-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathReleaseNotes
17132 lines (15493 loc) · 907 KB
/
ReleaseNotes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
This document summarizes new features and bugfixes in each stable release
of Tor. If you want to see more detailed descriptions of the changes in
each development snapshot, see the ChangeLog file.
Changes in version 0.3.2.9 - 2018-01-09
Tor 0.3.2.9 is the first stable release in the 0.3.2 series.
The 0.3.2 series includes our long-anticipated new onion service
design, with numerous security features. (For more information, see
our blog post at https://blog.torproject.org/fall-harvest.) We also
have a new circuit scheduler algorithm for improved performance on
relays everywhere (see https://blog.torproject.org/kist-and-tell),
along with many smaller features and bugfixes.
Per our stable release policy, we plan to support each stable release
series for at least the next nine months, or for three months after
the first stable release of the next series: whichever is longer. If
you need a release with long-term support, we recommend that you stay
with the 0.2.9 series.
Below is a list of the changes since 0.3.1.7. For a list of all
changes since 0.3.2.8-rc, see the ChangeLog file.
o Directory authority changes:
- Add "Bastet" as a ninth directory authority to the default list.
Closes ticket 23910.
- The directory authority "Longclaw" has changed its IP address.
Closes ticket 23592.
- Remove longclaw's IPv6 address, as it will soon change. Authority
IPv6 addresses were originally added in 0.2.8.1-alpha. This leaves
3/8 directory authorities with IPv6 addresses, but there are also
52 fallback directory mirrors with IPv6 addresses. Resolves 19760.
- Add an IPv6 address for the "bastet" directory authority. Closes
ticket 24394.
o Major features (next-generation onion services):
- Tor now supports the next-generation onion services protocol for
clients and services! As part of this release, the core of
proposal 224 has been implemented and is available for
experimentation and testing by our users. This newer version of
onion services ("v3") features many improvements over the legacy
system, including:
a) Better crypto (replaced SHA1/DH/RSA1024
with SHA3/ed25519/curve25519)
b) Improved directory protocol, leaking much less information to
directory servers.
c) Improved directory protocol, with smaller surface for
targeted attacks.
d) Better onion address security against impersonation.
e) More extensible introduction/rendezvous protocol.
f) A cleaner and more modular codebase.
You can identify a next-generation onion address by its length:
they are 56 characters long, as in
"4acth47i6kxnvkewtm6q7ib2s3ufpo5sqbsnzjpbi7utijcltosqemad.onion".
In the future, we will release more options and features for v3
onion services, but we first need a testing period, so that the
current codebase matures and becomes more robust. Planned features
include: offline keys, advanced client authorization, improved
guard algorithms, and statistics. For full details, see
proposal 224.
Legacy ("v2") onion services will still work for the foreseeable
future, and will remain the default until this new codebase gets
tested and hardened. Service operators who want to experiment with
the new system can use the 'HiddenServiceVersion 3' torrc
directive along with the regular onion service configuration
options. For more information, see our blog post at
"https://blog.torproject.org/fall-harvest". Enjoy!
o Major feature (scheduler, channel):
- Tor now uses new schedulers to decide which circuits should
deliver cells first, in order to improve congestion at relays. The
first type is called "KIST" ("Kernel Informed Socket Transport"),
and is only available on Linux-like systems: it uses feedback from
the kernel to prevent the kernel's TCP buffers from growing too
full. The second new scheduler type is called "KISTLite": it
behaves the same as KIST, but runs on systems without kernel
support for inspecting TCP implementation details. The old
scheduler is still available, under the name "Vanilla". To change
the default scheduler preference order, use the new "Schedulers"
option. (The default preference order is "KIST,KISTLite,Vanilla".)
Matt Traudt implemented KIST, based on research by Rob Jansen,
John Geddes, Christ Wacek, Micah Sherr, and Paul Syverson. For
more information, see the design paper at
http://www.robgjansen.com/publications/kist-sec2014.pdf and the
followup implementation paper at https://arxiv.org/abs/1709.01044.
Closes ticket 12541. For more information, see our blog post at
"https://blog.torproject.org/kist-and-tell".
o Major bugfixes (security, general):
- Fix a denial of service bug where an attacker could use a
malformed directory object to cause a Tor instance to pause while
OpenSSL would try to read a passphrase from the terminal. (Tor
instances run without a terminal, which is the case for most Tor
packages, are not impacted.) Fixes bug 24246; bugfix on every
version of Tor. Also tracked as TROVE-2017-011 and CVE-2017-8821.
Found by OSS-Fuzz as testcase 6360145429790720.
o Major bugfixes (security, directory authority):
- Fix a denial of service issue where an attacker could crash a
directory authority using a malformed router descriptor. Fixes bug
24245; bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2017-010
and CVE-2017-8820.
o Major bugfixes (security, onion service v2):
- Fix a use-after-free error that could crash v2 Tor onion services
when they failed to open circuits while expiring introduction
points. Fixes bug 24313; bugfix on 0.2.7.2-alpha. This issue is
also tracked as TROVE-2017-013 and CVE-2017-8823.
- When checking for replays in the INTRODUCE1 cell data for a
(legacy) onion service, correctly detect replays in the RSA-
encrypted part of the cell. We were previously checking for
replays on the entire cell, but those can be circumvented due to
the malleability of Tor's legacy hybrid encryption. This fix helps
prevent a traffic confirmation attack. Fixes bug 24244; bugfix on
0.2.4.1-alpha. This issue is also tracked as TROVE-2017-009
and CVE-2017-8819.
o Major bugfixes (security, relay):
- When running as a relay, make sure that we never build a path
through ourselves, even in the case where we have somehow lost the
version of our descriptor appearing in the consensus. Fixes part
of bug 21534; bugfix on 0.2.0.1-alpha. This issue is also tracked
as TROVE-2017-012 and CVE-2017-8822.
- When running as a relay, make sure that we never choose ourselves
as a guard. Fixes part of bug 21534; bugfix on 0.3.0.1-alpha. This
issue is also tracked as TROVE-2017-012 and CVE-2017-8822.
o Major bugfixes (bootstrapping):
- Fetch descriptors aggressively whenever we lack enough to build
circuits, regardless of how many descriptors we are missing.
Previously, we would delay launching the fetch when we had fewer
than 15 missing descriptors, even if some of those descriptors
were blocking circuits from building. Fixes bug 23985; bugfix on
0.1.1.11-alpha. The effects of this bug became worse in
0.3.0.3-alpha, when we began treating missing descriptors from our
primary guards as a reason to delay circuits.
- Don't try fetching microdescriptors from relays that have failed
to deliver them in the past. Fixes bug 23817; bugfix
on 0.3.0.1-alpha.
o Major bugfixes (circuit prediction):
- Fix circuit prediction logic so that a client doesn't treat a port
as being "handled" by a circuit if that circuit already has
isolation settings on it. This change should make Tor clients more
responsive by improving their chances of having a pre-created
circuit ready for use when a request arrives. Fixes bug 18859;
bugfix on 0.2.3.3-alpha.
o Major bugfixes (exit relays, DNS):
- Fix an issue causing DNS to fail on high-bandwidth exit nodes,
making them nearly unusable. Fixes bugs 21394 and 18580; bugfix on
0.1.2.2-alpha, which introduced eventdns. Thanks to Dhalgren for
identifying and finding a workaround to this bug and to Moritz,
Arthur Edelstein, and Roger for helping to track it down and
analyze it.
o Major bugfixes (relay, crash, assertion failure):
- Fix a timing-based assertion failure that could occur when the
circuit out-of-memory handler freed a connection's output buffer.
Fixes bug 23690; bugfix on 0.2.6.1-alpha.
o Major bugfixes (usability, control port):
- Report trusted clock skew indications as bootstrap errors, so
controllers can more easily alert users when their clocks are
wrong. Fixes bug 23506; bugfix on 0.1.2.6-alpha.
o Minor features (bridge):
- Bridge relays can now set the BridgeDistribution config option to
add a "bridge-distribution-request" line to their bridge
descriptor, which tells BridgeDB how they'd like their bridge
address to be given out. (Note that as of Oct 2017, BridgeDB does
not yet implement this feature.) As a side benefit, this feature
provides a way to distinguish bridge descriptors from non-bridge
descriptors. Implements tickets 18329.
- When handling the USERADDR command on an ExtOrPort, warn when the
transports provides a USERADDR with no port. In a future version,
USERADDR commands of this format may be rejected. Detects problems
related to ticket 23080.
o Minor features (bug detection):
- Log a warning message with a stack trace for any attempt to call
get_options() during option validation. This pattern has caused
subtle bugs in the past. Closes ticket 22281.
o Minor features (build, compilation):
- The "check-changes" feature is now part of the "make check" tests;
we'll use it to try to prevent misformed changes files from
accumulating. Closes ticket 23564.
- Tor builds should now fail if there are any mismatches between the
C type representing a configuration variable and the C type the
data-driven parser uses to store a value there. Previously, we
needed to check these by hand, which sometimes led to mistakes.
Closes ticket 23643.
o Minor features (client):
- You can now use Tor as a tunneled HTTP proxy: use the new
HTTPTunnelPort option to open a port that accepts HTTP CONNECT
requests. Closes ticket 22407.
- Add an extra check to make sure that we always use the newer guard
selection code for picking our guards. Closes ticket 22779.
- When downloading (micro)descriptors, don't split the list into
multiple requests unless we want at least 32 descriptors.
Previously, we split at 4, not 32, which led to significant
overhead in HTTP request size and degradation in compression
performance. Closes ticket 23220.
- Improve log messages when missing descriptors for primary guards.
Resolves ticket 23670.
o Minor features (command line):
- Add a new commandline option, --key-expiration, which prints when
the current signing key is going to expire. Implements ticket
17639; patch by Isis Lovecruft.
o Minor features (control port):
- If an application tries to use the control port as an HTTP proxy,
respond with a meaningful "This is the Tor control port" message,
and log the event. Closes ticket 1667. Patch from Ravi
Chandra Padmala.
- Provide better error message for GETINFO desc/(id|name) when not
fetching router descriptors. Closes ticket 5847. Patch by
Kevin Butler.
- Add GETINFO "{desc,md}/download-enabled", to inform the controller
whether Tor will try to download router descriptors and
microdescriptors respectively. Closes ticket 22684.
- Added new GETINFO targets "ip-to-country/{ipv4,ipv6}-available",
so controllers can tell whether the geoip databases are loaded.
Closes ticket 23237.
- Adds a timestamp field to the CIRC_BW and STREAM_BW bandwidth
events. Closes ticket 19254. Patch by "DonnchaC".
o Minor features (development support):
- Developers can now generate a call-graph for Tor using the
"calltool" python program, which post-processes object dumps. It
should work okay on many Linux and OSX platforms, and might work
elsewhere too. To run it, install calltool from
https://gitweb.torproject.org/user/nickm/calltool.git and run
"make callgraph". Closes ticket 19307.
o Minor features (directory authority):
- Make the "Exit" flag assignment only depend on whether the exit
policy allows connections to ports 80 and 443. Previously relays
would get the Exit flag if they allowed connections to one of
these ports and also port 6667. Resolves ticket 23637.
o Minor features (ed25519):
- Add validation function to checks for torsion components in
ed25519 public keys, used by prop224 client-side code. Closes
ticket 22006. Math help by Ian Goldberg.
o Minor features (exit relay, DNS):
- Improve the clarity and safety of the log message from evdns when
receiving an apparently spoofed DNS reply. Closes ticket 3056.
o Minor features (fallback directory mirrors):
- The fallback directory list has been re-generated based on the
current status of the network. Tor uses fallback directories to
bootstrap when it doesn't yet have up-to-date directory
information. Closes ticket 24801.
- Make the default DirAuthorityFallbackRate 0.1, so that clients
prefer to bootstrap from fallback directory mirrors. This is a
follow-up to 24679, which removed weights from the default
fallbacks. Implements ticket 24681.
o Minor features (geoip):
- Update geoip and geoip6 to the January 5 2018 Maxmind GeoLite2
Country database.
o Minor features (integration, hardening):
- Add a new NoExec option to prevent Tor from running other
programs. When this option is set to 1, Tor will never try to run
another program, regardless of the settings of
PortForwardingHelper, ClientTransportPlugin, or
ServerTransportPlugin. Once NoExec is set, it cannot be disabled
without restarting Tor. Closes ticket 22976.
o Minor features (linux seccomp2 sandbox):
- Update the sandbox rules so that they should now work correctly
with Glibc 2.26. Closes ticket 24315.
o Minor features (logging):
- Provide better warnings when the getrandom() syscall fails. Closes
ticket 24500.
- Downgrade a pair of log messages that could occur when an exit's
resolver gave us an unusual (but not forbidden) response. Closes
ticket 24097.
- Improve the message we log when re-enabling circuit build timeouts
after having received a consensus. Closes ticket 20963.
- Log more circuit information whenever we are about to try to
package a relay cell on a circuit with a nonexistent n_chan.
Attempt to diagnose ticket 8185.
- Improve info-level log identification of particular circuits, to
help with debugging. Closes ticket 23645.
- Improve the warning message for specifying a relay by nickname.
The previous message implied that nickname registration was still
part of the Tor network design, which it isn't. Closes
ticket 20488.
- If the sandbox filter fails to load, suggest to the user that
their kernel might not support seccomp2. Closes ticket 23090.
o Minor features (onion service, circuit, logging):
- Improve logging of many callsite in the circuit subsystem to print
the circuit identifier(s).
- Log when we cleanup an intro point from a service so we know when
and for what reason it happened. Closes ticket 23604.
o Minor features (portability):
- Tor now compiles correctly on arm64 with libseccomp-dev installed.
(It doesn't yet work with the sandbox enabled.) Closes
ticket 24424.
- Check at configure time whether uint8_t is the same type as
unsigned char. Lots of existing code already makes this
assumption, and there could be strict aliasing issues if the
assumption is violated. Closes ticket 22410.
o Minor features (relay):
- When choosing which circuits can be expired as unused, consider
circuits from clients even if those clients used regular CREATE
cells to make them; and do not consider circuits from relays even
if they were made with CREATE_FAST. Part of ticket 22805.
- Reject attempts to use relative file paths when RunAsDaemon is
set. Previously, Tor would accept these, but the directory-
changing step of RunAsDaemon would give strange and/or confusing
results. Closes ticket 22731.
o Minor features (relay statistics):
- Change relay bandwidth reporting stats interval from 4 hours to 24
hours in order to reduce the efficiency of guard discovery
attacks. Fixes ticket 23856.
o Minor features (reverted deprecations):
- The ClientDNSRejectInternalAddresses flag can once again be set in
non-testing Tor networks, so long as they do not use the default
directory authorities. This change also removes the deprecation of
this flag from 0.2.9.2-alpha. Closes ticket 21031.
o Minor features (robustness):
- Change several fatal assertions when flushing buffers into non-
fatal assertions, to prevent any recurrence of 23690.
o Minor features (startup, safety):
- When configured to write a PID file, Tor now exits if it is unable
to do so. Previously, it would warn and continue. Closes
ticket 20119.
o Minor features (static analysis):
- The BUG() macro has been changed slightly so that Coverity no
longer complains about dead code if the bug is impossible. Closes
ticket 23054.
o Minor features (testing):
- Our fuzzing tests now test the encrypted portions of v3 onion
service descriptors. Implements more of 21509.
- Add a unit test to make sure that our own generated platform
string will be accepted by directory authorities. Closes
ticket 22109.
- The default chutney network tests now include tests for the v3
onion service design. Make sure you have the latest version of
chutney if you want to run these. Closes ticket 22437.
- Add a unit test to verify that we can parse a hardcoded v2 onion
service descriptor. Closes ticket 15554.
o Minor bugfixes (address selection):
- When the fascist_firewall_choose_address_ functions don't find a
reachable address, set the returned address to the null address
and port. This is a precautionary measure, because some callers do
not check the return value. Fixes bug 24736; bugfix
on 0.2.8.2-alpha.
o Minor bugfixes (bootstrapping):
- When warning about state file clock skew, report the correct
direction for the detected skew. Fixes bug 23606; bugfix
on 0.2.8.1-alpha.
o Minor bugfixes (bridge clients, bootstrap):
- Retry directory downloads when we get our first bridge descriptor
during bootstrap or while reconnecting to the network. Keep
retrying every time we get a bridge descriptor, until we have a
reachable bridge. Fixes part of bug 24367; bugfix on 0.2.0.3-alpha.
- Stop delaying bridge descriptor fetches when we have cached bridge
descriptors. Instead, only delay bridge descriptor fetches when we
have at least one reachable bridge. Fixes part of bug 24367;
bugfix on 0.2.0.3-alpha.
- Stop delaying directory fetches when we have cached bridge
descriptors. Instead, only delay bridge descriptor fetches when
all our bridges are definitely unreachable. Fixes part of bug
24367; bugfix on 0.2.0.3-alpha.
o Minor bugfixes (bridge):
- Overwrite the bridge address earlier in the process of retrieving
its descriptor, to make sure we reach it on the configured
address. Fixes bug 20532; bugfix on 0.2.0.10-alpha.
o Minor bugfixes (build, compilation):
- Fix a compilation warning when building with zstd support on
32-bit platforms. Fixes bug 23568; bugfix on 0.3.1.1-alpha. Found
and fixed by Andreas Stieger.
- When searching for OpenSSL, don't accept any OpenSSL library that
lacks TLSv1_1_method(): Tor doesn't build with those versions.
Additionally, look in /usr/local/opt/openssl, if it's present.
These changes together repair the default build on OSX systems
with Homebrew installed. Fixes bug 23602; bugfix on 0.2.7.2-alpha.
- Fix a signed/unsigned comparison warning introduced by our fix to
TROVE-2017-009. Fixes bug 24480; bugfix on 0.2.5.16.
- Fix a memory leak warning in one of the libevent-related
configuration tests that could occur when manually specifying
-fsanitize=address. Fixes bug 24279; bugfix on 0.3.0.2-alpha.
Found and patched by Alex Xu.
- Fix unused-variable warnings in donna's Curve25519 SSE2 code.
Fixes bug 22895; bugfix on 0.2.7.2-alpha.
o Minor bugfixes (certificate handling):
- Fix a time handling bug in Tor certificates set to expire after
the year 2106. Fixes bug 23055; bugfix on 0.3.0.1-alpha. Found by
Coverity as CID 1415728.
o Minor bugfixes (client):
- By default, do not enable storage of client-side DNS values. These
values were unused by default previously, but they should not have
been cached at all. Fixes bug 24050; bugfix on 0.2.6.3-alpha.
o Minor bugfixes (client, usability):
- Refrain from needlessly rejecting SOCKS5-with-hostnames and
SOCKS4a requests that contain IP address strings, even when
SafeSocks in enabled, as this prevents user from connecting to
known IP addresses without relying on DNS for resolving. SafeSocks
still rejects SOCKS connections that connect to IP addresses when
those addresses are _not_ encoded as hostnames. Fixes bug 22461;
bugfix on Tor 0.2.6.2-alpha.
o Minor bugfixes (code correctness):
- Call htons() in extend_cell_format() for encoding a 16-bit value.
Previously we used ntohs(), which happens to behave the same on
all the platforms we support, but which isn't really correct.
Fixes bug 23106; bugfix on 0.2.4.8-alpha.
- For defense-in-depth, make the controller's write_escaped_data()
function robust to extremely long inputs. Fixes bug 19281; bugfix
on 0.1.1.1-alpha. Reported by Guido Vranken.
- Fix several places in our codebase where a C compiler would be
likely to eliminate a check, based on assuming that undefined
behavior had not happened elsewhere in the code. These cases are
usually a sign of redundant checking or dubious arithmetic. Found
by Georg Koppen using the "STACK" tool from Wang, Zeldovich,
Kaashoek, and Solar-Lezama. Fixes bug 24423; bugfix on various
Tor versions.
o Minor bugfixes (compression):
- Handle a pathological case when decompressing Zstandard data when
the output buffer size is zero. Fixes bug 23551; bugfix
on 0.3.1.1-alpha.
o Minor bugfixes (consensus expiry):
- Check for adequate directory information correctly. Previously, Tor
would reconsider whether it had sufficient directory information
every 2 minutes. Fixes bug 23091; bugfix on 0.2.0.19-alpha.
o Minor bugfixes (control port, linux seccomp2 sandbox):
- Avoid a crash when attempting to use the seccomp2 sandbox together
with the OwningControllerProcess feature. Fixes bug 24198; bugfix
on 0.2.5.1-alpha.
o Minor bugfixes (control port, onion services):
- Report "FAILED" instead of "UPLOAD_FAILED" "FAILED" for the
HS_DESC event when a service is not able to upload a descriptor.
Fixes bug 24230; bugfix on 0.2.7.1-alpha.
o Minor bugfixes (directory cache):
- Recover better from empty or corrupt files in the consensus cache
directory. Fixes bug 24099; bugfix on 0.3.1.1-alpha.
- When a consensus diff calculation is only partially successful,
only record the successful parts as having succeeded. Partial
success can happen if (for example) one compression method fails
but the others succeed. Previously we misrecorded all the
calculations as having succeeded, which would later cause a
nonfatal assertion failure. Fixes bug 24086; bugfix
on 0.3.1.1-alpha.
o Minor bugfixes (directory client):
- On failure to download directory information, delay retry attempts
by a random amount based on the "decorrelated jitter" algorithm.
Our previous delay algorithm tended to produce extra-long delays
too easily. Fixes bug 23816; bugfix on 0.2.9.1-alpha.
o Minor bugfixes (directory protocol):
- Directory servers now include a "Date:" http header for response
codes other than 200. Clients starting with a skewed clock and a
recent consensus were getting "304 Not modified" responses from
directory authorities, so without the Date header, the client
would never hear about a wrong clock. Fixes bug 23499; bugfix
on 0.0.8rc1.
- Make clients wait for 6 seconds before trying to download a
consensus from an authority. Fixes bug 17750; bugfix
on 0.2.8.1-alpha.
o Minor bugfixes (documentation):
- Document better how to read gcov, and what our gcov postprocessing
scripts do. Fixes bug 23739; bugfix on 0.2.9.1-alpha.
- Fix manpage to not refer to the obsolete (and misspelled)
UseEntryGuardsAsDirectoryGuards parameter in the description of
NumDirectoryGuards. Fixes bug 23611; bugfix on 0.2.4.8-alpha.
o Minor bugfixes (DoS-resistance):
- If future code asks if there are any running bridges, without
checking if bridges are enabled, log a BUG warning rather than
crashing. Fixes bug 23524; bugfix on 0.3.0.1-alpha.
o Minor bugfixes (entry guards):
- Tor now updates its guard state when it reads a consensus
regardless of whether it's missing descriptors. That makes tor use
its primary guards to fetch descriptors in some edge cases where
it would previously have used fallback directories. Fixes bug
23862; bugfix on 0.3.0.1-alpha.
o Minor bugfixes (format strictness):
- Restrict several data formats to decimal. Previously, the
BuildTimeHistogram entries in the state file, the "bw=" entries in
the bandwidth authority file, and the process IDs passed to the
__OwningControllerProcess option could all be specified in hex or
octal as well as in decimal. This was not an intentional feature.
Fixes bug 22802; bugfixes on 0.2.2.1-alpha, 0.2.2.2-alpha,
and 0.2.2.28-beta.
o Minor bugfixes (heartbeat):
- If we fail to write a heartbeat message, schedule a retry for the
minimum heartbeat interval number of seconds in the future. Fixes
bug 19476; bugfix on 0.2.3.1-alpha.
o Minor bugfixes (logging):
- Suppress a log notice when relay descriptors arrive. We already
have a bootstrap progress for this so no need to log notice
everytime tor receives relay descriptors. Microdescriptors behave
the same. Fixes bug 23861; bugfix on 0.2.8.2-alpha.
- Remove duplicate log messages regarding opening non-local
SocksPorts upon parsing config and opening listeners at startup.
Fixes bug 4019; bugfix on 0.2.3.3-alpha.
- Use a more comprehensible log message when telling the user
they've excluded every running exit node. Fixes bug 7890; bugfix
on 0.2.2.25-alpha.
- When logging the number of descriptors we intend to download per
directory request, do not log a number higher than then the number
of descriptors we're fetching in total. Fixes bug 19648; bugfix
on 0.1.1.8-alpha.
- When warning about a directory owned by the wrong user, log the
actual name of the user owning the directory. Previously, we'd log
the name of the process owner twice. Fixes bug 23487; bugfix
on 0.2.9.1-alpha.
- Fix some messages on unexpected errors from the seccomp2 library.
Fixes bug 22750; bugfix on 0.2.5.1-alpha. Patch from "cypherpunks".
- The tor specification says hop counts are 1-based, so fix two log
messages that mistakenly logged 0-based hop counts. Fixes bug
18982; bugfix on 0.2.6.2-alpha and 0.2.4.5-alpha. Patch by teor.
Credit to Xiaofan Li for reporting this issue.
o Minor bugfixes (logging, relay shutdown, annoyance):
- When a circuit is marked for close, do not attempt to package any
cells for channels on that circuit. Previously, we would detect
this condition lower in the call stack, when we noticed that the
circuit had no attached channel, and log an annoying message.
Fixes bug 8185; bugfix on 0.2.5.4-alpha.
o Minor bugfixes (memory safety, defensive programming):
- Clear the target address when node_get_prim_orport() returns
early. Fixes bug 23874; bugfix on 0.2.8.2-alpha.
o Minor bugfixes (memory usage):
- When queuing DESTROY cells on a channel, only queue the circuit-id
and reason fields: not the entire 514-byte cell. This fix should
help mitigate any bugs or attacks that fill up these queues, and
free more RAM for other uses. Fixes bug 24666; bugfix
on 0.2.5.1-alpha.
o Minor bugfixes (network layer):
- When closing a connection via close_connection_immediately(), we
mark it as "not blocked on bandwidth", to prevent later calls from
trying to unblock it, and give it permission to read. This fixes a
backtrace warning that can happen on relays under various
circumstances. Fixes bug 24167; bugfix on 0.1.0.1-rc.
o Minor bugfixes (onion services):
- The introduction circuit was being timed out too quickly while
waiting for the rendezvous circuit to complete. Keep the intro
circuit around longer instead of timing out and reopening new ones
constantly. Fixes bug 23681; bugfix on 0.2.4.8-alpha.
- Rename the consensus parameter "hsdir-interval" to "hsdir_interval"
so it matches dir-spec.txt. Fixes bug 24262; bugfix
on 0.3.1.1-alpha.
- When handling multiple SOCKS request for the same .onion address,
only fetch the service descriptor once.
- Avoid a possible double close of a circuit by the intro point on
error of sending the INTRO_ESTABLISHED cell. Fixes bug 23610;
bugfix on 0.3.0.1-alpha.
- When reloading configured onion services, copy all information
from the old service object. Previously, some data was omitted,
causing delays in descriptor upload, and other bugs. Fixes bug
23790; bugfix on 0.2.1.9-alpha.
o Minor bugfixes (path selection):
- When selecting relays by bandwidth, avoid a rounding error that
could sometimes cause load to be imbalanced incorrectly.
Previously, we would always round upwards; now, we round towards
the nearest integer. This had the biggest effect when a relay's
weight adjustments should have given it weight 0, but it got
weight 1 instead. Fixes bug 23318; bugfix on 0.2.4.3-alpha.
- When calculating the fraction of nodes that have descriptors, and
all nodes in the network have zero bandwidths, count the number of
nodes instead. Fixes bug 23318; bugfix on 0.2.4.10-alpha.
- Actually log the total bandwidth in compute_weighted_bandwidths().
Fixes bug 24170; bugfix on 0.2.4.3-alpha.
o Minor bugfixes (portability):
- Stop using the PATH_MAX variable, which is not defined on GNU
Hurd. Fixes bug 23098; bugfix on 0.3.1.1-alpha.
- Fix a bug in the bit-counting parts of our timing-wheel code on
MSVC. (Note that MSVC is still not a supported build platform, due
to cyptographic timing channel risks.) Fixes bug 24633; bugfix
on 0.2.9.1-alpha.
o Minor bugfixes (relay):
- When uploading our descriptor for the first time after startup,
report the reason for uploading as "Tor just started" rather than
leaving it blank. Fixes bug 22885; bugfix on 0.2.3.4-alpha.
- Avoid unnecessary calls to directory_fetches_from_authorities() on
relays, to prevent spurious address resolutions and descriptor
rebuilds. This is a mitigation for bug 21789. Fixes bug 23470;
bugfix on in 0.2.8.1-alpha.
- Avoid a crash when transitioning from client mode to bridge mode.
Previously, we would launch the worker threads whenever our
"public server" mode changed, but not when our "server" mode
changed. Fixes bug 23693; bugfix on 0.2.6.3-alpha.
o Minor bugfixes (testing):
- Fix a spurious fuzzing-only use of an uninitialized value. Found
by Brian Carpenter. Fixes bug 24082; bugfix on 0.3.0.3-alpha.
- Test that IPv6-only clients can use microdescriptors when running
"make test-network-all". Requires chutney master 61c28b9 or later.
Closes ticket 24109.
- Prevent scripts/test/coverage from attempting to move gcov output
to the root directory. Fixes bug 23741; bugfix on 0.2.5.1-alpha.
- Capture and detect several "Result does not fit" warnings in unit
tests on platforms with 32-bit time_t. Fixes bug 21800; bugfix
on 0.2.9.3-alpha.
- Fix additional channelpadding unit test failures by using mocked
time instead of actual time for all tests. Fixes bug 23608; bugfix
on 0.3.1.1-alpha.
- Fix a bug in our fuzzing mock replacement for crypto_pk_checksig(),
to correctly handle cases where a caller gives it an RSA key of
under 160 bits. (This is not actually a bug in Tor itself, but
rather in our fuzzing code.) Fixes bug 24247; bugfix on
0.3.0.3-alpha. Found by OSS-Fuzz as issue 4177.
- Fix a broken unit test for the OutboundAddress option: the parsing
function was never returning an error on failure. Fixes bug 23366;
bugfix on 0.3.0.3-alpha.
- Fix a signed-integer overflow in the unit tests for
dir/download_status_random_backoff, which was untriggered until we
fixed bug 17750. Fixes bug 22924; bugfix on 0.2.9.1-alpha.
o Minor bugfixes (usability, control port):
- Stop making an unnecessary routerlist check in NETINFO clock skew
detection; this was preventing clients from reporting NETINFO clock
skew to controllers. Fixes bug 23532; bugfix on 0.2.4.4-alpha.
o Code simplification and refactoring:
- Remove various ways of testing circuits and connections for
"clientness"; instead, favor channel_is_client(). Part of
ticket 22805.
- Extract the code for handling newly-open channels into a separate
function from the general code to handle channel state
transitions. This change simplifies our callgraph, reducing the
size of the largest strongly connected component by roughly a
factor of two. Closes ticket 22608.
- Remove dead code for largely unused statistics on the number of
times we've attempted various public key operations. Fixes bug
19871; bugfix on 0.1.2.4-alpha. Fix by Isis Lovecruft.
- Remove several now-obsolete functions for asking about old
variants directory authority status. Closes ticket 22311; patch
from "huyvq".
- Remove some of the code that once supported "Named" and "Unnamed"
routers. Authorities no longer vote for these flags. Closes
ticket 22215.
- Rename the obsolete malleable hybrid_encrypt functions used in TAP
and old hidden services, to indicate that they aren't suitable for
new protocols or formats. Closes ticket 23026.
- Replace our STRUCT_OFFSET() macro with offsetof(). Closes ticket
22521. Patch from Neel Chauhan.
- Split the enormous circuit_send_next_onion_skin() function into
multiple subfunctions. Closes ticket 22804.
- Split the portions of the buffer.c module that handle particular
protocols into separate modules. Part of ticket 23149.
- Use our test macros more consistently, to produce more useful
error messages when our unit tests fail. Add coccinelle patches to
allow us to re-check for test macro uses. Closes ticket 22497.
o Deprecated features:
- The ReachableDirAddresses and ClientPreferIPv6DirPort options are
now deprecated; they do not apply to relays, and they have had no
effect on clients since 0.2.8.x. Closes ticket 19704.
- Deprecate HTTPProxy/HTTPProxyAuthenticator config options. They
only applies to direct unencrypted HTTP connections to your
directory server, which your Tor probably isn't using. Closes
ticket 20575.
o Documentation:
- Add notes in man page regarding OS support for the various
scheduler types. Attempt to use less jargon in the scheduler
section. Closes ticket 24254.
- Clarify that the Address option is entirely about setting an
advertised IPv4 address. Closes ticket 18891.
- Clarify the manpage's use of the term "address" to clarify what
kind of address is intended. Closes ticket 21405.
- Document that onion service subdomains are allowed, and ignored.
Closes ticket 18736.
- Clarify in the manual that "Sandbox 1" is only supported on Linux
kernels. Closes ticket 22677.
- Document all values of PublishServerDescriptor in the manpage.
Closes ticket 15645.
- Improve the documentation for the directory port part of the
DirAuthority line. Closes ticket 20152.
- Restore documentation for the authorities' "approved-routers"
file. Closes ticket 21148.
o Removed features:
- The AllowDotExit option has been removed as unsafe. It has been
deprecated since 0.2.9.2-alpha. Closes ticket 23426.
- The ClientDNSRejectInternalAddresses flag can no longer be set on
non-testing networks. It has been deprecated since 0.2.9.2-alpha.
Closes ticket 21031.
- The controller API no longer includes an AUTHDIR_NEWDESCS event:
nobody was using it any longer. Closes ticket 22377.
Changes in version 0.2.8.15 - 2017-09-18
Tor 0.2.8.15 backports a collection of bugfixes from later
Tor series.
Most significantly, it includes a fix for TROVE-2017-008, a
security bug that affects hidden services running with the
SafeLogging option disabled. For more information, see
https://trac.torproject.org/projects/tor/ticket/23490
Note that Tor 0.2.8.x will no longer be supported after 1 Jan
2018. We suggest that you upgrade to the latest stable release if
possible. If you can't, we recommend that you upgrade at least to
0.2.9, which will be supported until 2020.
o Major bugfixes (openbsd, denial-of-service, backport from 0.3.1.5-alpha):
- Avoid an assertion failure bug affecting our implementation of
inet_pton(AF_INET6) on certain OpenBSD systems whose strtol()
handling of "0xx" differs from what we had expected. Fixes bug
22789; bugfix on 0.2.3.8-alpha. Also tracked as TROVE-2017-007.
o Minor features:
- Update geoip and geoip6 to the September 6 2017 Maxmind GeoLite2
Country database.
o Minor bugfixes (compilation, mingw, backport from 0.3.1.1-alpha):
- Backport a fix for an "unused variable" warning that appeared
in some versions of mingw. Fixes bug 22838; bugfix on
0.2.8.1-alpha.
o Minor bugfixes (defensive programming, undefined behavior, backport from 0.3.1.4-alpha):
- Fix a memset() off the end of an array when packing cells. This
bug should be harmless in practice, since the corrupted bytes are
still in the same structure, and are always padding bytes,
ignored, or immediately overwritten, depending on compiler
behavior. Nevertheless, because the memset()'s purpose is to make
sure that any other cell-handling bugs can't expose bytes to the
network, we need to fix it. Fixes bug 22737; bugfix on
0.2.4.11-alpha. Fixes CID 1401591.
o Build features (backport from 0.3.1.5-alpha):
- Tor's repository now includes a Travis Continuous Integration (CI)
configuration file (.travis.yml). This is meant to help new
developers and contributors who fork Tor to a Github repository be
better able to test their changes, and understand what we expect
to pass. To use this new build feature, you must fork Tor to your
Github account, then go into the "Integrations" menu in the
repository settings for your fork and enable Travis, then push
your changes. Closes ticket 22636.
Changes in version 0.2.9.12 - 2017-09-18
Tor 0.2.9.12 backports a collection of bugfixes from later
Tor series.
Most significantly, it includes a fix for TROVE-2017-008, a
security bug that affects hidden services running with the
SafeLogging option disabled. For more information, see
https://trac.torproject.org/projects/tor/ticket/23490
o Major features (security, backport from 0.3.0.2-alpha):
- Change the algorithm used to decide DNS TTLs on client and server
side, to better resist DNS-based correlation attacks like the
DefecTor attack of Greschbach, Pulls, Roberts, Winter, and
Feamster. Now relays only return one of two possible DNS TTL
values, and clients are willing to believe DNS TTL values up to 3
hours long. Closes ticket 19769.
o Major bugfixes (crash, directory connections, backport from 0.3.0.5-rc):
- Fix a rare crash when sending a begin cell on a circuit whose
linked directory connection had already been closed. Fixes bug
21576; bugfix on 0.2.9.3-alpha. Reported by Alec Muffett.
o Major bugfixes (DNS, backport from 0.3.0.2-alpha):
- Fix a bug that prevented exit nodes from caching DNS records for
more than 60 seconds. Fixes bug 19025; bugfix on 0.2.4.7-alpha.
o Major bugfixes (linux TPROXY support, backport from 0.3.1.1-alpha):
- Fix a typo that had prevented TPROXY-based transparent proxying
from working under Linux. Fixes bug 18100; bugfix on 0.2.6.3-alpha.
Patch from "d4fq0fQAgoJ".
o Major bugfixes (openbsd, denial-of-service, backport from 0.3.1.5-alpha):
- Avoid an assertion failure bug affecting our implementation of
inet_pton(AF_INET6) on certain OpenBSD systems whose strtol()
handling of "0xx" differs from what we had expected. Fixes bug
22789; bugfix on 0.2.3.8-alpha. Also tracked as TROVE-2017-007.
o Minor features (code style, backport from 0.3.1.3-alpha):
- Add "Falls through" comments to our codebase, in order to silence
GCC 7's -Wimplicit-fallthrough warnings. Patch from Andreas
Stieger. Closes ticket 22446.
o Minor features (geoip):
- Update geoip and geoip6 to the September 6 2017 Maxmind GeoLite2
Country database.
o Minor bugfixes (bandwidth accounting, backport from 0.3.1.1-alpha):
- Roll over monthly accounting at the configured hour and minute,
rather than always at 00:00. Fixes bug 22245; bugfix on 0.0.9rc1.
Found by Andrey Karpov with PVS-Studio.
o Minor bugfixes (compilation, backport from 0.3.1.5-alpha):
- Suppress -Wdouble-promotion warnings with clang 4.0. Fixes bug 22915;
bugfix on 0.2.8.1-alpha.
- Fix warnings when building with libscrypt and openssl scrypt support
on Clang. Fixes bug 22916; bugfix on 0.2.7.2-alpha.
- When building with certain versions the mingw C header files, avoid
float-conversion warnings when calling the C functions isfinite(),
isnan(), and signbit(). Fixes bug 22801; bugfix on 0.2.8.1-alpha.
o Minor bugfixes (compilation, backport from 0.3.1.7):
- Avoid compiler warnings in the unit tests for running tor_sscanf()
with wide string outputs. Fixes bug 15582; bugfix on 0.2.6.2-alpha.
o Minor bugfixes (compilation, mingw, backport from 0.3.1.1-alpha):
- Backport a fix for an "unused variable" warning that appeared
in some versions of mingw. Fixes bug 22838; bugfix on
0.2.8.1-alpha.
o Minor bugfixes (controller, backport from 0.3.1.7):
- Do not crash when receiving a HSPOST command with an empty body.
Fixes part of bug 22644; bugfix on 0.2.7.1-alpha.
- Do not crash when receiving a POSTDESCRIPTOR command with an
empty body. Fixes part of bug 22644; bugfix on 0.2.0.1-alpha.
o Minor bugfixes (coverity build support, backport from 0.3.1.5-alpha):
- Avoid Coverity build warnings related to our BUG() macro. By
default, Coverity treats BUG() as the Linux kernel does: an
instant abort(). We need to override that so our BUG() macro
doesn't prevent Coverity from analyzing functions that use it.
Fixes bug 23030; bugfix on 0.2.9.1-alpha.
o Minor bugfixes (defensive programming, undefined behavior, backport from 0.3.1.4-alpha):
- Fix a memset() off the end of an array when packing cells. This
bug should be harmless in practice, since the corrupted bytes are
still in the same structure, and are always padding bytes,
ignored, or immediately overwritten, depending on compiler
behavior. Nevertheless, because the memset()'s purpose is to make
sure that any other cell-handling bugs can't expose bytes to the
network, we need to fix it. Fixes bug 22737; bugfix on
0.2.4.11-alpha. Fixes CID 1401591.
o Minor bugfixes (file limits, osx, backport from 0.3.1.5-alpha):
- When setting the maximum number of connections allowed by the OS,
always allow some extra file descriptors for other files. Fixes
bug 22797; bugfix on 0.2.0.10-alpha.
o Minor bugfixes (linux seccomp2 sandbox, backport from 0.3.1.5-alpha):
- Avoid a sandbox failure when trying to re-bind to a socket and
mark it as IPv6-only. Fixes bug 20247; bugfix on 0.2.5.1-alpha.
o Minor bugfixes (linux seccomp2 sandbox, backport from 0.3.1.4-alpha):
- Permit the fchmod system call, to avoid crashing on startup when
starting with the seccomp2 sandbox and an unexpected set of
permissions on the data directory or its contents. Fixes bug
22516; bugfix on 0.2.5.4-alpha.
o Minor bugfixes (relay, backport from 0.3.0.5-rc):
- Avoid a double-marked-circuit warning that could happen when we
receive DESTROY cells under heavy load. Fixes bug 20059; bugfix
on 0.1.0.1-rc.
o Minor bugfixes (voting consistency, backport from 0.3.1.1-alpha):
- Reject version numbers with non-numeric prefixes (such as +, -, or
whitespace). Disallowing whitespace prevents differential version
parsing between POSIX-based and Windows platforms. Fixes bug 21507
and part of 21508; bugfix on 0.0.8pre1.
o Build features (backport from 0.3.1.5-alpha):
- Tor's repository now includes a Travis Continuous Integration (CI)
configuration file (.travis.yml). This is meant to help new
developers and contributors who fork Tor to a Github repository be
better able to test their changes, and understand what we expect
to pass. To use this new build feature, you must fork Tor to your
Github account, then go into the "Integrations" menu in the
repository settings for your fork and enable Travis, then push
your changes. Closes ticket 22636.
Changes in version 0.3.0.11 - 2017-09-18
Tor 0.3.0.11 backports a collection of bugfixes from Tor the 0.3.1
series.
Most significantly, it includes a fix for TROVE-2017-008, a
security bug that affects hidden services running with the
SafeLogging option disabled. For more information, see
https://trac.torproject.org/projects/tor/ticket/23490
o Minor features (code style, backport from 0.3.1.7):
- Add "Falls through" comments to our codebase, in order to silence
GCC 7's -Wimplicit-fallthrough warnings. Patch from Andreas
Stieger. Closes ticket 22446.
o Minor features:
- Update geoip and geoip6 to the September 6 2017 Maxmind GeoLite2
Country database.
o Minor bugfixes (compilation, backport from 0.3.1.7):
- Avoid compiler warnings in the unit tests for calling tor_sscanf()
with wide string outputs. Fixes bug 15582; bugfix on 0.2.6.2-alpha.
o Minor bugfixes (controller, backport from 0.3.1.7):
- Do not crash when receiving a HSPOST command with an empty body.
Fixes part of bug 22644; bugfix on 0.2.7.1-alpha.
- Do not crash when receiving a POSTDESCRIPTOR command with an empty
body. Fixes part of bug 22644; bugfix on 0.2.0.1-alpha.
o Minor bugfixes (file limits, osx, backport from 0.3.1.5-alpha):
- When setting the maximum number of connections allowed by the OS,
always allow some extra file descriptors for other files. Fixes
bug 22797; bugfix on 0.2.0.10-alpha.
o Minor bugfixes (logging, relay, backport from 0.3.1.6-rc):
- Remove a forgotten debugging message when an introduction point
successfully establishes a hidden service prop224 circuit with
a client.
- Change three other log_warn() for an introduction point to
protocol warnings, because they can be failure from the network
and are not relevant to the operator. Fixes bug 23078; bugfix on
0.3.0.1-alpha and 0.3.0.2-alpha.
Changes in version 0.3.1.7 - 2017-09-18
Tor 0.3.1.7 is the first stable release in the 0.3.1 series.
With the 0.3.1 series, Tor now serves and downloads directory
information in more compact formats, to save on bandwidth overhead. It
also contains a new padding system to resist netflow-based traffic
analysis, and experimental support for building parts of Tor in Rust
(though no parts of Tor are in Rust yet). There are also numerous
small features, bugfixes on earlier release series, and groundwork for
the hidden services revamp of 0.3.2.
This release also includes a fix for TROVE-2017-008, a security bug
that affects hidden services running with the SafeLogging option
disabled. For more information, see
https://trac.torproject.org/projects/tor/ticket/23490
Per our stable release policy, we plan to support each stable release
series for at least the next nine months, or for three months after
the first stable release of the next series: whichever is longer. If
you need a release with long-term support, we recommend that you stay
with the 0.2.9 series.
Below is a list of the changes since 0.3.0. For a list of all
changes since 0.3.1.6-rc, see the ChangeLog file.
o New dependencies:
- To build with zstd and lzma support, Tor now requires the
pkg-config tool at build time.
o Major bugfixes (security, hidden services, loggging):
- Fix a bug where we could log uninitialized stack when a certain
hidden service error occurred while SafeLogging was disabled.
Fixes bug #23490; bugfix on 0.2.7.2-alpha.
This is also tracked as TROVE-2017-008 and CVE-2017-0380.
o Major features (build system, continuous integration):
- Tor's repository now includes a Travis Continuous Integration (CI)
configuration file (.travis.yml). This is meant to help new
developers and contributors who fork Tor to a Github repository be