./net/tor, Anonymizing overlay network for TCP

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: CURRENT, Version:, Package name: tor-, Maintainer: reezer

The simple version: Tor provides a distributed network of servers ("onion
routers"). Users bounce their TCP streams (web traffic, FTP, SSH, etc.) around
the routers. This makes it hard for recipients, observers, and even the onion
routers themselves to track the source of the stream.

The complex version: Onion Routing is a connection-oriented anonymizing
communication service. Users choose a source-routed path through a set of
nodes, and negotiate a "virtual circuit" through the network, in which each
node knows its predecessor and successor, but no others. Traffic flowing down
the circuit is unwrapped by a symmetric key at each node, which reveals the
downstream node.

Required to build:
[textproc/asciidoc] [pkgtools/cwrappers]

Package options: doc

Master sites:

SHA1: 620c4cf306ec641e203541f9990acefb6a40a8d1
RMD160: 136a4926c6b3dc157c4a1f4c5539368743adca80
Filesize: 6771.993 KB

Version history: (Expand)

CVS history: (Expand)

   2019-01-08 09:39:55 by Adam Ciarcinski | Files touched by this commit (3) | Package updated
Log message:
tor: updated to

Changes in version

Tor is the first stable release in its series; it includes
compilation and portability fixes, and a fix for a severe problem
affecting directory caches.

The Tor 0.3.5 series includes several new features and performance
improvements, including client authorization for v3 onion services,
cleanups to bootstrap reporting, support for improved bandwidth-
measurement tools, experimental support for NSS in place of OpenSSL,
and much more. It also begins a full reorganization of Tor's code
layout, for improved modularity and maintainability in the future.
Finally, there is the usual set of performance improvements and
bugfixes that we try to do in every release series.

There are a couple of changes in the 0.3.5 that may affect
compatibility. First, the default version for newly created onion
services is now v3. Use the HiddenServiceVersion option if you want to
override this. Second, some log messages related to bootstrapping have
changed; if you use stem, you may need to update to the latest version
so it will recognize them.

We have designated 0.3.5 as a "long-term support" (LTS) series: we
will continue to patch major bugs in typical configurations of 0.3.5
until at least 1 Feb 2022. (We do not plan to provide long-term
support for embedding, Rust support, NSS support, running a directory
authority, or unsupported platforms. For these, you will need to stick
with the latest stable release.)
   2018-11-06 20:32:30 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
tor: updated to

Tor is the second stable release in its series; it backports
numerous fixes, including a fix for a bandwidth management bug that
was causing memory exhaustion on relays. Anyone running an earlier
version of Tor should upgrade.

o Major bugfixes (compilation, backport from
  - Fix compilation on ARM (and other less-used CPUs) when compiling
    with OpenSSL before 1.1. Fixes bug 27781; bugfix on

o Major bugfixes (mainloop, bootstrap, backport from
  - Make sure Tor bootstraps and works properly if only the
    ControlPort is set. Prior to this fix, Tor would only bootstrap
    when a client port was set (Socks, Trans, NATD, DNS or HTTPTunnel
    port). Fixes bug 27849; bugfix on

o Major bugfixes (relay, backport from
  - When our write bandwidth limit is exhausted, stop writing on the
    connection. Previously, we had a typo in the code that would make
    us stop reading instead, leading to relay connections being stuck
    indefinitely and consuming kernel RAM. Fixes bug 28089; bugfix

o Major bugfixes (restart-in-process, backport from
  - Fix a use-after-free error that could be caused by passing Tor an
    impossible set of options that would fail during options_act().
    Fixes bug 27708; bugfix on

o Minor features (continuous integration, backport from
  - Don't do a distcheck with --disable-module-dirauth in Travis.
    Implements ticket 27252.
  - Only run one online rust build in Travis, to reduce network
    errors. Skip offline rust builds on Travis for Linux gcc, because
    they're redundant. Implements ticket 27252.
  - Skip gcc on OSX in Travis CI, because it's rarely used. Skip a
    duplicate hardening-off build in Travis on Tor 0.2.9. Skip gcc on
    Linux with default settings, because all the non-default builds
    use gcc on Linux. Implements ticket 27252.

o Minor features (continuous integration, backport from
  - Use the Travis Homebrew addon to install packages on macOS during
    Travis CI. The package list is the same, but the Homebrew addon
    does not do a `brew update` by default. Implements ticket 27738.

o Minor features (geoip):
  - Update geoip and geoip6 to the October 9 2018 Maxmind GeoLite2
    Country database. Closes ticket 27991.

o Minor bugfixes (32-bit OSX and iOS, timing, backport from
  - Fix an integer overflow bug in our optimized 32-bit millisecond-
    difference algorithm for 32-bit Apple platforms. Previously, it
    would overflow when calculating the difference between two times
    more than 47 days apart. Fixes part of bug 27139; bugfix
  - Improve the precision of our 32-bit millisecond difference
    algorithm for 32-bit Apple platforms. Fixes part of bug 27139;
    bugfix on
  - Relax the tolerance on the mainloop/update_time_jumps test when
    running on 32-bit Apple platforms. Fixes part of bug 27139; bugfix

o Minor bugfixes (C correctness, to appear in
  - Avoid undefined behavior in an end-of-string check when parsing
    the BEGIN line in a directory object. Fixes bug 28202; bugfix

o Minor bugfixes (CI, appveyor, to appear in
  - Only install the necessary mingw packages during our appveyor
    builds. This change makes the build a little faster, and prevents
    a conflict with a preinstalled mingw openssl that appveyor now
    ships. Fixes bugs 27943 and 27765; bugfix on

o Minor bugfixes (code safety, backport from
  - Rewrite our assertion macros so that they no longer suppress the
    compiler's -Wparentheses warnings. Fixes bug 27709; bugfix

o Minor bugfixes (continuous integration, backport from
  - Stop reinstalling identical packages in our Windows CI. Fixes bug
    27464; bugfix on

o Minor bugfixes (directory authority, to appear in
  - Log additional info when we get a relay that shares an ed25519 ID
    with a different relay, instead making a BUG() warning. Fixes bug
    27800; bugfix on

o Minor bugfixes (directory connection shutdown, backport from
  - Avoid a double-close when shutting down a stalled directory
    connection. Fixes bug 26896; bugfix on

o Minor bugfixes (HTTP tunnel, backport from
  - Fix a bug warning when closing an HTTP tunnel connection due to an
    HTTP request we couldn't handle. Fixes bug 26470; bugfix

o Minor bugfixes (netflow padding, backport from
  - Ensure circuitmux queues are empty before scheduling or sending
    padding. Fixes bug 25505; bugfix on

o Minor bugfixes (onion service v3, backport from
  - When the onion service directory can't be created or has the wrong
    permissions, do not log a stack trace. Fixes bug 27335; bugfix

o Minor bugfixes (onion service v3, backport from
  - Close all SOCKS request (for the same .onion) if the newly fetched
    descriptor is unusable. Before that, we would close only the first
    one leaving the other hanging and let to time out by themselves.
    Fixes bug 27410; bugfix on

o Minor bugfixes (onion service v3, backport from
  - When selecting a v3 rendezvous point, don't only look at the
    protover, but also check whether the curve25519 onion key is
    present. This way we avoid picking a relay that supports the v3
    rendezvous but for which we don't have the microdescriptor. Fixes
    bug 27797; bugfix on

o Minor bugfixes (protover, backport from
  - Reject protocol names containing bytes other than alphanumeric
    characters and hyphens ([A-Za-z0-9-]). Fixes bug 27316; bugfix

o Minor bugfixes (rust, backport from
  - Compute protover votes correctly in the rust version of the
    protover code. Previously, the protover rewrite in 24031 allowed
    repeated votes from the same voter for the same protocol version
    to be counted multiple times in protover_compute_vote(). Fixes bug
    27649; bugfix on
  - Reject protover names that contain invalid characters. Fixes bug
    27687; bugfix on

o Minor bugfixes (rust, backport from
  - protover_all_supported() would attempt to allocate up to 16GB on
    some inputs, leading to a potential memory DoS. Fixes bug 27206;
    bugfix on

o Minor bugfixes (rust, directory authority, to appear in
  - Fix an API mismatch in the rust implementation of
    protover_compute_vote(). This bug could have caused crashes on any
    directory authorities running Tor with Rust (which we do not yet
    recommend). Fixes bug 27741; bugfix on

o Minor bugfixes (rust, to appear in
  - Fix a potential null dereference in protover_all_supported(). Add
    a test for it. Fixes bug 27804; bugfix on
  - Return a string that can be safely freed by C code, not one
    created by the rust allocator, in protover_all_supported(). Fixes
    bug 27740; bugfix on

o Minor bugfixes (testing, backport from
  - If a unit test running in a subprocess exits abnormally or with a
    nonzero status code, treat the test as having failed, even if the
    test reported success. Without this fix, memory leaks don't cause
    the tests to fail, even with LeakSanitizer. Fixes bug 27658;
    bugfix on

o Minor bugfixes (testing, backport from
  - Make the hs_service tests use the same time source when creating
    the introduction point and when testing it. Now tests work better
    on very slow systems like ARM or Travis. Fixes bug 27810; bugfix

o Minor bugfixes (testing, to appear in
  - Treat backtrace test failures as expected on BSD-derived systems
    (NetBSD, OpenBSD, and macOS/Darwin) until we solve bug 17808.
    (FreeBSD failures have been treated as expected since 18204 in
    0.2.8.) Fixes bug 27948; bugfix on
   2018-10-12 17:46:19 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
tor: updated to

Tor is the first stable release in its series; it includes
compilation and portability fixes.

The Tor 0.3.4 series includes improvements for running Tor in
low-power and embedded environments, which should help performance in
general. We've begun work on better modularity, and included preliminary
changes on the directory authority side to accommodate a new bandwidth
measurement system.  We've also integrated more continuous-integration
systems into our development process, and made corresponding changes to
Tor's testing infrastructure.  Finally, we've continued to refine
our anti-denial-of-service code.

Below are the changes since  For a complete list of changes
since, see the ReleaseNotes file.

o Minor features (compatibility):
  - Tell OpenSSL to maintain backward compatibility with previous
    RSA1024/DH1024 users in Tor. With OpenSSL 1.1.1-pre6, these
    ciphers are disabled by default. Closes ticket 27344.

o Minor features (continuous integration):
  - Log the compiler path and version during Appveyor builds.
    Implements ticket 27449.
  - Show config.log and test-suite.log after failed Appveyor builds.
    Also upload the zipped full logs as a build artifact. Implements
    ticket 27430.

o Minor bugfixes (compilation):
  - Silence a spurious compiler warning on the GetAdaptersAddresses
    function pointer cast. This issue is already fixed by 26481 in
    0.3.5 and later, by removing the lookup and cast. Fixes bug 27465;
    bugfix on
  - Stop calling SetProcessDEPPolicy() on 64-bit Windows. It is not
    supported, and always fails. Some compilers warn about the
    function pointer cast on 64-bit Windows. Fixes bug 27461; bugfix

o Minor bugfixes (continuous integration):
  - Disable gcc hardening in Appveyor Windows 64-bit builds. As of
    August 29 2018, Appveyor images come with gcc 8.2.0 by default.
    Executables compiled for 64-bit Windows with this version of gcc
    crash when Tor's --enable-gcc-hardening flag is set. Fixes bug
    27460; bugfix on
  - When a Travis build fails, and showing a log fails, keep trying to
    show the other logs. Fixes bug 27453; bugfix on
  - When we use echo in Travis, don't pass a --flag as the first
    argument. Fixes bug 27418; bugfix on

o Minor bugfixes (onion services):
  - Silence a spurious compiler warning in
    rend_client_send_introduction(). Fixes bug 27463; bugfix

o Minor bugfixes (testing, chutney):
  - When running make test-network-all, use the mixed+hs-v2 network.
    (A previous fix to chutney removed v3 onion services from the
    mixed+hs-v23 network, so seeing "mixed+hs-v23" in tests is
    confusing.) Fixes bug 27345; bugfix on
  - Before running make test-network-all, delete old logs and test
    result files, to avoid spurious failures. Fixes bug 27295; bugfix
   2018-07-17 08:14:04 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
tor: update to

Changes in version - 2018-07-13
  Tor moves to a new bridge authority, meaning people running
  bridge relays should upgrade.

  o Directory authority changes:
    - The "Bifroest" bridge authority has been retired; the new bridge
      authority is "Serge", and it is operated by George from the
      TorBSD project. Closes ticket 26771.
   2018-07-13 17:26:32 by Adam Ciarcinski | Files touched by this commit (2) | Package updated
Log message:
tor: updated to

Changes in version
  Tor backports several changes from the 0.3.4.x series, including
  fixes for a memory leak affecting directory authorities.

  o Major bugfixes (directory authority, backport from
    - Stop leaking memory on directory authorities when planning to
      vote. This bug was crashing authorities by exhausting their
      memory. Fixes bug 26435; bugfix on

  o Major bugfixes (rust, testing, backport from
    - Make sure that failing tests in Rust will actually cause the build
      to fail: previously, they were ignored. Fixes bug 26258; bugfix

  o Minor features (compilation, backport from
    - When building Tor, prefer to use Python 3 over Python 2, and more
      recent (contemplated) versions over older ones. Closes
      ticket 26372.

  o Minor features (geoip):
    - Update geoip and geoip6 to the July 3 2018 Maxmind GeoLite2
      Country database. Closes ticket 26674.

  o Minor features (relay, diagnostic, backport from
    - Add several checks to detect whether Tor relays are uploading
      their descriptors without specifying why they regenerated them.
      Diagnostic for ticket 25686.

  o Minor bugfixes (circuit path selection, backport from
    - Don't count path selection failures as circuit build failures.
      This change should eliminate cases where Tor blames its guard or
      the network for situations like insufficient microdescriptors
      and/or overly restrictive torrc settings. Fixes bug 25705; bugfix

  o Minor bugfixes (compilation, backport from
    - Fix a compilation warning on some versions of GCC when building
      code that calls routerinfo_get_my_routerinfo() twice, assuming
      that the second call will succeed if the first one did. Fixes bug
      26269; bugfix on

  o Minor bugfixes (control port, backport from
    - Handle the HSADDRESS= argument to the HSPOST command properly.
      (Previously, this argument was misparsed and thus ignored.) Fixes
      bug 26523; bugfix on Patch by "akwizgran".

  o Minor bugfixes (memory, correctness, backport from
    - Fix a number of small memory leaks identified by coverity. Fixes
      bug 26467; bugfix on numerous Tor versions.

  o Minor bugfixes (relay, backport from
    - Relays now correctly block attempts to re-extend to the previous
      relay by Ed25519 identity. Previously they would warn in this
      case, but not actually reject the attempt. Fixes bug 26158; bugfix

  o Minor bugfixes (restart-in-process, backport from
    - When shutting down, Tor now clears all the flags in the control.c
      module. This should prevent a bug where authentication cookies are
      not generated on restart. Fixes bug 25512; bugfix on

  o Minor bugfixes (testing, compatibility, backport from
    - When running the hs_ntor_ref.py test, make sure only to pass
      strings (rather than "bytes" objects) to the Python subprocess
      module. Python 3 on Windows seems to require this. Fixes bug
      26535; bugfix on
    - When running the ntor_ref.py test, make sure only to pass strings
      (rather than "bytes" objects) to the Python subprocess module.
      Python 3 on Windows seems to require this. Fixes bug 26535; bugfix
   2018-06-17 10:29:11 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
tor: update to

Changes in version - 2018-06-12
  Tor backports several changes from the 0.3.4.x series, including
  fixes for bugs affecting compatibility and stability.

  o Directory authority changes:
    - Add an IPv6 address for the "dannenberg" directory authority.
      Closes ticket 26343.

  o Minor features (geoip):
    - Update geoip and geoip6 to the June 7 2018 Maxmind GeoLite2
      Country database. Closes ticket 26351.

  o Minor bugfixes (compatibility, openssl, backport from
    - Work around a change in OpenSSL 1.1.1 where return values that
      would previously indicate "no password" now indicate an empty
      password. Without this workaround, Tor instances running with
      OpenSSL 1.1.1 would accept descriptors that other Tor instances
      would reject. Fixes bug 26116; bugfix on

  o Minor bugfixes (compilation, backport from
    - Silence unused-const-variable warnings in zstd.h with some GCC
      versions. Fixes bug 26272; bugfix on

  o Minor bugfixes (controller, backport from
    - Improve accuracy of the BUILDTIMEOUT_SET control port event's
      TIMEOUT_RATE and CLOSE_RATE fields. (We were previously
      miscounting the total number of circuits for these field values.)
      Fixes bug 26121; bugfix on

  o Minor bugfixes (hardening, backport from
    - Prevent a possible out-of-bounds smartlist read in
      protover_compute_vote(). Fixes bug 26196; bugfix on

  o Minor bugfixes (path selection, backport from
    - Only select relays when they have the descriptors we prefer to use
      for them. This change fixes a bug where we could select a relay
      because it had _some_ descriptor, but reject it later with a
      nonfatal assertion error because it didn't have the exact one we
      wanted. Fixes bugs 25691 and 25692; bugfix on
   2018-05-23 08:19:52 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
tor: update to

Changes in version - 2018-05-22
  Tor is the first stable release in the 0.3.3 series. It
  backports several important fixes from the

  The Tor 0.3.3 series includes controller support and other
  improvements for v3 onion services, official support for embedding Tor
  within other applications, and our first non-trivial module written in
  the Rust programming language. (Rust is still not enabled by default
  when building Tor.) And as usual, there are numerous other smaller
  bugfixes, features, and improvements.

  Below are the changes since For a list of only the changes
  since, see the ChangeLog file.

  o New system requirements:
    - When built with Rust, Tor now depends on version 0.2.39 of the
      libc crate. Closes tickets 25310 and 25664.

  o Major features (embedding):
    - There is now a documented stable API for programs that need to
      embed Tor. See tor_api.h for full documentation and known bugs.
      Closes ticket 23684.
    - Tor now has support for restarting in the same process.
      Controllers that run Tor using the "tor_api.h" interface can now
      restart Tor after Tor has exited. This support is incomplete,
      however: we fixed crash bugs that prevented it from working at
      all, but many bugs probably remain, including a possibility of
      security issues. Implements ticket 24581.

  o Major features (IPv6, directory documents):
    - Add consensus method 27, which adds IPv6 ORPorts to the microdesc
      consensus. This information makes it easier for IPv6 clients to
      bootstrap and choose reachable entry guards. Implements
      ticket 23826.
    - Add consensus method 28, which removes IPv6 ORPorts from
      microdescriptors. Now that the consensus contains IPv6 ORPorts,
      they are redundant in microdescs. This change will be used by Tor
      clients on 0.2.8.x and later. (That is to say, with all Tor
      clients that have IPv6 bootstrap and guard support.) Implements
      ticket 23828.
    - Expand the documentation for AuthDirHasIPv6Connectivity when it is
      set by different numbers of authorities. Fixes 23870

  o Major features (onion service v3, control port):
    - The control port now supports commands and events for v3 onion
      services. It is now possible to create ephemeral v3 services using
      ADD_ONION. Additionally, several events (HS_DESC, HS_DESC_CONTENT,
      CIRC and CIRC_MINOR) and commands (GETINFO, HSPOST, ADD_ONION and
      DEL_ONION) have been extended to support v3 onion services. Closes
      ticket 20699; implements proposal 284.

  o Major features (onion services):
    - Provide torrc options to pin the second and third hops of onion
      service circuits to a list of nodes. The option HSLayer2Guards
      pins the second hop, and the option HSLayer3Guards pins the third
      hop. These options are for use in conjunction with experiments
      with "vanguards" for preventing guard enumeration attacks. Closes
      ticket 13837.
    - When v3 onion service clients send introduce cells, they now
      include the IPv6 address of the rendezvous point, if it has one.
      Current v3 onion services running 0.3.2 ignore IPv6 addresses, but
      in future Tor versions, IPv6-only v3 single onion services will be
      able to use IPv6 addresses to connect directly to the rendezvous
      point. Closes ticket 23577. Patch by Neel Chauhan.

  o Major features (relay):
    - Implement an option, ReducedExitPolicy, to allow an Tor exit relay
      operator to use a more reasonable ("reduced") exit policy, rather
      than the default one. If you want to run an exit node without
      thinking too hard about which ports to allow, this one is for you.
      Closes ticket 13605. Patch from Neel Chauhan.

  o Major features (rust, portability, experimental):
    - Tor now ships with an optional implementation of one of its
      smaller modules (protover.c) in the Rust programming language. To
      try it out, install a Rust build environment, and configure Tor
      with "--enable-rust --enable-cargo-online-mode". This should not
      cause any user-visible changes, but should help us gain more
      experience with Rust, and plan future Rust integration work.
      Implementation by Chelsea Komlo. Closes ticket 22840.

  o Major bugfixes (directory authorities, security, backport from
    - When directory authorities read a zero-byte bandwidth file, they
      would previously log a warning with the contents of an
      uninitialised buffer. They now log a warning about the empty file
      instead. Fixes bug 26007; bugfix on

  o Major bugfixes (security, directory authority, denial-of-service):
    - Fix a bug that could have allowed an attacker to force a directory
      authority to use up all its RAM by passing it a maliciously
      crafted protocol versions string. Fixes bug 25517; bugfix on This issue is also tracked as TROVE-2018-005.

  o Major bugfixes (crash, backport from
    - Avoid a rare assertion failure in the circuit build timeout code
      if we fail to allow any circuits to actually complete. Fixes bug
      25733; bugfix on

  o Major bugfixes (netflow padding):
    - Stop adding unneeded channel padding right after we finish
      flushing to a connection that has been trying to flush for many
      seconds. Instead, treat all partial or complete flushes as
      activity on the channel, which will defer the time until we need
      to add padding. This fix should resolve confusing and scary log
      messages like "Channel padding timeout scheduled 221453ms in the
      past." Fixes bug 22212; bugfix on

  o Major bugfixes (networking):
    - Tor will no longer reject IPv6 address strings from Tor Browser
      when they are passed as hostnames in SOCKS5 requests. Fixes bug
      25036, bugfix on Tor

  o Major bugfixes (onion service, backport from
    - Correctly detect when onion services get disabled after HUP. Fixes
      bug 25761; bugfix on

  o Major bugfixes (performance, load balancing):
    - Directory authorities no longer vote in favor of the Guard flag
      for relays without directory support. Starting in Tor, clients have been avoiding using such relays in the
      Guard position, leading to increasingly broken load balancing for
      the 5%-or-so of Guards that don't advertise directory support.
      Fixes bug 22310; bugfix on

  o Major bugfixes (relay):
    - If we have failed to connect to a relay and received a connection
      refused, timeout, or similar error (at the TCP level), do not try
      that same address/port again for 60 seconds after the failure has
      occurred. Fixes bug 24767; bugfix on 0.0.6.

  o Major bugfixes (relay, denial of service, backport from
    - Impose a limit on circuit cell queue size. The limit can be
      controlled by a consensus parameter. Fixes bug 25226; bugfix

  o Minor features (cleanup):
    - Tor now deletes the CookieAuthFile and ExtORPortCookieAuthFile
      when it stops. Closes ticket 23271.

  o Minor features (compatibility, backport from
    - Avoid some compilation warnings with recent versions of LibreSSL.
      Closes ticket 26006.

  o Minor features (config options):
    - Change the way the default value for MaxMemInQueues is calculated.
      We now use 40% of the hardware RAM if the system has 8 GB RAM or
      more. Otherwise we use the former value of 75%. Closes
      ticket 24782.

  o Minor features (continuous integration):
    - Update the Travis CI configuration to use the stable Rust channel,
      now that we have decided to require that. Closes ticket 25714.

  o Minor features (continuous integration, backport from
    - Our .travis.yml configuration now includes support for testing the
      results of "make distcheck". (It's not uncommon for "make \ 
      to pass but "make distcheck" to fail.) Closes ticket 25814.
    - Our Travis CI configuration now integrates with the Coveralls
      coverage analysis tool. Closes ticket 25818.

  o Minor features (defensive programming):
    - Most of the functions in Tor that free objects have been replaced
      with macros that free the objects and set the corresponding
      pointers to NULL. This change should help prevent a large class of
      dangling pointer bugs. Closes ticket 24337.
    - Where possible, the tor_free() macro now only evaluates its input
      once. Part of ticket 24337.
    - Check that microdesc ed25519 ids are non-zero in
      node_get_ed25519_id() before returning them. Implements ticket
      24001, patch by "aruna1234".

  o Minor features (directory authority):
    - When directory authorities are unable to add signatures to a
      pending consensus, log the reason why. Closes ticket 24849.

  o Minor features (embedding):
    - Tor can now start with a preauthenticated control connection
      created by the process that launched it. This feature is meant for
      use by programs that want to launch and manage a Tor process
      without allowing other programs to manage it as well. For more
      information, see the __OwningControllerFD option documented in
      control-spec.txt. Closes ticket 23900.
    - On most errors that would cause Tor to exit, it now tries to
      return from the tor_main() function, rather than calling the
      system exit() function. Most users won't notice a difference here,
      but it should be significant for programs that run Tor inside a
      separate thread: they should now be able to survive Tor's exit
      conditions rather than having Tor shut down the entire process.
      Closes ticket 23848.
    - Applications that want to embed Tor can now tell Tor not to
      register any of its own POSIX signal handlers, using the
      __DisableSignalHandlers option. Closes ticket 24588.

  o Minor features (fallback directory list):
    - Avoid selecting fallbacks that change their IP addresses too
      often. Select more fallbacks by ignoring the Guard flag, and
      allowing lower cutoffs for the Running and V2Dir flags. Also allow
      a lower bandwidth, and a higher number of fallbacks per operator
      (5% of the list). Implements ticket 24785.
    - Update the fallback whitelist and blacklist based on opt-ins and
      relay changes. Closes tickets 22321, 24678, 22527, 24135,
      and 24695.

  o Minor features (fallback directory mirror configuration):
    - Add a nickname to each fallback in a C comment. This makes it
      easier for operators to find their relays, and allows stem to use
      nicknames to identify fallbacks. Implements ticket 24600.
    - Add a type and version header to the fallback directory mirror
      file. Also add a delimiter to the end of each fallback entry. This
      helps external parsers like stem and Relay Search. Implements
      ticket 24725.
    - Add an extrainfo cache flag for each fallback in a C comment. This
      allows stem to use fallbacks to fetch extra-info documents, rather
      than using authorities. Implements ticket 22759.
    - Add the generateFallbackDirLine.py script for automatically
      generating fallback directory mirror lines from relay fingerprints.
      No more typos! Add the lookupFallbackDirContact.py script for
      automatically looking up operator contact info from relay
      fingerprints. Implements ticket 24706, patch by teor and atagar.
    - Reject any fallback directory mirror that serves an expired
      consensus. Implements ticket 20942, patch by "minik".
    - Remove commas and equals signs from external string inputs to the
      fallback list. This avoids format confusion attacks. Implements
      ticket 24726.
    - Remove the "weight=10" line from fallback directory mirror
      entries. Ticket 24681 will maintain the current fallback weights
      by changing Tor's default fallback weight to 10. Implements
      ticket 24679.
    - Stop logging excessive information about fallback netblocks.
      Implements ticket 24791.

  o Minor features (forward-compatibility):
    - If a relay supports some link authentication protocol that we do
      not recognize, then include that relay's ed25519 key when telling
      other relays to extend to it. Previously, we treated future
      versions as if they were too old to support ed25519 link
      authentication. Closes ticket 20895.

  o Minor features (geoip):
    - Update geoip and geoip6 to the May 1 2018 Maxmind GeoLite2 Country
      database. Closes ticket 26104.

  o Minor features (heartbeat):
    - Add onion service information to our heartbeat logs, displaying
      stats about the activity of configured onion services. Closes
      ticket 24896.

  o Minor features (instrumentation, development):
    - Add the MainloopStats option to allow developers to get
      instrumentation information from the main event loop via the
      heartbeat messages. We hope to use this to improve Tor's behavior
      when it's trying to sleep. Closes ticket 24605.

  o Minor features (IPv6):
    - Make IPv6-only clients wait for microdescs for relays, even if we
      were previously using descriptors (or were using them as a bridge)
      and have a cached descriptor for them. Implements ticket 23827.
    - When a consensus has IPv6 ORPorts, make IPv6-only clients use
      them, rather than waiting to download microdescriptors. Implements
      ticket 23827.

  o Minor features (log messages):
    - Improve log message in the out-of-memory handler to include
      information about memory usage from the different compression
      backends. Closes ticket 25372.
    - Improve a warning message that happens when we fail to re-parse an
      old router because of an expired certificate. Closes ticket 20020.
    - Make the log more quantitative when we hit MaxMemInQueues
      threshold exposing some values. Closes ticket 24501.

  o Minor features (logging):
    - Clarify the log messages produced when getrandom() or a related
      entropy-generation mechanism gives an error. Closes ticket 25120.
    - Added support for the Android logging subsystem. Closes
      ticket 24362.

  o Minor features (performance):
    - Support predictive circuit building for onion service circuits
      with multiple layers of guards. Closes ticket 23101.
    - Use stdatomic.h where available, rather than mutexes, to implement
      atomic_counter_t. Closes ticket 23953.

  o Minor features (performance, 32-bit):
    - Improve performance on 32-bit systems by avoiding 64-bit division
      when calculating the timestamp in milliseconds for channel padding
      computations. Implements ticket 24613.
    - Improve performance on 32-bit systems by avoiding 64-bit division
      when timestamping cells and buffer chunks for OOM calculations.
      Implements ticket 24374.

  o Minor features (performance, OSX, iOS):
    - Use the mach_approximate_time() function (when available) to
      implement coarse monotonic time. Having a coarse time function
      should avoid a large number of system calls, and improve
      performance slightly, especially under load. Closes ticket 24427.

  o Minor features (performance, windows):
    - Improve performance on Windows Vista and Windows 7 by adjusting
      TCP send window size according to the recommendation from
      SIO_IDEAL_SEND_BACKLOG_QUERY. Closes ticket 22798. Patch
      from Vort.

  o Minor features (sandbox):
    - Explicitly permit the poll() system call when the Linux
      seccomp2-based sandbox is enabled: apparently, some versions of
      libc use poll() when calling getpwnam(). Closes ticket 25313.

  o Minor features (storage, configuration):
    - Users can store cached directory documents somewhere other than
      the DataDirectory by using the CacheDirectory option. Similarly,
      the storage location for relay's keys can be overridden with the
      KeyDirectory option. Closes ticket 22703.

  o Minor features (testing):
    - Add a "make test-rust" target to run the rust tests only. Closes
      ticket 25071.

  o Minor features (testing, debugging, embedding):
    - For development purposes, Tor now has a mode in which it runs for
      a few seconds, then stops, and starts again without exiting the
      process. This mode is meant to help us debug various issues with
      ticket 23847. To use this feature, compile with
      --enable-restart-debugging, and set the TOR_DEBUG_RESTART
      environment variable. This is expected to crash a lot, and is
      really meant for developers only. It will likely be removed in a
      future release. Implements ticket 24583.

  o Minor bugfixes (build, rust):
    - Fix output of autoconf checks to display success messages for Rust
      dependencies and a suitable rustc compiler version. Fixes bug
      24612; bugfix on
    - Don't pass the --quiet option to cargo: it seems to suppress some
      errors, which is not what we want to do when building. Fixes bug
      24518; bugfix on
    - Build correctly when building from outside Tor's source tree with
      the TOR_RUST_DEPENDENCIES option set. Fixes bug 22768; bugfix

  o Minor bugfixes (C correctness):
    - Fix a very unlikely (impossible, we believe) null pointer
      dereference. Fixes bug 25629; bugfix on Found by
      Coverity; this is CID 1430932.

  o Minor bugfixes (channel, client):
    - Better identify client connection when reporting to the geoip
      client cache. Fixes bug 24904; bugfix on

  o Minor bugfixes (circuit, cannibalization):
    - Don't cannibalize preemptively-built circuits if we no longer
      recognize their first hop. This situation can happen if our Guard
      relay went off the consensus after the circuit was created. Fixes
      bug 24469; bugfix on 0.0.6.

  o Minor bugfixes (client, backport from
    - Don't consider Tor running as a client if the ControlPort is open,
      but no actual client ports are open. Fixes bug 26062; bugfix

  o Minor bugfixes (compilation):
    - Fix a C99 compliance issue in our configuration script that caused
      compilation issues when compiling Tor with certain versions of
      xtools. Fixes bug 25474; bugfix on

  o Minor bugfixes (controller):
    - Restore the correct operation of the RESOLVE command, which had
      been broken since we added the ability to enable/disable DNS on
      specific listener ports. Fixes bug 25617; bugfix on
    - Avoid a (nonfatal) assertion failure when extending a one-hop
      circuit from the controller to become a multihop circuit. Fixes
      bug 24903; bugfix on

  o Minor bugfixes (correctness):
    - Remove a nonworking, unnecessary check to see whether a circuit
      hop's identity digest was set when the circuit failed. Fixes bug
      24927; bugfix on

  o Minor bugfixes (correctness, client, backport from
    - Upon receiving a malformed connected cell, stop processing the
      cell immediately. Previously we would mark the connection for
      close, but continue processing the cell as if the connection were
      open. Fixes bug 26072; bugfix on

  o Minor bugfixes (directory authorities, IPv6):
    - When creating a routerstatus (vote) from a routerinfo (descriptor),
      set the IPv6 address to the unspecified IPv6 address, and
      explicitly initialize the port to zero. Fixes bug 24488; bugfix

  o Minor bugfixes (documentation):
    - Document that the PerConnBW{Rate,Burst} options will fall back to
      their corresponding consensus parameters only if those parameters
      are set. Previously we had claimed that these values would always
      be set in the consensus. Fixes bug 25296; bugfix on

  o Minor bugfixes (documentation, backport from
    - Stop saying in the manual that clients cache ipv4 dns answers from
      exit relays. We haven't used them since, and in
      ticket 24050 we stopped even caching them as of, but
      we forgot to say so in the man page. Fixes bug 26052; bugfix

  o Minor bugfixes (exit relay DNS retries):
    - Re-attempt timed-out DNS queries 3 times before failure, since our
      timeout is 5 seconds for them, but clients wait 10-15. Also allow
      slightly more timeouts per resolver when an exit has multiple
      resolvers configured. Fixes bug 21394; bugfix on

  o Minor bugfixes (fallback directory mirrors):
    - Make updateFallbackDirs.py search harder for python. (Some OSs
      don't put it in /usr/bin.) Fixes bug 24708; bugfix

  o Minor bugfixes (hibernation, bandwidth accounting, shutdown):
    - When hibernating, close connections normally and allow them to
      flush. Fixes bug 23571; bugfix on Also fixes
      bug 7267.
    - Do not attempt to launch self-reachability tests when entering
      hibernation. Fixes a case of bug 12062; bugfix on 0.0.9pre5.
    - Resolve several bugs related to descriptor fetching on bridge
      clients with bandwidth accounting enabled. (This combination is
      not recommended!) Fixes a case of bug 12062; bugfix
    - When hibernating, do not attempt to launch DNS checks. Fixes a
      case of bug 12062; bugfix on
    - When hibernating, do not try to upload or download descriptors.
      Fixes a case of bug 12062; bugfix on 0.0.9pre5.

  o Minor bugfixes (IPv6, bridges):
    - Tor now always sets IPv6 preferences for bridges. Fixes bug 24573;
      bugfix on
    - Tor now sets IPv6 address in the routerstatus as well as in the
      router descriptors when updating addresses for a bridge. Closes
      ticket 24572; bugfix on Patch by "ffmancera".

  o Minor bugfixes (Linux seccomp2 sandbox):
    - When running with the sandbox enabled, reload configuration files
      correctly even when %include was used. Previously we would crash.
      Fixes bug 22605; bugfix on 0.3.1. Patch from Daniel Pinto.

  o Minor bugfixes (Linux seccomp2 sandbox, backport from
    - Allow the nanosleep() system call, which glibc uses to implement
      sleep() and usleep(). Fixes bug 24969; bugfix on

  o Minor bugfixes (logging):
    - Fix a (mostly harmless) race condition when invoking
      LOG_PROTOCOL_WARN message from a subthread while the torrc options
      are changing. Fixes bug 23954; bugfix on

  o Minor bugfixes (man page, SocksPort):
    - Remove dead code from the old "SocksSocket" option, and rename
      SocksSocketsGroupWritable to UnixSocksGroupWritable. The old
      option still works, but is deprecated. Fixes bug 24343; bugfix

  o Minor bugfixes (memory leaks):
    - Avoid possible at-exit memory leaks related to use of Libevent's
      event_base_once() function. (This function tends to leak memory if
      the event_base is closed before the event fires.) Fixes bug 24584;
      bugfix on
    - Fix a harmless memory leak in tor-resolve. Fixes bug 24582; bugfix

  o Minor bugfixes (network IPv6 test):
    - Tor's test scripts now check if "ping -6 ::1" works when the user
      runs "make test-network-all". Fixes bug 24677; bugfix on Patch by "ffmancera".

  o Minor bugfixes (networking):
    - string_is_valid_hostname() will not consider IP strings to be
      valid hostnames. Fixes bug 25055; bugfix on Tor

  o Minor bugfixes (onion service v3):
    - Avoid an assertion failure when the next onion service descriptor
      rotation type is out of sync with the consensus's valid-after
      time. Instead, log a warning message with extra information, so we
      can better hunt down the cause of this assertion. Fixes bug 25306;
      bugfix on

  o Minor bugfixes (onion service, backport from
    - Fix a memory leak when a v3 onion service is configured and gets a
      SIGHUP signal. Fixes bug 25901; bugfix on
    - When parsing the descriptor signature, look for the token plus an
      extra white-space at the end. This is more correct but also will
      allow us to support new fields that might start with "signature".
      Fixes bug 26069; bugfix on

  o Minor bugfixes (onion services):
    - If we are configured to offer a single onion service, don't log
      long-term established one hop rendezvous points in the heartbeat.
      Fixes bug 25116; bugfix on

  o Minor bugfixes (performance):
    - Reduce the number of circuits that will be opened at once during
      the circuit build timeout phase. This is done by increasing the
      idle timeout to 3 minutes, and lowering the maximum number of
      concurrent learning circuits to 10. Fixes bug 24769; bugfix
    - Avoid calling protocol_list_supports_protocol() from inside tight
      loops when running with cached routerinfo_t objects. Instead,
      summarize the relevant protocols as flags in the routerinfo_t, as
      we do for routerstatus_t objects. This change simplifies our code
      a little, and saves a large amount of short-term memory allocation
      operations. Fixes bug 25008; bugfix on

  o Minor bugfixes (performance, timeouts):
    - Consider circuits for timeout as soon as they complete a hop. This
      is more accurate than applying the timeout in
      circuit_expire_building() because that function is only called
      once per second, which is now too slow for typical timeouts on the
      current network. Fixes bug 23114; bugfix on
    - Use onion service circuits (and other circuits longer than 3 hops)
      to calculate a circuit build timeout. Previously, Tor only
      calculated its build timeout based on circuits that planned to be
      exactly 3 hops long. With this change, we include measurements
      from all circuits at the point where they complete their third
      hop. Fixes bug 23100; bugfix on

  o Minor bugfixes (relay, crash, backport from
    - Avoid a crash when running with DirPort set but ORPort tuned off.
      Fixes a case of bug 23693; bugfix on

  o Minor bugfixes (Rust FFI):
    - Fix a minor memory leak which would happen whenever the C code
      would call the Rust implementation of
      protover_get_supported_protocols(). This was due to the C version
      returning a static string, whereas the Rust version newly allocated
      a CString to pass accross the FFI boundary. Consequently, the C
      code was not expecting to need to free() what it was given. Fixes
      bug 25127; bugfix on

  o Minor bugfixes (spelling):
    - Use the "misspell" tool to detect and fix typos throughout the
      source code. Fixes bug 23650; bugfix on various versions of Tor.
      Patch from Deepesh Pathak.

  o Minor bugfixes (testing):
    - Avoid intermittent test failures due to a test that had relied on
      onion service introduction point creation finishing within 5
      seconds of real clock time. Fixes bug 25450; bugfix
    - Give out Exit flags in bootstrapping networks. Fixes bug 24137;
      bugfix on

  o Minor bugfixes (unit test, monotonic time):
    - Increase a constant (1msec to 10msec) in the monotonic time test
      that makes sure the nsec/usec/msec times read are synchronized.
      This change was needed to accommodate slow systems like armel or
      when the clock_gettime() is not a VDSO on the running kernel.
      Fixes bug 25113; bugfix on

  o Code simplification and refactoring:
    - Move the list of default directory authorities to its own file.
      Closes ticket 24854. Patch by "beastr0".
    - Remove the old (deterministic) directory retry logic entirely:
      We've used exponential backoff exclusively for some time. Closes
      ticket 23814.
    - Remove the unused nodelist_recompute_all_hsdir_indices(). Closes
      ticket 25108.
    - Remove a series of counters used to track circuit extend attempts
      and connection status but that in reality we aren't using for
      anything other than stats logged by a SIGUSR1 signal. Closes
      ticket 25163.
    - Remove /usr/athena from search path in configure.ac. Closes
      ticket 24363.
    - Remove duplicate code in node_has_curve25519_onion_key() and
      node_get_curve25519_onion_key(), and add a check for a zero
      microdesc curve25519 onion key. Closes ticket 23966, patch by
      "aruna1234" and teor.
    - Rewrite channel_rsa_id_group_set_badness to reduce temporary
      memory allocations with large numbers of OR connections (e.g.
      relays). Closes ticket 24119.
    - Separate the function that deletes ephemeral files when Tor
      stops gracefully.
    - Small changes to Tor's buf_t API to make it suitable for use as a
      general-purpose safe string constructor. Closes ticket 22342.
    - Switch -Wnormalized=id to -Wnormalized=nfkc in configure.ac to
      avoid source code identifier confusion. Closes ticket 24467.
    - The tor_git_revision[] constant no longer needs to be redeclared
      by everything that links against the rest of Tor. Done as part of
      ticket 23845, to simplify our external API.
    - We make extend_info_from_node() use node_get_curve25519_onion_key()
      introduced in ticket 23577 to access the curve25519 public keys
      rather than accessing it directly. Closes ticket 23760. Patch by
      Neel Chauhan.
    - Add a function to log channels' scheduler state changes to aid
      debugging efforts. Closes ticket 24531.

  o Documentation:
    - Improved the documentation of AccountingStart parameter. Closes
      ticket 23635.
    - Update the documentation for "Log" to include the current list of
      logging domains. Closes ticket 25378.
    - Add documentation on how to build tor with Rust dependencies
      without having to be online. Closes ticket 22907; bugfix
    - Clarify the behavior of RelayBandwidth{Rate,Burst} with client
      traffic. Closes ticket 24318.
    - Document that OutboundBindAddress doesn't apply to DNS requests.
      Closes ticket 22145. Patch from Aruna Maurya.

  o Code simplification and refactoring (channels):
    - Remove the incoming and outgoing channel queues. These were never
      used, but still took up a step in our fast path.
    - The majority of the channel unit tests have been rewritten and the
      code coverage has now been raised to 83.6% for channel.c. Closes
      ticket 23709.
    - Remove other dead code from the channel subsystem: All together,
      this cleanup has removed more than 1500 lines of code overall and
      adding very little except for unit test.

  o Code simplification and refactoring (circuit rendezvous):
    - Split the client-side rendezvous circuit lookup into two
      functions: one that returns only established circuits and another
      that returns all kinds of circuits. Closes ticket 23459.

  o Code simplification and refactoring (controller):
    - Make most of the variables in networkstatus_getinfo_by_purpose()
      const. Implements ticket 24489.

  o Documentation (backport from
    - Correct an IPv6 error in the documentation for ExitPolicy. Closes
      ticket 25857. Patch from "CTassisF".

  o Documentation (man page):
    - The HiddenServiceVersion torrc option accepts only one number:
      either version 2 or 3. Closes ticket 25026; bugfix

  o Documentation (manpage, denial of service):
    - Provide more detail about the denial-of-service options, by
      listing each mitigation and explaining how they relate. Closes
      ticket 25248.
   2018-03-04 08:46:06 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
tor: update to

Changes in version - 2018-03-03
  Tor is the second stable release in the 0.3.2 series. It
  backports a number of bugfixes, including important fixes for security

  It includes an important security fix for a remote crash attack
  against directory authorities, tracked as TROVE-2018-001.

  Additionally, it backports a fix for a bug whose severity we have
  upgraded: Bug 24700, which was fixed in, can be remotely
  triggered in order to crash relays with a use-after-free pattern. As
  such, we are now tracking that bug as TROVE-2018-002 and
  CVE-2018-0491, and backporting it to earlier releases.  This bug
  affected versions through, as well as version

  This release also backports our new system for improved resistance to
  denial-of-service attacks against relays.

  This release also fixes several minor bugs and annoyances from
  earlier releases.

  Relays running 0.3.2.x SHOULD upgrade to one of the versions released
  today, for the fix to TROVE-2018-002.  Directory authorities should
  also upgrade. (Relays on earlier versions might want to update too for
  the DoS mitigations.)