ChangeLog

Changes in version 0.1.2.7-alpha - 2007-??-??
  o Major bugfixes (rate limiting):
    - Servers decline directory requests much more aggressively when
      they're low on bandwidth. Otherwise they end up queueing more and
      more directory responses, which can't be good for latency.
    - But never refuse directory requests from local addresses.
    - Be willing to read or write on local connections (e.g. controller
      connections) even when the global rate limiting buckets are empty.
    - If our system clock jumps back in time, don't publish a negative
      uptime in the descriptor. Also, don't let the global rate limiting
      buckets go absurdly negative.
    - Flush local controller connection buffers periodically as we're
      writing to them, so we avoid queueing 4+ megabytes of data before
      trying to flush.

  o Major bugfixes (other):
    - Fix a crash bug in the presence of DNS hijacking (reported by Andrew
      Del Vecchio).
    - Previously, we would cache up to 16 old networkstatus documents
      indefinitely, if they came from nontrusted authorities. Now we
      discard them if they are more than 10 days old.
    - Detect and reject malformed DNS responses containing circular
      pointer loops.
    - Fix a memory leak when sending a 503 response for a networkstatus
      request.
    - If we're not marking exits as guards, ignore exit bandwidth
      when we're deciding the required bandwidth to become a guard.

  o Minor bugfixes:
    - When computing clock skew from directory HTTP headers, consider what
      time it was when we finished asking for the directory, not what
      time it is now.
    - Add some defensive programming to eventdns.c in an attempt to catch
      possible memory-stomping bugs.
    - Fix crash with "tor --list-fingerprint" (reported by seeess).
    - Expire socks connections if they spend too long waiting for the
      handshake to finish. Previously we would let them sit around for
      days, if the connecting application didn't close them either.
    - And if the socks handshake hasn't started, don't send a
      "DNS resolve socks failed" handshake reply; just close it.
    - Stop using C functions that OpenBSD's linker doesn't like.
    - Detect and reject DNS replies containing IPv4 or IPv6 records with
      an incorrect number of bytes. (Previously, we would ignore the
      extra bytes.)
    - Fix as-yet-unused reverse IPv6 lookup code so it sends nybbles
      in the correct order, and doesn't crash.
    - Free memory held in recently-completed DNS lookup attempts on exit.
      This was not a memory leak, but may have been hiding memory leaks.
    - Don't launch requests for descriptors unless we have networkstatuses
      from at least half of the authorities.  This delays the first
      download slightly under pathological circumstances, but can prevent
      us from downloading a bunch of descriptors we don't need.
    - Do not log IPs with TLS failures for incoming TLS
      connections. (Fixes bug 382.)
    - When we're handling a directory connection tunneled over Tor,
      don't fill up internal memory buffers with all the data we want
      to tunnel; instead, only add it if the OR connection that will
      eventually receive it has some room for it. (This can lead to
      slowdowns in tunneled dir connections; a better solution will have
      to wait for 0.2.0.)
    - If the user asks to use invalid exit nodes, be willing to use the
      unstable ones.
    - Handle TTL values correctly on reverse DNS lookups.
    - Stop using the reserved ac_cv namespace in our configure script.
    - Call stat() slightly less often; use fstat() when possible.
    - Treat failure to parse resolv.conf as an error.

  o Major features:
    - Weight directory requests by advertised bandwidth. Now we can
      let servers enable write limiting but still allow most clients to
      succeed at their directory requests.

  o Minor features:
    - Create a new file ReleaseNotes which was the old ChangeLog. The
      new ChangeLog file now includes the summaries for even development
      versions.
    - Check for addresses with invalid characters at the exit as well
      as at the client, and warn less verbosely when they fail. You can
      override this by setting ServerDNSAllowNonRFC953Addresses to 1.
    - Adapt a patch from goodell to let the contrib/exitlist script
      take arguments rather than require direct editing.
    - Inform the server operator when we decide not to advertise a
      DirPort due to AccountingMax enabled or a low BandwidthRate. It
      was confusing Zax, so now we're hopefully more helpful.
    - Bring us one step closer to being able to establish an encrypted
      directory tunnel without knowing a descriptor first. Still not
      ready yet. As part of the change, now assume we can use a
      create_fast cell if we don't know anything about a router.
    - Allow exit nodes to use nameservers running on ports other than 53.
    - Servers now cache reverse DNS replies.

  o Minor features (controller):
    - Track reasons for OR connection failure; make these reasons
      available via the controller interface. (Patch from Mike Perry.)
    - Add a SOCKS_BAD_HOSTNAME client status event so controllers
      can learn when clients are sending malformed hostnames to Tor.
    - Clean up documentation for controller status events.


Changes in version 0.1.2.6-alpha - 2007-01-09
  o Major bugfixes:
    - Fix an assert error introduced in 0.1.2.5-alpha: if a single TLS
      connection handles more than 4 gigs in either direction, we crash.
    - Fix an assert error introduced in 0.1.2.5-alpha: if we're an
      advertised exit node, somebody might try to exit from us when
      we're bootstrapping and before we've built your descriptor yet.
      Refuse the connection rather than crashing.

  o Minor bugfixes:
    - Warn if we (as a server) find that we've resolved an address that we
      weren't planning to resolve.
    - Warn that using select() on any libevent version before 1.1 will be
      unnecessarily slow (even for select()).
    - Flush ERR-level controller status events just like we currently
      flush ERR-level log events, so that a Tor shutdown doesn't prevent
      the controller from learning about current events.

  o Minor features (more controller status events):
    - Implement EXTERNAL_ADDRESS server status event so controllers can
      learn when our address changes.
    - Implement BAD_SERVER_DESCRIPTOR server status event so controllers
      can learn when directories reject our descriptor.
    - Implement SOCKS_UNKNOWN_PROTOCOL client status event so controllers
      can learn when a client application is speaking a non-socks protocol
      to our SocksPort.
    - Implement DANGEROUS_SOCKS client status event so controllers
      can learn when a client application is leaking DNS addresses.
    - Implement BUG general status event so controllers can learn when
      Tor is unhappy about its internal invariants.
    - Implement CLOCK_SKEW general status event so controllers can learn
      when Tor thinks the system clock is set incorrectly.
    - Implement GOOD_SERVER_DESCRIPTOR and ACCEPTED_SERVER_DESCRIPTOR
      server status events so controllers can learn when their descriptors
      are accepted by a directory.
    - Implement CHECKING_REACHABILITY and REACHABILITY_{SUCCEEDED|FAILED}
      server status events so controllers can learn about Tor's progress in
      deciding whether it's reachable from the outside.
    - Implement BAD_LIBEVENT general status event so controllers can learn
      when we have a version/method combination in libevent that needs to
      be changed.
    - Implement NAMESERVER_STATUS, NAMESERVER_ALL_DOWN, DNS_HIJACKED,
      and DNS_USELESS server status events so controllers can learn
      about changes to DNS server status.

  o Minor features (directory):
    - Authorities no longer recommend exits as guards if this would shift
      too much load to the exit nodes.


Changes in version 0.1.2.5-alpha - 2007-01-06
  o Major features:
    - Enable write limiting as well as read limiting. Now we sacrifice
      capacity if we're pushing out lots of directory traffic, rather
      than overrunning the user's intended bandwidth limits.
    - Include TLS overhead when counting bandwidth usage; previously, we
      would count only the bytes sent over TLS, but not the bytes used
      to send them.
    - Support running the Tor service with a torrc not in the same
      directory as tor.exe and default to using the torrc located in
      the %appdata%\Tor\ of the user who installed the service. Patch
      from Matt Edman.
    - Servers now check for the case when common DNS requests are going to
      wildcarded addresses (i.e. all getting the same answer), and change
      their exit policy to reject *:* if it's happening.
    - Implement BEGIN_DIR cells, so we can connect to the directory
      server via TLS to do encrypted directory requests rather than
      plaintext. Enable via the TunnelDirConns and PreferTunneledDirConns
      config options if you like.

  o Minor features (config and docs):
    - Start using the state file to store bandwidth accounting data:
      the bw_accounting file is now obsolete. We'll keep generating it
      for a while for people who are still using 0.1.2.4-alpha.
    - Try to batch changes to the state file so that we do as few
      disk writes as possible while still storing important things in
      a timely fashion.
    - The state file and the bw_accounting file get saved less often when
      the AvoidDiskWrites config option is set.
    - Make PIDFile work on Windows (untested).
    - Add internal descriptions for a bunch of configuration options:
      accessible via controller interface and in comments in saved
      options files.
    - Reject *:563 (NNTPS) in the default exit policy. We already reject
      NNTP by default, so this seems like a sensible addition.
    - Clients now reject hostnames with invalid characters. This should
      avoid some inadvertent info leaks. Add an option
      AllowNonRFC953Hostnames to disable this behavior, in case somebody
      is running a private network with hosts called @, !, and #.
    - Add a maintainer script to tell us which options are missing
      documentation: "make check-docs".
    - Add a new address-spec.txt document to describe our special-case
      addresses: .exit, .onion, and .noconnnect.

  o Minor features (DNS):
    - Ongoing work on eventdns infrastructure: now it has dns server
      and ipv6 support. One day Tor will make use of it.
    - Add client-side caching for reverse DNS lookups.
    - Add support to tor-resolve tool for reverse lookups and SOCKS5.
    - When we change nameservers or IP addresses, reset and re-launch
      our tests for DNS hijacking.

  o Minor features (directory):
    - Authorities now specify server versions in networkstatus. This adds
      about 2% to the side of compressed networkstatus docs, and allows
      clients to tell which servers support BEGIN_DIR and which don't.
      The implementation is forward-compatible with a proposed future
      protocol version scheme not tied to Tor versions.
    - DirServer configuration lines now have an orport= option so
      clients can open encrypted tunnels to the authorities without
      having downloaded their descriptors yet. Enabled for moria1,
      moria2, tor26, and lefkada now in the default configuration.
    - Directory servers are more willing to send a 503 "busy" if they
      are near their write limit, especially for v1 directory requests.
      Now they can use their limited bandwidth for actual Tor traffic.
    - Clients track responses with status 503 from dirservers. After a
      dirserver has given us a 503, we try not to use it until an hour has
      gone by, or until we have no dirservers that haven't given us a 503.
    - When we get a 503 from a directory, and we're not a server, we don't
      count the failure against the total number of failures allowed
      for the thing we're trying to download.
    - Report X-Your-Address-Is correctly from tunneled directory
      connections; don't report X-Your-Address-Is when it's an internal
      address; and never believe reported remote addresses when they're
      internal.
    - Protect against an unlikely DoS attack on directory servers.
    - Add a BadDirectory flag to network status docs so that authorities
      can (eventually) tell clients about caches they believe to be
      broken.

  o Minor features (controller):
    - Have GETINFO dir/status/* work on hosts with DirPort disabled.
    - Reimplement GETINFO so that info/names stays in sync with the
      actual keys.
    - Implement "GETINFO fingerprint".
    - Implement "SETEVENTS GUARD" so controllers can get updates on
      entry guard status as it changes.

  o Minor features (clean up obsolete pieces):
    - Remove some options that have been deprecated since at least
      0.1.0.x: AccountingMaxKB, LogFile, DebugLogFile, LogLevel, and
      SysLog. Use AccountingMax instead of AccountingMaxKB, and use Log
      to set log options.
    - We no longer look for identity and onion keys in "identity.key" and
      "onion.key" -- these were replaced by secret_id_key and
      secret_onion_key in 0.0.8pre1.
    - We no longer require unrecognized directory entries to be
      preceded by "opt".

  o Major bugfixes (security):
    - Stop sending the HttpProxyAuthenticator string to directory
      servers when directory connections are tunnelled through Tor.
    - Clients no longer store bandwidth history in the state file.
    - Do not log introduction points for hidden services if SafeLogging
      is set.
    - When generating bandwidth history, round down to the nearest
      1k. When storing accounting data, round up to the nearest 1k.
    - When we're running as a server, remember when we last rotated onion
      keys, so that we will rotate keys once they're a week old even if
      we never stay up for a week ourselves.

  o Major bugfixes (other):
    - Fix a longstanding bug in eventdns that prevented the count of
      timed-out resolves from ever being reset. This bug caused us to
      give up on a nameserver the third time it timed out, and try it
      10 seconds later... and to give up on it every time it timed out
      after that.
    - Take out the '5 second' timeout from the connection retry
      schedule. Now the first connect attempt will wait a full 10
      seconds before switching to a new circuit. Perhaps this will help
      a lot. Based on observations from Mike Perry.
    - Fix a bug on the Windows implementation of tor_mmap_file() that
      would prevent the cached-routers file from ever loading. Reported
      by John Kimble.

  o Minor bugfixes:
    - Fix an assert failure when a directory authority sets
      AuthDirRejectUnlisted and then receives a descriptor from an
      unlisted router. Reported by seeess.
    - Avoid a double-free when parsing malformed DirServer lines.
    - Fix a bug when a BSD-style PF socket is first used. Patch from
      Fabian Keil.
    - Fix a bug in 0.1.2.2-alpha that prevented clients from asking
      to resolve an address at a given exit node even when they ask for
      it by name.
    - Servers no longer ever list themselves in their "family" line,
      even if configured to do so. This makes it easier to configure
      family lists conveniently.
    - When running as a server, don't fall back to 127.0.0.1 when no
      nameservers are configured in /etc/resolv.conf; instead, make the
      user fix resolv.conf or specify nameservers explicitly. (Resolves
      bug 363.)
    - Stop accepting certain malformed ports in configured exit policies.
    - Don't re-write the fingerprint file every restart, unless it has
      changed.
    - Stop warning when a single nameserver fails: only warn when _all_ of
      our nameservers have failed. Also, when we only have one nameserver,
      raise the threshold for deciding that the nameserver is dead.
    - Directory authorities now only decide that routers are reachable
      if their identity keys are as expected.
    - When the user uses bad syntax in the Log config line, stop
      suggesting other bad syntax as a replacement.
    - Correctly detect ipv6 DNS capability on OpenBSD.

  o Minor bugfixes (controller):
    - Report the circuit number correctly in STREAM CLOSED events. Bug
      reported by Mike Perry.
    - Do not report bizarre values for results of accounting GETINFOs
      when the last second's write or read exceeds the allotted bandwidth.
    - Report "unrecognized key" rather than an empty string when the
      controller tries to fetch a networkstatus that doesn't exist.


Changes in version 0.1.1.26 - 2006-12-14
  o Security bugfixes:
    - Stop sending the HttpProxyAuthenticator string to directory
      servers when directory connections are tunnelled through Tor.
    - Clients no longer store bandwidth history in the state file.
    - Do not log introduction points for hidden services if SafeLogging
      is set.

  o Minor bugfixes:
    - Fix an assert failure when a directory authority sets
      AuthDirRejectUnlisted and then receives a descriptor from an
      unlisted router (reported by seeess).


Changes in version 0.1.2.4-alpha - 2006-12-03
  o Major features:
    - Add support for using natd; this allows FreeBSDs earlier than
      5.1.2 to have ipfw send connections through Tor without using
      SOCKS. (Patch from Zajcev Evgeny with tweaks from tup.)

  o Minor features:
    - Make all connections to addresses of the form ".noconnect"
      immediately get closed. This lets application/controller combos
      successfully test whether they're talking to the same Tor by
      watching for STREAM events.
    - Make cross.sh cross-compilation script work even when autogen.sh
      hasn't been run. (Patch from Michael Mohr.)
    - Statistics dumped by -USR2 now include a breakdown of public key
      operations, for profiling.

  o Major bugfixes:
    - Fix a major leak when directory authorities parse their
      approved-routers list, a minor memory leak when we fail to pick
      an exit node, and a few rare leaks on errors.
    - Handle TransPort connections even when the server sends data before
      the client sends data. Previously, the connection would just hang
      until the client sent data. (Patch from tup based on patch from
      Zajcev Evgeny.)
    - Avoid assert failure when our cached-routers file is empty on
      startup.

  o Minor bugfixes:
    - Don't log spurious warnings when we see a circuit close reason we
      don't recognize; it's probably just from a newer version of Tor.
    - Have directory authorities allow larger amounts of drift in uptime
      without replacing the server descriptor: previously, a server that
      restarted every 30 minutes could have 48 "interesting" descriptors
      per day.
    - Start linking to the Tor specification and Tor reference manual
      correctly in the Windows installer.
    - Add Vidalia to the OS X uninstaller script, so when we uninstall
      Tor/Privoxy we also uninstall Vidalia.
    - Resume building on Irix64, and fix a lot of warnings from its
      MIPSpro C compiler.
    - Don't corrupt last_guessed_ip in router_new_address_suggestion()
      when we're running as a client.


Changes in version 0.1.1.25 - 2006-11-04
  o Major bugfixes:
    - When a client asks us to resolve (rather than connect to)
      an address, and we have a cached answer, give them the cached
      answer. Previously, we would give them no answer at all.
    - We were building exactly the wrong circuits when we predict
      hidden service requirements, meaning Tor would have to build all
      its circuits on demand.
    - If none of our live entry guards have a high uptime, but we
      require a guard with a high uptime, try adding a new guard before
      we give up on the requirement. This patch should make long-lived
      connections more stable on average.
    - When testing reachability of our DirPort, don't launch new
      tests when there's already one in progress -- unreachable
      servers were stacking up dozens of testing streams.

  o Security bugfixes:
    - When the user sends a NEWNYM signal, clear the client-side DNS
      cache too. Otherwise we continue to act on previous information.

  o Minor bugfixes:
    - Avoid a memory corruption bug when creating a hash table for
      the first time.
    - Avoid possibility of controller-triggered crash when misusing
      certain commands from a v0 controller on platforms that do not
      handle printf("%s",NULL) gracefully.
    - Avoid infinite loop on unexpected controller input.
    - Don't log spurious warnings when we see a circuit close reason we
      don't recognize; it's probably just from a newer version of Tor.
    - Add Vidalia to the OS X uninstaller script, so when we uninstall
      Tor/Privoxy we also uninstall Vidalia.


Changes in version 0.1.2.3-alpha - 2006-10-29
  o Minor features:
    - Prepare for servers to publish descriptors less often: never
      discard a descriptor simply for being too old until either it is
      recommended by no authorities, or until we get a better one for
      the same router. Make caches consider retaining old recommended
      routers for even longer.
    - If most authorities set a BadExit flag for a server, clients
      don't think of it as a general-purpose exit. Clients only consider
      authorities that advertise themselves as listing bad exits.
    - Directory servers now provide 'Pragma: no-cache' and 'Expires'
      headers for content, so that we can work better in the presence of
      caching HTTP proxies.
    - Allow authorities to list nodes as bad exits by fingerprint or by
      address.

  o Minor features, controller:
    - Add a REASON field to CIRC events; for backward compatibility, this
      field is sent only to controllers that have enabled the extended
      event format.  Also, add additional reason codes to explain why
      a given circuit has been destroyed or truncated. (Patches from
      Mike Perry)
    - Add a REMOTE_REASON field to extended CIRC events to tell the
      controller about why a remote OR told us to close a circuit.
    - Stream events also now have REASON and REMOTE_REASON fields,
      working much like those for circuit events.
    - There's now a GETINFO ns/... field so that controllers can ask Tor
      about the current status of a router.
    - A new event type "NS" to inform a controller when our opinion of
      a router's status has changed.
    - Add a GETINFO events/names and GETINFO features/names so controllers
      can tell which events and features are supported.
    - A new CLEARDNSCACHE signal to allow controllers to clear the
      client-side DNS cache without expiring circuits.

  o Security bugfixes:
    - When the user sends a NEWNYM signal, clear the client-side DNS
      cache too. Otherwise we continue to act on previous information.

  o Minor bugfixes:
    - Avoid sending junk to controllers or segfaulting when a controller
      uses EVENT_NEW_DESC with verbose nicknames.
    - Stop triggering asserts if the controller tries to extend hidden
      service circuits (reported by mwenge).
    - Avoid infinite loop on unexpected controller input.
    - When the controller does a "GETINFO network-status", tell it
      about even those routers whose descriptors are very old, and use
      long nicknames where appropriate.
    - Change NT service functions to be loaded on demand.  This lets us
      build with MinGW without breaking Tor for Windows 98 users.
    - Do DirPort reachability tests less often, since a single test
      chews through many circuits before giving up.
    - In the hidden service example in torrc.sample, stop recommending
      esoteric and discouraged hidden service options.
    - When stopping an NT service, wait up to 10 sec for it to actually
      stop.  (Patch from Matt Edman; resolves bug 295.)
    - Fix handling of verbose nicknames with ORCONN controller events:
      make them show up exactly when requested, rather than exactly when
      not requested.
    - When reporting verbose nicknames in entry_guards_getinfo(), avoid
      printing a duplicate "$" in the keys we send (reported by mwenge).
    - Correctly set maximum connection limit on Cygwin. (This time
      for sure!)
    - Try to detect Windows correctly when cross-compiling.
    - Detect the size of the routers file correctly even if it is
      corrupted (on systems without mmap) or not page-aligned (on systems
      with mmap). This bug was harmless.
    - Sometimes we didn't bother sending a RELAY_END cell when an attempt
      to open a stream fails; now we do in more cases. This should
      make clients able to find a good exit faster in some cases, since
      unhandleable requests will now get an error rather than timing out.
    - Resolve two memory leaks when rebuilding the on-disk router cache
      (reported by fookoowa).
    - Clean up minor code warnings suggested by the MIPSpro C compiler,
      and reported by some Centos users.
    - Controller signals now work on non-Unix platforms that don't define
      SIGUSR1 and SIGUSR2 the way we expect.
    - Patch from Michael Mohr to contrib/cross.sh, so it checks more
      values before failing, and always enables eventdns.
    - Libevent-1.2 exports, but does not define in its headers, strlcpy.
      Try to fix this in configure.in by checking for most functions
      before we check for libevent.


Changes in version 0.1.2.2-alpha - 2006-10-07
  o Major features:
    - Make our async eventdns library on-by-default for Tor servers,
      and plan to deprecate the separate dnsworker threads.
    - Add server-side support for "reverse" DNS lookups (using PTR
      records so clients can determine the canonical hostname for a given
      IPv4 address). Only supported by servers using eventdns; servers
      now announce in their descriptors whether they support eventdns.
    - Specify and implement client-side SOCKS5 interface for reverse DNS
      lookups (see doc/socks-extensions.txt).
    - Add a BEGIN_DIR relay cell type for an easier in-protocol way to
      connect to directory servers through Tor. Previously, clients needed
      to find Tor exits to make private connections to directory servers.
    - Avoid choosing Exit nodes for entry or middle hops when the
      total bandwidth available from non-Exit nodes is much higher than
      the total bandwidth available from Exit nodes.
    - Workaround for name servers (like Earthlink's) that hijack failing
      DNS requests and replace the no-such-server answer with a "helpful"
      redirect to an advertising-driven search portal. Also work around
      DNS hijackers who "helpfully" decline to hijack known-invalid
      RFC2606 addresses. Config option "ServerDNSDetectHijacking 0"
      lets you turn it off.
    - Send out a burst of long-range padding cells once we've established
      that we're reachable. Spread them over 4 circuits, so hopefully
      a few will be fast. This exercises our bandwidth and bootstraps
      us into the directory more quickly.

  o New/improved config options:
    - Add new config option "ResolvConf" to let the server operator
      choose an alternate resolve.conf file when using eventdns.
    - Add an "EnforceDistinctSubnets" option to control our "exclude
      servers on the same /16" behavior. It's still on by default; this
      is mostly for people who want to operate private test networks with
      all the machines on the same subnet.
    - If one of our entry guards is on the ExcludeNodes list, or the
      directory authorities don't think it's a good guard, treat it as
      if it were unlisted: stop using it as a guard, and throw it off
      the guards list if it stays that way for a long time.
    - Allow directory authorities to be marked separately as authorities
      for the v1 directory protocol, the v2 directory protocol, and
      as hidden service directories, to make it easier to retire old
      authorities. V1 authorities should set "HSAuthoritativeDir 1"
      to continue being hidden service authorities too.
    - Remove 8888 as a LongLivedPort, and add 6697 (IRCS).

  o Minor features, controller:
    - Fix CIRC controller events so that controllers can learn the
      identity digests of non-Named servers used in circuit paths.
    - Let controllers ask for more useful identifiers for servers. Instead
      of learning identity digests for un-Named servers and nicknames
      for Named servers, the new identifiers include digest, nickname,
      and indication of Named status. Off by default; see control-spec.txt
      for more information.
    - Add a "getinfo address" controller command so it can display Tor's
      best guess to the user.
    - New controller event to alert the controller when our server
      descriptor has changed.
    - Give more meaningful errors on controller authentication failure.

  o Minor features, other:
    - When asked to resolve a hostname, don't use non-exit servers unless
      requested to do so. This allows servers with broken DNS to be
      useful to the network.
    - Divide eventdns log messages into warn and info messages.
    - Reserve the nickname "Unnamed" for routers that can't pick
      a hostname: any router can call itself Unnamed; directory
      authorities will never allocate Unnamed to any particular router;
      clients won't believe that any router is the canonical Unnamed.
    - Only include function names in log messages for info/debug messages.
      For notice/warn/err, the content of the message should be clear on
      its own, and printing the function name only confuses users.
    - Avoid some false positives during reachability testing: don't try
      to test via a server that's on the same /24 as us.
    - If we fail to build a circuit to an intended enclave, and it's
      not mandatory that we use that enclave, stop wanting it.
    - When eventdns is enabled, allow multithreaded builds on NetBSD and
      OpenBSD. (We had previously disabled threads on these platforms
      because they didn't have working thread-safe resolver functions.)

  o Major bugfixes, anonymity/security:
    - If a client asked for a server by name, and there's a named server
      in our network-status but we don't have its descriptor yet, we
      could return an unnamed server instead.
    - Fix NetBSD bug that could allow someone to force uninitialized RAM
      to be sent to a server's DNS resolver. This only affects NetBSD
      and other platforms that do not bounds-check tolower().
    - Reject (most) attempts to use Tor circuits with length one. (If
      many people start using Tor as a one-hop proxy, exit nodes become
      a more attractive target for compromise.)
    - Just because your DirPort is open doesn't mean people should be
      able to remotely teach you about hidden service descriptors. Now
      only accept rendezvous posts if you've got HSAuthoritativeDir set.

  o Major bugfixes, other:
    - Don't crash on race condition in dns.c: tor_assert(!resolve->expire)
    - When a client asks the server to resolve (not connect to)
      an address, and it has a cached answer, give them the cached answer.
      Previously, the server would give them no answer at all.
    - Allow really slow clients to not hang up five minutes into their
      directory downloads (suggested by Adam J. Richter).
    - We were building exactly the wrong circuits when we anticipated
      hidden service requirements, meaning Tor would have to build all
      its circuits on demand.
    - Avoid crashing when we mmap a router cache file of size 0.
    - When testing reachability of our DirPort, don't launch new
      tests when there's already one in progress -- unreachable
      servers were stacking up dozens of testing streams.

  o Minor bugfixes, correctness:
    - If we're a directory mirror and we ask for "all" network status
      documents, we would discard status documents from authorities
      we don't recognize.
    - Avoid a memory corruption bug when creating a hash table for
      the first time.
    - Avoid controller-triggered crash when misusing certain commands
      from a v0 controller on platforms that do not handle
      printf("%s",NULL) gracefully.
    - Don't crash when a controller sends a third argument to an
      "extendcircuit" request.
    - Controller protocol fixes: fix encoding in "getinfo addr-mappings"
      response; fix error code when "getinfo dir/status/" fails.
    - Avoid crash when telling controller stream-status and a stream
      is detached.
    - Patch from Adam Langley to fix assert() in eventdns.c.
    - Fix a debug log message in eventdns to say "X resolved to Y"
      instead of "X resolved to X".
    - Make eventdns give strings for DNS errors, not just error numbers.
    - Track unreachable entry guards correctly: don't conflate
      'unreachable by us right now' with 'listed as down by the directory
      authorities'. With the old code, if a guard was unreachable by
      us but listed as running, it would clog our guard list forever.
    - Behave correctly in case we ever have a network with more than
      2GB/s total advertised capacity.
    - Make TrackExitHosts case-insensitive, and fix the behavior of
      ".suffix" TrackExitHosts items to avoid matching in the middle of
      an address.
    - Finally fix the openssl warnings from newer gccs that believe that
      ignoring a return value is okay, but casting a return value and
      then ignoring it is a sign of madness.
    - Prevent the contrib/exitlist script from printing the same
      result more than once.
    - Patch from Steve Hildrey: Generate network status correctly on
      non-versioning dirservers.
    - Don't listen to the X-Your-Address-Is hint if you did the lookup
      via Tor; otherwise you'll think you're the exit node's IP address.

  o Minor bugfixes, performance:
    - Two small performance improvements on parsing descriptors.
    - Major performance improvement on inserting descriptors: change
      algorithm from O(n^2) to O(n).
    - Make the common memory allocation path faster on machines where
      malloc(0) returns a pointer.
    - Start remembering X-Your-Address-Is directory hints even if you're
      a client, so you can become a server more smoothly.
    - Avoid duplicate entries on MyFamily line in server descriptor.

  o Packaging, features:
    - Remove architecture from OS X builds. The official builds are
      now universal binaries.
    - The Debian package now uses --verify-config when (re)starting,
      to distinguish configuration errors from other errors.
    - Update RPMs to require libevent 1.1b.

  o Packaging, bugfixes:
    - Patches so Tor builds with MinGW on Windows.
    - Patches so Tor might run on Cygwin again.
    - Resume building on non-gcc compilers and ancient gcc. Resume
      building with the -O0 compile flag. Resume building cleanly on
      Debian woody.
    - Run correctly on OS X platforms with case-sensitive filesystems.
    - Correct includes for net/if.h and net/pfvar.h on OpenBSD (from Tup).
    - Add autoconf checks so Tor can build on Solaris x86 again.

  o Documentation
    - Documented (and renamed) ServerDNSSearchDomains and
      ServerDNSResolvConfFile options.
    - Be clearer that the *ListenAddress directives can be repeated
      multiple times.


Changes in version 0.1.1.24 - 2006-09-29
  o Major bugfixes:
    - Allow really slow clients to not hang up five minutes into their
      directory downloads (suggested by Adam J. Richter).
    - Fix major performance regression from 0.1.0.x: instead of checking
      whether we have enough directory information every time we want to
      do something, only check when the directory information has changed.
      This should improve client CPU usage by 25-50%.
    - Don't crash if, after a server has been running for a while,
      it can't resolve its hostname.
    - When a client asks us to resolve (not connect to) an address,
      and we have a cached answer, give them the cached answer.
      Previously, we would give them no answer at all.

  o Minor bugfixes:
    - Allow Tor to start when RunAsDaemon is set but no logs are set.
    - Don't crash when the controller receives a third argument to an
      "extendcircuit" request.
    - Controller protocol fixes: fix encoding in "getinfo addr-mappings"
      response; fix error code when "getinfo dir/status/" fails.
    - Fix configure.in to not produce broken configure files with
      more recent versions of autoconf. Thanks to Clint for his auto*
      voodoo.
    - Fix security bug on NetBSD that could allow someone to force
      uninitialized RAM to be sent to a server's DNS resolver. This
      only affects NetBSD and other platforms that do not bounds-check
      tolower().
    - Warn user when using libevent 1.1a or earlier with win32 or kqueue
      methods: these are known to be buggy.
    - If we're a directory mirror and we ask for "all" network status
      documents, we would discard status documents from authorities
      we don't recognize.


Changes in version 0.1.2.1-alpha - 2006-08-27
  o Major features:
    - Add "eventdns" async dns library from Adam Langley, tweaked to
      build on OSX and Windows. Only enabled if you pass the
      --enable-eventdns argument to configure.
    - Allow servers with no hostname or IP address to learn their
      IP address by asking the directory authorities. This code only
      kicks in when you would normally have exited with a "no address"
      error. Nothing's authenticated, so use with care.
    - Rather than waiting a fixed amount of time between retrying
      application connections, we wait only 5 seconds for the first,
      10 seconds for the second, and 15 seconds for each retry after
      that. Hopefully this will improve the expected user experience.
    - Patch from Tup to add support for transparent AP connections:
      this basically bundles the functionality of trans-proxy-tor
      into the Tor mainline. Now hosts with compliant pf/netfilter
      implementations can redirect TCP connections straight to Tor
      without diverting through SOCKS. Needs docs.
    - Busy directory servers save lots of memory by spooling server
      descriptors, v1 directories, and v2 networkstatus docs to buffers
      as needed rather than en masse. Also mmap the cached-routers
      files, so we don't need to keep the whole thing in memory too.
    - Automatically avoid picking more than one node from the same
      /16 network when constructing a circuit.
    - Revise and clean up the torrc.sample that we ship with; add
      a section for BandwidthRate and BandwidthBurst.

  o Minor features:
    - Split circuit_t into origin_circuit_t and or_circuit_t, and
      split connection_t into edge, or, dir, control, and base structs.
      These will save quite a bit of memory on busy servers, and they'll
      also help us track down bugs in the code and bugs in the spec.
    - Experimentally re-enable kqueue on OSX when using libevent 1.1b
      or later. Log when we are doing this, so we can diagnose it when
      it fails. (Also, recommend libevent 1.1b for kqueue and
      win32 methods; deprecate libevent 1.0b harder; make libevent
      recommendation system saner.)
    - Start being able to build universal binaries on OS X (thanks
      to Phobos).
    - Export the default exit policy via the control port, so controllers
      don't need to guess what it is / will be later.
    - Add a man page entry for ProtocolWarnings.
    - Add TestVia config option to the man page.
    - Remove even more protocol-related warnings from Tor server logs,
      such as bad TLS handshakes and malformed begin cells.
    - Stop fetching descriptors if you're not a dir mirror and you
      haven't tried to establish any circuits lately. [This currently
      causes some dangerous behavior, because when you start up again
      you'll use your ancient server descriptors.]
    - New DirPort behavior: if you have your dirport set, you download
      descriptors aggressively like a directory mirror, whether or not
      your ORPort is set.
    - Get rid of the router_retry_connections notion. Now routers
      no longer try to rebuild long-term connections to directory
      authorities, and directory authorities no longer try to rebuild
      long-term connections to all servers. We still don't hang up
      connections in these two cases though -- we need to look at it
      more carefully to avoid flapping, and we likely need to wait til
      0.1.1.x is obsolete.
    - Drop compatibility with obsolete Tors that permit create cells
      to have the wrong circ_id_type.
    - Re-enable per-connection rate limiting. Get rid of the "OP
      bandwidth" concept. Lay groundwork for "bandwidth classes" --
      separate global buckets that apply depending on what sort of conn
      it is.
    - Start publishing one minute or so after we find our ORPort
      to be reachable. This will help reduce the number of descriptors
      we have for ourselves floating around, since it's quite likely
      other things (e.g. DirPort) will change during that minute too.
    - Fork the v1 directory protocol into its own spec document,
      and mark dir-spec.txt as the currently correct (v2) spec.

  o Major bugfixes:
    - When we find our DirPort to be reachable, publish a new descriptor
      so we'll tell the world (reported by pnx).
    - Publish a new descriptor after we hup/reload. This is important
      if our config has changed such that we'll want to start advertising
      our DirPort now, etc.
    - Allow Tor to start when RunAsDaemon is set but no logs are set.
    - When we have a state file we cannot parse, tell the user and
      move it aside. Now we avoid situations where the user starts
      Tor in 1904, Tor writes a state file with that timestamp in it,
      the user fixes her clock, and Tor refuses to start.
    - Fix configure.in to not produce broken configure files with
      more recent versions of autoconf. Thanks to Clint for his auto*
      voodoo.
    - "tor --verify-config" now exits with -1(255) or 0 depending on
      whether the config options are bad or good.
    - Resolve bug 321 when using dnsworkers: append a period to every
      address we resolve at the exit node, so that we do not accidentally
      pick up local addresses, and so that failing searches are retried
      in the resolver search domains. (This is already solved for
      eventdns.) (This breaks Blossom servers for now.)
    - If we are using an exit enclave and we can't connect, e.g. because
      its webserver is misconfigured to not listen on localhost, then
      back off and try connecting from somewhere else before we fail.

  o Minor bugfixes:
    - Start compiling on MinGW on Windows (patches from Mike Chiussi).
    - Start compiling on MSVC6 on Windows (patches from Frediano Ziglio).
    - Fix bug 314: Tor clients issued "unsafe socks" warnings even
      when the IP address is mapped through MapAddress to a hostname.
    - Start passing "ipv4" hints to getaddrinfo(), so servers don't do
      useless IPv6 DNS resolves.
    - Patch suggested by Karsten Loesing: respond to SIGNAL command
      before we execute the signal, in case the signal shuts us down.
    - Clean up AllowInvalidNodes man page entry.
    - Claim a commonname of Tor, rather than TOR, in TLS handshakes.
    - Add more asserts to track down an assert error on a windows Tor
      server with connection_add being called with socket == -1.
    - Handle reporting OR_CONN_EVENT_NEW events to the controller.
    - Fix misleading log messages: an entry guard that is "unlisted",
      as well as not known to be "down" (because we've never heard
      of it), is not therefore "up".
    - Remove code to special-case "-cvs" ending, since it has not
      actually mattered since 0.0.9.
    - Make our socks5 handling more robust to broken socks clients:
      throw out everything waiting on the buffer in between socks
      handshake phases, since they can't possibly (so the theory
      goes) have predicted what we plan to respond to them.


Changes in version 0.1.1.23 - 2006-07-30
  o Major bugfixes:
    - Fast Tor servers, especially exit nodes, were triggering asserts
      due to a bug in handling the list of pending DNS resolves. Some
      bugs still remain here; we're hunting them.
    - Entry guards could crash clients by sending unexpected input.
    - More fixes on reachability testing: if you find yourself reachable,
      then don't ever make any client requests (so you stop predicting
      circuits), then hup or have your clock jump, then later your IP
      changes, you won't think circuits are working, so you won't try to
      test reachability, so you won't publish.

  o Minor bugfixes:
    - Avoid a crash if the controller does a resetconf firewallports
      and then a setconf fascistfirewall=1.
    - Avoid an integer underflow when the dir authority decides whether
      a router is stable: we might wrongly label it stable, and compute
      a slightly wrong median stability, when a descriptor is published
      later than now.
    - Fix a place where we might trigger an assert if we can't build our
      own server descriptor yet.


Changes in version 0.1.1.22 - 2006-07-05
  o Major bugfixes:
    - Fix a big bug that was causing servers to not find themselves
      reachable if they changed IP addresses. Since only 0.1.1.22+
      servers can do reachability testing correctly, now we automatically
      make sure to test via one of these.
    - Fix to allow clients and mirrors to learn directory info from
      descriptor downloads that get cut off partway through.
    - Directory authorities had a bug in deciding if a newly published
      descriptor was novel enough to make everybody want a copy -- a few
      servers seem to be publishing new descriptors many times a minute.
  o Minor bugfixes:
    - Fix a rare bug that was causing some servers to complain about
      "closing wedged cpuworkers" and skip some circuit create requests.
    - Make the Exit flag in directory status documents actually work.


Changes in version 0.1.1.21 - 2006-06-10
  o Crash and assert fixes from 0.1.1.20:
    - Fix a rare crash on Tor servers that have enabled hibernation.
    - Fix a seg fault on startup for Tor networks that use only one
      directory authority.
    - Fix an assert from a race condition that occurs on Tor servers
      while exiting, where various threads are trying to log that they're
      exiting, and delete the logs, at the same time.
    - Make our unit tests pass again on certain obscure platforms.

  o Other fixes:
    - Add support for building SUSE RPM packages.
    - Speed up initial bootstrapping for clients: if we are making our
      first ever connection to any entry guard, then don't mark it down
      right after that.
    - When only one Tor server in the network is labelled as a guard,
      and we've already picked him, we would cycle endlessly picking him
      again, being unhappy about it, etc. Now we specifically exclude
      current guards when picking a new guard.
    - Servers send create cells more reliably after the TLS connection
      is established: we were sometimes forgetting to send half of them
      when we had more than one pending.
    - If we get a create cell that asks us to extend somewhere, but the
      Tor server there doesn't match the expected digest, we now send
      a destroy cell back, rather than silently doing nothing.
    - Make options->RedirectExit work again.
    - Make cookie authentication for the controller work again.
    - Stop being picky about unusual characters in the arguments to
      mapaddress. It's none of our business.
    - Add a new config option "TestVia" that lets you specify preferred
      middle hops to use for test circuits. Perhaps this will let me
      debug the reachability problems better.

  o Log / documentation fixes:
    - If we're a server and some peer has a broken TLS certificate, don't
      log about it unless ProtocolWarnings is set, i.e., we want to hear
      about protocol violations by others.
    - Fix spelling of VirtualAddrNetwork in man page.
    - Add a better explanation at the top of the autogenerated torrc file
      about what happened to our old torrc.


Changes in version 0.1.1.20 - 2006-05-23
  o Bugfixes:
    - Downgrade a log severity where servers complain that they're
      invalid.
    - Avoid a compile warning on FreeBSD.
    - Remove string size limit on NEWDESC messages; solve bug 291.
    - Correct the RunAsDaemon entry in the man page; ignore RunAsDaemon
      more thoroughly when we're running on windows.


Changes in version 0.1.1.19-rc - 2006-05-03
  o Minor bugs:
    - Regenerate our local descriptor if it's dirty and we try to use
      it locally (e.g. if it changes during reachability detection).
    - If we setconf our ORPort to 0, we continued to listen on the
      old ORPort and receive connections.
    - Avoid a second warning about machine/limits.h on Debian
      GNU/kFreeBSD.
    - Be willing to add our own routerinfo into the routerlist.
      Now authorities will include themselves in their directories
      and network-statuses.
    - Stop trying to upload rendezvous descriptors to every
      directory authority: only try the v1 authorities.
    - Servers no longer complain when they think they're not
      registered with the directory authorities. There were too many
      false positives.
    - Backport dist-rpm changes so rpms can be built without errors.

  o Features:
    - Implement an option, VirtualAddrMask, to set which addresses
      get handed out in response to mapaddress requests. This works
      around a bug in tsocks where 127.0.0.0/8 is never socksified.


Changes in version 0.1.1.18-rc - 2006-04-10
  o Major fixes:
    - Work harder to download live network-statuses from all the
      directory authorities we know about. Improve the threshold
      decision logic so we're more robust to edge cases.
    - When fetching rendezvous descriptors, we were willing to ask
      v2 authorities too, which would always return 404.

  o Minor fixes:
    - Stop listing down or invalid nodes in the v1 directory. This will
      reduce its bulk by about 1/3, and reduce load on directory
      mirrors.
    - When deciding whether a router is Fast or Guard-worthy, consider
      his advertised BandwidthRate and not just the BandwidthCapacity.
    - No longer ship INSTALL and README files -- they are useless now.
    - Force rpmbuild to behave and honor target_cpu.
    - Avoid warnings about machine/limits.h on Debian GNU/kFreeBSD.
    - Start to include translated versions of the tor-doc-*.html
      files, along with the screenshots. Still needs more work.
    - Start sending back 512 and 451 errors if mapaddress fails,
      rather than not sending anything back at all.
    - When we fail to bind or listen on an incoming or outgoing
      socket, we should close it before failing. otherwise we just
      leak it. (thanks to weasel for finding.)
    - Allow "getinfo dir/status/foo" to work, as long as your DirPort
      is enabled. (This is a hack, and will be fixed in 0.1.2.x.)
    - Make NoPublish (even though deprecated) work again.
    - Fix a minor security flaw where a versioning auth dirserver
      could list a recommended version many times in a row to make
      clients more convinced that it's recommended.
    - Fix crash bug if there are two unregistered servers running
      with the same nickname, one of them is down, and you ask for
      them by nickname in your EntryNodes or ExitNodes. Also, try
      to pick the one that's running rather than an arbitrary one.
    - Fix an infinite loop we could hit if we go offline for too long.
    - Complain when we hit WSAENOBUFS on recv() or write() too.
      Perhaps this will help us hunt the bug.
    - If you're not a versioning dirserver, don't put the string
      "client-versions \nserver-versions \n" in your network-status.
    - Lower the minimum required number of file descriptors to 1000,
      so we can have some overhead for Valgrind on Linux, where the
      default ulimit -n is 1024.

  o New features:
    - Add tor.dizum.com as the fifth authoritative directory server.
    - Add a new config option FetchUselessDescriptors, off by default,
      for when you plan to run "exitlist" on your client and you want
      to know about even the non-running descriptors.


Changes in version 0.1.1.17-rc - 2006-03-28
  o Major fixes:
    - Clients and servers since 0.1.1.10-alpha have been expiring
      connections whenever they are idle for 5 minutes and they *do*
      have circuits on them. Oops. With this new version, clients will
      discard their previous entry guard choices and avoid choosing
      entry guards running these flawed versions.
    - Fix memory leak when uncompressing concatenated zlib streams. This
      was causing substantial leaks over time on Tor servers.
    - The v1 directory was including servers as much as 48 hours old,
      because that's how the new routerlist->routers works. Now only