tor-announce
Threads by month
- ----- 2025 -----
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- 294 discussions
Hi, all! There is a new stable release of the Tor source code, with
fixes for several important bugs.
(If you are about to reply saying "please take me off this list",
instead please follow these instructions:
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/
. You will have to enter the actual email address you used to subscribe.)
You can download the source from the usual place on the website.
Packages should be up in a few days.
(There is also a concurrent release of Tor 0.2.9.2-alpha; for alpha
announcements, please see tor-talk@ or the blog.)
====
Changes in version 0.2.8.7 - 2016-08-24
Tor 0.2.8.7 fixes an important bug related to the ReachableAddresses
option in 0.2.8.6, and replaces a retiring bridge authority. Everyone
who sets the ReachableAddresses option, and all bridges, are strongly
encouraged to upgrade.
o Directory authority changes:
- The "Tonga" bridge authority has been retired; the new bridge
authority is "Bifroest". Closes tickets 19728 and 19690.
o Major bugfixes (client, security):
- Only use the ReachableAddresses option to restrict the first hop
in a path. In earlier versions of 0.2.8.x, it would apply to
every hop in the path, with a possible degradation in anonymity
for anyone using an uncommon ReachableAddress setting. Fixes bug
19973; bugfix on 0.2.8.2-alpha.
o Minor features (geoip):
- Update geoip and geoip6 to the August 2 2016 Maxmind GeoLite2
Country database.
o Minor bugfixes (compilation):
- Remove an inappropriate "inline" in tortls.c that was causing
warnings on older versions of GCC. Fixes bug 19903; bugfix
on 0.2.8.1-alpha.
o Minor bugfixes (fallback directories):
- Avoid logging a NULL string pointer when loading fallback
directory information. Fixes bug 19947; bugfix on 0.2.4.7-alpha
and 0.2.8.1-alpha. Report and patch by "rubiate".
1
0
Hi all!
Tor Browser 6.0.4 is now available from the Tor Browser Project page[1]
and also from our distribution directory[2].
This release finally brings Tor Browser users the latest Tor stable,
0.2.8.6, and avoids pinging Mozilla's servers for system extensions.
Pinging Mozilla's servers was responsible for users getting an extension
into their Tor Browser that resulted in annoying and confusing "Your
Firefox is out of date" notifications on start-up (bug 19890)[3]. Thanks
to Mozilla engineers, who fixed that issue as quickly as possible on
their side, the extension is not shipped to Tor Browser users anymore
since August 11 13:00 UTC. This takes care of getting the add-on removed
as well in case it got installed into Tor Browser (as does the fix we
ship in Tor Browser 6.0.4) which should have happened/is happening
during the next extension update ping. For further information see the
discussion in our bug tracker[4].
Users that are on the alpha channel or are using the hardened Tor
Browser were not affected. The same goes for Tails users as far as we know.
The full changelog since Tor Browser 6.0.3 is:
Tor Browser 6.0.4 -- August 16
* All Platforms
* Update Tor to 0.2.8.6
* Update NoScript to 2.9.0.14
* Bug 19890: Disable installation of system addons
Georg
[1] https://www.torproject.org/download/download-easy.html
[2] https://www.torproject.org/dist/torbrowser/6.0.4/
[3] https://trac.torproject.org/projects/tor/ticket/19890
[4] https://trac.torproject.org/projects/tor/ticket/19890
1
0
Tor Browser 6.0.3 is now available from the Tor Browser Project page [1]
and also from our distribution directory [2].
1: https://www.torproject.org/download/download-easy.html
2: https://www.torproject.org/dist/torbrowser/6.0.3/
This release features important security updates [3] to Firefox.
3: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#f…
This release updates firefox to 45.3.0esr. Additionally, it bumps
NoScript to 2.9.0.12, HTTPS-Everywhere to 5.2.1, disables asmjs,
removes meek-google and contains a few other bug fixes.
Note: Due to bug 19410 [4], on OSX the incremental update will not be
working for users who installed the previous version using the .dmg file.
The internal updater should still work, though, doing a complete update.
4: https://trac.torproject.org/projects/tor/ticket/19410
Here is the full changelog since 6.0.2:
* All Platforms
* Update Firefox to 45.3.0esr
* Update Torbutton to 1.9.5.6
* Bug 19417: Disable asmjs for now
* Bug 19689: Use proper parent window for plugin prompt
* Update HTTPS-Everywhere to 5.2.1
* Update NoScript to 2.9.0.12
* Bug 19715: Disable the meek-google pluggable transport option
* Bug 19714: Remove mercurius4 obfs4 bridge
* Bug 19585: Fix regression test for keyboard layout fingerprinting
* Bug 19515: Tor Browser is crashing in graphics code
* Bug 18513: Favicon requests can bypass New Identity
* OS X
* Bug 19269: Icon doesn't appear in Applications folder or Dock
* Android
* Bug 19484: Avoid compilation error when MOZ_UPDATER is not defined
1
0
Hi, all! After months of work, a new Tor release series is finally stable.
(If you are about to reply saying "please take me off this list",
instead please follow these instructions:
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/
. You will have to enter the actual email address you used to subscribe.)
You can download the source from the usual place on the website.
Packages should be up in a few days.
====
Changes in version 0.2.8.6 - 2016-08-02
Tor 0.2.8.6 is the first stable version of the Tor 0.2.8 series.
The Tor 0.2.8 series improves client bootstrapping performance,
completes the authority-side implementation of improved identity
keys for relays, and includes numerous bugfixes and performance
improvements throughout the program. This release continues to
improve the coverage of Tor's test suite. For a full list of
changes since Tor 0.2.7, see the ReleaseNotes file.
Below is a list of the changes since Tor 0.2.7.
o New system requirements:
- Tor no longer attempts to support platforms where the "time_t"
type is unsigned. (To the best of our knowledge, only OpenVMS does
this, and Tor has never actually built on OpenVMS.) Closes
ticket 18184.
- Tor no longer supports versions of OpenSSL with a broken
implementation of counter mode. (This bug was present in OpenSSL
1.0.0, and was fixed in OpenSSL 1.0.0a.) Tor still detects, but no
longer runs with, these versions.
- Tor now uses Autoconf version 2.63 or later, and Automake 1.11 or
later (released in 2008 and 2009 respectively). If you are
building Tor from the git repository instead of from the source
distribution, and your tools are older than this, you will need to
upgrade. Closes ticket 17732.
o Directory authority changes:
- Update the V3 identity key for the dannenberg directory authority:
it was changed on 18 November 2015. Closes task 17906. Patch
by teor.
- Urras is no longer a directory authority. Closes ticket 19271.
o Major features (directory system):
- Include a trial list of default fallback directories, based on an
opt-in survey of suitable relays. Doing this should make clients
bootstrap more quickly and reliably, and reduce the load on the
directory authorities. Closes ticket 15775. Patch by teor.
Candidates identified using an OnionOO script by weasel, teor,
gsathya, and karsten.
- Previously only relays that explicitly opened a directory port
(DirPort) accepted directory requests from clients. Now all
relays, with and without a DirPort, accept and serve tunneled
directory requests that they receive through their ORPort. You can
disable this behavior using the new DirCache option. Closes
ticket 12538.
- When bootstrapping multiple consensus downloads at a time, use the
first one that starts downloading, and close the rest. This
reduces failures when authorities or fallback directories are slow
or down. Together with the code for feature 15775, this feature
should reduces failures due to fallback churn. Implements ticket
4483. Patch by teor. Implements IPv4 portions of proposal 210 by
mikeperry and teor.
o Major features (security, Linux):
- When Tor starts as root on Linux and is told to switch user ID, it
can now retain the capability to bind to low ports. By default,
Tor will do this only when it's switching user ID and some low
ports have been configured. You can change this behavior with the
new option KeepBindCapabilities. Closes ticket 8195.
o Major bugfixes (client, bootstrapping):
- Check if bootstrap consensus downloads are still needed when the
linked connection attaches. This prevents tor making unnecessary
begindir-style connections, which are the only directory
connections tor clients make since the fix for 18483 was merged.
- Fix some edge cases where consensus download connections may not
have been closed, even though they were not needed. Related to fix
for 18809.
- Make relays retry consensus downloads the correct number of times,
rather than the more aggressive client retry count. Fixes part of
ticket 18809.
o Major bugfixes (dns proxy mode, crash):
- Avoid crashing when running as a DNS proxy. Fixes bug 16248;
bugfix on 0.2.0.1-alpha. Patch from "cypherpunks".
o Major bugfixes (ed25519, voting):
- Actually enable support for authorities to match routers by their
Ed25519 identities. Previously, the code had been written, but
some debugging code that had accidentally been left in the
codebase made it stay turned off. Fixes bug 17702; bugfix
on 0.2.7.2-alpha.
- When collating votes by Ed25519 identities, authorities now
include a "NoEdConsensus" flag if the ed25519 value (or lack
thereof) for a server does not reflect the majority consensus.
Related to bug 17668; bugfix on 0.2.7.2-alpha.
- When generating a vote with keypinning disabled, never include two
entries for the same ed25519 identity. This bug was causing
authorities to generate votes that they could not parse when a
router violated key pinning by changing its RSA identity but
keeping its Ed25519 identity. Fixes bug 17668; fixes part of bug
18318. Bugfix on 0.2.7.2-alpha.
o Major bugfixes (key management):
- If OpenSSL fails to generate an RSA key, do not retain a dangling
pointer to the previous (uninitialized) key value. The impact here
should be limited to a difficult-to-trigger crash, if OpenSSL is
running an engine that makes key generation failures possible, or
if OpenSSL runs out of memory. Fixes bug 19152; bugfix on
0.2.1.10-alpha. Found by Yuan Jochen Kang, Suman Jana, and
Baishakhi Ray.
o Major bugfixes (security, client, DNS proxy):
- Stop a crash that could occur when a client running with DNSPort
received a query with multiple address types, and the first
address type was not supported. Found and fixed by Scott Dial.
Fixes bug 18710; bugfix on 0.2.5.4-alpha.
o Major bugfixes (security, compilation):
- Correctly detect compiler flags on systems where _FORTIFY_SOURCE
is predefined. Previously, our use of -D_FORTIFY_SOURCE would
cause a compiler warning, thereby making other checks fail, and
needlessly disabling compiler-hardening support. Fixes one case of
bug 18841; bugfix on 0.2.3.17-beta. Patch from "trudokal".
- Repair hardened builds under the clang compiler. Previously, our
use of _FORTIFY_SOURCE would conflict with clang's address
sanitizer. Fixes bug 14821; bugfix on 0.2.5.4-alpha.
o Major bugfixes (security, pointers):
- Avoid a difficult-to-trigger heap corruption attack when extending
a smartlist to contain over 16GB of pointers. Fixes bug 18162;
bugfix on 0.1.1.11-alpha, which fixed a related bug incompletely.
Reported by Guido Vranken.
o Major bugfixes (testing):
- Fix a bug that would block 'make test-network-all' on systems where
IPv6 packets were lost. Fixes bug 19008; bugfix on 0.2.7.3-rc.
o Major bugfixes (user interface):
- Correctly give a warning in the cases where a relay is specified
by nickname, and one such relay is found, but it is not officially
Named. Fixes bug 19203; bugfix on 0.2.3.1-alpha.
o Minor features (accounting):
- Added two modes to the AccountingRule option: One for limiting
only the number of bytes sent ("AccountingRule out"), and one for
limiting only the number of bytes received ("AccountingRule in").
Closes ticket 15989; patch from "unixninja92".
o Minor features (bug-resistance):
- Make Tor survive errors involving connections without a
corresponding event object. Previously we'd fail with an
assertion; now we produce a log message. Related to bug 16248.
- Use tor_snprintf() and tor_vsnprintf() even in external and low-
level code, to harden against accidental failures to NUL-
terminate. Part of ticket 17852. Patch from jsturgix. Found
with Flawfinder.
o Minor features (build):
- Detect systems with FreeBSD-derived kernels (such as GNU/kFreeBSD)
as having possible IPFW support. Closes ticket 18448. Patch from
Steven Chamberlain.
- Since our build process now uses "make distcheck", we no longer
force "make dist" to depend on "make check". Closes ticket 17893;
patch from "cypherpunks".
- Tor now builds once again with the recent OpenSSL 1.1 development
branch (tested against 1.1.0-pre5 and 1.1.0-pre6-dev). We have been
tracking OpenSSL 1.1 development as it has progressed, and fixing
numerous compatibility issues as they arose. See tickets
17549, 17921, 17984, 19499, and 18286.
- When building manual pages, set the timezone to "UTC", so that the
output is reproducible. Fixes bug 19558; bugfix on 0.2.2.9-alpha.
Patch from intrigeri.
o Minor features (clients):
- Make clients, onion services, and bridge relays always use an
encrypted begindir connection for directory requests. Resolves
ticket 18483. Patch by teor.
o Minor features (controller):
- Add 'GETINFO exit-policy/reject-private/[default,relay]', so
controllers can examine the the reject rules added by
ExitPolicyRejectPrivate. This makes it easier for stem to display
exit policies.
- Adds the FallbackDir entries to 'GETINFO config/defaults'. Closes
tickets 16774 and 17817. Patch by George Tankersley.
- New 'GETINFO hs/service/desc/id/' command to retrieve a hidden
service descriptor from a service's local hidden service
descriptor cache. Closes ticket 14846.
o Minor features (crypto):
- Add SHA3 and SHAKE support to crypto.c. Closes ticket 17783.
- Add SHA512 support to crypto.c. Closes ticket 17663; patch from
George Tankersley.
- Improve performance when hashing non-multiple of 8 sized buffers,
based on Andrew Moon's public domain SipHash-2-4 implementation.
Fixes bug 17544; bugfix on 0.2.5.3-alpha.
- Validate the hard-coded Diffie-Hellman parameters and ensure that
p is a safe prime, and g is a suitable generator. Closes
ticket 18221.
- When allocating a digest state object, allocate no more space than
we actually need. Previously, we would allocate as much space as
the state for the largest algorithm would need. This change saves
up to 672 bytes per circuit. Closes ticket 17796.
o Minor features (directory downloads):
- Add UseDefaultFallbackDirs, which enables any hard-coded fallback
directory mirrors. The default is 1; set it to 0 to disable
fallbacks. Implements ticket 17576. Patch by teor.
- Wait for busy authorities and fallback directories to become non-
busy when bootstrapping. (A similar change was made in 6c443e987d
for directory caches chosen from the consensus.) Closes ticket
17864; patch by teor.
o Minor features (geoip):
- Update geoip and geoip6 to the July 6 2016 Maxmind GeoLite2
Country database.
o Minor features (hidden service directory):
- Streamline relay-side hsdir handling: when relays consider whether
to accept an uploaded hidden service descriptor, they no longer
check whether they are one of the relays in the network that is
"supposed" to handle that descriptor. Implements ticket 18332.
o Minor features (IPv6):
- Add ClientPreferIPv6DirPort, which is set to 0 by default. If set
to 1, tor prefers IPv6 directory addresses.
- Add ClientUseIPv4, which is set to 1 by default. If set to 0, tor
avoids using IPv4 for client OR and directory connections.
- Add address policy assume_action support for IPv6 addresses.
- Add an argument 'ipv6=address:orport' to the DirAuthority and
FallbackDir torrc options, to specify an IPv6 address for an
authority or fallback directory. Add hard-coded ipv6 addresses for
directory authorities that have them. Closes ticket 17327; patch
from Nick Mathewson and teor.
- Allow users to configure directory authorities and fallback
directory servers with IPv6 addresses and ORPorts. Resolves
ticket 6027.
- Limit IPv6 mask bits to 128.
- Make tor_ersatz_socketpair work on IPv6-only systems. Fixes bug
17638; bugfix on 0.0.2pre8. Patch by teor.
- Try harder to obey the IP version restrictions "ClientUseIPv4 0",
"ClientUseIPv6 0", "ClientPreferIPv6ORPort", and
"ClientPreferIPv6DirPort". Closes ticket 17840; patch by teor.
- Warn when comparing against an AF_UNSPEC address in a policy, it's
almost always a bug. Closes ticket 17863; patch by teor.
- routerset_parse now accepts IPv6 literal addresses. Fixes bug
17060; bugfix on 0.2.1.3-alpha. Patch by teor.
o Minor features (Linux seccomp2 sandbox):
- Reject attempts to change our Address with "Sandbox 1" enabled.
Changing Address with Sandbox turned on would never actually work,
but previously it would fail in strange and confusing ways. Found
while fixing 18548.
o Minor features (logging):
- When logging to syslog, allow a tag to be added to the syslog
identity (the string prepended to every log message). The tag can
be configured with SyslogIdentityTag and defaults to none. Setting
it to "foo" will cause logs to be tagged as "Tor-foo". Closes
ticket 17194.
o Minor features (portability):
- Use timingsafe_memcmp() where available. Closes ticket 17944;
patch from <logan(a)hackers.mu>.
o Minor features (relay, address discovery):
- Add a family argument to get_interface_addresses_raw() and
subfunctions to make network interface address interogation more
efficient. Now Tor can specifically ask for IPv4, IPv6 or both
types of interfaces from the operating system. Resolves
ticket 17950.
- When get_interface_address6_list(.,AF_UNSPEC,.) is called and
fails to enumerate interface addresses using the platform-specific
API, have it rely on the UDP socket fallback technique to try and
find out what IP addresses (both IPv4 and IPv6) our machine has.
Resolves ticket 17951.
o Minor features (replay cache):
- The replay cache now uses SHA256 instead of SHA1. Implements
feature 8961. Patch by teor, issue reported by rransom.
o Minor features (robustness):
- Exit immediately with an error message if the code attempts to use
Libevent without having initialized it. This should resolve some
frequently-made mistakes in our unit tests. Closes ticket 18241.
o Minor features (security, clock):
- Warn when the system clock appears to move back in time (when the
state file was last written in the future). Tor doesn't know that
consensuses have expired if the clock is in the past. Patch by
teor. Implements ticket 17188.
o Minor features (security, exit policies):
- ExitPolicyRejectPrivate now rejects more private addresses by
default. Specifically, it now rejects the relay's outbound bind
addresses (if configured), and the relay's configured port
addresses (such as ORPort and DirPort). Fixes bug 17027; bugfix on
0.2.0.11-alpha. Patch by teor.
o Minor features (security, memory erasure):
- Make memwipe() do nothing when passed a NULL pointer or buffer of
zero size. Check size argument to memwipe() for underflow. Fixes
bug 18089; bugfix on 0.2.3.25 and 0.2.4.6-alpha. Reported by "gk",
patch by teor.
- Set the unused entries in a smartlist to NULL. This helped catch
a (harmless) bug, and shouldn't affect performance too much.
Implements ticket 17026.
- Use SecureMemoryWipe() function to securely clean memory on
Windows. Previously we'd use OpenSSL's OPENSSL_cleanse() function.
Implements feature 17986.
- Use explicit_bzero or memset_s when present. Previously, we'd use
OpenSSL's OPENSSL_cleanse() function. Closes ticket 7419; patches
from <logan(a)hackers.mu> and <selven(a)hackers.mu>.
o Minor features (security, RNG):
- Adjust Tor's use of OpenSSL's RNG APIs so that they absolutely,
positively are not allowed to fail. Previously we depended on
internal details of OpenSSL's behavior. Closes ticket 17686.
- Never use the system entropy output directly for anything besides
seeding the PRNG. When we want to generate important keys, instead
of using system entropy directly, we now hash it with the PRNG
stream. This may help resist certain attacks based on broken OS
entropy implementations. Closes part of ticket 17694.
- Use modern system calls (like getentropy() or getrandom()) to
generate strong entropy on platforms that have them. Closes
ticket 13696.
o Minor features (security, win32):
- Set SO_EXCLUSIVEADDRUSE on Win32 to avoid a local port-stealing
attack. Fixes bug 18123; bugfix on all tor versions. Patch
by teor.
o Minor features (unix domain sockets):
- Add a new per-socket option, RelaxDirModeCheck, to allow creating
Unix domain sockets without checking the permissions on the parent
directory. (Tor checks permissions by default because some
operating systems only check permissions on the parent directory.
However, some operating systems do look at permissions on the
socket, and tor's default check is unneeded.) Closes ticket 18458.
Patch by weasel.
o Minor features (unix file permissions):
- Defer creation of Unix sockets until after setuid. This avoids
needing CAP_CHOWN and CAP_FOWNER when using systemd's
CapabilityBoundingSet, or chown and fowner when using SELinux.
Implements part of ticket 17562. Patch from Jamie Nguyen.
- If any directory created by Tor is marked as group readable, the
filesystem group is allowed to be either the default GID or the
root user. Allowing root to read the DataDirectory prevents the
need for CAP_READ_SEARCH when using systemd's
CapabilityBoundingSet, or dac_read_search when using SELinux.
Implements part of ticket 17562. Patch from Jamie Nguyen.
- Introduce a new DataDirectoryGroupReadable option. If it is set to
1, the DataDirectory will be made readable by the default GID.
Implements part of ticket 17562. Patch from Jamie Nguyen.
o Minor bugfixes (accounting):
- The max bandwidth when using 'AccountRule sum' is now correctly
logged. Fixes bug 18024; bugfix on 0.2.6.1-alpha. Patch
from "unixninja92".
o Minor bugfixes (assert, portability):
- Fix an assertion failure in memarea.c on systems where "long" is
shorter than the size of a pointer. Fixes bug 18716; bugfix
on 0.2.1.1-alpha.
o Minor bugfixes (bootstrap):
- Consistently use the consensus download schedule for authority
certificates. Fixes bug 18816; bugfix on 0.2.4.13-alpha.
o Minor bugfixes (build):
- Avoid spurious failures from configure files related to calling
exit(0) in TOR_SEARCH_LIBRARY. Fixes bug 18625; bugfix on
0.2.0.1-alpha. Patch from "cypherpunks".
- Do not link the unit tests against both the testing and non-
testing versions of the static libraries. Fixes bug 18490; bugfix
on 0.2.7.1-alpha.
- Resolve warnings when building on systems that are concerned with
signed char. Fixes bug 18728; bugfix on 0.2.7.2-alpha
and 0.2.6.1-alpha.
- Silence spurious clang-scan warnings in the ed25519_donna code by
explicitly initializing some objects. Fixes bug 18384; bugfix on
0.2.7.2-alpha. Patch by teor.
- When libscrypt.h is found, but no libscrypt library can be linked,
treat libscrypt as absent. Fixes bug 19161; bugfix
on 0.2.6.1-alpha.
- Cause the unit tests to compile correctly on mingw64 versions that
lack sscanf. Fixes bug 19213; bugfix on 0.2.7.1-alpha.
- Don't try to use the pthread_condattr_setclock() function unless
it actually exists. Fixes compilation on NetBSD-6.x. Fixes bug
17819; bugfix on 0.2.6.3-alpha.
- Fix backtrace compilation on FreeBSD. Fixes bug 17827; bugfix
on 0.2.5.2-alpha.
- Fix search for libevent libraries on OpenBSD (and other systems
that install libevent 1 and libevent 2 in parallel). Fixes bug
16651; bugfix on 0.1.0.7-rc. Patch from "rubiate".
- Isolate environment variables meant for tests from the rest of the
build system. Fixes bug 17818; bugfix on 0.2.7.3-rc.
- Mark all object files that include micro-revision.i as depending
on it, so as to make parallel builds more reliable. Fixes bug
17826; bugfix on 0.2.5.1-alpha.
- Remove config.log only from make distclean, not from make clean.
Fixes bug 17924; bugfix on 0.2.4.1-alpha.
- Replace usage of 'INLINE' with 'inline'. Fixes bug 17804; bugfix
on 0.0.2pre8.
- Remove an #endif from configure.ac so that we correctly detect the
presence of in6_addr.s6_addr32. Fixes bug 17923; bugfix
on 0.2.0.13-alpha.
o Minor bugfixes (client, bootstrap):
- Count receipt of new microdescriptors as progress towards
bootstrapping. Previously, with EntryNodes set, Tor might not
successfully repopulate the guard set on bootstrapping. Fixes bug
16825; bugfix on 0.2.3.1-alpha.
o Minor bugfixes (code correctness):
- Fix a bad memory handling bug that would occur if we had queued a
cell on a channel's incoming queue. Fortunately, we can't actually
queue a cell like that as our code is constructed today, but it's
best to avoid this kind of error, even if there isn't any code
that triggers it today. Fixes bug 18570; bugfix on 0.2.4.4-alpha.
- Assert that allocated memory held by the reputation code is freed
according to its internal counters. Fixes bug 17753; bugfix
on 0.1.1.1-alpha.
- Assert when the TLS contexts fail to initialize. Fixes bug 17683;
bugfix on 0.0.6.
- Update to the latest version of Trunnel, which tries harder to
avoid generating code that can invoke memcpy(p,NULL,0). Bug found
by clang address sanitizer. Fixes bug 18373; bugfix
on 0.2.7.2-alpha.
- When closing an entry connection, generate a warning if we should
have sent an end cell for it but we haven't. Fixes bug 17876;
bugfix on 0.2.3.2-alpha.
o Minor bugfixes (configuration):
- Fix a tiny memory leak when parsing a port configuration ending in
":auto". Fixes bug 18374; bugfix on 0.2.3.3-alpha.
o Minor bugfixes (containers):
- If we somehow attempt to construct a heap with more than
1073741822 elements, avoid an integer overflow when maintaining
the heap property. Fixes bug 18296; bugfix on 0.1.2.1-alpha.
o Minor bugfixes (controller, microdescriptors):
- Make GETINFO dir/status-vote/current/consensus conform to the
control specification by returning "551 Could not open cached
consensus..." when not caching consensuses. Fixes bug 18920;
bugfix on 0.2.2.6-alpha.
o Minor bugfixes (crypto):
- Check the return value of HMAC() and assert on failure. Fixes bug
17658; bugfix on 0.2.3.6-alpha. Patch by teor.
o Minor bugfixes (directories):
- When fetching extrainfo documents, compare their SHA256 digests
and Ed25519 signing key certificates with the routerinfo that led
us to fetch them, rather than with the most recent routerinfo.
Otherwise we generate many spurious warnings about mismatches.
Fixes bug 17150; bugfix on 0.2.7.2-alpha.
- When generating a URL for a directory server on an IPv6 address,
wrap the IPv6 address in square brackets. Fixes bug 18051; bugfix
on 0.2.3.9-alpha. Patch from Malek.
o Minor bugfixes (downloading):
- Predict more correctly whether we'll be downloading over HTTP when
we determine the maximum length of a URL. This should avoid a
"BUG" warning about the Squid HTTP proxy and its URL limits. Fixes
bug 19191.
o Minor bugfixes (exit policies, security):
- Refresh an exit relay's exit policy when interface addresses
change. Previously, tor only refreshed the exit policy when the
configured external address changed. Fixes bug 18208; bugfix on
0.2.7.3-rc. Patch by teor.
o Minor bugfixes (fallback directories):
- Mark fallbacks as "too busy" when they return a 503 response,
rather than just marking authorities. Fixes bug 17572; bugfix on
0.2.4.7-alpha. Patch by teor.
- When requesting extrainfo descriptors from a trusted directory
server, check whether it is an authority or a fallback directory
which supports extrainfo descriptors. Fixes bug 18489; bugfix on
0.2.4.7-alpha. Reported by atagar, patch by teor.
o Minor bugfixes (hidden service, client):
- Handle the case where the user makes several fast consecutive
requests to the same .onion address. Previously, the first six
requests would each trigger a descriptor fetch, each picking a
directory (there are 6 overall) and the seventh one would fail
because no directories were left, thereby triggering a close on
all current directory connections asking for the hidden service.
The solution here is to not close the connections if we have
pending directory fetches. Fixes bug 15937; bugfix
on 0.2.7.1-alpha.
o Minor bugfixes (hidden service, control port):
- Add the onion address to the HS_DESC event for the UPLOADED action
both on success or failure. It was previously hardcoded with
UNKNOWN. Fixes bug 16023; bugfix on 0.2.7.2-alpha.
o Minor bugfixes (hidden service, directory):
- Bridges now refuse "rendezvous2" (hidden service descriptor)
publish attempts. Suggested by ticket 18332.
o Minor bugfixes (IPv6):
- Update the limits in max_dl_per_request for IPv6 address length.
Fixes bug 17573; bugfix on 0.2.1.5-alpha.
o Minor bugfixes (Linux seccomp2 sandbox):
- Allow more syscalls when running with "Sandbox 1" enabled:
sysinfo, getsockopt(SO_SNDBUF), and setsockopt(SO_SNDBUFFORCE). On
some systems, these are required for Tor to start. Fixes bug
18397; bugfix on 0.2.5.1-alpha. Patch from Daniel Pinto.
- Allow IPPROTO_UDP datagram sockets when running with "Sandbox 1",
so that get_interface_address6_via_udp_socket_hack() can work.
Fixes bug 19660; bugfix on 0.2.5.1-alpha.
- Allow the setrlimit syscall, and the prlimit and prlimit64
syscalls, which some libc implementations use under the hood.
Fixes bug 15221; bugfix on 0.2.5.1-alpha.
- Avoid a 10-second delay when starting as a client with "Sandbox 1"
enabled and no DNS resolvers configured. This should help TAILS
start up faster. Fixes bug 18548; bugfix on 0.2.5.1-alpha.
- Fix a crash when using offline master ed25519 keys with the Linux
seccomp2 sandbox enabled. Fixes bug 17675; bugfix on 0.2.7.3-rc.
- Allow statistics to be written to disk when "Sandbox 1" is
enabled. Fixes bugs 19556 and 19957; bugfix on 0.2.5.1-alpha and
0.2.6.1-alpha respectively.
o Minor bugfixes (logging):
- In log messages that include a function name, use __FUNCTION__
instead of __PRETTY_FUNCTION__. In GCC, these are synonymous, but
with clang __PRETTY_FUNCTION__ has extra information we don't
need. Fixes bug 16563; bugfix on 0.0.2pre8. Fix by Tom van
der Woerdt.
- Remove needless quotes from a log message about unparseable
addresses. Fixes bug 17843; bugfix on 0.2.3.3-alpha.
- Scrub service name in "unrecognized service ID" log messages.
Fixes bug 18600; bugfix on 0.2.4.11-alpha.
- When logging information about an unparsable networkstatus vote or
consensus, do not say "vote" when we mean consensus. Fixes bug
18368; bugfix on 0.2.0.8-alpha.
- When we can't generate a signing key because OfflineMasterKey is
set, do not imply that we should have been able to load it. Fixes
bug 18133; bugfix on 0.2.7.2-alpha.
- When logging a malformed hostname received through socks4, scrub
it if SafeLogging says we should. Fixes bug 17419; bugfix
on 0.1.1.16-rc.
o Minor bugfixes (memory safety):
- Avoid freeing an uninitialized pointer when opening a socket fails
in get_interface_addresses_ioctl(). Fixes bug 18454; bugfix on
0.2.3.11-alpha. Reported by toralf and "cypherpunks", patch
by teor.
- Fix a memory leak in "tor --list-fingerprint". Fixes part of bug
18672; bugfix on 0.2.5.1-alpha.
- Fix a memory leak in tor-gencert. Fixes part of bug 18672; bugfix
on 0.2.0.1-alpha.
o Minor bugfixes (pluggable transports):
- Avoid reporting a spurious error when we decide that we don't need
to terminate a pluggable transport because it has already exited.
Fixes bug 18686; bugfix on 0.2.5.5-alpha.
o Minor bugfixes (pointer arithmetic):
- Fix a bug in memarea_alloc() that could have resulted in remote
heap write access, if Tor had ever passed an unchecked size to
memarea_alloc(). Fortunately, all the sizes we pass to
memarea_alloc() are pre-checked to be less than 128 kilobytes.
Fixes bug 19150; bugfix on 0.2.1.1-alpha. Bug found by
Guido Vranken.
o Minor bugfixes (private directory):
- Prevent a race condition when creating private directories. Fixes
part of bug 17852; bugfix on 0.0.2pre13. Part of ticket 17852.
Patch from jsturgix. Found with Flawfinder.
o Minor bugfixes (relays):
- Check that both the ORPort and DirPort (if present) are reachable
before publishing a relay descriptor. Otherwise, relays publish a
descriptor with DirPort 0 when the DirPort reachability test takes
longer than the ORPort reachability test. Fixes bug 18050; bugfix
on 0.1.0.1-rc. Reported by "starlight", patch by teor.
- Resolve some edge cases where we might launch an ORPort
reachability check even when DisableNetwork is set. Noticed while
fixing bug 18616; bugfix on 0.2.3.9-alpha.
o Minor bugfixes (relays, hidden services):
- Refuse connection requests to private OR addresses unless
ExtendAllowPrivateAddresses is set. Previously, tor would connect,
then refuse to send any cells to a private address. Fixes bugs
17674 and 8976; bugfix on 0.2.3.21-rc. Patch by teor.
o Minor bugfixes (security, hidden services):
- Prevent hidden services connecting to client-supplied rendezvous
addresses that are reserved as internal or multicast. Fixes bug
8976; bugfix on 0.2.3.21-rc. Patch by dgoulet and teor.
o Minor bugfixes (statistics):
- Consistently check for overflow in round_*_to_next_multiple_of
functions, and add unit tests with additional and maximal values.
Fixes part of bug 13192; bugfix on 0.2.2.1-alpha.
- Handle edge cases in the laplace functions: avoid division by
zero, avoid taking the log of zero, and silence clang type
conversion warnings using round and trunc. Add unit tests for edge
cases with maximal values. Fixes part of bug 13192; bugfix
on 0.2.6.2-alpha.
- We now include consensus downloads via IPv6 in our directory-
request statistics. Fixes bug 18460; bugfix on 0.2.3.14-alpha.
o Minor bugfixes (test networks, IPv6):
- Allow internal IPv6 addresses in descriptors in test networks.
Fixes bug 17153; bugfix on 0.2.3.16-alpha. Patch by teor, reported
by karsten.
o Minor bugfixes (testing):
- Check the full results of SHA256 and SHA512 digests in the unit
tests. Bugfix on 0.2.2.4-alpha. Patch by teor.
- Fix a memory leak in the ntor test. Fixes bug 17778; bugfix
on 0.2.4.8-alpha.
- Fix a small memory leak that would occur when the
TestingEnableCellStatsEvent option was turned on. Fixes bug 18673;
bugfix on 0.2.5.2-alpha.
- Make unit tests pass on IPv6-only systems, and systems without
localhost addresses (like some FreeBSD jails). Fixes bug 17632;
bugfix on 0.2.7.3-rc. Patch by teor.
- The test for log_heartbeat was incorrectly failing in timezones
with non-integer offsets. Instead of comparing the end of the time
string against a constant, compare it to the output of
format_local_iso_time when given the correct input. Fixes bug
18039; bugfix on 0.2.5.4-alpha.
- We no longer disable assertions in the unit tests when coverage is
enabled. Instead, we require you to say --disable-asserts-in-tests
to the configure script if you need assertions disabled in the
unit tests (for example, if you want to perform branch coverage).
Fixes bug 18242; bugfix on 0.2.7.1-alpha.
o Minor bugfixes (time handling):
- When correcting a corrupt 'struct tm' value, fill in the tm_wday
field. Otherwise, our unit tests crash on Windows. Fixes bug
18977; bugfix on 0.2.2.25-alpha.
- Avoid overflow in tor_timegm when parsing dates in and after 2038
on platforms with 32-bit time_t. Fixes bug 18479; bugfix on
0.0.2pre14. Patch by teor.
o Minor bugfixes (tor-gencert):
- Correctly handle the case where an authority operator enters a
passphrase but sends an EOF before sending a newline. Fixes bug
17443; bugfix on 0.2.0.20-rc. Found by junglefowl.
o Code simplification and refactoring:
- Clean up a little duplicated code in
crypto_expand_key_material_TAP(). Closes ticket 17587; patch
from "pfrankw".
- Decouple the list of streams waiting to be attached to circuits
from the overall connection list. This change makes it possible to
attach streams quickly while simplifying Tor's callgraph and
avoiding O(N) scans of the entire connection list. Closes
ticket 17590.
- Extract the more complicated parts of circuit_mark_for_close()
into a new function that we run periodically before circuits are
freed. This change removes more than half of the functions
currently in the "blob". Closes ticket 17218.
- Move logging of redundant policy entries in
policies_parse_exit_policy_internal into its own function. Closes
ticket 17608; patch from "juce".
- Quote all the string interpolations in configure.ac -- even those
which we are pretty sure can't contain spaces. Closes ticket
17744. Patch from zerosion.
- Remove code for configuring OpenSSL dynamic locks; OpenSSL doesn't
use them. Closes ticket 17926.
- Remove specialized code for non-inplace AES_CTR. 99% of our AES is
inplace, so there's no need to have a separate implementation for
the non-inplace code. Closes ticket 18258. Patch from Malek.
- Simplify return types for some crypto functions that can't
actually fail. Patch from Hassan Alsibyani. Closes ticket 18259.
- When a direct directory request fails immediately on launch,
instead of relaunching that request from inside the code that
launches it, instead mark the connection for teardown. This change
simplifies Tor's callback and prevents the directory-request
launching code from invoking itself recursively. Closes
ticket 17589.
o Documentation:
- Add a description of the correct use of the '--keygen' command-
line option. Closes ticket 17583; based on text by 's7r'.
- Change build messages to refer to "Fedora" instead of "Fedora
Core", and "dnf" instead of "yum". Closes tickets 18459 and 18426.
Patches from "icanhasaccount" and "cypherpunks".
- Document the contents of the 'datadir/keys' subdirectory in the
manual page. Closes ticket 17621.
- Document the minimum HeartbeatPeriod value. Closes ticket 15638.
- Explain actual minima for BandwidthRate. Closes ticket 16382.
- Fix a minor formatting typo in the manpage. Closes ticket 17791.
- Mention torspec URL in the manpage and point the reader to it
whenever we mention a document that belongs in torspce. Fixes
issue 17392.
- Stop recommending use of nicknames to identify relays in our
MapAddress documentation. Closes ticket 18312.
o Removed features:
- Remove client-side support for connecting to Tor relays running
versions of Tor before 0.2.3.6-alpha. These relays didn't support
the v3 TLS handshake protocol, and are no longer allowed on the
Tor network. Implements the client side of ticket 11150. Based on
patches by Tom van der Woerdt.
- We no longer maintain an internal freelist in memarea.c.
Allocators should be good enough to make this code unnecessary,
and it's doubtful that it ever had any performance benefit.
o Testing:
- Add unit tests to check for common RNG failure modes, such as
returning all zeroes, identical values, or incrementing values
(OpenSSL's rand_predictable feature). Patch by teor.
- Always test both ed25519 backends, so that we can be sure that our
batch-open replacement code works. Part of ticket 16794.
- Cover dns_resolve_impl() in dns.c with unit tests. Implements a
portion of ticket 16831.
- Fix several warnings from clang's address sanitizer produced in
the unit tests.
- Log more information when the backtrace tests fail. Closes ticket
17892. Patch from "cypherpunks."
- More unit tests for compat_libevent.c, procmon.c, tortls.c,
util_format.c, directory.c, and options_validate.c. Closes tickets
17075, 17082, 17084, 17003, and 17076 respectively. Patches from
Ola Bini.
- Treat backtrace test failures as expected on FreeBSD until we
solve bug 17808. Closes ticket 18204.
- Unit tests for directory_handle_command_get. Closes ticket 17004.
Patch from Reinaldo de Souza Jr.
1
0
Tor Browser 6.0.2 is now available from the Tor Browser Project page [1]
and also from our distribution directory [2].
1: https://www.torproject.org/download/download-easy.html
2: https://www.torproject.org/dist/torbrowser/6.0.2/
Tor Browser 6.0.2 is a fixup release to address the most pressing issues
we found after switching to Firefox 45.2.0esr.
In particular, we resolved a possible crash bug visible e.g. on Faceboook
or mega.nz and we fixed the broken PDF download button in the PDF reader.
Note: In version 6.0 we started code signing the OS X bundle for Gatekeeper
support. A side effect of this signature is that it makes it harder to
compare the bundles we ship with the bundles produced using reproducible
builds, therefore we plan [3] to post instructions for removing the OS X
code signing parts on our website soon. An other effect is that the
incremental update will not be working for users who installed the previous
version using the .dmg file, due to bug 19410 [4]. The internal updater
should still work, though, doing a complete update.
3: https://bugs.torproject.org/18925
4: https://bugs.torproject.org/19410
Here is the full changelog since 6.0.1:
* All Platforms
* Update Torbutton to 1.9.5.5
* Bug 19417: Clear asmjscache
* Bug 19401: Fix broken PDF download button
* Bug 19411: Don't show update icon if a partial update failed
* Bug 19400: Back out GCC bug workaround to avoid asmjs crash
* Windows
* Bug 19348: Adapt to more than one build target on Windows (fixes updates)
* Linux
* Bug 19276: Disable Xrender due to possible performance regressions
1
0
Tor Browser 6.0.1 is now available from the Tor Browser Project page [1]
and also from our distribution directory [2].
1: https://www.torproject.org/download/download-easy.html
2: https://www.torproject.org/dist/torbrowser/6.0.1/
This release features important security updates [3] to Firefox.
3: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#f…
Tor Browser 6.0.1 is the first point release in our 6.0 series. It
updates Firefox to 45.2.0esr, contains fixes for two crash bugs and
does not ship the loop extension anymore.
Here is the full changelog since 6.0:
* All Platforms
* Update Firefox to 45.2.0esr
* Bug 18884: Don't build the loop extension
* Bug 19187: Backport fix for crash related to popup menus
* Bug 19212: Fix crash related to network panel in developer tools
* Linux
* Bug 19189: Backport for working around a linker (gold) bug
1
0
The Tor Browser Team is proud to announce the first stable release in
the 6.0 series. This release is available from the Tor Browser Project
page [1] and also from our distribution directory [2].
1: https://www.torproject.org/download/download-easy.html
2: https://www.torproject.org/dist/torbrowser/6.0/
This release brings us up to date with Firefox 45-ESR [3], which should
mean a better support for HTML5 video on Youtube, as well as a host of
other improvements.
3: https://www.mozilla.org/en-US/firefox/organizations/faq/
Beginning with the 6.0 series code-signing for OS X systems is introduced.
This should help our users who had trouble with getting Tor Browser to
work on their Mac due to Gatekeeper interference. There were bundle layout
changes necessary to adhere to code signing requirements but the
transition to the new Tor Browser layout on disk should go smoothly.
The release also features new privacy enhancements and disables features
where we either did not have the time [4] to write a proper fix or where
we decided they are rather potentially harmful in a Tor Browser context.
4: https://bugs.torproject.org/16998
On the security side this release makes sure that SHA1 certificate support
is disabled [5] and our updater is not only relying on the signature alone
but is checking the hash [6] of the downloaded update file as well before
applying it. Moreover, we provide a fix [7] for a Windows installer
related DLL hijacking vulnerability.
5: https://bugs.torproject.org/18042
6: https://bugs.torproject.org/19121
7: https://bugs.torproject.org/17895
A note on our search engine situation: Lately, we got a couple of comments
on our blog and via email wondering why we are now using DuckDuckGo as
the default search engine and not Disconnect anymore. Well, we still use
Disconnect. But for a while now Disconnect has no access to Google search
results anymore which we used in Tor Browser. Disconnect being more a meta
search engine which allows users to choose between different search
providers fell back to delivering Bing search results which were basically
unacceptable quality-wise. While Disconnect is still trying to fix the
situation we asked them to change the fallback to DuckDuckGo as their
search results are strictly better than the ones Bing delivers.
The full changelog since Tor Browser 5.5.5 is:
Tor Browser 6.0 -- May 30
* All Platforms
* Update Firefox to 45.1.1esr
* Update OpenSSL to 1.0.1t
* Update Torbutton to 1.9.5.4
* Bug 18466: Make Torbutton compatible with Firefox ESR 45
* Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu
* Bug 18905: Hide unusable items from help menu
* Bug 16017: Allow users to more easily set a non-tor SSH proxy
* Bug 17599: Provide shortcuts for New Identity and New Circuit
* Translation updates
* Code clean-up
* Update Tor Launcher to 0.2.9.3
* Bug 13252: Do not store data in the application bundle
* Bug 18947: Tor Browser is not starting on OS X if put into /Applications
* Bug 11773: Setup wizard UI flow improvements
* Translation updates
* Update HTTPS-Everywhere to 5.1.9
* Update meek to 0.22 (tag 0.22-18371-3)
* Bug 18371: Symlinks are incompatible with Gatekeeper signing
* Bug 18904: Mac OS: meek-http-helper profile not updated
* Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45
* Bug 18900: Fix broken updater on Linux
* Bug 19121: The update.xml hash should get checked during update
* Bug 18042: Disable SHA1 certificate support
* Bug 18821: Disable libmdns support for desktop and mobile
* Bug 18848: Disable additional welcome URL shown on first start
* Bug 14970: Exempt our extensions from signing requirement
* Bug 16328: Disable MediaDevices.enumerateDevices
* Bug 16673: Disable HTTP Alternative-Services
* Bug 17167: Disable Mozilla's tracking protection
* Bug 18603: Disable performance-based WebGL fingerprinting option
* Bug 18738: Disable Selfsupport and Unified Telemetry
* Bug 18799: Disable Network Tickler
* Bug 18800: Remove DNS lookup in lockfile code
* Bug 18801: Disable dom.push preferences
* Bug 18802: Remove the JS-based Flash VM (Shumway)
* Bug 18863: Disable MozTCPSocket explicitly
* Bug 15640: Place Canvas MediaStream behind site permission
* Bug 16326: Verify cache isolation for Request and Fetch APIs
* Bug 18741: Fix OCSP and favicon isolation for ESR 45
* Bug 16998: Disable <link rel="preconnect"> for now
* Bug 18898: Exempt the meek extension from the signing requirement as well
* Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile
* Bug 18890: Test importScripts() for cache and network isolation
* Bug 18886: Hide pocket menu items when Pocket is disabled
* Bug 18703: Fix circuit isolation issues on Page Info dialog
* Bug 19115: Tor Browser should not fall back to Bing as its search engine
* Bug 18915+19065: Use our search plugins in localized builds
* Bug 19176: Zip our language packs deterministically
* Bug 18811: Fix first-party isolation for blobs URLs in Workers
* Bug 18950: Disable or audit Reader View
* Bug 18886: Remove Pocket
* Bug 18619: Tor Browser reports "InvalidStateError" in browser console
* Bug 18945: Disable monitoring the connected state of Tor Browser users
* Bug 18855: Don't show error after add-on directory clean-up
* Bug 18885: Disable the option of logging TLS/SSL key material
* Bug 18770: SVGs should not show up on Page Info dialog when disabled
* Bug 18958: Spoof screen.orientation values
* Bug 19047: Disable Heartbeat prompts
* Bug 18914: Use English-only label in <isindex/> tags
* Bug 18996: Investigate server logging in esr45-based Tor Browser
* Bug 17790: Add unit tests for keyboard fingerprinting defenses
* Bug 18995: Regression test to ensure CacheStorage is disabled
* Bug 18912: Add automated tests for updater cert pinning
* Bug 16728: Add test cases for favicon isolation
* Bug 18976: Remove some FTE bridges
* Windows
* Bug 13419: Support ICU in Windows builds
* Bug 16874: Fix broken https://sports.yahoo.com/dailyfantasy page
* Bug 18767: Context menu is broken on Windows in ESR 45 based Tor Browser
* OS X
* Bug 6540: Support OS X Gatekeeper
* Bug 13252: Tor Browser should not store data in the application bundle
* Bug 18951: HTTPS-E is missing after update
* Bug 18904: meek-http-helper profile not updated
* Bug 18928: Upgrade is not smooth (requires another restart)
* Build System
* All Platforms
* Bug 18127: Add LXC support for building with Debian guest VMs
* Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds
* Bug 18919: Remove unused keys and unused dependencies
* Windows
* Bug 17895: Use NSIS 2.51 for installer to avoid DLL hijacking
* Bug 18290: Bump mingw-w64 commit we use
* OS X
* Bug 18331: Update toolchain for Firefox 45 ESR
* Bug 18690: Switch to Debian Wheezy guest VMs
* Linux
* Bug 18699: Stripping fails due to obsolete Browser/components directory
* Bug 18698: Include libgconf2-dev for our Linux builds
* Bug 15578: Switch to Debian Wheezy guest VMs (10.04 LTS is EOL)
1
0
Tor Browser 5.5.5 is now available from the Tor Browser Project page [1]
and also from our distribution directory [2].
1: https://www.torproject.org/download/download-easy.html
2: https://www.torproject.org/dist/torbrowser/5.5.5/
This release features important security updates [3] to Firefox.
3: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#f…
This release updates Firefox to 38.8.0esr. Additionally, we bump NoScript
to version 2.9.0.11 and HTTPS-Everywhere to 5.1.6.
Moreover, we don't advertise our help desk anymore as we are currently
restructuring our user support.
Here is the full changelog since 5.5.4:
Tor Browser 5.5.5 -- April 26 2016
* All Platforms
* Update Firefox to 38.8.0esr
* Update Tor Launcher to 0.2.7.9
* Bug 10534: Don't advertise the help desk directly anymore
* Translation updates
* Update HTTPS-Everywhere to 5.1.6
* Update NoScript to 2.9.0.11
* Bug 18726: Add new default obfs4 bridge (GreenBelt)
_______________________________________________
You are receiving this email because you are subscribed to the tor-announce
mailing list. Starting with Tor Browser 5.5.5, we are using this mailing
list to announce Tor Browser stable releases:
https://trac.torproject.org/projects/tor/ticket/18594
If you want to unsubscribe, use the form at the bottom of this page:
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce
1
0
Hi, all!
(If you are about to reply saying "please take me off this list",
instead please follow the instructions over here to get yourself
removed: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/
. You will have to enter the actual email address you used to
subscribe.)
Tor version 0.2.7.6 fixes a major bug in entry guard selection, as
well as a minor bug in hidden service reliability. (For Roger's
preliminary analysis of the guard selection bug, see
https://trac.torproject.org/projects/tor/ticket/17772#comment:1 )
You can download the source from the usual place on the website.
Packages should be up in a few days.
Changes in version 0.2.7.6 - 2015-12-10
Tor version 0.2.7.6 fixes a major bug in entry guard selection, as
well as a minor bug in hidden service reliability.
o Major bugfixes (guard selection):
- Actually look at the Guard flag when selecting a new directory
guard. When we implemented the directory guard design, we
accidentally started treating all relays as if they have the Guard
flag during guard selection, leading to weaker anonymity and worse
performance. Fixes bug 17772; bugfix on 0.2.4.8-alpha. Discovered
by Mohsen Imani.
o Minor features (geoip):
- Update geoip and geoip6 to the December 1 2015 Maxmind GeoLite2
Country database.
o Minor bugfixes (compilation):
- When checking for net/pfvar.h, include netinet/in.h if possible.
This fixes transparent proxy detection on OpenBSD. Fixes bug
17551; bugfix on 0.1.2.1-alpha. Patch from "rubiate".
- Fix a compilation warning with Clang 3.6: Do not check the
presence of an address which can never be NULL. Fixes bug 17781.
o Minor bugfixes (correctness):
- When displaying an IPv6 exit policy, include the mask bits
correctly even when the number is greater than 31. Fixes bug
16056; bugfix on 0.2.4.7-alpha. Patch from "gturner".
- The wrong list was used when looking up expired intro points in a
rend service object, causing what we think could be reachability
issues for hidden services, and triggering a BUG log. Fixes bug
16702; bugfix on 0.2.7.2-alpha.
- Fix undefined behavior in the tor_cert_checksig function. Fixes
bug 17722; bugfix on 0.2.7.2-alpha.
1
0
Hi, all!
(If you are about to reply saying "please take me off this list",
instead please follow the instructions over here to get yourself
removed: https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce/
. You will have to enter the actual email address you used to
subscribe.)
Tor 0.2.7.5 is the first stable release in the Tor 0.2.7 series. It
makes no changes beyond those in 0.2.7.4-rc; the summary below lists
all changes in the 0.2.7 series.
You can download the source from the usual place on the website.
Packages should be up in a few days.
Changes in version 0.2.7.5 - 2015-11-20
The Tor 0.2.7 release series is dedicated to the memory of Tor user
and privacy advocate Caspar Bowden (1961-2015). Caspar worked
tirelessly to advocate human rights regardless of national borders,
and oppose the encroachments of mass surveillance. He opposed national
exceptionalism, he brought clarity to legal and policy debates, he
understood and predicted the impact of mass surveillance on the world,
and he laid the groundwork for resisting it. While serving on the Tor
Project's board of directors, he brought us his uncompromising focus
on technical excellence in the service of humankind. Caspar was an
inimitable force for good and a wonderful friend. He was kind,
humorous, generous, gallant, and believed we should protect one
another without exception. We honor him here for his ideals, his
efforts, and his accomplishments. Please honor his memory with works
that would make him proud.
The 0.2.7 series adds a more secure identity key type for relays,
improves cryptography performance, resolves several longstanding
hidden-service performance issues, improves controller support for
hidden services, and includes small bugfixes and performance
improvements throughout the program. This release series also includes
more tests than before, and significant simplifications to which parts
of Tor invoke which others. For a full list of changes, see below.
o New system requirements:
- Tor no longer includes workarounds to support Libevent versions
before 1.3e. Libevent 2.0 or later is recommended. Closes
ticket 15248.
- Tor no longer supports copies of OpenSSL that are missing support
for Elliptic Curve Cryptography. (We began using ECC when
available in 0.2.4.8-alpha, for more safe and efficient key
negotiation.) In particular, support for at least one of P256 or
P224 is now required, with manual configuration needed if only
P224 is available. Resolves ticket 16140.
- Tor no longer supports versions of OpenSSL before 1.0. (If you are
on an operating system that has not upgraded to OpenSSL 1.0 or
later, and you compile Tor from source, you will need to install a
more recent OpenSSL to link Tor against.) These versions of
OpenSSL are still supported by the OpenSSL, but the numerous
cryptographic improvements in later OpenSSL releases makes them a
clear choice. Resolves ticket 16034.
o Major features (controller):
- Add the ADD_ONION and DEL_ONION commands that allow the creation
and management of hidden services via the controller. Closes
ticket 6411.
- New "GETINFO onions/current" and "GETINFO onions/detached"
commands to get information about hidden services created via the
controller. Part of ticket 6411.
- New HSFETCH command to launch a request for a hidden service
descriptor. Closes ticket 14847.
- New HSPOST command to upload a hidden service descriptor. Closes
ticket 3523. Patch by "DonnchaC".
o Major features (Ed25519 identity keys, Proposal 220):
- Add support for offline encrypted Ed25519 master keys. To use this
feature on your tor relay, run "tor --keygen" to make a new master
key (or to make a new signing key if you already have a master
key). Closes ticket 13642.
- All relays now maintain a stronger identity key, using the Ed25519
elliptic curve signature format. This master key is designed so
that it can be kept offline. Relays also generate an online
signing key, and a set of other Ed25519 keys and certificates.
These are all automatically regenerated and rotated as needed.
Implements part of ticket 12498.
- Directory authorities now vote on Ed25519 identity keys along with
RSA1024 keys. Implements part of ticket 12498.
- Directory authorities track which Ed25519 identity keys have been
used with which RSA1024 identity keys, and do not allow them to
vary freely. Implements part of ticket 12498.
- Microdescriptors now include Ed25519 identity keys. Implements
part of ticket 12498.
- Add a --newpass option to allow changing or removing the
passphrase of an encrypted key with tor --keygen. Implements part
of ticket 16769.
- Add a new OfflineMasterKey option to tell Tor never to try loading
or generating a secret Ed25519 identity key. You can use this in
combination with tor --keygen to manage offline and/or encrypted
Ed25519 keys. Implements ticket 16944.
- On receiving a HUP signal, check to see whether the Ed25519
signing key has changed, and reload it if so. Closes ticket 16790.
- Significant usability improvements for Ed25519 key management. Log
messages are better, and the code can recover from far more
failure conditions. Thanks to "s7r" for reporting and diagnosing
so many of these!
o Major features (ECC performance):
- Improve the runtime speed of Ed25519 signature verification by
using Ed25519-donna's batch verification support. Implements
ticket 16533.
- Improve the speed of Ed25519 operations and Curve25519 keypair
generation when built targeting 32 bit x86 platforms with SSE2
available. Implements ticket 16535.
- Improve the runtime speed of Ed25519 operations by using the
public-domain Ed25519-donna by Andrew M. ("floodyberry").
Implements ticket 16467.
- Improve the runtime speed of the ntor handshake by using an
optimized curve25519 basepoint scalarmult implementation from the
public-domain Ed25519-donna by Andrew M. ("floodyberry"), based on
ideas by Adam Langley. Implements ticket 9663.
o Major features (Hidden services):
- Hidden services, if using the EntryNodes option, are required to
use more than one EntryNode, in order to avoid a guard discovery
attack. (This would only affect people who had configured hidden
services and manually specified the EntryNodes option with a
single entry-node. The impact was that it would be easy to
remotely identify the guard node used by such a hidden service.
See ticket for more information.) Fixes ticket 14917.
- Add the torrc option HiddenServiceNumIntroductionPoints, to
specify a fixed number of introduction points. Its maximum value
is 10 and default is 3. Using this option can increase a hidden
service's reliability under load, at the cost of making it more
visible that the hidden service is facing extra load. Closes
ticket 4862.
- Remove the adaptive algorithm for choosing the number of
introduction points, which used to change the number of
introduction points (poorly) depending on the number of
connections the HS sees. Closes ticket 4862.
o Major features (onion key cross-certification):
- Relay descriptors now include signatures of their own identity
keys, made using the TAP and ntor onion keys. These signatures
allow relays to prove ownership of their own onion keys. Because
of this change, microdescriptors will no longer need to include
RSA identity keys. Implements proposal 228; closes ticket 12499.
o Major bugfixes (client-side privacy, also in 0.2.6.9):
- Properly separate out each SOCKSPort when applying stream
isolation. The error occurred because each port's session group
was being overwritten by a default value when the listener
connection was initialized. Fixes bug 16247; bugfix on
0.2.6.3-alpha. Patch by "jojelino".
o Major bugfixes (hidden service clients, stability, also in 0.2.6.10):
- Stop refusing to store updated hidden service descriptors on a
client. This reverts commit 9407040c59218 (which indeed fixed bug
14219, but introduced a major hidden service reachability
regression detailed in bug 16381). This is a temporary fix since
we can live with the minor issue in bug 14219 (it just results in
some load on the network) but the regression of 16381 is too much
of a setback. First-round fix for bug 16381; bugfix
on 0.2.6.3-alpha.
o Major bugfixes (hidden services):
- Revert commit that made directory authorities assign the HSDir
flag to relay without a DirPort; this was bad because such relays
can't handle BEGIN_DIR cells. Fixes bug 15850; bugfix
on tor-0.2.6.3-alpha.
- When cannibalizing a circuit for an introduction point, always
extend to the chosen exit node (creating a 4 hop circuit).
Previously Tor would use the current circuit exit node, which
changed the original choice of introduction point, and could cause
the hidden service to skip excluded introduction points or
reconnect to a skipped introduction point. Fixes bug 16260; bugfix
on 0.1.0.1-rc.
o Major bugfixes (memory leaks):
- Fix a memory leak in ed25519 batch signature checking. Fixes bug
17398; bugfix on 0.2.6.1-alpha.
o Major bugfixes (open file limit):
- The open file limit wasn't checked before calling
tor_accept_socket_nonblocking(), which would make Tor exceed the
limit. Now, before opening a new socket, Tor validates the open
file limit just before, and if the max has been reached, return an
error. Fixes bug 16288; bugfix on 0.1.1.1-alpha.
o Major bugfixes (security, correctness):
- Fix an error that could cause us to read 4 bytes before the
beginning of an openssl string. This bug could be used to cause
Tor to crash on systems with unusual malloc implementations, or
systems with unusual hardening installed. Fixes bug 17404; bugfix
on 0.2.3.6-alpha.
o Major bugfixes (stability, also in 0.2.6.10):
- Stop crashing with an assertion failure when parsing certain kinds
of malformed or truncated microdescriptors. Fixes bug 16400;
bugfix on 0.2.6.1-alpha. Found by "torkeln"; fix based on a patch
by "cypherpunks_backup".
- Stop random client-side assertion failures that could occur when
connecting to a busy hidden service, or connecting to a hidden
service while a NEWNYM is in progress. Fixes bug 16013; bugfix
on 0.1.0.1-rc.
o Minor features (client, SOCKS):
- Add GroupWritable and WorldWritable options to unix-socket based
SocksPort and ControlPort options. These options apply to a single
socket, and override {Control,Socks}SocketsGroupWritable. Closes
ticket 15220.
- Relax the validation done to hostnames in SOCKS5 requests, and
allow a single trailing '.' to cope with clients that pass FQDNs
using that syntax to explicitly indicate that the domain name is
fully-qualified. Fixes bug 16674; bugfix on 0.2.6.2-alpha.
- Relax the validation of hostnames in SOCKS5 requests, allowing the
character '_' to appear, in order to cope with domains observed in
the wild that are serving non-RFC compliant records. Resolves
ticket 16430.
o Minor features (client-side privacy):
- New KeepAliveIsolateSOCKSAuth option to indefinitely extend circuit
lifespan when IsolateSOCKSAuth and streams with SOCKS
authentication are attached to the circuit. This allows
applications like TorBrowser to manage circuit lifetime on their
own. Implements feature 15482.
- When logging malformed hostnames from SOCKS5 requests, respect
SafeLogging configuration. Fixes bug 16891; bugfix on 0.1.1.16-rc.
o Minor features (clock-jump tolerance):
- Recover better when our clock jumps back many hours, like might
happen for Tails or Whonix users who start with a very wrong
hardware clock, use Tor to discover a more accurate time, and then
fix their clock. Resolves part of ticket 8766.
o Minor features (command-line interface):
- Make --hash-password imply --hush to prevent unnecessary noise.
Closes ticket 15542. Patch from "cypherpunks".
- Print a warning whenever we find a relative file path being used
as torrc option. Resolves issue 14018.
o Minor features (compilation):
- Give a warning as early as possible when trying to build with an
unsupported OpenSSL version. Closes ticket 16901.
- Use C99 variadic macros when the compiler is not GCC. This avoids
failing compilations on MSVC, and fixes a log-file-based race
condition in our old workarounds. Original patch from Gisle Vanem.
o Minor features (control protocol):
- Support network-liveness GETINFO key and NETWORK_LIVENESS event in
the control protocol. Resolves ticket 15358.
o Minor features (controller):
- Add DirAuthority lines for default directory authorities to the
output of the "GETINFO config/defaults" command if not already
present. Implements ticket 14840.
- Controllers can now use "GETINFO hs/client/desc/id/..." to
retrieve items from the client's hidden service descriptor cache.
Closes ticket 14845.
- Implement a new controller command "GETINFO status/fresh-relay-
descs" to fetch a descriptor/extrainfo pair that was generated on
demand just for the controller's use. Implements ticket 14784.
o Minor features (directory authorities):
- Directory authorities no longer vote against the "Fast", "Stable",
and "HSDir" flags just because they were going to vote against
"Running": if the consensus turns out to be that the router was
running, then the authority's vote should count. Patch from Peter
Retzlaff; closes issue 8712.
o Minor features (directory authorities, security, also in 0.2.6.9):
- The HSDir flag given by authorities now requires the Stable flag.
For the current network, this results in going from 2887 to 2806
HSDirs. Also, it makes it harder for an attacker to launch a sybil
attack by raising the effort for a relay to become Stable to
require at the very least 7 days, while maintaining the 96 hours
uptime requirement for HSDir. Implements ticket 8243.
o Minor features (DoS-resistance):
- Make it harder for attackers to overload hidden services with
introductions, by blocking multiple introduction requests on the
same circuit. Resolves ticket 15515.
o Minor features (geoip):
- Update geoip and geoip6 to the October 9 2015 Maxmind GeoLite2
Country database.
o Minor features (hidden services):
- Add the new options "HiddenServiceMaxStreams" and
"HiddenServiceMaxStreamsCloseCircuit" to allow hidden services to
limit the maximum number of simultaneous streams per circuit, and
optionally tear down the circuit when the limit is exceeded. Part
of ticket 16052.
- Client now uses an introduction point failure cache to know when
to fetch or keep a descriptor in their cache. Previously, failures
were recorded implicitly, but not explicitly remembered. Closes
ticket 16389.
- Relays need to have the Fast flag to get the HSDir flag. As this
is being written, we'll go from 2745 HSDirs down to 2342, a ~14%
drop. This change should make some attacks against the hidden
service directory system harder. Fixes ticket 15963.
- Turn on hidden service statistics collection by setting the torrc
option HiddenServiceStatistics to "1" by default. (This keeps
track only of the fraction of traffic used by hidden services, and
the total number of hidden services in existence.) Closes
ticket 15254.
- To avoid leaking HS popularity, don't cycle the introduction point
when we've handled a fixed number of INTRODUCE2 cells but instead
cycle it when a random number of introductions is reached, thus
making it more difficult for an attacker to find out the amount of
clients that have used the introduction point for a specific HS.
Closes ticket 15745.
o Minor features (logging):
- Include the Tor version in all LD_BUG log messages, since people
tend to cut and paste those into the bugtracker. Implements
ticket 15026.
o Minor features (pluggable transports):
- When launching managed pluggable transports on Linux systems,
attempt to have the kernel deliver a SIGTERM on tor exit if the
pluggable transport process is still running. Resolves
ticket 15471.
- When launching managed pluggable transports, setup a valid open
stdin in the child process that can be used to detect if tor has
terminated. The "TOR_PT_EXIT_ON_STDIN_CLOSE" environment variable
can be used by implementations to detect this new behavior.
Resolves ticket 15435.
o Minor bugfixes (torrc exit policies):
- In each instance above, usage advice is provided to avoid the
message. Resolves ticket 16069. Patch by "teor". Fixes part of bug
16069; bugfix on 0.2.4.7-alpha.
- In torrc, "accept6 *" and "reject6 *" ExitPolicy lines now only
produce IPv6 wildcard addresses. Previously they would produce
both IPv4 and IPv6 wildcard addresses. Patch by "teor". Fixes part
of bug 16069; bugfix on 0.2.4.7-alpha.
- When parsing torrc ExitPolicies, we now issue an info-level
message when expanding an "accept/reject *" line to include both
IPv4 and IPv6 wildcard addresses. Related to ticket 16069.
- When parsing torrc ExitPolicies, we now warn for a number of cases
where the user's intent is likely to differ from Tor's actual
behavior. These include: using an IPv4 address with an accept6 or
reject6 line; using "private" on an accept6 or reject6 line; and
including any ExitPolicy lines after accept *:* or reject *:*.
Related to ticket 16069.
o Minor bugfixes (command-line interface):
- When "--quiet" is provided along with "--validate-config", do not
write anything to stdout on success. Fixes bug 14994; bugfix
on 0.2.3.3-alpha.
- When complaining about bad arguments to "--dump-config", use
stderr, not stdout.
- Print usage information for --dump-config when it is used without
an argument. Also, fix the error message to use different wording
and add newline at the end. Fixes bug 15541; bugfix
on 0.2.5.1-alpha.
o Minor bugfixes (compilation):
- Fix compilation of sandbox.c with musl-libc. Fixes bug 17347;
bugfix on 0.2.5.1-alpha. Patch from 'jamestk'.
- Repair compilation with the most recent (unreleased, alpha)
vesions of OpenSSL 1.1. Fixes part of ticket 17237.
o Minor bugfixes (compilation, also in 0.2.6.9):
- Build with --enable-systemd correctly when libsystemd is
installed, but systemd is not. Fixes bug 16164; bugfix on
0.2.6.3-alpha. Patch from Peter Palfrader.
o Minor bugfixes (configuration, unit tests):
- Only add the default fallback directories when the DirAuthorities,
AlternateDirAuthority, and FallbackDir directory config options
are set to their defaults. The default fallback directory list is
currently empty, this fix will only change tor's behavior when it
has default fallback directories. Includes unit tests for
consider_adding_dir_servers(). Fixes bug 15642; bugfix on
90f6071d8dc0 in 0.2.4.7-alpha. Patch by "teor".
o Minor bugfixes (controller):
- Add the descriptor ID in each HS_DESC control event. It was
missing, but specified in control-spec.txt. Fixes bug 15881;
bugfix on 0.2.5.2-alpha.
o Minor bugfixes (correctness):
- For correctness, avoid modifying a constant string in
handle_control_postdescriptor. Fixes bug 15546; bugfix
on 0.1.1.16-rc.
- Remove side-effects from tor_assert() calls. This was harmless,
because we never disable assertions, but it is bad style and
unnecessary. Fixes bug 15211; bugfix on 0.2.5.5, 0.2.2.36,
and 0.2.0.10.
- When calling channel_free_list(), avoid calling smartlist_remove()
while inside a FOREACH loop. This partially reverts commit
17356fe7fd96af where the correct SMARTLIST_DEL_CURRENT was
incorrectly removed. Fixes bug 16924; bugfix on 0.2.4.4-alpha.
o Minor bugfixes (crypto error-handling, also in 0.2.6.10):
- Check for failures from crypto_early_init, and refuse to continue.
A previous typo meant that we could keep going with an
uninitialized crypto library, and would have OpenSSL initialize
its own PRNG. Fixes bug 16360; bugfix on 0.2.5.2-alpha, introduced
when implementing ticket 4900. Patch by "teor".
o Minor bugfixes (hidden service):
- Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells on
a client authorized hidden service. Fixes bug 15823; bugfix
on 0.2.1.6-alpha.
- Remove an extraneous newline character from the end of hidden
service descriptors. Fixes bug 15296; bugfix on 0.2.0.10-alpha.
o Minor bugfixes (Linux seccomp2 sandbox):
- Use the sandbox in tor_open_cloexec whether or not O_CLOEXEC is
defined. Patch by "teor". Fixes bug 16515; bugfix on 0.2.3.1-alpha.
- Allow bridge authorities to run correctly under the seccomp2
sandbox. Fixes bug 16964; bugfix on 0.2.5.1-alpha.
- Add the "hidserv-stats" filename to our sandbox filter for the
HiddenServiceStatistics option to work properly. Fixes bug 17354;
bugfix on tor-0.2.6.2-alpha. Patch from David Goulet.
o Minor bugfixes (Linux seccomp2 sandbox, also in 0.2.6.10):
- Allow pipe() and pipe2() syscalls in the seccomp2 sandbox: we need
these when eventfd2() support is missing. Fixes bug 16363; bugfix
on 0.2.6.3-alpha. Patch from "teor".
o Minor bugfixes (Linux seccomp2 sandbox, also in 0.2.6.9):
- Allow systemd connections to work with the Linux seccomp2 sandbox
code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. Patch by
Peter Palfrader.
- Fix sandboxing to work when running as a relay, by allowing the
renaming of secret_id_key, and allowing the eventfd2 and futex
syscalls. Fixes bug 16244; bugfix on 0.2.6.1-alpha. Patch by
Peter Palfrader.
o Minor bugfixes (logging):
- When building Tor under Clang, do not include an extra set of
parentheses in log messages that include function names. Fixes bug
15269; bugfix on every released version of Tor when compiled with
recent enough Clang.
o Minor bugfixes (network):
- When attempting to use fallback technique for network interface
lookup, disregard loopback and multicast addresses since they are
unsuitable for public communications.
o Minor bugfixes (open file limit):
- Fix set_max_file_descriptors() to set by default the max open file
limit to the current limit when setrlimit() fails. Fixes bug
16274; bugfix on tor- 0.2.0.10-alpha. Patch by dgoulet.
o Minor bugfixes (portability):
- Check correctly for Windows socket errors in the workqueue
backend. Fixes bug 16741; bugfix on 0.2.6.3-alpha.
- Try harder to normalize the exit status of the Tor process to the
standard-provided range. Fixes bug 16975; bugfix on every version
of Tor ever.
- Use libexecinfo on FreeBSD to enable backtrace support. Fixes part
of bug 17151; bugfix on 0.2.5.2-alpha. Patch from Marcin Cieślak.
o Minor bugfixes (relay):
- Ensure that worker threads actually exit when a fatal error or
shutdown is indicated. This fix doesn't currently affect the
behavior of Tor, because Tor workers never indicates fatal error
or shutdown except in the unit tests. Fixes bug 16868; bugfix
on 0.2.6.3-alpha.
- Fix a rarely-encountered memory leak when failing to initialize
the thread pool. Fixes bug 16631; bugfix on 0.2.6.3-alpha. Patch
from "cypherpunks".
- Unblock threads before releasing the work queue mutex to ensure
predictable scheduling behavior. Fixes bug 16644; bugfix
on 0.2.6.3-alpha.
o Minor bugfixes (security, exit policies):
- ExitPolicyRejectPrivate now also rejects the relay's published
IPv6 address (if any), and any publicly routable IPv4 or IPv6
addresses on any local interfaces. ticket 17027. Patch by "teor".
Fixes bug 17027; bugfix on 0.2.0.11-alpha.
o Minor bugfixes (statistics):
- Disregard the ConnDirectionStatistics torrc options when Tor is
not a relay since in that mode of operation no sensible data is
being collected and because Tor might run into measurement hiccups
when running as a client for some time, then becoming a relay.
Fixes bug 15604; bugfix on 0.2.2.35.
o Minor bugfixes (systemd):
- Tor's systemd unit file no longer contains extraneous spaces.
These spaces would sometimes confuse tools like deb-systemd-
helper. Fixes bug 16162; bugfix on 0.2.5.5-alpha.
o Minor bugfixes (test networks):
- When self-testing reachability, use ExtendAllowPrivateAddresses to
determine if local/private addresses imply reachability. The
previous fix used TestingTorNetwork, which implies
ExtendAllowPrivateAddresses, but this excluded rare configurations
where ExtendAllowPrivateAddresses is set but TestingTorNetwork is
not. Fixes bug 15771; bugfix on 0.2.6.1-alpha. Patch by "teor",
issue discovered by CJ Ess.
o Minor bugfixes (tests, also in 0.2.6.9):
- Fix a crash in the unit tests when built with MSVC2013. Fixes bug
16030; bugfix on 0.2.6.2-alpha. Patch from "NewEraCracker".
o Code simplification and refactoring:
- Change the function that's called when we need to retry all
downloads so that it only reschedules the downloads to happen
immediately, rather than launching them all at once itself. This
further simplifies Tor's callgraph.
- Define WINVER and _WIN32_WINNT centrally, in orconfig.h, in order
to ensure they remain consistent and visible everywhere.
- Move some format-parsing functions out of crypto.c and
crypto_curve25519.c into crypto_format.c and/or util_format.c.
- Move the client-only parts of init_keys() into a separate
function. Closes ticket 16763.
- Move the hacky fallback code out of get_interface_address6() into
separate function and get it covered with unit-tests. Resolves
ticket 14710.
- Refactor hidden service client-side cache lookup to intelligently
report its various failure cases, and disentangle failure cases
involving a lack of introduction points. Closes ticket 14391.
- Remove some vestigial workarounds for the MSVC6 compiler. We
haven't supported that in ages.
- Remove the unused "nulterminate" argument from buf_pullup().
- Simplify the microdesc_free() implementation so that it no longer
appears (to code analysis tools) to potentially invoke a huge
suite of other microdesc functions.
- Simply the control graph further by deferring the inner body of
directory_all_unreachable() into a callback. Closes ticket 16762.
- The link authentication code has been refactored for better
testability and reliability. It now uses code generated with the
"trunnel" binary encoding generator, to reduce the risk of bugs
due to programmer error. Done as part of ticket 12498.
- Treat the loss of an owning controller as equivalent to a SIGTERM
signal. This removes a tiny amount of duplicated code, and
simplifies our callgraph. Closes ticket 16788.
- Use our own Base64 encoder instead of OpenSSL's, to allow more
control over the output. Part of ticket 15652.
- When generating an event to send to the controller, we no longer
put the event over the network immediately. Instead, we queue
these events, and use a Libevent callback to deliver them. This
change simplifies Tor's callgraph by reducing the number of
functions from which all other Tor functions are reachable. Closes
ticket 16695.
- Wrap Windows-only C files inside '#ifdef _WIN32' so that tools
that try to scan or compile every file on Unix won't decide that
they are broken.
o Documentation:
- Fix capitalization of SOCKS in sample torrc. Closes ticket 15609.
- Improve the descriptions of statistics-related torrc options in
the manpage to describe rationale and possible uses cases. Fixes
issue 15550.
- Improve the layout and formatting of ./configure --help messages.
Closes ticket 15024. Patch from "cypherpunks".
- Include a specific and (hopefully) accurate documentation of the
torrc file's meta-format in doc/torrc_format.txt. This is mainly
of interest to people writing programs to parse or generate torrc
files. This document is not a commitment to long-term
compatibility; some aspects of the current format are a bit
ridiculous. Closes ticket 2325.
- Include the TUNING document in our source tarball. It is referred
to in the ChangeLog and an error message. Fixes bug 16929; bugfix
on 0.2.6.1-alpha.
- Note that HiddenServicePorts can take a unix domain socket. Closes
ticket 17364.
- Recommend a 40 GB example AccountingMax in torrc.sample rather
than a 4 GB max. Closes ticket 16742.
- Standardize on the term "server descriptor" in the manual page.
Previously, we had used "router descriptor", "server descriptor",
and "relay descriptor" interchangeably. Part of ticket 14987.
- Advise users on how to configure separate IPv4 and IPv6 exit
policies in the manpage and sample torrcs. Related to ticket 16069.
- Fix an error in the manual page and comments for
TestingDirAuthVoteHSDir[IsStrict], which suggested that a HSDir
required "ORPort connectivity". While this is true, it is in no
way unique to the HSDir flag. Of all the flags, only HSDirs need a
DirPort configured in order for the authorities to assign that
particular flag. Patch by "teor". Fixed as part of 14882; bugfix
on 0.2.6.3-alpha.
- Fix the usage message of tor-resolve(1) so that it no longer lists
the removed -F option. Fixes bug 16913; bugfix on 0.2.2.28-beta.
o Removed code:
- Remove `USE_OPENSSL_BASE64` and the corresponding fallback code
and always use the internal Base64 decoder. The internal decoder
has been part of tor since tor-0.2.0.10-alpha, and no one should
be using the OpenSSL one. Part of ticket 15652.
- Remove the 'tor_strclear()' function; use memwipe() instead.
Closes ticket 14922.
- Remove the code that would try to aggressively flush controller
connections while writing to them. This code was introduced in
0.1.2.7-alpha, in order to keep output buffers from exceeding
their limits. But there is no longer a maximum output buffer size,
and flushing data in this way caused some undesirable recursions
in our call graph. Closes ticket 16480.
- The internal pure-C tor-fw-helper tool is now removed from the Tor
distribution, in favor of the pure-Go clone available from
https://gitweb.torproject.org/tor-fw-helper.git/ . The libraries
used by the C tor-fw-helper are not, in our opinion, very
confidence- inspiring in their secure-programming techniques.
Closes ticket 13338.
o Removed features:
- Remove the (seldom-used) DynamicDHGroups feature. For anti-
fingerprinting we now recommend pluggable transports; for forward-
secrecy in TLS, we now use the P-256 group. Closes ticket 13736.
- Remove the HidServDirectoryV2 option. Now all relays offer to
store hidden service descriptors. Related to 16543.
- Remove the VoteOnHidServDirectoriesV2 option, since all
authorities have long set it to 1. Closes ticket 16543.
- Remove the undocumented "--digests" command-line option. It
complicated our build process, caused subtle build issues on
multiple platforms, and is now redundant since we started
including git version identifiers. Closes ticket 14742.
- Tor no longer contains checks for ancient directory cache versions
that didn't know about microdescriptors.
- Tor no longer contains workarounds for stat files generated by
super-old versions of Tor that didn't choose guards sensibly.
o Testing:
- The test-network.sh script now supports performance testing.
Requires corresponding chutney performance testing changes. Patch
by "teor". Closes ticket 14175.
- Add a new set of callgraph analysis scripts that use clang to
produce a list of which Tor functions are reachable from which
other Tor functions. We're planning to use these to help simplify
our code structure by identifying illogical dependencies.
- Add new 'test-full' and 'test-full-online' targets to run all
tests, including integration tests with stem and chutney.
- Autodetect CHUTNEY_PATH if the chutney and Tor sources are side-
by-side in the same parent directory. Closes ticket 16903. Patch
by "teor".
- Document use of coverity, clang static analyzer, and clang dynamic
undefined behavior and address sanitizers in doc/HACKING. Include
detailed usage instructions in the blacklist. Patch by "teor".
Closes ticket 15817.
- Make "bridges+hs" the default test network. This tests almost all
tor functionality during make test-network, while allowing tests
to succeed on non-IPv6 systems. Requires chutney commit 396da92 in
test-network-bridges-hs. Closes tickets 16945 (tor) and 16946
(chutney). Patches by "teor".
- Make the test-workqueue test work on Windows by initializing the
network before we begin.
- New make target (make test-network-all) to run multiple applicable
chutney test cases. Patch from Teor; closes 16953.
- Now that OpenSSL has its own scrypt implementation, add an unit
test that checks for interoperability between libscrypt_scrypt()
and OpenSSL's EVP_PBE_scrypt() so that we could not use libscrypt
and rely on EVP_PBE_scrypt() whenever possible. Resolves
ticket 16189.
- The link authentication protocol code now has extensive tests.
- The relay descriptor signature testing code now has
extensive tests.
- The test_workqueue program now runs faster, and is enabled by
default as a part of "make check".
- Unit test dns_resolve(), dns_clip_ttl() and dns_get_expiry_ttl()
functions in dns.c. Implements a portion of ticket 16831.
- Use environment variables rather than autoconf substitutions to
send variables from the build system to the test scripts. This
change should be easier to maintain, and cause 'make distcheck' to
work better than before. Fixes bug 17148.
- When building Tor with testing coverage enabled, run Chutney tests
(if any) using the 'tor-cov' coverage binary.
- When running test-network or test-stem, check for the absence of
stem/chutney before doing any build operations.
- Add a test to verify that the compiler does not eliminate our
memwipe() implementation. Closes ticket 15377.
- Add make rule `check-changes` to verify the format of changes
files. Closes ticket 15180.
- Add unit tests for control_event_is_interesting(). Add a compile-
time check that the number of events doesn't exceed the capacity
of control_event_t.event_mask. Closes ticket 15431, checks for
bugs similar to 13085. Patch by "teor".
- Command-line argument tests moved to Stem. Resolves ticket 14806.
- Integrate the ntor, backtrace, and zero-length keys tests into the
automake test suite. Closes ticket 15344.
- Remove assertions during builds to determine Tor's test coverage.
We don't want to trigger these even in assertions, so including
them artificially makes our branch coverage look worse than it is.
This patch provides the new test-stem-full and coverage-html-full
configure options. Implements ticket 15400.
- New TestingDirAuthVote{Exit,Guard,HSDir}IsStrict flags to
explicitly manage consensus flags in testing networks. Patch by
"robgjansen", modified by "teor". Implements part of ticket 14882.
- Check for matching value in server response in ntor_ref.py. Fixes
bug 15591; bugfix on 0.2.4.8-alpha. Reported and fixed
by "joelanders".
- Set the severity correctly when testing
get_interface_addresses_ifaddrs() and
get_interface_addresses_win32(), so that the tests fail gracefully
instead of triggering an assertion. Fixes bug 15759; bugfix on
0.2.6.3-alpha. Reported by Nicolas Derive.
1
0