April 2014 - tor-commits - lists.torproject.org

[tor/master] reflow changelog.
by nickm＠torproject.org 26 Apr '14

26 Apr '14

commit 03ce73327ce07499df563919764ea020f880da6b Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Apr 25 21:51:31 2014 -0400 reflow changelog. --- ChangeLog | 53 +++++++++++++++++++++++++++-------------------------- 1 file changed, 27 insertions(+), 26 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0af644f..e4387e1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,9 +3,9 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 improvements for clients and relays, including blacklisting authority signing keys that were used while susceptible to the OpenSSL "heartbleed" bug, fixing two expensive functions on busy relays, - improved TLS ciphersuite preference lists, support for run-time hardening - on compilers that support AddressSanitizer, and more work on the Linux - sandbox code. + improved TLS ciphersuite preference lists, support for run-time + hardening on compilers that support AddressSanitizer, and more work on + the Linux sandbox code. There are also several usability fixes for clients (especially clients that use bridges), two new TransPort protocols supported (one on @@ -52,15 +52,15 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 uniform criteria, and includes all OpenSSL ciphersuites with acceptable strength and forward secrecy. Previously, we had left some perfectly fine ciphersuites unsupported due to omission or - typo. Resolves bugs 11513, 11492, 11498, 11499. Bugs reported - by 'cypherpunks'. Bugfix on 0.2.4.8-alpha. + typo. Resolves bugs 11513, 11492, 11498, 11499. Bugs reported by + 'cypherpunks'. Bugfix on 0.2.4.8-alpha. - Relays now trust themselves to have a better view than clients of - which TLS ciphersuites are better than others. (Thanks to bug 11513, - the relay list is now well-considered, whereas the client list has - been chosen mainly for anti-fingerprinting purposes.) Relays - prefer: AES over 3DES; then ECDHE over DHE; then GCM over CBC; - then SHA384 over SHA256 over SHA1; and last, AES256 over AES128. - Resolves ticket 11528. + which TLS ciphersuites are better than others. (Thanks to bug + 11513, the relay list is now well-considered, whereas the client + list has been chosen mainly for anti-fingerprinting purposes.) + Relays prefer: AES over 3DES; then ECDHE over DHE; then GCM over + CBC; then SHA384 over SHA256 over SHA1; and last, AES256 over + AES128. Resolves ticket 11528. - Clients now try to advertise the same list of ciphersuites as Firefox 28. This change enables selection of (fast) GCM ciphersuites, disables some strange old ciphers, and stops @@ -77,18 +77,18 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 FreeBSD. To enable it, set "TransProxyType ipfw". Resolves ticket 10267; patch from "yurivict". - Support OpenBSD's divert-to rules with the pf firewall for - transparent proxy ports. To enable it, set "TransProxyType - pf-divert". This allows Tor to run a TransPort transparent proxy - port on OpenBSD 4.4 or later without root privileges. See the + transparent proxy ports. To enable it, set "TransProxyType pf- + divert". This allows Tor to run a TransPort transparent proxy port + on OpenBSD 4.4 or later without root privileges. See the pf.conf(5) manual page for information on configuring pf to use divert-to rules. Closes ticket 10896; patch from Dana Koch. o Minor features (security): - New --enable-expensive-hardening option to enable security hardening options that consume nontrivial amounts of CPU and - memory. Right now, this includes AddressSanitizer and UbSan, - which are supported in newer versions of GCC and Clang. Closes - ticket 11477. + memory. Right now, this includes AddressSanitizer and UbSan, which + are supported in newer versions of GCC and Clang. Closes ticket + 11477. o Minor features (log verbosity): - Demote the message that we give when a flushing connection times @@ -98,8 +98,8 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 about downloading descriptors. Previously, we'd log a notice whenever we learned about more routers. Now, we only log a notice at every 5% of progress. Fixes bug 9963. - - Warn less verbosely when receiving a malformed ESTABLISH_RENDEZVOUS - cell. Fixes ticket 11279. + - Warn less verbosely when receiving a malformed + ESTABLISH_RENDEZVOUS cell. Fixes ticket 11279. - When we run out of usable circuit IDs on a channel, log only one warning for the whole channel, and describe how many circuits there were on the channel. Fixes part of ticket 11553. @@ -153,8 +153,8 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 just the wrong time. Re-fixes bug 11156; bugfix on 0.2.5.3-alpha. o Minor bugfixes (client, logging during bootstrap): - - Warn only once if we start logging in an unsafe way. Previously, we - complain as many times as we had problems. Fixes bug 9870; + - Warn only once if we start logging in an unsafe way. Previously, + we complain as many times as we had problems. Fixes bug 9870; bugfix on 0.2.5.1-alpha. - Only report the first fatal bootstrap error on a given OR connection. This stops us from telling the controller bogus error @@ -208,15 +208,16 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 harmless memory leak. Fixes bug 11278; bugfix on 0.2.5.1-alpha. - Don't re-initialize a second set of OpenSSL mutexes when starting up. Previously, we'd make one set of mutexes, and then immediately - replace them with another. Fixes bug 11726; bugfix on 0.2.5.3-alpha. + replace them with another. Fixes bug 11726; bugfix on + 0.2.5.3-alpha. - Resolve some memory leaks found by coverity in the unit tests, on exit in tor-gencert, and on a failure to compute digests for our own keys when generating a v3 networkstatus vote. These leaks should never have affected anyone in practice. o Minor bugfixes (hidden service): - - Only retry attempts to connect to a chosen rendezvous point 8 times, - not 30. Fixes bug 4241; bugfix on 0.1.0.1-rc. + - Only retry attempts to connect to a chosen rendezvous point 8 + times, not 30. Fixes bug 4241; bugfix on 0.1.0.1-rc. o Minor bugfixes (misc code correctness): - Fix various instances of undefined behavior in channeltls.c, @@ -226,8 +227,8 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 exist.) Fixes bug 10363; bugfixes on 0.1.1.1-alpha, 0.1.2.1-alpha, 0.2.0.10-alpha, and 0.2.3.6-alpha. Reported by "bobnomnom". - Use the AddressSanitizer and Ubsan sanitizers (in clang-3.4) to - fix some miscellaneous errors in our tests and codebase. Fixes - bug 11232. Bugfixes on versions back as far as 0.2.1.11-alpha. + fix some miscellaneous errors in our tests and codebase. Fixes bug + 11232. Bugfixes on versions back as far as 0.2.1.11-alpha. - Always check return values for unlink, munmap, UnmapViewOfFile; check strftime return values more often. In some cases all we can do is report a warning, but this may help prevent deeper bugs from

1 0

[tor/master] place the cherries on top and call it done
by arma＠torproject.org 26 Apr '14

26 Apr '14

commit f6559d8dcbbb5b3c22602fc8b4cb97849401db7f Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Apr 25 21:40:39 2014 -0400 place the cherries on top and call it done --- ChangeLog | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 88c96dc..0af644f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,7 +3,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 improvements for clients and relays, including blacklisting authority signing keys that were used while susceptible to the OpenSSL "heartbleed" bug, fixing two expensive functions on busy relays, - improved TLS ciphersuite preference lists, supporting run-time hardening + improved TLS ciphersuite preference lists, support for run-time hardening on compilers that support AddressSanitizer, and more work on the Linux sandbox code. @@ -42,8 +42,8 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 will probably turn up. To try it, enable "Sandbox 1" on a Linux host. Resolves ticket 11351. - Strengthen sandbox code: the sandbox can now test the arguments - for rename(), and blocks _sysctl() entirely. Resolves part of - ticket 11351. + for rename(), and blocks _sysctl() entirely. Resolves another part + of ticket 11351. - When the sandbox blocks a system call, it now tries to log a stack trace before exiting. Resolves ticket 11465. @@ -72,7 +72,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 launching for a second time while using bridges. Fixes bug 9229; bugfix on 0.2.0.3-alpha. - o Minor features (Transparent proxy, *BSD): + o Minor features (transparent proxy, *BSD): - Support FreeBSD's ipfw firewall interface for TransPort ports on FreeBSD. To enable it, set "TransProxyType ipfw". Resolves ticket 10267; patch from "yurivict". @@ -215,8 +215,8 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 should never have affected anyone in practice. o Minor bugfixes (hidden service): - - Only retry attempts to connect to a chosen rendezvous point 8 - times, not 30. Fixes bug 4241; bugfix on 0.1.0.1-rc. + - Only retry attempts to connect to a chosen rendezvous point 8 times, + not 30. Fixes bug 4241; bugfix on 0.1.0.1-rc. o Minor bugfixes (misc code correctness): - Fix various instances of undefined behavior in channeltls.c,

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 26 Apr '14

26 Apr '14

commit 0e07ea3ac0cff7c484e960af97ed5be293d1a5ad Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 26 01:45:52 2014 +0000 Update translations for torbutton-torbuttonproperties --- zh_HK/torbutton.properties | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zh_HK/torbutton.properties b/zh_HK/torbutton.properties index feb2a43..ea5a15a 100644 --- a/zh_HK/torbutton.properties +++ b/zh_HK/torbutton.properties @@ -25,9 +25,9 @@ torbutton.popup.external.title = Download an external file type? torbutton.popup.external.app = Tor Browser cannot display this file. You will need to open it with another application.\n\n torbutton.popup.external.note = Some types of files can cause applications to connect to the Internet without using Tor.\n\n torbutton.popup.external.suggest = To be safe, you should only open downloaded files while offline, or use a Tor Live CD such as Tails.\n -torbutton.popup.launch = Download file +torbutton.popup.launch = 下載文件 torbutton.popup.cancel = Cancel -torbutton.popup.dontask = Automatically download files from now on +torbutton.popup.dontask = 現在開始自動下載文件 torbutton.popup.test.no_http_proxy = Tor proxy test: Local HTTP Proxy is unreachable. Is Polipo running properly? torbutton.popup.captcha.title = Avoid Google Captchas? torbutton.popup.captcha.ask = Torbutton detected a Google Captcha. Would you like to be redirected to another search engine for this query?

1 0

[translation/abouttor-homepage] Update translations for abouttor-homepage
by translation＠torproject.org 26 Apr '14

26 Apr '14

commit 9eb72d3013f56d9f67c691656f4e9b7d98d64280 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 26 01:45:43 2014 +0000 Update translations for abouttor-homepage --- zh_HK/aboutTor.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zh_HK/aboutTor.dtd b/zh_HK/aboutTor.dtd index 68e9c38..c4b45a8 100644 --- a/zh_HK/aboutTor.dtd +++ b/zh_HK/aboutTor.dtd @@ -27,10 +27,10 @@ <!ENTITY aboutTor.searchDDGPost.link "https://duckduckgo.com/html/"> <!ENTITY aboutTor.torInfo1.label "額外訊息:"> -<!ENTITY aboutTor.torInfo2.label "Country & IP Address:"> +<!ENTITY aboutTor.torInfo2.label "國家及IP地址:"> <!ENTITY aboutTor.torInfo3.label "Exit Node:"> <!ENTITY aboutTor.torInfo4.label "此服務器不會記錄訪客的任何信息。"> -<!ENTITY aboutTor.whatnextQuestion.label "What Next?"> +<!ENTITY aboutTor.whatnextQuestion.label "然後怎樣?"> <!ENTITY aboutTor.whatnextAnswer.label "要匿名瀏覽, 您所需要的並不只是Tor! 您可能需要改變一些瀏覽習慣, 以確保您身份的安全。"> <!ENTITY aboutTor.whatnext.label "保持匿名的一些提示 »"> <!ENTITY aboutTor.whatnext.link "https://www.torproject.org/download/download.html.en#warning">

1 0

[translation/tor-launcher-properties] Update translations for tor-launcher-properties
by translation＠torproject.org 26 Apr '14

26 Apr '14

commit eb93bfe77a842dd6d91005e1e923786b4a4c6335 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 26 01:45:34 2014 +0000 Update translations for tor-launcher-properties --- zh_HK/torlauncher.properties | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/zh_HK/torlauncher.properties b/zh_HK/torlauncher.properties index d088f8d..f9b406e 100644 --- a/zh_HK/torlauncher.properties +++ b/zh_HK/torlauncher.properties @@ -1,7 +1,7 @@ ### Copyright (c) 2014, The Tor Project, Inc. ### See LICENSE for licensing information. -torlauncher.error_title=Tor Launcher +torlauncher.error_title=Tor啟動器 torlauncher.tor_exited=Tor unexpectedly exited. torlauncher.please_restart_app=Please restart this application. @@ -27,12 +27,12 @@ torlauncher.error_bridges_missing=You must specify one or more bridges. torlauncher.error_default_bridges_type_missing=You must select a transport type for the provided bridges. torlauncher.error_bridge_bad_default_type=No provided bridges that have the transport type %S are available. Please adjust your settings. -torlauncher.recommended_bridge=(recommended) +torlauncher.recommended_bridge=(建議) torlauncher.connect=Connect torlauncher.quit=離開 torlauncher.quit_win=離開 -torlauncher.done=Done +torlauncher.done=完成 torlauncher.forAssistance=For assistance, contact %S @@ -47,7 +47,7 @@ torlauncher.bootstrapStatus.conn_or=連接上Tor的網絡 torlauncher.bootstrapStatus.handshake_or=Establishing a Tor circuit torlauncher.bootstrapStatus.done=Connected to the Tor network! -torlauncher.bootstrapWarning.done=done +torlauncher.bootstrapWarning.done=完成 torlauncher.bootstrapWarning.connectrefused=connection refused torlauncher.bootstrapWarning.misc=miscellaneous torlauncher.bootstrapWarning.resourcelimit=insufficient resources

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 26 Apr '14

26 Apr '14

commit 182c6c58ada3d03419dedf0d5e5fb46046ec76a9 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 26 01:45:16 2014 +0000 Update translations for https_everywhere --- zh_HK/https-everywhere.dtd | 28 ++++++++++++++-------------- zh_HK/https-everywhere.properties | 8 ++++---- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/zh_HK/https-everywhere.dtd b/zh_HK/https-everywhere.dtd index d75b33e..cac896f 100644 --- a/zh_HK/https-everywhere.dtd +++ b/zh_HK/https-everywhere.dtd @@ -4,7 +4,7 @@ <!ENTITY https-everywhere.about.version "Version"> <!ENTITY https-everywhere.about.created_by "Created by"> <!ENTITY https-everywhere.about.librarians "Ruleset Librarians"> -<!ENTITY https-everywhere.about.thanks "Thanks to"> +<!ENTITY https-everywhere.about.thanks "多謝"> <!ENTITY https-everywhere.about.contribute "If you like HTTPS Everywhere, you might consider"> <!ENTITY https-everywhere.about.donate_tor "Donating to Tor"> <!ENTITY https-everywhere.about.tor_lang_code "en"> @@ -12,26 +12,26 @@ <!ENTITY https-everywhere.menu.about "About HTTPS Everywhere"> <!ENTITY https-everywhere.menu.observatory "SSL Observatory Preferences"> -<!ENTITY https-everywhere.menu.globalEnable "Enable HTTPS Everywhere"> -<!ENTITY https-everywhere.menu.globalDisable "Disable HTTPS Everywhere"> +<!ENTITY https-everywhere.menu.globalEnable "啟用到處HTTPS"> +<!ENTITY https-everywhere.menu.globalDisable "停用到處HTTPS"> <!ENTITY https-everywhere.menu.showCounter "Show Counter"> <!ENTITY https-everywhere.prefs.title "HTTPS Everywhere Preferences"> -<!ENTITY https-everywhere.prefs.enable_all "Enable All"> -<!ENTITY https-everywhere.prefs.disable_all "Disable All"> -<!ENTITY https-everywhere.prefs.reset_defaults "Reset to Defaults"> +<!ENTITY https-everywhere.prefs.enable_all "啟用所有"> +<!ENTITY https-everywhere.prefs.disable_all "停用所有"> +<!ENTITY https-everywhere.prefs.reset_defaults "恢復原本設定"> <!ENTITY https-everywhere.prefs.search "尋找"> -<!ENTITY https-everywhere.prefs.site "Site"> -<!ENTITY https-everywhere.prefs.notes "Notes"> +<!ENTITY https-everywhere.prefs.site "網站"> +<!ENTITY https-everywhere.prefs.notes "筆記"> <!ENTITY https-everywhere.prefs.list_caption "Which HTTPS redirection rules should apply?"> -<!ENTITY https-everywhere.prefs.enabled "Enabled"> +<!ENTITY https-everywhere.prefs.enabled "已啟用"> <!ENTITY https-everywhere.prefs.ruleset_howto "You can learn how to write your own rulesets (to add support for other web sites)"> -<!ENTITY https-everywhere.prefs.here_link "here"> +<!ENTITY https-everywhere.prefs.here_link "這裡"> <!ENTITY https-everywhere.prefs.toggle "Toggle"> <!ENTITY https-everywhere.prefs.reset_default "Reset to Default"> <!ENTITY https-everywhere.prefs.view_xml_source "View XML Source"> -<!ENTITY https-everywhere.source.downloading "Downloading"> +<!ENTITY https-everywhere.source.downloading "下載中"> <!ENTITY https-everywhere.source.filename "Filename"> <!ENTITY https-everywhere.source.unable_to_download "Unable to download source."> @@ -40,8 +40,8 @@ <!ENTITY https-everywhere.popup.paragraph2 "Would you like to go back to stable?"> <!ENTITY https-everywhere.popup.paragraph3 "We'd love it if you continued using our development release and helped us make HTTPS Everywhere better! You might find there are a few more bugs here and there, which you can report to https-everywhere(a)eff.org. Sorry about the inconvenience, and thank you for using HTTPS Everywhere."> <!ENTITY https-everywhere.popup.keep "Keep me on the development version"> -<!ENTITY https-everywhere.popup.revert "Download the latest stable version"> +<!ENTITY https-everywhere.popup.revert "下載最新穩定版本"> <!ENTITY https-everywhere.ruleset-tests.status_title "HTTPS Everywhere Ruleset Tests"> -<!ENTITY https-everywhere.ruleset-tests.status_cancel_button "Cancel"> -<!ENTITY https-everywhere.ruleset-tests.status_start_button "Start"> +<!ENTITY https-everywhere.ruleset-tests.status_cancel_button "取消"> +<!ENTITY https-everywhere.ruleset-tests.status_start_button "開始"> diff --git a/zh_HK/https-everywhere.properties b/zh_HK/https-everywhere.properties index 5c23955..207faff 100644 --- a/zh_HK/https-everywhere.properties +++ b/zh_HK/https-everywhere.properties @@ -1,7 +1,7 @@ -https-everywhere.menu.globalEnable = Enable HTTPS Everywhere -https-everywhere.menu.globalDisable = Disable HTTPS Everywhere -https-everywhere.menu.enableDisable = 啟用 / 禁用規則 -https-everywhere.menu.noRules = (No Rules for This Page) +https-everywhere.menu.globalEnable = 啟用到處HTTPS +https-everywhere.menu.globalDisable = 停用到處HTTPS +https-everywhere.menu.enableDisable = 啟用 / 停用規則 +https-everywhere.menu.noRules = (這頁沒有規則) https-everywhere.menu.unknownRules = (Rules for This Page Unknown) https-everywhere.toolbar.hint = HTTPS Everywhere is now active. You can toggle it on a site-by-site basis by clicking the icon in the address bar. https-everywhere.migration.notification0 = In order to implement a crucial fix, this update resets your HTTPS Everywhere rule preferences to their default values.

1 0

[tor/master] promote two stanzas; shuffle around two more
by arma＠torproject.org 26 Apr '14

26 Apr '14

commit 8d005d56e9a2e7d1bffe433ebfed6067e23d3c96 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Apr 25 21:31:06 2014 -0400 promote two stanzas; shuffle around two more --- ChangeLog | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1448fa7..88c96dc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,10 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 have accumulated many known flaws; everyone should upgrade. o Major features (security): + - If you don't specify MaxMemInQueues yourself, Tor now tries to + pick a good value based on your total system memory. Previously, + the default was always 8 GB. You can still override the default by + setting MaxMemInQueues yourself. Resolves ticket 11396. - Block authority signing keys that were used on authorities vulnerable to the "heartbleed" bug in OpenSSL (CVE-2014-0160). (We don't have any evidence that these keys _were_ compromised; we're @@ -63,6 +67,11 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 advertising the ECDH (not to be confused with ECDHE) ciphersuites. Resolves ticket 11438. + o Major bugfixes (bridge client): + - Avoid 60-second delays in the bootstrapping process when Tor is + launching for a second time while using bridges. Fixes bug 9229; + bugfix on 0.2.0.3-alpha. + o Minor features (Transparent proxy, *BSD): - Support FreeBSD's ipfw firewall interface for TransPort ports on FreeBSD. To enable it, set "TransProxyType ipfw". Resolves ticket @@ -77,9 +86,9 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 o Minor features (security): - New --enable-expensive-hardening option to enable security hardening options that consume nontrivial amounts of CPU and - memory. Right now, this includes AddressSanitizer and UbSan, which - are supported in newer versions of GCC and Clang. Closes ticket - 11477. + memory. Right now, this includes AddressSanitizer and UbSan, + which are supported in newer versions of GCC and Clang. Closes + ticket 11477. o Minor features (log verbosity): - Demote the message that we give when a flushing connection times @@ -89,20 +98,16 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 about downloading descriptors. Previously, we'd log a notice whenever we learned about more routers. Now, we only log a notice at every 5% of progress. Fixes bug 9963. + - Warn less verbosely when receiving a malformed ESTABLISH_RENDEZVOUS + cell. Fixes ticket 11279. + - When we run out of usable circuit IDs on a channel, log only one + warning for the whole channel, and describe how many circuits + there were on the channel. Fixes part of ticket 11553. o Minor features (relay): - - If you don't specify MaxMemInQueues yourself, Tor now tries to - pick a good value based on your total system memory. Previously, - the default was always 8 GB. You can still override the default by - setting MaxMemInQueues yourself. Resolves ticket 11396. - If a circuit timed out for at least 3 minutes, check if we have a new external IP address, and publish a new descriptor with the new IP address if it changed. Resolves ticket 2454. - - Warn less verbosely when receiving a malformed - ESTABLISH_RENDEZVOUS cell. Fixes ticket 11279. - - When we run out of usable circuit IDs on a channel, log only one - warning for the whole channel, and describe how many circuits - there were on the channel. Fixes part of ticket 11553. o Minor features (controller): - Make the entire exit policy available from the control port via @@ -146,9 +151,6 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 - Avoid a 60-second delay in the bootstrapping process when a Tor client with pluggable transports re-reads its configuration at just the wrong time. Re-fixes bug 11156; bugfix on 0.2.5.3-alpha. - - Avoid 60-second delays in the bootstrapping process when Tor is - launching for a second time while using bridges. Fixes bug 9229; - bugfix on 0.2.0.3-alpha. o Minor bugfixes (client, logging during bootstrap): - Warn only once if we start logging in an unsafe way. Previously, we

1 0

[tor/master] touchups on upcoming changelog
by arma＠torproject.org 26 Apr '14

26 Apr '14

commit ef69dc2d0928aedb8645fe91439195a7f49a6156 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Apr 25 21:28:03 2014 -0400 touchups on upcoming changelog --- ChangeLog | 60 +++++++++++++++++++++++++++++------------------------------- 1 file changed, 29 insertions(+), 31 deletions(-) diff --git a/ChangeLog b/ChangeLog index e57ad2f..1448fa7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -3,7 +3,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 improvements for clients and relays, including blacklisting authority signing keys that were used while susceptible to the OpenSSL "heartbleed" bug, fixing two expensive functions on busy relays, - improved TLS ciphersuite preference lists, support run-time hardening + improved TLS ciphersuite preference lists, supporting run-time hardening on compilers that support AddressSanitizer, and more work on the Linux sandbox code. @@ -11,7 +11,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 that use bridges), two new TransPort protocols supported (one on OpenBSD, one on FreeBSD), and various other bugfixes. - This release marks end-of-line for Tor 0.2.2.x; those Tor versions + This release marks end-of-life for Tor 0.2.2.x; those Tor versions have accumulated many known flaws; everyone should upgrade. o Major features (security): @@ -29,8 +29,8 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 nearly out of circuit IDs. Previously, we would do a linear scan over possible circuit IDs before finding one or deciding that we had exhausted our possibilities. Now, we try at most 64 random - circuit IDs before deciding that we probably won't succeed. Fix - for a possible root cause of ticket #11553. + circuit IDs before deciding that we probably won't succeed. Fixes + a possible root cause of ticket 11553. o Major features (seccomp2 sandbox, Linux only): - The seccomp2 sandbox can now run a test network for multiple hours @@ -48,10 +48,10 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 uniform criteria, and includes all OpenSSL ciphersuites with acceptable strength and forward secrecy. Previously, we had left some perfectly fine ciphersuites unsupported due to omission or - typo. Resolves bugs #11513, #11492, #11498, #11499. Bugs reported + typo. Resolves bugs 11513, 11492, 11498, 11499. Bugs reported by 'cypherpunks'. Bugfix on 0.2.4.8-alpha. - Relays now trust themselves to have a better view than clients of - which TLS ciphersuites are better than others. (Thanks to #11513, + which TLS ciphersuites are better than others. (Thanks to bug 11513, the relay list is now well-considered, whereas the client list has been chosen mainly for anti-fingerprinting purposes.) Relays prefer: AES over 3DES; then ECDHE over DHE; then GCM over CBC; @@ -64,13 +64,13 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 Resolves ticket 11438. o Minor features (Transparent proxy, *BSD): - - Support FreeBSD's ipfw firewall interface for TransPort ports. on + - Support FreeBSD's ipfw firewall interface for TransPort ports on FreeBSD. To enable it, set "TransProxyType ipfw". Resolves ticket 10267; patch from "yurivict". - Support OpenBSD's divert-to rules with the pf firewall for - transparent proxy ports. To enable it, set "TransProxyType pf- - divert". This allows Tor to run a TransPort transparent proxy port - on OpenBSD 4.4 or later without root privileges. See the + transparent proxy ports. To enable it, set "TransProxyType + pf-divert". This allows Tor to run a TransPort transparent proxy + port on OpenBSD 4.4 or later without root privileges. See the pf.conf(5) manual page for information on configuring pf to use divert-to rules. Closes ticket 10896; patch from Dana Koch. @@ -102,11 +102,11 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 ESTABLISH_RENDEZVOUS cell. Fixes ticket 11279. - When we run out of usable circuit IDs on a channel, log only one warning for the whole channel, and describe how many circuits - there were on the channel. Fix for part of ticket #11553. + there were on the channel. Fixes part of ticket 11553. o Minor features (controller): - Make the entire exit policy available from the control port via - GETINFO exit-policy/*. Implements enhancement #7952. Patch from + GETINFO exit-policy/*. Implements enhancement 7952. Patch from "rl1987". - Because of the fix for ticket 11396, the real limit for memory usage may no longer match the configured MaxMemInQueues value. The @@ -135,7 +135,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 hope. Fixes bug 10268; bugfix on 0.2.0.1-alpha. Original patch from "epoch". - o Minor bugfixes (exit): + o Minor bugfixes (exit relay): - Stop leaking memory when we successfully resolve a PTR record. Fixes bug 11437; bugfix on 0.2.4.7-alpha. @@ -151,15 +151,15 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 bugfix on 0.2.0.3-alpha. o Minor bugfixes (client, logging during bootstrap): - - Warn only once we start logging in an unsafe way. Previously, we - complain as many times we had problems. Fix for #9870; bugfix on - 0.2.5.1-alpha. + - Warn only once if we start logging in an unsafe way. Previously, we + complain as many times as we had problems. Fixes bug 9870; + bugfix on 0.2.5.1-alpha. - Only report the first fatal bootstrap error on a given OR connection. This stops us from telling the controller bogus error messages like "DONE". Fixes bug 10431; bugfix on 0.2.1.1-alpha. - Be more helpful when trying to run sandboxed on Linux without libseccomp. Instead of saying "Sandbox is not implemented on this - platform", we now explain that we to need be built with + platform", we now explain that we need to be built with libseccomp. Fixes bug 11543; bugfix on 0.2.5.1-alpha. - Avoid generating spurious warnings when starting with DisableNetwork enabled. Fixes bug 11200 and bug 10405; bugfix on @@ -169,11 +169,11 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 - If write_to_buf() in connection_write_to_buf_impl_() ever fails, check if it's an or_connection_t and correctly call connection_or_close_for_error() rather than - connection_mark_for_close() directly. Fixes bug #11304; bugfix on + connection_mark_for_close() directly. Fixes bug 11304; bugfix on 0.2.4.4-alpha. - When closing all connections on setting DisableNetwork to 1, use connection_or_close_normally() rather than closing OR connections - out from under the channel layer. Fixes bug #11306; bugfix on + out from under the channel layer. Fixes bug 11306; bugfix on 0.2.4.4-alpha. o Minor bugfixes (controller): @@ -197,7 +197,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 0.2.2.1-alpha. - Don't report failures from make_socket_reuseable() on incoming sockets on OSX: this can happen when incoming connections close - early. Fix for bug 10081. + early. Fixes bug 10081. o Minor bugfixes (trivial memory leaks): - Fix a small memory leak when signing a directory object. Fixes bug @@ -206,8 +206,7 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 harmless memory leak. Fixes bug 11278; bugfix on 0.2.5.1-alpha. - Don't re-initialize a second set of OpenSSL mutexes when starting up. Previously, we'd make one set of mutexes, and then immediately - replace them with another. Fixes bug 11726; bugfix on - 0.2.5.3-alpha. + replace them with another. Fixes bug 11726; bugfix on 0.2.5.3-alpha. - Resolve some memory leaks found by coverity in the unit tests, on exit in tor-gencert, and on a failure to compute digests for our own keys when generating a v3 networkstatus vote. These leaks @@ -215,18 +214,17 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 o Minor bugfixes (hidden service): - Only retry attempts to connect to a chosen rendezvous point 8 - times, not 30. Fixes bug #4241; bugfix on 0.1.0.1-rc. + times, not 30. Fixes bug 4241; bugfix on 0.1.0.1-rc. - o Minor bugfixes (misc correctness): + o Minor bugfixes (misc code correctness): - Fix various instances of undefined behavior in channeltls.c, - tor_memmem(), and eventdns.c, that would cause us to construct + tor_memmem(), and eventdns.c that would cause us to construct pointers to memory outside an allocated object. (These invalid pointers were not accessed, but C does not even allow them to - exist.) Fixes bug #10363; bugfixes on 0.2.0.10-alpha, - 0.2.3.6-alpha, 0.1.1.1-alpha, and 0.1.2.1-alpha. Reported by - "bobnomnom". + exist.) Fixes bug 10363; bugfixes on 0.1.1.1-alpha, 0.1.2.1-alpha, + 0.2.0.10-alpha, and 0.2.3.6-alpha. Reported by "bobnomnom". - Use the AddressSanitizer and Ubsan sanitizers (in clang-3.4) to - fix some miscellaneous errors in our tests and codebase. Fix for + fix some miscellaneous errors in our tests and codebase. Fixes bug 11232. Bugfixes on versions back as far as 0.2.1.11-alpha. - Always check return values for unlink, munmap, UnmapViewOfFile; check strftime return values more often. In some cases all we can @@ -256,9 +254,9 @@ Changes in version 0.2.5.4-alpha - 2014-04-25 - Resolve warnings from Doxygen. o Code simplifications and refactoring: - - Removing is_internal_IP() function. Resolves ticket 4645. + - Remove is_internal_IP() function. Resolves ticket 4645. - Remove unused function circuit_dump_by_chan from circuitlist.c. - Closes issue #9107; patch from "marek". + Closes issue 9107; patch from "marek". - Change our use of the ENUM_BF macro to avoid declarations that confuse Doxygen.

1 0

[tor/master] resolve a typo: sanboxing->sandboxing.
by nickm＠torproject.org 26 Apr '14

26 Apr '14

commit 9735ca6e3096be2ecb32848a44dce71827cd193e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Apr 25 21:08:01 2014 -0400 resolve a typo: sanboxing->sandboxing. --- src/common/sandbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 4ce9aa9..8516c75 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1616,7 +1616,7 @@ sandbox_init(sandbox_cfg_t *cfg) #elif defined(__linux__) (void)cfg; log_warn(LD_GENERAL, - "This version of Tor was built without support for sanboxing. To " + "This version of Tor was built without support for sandboxing. To " "build with support for sandboxing on Linux, you must have " "libseccomp and its necessary header files (e.g. seccomp.h)."); return 0;

1 0

r26738: {website} Tor Check no longer goes down all the time. (website/trunk/docs/en)
by Matt Pagan 25 Apr '14

25 Apr '14

Author: mttp Date: 2014-04-25 21:43:56 +0000 (Fri, 25 Apr 2014) New Revision: 26738 Modified: website/trunk/docs/en/faq.wml Log: Tor Check no longer goes down all the time. Modified: website/trunk/docs/en/faq.wml =================================================================== --- website/trunk/docs/en/faq.wml 2014-04-24 19:16:44 UTC (rev 26737) +++ website/trunk/docs/en/faq.wml 2014-04-25 21:43:56 UTC (rev 26738) @@ -931,27 +931,6 @@ coming through the Tor network. Try the <a href="https://check.torproject.org"> Tor Check</a> site and see whether it thinks you are using Tor or not. - - If that site is down, you can still test, but it will involve more effort. - Sites like <a href="http://ipid.shat.net">http://ipid.shat.net</a> and - <a href="http://www.showmyip.com/">http://www.showmyip.com/</a> will tell - you what your IP address appears to be, but you'll need to know your - current IP address so you can compare and decide whether you're using Tor - correctly. - - - To learn your IP address on OS X, Linux, BSD, etc, run "ifconfig". On - Windows, go to the Start menu, click Run and enter "cmd". At the command - prompt, enter "ipconfig /a". - - - If you are behind a NAT or firewall, though, your IP address will be - within the range of 10.XXX.XXX.XXX, 192.168.XXX.XXX, or 172.16.XXX.XXX - - 172.31.XXX.XXX, which is not your public IP address. In this case, you - should check your IP address with one of the sites above without using - Tor, and then check again using Tor to see whether your IP address has - changed. - <hr>

1 0