I did a build with Tor 0.2.1.7-alpha about 5 days ago.<br><br>Is this the same exact version, or were there updates in the last few days?<br><br>Thanks!<br><br>- Kyle<br><br><br><div class="gmail_quote">On Thu, Nov 20, 2008 at 3:50 PM, Roger Dingledine <span dir="ltr"><<a href="mailto:arma@mit.edu">arma@mit.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Tor 0.2.1.7-alpha fixes a major security problem in Debian and Ubuntu<br>
packages (and maybe other packages) noticed by Theo de Raadt, fixes<br>
a smaller security flaw that might allow an attacker to access local<br>
services, adds better defense against DNS poisoning attacks on exit<br>
relays, further improves hidden service performance, and fixes a variety<br>
of other issues.<br>
<br>
<a href="https://www.torproject.org/download.html.en" target="_blank">https://www.torproject.org/download.html.en</a><br>
<br>
Changes in version 0.2.1.7-alpha - 2008-11-08<br>
o Security fixes:<br>
- The "ClientDNSRejectInternalAddresses" config option wasn't being<br>
consistently obeyed: if an exit relay refuses a stream because its<br>
exit policy doesn't allow it, we would remember what IP address<br>
the relay said the destination address resolves to, even if it's<br>
an internal IP address. Bugfix on 0.2.0.7-alpha; patch by rovv.<br>
- The "User" and "Group" config options did not clear the<br>
supplementary group entries for the Tor process. The "User" option<br>
is now more robust, and we now set the groups to the specified<br>
user's primary group. The "Group" option is now ignored. For more<br>
detailed logging on credential switching, set CREDENTIAL_LOG_LEVEL<br>
in common/compat.c to LOG_NOTICE or higher. Patch by Jacob Appelbaum<br>
and Steven Murdoch. Bugfix on 0.0.2pre14. Fixes bug 848.<br>
- Do not use or believe expired v3 authority certificates. Patch<br>
from Karsten. Bugfix in 0.2.0.x. Fixes bug 851.<br>
<br>
o Minor features:<br>
- Now NodeFamily and MyFamily config options allow spaces in<br>
identity fingerprints, so it's easier to paste them in.<br>
Suggested by Lucky Green.<br>
- Implement the 0x20 hack to better resist DNS poisoning: set the<br>
case on outgoing DNS requests randomly, and reject responses that do<br>
not match the case correctly. This logic can be disabled with the<br>
ServerDNSRamdomizeCase setting, if you are using one of the 0.3%<br>
of servers that do not reliably preserve case in replies. See<br>
"Increased DNS Forgery Resistance through 0x20-Bit Encoding"<br>
for more info.<br>
- Preserve case in replies to DNSPort requests in order to support<br>
the 0x20 hack for resisting DNS poisoning attacks.<br>
<br>
o Hidden service performance improvements:<br>
- When the client launches an introduction circuit, retry with a<br>
new circuit after 30 seconds rather than 60 seconds.<br>
- Launch a second client-side introduction circuit in parallel<br>
after a delay of 15 seconds (based on work by Christian Wilms).<br>
- Hidden services start out building five intro circuits rather<br>
than three, and when the first three finish they publish a service<br>
descriptor using those. Now we publish our service descriptor much<br>
faster after restart.<br>
<br>
o Minor bugfixes:<br>
- Minor fix in the warning messages when you're having problems<br>
bootstrapping; also, be more forgiving of bootstrap problems when<br>
we're still making incremental progress on a given bootstrap phase.<br>
- When we're choosing an exit node for a circuit, and we have<br>
no pending streams, choose a good general exit rather than one that<br>
supports "all the pending streams". Bugfix on 0.1.1.x. Fix by rovv.<br>
- Send a valid END cell back when a client tries to connect to a<br>
nonexistent hidden service port. Bugfix on <a href="http://0.1.2.15" target="_blank">0.1.2.15</a>. Fixes bug<br>
840. Patch from rovv.<br>
- If a broken client asks a non-exit router to connect somewhere,<br>
do not even do the DNS lookup before rejecting the connection.<br>
Fixes another case of bug 619. Patch from rovv.<br>
- Fix another case of assuming, when a specific exit is requested,<br>
that we know more than the user about what hosts it allows.<br>
Fixes another case of bug 752. Patch from rovv.<br>
- Check which hops rendezvous stream cells are associated with to<br>
prevent possible guess-the-streamid injection attacks from<br>
intermediate hops. Fixes another case of bug 446. Based on patch<br>
from rovv.<br>
- Avoid using a negative right-shift when comparing 32-bit<br>
addresses. Possible fix for bug 845 and bug 811.<br>
- Make the assert_circuit_ok() function work correctly on circuits that<br>
have already been marked for close.<br>
- Fix read-off-the-end-of-string error in unit tests when decoding<br>
introduction points.<br>
- Fix uninitialized size field for memory area allocation: may improve<br>
memory performance during directory parsing.<br>
- Treat duplicate certificate fetches as failures, so that we do<br>
not try to re-fetch an expired certificate over and over and over.<br>
- Do not say we're fetching a certificate when we'll in fact skip it<br>
because of a pending download.<br>
<br>
<br>-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.6 (GNU/Linux)<br>
<br>
iD8DBQFJJfe061qJaiiYi/URAjQ1AJ9YANIWukD/iWzDf0mhmcdUeFSaywCfa+gh<br>
1Ycg6IFC+DACu48XnQ2nN30=<br>
=64Rm<br>
-----END PGP SIGNATURE-----<br>
<br></blockquote></div><br>