Also, clean up and remove old /etc/apparmor.d/usr.sbin.tor files on
upgrade if they have not been changed by the user.

* debian-merge: (74 commits)
  New upstream version: target unstable
  give 0.2.3.17-beta a release blurb
  another little step at making debugging 5458 easier
  tab-man returneth (this time using the name 'rob')
  fix typos, logic error, default in man page
  bump to 0.2.3.17-beta
  fold in next changes items
  Expand on bug5458 changes file
  Add a changes file for bug5458.
  Lower the default path bias notice rate to 40%.
  For now, never disable any guards.
  Defend against entry node path bias attacks
  Document --hush; fix documentation for --quiet.
  Remove validate_pluggable_transports_config(): redundant since 9d9b5ed0.
  demote two entries that don't affect most users
  fold in further changes files
  One more fix for bug 5049.
  Satisfy make check-spaces
  Move cbt->liveness.timeouts_after_firsthop free code into its own function
  Add change file for bug 5049
  ...

* commit 'tor-0.2.3.17-beta': (73 commits)
  give 0.2.3.17-beta a release blurb
  another little step at making debugging 5458 easier
  tab-man returneth (this time using the name 'rob')
  fix typos, logic error, default in man page
  bump to 0.2.3.17-beta
  fold in next changes items
  Expand on bug5458 changes file
  Add a changes file for bug5458.
  Lower the default path bias notice rate to 40%.
  For now, never disable any guards.
  Defend against entry node path bias attacks
  Document --hush; fix documentation for --quiet.
  Remove validate_pluggable_transports_config(): redundant since 9d9b5ed0.
  demote two entries that don't affect most users
  fold in further changes files
  One more fix for bug 5049.
  Satisfy make check-spaces
  Move cbt->liveness.timeouts_after_firsthop free code into its own function
  Add change file for bug 5049
  Early exit from circuit_build_times_set_timeout() if adaptive timeouts are disabled
  ...

I saw 72% on a test run with 26 circuits. 70% might be a little close to the
line. That, or min_circs is too low and we need to be more patient. We still
need to test/simulate more.

The defense counts the circuit failure rate for each guard for the past N
circuits. Failure is defined as the ability to complete a first hop, but not
finish completing the circuit all the way to the exit.

If the failure rate exceeds a certain amount, a notice is emitted.

If it exceeds a greater amount, a warn is emitted and the guard is disabled.

These values are governed by consensus parameters which we intend to tune as
we perform experiments and statistical simulations.

* Change the output of the init script to use lsb* functions:
  - Depend on lsb-base.
  - Makes the output pretty (closes: #676843)
* Also, in the init script we are now less verbose, unless VERBOSE is
  set to yes in /etc/default/rcS (see the rcS(5) manual page):
  - pass --quiet to tor on startup,
  - do not report raising ulimit -n.

The init script should take care of that since long ago.

The warning message of validate_pluggable_transports_config() is
superseded by the changes in the warning message of
connection_or_connect() when the proxy credentials can't be found.

- allow access to /var/log/tor/* and not just /var/log/tor/log*
- restrict such access to append instead of general writes

Andrea Shepard authored 12 years ago and Nick Mathewson committed 12 years ago

Don't poll to see if we need to build circuits for timeout data if LearnCircuitBuildTimeout is disabled

Andrea Shepard authored 12 years ago and Nick Mathewson committed 12 years ago

Add debug logging to circuit_build_times_* of circuitbuild.c to trace queries of consensus parameters for bug 5049