From f54e75a2c64561707812100d2227c201065a4bd4 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Sun, 21 Nov 2010 16:59:42 -0500 Subject: [PATCH 1/4] prepare for our emergency openssl fix release --- ChangeLog | 20 ++++++++++++++++++++ changes/bug2183 | 6 ------ changes/bug2195 | 7 ------- changes/fix2204 | 7 ------- 4 files changed, 20 insertions(+), 20 deletions(-) delete mode 100644 changes/bug2183 delete mode 100644 changes/bug2195 delete mode 100644 changes/fix2204 diff --git a/ChangeLog b/ChangeLog index 0bdecd0a84..6fb6ca3825 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,23 @@ +Changes in version 0.2.2.19-alpha - 2010-11-21 + o Major bugfixes: + - Resolve an incompatibility with openssl 0.9.8p and openssl 1.0.0b: + No longer set the tlsext_host_name extension on server SSL objects; + but continue to set it on client SSL objects. Our goal in setting + it was to imitate a browser, not a vhosting server. Fixes bug 2204; + bugfix on 0.2.1.1-alpha. + + o Minor bugfixes: + - Try harder not to exceed the maximum length of 50 KB when writing + statistics to extra-info descriptors. This bug was triggered by very + fast relays reporting exit-port, entry, and dirreq statistics. + Reported by Olaf Selke. Bugfix on 0.2.2.1-alpha. Fixes bug 2183. + - Publish a router descriptor even if generating an extra-info + descriptor fails. Previously we would not publish a router + descriptor without an extra-info descriptor; this can cause fast + exit relays collecting exit-port statistics to drop from the + consensus. Bugfix on 0.1.2.9-rc; fixes bug 2195. + + Changes in version 0.2.2.18-alpha - 2010-11-16 o Major bugfixes: - Do even more to reject (and not just ignore) annotations on diff --git a/changes/bug2183 b/changes/bug2183 deleted file mode 100644 index 01a8d76aca..0000000000 --- a/changes/bug2183 +++ /dev/null @@ -1,6 +0,0 @@ - o Minor bugfixes: - - Try harder not to exceed the maximum length of 50 KB when writing - statistics to extra-info descriptors. This bug was triggered by very - fast relays reporting exit-port, entry, and dirreq statistics. - Reported by Olaf Selke. Bugfix on 0.2.2.1-alpha. Fixes bug 2183. - diff --git a/changes/bug2195 b/changes/bug2195 deleted file mode 100644 index 1724fd0e21..0000000000 --- a/changes/bug2195 +++ /dev/null @@ -1,7 +0,0 @@ - o Minor bugfixes - - Publish a router descriptor even if generating an extra-info - descriptor fails. Previously we would not publish a router - descriptor without an extra-info descriptor; this can cause fast - exit relays collecting exit-port statistics to drop from the - consensus. Bugfix on 0.1.2.9-rc; fixes bug 2195. - diff --git a/changes/fix2204 b/changes/fix2204 deleted file mode 100644 index fb2771a7fa..0000000000 --- a/changes/fix2204 +++ /dev/null @@ -1,7 +0,0 @@ - o Major bugfixes - - Do not set the tlsext_host_name extension on server SSL objects; - only on client SSL objects. We set it to immitate a browser, not a - vhosting server. This resolves an incompatibility with openssl 0.9.8p - and openssl 1.0.0b. Fixes bug 2204; bugfix on 0.2.1.1-alpha. - - From 713db8dbfa172ea395ff3cee33fea875a052bd35 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Sun, 21 Nov 2010 18:00:12 -0500 Subject: [PATCH 2/4] bump to 0.2.2.19-alpha --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index d4878cdc5a..346008f630 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.2.18-alpha-dev) +AM_INIT_AUTOMAKE(tor, 0.2.2.19-alpha) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index da7167cdaa..a44961b027 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.2.18-alpha-dev" +!define VERSION "0.2.2.19-alpha" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index cdf1cbfb91..b3cd1db50b 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -233,5 +233,5 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.2.18-alpha-dev" +#define VERSION "0.2.2.19-alpha" From e57cb6b9762a2f94818738b5790d09c292e1bc24 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Mon, 22 Nov 2010 22:44:20 -0500 Subject: [PATCH 3/4] pick a more accurate release date --- ChangeLog | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6fb6ca3825..b87449ab69 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,9 @@ -Changes in version 0.2.2.19-alpha - 2010-11-21 +Changes in version 0.2.2.19-alpha - 2010-11-22 + Yet another OpenSSL security patch broke its compatibility with Tor: + Tor 0.2.2.19-alpha makes relays work with OpenSSL 0.9.8p and 1.0.0.b. + o Major bugfixes: - - Resolve an incompatibility with openssl 0.9.8p and openssl 1.0.0b: + - Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b: No longer set the tlsext_host_name extension on server SSL objects; but continue to set it on client SSL objects. Our goal in setting it was to imitate a browser, not a vhosting server. Fixes bug 2204; @@ -19,6 +22,11 @@ Changes in version 0.2.2.19-alpha - 2010-11-21 Changes in version 0.2.2.18-alpha - 2010-11-16 + Tor 0.2.2.18-alpha fixes several crash bugs that have been nagging + us lately, makes unpublished bridge relays able to detect their IP + address, and fixes a wide variety of other bugs to get us much closer + to a stable release. + o Major bugfixes: - Do even more to reject (and not just ignore) annotations on router descriptors received anywhere but from the cache. Previously From de75afc5561fe931d1ff4d29ae629a92205154f0 Mon Sep 17 00:00:00 2001 From: Robert Ransom Date: Wed, 24 Nov 2010 07:50:29 -0800 Subject: [PATCH 4/4] Avoid dereferencing NULL if a bridge fails to build an ei descriptor. Reported by an anonymous commenter on Trac. --- changes/fix2195-fix | 6 ++++++ src/or/router.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 changes/fix2195-fix diff --git a/changes/fix2195-fix b/changes/fix2195-fix new file mode 100644 index 0000000000..9f03c2465e --- /dev/null +++ b/changes/fix2195-fix @@ -0,0 +1,6 @@ + o Minor bugfixes: + - Do not dereference NULL if a bridge fails to build its + extra-info descriptor. Previously, we would have dereferenced + NULL. Found by an anonymous commenter on Trac. Bugfix on + 0.2.2.19-alpha. + diff --git a/src/or/router.c b/src/or/router.c index 3d4ee70399..66ef8ec52e 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1523,7 +1523,7 @@ router_rebuild_descriptor(int force) /* Let bridges serve their own descriptors unencrypted, so they can * pass reachability testing. (If they want to be harder to notice, * they can always leave the DirPort off). */ - if (!options->BridgeRelay) + if (ei && !options->BridgeRelay) ei->cache_info.send_unencrypted = 1; router_get_router_hash(ri->cache_info.signed_descriptor_body,