June 2017 - tor-commits - lists.torproject.org

[tor/release-0.3.0] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 987c7cae7073ba2c579cc81f973446831246858d Merge: d561da1 d15d09a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.2.9 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.6' into maint-0.2.7-redux
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit c1646d6e894f11fe3a363468d7a668648f2d63d7 Merge: 9a6f938 40bccc2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.6' into maint-0.2.7-redux changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] bump to 0.3.0.8
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit a0664fd0c32139e5fded325dd6df6a8b636a72ba Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:24:28 2017 -0400 bump to 0.3.0.8 --- changes/trove-2017-004 | 2 -- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 4 files changed, 3 insertions(+), 5 deletions(-) diff --git a/changes/trove-2017-004 b/changes/trove-2017-004 index eb0789d..af1567f 100644 --- a/changes/trove-2017-004 +++ b/changes/trove-2017-004 @@ -4,5 +4,3 @@ triggered by a tor_assert(). Fixes bug 22493, tracked as TROVE-2017-004 and as CVE-2017-0375; bugfix on 0.3.0.1-alpha. Found by armadev. - - diff --git a/configure.ac b/configure.ac index 8627335..bba29f5 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.0.7-dev]) +AC_INIT([tor],[0.3.0.8]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 96c242b..a2f261d 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.0.7-dev" +!define VERSION "0.3.0.8" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 49a4a45..9793405 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.0.7-dev" +#define VERSION "0.3.0.8"

1 0

[tor/release-0.3.0] bump to 0.2.9.11
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit b53322024967746b24eb47ac688ddfbf7df8599f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:24:38 2017 -0400 bump to 0.2.9.11 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index d54793a..b295bf5 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.2.9.10-dev]) +AC_INIT([tor],[0.2.9.11]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 5f3ac99..1f78046 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.9.10-dev" +!define VERSION "0.2.9.11" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index a54c009..b5ab2bf 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.9.10-dev" +#define VERSION "0.2.9.11"

1 0

[tor/release-0.3.0] bump to 0.2.5.14
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit fa73f59ad3902449826f31635e47aa4750b23209 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:26:00 2017 -0400 bump to 0.2.5.14 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 8f85dae..da797e5 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2013, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.5.13]) +AC_INIT([tor],[0.2.5.14]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 9661e10..3e55030 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.5.13" +!define VERSION "0.2.5.14" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index aa04092..d45f51e 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -241,7 +241,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.5.13" +#define VERSION "0.2.5.14"

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.6' into maint-0.2.7-redux
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 4915d9c5a7fc8db2497258a293137426cbd0d665 Merge: 2efe027 b796ad0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:28:54 2017 -0400 Merge branch 'maint-0.2.6' into maint-0.2.7-redux "ours" merge to avoid version bump.

1 0

[tor/release-0.3.0] Bump to 0.2.6.12
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 0de46203750f8c01b5f355d743949fe8471b0636 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:26:20 2017 -0400 Bump to 0.2.6.12 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index a79ea82..55e59e9 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.6.11]) +AC_INIT([tor],[0.2.6.12]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 6611bb8..4de6b1b 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.6.11" +!define VERSION "0.2.6.12" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 59cd43e..74a27f4 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.6.11" +#define VERSION "0.2.6.12"

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 03b91ac8c9b082430ba466ef72ef0c6ca594e698 Merge: 63d0426 d389480 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:29:49 2017 -0400 Merge branch 'maint-0.3.0' into release-0.3.0 changes/trove-2017-004 | 2 -- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 4 files changed, 3 insertions(+), 5 deletions(-)

1 0

[tor/release-0.3.0] copy changelog to releasenotes
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 802d30d9b71a6d54ef5fd1278ab4858b2e76e750 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:35:17 2017 -0400 copy changelog to releasenotes --- ReleaseNotes | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index b971c11..533e378 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,83 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.3.0.8 - 2017-06-08 + Tor 0.3.0.8 fixes a pair of bugs that would allow an attacker to + remotely crash a hidden service with an assertion failure. Anyone + running a hidden service should upgrade to this version, or to some + other version with fixes for TROVE-2017-004 and TROVE-2017-005. + + Tor 0.3.0.8 also includes fixes for several key management bugs + that sometimes made relays unreliable, as well as several other + bugfixes described below. + + o Major bugfixes (hidden service, relay, security, backport + from 0.3.1.3-alpha): + - Fix a remotely triggerable assertion failure when a hidden service + handles a malformed BEGIN cell. Fixes bug 22493, tracked as + TROVE-2017-004 and as CVE-2017-0375; bugfix on 0.3.0.1-alpha. + - Fix a remotely triggerable assertion failure caused by receiving a + BEGIN_DIR cell on a hidden service rendezvous circuit. Fixes bug + 22494, tracked as TROVE-2017-005 and CVE-2017-0376; bugfix + on 0.2.2.1-alpha. + + o Major bugfixes (relay, link handshake, backport from 0.3.1.3-alpha): + - When performing the v3 link handshake on a TLS connection, report + that we have the x509 certificate that we actually used on that + connection, even if we have changed certificates since that + connection was first opened. Previously, we would claim to have + used our most recent x509 link certificate, which would sometimes + make the link handshake fail. Fixes one case of bug 22460; bugfix + on 0.2.3.6-alpha. + + o Major bugfixes (relays, key management, backport from 0.3.1.3-alpha): + - Regenerate link and authentication certificates whenever the key + that signs them changes; also, regenerate link certificates + whenever the signed key changes. Previously, these processes were + only weakly coupled, and we relays could (for minutes to hours) + wind up with an inconsistent set of keys and certificates, which + other relays would not accept. Fixes two cases of bug 22460; + bugfix on 0.3.0.1-alpha. + - When sending an Ed25519 signing->link certificate in a CERTS cell, + send the certificate that matches the x509 certificate that we + used on the TLS connection. Previously, there was a race condition + if the TLS context rotated after we began the TLS handshake but + before we sent the CERTS cell. Fixes a case of bug 22460; bugfix + on 0.3.0.1-alpha. + + o Major bugfixes (hidden service v3, backport from 0.3.1.1-alpha): + - Stop rejecting v3 hidden service descriptors because their size + did not match an old padding rule. Fixes bug 22447; bugfix on + tor-0.3.0.1-alpha. + + o Minor features (fallback directory list, backport from 0.3.1.3-alpha): + - Replace the 177 fallbacks originally introduced in Tor 0.2.9.8 in + December 2016 (of which ~126 were still functional) with a list of + 151 fallbacks (32 new, 119 unchanged, 58 removed) generated in May + 2017. Resolves ticket 21564. + + o Minor bugfixes (configuration, backport from 0.3.1.1-alpha): + - Do not crash when starting with LearnCircuitBuildTimeout 0. Fixes + bug 22252; bugfix on 0.2.9.3-alpha. + + o Minor bugfixes (correctness, backport from 0.3.1.3-alpha): + - Avoid undefined behavior when parsing IPv6 entries from the geoip6 + file. Fixes bug 22490; bugfix on 0.2.4.6-alpha. + + o Minor bugfixes (link handshake, backport from 0.3.1.3-alpha): + - Lower the lifetime of the RSA->Ed25519 cross-certificate to six + months, and regenerate it when it is within one month of expiring. + Previously, we had generated this certificate at startup with a + ten-year lifetime, but that could lead to weird behavior when Tor + was started with a grossly inaccurate clock. Mitigates bug 22466; + mitigation on 0.3.0.1-alpha. + + o Minor bugfixes (memory leak, directory authority, backport from + 0.3.1.2-alpha): + - When directory authorities reject a router descriptor due to + keypinning, free the router descriptor rather than leaking the + memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha. + Changes in version 0.3.0.7 - 2017-05-15 Tor 0.3.0.7 fixes a medium-severity security bug in earlier versions

1 0

[tor/release-0.3.0] Bump to 0.2.8.14
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 792931d53d26e469ea2e22f63911b1553c053473 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:27:54 2017 -0400 Bump to 0.2.8.14 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 9c6d95d..092aa74 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.2.8.13]) +AC_INIT([tor],[0.2.8.14]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index ae477b8..ba0cf5c 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.8.13" +!define VERSION "0.2.8.14" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index b61f59f..41ce26e 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -229,7 +229,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.8.13" +#define VERSION "0.2.8.14"

1 0