tor-commits December 2011

tor-commits@lists.torproject.org

17 participants
533 discussions

[tor/maint-0.2.2] Merge remote-tracking branch 'sebastian/clang-3.0-fixes_022' into maint-0.2.2
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit cefff11950d0b80de02bc956d5eb21ceeb81260c Merge: 562c974 bcca541 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 16 17:49:41 2011 -0500 Merge remote-tracking branch 'sebastian/clang-3.0-fixes_022' into maint-0.2.2 changes/clang_30_options | 5 +++++ configure.in | 10 ++++------ 2 files changed, 9 insertions(+), 6 deletions(-)

1 0

[tor/master] Build with warnings and clang 3.0
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit bcca541da9f60d95fe7f0f7b3aa6ef4a8251b1e2 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Mon Dec 12 15:36:08 2011 +0100 Build with warnings and clang 3.0 --enable-gcc-warnings enables two warnings that clang doesn't support, so the build fails. We had hoped clang 3.0 would add those, but it didn't, so let's just always disable those warnings when building with clang. We can still fix it later once they add support --- changes/clang_30_options | 5 +++++ configure.in | 10 ++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/changes/clang_30_options b/changes/clang_30_options new file mode 100644 index 0000000..e8e34c8 --- /dev/null +++ b/changes/clang_30_options @@ -0,0 +1,5 @@ + o Code simplifications and refactoring: + - During configure, detect when we're building with clang version 3.0 or + lower and disable the -Wnormalized=id and -Woverride-init CFLAGS. + clang doesn't support them yet. + diff --git a/configure.in b/configure.in index a9339cc..424cccb 100644 --- a/configure.in +++ b/configure.in @@ -940,10 +940,10 @@ if test x$enable_gcc_warnings = xyes || test x$enable_gcc_warnings_advisory = xy #error #endif])], have_gcc43=yes, have_gcc43=no) - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [ -#if !defined(__clang__) || (__clang_major__ > 2) || (__clang_major__ == 2 && __clang_minor__ > 9) +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [ +#if !defined(__clang__) #error -#endif])], have_clang29orlower=yes, have_clang29orlower=no) +#endif])], have_clang=yes, have_clang=no) save_CFLAGS="$CFLAGS" CFLAGS="$CFLAGS -Wshorten-64-to-32" @@ -980,10 +980,8 @@ if test x$enable_gcc_warnings = xyes || test x$enable_gcc_warnings_advisory = xy # We used to use -Wstrict-overflow=5, but that breaks us heavily under 4.3. fi - if test x$have_gcc42 = xyes && test x$have_clang29orlower = xno; then + if test x$have_gcc42 = xyes && test x$have_clang = xno; then # These warnings break gcc 4.0.2 and clang, but work on gcc 4.2 - # We only disable these for clang 2.9 and lower, in case they are - # supported in later versions. CFLAGS="$CFLAGS -Wnormalized=id -Woverride-init" fi

1 0

[tor/master] Merge remote-tracking branch 'sebastian/clang-3.0-fixes_master'
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 9df0bf7a40eab077a5959eb9df6b1db79c729dde Merge: 3ee5924 bcca541 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 16 17:48:25 2011 -0500 Merge remote-tracking branch 'sebastian/clang-3.0-fixes_master' changes/clang_30_options | 5 +++++ configure.in | 10 ++++------ 2 files changed, 9 insertions(+), 6 deletions(-)

1 0

r25261: {website} bump tor stable to 0.2.2.35, tor alpha to 0.2.3.10-alpha, up (website/trunk/include)
by Erinn Clark 16 Dec '11

16 Dec '11

Author: erinn Date: 2011-12-16 17:58:41 +0000 (Fri, 16 Dec 2011) New Revision: 25261 Modified: website/trunk/include/versions.wmi Log: bump tor stable to 0.2.2.35, tor alpha to 0.2.3.10-alpha, update all package versions accordingly Modified: website/trunk/include/versions.wmi =================================================================== --- website/trunk/include/versions.wmi 2011-12-16 08:52:00 UTC (rev 25260) +++ website/trunk/include/versions.wmi 2011-12-16 17:58:41 UTC (rev 25261) @@ -1,55 +1,55 @@ -<define-tag version-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-win32-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-win32-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-win32-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-win32-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-win32-bundle-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-win32-bundle-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-win32-bundle-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-win32-bundle-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-win32-bridge-bundle-stable whitespace=delete>0.2.2.34-<version-vidalia-stable></define-tag> -<define-tag version-win32-relay-bundle-stable whitespace=delete>0.2.2.34-<version-vidalia-stable></define-tag> -<define-tag version-win32-exit-bundle-stable whitespace=delete>0.2.2.34-<version-vidalia-stable>-2</define-tag> +<define-tag version-win32-bridge-bundle-stable whitespace=delete>0.2.2.35-<version-vidalia-stable></define-tag> +<define-tag version-win32-relay-bundle-stable whitespace=delete>0.2.2.35-<version-vidalia-stable></define-tag> +<define-tag version-win32-exit-bundle-stable whitespace=delete>0.2.2.35-<version-vidalia-stable>-2</define-tag> -<define-tag version-win32-bridge-bundle-alpha whitespace=delete>0.2.3.9-alpha-<version-vidalia-stable></define-tag> -<define-tag version-win32-relay-bundle-alpha whitespace=delete>0.2.3.9-alpha-<version-vidalia-stable></define-tag> -<define-tag version-win32-exit-bundle-alpha whitespace=delete>0.2.3.9-alpha-<version-vidalia-stable></define-tag> +<define-tag version-win32-bridge-bundle-alpha whitespace=delete>0.2.3.10-alpha-<version-vidalia-stable></define-tag> +<define-tag version-win32-relay-bundle-alpha whitespace=delete>0.2.3.10-alpha-<version-vidalia-stable></define-tag> +<define-tag version-win32-exit-bundle-alpha whitespace=delete>0.2.3.10-alpha-<version-vidalia-stable></define-tag> -<define-tag version-osx-x86-bundle-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-osx-x86-bundle-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-osx-x86-bundle-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-osx-x86-bundle-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-osx-ppc-bundle-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-osx-ppc-bundle-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-osx-ppc-bundle-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-osx-ppc-bundle-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-osx-x86-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-osx-x86-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-osx-x86-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-osx-x86-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-osx-ppc-stable whitespace=delete>0.2.2.34</define-tag> -<define-tag version-osx-ppc-alpha whitespace=delete>0.2.3.9-alpha</define-tag> +<define-tag version-osx-ppc-stable whitespace=delete>0.2.2.35</define-tag> +<define-tag version-osx-ppc-alpha whitespace=delete>0.2.3.10-alpha</define-tag> -<define-tag version-torbrowserbundle whitespace=delete>2.2.34-3</define-tag> -<define-tag version-torbrowser-tor whitespace=delete>0.2.2.34</define-tag> +<define-tag version-torbrowserbundle whitespace=delete>2.2.35-1</define-tag> +<define-tag version-torbrowser-tor whitespace=delete>0.2.2.35</define-tag> <define-tag version-torbrowser-tor-components whitespace=delete>libevent-2.0.16-stable, zlib-1.2.5, openssl-1.0.0e</define-tag> <define-tag version-torbrowser-firefox whitespace=delete>8.0.1</define-tag> -<define-tag version-torbrowser-torbutton whitespace=delete>1.4.4.1</define-tag> +<define-tag version-torbrowser-torbutton whitespace=delete>1.4.5</define-tag> <define-tag version-torbrowser-pidgin whitespace=delete>2.7.5</define-tag> <define-tag version-torbrowser-otr whitespace=delete>3.2</define-tag> <define-tag version-torbrowser-vidalia whitespace=delete>0.2.15</define-tag> <define-tag version-torimbrowserbundle whitespace=delete>1.3.21</define-tag> -<define-tag version-torbrowserbundlelinux32 whitespace=delete>2.2.34-3</define-tag> -<define-tag version-torbrowserbundlelinux64 whitespace=delete>2.2.34-3</define-tag> -<define-tag version-gnu-torbrowser-tor whitespace=delete>0.2.2.34</define-tag> +<define-tag version-torbrowserbundlelinux32 whitespace=delete>2.2.35-1</define-tag> +<define-tag version-torbrowserbundlelinux64 whitespace=delete>2.2.35-1</define-tag> +<define-tag version-gnu-torbrowser-tor whitespace=delete>0.2.2.35</define-tag> <define-tag version-gnu-torbrowser-tor-components whitespace=delete>libevent-2.0.16-stable, zlib-1.2.5, openssl-1.0.0e</define-tag> <define-tag version-gnu-torbrowser-firefox whitespace=delete>8.0.1</define-tag> -<define-tag version-gnu-torbrowser-torbutton whitespace=delete>1.4.4.1</define-tag> +<define-tag version-gnu-torbrowser-torbutton whitespace=delete>1.4.5</define-tag> <define-tag version-gnu-torbrowser-vidalia whitespace=delete>0.2.15</define-tag> -<define-tag version-torbrowserbundleosx32 whitespace=delete>2.2.34-3</define-tag> -<define-tag version-torbrowserbundleosx64 whitespace=delete>2.2.34-3</define-tag> -<define-tag version-osx-torbrowser-tor whitespace=delete>0.2.2.34</define-tag> +<define-tag version-torbrowserbundleosx32 whitespace=delete>2.2.35-1</define-tag> +<define-tag version-torbrowserbundleosx64 whitespace=delete>2.2.35-1</define-tag> +<define-tag version-osx-torbrowser-tor whitespace=delete>0.2.2.35</define-tag> <define-tag version-osx-torbrowser-firefox whitespace=delete>8.0.1</define-tag> -<define-tag version-osx-torbrowser-torbutton whitespace=delete>1.4.4.1</define-tag> +<define-tag version-osx-torbrowser-torbutton whitespace=delete>1.4.5</define-tag> <define-tag version-osx-torbrowser-vidalia whitespace=delete>0.2.15</define-tag> <define-tag version-vidalia-stable whitespace=delete>0.2.15</define-tag>

1 0

[tor/master] put the stable changelogs into master too
by arma＠torproject.org 16 Dec '11

16 Dec '11

commit 3ee5924d1812598c1671d4f3b2a5804fcf83c848 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Dec 16 12:52:58 2011 -0500 put the stable changelogs into master too --- ChangeLog | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ReleaseNotes | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 240 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index 04625c3..667a953 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,6 +46,126 @@ Changes in version 0.2.3.10-alpha - 2011-12-16 - Update to the December 6 2011 Maxmind GeoLite Country database. +Changes in version 0.2.2.35 - 2011-12-16 + Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's + buffers code. Absolutely everybody should upgrade. + + The bug relied on an incorrect calculation when making data continuous + in one of our IO buffers, if the first chunk of the buffer was + misaligned by just the wrong amount. The miscalculation would allow an + attacker to overflow a piece of heap-allocated memory. To mount this + attack, the attacker would need to either open a SOCKS connection to + Tor's SocksPort (usually restricted to localhost), or target a Tor + instance configured to make its connections through a SOCKS proxy + (which Tor does not do by default). + + Good security practice requires that all heap-overflow bugs should be + presumed to be exploitable until proven otherwise, so we are treating + this as a potential code execution attack. Please upgrade immediately! + This bug does not affect bufferevents-based builds of Tor. Special + thanks to "Vektor" for reporting this issue to us! + + Tor 0.2.2.35 also fixes several bugs in previous versions, including + crash bugs for unusual configurations, and a long-term bug that + would prevent Tor from starting on Windows machines with draconian + AV software. + + With this release, we remind everyone that 0.2.0.x has reached its + formal end-of-life. Those Tor versions have many known flaws, and + nobody should be using them. You should upgrade -- ideally to the + 0.2.2.x series. If you're using a Linux or BSD and its packages are + obsolete, stop using those packages and upgrade anyway. + + The Tor 0.2.1.x series is also approaching its end-of-life: it will no + longer receive support after some time in early 2012. + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so + that it doesn't attempt to allocate a socketpair. This could cause + some problems on Windows systems with overzealous firewalls. Fix for + bug 4457; workaround for Libevent versions 2.0.1-alpha through + 2.0.15-stable. + - If we mark an OR connection for close based on a cell we process, + don't process any further cells on it. We already avoid further + reads on marked-for-close connections, but now we also discard the + cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha, + which was the first version where we might mark a connection for + close based on processing a cell on it. + - Correctly sanity-check that we don't underflow on a memory + allocation (and then assert) for hidden service introduction + point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; + bugfix on 0.2.1.5-alpha. + - Fix a memory leak when we check whether a hidden service + descriptor has any usable introduction points left. Fixes bug + 4424. Bugfix on 0.2.2.25-alpha. + - Don't crash when we're running as a relay and don't have a GeoIP + file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix + we've had in the 0.2.3.x branch already. + - When running as a client, do not print a misleading (and plain + wrong) log message that we're collecting "directory request" + statistics: clients don't collect statistics. Also don't create a + useless (because empty) stats file in the stats/ directory. Fixes + bug 4353; bugfix on 0.2.2.34. + + o Minor bugfixes: + - Detect failure to initialize Libevent. This fix provides better + detection for future instances of bug 4457. + - Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers + function. This was eating up hideously large amounts of time on some + busy servers. Fixes bug 4518; bugfix on 0.0.9.8. + - Resolve an integer overflow bug in smartlist_ensure_capacity(). + Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by + Mansour Moufid. + - Don't warn about unused log_mutex in log.c when building with + --disable-threads using a recent GCC. Fixes bug 4437; bugfix on + 0.1.0.6-rc which introduced --disable-threads. + - When configuring, starting, or stopping an NT service, stop + immediately after the service configuration attempt has succeeded + or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha. + - When sending a NETINFO cell, include the original address + received for the other side, not its canonical address. Found + by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha. + - Fix a typo in a hibernation-related log message. Fixes bug 4331; + bugfix on 0.2.2.23-alpha; found by "tmpname0901". + - Fix a memory leak in launch_direct_bridge_descriptor_fetch() that + occurred when a client tried to fetch a descriptor for a bridge + in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha. + - Backport fixes for a pair of compilation warnings on Windows. + Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta. + - If we had ever tried to call tor_addr_to_str on an address of + unknown type, we would have done a strdup on an uninitialized + buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha. + Reported by "troll_un". + - Correctly detect and handle transient lookup failures from + tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha. + Reported by "troll_un". + - Fix null-pointer access that could occur if TLS allocation failed. + Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un". + - Use tor_socket_t type for listener argument to accept(). Fixes bug + 4535; bugfix on 0.2.2.28-beta. Found by "troll_un". + + o Minor features: + - Add two new config options for directory authorities: + AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the + Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold + that is always sufficient to satisfy the bandwidth requirement for + the Guard flag. Now it will be easier for researchers to simulate + Tor networks with different values. Resolves ticket 4484. + - When Tor ignores a hidden service specified in its configuration, + include the hidden service's directory in the warning message. + Previously, we would only tell the user that some hidden service + was ignored. Bugfix on 0.0.6; fixes bug 4426. + - Update to the December 6 2011 Maxmind GeoLite Country database. + + o Packaging changes: + - Make it easier to automate expert package builds on Windows, + by removing an absolute path from makensis.exe command. + + Changes in version 0.2.3.9-alpha - 2011-12-08 Tor 0.2.3.9-alpha introduces initial IPv6 support for bridges, adds a "DisableNetwork" security feature that bundles can use to avoid diff --git a/ReleaseNotes b/ReleaseNotes index cbc8f0e..5e24d77 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,126 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.2.35 - 2011-12-16 + Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's + buffers code. Absolutely everybody should upgrade. + + The bug relied on an incorrect calculation when making data continuous + in one of our IO buffers, if the first chunk of the buffer was + misaligned by just the wrong amount. The miscalculation would allow an + attacker to overflow a piece of heap-allocated memory. To mount this + attack, the attacker would need to either open a SOCKS connection to + Tor's SocksPort (usually restricted to localhost), or target a Tor + instance configured to make its connections through a SOCKS proxy + (which Tor does not do by default). + + Good security practice requires that all heap-overflow bugs should be + presumed to be exploitable until proven otherwise, so we are treating + this as a potential code execution attack. Please upgrade immediately! + This bug does not affect bufferevents-based builds of Tor. Special + thanks to "Vektor" for reporting this issue to us! + + Tor 0.2.2.35 also fixes several bugs in previous versions, including + crash bugs for unusual configurations, and a long-term bug that + would prevent Tor from starting on Windows machines with draconian + AV software. + + With this release, we remind everyone that 0.2.0.x has reached its + formal end-of-life. Those Tor versions have many known flaws, and + nobody should be using them. You should upgrade -- ideally to the + 0.2.2.x series. If you're using a Linux or BSD and its packages are + obsolete, stop using those packages and upgrade anyway. + + The Tor 0.2.1.x series is also approaching its end-of-life: it will no + longer receive support after some time in early 2012. + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so + that it doesn't attempt to allocate a socketpair. This could cause + some problems on Windows systems with overzealous firewalls. Fix for + bug 4457; workaround for Libevent versions 2.0.1-alpha through + 2.0.15-stable. + - If we mark an OR connection for close based on a cell we process, + don't process any further cells on it. We already avoid further + reads on marked-for-close connections, but now we also discard the + cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha, + which was the first version where we might mark a connection for + close based on processing a cell on it. + - Correctly sanity-check that we don't underflow on a memory + allocation (and then assert) for hidden service introduction + point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; + bugfix on 0.2.1.5-alpha. + - Fix a memory leak when we check whether a hidden service + descriptor has any usable introduction points left. Fixes bug + 4424. Bugfix on 0.2.2.25-alpha. + - Don't crash when we're running as a relay and don't have a GeoIP + file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix + we've had in the 0.2.3.x branch already. + - When running as a client, do not print a misleading (and plain + wrong) log message that we're collecting "directory request" + statistics: clients don't collect statistics. Also don't create a + useless (because empty) stats file in the stats/ directory. Fixes + bug 4353; bugfix on 0.2.2.34. + + o Minor bugfixes: + - Detect failure to initialize Libevent. This fix provides better + detection for future instances of bug 4457. + - Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers + function. This was eating up hideously large amounts of time on some + busy servers. Fixes bug 4518; bugfix on 0.0.9.8. + - Resolve an integer overflow bug in smartlist_ensure_capacity(). + Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by + Mansour Moufid. + - Don't warn about unused log_mutex in log.c when building with + --disable-threads using a recent GCC. Fixes bug 4437; bugfix on + 0.1.0.6-rc which introduced --disable-threads. + - When configuring, starting, or stopping an NT service, stop + immediately after the service configuration attempt has succeeded + or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha. + - When sending a NETINFO cell, include the original address + received for the other side, not its canonical address. Found + by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha. + - Fix a typo in a hibernation-related log message. Fixes bug 4331; + bugfix on 0.2.2.23-alpha; found by "tmpname0901". + - Fix a memory leak in launch_direct_bridge_descriptor_fetch() that + occurred when a client tried to fetch a descriptor for a bridge + in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha. + - Backport fixes for a pair of compilation warnings on Windows. + Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta. + - If we had ever tried to call tor_addr_to_str on an address of + unknown type, we would have done a strdup on an uninitialized + buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha. + Reported by "troll_un". + - Correctly detect and handle transient lookup failures from + tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha. + Reported by "troll_un". + - Fix null-pointer access that could occur if TLS allocation failed. + Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un". + - Use tor_socket_t type for listener argument to accept(). Fixes bug + 4535; bugfix on 0.2.2.28-beta. Found by "troll_un". + + o Minor features: + - Add two new config options for directory authorities: + AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the + Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold + that is always sufficient to satisfy the bandwidth requirement for + the Guard flag. Now it will be easier for researchers to simulate + Tor networks with different values. Resolves ticket 4484. + - When Tor ignores a hidden service specified in its configuration, + include the hidden service's directory in the warning message. + Previously, we would only tell the user that some hidden service + was ignored. Bugfix on 0.0.6; fixes bug 4426. + - Update to the December 6 2011 Maxmind GeoLite Country database. + + o Packaging changes: + - Make it easier to automate expert package builds on Windows, + by removing an absolute path from makensis.exe command. + + Changes in version 0.2.2.34 - 2011-10-26 Tor 0.2.2.34 fixes a critical anonymity vulnerability where an attacker can deanonymize Tor users. Everybody should upgrade.

1 0

[tor/release-0.2.2] fix extra words and minor whitespace
by arma＠torproject.org 16 Dec '11

16 Dec '11

commit 1208c179fbee345fe99f7beae53012f926385157 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Dec 16 12:47:05 2011 -0500 fix extra words and minor whitespace --- ChangeLog | 8 ++++---- ReleaseNotes | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8d17a50..55bd9f7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -19,12 +19,12 @@ Changes in version 0.2.2.35 - 2011-12-16 Tor 0.2.2.35 also fixes several bugs in previous versions, including crash bugs for unusual configurations, and a long-term bug that - would that would prevent Tor from starting on Windows machines with - draconian AV software. + would prevent Tor from starting on Windows machines with draconian + AV software. With this release, we remind everyone that 0.2.0.x has reached its - formal end-of-life. Those Tor versions have many known flaws, and - nobody should be using them. You should upgrade--ideally to the + formal end-of-life. Those Tor versions have many known flaws, and + nobody should be using them. You should upgrade -- ideally to the 0.2.2.x series. If you're using a Linux or BSD and its packages are obsolete, stop using those packages and upgrade anyway. diff --git a/ReleaseNotes b/ReleaseNotes index 919491f..4b60d48 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -24,12 +24,12 @@ Changes in version 0.2.2.35 - 2011-12-16 Tor 0.2.2.35 also fixes several bugs in previous versions, including crash bugs for unusual configurations, and a long-term bug that - would that would prevent Tor from starting on Windows machines with - draconian AV software. + would prevent Tor from starting on Windows machines with draconian + AV software. With this release, we remind everyone that 0.2.0.x has reached its - formal end-of-life. Those Tor versions have many known flaws, and - nobody should be using them. You should upgrade--ideally to the + formal end-of-life. Those Tor versions have many known flaws, and + nobody should be using them. You should upgrade -- ideally to the 0.2.2.x series. If you're using a Linux or BSD and its packages are obsolete, stop using those packages and upgrade anyway.

1 0

[tor/master] retroactively reformat a little bit
by arma＠torproject.org 16 Dec '11

16 Dec '11

commit 41cb249b7facffa2b5f671f372f642dc59a3da9f Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Dec 16 12:27:38 2011 -0500 retroactively reformat a little bit --- ChangeLog | 20 +++++++++----------- 1 files changed, 9 insertions(+), 11 deletions(-) diff --git a/ChangeLog b/ChangeLog index afdac3d..04625c3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,8 +2,8 @@ Changes in version 0.2.3.11-alpha - 201?-??-?? Changes in version 0.2.3.10-alpha - 2011-12-16 - Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in Tor's - buffers code. Absolutely everybody should upgrade. + Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in + Tor's buffers code. Absolutely everybody should upgrade. The bug relied on an incorrect calculation when making data continuous in one of our IO buffers, if the first chunk of the buffer was @@ -20,8 +20,8 @@ Changes in version 0.2.3.10-alpha - 2011-12-16 This bug does not affect bufferevents-based builds of Tor. Special thanks to "Vektor" for reporting this issue to us! - This release also contains a few minor bugfixes for issues - discovered in 0.2.3.9-alpha. + This release also contains a few minor bugfixes for issues discovered + in 0.2.3.9-alpha. o Major bugfixes: - Fix a heap overflow bug that could occur when trying to pull @@ -33,21 +33,19 @@ Changes in version 0.2.3.10-alpha - 2011-12-16 - If we can't attach streams to a rendezvous circuit when we finish connecting to a hidden service, clear the rendezvous circuit's stream-isolation state and try to attach streams - again. Previously, we cleared rendezvous circuits' isolation - state either too early (if they were freshly built) or not at - all (if they had been built earlier and were cannibalized). - Bugfix on 0.2.3.3-alpha; fixes bug 4655. + again. Previously, we cleared rendezvous circuits' isolation + state either too early (if they were freshly built) or not at all + (if they had been built earlier and were cannibalized). Bugfix on + 0.2.3.3-alpha; fixes bug 4655. - Fix compilation of the libnatpmp helper on non-Windows. Bugfix on 0.2.3.9-alpha; fixes bug 4691. Reported by Anthony G. Basile. - Fix an assertion failure when a relay with accounting enabled - starts up while dormant. Fixes bug 4702; bugfix on - 0.2.3.9-alpha. + starts up while dormant. Fixes bug 4702; bugfix on 0.2.3.9-alpha. o Minor features: - Update to the December 6 2011 Maxmind GeoLite Country database. - Changes in version 0.2.3.9-alpha - 2011-12-08 Tor 0.2.3.9-alpha introduces initial IPv6 support for bridges, adds a "DisableNetwork" security feature that bundles can use to avoid

1 0

[translation/vidalia_help] Update translations for vidalia_help
by translation＠torproject.org 16 Dec '11

16 Dec '11

commit 3652be768b1515a6786f95c05bbda359ef498e04 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Dec 16 17:15:27 2011 +0000 Update translations for vidalia_help --- it/services.po | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/it/services.po b/it/services.po index ec88fb1..848894e 100644 --- a/it/services.po +++ b/it/services.po @@ -1,5 +1,6 @@ # # Translators: +# <balelo(a)mailforspam.com>, 2011. # Luca <luca(a)jeckodevelopment.it>, 2011. # <lukefiltroman(a)gmail.com>, 2011. msgid "" @@ -7,8 +8,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2010-06-26 17:00+0200\n" -"PO-Revision-Date: 2011-11-20 15:07+0000\n" -"Last-Translator: jeckodevelopment <luca(a)jeckodevelopment.it>\n" +"PO-Revision-Date: 2011-12-16 17:12+0000\n" +"Last-Translator: Balelo <balelo(a)mailforspam.com>\n" "Language-Team: Italian (http://www.transifex.net/projects/p/torproject/team/it/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -92,6 +93,8 @@ msgid "" "There is a fine tutorial on the Tor website (https://www.torproject.org/docs" "/tor-hidden-service.html) that describes these steps in more detail." msgstr "" +"C'è un tutorial sul sito ufficiale di Tor (https://www.torproject.org/docs" +"/tor-hidden-service.html) che spiega questi passaggi più nel dettaglio." #. type: Content of: <html><body> #: en/services.html:55 @@ -248,7 +251,7 @@ msgstr "<a name=\"client\"/>" #. type: Content of: <html><body><h3> #: en/services.html:136 msgid "How does Vidalia help me to access other hidden services?" -msgstr "" +msgstr "Come fa Vidalia ad aiutarmi ad accedere ad altri servizi nascosti?" #. type: Content of: <html><body><p> #: en/services.html:138

1 0

[tor/master] Increment version in master to 0.2.3.10-alpha-dev
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 663913e5cac521389faeae7a480456e2b6cd8737 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 16 12:09:42 2011 -0500 Increment version in master to 0.2.3.10-alpha-dev --- ChangeLog | 3 +++ configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index c01539c..afdac3d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,6 @@ +Changes in version 0.2.3.11-alpha - 201?-??-?? + + Changes in version 0.2.3.10-alpha - 2011-12-16 Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in Tor's buffers code. Absolutely everybody should upgrade. diff --git a/configure.in b/configure.in index ecf437e..8f70f22 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.3.10-alpha) +AM_INIT_AUTOMAKE(tor, 0.2.3.10-alpha-dev) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index acf30c4..02ffb2d 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.3.10-alpha" +!define VERSION "0.2.3.10-alpha-dev" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 0fdb148..ebf6a09 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -234,7 +234,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.3.10-alpha" +#define VERSION "0.2.3.10-alpha-dev"

1 0

[torbrowser/maint-2.2] bump all tbbs to 2.2.35-1 for new tor release
by erinn＠torproject.org 16 Dec '11

16 Dec '11

commit 8abea369ae8593fd32ea590e36b76eee52ab1c99 Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Dec 16 05:53:03 2011 +0000 bump all tbbs to 2.2.35-1 for new tor release --- README.LINUX-2.2 | 6 +++--- README.OSX-2.2 | 6 +++--- README.WIN-2.2 | 6 +++--- build-scripts/linux.mk | 2 +- build-scripts/osx.mk | 2 +- build-scripts/recommended-versions | 15 +++++---------- build-scripts/versions.mk | 8 ++++---- build-scripts/windows.mk | 2 +- changelog.linux-2.2 | 11 +++++++++++ changelog.osx-2.2 | 11 +++++++++++ changelog.windows-2.2 | 11 +++++++++++ 11 files changed, 54 insertions(+), 26 deletions(-) diff --git a/README.LINUX-2.2 b/README.LINUX-2.2 index 8be6ca9..308a7a3 100644 --- a/README.LINUX-2.2 +++ b/README.LINUX-2.2 @@ -5,10 +5,10 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.34 (with libevent-2.0.16-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.35 (with libevent-2.0.16-stable, zlib-1.2.5 and openssl-1.0.0e) Firefox (Aurora) 8.0.1 - \_ Torbutton 1.4.4.1 - |_ NoScript 2.2 + \_ Torbutton 1.4.5 + |_ NoScript 2.2.3 |_ HTTPS-Everywhere 1.2.1 Usage diff --git a/README.OSX-2.2 b/README.OSX-2.2 index e5a67ad..5d37e23 100644 --- a/README.OSX-2.2 +++ b/README.OSX-2.2 @@ -5,10 +5,10 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.34 (with libevent-2.0.16-stable, zlib-1.2.5 and openssl-1.0.0d) +Tor 0.2.2.35 (with libevent-2.0.16-stable, zlib-1.2.5 and openssl-1.0.0d) Firefox (Aurora) 8.0.1 - \_ Torbutton 1.4.4.1 - |_ NoScript 2.2 + \_ Torbutton 1.4.5 + |_ NoScript 2.2.3 |_ HTTPS-Everywhere 1.2.1 Usage diff --git a/README.WIN-2.2 b/README.WIN-2.2 index 4329309..d874e72 100644 --- a/README.WIN-2.2 +++ b/README.WIN-2.2 @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.15 (with Qt 4.6.2) -Tor 0.2.2.34 (with libevent-2.0.16-stable, zlib-1.2.5 and openssl-1.0.0e) +Tor 0.2.2.35 (with libevent-2.0.16-stable, zlib-1.2.5 and openssl-1.0.0e) FirefoxPortable 8.0.1 \_ Firefox (Aurora) 8.0.1 - \_ Torbutton 1.4.4.1 - |_ NoScript 2.2 + \_ Torbutton 1.4.5 + |_ NoScript 2.2.3 |_ HTTPS-Everywhere 1.2.1 Usage diff --git a/build-scripts/linux.mk b/build-scripts/linux.mk index 963da78..a8f9862 100644 --- a/build-scripts/linux.mk +++ b/build-scripts/linux.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=$(shell uname -m) -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Linux ## Location of directory for source unpacking diff --git a/build-scripts/osx.mk b/build-scripts/osx.mk index f53941b..817f32a 100644 --- a/build-scripts/osx.mk +++ b/build-scripts/osx.mk @@ -36,7 +36,7 @@ include $(PWD)/versions.mk ## Architecture ARCH_TYPE=i386 -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=MacOS ## Location of directory for source unpacking diff --git a/build-scripts/recommended-versions b/build-scripts/recommended-versions index 2cb0cda..ae01274 100644 --- a/build-scripts/recommended-versions +++ b/build-scripts/recommended-versions @@ -1,12 +1,7 @@ [ -"2.2.34-2-Linux-i686", -"2.2.34-2-Linux-x86_64", -"2.2.34-2-MacOS-i386", -"2.2.34-2-MacOS-x86_64", -"2.2.34-2-Windows", -"2.2.34-3-Linux-i686", -"2.2.34-3-Linux-x86_64", -"2.2.34-3-MacOS-i386", -"2.2.34-3-MacOS-x86_64", -"2.2.34-3-Windows" +"2.2.35-1-Linux-i686", +"2.2.35-1-Linux-x86_64", +"2.2.35-1-MacOS-i386", +"2.2.35-1-MacOS-x86_64", +"2.2.35-1-Windows" ] diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 81c5f1c..c2b6ca7 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -1,18 +1,18 @@ #!/usr/bin/make -RELEASE_VER=2.2.34 +RELEASE_VER=2.2.35 HTTPSEVERY_VER=1.2.1 FIREFOX_VER=8.0.1 LIBEVENT_VER=2.0.16-stable LIBPNG_VER=1.4.8 -NOSCRIPT_VER=2.2 +NOSCRIPT_VER=2.2.3 OPENSSL_VER=1.0.0e OTR_VER=3.2.0 PIDGIN_VER=2.6.4 QT_VER=4.6.2 -TOR_VER=0.2.2.34 -TORBUTTON_VER=1.4.4.1 +TOR_VER=0.2.2.35 +TORBUTTON_VER=1.4.5 VIDALIA_VER=0.2.15 ZLIB_VER=1.2.5 diff --git a/build-scripts/windows.mk b/build-scripts/windows.mk index 8f21e98..55447cc 100644 --- a/build-scripts/windows.mk +++ b/build-scripts/windows.mk @@ -31,7 +31,7 @@ ## Include versions include $(PWD)/versions.mk -BUILD_NUM=3 +BUILD_NUM=1 PLATFORM=Windows ## Location of required libraries diff --git a/changelog.linux-2.2 b/changelog.linux-2.2 index 7dd0125..429c50f 100644 --- a/changelog.linux-2.2 +++ b/changelog.linux-2.2 @@ -1,3 +1,14 @@ +Tor Browser Bundle (2.2.35-1); suite=linux + + * Update Tor to 0.2.2.35 + * Update NoScript to 2.2.3 + * Update Torbutton to 1.4.5 + * New Firefox patches + - Disable SSL Session ID tracking + - Provide an observer event to close persistent connections + + -- Erinn Clark <erinn(a)torproject.org> Fri Dec 16 03:56:12 GMT 2011 + Tor Browser Bundle (2.2.34-3); suite=linux * Update Firefox to 8.0.1 diff --git a/changelog.osx-2.2 b/changelog.osx-2.2 index 6a4d198..6c88cc0 100644 --- a/changelog.osx-2.2 +++ b/changelog.osx-2.2 @@ -1,3 +1,14 @@ +Tor Browser Bundle (2.2.35-1); suite=osx + + * Update Tor to 0.2.2.35 + * Update NoScript to 2.2.3 + * Update Torbutton to 1.4.5 + * New Firefox patches + - Disable SSL Session ID tracking + - Provide an observer event to close persistent connections + + -- Erinn Clark <erinn(a)torproject.org> Fri Dec 16 03:56:02 GMT 2011 + Tor Browser Bundle (2.2.34-3); suite=osx * Update Firefox to 8.0.1 diff --git a/changelog.windows-2.2 b/changelog.windows-2.2 index 1bb726c..bf0ba98 100644 --- a/changelog.windows-2.2 +++ b/changelog.windows-2.2 @@ -1,3 +1,14 @@ +Tor Browser Bundle (2.2.35-1); suite=windows + + * Update Tor to 0.2.2.35 + * Update NoScript to 2.2.3 + * Update Torbutton to 1.4.5 + * New Firefox patches + - Disable SSL Session ID tracking + - Provide an observer event to close persistent connections + + -- Erinn Clark <erinn(a)torproject.org> Fri Dec 16 03:56:07 GMT 2011 + Tor Browser Bundle (2.2.34-3); suite=windows * Update Firefox to 8.0.1

1 0

← Newer
1
...
27
28
29
30
31
32
33
...
54
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits December 2011