Tor 0.2.1.23 fixes a huge client-side performance bug, makes Tor work again on the latest OS X, and updates the location of a directory authority.

Major bugfixes (performance):
- We were selecting our guards uniformly at random, and then weighting which of our guards we'd use uniformly at random. This imbalance meant that Tor clients were severely limited on throughput (and probably latency too) by the first hop in their circuit. Now we select guards weighted by currently advertised bandwidth. We also automatically discard guards picked using the old algorithm. Fixes bug 1217; bugfix on 0.2.1.3-alpha. Found by Mike Perry.

Major bugfixes:
- Make Tor work again on the latest OS X: when deciding whether to use strange flags to turn TLS renegotiation on, detect the OpenSSL version at run-time, not compile time. We need to do this because Apple doesn't update its dev-tools headers when it updates its libraries in a security patch.
- Fix a potential buffer overflow in lookup_last_hid_serv_request() that could happen on 32-bit platforms with 64-bit time_t. Also fix a memory leak when requesting a hidden service descriptor we've requested before. Fixes bug 1242, bugfix on 0.2.0.18-alpha. Found by aakova.

Directory authority changes:
- Change IP address for dannenberg (v3 directory authority), and remove moria2 (obsolete v1, v2 directory authority and v0 hidden service directory authority) from the list.

Minor bugfixes:
- Refactor resolve_my_address() to not use gethostbyname() anymore. Fixes bug 1244; bugfix on 0.0.2pre25. Reported by Mike Mestnik.

Minor features:
- Avoid a mad rush at the beginning of each month when each client rotates half of its guards. Instead we spread the rotation out throughout the month, but we still avoid leaving a precise timestamp in the state file about when we first picked the guard. Improves over the behavior introduced in 0.1.2.17.

1.3.8
- update Firefox to 3.5.11

1.3.9
- update Pidgin to 2.7.2

o Major bugfixes:
- Stop assigning the HSDir flag to relays that disable their
DirPort (and thus will refuse to answer directory requests). This
fix should dramatically improve the reachability of hidden services:
hidden services and hidden service clients pick six HSDir relays
to store and retrieve the hidden service descriptor, and currently
about half of the HSDir relays will refuse to work. Bugfix on
0.2.0.10-alpha; fixes part of bug 1693.
- The PerConnBWRate and Burst config options, along with the
bwconnrate and bwconnburst consensus params, initialized each conn's
token bucket values only when the connection is established. Now we
update them if the config options change, and update them every time
we get a new consensus. Otherwise we can encounter an ugly edge
case where we initialize an OR conn to client-level bandwidth,
but then later the relay joins the consensus and we leave it
throttled. Bugfix on 0.2.2.7-alpha; fixes bug 1830.
- Fix a regression that caused Tor to rebind its ports if it receives
SIGHUP while hibernating. Bugfix in 0.1.1.6-alpha; closes bug 919.

o Major features:
- Lower the maximum weighted-fractional-uptime cutoff to 98%. This
should give us approximately 40-50% more Guard-flagged nodes,
improving the anonymity the Tor network can provide and also
decreasing the dropoff in throughput that relays experience when
they first get the Guard flag.
- Allow enabling or disabling the *Statistics config options while
Tor is running.

o Minor features:
- Update to the August 1 2010 Maxmind GeoLite Country database.
- Have the controller interface give a more useful message than
"Internal Error" in response to failed GETINFO requests.
- Warn when the same option is provided more than once in a torrc
file, on the command line, or in a single SETCONF statement, and
the option is one that only accepts a single line. Closes bug 1384.
- Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
Patch from mingw-san.
- Add support for the country code "{??}" in torrc options like
ExcludeNodes, to indicate all routers of unknown country. Closes
bug 1094.
- Relays report the number of bytes spent on answering directory
requests in extra-info descriptors similar to {read,write}-history.
Implements enhancement 1790.

o Minor bugfixes (on 0.2.1.x and earlier):
- Complain if PublishServerDescriptor is given multiple arguments that
include 0 or 1. This configuration will be rejected in the future.
Bugfix on 0.2.0.1-alpha; closes bug 1107.
- Disallow BridgeRelay 1 and ORPort 0 at once in the configuration.
Bugfix on 0.2.0.13-alpha; closes bug 928.
- Change "Application request when we're believed to be offline."
notice to "Application request when we haven't used client
functionality lately.", to clarify that it's not an error. Bugfix
on 0.0.9.3; fixes bug 1222.
- Fix a bug in the controller interface where "GETINFO ns/asdaskljkl"
would return "551 Internal error" rather than "552 Unrecognized key
ns/asdaskljkl". Bugfix on 0.1.2.3-alpha.
- Users can't configure a regular relay to be their bridge. It didn't
work because when Tor fetched the bridge descriptor, it found
that it already had it, and didn't realize that the purpose of the
descriptor had changed. Now we replace routers with a purpose other
than bridge with bridge descriptors when fetching them. Bugfix on
0.1.1.9-alpha. Bug 1776 not yet fixed because now we immediately
refetch the descriptor with router purpose 'general', disabling
it as a bridge.
- Fix a rare bug in rend_fn unit tests: we would fail a test when
a randomly generated port is 0. Diagnosed by Matt Edman. Bugfix
on 0.2.0.10-alpha; fixes bug 1808.
- Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
stream ending reason for this case: END_STREAM_REASON_NOROUTE.
Servers can start sending this code when enough clients recognize
it. Also update the spec to reflect this new reason. Bugfix on
0.1.0.1-rc; fixes part of bug 1793.
- Delay geoip stats collection by bridges for 6 hours, not 2 hours,
when we switch from being a public relay to a bridge. Otherwise
there will still be clients that see the relay in their consensus,
and the stats will end up wrong. Bugfix on 0.2.1.15-rc; fixes bug
932 even more.
- Instead of giving an assertion failure on an internal mismatch
on estimated freelist size, just log a BUG warning and try later.
Mitigates but does not fix bug 1125.
- Fix an assertion failure that could occur in caches or bridge users
when using a very short voting interval on a testing network.
Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on 0.2.0.8-alpha.

o Minor bugfixes (on 0.2.2.x):
- Alter directory authorities to always consider Exit-flagged nodes
as potential Guard nodes in their votes. The actual decision to
use Exits as Guards is done in the consensus bandwidth weights.
Fixes bug 1294; bugfix on 0.2.2.10-alpha.
- When the controller is reporting the purpose of circuits that
didn't finish building before the circuit build timeout, it was
printing UNKNOWN_13. Now print EXPIRED. Bugfix on 0.2.2.14-alpha.
- Our libevent version parsing code couldn't handle versions like
1.4.14b-stable and incorrectly warned the user about using an
old and broken version of libevent. Treat 1.4.14b-stable like
1.4.14-stable when parsing the version. Fixes bug 1731; bugfix
on 0.2.2.1-alpha.
- Don't use substitution references like $(VAR:MOD) when
$(asciidoc_files) is empty -- make(1) on NetBSD transforms
'$()' to 'x' rather than the empty string. This bites us in
doc/ when configured with --disable-asciidoc. Bugfix on
0.2.2.9-alpha; fixes bug 1773.
- Remove a spurious hidden service server-side log notice about
"Ancient non-dirty circuits". Bugfix on 0.2.2.14-alpha; fixes
bug 1741.
- Fix compilation with --with-dmalloc set. Bugfix on 0.2.2.6-alpha;
fixes bug 1832.
- Correctly report written bytes on linked connections. Found while
implementing 1790. Bugfix on 0.2.2.4-alpha.
- Fix three memory leaks: one in circuit_build_times_parse_state(),
one in dirvote_add_signatures_to_pending_consensus(), and one every
time we parse a v3 network consensus. Bugfixes on 0.2.2.14-alpha,
0.2.2.6-alpha, and 0.2.2.10-alpha respectively; fixes bug 1831.

o Code simplifications and refactoring:
- Take a first step towards making or.h smaller by splitting out
function definitions for all source files in src/or/. Leave
structures and defines in or.h for now.
- Remove a bunch of unused function declarations as well as a block of
#if 0'd code from the unit tests. Closes bug 1824.
- New unit tests for exit-port history statistics; refactored exit
statistics code to be more easily tested.
- Remove the old debian/ directory from the main Tor distribution.
The official Tor-for-debian git repository lives at the URL
https://git.torproject.org/debian/tor.git

1.3.10: Released 2010-09-28

update Vidalia to 0.2.10
update Firefox to 3.6.10
add new extensions:
Better Privacy 1.48.3
NoScript 2.0.3.2
HTTPS Everywhere 0.2.2

1.3.11: Release 2010-10-25
update Firefox to 3.6.11
update Pidgin to 2.7.4

Update Firefox to 3.6.12

Yet another OpenSSL security patch broke its compatibility with Tor:
Tor 0.2.1.27 makes relays work with openssl 0.9.8p and 1.0.0.b. We
also took this opportunity to fix several crash bugs, integrate a new
directory authority, and update the bundled GeoIP database.

o Major bugfixes:
- Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.0b:
No longer set the tlsext_host_name extension on server SSL objects;
but continue to set it on client SSL objects. Our goal in setting
it was to imitate a browser, not a vhosting server. Fixes bug 2204;
bugfix on 0.2.1.1-alpha.
- Do not log messages to the controller while shrinking buffer
freelists. Doing so would sometimes make the controller connection
try to allocate a buffer chunk, which would mess up the internals
of the freelist and cause an assertion failure. Fixes bug 1125;
fixed by Robert Ransom. Bugfix on 0.2.0.16-alpha.
- Learn our external IP address when we're a relay or bridge, even if
we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha,
where we introduced bridge relays that don't need to publish to
be useful. Fixes bug 2050.
- Do even more to reject (and not just ignore) annotations on
router descriptors received anywhere but from the cache. Previously
we would ignore such annotations at first, but cache them to disk
anyway. Bugfix on 0.2.0.8-alpha. Found by piebeer.
- When you're using bridges and your network goes away and your
bridges get marked as down, recover when you attempt a new socks
connection (if the network is back), rather than waiting up to an
hour to try fetching new descriptors for your bridges. Bugfix on
0.2.0.3-alpha; fixes bug 1981.

o Major features:
- Move to the November 2010 Maxmind GeoLite country db (rather
than the June 2009 ip-to-country GeoIP db) for our statistics that
count how many users relays are seeing from each country. Now we'll
have more accurate data, especially for many African countries.

o New directory authorities:
- Set up maatuska (run by Linus Nordberg) as the eighth v3 directory
authority.

o Minor bugfixes:
- Fix an assertion failure that could occur in directory caches or
bridge users when using a very short voting interval on a testing
network. Diagnosed by Robert Hogan. Fixes bug 1141; bugfix on
0.2.0.8-alpha.
- Enforce multiplicity rules when parsing annotations. Bugfix on
0.2.0.8-alpha. Found by piebeer.
- Allow handshaking OR connections to take a full KeepalivePeriod
seconds to handshake. Previously, we would close them after
IDLE_OR_CONN_TIMEOUT (180) seconds, the same timeout as if they
were open. Bugfix on 0.2.1.26; fixes bug 1840. Thanks to mingw-san
for analysis help.
- When building with --enable-gcc-warnings on OpenBSD, disable
warnings in system headers. This makes --enable-gcc-warnings
pass on OpenBSD 4.8.

o Minor features:
- Exit nodes didn't recognize EHOSTUNREACH as a plausible error code,
and so sent back END_STREAM_REASON_MISC. Clients now recognize a new
stream ending reason for this case: END_STREAM_REASON_NOROUTE.
Servers can start sending this code when enough clients recognize
it. Bugfix on 0.1.0.1-rc; fixes part of bug 1793.
- Build correctly on mingw with more recent versions of OpenSSL 0.9.8.
Patch from mingw-san.

o Removed files:
- Remove the old debian/ directory from the main Tor distribution.
The official Tor-for-debian git repository lives at the URL
https://git.torproject.org/debian/tor.git
- Stop shipping the old doc/website/ directory in the tarball. We
changed the website format in late 2010, and what we shipped in
0.2.1.26 really wasn't that useful anyway.

Windows Tor Browser Bundles
There were some controversial changes recently made to the Windows bundle, and for those I apologize. I have removed BetterPrivacy and NoScript from them pending further testing. The whole changelog:

1.3.13: Released 2010-11-25
update Tor to 0.2.1.27
update Pidgin to 2.7.5
update OpenSSL to 0.9.8p
fix Firefox extension install path so extensions show in the installed add-ons list
disable Firefox's ability to search the Windows registry path for system-wide
plugins and extensions (closes: #2118)
remove NoScript and BetterPrivacy from stable bundle until they receive more
testing

Tor 0.2.1.28 does some code cleanup to reduce the risk of remotely exploitable bugs. We also took this opportunity to change the IP address for one of our directory authorities, and to update the geoip database we ship.

Major bugfixes:
- Fix a remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade. Bugfix on the 0.1.1 series and later.

Directory authority changes:
- Change IP address and ports for gabelmoo (v3 directory authority).

Minor features:
- Update to the December 1 2010 Maxmind GeoLite Country database.

- update HTTPS-Everywhere to 0.9.9.development.2
- update Tor to 0.2.1.28

1 Changes in version 0.2.2.23-alpha - 2011-03-08
2 Tor 0.2.2.23-alpha lets relays record their bandwidth history so when
3 they restart they don't lose their bandwidth capacity estimate. This
4 release also fixes a diverse set of user-facing bugs, ranging from
5 relays overrunning their rate limiting to clients falsely warning about
6 clock skew to bridge descriptor leaks by our bridge directory authority.
7
8 o Major bugfixes:
9 - Stop sending a CLOCK_SKEW controller status event whenever
10 we fetch directory information from a relay that has a wrong clock.
11 Instead, only inform the controller when it's a trusted authority
12 that claims our clock is wrong. Bugfix on 0.1.2.6-alpha; fixes
13 the rest of bug 1074.
14 - Fix an assert in parsing router descriptors containing IPv6
15 addresses. This one took down the directory authorities when
16 somebody tried some experimental code. Bugfix on 0.2.1.3-alpha.
17 - Make the bridge directory authority refuse to answer directory
18 requests for "all" descriptors. It used to include bridge
19 descriptors in its answer, which was a major information leak.
20 Found by "piebeer". Bugfix on 0.2.0.3-alpha.
21 - If relays set RelayBandwidthBurst but not RelayBandwidthRate,
22 Tor would ignore their RelayBandwidthBurst setting,
23 potentially using more bandwidth than expected. Bugfix on
24 0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug 2470.
25 - Ignore and warn if the user mistakenly sets "PublishServerDescriptor
26 hidserv" in her torrc. The 'hidserv' argument never controlled
27 publication of hidden service descriptors. Bugfix on 0.2.0.1-alpha.
28
29 o Major features:
30 - Relays now save observed peak bandwidth throughput rates to their
31 state file (along with total usage, which was already saved)
32 so that they can determine their correct estimated bandwidth on
33 restart. Resolves bug 1863, where Tor relays would reset their
34 estimated bandwidth to 0 after restarting.
35 - Directory authorities now take changes in router IP address and
36 ORPort into account when determining router stability. Previously,
37 if a router changed its IP or ORPort, the authorities would not
38 treat it as having any downtime for the purposes of stability
39 calculation, whereas clients would experience downtime since the
40 change could take a while to propagate to them. Resolves issue 1035.
41 - Enable Address Space Layout Randomization (ASLR) and Data Execution
42 Prevention (DEP) by default on Windows to make it harder for
43 attackers to exploit vulnerabilities. Patch from John Brooks.
44
45 o Minor bugfixes (on 0.2.1.x and earlier):
46 - Fix a rare crash bug that could occur when a client was configured
47 with a large number of bridges. Fixes bug 2629; bugfix on
48 0.2.1.2-alpha. Bugfix by trac user "shitlei".
49 - Avoid a double mark-for-free warning when failing to attach a
50 transparent proxy connection. Bugfix on 0.1.2.1-alpha. Fixes
51 bug 2279.
52 - Correctly detect failure to allocate an OpenSSL BIO. Fixes bug 2378;
53 found by "cypherpunks". This bug was introduced before the first
54 Tor release, in svn commit r110.
55 - Country codes aren't supported in EntryNodes until 0.2.3.x, so
56 don't mention them in the manpage. Fixes bug 2450; issue
57 spotted by keb and G-Lo.
58 - Fix a bug in bandwidth history state parsing that could have been
59 triggered if a future version of Tor ever changed the timing
60 granularity at which bandwidth history is measured. Bugfix on
61 Tor 0.1.1.11-alpha.
62 - When a relay decides that its DNS is too broken for it to serve
63 as an exit server, it advertised itself as a non-exit, but
64 continued to act as an exit. This could create accidental
65 partitioning opportunities for users. Instead, if a relay is
66 going to advertise reject *:* as its exit policy, it should
67 really act with exit policy "reject *:*". Fixes bug 2366.
68 Bugfix on Tor 0.1.2.5-alpha. Bugfix by user "postman" on trac.
69 - In the special case where you configure a public exit relay as your
70 bridge, Tor would be willing to use that exit relay as the last
71 hop in your circuit as well. Now we fail that circuit instead.
72 Bugfix on 0.2.0.12-alpha. Fixes bug 2403. Reported by "piebeer".
73 - Fix a bug with our locking implementation on Windows that couldn't
74 correctly detect when a file was already locked. Fixes bug 2504,
75 bugfix on 0.2.1.6-alpha.
76 - Fix IPv6-related connect() failures on some platforms (BSD, OS X).
77 Bugfix on 0.2.0.3-alpha; fixes first part of bug 2660. Patch by
78 "piebeer".
79 - Set target port in get_interface_address6() correctly. Bugfix
80 on 0.1.1.4-alpha and 0.2.0.3-alpha; fixes second part of bug 2660.
81 - Directory authorities are now more robust to hops back in time
82 when calculating router stability. Previously, if a run of uptime
83 or downtime appeared to be negative, the calculation could give
84 incorrect results. Bugfix on 0.2.0.6-alpha; noticed when fixing
85 bug 1035.
86 - Fix an assert that got triggered when using the TestingTorNetwork
87 configuration option and then issuing a GETINFO config-text control
88 command. Fixes bug 2250; bugfix on 0.2.1.2-alpha.
89
90 o Minor bugfixes (on 0.2.2.x):
91 - Clients should not weight BadExit nodes as Exits in their node
92 selection. Similarly, directory authorities should not count BadExit
93 bandwidth as Exit bandwidth when computing bandwidth-weights.
94 Bugfix on 0.2.2.10-alpha; fixes bug 2203.
95 - Correctly clear our dir_read/dir_write history when there is an
96 error parsing any bw history value from the state file. Bugfix on
97 Tor 0.2.2.15-alpha.
98 - Resolve a bug in verifying signatures of directory objects
99 with digests longer than SHA1. Bugfix on 0.2.2.20-alpha.
100 Fixes bug 2409. Found by "piebeer".
101 - Bridge authorities no longer crash on SIGHUP when they try to
102 publish their relay descriptor to themselves. Fixes bug 2572. Bugfix
103 on 0.2.2.22-alpha.
104
105 o Minor features:
106 - Log less aggressively about circuit timeout changes, and improve
107 some other circuit timeout messages. Resolves bug 2004.
108 - Log a little more clearly about the times at which we're no longer
109 accepting new connections. Resolves bug 2181.
110 - Reject attempts at the client side to open connections to private
111 IP addresses (like 127.0.0.1, 10.0.0.1, and so on) with
112 a randomly chosen exit node. Attempts to do so are always
113 ill-defined, generally prevented by exit policies, and usually
114 in error. This will also help to detect loops in transparent
115 proxy configurations. You can disable this feature by setting
116 "ClientRejectInternalAddresses 0" in your torrc.
117 - Always treat failure to allocate an RSA key as an unrecoverable
118 allocation error.
119 - Update to the March 1 2011 Maxmind GeoLite Country database.
120
121 o Minor features (log subsystem):
122 - Add documentation for configuring logging at different severities in
123 different log domains. We've had this feature since 0.2.1.1-alpha,
124 but for some reason it never made it into the manpage. Fixes
125 bug 2215.
126 - Make it simpler to specify "All log domains except for A and B".
127 Previously you needed to say "[*,~A,~". Now you can just say
128 "[~A,~".
129 - Add a "LogMessageDomains 1" option to include the domains of log
130 messages along with the messages. Without this, there's no way
131 to use log domains without reading the source or doing a lot
132 of guessing.
133
134 o Packaging changes:
135 - Stop shipping the Tor specs files and development proposal documents
136 in the tarball. They are now in a separate git repository at
137 git://git.torproject.org/torspec.git

Tor 0.2.2.24-alpha fixes a variety of bugs, including a big bug that
prevented Tor clients from effectively using "multihomed" bridges,
that is, bridges that listen on multiple ports or IP addresses so users
can continue to use some of their addresses even if others get blocked.

https://www.torproject.org/download/download

Major bugfixes:
Fix a bug where bridge users who configure the non-canonical
address of a bridge automatically switch to its canonical
address. If a bridge listens at more than one address, it should be
able to advertise those addresses independently and any non-blocked
addresses should continue to work. Bugfix on Tor 0.2.0.x. Fixes
bug 2510.
If you configured Tor to use bridge A, and then quit and
configured Tor to use bridge B instead, it would happily continue
to use bridge A if it's still reachable. While this behavior is
a feature if your goal is connectivity, in some scenarios it's a
dangerous bug. Bugfix on Tor 0.2.0.1-alpha; fixes bug 2511.
Directory authorities now use data collected from their own
uptime observations when choosing whether to assign the HSDir flag
to relays, instead of trusting the uptime value the relay reports in
its descriptor. This change helps prevent an attack where a small
set of nodes with frequently-changing identity keys can blackhole
a hidden service. (Only authorities need upgrade; others will be
fine once they do.) Bugfix on 0.2.0.10-alpha; fixes bug 2709.

Minor bugfixes:
When we restart our relay, we might get a successful connection
from the outside before we've started our reachability tests,
triggering a warning: "ORPort found reachable, but I have no
routerinfo yet. Failing to inform controller of success." This
bug was harmless unless Tor is running under a controller
like Vidalia, in which case the controller would never get a
REACHABILITY_SUCCEEDED status event. Bugfix on 0.1.2.6-alpha;
fixes bug 1172.
Make directory authorities more accurate at recording when
relays that have failed several reachability tests became
unreachable, so we can provide more accuracy at assigning Stable,
Guard, HSDir, etc flags. Bugfix on 0.2.0.6-alpha. Resolves bug 2716.
- Fix an issue that prevented static linking of libevent on
some platforms (notably Linux). Fixes bug 2698; bugfix on
versions 0.2.1.23/0.2.2.8-alpha (the versions introducing
the --with-static-libevent configure option).
We now ask the other side of a stream (the client or the exit)
for more data on that stream when the amount of queued data on
that stream dips low enough. Previously, we wouldn't ask the
other side for more data until either it sent us more data (which
it wasn't supposed to do if it had exhausted its window!) or we
had completely flushed all our queued data. This flow control fix
should improve throughput. Fixes bug 2756; bugfix on the earliest
released versions of Tor (svn commit r152).
Avoid a double-mark-for-free warning when failing to attach a
transparent proxy connection. (We thought we had fixed this in
0.2.2.23-alpha, but it turns out our fix was checking the wrong
connection.) Fixes bug 2757; bugfix on 0.1.2.1-alpha (the original
bug) and 0.2.2.23-alpha (the incorrect fix).
When warning about missing zlib development packages during compile,
give the correct package names. Bugfix on 0.2.0.1-alpha.

Minor features:
Directory authorities now log the source of a rejected POSTed v3
networkstatus vote.
Make compilation with clang possible when using
--enable-gcc-warnings by removing two warning optionss that clang
hasn't implemented yet and by fixing a few warnings. Implements
ticket 2696.
When expiring circuits, use microsecond timers rather than
one-second timers. This can avoid an unpleasant situation where a
circuit is launched near the end of one second and expired right
near the beginning of the next, and prevent fluctuations in circuit
timeout values.
Use computed circuit-build timeouts to decide when to launch
parallel introduction circuits for hidden services. (Previously,
we would retry after 15 seconds.)

Packaging fixes:
Create the /var/run/tor directory on startup on OpenSUSE if it is
not already created. Patch from Andreas Stieger. Fixes bug 2573.

Documentation changes:
Modernize the doxygen configuration file slightly. Fixes bug 2707.
Resolve all doxygen warnings except those for missing documentation.
Fixes bug 2705.
Add doxygen documentation for more functions, fields, and types.

Update Firefox to 3.6.19
Update HTTPS-Everywhere to 1.0.0development.4
Update Libevent to 2.0.12-stable

https://gitweb.torproject.org/torbrowser.git/blob_plain/HEAD:/README

1 Changes in version 0.2.2.31-rc - 2011-08-17
2 Tor 0.2.2.31-rc is the second and hopefully final release candidate
3 for the Tor 0.2.2.x series.
4
5 o Major bugfixes:
6 - Remove an extra pair of quotation marks around the error
7 message in control-port STATUS_GENERAL BUG events. Bugfix on
8 0.1.2.6-alpha; fixes bug 3732.
9 - If we're configured to write our ControlPorts to disk, only write
10 them after switching UID and creating the data directory. This way,
11 we don't fail when starting up with a nonexistent DataDirectory
12 and a ControlPortWriteToFile setting based on that directory. Fixes
13 bug 3747; bugfix on Tor 0.2.2.26-beta.
14
15 o Minor features:
16 - Update to the August 2 2011 Maxmind GeoLite Country database.
17
18 o Minor bugfixes:
19 - Allow GETINFO fingerprint to return a fingerprint even when
20 we have not yet built a router descriptor. Fixes bug 3577;
21 bugfix on 0.2.0.1-alpha.
22 - Write several files in text mode, on OSes that distinguish text
23 mode from binary mode (namely, Windows). These files are:
24 'buffer-stats', 'dirreq-stats', and 'entry-stats' on relays
25 that collect those statistics; 'client_keys' and 'hostname' for
26 hidden services that use authentication; and (in the tor-gencert
27 utility) newly generated identity and signing keys. Previously,
28 we wouldn't specify text mode or binary mode, leading to an
29 assertion failure. Fixes bug 3607. Bugfix on 0.2.1.1-alpha (when
30 the DirRecordUsageByCountry option which would have triggered
31 the assertion failure was added), although this assertion failure
32 would have occurred in tor-gencert on Windows in 0.2.0.1-alpha.
33 - Selectively disable deprecation warnings on OS X because Lion
34 started deprecating the shipped copy of openssl. Fixes bug 3643.
35 - When unable to format an address as a string, report its value
36 as "???" rather than reusing the last formatted address. Bugfix
37 on 0.2.1.5-alpha.

The Tor 0.2.2 release series is dedicated to the memory of Andreas
Pfitzmann (1958-2010), a pioneer in anonymity and privacy research,
a founder of the PETS community, a leader in our field, a mentor,
and a friend. He left us with these words: "I had the possibility
to contribute to this world that is not as it should be. I hope I
could help in some areas to make the world a better place, and that
I could also encourage other people to be engaged in improving the
world. Please, stay engaged. This world needs you, your love, your
initiative -- now I cannot be part of that anymore."

Tor 0.2.2.32, the first stable release in the 0.2.2 branch, is finally
ready. More than two years in the making, this release features improved
client performance and hidden service reliability, better compatibility
for Android, correct behavior for bridges that listen on more than
one address, more extensible and flexible directory object handling,
better reporting of network statistics, improved code security, and
many many other features and bugfixes.

Tor Browser Bundle (2.2.32-3)

Update Firefox to 6.0.2
New Firefox patches:
Improve cache APIs to enable better isolation (closes: #3666)
Provide auth headers to on-modify-request (closes: #3907)
Randomize HTTP pipelining as an experimental website traffic fingerprinting defense (closes: #3914)
Enable HTTP pipelining in TBB prefs.js (closes: #3913)
Update Torbutton to 1.4.2
bug 3879: Fix broken framed sites (yopmail, gmane, gmaps, etc)
bug 3337: Fetch check.tp.o page to check versions (TBB only)
Bug 3754: Fix SafeCache OCSP errors (fix for TBB only)
Update NoScript to 2.1.2.7

Windows fixes

Add missing C runtime libraries so WinXP users can use TBB again. Fix found by velope.

Linux fixes

Update libpng to 1.4.8 (closes: #3906)
Make the TBB launch script work when using a relative symlink (closes: #2525)

The Tor Browser Bundles have been updated with a bunch of bug fixes.

Important note to Windows users: in the last release we enabled automatic port selection for Tor and this had very unexpected side effects on many Windows machines. It turns out that there are a number of consumer firewalls that don't like things connecting on high ports, which was the default. We're looking into smarter ways to handle this failure mode, but until we find one, we have reverted the behavior to using the previous static port. We're very sorry for the huge inconvenience this caused and hope you will find these bundles more bug-free! As ever, if you don't, please let us know.
https://www.torproject.org/download

Tor Browser Bundle (2.2.32-4)
Windows fixes

Disable automatic port selection to accommodate Windows users with
firewalls that don't allow connections or traffic on high ports (closes: #3952, #3945)

Linux fixes
Fix Makefile to allow for automatic retrieval of Qt and libpng (closes: #2255)
Remove symlinks from tarball (closes: #2312)

General fixes and updates
New Firefox patches
Prevent Firefox from loading all system plugins besides Flash (closes: #2826, #3547)
Prevent content-preferences service from writing website urls and their settings to disk (closes: #3229)
Update Torbutton to 1.4.3
Don't let Torbutton inadvertently enable automatic updating in Firefox (closes: #3933)
Fix auto-scroll on Twitter (closes: #3960)
Allow site zoom information to be stored (closes: #3928)
Make permissions and disk errors human-readable (closes: #3649)

Iran blocks Tor; Tor releases same-day fix

The short version: Tor relays and bridges should upgrade to Tor 0.2.2.33 or Tor 0.2.3.4-alpha so users in Iran can reach them again.

Yesterday morning (in our timezones — that evening, in Iran), Iran added a filter rule to their border routers that recognized Tor traffic and blocked it. Thanks to help from a variety of friends around the world, we quickly discovered how they were blocking it and released a new version of Tor that isn't blocked. Fortunately, the fix is on the relay side: that means once enough relays and bridges upgrade, the many tens of thousands of Tor users in Iran will resume being able to reach the Tor network, without needing to change their software.

How did the filter work technically? Tor tries to make its traffic look like a web browser talking to an https web server, but if you look carefully enough you can tell some differences. In this case, the characteristic of Tor's SSL handshake they looked at was the expiry time for our SSL session certificates: we rotate the session certificates every two hours, whereas normal SSL certificates you get from a certificate authority typically last a year or more. The fix was to simply write a larger expiration time on the certificates, so our certs have more plausible expiry times.

There are plenty of interesting discussion points from the research angle around how this arms race should be played. We're working on medium term and longer term solutions, but in the short term, there are other ways to filter Tor traffic like the one Iran used. Should we fix them all preemptively, meaning the next time they block us it will be through some more complex mechanism that's harder to figure out? Or should we leave things as they are, knowing there will be more blocking events but also knowing that we can solve them easily? Given that their last blocking attempt was in January 2011, I think it's smartest to collect some more data points first.

It's too early to have cool graphs showing a drop in users and then the users coming back a day or so later. I'll plan to add these graphs once things play out more.

The Tor Browser Bundles have been updated to Firefox 7.0.1 and Tor 0.2.2.33. The bundles were originally uploaded with Firefox 7.0, but a fix was quickly released, so the two changelogs have been merged in this post.

Windows fixes

Begin building Vidalia with DEP/ASLR

OS X fixes

Stop TBB from logging so much information to the system by only allowing dyld log library loads to syslog when it is in debug mode (closes: #4093)

General fixes and updates

Update Firefox to 7.0.1
Update OpenSSL to 1.0.0e (closes: #3996) (except for OS X)
Update Tor to 0.2.2.33
Update NoScript to 2.1.2.8
Downgrade HTTPS Everywhere to 1.0.3, because we don't want stable TBBs to use development versions of extensions (closes: #4050)

Tor 0.2.3.5-alpha fixes two bugs that make it possible to enumerate
bridge relays; fixes an assertion error that many users started hitting
today; and adds the ability to refill token buckets more often than
once per second, allowing significant performance improvements.

Security fixes:

Bridge relays now do their directory fetches inside Tor TLS
connections, like all the other clients do, rather than connecting
directly to the DirPort like public relays do. Removes another
avenue for enumerating bridges. Fixes bug 4115; bugfix on 0.2.0.35.
Bridges relays now build circuits for themselves in a more similar
way to how clients build them. Removes another avenue for
enumerating bridges. Fixes bug 4124; bugfix on 0.2.0.3-alpha,
when bridges were introduced.

Major bugfixes:

Fix an "Assertion md->held_by_node == 1 failed" error that could
occur when the same microdescriptor was referenced by two node_t
objects at once. Fix for bug 4118; bugfix on Tor 0.2.3.1-alpha.

Major features (networking):

Add a new TokenBucketRefillInterval option to refill token buckets
more frequently than once per second. This should improve network
performance, alleviate queueing problems, and make traffic less
bursty. Implements proposal 183; closes ticket 3630. Design by
Florian Tschorsch and Björn Scheuermann; implementation by
Florian Tschorsch.

Minor bugfixes:

Change an integer overflow check in the OpenBSD_Malloc code so
that GCC is less likely to eliminate it as impossible. Patch
from Mansour Moufid. Fixes bug 4059.

Minor bugfixes (usability):

Downgrade log messages about circuit timeout calibration from
"notice" to "info": they don't require or suggest any human
intervention. Patch from Tom Lowenthal. Fixes bug 4063;
bugfix on 0.2.2.14-alpha.

Minor features (diagnostics):

When the system call to create a listener socket fails, log the
error message explaining why. This may help diagnose bug 4027.

Changes in version 0.2.3.5-alpha - 2011-09-28

Tor 0.2.3.5-alpha fixes two bugs that make it possible to enumerate
bridge relays; fixes an assertion error that many users started hitting
today; and adds the ability to refill token buckets more often than
once per second, allowing significant performance improvements.

o Security fixes:
- Bridge relays now do their directory fetches inside Tor TLS
connections, like all the other clients do, rather than connecting
directly to the DirPort like public relays do. Removes another
avenue for enumerating bridges. Fixes bug 4115; bugfix on 0.2.0.35.
- Bridges relays now build circuits for themselves in a more similar
way to how clients build them. Removes another avenue for
enumerating bridges. Fixes bug 4124; bugfix on 0.2.0.3-alpha,
when bridges were introduced.

o Major bugfixes:
- Fix an "Assertion md->held_by_node == 1 failed" error that could
occur when the same microdescriptor was referenced by two node_t
objects at once. Fix for bug 4118; bugfix on Tor 0.2.3.1-alpha.

o Major features (networking):
- Add a new TokenBucketRefillInterval option to refill token buckets
more frequently than once per second. This should improve network
performance, alleviate queueing problems, and make traffic less
bursty. Implements proposal 183; closes ticket 3630. Design by
Florian Tschorsch and Björn Scheuermann; implementation by
Florian Tschorsch.

o Minor bugfixes:
- Change an integer overflow check in the OpenBSD_Malloc code so
that GCC is less likely to eliminate it as impossible. Patch
from Mansour Moufid. Fixes bug 4059.

o Minor bugfixes (usability):
- Downgrade log messages about circuit timeout calibration from
"notice" to "info": they don't require or suggest any human
intervention. Patch from Tom Lowenthal. Fixes bug 4063;
bugfix on 0.2.2.14-alpha.

o Minor features (diagnostics):
- When the system call to create a listener socket fails, log the
error message explaining why. This may help diagnose bug 4027.

o Draw the bandwidth graph curves based on the local maximum, not
the global maximum. Fixes bug 2188.
o Add an option for setting up a non-exit relay to the Sharing
configuration panel. This is meant to clarify what an exit policy
and an exit relay are. Resolves bug 2644.
o Display time statistics for bridges in UTC time, rather than local
time. Fixes bug 3342.
o Change the parameter for ordering the entries in the Basic Log
list from currentTime to currentDateTime to avoid missplacing
entries from different days.
o Check the tor version and that settings are sanitized before
trying to use the port autoconfiguration feature. Fixes bug 3843.
o Provide a way to hide Dock or System Tray icons in OSX. Resolves
ticket 2163.
o Make new processes appear at front when they are started (OSX
specific).

Tor 0.2.2.34 fixes a critical anonymity vulnerability where an attacker
can deanonymize Tor users. Everybody should upgrade.

The attack relies on four components:
1) Clients reuse their TLS cert when talking to different relays, so relays can recognize a user by the identity key in her cert.
2) An attacker who knows the client's identity key can probe each guard relay to see if that identity key is connected to that guard relay right now.
3) A variety of active attacks in the literature (starting from "Low-Cost Traffic Analysis of Tor" by Murdoch and Danezis in 2005) allow a malicious website to discover the guard relays that a Tor user visiting the website is using.
4) Clients typically pick three guards at random, so the set of guards for a given user could well be a unique fingerprint for her. This release fixes components #1 and #2, which is enough to block the attack; the other two remain as open research problems.

Special thanks to "frosty_un" for reporting the issue to us! (As far as we know, this has nothing to do with any claimed attack currently getting attention in the media.)

Clients should upgrade so they are no longer recognizable by the TLS certs they present. Relays should upgrade so they no longer allow a remote attacker to probe them to test whether unpatched clients are currently connected to them.

This release also fixes several vulnerabilities that allow an attacker to enumerate bridge relays. Some bridge enumeration attacks still remain; see for example proposal 188.

https://www.torproject.org/download/download

Changes in version 0.2.2.34 - 2011-10-26

Privacy/anonymity fixes (clients):
Clients and bridges no longer send TLS certificate chains on outgoing OR
connections. Previously, each client or bridge would use the same cert chain
for all outgoing OR connections until its IP address changes, which allowed any
relay that the client or bridge contacted to determine which entry guards it is
using. Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by "frosty_un".
If a relay receives a CREATE_FAST cell on a TLS connection, it no longer
considers that connection as suitable for satisfying a circuit EXTEND request.
Now relays can protect clients from the CVE-2011-2768 issue even if the clients
haven't upgraded yet.
Directory authorities no longer assign the Guard flag to relays that
haven't upgraded to the above "refuse EXTEND requests to client connections"
fix. Now directory authorities can protect clients from the CVE-2011-2768 issue
even if neither the clients nor the relays have upgraded yet. There's a new
"GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays" config option to let us
transition smoothly, else tomorrow there would be no guard relays.

Privacy/anonymity fixes (bridge enumeration):
Bridge relays now do their directory fetches inside Tor TLS connections,
like all the other clients do, rather than connecting directly to the DirPort
like public relays do. Removes another avenue for enumerating bridges. Fixes
bug 4115; bugfix on 0.2.0.35.
Bridges relays now build circuits for themselves in a more similar way to
how clients build them. Removes another avenue for enumerating bridges. Fixes
bug 4124; bugfix on 0.2.0.3-alpha, when bridges were introduced.
Bridges now refuse CREATE or CREATE_FAST cells on OR connections that they
initiated. Relays could distinguish incoming bridge connections from client
connections, creating another avenue for enumerating bridges. Fixes
CVE-2011-2769. Bugfix on 0.2.0.3-alpha. Found by "frosty_un".

Major bugfixes:
Fix a crash bug when changing node restrictions while a DNS lookup is
in-progress. Fixes bug 4259; bugfix on 0.2.2.25-alpha. Bugfix by "Tey'".
Don't launch a useless circuit after failing to use one of a hidden
service's introduction points. Previously, we would launch a new introduction
circuit, but not set the hidden service which that circuit was intended to
connect to, so it would never actually be used. A different piece of code would
then create a new introduction circuit correctly. Bug reported by katmagic and
found by Sebastian Hahn. Bugfix on 0.2.1.13-alpha; fixes bug 4212.

Minor bugfixes:
Change an integer overflow check in the OpenBSD_Malloc code so that GCC is
less likely to eliminate it as impossible. Patch from Mansour Moufid. Fixes bug
4059.
When a hidden service turns an extra service-side introduction circuit into
a general-purpose circuit, free the rend_data and intro_key fields first, so we
won't leak memory if the circuit is cannibalized for use as another
service-side introduction circuit. Bugfix on 0.2.1.7-alpha; fixes bug
4251.
Bridges now skip DNS self-tests, to act a little more stealthily. Fixes
bug 4201; bugfix on 0.2.0.3-alpha, which first introduced bridges. Patch by
"warms0x".
Fix internal bug-checking logic that was supposed to catch failures in
digest generation so that it will fail more robustly if we ask for a
nonexistent algorithm. Found by Coverity Scan. Bugfix on 0.2.2.1-alpha; fixes
Coverity CID 479.
Report any failure in init_keys() calls launched because our IP address has
changed. Spotted by Coverity Scan. Bugfix on 0.1.1.4-alpha; fixes CID 484.

Minor bugfixes (log messages and documentation):
Remove a confusing dollar sign from the example fingerprint in the man
page, and also make the example fingerprint a valid one. Fixes bug 4309; bugfix
on 0.2.1.3-alpha.
The next version of Windows will be called Windows 8, and it has a major
version of 6, minor version of 2. Correctly identify that version instead of
calling it "Very recent version". Resolves ticket 4153; reported by
funkstar.
Downgrade log messages about circuit timeout calibration from "notice" to
"info": they don't require or suggest any human intervention. Patch from Tom
Lowenthal. Fixes bug 4063; bugfix on 0.2.2.14-alpha.

Minor features:
Turn on directory request statistics by default and include them in
extra-info descriptors. Don't break if we have no GeoIP database. Backported
from 0.2.3.1-alpha; implements ticket 3951.
Update to the October 4 2011 Maxmind GeoLite Country database.

Tor 0.2.3.7-alpha fixes a crash bug in 0.2.3.6-alpha introduced by the new v3 handshake. It also resolves yet another bridge address enumeration issue.

All packages are updated, with the exception of the OS X PPC packages. The build machine is down and packages will be built as soon as it is back online.

https://www.torproject.org/download

Changes in version 0.2.3.7-alpha - 2011-10-30
Major bugfixes:
If we mark an OR connection for close based on a cell we process,
don't process any further cells on it. We already avoid further
reads on marked-for-close connections, but now we also discard the
cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha,
which was the first version where we might mark a connection for
close based on processing a cell on it.
Fix a double-free bug that would occur when we received an invalid
certificate in a CERT cell in the new v3 handshake. Fixes bug 4343;
bugfix on 0.2.3.6-alpha.
Bridges no longer include their address in NETINFO cells on outgoing
OR connections, to allow them to blend in better with clients.
Removes another avenue for enumerating bridges. Reported by
"troll_un". Fixes bug 4348; bugfix on 0.2.0.10-alpha, when NETINFO
cells were introduced.

Trivial fixes:
Fixed a typo in a hibernation-related log message. Fixes bug 4331;
bugfix on 0.2.2.23-alpha; found by "tmpname0901".

Changes in version 0.2.3.8-alpha - 2011-11-22
Tor 0.2.3.8-alpha fixes some crash and assert bugs, including a
socketpair-related bug that has been bothering Windows users. It adds
support to serve microdescriptors to controllers, so Vidalia's network
map can resume listing relays (once Vidalia implements its side),
and adds better support for hardware AES acceleration. Finally, it
starts the process of adjusting the bandwidth cutoff for getting the
"Fast" flag from 20KB to (currently) 32KB -- preliminary results show
that tiny relays harm performance more than they help network capacity.

o Major bugfixes:
- Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so
that it doesn't attempt to allocate a socketpair. This could cause
some problems on Windows systems with overzealous firewalls. Fix for
bug 4457; workaround for Libevent versions 2.0.1-alpha through
2.0.15-stable.
- Correctly sanity-check that we don't underflow on a memory
allocation (and then assert) for hidden service introduction
point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
bugfix on 0.2.1.5-alpha.
- Remove the artificially low cutoff of 20KB to guarantee the Fast
flag. In the past few years the average relay speed has picked
up, and while the "top 7/8 of the network get the Fast flag" and
"all relays with 20KB or more of capacity get the Fast flag" rules
used to have the same result, now the top 7/8 of the network has
a capacity more like 32KB. Bugfix on 0.2.1.14-rc. Fixes bug 4489.
- Fix a rare assertion failure when checking whether a v0 hidden
service descriptor has any usable introduction points left, and
we don't have enough information to build a circuit to the first
intro point named in the descriptor. The HS client code in
0.2.3.x no longer uses v0 HS descriptors, but this assertion can
trigger on (and crash) v0 HS authorities. Fixes bug 4411.
Bugfix on 0.2.3.1-alpha; diagnosed by frosty_un.
- Make bridge authorities not crash when they are asked for their own
descriptor. Bugfix on 0.2.3.7-alpha, reported by Lucky Green.
- When running as a client, do not print a misleading (and plain
wrong) log message that we're collecting "directory request"
statistics: clients don't collect statistics. Also don't create a
useless (because empty) stats file in the stats/ directory. Fixes
bug 4353; bugfix on 0.2.2.34 and 0.2.3.7-alpha.

o Major features:
- Allow Tor controllers like Vidalia to obtain the microdescriptor
for a relay by identity digest or nickname. Previously,
microdescriptors were only available by their own digests, so a
controller would have to ask for and parse the whole microdescriptor
consensus in order to look up a single relay's microdesc. Fixes
bug 3832; bugfix on 0.2.3.1-alpha.
- Use OpenSSL's EVP interface for AES encryption, so that all AES
operations can use hardware acceleration (if present). Resolves
ticket 4442.

o Minor bugfixes (on 0.2.2.x and earlier):
- Detect failure to initialize Libevent. This fix provides better
detection for future instances of bug 4457.
- Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers
function. This was eating up hideously large amounts of time on some
busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
- Don't warn about unused log_mutex in log.c when building with
--disable-threads using a recent GCC. Fixes bug 4437; bugfix on
0.1.0.6-rc which introduced --disable-threads.
- Allow manual 'authenticate' commands to the controller interface
from netcat (nc) as well as telnet. We were rejecting them because
they didn't come with the expected whitespace at the end of the
command. Bugfix on 0.1.1.1-alpha; fixes bug 2893.
- Fix some (not actually triggerable) buffer size checks in usage of
tor_inet_ntop. Fixes bug 4434; bugfix on Tor 0.2.0.1-alpha. Patch
by Anders Sundman.
- Fix parsing of some corner-cases with tor_inet_pton(). Fixes
bug 4515; bugfix on 0.2.0.1-alpha; fix by Anders Sundman.
- When configuring, starting, or stopping an NT service, stop
immediately after the service configuration attempt has succeeded
or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
- When sending a NETINFO cell, include the original address
received for the other side, not its canonical address. Found
by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
- Rename the bench_{aes,dmap} functions to test_*, so that tinytest
can pick them up when the tests aren't disabled. Bugfix on
0.2.2.4-alpha which introduced tinytest.
- Fix a memory leak when we check whether a hidden service
descriptor has any usable introduction points left. Fixes bug
4424. Bugfix on 0.2.2.25-alpha.
- Fix a memory leak in launch_direct_bridge_descriptor_fetch() that
occurred when a client tried to fetch a descriptor for a bridge
in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.

o Minor bugfixes (on 0.2.3.x):
- Make util unit tests build correctly with MSVC. Bugfix on
0.2.3.3-alpha. Patch by Gisle Vanem.
- Successfully detect AUTH_CHALLENGE cells with no recognized
authentication type listed. Fixes bug 4367; bugfix on 0.2.3.6-alpha.
Found by frosty_un.
- If a relay receives an AUTH_CHALLENGE cell it can't answer,
it should still send a NETINFO cell to allow the connection to
become open. Fixes bug 4368; fix on 0.2.3.6-alpha; bug found by
"frosty".
- Log less loudly when we get an invalid authentication certificate
from a source other than a directory authority: it's not unusual
to see invalid certs because of clock skew. Fixes bug 4370; bugfix
on 0.2.3.6-alpha.
- Tolerate servers with more clock skew in their authentication
certificates than previously. Fixes bug 4371; bugfix on
0.2.3.6-alpha.
- Fix a couple of compile warnings on Windows. Fixes bug 4469; bugfix
on 0.2.3.4-alpha and 0.2.3.6-alpha.

o Minor features:
- Add two new config options for directory authorities:
AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the
Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold
that is always sufficient to satisfy the bandwidth requirement for
the Guard flag. Now it will be easier for researchers to simulate
Tor networks with different values. Resolves ticket 4484.
- When Tor ignores a hidden service specified in its configuration,
include the hidden service's directory in the warning message.
Previously, we would only tell the user that some hidden service
was ignored. Bugfix on 0.0.6; fixes bug 4426.
- When we fail to initialize Libevent, retry with IOCP disabled so we
don't need to turn on multi-threading support in Libevent, which in
turn requires a working socketpair(). This is a workaround for bug
4457, which affects Libevent versions from 2.0.1-alpha through
2.0.15-stable.
- Detect when we try to build on a platform that doesn't define
AF_UNSPEC to 0. We don't work there, so refuse to compile.
- Update to the November 1 2011 Maxmind GeoLite Country database.

o Packaging changes:
- Make it easier to automate expert package builds on Windows,
by removing an absolute path from makensis.exe command.

o Code simplifications and refactoring:
- Remove some redundant #include directives throughout the code.
Patch from Andrea Gelmini.
- Unconditionally use OpenSSL's AES implementation instead of our
old built-in one. OpenSSL's AES has been better for a while, and
relatively few servers should still be on any version of OpenSSL
that doesn't have good optimized assembly AES.
- Use the name "CERTS" consistently to refer to the new cell type;
we were calling it CERT in some places and CERTS in others.

o Testing:
- Numerous new unit tests for functions in util.c and address.c by
Anders Sundman.
- The long-disabled benchmark tests are now split into their own
./src/test/bench binary.
- The benchmark tests can now use more accurate timers than
gettimeofday() when such timers are available.

Changes in version 0.2.3.9-alpha - 2011-12-08
Tor 0.2.3.9-alpha introduces initial IPv6 support for bridges, adds
a "DisableNetwork" security feature that bundles can use to avoid
touching the network until bridges are configured, moves forward on
the pluggable transport design, fixes a flaw in the hidden service
design that unnecessarily prevented clients with wrong clocks from
reaching hidden services, and fixes a wide variety of other issues.

o Major features:
- Clients can now connect to private bridges over IPv6. Bridges
still need at least one IPv4 address in order to connect to
other relays. Note that we don't yet handle the case where the
user has two bridge lines for the same bridge (one IPv4, one
IPv6). Implements parts of proposal 186.
- New "DisableNetwork" config option to prevent Tor from launching any
connections or accepting any connections except on a control port.
Bundles and controllers can set this option before letting Tor talk
to the rest of the network, for example to prevent any connections
to a non-bridge address. Packages like Orbot can also use this
option to instruct Tor to save power when the network is off.
- Clients and bridges can now be configured to use a separate
"transport" proxy. This approach makes the censorship arms race
easier by allowing bridges to use protocol obfuscation plugins. It
implements the "managed proxy" part of proposal 180 (ticket 3472).
- When using OpenSSL 1.0.0 or later, use OpenSSL's counter mode
implementation. It makes AES_CTR about 7% faster than our old one
(which was about 10% faster than the one OpenSSL used to provide).
Resolves ticket 4526.
- Add a "tor2web mode" for clients that want to connect to hidden
services non-anonymously (and possibly more quickly). As a safety
measure to try to keep users from turning this on without knowing
what they are doing, tor2web mode must be explicitly enabled at
compile time, and a copy of Tor compiled to run in tor2web mode
cannot be used as a normal Tor client. Implements feature 2553.
- Add experimental support for running on Windows with IOCP and no
kernel-space socket buffers. This feature is controlled by a new
"UserspaceIOCPBuffers" config option (off by default), which has
no effect unless Tor has been built with support for bufferevents,
is running on Windows, and has enabled IOCP. This may, in the long
run, help solve or mitigate bug 98.
- Use a more secure consensus parameter voting algorithm. Now at
least three directory authorities or a majority of them must
vote on a given parameter before it will be included in the
consensus. Implements proposal 178.

o Major bugfixes:
- Hidden services now ignore the timestamps on INTRODUCE2 cells.
They used to check that the timestamp was within 30 minutes
of their system clock, so they could cap the size of their
replay-detection cache, but that approach unnecessarily refused
service to clients with wrong clocks. Bugfix on 0.2.1.6-alpha, when
the v3 intro-point protocol (the first one which sent a timestamp
field in the INTRODUCE2 cell) was introduced; fixes bug 3460.
- Only use the EVP interface when AES acceleration is enabled,
to avoid a 5-7% performance regression. Resolves issue 4525;
bugfix on 0.2.3.8-alpha.

o Privacy/anonymity features (bridge detection):
- Make bridge SSL certificates a bit more stealthy by using random
serial numbers, in the same fashion as OpenSSL when generating
self-signed certificates. Implements ticket 4584.
- Introduce a new config option "DynamicDHGroups", enabled by
default, which provides each bridge with a unique prime DH modulus
to be used during SSL handshakes. This option attempts to help
against censors who might use the Apache DH modulus as a static
identifier for bridges. Addresses ticket 4548.

o Minor features (new/different config options):
- New configuration option "DisableDebuggerAttachment" (on by default)
to prevent basic debugging attachment attempts by other processes.
Supports Mac OS X and Gnu/Linux. Resolves ticket 3313.
- Allow MapAddress directives to specify matches against super-domains,
as in "MapAddress *.torproject.org *.torproject.org.torserver.exit".
Implements issue 933.
- Slightly change behavior of "list" options (that is, config
options that can appear more than once) when they appear both in
torrc and on the command line. Previously, the command-line options
would be appended to the ones from torrc. Now, the command-line
options override the torrc options entirely. This new behavior
allows the user to override list options (like exit policies and
ports to listen on) from the command line, rather than simply
appending to the list.
- You can get the old (appending) command-line behavior for "list"
options by prefixing the option name with a "+".
- You can remove all the values for a "list" option from the command
line without adding any new ones by prefixing the option name
with a "/".
- Add experimental support for a "defaults" torrc file to be parsed
before the regular torrc. Torrc options override the defaults file's
options in the same way that the command line overrides the torrc.
The SAVECONF controller command saves only those options which
differ between the current configuration and the defaults file. HUP
reloads both files. (Note: This is an experimental feature; its
behavior will probably be refined in future 0.2.3.x-alpha versions
to better meet packagers' needs.)

o Minor features:
- Try to make the introductory warning message that Tor prints on
startup more useful for actually finding help and information.
Resolves ticket 2474.
- Running "make version" now displays the version of Tor that
we're about to build. Idea from katmagic; resolves issue 4400.
- Expire old or over-used hidden service introduction points.
Required by fix for bug 3460.
- Move the replay-detection cache for the RSA-encrypted parts of
INTRODUCE2 cells to the introduction point data structures.
Previously, we would use one replay-detection cache per hidden
service. Required by fix for bug 3460.
- Reduce the lifetime of elements of hidden services' Diffie-Hellman
public key replay-detection cache from 60 minutes to 5 minutes. This
replay-detection cache is now used only to detect multiple
INTRODUCE2 cells specifying the same rendezvous point, so we can
avoid launching multiple simultaneous attempts to connect to it.

o Minor bugfixes (on Tor 0.2.2.x and earlier):
- Resolve an integer overflow bug in smartlist_ensure_capacity().
Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by
Mansour Moufid.
- Fix a minor formatting issue in one of tor-gencert's error messages.
Fixes bug 4574.
- Prevent a false positive from the check-spaces script, by disabling
the "whitespace between function name and (" check for functions
named 'op()'.
- Fix a log message suggesting that people contact a non-existent
email address. Fixes bug 3448.
- Fix null-pointer access that could occur if TLS allocation failed.
Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
- Report a real bootstrap problem to the controller on router
identity mismatch. Previously we just said "foo", which probably
made a lot of sense at the time. Fixes bug 4169; bugfix on
0.2.1.1-alpha.
- If we had ever tried to call tor_addr_to_str() on an address of
unknown type, we would have done a strdup() on an uninitialized
buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha.
Reported by "troll_un".
- Correctly detect and handle transient lookup failures from
tor_addr_lookup(). Fixes bug 4530; bugfix on 0.2.1.5-alpha.
Reported by "troll_un".
- Use tor_socket_t type for listener argument to accept(). Fixes bug
4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
- Initialize conn->addr to a valid state in spawn_cpuworker(). Fixes
bug 4532; found by "troll_un".

o Minor bugfixes (on Tor 0.2.3.x):
- Fix a compile warning in tor_inet_pton(). Bugfix on 0.2.3.8-alpha;
fixes bug 4554.
- Don't send two ESTABLISH_RENDEZVOUS cells when opening a new
circuit for use as a hidden service client's rendezvous point.
Fixes bugs 4641 and 4171; bugfix on 0.2.3.3-alpha. Diagnosed
with help from wanoskarnet.
- Restore behavior of overriding SocksPort, ORPort, and similar
options from the command line. Bugfix on 0.2.3.3-alpha.

o Build fixes:
- Properly handle the case where the build-tree is not the same
as the source tree when generating src/common/common_sha1.i,
src/or/micro-revision.i, and src/or/or_sha1.i. Fixes bug 3953;
bugfix on 0.2.0.1-alpha.

o Code simplifications, cleanups, and refactorings:
- Remove the pure attribute from all functions that used it
previously. In many cases we assigned it incorrectly, because the
functions might assert or call impure functions, and we don't have
evidence that keeping the pure attribute is worthwhile. Implements
changes suggested in ticket 4421.
- Remove some dead code spotted by coverity. Fixes cid 432.
Bugfix on 0.2.3.1-alpha, closes bug 4637.

Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's
buffers code. Absolutely everybody should upgrade.

The bug relied on an incorrect calculation when making data continuous
in one of our IO buffers, if the first chunk of the buffer was
misaligned by just the wrong amount. The miscalculation would allow an
attacker to overflow a piece of heap-allocated memory. To mount this
attack, the attacker would need to either open a SOCKS connection to
Tor's SocksPort (usually restricted to localhost), or target a Tor
instance configured to make its connections through a SOCKS proxy
(which Tor does not do by default).

Good security practice requires that all heap-overflow bugs should be
presumed to be exploitable until proven otherwise, so we are treating
this as a potential code execution attack. Please upgrade immediately!
This bug does not affect bufferevents-based builds of Tor. Special
thanks to "Vektor" for reporting this issue to us!

Tor 0.2.2.35 also fixes several bugs in previous versions, including
crash bugs for unusual configurations, and a long-term bug that
would prevent Tor from starting on Windows machines with draconian
AV software.

With this release, we remind everyone that 0.2.0.x has reached its
formal end-of-life. Those Tor versions have many known flaws, and
nobody should be using them. You should upgrade -- ideally to the
0.2.2.x series. If you're using a Linux or BSD and its packages are
obsolete, stop using those packages and upgrade anyway.

The Tor 0.2.1.x series is also approaching its end-of-life: it will no
longer receive support after some time in early 2012.

https://www.torproject.org/download

Changes in version 0.2.2.35 - 2011-12-16

Major bugfixes:
Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".
Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so
that it doesn't attempt to allocate a socketpair. This could cause
some problems on Windows systems with overzealous firewalls. Fix for
bug 4457; workaround for Libevent versions 2.0.1-alpha through
2.0.15-stable.
If we mark an OR connection for close based on a cell we process,
don't process any further cells on it. We already avoid further
reads on marked-for-close connections, but now we also discard the
cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha,
which was the first version where we might mark a connection for
close based on processing a cell on it.
Correctly sanity-check that we don't underflow on a memory
allocation (and then assert) for hidden service introduction
point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
bugfix on 0.2.1.5-alpha.
Fix a memory leak when we check whether a hidden service
descriptor has any usable introduction points left. Fixes bug
4424. Bugfix on 0.2.2.25-alpha.
Don't crash when we're running as a relay and don't have a GeoIP
file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix
we've had in the 0.2.3.x branch already.
When running as a client, do not print a misleading (and plain
wrong) log message that we're collecting "directory request"
statistics: clients don't collect statistics. Also don't create a
useless (because empty) stats file in the stats/ directory. Fixes
bug 4353; bugfix on 0.2.2.34.

Minor bugfixes:
Detect failure to initialize Libevent. This fix provides better
detection for future instances of bug 4457.
Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers
function. This was eating up hideously large amounts of time on some
busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
Resolve an integer overflow bug in smartlist_ensure_capacity().
Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by
Mansour Moufid.
Don't warn about unused log_mutex in log.c when building with
--disable-threads using a recent GCC. Fixes bug 4437; bugfix on
0.1.0.6-rc which introduced --disable-threads.
When configuring, starting, or stopping an NT service, stop
immediately after the service configuration attempt has succeeded
or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
When sending a NETINFO cell, include the original address
received for the other side, not its canonical address. Found
by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
Fix a typo in a hibernation-related log message. Fixes bug 4331;
bugfix on 0.2.2.23-alpha; found by "tmpname0901".
Fix a memory leak in launch_direct_bridge_descriptor_fetch() that
occurred when a client tried to fetch a descriptor for a bridge
in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
Backport fixes for a pair of compilation warnings on Windows.
Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta.
If we had ever tried to call tor_addr_to_str on an address of
unknown type, we would have done a strdup on an uninitialized
buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha.
Reported by "troll_un".
Correctly detect and handle transient lookup failures from
tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha.
Reported by "troll_un".
Fix null-pointer access that could occur if TLS allocation failed.
Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
Use tor_socket_t type for listener argument to accept(). Fixes bug
4535; bugfix on 0.2.2.28-beta. Found by "troll_un".

Minor features:
Add two new config options for directory authorities:
AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the
Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold
that is always sufficient to satisfy the bandwidth requirement for
the Guard flag. Now it will be easier for researchers to simulate
Tor networks with different values. Resolves ticket 4484.
When Tor ignores a hidden service specified in its configuration,
include the hidden service's directory in the warning message.
Previously, we would only tell the user that some hidden service
was ignored. Bugfix on 0.0.6; fixes bug 4426.
Update to the December 6 2011 Maxmind GeoLite Country database.

Packaging changes:
Make it easier to automate expert package builds on Windows,
by removing an absolute path from makensis.exe command.

Tor 0.2.3.10-alpha fixes a critical heap-overflow security issue in
Tor's buffers code. Absolutely everybody should upgrade.

The bug relied on an incorrect calculation when making data continuous
in one of our IO buffers, if the first chunk of the buffer was
misaligned by just the wrong amount. The miscalculation would allow an
attacker to overflow a piece of heap-allocated memory. To mount this
attack, the attacker would need to either open a SOCKS connection to
Tor's SocksPort (usually restricted to localhost), or target a Tor
instance configured to make its connections through a SOCKS proxy
(which Tor does not do by default).

Good security practice requires that all heap-overflow bugs should be
presumed to be exploitable until proven otherwise, so we are treating
this as a potential code execution attack. Please upgrade immediately!
This bug does not affect bufferevents-based builds of Tor. Special
thanks to "Vektor" for reporting this issue to us!

This release also contains a few minor bugfixes for issues discovered
in 0.2.3.9-alpha.

https://www.torproject.org/download

Changes in version 0.2.3.10-alpha - 2011-12-16

Major bugfixes
Fix a heap overflow bug that could occur when trying to pull
data into the first chunk of a buffer, when that chunk had
already had some data drained from it. Fixes CVE-2011-2778;
bugfix on 0.2.0.16-alpha. Reported by "Vektor".

Minor bugfixes
If we can't attach streams to a rendezvous circuit when we
finish connecting to a hidden service, clear the rendezvous
circuit's stream-isolation state and try to attach streams
again. Previously, we cleared rendezvous circuits' isolation
state either too early (if they were freshly built) or not at all
(if they had been built earlier and were cannibalized). Bugfix on
0.2.3.3-alpha; fixes bug 4655.
Fix compilation of the libnatpmp helper on non-Windows. Bugfix on
0.2.3.9-alpha; fixes bug 4691. Reported by Anthony G. Basile.
Fix an assertion failure when a relay with accounting enabled
starts up while dormant. Fixes bug 4702; bugfix on 0.2.3.9-alpha.

Minor features
Update to the December 6 2011 Maxmind GeoLite Country database.

The Tor Browser Bundles have been updated to Tor 0.2.2.35 which has a fix for a security critical bug. Please see the release announcement for further details. All users should update immediately.

This Tor Browser Bundle release also contains new Firefox patches which improve privacy and unlinkability.

https://www.torproject.org/download

Tor Browser Bundle (2.2.35-1)
Update Tor to 0.2.2.35
Update NoScript to 2.2.3
Update Torbutton to 1.4.5
New Firefox patches
Disable SSL Session ID tracking
Provide an observer event to close persistent connections

Tor Browser Bundle (2.2.35-2); suite=windows

* Update Firefox to 9.0
* Update Torbutton to 1.4.5.1
* Update Noscript to 2.2.4
* New Firefox patches
- Provide client values only to CSS Media Queries and disable several
Mozilla extensions that seem fingerprintable

Tor Browser Bundle (2.2.35-5)
Update Firefox to 10.0
Update Qt to 4.7.4
Update OpenSSL to 1.0.0g
Update zlib to 1.2.6
Update HTTPS Everywhere to 1.2.2
Update NoScript to 2.2.8
New Firefox patches
Limit the number of fonts per document

Linux changes
Put documentation in remove-shared-lib-symlinks debug dumps (closes: #4984)

Windows changes
Make sure mozconfig always gets copied into the Firefox build directory
(closes: #4879)

Tor Browser Bundle (2.2.35-6); suite=windows

* Update Firefox to 10.0.1
* Update Vidalia to 0.2.17
* Update Libevent to 2.0.17-stable
* Update NoScript to 2.3

Changes in version 0.2.3.12-alpha - 2012-02-13
Tor 0.2.3.12-alpha lets fast exit relays scale better, allows clients
to use bridges that run Tor 0.2.2.x, and resolves several big bugs
when Tor is configured to use a pluggable transport like obfsproxy.

o Major bugfixes:
- Fix builds when the path to sed, openssl, or sha1sum contains
spaces, which is pretty common on Windows. Fixes bug 5065; bugfix
on 0.2.2.1-alpha.
- Set the SO_REUSEADDR socket option before we call bind() on outgoing
connections. This change should allow busy exit relays to stop
running out of available sockets as quickly. Fixes bug 4950;
bugfix on 0.2.2.26-beta.
- Allow 0.2.3.x clients to use 0.2.2.x bridges. Previously the client
would ask the bridge for microdescriptors, which are only supported
in 0.2.3.x, and then fail to bootstrap when it didn't get the
answers it wanted. Fixes bug 4013; bugfix on 0.2.3.2-alpha.
- Avoid an assert when managed proxies like obfsproxy are configured,
and we receive HUP signals or configuration values too rapidly. This
situation happens most commonly when Vidalia tries to attach to
Tor or tries to configure the Tor it's attached to. Fixes bug 5084;
bugfix on 0.2.3.6-alpha.
- Properly set up obfsproxy's environment when in managed mode. The
Tor Browser Bundle needs LD_LIBRARY_PATH to be passed to obfsproxy,
and when you run your Tor as a daemon, there's no HOME. Fixes bugs
5076 and 5082; bugfix on 0.2.3.6-alpha.

o Minor features:
- Use the dead_strip option when building Tor on OS X. This reduces
binary size by almost 19% when linking openssl and libevent
statically, which we do for Tor Browser Bundle.
- Fix broken URLs in the sample torrc file, and tell readers about
the OutboundBindAddress, ExitPolicyRejectPrivate, and
PublishServerDescriptor options. Addresses bug 4652.
- Update to the February 7 2012 Maxmind GeoLite Country database.

o Minor bugfixes:
- Downgrade the "We're missing a certificate" message from notice
to info: people kept mistaking it for a real problem, whereas it
is seldom the problem even when we are failing to bootstrap. Fixes
bug 5067; bugfix on 0.2.0.10-alpha.
- Don't put "TOR_PT_EXTENDED_SERVER_PORT=127.0.0.1:4200" in a
managed pluggable transport server proxy's environment.
Previously, we would put it there, even though Tor doesn't
implement an 'extended server port' yet, and even though Tor
almost certainly isn't listening at that address. For now, we set
it to an empty string to avoid crashing older obfsproxies. Bugfix
on 0.2.3.6-alpha.
- Log the heartbeat message every HeartbeatPeriod seconds, not every
HeartbeatPeriod + 1 seconds. Fixes bug 4942; bugfix on
0.2.3.1-alpha. Bug reported by Scott Bennett.
- Calculate absolute paths correctly on Windows. Fixes bug 4973;
bugfix on 0.2.3.11-alpha.
- Update "ClientOnly" man page entry to explain that there isn't
really any point to messing with it. Resolves ticket 5005.
- Use the correct CVE number for CVE-2011-4576 in our comments and
log messages. Found by "fermenthor". Resolves bug 5066; bugfix on
0.2.3.11-alpha.

o Code simplifications and refactoring:
- Use the _WIN32 macro throughout our code to detect Windows.
(Previously we had used the obsolete 'WIN32' and the idiosyncratic
'MS_WINDOWS'.)

the only difference between 0.2.16 and 0.2.17 is what translations are in. Since we changed our translations workflow, we needed to update the availability policy. Basically, every new translation that has more than 90% done gets enabled. If any of the enabled translations drop bellow the 75% done, we take them out.

Remember that if you find any bugs, you can report them at https://trac.torproject.org/.

Here's what changed since 0.2.15:

0.2.17 11-Feb-2012
Improve the translation policy: do not remove translations that
are not under 75% done. This re enables Polish and Catalan.

0.2.16 11-Feb-2012
Make the default data directory in windows be located in the Local
AppData instead of the Roaming one. Fixes bug 2319.
Do not launch Firefox with every CIRCUIT_ESTABLISHED signal, do it
only if Firefox isn't open yet. Fixes bug 2943.
Uses TAKEOWNERSHIP and __OwningControllerProcess to avoid leaving
tor running in background if Vidalia exits unexpectedly. Fixes bug
3463.
Attempt to remove port.conf file before using it to avoid a race
condition between tor and Vidalia. Fixes bug 4048.
Do not allow users to check the "My ISP blocks..." checkbox
without entering any bridges. Also updates the
documentation. Fixes bug 4290.
Check that the authentication-cookie file length is exactly 32
bytes long. Fixes bug 4304.
Explicitly disable ControlPort auto. Fixes bug 4379.
Make the non exit relay option backward compatible with Vidalia <
0.2.14 so that it doesn't confuse users. Fixes bug 4642.
Sets the preferred size for the GUI layout so it doesn't squeeze
widges when the size isn't big enough. Fixes bug 4656.
Removes the option to have only HTTPProxy since it does not work
any more as it used to do with older tor versions. Users should
use HTTP/HTTPSProxy instead. Fixes bug 4724.
Add a hidden configuration option called SkipVersionCheck so
systems like Tails can force Vidalia to skip checking tor's
version. Resolves ticket 4736.
When Tor has cached enough information it bootstraps faster than
what takes Vidalia connect to it, so Vidalia does not see the
event to update the progress bar. Now Vidalia explicitly asks for
bootstrap-phase when it connects to Tor, and updates the progress
to what is actually happening instead of hanging in
"Authenticating to Tor". Fixes bug 4827.
Fix size hints in the main window layout so that tilling window
managers display the window properly. Thanks to Mike Warren for
the fix. Fixes bug 4907.
Vidalia only validates IPv4 bridge lines. IPv6 bridges are now
available, and there will be pluggable transport bridge lines. So
the validation is now delegated to Tor through SETCONF.
Explicitly disable SocksPort auto by setting it to its default
(9050). Fixes bug 4598.
Sets __ReloadTorrcOnSIGHUP to 0 if SAVECONF failed, which means
the user can't write the torrc file. Fixes bug 4833.
Enable new translations that are >90% done. The new languages are:
Bulgarian, Czech, Hebrew, Greek, Indonesian, Korean,
Dutch. Resolves ticket 5051.
Remove translations that aren't ready enough: Japanese, Thai,
Albanian, Vietnamese, Chinese (Taiwan), Polish, Catalan and
Burmese.

There are new alpha Tor Browser Bundles and Vidalia Bundles available for testing!

These bundles include the latest Vidalia 0.3.1 alpha release and Tor 0.2.3.12-alpha. Right now they are technology previews.

Included applications
---------------------

Vidalia 0.3.1-alpha (with Qt 4.7.4)
Tor 0.2.3.12-alpha (with libevent-2.0.17-stable, zlib-1.2.6 and openssl-1.0.1-beta1)
Firefox 10.0.1
\_ Torbutton 1.4.5.1
|_ NoScript 2.3
|_ HTTPS-Everywhere 2.0development.4

Tor Browser Bundle (2.2.35-8); suite=windows

* Update Firefox to 11.0
* Update OpenSSL to 1.0.0h
* Update NoScript to 2.3.4
* Update HTTPS Everywhere to 2.0.1
* Always build to with warnings enabled (closes; #4470)
* Disable HTTPS Everywhere SSL Observatory screen (closes: #5300)
* Remove tor-resolve from the Windows bundle (closes: #5403)

Tor Browser Bundle (2.3.12-alpha-2); suite=windows

* Update Firefox to 11.0
* Update NoScript to 2.3.4
* Update HTTPS Everywhere to 3.0development.1
* Disable HTTPS Everywhere SSL Observatory screen (closes: #5300)
* Always build to with warnings enabled (closes: #4470)
* Remove tor-resolve from the Windows bundle (closes: #5403)

-- Erinn Clark <erinn@torproject.org> Mon Mar 19 01:14:43 BRT 2012

Tor Browser Bundle (2.2.35-9); suite=windows

* Update Firefox to 12.0
* Update OpenSSL to 1.0.1b
* Update Libevent to 2.0.18-stable
* Update Qt to 4.8.1
* Update Libpng to 1.5.10
* Update HTTPS Everywhere to 2.0.2
* Update NoScript to 2.3.9
* Rebrand Firefox to TorBrowser (closes: #2176)
* New Firefox patches
- Make Download Manager memory-only (closes: #4017)
- Add DuckDuckGo and Startpage to Omnibox (closes: #4902)

-- Erinn Clark <erinn@torproject.org> Fri Apr 27 12:43:33 BRT 2012

Changes in version 0.2.3.15-alpha - 2012-04-30
Tor 0.2.3.15-alpha fixes a variety of smaller bugs, including making
the development branch build on Windows again.

o Minor bugfixes (on 0.2.2.x and earlier):
- Make sure that there are no unhandled pending TLS errors before
reading from a TLS stream. We had checks in 0.1.0.3-rc, but
lost them in 0.1.0.5-rc when we refactored read_to_buf_tls().
Bugfix on 0.1.0.5-rc; fixes bug 4528.
- Fix an assert that directory authorities could trigger on sighup
during some configuration state transitions. We now don't treat
it as a fatal error when the new descriptor we just generated in
init_keys() isn't accepted. Fixes bug 4438; bugfix on 0.2.1.9-alpha.
- After we pick a directory mirror, we would refuse to use it if
it's in our ExcludeExitNodes list, resulting in mysterious failures
to bootstrap for people who just wanted to avoid exiting from
certain locations. Fixes bug 5623; bugfix on 0.2.2.25-alpha.
- When building with --enable-static-tor on OpenBSD, do not
erroneously attempt to link -lrt. Fixes bug 5103.

o Minor bugfixes (on 0.2.3.x):
- When Tor is built with kernel headers from a recent (last few
years) Linux kernel, do not fail to run on older (pre-2.6.28
Linux kernels). Fixes bug 5112; bugfix on 0.2.3.1-alpha.
- Fix cross-compilation isssues with mingw. Bugfixes on 0.2.3.6-alpha
and 0.2.3.12-alpha.
- Fix compilation with miniupnpc version 1.6; patch from
Anthony G. Basile. Fixes bug 5434; bugfix on 0.2.3.12-alpha.
- Fix compilation with MSVC, which had defined MS_WINDOWS. Bugfix
on 0.2.3.13-alpha; found and fixed by Gisle Vanem.
- Fix compilation on platforms without unistd.h, or where environ
is defined in stdlib.h. Fixes bug 5704; bugfix on 0.2.3.13-alpha.

o Minor features:
- Directory authorities are now a little more lenient at accepting
older router descriptors, or newer router descriptors that don't
make big changes. This should help ameliorate past and future
issues where routers think they have uploaded valid descriptors,
but the authorities don't think so. Fix for ticket 2479.
- Make the code that clients use to detect an address change be
IPv6-aware, so that it won't fill clients' logs with error
messages when trying to get the IPv4 address of an IPv6
connection. Implements ticket 5537.

o Removed features:
- Remove the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays option;
authorities needed to use it for a while to keep the network working
as people upgraded to 0.2.1.31, 0.2.2.34, or 0.2.3.6-alpha, but
that was six months ago. As of now, it should no longer be needed
or used.