aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Bump maint-0.2.4 version to 0.2.4.22-devNick Mathewson2014-05-16
| | | | (See discussion on #9553)
* Merge commit 'bb9b4c37f8e7f5cf78918f382e90d8b11ff42551' into maint-0.2.4Nick Mathewson2014-05-07
|\
| * Supply better and less frequent warnings on circID exhaustionNick Mathewson2014-04-18
| | | | | | | | Fixes the surface behavior of #11553
* | Merge remote-tracking branch 'public/ticket11528_024' into maint-0.2.4Nick Mathewson2014-05-07
|\ \
| * | Elevate server TLS cipher preferences over clientNick Mathewson2014-04-17
| |/ | | | | | | | | | | | | The server cipher list is (thanks to #11513) chosen systematically to put the best choices for Tor first. The client cipher list is chosen to resemble a browser. So let's set SSL_OP_CIPHER_SERVER_PREFERENCE to have the servers pick according to their own preference order.
* | Merge remote-tracking branch 'public/bug11513_024' into maint-0.2.4Nick Mathewson2014-05-07
|\ \
| * | New sort order for server choice of ciphersuites.Nick Mathewson2014-04-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Back in 175b2678, we allowed servers to recognize clients who are telling them the truth about their ciphersuites, and select the best cipher from on that list. This implemented the server side of proposal 198. In bugs 11492, 11498, and 11499, cypherpunks found a bunch of mistakes and omissions and typos in the UNRESTRICTED_SERVER_CIPHER_LIST we had. In #11513, I found a couple more. Rather than try to hand-edit this list, I wrote a short python script to generate our ciphersuite preferences from the openssl headers. The new rules are: * Require forward secrecy. * Require RSA (since our servers only configure RSA keys) * Require AES or 3DES. (This means, reject RC4, DES, SEED, CAMELLIA, and NULL.) * No export ciphersuites. Then: * Prefer AES to 3DES. * If both suites have the same cipher, prefer ECDHE to DHE. * If both suites have the same DHE group type, prefer GCM to CBC. * If both suites have the same cipher mode, prefer SHA384 to SHA256 to SHA1. * If both suites have the same digest, prefer AES256 to AES128.
* | | Merge remote-tracking branch 'public/update_ciphers_ff28' into maint-0.2.4Nick Mathewson2014-05-07
|\ \ \
| * | | Update ciphers.inc to match ff28Nick Mathewson2014-04-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The major changes are to re-order some ciphers, to drop the ECDH suites (note: *not* ECDHE: ECDHE is still there), to kill off some made-up stuff (like the SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA suite), to drop some of the DSS suites... *and* to enable the ECDHE+GCM ciphersuites. This change is autogenerated by get_mozilla_ciphers.py from Firefox 28 and OpenSSL 1.0.1g. Resolves ticket 11438.
| * | | Teach the get_mozilla_ciphers.py script to parse recent firefoxenNick Mathewson2014-04-08
| | | |
* | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-05-01
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | Conflicts: src/or/microdesc.c
| * | | | Downgrade bug 7164 warning to INFONick Mathewson2014-05-01
| | | | | | | | | | | | | | | | | | | | | | | | | The 0.2.5.x warning is the one that might help us track this down; the warnings in stable are just annoying users over and over and over.
* | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-30
|\| | | |
| * | | | Merge remote-tracking branch 'public/bug10849_023_bruteforce' into maint-0.2.3Nick Mathewson2014-04-30
| |\ \ \ \
| | * | | | Forbid TunneledDirConns 0 and PreferTunneledDirConns 0 if being a HSNick Mathewson2014-04-25
| | | | | | | | | | | | | | | | | | | | | | | | Fixes bug 10849; bugfix on 0.2.1.1-alpha (I believe)
* | | | | | Drop the MaxMemInCellQueues lower limit down to 256 MB.Nick Mathewson2014-04-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on #9686, gmorehose reports that the 500 MB lower limit is too high for raspberry pi users. This is a backport of 647248729fa65f0e51d062e2af8f4e8b38592bf5 to 0.2.4. Note that in 0.2.4, the option is called MaxMemInCellQueues.
* | | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-29
|\| | | | |
| * | | | | Stop leaking memory in error cases of md parsingNick Mathewson2014-04-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When clearing a list of tokens, it's important to do token_clear() on them first, or else any keys they contain will leak. This didn't leak memory on any of the successful microdescriptor parsing paths, but it does leak on some failing paths when the failure happens during tokenization. Fixes bug 11618; bugfix on 0.2.2.6-alpha.
* | | | | | Merge remote-tracking branch 'public/bug9229_024' into maint-0.2.4Nick Mathewson2014-04-23
|\ \ \ \ \ \
| * | | | | | Update ns downloads when we receive a bridge descriptorNick Mathewson2014-03-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents long stalls when we're starting with a state file but with no bridge descriptors. Fixes bug 9229. I believe this bug has been present since 0.2.0.3-alpha.
* | | | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-16
|\ \ \ \ \ \ \ | | |/ / / / / | |/| | | | |
| * | | | | | remove note about dannenberg; it has upgraded.Nick Mathewson2014-04-16
| | | | | | |
* | | | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-16
|\| | | | | | | |_|_|_|_|/ |/| | | | |
| * | | | | Update the authority signing key blacklistNick Mathewson2014-04-16
| | |/ / / | |/| | | | | | | | | | | | | Now it only has dannenberg
* | | | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-15
|\| | | | | | | | | | | | | | | | | | | | | | | | Conflicts: src/or/circuituse.c
| * | | | Merge remote-tracking branch 'public/bug11519_023' into maint-0.2.3Nick Mathewson2014-04-15
| |\ \ \ \
| | * | | | Don't send uninitialized stack to the controller and say it's a date.Nick Mathewson2014-04-14
| |/ / / / | | | | | | | | | | | | | | | Fixes bug 11519, apparently bugfix on 0.2.3.11-alpha.
* | | | / Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-04-14
|\| | | | | |_|_|/ |/| | | | | | | | | | | Conflicts: src/or/routerlist.h
| * | | Merge branch 'bug11464_023_squashed' into maint-0.2.3Nick Mathewson2014-04-14
| |\ \ \
| | * | | Tweak changes file and comment dates.Nick Mathewson2014-04-14
| | | | |
| | * | | Fill in the list of blacklisted signing keys.Nick Mathewson2014-04-14
| | | | | | | | | | | | | | | | | | | | | | | | | I used a list of certificate files from arma, and a little script, both at 11464.
| | * | | Code to blacklist authority signing keysNick Mathewson2014-04-14
| |/ / / | | | | | | | | | | | | (I need a list of actual signing keys to blacklist.)
* | | | Merge remote-tracking branch 'public/bug11437_024' into maint-0.2.4Nick Mathewson2014-04-08
|\ \ \ \ | |_|_|/ |/| | |
| * | | Fix a small memory leak when resolving PTR addressesNick Mathewson2014-04-07
|/ / / | | | | | | | | | | | | | | | Fixes bug 11437; bugfix on 0.2.4.7-alpha. Found by coverity; this is CID 1198198.
* | | Merge branch 'bug9213_doc_024' into maint-0.2.4Nick Mathewson2014-04-01
|\ \ \
| * | | Fix documentation of torrc search orderNick Mathewson2014-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We are searching @CONFDIR@ before $HOME, but the documentation implied otherwise. I screwed this up in f5e86bcd6c06d43ff3af5acd8135bd8b577bc3, when I first documented the $HOME/.torrc possibility. Fix for bug 9213; bugfix on 0.2.3.18-rc.
* | | | whitespace fixNick Mathewson2014-03-27
|/ / /
* | | Fix unittest compilation with --disable-curve25519Nick Mathewson2014-03-20
| | | | | | | | | | | | | | | | | | | | | This is a fix for 9700, which we already fixed in 0.2.5.x, but which got left in 0.2.4.x. This is a partial backport of a0a855d586d99540277014ccd3
* | | Remove the unused router_hex_digest_matchesNick Mathewson2014-03-11
| |/ |/| | | | | | | When I removed some unused functions in 5bfa373eeeb, this became unused as well.
* | Correct the URL in the "a relay on win95???" messageNick Mathewson2014-03-06
| | | | | | | | | | | | This is a fix for 9393; it's not a bugfix on any Tor version per se, but rather on whatever Tor version was current when we reorganized the wiki.
* | Merge remote-tracking branch 'public/no_itime_queue' into maint-0.2.4Nick Mathewson2014-02-25
|\ \
| * | Excise the insertion_time_elem_t logicNick Mathewson2014-02-10
| | | | | | | | | | | | | | | | | | It's now redundant with the inserted_time field in packed_cell_t Fixes bug 10870.
* | | Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4Nick Mathewson2014-02-25
|\ \ \ | | |/ | |/|
| * | Fix geoip by falling back to registered countries.Karsten Loesing2014-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See 1d2179bc900f1646a5491b65294e78b175e70056 in master for details. """ Fall back to registered country if necessary. When extracting geoip and geoip6 files from MaxMind's GeoLite2 Country database, we only look at country->iso_code which is the two-character ISO 3166-1 country code of the country where MaxMind believes the end user is located. But if MaxMind thinks a range belongs to anonymous proxies, they don't put anything there. Hence, we omit those ranges and resolve them all to '??'. That's not what we want. What we should do is first try country->iso_code, and if there's no such key, try registered_country->iso_code which is the country in which the ISP has registered the IP address. In short: let's fill all A1 entries with what ARIN et. al think. """
* | | Merge remote-tracking branch 'public/feature9777_024_squashed' into maint-0.2.4Nick Mathewson2014-02-24
|\ \ \
| * | | Discard circuit paths on which nobody supports ntorNick Mathewson2014-02-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Right now this accounts for about 1% of circuits over all, but if you pick a guard that's running 0.2.3, it will be about 6% of the circuits running through that guard. Making sure that every circuit has at least one ntor link means that we're getting plausibly good forward secrecy on every circuit. This implements ticket 9777,
* | | | whoops; mistaek in a496010642c2. so many commaNick Mathewson2014-02-18
| | | |
* | | | add changes file for bug 10929Nick Mathewson2014-02-17
| | | |
* | | | Enveigle configure to look for a2x.py as well as a2x.dana koch2014-02-17
| | | | | | | | | | | | | | | | | | | | It's not guaranteed that every package symlinks a2x to a2x.py; OpenBSD does not do this, so let's just look for a2x.py as well.
* | | | Merge remote-tracking branch 'karsten/geoip6-feb2014' into maint-0.2.4Nick Mathewson2014-02-15
|\ \ \ \
generated by cgit v1.2.3 (git 2.25.4) at 2024-09-28 18:52:19 +0000