Changes in version 0.2.3.9-alpha - 2011-12-08
Tor 0.2.3.9-alpha introduces initial IPv6 support for bridges, adds
a "DisableNetwork" security feature that bundles can use to avoid
touching the network until bridges are configured, moves forward on
the pluggable transport design, fixes a flaw in the hidden service
design that unnecessarily prevented clients with wrong clocks from
reaching hidden services, and fixes a wide variety of other issues.

o Major features:
- Clients can now connect to private bridges over IPv6. Bridges
still need at least one IPv4 address in order to connect to
other relays. Note that we don't yet handle the case where the
user has two bridge lines for the same bridge (one IPv4, one
IPv6). Implements parts of proposal 186.
- New "DisableNetwork" config option to prevent Tor from launching any
connections or accepting any connections except on a control port.
Bundles and controllers can set this option before letting Tor talk
to the rest of the network, for example to prevent any connections
to a non-bridge address. Packages like Orbot can also use this
option to instruct Tor to save power when the network is off.
- Clients and bridges can now be configured to use a separate
"transport" proxy. This approach makes the censorship arms race
easier by allowing bridges to use protocol obfuscation plugins. It
implements the "managed proxy" part of proposal 180 (ticket 3472).
- When using OpenSSL 1.0.0 or later, use OpenSSL's counter mode
implementation. It makes AES_CTR about 7% faster than our old one
(which was about 10% faster than the one OpenSSL used to provide).
Resolves ticket 4526.
- Add a "tor2web mode" for clients that want to connect to hidden
services non-anonymously (and possibly more quickly). As a safety
measure to try to keep users from turning this on without knowing
what they are doing, tor2web mode must be explicitly enabled at
compile time, and a copy of Tor compiled to run in tor2web mode
cannot be used as a normal Tor client. Implements feature 2553.
- Add experimental support for running on Windows with IOCP and no
kernel-space socket buffers. This feature is controlled by a new
"UserspaceIOCPBuffers" config option (off by default), which has
no effect unless Tor has been built with support for bufferevents,
is running on Windows, and has enabled IOCP. This may, in the long
run, help solve or mitigate bug 98.
- Use a more secure consensus parameter voting algorithm. Now at
least three directory authorities or a majority of them must
vote on a given parameter before it will be included in the
consensus. Implements proposal 178.

o Major bugfixes:
- Hidden services now ignore the timestamps on INTRODUCE2 cells.
They used to check that the timestamp was within 30 minutes
of their system clock, so they could cap the size of their
replay-detection cache, but that approach unnecessarily refused
service to clients with wrong clocks. Bugfix on 0.2.1.6-alpha, when
the v3 intro-point protocol (the first one which sent a timestamp
field in the INTRODUCE2 cell) was introduced; fixes bug 3460.
- Only use the EVP interface when AES acceleration is enabled,
to avoid a 5-7% performance regression. Resolves issue 4525;
bugfix on 0.2.3.8-alpha.

o Privacy/anonymity features (bridge detection):
- Make bridge SSL certificates a bit more stealthy by using random
serial numbers, in the same fashion as OpenSSL when generating
self-signed certificates. Implements ticket 4584.
- Introduce a new config option "DynamicDHGroups", enabled by
default, which provides each bridge with a unique prime DH modulus
to be used during SSL handshakes. This option attempts to help
against censors who might use the Apache DH modulus as a static
identifier for bridges. Addresses ticket 4548.

o Minor features (new/different config options):
- New configuration option "DisableDebuggerAttachment" (on by default)
to prevent basic debugging attachment attempts by other processes.
Supports Mac OS X and Gnu/Linux. Resolves ticket 3313.
- Allow MapAddress directives to specify matches against super-domains,
as in "MapAddress *.torproject.org *.torproject.org.torserver.exit".
Implements issue 933.
- Slightly change behavior of "list" options (that is, config
options that can appear more than once) when they appear both in
torrc and on the command line. Previously, the command-line options
would be appended to the ones from torrc. Now, the command-line
options override the torrc options entirely. This new behavior
allows the user to override list options (like exit policies and
ports to listen on) from the command line, rather than simply
appending to the list.
- You can get the old (appending) command-line behavior for "list"
options by prefixing the option name with a "+".
- You can remove all the values for a "list" option from the command
line without adding any new ones by prefixing the option name
with a "/".
- Add experimental support for a "defaults" torrc file to be parsed
before the regular torrc. Torrc options override the defaults file's
options in the same way that the command line overrides the torrc.
The SAVECONF controller command saves only those options which
differ between the current configuration and the defaults file. HUP
reloads both files. (Note: This is an experimental feature; its
behavior will probably be refined in future 0.2.3.x-alpha versions
to better meet packagers' needs.)

o Minor features:
- Try to make the introductory warning message that Tor prints on
startup more useful for actually finding help and information.
Resolves ticket 2474.
- Running "make version" now displays the version of Tor that
we're about to build. Idea from katmagic; resolves issue 4400.
- Expire old or over-used hidden service introduction points.
Required by fix for bug 3460.
- Move the replay-detection cache for the RSA-encrypted parts of
INTRODUCE2 cells to the introduction point data structures.
Previously, we would use one replay-detection cache per hidden
service. Required by fix for bug 3460.
- Reduce the lifetime of elements of hidden services' Diffie-Hellman
public key replay-detection cache from 60 minutes to 5 minutes. This
replay-detection cache is now used only to detect multiple
INTRODUCE2 cells specifying the same rendezvous point, so we can
avoid launching multiple simultaneous attempts to connect to it.

o Minor bugfixes (on Tor 0.2.2.x and earlier):
- Resolve an integer overflow bug in smartlist_ensure_capacity().
Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by
Mansour Moufid.
- Fix a minor formatting issue in one of tor-gencert's error messages.
Fixes bug 4574.
- Prevent a false positive from the check-spaces script, by disabling
the "whitespace between function name and (" check for functions
named 'op()'.
- Fix a log message suggesting that people contact a non-existent
email address. Fixes bug 3448.
- Fix null-pointer access that could occur if TLS allocation failed.
Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
- Report a real bootstrap problem to the controller on router
identity mismatch. Previously we just said "foo", which probably
made a lot of sense at the time. Fixes bug 4169; bugfix on
0.2.1.1-alpha.
- If we had ever tried to call tor_addr_to_str() on an address of
unknown type, we would have done a strdup() on an uninitialized
buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha.
Reported by "troll_un".
- Correctly detect and handle transient lookup failures from
tor_addr_lookup(). Fixes bug 4530; bugfix on 0.2.1.5-alpha.
Reported by "troll_un".
- Use tor_socket_t type for listener argument to accept(). Fixes bug
4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
- Initialize conn->addr to a valid state in spawn_cpuworker(). Fixes
bug 4532; found by "troll_un".

o Minor bugfixes (on Tor 0.2.3.x):
- Fix a compile warning in tor_inet_pton(). Bugfix on 0.2.3.8-alpha;
fixes bug 4554.
- Don't send two ESTABLISH_RENDEZVOUS cells when opening a new
circuit for use as a hidden service client's rendezvous point.
Fixes bugs 4641 and 4171; bugfix on 0.2.3.3-alpha. Diagnosed
with help from wanoskarnet.
- Restore behavior of overriding SocksPort, ORPort, and similar
options from the command line. Bugfix on 0.2.3.3-alpha.

o Build fixes:
- Properly handle the case where the build-tree is not the same
as the source tree when generating src/common/common_sha1.i,
src/or/micro-revision.i, and src/or/or_sha1.i. Fixes bug 3953;
bugfix on 0.2.0.1-alpha.

o Code simplifications, cleanups, and refactorings:
- Remove the pure attribute from all functions that used it
previously. In many cases we assigned it incorrectly, because the
functions might assert or call impure functions, and we don't have
evidence that keeping the pure attribute is worthwhile. Implements
changes suggested in ticket 4421.
- Remove some dead code spotted by coverity. Fixes cid 432.
Bugfix on 0.2.3.1-alpha, closes bug 4637.

Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's
buffers code. Absolutely everybody should upgrade.

The bug relied on an incorrect calculation when making data continuous
in one of our IO buffers, if the first chunk of the buffer was
misaligned by just the wrong amount. The miscalculation would allow an
attacker to overflow a piece of heap-allocated memory. To mount this
attack, the attacker would need to either open a SOCKS connection to
Tor's SocksPort (usually restricted to localhost), or target a Tor
instance configured to make its connections through a SOCKS proxy
(which Tor does not do by default).

Good security practice requires that all heap-overflow bugs should be
presumed to be exploitable until proven otherwise, so we are treating
this as a potential code execution attack. Please upgrade immediately!
This bug does not affect bufferevents-based builds of Tor. Special
thanks to "Vektor" for reporting this issue to us!

Tor 0.2.2.35 also fixes several bugs in previous versions, including
crash bugs for unusual configurations, and a long-term bug that
would prevent Tor from starting on Windows machines with draconian
AV software.

With this release, we remind everyone that 0.2.0.x has reached its
formal end-of-life. Those Tor versions have many known flaws, and
nobody should be using them. You should upgrade -- ideally to the
0.2.2.x series. If you're using a Linux or BSD and its packages are
obsolete, stop using those packages and upgrade anyway.

The Tor 0.2.1.x series is also approaching its end-of-life: it will no
longer receive support after some time in early 2012.

https://www.torproject.org/download

Changes in version 0.2.2.35 - 2011-12-16

Major bugfixes:
Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".
Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so
that it doesn't attempt to allocate a socketpair. This could cause
some problems on Windows systems with overzealous firewalls. Fix for
bug 4457; workaround for Libevent versions 2.0.1-alpha through
2.0.15-stable.
If we mark an OR connection for close based on a cell we process,
don't process any further cells on it. We already avoid further
reads on marked-for-close connections, but now we also discard the
cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha,
which was the first version where we might mark a connection for
close based on processing a cell on it.
Correctly sanity-check that we don't underflow on a memory
allocation (and then assert) for hidden service introduction
point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
bugfix on 0.2.1.5-alpha.
Fix a memory leak when we check whether a hidden service
descriptor has any usable introduction points left. Fixes bug
4424. Bugfix on 0.2.2.25-alpha.
Don't crash when we're running as a relay and don't have a GeoIP
file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix
we've had in the 0.2.3.x branch already.
When running as a client, do not print a misleading (and plain
wrong) log message that we're collecting "directory request"
statistics: clients don't collect statistics. Also don't create a
useless (because empty) stats file in the stats/ directory. Fixes
bug 4353; bugfix on 0.2.2.34.

Minor bugfixes:
Detect failure to initialize Libevent. This fix provides better
detection for future instances of bug 4457.
Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers
function. This was eating up hideously large amounts of time on some
busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
Resolve an integer overflow bug in smartlist_ensure_capacity().
Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by
Mansour Moufid.
Don't warn about unused log_mutex in log.c when building with
--disable-threads using a recent GCC. Fixes bug 4437; bugfix on
0.1.0.6-rc which introduced --disable-threads.
When configuring, starting, or stopping an NT service, stop
immediately after the service configuration attempt has succeeded
or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
When sending a NETINFO cell, include the original address
received for the other side, not its canonical address. Found
by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
Fix a typo in a hibernation-related log message. Fixes bug 4331;
bugfix on 0.2.2.23-alpha; found by "tmpname0901".
Fix a memory leak in launch_direct_bridge_descriptor_fetch() that
occurred when a client tried to fetch a descriptor for a bridge
in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
Backport fixes for a pair of compilation warnings on Windows.
Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta.
If we had ever tried to call tor_addr_to_str on an address of
unknown type, we would have done a strdup on an uninitialized
buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha.
Reported by "troll_un".
Correctly detect and handle transient lookup failures from
tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha.
Reported by "troll_un".
Fix null-pointer access that could occur if TLS allocation failed.
Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
Use tor_socket_t type for listener argument to accept(). Fixes bug
4535; bugfix on 0.2.2.28-beta. Found by "troll_un".

Minor features:
Add two new config options for directory authorities:
AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the
Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold
that is always sufficient to satisfy the bandwidth requirement for
the Guard flag. Now it will be easier for researchers to simulate
Tor networks with different values. Resolves ticket 4484.
When Tor ignores a hidden service specified in its configuration,
include the hidden service's directory in the warning message.
Previously, we would only tell the user that some hidden service
was ignored. Bugfix on 0.0.6; fixes bug 4426.
Update to the December 6 2011 Maxmind GeoLite Country database.

Packaging changes:
Make it easier to automate expert package builds on Windows,
by removing an absolute path from makensis.exe command.

Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in
Tor's buffers code. Absolutely everybody should upgrade.

The bug relied on an incorrect calculation when making data continuous
in one of our IO buffers, if the first chunk of the buffer was
misaligned by just the wrong amount. The miscalculation would allow an
attacker to overflow a piece of heap-allocated memory. To mount this
attack, the attacker would need to either open a SOCKS connection to
Tor's SocksPort (usually restricted to localhost), or target a Tor
instance configured to make its connections through a SOCKS proxy
(which Tor does not do by default).

Good security practice requires that all heap-overflow bugs should be
presumed to be exploitable until proven otherwise, so we are treating
this as a potential code execution attack. Please upgrade immediately!
This bug does not affect bufferevents-based builds of Tor. Special
thanks to "Vektor" for reporting this issue to us!

This release also contains a few minor bugfixes for issues discovered
in 0.2.3.9-alpha.

https://www.torproject.org/download

Changes in version 0.2.3.10-alpha - 2011-12-16

Major bugfixes
Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".

Minor bugfixes
If we can't attach streams to a rendezvous circuit when we
finish connecting to a hidden service, clear the rendezvous
circuit's stream-isolation state and try to attach streams
again. Previously, we cleared rendezvous circuits' isolation
state either too early (if they were freshly built) or not at all
(if they had been built earlier and were cannibalized). Bugfix on
0.2.3.3-alpha; fixes bug 4655.
Fix compilation of the libnatpmp helper on non-Windows. Bugfix on
0.2.3.9-alpha; fixes bug 4691. Reported by Anthony G. Basile.
Fix an assertion failure when a relay with accounting enabled
starts up while dormant. Fixes bug 4702; bugfix on 0.2.3.9-alpha.

Minor features
Update to the December 6 2011 Maxmind GeoLite Country database.

The Tor Browser Bundles have been updated to Tor 0.2.2.35 which has a fix for a security critical bug. Please see the release announcement for further details. All users should update immediately.

This Tor Browser Bundle release also contains new Firefox patches which improve privacy and unlinkability.

https://www.torproject.org/download

Tor Browser Bundle (2.2.35-1)
Update Tor to 0.2.2.35
Update NoScript to 2.2.3
Update Torbutton to 1.4.5
New Firefox patches
Disable SSL Session ID tracking
Provide an observer event to close persistent connections

Tor Browser Bundle (2.2.35-2); suite=windows

* Update Firefox to 9.0
* Update Torbutton to 1.4.5.1
* Update Noscript to 2.2.4
* New Firefox patches
- Provide client values only to CSS Media Queries and disable several
Mozilla extensions that seem fingerprintable

Tor Browser Bundle (2.2.35-5)
Update Firefox to 10.0
Update Qt to 4.7.4
Update OpenSSL to 1.0.0g
Update zlib to 1.2.6
Update HTTPS Everywhere to 1.2.2
Update NoScript to 2.2.8
New Firefox patches
Limit the number of fonts per document

Linux changes
Put documentation in remove-shared-lib-symlinks debug dumps (closes: #4984)

Windows changes
Make sure mozconfig always gets copied into the Firefox build directory
(closes: #4879)

Tor Browser Bundle (2.2.35-6); suite=windows

* Update Firefox to 10.0.1
* Update Vidalia to 0.2.17
* Update Libevent to 2.0.17-stable
* Update NoScript to 2.3

Changes in version 0.2.3.12-alpha - 2012-02-13
Tor 0.2.3.12-alpha lets fast exit relays scale better, allows clients
to use bridges that run Tor 0.2.2.x, and resolves several big bugs
when Tor is configured to use a pluggable transport like obfsproxy.

o Major bugfixes:
- Fix builds when the path to sed, openssl, or sha1sum contains
spaces, which is pretty common on Windows. Fixes bug 5065; bugfix
on 0.2.2.1-alpha.
- Set the SO_REUSEADDR socket option before we call bind() on outgoing
connections. This change should allow busy exit relays to stop
running out of available sockets as quickly. Fixes bug 4950;
bugfix on 0.2.2.26-beta.
- Allow 0.2.3.x clients to use 0.2.2.x bridges. Previously the client
would ask the bridge for microdescriptors, which are only supported
in 0.2.3.x, and then fail to bootstrap when it didn't get the
answers it wanted. Fixes bug 4013; bugfix on 0.2.3.2-alpha.
- Avoid an assert when managed proxies like obfsproxy are configured,
and we receive HUP signals or configuration values too rapidly. This
situation happens most commonly when Vidalia tries to attach to
Tor or tries to configure the Tor it's attached to. Fixes bug 5084;
bugfix on 0.2.3.6-alpha.
- Properly set up obfsproxy's environment when in managed mode. The
Tor Browser Bundle needs LD_LIBRARY_PATH to be passed to obfsproxy,
and when you run your Tor as a daemon, there's no HOME. Fixes bugs
5076 and 5082; bugfix on 0.2.3.6-alpha.

o Minor features:
- Use the dead_strip option when building Tor on OS X. This reduces
binary size by almost 19% when linking openssl and libevent
statically, which we do for Tor Browser Bundle.
- Fix broken URLs in the sample torrc file, and tell readers about
the OutboundBindAddress, ExitPolicyRejectPrivate, and
PublishServerDescriptor options. Addresses bug 4652.
- Update to the February 7 2012 Maxmind GeoLite Country database.

o Minor bugfixes:
- Downgrade the "We're missing a certificate" message from notice
to info: people kept mistaking it for a real problem, whereas it
is seldom the problem even when we are failing to bootstrap. Fixes
bug 5067; bugfix on 0.2.0.10-alpha.
- Don't put "TOR_PT_EXTENDED_SERVER_PORT=127.0.0.1:4200" in a
managed pluggable transport server proxy's environment.
Previously, we would put it there, even though Tor doesn't
implement an 'extended server port' yet, and even though Tor
almost certainly isn't listening at that address. For now, we set
it to an empty string to avoid crashing older obfsproxies. Bugfix
on 0.2.3.6-alpha.
- Log the heartbeat message every HeartbeatPeriod seconds, not every
HeartbeatPeriod + 1 seconds. Fixes bug 4942; bugfix on
0.2.3.1-alpha. Bug reported by Scott Bennett.
- Calculate absolute paths correctly on Windows. Fixes bug 4973;
bugfix on 0.2.3.11-alpha.
- Update "ClientOnly" man page entry to explain that there isn't
really any point to messing with it. Resolves ticket 5005.
- Use the correct CVE number for CVE-2011-4576 in our comments and
log messages. Found by "fermenthor". Resolves bug 5066; bugfix on
0.2.3.11-alpha.

o Code simplifications and refactoring:
- Use the _WIN32 macro throughout our code to detect Windows.
(Previously we had used the obsolete 'WIN32' and the idiosyncratic
'MS_WINDOWS'.)

the only difference between 0.2.16 and 0.2.17 is what translations are in. Since we changed our translations workflow, we needed to update the availability policy. Basically, every new translation that has more than 90% done gets enabled. If any of the enabled translations drop bellow the 75% done, we take them out.

Remember that if you find any bugs, you can report them at https://trac.torproject.org/.

Here's what changed since 0.2.15:

0.2.17 11-Feb-2012
Improve the translation policy: do not remove translations that
are not under 75% done. This re enables Polish and Catalan.

0.2.16 11-Feb-2012
Make the default data directory in windows be located in the Local
AppData instead of the Roaming one. Fixes bug 2319.
Do not launch Firefox with every CIRCUIT_ESTABLISHED signal, do it
only if Firefox isn't open yet. Fixes bug 2943.
Uses TAKEOWNERSHIP and __OwningControllerProcess to avoid leaving
tor running in background if Vidalia exits unexpectedly. Fixes bug
3463.
Attempt to remove port.conf file before using it to avoid a race
condition between tor and Vidalia. Fixes bug 4048.
Do not allow users to check the "My ISP blocks..." checkbox
without entering any bridges. Also updates the
documentation. Fixes bug 4290.
Check that the authentication-cookie file length is exactly 32
bytes long. Fixes bug 4304.
Explicitly disable ControlPort auto. Fixes bug 4379.
Make the non exit relay option backward compatible with Vidalia <
0.2.14 so that it doesn't confuse users. Fixes bug 4642.
Sets the preferred size for the GUI layout so it doesn't squeeze
widges when the size isn't big enough. Fixes bug 4656.
Removes the option to have only HTTPProxy since it does not work
any more as it used to do with older tor versions. Users should
use HTTP/HTTPSProxy instead. Fixes bug 4724.
Add a hidden configuration option called SkipVersionCheck so
systems like Tails can force Vidalia to skip checking tor's
version. Resolves ticket 4736.
When Tor has cached enough information it bootstraps faster than
what takes Vidalia connect to it, so Vidalia does not see the
event to update the progress bar. Now Vidalia explicitly asks for
bootstrap-phase when it connects to Tor, and updates the progress
to what is actually happening instead of hanging in
"Authenticating to Tor". Fixes bug 4827.
Fix size hints in the main window layout so that tilling window
managers display the window properly. Thanks to Mike Warren for
the fix. Fixes bug 4907.
Vidalia only validates IPv4 bridge lines. IPv6 bridges are now
available, and there will be pluggable transport bridge lines. So
the validation is now delegated to Tor through SETCONF.
Explicitly disable SocksPort auto by setting it to its default
(9050). Fixes bug 4598.
Sets __ReloadTorrcOnSIGHUP to 0 if SAVECONF failed, which means
the user can't write the torrc file. Fixes bug 4833.
Enable new translations that are >90% done. The new languages are:
Bulgarian, Czech, Hebrew, Greek, Indonesian, Korean,
Dutch. Resolves ticket 5051.
Remove translations that aren't ready enough: Japanese, Thai,
Albanian, Vietnamese, Chinese (Taiwan), Polish, Catalan and
Burmese.

There are new alpha Tor Browser Bundles and Vidalia Bundles available for testing!

These bundles include the latest Vidalia 0.3.1 alpha release and Tor 0.2.3.12-alpha. Right now they are technology previews.

Included applications
---------------------

Vidalia 0.3.1-alpha (with Qt 4.7.4)
Tor 0.2.3.12-alpha (with libevent-2.0.17-stable, zlib-1.2.6 and openssl-1.0.1-beta1)
Firefox 10.0.1
\_ Torbutton 1.4.5.1
|_ NoScript 2.3
|_ HTTPS-Everywhere 2.0development.4

Tor Browser Bundle (2.2.35-8); suite=windows

* Update Firefox to 11.0
* Update OpenSSL to 1.0.0h
* Update NoScript to 2.3.4
* Update HTTPS Everywhere to 2.0.1
* Always build to with warnings enabled (closes; #4470)
* Disable HTTPS Everywhere SSL Observatory screen (closes: #5300)
* Remove tor-resolve from the Windows bundle (closes: #5403)

Tor Browser Bundle (2.3.12-alpha-2); suite=windows

* Update Firefox to 11.0
* Update NoScript to 2.3.4
* Update HTTPS Everywhere to 3.0development.1
* Disable HTTPS Everywhere SSL Observatory screen (closes: #5300)
* Always build to with warnings enabled (closes: #4470)
* Remove tor-resolve from the Windows bundle (closes: #5403)

-- Erinn Clark <erinn@torproject.org> Mon Mar 19 01:14:43 BRT 2012

Tor Browser Bundle (2.2.35-9); suite=windows

* Update Firefox to 12.0
* Update OpenSSL to 1.0.1b
* Update Libevent to 2.0.18-stable
* Update Qt to 4.8.1
* Update Libpng to 1.5.10
* Update HTTPS Everywhere to 2.0.2
* Update NoScript to 2.3.9
* Rebrand Firefox to TorBrowser (closes: #2176)
* New Firefox patches
- Make Download Manager memory-only (closes: #4017)
- Add DuckDuckGo and Startpage to Omnibox (closes: #4902)

-- Erinn Clark <erinn@torproject.org> Fri Apr 27 12:43:33 BRT 2012

Changes in version 0.2.3.15-alpha - 2012-04-30
Tor 0.2.3.15-alpha fixes a variety of smaller bugs, including making
the development branch build on Windows again.

o Minor bugfixes (on 0.2.2.x and earlier):
- Make sure that there are no unhandled pending TLS errors before
reading from a TLS stream. We had checks in 0.1.0.3-rc, but
lost them in 0.1.0.5-rc when we refactored read_to_buf_tls().
Bugfix on 0.1.0.5-rc; fixes bug 4528.
- Fix an assert that directory authorities could trigger on sighup
during some configuration state transitions. We now don't treat
it as a fatal error when the new descriptor we just generated in
init_keys() isn't accepted. Fixes bug 4438; bugfix on 0.2.1.9-alpha.
- After we pick a directory mirror, we would refuse to use it if
it's in our ExcludeExitNodes list, resulting in mysterious failures
to bootstrap for people who just wanted to avoid exiting from
certain locations. Fixes bug 5623; bugfix on 0.2.2.25-alpha.
- When building with --enable-static-tor on OpenBSD, do not
erroneously attempt to link -lrt. Fixes bug 5103.

o Minor bugfixes (on 0.2.3.x):
- When Tor is built with kernel headers from a recent (last few
years) Linux kernel, do not fail to run on older (pre-2.6.28
Linux kernels). Fixes bug 5112; bugfix on 0.2.3.1-alpha.
- Fix cross-compilation isssues with mingw. Bugfixes on 0.2.3.6-alpha
and 0.2.3.12-alpha.
- Fix compilation with miniupnpc version 1.6; patch from
Anthony G. Basile. Fixes bug 5434; bugfix on 0.2.3.12-alpha.
- Fix compilation with MSVC, which had defined MS_WINDOWS. Bugfix
on 0.2.3.13-alpha; found and fixed by Gisle Vanem.
- Fix compilation on platforms without unistd.h, or where environ
is defined in stdlib.h. Fixes bug 5704; bugfix on 0.2.3.13-alpha.

o Minor features:
- Directory authorities are now a little more lenient at accepting
older router descriptors, or newer router descriptors that don't
make big changes. This should help ameliorate past and future
issues where routers think they have uploaded valid descriptors,
but the authorities don't think so. Fix for ticket 2479.
- Make the code that clients use to detect an address change be
IPv6-aware, so that it won't fill clients' logs with error
messages when trying to get the IPv4 address of an IPv6
connection. Implements ticket 5537.

o Removed features:
- Remove the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays option;
authorities needed to use it for a while to keep the network working
as people upgraded to 0.2.1.31, 0.2.2.34, or 0.2.3.6-alpha, but
that was six months ago. As of now, it should no longer be needed
or used.

Tor Browser Bundle (2.2.35-11); suite=windows

* Security release to stop TorBrowser from bypassing SOCKS proxy DNS
configuration
* New Firefox patches:
- Prevent WebSocket DNS leak (closes: #5741)
- Fix a race condition that could be used to link browsing sessions
together when using new identity from Tor Browser (closes: #5715)
* Remove extraneous BetterPrivacy settings from prefs.js (closes: #5722)

-- Erinn Clark <erinn@torproject.org> Thu May 3 08:00:00 BRT 2012

Tor Browser Bundle (2.2.35-12); suite=windows

 * Update OpenSSL to 1.0.1c
 * Update Libevent to 2.0.19-stable
 * Update zlib to 1.2.7
 * Update NoScript to 2.4.1

-- Erinn Clark <erinn@torproject.org>  Fri May 11 20:16:10 BRT 2012

Tor Browser Bundle (2.2.35-13); suite=windows

* Fix Firefox build to sanitize file paths (closes: #5922)

-- Erinn Clark <erinn@torproject.org> Tue May 22 23:28:37 BRT 2012