tor-commits May 2021

tor-commits@lists.torproject.org

20 participants
1972 discussions

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit 35cba3ae330c46c62910d566d7d17be48a4a6f6c Merge: 8c4581865e e8d224dfb1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 10 15:28:14 2021 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40334 | 3 +++ src/feature/hs/hs_metrics.c | 8 +++++--- src/feature/hs/hs_service.c | 4 +++- 3 files changed, 11 insertions(+), 4 deletions(-)

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit 9c63b3b0c22f67e059d9c9dcb22ce0d8efc0512a Merge: 1fdfa8eeed a6533af9e8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:54:00 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-)

1 0

[tor/release-0.4.6] changelog updates from arma
by dgoulet＠torproject.org 07 May '21

07 May '21

commit bc2e3ea89d321dde9d024430561cffd6a13c6900 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 17:12:55 2021 -0400 changelog updates from arma --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 57480c08aa..a2052fa55f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,7 +34,7 @@ Changes in version 0.4.5.7 - 2021-03-16 o Minor features (geoip data): - We have switched geoip data sources. Previously we shipped IP-to- country mappings from Maxmind's GeoLite2, but in 2019 they changed - their licensing term, so we were unable to update them after that + their licensing terms, so we were unable to update them after that point. We now ship geoip files based on the IPFire Location Database instead. (See https://location.ipfire.org/ for more information). This release updates our geoip files to match the @@ -73,7 +73,7 @@ Changes in version 0.4.5.7 - 2021-03-16 - Remove a spammy log notice falsely claiming that the IPv4/v6 address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha. - Do not query the address cache early in the boot process when - deciding if we a relay needs to fetch early directory information + deciding if a relay needs to fetch early directory information from an authority. This bug resulted in a relay falsely believing it didn't have an address and thus triggering an authority fetch at each boot. Related to our fix for 40300.

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit 4b0a0b9952fffc7035914838dc29761042418416 Merge: 1aa8fd66be 1f21b6e6a7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Apr 13 10:36:01 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 changes/geoip-2021-04-13 | 3 + src/config/geoip | 10953 +++++++++++++++++++++------------------------ src/config/geoip6 | 2608 +++++++---- 3 files changed, 6970 insertions(+), 6594 deletions(-)

1 0

[tor/release-0.4.6] copy 0.4.5.7 changelog to releasenotes
by dgoulet＠torproject.org 07 May '21

07 May '21

commit 83f895c015de55201e5f226f84a866f30f5ee14b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 16 08:27:52 2021 -0400 copy 0.4.5.7 changelog to releasenotes --- ReleaseNotes | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index 47a673b90a..0b0e0912b1 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,91 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.4.5.7 - 2021-03-16 + Tor 0.4.5.7 fixes two important denial-of-service bugs in earlier + versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a few + smaller bugs in earlier releases. + + o Major bugfixes (security, denial of service): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing terms, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Minor bugfixes (directory authority): + - Now that exit relays don't allow exit connections to directory + authority DirPorts (to prevent network reentry), disable + authorities' reachability self test on the DirPort. Fixes bug + 40287; bugfix on 0.4.5.5-rc. + + o Minor bugfixes (documentation): + - Fix a formatting error in the documentation for + VirtualAddrNetworkIPv6. Fixes bug 40256; bugfix on 0.2.9.4-alpha. + + o Minor bugfixes (Linux, relay): + - Fix a bug in determining total available system memory that would + have been triggered if the format of Linux's /proc/meminfo file + had ever changed to include "MemTotal:" in the middle of a line. + Fixes bug 40315; bugfix on 0.2.5.4-alpha. + + o Minor bugfixes (metrics port): + - Fix a BUG() warning on the MetricsPort for an internal missing + handler. Fixes bug 40295; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (onion service): + - Remove a harmless BUG() warning when reloading tor configured with + onion services. Fixes bug 40334; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (portability): + - Fix a non-portable usage of "==" with "test" in the configure + script. Fixes bug 40298; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (relay): + - Remove a spammy log notice falsely claiming that the IPv4/v6 + address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha. + - Do not query the address cache early in the boot process when + deciding if a relay needs to fetch early directory information + from an authority. This bug resulted in a relay falsely believing + it didn't have an address and thus triggering an authority fetch + at each boot. Related to our fix for 40300. + + o Removed features (mallinfo deprecated): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.4.5.6 - 2021-02-15 The Tor 0.4.5.x release series is dedicated to the memory of Karsten Loesing (1979-2020), Tor developer, cypherpunk, husband, and father.

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit eddb3e262e3dd69c93082d1b7db872bff47fad87 Merge: 2daff0b045 30fa80c0fc Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Apr 14 08:39:17 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 src/app/config/fallback_dirs.inc | 2 -- 1 file changed, 2 deletions(-)

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit aa49562a0520ff3ddbbce9fc5e77acd8dd4a5812 Merge: 83f895c015 d66178c7b7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 16 09:18:52 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 configure.ac | 4 ++-- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit 2fc077e6766d66b6b4954c2d9a95a663f484da21 Merge: eddb3e262e 925ec0e0ea Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Apr 19 17:33:45 2021 +0300 Merge branch 'maint-0.4.5' into release-0.4.5 changes/autoconf-2.70 | 3 +++ configure.ac | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit 2daff0b045752cc3d6cb09aef7853241de73fccc Merge: 4b0a0b9952 59bc377dce Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Apr 13 16:59:16 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40265 | 3 + src/app/config/fallback_dirs.inc | 1040 ++++++++++++++++++++++++-------------- 2 files changed, 660 insertions(+), 383 deletions(-)

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 07 May '21

07 May '21

commit e6ef22ca153bd0b49536ad598907f8acb4f2b705 Merge: 2fc077e676 cd75eac743 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Apr 19 11:30:00 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40369 | 4 ++++ scripts/build/combine_libs | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits May 2021