Changes in version 0.1.1.26 - 2006-12-14
o Security bugfixes:
- Stop sending the HttpProxyAuthenticator string to directory
servers when directory connections are tunnelled through Tor.
- Clients no longer store bandwidth history in the state file.
- Do not log introduction points for hidden services if SafeLogging
is set.
o Minor bugfixes:
- Fix an assert failure when a directory authority sets
AuthDirRejectUnlisted and then receives a descriptor from an
unlisted router (reported by seeess).
Changes in version 0.1.1.25 - 2006-11-04
o Major bugfixes:
- When a client asks us to resolve (rather than connect to)
an address, and we have a cached answer, give them the cached
answer. Previously, we would give them no answer at all.
- We were building exactly the wrong circuits when we predict
hidden service requirements, meaning Tor would have to build all
its circuits on demand.
- If none of our live entry guards have a high uptime, but we
require a guard with a high uptime, try adding a new guard before
we give up on the requirement. This patch should make long-lived
connections more stable on average.
- When testing reachability of our DirPort, don't launch new
tests when there's already one in progress -- unreachable
servers were stacking up dozens of testing streams.
o Security bugfixes:
- When the user sends a NEWNYM signal, clear the client-side DNS
cache too. Otherwise we continue to act on previous information.
o Minor bugfixes:
- Avoid a memory corruption bug when creating a hash table for
the first time.
- Avoid possibility of controller-triggered crash when misusing
certain commands from a v0 controller on platforms that do not
handle printf("%s",NULL) gracefully.
- Avoid infinite loop on unexpected controller input.
- Don't log spurious warnings when we see a circuit close reason we
don't recognize; it's probably just from a newer version of Tor.
- Add Vidalia to the OS X uninstaller script, so when we uninstall
Tor/Privoxy we also uninstall Vidalia.
Changes in version 0.1.1.24 - 2006-09-29
o Major bugfixes:
- Allow really slow clients to not hang up five minutes into their
directory downloads (suggested by Adam J. Richter).
- Fix major performance regression from 0.1.0.x: instead of checking
whether we have enough directory information every time we want to
do something, only check when the directory information has changed.
This should improve client CPU usage by 25-50%.
- Don't crash if, after a server has been running for a while,
it can't resolve its hostname.
- When a client asks us to resolve (not connect to) an address,
and we have a cached answer, give them the cached answer.
Previously, we would give them no answer at all.
o Minor bugfixes:
- Allow Tor to start when RunAsDaemon is set but no logs are set.
- Don't crash when the controller receives a third argument to an
"extendcircuit" request.
- Controller protocol fixes: fix encoding in "getinfo addr-mappings"
response; fix error code when "getinfo dir/status/" fails.
- Fix configure.in to not produce broken configure files with
more recent versions of autoconf. Thanks to Clint for his auto*
voodoo.
- Fix security bug on NetBSD that could allow someone to force
uninitialized RAM to be sent to a server's DNS resolver. This
only affects NetBSD and other platforms that do not bounds-check
tolower().
- Warn user when using libevent 1.1a or earlier with win32 or kqueue
methods: these are known to be buggy.
- If we're a directory mirror and we ask for "all" network status
documents, we would discard status documents from authorities
we don't recognize.
o Major bugfixes:
- Fast Tor servers, especially exit nodes, were triggering asserts
due to a bug in handling the list of pending DNS resolves. Some
bugs still remain here; we're hunting them.
- Entry guards could crash clients by sending unexpected input.
- More fixes on reachability testing: if you find yourself reachable,
then don't ever make any client requests (so you stop predicting
circuits), then hup or have your clock jump, then later your IP
changes, you won't think circuits are working, so you won't try to
test reachability, so you won't publish.
o Minor bugfixes:
- Avoid a crash if the controller does a resetconf firewallports
and then a setconf fascistfirewall=1.
- Avoid an integer underflow when the dir authority decides whether
a router is stable: we might wrongly label it stable, and compute
a slightly wrong median stability, when a descriptor is published
later than now.
- Fix a place where we might trigger an assert if we can't build our
own server descriptor yet.
Changes in version 0.1.1.22 - 2006-07-05
o Major bugfixes:
- Fix a big bug that was causing servers to not find themselves
reachable if they changed IP addresses. Since only 0.1.1.22+
servers can do reachability testing correctly, now we automatically
make sure to test via one of these.
- Fix to allow clients and mirrors to learn directory info from
descriptor downloads that get cut off partway through.
- Directory authorities had a bug in deciding if a newly published
descriptor was novel enough to make everybody want a copy -- a few
servers seem to be publishing new descriptors many times a minute.
o Minor bugfixes:
- Fix a rare bug that was causing some servers to complain about
"closing wedged cpuworkers" and skip some circuit create requests.
- Make the Exit flag in directory status documents actually work.
While here, patch sample config file to log to syslog per default to make
sure that tor starts as a daemon with the default config.
o Crash and assert fixes from 0.1.1.20:
- Fix a rare crash on Tor servers that have enabled hibernation.
- Fix a seg fault on startup for Tor networks that use only one
directory authority.
- Fix an assert from a race condition that occurs on Tor servers
while exiting, where various threads are trying to log that they're
exiting, and delete the logs, at the same time.
- Make our unit tests pass again on certain obscure platforms.
[Noncritical changes, of which there are many, are in the ChangeLog.]
- maintainer -> tv
Changes (summary):
some major security fixes, including entry guards to protect the
beginning of the circuit, exit enclaves to protect the end, and better
firewall support; a new directory protocol that improves bandwidth use
and keeps clients more up to date; two new directory authorities;
a new ascii-based controller protocol that lets people easily write
applications to interact with Tor; and
many scalability and performance improvements
Full changes available at
http://archives.seul.org/or/announce/May-2006/msg00000.html:
Changes in version 0.1.0.17 - 2006-02-17
o Crash bugfixes on 0.1.0.x:
- When servers with a non-zero DirPort came out of hibernation,
sometimes they would trigger an assert.
o Other important bugfixes:
- On platforms that don't have getrlimit (like Windows), we
were artificially constraining ourselves to a max of 1024
connections. Now just assume that we can handle
as many as 15000 connections. Hopefully this won't cause
other problems.
o Backported features:
- When we're a server, a client asks
for an old-style directory, and our write bucket is empty,
don't give it to him. This way small servers can
continue to serve the directory *sometimes*,
without getting overloaded.
- Whenever you get a 503 in response to a directory fetch, try
once more. This will become important once servers start sending
503's whenever they feel busy.
- Fetch a new directory every 120 minutes, not every 40 minutes.
Now that we have hundreds of thousands of users running the old
directory algorithm, it's starting to hurt a lot.
- Bump up the period for forcing a hidden service descriptor upload
from 20 minutes to 1 hour.
o Bugfixes on 0.1.0.x:
- Reject ports 465 and 587 (spam targets) in default exit policy.
- Don't crash when we don't have any spare file descriptors and we
try to spawn a dns or cpu worker.
- Get rid of IgnoreVersion undocumented config option, and make us
only warn, never exit, when we're running an obsolete version.
- Don't try to print a null string when your server finds itself to
be unreachable and the Address config option is empty.
- Make the numbers in read-history and write-history into uint64s,
so they don't overflow and publish negatives in the descriptor.
- Fix a minor memory leak in smartlist_string_remove().
- We were only allowing ourselves to upload a server descriptor at
most every 20 minutes, even if it changed earlier than that.
- Clean up log entries that pointed to old URLs.
Tor 0.1.0.14 fixes the second half of an important bug in the security of
our crypto handshakes. This time for sure. :) All clients should upgrade.
o Bugfixes on 0.1.0.x:
- Fix the other half of the bug with crypto handshakes.
- Fix an assert trigger if you send a 'signal term' via the
controller when it's listening for 'event info' messages.
- Fix a critical bug in the security of our crypto handshakes.
- Fix a size_t underflow in smartlist_join_strings2() that made
it do bad things when you hand it an empty smartlist.
- Fix Windows installer to ship Tor license (thanks to Aphex for
pointing out this oversight) and put a link to the doc directory
in the start menu.
- Explicitly set no-unaligned-access for sparc: it turns out the
new gcc's let you compile broken code, but that doesn't make it
not-broken
This is a major update, too many improvements to list here, see
the ChangeLog in the distribution for details.
pkgsrc changes:
-remove dependency on tsocks; this is just one possible way to
make applications use SOCKS; add a hint to MESSAGE
-use the pkgsrc libevent - the NetBSD builtin is old, and tor
complains loudly if it doesn't like the libevent version
-make the rc.d script executable
Changes:
Bugfixes on 0.0.9.x (backported from 0.1.0.10):
- Refuse relay cells that claim to have a length larger than the
maximum allowed. This prevents a potential attack that could read
arbitrary memory (e.g. keys) from an exit server's process.
Bugfixes on 0.0.9.x:
- If unofficial Tor clients connect and send weird TLS certs, our
Tor server triggers an assert. This release contains a minimal
backport from the broader fix that we put into 0.1.0.4-rc.
Approved by <jlam>
- Fix another race crash bug (thanks to Glenn Fink for reporting).
- Compare identity to identity, not to nickname, when extending to
a router not already in the directory. This was preventing us from
extending to unknown routers. Oops.
- Make sure to create OS X Tor user in <500 range, so we aren't
creating actual system users.
- Note where connection-that-hasn't-sent-end was marked, and fix
a few really loud instances of this harmless bug (it's fixed more
in 0.1.0.x).
- We have a bug that I haven't found yet. Sometimes, very rarely,
cpuworkers get stuck in the 'busy' state, even though the cpuworker
thinks of itself as idle. This meant that no new circuits ever got
established. Here's a workaround to kill any cpuworker that's been
busy for more than 100 seconds.
- Add new end stream reasons to maintainance branch. Fix bug where
reason (8) could trigger an assert. Prevent bug from recurring.
- Apparently win32 stat wants paths to not end with a slash.
- Fix assert triggers in assert_cpath_layer_ok(), where we were
blowing away the circuit that conn->cpath_layer points to, then
checking to see if the circ is well-formed. Backport check to make
sure we dont use the cpath on a closed connection.
- Prevent circuit_resume_edge_reading_helper() from trying to package
inbufs for marked-for-close streams.
- Don't crash on hup if your options->address has become unresolvable.
- Some systems (like OS X) sometimes accept() a connection and tell
you the remote host is 0.0.0.0:0. If this happens, due to some
other mis-features, we get confused; so refuse the conn for now.
- Fix harmless but scary "Unrecognized content encoding" warn message.
- Add new stream error reason: TORPROTOCOL reason means "you are not
speaking a version of Tor I understand; say bye-bye to your stream."
- Be willing to cache directories from up to ROUTER_MAX_AGE seconds
into the future, now that we are more tolerant of skew. This
resolves a bug where a Tor server would refuse to cache a directory
because all the directories it gets are too far in the future;
yet the Tor server never logs any complaints about clock skew.
- Fix an assert race at exit nodes when resolve requests fail.
- Stop picking unverified dir mirrors--it only leads to misery.
- Patch from Dmitry Bely so Tor runs better as a service under
the win32 SYSTEM account. Service support is still not compiled
into the executable by default.
- Make tor-resolve actually work (?) on Win32.
- Fix a sign bug when getrlimit claims to have 4+ billion
file descriptors available.
- Stop refusing to start when bandwidthburst == bandwidthrate.
- When create cells have been on the onion queue more than five
seconds, just send back a destroy and take them off the list.
pkgsrc changes:
- depend on tsocks to allow torification of other applications
- create a user for this application to run as
- install a suitable rc script
ChangeLog says:
o Bugfixes on 0.0.9:
- Fix an assert bug that took down most of our servers: when
a server claims to have 500 GB of bandwidthburst, don't
freak out.
- Don't crash as badly if we have spawned the max allowed number
of dnsworkers, or we're out of file descriptors.
- Block more file-sharing ports in the default exit policy.
- MaxConn is now automatically set to the hard limit of max
file descriptors we're allowed (ulimit -n), minus a few for
logs, etc.
- Give a clearer message when servers need to raise their
ulimit -n when they start running out of file descriptors.
- SGI Compatibility patches from Jan Schaumann.
- Tolerate a corrupt cached directory better.
- When a dirserver hasn't approved your server, list which one.
- Go into soft hibernation after 95% of the bandwidth is used,
not 99%. This is especially important for daily hibernators who
have a small accounting max. Hopefully it will result in fewer
cut connections when the hard hibernation starts.
- Load-balance better when using servers that claim more than
800kB/s of capacity.
- Make NT services work (experimental, only used if compiled in).
Pkgsrc changes:
- make this build under IRIX.
- tor has moved to tor.eff.org
Version changes since 0.0.9.2:
- Backport the cpu use fixes from main branch, so busy servers won't
need as much processor time.
- Work better when we go offline and then come back, or when we
run Tor at boot before the network is up. We do this by
optimistically trying to fetch a new directory whenever an
application request comes in and we think we're offline -- the
human is hopefully a good measure of when the network is back.
- Backport some minimal hidserv bugfixes: keep rend circuits open as
long as you keep using them; actually publish hidserv descriptors
shortly after they change, rather than waiting 20-40 minutes.
- Enable Mac startup script by default.
- Fix duplicate dns_cancel_pending_resolve reported by Giorgos Pallas.
- When you update AllowUnverifiedNodes or FirewallPorts via the
controller's setconf feature, we were always appending, never
resetting.
- When you update HiddenServiceDir via setconf, it was screwing up
the order of reading the lines, making it fail.
- Do not rewrite a cached directory back to the cache; otherwise we
will think it is recent and not fetch a newer one on startup.
- Workaround for webservers that lie about Content-Encoding: Tor
now tries to autodetect compressed directories and compression
itself. This lets us Proxypass dir fetches through apache.
Changes in version 0.0.8.1 - 2004-10-14
o Bugfixes:
- Fix a seg fault that can be triggered remotely for Tor
clients/servers with an open dirport.
- Fix a rare assert trigger, where routerinfos for entries in
our cpath would expire while we're building the path.
- Fix a bug in OutboundBindAddress so it (hopefully) works.
- Fix a rare seg fault for people running hidden services on
intermittent connections.
- Fix a bug in parsing opt keywords with objects.
- Fix a stale pointer assert bug when a stream detaches and
reattaches.
- Fix a string format vulnerability (probably not exploitable)
in reporting stats locally.
- Fix an assert trigger: sometimes launching circuits can fail
immediately, e.g. because too many circuits have failed recently.
- Fix a compile warning on 64 bit platforms.
Changes in version 0.0.8 - 2004-08-25
o Bugfixes:
- Made our unit tests compile again on OpenBSD 3.5, and tor
itself compile again on OpenBSD on a sparc64.
- We were neglecting milliseconds when logging on win32, so
everything appeared to happen at the beginning of each second.
- Check directory signature _before_ you decide whether you're
you're running an obsolete version and should exit.
- Check directory signature _before_ you parse the running-routers
list to decide who's running.
- Check return value of fclose while writing to disk, so we don't
end up with broken files when servers run out of disk space.
- Port it to SunOS 5.9 / Athena
- Fix two bugs in saving onion keys to disk when rotating, so
hopefully we'll get fewer people using old onion keys.
- Remove our mostly unused -- and broken -- hex_encode()
function. Use base16_encode() instead. (Thanks to Timo Lindfors
for pointing out this bug.)
- Only pick and establish intro points after we've gotten a
directory.
- Fix assert triggers: if the other side returns an address 0.0.0.0,
don't put it into the client dns cache.
- If a begin failed due to exit policy, but we believe the IP
address should have been allowed, switch that router to exitpolicy
reject *:* until we get our next directory.
o Protocol changes:
- 'Extend' relay cell payloads now include the digest of the
intended next hop's identity key. Now we can verify that we're
extending to the right router, and also extend to routers we
hadn't heard of before.
o Features:
- Tor nodes can now act as relays (with an advertised ORPort)
without being manually verified by the dirserver operators.
- Uploaded descriptors of unverified routers are now accepted
by the dirservers, and included in the directory.
- Verified routers are listed by nickname in the running-routers
list; unverified routers are listed as "$<fingerprint>".
- We now use hash-of-identity-key in most places rather than
nickname or addr:port, for improved security/flexibility.
- AllowUnverifiedNodes config option to let circuits choose no-name
routers in entry,middle,exit,introduction,rendezvous positions.
Allow middle and rendezvous positions by default.
- When picking unverified routers, skip those with low uptime and/or
low bandwidth, depending on what properties you care about.
- ClientOnly option for nodes that never want to become servers.
- Directory caching.
- "AuthoritativeDir 1" option for the official dirservers.
- Now other nodes (clients and servers) will cache the latest
directory they've pulled down.
- They can enable their DirPort to serve it to others.
- Clients will pull down a directory from any node with an open
DirPort, and check the signature/timestamp correctly.
- Authoritative dirservers now fetch directories from other
authdirservers, to stay better synced.
- Running-routers list tells who's down also, along with noting
if they're verified (listed by nickname) or unverified (listed
by hash-of-key).
- Allow dirservers to serve running-router list separately.
This isn't used yet.
- You can now fetch $DIRURL/running-routers to get just the
running-routers line, not the whole descriptor list. (But
clients don't use this yet.)
- Clients choose nodes proportional to advertised bandwidth.
- Clients avoid using nodes with low uptime as introduction points.
- Handle servers with dynamic IP addresses: don't just replace
options->Address with the resolved one at startup, and
detect our address right before we make a routerinfo each time.
- 'FascistFirewall' option to pick dirservers and ORs on specific
ports; plus 'FirewallPorts' config option to tell FascistFirewall
which ports are open. (Defaults to 80,443)
- Try other dirservers immediately if the one you try is down. This
should tolerate down dirservers better now.
- ORs connect-on-demand to other ORs
- If you get an extend cell to an OR you're not connected to,
connect, handshake, and forward the create cell.
- The authoritative dirservers stay connected to everybody,
and everybody stays connected to 0.0.7 servers, but otherwise
clients/servers expire unused connections after 5 minutes.
- When servers get a sigint, they delay 30 seconds (refusing new
connections) then exit. A second sigint causes immediate exit.
- File and name management:
- Look for .torrc if no CONFDIR "torrc" is found.
- If no datadir is defined, then choose, make, and secure ~/.tor
as datadir.
- If torrc not found, exitpolicy reject *:*.
- Expands ~/ in filenames to $HOME/ (but doesn't yet expand ~arma).
- If no nickname is defined, derive default from hostname.
- Rename secret key files, e.g. identity.key -> secret_id_key,
to discourage people from mailing their identity key to tor-ops.
- Refuse to build a circuit before the directory has arrived --
it won't work anyway, since you won't know the right onion keys
to use.
- Parse tor version numbers so we can do an is-newer-than check
rather than an is-in-the-list check.
- New socks command 'resolve', to let us shim gethostbyname()
locally.
- A 'tor_resolve' script to access the socks resolve functionality.
- A new socks-extensions.txt doc file to describe our
interpretation and extensions to the socks protocols.
- Add a ContactInfo option, which gets published in descriptor.
- Write tor version at the top of each log file
- New docs in the tarball:
- tor-doc.html.
- Document that you should proxy your SSL traffic too.
- Log a warning if the user uses an unsafe socks variant, so people
are more likely to learn about privoxy or socat.
- Log a warning if you're running an unverified server, to let you
know you might want to get it verified.
- Change the default exit policy to reject the default edonkey,
kazaa, gnutella ports.
- Add replace_file() to util.[ch] to handle win32's rename().
- Publish OR uptime in descriptor (and thus in directory) too.
- Remember used bandwidth (both in and out), and publish 15-minute
snapshots for the past day into our descriptor.
- Be more aggressive about trying to make circuits when the network
has changed (e.g. when you unsuspend your laptop).
- Check for time skew on http headers; report date in response to
"GET /".
- If the entrynode config line has only one node, don't pick it as
an exitnode.
- Add strict{entry|exit}nodes config options. If set to 1, then
we refuse to build circuits that don't include the specified entry
or exit nodes.
- OutboundBindAddress config option, to bind to a specific
IP address for outgoing connect()s.
- End truncated log entries (e.g. directories) with "[truncated]".
The simple version: Tor provides a distributed network of servers ("onion
routers"). Users bounce their TCP streams (web traffic, FTP, SSH, etc.) around
the routers. This makes it hard for recipients, observers, and even the onion
routers themselves to track the source of the stream.
The complex version: Onion Routing is a connection-oriented anonymizing
communication service. Users choose a source-routed path through a set of
nodes, and negotiate a "virtual circuit" through the network, in which each
node knows its predecessor and successor, but no others. Traffic flowing down
the circuit is unwrapped by a symmetric key at each node, which reveals the
downstream node.
