Changes in version 0.2.1.20 - 2009-10-15
o Major bugfixes:
- Send circuit or stream sendme cells when our window has decreased
by 100 cells, not when it has decreased by 101 cells. Bug uncovered
by Karsten when testing the "reduce circuit window" performance
patch. Bugfix on the 54th commit on Tor -- from July 2002,
before the release of Tor 0.0.0. This is the new winner of the
oldest-bug prize.
- Fix a remotely triggerable memory leak when a consensus document
contains more than one signature from the same voter. Bugfix on
0.2.0.3-alpha.
- Avoid segfault in rare cases when finishing an introduction circuit
as a client and finding out that we don't have an introduction key
for it. Fixes bug 1073.
o Major features:
- Tor now reads the "circwindow" parameter out of the consensus,
and uses that value for its circuit package window rather than the
default of 1000 cells. Begins the implementation of proposal 168.
o New directory authorities:
- Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
authority.
- Move moria1 and tonga to alternate IP addresses.
o Minor bugfixes:
- Fix a signed/unsigned compile warning in 0.2.1.19.
- Fix possible segmentation fault on directory authorities. Bugfix on
0.2.1.14-rc.
- Fix an extremely rare infinite recursion bug that could occur if
we tried to log a message after shutting down the log subsystem.
Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
- Fix an obscure bug where hidden services on 64-bit big-endian
systems might mis-read the timestamp in v3 introduce cells, and
refuse to connect back to the client. Bugfix on 0.2.1.6-alpha.
- We were triggering a CLOCK_SKEW controller status event whenever
we connect via the v2 connection protocol to any relay that has
a wrong clock. Instead, we should only inform the controller when
it's a trusted authority that claims our clock is wrong. Bugfix
on 0.2.0.20-rc; starts to fix bug 1074.
- We were telling the controller about CHECKING_REACHABILITY and
REACHABILITY_FAILED status events whenever we launch a testing
circuit or notice that one has failed. Instead, only tell the
controller when we want to inform the user of overall success or
overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075.
- Don't warn when we're using a circuit that ends with a node
excluded in ExcludeExitNodes, but the circuit is not used to access
the outside world. This should help fix bug 1090. Bugfix on
0.2.1.6-alpha.
- Work around a small memory leak in some versions of OpenSSL that
stopped the memory used by the hostname TLS extension from being
freed.
o Minor features:
- Add a "getinfo status/accepted-server-descriptor" controller
command, which is the recommended way for controllers to learn
whether our server descriptor has been successfully received by at
least on directory authority. Un-recommend good-server-descriptor
getinfo and status events until we have a better design for them.
- Pull in upstream's 59eb52b7c6ccbe83742e5eb8b40b5e32bb6600cc, which
prevents windows from jumping to the current workspace when a
net_active_window message is received.
- Change an entry in the default menu file to use the Exit action instead
of SessionLogout, so as to not violate the POLA.
* Upgraded to Unicode 5.2.0
- Maildir: Fixed crash when using a lot of keywords.
- file_set_size() was broken with OSes that didn't support posix_fallocate()
(almost everyone except Linux), causing all kinds of index file errors.
pkgsrc changes:
- Adding license definition
- Adjusting dependencies according to META.yml
Upstream changes:
1.03 5 Nov 2009 Changed min version of HTML::StripScripts to 1.0.5
pkgsrc changes:
- Adding license definition
Upstream changes:
1.05 5 Nov 2009 Fixed bug where 'false' but valid content was being ignored,
eg "<i>0</i>" became "<i></i>"
See bug https://rt.cpan.org/Public/Bug/Display.html?id=51116
Thanks to Jim Laney for reporting it
Changes from 2.50 include:
* TFTP supports Windows/Dos \ separator.
* Warn if IP duplicated in /etc/ethers
* Test upstream responsiveness to work around upstream server slowdowns
* PXE and relay agent fixes
- autoconfig glue to detect presence of termios.h etc.
- On NetBSD default to getpass. Otherwise implement the password reading
using termios.h if present, falling back to getpassphrase/getpass or
plain fgets.
Changes:
Added 3 new features:
1) Fetch only
2) Keep going after error (skip package)
3) Log output of make steps
Modified verbosity to report what's failed and what succeeds.
* Optimizer enhancement: prepared statements are automatically re-compiled when
a binding on the RHS of a LIKE operator changes or when any range constraint
changes under SQLITE_ENABLE_STAT2.
* Various minor bug fixes and documentation enhancements.
* New translations: be, en_GB, it, ja, pt, sq, zh_CN
* Updated translations: da, sv, vi
* Now using a binary search to make searching through the tag table faster
* Fixed a heap buffer overflow during tag format conversion
- 2.8.5
* Fix for trackback DOS
* Removal of permalink_structure eval
* Remove some create_function() calls
* Disallow unfiltered uploads by default, even for admins. Enable it again with define('ALLOW_UNFILTERED_UPLOADS', true); in wp-config.php
* Add extra escapes here and there for some backside coverage
* Retire two old importers
* A few small bug fixes
- 2.8.6
* Fixed an XSS vulnerability in Press This
* Fixed issue with sanitizing uploaded file names that can be exploited in certain Apache configurations
a tun device and subnet topology, OpenVPN insisted on setting a broadcast
address on the tun device, causing a fatal error. This patch fixes that,
and has been submitted upstream
Upstream changes:
3.31 - Sun Nov 1 15:15:00 2009
- Do not pack a Build.PL to avoid a circular dependency involving
ExtUtils::CBuilder (PathTools RT #50749)
