forward-port the 0.1.2.13 changelog and releasenotes

svn:r10018

ChangeLog

@@ -104,6 +104,15 @@ Changes in version 0.2.0.1-alpha - 2007-??-??
       so the caller doesn't have to.
     - Rename wants_to_read and wants_to_write to read/write_blocked_on_bw.
 
+
+Changes in version 0.1.2.13 - 2007-04-24
+  o Minor fixes:
+    - Fix a memory leak when we ask for "all" networkstatuses and we
+      get one we don't recognize.
+    - Add more asserts to hunt down bug 417.
+    - Disable kqueue on OS X 10.3 and earlier, to fix bug 371.
+
+
 Changes in version 0.1.2.12-rc - 2007-03-16
   o Major bugfixes:
     - Fix an infinite loop introduced in 0.1.2.7-alpha when we serve
@@ -517,7 +526,7 @@ Changes in version 0.1.2.5-alpha - 2007-01-06
 
   o Minor features (directory):
     - Authorities now specify server versions in networkstatus. This adds
-      about 2% to the side of compressed networkstatus docs, and allows
+      about 2% to the size of compressed networkstatus docs, and allows
       clients to tell which servers support BEGIN_DIR and which don't.
       The implementation is forward-compatible with a proposed future
       protocol version scheme not tied to Tor versions.
@@ -1763,7 +1772,6 @@ Changes in version 0.1.0.16 - 2006-01-02
     - Do not check whether DirPort is reachable when we are suppressing
       advertising it because of hibernation.
     - When building with -static or on Solaris, we sometimes needed -ldl.
-    - One of the dirservers (tor26) changed its IP address.
     - When we're deciding whether a stream has enough circuits around
       that can handle it, count the freshly dirty ones and not the ones
       that are so dirty they won't be able to handle it.

ReleaseNotes

@@ -3,6 +3,570 @@ This document summarizes new features and bugfixes in each stable release
 of Tor. If you want to see more detailed descriptions of the changes in
 each development snapshot, see the ChangeLog file.
 
+Changes in version 0.1.2.13 - 2007-04-24
+
+Tor 0.1.2.13 is released in memory of Rob Levin (1955-2006), aka lilo
+of the Freenode IRC network, remembering his patience and vision for
+free speech on the Internet.
+
+  o Major features, client performance:
+    - Weight directory requests by advertised bandwidth. Now we can
+      let servers enable write limiting but still allow most clients to
+      succeed at their directory requests. (We still ignore weights when
+      choosing a directory authority; I hope this is a feature.)
+    - Stop overloading exit nodes -- avoid choosing them for entry or
+      middle hops when the total bandwidth available from non-exit nodes
+      is much higher than the total bandwidth available from exit nodes.
+    - Rather than waiting a fixed amount of time between retrying
+      application connections, we wait only 10 seconds for the first,
+      10 seconds for the second, and 15 seconds for each retry after
+      that. Hopefully this will improve the expected user experience.
+    - Sometimes we didn't bother sending a RELAY_END cell when an attempt
+      to open a stream fails; now we do in more cases. This should
+      make clients able to find a good exit faster in some cases, since
+      unhandleable requests will now get an error rather than timing out.
+
+  o Major features, client functionality:
+    - Implement BEGIN_DIR cells, so we can connect to a directory
+      server via TLS to do encrypted directory requests rather than
+      plaintext. Enable via the TunnelDirConns and PreferTunneledDirConns
+      config options if you like. For now, this feature only works if
+      you already have a descriptor for the destination dirserver.
+    - Add support for transparent application connections: this basically
+      bundles the functionality of trans-proxy-tor into the Tor
+      mainline. Now hosts with compliant pf/netfilter implementations
+      can redirect TCP connections straight to Tor without diverting
+      through SOCKS. (Based on patch from tup.)
+    - Add support for using natd; this allows FreeBSDs earlier than
+      5.1.2 to have ipfw send connections through Tor without using
+      SOCKS. (Patch from Zajcev Evgeny with tweaks from tup.)
+
+  o Major features, servers:
+    - Setting up a dyndns name for your server is now optional: servers
+      with no hostname or IP address will learn their IP address by
+      asking the directory authorities. This code only kicks in when you
+      would normally have exited with a "no address" error. Nothing's
+      authenticated, so use with care.
+    - Directory servers now spool server descriptors, v1 directories,
+      and v2 networkstatus objects to buffers as needed rather than en
+      masse. They also mmap the cached-routers files. These steps save
+      lots of memory.
+    - Stop requiring clients to have well-formed certificates, and stop
+      checking nicknames in certificates. (Clients have certificates so
+      that they can look like Tor servers, but in the future we might want
+      to allow them to look like regular TLS clients instead. Nicknames
+      in certificates serve no purpose other than making our protocol
+      easier to recognize on the wire.) Implements proposal 106.
+
+  o Improvements on DNS support:
+    - Add "eventdns" asynchronous dns library originally based on code
+      from Adam Langley. Now we can discard the old rickety dnsworker
+      concept, and support a wider variety of DNS functions. Allows
+      multithreaded builds on NetBSD and OpenBSD again.
+    - Add server-side support for "reverse" DNS lookups (using PTR
+      records so clients can determine the canonical hostname for a given
+      IPv4 address). Only supported by servers using eventdns; servers
+      now announce in their descriptors if they don't support eventdns.
+    - Workaround for name servers (like Earthlink's) that hijack failing
+      DNS requests and replace the no-such-server answer with a "helpful"
+      redirect to an advertising-driven search portal. Also work around
+      DNS hijackers who "helpfully" decline to hijack known-invalid
+      RFC2606 addresses. Config option "ServerDNSDetectHijacking 0"
+      lets you turn it off.
+    - Servers now check for the case when common DNS requests are going to
+      wildcarded addresses (i.e. all getting the same answer), and change
+      their exit policy to reject *:* if it's happening.
+    - When asked to resolve a hostname, don't use non-exit servers unless
+      requested to do so. This allows servers with broken DNS to be
+      useful to the network.
+    - Start passing "ipv4" hints to getaddrinfo(), so servers don't do
+      useless IPv6 DNS resolves.
+    - Specify and implement client-side SOCKS5 interface for reverse DNS
+      lookups (see doc/socks-extensions.txt). Also cache them.
+    - When we change nameservers or IP addresses, reset and re-launch
+      our tests for DNS hijacking.
+
+  o Improvements on reachability testing:
+    - Servers send out a burst of long-range padding cells once they've
+      established that they're reachable. Spread them over 4 circuits,
+      so hopefully a few will be fast. This exercises bandwidth and
+      bootstraps them into the directory more quickly.
+    - When we find our DirPort to be reachable, publish a new descriptor
+      so we'll tell the world (reported by pnx).
+    - Directory authorities now only decide that routers are reachable
+      if their identity keys are as expected.
+    - Do DirPort reachability tests less often, since a single test
+      chews through many circuits before giving up.
+    - Avoid some false positives during reachability testing: don't try
+      to test via a server that's on the same /24 network as us.
+    - Start publishing one minute or so after we find our ORPort
+      to be reachable. This will help reduce the number of descriptors
+      we have for ourselves floating around, since it's quite likely
+      other things (e.g. DirPort) will change during that minute too.
+    - Routers no longer try to rebuild long-term connections to directory
+      authorities, and directory authorities no longer try to rebuild
+      long-term connections to all servers. We still don't hang up
+      connections in these two cases though -- we need to look at it
+      more carefully to avoid flapping, and we likely need to wait til
+      0.1.1.x is obsolete.
+
+  o Improvements on rate limiting:
+    - Enable write limiting as well as read limiting. Now we sacrifice
+      capacity if we're pushing out lots of directory traffic, rather
+      than overrunning the user's intended bandwidth limits.
+    - Include TLS overhead when counting bandwidth usage; previously, we
+      would count only the bytes sent over TLS, but not the bytes used
+      to send them.
+    - Servers decline directory requests much more aggressively when
+      they're low on bandwidth. Otherwise they end up queueing more and
+      more directory responses, which can't be good for latency.
+    - But never refuse directory requests from local addresses.
+    - Be willing to read or write on local connections (e.g. controller
+      connections) even when the global rate limiting buckets are empty.
+    - Flush local controller connection buffers periodically as we're
+      writing to them, so we avoid queueing 4+ megabytes of data before
+      trying to flush.
+    - Revise and clean up the torrc.sample that we ship with; add
+      a section for BandwidthRate and BandwidthBurst.
+
+  o Major features, NT services:
+    - Install as NT_AUTHORITY\LocalService rather than as SYSTEM; add a
+      command-line flag so that admins can override the default by saying
+      "tor --service install --user "SomeUser"". This will not affect
+      existing installed services. Also, warn the user that the service
+      will look for its configuration file in the service user's
+      %appdata% directory. (We can't do the "hardwire the user's appdata
+      directory" trick any more, since we may not have read access to that
+      directory.)
+    - Support running the Tor service with a torrc not in the same
+      directory as tor.exe and default to using the torrc located in
+      the %appdata%\Tor\ of the user who installed the service. Patch
+      from Matt Edman.
+    - Add an --ignore-missing-torrc command-line option so that we can
+      get the "use sensible defaults if the configuration file doesn't
+      exist" behavior even when specifying a torrc location on the
+      command line.
+    - When stopping an NT service, wait up to 10 sec for it to actually
+      stop. (Patch from Matt Edman; resolves bug 295.)
+
+  o Directory authority improvements:
+    - Stop letting hibernating or obsolete servers affect uptime and
+      bandwidth cutoffs.
+    - Stop listing hibernating servers in the v1 directory.
+    - Authorities no longer recommend exits as guards if this would shift
+      too much load to the exit nodes.
+    - Authorities now specify server versions in networkstatus. This adds
+      about 2% to the size of compressed networkstatus docs, and allows
+      clients to tell which servers support BEGIN_DIR and which don't.
+      The implementation is forward-compatible with a proposed future
+      protocol version scheme not tied to Tor versions.
+    - DirServer configuration lines now have an orport= option so
+      clients can open encrypted tunnels to the authorities without
+      having downloaded their descriptors yet. Enabled for moria1,
+      moria2, tor26, and lefkada now in the default configuration.
+    - Add a BadDirectory flag to network status docs so that authorities
+      can (eventually) tell clients about caches they believe to be
+      broken. Not used yet.
+    - Allow authorities to list nodes as bad exits in their
+      approved-routers file by fingerprint or by address. If most
+      authorities set a BadExit flag for a server, clients don't think
+      of it as a general-purpose exit. Clients only consider authorities
+      that advertise themselves as listing bad exits.
+    - Patch from Steve Hildrey: Generate network status correctly on
+      non-versioning dirservers.
+    - Have directory authorities allow larger amounts of drift in uptime
+      without replacing the server descriptor: previously, a server that
+      restarted every 30 minutes could have 48 "interesting" descriptors
+      per day.
+    - Reserve the nickname "Unnamed" for routers that can't pick
+      a hostname: any router can call itself Unnamed; directory
+      authorities will never allocate Unnamed to any particular router;
+      clients won't believe that any router is the canonical Unnamed.
+
+  o Directory mirrors and clients:
+    - Discard any v1 directory info that's over 1 month old (for
+      directories) or over 1 week old (for running-routers lists).
+    - Clients track responses with status 503 from dirservers. After a
+      dirserver has given us a 503, we try not to use it until an hour has
+      gone by, or until we have no dirservers that haven't given us a 503.
+    - When we get a 503 from a directory, and we're not a server, we no
+      longer count the failure against the total number of failures
+      allowed for the object we're trying to download.
+    - Prepare for servers to publish descriptors less often: never
+      discard a descriptor simply for being too old until either it is
+      recommended by no authorities, or until we get a better one for
+      the same router. Make caches consider retaining old recommended
+      routers for even longer.
+    - Directory servers now provide 'Pragma: no-cache' and 'Expires'
+      headers for content, so that we can work better in the presence of
+      caching HTTP proxies.
+    - Stop fetching descriptors if you're not a dir mirror and you
+      haven't tried to establish any circuits lately. (This currently
+      causes some dangerous behavior, because when you start up again
+      you'll use your ancient server descriptors.)
+
+  o Major fixes, crashes:
+    - Stop crashing when the controller asks us to resetconf more than
+      one config option at once. (Vidalia 0.0.11 does this.)
+    - Fix a longstanding obscure crash bug that could occur when we run
+      out of DNS worker processes, if we're not using eventdns. (Resolves
+      bug 390.)
+    - Fix an assert that could trigger if a controller quickly set then
+      cleared EntryNodes. (Bug found by Udo van den Heuvel.)
+    - Avoid crash when telling controller about stream-status and a
+      stream is detached.
+    - Avoid sending junk to controllers or segfaulting when a controller
+      uses EVENT_NEW_DESC with verbose nicknames.
+    - Stop triggering asserts if the controller tries to extend hidden
+      service circuits (reported by mwenge).
+    - If we start a server with ClientOnly 1, then set ClientOnly to 0
+      and hup, stop triggering an assert based on an empty onion_key.
+    - Mask out all signals in sub-threads; only the libevent signal
+      handler should be processing them. This should prevent some crashes
+      on some machines using pthreads. (Patch from coderman.)
+    - Disable kqueue on OS X 10.3 and earlier, to fix bug 371.
+
+  o Major fixes, anonymity/security:
+    - Automatically avoid picking more than one node from the same
+      /16 network when constructing a circuit. Add an
+      "EnforceDistinctSubnets" option to let people disable it if they
+      want to operate private test networks on a single subnet.
+    - When generating bandwidth history, round down to the nearest
+      1k. When storing accounting data, round up to the nearest 1k.
+    - When we're running as a server, remember when we last rotated onion
+      keys, so that we will rotate keys once they're a week old even if
+      we never stay up for a week ourselves.
+    - If a client asked for a server by name, and there's a named server
+      in our network-status but we don't have its descriptor yet, we
+      could return an unnamed server instead.
+    - Reject (most) attempts to use Tor circuits with length one. (If
+      many people start using Tor as a one-hop proxy, exit nodes become
+      a more attractive target for compromise.)
+    - Just because your DirPort is open doesn't mean people should be
+      able to remotely teach you about hidden service descriptors. Now
+      only accept rendezvous posts if you've got HSAuthoritativeDir set.
+    - Fix a potential race condition in the rpm installer. Found by
+      Stefan Nordhausen.
+    - Do not log IPs with TLS failures for incoming TLS
+      connections. (Fixes bug 382.)
+
+  o Major fixes, other:
+    - If our system clock jumps back in time, don't publish a negative
+      uptime in the descriptor.
+    - When we start during an accounting interval before it's time to wake
+      up, remember to wake up at the correct time. (May fix bug 342.)
+    - Previously, we would cache up to 16 old networkstatus documents
+      indefinitely, if they came from nontrusted authorities. Now we
+      discard them if they are more than 10 days old.
+    - When we have a state file we cannot parse, tell the user and
+      move it aside. Now we avoid situations where the user starts
+      Tor in 1904, Tor writes a state file with that timestamp in it,
+      the user fixes her clock, and Tor refuses to start.
+    - Publish a new descriptor after we hup/reload. This is important
+      if our config has changed such that we'll want to start advertising
+      our DirPort now, etc.
+    - If we are using an exit enclave and we can't connect, e.g. because
+      its webserver is misconfigured to not listen on localhost, then
+      back off and try connecting from somewhere else before we fail.
+
+  o New config options or behaviors:
+    - When EntryNodes are configured, rebuild the guard list to contain,
+      in order: the EntryNodes that were guards before; the rest of the
+      EntryNodes; the nodes that were guards before.
+    - Do not warn when individual nodes in the configuration's EntryNodes,
+      ExitNodes, etc are down: warn only when all possible nodes
+      are down. (Fixes bug 348.)
+    - Put a lower-bound on MaxAdvertisedBandwidth.
+    - Start using the state file to store bandwidth accounting data:
+      the bw_accounting file is now obsolete. We'll keep generating it
+      for a while for people who are still using 0.1.2.4-alpha.
+    - Try to batch changes to the state file so that we do as few
+      disk writes as possible while still storing important things in
+      a timely fashion.
+    - The state file and the bw_accounting file get saved less often when
+      the AvoidDiskWrites config option is set.
+    - Make PIDFile work on Windows.
+    - Add internal descriptions for a bunch of configuration options:
+      accessible via controller interface and in comments in saved
+      options files.
+    - Reject *:563 (NNTPS) in the default exit policy. We already reject
+      NNTP by default, so this seems like a sensible addition.
+    - Clients now reject hostnames with invalid characters. This should
+      avoid some inadvertent info leaks. Add an option
+      AllowNonRFC953Hostnames to disable this behavior, in case somebody
+      is running a private network with hosts called @, !, and #.
+    - Check for addresses with invalid characters at the exit as well,
+      and warn less verbosely when they fail. You can override this by
+      setting ServerDNSAllowNonRFC953Addresses to 1.
+    - Remove some options that have been deprecated since at least
+      0.1.0.x: AccountingMaxKB, LogFile, DebugLogFile, LogLevel, and
+      SysLog. Use AccountingMax instead of AccountingMaxKB, and use Log
+      to set log options. Mark PathlenCoinWeight as obsolete.
+    - Stop accepting certain malformed ports in configured exit policies.
+    - When the user uses bad syntax in the Log config line, stop
+      suggesting other bad syntax as a replacement.
+    - Add new config option "ResolvConf" to let the server operator
+      choose an alternate resolve.conf file when using eventdns.
+    - If one of our entry guards is on the ExcludeNodes list, or the
+      directory authorities don't think it's a good guard, treat it as
+      if it were unlisted: stop using it as a guard, and throw it off
+      the guards list if it stays that way for a long time.
+    - Allow directory authorities to be marked separately as authorities
+      for the v1 directory protocol, the v2 directory protocol, and
+      as hidden service directories, to make it easier to retire old
+      authorities. V1 authorities should set "HSAuthoritativeDir 1"
+      to continue being hidden service authorities too.
+    - Remove 8888 as a LongLivedPort, and add 6697 (IRCS).
+    - Make TrackExitHosts case-insensitive, and fix the behavior of
+      ".suffix" TrackExitHosts items to avoid matching in the middle of
+      an address.
+    - New DirPort behavior: if you have your dirport set, you download
+      descriptors aggressively like a directory mirror, whether or not
+      your ORPort is set.
+
+  o Docs:
+    - Create a new file ReleaseNotes which was the old ChangeLog. The
+      new ChangeLog file now includes the notes for all development
+      versions too.
+    - Add a new address-spec.txt document to describe our special-case
+      addresses: .exit, .onion, and .noconnnect.
+    - Fork the v1 directory protocol into its own spec document,
+      and mark dir-spec.txt as the currently correct (v2) spec.
+
+  o Packaging, porting, and contrib
+    - "tor --verify-config" now exits with -1(255) or 0 depending on
+      whether the config options are bad or good.
+    - The Debian package now uses --verify-config when (re)starting,
+      to distinguish configuration errors from other errors.
+    - Adapt a patch from goodell to let the contrib/exitlist script
+      take arguments rather than require direct editing.
+    - Prevent the contrib/exitlist script from printing the same
+      result more than once.
+    - Add support to tor-resolve tool for reverse lookups and SOCKS5.
+    - In the hidden service example in torrc.sample, stop recommending
+      esoteric and discouraged hidden service options.
+    - Patch from Michael Mohr to contrib/cross.sh, so it checks more
+      values before failing, and always enables eventdns.
+    - Try to detect Windows correctly when cross-compiling.
+    - Libevent-1.2 exports, but does not define in its headers, strlcpy.
+      Try to fix this in configure.in by checking for most functions
+      before we check for libevent.
+    - Update RPMs to require libevent 1.2.
+    - Experimentally re-enable kqueue on OSX when using libevent 1.1b
+      or later. Log when we are doing this, so we can diagnose it when
+      it fails. (Also, recommend libevent 1.1b for kqueue and
+      win32 methods; deprecate libevent 1.0b harder; make libevent
+      recommendation system saner.)
+    - Build with recent (1.3+) libevents on platforms that do not
+      define the nonstandard types "u_int8_t" and friends.
+    - Remove architecture from OS X builds. The official builds are
+      now universal binaries.
+    - Run correctly on OS X platforms with case-sensitive filesystems.
+    - Correctly set maximum connection limit on Cygwin. (This time
+      for sure!)
+    - Start compiling on MinGW on Windows (patches from Mike Chiussi
+      and many others).
+    - Start compiling on MSVC6 on Windows (patches from Frediano Ziglio).
+    - Finally fix the openssl warnings from newer gccs that believe that
+      ignoring a return value is okay, but casting a return value and
+      then ignoring it is a sign of madness.
+    - On architectures where sizeof(int)>4, still clamp declarable
+      bandwidth to INT32_MAX.
+
+  o Minor features, controller:
+    - Warn the user when an application uses the obsolete binary v0
+      control protocol. We're planning to remove support for it during
+      the next development series, so it's good to give people some
+      advance warning.
+    - Add STREAM_BW events to report per-entry-stream bandwidth
+      use. (Patch from Robert Hogan.)
+    - Rate-limit SIGNEWNYM signals in response to controllers that
+      impolitely generate them for every single stream. (Patch from
+      mwenge; closes bug 394.)
+    - Add a REMAP status to stream events to note that a stream's
+      address has changed because of a cached address or a MapAddress
+      directive.
+    - Make REMAP stream events have a SOURCE (cache or exit), and
+      make them generated in every case where we get a successful
+      connected or resolved cell.
+    - Track reasons for OR connection failure; make these reasons
+      available via the controller interface. (Patch from Mike Perry.)
+    - Add a SOCKS_BAD_HOSTNAME client status event so controllers
+      can learn when clients are sending malformed hostnames to Tor.
+    - Specify and implement some of the controller status events.
+    - Have GETINFO dir/status/* work on hosts with DirPort disabled.
+    - Reimplement GETINFO so that info/names stays in sync with the
+      actual keys.
+    - Implement "GETINFO fingerprint".
+    - Implement "SETEVENTS GUARD" so controllers can get updates on
+      entry guard status as it changes.
+    - Make all connections to addresses of the form ".noconnect"
+      immediately get closed. This lets application/controller combos
+      successfully test whether they're talking to the same Tor by
+      watching for STREAM events.
+    - Add a REASON field to CIRC events; for backward compatibility, this
+      field is sent only to controllers that have enabled the extended
+      event format. Also, add additional reason codes to explain why
+      a given circuit has been destroyed or truncated. (Patches from
+      Mike Perry)
+    - Add a REMOTE_REASON field to extended CIRC events to tell the
+      controller why a remote OR told us to close a circuit.
+    - Stream events also now have REASON and REMOTE_REASON fields,
+      working much like those for circuit events.
+    - There's now a GETINFO ns/... field so that controllers can ask Tor
+      about the current status of a router.
+    - A new event type "NS" to inform a controller when our opinion of
+      a router's status has changed.
+    - Add a GETINFO events/names and GETINFO features/names so controllers
+      can tell which events and features are supported.
+    - A new CLEARDNSCACHE signal to allow controllers to clear the
+      client-side DNS cache without expiring circuits.
+    - Fix CIRC controller events so that controllers can learn the
+      identity digests of non-Named servers used in circuit paths.
+    - Let controllers ask for more useful identifiers for servers. Instead
+      of learning identity digests for un-Named servers and nicknames
+      for Named servers, the new identifiers include digest, nickname,
+      and indication of Named status. Off by default; see control-spec.txt
+      for more information.
+    - Add a "getinfo address" controller command so it can display Tor's
+      best guess to the user.
+    - New controller event to alert the controller when our server
+      descriptor has changed.
+    - Give more meaningful errors on controller authentication failure.
+    - Export the default exit policy via the control port, so controllers
+      don't need to guess what it is / will be later.
+
+  o Minor bugfixes, controller:
+    - When creating a circuit via the controller, send a 'launched'
+      event when we're done, so we follow the spec better.
+    - Correct the control spec to match how the code actually responds
+      to 'getinfo addr-mappings/*'. Reported by daejees.
+    - The control spec described a GUARDS event, but the code
+      implemented a GUARD event. Standardize on GUARD, but let people
+      ask for GUARDS too. Reported by daejees.
+    - Give the controller END_STREAM_REASON_DESTROY events _before_ we
+      clear the corresponding on_circuit variable, and remember later
+      that we don't need to send a redundant CLOSED event. (Resolves part
+      3 of bug 367.)
+    - Report events where a resolve succeeded or where we got a socks
+      protocol error correctly, rather than calling both of them
+      "INTERNAL".
+    - Change reported stream target addresses to IP consistently when
+      we finally get the IP from an exit node.
+    - Send log messages to the controller even if they happen to be very
+      long.
+    - Flush ERR-level controller status events just like we currently
+      flush ERR-level log events, so that a Tor shutdown doesn't prevent
+      the controller from learning about current events.
+    - Report the circuit number correctly in STREAM CLOSED events. Bug
+      reported by Mike Perry.
+    - Do not report bizarre values for results of accounting GETINFOs
+      when the last second's write or read exceeds the allotted bandwidth.
+    - Report "unrecognized key" rather than an empty string when the
+      controller tries to fetch a networkstatus that doesn't exist.
+    - When the controller does a "GETINFO network-status", tell it
+      about even those routers whose descriptors are very old, and use
+      long nicknames where appropriate.
+    - Fix handling of verbose nicknames with ORCONN controller events:
+      make them show up exactly when requested, rather than exactly when
+      not requested.
+    - Controller signals now work on non-Unix platforms that don't define
+      SIGUSR1 and SIGUSR2 the way we expect.
+    - Respond to SIGNAL command before we execute the signal, in case
+      the signal shuts us down. Suggested by Karsten Loesing.
+    - Handle reporting OR_CONN_EVENT_NEW events to the controller.
+
+  o Minor features, code performance:
+    - Major performance improvement on inserting descriptors: change
+      algorithm from O(n^2) to O(n).
+    - Do not rotate onion key immediately after setting it for the first
+      time.
+    - Call router_have_min_dir_info half as often. (This is showing up in
+      some profiles, but not others.)
+    - When using GCC, make log_debug never get called at all, and its
+      arguments never get evaluated, when no debug logs are configured.
+      (This is showing up in some profiles, but not others.)
+    - Statistics dumped by -USR2 now include a breakdown of public key
+      operations, for profiling.
+    - Make the common memory allocation path faster on machines where
+      malloc(0) returns a pointer.
+    - Split circuit_t into origin_circuit_t and or_circuit_t, and
+      split connection_t into edge, or, dir, control, and base structs.
+      These will save quite a bit of memory on busy servers, and they'll
+      also help us track down bugs in the code and bugs in the spec.
+    - Use OpenSSL's AES implementation on platforms where it's faster.
+      This could save us as much as 10% CPU usage.
+
+  o Minor features, descriptors and descriptor handling:
+    - Avoid duplicate entries on MyFamily line in server descriptor.
+    - When Tor receives a router descriptor that it asked for, but
+      no longer wants (because it has received fresh networkstatuses
+      in the meantime), do not warn the user. Cache the descriptor if
+      we're a cache; drop it if we aren't.
+    - Servers no longer ever list themselves in their "family" line,
+      even if configured to do so. This makes it easier to configure
+      family lists conveniently.
+
+  o Minor fixes, confusing/misleading log messages:
+    - Display correct results when reporting which versions are
+      recommended, and how recommended they are. (Resolves bug 383.)
+    - Inform the server operator when we decide not to advertise a
+      DirPort due to AccountingMax enabled or a low BandwidthRate.
+    - Only include function names in log messages for info/debug messages.
+      For notice/warn/err, the content of the message should be clear on
+      its own, and printing the function name only confuses users.
+    - Remove even more protocol-related warnings from Tor server logs,
+      such as bad TLS handshakes and malformed begin cells.
+    - Fix bug 314: Tor clients issued "unsafe socks" warnings even
+      when the IP address is mapped through MapAddress to a hostname.
+    - Fix misleading log messages: an entry guard that is "unlisted",
+      as well as not known to be "down" (because we've never heard
+      of it), is not therefore "up".
+
+  o Minor fixes, old/obsolete behavior:
+    - Start assuming we can use a create_fast cell if we don't know
+      what version a router is running.
+    - We no longer look for identity and onion keys in "identity.key" and
+      "onion.key" -- these were replaced by secret_id_key and
+      secret_onion_key in 0.0.8pre1.
+    - We no longer require unrecognized directory entries to be
+      preceded by "opt".
+    - Drop compatibility with obsolete Tors that permit create cells
+      to have the wrong circ_id_type.
+    - Remove code to special-case "-cvs" ending, since it has not
+      actually mattered since 0.0.9.
+    - Don't re-write the fingerprint file every restart, unless it has
+      changed.
+
+  o Minor fixes, misc client-side behavior:
+    - Always remove expired routers and networkstatus docs before checking
+      whether we have enough information to build circuits. (Fixes
+      bug 373.)
+    - When computing clock skew from directory HTTP headers, consider what
+      time it was when we finished asking for the directory, not what
+      time it is now.
+    - Make our socks5 handling more robust to broken socks clients:
+      throw out everything waiting on the buffer in between socks
+      handshake phases, since they can't possibly (so the theory
+      goes) have predicted what we plan to respond to them.
+    - Expire socks connections if they spend too long waiting for the
+      handshake to finish. Previously we would let them sit around for
+      days, if the connecting application didn't close them either.
+    - And if the socks handshake hasn't started, don't send a
+      "DNS resolve socks failed" handshake reply; just close it.
+    - If the user asks to use invalid exit nodes, be willing to use
+      unstable ones.
+    - Track unreachable entry guards correctly: don't conflate
+      'unreachable by us right now' with 'listed as down by the directory
+      authorities'. With the old code, if a guard was unreachable by us
+      but listed as running, it would clog our guard list forever.
+    - Behave correctly in case we ever have a network with more than
+      2GB/s total advertised capacity.
+    - Claim a commonname of Tor, rather than TOR, in TLS handshakes.
+    - Fix a memory leak when we ask for "all" networkstatuses and we
+      get one we don't recognize.
+
+
 Changes in version 0.1.1.26 - 2006-12-14
   o Security bugfixes:
     - Stop sending the HttpProxyAuthenticator string to directory