mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-27 13:53:31 +01:00
Re-wrap the 0.2.5.5-alpha changelog
This commit is contained in:
parent
565c9d436f
commit
a94a39ffc1
101
ChangeLog
101
ChangeLog
@ -1,22 +1,24 @@
|
|||||||
Changes in version 0.2.5.5-alpha - 2014-06-1?
|
Changes in version 0.2.5.5-alpha - 2014-06-1?
|
||||||
Tor 0.2.5.5-alpha fixes a wide variety of remaining issues in the Tor
|
Tor 0.2.5.5-alpha fixes a wide variety of remaining issues in the Tor
|
||||||
0.2.5.x release series, including a couple of DoS issues, some performance
|
0.2.5.x release series, including a couple of DoS issues, some
|
||||||
regressions, and a large number of bugs affecting the Linux
|
performance regressions, and a large number of bugs affecting the
|
||||||
seccomp2 sandbox code, and various other bugfixes. It also adds diagnostic
|
Linux seccomp2 sandbox code, and various other bugfixes. It also adds
|
||||||
bugfixes for a few tricky issues that we're trying to track down.
|
diagnostic bugfixes for a few tricky issues that we're trying to
|
||||||
|
track down.
|
||||||
|
|
||||||
o Major features (security, traffic analysis resistance):
|
o Major features (security, traffic analysis resistance):
|
||||||
- Several major improvements to the algorithm used to decide
|
- Several major improvements to the algorithm used to decide when to
|
||||||
when to close TLS connections. Previous versions of Tor closed connections
|
close TLS connections. Previous versions of Tor closed connections
|
||||||
at a fixed interval after the last time a non-padding cell was sent
|
at a fixed interval after the last time a non-padding cell was
|
||||||
over the connection, regardless of the target of the connection. Now,
|
sent over the connection, regardless of the target of the
|
||||||
we randomize the intervals by adding up to 50% of their base value,
|
connection. Now, we randomize the intervals by adding up to 50% of
|
||||||
we measure the length of time since connection last had at least one
|
their base value, we measure the length of time since connection
|
||||||
circuit, and we we allow connections to known ORs to remain open a
|
last had at least one circuit, and we we allow connections to
|
||||||
little longer (15 minutes instead of 3 minutes minimum). These changes
|
known ORs to remain open a little longer (15 minutes instead of 3
|
||||||
should improve Tor's resistance against some kinds of traffic analysis,
|
minutes minimum). These changes should improve Tor's resistance
|
||||||
and lower some overhead from needlessly closed connections. Fixes
|
against some kinds of traffic analysis, and lower some overhead
|
||||||
ticket 6799. Incidentally fixes ticket 12023; bugfix on 0.2.5.1-alpha.
|
from needlessly closed connections. Fixes ticket 6799.
|
||||||
|
Incidentally fixes ticket 12023; bugfix on 0.2.5.1-alpha.
|
||||||
|
|
||||||
o Major bugfixes (security, OOM, new since 0.2.5.4-alpha, also in 0.2.4.22):
|
o Major bugfixes (security, OOM, new since 0.2.5.4-alpha, also in 0.2.4.22):
|
||||||
- Fix a memory leak that could occur if a microdescriptor parse
|
- Fix a memory leak that could occur if a microdescriptor parse
|
||||||
@ -41,15 +43,16 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
router's identity is not forgeable.
|
router's identity is not forgeable.
|
||||||
|
|
||||||
o Major bugfixes (relay):
|
o Major bugfixes (relay):
|
||||||
- Use a direct dirport connection when uploading non-anonymous descriptors to the directory authorities.
|
- Use a direct dirport connection when uploading non-anonymous
|
||||||
object. Previously, relays would incorrectly use tunnel connections
|
descriptors to the directory authorities. object. Previously,
|
||||||
under a fairly wide variety of circumstances. Fixes bug 11469; bugfix
|
relays would incorrectly use tunnel connections under a fairly
|
||||||
|
wide variety of circumstances. Fixes bug 11469; bugfix
|
||||||
on 0.2.4.3-alpha.
|
on 0.2.4.3-alpha.
|
||||||
- When a circuit accidentally has the same circuit ID for its
|
- When a circuit accidentally has the same circuit ID for its
|
||||||
forward and reverse direction, correctly detect the direction of
|
forward and reverse direction, correctly detect the direction of
|
||||||
cells using that circuit. Previously, this bug made roughly
|
cells using that circuit. Previously, this bug made roughly one
|
||||||
one circuit in a million non-functional. Fixes bug 12195; this is
|
circuit in a million non-functional. Fixes bug 12195; this is a
|
||||||
a bugfix on every version of Tor.
|
bugfix on every version of Tor.
|
||||||
|
|
||||||
o Major bugfixes (client, pluggable transports):
|
o Major bugfixes (client, pluggable transports):
|
||||||
- When managing pluggable transports, use OS notification facilities
|
- When managing pluggable transports, use OS notification facilities
|
||||||
@ -58,17 +61,17 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
on 0.2.3.6-alpha.
|
on 0.2.3.6-alpha.
|
||||||
|
|
||||||
o Minor features (diagnostic):
|
o Minor features (diagnostic):
|
||||||
- When logging a warning because of bug 7164, additionally check
|
- When logging a warning because of bug 7164, additionally check the
|
||||||
the hash table for consistency (as proposed on ticket 11737).
|
hash table for consistency (as proposed on ticket 11737). This may
|
||||||
This may help diagnose bug 7164.
|
help diagnose bug 7164.
|
||||||
- When we log a heartbeat, log how many one-hop circuits we have
|
- When we log a heartbeat, log how many one-hop circuits we have
|
||||||
that are at least 30 minutes old, and log status information about
|
that are at least 30 minutes old, and log status information about
|
||||||
a few of them. This is an attempt to track down bug 8387.
|
a few of them. This is an attempt to track down bug 8387.
|
||||||
- When encountering an unexpected CR while writing text to a
|
- When encountering an unexpected CR while writing text to a file on
|
||||||
file on Windows, log the name of the file. Should help
|
Windows, log the name of the file. Should help diagnosing
|
||||||
diagnosing bug 11233.
|
bug 11233.
|
||||||
- Give more specific warnings when a client notices that
|
- Give more specific warnings when a client notices that an onion
|
||||||
an onion handshake has failed. Fixes ticket 9635.
|
handshake has failed. Fixes ticket 9635.
|
||||||
- Add significant new logging code to attempt to diagnose bug 12184,
|
- Add significant new logging code to attempt to diagnose bug 12184,
|
||||||
where relays seem to run out of available circuit IDs.
|
where relays seem to run out of available circuit IDs.
|
||||||
- Improve the diagnostic log message for bug 8387 even further to
|
- Improve the diagnostic log message for bug 8387 even further to
|
||||||
@ -76,13 +79,12 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
circuits sometimes do not get closed.
|
circuits sometimes do not get closed.
|
||||||
|
|
||||||
o Minor features (security, memory management):
|
o Minor features (security, memory management):
|
||||||
- Memory allocation tricks (mempools and buffer freelists)
|
- Memory allocation tricks (mempools and buffer freelists) are now
|
||||||
are now disabled by default. You can turn them back on with
|
disabled by default. You can turn them back on with
|
||||||
--enable-mempools and --enable-buf-freelists respectively.
|
--enable-mempools and --enable-buf-freelists respectively. We're
|
||||||
We're disabling these features because malloc performance is good
|
disabling these features because malloc performance is good enough
|
||||||
enough on most platforms, and a
|
on most platforms, and a similar feature in OpenSSL exacerbated
|
||||||
similar feature in OpenSSL exacerbated exploitation of the Heartbleed
|
exploitation of the Heartbleed attack. Resolves ticket 11476.
|
||||||
attack. Resolves ticket 11476.
|
|
||||||
|
|
||||||
o Minor features (security):
|
o Minor features (security):
|
||||||
- Apply the secure SipHash-2-4 function to the hash table mapping
|
- Apply the secure SipHash-2-4 function to the hash table mapping
|
||||||
@ -106,15 +108,14 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
bugfix on 0.2.1.1-alpha.
|
bugfix on 0.2.1.1-alpha.
|
||||||
|
|
||||||
o Minor bugfixes (performance):
|
o Minor bugfixes (performance):
|
||||||
- Avoid a bug where every successful connection made us recompute the
|
- Avoid a bug where every successful connection made us recompute
|
||||||
flag telling us whether we have sufficient information to build
|
the flag telling us whether we have sufficient information to
|
||||||
circuits. Previously,
|
build circuits. Previously, we would forget our cached value
|
||||||
we would forget our cached value
|
|
||||||
successfully opened a channel (or marked a router as running or
|
successfully opened a channel (or marked a router as running or
|
||||||
not running for any other reason), regardless of whether we had
|
not running for any other reason), regardless of whether we had
|
||||||
previously believed the router to be running. This forced us to
|
previously believed the router to be running. This forced us to
|
||||||
run an expensive update operation far too often.
|
run an expensive update operation far too often. Fixes bug 12170;
|
||||||
Fixes bug 12170; bugfix on 0.1.2.1-alpha.
|
bugfix on 0.1.2.1-alpha.
|
||||||
- Avoid using tor_memeq() for checking relay cell integrity. This
|
- Avoid using tor_memeq() for checking relay cell integrity. This
|
||||||
removes a possible performance bottleneck. Fixes part of bug
|
removes a possible performance bottleneck. Fixes part of bug
|
||||||
12169; bugfix on 0.2.1.31.
|
12169; bugfix on 0.2.1.31.
|
||||||
@ -179,9 +180,9 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
- Avoid warnings when running with sandboxing enabled at the same
|
- Avoid warnings when running with sandboxing enabled at the same
|
||||||
time as cookie authentication, hidden services or directory
|
time as cookie authentication, hidden services or directory
|
||||||
authority voting. Fixes part of 12064; bugfix on 0.2.5.1-alpha.
|
authority voting. Fixes part of 12064; bugfix on 0.2.5.1-alpha.
|
||||||
- Do not allow options that require calls to exec to be
|
- Do not allow options that require calls to exec to be enabled
|
||||||
enabled alongside the seccomp2 sandbox: they will inevitably
|
alongside the seccomp2 sandbox: they will inevitably crash. Fixes
|
||||||
crash. Fixes bug 12043; bugfix on 0.2.5.1-alpha.
|
bug 12043; bugfix on 0.2.5.1-alpha.
|
||||||
- Handle failures in getpwnam()/getpwuid() when running with the
|
- Handle failures in getpwnam()/getpwuid() when running with the
|
||||||
User option set and the Linux syscall sandbox enabled. Fixes bug
|
User option set and the Linux syscall sandbox enabled. Fixes bug
|
||||||
11946; bugfix on 0.2.5.1-alpha.
|
11946; bugfix on 0.2.5.1-alpha.
|
||||||
@ -255,8 +256,8 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
v2 link handshake. Fixes bug 12227; bugfix on 0.2.4.8-alpha. Found
|
v2 link handshake. Fixes bug 12227; bugfix on 0.2.4.8-alpha. Found
|
||||||
by "starlight".
|
by "starlight".
|
||||||
- When rejecting DATA cells for stream_id zero, still count them
|
- When rejecting DATA cells for stream_id zero, still count them
|
||||||
against the circuit's deliver window so that we don't fail to
|
against the circuit's deliver window so that we don't fail to send
|
||||||
send a SENDME. Fixes bug 11246; bugfix on 0.2.4.10-alpha.
|
a SENDME. Fixes bug 11246; bugfix on 0.2.4.10-alpha.
|
||||||
|
|
||||||
o Minor bugfixes (logging):
|
o Minor bugfixes (logging):
|
||||||
- Fix a misformatted log message about delayed directory fetches.
|
- Fix a misformatted log message about delayed directory fetches.
|
||||||
@ -285,9 +286,9 @@ Changes in version 0.2.5.5-alpha - 2014-06-1?
|
|||||||
caches don't get confused.
|
caches don't get confused.
|
||||||
|
|
||||||
o Package cleanup:
|
o Package cleanup:
|
||||||
- The contrib directory has been sorted and tidied. Before, it was an
|
- The contrib directory has been sorted and tidied. Before, it was
|
||||||
unsorted dumping ground for useful and not-so-useful things. Now,
|
an unsorted dumping ground for useful and not-so-useful things.
|
||||||
it is divided based on functionality, and the items which
|
Now, it is divided based on functionality, and the items which
|
||||||
seemed to be nonfunctional or useless have been removed. Resolves
|
seemed to be nonfunctional or useless have been removed. Resolves
|
||||||
ticket 8966; based on patches from "rl1987".
|
ticket 8966; based on patches from "rl1987".
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user