build:
- Add support for Intel's VTune JIT profiling when compiled with
--enable-vtune-profiling.
- Properly enable V8 snapshots by default. Due to a configuration
error, snapshots have been kept off by default when the intention
is for the feature to be enabled.
crypto:
- Simplify use of ECDH (Elliptic Curve Diffie-Hellman) objects
(created via crypto.createECDH(curve_name)) with private keys
that are not dynamically generated via generateKeys(). The
public key is now computed when explicitly setting a private
key. Added validity checks to reduce the possibility of
computing weak or invalid shared secrets. Also, deprecated
the setPublicKey() method for ECDH objects as its usage is
unnecessary and can lead to inconsistent state.
- Update root certificates from the current list stored
maintained by Mozilla NSS.
- Multiple CA certificates can now be passed with the ca option
to TLS methods as an array of strings or in a single new-line
separated string.
tools:
- Include a tick processor in core, exposed via the
--prof-process command-line argument which can be used to
process V8 profiling output files generated when using the
--prof command-line argument.
Changes:
- Fix bokken startup script.
- Add runtime dependency on py-Pillow
It would be probably better to link bin/bokken share/bokken/bokken.py
The intermediate script tries to detect (wrongly in pkgsrc) the Python
executable and it needs adapting anyway.
2015.12.05 - GNU nano 2.5.0 "Karma", the first release of the 2.5 series,
is now available. Please note that as of this release,
there will no longer be separate stable and unstable
branches. The development team will prioritize bug fixes
as needed, and make new releases in proportion to the
severity of the bugs which are fixed.
This release includes all of the fixes now in
2.4.3, as well as color syntax highlighting improvements,
undo fixes, and many more improvements! Thank you for
using nano!
Changes:
release 2015.07.2
Bonus release! This release contains fixes for CMake configuration bugs that
affected installation of 2015.07.1 on some platforms.
release 2015.07.1
To upgrade to this release, you must update libhackrf and hackrf-tools on your
host computer. You must also update firmware on your HackRF. It is important
to update both the host code and firmware for this release to work properly.
If you only update one or the other, you may experience unpredictable
behaviour.
Major changes in this release include:
Multiple HackRF support. Users with more than one HackRF can target a
specific device from software using the device serial number. The serial
number is easy to find with hackrf_info. Thanks, Hessu!
Linux kernel module detaching. A work-around to avoid the unofficial HackRF
kernel module in recent kernel versions that has been causing problems for
many users.
Updating the CPLD is now possible from Windows. There is no CPLD update with
this release, but Windows users should now be able to update.
Support for rad1o hardware, the badge of CCCamp 2015 based on HackRF One.
This package contains host software supporting rad1o; for firmware and other
resources, refer to: https://rad1o.badge.events.ccc.de/
There have been many more enhancements and bug fixes, for a full list of
changes, see the git log.
Automake improvements
Misc documentation fixes
Misc updates to startup scripts
lru_crawler enable blocks until ready (test failure)
Record and report on time spent in listen_disabled (time_in_listen_disabled_us)
Update manpage for -I command. Make it more clear
Fix display of settings.hot_lru_pct in stats settings
No longer edits the output of ps while processing arguments
No longer crashes when failing to give arguments to some start args
Fix memcached unable to bind to an ipv6 address
No longer attempts bind to same interface more than once
fixed libevent version check: add the missing 1.0.x version check
fix off-by-one in LRU crawler, causing rare segfault
remove another invalid assert(), fixes clang and pedantic compilation
Patch based largely on a pull request by bahamat@:
https://github.com/joyent/pkgsrc/pull/307
3.7.2:
Bug fixes:
- readfile() and read*list() should print an error if they fail to read file.
(Redmine #7702)
- Fix 'AIX_PREINSTALL_ALREADY_DONE.txt: cannot create' error
message on AIX.
- If there is an error saving a mustache template file
it is now logged with log-level error (was inform).
- Change: Clarify bootstrap/failsafe reports
- Fixed several bugs which prevented CFEngine from loading
libraries from the correct location. This affected several platforms.
(Redmine #6708)
- If file_select.file_types is set to symlink and there
are regular files in the scanned directory, CFEngine no longer
produces an unneccessary error message. (Redmine #6996)
- Fix: Solaris packages no longer contain duplicate library
files, but instead symlinks to them. (Redmine #7591)
- cf-agent, cf-execd, cf-promises, cf-runagent and cf-serverd honor
multiple -D, -N and -s arguments (Redmine #7191)
- Fix "@endif" keyword sometimes being improperly processed
by policy parser. (Redmine #7413)
- It is possible to edit the same value in multiple regions
of one file. (Redmine #7460)
- Fix select_class not setting class when used in common bundle with slist.
(Redmine #7482)
- Fix broken HA policy for 3rd disaster-recovery node.
- Directories should no more be changed randomly
into files. (Redmine #6027)
- Include latest security updates for 3.7.
- Reduce malloc() thread contention on heavily loaded
cf-serverd, by not exiting early in the logging function, if no message
is to be printed. (Redmine #7624)
- Improve cf-serverd's lock contention because of getpwnam()
call. (Redmine #7643)
- action_policy "warn" now correctly produces warnings instead
of various other verbosity levels. (Redmine #7274)
- Change: Improve efficiency and debug reports (Redmine #7527)
- Change package modules permissions on hub package so that
hub can execute package promises. (Redmine #7602)
- No longer hang when changing permissions/ownership on fifos
(Redmine #7030)
- Fix exporting CSV reports through HTTPS. (Redmine #7267)
- failsafe.cf will be created when needed. (Redmine #7634)
- Mustache templates: Fix key when value is not a
primitive. The old behavior, when iterating across a map or array of
maps, was to abort if the key was requested with . The new
behavior is to always replace with either the key name or the
iteration position in the array. An error is printed if is used
outside of a Mustache iteration section.
- Legacy package promise: Result classes are now defined if
the package being promised is already up to date. (Redmine #7399)
- TTY detection should be more reliable. (Redmine #7606)
Masterfiles:
- Add: Path to svcprop in stdlib
- Add: New `results` classes body [] (Redmine #7418, #7481)
- Remove: Support for email settings from augments_file (Redmine #7682)
3.7.1:
Bug fixes:
- Fix daemons not restarting correctly on upgrade on AIX. (Redmine #7550)
- Fix upgrade causing error message under systemd because of open ports.
- Fix build with musl libc. (Redmine #7455)
- Long promiser strings with multiple lines are now
abbreviated in logs. (Redmine #3964)
- Fixed a bug which could cause daemons to not to be killed
correctly when upgrading or manually running "service cfengine3 stop".
(Redmine #7193)
- Package promise: Fix inability to install certain packages
with numbers.
- Fix package promise not removing dependant packages. (Redmine #7424)
- Fix warning "Failed to parse csv file entry" with certain very long
commands promises. (Redmine #7400)
- Fix misaligned help output in cf-hub. (Redmine #7273)
- Augmenting inputs from the augments_file (Redmine #7420)
- Add support for failover to 3rd HA node located outside cluster.
- Upgrade all dependencies for patch release.
- Fix a bug which caused daemons not to be restarted on
upgrade. (Redmine #7528)
3.7.0:
New features:
- New package promise implementation.
- Full systemd support for all relevant platforms
- New classes to determine whether certain features are enabled:
* feature_yaml
* feature_xml
For the official CFEngine packages, these are always enabled, but
packages from other sources may be built without the support.
- New readdata() support for generic data input (CSV, YAML, JSON, or auto)
- YAML support: new readyaml() function and in readdata()
- CSV support: new readcsv() function and in readdata()
- New string_mustache() function
- New data_regextract() function
- eval() can now be called with "class" as the "mode" argument, which
will cause it to return true ("any") if the calculated result is
non-zero, and false ("!any") if it is zero.
- New list_ifelse() function
- New mapjson() function as well as JSON support in maparray().
- filestat() function now supports "xattr" argument for extended
attributes.
- "ifvarclass" now has "if" as an alias, and "unless" as an inverse
alias.
- Ability to expand JSON variables directory in Mustache templates:
Prefix the name with '%' for multiline expansion, '$' for compact
expansion.
- Ability to expand the iteration *key* in Mustache templates with @
- Canonical JSON output: JSON output has reliably sorted keys so the
same data structure will produce the same JSON every time.
- New "@if minimum_version(x.x)" syntax in order to hide future language
improvements from versions that don't understand them.
- compile time option (--with-statedir) to
override the default state/ directory path.
- Fix error messages/ handling in process signalling which no longer
allowed any signals to fail silently
- Also enable shortcut keyword for cf-serverd classic protocol, eg to
simplify the bootstrap process for clients that have different
sys.masterdir settings (Redmine #3697)
- methods promises now accepts the bundle name in the promiser string,
as long as it doesn't have any parameters.
- In a services promise, if the service_method bundle is not specified,
it defaults to the promiser string (canonified) with "service_" as a
prefix. The bundle must be in the same namespace as the promise.
- inline JSON in policy files: surrounding with parsejson() is now
optional *when creating a new data container*.
- New data_expand() function to interpolate variables in a data container.
- Add configurable network bandwidth limit for all outgoing
connections ("bwlimit" attribute in "body common control") . To
enforce it in both directions, make sure the attribute is set on both
sides of the connection.
- Secure bootstrap has been facilitated by use of
"cf-agent --boostrap HUB_ADDRESS --trust-server=no"
- Implement new TLS-relevant options (Redmine #6883):
- body common control: tls_min_version
- body server control: allowtlsversion
- body common control: tls_ciphers
- body server control: allowciphers (preexisting)
Changes:
- Improved output format, less verbose, and messages are grouped.
- cf-execd: agent_expireafter default was changed to 120 minutes
(Redmine #7113)
- All embedded databases are now rooted in the state/ directory.
- TLS used as default for all outgoing connections.
- process promise now reports kept status instead of repaired if a
signal is not sent, even if the restart_class is set. The old
behavior was to set the repaired status whenever the process was not
running. (Redmine#7216).
- Bootstrapping requires keys to be generated in advance using cf-key.
- Disable class set on reverse lookup of interfaces IP addresses.
(Redmine #3993, Redmine #6870)
- Define a hard class with just the OS major version on FreeBSD.
- Abort cf-agent if OpenSSL's random number generator can't
be seeded securely.
- Masterfiles source tarball now installs using the usual commands
"./configure; make install".
- Updated Emacs syntax highlighting template to support the latest
syntax enhancements in 3.7.
Deprecations:
- Arbitrary arguments to cfruncommand (using "cf-runagent -o") are
not acceptable any more. (Redmine #6978)
- 3.4 is no longer supported in masterfiles.
Bug fixes:
- Fix server common bundles evaluation order (Redmine#7211).
- Limit LMDB disk usage by preserving sparse areas in LMDB files
(Redmine#7242).
- Fixed LMDB corruption on HP-UX 11.23. (Redmine #6994)
- Fixed insert_lines failing to converge if preserve_block was used.
(Redmine #7094)
- Fixed init script failing to stop/restart daemons on openvz/lxc
hosts. (Redmine #3394)
- rm_rf_depth now deletes base directory as advertised. (Redmine #7009)
- Refactored cf-agent's connection cache to properly differentiate
hosts using all needed attributes like host and port.
(Redmine #4646)
- Refactored lastseen database handling to avoid inconsistencies.
(Redmine #6660)
- cf-key --trust-key now supports new syntax to also update the
lastseen database, so that clients using old protocol will trust
the server correctly.
- Fixed a bug which sometimes caused an agent or daemon to kill or stop
itself. (Redmine #7075, #7244)
- Fixed a bug which made it difficult to kill CFEngine daemons,
particularly cf-execd. (Redmine #6659, #7193)
- Fixed a bug causing systemd not to be detected correctly on Debian.
(Redmine #7297)
- "cf-promises -T" will now correctly report the checked out commit,
even if you haven't checked out a Git branch. (Redmine #7332)
- Reduce verbosity of harmless errors related to socket timeouts and
missing thermal zone files. (Redmine #6486 and #7238)
- Fix process_result logic to match the purpose of body process_select
days_older_than (Redmine #3009)
Masterfiles:
Added:
- Support for user specified overring of framework defaults without
modifying policy supplied by the framework itself (see
example_def.json)
- Support for def.json class augmentation in update policy
- Run vacuum operation on postgresql every night as a part of
maintenance.
- Add measure_promise_time action body to lib (3.5, 3.6, 3.7, 3.8)
- New negative class guard `cfengine_internal_disable_agent_email` so
that agent email can be easily disabled by augmenting def.json
Changed:
- Relocate def.cf to controls/VER/
- Relocate update_def to controls/VER
- Relocate all controls to controls/VER
- Only load cf_hub and reports.cf on CFEngine Enterprise installs
- Relocate acls related to report collection from bundle server
access_rules to controls/VER/reports.cf into bundle server
report_access_rules
- Re-organize cfe_internal splitting core from enterprise specific
policies and loading the appropriate inputs only when necessary
- Moved update directory into cfe_internal as it is not generally
intended to be modified
- services/autorun.cf moved to lib/VER/ as it is not generally intended
to be modified
- To improve predictibility autorun bundles are activated in
lexicographical order
- Relocate services/file_change.cf to cfe_internal/enterprise. This
policy is most useful for a good OOTB experience with CFEngine
Enterprise Mission Portal.
- Relocate service_catalogue from promsies.cf to services/main.cf. It is
intended to be a user entry. This name change correlates with the main
bundle being activated by default if there is no bundlesequence
specified.
- Reduce benchmarks sample history to 1 day.
- Update policy no longer generates a keypair if one is not found.
(Redmine: #7167)
- Relocate cfe_internal_postgresql_maintenance bundle to lib/VER/
- Set postgresql_monitoring_maintenance only for versions 3.6.0 and
3.6.1
- Move hub specific bundles from lib/VER/cfe_internal.cf into
lib/VER/cfe_internal_hub.cf and load them only if policy_server policy
if set.
- Re-organize lib/VER/stdlib.cf from lists into classic array for use
with getvalues
Removed:
- Diff reporting on /etc/shadow (Enterprise)
- Update policy from promise.cf inputs. There is no reason to include
the update policy into promsies.cf, update.cf is the entry for the
update policy
- _not_repaired outcome from classes_generic and scoped_classes generic
(Redmine: # 7022)
Fixes:
- standard_services now restarts the service if it was not already
running when using service_policy => restart with chkconfig (Redmine
#7258)
bootstrap-mk-files). OpenSSL specifically checks for CC=gcc before using it as
a makedepend replacement, whereas CC=cc will fall back to requiring a real
'makedepend' which may not be installed. Tested on Linux by kamil@
-----------------
2015-11-15 3.2.7
-----------------
* Issue #6973: When we know a subprocess.Popen process has died, do
not allow the send_signal(), terminate(), or kill() methods to do
anything as they could potentially signal a different process.
* Issue #23564: Fixed a partially broken sanity check in the _posixsubprocess
internals regarding how fds_to_pass were passed to the child. The bug had
no actual impact as subprocess32.py already avoided it.
-----------------
2015-11-14 3.2.7rc2
-----------------
* Moved the repository from code.google.com to github.
* Added a _WAIT_TIMEOUT to satisfy the unsupported people entirely on
their own trying to use this on Windows.
* Similarly: Updated setup.py to not build the extension on non-posix.
-----------------
2014-06-01 3.2.7rc1
-----------------
* Issue #21618: The subprocess module could fail to close open fds that were
inherited by the calling process and already higher than POSIX resource
limits would otherwise allow. On systems with a functioning /proc/self/fd
or /dev/fd interface the max is now ignored and all fds are closed.
- Add primary audio stream to bd_select_stream().
- Improve error resilience.
- Fix Java 8 compability issues.
- Fix Android build.
- Fix SecurityException in AWTAutoShutdown.
- Fix BD-J check when install path in Windows contains non-ASCII chars.
- Fix jvm.dll loading in Windows ($JAVA_HOME/bin should be in dll load path).
- Fix class translating in recent Java 8 versions.
Changes in version 0.2.7.5 - 2015-11-20
The Tor 0.2.7 release series is dedicated to the memory of Tor user
and privacy advocate Caspar Bowden (1961-2015). Caspar worked
tirelessly to advocate human rights regardless of national borders,
and oppose the encroachments of mass surveillance. He opposed national
exceptionalism, he brought clarity to legal and policy debates, he
understood and predicted the impact of mass surveillance on the world,
and he laid the groundwork for resisting it. While serving on the Tor
Project's board of directors, he brought us his uncompromising focus
on technical excellence in the service of humankind. Caspar was an
inimitable force for good and a wonderful friend. He was kind,
humorous, generous, gallant, and believed we should protect one
another without exception. We honor him here for his ideals, his
efforts, and his accomplishments. Please honor his memory with works
that would make him proud.
Tor 0.2.7.5 is the first stable release in the Tor 0.2.7 series.
The 0.2.7 series adds a more secure identity key type for relays,
improves cryptography performance, resolves several longstanding
hidden-service performance issues, improves controller support for
hidden services, and includes small bugfixes and performance
improvements throughout the program. This release series also includes
more tests than before, and significant simplifications to which parts
of Tor invoke which others.
(This release contains no code changes since 0.2.7.4-rc.)
Changes in version 0.2.7.4-rc - 2015-10-21
Tor 0.2.7.4-rc is the second release candidate in the 0.2.7 series. It
fixes some important memory leaks, and a scary-looking (but mostly
harmless in practice) invalid-read bug. It also has a few small
bugfixes, notably fixes for compilation and portability on different
platforms. If no further significant bounds are found, the next
release will the the official stable release.
o Major bugfixes (security, correctness):
- Fix an error that could cause us to read 4 bytes before the
beginning of an openssl string. This bug could be used to cause
Tor to crash on systems with unusual malloc implementations, or
systems with unusual hardening installed. Fixes bug 17404; bugfix
on 0.2.3.6-alpha.
o Major bugfixes (correctness):
- Fix a use-after-free bug in validate_intro_point_failure(). Fixes
bug 17401; bugfix on 0.2.7.3-rc.
o Major bugfixes (memory leaks):
- Fix a memory leak in ed25519 batch signature checking. Fixes bug
17398; bugfix on 0.2.6.1-alpha.
- Fix a memory leak in rend_cache_failure_entry_free(). Fixes bug
17402; bugfix on 0.2.7.3-rc.
- Fix a memory leak when reading an expired signing key from disk.
Fixes bug 17403; bugfix on 0.2.7.2-rc.
o Minor features (geoIP):
- Update geoip and geoip6 to the October 9 2015 Maxmind GeoLite2
Country database.
o Minor bugfixes (compilation):
- Repair compilation with the most recent (unreleased, alpha)
vesions of OpenSSL 1.1. Fixes part of ticket 17237.
- Fix an integer overflow warning in test_crypto_slow.c. Fixes bug
17251; bugfix on 0.2.7.2-alpha.
- Fix compilation of sandbox.c with musl-libc. Fixes bug 17347;
bugfix on 0.2.5.1-alpha. Patch from 'jamestk'.
o Minor bugfixes (portability):
- Use libexecinfo on FreeBSD to enable backtrace support. Fixes part
of bug 17151; bugfix on 0.2.5.2-alpha. Patch from Marcin Cieślak.
o Minor bugfixes (sandbox):
- Add the "hidserv-stats" filename to our sandbox filter for the
HiddenServiceStatistics option to work properly. Fixes bug 17354;
bugfix on tor-0.2.6.2-alpha. Patch from David Goulet.
o Minor bugfixes (testing):
- Add unit tests for get_interface_address* failure cases. Fixes bug
17173; bugfix on 0.2.7.3-rc. Patch by fk/teor.
- Fix breakage when running 'make check' with BSD make. Fixes bug
17154; bugfix on 0.2.7.3-rc. Patch by Marcin Cieślak.
- Make the get_ifaddrs_* unit tests more tolerant of different
network configurations. (Don't assume every test box has an IPv4
address, and don't assume every test box has a non-localhost
address.) Fixes bug 17255; bugfix on 0.2.7.3-rc. Patch by "teor".
- Skip backtrace tests when backtrace support is not compiled in.
Fixes part of bug 17151; bugfix on 0.2.7.1-alpha. Patch from
Marcin Cieślak.
o Documentation:
- Fix capitalization of SOCKS in sample torrc. Closes ticket 15609.
- Note that HiddenServicePorts can take a unix domain socket. Closes
ticket 17364.
Changes in version 0.2.7.3-rc - 2015-09-25
Tor 0.2.7.3-rc is the first release candidate in the 0.2.7 series. It
contains numerous usability fixes for Ed25519 keys, safeguards against
several misconfiguration problems, significant simplifications to
Tor's callgraph, and numerous bugfixes and small features.
This is the most tested release of Tor to date. The unit tests cover
39.40% of the code, and the integration tests (accessible with "make
test-full-online", requiring stem and chutney and a network
connection) raise the coverage to 64.49%.
o Major features (security, hidden services):
- Hidden services, if using the EntryNodes option, are required to
use more than one EntryNode, in order to avoid a guard discovery
attack. (This would only affect people who had configured hidden
services and manually specified the EntryNodes option with a
single entry-node. The impact was that it would be easy to
remotely identify the guard node used by such a hidden service.
See ticket for more information.) Fixes ticket 14917.
o Major features (Ed25519 keys, keypinning):
- The key-pinning option on directory authorities is now advisory-
only by default. In a future version, or when the AuthDirPinKeys
option is set, pins are enforced again. Disabling key-pinning
seemed like a good idea so that we can survive the fallout of any
usability problems associated with Ed25519 keys. Closes
ticket 17135.
o Major features (Ed25519 performance):
- Improve the speed of Ed25519 operations and Curve25519 keypair
generation when built targeting 32 bit x86 platforms with SSE2
available. Implements ticket 16535.
- Improve the runtime speed of Ed25519 signature verification by
using Ed25519-donna's batch verification support. Implements
ticket 16533.
o Major features (performance testing):
- The test-network.sh script now supports performance testing.
Requires corresponding chutney performance testing changes. Patch
by "teor". Closes ticket 14175.
o Major features (relay, Ed25519):
- Significant usability improvements for Ed25519 key management. Log
messages are better, and the code can recover from far more
failure conditions. Thanks to "s7r" for reporting and diagnosing
so many of these!
- Add a new OfflineMasterKey option to tell Tor never to try loading
or generating a secret Ed25519 identity key. You can use this in
combination with tor --keygen to manage offline and/or encrypted
Ed25519 keys. Implements ticket 16944.
- Add a --newpass option to allow changing or removing the
passphrase of an encrypted key with tor --keygen. Implements part
of ticket 16769.
- On receiving a HUP signal, check to see whether the Ed25519
signing key has changed, and reload it if so. Closes ticket 16790.
o Major bugfixes (relay, Ed25519):
- Avoid crashing on 'tor --keygen'. Fixes bug 16679; bugfix on
0.2.7.2-alpha. Reported by "s7r".
- Improve handling of expired signing keys with offline master keys.
Fixes bug 16685; bugfix on 0.2.7.2-alpha. Reported by "s7r".
o Minor features (client-side privacy):
- New KeepAliveIsolateSOCKSAuth option to indefinitely extend circuit
lifespan when IsolateSOCKSAuth and streams with SOCKS
authentication are attached to the circuit. This allows
applications like TorBrowser to manage circuit lifetime on their
own. Implements feature 15482.
- When logging malformed hostnames from SOCKS5 requests, respect
SafeLogging configuration. Fixes bug 16891; bugfix on 0.1.1.16-rc.
o Minor features (compilation):
- Give a warning as early as possible when trying to build with an
unsupported OpenSSL version. Closes ticket 16901.
- Fail during configure if we're trying to build against an OpenSSL
built without ECC support. Fixes bug 17109, bugfix on 0.2.7.1-alpha
which started requiring ECC.
o Minor features (geoip):
- Update geoip and geoip6 to the September 3 2015 Maxmind GeoLite2
Country database.
o Minor features (hidden services):
- Relays need to have the Fast flag to get the HSDir flag. As this
is being written, we'll go from 2745 HSDirs down to 2342, a ~14%
drop. This change should make some attacks against the hidden
service directory system harder. Fixes ticket 15963.
- Turn on hidden service statistics collection by setting the torrc
option HiddenServiceStatistics to "1" by default. (This keeps
track only of the fraction of traffic used by hidden services, and
the total number of hidden services in existence.) Closes
ticket 15254.
- Client now uses an introduction point failure cache to know when
to fetch or keep a descriptor in their cache. Previously, failures
were recorded implicitly, but not explicitly remembered. Closes
ticket 16389.
o Minor features (testing, authorities, documentation):
- New TestingDirAuthVote{Exit,Guard,HSDir}IsStrict flags to
explicitly manage consensus flags in testing networks. Patch by
"robgjansen", modified by "teor". Implements part of ticket 14882.
o Minor bugfixes (security, exit policies):
- ExitPolicyRejectPrivate now also rejects the relay's published
IPv6 address (if any), and any publicly routable IPv4 or IPv6
addresses on any local interfaces. ticket 17027. Patch by "teor".
Fixes bug 17027; bugfix on 0.2.0.11-alpha.
o Minor bug fixes (torrc exit policies):
- In torrc, "accept6 *" and "reject6 *" ExitPolicy lines now only
produce IPv6 wildcard addresses. Previously they would produce
both IPv4 and IPv6 wildcard addresses. Patch by "teor". Fixes part
of bug 16069; bugfix on 0.2.4.7-alpha.
- When parsing torrc ExitPolicies, we now warn for a number of cases
where the user's intent is likely to differ from Tor's actual
behavior. These include: using an IPv4 address with an accept6 or
reject6 line; using "private" on an accept6 or reject6 line; and
including any ExitPolicy lines after accept *:* or reject *:*.
Related to ticket 16069.
- When parsing torrc ExitPolicies, we now issue an info-level
message when expanding an "accept/reject *" line to include both
IPv4 and IPv6 wildcard addresses. Related to ticket 16069.
- In each instance above, usage advice is provided to avoid the
message. Resolves ticket 16069. Patch by "teor". Fixes part of bug
16069; bugfix on 0.2.4.7-alpha.
o Minor bugfixes (authority):
- Don't assign "HSDir" to a router if it isn't Valid and Running.
Fixes bug 16524; bugfix on 0.2.7.2-alpha.
- Downgrade log messages about Ed25519 key issues if they are in old
cached router descriptors. Fixes part of bug 16286; bugfix
on 0.2.7.2-alpha.
- When we find an Ed25519 key issue in a cached descriptor, stop
saying the descriptor was just "uploaded". Fixes another part of
bug 16286; bugfix on 0.2.7.2-alpha.
o Minor bugfixes (control port):
- Repair a warning and a spurious result when getting the maximum
number of file descriptors from the controller. Fixes bug 16697;
bugfix on 0.2.7.2-alpha.
o Minor bugfixes (correctness):
- When calling channel_free_list(), avoid calling smartlist_remove()
while inside a FOREACH loop. This partially reverts commit
17356fe7fd96af where the correct SMARTLIST_DEL_CURRENT was
incorrectly removed. Fixes bug 16924; bugfix on 0.2.4.4-alpha.
o Minor bugfixes (documentation):
- Advise users on how to configure separate IPv4 and IPv6 exit
policies in the manpage and sample torrcs. Related to ticket 16069.
- Fix the usage message of tor-resolve(1) so that it no longer lists
the removed -F option. Fixes bug 16913; bugfix on 0.2.2.28-beta.
- Fix an error in the manual page and comments for
TestingDirAuthVoteHSDir[IsStrict], which suggested that a HSDir
required "ORPort connectivity". While this is true, it is in no
way unique to the HSDir flag. Of all the flags, only HSDirs need a
DirPort configured in order for the authorities to assign that
particular flag. Patch by "teor". Fixed as part of 14882; bugfix
on 0.2.6.3-alpha.
o Minor bugfixes (Ed25519):
- Fix a memory leak when reading router descriptors with expired
Ed25519 certificates. Fixes bug 16539; bugfix on 0.2.7.2-alpha.
o Minor bugfixes (linux seccomp2 sandbox):
- Allow bridge authorities to run correctly under the seccomp2
sandbox. Fixes bug 16964; bugfix on 0.2.5.1-alpha.
- Allow routers with ed25519 keys to run correctly under the
seccomp2 sandbox. Fixes bug 16965; bugfix on 0.2.7.2-alpha.
o Minor bugfixes (open file limit):
- Fix set_max_file_descriptors() to set by default the max open file
limit to the current limit when setrlimit() fails. Fixes bug
16274; bugfix on tor- 0.2.0.10-alpha. Patch by dgoulet.
o Minor bugfixes (portability):
- Try harder to normalize the exit status of the Tor process to the
standard-provided range. Fixes bug 16975; bugfix on every version
of Tor ever.
- Check correctly for Windows socket errors in the workqueue
backend. Fixes bug 16741; bugfix on 0.2.6.3-alpha.
- Fix the behavior of crypto_rand_time_range() when told to consider
times before 1970. (These times were possible when running in a
simulated network environment where time()'s output starts at
zero.) Fixes bug 16980; bugfix on 0.2.7.1-alpha.
- Restore correct operation of TLS client-cipher detection on
OpenSSL 1.1. Fixes bug 14047; bugfix on 0.2.7.2-alpha.
o Minor bugfixes (relay):
- Ensure that worker threads actually exit when a fatal error or
shutdown is indicated. This fix doesn't currently affect the
behavior of Tor, because Tor workers never indicates fatal error
or shutdown except in the unit tests. Fixes bug 16868; bugfix
on 0.2.6.3-alpha.
- Unblock threads before releasing the work queue mutex to ensure
predictable scheduling behavior. Fixes bug 16644; bugfix
on 0.2.6.3-alpha.
o Code simplification and refactoring:
- Change the function that's called when we need to retry all
downloads so that it only reschedules the downloads to happen
immediately, rather than launching them all at once itself. This
further simplifies Tor's callgraph.
- Move some format-parsing functions out of crypto.c and
crypto_curve25519.c into crypto_format.c and/or util_format.c.
- Move the client-only parts of init_keys() into a separate
function. Closes ticket 16763.
- Simplify the microdesc_free() implementation so that it no longer
appears (to code analysis tools) to potentially invoke a huge
suite of other microdesc functions.
- Simply the control graph further by deferring the inner body of
directory_all_unreachable() into a callback. Closes ticket 16762.
- Treat the loss of an owning controller as equivalent to a SIGTERM
signal. This removes a tiny amount of duplicated code, and
simplifies our callgraph. Closes ticket 16788.
- When generating an event to send to the controller, we no longer
put the event over the network immediately. Instead, we queue
these events, and use a Libevent callback to deliver them. This
change simplifies Tor's callgraph by reducing the number of
functions from which all other Tor functions are reachable. Closes
ticket 16695.
- Wrap Windows-only C files inside '#ifdef _WIN32' so that tools
that try to scan or compile every file on Unix won't decide that
they are broken.
- Remove the unused "nulterminate" argument from buf_pullup().
o Documentation:
- Recommend a 40 GB example AccountingMax in torrc.sample rather
than a 4 GB max. Closes ticket 16742.
- Include the TUNING document in our source tarball. It is referred
to in the ChangeLog and an error message. Fixes bug 16929; bugfix
on 0.2.6.1-alpha.
o Removed code:
- The internal pure-C tor-fw-helper tool is now removed from the Tor
distribution, in favor of the pure-Go clone available from
https://gitweb.torproject.org/tor-fw-helper.git/ . The libraries
used by the C tor-fw-helper are not, in our opinion, very
confidence- inspiring in their secure-programming techniques.
Closes ticket 13338.
- Remove the code that would try to aggressively flush controller
connections while writing to them. This code was introduced in
0.1.2.7-alpha, in order to keep output buffers from exceeding
their limits. But there is no longer a maximum output buffer size,
and flushing data in this way caused some undesirable recursions
in our call graph. Closes ticket 16480.
o Testing:
- Make "bridges+hs" the default test network. This tests almost all
tor functionality during make test-network, while allowing tests
to succeed on non-IPv6 systems. Requires chutney commit 396da92 in
test-network-bridges-hs. Closes tickets 16945 (tor) and 16946
(chutney). Patches by "teor".
- Autodetect CHUTNEY_PATH if the chutney and Tor sources are side-
by-side in the same parent directory. Closes ticket 16903. Patch
by "teor".
- Use environment variables rather than autoconf substitutions to
send variables from the build system to the test scripts. This
change should be easier to maintain, and cause 'make distcheck' to
work better than before. Fixes bug 17148.
- Add a new set of callgraph analysis scripts that use clang to
produce a list of which Tor functions are reachable from which
other Tor functions. We're planning to use these to help simplify
our code structure by identifying illogical dependencies.
- Add new 'test-full' and 'test-full-online' targets to run all
tests, including integration tests with stem and chutney.
- Make the test-workqueue test work on Windows by initializing the
network before we begin.
- New make target (make test-network-all) to run multiple applicable
chutney test cases. Patch from Teor; closes 16953.
- Unit test dns_resolve(), dns_clip_ttl() and dns_get_expiry_ttl()
functions in dns.c. Implements a portion of ticket 16831.
- When building Tor with testing coverage enabled, run Chutney tests
(if any) using the 'tor-cov' coverage binary.
- When running test-network or test-stem, check for the absence of
stem/chutney before doing any build operations.
Changes in version 0.2.7.2-alpha - 2015-07-27
This, the second alpha in the Tor 0.2.7 series, has a number of new
features, including a way to manually pick the number of introduction
points for hidden services, and the much stronger Ed25519 signing key
algorithm for regular Tor relays (including support for encrypted
offline identity keys in the new algorithm).
Support for Ed25519 on relays is currently limited to signing router
descriptors; later alphas in this series will extend Ed25519 key
support to more parts of the Tor protocol.
o Major features (Ed25519 identity keys, Proposal 220):
- All relays now maintain a stronger identity key, using the Ed25519
elliptic curve signature format. This master key is designed so
that it can be kept offline. Relays also generate an online
signing key, and a set of other Ed25519 keys and certificates.
These are all automatically regenerated and rotated as needed.
Implements part of ticket 12498.
- Directory authorities now vote on Ed25519 identity keys along with
RSA1024 keys. Implements part of ticket 12498.
- Directory authorities track which Ed25519 identity keys have been
used with which RSA1024 identity keys, and do not allow them to
vary freely. Implements part of ticket 12498.
- Microdescriptors now include Ed25519 identity keys. Implements
part of ticket 12498.
- Add support for offline encrypted Ed25519 master keys. To use this
feature on your tor relay, run "tor --keygen" to make a new master
key (or to make a new signing key if you already have a master
key). Closes ticket 13642.
o Major features (Hidden services):
- Add the torrc option HiddenServiceNumIntroductionPoints, to
specify a fixed number of introduction points. Its maximum value
is 10 and default is 3. Using this option can increase a hidden
service's reliability under load, at the cost of making it more
visible that the hidden service is facing extra load. Closes
ticket 4862.
- Remove the adaptive algorithm for choosing the number of
introduction points, which used to change the number of
introduction points (poorly) depending on the number of
connections the HS sees. Closes ticket 4862.
o Major features (onion key cross-certification):
- Relay descriptors now include signatures of their own identity
keys, made using the TAP and ntor onion keys. These signatures
allow relays to prove ownership of their own onion keys. Because
of this change, microdescriptors will no longer need to include
RSA identity keys. Implements proposal 228; closes ticket 12499.
o Major features (performance):
- Improve the runtime speed of Ed25519 operations by using the
public-domain Ed25519-donna by Andrew M. ("floodyberry").
Implements ticket 16467.
- Improve the runtime speed of the ntor handshake by using an
optimized curve25519 basepoint scalarmult implementation from the
public-domain Ed25519-donna by Andrew M. ("floodyberry"), based on
ideas by Adam Langley. Implements ticket 9663.
o Major bugfixes (client-side privacy, also in 0.2.6.9):
- Properly separate out each SOCKSPort when applying stream
isolation. The error occurred because each port's session group
was being overwritten by a default value when the listener
connection was initialized. Fixes bug 16247; bugfix on
0.2.6.3-alpha. Patch by "jojelino".
o Major bugfixes (hidden service clients, stability, also in 0.2.6.10):
- Stop refusing to store updated hidden service descriptors on a
client. This reverts commit 9407040c59218 (which indeed fixed bug
14219, but introduced a major hidden service reachability
regression detailed in bug 16381). This is a temporary fix since
we can live with the minor issue in bug 14219 (it just results in
some load on the network) but the regression of 16381 is too much
of a setback. First-round fix for bug 16381; bugfix
on 0.2.6.3-alpha.
o Major bugfixes (hidden services):
- When cannibalizing a circuit for an introduction point, always
extend to the chosen exit node (creating a 4 hop circuit).
Previously Tor would use the current circuit exit node, which
changed the original choice of introduction point, and could cause
the hidden service to skip excluded introduction points or
reconnect to a skipped introduction point. Fixes bug 16260; bugfix
on 0.1.0.1-rc.
o Major bugfixes (open file limit):
- The open file limit wasn't checked before calling
tor_accept_socket_nonblocking(), which would make Tor exceed the
limit. Now, before opening a new socket, Tor validates the open
file limit just before, and if the max has been reached, return an
error. Fixes bug 16288; bugfix on 0.1.1.1-alpha.
o Major bugfixes (stability, also in 0.2.6.10):
- Stop crashing with an assertion failure when parsing certain kinds
of malformed or truncated microdescriptors. Fixes bug 16400;
bugfix on 0.2.6.1-alpha. Found by "torkeln"; fix based on a patch
by "cypherpunks_backup".
- Stop random client-side assertion failures that could occur when
connecting to a busy hidden service, or connecting to a hidden
service while a NEWNYM is in progress. Fixes bug 16013; bugfix
on 0.1.0.1-rc.
o Minor features (directory authorities, security, also in 0.2.6.9):
- The HSDir flag given by authorities now requires the Stable flag.
For the current network, this results in going from 2887 to 2806
HSDirs. Also, it makes it harder for an attacker to launch a sybil
attack by raising the effort for a relay to become Stable to
require at the very least 7 days, while maintaining the 96 hours
uptime requirement for HSDir. Implements ticket 8243.
o Minor features (client):
- Relax the validation of hostnames in SOCKS5 requests, allowing the
character '_' to appear, in order to cope with domains observed in
the wild that are serving non-RFC compliant records. Resolves
ticket 16430.
- Relax the validation done to hostnames in SOCKS5 requests, and
allow a single trailing '.' to cope with clients that pass FQDNs
using that syntax to explicitly indicate that the domain name is
fully-qualified. Fixes bug 16674; bugfix on 0.2.6.2-alpha.
- Add GroupWritable and WorldWritable options to unix-socket based
SocksPort and ControlPort options. These options apply to a single
socket, and override {Control,Socks}SocketsGroupWritable. Closes
ticket 15220.
o Minor features (control protocol):
- Support network-liveness GETINFO key and NETWORK_LIVENESS event in
the control protocol. Resolves ticket 15358.
o Minor features (directory authorities):
- Directory authorities no longer vote against the "Fast", "Stable",
and "HSDir" flags just because they were going to vote against
"Running": if the consensus turns out to be that the router was
running, then the authority's vote should count. Patch from Peter
Retzlaff; closes issue 8712.
o Minor features (geoip, also in 0.2.6.10):
- Update geoip to the June 3 2015 Maxmind GeoLite2 Country database.
- Update geoip6 to the June 3 2015 Maxmind GeoLite2 Country database.
o Minor features (hidden services):
- Add the new options "HiddenServiceMaxStreams" and
"HiddenServiceMaxStreamsCloseCircuit" to allow hidden services to
limit the maximum number of simultaneous streams per circuit, and
optionally tear down the circuit when the limit is exceeded. Part
of ticket 16052.
o Minor features (portability):
- Use C99 variadic macros when the compiler is not GCC. This avoids
failing compilations on MSVC, and fixes a log-file-based race
condition in our old workarounds. Original patch from Gisle Vanem.
o Minor bugfixes (compilation, also in 0.2.6.9):
- Build with --enable-systemd correctly when libsystemd is
installed, but systemd is not. Fixes bug 16164; bugfix on
0.2.6.3-alpha. Patch from Peter Palfrader.
o Minor bugfixes (controller):
- Add the descriptor ID in each HS_DESC control event. It was
missing, but specified in control-spec.txt. Fixes bug 15881;
bugfix on 0.2.5.2-alpha.
o Minor bugfixes (crypto error-handling, also in 0.2.6.10):
- Check for failures from crypto_early_init, and refuse to continue.
A previous typo meant that we could keep going with an
uninitialized crypto library, and would have OpenSSL initialize
its own PRNG. Fixes bug 16360; bugfix on 0.2.5.2-alpha, introduced
when implementing ticket 4900. Patch by "teor".
o Minor bugfixes (hidden services):
- Fix a crash when reloading configuration while at least one
configured and one ephemeral hidden service exists. Fixes bug
16060; bugfix on 0.2.7.1-alpha.
- Avoid crashing with a double-free bug when we create an ephemeral
hidden service but adding it fails for some reason. Fixes bug
16228; bugfix on 0.2.7.1-alpha.
o Minor bugfixes (Linux seccomp2 sandbox):
- Use the sandbox in tor_open_cloexec whether or not O_CLOEXEC is
defined. Patch by "teor". Fixes bug 16515; bugfix on 0.2.3.1-alpha.
o Minor bugfixes (Linux seccomp2 sandbox, also in 0.2.6.10):
- Allow pipe() and pipe2() syscalls in the seccomp2 sandbox: we need
these when eventfd2() support is missing. Fixes bug 16363; bugfix
on 0.2.6.3-alpha. Patch from "teor".
o Minor bugfixes (Linux seccomp2 sandbox, also in 0.2.6.9):
- Fix sandboxing to work when running as a relay, by allowing the
renaming of secret_id_key, and allowing the eventfd2 and futex
syscalls. Fixes bug 16244; bugfix on 0.2.6.1-alpha. Patch by
Peter Palfrader.
- Allow systemd connections to work with the Linux seccomp2 sandbox
code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. Patch by
Peter Palfrader.
o Minor bugfixes (relay):
- Fix a rarely-encountered memory leak when failing to initialize
the thread pool. Fixes bug 16631; bugfix on 0.2.6.3-alpha. Patch
from "cypherpunks".
o Minor bugfixes (systemd):
- Fix an accidental formatting error that broke the systemd
configuration file. Fixes bug 16152; bugfix on 0.2.7.1-alpha.
- Tor's systemd unit file no longer contains extraneous spaces.
These spaces would sometimes confuse tools like deb-systemd-
helper. Fixes bug 16162; bugfix on 0.2.5.5-alpha.
o Minor bugfixes (tests):
- Use the configured Python executable when running test-stem-full.
Fixes bug 16470; bugfix on 0.2.7.1-alpha.
o Minor bugfixes (tests, also in 0.2.6.9):
- Fix a crash in the unit tests when built with MSVC2013. Fixes bug
16030; bugfix on 0.2.6.2-alpha. Patch from "NewEraCracker".
o Minor bugfixes (threads, comments):
- Always initialize return value in compute_desc_id in rendcommon.c
Patch by "teor". Fixes part of bug 16115; bugfix on 0.2.7.1-alpha.
- Check for NULL values in getinfo_helper_onions(). Patch by "teor".
Fixes part of bug 16115; bugfix on 0.2.7.1-alpha.
- Remove undefined directive-in-macro in test_util_writepid clang
3.7 complains that using a preprocessor directive inside a macro
invocation in test_util_writepid in test_util.c is undefined.
Patch by "teor". Fixes part of bug 16115; bugfix on 0.2.7.1-alpha.
o Code simplification and refactoring:
- Define WINVER and _WIN32_WINNT centrally, in orconfig.h, in order
to ensure they remain consistent and visible everywhere.
- Remove some vestigial workarounds for the MSVC6 compiler. We
haven't supported that in ages.
- The link authentication code has been refactored for better
testability and reliability. It now uses code generated with the
"trunnel" binary encoding generator, to reduce the risk of bugs
due to programmer error. Done as part of ticket 12498.
o Documentation:
- Include a specific and (hopefully) accurate documentation of the
torrc file's meta-format in doc/torrc_format.txt. This is mainly
of interest to people writing programs to parse or generate torrc
files. This document is not a commitment to long-term
compatibility; some aspects of the current format are a bit
ridiculous. Closes ticket 2325.
o Removed features:
- Tor no longer supports copies of OpenSSL that are missing support
for Elliptic Curve Cryptography. (We began using ECC when
available in 0.2.4.8-alpha, for more safe and efficient key
negotiation.) In particular, support for at least one of P256 or
P224 is now required, with manual configuration needed if only
P224 is available. Resolves ticket 16140.
- Tor no longer supports versions of OpenSSL before 1.0. (If you are
on an operating system that has not upgraded to OpenSSL 1.0 or
later, and you compile Tor from source, you will need to install a
more recent OpenSSL to link Tor against.) These versions of
OpenSSL are still supported by the OpenSSL, but the numerous
cryptographic improvements in later OpenSSL releases makes them a
clear choice. Resolves ticket 16034.
- Remove the HidServDirectoryV2 option. Now all relays offer to
store hidden service descriptors. Related to 16543.
- Remove the VoteOnHidServDirectoriesV2 option, since all
authorities have long set it to 1. Closes ticket 16543.
o Testing:
- Document use of coverity, clang static analyzer, and clang dynamic
undefined behavior and address sanitizers in doc/HACKING. Include
detailed usage instructions in the blacklist. Patch by "teor".
Closes ticket 15817.
- The link authentication protocol code now has extensive tests.
- The relay descriptor signature testing code now has
extensive tests.
- The test_workqueue program now runs faster, and is enabled by
default as a part of "make check".
- Now that OpenSSL has its own scrypt implementation, add an unit
test that checks for interoperability between libscrypt_scrypt()
and OpenSSL's EVP_PBE_scrypt() so that we could not use libscrypt
and rely on EVP_PBE_scrypt() whenever possible. Resolves
ticket 16189.
This is a manually created snapshot to get a bug fix while waiting
for the next release since the diff would be too big.
Changes from 0.9.12:
--------------------
* Features:
- new library: libpkgconf
* Enhancements:
- testsuite: use an explicit prefix on all tests
- build: switch to automake
* Bug fixes:
- cast all usage of ctype(3) functions
- do not expand variables passed via --define-variable for compatibility with pkg-config 0.29
- let the CFLAGS being user settable
NEWS:
Changes from 5.1.1 to 5.2
-------------------------
The new module zsh/param/private can be loaded to allow the shell
to define parameters that are private to a function scope (i.e. are
not propagated to nested functions called within this function).
The parameter flag ${(P)...} is now more useful when it appears in
a nested expansion. For example,
typeset -A assoc=(one un two deux three trois)
name=assoc
print ${${(P)name}[one]}
now prints "un". In previous versions of the shell the value of the
substitution was fully expanded on return from ${(P)name}, making
associative array subscripting difficult. As a side effect, flags
for formatting appearing in the inner substitution now affect the
substitution of the name (into "assoc" in this case), which is not
normally useful: flags that should apply to the value must be in the
outer substitution.
The GLOB_STAR_SHORT option allows the pattern **/* to be shortened to
just ** if no / follows. so **.c searches recursively for a file whose
name has the suffix ".c".
The effect of the WARN_CREATE_GLOBAL option has been significantly
extended, so expect it to cause additional warning messages about
parameters created globally within function scope.
README:
Incompatibilities between 5.1 and 5.2
-------------------------------------
The behaviour of the parameter flag (P) has changed when it appears
in a nested parameter group, in order to make it more useful in
such cases. A (P) in the outermost parameter group behaves as
before. See NEWS for more.
pkgsrc changes:
- Release tarballs cannot build man pages any more, use pre-built
ones instead.
Changes since 1.2.1:
- If the driver is compiled without SSL support but a URI with "ssl=true"
is passed to mongoc_client_new, mongoc_client_new_from_uri, or
mongoc_client_pool_new, the function logs an error and returns NULL.
Before, the driver would attempt a non-SSL connection.
- mongoc_collection_find_and_modify will now apply the mongoc_collection_t's
write_concern_t when talking to MongoDB 3.2.
- Support for MongoDB 3.2's "readConcern" feature for queries, counts,
and aggregations. The option "readConcernLevel" is now accepted in
the MongoDB URI.
- Support for MongoDB 3.2's "bypassDocumentValidation" option for writes.
- New struct mongoc_bulk_write_flags_t and related functions.
- New struct mongoc_find_and_modify_opts_t and related functions.
- New functions to copy database and collection handles.
- Support for MongoDB 3.2 wire protocol: use commands in place of OP_QUERY,
OP_GETMORE, and OP_KILLCURSORS messages.
- To explain a query plan with MongoDB 3.2, you must now call the "explain"
command, instead of including the "$explain" key in
a mongoc_collection_find query. See the mongoc_collection_find
documentation page for details.
- Configurable wait time on tailable cursors with MongoDB 3.2.
- Use electionId to detect a stale replica set primary during
a network split.
- Disconnect from replica set members whose "me" field does not match
the connection address.
- The client side matching feature, mongoc_matcher_t and related functions,
are deprecated and scheduled for removal in version 2.0.
- New CMake options ENABLE_SSL, ENABLE_SASL, ENABLE_TESTS, and
ENABLE_EXAMPLES.
- Use constant-time comparison when verifying credentials.
- Combine environment's CFLAGS with configure options when building.
- Improved man page output and "whatis" entries.
pkgsrc changes:
- Release tarballs cannot build man pages any more, use pre-built
ones instead.
Changes since 1.2.1:
- Fix potential crash in bson_strncpy on Windows.
- Parse DBRefs correctly from JSON.
- CMake option to disable building tests: "cmake -DENABLE_TESTS:BOOL=OFF".
- Refactor the build system to declare library version in one place.
- Fix compiler warnings and errors, especially with Visual Studio 2015
and IBM XL C.
- Combine environment's CFLAGS with configure options when building.
MySQL Server RPM packages now contain a conflict indicator for MySQL Connector C, such that an error occurs when installing MySQL Server if MySQL Connector C is also installed. To install MySQL Server, remove any MySQL Connector C packages first.
mysql_upgrade now attempts to print more informative errors than FATAL ERROR: Upgrade failed.
These client programs now support the --enable-cleartext-plugin option: mysqlcheck, mysqldump, mysqlimport, mysqlshow. This option enables the mysql_clear_password cleartext authentication plugin. (See The Cleartext Client-Side Authentication Plugin.)
Support for building with Solaris Studio 5.13 was added.
Performance Schema digests in DIGEST_TEXT columns have ... appended to the end to indicate when statements exceed the maximum statement size and were truncated. This is also now done for statement text values in SQL_TEXT columns.
Bugs Fixed
v0.12.7:
Filenames added to audit log in the LocalIndexUpdated event (#2549, @nrm21)
staticClient.connect(): don't handshake twice (fixes#2547, #2548) (@canton7)
Fix STTRACE=http (it should use the http debug logger) (@calmh)
