
|
|
|
treat it as having any downtime for the purposes of stability
|
|
|
|
|
calculation, whereas clients would experience downtime since the
|
|
|
|
|
change could take a while to propagate to them. Resolves issue 1035.
|
|
|
|
|
- Enable Address Space Layout Randomization (ASLR) and Data Execution
|
|
|
|
|
Prevention (DEP) by default on Windows to make it harder for
|
|
|
|
|
attackers to exploit vulnerabilities. Patch from John Brooks.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.1.x and earlier):
|
|
|
|
|
- Fix a rare crash bug that could occur when a client was configured
|
|
|
|
|
with a large number of bridges. Fixes bug 2629; bugfix on
|
|
|
|
|
0.2.1.2-alpha. Bugfix by trac user "shitlei".
|
|
|
|
|
- Avoid a double mark-for-free warning when failing to attach a
|
|
|
|
|
transparent proxy connection. Bugfix on 0.1.2.1-alpha. Fixes
|
|
|
|
|
bug 2279.
|
|
|
|
|
- Correctly detect failure to allocate an OpenSSL BIO. Fixes bug 2378;
|
|
|
|
|
found by "cypherpunks". This bug was introduced before the first
|
|
|
|
|
Tor release, in svn commit r110.
|
|
|
|
|
- Country codes aren't supported in EntryNodes until 0.2.3.x, so
|
|
|
|
|
don't mention them in the manpage. Fixes bug 2450; issue
|
|
|
|
|
spotted by keb and G-Lo.
|
|
|
|
|
- Fix a bug in bandwidth history state parsing that could have been
|
|
|
|
|
triggered if a future version of Tor ever changed the timing
|
|
|
|
|
granularity at which bandwidth history is measured. Bugfix on
|
|
|
|
|
Tor 0.1.1.11-alpha.
|
|
|
|
|
- When a relay decides that its DNS is too broken for it to serve
|
|
|
|
|
as an exit server, it advertised itself as a non-exit, but
|
|
|
|
|
continued to act as an exit. This could create accidental
|
|
|
|
|
partitioning opportunities for users. Instead, if a relay is
|
|
|
|
|
going to advertise reject *:* as its exit policy, it should
|
|
|
|
|
really act with exit policy "reject *:*". Fixes bug 2366.
|
|
|
|
|
Bugfix on Tor 0.1.2.5-alpha. Bugfix by user "postman" on trac.
|
|
|
|
|
- In the special case where you configure a public exit relay as your
|
|
|
|
|
bridge, Tor would be willing to use that exit relay as the last
|
|
|
|
|
hop in your circuit as well. Now we fail that circuit instead.
|
|
|
|
|
Bugfix on 0.2.0.12-alpha. Fixes bug 2403. Reported by "piebeer".
|
|
|
|
|
- Fix a bug with our locking implementation on Windows that couldn't
|
|
|
|
|
correctly detect when a file was already locked. Fixes bug 2504,
|
|
|
|
|
bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- Fix IPv6-related connect() failures on some platforms (BSD, OS X).
|
|
|
|
|
Bugfix on 0.2.0.3-alpha; fixes first part of bug 2660. Patch by
|
|
|
|
|
"piebeer".
|
|
|
|
|
- Set target port in get_interface_address6() correctly. Bugfix
|
|
|
|
|
on 0.1.1.4-alpha and 0.2.0.3-alpha; fixes second part of bug 2660.
|
|
|
|
|
- Directory authorities are now more robust to hops back in time
|
|
|
|
|
when calculating router stability. Previously, if a run of uptime
|
|
|
|
|
or downtime appeared to be negative, the calculation could give
|
|
|
|
|
incorrect results. Bugfix on 0.2.0.6-alpha; noticed when fixing
|
|
|
|
|
bug 1035.
|
|
|
|
|
- Fix an assert that got triggered when using the TestingTorNetwork
|
|
|
|
|
configuration option and then issuing a GETINFO config-text control
|
|
|
|
|
command. Fixes bug 2250; bugfix on 0.2.1.2-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.2.x):
|
|
|
|
|
- Clients should not weight BadExit nodes as Exits in their node
|
|
|
|
|
selection. Similarly, directory authorities should not count BadExit
|
|
|
|
|
bandwidth as Exit bandwidth when computing bandwidth-weights.
|
|
|
|
|
Bugfix on 0.2.2.10-alpha; fixes bug 2203.
|
|
|
|
|
- Correctly clear our dir_read/dir_write history when there is an
|
|
|
|
|
error parsing any bw history value from the state file. Bugfix on
|
|
|
|
|
Tor 0.2.2.15-alpha.
|
|
|
|
|
- Resolve a bug in verifying signatures of directory objects
|
|
|
|
|
with digests longer than SHA1. Bugfix on 0.2.2.20-alpha.
|
|
|
|
|
Fixes bug 2409. Found by "piebeer".
|
|
|
|
|
- Bridge authorities no longer crash on SIGHUP when they try to
|
|
|
|
|
publish their relay descriptor to themselves. Fixes bug 2572. Bugfix
|
|
|
|
|
on 0.2.2.22-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Log less aggressively about circuit timeout changes, and improve
|
|
|
|
|
some other circuit timeout messages. Resolves bug 2004.
|
|
|
|
|
- Log a little more clearly about the times at which we're no longer
|
|
|
|
|
accepting new connections. Resolves bug 2181.
|
|
|
|
|
- Reject attempts at the client side to open connections to private
|
|
|
|
|
IP addresses (like 127.0.0.1, 10.0.0.1, and so on) with
|
|
|
|
|
a randomly chosen exit node. Attempts to do so are always
|
|
|
|
|
ill-defined, generally prevented by exit policies, and usually
|
|
|
|
|
in error. This will also help to detect loops in transparent
|
|
|
|
|
proxy configurations. You can disable this feature by setting
|
|
|
|
|
"ClientRejectInternalAddresses 0" in your torrc.
|
|
|
|
|
- Always treat failure to allocate an RSA key as an unrecoverable
|
|
|
|
|
allocation error.
|
|
|
|
|
- Update to the March 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
o Minor features (log subsystem):
|
|
|
|
|
- Add documentation for configuring logging at different severities in
|
|
|
|
|
different log domains. We've had this feature since 0.2.1.1-alpha,
|
|
|
|
|
but for some reason it never made it into the manpage. Fixes
|
|
|
|
|
bug 2215.
|
|
|
|
|
- Make it simpler to specify "All log domains except for A and B".
|
|
|
|
|
Previously you needed to say "[*,~A,~B]". Now you can just say
|
|
|
|
|
"[~A,~B]".
|
|
|
|
|
- Add a "LogMessageDomains 1" option to include the domains of log
|
|
|
|
|
messages along with the messages. Without this, there's no way
|
|
|
|
|
to use log domains without reading the source or doing a lot
|
|
|
|
|
of guessing.
|
|
|
|
|
|
|
|
|
|
o Packaging changes:
|
|
|
|
|
- Stop shipping the Tor specs files and development proposal documents
|
|
|
|
|
in the tarball. They are now in a separate git repository at
|
|
|
|
|
git://git.torproject.org/torspec.git
|
|
|
|
|
|
|
|
|
|
|
2011-08-01 22:14:17 +02:00
|
|
|
Changes in version 0.2.1.30 - 2011-02-23
|
|
|
|
|
Tor 0.2.1.30 fixes a variety of less critical bugs. The main other
|
|
|
|
|
change is a slight tweak to Tor's TLS handshake that makes relays
|
|
|
|
|
and bridges that run this new version reachable from Iran again.
|
|
|
|
|
We don't expect this tweak will win the arms race long-term, but it
|
|
|
|
|
buys us time until we roll out a better solution.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop sending a CLOCK_SKEW controller status event whenever
|
|
|
|
|
we fetch directory information from a relay that has a wrong clock.
|
|
|
|
|
Instead, only inform the controller when it's a trusted authority
|
|
|
|
|
that claims our clock is wrong. Bugfix on 0.1.2.6-alpha; fixes
|
|
|
|
|
the rest of bug 1074.
|
|
|
|
|
- Fix a bounds-checking error that could allow an attacker to
|
|
|
|
|
remotely crash a directory authority. Bugfix on 0.2.1.5-alpha.
|
|
|
|
|
Found by "piebeer".
|
|
|
|
|
- If relays set RelayBandwidthBurst but not RelayBandwidthRate,
|
|
|
|
|
Tor would ignore their RelayBandwidthBurst setting,
|
|
|
|
|
potentially using more bandwidth than expected. Bugfix on
|
|
|
|
|
0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug 2470.
|
|
|
|
|
- Ignore and warn if the user mistakenly sets "PublishServerDescriptor
|
|
|
|
|
hidserv" in her torrc. The 'hidserv' argument never controlled
|
|
|
|
|
publication of hidden service descriptors. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Adjust our TLS Diffie-Hellman parameters to match those used by
|
|
|
|
|
Apache's mod_ssl.
|
|
|
|
|
- Update to the February 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Check for and reject overly long directory certificates and
|
|
|
|
|
directory tokens before they have a chance to hit any assertions.
|
|
|
|
|
Bugfix on 0.2.1.28. Found by "doorss".
|
|
|
|
|
- Bring the logic that gathers routerinfos and assesses the
|
|
|
|
|
acceptability of circuits into line. This prevents a Tor OP from
|
|
|
|
|
getting locked in a cycle of choosing its local OR as an exit for a
|
|
|
|
|
path (due to a .exit request) and then rejecting the circuit because
|
|
|
|
|
its OR is not listed yet. It also prevents Tor clients from using an
|
|
|
|
|
OR running in the same instance as an exit (due to a .exit request)
|
|
|
|
|
if the OR does not meet the same requirements expected of an OR
|
|
|
|
|
running elsewhere. Fixes bug 1859; bugfix on 0.1.0.1-rc.
|
|
|
|
|
|
|
|
|
|
o Packaging changes:
|
|
|
|
|
- Stop shipping the Tor specs files and development proposal documents
|
|
|
|
|
in the tarball. They are now in a separate git repository at
|
|
|
|
|
git://git.torproject.org/torspec.git
|
|
|
|
|
- Do not include Git version tags as though they are SVN tags when
|
|
|
|
|
generating a tarball from inside a repository that has switched
|
|
|
|
|
between branches. Bugfix on 0.2.1.15-rc; fixes bug 2402.
|
|
|
|
|
|
|
|
|
|
|
2011-02-08 04:29:19 +01:00
|
|
|
Changes in version 0.2.2.22-alpha - 2011-01-25
|
|
|
|
|
Tor 0.2.2.22-alpha fixes a few more less-critical security issues. The
|
|
|
|
|
main other change is a slight tweak to Tor's TLS handshake that makes
|
|
|
|
|
relays and bridges that run this new version reachable from Iran again.
|
|
|
|
|
We don't expect this tweak will win the arms race long-term, but it
|
|
|
|
|
will buy us a bit more time until we roll out a better solution.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a bounds-checking error that could allow an attacker to
|
|
|
|
|
remotely crash a directory authority. Bugfix on 0.2.1.5-alpha.
|
|
|
|
|
Found by "piebeer".
|
|
|
|
|
- Don't assert when changing from bridge to relay or vice versa
|
|
|
|
|
via the controller. The assert happened because we didn't properly
|
|
|
|
|
initialize our keys in this case. Bugfix on 0.2.2.18-alpha; fixes
|
|
|
|
|
bug 2433. Reported by bastik.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Adjust our TLS Diffie-Hellman parameters to match those used by
|
|
|
|
|
Apache's mod_ssl.
|
|
|
|
|
- Provide a log message stating which geoip file we're parsing
|
|
|
|
|
instead of just stating that we're parsing the geoip file.
|
|
|
|
|
Implements ticket 2432.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Check for and reject overly long directory certificates and
|
|
|
|
|
directory tokens before they have a chance to hit any assertions.
|
|
|
|
|
Bugfix on 0.2.1.28 / 0.2.2.20-alpha. Found by "doorss".
|
|
|
|
|
|
|
|
|
|
|
2011-01-16 02:59:25 +01:00
|
|
|
Changes in version 0.2.2.21-alpha - 2011-01-15
|
|
|
|
|
Tor 0.2.2.21-alpha includes all the patches from Tor 0.2.1.29, which
|
|
|
|
|
continues our recent code security audit work. The main fix resolves
|
|
|
|
|
a remote heap overflow vulnerability that can allow remote code
|
|
|
|
|
execution (CVE-2011-0427). Other fixes address a variety of assert
|
|
|
|
|
and crash bugs, most of which we think are hard to exploit remotely.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (security), also included in 0.2.1.29:
|
|
|
|
|
- Fix a heap overflow bug where an adversary could cause heap
|
|
|
|
|
corruption. This bug probably allows remote code execution
|
|
|
|
|
attacks. Reported by "debuger". Fixes CVE-2011-0427. Bugfix on
|
|
|
|
|
0.1.2.10-rc.
|
|
|
|
|
- Prevent a denial-of-service attack by disallowing any
|
|
|
|
|
zlib-compressed data whose compression factor is implausibly
|
|
|
|
|
high. Fixes part of bug 2324; reported by "doorss".
|
|
|
|
|
- Zero out a few more keys in memory before freeing them. Fixes
|
|
|
|
|
bug 2384 and part of bug 2385. These key instances found by
|
|
|
|
|
"cypherpunks", based on Andrew Case's report about being able
|
|
|
|
|
to find sensitive data in Tor's memory space if you have enough
|
|
|
|
|
permissions. Bugfix on 0.0.2pre9.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (crashes), also included in 0.2.1.29:
|
|
|
|
|
- Prevent calls to Libevent from inside Libevent log handlers.
|
|
|
|
|
This had potential to cause a nasty set of crashes, especially
|
|
|
|
|
if running Libevent with debug logging enabled, and running
|
|
|
|
|
Tor with a controller watching for low-severity log messages.
|
|
|
|
|
Bugfix on 0.1.0.2-rc. Fixes bug 2190.
|
|
|
|
|
- Add a check for SIZE_T_MAX to tor_realloc() to try to avoid
|
|
|
|
|
underflow errors there too. Fixes the other part of bug 2324.
|
|
|
|
|
- Fix a bug where we would assert if we ever had a
|
|
|
|
|
cached-descriptors.new file (or another file read directly into
|
|
|
|
|
memory) of exactly SIZE_T_CEILING bytes. Fixes bug 2326; bugfix
|
|
|
|
|
on 0.2.1.25. Found by doorss.
|
|
|
|
|
- Fix some potential asserts and parsing issues with grossly
|
|
|
|
|
malformed router caches. Fixes bug 2352; bugfix on Tor 0.2.1.27.
|
|
|
|
|
Found by doorss.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (other), also included in 0.2.1.29:
|
|
|
|
|
- Fix a bug with handling misformed replies to reverse DNS lookup
|
|
|
|
|
requests in DNSPort. Bugfix on Tor 0.2.0.1-alpha. Related to a
|
|
|
|
|
bug reported by doorss.
|
|
|
|
|
- Fix compilation on mingw when a pthreads compatibility library
|
|
|
|
|
has been installed. (We don't want to use it, so we shouldn't
|
|
|
|
|
be including pthread.h.) Fixes bug 2313; bugfix on 0.1.0.1-rc.
|
|
|
|
|
- Fix a bug where we would declare that we had run out of virtual
|
|
|
|
|
addresses when the address space was only half-exhausted. Bugfix
|
|
|
|
|
on 0.1.2.1-alpha.
|
|
|
|
|
- Correctly handle the case where AutomapHostsOnResolve is set but
|
|
|
|
|
no virtual addresses are available. Fixes bug 2328; bugfix on
|
|
|
|
|
0.1.2.1-alpha. Bug found by doorss.
|
2011-01-19 01:14:14 +01:00
|
|
|
- Correctly handle wrapping around when we run out of virtual
|
|
|
|
|
address space. Found by cypherpunks; bugfix on 0.2.0.5-alpha.
|
2011-01-16 02:59:25 +01:00
|
|
|
|
|
|
|
|
o Minor features, also included in 0.2.1.29:
|
|
|
|
|
- Update to the January 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
- Introduce output size checks on all of our decryption functions.
|
|
|
|
|
|
|
|
|
|
o Build changes, also included in 0.2.1.29:
|
|
|
|
|
- Tor does not build packages correctly with Automake 1.6 and earlier;
|
|
|
|
|
added a check to Makefile.am to make sure that we're building with
|
|
|
|
|
Automake 1.7 or later.
|
2011-01-19 01:14:14 +01:00
|
|
|
- The 0.2.1.28 tarball was missing src/common/OpenBSD_malloc_Linux.c
|
|
|
|
|
because we built it with a too-old version of automake. Thus that
|
|
|
|
|
release broke ./configure --enable-openbsd-malloc, which is popular
|
|
|
|
|
among really fast exit relays on Linux.
|
2011-01-16 02:59:25 +01:00
|
|
|
|
2011-01-16 04:42:14 +01:00
|
|
|
o Major bugfixes, new in 0.2.2.21-alpha:
|
|
|
|
|
- Prevent crash/heap corruption when the cbtnummodes consensus
|
|
|
|
|
parameter is set to 0 or large values. Fixes bug 2317; bugfix
|
|
|
|
|
on 0.2.2.14-alpha.
|
|
|
|
|
|
|
|
|
|
o Major features, new in 0.2.2.21-alpha:
|
|
|
|
|
- Introduce minimum/maximum values that clients will believe
|
|
|
|
|
from the consensus. Now we'll have a better chance to avoid crashes
|
|
|
|
|
or worse when a consensus param has a weird value.
|
|
|
|
|
|
2011-01-16 02:59:25 +01:00
|
|
|
o Minor features, new in 0.2.2.21-alpha:
|
|
|
|
|
- Make sure to disable DirPort if running as a bridge. DirPorts aren't
|
|
|
|
|
used on bridges, and it makes bridge scanning somewhat easier.
|
|
|
|
|
- If writing the state file to disk fails, wait up to an hour before
|
|
|
|
|
retrying again, rather than trying again each second. Fixes bug
|
|
|
|
|
2346; bugfix on Tor 0.1.1.3-alpha.
|
|
|
|
|
- Make Libevent log messages get delivered to controllers later,
|
|
|
|
|
and not from inside the Libevent log handler. This prevents unsafe
|
|
|
|
|
reentrant Libevent calls while still letting the log messages
|
|
|
|
|
get through.
|
|
|
|
|
- Detect platforms that brokenly use a signed size_t, and refuse to
|
|
|
|
|
build there. Found and analyzed by doorss and rransom.
|
|
|
|
|
- Fix a bunch of compile warnings revealed by mingw with gcc 4.5.
|
|
|
|
|
Resolves bug 2314.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes, new in 0.2.2.21-alpha:
|
|
|
|
|
- Handle SOCKS messages longer than 128 bytes long correctly, rather
|
|
|
|
|
than waiting forever for them to finish. Fixes bug 2330; bugfix
|
|
|
|
|
on 0.2.0.16-alpha. Found by doorss.
|
|
|
|
|
- Add assertions to check for overflow in arguments to
|
|
|
|
|
base32_encode() and base32_decode(); fix a signed-unsigned
|
|
|
|
|
comparison there too. These bugs are not actually reachable in Tor,
|
|
|
|
|
but it's good to prevent future errors too. Found by doorss.
|
|
|
|
|
- Correctly detect failures to create DNS requests when using Libevent
|
|
|
|
|
versions before v2. (Before Libevent 2, we used our own evdns
|
|
|
|
|
implementation. Its return values for Libevent's evdns_resolve_*()
|
|
|
|
|
functions are not consistent with those from Libevent.) Fixes bug
|
|
|
|
|
2363; bugfix on 0.2.2.6-alpha. Found by "lodger".
|
|
|
|
|
|
|
|
|
|
o Documentation, new in 0.2.2.21-alpha:
|
|
|
|
|
- Document the default socks host and port (127.0.0.1:9050) for
|
|
|
|
|
tor-resolve.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.2.1.29 - 2011-01-15
|
|
|
|
|
Tor 0.2.1.29 continues our recent code security audit work. The main
|
|
|
|
|
fix resolves a remote heap overflow vulnerability that can allow remote
|
|
|
|
|
code execution. Other fixes address a variety of assert and crash bugs,
|
|
|
|
|
most of which we think are hard to exploit remotely.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (security):
|
|
|
|
|
- Fix a heap overflow bug where an adversary could cause heap
|
|
|
|
|
corruption. This bug probably allows remote code execution
|
|
|
|
|
attacks. Reported by "debuger". Fixes CVE-2011-0427. Bugfix on
|
|
|
|
|
0.1.2.10-rc.
|
|
|
|
|
- Prevent a denial-of-service attack by disallowing any
|
|
|
|
|
zlib-compressed data whose compression factor is implausibly
|
|
|
|
|
high. Fixes part of bug 2324; reported by "doorss".
|
|
|
|
|
- Zero out a few more keys in memory before freeing them. Fixes
|
|
|
|
|
bug 2384 and part of bug 2385. These key instances found by
|
|
|
|
|
"cypherpunks", based on Andrew Case's report about being able
|
|
|
|
|
to find sensitive data in Tor's memory space if you have enough
|
|
|
|
|
permissions. Bugfix on 0.0.2pre9.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- Prevent calls to Libevent from inside Libevent log handlers.
|
|
|
|
|
This had potential to cause a nasty set of crashes, especially
|
|
|
|
|
if running Libevent with debug logging enabled, and running
|
|
|
|
|
Tor with a controller watching for low-severity log messages.
|
|
|
|
|
Bugfix on 0.1.0.2-rc. Fixes bug 2190.
|
|
|
|
|
- Add a check for SIZE_T_MAX to tor_realloc() to try to avoid
|
|
|
|
|
underflow errors there too. Fixes the other part of bug 2324.
|
|
|
|
|
- Fix a bug where we would assert if we ever had a
|
|
|
|
|
cached-descriptors.new file (or another file read directly into
|
|
|
|
|
memory) of exactly SIZE_T_CEILING bytes. Fixes bug 2326; bugfix
|
|
|
|
|
on 0.2.1.25. Found by doorss.
|
|
|
|
|
- Fix some potential asserts and parsing issues with grossly
|
|
|
|
|
malformed router caches. Fixes bug 2352; bugfix on Tor 0.2.1.27.
|
|
|
|
|
Found by doorss.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (other):
|
|
|
|
|
- Fix a bug with handling misformed replies to reverse DNS lookup
|
|
|
|
|
requests in DNSPort. Bugfix on Tor 0.2.0.1-alpha. Related to a
|
|
|
|
|
bug reported by doorss.
|
|
|
|
|
- Fix compilation on mingw when a pthreads compatibility library
|
|
|
|
|
has been installed. (We don't want to use it, so we shouldn't
|
|
|
|
|
be including pthread.h.) Fixes bug 2313; bugfix on 0.1.0.1-rc.
|
|
|
|
|
- Fix a bug where we would declare that we had run out of virtual
|
|
|
|
|
addresses when the address space was only half-exhausted. Bugfix
|
|
|
|
|
on 0.1.2.1-alpha.
|
|
|
|
|
- Correctly handle the case where AutomapHostsOnResolve is set but
|
|
|
|
|
no virtual addresses are available. Fixes bug 2328; bugfix on
|
|
|
|
|
0.1.2.1-alpha. Bug found by doorss.
|
|
|
|
|
- Correctly handle wrapping around to when we run out of virtual
|
|
|
|
|
address space. Found by cypherpunks, bugfix on 0.2.0.5-alpha.
|
|
|
|
|
- The 0.2.1.28 tarball was missing src/common/OpenBSD_malloc_Linux.c
|
|
|
|
|
because we built it with a too-old version of automake. Thus that
|
|
|
|
|
release broke ./configure --enable-openbsd-malloc, which is popular
|
|
|
|
|
among really fast exit relays on Linux.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the January 1 2011 Maxmind GeoLite Country database.
|
|
|
|
|
- Introduce output size checks on all of our decryption functions.
|
|
|
|
|
|
|
|
|
|
o Build changes:
|
|
|
|
|
- Tor does not build packages correctly with Automake 1.6 and earlier;
|
|
|
|
|
added a check to Makefile.am to make sure that we're building with
|
|
|
|
|
Automake 1.7 or later.
|
|
|
|
|
|
|
|
|
|
|
2010-12-20 13:49:22 +01:00
|
|
|
Changes in version 0.2.2.20-alpha - 2010-12-17
|
|
|
|
|
Tor 0.2.2.20-alpha does some code cleanup to reduce the risk of remotely
|
|
|
|
|
exploitable bugs. We also fix a variety of other significant bugs,
|
|
|
|
|
change the IP address for one of our directory authorities, and update
|
|
|
|
|
the minimum version that Tor relays must run to join the network.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a remotely exploitable bug that could be used to crash instances
|
|
|
|
|
of Tor remotely by overflowing on the heap. Remote-code execution
|
|
|
|
|
hasn't been confirmed, but can't be ruled out. Everyone should
|
|
|
|
|
upgrade. Bugfix on the 0.1.1 series and later.
|
|
|
|
|
- Fix a bug that could break accounting on 64-bit systems with large
|
|
|
|
|
time_t values, making them hibernate for impossibly long intervals.
|
|
|
|
|
Fixes bug 2146. Bugfix on 0.0.9pre6; fix by boboper.
|
|
|
|
|
- Fix a logic error in directory_fetches_from_authorities() that
|
|
|
|
|
would cause all _non_-exits refusing single-hop-like circuits
|
|
|
|
|
to fetch from authorities, when we wanted to have _exits_ fetch
|
|
|
|
|
from authorities. Fixes more of 2097. Bugfix on 0.2.2.16-alpha;
|
|
|
|
|
fix by boboper.
|
|
|
|
|
- Fix a stream fairness bug that would cause newer streams on a given
|
|
|
|
|
circuit to get preference when reading bytes from the origin or
|
|
|
|
|
destination. Fixes bug 2210. Fix by Mashael AlSabah. This bug was
|
|
|
|
|
introduced before the first Tor release, in svn revision r152.
|
|
|
|
|
|
|
|
|
|
o Directory authority changes:
|
|
|
|
|
- Change IP address and ports for gabelmoo (v3 directory authority).
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Avoid crashes when AccountingMax is set on clients. Fixes bug 2235.
|
|
|
|
|
Bugfix on 0.2.2.18-alpha. Diagnosed by boboper.
|
|
|
|
|
- Fix an off-by-one error in calculating some controller command
|
|
|
|
|
argument lengths. Fortunately, this mistake is harmless since
|
|
|
|
|
the controller code does redundant NUL termination too. Found by
|
|
|
|
|
boboper. Bugfix on 0.1.1.1-alpha.
|
|
|
|
|
- Do not dereference NULL if a bridge fails to build its
|
|
|
|
|
extra-info descriptor. Found by an anonymous commenter on
|
|
|
|
|
Trac. Bugfix on 0.2.2.19-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the December 1 2010 Maxmind GeoLite Country database.
|
|
|
|
|
- Directory authorities now reject relays running any versions of
|
|
|
|
|
Tor between 0.2.1.3-alpha and 0.2.1.18 inclusive; they have
|
|
|
|
|
known bugs that keep RELAY_EARLY cells from working on rendezvous
|
|
|
|
|
circuits. Followup to fix for bug 2081.
|
|
|
|
|
- Directory authorities now reject relays running any version of Tor
|
|
|
|
|
older than 0.2.0.26-rc. That version is the earliest that fetches
|
|
|
|
|
current directory information correctly. Fixes bug 2156.
|
|
|
|
|
- Report only the top 10 ports in exit-port stats in order not to
|
|
|
|
|
exceed the maximum extra-info descriptor length of 50 KB. Implements
|
|
|
|
|
task 2196.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.2.1.28 - 2010-12-17
|
|
|
|
|
Tor 0.2.1.28 does some code cleanup to reduce the risk of remotely
|
|
|
|
|
exploitable bugs. We also took this opportunity to change the IP address
|
|
|
|
|
for one of our directory authorities, and to update the geoip database
|
|
|
|
|
we ship.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a remotely exploitable bug that could be used to crash instances
|
|
|
|
|
of Tor remotely by overflowing on the heap. Remote-code execution
|
|
|
|
|
hasn't been confirmed, but can't be ruled out. Everyone should
|
|
|
|
|
upgrade. Bugfix on the 0.1.1 series and later.
|
|
|
|
|
|
|
|
|
|
o Directory authority changes:
|
|
|
|
|
- Change IP address and ports for gabelmoo (v3 directory authority).
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the December 1 2010 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
|
2011-01-16 02:59:25 +01:00
|
|
|
Changes in version 0.2.1.27 - 2010-11-23
|
|
|
|
|
Yet another OpenSSL security patch broke its compatibility with Tor:
|
|
|
|
|
Tor 0.2.1.27 makes relays work with openssl 0.9.8p and 1.0.0.b. We
|
|
|
|
|
also took this opportunity to fix several crash bugs, integrate a new
|
|
|
|
|
directory authority, and update the bundled GeoIP database.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
|
|
|
|
|
No longer set the tlsext_host_name extension on server SSL objects;
|
|
|
|
|
but continue to set it on client SSL objects. Our goal in setting
|
|
|
|
|
it was to imitate a browser, not a vhosting server. Fixes bug 2204;
|
|
|
|
|
bugfix on 0.2.1.1-alpha.
|
|
|
|
|
- Do not log messages to the controller while shrinking buffer
|
|
|
|
|
freelists. Doing so would sometimes make the controller connection
|
|
|
|
|
try to allocate a buffer chunk, which would mess up the internals
|
|
|
|
|
of the freelist and cause an assertion failure. Fixes bug 1125;
|
|
|
|
|
fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
|
|
|
|
|
- Learn our external IP address when we're a relay or bridge, even if
|
|
|
|
|
we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
|
|
|
|
|
where we introduced bridge relays that don't need to publish to
|
|
|
|
|
be useful. Fixes bug 2050.
|
|
|
|
|
- Do even more to reject (and not just ignore) annotations on
|
|
|
|
|
router descriptors received anywhere but from the cache. Previously
|
|
|
|
|
we would ignore such annotations at first, but cache them to disk
|
|
|
|
|
anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
|
|
|
|
|
- When you're using bridges and your network goes away and your
|
|
|
|
|
bridges get marked as down, recover when you attempt a new socks
|
|
|
|
|
connection (if the network is back), rather than waiting up to an
|
|
|
|
|
hour to try fetching new descriptors for your bridges. Bugfix on
|
|
|
|
|
0.2.0.3-alpha; fixes bug 1981.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Move to the November 2010 Maxmind GeoLite country db (rather
|
|
|
|
|
than the June 2009 ip-to-country GeoIP db) for our statistics that
|
|
|
|
|
count how many users relays are seeing from each country. Now we'll
|
|
|
|
|
have more accurate data, especially for many African countries.
|
|
|
|
|
|
|
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix an assertion failure that could occur in directory caches or
|
|
|
|
|
bridge users when using a very short voting interval on a testing
|
|
|
|
|
network. Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on
|
|
|
|
|
0.2.0.8-alpha.
|
|
|
|
|
- Enforce multiplicity rules when parsing annotations. Bugfix on
|
|
|
|
|
0.2.0.8-alpha. Found by piebeer.
|
|
|
|
|
- Allow handshaking OR connections to take a full KeepalivePeriod
|
|
|
|
|
seconds to handshake. Previously, we would close them after
|
|
|
|
|
IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
|
|
|
|
|
were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
|
|
|
|
|
for analysis help.
|
|
|
|
|
- When building with --enable-gcc-warnings on OpenBSD, disable
|
|
|
|
|
warnings in system headers. This makes --enable-gcc-warnings
|
|
|
|
|
pass on OpenBSD 4.8.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
|
|
|
|
|
and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
|
|
|
|
|
stream ending reason for this case: END_STREAM_REASON_NOROUTE.
|
|
|
|
|
Servers can start sending this code when enough clients recognize
|
|
|
|
|
it. Bugfix on 0.1.0.1-rc; fixes part of bug 1793.
|
|
|
|
|
- Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
|
|
|
|
|
Patch from mingw-san.
|
|
|
|
|
|
|
|
|
|
o Removed files:
|
|
|
|
|
- Remove the old debian/ directory from the main Tor distribution.
|
|
|
|
|
The official Tor-for-debian git repository lives at the URL
|
|
|
|
|
https://git.torproject.org/debian/tor.git
|
|
|
|
|
- Stop shipping the old doc/website/ directory in the tarball. We
|
|
|
|
|
changed the website format in late 2010, and what we shipped in
|
|
|
|
|
0.2.1.26 really wasn't that useful anyway.
|
|
|
|
|
|
|
|
|
|
|
2010-11-23 04:44:20 +01:00
|
|
|
Changes in version 0.2.2.19-alpha - 2010-11-22
|
|
|
|
|
Yet another OpenSSL security patch broke its compatibility with Tor:
|
|
|
|
|
Tor 0.2.2.19-alpha makes relays work with OpenSSL 0.9.8p and 1.0.0.b.
|
|
|
|
|
|
2010-11-21 22:59:42 +01:00
|
|
|
o Major bugfixes:
|
2010-11-23 04:44:20 +01:00
|
|
|
- Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
|
2010-11-21 22:59:42 +01:00
|
|
|
No longer set the tlsext_host_name extension on server SSL objects;
|
|
|
|
|
but continue to set it on client SSL objects. Our goal in setting
|
|
|
|
|
it was to imitate a browser, not a vhosting server. Fixes bug 2204;
|
|
|
|
|
bugfix on 0.2.1.1-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Try harder not to exceed the maximum length of 50 KB when writing
|
|
|
|
|
statistics to extra-info descriptors. This bug was triggered by very
|
|
|
|
|
fast relays reporting exit-port, entry, and dirreq statistics.
|
|
|
|
|
Reported by Olaf Selke. Bugfix on 0.2.2.1-alpha. Fixes bug 2183.
|
|
|
|
|
- Publish a router descriptor even if generating an extra-info
|
|
|
|
|
descriptor fails. Previously we would not publish a router
|
|
|
|
|
descriptor without an extra-info descriptor; this can cause fast
|
|
|
|
|
exit relays collecting exit-port statistics to drop from the
|
|
|
|
|
consensus. Bugfix on 0.1.2.9-rc; fixes bug 2195.
|
|
|
|
|
|
|
|
|
|
|
2010-11-16 05:54:20 +01:00
|
|
|
Changes in version 0.2.2.18-alpha - 2010-11-16
|
2010-11-23 04:44:20 +01:00
|
|
|
Tor 0.2.2.18-alpha fixes several crash bugs that have been nagging
|
|
|
|
|
us lately, makes unpublished bridge relays able to detect their IP
|
|
|
|
|
address, and fixes a wide variety of other bugs to get us much closer
|
|
|
|
|
to a stable release.
|
|
|
|
|
|
2010-11-10 03:50:30 +01:00
|
|
|
o Major bugfixes:
|
2010-11-16 05:54:20 +01:00
|
|
|
- Do even more to reject (and not just ignore) annotations on
|
|
|
|
|
router descriptors received anywhere but from the cache. Previously
|
|
|
|
|
we would ignore such annotations at first, but cache them to disk
|
|
|
|
|
anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
|
|
|
|
|
- Do not log messages to the controller while shrinking buffer
|
|
|
|
|
freelists. Doing so would sometimes make the controller connection
|
|
|
|
|
try to allocate a buffer chunk, which would mess up the internals
|
|
|
|
|
of the freelist and cause an assertion failure. Fixes bug 1125;
|
|
|
|
|
fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
|
|
|
|
|
- Learn our external IP address when we're a relay or bridge, even if
|
|
|
|
|
we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
|
|
|
|
|
where we introduced bridge relays that don't need to publish to
|
|
|
|
|
be useful. Fixes bug 2050.
|
|
|
|
|
- Maintain separate TLS contexts and certificates for incoming and
|
|
|
|
|
outgoing connections in bridge relays. Previously we would use the
|
|
|
|
|
same TLS contexts and certs for incoming and outgoing connections.
|
|
|
|
|
Bugfix on 0.2.0.3-alpha; addresses bug 988.
|
|
|
|
|
- Maintain separate identity keys for incoming and outgoing TLS
|
|
|
|
|
contexts in bridge relays. Previously we would use the same
|
|
|
|
|
identity keys for incoming and outgoing TLS contexts. Bugfix on
|
2010-11-16 07:12:32 +01:00
|
|
|
0.2.0.3-alpha; addresses the other half of bug 988.
|
2010-11-16 05:54:20 +01:00
|
|
|
- Avoid an assertion failure when we as an authority receive a
|
|
|
|
|
duplicate upload of a router descriptor that we already have,
|
|
|
|
|
but which we previously considered an obsolete descriptor.
|
|
|
|
|
Fixes another case of bug 1776. Bugfix on 0.2.2.16-alpha.
|
2010-11-10 03:50:30 +01:00
|
|
|
- Avoid a crash bug triggered by looking at a dangling pointer while
|
|
|
|
|
setting the network status consensus. Found by Robert Ransom.
|
|
|
|
|
Bugfix on 0.2.2.17-alpha. Fixes bug 2097.
|
2010-11-16 07:12:32 +01:00
|
|
|
- Fix a logic error where servers that _didn't_ act as exits would
|
|
|
|
|
try to keep their server lists more aggressively up to date than
|
|
|
|
|
exits, when it was supposed to be the other way around. Bugfix
|
|
|
|
|
on 0.2.2.17-alpha.
|
2010-11-10 03:50:30 +01:00
|
|
|
|
|
|
|
|
o Minor bugfixes (on Tor 0.2.1.x and earlier):
|
|
|
|
|
- When we're trying to guess whether we know our IP address as
|
|
|
|
|
a relay, we would log various ways that we failed to guess
|
|
|
|
|
our address, but never log that we ended up guessing it
|
|
|
|
|
successfully. Now add a log line to help confused and anxious
|
|
|
|
|
relay operators. Bugfix on 0.1.2.1-alpha; fixes bug 1534.
|
|
|
|
|
- Bring the logic that gathers routerinfos and assesses the
|
|
|
|
|
acceptability of circuits into line. This prevents a Tor OP from
|
|
|
|
|
getting locked in a cycle of choosing its local OR as an exit for a
|
|
|
|
|
path (due to a .exit request) and then rejecting the circuit because
|
2010-11-16 07:12:32 +01:00
|
|
|
its OR is not listed yet. It also prevents Tor clients from using an
|
|
|
|
|
OR running in the same instance as an exit (due to a .exit request)
|
2010-11-10 03:50:30 +01:00
|
|
|
if the OR does not meet the same requirements expected of an OR
|
|
|
|
|
running elsewhere. Fixes bug 1859; bugfix on 0.1.0.1-rc.
|
2010-11-16 07:12:32 +01:00
|
|
|
- Correctly describe errors that occur when generating a TLS object.
|
|
|
|
|
Previously we would attribute them to a failure while generating a
|
|
|
|
|
TLS context. Patch by Robert Ransom. Bugfix on 0.1.0.4-rc; fixes
|
|
|
|
|
bug 1994.
|
2010-11-16 05:54:20 +01:00
|
|
|
- Enforce multiplicity rules when parsing annotations. Bugfix on
|
|
|
|
|
0.2.0.8-alpha. Found by piebeer.
|
2010-11-10 03:50:30 +01:00
|
|
|
- Fix warnings that newer versions of autoconf produced during
|
|
|
|
|
./autogen.sh. These warnings appear to be harmless in our case,
|
|
|
|
|
but they were extremely verbose. Fixes bug 2020.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on Tor 0.2.2.x):
|
|
|
|
|
- Enable protection of small arrays whenever we build with gcc
|
|
|
|
|
hardening features, not only when also building with warnings
|
|
|
|
|
enabled. Fixes bug 2031; bugfix on 0.2.2.14-alpha. Reported by keb.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
2010-11-16 05:54:20 +01:00
|
|
|
- Make hidden services work better in private Tor networks by not
|
|
|
|
|
requiring any uptime to join the hidden service descriptor
|
|
|
|
|
DHT. Implements ticket 2088.
|
|
|
|
|
- Rate-limit the "your application is giving Tor only an IP address"
|
|
|
|
|
warning. Addresses bug 2000; bugfix on 0.0.8pre2.
|
2010-11-16 07:12:32 +01:00
|
|
|
- When AllowSingleHopExits is set, print a warning to explain to the
|
|
|
|
|
relay operator why most clients are avoiding her relay.
|
2010-11-10 03:50:30 +01:00
|
|
|
- Update to the November 1 2010 Maxmind GeoLite Country database.
|
|
|
|
|
|
|
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- When we fixed bug 1038 we had to put in a restriction not to send
|
2010-11-16 07:12:32 +01:00
|
|
|
RELAY_EARLY cells on rend circuits. This was necessary as long
|
|
|
|
|
as relays using Tor 0.2.1.3-alpha through 0.2.1.18-alpha were
|
|
|
|
|
active. Now remove this obsolete check. Resolves bug 2081.
|
2010-11-16 05:54:20 +01:00
|
|
|
- Some options used different conventions for uppercasing of acronyms
|
|
|
|
|
when comparing manpage and source. Fix those in favor of the
|
|
|
|
|
manpage, as it makes sense to capitalize acronyms.
|
|
|
|
|
- Remove the torrc.complete file. It hasn't been kept up to date
|
|
|
|
|
and users will have better luck checking out the manpage.
|
2010-11-16 07:12:32 +01:00
|
|
|
- Remove the obsolete "NoPublish" option; it has been flagged
|
2010-11-16 05:54:20 +01:00
|
|
|
as obsolete and has produced a warning since 0.1.1.18-rc.
|
|
|
|
|
- Remove everything related to building the expert bundle for OS X.
|
|
|
|
|
It has confused many users, doesn't work right on OS X 10.6,
|
|
|
|
|
and is hard to get rid of once installed. Resolves bug 1274.
|
2010-11-10 03:50:30 +01:00
|
|
|
|
|
|
|
|
|
2010-09-30 23:32:17 +02:00
|
|
|
Changes in version 0.2.2.17-alpha - 2010-09-30
|
2010-10-01 10:53:23 +02:00
|
|
|
Tor 0.2.2.17-alpha introduces a feature to make it harder for clients
|
|
|
|
|
to use one-hop circuits (which can put the exit relays at higher risk,
|
|
|
|
|
plus unbalance the network); fixes a big bug in bandwidth accounting
|
|
|
|
|
for relays that want to limit their monthly bandwidth use; fixes a
|
|
|
|
|
big pile of bugs in how clients tolerate temporary network failure;
|
|
|
|
|
and makes our adaptive circuit build timeout feature (which improves
|
|
|
|
|
client performance if your network is fast while not breaking things
|
|
|
|
|
if your network is slow) better handle bad networks.
|
|
|
|
|
|
2010-09-30 23:32:17 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Exit relays now try harder to block exit attempts from unknown
|
|
|
|
|
relays, to make it harder for people to use them as one-hop proxies
|
|
|
|
|
a la tortunnel. Controlled by the refuseunknownexits consensus
|
|
|
|
|
parameter (currently enabled), or you can override it on your
|
2010-09-30 23:49:11 +02:00
|
|
|
relay with the RefuseUnknownExits torrc option. Resolves bug 1751.
|
2010-09-30 23:32:17 +02:00
|
|
|
|
|
|
|
|
o Major bugfixes (0.2.1.x and earlier):
|
|
|
|
|
- Fix a bug in bandwidth accounting that could make us use twice
|
|
|
|
|
the intended bandwidth when our interval start changes due to
|
|
|
|
|
daylight saving time. Now we tolerate skew in stored vs computed
|
|
|
|
|
interval starts: if the start of the period changes by no more than
|
|
|
|
|
50% of the period's duration, we remember bytes that we transferred
|
|
|
|
|
in the old period. Fixes bug 1511; bugfix on 0.0.9pre5.
|
|
|
|
|
- Always search the Windows system directory for system DLLs, and
|
|
|
|
|
nowhere else. Bugfix on 0.1.1.23; fixes bug 1954.
|
|
|
|
|
- When you're using bridges and your network goes away and your
|
|
|
|
|
bridges get marked as down, recover when you attempt a new socks
|
|
|
|
|
connection (if the network is back), rather than waiting up to an
|
|
|
|
|
hour to try fetching new descriptors for your bridges. Bugfix on
|
|
|
|
|
0.2.0.3-alpha; fixes bug 1981.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (on 0.2.2.x):
|
|
|
|
|
- Fix compilation on Windows. Bugfix on 0.2.2.16-alpha; related to
|
|
|
|
|
bug 1797.
|
|
|
|
|
- Fix a segfault that could happen when operating a bridge relay with
|
|
|
|
|
no GeoIP database set. Fixes bug 1964; bugfix on 0.2.2.15-alpha.
|
|
|
|
|
- The consensus bandwidth-weights (used by clients to choose fast
|
|
|
|
|
relays) entered an unexpected edge case in September where
|
|
|
|
|
Exits were much scarcer than Guards, resulting in bad weight
|
|
|
|
|
recommendations. Now we compute them using new constraints that
|
|
|
|
|
should succeed in all cases. Also alter directory authorities to
|
|
|
|
|
not include the bandwidth-weights line if they fail to produce
|
|
|
|
|
valid values. Fixes bug 1952; bugfix on 0.2.2.10-alpha.
|
|
|
|
|
- When weighting bridges during path selection, we used to trust
|
|
|
|
|
the bandwidths they provided in their descriptor, only capping them
|
|
|
|
|
at 10MB/s. This turned out to be problematic for two reasons:
|
|
|
|
|
Bridges could claim to handle a lot more traffic then they
|
|
|
|
|
actually would, thus making more clients pick them and have a
|
|
|
|
|
pretty effective DoS attack. The other issue is that new bridges
|
|
|
|
|
that might not have a good estimate for their bw capacity yet
|
|
|
|
|
would not get used at all unless no other bridges are available
|
|
|
|
|
to a client. Fixes bug 1912; bugfix on 0.2.2.7-alpha.
|
|
|
|
|
|
2010-10-01 10:53:23 +02:00
|
|
|
o Major bugfixes (on the circuit build timeout feature, 0.2.2.x):
|
|
|
|
|
- Ignore cannibalized circuits when recording circuit build times.
|
|
|
|
|
This should provide for a minor performance improvement for hidden
|
|
|
|
|
service users using 0.2.2.14-alpha, and should remove two spurious
|
|
|
|
|
notice log messages. Bugfix on 0.2.2.14-alpha; fixes bug 1740.
|
|
|
|
|
- Simplify the logic that causes us to decide if the network is
|
|
|
|
|
unavailable for purposes of recording circuit build times. If we
|
|
|
|
|
receive no cells whatsoever for the entire duration of a circuit's
|
|
|
|
|
full measured lifetime, the network is probably down. Also ignore
|
|
|
|
|
one-hop directory fetching circuit timeouts when calculating our
|
|
|
|
|
circuit build times. These changes should hopefully reduce the
|
|
|
|
|
cases where we see ridiculous circuit build timeouts for people
|
|
|
|
|
with spotty wireless connections. Fixes part of bug 1772; bugfix
|
|
|
|
|
on 0.2.2.2-alpha.
|
|
|
|
|
- Prevent the circuit build timeout from becoming larger than
|
|
|
|
|
the maximum build time we have ever seen. Also, prevent the time
|
|
|
|
|
period for measurement circuits from becoming larger than twice that
|
|
|
|
|
value. Fixes the other part of bug 1772; bugfix on 0.2.2.2-alpha.
|
|
|
|
|
|
2010-09-30 23:32:17 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- When we run out of directory information such that we can't build
|
|
|
|
|
circuits, but then get enough that we can build circuits, log when
|
|
|
|
|
we actually construct a circuit, so the user has a better chance of
|
|
|
|
|
knowing what's going on. Fixes bug 1362.
|
|
|
|
|
- Be more generous with how much bandwidth we'd use up (with
|
|
|
|
|
accounting enabled) before entering "soft hibernation". Previously,
|
|
|
|
|
we'd refuse new connections and circuits once we'd used up 95% of
|
|
|
|
|
our allotment. Now, we use up 95% of our allotment, AND make sure
|
|
|
|
|
that we have no more than 500MB (or 3 hours of expected traffic,
|
|
|
|
|
whichever is lower) remaining before we enter soft hibernation.
|
|
|
|
|
- If we've configured EntryNodes and our network goes away and/or all
|
|
|
|
|
our entrynodes get marked down, optimistically retry them all when
|
|
|
|
|
a new socks application request appears. Fixes bug 1882.
|
|
|
|
|
- Add some more defensive programming for architectures that can't
|
|
|
|
|
handle unaligned integer accesses. We don't know of any actual bugs
|
|
|
|
|
right now, but that's the best time to fix them. Fixes bug 1943.
|
|
|
|
|
- Support line continuations in the torrc config file. If a line
|
|
|
|
|
ends with a single backslash character, the newline is ignored, and
|
|
|
|
|
the configuration value is treated as continuing on the next line.
|
|
|
|
|
Resolves bug 1929.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.1.x and earlier):
|
|
|
|
|
- For bandwidth accounting, calculate our expected bandwidth rate
|
|
|
|
|
based on the time during which we were active and not in
|
|
|
|
|
soft-hibernation during the last interval. Previously, we were
|
|
|
|
|
also considering the time spent in soft-hibernation. If this
|
|
|
|
|
was a long time, we would wind up underestimating our bandwidth
|
|
|
|
|
by a lot, and skewing our wakeup time towards the start of the
|
|
|
|
|
accounting interval. Fixes bug 1789. Bugfix on 0.0.9pre5.
|
|
|
|
|
|
2010-10-01 10:53:23 +02:00
|
|
|
o Minor bugfixes (on 0.2.2.x):
|
2010-09-30 23:32:17 +02:00
|
|
|
- Resume generating CIRC FAILED REASON=TIMEOUT control port messages,
|
|
|
|
|
which were disabled by the circuit build timeout changes in
|
|
|
|
|
0.2.2.14-alpha. Bugfix on 0.2.2.14-alpha; fixes bug 1739.
|
|
|
|
|
- Make sure we don't warn about missing bandwidth weights when
|
|
|
|
|
choosing bridges or other relays not in the consensus. Bugfix on
|
|
|
|
|
0.2.2.10-alpha; fixes bug 1805.
|
|
|
|
|
- In our logs, do not double-report signatures from unrecognized
|
|
|
|
|
authorities both as "from unknown authority" and "not
|
|
|
|
|
present". Fixes bug 1956, bugfix on 0.2.2.16-alpha.
|
2010-09-17 11:07:59 +02:00
|
|
|
|
|
|
|
|
|
2010-09-17 08:06:34 +02:00
|
|
|
Changes in version 0.2.2.16-alpha - 2010-09-17
|
2010-10-01 10:53:23 +02:00
|
|
|
Tor 0.2.2.16-alpha fixes a variety of old stream fairness bugs (most
|
|
|
|
|
evident at exit relays), and also continues to resolve all the little
|
|
|
|
|
bugs that have been filling up trac lately.
|
|
|
|
|
|
2010-09-13 11:51:49 +02:00
|
|
|
o Major bugfixes (stream-level fairness):
|
2010-09-16 19:45:54 +02:00
|
|
|
- When receiving a circuit-level SENDME for a blocked circuit, try
|
|
|
|
|
to package cells fairly from all the streams that had previously
|
|
|
|
|
been blocked on that circuit. Previously, we had started with the
|
|
|
|
|
oldest stream, and allowed each stream to potentially exhaust
|
|
|
|
|
the circuit's package window. This gave older streams on any
|
|
|
|
|
given circuit priority over newer ones. Fixes bug 1937. Detected
|
|
|
|
|
originally by Camilo Viecco. This bug was introduced before the
|
|
|
|
|
first Tor release, in svn commit r152: it is the new winner of
|
|
|
|
|
the longest-lived bug prize.
|
2010-09-13 11:51:49 +02:00
|
|
|
- When the exit relay got a circuit-level sendme cell, it started
|
|
|
|
|
reading on the exit streams, even if had 500 cells queued in the
|
|
|
|
|
circuit queue already, so the circuit queue just grew and grew in
|
|
|
|
|
some cases. We fix this by not re-enabling reading on receipt of a
|
|
|
|
|
sendme cell when the cell queue is blocked. Fixes bug 1653. Bugfix
|
|
|
|
|
on 0.2.0.1-alpha. Detected by Mashael AlSabah. Original patch by
|
|
|
|
|
"yetonetime".
|
|
|
|
|
- Newly created streams were allowed to read cells onto circuits,
|
|
|
|
|
even if the circuit's cell queue was blocked and waiting to drain.
|
|
|
|
|
This created potential unfairness, as older streams would be
|
|
|
|
|
blocked, but newer streams would gladly fill the queue completely.
|
|
|
|
|
We add code to detect this situation and prevent any stream from
|
|
|
|
|
getting more than one free cell. Bugfix on 0.2.0.1-alpha. Partially
|
|
|
|
|
fixes bug 1298.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the September 1 2010 Maxmind GeoLite Country database.
|
|
|
|
|
- Warn when CookieAuthFileGroupReadable is set but CookieAuthFile is
|
|
|
|
|
not. This would lead to a cookie that is still not group readable.
|
|
|
|
|
Closes bug 1843. Suggested by katmagic.
|
|
|
|
|
- When logging a rate-limited warning, we now mention how many messages
|
|
|
|
|
got suppressed since the last warning.
|
2010-09-16 19:45:54 +02:00
|
|
|
- Add new "perconnbwrate" and "perconnbwburst" consensus params to
|
|
|
|
|
do individual connection-level rate limiting of clients. The torrc
|
|
|
|
|
config options with the same names trump the consensus params, if
|
|
|
|
|
both are present. Replaces the old "bwconnrate" and "bwconnburst"
|
|
|
|
|
consensus params which were broken from 0.2.2.7-alpha through
|
|
|
|
|
0.2.2.14-alpha. Closes bug 1947.
|
|
|
|
|
- When a router changes IP address or port, authorities now launch
|
|
|
|
|
a new reachability test for it. Implements ticket 1899.
|
|
|
|
|
- Make the formerly ugly "2 unknown, 7 missing key, 0 good, 0 bad,
|
|
|
|
|
2 no signature, 4 required" messages about consensus signatures
|
|
|
|
|
easier to read, and make sure they get logged at the same severity
|
|
|
|
|
as the messages explaining which keys are which. Fixes bug 1290.
|
|
|
|
|
- Don't warn when we have a consensus that we can't verify because
|
|
|
|
|
of missing certificates, unless those certificates are ones
|
|
|
|
|
that we have been trying and failing to download. Fixes bug 1145.
|
|
|
|
|
- If you configure your bridge with a known identity fingerprint,
|
|
|
|
|
and the bridge authority is unreachable (as it is in at least
|
|
|
|
|
one country now), fall back to directly requesting the descriptor
|
|
|
|
|
from the bridge. Finishes the feature started in 0.2.0.10-alpha;
|
|
|
|
|
closes bug 1138.
|
|
|
|
|
- When building with --enable-gcc-warnings on OpenBSD, disable
|
|
|
|
|
warnings in system headers. This makes --enable-gcc-warnings
|
|
|
|
|
pass on OpenBSD 4.8.
|
2010-09-13 11:51:49 +02:00
|
|
|
|
2010-09-16 19:45:54 +02:00
|
|
|
o Minor bugfixes (on 0.2.1.x and earlier):
|
2010-09-13 11:51:49 +02:00
|
|
|
- Authorities will now attempt to download consensuses if their
|
|
|
|
|
own efforts to make a live consensus have failed. This change
|
|
|
|
|
means authorities that restart will fetch a valid consensus, and
|
|
|
|
|
it means authorities that didn't agree with the current consensus
|
|
|
|
|
will still fetch and serve it if it has enough signatures. Bugfix
|
|
|
|
|
on 0.2.0.9-alpha; fixes bug 1300.
|
|
|
|
|
- Ensure DNS requests launched by "RESOLVE" commands from the
|
|
|
|
|
controller respect the __LeaveStreamsUnattached setconf options. The
|
|
|
|
|
same goes for requests launched via DNSPort or transparent
|
|
|
|
|
proxying. Bugfix on 0.2.0.1-alpha; fixes bug 1525.
|
|
|
|
|
- Allow handshaking OR connections to take a full KeepalivePeriod
|
|
|
|
|
seconds to handshake. Previously, we would close them after
|
|
|
|
|
IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
|
|
|
|
|
were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
|
|
|
|
|
for analysis help.
|
|
|
|
|
- Rate-limit "Failed to hand off onionskin" warnings.
|
2010-09-16 19:45:54 +02:00
|
|
|
- Never relay a cell for a circuit we have already destroyed.
|
|
|
|
|
Between marking a circuit as closeable and finally closing it,
|
|
|
|
|
it may have been possible for a few queued cells to get relayed,
|
|
|
|
|
even though they would have been immediately dropped by the next
|
|
|
|
|
OR in the circuit. Fixes bug 1184; bugfix on 0.2.0.1-alpha.
|
|
|
|
|
- Never queue a cell for a circuit that's already been marked
|
|
|
|
|
for close.
|
|
|
|
|
- Never vote for a server as "Running" if we have a descriptor for
|
|
|
|
|
it claiming to be hibernating, and that descriptor was published
|
|
|
|
|
more recently than our last contact with the server. Bugfix on
|
|
|
|
|
0.2.0.3-alpha; fixes bug 911.
|
|
|
|
|
- Squash a compile warning on OpenBSD. Reported by Tas; fixes
|
|
|
|
|
bug 1848.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.2.x):
|
|
|
|
|
- Fix a regression introduced in 0.2.2.7-alpha that marked relays
|
|
|
|
|
down if a directory fetch fails and you've configured either
|
|
|
|
|
bridges or EntryNodes. The intent was to mark the relay as down
|
|
|
|
|
_unless_ you're using bridges or EntryNodes, since if you are
|
|
|
|
|
then you could quickly run out of entry points.
|
2010-09-13 11:51:49 +02:00
|
|
|
- Fix the Windows directory-listing code. A bug introduced in
|
|
|
|
|
0.2.2.14-alpha could make Windows directory servers forget to load
|
|
|
|
|
some of their cached v2 networkstatus files.
|
2010-09-16 19:45:54 +02:00
|
|
|
- Really allow clients to use relays as bridges. Fixes bug 1776;
|
|
|
|
|
bugfix on 0.2.2.15-alpha.
|
|
|
|
|
- Demote a warn to info that happens when the CellStatistics option
|
|
|
|
|
was just enabled. Bugfix on 0.2.2.15-alpha; fixes bug 1921.
|
|
|
|
|
Reported by Moritz Bartl.
|
2010-09-13 11:51:49 +02:00
|
|
|
- On Windows, build correctly either with or without Unicode support.
|
|
|
|
|
This is necessary so that Tor can support fringe platforms like
|
|
|
|
|
Windows 98 (which has no Unicode), or Windows CE (which has no
|
2010-09-16 19:45:54 +02:00
|
|
|
non-Unicode). Bugfix on 0.2.2.14-alpha; fixes bug 1797.
|
2010-09-13 11:51:49 +02:00
|
|
|
|
|
|
|
|
o Testing
|
|
|
|
|
- Add a unit test for cross-platform directory-listing code.
|
|
|
|
|
|
|
|
|
|
|
2010-08-18 22:42:15 +02:00
|
|
|
Changes in version 0.2.2.15-alpha - 2010-08-18
|
2010-10-01 10:53:23 +02:00
|
|
|
Tor 0.2.2.15-alpha fixes a big bug in hidden service availability,
|
|
|
|
|
fixes a variety of other bugs that were preventing performance
|
|
|
|
|
experiments from moving forward, fixes several bothersome memory leaks,
|
|
|
|
|
and generally closes a lot of smaller bugs that have been filling up
|
|
|
|
|
trac lately.
|
|
|
|
|
|
2010-07-21 15:28:34 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop assigning the HSDir flag to relays that disable their
|
|
|
|
|
DirPort (and thus will refuse to answer directory requests). This
|
|
|
|
|
fix should dramatically improve the reachability of hidden services:
|
2010-08-16 08:02:11 +02:00
|
|
|
hidden services and hidden service clients pick six HSDir relays
|
2010-07-21 15:28:34 +02:00
|
|
|
to store and retrieve the hidden service descriptor, and currently
|
|
|
|
|
about half of the HSDir relays will refuse to work. Bugfix on
|
|
|
|
|
0.2.0.10-alpha; fixes part of bug 1693.
|
2010-08-16 08:02:11 +02:00
|
|
|
- The PerConnBWRate and Burst config options, along with the
|
|
|
|
|
bwconnrate and bwconnburst consensus params, initialized each conn's
|
|
|
|
|
token bucket values only when the connection is established. Now we
|
|
|
|
|
update them if the config options change, and update them every time
|
|
|
|
|
we get a new consensus. Otherwise we can encounter an ugly edge
|
|
|
|
|
case where we initialize an OR conn to client-level bandwidth,
|
|
|
|
|
but then later the relay joins the consensus and we leave it
|
|
|
|
|
throttled. Bugfix on 0.2.2.7-alpha; fixes bug 1830.
|
|
|
|
|
- Fix a regression that caused Tor to rebind its ports if it receives
|
|
|
|
|
SIGHUP while hibernating. Bugfix in 0.1.1.6-alpha; closes bug 919.
|
2010-07-21 15:28:34 +02:00
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Lower the maximum weighted-fractional-uptime cutoff to 98%. This
|
|
|
|
|
should give us approximately 40-50% more Guard-flagged nodes,
|
|
|
|
|
improving the anonymity the Tor network can provide and also
|
|
|
|
|
decreasing the dropoff in throughput that relays experience when
|
|
|
|
|
they first get the Guard flag.
|
2010-08-11 07:51:41 +02:00
|
|
|
- Allow enabling or disabling the *Statistics config options while
|
|
|
|
|
Tor is running.
|
2010-07-21 15:28:34 +02:00
|
|
|
|
|
|
|
|
o Minor features:
|
2010-08-11 07:51:41 +02:00
|
|
|
- Update to the August 1 2010 Maxmind GeoLite Country database.
|
2010-07-21 15:28:34 +02:00
|
|
|
- Have the controller interface give a more useful message than
|
|
|
|
|
"Internal Error" in response to failed GETINFO requests.
|
2010-08-11 07:51:41 +02:00
|
|
|
- Warn when the same option is provided more than once in a torrc
|
|
|
|
|
file, on the command line, or in a single SETCONF statement, and
|
|
|
|
|
the option is one that only accepts a single line. Closes bug 1384.
|
|
|
|
|
- Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
|
|
|
|
|
Patch from mingw-san.
|
|
|
|
|
- Add support for the country code "{??}" in torrc options like
|
|
|
|
|
ExcludeNodes, to indicate all routers of unknown country. Closes
|
|
|
|
|
bug 1094.
|
2010-08-18 22:42:15 +02:00
|
|
|
- Relays report the number of bytes spent on answering directory
|
|
|
|
|
requests in extra-info descriptors similar to {read,write}-history.
|
|
|
|
|
Implements enhancement 1790.
|
2010-07-21 15:28:34 +02:00
|
|
|
|
2010-08-11 07:51:41 +02:00
|
|
|
o Minor bugfixes (on 0.2.1.x and earlier):
|
|
|
|
|
- Complain if PublishServerDescriptor is given multiple arguments that
|
2010-08-16 08:02:11 +02:00
|
|
|
include 0 or 1. This configuration will be rejected in the future.
|
2010-08-11 07:51:41 +02:00
|
|
|
Bugfix on 0.2.0.1-alpha; closes bug 1107.
|
2010-08-16 08:02:11 +02:00
|
|
|
- Disallow BridgeRelay 1 and ORPort 0 at once in the configuration.
|
|
|
|
|
Bugfix on 0.2.0.13-alpha; closes bug 928.
|
2010-08-11 07:51:41 +02:00
|
|
|
- Change "Application request when we're believed to be offline."
|
|
|
|
|
notice to "Application request when we haven't used client
|
|
|
|
|
functionality lately.", to clarify that it's not an error. Bugfix
|
|
|
|
|
on 0.0.9.3; fixes bug 1222.
|
|
|
|
|
- Fix a bug in the controller interface where "GETINFO ns/asdaskljkl"
|
|
|
|
|
would return "551 Internal error" rather than "552 Unrecognized key
|
|
|
|
|
ns/asdaskljkl". Bugfix on 0.1.2.3-alpha.
|
2010-08-18 22:11:55 +02:00
|
|
|
- Users can't configure a regular relay to be their bridge. It didn't
|
|
|
|
|
work because when Tor fetched the bridge descriptor, it found
|
|
|
|
|
that it already had it, and didn't realize that the purpose of the
|
|
|
|
|
descriptor had changed. Now we replace routers with a purpose other
|
|
|
|
|
than bridge with bridge descriptors when fetching them. Bugfix on
|
|
|
|
|
0.1.1.9-alpha. Bug 1776 not yet fixed because now we immediately
|
|
|
|
|
refetch the descriptor with router purpose 'general', disabling
|
|
|
|
|
it as a bridge.
|
2010-08-11 08:11:05 +02:00
|
|
|
- Fix a rare bug in rend_fn unit tests: we would fail a test when
|
|
|
|
|
a randomly generated port is 0. Diagnosed by Matt Edman. Bugfix
|
|
|
|
|
on 0.2.0.10-alpha; fixes bug 1808.
|
2010-08-16 08:02:11 +02:00
|
|
|
- Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
|
2010-08-18 19:50:47 +02:00
|
|
|
and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
|
|
|
|
|
stream ending reason for this case: END_STREAM_REASON_NOROUTE.
|
|
|
|
|
Servers can start sending this code when enough clients recognize
|
|
|
|
|
it. Also update the spec to reflect this new reason. Bugfix on
|
2010-08-19 01:16:02 +02:00
|
|
|
0.1.0.1-rc; fixes part of bug 1793.
|
2010-08-18 22:42:15 +02:00
|
|
|
- Delay geoip stats collection by bridges for 6 hours, not 2 hours,
|
|
|
|
|
when we switch from being a public relay to a bridge. Otherwise
|
|
|
|
|
there will still be clients that see the relay in their consensus,
|
|
|
|
|
and the stats will end up wrong. Bugfix on 0.2.1.15-rc; fixes bug
|
|
|
|
|
932 even more.
|
2010-08-16 08:02:11 +02:00
|
|
|
- Instead of giving an assertion failure on an internal mismatch
|
|
|
|
|
on estimated freelist size, just log a BUG warning and try later.
|
|
|
|
|
Mitigates but does not fix bug 1125.
|
2010-08-18 22:42:15 +02:00
|
|
|
- Fix an assertion failure that could occur in caches or bridge users
|
|
|
|
|
when using a very short voting interval on a testing network.
|
|
|
|
|
Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on 0.2.0.8-alpha.
|
2010-08-11 07:51:41 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.2.x):
|
2010-07-21 15:28:34 +02:00
|
|
|
- Alter directory authorities to always consider Exit-flagged nodes
|
|
|
|
|
as potential Guard nodes in their votes. The actual decision to
|
|
|
|
|
use Exits as Guards is done in the consensus bandwidth weights.
|
|
|
|
|
Fixes bug 1294; bugfix on 0.2.2.10-alpha.
|
|
|
|
|
- When the controller is reporting the purpose of circuits that
|
|
|
|
|
didn't finish building before the circuit build timeout, it was
|
|
|
|
|
printing UNKNOWN_13. Now print EXPIRED. Bugfix on 0.2.2.14-alpha.
|
2010-08-11 07:51:41 +02:00
|
|
|
- Our libevent version parsing code couldn't handle versions like
|
|
|
|
|
1.4.14b-stable and incorrectly warned the user about using an
|
|
|
|
|
old and broken version of libevent. Treat 1.4.14b-stable like
|
|
|
|
|
1.4.14-stable when parsing the version. Fixes bug 1731; bugfix
|
|
|
|
|
on 0.2.2.1-alpha.
|
2010-08-13 23:19:04 +02:00
|
|
|
- Don't use substitution references like $(VAR:MOD) when
|
|
|
|
|
$(asciidoc_files) is empty -- make(1) on NetBSD transforms
|
|
|
|
|
'$(:x)' to 'x' rather than the empty string. This bites us in
|
|
|
|
|
doc/ when configured with --disable-asciidoc. Bugfix on
|
|
|
|
|
0.2.2.9-alpha; fixes bug 1773.
|
2010-08-19 01:16:02 +02:00
|
|
|
- Remove a spurious hidden service server-side log notice about
|
2010-08-16 08:02:11 +02:00
|
|
|
"Ancient non-dirty circuits". Bugfix on 0.2.2.14-alpha; fixes
|
|
|
|
|
bug 1741.
|
|
|
|
|
- Fix compilation with --with-dmalloc set. Bugfix on 0.2.2.6-alpha;
|
|
|
|
|
fixes bug 1832.
|
2010-08-18 22:42:15 +02:00
|
|
|
- Correctly report written bytes on linked connections. Found while
|
|
|
|
|
implementing 1790. Bugfix on 0.2.2.4-alpha.
|
2010-08-16 08:02:11 +02:00
|
|
|
- Fix three memory leaks: one in circuit_build_times_parse_state(),
|
|
|
|
|
one in dirvote_add_signatures_to_pending_consensus(), and one every
|
|
|
|
|
time we parse a v3 network consensus. Bugfixes on 0.2.2.14-alpha,
|
|
|
|
|
0.2.2.6-alpha, and 0.2.2.10-alpha respectively; fixes bug 1831.
|
2010-07-13 21:48:03 +02:00
|
|
|
|
2010-08-18 22:42:15 +02:00
|
|
|
o Code simplifications and refactoring:
|
2010-08-19 01:16:02 +02:00
|
|
|
- Take a first step towards making or.h smaller by splitting out
|
|
|
|
|
function definitions for all source files in src/or/. Leave
|
|
|
|
|
structures and defines in or.h for now.
|
2010-08-18 22:42:15 +02:00
|
|
|
- Remove a bunch of unused function declarations as well as a block of
|
|
|
|
|
#if 0'd code from the unit tests. Closes bug 1824.
|
2010-08-19 01:16:02 +02:00
|
|
|
- New unit tests for exit-port history statistics; refactored exit
|
|
|
|
|
statistics code to be more easily tested.
|
|
|
|
|
- Remove the old debian/ directory from the main Tor distribution.
|
|
|
|
|
The official Tor-for-debian git repository lives at the URL
|
|
|
|
|
https://git.torproject.org/debian/tor.git
|
2010-08-18 22:42:15 +02:00
|
|
|
|
2010-07-13 21:48:03 +02:00
|
|
|
|
2010-07-12 22:46:28 +02:00
|
|
|
Changes in version 0.2.2.14-alpha - 2010-07-12
|
2010-07-13 21:50:24 +02:00
|
|
|
Tor 0.2.2.14-alpha greatly improves client-side handling of
|
|
|
|
|
circuit build timeouts, which are used to estimate speed and improve
|
|
|
|
|
performance. We also move to a much better GeoIP database, port Tor to
|
|
|
|
|
Windows CE, introduce new compile flags that improve code security,
|
|
|
|
|
add an eighth v3 directory authority, and address a lot of more
|
|
|
|
|
minor issues.
|
|
|
|
|
|
2010-06-30 00:40:08 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Tor directory authorities no longer crash when started with a
|
2010-07-09 20:07:54 +02:00
|
|
|
cached-microdesc-consensus file in their data directory. Bugfix
|
|
|
|
|
on 0.2.2.6-alpha; fixes bug 1532.
|
2010-06-30 00:40:08 +02:00
|
|
|
- Treat an unset $HOME like an empty $HOME rather than triggering an
|
2010-07-09 20:07:54 +02:00
|
|
|
assert. Bugfix on 0.0.8pre1; fixes bug 1522.
|
|
|
|
|
- Ignore negative and large circuit build timeout values that can
|
|
|
|
|
happen during a suspend or hibernate. These values caused various
|
|
|
|
|
asserts to fire. Bugfix on 0.2.2.2-alpha; fixes bug 1245.
|
|
|
|
|
- Alter calculation of Pareto distribution parameter 'Xm' for
|
2010-07-12 22:46:28 +02:00
|
|
|
Circuit Build Timeout learning to use the weighted average of the
|
|
|
|
|
top N=3 modes (because we have three entry guards). Considering
|
|
|
|
|
multiple modes should improve the timeout calculation in some cases,
|
|
|
|
|
and prevent extremely high timeout values. Bugfix on 0.2.2.2-alpha;
|
|
|
|
|
fixes bug 1335.
|
2010-07-09 20:07:54 +02:00
|
|
|
- Alter calculation of Pareto distribution parameter 'Alpha' to use a
|
2010-07-12 22:46:28 +02:00
|
|
|
right censored distribution model. This approach improves over the
|
|
|
|
|
synthetic timeout generation approach that was producing insanely
|
|
|
|
|
high timeout values. Now we calculate build timeouts using truncated
|
|
|
|
|
times. Bugfix on 0.2.2.2-alpha; fixes bugs 1245 and 1335.
|
|
|
|
|
- Do not close circuits that are under construction when they reach
|
|
|
|
|
the circuit build timeout. Instead, leave them building (but do not
|
|
|
|
|
use them) for up until the time corresponding to the 95th percentile
|
2010-07-09 20:07:54 +02:00
|
|
|
on the Pareto CDF or 60 seconds, whichever is greater. This is done
|
|
|
|
|
to provide better data for the new Pareto model. This percentile
|
|
|
|
|
can be controlled by the consensus.
|
2010-06-30 00:40:08 +02:00
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Move to the June 2010 Maxmind GeoLite country db (rather than the
|
|
|
|
|
June 2009 ip-to-country GeoIP db) for our statistics that count
|
|
|
|
|
how many users relays are seeing from each country. Now we have
|
|
|
|
|
more accurate data for many African countries.
|
|
|
|
|
- Port Tor to build and run correctly on Windows CE systems, using
|
|
|
|
|
the wcecompat library. Contributed by Valerio Lupi.
|
2010-07-12 22:46:28 +02:00
|
|
|
- New "--enable-gcc-hardening" ./configure flag (off by default)
|
|
|
|
|
to turn on gcc compile time hardening options. It ensures
|
|
|
|
|
that signed ints have defined behavior (-fwrapv), enables
|
|
|
|
|
-D_FORTIFY_SOURCE=2 (requiring -O2), adds stack smashing protection
|
|
|
|
|
with canaries (-fstack-protector-all), turns on ASLR protection if
|
|
|
|
|
supported by the kernel (-fPIE, -pie), and adds additional security
|
|
|
|
|
related warnings. Verified to work on Mac OS X and Debian Lenny.
|
|
|
|
|
- New "--enable-linker-hardening" ./configure flag (off by default)
|
|
|
|
|
to turn on ELF specific hardening features (relro, now). This does
|
|
|
|
|
not work with Mac OS X or any other non-ELF binary format.
|
2010-06-30 00:40:08 +02:00
|
|
|
|
|
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- New config option "WarnUnsafeSocks 0" disables the warning that
|
|
|
|
|
occurs whenever Tor receives only an IP address instead of a
|
|
|
|
|
hostname. Setups that do DNS locally over Tor are fine, and we
|
|
|
|
|
shouldn't spam the logs in that case.
|
|
|
|
|
- Convert the HACKING file to asciidoc, and add a few new sections
|
|
|
|
|
to it, explaining how we use Git, how we make changelogs, and
|
|
|
|
|
what should go in a patch.
|
2010-07-09 20:07:54 +02:00
|
|
|
- Add a TIMEOUT_RATE keyword to the BUILDTIMEOUT_SET control port
|
|
|
|
|
event, to give information on the current rate of circuit timeouts
|
|
|
|
|
over our stored history.
|
|
|
|
|
- Add ability to disable circuit build time learning via consensus
|
|
|
|
|
parameter and via a LearnCircuitBuildTimeout config option. Also
|
|
|
|
|
automatically disable circuit build time calculation if we are
|
|
|
|
|
either a AuthoritativeDirectory, or if we fail to write our state
|
|
|
|
|
file. Fixes bug 1296.
|
|
|
|
|
- More gracefully handle corrupt state files, removing asserts
|
|
|
|
|
in favor of saving a backup and resetting state.
|
2010-07-12 22:46:28 +02:00
|
|
|
- Rename the "log.h" header to "torlog.h" so as to conflict with fewer
|
|
|
|
|
system headers.
|
2010-06-30 00:40:08 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Build correctly on OSX with zlib 1.2.4 and higher with all warnings
|
|
|
|
|
enabled.
|
|
|
|
|
- When a2x fails, mention that the user could disable manpages instead
|
|
|
|
|
of trying to fix their asciidoc installation.
|
|
|
|
|
- Where available, use Libevent 2.0's periodic timers so that our
|
|
|
|
|
once-per-second cleanup code gets called even more closely to
|
|
|
|
|
once per second than it would otherwise. Fixes bug 943.
|
|
|
|
|
- If you run a bridge that listens on multiple IP addresses, and
|
|
|
|
|
some user configures a bridge address that uses a different IP
|
|
|
|
|
address than your bridge writes in its router descriptor, and the
|
|
|
|
|
user doesn't specify an identity key, their Tor would discard the
|
|
|
|
|
descriptor because "it isn't one of our configured bridges", and
|
|
|
|
|
fail to bootstrap. Now believe the descriptor and bootstrap anyway.
|
|
|
|
|
Bugfix on 0.2.0.3-alpha.
|
|
|
|
|
- If OpenSSL fails to make a duplicate of a private or public key, log
|
|
|
|
|
an error message and try to exit cleanly. May help with debugging
|
|
|
|
|
if bug 1209 ever remanifests.
|
|
|
|
|
- Save a couple bytes in memory allocation every time we escape
|
|
|
|
|
certain characters in a string. Patch from Florian Zumbiehl.
|
|
|
|
|
- Make it explicit that we don't cannibalize one-hop circuits. This
|
|
|
|
|
happens in the wild, but doesn't turn out to be a problem because
|
|
|
|
|
we fortunately don't use those circuits. Many thanks to outofwords
|
|
|
|
|
for the initial analysis and to swissknife who confirmed that
|
|
|
|
|
two-hop circuits are actually created.
|
2010-07-09 20:07:54 +02:00
|
|
|
- Make directory mirrors report non-zero dirreq-v[23]-shares again.
|
|
|
|
|
Fixes bug 1564; bugfix on 0.2.2.9-alpha.
|
|
|
|
|
- Eliminate a case where a circuit build time warning was displayed
|
|
|
|
|
after network connectivity resumed. Bugfix on 0.2.2.2-alpha.
|
2010-06-30 00:40:08 +02:00
|
|
|
|
|
|
|
|
|
2010-06-11 22:31:03 +02:00
|
|
|
Changes in version 0.2.1.26 - 2010-05-02
|
|
|
|
|
Tor 0.2.1.26 addresses the recent connection and memory overload
|
|
|
|
|
problems we've been seeing on relays, especially relays with their
|
|
|
|
|
DirPort open. If your relay has been crashing, or you turned it off
|
|
|
|
|
because it used too many resources, give this release a try.
|
|
|
|
|
|
|
|
|
|
This release also fixes yet another instance of broken OpenSSL libraries
|
|
|
|
|
that was causing some relays to drop out of the consensus.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Teach relays to defend themselves from connection overload. Relays
|
|
|
|
|
now close idle circuits early if it looks like they were intended
|
|
|
|
|
for directory fetches. Relays are also more aggressive about closing
|
|
|
|
|
TLS connections that have no circuits on them. Such circuits are
|
|
|
|
|
unlikely to be re-used, and tens of thousands of them were piling
|
|
|
|
|
up at the fast relays, causing the relays to run out of sockets
|
|
|
|
|
and memory. Bugfix on 0.2.0.22-rc (where clients started tunneling
|
|
|
|
|
their directory fetches over TLS).
|
|
|
|
|
- Fix SSL renegotiation behavior on OpenSSL versions like on Centos
|
|
|
|
|
that claim to be earlier than 0.9.8m, but which have in reality
|
|
|
|
|
backported huge swaths of 0.9.8m or 0.9.8n renegotiation
|
|
|
|
|
behavior. Possible fix for some cases of bug 1346.
|
|
|
|
|
- Directory mirrors were fetching relay descriptors only from v2
|
|
|
|
|
directory authorities, rather than v3 authorities like they should.
|
|
|
|
|
Only 2 v2 authorities remain (compared to 7 v3 authorities), leading
|
|
|
|
|
to a serious bottleneck. Bugfix on 0.2.0.9-alpha. Fixes bug 1324.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Finally get rid of the deprecated and now harmful notion of "clique
|
|
|
|
|
mode", where directory authorities maintain TLS connections to
|
|
|
|
|
every other relay.
|
|
|
|
|
|
|
|
|
|
o Testsuite fixes:
|
|
|
|
|
- In the util/threads test, no longer free the test_mutex before all
|
|
|
|
|
worker threads have finished. Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- The master thread could starve the worker threads quite badly on
|
|
|
|
|
certain systems, causing them to run only partially in the allowed
|
|
|
|
|
window. This resulted in test failures. Now the master thread sleeps
|
|
|
|
|
occasionally for a few microseconds while the two worker-threads
|
|
|
|
|
compete for the mutex. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
|
|
|
|
|
|
2010-04-24 02:59:20 +02:00
|
|
|
Changes in version 0.2.2.13-alpha - 2010-04-24
|
2010-05-05 09:12:26 +02:00
|
|
|
Tor 0.2.2.13-alpha addresses the recent connection and memory overload
|
|
|
|
|
problems we've been seeing on relays, especially relays with their
|
|
|
|
|
DirPort open. If your relay has been crashing, or you turned it off
|
|
|
|
|
because it used too many resources, give this release a try.
|
|
|
|
|
|
2010-04-24 02:59:20 +02:00
|
|
|
o Major bugfixes:
|
2010-04-24 11:43:43 +02:00
|
|
|
- Teach relays to defend themselves from connection overload. Relays
|
|
|
|
|
now close idle circuits early if it looks like they were intended
|
|
|
|
|
for directory fetches. Relays are also more aggressive about closing
|
|
|
|
|
TLS connections that have no circuits on them. Such circuits are
|
|
|
|
|
unlikely to be re-used, and tens of thousands of them were piling
|
|
|
|
|
up at the fast relays, causing the relays to run out of sockets
|
|
|
|
|
and memory. Bugfix on 0.2.0.22-rc (where clients started tunneling
|
|
|
|
|
their directory fetches over TLS).
|
2010-04-24 02:59:20 +02:00
|
|
|
|
|
|
|
|
o Minor features:
|
2010-04-24 11:43:43 +02:00
|
|
|
- Finally get rid of the deprecated and now harmful notion of "clique
|
|
|
|
|
mode", where directory authorities maintain TLS connections to
|
|
|
|
|
every other relay.
|
2010-04-24 02:59:20 +02:00
|
|
|
- Directory authorities now do an immediate reachability check as soon
|
|
|
|
|
as they hear about a new relay. This change should slightly reduce
|
|
|
|
|
the time between setting up a relay and getting listed as running
|
|
|
|
|
in the consensus. It should also improve the time between setting
|
|
|
|
|
up a bridge and seeing use by bridge users.
|
|
|
|
|
- Directory authorities no longer launch a TLS connection to every
|
|
|
|
|
relay as they startup. Now that we have 2k+ descriptors cached,
|
|
|
|
|
the resulting network hiccup is becoming a burden. Besides,
|
|
|
|
|
authorities already avoid voting about Running for the first half
|
|
|
|
|
hour of their uptime.
|
|
|
|
|
|
|
|
|
|
|
2010-04-20 09:53:07 +02:00
|
|
|
Changes in version 0.2.2.12-alpha - 2010-04-20
|
2010-04-24 01:42:34 +02:00
|
|
|
Tor 0.2.2.12-alpha fixes a critical bug in how directory authorities
|
|
|
|
|
handle and vote on descriptors. It was causing relays to drop out of
|
|
|
|
|
the consensus.
|
|
|
|
|
|
2010-04-20 09:53:07 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Many relays have been falling out of the consensus lately because
|
|
|
|
|
not enough authorities know about their descriptor for them to get
|
|
|
|
|
a majority of votes. When we deprecated the v2 directory protocol,
|
|
|
|
|
we got rid of the only way that v3 authorities can hear from each
|
|
|
|
|
other about other descriptors. Now authorities examine every v3
|
|
|
|
|
vote for new descriptors, and fetch them from that authority. Bugfix
|
|
|
|
|
on 0.2.1.23.
|
|
|
|
|
- Fix two typos in tor_vasprintf() that broke the compile on Windows,
|
|
|
|
|
and a warning in or.h related to bandwidth_weight_rule_t that
|
|
|
|
|
prevented clean compile on OS X. Fixes bug 1363; bugfix on
|
|
|
|
|
0.2.2.11-alpha.
|
|
|
|
|
- Fix a segfault on relays when DirReqStatistics is enabled
|
|
|
|
|
and 24 hours pass. Bug found by keb. Fixes bug 1365; bugfix on
|
|
|
|
|
0.2.2.11-alpha.
|
2010-04-19 12:09:06 +02:00
|
|
|
|
2010-04-20 09:59:23 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Demote a confusing TLS warning that relay operators might get when
|
|
|
|
|
someone tries to talk to their OrPort. It is neither the operator's
|
|
|
|
|
fault nor can they do anything about it. Fixes bug 1364; bugfix
|
|
|
|
|
on 0.2.0.14-alpha.
|
|
|
|
|
|
2010-04-19 12:09:06 +02:00
|
|
|
|
2010-04-15 16:48:33 +02:00
|
|
|
Changes in version 0.2.2.11-alpha - 2010-04-15
|
2010-04-24 01:42:34 +02:00
|
|
|
Tor 0.2.2.11-alpha fixes yet another instance of broken OpenSSL
|
|
|
|
|
libraries that was causing some relays to drop out of the consensus.
|
|
|
|
|
|
2010-04-15 16:48:33 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Directory mirrors were fetching relay descriptors only from v2
|
|
|
|
|
directory authorities, rather than v3 authorities like they should.
|
|
|
|
|
Only 2 v2 authorities remain (compared to 7 v3 authorities), leading
|
|
|
|
|
to a serious bottleneck. Bugfix on 0.2.0.9-alpha. Fixes bug 1324.
|
|
|
|
|
- Fix a parsing error that made every possible value of
|
|
|
|
|
CircPriorityHalflifeMsec get treated as "1 msec". Bugfix
|
|
|
|
|
on 0.2.2.7-alpha. Rename CircPriorityHalflifeMsec to
|
|
|
|
|
CircuitPriorityHalflifeMsec, so authorities can tell newer relays
|
|
|
|
|
about the option without breaking older ones.
|
2010-04-15 17:02:31 +02:00
|
|
|
- Fix SSL renegotiation behavior on OpenSSL versions like on Centos
|
|
|
|
|
that claim to be earlier than 0.9.8m, but which have in reality
|
|
|
|
|
backported huge swaths of 0.9.8m or 0.9.8n renegotiation
|
|
|
|
|
behavior. Possible fix for some cases of bug 1346.
|
2010-04-15 16:48:33 +02:00
|
|
|
|
2010-03-11 04:43:23 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Experiment with a more aggressive approach to preventing clients
|
|
|
|
|
from making one-hop exit streams. Exit relays who want to try it
|
|
|
|
|
out can set "RefuseUnknownExits 1" in their torrc, and then look
|
|
|
|
|
for "Attempt by %s to open a stream" log messages. Let us know
|
|
|
|
|
how it goes!
|
2010-04-15 16:48:33 +02:00
|
|
|
- Add support for statically linking zlib by specifying
|
|
|
|
|
--enable-static-zlib, to go with our support for statically linking
|
2010-04-15 17:02:31 +02:00
|
|
|
openssl and libevent. Resolves bug 1358.
|
2010-03-11 04:43:23 +01:00
|
|
|
|
2010-03-09 02:40:21 +01:00
|
|
|
o Minor bugfixes:
|
2010-04-15 16:48:33 +02:00
|
|
|
- Fix a segfault that happens whenever a Tor client that is using
|
|
|
|
|
libevent2's bufferevents gets a hup signal. Bugfix on 0.2.2.5-alpha;
|
|
|
|
|
fixes bug 1341.
|
2010-03-09 02:40:21 +01:00
|
|
|
- When we cleaned up the contrib/tor-exit-notice.html file, we left
|
2010-04-02 21:33:38 +02:00
|
|
|
out the first line. Fixes bug 1295.
|
|
|
|
|
- When building the manpage from a tarball, we required asciidoc, but
|
|
|
|
|
the asciidoc -> roff/html conversion was already done for the
|
|
|
|
|
tarball. Make 'make' complain only when we need asciidoc (either
|
|
|
|
|
because we're compiling directly from git, or because we altered
|
|
|
|
|
the asciidoc manpage in the tarball). Bugfix on 0.2.2.9-alpha.
|
|
|
|
|
- When none of the directory authorities vote on any params, Tor
|
|
|
|
|
segfaulted when trying to make the consensus from the votes. We
|
|
|
|
|
didn't trigger the bug in practice, because authorities do include
|
2010-04-15 16:48:33 +02:00
|
|
|
params in their votes. Bugfix on 0.2.2.10-alpha; fixes bug 1322.
|
|
|
|
|
|
|
|
|
|
o Testsuite fixes:
|
|
|
|
|
- In the util/threads test, no longer free the test_mutex before all
|
|
|
|
|
worker threads have finished. Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- The master thread could starve the worker threads quite badly on
|
|
|
|
|
certain systems, causing them to run only partially in the allowed
|
|
|
|
|
window. This resulted in test failures. Now the master thread sleeps
|
|
|
|
|
occasionally for a few microseconds while the two worker-threads
|
|
|
|
|
compete for the mutex. Bugfix on 0.2.0.1-alpha.
|
2010-03-08 06:40:00 +01:00
|
|
|
|
|
|
|
|
|
2010-03-07 06:13:12 +01:00
|
|
|
Changes in version 0.2.2.10-alpha - 2010-03-07
|
2010-03-09 05:09:49 +01:00
|
|
|
Tor 0.2.2.10-alpha fixes a regression introduced in 0.2.2.9-alpha that
|
|
|
|
|
could prevent relays from guessing their IP address correctly. It also
|
|
|
|
|
starts the groundwork for another client-side performance boost, since
|
|
|
|
|
currently we're not making efficient use of relays that have both the
|
|
|
|
|
Guard flag and the Exit flag.
|
|
|
|
|
|
2010-03-07 06:13:12 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a regression from our patch for bug 1244 that caused relays
|
|
|
|
|
to guess their IP address incorrectly if they didn't set Address
|
|
|
|
|
in their torrc and/or their address fails to resolve. Bugfix on
|
|
|
|
|
0.2.2.9-alpha; fixes bug 1269.
|
|
|
|
|
|
2010-02-23 02:04:35 +01:00
|
|
|
o Major features (performance):
|
2010-03-07 06:13:12 +01:00
|
|
|
- Directory authorities now compute consensus weightings that instruct
|
|
|
|
|
clients how to weight relays flagged as Guard, Exit, Guard+Exit,
|
|
|
|
|
and no flag. Clients that use these weightings will distribute
|
|
|
|
|
network load more evenly across these different relay types. The
|
|
|
|
|
weightings are in the consensus so we can change them globally in
|
|
|
|
|
the future. Extra thanks to "outofwords" for finding some nasty
|
|
|
|
|
security bugs in the first implementation of this feature.
|
2010-02-23 02:04:35 +01:00
|
|
|
|
|
|
|
|
o Minor features (performance):
|
2010-03-07 06:13:12 +01:00
|
|
|
- Always perform router selections using weighted relay bandwidth,
|
2010-02-23 02:04:35 +01:00
|
|
|
even if we don't need a high capacity circuit at the time. Non-fast
|
2010-03-07 06:13:12 +01:00
|
|
|
circuits now only differ from fast ones in that they can use relays
|
|
|
|
|
not marked with the Fast flag. This "feature" could turn out to
|
|
|
|
|
be a horrible bug; we should investigate more before it goes into
|
|
|
|
|
a stable release.
|
2010-02-23 02:04:35 +01:00
|
|
|
|
2010-03-01 03:17:48 +01:00
|
|
|
o Minor features:
|
2010-03-07 06:13:12 +01:00
|
|
|
- Allow disabling building of the manpages. Skipping the manpage
|
|
|
|
|
speeds up the build considerably.
|
2010-03-01 03:17:48 +01:00
|
|
|
|
2010-03-07 06:13:12 +01:00
|
|
|
o Minor bugfixes (on 0.2.2.x):
|
2010-02-23 15:02:34 +01:00
|
|
|
- Fix a memleak in the EXTENDCIRCUIT logic. Spotted by coverity.
|
|
|
|
|
Bugfix on 0.2.2.9-alpha.
|
2010-02-25 12:25:57 +01:00
|
|
|
- Disallow values larger than INT32_MAX for PerConnBWRate|Burst
|
|
|
|
|
config option. Bugfix on 0.2.2.7-alpha.
|
2010-02-27 16:27:44 +01:00
|
|
|
- Ship the asciidoc-helper file in the tarball, so that people can
|
|
|
|
|
build from source if they want to, and touching the .1.txt files
|
|
|
|
|
doesn't break the build. Bugfix on 0.2.2.9-alpha.
|
2010-02-23 15:02:34 +01:00
|
|
|
|
2010-03-07 06:13:12 +01:00
|
|
|
o Minor bugfixes (on 0.2.1.x or earlier):
|
|
|
|
|
- Fix a dereference-then-NULL-check sequence when publishing
|
|
|
|
|
descriptors. Bugfix on 0.2.1.5-alpha. Discovered by ekir; fixes
|
|
|
|
|
bug 1255.
|
|
|
|
|
- Fix another dereference-then-NULL-check sequence. Bugfix on
|
|
|
|
|
0.2.1.14-rc. Discovered by ekir; fixes bug 1256.
|
|
|
|
|
- Make sure we treat potentially not NUL-terminated strings correctly.
|
|
|
|
|
Bugfix on 0.1.1.13-alpha. Discovered by rieo; fixes bug 1257.
|
|
|
|
|
|
2010-02-23 19:59:34 +01:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Fix some urls in the exit notice file and make it XHTML1.1 strict
|
|
|
|
|
compliant. Based on a patch from Christian Kujau.
|
2010-02-27 17:06:06 +01:00
|
|
|
- Don't use sed in asciidoc-helper anymore.
|
2010-03-07 06:13:12 +01:00
|
|
|
- Make the build process fail if asciidoc cannot be found and
|
2010-03-01 03:17:48 +01:00
|
|
|
building with asciidoc isn't disabled.
|
2010-02-25 22:22:29 +01:00
|
|
|
|
2010-03-07 06:13:12 +01:00
|
|
|
|
2010-02-22 06:20:55 +01:00
|
|
|
Changes in version 0.2.2.9-alpha - 2010-02-22
|
2010-03-09 05:09:49 +01:00
|
|
|
Tor 0.2.2.9-alpha makes Tor work again on the latest OS X, updates the
|
|
|
|
|
location of a directory authority, and cleans up a bunch of small bugs.
|
|
|
|
|
|
2010-02-22 06:20:55 +01:00
|
|
|
o Directory authority changes:
|
|
|
|
|
- Change IP address for dannenberg (v3 directory authority), and
|
|
|
|
|
remove moria2 (obsolete v1, v2 directory authority and v0 hidden
|
|
|
|
|
service directory authority) from the list.
|
|
|
|
|
|
2010-02-02 14:51:51 +01:00
|
|
|
o Major bugfixes:
|
2010-02-22 06:20:55 +01:00
|
|
|
- Make Tor work again on the latest OS X: when deciding whether to
|
|
|
|
|
use strange flags to turn TLS renegotiation on, detect the OpenSSL
|
|
|
|
|
version at run-time, not compile time. We need to do this because
|
|
|
|
|
Apple doesn't update its dev-tools headers when it updates its
|
|
|
|
|
libraries in a security patch.
|
|
|
|
|
- Fix a potential buffer overflow in lookup_last_hid_serv_request()
|
|
|
|
|
that could happen on 32-bit platforms with 64-bit time_t. Also fix
|
|
|
|
|
a memory leak when requesting a hidden service descriptor we've
|
|
|
|
|
requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found
|
|
|
|
|
by aakova.
|
2010-02-02 14:51:51 +01:00
|
|
|
- Authorities could be tricked into giving out the Exit flag to relays
|
2010-02-22 06:20:55 +01:00
|
|
|
that didn't allow exiting to any ports. This bug could screw
|
|
|
|
|
with load balancing and stats. Bugfix on 0.1.1.6-alpha; fixes bug
|
|
|
|
|
1238. Bug discovered by Martin Kowalczyk.
|
2010-03-07 06:13:12 +01:00
|
|
|
- When freeing a session key, zero it out completely. We only zeroed
|
|
|
|
|
the first ptrsize bytes. Bugfix on 0.0.2pre8. Discovered and
|
|
|
|
|
patched by ekir. Fixes bug 1254.
|
2010-02-02 14:51:51 +01:00
|
|
|
|
2010-01-29 23:02:17 +01:00
|
|
|
o Minor bugfixes:
|
2010-02-02 22:22:12 +01:00
|
|
|
- Fix static compilation by listing the openssl libraries in the right
|
2010-02-22 06:20:55 +01:00
|
|
|
order. Bugfix on Tor 0.2.2.8-alpha; fixes bug 1237.
|
|
|
|
|
- Resume handling .exit hostnames in a special way: originally we
|
|
|
|
|
stripped the .exit part and used the requested exit relay. In
|
|
|
|
|
0.2.2.1-alpha we stopped treating them in any special way, meaning
|
|
|
|
|
if you use a .exit address then Tor will pass it on to the exit
|
|
|
|
|
relay. Now we reject the .exit stream outright, since that behavior
|
|
|
|
|
might be more expected by the user. Found and diagnosed by Scott
|
|
|
|
|
Bennett and Downie on or-talk.
|
|
|
|
|
- Don't spam the controller with events when we have no file
|
|
|
|
|
descriptors available. Bugfix on 0.2.1.5-alpha. (Rate-limiting
|
|
|
|
|
for log messages was already solved from bug 748.)
|
|
|
|
|
- Avoid a bogus overlapped memcpy in tor_addr_copy(). Reported by
|
2010-02-09 19:08:49 +01:00
|
|
|
"memcpyfail".
|
2010-02-19 17:19:33 +01:00
|
|
|
- Make the DNSPort option work with libevent 2.x. Don't alter the
|
|
|
|
|
behaviour for libevent 1.x. Fixes bug 1143. Found by SwissTorExit.
|
2010-02-22 06:20:55 +01:00
|
|
|
- Emit a GUARD DROPPED controller event for a case we missed.
|
|
|
|
|
- Make more fields in the controller protocol case-insensitive, since
|
|
|
|
|
control-spec.txt said they were.
|
|
|
|
|
- Refactor resolve_my_address() to not use gethostbyname() anymore.
|
|
|
|
|
Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik.
|
2010-02-22 07:58:10 +01:00
|
|
|
- Fix a spec conformance issue: the network-status-version token
|
|
|
|
|
must be the first token in a v3 consensus or vote. Discovered by
|
|
|
|
|
parakeep. Bugfix on 0.2.0.3-alpha.
|
2010-01-29 23:02:17 +01:00
|
|
|
|
2010-01-27 19:27:53 +01:00
|
|
|
o Code simplifications and refactoring:
|
2010-02-22 06:20:55 +01:00
|
|
|
- Generate our manpage and HTML documentation using Asciidoc. This
|
|
|
|
|
change should make it easier to maintain the documentation, and
|
|
|
|
|
produce nicer HTML.
|
|
|
|
|
- Remove the --enable-iphone option. According to reports from Marco
|
|
|
|
|
Bonetti, Tor builds fine without any special tweaking on recent
|
|
|
|
|
iPhone SDK versions.
|
2010-02-07 07:39:00 +01:00
|
|
|
- Removed some unnecessary files from the source distribution. The
|
2010-02-22 06:20:55 +01:00
|
|
|
AUTHORS file has now been merged into the people page on the
|
2010-02-07 07:39:00 +01:00
|
|
|
website. The roadmaps and design doc can now be found in the
|
|
|
|
|
projects directory in svn.
|
2010-02-18 18:40:15 +01:00
|
|
|
- Enabled various circuit build timeout constants to be controlled
|
|
|
|
|
by consensus parameters. Also set better defaults for these
|
|
|
|
|
parameters based on experimentation on broadband and simulated
|
|
|
|
|
high latency links.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- The 'EXTENDCIRCUIT' control port command can now be used with
|
2010-02-22 06:20:55 +01:00
|
|
|
a circ id of 0 and no path. This feature will cause Tor to build
|
|
|
|
|
a new 'fast' general purpose circuit using its own path selection
|
2010-02-18 18:40:15 +01:00
|
|
|
algorithms.
|
2010-02-22 06:20:55 +01:00
|
|
|
- Added a BUILDTIMEOUT_SET controller event to describe changes
|
2010-02-18 18:40:15 +01:00
|
|
|
to the circuit build timeout.
|
2010-02-18 18:47:42 +01:00
|
|
|
- Future-proof the controller protocol a bit by ignoring keyword
|
|
|
|
|
arguments we do not recognize.
|
2010-02-22 12:08:58 +01:00
|
|
|
- Expand homedirs passed to tor-checkkey. This should silence a
|
|
|
|
|
coverity complaint about passing a user-supplied string into
|
|
|
|
|
open() without checking it.
|
2010-01-27 19:27:53 +01:00
|
|
|
|
|
|
|
|
|
2010-03-16 05:44:30 +01:00
|
|
|
Changes in version 0.2.1.25 - 2010-03-16
|
|
|
|
|
Tor 0.2.1.25 fixes a regression introduced in 0.2.1.23 that could
|
|
|
|
|
prevent relays from guessing their IP address correctly. It also fixes
|
|
|
|
|
several minor potential security bugs.
|
|
|
|
|
|
2010-02-22 11:39:29 +01:00
|
|
|
o Major bugfixes:
|
2010-03-07 04:39:34 +01:00
|
|
|
- Fix a regression from our patch for bug 1244 that caused relays
|
|
|
|
|
to guess their IP address incorrectly if they didn't set Address
|
|
|
|
|
in their torrc and/or their address fails to resolve. Bugfix on
|
|
|
|
|
0.2.1.23; fixes bug 1269.
|
|
|
|
|
- When freeing a session key, zero it out completely. We only zeroed
|
|
|
|
|
the first ptrsize bytes. Bugfix on 0.0.2pre8. Discovered and
|
|
|
|
|
patched by ekir. Fixes bug 1254.
|
2010-03-05 00:37:40 +01:00
|
|
|
|
2010-02-23 17:09:02 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a dereference-then-NULL-check sequence when publishing
|
2010-03-07 04:39:34 +01:00
|
|
|
descriptors. Bugfix on 0.2.1.5-alpha. Discovered by ekir; fixes
|
|
|
|
|
bug 1255.
|
2010-02-24 09:36:15 +01:00
|
|
|
- Fix another dereference-then-NULL-check sequence. Bugfix on
|
2010-03-07 04:39:34 +01:00
|
|
|
0.2.1.14-rc. Discovered by ekir; fixes bug 1256.
|
2010-02-25 10:31:36 +01:00
|
|
|
- Make sure we treat potentially not NUL-terminated strings correctly.
|
2010-03-07 04:39:34 +01:00
|
|
|
Bugfix on 0.1.1.13-alpha. Discovered by rieo; fixes bug 1257.
|
|
|
|
|
|
2010-02-22 11:39:29 +01:00
|
|
|
|
2010-02-27 21:34:02 +01:00
|
|
|
|
2010-02-21 23:27:12 +01:00
|
|
|
Changes in version 0.2.1.24 - 2010-02-21
|
|
|
|
|
Tor 0.2.1.24 makes Tor work again on the latest OS X -- this time
|
|
|
|
|
for sure!
|
2010-01-25 19:44:17 +01:00
|
|
|
|
2010-02-18 17:54:26 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Work correctly out-of-the-box with even more vendor-patched versions
|
2010-02-21 23:27:12 +01:00
|
|
|
of OpenSSL. In particular, make it so Debian and OS X don't need
|
|
|
|
|
customized patches to run/build.
|
2010-02-18 17:54:26 +01:00
|
|
|
|
|
|
|
|
|
2010-02-13 20:10:57 +01:00
|
|
|
Changes in version 0.2.1.23 - 2010-02-13
|
|
|
|
|
Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work
|
|
|
|
|
again on the latest OS X, and updates the location of a directory
|
|
|
|
|
authority.
|
|
|
|
|
|
2010-01-19 23:30:52 +01:00
|
|
|
o Major bugfixes (performance):
|
|
|
|
|
- We were selecting our guards uniformly at random, and then weighting
|
|
|
|
|
which of our guards we'd use uniformly at random. This imbalance
|
|
|
|
|
meant that Tor clients were severely limited on throughput (and
|
|
|
|
|
probably latency too) by the first hop in their circuit. Now we
|
|
|
|
|
select guards weighted by currently advertised bandwidth. We also
|
|
|
|
|
automatically discard guards picked using the old algorithm. Fixes
|
|
|
|
|
bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry.
|
|
|
|
|
|
2010-02-07 06:30:55 +01:00
|
|
|
o Major bugfixes:
|
2010-02-12 18:35:40 +01:00
|
|
|
- Make Tor work again on the latest OS X: when deciding whether to
|
|
|
|
|
use strange flags to turn TLS renegotiation on, detect the OpenSSL
|
|
|
|
|
version at run-time, not compile time. We need to do this because
|
|
|
|
|
Apple doesn't update its dev-tools headers when it updates its
|
|
|
|
|
libraries in a security patch.
|
2010-02-07 06:30:55 +01:00
|
|
|
- Fix a potential buffer overflow in lookup_last_hid_serv_request()
|
2010-02-12 18:35:40 +01:00
|
|
|
that could happen on 32-bit platforms with 64-bit time_t. Also fix
|
|
|
|
|
a memory leak when requesting a hidden service descriptor we've
|
|
|
|
|
requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found
|
|
|
|
|
by aakova.
|
2010-02-07 06:30:55 +01:00
|
|
|
|
2010-02-12 20:31:08 +01:00
|
|
|
o Directory authority changes:
|
|
|
|
|
- Change IP address for dannenberg (v3 directory authority), and
|
|
|
|
|
remove moria2 (obsolete v1, v2 directory authority and v0 hidden
|
|
|
|
|
service directory authority) from the list.
|
2010-02-07 06:30:55 +01:00
|
|
|
|
2010-01-29 23:02:17 +01:00
|
|
|
o Minor bugfixes:
|
2010-02-12 18:35:40 +01:00
|
|
|
- Refactor resolve_my_address() to not use gethostbyname() anymore.
|
|
|
|
|
Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik.
|
2010-01-29 23:02:17 +01:00
|
|
|
|
2010-01-19 23:52:52 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Avoid a mad rush at the beginning of each month when each client
|
|
|
|
|
rotates half of its guards. Instead we spread the rotation out
|
|
|
|
|
throughout the month, but we still avoid leaving a precise timestamp
|
|
|
|
|
in the state file about when we first picked the guard. Improves
|
|
|
|
|
over the behavior introduced in 0.1.2.17.
|
|
|
|
|
|
2010-01-19 23:30:52 +01:00
|
|
|
|
2010-02-22 06:24:33 +01:00
|
|
|
Changes in version 0.2.2.8-alpha - 2010-01-26
|
2010-03-09 05:09:49 +01:00
|
|
|
Tor 0.2.2.8-alpha fixes a crash bug in 0.2.2.7-alpha that has been
|
|
|
|
|
causing bridge relays to disappear. If you're running a bridge,
|
|
|
|
|
please upgrade.
|
|
|
|
|
|
2010-02-22 06:24:33 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a memory corruption bug on bridges that occured during the
|
|
|
|
|
inclusion of stats data in extra-info descriptors. Also fix the
|
|
|
|
|
interface for geoip_get_bridge_stats* to prevent similar bugs in
|
|
|
|
|
the future. Diagnosis by Tas, patch by Karsten and Sebastian.
|
|
|
|
|
Fixes bug 1208; bugfix on 0.2.2.7-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Ignore OutboundBindAddress when connecting to localhost.
|
|
|
|
|
Connections to localhost need to come _from_ localhost, or else
|
|
|
|
|
local servers (like DNS and outgoing HTTP/SOCKS proxies) will often
|
|
|
|
|
refuse to listen.
|
|
|
|
|
|
|
|
|
|
|
2010-01-19 21:20:07 +01:00
|
|
|
Changes in version 0.2.2.7-alpha - 2010-01-19
|
2010-01-26 19:11:58 +01:00
|
|
|
Tor 0.2.2.7-alpha fixes a huge client-side performance bug, as well
|
|
|
|
|
as laying the groundwork for further relay-side performance fixes. It
|
|
|
|
|
also starts cleaning up client behavior with respect to the EntryNodes,
|
|
|
|
|
ExitNodes, and StrictNodes config options.
|
|
|
|
|
|
|
|
|
|
This release also rotates two directory authority keys, due to a
|
|
|
|
|
security breach of some of the Torproject servers.
|
|
|
|
|
|
2010-01-20 21:39:23 +01:00
|
|
|
o Directory authority changes:
|
|
|
|
|
- Rotate keys (both v3 identity and relay identity) for moria1
|
|
|
|
|
and gabelmoo.
|
|
|
|
|
|
2009-12-21 10:38:49 +01:00
|
|
|
o Major features (performance):
|
2010-01-19 23:55:54 +01:00
|
|
|
- We were selecting our guards uniformly at random, and then weighting
|
|
|
|
|
which of our guards we'd use uniformly at random. This imbalance
|
|
|
|
|
meant that Tor clients were severely limited on throughput (and
|
|
|
|
|
probably latency too) by the first hop in their circuit. Now we
|
|
|
|
|
select guards weighted by currently advertised bandwidth. We also
|
|
|
|
|
automatically discard guards picked using the old algorithm. Fixes
|
|
|
|
|
bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry.
|
2010-01-19 21:20:07 +01:00
|
|
|
- When choosing which cells to relay first, relays can now favor
|
|
|
|
|
circuits that have been quiet recently, to provide lower latency
|
|
|
|
|
for low-volume circuits. By default, relays enable or disable this
|
|
|
|
|
feature based on a setting in the consensus. You can override
|
|
|
|
|
this default by using the new "CircuitPriorityHalflife" config
|
|
|
|
|
option. Design and code by Ian Goldberg, Can Tang, and Chris
|
|
|
|
|
Alexander.
|
2009-12-30 04:25:02 +01:00
|
|
|
- Add separate per-conn write limiting to go with the per-conn read
|
|
|
|
|
limiting. We added a global write limit in Tor 0.1.2.5-alpha,
|
|
|
|
|
but never per-conn write limits.
|
2009-12-23 10:56:24 +01:00
|
|
|
- New consensus params "bwconnrate" and "bwconnburst" to let us
|
|
|
|
|
rate-limit client connections as they enter the network. It's
|
|
|
|
|
controlled in the consensus so we can turn it on and off for
|
|
|
|
|
experiments. It's starting out off. Based on proposal 163.
|
2009-12-19 04:32:56 +01:00
|
|
|
|
2010-01-19 21:20:07 +01:00
|
|
|
o Major features (relay selection options):
|
2009-12-21 10:38:49 +01:00
|
|
|
- Switch to a StrictNodes config option, rather than the previous
|
2009-12-23 10:56:24 +01:00
|
|
|
"StrictEntryNodes" / "StrictExitNodes" separation that was missing a
|
|
|
|
|
"StrictExcludeNodes" option.
|
2009-12-21 10:38:49 +01:00
|
|
|
- If EntryNodes, ExitNodes, ExcludeNodes, or ExcludeExitNodes
|
|
|
|
|
change during a config reload, mark and discard all our origin
|
|
|
|
|
circuits. This fix should address edge cases where we change the
|
|
|
|
|
config options and but then choose a circuit that we created before
|
|
|
|
|
the change.
|
|
|
|
|
- If EntryNodes or ExitNodes are set, be more willing to use an
|
|
|
|
|
unsuitable (e.g. slow or unstable) circuit. The user asked for it,
|
|
|
|
|
they get it.
|
|
|
|
|
- Make EntryNodes config option much more aggressive even when
|
|
|
|
|
StrictNodes is not set. Before it would prepend your requested
|
|
|
|
|
entrynodes to your list of guard nodes, but feel free to use others
|
|
|
|
|
after that. Now it chooses only from your EntryNodes if any of
|
|
|
|
|
those are available, and only falls back to others if a) they're
|
|
|
|
|
all down and b) StrictNodes is not set.
|
|
|
|
|
- Now we refresh your entry guards from EntryNodes at each consensus
|
|
|
|
|
fetch -- rather than just at startup and then they slowly rot as
|
|
|
|
|
the network changes.
|
|
|
|
|
|
2010-01-20 21:39:23 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop bridge directory authorities from answering dbg-stability.txt
|
|
|
|
|
directory queries, which would let people fetch a list of all
|
|
|
|
|
bridge identities they track. Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
|
2009-11-22 05:36:36 +01:00
|
|
|
o Minor features:
|
2010-01-19 21:58:55 +01:00
|
|
|
- Log a notice when we get a new control connection. Now it's easier
|
|
|
|
|
for security-conscious users to recognize when a local application
|
|
|
|
|
is knocking on their controller door. Suggested by bug 1196.
|
2009-11-22 05:36:36 +01:00
|
|
|
- New config option "CircuitStreamTimeout" to override our internal
|
|
|
|
|
timeout schedule for how many seconds until we detach a stream from
|
|
|
|
|
a circuit and try a new circuit. If your network is particularly
|
|
|
|
|
slow, you might want to set this to a number like 60.
|
2009-12-14 01:21:06 +01:00
|
|
|
- New controller command "getinfo config-text". It returns the
|
|
|
|
|
contents that Tor would write if you send it a SAVECONF command,
|
|
|
|
|
so the controller can write the file to disk itself.
|
2009-09-28 15:08:32 +02:00
|
|
|
- New options for SafeLogging to allow scrubbing only log messages
|
|
|
|
|
generated while acting as a relay.
|
2010-01-19 21:58:55 +01:00
|
|
|
- Ship the bridges spec file in the tarball too.
|
2010-01-19 23:55:54 +01:00
|
|
|
- Avoid a mad rush at the beginning of each month when each client
|
|
|
|
|
rotates half of its guards. Instead we spread the rotation out
|
|
|
|
|
throughout the month, but we still avoid leaving a precise timestamp
|
|
|
|
|
in the state file about when we first picked the guard. Improves
|
|
|
|
|
over the behavior introduced in 0.1.2.17.
|
2009-11-22 05:36:36 +01:00
|
|
|
|
2010-01-19 21:58:55 +01:00
|
|
|
o Minor bugfixes (compiling):
|
2010-01-19 21:20:07 +01:00
|
|
|
- Fix compilation on OS X 10.3, which has a stub mlockall() but
|
2009-11-22 04:57:05 +01:00
|
|
|
hides it. Bugfix on 0.2.2.6-alpha.
|
2010-01-19 21:20:07 +01:00
|
|
|
- Fix compilation on Solaris by removing support for the
|
|
|
|
|
DisableAllSwap config option. Solaris doesn't have an rlimit for
|
2010-01-19 21:58:55 +01:00
|
|
|
mlockall, so we cannot use it safely. Fixes bug 1198; bugfix on
|
|
|
|
|
0.2.2.6-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (crashes):
|
2009-12-03 11:07:41 +01:00
|
|
|
- Do not segfault when writing buffer stats when we haven't observed
|
|
|
|
|
a single circuit to report about. Found by Fabian Lanze. Bugfix on
|
|
|
|
|
0.2.2.1-alpha.
|
2010-01-02 19:13:30 +01:00
|
|
|
- If we're in the pathological case where there's no exit bandwidth
|
|
|
|
|
but there is non-exit bandwidth, or no guard bandwidth but there
|
|
|
|
|
is non-guard bandwidth, don't crash during path selection. Bugfix
|
|
|
|
|
on 0.2.0.3-alpha.
|
2010-01-19 21:58:55 +01:00
|
|
|
- Fix an impossible-to-actually-trigger buffer overflow in relay
|
|
|
|
|
descriptor generation. Bugfix on 0.1.0.15.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (privacy):
|
|
|
|
|
- Fix an instance where a Tor directory mirror might accidentally
|
|
|
|
|
log the IP address of a misbehaving Tor client. Bugfix on
|
|
|
|
|
0.1.0.1-rc.
|
|
|
|
|
- Don't list Windows capabilities in relay descriptors. We never made
|
|
|
|
|
use of them, and maybe it's a bad idea to publish them. Bugfix
|
|
|
|
|
on 0.1.1.8-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (other):
|
|
|
|
|
- Resolve an edge case in path weighting that could make us misweight
|
|
|
|
|
our relay selection. Fixes bug 1203; bugfix on 0.0.8rc1.
|
|
|
|
|
- Fix statistics on client numbers by country as seen by bridges that
|
|
|
|
|
were broken in 0.2.2.1-alpha. Also switch to reporting full 24-hour
|
|
|
|
|
intervals instead of variable 12-to-48-hour intervals.
|
|
|
|
|
- After we free an internal connection structure, overwrite it
|
|
|
|
|
with a different memory value than we use for overwriting a freed
|
|
|
|
|
internal circuit structure. Should help with debugging. Suggested
|
|
|
|
|
by bug 1055.
|
|
|
|
|
- Update our OpenSSL 0.9.8l fix so that it works with OpenSSL 0.9.8m
|
|
|
|
|
too.
|
2009-11-22 04:57:05 +01:00
|
|
|
|
2009-12-17 09:19:04 +01:00
|
|
|
o Removed features:
|
|
|
|
|
- Remove the HSAuthorityRecordStats option that version 0 hidden
|
|
|
|
|
service authorities could have used to track statistics of overall
|
|
|
|
|
hidden service usage.
|
|
|
|
|
|
2009-11-20 19:28:16 +01:00
|
|
|
|
2010-01-19 20:12:39 +01:00
|
|
|
Changes in version 0.2.1.22 - 2010-01-19
|
2010-01-19 20:43:05 +01:00
|
|
|
Tor 0.2.1.22 fixes a critical privacy problem in bridge directory
|
|
|
|
|
authorities -- it would tell you its whole history of bridge descriptors
|
|
|
|
|
if you make the right directory request. This stable update also
|
|
|
|
|
rotates two of the seven v3 directory authority keys and locations.
|
|
|
|
|
|
2010-01-19 20:12:39 +01:00
|
|
|
o Directory authority changes:
|
|
|
|
|
- Rotate keys (both v3 identity and relay identity) for moria1
|
|
|
|
|
and gabelmoo.
|
|
|
|
|
|
2010-01-18 01:41:22 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop bridge directory authorities from answering dbg-stability.txt
|
|
|
|
|
directory queries, which would let people fetch a list of all
|
|
|
|
|
bridge identities they track. Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
|
|
|
|
|
|
2010-01-19 21:20:07 +01:00
|
|
|
Changes in version 0.2.1.21 - 2009-12-21
|
|
|
|
|
Tor 0.2.1.21 fixes an incompatibility with the most recent OpenSSL
|
|
|
|
|
library. If you use Tor on Linux / Unix and you're getting SSL
|
|
|
|
|
renegotiation errors, upgrading should help. We also recommend an
|
|
|
|
|
upgrade if you're an exit relay.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Work around a security feature in OpenSSL 0.9.8l that prevents our
|
|
|
|
|
handshake from working unless we explicitly tell OpenSSL that we
|
|
|
|
|
are using SSL renegotiation safely. We are, of course, but OpenSSL
|
|
|
|
|
0.9.8l won't work unless we say we are.
|
|
|
|
|
- Avoid crashing if the client is trying to upload many bytes and the
|
|
|
|
|
circuit gets torn down at the same time, or if the flip side
|
|
|
|
|
happens on the exit relay. Bugfix on 0.2.0.1-alpha; fixes bug 1150.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Do not refuse to learn about authority certs and v2 networkstatus
|
|
|
|
|
documents that are older than the latest consensus. This bug might
|
|
|
|
|
have degraded client bootstrapping. Bugfix on 0.2.0.10-alpha.
|
|
|
|
|
Spotted and fixed by xmux.
|
|
|
|
|
- Fix a couple of very-hard-to-trigger memory leaks, and one hard-to-
|
|
|
|
|
trigger platform-specific option misparsing case found by Coverity
|
|
|
|
|
Scan.
|
|
|
|
|
- Fix a compilation warning on Fedora 12 by removing an impossible-to-
|
|
|
|
|
trigger assert. Fixes bug 1173.
|
|
|
|
|
|
|
|
|
|
|
2009-11-19 20:16:11 +01:00
|
|
|
Changes in version 0.2.2.6-alpha - 2009-11-19
|
2010-01-19 21:20:07 +01:00
|
|
|
Tor 0.2.2.6-alpha lays the groundwork for many upcoming features:
|
|
|
|
|
support for the new lower-footprint "microdescriptor" directory design,
|
|
|
|
|
future-proofing our consensus format against new hash functions or
|
|
|
|
|
other changes, and an Android port. It also makes Tor compatible with
|
|
|
|
|
the upcoming OpenSSL 0.9.8l release, and fixes a variety of bugs.
|
|
|
|
|
|
2009-10-19 06:39:20 +02:00
|
|
|
o Major features:
|
2009-11-17 13:02:17 +01:00
|
|
|
- Directory authorities can now create, vote on, and serve multiple
|
2009-10-19 06:39:20 +02:00
|
|
|
parallel formats of directory data as part of their voting process.
|
2009-11-17 13:02:17 +01:00
|
|
|
Partially implements Proposal 162: "Publish the consensus in
|
|
|
|
|
multiple flavors".
|
|
|
|
|
- Directory authorities can now agree on and publish small summaries
|
|
|
|
|
of router information that clients can use in place of regular
|
|
|
|
|
server descriptors. This transition will eventually allow clients
|
|
|
|
|
to use far less bandwidth for downloading information about the
|
|
|
|
|
network. Begins the implementation of Proposal 158: "Clients
|
|
|
|
|
download consensus + microdescriptors".
|
2009-10-19 06:39:20 +02:00
|
|
|
- The directory voting system is now extensible to use multiple hash
|
2009-11-17 13:02:17 +01:00
|
|
|
algorithms for signatures and resource selection. Newer formats
|
|
|
|
|
are signed with SHA256, with a possibility for moving to a better
|
|
|
|
|
hash algorithm in the future.
|
2009-10-22 06:21:57 +02:00
|
|
|
- New DisableAllSwap option. If set to 1, Tor will attempt to lock all
|
2009-11-17 13:02:17 +01:00
|
|
|
current and future memory pages via mlockall(). On supported
|
|
|
|
|
platforms (modern Linux and probably BSD but not Windows or OS X),
|
|
|
|
|
this should effectively disable any and all attempts to page out
|
|
|
|
|
memory. This option requires that you start your Tor as root --
|
|
|
|
|
if you use DisableAllSwap, please consider using the User option
|
|
|
|
|
to properly reduce the privileges of your Tor.
|
|
|
|
|
- Numerous changes, bugfixes, and workarounds from Nathan Freitas
|
|
|
|
|
to help Tor build correctly for Android phones.
|
2009-10-19 06:39:20 +02:00
|
|
|
|
2009-11-06 21:25:41 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Work around a security feature in OpenSSL 0.9.8l that prevents our
|
2009-11-17 13:02:17 +01:00
|
|
|
handshake from working unless we explicitly tell OpenSSL that we
|
|
|
|
|
are using SSL renegotiation safely. We are, but OpenSSL 0.9.8l
|
|
|
|
|
won't work unless we say we are.
|
2009-10-12 21:01:10 +02:00
|
|
|
|
2009-10-13 23:54:04 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a crash bug when trying to initialize the evdns module in
|
2009-11-17 13:02:17 +01:00
|
|
|
Libevent 2. Bugfix on 0.2.1.16-rc.
|
2009-10-26 08:16:47 +01:00
|
|
|
- Stop logging at severity 'warn' when some other Tor client tries
|
|
|
|
|
to establish a circuit with us using weak DH keys. It's a protocol
|
|
|
|
|
violation, but that doesn't mean ordinary users need to hear about
|
|
|
|
|
it. Fixes the bug part of bug 1114. Bugfix on 0.1.0.13.
|
2009-10-27 01:15:03 +01:00
|
|
|
- Do not refuse to learn about authority certs and v2 networkstatus
|
2009-11-17 13:02:17 +01:00
|
|
|
documents that are older than the latest consensus. This bug might
|
|
|
|
|
have degraded client bootstrapping. Bugfix on 0.2.0.10-alpha.
|
2009-10-27 01:15:03 +01:00
|
|
|
Spotted and fixed by xmux.
|
2009-10-27 03:38:10 +01:00
|
|
|
- Fix numerous small code-flaws found by Coverity Scan Rung 3.
|
2009-10-27 03:27:54 +01:00
|
|
|
- If all authorities restart at once right before a consensus vote,
|
|
|
|
|
nobody will vote about "Running", and clients will get a consensus
|
|
|
|
|
with no usable relays. Instead, authorities refuse to build a
|
|
|
|
|
consensus if this happens. Bugfix on 0.2.0.10-alpha; fixes bug 1066.
|
2009-10-27 06:49:43 +01:00
|
|
|
- If your relay can't keep up with the number of incoming create
|
|
|
|
|
cells, it would log one warning per failure into your logs. Limit
|
|
|
|
|
warnings to 1 per minute. Bugfix on 0.0.2pre10; fixes bug 1042.
|
2009-11-17 13:02:17 +01:00
|
|
|
- Bridges now use "reject *:*" as their default exit policy. Bugfix
|
|
|
|
|
on 0.2.0.3-alpha; fixes bug 1113.
|
2009-11-12 07:31:26 +01:00
|
|
|
- Fix a memory leak on directory authorities during voting that was
|
|
|
|
|
introduced in 0.2.2.1-alpha. Found via valgrind.
|
2009-10-13 23:54:04 +02:00
|
|
|
|
2009-10-12 21:01:10 +02:00
|
|
|
|
2010-01-19 21:20:07 +01:00
|
|
|
Changes in version 0.2.1.20 - 2009-10-15
|
|
|
|
|
Tor 0.2.1.20 fixes a crash bug when you're accessing many hidden
|
|
|
|
|
services at once, prepares for more performance improvements, and
|
|
|
|
|
fixes a bunch of smaller bugs.
|
|
|
|
|
|
|
|
|
|
The Windows and OS X bundles also include a more recent Vidalia,
|
|
|
|
|
and switch from Privoxy to Polipo.
|
|
|
|
|
|
|
|
|
|
The OS X installers are now drag and drop. It's best to un-install
|
|
|
|
|
Tor/Vidalia and then install this new bundle, rather than upgrade. If
|
|
|
|
|
you want to upgrade, you'll need to update the paths for Tor and Polipo
|
|
|
|
|
in the Vidalia Settings window.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Send circuit or stream sendme cells when our window has decreased
|
|
|
|
|
by 100 cells, not when it has decreased by 101 cells. Bug uncovered
|
|
|
|
|
by Karsten when testing the "reduce circuit window" performance
|
|
|
|
|
patch. Bugfix on the 54th commit on Tor -- from July 2002,
|
|
|
|
|
before the release of Tor 0.0.0. This is the new winner of the
|
|
|
|
|
oldest-bug prize.
|
|
|
|
|
- Fix a remotely triggerable memory leak when a consensus document
|
|
|
|
|
contains more than one signature from the same voter. Bugfix on
|
|
|
|
|
0.2.0.3-alpha.
|
|
|
|
|
- Avoid segfault in rare cases when finishing an introduction circuit
|
|
|
|
|
as a client and finding out that we don't have an introduction key
|
|
|
|
|
for it. Fixes bug 1073. Reported by Aaron Swartz.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Tor now reads the "circwindow" parameter out of the consensus,
|
|
|
|
|
and uses that value for its circuit package window rather than the
|
|
|
|
|
default of 1000 cells. Begins the implementation of proposal 168.
|
|
|
|
|
|
|
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
- Move moria1 and tonga to alternate IP addresses.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a signed/unsigned compile warning in 0.2.1.19.
|
|
|
|
|
- Fix possible segmentation fault on directory authorities. Bugfix on
|
|
|
|
|
0.2.1.14-rc.
|
|
|
|
|
- Fix an extremely rare infinite recursion bug that could occur if
|
|
|
|
|
we tried to log a message after shutting down the log subsystem.
|
|
|
|
|
Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
|
|
|
|
|
- Fix an obscure bug where hidden services on 64-bit big-endian
|
|
|
|
|
systems might mis-read the timestamp in v3 introduce cells, and
|
|
|
|
|
refuse to connect back to the client. Discovered by "rotor".
|
|
|
|
|
Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- We were triggering a CLOCK_SKEW controller status event whenever
|
|
|
|
|
we connect via the v2 connection protocol to any relay that has
|
|
|
|
|
a wrong clock. Instead, we should only inform the controller when
|
|
|
|
|
it's a trusted authority that claims our clock is wrong. Bugfix
|
|
|
|
|
on 0.2.0.20-rc; starts to fix bug 1074. Reported by SwissTorExit.
|
|
|
|
|
- We were telling the controller about CHECKING_REACHABILITY and
|
|
|
|
|
REACHABILITY_FAILED status events whenever we launch a testing
|
|
|
|
|
circuit or notice that one has failed. Instead, only tell the
|
|
|
|
|
controller when we want to inform the user of overall success or
|
|
|
|
|
overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075. Reported
|
|
|
|
|
by SwissTorExit.
|
|
|
|
|
- Don't warn when we're using a circuit that ends with a node
|
|
|
|
|
excluded in ExcludeExitNodes, but the circuit is not used to access
|
|
|
|
|
the outside world. This should help fix bug 1090. Bugfix on
|
|
|
|
|
0.2.1.6-alpha.
|
|
|
|
|
- Work around a small memory leak in some versions of OpenSSL that
|
|
|
|
|
stopped the memory used by the hostname TLS extension from being
|
|
|
|
|
freed.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Add a "getinfo status/accepted-server-descriptor" controller
|
|
|
|
|
command, which is the recommended way for controllers to learn
|
|
|
|
|
whether our server descriptor has been successfully received by at
|
|
|
|
|
least on directory authority. Un-recommend good-server-descriptor
|
|
|
|
|
getinfo and status events until we have a better design for them.
|
|
|
|
|
|
|
|
|
|
|
2009-10-11 20:59:14 +02:00
|
|
|
Changes in version 0.2.2.5-alpha - 2009-10-11
|
2009-10-14 21:49:26 +02:00
|
|
|
Tor 0.2.2.5-alpha fixes a few compile problems in 0.2.2.4-alpha.
|
|
|
|
|
|
2009-10-11 20:59:14 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Make the tarball compile again. Oops. Bugfix on 0.2.2.4-alpha.
|
|
|
|
|
|
2011-08-01 21:53:13 +02:00
|
|
|
o Directory authorities:
|
|
|
|
|
- Temporarily (just for this release) move dizum to an alternate
|
|
|
|
|
IP address.
|
2009-10-11 20:59:14 +02:00
|
|
|
|
|
|
|
|
|
2009-10-10 23:29:44 +02:00
|
|
|
Changes in version 0.2.2.4-alpha - 2009-10-10
|
2009-10-14 21:49:26 +02:00
|
|
|
Tor 0.2.2.4-alpha fixes more crash bugs in 0.2.2.2-alpha. It also
|
|
|
|
|
introduces a new unit test framework, shifts directry authority
|
|
|
|
|
addresses around to reduce the impact from recent blocking events,
|
|
|
|
|
and fixes a few smaller bugs.
|
|
|
|
|
|
2009-09-29 12:41:23 +02:00
|
|
|
o Major bugfixes:
|
2009-10-07 22:18:18 +02:00
|
|
|
- Fix several more asserts in the circuit_build_times code, for
|
|
|
|
|
example one that causes Tor to fail to start once we have
|
|
|
|
|
accumulated 5000 build times in the state file. Bugfixes on
|
|
|
|
|
0.2.2.2-alpha; fixes bug 1108.
|
2009-09-29 12:41:23 +02:00
|
|
|
|
2009-10-01 00:46:55 +02:00
|
|
|
o New directory authorities:
|
2009-10-01 04:35:05 +02:00
|
|
|
- Move moria1 and Tonga to alternate IP addresses.
|
2009-10-01 00:46:55 +02:00
|
|
|
|
2009-09-24 18:31:22 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- Log SSL state transitions at debug level during handshake, and
|
2009-10-07 22:18:18 +02:00
|
|
|
include SSL states in error messages. This may help debug future
|
|
|
|
|
SSL handshake issues.
|
2009-09-24 18:31:22 +02:00
|
|
|
- Add a new "Handshake" log domain for activities that happen
|
|
|
|
|
during the TLS handshake.
|
2009-09-25 01:15:24 +02:00
|
|
|
- Revert to the "June 3 2009" ip-to-country file. The September one
|
|
|
|
|
seems to have removed most US IP addresses.
|
2009-10-01 00:34:21 +02:00
|
|
|
- Directory authorities now reject Tor relays with versions less than
|
|
|
|
|
0.1.2.14. This step cuts out four relays from the current network,
|
|
|
|
|
none of which are very big.
|
2009-09-24 18:31:22 +02:00
|
|
|
|
2009-09-24 21:58:56 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a couple of smaller issues with gathering statistics. Bugfixes
|
|
|
|
|
on 0.2.2.1-alpha.
|
2009-09-26 15:38:52 +02:00
|
|
|
- Fix two memory leaks in the error case of
|
2009-10-14 21:49:26 +02:00
|
|
|
circuit_build_times_parse_state(). Bugfix on 0.2.2.2-alpha.
|
2009-10-01 10:15:45 +02:00
|
|
|
- Don't count one-hop circuits when we're estimating how long it
|
|
|
|
|
takes circuits to build on average. Otherwise we'll set our circuit
|
|
|
|
|
build timeout lower than we should. Bugfix on 0.2.2.2-alpha.
|
2009-07-02 19:56:52 +02:00
|
|
|
- Directory authorities no longer change their opinion of, or vote on,
|
2009-10-10 23:29:44 +02:00
|
|
|
whether a router is Running, unless they have themselves been
|
|
|
|
|
online long enough to have some idea. Bugfix on 0.2.0.6-alpha.
|
|
|
|
|
Fixes bug 1023.
|
2009-10-01 10:15:45 +02:00
|
|
|
|
2009-10-07 22:18:18 +02:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Revise our unit tests to use the "tinytest" framework, so we
|
|
|
|
|
can run tests in their own processes, have smarter setup/teardown
|
2009-10-14 21:49:26 +02:00
|
|
|
code, and so on. The unit test code has moved to its own
|
2009-10-07 22:18:18 +02:00
|
|
|
subdirectory, and has been split into multiple modules.
|
|
|
|
|
|
2009-09-23 06:49:49 +02:00
|
|
|
|
2009-09-23 04:09:33 +02:00
|
|
|
Changes in version 0.2.2.3-alpha - 2009-09-23
|
2009-10-10 19:33:17 +02:00
|
|
|
Tor 0.2.2.3-alpha fixes a few crash bugs in 0.2.2.2-alpha.
|
|
|
|
|
|
2009-09-23 04:15:56 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix an overzealous assert in our new circuit build timeout code.
|
2009-09-23 06:13:57 +02:00
|
|
|
Bugfix on 0.2.2.2-alpha; fixes bug 1103.
|
2009-09-23 04:15:56 +02:00
|
|
|
|
2009-09-23 04:09:33 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- If the networkstatus consensus tells us that we should use a
|
|
|
|
|
negative circuit package window, ignore it. Otherwise we'll
|
2009-09-23 06:13:57 +02:00
|
|
|
believe it and then trigger an assert. Bugfix on 0.2.2.2-alpha.
|
2009-09-23 04:09:33 +02:00
|
|
|
|
2009-09-21 21:51:08 +02:00
|
|
|
|
2009-09-21 07:31:39 +02:00
|
|
|
Changes in version 0.2.2.2-alpha - 2009-09-21
|
2009-10-10 19:33:17 +02:00
|
|
|
Tor 0.2.2.2-alpha introduces our latest performance improvement for
|
|
|
|
|
clients: Tor tracks the average time it takes to build a circuit, and
|
|
|
|
|
avoids using circuits that take too long to build. For fast connections,
|
|
|
|
|
this feature can cut your expected latency in half. For slow or flaky
|
|
|
|
|
connections, it could ruin your Tor experience. Let us know if it does!
|
|
|
|
|
|
2009-09-15 04:15:57 +02:00
|
|
|
o Major features:
|
2009-09-17 07:42:33 +02:00
|
|
|
- Tor now tracks how long it takes to build client-side circuits
|
|
|
|
|
over time, and adapts its timeout to local network performance.
|
|
|
|
|
Since a circuit that takes a long time to build will also provide
|
|
|
|
|
bad performance, we get significant latency improvements by
|
|
|
|
|
discarding the slowest 20% of circuits. Specifically, Tor creates
|
|
|
|
|
circuits more aggressively than usual until it has enough data
|
|
|
|
|
points for a good timeout estimate. Implements proposal 151.
|
|
|
|
|
We are especially looking for reports (good and bad) from users with
|
|
|
|
|
both EDGE and broadband connections that can move from broadband
|
|
|
|
|
to EDGE and find out if the build-time data in the .tor/state gets
|
|
|
|
|
reset without loss of Tor usability. You should also see a notice
|
|
|
|
|
log message telling you that Tor has reset its timeout.
|
2009-09-18 04:44:11 +02:00
|
|
|
- Directory authorities can now vote on arbitary integer values as
|
|
|
|
|
part of the consensus process. This is designed to help set
|
|
|
|
|
network-wide parameters. Implements proposal 167.
|
2009-09-15 12:33:33 +02:00
|
|
|
- Tor now reads the "circwindow" parameter out of the consensus,
|
|
|
|
|
and uses that value for its circuit package window rather than the
|
|
|
|
|
default of 1000 cells. Begins the implementation of proposal 168.
|
2009-09-15 04:15:57 +02:00
|
|
|
|
2009-09-18 04:44:11 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a remotely triggerable memory leak when a consensus document
|
|
|
|
|
contains more than one signature from the same voter. Bugfix on
|
|
|
|
|
0.2.0.3-alpha.
|
|
|
|
|
|
2009-08-28 04:27:25 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix an extremely rare infinite recursion bug that could occur if
|
|
|
|
|
we tried to log a message after shutting down the log subsystem.
|
|
|
|
|
Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
|
2009-08-31 06:18:55 +02:00
|
|
|
- Fix parsing for memory or time units given without a space between
|
2009-09-18 04:44:11 +02:00
|
|
|
the number and the unit. Bugfix on 0.2.2.1-alpha; fixes bug 1076.
|
2009-09-13 21:47:55 +02:00
|
|
|
- A networkstatus vote must contain exactly one signature. Spec
|
|
|
|
|
conformance issue. Bugfix on 0.2.0.3-alpha.
|
2009-09-18 04:44:11 +02:00
|
|
|
- Fix an obscure bug where hidden services on 64-bit big-endian
|
|
|
|
|
systems might mis-read the timestamp in v3 introduce cells, and
|
|
|
|
|
refuse to connect back to the client. Discovered by "rotor".
|
|
|
|
|
Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- We were triggering a CLOCK_SKEW controller status event whenever
|
|
|
|
|
we connect via the v2 connection protocol to any relay that has
|
|
|
|
|
a wrong clock. Instead, we should only inform the controller when
|
|
|
|
|
it's a trusted authority that claims our clock is wrong. Bugfix
|
|
|
|
|
on 0.2.0.20-rc; starts to fix bug 1074. Reported by SwissTorExit.
|
|
|
|
|
- We were telling the controller about CHECKING_REACHABILITY and
|
|
|
|
|
REACHABILITY_FAILED status events whenever we launch a testing
|
|
|
|
|
circuit or notice that one has failed. Instead, only tell the
|
|
|
|
|
controller when we want to inform the user of overall success or
|
|
|
|
|
overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075. Reported
|
|
|
|
|
by SwissTorExit.
|
|
|
|
|
- Don't warn when we're using a circuit that ends with a node
|
|
|
|
|
excluded in ExcludeExitNodes, but the circuit is not used to access
|
2009-09-21 07:31:39 +02:00
|
|
|
the outside world. This should help fix bug 1090, but more problems
|
|
|
|
|
remain. Bugfix on 0.2.1.6-alpha.
|
2009-09-18 04:44:11 +02:00
|
|
|
- Work around a small memory leak in some versions of OpenSSL that
|
|
|
|
|
stopped the memory used by the hostname TLS extension from being
|
|
|
|
|
freed.
|
2009-09-21 05:24:46 +02:00
|
|
|
- Make our 'torify' script more portable; if we have only one of
|
|
|
|
|
'torsocks' or 'tsocks' installed, don't complain to the user;
|
|
|
|
|
and explain our warning about tsocks better.
|
2009-09-18 04:44:11 +02:00
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Add a "getinfo status/accepted-server-descriptor" controller
|
|
|
|
|
command, which is the recommended way for controllers to learn
|
|
|
|
|
whether our server descriptor has been successfully received by at
|
|
|
|
|
least on directory authority. Un-recommend good-server-descriptor
|
|
|
|
|
getinfo and status events until we have a better design for them.
|
2009-09-21 07:44:59 +02:00
|
|
|
- Update to the "September 4 2009" ip-to-country file.
|
2009-08-28 04:27:25 +02:00
|
|
|
|
|
|
|
|
|
2009-08-26 19:58:19 +02:00
|
|
|
Changes in version 0.2.2.1-alpha - 2009-08-26
|
2009-10-10 19:33:17 +02:00
|
|
|
Tor 0.2.2.1-alpha disables ".exit" address notation by default, allows
|
|
|
|
|
Tor clients to bootstrap on networks where only port 80 is reachable,
|
|
|
|
|
makes it more straightforward to support hardware crypto accelerators,
|
|
|
|
|
and starts the groundwork for gathering stats safely at relays.
|
|
|
|
|
|
2009-08-26 21:43:18 +02:00
|
|
|
o Security fixes:
|
|
|
|
|
- Start the process of disabling ".exit" address notation, since it
|
|
|
|
|
can be used for a variety of esoteric application-level attacks
|
|
|
|
|
on users. To reenable it, set "AllowDotExit 1" in your torrc. Fix
|
|
|
|
|
on 0.0.9rc5.
|
|
|
|
|
|
2009-08-26 19:58:19 +02:00
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
2009-05-31 19:36:18 +02:00
|
|
|
o Major features:
|
2009-08-26 19:58:19 +02:00
|
|
|
- New AccelName and AccelDir options add support for dynamic OpenSSL
|
|
|
|
|
hardware crypto acceleration engines.
|
|
|
|
|
- Tor now supports tunneling all of its outgoing connections over
|
|
|
|
|
a SOCKS proxy, using the SOCKS4Proxy and/or SOCKS5Proxy
|
|
|
|
|
configuration options. Code by Christopher Davis.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Send circuit or stream sendme cells when our window has decreased
|
|
|
|
|
by 100 cells, not when it has decreased by 101 cells. Bug uncovered
|
|
|
|
|
by Karsten when testing the "reduce circuit window" performance
|
|
|
|
|
patch. Bugfix on the 54th commit on Tor -- from July 2002,
|
|
|
|
|
before the release of Tor 0.0.0. This is the new winner of the
|
|
|
|
|
oldest-bug prize.
|
2009-05-31 19:36:18 +02:00
|
|
|
|
2009-07-25 00:58:09 +02:00
|
|
|
o New options for gathering stats safely:
|
2009-08-19 23:36:27 +02:00
|
|
|
- Directories that set "DirReqStatistics 1" write statistics on
|
|
|
|
|
directory request to disk every 24 hours. As compared to the
|
|
|
|
|
--enable-geoip-stats flag in 0.2.1.x, there are a few improvements:
|
|
|
|
|
1) stats are written to disk exactly every 24 hours; 2) estimated
|
|
|
|
|
shares of v2 and v3 requests are determined as mean values, not at
|
|
|
|
|
the end of a measurement period; 3) unresolved requests are listed
|
|
|
|
|
with country code '??'; 4) directories also measure download times.
|
2009-08-19 17:14:35 +02:00
|
|
|
- Exit nodes that set "ExitPortStatistics 1" write statistics on the
|
|
|
|
|
number of exit streams and transferred bytes per port to disk every
|
|
|
|
|
24 hours.
|
2009-08-19 23:36:27 +02:00
|
|
|
- Relays that set "CellStatistics 1" write statistics on how long
|
|
|
|
|
cells spend in their circuit queues to disk every 24 hours.
|
|
|
|
|
- Entry nodes that set "EntryStatistics 1" write statistics on the
|
|
|
|
|
rough number and origins of connecting clients to disk every 24
|
|
|
|
|
hours.
|
2009-08-19 17:14:35 +02:00
|
|
|
- Relays that write any of the above statistics to disk and set
|
|
|
|
|
"ExtraInfoStatistics 1" include the past 24 hours of statistics in
|
|
|
|
|
their extra-info documents.
|
2009-07-25 00:58:09 +02:00
|
|
|
|
2009-05-31 19:36:18 +02:00
|
|
|
o Minor features:
|
2009-05-17 06:51:23 +02:00
|
|
|
- New --digests command-line switch to output the digests of the
|
|
|
|
|
source files Tor was built with.
|
2009-04-30 01:05:56 +02:00
|
|
|
- The "torify" script now uses torsocks where available.
|
2009-05-12 21:10:23 +02:00
|
|
|
- The memarea code now uses a sentinel value at the end of each area
|
2009-08-26 19:58:19 +02:00
|
|
|
to make sure nothing writes beyond the end of an area. This might
|
2009-05-12 21:10:23 +02:00
|
|
|
help debug some conceivable causes of bug 930.
|
2009-07-15 16:02:49 +02:00
|
|
|
- Time and memory units in the configuration file can now be set to
|
2009-08-26 19:58:19 +02:00
|
|
|
fractional units. For example, "2.5 GB" is now a valid value for
|
2009-07-15 16:02:49 +02:00
|
|
|
AccountingMax.
|
2009-07-25 06:52:54 +02:00
|
|
|
- Certain Tor clients (such as those behind check.torproject.org) may
|
|
|
|
|
want to fetch the consensus in an extra early manner. To enable this
|
|
|
|
|
a user may now set FetchDirInfoExtraEarly to 1. This also depends on
|
|
|
|
|
setting FetchDirInfoEarly to 1. Previous behavior will stay the same
|
|
|
|
|
as only certain clients who must have this information sooner should
|
|
|
|
|
set this option.
|
2009-06-12 19:38:37 +02:00
|
|
|
- Instead of adding the svn revision to the Tor version string, report
|
|
|
|
|
the git commit (when we're building from a git checkout).
|
2009-01-04 03:43:05 +01:00
|
|
|
|
2009-08-20 22:50:51 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- If any the v3 certs we download are unparseable, we should actually
|
|
|
|
|
notice the failure so we don't retry indefinitely. Bugfix on
|
|
|
|
|
0.2.0.x; reported by "rotator".
|
2009-08-20 22:56:21 +02:00
|
|
|
- If the cached cert file is unparseable, warn but don't exit.
|
2009-08-26 19:58:19 +02:00
|
|
|
- Fix possible segmentation fault on directory authorities. Bugfix on
|
|
|
|
|
0.2.1.14-rc.
|
2009-08-27 02:20:09 +02:00
|
|
|
- When Tor fails to parse a descriptor of any kind, dump it to disk.
|
|
|
|
|
Might help diagnosing bug 1051.
|
2009-08-20 22:50:51 +02:00
|
|
|
|
2009-05-01 12:25:18 +02:00
|
|
|
o Deprecated and removed features:
|
|
|
|
|
- The controller no longer accepts the old obsolete "addr-mappings/"
|
2009-07-25 00:58:09 +02:00
|
|
|
or "unregistered-servers-" GETINFO values.
|
2009-05-03 00:34:36 +02:00
|
|
|
- Hidden services no longer publish version 0 descriptors, and clients
|
2009-08-26 19:58:19 +02:00
|
|
|
do not request or use version 0 descriptors. However, the old hidden
|
|
|
|
|
service authorities still accept and serve version 0 descriptors
|
|
|
|
|
when contacted by older hidden services/clients.
|
2009-05-08 18:12:20 +02:00
|
|
|
- The EXTENDED_EVENTS and VERBOSE_NAMES controller features are now
|
|
|
|
|
always on; using them is necessary for correct forward-compatible
|
|
|
|
|
controllers.
|
2009-08-26 19:58:19 +02:00
|
|
|
- Remove support for .noconnect style addresses. Nobody was using
|
|
|
|
|
them, and they provided another avenue for detecting Tor users
|
|
|
|
|
via application-level web tricks.
|
2009-05-01 12:25:18 +02:00
|
|
|
|
2009-09-02 04:51:46 +02:00
|
|
|
o Packaging changes:
|
2009-09-02 05:14:54 +02:00
|
|
|
- Upgrade Vidalia from 0.1.15 to 0.2.3 in the Windows and OS X
|
|
|
|
|
installer bundles. See
|
|
|
|
|
https://trac.vidalia-project.net/browser/vidalia/tags/vidalia-0.2.3/CHANGELOG
|
|
|
|
|
for details of what's new in Vidalia 0.2.3.
|
|
|
|
|
- Windows Vidalia Bundle: update Privoxy from 3.0.6 to 3.0.14-beta.
|
|
|
|
|
- OS X Vidalia Bundle: move to Polipo 1.0.4 with Tor specific
|
|
|
|
|
configuration file, rather than the old Privoxy.
|
2009-09-02 04:51:46 +02:00
|
|
|
- OS X Vidalia Bundle: Vidalia, Tor, and Polipo are compiled as
|
2009-09-02 05:14:54 +02:00
|
|
|
x86-only for better compatibility with OS X 10.6, aka Snow Leopard.
|
2009-09-02 04:51:46 +02:00
|
|
|
- OS X Tor Expert Bundle: Tor is compiled as x86-only for
|
|
|
|
|
better compatibility with OS X 10.6, aka Snow Leopard.
|
|
|
|
|
- OS X Vidalia Bundle: The multi-package installer is now replaced
|
2009-09-02 05:14:54 +02:00
|
|
|
by a simple drag and drop to the /Applications folder. This change
|
|
|
|
|
occurred with the upgrade to Vidalia 0.2.3.
|
2009-09-02 04:51:46 +02:00
|
|
|
|
2009-01-04 03:43:05 +01:00
|
|
|
|
2009-07-28 23:39:51 +02:00
|
|
|
Changes in version 0.2.1.19 - 2009-07-28
|
2009-07-29 02:44:51 +02:00
|
|
|
Tor 0.2.1.19 fixes a major bug with accessing and providing hidden
|
|
|
|
|
services on Tor 0.2.1.3-alpha through 0.2.1.18.
|
|
|
|
|
|
2009-07-28 03:01:24 +02:00
|
|
|
o Major bugfixes:
|
2009-07-29 02:44:51 +02:00
|
|
|
- Make accessing hidden services on 0.2.1.x work right again.
|
|
|
|
|
Bugfix on 0.2.1.3-alpha; workaround for bug 1038. Diagnosis and
|
|
|
|
|
part of patch provided by "optimist".
|
2009-07-28 03:01:24 +02:00
|
|
|
|
2009-07-28 04:51:20 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- When a relay/bridge is writing out its identity key fingerprint to
|
|
|
|
|
the "fingerprint" file and to its logs, write it without spaces. Now
|
|
|
|
|
it will look like the fingerprints in our bridges documentation,
|
|
|
|
|
and confuse fewer users.
|
|
|
|
|
|
2009-07-28 04:38:09 +02:00
|
|
|
o Minor bugfixes:
|
2009-07-07 18:04:00 +02:00
|
|
|
- Relays no longer publish a new server descriptor if they change
|
|
|
|
|
their MaxAdvertisedBandwidth config option but it doesn't end up
|
|
|
|
|
changing their advertised bandwidth numbers. Bugfix on 0.2.0.28-rc;
|
|
|
|
|
fixes bug 1026. Patch from Sebastian.
|
2009-07-28 04:38:09 +02:00
|
|
|
- Avoid leaking memory every time we get a create cell but we have
|
|
|
|
|
so many already queued that we refuse it. Bugfix on 0.2.0.19-alpha;
|
|
|
|
|
fixes bug 1034. Reported by BarkerJr.
|
|
|
|
|
|
2009-07-28 03:01:24 +02:00
|
|
|
|
2009-07-24 23:16:07 +02:00
|
|
|
Changes in version 0.2.1.18 - 2009-07-24
|
2009-07-29 02:44:51 +02:00
|
|
|
Tor 0.2.1.18 lays the foundations for performance improvements,
|
|
|
|
|
adds status events to help users diagnose bootstrap problems, adds
|
|
|
|
|
optional authentication/authorization for hidden services, fixes a
|
|
|
|
|
variety of potential anonymity problems, and includes a huge pile of
|
|
|
|
|
other features and bug fixes.
|
|
|
|
|
|
2009-07-24 23:16:07 +02:00
|
|
|
o Build fixes:
|
|
|
|
|
- Add LIBS=-lrt to Makefile.am so the Tor RPMs use a static libevent.
|
|
|
|
|
|
|
|
|
|
|
2009-07-07 18:19:04 +02:00
|
|
|
Changes in version 0.2.1.17-rc - 2009-07-07
|
2009-07-24 22:53:40 +02:00
|
|
|
Tor 0.2.1.17-rc marks the fourth -- and hopefully last -- release
|
|
|
|
|
candidate for the 0.2.1.x series. It lays the groundwork for further
|
|
|
|
|
client performance improvements, and also fixes a big bug with directory
|
|
|
|
|
authorities that were causing them to assign Guard and Stable flags
|
|
|
|
|
poorly.
|
|
|
|
|
|
|
|
|
|
The Windows bundles also finally include the geoip database that we
|
|
|
|
|
thought we'd been shipping since 0.2.0.x (oops), and the OS X bundles
|
|
|
|
|
should actually install Torbutton rather than giving you a cryptic
|
|
|
|
|
failure message (oops).
|
|
|
|
|
|
2009-07-02 16:13:01 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Clients now use the bandwidth values in the consensus, rather than
|
|
|
|
|
the bandwidth values in each relay descriptor. This approach opens
|
|
|
|
|
the door to more accurate bandwidth estimates once the directory
|
|
|
|
|
authorities start doing active measurements. Implements more of
|
|
|
|
|
proposal 141.
|
|
|
|
|
|
2009-06-20 12:14:32 +02:00
|
|
|
o Major bugfixes:
|
2009-07-02 16:13:01 +02:00
|
|
|
- When Tor clients restart after 1-5 days, they discard all their
|
|
|
|
|
cached descriptors as too old, but they still use the cached
|
|
|
|
|
consensus document. This approach is good for robustness, but
|
|
|
|
|
bad for performance: since they don't know any bandwidths, they
|
|
|
|
|
end up choosing at random rather than weighting their choice by
|
|
|
|
|
speed. Fixed by the above feature of putting bandwidths in the
|
|
|
|
|
consensus. Bugfix on 0.2.0.x.
|
2009-06-20 12:14:32 +02:00
|
|
|
- Directory authorities were neglecting to mark relays down in their
|
|
|
|
|
internal histories if the relays fall off the routerlist without
|
|
|
|
|
ever being found unreachable. So there were relays in the histories
|
|
|
|
|
that haven't been seen for eight months, and are listed as being
|
|
|
|
|
up for eight months. This wreaked havoc on the "median wfu"
|
|
|
|
|
and "median mtbf" calculations, in turn making Guard and Stable
|
|
|
|
|
flags very wrong, hurting network performance. Fixes bugs 696 and
|
|
|
|
|
969. Bugfix on 0.2.0.6-alpha.
|
|
|
|
|
|
2009-06-22 18:34:32 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Serve the DirPortFrontPage page even when we have been approaching
|
2009-07-02 16:13:01 +02:00
|
|
|
our quotas recently. Fixes bug 1013; bugfix on 0.2.1.8-alpha.
|
|
|
|
|
- The control port would close the connection before flushing long
|
|
|
|
|
replies, such as the network consensus, if a QUIT command was issued
|
|
|
|
|
before the reply had completed. Now, the control port flushes all
|
|
|
|
|
pending replies before closing the connection. Also fixed a spurious
|
|
|
|
|
warning when a QUIT command is issued after a malformed or rejected
|
|
|
|
|
AUTHENTICATE command, but before the connection was closed. Patch
|
|
|
|
|
by Marcus Griep. Bugfix on 0.2.0.x; fixes bugs 1015 and 1016.
|
2009-06-30 20:35:03 +02:00
|
|
|
- When we can't find an intro key for a v2 hidden service descriptor,
|
|
|
|
|
fall back to the v0 hidden service descriptor and log a bug message.
|
2009-07-02 16:13:01 +02:00
|
|
|
Workaround for bug 1024.
|
2009-07-07 18:19:04 +02:00
|
|
|
- Fix a log message that did not respect the SafeLogging option.
|
|
|
|
|
Resolves bug 1027.
|
2009-06-22 18:34:32 +02:00
|
|
|
|
2009-07-02 16:13:01 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- If we're a relay and we change our IP address, be more verbose
|
|
|
|
|
about the reason that made us change. Should help track down
|
|
|
|
|
further bugs for relays on dynamic IP addresses.
|
2009-06-24 06:06:53 +02:00
|
|
|
|
2009-06-22 18:34:32 +02:00
|
|
|
|
2009-08-26 20:11:53 +02:00
|
|
|
Changes in version 0.2.0.35 - 2009-06-24
|
|
|
|
|
o Security fix:
|
|
|
|
|
- Avoid crashing in the presence of certain malformed descriptors.
|
|
|
|
|
Found by lark, and by automated fuzzing.
|
|
|
|
|
- Fix an edge case where a malicious exit relay could convince a
|
|
|
|
|
controller that the client's DNS question resolves to an internal IP
|
|
|
|
|
address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Finally fix the bug where dynamic-IP relays disappear when their
|
|
|
|
|
IP address changes: directory mirrors were mistakenly telling
|
|
|
|
|
them their old address if they asked via begin_dir, so they
|
|
|
|
|
never got an accurate answer about their new address, so they
|
|
|
|
|
just vanished after a day. For belt-and-suspenders, relays that
|
|
|
|
|
don't set Address in their config now avoid using begin_dir for
|
|
|
|
|
all direct connections. Should fix bugs 827, 883, and 900.
|
|
|
|
|
- Fix a timing-dependent, allocator-dependent, DNS-related crash bug
|
|
|
|
|
that would occur on some exit nodes when DNS failures and timeouts
|
|
|
|
|
occurred in certain patterns. Fix for bug 957.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When starting with a cache over a few days old, do not leak
|
|
|
|
|
memory for the obsolete router descriptors in it. Bugfix on
|
|
|
|
|
0.2.0.33; fixes bug 672.
|
|
|
|
|
- Hidden service clients didn't use a cached service descriptor that
|
|
|
|
|
was older than 15 minutes, but wouldn't fetch a new one either,
|
|
|
|
|
because there was already one in the cache. Now, fetch a v2
|
|
|
|
|
descriptor unless the same descriptor was added to the cache within
|
|
|
|
|
the last 15 minutes. Fixes bug 997; reported by Marcus Griep.
|
|
|
|
|
|
|
|
|
|
|
2009-06-20 07:14:07 +02:00
|
|
|
Changes in version 0.2.1.16-rc - 2009-06-20
|
2009-07-24 22:53:40 +02:00
|
|
|
Tor 0.2.1.16-rc speeds up performance for fast exit relays, and fixes
|
|
|
|
|
a bunch of minor bugs.
|
|
|
|
|
|
2009-06-12 17:18:02 +02:00
|
|
|
o Security fixes:
|
|
|
|
|
- Fix an edge case where a malicious exit relay could convince a
|
|
|
|
|
controller that the client's DNS question resolves to an internal IP
|
|
|
|
|
address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.
|
|
|
|
|
|
2009-06-03 19:52:03 +02:00
|
|
|
o Major performance improvements (on 0.2.0.x):
|
|
|
|
|
- Disable and refactor some debugging checks that forced a linear scan
|
2009-06-19 15:31:07 +02:00
|
|
|
over the whole server-side DNS cache. These accounted for over 50%
|
|
|
|
|
of CPU time on a relatively busy exit node's gprof profile. Found
|
|
|
|
|
by Jacob.
|
2009-06-03 19:52:03 +02:00
|
|
|
- Disable some debugging checks that appeared in exit node profile
|
|
|
|
|
data.
|
|
|
|
|
|
2009-06-08 06:00:54 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- Update to the "June 3 2009" ip-to-country file.
|
2009-06-18 17:08:10 +02:00
|
|
|
- Do not have tor-resolve automatically refuse all .onion addresses;
|
2009-06-19 15:31:07 +02:00
|
|
|
if AutomapHostsOnResolve is set in your torrc, this will work fine.
|
2009-06-08 06:00:54 +02:00
|
|
|
|
2009-05-25 22:38:50 +02:00
|
|
|
o Minor bugfixes (on 0.2.0.x):
|
|
|
|
|
- Log correct error messages for DNS-related network errors on
|
|
|
|
|
Windows.
|
2009-06-19 15:31:07 +02:00
|
|
|
- Fix a race condition that could cause crashes or memory corruption
|
|
|
|
|
when running as a server with a controller listening for log
|
|
|
|
|
messages.
|
2009-06-07 06:03:27 +02:00
|
|
|
- Avoid crashing when we have a policy specified in a DirPolicy or
|
2009-06-19 15:31:07 +02:00
|
|
|
SocksPolicy or ReachableAddresses option with ports set on it,
|
|
|
|
|
and we re-load the policy. May fix bug 996.
|
2009-06-19 16:26:02 +02:00
|
|
|
- Hidden service clients didn't use a cached service descriptor that
|
|
|
|
|
was older than 15 minutes, but wouldn't fetch a new one either,
|
|
|
|
|
because there was already one in the cache. Now, fetch a v2
|
|
|
|
|
descriptor unless the same descriptor was added to the cache within
|
|
|
|
|
the last 15 minutes. Fixes bug 997; reported by Marcus Griep.
|
2009-05-25 22:38:50 +02:00
|
|
|
|
2009-05-27 20:11:38 +02:00
|
|
|
o Minor bugfixes (on 0.2.1.x):
|
2009-06-19 15:31:07 +02:00
|
|
|
- Don't warn users about low port and hibernation mix when they
|
|
|
|
|
provide a *ListenAddress directive to fix that. Bugfix on
|
|
|
|
|
0.2.1.15-rc.
|
2009-05-27 20:11:38 +02:00
|
|
|
- When switching back and forth between bridge mode, do not start
|
|
|
|
|
gathering GeoIP data until two hours have passed.
|
2009-05-27 20:07:41 +02:00
|
|
|
- Do not complain that the user has requested an excluded node as
|
2009-06-19 15:31:07 +02:00
|
|
|
an exit when the node is not really an exit. This could happen
|
2009-05-27 20:07:41 +02:00
|
|
|
because the circuit was for testing, or an introduction point.
|
|
|
|
|
Fix for bug 984.
|
2009-05-27 20:11:38 +02:00
|
|
|
|
2009-05-25 22:38:50 +02:00
|
|
|
|
2009-05-25 19:14:58 +02:00
|
|
|
Changes in version 0.2.1.15-rc - 2009-05-25
|
2009-07-24 22:53:40 +02:00
|
|
|
Tor 0.2.1.15-rc marks the second release candidate for the 0.2.1.x
|
|
|
|
|
series. It fixes a major bug on fast exit relays, as well as a variety
|
|
|
|
|
of more minor bugs.
|
|
|
|
|
|
2009-05-25 19:14:58 +02:00
|
|
|
o Major bugfixes (on 0.2.0.x):
|
2009-05-22 17:47:09 +02:00
|
|
|
- Fix a timing-dependent, allocator-dependent, DNS-related crash bug
|
|
|
|
|
that would occur on some exit nodes when DNS failures and timeouts
|
2009-05-25 19:14:58 +02:00
|
|
|
occurred in certain patterns. Fix for bug 957.
|
2009-05-22 17:47:09 +02:00
|
|
|
|
2009-05-25 19:14:58 +02:00
|
|
|
o Minor bugfixes (on 0.2.0.x):
|
2009-05-17 06:51:23 +02:00
|
|
|
- Actually return -1 in the error case for read_bandwidth_usage().
|
|
|
|
|
Harmless bug, since we currently don't care about the return value
|
|
|
|
|
anywhere. Bugfix on 0.2.0.9-alpha.
|
2009-05-12 19:54:21 +02:00
|
|
|
- Provide a more useful log message if bug 977 (related to buffer
|
|
|
|
|
freelists) ever reappears, and do not crash right away.
|
2009-05-25 19:14:58 +02:00
|
|
|
- Fix an assertion failure on 64-bit platforms when we allocated
|
|
|
|
|
memory right up to the end of a memarea, then realigned the memory
|
|
|
|
|
one step beyond the end. Fixes a possible cause of bug 930.
|
2009-05-12 22:17:32 +02:00
|
|
|
- Protect the count of open sockets with a mutex, so we can't
|
|
|
|
|
corrupt it when two threads are closing or opening sockets at once.
|
2009-05-25 19:14:58 +02:00
|
|
|
Fix for bug 939. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
- Don't allow a bridge to publish its router descriptor to a
|
|
|
|
|
non-bridge directory authority. Fixes part of bug 932.
|
2009-05-13 22:44:10 +02:00
|
|
|
- When we change to or from being a bridge, reset our counts of
|
2009-05-25 19:14:58 +02:00
|
|
|
client usage by country. Fixes bug 932.
|
2009-05-17 05:57:30 +02:00
|
|
|
- Fix a bug that made stream bandwidth get misreported to the
|
|
|
|
|
controller.
|
2009-05-17 07:55:02 +02:00
|
|
|
- Stop using malloc_usable_size() to use more area than we had
|
2009-05-25 19:14:58 +02:00
|
|
|
actually allocated: it was safe, but made valgrind really unhappy.
|
2009-05-17 07:22:29 +02:00
|
|
|
- Fix a memory leak when v3 directory authorities load their keys
|
|
|
|
|
and cert from disk. Bugfix on 0.2.0.1-alpha.
|
2009-05-12 19:54:21 +02:00
|
|
|
|
2009-05-25 19:14:58 +02:00
|
|
|
o Minor bugfixes (on 0.2.1.x):
|
|
|
|
|
- Fix use of freed memory when deciding to mark a non-addable
|
|
|
|
|
descriptor as never-downloadable. Bugfix on 0.2.1.9-alpha.
|
|
|
|
|
|
2009-04-24 00:04:10 +02:00
|
|
|
|
2009-04-12 09:56:58 +02:00
|
|
|
Changes in version 0.2.1.14-rc - 2009-04-12
|
2009-05-25 19:16:45 +02:00
|
|
|
Tor 0.2.1.14-rc marks the first release candidate for the 0.2.1.x
|
|
|
|
|
series. It begins fixing some major performance problems, and also
|
|
|
|
|
finally addresses the bug that was causing relays on dynamic IP
|
|
|
|
|
addresses to fall out of the directory.
|
|
|
|
|
|
2009-04-11 14:00:18 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Clients replace entry guards that were chosen more than a few months
|
|
|
|
|
ago. This change should significantly improve client performance,
|
|
|
|
|
especially once more people upgrade, since relays that have been
|
|
|
|
|
a guard for a long time are currently overloaded.
|
|
|
|
|
|
2009-04-11 20:09:15 +02:00
|
|
|
o Major bugfixes (on 0.2.0):
|
|
|
|
|
- Finally fix the bug where dynamic-IP relays disappear when their
|
2009-04-11 21:40:42 +02:00
|
|
|
IP address changes: directory mirrors were mistakenly telling
|
|
|
|
|
them their old address if they asked via begin_dir, so they
|
|
|
|
|
never got an accurate answer about their new address, so they
|
|
|
|
|
just vanished after a day. For belt-and-suspenders, relays that
|
|
|
|
|
don't set Address in their config now avoid using begin_dir for
|
|
|
|
|
all direct connections. Should fix bugs 827, 883, and 900.
|
2009-04-11 02:24:06 +02:00
|
|
|
- Relays were falling out of the networkstatus consensus for
|
2009-04-11 14:00:18 +02:00
|
|
|
part of a day if they changed their local config but the
|
|
|
|
|
authorities discarded their new descriptor as "not sufficiently
|
|
|
|
|
different". Now directory authorities accept a descriptor as changed
|
|
|
|
|
if bandwidthrate or bandwidthburst changed. Partial fix for bug 962;
|
2009-04-11 02:24:06 +02:00
|
|
|
patch by Sebastian.
|
2009-04-11 20:09:15 +02:00
|
|
|
- Avoid crashing in the presence of certain malformed descriptors.
|
|
|
|
|
Found by lark, and by automated fuzzing.
|
2009-04-11 02:24:06 +02:00
|
|
|
|
2009-04-11 02:16:05 +02:00
|
|
|
o Minor features:
|
2009-04-11 06:31:46 +02:00
|
|
|
- When generating circuit events with verbose nicknames for
|
|
|
|
|
controllers, try harder to look up nicknames for routers on a
|
|
|
|
|
circuit. (Previously, we would look in the router descriptors we had
|
|
|
|
|
for nicknames, but not in the consensus.) Partial fix for bug 941.
|
2009-04-11 02:16:05 +02:00
|
|
|
- If the bridge config line doesn't specify a port, assume 443.
|
|
|
|
|
This makes bridge lines a bit smaller and easier for users to
|
|
|
|
|
understand.
|
2009-04-12 09:56:58 +02:00
|
|
|
- Raise the minimum bandwidth to be a relay from 20000 bytes to 20480
|
|
|
|
|
bytes (aka 20KB/s), to match our documentation. Also update
|
|
|
|
|
directory authorities so they always assign the Fast flag to relays
|
|
|
|
|
with 20KB/s of capacity. Now people running relays won't suddenly
|
|
|
|
|
find themselves not seeing any use, if the network gets faster
|
|
|
|
|
on average.
|
2009-04-12 10:09:38 +02:00
|
|
|
- Update to the "April 3 2009" ip-to-country file.
|
2009-04-11 02:16:05 +02:00
|
|
|
|
2009-03-09 23:05:17 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Avoid trying to print raw memory to the logs when we decide to
|
|
|
|
|
give up on downloading a given relay descriptor. Bugfix on
|
|
|
|
|
0.2.1.9-alpha.
|
2009-03-10 01:52:45 +01:00
|
|
|
- In tor-resolve, when the Tor client to use is specified by
|
|
|
|
|
<hostname>:<port>, actually use the specified port rather than
|
|
|
|
|
defaulting to 9050. Bugfix on 0.2.1.6-alpha.
|
2009-03-11 23:08:37 +01:00
|
|
|
- Make directory usage recording work again. Bugfix on 0.2.1.6-alpha.
|
2009-03-16 19:47:45 +01:00
|
|
|
- When starting with a cache over a few days old, do not leak
|
2009-04-11 06:31:46 +02:00
|
|
|
memory for the obsolete router descriptors in it. Bugfix on
|
2009-03-16 19:47:45 +01:00
|
|
|
0.2.0.33.
|
2009-03-18 15:35:24 +01:00
|
|
|
- Avoid double-free on list of successfully uploaded hidden
|
2009-04-11 06:31:46 +02:00
|
|
|
service discriptors. Fix for bug 948. Bugfix on 0.2.1.6-alpha.
|
2009-03-21 12:52:53 +01:00
|
|
|
- Change memarea_strndup() implementation to work even when
|
2009-04-11 06:31:46 +02:00
|
|
|
duplicating a string at the end of a page. This bug was
|
2009-03-21 12:52:53 +01:00
|
|
|
harmless for now, but could have meant crashes later. Fix by
|
2009-04-11 06:31:46 +02:00
|
|
|
lark. Bugfix on 0.2.1.1-alpha.
|
2009-03-31 06:03:37 +02:00
|
|
|
- Limit uploaded directory documents to be 16M rather than 500K.
|
|
|
|
|
The directory authorities were refusing v3 consensus votes from
|
|
|
|
|
other authorities, since the votes are now 504K. Fixes bug 959;
|
|
|
|
|
bugfix on 0.0.2pre17 (where we raised it from 50K to 500K ;).
|
2009-03-31 03:29:07 +02:00
|
|
|
- Directory authorities should never send a 503 "busy" response to
|
|
|
|
|
requests for votes or keys. Bugfix on 0.2.0.8-alpha; exposed by
|
|
|
|
|
bug 959.
|
2009-03-09 23:05:17 +01:00
|
|
|
|
|
|
|
|
|
2009-03-09 01:55:59 +01:00
|
|
|
Changes in version 0.2.1.13-alpha - 2009-03-09
|
2009-03-13 05:47:12 +01:00
|
|
|
Tor 0.2.1.13-alpha includes another big pile of minor bugfixes and
|
|
|
|
|
cleanups. We're finally getting close to a release candidate.
|
|
|
|
|
|
2009-02-16 16:15:06 +01:00
|
|
|
o Major bugfixes:
|
2009-03-09 01:43:03 +01:00
|
|
|
- Correctly update the list of which countries we exclude as
|
|
|
|
|
exits, when the GeoIP file is loaded or reloaded. Diagnosed by
|
|
|
|
|
lark. Bugfix on 0.2.1.6-alpha.
|
2009-02-16 16:15:06 +01:00
|
|
|
|
2009-03-09 01:43:03 +01:00
|
|
|
o Minor bugfixes (on 0.2.0.x and earlier):
|
2009-02-09 17:07:02 +01:00
|
|
|
- Automatically detect MacOSX versions earlier than 10.4.0, and
|
|
|
|
|
disable kqueue from inside Tor when running with these versions.
|
|
|
|
|
We previously did this from the startup script, but that was no
|
2009-03-09 01:43:03 +01:00
|
|
|
help to people who didn't use the startup script. Resolves bug 863.
|
2009-02-09 17:55:48 +01:00
|
|
|
- When we had picked an exit node for a connection, but marked it as
|
|
|
|
|
"optional", and it turned out we had no onion key for the exit,
|
2009-03-09 01:43:03 +01:00
|
|
|
stop wanting that exit and try again. This situation may not
|
|
|
|
|
be possible now, but will probably become feasible with proposal
|
|
|
|
|
158. Spotted by rovv. Fixes another case of bug 752.
|
2009-02-10 21:28:30 +01:00
|
|
|
- Clients no longer cache certificates for authorities they do not
|
2009-03-09 01:43:03 +01:00
|
|
|
recognize. Bugfix on 0.2.0.9-alpha.
|
2009-02-11 18:23:11 +01:00
|
|
|
- When we can't transmit a DNS request due to a network error, retry
|
2009-03-09 01:43:03 +01:00
|
|
|
it after a while, and eventually transmit a failing response to
|
|
|
|
|
the RESOLVED cell. Bugfix on 0.1.2.5-alpha.
|
2009-02-13 05:11:14 +01:00
|
|
|
- If the controller claimed responsibility for a stream, but that
|
|
|
|
|
stream never finished making its connection, it would live
|
|
|
|
|
forever in circuit_wait state. Now we close it after SocksTimeout
|
|
|
|
|
seconds. Bugfix on 0.1.2.7-alpha; reported by Mike Perry.
|
2009-03-09 01:43:03 +01:00
|
|
|
- Drop begin cells to a hidden service if they come from the middle
|
|
|
|
|
of a circuit. Patch from lark.
|
|
|
|
|
- When we erroneously receive two EXTEND cells for the same circuit
|
|
|
|
|
ID on the same connection, drop the second. Patch from lark.
|
2009-02-23 21:04:51 +01:00
|
|
|
- Fix a crash that occurs on exit nodes when a nameserver request
|
2009-03-09 01:43:03 +01:00
|
|
|
timed out. Bugfix on 0.1.2.1-alpha; our CLEAR debugging code had
|
|
|
|
|
been suppressing the bug since 0.1.2.10-alpha. Partial fix for
|
|
|
|
|
bug 929.
|
2009-03-02 20:15:05 +01:00
|
|
|
- Do not assume that a stack-allocated character array will be
|
|
|
|
|
64-bit aligned on platforms that demand that uint64_t access is
|
2009-03-09 01:43:03 +01:00
|
|
|
aligned. Possible fix for bug 604.
|
2009-03-03 19:02:36 +01:00
|
|
|
- Parse dates and IPv4 addresses in a locale- and libc-independent
|
|
|
|
|
manner, to avoid platform-dependent behavior on malformed input.
|
2009-03-09 00:18:44 +01:00
|
|
|
- Build correctly when configured to build outside the main source
|
2009-03-09 01:43:03 +01:00
|
|
|
path. Patch from Michael Gold.
|
2009-03-09 01:53:42 +01:00
|
|
|
- We were already rejecting relay begin cells with destination port
|
|
|
|
|
of 0. Now also reject extend cells with destination port or address
|
|
|
|
|
of 0. Suggested by lark.
|
2009-03-09 01:43:03 +01:00
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.1.x):
|
|
|
|
|
- Don't re-extend introduction circuits if we ran out of RELAY_EARLY
|
|
|
|
|
cells. Bugfix on 0.2.1.3-alpha. Fixes more of bug 878.
|
|
|
|
|
- If we're an exit node, scrub the IP address to which we are exiting
|
|
|
|
|
in the logs. Bugfix on 0.2.1.8-alpha.
|
2009-02-09 17:07:02 +01:00
|
|
|
|
2009-02-09 16:20:17 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- On Linux, use the prctl call to re-enable core dumps when the user
|
|
|
|
|
is option is set.
|
2009-02-16 11:39:10 +01:00
|
|
|
- New controller event NEWCONSENSUS that lists the networkstatus
|
|
|
|
|
lines for every recommended relay. Now controllers like Torflow
|
|
|
|
|
can keep up-to-date on which relays they should be using.
|
2009-03-05 11:47:25 +01:00
|
|
|
- Update to the "February 26 2009" ip-to-country file.
|
2009-02-09 16:09:51 +01:00
|
|
|
|
2009-03-09 01:43:03 +01:00
|
|
|
|
2009-02-11 23:21:50 +01:00
|
|
|
Changes in version 0.2.0.34 - 2009-02-08
|
|
|
|
|
Tor 0.2.0.34 features several more security-related fixes. You should
|
|
|
|
|
upgrade, especially if you run an exit relay (remote crash) or a
|
|
|
|
|
directory authority (remote infinite loop), or you're on an older
|
|
|
|
|
(pre-XP) or not-recently-patched Windows (remote exploit).
|
|
|
|
|
|
|
|
|
|
This release marks end-of-life for Tor 0.1.2.x. Those Tor versions
|
|
|
|
|
have many known flaws, and nobody should be using them. You should
|
|
|
|
|
upgrade. If you're using a Linux or BSD and its packages are obsolete,
|
|
|
|
|
stop using those packages and upgrade anyway.
|
|
|
|
|
|
|
|
|
|
o Security fixes:
|
|
|
|
|
- Fix an infinite-loop bug on handling corrupt votes under certain
|
|
|
|
|
circumstances. Bugfix on 0.2.0.8-alpha.
|
|
|
|
|
- Fix a temporary DoS vulnerability that could be performed by
|
|
|
|
|
a directory mirror. Bugfix on 0.2.0.9-alpha; reported by lark.
|
|
|
|
|
- Avoid a potential crash on exit nodes when processing malformed
|
|
|
|
|
input. Remote DoS opportunity. Bugfix on 0.2.0.33.
|
|
|
|
|
- Do not accept incomplete ipv4 addresses (like 192.168.0) as valid.
|
|
|
|
|
Spec conformance issue. Bugfix on Tor 0.0.2pre27.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix compilation on systems where time_t is a 64-bit integer.
|
|
|
|
|
Patch from Matthias Drochner.
|
|
|
|
|
- Don't consider expiring already-closed client connections. Fixes
|
|
|
|
|
bug 893. Bugfix on 0.0.2pre20.
|
|
|
|
|
|
|
|
|
|
|
2009-02-08 06:00:39 +01:00
|
|
|
Changes in version 0.2.1.12-alpha - 2009-02-08
|
2009-02-11 23:21:50 +01:00
|
|
|
Tor 0.2.1.12-alpha features several more security-related fixes. You
|
|
|
|
|
should upgrade, especially if you run an exit relay (remote crash) or
|
|
|
|
|
a directory authority (remote infinite loop), or you're on an older
|
|
|
|
|
(pre-XP) or not-recently-patched Windows (remote exploit). It also
|
|
|
|
|
includes a big pile of minor bugfixes and cleanups.
|
|
|
|
|
|
2009-02-09 04:12:07 +01:00
|
|
|
o Security fixes:
|
2009-01-31 19:27:38 +01:00
|
|
|
- Fix an infinite-loop bug on handling corrupt votes under certain
|
2009-02-05 00:13:51 +01:00
|
|
|
circumstances. Bugfix on 0.2.0.8-alpha.
|
2009-02-09 04:21:43 +01:00
|
|
|
- Fix a temporary DoS vulnerability that could be performed by
|
|
|
|
|
a directory mirror. Bugfix on 0.2.0.9-alpha; reported by lark.
|
2009-02-09 04:13:02 +01:00
|
|
|
- Avoid a potential crash on exit nodes when processing malformed
|
2009-02-09 04:21:43 +01:00
|
|
|
input. Remote DoS opportunity. Bugfix on 0.2.1.7-alpha.
|
2009-01-31 19:27:38 +01:00
|
|
|
|
2009-01-21 04:24:27 +01:00
|
|
|
o Minor bugfixes:
|
2009-02-09 04:24:53 +01:00
|
|
|
- Let controllers actually ask for the "clients_seen" event for
|
|
|
|
|
getting usage summaries on bridge relays. Bugfix on 0.2.1.10-alpha;
|
|
|
|
|
reported by Matt Edman.
|
2009-02-05 00:13:51 +01:00
|
|
|
- Fix a compile warning on OSX Panther. Fixes bug 913; bugfix against
|
2009-01-21 04:51:14 +01:00
|
|
|
0.2.1.11-alpha.
|
2009-01-21 08:24:50 +01:00
|
|
|
- Fix a bug in address parsing that was preventing bridges or hidden
|
|
|
|
|
service targets from being at IPv6 addresses.
|
2009-01-21 16:38:39 +01:00
|
|
|
- Solve a bug that kept hardware crypto acceleration from getting
|
2009-02-05 00:13:51 +01:00
|
|
|
enabled when accounting was turned on. Fixes bug 907. Bugfix on
|
2009-01-21 16:38:39 +01:00
|
|
|
0.0.9pre6.
|
2009-01-22 20:06:28 +01:00
|
|
|
- Remove a bash-ism from configure.in to build properly on non-Linux
|
2009-02-05 00:13:51 +01:00
|
|
|
platforms. Bugfix on 0.2.1.1-alpha.
|
2009-01-28 17:06:46 +01:00
|
|
|
- Fix code so authorities _actually_ send back X-Descriptor-Not-New
|
2009-02-05 00:13:51 +01:00
|
|
|
headers. Bugfix on 0.2.0.10-alpha.
|
2009-02-08 06:00:39 +01:00
|
|
|
- Don't consider expiring already-closed client connections. Fixes
|
|
|
|
|
bug 893. Bugfix on 0.0.2pre20.
|
2009-01-28 18:36:41 +01:00
|
|
|
- Fix another interesting corner-case of bug 891 spotted by rovv:
|
2009-02-05 00:13:51 +01:00
|
|
|
Previously, if two hosts had different amounts of clock drift, and
|
|
|
|
|
one of them created a new connection with just the wrong timing,
|
|
|
|
|
the other might decide to deprecate the new connection erroneously.
|
|
|
|
|
Bugfix on 0.1.1.13-alpha.
|
2009-01-28 19:26:20 +01:00
|
|
|
- Resolve a very rare crash bug that could occur when the user forced
|
|
|
|
|
a nameserver reconfiguration during the middle of a nameserver
|
2009-02-05 00:13:51 +01:00
|
|
|
probe. Fixes bug 526. Bugfix on 0.1.2.1-alpha.
|
2009-01-28 20:53:03 +01:00
|
|
|
- Support changing value of ServerDNSRandomizeCase during SIGHUP.
|
|
|
|
|
Bugfix on 0.2.1.7-alpha.
|
2009-02-05 00:27:35 +01:00
|
|
|
- If we're using bridges and our network goes away, be more willing
|
|
|
|
|
to forgive our bridges and try again when we get an application
|
|
|
|
|
request. Bugfix on 0.2.0.x.
|
2009-01-21 03:51:30 +01:00
|
|
|
|
2009-01-22 17:28:12 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Support platforms where time_t is 64 bits long. (Congratulations,
|
2009-01-28 08:16:22 +01:00
|
|
|
NetBSD!) Patch from Matthias Drochner.
|
|
|
|
|
- Add a 'getinfo status/clients-seen' controller command, in case
|
|
|
|
|
controllers want to hear clients_seen events but connect late.
|
2009-01-22 17:28:12 +01:00
|
|
|
|
2009-02-05 00:13:51 +01:00
|
|
|
o Build changes:
|
2009-01-31 08:51:02 +01:00
|
|
|
- Disable GCC's strict alias optimization by default, to avoid the
|
|
|
|
|
likelihood of its introducing subtle bugs whenever our code violates
|
|
|
|
|
the letter of C99's alias rules.
|
|
|
|
|
|
2009-01-21 03:51:30 +01:00
|
|
|
|
2009-02-11 23:21:50 +01:00
|
|
|
Changes in version 0.2.0.33 - 2009-01-21
|
|
|
|
|
Tor 0.2.0.33 fixes a variety of bugs that were making relays less
|
|
|
|
|
useful to users. It also finally fixes a bug where a relay or client
|
|
|
|
|
that's been off for many days would take a long time to bootstrap.
|
|
|
|
|
|
|
|
|
|
This update also fixes an important security-related bug reported by
|
|
|
|
|
Ilja van Sprundel. You should upgrade. (We'll send out more details
|
|
|
|
|
about the bug once people have had some time to upgrade.)
|
|
|
|
|
|
|
|
|
|
o Security fixes:
|
|
|
|
|
- Fix a heap-corruption bug that may be remotely triggerable on
|
|
|
|
|
some platforms. Reported by Ilja van Sprundel.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- When a stream at an exit relay is in state "resolving" or
|
|
|
|
|
"connecting" and it receives an "end" relay cell, the exit relay
|
|
|
|
|
would silently ignore the end cell and not close the stream. If
|
|
|
|
|
the client never closes the circuit, then the exit relay never
|
|
|
|
|
closes the TCP connection. Bug introduced in Tor 0.1.2.1-alpha;
|
|
|
|
|
reported by "wood".
|
|
|
|
|
- When sending CREATED cells back for a given circuit, use a 64-bit
|
|
|
|
|
connection ID to find the right connection, rather than an addr:port
|
|
|
|
|
combination. Now that we can have multiple OR connections between
|
|
|
|
|
the same ORs, it is no longer possible to use addr:port to uniquely
|
|
|
|
|
identify a connection.
|
|
|
|
|
- Bridge relays that had DirPort set to 0 would stop fetching
|
|
|
|
|
descriptors shortly after startup, and then briefly resume
|
|
|
|
|
after a new bandwidth test and/or after publishing a new bridge
|
|
|
|
|
descriptor. Bridge users that try to bootstrap from them would
|
|
|
|
|
get a recent networkstatus but would get descriptors from up to
|
|
|
|
|
18 hours earlier, meaning most of the descriptors were obsolete
|
|
|
|
|
already. Reported by Tas; bugfix on 0.2.0.13-alpha.
|
|
|
|
|
- Prevent bridge relays from serving their 'extrainfo' document
|
|
|
|
|
to anybody who asks, now that extrainfo docs include potentially
|
|
|
|
|
sensitive aggregated client geoip summaries. Bugfix on
|
|
|
|
|
0.2.0.13-alpha.
|
|
|
|
|
- If the cached networkstatus consensus is more than five days old,
|
|
|
|
|
discard it rather than trying to use it. In theory it could be
|
|
|
|
|
useful because it lists alternate directory mirrors, but in practice
|
|
|
|
|
it just means we spend many minutes trying directory mirrors that
|
|
|
|
|
are long gone from the network. Also discard router descriptors as
|
|
|
|
|
we load them if they are more than five days old, since the onion
|
|
|
|
|
key is probably wrong by now. Bugfix on 0.2.0.x. Fixes bug 887.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Do not mark smartlist_bsearch_idx() function as ATTR_PURE. This bug
|
|
|
|
|
could make gcc generate non-functional binary search code. Bugfix
|
|
|
|
|
on 0.2.0.10-alpha.
|
|
|
|
|
- Build correctly on platforms without socklen_t.
|
|
|
|
|
- Compile without warnings on solaris.
|
|
|
|
|
- Avoid potential crash on internal error during signature collection.
|
|
|
|
|
Fixes bug 864. Patch from rovv.
|
|
|
|
|
- Correct handling of possible malformed authority signing key
|
|
|
|
|
certificates with internal signature types. Fixes bug 880.
|
|
|
|
|
Bugfix on 0.2.0.3-alpha.
|
|
|
|
|
- Fix a hard-to-trigger resource leak when logging credential status.
|
|
|
|
|
CID 349.
|
|
|
|
|
- When we can't initialize DNS because the network is down, do not
|
|
|
|
|
automatically stop Tor from starting. Instead, we retry failed
|
|
|
|
|
dns_init() every 10 minutes, and change the exit policy to reject
|
|
|
|
|
*:* until one succeeds. Fixes bug 691.
|
|
|
|
|
- Use 64 bits instead of 32 bits for connection identifiers used with
|
|
|
|
|
the controller protocol, to greatly reduce risk of identifier reuse.
|
|
|
|
|
- When we're choosing an exit node for a circuit, and we have
|
|
|
|
|
no pending streams, choose a good general exit rather than one that
|
|
|
|
|
supports "all the pending streams". Bugfix on 0.1.1.x. Fix by rovv.
|
|
|
|
|
- Fix another case of assuming, when a specific exit is requested,
|
|
|
|
|
that we know more than the user about what hosts it allows.
|
|
|
|
|
Fixes one case of bug 752. Patch from rovv.
|
|
|
|
|
- Clip the MaxCircuitDirtiness config option to a minimum of 10
|
|
|
|
|
seconds. Warn the user if lower values are given in the
|
|
|
|
|
configuration. Bugfix on 0.1.0.1-rc. Patch by Sebastian.
|
|
|
|
|
- Clip the CircuitBuildTimeout to a minimum of 30 seconds. Warn the
|
|
|
|
|
user if lower values are given in the configuration. Bugfix on
|
|
|
|
|
0.1.1.17-rc. Patch by Sebastian.
|
|
|
|
|
- Fix a memory leak when we decline to add a v2 rendezvous descriptor to
|
|
|
|
|
the cache because we already had a v0 descriptor with the same ID.
|
|
|
|
|
Bugfix on 0.2.0.18-alpha.
|
|
|
|
|
- Fix a race condition when freeing keys shared between main thread
|
|
|
|
|
and CPU workers that could result in a memory leak. Bugfix on
|
|
|
|
|
0.1.0.1-rc. Fixes bug 889.
|
|
|
|
|
- Send a valid END cell back when a client tries to connect to a
|
|
|
|
|
nonexistent hidden service port. Bugfix on 0.1.2.15. Fixes bug
|
|
|
|
|
840. Patch from rovv.
|
|
|
|
|
- Check which hops rendezvous stream cells are associated with to
|
|
|
|
|
prevent possible guess-the-streamid injection attacks from
|
|
|
|
|
intermediate hops. Fixes another case of bug 446. Based on patch
|
|
|
|
|
from rovv.
|
|
|
|
|
- If a broken client asks a non-exit router to connect somewhere,
|
|
|
|
|
do not even do the DNS lookup before rejecting the connection.
|
|
|
|
|
Fixes another case of bug 619. Patch from rovv.
|
|
|
|
|
- When a relay gets a create cell it can't decrypt (e.g. because it's
|
|
|
|
|
using the wrong onion key), we were dropping it and letting the
|
|
|
|
|
client time out. Now actually answer with a destroy cell. Fixes
|
|
|
|
|
bug 904. Bugfix on 0.0.2pre8.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (hidden services):
|
|
|
|
|
- Do not throw away existing introduction points on SIGHUP. Bugfix on
|
|
|
|
|
0.0.6pre1. Patch by Karsten. Fixes bug 874.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Report the case where all signatures in a detached set are rejected
|
|
|
|
|
differently than the case where there is an error handling the
|
|
|
|
|
detached set.
|
|
|
|
|
- When we realize that another process has modified our cached
|
|
|
|
|
descriptors, print out a more useful error message rather than
|
|
|
|
|
triggering an assertion. Fixes bug 885. Patch from Karsten.
|
|
|
|
|
- Implement the 0x20 hack to better resist DNS poisoning: set the
|
|
|
|
|
case on outgoing DNS requests randomly, and reject responses that do
|
|
|
|
|
not match the case correctly. This logic can be disabled with the
|
|
|
|
|
ServerDNSRamdomizeCase setting, if you are using one of the 0.3%
|
|
|
|
|
of servers that do not reliably preserve case in replies. See
|
|
|
|
|
"Increased DNS Forgery Resistance through 0x20-Bit Encoding"
|
|
|
|
|
for more info.
|
|
|
|
|
- Check DNS replies for more matching fields to better resist DNS
|
|
|
|
|
poisoning.
|
|
|
|
|
- Never use OpenSSL compression: it wastes RAM and CPU trying to
|
|
|
|
|
compress cells, which are basically all encrypted, compressed, or
|
|
|
|
|
both.
|
|
|
|
|
|
|
|
|
|
|
2009-01-21 00:33:04 +01:00
|
|
|
Changes in version 0.2.1.11-alpha - 2009-01-20
|
2009-02-11 23:21:50 +01:00
|
|
|
Tor 0.2.1.11-alpha finishes fixing the "if your Tor is off for a
|
|
|
|
|
week it will take a long time to bootstrap again" bug. It also fixes
|
|
|
|
|
an important security-related bug reported by Ilja van Sprundel. You
|
|
|
|
|
should upgrade. (We'll send out more details about the bug once people
|
|
|
|
|
have had some time to upgrade.)
|
|
|
|
|
|
2009-01-21 00:33:04 +01:00
|
|
|
o Security fixes:
|
|
|
|
|
- Fix a heap-corruption bug that may be remotely triggerable on
|
|
|
|
|
some platforms. Reported by Ilja van Sprundel.
|
|
|
|
|
|
2009-01-07 03:13:42 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Discard router descriptors as we load them if they are more than
|
|
|
|
|
five days old. Otherwise if Tor is off for a long time and then
|
|
|
|
|
starts with cached descriptors, it will try to use the onion
|
|
|
|
|
keys in those obsolete descriptors when building circuits. Bugfix
|
|
|
|
|
on 0.2.0.x. Fixes bug 887.
|
|
|
|
|
|
2009-01-07 22:05:02 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Try to make sure that the version of Libevent we're running with
|
2009-01-21 00:33:04 +01:00
|
|
|
is binary-compatible with the one we built with. May address bug
|
2009-01-07 22:05:02 +01:00
|
|
|
897 and others.
|
2009-01-21 00:33:04 +01:00
|
|
|
- Make setting ServerDNSRandomizeCase to 0 actually work. Bugfix
|
|
|
|
|
for bug 905. Bugfix on 0.2.1.7-alpha.
|
2009-01-16 00:07:11 +01:00
|
|
|
- Add a new --enable-local-appdata configuration switch to change
|
|
|
|
|
the default location of the datadir on win32 from APPDATA to
|
2009-01-21 00:33:04 +01:00
|
|
|
LOCAL_APPDATA. In the future, we should migrate to LOCAL_APPDATA
|
|
|
|
|
entirely. Patch from coderman.
|
2009-01-07 22:05:02 +01:00
|
|
|
|
2009-01-06 21:50:55 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Make outbound DNS packets respect the OutboundBindAddress setting.
|
2009-01-06 22:28:48 +01:00
|
|
|
Fixes the bug part of bug 798. Bugfix on 0.1.2.2-alpha.
|
|
|
|
|
- When our circuit fails at the first hop (e.g. we get a destroy
|
|
|
|
|
cell back), avoid using that OR connection anymore, and also
|
|
|
|
|
tell all the one-hop directory requests waiting for it that they
|
|
|
|
|
should fail. Bugfix on 0.2.1.3-alpha.
|
2009-01-21 00:33:04 +01:00
|
|
|
- In the torify(1) manpage, mention that tsocks will leak your
|
2009-01-18 02:05:17 +01:00
|
|
|
DNS requests.
|
2009-01-06 22:28:48 +01:00
|
|
|
|
2009-01-06 21:38:05 +01:00
|
|
|
|
2009-01-06 21:11:47 +01:00
|
|
|
Changes in version 0.2.1.10-alpha - 2009-01-06
|
2009-03-09 01:43:03 +01:00
|
|
|
Tor 0.2.1.10-alpha fixes two major bugs in bridge relays (one that
|
|
|
|
|
would make the bridge relay not so useful if it had DirPort set to 0,
|
|
|
|
|
and one that could let an attacker learn a little bit of information
|
|
|
|
|
about the bridge's users), and a bug that would cause your Tor relay
|
|
|
|
|
to ignore a circuit create request it can't decrypt (rather than reply
|
|
|
|
|
with an error). It also fixes a wide variety of other bugs.
|
|
|
|
|
|
2009-01-05 17:56:11 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- If the cached networkstatus consensus is more than five days old,
|
|
|
|
|
discard it rather than trying to use it. In theory it could
|
|
|
|
|
be useful because it lists alternate directory mirrors, but in
|
|
|
|
|
practice it just means we spend many minutes trying directory
|
|
|
|
|
mirrors that are long gone from the network. Helps bug 887 a bit;
|
|
|
|
|
bugfix on 0.2.0.x.
|
2009-01-05 19:54:11 +01:00
|
|
|
- Bridge relays that had DirPort set to 0 would stop fetching
|
|
|
|
|
descriptors shortly after startup, and then briefly resume
|
|
|
|
|
after a new bandwidth test and/or after publishing a new bridge
|
|
|
|
|
descriptor. Bridge users that try to bootstrap from them would
|
|
|
|
|
get a recent networkstatus but would get descriptors from up to
|
|
|
|
|
18 hours earlier, meaning most of the descriptors were obsolete
|
|
|
|
|
already. Reported by Tas; bugfix on 0.2.0.13-alpha.
|
2009-01-06 17:03:38 +01:00
|
|
|
- Prevent bridge relays from serving their 'extrainfo' document
|
|
|
|
|
to anybody who asks, now that extrainfo docs include potentially
|
2009-01-06 17:11:10 +01:00
|
|
|
sensitive aggregated client geoip summaries. Bugfix on
|
|
|
|
|
0.2.0.13-alpha.
|
2009-01-05 17:56:11 +01:00
|
|
|
|
2008-12-27 07:50:07 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- New controller event "clients_seen" to report a geoip-based summary
|
|
|
|
|
of which countries we've seen clients from recently. Now controllers
|
|
|
|
|
like Vidalia can show bridge operators that they're actually making
|
|
|
|
|
a difference.
|
2008-12-29 03:20:57 +01:00
|
|
|
- Build correctly against versions of OpenSSL 0.9.8 or later built
|
|
|
|
|
without support for deprecated functions.
|
2009-01-06 19:03:01 +01:00
|
|
|
- Update to the "December 19 2008" ip-to-country file.
|
2008-12-27 07:50:07 +01:00
|
|
|
|
2009-01-06 21:11:47 +01:00
|
|
|
o Minor bugfixes (on 0.2.0.x):
|
2009-01-21 00:33:04 +01:00
|
|
|
- Authorities now vote for the Stable flag for any router whose
|
2008-12-29 21:17:18 +01:00
|
|
|
weighted MTBF is at least 5 days, regardless of the mean MTBF.
|
2009-01-04 20:47:12 +01:00
|
|
|
- Do not remove routers as too old if we do not have any consensus
|
2009-01-06 04:57:06 +01:00
|
|
|
document. Bugfix on 0.2.0.7-alpha.
|
2009-01-04 20:47:17 +01:00
|
|
|
- Do not accept incomplete ipv4 addresses (like 192.168.0) as valid.
|
2009-01-06 04:57:06 +01:00
|
|
|
Spec conformance issue. Bugfix on Tor 0.0.2pre27.
|
|
|
|
|
- When an exit relay resolves a stream address to a local IP address,
|
|
|
|
|
do not just keep retrying that same exit relay over and
|
2009-01-06 21:11:47 +01:00
|
|
|
over. Instead, just close the stream. Addresses bug 872. Bugfix
|
|
|
|
|
on 0.2.0.32. Patch from rovv.
|
2009-01-05 21:52:14 +01:00
|
|
|
- If a hidden service sends us an END cell, do not consider
|
2009-01-06 04:57:06 +01:00
|
|
|
retrying the connection; just close it. Patch from rovv.
|
2009-01-06 08:13:24 +01:00
|
|
|
- When we made bridge authorities stop serving bridge descriptors over
|
|
|
|
|
unencrypted links, we also broke DirPort reachability testing for
|
|
|
|
|
bridges. So bridges with a non-zero DirPort were printing spurious
|
|
|
|
|
warns to their logs. Bugfix on 0.2.0.16-alpha. Fixes bug 709.
|
2009-01-06 20:03:15 +01:00
|
|
|
- When a relay gets a create cell it can't decrypt (e.g. because it's
|
|
|
|
|
using the wrong onion key), we were dropping it and letting the
|
2009-01-06 20:07:21 +01:00
|
|
|
client time out. Now actually answer with a destroy cell. Fixes
|
|
|
|
|
bug 904. Bugfix on 0.0.2pre8.
|
2009-01-06 21:11:47 +01:00
|
|
|
- Squeeze 2-5% out of client performance (according to oprofile) by
|
|
|
|
|
improving the implementation of some policy-manipulation functions.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.1.x):
|
|
|
|
|
- Make get_interface_address() function work properly again; stop
|
|
|
|
|
guessing the wrong parts of our address as our address.
|
|
|
|
|
- Do not cannibalize a circuit if we're out of RELAY_EARLY cells to
|
|
|
|
|
send on that circuit. Otherwise we might violate the proposal-110
|
2009-02-10 01:45:30 +01:00
|
|
|
limit. Bugfix on 0.2.1.3-alpha. Partial fix for bug 878. Diagnosis
|
2009-01-06 21:11:47 +01:00
|
|
|
thanks to Karsten.
|
|
|
|
|
- When we're sending non-EXTEND cells to the first hop in a circuit,
|
|
|
|
|
for example to use an encrypted directory connection, we don't need
|
|
|
|
|
to use RELAY_EARLY cells: the first hop knows what kind of cell
|
|
|
|
|
it is, and nobody else can even see the cell type. Conserving
|
|
|
|
|
RELAY_EARLY cells makes it easier to cannibalize circuits like
|
|
|
|
|
this later.
|
|
|
|
|
- Stop logging nameserver addresses in reverse order.
|
|
|
|
|
- If we are retrying a directory download slowly over and over, do
|
|
|
|
|
not automatically give up after the 254th failure. Bugfix on
|
|
|
|
|
0.2.1.9-alpha.
|
|
|
|
|
- Resume reporting accurate "stream end" reasons to the local control
|
|
|
|
|
port. They were lost in the changes for Proposal 148. Bugfix on
|
|
|
|
|
0.2.1.9-alpha.
|
2008-12-26 22:26:03 +01:00
|
|
|
|
2009-01-04 01:35:51 +01:00
|
|
|
o Deprecated and removed features:
|
2009-01-06 04:57:06 +01:00
|
|
|
- The old "tor --version --version" command, which would print out
|
|
|
|
|
the subversion "Id" of most of the source files, is now removed. It
|
2009-01-04 01:35:51 +01:00
|
|
|
turned out to be less useful than we'd expected, and harder to
|
|
|
|
|
maintain.
|
|
|
|
|
|
2008-12-29 03:21:02 +01:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Change our header file guard macros to be less likely to conflict
|
2009-01-06 04:57:06 +01:00
|
|
|
with system headers. Adam Langley noticed that we were conflicting
|
2008-12-29 03:21:02 +01:00
|
|
|
with log.h on Android.
|
2009-01-06 04:57:06 +01:00
|
|
|
- Tool-assisted documentation cleanup. Nearly every function or
|
|
|
|
|
static variable in Tor should have its own documentation now.
|
2008-12-29 03:21:02 +01:00
|
|
|
|
2008-12-26 22:26:03 +01:00
|
|
|
|
2008-12-25 21:32:49 +01:00
|
|
|
Changes in version 0.2.1.9-alpha - 2008-12-25
|
2009-01-05 15:32:58 +01:00
|
|
|
Tor 0.2.1.9-alpha fixes many more bugs, some of them security-related.
|
|
|
|
|
|
2008-12-25 22:02:50 +01:00
|
|
|
o New directory authorities:
|
|
|
|
|
- gabelmoo (the authority run by Karsten Loesing) now has a new
|
|
|
|
|
IP address.
|
|
|
|
|
|
2008-12-25 16:37:47 +01:00
|
|
|
o Security fixes:
|
2008-12-15 22:17:53 +01:00
|
|
|
- Never use a connection with a mismatched address to extend a
|
2008-12-25 16:37:47 +01:00
|
|
|
circuit, unless that connection is canonical. A canonical
|
2008-12-15 22:17:53 +01:00
|
|
|
connection is one whose address is authenticated by the router's
|
|
|
|
|
identity key, either in a NETINFO cell or in a router descriptor.
|
2008-12-25 22:02:50 +01:00
|
|
|
- Avoid a possible memory corruption bug when receiving hidden service
|
|
|
|
|
descriptors. Bugfix on 0.2.1.6-alpha.
|
2008-12-15 22:17:53 +01:00
|
|
|
|
2008-12-10 23:57:41 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a logic error that would automatically reject all but the first
|
2008-12-17 23:46:00 +01:00
|
|
|
configured DNS server. Bugfix on 0.2.1.5-alpha. Possible fix for
|
|
|
|
|
part of bug 813/868. Bug spotted by coderman.
|
2008-12-14 20:40:56 +01:00
|
|
|
- When a stream at an exit relay is in state "resolving" or
|
|
|
|
|
"connecting" and it receives an "end" relay cell, the exit relay
|
|
|
|
|
would silently ignore the end cell and not close the stream. If
|
|
|
|
|
the client never closes the circuit, then the exit relay never
|
2008-12-25 22:02:50 +01:00
|
|
|
closes the TCP connection. Bug introduced in 0.1.2.1-alpha;
|
2008-12-14 20:40:56 +01:00
|
|
|
reported by "wood".
|
2008-12-25 22:02:50 +01:00
|
|
|
- When we can't initialize DNS because the network is down, do not
|
|
|
|
|
automatically stop Tor from starting. Instead, retry failed
|
2009-02-04 16:20:50 +01:00
|
|
|
dns_init() every 10 minutes, and change the exit policy to reject
|
2008-12-25 22:02:50 +01:00
|
|
|
*:* until one succeeds. Fixes bug 691.
|
2008-12-10 23:57:41 +01:00
|
|
|
|
2008-12-10 00:26:12 +01:00
|
|
|
o Minor features:
|
2008-12-17 23:46:00 +01:00
|
|
|
- Give a better error message when an overzealous init script says
|
|
|
|
|
"sudo -u username tor --user username". Makes Bug 882 easier for
|
|
|
|
|
users to diagnose.
|
2008-12-10 02:46:51 +01:00
|
|
|
- When a directory authority gives us a new guess for our IP address,
|
|
|
|
|
log which authority we used. Hopefully this will help us debug
|
|
|
|
|
the recent complaints about bad IP address guesses.
|
2008-12-11 07:52:24 +01:00
|
|
|
- Detect svn revision properly when we're using git-svn.
|
2008-12-17 23:46:00 +01:00
|
|
|
- Try not to open more than one descriptor-downloading connection
|
|
|
|
|
to an authority at once. This should reduce load on directory
|
|
|
|
|
authorities. Fixes bug 366.
|
2008-12-12 19:31:39 +01:00
|
|
|
- Add cross-certification to newly generated certificates, so that
|
2008-12-25 22:02:50 +01:00
|
|
|
a signing key is enough information to look up a certificate.
|
2008-12-12 19:31:39 +01:00
|
|
|
Partial implementation of proposal 157.
|
2008-12-12 20:05:36 +01:00
|
|
|
- Start serving certificates by <identity digest, signing key digest>
|
2008-12-17 23:46:00 +01:00
|
|
|
pairs. Partial implementation of proposal 157.
|
2008-12-12 21:30:42 +01:00
|
|
|
- Clients now never report any stream end reason except 'MISC'.
|
|
|
|
|
Implements proposal 148.
|
2008-12-18 18:18:06 +01:00
|
|
|
- On platforms with a maximum syslog string length, truncate syslog
|
|
|
|
|
messages to that length ourselves, rather than relying on the
|
|
|
|
|
system to do it for us.
|
2008-12-25 21:32:49 +01:00
|
|
|
- Optimize out calls to time(NULL) that occur for every IO operation,
|
2008-12-25 22:02:50 +01:00
|
|
|
or for every cell. On systems where time() is a slow syscall,
|
|
|
|
|
this fix will be slightly helpful.
|
2008-12-19 19:52:00 +01:00
|
|
|
- Exit servers can now answer resolve requests for ip6.arpa addresses.
|
2008-12-25 21:32:49 +01:00
|
|
|
- When we download a descriptor that we then immediately (as
|
|
|
|
|
a directory authority) reject, do not retry downloading it right
|
|
|
|
|
away. Should save some bandwidth on authorities. Fix for bug
|
|
|
|
|
888. Patch by Sebastian Hahn.
|
|
|
|
|
- When a download gets us zero good descriptors, do not notify
|
|
|
|
|
Tor that new directory information has arrived.
|
|
|
|
|
- Avoid some nasty corner cases in the logic for marking connections
|
2009-01-28 18:36:37 +01:00
|
|
|
as too old or obsolete or noncanonical for circuits. Partial
|
|
|
|
|
bugfix on bug 891.
|
2008-12-10 00:26:12 +01:00
|
|
|
|
2008-12-09 19:16:41 +01:00
|
|
|
o Minor features (controller):
|
2008-12-09 20:55:19 +01:00
|
|
|
- New CONSENSUS_ARRIVED event to note when a new consensus has
|
|
|
|
|
been fetched and validated.
|
2008-12-10 04:01:26 +01:00
|
|
|
- When we realize that another process has modified our cached
|
2008-12-25 22:02:50 +01:00
|
|
|
descriptors file, print out a more useful error message rather
|
|
|
|
|
than triggering an assertion. Fixes bug 885. Patch from Karsten.
|
2008-12-17 23:46:00 +01:00
|
|
|
- Add an internal-use-only __ReloadTorrcOnSIGHUP option for
|
|
|
|
|
controllers to prevent SIGHUP from reloading the
|
|
|
|
|
configuration. Fixes bug 856.
|
2008-12-09 21:48:22 +01:00
|
|
|
|
2008-12-10 02:34:24 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Resume using the correct "REASON=" stream when telling the
|
|
|
|
|
controller why we closed a stream. Bugfix in 0.2.1.1-alpha.
|
2008-12-15 22:17:43 +01:00
|
|
|
- When a canonical connection appears later in our internal list
|
|
|
|
|
than a noncanonical one for a given OR ID, always use the
|
2008-12-17 23:46:00 +01:00
|
|
|
canonical one. Bugfix on 0.2.0.12-alpha. Fixes bug 805.
|
2008-12-15 22:17:43 +01:00
|
|
|
Spotted by rovv.
|
2008-12-17 23:32:17 +01:00
|
|
|
- Clip the MaxCircuitDirtiness config option to a minimum of 10
|
|
|
|
|
seconds. Warn the user if lower values are given in the
|
|
|
|
|
configuration. Bugfix on 0.1.0.1-rc. Patch by Sebastian.
|
|
|
|
|
- Clip the CircuitBuildTimeout to a minimum of 30 seconds. Warn the
|
|
|
|
|
user if lower values are given in the configuration. Bugfix on
|
|
|
|
|
0.1.1.17-rc. Patch by Sebastian.
|
2008-12-18 06:28:27 +01:00
|
|
|
- Fix a race condition when freeing keys shared between main thread
|
2008-12-25 22:02:50 +01:00
|
|
|
and CPU workers that could result in a memory leak. Bugfix on
|
|
|
|
|
0.1.0.1-rc. Fixes bug 889.
|
2008-12-10 02:34:24 +01:00
|
|
|
|
2008-12-10 19:16:58 +01:00
|
|
|
o Minor bugfixes (hidden services):
|
2008-12-25 22:02:50 +01:00
|
|
|
- Do not throw away existing introduction points on SIGHUP (bugfix on
|
|
|
|
|
0.0.6pre1); also, do not stall hidden services because we're
|
|
|
|
|
throwing away introduction points; bugfix on 0.2.1.7-alpha. Spotted
|
2008-12-17 23:46:00 +01:00
|
|
|
by John Brooks. Patch by Karsten. Fixes bug 874.
|
2008-12-25 21:32:49 +01:00
|
|
|
- Fix a memory leak when we decline to add a v2 rendezvous
|
|
|
|
|
descriptor to the cache because we already had a v0 descriptor
|
|
|
|
|
with the same ID. Bugfix on 0.2.0.18-alpha.
|
2008-12-10 19:16:58 +01:00
|
|
|
|
2008-12-18 00:02:04 +01:00
|
|
|
o Deprecated and removed features:
|
2008-12-25 16:37:47 +01:00
|
|
|
- RedirectExits has been removed. It was deprecated since
|
|
|
|
|
0.2.0.3-alpha.
|
|
|
|
|
- Finally remove deprecated "EXTENDED_FORMAT" controller feature. It
|
|
|
|
|
has been called EXTENDED_EVENTS since 0.1.2.4-alpha.
|
2008-12-18 18:28:50 +01:00
|
|
|
- Cell pools are now always enabled; --disable-cell-pools is ignored.
|
2008-12-18 00:02:04 +01:00
|
|
|
|
2008-12-17 15:59:19 +01:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Rename the confusing or_is_obsolete field to the more appropriate
|
2008-12-17 23:46:00 +01:00
|
|
|
is_bad_for_new_circs, and move it to or_connection_t where it
|
|
|
|
|
belongs.
|
2008-12-17 15:59:28 +01:00
|
|
|
- Move edge-only flags from connection_t to edge_connection_t: not
|
|
|
|
|
only is this better coding, but on machines of plausible alignment,
|
2008-12-17 23:46:00 +01:00
|
|
|
it should save 4-8 bytes per connection_t. "Every little bit helps."
|
2008-12-17 23:58:14 +01:00
|
|
|
- Rename ServerDNSAllowBrokenResolvConf to ServerDNSAllowBrokenConfig
|
|
|
|
|
for consistency; keep old option working for backward compatibility.
|
2008-12-24 03:41:36 +01:00
|
|
|
- Simplify the code for finding connections to use for a circuit.
|
2008-12-17 15:59:19 +01:00
|
|
|
|
2008-12-09 19:16:41 +01:00
|
|
|
|
2008-12-08 00:53:39 +01:00
|
|
|
Changes in version 0.2.1.8-alpha - 2008-12-08
|
2008-12-11 18:18:03 +01:00
|
|
|
Tor 0.2.1.8-alpha fixes some crash bugs in earlier alpha releases,
|
|
|
|
|
builds better on unusual platforms like Solaris and old OS X, and
|
|
|
|
|
fixes a variety of other issues.
|
|
|
|
|
|
2008-12-07 02:34:45 +01:00
|
|
|
o Major features:
|
|
|
|
|
- New DirPortFrontPage option that takes an html file and publishes
|
|
|
|
|
it as "/" on the DirPort. Now relay operators can provide a
|
|
|
|
|
disclaimer without needing to set up a separate webserver. There's
|
|
|
|
|
a sample disclaimer in contrib/tor-exit-notice.html.
|
2008-12-07 02:21:19 +01:00
|
|
|
|
2008-12-08 01:04:29 +01:00
|
|
|
o Security fixes:
|
|
|
|
|
- When the client is choosing entry guards, now it selects at most
|
|
|
|
|
one guard from a given relay family. Otherwise we could end up with
|
|
|
|
|
all of our entry points into the network run by the same operator.
|
|
|
|
|
Suggested by Camilo Viecco. Fix on 0.1.1.11-alpha.
|
|
|
|
|
|
2008-11-11 17:35:46 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a DOS opportunity during the voting signature collection process
|
|
|
|
|
at directory authorities. Spotted by rovv. Bugfix on 0.2.0.x.
|
2008-11-16 02:52:44 +01:00
|
|
|
- Fix a possible segfault when establishing an exit connection. Bugfix
|
|
|
|
|
on 0.2.1.5-alpha.
|
2008-11-11 17:35:46 +01:00
|
|
|
|
2008-11-11 16:29:40 +01:00
|
|
|
o Minor bugfixes:
|
2008-12-07 01:30:14 +01:00
|
|
|
- Get file locking working on win32. Bugfix on 0.2.1.6-alpha. Fixes
|
2008-11-11 16:29:40 +01:00
|
|
|
bug 859.
|
2008-12-07 01:30:14 +01:00
|
|
|
- Made Tor a little less aggressive about deleting expired
|
|
|
|
|
certificates. Partial fix for bug 854.
|
2008-11-12 15:41:44 +01:00
|
|
|
- Stop doing unaligned memory access that generated bus errors on
|
2008-12-07 01:30:14 +01:00
|
|
|
sparc64. Bugfix on 0.2.0.10-alpha. Fix for bug 862.
|
|
|
|
|
- Fix a crash bug when changing EntryNodes from the controller. Bugfix
|
|
|
|
|
on 0.2.1.6-alpha. Fix for bug 867. Patched by Sebastian.
|
|
|
|
|
- Make USR2 log-level switch take effect immediately. Bugfix on
|
2008-11-17 20:58:51 +01:00
|
|
|
0.1.2.8-beta.
|
2008-11-22 22:46:34 +01:00
|
|
|
- If one win32 nameserver fails to get added, continue adding the
|
|
|
|
|
rest, and don't automatically fail.
|
2008-12-07 01:30:14 +01:00
|
|
|
- Use fcntl() for locking when flock() is not available. Should fix
|
|
|
|
|
compilation on Solaris. Should fix Bug 873. Bugfix on 0.2.1.6-alpha.
|
|
|
|
|
- Do not mark smartlist_bsearch_idx() function as ATTR_PURE. This bug
|
2008-11-26 17:57:46 +01:00
|
|
|
could make gcc generate non-functional binary search code. Bugfix
|
|
|
|
|
on 0.2.0.10-alpha.
|
2008-12-02 19:54:47 +01:00
|
|
|
- Build correctly on platforms without socklen_t.
|
2008-12-02 20:13:23 +01:00
|
|
|
- Avoid potential crash on internal error during signature collection.
|
2008-12-07 01:30:14 +01:00
|
|
|
Fixes bug 864. Patch from rovv.
|
|
|
|
|
- Do not use C's stdio library for writing to log files. This will
|
|
|
|
|
improve logging performance by a minute amount, and will stop
|
|
|
|
|
leaking fds when our disk is full. Fixes bug 861.
|
2008-12-03 00:49:40 +01:00
|
|
|
- Stop erroneous use of O_APPEND in cases where we did not in fact
|
|
|
|
|
want to re-seek to the end of a file before every last write().
|
2008-12-03 04:42:19 +01:00
|
|
|
- Correct handling of possible malformed authority signing key
|
2008-12-07 01:30:14 +01:00
|
|
|
certificates with internal signature types. Fixes bug 880. Bugfix
|
|
|
|
|
on 0.2.0.3-alpha.
|
2008-12-05 02:29:59 +01:00
|
|
|
- Fix a hard-to-trigger resource leak when logging credential status.
|
|
|
|
|
CID 349.
|
2008-12-02 20:13:23 +01:00
|
|
|
|
|
|
|
|
o Minor features:
|
2008-12-08 00:53:39 +01:00
|
|
|
- Directory mirrors no longer fetch the v1 directory or
|
|
|
|
|
running-routers files. They are obsolete, and nobody asks for them
|
|
|
|
|
anymore. This is the first step to making v1 authorities obsolete.
|
2008-11-11 16:29:40 +01:00
|
|
|
|
2008-11-11 16:59:24 +01:00
|
|
|
o Minor features (controller):
|
2008-12-07 01:30:14 +01:00
|
|
|
- Return circuit purposes in response to GETINFO circuit-status. Fixes
|
2008-11-11 16:59:24 +01:00
|
|
|
bug 858.
|
2008-11-11 16:29:40 +01:00
|
|
|
|
2008-11-22 06:14:12 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.2.0.32 - 2008-11-20
|
2008-12-11 18:18:03 +01:00
|
|
|
Tor 0.2.0.32 fixes a major security problem in Debian and Ubuntu
|
|
|
|
|
packages (and maybe other packages) noticed by Theo de Raadt, fixes
|
|
|
|
|
a smaller security flaw that might allow an attacker to access local
|
|
|
|
|
services, further improves hidden service performance, and fixes a
|
|
|
|
|
variety of other issues.
|
|
|
|
|
|
2008-11-22 06:14:12 +01:00
|
|
|
o Security fixes:
|
|
|
|
|
- The "User" and "Group" config options did not clear the
|
|
|
|
|
supplementary group entries for the Tor process. The "User" option
|
|
|
|
|
is now more robust, and we now set the groups to the specified
|
|
|
|
|
user's primary group. The "Group" option is now ignored. For more
|
|
|
|
|
detailed logging on credential switching, set CREDENTIAL_LOG_LEVEL
|
|
|
|
|
in common/compat.c to LOG_NOTICE or higher. Patch by Jacob Appelbaum
|
|
|
|
|
and Steven Murdoch. Bugfix on 0.0.2pre14. Fixes bug 848 and 857.
|
|
|
|
|
- The "ClientDNSRejectInternalAddresses" config option wasn't being
|
|
|
|
|
consistently obeyed: if an exit relay refuses a stream because its
|
|
|
|
|
exit policy doesn't allow it, we would remember what IP address
|
|
|
|
|
the relay said the destination address resolves to, even if it's
|
|
|
|
|
an internal IP address. Bugfix on 0.2.0.7-alpha; patch by rovv.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a DOS opportunity during the voting signature collection process
|
|
|
|
|
at directory authorities. Spotted by rovv. Bugfix on 0.2.0.x.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (hidden services):
|
|
|
|
|
- When fetching v0 and v2 rendezvous service descriptors in parallel,
|
|
|
|
|
we were failing the whole hidden service request when the v0
|
|
|
|
|
descriptor fetch fails, even if the v2 fetch is still pending and
|
|
|
|
|
might succeed. Similarly, if the last v2 fetch fails, we were
|
|
|
|
|
failing the whole hidden service request even if a v0 fetch is
|
|
|
|
|
still pending. Fixes bug 814. Bugfix on 0.2.0.10-alpha.
|
|
|
|
|
- When extending a circuit to a hidden service directory to upload a
|
|
|
|
|
rendezvous descriptor using a BEGIN_DIR cell, almost 1/6 of all
|
|
|
|
|
requests failed, because the router descriptor has not been
|
|
|
|
|
downloaded yet. In these cases, do not attempt to upload the
|
|
|
|
|
rendezvous descriptor, but wait until the router descriptor is
|
|
|
|
|
downloaded and retry. Likewise, do not attempt to fetch a rendezvous
|
|
|
|
|
descriptor from a hidden service directory for which the router
|
|
|
|
|
descriptor has not yet been downloaded. Fixes bug 767. Bugfix
|
|
|
|
|
on 0.2.0.10-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix several infrequent memory leaks spotted by Coverity.
|
|
|
|
|
- When testing for libevent functions, set the LDFLAGS variable
|
|
|
|
|
correctly. Found by Riastradh.
|
|
|
|
|
- Avoid a bug where the FastFirstHopPK 0 option would keep Tor from
|
|
|
|
|
bootstrapping with tunneled directory connections. Bugfix on
|
|
|
|
|
0.1.2.5-alpha. Fixes bug 797. Found by Erwin Lam.
|
|
|
|
|
- When asked to connect to A.B.exit:80, if we don't know the IP for A
|
|
|
|
|
and we know that server B rejects most-but-not all connections to
|
|
|
|
|
port 80, we would previously reject the connection. Now, we assume
|
|
|
|
|
the user knows what they were asking for. Fixes bug 752. Bugfix
|
|
|
|
|
on 0.0.9rc5. Diagnosed by BarkerJr.
|
|
|
|
|
- If we overrun our per-second write limits a little, count this as
|
|
|
|
|
having used up our write allocation for the second, and choke
|
|
|
|
|
outgoing directory writes. Previously, we had only counted this when
|
|
|
|
|
we had met our limits precisely. Fixes bug 824. Patch from by rovv.
|
|
|
|
|
Bugfix on 0.2.0.x (??).
|
|
|
|
|
- Remove the old v2 directory authority 'lefkada' from the default
|
|
|
|
|
list. It has been gone for many months.
|
|
|
|
|
- Stop doing unaligned memory access that generated bus errors on
|
|
|
|
|
sparc64. Bugfix on 0.2.0.10-alpha. Fixes bug 862.
|
|
|
|
|
- Make USR2 log-level switch take effect immediately. Bugfix on
|
|
|
|
|
0.1.2.8-beta.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (controller):
|
|
|
|
|
- Make DNS resolved events into "CLOSED", not "FAILED". Bugfix on
|
|
|
|
|
0.1.2.5-alpha. Fix by Robert Hogan. Resolves bug 807.
|
|
|
|
|
|
|
|
|
|
|
2008-11-08 07:43:32 +01:00
|
|
|
Changes in version 0.2.1.7-alpha - 2008-11-08
|
2008-12-11 18:18:03 +01:00
|
|
|
Tor 0.2.1.7-alpha fixes a major security problem in Debian and Ubuntu
|
|
|
|
|
packages (and maybe other packages) noticed by Theo de Raadt, fixes
|
|
|
|
|
a smaller security flaw that might allow an attacker to access local
|
|
|
|
|
services, adds better defense against DNS poisoning attacks on exit
|
|
|
|
|
relays, further improves hidden service performance, and fixes a
|
|
|
|
|
variety of other issues.
|
|
|
|
|
|
2008-10-18 00:08:49 +02:00
|
|
|
o Security fixes:
|
|
|
|
|
- The "ClientDNSRejectInternalAddresses" config option wasn't being
|
|
|
|
|
consistently obeyed: if an exit relay refuses a stream because its
|
|
|
|
|
exit policy doesn't allow it, we would remember what IP address
|
|
|
|
|
the relay said the destination address resolves to, even if it's
|
|
|
|
|
an internal IP address. Bugfix on 0.2.0.7-alpha; patch by rovv.
|
2008-11-07 03:06:12 +01:00
|
|
|
- The "User" and "Group" config options did not clear the
|
2008-11-07 06:11:41 +01:00
|
|
|
supplementary group entries for the Tor process. The "User" option
|
|
|
|
|
is now more robust, and we now set the groups to the specified
|
|
|
|
|
user's primary group. The "Group" option is now ignored. For more
|
|
|
|
|
detailed logging on credential switching, set CREDENTIAL_LOG_LEVEL
|
|
|
|
|
in common/compat.c to LOG_NOTICE or higher. Patch by Jacob Appelbaum
|
2008-11-08 07:43:32 +01:00
|
|
|
and Steven Murdoch. Bugfix on 0.0.2pre14. Fixes bug 848.
|
|
|
|
|
- Do not use or believe expired v3 authority certificates. Patch
|
|
|
|
|
from Karsten. Bugfix in 0.2.0.x. Fixes bug 851.
|
2008-10-18 00:08:49 +02:00
|
|
|
|
2008-10-01 05:41:33 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- Now NodeFamily and MyFamily config options allow spaces in
|
|
|
|
|
identity fingerprints, so it's easier to paste them in.
|
|
|
|
|
Suggested by Lucky Green.
|
2008-11-07 06:11:41 +01:00
|
|
|
- Implement the 0x20 hack to better resist DNS poisoning: set the
|
|
|
|
|
case on outgoing DNS requests randomly, and reject responses that do
|
|
|
|
|
not match the case correctly. This logic can be disabled with the
|
2009-01-10 15:38:14 +01:00
|
|
|
ServerDNSRandomizeCase setting, if you are using one of the 0.3%
|
2008-11-07 06:11:41 +01:00
|
|
|
of servers that do not reliably preserve case in replies. See
|
|
|
|
|
"Increased DNS Forgery Resistance through 0x20-Bit Encoding"
|
|
|
|
|
for more info.
|
2008-10-29 16:31:26 +01:00
|
|
|
- Preserve case in replies to DNSPort requests in order to support
|
|
|
|
|
the 0x20 hack for resisting DNS poisoning attacks.
|
2008-10-15 22:59:48 +02:00
|
|
|
|
|
|
|
|
o Hidden service performance improvements:
|
2008-10-16 00:01:17 +02:00
|
|
|
- When the client launches an introduction circuit, retry with a
|
|
|
|
|
new circuit after 30 seconds rather than 60 seconds.
|
2008-10-15 20:52:06 +02:00
|
|
|
- Launch a second client-side introduction circuit in parallel
|
|
|
|
|
after a delay of 15 seconds (based on work by Christian Wilms).
|
2008-10-15 22:59:48 +02:00
|
|
|
- Hidden services start out building five intro circuits rather
|
|
|
|
|
than three, and when the first three finish they publish a service
|
|
|
|
|
descriptor using those. Now we publish our service descriptor much
|
|
|
|
|
faster after restart.
|
2008-10-01 05:41:33 +02:00
|
|
|
|
2008-10-13 05:34:29 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Minor fix in the warning messages when you're having problems
|
|
|
|
|
bootstrapping; also, be more forgiving of bootstrap problems when
|
|
|
|
|
we're still making incremental progress on a given bootstrap phase.
|
2008-10-15 22:59:48 +02:00
|
|
|
- When we're choosing an exit node for a circuit, and we have
|
|
|
|
|
no pending streams, choose a good general exit rather than one that
|
|
|
|
|
supports "all the pending streams". Bugfix on 0.1.1.x. Fix by rovv.
|
2008-10-21 18:41:20 +02:00
|
|
|
- Send a valid END cell back when a client tries to connect to a
|
2008-11-07 06:11:41 +01:00
|
|
|
nonexistent hidden service port. Bugfix on 0.1.2.15. Fixes bug
|
|
|
|
|
840. Patch from rovv.
|
2008-10-21 18:51:59 +02:00
|
|
|
- If a broken client asks a non-exit router to connect somewhere,
|
|
|
|
|
do not even do the DNS lookup before rejecting the connection.
|
2008-11-07 06:11:41 +01:00
|
|
|
Fixes another case of bug 619. Patch from rovv.
|
2008-10-21 19:09:04 +02:00
|
|
|
- Fix another case of assuming, when a specific exit is requested,
|
|
|
|
|
that we know more than the user about what hosts it allows.
|
2008-11-07 06:11:41 +01:00
|
|
|
Fixes another case of bug 752. Patch from rovv.
|
2008-10-27 17:46:45 +01:00
|
|
|
- Check which hops rendezvous stream cells are associated with to
|
|
|
|
|
prevent possible guess-the-streamid injection attacks from
|
2008-11-07 06:11:41 +01:00
|
|
|
intermediate hops. Fixes another case of bug 446. Based on patch
|
2008-10-27 17:46:45 +01:00
|
|
|
from rovv.
|
2008-10-29 14:29:54 +01:00
|
|
|
- Avoid using a negative right-shift when comparing 32-bit
|
2008-11-07 06:11:41 +01:00
|
|
|
addresses. Possible fix for bug 845 and bug 811.
|
2008-11-01 21:28:10 +01:00
|
|
|
- Make the assert_circuit_ok() function work correctly on circuits that
|
|
|
|
|
have already been marked for close.
|
2008-11-03 17:36:15 +01:00
|
|
|
- Fix read-off-the-end-of-string error in unit tests when decoding
|
|
|
|
|
introduction points.
|
2008-11-05 21:34:22 +01:00
|
|
|
- Fix uninitialized size field for memory area allocation: may improve
|
|
|
|
|
memory performance during directory parsing.
|
2008-11-07 15:01:44 +01:00
|
|
|
- Treat duplicate certificate fetches as failures, so that we do
|
|
|
|
|
not try to re-fetch an expired certificate over and over and over.
|
|
|
|
|
- Do not say we're fetching a certificate when we'll in fact skip it
|
|
|
|
|
because of a pending download.
|
2008-10-13 05:34:29 +02:00
|
|
|
|
2008-10-01 05:41:33 +02:00
|
|
|
|
2008-09-30 11:37:18 +02:00
|
|
|
Changes in version 0.2.1.6-alpha - 2008-09-30
|
2008-10-12 02:51:02 +02:00
|
|
|
Tor 0.2.1.6-alpha further improves performance and robustness of
|
|
|
|
|
hidden services, starts work on supporting per-country relay selection,
|
|
|
|
|
and fixes a variety of smaller issues.
|
|
|
|
|
|
2008-09-24 16:44:29 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Implement proposal 121: make it possible to build hidden services
|
2008-09-29 08:54:32 +02:00
|
|
|
that only certain clients are allowed to connect to. This is
|
|
|
|
|
enforced at several points, so that unauthorized clients are unable
|
|
|
|
|
to send INTRODUCE cells to the service, or even (depending on the
|
|
|
|
|
type of authentication) to learn introduction points. This feature
|
|
|
|
|
raises the bar for certain kinds of active attacks against hidden
|
|
|
|
|
services. Code by Karsten Loesing.
|
|
|
|
|
- Relays now store and serve v2 hidden service descriptors by default,
|
|
|
|
|
i.e., the new default value for HidServDirectoryV2 is 1. This is
|
|
|
|
|
the last step in proposal 114, which aims to make hidden service
|
|
|
|
|
lookups more reliable.
|
2008-09-30 11:37:18 +02:00
|
|
|
- Start work to allow node restrictions to include country codes. The
|
|
|
|
|
syntax to exclude nodes in a country with country code XX is
|
|
|
|
|
"ExcludeNodes {XX}". Patch from Robert Hogan. It still needs some
|
|
|
|
|
refinement to decide what config options should take priority if
|
|
|
|
|
you ask to both use a particular node and exclude it.
|
2008-09-29 08:54:32 +02:00
|
|
|
- Allow ExitNodes list to include IP ranges and country codes, just
|
|
|
|
|
like the Exclude*Nodes lists. Patch from Robert Hogan.
|
2008-09-24 16:44:29 +02:00
|
|
|
|
2008-09-09 08:25:39 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a bug when parsing ports in tor_addr_port_parse() that caused
|
|
|
|
|
Tor to fail to start if you had it configured to use a bridge
|
|
|
|
|
relay. Fixes bug 809. Bugfix on 0.2.1.5-alpha.
|
2008-09-09 10:41:58 +02:00
|
|
|
- When extending a circuit to a hidden service directory to upload a
|
|
|
|
|
rendezvous descriptor using a BEGIN_DIR cell, almost 1/6 of all
|
2008-09-29 08:54:32 +02:00
|
|
|
requests failed, because the router descriptor had not been
|
|
|
|
|
downloaded yet. In these cases, we now wait until the router
|
|
|
|
|
descriptor is downloaded, and then retry. Likewise, clients
|
|
|
|
|
now skip over a hidden service directory if they don't yet have
|
|
|
|
|
its router descriptor, rather than futilely requesting it and
|
|
|
|
|
putting mysterious complaints in the logs. Fixes bug 767. Bugfix
|
2008-09-09 11:21:21 +02:00
|
|
|
on 0.2.0.10-alpha.
|
2008-09-24 19:01:43 +02:00
|
|
|
- When fetching v0 and v2 rendezvous service descriptors in parallel,
|
|
|
|
|
we were failing the whole hidden service request when the v0
|
|
|
|
|
descriptor fetch fails, even if the v2 fetch is still pending and
|
|
|
|
|
might succeed. Similarly, if the last v2 fetch fails, we were
|
|
|
|
|
failing the whole hidden service request even if a v0 fetch is
|
|
|
|
|
still pending. Fixes bug 814. Bugfix on 0.2.0.10-alpha.
|
|
|
|
|
- DNS replies need to have names matching their requests, but
|
|
|
|
|
these names should be in the questions section, not necessarily
|
|
|
|
|
in the answers section. Fixes bug 823. Bugfix on 0.2.1.5-alpha.
|
|
|
|
|
|
2008-09-29 11:30:06 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- Update to the "September 1 2008" ip-to-country file.
|
|
|
|
|
- Allow ports 465 and 587 in the default exit policy again. We had
|
|
|
|
|
rejected them in 0.1.0.15, because back in 2005 they were commonly
|
|
|
|
|
misconfigured and ended up as spam targets. We hear they are better
|
|
|
|
|
locked down these days.
|
|
|
|
|
- Use a lockfile to make sure that two Tor processes are not
|
|
|
|
|
simultaneously running with the same datadir.
|
|
|
|
|
- Serve the latest v3 networkstatus consensus via the control
|
|
|
|
|
port. Use "getinfo dir/status-vote/current/consensus" to fetch it.
|
|
|
|
|
- Better logging about stability/reliability calculations on directory
|
|
|
|
|
servers.
|
|
|
|
|
- Drop the requirement to have an open dir port for storing and
|
|
|
|
|
serving v2 hidden service descriptors.
|
|
|
|
|
- Directory authorities now serve a /tor/dbg-stability.txt URL to
|
|
|
|
|
help debug WFU and MTBF calculations.
|
|
|
|
|
- Implement most of Proposal 152: allow specialized servers to permit
|
|
|
|
|
single-hop circuits, and clients to use those servers to build
|
|
|
|
|
single-hop circuits when using a specialized controller. Patch
|
|
|
|
|
from Josh Albrecht. Resolves feature request 768.
|
2008-09-29 16:18:47 +02:00
|
|
|
- Add a -p option to tor-resolve for specifying the SOCKS port: some
|
|
|
|
|
people find host:port too confusing.
|
2008-09-29 16:53:53 +02:00
|
|
|
- Make TrackHostExit mappings expire a while after their last use, not
|
2008-11-07 06:11:41 +01:00
|
|
|
after their creation. Patch from Robert Hogan.
|
2008-09-30 00:34:22 +02:00
|
|
|
- Provide circuit purposes along with circuit events to the controller.
|
2008-09-29 11:30:06 +02:00
|
|
|
|
2008-09-01 10:01:22 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix compile on OpenBSD 4.4-current. Bugfix on 0.2.1.5-alpha.
|
|
|
|
|
Reported by Tas.
|
2008-09-24 19:01:43 +02:00
|
|
|
- Fixed some memory leaks -- some quite frequent, some almost
|
|
|
|
|
impossible to trigger -- based on results from Coverity.
|
2008-09-08 03:57:02 +02:00
|
|
|
- When testing for libevent functions, set the LDFLAGS variable
|
2008-09-24 19:01:43 +02:00
|
|
|
correctly. Found by Riastradh.
|
2008-09-09 05:48:01 +02:00
|
|
|
- Fix an assertion bug in parsing policy-related options; possible fix
|
|
|
|
|
for bug 811.
|
2008-09-09 08:25:39 +02:00
|
|
|
- Catch and report a few more bootstrapping failure cases when Tor
|
|
|
|
|
fails to establish a TCP connection. Cleanup on 0.2.1.x.
|
2008-09-23 23:01:54 +02:00
|
|
|
- Avoid a bug where the FastFirstHopPK 0 option would keep Tor from
|
|
|
|
|
bootstrapping with tunneled directory connections. Bugfix on
|
|
|
|
|
0.1.2.5-alpha. Fixes bug 797. Found by Erwin Lam.
|
2008-09-23 22:25:01 +02:00
|
|
|
- When asked to connect to A.B.exit:80, if we don't know the IP for A
|
2008-09-23 23:01:54 +02:00
|
|
|
and we know that server B rejects most-but-not all connections to
|
|
|
|
|
port 80, we would previously reject the connection. Now, we assume
|
|
|
|
|
the user knows what they were asking for. Fixes bug 752. Bugfix
|
|
|
|
|
on 0.0.9rc5. Diagnosed by BarkerJr.
|
2008-09-25 00:29:22 +02:00
|
|
|
- If we are not using BEGIN_DIR cells, don't attempt to contact hidden
|
2008-09-29 08:54:32 +02:00
|
|
|
service directories if they have no advertised dir port. Bugfix
|
|
|
|
|
on 0.2.0.10-alpha.
|
2008-09-26 17:30:26 +02:00
|
|
|
- If we overrun our per-second write limits a little, count this as
|
2008-09-29 08:54:32 +02:00
|
|
|
having used up our write allocation for the second, and choke
|
|
|
|
|
outgoing directory writes. Previously, we had only counted this when
|
2008-10-18 00:08:49 +02:00
|
|
|
we had met our limits precisely. Fixes bug 824. Patch by rovv.
|
2008-09-26 17:30:26 +02:00
|
|
|
Bugfix on 0.2.0.x (??).
|
2008-09-29 08:54:32 +02:00
|
|
|
- Avoid a "0 divided by 0" calculation when calculating router uptime
|
|
|
|
|
at directory authorities. Bugfix on 0.2.0.8-alpha.
|
2008-09-29 11:30:06 +02:00
|
|
|
- Make DNS resolved controller events into "CLOSED", not
|
|
|
|
|
"FAILED". Bugfix on 0.1.2.5-alpha. Fix by Robert Hogan. Resolves
|
|
|
|
|
bug 807.
|
2008-09-29 11:36:42 +02:00
|
|
|
- Fix a bug where an unreachable relay would establish enough
|
|
|
|
|
reachability testing circuits to do a bandwidth test -- if
|
|
|
|
|
we already have a connection to the middle hop of the testing
|
|
|
|
|
circuit, then it could establish the last hop by using the existing
|
|
|
|
|
connection. Bugfix on 0.1.2.2-alpha, exposed when we made testing
|
|
|
|
|
circuits no longer use entry guards in 0.2.1.3-alpha.
|
2008-09-29 12:09:05 +02:00
|
|
|
- If we have correct permissions on $datadir, we complain to stdout
|
|
|
|
|
and fail to start. But dangerous permissions on
|
|
|
|
|
$datadir/cached-status/ would cause us to open a log and complain
|
|
|
|
|
there. Now complain to stdout and fail to start in both cases. Fixes
|
|
|
|
|
bug 820, reported by seeess.
|
2008-09-29 21:27:20 +02:00
|
|
|
- Remove the old v2 directory authority 'lefkada' from the default
|
|
|
|
|
list. It has been gone for many months.
|
2008-09-01 22:06:26 +02:00
|
|
|
|
2008-09-06 00:09:44 +02:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Revise the connection_new functions so that a more typesafe variant
|
2008-09-24 19:01:43 +02:00
|
|
|
exists. This will work better with Coverity, and let us find any
|
2008-09-29 08:54:32 +02:00
|
|
|
actual mistakes we're making here.
|
2008-09-24 19:01:43 +02:00
|
|
|
- Refactor unit testing logic so that dmalloc can be used sensibly
|
|
|
|
|
with unit tests to check for memory leaks.
|
2008-09-24 16:44:29 +02:00
|
|
|
- Move all hidden-service related fields from connection and circuit
|
|
|
|
|
structure to substructures: this way they won't eat so much memory.
|
2008-09-01 10:01:22 +02:00
|
|
|
|
2008-09-16 12:26:15 +02:00
|
|
|
|
2008-09-08 21:50:29 +02:00
|
|
|
Changes in version 0.2.0.31 - 2008-09-03
|
|
|
|
|
Tor 0.2.0.31 addresses two potential anonymity issues, starts to fix
|
|
|
|
|
a big bug we're seeing where in rare cases traffic from one Tor stream
|
|
|
|
|
gets mixed into another stream, and fixes a variety of smaller issues.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Make sure that two circuits can never exist on the same connection
|
|
|
|
|
with the same circuit ID, even if one is marked for close. This
|
|
|
|
|
is conceivably a bugfix for bug 779. Bugfix on 0.1.0.4-rc.
|
|
|
|
|
- Relays now reject risky extend cells: if the extend cell includes
|
|
|
|
|
a digest of all zeroes, or asks to extend back to the relay that
|
|
|
|
|
sent the extend cell, tear down the circuit. Ideas suggested
|
|
|
|
|
by rovv.
|
|
|
|
|
- If not enough of our entry guards are available so we add a new
|
|
|
|
|
one, we might use the new one even if it overlapped with the
|
|
|
|
|
current circuit's exit relay (or its family). Anonymity bugfix
|
|
|
|
|
pointed out by rovv.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Recover 3-7 bytes that were wasted per memory chunk. Fixes bug
|
|
|
|
|
794; bug spotted by rovv. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
- Correctly detect the presence of the linux/netfilter_ipv4.h header
|
|
|
|
|
when building against recent kernels. Bugfix on 0.1.2.1-alpha.
|
|
|
|
|
- Pick size of default geoip filename string correctly on windows.
|
|
|
|
|
Fixes bug 806. Bugfix on 0.2.0.30.
|
|
|
|
|
- Make the autoconf script accept the obsolete --with-ssl-dir
|
|
|
|
|
option as an alias for the actually-working --with-openssl-dir
|
|
|
|
|
option. Fix the help documentation to recommend --with-openssl-dir.
|
|
|
|
|
Based on a patch by "Dave". Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
- When using the TransPort option on OpenBSD, and using the User
|
|
|
|
|
option to change UID and drop privileges, make sure to open
|
|
|
|
|
/dev/pf before dropping privileges. Fixes bug 782. Patch from
|
|
|
|
|
Christopher Davis. Bugfix on 0.1.2.1-alpha.
|
|
|
|
|
- Try to attach connections immediately upon receiving a RENDEZVOUS2
|
|
|
|
|
or RENDEZVOUS_ESTABLISHED cell. This can save a second or two
|
|
|
|
|
on the client side when connecting to a hidden service. Bugfix
|
|
|
|
|
on 0.0.6pre1. Found and fixed by Christian Wilms; resolves bug 743.
|
|
|
|
|
- When closing an application-side connection because its circuit is
|
|
|
|
|
getting torn down, generate the stream event correctly. Bugfix on
|
|
|
|
|
0.1.2.x. Anonymous patch.
|
|
|
|
|
|
|
|
|
|
|
2008-09-01 00:08:34 +02:00
|
|
|
Changes in version 0.2.1.5-alpha - 2008-08-31
|
2008-09-10 21:08:46 +02:00
|
|
|
Tor 0.2.1.5-alpha moves us closer to handling IPv6 destinations, puts
|
|
|
|
|
in a lot of the infrastructure for adding authorization to hidden
|
|
|
|
|
services, lays the groundwork for having clients read their load
|
|
|
|
|
balancing information out of the networkstatus consensus rather than
|
|
|
|
|
the individual router descriptors, addresses two potential anonymity
|
|
|
|
|
issues, and fixes a variety of smaller issues.
|
|
|
|
|
|
2008-09-01 00:23:32 +02:00
|
|
|
o Major features:
|
2008-08-05 22:08:19 +02:00
|
|
|
- Convert many internal address representations to optionally hold
|
|
|
|
|
IPv6 addresses.
|
|
|
|
|
- Generate and accept IPv6 addresses in many protocol elements.
|
2008-08-22 18:24:43 +02:00
|
|
|
- Make resolver code handle nameservers located at ipv6 addresses.
|
2008-09-01 00:30:08 +02:00
|
|
|
- Begin implementation of proposal 121 ("Client authorization for
|
|
|
|
|
hidden services"): configure hidden services with client
|
2008-09-01 00:23:32 +02:00
|
|
|
authorization, publish descriptors for them, and configure
|
2008-09-01 00:30:08 +02:00
|
|
|
authorization data for hidden services at clients. The next
|
|
|
|
|
step is to actually access hidden services that perform client
|
|
|
|
|
authorization.
|
|
|
|
|
- More progress toward proposal 141: Network status consensus
|
|
|
|
|
documents and votes now contain bandwidth information for each
|
|
|
|
|
router and a summary of that router's exit policy. Eventually this
|
|
|
|
|
will be used by clients so that they do not have to download every
|
|
|
|
|
known descriptor before building circuits.
|
2008-08-05 22:08:19 +02:00
|
|
|
|
2008-08-20 07:21:43 +02:00
|
|
|
o Major bugfixes (on 0.2.0.x and before):
|
2008-08-15 15:55:01 +02:00
|
|
|
- When sending CREATED cells back for a given circuit, use a 64-bit
|
|
|
|
|
connection ID to find the right connection, rather than an addr:port
|
2008-09-01 00:08:34 +02:00
|
|
|
combination. Now that we can have multiple OR connections between
|
|
|
|
|
the same ORs, it is no longer possible to use addr:port to uniquely
|
2008-08-15 15:55:01 +02:00
|
|
|
identify a connection.
|
2008-08-20 07:21:43 +02:00
|
|
|
- Relays now reject risky extend cells: if the extend cell includes
|
|
|
|
|
a digest of all zeroes, or asks to extend back to the relay that
|
|
|
|
|
sent the extend cell, tear down the circuit. Ideas suggested
|
|
|
|
|
by rovv.
|
2008-08-31 08:33:39 +02:00
|
|
|
- If not enough of our entry guards are available so we add a new
|
|
|
|
|
one, we might use the new one even if it overlapped with the
|
|
|
|
|
current circuit's exit relay (or its family). Anonymity bugfix
|
|
|
|
|
pointed out by rovv.
|
2008-08-15 15:55:01 +02:00
|
|
|
|
2008-08-06 18:22:25 +02:00
|
|
|
o Minor bugfixes:
|
2008-09-01 00:08:34 +02:00
|
|
|
- Recover 3-7 bytes that were wasted per memory chunk. Fixes bug
|
|
|
|
|
794; bug spotted by rovv. Bugfix on 0.2.0.1-alpha.
|
2008-08-06 18:32:17 +02:00
|
|
|
- When using the TransPort option on OpenBSD, and using the User
|
2008-09-01 00:08:34 +02:00
|
|
|
option to change UID and drop privileges, make sure to open /dev/pf
|
|
|
|
|
before dropping privileges. Fixes bug 782. Patch from Christopher
|
|
|
|
|
Davis. Bugfix on 0.1.2.1-alpha.
|
2008-08-07 21:39:52 +02:00
|
|
|
- Correctly detect the presence of the linux/netfilter_ipv4.h header
|
2008-09-01 00:08:34 +02:00
|
|
|
when building against recent kernels. Bugfix on 0.1.2.1-alpha.
|
2008-08-07 22:06:40 +02:00
|
|
|
- Add a missing safe_str() call for a debug log message.
|
2008-08-15 15:55:01 +02:00
|
|
|
- Use 64 bits instead of 32 bits for connection identifiers used with
|
|
|
|
|
the controller protocol, to greatly reduce risk of identifier reuse.
|
2008-09-01 00:08:34 +02:00
|
|
|
- Make the autoconf script accept the obsolete --with-ssl-dir
|
|
|
|
|
option as an alias for the actually-working --with-openssl-dir
|
|
|
|
|
option. Fix the help documentation to recommend --with-openssl-dir.
|
|
|
|
|
Based on a patch by "Dave". Bugfix on 0.2.0.1-alpha.
|
2008-08-06 18:22:25 +02:00
|
|
|
|
2008-09-01 00:08:34 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- Rate-limit too-many-sockets messages: when they happen, they happen
|
|
|
|
|
a lot. Resolves bug 748.
|
|
|
|
|
- Resist DNS poisoning a little better by making sure that names in
|
|
|
|
|
answer sections match.
|
2008-09-01 00:30:08 +02:00
|
|
|
- Print the SOCKS5 error message string as well as the error code
|
|
|
|
|
when a tor-resolve request fails. Patch from Jacob.
|
2008-08-09 17:35:37 +02:00
|
|
|
|
2008-08-05 22:08:19 +02:00
|
|
|
|
2008-08-05 02:00:35 +02:00
|
|
|
Changes in version 0.2.1.4-alpha - 2008-08-04
|
2008-09-10 21:08:46 +02:00
|
|
|
Tor 0.2.1.4-alpha fixes a pair of crash bugs in 0.2.1.3-alpha.
|
|
|
|
|
|
2008-08-03 21:27:19 +02:00
|
|
|
o Major bugfixes:
|
2008-08-05 02:00:35 +02:00
|
|
|
- The address part of exit policies was not correctly written
|
|
|
|
|
to router descriptors. This generated router descriptors that failed
|
|
|
|
|
their self-checks. Noticed by phobos, fixed by Karsten. Bugfix
|
|
|
|
|
on 0.2.1.3-alpha.
|
|
|
|
|
- Tor triggered a false assert when extending a circuit to a relay
|
|
|
|
|
but we already have a connection open to that relay. Noticed by
|
|
|
|
|
phobos, fixed by Karsten. Bugfix on 0.2.1.3-alpha.
|
2008-08-03 21:27:19 +02:00
|
|
|
|
2008-08-05 01:35:12 +02:00
|
|
|
o Minor bugfixes:
|
2008-08-05 02:00:35 +02:00
|
|
|
- Fix a hidden service logging bug: in some edge cases, the router
|
|
|
|
|
descriptor of a previously picked introduction point becomes
|
|
|
|
|
obsolete and we need to give up on it rather than continually
|
|
|
|
|
complaining that it has become obsolete. Observed by xiando. Bugfix
|
|
|
|
|
on 0.2.1.3-alpha.
|
2008-08-05 01:35:12 +02:00
|
|
|
|
2008-08-05 02:12:05 +02:00
|
|
|
o Removed features:
|
|
|
|
|
- Take out the TestVia config option, since it was a workaround for
|
|
|
|
|
a bug that was fixed in Tor 0.1.1.21.
|
|
|
|
|
|
2008-08-03 21:27:19 +02:00
|
|
|
|
2008-08-03 07:35:42 +02:00
|
|
|
Changes in version 0.2.1.3-alpha - 2008-08-03
|
2008-09-10 21:08:46 +02:00
|
|
|
Tor 0.2.1.3-alpha implements most of the pieces to prevent
|
|
|
|
|
infinite-length circuit attacks (see proposal 110); fixes a bug that
|
|
|
|
|
might cause exit relays to corrupt streams they send back; allows
|
|
|
|
|
address patterns (e.g. 255.128.0.0/16) to appear in ExcludeNodes and
|
|
|
|
|
ExcludeExitNodes config options; and fixes a big pile of bugs.
|
|
|
|
|
|
2008-06-24 10:00:30 +02:00
|
|
|
o Bootstrapping bugfixes (on 0.2.1.x-alpha):
|
|
|
|
|
- Send a bootstrap problem "warn" event on the first problem if the
|
|
|
|
|
reason is NO_ROUTE (that is, our network is down).
|
|
|
|
|
|
2008-07-23 17:58:38 +02:00
|
|
|
o Major features:
|
2008-12-30 03:03:23 +01:00
|
|
|
- Implement most of proposal 110: The first K cells to be sent
|
|
|
|
|
along a circuit are marked as special "early" cells; only K "early"
|
|
|
|
|
cells will be allowed. Once this code is universal, we can block
|
|
|
|
|
certain kinds of DOS attack by requiring that EXTEND commands must
|
|
|
|
|
be sent using an "early" cell.
|
2008-07-23 17:58:38 +02:00
|
|
|
|
2008-07-06 20:34:45 +02:00
|
|
|
o Major bugfixes:
|
2008-07-09 12:28:11 +02:00
|
|
|
- Try to attach connections immediately upon receiving a RENDEZVOUS2
|
|
|
|
|
or RENDEZVOUS_ESTABLISHED cell. This can save a second or two
|
|
|
|
|
on the client side when connecting to a hidden service. Bugfix
|
|
|
|
|
on 0.0.6pre1. Found and fixed by Christian Wilms; resolves bug 743.
|
2008-07-23 14:55:55 +02:00
|
|
|
- Ensure that two circuits can never exist on the same connection
|
2008-08-03 07:35:42 +02:00
|
|
|
with the same circuit ID, even if one is marked for close. This
|
2008-07-23 14:55:55 +02:00
|
|
|
is conceivably a bugfix for bug 779; fixes a bug on 0.1.0.4-rc.
|
2008-07-06 20:34:45 +02:00
|
|
|
|
2008-07-11 23:42:09 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- When relays do their initial bandwidth measurement, don't limit
|
2008-08-03 07:35:42 +02:00
|
|
|
to just our entry guards for the test circuits. Otherwise we tend
|
|
|
|
|
to have multiple test circuits going through a single entry guard,
|
|
|
|
|
which makes our bandwidth test less accurate. Fixes part of bug 654;
|
|
|
|
|
patch contributed by Josh Albrecht.
|
2008-07-18 20:36:32 +02:00
|
|
|
- Add an ExcludeExitNodes option so users can list a set of nodes
|
|
|
|
|
that should be be excluded from the exit node position, but
|
2008-08-03 07:35:42 +02:00
|
|
|
allowed elsewhere. Implements proposal 151.
|
2008-07-18 20:36:32 +02:00
|
|
|
- Allow address patterns (e.g., 255.128.0.0/16) to appear in
|
|
|
|
|
ExcludeNodes and ExcludeExitNodes lists.
|
2008-08-03 07:35:42 +02:00
|
|
|
- Change the implementation of ExcludeNodes and ExcludeExitNodes to
|
|
|
|
|
be more efficient. Formerly it was quadratic in the number of
|
|
|
|
|
servers; now it should be linear. Fixes bug 509.
|
2008-08-03 19:45:24 +02:00
|
|
|
- Save 16-22 bytes per open circuit by moving the n_addr, n_port,
|
2008-07-30 15:04:32 +02:00
|
|
|
and n_conn_id_digest fields into a separate structure that's
|
|
|
|
|
only needed when the circuit has not yet attached to an n_conn.
|
2008-07-11 23:42:09 +02:00
|
|
|
|
2008-06-22 09:15:18 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Change the contrib/tor.logrotate script so it makes the new
|
|
|
|
|
logs as "_tor:_tor" rather than the default, which is generally
|
|
|
|
|
"root:wheel". Fixes bug 676, reported by Serge Koksharov.
|
2008-07-09 17:23:23 +02:00
|
|
|
- Stop using __attribute__((nonnull)) with GCC: it can give us useful
|
|
|
|
|
warnings (occasionally), but it can also cause the compiler to
|
2008-08-03 07:35:42 +02:00
|
|
|
eliminate error-checking code. Suggested by Peter Gutmann.
|
2008-07-10 23:02:01 +02:00
|
|
|
- When a hidden service is giving up on an introduction point candidate
|
|
|
|
|
that was not included in the last published rendezvous descriptor,
|
|
|
|
|
don't reschedule publication of the next descriptor. Fixes bug 763.
|
|
|
|
|
Bugfix on 0.0.9.3.
|
2008-07-23 16:07:32 +02:00
|
|
|
- Mark RendNodes, RendExcludeNodes, HiddenServiceNodes, and
|
|
|
|
|
HiddenServiceExcludeNodes as obsolete: they never worked properly,
|
|
|
|
|
and nobody claims to be using them. Fixes bug 754. Bugfix on
|
2008-08-03 07:35:42 +02:00
|
|
|
0.1.0.1-rc. Patch from Christian Wilms.
|
2008-09-08 21:50:29 +02:00
|
|
|
- Fix a small alignment and memory-wasting bug on buffer chunks.
|
|
|
|
|
Spotted by rovv.
|
2008-06-22 09:15:18 +02:00
|
|
|
|
2008-07-23 16:07:26 +02:00
|
|
|
o Minor bugfixes (controller):
|
|
|
|
|
- When closing an application-side connection because its circuit
|
|
|
|
|
is getting torn down, generate the stream event correctly.
|
2008-08-03 07:35:42 +02:00
|
|
|
Bugfix on 0.1.2.x. Anonymous patch.
|
2008-07-23 16:07:26 +02:00
|
|
|
|
2008-08-05 02:12:05 +02:00
|
|
|
o Removed features:
|
2008-08-03 07:35:42 +02:00
|
|
|
- Remove all backward-compatibility code to support relays running
|
|
|
|
|
versions of Tor so old that they no longer work at all on the
|
|
|
|
|
Tor network.
|
2008-07-16 15:15:11 +02:00
|
|
|
|
2008-06-22 09:15:18 +02:00
|
|
|
|
2009-02-05 18:52:58 +01:00
|
|
|
Changes in version 0.2.0.30 - 2008-07-15
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Stop using __attribute__((nonnull)) with GCC: it can give us useful
|
|
|
|
|
warnings (occasionally), but it can also cause the compiler to
|
|
|
|
|
eliminate error-checking code. Suggested by Peter Gutmann.
|
|
|
|
|
|
|
|
|
|
|
2008-07-09 12:10:37 +02:00
|
|
|
Changes in version 0.2.0.29-rc - 2008-07-08
|
2008-09-10 21:08:46 +02:00
|
|
|
Tor 0.2.0.29-rc fixes two big bugs with using bridges, fixes more
|
|
|
|
|
hidden-service performance bugs, and fixes a bunch of smaller bugs.
|
|
|
|
|
|
2008-07-09 12:10:37 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- If you have more than one bridge but don't know their keys,
|
|
|
|
|
you would only launch a request for the descriptor of the first one
|
|
|
|
|
on your list. (Tor considered launching requests for the others, but
|
|
|
|
|
found that it already had a connection on the way for $0000...0000
|
|
|
|
|
so it didn't open another.) Bugfix on 0.2.0.x.
|
|
|
|
|
- If you have more than one bridge but don't know their keys, and the
|
|
|
|
|
connection to one of the bridges failed, you would cancel all
|
|
|
|
|
pending bridge connections. (After all, they all have the same
|
|
|
|
|
digest.) Bugfix on 0.2.0.x.
|
|
|
|
|
- When a hidden service was trying to establish an introduction point,
|
|
|
|
|
and Tor had built circuits preemptively for such purposes, we
|
|
|
|
|
were ignoring all the preemptive circuits and launching a new one
|
|
|
|
|
instead. Bugfix on 0.2.0.14-alpha.
|
|
|
|
|
- When a hidden service was trying to establish an introduction point,
|
|
|
|
|
and Tor *did* manage to reuse one of the preemptively built
|
|
|
|
|
circuits, it didn't correctly remember which one it used,
|
|
|
|
|
so it asked for another one soon after, until there were no
|
|
|
|
|
more preemptive circuits, at which point it launched one from
|
|
|
|
|
scratch. Bugfix on 0.0.9.x.
|
|
|
|
|
- Make directory servers include the X-Your-Address-Is: http header in
|
|
|
|
|
their responses even for begin_dir conns. Now clients who only
|
|
|
|
|
ever use begin_dir connections still have a way to learn their IP
|
|
|
|
|
address. Fixes bug 737; bugfix on 0.2.0.22-rc. Reported by goldy.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
2008-07-16 02:04:00 +02:00
|
|
|
- Fix a macro/CPP interaction that was confusing some compilers:
|
2008-07-09 12:10:37 +02:00
|
|
|
some GCCs don't like #if/#endif pairs inside macro arguments.
|
2008-07-16 02:04:00 +02:00
|
|
|
Fixes bug 707.
|
2008-07-09 12:10:37 +02:00
|
|
|
- Fix macro collision between OpenSSL 0.9.8h and Windows headers.
|
|
|
|
|
Fixes bug 704; fix from Steven Murdoch.
|
|
|
|
|
- When opening /dev/null in finish_daemonize(), do not pass the
|
|
|
|
|
O_CREAT flag. Fortify was complaining, and correctly so. Fixes
|
|
|
|
|
bug 742; fix from Michael Scherer. Bugfix on 0.0.2pre19.
|
|
|
|
|
- Correctly detect transparent proxy support on Linux hosts that
|
2008-09-29 08:54:32 +02:00
|
|
|
require in.h to be included before netfilter_ipv4.h. Patch
|
2008-07-09 12:10:37 +02:00
|
|
|
from coderman.
|
2008-07-10 20:31:33 +02:00
|
|
|
- Disallow session resumption attempts during the renegotiation
|
2008-09-08 21:50:29 +02:00
|
|
|
stage of the v2 handshake protocol. Clients should never be trying
|
|
|
|
|
session resumption at this point, but apparently some did, in
|
|
|
|
|
ways that caused the handshake to fail. Bugfix on 0.2.0.20-rc. Bug
|
|
|
|
|
found by Geoff Goodell.
|
2008-07-09 12:10:37 +02:00
|
|
|
|
|
|
|
|
|
2008-06-20 08:26:58 +02:00
|
|
|
Changes in version 0.2.1.2-alpha - 2008-06-20
|
2008-06-28 06:23:26 +02:00
|
|
|
Tor 0.2.1.2-alpha includes a new "TestingTorNetwork" config option to
|
|
|
|
|
make it easier to set up your own private Tor network; fixes several
|
|
|
|
|
big bugs with using more than one bridge relay; fixes a big bug with
|
|
|
|
|
offering hidden services quickly after Tor starts; and uses a better
|
|
|
|
|
API for reporting potential bootstrapping problems to the controller.
|
|
|
|
|
|
2008-06-14 18:01:29 +02:00
|
|
|
o Major features:
|
2008-06-28 06:23:26 +02:00
|
|
|
- New TestingTorNetwork config option to allow adjustment of
|
|
|
|
|
previously constant values that, while reasonable, could slow
|
|
|
|
|
bootstrapping. Implements proposal 135. Patch from Karsten.
|
2008-06-14 18:01:29 +02:00
|
|
|
|
2008-06-20 05:13:16 +02:00
|
|
|
o Major bugfixes:
|
2008-06-20 08:26:58 +02:00
|
|
|
- If you have more than one bridge but don't know their digests,
|
2008-06-20 05:13:16 +02:00
|
|
|
you would only learn a request for the descriptor of the first one
|
|
|
|
|
on your list. (Tor considered launching requests for the others, but
|
|
|
|
|
found that it already had a connection on the way for $0000...0000
|
2008-06-21 06:25:10 +02:00
|
|
|
so it didn't open another.) Bugfix on 0.2.0.x.
|
2008-06-20 08:26:58 +02:00
|
|
|
- If you have more than one bridge but don't know their digests,
|
|
|
|
|
and the connection to one of the bridges failed, you would cancel
|
|
|
|
|
all pending bridge connections. (After all, they all have the
|
2008-06-21 06:25:10 +02:00
|
|
|
same digest.) Bugfix on 0.2.0.x.
|
|
|
|
|
- When establishing a hidden service, introduction points that
|
|
|
|
|
originate from cannibalized circuits are completely ignored and not
|
|
|
|
|
included in rendezvous service descriptors. This might be another
|
|
|
|
|
reason for delay in making a hidden service available. Bugfix
|
|
|
|
|
from long ago (0.0.9.x?)
|
2008-06-20 05:13:16 +02:00
|
|
|
|
2008-06-13 18:35:12 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- Allow OpenSSL to use dynamic locks if it wants.
|
2008-06-20 08:26:58 +02:00
|
|
|
- When building a consensus, do not include routers that are down.
|
|
|
|
|
This will cut down 30% to 40% on consensus size. Implements
|
2008-06-13 23:22:49 +02:00
|
|
|
proposal 138.
|
2008-06-16 04:08:30 +02:00
|
|
|
- In directory authorities' approved-routers files, allow
|
|
|
|
|
fingerprints with or without space.
|
2008-06-17 10:15:42 +02:00
|
|
|
- Add a "GETINFO /status/bootstrap-phase" controller option, so the
|
|
|
|
|
controller can query our current bootstrap state in case it attaches
|
|
|
|
|
partway through and wants to catch up.
|
|
|
|
|
- Send an initial "Starting" bootstrap status event, so we have a
|
|
|
|
|
state to start out in.
|
2008-06-14 18:01:29 +02:00
|
|
|
|
2008-06-21 06:25:10 +02:00
|
|
|
o Minor bugfixes:
|
2008-06-13 20:58:58 +02:00
|
|
|
- Asking for a conditional consensus at .../consensus/<fingerprints>
|
2008-06-21 06:25:10 +02:00
|
|
|
would crash a dirserver if it did not already have a
|
|
|
|
|
consensus. Bugfix on 0.2.1.1-alpha.
|
2008-06-16 20:35:21 +02:00
|
|
|
- Clean up some macro/CPP interactions: some GCC versions don't like
|
2008-06-21 06:25:10 +02:00
|
|
|
#if/#endif pairs inside macro arguments. Fixes bug 707. Bugfix on
|
|
|
|
|
0.2.0.x.
|
2008-06-20 06:34:39 +02:00
|
|
|
|
2008-06-21 06:25:10 +02:00
|
|
|
o Bootstrapping bugfixes (on 0.2.1.1-alpha):
|
2008-06-18 09:34:04 +02:00
|
|
|
- Directory authorities shouldn't complain about bootstrapping
|
|
|
|
|
problems just because they do a lot of reachability testing and
|
|
|
|
|
some of the connection attempts fail.
|
2008-06-20 06:34:39 +02:00
|
|
|
- Start sending "count" and "recommendation" key/value pairs in
|
|
|
|
|
bootstrap problem status events, so the controller can hear about
|
|
|
|
|
problems even before Tor decides they're worth reporting for sure.
|
|
|
|
|
- If you're using bridges, generate "bootstrap problem" warnings
|
|
|
|
|
as soon as you run out of working bridges, rather than waiting
|
|
|
|
|
for ten failures -- which will never happen if you have less than
|
|
|
|
|
ten bridges.
|
2008-06-20 06:42:17 +02:00
|
|
|
- If we close our OR connection because there's been a circuit
|
|
|
|
|
pending on it for too long, we were telling our bootstrap status
|
|
|
|
|
events "REASON=NONE". Now tell them "REASON=TIMEOUT".
|
2008-06-16 20:35:21 +02:00
|
|
|
|
2008-06-13 18:35:12 +02:00
|
|
|
|
2008-06-13 06:26:05 +02:00
|
|
|
Changes in version 0.2.1.1-alpha - 2008-06-13
|
2008-06-28 06:23:26 +02:00
|
|
|
Tor 0.2.1.1-alpha fixes a lot of memory fragmentation problems that
|
|
|
|
|
were making the Tor process bloat especially on Linux; makes our TLS
|
|
|
|
|
handshake blend in better; sends "bootstrap phase" status events to
|
|
|
|
|
the controller, so it can keep the user informed of progress (and
|
|
|
|
|
problems) fetching directory information and establishing circuits;
|
|
|
|
|
and adds a variety of smaller features.
|
|
|
|
|
|
2008-06-13 06:26:05 +02:00
|
|
|
o Major features:
|
2008-06-13 07:13:22 +02:00
|
|
|
- More work on making our TLS handshake blend in: modify the list
|
|
|
|
|
of ciphers advertised by OpenSSL in client mode to even more
|
|
|
|
|
closely resemble a common web browser. We cheat a little so that
|
|
|
|
|
we can advertise ciphers that the locally installed OpenSSL doesn't
|
|
|
|
|
know about.
|
2008-06-13 06:26:05 +02:00
|
|
|
- Start sending "bootstrap phase" status events to the controller,
|
|
|
|
|
so it can keep the user informed of progress fetching directory
|
|
|
|
|
information and establishing circuits. Also inform the controller
|
|
|
|
|
if we think we're stuck at a particular bootstrap phase. Implements
|
|
|
|
|
proposal 137.
|
2008-06-13 07:13:22 +02:00
|
|
|
- Resume using OpenSSL's RAND_poll() for better (and more portable)
|
|
|
|
|
cross-platform entropy collection again. We used to use it, then
|
|
|
|
|
stopped using it because of a bug that could crash systems that
|
|
|
|
|
called RAND_poll when they had a lot of fds open. It looks like the
|
|
|
|
|
bug got fixed in late 2006. Our new behavior is to call RAND_poll()
|
|
|
|
|
at startup, and to call RAND_poll() when we reseed later only if
|
|
|
|
|
we have a non-buggy OpenSSL version.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- When we choose to abandon a new entry guard because we think our
|
|
|
|
|
older ones might be better, close any circuits pending on that
|
2008-06-13 08:23:46 +02:00
|
|
|
new entry guard connection. This fix should make us recover much
|
|
|
|
|
faster when our network is down and then comes back. Bugfix on
|
|
|
|
|
0.1.2.8-beta; found by lodger.
|
2008-06-13 06:26:05 +02:00
|
|
|
|
2008-06-13 04:06:04 +02:00
|
|
|
o Memory fixes and improvements:
|
|
|
|
|
- Add a malloc_good_size implementation to OpenBSD_malloc_linux.c,
|
|
|
|
|
to avoid unused RAM in buffer chunks and memory pools.
|
|
|
|
|
- Speed up parsing and cut down on memory fragmentation by using
|
|
|
|
|
stack-style allocations for parsing directory objects. Previously,
|
|
|
|
|
this accounted for over 40% of allocations from within Tor's code
|
|
|
|
|
on a typical directory cache.
|
|
|
|
|
- Use a Bloom filter rather than a digest-based set to track which
|
|
|
|
|
descriptors we need to keep around when we're cleaning out old
|
|
|
|
|
router descriptors. This speeds up the computation significantly,
|
|
|
|
|
and may reduce fragmentation.
|
|
|
|
|
- Reduce the default smartlist size from 32 to 16; it turns out that
|
|
|
|
|
most smartlists hold around 8-12 elements tops.
|
|
|
|
|
- Make dumpstats() log the fullness and size of openssl-internal
|
|
|
|
|
buffers.
|
|
|
|
|
- If the user has applied the experimental SSL_MODE_RELEASE_BUFFERS
|
|
|
|
|
patch to their OpenSSL, turn it on to save memory on servers. This
|
|
|
|
|
patch will (with any luck) get included in a mainline distribution
|
|
|
|
|
before too long.
|
2008-06-13 07:13:22 +02:00
|
|
|
- Never use OpenSSL compression: it wastes RAM and CPU trying to
|
|
|
|
|
compress cells, which are basically all encrypted, compressed,
|
|
|
|
|
or both.
|
2008-06-13 04:06:04 +02:00
|
|
|
|
2008-02-27 20:19:34 +01:00
|
|
|
o Minor bugfixes:
|
2008-06-07 06:56:08 +02:00
|
|
|
- Stop reloading the router list from disk for no reason when we
|
|
|
|
|
run out of reachable directory mirrors. Once upon a time reloading
|
|
|
|
|
it would set the 'is_running' flag back to 1 for them. It hasn't
|
|
|
|
|
done that for a long time.
|
2008-06-12 02:08:25 +02:00
|
|
|
- In very rare situations new hidden service descriptors were
|
|
|
|
|
published earlier than 30 seconds after the last change to the
|
2008-06-13 07:13:22 +02:00
|
|
|
service. (We currently think that a hidden service descriptor
|
|
|
|
|
that's been stable for 30 seconds is worth publishing.)
|
2008-02-26 04:11:37 +01:00
|
|
|
|
2008-03-05 23:31:39 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Allow separate log levels to be configured for different logging
|
2008-06-13 07:13:22 +02:00
|
|
|
domains. For example, this allows one to log all notices, warnings,
|
2008-06-12 02:08:25 +02:00
|
|
|
or errors, plus all memory management messages of level debug or
|
|
|
|
|
higher, with: Log [MM] debug-err [*] notice-err file /var/log/tor.
|
2008-03-21 20:18:54 +01:00
|
|
|
- Add a couple of extra warnings to --enable-gcc-warnings for GCC 4.3,
|
2008-06-12 02:08:25 +02:00
|
|
|
and stop using a warning that had become unfixably verbose under
|
|
|
|
|
GCC 4.3.
|
|
|
|
|
- New --hush command-line option similar to --quiet. While --quiet
|
2008-03-27 18:25:49 +01:00
|
|
|
disables all logging to the console on startup, --hush limits the
|
|
|
|
|
output to messages of warning and error severity.
|
2008-04-24 17:51:55 +02:00
|
|
|
- Servers support a new URL scheme for consensus downloads that
|
2008-05-12 04:14:01 +02:00
|
|
|
allows the client to specify which authorities are trusted.
|
2008-06-12 02:13:35 +02:00
|
|
|
The server then only sends the consensus if the client will trust
|
2008-06-13 07:13:22 +02:00
|
|
|
it. Otherwise a 404 error is sent back. Clients use this
|
|
|
|
|
new scheme when the server supports it (meaning it's running
|
|
|
|
|
0.2.1.1-alpha or later). Implements proposal 134.
|
2008-05-29 04:29:35 +02:00
|
|
|
- New configure/torrc options (--enable-geoip-stats,
|
2008-06-12 02:08:25 +02:00
|
|
|
DirRecordUsageByCountry) to record how many IPs we've served
|
|
|
|
|
directory info to in each country code, how many status documents
|
|
|
|
|
total we've sent to each country code, and what share of the total
|
2008-06-10 20:28:10 +02:00
|
|
|
directory requests we should expect to see.
|
2008-06-13 00:39:13 +02:00
|
|
|
- Use the TLS1 hostname extension to more closely resemble browser
|
|
|
|
|
behavior.
|
2008-06-13 07:13:22 +02:00
|
|
|
- Lots of new unit tests.
|
2008-04-07 18:28:34 +02:00
|
|
|
- Add a macro to implement the common pattern of iterating through
|
|
|
|
|
two parallel lists in lockstep.
|
2008-02-26 04:11:37 +01:00
|
|
|
|
2008-04-10 17:12:24 +02:00
|
|
|
|
2008-06-13 08:40:36 +02:00
|
|
|
Changes in version 0.2.0.28-rc - 2008-06-13
|
2008-06-28 06:23:26 +02:00
|
|
|
Tor 0.2.0.28-rc fixes an anonymity-related bug, fixes a hidden-service
|
|
|
|
|
performance bug, and fixes a bunch of smaller bugs.
|
|
|
|
|
|
2008-06-13 08:40:36 +02:00
|
|
|
o Anonymity fixes:
|
|
|
|
|
- Fix a bug where, when we were choosing the 'end stream reason' to
|
|
|
|
|
put in our relay end cell that we send to the exit relay, Tor
|
|
|
|
|
clients on Windows were sometimes sending the wrong 'reason'. The
|
|
|
|
|
anonymity problem is that exit relays may be able to guess whether
|
|
|
|
|
the client is running Windows, thus helping partition the anonymity
|
|
|
|
|
set. Down the road we should stop sending reasons to exit relays,
|
|
|
|
|
or otherwise prevent future versions of this bug.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- While setting up a hidden service, some valid introduction circuits
|
|
|
|
|
were overlooked and abandoned. This might be the reason for
|
|
|
|
|
the long delay in making a hidden service available. Bugfix on
|
2008-06-17 19:10:03 +02:00
|
|
|
0.2.0.14-alpha.
|
2008-06-13 08:40:36 +02:00
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Update to the "June 9 2008" ip-to-country file.
|
|
|
|
|
- Run 'make test' as part of 'make dist', so we stop releasing so
|
|
|
|
|
many development snapshots that fail their unit tests.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When we're checking if we have enough dir info for each relay
|
|
|
|
|
to begin establishing circuits, make sure that we actually have
|
|
|
|
|
the descriptor listed in the consensus, not just any descriptor.
|
2008-06-24 09:40:46 +02:00
|
|
|
Bugfix on 0.1.2.x.
|
2008-06-13 08:40:36 +02:00
|
|
|
- Bridge relays no longer print "xx=0" in their extrainfo document
|
2008-06-24 09:40:46 +02:00
|
|
|
for every single country code in the geoip db. Bugfix on
|
|
|
|
|
0.2.0.27-rc.
|
2008-06-13 08:40:36 +02:00
|
|
|
- Only warn when we fail to load the geoip file if we were planning to
|
2008-06-24 09:40:46 +02:00
|
|
|
include geoip stats in our extrainfo document. Bugfix on 0.2.0.27-rc.
|
2008-06-13 08:40:36 +02:00
|
|
|
- If we change our MaxAdvertisedBandwidth and then reload torrc,
|
|
|
|
|
Tor won't realize it should publish a new relay descriptor. Fixes
|
2008-06-24 09:40:46 +02:00
|
|
|
bug 688, reported by mfr. Bugfix on 0.1.2.x.
|
2008-06-13 08:40:36 +02:00
|
|
|
- When we haven't had any application requests lately, don't bother
|
2008-06-24 09:40:46 +02:00
|
|
|
logging that we have expired a bunch of descriptors. Bugfix
|
|
|
|
|
on 0.1.2.x.
|
2008-06-13 08:40:36 +02:00
|
|
|
- Make relay cells written on a connection count as non-padding when
|
|
|
|
|
tracking how long a connection has been in use. Bugfix on
|
|
|
|
|
0.2.0.1-alpha. Spotted by lodger.
|
|
|
|
|
- Fix unit tests in 0.2.0.27-rc.
|
|
|
|
|
- Fix compile on Windows.
|
|
|
|
|
|
|
|
|
|
|
2008-06-05 08:27:58 +02:00
|
|
|
Changes in version 0.2.0.27-rc - 2008-06-03
|
2008-06-28 06:23:26 +02:00
|
|
|
Tor 0.2.0.27-rc adds a few features we left out of the earlier
|
|
|
|
|
release candidates. In particular, we now include an IP-to-country
|
|
|
|
|
GeoIP database, so controllers can easily look up what country a
|
|
|
|
|
given relay is in, and so bridge relays can give us some sanitized
|
|
|
|
|
summaries about which countries are making use of bridges. (See proposal
|
|
|
|
|
126-geoip-fetching.txt for details.)
|
|
|
|
|
|
2008-06-05 08:27:58 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Include an IP-to-country GeoIP file in the tarball, so bridge
|
|
|
|
|
relays can report sanitized summaries of the usage they're seeing.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Add a "PURPOSE=" argument to "STREAM NEW" events, as suggested by
|
|
|
|
|
Robert Hogan. Fixes the first part of bug 681.
|
|
|
|
|
- Make bridge authorities never serve extrainfo docs.
|
|
|
|
|
- Add support to detect Libevent versions in the 1.4.x series
|
|
|
|
|
on mingw.
|
|
|
|
|
- Fix build on gcc 4.3 with --enable-gcc-warnings set.
|
|
|
|
|
- Include a new contrib/tor-exit-notice.html file that exit relay
|
|
|
|
|
operators can put on their website to help reduce abuse queries.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When tunneling an encrypted directory connection, and its first
|
|
|
|
|
circuit fails, do not leave it unattached and ask the controller
|
|
|
|
|
to deal. Fixes the second part of bug 681.
|
|
|
|
|
- Make bridge authorities correctly expire old extrainfo documents
|
|
|
|
|
from time to time.
|
|
|
|
|
|
|
|
|
|
|
2008-05-23 13:54:46 +02:00
|
|
|
Changes in version 0.2.0.26-rc - 2008-05-13
|
|
|
|
|
Tor 0.2.0.26-rc fixes a major security vulnerability caused by a bug
|
|
|
|
|
in Debian's OpenSSL packages. All users running any 0.2.0.x version
|
|
|
|
|
should upgrade, whether they're running Debian or not.
|
|
|
|
|
|
|
|
|
|
o Major security fixes:
|
|
|
|
|
- Use new V3 directory authority keys on the tor26, gabelmoo, and
|
|
|
|
|
moria1 V3 directory authorities. The old keys were generated with
|
|
|
|
|
a vulnerable version of Debian's OpenSSL package, and must be
|
|
|
|
|
considered compromised. Other authorities' keys were not generated
|
|
|
|
|
with an affected version of OpenSSL.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- List authority signatures as "unrecognized" based on DirServer
|
|
|
|
|
lines, not on cert cache. Bugfix on 0.2.0.x.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Add a new V3AuthUseLegacyKey option to make it easier for
|
|
|
|
|
authorities to change their identity keys if they have to.
|
|
|
|
|
|
|
|
|
|
|
2008-05-05 06:08:49 +02:00
|
|
|
Changes in version 0.2.0.25-rc - 2008-04-23
|
|
|
|
|
Tor 0.2.0.25-rc makes Tor work again on OS X and certain BSDs.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Remember to initialize threading before initializing logging.
|
|
|
|
|
Otherwise, many BSD-family implementations will crash hard on
|
|
|
|
|
startup. Fixes bug 671. Bugfix on 0.2.0.24-rc.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Authorities correctly free policies on bad servers on
|
|
|
|
|
exit. Fixes bug 672. Bugfix on 0.2.0.x.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.2.0.24-rc - 2008-04-22
|
|
|
|
|
Tor 0.2.0.24-rc adds dizum (run by Alex de Joode) as the new sixth
|
|
|
|
|
v3 directory authority, makes relays with dynamic IP addresses and no
|
|
|
|
|
DirPort notice more quickly when their IP address changes, fixes a few
|
|
|
|
|
rare crashes and memory leaks, and fixes a few other miscellaneous bugs.
|
|
|
|
|
|
|
|
|
|
o New directory authorities:
|
|
|
|
|
- Take lefkada out of the list of v3 directory authorities, since
|
|
|
|
|
it has been down for months.
|
|
|
|
|
- Set up dizum (run by Alex de Joode) as the new sixth v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Detect address changes more quickly on non-directory mirror
|
|
|
|
|
relays. Bugfix on 0.2.0.18-alpha; fixes bug 652.
|
|
|
|
|
|
|
|
|
|
o Minor features (security):
|
|
|
|
|
- Reject requests for reverse-dns lookup of names that are in
|
|
|
|
|
a private address space. Patch from lodger.
|
|
|
|
|
- Non-exit relays no longer allow DNS requests. Fixes bug 619. Patch
|
|
|
|
|
from lodger.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (crashes):
|
|
|
|
|
- Avoid a rare assert that can trigger when Tor doesn't have much
|
|
|
|
|
directory information yet and it tries to fetch a v2 hidden
|
|
|
|
|
service descriptor. Fixes bug 651, reported by nwf.
|
|
|
|
|
- Initialize log mutex before initializing dmalloc. Otherwise,
|
|
|
|
|
running with dmalloc would crash. Bugfix on 0.2.0.x-alpha.
|
|
|
|
|
- Use recursive pthread mutexes in order to avoid deadlock when
|
|
|
|
|
logging debug-level messages to a controller. Bug spotted by nwf,
|
|
|
|
|
bugfix on 0.2.0.16-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (resource management):
|
|
|
|
|
- Keep address policies from leaking memory: start their refcount
|
|
|
|
|
at 1, not 2. Bugfix on 0.2.0.16-alpha.
|
|
|
|
|
- Free authority certificates on exit, so they don't look like memory
|
|
|
|
|
leaks. Bugfix on 0.2.0.19-alpha.
|
|
|
|
|
- Free static hashtables for policy maps and for TLS connections on
|
|
|
|
|
shutdown, so they don't look like memory leaks. Bugfix on 0.2.0.x.
|
|
|
|
|
- Avoid allocating extra space when computing consensuses on 64-bit
|
|
|
|
|
platforms. Bug spotted by aakova.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (misc):
|
|
|
|
|
- Do not read the configuration file when we've only been told to
|
|
|
|
|
generate a password hash. Fixes bug 643. Bugfix on 0.0.9pre5. Fix
|
|
|
|
|
based on patch from Sebastian Hahn.
|
|
|
|
|
- Exit relays that are used as a client can now reach themselves
|
|
|
|
|
using the .exit notation, rather than just launching an infinite
|
|
|
|
|
pile of circuits. Fixes bug 641. Reported by Sebastian Hahn.
|
|
|
|
|
- When attempting to open a logfile fails, tell us why.
|
|
|
|
|
- Fix a dumb bug that was preventing us from knowing that we should
|
|
|
|
|
preemptively build circuits to handle expected directory requests.
|
|
|
|
|
Fixes bug 660. Bugfix on 0.1.2.x.
|
|
|
|
|
- Warn less verbosely about clock skew from netinfo cells from
|
|
|
|
|
untrusted sources. Fixes bug 663.
|
|
|
|
|
- Make controller stream events for DNS requests more consistent,
|
|
|
|
|
by adding "new stream" events for DNS requests, and removing
|
|
|
|
|
spurious "stream closed" events" for cached reverse resolves.
|
|
|
|
|
Patch from mwenge. Fixes bug 646.
|
|
|
|
|
- Correctly notify one-hop connections when a circuit build has
|
|
|
|
|
failed. Possible fix for bug 669. Found by lodger.
|
|
|
|
|
|
|
|
|
|
|
2008-03-25 19:36:16 +01:00
|
|
|
Changes in version 0.2.0.23-rc - 2008-03-24
|
2008-04-11 05:44:50 +02:00
|
|
|
Tor 0.2.0.23-rc is the fourth release candidate for the 0.2.0 series. It
|
|
|
|
|
makes bootstrapping faster if the first directory mirror you contact
|
2008-04-11 05:43:16 +02:00
|
|
|
is down. The bundles also include the new Vidalia 0.1.2 release.
|
|
|
|
|
|
2008-03-25 19:36:16 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- When a tunneled directory request is made to a directory server
|
|
|
|
|
that's down, notice after 30 seconds rather than 120 seconds. Also,
|
|
|
|
|
fail any begindir streams that are pending on it, so they can
|
|
|
|
|
retry elsewhere. This was causing multi-minute delays on bootstrap.
|
|
|
|
|
|
|
|
|
|
|
2008-03-19 01:23:07 +01:00
|
|
|
Changes in version 0.2.0.22-rc - 2008-03-18
|
2008-04-11 05:43:16 +02:00
|
|
|
Tor 0.2.0.22-rc is the third release candidate for the 0.2.0 series. It
|
|
|
|
|
enables encrypted directory connections by default for non-relays, fixes
|
|
|
|
|
some broken TLS behavior we added in 0.2.0.20-rc, and resolves many
|
|
|
|
|
other bugs. The bundles also include Vidalia 0.1.1 and Torbutton 1.1.17.
|
|
|
|
|
|
2008-03-18 03:39:34 +01:00
|
|
|
o Major features:
|
2008-03-19 01:23:07 +01:00
|
|
|
- Enable encrypted directory connections by default for non-relays,
|
|
|
|
|
so censor tools that block Tor directory connections based on their
|
|
|
|
|
plaintext patterns will no longer work. This means Tor works in
|
|
|
|
|
certain censored countries by default again.
|
2008-03-18 03:39:34 +01:00
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Make sure servers always request certificates from clients during
|
|
|
|
|
TLS renegotiation. Reported by lodger; bugfix on 0.2.0.20-rc.
|
2008-03-19 01:23:07 +01:00
|
|
|
- Do not enter a CPU-eating loop when a connection is closed in
|
|
|
|
|
the middle of client-side TLS renegotiation. Fixes bug 622. Bug
|
|
|
|
|
diagnosed by lodger; bugfix on 0.2.0.20-rc.
|
|
|
|
|
- Fix assertion failure that could occur when a blocked circuit
|
|
|
|
|
became unblocked, and it had pending client DNS requests. Bugfix
|
|
|
|
|
on 0.2.0.1-alpha. Fixes bug 632.
|
2008-03-18 03:39:34 +01:00
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.1.2.x):
|
|
|
|
|
- Generate "STATUS_SERVER" events rather than misspelled
|
|
|
|
|
"STATUS_SEVER" events. Caught by mwenge.
|
|
|
|
|
- When counting the number of bytes written on a TLS connection,
|
|
|
|
|
look at the BIO actually used for writing to the network, not
|
|
|
|
|
at the BIO used (sometimes) to buffer data for the network.
|
|
|
|
|
Looking at different BIOs could result in write counts on the
|
|
|
|
|
order of ULONG_MAX. Fixes bug 614.
|
2008-03-19 01:23:07 +01:00
|
|
|
- On Windows, correctly detect errors when listing the contents of
|
|
|
|
|
a directory. Fix from lodger.
|
2008-03-18 03:39:34 +01:00
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.0.x):
|
|
|
|
|
- Downgrade "sslv3 alert handshake failure" message to INFO.
|
|
|
|
|
- If we set RelayBandwidthRate and RelayBandwidthBurst very high but
|
|
|
|
|
left BandwidthRate and BandwidthBurst at the default, we would be
|
|
|
|
|
silently limited by those defaults. Now raise them to match the
|
|
|
|
|
RelayBandwidth* values.
|
|
|
|
|
- Fix the SVK version detection logic to work correctly on a branch.
|
|
|
|
|
- Make --enable-openbsd-malloc work correctly on Linux with alpha
|
|
|
|
|
CPUs. Fixes bug 625.
|
|
|
|
|
- Logging functions now check that the passed severity is sane.
|
|
|
|
|
- Use proper log levels in the testsuite call of
|
|
|
|
|
get_interface_address6().
|
|
|
|
|
- When using a nonstandard malloc, do not use the platform values for
|
|
|
|
|
HAVE_MALLOC_GOOD_SIZE or HAVE_MALLOC_USABLE_SIZE.
|
|
|
|
|
- Make the openbsd malloc code use 8k pages on alpha CPUs and
|
|
|
|
|
16k pages on ia64.
|
|
|
|
|
- Detect mismatched page sizes when using --enable-openbsd-malloc.
|
|
|
|
|
- Avoid double-marked-for-close warning when certain kinds of invalid
|
|
|
|
|
.in-addr.arpa addresses are passed to the DNSPort. Part of a fix
|
|
|
|
|
for bug 617. Bugfix on 0.2.0.1-alpha.
|
|
|
|
|
- Make sure that the "NULL-means-reject *:*" convention is followed by
|
|
|
|
|
all the policy manipulation functions, avoiding some possible crash
|
|
|
|
|
bugs. Bug found by lodger. Bugfix on 0.2.0.16-alpha.
|
2008-03-19 01:23:07 +01:00
|
|
|
- Fix the implementation of ClientDNSRejectInternalAddresses so that it
|
|
|
|
|
actually works, and doesn't warn about every single reverse lookup.
|
|
|
|
|
Fixes the other part of bug 617. Bugfix on 0.2.0.1-alpha.
|
2008-03-18 03:39:34 +01:00
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Only log guard node status when guard node status has changed.
|
|
|
|
|
- Downgrade the 3 most common "INFO" messages to "DEBUG". This will
|
|
|
|
|
make "INFO" 75% less verbose.
|
|
|
|
|
|
|
|
|
|
|
2008-03-02 23:29:04 +01:00
|
|
|
Changes in version 0.2.0.21-rc - 2008-03-02
|
2008-04-11 05:43:16 +02:00
|
|
|
Tor 0.2.0.21-rc is the second release candidate for the 0.2.0 series. It
|
|
|
|
|
makes Tor work well with Vidalia again, fixes a rare assert bug,
|
|
|
|
|
and fixes a pair of more minor bugs. The bundles also include Vidalia
|
|
|
|
|
0.1.0 and Torbutton 1.1.16.
|
|
|
|
|
|
2008-03-02 23:29:04 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- The control port should declare that it requires password auth
|
|
|
|
|
when HashedControlSessionPassword is set too. Patch from Matt Edman;
|
|
|
|
|
bugfix on 0.2.0.20-rc. Fixes bug 615.
|
|
|
|
|
- Downgrade assert in connection_buckets_decrement() to a log message.
|
|
|
|
|
This may help us solve bug 614, and in any case will make its
|
|
|
|
|
symptoms less severe. Bugfix on 0.2.0.20-rc. Reported by fredzupy.
|
|
|
|
|
- We were sometimes miscounting the number of bytes read from the
|
|
|
|
|
network, causing our rate limiting to not be followed exactly.
|
|
|
|
|
Bugfix on 0.2.0.16-alpha. Reported by lodger.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
2009-01-06 20:03:15 +01:00
|
|
|
- Fix compilation with OpenSSL 0.9.8 and 0.9.8a. All other supported
|
|
|
|
|
OpenSSL versions should have been working fine. Diagnosis and patch
|
|
|
|
|
from lodger, Karsten Loesing, and Sebastian Hahn. Fixes bug 616.
|
2008-03-02 23:29:04 +01:00
|
|
|
Bugfix on 0.2.0.20-rc.
|
|
|
|
|
|
|
|
|
|
|
2008-02-25 01:39:58 +01:00
|
|
|
Changes in version 0.2.0.20-rc - 2008-02-24
|
2008-02-26 04:11:37 +01:00
|
|
|
Tor 0.2.0.20-rc is the first release candidate for the 0.2.0 series. It
|
|
|
|
|
makes more progress towards normalizing Tor's TLS handshake, makes
|
|
|
|
|
hidden services work better again, helps relays bootstrap if they don't
|
|
|
|
|
know their IP address, adds optional support for linking in openbsd's
|
|
|
|
|
allocator or tcmalloc, allows really fast relays to scale past 15000
|
|
|
|
|
sockets, and fixes a bunch of minor bugs reported by Veracode.
|
|
|
|
|
|
2008-02-12 23:02:47 +01:00
|
|
|
o Major features:
|
2008-02-21 23:14:32 +01:00
|
|
|
- Enable the revised TLS handshake based on the one designed by
|
2008-02-25 01:39:58 +01:00
|
|
|
Steven Murdoch in proposal 124, as revised in proposal 130. It
|
2008-02-21 23:14:32 +01:00
|
|
|
includes version negotiation for OR connections as described in
|
2008-02-25 01:39:58 +01:00
|
|
|
proposal 105. The new handshake is meant to be harder for censors
|
|
|
|
|
to fingerprint, and it adds the ability to detect certain kinds of
|
|
|
|
|
man-in-the-middle traffic analysis attacks. The version negotiation
|
|
|
|
|
feature will allow us to improve Tor's link protocol more safely
|
|
|
|
|
in the future.
|
|
|
|
|
- Choose which bridge to use proportional to its advertised bandwidth,
|
|
|
|
|
rather than uniformly at random. This should speed up Tor for
|
|
|
|
|
bridge users. Also do this for people who set StrictEntryNodes.
|
|
|
|
|
- When a TrackHostExits-chosen exit fails too many times in a row,
|
|
|
|
|
stop using it. Bugfix on 0.1.2.x; fixes bug 437.
|
2008-02-12 23:02:47 +01:00
|
|
|
|
2008-02-17 17:52:24 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Resolved problems with (re-)fetching hidden service descriptors.
|
|
|
|
|
Patch from Karsten Loesing; fixes problems with 0.2.0.18-alpha
|
|
|
|
|
and 0.2.0.19-alpha.
|
2008-02-19 22:30:24 +01:00
|
|
|
- If we only ever used Tor for hidden service lookups or posts, we
|
|
|
|
|
would stop building circuits and start refusing connections after
|
2008-02-19 22:41:43 +01:00
|
|
|
24 hours, since we falsely believed that Tor was dormant. Reported
|
2008-02-19 22:30:24 +01:00
|
|
|
by nwf; bugfix on 0.1.2.x.
|
2008-02-24 00:39:16 +01:00
|
|
|
- Servers that don't know their own IP address should go to the
|
|
|
|
|
authorities for their first directory fetch, even if their DirPort
|
|
|
|
|
is off or if they don't know they're reachable yet. This will help
|
|
|
|
|
them bootstrap better. Bugfix on 0.2.0.18-alpha; fixes bug 609.
|
2008-02-25 01:39:58 +01:00
|
|
|
- When counting the number of open sockets, count not only the number
|
|
|
|
|
of sockets we have received from the socket() call, but also
|
|
|
|
|
the number we've gotten from accept() and socketpair(). This bug
|
|
|
|
|
made us fail to count all sockets that we were using for incoming
|
|
|
|
|
connections. Bugfix on 0.2.0.x.
|
|
|
|
|
- Fix code used to find strings within buffers, when those strings
|
|
|
|
|
are not in the first chunk of the buffer. Bugfix on 0.2.0.x.
|
|
|
|
|
- Fix potential segfault when parsing HTTP headers. Bugfix on 0.2.0.x.
|
|
|
|
|
- Add a new __HashedControlSessionPassword option for controllers
|
|
|
|
|
to use for one-off session password hashes that shouldn't get
|
|
|
|
|
saved to disk by SAVECONF --- Vidalia users were accumulating a
|
|
|
|
|
pile of HashedControlPassword lines in their torrc files, one for
|
|
|
|
|
each time they had restarted Tor and then clicked Save. Make Tor
|
|
|
|
|
automatically convert "HashedControlPassword" to this new option but
|
|
|
|
|
only when it's given on the command line. Partial fix for bug 586.
|
2008-02-17 17:52:24 +01:00
|
|
|
|
2008-02-12 21:20:52 +01:00
|
|
|
o Minor features (performance):
|
|
|
|
|
- Tune parameters for cell pool allocation to minimize amount of
|
|
|
|
|
RAM overhead used.
|
2008-02-17 20:03:49 +01:00
|
|
|
- Add OpenBSD malloc code from phk as an optional malloc
|
|
|
|
|
replacement on Linux: some glibc libraries do very poorly
|
2008-02-25 01:39:58 +01:00
|
|
|
with Tor's memory allocation patterns. Pass
|
2008-02-17 20:03:49 +01:00
|
|
|
--enable-openbsd-malloc to get the replacement malloc code.
|
2008-02-17 20:26:55 +01:00
|
|
|
- Add a --with-tcmalloc option to the configure script to link
|
2008-02-26 04:11:37 +01:00
|
|
|
against tcmalloc (if present). Does not yet search for
|
2008-02-17 20:26:55 +01:00
|
|
|
non-system include paths.
|
2008-02-20 23:28:26 +01:00
|
|
|
- Stop imposing an arbitrary maximum on the number of file descriptors
|
2008-02-25 01:39:58 +01:00
|
|
|
used for busy servers. Bug reported by Olaf Selke; patch from
|
2008-02-20 23:28:26 +01:00
|
|
|
Sebastian Hahn.
|
2008-02-12 21:20:52 +01:00
|
|
|
|
2008-02-25 01:39:58 +01:00
|
|
|
o Minor features (other):
|
2008-02-19 23:27:44 +01:00
|
|
|
- When SafeLogging is disabled, log addresses along with all TLS
|
|
|
|
|
errors.
|
2008-02-25 01:39:58 +01:00
|
|
|
- When building with --enable-gcc-warnings, check for whether Apple's
|
|
|
|
|
warning "-Wshorten-64-to-32" is available.
|
|
|
|
|
- Add a --passphrase-fd argument to the tor-gencert command for
|
2008-02-22 20:07:52 +01:00
|
|
|
scriptability.
|
|
|
|
|
|
2008-02-25 01:39:58 +01:00
|
|
|
o Minor bugfixes (memory leaks and code problems):
|
2008-02-13 08:23:37 +01:00
|
|
|
- We were leaking a file descriptor if Tor started with a zero-length
|
|
|
|
|
cached-descriptors file. Patch by freddy77; bugfix on 0.1.2.
|
2008-02-29 02:45:06 +01:00
|
|
|
- Detect size overflow in zlib code. Reported by Justin Ferguson and
|
|
|
|
|
Dan Kaminsky.
|
2008-02-20 03:05:28 +01:00
|
|
|
- We were comparing the raw BridgePassword entry with a base64'ed
|
|
|
|
|
version of it, when handling a "/tor/networkstatus-bridges"
|
|
|
|
|
directory request. Now compare correctly. Noticed by Veracode.
|
2008-02-21 03:18:41 +01:00
|
|
|
- Recover from bad tracked-since value in MTBF-history file.
|
|
|
|
|
Should fix bug 537.
|
2008-02-25 01:39:58 +01:00
|
|
|
- Alter the code that tries to recover from unhandled write
|
|
|
|
|
errors, to not try to flush onto a socket that's given us
|
2008-02-26 04:11:37 +01:00
|
|
|
unhandled errors. Bugfix on 0.1.2.x.
|
2008-02-25 01:39:58 +01:00
|
|
|
- Make Unix controlsockets work correctly on OpenBSD. Patch from
|
|
|
|
|
tup. Bugfix on 0.2.0.3-alpha.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (other):
|
|
|
|
|
- If we have an extra-info document for our server, always make
|
|
|
|
|
it available on the control port, even if we haven't gotten
|
|
|
|
|
a copy of it from an authority yet. Patch from mwenge.
|
|
|
|
|
- Log the correct memory chunk sizes for empty RAM chunks in mempool.c.
|
|
|
|
|
- Directory mirrors no longer include a guess at the client's IP
|
|
|
|
|
address if the connection appears to be coming from the same /24
|
|
|
|
|
network; it was producing too many wrong guesses.
|
|
|
|
|
- Make the new hidden service code respect the SafeLogging setting.
|
2008-02-26 04:11:37 +01:00
|
|
|
Bugfix on 0.2.0.x. Patch from Karsten.
|
2008-02-25 01:39:58 +01:00
|
|
|
- When starting as an authority, do not overwrite all certificates
|
|
|
|
|
cached from other authorities. Bugfix on 0.2.0.x. Fixes bug 606.
|
2008-02-21 06:51:09 +01:00
|
|
|
- If we're trying to flush the last bytes on a connection (for
|
|
|
|
|
example, when answering a directory request), reset the
|
|
|
|
|
time-to-give-up timeout every time we manage to write something
|
|
|
|
|
on the socket. Bugfix on 0.1.2.x.
|
2008-02-21 07:06:45 +01:00
|
|
|
- Change the behavior of "getinfo status/good-server-descriptor"
|
|
|
|
|
so it doesn't return failure when any authority disappears.
|
2008-02-21 09:08:13 +01:00
|
|
|
- Even though the man page said that "TrackHostExits ." should
|
|
|
|
|
work, nobody had ever implemented it. Bugfix on 0.1.0.x.
|
2008-02-21 17:11:58 +01:00
|
|
|
- Report TLS "zero return" case as a "clean close" and "IO error"
|
2008-02-25 01:39:58 +01:00
|
|
|
as a "close". Stop calling closes "unexpected closes": existing
|
2008-02-21 17:11:58 +01:00
|
|
|
Tors don't use SSL_close(), so having a connection close without
|
|
|
|
|
the TLS shutdown handshake is hardly unexpected.
|
2008-02-22 21:33:47 +01:00
|
|
|
- Send NAMESERVER_STATUS messages for a single failed nameserver
|
|
|
|
|
correctly.
|
2008-02-11 06:31:56 +01:00
|
|
|
|
2008-02-16 00:39:14 +01:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Remove the tor_strpartition function: its logic was confused,
|
|
|
|
|
and it was only used for one thing that could be implemented far
|
|
|
|
|
more easily.
|
|
|
|
|
|
2008-02-11 02:52:24 +01:00
|
|
|
|
2008-02-09 18:13:28 +01:00
|
|
|
Changes in version 0.2.0.19-alpha - 2008-02-09
|
2008-02-12 06:18:24 +01:00
|
|
|
Tor 0.2.0.19-alpha makes more progress towards normalizing Tor's TLS
|
|
|
|
|
handshake, makes path selection for relays more secure and IP address
|
|
|
|
|
guessing more robust, and generally fixes a lot of bugs in preparation
|
|
|
|
|
for calling the 0.2.0 branch stable.
|
|
|
|
|
|
2008-02-09 18:13:28 +01:00
|
|
|
o Major features:
|
|
|
|
|
- Do not include recognizeable strings in the commonname part of
|
|
|
|
|
Tor's x509 certificates.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- If we're a relay, avoid picking ourselves as an introduction point,
|
|
|
|
|
a rendezvous point, or as the final hop for internal circuits. Bug
|
|
|
|
|
reported by taranis and lodger. Bugfix on 0.1.2.x.
|
|
|
|
|
- Patch from "Andrew S. Lists" to catch when we contact a directory
|
|
|
|
|
mirror at IP address X and he says we look like we're coming from
|
|
|
|
|
IP address X. Bugfix on 0.1.2.x.
|
|
|
|
|
|
|
|
|
|
o Minor features (security):
|
|
|
|
|
- Be more paranoid about overwriting sensitive memory on free(),
|
|
|
|
|
as a defensive programming tactic to ensure forward secrecy.
|
|
|
|
|
|
2008-02-05 22:39:49 +01:00
|
|
|
o Minor features (directory authority):
|
2008-02-09 18:13:28 +01:00
|
|
|
- Actually validate the options passed to AuthDirReject,
|
|
|
|
|
AuthDirInvalid, AuthDirBadDir, and AuthDirBadExit.
|
|
|
|
|
- Reject router descriptors with out-of-range bandwidthcapacity or
|
|
|
|
|
bandwidthburst values.
|
2008-02-05 22:39:40 +01:00
|
|
|
|
2008-02-05 22:39:49 +01:00
|
|
|
o Minor features (controller):
|
|
|
|
|
- Reject controller commands over 1MB in length. This keeps rogue
|
|
|
|
|
processes from running us out of memory.
|
|
|
|
|
|
2008-02-06 01:54:47 +01:00
|
|
|
o Minor features (misc):
|
|
|
|
|
- Give more descriptive well-formedness errors for out-of-range
|
|
|
|
|
hidden service descriptor/protocol versions.
|
2008-02-09 18:13:28 +01:00
|
|
|
- Make memory debugging information describe more about history
|
|
|
|
|
of cell allocation, so we can help reduce our memory use.
|
2008-02-07 17:10:33 +01:00
|
|
|
|
2008-02-05 22:39:49 +01:00
|
|
|
o Deprecated features (controller):
|
|
|
|
|
- The status/version/num-versioning and status/version/num-concurring
|
2008-02-09 18:13:28 +01:00
|
|
|
GETINFO options are no longer useful in the v3 directory protocol:
|
2008-02-05 22:39:49 +01:00
|
|
|
treat them as deprecated, and warn when they're used.
|
|
|
|
|
|
2008-01-27 00:18:30 +01:00
|
|
|
o Minor bugfixes:
|
2008-02-09 18:13:28 +01:00
|
|
|
- When our consensus networkstatus has been expired for a while, stop
|
|
|
|
|
being willing to build circuits using it. Fixes bug 401. Bugfix
|
|
|
|
|
on 0.1.2.x.
|
2008-01-27 00:18:30 +01:00
|
|
|
- Directory caches now fetch certificates from all authorities
|
|
|
|
|
listed in a networkstatus consensus, even when they do not
|
2008-02-09 18:13:28 +01:00
|
|
|
recognize them. Fixes bug 571. Bugfix on 0.2.0.x.
|
2008-01-30 23:23:44 +01:00
|
|
|
- When connecting to a bridge without specifying its key, insert
|
|
|
|
|
the connection into the identity-to-connection map as soon as
|
2008-02-09 18:13:28 +01:00
|
|
|
a key is learned. Fixes bug 574. Bugfix on 0.2.0.x.
|
|
|
|
|
- Detect versions of OS X where malloc_good_size() is present in the
|
|
|
|
|
library but never actually declared. Resolves bug 587. Bugfix
|
|
|
|
|
on 0.2.0.x.
|
2008-02-01 06:27:12 +01:00
|
|
|
- Stop incorrectly truncating zlib responses to directory authority
|
2008-02-09 18:13:28 +01:00
|
|
|
signature download requests. Fixes bug 593. Bugfix on 0.2.0.x.
|
|
|
|
|
- Stop recommending that every server operator send mail to tor-ops.
|
|
|
|
|
Resolves bug 597. Bugfix on 0.1.2.x.
|
2008-02-04 17:58:50 +01:00
|
|
|
- Don't trigger an assert if we start a directory authority with a
|
|
|
|
|
private IP address (like 127.0.0.1).
|
2008-02-09 18:13:28 +01:00
|
|
|
- Avoid possible failures when generating a directory with routers
|
|
|
|
|
with over-long versions strings, or too many flags set. Bugfix
|
|
|
|
|
on 0.1.2.x.
|
2008-02-05 22:39:40 +01:00
|
|
|
- If an attempt to launch a DNS resolve request over the control
|
|
|
|
|
port fails because we have overrun the limit on the number of
|
|
|
|
|
connections, tell the controller that the request has failed.
|
2008-02-09 18:13:28 +01:00
|
|
|
- Avoid using too little bandwidth when our clock skips a few
|
|
|
|
|
seconds. Bugfix on 0.1.2.x.
|
2008-02-07 02:08:33 +01:00
|
|
|
- Fix shell error when warning about missing packages in configure
|
2008-02-09 18:13:28 +01:00
|
|
|
script, on Fedora or Red Hat machines. Bugfix on 0.2.0.x.
|
2008-02-08 22:13:15 +01:00
|
|
|
- Do not become confused when receiving a spurious VERSIONS-like
|
|
|
|
|
cell from a confused v1 client. Bugfix on 0.2.0.x.
|
2008-02-09 18:13:28 +01:00
|
|
|
- Re-fetch v2 (as well as v0) rendezvous descriptors when all
|
|
|
|
|
introduction points for a hidden service have failed. Patch from
|
|
|
|
|
Karsten Loesing. Bugfix on 0.2.0.x.
|
2008-01-26 06:38:44 +01:00
|
|
|
|
2008-02-06 00:20:49 +01:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Remove some needless generality from cpuworker code, for improved
|
|
|
|
|
type-safety.
|
|
|
|
|
- Stop overloading the circuit_t.onionskin field for both "onionskin
|
|
|
|
|
from a CREATE cell that we are waiting for a cpuworker to be
|
|
|
|
|
assigned" and "onionskin from an EXTEND cell that we are going to
|
2008-02-09 18:13:28 +01:00
|
|
|
send to an OR as soon as we are connected". Might help with bug 600.
|
|
|
|
|
- Add an in-place version of aes_crypt() so that we can avoid doing a
|
2008-02-07 17:10:33 +01:00
|
|
|
needless memcpy() call on each cell payload.
|
2008-02-06 00:20:49 +01:00
|
|
|
|
2008-01-26 06:38:44 +01:00
|
|
|
|
2008-01-26 04:48:03 +01:00
|
|
|
Changes in version 0.2.0.18-alpha - 2008-01-25
|
2008-02-12 06:18:24 +01:00
|
|
|
Tor 0.2.0.18-alpha adds a sixth v3 directory authority run by CCC,
|
|
|
|
|
fixes a big memory leak in 0.2.0.17-alpha, and adds new config options
|
|
|
|
|
that can warn or reject connections to ports generally associated with
|
|
|
|
|
vulnerable-plaintext protocols.
|
|
|
|
|
|
2008-01-22 23:38:38 +01:00
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up dannenberg (run by CCC) as the sixth v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
2008-01-21 23:42:16 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a major memory leak when attempting to use the v2 TLS
|
2008-01-25 02:45:06 +01:00
|
|
|
handshake code. Bugfix on 0.2.0.x; fixes bug 589.
|
2008-01-26 04:48:03 +01:00
|
|
|
- We accidentally enabled the under-development v2 TLS handshake
|
|
|
|
|
code, which was causing log entries like "TLS error while
|
|
|
|
|
renegotiating handshake". Disable it again. Resolves bug 590.
|
2008-01-25 02:45:06 +01:00
|
|
|
- We were computing the wrong Content-Length: header for directory
|
|
|
|
|
responses that need to be compressed on the fly, causing clients
|
2008-02-09 18:13:28 +01:00
|
|
|
asking for those items to always fail. Bugfix on 0.2.0.x; partially
|
|
|
|
|
fixes bug 593.
|
2008-01-21 23:42:16 +01:00
|
|
|
|
2008-01-18 05:42:22 +01:00
|
|
|
o Major features:
|
|
|
|
|
- Avoid going directly to the directory authorities even if you're a
|
|
|
|
|
relay, if you haven't found yourself reachable yet or if you've
|
|
|
|
|
decided not to advertise your dirport yet. Addresses bug 556.
|
2008-01-18 05:58:40 +01:00
|
|
|
- If we've gone 12 hours since our last bandwidth check, and we
|
|
|
|
|
estimate we have less than 50KB bandwidth capacity but we could
|
|
|
|
|
handle more, do another bandwidth test.
|
2008-01-20 06:54:15 +01:00
|
|
|
- New config options WarnPlaintextPorts and RejectPlaintextPorts so
|
|
|
|
|
Tor can warn and/or refuse connections to ports commonly used with
|
2008-01-26 04:48:03 +01:00
|
|
|
vulnerable-plaintext protocols. Currently we warn on ports 23,
|
|
|
|
|
109, 110, and 143, but we don't reject any.
|
2008-01-18 05:42:22 +01:00
|
|
|
|
2008-01-21 23:42:16 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When we setconf ClientOnly to 1, close any current OR and Dir
|
|
|
|
|
listeners. Reported by mwenge.
|
2008-01-24 03:31:37 +01:00
|
|
|
- When we get a consensus that's been signed by more people than
|
2008-01-26 04:48:03 +01:00
|
|
|
we expect, don't log about it; it's not a big deal. Reported
|
|
|
|
|
by Kyle Williams.
|
2008-01-21 23:33:01 +01:00
|
|
|
|
2008-01-18 05:51:12 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Don't answer "/tor/networkstatus-bridges" directory requests if
|
|
|
|
|
the request isn't encrypted.
|
2008-01-21 22:00:50 +01:00
|
|
|
- Make "ClientOnly 1" config option disable directory ports too.
|
2008-01-26 05:35:16 +01:00
|
|
|
- Patches from Karsten Loesing to make v2 hidden services more
|
|
|
|
|
robust: work even when there aren't enough HSDir relays available;
|
|
|
|
|
retry when a v2 rend desc fetch fails; but don't retry if we
|
|
|
|
|
already have a usable v0 rend desc.
|
2008-01-18 05:51:12 +01:00
|
|
|
|
2008-01-18 05:42:22 +01:00
|
|
|
|
2008-01-17 21:32:37 +01:00
|
|
|
Changes in version 0.2.0.17-alpha - 2008-01-17
|
2008-01-19 19:05:19 +01:00
|
|
|
Tor 0.2.0.17-alpha makes the tarball build cleanly again (whoops).
|
|
|
|
|
|
2008-01-17 21:32:37 +01:00
|
|
|
o Compile fixes:
|
|
|
|
|
- Make the tor-gencert man page get included correctly in the tarball.
|
|
|
|
|
|
|
|
|
|
|
2008-01-17 20:56:21 +01:00
|
|
|
Changes in version 0.2.0.16-alpha - 2008-01-17
|
2008-01-19 19:05:19 +01:00
|
|
|
Tor 0.2.0.16-alpha adds a fifth v3 directory authority run by Karsten
|
|
|
|
|
Loesing, and generally cleans up a lot of features and minor bugs.
|
|
|
|
|
|
2008-01-09 00:51:48 +01:00
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up gabelmoo (run by Karsten Loesing) as the fifth v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
2007-12-26 01:12:08 +01:00
|
|
|
o Major performance improvements:
|
|
|
|
|
- Switch our old ring buffer implementation for one more like that
|
2008-01-17 20:56:21 +01:00
|
|
|
used by free Unix kernels. The wasted space in a buffer with 1mb
|
|
|
|
|
of data will now be more like 8k than 1mb. The new implementation
|
|
|
|
|
also avoids realloc();realloc(); patterns that can contribute to
|
|
|
|
|
memory fragmentation.
|
2007-12-26 01:12:08 +01:00
|
|
|
|
2008-01-02 07:59:15 +01:00
|
|
|
o Minor features:
|
2008-01-17 20:56:21 +01:00
|
|
|
- Configuration files now accept C-style strings as values. This
|
2008-01-02 07:59:15 +01:00
|
|
|
helps encode characters not allowed in the current configuration
|
2008-01-17 20:56:21 +01:00
|
|
|
file format, such as newline or #. Addresses bug 557.
|
2008-01-07 18:49:13 +01:00
|
|
|
- Although we fixed bug 539 (where servers would send HTTP status 503
|
2008-01-17 20:56:21 +01:00
|
|
|
responses _and_ send a body too), there are still servers out
|
|
|
|
|
there that haven't upgraded. Therefore, make clients parse such
|
|
|
|
|
bodies when they receive them.
|
2008-01-10 19:08:42 +01:00
|
|
|
- When we're not serving v2 directory information, there is no reason
|
2008-01-19 19:05:19 +01:00
|
|
|
to actually keep any around. Remove the obsolete files and directory
|
2008-01-10 19:08:42 +01:00
|
|
|
on startup if they are very old and we aren't going to serve them.
|
2008-01-02 07:59:15 +01:00
|
|
|
|
2008-01-02 05:43:44 +01:00
|
|
|
o Minor performance improvements:
|
2008-01-17 20:56:21 +01:00
|
|
|
- Reference-count and share copies of address policy entries; only 5%
|
|
|
|
|
of them were actually distinct.
|
2008-01-02 06:38:53 +01:00
|
|
|
- Never walk through the list of logs if we know that no log is
|
|
|
|
|
interested in a given message.
|
2008-01-02 05:43:44 +01:00
|
|
|
|
2008-01-02 05:57:48 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When an authority has not signed a consensus, do not try to
|
2008-01-19 19:05:19 +01:00
|
|
|
download a nonexistent "certificate with key 00000000". Bugfix
|
2008-01-02 05:57:48 +01:00
|
|
|
on 0.2.0.x. Fixes bug 569.
|
2008-01-17 20:56:21 +01:00
|
|
|
- Fix a rare assert error when we're closing one of our threads:
|
|
|
|
|
use a mutex to protect the list of logs, so we never write to the
|
|
|
|
|
list as it's being freed. Bugfix on 0.1.2.x. Fixes the very rare
|
|
|
|
|
bug 575, which is kind of the revenge of bug 222.
|
2008-01-07 00:37:48 +01:00
|
|
|
- Patch from Karsten Loesing to complain less at both the client
|
|
|
|
|
and the relay when a relay used to have the HSDir flag but doesn't
|
|
|
|
|
anymore, and we try to upload a hidden service descriptor.
|
2008-01-17 20:56:21 +01:00
|
|
|
- Stop leaking one cert per TLS context. Fixes bug 582. Bugfix on
|
|
|
|
|
0.2.0.15-alpha.
|
2008-01-07 20:15:34 +01:00
|
|
|
- Do not try to download missing certificates until we have tried
|
2008-01-17 20:56:21 +01:00
|
|
|
to check our fallback consensus. Fixes bug 583.
|
|
|
|
|
- Make bridges round reported GeoIP stats info up to the nearest
|
|
|
|
|
estimate, not down. Now we can distinguish between "0 people from
|
|
|
|
|
this country" and "1 person from this country".
|
|
|
|
|
- Avoid a spurious free on base64 failure. Bugfix on 0.1.2.
|
2008-01-14 20:00:28 +01:00
|
|
|
- Avoid possible segfault if key generation fails in
|
|
|
|
|
crypto_pk_hybrid_encrypt. Bugfix on 0.2.0.
|
2008-01-14 20:00:33 +01:00
|
|
|
- Avoid segfault in the case where a badly behaved v2 versioning
|
|
|
|
|
directory sends a signed networkstatus with missing client-versions.
|
|
|
|
|
Bugfix on 0.1.2.
|
2008-01-15 06:57:19 +01:00
|
|
|
- Avoid segfaults on certain complex invocations of
|
2008-01-17 20:56:21 +01:00
|
|
|
router_get_by_hexdigest(). Bugfix on 0.1.2.
|
|
|
|
|
- Correct bad index on array access in parse_http_time(). Bugfix
|
2008-01-15 06:57:19 +01:00
|
|
|
on 0.2.0.
|
|
|
|
|
- Fix possible bug in vote generation when server versions are present
|
|
|
|
|
but client versions are not.
|
|
|
|
|
- Fix rare bug on REDIRECTSTREAM control command when called with no
|
2008-01-17 20:56:21 +01:00
|
|
|
port set: it could erroneously report an error when none had
|
|
|
|
|
happened.
|
|
|
|
|
- Avoid bogus crash-prone, leak-prone tor_realloc when we're
|
|
|
|
|
compressing large objects and find ourselves with more than 4k
|
|
|
|
|
left over. Bugfix on 0.2.0.
|
2008-01-16 06:27:19 +01:00
|
|
|
- Fix a small memory leak when setting up a hidden service.
|
2008-01-17 20:56:21 +01:00
|
|
|
- Fix a few memory leaks that could in theory happen under bizarre
|
|
|
|
|
error conditions.
|
2008-01-17 06:25:21 +01:00
|
|
|
- Fix an assert if we post a general-purpose descriptor via the
|
|
|
|
|
control port but that descriptor isn't mentioned in our current
|
|
|
|
|
network consensus. Bug reported by Jon McLachlan; bugfix on
|
|
|
|
|
0.2.0.9-alpha.
|
2008-01-02 05:57:48 +01:00
|
|
|
|
2007-12-31 22:12:16 +01:00
|
|
|
o Minor features (controller):
|
2008-01-17 20:56:21 +01:00
|
|
|
- Get NS events working again. Patch from tup.
|
2008-01-07 19:54:55 +01:00
|
|
|
- The GETCONF command now escapes and quotes configuration values
|
|
|
|
|
that don't otherwise fit into the torrc file.
|
|
|
|
|
- The SETCONF command now handles quoted values correctly.
|
2007-12-31 22:12:16 +01:00
|
|
|
|
2008-01-10 17:08:47 +01:00
|
|
|
o Minor features (directory authorities):
|
|
|
|
|
- New configuration options to override default maximum number of
|
2008-01-17 20:56:21 +01:00
|
|
|
servers allowed on a single IP address. This is important for
|
|
|
|
|
running a test network on a single host.
|
2008-01-10 18:08:05 +01:00
|
|
|
- Actually implement the -s option to tor-gencert.
|
|
|
|
|
- Add a manual page for tor-gencert.
|
2008-01-10 17:08:47 +01:00
|
|
|
|
2008-01-10 18:48:40 +01:00
|
|
|
o Minor features (bridges):
|
2008-01-17 20:56:21 +01:00
|
|
|
- Bridge authorities no longer serve bridge descriptors over
|
|
|
|
|
unencrypted connections.
|
2008-01-10 18:48:40 +01:00
|
|
|
|
2008-01-06 02:14:11 +01:00
|
|
|
o Minor features (other):
|
|
|
|
|
- Add hidden services and DNSPorts to the list of things that make
|
2008-01-17 20:56:21 +01:00
|
|
|
Tor accept that it has running ports. Change starting Tor with no
|
|
|
|
|
ports from a fatal error to a warning; we might change it back if
|
|
|
|
|
this turns out to confuse anybody. Fixes bug 579.
|
2008-01-06 02:14:11 +01:00
|
|
|
|
2008-01-07 19:54:55 +01:00
|
|
|
|
2008-01-19 18:58:09 +01:00
|
|
|
Changes in version 0.1.2.19 - 2008-01-17
|
|
|
|
|
Tor 0.1.2.19 fixes a huge memory leak on exit relays, makes the default
|
|
|
|
|
exit policy a little bit more conservative so it's safer to run an
|
|
|
|
|
exit relay on a home system, and fixes a variety of smaller issues.
|
|
|
|
|
|
|
|
|
|
o Security fixes:
|
|
|
|
|
- Exit policies now reject connections that are addressed to a
|
|
|
|
|
relay's public (external) IP address too, unless
|
|
|
|
|
ExitPolicyRejectPrivate is turned off. We do this because too
|
|
|
|
|
many relays are running nearby to services that trust them based
|
|
|
|
|
on network address.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- When the clock jumps forward a lot, do not allow the bandwidth
|
|
|
|
|
buckets to become negative. Fixes bug 544.
|
|
|
|
|
- Fix a memory leak on exit relays; we were leaking a cached_resolve_t
|
|
|
|
|
on every successful resolve. Reported by Mike Perry.
|
|
|
|
|
- Purge old entries from the "rephist" database and the hidden
|
|
|
|
|
service descriptor database even when DirPort is zero.
|
|
|
|
|
- Stop thinking that 0.1.2.x directory servers can handle "begin_dir"
|
|
|
|
|
requests. Should ease bugs 406 and 419 where 0.1.2.x relays are
|
|
|
|
|
crashing or mis-answering these requests.
|
|
|
|
|
- When we decide to send a 503 response to a request for servers, do
|
|
|
|
|
not then also send the server descriptors: this defeats the whole
|
|
|
|
|
purpose. Fixes bug 539.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Changing the ExitPolicyRejectPrivate setting should cause us to
|
|
|
|
|
rebuild our server descriptor.
|
|
|
|
|
- Fix handling of hex nicknames when answering controller requests for
|
|
|
|
|
networkstatus by name, or when deciding whether to warn about
|
|
|
|
|
unknown routers in a config option. (Patch from mwenge.)
|
|
|
|
|
- Fix a couple of hard-to-trigger autoconf problems that could result
|
|
|
|
|
in really weird results on platforms whose sys/types.h files define
|
|
|
|
|
nonstandard integer types.
|
|
|
|
|
- Don't try to create the datadir when running --verify-config or
|
|
|
|
|
--hash-password. Resolves bug 540.
|
|
|
|
|
- If we were having problems getting a particular descriptor from the
|
|
|
|
|
directory caches, and then we learned about a new descriptor for
|
|
|
|
|
that router, we weren't resetting our failure count. Reported
|
|
|
|
|
by lodger.
|
|
|
|
|
- Although we fixed bug 539 (where servers would send HTTP status 503
|
|
|
|
|
responses _and_ send a body too), there are still servers out there
|
|
|
|
|
that haven't upgraded. Therefore, make clients parse such bodies
|
|
|
|
|
when they receive them.
|
|
|
|
|
- Run correctly on systems where rlim_t is larger than unsigned long.
|
|
|
|
|
This includes some 64-bit systems.
|
|
|
|
|
- Run correctly on platforms (like some versions of OS X 10.5) where
|
|
|
|
|
the real limit for number of open files is OPEN_FILES, not rlim_max
|
|
|
|
|
from getrlimit(RLIMIT_NOFILES).
|
|
|
|
|
- Avoid a spurious free on base64 failure.
|
|
|
|
|
- Avoid segfaults on certain complex invocations of
|
|
|
|
|
router_get_by_hexdigest().
|
|
|
|
|
- Fix rare bug on REDIRECTSTREAM control command when called with no
|
|
|
|
|
port set: it could erroneously report an error when none had
|
|
|
|
|
happened.
|
|
|
|
|
|
|
|
|
|
|
2007-12-25 06:45:36 +01:00
|
|
|
Changes in version 0.2.0.15-alpha - 2007-12-25
|
2008-01-11 03:31:19 +01:00
|
|
|
Tor 0.2.0.14-alpha and 0.2.0.15-alpha fix a bunch of bugs with the
|
|
|
|
|
features added in 0.2.0.13-alpha.
|
|
|
|
|
|
2007-12-24 12:25:45 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix several remotely triggerable asserts based on DirPort requests
|
|
|
|
|
for a v2 or v3 networkstatus object before we were prepared. This
|
|
|
|
|
was particularly bad for 0.2.0.13 and later bridge relays, who
|
|
|
|
|
would never have a v2 networkstatus and would thus always crash
|
|
|
|
|
when used. Bugfixes on 0.2.0.x.
|
|
|
|
|
- Estimate the v3 networkstatus size more accurately, rather than
|
|
|
|
|
estimating it at zero bytes and giving it artificially high priority
|
|
|
|
|
compared to other directory requests. Bugfix on 0.2.0.x.
|
|
|
|
|
|
2007-12-23 19:20:22 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix configure.in logic for cross-compilation.
|
2007-12-24 11:31:39 +01:00
|
|
|
- When we load a bridge descriptor from the cache, and it was
|
|
|
|
|
previously unreachable, mark it as retriable so we won't just
|
|
|
|
|
ignore it. Also, try fetching a new copy immediately. Bugfixes
|
|
|
|
|
on 0.2.0.13-alpha.
|
2007-12-25 01:07:13 +01:00
|
|
|
- The bridge GeoIP stats were counting other relays, for example
|
|
|
|
|
self-reachability and authority-reachability tests.
|
2007-12-23 19:20:22 +01:00
|
|
|
|
2007-12-23 19:27:47 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Support compilation to target iPhone; patch from cjacker huang.
|
|
|
|
|
To build for iPhone, pass the --enable-iphone option to configure.
|
|
|
|
|
|
|
|
|
|
|
2007-12-23 07:38:00 +01:00
|
|
|
Changes in version 0.2.0.14-alpha - 2007-12-23
|
2007-12-21 23:58:22 +01:00
|
|
|
o Major bugfixes:
|
2007-12-22 12:42:12 +01:00
|
|
|
- Fix a crash on startup if you install Tor 0.2.0.13-alpha fresh
|
|
|
|
|
without a datadirectory from a previous Tor install. Reported
|
|
|
|
|
by Zax.
|
2007-12-21 23:58:22 +01:00
|
|
|
- Fix a crash when we fetch a descriptor that turns out to be
|
|
|
|
|
unexpected (it used to be in our networkstatus when we started
|
|
|
|
|
fetching it, but it isn't in our current networkstatus), and we
|
|
|
|
|
aren't using bridges. Bugfix on 0.2.0.x.
|
2007-12-22 00:28:23 +01:00
|
|
|
- Fix a crash when accessing hidden services: it would work the first
|
|
|
|
|
time you use a given introduction point for your service, but
|
|
|
|
|
on subsequent requests we'd be using garbage memory. Fixed by
|
2007-12-23 07:38:00 +01:00
|
|
|
Karsten Loesing. Bugfix on 0.2.0.13-alpha.
|
2007-12-22 07:11:49 +01:00
|
|
|
- Fix a crash when we load a bridge descriptor from disk but we don't
|
|
|
|
|
currently have a Bridge line for it in our torrc. Bugfix on
|
2007-12-23 07:38:00 +01:00
|
|
|
0.2.0.13-alpha.
|
2007-12-21 23:58:22 +01:00
|
|
|
|
2007-12-22 12:48:17 +01:00
|
|
|
o Major features:
|
|
|
|
|
- If bridge authorities set BridgePassword, they will serve a
|
|
|
|
|
snapshot of known bridge routerstatuses from their DirPort to
|
|
|
|
|
anybody who knows that password. Unset by default.
|
|
|
|
|
|
2007-12-21 11:40:40 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Make the unit tests build again.
|
2007-12-22 06:27:30 +01:00
|
|
|
- Make "GETINFO/desc-annotations/id/<OR digest>" actually work.
|
2007-12-22 09:27:42 +01:00
|
|
|
- Make PublishServerDescriptor default to 1, so the default doesn't
|
|
|
|
|
have to change as we invent new directory protocol versions.
|
2007-12-22 18:30:12 +01:00
|
|
|
- Fix test for rlim_t on OSX 10.3: sys/resource.h doesn't want to
|
|
|
|
|
be included unless sys/time.h is already included. Fixes
|
|
|
|
|
bug 553. Bugfix on 0.2.0.x.
|
2007-12-23 02:18:14 +01:00
|
|
|
- If we receive a general-purpose descriptor and then receive an
|
|
|
|
|
identical bridge-purpose descriptor soon after, don't discard
|
|
|
|
|
the next one as a duplicate.
|
2007-12-21 11:40:40 +01:00
|
|
|
|
2007-12-22 10:04:46 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- If BridgeRelay is set to 1, then the default for
|
|
|
|
|
PublishServerDescriptor is now "bridge" rather than "v2,v3".
|
2007-12-22 10:13:24 +01:00
|
|
|
- If the user sets RelayBandwidthRate but doesn't set
|
|
|
|
|
RelayBandwidthBurst, then make them equal rather than erroring out.
|
2007-12-22 10:04:46 +01:00
|
|
|
|
2007-12-21 11:40:40 +01:00
|
|
|
|
2007-12-21 07:08:00 +01:00
|
|
|
Changes in version 0.2.0.13-alpha - 2007-12-21
|
2007-12-22 10:20:11 +01:00
|
|
|
Tor 0.2.0.13-alpha adds a fourth v3 directory authority run by Geoff
|
|
|
|
|
Goodell, fixes many more bugs, and adds a lot of infrastructure for
|
|
|
|
|
upcoming features.
|
|
|
|
|
|
2007-12-08 21:16:34 +01:00
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up lefkada (run by Geoff Goodell) as the fourth v3 directory
|
|
|
|
|
authority.
|
|
|
|
|
|
2007-11-26 03:18:57 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Only update guard status (usable / not usable) once we have
|
|
|
|
|
enough directory information. This was causing us to always pick
|
|
|
|
|
two new guards on startup (bugfix on 0.2.0.9-alpha), and it was
|
|
|
|
|
causing us to discard all our guards on startup if we hadn't been
|
|
|
|
|
running for a few weeks (bugfix on 0.1.2.x). Fixes bug 448.
|
2007-12-02 12:24:06 +01:00
|
|
|
- Purge old entries from the "rephist" database and the hidden
|
|
|
|
|
service descriptor databases even when DirPort is zero. Bugfix
|
|
|
|
|
on 0.1.2.x.
|
|
|
|
|
- We were ignoring our RelayBandwidthRate for the first 30 seconds
|
2007-12-21 08:29:55 +01:00
|
|
|
after opening a circuit -- even a relayed circuit. Bugfix on
|
2007-12-02 12:24:06 +01:00
|
|
|
0.2.0.3-alpha.
|
2007-12-03 23:31:59 +01:00
|
|
|
- Stop thinking that 0.1.2.x directory servers can handle "begin_dir"
|
|
|
|
|
requests. Should ease bugs 406 and 419 where 0.1.2.x relays are
|
2007-12-21 08:29:55 +01:00
|
|
|
crashing or mis-answering these types of requests.
|
2007-12-11 21:18:12 +01:00
|
|
|
- Relays were publishing their server descriptor to v1 and v2
|
|
|
|
|
directory authorities, but they didn't try publishing to v3-only
|
|
|
|
|
authorities. Fix this; and also stop publishing to v1 authorities.
|
2007-12-21 08:29:55 +01:00
|
|
|
Bugfix on 0.2.0.x.
|
2007-12-19 04:11:02 +01:00
|
|
|
- When we were reading router descriptors from cache, we were ignoring
|
2007-12-21 08:29:55 +01:00
|
|
|
the annotations -- so for example we were reading in bridge-purpose
|
|
|
|
|
descriptors as general-purpose descriptors. Bugfix on 0.2.0.8-alpha.
|
|
|
|
|
- When we decided to send a 503 response to a request for servers, we
|
|
|
|
|
were then also sending the server descriptors: this defeats the
|
|
|
|
|
whole purpose. Fixes bug 539; bugfix on 0.1.2.x.
|
2007-11-26 03:18:57 +01:00
|
|
|
|
2007-12-06 18:01:16 +01:00
|
|
|
o Major features:
|
2007-12-21 08:29:55 +01:00
|
|
|
- Bridge relays now behave like clients with respect to time
|
|
|
|
|
intervals for downloading new consensus documents -- otherwise they
|
|
|
|
|
stand out. Bridge users now wait until the end of the interval,
|
|
|
|
|
so their bridge relay will be sure to have a new consensus document.
|
2007-12-12 05:38:54 +01:00
|
|
|
- Three new config options (AlternateDirAuthority,
|
|
|
|
|
AlternateBridgeAuthority, and AlternateHSAuthority) that let the
|
2007-12-21 08:29:55 +01:00
|
|
|
user selectively replace the default directory authorities by type,
|
|
|
|
|
rather than the all-or-nothing replacement that DirServer offers.
|
2007-12-19 05:58:58 +01:00
|
|
|
- Tor can now be configured to read a GeoIP file from disk in one
|
|
|
|
|
of two formats. This can be used by controllers to map IP addresses
|
|
|
|
|
to countries. Eventually, it may support exit-by-country.
|
|
|
|
|
- When possible, bridge relays remember which countries users
|
|
|
|
|
are coming from, and report aggregate information in their
|
|
|
|
|
extra-info documents, so that the bridge authorities can learn
|
|
|
|
|
where Tor is blocked.
|
|
|
|
|
- Bridge directory authorities now do reachability testing on the
|
|
|
|
|
bridges they know. They provide router status summaries to the
|
2007-12-21 08:29:55 +01:00
|
|
|
controller via "getinfo ns/purpose/bridge", and also dump summaries
|
2007-12-19 05:58:58 +01:00
|
|
|
to a file periodically.
|
2007-12-21 07:08:00 +01:00
|
|
|
- Stop fetching directory info so aggressively if your DirPort is
|
|
|
|
|
on but your ORPort is off; stop fetching v2 dir info entirely.
|
|
|
|
|
You can override these choices with the new FetchDirInfoEarly
|
|
|
|
|
config option.
|
2007-12-06 18:01:16 +01:00
|
|
|
|
2007-11-17 08:00:14 +01:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- The fix in 0.2.0.12-alpha cleared the "hsdir" flag in v3 network
|
|
|
|
|
consensus documents when there are too many relays at a single
|
2007-12-10 17:40:14 +01:00
|
|
|
IP address. Now clear it in v2 network status documents too, and
|
|
|
|
|
also clear it in routerinfo_t when the relay is no longer listed
|
|
|
|
|
in the relevant networkstatus document.
|
2007-11-22 01:43:22 +01:00
|
|
|
- Don't crash if we get an unexpected value for the
|
|
|
|
|
PublishServerDescriptor config option. Reported by Matt Edman;
|
|
|
|
|
bugfix on 0.2.0.9-alpha.
|
2007-11-27 22:06:34 +01:00
|
|
|
- Our new v2 hidden service descriptor format allows descriptors
|
|
|
|
|
that have no introduction points. But Tor crashed when we tried
|
|
|
|
|
to build a descriptor with no intro points (and it would have
|
|
|
|
|
crashed if we had tried to parse one). Bugfix on 0.2.0.x; patch
|
|
|
|
|
by Karsten Loesing.
|
2007-11-30 19:11:26 +01:00
|
|
|
- Fix building with dmalloc 5.5.2 with glibc.
|
2007-12-02 07:11:53 +01:00
|
|
|
- Reject uploaded descriptors and extrainfo documents if they're
|
|
|
|
|
huge. Otherwise we'll cache them all over the network and it'll
|
2007-12-02 12:15:55 +01:00
|
|
|
clog everything up. Reported by Aljosha Judmayer.
|
2007-12-05 17:30:52 +01:00
|
|
|
- Check for presence of s6_addr16 and s6_addr32 fields in in6_addr
|
2007-12-21 08:29:55 +01:00
|
|
|
via autoconf. Should fix compile on solaris. Bugfix on 0.2.0.x.
|
2007-12-05 20:32:58 +01:00
|
|
|
- When the DANGEROUS_VERSION controller status event told us we're
|
|
|
|
|
running an obsolete version, it used the string "OLD" to describe
|
|
|
|
|
it. Yet the "getinfo" interface used the string "OBSOLETE". Now use
|
2007-12-21 08:29:55 +01:00
|
|
|
"OBSOLETE" in both cases. Bugfix on 0.1.2.x.
|
2007-12-10 18:16:41 +01:00
|
|
|
- If we can't expand our list of entry guards (e.g. because we're
|
|
|
|
|
using bridges or we have StrictEntryNodes set), don't mark relays
|
|
|
|
|
down when they fail a directory request. Otherwise we're too quick
|
2007-12-21 08:29:55 +01:00
|
|
|
to mark all our entry points down. Bugfix on 0.1.2.x.
|
2007-12-12 00:06:45 +01:00
|
|
|
- Fix handling of hex nicknames when answering controller requests for
|
|
|
|
|
networkstatus by name, or when deciding whether to warn about unknown
|
2007-12-12 00:16:25 +01:00
|
|
|
routers in a config option. Bugfix on 0.1.2.x. (Patch from mwenge.)
|
2007-12-12 00:06:48 +01:00
|
|
|
- Fix a couple of hard-to-trigger autoconf problems that could result
|
|
|
|
|
in really weird results on platforms whose sys/types.h files define
|
2007-12-21 08:29:55 +01:00
|
|
|
nonstandard integer types. Bugfix on 0.1.2.x.
|
|
|
|
|
- Fix compilation with --disable-threads set. Bugfix on 0.2.0.x.
|
2007-12-20 06:06:02 +01:00
|
|
|
- Don't crash on name lookup when we have no current consensus. Fixes
|
|
|
|
|
bug 538; bugfix on 0.2.0.x.
|
2007-12-20 07:47:59 +01:00
|
|
|
- Only Tors that want to mirror the v2 directory info should
|
2007-12-21 08:29:55 +01:00
|
|
|
create the "cached-status" directory in their datadir. (All Tors
|
|
|
|
|
used to create it.) Bugfix on 0.2.0.9-alpha.
|
2007-12-21 07:33:02 +01:00
|
|
|
- Directory authorities should only automatically download Extra Info
|
2007-12-21 08:29:55 +01:00
|
|
|
documents if they're v1, v2, or v3 authorities. Bugfix on 0.1.2.x.
|
2007-11-30 19:11:26 +01:00
|
|
|
|
|
|
|
|
o Minor features:
|
2007-12-21 08:29:55 +01:00
|
|
|
- On the USR1 signal, when dmalloc is in use, log the top 10 memory
|
2007-12-01 21:04:36 +01:00
|
|
|
consumers. (We already do this on HUP.)
|
|
|
|
|
- Authorities and caches fetch the v2 networkstatus documents
|
|
|
|
|
less often, now that v3 is encouraged.
|
2007-12-04 19:35:03 +01:00
|
|
|
- Add a new config option BridgeRelay that specifies you want to
|
|
|
|
|
be a bridge relay. Right now the only difference is that it makes
|
|
|
|
|
you answer begin_dir requests, and it makes you cache dir info,
|
|
|
|
|
even if your DirPort isn't on.
|
2007-12-06 08:15:06 +01:00
|
|
|
- Add "GETINFO/desc-annotations/id/<OR digest>" so controllers can
|
|
|
|
|
ask about source, timestamp of arrival, purpose, etc. We need
|
|
|
|
|
something like this to help Vidalia not do GeoIP lookups on bridge
|
|
|
|
|
addresses.
|
2007-12-09 05:59:27 +01:00
|
|
|
- Allow multiple HashedControlPassword config lines, to support
|
|
|
|
|
multiple controller passwords.
|
2007-12-21 08:29:55 +01:00
|
|
|
- Authorities now decide whether they're authoritative for a given
|
|
|
|
|
router based on the router's purpose.
|
2007-12-10 17:49:54 +01:00
|
|
|
- New config options AuthDirBadDir and AuthDirListBadDirs for
|
|
|
|
|
authorities to mark certain relays as "bad directories" in the
|
|
|
|
|
networkstatus documents. Also supports the "!baddir" directive in
|
|
|
|
|
the approved-routers file.
|
2007-11-17 08:00:14 +01:00
|
|
|
|
|
|
|
|
|
2007-11-17 03:22:56 +01:00
|
|
|
Changes in version 0.2.0.12-alpha - 2007-11-16
|
2007-11-17 08:15:56 +01:00
|
|
|
This twelfth development snapshot fixes some more build problems as
|
|
|
|
|
well as a few minor bugs.
|
|
|
|
|
|
2007-11-12 21:42:57 +01:00
|
|
|
o Compile fixes:
|
|
|
|
|
- Make it build on OpenBSD again. Patch from tup.
|
2007-11-17 03:22:56 +01:00
|
|
|
- Substitute BINDIR and LOCALSTATEDIR in scripts. Fixes
|
|
|
|
|
package-building for Red Hat, OS X, etc.
|
2007-11-12 21:42:57 +01:00
|
|
|
|
2007-11-17 08:00:14 +01:00
|
|
|
o Minor bugfixes (on 0.1.2.x):
|
|
|
|
|
- Changing the ExitPolicyRejectPrivate setting should cause us to
|
|
|
|
|
rebuild our server descriptor.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.0.x):
|
2007-11-14 19:39:15 +01:00
|
|
|
- When we're lacking a consensus, don't try to perform rendezvous
|
2007-11-17 03:22:56 +01:00
|
|
|
operations. Reported by Karsten Loesing.
|
2007-11-15 12:14:08 +01:00
|
|
|
- Fix a small memory leak whenever we decide against using a
|
|
|
|
|
newly picked entry guard. Reported by Mike Perry.
|
2007-11-17 02:53:33 +01:00
|
|
|
- When authorities detected more than two relays running on the same
|
|
|
|
|
IP address, they were clearing all the status flags but forgetting
|
|
|
|
|
to clear the "hsdir" flag. So clients were being told that a
|
|
|
|
|
given relay was the right choice for a v2 hsdir lookup, yet they
|
|
|
|
|
never had its descriptor because it was marked as 'not running'
|
|
|
|
|
in the consensus.
|
2007-11-16 08:31:51 +01:00
|
|
|
- If we're trying to fetch a bridge descriptor and there's no way
|
|
|
|
|
the bridge authority could help us (for example, we don't know
|
|
|
|
|
a digest, or there is no bridge authority), don't be so eager to
|
|
|
|
|
fall back to asking the bridge authority.
|
2007-11-16 08:37:49 +01:00
|
|
|
- If we're using bridges or have strictentrynodes set, and our
|
|
|
|
|
chosen exit is in the same family as all our bridges/entry guards,
|
|
|
|
|
then be flexible about families.
|
2007-11-14 19:39:15 +01:00
|
|
|
|
2007-11-14 21:01:15 +01:00
|
|
|
o Minor features:
|
2007-11-17 03:22:56 +01:00
|
|
|
- When we negotiate a v2 link-layer connection (not yet implemented),
|
|
|
|
|
accept RELAY_EARLY cells and turn them into RELAY cells if we've
|
|
|
|
|
negotiated a v1 connection for their next step. Initial code for
|
|
|
|
|
proposal 110.
|
2007-11-14 19:39:15 +01:00
|
|
|
|
2007-11-15 12:14:08 +01:00
|
|
|
|
2007-11-12 20:42:34 +01:00
|
|
|
Changes in version 0.2.0.11-alpha - 2007-11-12
|
2007-11-17 08:15:56 +01:00
|
|
|
This eleventh development snapshot fixes some build problems with
|
|
|
|
|
the previous snapshot. It also includes a more secure-by-default exit
|
|
|
|
|
policy for relays, fixes an enormous memory leak for exit relays, and
|
|
|
|
|
fixes another bug where servers were falling out of the directory list.
|
|
|
|
|
|
2007-11-10 22:17:51 +01:00
|
|
|
o Security fixes:
|
|
|
|
|
- Exit policies now reject connections that are addressed to a
|
|
|
|
|
relay's public (external) IP address too, unless
|
|
|
|
|
ExitPolicyRejectPrivate is turned off. We do this because too
|
|
|
|
|
many relays are running nearby to services that trust them based
|
2007-11-17 08:00:14 +01:00
|
|
|
on network address. Bugfix on 0.1.2.x.
|
2007-11-10 21:30:54 +01:00
|
|
|
|
2007-11-11 06:33:49 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a memory leak on exit relays; we were leaking a cached_resolve_t
|
2007-11-12 20:42:34 +01:00
|
|
|
on every successful resolve. Reported by Mike Perry; bugfix
|
|
|
|
|
on 0.1.2.x.
|
2007-11-12 17:29:31 +01:00
|
|
|
- On authorities, never downgrade to old router descriptors simply
|
2007-11-12 20:42:34 +01:00
|
|
|
because they're listed in the consensus. This created a catch-22
|
|
|
|
|
where we wouldn't list a new descriptor because there was an
|
|
|
|
|
old one in the consensus, and we couldn't get the new one in the
|
|
|
|
|
consensus because we wouldn't list it. Possible fix for bug 548.
|
|
|
|
|
Also, this might cause bug 543 to appear on authorities; if so,
|
|
|
|
|
we'll need a band-aid for that. Bugfix on 0.2.0.9-alpha.
|
2007-11-11 06:33:49 +01:00
|
|
|
|
2007-11-11 02:27:02 +01:00
|
|
|
o Packaging fixes on 0.2.0.10-alpha:
|
|
|
|
|
- We were including instructions about what to do with the
|
|
|
|
|
src/config/fallback-consensus file, but we weren't actually
|
|
|
|
|
including it in the tarball. Disable all of that for now.
|
2007-11-11 00:58:07 +01:00
|
|
|
|
2007-11-11 18:37:59 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Allow people to say PreferTunnelledDirConns rather than
|
|
|
|
|
PreferTunneledDirConns, for those alternate-spellers out there.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Don't reevaluate all the information from our consensus document
|
|
|
|
|
just because we've downloaded a v2 networkstatus that we intend
|
2007-11-17 08:00:14 +01:00
|
|
|
to cache. Fixes bug 545; bugfix on 0.2.0.x.
|
2007-11-11 18:37:59 +01:00
|
|
|
|
2007-11-10 21:30:54 +01:00
|
|
|
|
2007-11-10 07:56:03 +01:00
|
|
|
Changes in version 0.2.0.10-alpha - 2007-11-10
|
2007-11-17 08:15:56 +01:00
|
|
|
This tenth development snapshot adds a third v3 directory authority
|
|
|
|
|
run by Mike Perry, adds most of Karsten Loesing's new hidden service
|
|
|
|
|
descriptor format, fixes a bad crash bug and new bridge bugs introduced
|
|
|
|
|
in 0.2.0.9-alpha, fixes many bugs with the v3 directory implementation,
|
|
|
|
|
fixes some minor memory leaks in previous 0.2.0.x snapshots, and
|
|
|
|
|
addresses many more minor issues.
|
|
|
|
|
|
2007-11-07 22:20:45 +01:00
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up ides (run by Mike Perry) as the third v3 directory authority.
|
|
|
|
|
|
2007-10-28 09:16:19 +01:00
|
|
|
o Major features:
|
2007-11-07 20:38:08 +01:00
|
|
|
- Allow tunnelled directory connections to ask for an encrypted
|
|
|
|
|
"begin_dir" connection or an anonymized "uses a full Tor circuit"
|
|
|
|
|
connection independently. Now we can make anonymized begin_dir
|
|
|
|
|
connections for (e.g.) more secure hidden service posting and
|
|
|
|
|
fetching.
|
|
|
|
|
- More progress on proposal 114: code from Karsten Loesing to
|
|
|
|
|
implement new hidden service descriptor format.
|
2007-11-03 23:08:52 +01:00
|
|
|
- Raise the default BandwidthRate/BandwidthBurst to 5MB/10MB, to
|
|
|
|
|
accommodate the growing number of servers that use the default
|
|
|
|
|
and are reaching it.
|
2007-11-10 08:03:05 +01:00
|
|
|
- Directory authorities use a new formula for selecting which nodes
|
|
|
|
|
to advertise as Guards: they must be in the top 7/8 in terms of
|
|
|
|
|
how long we have known about them, and above the median of those
|
|
|
|
|
nodes in terms of weighted fractional uptime.
|
2007-11-10 08:26:56 +01:00
|
|
|
- Make "not enough dir info yet" warnings describe *why* Tor feels
|
|
|
|
|
it doesn't have enough directory info yet.
|
2007-10-28 09:16:19 +01:00
|
|
|
|
2007-10-27 23:40:32 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop servers from crashing if they set a Family option (or
|
|
|
|
|
maybe in other situations too). Bugfix on 0.2.0.9-alpha; reported
|
|
|
|
|
by Fabian Keil.
|
2007-11-07 20:38:08 +01:00
|
|
|
- Make bridge users work again -- the move to v3 directories in
|
|
|
|
|
0.2.0.9-alpha had introduced a number of bugs that made bridges
|
|
|
|
|
no longer work for clients.
|
2007-11-06 20:42:37 +01:00
|
|
|
- When the clock jumps forward a lot, do not allow the bandwidth
|
2007-11-07 20:38:08 +01:00
|
|
|
buckets to become negative. Bugfix on 0.1.2.x; fixes bug 544.
|
2007-10-27 23:40:32 +02:00
|
|
|
|
2007-11-04 03:36:09 +01:00
|
|
|
o Major bugfixes (v3 dir, bugfixes on 0.2.0.9-alpha):
|
2007-11-07 20:38:08 +01:00
|
|
|
- When the consensus lists a router descriptor that we previously were
|
|
|
|
|
mirroring, but that we considered non-canonical, reload the
|
|
|
|
|
descriptor as canonical. This fixes bug 543 where Tor servers
|
|
|
|
|
would start complaining after a few days that they don't have
|
|
|
|
|
enough directory information to build a circuit.
|
2007-11-04 03:36:09 +01:00
|
|
|
- Consider replacing the current consensus when certificates arrive
|
2007-11-07 20:38:08 +01:00
|
|
|
that make the pending consensus valid. Previously, we were only
|
2007-11-04 03:36:09 +01:00
|
|
|
considering replacement when the new certs _didn't_ help.
|
|
|
|
|
- Fix an assert error on startup if we didn't already have the
|
|
|
|
|
consensus and certs cached in our datadirectory: we were caching
|
|
|
|
|
the consensus in consensus_waiting_for_certs but then free'ing it
|
|
|
|
|
right after.
|
|
|
|
|
- Avoid sending a request for "keys/fp" (for which we'll get a 400 Bad
|
|
|
|
|
Request) if we need more v3 certs but we've already got pending
|
|
|
|
|
requests for all of them.
|
2007-11-10 07:56:03 +01:00
|
|
|
- Correctly back off from failing certificate downloads. Fixes
|
|
|
|
|
bug 546.
|
2007-11-08 19:15:49 +01:00
|
|
|
- Authorities don't vote on the Running flag if they have been running
|
2007-11-10 07:56:03 +01:00
|
|
|
for less than 30 minutes themselves. Fixes bug 547, where a newly
|
2007-11-08 19:15:49 +01:00
|
|
|
started authority would vote that everyone was down.
|
2007-11-04 03:36:09 +01:00
|
|
|
|
2007-10-25 18:54:56 +02:00
|
|
|
o New requirements:
|
2007-11-07 20:38:08 +01:00
|
|
|
- Drop support for OpenSSL version 0.9.6. Just about nobody was using
|
2007-11-03 23:06:56 +01:00
|
|
|
it, it had no AES, and it hasn't seen any security patches since
|
|
|
|
|
2004.
|
2007-10-25 18:54:56 +02:00
|
|
|
|
2007-10-27 00:50:40 +02:00
|
|
|
o Minor features:
|
2007-11-07 22:20:45 +01:00
|
|
|
- Clients now hold circuitless TLS connections open for 1.5 times
|
2007-11-10 08:26:56 +01:00
|
|
|
MaxCircuitDirtiness (15 minutes), since it is likely that they'll
|
|
|
|
|
rebuild a new circuit over them within that timeframe. Previously,
|
|
|
|
|
they held them open only for KeepalivePeriod (5 minutes).
|
|
|
|
|
- Use "If-Modified-Since" to avoid retrieving consensus
|
|
|
|
|
networkstatuses that we already have.
|
2007-10-29 00:44:55 +01:00
|
|
|
- When we have no consensus, check FallbackNetworkstatusFile (defaults
|
|
|
|
|
to $PREFIX/share/tor/fallback-consensus) for a consensus. This way
|
|
|
|
|
we start knowing some directory caches.
|
2007-10-30 16:17:01 +01:00
|
|
|
- When we receive a consensus from the future, warn about skew.
|
2007-11-03 23:06:56 +01:00
|
|
|
- Improve skew reporting: try to give the user a better log message
|
|
|
|
|
about how skewed they are, and how much this matters.
|
|
|
|
|
- When we have a certificate for an authority, believe that
|
|
|
|
|
certificate's claims about the authority's IP address.
|
2007-11-01 05:38:43 +01:00
|
|
|
- New --quiet command-line option to suppress the default console log.
|
|
|
|
|
Good in combination with --hash-password.
|
2007-11-01 06:01:24 +01:00
|
|
|
- Authorities send back an X-Descriptor-Not-New header in response to
|
2011-05-20 03:39:09 +02:00
|
|
|
an accepted-but-discarded descriptor upload. Partially implements
|
2007-11-01 06:01:24 +01:00
|
|
|
fix for bug 535.
|
2007-11-07 17:37:08 +01:00
|
|
|
- Make the log message for "tls error. breaking." more useful.
|
2007-11-08 17:19:04 +01:00
|
|
|
- Better log messages about certificate downloads, to attempt to
|
|
|
|
|
track down the second incarnation of bug 546.
|
2007-10-30 16:17:07 +01:00
|
|
|
|
2007-11-04 01:15:42 +01:00
|
|
|
o Minor features (bridges):
|
|
|
|
|
- If bridge users set UpdateBridgesFromAuthority, but the digest
|
|
|
|
|
they ask for is a 404 from the bridge authority, they now fall
|
|
|
|
|
back to trying the bridge directly.
|
|
|
|
|
- Bridges now use begin_dir to publish their server descriptor to
|
|
|
|
|
the bridge authority, even when they haven't set TunnelDirConns.
|
|
|
|
|
|
2007-10-30 16:17:07 +01:00
|
|
|
o Minor features (controller):
|
2007-11-10 07:56:03 +01:00
|
|
|
- When reporting clock skew, and we know that the clock is _at least
|
2007-11-07 22:26:59 +01:00
|
|
|
as skewed_ as some value, but we don't know the actual value,
|
|
|
|
|
report the value as a "minimum skew."
|
2007-10-27 00:50:40 +02:00
|
|
|
|
2007-11-03 23:06:56 +01:00
|
|
|
o Utilities:
|
2007-10-29 20:43:35 +01:00
|
|
|
- Update linux-tor-prio.sh script to allow QoS based on the uid of
|
2007-11-03 23:06:56 +01:00
|
|
|
the Tor process. Patch from Marco Bonetti with tweaks from Mike
|
|
|
|
|
Perry.
|
2007-10-29 20:43:35 +01:00
|
|
|
|
2007-10-25 06:40:27 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Refuse to start if both ORPort and UseBridges are set. Bugfix
|
2007-11-10 08:26:56 +01:00
|
|
|
on 0.2.0.x, suggested by Matt Edman.
|
2007-11-08 05:19:51 +01:00
|
|
|
- Don't stop fetching descriptors when FetchUselessDescriptors is
|
|
|
|
|
set, even if we stop asking for circuits. Bugfix on 0.1.2.x;
|
|
|
|
|
reported by tup and ioerror.
|
2007-10-26 16:57:26 +02:00
|
|
|
- Better log message on vote from unknown authority.
|
2007-11-10 08:26:56 +01:00
|
|
|
- Don't log "Launching 0 request for 0 router" message.
|
2007-10-25 16:31:15 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes (memory leaks):
|
2007-10-25 15:18:37 +02:00
|
|
|
- Stop leaking memory every time we parse a v3 certificate. Bugfix
|
|
|
|
|
on 0.2.0.1-alpha.
|
2007-10-25 16:31:13 +02:00
|
|
|
- Stop leaking memory every time we load a v3 certificate. Bugfix
|
2008-08-06 01:33:43 +02:00
|
|
|
on 0.2.0.1-alpha. Fixes bug 536.
|
2007-10-25 16:31:15 +02:00
|
|
|
- Stop leaking a cached networkstatus on exit. Bugfix on
|
|
|
|
|
0.2.0.3-alpha.
|
2007-11-03 23:06:56 +01:00
|
|
|
- Stop leaking voter information every time we free a consensus.
|
|
|
|
|
Bugfix on 0.2.0.3-alpha.
|
2007-10-25 16:31:15 +02:00
|
|
|
- Stop leaking signed data every time we check a voter signature.
|
|
|
|
|
Bugfix on 0.2.0.3-alpha.
|
|
|
|
|
- Stop leaking a signature every time we fail to parse a consensus or
|
|
|
|
|
a vote. Bugfix on 0.2.0.3-alpha.
|
2007-10-25 16:37:49 +02:00
|
|
|
- Stop leaking v2_download_status_map on shutdown. Bugfix on
|
|
|
|
|
0.2.0.9-alpha.
|
2007-11-03 15:44:53 +01:00
|
|
|
- Stop leaking conn->nickname every time we make a connection to a
|
|
|
|
|
Tor relay without knowing its expected identity digest (e.g. when
|
|
|
|
|
using bridges). Bugfix on 0.2.0.3-alpha.
|
2007-10-25 06:40:27 +02:00
|
|
|
|
2007-11-02 15:50:37 +01:00
|
|
|
- Minor bugfixes (portability):
|
2007-11-02 17:02:26 +01:00
|
|
|
- Run correctly on platforms where rlim_t is larger than unsigned
|
2007-11-07 22:20:45 +01:00
|
|
|
long, and/or where the real limit for number of open files is
|
|
|
|
|
OPEN_FILES, not rlim_max from getrlimit(RLIMIT_NOFILES). In
|
|
|
|
|
particular, these may be needed for OS X 10.5.
|
2007-11-02 15:50:37 +01:00
|
|
|
|
2007-10-25 06:40:27 +02:00
|
|
|
|
2007-11-11 01:33:53 +01:00
|
|
|
Changes in version 0.1.2.18 - 2007-10-28
|
|
|
|
|
Tor 0.1.2.18 fixes many problems including crash bugs, problems with
|
|
|
|
|
hidden service introduction that were causing huge delays, and a big
|
|
|
|
|
bug that was causing some servers to disappear from the network status
|
|
|
|
|
lists for a few hours each day.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- If a connection is shut down abruptly because of something that
|
|
|
|
|
happened inside connection_flushed_some(), do not call
|
|
|
|
|
connection_finished_flushing(). Should fix bug 451:
|
|
|
|
|
"connection_stop_writing: Assertion conn->write_event failed"
|
|
|
|
|
Bugfix on 0.1.2.7-alpha.
|
|
|
|
|
- Fix possible segfaults in functions called from
|
|
|
|
|
rend_process_relay_cell().
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (hidden services):
|
|
|
|
|
- Hidden services were choosing introduction points uniquely by
|
|
|
|
|
hexdigest, but when constructing the hidden service descriptor
|
|
|
|
|
they merely wrote the (potentially ambiguous) nickname.
|
|
|
|
|
- Clients now use the v2 intro format for hidden service
|
|
|
|
|
connections: they specify their chosen rendezvous point by identity
|
|
|
|
|
digest rather than by (potentially ambiguous) nickname. These
|
|
|
|
|
changes could speed up hidden service connections dramatically.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (other):
|
|
|
|
|
- Stop publishing a new server descriptor just because we get a
|
|
|
|
|
HUP signal. This led (in a roundabout way) to some servers getting
|
|
|
|
|
dropped from the networkstatus lists for a few hours each day.
|
|
|
|
|
- When looking for a circuit to cannibalize, consider family as well
|
|
|
|
|
as identity. Fixes bug 438. Bugfix on 0.1.0.x (which introduced
|
|
|
|
|
circuit cannibalization).
|
|
|
|
|
- When a router wasn't listed in a new networkstatus, we were leaving
|
|
|
|
|
the flags for that router alone -- meaning it remained Named,
|
|
|
|
|
Running, etc -- even though absence from the networkstatus means
|
|
|
|
|
that it shouldn't be considered to exist at all anymore. Now we
|
|
|
|
|
clear all the flags for routers that fall out of the networkstatus
|
|
|
|
|
consensus. Fixes bug 529.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Don't try to access (or alter) the state file when running
|
|
|
|
|
--list-fingerprint or --verify-config or --hash-password. Resolves
|
|
|
|
|
bug 499.
|
|
|
|
|
- When generating information telling us how to extend to a given
|
|
|
|
|
router, do not try to include the nickname if it is
|
|
|
|
|
absent. Resolves bug 467.
|
|
|
|
|
- Fix a user-triggerable segfault in expand_filename(). (There isn't
|
|
|
|
|
a way to trigger this remotely.)
|
|
|
|
|
- When sending a status event to the controller telling it that an
|
2008-06-07 07:24:47 +02:00
|
|
|
OR address is reachable, set the port correctly. (Previously we
|
2007-11-11 01:33:53 +01:00
|
|
|
were reporting the dir port.)
|
|
|
|
|
- Fix a minor memory leak whenever a controller sends the PROTOCOLINFO
|
|
|
|
|
command. Bugfix on 0.1.2.17.
|
|
|
|
|
- When loading bandwidth history, do not believe any information in
|
|
|
|
|
the future. Fixes bug 434.
|
|
|
|
|
- When loading entry guard information, do not believe any information
|
|
|
|
|
in the future.
|
|
|
|
|
- When we have our clock set far in the future and generate an
|
|
|
|
|
onion key, then re-set our clock to be correct, we should not stop
|
|
|
|
|
the onion key from getting rotated.
|
|
|
|
|
- On some platforms, accept() can return a broken address. Detect
|
|
|
|
|
this more quietly, and deal accordingly. Fixes bug 483.
|
|
|
|
|
- It's not actually an error to find a non-pending entry in the DNS
|
|
|
|
|
cache when canceling a pending resolve. Don't log unless stuff
|
|
|
|
|
is fishy. Resolves bug 463.
|
|
|
|
|
- Don't reset trusted dir server list when we set a configuration
|
|
|
|
|
option. Patch from Robert Hogan.
|
2007-12-20 07:15:09 +01:00
|
|
|
- Don't try to create the datadir when running --verify-config or
|
|
|
|
|
--hash-password. Resolves bug 540.
|
2007-11-11 01:33:53 +01:00
|
|
|
|
|
|
|
|
|
2007-10-24 14:23:49 +02:00
|
|
|
Changes in version 0.2.0.9-alpha - 2007-10-24
|
2007-10-27 23:36:56 +02:00
|
|
|
This ninth development snapshot switches clients to the new v3 directory
|
|
|
|
|
system; allows servers to be listed in the network status even when they
|
|
|
|
|
have the same nickname as a registered server; and fixes many other
|
|
|
|
|
bugs including a big one that was causing some servers to disappear
|
|
|
|
|
from the network status lists for a few hours each day.
|
|
|
|
|
|
2007-10-24 14:23:49 +02:00
|
|
|
o Major features (directory system):
|
2007-10-16 01:15:24 +02:00
|
|
|
- Clients now download v3 consensus networkstatus documents instead
|
2007-10-24 14:23:49 +02:00
|
|
|
of v2 networkstatus documents. Clients and caches now base their
|
|
|
|
|
opinions about routers on these consensus documents. Clients only
|
|
|
|
|
download router descriptors listed in the consensus.
|
|
|
|
|
- Authorities now list servers who have the same nickname as
|
|
|
|
|
a different named server, but list them with a new flag,
|
2007-10-25 05:03:52 +02:00
|
|
|
"Unnamed". Now we can list servers that happen to pick the same
|
|
|
|
|
nickname as a server that registered two years ago and then
|
|
|
|
|
disappeared. Partially implements proposal 122.
|
2008-07-09 14:36:26 +02:00
|
|
|
- If the consensus lists a router as "Unnamed", the name is assigned
|
2007-10-19 20:56:26 +02:00
|
|
|
to a different router: do not identify the router by that name.
|
2007-10-24 14:23:49 +02:00
|
|
|
Partially implements proposal 122.
|
2007-10-19 20:56:30 +02:00
|
|
|
- Authorities can now come to a consensus on which method to use to
|
2007-10-24 14:23:49 +02:00
|
|
|
compute the consensus. This gives us forward compatibility.
|
2007-10-12 21:53:29 +02:00
|
|
|
|
2007-10-14 00:31:35 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Stop publishing a new server descriptor just because we HUP or
|
|
|
|
|
when we find our DirPort to be reachable but won't actually publish
|
2007-10-24 14:23:49 +02:00
|
|
|
it. New descriptors without any real changes are dropped by the
|
2007-10-14 00:31:35 +02:00
|
|
|
authorities, and can screw up our "publish every 18 hours" schedule.
|
2007-10-24 14:23:49 +02:00
|
|
|
Bugfix on 0.1.2.x.
|
2007-10-19 01:14:42 +02:00
|
|
|
- When a router wasn't listed in a new networkstatus, we were leaving
|
|
|
|
|
the flags for that router alone -- meaning it remained Named,
|
|
|
|
|
Running, etc -- even though absence from the networkstatus means
|
|
|
|
|
that it shouldn't be considered to exist at all anymore. Now we
|
|
|
|
|
clear all the flags for routers that fall out of the networkstatus
|
2007-10-24 14:23:49 +02:00
|
|
|
consensus. Fixes bug 529; bugfix on 0.1.2.x.
|
2007-10-21 02:08:35 +02:00
|
|
|
- Fix awful behavior in DownloadExtraInfo option where we'd fetch
|
|
|
|
|
extrainfo documents and then discard them immediately for not
|
2007-10-24 16:17:47 +02:00
|
|
|
matching the latest router. Bugfix on 0.2.0.1-alpha.
|
2007-10-14 00:31:35 +02:00
|
|
|
|
2007-10-19 18:28:10 +02:00
|
|
|
o Minor features (v3 directory protocol):
|
2007-10-24 14:23:49 +02:00
|
|
|
- Allow tor-gencert to generate a new certificate without replacing
|
|
|
|
|
the signing key.
|
2007-10-19 18:28:10 +02:00
|
|
|
- Allow certificates to include an address.
|
2007-10-22 18:32:04 +02:00
|
|
|
- When we change our directory-cache settings, reschedule all voting
|
|
|
|
|
and download operations.
|
2007-10-24 14:23:49 +02:00
|
|
|
- Reattempt certificate downloads immediately on failure, as long as
|
|
|
|
|
we haven't failed a threshold number of times yet.
|
2007-10-24 21:53:11 +02:00
|
|
|
- Delay retrying consensus downloads while we're downloading
|
|
|
|
|
certificates to verify the one we just got. Also, count getting a
|
|
|
|
|
consensus that we already have (or one that isn't valid) as a failure,
|
|
|
|
|
and count failing to get the certificates after 20 minutes as a
|
|
|
|
|
failure.
|
2007-10-25 03:53:49 +02:00
|
|
|
- Build circuits and download descriptors even if our consensus is a
|
2007-10-25 05:03:52 +02:00
|
|
|
little expired. (This feature will go away once authorities are
|
|
|
|
|
more reliable.)
|
2007-10-19 18:28:10 +02:00
|
|
|
|
2007-10-15 16:59:48 +02:00
|
|
|
o Minor features (router descriptor cache):
|
2007-10-14 02:13:06 +02:00
|
|
|
- If we find a cached-routers file that's been sitting around for more
|
2007-10-24 14:23:49 +02:00
|
|
|
than 28 days unmodified, then most likely it's a leftover from
|
|
|
|
|
when we upgraded to 0.2.0.8-alpha. Remove it. It has no good
|
|
|
|
|
routers anyway.
|
|
|
|
|
- When we (as a cache) download a descriptor because it was listed
|
|
|
|
|
in a consensus, remember when the consensus was supposed to expire,
|
|
|
|
|
and don't expire the descriptor until then.
|
2007-10-14 02:13:06 +02:00
|
|
|
|
2007-10-16 20:19:02 +02:00
|
|
|
o Minor features (performance):
|
2007-10-24 14:23:49 +02:00
|
|
|
- Call routerlist_remove_old_routers() much less often. This should
|
2007-10-16 20:19:02 +02:00
|
|
|
speed startup, especially on directory caches.
|
2007-10-24 14:23:49 +02:00
|
|
|
- Don't try to launch new descriptor downloads quite so often when we
|
|
|
|
|
already have enough directory information to build circuits.
|
|
|
|
|
- Base64 decoding was actually showing up on our profile when parsing
|
|
|
|
|
the initial descriptor file; switch to an in-process all-at-once
|
|
|
|
|
implementation that's about 3.5x times faster than calling out to
|
|
|
|
|
OpenSSL.
|
2007-10-16 20:19:02 +02:00
|
|
|
|
2007-10-22 02:44:42 +02:00
|
|
|
o Minor features (compilation):
|
|
|
|
|
- Detect non-ASCII platforms (if any still exist) and refuse to
|
2007-10-24 14:23:49 +02:00
|
|
|
build there: some of our code assumes that 'A' is 65 and so on.
|
2007-10-22 02:44:42 +02:00
|
|
|
|
2007-10-24 14:23:49 +02:00
|
|
|
o Minor bugfixes (v3 directory authorities, bugfixes on 0.2.0.x):
|
2007-10-15 16:59:48 +02:00
|
|
|
- Make the "next period" votes into "current period" votes immediately
|
2007-10-24 14:23:49 +02:00
|
|
|
after publishing the consensus; avoid a heisenbug that made them
|
|
|
|
|
stick around indefinitely.
|
|
|
|
|
- When we discard a vote as a duplicate, do not report this as
|
|
|
|
|
an error.
|
2007-10-17 23:26:19 +02:00
|
|
|
- Treat missing v3 keys or certificates as an error when running as a
|
|
|
|
|
v3 directory authority.
|
2007-10-24 14:23:49 +02:00
|
|
|
- When we're configured to be a v3 authority, but we're only listed
|
|
|
|
|
as a non-v3 authority in our DirServer line for ourself, correct
|
|
|
|
|
the listing.
|
|
|
|
|
- If an authority doesn't have a qualified hostname, just put
|
|
|
|
|
its address in the vote. This fixes the problem where we referred to
|
|
|
|
|
"moria on moria:9031."
|
2007-10-19 18:41:32 +02:00
|
|
|
- Distinguish between detached signatures for the wrong period, and
|
|
|
|
|
detached signatures for a divergent vote.
|
2007-10-19 20:56:30 +02:00
|
|
|
- Fix a small memory leak when computing a consensus.
|
2007-10-23 08:38:16 +02:00
|
|
|
- When there's no concensus, we were forming a vote every 30
|
|
|
|
|
minutes, but writing the "valid-after" line in our vote based
|
|
|
|
|
on our configured V3AuthVotingInterval: so unless the intervals
|
|
|
|
|
matched up, we immediately rejected our own vote because it didn't
|
|
|
|
|
start at the voting interval that caused us to construct a vote.
|
2007-10-19 18:28:13 +02:00
|
|
|
|
2007-10-24 14:23:49 +02:00
|
|
|
o Minor bugfixes (v3 directory protocol, bugfixes on 0.2.0.x):
|
2007-10-17 18:55:44 +02:00
|
|
|
- Delete unverified-consensus when the real consensus is set.
|
2007-10-24 14:23:49 +02:00
|
|
|
- Consider retrying a consensus networkstatus fetch immediately
|
|
|
|
|
after one fails: don't wait 60 seconds to notice.
|
2007-10-18 16:19:56 +02:00
|
|
|
- When fetching a consensus as a cache, wait until a newer consensus
|
2007-10-24 14:23:49 +02:00
|
|
|
should exist before trying to replace the current one.
|
2007-10-25 05:03:52 +02:00
|
|
|
- Use a more forgiving schedule for retrying failed consensus
|
|
|
|
|
downloads than for other types.
|
2007-10-24 14:23:49 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes (other directory issues):
|
|
|
|
|
- Correct the implementation of "download votes by digest." Bugfix on
|
|
|
|
|
0.2.0.8-alpha.
|
|
|
|
|
- Authorities no longer send back "400 you're unreachable please fix
|
|
|
|
|
it" errors to Tor servers that aren't online all the time. We're
|
|
|
|
|
supposed to tolerate these servers now. Bugfix on 0.1.2.x.
|
2007-10-15 16:59:44 +02:00
|
|
|
|
2007-10-17 21:23:52 +02:00
|
|
|
o Minor bugfixes (controller):
|
2007-10-21 06:15:28 +02:00
|
|
|
- Don't reset trusted dir server list when we set a configuration
|
2007-10-24 14:23:49 +02:00
|
|
|
option. Patch from Robert Hogan; bugfix on 0.1.2.x.
|
2007-10-21 06:15:28 +02:00
|
|
|
- Respond to INT and TERM SIGNAL commands before we execute the
|
|
|
|
|
signal, in case the signal shuts us down. We had a patch in
|
|
|
|
|
0.1.2.1-alpha that tried to do this by queueing the response on
|
|
|
|
|
the connection's buffer before shutting down, but that really
|
2007-10-24 14:23:49 +02:00
|
|
|
isn't the same thing at all. Bug located by Matt Edman.
|
2007-10-15 17:38:44 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes (misc):
|
2007-10-24 14:23:49 +02:00
|
|
|
- Correctly check for bad options to the "PublishServerDescriptor"
|
|
|
|
|
config option. Bugfix on 0.2.0.1-alpha; reported by Matt Edman.
|
|
|
|
|
- Stop leaking memory on failing case of base32_decode, and make
|
|
|
|
|
it accept upper-case letters. Bugfixes on 0.2.0.7-alpha.
|
2007-10-21 01:45:07 +02:00
|
|
|
- Don't try to download extrainfo documents when we're trying to
|
|
|
|
|
fetch enough directory info to build a circuit: having enough
|
2007-10-24 14:23:49 +02:00
|
|
|
info should get priority. Bugfix on 0.2.0.x.
|
2007-10-23 17:44:13 +02:00
|
|
|
- Don't complain that "your server has not managed to confirm that its
|
|
|
|
|
ports are reachable" if we haven't been able to build any circuits
|
2007-10-24 14:23:49 +02:00
|
|
|
yet. Bug found by spending four hours without a v3 consensus. Bugfix
|
|
|
|
|
on 0.1.2.x.
|
2007-10-24 17:45:45 +02:00
|
|
|
- Detect the reason for failing to mmap a descriptor file we just
|
|
|
|
|
wrote, and give a more useful log message. Fixes bug 533. Bugfix
|
|
|
|
|
on 0.1.2.x.
|
2007-10-17 21:23:56 +02:00
|
|
|
|
2007-10-14 02:13:04 +02:00
|
|
|
o Code simplifications and refactoring:
|
|
|
|
|
- Remove support for the old bw_accounting file: we've been storing
|
2007-10-24 14:23:49 +02:00
|
|
|
bandwidth accounting information in the state file since
|
|
|
|
|
0.1.2.5-alpha. This may result in bandwidth accounting errors
|
|
|
|
|
if you try to upgrade from 0.1.1.x or earlier, or if you try to
|
|
|
|
|
downgrade to 0.1.1.x or earlier.
|
2007-10-17 18:55:44 +02:00
|
|
|
- New convenience code to locate a file within the DataDirectory.
|
2007-10-22 19:31:26 +02:00
|
|
|
- Move non-authority functionality out of dirvote.c.
|
2007-10-24 20:42:16 +02:00
|
|
|
- Refactor the arguments for router_pick_{directory_|trusteddir}server
|
2007-10-25 05:03:52 +02:00
|
|
|
so that they all take the same named flags.
|
2007-10-12 21:53:29 +02:00
|
|
|
|
2007-10-18 20:15:04 +02:00
|
|
|
o Utilities
|
|
|
|
|
- Include the "tor-ctrl.sh" bash script by Stefan Behte to provide
|
2007-10-24 14:23:49 +02:00
|
|
|
Unix users an easy way to script their Tor process (e.g. by
|
|
|
|
|
adjusting bandwidth based on the time of the day).
|
2007-10-18 20:15:04 +02:00
|
|
|
|
2007-10-19 01:14:42 +02:00
|
|
|
|
2007-10-10 19:56:53 +02:00
|
|
|
Changes in version 0.2.0.8-alpha - 2007-10-12
|
2007-10-22 10:52:01 +02:00
|
|
|
This eighth development snapshot fixes a crash bug that's been bothering
|
|
|
|
|
us since February 2007, lets bridge authorities store a list of bridge
|
|
|
|
|
descriptors they've seen, gets v3 directory voting closer to working,
|
|
|
|
|
starts caching v3 directory consensus documents on directory mirrors,
|
|
|
|
|
and fixes a variety of smaller issues including some minor memory leaks.
|
|
|
|
|
|
2007-10-11 01:40:21 +02:00
|
|
|
o Major features (router descriptor cache):
|
|
|
|
|
- Store routers in a file called cached-descriptors instead of in
|
|
|
|
|
cached-routers. Initialize cached-descriptors from cached-routers
|
|
|
|
|
if the old format is around. The new format allows us to store
|
|
|
|
|
annotations along with descriptors.
|
2007-10-12 20:55:30 +02:00
|
|
|
- Use annotations to record the time we received each descriptor, its
|
|
|
|
|
source, and its purpose.
|
2007-10-12 00:19:47 +02:00
|
|
|
- Disable the SETROUTERPURPOSE controller command: it is now
|
|
|
|
|
obsolete.
|
2007-10-12 09:57:29 +02:00
|
|
|
- Controllers should now specify cache=no or cache=yes when using
|
|
|
|
|
the +POSTDESCRIPTOR command.
|
2007-10-11 01:40:21 +02:00
|
|
|
- Bridge authorities now write bridge descriptors to disk, meaning
|
|
|
|
|
we can export them to other programs and begin distributing them
|
|
|
|
|
to blocked users.
|
|
|
|
|
|
2007-09-22 08:06:05 +02:00
|
|
|
o Major features (directory authorities):
|
2007-10-11 01:40:21 +02:00
|
|
|
- When a v3 authority is missing votes or signatures, it now tries
|
|
|
|
|
to fetch them.
|
2007-10-10 19:48:58 +02:00
|
|
|
- Directory authorities track weighted fractional uptime as well as
|
|
|
|
|
weighted mean-time-between failures. WFU is suitable for deciding
|
|
|
|
|
whether a node is "usually up", while MTBF is suitable for deciding
|
2007-10-11 01:40:21 +02:00
|
|
|
whether a node is "likely to stay up." We need both, because
|
|
|
|
|
"usually up" is a good requirement for guards, while "likely to
|
|
|
|
|
stay up" is a good requirement for long-lived connections.
|
2007-09-22 08:06:05 +02:00
|
|
|
|
2007-10-08 21:56:57 +02:00
|
|
|
o Major features (v3 directory system):
|
2007-10-12 20:55:30 +02:00
|
|
|
- Caches now download v3 network status documents as needed,
|
|
|
|
|
and download the descriptors listed in them.
|
2007-10-10 21:33:19 +02:00
|
|
|
- All hosts now attempt to download and keep fresh v3 authority
|
|
|
|
|
certificates, and re-attempt after failures.
|
2007-10-11 20:01:12 +02:00
|
|
|
- More internal-consistency checks for vote parsing.
|
2007-10-08 21:56:57 +02:00
|
|
|
|
2007-10-12 20:55:30 +02:00
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- If a connection is shut down abruptly because of something that
|
|
|
|
|
happened inside connection_flushed_some(), do not call
|
|
|
|
|
connection_finished_flushing(). Should fix bug 451. Bugfix on
|
|
|
|
|
0.1.2.7-alpha.
|
|
|
|
|
|
2007-10-11 01:40:21 +02:00
|
|
|
o Major bugfixes (performance):
|
|
|
|
|
- Fix really bad O(n^2) performance when parsing a long list of
|
|
|
|
|
routers: Instead of searching the entire list for an "extra-info "
|
|
|
|
|
string which usually wasn't there, once for every routerinfo
|
|
|
|
|
we read, just scan lines forward until we find one we like.
|
|
|
|
|
Bugfix on 0.2.0.1.
|
2007-10-11 22:45:26 +02:00
|
|
|
- When we add data to a write buffer in response to the data on that
|
2007-10-12 20:55:30 +02:00
|
|
|
write buffer getting low because of a flush, do not consider the
|
|
|
|
|
newly added data as a candidate for immediate flushing, but rather
|
|
|
|
|
make it wait until the next round of writing. Otherwise, we flush
|
|
|
|
|
and refill recursively, and a single greedy TLS connection can
|
|
|
|
|
eat all of our bandwidth. Bugfix on 0.1.2.7-alpha.
|
2007-09-27 22:46:24 +02:00
|
|
|
|
2007-10-02 22:19:43 +02:00
|
|
|
o Minor features (v3 authority system):
|
2007-10-11 01:40:21 +02:00
|
|
|
- Add more ways for tools to download the votes that lead to the
|
|
|
|
|
current consensus.
|
|
|
|
|
- Send a 503 when low on bandwidth and a vote, consensus, or
|
|
|
|
|
certificate is requested.
|
2007-10-10 22:28:01 +02:00
|
|
|
- If-modified-since is now implemented properly for all kinds of
|
|
|
|
|
certificate requests.
|
2007-10-02 22:19:43 +02:00
|
|
|
|
2007-10-11 01:40:21 +02:00
|
|
|
o Minor bugfixes (network statuses):
|
2007-10-10 21:53:08 +02:00
|
|
|
- Tweak the implementation of proposal 109 slightly: allow at most
|
|
|
|
|
two Tor servers on the same IP address, except if it's the location
|
2007-10-11 01:40:21 +02:00
|
|
|
of a directory authority, in which case allow five. Bugfix on
|
|
|
|
|
0.2.0.3-alpha.
|
2007-10-02 03:22:42 +02:00
|
|
|
|
2007-09-24 17:41:20 +02:00
|
|
|
o Minor bugfixes (controller):
|
|
|
|
|
- When sending a status event to the controller telling it that an
|
2007-10-25 15:18:37 +02:00
|
|
|
OR address is reachable, set the port correctly. (Previously we
|
2007-10-11 01:40:21 +02:00
|
|
|
were reporting the dir port.) Bugfix on 0.1.2.x.
|
2007-09-24 17:41:20 +02:00
|
|
|
|
2007-10-12 20:55:30 +02:00
|
|
|
o Minor bugfixes (v3 directory system):
|
2007-10-11 01:40:21 +02:00
|
|
|
- Fix logic to look up a cert by its signing key digest. Bugfix on
|
2007-09-27 18:41:42 +02:00
|
|
|
0.2.0.7-alpha.
|
2007-10-11 01:40:21 +02:00
|
|
|
- Only change the reply to a vote to "OK" if it's not already
|
|
|
|
|
set. This gets rid of annoying "400 OK" log messages, which may
|
|
|
|
|
have been masking some deeper issue. Bugfix on 0.2.0.7-alpha.
|
2007-10-09 20:36:56 +02:00
|
|
|
- When we get a valid consensus, recompute the voting schedule.
|
2007-10-11 01:40:21 +02:00
|
|
|
- Base the valid-after time of a vote on the consensus voting
|
|
|
|
|
schedule, not on our preferred schedule.
|
|
|
|
|
- Make the return values and messages from signature uploads and
|
|
|
|
|
downloads more sensible.
|
2007-10-10 22:06:38 +02:00
|
|
|
- Fix a memory leak when serving votes and consensus documents, and
|
|
|
|
|
another when serving certificates.
|
2007-09-27 18:41:42 +02:00
|
|
|
|
2007-09-28 21:23:54 +02:00
|
|
|
o Minor bugfixes (performance):
|
|
|
|
|
- Use a slightly simpler string hashing algorithm (copying Python's
|
|
|
|
|
instead of Java's) and optimize our digest hashing algorithm to take
|
|
|
|
|
advantage of 64-bit platforms and to remove some possibly-costly
|
|
|
|
|
voodoo.
|
2007-10-12 20:55:30 +02:00
|
|
|
- Fix a minor memory leak whenever we parse guards from our state
|
|
|
|
|
file. Bugfix on 0.2.0.7-alpha.
|
|
|
|
|
- Fix a minor memory leak whenever we write out a file. Bugfix on
|
|
|
|
|
0.2.0.7-alpha.
|
|
|
|
|
- Fix a minor memory leak whenever a controller sends the PROTOCOLINFO
|
|
|
|
|
command. Bugfix on 0.2.0.5-alpha.
|
2007-09-28 21:23:54 +02:00
|
|
|
|
2007-10-10 06:24:02 +02:00
|
|
|
o Minor bugfixes (portability):
|
2007-10-12 20:55:30 +02:00
|
|
|
- On some platforms, accept() can return a broken address. Detect
|
|
|
|
|
this more quietly, and deal accordingly. Fixes bug 483.
|
|
|
|
|
- Stop calling tor_strlower() on uninitialized memory in some cases.
|
|
|
|
|
Bugfix in 0.2.0.7-alpha.
|
2007-10-10 06:24:02 +02:00
|
|
|
|
2007-10-11 20:01:12 +02:00
|
|
|
o Minor bugfixes (usability):
|
|
|
|
|
- Treat some 403 responses from directory servers as INFO rather than
|
|
|
|
|
WARN-severity events.
|
2007-10-10 06:37:38 +02:00
|
|
|
- It's not actually an error to find a non-pending entry in the DNS
|
2007-10-12 20:55:30 +02:00
|
|
|
cache when canceling a pending resolve. Don't log unless stuff is
|
|
|
|
|
fishy. Resolves bug 463.
|
2007-10-10 06:37:38 +02:00
|
|
|
|
2007-10-11 01:44:10 +02:00
|
|
|
o Minor bugfixes (anonymity):
|
2007-10-10 17:07:19 +02:00
|
|
|
- Never report that we've used more bandwidth than we're willing to
|
2007-10-11 01:40:21 +02:00
|
|
|
relay: it leaks how much non-relay traffic we're using. Resolves
|
|
|
|
|
bug 516.
|
2007-10-12 20:55:30 +02:00
|
|
|
- When looking for a circuit to cannibalize, consider family as well
|
|
|
|
|
as identity. Fixes bug 438. Bugfix on 0.1.0.x (which introduced
|
|
|
|
|
circuit cannibalization).
|
2007-10-11 01:44:10 +02:00
|
|
|
|
2007-10-02 22:35:23 +02:00
|
|
|
o Code simplifications and refactoring:
|
2007-10-12 20:55:30 +02:00
|
|
|
- Make a bunch of functions static. Remove some dead code.
|
2007-10-08 23:21:50 +02:00
|
|
|
- Pull out about a third of the really big routerlist.c; put it in a
|
|
|
|
|
new module, networkstatus.c.
|
2007-10-09 17:27:15 +02:00
|
|
|
- Merge the extra fields in local_routerstatus_t back into
|
|
|
|
|
routerstatus_t: we used to need one routerstatus_t for each
|
|
|
|
|
authority's opinion, plus a local_routerstatus_t for the locally
|
2007-10-11 01:40:21 +02:00
|
|
|
computed consensus opinion. To save space, we put the locally
|
|
|
|
|
modified fields into local_routerstatus_t, and only the common
|
|
|
|
|
stuff into routerstatus_t. But once v3 directories are in use,
|
|
|
|
|
clients and caches will no longer need to hold authority opinions;
|
|
|
|
|
thus, the rationale for keeping the types separate is now gone.
|
|
|
|
|
- Make the code used to reschedule and reattempt downloads more
|
|
|
|
|
uniform.
|
|
|
|
|
- Turn all 'Are we a directory server/mirror?' logic into a call to
|
|
|
|
|
dirserver_mode().
|
2007-10-11 15:56:33 +02:00
|
|
|
- Remove the code to generate the oldest (v1) directory format.
|
|
|
|
|
The code has been disabled since 0.2.0.5-alpha.
|
2007-10-09 17:27:15 +02:00
|
|
|
|
2007-09-28 21:23:54 +02:00
|
|
|
|
2007-09-20 04:29:18 +02:00
|
|
|
Changes in version 0.2.0.7-alpha - 2007-09-21
|
2007-10-22 10:52:01 +02:00
|
|
|
This seventh development snapshot makes bridges work again, makes bridge
|
|
|
|
|
authorities work for the first time, fixes two huge performance flaws
|
|
|
|
|
in hidden services, and fixes a variety of minor issues.
|
|
|
|
|
|
2007-09-19 05:22:01 +02:00
|
|
|
o New directory authorities:
|
2007-09-21 00:02:38 +02:00
|
|
|
- Set up moria1 and tor26 as the first v3 directory authorities. See
|
2007-09-19 05:22:01 +02:00
|
|
|
doc/spec/dir-spec.txt for details on the new directory design.
|
|
|
|
|
|
2007-09-21 22:19:38 +02:00
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- Fix possible segfaults in functions called from
|
|
|
|
|
rend_process_relay_cell(). Bugfix on 0.1.2.x.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (bridges):
|
|
|
|
|
- Fix a bug that made servers send a "404 Not found" in response to
|
|
|
|
|
attempts to fetch their server descriptor. This caused Tor servers
|
|
|
|
|
to take many minutes to establish reachability for their DirPort,
|
|
|
|
|
and it totally crippled bridges. Bugfix on 0.2.0.5-alpha.
|
2007-09-21 08:14:36 +02:00
|
|
|
- Make "UpdateBridgesFromAuthority" torrc option work: when bridge
|
|
|
|
|
users configure that and specify a bridge with an identity
|
|
|
|
|
fingerprint, now they will lookup the bridge descriptor at the
|
|
|
|
|
default bridge authority via a one-hop tunnel, but once circuits
|
|
|
|
|
are established they will switch to a three-hop tunnel for later
|
2007-09-21 22:19:38 +02:00
|
|
|
connections to the bridge authority. Bugfix in 0.2.0.3-alpha.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (hidden services):
|
|
|
|
|
- Hidden services were choosing introduction points uniquely by
|
|
|
|
|
hexdigest, but when constructing the hidden service descriptor
|
|
|
|
|
they merely wrote the (potentially ambiguous) nickname.
|
|
|
|
|
- Clients now use the v2 intro format for hidden service
|
|
|
|
|
connections: they specify their chosen rendezvous point by identity
|
|
|
|
|
digest rather than by (potentially ambiguous) nickname. Both
|
|
|
|
|
are bugfixes on 0.1.2.x, and they could speed up hidden service
|
|
|
|
|
connections dramatically. Thanks to Karsten Loesing.
|
2007-09-21 08:14:36 +02:00
|
|
|
|
2007-08-27 17:33:58 +02:00
|
|
|
o Minor features (security):
|
2007-09-21 22:19:38 +02:00
|
|
|
- As a client, do not believe any server that tells us that an
|
|
|
|
|
address maps to an internal address space.
|
2007-09-05 02:31:07 +02:00
|
|
|
- Make it possible to enable HashedControlPassword and
|
|
|
|
|
CookieAuthentication at the same time.
|
2007-08-27 17:33:58 +02:00
|
|
|
|
2007-08-29 19:22:00 +02:00
|
|
|
o Minor features (guard nodes):
|
2007-09-21 22:19:38 +02:00
|
|
|
- Tag every guard node in our state file with the version that
|
|
|
|
|
we believe added it, or with our own version if we add it. This way,
|
|
|
|
|
if a user temporarily runs an old version of Tor and then switches
|
|
|
|
|
back to a new one, she doesn't automatically lose her guards.
|
2007-08-29 19:22:00 +02:00
|
|
|
|
2007-09-20 19:07:45 +02:00
|
|
|
o Minor features (speed):
|
|
|
|
|
- When implementing AES counter mode, update only the portions of the
|
|
|
|
|
counter buffer that need to change, and don't keep separate
|
2007-09-21 22:19:38 +02:00
|
|
|
network-order and host-order counters when they are the same (i.e.,
|
|
|
|
|
on big-endian hosts.)
|
2007-09-20 19:07:45 +02:00
|
|
|
|
2007-08-29 21:02:33 +02:00
|
|
|
o Minor features (controller):
|
|
|
|
|
- Accept LF instead of CRLF on controller, since some software has a
|
|
|
|
|
hard time generating real Internet newlines.
|
2007-09-18 17:53:55 +02:00
|
|
|
- Add GETINFO values for the server status events
|
|
|
|
|
"REACHABILITY_SUCCEEDED" and "GOOD_SERVER_DESCRIPTOR". Patch from
|
|
|
|
|
Robert Hogan.
|
2007-08-29 21:02:33 +02:00
|
|
|
|
2007-09-12 19:33:23 +02:00
|
|
|
o Removed features:
|
|
|
|
|
- Routers no longer include bandwidth-history lines in their
|
|
|
|
|
descriptors; this information is already available in extra-info
|
2007-09-21 22:19:38 +02:00
|
|
|
documents, and including it in router descriptors took up 60%
|
|
|
|
|
(!) of compressed router descriptor downloads. Completes
|
|
|
|
|
implementation of proposal 104.
|
2007-09-17 23:59:24 +02:00
|
|
|
- Remove the contrib scripts ExerciseServer.py, PathDemo.py,
|
|
|
|
|
and TorControl.py, as they use the old v0 controller protocol,
|
|
|
|
|
and are obsoleted by TorFlow anyway.
|
2007-09-18 23:17:45 +02:00
|
|
|
- Drop support for v1 rendezvous descriptors, since we never used
|
|
|
|
|
them anyway, and the code has probably rotted by now. Based on
|
|
|
|
|
patch from Karsten Loesing.
|
2007-09-21 22:02:43 +02:00
|
|
|
- On OSX, stop warning the user that kqueue support in libevent is
|
|
|
|
|
"experimental", since it seems to have worked fine for ages.
|
2007-09-12 19:33:23 +02:00
|
|
|
|
2007-08-28 02:00:32 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When generating information telling us how to extend to a given
|
2007-09-21 22:19:38 +02:00
|
|
|
router, do not try to include the nickname if it is absent. Fixes
|
|
|
|
|
bug 467. Bugfix on 0.2.0.3-alpha.
|
|
|
|
|
- Fix a user-triggerable (but not remotely-triggerable) segfault
|
|
|
|
|
in expand_filename(). Bugfix on 0.1.2.x.
|
2007-09-10 15:48:01 +02:00
|
|
|
- Fix a memory leak when freeing incomplete requests from DNSPort.
|
2007-09-21 22:19:38 +02:00
|
|
|
Found by Niels Provos with valgrind. Bugfix on 0.2.0.1-alpha.
|
2007-09-13 19:01:08 +02:00
|
|
|
- Don't try to access (or alter) the state file when running
|
|
|
|
|
--list-fingerprint or --verify-config or --hash-password. (Resolves
|
2007-09-21 22:19:38 +02:00
|
|
|
bug 499.) Bugfix on 0.1.2.x.
|
2007-09-18 00:22:05 +02:00
|
|
|
- Servers used to decline to publish their DirPort if their
|
|
|
|
|
BandwidthRate, RelayBandwidthRate, or MaxAdvertisedBandwidth
|
|
|
|
|
were below a threshold. Now they only look at BandwidthRate and
|
2007-09-21 22:19:38 +02:00
|
|
|
RelayBandwidthRate. Bugfix on 0.1.2.x.
|
|
|
|
|
- Remove an optimization in the AES counter-mode code that assumed
|
|
|
|
|
that the counter never exceeded 2^68. When the counter can be set
|
|
|
|
|
arbitrarily as an IV (as it is by Karsten's new hidden services
|
|
|
|
|
code), this assumption no longer holds. Bugfix on 0.1.2.x.
|
2007-09-20 06:37:17 +02:00
|
|
|
- Resume listing "AUTHORITY" flag for authorities in network status.
|
|
|
|
|
Bugfix on 0.2.0.3-alpha; reported by Alex de Joode.
|
2007-08-27 17:33:58 +02:00
|
|
|
|
2007-08-29 21:02:43 +02:00
|
|
|
o Code simplifications and refactoring:
|
2007-09-21 22:19:38 +02:00
|
|
|
- Revamp file-writing logic so we don't need to have the entire
|
|
|
|
|
contents of a file in memory at once before we write to disk. Tor,
|
|
|
|
|
meet stdio.
|
2007-08-31 17:08:37 +02:00
|
|
|
- Turn "descriptor store" into a full-fledged type.
|
2007-09-06 19:42:05 +02:00
|
|
|
- Move all NT services code into a separate source file.
|
2007-09-17 20:27:49 +02:00
|
|
|
- Unify all code that computes medians, percentile elements, etc.
|
2007-09-18 17:38:00 +02:00
|
|
|
- Get rid of a needless malloc when parsing address policies.
|
2007-08-29 21:02:43 +02:00
|
|
|
|
|
|
|
|
|
2007-08-31 23:39:11 +02:00
|
|
|
Changes in version 0.1.2.17 - 2007-08-30
|
2007-10-22 10:52:01 +02:00
|
|
|
Tor 0.1.2.17 features a new Vidalia version in the Windows and OS
|
|
|
|
|
X bundles. Vidalia 0.0.14 makes authentication required for the
|
|
|
|
|
ControlPort in the default configuration, which addresses important
|
|
|
|
|
security risks. Everybody who uses Vidalia (or another controller)
|
|
|
|
|
should upgrade.
|
|
|
|
|
|
|
|
|
|
In addition, this Tor update fixes major load balancing problems with
|
|
|
|
|
path selection, which should speed things up a lot once many people
|
|
|
|
|
have upgraded.
|
|
|
|
|
|
2007-08-31 23:39:11 +02:00
|
|
|
o Major bugfixes (security):
|
|
|
|
|
- We removed support for the old (v0) control protocol. It has been
|
|
|
|
|
deprecated since Tor 0.1.1.1-alpha, and keeping it secure has
|
|
|
|
|
become more of a headache than it's worth.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (load balancing):
|
|
|
|
|
- When choosing nodes for non-guard positions, weight guards
|
|
|
|
|
proportionally less, since they already have enough load. Patch
|
|
|
|
|
from Mike Perry.
|
|
|
|
|
- Raise the "max believable bandwidth" from 1.5MB/s to 10MB/s. This
|
|
|
|
|
will allow fast Tor servers to get more attention.
|
|
|
|
|
- When we're upgrading from an old Tor version, forget our current
|
|
|
|
|
guards and pick new ones according to the new weightings. These
|
|
|
|
|
three load balancing patches could raise effective network capacity
|
|
|
|
|
by a factor of four. Thanks to Mike Perry for measurements.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (stream expiration):
|
|
|
|
|
- Expire not-yet-successful application streams in all cases if
|
|
|
|
|
they've been around longer than SocksTimeout. Right now there are
|
|
|
|
|
some cases where the stream will live forever, demanding a new
|
|
|
|
|
circuit every 15 seconds. Fixes bug 454; reported by lodger.
|
|
|
|
|
|
|
|
|
|
o Minor features (controller):
|
|
|
|
|
- Add a PROTOCOLINFO controller command. Like AUTHENTICATE, it
|
|
|
|
|
is valid before any authentication has been received. It tells
|
|
|
|
|
a controller what kind of authentication is expected, and what
|
|
|
|
|
protocol is spoken. Implements proposal 119.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (performance):
|
|
|
|
|
- Save on most routerlist_assert_ok() calls in routerlist.c, thus
|
|
|
|
|
greatly speeding up loading cached-routers from disk on startup.
|
|
|
|
|
- Disable sentinel-based debugging for buffer code: we squashed all
|
|
|
|
|
the bugs that this was supposed to detect a long time ago, and now
|
|
|
|
|
its only effect is to change our buffer sizes from nice powers of
|
|
|
|
|
two (which platform mallocs tend to like) to values slightly over
|
|
|
|
|
powers of two (which make some platform mallocs sad).
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (misc):
|
|
|
|
|
- If exit bandwidth ever exceeds one third of total bandwidth, then
|
|
|
|
|
use the correct formula to weight exit nodes when choosing paths.
|
|
|
|
|
Based on patch from Mike Perry.
|
|
|
|
|
- Choose perfectly fairly among routers when choosing by bandwidth and
|
|
|
|
|
weighting by fraction of bandwidth provided by exits. Previously, we
|
|
|
|
|
would choose with only approximate fairness, and correct ourselves
|
|
|
|
|
if we ran off the end of the list.
|
|
|
|
|
- If we require CookieAuthentication but we fail to write the
|
|
|
|
|
cookie file, we would warn but not exit, and end up in a state
|
|
|
|
|
where no controller could authenticate. Now we exit.
|
|
|
|
|
- If we require CookieAuthentication, stop generating a new cookie
|
|
|
|
|
every time we change any piece of our config.
|
|
|
|
|
- Refuse to start with certain directory authority keys, and
|
|
|
|
|
encourage people using them to stop.
|
|
|
|
|
- Terminate multi-line control events properly. Original patch
|
|
|
|
|
from tup.
|
|
|
|
|
- Fix a minor memory leak when we fail to find enough suitable
|
|
|
|
|
servers to choose a circuit.
|
|
|
|
|
- Stop leaking part of the descriptor when we run into a particularly
|
|
|
|
|
unparseable piece of it.
|
|
|
|
|
|
|
|
|
|
|
2007-08-25 23:59:14 +02:00
|
|
|
Changes in version 0.2.0.6-alpha - 2007-08-26
|
2007-10-22 10:52:01 +02:00
|
|
|
This sixth development snapshot features a new Vidalia version in the
|
|
|
|
|
Windows and OS X bundles. Vidalia 0.0.14 makes authentication required for
|
|
|
|
|
the ControlPort in the default configuration, which addresses important
|
|
|
|
|
security risks.
|
|
|
|
|
|
|
|
|
|
In addition, this snapshot fixes major load balancing problems
|
|
|
|
|
with path selection, which should speed things up a lot once many
|
|
|
|
|
people have upgraded. The directory authorities also use a new
|
|
|
|
|
mean-time-between-failure approach to tracking which servers are stable,
|
|
|
|
|
rather than just looking at the most recent uptime.
|
|
|
|
|
|
2007-08-26 00:02:55 +02:00
|
|
|
o New directory authorities:
|
|
|
|
|
- Set up Tonga as the default bridge directory authority.
|
|
|
|
|
|
2007-08-24 08:33:12 +02:00
|
|
|
o Major features:
|
|
|
|
|
- Directory authorities now track servers by weighted
|
|
|
|
|
mean-times-between-failures. When we have 4 or more days of data,
|
|
|
|
|
use measured MTBF rather than declared uptime to decide whether
|
|
|
|
|
to call a router Stable. Implements proposal 108.
|
2007-08-25 23:31:34 +02:00
|
|
|
|
|
|
|
|
o Major bugfixes (load balancing):
|
2007-08-24 10:01:47 +02:00
|
|
|
- When choosing nodes for non-guard positions, weight guards
|
|
|
|
|
proportionally less, since they already have enough load. Patch
|
|
|
|
|
from Mike Perry.
|
|
|
|
|
- Raise the "max believable bandwidth" from 1.5MB/s to 10MB/s. This
|
2007-08-24 12:50:48 +02:00
|
|
|
will allow fast Tor servers to get more attention.
|
|
|
|
|
- When we're upgrading from an old Tor version, forget our current
|
|
|
|
|
guards and pick new ones according to the new weightings. These
|
|
|
|
|
three load balancing patches could raise effective network capacity
|
|
|
|
|
by a factor of four. Thanks to Mike Perry for measurements.
|
2007-08-21 07:37:24 +02:00
|
|
|
|
2007-08-25 23:59:14 +02:00
|
|
|
o Major bugfixes (descriptor parsing):
|
2007-08-20 22:05:56 +02:00
|
|
|
- Handle unexpected whitespace better in malformed descriptors. Bug
|
|
|
|
|
found using Benedikt Boss's new Tor fuzzer! Bugfix on 0.2.0.x.
|
|
|
|
|
|
2007-08-25 23:59:14 +02:00
|
|
|
o Minor features:
|
|
|
|
|
- There is now an ugly, temporary "desc/all-recent-extrainfo-hack"
|
|
|
|
|
GETINFO for Torstat to use until it can switch to using extrainfos.
|
2007-08-24 08:33:12 +02:00
|
|
|
- Optionally (if built with -DEXPORTMALLINFO) export the output
|
2007-08-25 23:59:14 +02:00
|
|
|
of mallinfo via http, as tor/mallinfo.txt. Only accessible
|
2007-08-24 08:33:12 +02:00
|
|
|
from localhost.
|
|
|
|
|
|
2007-08-25 23:59:14 +02:00
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Do not intermix bridge routers with controller-added
|
|
|
|
|
routers. (Bugfix on 0.2.0.x)
|
2007-08-24 08:33:12 +02:00
|
|
|
- Do not fail with an assert when accept() returns an unexpected
|
|
|
|
|
address family. Addresses but does not wholly fix bug 483. (Bugfix
|
|
|
|
|
on 0.2.0.x)
|
2007-08-20 20:29:17 +02:00
|
|
|
- Let directory authorities startup even when they can't generate
|
|
|
|
|
a descriptor immediately, e.g. because they don't know their
|
|
|
|
|
address.
|
2007-08-21 05:11:56 +02:00
|
|
|
- Stop putting the authentication cookie in a file called "0"
|
|
|
|
|
in your working directory if you don't specify anything for the
|
|
|
|
|
new CookieAuthFile option. Reported by Matt Edman.
|
2007-08-22 09:57:10 +02:00
|
|
|
- Make it possible to read the PROTOCOLINFO response in a way that
|
|
|
|
|
conforms to our control-spec. Reported by Matt Edman.
|
2007-08-22 05:03:24 +02:00
|
|
|
- Fix a minor memory leak when we fail to find enough suitable
|
|
|
|
|
servers to choose a circuit. Bugfix on 0.1.2.x.
|
2007-08-22 05:21:51 +02:00
|
|
|
- Stop leaking part of the descriptor when we run into a particularly
|
|
|
|
|
unparseable piece of it. Bugfix on 0.1.2.x.
|
2007-08-22 17:07:29 +02:00
|
|
|
- Unmap the extrainfo cache file on exit.
|
2007-08-21 05:11:56 +02:00
|
|
|
|
|
|
|
|
|
2007-08-19 04:01:02 +02:00
|
|
|
Changes in version 0.2.0.5-alpha - 2007-08-19
|
2007-10-22 10:52:01 +02:00
|
|
|
This fifth development snapshot fixes compilation on Windows again;
|
|
|
|
|
fixes an obnoxious client-side bug that slowed things down and put
|
|
|
|
|
extra load on the network; gets us closer to using the v3 directory
|
|
|
|
|
voting scheme; makes it easier for Tor controllers to use cookie-based
|
|
|
|
|
authentication; and fixes a variety of other bugs.
|
|
|
|
|
|
2007-08-10 00:32:33 +02:00
|
|
|
o Removed features:
|
2007-08-19 04:01:02 +02:00
|
|
|
- Version 1 directories are no longer generated in full. Instead,
|
|
|
|
|
authorities generate and serve "stub" v1 directories that list
|
|
|
|
|
no servers. This will stop Tor versions 0.1.0.x and earlier from
|
|
|
|
|
working, but (for security reasons) nobody should be running those
|
|
|
|
|
versions anyway.
|
2007-08-10 00:32:33 +02:00
|
|
|
|
2007-08-19 04:01:02 +02:00
|
|
|
o Major bugfixes (compilation, 0.2.0.x):
|
|
|
|
|
- Try to fix Win32 compilation again: improve checking for IPv6 types.
|
|
|
|
|
- Try to fix MSVC compilation: build correctly on platforms that do
|
|
|
|
|
not define s6_addr16 or s6_addr32.
|
2007-08-03 09:57:31 +02:00
|
|
|
- Fix compile on platforms without getaddrinfo: bug found by Li-Hui
|
|
|
|
|
Zhou.
|
2007-08-19 04:01:02 +02:00
|
|
|
|
2007-08-19 09:17:40 +02:00
|
|
|
o Major bugfixes (stream expiration):
|
2007-08-19 09:18:37 +02:00
|
|
|
- Expire not-yet-successful application streams in all cases if
|
|
|
|
|
they've been around longer than SocksTimeout. Right now there are
|
|
|
|
|
some cases where the stream will live forever, demanding a new
|
|
|
|
|
circuit every 15 seconds. Bugfix on 0.1.2.7-alpha; fixes bug 454;
|
|
|
|
|
reported by lodger.
|
2007-08-19 09:17:40 +02:00
|
|
|
|
2007-08-14 22:19:58 +02:00
|
|
|
o Minor features (directory servers):
|
|
|
|
|
- When somebody requests a list of statuses or servers, and we have
|
|
|
|
|
none of those, return a 404 rather than an empty 200.
|
|
|
|
|
|
2007-08-13 20:47:22 +02:00
|
|
|
o Minor features (directory voting):
|
|
|
|
|
- Store v3 consensus status consensuses on disk, and reload them
|
|
|
|
|
on startup.
|
|
|
|
|
|
2007-08-13 21:16:44 +02:00
|
|
|
o Minor features (security):
|
2007-08-02 23:03:40 +02:00
|
|
|
- Warn about unsafe ControlPort configurations.
|
2007-08-19 04:51:54 +02:00
|
|
|
- Refuse to start with certain directory authority keys, and
|
|
|
|
|
encourage people using them to stop.
|
2007-08-02 23:03:40 +02:00
|
|
|
|
2007-08-16 19:31:23 +02:00
|
|
|
o Minor features (controller):
|
2007-08-19 04:01:02 +02:00
|
|
|
- Add a PROTOCOLINFO controller command. Like AUTHENTICATE, it
|
|
|
|
|
is valid before any authentication has been received. It tells
|
|
|
|
|
a controller what kind of authentication is expected, and what
|
|
|
|
|
protocol is spoken. Implements proposal 119.
|
|
|
|
|
- New config option CookieAuthFile to choose a new location for the
|
|
|
|
|
cookie authentication file, and config option
|
|
|
|
|
CookieAuthFileGroupReadable to make it group-readable.
|
2007-08-16 19:31:23 +02:00
|
|
|
|
2007-08-18 21:39:14 +02:00
|
|
|
o Minor features (unit testing):
|
|
|
|
|
- Add command-line arguments to unit-test executable so that we can
|
2007-08-19 04:01:02 +02:00
|
|
|
invoke any chosen test from the command line rather than having
|
|
|
|
|
to run the whole test suite at once; and so that we can turn on
|
|
|
|
|
logging for the unit tests.
|
2007-08-18 21:39:14 +02:00
|
|
|
|
2007-08-19 04:01:02 +02:00
|
|
|
o Minor bugfixes (on 0.1.2.x):
|
2007-08-15 17:26:14 +02:00
|
|
|
- If we require CookieAuthentication but we fail to write the
|
|
|
|
|
cookie file, we would warn but not exit, and end up in a state
|
|
|
|
|
where no controller could authenticate. Now we exit.
|
|
|
|
|
- If we require CookieAuthentication, stop generating a new cookie
|
|
|
|
|
every time we change any piece of our config.
|
2007-08-18 20:20:42 +02:00
|
|
|
- When loading bandwidth history, do not believe any information in
|
|
|
|
|
the future. Fixes bug 434.
|
|
|
|
|
- When loading entry guard information, do not believe any information
|
|
|
|
|
in the future.
|
2007-08-19 04:01:02 +02:00
|
|
|
- When we have our clock set far in the future and generate an
|
|
|
|
|
onion key, then re-set our clock to be correct, we should not stop
|
|
|
|
|
the onion key from getting rotated.
|
2007-08-19 04:02:58 +02:00
|
|
|
- Clean up torrc sample config file.
|
2007-08-19 10:16:23 +02:00
|
|
|
- Do not automatically run configure from autogen.sh. This
|
|
|
|
|
non-standard behavior tended to annoy people who have built other
|
|
|
|
|
programs.
|
2007-08-19 04:01:02 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes (on 0.2.0.x):
|
|
|
|
|
- Fix a bug with AutomapHostsOnResolve that would always cause
|
|
|
|
|
the second request to fail. Bug reported by Kate. Bugfix on
|
|
|
|
|
0.2.0.3-alpha.
|
2007-08-19 06:58:55 +02:00
|
|
|
- Fix a bug in ADDRMAP controller replies that would sometimes
|
|
|
|
|
try to print a NULL. Patch from tup.
|
2007-08-19 04:01:02 +02:00
|
|
|
- Read v3 directory authority keys from the right location.
|
|
|
|
|
- Numerous bugfixes to directory voting code.
|
2007-08-15 17:26:14 +02:00
|
|
|
|
|
|
|
|
|
2007-08-30 10:40:52 +02:00
|
|
|
Changes in version 0.1.2.16 - 2007-08-01
|
2007-10-22 10:52:01 +02:00
|
|
|
Tor 0.1.2.16 fixes a critical security vulnerability that allows a
|
|
|
|
|
remote attacker in certain situations to rewrite the user's torrc
|
|
|
|
|
configuration file. This can completely compromise anonymity of users
|
|
|
|
|
in most configurations, including those running the Vidalia bundles,
|
|
|
|
|
TorK, etc. Or worse.
|
|
|
|
|
|
2007-08-30 10:40:52 +02:00
|
|
|
o Major security fixes:
|
|
|
|
|
- Close immediately after missing authentication on control port;
|
|
|
|
|
do not allow multiple authentication attempts.
|
|
|
|
|
|
|
|
|
|
|
2007-08-02 03:28:40 +02:00
|
|
|
Changes in version 0.2.0.4-alpha - 2007-08-01
|
2007-10-22 10:52:01 +02:00
|
|
|
This fourth development snapshot fixes a critical security vulnerability
|
|
|
|
|
for most users, specifically those running Vidalia, TorK, etc. Everybody
|
|
|
|
|
should upgrade to either 0.1.2.16 or 0.2.0.4-alpha.
|
|
|
|
|
|
2007-08-02 03:28:40 +02:00
|
|
|
o Major security fixes:
|
|
|
|
|
- Close immediately after missing authentication on control port;
|
|
|
|
|
do not allow multiple authentication attempts.
|
|
|
|
|
|
2007-08-01 17:57:34 +02:00
|
|
|
o Major bugfixes (compilation):
|
|
|
|
|
- Fix win32 compilation: apparently IN_ADDR and IN6_ADDR are already
|
|
|
|
|
defined there.
|
|
|
|
|
|
2007-07-30 19:47:43 +02:00
|
|
|
o Minor features (performance):
|
|
|
|
|
- Be even more aggressive about releasing RAM from small
|
|
|
|
|
empty buffers. Thanks to our free-list code, this shouldn't be too
|
|
|
|
|
performance-intensive.
|
2007-07-30 20:14:14 +02:00
|
|
|
- Disable sentinel-based debugging for buffer code: we squashed all
|
2007-07-30 19:51:14 +02:00
|
|
|
the bugs that this was supposed to detect a long time ago, and
|
|
|
|
|
now its only effect is to change our buffer sizes from nice
|
|
|
|
|
powers of two (which platform mallocs tend to like) to values
|
2008-06-07 07:24:47 +02:00
|
|
|
slightly over powers of two (which make some platform mallocs sad).
|
2007-07-30 20:14:14 +02:00
|
|
|
- Log malloc statistics from mallinfo() on platforms where it
|
|
|
|
|
exists.
|
2007-07-30 19:47:43 +02:00
|
|
|
|
|
|
|
|
|
2007-07-29 03:08:16 +02:00
|
|
|
Changes in version 0.2.0.3-alpha - 2007-07-29
|
2007-10-22 10:52:01 +02:00
|
|
|
This third development snapshot introduces new experimental
|
|
|
|
|
blocking-resistance features and a preliminary version of the v3
|
|
|
|
|
directory voting design, and includes many other smaller features
|
|
|
|
|
and bugfixes.
|
|
|
|
|
|
2007-07-29 03:07:35 +02:00
|
|
|
o Major features:
|
2007-07-30 14:13:32 +02:00
|
|
|
- The first pieces of our "bridge" design for blocking-resistance
|
|
|
|
|
are implemented. People can run bridge directory authorities;
|
|
|
|
|
people can run bridges; and people can configure their Tor clients
|
|
|
|
|
with a set of bridges to use as the first hop into the Tor network.
|
2007-07-30 14:15:07 +02:00
|
|
|
See http://archives.seul.org/or/talk/Jul-2007/msg00249.html for
|
|
|
|
|
details.
|
2007-07-29 03:07:35 +02:00
|
|
|
- Create listener connections before we setuid to the configured
|
2007-07-30 14:13:32 +02:00
|
|
|
User and Group. Now non-Windows users can choose port values
|
|
|
|
|
under 1024, start Tor as root, and have Tor bind those ports
|
|
|
|
|
before it changes to another UID. (Windows users could already
|
|
|
|
|
pick these ports.)
|
|
|
|
|
- Added a new ConstrainedSockets config option to set SO_SNDBUF and
|
|
|
|
|
SO_RCVBUF on TCP sockets. Hopefully useful for Tor servers running
|
|
|
|
|
on "vserver" accounts. (Patch from coderman.)
|
2007-07-30 00:13:44 +02:00
|
|
|
- Be even more aggressive about separating local traffic from relayed
|
|
|
|
|
traffic when RelayBandwidthRate is set. (Refines proposal 111.)
|
2007-07-29 03:07:35 +02:00
|
|
|
|
2007-07-30 01:11:44 +02:00
|
|
|
o Major features (experimental):
|
2007-07-30 14:13:32 +02:00
|
|
|
- First cut of code for "v3 dir voting": directory authorities will
|
|
|
|
|
vote on a common network status document rather than each publishing
|
|
|
|
|
their own opinion. This code needs more testing and more corner-case
|
|
|
|
|
handling before it's ready for use.
|
2007-07-30 01:11:44 +02:00
|
|
|
|
2007-07-29 03:07:35 +02:00
|
|
|
o Security fixes:
|
|
|
|
|
- Directory authorities now call routers Fast if their bandwidth is
|
|
|
|
|
at least 100KB/s, and consider their bandwidth adequate to be a
|
|
|
|
|
Guard if it is at least 250KB/s, no matter the medians. This fix
|
|
|
|
|
complements proposal 107. [Bugfix on 0.1.2.x]
|
2007-07-29 07:20:31 +02:00
|
|
|
- Directory authorities now never mark more than 3 servers per IP as
|
2007-07-30 14:13:32 +02:00
|
|
|
Valid and Running. (Implements proposal 109, by Kevin Bauer and
|
2007-07-29 07:20:31 +02:00
|
|
|
Damon McCoy.)
|
2007-07-30 14:13:32 +02:00
|
|
|
- Minor change to organizationName and commonName generation
|
|
|
|
|
procedures in TLS certificates during Tor handshakes, to invalidate
|
|
|
|
|
some earlier censorware approaches. This is not a long-term
|
|
|
|
|
solution, but applying it will give us a bit of time to look into
|
|
|
|
|
the epidemiology of countermeasures as they spread.
|
2007-06-04 01:00:26 +02:00
|
|
|
|
2007-07-29 03:07:35 +02:00
|
|
|
o Major bugfixes (directory):
|
|
|
|
|
- Rewrite directory tokenization code to never run off the end of
|
|
|
|
|
a string. Fixes bug 455. Patch from croup. [Bugfix on 0.1.2.x]
|
2007-06-08 21:02:39 +02:00
|
|
|
|
2007-06-17 17:10:51 +02:00
|
|
|
o Minor features (controller):
|
|
|
|
|
- Add a SOURCE_ADDR field to STREAM NEW events so that controllers can
|
|
|
|
|
match requests to applications. (Patch from Robert Hogan.)
|
2007-06-17 17:59:27 +02:00
|
|
|
- Report address and port correctly on connections to DNSPort. (Patch
|
|
|
|
|
from Robert Hogan.)
|
2007-07-10 19:14:51 +02:00
|
|
|
- Add a RESOLVE command to launch hostname lookups. (Original patch
|
|
|
|
|
from Robert Hogan.)
|
2007-07-10 19:14:55 +02:00
|
|
|
- Add GETINFO status/enough-dir-info to let controllers tell whether
|
2007-07-29 03:07:35 +02:00
|
|
|
Tor has downloaded sufficient directory information. (Patch
|
|
|
|
|
from Tup.)
|
2007-07-16 18:58:11 +02:00
|
|
|
- You can now use the ControlSocket option to tell Tor to listen for
|
2007-07-29 03:07:35 +02:00
|
|
|
controller connections on Unix domain sockets on systems that
|
|
|
|
|
support them. (Patch from Peter Palfrader.)
|
|
|
|
|
- STREAM NEW events are generated for DNSPort requests and for
|
|
|
|
|
tunneled directory connections. (Patch from Robert Hogan.)
|
|
|
|
|
- New "GETINFO address-mappings/*" command to get address mappings
|
|
|
|
|
with expiry information. "addr-mappings/*" is now deprecated.
|
2007-07-16 18:58:11 +02:00
|
|
|
(Patch from Tup.)
|
2007-06-17 17:10:51 +02:00
|
|
|
|
2007-07-29 03:07:35 +02:00
|
|
|
o Minor features (misc):
|
2007-07-19 20:46:09 +02:00
|
|
|
- Merge in some (as-yet-unused) IPv6 address manipulation code. (Patch
|
|
|
|
|
from croup.)
|
2007-07-30 14:13:32 +02:00
|
|
|
- The tor-gencert tool for v3 directory authorities now creates all
|
|
|
|
|
files as readable to the file creator only, and write-protects
|
|
|
|
|
the authority identity key.
|
2007-07-29 03:07:35 +02:00
|
|
|
- When dumping memory usage, list bytes used in buffer memory
|
|
|
|
|
free-lists.
|
2007-07-29 23:42:34 +02:00
|
|
|
- When running with dmalloc, dump more stats on hup and on exit.
|
2007-07-29 03:07:35 +02:00
|
|
|
- Directory authorities now fail quickly and (relatively) harmlessly
|
|
|
|
|
if they generate a network status document that is somehow
|
|
|
|
|
malformed.
|
2007-07-19 20:46:09 +02:00
|
|
|
|
2007-07-30 14:13:32 +02:00
|
|
|
o Traffic load balancing improvements:
|
2007-07-29 00:14:39 +02:00
|
|
|
- If exit bandwidth ever exceeds one third of total bandwidth, then
|
|
|
|
|
use the correct formula to weight exit nodes when choosing paths.
|
|
|
|
|
(Based on patch from Mike Perry.)
|
2007-07-30 14:13:32 +02:00
|
|
|
- Choose perfectly fairly among routers when choosing by bandwidth and
|
|
|
|
|
weighting by fraction of bandwidth provided by exits. Previously, we
|
|
|
|
|
would choose with only approximate fairness, and correct ourselves
|
|
|
|
|
if we ran off the end of the list. [Bugfix on 0.1.2.x]
|
|
|
|
|
|
|
|
|
|
o Performance improvements:
|
|
|
|
|
- Be more aggressive with freeing buffer RAM or putting it on the
|
|
|
|
|
memory free lists.
|
2007-07-05 16:51:01 +02:00
|
|
|
- Use Critical Sections rather than Mutexes for synchronizing threads
|
|
|
|
|
on win32; Mutexes are heavier-weight, and designed for synchronizing
|
|
|
|
|
between processes.
|
|
|
|
|
|
2007-07-29 03:07:35 +02:00
|
|
|
o Deprecated and removed features:
|
2007-06-07 19:26:21 +02:00
|
|
|
- RedirectExits is now deprecated.
|
2007-07-29 03:07:35 +02:00
|
|
|
- Stop allowing address masks that do not correspond to bit prefixes.
|
|
|
|
|
We have warned about these for a really long time; now it's time
|
|
|
|
|
to reject them. (Patch from croup.)
|
2007-07-06 20:20:54 +02:00
|
|
|
|
2007-06-11 23:42:48 +02:00
|
|
|
o Minor bugfixes (directory):
|
2007-07-29 03:07:35 +02:00
|
|
|
- Fix another crash bug related to extra-info caching. (Bug found by
|
2007-06-11 23:42:48 +02:00
|
|
|
Peter Palfrader.) [Bugfix on 0.2.0.2-alpha]
|
2007-06-15 06:20:51 +02:00
|
|
|
- Directories no longer return a "304 not modified" when they don't
|
|
|
|
|
have the networkstatus the client asked for. Also fix a memory
|
|
|
|
|
leak when returning 304 not modified. [Bugfixes on 0.2.0.2-alpha]
|
2007-07-17 11:37:00 +02:00
|
|
|
- We had accidentally labelled 0.1.2.x directory servers as not
|
|
|
|
|
suitable for begin_dir requests, and had labelled no directory
|
|
|
|
|
servers as suitable for uploading extra-info documents. [Bugfix
|
|
|
|
|
on 0.2.0.1-alpha]
|
2007-06-11 23:42:48 +02:00
|
|
|
|
2007-06-04 01:00:26 +02:00
|
|
|
o Minor bugfixes (dns):
|
2007-06-03 23:39:24 +02:00
|
|
|
- Fix a crash when DNSPort is set more than once. (Patch from Robert
|
2007-06-11 23:42:48 +02:00
|
|
|
Hogan.) [Bugfix on 0.2.0.2-alpha]
|
2007-06-13 21:50:18 +02:00
|
|
|
- Add DNSPort connections to the global connection list, so that we
|
2007-07-29 03:07:35 +02:00
|
|
|
can time them out correctly. (Bug found by Robert Hogan.) [Bugfix
|
|
|
|
|
on 0.2.0.2-alpha]
|
2007-07-26 00:57:07 +02:00
|
|
|
- Fix a dangling reference that could lead to a crash when DNSPort is
|
2007-07-29 03:07:35 +02:00
|
|
|
changed or closed (Patch from Robert Hogan.) [Bugfix on
|
|
|
|
|
0.2.0.2-alpha]
|
2007-07-12 19:09:19 +02:00
|
|
|
|
2007-07-29 03:07:35 +02:00
|
|
|
o Minor bugfixes (controller):
|
|
|
|
|
- Provide DNS expiry times in GMT, not in local time. For backward
|
2007-07-26 00:56:54 +02:00
|
|
|
compatibility, ADDRMAP events only provide GMT expiry in an extended
|
2007-07-29 03:07:35 +02:00
|
|
|
field. "GETINFO address-mappings" always does the right thing.
|
2007-07-26 00:57:02 +02:00
|
|
|
- Use CRLF line endings properly in NS events.
|
2007-07-30 14:13:32 +02:00
|
|
|
- Terminate multi-line control events properly. (Original patch
|
|
|
|
|
from tup.) [Bugfix on 0.1.2.x-alpha]
|
|
|
|
|
- Do not include spaces in SOURCE_ADDR fields in STREAM
|
|
|
|
|
events. Resolves bug 472. [Bugfix on 0.2.0.x-alpha]
|
2007-07-26 23:26:57 +02:00
|
|
|
|
2007-06-03 23:39:24 +02:00
|
|
|
|
2007-07-17 22:57:43 +02:00
|
|
|
Changes in version 0.1.2.15 - 2007-07-17
|
2007-10-22 10:52:01 +02:00
|
|
|
Tor 0.1.2.15 fixes several crash bugs, fixes some anonymity-related
|
|
|
|
|
problems, fixes compilation on BSD, and fixes a variety of other
|
|
|
|
|
bugs. Everybody should upgrade.
|
|
|
|
|
|
2007-07-17 22:57:43 +02:00
|
|
|
o Major bugfixes (compilation):
|
|
|
|
|
- Fix compile on FreeBSD/NetBSD/OpenBSD. Oops.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- Try even harder not to dereference the first character after
|
|
|
|
|
an mmap(). Reported by lodger.
|
|
|
|
|
- Fix a crash bug in directory authorities when we re-number the
|
|
|
|
|
routerlist while inserting a new router.
|
|
|
|
|
- When the cached-routers file is an even multiple of the page size,
|
|
|
|
|
don't run off the end and crash. (Fixes bug 455; based on idea
|
|
|
|
|
from croup.)
|
|
|
|
|
- Fix eventdns.c behavior on Solaris: It is critical to include
|
|
|
|
|
orconfig.h _before_ sys/types.h, so that we can get the expected
|
|
|
|
|
definition of _FILE_OFFSET_BITS.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (security):
|
|
|
|
|
- Fix a possible buffer overrun when using BSD natd support. Bug
|
|
|
|
|
found by croup.
|
|
|
|
|
- When sending destroy cells from a circuit's origin, don't include
|
|
|
|
|
the reason for tearing down the circuit. The spec says we didn't,
|
|
|
|
|
and now we actually don't. Reported by lodger.
|
|
|
|
|
- Keep streamids from different exits on a circuit separate. This
|
|
|
|
|
bug may have allowed other routers on a given circuit to inject
|
|
|
|
|
cells into streams. Reported by lodger; fixes bug 446.
|
|
|
|
|
- If there's a never-before-connected-to guard node in our list,
|
|
|
|
|
never choose any guards past it. This way we don't expand our
|
|
|
|
|
guard list unless we need to.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (guard nodes):
|
|
|
|
|
- Weight guard selection by bandwidth, so that low-bandwidth nodes
|
|
|
|
|
don't get overused as guards.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (directory):
|
|
|
|
|
- Correctly count the number of authorities that recommend each
|
|
|
|
|
version. Previously, we were under-counting by 1.
|
|
|
|
|
- Fix a potential crash bug when we load many server descriptors at
|
|
|
|
|
once and some of them make others of them obsolete. Fixes bug 458.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (hidden services):
|
|
|
|
|
- Stop tearing down the whole circuit when the user asks for a
|
|
|
|
|
connection to a port that the hidden service didn't configure.
|
|
|
|
|
Resolves bug 444.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (misc):
|
|
|
|
|
- On Windows, we were preventing other processes from reading
|
|
|
|
|
cached-routers while Tor was running. Reported by janbar.
|
|
|
|
|
- Fix a possible (but very unlikely) bug in picking routers by
|
|
|
|
|
bandwidth. Add a log message to confirm that it is in fact
|
|
|
|
|
unlikely. Patch from lodger.
|
|
|
|
|
- Backport a couple of memory leak fixes.
|
|
|
|
|
- Backport miscellaneous cosmetic bugfixes.
|
|
|
|
|
|
|
|
|
|
|
2007-06-03 01:56:04 +02:00
|
|
|
Changes in version 0.2.0.2-alpha - 2007-06-02
|
2007-06-02 17:26:54 +02:00
|
|
|
o Major bugfixes on 0.2.0.1-alpha:
|
|
|
|
|
- Fix an assertion failure related to servers without extra-info digests.
|
|
|
|
|
Resolves bugs 441 and 442.
|
|
|
|
|
|
2007-06-02 17:26:57 +02:00
|
|
|
o Minor features (directory):
|
|
|
|
|
- Support "If-Modified-Since" when answering HTTP requests for
|
|
|
|
|
directories, running-routers documents, and network-status documents.
|
|
|
|
|
(There's no need to support it for router descriptors, since those
|
|
|
|
|
are downloaded by descriptor digest.)
|
|
|
|
|
|
2007-06-02 17:26:54 +02:00
|
|
|
o Minor build issues:
|
|
|
|
|
- Clear up some MIPSPro compiler warnings.
|
2007-06-02 17:40:10 +02:00
|
|
|
- When building from a tarball on a machine that happens to have SVK
|
|
|
|
|
installed, report the micro-revision as whatever version existed
|
|
|
|
|
in the tarball, not as "x".
|
2007-06-02 17:26:54 +02:00
|
|
|
|
2007-06-01 01:52:48 +02:00
|
|
|
|
|
|
|
|
Changes in version 0.2.0.1-alpha - 2007-06-01
|
2007-10-22 10:52:01 +02:00
|
|
|
This early development snapshot provides new features for people running
|
|
|
|
|
Tor as both a client and a server (check out the new RelayBandwidth
|
|
|
|
|
config options); lets Tor run as a DNS proxy; and generally moves us
|
|
|
|
|
forward on a lot of fronts.
|
|
|
|
|
|
2007-06-01 09:12:14 +02:00
|
|
|
o Major features, server usability:
|
|
|
|
|
- New config options RelayBandwidthRate and RelayBandwidthBurst:
|
|
|
|
|
a separate set of token buckets for relayed traffic. Right now
|
|
|
|
|
relayed traffic is defined as answers to directory requests, and
|
|
|
|
|
OR connections that don't have any local circuits on them.
|
|
|
|
|
|
|
|
|
|
o Major features, client usability:
|
|
|
|
|
- A client-side DNS proxy feature to replace the need for
|
|
|
|
|
dns-proxy-tor: Just set "DNSPort 9999", and Tor will now listen
|
|
|
|
|
for DNS requests on port 9999, use the Tor network to resolve them
|
|
|
|
|
anonymously, and send the reply back like a regular DNS server.
|
|
|
|
|
The code still only implements a subset of DNS.
|
|
|
|
|
- Make PreferTunneledDirConns and TunnelDirConns work even when
|
|
|
|
|
we have no cached directory info. This means Tor clients can now
|
|
|
|
|
do all of their connections protected by TLS.
|
|
|
|
|
|
|
|
|
|
o Major features, performance and efficiency:
|
|
|
|
|
- Directory authorities accept and serve "extra info" documents for
|
|
|
|
|
routers. These documents contain fields from router descriptors
|
|
|
|
|
that aren't usually needed, and that use a lot of excess
|
|
|
|
|
bandwidth. Once these fields are removed from router descriptors,
|
|
|
|
|
the bandwidth savings should be about 60%. [Partially implements
|
|
|
|
|
proposal 104.]
|
|
|
|
|
- Servers upload extra-info documents to any authority that accepts
|
|
|
|
|
them. Authorities (and caches that have been configured to download
|
|
|
|
|
extra-info documents) download them as needed. [Partially implements
|
|
|
|
|
proposal 104.]
|
2007-03-26 16:07:59 +02:00
|
|
|
- Change the way that Tor buffers data that it is waiting to write.
|
|
|
|
|
Instead of queueing data cells in an enormous ring buffer for each
|
|
|
|
|
client->OR or OR->OR connection, we now queue cells on a separate
|
|
|
|
|
queue for each circuit. This lets us use less slack memory, and
|
|
|
|
|
will eventually let us be smarter about prioritizing different kinds
|
|
|
|
|
of traffic.
|
2007-05-04 11:20:13 +02:00
|
|
|
- Use memory pools to allocate cells with better speed and memory
|
|
|
|
|
efficiency, especially on platforms where malloc() is inefficient.
|
2007-03-26 16:08:18 +02:00
|
|
|
- Stop reading on edge connections when their corresponding circuit
|
|
|
|
|
buffers are full; start again as the circuits empty out.
|
2007-06-01 09:12:14 +02:00
|
|
|
|
|
|
|
|
o Major features, other:
|
2007-04-30 19:46:13 +02:00
|
|
|
- Add an HSAuthorityRecordStats option that hidden service authorities
|
|
|
|
|
can use to track statistics of overall hidden service usage without
|
|
|
|
|
logging information that would be very useful to an attacker.
|
2007-06-01 09:12:14 +02:00
|
|
|
- Start work implementing multi-level keys for directory authorities:
|
|
|
|
|
Add a standalone tool to generate key certificates. (Proposal 103.)
|
2007-03-26 16:07:59 +02:00
|
|
|
|
2007-03-10 06:43:35 +01:00
|
|
|
o Security fixes:
|
2007-07-22 01:40:55 +02:00
|
|
|
- Directory authorities now call routers Stable if they have an
|
2007-03-10 06:43:35 +01:00
|
|
|
uptime of at least 30 days, even if that's not the median uptime
|
2007-03-29 04:55:00 +02:00
|
|
|
in the network. Implements proposal 107, suggested by Kevin Bauer
|
2007-03-10 06:43:35 +01:00
|
|
|
and Damon McCoy.
|
|
|
|
|
|
2007-04-21 19:24:18 +02:00
|
|
|
o Minor fixes (resource management):
|
2007-05-13 01:19:10 +02:00
|
|
|
- Count the number of open sockets separately from the number
|
|
|
|
|
of active connection_t objects. This will let us avoid underusing
|
|
|
|
|
our allocated connection limit.
|
2007-04-21 19:26:12 +02:00
|
|
|
- We no longer use socket pairs to link an edge connection to an
|
2007-06-01 09:12:14 +02:00
|
|
|
anonymous directory connection or a DirPort test connection.
|
2007-05-13 01:19:10 +02:00
|
|
|
Instead, we track the link internally and transfer the data
|
|
|
|
|
in-process. This saves two sockets per "linked" connection (at the
|
|
|
|
|
client and at the server), and avoids the nasty Windows socketpair()
|
|
|
|
|
workaround.
|
2007-05-10 00:39:49 +02:00
|
|
|
- Keep unused 4k and 16k buffers on free lists, rather than wasting 8k
|
2007-06-01 09:12:14 +02:00
|
|
|
for every single inactive connection_t. Free items from the
|
|
|
|
|
4k/16k-buffer free lists when they haven't been used for a while.
|
2007-04-21 19:24:18 +02:00
|
|
|
|
2007-03-04 20:49:06 +01:00
|
|
|
o Minor features (build):
|
2007-04-11 18:28:44 +02:00
|
|
|
- Make autoconf search for libevent, openssl, and zlib consistently.
|
2007-05-13 01:19:10 +02:00
|
|
|
- Update deprecated macros in configure.in.
|
2007-04-11 18:28:44 +02:00
|
|
|
- When warning about missing headers, tell the user to let us
|
|
|
|
|
know if the compile succeeds anyway, so we can downgrade the
|
|
|
|
|
warning.
|
2007-04-18 21:28:47 +02:00
|
|
|
- Include the current subversion revision as part of the version
|
|
|
|
|
string: either fetch it directly if we're in an SVN checkout, do
|
|
|
|
|
some magic to guess it if we're in an SVK checkout, or use
|
|
|
|
|
the last-detected version if we're building from a .tar.gz.
|
2007-05-22 17:49:14 +02:00
|
|
|
Use this version consistently in log messages.
|
2007-03-04 20:49:06 +01:00
|
|
|
|
2007-03-04 21:11:46 +01:00
|
|
|
o Minor features (logging):
|
|
|
|
|
- Always prepend "Bug: " to any log message about a bug.
|
2007-03-09 09:56:39 +01:00
|
|
|
- Put a platform string (e.g. "Linux i686") in the startup log
|
|
|
|
|
message, so when people paste just their logs, we know if it's
|
2007-05-13 01:19:10 +02:00
|
|
|
OpenBSD or Windows or what.
|
2007-04-23 05:04:46 +02:00
|
|
|
- When logging memory usage, break down memory used in buffers by
|
|
|
|
|
buffer type.
|
2007-03-04 21:11:46 +01:00
|
|
|
|
2007-04-16 23:37:21 +02:00
|
|
|
o Minor features (directory system):
|
2007-05-02 11:12:04 +02:00
|
|
|
- New config option V2AuthoritativeDirectory that all directory
|
|
|
|
|
authorities should set. This will let future authorities choose
|
|
|
|
|
not to serve V2 directory information.
|
2007-06-01 09:12:14 +02:00
|
|
|
- Directory authorities allow multiple router descriptors and/or extra
|
|
|
|
|
info documents to be uploaded in a single go. This will make
|
|
|
|
|
implementing proposal 104 simpler.
|
2007-04-16 23:37:21 +02:00
|
|
|
|
2007-04-30 13:10:45 +02:00
|
|
|
o Minor features (controller):
|
2007-04-30 11:18:48 +02:00
|
|
|
- Add a new config option __DisablePredictedCircuits designed for
|
|
|
|
|
use by the controller, when we don't want Tor to build any circuits
|
|
|
|
|
preemptively.
|
2007-04-30 13:10:45 +02:00
|
|
|
- Let the controller specify HOP=%d as an argument to ATTACHSTREAM,
|
|
|
|
|
so we can exit from the middle of the circuit.
|
2007-05-06 00:51:02 +02:00
|
|
|
- Implement "getinfo status/circuit-established".
|
2007-05-13 01:19:10 +02:00
|
|
|
- Implement "getinfo status/version/..." so a controller can tell
|
|
|
|
|
whether the current version is recommended, and whether any versions
|
|
|
|
|
are good, and how many authorities agree. (Patch from shibz.)
|
2007-04-30 13:10:45 +02:00
|
|
|
|
2007-05-29 20:58:16 +02:00
|
|
|
o Minor features (hidden services):
|
2007-06-04 15:55:58 +02:00
|
|
|
- Allow multiple HiddenServicePort directives with the same virtual
|
2007-05-29 20:58:16 +02:00
|
|
|
port; when they occur, the user is sent round-robin to one
|
|
|
|
|
of the target ports chosen at random. Partially fixes bug 393 by
|
|
|
|
|
adding limited ad-hoc round-robining.
|
|
|
|
|
|
2007-04-30 13:10:45 +02:00
|
|
|
o Minor features (other):
|
|
|
|
|
- More unit tests.
|
2007-05-25 16:48:16 +02:00
|
|
|
- Add a new AutomapHostsOnResolve option: when it is enabled, any
|
|
|
|
|
resolve request for hosts matching a given pattern causes Tor to
|
|
|
|
|
generate an internal virtual address mapping for that host. This
|
|
|
|
|
allows DNSPort to work sensibly with hidden service users. By
|
|
|
|
|
default, .exit and .onion addresses are remapped; the list of
|
|
|
|
|
patterns can be reconfigured with AutomapHostsSuffixes.
|
2007-06-01 09:12:14 +02:00
|
|
|
- Add an "-F" option to tor-resolve to force a resolve for a .onion
|
|
|
|
|
address. Thanks to the AutomapHostsOnResolve option, this is no
|
|
|
|
|
longer a completely silly thing to do.
|
2007-05-26 10:04:15 +02:00
|
|
|
- If Tor is invoked from something that isn't a shell (e.g. Vidalia),
|
|
|
|
|
now we expand "-f ~/.tor/torrc" correctly. Suggested by Matt Edman.
|
2007-06-01 09:12:14 +02:00
|
|
|
- Treat "2gb" when given in torrc for a bandwidth as meaning 2gb,
|
|
|
|
|
minus 1 byte: the actual maximum declared bandwidth.
|
2007-03-06 21:25:44 +01:00
|
|
|
|
2007-03-04 22:08:28 +01:00
|
|
|
o Removed features:
|
|
|
|
|
- Removed support for the old binary "version 0" controller protocol.
|
|
|
|
|
This has been deprecated since 0.1.1, and warnings have been issued
|
2007-06-01 09:12:14 +02:00
|
|
|
since 0.1.2. When we encounter a v0 control message, we now send
|
|
|
|
|
back an error and close the connection.
|
2007-03-05 03:40:58 +01:00
|
|
|
- Remove the old "dns worker" server DNS code: it hasn't been default
|
|
|
|
|
since 0.1.2.2-alpha, and all the servers seem to be using the new
|
|
|
|
|
eventdns code.
|
2007-03-04 22:08:28 +01:00
|
|
|
|
2007-03-16 07:34:03 +01:00
|
|
|
o Minor bugfixes (portability):
|
2007-05-13 11:25:06 +02:00
|
|
|
- Even though Windows is equally happy with / and \ as path separators,
|
|
|
|
|
try to use \ consistently on Windows and / consistently on Unix: it
|
2007-03-09 22:39:30 +01:00
|
|
|
makes the log messages nicer.
|
2007-05-13 01:19:10 +02:00
|
|
|
- Correctly report platform name on Windows 95 OSR2 and Windows 98 SE.
|
2007-06-06 15:48:15 +02:00
|
|
|
- Read resolv.conf files correctly on platforms where read() returns
|
|
|
|
|
partial results on small file reads.
|
2007-05-13 01:19:10 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes (directory):
|
|
|
|
|
- Correctly enforce that elements of directory objects do not appear
|
|
|
|
|
more often than they are allowed to appear.
|
|
|
|
|
- When we are reporting the DirServer line we just parsed, we were
|
|
|
|
|
logging the second stanza of the key fingerprint, not the first.
|
2007-03-09 22:39:30 +01:00
|
|
|
|
2007-05-29 20:21:00 +02:00
|
|
|
o Minor bugfixes (logging):
|
|
|
|
|
- When we hit an EOF on a log (probably because we're shutting down),
|
|
|
|
|
don't try to remove the log from the list: just mark it as
|
2011-05-05 19:57:32 +02:00
|
|
|
unusable. (Bulletproofs against bug 222.)
|
2007-05-29 20:21:00 +02:00
|
|
|
|
2007-03-17 22:09:49 +01:00
|
|
|
o Minor bugfixes (other):
|
2007-06-01 09:12:14 +02:00
|
|
|
- In the exitlist script, only consider the most recently published
|
|
|
|
|
server descriptor for each server. Also, when the user requests
|
|
|
|
|
a list of servers that _reject_ connections to a given address,
|
|
|
|
|
explicitly exclude the IPs that also have servers that accept
|
|
|
|
|
connections to that address. (Resolves bug 405.)
|
2007-03-13 02:59:09 +01:00
|
|
|
- Stop allowing hibernating servers to be "stable" or "fast".
|
2007-06-01 09:12:14 +02:00
|
|
|
- On Windows, we were preventing other processes from reading
|
2011-05-05 19:57:32 +02:00
|
|
|
cached-routers while Tor was running. (Reported by janbar)
|
2007-06-01 09:12:14 +02:00
|
|
|
- Make the NodeFamilies config option work. (Reported by
|
|
|
|
|
lodger -- it has never actually worked, even though we added it
|
|
|
|
|
in Oct 2004.)
|
2007-03-24 16:57:51 +01:00
|
|
|
- Check return values from pthread_mutex functions.
|
2007-03-21 16:37:30 +01:00
|
|
|
- Don't save non-general-purpose router descriptors to the disk cache,
|
|
|
|
|
because we have no way of remembering what their purpose was when
|
|
|
|
|
we restart.
|
2007-04-30 07:32:57 +02:00
|
|
|
- Add even more asserts to hunt down bug 417.
|
2007-05-25 23:31:49 +02:00
|
|
|
- Build without verbose warnings even on (not-yet-released) gcc 4.2.
|
2007-07-12 18:34:45 +02:00
|
|
|
- Fix a possible (but very unlikely) bug in picking routers by bandwidth.
|
|
|
|
|
Add a log message to confirm that it is in fact unlikely.
|
2007-03-15 07:10:58 +01:00
|
|
|
|
2007-05-13 01:19:10 +02:00
|
|
|
o Minor bugfixes (controller):
|
2007-03-15 04:11:53 +01:00
|
|
|
- Make 'getinfo fingerprint' return a 551 error if we're not a
|
2007-05-13 01:19:10 +02:00
|
|
|
server, so we match what the control spec claims we do. Reported
|
|
|
|
|
by daejees.
|
2007-03-15 07:10:58 +01:00
|
|
|
- Fix a typo in an error message when extendcircuit fails that
|
2007-05-13 01:19:10 +02:00
|
|
|
caused us to not follow the \r\n-based delimiter protocol. Reported
|
|
|
|
|
by daejees.
|
2007-04-30 21:48:45 +02:00
|
|
|
|
2007-05-13 11:25:06 +02:00
|
|
|
o Code simplifications and refactoring:
|
2007-03-26 16:07:59 +02:00
|
|
|
- Stop passing around circuit_t and crypt_path_t pointers that are
|
|
|
|
|
implicit in other procedure arguments.
|
2007-06-01 09:12:14 +02:00
|
|
|
- Drop the old code to choke directory connections when the
|
|
|
|
|
corresponding OR connections got full: thanks to the cell queue
|
|
|
|
|
feature, OR conns don't get full any more.
|
2007-05-13 01:19:10 +02:00
|
|
|
- Make dns_resolve() handle attaching connections to circuits
|
|
|
|
|
properly, so the caller doesn't have to.
|
2007-04-21 19:30:42 +02:00
|
|
|
- Rename wants_to_read and wants_to_write to read/write_blocked_on_bw.
|
2007-05-22 17:49:14 +02:00
|
|
|
- Keep the connection array as a dynamic smartlist_t, rather than as
|
2007-06-01 09:12:14 +02:00
|
|
|
a fixed-sized array. This is important, as the number of connections
|
2007-05-22 17:49:14 +02:00
|
|
|
is becoming increasingly decoupled from the number of sockets.
|
2007-03-04 21:11:46 +01:00
|
|
|
|
2007-04-24 20:29:57 +02:00
|
|
|
|
2007-05-25 23:31:49 +02:00
|
|
|
Changes in version 0.1.2.14 - 2007-05-25
|
2007-10-22 10:52:01 +02:00
|
|
|
Tor 0.1.2.14 changes the addresses of two directory authorities (this
|
|
|
|
|
change especially affects those who serve or use hidden services),
|
|
|
|
|
and fixes several other crash- and security-related bugs.
|
|
|
|
|
|
2007-05-25 23:31:49 +02:00
|
|
|
o Directory authority changes:
|
|
|
|
|
- Two directory authorities (moria1 and moria2) just moved to new
|
|
|
|
|
IP addresses. This change will particularly affect those who serve
|
|
|
|
|
or use hidden services.
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- If a directory server runs out of space in the connection table
|
|
|
|
|
as it's processing a begin_dir request, it will free the exit stream
|
|
|
|
|
but leave it attached to the circuit, leading to unpredictable
|
|
|
|
|
behavior. (Reported by seeess, fixes bug 425.)
|
|
|
|
|
- Fix a bug in dirserv_remove_invalid() that would cause authorities
|
|
|
|
|
to corrupt memory under some really unlikely scenarios.
|
|
|
|
|
- Tighten router parsing rules. (Bugs reported by Benedikt Boss.)
|
|
|
|
|
- Avoid segfaults when reading from mmaped descriptor file. (Reported
|
|
|
|
|
by lodger.)
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (security):
|
|
|
|
|
- When choosing an entry guard for a circuit, avoid using guards
|
|
|
|
|
that are in the same family as the chosen exit -- not just guards
|
|
|
|
|
that are exactly the chosen exit. (Reported by lodger.)
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (resource management):
|
|
|
|
|
- If a directory authority is down, skip it when deciding where to get
|
|
|
|
|
networkstatus objects or descriptors. Otherwise we keep asking
|
|
|
|
|
every 10 seconds forever. Fixes bug 384.
|
|
|
|
|
- Count it as a failure if we fetch a valid network-status but we
|
|
|
|
|
don't want to keep it. Otherwise we'll keep fetching it and keep
|
|
|
|
|
not wanting to keep it. Fixes part of bug 422.
|
|
|
|
|
- If all of our dirservers have given us bad or no networkstatuses
|
|
|
|
|
lately, then stop hammering them once per minute even when we
|
|
|
|
|
think they're failed. Fixes another part of bug 422.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Actually set the purpose correctly for descriptors inserted with
|
|
|
|
|
purpose=controller.
|
|
|
|
|
- When we have k non-v2 authorities in our DirServer config,
|
|
|
|
|
we ignored the last k authorities in the list when updating our
|
|
|
|
|
network-statuses.
|
|
|
|
|
- Correctly back-off from requesting router descriptors that we are
|
|
|
|
|
having a hard time downloading.
|
|
|
|
|
- Read resolv.conf files correctly on platforms where read() returns
|
|
|
|
|
partial results on small file reads.
|
|
|
|
|
- Don't rebuild the entire router store every time we get 32K of
|
|
|
|
|
routers: rebuild it when the journal gets very large, or when
|
|
|
|
|
the gaps in the store get very large.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- When routers publish SVN revisions in their router descriptors,
|
|
|
|
|
authorities now include those versions correctly in networkstatus
|
|
|
|
|
documents.
|
|
|
|
|
- Warn when using a version of libevent before 1.3b to run a server on
|
|
|
|
|
OSX or BSD: these versions interact badly with userspace threads.
|
|
|
|
|
|
|
|
|
|
|
2007-04-24 20:29:57 +02:00
|
|
|
Changes in version 0.1.2.13 - 2007-04-24
|
2007-10-22 10:52:01 +02:00
|
|
|
This release features some major anonymity fixes, such as safer path
|
|
|
|
|
selection; better client performance; faster bootstrapping, better
|
|
|
|
|
address detection, and better DNS support for servers; write limiting as
|
|
|
|
|
well as read limiting to make servers easier to run; and a huge pile of
|
|
|
|
|
other features and bug fixes. The bundles also ship with Vidalia 0.0.11.
|
|
|
|
|
|
2007-10-22 10:54:32 +02:00
|
|
|
Tor 0.1.2.13 is released in memory of Rob Levin (1955-2006), aka lilo
|
|
|
|
|
of the Freenode IRC network, remembering his patience and vision for
|
|
|
|
|
free speech on the Internet.
|
|
|
|
|
|
2007-04-24 20:29:57 +02:00
|
|
|
o Minor fixes:
|
|
|
|
|
- Fix a memory leak when we ask for "all" networkstatuses and we
|
|
|
|
|
get one we don't recognize.
|
|
|
|
|
- Add more asserts to hunt down bug 417.
|
|
|
|
|
- Disable kqueue on OS X 10.3 and earlier, to fix bug 371.
|
|
|
|
|
|
|
|
|
|
|
2007-03-17 05:32:04 +01:00
|
|
|
Changes in version 0.1.2.12-rc - 2007-03-16
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix an infinite loop introduced in 0.1.2.7-alpha when we serve
|
|
|
|
|
directory information requested inside Tor connections (i.e. via
|
|
|
|
|
begin_dir cells). It only triggered when the same connection was
|
|
|
|
|
serving other data at the same time. Reported by seeess.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- When creating a circuit via the controller, send a 'launched'
|
|
|
|
|
event when we're done, so we follow the spec better.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.2.11-rc - 2007-03-15
|
|
|
|
|
o Minor bugfixes (controller), reported by daejees:
|
|
|
|
|
- Correct the control spec to match how the code actually responds
|
|
|
|
|
to 'getinfo addr-mappings/*'.
|
|
|
|
|
- The control spec described a GUARDS event, but the code
|
|
|
|
|
implemented a GUARD event. Standardize on GUARD, but let people
|
|
|
|
|
ask for GUARDS too.
|
|
|
|
|
|
|
|
|
|
|
2007-03-09 09:49:54 +01:00
|
|
|
Changes in version 0.1.2.10-rc - 2007-03-07
|
2007-03-04 19:58:38 +01:00
|
|
|
o Major bugfixes (Windows):
|
2007-03-03 22:16:07 +01:00
|
|
|
- Do not load the NT services library functions (which may not exist)
|
2007-03-09 09:49:54 +01:00
|
|
|
just to detect if we're a service trying to shut down. Now we run
|
|
|
|
|
on Win98 and friends again.
|
2007-03-03 22:16:07 +01:00
|
|
|
|
2007-03-04 19:58:38 +01:00
|
|
|
o Minor bugfixes (other):
|
|
|
|
|
- Clarify a couple of log messages.
|
2007-03-09 09:49:54 +01:00
|
|
|
- Fix a misleading socks5 error number.
|
2007-03-04 19:58:38 +01:00
|
|
|
|
2007-03-03 22:16:07 +01:00
|
|
|
|
2007-03-02 06:18:52 +01:00
|
|
|
Changes in version 0.1.2.9-rc - 2007-03-02
|
2007-03-01 06:04:54 +01:00
|
|
|
o Major bugfixes (Windows):
|
|
|
|
|
- On MinGW, use "%I64u" to printf/scanf 64-bit integers, instead
|
|
|
|
|
of the usual GCC "%llu". This prevents a bug when saving 64-bit
|
|
|
|
|
int configuration values: the high-order 32 bits would get
|
|
|
|
|
truncated. In particular, we were being bitten by the default
|
|
|
|
|
MaxAdvertisedBandwidth of 128 TB turning into 0. (Fixes bug 400
|
|
|
|
|
and maybe also bug 397.)
|
|
|
|
|
|
2007-02-27 04:53:45 +01:00
|
|
|
o Minor bugfixes (performance):
|
|
|
|
|
- Use OpenSSL's AES implementation on platforms where it's faster.
|
|
|
|
|
This could save us as much as 10% CPU usage.
|
|
|
|
|
|
2007-02-27 04:53:40 +01:00
|
|
|
o Minor bugfixes (server):
|
|
|
|
|
- Do not rotate onion key immediately after setting it for the first
|
|
|
|
|
time.
|
|
|
|
|
|
2007-03-01 06:04:54 +01:00
|
|
|
o Minor bugfixes (directory authorities):
|
2007-02-28 22:06:05 +01:00
|
|
|
- Stop calling servers that have been hibernating for a long time
|
|
|
|
|
"stable". Also, stop letting hibernating or obsolete servers affect
|
|
|
|
|
uptime and bandwidth cutoffs.
|
|
|
|
|
- Stop listing hibernating servers in the v1 directory.
|
|
|
|
|
|
2007-03-01 01:41:28 +01:00
|
|
|
o Minor bugfixes (hidden services):
|
|
|
|
|
- Upload hidden service descriptors slightly less often, to reduce
|
|
|
|
|
load on authorities.
|
|
|
|
|
|
2007-02-28 01:23:05 +01:00
|
|
|
o Minor bugfixes (other):
|
|
|
|
|
- Fix an assert that could trigger if a controller quickly set then
|
|
|
|
|
cleared EntryNodes. (Bug found by Udo van den Heuvel.)
|
2007-02-28 17:56:07 +01:00
|
|
|
- On architectures where sizeof(int)>4, still clamp declarable bandwidth
|
|
|
|
|
to INT32_MAX.
|
2007-02-28 18:27:36 +01:00
|
|
|
- Fix a potential race condition in the rpm installer. Found by
|
|
|
|
|
Stefan Nordhausen.
|
2007-02-28 21:24:23 +01:00
|
|
|
- Try to fix eventdns warnings once and for all: do not treat a dns rcode
|
|
|
|
|
of 2 as indicating that the server is completely bad; it sometimes
|
|
|
|
|
means that the server is just bad for the request in question. (may fix
|
|
|
|
|
the last of bug 326.)
|
2007-03-01 05:26:30 +01:00
|
|
|
- Disable encrypted directory connections when we don't have a server
|
|
|
|
|
descriptor for the destination. We'll get this working again in
|
|
|
|
|
the 0.2.0 branch.
|
2007-02-28 01:23:05 +01:00
|
|
|
|
2007-02-27 04:53:40 +01:00
|
|
|
|
2007-02-26 07:53:19 +01:00
|
|
|
Changes in version 0.1.2.8-beta - 2007-02-26
|
2007-02-10 08:04:46 +01:00
|
|
|
o Major bugfixes (crashes):
|
|
|
|
|
- Stop crashing when the controller asks us to resetconf more than
|
|
|
|
|
one config option at once. (Vidalia 0.0.11 does this.)
|
2007-02-13 00:39:24 +01:00
|
|
|
- Fix a crash that happened on Win98 when we're given command-line
|
2007-02-24 02:12:53 +01:00
|
|
|
arguments: don't try to load NT service functions from advapi32.dll
|
|
|
|
|
except when we need them. (Bug introduced in 0.1.2.7-alpha;
|
|
|
|
|
resolves bug 389.)
|
2007-02-26 06:36:02 +01:00
|
|
|
- Fix a longstanding obscure crash bug that could occur when
|
|
|
|
|
we run out of DNS worker processes. (Resolves bug 390.)
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (hidden services):
|
|
|
|
|
- Correctly detect whether hidden service descriptor downloads are
|
|
|
|
|
in-progress. (Suggested by Karsten Loesing; fixes bug 399.)
|
2007-02-24 02:12:53 +01:00
|
|
|
|
|
|
|
|
o Major bugfixes (accounting):
|
|
|
|
|
- When we start during an accounting interval before it's time to wake
|
|
|
|
|
up, remember to wake up at the correct time. (May fix bug 342.)
|
2007-02-10 08:04:46 +01:00
|
|
|
|
2007-02-07 07:54:22 +01:00
|
|
|
o Minor bugfixes (controller):
|
|
|
|
|
- Give the controller END_STREAM_REASON_DESTROY events _before_ we
|
2007-02-24 02:12:53 +01:00
|
|
|
clear the corresponding on_circuit variable, and remember later
|
|
|
|
|
that we don't need to send a redundant CLOSED event. (Resolves part
|
|
|
|
|
3 of bug 367.)
|
2007-02-07 07:54:27 +01:00
|
|
|
- Report events where a resolve succeeded or where we got a socks
|
2007-02-09 01:21:41 +01:00
|
|
|
protocol error correctly, rather than calling both of them
|
|
|
|
|
"INTERNAL".
|
2007-02-23 21:13:02 +01:00
|
|
|
- Change reported stream target addresses to IP consistently when
|
|
|
|
|
we finally get the IP from an exit node.
|
2007-02-24 21:28:41 +01:00
|
|
|
- Send log messages to the controller even if they happen to be very
|
|
|
|
|
long.
|
2007-02-07 07:54:22 +01:00
|
|
|
|
2007-02-08 20:44:48 +01:00
|
|
|
o Minor bugfixes (other):
|
2007-02-09 01:21:41 +01:00
|
|
|
- Display correct results when reporting which versions are
|
|
|
|
|
recommended, and how recommended they are. (Resolves bug 383.)
|
|
|
|
|
- Improve our estimates for directory bandwidth to be less random:
|
|
|
|
|
guess that an unrecognized directory will have the average bandwidth
|
|
|
|
|
from all known directories, not that it will have the average
|
|
|
|
|
bandwidth from those directories earlier than it on the list.
|
2007-02-09 01:22:43 +01:00
|
|
|
- If we start a server with ClientOnly 1, then set ClientOnly to 0
|
|
|
|
|
and hup, stop triggering an assert based on an empty onion_key.
|
2007-02-12 22:39:44 +01:00
|
|
|
- On platforms with no working mmap() equivalent, don't warn the
|
|
|
|
|
user when cached-routers doesn't exist.
|
|
|
|
|
- Warn the user when mmap() [or its equivalent] fails for some reason
|
|
|
|
|
other than file-not-found.
|
|
|
|
|
- Don't warn the user when cached-routers.new doesn't exist: that's
|
|
|
|
|
perfectly fine when starting up for the first time.
|
2007-02-25 14:39:33 +01:00
|
|
|
- When EntryNodes are configured, rebuild the guard list to contain,
|
|
|
|
|
in order: the EntryNodes that were guards before; the rest of the
|
2007-02-13 02:27:55 +01:00
|
|
|
EntryNodes; the nodes that were guards before.
|
2007-02-25 14:39:33 +01:00
|
|
|
- Mask out all signals in sub-threads; only the libevent signal
|
|
|
|
|
handler should be processing them. This should prevent some crashes
|
|
|
|
|
on some machines using pthreads. (Patch from coderman.)
|
|
|
|
|
- Fix switched arguments on memset in the implementation of
|
|
|
|
|
tor_munmap() for systems with no mmap() call.
|
|
|
|
|
- When Tor receives a router descriptor that it asked for, but
|
|
|
|
|
no longer wants (because it has received fresh networkstatuses
|
|
|
|
|
in the meantime), do not warn the user. Cache the descriptor if
|
|
|
|
|
we're a cache; drop it if we aren't.
|
|
|
|
|
- Make earlier entry guards _really_ get retried when the network
|
|
|
|
|
comes back online.
|
2007-02-24 09:18:59 +01:00
|
|
|
- On a malformed DNS reply, always give an error to the corresponding
|
|
|
|
|
DNS request.
|
2007-02-24 20:10:35 +01:00
|
|
|
- Build with recent libevents on platforms that do not define the
|
|
|
|
|
nonstandard types "u_int8_t" and friends.
|
2007-02-07 07:54:22 +01:00
|
|
|
|
2007-02-14 17:46:49 +01:00
|
|
|
o Minor features (controller):
|
2007-02-09 01:21:41 +01:00
|
|
|
- Warn the user when an application uses the obsolete binary v0
|
|
|
|
|
control protocol. We're planning to remove support for it during
|
|
|
|
|
the next development series, so it's good to give people some
|
|
|
|
|
advance warning.
|
2007-02-25 14:39:33 +01:00
|
|
|
- Add STREAM_BW events to report per-entry-stream bandwidth
|
|
|
|
|
use. (Patch from Robert Hogan.)
|
|
|
|
|
- Rate-limit SIGNEWNYM signals in response to controllers that
|
|
|
|
|
impolitely generate them for every single stream. (Patch from
|
|
|
|
|
mwenge; closes bug 394.)
|
|
|
|
|
- Make REMAP stream events have a SOURCE (cache or exit), and
|
|
|
|
|
make them generated in every case where we get a successful
|
|
|
|
|
connected or resolved cell.
|
2007-02-14 17:46:49 +01:00
|
|
|
|
2007-02-21 06:56:53 +01:00
|
|
|
o Minor bugfixes (performance):
|
2007-02-25 14:39:33 +01:00
|
|
|
- Call router_have_min_dir_info half as often. (This is showing up in
|
2007-02-21 06:56:53 +01:00
|
|
|
some profiles, but not others.)
|
2007-02-25 14:39:33 +01:00
|
|
|
- When using GCC, make log_debug never get called at all, and its
|
2007-02-21 06:57:12 +01:00
|
|
|
arguments never get evaluated, when no debug logs are configured.
|
|
|
|
|
(This is showing up in some profiles, but not others.)
|
2007-02-21 06:56:53 +01:00
|
|
|
|
2007-02-14 17:46:49 +01:00
|
|
|
o Minor features:
|
2007-02-08 23:07:56 +01:00
|
|
|
- Remove some never-implemented options. Mark PathlenCoinWeight as
|
|
|
|
|
obsolete.
|
2007-02-12 22:39:33 +01:00
|
|
|
- Implement proposal 106: Stop requiring clients to have well-formed
|
2007-02-25 14:39:33 +01:00
|
|
|
certificates; stop checking nicknames in certificates. (Clients
|
|
|
|
|
have certificates so that they can look like Tor servers, but in
|
|
|
|
|
the future we might want to allow them to look like regular TLS
|
|
|
|
|
clients instead. Nicknames in certificates serve no purpose other
|
|
|
|
|
than making our protocol easier to recognize on the wire.)
|
2007-02-12 22:39:33 +01:00
|
|
|
- Revise messages on handshake failure again to be even more clear about
|
|
|
|
|
which are incoming connections and which are outgoing.
|
2007-02-13 00:39:24 +01:00
|
|
|
- Discard any v1 directory info that's over 1 month old (for
|
|
|
|
|
directories) or over 1 week old (for running-routers lists).
|
2007-02-13 02:27:55 +01:00
|
|
|
- Do not warn when individual nodes in the configuration's EntryNodes,
|
2007-02-25 14:39:33 +01:00
|
|
|
ExitNodes, etc are down: warn only when all possible nodes
|
|
|
|
|
are down. (Fixes bug 348.)
|
2007-02-13 03:01:38 +01:00
|
|
|
- Always remove expired routers and networkstatus docs before checking
|
2007-02-25 14:39:33 +01:00
|
|
|
whether we have enough information to build circuits. (Fixes
|
|
|
|
|
bug 373.)
|
2007-02-25 20:43:23 +01:00
|
|
|
- Put a lower-bound on MaxAdvertisedBandwidth.
|
2007-02-08 20:44:48 +01:00
|
|
|
|
|
|
|
|
|
2007-02-06 03:49:07 +01:00
|
|
|
Changes in version 0.1.2.7-alpha - 2007-02-06
|
2007-01-26 08:54:16 +01:00
|
|
|
o Major bugfixes (rate limiting):
|
2007-01-18 04:35:13 +01:00
|
|
|
- Servers decline directory requests much more aggressively when
|
|
|
|
|
they're low on bandwidth. Otherwise they end up queueing more and
|
|
|
|
|
more directory responses, which can't be good for latency.
|
2007-02-08 06:38:17 +01:00
|
|
|
- But never refuse directory requests from local addresses.
|
2007-02-06 03:49:07 +01:00
|
|
|
- Fix a memory leak when sending a 503 response for a networkstatus
|
|
|
|
|
request.
|
2007-01-18 04:38:24 +01:00
|
|
|
- Be willing to read or write on local connections (e.g. controller
|
|
|
|
|
connections) even when the global rate limiting buckets are empty.
|
2007-01-21 07:24:05 +01:00
|
|
|
- If our system clock jumps back in time, don't publish a negative
|
|
|
|
|
uptime in the descriptor. Also, don't let the global rate limiting
|
|
|
|
|
buckets go absurdly negative.
|
2007-01-26 08:54:16 +01:00
|
|
|
- Flush local controller connection buffers periodically as we're
|
|
|
|
|
writing to them, so we avoid queueing 4+ megabytes of data before
|
|
|
|
|
trying to flush.
|
|
|
|
|
|
2007-02-05 21:45:02 +01:00
|
|
|
o Major bugfixes (NT services):
|
2007-02-05 22:15:52 +01:00
|
|
|
- Install as NT_AUTHORITY\LocalService rather than as SYSTEM; add a
|
2007-02-05 21:45:02 +01:00
|
|
|
command-line flag so that admins can override the default by saying
|
2007-02-07 06:10:58 +01:00
|
|
|
"tor --service install --user "SomeUser"". This will not affect
|
2007-02-06 19:36:26 +01:00
|
|
|
existing installed services. Also, warn the user that the service
|
|
|
|
|
will look for its configuration file in the service user's
|
|
|
|
|
%appdata% directory. (We can't do the 'hardwire the user's appdata
|
|
|
|
|
directory' trick any more, since we may not have read access to that
|
|
|
|
|
directory.)
|
2007-02-05 21:45:02 +01:00
|
|
|
|
2007-01-26 08:54:16 +01:00
|
|
|
o Major bugfixes (other):
|
|
|
|
|
- Previously, we would cache up to 16 old networkstatus documents
|
|
|
|
|
indefinitely, if they came from nontrusted authorities. Now we
|
|
|
|
|
discard them if they are more than 10 days old.
|
2007-02-06 03:49:07 +01:00
|
|
|
- Fix a crash bug in the presence of DNS hijacking (reported by Andrew
|
|
|
|
|
Del Vecchio).
|
2007-01-21 18:05:10 +01:00
|
|
|
- Detect and reject malformed DNS responses containing circular
|
|
|
|
|
pointer loops.
|
2007-02-06 01:27:03 +01:00
|
|
|
- If exits are rare enough that we're not marking exits as guards,
|
|
|
|
|
ignore exit bandwidth when we're deciding the required bandwidth
|
|
|
|
|
to become a guard.
|
|
|
|
|
- When we're handling a directory connection tunneled over Tor,
|
|
|
|
|
don't fill up internal memory buffers with all the data we want
|
|
|
|
|
to tunnel; instead, only add it if the OR connection that will
|
|
|
|
|
eventually receive it has some room for it. (This can lead to
|
|
|
|
|
slowdowns in tunneled dir connections; a better solution will have
|
|
|
|
|
to wait for 0.2.0.)
|
2007-01-11 15:13:13 +01:00
|
|
|
|
2007-02-06 03:49:07 +01:00
|
|
|
o Minor bugfixes (dns):
|
2007-01-10 20:49:21 +01:00
|
|
|
- Add some defensive programming to eventdns.c in an attempt to catch
|
|
|
|
|
possible memory-stomping bugs.
|
2007-01-21 19:21:39 +01:00
|
|
|
- Detect and reject DNS replies containing IPv4 or IPv6 records with
|
2007-01-26 08:54:16 +01:00
|
|
|
an incorrect number of bytes. (Previously, we would ignore the
|
|
|
|
|
extra bytes.)
|
|
|
|
|
- Fix as-yet-unused reverse IPv6 lookup code so it sends nybbles
|
2007-01-27 06:15:53 +01:00
|
|
|
in the correct order, and doesn't crash.
|
2007-01-22 20:13:02 +01:00
|
|
|
- Free memory held in recently-completed DNS lookup attempts on exit.
|
|
|
|
|
This was not a memory leak, but may have been hiding memory leaks.
|
2007-02-06 03:49:07 +01:00
|
|
|
- Handle TTL values correctly on reverse DNS lookups.
|
|
|
|
|
- Treat failure to parse resolv.conf as an error.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes (other):
|
|
|
|
|
- Fix crash with "tor --list-fingerprint" (reported by seeess).
|
|
|
|
|
- When computing clock skew from directory HTTP headers, consider what
|
|
|
|
|
time it was when we finished asking for the directory, not what
|
|
|
|
|
time it is now.
|
|
|
|
|
- Expire socks connections if they spend too long waiting for the
|
|
|
|
|
handshake to finish. Previously we would let them sit around for
|
|
|
|
|
days, if the connecting application didn't close them either.
|
|
|
|
|
- And if the socks handshake hasn't started, don't send a
|
|
|
|
|
"DNS resolve socks failed" handshake reply; just close it.
|
|
|
|
|
- Stop using C functions that OpenBSD's linker doesn't like.
|
2007-01-22 21:57:26 +01:00
|
|
|
- Don't launch requests for descriptors unless we have networkstatuses
|
2007-01-26 08:54:16 +01:00
|
|
|
from at least half of the authorities. This delays the first
|
|
|
|
|
download slightly under pathological circumstances, but can prevent
|
|
|
|
|
us from downloading a bunch of descriptors we don't need.
|
|
|
|
|
- Do not log IPs with TLS failures for incoming TLS
|
|
|
|
|
connections. (Fixes bug 382.)
|
2007-02-06 03:49:07 +01:00
|
|
|
- If the user asks to use invalid exit nodes, be willing to use
|
2007-01-27 20:40:49 +01:00
|
|
|
unstable ones.
|
2007-01-30 00:09:26 +01:00
|
|
|
- Stop using the reserved ac_cv namespace in our configure script.
|
2007-02-01 19:09:27 +01:00
|
|
|
- Call stat() slightly less often; use fstat() when possible.
|
2007-02-05 18:42:40 +01:00
|
|
|
- Refactor the way we handle pending circuits when an OR connection
|
|
|
|
|
completes or fails, in an attempt to fix a rare crash bug.
|
2007-02-07 04:40:06 +01:00
|
|
|
- Only rewrite a conn's address based on X-Forwarded-For: headers
|
|
|
|
|
if it's a parseable public IP address; and stop adding extra quotes
|
|
|
|
|
to the resulting address.
|
2007-01-10 17:33:40 +01:00
|
|
|
|
2007-01-27 10:13:19 +01:00
|
|
|
o Major features:
|
|
|
|
|
- Weight directory requests by advertised bandwidth. Now we can
|
|
|
|
|
let servers enable write limiting but still allow most clients to
|
2007-02-06 01:27:03 +01:00
|
|
|
succeed at their directory requests. (We still ignore weights when
|
|
|
|
|
choosing a directory authority; I hope this is a feature.)
|
2007-01-27 10:13:19 +01:00
|
|
|
|
2007-01-22 20:20:33 +01:00
|
|
|
o Minor features:
|
2007-01-26 10:03:20 +01:00
|
|
|
- Create a new file ReleaseNotes which was the old ChangeLog. The
|
2007-02-06 01:27:03 +01:00
|
|
|
new ChangeLog file now includes the summaries for all development
|
|
|
|
|
versions too.
|
2007-01-26 08:54:16 +01:00
|
|
|
- Check for addresses with invalid characters at the exit as well
|
|
|
|
|
as at the client, and warn less verbosely when they fail. You can
|
|
|
|
|
override this by setting ServerDNSAllowNonRFC953Addresses to 1.
|
2007-01-22 20:20:33 +01:00
|
|
|
- Adapt a patch from goodell to let the contrib/exitlist script
|
|
|
|
|
take arguments rather than require direct editing.
|
2007-01-25 20:41:15 +01:00
|
|
|
- Inform the server operator when we decide not to advertise a
|
|
|
|
|
DirPort due to AccountingMax enabled or a low BandwidthRate. It
|
|
|
|
|
was confusing Zax, so now we're hopefully more helpful.
|
2007-01-27 20:29:16 +01:00
|
|
|
- Bring us one step closer to being able to establish an encrypted
|
|
|
|
|
directory tunnel without knowing a descriptor first. Still not
|
|
|
|
|
ready yet. As part of the change, now assume we can use a
|
|
|
|
|
create_fast cell if we don't know anything about a router.
|
2007-01-29 19:13:42 +01:00
|
|
|
- Allow exit nodes to use nameservers running on ports other than 53.
|
2007-01-31 01:58:06 +01:00
|
|
|
- Servers now cache reverse DNS replies.
|
2007-02-06 19:36:21 +01:00
|
|
|
- Add an --ignore-missing-torrc command-line option so that we can
|
|
|
|
|
get the "use sensible defaults if the configuration file doesn't
|
|
|
|
|
exist" behavior even when specifying a torrc location on the command
|
|
|
|
|
line.
|
2007-01-22 20:20:33 +01:00
|
|
|
|
|
|
|
|
o Minor features (controller):
|
2007-01-26 08:54:16 +01:00
|
|
|
- Track reasons for OR connection failure; make these reasons
|
|
|
|
|
available via the controller interface. (Patch from Mike Perry.)
|
|
|
|
|
- Add a SOCKS_BAD_HOSTNAME client status event so controllers
|
|
|
|
|
can learn when clients are sending malformed hostnames to Tor.
|
2007-01-22 20:20:33 +01:00
|
|
|
- Clean up documentation for controller status events.
|
2007-02-06 03:49:07 +01:00
|
|
|
- Add a REMAP status to stream events to note that a stream's
|
|
|
|
|
address has changed because of a cached address or a MapAddress
|
|
|
|
|
directive.
|
|
|
|
|
|
2007-01-10 17:33:40 +01:00
|
|
|
|
2007-01-09 06:14:34 +01:00
|
|
|
Changes in version 0.1.2.6-alpha - 2007-01-09
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix an assert error introduced in 0.1.2.5-alpha: if a single TLS
|
2007-01-09 06:20:06 +01:00
|
|
|
connection handles more than 4 gigs in either direction, we crash.
|
|
|
|
|
- Fix an assert error introduced in 0.1.2.5-alpha: if we're an
|
|
|
|
|
advertised exit node, somebody might try to exit from us when
|
2007-02-08 06:38:17 +01:00
|
|
|
we're bootstrapping and before we've built our descriptor yet.
|
2007-01-09 06:20:06 +01:00
|
|
|
Refuse the connection rather than crashing.
|
2007-01-09 06:14:34 +01:00
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Warn if we (as a server) find that we've resolved an address that we
|
|
|
|
|
weren't planning to resolve.
|
|
|
|
|
- Warn that using select() on any libevent version before 1.1 will be
|
|
|
|
|
unnecessarily slow (even for select()).
|
|
|
|
|
- Flush ERR-level controller status events just like we currently
|
|
|
|
|
flush ERR-level log events, so that a Tor shutdown doesn't prevent
|
|
|
|
|
the controller from learning about current events.
|
|
|
|
|
|
|
|
|
|
o Minor features (more controller status events):
|
2007-01-06 06:42:31 +01:00
|
|
|
- Implement EXTERNAL_ADDRESS server status event so controllers can
|
|
|
|
|
learn when our address changes.
|
|
|
|
|
- Implement BAD_SERVER_DESCRIPTOR server status event so controllers
|
|
|
|
|
can learn when directories reject our descriptor.
|
|
|
|
|
- Implement SOCKS_UNKNOWN_PROTOCOL client status event so controllers
|
|
|
|
|
can learn when a client application is speaking a non-socks protocol
|
|
|
|
|
to our SocksPort.
|
|
|
|
|
- Implement DANGEROUS_SOCKS client status event so controllers
|
|
|
|
|
can learn when a client application is leaking DNS addresses.
|
|
|
|
|
- Implement BUG general status event so controllers can learn when
|
|
|
|
|
Tor is unhappy about its internal invariants.
|
|
|
|
|
- Implement CLOCK_SKEW general status event so controllers can learn
|
|
|
|
|
when Tor thinks the system clock is set incorrectly.
|
|
|
|
|
- Implement GOOD_SERVER_DESCRIPTOR and ACCEPTED_SERVER_DESCRIPTOR
|
|
|
|
|
server status events so controllers can learn when their descriptors
|
|
|
|
|
are accepted by a directory.
|
|
|
|
|
- Implement CHECKING_REACHABILITY and REACHABILITY_{SUCCEEDED|FAILED}
|
|
|
|
|
server status events so controllers can learn about Tor's progress in
|
|
|
|
|
deciding whether it's reachable from the outside.
|
2007-01-06 08:34:02 +01:00
|
|
|
- Implement BAD_LIBEVENT general status event so controllers can learn
|
|
|
|
|
when we have a version/method combination in libevent that needs to
|
|
|
|
|
be changed.
|
2007-01-06 08:34:11 +01:00
|
|
|
- Implement NAMESERVER_STATUS, NAMESERVER_ALL_DOWN, DNS_HIJACKED,
|
|
|
|
|
and DNS_USELESS server status events so controllers can learn
|
|
|
|
|
about changes to DNS server status.
|
2007-01-06 06:42:31 +01:00
|
|
|
|
2007-01-06 07:26:53 +01:00
|
|
|
o Minor features (directory):
|
2007-01-09 06:14:34 +01:00
|
|
|
- Authorities no longer recommend exits as guards if this would shift
|
|
|
|
|
too much load to the exit nodes.
|
2007-01-06 07:26:46 +01:00
|
|
|
|
2007-01-06 06:42:31 +01:00
|
|
|
|
2007-01-06 06:14:57 +01:00
|
|
|
Changes in version 0.1.2.5-alpha - 2007-01-06
|
2006-12-13 03:49:45 +01:00
|
|
|
o Major features:
|
2006-12-15 22:39:35 +01:00
|
|
|
- Enable write limiting as well as read limiting. Now we sacrifice
|
|
|
|
|
capacity if we're pushing out lots of directory traffic, rather
|
|
|
|
|
than overrunning the user's intended bandwidth limits.
|
2006-12-29 04:42:46 +01:00
|
|
|
- Include TLS overhead when counting bandwidth usage; previously, we
|
2007-01-04 06:41:24 +01:00
|
|
|
would count only the bytes sent over TLS, but not the bytes used
|
|
|
|
|
to send them.
|
2007-01-06 06:14:57 +01:00
|
|
|
- Support running the Tor service with a torrc not in the same
|
|
|
|
|
directory as tor.exe and default to using the torrc located in
|
|
|
|
|
the %appdata%\Tor\ of the user who installed the service. Patch
|
|
|
|
|
from Matt Edman.
|
|
|
|
|
- Servers now check for the case when common DNS requests are going to
|
|
|
|
|
wildcarded addresses (i.e. all getting the same answer), and change
|
|
|
|
|
their exit policy to reject *:* if it's happening.
|
|
|
|
|
- Implement BEGIN_DIR cells, so we can connect to the directory
|
|
|
|
|
server via TLS to do encrypted directory requests rather than
|
|
|
|
|
plaintext. Enable via the TunnelDirConns and PreferTunneledDirConns
|
|
|
|
|
config options if you like.
|
2006-12-13 03:49:45 +01:00
|
|
|
|
2007-01-06 06:14:57 +01:00
|
|
|
o Minor features (config and docs):
|
2006-12-07 19:57:37 +01:00
|
|
|
- Start using the state file to store bandwidth accounting data:
|
2006-12-12 21:19:54 +01:00
|
|
|
the bw_accounting file is now obsolete. We'll keep generating it
|
2006-12-07 19:57:37 +01:00
|
|
|
for a while for people who are still using 0.1.2.4-alpha.
|
2006-12-12 21:19:54 +01:00
|
|
|
- Try to batch changes to the state file so that we do as few
|
|
|
|
|
disk writes as possible while still storing important things in
|
|
|
|
|
a timely fashion.
|
2007-01-04 06:41:24 +01:00
|
|
|
- The state file and the bw_accounting file get saved less often when
|
2007-01-06 06:14:57 +01:00
|
|
|
the AvoidDiskWrites config option is set.
|
2006-12-15 06:12:52 +01:00
|
|
|
- Make PIDFile work on Windows (untested).
|
2006-12-15 22:27:19 +01:00
|
|
|
- Add internal descriptions for a bunch of configuration options:
|
|
|
|
|
accessible via controller interface and in comments in saved
|
|
|
|
|
options files.
|
2007-01-06 06:14:57 +01:00
|
|
|
- Reject *:563 (NNTPS) in the default exit policy. We already reject
|
2006-12-18 09:25:34 +01:00
|
|
|
NNTP by default, so this seems like a sensible addition.
|
2007-01-06 06:14:57 +01:00
|
|
|
- Clients now reject hostnames with invalid characters. This should
|
|
|
|
|
avoid some inadvertent info leaks. Add an option
|
|
|
|
|
AllowNonRFC953Hostnames to disable this behavior, in case somebody
|
|
|
|
|
is running a private network with hosts called @, !, and #.
|
2006-12-20 18:05:48 +01:00
|
|
|
- Add a maintainer script to tell us which options are missing
|
2007-01-04 05:35:18 +01:00
|
|
|
documentation: "make check-docs".
|
2007-01-06 06:14:57 +01:00
|
|
|
- Add a new address-spec.txt document to describe our special-case
|
|
|
|
|
addresses: .exit, .onion, and .noconnnect.
|
|
|
|
|
|
|
|
|
|
o Minor features (DNS):
|
|
|
|
|
- Ongoing work on eventdns infrastructure: now it has dns server
|
|
|
|
|
and ipv6 support. One day Tor will make use of it.
|
|
|
|
|
- Add client-side caching for reverse DNS lookups.
|
|
|
|
|
- Add support to tor-resolve tool for reverse lookups and SOCKS5.
|
|
|
|
|
- When we change nameservers or IP addresses, reset and re-launch
|
|
|
|
|
our tests for DNS hijacking.
|
|
|
|
|
|
|
|
|
|
o Minor features (directory):
|
|
|
|
|
- Authorities now specify server versions in networkstatus. This adds
|
2007-04-24 20:29:57 +02:00
|
|
|
about 2% to the size of compressed networkstatus docs, and allows
|
2007-01-06 06:14:57 +01:00
|
|
|
clients to tell which servers support BEGIN_DIR and which don't.
|
|
|
|
|
The implementation is forward-compatible with a proposed future
|
|
|
|
|
protocol version scheme not tied to Tor versions.
|
|
|
|
|
- DirServer configuration lines now have an orport= option so
|
2007-01-04 06:41:24 +01:00
|
|
|
clients can open encrypted tunnels to the authorities without
|
|
|
|
|
having downloaded their descriptors yet. Enabled for moria1,
|
|
|
|
|
moria2, tor26, and lefkada now in the default configuration.
|
2007-01-06 06:14:57 +01:00
|
|
|
- Directory servers are more willing to send a 503 "busy" if they
|
|
|
|
|
are near their write limit, especially for v1 directory requests.
|
|
|
|
|
Now they can use their limited bandwidth for actual Tor traffic.
|
|
|
|
|
- Clients track responses with status 503 from dirservers. After a
|
2007-01-04 06:41:24 +01:00
|
|
|
dirserver has given us a 503, we try not to use it until an hour has
|
|
|
|
|
gone by, or until we have no dirservers that haven't given us a 503.
|
2006-12-25 03:47:37 +01:00
|
|
|
- When we get a 503 from a directory, and we're not a server, we don't
|
2007-01-04 06:41:24 +01:00
|
|
|
count the failure against the total number of failures allowed
|
|
|
|
|
for the thing we're trying to download.
|
|
|
|
|
- Report X-Your-Address-Is correctly from tunneled directory
|
2007-01-04 10:12:23 +01:00
|
|
|
connections; don't report X-Your-Address-Is when it's an internal
|
2007-01-04 06:41:24 +01:00
|
|
|
address; and never believe reported remote addresses when they're
|
|
|
|
|
internal.
|
2007-01-06 06:14:57 +01:00
|
|
|
- Protect against an unlikely DoS attack on directory servers.
|
2007-01-03 20:58:00 +01:00
|
|
|
- Add a BadDirectory flag to network status docs so that authorities
|
2007-01-04 06:41:24 +01:00
|
|
|
can (eventually) tell clients about caches they believe to be
|
|
|
|
|
broken.
|
2006-12-07 19:57:37 +01:00
|
|
|
|
2007-01-06 06:14:57 +01:00
|
|
|
o Minor features (controller):
|
|
|
|
|
- Have GETINFO dir/status/* work on hosts with DirPort disabled.
|
|
|
|
|
- Reimplement GETINFO so that info/names stays in sync with the
|
|
|
|
|
actual keys.
|
|
|
|
|
- Implement "GETINFO fingerprint".
|
|
|
|
|
- Implement "SETEVENTS GUARD" so controllers can get updates on
|
|
|
|
|
entry guard status as it changes.
|
|
|
|
|
|
|
|
|
|
o Minor features (clean up obsolete pieces):
|
|
|
|
|
- Remove some options that have been deprecated since at least
|
|
|
|
|
0.1.0.x: AccountingMaxKB, LogFile, DebugLogFile, LogLevel, and
|
|
|
|
|
SysLog. Use AccountingMax instead of AccountingMaxKB, and use Log
|
|
|
|
|
to set log options.
|
|
|
|
|
- We no longer look for identity and onion keys in "identity.key" and
|
|
|
|
|
"onion.key" -- these were replaced by secret_id_key and
|
|
|
|
|
secret_onion_key in 0.0.8pre1.
|
|
|
|
|
- We no longer require unrecognized directory entries to be
|
|
|
|
|
preceded by "opt".
|
|
|
|
|
|
|
|
|
|
o Major bugfixes (security):
|
2006-12-15 20:56:56 +01:00
|
|
|
- Stop sending the HttpProxyAuthenticator string to directory
|
|
|
|
|
servers when directory connections are tunnelled through Tor.
|
|
|
|
|
- Clients no longer store bandwidth history in the state file.
|
|
|
|
|
- Do not log introduction points for hidden services if SafeLogging
|
|
|
|
|
is set.
|
|
|
|
|
- When generating bandwidth history, round down to the nearest
|
|
|
|
|
1k. When storing accounting data, round up to the nearest 1k.
|
|
|
|
|
- When we're running as a server, remember when we last rotated onion
|
|
|
|
|
keys, so that we will rotate keys once they're a week old even if
|
|
|
|
|
we never stay up for a week ourselves.
|
|
|
|
|
|
2007-01-06 06:14:57 +01:00
|
|
|
o Major bugfixes (other):
|
2006-12-08 06:59:21 +01:00
|
|
|
- Fix a longstanding bug in eventdns that prevented the count of
|
2006-12-12 21:19:54 +01:00
|
|
|
timed-out resolves from ever being reset. This bug caused us to
|
|
|
|
|
give up on a nameserver the third time it timed out, and try it
|
|
|
|
|
10 seconds later... and to give up on it every time it timed out
|
2007-01-06 06:14:57 +01:00
|
|
|
after that.
|
2006-12-20 10:43:28 +01:00
|
|
|
- Take out the '5 second' timeout from the connection retry
|
|
|
|
|
schedule. Now the first connect attempt will wait a full 10
|
|
|
|
|
seconds before switching to a new circuit. Perhaps this will help
|
|
|
|
|
a lot. Based on observations from Mike Perry.
|
2007-01-03 04:45:53 +01:00
|
|
|
- Fix a bug on the Windows implementation of tor_mmap_file() that
|
2007-01-06 06:14:57 +01:00
|
|
|
would prevent the cached-routers file from ever loading. Reported
|
|
|
|
|
by John Kimble.
|
2006-12-08 06:59:21 +01:00
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
2006-12-12 21:19:54 +01:00
|
|
|
- Fix an assert failure when a directory authority sets
|
2006-12-04 19:54:01 +01:00
|
|
|
AuthDirRejectUnlisted and then receives a descriptor from an
|
2007-01-06 06:14:57 +01:00
|
|
|
unlisted router. Reported by seeess.
|
|
|
|
|
- Avoid a double-free when parsing malformed DirServer lines.
|
|
|
|
|
- Fix a bug when a BSD-style PF socket is first used. Patch from
|
|
|
|
|
Fabian Keil.
|
2006-12-12 21:23:17 +01:00
|
|
|
- Fix a bug in 0.1.2.2-alpha that prevented clients from asking
|
|
|
|
|
to resolve an address at a given exit node even when they ask for
|
|
|
|
|
it by name.
|
2007-01-06 06:14:57 +01:00
|
|
|
- Servers no longer ever list themselves in their "family" line,
|
|
|
|
|
even if configured to do so. This makes it easier to configure
|
|
|
|
|
family lists conveniently.
|
2006-12-20 10:25:58 +01:00
|
|
|
- When running as a server, don't fall back to 127.0.0.1 when no
|
|
|
|
|
nameservers are configured in /etc/resolv.conf; instead, make the
|
|
|
|
|
user fix resolv.conf or specify nameservers explicitly. (Resolves
|
|
|
|
|
bug 363.)
|
2006-12-21 04:22:59 +01:00
|
|
|
- Stop accepting certain malformed ports in configured exit policies.
|
2006-12-24 04:06:03 +01:00
|
|
|
- Don't re-write the fingerprint file every restart, unless it has
|
|
|
|
|
changed.
|
2006-12-28 22:29:26 +01:00
|
|
|
- Stop warning when a single nameserver fails: only warn when _all_ of
|
2007-01-06 06:14:57 +01:00
|
|
|
our nameservers have failed. Also, when we only have one nameserver,
|
|
|
|
|
raise the threshold for deciding that the nameserver is dead.
|
2007-01-02 22:47:21 +01:00
|
|
|
- Directory authorities now only decide that routers are reachable
|
|
|
|
|
if their identity keys are as expected.
|
2007-01-03 04:56:17 +01:00
|
|
|
- When the user uses bad syntax in the Log config line, stop
|
|
|
|
|
suggesting other bad syntax as a replacement.
|
2007-01-05 23:12:15 +01:00
|
|
|
- Correctly detect ipv6 DNS capability on OpenBSD.
|
2006-12-04 06:09:09 +01:00
|
|
|
|
2007-01-06 06:14:57 +01:00
|
|
|
o Minor bugfixes (controller):
|
|
|
|
|
- Report the circuit number correctly in STREAM CLOSED events. Bug
|
|
|
|
|
reported by Mike Perry.
|
2006-12-15 06:12:42 +01:00
|
|
|
- Do not report bizarre values for results of accounting GETINFOs
|
2007-01-06 06:14:57 +01:00
|
|
|
when the last second's write or read exceeds the allotted bandwidth.
|
2006-12-29 21:49:47 +01:00
|
|
|
- Report "unrecognized key" rather than an empty string when the
|
|
|
|
|
controller tries to fetch a networkstatus that doesn't exist.
|
2006-12-04 06:55:40 +01:00
|
|
|
|
|
|
|
|
|
2007-01-26 07:44:38 +01:00
|
|
|
Changes in version 0.1.1.26 - 2006-12-14
|
|
|
|
|
o Security bugfixes:
|
|
|
|
|
- Stop sending the HttpProxyAuthenticator string to directory
|
|
|
|
|
servers when directory connections are tunnelled through Tor.
|
|
|
|
|
- Clients no longer store bandwidth history in the state file.
|
|
|
|
|
- Do not log introduction points for hidden services if SafeLogging
|
|
|
|
|
is set.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix an assert failure when a directory authority sets
|
|
|
|
|
AuthDirRejectUnlisted and then receives a descriptor from an
|
|
|
|
|
unlisted router (reported by seeess).
|
|
|
|
|
|
|
|
|
|
|
2006-12-03 17:48:01 +01:00
|
|
|
Changes in version 0.1.2.4-alpha - 2006-12-03
|
2006-12-02 23:47:46 +01:00
|
|
|
o Major features:
|
|
|
|
|
- Add support for using natd; this allows FreeBSDs earlier than
|
|
|
|
|
5.1.2 to have ipfw send connections through Tor without using
|
|
|
|
|
SOCKS. (Patch from Zajcev Evgeny with tweaks from tup.)
|
2006-11-14 01:06:31 +01:00
|
|
|
|
2006-12-02 23:47:46 +01:00
|
|
|
o Minor features:
|
|
|
|
|
- Make all connections to addresses of the form ".noconnect"
|
|
|
|
|
immediately get closed. This lets application/controller combos
|
|
|
|
|
successfully test whether they're talking to the same Tor by
|
|
|
|
|
watching for STREAM events.
|
|
|
|
|
- Make cross.sh cross-compilation script work even when autogen.sh
|
|
|
|
|
hasn't been run. (Patch from Michael Mohr.)
|
|
|
|
|
- Statistics dumped by -USR2 now include a breakdown of public key
|
|
|
|
|
operations, for profiling.
|
2006-11-17 04:34:58 +01:00
|
|
|
|
2006-12-02 23:47:46 +01:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a major leak when directory authorities parse their
|
|
|
|
|
approved-routers list, a minor memory leak when we fail to pick
|
|
|
|
|
an exit node, and a few rare leaks on errors.
|
2006-11-14 01:06:02 +01:00
|
|
|
- Handle TransPort connections even when the server sends data before
|
2006-12-02 23:47:46 +01:00
|
|
|
the client sends data. Previously, the connection would just hang
|
2006-11-14 01:06:02 +01:00
|
|
|
until the client sent data. (Patch from tup based on patch from
|
|
|
|
|
Zajcev Evgeny.)
|
2006-12-02 23:47:46 +01:00
|
|
|
- Avoid assert failure when our cached-routers file is empty on
|
|
|
|
|
startup.
|
2006-11-14 01:06:02 +01:00
|
|
|
|
2006-12-02 23:47:46 +01:00
|
|
|
o Minor bugfixes:
|
2006-11-01 00:35:50 +01:00
|
|
|
- Don't log spurious warnings when we see a circuit close reason we
|
|
|
|
|
don't recognize; it's probably just from a newer version of Tor.
|
2006-11-02 00:53:15 +01:00
|
|
|
- Have directory authorities allow larger amounts of drift in uptime
|
|
|
|
|
without replacing the server descriptor: previously, a server that
|
2006-11-12 08:09:22 +01:00
|
|
|
restarted every 30 minutes could have 48 "interesting" descriptors
|
|
|
|
|
per day.
|
2006-11-06 07:43:21 +01:00
|
|
|
- Start linking to the Tor specification and Tor reference manual
|
|
|
|
|
correctly in the Windows installer.
|
2006-12-02 23:47:46 +01:00
|
|
|
- Add Vidalia to the OS X uninstaller script, so when we uninstall
|
|
|
|
|
Tor/Privoxy we also uninstall Vidalia.
|
|
|
|
|
- Resume building on Irix64, and fix a lot of warnings from its
|
|
|
|
|
MIPSpro C compiler.
|
|
|
|
|
- Don't corrupt last_guessed_ip in router_new_address_suggestion()
|
|
|
|
|
when we're running as a client.
|
2006-11-06 07:43:21 +01:00
|
|
|
|
2006-10-31 20:17:07 +01:00
|
|
|
|
2007-01-26 07:44:38 +01:00
|
|
|
Changes in version 0.1.1.25 - 2006-11-04
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- When a client asks us to resolve (rather than connect to)
|
|
|
|
|
an address, and we have a cached answer, give them the cached
|
|
|
|
|
answer. Previously, we would give them no answer at all.
|
|
|
|
|
- We were building exactly the wrong circuits when we predict
|
|
|
|
|
hidden service requirements, meaning Tor would have to build all
|
|
|
|
|
its circuits on demand.
|
|
|
|
|
- If none of our live entry guards have a high uptime, but we
|
|
|
|
|
require a guard with a high uptime, try adding a new guard before
|
|
|
|
|
we give up on the requirement. This patch should make long-lived
|
|
|
|
|
connections more stable on average.
|
|
|
|
|
- When testing reachability of our DirPort, don't launch new
|
|
|
|
|
tests when there's already one in progress -- unreachable
|
|
|
|
|
servers were stacking up dozens of testing streams.
|
|
|
|
|
|
|
|
|
|
o Security bugfixes:
|
|
|
|
|
- When the user sends a NEWNYM signal, clear the client-side DNS
|
|
|
|
|
cache too. Otherwise we continue to act on previous information.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Avoid a memory corruption bug when creating a hash table for
|
|
|
|
|
the first time.
|
|
|
|
|
- Avoid possibility of controller-triggered crash when misusing
|
|
|
|
|
certain commands from a v0 controller on platforms that do not
|
|
|
|
|
handle printf("%s",NULL) gracefully.
|
|
|
|
|
- Avoid infinite loop on unexpected controller input.
|
|
|
|
|
- Don't log spurious warnings when we see a circuit close reason we
|
|
|
|
|
don't recognize; it's probably just from a newer version of Tor.
|
|
|
|
|
- Add Vidalia to the OS X uninstaller script, so when we uninstall
|
|
|
|
|
Tor/Privoxy we also uninstall Vidalia.
|
|
|
|
|
|
|
|
|
|
|
2006-10-30 03:55:17 +01:00
|
|
|
Changes in version 0.1.2.3-alpha - 2006-10-29
|
2006-10-12 00:06:01 +02:00
|
|
|
o Minor features:
|
2006-10-30 03:55:17 +01:00
|
|
|
- Prepare for servers to publish descriptors less often: never
|
2006-10-20 01:04:56 +02:00
|
|
|
discard a descriptor simply for being too old until either it is
|
2006-10-29 08:41:25 +01:00
|
|
|
recommended by no authorities, or until we get a better one for
|
|
|
|
|
the same router. Make caches consider retaining old recommended
|
2006-10-20 01:04:56 +02:00
|
|
|
routers for even longer.
|
2006-10-30 03:55:17 +01:00
|
|
|
- If most authorities set a BadExit flag for a server, clients
|
|
|
|
|
don't think of it as a general-purpose exit. Clients only consider
|
|
|
|
|
authorities that advertise themselves as listing bad exits.
|
2006-10-20 01:05:34 +02:00
|
|
|
- Directory servers now provide 'Pragma: no-cache' and 'Expires'
|
|
|
|
|
headers for content, so that we can work better in the presence of
|
|
|
|
|
caching HTTP proxies.
|
2006-10-23 05:48:42 +02:00
|
|
|
- Allow authorities to list nodes as bad exits by fingerprint or by
|
|
|
|
|
address.
|
2006-10-12 00:06:01 +02:00
|
|
|
|
2006-10-09 17:47:27 +02:00
|
|
|
o Minor features, controller:
|
2006-10-09 17:47:50 +02:00
|
|
|
- Add a REASON field to CIRC events; for backward compatibility, this
|
|
|
|
|
field is sent only to controllers that have enabled the extended
|
2006-10-30 03:55:17 +01:00
|
|
|
event format. Also, add additional reason codes to explain why
|
|
|
|
|
a given circuit has been destroyed or truncated. (Patches from
|
|
|
|
|
Mike Perry)
|
2006-10-20 21:11:12 +02:00
|
|
|
- Add a REMOTE_REASON field to extended CIRC events to tell the
|
|
|
|
|
controller about why a remote OR told us to close a circuit.
|
2006-10-30 03:55:17 +01:00
|
|
|
- Stream events also now have REASON and REMOTE_REASON fields,
|
|
|
|
|
working much like those for circuit events.
|
2006-10-20 16:58:29 +02:00
|
|
|
- There's now a GETINFO ns/... field so that controllers can ask Tor
|
2006-10-30 03:55:17 +01:00
|
|
|
about the current status of a router.
|
|
|
|
|
- A new event type "NS" to inform a controller when our opinion of
|
|
|
|
|
a router's status has changed.
|
2006-10-24 04:58:03 +02:00
|
|
|
- Add a GETINFO events/names and GETINFO features/names so controllers
|
|
|
|
|
can tell which events and features are supported.
|
2006-10-25 23:46:21 +02:00
|
|
|
- A new CLEARDNSCACHE signal to allow controllers to clear the
|
|
|
|
|
client-side DNS cache without expiring circuits.
|
2006-10-09 17:47:27 +02:00
|
|
|
|
2006-10-09 23:11:50 +02:00
|
|
|
o Security bugfixes:
|
|
|
|
|
- When the user sends a NEWNYM signal, clear the client-side DNS
|
|
|
|
|
cache too. Otherwise we continue to act on previous information.
|
|
|
|
|
|
2006-10-08 02:33:43 +02:00
|
|
|
o Minor bugfixes:
|
2006-10-30 03:55:17 +01:00
|
|
|
- Avoid sending junk to controllers or segfaulting when a controller
|
|
|
|
|
uses EVENT_NEW_DESC with verbose nicknames.
|
|
|
|
|
- Stop triggering asserts if the controller tries to extend hidden
|
|
|
|
|
service circuits (reported by mwenge).
|
|
|
|
|
- Avoid infinite loop on unexpected controller input.
|
|
|
|
|
- When the controller does a "GETINFO network-status", tell it
|
|
|
|
|
about even those routers whose descriptors are very old, and use
|
|
|
|
|
long nicknames where appropriate.
|
2006-10-08 02:33:43 +02:00
|
|
|
- Change NT service functions to be loaded on demand. This lets us
|
2006-10-29 08:41:25 +01:00
|
|
|
build with MinGW without breaking Tor for Windows 98 users.
|
2006-10-08 09:45:16 +02:00
|
|
|
- Do DirPort reachability tests less often, since a single test
|
|
|
|
|
chews through many circuits before giving up.
|
|
|
|
|
- In the hidden service example in torrc.sample, stop recommending
|
|
|
|
|
esoteric and discouraged hidden service options.
|
2006-10-09 17:46:21 +02:00
|
|
|
- When stopping an NT service, wait up to 10 sec for it to actually
|
|
|
|
|
stop. (Patch from Matt Edman; resolves bug 295.)
|
2006-10-09 20:19:32 +02:00
|
|
|
- Fix handling of verbose nicknames with ORCONN controller events:
|
|
|
|
|
make them show up exactly when requested, rather than exactly when
|
|
|
|
|
not requested.
|
2006-10-09 23:26:34 +02:00
|
|
|
- When reporting verbose nicknames in entry_guards_getinfo(), avoid
|
2006-10-29 08:41:25 +01:00
|
|
|
printing a duplicate "$" in the keys we send (reported by mwenge).
|
|
|
|
|
- Correctly set maximum connection limit on Cygwin. (This time
|
|
|
|
|
for sure!)
|
|
|
|
|
- Try to detect Windows correctly when cross-compiling.
|
|
|
|
|
- Detect the size of the routers file correctly even if it is
|
|
|
|
|
corrupted (on systems without mmap) or not page-aligned (on systems
|
|
|
|
|
with mmap). This bug was harmless.
|
|
|
|
|
- Sometimes we didn't bother sending a RELAY_END cell when an attempt
|
|
|
|
|
to open a stream fails; now we do in more cases. This should
|
|
|
|
|
make clients able to find a good exit faster in some cases, since
|
|
|
|
|
unhandleable requests will now get an error rather than timing out.
|
2006-10-22 10:10:44 +02:00
|
|
|
- Resolve two memory leaks when rebuilding the on-disk router cache
|
|
|
|
|
(reported by fookoowa).
|
2006-10-29 08:41:25 +01:00
|
|
|
- Clean up minor code warnings suggested by the MIPSpro C compiler,
|
|
|
|
|
and reported by some Centos users.
|
2006-10-25 23:39:42 +02:00
|
|
|
- Controller signals now work on non-Unix platforms that don't define
|
|
|
|
|
SIGUSR1 and SIGUSR2 the way we expect.
|
2006-10-30 03:55:17 +01:00
|
|
|
- Patch from Michael Mohr to contrib/cross.sh, so it checks more
|
|
|
|
|
values before failing, and always enables eventdns.
|
2006-10-29 08:41:25 +01:00
|
|
|
- Libevent-1.2 exports, but does not define in its headers, strlcpy.
|
|
|
|
|
Try to fix this in configure.in by checking for most functions
|
|
|
|
|
before we check for libevent.
|
|
|
|
|
|
2006-10-08 02:33:43 +02:00
|
|
|
|
2006-10-07 11:13:30 +02:00
|
|
|
Changes in version 0.1.2.2-alpha - 2006-10-07
|
2006-09-21 23:48:06 +02:00
|
|
|
o Major features:
|
2006-10-06 09:50:57 +02:00
|
|
|
- Make our async eventdns library on-by-default for Tor servers,
|
2006-10-07 11:13:30 +02:00
|
|
|
and plan to deprecate the separate dnsworker threads.
|
2006-09-21 23:48:06 +02:00
|
|
|
- Add server-side support for "reverse" DNS lookups (using PTR
|
2006-10-02 00:11:04 +02:00
|
|
|
records so clients can determine the canonical hostname for a given
|
2006-10-06 09:50:57 +02:00
|
|
|
IPv4 address). Only supported by servers using eventdns; servers
|
|
|
|
|
now announce in their descriptors whether they support eventdns.
|
2006-09-22 02:43:55 +02:00
|
|
|
- Specify and implement client-side SOCKS5 interface for reverse DNS
|
2006-10-07 11:13:30 +02:00
|
|
|
lookups (see doc/socks-extensions.txt).
|
2006-09-29 05:50:11 +02:00
|
|
|
- Add a BEGIN_DIR relay cell type for an easier in-protocol way to
|
2006-10-06 09:50:57 +02:00
|
|
|
connect to directory servers through Tor. Previously, clients needed
|
|
|
|
|
to find Tor exits to make private connections to directory servers.
|
|
|
|
|
- Avoid choosing Exit nodes for entry or middle hops when the
|
|
|
|
|
total bandwidth available from non-Exit nodes is much higher than
|
|
|
|
|
the total bandwidth available from Exit nodes.
|
|
|
|
|
- Workaround for name servers (like Earthlink's) that hijack failing
|
|
|
|
|
DNS requests and replace the no-such-server answer with a "helpful"
|
2006-10-07 11:13:30 +02:00
|
|
|
redirect to an advertising-driven search portal. Also work around
|
|
|
|
|
DNS hijackers who "helpfully" decline to hijack known-invalid
|
|
|
|
|
RFC2606 addresses. Config option "ServerDNSDetectHijacking 0"
|
|
|
|
|
lets you turn it off.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Send out a burst of long-range padding cells once we've established
|
|
|
|
|
that we're reachable. Spread them over 4 circuits, so hopefully
|
|
|
|
|
a few will be fast. This exercises our bandwidth and bootstraps
|
2006-10-07 11:13:30 +02:00
|
|
|
us into the directory more quickly.
|
2006-10-06 09:50:57 +02:00
|
|
|
|
|
|
|
|
o New/improved config options:
|
|
|
|
|
- Add new config option "ResolvConf" to let the server operator
|
2006-10-07 11:13:30 +02:00
|
|
|
choose an alternate resolve.conf file when using eventdns.
|
2006-09-26 00:12:54 +02:00
|
|
|
- Add an "EnforceDistinctSubnets" option to control our "exclude
|
2006-10-07 11:13:30 +02:00
|
|
|
servers on the same /16" behavior. It's still on by default; this
|
2006-09-26 00:12:54 +02:00
|
|
|
is mostly for people who want to operate private test networks with
|
|
|
|
|
all the machines on the same subnet.
|
2006-09-29 01:57:44 +02:00
|
|
|
- If one of our entry guards is on the ExcludeNodes list, or the
|
2006-10-05 10:23:21 +02:00
|
|
|
directory authorities don't think it's a good guard, treat it as
|
|
|
|
|
if it were unlisted: stop using it as a guard, and throw it off
|
|
|
|
|
the guards list if it stays that way for a long time.
|
|
|
|
|
- Allow directory authorities to be marked separately as authorities
|
|
|
|
|
for the v1 directory protocol, the v2 directory protocol, and
|
|
|
|
|
as hidden service directories, to make it easier to retire old
|
2006-10-07 11:13:30 +02:00
|
|
|
authorities. V1 authorities should set "HSAuthoritativeDir 1"
|
2006-10-05 10:23:21 +02:00
|
|
|
to continue being hidden service authorities too.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Remove 8888 as a LongLivedPort, and add 6697 (IRCS).
|
|
|
|
|
|
|
|
|
|
o Minor features, controller:
|
|
|
|
|
- Fix CIRC controller events so that controllers can learn the
|
|
|
|
|
identity digests of non-Named servers used in circuit paths.
|
2006-10-07 11:13:30 +02:00
|
|
|
- Let controllers ask for more useful identifiers for servers. Instead
|
|
|
|
|
of learning identity digests for un-Named servers and nicknames
|
|
|
|
|
for Named servers, the new identifiers include digest, nickname,
|
|
|
|
|
and indication of Named status. Off by default; see control-spec.txt
|
|
|
|
|
for more information.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Add a "getinfo address" controller command so it can display Tor's
|
|
|
|
|
best guess to the user.
|
2006-10-07 11:13:30 +02:00
|
|
|
- New controller event to alert the controller when our server
|
|
|
|
|
descriptor has changed.
|
|
|
|
|
- Give more meaningful errors on controller authentication failure.
|
2006-10-06 09:50:57 +02:00
|
|
|
|
|
|
|
|
o Minor features, other:
|
|
|
|
|
- When asked to resolve a hostname, don't use non-exit servers unless
|
|
|
|
|
requested to do so. This allows servers with broken DNS to be
|
|
|
|
|
useful to the network.
|
|
|
|
|
- Divide eventdns log messages into warn and info messages.
|
2006-10-05 10:23:21 +02:00
|
|
|
- Reserve the nickname "Unnamed" for routers that can't pick
|
2006-10-07 11:13:30 +02:00
|
|
|
a hostname: any router can call itself Unnamed; directory
|
2006-10-05 10:23:21 +02:00
|
|
|
authorities will never allocate Unnamed to any particular router;
|
|
|
|
|
clients won't believe that any router is the canonical Unnamed.
|
2006-10-07 02:50:39 +02:00
|
|
|
- Only include function names in log messages for info/debug messages.
|
|
|
|
|
For notice/warn/err, the content of the message should be clear on
|
2006-10-07 11:13:30 +02:00
|
|
|
its own, and printing the function name only confuses users.
|
2006-10-05 10:23:21 +02:00
|
|
|
- Avoid some false positives during reachability testing: don't try
|
|
|
|
|
to test via a server that's on the same /24 as us.
|
2006-10-06 09:50:57 +02:00
|
|
|
- If we fail to build a circuit to an intended enclave, and it's
|
|
|
|
|
not mandatory that we use that enclave, stop wanting it.
|
2006-10-07 11:13:30 +02:00
|
|
|
- When eventdns is enabled, allow multithreaded builds on NetBSD and
|
|
|
|
|
OpenBSD. (We had previously disabled threads on these platforms
|
2006-10-29 08:41:25 +01:00
|
|
|
because they didn't have working thread-safe resolver functions.)
|
2006-09-21 23:48:22 +02:00
|
|
|
|
2006-10-06 09:50:57 +02:00
|
|
|
o Major bugfixes, anonymity/security:
|
2006-10-05 10:23:21 +02:00
|
|
|
- If a client asked for a server by name, and there's a named server
|
|
|
|
|
in our network-status but we don't have its descriptor yet, we
|
2006-10-07 11:13:30 +02:00
|
|
|
could return an unnamed server instead.
|
2006-09-25 07:59:13 +02:00
|
|
|
- Fix NetBSD bug that could allow someone to force uninitialized RAM
|
|
|
|
|
to be sent to a server's DNS resolver. This only affects NetBSD
|
|
|
|
|
and other platforms that do not bounds-check tolower().
|
2006-10-05 10:23:21 +02:00
|
|
|
- Reject (most) attempts to use Tor circuits with length one. (If
|
|
|
|
|
many people start using Tor as a one-hop proxy, exit nodes become
|
|
|
|
|
a more attractive target for compromise.)
|
2006-10-02 00:16:55 +02:00
|
|
|
- Just because your DirPort is open doesn't mean people should be
|
|
|
|
|
able to remotely teach you about hidden service descriptors. Now
|
|
|
|
|
only accept rendezvous posts if you've got HSAuthoritativeDir set.
|
2006-09-20 01:48:14 +02:00
|
|
|
|
2006-10-06 09:50:57 +02:00
|
|
|
o Major bugfixes, other:
|
2006-10-07 11:13:30 +02:00
|
|
|
- Don't crash on race condition in dns.c: tor_assert(!resolve->expire)
|
2006-09-25 07:59:13 +02:00
|
|
|
- When a client asks the server to resolve (not connect to)
|
|
|
|
|
an address, and it has a cached answer, give them the cached answer.
|
|
|
|
|
Previously, the server would give them no answer at all.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Allow really slow clients to not hang up five minutes into their
|
|
|
|
|
directory downloads (suggested by Adam J. Richter).
|
2006-10-02 00:11:04 +02:00
|
|
|
- We were building exactly the wrong circuits when we anticipated
|
|
|
|
|
hidden service requirements, meaning Tor would have to build all
|
|
|
|
|
its circuits on demand.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Avoid crashing when we mmap a router cache file of size 0.
|
|
|
|
|
- When testing reachability of our DirPort, don't launch new
|
|
|
|
|
tests when there's already one in progress -- unreachable
|
|
|
|
|
servers were stacking up dozens of testing streams.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes, correctness:
|
|
|
|
|
- If we're a directory mirror and we ask for "all" network status
|
|
|
|
|
documents, we would discard status documents from authorities
|
|
|
|
|
we don't recognize.
|
|
|
|
|
- Avoid a memory corruption bug when creating a hash table for
|
|
|
|
|
the first time.
|
|
|
|
|
- Avoid controller-triggered crash when misusing certain commands
|
|
|
|
|
from a v0 controller on platforms that do not handle
|
|
|
|
|
printf("%s",NULL) gracefully.
|
2006-10-07 11:13:30 +02:00
|
|
|
- Don't crash when a controller sends a third argument to an
|
2006-10-06 09:50:57 +02:00
|
|
|
"extendcircuit" request.
|
|
|
|
|
- Controller protocol fixes: fix encoding in "getinfo addr-mappings"
|
|
|
|
|
response; fix error code when "getinfo dir/status/" fails.
|
|
|
|
|
- Avoid crash when telling controller stream-status and a stream
|
|
|
|
|
is detached.
|
2006-10-07 11:13:30 +02:00
|
|
|
- Patch from Adam Langley to fix assert() in eventdns.c.
|
2006-09-21 23:48:11 +02:00
|
|
|
- Fix a debug log message in eventdns to say "X resolved to Y"
|
|
|
|
|
instead of "X resolved to X".
|
2006-10-06 09:50:57 +02:00
|
|
|
- Make eventdns give strings for DNS errors, not just error numbers.
|
|
|
|
|
- Track unreachable entry guards correctly: don't conflate
|
|
|
|
|
'unreachable by us right now' with 'listed as down by the directory
|
|
|
|
|
authorities'. With the old code, if a guard was unreachable by
|
|
|
|
|
us but listed as running, it would clog our guard list forever.
|
|
|
|
|
- Behave correctly in case we ever have a network with more than
|
2006-10-07 11:13:30 +02:00
|
|
|
2GB/s total advertised capacity.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Make TrackExitHosts case-insensitive, and fix the behavior of
|
|
|
|
|
".suffix" TrackExitHosts items to avoid matching in the middle of
|
|
|
|
|
an address.
|
|
|
|
|
- Finally fix the openssl warnings from newer gccs that believe that
|
|
|
|
|
ignoring a return value is okay, but casting a return value and
|
|
|
|
|
then ignoring it is a sign of madness.
|
2006-09-25 07:59:13 +02:00
|
|
|
- Prevent the contrib/exitlist script from printing the same
|
|
|
|
|
result more than once.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Patch from Steve Hildrey: Generate network status correctly on
|
|
|
|
|
non-versioning dirservers.
|
2006-10-07 11:13:30 +02:00
|
|
|
- Don't listen to the X-Your-Address-Is hint if you did the lookup
|
|
|
|
|
via Tor; otherwise you'll think you're the exit node's IP address.
|
2006-10-06 09:50:57 +02:00
|
|
|
|
|
|
|
|
o Minor bugfixes, performance:
|
|
|
|
|
- Two small performance improvements on parsing descriptors.
|
|
|
|
|
- Major performance improvement on inserting descriptors: change
|
|
|
|
|
algorithm from O(n^2) to O(n).
|
|
|
|
|
- Make the common memory allocation path faster on machines where
|
|
|
|
|
malloc(0) returns a pointer.
|
|
|
|
|
- Start remembering X-Your-Address-Is directory hints even if you're
|
|
|
|
|
a client, so you can become a server more smoothly.
|
|
|
|
|
- Avoid duplicate entries on MyFamily line in server descriptor.
|
|
|
|
|
|
|
|
|
|
o Packaging, features:
|
|
|
|
|
- Remove architecture from OS X builds. The official builds are
|
|
|
|
|
now universal binaries.
|
|
|
|
|
- The Debian package now uses --verify-config when (re)starting,
|
|
|
|
|
to distinguish configuration errors from other errors.
|
|
|
|
|
- Update RPMs to require libevent 1.1b.
|
|
|
|
|
|
|
|
|
|
o Packaging, bugfixes:
|
|
|
|
|
- Patches so Tor builds with MinGW on Windows.
|
2006-10-07 11:13:30 +02:00
|
|
|
- Patches so Tor might run on Cygwin again.
|
2006-09-25 07:59:13 +02:00
|
|
|
- Resume building on non-gcc compilers and ancient gcc. Resume
|
|
|
|
|
building with the -O0 compile flag. Resume building cleanly on
|
|
|
|
|
Debian woody.
|
2006-10-07 11:13:30 +02:00
|
|
|
- Run correctly on OS X platforms with case-sensitive filesystems.
|
2006-09-25 07:59:13 +02:00
|
|
|
- Correct includes for net/if.h and net/pfvar.h on OpenBSD (from Tup).
|
2006-10-06 05:39:38 +02:00
|
|
|
- Add autoconf checks so Tor can build on Solaris x86 again.
|
2006-09-20 00:20:09 +02:00
|
|
|
|
2006-09-21 23:48:16 +02:00
|
|
|
o Documentation
|
|
|
|
|
- Documented (and renamed) ServerDNSSearchDomains and
|
|
|
|
|
ServerDNSResolvConfFile options.
|
2006-10-06 09:50:57 +02:00
|
|
|
- Be clearer that the *ListenAddress directives can be repeated
|
|
|
|
|
multiple times.
|
2006-09-21 23:48:16 +02:00
|
|
|
|
2006-09-25 07:59:13 +02:00
|
|
|
|
2007-01-26 07:44:38 +01:00
|
|
|
Changes in version 0.1.1.24 - 2006-09-29
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Allow really slow clients to not hang up five minutes into their
|
|
|
|
|
directory downloads (suggested by Adam J. Richter).
|
|
|
|
|
- Fix major performance regression from 0.1.0.x: instead of checking
|
|
|
|
|
whether we have enough directory information every time we want to
|
|
|
|
|
do something, only check when the directory information has changed.
|
|
|
|
|
This should improve client CPU usage by 25-50%.
|
|
|
|
|
- Don't crash if, after a server has been running for a while,
|
|
|
|
|
it can't resolve its hostname.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Allow Tor to start when RunAsDaemon is set but no logs are set.
|
|
|
|
|
- Don't crash when the controller receives a third argument to an
|
|
|
|
|
"extendcircuit" request.
|
|
|
|
|
- Controller protocol fixes: fix encoding in "getinfo addr-mappings"
|
|
|
|
|
response; fix error code when "getinfo dir/status/" fails.
|
|
|
|
|
- Fix configure.in to not produce broken configure files with
|
|
|
|
|
more recent versions of autoconf. Thanks to Clint for his auto*
|
|
|
|
|
voodoo.
|
|
|
|
|
- Fix security bug on NetBSD that could allow someone to force
|
|
|
|
|
uninitialized RAM to be sent to a server's DNS resolver. This
|
|
|
|
|
only affects NetBSD and other platforms that do not bounds-check
|
|
|
|
|
tolower().
|
|
|
|
|
- Warn user when using libevent 1.1a or earlier with win32 or kqueue
|
|
|
|
|
methods: these are known to be buggy.
|
|
|
|
|
- If we're a directory mirror and we ask for "all" network status
|
|
|
|
|
documents, we would discard status documents from authorities
|
|
|
|
|
we don't recognize.
|
|
|
|
|
|
|
|
|
|
|
2006-08-27 08:55:48 +02:00
|
|
|
Changes in version 0.1.2.1-alpha - 2006-08-27
|
|
|
|
|
o Major features:
|
|
|
|
|
- Add "eventdns" async dns library from Adam Langley, tweaked to
|
2006-08-27 09:26:00 +02:00
|
|
|
build on OSX and Windows. Only enabled if you pass the
|
|
|
|
|
--enable-eventdns argument to configure.
|
2006-08-27 08:55:48 +02:00
|
|
|
- Allow servers with no hostname or IP address to learn their
|
|
|
|
|
IP address by asking the directory authorities. This code only
|
|
|
|
|
kicks in when you would normally have exited with a "no address"
|
|
|
|
|
error. Nothing's authenticated, so use with care.
|
|
|
|
|
- Rather than waiting a fixed amount of time between retrying
|
|
|
|
|
application connections, we wait only 5 seconds for the first,
|
|
|
|
|
10 seconds for the second, and 15 seconds for each retry after
|
|
|
|
|
that. Hopefully this will improve the expected user experience.
|
|
|
|
|
- Patch from Tup to add support for transparent AP connections:
|
|
|
|
|
this basically bundles the functionality of trans-proxy-tor
|
|
|
|
|
into the Tor mainline. Now hosts with compliant pf/netfilter
|
|
|
|
|
implementations can redirect TCP connections straight to Tor
|
|
|
|
|
without diverting through SOCKS. Needs docs.
|
|
|
|
|
- Busy directory servers save lots of memory by spooling server
|
|
|
|
|
descriptors, v1 directories, and v2 networkstatus docs to buffers
|
|
|
|
|
as needed rather than en masse. Also mmap the cached-routers
|
|
|
|
|
files, so we don't need to keep the whole thing in memory too.
|
|
|
|
|
- Automatically avoid picking more than one node from the same
|
|
|
|
|
/16 network when constructing a circuit.
|
|
|
|
|
- Revise and clean up the torrc.sample that we ship with; add
|
|
|
|
|
a section for BandwidthRate and BandwidthBurst.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
2006-08-14 12:16:42 +02:00
|
|
|
- Split circuit_t into origin_circuit_t and or_circuit_t, and
|
|
|
|
|
split connection_t into edge, or, dir, control, and base structs.
|
|
|
|
|
These will save quite a bit of memory on busy servers, and they'll
|
2006-08-27 08:55:48 +02:00
|
|
|
also help us track down bugs in the code and bugs in the spec.
|
|
|
|
|
- Experimentally re-enable kqueue on OSX when using libevent 1.1b
|
|
|
|
|
or later. Log when we are doing this, so we can diagnose it when
|
|
|
|
|
it fails. (Also, recommend libevent 1.1b for kqueue and
|
|
|
|
|
win32 methods; deprecate libevent 1.0b harder; make libevent
|
|
|
|
|
recommendation system saner.)
|
|
|
|
|
- Start being able to build universal binaries on OS X (thanks
|
|
|
|
|
to Phobos).
|
2006-08-14 12:16:42 +02:00
|
|
|
- Export the default exit policy via the control port, so controllers
|
|
|
|
|
don't need to guess what it is / will be later.
|
2006-08-27 08:55:48 +02:00
|
|
|
- Add a man page entry for ProtocolWarnings.
|
|
|
|
|
- Add TestVia config option to the man page.
|
|
|
|
|
- Remove even more protocol-related warnings from Tor server logs,
|
|
|
|
|
such as bad TLS handshakes and malformed begin cells.
|
|
|
|
|
- Stop fetching descriptors if you're not a dir mirror and you
|
|
|
|
|
haven't tried to establish any circuits lately. [This currently
|
|
|
|
|
causes some dangerous behavior, because when you start up again
|
|
|
|
|
you'll use your ancient server descriptors.]
|
|
|
|
|
- New DirPort behavior: if you have your dirport set, you download
|
|
|
|
|
descriptors aggressively like a directory mirror, whether or not
|
|
|
|
|
your ORPort is set.
|
2006-08-14 12:16:42 +02:00
|
|
|
- Get rid of the router_retry_connections notion. Now routers
|
|
|
|
|
no longer try to rebuild long-term connections to directory
|
|
|
|
|
authorities, and directory authorities no longer try to rebuild
|
|
|
|
|
long-term connections to all servers. We still don't hang up
|
|
|
|
|
connections in these two cases though -- we need to look at it
|
|
|
|
|
more carefully to avoid flapping, and we likely need to wait til
|
|
|
|
|
0.1.1.x is obsolete.
|
2006-08-27 08:55:48 +02:00
|
|
|
- Drop compatibility with obsolete Tors that permit create cells
|
|
|
|
|
to have the wrong circ_id_type.
|
|
|
|
|
- Re-enable per-connection rate limiting. Get rid of the "OP
|
|
|
|
|
bandwidth" concept. Lay groundwork for "bandwidth classes" --
|
|
|
|
|
separate global buckets that apply depending on what sort of conn
|
|
|
|
|
it is.
|
2006-08-14 12:16:42 +02:00
|
|
|
- Start publishing one minute or so after we find our ORPort
|
|
|
|
|
to be reachable. This will help reduce the number of descriptors
|
|
|
|
|
we have for ourselves floating around, since it's quite likely
|
|
|
|
|
other things (e.g. DirPort) will change during that minute too.
|
2006-08-27 08:55:48 +02:00
|
|
|
- Fork the v1 directory protocol into its own spec document,
|
2006-08-14 12:16:42 +02:00
|
|
|
and mark dir-spec.txt as the currently correct (v2) spec.
|
|
|
|
|
|
2006-08-27 08:55:48 +02:00
|
|
|
o Major bugfixes:
|
|
|
|
|
- When we find our DirPort to be reachable, publish a new descriptor
|
|
|
|
|
so we'll tell the world (reported by pnx).
|
|
|
|
|
- Publish a new descriptor after we hup/reload. This is important
|
|
|
|
|
if our config has changed such that we'll want to start advertising
|
|
|
|
|
our DirPort now, etc.
|
|
|
|
|
- Allow Tor to start when RunAsDaemon is set but no logs are set.
|
|
|
|
|
- When we have a state file we cannot parse, tell the user and
|
|
|
|
|
move it aside. Now we avoid situations where the user starts
|
|
|
|
|
Tor in 1904, Tor writes a state file with that timestamp in it,
|
|
|
|
|
the user fixes her clock, and Tor refuses to start.
|
|
|
|
|
- Fix configure.in to not produce broken configure files with
|
|
|
|
|
more recent versions of autoconf. Thanks to Clint for his auto*
|
|
|
|
|
voodoo.
|
|
|
|
|
- "tor --verify-config" now exits with -1(255) or 0 depending on
|
|
|
|
|
whether the config options are bad or good.
|
|
|
|
|
- Resolve bug 321 when using dnsworkers: append a period to every
|
|
|
|
|
address we resolve at the exit node, so that we do not accidentally
|
|
|
|
|
pick up local addresses, and so that failing searches are retried
|
|
|
|
|
in the resolver search domains. (This is already solved for
|
|
|
|
|
eventdns.) (This breaks Blossom servers for now.)
|
|
|
|
|
- If we are using an exit enclave and we can't connect, e.g. because
|
|
|
|
|
its webserver is misconfigured to not listen on localhost, then
|
|
|
|
|
back off and try connecting from somewhere else before we fail.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Start compiling on MinGW on Windows (patches from Mike Chiussi).
|
|
|
|
|
- Start compiling on MSVC6 on Windows (patches from Frediano Ziglio).
|
|
|
|
|
- Fix bug 314: Tor clients issued "unsafe socks" warnings even
|
|
|
|
|
when the IP address is mapped through MapAddress to a hostname.
|
|
|
|
|
- Start passing "ipv4" hints to getaddrinfo(), so servers don't do
|
|
|
|
|
useless IPv6 DNS resolves.
|
|
|
|
|
- Patch suggested by Karsten Loesing: respond to SIGNAL command
|
|
|
|
|
before we execute the signal, in case the signal shuts us down.
|
|
|
|
|
- Clean up AllowInvalidNodes man page entry.
|
|
|
|
|
- Claim a commonname of Tor, rather than TOR, in TLS handshakes.
|
|
|
|
|
- Add more asserts to track down an assert error on a windows Tor
|
|
|
|
|
server with connection_add being called with socket == -1.
|
|
|
|
|
- Handle reporting OR_CONN_EVENT_NEW events to the controller.
|
2006-08-14 12:16:42 +02:00
|
|
|
- Fix misleading log messages: an entry guard that is "unlisted",
|
|
|
|
|
as well as not known to be "down" (because we've never heard
|
|
|
|
|
of it), is not therefore "up".
|
|
|
|
|
- Remove code to special-case "-cvs" ending, since it has not
|
|
|
|
|
actually mattered since 0.0.9.
|
2006-08-27 08:55:48 +02:00
|
|
|
- Make our socks5 handling more robust to broken socks clients:
|
|
|
|
|
throw out everything waiting on the buffer in between socks
|
|
|
|
|
handshake phases, since they can't possibly (so the theory
|
|
|
|
|
goes) have predicted what we plan to respond to them.
|
2006-08-14 12:16:42 +02:00
|
|
|
|
2006-06-11 03:41:30 +02:00
|
|
|
|
2006-07-30 07:36:17 +02:00
|
|
|
Changes in version 0.1.1.23 - 2006-07-30
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fast Tor servers, especially exit nodes, were triggering asserts
|
|
|
|
|
due to a bug in handling the list of pending DNS resolves. Some
|
|
|
|
|
bugs still remain here; we're hunting them.
|
|
|
|
|
- Entry guards could crash clients by sending unexpected input.
|
|
|
|
|
- More fixes on reachability testing: if you find yourself reachable,
|
|
|
|
|
then don't ever make any client requests (so you stop predicting
|
|
|
|
|
circuits), then hup or have your clock jump, then later your IP
|
|
|
|
|
changes, you won't think circuits are working, so you won't try to
|
|
|
|
|
test reachability, so you won't publish.
|
|
|
|
|
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Avoid a crash if the controller does a resetconf firewallports
|
|
|
|
|
and then a setconf fascistfirewall=1.
|
|
|
|
|
- Avoid an integer underflow when the dir authority decides whether
|
|
|
|
|
a router is stable: we might wrongly label it stable, and compute
|
|
|
|
|
a slightly wrong median stability, when a descriptor is published
|
|
|
|
|
later than now.
|
|
|
|
|
- Fix a place where we might trigger an assert if we can't build our
|
|
|
|
|
own server descriptor yet.
|
|
|
|
|
|
|
|
|
|
|
2006-07-06 18:19:00 +02:00
|
|
|
Changes in version 0.1.1.22 - 2006-07-05
|
|
|
|
|
o Major bugfixes:
|
|
|
|
|
- Fix a big bug that was causing servers to not find themselves
|
|
|
|
|
reachable if they changed IP addresses. Since only 0.1.1.22+
|
|
|
|
|
servers can do reachability testing correctly, now we automatically
|
|
|
|
|
make sure to test via one of these.
|
|
|
|
|
- Fix to allow clients and mirrors to learn directory info from
|
|
|
|
|
descriptor downloads that get cut off partway through.
|
|
|
|
|
- Directory authorities had a bug in deciding if a newly published
|
|
|
|
|
descriptor was novel enough to make everybody want a copy -- a few
|
|
|
|
|
servers seem to be publishing new descriptors many times a minute.
|
|
|
|
|
o Minor bugfixes:
|
|
|
|
|
- Fix a rare bug that was causing some servers to complain about
|
|
|
|
|
"closing wedged cpuworkers" and skip some circuit create requests.
|
|
|
|
|
- Make the Exit flag in directory status documents actually work.
|
|
|
|
|
|
|
|
|
|
|
2006-06-11 03:42:21 +02:00
|
|
|
Changes in version 0.1.1.21 - 2006-06-10
|
|
|
|
|
o Crash and assert fixes from 0.1.1.20:
|
|
|
|
|
- Fix a rare crash on Tor servers that have enabled hibernation.
|
|
|
|
|
- Fix a seg fault on startup for Tor networks that use only one
|
|
|
|
|
directory authority.
|
|
|
|
|
- Fix an assert from a race condition that occurs on Tor servers
|
|
|
|
|
while exiting, where various threads are trying to log that they're
|
|
|
|
|
exiting, and delete the logs, at the same time.
|
|
|
|
|
- Make our unit tests pass again on certain obscure platforms.
|
|
|
|
|
|
|
|
|
|
o Other fixes:
|
|
|
|
|
- Add support for building SUSE RPM packages.
|
|
|
|
|
- Speed up initial bootstrapping for clients: if we are making our
|
|
|
|
|
first ever connection to any entry guard, then don't mark it down
|
|
|
|
|
right after that.
|
|
|
|
|
- When only one Tor server in the network is labelled as a guard,
|
|
|
|
|
and we've already picked him, we would cycle endlessly picking him
|
|
|
|
|
again, being unhappy about it, etc. Now we specifically exclude
|
|
|
|
|
current guards when picking a new guard.
|
|
|
|
|
- Servers send create cells more reliably after the TLS connection
|
|
|
|
|
is established: we were sometimes forgetting to send half of them
|
|
|
|
|
when we had more than one pending.
|
|
|
|
|
- If we get a create cell that asks us to extend somewhere, but the
|
|
|
|
|
Tor server there doesn't match the expected digest, we now send
|
|
|
|
|
a destroy cell back, rather than silently doing nothing.
|
|
|
|
|
- Make options->RedirectExit work again.
|
|
|
|
|
- Make cookie authentication for the controller work again.
|
|
|
|
|
- Stop being picky about unusual characters in the arguments to
|
|
|
|
|
mapaddress. It's none of our business.
|
|
|
|
|
- Add a new config option "TestVia" that lets you specify preferred
|
|
|
|
|
middle hops to use for test circuits. Perhaps this will let me
|
|
|
|
|
debug the reachability problems better.
|
|
|
|
|
|
|
|
|
|
o Log / documentation fixes:
|
|
|
|
|
- If we're a server and some peer has a broken TLS certificate, don't
|
|
|
|
|
log about it unless ProtocolWarnings is set, i.e., we want to hear
|
|
|
|
|
about protocol violations by others.
|
|
|
|
|
- Fix spelling of VirtualAddrNetwork in man page.
|
|
|
|
|
- Add a better explanation at the top of the autogenerated torrc file
|
|
|
|
|
about what happened to our old torrc.
|
|
|
|
|
|
|
|
|
|
|
2006-05-23 08:20:35 +02:00
|
|
|
Changes in version 0.1.1.20 - 2006-05-23
|
2007-01-26 07:34:48 +01:00
|
|
|
o Bugfixes:
|
|
|
|
|
- Downgrade a log severity where servers complain that they're
|
|
|
|
|
invalid.
|
|
|
|
|
- Avoid a compile warning on FreeBSD.
|
|
|
|
|
- Remove string size limit on NEWDESC messages; solve bug 291.
|
|
|
|
|
- Correct the RunAsDaemon entry in the man page; ignore RunAsDaemon
|
|
|
|
|
more thoroughly when we're running on windows.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.19-rc - 2006-05-03
|
|
|
|
|
o Minor bugs:
|
|
|
|
|
- Regenerate our local descriptor if it's dirty and we try to use
|
|
|
|
|
it locally (e.g. if it changes during reachability detection).
|
|
|
|
|
- If we setconf our ORPort to 0, we continued to listen on the
|
|
|
|
|
old ORPort and receive connections.
|
|
|
|
|
- Avoid a second warning about machine/limits.h on Debian
|
|
|
|
|
GNU/kFreeBSD.
|
|
|
|
|
- Be willing to add our own routerinfo into the routerlist.
|
|
|
|
|
Now authorities will include themselves in their directories
|
|
|
|
|
and network-statuses.
|
|
|
|
|
- Stop trying to upload rendezvous descriptors to every
|
|
|
|
|
directory authority: only try the v1 authorities.
|
|
|
|
|
- Servers no longer complain when they think they're not
|
|
|
|
|
registered with the directory authorities. There were too many
|
|
|
|
|
false positives.
|
|
|
|
|
- Backport dist-rpm changes so rpms can be built without errors.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Features:
|
|
|
|
|
- Implement an option, VirtualAddrMask, to set which addresses
|
|
|
|
|
get handed out in response to mapaddress requests. This works
|
|
|
|
|
around a bug in tsocks where 127.0.0.0/8 is never socksified.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.18-rc - 2006-04-10
|
|
|
|
|
o Major fixes:
|
|
|
|
|
- Work harder to download live network-statuses from all the
|
|
|
|
|
directory authorities we know about. Improve the threshold
|
|
|
|
|
decision logic so we're more robust to edge cases.
|
|
|
|
|
- When fetching rendezvous descriptors, we were willing to ask
|
|
|
|
|
v2 authorities too, which would always return 404.
|
|
|
|
|
|
|
|
|
|
o Minor fixes:
|
|
|
|
|
- Stop listing down or invalid nodes in the v1 directory. This will
|
|
|
|
|
reduce its bulk by about 1/3, and reduce load on directory
|
|
|
|
|
mirrors.
|
|
|
|
|
- When deciding whether a router is Fast or Guard-worthy, consider
|
|
|
|
|
his advertised BandwidthRate and not just the BandwidthCapacity.
|
|
|
|
|
- No longer ship INSTALL and README files -- they are useless now.
|
|
|
|
|
- Force rpmbuild to behave and honor target_cpu.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Avoid warnings about machine/limits.h on Debian GNU/kFreeBSD.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Start to include translated versions of the tor-doc-*.html
|
|
|
|
|
files, along with the screenshots. Still needs more work.
|
|
|
|
|
- Start sending back 512 and 451 errors if mapaddress fails,
|
|
|
|
|
rather than not sending anything back at all.
|
|
|
|
|
- When we fail to bind or listen on an incoming or outgoing
|
|
|
|
|
socket, we should close it before failing. otherwise we just
|
|
|
|
|
leak it. (thanks to weasel for finding.)
|
|
|
|
|
- Allow "getinfo dir/status/foo" to work, as long as your DirPort
|
|
|
|
|
is enabled. (This is a hack, and will be fixed in 0.1.2.x.)
|
|
|
|
|
- Make NoPublish (even though deprecated) work again.
|
|
|
|
|
- Fix a minor security flaw where a versioning auth dirserver
|
|
|
|
|
could list a recommended version many times in a row to make
|
|
|
|
|
clients more convinced that it's recommended.
|
|
|
|
|
- Fix crash bug if there are two unregistered servers running
|
|
|
|
|
with the same nickname, one of them is down, and you ask for
|
|
|
|
|
them by nickname in your EntryNodes or ExitNodes. Also, try
|
|
|
|
|
to pick the one that's running rather than an arbitrary one.
|
|
|
|
|
- Fix an infinite loop we could hit if we go offline for too long.
|
|
|
|
|
- Complain when we hit WSAENOBUFS on recv() or write() too.
|
|
|
|
|
Perhaps this will help us hunt the bug.
|
|
|
|
|
- If you're not a versioning dirserver, don't put the string
|
|
|
|
|
"client-versions \nserver-versions \n" in your network-status.
|
|
|
|
|
- Lower the minimum required number of file descriptors to 1000,
|
|
|
|
|
so we can have some overhead for Valgrind on Linux, where the
|
|
|
|
|
default ulimit -n is 1024.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o New features:
|
|
|
|
|
- Add tor.dizum.com as the fifth authoritative directory server.
|
|
|
|
|
- Add a new config option FetchUselessDescriptors, off by default,
|
|
|
|
|
for when you plan to run "exitlist" on your client and you want
|
|
|
|
|
to know about even the non-running descriptors.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.1.1.17-rc - 2006-03-28
|
|
|
|
|
o Major fixes:
|
|
|
|
|
- Clients and servers since 0.1.1.10-alpha have been expiring
|
|
|
|
|
connections whenever they are idle for 5 minutes and they *do*
|
|
|
|
|
have circuits on them. Oops. With this new version, clients will
|
|
|
|
|
discard their previous entry guard choices and avoid choosing
|
|
|
|
|
entry guards running these flawed versions.
|
|
|
|
|
- Fix memory leak when uncompressing concatenated zlib streams. This
|
|
|
|
|
was causing substantial leaks over time on Tor servers.
|
|
|
|
|
- The v1 directory was including servers as much as 48 hours old,
|
|
|
|
|
because that's how the new routerlist->routers works. Now only
|
|
|
|
|
include them if they're 20 hours old or less.
|
|
|
|
|
|
|
|
|
|
o Minor fixes:
|
|
|
|
|
- Resume building on irix64, netbsd 2.0, etc.
|
|
|
|
|
- On non-gcc compilers (e.g. solaris), use "-g -O" instead of
|
|
|
|
|
"-Wall -g -O2".
|
|
|
|
|
- Stop writing the "router.desc" file, ever. Nothing uses it anymore,
|
|
|
|
|
and it is confusing some users.
|
|
|
|
|
- Mirrors stop caching the v1 directory so often.
|
|
|
|
|
- Make the max number of old descriptors that a cache will hold
|
|
|
|
|
rise with the number of directory authorities, so we can scale.
|
|
|
|
|
- Change our win32 uname() hack to be more forgiving about what
|
|
|
|
|
win32 versions it thinks it's found.
|
|
|
|
|
|
|
|
|
|
o New features:
|
|
|
|
|
- Add lefkada.eecs.harvard.edu as a fourth authoritative directory
|
|
|
|
|
server.
|
|
|
|
|
- When the controller's *setconf commands fail, collect an error
|
|
|
|
|
message in a string and hand it back to the controller.
|
2006-05-23 08:20:35 +02:00
|
|
|
- Make the v2 dir's "Fast" flag based on relative capacity, just
|
|
|
|
|
like "Stable" is based on median uptime. Name everything in the
|
|
|
|
|
top 7/8 Fast, and only the top 1/2 gets to be a Guard.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Log server fingerprint on startup, so new server operators don't
|
|
|
|
|
have to go hunting around their filesystem for it.
|
2006-05-23 08:20:35 +02:00
|
|
|
- Return a robots.txt on our dirport to discourage google indexing.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Let the controller ask for GETINFO dir/status/foo so it can ask
|
|
|
|
|
directly rather than connecting to the dir port. Only works when
|
|
|
|
|
dirport is set for now.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o New config options rather than constants in the code:
|
|
|
|
|
- SocksTimeout: How long do we let a socks connection wait
|
|
|
|
|
unattached before we fail it?
|
|
|
|
|
- CircuitBuildTimeout: Cull non-open circuits that were born
|
|
|
|
|
at least this many seconds ago.
|
|
|
|
|
- CircuitIdleTimeout: Cull open clean circuits that were born
|
|
|
|
|
at least this many seconds ago.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.16-rc - 2006-03-18
|
|
|
|
|
o Bugfixes on 0.1.1.15-rc:
|
|
|
|
|
- Fix assert when the controller asks to attachstream a connect-wait
|
|
|
|
|
or resolve-wait stream.
|
|
|
|
|
- Now do address rewriting when the controller asks us to attach
|
|
|
|
|
to a particular circuit too. This will let Blossom specify
|
|
|
|
|
"moria2.exit" without having to learn what moria2's IP address is.
|
|
|
|
|
- Make the "tor --verify-config" command-line work again, so people
|
|
|
|
|
can automatically check if their torrc will parse.
|
|
|
|
|
- Authoritative dirservers no longer require an open connection from
|
|
|
|
|
a server to consider him "reachable". We need this change because
|
|
|
|
|
when we add new auth dirservers, old servers won't know not to
|
|
|
|
|
hang up on them.
|
|
|
|
|
- Let Tor build on Sun CC again.
|
|
|
|
|
- Fix an off-by-one buffer size in dirserv.c that magically never
|
|
|
|
|
hit our three authorities but broke sjmurdoch's own tor network.
|
|
|
|
|
- If we as a directory mirror don't know of any v1 directory
|
|
|
|
|
authorities, then don't try to cache any v1 directories.
|
|
|
|
|
- Stop warning about unknown servers in our family when they are
|
|
|
|
|
given as hex digests.
|
|
|
|
|
- Stop complaining as quickly to the server operator that he
|
|
|
|
|
hasn't registered his nickname/key binding.
|
|
|
|
|
- Various cleanups so we can add new V2 Auth Dirservers.
|
|
|
|
|
- Change "AllowUnverifiedNodes" to "AllowInvalidNodes", to
|
|
|
|
|
reflect the updated flags in our v2 dir protocol.
|
|
|
|
|
- Resume allowing non-printable characters for exit streams (both
|
|
|
|
|
for connecting and for resolving). Now we tolerate applications
|
|
|
|
|
that don't follow the RFCs. But continue to block malformed names
|
|
|
|
|
at the socks side.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Fix assert bug in close_logs(): when we close and delete logs,
|
|
|
|
|
remove them all from the global "logfiles" list.
|
|
|
|
|
- Fix minor integer overflow in calculating when we expect to use up
|
|
|
|
|
our bandwidth allocation before hibernating.
|
|
|
|
|
- Fix a couple of bugs in OpenSSL detection. Also, deal better when
|
|
|
|
|
there are multiple SSLs installed with different versions.
|
|
|
|
|
- When we try to be a server and Address is not explicitly set and
|
|
|
|
|
our hostname resolves to a private IP address, try to use an
|
|
|
|
|
interface address if it has a public address. Now Windows machines
|
|
|
|
|
that think of themselves as localhost can work by default.
|
|
|
|
|
|
|
|
|
|
o New features:
|
|
|
|
|
- Let the controller ask for GETINFO dir/server/foo so it can ask
|
|
|
|
|
directly rather than connecting to the dir port.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Let the controller tell us about certain router descriptors
|
|
|
|
|
that it doesn't want Tor to use in circuits. Implement
|
2007-01-26 07:34:48 +01:00
|
|
|
SETROUTERPURPOSE and modify +POSTDESCRIPTOR to do this.
|
|
|
|
|
- New config option SafeSocks to reject all application connections
|
|
|
|
|
using unsafe socks protocols. Defaults to off.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.15-rc - 2006-03-11
|
|
|
|
|
o Bugfixes and cleanups:
|
|
|
|
|
- When we're printing strings from the network, don't try to print
|
|
|
|
|
non-printable characters. This protects us against shell escape
|
|
|
|
|
sequence exploits, and also against attacks to fool humans into
|
|
|
|
|
misreading their logs.
|
|
|
|
|
- Fix a bug where Tor would fail to establish any connections if you
|
|
|
|
|
left it off for 24 hours and then started it: we were happy with
|
|
|
|
|
the obsolete network statuses, but they all referred to router
|
|
|
|
|
descriptors that were too old to fetch, so we ended up with no
|
|
|
|
|
valid router descriptors.
|
|
|
|
|
- Fix a seg fault in the controller's "getinfo orconn-status"
|
|
|
|
|
command while listing status on incoming handshaking connections.
|
|
|
|
|
Introduce a status name "NEW" for these connections.
|
|
|
|
|
- If we get a linelist or linelist_s config option from the torrc
|
|
|
|
|
(e.g. ExitPolicy) and it has no value, warn and skip rather than
|
|
|
|
|
silently resetting it to its default.
|
|
|
|
|
- Don't abandon entry guards until they've been down or gone for
|
|
|
|
|
a whole month.
|
|
|
|
|
- Cleaner and quieter log messages.
|
|
|
|
|
|
|
|
|
|
o New features:
|
|
|
|
|
- New controller signal NEWNYM that makes new application requests
|
|
|
|
|
use clean circuits.
|
|
|
|
|
- Add a new circuit purpose 'controller' to let the controller ask
|
|
|
|
|
for a circuit that Tor won't try to use. Extend the EXTENDCIRCUIT
|
|
|
|
|
controller command to let you specify the purpose if you're
|
|
|
|
|
starting a new circuit. Add a new SETCIRCUITPURPOSE controller
|
|
|
|
|
command to let you change a circuit's purpose after it's been
|
|
|
|
|
created.
|
|
|
|
|
- Accept "private:*" in routerdesc exit policies; not generated yet
|
|
|
|
|
because older Tors do not understand it.
|
|
|
|
|
- Add BSD-style contributed startup script "rc.subr" from Peter
|
|
|
|
|
Thoenen.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.14-alpha - 2006-02-20
|
|
|
|
|
o Bugfixes on 0.1.1.x:
|
|
|
|
|
- Don't die if we ask for a stdout or stderr log (even implicitly)
|
|
|
|
|
and we're set to RunAsDaemon -- just warn.
|
|
|
|
|
- We still had a few bugs in the OR connection rotation code that
|
|
|
|
|
caused directory servers to slowly aggregate connections to other
|
|
|
|
|
fast Tor servers. This time for sure!
|
|
|
|
|
- Make log entries on Win32 include the name of the function again.
|
|
|
|
|
- We were treating a pair of exit policies if they were equal even
|
|
|
|
|
if one said accept and the other said reject -- causing us to
|
|
|
|
|
not always publish a new descriptor since we thought nothing
|
|
|
|
|
had changed.
|
|
|
|
|
- Retry pending server downloads as well as pending networkstatus
|
|
|
|
|
downloads when we unexpectedly get a socks request.
|
|
|
|
|
- We were ignoring the IS_FAST flag in the directory status,
|
|
|
|
|
meaning we were willing to pick trivial-bandwidth nodes for "fast"
|
|
|
|
|
connections.
|
|
|
|
|
- If the controller's SAVECONF command fails (e.g. due to file
|
|
|
|
|
permissions), let the controller know that it failed.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- If we're trying to be a Tor server and running Windows 95/98/ME
|
|
|
|
|
as a server, explain that we'll likely crash.
|
|
|
|
|
- When we're a server, a client asks for an old-style directory,
|
|
|
|
|
and our write bucket is empty, don't give it to him. This way
|
|
|
|
|
small servers can continue to serve the directory *sometimes*,
|
|
|
|
|
without getting overloaded.
|
|
|
|
|
- Compress exit policies even more -- look for duplicate lines
|
|
|
|
|
and remove them.
|
|
|
|
|
- Clients now honor the "guard" flag in the router status when
|
|
|
|
|
picking entry guards, rather than looking at is_fast or is_stable.
|
|
|
|
|
- Retain unrecognized lines in $DATADIR/state file, so that we can
|
|
|
|
|
be forward-compatible.
|
|
|
|
|
- Generate 18.0.0.0/8 address policy format in descs when we can;
|
|
|
|
|
warn when the mask is not reducible to a bit-prefix.
|
|
|
|
|
- Let the user set ControlListenAddress in the torrc. This can be
|
|
|
|
|
dangerous, but there are some cases (like a secured LAN) where it
|
|
|
|
|
makes sense.
|
|
|
|
|
- Split ReachableAddresses into ReachableDirAddresses and
|
|
|
|
|
ReachableORAddresses, so we can restrict Dir conns to port 80
|
|
|
|
|
and OR conns to port 443.
|
|
|
|
|
- Now we can target arch and OS in rpm builds (contributed by
|
|
|
|
|
Phobos). Also make the resulting dist-rpm filename match the
|
|
|
|
|
target arch.
|
|
|
|
|
- New config options to help controllers: FetchServerDescriptors
|
|
|
|
|
and FetchHidServDescriptors for whether to fetch server
|
|
|
|
|
info and hidserv info or let the controller do it, and
|
|
|
|
|
PublishServerDescriptor and PublishHidServDescriptors.
|
|
|
|
|
- Also let the controller set the __AllDirActionsPrivate config
|
|
|
|
|
option if you want all directory fetches/publishes to happen via
|
|
|
|
|
Tor (it assumes your controller bootstraps your circuits).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.17 - 2006-02-17
|
|
|
|
|
o Crash bugfixes on 0.1.0.x:
|
|
|
|
|
- When servers with a non-zero DirPort came out of hibernation,
|
|
|
|
|
sometimes they would trigger an assert.
|
|
|
|
|
|
|
|
|
|
o Other important bugfixes:
|
|
|
|
|
- On platforms that don't have getrlimit (like Windows), we were
|
|
|
|
|
artificially constraining ourselves to a max of 1024
|
|
|
|
|
connections. Now just assume that we can handle as many as 15000
|
|
|
|
|
connections. Hopefully this won't cause other problems.
|
|
|
|
|
|
|
|
|
|
o Backported features:
|
|
|
|
|
- When we're a server, a client asks for an old-style directory,
|
|
|
|
|
and our write bucket is empty, don't give it to him. This way
|
|
|
|
|
small servers can continue to serve the directory *sometimes*,
|
|
|
|
|
without getting overloaded.
|
|
|
|
|
- Whenever you get a 503 in response to a directory fetch, try
|
|
|
|
|
once more. This will become important once servers start sending
|
|
|
|
|
503's whenever they feel busy.
|
|
|
|
|
- Fetch a new directory every 120 minutes, not every 40 minutes.
|
|
|
|
|
Now that we have hundreds of thousands of users running the old
|
|
|
|
|
directory algorithm, it's starting to hurt a lot.
|
|
|
|
|
- Bump up the period for forcing a hidden service descriptor upload
|
|
|
|
|
from 20 minutes to 1 hour.
|
|
|
|
|
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.13-alpha - 2006-02-09
|
|
|
|
|
o Crashes in 0.1.1.x:
|
|
|
|
|
- When you tried to setconf ORPort via the controller, Tor would
|
|
|
|
|
crash. So people using TorCP to become a server were sad.
|
|
|
|
|
- Solve (I hope) the stack-smashing bug that we were seeing on fast
|
|
|
|
|
servers. The problem appears to be something do with OpenSSL's
|
|
|
|
|
random number generation, or how we call it, or something. Let me
|
|
|
|
|
know if the crashes continue.
|
|
|
|
|
- Turn crypto hardware acceleration off by default, until we find
|
|
|
|
|
somebody smart who can test it for us. (It appears to produce
|
|
|
|
|
seg faults in at least some cases.)
|
|
|
|
|
- Fix a rare assert error when we've tried all intro points for
|
|
|
|
|
a hidden service and we try fetching the service descriptor again:
|
|
|
|
|
"Assertion conn->state != AP_CONN_STATE_RENDDESC_WAIT failed"
|
|
|
|
|
|
|
|
|
|
o Major fixes:
|
|
|
|
|
- Fix a major load balance bug: we were round-robining in 16 KB
|
2006-05-23 08:20:35 +02:00
|
|
|
chunks, and servers with bandwidthrate of 20 KB, while downloading
|
|
|
|
|
a 600 KB directory, would starve their other connections. Now we
|
|
|
|
|
try to be a bit more fair.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Dir authorities and mirrors were never expiring the newest
|
|
|
|
|
descriptor for each server, causing memory and directory bloat.
|
|
|
|
|
- Fix memory-bloating and connection-bloating bug on servers: We
|
|
|
|
|
were never closing any connection that had ever had a circuit on
|
|
|
|
|
it, because we were checking conn->n_circuits == 0, yet we had a
|
|
|
|
|
bug that let it go negative.
|
|
|
|
|
- Make Tor work using squid as your http proxy again -- squid
|
|
|
|
|
returns an error if you ask for a URL that's too long, and it uses
|
|
|
|
|
a really generic error message. Plus, many people are behind a
|
|
|
|
|
transparent squid so they don't even realize it.
|
|
|
|
|
- On platforms that don't have getrlimit (like Windows), we were
|
|
|
|
|
artificially constraining ourselves to a max of 1024
|
|
|
|
|
connections. Now just assume that we can handle as many as 15000
|
|
|
|
|
connections. Hopefully this won't cause other problems.
|
|
|
|
|
- Add a new config option ExitPolicyRejectPrivate which defaults to
|
|
|
|
|
1. This means all exit policies will begin with rejecting private
|
|
|
|
|
addresses, unless the server operator explicitly turns it off.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
2007-10-19 01:14:42 +02:00
|
|
|
- Clients no longer download descriptors for non-running
|
2007-01-26 07:34:48 +01:00
|
|
|
descriptors.
|
|
|
|
|
- Before we add new directory authorities, we should make it
|
|
|
|
|
clear that only v1 authorities should receive/publish hidden
|
|
|
|
|
service descriptors.
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- As soon as we've fetched some more directory info, immediately
|
|
|
|
|
try to download more server descriptors. This way we don't have
|
|
|
|
|
a 10 second pause during initial bootstrapping.
|
|
|
|
|
- Remove even more loud log messages that the server operator can't
|
|
|
|
|
do anything about.
|
|
|
|
|
- When we're running an obsolete or un-recommended version, make
|
|
|
|
|
the log message more clear about what the problem is and what
|
|
|
|
|
versions *are* still recommended.
|
|
|
|
|
- Provide a more useful warn message when our onion queue gets full:
|
|
|
|
|
the CPU is too slow or the exit policy is too liberal.
|
|
|
|
|
- Don't warn when we receive a 503 from a dirserver/cache -- this
|
|
|
|
|
will pave the way for them being able to refuse if they're busy.
|
|
|
|
|
- When we fail to bind a listener, try to provide a more useful
|
|
|
|
|
log message: e.g., "Is Tor already running?"
|
|
|
|
|
- Adjust tor-spec to parameterize cell and key lengths. Now Ian
|
|
|
|
|
Goldberg can prove things about our handshake protocol more
|
|
|
|
|
easily.
|
|
|
|
|
- MaxConn has been obsolete for a while now. Document the ConnLimit
|
|
|
|
|
config option, which is a *minimum* number of file descriptors
|
|
|
|
|
that must be available else Tor refuses to start.
|
|
|
|
|
- Apply Matt Ghali's --with-syslog-facility patch to ./configure
|
|
|
|
|
if you log to syslog and want something other than LOG_DAEMON.
|
|
|
|
|
- Make dirservers generate a separate "guard" flag to mean,
|
|
|
|
|
"would make a good entry guard". Make clients parse it and vote
|
|
|
|
|
on it. Not used by clients yet.
|
|
|
|
|
- Implement --with-libevent-dir option to ./configure. Also, improve
|
|
|
|
|
search techniques to find libevent, and use those for openssl too.
|
|
|
|
|
- Bump the default bandwidthrate to 3 MB, and burst to 6 MB
|
|
|
|
|
- Only start testing reachability once we've established a
|
|
|
|
|
circuit. This will make startup on dirservers less noisy.
|
|
|
|
|
- Don't try to upload hidden service descriptors until we have
|
|
|
|
|
established a circuit.
|
|
|
|
|
- Fix the controller's "attachstream 0" command to treat conn like
|
|
|
|
|
it just connected, doing address remapping, handling .exit and
|
|
|
|
|
.onion idioms, and so on. Now we're more uniform in making sure
|
|
|
|
|
that the controller hears about new and closing connections.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.12-alpha - 2006-01-11
|
|
|
|
|
o Bugfixes on 0.1.1.x:
|
|
|
|
|
- The fix to close duplicate server connections was closing all
|
|
|
|
|
Tor client connections if they didn't establish a circuit
|
|
|
|
|
quickly enough. Oops.
|
|
|
|
|
- Fix minor memory issue (double-free) that happened on exit.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Tor didn't warn when it failed to open a log file.
|
2006-05-23 08:20:35 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.1.1.11-alpha - 2006-01-10
|
|
|
|
|
o Crashes in 0.1.1.x:
|
|
|
|
|
- Include all the assert/crash fixes from 0.1.0.16.
|
|
|
|
|
- If you start Tor and then quit very quickly, there were some
|
|
|
|
|
races that tried to free things that weren't allocated yet.
|
|
|
|
|
- Fix a rare memory stomp if you're running hidden services.
|
|
|
|
|
- Fix segfault when specifying DirServer in config without nickname.
|
|
|
|
|
- Fix a seg fault when you finish connecting to a server but at
|
|
|
|
|
that moment you dump his server descriptor.
|
|
|
|
|
- Extendcircuit and Attachstream controller commands would
|
|
|
|
|
assert/crash if you don't give them enough arguments.
|
|
|
|
|
- Fix an assert error when we're out of space in the connection_list
|
|
|
|
|
and we try to post a hidden service descriptor (reported by weasel).
|
|
|
|
|
- If you specify a relative torrc path and you set RunAsDaemon in
|
|
|
|
|
your torrc, then it chdir()'s to the new directory. If you HUP,
|
|
|
|
|
it tries to load the new torrc location, fails, and exits.
|
|
|
|
|
The fix: no longer allow a relative path to torrc using -f.
|
|
|
|
|
|
|
|
|
|
o Major features:
|
|
|
|
|
- Implement "entry guards": automatically choose a handful of entry
|
|
|
|
|
nodes and stick with them for all circuits. Only pick new guards
|
|
|
|
|
when the ones you have are unsuitable, and if the old guards
|
|
|
|
|
become suitable again, switch back. This will increase security
|
|
|
|
|
dramatically against certain end-point attacks. The EntryNodes
|
|
|
|
|
config option now provides some hints about which entry guards you
|
|
|
|
|
want to use most; and StrictEntryNodes means to only use those.
|
|
|
|
|
- New directory logic: download by descriptor digest, not by
|
|
|
|
|
fingerprint. Caches try to download all listed digests from
|
|
|
|
|
authorities; clients try to download "best" digests from caches.
|
|
|
|
|
This avoids partitioning and isolating attacks better.
|
|
|
|
|
- Make the "stable" router flag in network-status be the median of
|
|
|
|
|
the uptimes of running valid servers, and make clients pay
|
|
|
|
|
attention to the network-status flags. Thus the cutoff adapts
|
|
|
|
|
to the stability of the network as a whole, making IRC, IM, etc
|
|
|
|
|
connections more reliable.
|
|
|
|
|
|
|
|
|
|
o Major fixes:
|
2006-05-23 08:20:35 +02:00
|
|
|
- Tor servers with dynamic IP addresses were needing to wait 18
|
|
|
|
|
hours before they could start doing reachability testing using
|
|
|
|
|
the new IP address and ports. This is because they were using
|
|
|
|
|
the internal descriptor to learn what to test, yet they were only
|
|
|
|
|
rebuilding the descriptor once they decided they were reachable.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Tor 0.1.1.9 and 0.1.1.10 had a serious bug that caused clients
|
|
|
|
|
to download certain server descriptors, throw them away, and then
|
|
|
|
|
fetch them again after 30 minutes. Now mirrors throw away these
|
|
|
|
|
server descriptors so clients can't get them.
|
|
|
|
|
- We were leaving duplicate connections to other ORs open for a week,
|
|
|
|
|
rather than closing them once we detect a duplicate. This only
|
|
|
|
|
really affected authdirservers, but it affected them a lot.
|
|
|
|
|
- Spread the authdirservers' reachability testing over the entire
|
|
|
|
|
testing interval, so we don't try to do 500 TLS's at once every
|
|
|
|
|
20 minutes.
|
|
|
|
|
|
|
|
|
|
o Minor fixes:
|
|
|
|
|
- If the network is down, and we try to connect to a conn because
|
|
|
|
|
we have a circuit in mind, and we timeout (30 seconds) because the
|
|
|
|
|
network never answers, we were expiring the circuit, but we weren't
|
|
|
|
|
obsoleting the connection or telling the entry_guards functions.
|
|
|
|
|
- Some Tor servers process billions of cells per day. These statistics
|
|
|
|
|
need to be uint64_t's.
|
|
|
|
|
- Check for integer overflows in more places, when adding elements
|
|
|
|
|
to smartlists. This could possibly prevent a buffer overflow
|
|
|
|
|
on malicious huge inputs. I don't see any, but I haven't looked
|
|
|
|
|
carefully.
|
|
|
|
|
- ReachableAddresses kept growing new "reject *:*" lines on every
|
|
|
|
|
setconf/reload.
|
|
|
|
|
- When you "setconf log" via the controller, it should remove all
|
|
|
|
|
logs. We were automatically adding back in a "log notice stdout".
|
2006-05-23 08:20:35 +02:00
|
|
|
- Newly bootstrapped Tor networks couldn't establish hidden service
|
|
|
|
|
circuits until they had nodes with high uptime. Be more tolerant.
|
2007-01-26 07:34:48 +01:00
|
|
|
- We were marking servers down when they could not answer every piece
|
|
|
|
|
of the directory request we sent them. This was far too harsh.
|
|
|
|
|
- Fix the torify (tsocks) config file to not use Tor for localhost
|
|
|
|
|
connections.
|
|
|
|
|
- Directory authorities now go to the proper authority when asking for
|
|
|
|
|
a networkstatus, even when they want a compressed one.
|
|
|
|
|
- Fix a harmless bug that was causing Tor servers to log
|
|
|
|
|
"Got an end because of misc error, but we're not an AP. Closing."
|
|
|
|
|
- Authorities were treating their own descriptor changes as cosmetic,
|
|
|
|
|
meaning the descriptor available in the network-status and the
|
|
|
|
|
descriptor that clients downloaded were different.
|
|
|
|
|
- The OS X installer was adding a symlink for tor_resolve but
|
|
|
|
|
the binary was called tor-resolve (reported by Thomas Hardly).
|
|
|
|
|
- Workaround a problem with some http proxies where they refuse GET
|
|
|
|
|
requests that specify "Content-Length: 0" (reported by Adrian).
|
|
|
|
|
- Fix wrong log message when you add a "HiddenServiceNodes" config
|
|
|
|
|
line without any HiddenServiceDir line (reported by Chris Thomas).
|
|
|
|
|
|
|
|
|
|
o Minor features:
|
|
|
|
|
- Write the TorVersion into the state file so we have a prayer of
|
|
|
|
|
keeping forward and backward compatibility.
|
|
|
|
|
- Revive the FascistFirewall config option rather than eliminating it:
|
|
|
|
|
now it's a synonym for ReachableAddresses *:80,*:443.
|
|
|
|
|
- Clients choose directory servers from the network status lists,
|
|
|
|
|
not from their internal list of router descriptors. Now they can
|
|
|
|
|
go to caches directly rather than needing to go to authorities
|
|
|
|
|
to bootstrap.
|
|
|
|
|
- Directory authorities ignore router descriptors that have only
|
|
|
|
|
cosmetic differences: do this for 0.1.0.x servers now too.
|
|
|
|
|
- Add a new flag to network-status indicating whether the server
|
|
|
|
|
can answer v2 directory requests too.
|
|
|
|
|
- Authdirs now stop whining so loudly about bad descriptors that
|
|
|
|
|
they fetch from other dirservers. So when there's a log complaint,
|
|
|
|
|
it's for sure from a freshly uploaded descriptor.
|
|
|
|
|
- Reduce memory requirements in our structs by changing the order
|
|
|
|
|
of fields.
|
|
|
|
|
- There used to be two ways to specify your listening ports in a
|
|
|
|
|
server descriptor: on the "router" line and with a separate "ports"
|
|
|
|
|
line. Remove support for the "ports" line.
|
|
|
|
|
- New config option "AuthDirRejectUnlisted" for auth dirservers as
|
|
|
|
|
a panic button: if we get flooded with unusable servers we can
|
|
|
|
|
revert to only listing servers in the approved-routers file.
|
|
|
|
|
- Auth dir servers can now mark a fingerprint as "!reject" or
|
|
|
|
|
"!invalid" in the approved-routers file (as its nickname), to
|
|
|
|
|
refuse descriptors outright or include them but marked as invalid.
|
|
|
|
|
- Servers store bandwidth history across restarts/crashes.
|
|
|
|
|
- Add reasons to DESTROY and RELAY_TRUNCATED cells, so clients can
|
|
|
|
|
get a better idea of why their circuits failed. Not used yet.
|
|
|
|
|
- Directory mirrors now cache up to 16 unrecognized network-status
|
|
|
|
|
docs. Now we can add new authdirservers and they'll be cached too.
|
|
|
|
|
- When picking a random directory, prefer non-authorities if any
|
|
|
|
|
are known.
|
|
|
|
|
- New controller option "getinfo desc/all-recent" to fetch the
|
|
|
|
|
latest server descriptor for every router that Tor knows about.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.16 - 2006-01-02
|
|
|
|
|
o Crash bugfixes on 0.1.0.x:
|
|
|
|
|
- On Windows, build with a libevent patch from "I-M Weasel" to avoid
|
|
|
|
|
corrupting the heap, losing FDs, or crashing when we need to resize
|
|
|
|
|
the fd_sets. (This affects the Win32 binaries, not Tor's sources.)
|
|
|
|
|
- It turns out sparc64 platforms crash on unaligned memory access
|
|
|
|
|
too -- so detect and avoid this.
|
|
|
|
|
- Handle truncated compressed data correctly (by detecting it and
|
|
|
|
|
giving an error).
|
|
|
|
|
- Fix possible-but-unlikely free(NULL) in control.c.
|
|
|
|
|
- When we were closing connections, there was a rare case that
|
|
|
|
|
stomped on memory, triggering seg faults and asserts.
|
|
|
|
|
- Avoid potential infinite recursion when building a descriptor. (We
|
|
|
|
|
don't know that it ever happened, but better to fix it anyway.)
|
|
|
|
|
- We were neglecting to unlink marked circuits from soon-to-close OR
|
|
|
|
|
connections, which caused some rare scribbling on freed memory.
|
|
|
|
|
- Fix a memory stomping race bug when closing the joining point of two
|
|
|
|
|
rendezvous circuits.
|
|
|
|
|
- Fix an assert in time parsing found by Steven Murdoch.
|
|
|
|
|
|
|
|
|
|
o Other bugfixes on 0.1.0.x:
|
|
|
|
|
- When we're doing reachability testing, provide more useful log
|
|
|
|
|
messages so the operator knows what to expect.
|
|
|
|
|
- Do not check whether DirPort is reachable when we are suppressing
|
|
|
|
|
advertising it because of hibernation.
|
|
|
|
|
- When building with -static or on Solaris, we sometimes needed -ldl.
|
|
|
|
|
- When we're deciding whether a stream has enough circuits around
|
|
|
|
|
that can handle it, count the freshly dirty ones and not the ones
|
|
|
|
|
that are so dirty they won't be able to handle it.
|
|
|
|
|
- When we're expiring old circuits, we had a logic error that caused
|
|
|
|
|
us to close new rendezvous circuits rather than old ones.
|
|
|
|
|
- Give a more helpful log message when you try to change ORPort via
|
|
|
|
|
the controller: you should upgrade Tor if you want that to work.
|
|
|
|
|
- We were failing to parse Tor versions that start with "Tor ".
|
|
|
|
|
- Tolerate faulty streams better: when a stream fails for reason
|
|
|
|
|
exitpolicy, stop assuming that the router is lying about his exit
|
|
|
|
|
policy. When a stream fails for reason misc, allow it to retry just
|
|
|
|
|
as if it was resolvefailed. When a stream has failed three times,
|
|
|
|
|
reset its failure count so we can try again and get all three tries.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.10-alpha - 2005-12-11
|
|
|
|
|
o Correctness bugfixes on 0.1.0.x:
|
|
|
|
|
- On Windows, build with a libevent patch from "I-M Weasel" to avoid
|
|
|
|
|
corrupting the heap, losing FDs, or crashing when we need to resize
|
|
|
|
|
the fd_sets. (This affects the Win32 binaries, not Tor's sources.)
|
|
|
|
|
- Stop doing the complex voodoo overkill checking for insecure
|
|
|
|
|
Diffie-Hellman keys. Just check if it's in [2,p-2] and be happy.
|
|
|
|
|
- When we were closing connections, there was a rare case that
|
|
|
|
|
stomped on memory, triggering seg faults and asserts.
|
|
|
|
|
- We were neglecting to unlink marked circuits from soon-to-close OR
|
|
|
|
|
connections, which caused some rare scribbling on freed memory.
|
|
|
|
|
- When we're deciding whether a stream has enough circuits around
|
|
|
|
|
that can handle it, count the freshly dirty ones and not the ones
|
|
|
|
|
that are so dirty they won't be able to handle it.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Recover better from TCP connections to Tor servers that are
|
|
|
|
|
broken but don't tell you (it happens!); and rotate TLS
|
|
|
|
|
connections once a week.
|
2007-01-26 07:34:48 +01:00
|
|
|
- When we're expiring old circuits, we had a logic error that caused
|
|
|
|
|
us to close new rendezvous circuits rather than old ones.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Fix a scary-looking but apparently harmless bug where circuits
|
|
|
|
|
would sometimes start out in state CIRCUIT_STATE_OR_WAIT at
|
|
|
|
|
servers, and never switch to state CIRCUIT_STATE_OPEN.
|
2007-01-26 07:34:48 +01:00
|
|
|
- When building with -static or on Solaris, we sometimes needed to
|
|
|
|
|
build with -ldl.
|
|
|
|
|
- Give a useful message when people run Tor as the wrong user,
|
|
|
|
|
rather than telling them to start chowning random directories.
|
|
|
|
|
- We were failing to inform the controller about new .onion streams.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Security bugfixes on 0.1.0.x:
|
|
|
|
|
- Refuse server descriptors if the fingerprint line doesn't match
|
|
|
|
|
the included identity key. Tor doesn't care, but other apps (and
|
|
|
|
|
humans) might actually be trusting the fingerprint line.
|
|
|
|
|
- We used to kill the circuit when we receive a relay command we
|
|
|
|
|
don't recognize. Now we just drop it.
|
|
|
|
|
- Start obeying our firewall options more rigorously:
|
|
|
|
|
. If we can't get to a dirserver directly, try going via Tor.
|
|
|
|
|
. Don't ever try to connect (as a client) to a place our
|
|
|
|
|
firewall options forbid.
|
|
|
|
|
. If we specify a proxy and also firewall options, obey the
|
|
|
|
|
firewall options even when we're using the proxy: some proxies
|
|
|
|
|
can only proxy to certain destinations.
|
|
|
|
|
- Fix a bug found by Lasse Overlier: when we were making internal
|
|
|
|
|
circuits (intended to be cannibalized later for rendezvous and
|
|
|
|
|
introduction circuits), we were picking them so that they had
|
|
|
|
|
useful exit nodes. There was no need for this, and it actually
|
|
|
|
|
aids some statistical attacks.
|
|
|
|
|
- Start treating internal circuits and exit circuits separately.
|
|
|
|
|
It's important to keep them separate because internal circuits
|
|
|
|
|
have their last hops picked like middle hops, rather than like
|
|
|
|
|
exit hops. So exiting on them will break the user's expectations.
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Bugfixes on 0.1.1.x:
|
|
|
|
|
- Take out the mis-feature where we tried to detect IP address
|
|
|
|
|
flapping for people with DynDNS, and chose not to upload a new
|
|
|
|
|
server descriptor sometimes.
|
|
|
|
|
- Try to be compatible with OpenSSL 0.9.6 again.
|
|
|
|
|
- Log fix: when the controller is logging about .onion addresses,
|
|
|
|
|
sometimes it didn't include the ".onion" part of the address.
|
|
|
|
|
- Don't try to modify options->DirServers internally -- if the
|
|
|
|
|
user didn't specify any, just add the default ones directly to
|
|
|
|
|
the trusted dirserver list. This fixes a bug where people running
|
|
|
|
|
controllers would use SETCONF on some totally unrelated config
|
|
|
|
|
option, and Tor would start yelling at them about changing their
|
|
|
|
|
DirServer lines.
|
|
|
|
|
- Let the controller's redirectstream command specify a port, in
|
|
|
|
|
case the controller wants to change that too.
|
|
|
|
|
- When we requested a pile of server descriptors, we sometimes
|
|
|
|
|
accidentally launched a duplicate request for the first one.
|
|
|
|
|
- Bugfix for trackhostexits: write down the fingerprint of the
|
|
|
|
|
chosen exit, not its nickname, because the chosen exit might not
|
|
|
|
|
be verified.
|
|
|
|
|
- When parsing foo.exit, if foo is unknown, and we are leaving
|
|
|
|
|
circuits unattached, set the chosen_exit field and leave the
|
|
|
|
|
address empty. This matters because controllers got confused
|
|
|
|
|
otherwise.
|
|
|
|
|
- Directory authorities no longer try to download server
|
|
|
|
|
descriptors that they know they will reject.
|
|
|
|
|
|
|
|
|
|
o Features and updates:
|
|
|
|
|
- Replace balanced trees with hash tables: this should make stuff
|
|
|
|
|
significantly faster.
|
|
|
|
|
- Resume using the AES counter-mode implementation that we ship,
|
|
|
|
|
rather than OpenSSL's. Ours is significantly faster.
|
|
|
|
|
- Many other CPU and memory improvements.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Add a new config option FastFirstHopPK (on by default) so clients
|
|
|
|
|
do a trivial crypto handshake for their first hop, since TLS has
|
|
|
|
|
already taken care of confidentiality and authentication.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Add a new config option TestSocks so people can see if their
|
2006-05-22 22:00:12 +02:00
|
|
|
applications are using socks4, socks4a, socks5-with-ip, or
|
2007-01-26 07:34:48 +01:00
|
|
|
socks5-with-hostname. This way they don't have to keep mucking
|
2006-05-22 22:00:12 +02:00
|
|
|
with tcpdump and wondering if something got cached somewhere.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Warn when listening on a public address for socks. I suspect a
|
|
|
|
|
lot of people are setting themselves up as open socks proxies,
|
|
|
|
|
and they have no idea that jerks on the Internet are using them,
|
|
|
|
|
since they simply proxy the traffic into the Tor network.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Add "private:*" as an alias in configuration for policies. Now
|
|
|
|
|
you can simplify your exit policy rather than needing to list
|
|
|
|
|
every single internal or nonroutable network space.
|
2007-01-26 07:34:48 +01:00
|
|
|
- Add a new controller event type that allows controllers to get
|
|
|
|
|
all server descriptors that were uploaded to a router in its role
|
|
|
|
|
as authoritative dirserver.
|
|
|
|
|
- Start shipping socks-extensions.txt, tor-doc-unix.html,
|
|
|
|
|
tor-doc-server.html, and stylesheet.css in the tarball.
|
|
|
|
|
- Stop shipping tor-doc.html in the tarball.
|
|
|
|
|
|
2006-05-22 22:00:12 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.9-alpha - 2005-11-15
|
|
|
|
|
o Usability improvements:
|
|
|
|
|
- Start calling it FooListenAddress rather than FooBindAddress,
|
|
|
|
|
since few of our users know what it means to bind an address
|
|
|
|
|
or port.
|
2006-05-22 22:00:12 +02:00
|
|
|
- Reduce clutter in server logs. We're going to try to make
|
|
|
|
|
them actually usable now. New config option ProtocolWarnings that
|
|
|
|
|
lets you hear about how _other Tors_ are breaking the protocol. Off
|
|
|
|
|
by default.
|
|
|
|
|
- Divide log messages into logging domains. Once we put some sort
|
|
|
|
|
of interface on this, it will let people looking at more verbose
|
2007-01-26 07:34:48 +01:00
|
|
|
log levels specify the topics they want to hear more about.
|
|
|
|
|
- Make directory servers return better http 404 error messages
|
|
|
|
|
instead of a generic "Servers unavailable".
|
|
|
|
|
- Check for even more Windows version flags when writing the platform
|
|
|
|
|
string in server descriptors, and note any we don't recognize.
|
|
|
|
|
- Clean up more of the OpenSSL memory when exiting, so we can detect
|
|
|
|
|
memory leaks better.
|
|
|
|
|
- Make directory authorities be non-versioning, non-naming by
|
|
|
|
|
default. Now we can add new directory servers without requiring
|
|
|
|
|
their operators to pay close attention.
|
2006-05-22 22:00:12 +02:00
|
|
|
- When logging via syslog, include the pid whenever we provide
|
|
|
|
|
a log entry. Suggested by Todd Fries.
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Performance improvements:
|
|
|
|
|
- Directory servers now silently throw away new descriptors that
|
|
|
|
|
haven't changed much if the timestamps are similar. We do this to
|
|
|
|
|
tolerate older Tor servers that upload a new descriptor every 15
|
|
|
|
|
minutes. (It seemed like a good idea at the time.)
|
|
|
|
|
- Inline bottleneck smartlist functions; use fast versions by default.
|
|
|
|
|
- Add a "Map from digest to void*" abstraction digestmap_t so we
|
|
|
|
|
can do less hex encoding/decoding. Use it in router_get_by_digest()
|
|
|
|
|
to resolve a performance bottleneck.
|
|
|
|
|
- Allow tor_gzip_uncompress to extract as much as possible from
|
|
|
|
|
truncated compressed data. Try to extract as many
|
|
|
|
|
descriptors as possible from truncated http responses (when
|
|
|
|
|
DIR_PURPOSE_FETCH_ROUTERDESC).
|
|
|
|
|
- Make circ->onionskin a pointer, not a static array. moria2 was using
|
|
|
|
|
125000 circuit_t's after it had been up for a few weeks, which
|
|
|
|
|
translates to 20+ megs of wasted space.
|
|
|
|
|
- The private half of our EDH handshake keys are now chosen out
|
|
|
|
|
of 320 bits, not 1024 bits. (Suggested by Ian Goldberg.)
|
2006-05-23 08:20:35 +02:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Security improvements:
|
|
|
|
|
- Start making directory caches retain old routerinfos, so soon
|
|
|
|
|
clients can start asking by digest of descriptor rather than by
|
|
|
|
|
fingerprint of server.
|
|
|
|
|
- Add half our entropy from RAND_poll in OpenSSL. This knows how
|
|
|
|
|
to use egd (if present), openbsd weirdness (if present), vms/os2
|
|
|
|
|
weirdness (if we ever port there), and more in the future.
|
2006-03-08 07:56:28 +01:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Do round-robin writes of at most 16 kB per write. This might be
|
|
|
|
|
more fair on loaded Tor servers, and it might resolve our Windows
|
|
|
|
|
crash bug. It might also slow things down.
|
|
|
|
|
- Our TLS handshakes were generating a single public/private
|
|
|
|
|
keypair for the TLS context, rather than making a new one for
|
|
|
|
|
each new connections. Oops. (But we were still rotating them
|
|
|
|
|
periodically, so it's not so bad.)
|
|
|
|
|
- When we were cannibalizing a circuit with a particular exit
|
|
|
|
|
node in mind, we weren't checking to see if that exit node was
|
|
|
|
|
already present earlier in the circuit. Oops.
|
|
|
|
|
- When a Tor server's IP changes (e.g. from a dyndns address),
|
|
|
|
|
upload a new descriptor so clients will learn too.
|
|
|
|
|
- Really busy servers were keeping enough circuits open on stable
|
|
|
|
|
connections that they were wrapping around the circuit_id
|
|
|
|
|
space. (It's only two bytes.) This exposed a bug where we would
|
|
|
|
|
feel free to reuse a circuit_id even if it still exists but has
|
|
|
|
|
been marked for close. Try to fix this bug. Some bug remains.
|
|
|
|
|
- If we would close a stream early (e.g. it asks for a .exit that
|
|
|
|
|
we know would refuse it) but the LeaveStreamsUnattached config
|
|
|
|
|
option is set by the controller, then don't close it.
|
2006-03-08 07:56:28 +01:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Bugfixes on 0.1.1.8-alpha:
|
|
|
|
|
- Fix a big pile of memory leaks, some of them serious.
|
|
|
|
|
- Do not try to download a routerdesc if we would immediately reject
|
|
|
|
|
it as obsolete.
|
|
|
|
|
- Resume inserting a newline between all router descriptors when
|
|
|
|
|
generating (old style) signed directories, since our spec says
|
|
|
|
|
we do.
|
|
|
|
|
- When providing content-type application/octet-stream for
|
|
|
|
|
server descriptors using .z, we were leaving out the
|
|
|
|
|
content-encoding header. Oops. (Everything tolerated this just
|
|
|
|
|
fine, but that doesn't mean we need to be part of the problem.)
|
|
|
|
|
- Fix a potential seg fault in getconf and getinfo using version 1
|
|
|
|
|
of the controller protocol.
|
|
|
|
|
- Avoid crash: do not check whether DirPort is reachable when we
|
|
|
|
|
are suppressing it because of hibernation.
|
|
|
|
|
- Make --hash-password not crash on exit.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.8-alpha - 2005-10-07
|
|
|
|
|
o New features (major):
|
|
|
|
|
- Clients don't download or use the directory anymore. Now they
|
|
|
|
|
download and use network-statuses from the trusted dirservers,
|
|
|
|
|
and fetch individual server descriptors as needed from mirrors.
|
|
|
|
|
See dir-spec.txt for all the gory details.
|
|
|
|
|
- Be more conservative about whether to advertise our DirPort.
|
|
|
|
|
The main change is to not advertise if we're running at capacity
|
|
|
|
|
and either a) we could hibernate or b) our capacity is low and
|
|
|
|
|
we're using a default DirPort.
|
|
|
|
|
- Use OpenSSL's AES when OpenSSL has version 0.9.7 or later.
|
2006-03-08 07:56:28 +01:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o New features (minor):
|
|
|
|
|
- Try to be smart about when to retry network-status and
|
|
|
|
|
server-descriptor fetches. Still needs some tuning.
|
|
|
|
|
- Stop parsing, storing, or using running-routers output (but
|
|
|
|
|
mirrors still cache and serve it).
|
|
|
|
|
- Consider a threshold of versioning dirservers (dirservers who have
|
|
|
|
|
an opinion about which Tor versions are still recommended) before
|
|
|
|
|
deciding whether to warn the user that he's obsolete.
|
|
|
|
|
- Dirservers can now reject/invalidate by key and IP, with the
|
|
|
|
|
config options "AuthDirInvalid" and "AuthDirReject". This is
|
|
|
|
|
useful since currently we automatically list servers as running
|
|
|
|
|
and usable even if we know they're jerks.
|
|
|
|
|
- Provide dire warnings to any users who set DirServer; move it out
|
|
|
|
|
of torrc.sample and into torrc.complete.
|
|
|
|
|
- Add MyFamily to torrc.sample in the server section.
|
|
|
|
|
- Add nicknames to the DirServer line, so we can refer to them
|
|
|
|
|
without requiring all our users to memorize their IP addresses.
|
|
|
|
|
- When we get an EOF or a timeout on a directory connection, note
|
|
|
|
|
how many bytes of serverdesc we are dropping. This will help
|
|
|
|
|
us determine whether it is smart to parse incomplete serverdesc
|
|
|
|
|
responses.
|
|
|
|
|
- Add a new function to "change pseudonyms" -- that is, to stop
|
|
|
|
|
using any currently-dirty circuits for new streams, so we don't
|
|
|
|
|
link new actions to old actions. Currently it's only called on
|
|
|
|
|
HUP (or SIGNAL RELOAD).
|
|
|
|
|
- On sighup, if UseHelperNodes changed to 1, use new circuits.
|
|
|
|
|
- Start using RAND_bytes rather than RAND_pseudo_bytes from
|
|
|
|
|
OpenSSL. Also, reseed our entropy every hour, not just at
|
|
|
|
|
startup. And entropy in 512-bit chunks, not 160-bit chunks.
|
|
|
|
|
|
|
|
|
|
o Fixes on 0.1.1.7-alpha:
|
|
|
|
|
- Nobody ever implemented EVENT_ADDRMAP for control protocol
|
|
|
|
|
version 0, so don't let version 0 controllers ask for it.
|
|
|
|
|
- If you requested something with too many newlines via the
|
|
|
|
|
v1 controller protocol, you could crash tor.
|
|
|
|
|
- Fix a number of memory leaks, including some pretty serious ones.
|
|
|
|
|
- Re-enable DirPort testing again, so Tor servers will be willing
|
|
|
|
|
to advertise their DirPort if it's reachable.
|
|
|
|
|
- On TLS handshake, only check the other router's nickname against
|
|
|
|
|
its expected nickname if is_named is set.
|
|
|
|
|
|
|
|
|
|
o Fixes forward-ported from 0.1.0.15:
|
|
|
|
|
- Don't crash when we don't have any spare file descriptors and we
|
|
|
|
|
try to spawn a dns or cpu worker.
|
|
|
|
|
- Make the numbers in read-history and write-history into uint64s,
|
|
|
|
|
so they don't overflow and publish negatives in the descriptor.
|
2006-01-03 06:32:21 +01:00
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
o Fixes on 0.1.0.x:
|
|
|
|
|
- For the OS X package's modified privoxy config file, comment
|
|
|
|
|
out the "logfile" line so we don't log everything passed
|
|
|
|
|
through privoxy.
|
|
|
|
|
- We were whining about using socks4 or socks5-with-local-lookup
|
|
|
|
|
even when it's an IP in the "virtual" range we designed exactly
|
|
|
|
|
for this case.
|
|
|
|
|
- We were leaking some memory every time the client changes IPs.
|
|
|
|
|
- Never call free() on tor_malloc()d memory. This will help us
|
|
|
|
|
use dmalloc to detect memory leaks.
|
|
|
|
|
- Check for named servers when looking them up by nickname;
|
|
|
|
|
warn when we'recalling a non-named server by its nickname;
|
|
|
|
|
don't warn twice about the same name.
|
|
|
|
|
- Try to list MyFamily elements by key, not by nickname, and warn
|
|
|
|
|
if we've not heard of the server.
|
|
|
|
|
- Make windows platform detection (uname equivalent) smarter.
|
|
|
|
|
- It turns out sparc64 doesn't like unaligned access either.
|
2006-01-03 06:32:21 +01:00
|
|
|
|
|
|
|
|
|
2005-10-05 13:21:39 +02:00
|
|
|
Changes in version 0.1.0.15 - 2005-09-23
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Reject ports 465 and 587 (spam targets) in default exit policy.
|
|
|
|
|
- Don't crash when we don't have any spare file descriptors and we
|
|
|
|
|
try to spawn a dns or cpu worker.
|
|
|
|
|
- Get rid of IgnoreVersion undocumented config option, and make us
|
|
|
|
|
only warn, never exit, when we're running an obsolete version.
|
|
|
|
|
- Don't try to print a null string when your server finds itself to
|
|
|
|
|
be unreachable and the Address config option is empty.
|
|
|
|
|
- Make the numbers in read-history and write-history into uint64s,
|
|
|
|
|
so they don't overflow and publish negatives in the descriptor.
|
|
|
|
|
- Fix a minor memory leak in smartlist_string_remove().
|
|
|
|
|
- We were only allowing ourselves to upload a server descriptor at
|
|
|
|
|
most every 20 minutes, even if it changed earlier than that.
|
|
|
|
|
- Clean up log entries that pointed to old URLs.
|
|
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.7-alpha - 2005-09-14
|
|
|
|
|
o Fixes on 0.1.1.6-alpha:
|
|
|
|
|
- Exit servers were crashing when people asked them to make a
|
|
|
|
|
connection to an address not in their exit policy.
|
|
|
|
|
- Looking up a non-existent stream for a v1 control connection would
|
|
|
|
|
cause a segfault.
|
|
|
|
|
- Fix a seg fault if we ask a dirserver for a descriptor by
|
|
|
|
|
fingerprint but he doesn't know about him.
|
|
|
|
|
- SETCONF was appending items to linelists, not clearing them.
|
|
|
|
|
- SETCONF SocksBindAddress killed Tor if it fails to bind. Now back
|
|
|
|
|
out and refuse the setconf if it would fail.
|
|
|
|
|
- Downgrade the dirserver log messages when whining about
|
|
|
|
|
unreachability.
|
|
|
|
|
|
|
|
|
|
o New features:
|
|
|
|
|
- Add Peter Palfrader's check-tor script to tor/contrib/
|
|
|
|
|
It lets you easily check whether a given server (referenced by
|
|
|
|
|
nickname) is reachable by you.
|
|
|
|
|
- Numerous changes to move towards client-side v2 directories. Not
|
|
|
|
|
enabled yet.
|
|
|
|
|
|
|
|
|
|
o Fixes on 0.1.0.x:
|
|
|
|
|
- If the user gave tor an odd number of command-line arguments,
|
|
|
|
|
we were silently ignoring the last one. Now we complain and fail.
|
|
|
|
|
[This wins the oldest-bug prize -- this bug has been present since
|
|
|
|
|
November 2002, as released in Tor 0.0.0.]
|
|
|
|
|
- Do not use unaligned memory access on alpha, mips, or mipsel.
|
|
|
|
|
It *works*, but is very slow, so we treat them as if it doesn't.
|
|
|
|
|
- Retry directory requests if we fail to get an answer we like
|
|
|
|
|
from a given dirserver (we were retrying before, but only if
|
|
|
|
|
we fail to connect).
|
|
|
|
|
- When writing the RecommendedVersions line, sort them first.
|
|
|
|
|
- When the client asked for a rendezvous port that the hidden
|
|
|
|
|
service didn't want to provide, we were sending an IP address
|
|
|
|
|
back along with the end cell. Fortunately, it was zero. But stop
|
|
|
|
|
that anyway.
|
|
|
|
|
- Correct "your server is reachable" log entries to indicate that
|
|
|
|
|
it was self-testing that told us so.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.6-alpha - 2005-09-09
|
|
|
|
|
o Fixes on 0.1.1.5-alpha:
|
|
|
|
|
- We broke fascistfirewall in 0.1.1.5-alpha. Oops.
|
|
|
|
|
- Fix segfault in unit tests in 0.1.1.5-alpha. Oops.
|
|
|
|
|
- Fix bug with tor_memmem finding a match at the end of the string.
|
|
|
|
|
- Make unit tests run without segfaulting.
|
|
|
|
|
- Resolve some solaris x86 compile warnings.
|
|
|
|
|
- Handle duplicate lines in approved-routers files without warning.
|
|
|
|
|
- Fix bug where as soon as a server refused any requests due to his
|
|
|
|
|
exit policy (e.g. when we ask for localhost and he tells us that's
|
|
|
|
|
127.0.0.1 and he won't do it), we decided he wasn't obeying his
|
|
|
|
|
exit policy using him for any exits.
|
|
|
|
|
- Only do openssl hardware accelerator stuff if openssl version is
|
|
|
|
|
at least 0.9.7.
|
|
|
|
|
|
|
|
|
|
o New controller features/fixes:
|
|
|
|
|
- Add a "RESETCONF" command so you can set config options like
|
|
|
|
|
AllowUnverifiedNodes and LongLivedPorts to "". Also, if you give
|
|
|
|
|
a config option in the torrc with no value, then it clears it
|
|
|
|
|
entirely (rather than setting it to its default).
|
|
|
|
|
- Add a "GETINFO config-file" to tell us where torrc is.
|
|
|
|
|
- Avoid sending blank lines when GETINFO replies should be empty.
|
|
|
|
|
- Add a QUIT command for the controller (for using it manually).
|
|
|
|
|
- Fix a bug in SAVECONF that was adding default dirservers and
|
|
|
|
|
other redundant entries to the torrc file.
|
|
|
|
|
|
|
|
|
|
o Start on the new directory design:
|
|
|
|
|
- Generate, publish, cache, serve new network-status format.
|
|
|
|
|
- Publish individual descriptors (by fingerprint, by "all", and by
|
|
|
|
|
"tell me yours").
|
|
|
|
|
- Publish client and server recommended versions separately.
|
|
|
|
|
- Allow tor_gzip_uncompress() to handle multiple concatenated
|
|
|
|
|
compressed strings. Serve compressed groups of router
|
|
|
|
|
descriptors. The compression logic here could be more
|
|
|
|
|
memory-efficient.
|
|
|
|
|
- Distinguish v1 authorities (all currently trusted directories)
|
|
|
|
|
from v2 authorities (all trusted directories).
|
|
|
|
|
- Change DirServers config line to note which dirs are v1 authorities.
|
|
|
|
|
- Add configuration option "V1AuthoritativeDirectory 1" which
|
|
|
|
|
moria1, moria2, and tor26 should set.
|
|
|
|
|
- Remove option when getting directory cache to see whether they
|
|
|
|
|
support running-routers; they all do now. Replace it with one
|
|
|
|
|
to see whether caches support v2 stuff.
|
|
|
|
|
|
|
|
|
|
o New features:
|
|
|
|
|
- Dirservers now do their own external reachability testing of each
|
|
|
|
|
Tor server, and only list them as running if they've been found to
|
|
|
|
|
be reachable. We also send back warnings to the server's logs if
|
|
|
|
|
it uploads a descriptor that we already believe is unreachable.
|
|
|
|
|
- Implement exit enclaves: if we know an IP address for the
|
|
|
|
|
destination, and there's a running Tor server at that address
|
|
|
|
|
which allows exit to the destination, then extend the circuit to
|
|
|
|
|
that exit first. This provides end-to-end encryption and end-to-end
|
|
|
|
|
authentication. Also, if the user wants a .exit address or enclave,
|
|
|
|
|
use 4 hops rather than 3, and cannibalize a general circ for it
|
|
|
|
|
if you can.
|
|
|
|
|
- Permit transitioning from ORPort=0 to ORPort!=0, and back, from the
|
|
|
|
|
controller. Also, rotate dns and cpu workers if the controller
|
|
|
|
|
changes options that will affect them; and initialize the dns
|
|
|
|
|
worker cache tree whether or not we start out as a server.
|
|
|
|
|
- Only upload a new server descriptor when options change, 18
|
|
|
|
|
hours have passed, uptime is reset, or bandwidth changes a lot.
|
|
|
|
|
- Check [X-]Forwarded-For headers in HTTP requests when generating
|
|
|
|
|
log messages. This lets people run dirservers (and caches) behind
|
|
|
|
|
Apache but still know which IP addresses are causing warnings.
|
|
|
|
|
|
|
|
|
|
o Config option changes:
|
|
|
|
|
- Replace (Fascist)Firewall* config options with a new
|
|
|
|
|
ReachableAddresses option that understands address policies.
|
|
|
|
|
For example, "ReachableAddresses *:80,*:443"
|
|
|
|
|
- Get rid of IgnoreVersion undocumented config option, and make us
|
|
|
|
|
only warn, never exit, when we're running an obsolete version.
|
|
|
|
|
- Make MonthlyAccountingStart config option truly obsolete now.
|
|
|
|
|
|
|
|
|
|
o Fixes on 0.1.0.x:
|
|
|
|
|
- Reject ports 465 and 587 in the default exit policy, since
|
|
|
|
|
people have started using them for spam too.
|
|
|
|
|
- It turns out we couldn't bootstrap a network since we added
|
|
|
|
|
reachability detection in 0.1.0.1-rc. Good thing the Tor network
|
|
|
|
|
has never gone down. Add an AssumeReachable config option to let
|
|
|
|
|
servers and dirservers bootstrap. When we're trying to build a
|
|
|
|
|
high-uptime or high-bandwidth circuit but there aren't enough
|
|
|
|
|
suitable servers, try being less picky rather than simply failing.
|
|
|
|
|
- Our logic to decide if the OR we connected to was the right guy
|
|
|
|
|
was brittle and maybe open to a mitm for unverified routers.
|
|
|
|
|
- We weren't cannibalizing circuits correctly for
|
|
|
|
|
CIRCUIT_PURPOSE_C_ESTABLISH_REND and
|
|
|
|
|
CIRCUIT_PURPOSE_S_ESTABLISH_INTRO, so we were being forced to
|
|
|
|
|
build those from scratch. This should make hidden services faster.
|
|
|
|
|
- Predict required circuits better, with an eye toward making hidden
|
|
|
|
|
services faster on the service end.
|
|
|
|
|
- Retry streams if the exit node sends back a 'misc' failure. This
|
|
|
|
|
should result in fewer random failures. Also, after failing
|
|
|
|
|
from resolve failed or misc, reset the num failures, so we give
|
|
|
|
|
it a fair shake next time we try.
|
|
|
|
|
- Clean up the rendezvous warn log msgs, and downgrade some to info.
|
|
|
|
|
- Reduce severity on logs about dns worker spawning and culling.
|
|
|
|
|
- When we're shutting down and we do something like try to post a
|
|
|
|
|
server descriptor or rendezvous descriptor, don't complain that
|
|
|
|
|
we seem to be unreachable. Of course we are, we're shutting down.
|
|
|
|
|
- Add TTLs to RESOLVED, CONNECTED, and END_REASON_EXITPOLICY cells.
|
|
|
|
|
We don't use them yet, but maybe one day our DNS resolver will be
|
|
|
|
|
able to discover them.
|
|
|
|
|
- Make ContactInfo mandatory for authoritative directory servers.
|
|
|
|
|
- Require server descriptors to list IPv4 addresses -- hostnames
|
|
|
|
|
are no longer allowed. This also fixes some potential security
|
|
|
|
|
problems with people providing hostnames as their address and then
|
|
|
|
|
preferentially resolving them to partition users.
|
|
|
|
|
- Change log line for unreachability to explicitly suggest /etc/hosts
|
|
|
|
|
as the culprit. Also make it clearer what IP address and ports we're
|
|
|
|
|
testing for reachability.
|
|
|
|
|
- Put quotes around user-supplied strings when logging so users are
|
|
|
|
|
more likely to realize if they add bad characters (like quotes)
|
|
|
|
|
to the torrc.
|
|
|
|
|
- Let auth dir servers start without specifying an Address config
|
|
|
|
|
option.
|
|
|
|
|
- Make unit tests (and other invocations that aren't the real Tor)
|
|
|
|
|
run without launching listeners, creating subdirectories, and so on.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.1.5-alpha - 2005-08-08
|
|
|
|
|
o Bugfixes included in 0.1.0.14.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- If you write "HiddenServicePort 6667 127.0.0.1 6668" in your
|
|
|
|
|
torrc rather than "HiddenServicePort 6667 127.0.0.1:6668",
|
|
|
|
|
it would silently using ignore the 6668.
|
|
|
|
|
|
|
|
|
|
|
2005-08-07 22:15:32 +02:00
|
|
|
Changes in version 0.1.0.14 - 2005-08-08
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
2006-01-25 13:26:21 +01:00
|
|
|
- Fix the other half of the bug with crypto handshakes
|
|
|
|
|
(CVE-2005-2643).
|
2005-08-07 22:15:32 +02:00
|
|
|
- Fix an assert trigger if you send a 'signal term' via the
|
|
|
|
|
controller when it's listening for 'event info' messages.
|
|
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.4-alpha - 2005-08-04
|
|
|
|
|
o Bugfixes included in 0.1.0.13.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Improve tor_gettimeofday() granularity on windows.
|
|
|
|
|
- Make clients regenerate their keys when their IP address changes.
|
|
|
|
|
- Implement some more GETINFO goodness: expose helper nodes, config
|
|
|
|
|
options, getinfo keys.
|
|
|
|
|
|
|
|
|
|
|
2005-08-05 00:45:54 +02:00
|
|
|
Changes in version 0.1.0.13 - 2005-08-04
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Fix a critical bug in the security of our crypto handshakes.
|
|
|
|
|
- Fix a size_t underflow in smartlist_join_strings2() that made
|
|
|
|
|
it do bad things when you hand it an empty smartlist.
|
|
|
|
|
- Fix Windows installer to ship Tor license (thanks to Aphex for
|
|
|
|
|
pointing out this oversight) and put a link to the doc directory
|
|
|
|
|
in the start menu.
|
2005-08-05 01:05:11 +02:00
|
|
|
- Explicitly set no-unaligned-access for sparc: it turns out the
|
|
|
|
|
new gcc's let you compile broken code, but that doesn't make it
|
|
|
|
|
not-broken.
|
2005-08-05 00:45:54 +02:00
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.3-alpha - 2005-07-23
|
|
|
|
|
o Bugfixes on 0.1.1.2-alpha:
|
|
|
|
|
- Fix a bug in handling the controller's "post descriptor"
|
|
|
|
|
function.
|
|
|
|
|
- Fix several bugs in handling the controller's "extend circuit"
|
|
|
|
|
function.
|
|
|
|
|
- Fix a bug in handling the controller's "stream status" event.
|
|
|
|
|
- Fix an assert failure if we have a controller listening for
|
|
|
|
|
circuit events and we go offline.
|
|
|
|
|
- Re-allow hidden service descriptors to publish 0 intro points.
|
|
|
|
|
- Fix a crash when generating your hidden service descriptor if
|
|
|
|
|
you don't have enough intro points already.
|
|
|
|
|
|
|
|
|
|
o New features on 0.1.1.2-alpha:
|
|
|
|
|
- New controller function "getinfo accounting", to ask how
|
|
|
|
|
many bytes we've used in this time period.
|
|
|
|
|
- Experimental support for helper nodes: a lot of the risk from
|
|
|
|
|
a small static adversary comes because users pick new random
|
|
|
|
|
nodes every time they rebuild a circuit. Now users will try to
|
|
|
|
|
stick to the same small set of entry nodes if they can. Not
|
|
|
|
|
enabled by default yet.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.12:
|
|
|
|
|
- If you're an auth dir server, always publish your dirport,
|
|
|
|
|
even if you haven't yet found yourself to be reachable.
|
|
|
|
|
- Fix a size_t underflow in smartlist_join_strings2() that made
|
|
|
|
|
it do bad things when you hand it an empty smartlist.
|
|
|
|
|
|
|
|
|
|
|
2005-07-18 21:32:35 +02:00
|
|
|
Changes in version 0.1.0.12 - 2005-07-18
|
|
|
|
|
o New directory servers:
|
|
|
|
|
- tor26 has changed IP address.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Fix a possible double-free in tor_gzip_uncompress().
|
|
|
|
|
- When --disable-threads is set, do not search for or link against
|
|
|
|
|
pthreads libraries.
|
|
|
|
|
- Don't trigger an assert if an authoritative directory server
|
|
|
|
|
claims its dirport is 0.
|
|
|
|
|
- Fix bug with removing Tor as an NT service: some people were
|
|
|
|
|
getting "The service did not return an error." Thanks to Matt
|
|
|
|
|
Edman for the fix.
|
|
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.2-alpha - 2005-07-15
|
|
|
|
|
o New directory servers:
|
|
|
|
|
- tor26 has changed IP address.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.x, crashes/leaks:
|
|
|
|
|
- Port the servers-not-obeying-their-exit-policies fix from
|
|
|
|
|
0.1.0.11.
|
|
|
|
|
- Fix an fd leak in start_daemon().
|
|
|
|
|
- On Windows, you can't always reopen a port right after you've
|
|
|
|
|
closed it. So change retry_listeners() to only close and re-open
|
|
|
|
|
ports that have changed.
|
|
|
|
|
- Fix a possible double-free in tor_gzip_uncompress().
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.x, usability:
|
|
|
|
|
- When tor_socketpair() fails in Windows, give a reasonable
|
|
|
|
|
Windows-style errno back.
|
|
|
|
|
- Let people type "tor --install" as well as "tor -install" when
|
|
|
|
|
they
|
|
|
|
|
want to make it an NT service.
|
|
|
|
|
- NT service patch from Matt Edman to improve error messages.
|
|
|
|
|
- When the controller asks for a config option with an abbreviated
|
|
|
|
|
name, give the full name in our response.
|
|
|
|
|
- Correct the man page entry on TrackHostExitsExpire.
|
|
|
|
|
- Looks like we were never delivering deflated (i.e. compressed)
|
|
|
|
|
running-routers lists, even when asked. Oops.
|
|
|
|
|
- When --disable-threads is set, do not search for or link against
|
|
|
|
|
pthreads libraries.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.1.x:
|
|
|
|
|
- Fix a seg fault with autodetecting which controller version is
|
|
|
|
|
being used.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- New hidden service descriptor format: put a version in it, and
|
|
|
|
|
let people specify introduction/rendezvous points that aren't
|
|
|
|
|
in "the directory" (which is subjective anyway).
|
|
|
|
|
- Allow the DEBUG controller event to work again. Mark certain log
|
|
|
|
|
entries as "don't tell this to controllers", so we avoid cycles.
|
|
|
|
|
|
|
|
|
|
|
2005-07-01 04:01:21 +02:00
|
|
|
Changes in version 0.1.0.11 - 2005-06-30
|
|
|
|
|
o Bugfixes on 0.1.0.x:
|
|
|
|
|
- Fix major security bug: servers were disregarding their
|
|
|
|
|
exit policies if clients behaved unexpectedly.
|
|
|
|
|
- Make OS X init script check for missing argument, so we don't
|
|
|
|
|
confuse users who invoke it incorrectly.
|
|
|
|
|
- Fix a seg fault in "tor --hash-password foo".
|
|
|
|
|
- The MAPADDRESS control command was broken.
|
|
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.1.1.1-alpha - 2005-06-29
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Make OS X init script check for missing argument, so we don't
|
|
|
|
|
confuse users who invoke it incorrectly.
|
|
|
|
|
- Fix a seg fault in "tor --hash-password foo".
|
|
|
|
|
- Fix a possible way to DoS dirservers.
|
|
|
|
|
- When we complain that your exit policy implicitly allows local or
|
|
|
|
|
private address spaces, name them explicitly so operators can
|
|
|
|
|
fix it.
|
|
|
|
|
- Make the log message less scary when all the dirservers are
|
|
|
|
|
temporarily unreachable.
|
|
|
|
|
- We were printing the number of idle dns workers incorrectly when
|
|
|
|
|
culling them.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Revised controller protocol (version 1) that uses ascii rather
|
|
|
|
|
than binary. Add supporting libraries in python and java so you
|
|
|
|
|
can use the controller from your applications without caring how
|
|
|
|
|
our protocol works.
|
|
|
|
|
- Spiffy new support for crypto hardware accelerators. Can somebody
|
|
|
|
|
test this?
|
|
|
|
|
|
|
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
Changes in version 0.0.9.10 - 2005-06-16
|
|
|
|
|
o Bugfixes on 0.0.9.x (backported from 0.1.0.10):
|
2005-06-09 06:06:52 +02:00
|
|
|
- Refuse relay cells that claim to have a length larger than the
|
|
|
|
|
maximum allowed. This prevents a potential attack that could read
|
2006-01-25 13:26:21 +01:00
|
|
|
arbitrary memory (e.g. keys) from an exit server's process
|
|
|
|
|
(CVE-2005-2050).
|
2005-05-17 02:55:18 +02:00
|
|
|
|
2005-05-14 08:20:09 +02:00
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
Changes in version 0.1.0.10 - 2005-06-14
|
|
|
|
|
o Allow a few EINVALs from libevent before dying. Warn on kqueue with
|
|
|
|
|
libevent before 1.1a.
|
2005-05-14 08:20:09 +02:00
|
|
|
|
2005-06-09 06:06:52 +02:00
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
Changes in version 0.1.0.9-rc - 2005-06-09
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Reset buf->highwater every time buf_shrink() is called, not just on
|
|
|
|
|
a successful shrink. This was causing significant memory bloat.
|
|
|
|
|
- Fix buffer overflow when checking hashed passwords.
|
|
|
|
|
- Security fix: if seeding the RNG on Win32 fails, quit.
|
|
|
|
|
- Allow seeding the RNG on Win32 even when you're not running as
|
|
|
|
|
Administrator.
|
|
|
|
|
- Disable threading on Solaris too. Something is wonky with it,
|
|
|
|
|
cpuworkers, and reentrant libs.
|
2005-06-13 03:29:35 +02:00
|
|
|
- Reenable the part of the code that tries to flush as soon as an
|
|
|
|
|
OR outbuf has a full TLS record available. Perhaps this will make
|
|
|
|
|
OR outbufs not grow as huge except in rare cases, thus saving lots
|
|
|
|
|
of CPU time plus memory.
|
|
|
|
|
- Reject malformed .onion addresses rather then passing them on as
|
|
|
|
|
normal web requests.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Adapt patch from Adam Langley: fix possible memory leak in
|
|
|
|
|
tor_lookup_hostname().
|
|
|
|
|
- Initialize libevent later in the startup process, so the logs are
|
|
|
|
|
already established by the time we start logging libevent warns.
|
|
|
|
|
- Use correct errno on win32 if libevent fails.
|
|
|
|
|
- Check and warn about known-bad/slow libevent versions.
|
|
|
|
|
- Pay more attention to the ClientOnly config option.
|
|
|
|
|
- Have torctl.in/tor.sh.in check for location of su binary (needed
|
|
|
|
|
on FreeBSD)
|
|
|
|
|
- Correct/add man page entries for LongLivedPorts, ExitPolicy,
|
|
|
|
|
KeepalivePeriod, ClientOnly, NoPublish, HttpProxy, HttpsProxy,
|
|
|
|
|
HttpProxyAuthenticator
|
|
|
|
|
- Stop warning about sigpipes in the logs. We're going to
|
|
|
|
|
pretend that getting these occassionally is normal and fine.
|
|
|
|
|
- Resolve OS X installer bugs: stop claiming to be 0.0.9.2 in
|
|
|
|
|
certain
|
|
|
|
|
installer screens; and don't put stuff into StartupItems unless
|
|
|
|
|
the user asks you to.
|
|
|
|
|
- Require servers that use the default dirservers to have public IP
|
|
|
|
|
addresses. We have too many servers that are configured with private
|
|
|
|
|
IPs and their admins never notice the log entries complaining that
|
|
|
|
|
their descriptors are being rejected.
|
|
|
|
|
- Add OSX uninstall instructions. An actual uninstall script will
|
|
|
|
|
come later.
|
2005-04-27 06:36:32 +02:00
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.1.0.8-rc - 2005-05-23
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- It turns out that kqueue on OS X 10.3.9 was causing kernel
|
|
|
|
|
panics. Disable kqueue on all OS X Tors.
|
|
|
|
|
- Fix RPM: remove duplicate line accidentally added to the rpm
|
|
|
|
|
spec file.
|
|
|
|
|
- Disable threads on openbsd too, since its gethostaddr is not
|
|
|
|
|
reentrant either.
|
|
|
|
|
- Tolerate libevent 0.8 since it still works, even though it's
|
|
|
|
|
ancient.
|
|
|
|
|
- Enable building on Red Hat 9.0 again.
|
|
|
|
|
- Allow the middle hop of the testing circuit to be running any
|
|
|
|
|
version, now that most of them have the bugfix to let them connect
|
|
|
|
|
to unknown servers. This will allow reachability testing to work
|
|
|
|
|
even when 0.0.9.7-0.0.9.9 become obsolete.
|
|
|
|
|
- Handle relay cells with rh.length too large. This prevents
|
|
|
|
|
a potential attack that could read arbitrary memory (maybe even
|
|
|
|
|
keys) from the exit server's process.
|
|
|
|
|
- We screwed up the dirport reachability testing when we don't yet
|
|
|
|
|
have a cached version of the directory. Hopefully now fixed.
|
|
|
|
|
- Clean up router_load_single_router() (used by the controller),
|
|
|
|
|
so it doesn't seg fault on error.
|
|
|
|
|
- Fix a minor memory leak when somebody establishes an introduction
|
|
|
|
|
point at your Tor server.
|
|
|
|
|
- If a socks connection ends because read fails, don't warn that
|
|
|
|
|
you're not sending a socks reply back.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Add HttpProxyAuthenticator config option too, that works like
|
|
|
|
|
the HttpsProxyAuthenticator config option.
|
2005-06-09 06:06:52 +02:00
|
|
|
- Encode hashed controller passwords in hex instead of base64,
|
|
|
|
|
to make it easier to write controllers.
|
|
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.1.0.7-rc - 2005-05-17
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fix a bug in the OS X package installer that prevented it from
|
|
|
|
|
installing on Tiger.
|
|
|
|
|
- Fix a script bug in the OS X package installer that made it
|
|
|
|
|
complain during installation.
|
|
|
|
|
- Find libevent even if it's hiding in /usr/local/ and your
|
|
|
|
|
CFLAGS and LDFLAGS don't tell you to look there.
|
|
|
|
|
- Be able to link with libevent as a shared library (the default
|
|
|
|
|
after 1.0d), even if it's hiding in /usr/local/lib and even
|
|
|
|
|
if you haven't added /usr/local/lib to your /etc/ld.so.conf,
|
|
|
|
|
assuming you're running gcc. Otherwise fail and give a useful
|
|
|
|
|
error message.
|
|
|
|
|
- Fix a bug in the RPM packager: set home directory for _tor to
|
|
|
|
|
something more reasonable when first installing.
|
|
|
|
|
- Free a minor amount of memory that is still reachable on exit.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.6-rc - 2005-05-14
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Implement --disable-threads configure option. Disable threads on
|
|
|
|
|
netbsd by default, because it appears to have no reentrant resolver
|
|
|
|
|
functions.
|
|
|
|
|
- Apple's OS X 10.4.0 ships with a broken kqueue. The new libevent
|
|
|
|
|
release (1.1) detects and disables kqueue if it's broken.
|
|
|
|
|
- Append default exit policy before checking for implicit internal
|
|
|
|
|
addresses. Now we don't log a bunch of complaints on startup
|
|
|
|
|
when using the default exit policy.
|
2005-06-09 06:06:52 +02:00
|
|
|
- Some people were putting "Address " in their torrc, and they had
|
|
|
|
|
a buggy resolver that resolved " " to 0.0.0.0. Oops.
|
|
|
|
|
- If DataDir is ~/.tor, and that expands to /.tor, then default to
|
|
|
|
|
LOCALSTATEDIR/tor instead.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Fix fragmented-message bug in TorControl.py.
|
|
|
|
|
- Resolve a minor bug which would prevent unreachable dirports
|
|
|
|
|
from getting suppressed in the published descriptor.
|
|
|
|
|
- When the controller gave us a new descriptor, we weren't resolving
|
|
|
|
|
it immediately, so Tor would think its address was 0.0.0.0 until
|
|
|
|
|
we fetched a new directory.
|
|
|
|
|
- Fix an uppercase/lowercase case error in suppressing a bogus
|
|
|
|
|
libevent warning on some Linuxes.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Begin scrubbing sensitive strings from logs by default. Turn off
|
|
|
|
|
the config option SafeLogging if you need to do debugging.
|
|
|
|
|
- Switch to a new buffer management algorithm, which tries to avoid
|
|
|
|
|
reallocing and copying quite as much. In first tests it looks like
|
|
|
|
|
it uses *more* memory on average, but less cpu.
|
|
|
|
|
- First cut at support for "create-fast" cells. Clients can use
|
|
|
|
|
these when extending to their first hop, since the TLS already
|
|
|
|
|
provides forward secrecy and authentication. Not enabled on
|
|
|
|
|
clients yet.
|
|
|
|
|
- When dirservers refuse a router descriptor, we now log its
|
|
|
|
|
contactinfo, platform, and the poster's IP address.
|
|
|
|
|
- Call tor_free_all instead of connections_free_all after forking, to
|
|
|
|
|
save memory on systems that need to fork.
|
|
|
|
|
- Whine at you if you're a server and you don't set your contactinfo.
|
2005-06-09 06:06:52 +02:00
|
|
|
- Implement --verify-config command-line option to check if your torrc
|
|
|
|
|
is valid without actually launching Tor.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Rewrite address "serifos.exit" to "localhost.serifos.exit"
|
|
|
|
|
rather than just rejecting it.
|
2005-04-23 20:31:00 +02:00
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.1.0.5-rc - 2005-04-27
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Stop trying to print a null pointer if an OR conn fails because
|
|
|
|
|
we didn't like its cert.
|
|
|
|
|
o Features:
|
|
|
|
|
- Switch our internal buffers implementation to use a ring buffer,
|
|
|
|
|
to hopefully improve performance for fast servers a lot.
|
|
|
|
|
- Add HttpsProxyAuthenticator support (basic auth only), based
|
|
|
|
|
on patch from Adam Langley.
|
|
|
|
|
- Bump the default BandwidthRate from 1 MB to 2 MB, to accommodate
|
|
|
|
|
the fast servers that have been joining lately.
|
|
|
|
|
- Give hidden service accesses extra time on the first attempt,
|
|
|
|
|
since 60 seconds is often only barely enough. This might improve
|
|
|
|
|
robustness more.
|
|
|
|
|
- Improve performance for dirservers: stop re-parsing the whole
|
|
|
|
|
directory every time you regenerate it.
|
|
|
|
|
- Add more debugging info to help us find the weird dns freebsd
|
|
|
|
|
pthreads bug; cleaner debug messages to help track future issues.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9.9 - 2005-04-23
|
|
|
|
|
o Bugfixes on 0.0.9.x:
|
|
|
|
|
- If unofficial Tor clients connect and send weird TLS certs, our
|
|
|
|
|
Tor server triggers an assert. This release contains a minimal
|
|
|
|
|
backport from the broader fix that we put into 0.1.0.4-rc.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.4-rc - 2005-04-23
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- If unofficial Tor clients connect and send weird TLS certs, our
|
|
|
|
|
Tor server triggers an assert. Stop asserting, and start handling
|
|
|
|
|
TLS errors better in other situations too.
|
|
|
|
|
- When the controller asks us to tell it about all the debug-level
|
|
|
|
|
logs, it turns out we were generating debug-level logs while
|
|
|
|
|
telling it about them, which turns into a bad loop. Now keep
|
|
|
|
|
track of whether you're sending a debug log to the controller,
|
|
|
|
|
and don't log when you are.
|
|
|
|
|
- Fix the "postdescriptor" feature of the controller interface: on
|
|
|
|
|
non-complete success, only say "done" once.
|
|
|
|
|
o Features:
|
|
|
|
|
- Clients are now willing to load balance over up to 2mB, not 1mB,
|
|
|
|
|
of advertised bandwidth capacity.
|
|
|
|
|
- Add a NoPublish config option, so you can be a server (e.g. for
|
|
|
|
|
testing running Tor servers in other Tor networks) without
|
|
|
|
|
publishing your descriptor to the primary dirservers.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.3-rc - 2005-04-08
|
|
|
|
|
o Improvements on 0.1.0.2-rc:
|
|
|
|
|
- Client now retries when streams end early for 'hibernating' or
|
|
|
|
|
'resource limit' reasons, rather than failing them.
|
|
|
|
|
- More automated handling for dirserver operators:
|
|
|
|
|
- Automatically approve nodes running 0.1.0.2-rc or later,
|
|
|
|
|
now that the the reachability detection stuff is working.
|
|
|
|
|
- Now we allow two unverified servers with the same nickname
|
|
|
|
|
but different keys. But if a nickname is verified, only that
|
|
|
|
|
nickname+key are allowed.
|
|
|
|
|
- If you're an authdirserver connecting to an address:port,
|
|
|
|
|
and it's not the OR you were expecting, forget about that
|
|
|
|
|
descriptor. If he *was* the one you were expecting, then forget
|
|
|
|
|
about all other descriptors for that address:port.
|
|
|
|
|
- Allow servers to publish descriptors from 12 hours in the future.
|
|
|
|
|
Corollary: only whine about clock skew from the dirserver if
|
|
|
|
|
he's a trusted dirserver (since now even verified servers could
|
|
|
|
|
have quite wrong clocks).
|
|
|
|
|
- Adjust maximum skew and age for rendezvous descriptors: let skew
|
|
|
|
|
be 48 hours rather than 90 minutes.
|
|
|
|
|
- Efficiency improvements:
|
|
|
|
|
- Keep a big splay tree of (circid,orconn)->circuit mappings to make
|
|
|
|
|
it much faster to look up a circuit for each relay cell.
|
|
|
|
|
- Remove most calls to assert_all_pending_dns_resolves_ok(),
|
|
|
|
|
since they're eating our cpu on exit nodes.
|
|
|
|
|
- Stop wasting time doing a case insensitive comparison for every
|
|
|
|
|
dns name every time we do any lookup. Canonicalize the names to
|
|
|
|
|
lowercase and be done with it.
|
|
|
|
|
- Start sending 'truncated' cells back rather than destroy cells,
|
|
|
|
|
if the circuit closes in front of you. This means we won't have
|
|
|
|
|
to abandon partially built circuits.
|
|
|
|
|
- Only warn once per nickname from add_nickname_list_to_smartlist
|
2005-04-08 08:16:38 +02:00
|
|
|
per failure, so an entrynode or exitnode choice that's down won't
|
|
|
|
|
yell so much.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Put a note in the torrc about abuse potential with the default
|
|
|
|
|
exit policy.
|
|
|
|
|
- Revise control spec and implementation to allow all log messages to
|
|
|
|
|
be sent to controller with their severities intact (suggested by
|
|
|
|
|
Matt Edman). Update TorControl to handle new log event types.
|
|
|
|
|
- Provide better explanation messages when controller's POSTDESCRIPTOR
|
|
|
|
|
fails.
|
|
|
|
|
- Stop putting nodename in the Platform string in server descriptors.
|
|
|
|
|
It doesn't actually help, and it is confusing/upsetting some people.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.1.0.2-rc:
|
|
|
|
|
- We were printing the host mask wrong in exit policies in server
|
|
|
|
|
descriptors. This isn't a critical bug though, since we were still
|
|
|
|
|
obeying the exit policy internally.
|
|
|
|
|
- Fix Tor when compiled with libevent but without pthreads: move
|
|
|
|
|
connection_unregister() from _connection_free() to
|
|
|
|
|
connection_free().
|
|
|
|
|
- Fix an assert trigger (already fixed in 0.0.9.x): when we have
|
|
|
|
|
the rare mysterious case of accepting a conn on 0.0.0.0:0, then
|
|
|
|
|
when we look through the connection array, we'll find any of the
|
|
|
|
|
cpu/dnsworkers. This is no good.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9.8:
|
|
|
|
|
- Fix possible bug on threading platforms (e.g. win32) which was
|
|
|
|
|
leaking a file descriptor whenever a cpuworker or dnsworker died.
|
|
|
|
|
- When using preferred entry or exit nodes, ignore whether the
|
|
|
|
|
circuit wants uptime or capacity. They asked for the nodes, they
|
|
|
|
|
get the nodes.
|
|
|
|
|
- chdir() to your datadirectory at the *end* of the daemonize process,
|
|
|
|
|
not the beginning. This was a problem because the first time you
|
|
|
|
|
run tor, if your datadir isn't there, and you have runasdaemon set
|
|
|
|
|
to 1, it will try to chdir to it before it tries to create it. Oops.
|
|
|
|
|
- Handle changed router status correctly when dirserver reloads
|
|
|
|
|
fingerprint file. We used to be dropping all unverified descriptors
|
|
|
|
|
right then. The bug was hidden because we would immediately
|
|
|
|
|
fetch a directory from another dirserver, which would include the
|
|
|
|
|
descriptors we just dropped.
|
2005-04-08 08:16:38 +02:00
|
|
|
- When we're connecting to an OR and he's got a different nickname/key
|
|
|
|
|
than we were expecting, only complain loudly if we're an OP or a
|
|
|
|
|
dirserver. Complaining loudly to the OR admins just confuses them.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Tie MAX_DIR_SIZE to MAX_BUF_SIZE, so now directory sizes won't get
|
|
|
|
|
artificially capped at 500kB.
|
2005-04-01 18:29:52 +02:00
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.0.9.8 - 2005-04-07
|
|
|
|
|
o Bugfixes on 0.0.9.x:
|
|
|
|
|
- We have a bug that I haven't found yet. Sometimes, very rarely,
|
|
|
|
|
cpuworkers get stuck in the 'busy' state, even though the cpuworker
|
|
|
|
|
thinks of itself as idle. This meant that no new circuits ever got
|
|
|
|
|
established. Here's a workaround to kill any cpuworker that's been
|
|
|
|
|
busy for more than 100 seconds.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.2-rc - 2005-04-01
|
|
|
|
|
o Bugfixes on 0.1.0.1-rc:
|
|
|
|
|
- Fixes on reachability detection:
|
|
|
|
|
- Don't check for reachability while hibernating.
|
|
|
|
|
- If ORPort is reachable but DirPort isn't, still publish the
|
|
|
|
|
descriptor, but zero out DirPort until it's found reachable.
|
|
|
|
|
- When building testing circs for ORPort testing, use only
|
|
|
|
|
high-bandwidth nodes, so fewer circuits fail.
|
|
|
|
|
- Complain about unreachable ORPort separately from unreachable
|
|
|
|
|
DirPort, so the user knows what's going on.
|
|
|
|
|
- Make sure we only conclude ORPort reachability if we didn't
|
|
|
|
|
initiate the conn. Otherwise we could falsely conclude that
|
|
|
|
|
we're reachable just because we connected to the guy earlier
|
|
|
|
|
and he used that same pipe to extend to us.
|
|
|
|
|
- Authdirservers shouldn't do ORPort reachability detection,
|
|
|
|
|
since they're in clique mode, so it will be rare to find a
|
|
|
|
|
server not already connected to them.
|
|
|
|
|
- When building testing circuits, always pick middle hops running
|
|
|
|
|
Tor 0.0.9.7, so we avoid the "can't extend to unknown routers"
|
|
|
|
|
bug. (This is a kludge; it will go away when 0.0.9.x becomes
|
|
|
|
|
obsolete.)
|
|
|
|
|
- When we decide we're reachable, actually publish our descriptor
|
|
|
|
|
right then.
|
|
|
|
|
- Fix bug in redirectstream in the controller.
|
|
|
|
|
- Fix the state descriptor strings so logs don't claim edge streams
|
|
|
|
|
are in a different state than they actually are.
|
|
|
|
|
- Use recent libevent features when possible (this only really affects
|
|
|
|
|
win32 and osx right now, because the new libevent with these
|
|
|
|
|
features hasn't been released yet). Add code to suppress spurious
|
|
|
|
|
libevent log msgs.
|
|
|
|
|
- Prevent possible segfault in connection_close_unattached_ap().
|
|
|
|
|
- Fix newlines on torrc in win32.
|
|
|
|
|
- Improve error msgs when tor-resolve fails.
|
|
|
|
|
|
|
|
|
|
o Improvements on 0.0.9.x:
|
2005-04-01 18:29:52 +02:00
|
|
|
- New experimental script tor/contrib/ExerciseServer.py (needs more
|
|
|
|
|
work) that uses the controller interface to build circuits and
|
|
|
|
|
fetch pages over them. This will help us bootstrap servers that
|
|
|
|
|
have lots of capacity but haven't noticed it yet.
|
|
|
|
|
- New experimental script tor/contrib/PathDemo.py (needs more work)
|
|
|
|
|
that uses the controller interface to let you choose whole paths
|
|
|
|
|
via addresses like
|
|
|
|
|
"<hostname>.<path,separated by dots>.<length of path>.path"
|
2007-01-26 03:08:53 +01:00
|
|
|
- When we've connected to an OR and handshaked but didn't like
|
|
|
|
|
the result, we were closing the conn without sending destroy
|
|
|
|
|
cells back for pending circuits. Now send those destroys.
|
2005-03-26 01:46:02 +01:00
|
|
|
|
2005-06-09 06:06:52 +02:00
|
|
|
|
2007-01-26 03:08:53 +01:00
|
|
|
Changes in version 0.0.9.7 - 2005-04-01
|
|
|
|
|
o Bugfixes on 0.0.9.x:
|
|
|
|
|
- Fix another race crash bug (thanks to Glenn Fink for reporting).
|
|
|
|
|
- Compare identity to identity, not to nickname, when extending to
|
|
|
|
|
a router not already in the directory. This was preventing us from
|
|
|
|
|
extending to unknown routers. Oops.
|
|
|
|
|
- Make sure to create OS X Tor user in <500 range, so we aren't
|
|
|
|
|
creating actual system users.
|
|
|
|
|
- Note where connection-that-hasn't-sent-end was marked, and fix
|
|
|
|
|
a few really loud instances of this harmless bug (it's fixed more
|
|
|
|
|
in 0.1.0.x).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.1.0.1-rc - 2005-03-28
|
|
|
|
|
o New features:
|
|
|
|
|
- Add reachability testing. Your Tor server will automatically try
|
|
|
|
|
to see if its ORPort and DirPort are reachable from the outside,
|
|
|
|
|
and it won't upload its descriptor until it decides they are.
|
|
|
|
|
- Handle unavailable hidden services better. Handle slow or busy
|
|
|
|
|
hidden services better.
|
|
|
|
|
- Add support for CONNECTing through https proxies, with "HttpsProxy"
|
|
|
|
|
config option.
|
|
|
|
|
- New exit policy: accept most low-numbered ports, rather than
|
|
|
|
|
rejecting most low-numbered ports.
|
|
|
|
|
- More Tor controller support (still experimental). See
|
|
|
|
|
http://tor.eff.org/doc/control-spec.txt for all the new features,
|
|
|
|
|
including signals to emulate unix signals from any platform;
|
|
|
|
|
redirectstream; extendcircuit; mapaddress; getinfo; postdescriptor;
|
|
|
|
|
closestream; closecircuit; etc.
|
|
|
|
|
- Make nt services work and start on startup on win32 (based on
|
|
|
|
|
patch by Matt Edman).
|
|
|
|
|
- Add a new AddressMap config directive to rewrite incoming socks
|
|
|
|
|
addresses. This lets you, for example, declare an implicit
|
|
|
|
|
required exit node for certain sites.
|
|
|
|
|
- Add a new TrackHostExits config directive to trigger addressmaps
|
|
|
|
|
for certain incoming socks addresses -- for sites that break when
|
|
|
|
|
your exit keeps changing (based on patch by Mike Perry).
|
|
|
|
|
- Redo the client-side dns cache so it's just an addressmap too.
|
|
|
|
|
- Notice when our IP changes, and reset stats/uptime/reachability.
|
2005-06-09 06:06:52 +02:00
|
|
|
- When an application is using socks5, give him the whole variety of
|
|
|
|
|
potential socks5 responses (connect refused, host unreachable, etc),
|
|
|
|
|
rather than just "success" or "failure".
|
|
|
|
|
- A more sane version numbering system. See
|
|
|
|
|
http://tor.eff.org/cvs/tor/doc/version-spec.txt for details.
|
2007-01-26 03:08:53 +01:00
|
|
|
- New contributed script "exitlist": a simple python script to
|
|
|
|
|
parse directories and find Tor nodes that exit to listed
|
|
|
|
|
addresses/ports.
|
|
|
|
|
- New contributed script "privoxy-tor-toggle" to toggle whether
|
|
|
|
|
Privoxy uses Tor. Seems to be configured for Debian by default.
|
|
|
|
|
- Report HTTP reasons to client when getting a response from directory
|
|
|
|
|
servers -- so you can actually know what went wrong.
|
|
|
|
|
- New config option MaxAdvertisedBandwidth which lets you advertise
|
|
|
|
|
a low bandwidthrate (to not attract as many circuits) while still
|
|
|
|
|
allowing a higher bandwidthrate in reality.
|
|
|
|
|
|
|
|
|
|
o Robustness/stability fixes:
|
|
|
|
|
- Make Tor use Niels Provos's libevent instead of its current
|
|
|
|
|
poll-but-sometimes-select mess. This will let us use faster async
|
|
|
|
|
cores (like epoll, kpoll, and /dev/poll), and hopefully work better
|
|
|
|
|
on Windows too.
|
|
|
|
|
- pthread support now too. This was forced because when we forked,
|
|
|
|
|
we ended up wasting a lot of duplicate ram over time. Also switch
|
|
|
|
|
to foo_r versions of some library calls to allow reentry and
|
|
|
|
|
threadsafeness.
|
|
|
|
|
- Better handling for heterogeneous / unreliable nodes:
|
|
|
|
|
- Annotate circuits w/ whether they aim to contain high uptime nodes
|
|
|
|
|
and/or high capacity nodes. When building circuits, choose
|
|
|
|
|
appropriate nodes.
|
|
|
|
|
- This means that every single node in an intro rend circuit,
|
|
|
|
|
not just the last one, will have a minimum uptime.
|
|
|
|
|
- New config option LongLivedPorts to indicate application streams
|
|
|
|
|
that will want high uptime circuits.
|
|
|
|
|
- Servers reset uptime when a dir fetch entirely fails. This
|
|
|
|
|
hopefully reflects stability of the server's network connectivity.
|
|
|
|
|
- If somebody starts his tor server in Jan 2004 and then fixes his
|
|
|
|
|
clock, don't make his published uptime be a year.
|
|
|
|
|
- Reset published uptime when you wake up from hibernation.
|
|
|
|
|
- Introduce a notion of 'internal' circs, which are chosen without
|
|
|
|
|
regard to the exit policy of the last hop. Intro and rendezvous
|
|
|
|
|
circs must be internal circs, to avoid leaking information. Resolve
|
|
|
|
|
and connect streams can use internal circs if they want.
|
|
|
|
|
- New circuit pooling algorithm: make sure to have enough circs around
|
|
|
|
|
to satisfy any predicted ports, and also make sure to have 2 internal
|
|
|
|
|
circs around if we've required internal circs lately (and with high
|
|
|
|
|
uptime if we've seen that lately too).
|
|
|
|
|
- Split NewCircuitPeriod option into NewCircuitPeriod (30 secs),
|
|
|
|
|
which describes how often we retry making new circuits if current
|
|
|
|
|
ones are dirty, and MaxCircuitDirtiness (10 mins), which describes
|
|
|
|
|
how long we're willing to make use of an already-dirty circuit.
|
|
|
|
|
- Cannibalize GENERAL circs to be C_REND, C_INTRO, S_INTRO, and S_REND
|
|
|
|
|
circ as necessary, if there are any completed ones lying around
|
|
|
|
|
when we try to launch one.
|
|
|
|
|
- Make hidden services try to establish a rendezvous for 30 seconds,
|
|
|
|
|
rather than for n (where n=3) attempts to build a circuit.
|
|
|
|
|
- Change SHUTDOWN_WAIT_LENGTH from a fixed 30 secs to a config option
|
|
|
|
|
"ShutdownWaitLength".
|
|
|
|
|
- Try to be more zealous about calling connection_edge_end when
|
|
|
|
|
things go bad with edge conns in connection.c.
|
|
|
|
|
- Revise tor-spec to add more/better stream end reasons.
|
|
|
|
|
- Revise all calls to connection_edge_end to avoid sending "misc",
|
|
|
|
|
and to take errno into account where possible.
|
|
|
|
|
|
|
|
|
|
o Bug fixes:
|
|
|
|
|
- Fix a race condition that can trigger an assert, when we have a
|
|
|
|
|
pending create cell and an OR connection fails right then.
|
|
|
|
|
- Fix several double-mark-for-close bugs, e.g. where we were finding
|
|
|
|
|
a conn for a cell even if that conn is already marked for close.
|
|
|
|
|
- Make sequence of log messages when starting on win32 with no config
|
|
|
|
|
file more reasonable.
|
|
|
|
|
- When choosing an exit node for a new non-internal circ, don't take
|
|
|
|
|
into account whether it'll be useful for any pending x.onion
|
|
|
|
|
addresses -- it won't.
|
|
|
|
|
- Turn addr_policy_compare from a tristate to a quadstate; this should
|
|
|
|
|
help address our "Ah, you allow 1.2.3.4:80. You are a good choice
|
|
|
|
|
for google.com" problem.
|
|
|
|
|
- Make "platform" string in descriptor more accurate for Win32 servers,
|
|
|
|
|
so it's not just "unknown platform".
|
|
|
|
|
- Fix an edge case in parsing config options (thanks weasel).
|
|
|
|
|
If they say "--" on the commandline, it's not an option.
|
|
|
|
|
- Reject odd-looking addresses at the client (e.g. addresses that
|
|
|
|
|
contain a colon), rather than having the server drop them because
|
|
|
|
|
they're malformed.
|
|
|
|
|
- tor-resolve requests were ignoring .exit if there was a working circuit
|
|
|
|
|
they could use instead.
|
|
|
|
|
- REUSEADDR on normal platforms means you can rebind to the port
|
|
|
|
|
right after somebody else has let it go. But REUSEADDR on win32
|
|
|
|
|
means to let you bind to the port _even when somebody else
|
|
|
|
|
already has it bound_! So, don't do that on Win32.
|
2005-03-26 01:46:02 +01:00
|
|
|
- Change version parsing logic: a version is "obsolete" if it is not
|
|
|
|
|
recommended and (1) there is a newer recommended version in the
|
|
|
|
|
same series, or (2) there are no recommended versions in the same
|
|
|
|
|
series, but there are some recommended versions in a newer series.
|
|
|
|
|
A version is "new" if it is newer than any recommended version in
|
|
|
|
|
the same series.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Stop most cases of hanging up on a socks connection without sending
|
|
|
|
|
the socks reject.
|
|
|
|
|
|
|
|
|
|
o Helpful fixes:
|
|
|
|
|
- Require BandwidthRate to be at least 20kB/s for servers.
|
|
|
|
|
- When a dirserver causes you to give a warn, mention which dirserver
|
|
|
|
|
it was.
|
|
|
|
|
- New config option DirAllowPrivateAddresses for authdirservers.
|
|
|
|
|
Now by default they refuse router descriptors that have non-IP or
|
|
|
|
|
private-IP addresses.
|
2005-03-26 01:46:02 +01:00
|
|
|
- Stop publishing socksport in the directory, since it's not
|
|
|
|
|
actually meant to be public. For compatibility, publish a 0 there
|
|
|
|
|
for now.
|
2007-01-26 03:08:53 +01:00
|
|
|
- Change DirFetchPeriod/StatusFetchPeriod to have a special "Be
|
|
|
|
|
smart" value, that is low for servers and high for clients.
|
|
|
|
|
- If our clock jumps forward by 100 seconds or more, assume something
|
|
|
|
|
has gone wrong with our network and abandon all not-yet-used circs.
|
|
|
|
|
- Warn when exit policy implicitly allows local addresses.
|
|
|
|
|
- If we get an incredibly skewed timestamp from a dirserver mirror
|
|
|
|
|
that isn't a verified OR, don't warn -- it's probably him that's
|
|
|
|
|
wrong.
|
2005-03-29 04:44:24 +02:00
|
|
|
- Since we ship our own Privoxy on OS X, tweak it so it doesn't write
|
2005-03-26 01:46:02 +01:00
|
|
|
cookies to disk and doesn't log each web request to disk. (Thanks
|
|
|
|
|
to Brett Carrington for pointing this out.)
|
2007-01-26 03:08:53 +01:00
|
|
|
- When a client asks us for a dir mirror and we don't have one,
|
|
|
|
|
launch an attempt to get a fresh one.
|
|
|
|
|
- If we're hibernating and we get a SIGINT, exit immediately.
|
|
|
|
|
- Add --with-dmalloc ./configure option, to track memory leaks.
|
|
|
|
|
- And try to free all memory on closing, so we can detect what
|
|
|
|
|
we're leaking.
|
|
|
|
|
- Cache local dns resolves correctly even when they're .exit
|
|
|
|
|
addresses.
|
|
|
|
|
- Give a better warning when some other server advertises an
|
|
|
|
|
ORPort that is actually an apache running ssl.
|
2005-03-26 01:46:02 +01:00
|
|
|
- Add "opt hibernating 1" to server descriptor to make it clearer
|
|
|
|
|
whether the server is hibernating.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9.6 - 2005-03-24
|
|
|
|
|
o Bugfixes on 0.0.9.x (crashes and asserts):
|
|
|
|
|
- Add new end stream reasons to maintainance branch. Fix bug where
|
|
|
|
|
reason (8) could trigger an assert. Prevent bug from recurring.
|
|
|
|
|
- Apparently win32 stat wants paths to not end with a slash.
|
|
|
|
|
- Fix assert triggers in assert_cpath_layer_ok(), where we were
|
|
|
|
|
blowing away the circuit that conn->cpath_layer points to, then
|
|
|
|
|
checking to see if the circ is well-formed. Backport check to make
|
|
|
|
|
sure we dont use the cpath on a closed connection.
|
|
|
|
|
- Prevent circuit_resume_edge_reading_helper() from trying to package
|
|
|
|
|
inbufs for marked-for-close streams.
|
|
|
|
|
- Don't crash on hup if your options->address has become unresolvable.
|
|
|
|
|
- Some systems (like OS X) sometimes accept() a connection and tell
|
|
|
|
|
you the remote host is 0.0.0.0:0. If this happens, due to some
|
|
|
|
|
other mis-features, we get confused; so refuse the conn for now.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9.x (other):
|
|
|
|
|
- Fix harmless but scary "Unrecognized content encoding" warn message.
|
|
|
|
|
- Add new stream error reason: TORPROTOCOL reason means "you are not
|
|
|
|
|
speaking a version of Tor I understand; say bye-bye to your stream."
|
|
|
|
|
- Be willing to cache directories from up to ROUTER_MAX_AGE seconds
|
|
|
|
|
into the future, now that we are more tolerant of skew. This
|
|
|
|
|
resolves a bug where a Tor server would refuse to cache a directory
|
|
|
|
|
because all the directories it gets are too far in the future;
|
|
|
|
|
yet the Tor server never logs any complaints about clock skew.
|
|
|
|
|
- Mac packaging magic: make man pages useable, and do not overwrite
|
|
|
|
|
existing torrc files.
|
|
|
|
|
- Make OS X log happily to /var/log/tor/tor.log
|
|
|
|
|
|
|
|
|
|
|
2005-02-24 23:38:33 +01:00
|
|
|
Changes in version 0.0.9.5 - 2005-02-22
|
|
|
|
|
o Bugfixes on 0.0.9.x:
|
|
|
|
|
- Fix an assert race at exit nodes when resolve requests fail.
|
|
|
|
|
- Stop picking unverified dir mirrors--it only leads to misery.
|
|
|
|
|
- Patch from Matt Edman to make NT services work better. Service
|
|
|
|
|
support is still not compiled into the executable by default.
|
|
|
|
|
- Patch from Dmitri Bely so the Tor service runs better under
|
|
|
|
|
the win32 SYSTEM account.
|
|
|
|
|
- Make tor-resolve actually work (?) on Win32.
|
|
|
|
|
- Fix a sign bug when getrlimit claims to have 4+ billion
|
|
|
|
|
file descriptors available.
|
|
|
|
|
- Stop refusing to start when bandwidthburst == bandwidthrate.
|
|
|
|
|
- When create cells have been on the onion queue more than five
|
|
|
|
|
seconds, just send back a destroy and take them off the list.
|
|
|
|
|
|
|
|
|
|
|
2005-02-04 00:55:49 +01:00
|
|
|
Changes in version 0.0.9.4 - 2005-02-03
|
|
|
|
|
o Bugfixes on 0.0.9:
|
|
|
|
|
- Fix an assert bug that took down most of our servers: when
|
2005-02-17 02:12:50 +01:00
|
|
|
a server claims to have 1 GB of bandwidthburst, don't
|
2005-02-04 00:55:49 +01:00
|
|
|
freak out.
|
|
|
|
|
- Don't crash as badly if we have spawned the max allowed number
|
|
|
|
|
of dnsworkers, or we're out of file descriptors.
|
|
|
|
|
- Block more file-sharing ports in the default exit policy.
|
2005-02-04 03:23:16 +01:00
|
|
|
- MaxConn is now automatically set to the hard limit of max
|
|
|
|
|
file descriptors we're allowed (ulimit -n), minus a few for
|
|
|
|
|
logs, etc.
|
|
|
|
|
- Give a clearer message when servers need to raise their
|
|
|
|
|
ulimit -n when they start running out of file descriptors.
|
2005-02-04 00:55:49 +01:00
|
|
|
- SGI Compatibility patches from Jan Schaumann.
|
|
|
|
|
- Tolerate a corrupt cached directory better.
|
|
|
|
|
- When a dirserver hasn't approved your server, list which one.
|
|
|
|
|
- Go into soft hibernation after 95% of the bandwidth is used,
|
|
|
|
|
not 99%. This is especially important for daily hibernators who
|
|
|
|
|
have a small accounting max. Hopefully it will result in fewer
|
|
|
|
|
cut connections when the hard hibernation starts.
|
|
|
|
|
- Load-balance better when using servers that claim more than
|
|
|
|
|
800kB/s of capacity.
|
|
|
|
|
- Make NT services work (experimental, only used if compiled in).
|
|
|
|
|
|
|
|
|
|
|
2005-01-22 08:21:15 +01:00
|
|
|
Changes in version 0.0.9.3 - 2005-01-21
|
|
|
|
|
o Bugfixes on 0.0.9:
|
|
|
|
|
- Backport the cpu use fixes from main branch, so busy servers won't
|
|
|
|
|
need as much processor time.
|
|
|
|
|
- Work better when we go offline and then come back, or when we
|
|
|
|
|
run Tor at boot before the network is up. We do this by
|
|
|
|
|
optimistically trying to fetch a new directory whenever an
|
|
|
|
|
application request comes in and we think we're offline -- the
|
|
|
|
|
human is hopefully a good measure of when the network is back.
|
|
|
|
|
- Backport some minimal hidserv bugfixes: keep rend circuits open as
|
|
|
|
|
long as you keep using them; actually publish hidserv descriptors
|
|
|
|
|
shortly after they change, rather than waiting 20-40 minutes.
|
|
|
|
|
- Enable Mac startup script by default.
|
|
|
|
|
- Fix duplicate dns_cancel_pending_resolve reported by Giorgos Pallas.
|
|
|
|
|
- When you update AllowUnverifiedNodes or FirewallPorts via the
|
|
|
|
|
controller's setconf feature, we were always appending, never
|
|
|
|
|
resetting.
|
|
|
|
|
- When you update HiddenServiceDir via setconf, it was screwing up
|
|
|
|
|
the order of reading the lines, making it fail.
|
|
|
|
|
- Do not rewrite a cached directory back to the cache; otherwise we
|
|
|
|
|
will think it is recent and not fetch a newer one on startup.
|
|
|
|
|
- Workaround for webservers that lie about Content-Encoding: Tor
|
|
|
|
|
now tries to autodetect compressed directories and compression
|
|
|
|
|
itself. This lets us Proxypass dir fetches through apache.
|
|
|
|
|
|
|
|
|
|
|
2005-01-04 10:09:00 +01:00
|
|
|
Changes in version 0.0.9.2 - 2005-01-04
|
|
|
|
|
o Bugfixes on 0.0.9 (crashes and asserts):
|
|
|
|
|
- Fix an assert on startup when the disk is full and you're logging
|
|
|
|
|
to a file.
|
|
|
|
|
- If you do socks4 with an IP of 0.0.0.x but *don't* provide a socks4a
|
|
|
|
|
style address, then we'd crash.
|
|
|
|
|
- Fix an assert trigger when the running-routers string we get from
|
|
|
|
|
a dirserver is broken.
|
|
|
|
|
- Make worker threads start and run on win32. Now win32 servers
|
|
|
|
|
may work better.
|
|
|
|
|
- Bandaid (not actually fix, but now it doesn't crash) an assert
|
|
|
|
|
where the dns worker dies mysteriously and the main Tor process
|
|
|
|
|
doesn't remember anything about the address it was resolving.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9 (Win32):
|
|
|
|
|
- Workaround for brain-damaged __FILE__ handling on MSVC: keep Nick's
|
|
|
|
|
name out of the warning/assert messages.
|
|
|
|
|
- Fix a superficial "unhandled error on read" bug on win32.
|
|
|
|
|
- The win32 installer no longer requires a click-through for our
|
|
|
|
|
license, since our Free Software license grants rights but does not
|
|
|
|
|
take any away.
|
|
|
|
|
- Win32: When connecting to a dirserver fails, try another one
|
|
|
|
|
immediately. (This was already working for non-win32 Tors.)
|
|
|
|
|
- Stop trying to parse $HOME on win32 when hunting for default
|
|
|
|
|
DataDirectory.
|
|
|
|
|
- Make tor-resolve.c work on win32 by calling network_init().
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9 (other):
|
|
|
|
|
- Make 0.0.9.x build on Solaris again.
|
|
|
|
|
- Due to a fencepost error, we were blowing away the \n when reporting
|
|
|
|
|
confvalue items in the controller. So asking for multiple config
|
|
|
|
|
values at once couldn't work.
|
|
|
|
|
- When listing circuits that are pending on an opening OR connection,
|
|
|
|
|
if we're an OR we were listing circuits that *end* at us as
|
|
|
|
|
being pending on every listener, dns/cpu worker, etc. Stop that.
|
|
|
|
|
- Dirservers were failing to create 'running-routers' or 'directory'
|
|
|
|
|
strings if we had more than some threshold of routers. Fix them so
|
|
|
|
|
they can handle any number of routers.
|
|
|
|
|
- Fix a superficial "Duplicate mark for close" bug.
|
|
|
|
|
- Stop checking for clock skew for OR connections, even for servers.
|
|
|
|
|
- Fix a fencepost error that was chopping off the last letter of any
|
|
|
|
|
nickname that is the maximum allowed nickname length.
|
|
|
|
|
- Update URLs in log messages so they point to the new website.
|
|
|
|
|
- Fix a potential problem in mangling server private keys while
|
|
|
|
|
writing to disk (not triggered yet, as far as we know).
|
|
|
|
|
- Include the licenses for other free software we include in Tor,
|
|
|
|
|
now that we're shipping binary distributions more regularly.
|
|
|
|
|
|
|
|
|
|
|
2007-01-26 07:34:48 +01:00
|
|
|
Changes in version 0.0.9.1 - 2004-12-15
|
2004-12-15 20:51:35 +01:00
|
|
|
o Bugfixes on 0.0.9:
|
|
|
|
|
- Make hibernation actually work.
|
|
|
|
|
- Make HashedControlPassword config option work.
|
|
|
|
|
- When we're reporting event circuit status to a controller,
|
|
|
|
|
don't use the stream status code.
|
|
|
|
|
|
2004-12-08 00:42:32 +01:00
|
|
|
|
2004-12-13 01:52:35 +01:00
|
|
|
Changes in version 0.0.9 - 2004-12-12
|
2007-01-26 01:22:33 +01:00
|
|
|
o Cleanups:
|
|
|
|
|
- Clean up manpage and torrc.sample file.
|
|
|
|
|
- Clean up severities and text of log warnings.
|
|
|
|
|
o Mistakes:
|
|
|
|
|
- Make servers trigger an assert when they enter hibernation.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc7 - 2004-12-08
|
|
|
|
|
o Bugfixes on 0.0.9rc:
|
|
|
|
|
- Fix a stack-trashing crash when an exit node begins hibernating.
|
|
|
|
|
- Avoid looking at unallocated memory while considering which
|
|
|
|
|
ports we need to build circuits to cover.
|
|
|
|
|
- Stop a sigpipe: when an 'end' cell races with eof from the app,
|
|
|
|
|
we shouldn't hold-open-until-flush if the eof arrived first.
|
|
|
|
|
- Fix a bug with init_cookie_authentication() in the controller.
|
|
|
|
|
- When recommending new-format log lines, if the upper bound is
|
|
|
|
|
LOG_ERR, leave it implicit.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Fix a whole slew of memory leaks.
|
2004-12-08 02:14:56 +01:00
|
|
|
- Fix isspace() and friends so they still make Solaris happy
|
|
|
|
|
but also so they don't trigger asserts on win32.
|
2004-12-08 00:42:32 +01:00
|
|
|
- Fix parse_iso_time on platforms without strptime (eg win32).
|
2007-01-26 01:22:33 +01:00
|
|
|
- win32: tolerate extra "readable" events better.
|
2004-12-08 00:42:32 +01:00
|
|
|
- win32: when being multithreaded, leave parent fdarray open.
|
|
|
|
|
- Make unit tests work on win32.
|
|
|
|
|
|
2007-01-26 01:22:33 +01:00
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc6 - 2004-12-06
|
|
|
|
|
o Bugfixes on 0.0.9pre:
|
|
|
|
|
- Clean up some more integer underflow opportunities (not exploitable
|
|
|
|
|
we think).
|
|
|
|
|
- While hibernating, hup should not regrow our listeners.
|
|
|
|
|
- Send an end to the streams we close when we hibernate, rather
|
|
|
|
|
than just chopping them off.
|
|
|
|
|
- React to eof immediately on non-open edge connections.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
2004-12-06 07:27:39 +01:00
|
|
|
- Calculate timeout for waiting for a connected cell from the time
|
|
|
|
|
we sent the begin cell, not from the time the stream started. If
|
|
|
|
|
it took a long time to establish the circuit, we would time out
|
|
|
|
|
right after sending the begin cell.
|
|
|
|
|
- Fix router_compare_addr_to_addr_policy: it was not treating a port
|
|
|
|
|
of * as always matching, so we were picking reject *:* nodes as
|
|
|
|
|
exit nodes too. Oops.
|
2004-12-11 19:07:52 +01:00
|
|
|
|
2007-01-26 01:22:33 +01:00
|
|
|
o Features:
|
2004-12-06 07:27:39 +01:00
|
|
|
- New circuit building strategy: keep a list of ports that we've
|
|
|
|
|
used in the past 6 hours, and always try to have 2 circuits open
|
|
|
|
|
or on the way that will handle each such port. Seed us with port
|
|
|
|
|
80 so web users won't complain that Tor is "slow to start up".
|
|
|
|
|
- Make kill -USR1 dump more useful stats about circuits.
|
|
|
|
|
- When warning about retrying or giving up, print the address, so
|
|
|
|
|
the user knows which one it's talking about.
|
|
|
|
|
- If you haven't used a clean circuit in an hour, throw it away,
|
|
|
|
|
just to be on the safe side. (This means after 6 hours a totally
|
|
|
|
|
unused Tor client will have no circuits open.)
|
2007-01-26 01:22:33 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc5 - 2004-12-01
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Disallow NDEBUG. We don't ever want anybody to turn off debug.
|
|
|
|
|
- Let resolve conns retry/expire also, rather than sticking around
|
|
|
|
|
forever.
|
|
|
|
|
- If we are using select, make sure we stay within FD_SETSIZE.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9pre:
|
|
|
|
|
- Fix integer underflow in tor_vsnprintf() that may be exploitable,
|
|
|
|
|
but doesn't seem to be currently; thanks to Ilja van Sprundel for
|
|
|
|
|
finding it.
|
|
|
|
|
- If anybody set DirFetchPostPeriod, give them StatusFetchPeriod
|
|
|
|
|
instead. Impose minima and maxima for all *Period options; impose
|
|
|
|
|
even tighter maxima for fetching if we are a caching dirserver.
|
|
|
|
|
Clip rather than rejecting.
|
|
|
|
|
- Fetch cached running-routers from servers that serve it (that is,
|
|
|
|
|
authdirservers and servers running 0.0.9rc5-cvs or later.)
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Accept *:706 (silc) in default exit policy.
|
|
|
|
|
- Implement new versioning format for post 0.1.
|
2004-11-30 11:33:23 +01:00
|
|
|
- Support "foo.nickname.exit" addresses, to let Alice request the
|
|
|
|
|
address "foo" as viewed by exit node "nickname". Based on a patch
|
2007-01-26 01:22:33 +01:00
|
|
|
by Geoff Goodell.
|
|
|
|
|
- Make tor --version --version dump the cvs Id of every file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc4 - 2004-11-28
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Make windows sockets actually non-blocking (oops), and handle
|
|
|
|
|
win32 socket errors better.
|
2004-11-23 08:36:48 +01:00
|
|
|
|
2007-01-26 01:22:33 +01:00
|
|
|
o Bugfixes on 0.0.9rc1:
|
|
|
|
|
- Actually catch the -USR2 signal.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc3 - 2004-11-25
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Flush the log file descriptor after we print "Tor opening log file",
|
|
|
|
|
so we don't see those messages days later.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9rc1:
|
|
|
|
|
- Make tor-resolve work again.
|
|
|
|
|
- Avoid infinite loop in tor-resolve if tor hangs up on it.
|
|
|
|
|
- Fix an assert trigger for clients/servers handling resolves.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc2 - 2004-11-24
|
|
|
|
|
o Bugfixes on 0.0.9rc1:
|
|
|
|
|
- I broke socks5 support while fixing the eof bug.
|
|
|
|
|
- Allow unitless bandwidths and intervals; they default to bytes
|
|
|
|
|
and seconds.
|
|
|
|
|
- New servers don't start out hibernating; they are active until
|
|
|
|
|
they run out of bytes, so they have a better estimate of how
|
|
|
|
|
long it takes, and so their operators can know they're working.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9rc1 - 2004-11-23
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Finally fix a bug that's been plaguing us for a year:
|
|
|
|
|
With high load, circuit package window was reaching 0. Whenever
|
|
|
|
|
we got a circuit-level sendme, we were reading a lot on each
|
|
|
|
|
socket, but only writing out a bit. So we would eventually reach
|
|
|
|
|
eof. This would be noticed and acted on even when there were still
|
|
|
|
|
bytes sitting in the inbuf.
|
|
|
|
|
- When poll() is interrupted, we shouldn't believe the revents values.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9pre6:
|
|
|
|
|
- Fix hibernate bug that caused pre6 to be broken.
|
|
|
|
|
- Don't keep rephist info for routers that haven't had activity for
|
|
|
|
|
24 hours. (This matters now that clients have keys, since we track
|
|
|
|
|
them too.)
|
|
|
|
|
- Never call close_temp_logs while validating log options.
|
|
|
|
|
- Fix backslash-escaping on tor.sh.in and torctl.in.
|
|
|
|
|
|
|
|
|
|
o Features:
|
2004-11-23 08:36:48 +01:00
|
|
|
- Implement weekly/monthly/daily accounting: now you specify your
|
|
|
|
|
hibernation properties by
|
|
|
|
|
AccountingMax N bytes|KB|MB|GB|TB
|
|
|
|
|
AccountingStart day|week|month [day] HH:MM
|
|
|
|
|
Defaults to "month 1 0:00".
|
|
|
|
|
- Let bandwidth and interval config options be specified as 5 bytes,
|
|
|
|
|
kb, kilobytes, etc; and as seconds, minutes, hours, days, weeks.
|
2007-01-26 01:22:33 +01:00
|
|
|
- kill -USR2 now moves all logs to loglevel debug (kill -HUP to
|
|
|
|
|
get back to normal.)
|
|
|
|
|
- If your requested entry or exit node has advertised bandwidth 0,
|
|
|
|
|
pick it anyway.
|
|
|
|
|
- Be more greedy about filling up relay cells -- we try reading again
|
|
|
|
|
once we've processed the stuff we read, in case enough has arrived
|
|
|
|
|
to fill the last cell completely.
|
|
|
|
|
- Apply NT service patch from Osamu Fujino. Still needs more work.
|
2004-11-16 04:12:35 +01:00
|
|
|
|
|
|
|
|
|
2007-01-26 01:22:33 +01:00
|
|
|
Changes in version 0.0.9pre6 - 2004-11-15
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Fix assert failure on malformed socks4a requests.
|
|
|
|
|
- Use identity comparison, not nickname comparison, to choose which
|
|
|
|
|
half of circuit-ID-space each side gets to use. This is needed
|
|
|
|
|
because sometimes we think of a router as a nickname, and sometimes
|
|
|
|
|
as a hex ID, and we can't predict what the other side will do.
|
|
|
|
|
- Catch and ignore SIGXFSZ signals when log files exceed 2GB; our
|
|
|
|
|
write() call will fail and we handle it there.
|
|
|
|
|
- Add a FAST_SMARTLIST define to optionally inline smartlist_get
|
|
|
|
|
and smartlist_len, which are two major profiling offenders.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9pre5:
|
|
|
|
|
- Fix a bug in read_all that was corrupting config files on windows.
|
|
|
|
|
- When we're raising the max number of open file descriptors to
|
|
|
|
|
'unlimited', don't log that we just raised it to '-1'.
|
|
|
|
|
- Include event code with events, as required by control-spec.txt.
|
|
|
|
|
- Don't give a fingerprint when clients do --list-fingerprint:
|
|
|
|
|
it's misleading, because it will never be the same again.
|
|
|
|
|
- Stop using strlcpy in tor_strndup, since it was slowing us
|
|
|
|
|
down a lot.
|
|
|
|
|
- Remove warn on startup about missing cached-directory file.
|
|
|
|
|
- Make kill -USR1 work again.
|
|
|
|
|
- Hibernate if we start tor during the "wait for wakeup-time" phase
|
|
|
|
|
of an accounting interval. Log our hibernation plans better.
|
|
|
|
|
- Authoritative dirservers now also cache their directory, so they
|
|
|
|
|
have it on start-up.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Fetch running-routers; cache running-routers; compress
|
|
|
|
|
running-routers; serve compressed running-routers.z
|
|
|
|
|
- Add NSI installer script contributed by J Doe.
|
2004-11-16 04:12:35 +01:00
|
|
|
- Commit VC6 and VC7 workspace/project files.
|
|
|
|
|
- Commit a tor.spec for making RPM files, with help from jbash.
|
|
|
|
|
- Add contrib/torctl.in contributed by Glenn Fink.
|
2007-01-26 01:22:33 +01:00
|
|
|
- Implement the control-spec's SAVECONF command, to write your
|
|
|
|
|
configuration to torrc.
|
|
|
|
|
- Get cookie authentication for the controller closer to working.
|
|
|
|
|
- Include control-spec.txt in the tarball.
|
|
|
|
|
- When set_conf changes our server descriptor, upload a new copy.
|
|
|
|
|
But don't upload it too often if there are frequent changes.
|
|
|
|
|
- Document authentication config in man page, and document signals
|
|
|
|
|
we catch.
|
|
|
|
|
- Clean up confusing parts of man page and torrc.sample.
|
2004-11-16 04:12:35 +01:00
|
|
|
- Make expand_filename handle ~ and ~username.
|
|
|
|
|
- Use autoconf to enable largefile support where necessary. Use
|
|
|
|
|
ftello where available, since ftell can fail at 2GB.
|
2007-01-26 01:22:33 +01:00
|
|
|
- Distinguish between TOR_TLS_CLOSE and TOR_TLS_ERROR, so we can
|
|
|
|
|
log more informatively.
|
|
|
|
|
- Give a slightly more useful output for "tor -h".
|
|
|
|
|
- Refuse application socks connections to port 0.
|
|
|
|
|
- Check clock skew for verified servers, but allow unverified
|
|
|
|
|
servers and clients to have any clock skew.
|
|
|
|
|
- Break DirFetchPostPeriod into:
|
|
|
|
|
- DirFetchPeriod for fetching full directory,
|
|
|
|
|
- StatusFetchPeriod for fetching running-routers,
|
|
|
|
|
- DirPostPeriod for posting server descriptor,
|
|
|
|
|
- RendPostPeriod for posting hidden service descriptors.
|
|
|
|
|
- Make sure the hidden service descriptors are at a random offset
|
|
|
|
|
from each other, to hinder linkability.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9pre5 - 2004-11-09
|
|
|
|
|
o Bugfixes on 0.0.9pre4:
|
|
|
|
|
- Fix a seg fault in unit tests (doesn't affect main program).
|
|
|
|
|
- Fix an assert bug where a hidden service provider would fail if
|
|
|
|
|
the first hop of his rendezvous circuit was down.
|
|
|
|
|
- Hidden service operators now correctly handle version 1 style
|
|
|
|
|
INTRODUCE1 cells (nobody generates them still, so not a critical
|
|
|
|
|
bug).
|
|
|
|
|
- If do_hup fails, actually notice.
|
|
|
|
|
- Handle more errnos from accept() without closing the listener.
|
|
|
|
|
Some OpenBSD machines were closing their listeners because
|
|
|
|
|
they ran out of file descriptors.
|
|
|
|
|
- Send resolve cells to exit routers that are running a new
|
|
|
|
|
enough version of the resolve code to work right.
|
|
|
|
|
- Better handling of winsock includes on non-MSV win32 compilers.
|
|
|
|
|
- Some people had wrapped their tor client/server in a script
|
|
|
|
|
that would restart it whenever it died. This did not play well
|
|
|
|
|
with our "shut down if your version is obsolete" code. Now people
|
|
|
|
|
don't fetch a new directory if their local cached version is
|
|
|
|
|
recent enough.
|
|
|
|
|
- Make our autogen.sh work on ksh as well as bash.
|
2004-11-16 04:12:35 +01:00
|
|
|
|
2007-01-26 01:22:33 +01:00
|
|
|
o Major Features:
|
|
|
|
|
- Hibernation: New config option "AccountingMaxKB" lets you
|
|
|
|
|
set how many KBytes per month you want to allow your server to
|
|
|
|
|
consume. Rather than spreading those bytes out evenly over the
|
|
|
|
|
month, we instead hibernate for some of the month and pop up
|
|
|
|
|
at a deterministic time, work until the bytes are consumed, then
|
|
|
|
|
hibernate again. Config option "MonthlyAccountingStart" lets you
|
|
|
|
|
specify which day of the month your billing cycle starts on.
|
2004-11-09 09:13:03 +01:00
|
|
|
- Control interface: a separate program can now talk to your
|
|
|
|
|
client/server over a socket, and get/set config options, receive
|
|
|
|
|
notifications of circuits and streams starting/finishing/dying,
|
|
|
|
|
bandwidth used, etc. The next step is to get some GUIs working.
|
2004-11-09 12:55:16 +01:00
|
|
|
Let us know if you want to help out. See doc/control-spec.txt .
|
2004-11-09 09:13:03 +01:00
|
|
|
- Ship a contrib/tor-control.py as an example script to interact
|
|
|
|
|
with the control port.
|
|
|
|
|
- "tor --hash-password zzyxz" will output a salted password for
|
|
|
|
|
use in authenticating to the control interface.
|
|
|
|
|
- New log format in config:
|
|
|
|
|
"Log minsev[-maxsev] stdout|stderr|syslog" or
|
2004-11-14 05:54:35 +01:00
|
|
|
"Log minsev[-maxsev] file /var/foo"
|
2007-01-26 01:22:33 +01:00
|
|
|
|
|
|
|
|
o Minor Features:
|
2004-11-09 09:13:03 +01:00
|
|
|
- DirPolicy config option, to let people reject incoming addresses
|
|
|
|
|
from their dirserver.
|
|
|
|
|
- "tor --list-fingerprint" will list your identity key fingerprint
|
|
|
|
|
and then exit.
|
2007-01-26 01:22:33 +01:00
|
|
|
- Add "pass" target for RedirectExit, to make it easier to break
|
|
|
|
|
out of a sequence of RedirectExit rules.
|
|
|
|
|
- Clients now generate a TLS cert too, in preparation for having
|
|
|
|
|
them act more like real nodes.
|
|
|
|
|
- Ship src/win32/ in the tarball, so people can use it to build.
|
|
|
|
|
- Make old win32 fall back to CWD if SHGetSpecialFolderLocation
|
|
|
|
|
is broken.
|
|
|
|
|
- New "router-status" line in directory, to better bind each verified
|
|
|
|
|
nickname to its identity key.
|
|
|
|
|
- Deprecate unofficial config option abbreviations, and abbreviations
|
|
|
|
|
not on the command line.
|
|
|
|
|
- Add a pure-C tor-resolve implementation.
|
|
|
|
|
- Use getrlimit and friends to ensure we can reach MaxConn (currently
|
|
|
|
|
1024) file descriptors.
|
|
|
|
|
|
|
|
|
|
o Code security improvements, inspired by Ilja:
|
|
|
|
|
- Replace sprintf with snprintf. (I think they were all safe, but
|
|
|
|
|
hey.)
|
|
|
|
|
- Replace strcpy/strncpy with strlcpy in more places.
|
|
|
|
|
- Avoid strcat; use snprintf or strlcat instead.
|
|
|
|
|
- snprintf wrapper with consistent (though not C99) overflow behavior.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9pre4 - 2004-10-17
|
|
|
|
|
o Bugfixes on 0.0.9pre3:
|
|
|
|
|
- If the server doesn't specify an exit policy, use the real default
|
|
|
|
|
exit policy, not reject *:*.
|
|
|
|
|
- Ignore fascistfirewall when uploading/downloading hidden service
|
|
|
|
|
descriptors, since we go through Tor for those; and when using
|
|
|
|
|
an HttpProxy, since we assume it can reach them all.
|
|
|
|
|
- When looking for an authoritative dirserver, use only the ones
|
|
|
|
|
configured at boot. Don't bother looking in the directory.
|
|
|
|
|
- The rest of the fix for get_default_conf_file() on older win32.
|
|
|
|
|
- Make 'Routerfile' config option obsolete.
|
|
|
|
|
|
|
|
|
|
o Features:
|
2004-10-17 07:15:46 +02:00
|
|
|
- New 'MyFamily nick1,...' config option for a server to
|
|
|
|
|
specify other servers that shouldn't be used in the same circuit
|
|
|
|
|
with it. Only believed if nick1 also specifies us.
|
|
|
|
|
- New 'NodeFamily nick1,nick2,...' config option for a client to
|
|
|
|
|
specify nodes that it doesn't want to use in the same circuit.
|
|
|
|
|
- New 'Redirectexit pattern address:port' config option for a
|
|
|
|
|
server to redirect exit connections, e.g. to a local squid.
|
2007-01-26 01:22:33 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9pre3 - 2004-10-13
|
|
|
|
|
o Bugfixes on 0.0.8.1:
|
|
|
|
|
- Better torrc example lines for dirbindaddress and orbindaddress.
|
|
|
|
|
- Improved bounds checking on parsed ints (e.g. config options and
|
|
|
|
|
the ones we find in directories.)
|
|
|
|
|
- Better handling of size_t vs int, so we're more robust on 64
|
|
|
|
|
bit platforms.
|
|
|
|
|
- Fix the rest of the bug where a newly started OR would appear
|
|
|
|
|
as unverified even after we've added his fingerprint and hupped
|
|
|
|
|
the dirserver.
|
|
|
|
|
- Fix a bug from 0.0.7: when read() failed on a stream, we would
|
|
|
|
|
close it without sending back an end. So 'connection refused'
|
|
|
|
|
would simply be ignored and the user would get no response.
|
|
|
|
|
|
|
|
|
|
o Bugfixes on 0.0.9pre2:
|
|
|
|
|
- Serving the cached-on-disk directory to people is bad. We now
|
|
|
|
|
provide no directory until we've fetched a fresh one.
|
|
|
|
|
- Workaround for bug on windows where cached-directories get crlf
|
|
|
|
|
corruption.
|
|
|
|
|
- Make get_default_conf_file() work on older windows too.
|
|
|
|
|
- If we write a *:* exit policy line in the descriptor, don't write
|
|
|
|
|
any more exit policy lines.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Use only 0.0.9pre1 and later servers for resolve cells.
|
2004-10-14 07:31:03 +02:00
|
|
|
- Make the dirservers file obsolete.
|
|
|
|
|
- Include a dir-signing-key token in directories to tell the
|
|
|
|
|
parsing entity which key is being used to sign.
|
2004-10-14 12:27:26 +02:00
|
|
|
- Remove the built-in bulky default dirservers string.
|
|
|
|
|
- New config option "Dirserver %s:%d [fingerprint]", which can be
|
|
|
|
|
repeated as many times as needed. If no dirservers specified,
|
|
|
|
|
default to moria1,moria2,tor26.
|
2007-01-26 01:22:33 +01:00
|
|
|
- Make moria2 advertise a dirport of 80, so people behind firewalls
|
|
|
|
|
will be able to get a directory.
|
|
|
|
|
- Http proxy support
|
|
|
|
|
- Dirservers translate requests for http://%s:%d/x to /x
|
|
|
|
|
- You can specify "HttpProxy %s[:%d]" and all dir fetches will
|
|
|
|
|
be routed through this host.
|
|
|
|
|
- Clients ask for /tor/x rather than /x for new enough dirservers.
|
|
|
|
|
This way we can one day coexist peacefully with apache.
|
|
|
|
|
- Clients specify a "Host: %s%d" http header, to be compatible
|
|
|
|
|
with more proxies, and so running squid on an exit node can work.
|
2004-09-27 03:10:07 +02:00
|
|
|
|
|
|
|
|
|
2004-10-14 07:31:03 +02:00
|
|
|
Changes in version 0.0.8.1 - 2004-10-13
|
|
|
|
|
o Bugfixes:
|
2004-10-14 08:44:47 +02:00
|
|
|
- Fix a seg fault that can be triggered remotely for Tor
|
|
|
|
|
clients/servers with an open dirport.
|
2004-10-14 07:31:03 +02:00
|
|
|
- Fix a rare assert trigger, where routerinfos for entries in
|
|
|
|
|
our cpath would expire while we're building the path.
|
|
|
|
|
- Fix a bug in OutboundBindAddress so it (hopefully) works.
|
|
|
|
|
- Fix a rare seg fault for people running hidden services on
|
|
|
|
|
intermittent connections.
|
|
|
|
|
- Fix a bug in parsing opt keywords with objects.
|
|
|
|
|
- Fix a stale pointer assert bug when a stream detaches and
|
|
|
|
|
reattaches.
|
|
|
|
|
- Fix a string format vulnerability (probably not exploitable)
|
|
|
|
|
in reporting stats locally.
|
|
|
|
|
- Fix an assert trigger: sometimes launching circuits can fail
|
|
|
|
|
immediately, e.g. because too many circuits have failed recently.
|
2004-10-14 08:50:57 +02:00
|
|
|
- Fix a compile warning on 64 bit platforms.
|
2004-10-14 07:31:03 +02:00
|
|
|
|
|
|
|
|
|
2007-01-26 01:22:33 +01:00
|
|
|
Changes in version 0.0.9pre2 - 2004-10-03
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Make fetching a cached directory work for 64-bit platforms too.
|
|
|
|
|
- Make zlib.h a required header, not an optional header.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.9pre1 - 2004-10-01
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Stop using separate defaults for no-config-file and
|
|
|
|
|
empty-config-file. Now you have to explicitly turn off SocksPort,
|
|
|
|
|
if you don't want it open.
|
|
|
|
|
- Fix a bug in OutboundBindAddress so it (hopefully) works.
|
|
|
|
|
- Improve man page to mention more of the 0.0.8 features.
|
|
|
|
|
- Fix a rare seg fault for people running hidden services on
|
|
|
|
|
intermittent connections.
|
|
|
|
|
- Change our file IO stuff (especially wrt OpenSSL) so win32 is
|
|
|
|
|
happier.
|
|
|
|
|
- Fix more dns related bugs: send back resolve_failed and end cells
|
|
|
|
|
more reliably when the resolve fails, rather than closing the
|
|
|
|
|
circuit and then trying to send the cell. Also attach dummy resolve
|
|
|
|
|
connections to a circuit *before* calling dns_resolve(), to fix
|
|
|
|
|
a bug where cached answers would never be sent in RESOLVED cells.
|
|
|
|
|
- When we run out of disk space, or other log writing error, don't
|
|
|
|
|
crash. Just stop logging to that log and continue.
|
|
|
|
|
- We were starting to daemonize before we opened our logs, so if
|
|
|
|
|
there were any problems opening logs, we would complain to stderr,
|
|
|
|
|
which wouldn't work, and then mysteriously exit.
|
|
|
|
|
- Fix a rare bug where sometimes a verified OR would connect to us
|
|
|
|
|
before he'd uploaded his descriptor, which would cause us to
|
|
|
|
|
assign conn->nickname as though he's unverified. Now we look through
|
|
|
|
|
the fingerprint list to see if he's there.
|
|
|
|
|
- Fix a rare assert trigger, where routerinfos for entries in
|
|
|
|
|
our cpath would expire while we're building the path.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Clients can ask dirservers for /dir.z to get a compressed version
|
|
|
|
|
of the directory. Only works for servers running 0.0.9, of course.
|
|
|
|
|
- Make clients cache directories and use them to seed their router
|
|
|
|
|
lists at startup. This means clients have a datadir again.
|
|
|
|
|
- Configuration infrastructure support for warning on obsolete
|
|
|
|
|
options.
|
|
|
|
|
- Respond to content-encoding headers by trying to uncompress as
|
|
|
|
|
appropriate.
|
|
|
|
|
- Reply with a deflated directory when a client asks for "dir.z".
|
|
|
|
|
We could use allow-encodings instead, but allow-encodings isn't
|
|
|
|
|
specified in HTTP 1.0.
|
|
|
|
|
- Raise the max dns workers from 50 to 100.
|
|
|
|
|
- Discourage people from setting their dirfetchpostperiod more often
|
|
|
|
|
than once per minute.
|
|
|
|
|
- Protect dirservers from overzealous descriptor uploading -- wait
|
|
|
|
|
10 seconds after directory gets dirty, before regenerating.
|
|
|
|
|
|
|
|
|
|
|
2004-08-25 21:45:23 +02:00
|
|
|
Changes in version 0.0.8 - 2004-08-25
|
2007-01-25 23:19:13 +01:00
|
|
|
o Port it to SunOS 5.9 / Athena
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.8rc2 - 2004-08-20
|
|
|
|
|
o Make it compile on cygwin again.
|
|
|
|
|
o When picking unverified routers, skip those with low uptime and/or
|
|
|
|
|
low bandwidth, depending on what properties you care about.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.8rc1 - 2004-08-18
|
|
|
|
|
o Changes from 0.0.7.3:
|
|
|
|
|
- Bugfixes:
|
|
|
|
|
- Fix assert triggers: if the other side returns an address 0.0.0.0,
|
|
|
|
|
don't put it into the client dns cache.
|
|
|
|
|
- If a begin failed due to exit policy, but we believe the IP address
|
|
|
|
|
should have been allowed, switch that router to exitpolicy reject *:*
|
|
|
|
|
until we get our next directory.
|
|
|
|
|
- Features:
|
|
|
|
|
- Clients choose nodes proportional to advertised bandwidth.
|
|
|
|
|
- Avoid using nodes with low uptime as introduction points.
|
|
|
|
|
- Handle servers with dynamic IP addresses: don't replace
|
|
|
|
|
options->Address with the resolved one at startup, and
|
|
|
|
|
detect our address right before we make a routerinfo each time.
|
|
|
|
|
- 'FascistFirewall' option to pick dirservers and ORs on specific
|
|
|
|
|
ports; plus 'FirewallPorts' config option to tell FascistFirewall
|
|
|
|
|
which ports are open. (Defaults to 80,443)
|
|
|
|
|
- Be more aggressive about trying to make circuits when the network
|
|
|
|
|
has changed (e.g. when you unsuspend your laptop).
|
|
|
|
|
- Check for time skew on http headers; report date in response to
|
|
|
|
|
"GET /".
|
|
|
|
|
- If the entrynode config line has only one node, don't pick it as
|
|
|
|
|
an exitnode.
|
|
|
|
|
- Add strict{entry|exit}nodes config options. If set to 1, then
|
|
|
|
|
we refuse to build circuits that don't include the specified entry
|
|
|
|
|
or exit nodes.
|
|
|
|
|
- OutboundBindAddress config option, to bind to a specific
|
|
|
|
|
IP address for outgoing connect()s.
|
|
|
|
|
- End truncated log entries (e.g. directories) with "[truncated]".
|
|
|
|
|
|
|
|
|
|
o Patches to 0.0.8preX:
|
|
|
|
|
- Bugfixes:
|
|
|
|
|
- Patches to compile and run on win32 again (maybe)?
|
|
|
|
|
- Fix crash when looking for ~/.torrc with no $HOME set.
|
|
|
|
|
- Fix a race bug in the unit tests.
|
|
|
|
|
- Handle verified/unverified name collisions better when new
|
|
|
|
|
routerinfo's arrive in a directory.
|
|
|
|
|
- Sometimes routers were getting entered into the stats before
|
|
|
|
|
we'd assigned their identity_digest. Oops.
|
|
|
|
|
- Only pick and establish intro points after we've gotten a
|
|
|
|
|
directory.
|
|
|
|
|
- Features:
|
|
|
|
|
- AllowUnverifiedNodes config option to let circuits choose no-name
|
|
|
|
|
routers in entry,middle,exit,introduction,rendezvous positions.
|
|
|
|
|
Allow middle and rendezvous positions by default.
|
|
|
|
|
- Add a man page for tor-resolve.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.7.3 - 2004-08-12
|
|
|
|
|
o Stop dnsworkers from triggering an assert failure when you
|
|
|
|
|
ask them to resolve the host "".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.8pre3 - 2004-08-09
|
|
|
|
|
o Changes from 0.0.7.2:
|
|
|
|
|
- Allow multiple ORs with same nickname in routerlist -- now when
|
|
|
|
|
people give us one identity key for a nickname, then later
|
|
|
|
|
another, we don't constantly complain until the first expires.
|
|
|
|
|
- Remember used bandwidth (both in and out), and publish 15-minute
|
|
|
|
|
snapshots for the past day into our descriptor.
|
|
|
|
|
- You can now fetch $DIRURL/running-routers to get just the
|
|
|
|
|
running-routers line, not the whole descriptor list. (But
|
|
|
|
|
clients don't use this yet.)
|
|
|
|
|
- When people mistakenly use Tor as an http proxy, point them
|
|
|
|
|
at the tor-doc.html rather than the INSTALL.
|
|
|
|
|
- Remove our mostly unused -- and broken -- hex_encode()
|
|
|
|
|
function. Use base16_encode() instead. (Thanks to Timo Lindfors
|
|
|
|
|
for pointing out this bug.)
|
|
|
|
|
- Rotate onion keys every 12 hours, not every 2 hours, so we have
|
|
|
|
|
fewer problems with people using the wrong key.
|
|
|
|
|
- Change the default exit policy to reject the default edonkey,
|
|
|
|
|
kazaa, gnutella ports.
|
|
|
|
|
- Add replace_file() to util.[ch] to handle win32's rename().
|
|
|
|
|
|
|
|
|
|
o Changes from 0.0.8preX:
|
|
|
|
|
- Fix two bugs in saving onion keys to disk when rotating, so
|
|
|
|
|
hopefully we'll get fewer people using old onion keys.
|
|
|
|
|
- Fix an assert error that was making SocksPolicy not work.
|
|
|
|
|
- Be willing to expire routers that have an open dirport -- it's
|
|
|
|
|
just the authoritative dirservers we want to not forget.
|
|
|
|
|
- Reject tor-resolve requests for .onion addresses early, so we
|
|
|
|
|
don't build a whole rendezvous circuit and then fail.
|
|
|
|
|
- When you're warning a server that he's unverified, don't cry
|
|
|
|
|
wolf unpredictably.
|
|
|
|
|
- Fix a race condition: don't try to extend onto a connection
|
|
|
|
|
that's still handshaking.
|
|
|
|
|
- For servers in clique mode, require the conn to be open before
|
|
|
|
|
you'll choose it for your path.
|
|
|
|
|
- Fix some cosmetic bugs about duplicate mark-for-close, lack of
|
|
|
|
|
end relay cell, etc.
|
|
|
|
|
- Measure bandwidth capacity over the last 24 hours, not just 12
|
|
|
|
|
- Bugfix: authoritative dirservers were making and signing a new
|
|
|
|
|
directory for each client, rather than reusing the cached one.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.8pre2 - 2004-08-04
|
|
|
|
|
o Changes from 0.0.7.2:
|
|
|
|
|
- Security fixes:
|
|
|
|
|
- Check directory signature _before_ you decide whether you're
|
|
|
|
|
you're running an obsolete version and should exit.
|
|
|
|
|
- Check directory signature _before_ you parse the running-routers
|
|
|
|
|
list to decide who's running or verified.
|
|
|
|
|
- Bugfixes and features:
|
|
|
|
|
- Check return value of fclose while writing to disk, so we don't
|
|
|
|
|
end up with broken files when servers run out of disk space.
|
|
|
|
|
- Log a warning if the user uses an unsafe socks variant, so people
|
|
|
|
|
are more likely to learn about privoxy or socat.
|
|
|
|
|
- Dirservers now include RFC1123-style dates in the HTTP headers,
|
|
|
|
|
which one day we will use to better detect clock skew.
|
|
|
|
|
|
|
|
|
|
o Changes from 0.0.8pre1:
|
|
|
|
|
- Make it compile without warnings again on win32.
|
|
|
|
|
- Log a warning if you're running an unverified server, to let you
|
|
|
|
|
know you might want to get it verified.
|
|
|
|
|
- Only pick a default nickname if you plan to be a server.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.8pre1 - 2004-07-23
|
2004-07-23 02:35:44 +02:00
|
|
|
o Bugfixes:
|
|
|
|
|
- Made our unit tests compile again on OpenBSD 3.5, and tor
|
|
|
|
|
itself compile again on OpenBSD on a sparc64.
|
|
|
|
|
- We were neglecting milliseconds when logging on win32, so
|
|
|
|
|
everything appeared to happen at the beginning of each second.
|
|
|
|
|
|
|
|
|
|
o Protocol changes:
|
|
|
|
|
- 'Extend' relay cell payloads now include the digest of the
|
|
|
|
|
intended next hop's identity key. Now we can verify that we're
|
|
|
|
|
extending to the right router, and also extend to routers we
|
|
|
|
|
hadn't heard of before.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Tor nodes can now act as relays (with an advertised ORPort)
|
|
|
|
|
without being manually verified by the dirserver operators.
|
|
|
|
|
- Uploaded descriptors of unverified routers are now accepted
|
|
|
|
|
by the dirservers, and included in the directory.
|
|
|
|
|
- Verified routers are listed by nickname in the running-routers
|
|
|
|
|
list; unverified routers are listed as "$<fingerprint>".
|
|
|
|
|
- We now use hash-of-identity-key in most places rather than
|
|
|
|
|
nickname or addr:port, for improved security/flexibility.
|
2007-01-25 23:19:13 +01:00
|
|
|
- To avoid Sybil attacks, paths still use only verified servers.
|
|
|
|
|
But now we have a chance to play around with hybrid approaches.
|
|
|
|
|
- Nodes track bandwidth usage to estimate capacity (not used yet).
|
2004-07-23 02:35:44 +02:00
|
|
|
- ClientOnly option for nodes that never want to become servers.
|
|
|
|
|
- Directory caching.
|
|
|
|
|
- "AuthoritativeDir 1" option for the official dirservers.
|
|
|
|
|
- Now other nodes (clients and servers) will cache the latest
|
|
|
|
|
directory they've pulled down.
|
|
|
|
|
- They can enable their DirPort to serve it to others.
|
|
|
|
|
- Clients will pull down a directory from any node with an open
|
|
|
|
|
DirPort, and check the signature/timestamp correctly.
|
|
|
|
|
- Authoritative dirservers now fetch directories from other
|
|
|
|
|
authdirservers, to stay better synced.
|
|
|
|
|
- Running-routers list tells who's down also, along with noting
|
|
|
|
|
if they're verified (listed by nickname) or unverified (listed
|
|
|
|
|
by hash-of-key).
|
|
|
|
|
- Allow dirservers to serve running-router list separately.
|
|
|
|
|
This isn't used yet.
|
|
|
|
|
- ORs connect-on-demand to other ORs
|
|
|
|
|
- If you get an extend cell to an OR you're not connected to,
|
|
|
|
|
connect, handshake, and forward the create cell.
|
|
|
|
|
- The authoritative dirservers stay connected to everybody,
|
|
|
|
|
and everybody stays connected to 0.0.7 servers, but otherwise
|
|
|
|
|
clients/servers expire unused connections after 5 minutes.
|
|
|
|
|
- When servers get a sigint, they delay 30 seconds (refusing new
|
|
|
|
|
connections) then exit. A second sigint causes immediate exit.
|
|
|
|
|
- File and name management:
|
|
|
|
|
- Look for .torrc if no CONFDIR "torrc" is found.
|
|
|
|
|
- If no datadir is defined, then choose, make, and secure ~/.tor
|
|
|
|
|
as datadir.
|
|
|
|
|
- If torrc not found, exitpolicy reject *:*.
|
|
|
|
|
- Expands ~/ in filenames to $HOME/ (but doesn't yet expand ~arma).
|
|
|
|
|
- If no nickname is defined, derive default from hostname.
|
|
|
|
|
- Rename secret key files, e.g. identity.key -> secret_id_key,
|
|
|
|
|
to discourage people from mailing their identity key to tor-ops.
|
|
|
|
|
- Refuse to build a circuit before the directory has arrived --
|
|
|
|
|
it won't work anyway, since you won't know the right onion keys
|
|
|
|
|
to use.
|
2007-01-25 23:19:13 +01:00
|
|
|
- Try other dirservers immediately if the one you try is down. This
|
|
|
|
|
should tolerate down dirservers better now.
|
2004-07-23 02:35:44 +02:00
|
|
|
- Parse tor version numbers so we can do an is-newer-than check
|
|
|
|
|
rather than an is-in-the-list check.
|
|
|
|
|
- New socks command 'resolve', to let us shim gethostbyname()
|
|
|
|
|
locally.
|
|
|
|
|
- A 'tor_resolve' script to access the socks resolve functionality.
|
|
|
|
|
- A new socks-extensions.txt doc file to describe our
|
|
|
|
|
interpretation and extensions to the socks protocols.
|
|
|
|
|
- Add a ContactInfo option, which gets published in descriptor.
|
2007-01-25 23:19:13 +01:00
|
|
|
- Publish OR uptime in descriptor (and thus in directory) too.
|
2004-07-23 02:35:44 +02:00
|
|
|
- Write tor version at the top of each log file
|
|
|
|
|
- New docs in the tarball:
|
|
|
|
|
- tor-doc.html.
|
|
|
|
|
- Document that you should proxy your SSL traffic too.
|
2004-08-12 08:31:39 +02:00
|
|
|
|
|
|
|
|
|
2004-07-08 04:20:25 +02:00
|
|
|
Changes in version 0.0.7.2 - 2004-07-07
|
|
|
|
|
o A better fix for the 0.0.0.0 problem, that will hopefully
|
|
|
|
|
eliminate the remaining related assertion failures.
|
|
|
|
|
|
|
|
|
|
|
2004-07-04 21:15:11 +02:00
|
|
|
Changes in version 0.0.7.1 - 2004-07-04
|
|
|
|
|
o When an address resolves to 0.0.0.0, treat it as a failed resolve,
|
|
|
|
|
since internally we use 0.0.0.0 to signify "not yet resolved".
|
|
|
|
|
|
|
|
|
|
|
2004-06-07 21:16:35 +02:00
|
|
|
Changes in version 0.0.7 - 2004-06-07
|
2007-01-25 22:39:18 +01:00
|
|
|
o Updated the man page to reflect the new features.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.7rc2 - 2004-06-06
|
|
|
|
|
o Changes from 0.0.7rc1:
|
|
|
|
|
- Make it build on Win32 again.
|
|
|
|
|
o Changes from 0.0.6.2:
|
|
|
|
|
- Rotate dnsworkers and cpuworkers on SIGHUP, so they get new config
|
|
|
|
|
settings too.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.7rc1 - 2004-06-02
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- On sighup, we were adding another log without removing the first
|
|
|
|
|
one. So log messages would get duplicated n times for n sighups.
|
|
|
|
|
- Several cases of using a connection after we'd freed it. The
|
|
|
|
|
problem was that connections that are pending resolve are in both
|
|
|
|
|
the pending_resolve tree, and also the circuit's resolving_streams
|
|
|
|
|
list. When you want to remove one, you must remove it from both.
|
|
|
|
|
- Fix a double-mark-for-close where an end cell arrived for a
|
|
|
|
|
resolving stream, and then the resolve failed.
|
|
|
|
|
- Check directory signatures based on name of signer, not on whom
|
|
|
|
|
we got the directory from. This will let us cache directories more
|
|
|
|
|
easily.
|
|
|
|
|
o Features:
|
|
|
|
|
- Crank up some of our constants to handle more users.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.7pre1 - 2004-06-02
|
2004-06-02 00:42:01 +02:00
|
|
|
o Fixes for crashes and other obnoxious bugs:
|
2004-05-16 10:50:36 +02:00
|
|
|
- Fix an epipe bug: sometimes when directory connections failed
|
|
|
|
|
to connect, we would give them a chance to flush before closing
|
|
|
|
|
them.
|
2004-06-02 00:42:01 +02:00
|
|
|
- When we detached from a circuit because of resolvefailed, we
|
|
|
|
|
would immediately try the same circuit twice more, and then
|
|
|
|
|
give up on the resolve thinking we'd tried three different
|
|
|
|
|
exit nodes.
|
|
|
|
|
- Limit the number of intro circuits we'll attempt to build for a
|
|
|
|
|
hidden service per 15-minute period.
|
|
|
|
|
- Check recommended-software string *early*, before actually parsing
|
|
|
|
|
the directory. Thus we can detect an obsolete version and exit,
|
|
|
|
|
even if the new directory format doesn't parse.
|
|
|
|
|
o Fixes for security bugs:
|
|
|
|
|
- Remember which nodes are dirservers when you startup, and if a
|
|
|
|
|
random OR enables his dirport, don't automatically assume he's
|
|
|
|
|
a trusted dirserver.
|
|
|
|
|
o Other bugfixes:
|
2004-05-16 10:50:36 +02:00
|
|
|
- Directory connections were asking the wrong poll socket to
|
|
|
|
|
start writing, and not asking themselves to start writing.
|
|
|
|
|
- When we detached from a circuit because we sent a begin but
|
|
|
|
|
didn't get a connected, we would use it again the first time;
|
|
|
|
|
but after that we would correctly switch to a different one.
|
|
|
|
|
- Stop warning when the first onion decrypt attempt fails; they
|
|
|
|
|
will sometimes legitimately fail now that we rotate keys.
|
2004-05-28 17:05:48 +02:00
|
|
|
- Override unaligned-access-ok check when $host_cpu is ia64 or
|
|
|
|
|
arm. Apparently they allow it but the kernel whines.
|
|
|
|
|
- Dirservers try to reconnect periodically too, in case connections
|
2004-06-02 00:42:01 +02:00
|
|
|
have failed.
|
|
|
|
|
- Fix some memory leaks in directory servers.
|
2004-05-28 17:05:48 +02:00
|
|
|
- Allow backslash in Win32 filenames.
|
2004-06-02 00:42:01 +02:00
|
|
|
- Made Tor build complain-free on FreeBSD, hopefully without
|
|
|
|
|
breaking other BSD builds. We'll see.
|
2004-05-16 10:50:36 +02:00
|
|
|
o Features:
|
2004-06-02 00:42:01 +02:00
|
|
|
- Doxygen markup on all functions and global variables.
|
2004-05-28 17:05:48 +02:00
|
|
|
- Make directory functions update routerlist, not replace it. So
|
2004-06-02 00:42:01 +02:00
|
|
|
now directory disagreements are not so critical a problem.
|
2004-05-28 17:05:48 +02:00
|
|
|
- Remove the upper limit on number of descriptors in a dirserver's
|
|
|
|
|
directory (not that we were anywhere close).
|
|
|
|
|
- Allow multiple logfiles at different severity ranges.
|
|
|
|
|
- Allow *BindAddress to specify ":port" rather than setting *Port
|
|
|
|
|
separately. Allow multiple instances of each BindAddress config
|
|
|
|
|
option, so you can bind to multiple interfaces if you want.
|
|
|
|
|
- Allow multiple exit policy lines, which are processed in order.
|
|
|
|
|
Now we don't need that huge line with all the commas in it.
|
|
|
|
|
- Enable accept/reject policies on SOCKS connections, so you can bind
|
|
|
|
|
to 0.0.0.0 but still control who can use your OP.
|
|
|
|
|
|
2004-05-16 10:50:36 +02:00
|
|
|
|
|
|
|
|
Changes in version 0.0.6.2 - 2004-05-16
|
|
|
|
|
o Our integrity-checking digest was checking only the most recent cell,
|
|
|
|
|
not the previous cells like we'd thought.
|
2004-05-16 12:58:50 +02:00
|
|
|
Thanks to Stefan Mark for finding the flaw!
|
2004-05-16 10:50:36 +02:00
|
|
|
|
|
|
|
|
|
2004-05-07 00:46:32 +02:00
|
|
|
Changes in version 0.0.6.1 - 2004-05-06
|
|
|
|
|
o Fix two bugs in our AES counter-mode implementation (this affected
|
|
|
|
|
onion-level stream encryption, but not TLS-level). It turns
|
|
|
|
|
out we were doing something much more akin to a 16-character
|
|
|
|
|
polyalphabetic cipher. Oops.
|
2004-05-16 12:58:50 +02:00
|
|
|
Thanks to Stefan Mark for finding the flaw!
|
2004-05-07 00:46:32 +02:00
|
|
|
o Retire moria3 as a directory server, and add tor26 as a directory
|
|
|
|
|
server.
|
|
|
|
|
|
|
|
|
|
|
2004-05-02 21:26:51 +02:00
|
|
|
Changes in version 0.0.6 - 2004-05-02
|
2007-01-25 22:25:22 +01:00
|
|
|
[version bump only]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6rc4 - 2004-05-01
|
|
|
|
|
o Update the built-in dirservers list to use the new directory format
|
|
|
|
|
o Fix a rare seg fault: if a node offering a hidden service attempts
|
|
|
|
|
to build a circuit to Alice's rendezvous point and fails before it
|
|
|
|
|
reaches the last hop, it retries with a different circuit, but
|
|
|
|
|
then dies.
|
|
|
|
|
o Handle windows socket errors correctly.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6rc3 - 2004-04-28
|
|
|
|
|
o Don't expire non-general excess circuits (if we had enough
|
|
|
|
|
circuits open, we were expiring rendezvous circuits -- even
|
|
|
|
|
when they had a stream attached. oops.)
|
|
|
|
|
o Fetch randomness from /dev/urandom better (not via fopen/fread)
|
|
|
|
|
o Better debugging for tls errors
|
|
|
|
|
o Some versions of openssl have an SSL_pending function that erroneously
|
|
|
|
|
returns bytes when there is a non-application record pending.
|
|
|
|
|
o Set Content-Type on the directory and hidserv descriptor.
|
|
|
|
|
o Remove IVs from cipher code, since AES-ctr has none.
|
|
|
|
|
o Win32 fixes. Tor now compiles on win32 with no warnings/errors.
|
|
|
|
|
o We were using an array of length zero in a few places.
|
|
|
|
|
o win32's gethostbyname can't resolve an IP to an IP.
|
|
|
|
|
o win32's close can't close a socket.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6rc2 - 2004-04-26
|
|
|
|
|
o Fix a bug where we were closing tls connections intermittently.
|
|
|
|
|
It turns out openssl keeps its errors around -- so if an error
|
|
|
|
|
happens, and you don't ask about it, and then another openssl
|
|
|
|
|
operation happens and succeeds, and you ask if there was an error,
|
|
|
|
|
it tells you about the first error. Fun fun.
|
|
|
|
|
o Fix a bug that's been lurking since 27 may 03 (!)
|
|
|
|
|
When passing back a destroy cell, we would use the wrong circ id.
|
|
|
|
|
'Mostly harmless', but still worth fixing.
|
|
|
|
|
o Since we don't support truncateds much, don't bother sending them;
|
|
|
|
|
just close the circ.
|
|
|
|
|
o check for <machine/limits.h> so we build on NetBSD again (I hope).
|
|
|
|
|
o don't crash if a conn that sent a begin has suddenly lost its circuit
|
|
|
|
|
(this was quite rare).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6rc1 - 2004-04-25
|
|
|
|
|
o We now rotate link (tls context) keys and onion keys.
|
|
|
|
|
o CREATE cells now include oaep padding, so you can tell
|
|
|
|
|
if you decrypted them correctly.
|
|
|
|
|
o Add bandwidthburst to server descriptor.
|
|
|
|
|
o Directories now say which dirserver signed them.
|
|
|
|
|
o Use a tor_assert macro that logs failed assertions too.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6pre5 - 2004-04-18
|
|
|
|
|
o changes from 0.0.6pre4:
|
|
|
|
|
- make tor build on broken freebsd 5.2 installs
|
|
|
|
|
- fix a failed assert when you try an intro point, get a nack, and try
|
|
|
|
|
a second one and it works.
|
|
|
|
|
- when alice uses a port that the hidden service doesn't accept,
|
|
|
|
|
it now sends back an end cell (denied by exit policy). otherwise
|
|
|
|
|
alice would just have to wait to time out.
|
|
|
|
|
- fix another rare bug: when we had tried all the intro
|
|
|
|
|
points for a hidden service, we fetched the descriptor
|
|
|
|
|
again, but we left our introcirc thinking it had already
|
|
|
|
|
sent an intro, so it kept waiting for a response...
|
|
|
|
|
- bugfix: when you sleep your hidden-service laptop, as soon
|
|
|
|
|
as it wakes up it tries to upload a service descriptor, but
|
|
|
|
|
socketpair fails for some reason (localhost not up yet?).
|
|
|
|
|
now we simply give up on that upload, and we'll try again later.
|
|
|
|
|
i'd still like to find the bug though.
|
|
|
|
|
- if an intro circ waiting for an ack dies before getting one, then
|
|
|
|
|
count it as a nack
|
|
|
|
|
- we were reusing stale service descriptors and refetching usable
|
|
|
|
|
ones. oops.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6pre4 - 2004-04-14
|
|
|
|
|
o changes from 0.0.6pre3:
|
|
|
|
|
- when bob fails to connect to the rendezvous point, and his
|
|
|
|
|
circ didn't fail because of the rendezvous point itself, then
|
|
|
|
|
he retries a couple of times
|
|
|
|
|
- we expire introduction and rendezvous circs more thoroughly
|
|
|
|
|
(sometimes they were hanging around forever)
|
|
|
|
|
- we expire unattached rendezvous streams that have been around
|
|
|
|
|
too long (they were sticking around forever).
|
|
|
|
|
- fix a measly fencepost error that was crashing everybody with
|
|
|
|
|
a strict glibc.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6pre3 - 2004-04-14
|
|
|
|
|
o changes from 0.0.6pre2:
|
|
|
|
|
- make hup work again
|
|
|
|
|
- fix some memory leaks for dirservers
|
|
|
|
|
- allow more skew in rendezvous descriptor timestamps, to help
|
|
|
|
|
handle people like blanu who don't know what time it is
|
|
|
|
|
- normal circs are 3 hops, but some rend/intro circs are 4, if
|
|
|
|
|
the initiator doesn't get to choose the last hop
|
|
|
|
|
- send acks for introductions, so alice can know whether to try
|
|
|
|
|
again
|
|
|
|
|
- bob publishes intro points more correctly
|
|
|
|
|
o changes from 0.0.5:
|
|
|
|
|
- fix an assert trigger that's been plaguing us since the days
|
|
|
|
|
of 0.0.2prexx (thanks weasel!)
|
|
|
|
|
- retry stream correctly when we fail to connect because of
|
|
|
|
|
exit-policy-reject (should try another) or can't-resolve-address
|
|
|
|
|
(also should try another, because dns on random internet servers
|
|
|
|
|
is flaky).
|
|
|
|
|
- when we hup a dirserver and we've *removed* a server from the
|
|
|
|
|
approved-routers list, now we remove that server from the
|
|
|
|
|
in-memory directories too
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6pre2 - 2004-04-08
|
|
|
|
|
o We fixed our base32 implementation. Now it works on all architectures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.6pre1 - 2004-04-08
|
2004-05-02 21:26:51 +02:00
|
|
|
o Features:
|
|
|
|
|
- Hidden services and rendezvous points are implemented. Go to
|
|
|
|
|
http://6sxoyfb3h2nvok2d.onion/ for an index of currently available
|
|
|
|
|
hidden services. (This only works via a socks4a proxy such as
|
|
|
|
|
Privoxy, and currently it's quite slow.)
|
|
|
|
|
|
|
|
|
|
|
2004-03-30 20:39:05 +02:00
|
|
|
Changes in version 0.0.5 - 2004-03-30
|
2007-01-25 22:25:22 +01:00
|
|
|
[version bump only]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.5rc3 - 2004-03-29
|
2004-03-30 20:39:05 +02:00
|
|
|
o Install torrc as torrc.sample -- we no longer clobber your
|
|
|
|
|
torrc. (Woo!)
|
2007-01-25 22:25:22 +01:00
|
|
|
o Re-enable recommendedversion checking (we broke it in rc2, oops)
|
|
|
|
|
o Add in a 'notice' log level for things the operator should hear
|
|
|
|
|
but that aren't warnings
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.5rc2 - 2004-03-29
|
2004-03-30 20:39:05 +02:00
|
|
|
o Hold socks connection open until reply is flushed (if possible)
|
|
|
|
|
o Make exit nodes resolve IPs to IPs immediately, rather than asking
|
|
|
|
|
the dns farm to do it.
|
|
|
|
|
o Fix c99 aliasing warnings in rephist.c
|
|
|
|
|
o Don't include server descriptors that are older than 24 hours in the
|
|
|
|
|
directory.
|
|
|
|
|
o Give socks 'reject' replies their whole 15s to attempt to flush,
|
|
|
|
|
rather than seeing the 60s timeout and assuming the flush had failed.
|
|
|
|
|
o Clean automake droppings from the cvs repository
|
2007-01-25 22:25:22 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.5rc1 - 2004-03-28
|
|
|
|
|
o Fix mangled-state bug in directory fetching (was causing sigpipes).
|
|
|
|
|
o Only build circuits after we've fetched the directory: clients were
|
|
|
|
|
using only the directory servers before they'd fetched a directory.
|
|
|
|
|
This also means longer startup time; so it goes.
|
|
|
|
|
o Fix an assert trigger where an OP would fail to handshake, and we'd
|
|
|
|
|
expect it to have a nickname.
|
|
|
|
|
o Work around a tsocks bug: do a socks reject when AP connection dies
|
|
|
|
|
early, else tsocks goes into an infinite loop.
|
2004-03-30 20:39:05 +02:00
|
|
|
|
|
|
|
|
|
2004-03-26 23:20:48 +01:00
|
|
|
Changes in version 0.0.4 - 2004-03-26
|
|
|
|
|
o When connecting to a dirserver or OR and the network is down,
|
|
|
|
|
we would crash.
|
|
|
|
|
|
|
|
|
|
|
2004-03-26 19:15:31 +01:00
|
|
|
Changes in version 0.0.3 - 2004-03-26
|
|
|
|
|
o Warn and fail if server chose a nickname with illegal characters
|
|
|
|
|
o Port to Solaris and Sparc:
|
|
|
|
|
- include missing header fcntl.h
|
|
|
|
|
- have autoconf find -lsocket -lnsl automatically
|
|
|
|
|
- deal with hardware word alignment
|
|
|
|
|
- make uname() work (solaris has a different return convention)
|
|
|
|
|
- switch from using signal() to sigaction()
|
|
|
|
|
o Preliminary work on reputation system:
|
|
|
|
|
- Keep statistics on success/fail of connect attempts; they're published
|
|
|
|
|
by kill -USR1 currently.
|
|
|
|
|
- Add a RunTesting option to try to learn link state by creating test
|
|
|
|
|
circuits, even when SocksPort is off.
|
|
|
|
|
- Remove unused open circuits when there are too many.
|
|
|
|
|
|
|
|
|
|
|
2004-03-19 08:08:15 +01:00
|
|
|
Changes in version 0.0.2 - 2004-03-19
|
|
|
|
|
- Include strlcpy and strlcat for safer string ops
|
|
|
|
|
- define INADDR_NONE so we compile (but still not run) on solaris
|
|
|
|
|
|
|
|
|
|
|
2004-03-15 05:21:47 +01:00
|
|
|
Changes in version 0.0.2pre27 - 2004-03-14
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Allow internal tor networks (we were rejecting internal IPs,
|
|
|
|
|
now we allow them if they're set explicitly).
|
|
|
|
|
- And fix a few endian issues.
|
|
|
|
|
|
|
|
|
|
|
2004-03-15 02:03:10 +01:00
|
|
|
Changes in version 0.0.2pre26 - 2004-03-14
|
|
|
|
|
o New features:
|
|
|
|
|
- If a stream times out after 15s without a connected cell, don't
|
|
|
|
|
try that circuit again: try a new one.
|
|
|
|
|
- Retry streams at most 4 times. Then give up.
|
|
|
|
|
- When a dirserver gets a descriptor from an unknown router, it
|
|
|
|
|
logs its fingerprint (so the dirserver operator can choose to
|
|
|
|
|
accept it even without mail from the server operator).
|
|
|
|
|
- Inform unapproved servers when we reject their descriptors.
|
|
|
|
|
- Make tor build on Windows again. It works as a client, who knows
|
|
|
|
|
about as a server.
|
|
|
|
|
- Clearer instructions in the torrc for how to set up a server.
|
|
|
|
|
- Be more efficient about reading fd's when our global token bucket
|
|
|
|
|
(used for rate limiting) becomes empty.
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Stop asserting that computers always go forward in time. It's
|
|
|
|
|
simply not true.
|
|
|
|
|
- When we sent a cell (e.g. destroy) and then marked an OR connection
|
|
|
|
|
expired, we might close it before finishing a flush if the other
|
|
|
|
|
side isn't reading right then.
|
|
|
|
|
- Don't allow dirservers to start if they haven't defined
|
|
|
|
|
RecommendedVersions
|
|
|
|
|
- We were caching transient dns failures. Oops.
|
|
|
|
|
- Prevent servers from publishing an internal IP as their address.
|
|
|
|
|
- Address a strcat vulnerability in circuit.c
|
|
|
|
|
|
|
|
|
|
|
2004-03-04 22:40:38 +01:00
|
|
|
Changes in version 0.0.2pre25 - 2004-03-04
|
|
|
|
|
o New features:
|
|
|
|
|
- Put the OR's IP in its router descriptor, not its fqdn. That way
|
|
|
|
|
we'll stop being stalled by gethostbyname for nodes with flaky dns,
|
|
|
|
|
e.g. poblano.
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- If the user typed in an address that didn't resolve, the server
|
|
|
|
|
crashed.
|
|
|
|
|
|
2004-03-15 02:03:10 +01:00
|
|
|
|
2004-03-03 10:41:13 +01:00
|
|
|
Changes in version 0.0.2pre24 - 2004-03-03
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fix an assertion failure in dns.c, where we were trying to dequeue
|
|
|
|
|
a pending dns resolve even if it wasn't pending
|
2004-05-09 18:32:22 +02:00
|
|
|
- Fix a spurious socks5 warning about still trying to write after the
|
|
|
|
|
connection is finished.
|
2004-03-03 10:41:13 +01:00
|
|
|
- Hold certain marked_for_close connections open until they're finished
|
|
|
|
|
flushing, rather than losing bytes by closing them too early.
|
|
|
|
|
- Correctly report the reason for ending a stream
|
|
|
|
|
- Remove some duplicate calls to connection_mark_for_close
|
|
|
|
|
- Put switch_id and start_daemon earlier in the boot sequence, so it
|
|
|
|
|
will actually try to chdir() to options.DataDirectory
|
|
|
|
|
- Make 'make test' exit(1) if a test fails; fix some unit tests
|
|
|
|
|
- Make tor fail when you use a config option it doesn't know about,
|
|
|
|
|
rather than warn and continue.
|
|
|
|
|
- Make --version work
|
|
|
|
|
- Bugfixes on the rpm spec file and tor.sh, so it's more up to date
|
|
|
|
|
|
|
|
|
|
|
2004-02-29 12:13:14 +01:00
|
|
|
Changes in version 0.0.2pre23 - 2004-02-29
|
|
|
|
|
o New features:
|
|
|
|
|
- Print a statement when the first circ is finished, so the user
|
|
|
|
|
knows it's working.
|
|
|
|
|
- If a relay cell is unrecognized at the end of the circuit,
|
|
|
|
|
send back a destroy. (So attacks to mutate cells are more
|
|
|
|
|
clearly thwarted.)
|
|
|
|
|
- New config option 'excludenodes' to avoid certain nodes for circuits.
|
|
|
|
|
- When it daemonizes, it chdir's to the DataDirectory rather than "/",
|
|
|
|
|
so you can collect coredumps there.
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fix a bug in tls flushing where sometimes data got wedged and
|
|
|
|
|
didn't flush until more data got sent. Hopefully this bug was
|
|
|
|
|
a big factor in the random delays we were seeing.
|
|
|
|
|
- Make 'connected' cells include the resolved IP, so the client
|
|
|
|
|
dns cache actually gets populated.
|
|
|
|
|
- Disallow changing from ORPort=0 to ORPort>0 on hup.
|
|
|
|
|
- When we time-out on a stream and detach from the circuit, send an
|
|
|
|
|
end cell down it first.
|
|
|
|
|
- Only warn about an unknown router (in exitnodes, entrynodes,
|
|
|
|
|
excludenodes) after we've fetched a directory.
|
|
|
|
|
|
|
|
|
|
|
2004-02-27 01:55:31 +01:00
|
|
|
Changes in version 0.0.2pre22 - 2004-02-26
|
|
|
|
|
o New features:
|
|
|
|
|
- Servers publish less revealing uname information in descriptors.
|
|
|
|
|
- More memory tracking and assertions, to crash more usefully when
|
|
|
|
|
errors happen.
|
|
|
|
|
- If the default torrc isn't there, just use some default defaults.
|
|
|
|
|
Plus provide an internal dirservers file if they don't have one.
|
|
|
|
|
- When the user tries to use Tor as an http proxy, give them an http
|
|
|
|
|
501 failure explaining that we're a socks proxy.
|
|
|
|
|
- Dump a new router.desc on hup, to help confused people who change
|
|
|
|
|
their exit policies and then wonder why router.desc doesn't reflect
|
|
|
|
|
it.
|
|
|
|
|
- Clean up the generic tor.sh init script that we ship with.
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- If the exit stream is pending on the resolve, and a destroy arrives,
|
|
|
|
|
then the stream wasn't getting removed from the pending list. I
|
|
|
|
|
think this was the one causing recent server crashes.
|
|
|
|
|
- Use a more robust poll on OSX 10.3, since their poll is flaky.
|
|
|
|
|
- When it couldn't resolve any dirservers, it was useless from then on.
|
|
|
|
|
Now it reloads the RouterFile (or default dirservers) if it has no
|
|
|
|
|
dirservers.
|
|
|
|
|
- Move the 'tor' binary back to /usr/local/bin/ -- it turns out
|
|
|
|
|
many users don't even *have* a /usr/local/sbin/.
|
|
|
|
|
|
|
|
|
|
|
2004-02-18 09:54:35 +01:00
|
|
|
Changes in version 0.0.2pre21 - 2004-02-18
|
|
|
|
|
o New features:
|
|
|
|
|
- There's a ChangeLog file that actually reflects the changelog.
|
2004-02-18 10:40:18 +01:00
|
|
|
- There's a 'torify' wrapper script, with an accompanying
|
|
|
|
|
tor-tsocks.conf, that simplifies the process of using tsocks for
|
|
|
|
|
tor. It even has a man page.
|
2004-02-18 09:54:35 +01:00
|
|
|
- The tor binary gets installed to sbin rather than bin now.
|
|
|
|
|
- Retry streams where the connected cell hasn't arrived in 15 seconds
|
2004-05-09 18:32:22 +02:00
|
|
|
- Clean up exit policy handling -- get the default out of the torrc,
|
|
|
|
|
so we can update it without forcing each server operator to fix
|
2004-02-18 09:54:35 +01:00
|
|
|
his/her torrc.
|
|
|
|
|
- Allow imaps and pop3s in default exit policy
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Prevent picking middleman nodes as the last node in the circuit
|
|
|
|
|
|
|
|
|
|
|
2004-02-17 01:31:39 +01:00
|
|
|
Changes in version 0.0.2pre20 - 2004-01-30
|
|
|
|
|
o New features:
|
|
|
|
|
- We now have a deb package, and it's in debian unstable. Go to
|
|
|
|
|
it, apt-getters. :)
|
|
|
|
|
- I've split the TotalBandwidth option into BandwidthRate (how many
|
|
|
|
|
bytes per second you want to allow, long-term) and
|
|
|
|
|
BandwidthBurst (how many bytes you will allow at once before the cap
|
|
|
|
|
kicks in). This better token bucket approach lets you, say, set
|
|
|
|
|
BandwidthRate to 10KB/s and BandwidthBurst to 10MB, allowing good
|
|
|
|
|
performance while not exceeding your monthly bandwidth quota.
|
|
|
|
|
- Push out a tls record's worth of data once you've got it, rather
|
|
|
|
|
than waiting until you've read everything waiting to be read. This
|
|
|
|
|
may improve performance by pipelining better. We'll see.
|
|
|
|
|
- Add an AP_CONN_STATE_CONNECTING state, to allow streams to detach
|
|
|
|
|
from failed circuits (if they haven't been connected yet) and attach
|
|
|
|
|
to new ones.
|
|
|
|
|
- Expire old streams that haven't managed to connect. Some day we'll
|
|
|
|
|
have them reattach to new circuits instead.
|
|
|
|
|
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fix several memory leaks that were causing servers to become bloated
|
|
|
|
|
after a while.
|
|
|
|
|
- Fix a few very rare assert triggers. A few more remain.
|
|
|
|
|
- Setuid to User _before_ complaining about running as root.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.2pre19 - 2004-01-07
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fix deadlock condition in dns farm. We were telling a child to die by
|
|
|
|
|
closing the parent's file descriptor to him. But newer children were
|
|
|
|
|
inheriting the open file descriptor from the parent, and since they
|
|
|
|
|
weren't closing it, the socket never closed, so the child never read
|
|
|
|
|
eof, so he never knew to exit. Similarly, dns workers were holding
|
|
|
|
|
open other sockets, leading to all sorts of chaos.
|
|
|
|
|
- New cleaner daemon() code for forking and backgrounding.
|
|
|
|
|
- If you log to a file, it now prints an entry at the top of the
|
|
|
|
|
logfile so you know it's working.
|
|
|
|
|
- The onionskin challenge length was 30 bytes longer than necessary.
|
|
|
|
|
- Started to patch up the spec so it's not quite so out of date.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.2pre18 - 2004-01-02
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fix endian issues with the 'integrity' field in the relay header.
|
|
|
|
|
- Fix a potential bug where connections in state
|
|
|
|
|
AP_CONN_STATE_CIRCUIT_WAIT might unexpectedly ask to write.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.2pre17 - 2003-12-30
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Made --debuglogfile (or any second log file, actually) work.
|
|
|
|
|
- Resolved an edge case in get_unique_circ_id_by_conn where a smart
|
|
|
|
|
adversary could force us into an infinite loop.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Each onionskin handshake now includes a hash of the computed key,
|
|
|
|
|
to prove the server's identity and help perfect forward secrecy.
|
|
|
|
|
- Changed cell size from 256 to 512 bytes (working toward compatibility
|
|
|
|
|
with MorphMix).
|
|
|
|
|
- Changed cell length to 2 bytes, and moved it to the relay header.
|
|
|
|
|
- Implemented end-to-end integrity checking for the payloads of
|
|
|
|
|
relay cells.
|
|
|
|
|
- Separated streamid from 'recognized' (otherwise circuits will get
|
|
|
|
|
messed up when we try to have streams exit from the middle). We
|
|
|
|
|
use the integrity-checking to confirm that a cell is addressed to
|
|
|
|
|
this hop.
|
|
|
|
|
- Randomize the initial circid and streamid values, so an adversary who
|
|
|
|
|
breaks into a node can't learn how many circuits or streams have
|
|
|
|
|
been made so far.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.2pre16 - 2003-12-14
|
|
|
|
|
o Bugfixes:
|
|
|
|
|
- Fixed a bug that made HUP trigger an assert
|
|
|
|
|
- Fixed a bug where a circuit that immediately failed wasn't being
|
|
|
|
|
counted as a failed circuit in counting retries.
|
|
|
|
|
|
|
|
|
|
o Features:
|
|
|
|
|
- Now we close the circuit when we get a truncated cell: otherwise we're
|
|
|
|
|
open to an anonymity attack where a bad node in the path truncates
|
|
|
|
|
the circuit and then we open streams at him.
|
|
|
|
|
- Add port ranges to exit policies
|
|
|
|
|
- Add a conservative default exit policy
|
|
|
|
|
- Warn if you're running tor as root
|
|
|
|
|
- on HUP, retry OR connections and close/rebind listeners
|
|
|
|
|
- options.EntryNodes: try these nodes first when picking the first node
|
|
|
|
|
- options.ExitNodes: if your best choices happen to include any of
|
|
|
|
|
your preferred exit nodes, you choose among just those preferred
|
|
|
|
|
exit nodes.
|
|
|
|
|
- options.ExcludedNodes: nodes that are never picked in path building
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.2pre15 - 2003-12-03
|
|
|
|
|
o Robustness and bugfixes:
|
|
|
|
|
- Sometimes clients would cache incorrect DNS resolves, which would
|
|
|
|
|
really screw things up.
|
|
|
|
|
- An OP that goes offline would slowly leak all its sockets and stop
|
|
|
|
|
working.
|
|
|
|
|
- A wide variety of bugfixes in exit node selection, exit policy
|
|
|
|
|
handling, and processing pending streams when a new circuit is
|
|
|
|
|
established.
|
|
|
|
|
- Pick nodes for a path only from those the directory says are up
|
|
|
|
|
- Choose randomly from all running dirservers, not always the first one
|
|
|
|
|
- Increase allowed http header size for directory fetch.
|
|
|
|
|
- Stop writing to stderr (if we're daemonized it will be closed).
|
|
|
|
|
- Enable -g always, so cores will be more useful to me.
|
|
|
|
|
- Switch "-lcrypto -lssl" to "-lssl -lcrypto" for broken distributions.
|
|
|
|
|
|
|
|
|
|
o Documentation:
|
|
|
|
|
- Wrote a man page. It lists commonly used options.
|
|
|
|
|
|
|
|
|
|
o Configuration:
|
|
|
|
|
- Change default loglevel to warn.
|
|
|
|
|
- Make PidFile default to null rather than littering in your CWD.
|
|
|
|
|
- OnionRouter config option is now obsolete. Instead it just checks
|
|
|
|
|
ORPort>0.
|
|
|
|
|
- Moved to a single unified torrc file for both clients and servers.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Changes in version 0.0.2pre14 - 2003-11-29
|
|
|
|
|
o Robustness and bugfixes:
|
|
|
|
|
- Force the admin to make the DataDirectory himself
|
|
|
|
|
- to get ownership/permissions right
|
|
|
|
|
- so clients no longer make a DataDirectory and then never use it
|
|
|
|
|
- fix bug where a client who was offline for 45 minutes would never
|
|
|
|
|
pull down a directory again
|
|
|
|
|
- fix (or at least hide really well) the dns assert bug that was
|
|
|
|
|
causing server crashes
|
|
|
|
|
- warnings and improved robustness wrt clockskew for certs
|
|
|
|
|
- use the native daemon(3) to daemonize, when available
|
|
|
|
|
- exit if bind() fails
|
|
|
|
|
- exit if neither socksport nor orport is defined
|
|
|
|
|
- include our own tor_timegm (Win32 doesn't have its own)
|
|
|
|
|
- bugfix for win32 with lots of connections
|
|
|
|
|
- fix minor bias in PRNG
|
|
|
|
|
- make dirserver more robust to corrupt cached directory
|
|
|
|
|
|
|
|
|
|
o Documentation:
|
|
|
|
|
- Wrote the design document (woo)
|
|
|
|
|
|
|
|
|
|
o Circuit building and exit policies:
|
|
|
|
|
- Circuits no longer try to use nodes that the directory has told them
|
|
|
|
|
are down.
|
|
|
|
|
- Exit policies now support bitmasks (18.0.0.0/255.0.0.0) and
|
|
|
|
|
bitcounts (18.0.0.0/8).
|
|
|
|
|
- Make AP connections standby for a circuit if no suitable circuit
|
|
|
|
|
exists, rather than failing
|
|
|
|
|
- Circuits choose exit node based on addr/port, exit policies, and
|
|
|
|
|
which AP connections are standing by
|
|
|
|
|
- Bump min pathlen from 2 to 3
|
|
|
|
|
- Relay end cells have a payload to describe why the stream ended.
|
|
|
|
|
- If the stream failed because of exit policy, try again with a new
|
|
|
|
|
circuit.
|
|
|
|
|
- Clients have a dns cache to remember resolved addresses.
|
|
|
|
|
- Notice more quickly when we have no working circuits
|
|
|
|
|
|
|
|
|
|
o Configuration:
|
|
|
|
|
- APPort is now called SocksPort
|
|
|
|
|
- SocksBindAddress, ORBindAddress, DirBindAddress let you configure
|
|
|
|
|
where to bind
|
|
|
|
|
- RecommendedVersions is now a config variable rather than
|
|
|
|
|
hardcoded (for dirservers)
|
|
|
|
|
- Reloads config on HUP
|
|
|
|
|
- Usage info on -h or --help
|
|
|
|
|
- If you set User and Group config vars, it'll setu/gid to them.
|
2004-06-23 22:45:12 +02:00
|
|
|
|
2008-06-07 07:24:47 +02:00
|
|
|
|
2004-06-23 22:45:12 +02:00
|
|
|
Changes in version 0.0.2pre13 - 2003-10-19
|
|
|
|
|
o General stability:
|
|
|
|
|
- SSL_write no longer fails when it returns WANTWRITE and the number
|
|
|
|
|
of bytes in the buf has changed by the next SSL_write call.
|
|
|
|
|
- Fix segfault fetching directory when network is down
|
|
|
|
|
- Fix a variety of minor memory leaks
|
|
|
|
|
- Dirservers reload the fingerprints file on HUP, so I don't have
|
|
|
|
|
to take down the network when I approve a new router
|
|
|
|
|
- Default server config file has explicit Address line to specify fqdn
|
|
|
|
|
|
|
|
|
|
o Buffers:
|
|
|
|
|
- Buffers grow and shrink as needed (Cut process size from 20M to 2M)
|
|
|
|
|
- Make listener connections not ever alloc bufs
|
|
|
|
|
|
|
|
|
|
o Autoconf improvements:
|
|
|
|
|
- don't clobber an external CFLAGS in ./configure
|
|
|
|
|
- Make install now works
|
|
|
|
|
- create var/lib/tor on make install
|
|
|
|
|
- autocreate a tor.sh initscript to help distribs
|
|
|
|
|
- autocreate the torrc and sample-server-torrc with correct paths
|
|
|
|
|
|
|
|
|
|
o Log files and Daemonizing now work:
|
|
|
|
|
- If --DebugLogFile is specified, log to it at -l debug
|
|
|
|
|
- If --LogFile is specified, use it instead of commandline
|
|
|
|
|
- If --RunAsDaemon is set, tor forks and backgrounds on startup
|
|
|
|
|
|
