Tor 0.2.2.23-alpha lets relays record their bandwidth history so when
they restart they don't lose their bandwidth capacity estimate. This
release also fixes a diverse set of user-facing bugs, ranging from
relays overrunning their rate limiting to clients falsely warning about
clock skew to bridge descriptor leaks by our bridge directory authority.
o Major bugfixes:
- Stop sending a CLOCK_SKEW controller status event whenever
we fetch directory information from a relay that has a wrong clock.
Instead, only inform the controller when it's a trusted authority
that claims our clock is wrong. Bugfix on 0.1.2.6-alpha; fixes
the rest of bug 1074.
- Fix an assert in parsing router descriptors containing IPv6
addresses. This one took down the directory authorities when
somebody tried some experimental code. Bugfix on 0.2.1.3-alpha.
- Make the bridge directory authority refuse to answer directory
requests for "all" descriptors. It used to include bridge
descriptors in its answer, which was a major information leak.
Found by "piebeer". Bugfix on 0.2.0.3-alpha.
- If relays set RelayBandwidthBurst but not RelayBandwidthRate,
Tor would ignore their RelayBandwidthBurst setting,
potentially using more bandwidth than expected. Bugfix on
0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug 2470.
- Ignore and warn if the user mistakenly sets "PublishServerDescriptor
hidserv" in her torrc. The 'hidserv' argument never controlled
publication of hidden service descriptors. Bugfix on 0.2.0.1-alpha.
o Major features:
- Relays now save observed peak bandwidth throughput rates to their
state file (along with total usage, which was already saved)
so that they can determine their correct estimated bandwidth on
restart. Resolves bug 1863, where Tor relays would reset their
estimated bandwidth to 0 after restarting.
- Directory authorities now take changes in router IP address and
ORPort into account when determining router stability. Previously,
if a router changed its IP or ORPort, the authorities would not
treat it as having any downtime for the purposes of stability
calculation, whereas clients would experience downtime since the
change could take a while to propagate to them. Resolves issue 1035.
- Enable Address Space Layout Randomization (ASLR) and Data Execution
Prevention (DEP) by default on Windows to make it harder for
attackers to exploit vulnerabilities. Patch from John Brooks.
2a652dccd2