Newer
Older
Changes in version 0.2.2.21-alpha - 2011-01-15
Tor 0.2.2.21-alpha includes all the patches from Tor 0.2.1.29, which
continues our recent code security audit work. The main fix resolves
a remote heap overflow vulnerability that can allow remote code
execution (CVE-2011-0427). Other fixes address a variety of assert
and crash bugs, most of which we think are hard to exploit remotely.
o Major bugfixes (security), also included in 0.2.1.29:
- Fix a heap overflow bug where an adversary could cause heap
corruption. This bug probably allows remote code execution
attacks. Reported by "debuger". Fixes CVE-2011-0427. Bugfix on
0.1.2.10-rc.
- Prevent a denial-of-service attack by disallowing any
zlib-compressed data whose compression factor is implausibly
high. Fixes part of bug 2324; reported by "doorss".
- Zero out a few more keys in memory before freeing them. Fixes
bug 2384 and part of bug 2385. These key instances found by
"cypherpunks", based on Andrew Case's report about being able
to find sensitive data in Tor's memory space if you have enough
permissions. Bugfix on 0.0.2pre9.
o Major bugfixes (crashes), also included in 0.2.1.29:
- Prevent calls to Libevent from inside Libevent log handlers.
This had potential to cause a nasty set of crashes, especially
if running Libevent with debug logging enabled, and running
Tor with a controller watching for low-severity log messages.
Bugfix on 0.1.0.2-rc. Fixes bug 2190.
- Add a check for SIZE_T_MAX to tor_realloc() to try to avoid
underflow errors there too. Fixes the other part of bug 2324.
- Fix a bug where we would assert if we ever had a
cached-descriptors.new file (or another file read directly into
memory) of exactly SIZE_T_CEILING bytes. Fixes bug 2326; bugfix
on 0.2.1.25. Found by doorss.
- Fix some potential asserts and parsing issues with grossly
malformed router caches. Fixes bug 2352; bugfix on Tor 0.2.1.27.
Found by doorss.
o Minor bugfixes (other), also included in 0.2.1.29:
- Fix a bug with handling misformed replies to reverse DNS lookup
requests in DNSPort. Bugfix on Tor 0.2.0.1-alpha. Related to a
bug reported by doorss.
- Fix compilation on mingw when a pthreads compatibility library
has been installed. (We don't want to use it, so we shouldn't
be including pthread.h.) Fixes bug 2313; bugfix on 0.1.0.1-rc.
- Fix a bug where we would declare that we had run out of virtual
addresses when the address space was only half-exhausted. Bugfix
on 0.1.2.1-alpha.
- Correctly handle the case where AutomapHostsOnResolve is set but
no virtual addresses are available. Fixes bug 2328; bugfix on
0.1.2.1-alpha. Bug found by doorss.
- Correctly handle wrapping around to when we run out of virtual
address space. Found by cypherpunks, bugfix on 0.2.0.5-alpha.
- The 0.2.1.28 tarball was missing src/common/OpenBSD_malloc_Linux.c
because we built it with a too-old version of automake. Thus that
release broke ./configure --enable-openbsd-malloc, which is popular
among really fast exit relays on Linux.
o Minor features, also included in 0.2.1.29:
- Update to the January 1 2011 Maxmind GeoLite Country database.
- Introduce output size checks on all of our decryption functions.
o Build changes, also included in 0.2.1.29:
- Tor does not build packages correctly with Automake 1.6 and earlier;
added a check to Makefile.am to make sure that we're building with
Automake 1.7 or later.
o Minor features, new in 0.2.2.21-alpha:
- Make sure to disable DirPort if running as a bridge. DirPorts aren't
used on bridges, and it makes bridge scanning somewhat easier.
- If writing the state file to disk fails, wait up to an hour before
retrying again, rather than trying again each second. Fixes bug
2346; bugfix on Tor 0.1.1.3-alpha.
- Make Libevent log messages get delivered to controllers later,
and not from inside the Libevent log handler. This prevents unsafe
reentrant Libevent calls while still letting the log messages
get through.
- Detect platforms that brokenly use a signed size_t, and refuse to
build there. Found and analyzed by doorss and rransom.
- Fix a bunch of compile warnings revealed by mingw with gcc 4.5.
Resolves bug 2314.
o Minor bugfixes, new in 0.2.2.21-alpha:
- Handle SOCKS messages longer than 128 bytes long correctly, rather
than waiting forever for them to finish. Fixes bug 2330; bugfix
on 0.2.0.16-alpha. Found by doorss.
- Add assertions to check for overflow in arguments to
base32_encode() and base32_decode(); fix a signed-unsigned
comparison there too. These bugs are not actually reachable in Tor,
but it's good to prevent future errors too. Found by doorss.
- Correctly detect failures to create DNS requests when using Libevent
versions before v2. (Before Libevent 2, we used our own evdns
implementation. Its return values for Libevent's evdns_resolve_*()
functions are not consistent with those from Libevent.) Fixes bug
2363; bugfix on 0.2.2.6-alpha. Found by "lodger".
o Documentation, new in 0.2.2.21-alpha:
- Document the default socks host and port (127.0.0.1:9050) for
tor-resolve.
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
Changes in version 0.2.2.20-alpha - 2010-12-17
Tor 0.2.2.20-alpha does some code cleanup to reduce the risk of remotely
exploitable bugs. We also fix a variety of other significant bugs,
change the IP address for one of our directory authorities, and update
the minimum version that Tor relays must run to join the network.
o Major bugfixes:
- Fix a remotely exploitable bug that could be used to crash instances
of Tor remotely by overflowing on the heap. Remote-code execution
hasn't been confirmed, but can't be ruled out. Everyone should
upgrade. Bugfix on the 0.1.1 series and later.
- Fix a bug that could break accounting on 64-bit systems with large
time_t values, making them hibernate for impossibly long intervals.
Fixes bug 2146. Bugfix on 0.0.9pre6; fix by boboper.
- Fix a logic error in directory_fetches_from_authorities() that
would cause all _non_-exits refusing single-hop-like circuits
to fetch from authorities, when we wanted to have _exits_ fetch
from authorities. Fixes more of 2097. Bugfix on 0.2.2.16-alpha;
fix by boboper.
- Fix a stream fairness bug that would cause newer streams on a given
circuit to get preference when reading bytes from the origin or
destination. Fixes bug 2210. Fix by Mashael AlSabah. This bug was
introduced before the first Tor release, in svn revision r152.
o Directory authority changes:
- Change IP address and ports for gabelmoo (v3 directory authority).
o Minor bugfixes:
- Avoid crashes when AccountingMax is set on clients. Fixes bug 2235.
Bugfix on 0.2.2.18-alpha. Diagnosed by boboper.
- Fix an off-by-one error in calculating some controller command
argument lengths. Fortunately, this mistake is harmless since
the controller code does redundant NUL termination too. Found by
boboper. Bugfix on 0.1.1.1-alpha.
- Do not dereference NULL if a bridge fails to build its
extra-info descriptor. Found by an anonymous commenter on
Trac. Bugfix on 0.2.2.19-alpha.
o Minor features:
- Update to the December 1 2010 Maxmind GeoLite Country database.
- Directory authorities now reject relays running any versions of
Tor between 0.2.1.3-alpha and 0.2.1.18 inclusive; they have
known bugs that keep RELAY_EARLY cells from working on rendezvous
circuits. Followup to fix for bug 2081.
- Directory authorities now reject relays running any version of Tor
older than 0.2.0.26-rc. That version is the earliest that fetches
current directory information correctly. Fixes bug 2156.
- Report only the top 10 ports in exit-port stats in order not to
exceed the maximum extra-info descriptor length of 50 KB. Implements
task 2196.
Changes in version 0.2.1.27 - 2010-11-23
Yet another OpenSSL security patch broke its compatibility with Tor:
Tor 0.2.1.27 makes relays work with openssl 0.9.8p and 1.0.0.b. We
also took this opportunity to fix several crash bugs, integrate a new
directory authority, and update the bundled GeoIP database.
o Major bugfixes:
- Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
No longer set the tlsext_host_name extension on server SSL objects;
but continue to set it on client SSL objects. Our goal in setting
it was to imitate a browser, not a vhosting server. Fixes bug 2204;
bugfix on 0.2.1.1-alpha.
- Do not log messages to the controller while shrinking buffer
freelists. Doing so would sometimes make the controller connection
try to allocate a buffer chunk, which would mess up the internals
of the freelist and cause an assertion failure. Fixes bug 1125;
fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
- Learn our external IP address when we're a relay or bridge, even if
we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
where we introduced bridge relays that don't need to publish to
be useful. Fixes bug 2050.
- Do even more to reject (and not just ignore) annotations on
router descriptors received anywhere but from the cache. Previously
we would ignore such annotations at first, but cache them to disk
anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
- When you're using bridges and your network goes away and your
bridges get marked as down, recover when you attempt a new socks
connection (if the network is back), rather than waiting up to an
hour to try fetching new descriptors for your bridges. Bugfix on
0.2.0.3-alpha; fixes bug 1981.
o Major features:
- Move to the November 2010 Maxmind GeoLite country db (rather
than the June 2009 ip-to-country GeoIP db) for our statistics that
count how many users relays are seeing from each country. Now we'll
have more accurate data, especially for many African countries.
o New directory authorities:
- Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
authority.
o Minor bugfixes:
- Fix an assertion failure that could occur in directory caches or
bridge users when using a very short voting interval on a testing
network. Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on
0.2.0.8-alpha.
- Enforce multiplicity rules when parsing annotations. Bugfix on
0.2.0.8-alpha. Found by piebeer.
- Allow handshaking OR connections to take a full KeepalivePeriod
seconds to handshake. Previously, we would close them after
IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
for analysis help.
- When building with --enable-gcc-warnings on OpenBSD, disable
warnings in system headers. This makes --enable-gcc-warnings
pass on OpenBSD 4.8.
o Minor features:
- Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
stream ending reason for this case: END_STREAM_REASON_NOROUTE.
Servers can start sending this code when enough clients recognize
it. Bugfix on 0.1.0.1-rc; fixes part of bug 1793.
- Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
Patch from mingw-san.
o Removed files:
- Remove the old debian/ directory from the main Tor distribution.
The official Tor-for-debian git repository lives at the URL
https://git.torproject.org/debian/tor.git
- Stop shipping the old doc/website/ directory in the tarball. We
changed the website format in late 2010, and what we shipped in
0.2.1.26 really wasn't that useful anyway.
Changes in version 0.2.2.19-alpha - 2010-11-22
Yet another OpenSSL security patch broke its compatibility with Tor:
Tor 0.2.2.19-alpha makes relays work with OpenSSL 0.9.8p and 1.0.0.b.
- Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
No longer set the tlsext_host_name extension on server SSL objects;
but continue to set it on client SSL objects. Our goal in setting
it was to imitate a browser, not a vhosting server. Fixes bug 2204;
bugfix on 0.2.1.1-alpha.
o Minor bugfixes:
- Try harder not to exceed the maximum length of 50 KB when writing
statistics to extra-info descriptors. This bug was triggered by very
fast relays reporting exit-port, entry, and dirreq statistics.
Reported by Olaf Selke. Bugfix on 0.2.2.1-alpha. Fixes bug 2183.
- Publish a router descriptor even if generating an extra-info
descriptor fails. Previously we would not publish a router
descriptor without an extra-info descriptor; this can cause fast
exit relays collecting exit-port statistics to drop from the
consensus. Bugfix on 0.1.2.9-rc; fixes bug 2195.
Changes in version 0.2.2.18-alpha - 2010-11-16
Tor 0.2.2.18-alpha fixes several crash bugs that have been nagging
us lately, makes unpublished bridge relays able to detect their IP
address, and fixes a wide variety of other bugs to get us much closer
to a stable release.
- Do even more to reject (and not just ignore) annotations on
router descriptors received anywhere but from the cache. Previously
we would ignore such annotations at first, but cache them to disk
anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
- Do not log messages to the controller while shrinking buffer
freelists. Doing so would sometimes make the controller connection
try to allocate a buffer chunk, which would mess up the internals
of the freelist and cause an assertion failure. Fixes bug 1125;
fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
- Learn our external IP address when we're a relay or bridge, even if
we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
where we introduced bridge relays that don't need to publish to
be useful. Fixes bug 2050.
- Maintain separate TLS contexts and certificates for incoming and
outgoing connections in bridge relays. Previously we would use the
same TLS contexts and certs for incoming and outgoing connections.
Bugfix on 0.2.0.3-alpha; addresses bug 988.
- Maintain separate identity keys for incoming and outgoing TLS
contexts in bridge relays. Previously we would use the same
identity keys for incoming and outgoing TLS contexts. Bugfix on
- Avoid an assertion failure when we as an authority receive a
duplicate upload of a router descriptor that we already have,
but which we previously considered an obsolete descriptor.
Fixes another case of bug 1776. Bugfix on 0.2.2.16-alpha.
- Avoid a crash bug triggered by looking at a dangling pointer while
setting the network status consensus. Found by Robert Ransom.
Bugfix on 0.2.2.17-alpha. Fixes bug 2097.
- Fix a logic error where servers that _didn't_ act as exits would
try to keep their server lists more aggressively up to date than
exits, when it was supposed to be the other way around. Bugfix
on 0.2.2.17-alpha.
o Minor bugfixes (on Tor 0.2.1.x and earlier):
- When we're trying to guess whether we know our IP address as
a relay, we would log various ways that we failed to guess
our address, but never log that we ended up guessing it
successfully. Now add a log line to help confused and anxious
relay operators. Bugfix on 0.1.2.1-alpha; fixes bug 1534.
- Bring the logic that gathers routerinfos and assesses the
acceptability of circuits into line. This prevents a Tor OP from
getting locked in a cycle of choosing its local OR as an exit for a
path (due to a .exit request) and then rejecting the circuit because
its OR is not listed yet. It also prevents Tor clients from using an
OR running in the same instance as an exit (due to a .exit request)
if the OR does not meet the same requirements expected of an OR
running elsewhere. Fixes bug 1859; bugfix on 0.1.0.1-rc.
- Correctly describe errors that occur when generating a TLS object.
Previously we would attribute them to a failure while generating a
TLS context. Patch by Robert Ransom. Bugfix on 0.1.0.4-rc; fixes
bug 1994.
- Enforce multiplicity rules when parsing annotations. Bugfix on
0.2.0.8-alpha. Found by piebeer.
- Fix warnings that newer versions of autoconf produced during
./autogen.sh. These warnings appear to be harmless in our case,
but they were extremely verbose. Fixes bug 2020.
o Minor bugfixes (on Tor 0.2.2.x):
- Enable protection of small arrays whenever we build with gcc
hardening features, not only when also building with warnings
enabled. Fixes bug 2031; bugfix on 0.2.2.14-alpha. Reported by keb.
o Minor features:
- Make hidden services work better in private Tor networks by not
requiring any uptime to join the hidden service descriptor
DHT. Implements ticket 2088.
- Rate-limit the "your application is giving Tor only an IP address"
warning. Addresses bug 2000; bugfix on 0.0.8pre2.
- When AllowSingleHopExits is set, print a warning to explain to the
relay operator why most clients are avoiding her relay.
- Update to the November 1 2010 Maxmind GeoLite Country database.
o Code simplifications and refactoring:
- When we fixed bug 1038 we had to put in a restriction not to send
RELAY_EARLY cells on rend circuits. This was necessary as long
as relays using Tor 0.2.1.3-alpha through 0.2.1.18-alpha were
active. Now remove this obsolete check. Resolves bug 2081.
- Some options used different conventions for uppercasing of acronyms
when comparing manpage and source. Fix those in favor of the
manpage, as it makes sense to capitalize acronyms.
- Remove the torrc.complete file. It hasn't been kept up to date
and users will have better luck checking out the manpage.
- Remove the obsolete "NoPublish" option; it has been flagged
as obsolete and has produced a warning since 0.1.1.18-rc.
- Remove everything related to building the expert bundle for OS X.
It has confused many users, doesn't work right on OS X 10.6,
and is hard to get rid of once installed. Resolves bug 1274.
Changes in version 0.2.2.17-alpha - 2010-09-30
Tor 0.2.2.17-alpha introduces a feature to make it harder for clients
to use one-hop circuits (which can put the exit relays at higher risk,
plus unbalance the network); fixes a big bug in bandwidth accounting
for relays that want to limit their monthly bandwidth use; fixes a
big pile of bugs in how clients tolerate temporary network failure;
and makes our adaptive circuit build timeout feature (which improves
client performance if your network is fast while not breaking things
if your network is slow) better handle bad networks.
o Major features:
- Exit relays now try harder to block exit attempts from unknown
relays, to make it harder for people to use them as one-hop proxies
a la tortunnel. Controlled by the refuseunknownexits consensus
parameter (currently enabled), or you can override it on your
relay with the RefuseUnknownExits torrc option. Resolves bug 1751.
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
o Major bugfixes (0.2.1.x and earlier):
- Fix a bug in bandwidth accounting that could make us use twice
the intended bandwidth when our interval start changes due to
daylight saving time. Now we tolerate skew in stored vs computed
interval starts: if the start of the period changes by no more than
50% of the period's duration, we remember bytes that we transferred
in the old period. Fixes bug 1511; bugfix on 0.0.9pre5.
- Always search the Windows system directory for system DLLs, and
nowhere else. Bugfix on 0.1.1.23; fixes bug 1954.
- When you're using bridges and your network goes away and your
bridges get marked as down, recover when you attempt a new socks
connection (if the network is back), rather than waiting up to an
hour to try fetching new descriptors for your bridges. Bugfix on
0.2.0.3-alpha; fixes bug 1981.
o Major bugfixes (on 0.2.2.x):
- Fix compilation on Windows. Bugfix on 0.2.2.16-alpha; related to
bug 1797.
- Fix a segfault that could happen when operating a bridge relay with
no GeoIP database set. Fixes bug 1964; bugfix on 0.2.2.15-alpha.
- The consensus bandwidth-weights (used by clients to choose fast
relays) entered an unexpected edge case in September where
Exits were much scarcer than Guards, resulting in bad weight
recommendations. Now we compute them using new constraints that
should succeed in all cases. Also alter directory authorities to
not include the bandwidth-weights line if they fail to produce
valid values. Fixes bug 1952; bugfix on 0.2.2.10-alpha.
- When weighting bridges during path selection, we used to trust
the bandwidths they provided in their descriptor, only capping them
at 10MB/s. This turned out to be problematic for two reasons:
Bridges could claim to handle a lot more traffic then they
actually would, thus making more clients pick them and have a
pretty effective DoS attack. The other issue is that new bridges
that might not have a good estimate for their bw capacity yet
would not get used at all unless no other bridges are available
to a client. Fixes bug 1912; bugfix on 0.2.2.7-alpha.
o Major bugfixes (on the circuit build timeout feature, 0.2.2.x):
- Ignore cannibalized circuits when recording circuit build times.
This should provide for a minor performance improvement for hidden
service users using 0.2.2.14-alpha, and should remove two spurious
notice log messages. Bugfix on 0.2.2.14-alpha; fixes bug 1740.
- Simplify the logic that causes us to decide if the network is
unavailable for purposes of recording circuit build times. If we
receive no cells whatsoever for the entire duration of a circuit's
full measured lifetime, the network is probably down. Also ignore
one-hop directory fetching circuit timeouts when calculating our
circuit build times. These changes should hopefully reduce the
cases where we see ridiculous circuit build timeouts for people
with spotty wireless connections. Fixes part of bug 1772; bugfix
on 0.2.2.2-alpha.
- Prevent the circuit build timeout from becoming larger than
the maximum build time we have ever seen. Also, prevent the time
period for measurement circuits from becoming larger than twice that
value. Fixes the other part of bug 1772; bugfix on 0.2.2.2-alpha.
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
o Minor features:
- When we run out of directory information such that we can't build
circuits, but then get enough that we can build circuits, log when
we actually construct a circuit, so the user has a better chance of
knowing what's going on. Fixes bug 1362.
- Be more generous with how much bandwidth we'd use up (with
accounting enabled) before entering "soft hibernation". Previously,
we'd refuse new connections and circuits once we'd used up 95% of
our allotment. Now, we use up 95% of our allotment, AND make sure
that we have no more than 500MB (or 3 hours of expected traffic,
whichever is lower) remaining before we enter soft hibernation.
- If we've configured EntryNodes and our network goes away and/or all
our entrynodes get marked down, optimistically retry them all when
a new socks application request appears. Fixes bug 1882.
- Add some more defensive programming for architectures that can't
handle unaligned integer accesses. We don't know of any actual bugs
right now, but that's the best time to fix them. Fixes bug 1943.
- Support line continuations in the torrc config file. If a line
ends with a single backslash character, the newline is ignored, and
the configuration value is treated as continuing on the next line.
Resolves bug 1929.
o Minor bugfixes (on 0.2.1.x and earlier):
- For bandwidth accounting, calculate our expected bandwidth rate
based on the time during which we were active and not in
soft-hibernation during the last interval. Previously, we were
also considering the time spent in soft-hibernation. If this
was a long time, we would wind up underestimating our bandwidth
by a lot, and skewing our wakeup time towards the start of the
accounting interval. Fixes bug 1789. Bugfix on 0.0.9pre5.
o Minor bugfixes (on 0.2.2.x):
- Resume generating CIRC FAILED REASON=TIMEOUT control port messages,
which were disabled by the circuit build timeout changes in
0.2.2.14-alpha. Bugfix on 0.2.2.14-alpha; fixes bug 1739.
- Make sure we don't warn about missing bandwidth weights when
choosing bridges or other relays not in the consensus. Bugfix on
0.2.2.10-alpha; fixes bug 1805.
- In our logs, do not double-report signatures from unrecognized
authorities both as "from unknown authority" and "not
present". Fixes bug 1956, bugfix on 0.2.2.16-alpha.
Tor 0.2.2.16-alpha fixes a variety of old stream fairness bugs (most
evident at exit relays), and also continues to resolve all the little
bugs that have been filling up trac lately.
o Major bugfixes (stream-level fairness):
- When receiving a circuit-level SENDME for a blocked circuit, try
to package cells fairly from all the streams that had previously
been blocked on that circuit. Previously, we had started with the
oldest stream, and allowed each stream to potentially exhaust
the circuit's package window. This gave older streams on any
given circuit priority over newer ones. Fixes bug 1937. Detected
originally by Camilo Viecco. This bug was introduced before the
first Tor release, in svn commit r152: it is the new winner of
the longest-lived bug prize.
- When the exit relay got a circuit-level sendme cell, it started
reading on the exit streams, even if had 500 cells queued in the
circuit queue already, so the circuit queue just grew and grew in
some cases. We fix this by not re-enabling reading on receipt of a
sendme cell when the cell queue is blocked. Fixes bug 1653. Bugfix
on 0.2.0.1-alpha. Detected by Mashael AlSabah. Original patch by
"yetonetime".
- Newly created streams were allowed to read cells onto circuits,
even if the circuit's cell queue was blocked and waiting to drain.
This created potential unfairness, as older streams would be
blocked, but newer streams would gladly fill the queue completely.
We add code to detect this situation and prevent any stream from
getting more than one free cell. Bugfix on 0.2.0.1-alpha. Partially
fixes bug 1298.
o Minor features:
- Update to the September 1 2010 Maxmind GeoLite Country database.
- Warn when CookieAuthFileGroupReadable is set but CookieAuthFile is
not. This would lead to a cookie that is still not group readable.
Closes bug 1843. Suggested by katmagic.
- When logging a rate-limited warning, we now mention how many messages
got suppressed since the last warning.
- Add new "perconnbwrate" and "perconnbwburst" consensus params to
do individual connection-level rate limiting of clients. The torrc
config options with the same names trump the consensus params, if
both are present. Replaces the old "bwconnrate" and "bwconnburst"
consensus params which were broken from 0.2.2.7-alpha through
0.2.2.14-alpha. Closes bug 1947.
- When a router changes IP address or port, authorities now launch
a new reachability test for it. Implements ticket 1899.
- Make the formerly ugly "2 unknown, 7 missing key, 0 good, 0 bad,
2 no signature, 4 required" messages about consensus signatures
easier to read, and make sure they get logged at the same severity
as the messages explaining which keys are which. Fixes bug 1290.
- Don't warn when we have a consensus that we can't verify because
of missing certificates, unless those certificates are ones
that we have been trying and failing to download. Fixes bug 1145.
- If you configure your bridge with a known identity fingerprint,
and the bridge authority is unreachable (as it is in at least
one country now), fall back to directly requesting the descriptor
from the bridge. Finishes the feature started in 0.2.0.10-alpha;
closes bug 1138.
- When building with --enable-gcc-warnings on OpenBSD, disable
warnings in system headers. This makes --enable-gcc-warnings
pass on OpenBSD 4.8.
o Minor bugfixes (on 0.2.1.x and earlier):
- Authorities will now attempt to download consensuses if their
own efforts to make a live consensus have failed. This change
means authorities that restart will fetch a valid consensus, and
it means authorities that didn't agree with the current consensus
will still fetch and serve it if it has enough signatures. Bugfix
on 0.2.0.9-alpha; fixes bug 1300.
- Ensure DNS requests launched by "RESOLVE" commands from the
controller respect the __LeaveStreamsUnattached setconf options. The
same goes for requests launched via DNSPort or transparent
proxying. Bugfix on 0.2.0.1-alpha; fixes bug 1525.
- Allow handshaking OR connections to take a full KeepalivePeriod
seconds to handshake. Previously, we would close them after
IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
for analysis help.
- Rate-limit "Failed to hand off onionskin" warnings.
- Never relay a cell for a circuit we have already destroyed.
Between marking a circuit as closeable and finally closing it,
it may have been possible for a few queued cells to get relayed,
even though they would have been immediately dropped by the next
OR in the circuit. Fixes bug 1184; bugfix on 0.2.0.1-alpha.
- Never queue a cell for a circuit that's already been marked
for close.
- Never vote for a server as "Running" if we have a descriptor for
it claiming to be hibernating, and that descriptor was published
more recently than our last contact with the server. Bugfix on
0.2.0.3-alpha; fixes bug 911.
- Squash a compile warning on OpenBSD. Reported by Tas; fixes
bug 1848.
o Minor bugfixes (on 0.2.2.x):
- Fix a regression introduced in 0.2.2.7-alpha that marked relays
down if a directory fetch fails and you've configured either
bridges or EntryNodes. The intent was to mark the relay as down
_unless_ you're using bridges or EntryNodes, since if you are
then you could quickly run out of entry points.
- Fix the Windows directory-listing code. A bug introduced in
0.2.2.14-alpha could make Windows directory servers forget to load
some of their cached v2 networkstatus files.
- Really allow clients to use relays as bridges. Fixes bug 1776;
bugfix on 0.2.2.15-alpha.
- Demote a warn to info that happens when the CellStatistics option
was just enabled. Bugfix on 0.2.2.15-alpha; fixes bug 1921.
Reported by Moritz Bartl.
- On Windows, build correctly either with or without Unicode support.
This is necessary so that Tor can support fringe platforms like
Windows 98 (which has no Unicode), or Windows CE (which has no
non-Unicode). Bugfix on 0.2.2.14-alpha; fixes bug 1797.
o Testing
- Add a unit test for cross-platform directory-listing code.
Changes in version 0.2.2.15-alpha - 2010-08-18
Tor 0.2.2.15-alpha fixes a big bug in hidden service availability,
fixes a variety of other bugs that were preventing performance
experiments from moving forward, fixes several bothersome memory leaks,
and generally closes a lot of smaller bugs that have been filling up
trac lately.
o Major bugfixes:
- Stop assigning the HSDir flag to relays that disable their
DirPort (and thus will refuse to answer directory requests). This
fix should dramatically improve the reachability of hidden services:
hidden services and hidden service clients pick six HSDir relays
to store and retrieve the hidden service descriptor, and currently
about half of the HSDir relays will refuse to work. Bugfix on
0.2.0.10-alpha; fixes part of bug 1693.
- The PerConnBWRate and Burst config options, along with the
bwconnrate and bwconnburst consensus params, initialized each conn's
token bucket values only when the connection is established. Now we
update them if the config options change, and update them every time
we get a new consensus. Otherwise we can encounter an ugly edge
case where we initialize an OR conn to client-level bandwidth,
but then later the relay joins the consensus and we leave it
throttled. Bugfix on 0.2.2.7-alpha; fixes bug 1830.
- Fix a regression that caused Tor to rebind its ports if it receives
SIGHUP while hibernating. Bugfix in 0.1.1.6-alpha; closes bug 919.
o Major features:
- Lower the maximum weighted-fractional-uptime cutoff to 98%. This
should give us approximately 40-50% more Guard-flagged nodes,
improving the anonymity the Tor network can provide and also
decreasing the dropoff in throughput that relays experience when
they first get the Guard flag.
- Allow enabling or disabling the *Statistics config options while
Tor is running.
- Update to the August 1 2010 Maxmind GeoLite Country database.
- Have the controller interface give a more useful message than
"Internal Error" in response to failed GETINFO requests.
- Warn when the same option is provided more than once in a torrc
file, on the command line, or in a single SETCONF statement, and
the option is one that only accepts a single line. Closes bug 1384.
- Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
Patch from mingw-san.
- Add support for the country code "{??}" in torrc options like
ExcludeNodes, to indicate all routers of unknown country. Closes
bug 1094.
- Relays report the number of bytes spent on answering directory
requests in extra-info descriptors similar to {read,write}-history.
Implements enhancement 1790.
o Minor bugfixes (on 0.2.1.x and earlier):
- Complain if PublishServerDescriptor is given multiple arguments that
include 0 or 1. This configuration will be rejected in the future.
Bugfix on 0.2.0.1-alpha; closes bug 1107.
- Disallow BridgeRelay 1 and ORPort 0 at once in the configuration.
Bugfix on 0.2.0.13-alpha; closes bug 928.
- Change "Application request when we're believed to be offline."
notice to "Application request when we haven't used client
functionality lately.", to clarify that it's not an error. Bugfix
on 0.0.9.3; fixes bug 1222.
- Fix a bug in the controller interface where "GETINFO ns/asdaskljkl"
would return "551 Internal error" rather than "552 Unrecognized key
ns/asdaskljkl". Bugfix on 0.1.2.3-alpha.
- Users can't configure a regular relay to be their bridge. It didn't
work because when Tor fetched the bridge descriptor, it found
that it already had it, and didn't realize that the purpose of the
descriptor had changed. Now we replace routers with a purpose other
than bridge with bridge descriptors when fetching them. Bugfix on
0.1.1.9-alpha. Bug 1776 not yet fixed because now we immediately
refetch the descriptor with router purpose 'general', disabling
it as a bridge.
- Fix a rare bug in rend_fn unit tests: we would fail a test when
a randomly generated port is 0. Diagnosed by Matt Edman. Bugfix
on 0.2.0.10-alpha; fixes bug 1808.
- Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
Nick Mathewson
committed
and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
stream ending reason for this case: END_STREAM_REASON_NOROUTE.
Servers can start sending this code when enough clients recognize
it. Also update the spec to reflect this new reason. Bugfix on
- Delay geoip stats collection by bridges for 6 hours, not 2 hours,
when we switch from being a public relay to a bridge. Otherwise
there will still be clients that see the relay in their consensus,
and the stats will end up wrong. Bugfix on 0.2.1.15-rc; fixes bug
932 even more.
- Instead of giving an assertion failure on an internal mismatch
on estimated freelist size, just log a BUG warning and try later.
Mitigates but does not fix bug 1125.
- Fix an assertion failure that could occur in caches or bridge users
when using a very short voting interval on a testing network.
Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on 0.2.0.8-alpha.
o Minor bugfixes (on 0.2.2.x):
- Alter directory authorities to always consider Exit-flagged nodes
as potential Guard nodes in their votes. The actual decision to
use Exits as Guards is done in the consensus bandwidth weights.
Fixes bug 1294; bugfix on 0.2.2.10-alpha.
- When the controller is reporting the purpose of circuits that
didn't finish building before the circuit build timeout, it was
printing UNKNOWN_13. Now print EXPIRED. Bugfix on 0.2.2.14-alpha.
- Our libevent version parsing code couldn't handle versions like
1.4.14b-stable and incorrectly warned the user about using an
old and broken version of libevent. Treat 1.4.14b-stable like
1.4.14-stable when parsing the version. Fixes bug 1731; bugfix
on 0.2.2.1-alpha.
- Don't use substitution references like $(VAR:MOD) when
$(asciidoc_files) is empty -- make(1) on NetBSD transforms
'$(:x)' to 'x' rather than the empty string. This bites us in
doc/ when configured with --disable-asciidoc. Bugfix on
0.2.2.9-alpha; fixes bug 1773.
- Remove a spurious hidden service server-side log notice about
"Ancient non-dirty circuits". Bugfix on 0.2.2.14-alpha; fixes
bug 1741.
- Fix compilation with --with-dmalloc set. Bugfix on 0.2.2.6-alpha;
fixes bug 1832.
- Correctly report written bytes on linked connections. Found while
implementing 1790. Bugfix on 0.2.2.4-alpha.
- Fix three memory leaks: one in circuit_build_times_parse_state(),
one in dirvote_add_signatures_to_pending_consensus(), and one every
time we parse a v3 network consensus. Bugfixes on 0.2.2.14-alpha,
0.2.2.6-alpha, and 0.2.2.10-alpha respectively; fixes bug 1831.
o Code simplifications and refactoring:
- Take a first step towards making or.h smaller by splitting out
function definitions for all source files in src/or/. Leave
structures and defines in or.h for now.
- Remove a bunch of unused function declarations as well as a block of
#if 0'd code from the unit tests. Closes bug 1824.
- New unit tests for exit-port history statistics; refactored exit
statistics code to be more easily tested.
- Remove the old debian/ directory from the main Tor distribution.
The official Tor-for-debian git repository lives at the URL
https://git.torproject.org/debian/tor.git
Changes in version 0.2.2.14-alpha - 2010-07-12
Tor 0.2.2.14-alpha greatly improves client-side handling of
circuit build timeouts, which are used to estimate speed and improve
performance. We also move to a much better GeoIP database, port Tor to
Windows CE, introduce new compile flags that improve code security,
add an eighth v3 directory authority, and address a lot of more
minor issues.
o Major bugfixes:
- Tor directory authorities no longer crash when started with a
cached-microdesc-consensus file in their data directory. Bugfix
on 0.2.2.6-alpha; fixes bug 1532.
- Treat an unset $HOME like an empty $HOME rather than triggering an
assert. Bugfix on 0.0.8pre1; fixes bug 1522.
- Ignore negative and large circuit build timeout values that can
happen during a suspend or hibernate. These values caused various
asserts to fire. Bugfix on 0.2.2.2-alpha; fixes bug 1245.
- Alter calculation of Pareto distribution parameter 'Xm' for
Circuit Build Timeout learning to use the weighted average of the
top N=3 modes (because we have three entry guards). Considering
multiple modes should improve the timeout calculation in some cases,
and prevent extremely high timeout values. Bugfix on 0.2.2.2-alpha;
fixes bug 1335.
- Alter calculation of Pareto distribution parameter 'Alpha' to use a
right censored distribution model. This approach improves over the
synthetic timeout generation approach that was producing insanely
high timeout values. Now we calculate build timeouts using truncated
times. Bugfix on 0.2.2.2-alpha; fixes bugs 1245 and 1335.
- Do not close circuits that are under construction when they reach
the circuit build timeout. Instead, leave them building (but do not
use them) for up until the time corresponding to the 95th percentile
on the Pareto CDF or 60 seconds, whichever is greater. This is done
to provide better data for the new Pareto model. This percentile
can be controlled by the consensus.
o Major features:
- Move to the June 2010 Maxmind GeoLite country db (rather than the
June 2009 ip-to-country GeoIP db) for our statistics that count
how many users relays are seeing from each country. Now we have
more accurate data for many African countries.
- Port Tor to build and run correctly on Windows CE systems, using
the wcecompat library. Contributed by Valerio Lupi.
- New "--enable-gcc-hardening" ./configure flag (off by default)
to turn on gcc compile time hardening options. It ensures
that signed ints have defined behavior (-fwrapv), enables
-D_FORTIFY_SOURCE=2 (requiring -O2), adds stack smashing protection
with canaries (-fstack-protector-all), turns on ASLR protection if
supported by the kernel (-fPIE, -pie), and adds additional security
related warnings. Verified to work on Mac OS X and Debian Lenny.
- New "--enable-linker-hardening" ./configure flag (off by default)
to turn on ELF specific hardening features (relro, now). This does
not work with Mac OS X or any other non-ELF binary format.
o New directory authorities:
- Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
authority.
o Minor features:
- New config option "WarnUnsafeSocks 0" disables the warning that
occurs whenever Tor receives only an IP address instead of a
hostname. Setups that do DNS locally over Tor are fine, and we
shouldn't spam the logs in that case.
- Convert the HACKING file to asciidoc, and add a few new sections
to it, explaining how we use Git, how we make changelogs, and
what should go in a patch.
- Add a TIMEOUT_RATE keyword to the BUILDTIMEOUT_SET control port
event, to give information on the current rate of circuit timeouts
over our stored history.
- Add ability to disable circuit build time learning via consensus
parameter and via a LearnCircuitBuildTimeout config option. Also
automatically disable circuit build time calculation if we are
either a AuthoritativeDirectory, or if we fail to write our state
file. Fixes bug 1296.
- More gracefully handle corrupt state files, removing asserts
in favor of saving a backup and resetting state.
- Rename the "log.h" header to "torlog.h" so as to conflict with fewer
system headers.
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
o Minor bugfixes:
- Build correctly on OSX with zlib 1.2.4 and higher with all warnings
enabled.
- When a2x fails, mention that the user could disable manpages instead
of trying to fix their asciidoc installation.
- Where available, use Libevent 2.0's periodic timers so that our
once-per-second cleanup code gets called even more closely to
once per second than it would otherwise. Fixes bug 943.
- If you run a bridge that listens on multiple IP addresses, and
some user configures a bridge address that uses a different IP
address than your bridge writes in its router descriptor, and the
user doesn't specify an identity key, their Tor would discard the
descriptor because "it isn't one of our configured bridges", and
fail to bootstrap. Now believe the descriptor and bootstrap anyway.
Bugfix on 0.2.0.3-alpha.
- If OpenSSL fails to make a duplicate of a private or public key, log
an error message and try to exit cleanly. May help with debugging
if bug 1209 ever remanifests.
- Save a couple bytes in memory allocation every time we escape
certain characters in a string. Patch from Florian Zumbiehl.
- Make it explicit that we don't cannibalize one-hop circuits. This
happens in the wild, but doesn't turn out to be a problem because
we fortunately don't use those circuits. Many thanks to outofwords
for the initial analysis and to swissknife who confirmed that
two-hop circuits are actually created.
- Make directory mirrors report non-zero dirreq-v[23]-shares again.
Fixes bug 1564; bugfix on 0.2.2.9-alpha.
- Eliminate a case where a circuit build time warning was displayed
after network connectivity resumed. Bugfix on 0.2.2.2-alpha.
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
Changes in version 0.2.1.26 - 2010-05-02
Tor 0.2.1.26 addresses the recent connection and memory overload
problems we've been seeing on relays, especially relays with their
DirPort open. If your relay has been crashing, or you turned it off
because it used too many resources, give this release a try.
This release also fixes yet another instance of broken OpenSSL libraries
that was causing some relays to drop out of the consensus.
o Major bugfixes:
- Teach relays to defend themselves from connection overload. Relays
now close idle circuits early if it looks like they were intended
for directory fetches. Relays are also more aggressive about closing
TLS connections that have no circuits on them. Such circuits are
unlikely to be re-used, and tens of thousands of them were piling
up at the fast relays, causing the relays to run out of sockets
and memory. Bugfix on 0.2.0.22-rc (where clients started tunneling
their directory fetches over TLS).
- Fix SSL renegotiation behavior on OpenSSL versions like on Centos
that claim to be earlier than 0.9.8m, but which have in reality
backported huge swaths of 0.9.8m or 0.9.8n renegotiation
behavior. Possible fix for some cases of bug 1346.
- Directory mirrors were fetching relay descriptors only from v2
directory authorities, rather than v3 authorities like they should.
Only 2 v2 authorities remain (compared to 7 v3 authorities), leading
to a serious bottleneck. Bugfix on 0.2.0.9-alpha. Fixes bug 1324.
o Minor bugfixes:
- Finally get rid of the deprecated and now harmful notion of "clique
mode", where directory authorities maintain TLS connections to
every other relay.
o Testsuite fixes:
- In the util/threads test, no longer free the test_mutex before all
worker threads have finished. Bugfix on 0.2.1.6-alpha.
- The master thread could starve the worker threads quite badly on
certain systems, causing them to run only partially in the allowed
window. This resulted in test failures. Now the master thread sleeps
occasionally for a few microseconds while the two worker-threads
compete for the mutex. Bugfix on 0.2.0.1-alpha.
Changes in version 0.2.2.13-alpha - 2010-04-24
Tor 0.2.2.13-alpha addresses the recent connection and memory overload
problems we've been seeing on relays, especially relays with their
DirPort open. If your relay has been crashing, or you turned it off
because it used too many resources, give this release a try.
- Teach relays to defend themselves from connection overload. Relays
now close idle circuits early if it looks like they were intended
for directory fetches. Relays are also more aggressive about closing
TLS connections that have no circuits on them. Such circuits are
unlikely to be re-used, and tens of thousands of them were piling
up at the fast relays, causing the relays to run out of sockets
and memory. Bugfix on 0.2.0.22-rc (where clients started tunneling
their directory fetches over TLS).
- Finally get rid of the deprecated and now harmful notion of "clique
mode", where directory authorities maintain TLS connections to
every other relay.
- Directory authorities now do an immediate reachability check as soon
as they hear about a new relay. This change should slightly reduce
the time between setting up a relay and getting listed as running
in the consensus. It should also improve the time between setting
up a bridge and seeing use by bridge users.
- Directory authorities no longer launch a TLS connection to every
relay as they startup. Now that we have 2k+ descriptors cached,
the resulting network hiccup is becoming a burden. Besides,
authorities already avoid voting about Running for the first half
hour of their uptime.
Changes in version 0.2.2.12-alpha - 2010-04-20
Tor 0.2.2.12-alpha fixes a critical bug in how directory authorities
handle and vote on descriptors. It was causing relays to drop out of
the consensus.
o Major bugfixes:
- Many relays have been falling out of the consensus lately because
not enough authorities know about their descriptor for them to get
a majority of votes. When we deprecated the v2 directory protocol,
we got rid of the only way that v3 authorities can hear from each
other about other descriptors. Now authorities examine every v3
vote for new descriptors, and fetch them from that authority. Bugfix
on 0.2.1.23.
- Fix two typos in tor_vasprintf() that broke the compile on Windows,
and a warning in or.h related to bandwidth_weight_rule_t that
prevented clean compile on OS X. Fixes bug 1363; bugfix on
0.2.2.11-alpha.
- Fix a segfault on relays when DirReqStatistics is enabled
and 24 hours pass. Bug found by keb. Fixes bug 1365; bugfix on
0.2.2.11-alpha.
o Minor bugfixes:
- Demote a confusing TLS warning that relay operators might get when
someone tries to talk to their OrPort. It is neither the operator's
fault nor can they do anything about it. Fixes bug 1364; bugfix
on 0.2.0.14-alpha.
Changes in version 0.2.2.11-alpha - 2010-04-15
Tor 0.2.2.11-alpha fixes yet another instance of broken OpenSSL
libraries that was causing some relays to drop out of the consensus.
o Major bugfixes:
- Directory mirrors were fetching relay descriptors only from v2
directory authorities, rather than v3 authorities like they should.
Only 2 v2 authorities remain (compared to 7 v3 authorities), leading
to a serious bottleneck. Bugfix on 0.2.0.9-alpha. Fixes bug 1324.
- Fix a parsing error that made every possible value of
CircPriorityHalflifeMsec get treated as "1 msec". Bugfix
on 0.2.2.7-alpha. Rename CircPriorityHalflifeMsec to
CircuitPriorityHalflifeMsec, so authorities can tell newer relays
about the option without breaking older ones.
- Fix SSL renegotiation behavior on OpenSSL versions like on Centos
that claim to be earlier than 0.9.8m, but which have in reality
backported huge swaths of 0.9.8m or 0.9.8n renegotiation
behavior. Possible fix for some cases of bug 1346.
o Minor features:
- Experiment with a more aggressive approach to preventing clients
from making one-hop exit streams. Exit relays who want to try it
out can set "RefuseUnknownExits 1" in their torrc, and then look
for "Attempt by %s to open a stream" log messages. Let us know
how it goes!
- Add support for statically linking zlib by specifying
--enable-static-zlib, to go with our support for statically linking
- Fix a segfault that happens whenever a Tor client that is using
libevent2's bufferevents gets a hup signal. Bugfix on 0.2.2.5-alpha;
fixes bug 1341.
- When we cleaned up the contrib/tor-exit-notice.html file, we left
out the first line. Fixes bug 1295.
- When building the manpage from a tarball, we required asciidoc, but
the asciidoc -> roff/html conversion was already done for the
tarball. Make 'make' complain only when we need asciidoc (either
because we're compiling directly from git, or because we altered
the asciidoc manpage in the tarball). Bugfix on 0.2.2.9-alpha.
- When none of the directory authorities vote on any params, Tor
segfaulted when trying to make the consensus from the votes. We
didn't trigger the bug in practice, because authorities do include
params in their votes. Bugfix on 0.2.2.10-alpha; fixes bug 1322.
o Testsuite fixes:
- In the util/threads test, no longer free the test_mutex before all
worker threads have finished. Bugfix on 0.2.1.6-alpha.
- The master thread could starve the worker threads quite badly on
certain systems, causing them to run only partially in the allowed
window. This resulted in test failures. Now the master thread sleeps
occasionally for a few microseconds while the two worker-threads
compete for the mutex. Bugfix on 0.2.0.1-alpha.
Changes in version 0.2.2.10-alpha - 2010-03-07
Tor 0.2.2.10-alpha fixes a regression introduced in 0.2.2.9-alpha that
could prevent relays from guessing their IP address correctly. It also
starts the groundwork for another client-side performance boost, since
currently we're not making efficient use of relays that have both the
Guard flag and the Exit flag.
o Major bugfixes:
- Fix a regression from our patch for bug 1244 that caused relays
to guess their IP address incorrectly if they didn't set Address
in their torrc and/or their address fails to resolve. Bugfix on
0.2.2.9-alpha; fixes bug 1269.
o Major features (performance):
- Directory authorities now compute consensus weightings that instruct
clients how to weight relays flagged as Guard, Exit, Guard+Exit,
and no flag. Clients that use these weightings will distribute
network load more evenly across these different relay types. The
weightings are in the consensus so we can change them globally in
the future. Extra thanks to "outofwords" for finding some nasty
security bugs in the first implementation of this feature.