Tor 0.1.2.19 fixes a huge memory leak on exit relays, makes the default
exit policy a little bit more conservative so it's safer to run an exit
relay on a home system, and fixes a variety of smaller issues.
https://www.torproject.org/download.html
Changes in version 0.1.2.19 - 2008-01-17
o Security fixes:
- Exit policies now reject connections that are addressed to a
relay's public (external) IP address too, unless
ExitPolicyRejectPrivate is turned off. We do this because too
many relays are running nearby to services that trust them based
on network address.
o Major bugfixes:
- When the clock jumps forward a lot, do not allow the bandwidth
buckets to become negative. Fixes bug 544.
- Fix a memory leak on exit relays; we were leaking a cached_resolve_t
on every successful resolve. Reported by Mike Perry.
- Purge old entries from the "rephist" database and the hidden
service descriptor database even when DirPort is zero.
- Stop thinking that 0.1.2.x directory servers can handle "begin_dir"
requests. Should ease bugs 406 and 419 where 0.1.2.x relays are
crashing or mis-answering these requests.
- When we decide to send a 503 response to a request for servers, do
not then also send the server descriptors: this defeats the whole
purpose. Fixes bug 539.
o Minor bugfixes:
- Changing the ExitPolicyRejectPrivate setting should cause us to
rebuild our server descriptor.
- Fix handling of hex nicknames when answering controller requests for
networkstatus by name, or when deciding whether to warn about
unknown routers in a config option. (Patch from mwenge.)
- Fix a couple of hard-to-trigger autoconf problems that could result
in really weird results on platforms whose sys/types.h files define
nonstandard integer types.
- Don't try to create the datadir when running --verify-config or
--hash-password. Resolves bug 540.
- If we were having problems getting a particular descriptor from the
directory caches, and then we learned about a new descriptor for
that router, we weren't resetting our failure count. Reported
by lodger.
- Although we fixed bug 539 (where servers would send HTTP status 503
responses _and_ send a body too), there are still servers out there
that haven't upgraded. Therefore, make clients parse such bodies
when they receive them.
- Run correctly on systems where rlim_t is larger than unsigned long.
This includes some 64-bit systems.
- Run correctly on platforms (like some versions of OS X 10.5) where
the real limit for number of open files is OPEN_FILES, not rlim_max
from getrlimit(RLIMIT_NOFILES).
- Avoid a spurious free on base64 failure.
- Avoid segfaults on certain complex invocations of
router_get_by_hexdigest().
- Fix rare bug on REDIRECTSTREAM control command when called with no
port set: it could erroneously report an error when none had
happened.
o Major bugfixes (crashes):
- If a connection is shut down abruptly because of something that
happened inside connection_flushed_some(), do not call
connection_finished_flushing(). Should fix bug 451:
"connection_stop_writing: Assertion conn->write_event failed"
Bugfix on 0.1.2.7-alpha.
- Fix possible segfaults in functions called from
rend_process_relay_cell().
o Major bugfixes (hidden services):
- Hidden services were choosing introduction points uniquely by
hexdigest, but when constructing the hidden service descriptor
they merely wrote the (potentially ambiguous) nickname.
- Clients now use the v2 intro format for hidden service
connections: they specify their chosen rendezvous point by identity
digest rather than by (potentially ambiguous) nickname. These
changes could speed up hidden service connections dramatically.
o Major bugfixes (other):
- Stop publishing a new server descriptor just because we get a
HUP signal. This led (in a roundabout way) to some servers getting
dropped from the networkstatus lists for a few hours each day.
- When looking for a circuit to cannibalize, consider family as well
as identity. Fixes bug 438. Bugfix on 0.1.0.x (which introduced
circuit cannibalization).
- When a router wasn't listed in a new networkstatus, we were leaving
the flags for that router alone -- meaning it remained Named,
Running, etc -- even though absence from the networkstatus means
that it shouldn't be considered to exist at all anymore. Now we
clear all the flags for routers that fall out of the networkstatus
consensus. Fixes bug 529.
o Minor bugfixes:
- Don't try to access (or alter) the state file when running
--list-fingerprint or --verify-config or --hash-password. Resolves
bug 499.
- When generating information telling us how to extend to a given
router, do not try to include the nickname if it is
absent. Resolves bug 467.
- Fix a user-triggerable segfault in expand_filename(). (There isn't
a way to trigger this remotely.)
- When sending a status event to the controller telling it that an
OR address is readable, set the port correctly. (Previously we
were reporting the dir port.)
- Fix a minor memory leak whenever a controller sends the PROTOCOLINFO
command. Bugfix on 0.1.2.17.
- When loading bandwidth history, do not believe any information in
the future. Fixes bug 434.
- When loading entry guard information, do not believe any information
in the future.
- When we have our clock set far in the future and generate an
onion key, then re-set our clock to be correct, we should not stop
the onion key from getting rotated.
- On some platforms, accept() can return a broken address. Detect
this more quietly, and deal accordingly. Fixes bug 483.
- It's not actually an error to find a non-pending entry in the DNS
cache when canceling a pending resolve. Don't log unless stuff
is fishy. Resolves bug 463.
- Don't reset trusted dir server list when we set a configuration
option. Patch from Robert Hogan.
Changes in version 0.1.2.17 - 2007-08-30
o Major bugfixes (security):
- We removed support for the old (v0) control protocol. It has been
deprecated since Tor 0.1.1.1-alpha, and keeping it secure has
become more of a headache than it's worth.
o Major bugfixes (load balancing):
- When choosing nodes for non-guard positions, weight guards
proportionally less, since they already have enough load. Patch
from Mike Perry.
- Raise the "max believable bandwidth" from 1.5MB/s to 10MB/s. This
will allow fast Tor servers to get more attention.
- When we're upgrading from an old Tor version, forget our current
guards and pick new ones according to the new weightings. These
three load balancing patches could raise effective network capacity
by a factor of four. Thanks to Mike Perry for measurements.
o Major bugfixes (stream expiration):
- Expire not-yet-successful application streams in all cases if
they've been around longer than SocksTimeout. Right now there are
some cases where the stream will live forever, demanding a new
circuit every 15 seconds. Fixes bug 454; reported by lodger.
o Minor features (controller):
- Add a PROTOCOLINFO controller command. Like AUTHENTICATE, it
is valid before any authentication has been received. It tells
a controller what kind of authentication is expected, and what
protocol is spoken. Implements proposal 119.
o Minor bugfixes (performance):
- Save on most routerlist_assert_ok() calls in routerlist.c, thus
greatly speeding up loading cached-routers from disk on startup.
- Disable sentinel-based debugging for buffer code: we squashed all
the bugs that this was supposed to detect a long time ago, and now
its only effect is to change our buffer sizes from nice powers of
two (which platform mallocs tend to like) to values slightly over
powers of two (which make some platform mallocs sad).
o Minor bugfixes (misc):
- If exit bandwidth ever exceeds one third of total bandwidth, then
use the correct formula to weight exit nodes when choosing paths.
Based on patch from Mike Perry.
- Choose perfectly fairly among routers when choosing by bandwidth and
weighting by fraction of bandwidth provided by exits. Previously, we
would choose with only approximate fairness, and correct ourselves
if we ran off the end of the list.
- If we require CookieAuthentication but we fail to write the
cookie file, we would warn but not exit, and end up in a state
where no controller could authenticate. Now we exit.
- If we require CookieAuthentication, stop generating a new cookie
every time we change any piece of our config.
- Refuse to start with certain directory authority keys, and
encourage people using them to stop.
- Terminate multi-line control events properly. Original patch
from tup.
- Fix a minor memory leak when we fail to find enough suitable
servers to choose a circuit.
- Stop leaking part of the descriptor when we run into a particularly
unparseable piece of it.
Too many changes to list here; most are not visible to client-only
users anyway.
I've tested client and anymous service functions. Couldn't test server
myself. Since noone responded when I asked for testers I'm committing
the update anyway, also because security flaws were reported without
telling whether they apply to the old 0.1.1 branch.
the owner of all installed files is a non-root user. This change
affects most packages that require special users or groups by making
them use the specified unprivileged user and group instead.
(1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to
unprivileged.mk. These two variables are lists of other bmake
variables that define package-specific users and groups. Packages
that have user-settable variables for users and groups, e.g. apache
and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP},
etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS
so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER}
and ${UNPRIVILEGED_GROUP}.
(2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
Changes in version 0.1.1.26 - 2006-12-14
o Security bugfixes:
- Stop sending the HttpProxyAuthenticator string to directory
servers when directory connections are tunnelled through Tor.
- Clients no longer store bandwidth history in the state file.
- Do not log introduction points for hidden services if SafeLogging
is set.
o Minor bugfixes:
- Fix an assert failure when a directory authority sets
AuthDirRejectUnlisted and then receives a descriptor from an
unlisted router (reported by seeess).
Changes in version 0.1.1.25 - 2006-11-04
o Major bugfixes:
- When a client asks us to resolve (rather than connect to)
an address, and we have a cached answer, give them the cached
answer. Previously, we would give them no answer at all.
- We were building exactly the wrong circuits when we predict
hidden service requirements, meaning Tor would have to build all
its circuits on demand.
- If none of our live entry guards have a high uptime, but we
require a guard with a high uptime, try adding a new guard before
we give up on the requirement. This patch should make long-lived
connections more stable on average.
- When testing reachability of our DirPort, don't launch new
tests when there's already one in progress -- unreachable
servers were stacking up dozens of testing streams.
o Security bugfixes:
- When the user sends a NEWNYM signal, clear the client-side DNS
cache too. Otherwise we continue to act on previous information.
o Minor bugfixes:
- Avoid a memory corruption bug when creating a hash table for
the first time.
- Avoid possibility of controller-triggered crash when misusing
certain commands from a v0 controller on platforms that do not
handle printf("%s",NULL) gracefully.
- Avoid infinite loop on unexpected controller input.
- Don't log spurious warnings when we see a circuit close reason we
don't recognize; it's probably just from a newer version of Tor.
- Add Vidalia to the OS X uninstaller script, so when we uninstall
Tor/Privoxy we also uninstall Vidalia.
Changes in version 0.1.1.24 - 2006-09-29
o Major bugfixes:
- Allow really slow clients to not hang up five minutes into their
directory downloads (suggested by Adam J. Richter).
- Fix major performance regression from 0.1.0.x: instead of checking
whether we have enough directory information every time we want to
do something, only check when the directory information has changed.
This should improve client CPU usage by 25-50%.
- Don't crash if, after a server has been running for a while,
it can't resolve its hostname.
- When a client asks us to resolve (not connect to) an address,
and we have a cached answer, give them the cached answer.
Previously, we would give them no answer at all.
o Minor bugfixes:
- Allow Tor to start when RunAsDaemon is set but no logs are set.
- Don't crash when the controller receives a third argument to an
"extendcircuit" request.
- Controller protocol fixes: fix encoding in "getinfo addr-mappings"
response; fix error code when "getinfo dir/status/" fails.
- Fix configure.in to not produce broken configure files with
more recent versions of autoconf. Thanks to Clint for his auto*
voodoo.
- Fix security bug on NetBSD that could allow someone to force
uninitialized RAM to be sent to a server's DNS resolver. This
only affects NetBSD and other platforms that do not bounds-check
tolower().
- Warn user when using libevent 1.1a or earlier with win32 or kqueue
methods: these are known to be buggy.
- If we're a directory mirror and we ask for "all" network status
documents, we would discard status documents from authorities
we don't recognize.
o Major bugfixes:
- Fast Tor servers, especially exit nodes, were triggering asserts
due to a bug in handling the list of pending DNS resolves. Some
bugs still remain here; we're hunting them.
- Entry guards could crash clients by sending unexpected input.
- More fixes on reachability testing: if you find yourself reachable,
then don't ever make any client requests (so you stop predicting
circuits), then hup or have your clock jump, then later your IP
changes, you won't think circuits are working, so you won't try to
test reachability, so you won't publish.
o Minor bugfixes:
- Avoid a crash if the controller does a resetconf firewallports
and then a setconf fascistfirewall=1.
- Avoid an integer underflow when the dir authority decides whether
a router is stable: we might wrongly label it stable, and compute
a slightly wrong median stability, when a descriptor is published
later than now.
- Fix a place where we might trigger an assert if we can't build our
own server descriptor yet.
Changes in version 0.1.1.22 - 2006-07-05
o Major bugfixes:
- Fix a big bug that was causing servers to not find themselves
reachable if they changed IP addresses. Since only 0.1.1.22+
servers can do reachability testing correctly, now we automatically
make sure to test via one of these.
- Fix to allow clients and mirrors to learn directory info from
descriptor downloads that get cut off partway through.
- Directory authorities had a bug in deciding if a newly published
descriptor was novel enough to make everybody want a copy -- a few
servers seem to be publishing new descriptors many times a minute.
o Minor bugfixes:
- Fix a rare bug that was causing some servers to complain about
"closing wedged cpuworkers" and skip some circuit create requests.
- Make the Exit flag in directory status documents actually work.
While here, patch sample config file to log to syslog per default to make
sure that tor starts as a daemon with the default config.
o Crash and assert fixes from 0.1.1.20:
- Fix a rare crash on Tor servers that have enabled hibernation.
- Fix a seg fault on startup for Tor networks that use only one
directory authority.
- Fix an assert from a race condition that occurs on Tor servers
while exiting, where various threads are trying to log that they're
exiting, and delete the logs, at the same time.
- Make our unit tests pass again on certain obscure platforms.
[Noncritical changes, of which there are many, are in the ChangeLog.]
- maintainer -> tv
Changes (summary):
some major security fixes, including entry guards to protect the
beginning of the circuit, exit enclaves to protect the end, and better
firewall support; a new directory protocol that improves bandwidth use
and keeps clients more up to date; two new directory authorities;
a new ascii-based controller protocol that lets people easily write
applications to interact with Tor; and
many scalability and performance improvements
Full changes available at
http://archives.seul.org/or/announce/May-2006/msg00000.html:
RECOMMENDED is removed. It becomes ABI_DEPENDS.
BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo.
BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo.
BUILDLINK_DEPENDS does not change.
IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS
which defaults to "yes".
Added to obsolete.mk checking for IGNORE_RECOMMENDED.
I did not manually go through and fix any aesthetic tab/spacing issues.
I have tested the above patch on DragonFly building and packaging
subversion and pkglint and their many dependencies.
I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I
have used IGNORE_RECOMMENDED for a long time). I have been an active user
of IGNORE_RECOMMENDED since it was available.
As suggested, I removed the documentation sentences suggesting bumping for
"security" issues.
As discussed on tech-pkg.
I will commit to revbump, pkglint, pkg_install, createbuildlink separately.
Note that if you use wip, it will fail! I will commit to pkgsrc-wip
later (within day).
INSTALL/DEINSTALL script creation within pkgsrc.
If an INSTALL or DEINSTALL script is found in the package directory,
it is automatically used as a template for the pkginstall-generated
scripts. If instead, they should be used simply as the full scripts,
then the package Makefile should set INSTALL_SRC or DEINSTALL_SRC
explicitly, e.g.:
INSTALL_SRC= ${PKGDIR}/INSTALL
DEINSTALL_SRC= # emtpy
As part of the restructuring of the pkginstall framework internals,
we now *always* generate temporary INSTALL or DEINSTALL scripts. By
comparing these temporary scripts with minimal INSTALL/DEINSTALL
scripts formed from only the base templates, we determine whether or
not the INSTALL/DEINSTALL scripts are actually needed by the package
(see the generate-install-scripts target in bsd.pkginstall.mk).
In addition, more variables in the framework have been made private.
The *_EXTRA_TMPL variables have been renamed to *_TEMPLATE, which are
more sensible names given the very few exported variables in this
framework. The only public variables relating to the templates are:
INSTALL_SRC INSTALL_TEMPLATE
DEINSTALL_SRC DEINSTALL_TEMPLATE
HEADER_TEMPLATE
The packages in pkgsrc have been modified to reflect the changes in
the pkginstall framework.
Changes in version 0.1.0.17 - 2006-02-17
o Crash bugfixes on 0.1.0.x:
- When servers with a non-zero DirPort came out of hibernation,
sometimes they would trigger an assert.
o Other important bugfixes:
- On platforms that don't have getrlimit (like Windows), we
were artificially constraining ourselves to a max of 1024
connections. Now just assume that we can handle
as many as 15000 connections. Hopefully this won't cause
other problems.
o Backported features:
- When we're a server, a client asks
for an old-style directory, and our write bucket is empty,
don't give it to him. This way small servers can
continue to serve the directory *sometimes*,
without getting overloaded.
- Whenever you get a 503 in response to a directory fetch, try
once more. This will become important once servers start sending
503's whenever they feel busy.
- Fetch a new directory every 120 minutes, not every 40 minutes.
Now that we have hundreds of thousands of users running the old
directory algorithm, it's starting to hurt a lot.
- Bump up the period for forcing a hidden service descriptor upload
from 20 minutes to 1 hour.
o Bugfixes on 0.1.0.x:
- Reject ports 465 and 587 (spam targets) in default exit policy.
- Don't crash when we don't have any spare file descriptors and we
try to spawn a dns or cpu worker.
- Get rid of IgnoreVersion undocumented config option, and make us
only warn, never exit, when we're running an obsolete version.
- Don't try to print a null string when your server finds itself to
be unreachable and the Address config option is empty.
- Make the numbers in read-history and write-history into uint64s,
so they don't overflow and publish negatives in the descriptor.
- Fix a minor memory leak in smartlist_string_remove().
- We were only allowing ourselves to upload a server descriptor at
most every 20 minutes, even if it changed earlier than that.
- Clean up log entries that pointed to old URLs.
no longer correct since update to libevent 1.x; it now uses libtool and
generates a shlib.
Remove the offending bl3 line, and bump all dependents' PKGREVISIONs, since
the binary pkg changes for any OS that doesn't have a sufficient builtin
libevent version (or the package has requested a non-builtin version).
Tor 0.1.0.14 fixes the second half of an important bug in the security of
our crypto handshakes. This time for sure. :) All clients should upgrade.
o Bugfixes on 0.1.0.x:
- Fix the other half of the bug with crypto handshakes.
- Fix an assert trigger if you send a 'signal term' via the
controller when it's listening for 'event info' messages.
- Fix a critical bug in the security of our crypto handshakes.
- Fix a size_t underflow in smartlist_join_strings2() that made
it do bad things when you hand it an empty smartlist.
- Fix Windows installer to ship Tor license (thanks to Aphex for
pointing out this oversight) and put a link to the doc directory
in the start menu.
- Explicitly set no-unaligned-access for sparc: it turns out the
new gcc's let you compile broken code, but that doesn't make it
not-broken
This is a major update, too many improvements to list here, see
the ChangeLog in the distribution for details.
pkgsrc changes:
-remove dependency on tsocks; this is just one possible way to
make applications use SOCKS; add a hint to MESSAGE
-use the pkgsrc libevent - the NetBSD builtin is old, and tor
complains loudly if it doesn't like the libevent version
-make the rc.d script executable
Changes:
Bugfixes on 0.0.9.x (backported from 0.1.0.10):
- Refuse relay cells that claim to have a length larger than the
maximum allowed. This prevents a potential attack that could read
arbitrary memory (e.g. keys) from an exit server's process.
Bugfixes on 0.0.9.x:
- If unofficial Tor clients connect and send weird TLS certs, our
Tor server triggers an assert. This release contains a minimal
backport from the broader fix that we put into 0.1.0.4-rc.
Approved by <jlam>
And always is defined as share/examples/rc.d
which was the default before.
This rc.d scripts are not automatically added to PLISTs now also.
So add to each corresponding PLIST as required.
This was discussed on tech-pkg in late January and late April.
Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere
and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
- Fix another race crash bug (thanks to Glenn Fink for reporting).
- Compare identity to identity, not to nickname, when extending to
a router not already in the directory. This was preventing us from
extending to unknown routers. Oops.
- Make sure to create OS X Tor user in <500 range, so we aren't
creating actual system users.
- Note where connection-that-hasn't-sent-end was marked, and fix
a few really loud instances of this harmless bug (it's fixed more
in 0.1.0.x).
- We have a bug that I haven't found yet. Sometimes, very rarely,
cpuworkers get stuck in the 'busy' state, even though the cpuworker
thinks of itself as idle. This meant that no new circuits ever got
established. Here's a workaround to kill any cpuworker that's been
busy for more than 100 seconds.
- Add new end stream reasons to maintainance branch. Fix bug where
reason (8) could trigger an assert. Prevent bug from recurring.
- Apparently win32 stat wants paths to not end with a slash.
- Fix assert triggers in assert_cpath_layer_ok(), where we were
blowing away the circuit that conn->cpath_layer points to, then
checking to see if the circ is well-formed. Backport check to make
sure we dont use the cpath on a closed connection.
- Prevent circuit_resume_edge_reading_helper() from trying to package
inbufs for marked-for-close streams.
- Don't crash on hup if your options->address has become unresolvable.
- Some systems (like OS X) sometimes accept() a connection and tell
you the remote host is 0.0.0.0:0. If this happens, due to some
other mis-features, we get confused; so refuse the conn for now.
- Fix harmless but scary "Unrecognized content encoding" warn message.
- Add new stream error reason: TORPROTOCOL reason means "you are not
speaking a version of Tor I understand; say bye-bye to your stream."
- Be willing to cache directories from up to ROUTER_MAX_AGE seconds
into the future, now that we are more tolerant of skew. This
resolves a bug where a Tor server would refuse to cache a directory
because all the directories it gets are too far in the future;
yet the Tor server never logs any complaints about clock skew.
- Fix an assert race at exit nodes when resolve requests fail.
- Stop picking unverified dir mirrors--it only leads to misery.
- Patch from Dmitry Bely so Tor runs better as a service under
the win32 SYSTEM account. Service support is still not compiled
into the executable by default.
- Make tor-resolve actually work (?) on Win32.
- Fix a sign bug when getrlimit claims to have 4+ billion
file descriptors available.
- Stop refusing to start when bandwidthburst == bandwidthrate.
- When create cells have been on the onion queue more than five
seconds, just send back a destroy and take them off the list.
