Merge branch 'maint-0.2.2' into release-0.2.2

changes/bug1090-general

@@ -0,0 +1,73 @@
+  o Major features and bugfixes (node selection)
+
+    - Revise and unify the meaning of the ExitNodes, EntryNodes,
+      ExcludeEntryNodes, ExcludeExitNodes, ExcludeNodes, and
+      StrictNodes options.  Previously, we had been ambiguous in
+      describing what counted as an "exit" node, and what operations
+      exactly "StrictNodes 0" would permit.  This created confusion
+      when people saw nodes built through unexpected circuits, and
+      made it hard to tell real bugs from surprises.  We now stipulate
+      that the intended behavior is:
+
+	. "Exit", in the context of ExitNodes and ExcludeExitNodes,
+	   means a node that delivers user traffic outside the Tor
+	   network.
+	. "Entry", in the context of EntryNodes and ExcludeEntryNodes,
+	  means a node used as the first hop of a multihop circuit:
+	  it doesn't include direct connections to directory servers.
+	. "ExcludeNodes" applies to all nodes.
+	. "StrictNodes" changes the behavior of ExcludeNodes only.
+	  When StrictNodes is set, Tor should avoid all nodes listed
+	  in ExcludeNodes, even when it will make user requests
+	  fail.  When StrictNodes is *not* set, then Tor should
+	  follow ExcludeNodes whenever it can, except when it must
+	  use an excluded node to perform self-tests, connect to a
+	  hidden service, provide a hidden service, fulfill a .exit
+	  request, upload directory information, or fetch directory
+	  information.
+
+      Collectively, the changes to implement the behavior are a fix for
+      bug 1090.
+
+    - ExcludeNodes now takes precedence over EntryNodes and ExitNodes:
+      if a node is listed in both, it's treated as excluded.
+
+    - ExcludeNodes now applies to directory nodes: as a preference if
+      StrictNodes is 0, or an absolute requirement if StrictNodes is 1.
+      (Don't exclude all the directory authorities and set StrictNodes
+      to 1 unless you really want your Tor to break.)
+
+    - ExcludeNodes and ExcludeExitNodes now override exit enclaving.
+
+    - ExcludeExitNodes now overrides .exit requests.
+
+    - We don't use bridges from ExcludeNodes.
+
+    - When StrictNodes is 1:
+       . We now apply ExcludeNodes to hidden service introduction points
+         and to rendezvous points selected by hidden service users.
+         This can make your hidden service less reliable: use it with
+         caution!
+       . If we have used ExcludeNodes on ourself, do not try self-tests.
+       . If we have excluded all the directory authorities, we will
+         not even try to upload our descriptor if we're a server.
+       . Do not honor .exit requests to an excluded node.
+
+    - Remove a misfeature that caused us to ignore the Fast/Stable flags
+      if ExitNodes was set.  Bugfix on 0.2.2.7-alpha.
+
+    - When the set of permitted nodes changes, we now remove any
+      mappings introduced via TrackExitHosts to now-excluded nodes.
+      Bugfix on 0.1.0.1-rc.
+
+    - We never cannibalize a circuit that had excluded nodes on it,
+      even if StrictNodes is 0.  Bugfix on 0.1.0.1-rc.
+
+    - Improve log messages related to excluded nodes.
+
+    - Revert a change where we would be laxer about attaching streams to
+      circuits than when building the circuits.  This was meant to
+      prevent a set of bugs where streams were never attachable, but our
+      improved code here should make this unnecessary.  Bugfix on
+      0.2.2.7-alpha.
+

changes/bug1090-launch-warning

@@ -0,0 +1,5 @@
+  o Minor features:
+    - Keep track of how many times we launch a new circuit to handle
+      a given stream. Too many launches could indicate an inconsistency
+      between our "launch a circuit to handle this stream" logic and our
+      "attach our stream to one of the available circuits" logic.

changes/bug2704

@@ -0,0 +1,5 @@
+  o Major bugfixes:
+    - When writing our maximum bw for the current interval to the state
+      file, don't wrongly inflate that value by a factor of 10 anymore.
+      Fixes more of bug 2704.
+

changes/bug2899

@@ -0,0 +1,4 @@
+  - Minor bugfixes:
+    o Downgrade "no current certificates known for authority" message from
+      Notice to Info.  Bugfix on 0.2.0.10-alpha; fixes bug 2899.
+

changes/bug2917

@@ -0,0 +1,4 @@
+  o Minor bugfixes
+    - Make the SIGNAL DUMP control-port command work on FreeBSD.  Fixes
+      bug 2917.  Bugfix on 0.1.1.1-alpha.
+

changes/bug2971

@@ -0,0 +1,6 @@
+  o Minor bugfixes:
+    - Be more consistent in our treatment of file system paths. ~ should
+      get expanded to the user's home directory in the Log config option.
+      Bugfix on 0.2.0.1-alpha, which introduced the feature for the -f and
+      --DataDirectory options.
+

changes/bug2979

@@ -0,0 +1,9 @@
+  o Minor bugfixes:
+    - If the Nickname configuration option wasn't given, Tor used to pick
+      a nickname based on the local hostname as the nickname for a relay.
+      Because nicknames are not very important in today's Tor and the
+      "Unnamed" nickname has been implemented, this is now problematic
+      behaviour: It leaks information about the hostname without being
+      useful at all. Bugfix on tor-0.1.2.2-alpha, which introduced the
+      Unnamed nickname. Fixes bug 2979, reported by tagnaq.
+

changes/exitnodes_reliable

@@ -0,0 +1,7 @@
+  o Minor features:
+    - If ExitNodes is set, still pay attention to the Fast/Stable
+      status of exits when picking exit nodes.  (We used to ignore
+      these flags when ExitNodes was set, on the grounds that people
+      who set exitnodes wanted all of those nodes to get used, but
+      with the ability to pick exits by country and IP range, this
+      doesn't necessarily make sense any more.)