ChangeLog 423 KB
Newer Older
1
2
3
4
5
Changes in version 0.2.2.6-alpha - 2009-10-??
  o Code simplifications and refactorings:
    - Numerous changes, bugfixes, and workarounds from Nathan Freitas
      to help Tor build correctly for Android phones.

6
7
8
9
  o Minor bugfixes:
    - Fix a crash bug when trying to initialize the evdns module in
      Libevent 2.

10

11
12
13
14
15
16
17
18
Changes in version 0.2.2.5-alpha - 2009-10-11
  o Major bugfixes:
    - Make the tarball compile again. Oops. Bugfix on 0.2.2.4-alpha.

  o New directory authorities:
    - Move dizum to an alternate IP address.


Roger Dingledine's avatar
Roger Dingledine committed
19
Changes in version 0.2.2.4-alpha - 2009-10-10
20
  o Major bugfixes:
21
22
23
24
    - Fix several more asserts in the circuit_build_times code, for
      example one that causes Tor to fail to start once we have
      accumulated 5000 build times in the state file. Bugfixes on
      0.2.2.2-alpha; fixes bug 1108.
25

26
  o New directory authorities:
27
    - Move moria1 and Tonga to alternate IP addresses.
28

29
30
  o Minor features:
    - Log SSL state transitions at debug level during handshake, and
31
32
      include SSL states in error messages. This may help debug future
      SSL handshake issues.
33
34
    - Add a new "Handshake" log domain for activities that happen
      during the TLS handshake.
35
36
    - Revert to the "June 3 2009" ip-to-country file. The September one
      seems to have removed most US IP addresses.
37
38
39
    - Directory authorities now reject Tor relays with versions less than
      0.1.2.14. This step cuts out four relays from the current network,
      none of which are very big.
40

41
42
43
  o Minor bugfixes:
    - Fix a couple of smaller issues with gathering statistics. Bugfixes
      on 0.2.2.1-alpha.
Sebastian Hahn's avatar
Sebastian Hahn committed
44
45
    - Fix two memory leaks in the error case of
      circuit_build_times_parse_state. Bugfix on 0.2.2.2-alpha.
46
47
48
    - Don't count one-hop circuits when we're estimating how long it
      takes circuits to build on average. Otherwise we'll set our circuit
      build timeout lower than we should. Bugfix on 0.2.2.2-alpha.
49
    - Directory authorities no longer change their opinion of, or vote on,
Roger Dingledine's avatar
Roger Dingledine committed
50
51
52
      whether a router is Running, unless they have themselves been
      online long enough to have some idea. Bugfix on 0.2.0.6-alpha.
      Fixes bug 1023.
53

54
55
56
57
58
59
  o Code simplifications and refactoring:
    - Revise our unit tests to use the "tinytest" framework, so we
      can run tests in their own processes, have smarter setup/teardown
      code, and so on.  The unit test code has moved to its own
      subdirectory, and has been split into multiple modules.

60

61
Changes in version 0.2.2.3-alpha - 2009-09-23
62
63
  Tor 0.2.2.3-alpha fixes a few crash bugs in 0.2.2.2-alpha.

64
65
  o Major bugfixes:
    - Fix an overzealous assert in our new circuit build timeout code.
66
      Bugfix on 0.2.2.2-alpha; fixes bug 1103.
67

68
69
70
  o Minor bugfixes:
    - If the networkstatus consensus tells us that we should use a
      negative circuit package window, ignore it. Otherwise we'll
71
      believe it and then trigger an assert. Bugfix on 0.2.2.2-alpha.
72

73

Roger Dingledine's avatar
Roger Dingledine committed
74
Changes in version 0.2.2.2-alpha - 2009-09-21
75
76
77
78
79
80
  Tor 0.2.2.2-alpha introduces our latest performance improvement for
  clients: Tor tracks the average time it takes to build a circuit, and
  avoids using circuits that take too long to build. For fast connections,
  this feature can cut your expected latency in half. For slow or flaky
  connections, it could ruin your Tor experience. Let us know if it does!

81
  o Major features:
82
83
84
85
86
87
88
89
90
91
92
93
    - Tor now tracks how long it takes to build client-side circuits
      over time, and adapts its timeout to local network performance.
      Since a circuit that takes a long time to build will also provide
      bad performance, we get significant latency improvements by
      discarding the slowest 20% of circuits. Specifically, Tor creates
      circuits more aggressively than usual until it has enough data
      points for a good timeout estimate. Implements proposal 151.
      We are especially looking for reports (good and bad) from users with
      both EDGE and broadband connections that can move from broadband
      to EDGE and find out if the build-time data in the .tor/state gets
      reset without loss of Tor usability. You should also see a notice
      log message telling you that Tor has reset its timeout.
94
95
96
    - Directory authorities can now vote on arbitary integer values as
      part of the consensus process. This is designed to help set
      network-wide parameters. Implements proposal 167.
97
98
99
    - Tor now reads the "circwindow" parameter out of the consensus,
      and uses that value for its circuit package window rather than the
      default of 1000 cells. Begins the implementation of proposal 168.
100

101
102
103
104
105
  o Major bugfixes:
    - Fix a remotely triggerable memory leak when a consensus document
      contains more than one signature from the same voter. Bugfix on
      0.2.0.3-alpha.

106
107
108
109
  o Minor bugfixes:
    - Fix an extremely rare infinite recursion bug that could occur if
      we tried to log a message after shutting down the log subsystem.
      Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
110
    - Fix parsing for memory or time units given without a space between
111
      the number and the unit. Bugfix on 0.2.2.1-alpha; fixes bug 1076.
112
113
    - A networkstatus vote must contain exactly one signature. Spec
      conformance issue. Bugfix on 0.2.0.3-alpha.
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
    - Fix an obscure bug where hidden services on 64-bit big-endian
      systems might mis-read the timestamp in v3 introduce cells, and
      refuse to connect back to the client. Discovered by "rotor".
      Bugfix on 0.2.1.6-alpha.
    - We were triggering a CLOCK_SKEW controller status event whenever
      we connect via the v2 connection protocol to any relay that has
      a wrong clock. Instead, we should only inform the controller when
      it's a trusted authority that claims our clock is wrong. Bugfix
      on 0.2.0.20-rc; starts to fix bug 1074. Reported by SwissTorExit.
    - We were telling the controller about CHECKING_REACHABILITY and
      REACHABILITY_FAILED status events whenever we launch a testing
      circuit or notice that one has failed. Instead, only tell the
      controller when we want to inform the user of overall success or
      overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075. Reported
      by SwissTorExit.
    - Don't warn when we're using a circuit that ends with a node
      excluded in ExcludeExitNodes, but the circuit is not used to access
Roger Dingledine's avatar
Roger Dingledine committed
131
132
      the outside world. This should help fix bug 1090, but more problems
      remain. Bugfix on 0.2.1.6-alpha.
133
134
135
    - Work around a small memory leak in some versions of OpenSSL that
      stopped the memory used by the hostname TLS extension from being
      freed.
136
137
138
    - Make our 'torify' script more portable; if we have only one of
      'torsocks' or 'tsocks' installed, don't complain to the user;
      and explain our warning about tsocks better.
139
140
141
142
143
144
145

  o Minor features:
    - Add a "getinfo status/accepted-server-descriptor" controller
      command, which is the recommended way for controllers to learn
      whether our server descriptor has been successfully received by at
      least on directory authority. Un-recommend good-server-descriptor
      getinfo and status events until we have a better design for them.
146
    - Update to the "September 4 2009" ip-to-country file.
147
148


149
Changes in version 0.2.2.1-alpha - 2009-08-26
150
151
152
153
154
  Tor 0.2.2.1-alpha disables ".exit" address notation by default, allows
  Tor clients to bootstrap on networks where only port 80 is reachable,
  makes it more straightforward to support hardware crypto accelerators,
  and starts the groundwork for gathering stats safely at relays.

155
156
157
158
159
160
  o Security fixes:
    - Start the process of disabling ".exit" address notation, since it
      can be used for a variety of esoteric application-level attacks
      on users. To reenable it, set "AllowDotExit 1" in your torrc. Fix
      on 0.0.9rc5.

161
162
163
164
  o New directory authorities:
    - Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
      authority.

165
  o Major features:
166
167
168
169
170
171
172
173
174
175
176
177
178
    - New AccelName and AccelDir options add support for dynamic OpenSSL
      hardware crypto acceleration engines.
    - Tor now supports tunneling all of its outgoing connections over
      a SOCKS proxy, using the SOCKS4Proxy and/or SOCKS5Proxy
      configuration options. Code by Christopher Davis.

  o Major bugfixes:
    - Send circuit or stream sendme cells when our window has decreased
      by 100 cells, not when it has decreased by 101 cells. Bug uncovered
      by Karsten when testing the "reduce circuit window" performance
      patch. Bugfix on the 54th commit on Tor -- from July 2002,
      before the release of Tor 0.0.0. This is the new winner of the
      oldest-bug prize.
179

180
  o New options for gathering stats safely:
181
182
183
184
185
186
187
    - Directories that set "DirReqStatistics 1" write statistics on
      directory request to disk every 24 hours. As compared to the
      --enable-geoip-stats flag in 0.2.1.x, there are a few improvements:
      1) stats are written to disk exactly every 24 hours; 2) estimated
      shares of v2 and v3 requests are determined as mean values, not at
      the end of a measurement period; 3) unresolved requests are listed
      with country code '??'; 4) directories also measure download times.
188
189
190
    - Exit nodes that set "ExitPortStatistics 1" write statistics on the
      number of exit streams and transferred bytes per port to disk every
      24 hours.
191
192
193
194
195
    - Relays that set "CellStatistics 1" write statistics on how long
      cells spend in their circuit queues to disk every 24 hours.
    - Entry nodes that set "EntryStatistics 1" write statistics on the
      rough number and origins of connecting clients to disk every 24
      hours.
196
197
198
    - Relays that write any of the above statistics to disk and set
      "ExtraInfoStatistics 1" include the past 24 hours of statistics in
      their extra-info documents.
199

200
  o Minor features:
201
202
    - New --digests command-line switch to output the digests of the
      source files Tor was built with.
203
    - The "torify" script now uses torsocks where available.
204
    - The memarea code now uses a sentinel value at the end of each area
205
      to make sure nothing writes beyond the end of an area. This might
206
      help debug some conceivable causes of bug 930.
207
    - Time and memory units in the configuration file can now be set to
208
      fractional units. For example, "2.5 GB" is now a valid value for
209
      AccountingMax.
210
211
212
213
214
215
    - Certain Tor clients (such as those behind check.torproject.org) may
      want to fetch the consensus in an extra early manner. To enable this
      a user may now set FetchDirInfoExtraEarly to 1. This also depends on
      setting FetchDirInfoEarly to 1. Previous behavior will stay the same
      as only certain clients who must have this information sooner should
      set this option.
216
217
    - Instead of adding the svn revision to the Tor version string, report
      the git commit (when we're building from a git checkout).
218

219
220
221
222
  o Minor bugfixes:
    - If any the v3 certs we download are unparseable, we should actually
      notice the failure so we don't retry indefinitely. Bugfix on
      0.2.0.x; reported by "rotator".
223
    - If the cached cert file is unparseable, warn but don't exit.
224
225
    - Fix possible segmentation fault on directory authorities. Bugfix on
      0.2.1.14-rc.
226
227
    - When Tor fails to parse a descriptor of any kind, dump it to disk.
      Might help diagnosing bug 1051.
228

229
230
  o Deprecated and removed features:
    - The controller no longer accepts the old obsolete "addr-mappings/"
231
      or "unregistered-servers-" GETINFO values.
Karsten Loesing's avatar
Karsten Loesing committed
232
    - Hidden services no longer publish version 0 descriptors, and clients
233
234
235
      do not request or use version 0 descriptors. However, the old hidden
      service authorities still accept and serve version 0 descriptors
      when contacted by older hidden services/clients.
236
237
238
    - The EXTENDED_EVENTS and VERBOSE_NAMES controller features are now
      always on; using them is necessary for correct forward-compatible
      controllers.
239
240
241
    - Remove support for .noconnect style addresses. Nobody was using
      them, and they provided another avenue for detecting Tor users
      via application-level web tricks.
242

243
  o Packaging changes:
244
245
246
247
248
249
250
    - Upgrade Vidalia from 0.1.15 to 0.2.3 in the Windows and OS X
      installer bundles. See
      https://trac.vidalia-project.net/browser/vidalia/tags/vidalia-0.2.3/CHANGELOG
      for details of what's new in Vidalia 0.2.3.
    - Windows Vidalia Bundle: update Privoxy from 3.0.6 to 3.0.14-beta.
    - OS X Vidalia Bundle: move to Polipo 1.0.4 with Tor specific
      configuration file, rather than the old Privoxy.
251
    - OS X Vidalia Bundle: Vidalia, Tor, and Polipo are compiled as
252
      x86-only for better compatibility with OS X 10.6, aka Snow Leopard.
253
254
255
    - OS X Tor Expert Bundle: Tor is compiled as x86-only for
      better compatibility with OS X 10.6, aka Snow Leopard.
    - OS X Vidalia Bundle: The multi-package installer is now replaced
256
257
      by a simple drag and drop to the /Applications folder. This change
      occurred with the upgrade to Vidalia 0.2.3.
258

259

260
Changes in version 0.2.1.20 - 2009-??-??
261
262
263
264
265
266
267
  o Major bugfixes:
    - Send circuit or stream sendme cells when our window has decreased
      by 100 cells, not when it has decreased by 101 cells. Bug uncovered
      by Karsten when testing the "reduce circuit window" performance
      patch. Bugfix on the 54th commit on Tor -- from July 2002,
      before the release of Tor 0.0.0. This is the new winner of the
      oldest-bug prize.
268
269
270
    - Fix a remotely triggerable memory leak when a consensus document
      contains more than one signature from the same voter. Bugfix on
      0.2.0.3-alpha.
271

272
273
274
275
  o New directory authorities:
    - Set up urras (run by Jacob Appelbaum) as the seventh v3 directory
      authority.

276
277
  o Minor bugfixes:
    - Fix a signed/unsigned compile warning in 0.2.1.19.
278
279
    - Fix possible segmentation fault on directory authorities. Bugfix on
      0.2.1.14-rc.
280
281
282
    - Fix an extremely rare infinite recursion bug that could occur if
      we tried to log a message after shutting down the log subsystem.
      Found by Matt Edman. Bugfix on 0.2.0.16-alpha.
283
284
285
286
    - Fix an obscure bug where hidden services on 64-bit big-endian
      systems might mis-read the timestamp in v3 introduce cells, and
      refuse to connect back to the client. Discovered by "rotor".
      Bugfix on 0.2.1.6-alpha.
287
288
289
290
291
    - We were triggering a CLOCK_SKEW controller status event whenever
      we connect via the v2 connection protocol to any relay that has
      a wrong clock. Instead, we should only inform the controller when
      it's a trusted authority that claims our clock is wrong. Bugfix
      on 0.2.0.20-rc; starts to fix bug 1074. Reported by SwissTorExit.
292
293
294
295
296
297
    - We were telling the controller about CHECKING_REACHABILITY and
      REACHABILITY_FAILED status events whenever we launch a testing
      circuit or notice that one has failed. Instead, only tell the
      controller when we want to inform the user of overall success or
      overall failure. Bugfix on 0.1.2.6-alpha. Fixes bug 1075. Reported
      by SwissTorExit.
298
299
300
301
    - Don't warn when we're using a circuit that ends with a node
      excluded in ExcludeExitNodes, but the circuit is not used to access
      the outside world. This should help fix bug 1090. Bugfix on
      0.2.1.6-alpha.
302
303
304
    - Avoid segfault in rare cases when finishing an introduction circuit
      as a client and finding out that we don't have an introduction key
      for it. Fixes bug 1073. Reported by Aaron Swartz.
305
306
307
    - Work around a small memory leak in some versions of OpenSSL that
      stopped the memory used by the hostname TLS extension from being
      freed.
308

309
310
311
312
313
314
315
  o Minor features:
    - Add a "getinfo status/accepted-server-descriptor" controller
      command, which is the recommended way for controllers to learn
      whether our server descriptor has been successfully received by at
      least on directory authority. Un-recommend good-server-descriptor
      getinfo and status events until we have a better design for them.

316

Roger Dingledine's avatar
Roger Dingledine committed
317
Changes in version 0.2.1.19 - 2009-07-28
318
319
320
  Tor 0.2.1.19 fixes a major bug with accessing and providing hidden
  services on Tor 0.2.1.3-alpha through 0.2.1.18.

321
  o Major bugfixes:
322
323
324
    - Make accessing hidden services on 0.2.1.x work right again.
      Bugfix on 0.2.1.3-alpha; workaround for bug 1038. Diagnosis and
      part of patch provided by "optimist".
325

326
327
328
329
330
331
  o Minor features:
    - When a relay/bridge is writing out its identity key fingerprint to
      the "fingerprint" file and to its logs, write it without spaces. Now
      it will look like the fingerprints in our bridges documentation,
      and confuse fewer users.

332
  o Minor bugfixes:
333
334
335
336
    - Relays no longer publish a new server descriptor if they change
      their MaxAdvertisedBandwidth config option but it doesn't end up
      changing their advertised bandwidth numbers. Bugfix on 0.2.0.28-rc;
      fixes bug 1026. Patch from Sebastian.
337
338
339
340
    - Avoid leaking memory every time we get a create cell but we have
      so many already queued that we refuse it. Bugfix on 0.2.0.19-alpha;
      fixes bug 1034. Reported by BarkerJr.

341

342
Changes in version 0.2.1.18 - 2009-07-24
343
344
345
346
347
348
  Tor 0.2.1.18 lays the foundations for performance improvements,
  adds status events to help users diagnose bootstrap problems, adds
  optional authentication/authorization for hidden services, fixes a
  variety of potential anonymity problems, and includes a huge pile of
  other features and bug fixes.

349
350
351
352
  o Build fixes:
    - Add LIBS=-lrt to Makefile.am so the Tor RPMs use a static libevent.


353
Changes in version 0.2.1.17-rc - 2009-07-07
354
355
356
357
358
359
360
361
362
363
364
  Tor 0.2.1.17-rc marks the fourth -- and hopefully last -- release
  candidate for the 0.2.1.x series. It lays the groundwork for further
  client performance improvements, and also fixes a big bug with directory
  authorities that were causing them to assign Guard and Stable flags
  poorly.

  The Windows bundles also finally include the geoip database that we
  thought we'd been shipping since 0.2.0.x (oops), and the OS X bundles
  should actually install Torbutton rather than giving you a cryptic
  failure message (oops).

365
366
367
368
369
370
371
  o Major features:
    - Clients now use the bandwidth values in the consensus, rather than
      the bandwidth values in each relay descriptor. This approach opens
      the door to more accurate bandwidth estimates once the directory
      authorities start doing active measurements. Implements more of
      proposal 141.

372
  o Major bugfixes:
373
374
375
376
377
378
379
    - When Tor clients restart after 1-5 days, they discard all their
      cached descriptors as too old, but they still use the cached
      consensus document. This approach is good for robustness, but
      bad for performance: since they don't know any bandwidths, they
      end up choosing at random rather than weighting their choice by
      speed. Fixed by the above feature of putting bandwidths in the
      consensus. Bugfix on 0.2.0.x.
380
381
382
383
384
385
386
387
388
    - Directory authorities were neglecting to mark relays down in their
      internal histories if the relays fall off the routerlist without
      ever being found unreachable. So there were relays in the histories
      that haven't been seen for eight months, and are listed as being
      up for eight months. This wreaked havoc on the "median wfu"
      and "median mtbf" calculations, in turn making Guard and Stable
      flags very wrong, hurting network performance. Fixes bugs 696 and
      969. Bugfix on 0.2.0.6-alpha.

389
390
  o Minor bugfixes:
    - Serve the DirPortFrontPage page even when we have been approaching
391
392
393
394
395
396
397
398
      our quotas recently. Fixes bug 1013; bugfix on 0.2.1.8-alpha.
    - The control port would close the connection before flushing long
      replies, such as the network consensus, if a QUIT command was issued
      before the reply had completed. Now, the control port flushes all
      pending replies before closing the connection. Also fixed a spurious
      warning when a QUIT command is issued after a malformed or rejected
      AUTHENTICATE command, but before the connection was closed. Patch
      by Marcus Griep. Bugfix on 0.2.0.x; fixes bugs 1015 and 1016.
399
400
    - When we can't find an intro key for a v2 hidden service descriptor,
      fall back to the v0 hidden service descriptor and log a bug message.
401
      Workaround for bug 1024.
402
403
    - Fix a log message that did not respect the SafeLogging option.
      Resolves bug 1027.
404

405
406
407
408
  o Minor features:
    - If we're a relay and we change our IP address, be more verbose
      about the reason that made us change. Should help track down
      further bugs for relays on dynamic IP addresses.
409

410

411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
Changes in version 0.2.0.35 - 2009-06-24
  o Security fix:
    - Avoid crashing in the presence of certain malformed descriptors.
      Found by lark, and by automated fuzzing.
    - Fix an edge case where a malicious exit relay could convince a
      controller that the client's DNS question resolves to an internal IP
      address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.

  o Major bugfixes:
    - Finally fix the bug where dynamic-IP relays disappear when their
      IP address changes: directory mirrors were mistakenly telling
      them their old address if they asked via begin_dir, so they
      never got an accurate answer about their new address, so they
      just vanished after a day. For belt-and-suspenders, relays that
      don't set Address in their config now avoid using begin_dir for
      all direct connections. Should fix bugs 827, 883, and 900.
    - Fix a timing-dependent, allocator-dependent, DNS-related crash bug
      that would occur on some exit nodes when DNS failures and timeouts
      occurred in certain patterns. Fix for bug 957.

  o Minor bugfixes:
    - When starting with a cache over a few days old, do not leak
      memory for the obsolete router descriptors in it. Bugfix on
      0.2.0.33; fixes bug 672.
    - Hidden service clients didn't use a cached service descriptor that
      was older than 15 minutes, but wouldn't fetch a new one either,
      because there was already one in the cache. Now, fetch a v2
      descriptor unless the same descriptor was added to the cache within
      the last 15 minutes. Fixes bug 997; reported by Marcus Griep.


Nick Mathewson's avatar
Nick Mathewson committed
442
Changes in version 0.2.1.16-rc - 2009-06-20
443
444
445
  Tor 0.2.1.16-rc speeds up performance for fast exit relays, and fixes
  a bunch of minor bugs.

446
447
448
449
450
  o Security fixes:
    - Fix an edge case where a malicious exit relay could convince a
      controller that the client's DNS question resolves to an internal IP
      address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta.

451
452
  o Major performance improvements (on 0.2.0.x):
    - Disable and refactor some debugging checks that forced a linear scan
453
454
455
      over the whole server-side DNS cache. These accounted for over 50%
      of CPU time on a relatively busy exit node's gprof profile. Found
      by Jacob.
456
457
458
    - Disable some debugging checks that appeared in exit node profile
      data.

459
460
  o Minor features:
    - Update to the "June 3 2009" ip-to-country file.
461
    - Do not have tor-resolve automatically refuse all .onion addresses;
462
      if AutomapHostsOnResolve is set in your torrc, this will work fine.
463

464
465
466
  o Minor bugfixes (on 0.2.0.x):
    - Log correct error messages for DNS-related network errors on
      Windows.
467
468
469
    - Fix a race condition that could cause crashes or memory corruption
      when running as a server with a controller listening for log
      messages.
470
    - Avoid crashing when we have a policy specified in a DirPolicy or
471
472
      SocksPolicy or ReachableAddresses option with ports set on it,
      and we re-load the policy. May fix bug 996.
Karsten Loesing's avatar
Karsten Loesing committed
473
474
475
476
477
    - Hidden service clients didn't use a cached service descriptor that
      was older than 15 minutes, but wouldn't fetch a new one either,
      because there was already one in the cache. Now, fetch a v2
      descriptor unless the same descriptor was added to the cache within
      the last 15 minutes. Fixes bug 997; reported by Marcus Griep.
478

479
  o Minor bugfixes (on 0.2.1.x):
480
481
482
    - Don't warn users about low port and hibernation mix when they
      provide a *ListenAddress directive to fix that. Bugfix on
      0.2.1.15-rc.
483
484
    - When switching back and forth between bridge mode, do not start
      gathering GeoIP data until two hours have passed.
485
    - Do not complain that the user has requested an excluded node as
486
      an exit when the node is not really an exit. This could happen
487
488
      because the circuit was for testing, or an introduction point.
      Fix for bug 984.
489

490

491
Changes in version 0.2.1.15-rc - 2009-05-25
492
493
494
495
  Tor 0.2.1.15-rc marks the second release candidate for the 0.2.1.x
  series. It fixes a major bug on fast exit relays, as well as a variety
  of more minor bugs.

496
  o Major bugfixes (on 0.2.0.x):
497
498
    - Fix a timing-dependent, allocator-dependent, DNS-related crash bug
      that would occur on some exit nodes when DNS failures and timeouts
499
      occurred in certain patterns. Fix for bug 957.
500

501
  o Minor bugfixes (on 0.2.0.x):
502
503
504
    - Actually return -1 in the error case for read_bandwidth_usage().
      Harmless bug, since we currently don't care about the return value
      anywhere. Bugfix on 0.2.0.9-alpha.
505
506
    - Provide a more useful log message if bug 977 (related to buffer
      freelists) ever reappears, and do not crash right away.
507
508
509
    - Fix an assertion failure on 64-bit platforms when we allocated
      memory right up to the end of a memarea, then realigned the memory
      one step beyond the end. Fixes a possible cause of bug 930.
510
511
    - Protect the count of open sockets with a mutex, so we can't
      corrupt it when two threads are closing or opening sockets at once.
512
513
514
      Fix for bug 939. Bugfix on 0.2.0.1-alpha.
    - Don't allow a bridge to publish its router descriptor to a
      non-bridge directory authority. Fixes part of bug 932.
515
    - When we change to or from being a bridge, reset our counts of
516
      client usage by country. Fixes bug 932.
517
518
    - Fix a bug that made stream bandwidth get misreported to the
      controller.
519
    - Stop using malloc_usable_size() to use more area than we had
520
      actually allocated: it was safe, but made valgrind really unhappy.
521
522
    - Fix a memory leak when v3 directory authorities load their keys
      and cert from disk. Bugfix on 0.2.0.1-alpha.
523

524
525
526
527
  o Minor bugfixes (on 0.2.1.x):
    - Fix use of freed memory when deciding to mark a non-addable
      descriptor as never-downloadable. Bugfix on 0.2.1.9-alpha.

528

529
Changes in version 0.2.1.14-rc - 2009-04-12
Roger Dingledine's avatar
Roger Dingledine committed
530
531
532
533
534
  Tor 0.2.1.14-rc marks the first release candidate for the 0.2.1.x
  series. It begins fixing some major performance problems, and also
  finally addresses the bug that was causing relays on dynamic IP
  addresses to fall out of the directory.

535
536
537
538
539
540
  o Major features:
    - Clients replace entry guards that were chosen more than a few months
      ago. This change should significantly improve client performance,
      especially once more people upgrade, since relays that have been
      a guard for a long time are currently overloaded.

541
542
  o Major bugfixes (on 0.2.0):
    - Finally fix the bug where dynamic-IP relays disappear when their
543
544
545
546
547
548
      IP address changes: directory mirrors were mistakenly telling
      them their old address if they asked via begin_dir, so they
      never got an accurate answer about their new address, so they
      just vanished after a day. For belt-and-suspenders, relays that
      don't set Address in their config now avoid using begin_dir for
      all direct connections. Should fix bugs 827, 883, and 900.
549
    - Relays were falling out of the networkstatus consensus for
550
551
552
553
      part of a day if they changed their local config but the
      authorities discarded their new descriptor as "not sufficiently
      different". Now directory authorities accept a descriptor as changed
      if bandwidthrate or bandwidthburst changed. Partial fix for bug 962;
554
      patch by Sebastian.
555
556
    - Avoid crashing in the presence of certain malformed descriptors.
      Found by lark, and by automated fuzzing.
557

558
  o Minor features:
Roger Dingledine's avatar
Roger Dingledine committed
559
560
561
562
    - When generating circuit events with verbose nicknames for
      controllers, try harder to look up nicknames for routers on a
      circuit. (Previously, we would look in the router descriptors we had
      for nicknames, but not in the consensus.) Partial fix for bug 941.
563
564
565
    - If the bridge config line doesn't specify a port, assume 443.
      This makes bridge lines a bit smaller and easier for users to
      understand.
566
567
568
569
570
571
    - Raise the minimum bandwidth to be a relay from 20000 bytes to 20480
      bytes (aka 20KB/s), to match our documentation. Also update
      directory authorities so they always assign the Fast flag to relays
      with 20KB/s of capacity. Now people running relays won't suddenly
      find themselves not seeing any use, if the network gets faster
      on average.
572
    - Update to the "April 3 2009" ip-to-country file.
573

Roger Dingledine's avatar
Roger Dingledine committed
574
575
576
577
  o Minor bugfixes:
    - Avoid trying to print raw memory to the logs when we decide to
      give up on downloading a given relay descriptor. Bugfix on
      0.2.1.9-alpha.
578
579
580
    - In tor-resolve, when the Tor client to use is specified by
      <hostname>:<port>, actually use the specified port rather than
      defaulting to 9050. Bugfix on 0.2.1.6-alpha.
581
    - Make directory usage recording work again. Bugfix on 0.2.1.6-alpha.
582
    - When starting with a cache over a few days old, do not leak
Roger Dingledine's avatar
Roger Dingledine committed
583
      memory for the obsolete router descriptors in it. Bugfix on
584
      0.2.0.33.
585
    - Avoid double-free on list of successfully uploaded hidden
Roger Dingledine's avatar
Roger Dingledine committed
586
      service discriptors. Fix for bug 948. Bugfix on 0.2.1.6-alpha.
587
    - Change memarea_strndup() implementation to work even when
Roger Dingledine's avatar
Roger Dingledine committed
588
      duplicating a string at the end of a page. This bug was
589
      harmless for now, but could have meant crashes later. Fix by
Roger Dingledine's avatar
Roger Dingledine committed
590
      lark. Bugfix on 0.2.1.1-alpha.
591
592
593
594
    - Limit uploaded directory documents to be 16M rather than 500K.
      The directory authorities were refusing v3 consensus votes from
      other authorities, since the votes are now 504K. Fixes bug 959;
      bugfix on 0.0.2pre17 (where we raised it from 50K to 500K ;).
595
596
597
    - Directory authorities should never send a 503 "busy" response to
      requests for votes or keys. Bugfix on 0.2.0.8-alpha; exposed by
      bug 959.
Roger Dingledine's avatar
Roger Dingledine committed
598
599


Roger Dingledine's avatar
Roger Dingledine committed
600
Changes in version 0.2.1.13-alpha - 2009-03-09
Roger Dingledine's avatar
Roger Dingledine committed
601
602
603
  Tor 0.2.1.13-alpha includes another big pile of minor bugfixes and
  cleanups. We're finally getting close to a release candidate.

604
  o Major bugfixes:
605
606
607
    - Correctly update the list of which countries we exclude as
      exits, when the GeoIP file is loaded or reloaded. Diagnosed by
      lark. Bugfix on 0.2.1.6-alpha.
608

609
  o Minor bugfixes (on 0.2.0.x and earlier):
610
611
612
    - Automatically detect MacOSX versions earlier than 10.4.0, and
      disable kqueue from inside Tor when running with these versions.
      We previously did this from the startup script, but that was no
613
      help to people who didn't use the startup script. Resolves bug 863.
614
615
    - When we had picked an exit node for a connection, but marked it as
      "optional", and it turned out we had no onion key for the exit,
616
617
618
      stop wanting that exit and try again. This situation may not
      be possible now, but will probably become feasible with proposal
      158. Spotted by rovv. Fixes another case of bug 752.
619
    - Clients no longer cache certificates for authorities they do not
620
      recognize. Bugfix on 0.2.0.9-alpha.
621
    - When we can't transmit a DNS request due to a network error, retry
622
623
      it after a while, and eventually transmit a failing response to
      the RESOLVED cell. Bugfix on 0.1.2.5-alpha.
624
625
626
627
    - If the controller claimed responsibility for a stream, but that
      stream never finished making its connection, it would live
      forever in circuit_wait state. Now we close it after SocksTimeout
      seconds. Bugfix on 0.1.2.7-alpha; reported by Mike Perry.
628
629
630
631
    - Drop begin cells to a hidden service if they come from the middle
      of a circuit. Patch from lark.
    - When we erroneously receive two EXTEND cells for the same circuit
      ID on the same connection, drop the second. Patch from lark.
Nick Mathewson's avatar
Nick Mathewson committed
632
    - Fix a crash that occurs on exit nodes when a nameserver request
633
634
635
      timed out. Bugfix on 0.1.2.1-alpha; our CLEAR debugging code had
      been suppressing the bug since 0.1.2.10-alpha. Partial fix for
      bug 929.
636
637
    - Do not assume that a stack-allocated character array will be
      64-bit aligned on platforms that demand that uint64_t access is
638
      aligned. Possible fix for bug 604.
639
640
    - Parse dates and IPv4 addresses in a locale- and libc-independent
      manner, to avoid platform-dependent behavior on malformed input.
641
    - Build correctly when configured to build outside the main source
642
      path. Patch from Michael Gold.
643
644
645
    - We were already rejecting relay begin cells with destination port
      of 0. Now also reject extend cells with destination port or address
      of 0. Suggested by lark.
646
647
648
649
650
651

  o Minor bugfixes (on 0.2.1.x):
    - Don't re-extend introduction circuits if we ran out of RELAY_EARLY
      cells. Bugfix on 0.2.1.3-alpha. Fixes more of bug 878.
    - If we're an exit node, scrub the IP address to which we are exiting
      in the logs. Bugfix on 0.2.1.8-alpha.
652

653
654
655
  o Minor features:
    - On Linux, use the prctl call to re-enable core dumps when the user
      is option is set.
656
657
658
    - New controller event NEWCONSENSUS that lists the networkstatus
      lines for every recommended relay. Now controllers like Torflow
      can keep up-to-date on which relays they should be using.
659
    - Update to the "February 26 2009" ip-to-country file.
660

661

662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
Changes in version 0.2.0.34 - 2009-02-08
  Tor 0.2.0.34 features several more security-related fixes. You should
  upgrade, especially if you run an exit relay (remote crash) or a
  directory authority (remote infinite loop), or you're on an older
  (pre-XP) or not-recently-patched Windows (remote exploit).

  This release marks end-of-life for Tor 0.1.2.x. Those Tor versions
  have many known flaws, and nobody should be using them. You should
  upgrade. If you're using a Linux or BSD and its packages are obsolete,
  stop using those packages and upgrade anyway.

  o Security fixes:
    - Fix an infinite-loop bug on handling corrupt votes under certain
      circumstances. Bugfix on 0.2.0.8-alpha.
    - Fix a temporary DoS vulnerability that could be performed by
      a directory mirror. Bugfix on 0.2.0.9-alpha; reported by lark.
    - Avoid a potential crash on exit nodes when processing malformed
      input. Remote DoS opportunity. Bugfix on 0.2.0.33.
    - Do not accept incomplete ipv4 addresses (like 192.168.0) as valid.
      Spec conformance issue. Bugfix on Tor 0.0.2pre27.

  o Minor bugfixes:
    - Fix compilation on systems where time_t is a 64-bit integer.
      Patch from Matthias Drochner.
    - Don't consider expiring already-closed client connections. Fixes
      bug 893. Bugfix on 0.0.2pre20.


690
Changes in version 0.2.1.12-alpha - 2009-02-08
691
692
693
694
695
696
  Tor 0.2.1.12-alpha features several more security-related fixes. You
  should upgrade, especially if you run an exit relay (remote crash) or
  a directory authority (remote infinite loop), or you're on an older
  (pre-XP) or not-recently-patched Windows (remote exploit). It also
  includes a big pile of minor bugfixes and cleanups.

697
  o Security fixes:
698
    - Fix an infinite-loop bug on handling corrupt votes under certain
Roger Dingledine's avatar
Roger Dingledine committed
699
      circumstances. Bugfix on 0.2.0.8-alpha.
Roger Dingledine's avatar
Roger Dingledine committed
700
701
    - Fix a temporary DoS vulnerability that could be performed by
      a directory mirror. Bugfix on 0.2.0.9-alpha; reported by lark.
702
    - Avoid a potential crash on exit nodes when processing malformed
Roger Dingledine's avatar
Roger Dingledine committed
703
      input. Remote DoS opportunity. Bugfix on 0.2.1.7-alpha.
704

705
  o Minor bugfixes:
706
707
708
    - Let controllers actually ask for the "clients_seen" event for
      getting usage summaries on bridge relays. Bugfix on 0.2.1.10-alpha;
      reported by Matt Edman.
Roger Dingledine's avatar
Roger Dingledine committed
709
    - Fix a compile warning on OSX Panther. Fixes bug 913; bugfix against
710
      0.2.1.11-alpha.
711
712
    - Fix a bug in address parsing that was preventing bridges or hidden
      service targets from being at IPv6 addresses.
713
    - Solve a bug that kept hardware crypto acceleration from getting
Roger Dingledine's avatar
Roger Dingledine committed
714
      enabled when accounting was turned on. Fixes bug 907. Bugfix on
715
      0.0.9pre6.
716
    - Remove a bash-ism from configure.in to build properly on non-Linux
Roger Dingledine's avatar
Roger Dingledine committed
717
      platforms. Bugfix on 0.2.1.1-alpha.
718
    - Fix code so authorities _actually_ send back X-Descriptor-Not-New
Roger Dingledine's avatar
Roger Dingledine committed
719
      headers. Bugfix on 0.2.0.10-alpha.
720
721
    - Don't consider expiring already-closed client connections. Fixes
      bug 893. Bugfix on 0.0.2pre20.
722
    - Fix another interesting corner-case of bug 891 spotted by rovv:
Roger Dingledine's avatar
Roger Dingledine committed
723
724
725
726
      Previously, if two hosts had different amounts of clock drift, and
      one of them created a new connection with just the wrong timing,
      the other might decide to deprecate the new connection erroneously.
      Bugfix on 0.1.1.13-alpha.
727
728
    - Resolve a very rare crash bug that could occur when the user forced
      a nameserver reconfiguration during the middle of a nameserver
Roger Dingledine's avatar
Roger Dingledine committed
729
      probe. Fixes bug 526. Bugfix on 0.1.2.1-alpha.
730
731
    - Support changing value of ServerDNSRandomizeCase during SIGHUP.
      Bugfix on 0.2.1.7-alpha.
732
733
734
    - If we're using bridges and our network goes away, be more willing
      to forgive our bridges and try again when we get an application
      request. Bugfix on 0.2.0.x.
735

736
737
  o Minor features:
    - Support platforms where time_t is 64 bits long. (Congratulations,
Roger Dingledine's avatar
Roger Dingledine committed
738
739
740
      NetBSD!) Patch from Matthias Drochner.
    - Add a 'getinfo status/clients-seen' controller command, in case
      controllers want to hear clients_seen events but connect late.
741

Roger Dingledine's avatar
Roger Dingledine committed
742
  o Build changes:
743
744
745
746
    - Disable GCC's strict alias optimization by default, to avoid the
      likelihood of its introducing subtle bugs whenever our code violates
      the letter of C99's alias rules.

747

748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
Changes in version 0.2.0.33 - 2009-01-21
  Tor 0.2.0.33 fixes a variety of bugs that were making relays less
  useful to users. It also finally fixes a bug where a relay or client
  that's been off for many days would take a long time to bootstrap.

  This update also fixes an important security-related bug reported by
  Ilja van Sprundel. You should upgrade. (We'll send out more details
  about the bug once people have had some time to upgrade.)

  o Security fixes:
    - Fix a heap-corruption bug that may be remotely triggerable on
      some platforms. Reported by Ilja van Sprundel.

  o Major bugfixes:
    - When a stream at an exit relay is in state "resolving" or
      "connecting" and it receives an "end" relay cell, the exit relay
      would silently ignore the end cell and not close the stream. If
      the client never closes the circuit, then the exit relay never
      closes the TCP connection. Bug introduced in Tor 0.1.2.1-alpha;
      reported by "wood".
    - When sending CREATED cells back for a given circuit, use a 64-bit
      connection ID to find the right connection, rather than an addr:port
      combination. Now that we can have multiple OR connections between
      the same ORs, it is no longer possible to use addr:port to uniquely
      identify a connection.
    - Bridge relays that had DirPort set to 0 would stop fetching
      descriptors shortly after startup, and then briefly resume
      after a new bandwidth test and/or after publishing a new bridge
      descriptor. Bridge users that try to bootstrap from them would
      get a recent networkstatus but would get descriptors from up to
      18 hours earlier, meaning most of the descriptors were obsolete
      already. Reported by Tas; bugfix on 0.2.0.13-alpha.
    - Prevent bridge relays from serving their 'extrainfo' document
      to anybody who asks, now that extrainfo docs include potentially
      sensitive aggregated client geoip summaries. Bugfix on
      0.2.0.13-alpha.
    - If the cached networkstatus consensus is more than five days old,
      discard it rather than trying to use it. In theory it could be
      useful because it lists alternate directory mirrors, but in practice
      it just means we spend many minutes trying directory mirrors that
      are long gone from the network. Also discard router descriptors as
      we load them if they are more than five days old, since the onion
      key is probably wrong by now. Bugfix on 0.2.0.x. Fixes bug 887.

  o Minor bugfixes:
    - Do not mark smartlist_bsearch_idx() function as ATTR_PURE. This bug
      could make gcc generate non-functional binary search code. Bugfix
      on 0.2.0.10-alpha.
    - Build correctly on platforms without socklen_t.
    - Compile without warnings on solaris.
    - Avoid potential crash on internal error during signature collection.
      Fixes bug 864. Patch from rovv.
    - Correct handling of possible malformed authority signing key
      certificates with internal signature types. Fixes bug 880.
      Bugfix on 0.2.0.3-alpha.
    - Fix a hard-to-trigger resource leak when logging credential status.
      CID 349.
    - When we can't initialize DNS because the network is down, do not
      automatically stop Tor from starting. Instead, we retry failed
      dns_init() every 10 minutes, and change the exit policy to reject
      *:* until one succeeds. Fixes bug 691.
    - Use 64 bits instead of 32 bits for connection identifiers used with
      the controller protocol, to greatly reduce risk of identifier reuse.
    - When we're choosing an exit node for a circuit, and we have
      no pending streams, choose a good general exit rather than one that
      supports "all the pending streams". Bugfix on 0.1.1.x. Fix by rovv.
    - Fix another case of assuming, when a specific exit is requested,
      that we know more than the user about what hosts it allows.
      Fixes one case of bug 752. Patch from rovv.
    - Clip the MaxCircuitDirtiness config option to a minimum of 10
      seconds. Warn the user if lower values are given in the
      configuration. Bugfix on 0.1.0.1-rc. Patch by Sebastian.
    - Clip the CircuitBuildTimeout to a minimum of 30 seconds. Warn the
      user if lower values are given in the configuration. Bugfix on
      0.1.1.17-rc. Patch by Sebastian.
    - Fix a memory leak when we decline to add a v2 rendezvous descriptor to
      the cache because we already had a v0 descriptor with the same ID.
      Bugfix on 0.2.0.18-alpha.
    - Fix a race condition when freeing keys shared between main thread
      and CPU workers that could result in a memory leak. Bugfix on
      0.1.0.1-rc. Fixes bug 889.
    - Send a valid END cell back when a client tries to connect to a
      nonexistent hidden service port. Bugfix on 0.1.2.15. Fixes bug
      840. Patch from rovv.
    - Check which hops rendezvous stream cells are associated with to
      prevent possible guess-the-streamid injection attacks from
      intermediate hops. Fixes another case of bug 446. Based on patch
      from rovv.
    - If a broken client asks a non-exit router to connect somewhere,
      do not even do the DNS lookup before rejecting the connection.
      Fixes another case of bug 619. Patch from rovv.
    - When a relay gets a create cell it can't decrypt (e.g. because it's
      using the wrong onion key), we were dropping it and letting the
      client time out. Now actually answer with a destroy cell. Fixes
      bug 904. Bugfix on 0.0.2pre8.

  o Minor bugfixes (hidden services):
    - Do not throw away existing introduction points on SIGHUP. Bugfix on
      0.0.6pre1. Patch by Karsten. Fixes bug 874.

  o Minor features:
    - Report the case where all signatures in a detached set are rejected
      differently than the case where there is an error handling the
      detached set.
    - When we realize that another process has modified our cached
      descriptors, print out a more useful error message rather than
      triggering an assertion. Fixes bug 885. Patch from Karsten.
    - Implement the 0x20 hack to better resist DNS poisoning: set the
      case on outgoing DNS requests randomly, and reject responses that do
      not match the case correctly. This logic can be disabled with the
      ServerDNSRamdomizeCase setting, if you are using one of the 0.3%
      of servers that do not reliably preserve case in replies. See
      "Increased DNS Forgery Resistance through 0x20-Bit Encoding"
      for more info.
    - Check DNS replies for more matching fields to better resist DNS
      poisoning.
    - Never use OpenSSL compression: it wastes RAM and CPU trying to
      compress cells, which are basically all encrypted, compressed, or
      both.


869
Changes in version 0.2.1.11-alpha - 2009-01-20
870
871
872
873
874
875
  Tor 0.2.1.11-alpha finishes fixing the "if your Tor is off for a
  week it will take a long time to bootstrap again" bug. It also fixes
  an important security-related bug reported by Ilja van Sprundel. You
  should upgrade. (We'll send out more details about the bug once people
  have had some time to upgrade.)

876
877
878
879
  o Security fixes:
    - Fix a heap-corruption bug that may be remotely triggerable on
      some platforms. Reported by Ilja van Sprundel.

880
881
882
883
884
885
886
  o Major bugfixes:
    - Discard router descriptors as we load them if they are more than
      five days old. Otherwise if Tor is off for a long time and then
      starts with cached descriptors, it will try to use the onion
      keys in those obsolete descriptors when building circuits. Bugfix
      on 0.2.0.x. Fixes bug 887.

887
888
  o Minor features:
    - Try to make sure that the version of Libevent we're running with
889
      is binary-compatible with the one we built with. May address bug
890
      897 and others.
891
892
    - Make setting ServerDNSRandomizeCase to 0 actually work. Bugfix
      for bug 905. Bugfix on 0.2.1.7-alpha.
893
894
    - Add a new --enable-local-appdata configuration switch to change
      the default location of the datadir on win32 from APPDATA to
895
896
      LOCAL_APPDATA. In the future, we should migrate to LOCAL_APPDATA
      entirely. Patch from coderman.
897

898
899
  o Minor bugfixes:
    - Make outbound DNS packets respect the OutboundBindAddress setting.
900
901
902
903
904
      Fixes the bug part of bug 798. Bugfix on 0.1.2.2-alpha.
    - When our circuit fails at the first hop (e.g. we get a destroy
      cell back), avoid using that OR connection anymore, and also
      tell all the one-hop directory requests waiting for it that they
      should fail. Bugfix on 0.2.1.3-alpha.
905
    - In the torify(1) manpage, mention that tsocks will leak your
906
      DNS requests.
907

908

909
Changes in version 0.2.1.10-alpha - 2009-01-06
910
911
912
913
914
915
916
  Tor 0.2.1.10-alpha fixes two major bugs in bridge relays (one that
  would make the bridge relay not so useful if it had DirPort set to 0,
  and one that could let an attacker learn a little bit of information
  about the bridge's users), and a bug that would cause your Tor relay
  to ignore a circuit create request it can't decrypt (rather than reply
  with an error). It also fixes a wide variety of other bugs.

917
918
919
920
921
922
923
  o Major bugfixes:
    - If the cached networkstatus consensus is more than five days old,
      discard it rather than trying to use it. In theory it could
      be useful because it lists alternate directory mirrors, but in
      practice it just means we spend many minutes trying directory
      mirrors that are long gone from the network. Helps bug 887 a bit;
      bugfix on 0.2.0.x.
924
925
926
927
928
929
930
    - Bridge relays that had DirPort set to 0 would stop fetching
      descriptors shortly after startup, and then briefly resume
      after a new bandwidth test and/or after publishing a new bridge
      descriptor. Bridge users that try to bootstrap from them would
      get a recent networkstatus but would get descriptors from up to
      18 hours earlier, meaning most of the descriptors were obsolete
      already. Reported by Tas; bugfix on 0.2.0.13-alpha.
931
932
    - Prevent bridge relays from serving their 'extrainfo' document
      to anybody who asks, now that extrainfo docs include potentially
933
934
      sensitive aggregated client geoip summaries. Bugfix on
      0.2.0.13-alpha.
935

936
937
938
939
940
  o Minor features:
    - New controller event "clients_seen" to report a geoip-based summary
      of which countries we've seen clients from recently. Now controllers
      like Vidalia can show bridge operators that they're actually making
      a difference.
941
942
    - Build correctly against versions of OpenSSL 0.9.8 or later built
      without support for deprecated functions.
943
    - Update to the "December 19 2008" ip-to-country file.
944

945
  o Minor bugfixes (on 0.2.0.x):
946
    - Authorities now vote for the Stable flag for any router whose
947
      weighted MTBF is at least 5 days, regardless of the mean MTBF.
948
    - Do not remove routers as too old if we do not have any consensus
949
      document. Bugfix on 0.2.0.7-alpha.
950
    - Do not accept incomplete ipv4 addresses (like 192.168.0) as valid.
951
952
953
      Spec conformance issue. Bugfix on Tor 0.0.2pre27.
    - When an exit relay resolves a stream address to a local IP address,
      do not just keep retrying that same exit relay over and
954
955
      over. Instead, just close the stream. Addresses bug 872. Bugfix
      on 0.2.0.32. Patch from rovv.
956
    - If a hidden service sends us an END cell, do not consider
957
      retrying the connection; just close it. Patch from rovv.
958
959
960
961
    - When we made bridge authorities stop serving bridge descriptors over
      unencrypted links, we also broke DirPort reachability testing for
      bridges. So bridges with a non-zero DirPort were printing spurious
      warns to their logs. Bugfix on 0.2.0.16-alpha. Fixes bug 709.
962
963
    - When a relay gets a create cell it can't decrypt (e.g. because it's
      using the wrong onion key), we were dropping it and letting the
964
965
      client time out. Now actually answer with a destroy cell. Fixes
      bug 904. Bugfix on 0.0.2pre8.
966
967
968
969
970
971
972
973
    - Squeeze 2-5% out of client performance (according to oprofile) by
      improving the implementation of some policy-manipulation functions.

  o Minor bugfixes (on 0.2.1.x):
    - Make get_interface_address() function work properly again; stop
      guessing the wrong parts of our address as our address.
    - Do not cannibalize a circuit if we're out of RELAY_EARLY cells to
      send on that circuit. Otherwise we might violate the proposal-110
974
      limit. Bugfix on 0.2.1.3-alpha. Partial fix for bug 878. Diagnosis
975
976
977
978
979
980
981
982
983
984
985
986
987
988
      thanks to Karsten.
    - When we're sending non-EXTEND cells to the first hop in a circuit,
      for example to use an encrypted directory connection, we don't need
      to use RELAY_EARLY cells: the first hop knows what kind of cell
      it is, and nobody else can even see the cell type. Conserving
      RELAY_EARLY cells makes it easier to cannibalize circuits like
      this later.
    - Stop logging nameserver addresses in reverse order.
    - If we are retrying a directory download slowly over and over, do
      not automatically give up after the 254th failure. Bugfix on
      0.2.1.9-alpha.
    - Resume reporting accurate "stream end" reasons to the local control
      port. They were lost in the changes for Proposal 148. Bugfix on
      0.2.1.9-alpha.
989

990
  o Deprecated and removed features:
991
992
    - The old "tor --version --version" command, which would print out
      the subversion "Id" of most of the source files, is now removed. It
993
994
995
      turned out to be less useful than we'd expected, and harder to
      maintain.

996
997
  o Code simplifications and refactoring:
    - Change our header file guard macros to be less likely to conflict
998
      with system headers. Adam Langley noticed that we were conflicting
999
      with log.h on Android.
1000
    - Tool-assisted documentation cleanup. Nearly every function or