From 33f8dcae6a4fd2a380fed23d028ea0a88bf7c133 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Fri, 12 Feb 2010 12:35:40 -0500 Subject: [PATCH 1/7] prepare for 0.2.1.23 --- ChangeLog | 24 ++++++++++++------------ ReleaseNotes | 34 ++++++++++++++++++++++++++++++++++ configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 5 files changed, 49 insertions(+), 15 deletions(-) diff --git a/ChangeLog b/ChangeLog index 62925d8677..8a743f05ed 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.2.1.23 - 2010-0?-?? +Changes in version 0.2.1.23 - 2010-02-12 o Major bugfixes (performance): - We were selecting our guards uniformly at random, and then weighting which of our guards we'd use uniformly at random. This imbalance @@ -9,20 +9,20 @@ Changes in version 0.2.1.23 - 2010-0?-?? bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry. o Major bugfixes: + - Make Tor work again on the latest OS X: when deciding whether to + use strange flags to turn TLS renegotiation on, detect the OpenSSL + version at run-time, not compile time. We need to do this because + Apple doesn't update its dev-tools headers when it updates its + libraries in a security patch. - Fix a potential buffer overflow in lookup_last_hid_serv_request() - that could happen on 32-bit platforms with 64-bit time_t. Also fix - a memory leak when requesting a hidden service descriptor we've - requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found - by aakova. + that could happen on 32-bit platforms with 64-bit time_t. Also fix + a memory leak when requesting a hidden service descriptor we've + requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found + by aakova. o Minor bugfixes: - - When deciding whether to use strange flags to turn TLS renegotiation - on, detect the OpenSSL version at run-time, not compile time. We - need to do this because Apple doesn't update its dev-tools headers - when it updates its libraries in a security patch. - - Refactor resolve_my_address() a little, to not use gethostbyname() - anymore. Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike - Mestnik. + - Refactor resolve_my_address() to not use gethostbyname() anymore. + Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik. o Minor features: - Avoid a mad rush at the beginning of each month when each client diff --git a/ReleaseNotes b/ReleaseNotes index 3790142d3d..000e174354 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,40 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.1.23 - 2010-02-12 + o Major bugfixes (performance): + - We were selecting our guards uniformly at random, and then weighting + which of our guards we'd use uniformly at random. This imbalance + meant that Tor clients were severely limited on throughput (and + probably latency too) by the first hop in their circuit. Now we + select guards weighted by currently advertised bandwidth. We also + automatically discard guards picked using the old algorithm. Fixes + bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry. + + o Major bugfixes: + - Make Tor work again on the latest OS X: when deciding whether to + use strange flags to turn TLS renegotiation on, detect the OpenSSL + version at run-time, not compile time. We need to do this because + Apple doesn't update its dev-tools headers when it updates its + libraries in a security patch. + - Fix a potential buffer overflow in lookup_last_hid_serv_request() + that could happen on 32-bit platforms with 64-bit time_t. Also fix + a memory leak when requesting a hidden service descriptor we've + requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found + by aakova. + + o Minor bugfixes: + - Refactor resolve_my_address() to not use gethostbyname() anymore. + Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik. + + o Minor features: + - Avoid a mad rush at the beginning of each month when each client + rotates half of its guards. Instead we spread the rotation out + throughout the month, but we still avoid leaving a precise timestamp + in the state file about when we first picked the guard. Improves + over the behavior introduced in 0.1.2.17. + + Changes in version 0.2.1.22 - 2010-01-19 Tor 0.2.1.22 fixes a critical privacy problem in bridge directory authorities -- it would tell you its whole history of bridge descriptors diff --git a/configure.in b/configure.in index 86fa2eb1c2..5b12860a83 100644 --- a/configure.in +++ b/configure.in @@ -5,7 +5,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.1.22) +AM_INIT_AUTOMAKE(tor, 0.2.1.23) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index a6124c8568..a184f8267c 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -9,7 +9,7 @@ !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.1.22" +!define VERSION "0.2.1.23" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index dec1a9c459..c25cb8a382 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -226,6 +226,6 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.1.22" +#define VERSION "0.2.1.23" From 3e6a37e61e7a7cd654fffff9eafdcbf65f7a3fd8 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Fri, 12 Feb 2010 14:31:08 -0500 Subject: [PATCH 2/7] new dannenberg address; make moria2's demise official. --- ChangeLog | 5 +++++ src/or/config.c | 4 +--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8a743f05ed..b75ac0c907 100644 --- a/ChangeLog +++ b/ChangeLog @@ -20,6 +20,11 @@ Changes in version 0.2.1.23 - 2010-02-12 requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found by aakova. + o Directory authority changes: + - Change IP address for dannenberg (v3 directory authority), and + remove moria2 (obsolete v1, v2 directory authority and v0 hidden + service directory authority) from the list. + o Minor bugfixes: - Refactor resolve_my_address() to not use gethostbyname() anymore. Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik. diff --git a/src/or/config.c b/src/or/config.c index a634f16cb6..26d664454d 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -906,8 +906,6 @@ add_default_trusted_dir_authorities(authority_type_t type) "moria1 orport=9101 no-v2 " "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", - "moria2 v1 orport=9002 128.31.0.34:9032 " - "719B E45D E224 B607 C537 07D0 E214 3E2D 423E 74CF", "tor26 v1 orport=443 v3ident=14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4 " "86.59.21.38:80 847B 1F85 0344 D787 6491 A548 92F9 0493 4E4E B85D", "dizum orport=443 v3ident=E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58 " @@ -921,7 +919,7 @@ add_default_trusted_dir_authorities(authority_type_t type) "80.190.246.100:8180 F204 4413 DAC2 E02E 3D6B CF47 35A1 9BCA 1DE9 7281", "dannenberg orport=443 no-v2 " "v3ident=585769C78764D58426B8B52B6651A5A71137189A " - "213.73.91.31:80 7BE6 83E6 5D48 1413 21C5 ED92 F075 C553 64AC 7123", + "193.23.244.244:80 7BE6 83E6 5D48 1413 21C5 ED92 F075 C553 64AC 7123", "urras orport=80 no-v2 v3ident=80550987E1D626E3EBA5E5E75A458DE0626D088C " "208.83.223.34:443 0AD3 FA88 4D18 F89E EA2D 89C0 1937 9E0E 7FD9 4417", NULL From c9a3781580cb0f56ec0b388f0fad41ddef844bb1 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Sat, 13 Feb 2010 14:10:57 -0500 Subject: [PATCH 3/7] give it a blurb, update the date --- ChangeLog | 6 +++++- ReleaseNotes | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index b75ac0c907..3bf0dba152 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,8 @@ -Changes in version 0.2.1.23 - 2010-02-12 +Changes in version 0.2.1.23 - 2010-02-13 + Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work + again on the latest OS X, and updates the location of a directory + authority. + o Major bugfixes (performance): - We were selecting our guards uniformly at random, and then weighting which of our guards we'd use uniformly at random. This imbalance diff --git a/ReleaseNotes b/ReleaseNotes index 000e174354..1a9001f60c 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,7 +3,11 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. -Changes in version 0.2.1.23 - 2010-02-12 +Changes in version 0.2.1.23 - 2010-02-13 + Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work + again on the latest OS X, and updates the location of a directory + authority. + o Major bugfixes (performance): - We were selecting our guards uniformly at random, and then weighting which of our guards we'd use uniformly at random. This imbalance From e861b3be88160b36ee21a9ea7e2faff5047635f5 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 17 Feb 2010 23:55:03 -0500 Subject: [PATCH 4/7] Even more conservative option-setting for SSL renegotiation. This time, set the SSL3_FLAGS_ALLOW_UNSAFE_RENEGOTIATION flag on every version before OpenSSL 0.9.8l. I can confirm that the option value (0x0010) wasn't reused until OpenSSL 1.0.0beta3. --- src/common/tortls.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index f552f2162d..ddcb94ebe6 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -345,7 +345,7 @@ tor_tls_init(void) * OpenSSL 0.9.8l. * * No, we can't just set flag 0x0010 everywhere. It breaks Tor with - * OpenSSL 1.0.0beta, since i. No, we can't just set option + * OpenSSL 1.0.0beta3 and later. No, we can't just set option * 0x00040000L everywhere: before 0.9.8m, it meant something else. * * No, we can't simply detect whether the flag or the option is present @@ -358,7 +358,7 @@ tor_tls_init(void) */ if (version >= 0x009080c0L && version < 0x009080d0L) { log_notice(LD_GENERAL, "OpenSSL %s looks like version 0.9.8l; " - "I will try SSL3_FLAGS to enable renegotation.", + "I will try SSL3_FLAGS to enable renegotation.", SSLeay_version(SSLEAY_VERSION)); use_unsafe_renegotiation_flag = 1; use_unsafe_renegotiation_op = 1; @@ -367,6 +367,12 @@ tor_tls_init(void) "I will try SSL_OP to enable renegotiation", SSLeay_version(SSLEAY_VERSION)); use_unsafe_renegotiation_op = 1; + } else if (version < 0x009080c0L) { + log_notice(LD_GENERAL, "OpenSSL %s [%lx] looks like it's older than " + "0.9.8l, but some vendors have backported 0.9.8l's " + "renegotiation code to earlier versions. I'll set " + "SSL3_FLAGS just to be safe."); + use_unsafe_renegotiation_flag = 1; } else { log_info(LD_GENERAL, "OpenSSL %s has version %lx", SSLeay_version(SSLEAY_VERSION), version); From c2c3a5a3f53d26fa1b189202a997578f486f4eff Mon Sep 17 00:00:00 2001 From: Sebastian Hahn Date: Thu, 18 Feb 2010 13:08:57 +0100 Subject: [PATCH 5/7] Fix compile --- src/common/tortls.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index ddcb94ebe6..cfaa2b4a17 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -371,7 +371,8 @@ tor_tls_init(void) log_notice(LD_GENERAL, "OpenSSL %s [%lx] looks like it's older than " "0.9.8l, but some vendors have backported 0.9.8l's " "renegotiation code to earlier versions. I'll set " - "SSL3_FLAGS just to be safe."); + "SSL3_FLAGS just to be safe.", + SSLeay_version(SSLEAY_VERSION), version); use_unsafe_renegotiation_flag = 1; } else { log_info(LD_GENERAL, "OpenSSL %s has version %lx", From 428c07ea0dbf3b6735fc7580786f2cc82fc2babc Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Thu, 18 Feb 2010 11:54:26 -0500 Subject: [PATCH 6/7] Add changelog for latest openssl fix --- ChangeLog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3bf0dba152..376c8500c8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +Changes in version 0.2.1.24 - 2010-??-?? + o Minor bugfixes: + - Work correctly out-of-the-box with even more vendor-patched versions + of OpenSSL. + + Changes in version 0.2.1.23 - 2010-02-13 Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work again on the latest OS X, and updates the location of a directory From 4a3bd153c0c181a1b478ead9efef3d5c0dbbb849 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Thu, 18 Feb 2010 11:57:47 -0500 Subject: [PATCH 7/7] Bump version to 0.2.1.23-dev --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index 5b12860a83..afa13cb46f 100644 --- a/configure.in +++ b/configure.in @@ -5,7 +5,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.1.23) +AM_INIT_AUTOMAKE(tor, 0.2.1.23-dev) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index a184f8267c..ffe836c39e 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -9,7 +9,7 @@ !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.1.23" +!define VERSION "0.2.1.23-dev" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index c25cb8a382..0af0b2d31f 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -226,6 +226,6 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.1.23" +#define VERSION "0.2.1.23-dev"