diff -pruN 0.3.3.9-1/aclocal.m4 0.3.4.8-1/aclocal.m4 --- 0.3.3.9-1/aclocal.m4 2018-07-13 18:25:31.000000000 +0000 +++ 0.3.4.8-1/aclocal.m4 2018-09-07 20:21:13.000000000 +0000 @@ -1,6 +1,6 @@ -# generated automatically by aclocal 1.14.1 -*- Autoconf -*- +# generated automatically by aclocal 1.15.1 -*- Autoconf -*- -# Copyright (C) 1996-2013 Free Software Foundation, Inc. +# Copyright (C) 1996-2017 Free Software Foundation, Inc. # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -20,7 +20,7 @@ You have another version of autoconf. I If you have problems, you may need to regenerate the build system entirely. To do so, use the procedure documented by the package, typically 'autoreconf'.])]) -# Copyright (C) 2002-2013 Free Software Foundation, Inc. +# Copyright (C) 2002-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -32,10 +32,10 @@ To do so, use the procedure documented b # generated from the m4 files accompanying Automake X.Y. # (This private macro should not be called outside this file.) AC_DEFUN([AM_AUTOMAKE_VERSION], -[am__api_version='1.14' +[am__api_version='1.15' dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to dnl require some minimum version. Point them to the right macro. -m4_if([$1], [1.14.1], [], +m4_if([$1], [1.15.1], [], [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl ]) @@ -51,12 +51,12 @@ m4_define([_AM_AUTOCONF_VERSION], []) # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced. # This function is AC_REQUIREd by AM_INIT_AUTOMAKE. AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION], -[AM_AUTOMAKE_VERSION([1.14.1])dnl +[AM_AUTOMAKE_VERSION([1.15.1])dnl m4_ifndef([AC_AUTOCONF_VERSION], [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))]) -# Copyright (C) 2011-2013 Free Software Foundation, Inc. +# Copyright (C) 2011-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -118,7 +118,7 @@ AC_SUBST([AR])dnl # AM_AUX_DIR_EXPAND -*- Autoconf -*- -# Copyright (C) 2001-2013 Free Software Foundation, Inc. +# Copyright (C) 2001-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -170,7 +170,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd` # AM_CONDITIONAL -*- Autoconf -*- -# Copyright (C) 1997-2013 Free Software Foundation, Inc. +# Copyright (C) 1997-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -201,7 +201,7 @@ AC_CONFIG_COMMANDS_PRE( Usually this means the macro was only invoked conditionally.]]) fi])]) -# Copyright (C) 1999-2013 Free Software Foundation, Inc. +# Copyright (C) 1999-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -392,7 +392,7 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl # Generate code to set up dependency tracking. -*- Autoconf -*- -# Copyright (C) 1999-2013 Free Software Foundation, Inc. +# Copyright (C) 1999-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -468,7 +468,7 @@ AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS] # Do all the work for Automake. -*- Autoconf -*- -# Copyright (C) 1996-2013 Free Software Foundation, Inc. +# Copyright (C) 1996-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -558,8 +558,8 @@ AC_REQUIRE([AC_PROG_MKDIR_P])dnl # # AC_SUBST([mkdir_p], ['$(MKDIR_P)']) -# We need awk for the "check" target. The system "awk" is bad on -# some platforms. +# We need awk for the "check" target (and possibly the TAP driver). The +# system "awk" is bad on some platforms. AC_REQUIRE([AC_PROG_AWK])dnl AC_REQUIRE([AC_PROG_MAKE_SET])dnl AC_REQUIRE([AM_SET_LEADING_DOT])dnl @@ -633,6 +633,9 @@ END AC_MSG_ERROR([Your 'rm' program is bad, sorry.]) fi fi +dnl The trailing newline in this macro's definition is deliberate, for +dnl backward compatibility and to allow trailing 'dnl'-style comments +dnl after the AM_INIT_AUTOMAKE invocation. See automake bug#16841. ]) dnl Hook into '_AC_COMPILER_EXEEXT' early to learn its expansion. Do not @@ -662,7 +665,7 @@ for _am_header in $config_headers :; do done echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count]) -# Copyright (C) 2001-2013 Free Software Foundation, Inc. +# Copyright (C) 2001-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -673,7 +676,7 @@ echo "timestamp for $_am_arg" >`AS_DIRNA # Define $install_sh. AC_DEFUN([AM_PROG_INSTALL_SH], [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl -if test x"${install_sh}" != xset; then +if test x"${install_sh+set}" != xset; then case $am_aux_dir in *\ * | *\ *) install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;; @@ -683,7 +686,7 @@ if test x"${install_sh}" != xset; then fi AC_SUBST([install_sh])]) -# Copyright (C) 2003-2013 Free Software Foundation, Inc. +# Copyright (C) 2003-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -704,7 +707,7 @@ AC_SUBST([am__leading_dot])]) # Check to see how 'make' treats includes. -*- Autoconf -*- -# Copyright (C) 2001-2013 Free Software Foundation, Inc. +# Copyright (C) 2001-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -754,7 +757,7 @@ rm -f confinc confmf # Fake the existence of programs that GNU maintainers use. -*- Autoconf -*- -# Copyright (C) 1997-2013 Free Software Foundation, Inc. +# Copyright (C) 1997-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -793,7 +796,7 @@ fi # Helper functions for option handling. -*- Autoconf -*- -# Copyright (C) 2001-2013 Free Software Foundation, Inc. +# Copyright (C) 2001-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -822,7 +825,7 @@ AC_DEFUN([_AM_SET_OPTIONS], AC_DEFUN([_AM_IF_OPTION], [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])]) -# Copyright (C) 1999-2013 Free Software Foundation, Inc. +# Copyright (C) 1999-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -869,7 +872,7 @@ AC_LANG_POP([C])]) # For backward compatibility. AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])]) -# Copyright (C) 2001-2013 Free Software Foundation, Inc. +# Copyright (C) 2001-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -888,7 +891,7 @@ AC_DEFUN([AM_RUN_LOG], # Check to make sure that the build environment is sane. -*- Autoconf -*- -# Copyright (C) 1996-2013 Free Software Foundation, Inc. +# Copyright (C) 1996-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -969,7 +972,7 @@ AC_CONFIG_COMMANDS_PRE( rm -f conftest.file ]) -# Copyright (C) 2009-2013 Free Software Foundation, Inc. +# Copyright (C) 2009-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -1029,7 +1032,7 @@ AC_SUBST([AM_BACKSLASH])dnl _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl ]) -# Copyright (C) 2001-2013 Free Software Foundation, Inc. +# Copyright (C) 2001-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -1057,7 +1060,7 @@ fi INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s" AC_SUBST([INSTALL_STRIP_PROGRAM])]) -# Copyright (C) 2006-2013 Free Software Foundation, Inc. +# Copyright (C) 2006-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, @@ -1076,7 +1079,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_ # Check how to create a tarball. -*- Autoconf -*- -# Copyright (C) 2004-2013 Free Software Foundation, Inc. +# Copyright (C) 2004-2017 Free Software Foundation, Inc. # # This file is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, diff -pruN 0.3.3.9-1/ar-lib 0.3.4.8-1/ar-lib --- 0.3.3.9-1/ar-lib 2018-07-12 17:16:59.000000000 +0000 +++ 0.3.4.8-1/ar-lib 2018-06-25 18:12:07.000000000 +0000 @@ -1,10 +1,10 @@ -#! /bin/sh +#!/bin/sh # Wrapper for Microsoft lib.exe me=ar-lib scriptversion=2012-03-01.08; # UTC -# Copyright (C) 2010-2013 Free Software Foundation, Inc. +# Copyright (C) 2010-2017 Free Software Foundation, Inc. # Written by Peter Rosin . # # This program is free software; you can redistribute it and/or modify diff -pruN 0.3.3.9-1/ChangeLog 0.3.4.8-1/ChangeLog --- 0.3.3.9-1/ChangeLog 2018-07-13 18:25:23.000000000 +0000 +++ 0.3.4.8-1/ChangeLog 2018-09-10 12:47:03.000000000 +0000 @@ -1,3 +1,286 @@ +Changes in version 0.3.4.8 - 2018-09-10 + Tor 0.3.4.8 is the first stable release in its series; it includes + compilation and portability fixes. + + The Tor 0.3.4 series includes improvements for running Tor in + low-power and embedded environments, which should help performance in + general. We've begun work on better modularity, and included preliminary + changes on the directory authority side to accommodate a new bandwidth + measurement system. We've also integrated more continuous-integration + systems into our development process, and made corresponding changes to + Tor's testing infrastructure. Finally, we've continued to refine + our anti-denial-of-service code. + + Below are the changes since 0.3.4.7-rc. For a complete list of changes + since 0.3.3.9, see the ReleaseNotes file. + + o Minor features (compatibility): + - Tell OpenSSL to maintain backward compatibility with previous + RSA1024/DH1024 users in Tor. With OpenSSL 1.1.1-pre6, these + ciphers are disabled by default. Closes ticket 27344. + + o Minor features (continuous integration): + - Log the compiler path and version during Appveyor builds. + Implements ticket 27449. + - Show config.log and test-suite.log after failed Appveyor builds. + Also upload the zipped full logs as a build artifact. Implements + ticket 27430. + + o Minor bugfixes (compilation): + - Silence a spurious compiler warning on the GetAdaptersAddresses + function pointer cast. This issue is already fixed by 26481 in + 0.3.5 and later, by removing the lookup and cast. Fixes bug 27465; + bugfix on 0.2.3.11-alpha. + - Stop calling SetProcessDEPPolicy() on 64-bit Windows. It is not + supported, and always fails. Some compilers warn about the + function pointer cast on 64-bit Windows. Fixes bug 27461; bugfix + on 0.2.2.23-alpha. + + o Minor bugfixes (continuous integration): + - Disable gcc hardening in Appveyor Windows 64-bit builds. As of + August 29 2018, Appveyor images come with gcc 8.2.0 by default. + Executables compiled for 64-bit Windows with this version of gcc + crash when Tor's --enable-gcc-hardening flag is set. Fixes bug + 27460; bugfix on 0.3.4.1-alpha. + - When a Travis build fails, and showing a log fails, keep trying to + show the other logs. Fixes bug 27453; bugfix on 0.3.4.7-rc. + - When we use echo in Travis, don't pass a --flag as the first + argument. Fixes bug 27418; bugfix on 0.3.4.7-rc. + + o Minor bugfixes (onion services): + - Silence a spurious compiler warning in + rend_client_send_introduction(). Fixes bug 27463; bugfix + on 0.1.1.2-alpha. + + o Minor bugfixes (testing, chutney): + - When running make test-network-all, use the mixed+hs-v2 network. + (A previous fix to chutney removed v3 onion services from the + mixed+hs-v23 network, so seeing "mixed+hs-v23" in tests is + confusing.) Fixes bug 27345; bugfix on 0.3.2.1-alpha. + - Before running make test-network-all, delete old logs and test + result files, to avoid spurious failures. Fixes bug 27295; bugfix + on 0.2.7.3-rc. + + +Changes in version 0.3.4.7-rc - 2018-08-24 + Tor 0.3.4.7-rc fixes several small compilation, portability, and + correctness issues in previous versions of Tor. This version is a + release candidate: if no serious bugs are found, we expect that the + stable 0.3.4 release will be (almost) the same as this release. + + o Minor features (bug workaround): + - Compile correctly on systems that provide the C11 stdatomic.h + header, but where C11 atomic functions don't actually compile. + Closes ticket 26779; workaround for Debian issue 903709. + + o Minor features (continuous integration): + - Backport Travis rust distcheck to 0.3.3. Closes ticket 24629. + - Enable macOS builds in our Travis CI configuration. Closes + ticket 24629. + - Install libcap-dev and libseccomp2-dev so these optional + dependencies get tested on Travis CI. Closes ticket 26560. + - Only post Appveyor IRC notifications when the build fails. + Implements ticket 27275. + - Run asciidoc during Travis CI. Implements ticket 27087. + - Use ccache in our Travis CI configuration. Closes ticket 26952. + + o Minor features (continuous integration, rust): + - Use cargo cache in our Travis CI configuration. Closes + ticket 26952. + + o Minor features (directory authorities): + - Authorities no longer vote to make the subprotocol version + "LinkAuth=1" a requirement: it is unsupportable with NSS, and + hasn't been needed since Tor 0.3.0.1-alpha. Closes ticket 27286. + + o Minor features (geoip): + - Update geoip and geoip6 to the August 7 2018 Maxmind GeoLite2 + Country database. Closes ticket 27089. + + o Minor bugfixes (compilation, windows): + - Don't link or search for pthreads when building for Windows, even + if we are using build environment (like mingw) that provides a + pthreads library. Fixes bug 27081; bugfix on 0.1.0.1-rc. + + o Minor bugfixes (continuous integration): + - Improve Appveyor CI IRC logging. Generate correct branches and + URLs for pull requests and tags. Use unambiguous short commits. + Fixes bug 26979; bugfix on master. + - Build with zstd on macOS. Fixes bug 27090; bugfix on 0.3.1.5-alpha. + - Pass the module flags to distcheck configure, and log the flags + before running configure. (Backported to 0.2.9 and later as a + precaution.) Fixes bug 27088; bugfix on 0.3.4.1-alpha. + + o Minor bugfixes (in-process restart): + - Always call tor_free_all() when leaving tor_run_main(). When we + did not, restarting tor in-process would cause an assertion + failure. Fixes bug 26948; bugfix on 0.3.3.1-alpha. + + o Minor bugfixes (linux seccomp2 sandbox): + - Fix a bug in our sandboxing rules for the openat() syscall. + Previously, no openat() call would be permitted, which would break + filesystem operations on recent glibc versions. Fixes bug 25440; + bugfix on 0.2.9.15. Diagnosis and patch from Daniel Pinto. + + o Minor bugfixes (onion services): + - Fix bug that causes services to not ever rotate their descriptors + if they were getting SIGHUPed often. Fixes bug 26932; bugfix + on 0.3.2.1-alpha. + + o Minor bugfixes (portability): + - Fix compilation of the unit tests on GNU/Hurd, which does not + define PATH_MAX. Fixes bug 26873; bugfix on 0.3.3.1-alpha. Patch + from "paulusASol". + + o Minor bugfixes (rust): + - Backport test_rust.sh from master. Fixes bug 26497; bugfix + on 0.3.1.5-alpha. + - Consistently use ../../.. as a fallback for $abs_top_srcdir in + test_rust.sh. Fixes bug 27093; bugfix on 0.3.4.3-alpha. + - Protover parsing was accepting the presence of whitespace in + version strings, which the C implementation would choke on, e.g. + "Desc=1\t,2". Fixes bug 27177; bugfix on 0.3.3.5-rc. + - Protover parsing was ignoring a 2nd hyphen and everything after + it, accepting entries like "Link=1-5-foo". Fixes bug 27164; bugfix + on 0.3.3.1-alpha. + - Stop setting $CARGO_HOME. cargo will use the user's $CARGO_HOME, or + $HOME/.cargo by default. Fixes bug 26497; bugfix on 0.3.1.5-alpha. + - cd to ${abs_top_builddir}/src/rust before running cargo in + src/test/test_rust.sh. This makes the working directory consistent + between builds and tests. Fixes bug 26497; bugfix on 0.3.3.2-alpha. + + o Minor bugfixes (testing, bootstrap): + - When calculating bootstrap progress, check exit policies and the + exit flag. Previously, Tor would only check the exit flag, which + caused race conditions in small and fast networks like chutney. + Fixes bug 27236; bugfix on 0.2.6.3-alpha. + + o Minor bugfixes (testing, openssl compatibility): + - Our "tortls/cert_matches_key" unit test no longer relies on + OpenSSL internals. Previously, it relied on unsupported OpenSSL + behavior in a way that caused it to crash with OpenSSL 1.0.2p. + Fixes bug 27226; bugfix on 0.2.5.1-alpha. + + o Minor bugfixes (Windows, compilation): + - Silence a compilation warning on MSVC 2017 and clang-cl. Fixes bug + 27185; bugfix on 0.2.2.2-alpha. + + +Changes in version 0.3.4.6-rc - 2018-08-06 + Tor 0.3.4.6-rc fixes several small compilation, portability, and + correctness issues in previous versions of Tor. This version is a + release candidate: if no serious bugs are found, we expect that the + stable 0.3.4 release will be (almost) the same as this release. + + o Major bugfixes (event scheduler): + - When we enable a periodic event, schedule it in the event loop + rather than running it immediately. Previously, we would re-run + periodic events immediately in the middle of (for example) + changing our options, with unpredictable effects. Fixes bug 27003; + bugfix on 0.3.4.1-alpha. + + o Minor features (compilation): + - When building Tor, prefer to use Python 3 over Python 2, and more + recent (contemplated) versions over older ones. Closes + ticket 26372. + - When compiling with --enable-openbsd-malloc or --enable-tcmalloc, + tell the compiler not to include the system malloc implementation. + Fixes bug 20424; bugfix on 0.2.0.20-rc. + - Don't try to use a pragma to temporarily disable the + -Wunused-const-variable warning if the compiler doesn't support + it. Fixes bug 26785; bugfix on 0.3.2.11. + + o Minor bugfixes (continuous integration): + - Skip a pair of unreliable key generation tests on Windows, until + the underlying issue in bug 26076 is resolved. Fixes bug 26830 and + bug 26853; bugfix on 0.2.7.3-rc and 0.3.2.1-alpha respectively. + + o Minor features (controller): + - The control port now exposes the list of HTTPTunnelPorts and + ExtOrPorts via GETINFO net/listeners/httptunnel and + net/listeners/extor respectively. Closes ticket 26647. + + o Minor bugfixes (directory authority): + - When voting for recommended versions, make sure that all of the + versions are well-formed and parsable. Fixes bug 26485; bugfix + on 0.1.1.6-alpha. + + o Minor features (geoip): + - Update geoip and geoip6 to the July 3 2018 Maxmind GeoLite2 + Country database. Closes ticket 26674. + + o Minor features (Rust, portability): + - Rust cross-compilation is now supported. Closes ticket 25895. + + o Minor bugfixes (compilation): + - Update build system so that tor builds again with --disable-unittests + after recent refactoring. Fixes bug 26789; bugfix on 0.3.4.3-alpha. + - Fix a compilation warning on some versions of GCC when building + code that calls routerinfo_get_my_routerinfo() twice, assuming + that the second call will succeed if the first one did. Fixes bug + 26269; bugfix on 0.2.8.2-alpha. + + o Minor bugfixes (controller): + - Report the port correctly when a port is configured to bind to + "auto". Fixes bug 26568; bugfix on 0.3.4.1-alpha. + - Parse the "HSADDRESS=" parameter in HSPOST commands properly. + Previously, it was misparsed and ignored. Fixes bug 26523; bugfix + on 0.3.3.1-alpha. Patch by "akwizgran". + + o Minor bugfixes (correctness, flow control): + - Upon receiving a stream-level SENDME cell, verify that our window + has not grown too large. Fixes bug 26214; bugfix on svn + r54 (pre-0.0.1) + + o Minor bugfixes (memory, correctness): + - Fix a number of small memory leaks identified by coverity. Fixes + bug 26467; bugfix on numerous Tor versions. + + o Minor bugfixes (logging): + - Improve the log message when connection initiators fail to + authenticate direct connections to relays. Fixes bug 26927; bugfix + on 0.3.0.1-alpha. + + o Minor bugfixes (portability): + - Avoid a compilation error in test_bwmgt.c on Solaris 10. Fixes bug + 26994; bugfix on 0.3.4.1-alpha. + - Work around two different bugs in the OS X 10.10 and later SDKs + that would prevent us from successfully targeting earlier versions + of OS X. Fixes bug 26876; bugfix on 0.3.3.1-alpha. + + o Minor bugfixes (single onion services, Tor2web): + - Log a protocol warning when single onion services or Tor2web + clients fail to authenticate direct connections to relays. Fixes + bug 26924; bugfix on 0.2.9.1-alpha. + + o Minor bugfixes (testing): + - Disable core dumps in test_bt.sh, to avoid failures in "make + distcheck". Fixes bug 26787; bugfix on 0.2.5.2-alpha. + + o Minor bugfixes (testing, compatibility): + - When running the ntor_ref.py and hs_ntor_ref.py tests, make sure + only to pass strings (rather than "bytes" objects) to the Python + subprocess module. Python 3 on Windows seems to require this. + Fixes bug 26535; bugfix on 0.2.5.5-alpha (for ntor_ref.py) and + 0.3.1.1-alpha (for hs_ntor_ref.py). + + o Minor bugfixes (v3 onion services): + - Stop sending ed25519 link specifiers in v3 onion service introduce + cells and descriptors, when the rendezvous or introduction point + doesn't support ed25519 link authentication. Fixes bug 26627; + bugfix on 0.3.2.4-alpha. + + +Changes in version 0.3.4.5-rc - 2018-07-13 + Tor 0.3.4.5-rc moves to a new bridge authority, meaning people running + bridge relays should upgrade. + + o Directory authority changes: + - The "Bifroest" bridge authority has been retired; the new bridge + authority is "Serge", and it is operated by George from the + TorBSD project. Closes ticket 26771. + + Changes in version 0.3.3.9 - 2018-07-13 Tor 0.3.3.9 moves to a new bridge authority, meaning people running bridge relays should upgrade. @@ -250,6 +533,57 @@ Changes in version 0.2.9.16 - 2018-07-13 Closes ticket 24854. Patch by "beastr0". +Changes in version 0.3.4.4-rc - 2018-07-09 + Tor 0.3.4.4-rc fixes several small compilation, portability, and + correctness issues in previous versions of Tor. This version is a + release candidate: if no serious bugs are found, we expect that the + stable 0.3.4 release will be (almost) the same as this release. + + o Minor features (compilation): + - When building Tor, prefer to use Python 3 over Python 2, and more + recent (contemplated) versions over older ones. Closes + ticket 26372. + + o Minor features (geoip): + - Update geoip and geoip6 to the July 3 2018 Maxmind GeoLite2 + Country database. Closes ticket 26674. + + o Minor features (Rust, portability): + - Rust cross-compilation is now supported. Closes ticket 25895. + + o Minor bugfixes (compilation): + - Fix a compilation warning on some versions of GCC when building + code that calls routerinfo_get_my_routerinfo() twice, assuming + that the second call will succeed if the first one did. Fixes bug + 26269; bugfix on 0.2.8.2-alpha. + + o Minor bugfixes (control port): + - Report the port correctly when a port is configured to bind to + "auto". Fixes bug 26568; bugfix on 0.3.4.1-alpha. + - Handle the HSADDRESS= argument to the HSPOST command properly. + (Previously, this argument was misparsed and thus ignored.) Fixes + bug 26523; bugfix on 0.3.3.1-alpha. Patch by "akwizgran". + + o Minor bugfixes (correctness, flow control): + - Upon receiving a stream-level SENDME cell, verify that our window + has not grown too large. Fixes bug 26214; bugfix on svn + r54 (pre-0.0.1). + + o Minor bugfixes (memory, correctness): + - Fix a number of small memory leaks identified by coverity. Fixes + bug 26467; bugfix on numerous Tor versions. + + o Minor bugfixes (testing, compatibility): + - When running the hs_ntor_ref.py test, make sure only to pass + strings (rather than "bytes" objects) to the Python subprocess + module. Python 3 on Windows seems to require this. Fixes bug + 26535; bugfix on 0.3.1.1-alpha. + - When running the ntor_ref.py test, make sure only to pass strings + (rather than "bytes" objects) to the Python subprocess module. + Python 3 on Windows seems to require this. Fixes bug 26535; bugfix + on 0.2.5.5-alpha. + + Changes in version 0.3.3.8 - 2018-07-09 Tor 0.3.3.8 backports several changes from the 0.3.4.x series, including fixes for a memory leak affecting directory authorities. @@ -322,6 +656,75 @@ Changes in version 0.3.3.8 - 2018-07-09 on 0.2.5.5-alpha. +Changes in version 0.3.4.3-alpha - 2018-06-26 + Tor 0.3.4.3-alpha fixes several bugs in earlier versions, including + one that was causing stability issues on directory authorities. + + o Major bugfixes (directory authority): + - Stop leaking memory on directory authorities when planning to + vote. This bug was crashing authorities by exhausting their + memory. Fixes bug 26435; bugfix on 0.3.3.6. + + o Major bugfixes (rust, testing): + - Make sure that failing tests in Rust will actually cause the build + to fail: previously, they were ignored. Fixes bug 26258; bugfix + on 0.3.3.4-alpha. + + o Minor feature (directory authorities): + - Stop warning about incomplete bw lines before the first complete + bw line has been found, so that additional header lines can be + ignored. Fixes bug 25960; bugfix on 0.2.2.1-alpha + + o Minor features (relay, diagnostic): + - Add several checks to detect whether Tor relays are uploading + their descriptors without specifying why they regenerated them. + Diagnostic for ticket 25686. + + o Minor features (unit tests): + - Test complete bandwidth measurements files, and test that + incomplete bandwidth lines only give warnings when the end of the + header has not been detected. Fixes bug 25947; bugfix + on 0.2.2.1-alpha + + o Minor bugfixes (compilation): + - Refrain from compiling unit testing related object files when + --disable-unittests is set to configure script. Fixes bug 24891; + bugfix on 0.2.5.1-alpha. + - When linking the libtor_testing.a library, only include the + dirauth object files once. Previously, they were getting added + twice. Fixes bug 26402; bugfix on 0.3.4.1-alpha. + - The --enable-fatal-warnings flag now affects Rust code as well. + Closes ticket 26245. + + o Minor bugfixes (onion services): + - Recompute some consensus information after detecting a clock jump, + or after transitioning from a non-live consensus to a live + consensus. We do this to avoid having an outdated state, and + miscalculating the index for next-generation onion services. Fixes + bug 24977; bugfix on 0.3.2.1-alpha. + + o Minor bugfixes (relay): + - Relays now correctly block attempts to re-extend to the previous + relay by Ed25519 identity. Previously they would warn in this + case, but not actually reject the attempt. Fixes bug 26158; bugfix + on 0.3.0.1-alpha. + + o Minor bugfixes (testing): + - Fix compilation of the doctests in the Rust crypto crate. Fixes + bug 26415; bugfix on 0.3.4.1-alpha. + - Instead of trying to read the geoip configuration files from + within the unit tests, instead create our own ersatz files with + just enough geoip data in the format we expect. Trying to read + from the source directory created problems on Windows with mingw, + where the build system's paths are not the same as the platform's + paths. Fixes bug 25787; bugfix on 0.3.4.1-alpha. + - Refrain from trying to get an item from an empty smartlist in + test_bridges_clear_bridge_list. Set DEBUG_SMARTLIST in unit tests + to catch improper smartlist usage. Furthermore, enable + DEBUG_SMARTLIST globally when build is configured with fragile + hardening. Fixes bug 26196; bugfix on 0.3.4.1-alpha. + + Changes in version 0.3.3.7 - 2018-06-12 Tor 0.3.3.7 backports several changes from the 0.3.4.x series, including fixes for bugs affecting compatibility and stability. @@ -363,6 +766,72 @@ Changes in version 0.3.3.7 - 2018-06-12 wanted. Fixes bugs 25691 and 25692; bugfix on 0.3.3.4-alpha. +Changes in version 0.3.4.2-alpha - 2018-06-12 + Tor 0.3.4.2-alpha fixes several minor bugs in the previous alpha + release, and forward-ports an authority-only security fix from 0.3.3.6. + + o Directory authority changes: + - Add an IPv6 address for the "dannenberg" directory authority. + Closes ticket 26343. + + o Major bugfixes (security, directory authority, denial-of-service, also in 0.3.3.6): + - Fix a bug that could have allowed an attacker to force a directory + authority to use up all its RAM by passing it a maliciously + crafted protocol versions string. Fixes bug 25517; bugfix on + 0.2.9.4-alpha. This issue is also tracked as TROVE-2018-005. + + o Minor features (continuous integration): + - Add the necessary configuration files for continuous integration + testing on Windows, via the Appveyor platform. Closes ticket + 25549. Patches from Marcin Cieślak and Isis Lovecruft. + + o Minor features (geoip): + - Update geoip and geoip6 to the June 7 2018 Maxmind GeoLite2 + Country database. Closes ticket 26351. + + o Minor bugfixes (compatibility, openssl): + - Work around a change in OpenSSL 1.1.1 where return values that + would previously indicate "no password" now indicate an empty + password. Without this workaround, Tor instances running with + OpenSSL 1.1.1 would accept descriptors that other Tor instances + would reject. Fixes bug 26116; bugfix on 0.2.5.16. + + o Minor bugfixes (compilation): + - Silence unused-const-variable warnings in zstd.h with some GCC + versions. Fixes bug 26272; bugfix on 0.3.1.1-alpha. + - Fix compilation when using OpenSSL 1.1.0 with the "no-deprecated" + flag enabled. Fixes bug 26156; bugfix on 0.3.4.1-alpha. + - Avoid a compiler warning when casting the return value of + smartlist_len() to double with DEBUG_SMARTLIST enabled. Fixes bug + 26283; bugfix on 0.2.4.10-alpha. + + o Minor bugfixes (control port): + - Do not count 0-length RELAY_COMMAND_DATA cells as valid data in + CIRC_BW events. Previously, such cells were counted entirely in + the OVERHEAD field. Now they are not. Fixes bug 26259; bugfix + on 0.3.4.1-alpha. + + o Minor bugfixes (controller): + - Improve accuracy of the BUILDTIMEOUT_SET control port event's + TIMEOUT_RATE and CLOSE_RATE fields. (We were previously + miscounting the total number of circuits for these field values.) + Fixes bug 26121; bugfix on 0.3.3.1-alpha. + + o Minor bugfixes (hardening): + - Prevent a possible out-of-bounds smartlist read in + protover_compute_vote(). Fixes bug 26196; bugfix on 0.2.9.4-alpha. + + o Minor bugfixes (onion services): + - Fix a bug that blocked the creation of ephemeral v3 onion + services. Fixes bug 25939; bugfix on 0.3.4.1-alpha. + + o Minor bugfixes (test coverage tools): + - Update our "cov-diff" script to handle output from the latest + version of gcov, and to remove extraneous timestamp information + from its output. Fixes bugs 26101 and 26102; bugfix + on 0.2.5.1-alpha. + + Changes in version 0.3.3.6 - 2018-05-22 Tor 0.3.3.6 is the first stable release in the 0.3.3 series. It backports several important fixes from the 0.3.4.1-alpha. @@ -454,7 +923,7 @@ Changes in version 0.3.3.6 - 2018-05-22 Fixes bug 26069; bugfix on 0.3.0.1-alpha. o Minor bugfixes (relay, crash, backport from 0.3.4.1-alpha): - - Avoid a crash when running with DirPort set but ORPort tuned off. + - Avoid a crash when running with DirPort set but ORPort turned off. Fixes a case of bug 23693; bugfix on 0.3.1.1-alpha. o Documentation (backport from 0.3.4.1-alpha): @@ -462,6 +931,456 @@ Changes in version 0.3.3.6 - 2018-05-22 ticket 25857. Patch from "CTassisF". +Changes in version 0.3.4.1-alpha - 2018-05-17 + Tor 0.3.4.1-alpha is the first release in the 0.3.4.x series. It + includes refactoring to begin reducing Tor's binary size and idle CPU + usage on mobile, along with prep work for new bandwidth scanners, + improvements to the experimental "vanguards" feature, and numerous + other small features and bugfixes. + + o New system requirements: + - Tor no longer tries to support old operating systems without + mmap() or some local equivalent. Apparently, compilation on such + systems has been broken for some time, without anybody noticing or + complaining. Closes ticket 25398. + + o Major feature (directory authority, modularization): + - The directory authority subsystem has been modularized. The code + is now located in src/or/dirauth/, and is compiled in by default. + To disable the module, the configure option + --disable-module-dirauth has been added. This module may be + disabled by default in some future release. Closes ticket 25610. + + o Major features (main loop, CPU usage): + - When Tor is disabled (via DisableNetwork or via hibernation), it + no longer needs to run any per-second events. This change should + make it easier for mobile applications to disable Tor while the + device is sleeping, or Tor is not running. Closes ticket 26063. + - Tor no longer enables all of its periodic events by default. + Previously, Tor would enable all possible main loop events, + regardless of whether it needed them. Furthermore, many of these + events are now disabled when Tor is hibernating or DisableNetwork + is set. This is a big step towards reducing client CPU usage by + reducing the amount of wake-ups the daemon does. Closes tickets + 25376 and 25762. + - The bandwidth-limitation logic has been refactored so that + bandwidth calculations are performed on-demand, rather than every + TokenBucketRefillInterval milliseconds. This change should improve + the granularity of our bandwidth calculations, and limit the + number of times that the Tor process needs to wake up when it is + idle. Closes ticket 25373. + - Move responsibility for many operations from a once-per-second + callback to a callback that is only scheduled as needed. Moving + this functionality has allowed us to disable the callback when + Tor's network is disabled. Once enough items are removed from our + once-per-second callback, we can eliminate it entirely to conserve + CPU when idle. The functionality removed includes: closing + connections, circuits, and channels (ticket 25932); consensus + voting (25937); flushing log callbacks (25951); honoring delayed + SIGNEWNYM requests (25949); rescanning the consensus cache + (25931); saving the state file to disk (25948); warning relay + operators about unreachable ports (25952); and keeping track of + Tor's uptime (26009). + + o Major bugfixes (directory authorities, security): + - When directory authorities read a zero-byte bandwidth file, they + would previously log a warning with the contents of an + uninitialised buffer. They now log a warning about the empty file + instead. Fixes bug 26007; bugfix on 0.2.2.1-alpha. + + o Major bugfixes (crash): + - Avoid a rare assertion failure in the circuit build timeout code + if we fail to allow any circuits to actually complete. Fixes bug + 25733; bugfix on 0.2.2.2-alpha. + + o Major bugfixes (directory authority): + - Avoid a crash when testing router reachability on a router that + could have an ed25519 ID, but which does not. Fixes bug 25415; + bugfix on 0.3.3.2-alpha. + + o Major bugfixes (onion service): + - Correctly detect when onion services get disabled after HUP. Fixes + bug 25761; bugfix on 0.3.2.1. + + o Major bugfixes (protover, voting): + - Revise Rust implementation of protover to use a more memory- + efficient voting algorithm and corresponding data structures, thus + avoiding a potential (but small impact) DoS attack where specially + crafted protocol strings would expand to several potential + megabytes in memory. In the process, several portions of code were + revised to be methods on new, custom types, rather than functions + taking interchangeable types, thus increasing type safety of the + module. Custom error types and handling were added as well, in + order to facilitate better error dismissal/handling in outside + crates and avoid mistakenly passing an internal error string to C + over the FFI boundary. Many tests were added, and some previous + differences between the C and Rust implementations have been + remedied. Fixes bug 24031; bugfix on 0.3.3.1-alpha. + + o Major bugfixes (relay, denial of service): + - Impose a limit on circuit cell queue size. The limit can be + controlled by a consensus parameter. Fixes bug 25226; bugfix + on 0.2.4.14-alpha. + + o Minor features (accounting): + - When Tor becomes dormant, it now uses a scheduled event to wake up + at the right time. Previously, we would use the per-second timer + to check whether to wake up, but we no longer have any per-second + timers enabled when the network is disabled. Closes ticket 26064. + + o Minor features (code quality): + - Add optional spell-checking for the Tor codebase, using the + "misspell" program. To use this feature, run "make check-typos". + Closes ticket 25024. + + o Minor features (compatibility): + - Tor now detects versions of OpenSSL 1.1.0 and later compiled with + the no-deprecated option, and builds correctly with them. Closes + tickets 19429, 19981, and 25353. + - Avoid some compilation warnings with recent versions of LibreSSL. + Closes ticket 26006. + + o Minor features (compression, zstd): + - When running with zstd, Tor now considers using advanced functions + that the zstd maintainers have labeled as potentially unstable. To + prevent breakage, Tor will only use this functionality when the + runtime version of the zstd library matches the version with which + Tor was compiled. Closes ticket 25162. + + o Minor features (configuration): + - The "DownloadSchedule" options have been renamed to end with + "DownloadInitialDelay". The old names are still allowed, but will + produce a warning. Comma-separated lists are still permitted for + these options, but all values after the first are ignored (as they + have been since 0.2.9). Closes ticket 23354. + + o Minor features (continuous integration): + - Our .travis.yml configuration now includes support for testing the + results of "make distcheck". (It's not uncommon for "make check" + to pass but "make distcheck" to fail.) Closes ticket 25814. + - Our Travis CI configuration now integrates with the Coveralls + coverage analysis tool. Closes ticket 25818. + + o Minor features (control port): + - Introduce GETINFO "current-time/{local,utc}" to return the local + and UTC times respectively in ISO format. This helps a controller + like Tor Browser detect a time-related error. Closes ticket 25511. + Patch by Neel Chauhan. + - Introduce new fields to the CIRC_BW event. There are two new + fields in each of the read and written directions. The DELIVERED + fields report the total valid data on the circuit, as measured by + the payload sizes of verified and error-checked relay command + cells. The OVERHEAD fields report the total unused bytes in each + of these cells. Closes ticket 25903. + + o Minor features (directory authority): + - Directory authorities now open their key-pinning files as O_SYNC, + to limit their chances of accidentally writing partial lines. + Closes ticket 23909. + + o Minor features (directory authority, forward compatibility): + - Make the lines of the measured bandwidth file able to contain + their entries in any order. Previously, the node_id entry needed + to come first. Closes ticket 26004. + + o Minor features (entry guards): + - Introduce a new torrc option NumPrimaryGuards for controlling the + number of primary guards. Closes ticket 25843. + + o Minor features (geoip): + - Update geoip and geoip6 to the May 1 2018 Maxmind GeoLite2 Country + database. Closes ticket 26104. + + o Minor features (performance): + - Avoid a needless call to malloc() when processing an incoming + relay cell. Closes ticket 24914. + - Make our timing-wheel code run a tiny bit faster on 32-bit + platforms, by preferring 32-bit math to 64-bit. Closes + ticket 24688. + - Avoid a needless malloc()/free() pair every time we handle an ntor + handshake. Closes ticket 25150. + + o Minor features (testing): + - Add a unit test for voting_schedule_get_start_of_next_interval(). + Closes ticket 26014, and helps make unit test coverage + more deterministic. + - A new unittests module specifically for testing the functions in + the (new-ish) bridges.c module has been created with new + unittests, raising the code coverage percentages. Closes 25425. + - We now have improved testing for addressmap_get_virtual_address() + function. This should improve our test coverage, and make our test + coverage more deterministic. Closes ticket 25993. + + o Minor features (timekeeping, circuit scheduling): + - When keeping track of how busy each circuit have been recently on + a given connection, use coarse-grained monotonic timers rather + than gettimeofday(). This change should marginally increase + accuracy and performance. Implements part of ticket 25927. + + o Minor bugfixes (bandwidth management): + - Consider ourselves "low on write bandwidth" if we have exhausted + our write bandwidth some time in the last second. This was the + documented behavior before, but the actual behavior was to change + this value every TokenBucketRefillInterval. Fixes bug 25828; + bugfix on 0.2.3.5-alpha. + + o Minor bugfixes (C correctness): + - Add a missing lock acquisition in the shutdown code of the control + subsystem. Fixes bug 25675; bugfix on 0.2.7.3-rc. Found by + Coverity; this is CID 1433643. + + o Minor bugfixes (circuit path selection): + - Don't count path selection failures as circuit build failures. + This change should eliminate cases where Tor blames its guard or + the network for situations like insufficient microdescriptors + and/or overly restrictive torrc settings. Fixes bug 25705; bugfix + on 0.3.3.1-alpha. + + o Minor bugfixes (client): + - Don't consider Tor running as a client if the ControlPort is open, + but no actual client ports are open. Fixes bug 26062; bugfix + on 0.2.9.4-alpha. + + o Minor bugfixes (code style): + - Fixed multiple includes of transports.h in src/or/connection.c + Fixes bug 25261; bugfix on 0.2.5.1-alpha. + - Remove the unused variable n_possible from the function + channel_get_for_extend(). Fixes bug 25645; bugfix on 0.2.4.4-alpha + + o Minor bugfixes (control interface): + - Respond with more human-readable error messages to GETINFO exit- + policy/* requests. Also, let controller know if an error is + transient (response code 551) or not (response code 552). Fixes + bug 25852; bugfix on 0.2.8.1-alpha. + + o Minor bugfixes (controller): + - Make CIRC_BW event reflect the total of all data sent on a + circuit, including padding and dropped cells. Also fix a mis- + counting bug when STREAM_BW events were enabled. Fixes bug 25400; + bugfix on 0.2.5.2-alpha. + + o Minor bugfixes (correctness, client): + - Upon receiving a malformed connected cell, stop processing the cell + immediately. Previously we would mark the connection for close, but + continue processing the cell as if the connection were open. Fixes bug + 26072; bugfix on 0.2.4.7-alpha. + + o Minor bugfixes (directory client): + - When unverified-consensus is verified, rename it to cached- + consenus. Fixes bug 4187; bugfix on 0.2.0.3-alpha. + - Fixed launching a certificate fetch always during the scheduled + periodic consensus fetch by fetching only in those cases when + consensus are waiting for certs. Fixes bug 24740; bugfix + on 0.2.9.1-alpha. + + o Minor bugfixes (documentation): + - Stop saying in the manual that clients cache ipv4 dns answers from + exit relays. We haven't used them since 0.2.6.3-alpha, and in + ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, but + we forgot to say so in the man page. Fixes bug 26052; bugfix + on 0.3.2.6-alpha. + + o Minor bugfixes (error reporting): + - Improve tolerance for directory authorities with skewed clocks. + Previously, an authority with a clock more than 60 seconds ahead + could cause a client with a correct clock to warn that the + client's clock was behind. Now the clocks of a majority of + directory authorities have to be ahead of the client before this + warning will occur. Fixes bug 25756; bugfix on 0.2.2.25-alpha. + + o Minor bugfixes (Linux seccomp2 sandbox): + - Allow the nanosleep() system call, which glibc uses to implement + sleep() and usleep(). Fixes bug 24969; bugfix on 0.2.5.1-alpha. + + o Minor bugfixes (onion service): + - Fix a memory leak when a v3 onion service is configured and gets a + SIGHUP signal. Fixes bug 25901; bugfix on 0.3.2.1-alpha. + - When parsing the descriptor signature, look for the token plus an + extra white-space at the end. This is more correct but also will + allow us to support new fields that might start with "signature". + Fixes bug 26069; bugfix on 0.3.0.1-alpha. + + o Minor bugfixes (path selection): + - Only select relays when they have the descriptors we prefer to use + for them. This change fixes a bug where we could select a relay + because it had _some_ descriptor, but reject it later with a + nonfatal assertion error because it didn't have the exact one we + wanted. Fixes bugs 25691 and 25692; bugfix on 0.3.3.4-alpha. + + o Minor bugfixes (portability): + - Do not align mmap length, as it is not required by POSIX, and the + getpagesize function is deprecated. Fixes bug 25399; bugfix + on 0.1.1.23. + + o Minor bugfixes (portability, FreeBSD): + - In have_enough_mem_for_dircache(), the variable DIRCACHE_MIN_MEM_MB + does not stringify on FreeBSD, so we switch to tor_asprintf(). + Fixes bug 20887; bugfix on 0.2.8.1-alpha. Patch by Neel Chauhan. + + o Minor bugfixes (relay statistics): + - When a relay is collecting internal statistics about how many + create cell requests it has seen of each type, accurately count + the requests from relays that temporarily fall out of the + consensus. (To be extra conservative, we were already ignoring + requests from clients in our counts, and we continue ignoring them + here.) Fixes bug 24910; bugfix on 0.2.4.17-rc. + + o Minor bugfixes (relay, crash): + - Avoid a crash when running with DirPort set but ORPort turned off. + Fixes a case of bug 23693; bugfix on 0.3.1.1-alpha. + + o Minor bugfixes (restart-in-process): + - When shutting down, Tor now clears all the flags in the control.c + module. This should prevent a bug where authentication cookies are + not generated on restart. Fixes bug 25512; bugfix on 0.3.3.1-alpha. + + o Minor bugfixes (testing): + - When testing workqueue event-cancellation, make sure that we + actually cancel an event, and that cancel each event with equal + probability. (It was previously possible, though extremely + unlikely, for our event-canceling test not to cancel any events.) + Fixes bug 26008; bugfix on 0.2.6.3-alpha. + - Repeat part of the test in test_client_pick_intro() a number of + times, to give it consistent coverage. Fixes bug 25996; bugfix + on 0.3.2.1-alpha. + - Remove randomness from the hs_common/responsible_hsdirs test, so + that it always takes the same path through the function it tests. + Fixes bug 25997; bugfix on 0.3.2.1-alpha. + - Change the behavior of the "channel/outbound" test so that it + never causes a 10-second rollover for the EWMA circuitmux code. + Previously, this behavior would happen randomly, and result in + fluctuating test coverage. Fixes bug 25994; bugfix + on 0.3.3.1-alpha. + - Use X509_new() to allocate certificates that will be freed later + with X509_free(). Previously, some parts of the unit tests had + used tor_malloc_zero(), which is incorrect, and which caused test + failures on Windows when they were built with extra hardening. + Fixes bugs 25943 and 25944; bugfix on 0.2.8.1-alpha. Patch by + Marcin Cieślak. + - While running the circuit_timeout test, fix the PRNG to a + deterministic AES stream, so that the test coverage from this test + will itself be deterministic. Fixes bug 25995; bugfix + on 0.2.2.2-alpha. + + o Minor bugfixes (vanguards): + - Allow the last hop in a vanguard circuit to be the same as our + first, to prevent the adversary from influencing guard node choice + by choice of last hop. Also prevent the creation of A - B - A + paths, or A - A paths, which are forbidden by relays. Fixes bug + 25870; bugfix on 0.3.3.1-alpha. + + o Code simplification and refactoring: + - Remove duplicate code in parse_{c,s}method_line and bootstrap + their functionalities into a single function. Fixes bug 6236; + bugfix on 0.2.3.6-alpha. + - We remove the PortForwsrding and PortForwardingHelper options, + related functions, and the port_forwarding tests. These options + were used by the now-deprecated Vidalia to help ordinary users + become Tor relays or bridges. Closes ticket 25409. Patch by + Neel Chauhan. + - In order to make the OR and dir checking function in router.c less + confusing we renamed some functions and + consider_testing_reachability() has been split into + router_should_check_reachability() and + router_do_reachability_checks(). Also we improved the documentation + in some functions. Closes ticket 18918. + - Initial work to isolate Libevent usage to a handful of modules in + our codebase, to simplify our call structure, and so that we can + more easily change event loops in the future if needed. Closes + ticket 23750. + - Introduce a function to call getsockname() and return tor_addr_t, + to save a little complexity throughout the codebase. Closes + ticket 18105. + - Make hsdir_index in node_t a hsdir_index_t rather than a pointer + as hsdir_index is always present. Also, we move hsdir_index_t into + or.h. Closes ticket 23094. Patch by Neel Chauhan. + - Merge functions used for describing nodes and suppress the + functions that do not allocate memory for the output buffer + string. NODE_DESC_BUF_LEN constant and format_node_description() + function cannot be used externally from router.c module anymore. + Closes ticket 25432. Patch by valentecaio. + - Our main loop has been simplified so that all important operations + happen inside events. Previously, some operations had to happen + outside the event loop, to prevent infinite sequences of event + activations. Closes ticket 25374. + - Put a SHA1 public key digest in hs_service_intro_point_t, and use + it in register_intro_circ() and service_intro_point_new(). This + prevents the digest from being re-calculated each time. Closes + ticket 23107. Patch by Neel Chauhan. + - Refactor token-bucket implementations to use a common backend. + Closes ticket 25766. + - Remove extern declaration of stats_n_seconds_working variable from + main, protecting its accesses with get_uptime() and reset_uptime() + functions. Closes ticket 25081, patch by “valentecaio”. + - Remove our previous logic for "cached gettimeofday()" -- our + coarse monotonic timers are fast enough for this purpose, and far + less error-prone. Implements part of ticket 25927. + - Remove the return value for fascist_firewall_choose_address_base(), + and sister functions such as fascist_firewall_choose_address_node() + and fascist_firewall_choose_address_rs(). Also, while we're here, + initialize the ap argument as leaving it uninitialized can pose a + security hazard. Closes ticket 24734. Patch by Neel Chauhan. + - Rename two fields of connection_t struct. timestamp_lastwritten is + renamed to timestamp_last_write_allowed and timestamp_lastread is + renamed to timestamp_last_read_allowed. Closes ticket 24714, patch + by "valentecaio". + - Since Tor requires C99, remove our old workaround code for libc + implementations where free(NULL) doesn't work. Closes ticket 24484. + - Use our standard rate-limiting code to deal with excessive + libevent failures, rather than the hand-rolled logic we had + before. Closes ticket 26016. + - We remove the return value of node_get_prim_orport() and + node_get_prim_dirport(), and introduce node_get_prim_orport() in + node_ipv6_or_preferred() and node_ipv6_dir_preferred() in order to + check for a null address. Closes ticket 23873. Patch by + Neel Chauhan. + - We switch to should_record_bridge_info() in + geoip_note_client_seen() and options_need_geoip_info() instead of + accessing the configuration values directly. Fixes bug 25290; + bugfix on 0.2.1.6-alpha. Patch by Neel Chauhan. + + o Deprecated features: + - As we are not recommending 0.2.5 anymore, we require relays that + once had an ed25519 key associated with their RSA key to always + have that key, instead of allowing them to drop back to a version + that didn't support ed25519. This means they need to use a new RSA + key if the want to downgrade to an older version of tor without + ed25519. Closes ticket 20522. + + o Documentation: + - Correct an IPv6 error in the documentation for ExitPolicy. Closes + ticket 25857. Patch from "CTassisF". + + o Removed features: + - Directory authorities will no longer support voting according to + any consensus method before consensus method 25. This keeps + authorities compatible with all authorities running 0.2.9.8 and + later, and does not break any clients or relays. Implements ticket + 24378 and proposal 290. + - The PortForwarding and PortForwardingHelper features have been + removed. The reasoning is, given that implementations of NAT + traversal protocols within common consumer grade routers are + frequently buggy, and that the target audience for a NAT punching + feature is a perhaps less-technically-inclined relay operator, + when the helper fails to setup traversal the problems are usually + deep, ugly, and very router specific, making them horrendously + impossible for technical support to reliable assist with, and thus + resulting in frustration all around. Unfortunately, relay + operators who would like to run relays behind NATs will need to + become more familiar with the port forwarding configurations on + their local router. Closes 25409. + - The TestingEnableTbEmptyEvent option has been removed. It was used + in testing simulations to measure how often connection buckets + were emptied, in order to improve our scheduling, but it has not + been actively used in years. Closes ticket 25760. + - The old "round-robin" circuit multiplexer (circuitmux) + implementation has been removed, along with a fairly large set of + code that existed to support it. It has not been the default + circuitmux since we introduced the "EWMA" circuitmux in 0.2.4.x, + but it still required an unreasonable amount of memory and CPU. + Closes ticket 25268. + + Changes in version 0.3.3.5-rc - 2018-04-15 Tor 0.3.3.5-rc fixes various bugs in earlier versions of Tor, including some that could affect reliability or correctness. diff -pruN 0.3.3.9-1/compile 0.3.4.8-1/compile --- 0.3.3.9-1/compile 2018-07-12 17:16:59.000000000 +0000 +++ 0.3.4.8-1/compile 2018-06-25 18:12:07.000000000 +0000 @@ -1,9 +1,9 @@ -#! /bin/sh +#!/bin/sh # Wrapper for compilers which do not understand '-c -o'. -scriptversion=2012-10-14.11; # UTC +scriptversion=2016-01-11.22; # UTC -# Copyright (C) 1999-2013 Free Software Foundation, Inc. +# Copyright (C) 1999-2017 Free Software Foundation, Inc. # Written by Tom Tromey . # # This program is free software; you can redistribute it and/or modify @@ -255,7 +255,8 @@ EOF echo "compile $scriptversion" exit $? ;; - cl | *[/\\]cl | cl.exe | *[/\\]cl.exe ) + cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \ + icl | *[/\\]icl | icl.exe | *[/\\]icl.exe ) func_cl_wrapper "$@" # Doesn't return... ;; esac @@ -342,6 +343,6 @@ exit $ret # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" -# time-stamp-time-zone: "UTC" +# time-stamp-time-zone: "UTC0" # time-stamp-end: "; # UTC" # End: diff -pruN 0.3.3.9-1/config.guess 0.3.4.8-1/config.guess --- 0.3.3.9-1/config.guess 2018-07-12 17:16:59.000000000 +0000 +++ 0.3.4.8-1/config.guess 2018-06-25 18:12:07.000000000 +0000 @@ -1,8 +1,8 @@ -#! /bin/sh +#!/bin/sh # Attempt to guess a canonical system name. -# Copyright 1992-2014 Free Software Foundation, Inc. +# Copyright 1992-2017 Free Software Foundation, Inc. -timestamp='2014-03-23' +timestamp='2017-08-08' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -24,12 +24,12 @@ timestamp='2014-03-23' # program. This Exception is an additional permission under section 7 # of the GNU General Public License, version 3 ("GPLv3"). # -# Originally written by Per Bothner. +# Originally written by Per Bothner; maintained since 2000 by Ben Elliston. # # You can get the latest version of this script from: -# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD +# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess # -# Please send patches with a ChangeLog entry to config-patches@gnu.org. +# Please send patches to . me=`echo "$0" | sed -e 's,.*/,,'` @@ -50,7 +50,7 @@ version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. -Copyright 1992-2014 Free Software Foundation, Inc. +Copyright 1992-2017 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -168,19 +168,29 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ # Note: NetBSD doesn't particularly care about the vendor # portion of the name. We always set it to "unknown". sysctl="sysctl -n hw.machine_arch" - UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \ - /usr/sbin/$sysctl 2>/dev/null || echo unknown)` + UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \ + /sbin/$sysctl 2>/dev/null || \ + /usr/sbin/$sysctl 2>/dev/null || \ + echo unknown)` case "${UNAME_MACHINE_ARCH}" in armeb) machine=armeb-unknown ;; arm*) machine=arm-unknown ;; sh3el) machine=shl-unknown ;; sh3eb) machine=sh-unknown ;; sh5el) machine=sh5le-unknown ;; + earmv*) + arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'` + endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'` + machine=${arch}${endian}-unknown + ;; *) machine=${UNAME_MACHINE_ARCH}-unknown ;; esac # The Operating System including object format, if it has switched - # to ELF recently, or will in the future. + # to ELF recently (or will in the future) and ABI. case "${UNAME_MACHINE_ARCH}" in + earm*) + os=netbsdelf + ;; arm*|i386|m68k|ns32k|sh3*|sparc|vax) eval $set_cc_for_build if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \ @@ -197,6 +207,13 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ os=netbsd ;; esac + # Determine ABI tags. + case "${UNAME_MACHINE_ARCH}" in + earm*) + expr='s/^earmv[0-9]/-eabi/;s/eb$//' + abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"` + ;; + esac # The OS release # Debian GNU/NetBSD machines have a different userland, and # thus, need a distinct triplet. However, they do not need @@ -207,13 +224,13 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ release='-gnu' ;; *) - release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'` + release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2` ;; esac # Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM: # contains redundant information, the shorter form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used. - echo "${machine}-${os}${release}" + echo "${machine}-${os}${release}${abi}" exit ;; *:Bitrig:*:*) UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'` @@ -223,6 +240,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'` echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE} exit ;; + *:LibertyBSD:*:*) + UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'` + echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE} + exit ;; *:ekkoBSD:*:*) echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE} exit ;; @@ -235,6 +256,12 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ *:MirBSD:*:*) echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE} exit ;; + *:Sortix:*:*) + echo ${UNAME_MACHINE}-unknown-sortix + exit ;; + *:Redox:*:*) + echo ${UNAME_MACHINE}-unknown-redox + exit ;; alpha:OSF1:*:*) case $UNAME_RELEASE in *4.0) @@ -251,42 +278,42 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha \(.*\) processor.*$/\1/p' | head -n 1` case "$ALPHA_CPU_TYPE" in "EV4 (21064)") - UNAME_MACHINE="alpha" ;; + UNAME_MACHINE=alpha ;; "EV4.5 (21064)") - UNAME_MACHINE="alpha" ;; + UNAME_MACHINE=alpha ;; "LCA4 (21066/21068)") - UNAME_MACHINE="alpha" ;; + UNAME_MACHINE=alpha ;; "EV5 (21164)") - UNAME_MACHINE="alphaev5" ;; + UNAME_MACHINE=alphaev5 ;; "EV5.6 (21164A)") - UNAME_MACHINE="alphaev56" ;; + UNAME_MACHINE=alphaev56 ;; "EV5.6 (21164PC)") - UNAME_MACHINE="alphapca56" ;; + UNAME_MACHINE=alphapca56 ;; "EV5.7 (21164PC)") - UNAME_MACHINE="alphapca57" ;; + UNAME_MACHINE=alphapca57 ;; "EV6 (21264)") - UNAME_MACHINE="alphaev6" ;; + UNAME_MACHINE=alphaev6 ;; "EV6.7 (21264A)") - UNAME_MACHINE="alphaev67" ;; + UNAME_MACHINE=alphaev67 ;; "EV6.8CB (21264C)") - UNAME_MACHINE="alphaev68" ;; + UNAME_MACHINE=alphaev68 ;; "EV6.8AL (21264B)") - UNAME_MACHINE="alphaev68" ;; + UNAME_MACHINE=alphaev68 ;; "EV6.8CX (21264D)") - UNAME_MACHINE="alphaev68" ;; + UNAME_MACHINE=alphaev68 ;; "EV6.9A (21264/EV69A)") - UNAME_MACHINE="alphaev69" ;; + UNAME_MACHINE=alphaev69 ;; "EV7 (21364)") - UNAME_MACHINE="alphaev7" ;; + UNAME_MACHINE=alphaev7 ;; "EV7.9 (21364A)") - UNAME_MACHINE="alphaev79" ;; + UNAME_MACHINE=alphaev79 ;; esac # A Pn.n version is a patched version. # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. - echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` + echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz` # Reset EXIT trap before exiting to avoid spurious non-zero exit code. exitcode=$? trap '' 0 @@ -359,16 +386,16 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ exit ;; i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*) eval $set_cc_for_build - SUN_ARCH="i386" + SUN_ARCH=i386 # If there is a compiler, see if it is configured for 64-bit objects. # Note that the Sun cc does not turn __LP64__ into 1 like gcc does. # This test works for both compilers. - if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then + if [ "$CC_FOR_BUILD" != no_compiler_found ]; then if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \ - (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ + (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ grep IS_64BIT_ARCH >/dev/null then - SUN_ARCH="x86_64" + SUN_ARCH=x86_64 fi fi echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` @@ -393,7 +420,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:$ exit ;; sun*:*:4.2BSD:*) UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null` - test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3 + test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3 case "`/bin/arch`" in sun3) echo m68k-sun-sunos${UNAME_RELEASE} @@ -579,8 +606,9 @@ EOF else IBM_ARCH=powerpc fi - if [ -x /usr/bin/oslevel ] ; then - IBM_REV=`/usr/bin/oslevel` + if [ -x /usr/bin/lslpp ] ; then + IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | + awk -F: '{ print $3 }' | sed s/[0-9]*$/0/` else IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE} fi @@ -617,13 +645,13 @@ EOF sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null` sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null` case "${sc_cpu_version}" in - 523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0 - 528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1 + 523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0 + 528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1 532) # CPU_PA_RISC2_0 case "${sc_kernel_bits}" in - 32) HP_ARCH="hppa2.0n" ;; - 64) HP_ARCH="hppa2.0w" ;; - '') HP_ARCH="hppa2.0" ;; # HP-UX 10.20 + 32) HP_ARCH=hppa2.0n ;; + 64) HP_ARCH=hppa2.0w ;; + '') HP_ARCH=hppa2.0 ;; # HP-UX 10.20 esac ;; esac fi @@ -662,11 +690,11 @@ EOF exit (0); } EOF - (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy` + (CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy` test -z "$HP_ARCH" && HP_ARCH=hppa fi ;; esac - if [ ${HP_ARCH} = "hppa2.0w" ] + if [ ${HP_ARCH} = hppa2.0w ] then eval $set_cc_for_build @@ -679,12 +707,12 @@ EOF # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess # => hppa64-hp-hpux11.23 - if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | + if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | grep -q __LP64__ then - HP_ARCH="hppa2.0w" + HP_ARCH=hppa2.0w else - HP_ARCH="hppa64" + HP_ARCH=hppa64 fi fi echo ${HP_ARCH}-hp-hpux${HPUX_REV} @@ -789,14 +817,14 @@ EOF echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/' exit ;; F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*) - FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'` - FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` + FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz` + FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'` echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; 5000:UNIX_System_V:4.*:*) - FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'` - FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'` + FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'` + FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'` echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit ;; i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*) @@ -812,10 +840,11 @@ EOF UNAME_PROCESSOR=`/usr/bin/uname -p` case ${UNAME_PROCESSOR} in amd64) - echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; - *) - echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; + UNAME_PROCESSOR=x86_64 ;; + i386) + UNAME_PROCESSOR=i586 ;; esac + echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` exit ;; i*:CYGWIN*:*) echo ${UNAME_MACHINE}-pc-cygwin @@ -878,7 +907,7 @@ EOF exit ;; *:GNU/*:*:*) # other systems with GNU libc and userland - echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC} + echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC} exit ;; i*86:Minix:*:*) echo ${UNAME_MACHINE}-pc-minix @@ -901,7 +930,7 @@ EOF EV68*) UNAME_MACHINE=alphaev68 ;; esac objdump --private-headers /bin/sh | grep -q ld.so.1 - if test "$?" = 0 ; then LIBC="gnulibc1" ; fi + if test "$?" = 0 ; then LIBC=gnulibc1 ; fi echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; arc:Linux:*:* | arceb:Linux:*:*) @@ -932,6 +961,9 @@ EOF crisv32:Linux:*:*) echo ${UNAME_MACHINE}-axis-linux-${LIBC} exit ;; + e2k:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + exit ;; frv:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; @@ -944,6 +976,9 @@ EOF ia64:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; + k1om:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + exit ;; m32r*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} exit ;; @@ -969,6 +1004,9 @@ EOF eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'` test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; } ;; + mips64el:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + exit ;; openrisc*:Linux:*:*) echo or1k-unknown-linux-${LIBC} exit ;; @@ -1001,6 +1039,9 @@ EOF ppcle:Linux:*:*) echo powerpcle-unknown-linux-${LIBC} exit ;; + riscv32:Linux:*:* | riscv64:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + exit ;; s390:Linux:*:* | s390x:Linux:*:*) echo ${UNAME_MACHINE}-ibm-linux-${LIBC} exit ;; @@ -1020,7 +1061,7 @@ EOF echo ${UNAME_MACHINE}-dec-linux-${LIBC} exit ;; x86_64:Linux:*:*) - echo ${UNAME_MACHINE}-unknown-linux-${LIBC} + echo ${UNAME_MACHINE}-pc-linux-${LIBC} exit ;; xtensa*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-${LIBC} @@ -1099,7 +1140,7 @@ EOF # uname -m prints for DJGPP always 'pc', but it prints nothing about # the processor, so we play safe by assuming i586. # Note: whatever this is, it MUST be the same as what config.sub - # prints for the "djgpp" host, or else GDB configury will decide that + # prints for the "djgpp" host, or else GDB configure will decide that # this is a cross-build. echo i586-pc-msdosdjgpp exit ;; @@ -1248,6 +1289,9 @@ EOF SX-8R:SUPER-UX:*:*) echo sx8r-nec-superux${UNAME_RELEASE} exit ;; + SX-ACE:SUPER-UX:*:*) + echo sxace-nec-superux${UNAME_RELEASE} + exit ;; Power*:Rhapsody:*:*) echo powerpc-apple-rhapsody${UNAME_RELEASE} exit ;; @@ -1261,16 +1305,23 @@ EOF UNAME_PROCESSOR=powerpc fi if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then - if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then + if [ "$CC_FOR_BUILD" != no_compiler_found ]; then if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \ - (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \ - grep IS_64BIT_ARCH >/dev/null + (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ + grep IS_64BIT_ARCH >/dev/null then case $UNAME_PROCESSOR in i386) UNAME_PROCESSOR=x86_64 ;; powerpc) UNAME_PROCESSOR=powerpc64 ;; esac fi + # On 10.4-10.6 one might compile for PowerPC via gcc -arch ppc + if (echo '#ifdef __POWERPC__'; echo IS_PPC; echo '#endif') | \ + (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \ + grep IS_PPC >/dev/null + then + UNAME_PROCESSOR=powerpc + fi fi elif test "$UNAME_PROCESSOR" = i386 ; then # Avoid executing cc on OS X 10.9, as it ships with a stub @@ -1285,7 +1336,7 @@ EOF exit ;; *:procnto*:*:* | *:QNX:[0123456789]*:*) UNAME_PROCESSOR=`uname -p` - if test "$UNAME_PROCESSOR" = "x86"; then + if test "$UNAME_PROCESSOR" = x86; then UNAME_PROCESSOR=i386 UNAME_MACHINE=pc fi @@ -1294,15 +1345,18 @@ EOF *:QNX:*:4*) echo i386-pc-qnx exit ;; - NEO-?:NONSTOP_KERNEL:*:*) + NEO-*:NONSTOP_KERNEL:*:*) echo neo-tandem-nsk${UNAME_RELEASE} exit ;; NSE-*:NONSTOP_KERNEL:*:*) echo nse-tandem-nsk${UNAME_RELEASE} exit ;; - NSR-?:NONSTOP_KERNEL:*:*) + NSR-*:NONSTOP_KERNEL:*:*) echo nsr-tandem-nsk${UNAME_RELEASE} exit ;; + NSX-*:NONSTOP_KERNEL:*:*) + echo nsx-tandem-nsk${UNAME_RELEASE} + exit ;; *:NonStop-UX:*:*) echo mips-compaq-nonstopux exit ;; @@ -1316,7 +1370,7 @@ EOF # "uname -m" is not consistent, so use $cputype instead. 386 # is converted to i386 for consistency with other x86 # operating systems. - if test "$cputype" = "386"; then + if test "$cputype" = 386; then UNAME_MACHINE=i386 else UNAME_MACHINE="$cputype" @@ -1358,7 +1412,7 @@ EOF echo i386-pc-xenix exit ;; i*86:skyos:*:*) - echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//' + echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'` exit ;; i*86:rdos:*:*) echo ${UNAME_MACHINE}-pc-rdos @@ -1369,23 +1423,25 @@ EOF x86_64:VMkernel:*:*) echo ${UNAME_MACHINE}-unknown-esx exit ;; + amd64:Isilon\ OneFS:*:*) + echo x86_64-unknown-onefs + exit ;; esac cat >&2 < in order to provide the needed -information to handle your system. +If $0 has already been updated, send the following data and any +information you think might be pertinent to config-patches@gnu.org to +provide the necessary information to handle your system. config.guess timestamp = $timestamp diff -pruN 0.3.3.9-1/config.rust.in 0.3.4.8-1/config.rust.in --- 0.3.3.9-1/config.rust.in 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/config.rust.in 2018-06-21 12:38:21.000000000 +0000 @@ -0,0 +1,22 @@ +# Used by our cargo build.rs script to get variables from autoconf. +# +# The "configure" script will generate "config.rust" from "config.rust.in", +# and then build.rs will read "config.rust". + +BUILDDIR=@BUILDDIR@ +TOR_LDFLAGS_zlib=@TOR_LDFLAGS_zlib@ +TOR_LDFLAGS_openssl=@TOR_LDFLAGS_openssl@ +TOR_LDFLAGS_libevent=@TOR_LDFLAGS_libevent@ +TOR_ZLIB_LIBS=@TOR_ZLIB_LIBS@ +TOR_LIB_MATH=@TOR_LIB_MATH@ +TOR_LIBEVENT_LIBS=@TOR_LIBEVENT_LIBS@ +TOR_OPENSSL_LIBS=@TOR_OPENSSL_LIBS@ +TOR_LIB_WS32=@TOR_LIB_WS32@ +TOR_LIB_GDI=@TOR_LIB_GDI@ +TOR_LIB_USERENV=@TOR_LIB_USERENV@ +CURVE25519_LIBS=@CURVE25519_LIBS@ +TOR_SYSTEMD_LIBS=@TOR_SYSTEMD_LIBS@ +TOR_LZMA_LIBS=@TOR_LZMA_LIBS@ +TOR_ZSTD_LIBS=@TOR_ZSTD_LIBS@ +LIBS=@LIBS@ +LDFLAGS=@LDFLAGS@ diff -pruN 0.3.3.9-1/config.sub 0.3.4.8-1/config.sub --- 0.3.3.9-1/config.sub 2018-07-12 17:16:59.000000000 +0000 +++ 0.3.4.8-1/config.sub 2018-06-25 18:12:07.000000000 +0000 @@ -1,8 +1,8 @@ -#! /bin/sh +#!/bin/sh # Configuration validation subroutine script. -# Copyright 1992-2014 Free Software Foundation, Inc. +# Copyright 1992-2017 Free Software Foundation, Inc. -timestamp='2014-09-11' +timestamp='2017-04-02' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -25,7 +25,7 @@ timestamp='2014-09-11' # of the GNU General Public License, version 3 ("GPLv3"). -# Please send patches with a ChangeLog entry to config-patches@gnu.org. +# Please send patches to . # # Configuration subroutine to validate and canonicalize a configuration type. # Supply the specified configuration type as an argument. @@ -33,7 +33,7 @@ timestamp='2014-09-11' # Otherwise, we print the canonical config type on stdout and succeed. # You can get the latest version of this script from: -# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD +# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases @@ -53,8 +53,7 @@ timestamp='2014-09-11' me=`echo "$0" | sed -e 's,.*/,,'` usage="\ -Usage: $0 [OPTION] CPU-MFR-OPSYS - $0 [OPTION] ALIAS +Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS Canonicalize a configuration name. @@ -68,7 +67,7 @@ Report bugs and patches to config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by tor $as_me 0.3.3.9, which was +It was created by tor $as_me 0.3.4.8, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2744,7 +2761,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu # "foreign" means we don't follow GNU package layout standards # "1.11" means we require automake version 1.11 or newer # "subdir-objects" means put .o files in the same directory as the .c files -am__api_version='1.14' +am__api_version='1.15' ac_aux_dir= for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do @@ -2965,7 +2982,7 @@ else $as_echo "$as_me: WARNING: 'missing' script is too old or missing" >&2;} fi -if test x"${install_sh}" != xset; then +if test x"${install_sh+set}" != xset; then case $am_aux_dir in *\ * | *\ *) install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;; @@ -3259,7 +3276,7 @@ fi # Define the identity of the package. PACKAGE='tor' - VERSION='0.3.3.9' + VERSION='0.3.4.8' cat >>confdefs.h <<_ACEOF @@ -3293,8 +3310,8 @@ MAKEINFO=${MAKEINFO-"${am_missing_run}ma # mkdir_p='$(MKDIR_P)' -# We need awk for the "check" target. The system "awk" is bad on -# some platforms. +# We need awk for the "check" target (and possibly the TAP driver). The +# system "awk" is bad on some platforms. # Always define AMTAR for backward compatibility. Yes, it's still used # in the wild :-( We should find a proper way to deprecate it ... AMTAR='$${TAR-tar}' @@ -5171,6 +5188,11 @@ if test "${enable_restart_debugging+set} enableval=$enable_restart_debugging; fi +# Check whether --enable-zstd-advanced-apis was given. +if test "${enable_zstd_advanced_apis+set}" = set; then : + enableval=$enable_zstd_advanced_apis; +fi + if test "x$enable_coverage" != "xyes" -a "x$enable_asserts_in_tests" = "xno" ; then as_fn_error $? "Can't disable assertions outside of coverage build" "$LINENO" 5 @@ -5284,6 +5306,11 @@ $as_echo "#define ENABLE_RESTART_DEBUGGI fi +if test "$enable_zstd_advanced_apis" != "no"; then + +$as_echo "#define ENABLE_ZSTD_ADVANCED_APIS 1" >>confdefs.h + +fi # systemd support if test "x$enable_systemd" = "xno"; then @@ -5586,6 +5613,9 @@ fi if test "x$enable_expensive_hardening" = "xyes" || test "x$enable_fragile_hardening" = "xyes"; then fragile_hardening="yes" + +$as_echo "#define DEBUG_SMARTLIST 1" >>confdefs.h + fi # Check whether --enable-linker-hardening was given. @@ -5745,6 +5775,35 @@ fi fi + + + +# Check whether --enable-module-dirauth was given. +if test "${enable_module_dirauth+set}" = set; then : + enableval=$enable_module_dirauth; +else + +$as_echo "#define HAVE_MODULE_DIRAUTH 1" >>confdefs.h + +fi + + if test "x$enable_module_dirauth" != "xno"; then + BUILD_MODULE_DIRAUTH_TRUE= + BUILD_MODULE_DIRAUTH_FALSE='#' +else + BUILD_MODULE_DIRAUTH_TRUE='#' + BUILD_MODULE_DIRAUTH_FALSE= +fi + + +TOR_MODULES_ALL_ENABLED= + + + MODULE=DIRAUTH + TOR_MODULES_ALL_ENABLED="${TOR_MODULES_ALL_ENABLED} -DHAVE_MODULE_${MODULE}=1" + + + if test -n "$ac_tool_prefix"; then for ac_prog in ar lib "link -lib" do @@ -7369,7 +7428,10 @@ else fi -rust_crates="libc-0.2.39" +rust_crates=" \ + digest-0.7.2 \ + libc-0.2.39 \ +" @@ -7835,6 +7897,8 @@ $as_echo "#define AC_APPLE_UNIVERSAL_BUI esac + + if test "x$enable_rust" = "xyes"; then # Extract the first word of "rustc", so it can be a program name with args. @@ -7925,6 +7989,11 @@ fi $as_echo "#define HAVE_RUST 1" >>confdefs.h + if test "x$enable_fatal_warnings" = "xyes"; then + RUST_WARN= + else + RUST_WARN=# + fi if test "x$enable_cargo_online_mode" = "xyes"; then CARGO_ONLINE= RUST_DL=# @@ -7963,13 +8032,31 @@ $as_echo "yes" >&6; } esac if test "$bwin32" = "true"; then - TOR_RUST_STATIC_NAME=tor_rust.lib + tor_rust_static_name=tor_rust.lib else - TOR_RUST_STATIC_NAME=libtor_rust.a + tor_rust_static_name=libtor_rust.a fi + if test -n "$TOR_RUST_TARGET"; then + if test "$host" = "$build"; then + as_fn_error $? "HOST = BUILD is invalid if TOR_RUST_TARGET is specified, see configure --help for more information." "$LINENO" 5 + fi + RUST_TARGET_PROP="target = '$TOR_RUST_TARGET'" + TOR_RUST_LIB_PATH="src/rust/target/$TOR_RUST_TARGET/release/$tor_rust_static_name" + else + if test "$host" != "$build"; then + as_fn_error $? "TOR_RUST_TARGET must be specified when cross-compiling with Rust enabled." "$LINENO" 5 + fi + RUST_TARGET_PROP= + TOR_RUST_LIB_PATH="src/rust/target/release/$tor_rust_static_name" + fi + + + + + { $as_echo "$as_me:${as_lineno-$LINENO}: checking rust version" >&5 @@ -8331,7 +8418,8 @@ if test "$LIBS" != "$saved_LIBS"; then have_rt=yes fi -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing pthread_create" >&5 +if test "$bwin32" = "false"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing pthread_create" >&5 $as_echo_n "checking for library containing pthread_create... " >&6; } if ${ac_cv_search_pthread_create+:} false; then : $as_echo_n "(cached) " >&6 @@ -8387,7 +8475,7 @@ if test "$ac_res" != no; then : fi -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing pthread_detach" >&5 + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing pthread_detach" >&5 $as_echo_n "checking for library containing pthread_detach... " >&6; } if ${ac_cv_search_pthread_detach+:} false; then : $as_echo_n "(cached) " >&6 @@ -8443,6 +8531,7 @@ if test "$ac_res" != no; then : fi +fi if test "$bwin32" = "true"; then THREADS_WIN32_TRUE= @@ -8487,9 +8576,9 @@ for ac_func in _NSGetEnviron \ llround \ localtime_r \ lround \ - mach_approximate_time \ memmem \ memset_s \ + mmap \ pipe \ pipe2 \ prctl \ @@ -8524,9 +8613,63 @@ fi done -# Apple messed up when they added two functions functions in Sierra: they +# Apple messed up when they added some functions: they # forgot to decorate them with appropriate AVAILABLE_MAC_OS_VERSION -# checks. So we should only probe for those functions if we are sure that we +# checks. + +# We should only probe for these functions if we are sure that we +# are not targeting OS X 10.9 or earlier. +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a pre-Yosemite OS X build target" >&5 +$as_echo_n "checking for a pre-Yosemite OS X build target... " >&6; } +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +#ifdef __APPLE__ +# include +# ifndef MAC_OS_X_VERSION_10_10 +# define MAC_OS_X_VERSION_10_10 101000 +# endif +# if defined(MAC_OS_X_VERSION_MIN_REQUIRED) +# if MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_10 +# error "Running on Mac OS X 10.9 or earlier" +# endif +# endif +#endif + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + on_macos_pre_10_10=no ; { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +else + on_macos_pre_10_10=yes; { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + +if test "$on_macos_pre_10_10" = "no"; then + for ac_func in mach_approximate_time \ + +do : + as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` +ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" +if eval test \"x\$"$as_ac_var"\" = x"yes"; then : + cat >>confdefs.h <<_ACEOF +#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 +_ACEOF + +fi +done + +fi + +# We should only probe for these functions if we are sure that we # are not targeting OSX 10.11 or earlier. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a pre-Sierra OSX build target" >&5 $as_echo_n "checking for a pre-Sierra OSX build target... " >&6; } @@ -8659,6 +8802,44 @@ else fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether free(NULL) works" >&5 +$as_echo_n "checking whether free(NULL) works... " >&6; } +if test "$cross_compiling" = yes; then : + free_null_ok=cross; { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross" >&5 +$as_echo "cross" >&6; } +else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + + #include + +int +main () +{ + +char *p = NULL; +free(p); + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_run "$LINENO"; then : + free_null_ok=true; { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } +else + free_null_ok=false; { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +fi +rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ + conftest.$ac_objext conftest.beam conftest.$ac_ext +fi + + +if test "$free_null_ok" = "false"; then + as_fn_error $? "Your libc implementation doesn't allow free(NULL), as required by C99." "$LINENO" 5 +fi + if test "$bwin32" = "true"; then TOR_LIB_WS32=-lws2_32 @@ -9394,11 +9575,13 @@ else # the binary? cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -struct ssl_method_st; const struct ssl_method_st *TLSv1_1_method(void); +struct ssl_cipher_st; + unsigned SSL_CIPHER_get_id(const struct ssl_cipher_st *); + char *getenv(const char *); int main () { -TLSv1_1_method(); + if (getenv("THIS_SHOULDNT_BE_SET_X201803")) SSL_CIPHER_get_id((void *)0); ; return 0; } @@ -9417,10 +9600,11 @@ rm -f core conftest.err conftest.$ac_obj cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include + char *getenv(const char *); int main () { -TLSv1_1_method(); + if (getenv("THIS_SHOULDNT_BE_SET_X201803")) SSL_CIPHER_get_id((void *)0); ; return 0; } @@ -9602,11 +9786,13 @@ rm -f core conftest.err conftest.$ac_obj else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -struct ssl_method_st; const struct ssl_method_st *TLSv1_1_method(void); +struct ssl_cipher_st; + unsigned SSL_CIPHER_get_id(const struct ssl_cipher_st *); + char *getenv(const char *); int main () { -TLSv1_1_method(); + if (getenv("THIS_SHOULDNT_BE_SET_X201803")) SSL_CIPHER_get_id((void *)0); ; return 0; } @@ -9733,6 +9919,7 @@ for ac_func in \ SSL_get_client_ciphers \ SSL_get_client_random \ SSL_CIPHER_find \ + SSL_CTX_set_security_level \ TLS_method do : @@ -9773,6 +9960,43 @@ _ACEOF fi +# The cast to long int works around a bug in the HP C Compiler +# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects +# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'. +# This bug is HP SR number 8606223364. +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of SHA_CTX" >&5 +$as_echo_n "checking size of SHA_CTX... " >&6; } +if ${ac_cv_sizeof_SHA_CTX+:} false; then : + $as_echo_n "(cached) " >&6 +else + if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (SHA_CTX))" "ac_cv_sizeof_SHA_CTX" "$ac_includes_default +#include + +"; then : + +else + if test "$ac_cv_type_SHA_CTX" = yes; then + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error 77 "cannot compute sizeof (SHA_CTX) +See \`config.log' for more details" "$LINENO" 5; } + else + ac_cv_sizeof_SHA_CTX=0 + fi +fi + +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_SHA_CTX" >&5 +$as_echo "$ac_cv_sizeof_SHA_CTX" >&6; } + + + +cat >>confdefs.h <<_ACEOF +#define SIZEOF_SHA_CTX $ac_cv_sizeof_SHA_CTX +_ACEOF + + + ac_fn_c_check_member "$LINENO" "struct tcp_info" "tcpi_unacked" "ac_cv_member_struct_tcp_info_tcpi_unacked" "#include @@ -10375,6 +10599,26 @@ $as_echo "#define HAVE_ZSTD 1" >>confdef TOR_ZSTD_CFLAGS="${ZSTD_CFLAGS}" TOR_ZSTD_LIBS="${ZSTD_LIBS}" + + save_LIBS="$LIBS" + save_CFLAGS="$CFLAGS" + LIBS="$LIBS $ZSTD_LIBS" + CFLAGS="$CFLAGS $ZSTD_CFLAGS" + for ac_func in ZSTD_estimateCStreamSize \ + ZSTD_estimateDCtxSize +do : + as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` +ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" +if eval test \"x\$"$as_ac_var"\" = x"yes"; then : + cat >>confdefs.h <<_ACEOF +#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 +_ACEOF + +fi +done + + LIBS="$save_LIBS" + CFLAGS="$save_CFLAGS" fi @@ -11206,6 +11450,24 @@ $as_echo "$tor_cv_cflags__fno_omit_frame fi +RUST_LINKER_OPTIONS="" +if test "x$have_clang" = "xyes"; then + if test "x$CFLAGS_ASAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS $CFLAGS_ASAN" + fi + if test "x$CFLAGS_UBSAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS $CFLAGS_UBSAN" + fi +else + if test "x$CFLAGS_ASAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS -lasan" + fi + if test "x$CFLAGS_UBSAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS -lubsan" + fi +fi + + CFLAGS_BUGTRAP="$CFLAGS_FTRAPV $CFLAGS_ASAN $CFLAGS_UBSAN" CFLAGS_CONSTTIME="$CFLAGS_FWRAPV" @@ -11914,7 +12176,7 @@ else We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -11960,7 +12222,7 @@ else We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -11984,7 +12246,7 @@ rm -f core conftest.err conftest.$ac_obj We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -12029,7 +12291,7 @@ else We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -12053,7 +12315,7 @@ rm -f core conftest.err conftest.$ac_obj We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ -#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31)) +#define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; @@ -13663,6 +13925,44 @@ _ACEOF +# Let's see if stdatomic works. (There are some debian clangs that screw it +# up; see Tor bug #26779 and debian bug 903709.) +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C11 stdatomic.h actually works" >&5 +$as_echo_n "checking whether C11 stdatomic.h actually works... " >&6; } +if ${tor_cv_stdatomic_works+:} false; then : + $as_echo_n "(cached) " >&6 +else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +#include +struct x { atomic_size_t y; }; +void try_atomic_init(struct x *xx) +{ + atomic_init(&xx->y, 99); + atomic_fetch_add(&xx->y, 1); +} + +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + tor_cv_stdatomic_works=yes +else + tor_cv_stdatomic_works=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $tor_cv_stdatomic_works" >&5 +$as_echo "$tor_cv_stdatomic_works" >&6; } + +if test "$tor_cv_stdatomic_works" = "yes"; then + +$as_echo "#define STDATOMIC_WORKS 1" >>confdefs.h + +elif test "$ac_cv_header_stdatomic_h" = "yes"; then + { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Your compiler provides the stdatomic.h header, but it doesn't seem to work. I'll pretend it isn't there. If you are using Clang on Debian, maybe this is because of https://bugs.debian.org/903709 " >&5 +$as_echo "$as_me: WARNING: Your compiler provides the stdatomic.h header, but it doesn't seem to work. I'll pretend it isn't there. If you are using Clang on Debian, maybe this is because of https://bugs.debian.org/903709 " >&2;} +fi + # Now make sure that NULL can be represented as zero bytes. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether memset(0) sets pointers to NULL" >&5 $as_echo_n "checking whether memset(0) sets pointers to NULL... " >&6; } @@ -14050,6 +14350,72 @@ fi done fi +if test "$using_custom_malloc" = "yes"; then + # Tell the C compiler not to use the system allocator functions. + + + + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the compiler accepts -fno-builtin-malloc -fno-builtin-realloc -fno-builtin-calloc -fno-builtin-free" >&5 +$as_echo_n "checking whether the compiler accepts -fno-builtin-malloc -fno-builtin-realloc -fno-builtin-calloc -fno-builtin-free... " >&6; } +if ${tor_cv_cflags__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free+:} false; then : + $as_echo_n "(cached) " >&6 +else + + tor_saved_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS -pedantic -Werror -fno-builtin-malloc -fno-builtin-realloc -fno-builtin-calloc -fno-builtin-free" + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + tor_cv_cflags__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free=yes +else + tor_cv_cflags__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + if test x != x; then + + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + tor_can_link__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free=yes +else + tor_can_link__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext + + fi + CFLAGS="$tor_saved_CFLAGS" + +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $tor_cv_cflags__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free" >&5 +$as_echo "$tor_cv_cflags__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free" >&6; } + if test x$tor_cv_cflags__fno_builtin_malloc__fno_builtin_realloc__fno_builtin_calloc__fno_builtin_free = xyes; then + CFLAGS="$CFLAGS -fno-builtin-malloc -fno-builtin-realloc -fno-builtin-calloc -fno-builtin-free" + else + true + fi + + + +fi # By default, we're going to assume we don't have mlockall() # bionic and other platforms have various broken mlockall subsystems. @@ -14082,25 +14448,6 @@ cat >>confdefs.h <<_ACEOF _ACEOF -# Some MinGW environments don't have getpagesize in unistd.h. We don't use -# AC_CHECK_FUNCS(getpagesize), because other environments rename getpagesize -# using macros -ac_fn_c_check_decl "$LINENO" "getpagesize" "ac_cv_have_decl_getpagesize" " -#ifdef HAVE_UNISTD_H -#include -#endif -" -if test "x$ac_cv_have_decl_getpagesize" = xyes; then : - ac_have_decl=1 -else - ac_have_decl=0 -fi - -cat >>confdefs.h <<_ACEOF -#define HAVE_DECL_GETPAGESIZE $ac_have_decl -_ACEOF - - # Allow user to specify an alternate syslog facility # Check whether --with-syslog-facility was given. @@ -14381,6 +14728,15 @@ cat >>confdefs.h <<_ACEOF _ACEOF +if test "x$SRCDIR" = "x"; then + SRCDIR=$(cd "$srcdir"; pwd) +fi + +cat >>confdefs.h <<_ACEOF +#define SRCDIR "$SRCDIR" +_ACEOF + + if test "x$CONFDIR" = "x"; then CONFDIR=`eval echo $sysconfdir/tor` fi @@ -27279,6 +27635,11 @@ $as_echo "#define HAVE_CFLAG_WNULL_DEREF $as_echo "#define HAVE_CFLAG_WOVERLENGTH_STRINGS 1" >>confdefs.h fi + if test "$tor_cv_cflags__warn_unused_const_variable_2" = "yes"; then + +$as_echo "#define HAVE_CFLAG_WUNUSED_CONST_VARIABLE 1" >>confdefs.h + + fi if test "x$enable_fatal_warnings" = "xyes"; then # I'd like to use TOR_CHECK_CFLAGS here, but I can't, since the @@ -27298,7 +27659,7 @@ fi CPPFLAGS="$CPPFLAGS $TOR_CPPFLAGS_libevent $TOR_CPPFLAGS_openssl $TOR_CPPFLAGS_zlib" -ac_config_files="$ac_config_files Doxyfile Makefile contrib/dist/suse/tor.sh contrib/operator-tools/tor.logrotate contrib/dist/tor.sh contrib/dist/torctl contrib/dist/tor.service src/config/torrc.sample src/config/torrc.minimal src/rust/.cargo/config scripts/maint/checkOptionDocs.pl scripts/maint/updateVersions.pl" +ac_config_files="$ac_config_files Doxyfile Makefile config.rust link_rust.sh contrib/dist/suse/tor.sh contrib/operator-tools/tor.logrotate contrib/dist/tor.sh contrib/dist/torctl contrib/dist/tor.service src/config/torrc.sample src/config/torrc.minimal src/rust/.cargo/config scripts/maint/checkOptionDocs.pl scripts/maint/updateVersions.pl" if test "x$asciidoc" = "xtrue" && test "$ASCIIDOC" = "none"; then @@ -27515,6 +27876,10 @@ if test -z "${USE_ANDROID_TRUE}" && test as_fn_error $? "conditional \"USE_ANDROID\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 fi +if test -z "${BUILD_MODULE_DIRAUTH_TRUE}" && test -z "${BUILD_MODULE_DIRAUTH_FALSE}"; then + as_fn_error $? "conditional \"BUILD_MODULE_DIRAUTH\" was never defined. +Usually this means the macro was only invoked conditionally." "$LINENO" 5 +fi if test -z "${am__fastdepCC_TRUE}" && test -z "${am__fastdepCC_FALSE}"; then as_fn_error $? "conditional \"am__fastdepCC\" was never defined. Usually this means the macro was only invoked conditionally." "$LINENO" 5 @@ -27961,7 +28326,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by tor $as_me 0.3.3.9, which was +This file was extended by tor $as_me 0.3.4.8, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -28027,7 +28392,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -tor config.status 0.3.3.9 +tor config.status 0.3.4.8 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" @@ -28160,6 +28525,8 @@ do "depfiles") CONFIG_COMMANDS="$CONFIG_COMMANDS depfiles" ;; "Doxyfile") CONFIG_FILES="$CONFIG_FILES Doxyfile" ;; "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; + "config.rust") CONFIG_FILES="$CONFIG_FILES config.rust" ;; + "link_rust.sh") CONFIG_FILES="$CONFIG_FILES link_rust.sh" ;; "contrib/dist/suse/tor.sh") CONFIG_FILES="$CONFIG_FILES contrib/dist/suse/tor.sh" ;; "contrib/operator-tools/tor.logrotate") CONFIG_FILES="$CONFIG_FILES contrib/operator-tools/tor.logrotate" ;; "contrib/dist/tor.sh") CONFIG_FILES="$CONFIG_FILES contrib/dist/tor.sh" ;; diff -pruN 0.3.3.9-1/configure.ac 0.3.4.8-1/configure.ac --- 0.3.3.9-1/configure.ac 2018-07-13 18:25:23.000000000 +0000 +++ 0.3.4.8-1/configure.ac 2018-09-07 13:49:53.000000000 +0000 @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2017, The Tor Pro dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.3.9]) +AC_INIT([tor],[0.3.4.8]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) @@ -61,6 +61,8 @@ AC_ARG_ENABLE(cargo-online-mode, AS_HELP_STRING(--enable-cargo-online-mode, [Allow cargo to make network requests to fetch crates. For builds with rust only.])) AC_ARG_ENABLE(restart-debugging, AS_HELP_STRING(--enable-restart-debugging, [Build Tor with support for debugging in-process restart. Developers only.])) +AC_ARG_ENABLE(zstd-advanced-apis, + AS_HELP_STRING(--disable-zstd-advanced-apis, [Build without support for zstd's "static-only" APIs.])) if test "x$enable_coverage" != "xyes" -a "x$enable_asserts_in_tests" = "xno" ; then AC_MSG_ERROR([Can't disable assertions outside of coverage build]) @@ -114,6 +116,10 @@ if test "$enable_restart_debugging" = "y [Defined if we're building with support for in-process restart debugging.]) fi +if test "$enable_zstd_advanced_apis" != "no"; then + AC_DEFINE(ENABLE_ZSTD_ADVANCED_APIS, 1, + [Defined if we're going to try to use zstd's "static-only" APIs.]) +fi # systemd support if test "x$enable_systemd" = "xno"; then @@ -170,6 +176,7 @@ AC_ARG_ENABLE(fragile-hardening, AS_HELP_STRING(--enable-fragile-hardening, [enable more fragile and expensive compiler hardening; makes Tor slower])) if test "x$enable_expensive_hardening" = "xyes" || test "x$enable_fragile_hardening" = "xyes"; then fragile_hardening="yes" + AC_DEFINE(DEBUG_SMARTLIST, 1, [Enable smartlist debugging]) fi dnl Linker hardening options @@ -224,6 +231,31 @@ if test "x$enable_android" = "xyes"; the fi +dnl --- +dnl Tor modules options. These options are namespaced with --disable-module-XXX +dnl --- + +dnl All our modules. +m4_define(MODULES, dirauth) + +dnl Directory Authority module. +AC_ARG_ENABLE([module-dirauth], + AS_HELP_STRING([--disable-module-dirauth], + [Do not build tor with the dirauth module]), + [], dnl Action if-given + AC_DEFINE([HAVE_MODULE_DIRAUTH], [1], + [Compile with Directory Authority feature support])) +AM_CONDITIONAL(BUILD_MODULE_DIRAUTH, [test "x$enable_module_dirauth" != "xno"]) + +dnl Helper variables. +TOR_MODULES_ALL_ENABLED= +AC_DEFUN([ADD_MODULE], [ + MODULE=m4_toupper($1) + TOR_MODULES_ALL_ENABLED="${TOR_MODULES_ALL_ENABLED} -DHAVE_MODULE_${MODULE}=1" +]) +m4_foreach_w([module], MODULES, [ADD_MODULE([module])]) +AC_SUBST(TOR_MODULES_ALL_ENABLED) + dnl check for the correct "ar" when cross-compiling. dnl (AM_PROG_AR was new in automake 1.11.2, which we do not yet require, dnl so kludge up a replacement for the case where it isn't there yet.) @@ -279,7 +311,10 @@ fi AM_CONDITIONAL(USEPYTHON, [test "x$PYTHON" != "x"]) dnl List all external rust crates we depend on here. Include the version -rust_crates="libc-0.2.39" +rust_crates=" \ + digest-0.7.2 \ + libc-0.2.39 \ +" AC_SUBST(rust_crates) ifdef([AC_C_FLEXIBLE_ARRAY_MEMBER], [ @@ -418,6 +453,8 @@ fi AC_C_BIGENDIAN +AC_ARG_VAR([TOR_RUST_TARGET], [Rust target, must be specified when cross-compiling (HOST != BUILD). example: i686-pc-windows-gnu]) + if test "x$enable_rust" = "xyes"; then AC_ARG_VAR([RUSTC], [path to the rustc binary]) AC_CHECK_PROG([RUSTC], [rustc], [rustc],[no]) @@ -432,6 +469,11 @@ if test "x$enable_rust" = "xyes"; then fi AC_DEFINE([HAVE_RUST], 1, [have Rust]) + if test "x$enable_fatal_warnings" = "xyes"; then + RUST_WARN= + else + RUST_WARN=# + fi if test "x$enable_cargo_online_mode" = "xyes"; then CARGO_ONLINE= RUST_DL=# @@ -478,13 +520,31 @@ if test "x$enable_rust" = "xyes"; then dnl For now both MSVC and MinGW rust libraries will output static libs with dnl the MSVC naming convention. if test "$bwin32" = "true"; then - TOR_RUST_STATIC_NAME=tor_rust.lib + tor_rust_static_name=tor_rust.lib else - TOR_RUST_STATIC_NAME=libtor_rust.a + tor_rust_static_name=libtor_rust.a fi - AC_SUBST(TOR_RUST_STATIC_NAME) + AC_CANONICAL_BUILD + + if test -n "$TOR_RUST_TARGET"; then + if test "$host" = "$build"; then + AC_MSG_ERROR([HOST = BUILD is invalid if TOR_RUST_TARGET is specified, see configure --help for more information.]) + fi + RUST_TARGET_PROP="target = '$TOR_RUST_TARGET'" + TOR_RUST_LIB_PATH="src/rust/target/$TOR_RUST_TARGET/release/$tor_rust_static_name" + else + if test "$host" != "$build"; then + AC_MSG_ERROR([TOR_RUST_TARGET must be specified when cross-compiling with Rust enabled.]) + fi + RUST_TARGET_PROP= + TOR_RUST_LIB_PATH="src/rust/target/release/$tor_rust_static_name" + fi + + AC_SUBST(RUST_TARGET_PROP) + AC_SUBST(TOR_RUST_LIB_PATH) AC_SUBST(CARGO_ONLINE) + AC_SUBST(RUST_WARN) AC_SUBST(RUST_DL) dnl Let's check the rustc version, too @@ -515,8 +575,10 @@ if test "$LIBS" != "$saved_LIBS"; then have_rt=yes fi -AC_SEARCH_LIBS(pthread_create, [pthread]) -AC_SEARCH_LIBS(pthread_detach, [pthread]) +if test "$bwin32" = "false"; then + AC_SEARCH_LIBS(pthread_create, [pthread]) + AC_SEARCH_LIBS(pthread_detach, [pthread]) +fi AM_CONDITIONAL(THREADS_WIN32, test "$bwin32" = "true") AM_CONDITIONAL(THREADS_PTHREADS, test "$bwin32" = "false") @@ -548,9 +610,9 @@ AC_CHECK_FUNCS( llround \ localtime_r \ lround \ - mach_approximate_time \ memmem \ memset_s \ + mmap \ pipe \ pipe2 \ prctl \ @@ -574,9 +636,36 @@ AC_CHECK_FUNCS( _vscprintf ) -# Apple messed up when they added two functions functions in Sierra: they +# Apple messed up when they added some functions: they # forgot to decorate them with appropriate AVAILABLE_MAC_OS_VERSION -# checks. So we should only probe for those functions if we are sure that we +# checks. + +# We should only probe for these functions if we are sure that we +# are not targeting OS X 10.9 or earlier. +AC_MSG_CHECKING([for a pre-Yosemite OS X build target]) +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ +#ifdef __APPLE__ +# include +# ifndef MAC_OS_X_VERSION_10_10 +# define MAC_OS_X_VERSION_10_10 101000 +# endif +# if defined(MAC_OS_X_VERSION_MIN_REQUIRED) +# if MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_10 +# error "Running on Mac OS X 10.9 or earlier" +# endif +# endif +#endif +]], [[]])], + [on_macos_pre_10_10=no ; AC_MSG_RESULT([no])], + [on_macos_pre_10_10=yes; AC_MSG_RESULT([yes])]) + +if test "$on_macos_pre_10_10" = "no"; then + AC_CHECK_FUNCS( + mach_approximate_time \ + ) +fi + +# We should only probe for these functions if we are sure that we # are not targeting OSX 10.11 or earlier. AC_MSG_CHECKING([for a pre-Sierra OSX build target]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ @@ -619,6 +708,21 @@ fi AM_CONDITIONAL(BUILD_READPASSPHRASE_C, test "x$ac_cv_func_readpassphrase" = "xno" && test "$bwin32" = "false") +AC_MSG_CHECKING([whether free(NULL) works]) +AC_RUN_IFELSE([AC_LANG_PROGRAM([ + #include +], [ +char *p = NULL; +free(p); +])], +[free_null_ok=true; AC_MSG_RESULT(yes)], +[free_null_ok=false; AC_MSG_RESULT(no)], +[free_null_ok=cross; AC_MSG_RESULT(cross)]) + +if test "$free_null_ok" = "false"; then + AC_MSG_ERROR([Your libc implementation doesn't allow free(NULL), as required by C99.]) +fi + dnl ------------------------------------------------------ dnl Where do you live, libevent? And how do we call you? @@ -770,9 +874,18 @@ AC_ARG_WITH(ssl-dir, AC_MSG_NOTICE([Now, we'll look for OpenSSL >= 1.0.1]) TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI $TOR_LIB_WS32], - [#include ], - [struct ssl_method_st; const struct ssl_method_st *TLSv1_1_method(void);], - [TLSv1_1_method();], [], + [#include + char *getenv(const char *);], + [struct ssl_cipher_st; + unsigned SSL_CIPHER_get_id(const struct ssl_cipher_st *); + char *getenv(const char *);], + dnl This funny-looking test program calls getenv, so that the compiler + dnl will neither make code that call SSL_CIPHER_get_id(NULL) [producing + dnl a crash], nor optimize out the call to SSL_CIPHER_get_id(). + dnl We look for SSL_cipher_get_id() because it is present in + dnl OpenSSL >=1.0.1, because it is not deprecated, and because Tor + dnl depends on it. + [if (getenv("THIS_SHOULDNT_BE_SET_X201803")) SSL_CIPHER_get_id((void *)0);], [], [/usr/local/opt/openssl /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /opt/openssl]) dnl XXXX check for OPENSSL_VERSION_NUMBER == SSLeay() @@ -828,6 +941,7 @@ AC_CHECK_FUNCS([ \ SSL_get_client_ciphers \ SSL_get_client_random \ SSL_CIPHER_find \ + SSL_CTX_set_security_level \ TLS_method ]) @@ -839,6 +953,10 @@ AC_CHECK_MEMBERS([SSL.state], , , [#include ]) +AC_CHECK_SIZEOF(SHA_CTX, , [AC_INCLUDES_DEFAULT() +#include +]) + dnl Define the set of checks for KIST scheduler support. AC_DEFUN([CHECK_KIST_SUPPORT],[ dnl KIST needs struct tcp_info and for certain members to exist. @@ -957,6 +1075,16 @@ if test "x$have_zstd" = "xyes"; then AC_DEFINE(HAVE_ZSTD,1,[Have Zstd]) TOR_ZSTD_CFLAGS="${ZSTD_CFLAGS}" TOR_ZSTD_LIBS="${ZSTD_LIBS}" + + dnl now check for zstd functions + save_LIBS="$LIBS" + save_CFLAGS="$CFLAGS" + LIBS="$LIBS $ZSTD_LIBS" + CFLAGS="$CFLAGS $ZSTD_CFLAGS" + AC_CHECK_FUNCS(ZSTD_estimateCStreamSize \ + ZSTD_estimateDCtxSize) + LIBS="$save_LIBS" + CFLAGS="$save_CFLAGS" fi AC_SUBST(TOR_ZSTD_CFLAGS) AC_SUBST(TOR_ZSTD_LIBS) @@ -1042,6 +1170,33 @@ if test "$fragile_hardening" = "yes"; th TOR_CHECK_CFLAGS([-fno-omit-frame-pointer]) fi +dnl Find the correct libraries to add in order to use the sanitizers. +dnl +dnl When building Rust, Cargo will run the linker with the -nodefaultlibs +dnl option, which will prevent the compiler from linking the sanitizer +dnl libraries it needs. We need to specify them manually. +dnl +dnl What's more, we need to specify them in a linker script rather than +dnl from build.rs: these options aren't allowed in the cargo:rustc-flags +dnl variable. +RUST_LINKER_OPTIONS="" +if test "x$have_clang" = "xyes"; then + if test "x$CFLAGS_ASAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS $CFLAGS_ASAN" + fi + if test "x$CFLAGS_UBSAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS $CFLAGS_UBSAN" + fi +else + if test "x$CFLAGS_ASAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS -lasan" + fi + if test "x$CFLAGS_UBSAN" != "x"; then + RUST_LINKER_OPTIONS="$RUST_LINKER_OPTIONS -lubsan" + fi +fi +AC_SUBST(RUST_LINKER_OPTIONS) + CFLAGS_BUGTRAP="$CFLAGS_FTRAPV $CFLAGS_ASAN $CFLAGS_UBSAN" CFLAGS_CONSTTIME="$CFLAGS_FWRAPV" @@ -1531,6 +1686,26 @@ AC_CHECK_SIZEOF(socklen_t, , [AC_INCLUDE AC_CHECK_SIZEOF(cell_t) +# Let's see if stdatomic works. (There are some debian clangs that screw it +# up; see Tor bug #26779 and debian bug 903709.) +AC_CACHE_CHECK([whether C11 stdatomic.h actually works], + tor_cv_stdatomic_works, +[AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ +#include +struct x { atomic_size_t y; }; +void try_atomic_init(struct x *xx) +{ + atomic_init(&xx->y, 99); + atomic_fetch_add(&xx->y, 1); +} +]])], [tor_cv_stdatomic_works=yes], [tor_cv_stdatomic_works=no])]) + +if test "$tor_cv_stdatomic_works" = "yes"; then + AC_DEFINE(STDATOMIC_WORKS, 1, [Set to 1 if we can compile a simple stdatomic example.]) +elif test "$ac_cv_header_stdatomic_h" = "yes"; then + AC_MSG_WARN([Your compiler provides the stdatomic.h header, but it doesn't seem to work. I'll pretend it isn't there. If you are using Clang on Debian, maybe this is because of https://bugs.debian.org/903709 ]) +fi + # Now make sure that NULL can be represented as zero bytes. AC_CACHE_CHECK([whether memset(0) sets pointers to NULL], tor_cv_null_is_zero, [AC_RUN_IFELSE([AC_LANG_SOURCE( @@ -1698,6 +1873,10 @@ fi if test "$using_custom_malloc" = "no"; then AC_CHECK_FUNCS(mallinfo) fi +if test "$using_custom_malloc" = "yes"; then + # Tell the C compiler not to use the system allocator functions. + TOR_CHECK_CFLAGS([-fno-builtin-malloc -fno-builtin-realloc -fno-builtin-calloc -fno-builtin-free]) +fi # By default, we're going to assume we don't have mlockall() # bionic and other platforms have various broken mlockall subsystems. @@ -1709,14 +1888,6 @@ AC_CHECK_DECLS([mlockall], , , [ #include #endif]) -# Some MinGW environments don't have getpagesize in unistd.h. We don't use -# AC_CHECK_FUNCS(getpagesize), because other environments rename getpagesize -# using macros -AC_CHECK_DECLS([getpagesize], , , [ -#ifdef HAVE_UNISTD_H -#include -#endif]) - # Allow user to specify an alternate syslog facility AC_ARG_WITH(syslog-facility, AS_HELP_STRING(--with-syslog-facility=LOG, [syslog facility to use (default=LOG_DAEMON)]), @@ -1854,6 +2025,12 @@ AC_SUBST(BUILDDIR) AH_TEMPLATE([BUILDDIR],[tor's build directory]) AC_DEFINE_UNQUOTED(BUILDDIR,"$BUILDDIR") +if test "x$SRCDIR" = "x"; then + SRCDIR=$(cd "$srcdir"; pwd) +fi +AH_TEMPLATE([SRCDIR],[tor's sourcedir directory]) +AC_DEFINE_UNQUOTED(SRCDIR,"$SRCDIR") + if test "x$CONFDIR" = "x"; then CONFDIR=`eval echo $sysconfdir/tor` fi @@ -2172,6 +2349,9 @@ dnl -Wthread-safety-precise if test "$tor_cv_cflags__Woverlength_strings" = "yes"; then AC_DEFINE([HAVE_CFLAG_WOVERLENGTH_STRINGS], 1, [True if we have -Woverlength-strings]) fi + if test "$tor_cv_cflags__warn_unused_const_variable_2" = "yes"; then + AC_DEFINE([HAVE_CFLAG_WUNUSED_CONST_VARIABLE], 1, [True if we have -Wunused-const-variable]) + fi if test "x$enable_fatal_warnings" = "xyes"; then # I'd like to use TOR_CHECK_CFLAGS here, but I can't, since the @@ -2193,6 +2373,8 @@ CPPFLAGS="$CPPFLAGS $TOR_CPPFLAGS_libeve AC_CONFIG_FILES([ Doxyfile Makefile + config.rust + link_rust.sh contrib/dist/suse/tor.sh contrib/operator-tools/tor.logrotate contrib/dist/tor.sh diff -pruN 0.3.3.9-1/contrib/win32build/tor-mingw.nsi.in 0.3.4.8-1/contrib/win32build/tor-mingw.nsi.in --- 0.3.3.9-1/contrib/win32build/tor-mingw.nsi.in 2018-07-13 18:25:23.000000000 +0000 +++ 0.3.4.8-1/contrib/win32build/tor-mingw.nsi.in 2018-09-07 13:49:53.000000000 +0000 @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.3.8-dev" +!define VERSION "0.3.4.8" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff -pruN 0.3.3.9-1/CONTRIBUTING 0.3.4.8-1/CONTRIBUTING --- 0.3.3.9-1/CONTRIBUTING 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/CONTRIBUTING 2018-06-15 21:20:53.000000000 +0000 @@ -0,0 +1,39 @@ +Contributing to Tor +------------------- + +### Getting started + +Welcome! + +We have a bunch of documentation about how to develop Tor in the +doc/HACKING/ directory. We recommend that you start with +doc/HACKING/README.1st.md , and then go from there. It will tell +you how to find your way around the source code, how to get +involved with the Tor community, how to write patches, and much +more! + +You don't have to be a C developer to help with Tor: have a look +at https://www.torproject.org/getinvolved/volunteer ! + +The Tor Project is committed to fostering a inclusive community +where people feel safe to engage, share their points of view, and +participate. For the latest version of our Code of Conduct, please +see + +https://gitweb.torproject.org/community/policies.git/plain/code_of_conduct.txt + + + +### License issues + +Tor is distributed under the license terms in the LICENSE -- in +brief, the "3-clause BSD license". If you send us code to +distribute with Tor, it needs to be code that we can distribute +under those terms. Please don't send us patches unless you agree +to allow this. + +Some compatible licenses include: + + - 3-clause BSD + - 2-clause BSD + - CC0 Public Domain Dedication diff -pruN 0.3.3.9-1/debian/changelog 0.3.4.8-1/debian/changelog --- 0.3.3.9-1/debian/changelog 2018-09-12 16:45:29.000000000 +0000 +++ 0.3.4.8-1/debian/changelog 2018-09-12 16:45:30.000000000 +0000 @@ -1,28 +1,57 @@ -tor (0.3.3.9-1) unstable; urgency=medium +tor (0.3.4.8-1) unstable; urgency=medium + + * New upstream version, upload 0.3.4.x tree to unstable. + * Includes, among other changes: + - Tell OpenSSL to maintain backward compatibility with previous + RSA1024/DH1024 users in Tor. With OpenSSL 1.1.1-pre6, these + ciphers are disabled by default. Closes ticket 27344. + closes: #907351 + + -- Peter Palfrader Tue, 11 Sep 2018 14:23:51 +0200 + +tor (0.3.4.7-rc-1) experimental; urgency=medium + + * New upstream version. + + -- Peter Palfrader Fri, 24 Aug 2018 23:42:51 +0200 + +tor (0.3.4.6-rc-1) experimental; urgency=medium + + * New upstream version. + + -- Peter Palfrader Wed, 08 Aug 2018 08:38:06 +0200 + +tor (0.3.4.5-rc-1) experimental; urgency=medium + + * New upstream version. + + -- Peter Palfrader Sat, 14 Jul 2018 01:37:14 +0200 + +tor (0.3.4.4-rc-1) experimental; urgency=medium * New upstream version. - -- Peter Palfrader Fri, 13 Jul 2018 22:24:19 +0200 + -- Peter Palfrader Tue, 10 Jul 2018 14:19:16 +0200 -tor (0.3.3.8-1) unstable; urgency=medium +tor (0.3.4.3-alpha-1) experimental; urgency=medium * New upstream version. - -- Peter Palfrader Tue, 10 Jul 2018 10:50:11 +0200 + -- Peter Palfrader Tue, 26 Jun 2018 18:22:48 +0200 -tor (0.3.3.7-1) unstable; urgency=medium +tor (0.3.4.2-alpha-1) experimental; urgency=medium * New upstream version. - -- Peter Palfrader Wed, 13 Jun 2018 09:31:15 +0200 + -- Peter Palfrader Wed, 13 Jun 2018 09:34:10 +0200 -tor (0.3.3.6-1) unstable; urgency=medium +tor (0.3.4.1-alpha-1) experimental; urgency=medium - * New upstream version, upload 0.3.3.x tree to unstable. + * New upstream tree. * Start using upstream's minimal torrc as our default /etc/tor/torrc. * Put longer torrc.sample into /usr/share/doc. - -- Peter Palfrader Wed, 23 May 2018 00:08:43 +0200 + -- Peter Palfrader Fri, 18 May 2018 10:33:45 +0200 tor (0.3.3.5-rc-1) experimental; urgency=medium diff -pruN 0.3.3.9-1/debian/micro-revision.i 0.3.4.8-1/debian/micro-revision.i --- 0.3.3.9-1/debian/micro-revision.i 2018-09-12 16:45:29.000000000 +0000 +++ 0.3.4.8-1/debian/micro-revision.i 2018-09-12 16:45:30.000000000 +0000 @@ -1 +1 @@ -"ca1a436fa8e53a32" +"5da0e95e4871a0a1" diff -pruN 0.3.3.9-1/depcomp 0.3.4.8-1/depcomp --- 0.3.3.9-1/depcomp 2018-07-12 17:17:00.000000000 +0000 +++ 0.3.4.8-1/depcomp 2018-06-25 18:12:07.000000000 +0000 @@ -1,9 +1,9 @@ -#! /bin/sh +#!/bin/sh # depcomp - compile a program generating dependencies as side-effects -scriptversion=2013-05-30.07; # UTC +scriptversion=2016-01-11.22; # UTC -# Copyright (C) 1999-2013 Free Software Foundation, Inc. +# Copyright (C) 1999-2017 Free Software Foundation, Inc. # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by @@ -786,6 +786,6 @@ exit 0 # eval: (add-hook 'write-file-hooks 'time-stamp) # time-stamp-start: "scriptversion=" # time-stamp-format: "%:y-%02m-%02d.%02H" -# time-stamp-time-zone: "UTC" +# time-stamp-time-zone: "UTC0" # time-stamp-end: "; # UTC" # End: diff -pruN 0.3.3.9-1/doc/HACKING/CodingStandards.md 0.3.4.8-1/doc/HACKING/CodingStandards.md --- 0.3.3.9-1/doc/HACKING/CodingStandards.md 2018-07-13 18:25:23.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/CodingStandards.md 2018-06-15 21:20:53.000000000 +0000 @@ -42,6 +42,23 @@ If you have changed build system compone - For example, if you have changed Makefiles, autoconf files, or anything else that affects the build system. +License issues +============== + +Tor is distributed under the license terms in the LICENSE -- in +brief, the "3-clause BSD license". If you send us code to +distribute with Tor, it needs to be code that we can distribute +under those terms. Please don't send us patches unless you agree +to allow this. + +Some compatible licenses include: + + - 3-clause BSD + - 2-clause BSD + - CC0 Public Domain Dedication + + + How we use Git branches ======================= @@ -417,3 +434,4 @@ the functions that call your function re function should mention that it does that something in the documentation. If you rely on a function doing something beyond what is in its documentation, then you should watch out, or it might do something else later. + diff -pruN 0.3.3.9-1/doc/HACKING/CodingStandardsRust.md 0.3.4.8-1/doc/HACKING/CodingStandardsRust.md --- 0.3.3.9-1/doc/HACKING/CodingStandardsRust.md 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/CodingStandardsRust.md 2018-06-15 21:20:53.000000000 +0000 @@ -0,0 +1,523 @@ + + Rust Coding Standards +======================= + +You MUST follow the standards laid out in `.../doc/HACKING/CodingStandards.md`, +where applicable. + + Module/Crate Declarations +--------------------------- + +Each Tor C module which is being rewritten MUST be in its own crate. +See the structure of `.../src/rust` for examples. + +In your crate, you MUST use `lib.rs` ONLY for pulling in external +crates (e.g. `extern crate libc;`) and exporting public objects from +other Rust modules (e.g. `pub use mymodule::foo;`). For example, if +you create a crate in `.../src/rust/yourcrate`, your Rust code should +live in `.../src/rust/yourcrate/yourcode.rs` and the public interface +to it should be exported in `.../src/rust/yourcrate/lib.rs`. + +If your code is to be called from Tor C code, you MUST define a safe +`ffi.rs`. See the "Safety" section further down for more details. + +For example, in a hypothetical `tor_addition` Rust module: + +In `.../src/rust/tor_addition/addition.rs`: + + pub fn get_sum(a: i32, b: i32) -> i32 { + a + b + } + +In `.../src/rust/tor_addition/lib.rs`: + + pub use addition::*; + +In `.../src/rust/tor_addition/ffi.rs`: + + #[no_mangle] + pub extern "C" fn tor_get_sum(a: c_int, b: c_int) -> c_int { + get_sum(a, b) + } + +If your Rust code must call out to parts of Tor's C code, you must +declare the functions you are calling in the `external` crate, located +at `.../src/rust/external`. + + + + +Modules should strive to be below 500 lines (tests excluded). Single +responsibility and limited dependencies should be a guiding standard. + +If you have any external modules as dependencies (e.g. `extern crate +libc;`), you MUST declare them in your crate's `lib.rs` and NOT in any +other module. + + Dependencies and versions +--------------------------- + +In general, we use modules from only the Rust standard library +whenever possible. We will review including external crates on a +case-by-case basis. + +If a crate only contains traits meant for compatibility between Rust +crates, such as [the digest crate](https://crates.io/crates/digest) or +[the failure crate](https://crates.io/crates/failure), it is very likely +permissible to add it as a dependency. However, a brief review should +be conducted as to the usefulness of implementing external traits +(i.e. how widespread is the usage, how many other crates either +implement the traits or have trait bounds based upon them), as well as +the stability of the traits (i.e. if the trait is going to change, we'll +potentially have to re-do all our implementations of it). + +For large external libraries, especially which implement features which +would be labour-intensive to reproduce/maintain ourselves, such as +cryptographic or mathematical/statistics libraries, only crates which +have stabilised to 1.0.0 should be considered, however, again, we may +make exceptions on a case-by-case basis. + +Currently, Tor requires that you use the latest stable Rust version. At +some point in the future, we will freeze on a given stable Rust version, +to ensure backward compatibility with stable distributions that ship it. + + Updating/Adding Dependencies +------------------------------ + +To add/remove/update dependencies, first add your dependencies, +exactly specifying their versions, into the appropriate *crate-level* +`Cargo.toml` in `src/rust/` (i.e. *not* `/src/rust/Cargo.toml`, but +instead the one for your crate). Also, investigate whether your +dependency has any optional dependencies which are unnecessary but are +enabled by default. If so, you'll likely be able to enable/disable +them via some feature, e.g.: + +```toml +[dependencies] +foo = { version = "1.0.0", default-features = false } +``` + +Next, run `/scripts/maint/updateRustDependencies.sh`. Then, go into +`src/ext/rust` and commit the changes to the `tor-rust-dependencies` +repo. + + Documentation +--------------- + +You MUST include `#[deny(missing_docs)]` in your crate. + +For function/method comments, you SHOULD include a one-sentence, "first person" +description of function behaviour (see requirements for documentation as +described in `.../src/HACKING/CodingStandards.md`), then an `# Inputs` section +for inputs or initialisation values, a `# Returns` section for return +values/types, a `# Warning` section containing warnings for unsafe behaviours or +panics that could happen. For publicly accessible +types/constants/objects/functions/methods, you SHOULD also include an +`# Examples` section with runnable doctests. + +You MUST document your module with _module docstring_ comments, +i.e. `//!` at the beginning of each line. + + Style +------- + +You SHOULD consider breaking up large literal numbers with `_` when it makes it +more human readable to do so, e.g. `let x: u64 = 100_000_000_000`. + + Testing +--------- + +All code MUST be unittested and integration tested. + +Public functions/objects exported from a crate SHOULD include doctests +describing how the function/object is expected to be used. + +Integration tests SHOULD go into a `tests/` directory inside your +crate. Unittests SHOULD go into their own module inside the module +they are testing, e.g. in `.../src/rust/tor_addition/addition.rs` you +should put: + + #[cfg(test)] + mod test { + use super::*; + + #[test] + fn addition_with_zero() { + let sum: i32 = get_sum(5i32, 0i32); + assert_eq!(sum, 5); + } + } + + Benchmarking +-------------- + +The external `test` crate can be used for most benchmarking. However, using +this crate requires nightly Rust. Since we may want to switch to a more +stable Rust compiler eventually, we shouldn't do things which will automatically +break builds for stable compilers. Therefore, you MUST feature-gate your +benchmarks in the following manner. + +If you wish to benchmark some of your Rust code, you MUST put the +following in the `[features]` section of your crate's `Cargo.toml`: + + [features] + bench = [] + +Next, in your crate's `lib.rs` you MUST put: + + #[cfg(all(test, feature = "bench"))] + extern crate test; + +This ensures that the external crate `test`, which contains utilities +for basic benchmarks, is only used when running benchmarks via `cargo +bench --features bench`. + +Finally, to write your benchmark code, in +`.../src/rust/tor_addition/addition.rs` you SHOULD put: + + #[cfg(all(test, features = "bench"))] + mod bench { + use test::Bencher; + use super::*; + + #[bench] + fn addition_small_integers(b: &mut Bencher) { + b.iter(| | get_sum(5i32, 0i32)); + } + } + + Fuzzing +--------- + +If you wish to fuzz parts of your code, please see the +[`cargo fuzz`](https://github.com/rust-fuzz/cargo-fuzz) crate, which uses +[libfuzzer-sys](https://github.com/rust-fuzz/libfuzzer-sys). + + Whitespace & Formatting +------------------------- + +You MUST run `rustfmt` (https://github.com/rust-lang-nursery/rustfmt) +on your code before your code will be merged. You can install rustfmt +by doing `cargo install rustfmt-nightly` and then run it with `cargo +fmt`. + + Safety +-------- + +You SHOULD read [the nomicon](https://doc.rust-lang.org/nomicon/) before writing +Rust FFI code. It is *highly advised* that you read and write normal Rust code +before attempting to write FFI or any other unsafe code. + +Here are some additional bits of advice and rules: + +0. Any behaviours which Rust considers to be undefined are forbidden + + From https://doc.rust-lang.org/reference/behavior-considered-undefined.html: + + > Behavior considered undefined + > + > The following is a list of behavior which is forbidden in all Rust code, + > including within unsafe blocks and unsafe functions. Type checking provides the + > guarantee that these issues are never caused by safe code. + > + > * Data races + > * Dereferencing a null/dangling raw pointer + > * Reads of [undef](http://llvm.org/docs/LangRef.html#undefined-values) + > (uninitialized) memory + > * Breaking the + > [pointer aliasing rules](http://llvm.org/docs/LangRef.html#pointer-aliasing-rules) + > with raw pointers (a subset of the rules used by C) + > * `&mut T` and `&T` follow LLVM’s scoped noalias model, except if the `&T` + > contains an `UnsafeCell`. Unsafe code must not violate these aliasing + > guarantees. + > * Mutating non-mutable data (that is, data reached through a shared + > reference or data owned by a `let` binding), unless that data is + > contained within an `UnsafeCell`. + > * Invoking undefined behavior via compiler intrinsics: + > - Indexing outside of the bounds of an object with + > `std::ptr::offset` (`offset` intrinsic), with the exception of + > one byte past the end which is permitted. + > - Using `std::ptr::copy_nonoverlapping_memory` (`memcpy32`/`memcpy64` + > intrinsics) on overlapping buffers + > * Invalid values in primitive types, even in private fields/locals: + > - Dangling/null references or boxes + > - A value other than `false` (0) or `true` (1) in a `bool` + > - A discriminant in an `enum` not included in the type definition + > - A value in a `char` which is a surrogate or above `char::MAX` + > - Non-UTF-8 byte sequences in a `str` + > * Unwinding into Rust from foreign code or unwinding from Rust into foreign + > code. Rust's failure system is not compatible with exception handling in other + > languages. Unwinding must be caught and handled at FFI boundaries. + +1. `unwrap()` + + If you call `unwrap()`, anywhere, even in a test, you MUST include + an inline comment stating how the unwrap will either 1) never fail, + or 2) should fail (i.e. in a unittest). + + You SHOULD NOT use `unwrap()` anywhere in which it is possible to handle the + potential error with either `expect()` or the eel operator, `?`. + For example, consider a function which parses a string into an integer: + + fn parse_port_number(config_string: &str) -> u16 { + u16::from_str_radix(config_string, 10).unwrap() + } + + There are numerous ways this can fail, and the `unwrap()` will cause the + whole program to byte the dust! Instead, either you SHOULD use `expect()` + (or another equivalent function which will return an `Option` or a `Result`) + and change the return type to be compatible: + + fn parse_port_number(config_string: &str) -> Option { + u16::from_str_radix(config_string, 10).expect("Couldn't parse port into a u16") + } + + or you SHOULD use `or()` (or another similar method): + + fn parse_port_number(config_string: &str) -> Option { + u16::from_str_radix(config_string, 10).or(Err("Couldn't parse port into a u16") + } + + Using methods like `or()` can be particularly handy when you must do + something afterwards with the data, for example, if we wanted to guarantee + that the port is high. Combining these methods with the eel operator (`?`) + makes this even easier: + + fn parse_port_number(config_string: &str) -> Result { + let port = u16::from_str_radix(config_string, 10).or(Err("Couldn't parse port into a u16"))?; + + if port > 1024 { + return Ok(port); + } else { + return Err("Low ports not allowed"); + } + } + +2. `unsafe` + + If you use `unsafe`, you MUST describe a contract in your + documentation which describes how and when the unsafe code may + fail, and what expectations are made w.r.t. the interfaces to + unsafe code. This is also REQUIRED for major pieces of FFI between + C and Rust. + + When creating an FFI in Rust for C code to call, it is NOT REQUIRED + to declare the entire function `unsafe`. For example, rather than doing: + + #[no_mangle] + pub unsafe extern "C" fn increment_and_combine_numbers(mut numbers: [u8; 4]) -> u32 { + for number in &mut numbers { + *number += 1; + } + std::mem::transmute::<[u8; 4], u32>(numbers) + } + + You SHOULD instead do: + + #[no_mangle] + pub extern "C" fn increment_and_combine_numbers(mut numbers: [u8; 4]) -> u32 { + for index in 0..numbers.len() { + numbers[index] += 1; + } + unsafe { + std::mem::transmute::<[u8; 4], u32>(numbers) + } + } + +3. Pass only C-compatible primitive types and bytes over the boundary + + Rust's C-compatible primitive types are integers and floats. + These types are declared in the [libc crate](https://doc.rust-lang.org/libc/x86_64-unknown-linux-gnu/libc/index.html#types). + Most Rust objects have different [representations](https://doc.rust-lang.org/libc/x86_64-unknown-linux-gnu/libc/index.html#types) + in C and Rust, so they can't be passed using FFI. + + Tor currently uses the following Rust primitive types from libc for FFI: + * defined-size integers: `uint32_t` + * native-sized integers: `c_int` + * native-sized floats: `c_double` + * native-sized raw pointers: `* c_void`, `* c_char`, `** c_char` + + TODO: C smartlist to Stringlist conversion using FFI + + The only non-primitive type which may cross the FFI boundary is + bytes, e.g. `&[u8]`. This SHOULD be done on the Rust side by + passing a pointer (`*mut libc::c_char`). The length can be passed + explicitly (`libc::size_t`), or the string can be NUL-byte terminated + C string. + + One might be tempted to do this via doing + `CString::new("blah").unwrap().into_raw()`. This has several problems: + + a) If you do `CString::new("bl\x00ah")` then the unwrap() will fail + due to the additional NULL terminator, causing a dangling + pointer to be returned (as well as a potential use-after-free). + + b) Returning the raw pointer will cause the CString to run its deallocator, + which causes any C code which tries to access the contents to dereference a + NULL pointer. + + c) If we were to do `as_raw()` this would result in a potential double-free + since the Rust deallocator would run and possibly Tor's deallocator. + + d) Calling `into_raw()` without later using the same pointer in Rust to call + `from_raw()` and then deallocate in Rust can result in a + [memory leak](https://doc.rust-lang.org/std/ffi/struct.CString.html#method.into_raw). + + [It was determined](https://github.com/rust-lang/rust/pull/41074) that this + is safe to do if you use the same allocator in C and Rust and also specify + the memory alignment for CString (except that there is no way to specify + the alignment for CString). It is believed that the alignment is always 1, + which would mean it's safe to dealloc the resulting `*mut c_char` in Tor's + C code. However, the Rust developers are not willing to guarantee the + stability of, or a contract for, this behaviour, citing concerns that this + is potentially extremely and subtly unsafe. + +4. Perform an allocation on the other side of the boundary + + After crossing the boundary, the other side MUST perform an + allocation to copy the data and is therefore responsible for + freeing that memory later. + +5. No touching other language's enums + + Rust enums should never be touched from C (nor can they be safely + `#[repr(C)]`) nor vice versa: + + > "The chosen size is the default enum size for the target platform's C + > ABI. Note that enum representation in C is implementation defined, so this is + > really a "best guess". In particular, this may be incorrect when the C code + > of interest is compiled with certain flags." + + (from https://gankro.github.io/nomicon/other-reprs.html) + +6. Type safety + + Wherever possible and sensical, you SHOULD create new types in a + manner which prevents type confusion or misuse. For example, + rather than using an untyped mapping between strings and integers + like so: + + use std::collections::HashMap; + + pub fn get_elements_with_over_9000_points(map: &HashMap) -> Vec { + ... + } + + It would be safer to define a new type, such that some other usage + of `HashMap` cannot be confused for this type: + + pub struct DragonBallZPowers(pub HashMap); + + impl DragonBallZPowers { + pub fn over_nine_thousand<'a>(&'a self) -> Vec<&'a String> { + let mut powerful_enough: Vec<&'a String> = Vec::with_capacity(5); + + for (character, power) in &self.0 { + if *power > 9000 { + powerful_enough.push(character); + } + } + powerful_enough + } + } + + Note the following code, which uses Rust's type aliasing, is valid + but it does NOT meet the desired type safety goals: + + pub type Power = usize; + + pub fn over_nine_thousand(power: &Power) -> bool { + if *power > 9000 { + return true; + } + false + } + + // We can still do the following: + let his_power: usize = 9001; + over_nine_thousand(&his_power); + +7. Unsafe mucking around with lifetimes + + Because lifetimes are technically, in type theory terms, a kind, i.e. a + family of types, individual lifetimes can be treated as types. For example, + one can arbitrarily extend and shorten lifetime using `std::mem::transmute`: + + struct R<'a>(&'a i32); + + unsafe fn extend_lifetime<'b>(r: R<'b>) -> R<'static> { + std::mem::transmute::, R<'static>>(r) + } + + unsafe fn shorten_invariant_lifetime<'b, 'c>(r: &'b mut R<'static>) -> &'b mut R<'c> { + std::mem::transmute::<&'b mut R<'static>, &'b mut R<'c>>(r) + } + + Calling `extend_lifetime()` would cause an `R` passed into it to live forever + for the life of the program (the `'static` lifetime). Similarly, + `shorten_invariant_lifetime()` could be used to take something meant to live + forever, and cause it to disappear! This is incredibly unsafe. If you're + going to be mucking around with lifetimes like this, first, you better have + an extremely good reason, and second, you may as be honest and explicit about + it, and for ferris' sake just use a raw pointer. + + In short, just because lifetimes can be treated like types doesn't mean you + should do it. + +8. Doing excessively unsafe things when there's a safer alternative + + Similarly to #7, often there are excessively unsafe ways to do a task and a + simpler, safer way. You MUST choose the safer option where possible. + + For example, `std::mem::transmute` can be abused in ways where casting with + `as` would be both simpler and safer: + + // Don't do this + let ptr = &0; + let ptr_num_transmute = unsafe { std::mem::transmute::<&i32, usize>(ptr)}; + + // Use an `as` cast instead + let ptr_num_cast = ptr as *const i32 as usize; + + In fact, using `std::mem::transmute` for *any* reason is a code smell and as + such SHOULD be avoided. + +9. Casting integers with `as` + + This is generally fine to do, but it has some behaviours which you should be + aware of. Casting down chops off the high bits, e.g.: + + let x: u32 = 4294967295; + println!("{}", x as u16); // prints 65535 + + Some cases which you MUST NOT do include: + + * Casting an `u128` down to an `f32` or vice versa (e.g. + `u128::MAX as f32` but this isn't only a problem with overflowing + as it is also undefined behaviour for `42.0f32 as u128`), + + * Casting between integers and floats when the thing being cast + cannot fit into the type it is being casted into, e.g.: + + println!("{}", 42949.0f32 as u8); // prints 197 in debug mode and 0 in release + println!("{}", 1.04E+17 as u8); // prints 0 in both modes + println!("{}", (0.0/0.0) as i64); // prints whatever the heck LLVM wants + + Because this behaviour is undefined, it can even produce segfaults in + safe Rust code. For example, the following program built in release + mode segfaults: + + #[inline(never)] + pub fn trigger_ub(sl: &[u8; 666]) -> &[u8] { + // Note that the float is out of the range of `usize`, invoking UB when casting. + let idx = 1e99999f64 as usize; + &sl[idx..] // The bound check is elided due to `idx` being of an undefined value. + } + + fn main() { + println!("{}", trigger_ub(&[1; 666])[999999]); // ~ out of bound + } + + And in debug mode panics with: + + thread 'main' panicked at 'slice index starts at 140721821254240 but ends at 666', /checkout/src/libcore/slice/mod.rs:754:4 diff -pruN 0.3.3.9-1/doc/HACKING/Fuzzing.md 0.3.4.8-1/doc/HACKING/Fuzzing.md --- 0.3.3.9-1/doc/HACKING/Fuzzing.md 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/Fuzzing.md 2018-06-15 21:20:53.000000000 +0000 @@ -0,0 +1,123 @@ += Fuzzing Tor + +== The simple version (no fuzzing, only tests) + +Check out fuzzing-corpora, and set TOR_FUZZ_CORPORA to point to the place +where you checked it out. + +To run the fuzzing test cases in a deterministic fashion, use: + make test-fuzz-corpora + +This won't actually fuzz Tor! It will just run all the fuzz binaries +on our existing set of testcases for the fuzzer. + + +== Different kinds of fuzzing + +Right now we support three different kinds of fuzzer. + +First, there's American Fuzzy Lop (AFL), a fuzzer that works by forking +a target binary and passing it lots of different inputs on stdin. It's the +trickiest one to set up, so I'll be describing it more below. + +Second, there's libFuzzer, a llvm-based fuzzer that you link in as a library, +and it runs a target function over and over. To use this one, you'll need to +have a reasonably recent clang and libfuzzer installed. At that point, you +just build with --enable-expensive-hardening and --enable-libfuzzer. That +will produce a set of binaries in src/test/fuzz/lf-fuzz-* . These programs +take as input a series of directories full of fuzzing examples. For more +information on libfuzzer, see http://llvm.org/docs/LibFuzzer.html + +Third, there's Google's OSS-Fuzz infrastructure, which expects to get all of +its. For more on this, see https://github.com/google/oss-fuzz and the +projects/tor subdirectory. You'll need to mess around with Docker a bit to +test this one out; it's meant to run on Google's infrastructure. + +In all cases, you'll need some starting examples to give the fuzzer when it +starts out. There's a set in the "fuzzing-corpora" git repository. Try +setting TOR_FUZZ_CORPORA to point to a checkout of that repository + +== Writing Tor fuzzers + +A tor fuzzing harness should have: +* a fuzz_init() function to set up any necessary global state. +* a fuzz_main() function to receive input and pass it to a parser. +* a fuzz_cleanup() function to clear global state. + +Most fuzzing frameworks will produce many invalid inputs - a tor fuzzing +harness should rejecting invalid inputs without crashing or behaving badly. + +But the fuzzing harness should crash if tor fails an assertion, triggers a +bug, or accesses memory it shouldn't. This helps fuzzing frameworks detect +"interesting" cases. + + +== Guided Fuzzing with AFL + +There is no HTTPS, hash, or signature for American Fuzzy Lop's source code, so +its integrity can't be verified. That said, you really shouldn't fuzz on a +machine you care about, anyway. + +To Build: + Get AFL from http://lcamtuf.coredump.cx/afl/ and unpack it + cd afl + make + cd ../tor + PATH=$PATH:../afl/ CC="../afl/afl-gcc" ./configure --enable-expensive-hardening + AFL_HARDEN=1 make clean fuzzers + +To Find The ASAN Memory Limit: (64-bit only) + +On 64-bit platforms, afl needs to know how much memory ASAN uses, +because ASAN tends to allocate a ridiculous amount of virtual memory, +and then not actually use it. + +Read afl/docs/notes_for_asan.txt for more details. + + Download recidivm from http://jwilk.net/software/recidivm + Download the signature + Check the signature + tar xvzf recidivm*.tar.gz + cd recidivm* + make + /path/to/recidivm -v src/test/fuzz/fuzz-http + Use the final "ok" figure as the input to -m when calling afl-fuzz + (Normally, recidivm would output a figure automatically, but in some cases, + the fuzzing harness will hang when the memory limit is too small.) + +You could also just say "none" instead of the memory limit below, if you +don't care about memory limits. + + +To Run: + mkdir -p src/test/fuzz/fuzz_http_findings + ../afl/afl-fuzz -i ${TOR_FUZZ_CORPORA}/http -o src/test/fuzz/fuzz_http_findings -m -- src/test/fuzz/fuzz-http + + +AFL has a multi-core mode, check the documentation for details. +You might find the included fuzz-multi.sh script useful for this. + +macOS (OS X) requires slightly more preparation, including: +* using afl-clang (or afl-clang-fast from the llvm directory) +* disabling external crash reporting (AFL will guide you through this step) + +== Triaging Issues + +Crashes are usually interesting, particularly if using AFL_HARDEN=1 and --enable-expensive-hardening. Sometimes crashes are due to bugs in the harness code. + +Hangs might be interesting, but they might also be spurious machine slowdowns. +Check if a hang is reproducible before reporting it. Sometimes, processing +valid inputs may take a second or so, particularly with the fuzzer and +sanitizers enabled. + +To see what fuzz-http is doing with a test case, call it like this: + src/test/fuzz/fuzz-http --debug < /path/to/test.case + +(Logging is disabled while fuzzing to increase fuzzing speed.) + +== Reporting Issues + +Please report any issues discovered using the process in Tor's security issue +policy: + +https://trac.torproject.org/projects/tor/wiki/org/meetings/2016SummerDevMeeting/Notes/SecurityIssuePolicy diff -pruN 0.3.3.9-1/doc/HACKING/GettingStartedRust.md 0.3.4.8-1/doc/HACKING/GettingStartedRust.md --- 0.3.3.9-1/doc/HACKING/GettingStartedRust.md 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/GettingStartedRust.md 2018-08-16 12:35:31.000000000 +0000 @@ -0,0 +1,183 @@ + + Hacking on Rust in Tor +======================== + + Getting Started +----------------- + +Please read or review our documentation on Rust coding standards +(`.../doc/HACKING/CodingStandardsRust.md`) before doing anything. + +Please also read +[the Rust Code of Conduct](https://www.rust-lang.org/en-US/conduct.html). We +aim to follow the good example set by the Rust community and be +excellent to one another. Let's be careful with each other, so we can +be memory-safe together! + +Next, please contact us before rewriting anything! Rust in Tor is still +an experiment. It is an experiment that we very much want to see +succeed, so we're going slowly and carefully. For the moment, it's also +a completely volunteer-driven effort: while many, if not most, of us are +paid to work on Tor, we are not yet funded to write Rust code for Tor. +Please be patient with the other people who are working on getting more +Rust code into Tor, because they are graciously donating their free time +to contribute to this effort. + + Resources for learning Rust +----------------------------- + +**Beginning resources** + +The primary resource for learning Rust is +[The Book](https://doc.rust-lang.org/book/). If you'd like to start writing +Rust immediately, without waiting for anything to install, there is +[an interactive browser-based playground](https://play.rust-lang.org/). + +**Advanced resources** + +If you're interested in playing with various Rust compilers and viewing +a very nicely displayed output of the generated assembly, there is +[the Godbolt compiler explorer](https://rust.godbolt.org/) + +For learning how to write unsafe Rust, read +[The Rustonomicon](https://doc.rust-lang.org/nomicon/). + +For learning everything you ever wanted to know about Rust macros, there +is +[The Little Book of Rust Macros](https://danielkeep.github.io/tlborm/book/index.html). + +For learning more about FFI and Rust, see Jake Goulding's +[Rust FFI Omnibus](http://jakegoulding.com/rust-ffi-omnibus/). + + Compiling Tor with Rust enabled +--------------------------------- + +You will need to run the `configure` script with the `--enable-rust` +flag to explicitly build with Rust. Additionally, you will need to +specify where to fetch Rust dependencies, as we allow for either +fetching dependencies from Cargo or specifying a local directory. + +**Fetch dependencies from Cargo** + + ./configure --enable-rust --enable-cargo-online-mode + +**Using a local dependency cache** + +You'll need the following Rust dependencies (as of this writing): + + libc==0.2.39 + +We vendor our Rust dependencies in a separate repo using +[cargo-vendor](https://github.com/alexcrichton/cargo-vendor). To use +them, do: + + git submodule init + git submodule update + +To specify the local directory containing the dependencies, (assuming +you are in the top level of the repository) configure tor with: + + TOR_RUST_DEPENDENCIES='path_to_dependencies_directory' ./configure --enable-rust + +(Note that TOR_RUST_DEPENDENCIES must be the full path to the directory; it +cannot be relative.) + +Assuming you used the above `git submodule` commands and you're in the +topmost directory of the repository, this would be: + + TOR_RUST_DEPENDENCIES=`pwd`/src/ext/rust/crates ./configure --enable-rust + + + Identifying which modules to rewrite +====================================== + +The places in the Tor codebase that are good candidates for porting to +Rust are: + +1. loosely coupled to other Tor submodules, +2. have high test coverage, and +3. would benefit from being implemented in a memory safe language. + +Help in either identifying places such as this, or working to improve +existing areas of the C codebase by adding regression tests and +simplifying dependencies, would be really helpful. + +Furthermore, as submodules in C are implemented in Rust, this is a good +opportunity to refactor, add more tests, and split modules into smaller +areas of responsibility. + +A good first step is to build a module-level callgraph to understand how +interconnected your target module is. + + git clone https://git.torproject.org/user/nickm/calltool.git + cd tor + CFLAGS=0 ./configure + ../calltool/src/main.py module_callgraph + +The output will tell you each module name, along with a set of every module that +the module calls. Modules which call fewer other modules are better targets. + + Writing your Rust module +========================== + +Strive to change the C API as little as possible. + +We are currently targetting Rust stable. (See CodingStandardsRust.md for more +details.) + +It is on our TODO list to try to cultivate good +standing with various distro maintainers of `rustc` and `cargo`, in +order to ensure that whatever version we solidify on is readily +available. + +If parts of your Rust code needs to stay in sync with C code (such as +handling enums across the FFI boundary), annonotate these places in a +comment structured as follows: + + /// C_RUST_COUPLED: `` + +Where can be an enum, struct, constant, etc. Then, +do the same in the C code, to note that rust will need to be changed +when the C does. + + + Adding your Rust module to Tor's build system +----------------------------------------------- + +0. Your translation of the C module should live in its own crate(s) + in the `.../tor/src/rust/` directory. +1. Add your crate to `.../tor/src/rust/Cargo.toml`, in the + `[workspace.members]` section. +2. Add your crate's files to src/rust/include.am + +If your crate should be available to C (rather than just being included as a +dependency of other Rust modules): +0. Declare the crate as a dependency of tor_rust in + `src/rust/tor_util/Cargo.toml` and include it in + `src/rust/tor_rust/lib.rs` + + How to test your Rust code +---------------------------- + +Everything should be tested full stop. Even non-public functionality. + +Be sure to edit `.../tor/src/test/test_rust.sh` to add the name of your +crate to the `crates` variable! This will ensure that `cargo test` is +run on your crate. + +Configure Tor's build system to build with Rust enabled: + + ./configure --enable-fatal-warnings --enable-rust --enable-cargo-online-mode + +Tor's test should be run by doing: + + make check + +Tor's integration tests should also pass: + + make test-stem + + Submitting a patch +===================== + +Please follow the instructions in `.../doc/HACKING/GettingStarted.md`. diff -pruN 0.3.3.9-1/doc/HACKING/HelpfulTools.md 0.3.4.8-1/doc/HACKING/HelpfulTools.md --- 0.3.3.9-1/doc/HACKING/HelpfulTools.md 2018-07-13 18:17:34.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/HelpfulTools.md 2018-06-15 21:20:53.000000000 +0000 @@ -4,6 +4,22 @@ Useful tools These aren't strictly necessary for hacking on Tor, but they can help track down bugs. +Travis CI +--------- +It's CI. Looks like this: https://travis-ci.org/torproject/tor. + +Runs automatically on Pull Requests sent to torproject/tor. You can set it up +for your fork to build commits outside of PRs too: + +1. sign up for GitHub: https://github.com/join +2. fork https://github.com/torproject/tor: + https://help.github.com/articles/fork-a-repo/ +3. follow https://docs.travis-ci.com/user/getting-started/#To-get-started-with-Travis-CI. + skip steps involving `.travis.yml` (we already have one). + +Builds should show up on the web at travis-ci.com and on IRC at #tor-ci on +OFTC. If they don't, ask #tor-dev (also on OFTC). + Jenkins ------- diff -pruN 0.3.3.9-1/doc/HACKING/Module.md 0.3.4.8-1/doc/HACKING/Module.md --- 0.3.3.9-1/doc/HACKING/Module.md 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/Module.md 2018-06-15 21:20:53.000000000 +0000 @@ -0,0 +1,111 @@ +# Modules in Tor # + +This document describes the build system and coding standards when writing a +module in Tor. + +## What is a module? ## + +In the context of the tor code base, a module is a subsystem that we can +selectively enable or disable, at `configure` time. + +Currently, there is only one module: + + - Directory Authority subsystem (dirauth) + +It is located in its own directory in `src/or/dirauth/`. To disable it, one +need to pass `--disable-module-dirauth` at configure time. All modules are +currently enabled by default. + +## Build System ## + +The changes to the build system are pretty straightforward. + +1. Locate in the `configure.ac` file this define: `m4_define(MODULES`. It + contains a list (white-space separated) of the module in tor. Add yours to + the list. + +2. Use the `AC_ARG_ENABLE([module-dirauth]` template for your new module. We + use the "disable module" approach instead of enabling them one by one. So, + by default, tor will build all the modules. + + This will define the `HAVE_MODULE_` statement which can be used in + the C code to conditionally compile things for your module. And the + `BUILD_MODULE_` is also defined for automake files (e.g: include.am). + +3. In the `src/or/include.am` file, locate the `MODULE_DIRAUTH_SOURCES` value. + You need to create your own `_SOURCES` variable for your module and then + conditionally add the it to `LIBTOR_A_SOURCES` if you should build the + module. + + It is then **very** important to add your SOURCES variable to + `src_or_libtor_testing_a_SOURCES` so the tests can build it. + +4. Do the same for header files, locate `ORHEADERS +=` which always add all + headers of all modules so the symbol can be found for the module entry + points. + +Finally, your module will automatically be included in the +`TOR_MODULES_ALL_ENABLED` variable which is used to build the unit tests. They +always build everything in order to tests everything. + +## Coding ## + +As mentioned above, a module must be isolated in its own directory (name of +the module) in `src/or/`. + +There are couples of "rules" you want to follow: + +* Minimize as much as you can the number of entry points into your module. + Less is always better but of course that doesn't work out for every use + case. However, it is a good thing to always keep that in mind. + +* Do **not** use the `HAVE_MODULE_` define outside of the module code + base. Every entry point should have a second definition if the module is + disabled. For instance: + + ``` + #ifdef HAVE_MODULE_DIRAUTH + + int sr_init(int save_to_disk); + + #else /* HAVE_MODULE_DIRAUTH */ + + static inline int + sr_init(int save_to_disk) + { + (void) save_to_disk; + return 0; + } + + #endif /* HAVE_MODULE_DIRAUTH */ + + ``` + + The main reason for this approach is to avoid having conditional code + everywhere in the code base. It should be centralized as much as possible + which helps maintainability but also avoids conditional spaghetti code + making the code much more difficult to follow/understand. + +* It is possible that you end up with code that needs to be used by the rest + of the code base but is still part of your module. As a good example, if you + look at `src/or/shared_random_client.c`: it contains code needed by the hidden + service subsystem but mainly related to the shared random subsystem very + specific to the dirauth module. + + This is fine but try to keep it as lean as possible and never use the same + filename as the one in the module. For example, this is a bad idea and + should never be done: + + - `src/or/shared_random.c` + - `src/or/dirauth/shared_random.c` + +* When you include headers from the module, **always** use the full module + path in your statement. Example: + + `#include "dirauth/dirvote.h"` + + The main reason is that we do **not** add the module include path by default + so it needs to be specified. But also, it helps our human brain understand + which part comes from a module or not. + + Even **in** the module itself, use the full include path like above. diff -pruN 0.3.3.9-1/doc/HACKING/ReleasingTor.md 0.3.4.8-1/doc/HACKING/ReleasingTor.md --- 0.3.3.9-1/doc/HACKING/ReleasingTor.md 2018-07-13 18:25:23.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/ReleasingTor.md 2018-06-15 21:20:53.000000000 +0000 @@ -34,7 +34,7 @@ new Tor release: What about Coverity Scan? - What about clan scan-build? + What about clang scan-build? Does 'make distcheck' complain? diff -pruN 0.3.3.9-1/doc/HACKING/Tracing.md 0.3.4.8-1/doc/HACKING/Tracing.md --- 0.3.3.9-1/doc/HACKING/Tracing.md 1970-01-01 00:00:00.000000000 +0000 +++ 0.3.4.8-1/doc/HACKING/Tracing.md 2018-06-15 21:20:53.000000000 +0000 @@ -0,0 +1,91 @@ +# Tracing # + +This document describes how the event tracing subsystem works in tor so +developers can add events to the code base but also hook them to an event +tracing framework. + +## Basics ### + +Event tracing is separated in two concepts, trace events and a tracer. The +tracing subsystem can be found in `src/trace`. The `events.h` header file is +the main file that maps the different tracers to trace events. + +### Events ### + +A trace event is basically a function from which we can pass any data that +we want to collect. In addition, we specify a context for the event such as +a subsystem and an event name. + +A trace event in tor has the following standard format: + + tor_trace(subsystem, event\_name, args...) + +The `subsystem` parameter is the name of the subsytem the trace event is in. +For example that could be "scheduler" or "vote" or "hs". The idea is to add +some context to the event so when we collect them we know where it's coming +from. The `event_name` is the name of the event which helps a lot with +adding some semantic to the event. Finally, `args` is any number of +arguments we want to collect. + +Here is an example of a possible tracepoint in main(): + + tor_trace(main, init_phase, argc) + +The above is a tracepoint in the `main` subsystem with `init_phase` as the +event name and the `int argc` is passed to the event as well. + +How `argc` is collected or used has nothing to do with the instrumentation +(adding trace events to the code). It is the work of the tracer so this is why +the trace events and collection framework (tracer) are decoupled. You _can_ +have trace events without a tracer. + +### Tracer ### + +In `src/trace/events.h`, we map the `tor_trace()` function to the right +tracer. A tracer support is only enabled at compile time. For instance, the +file `src/trace/debug.h` contains the mapping of the generic tracing function +`tor_trace()` to the `log_debug()` function. More specialized function can be +mapped depending on the tracepoint. + +## Build System ## + +This section describes how it is integrated into the build system of tor. + +By default, every tracing events are disabled in tor that is `tor_trace()` +is a NOP. + +To enable a tracer, there is a configure option on the form of: + + --enable-tracing- + +We have an option that will send every trace events to a `log_debug()` (as +mentionned above) which will print you the subsystem and name of the event but +not the arguments for technical reasons. This is useful if you want to quickly +see if your trace event is being hit or well written. To do so, use this +configure option: + + --enable-tracing-debug + +## Instrument Tor ## + +This is pretty easy. Let's say you want to add a trace event in +`src/or/rendcache.c`, you only have to add this include statement: + + #include "trace/events.h" + +Once done, you can add as many as you want `tor_trace()` that you need. +Please use the right subsystem (here it would be `hs`) and a unique name that +tells what the event is for. For example: + + tor_trace(hs, store_desc_as_client, desc, desc_id); + +If you look in `src/trace/events.h`, you'll see that if tracing is enabled it +will be mapped to a function called: + + tor_trace_hs_store_desc_as_client(desc, desc_id) + +And the point of all this is for that function to be defined in a new file +that you might want to add named `src/trace/hs.{c|h}` which would defined how +to collect the data for the `tor_trace_hs_store_desc_as_client()` function +like for instance sending it to a `log_debug()` or do more complex operations +or use a userspace tracer like LTTng (https://lttng.org). diff -pruN 0.3.3.9-1/doc/include.am 0.3.4.8-1/doc/include.am --- 0.3.3.9-1/doc/include.am 2018-07-13 18:17:34.000000000 +0000 +++ 0.3.4.8-1/doc/include.am 2018-06-15 21:20:53.000000000 +0000 @@ -35,10 +35,15 @@ EXTRA_DIST+= doc/asciidoc-helper.sh \ doc/TUNING \ doc/HACKING/README.1st.md \ doc/HACKING/CodingStandards.md \ + doc/HACKING/CodingStandardsRust.md \ + doc/HACKING/Fuzzing.md \ doc/HACKING/GettingStarted.md \ + doc/HACKING/GettingStartedRust.md \ doc/HACKING/HelpfulTools.md \ doc/HACKING/HowToReview.md \ + doc/HACKING/Module.md \ doc/HACKING/ReleasingTor.md \ + doc/HACKING/Tracing.md \ doc/HACKING/WritingTests.md docdir = @docdir@ diff -pruN 0.3.3.9-1/doc/tor.1.in 0.3.4.8-1/doc/tor.1.in --- 0.3.3.9-1/doc/tor.1.in 2018-07-13 18:26:45.000000000 +0000 +++ 0.3.4.8-1/doc/tor.1.in 2018-06-25 18:12:27.000000000 +0000 @@ -1,13 +1,13 @@ '\" t .\" Title: tor .\" Author: [see the "AUTHORS" section] -.\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 07/13/2018 +.\" Generator: DocBook XSL Stylesheets vsnapshot +.\" Date: 06/25/2018 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TOR" "1" "07/13/2018" "Tor" "Tor Manual" +.TH "TOR" "1" "06/25/2018" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -39,7 +39,7 @@ Tor is a connection\-oriented anonymizin Basically, Tor provides a distributed network of servers or relays ("onion routers")\&. Users bounce their TCP streams \(em web traffic, ftp, ssh, etc\&. \(em around the network, and recipients, observers, and even the relays themselves have difficulty tracking the source of the stream\&. .sp By default, \fBtor\fR will act as a client only\&. To help the network by providing bandwidth as a relay, change the \fBORPort\fR configuration option \(em see below\&. Please also consult the documentation on the Tor Project\(cqs website\&. -.SH "COMMAND-LINE OPTIONS" +.SH "COMMAND\-LINE OPTIONS" .PP \fB\-h\fR, \fB\-help\fR .RS 4 @@ -129,16 +129,19 @@ option, which tells Tor not to log to th .RS 4 Running "tor \-\-keygen" creates a new ed25519 master identity key for a relay, or only a fresh temporary signing key and certificate, if you already have a master key\&. Optionally you can encrypt the master identity key with a passphrase: Tor will ask you for one\&. If you don\(cqt want to encrypt the master key, just don\(cqt enter any passphrase when asked\&. + The \fB\-\-newpass\fR option should be used with \-\-keygen only when you need to add, change, or remove a passphrase on an existing ed25519 master identity key\&. You will be prompted for the old passphase (if any), and the new passphrase (if any)\&. + When generating a master key, you will probably want to use \fB\-\-DataDirectory\fR to control where the keys and certificates will be stored, and \fB\-\-SigningKeyLifetime\fR to control their lifetimes\&. Their behavior is as documented in the server options section below\&. (You must have write access to the specified DataDirectory\&.) + To use the generated files, you must copy them to the DataDirectory/keys directory of your Tor daemon, and make sure that they are owned by the user actually running the Tor daemon on your system\&. .RE .PP @@ -155,6 +158,7 @@ specifies which type of key certificate \fBpurpose\fR is "sign"\&. + Running "tor \-\-key\-expiration sign" will attempt to find your signing key certificate and will output, both in the logs as well as to stdout, the signing key certificate\(cqs expiration time in ISO\-8601 format\&. For example, the output sent to stdout will be of the form: "signing\-cert\-expiry: 2017\-07\-25 08:30:15 UTC" .RE .sp @@ -180,8 +184,10 @@ A token bucket limits the average incomi \fIat the very least\fR 75 KBytes for a relay (that is, 600 kbits) or 50 KBytes for a bridge (400 kbits) \(em but of course, more is better; we recommend at least 250 KBytes (2 mbits) if possible\&. (Default: 1 GByte) + Note that this option, and other bandwidth\-limiting options, apply to TCP data only: They do not count TCP headers or DNS traffic\&. + With this option, and in other options that take arguments in bytes, KBytes, and so on, other formats are also supported\&. Notably, "KBytes" can also be written as "kilobytes" or "kb"; "MBytes" can be written as "megabytes" or "MB"; "kbits" can be written as "kilobits"; and so forth\&. Tor also accepts "byte" and "bit" in the singular\&. The prefixes "tera" and "T" are also recognized\&. If no units are given, we default to bytes\&. To avoid confusion, we recommend writing "bytes" or "bits" explicitly, since it\(cqs easy to forget that "B" means bytes, not bits\&. .RE .PP @@ -219,6 +225,7 @@ If this option is set manually, or via t .RS 4 In its first form, when set along with a corresponding Bridge line, the Tor client forwards its traffic to a SOCKS\-speaking proxy on "IP:PORT"\&. (IPv4 addresses should written as\-is; IPv6 addresses should be wrapped in square brackets\&.) It\(cqs the duty of that proxy to properly forward the traffic to the bridge\&. + In its second form, when set along with a corresponding Bridge line, the Tor client launches the pluggable transport proxy executable in \fIpath\-to\-binary\fR using @@ -272,12 +279,13 @@ If this option is set to 0, don\(cqt all .RS 4 The minimum number of file descriptors that must be available to the Tor process before it will start\&. Tor will ask the OS for as many file descriptors as the OS will allow (you can find this by "ulimit \-H \-n")\&. If this number is less than ConnLimit, then Tor will refuse to start\&. + You probably don\(cqt need to adjust this\&. It has no effect on Windows since that platform lacks getrlimit()\&. (Default: 1000) .RE .PP \fBDisableNetwork\fR \fB0\fR|\fB1\fR .RS 4 -When this option is set, we don\(cqt listen for or accept any connections other than controller connections, and we close (and don\(cqt reattempt) any outbound connections\&. Controllers sometimes use this option to avoid using the network until Tor is fully configured\&. (Default: 0) +When this option is set, we don\(cqt listen for or accept any connections other than controller connections, and we close (and don\(cqt reattempt) any outbound connections\&. Controllers sometimes use this option to avoid using the network until Tor is fully configured\&. Tor will make still certain network\-related calls (like DNS lookups) as a part of its configuration process, even if DisableNetwork is set\&. (Default: 0) .RE .PP \fBConstrainedSockets\fR \fB0\fR|\fB1\fR @@ -285,10 +293,13 @@ When this option is set, we don\(cqt lis If set, Tor will tell the kernel to attempt to shrink the buffers for all sockets to the size specified in \fBConstrainedSockSize\fR\&. This is useful for virtual servers and other environments where system level TCP buffers may be limited\&. If you\(cqre on a virtual server, and you encounter the "Error creating network socket: No buffer space available" message, you are likely experiencing this problem\&. + The preferred solution is to have the admin increase the buffer pool for the host itself via /proc/sys/net/ipv4/tcp_mem or equivalent facility; this configuration option is a second\-resort\&. + The DirPort option should also not be used if TCP buffers are scarce\&. The cached directory requests consume additional sockets which exacerbates the problem\&. + You should \fBnot\fR enable this feature unless you encounter the "no buffer space available" issue\&. Reducing the TCP buffers affects window size for the TCP stream and will reduce throughput in proportion to round trip time on long paths\&. (Default: 0) @@ -309,6 +320,7 @@ torspec)\&. Note: unless you also specif or \fBCookieAuthentication\fR, setting this option will cause Tor to allow any process on the local host to control it\&. (Setting both authentication methods means either method is sufficient to authenticate to Tor\&.) This option is required for many Tor controllers; most use the value of 9051\&. If a unix domain socket is used, you may quote the path using standard C escape sequences\&. Set it to "auto" to have Tor pick a port for you\&. (Default: 0) + Recognized flags are\&... .PP \fBGroupWritable\fR @@ -331,7 +343,7 @@ Unix domain sockets only: Do not insist .RS 4 Like ControlPort, but listens on a Unix domain socket, rather than a TCP socket\&. \fI0\fR -disables ControlSocket (Unix and Unix\-like systems only\&.) +disables ControlSocket\&. (Unix and Unix\-like systems only\&.) (Default: 0) .RE .PP \fBControlSocketsGroupWritable\fR \fB0\fR|\fB1\fR @@ -408,12 +420,14 @@ Use Tor\(cqs default hard\-coded Fallbac Use a nonstandard authoritative directory server at the provided address and port, with the specified key fingerprint\&. This option can be repeated many times, for multiple authoritative directory servers\&. Flags are separated by spaces, and determine what kind of an authority this directory is\&. By default, an authority is not authoritative for any directory style or version unless an appropriate flag is given\&. Tor will use this authority as a bridge authoritative directory if the "bridge" flag is set\&. If a flag "orport=\fBport\fR" is given, Tor will use the given port when opening encrypted tunnels to the dirserver\&. If a flag "weight=\fBnum\fR" is given, then the directory server is chosen randomly with probability proportional to that weight (default 1\&.0)\&. If a flag "v3ident=\fBfp\fR" is given, the dirserver is a v3 directory authority whose v3 long\-term signing key has the fingerprint \fBfp\fR\&. Lastly, if an "ipv6=\fB[\fR\fIipv6address\fR\fB]\fR:\fIorport\fR" flag is present, then the directory authority is listening for IPv6 connections on the indicated IPv6 address and OR Port\&. + Tor will contact the authority at \fIipv4address\fR to download directory documents\&. The provided \fIport\fR value is a dirport; clients ignore this in favor of the specified "orport=" value\&. If an IPv6 ORPort is supplied, Tor will also download directory documents at the IPv6 ORPort\&. + If no \fBDirAuthority\fR line is given, Tor will use the default directory authorities\&. NOTE: this option is intended for setting up a private Tor network with its own directory authorities\&. If you use it, you will be distinguishable from other users, because you won\(cqt believe the same authorities they do\&. @@ -553,10 +567,13 @@ As above, but select messages by range o \fIand\fR by a set of "logging domains"\&. Each logging domain corresponds to an area of functionality inside Tor\&. You can specify any number of severity ranges for a single log statement, each of them prefixed by a comma\-separated list of logging domains\&. You can prefix a domain with ~ to indicate negation, and use * to indicate "all domains"\&. If you specify a severity range without a list of domains, it matches all domains\&. + This is an advanced feature which is most useful for debugging one or two of Tor\(cqs subsystems at a time\&. + The currently recognized domains are: general, crypto, net, config, fs, protocol, mm, http, app, control, circ, rend, bug, dir, dirserv, or, edge, acct, hist, handshake, heartbeat, channel, sched, guard, consdiff, and dos\&. Domain names are case\-insensitive\&. + For example, "Log [handshake]debug [~net,~mm]info notice stdout" sends to stdout: all handshake messages of any severity, all info\-and\-higher messages from domains other than networking and memory management, and all messages of severity notice or higher\&. .RE .PP @@ -628,6 +645,7 @@ When logging to Android\(cqs logging sub .RS 4 Tor can scrub potentially sensitive strings from log messages (e\&.g\&. addresses) by replacing them with the string [scrubbed]\&. This way logs can still be useful, but they don\(cqt leave behind personally identifying information about what sites a user might have visited\&. + If this option is set to 0, Tor will not perform any scrubbing, if it is set to 1, all potentially sensitive strings are replaced\&. If it is set to relay, all log messages generated when acting as a relay are sanitized, but all messages generated when acting as a client are not\&. (Default: 1) .RE .PP @@ -666,9 +684,9 @@ Specify this option if using dynamic har If non\-zero, try to write to disk less frequently than we would otherwise\&. This is useful when running on flash memory or other media that support only a limited number of writes\&. (Default: 0) .RE .PP -\fBCircuitPriorityHalflife\fR \fINUM1\fR +\fBCircuitPriorityHalflife\fR \fINUM\fR .RS 4 -If this value is set, we override the default algorithm for choosing which circuit\(cqs cell to deliver or relay next\&. When the value is 0, we round\-robin between the active circuits on a connection, delivering one cell from each in turn\&. When the value is positive, we prefer delivering cells from whichever connection has the lowest weighted cell count, where cells are weighted exponentially according to the supplied CircuitPriorityHalflife value (in seconds)\&. If this option is not set at all, we use the behavior recommended in the current consensus networkstatus\&. This is an advanced option; you generally shouldn\(cqt have to mess with it\&. (Default: not set) +If this value is set, we override the default algorithm for choosing which circuit\(cqs cell to deliver or relay next\&. It is delivered first to the circuit that has the lowest weighted cell count, where cells are weighted exponentially according to this value (in seconds)\&. If the value is \-1, it is taken from the consensus if possible else it will fallback to the default value of 30\&. Minimum: 1, Maximum: 2147483647\&. This can be defined as a float value\&. This is an advanced option; you generally shouldn\(cqt have to mess with it\&. (Default: \-1) .RE .PP \fBCountPrivateBandwidth\fR \fB0\fR|\fB1\fR @@ -683,7 +701,7 @@ If this option is set to 1, we always tr .PP \fBNoExec\fR \fB0\fR|\fB1\fR .RS 4 -If this option is set to 1, then Tor will never launch another executable, regardless of the settings of PortForwardingHelper, ClientTransportPlugin, or ServerTransportPlugin\&. Once this option has been set to 1, it cannot be set back to 0 without restarting Tor\&. (Default: 0) +If this option is set to 1, then Tor will never launch another executable, regardless of the settings of ClientTransportPlugin or ServerTransportPlugin\&. Once this option has been set to 1, it cannot be set back to 0 without restarting Tor\&. (Default: 0) .RE .PP \fBSchedulers\fR \fBKIST\fR|\fBKISTLite\fR|\fBVanilla\fR @@ -691,8 +709,11 @@ If this option is set to 1, then Tor wil Specify the scheduler type that tor should use\&. The scheduler is responsible for moving data around within a Tor process\&. This is an ordered list by priority which means that the first value will be tried first and if unavailable, the second one is tried and so on\&. It is possible to change these values at runtime\&. This option mostly effects relays, and most operators should leave it set to its default value\&. (Default: KIST,KISTLite,Vanilla) The possible scheduler types are: + \fBKIST\fR: Kernel\-Informed Socket Transport\&. Tor will use TCP information from the kernel to make informed decisions regarding how much data to send and when to send it\&. KIST also handles traffic in batches (see KISTSchedRunInterval) in order to improve traffic prioritization decisions\&. As implemented, KIST will only work on Linux kernel version 2\&.6\&.39 or higher\&. + \fBKISTLite\fR: Same as KIST but without kernel support\&. Tor will use all the same mechanics as with KIST, including the batching, but its decisions regarding how much data to send will not be as good\&. KISTLite will work on all kernels and operating systems, and the majority of the benefits of KIST are still realized with KISTLite\&. + \fBVanilla\fR: The scheduler that Tor used before KIST was implemented\&. It sends as much data as possible, as soon as possible\&. Vanilla will work on all kernels and operating systems\&. .RE .PP @@ -713,8 +734,10 @@ The following options are useful only fo .RS 4 When set along with UseBridges, instructs Tor to use the relay at "IP:ORPort" as a "bridge" relaying into the Tor network\&. If "fingerprint" is provided (using the same format as for DirAuthority), we will verify that the relay running at that location has the right fingerprint\&. We also use fingerprint to look up the bridge descriptor at the bridge authority, if it\(cqs provided and if UpdateBridgesFromAuthority is set too\&. + If "transport" is provided, it must match a ClientTransportPlugin line\&. We then use that pluggable transport\(cqs proxy to transfer data to the bridge, rather than connecting to the bridge directly\&. Some transports use a transport\-specific method to work out the remote address to connect to\&. These transports typically ignore the "IP:ORPort" specified in the bridge line\&. + Tor passes any "key=val" settings to the pluggable transport proxy as per\-connection arguments when connecting to the bridge\&. Consult the documentation of the pluggable transport for details of what arguments it supports\&. .RE .PP @@ -758,10 +781,13 @@ If set to 1, Tor will not not hold OR co .RS 4 A list of identity fingerprints, country codes, and address patterns of nodes to avoid when building a circuit\&. Country codes are 2\-letter ISO3166 codes, and must be wrapped in braces; fingerprints may be preceded by a dollar sign\&. (Example: ExcludeNodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255\&.254\&.0\&.0/8) + By default, this option is treated as a preference that Tor is allowed to override in order to keep working\&. For example, if you try to connect to a hidden service, but you have excluded all of the hidden service\(cqs introduction points, Tor will connect to one of them anyway\&. If you do not want this behavior, set the StrictNodes option (documented below)\&. + Note also that if you are a relay, this (and the other node selection options below) only affects your own circuits that Tor builds for you\&. Clients can still build circuits through you to any node\&. Controllers can tell Tor to build circuits through any node\&. + Country codes are case\-insensitive\&. The code "{??}" refers to nodes whose country can\(cqt be identified\&. No country code, including {??}, works if no GeoIPFile can be loaded\&. See also the GeoIPExcludeUnknown option below\&. .RE .PP @@ -789,14 +815,18 @@ the Tor network\&. See the \fBExcludeNodes\fR option for more information on how to specify nodes\&. + Note that if you list too few nodes here, or if you exclude too many exit nodes with ExcludeExitNodes, you can degrade functionality\&. For example, if none of the exits you list allows traffic on port 80 or 443, you won\(cqt be able to browse the web\&. + Note also that not every circuit is used to deliver traffic \fBoutside\fR of the Tor network\&. It is normal to see non\-exit circuits (such as those used to connect to hidden services, those that do directory fetches, those used for relay reachability self\-tests, and so on) that end at a non\-exit node\&. To keep a node from being used entirely, see ExcludeNodes and StrictNodes\&. + The ExcludeNodes option overrides this option: any node listed in both ExitNodes and ExcludeNodes is treated as excluded\&. + The \&.exit address notation, if enabled via MapAddress, overrides this option\&. .RE .PP @@ -804,6 +834,7 @@ The \&.exit address notation, if enabled .RS 4 A list of identity fingerprints and country codes of nodes to use for the first hop in your normal circuits\&. Normal circuits include all circuits except for direct connections to directory servers\&. The Bridge option overrides this option; if you have configured bridges and UseBridges is 1, the Bridges are used as your entry nodes\&. + The ExcludeNodes option overrides this option: any node listed in both EntryNodes and ExcludeNodes is treated as excluded\&. See the \fBExcludeNodes\fR option for more information on how to specify nodes\&. @@ -853,6 +884,7 @@ is used\&. If \fBHTTPSProxy\fR is set then these connections will go through that proxy\&. + The separation between \fBReachableORAddresses\fR and @@ -887,6 +919,7 @@ is the fingerprint of the server), use " \fItorserver\fR is the fingerprint of the server), use "MapAddress *\&.example\&.com *\&.example\&.com\&.torserver\&.exit"\&. (Note the leading "*\&." in each part of the directive\&.) You can also redirect all subdomains of a domain to a single address\&. For example, "MapAddress *\&.example\&.com www\&.example\&.com"\&. + NOTES: .sp .RS 4 @@ -1001,8 +1034,10 @@ If 1, Tor will not put two servers whose .RS 4 Open this port to listen for connections from SOCKS\-speaking applications\&. Set this to 0 if you don\(cqt want to allow application connections via SOCKS\&. Set it to "auto" to have Tor pick a port for you\&. This directive can be specified multiple times to bind to multiple addresses/ports\&. If a unix domain socket is used, you may quote the path using standard C escape sequences\&. (Default: 9050) + NOTE: Although this option allows you to specify an IP address other than localhost, you should do so only with extreme caution\&. The SOCKS protocol is unencrypted and (as we use it) unauthenticated, so exposing it in this way could leak your information to anybody watching your network, and allow anybody to use your computer as an open proxy\&. + The \fIisolation flags\fR arguments give Tor rules for which streams received on this SocksPort are allowed to share circuits with one another\&. Recognized isolation flags are: @@ -1149,7 +1184,7 @@ Let a socks connection wait NUM seconds .PP \fBTokenBucketRefillInterval\fR \fINUM\fR [\fBmsec\fR|\fBsecond\fR] .RS 4 -Set the refill interval of Tor\(cqs token bucket to NUM milliseconds\&. NUM must be between 1 and 1000, inclusive\&. Note that the configured bandwidth limits are still expressed in bytes per second: this option only affects the frequency with which Tor checks to see whether previously exhausted connections may read again\&. Can not be changed while tor is running\&. (Default: 100 msec) +Set the refill delay interval of Tor\(cqs token bucket to NUM milliseconds\&. NUM must be between 1 and 1000, inclusive\&. When Tor is out of bandwidth, on a connection or globally, it will wait up to this long before it tries to use that connection again\&. Note that bandwidth limits are still expressed in bytes per second: this option only affects the frequency with which Tor checks to see whether previously exhausted connections may read again\&. Can not be changed while tor is running\&. (Default: 100 msec) .RE .PP \fBTrackHostExits\fR \fIhost\fR,\fI\&.domain\fR,\fI\&...\fR @@ -1193,6 +1228,11 @@ This torrc option specifies whether clie If UseEntryGuards is set to 1, we will try to pick a total of NUM routers as long\-term entries for our circuits\&. If NUM is 0, we try to learn the number from the guard\-n\-primary\-guards\-to\-use consensus parameter, and default to 1 if the consensus parameter isn\(cqt set\&. (Default: 0) .RE .PP +\fBNumPrimaryGuards\fR \fINUM\fR +.RS 4 +If UseEntryGuards is set to 1, we will try to pick NUM routers for our primary guard list, which is the set of routers we strongly prefer when connecting to the Tor network\&. If NUM is 0, we try to learn the number from the guard\-n\-primary\-guards consensus parameter, and default to 3 if the consensus parameter isn\(cqt set\&. (Default: 0) +.RE +.PP \fBNumDirectoryGuards\fR \fINUM\fR .RS 4 If UseEntryGuards is set to 1, we try to make sure we have at least NUM routers to use as directory guards\&. If this option is set to 0, use the value from the guard\-n\-primary\-dir\-guards\-to\-use consensus parameter, and default to 3 if the consensus parameter isn\(cqt set\&. (Default: 0) @@ -1219,6 +1259,7 @@ When this option is enabled, Tor will ma .RS 4 When Tor needs to assign a virtual (unused) address because of a MAPADDRESS command from the controller or the AutomapHostsOnResolve feature, Tor picks an unassigned address from this range\&. (Defaults: 127\&.192\&.0\&.0/10 and [FE80::]/10 respectively\&.) + When providing proxy server service to a network of computers using a tool like dns\-proxy\-tor, change the IPv4 network to "10\&.192\&.0\&.0/10" or "172\&.16\&.0\&.0/12" and change the IPv6 network to "[FC00::]/7"\&. The default \fBVirtualAddrNetwork\fR address ranges on a properly configured machine will route to the loopback or link\-local interface\&. The maximum number of bits for the network prefix is set to 104 for IPv6 and 16 for IPv4\&. However, a wider network \- smaller prefix length @@ -1242,13 +1283,14 @@ When this option is disabled, Tor blocks .PP \fBHTTPTunnelPort\fR [\fIaddress\fR:]\fIport\fR|\fBauto\fR [\fIisolation flags\fR] .RS 4 -Open this port to listen for proxy connections using the "HTTP CONNECT" protocol instead of SOCKS\&. Set this to 0 0 if you don\(cqt want to allow "HTTP CONNECT" connections\&. Set the port to "auto" to have Tor pick a port for you\&. This directive can be specified multiple times to bind to multiple addresses/ports\&. See SOCKSPort for an explanation of isolation flags\&. (Default: 0) +Open this port to listen for proxy connections using the "HTTP CONNECT" protocol instead of SOCKS\&. Set this to 0 if you don\(cqt want to allow "HTTP CONNECT" connections\&. Set the port to "auto" to have Tor pick a port for you\&. This directive can be specified multiple times to bind to multiple addresses/ports\&. See SOCKSPort for an explanation of isolation flags\&. (Default: 0) .RE .PP \fBTransPort\fR [\fIaddress\fR:]\fIport\fR|\fBauto\fR [\fIisolation flags\fR] .RS 4 Open this port to listen for transparent proxy connections\&. Set this to 0 if you don\(cqt want to allow transparent proxy connections\&. Set the port to "auto" to have Tor pick a port for you\&. This directive can be specified multiple times to bind to multiple addresses/ports\&. See SOCKSPort for an explanation of isolation flags\&. + TransPort requires OS support for transparent proxies, such as BSDs\*(Aq pf or Linux\(cqs IPTables\&. If you\(cqre planning to use Tor as a transparent proxy for a network, you\(cqll want to examine and change VirtualAddrNetwork from the default setting\&. (Default: 0) .RE .PP @@ -1256,10 +1298,13 @@ TransPort requires OS support for transp .RS 4 TransProxyType may only be enabled when there is transparent proxy listener enabled\&. + Set this to "TPROXY" if you wish to be able to use the TPROXY Linux module to transparently proxy connections that are configured using the TransPort option\&. Detailed information on how to configure the TPROXY feature can be found in the Linux kernel source tree in the file Documentation/networking/tproxy\&.txt\&. + Set this option to "ipfw" to use the FreeBSD ipfw interface\&. + On *BSD operating systems when using pf, set this to "pf\-divert" to take advantage of divert\-to rules, which do not modify the packets like @@ -1270,17 +1315,20 @@ rules can be found in the pf\&.conf(5) m divert\-to is available to use on versions greater than or equal to OpenBSD 4\&.4\&. + Set this to "default", or leave it unconfigured, to use regular IPTables on Linux, or to use pf rdr\-to rules on *BSD systems\&. -(Default: "default"\&.) + +(Default: "default") .RE .PP \fBNATDPort\fR [\fIaddress\fR:]\fIport\fR|\fBauto\fR [\fIisolation flags\fR] .RS 4 Open this port to listen for connections from old versions of ipfw (as included in old versions of FreeBSD, etc) using the NATD protocol\&. Use 0 if you don\(cqt want to allow NATD connections\&. Set the port to "auto" to have Tor pick a port for you\&. This directive can be specified multiple times to bind to multiple addresses/ports\&. See SocksPort for an explanation of isolation flags\&. + This option is only for people who cannot use TransPort\&. (Default: 0) .RE .PP @@ -1346,10 +1394,13 @@ be used when running a tor2web Hidden Se .RS 4 A list of identity fingerprints, nicknames, country codes and address patterns of nodes that are allowed to be used as RPs in HS circuits; any other nodes will not be used as RPs\&. (Example: Tor2webRendezvousPoints Fastyfasty, ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255\&.254\&.0\&.0/8) + This feature can only be used if Tor2webMode is also enabled\&. + ExcludeNodes have higher priority than Tor2webRendezvousPoints, which means that nodes specified in ExcludeNodes will not be picked as RPs\&. + If no nodes in Tor2webRendezvousPoints are currently available for use, Tor will choose a random node when building HS circuits\&. .RE .PP @@ -1359,6 +1410,7 @@ A list of identity fingerprints, nicknam (Example: HSLayer2Nodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255\&.254\&.0\&.0/8) + When this is set, the resulting hidden service paths will look like: C \- G \- L2 \- M \- Rend @@ -1373,6 +1425,7 @@ S \- G \- L2 \- M \- HSDir S \- G \- L2 \- M \- Intro + where C is this client, S is the service, G is the Guard node, L2 is a node from this option, and M is a random middle node\&. Rend, HSDir, and Intro point selection is not affected by this option\&. This option may be combined with HSLayer3Nodes to create paths of the form: @@ -1389,8 +1442,11 @@ S \- G \- L2 \- L3 \- HSDir S \- G \- L2 \- L3 \- Intro + ExcludeNodes have higher priority than HSLayer2Nodes, which means that nodes specified in ExcludeNodes will not be picked\&. +When either this option or HSLayer3Nodes are set, the /16 subnet and node family restrictions are removed for hidden service circuits\&. Additionally, we allow the guard node to be present as the Rend, HSDir, and IP node, and as the hop before it\&. This is done to prevent the adversary from inferring information about our guard, layer2, and layer3 node choices at later points in the path\&. + This option is meant to be managed by a Tor controller such as https://github\&.com/mikeperry\-tor/vanguards that selects and updates this set of nodes for you\&. Hence it does not do load balancing if fewer than 20 nodes are selected, and if no nodes in HSLayer2Nodes are currently available for use, Tor will not work\&. Please use extreme care if you are setting this option manually\&. @@ -1402,6 +1458,7 @@ A list of identity fingerprints, nicknam (Example: HSLayer3Nodes ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255\&.254\&.0\&.0/8) + When this is set by itself, the resulting hidden service paths will look like: C \- G \- M \- L3 \- Rend @@ -1432,8 +1489,11 @@ S \- G \- L2 \- L3 \- HSDir S \- G \- L2 \- L3 \- Intro + ExcludeNodes have higher priority than HSLayer3Nodes, which means that nodes specified in ExcludeNodes will not be picked\&. +When either this option or HSLayer2Nodes are set, the /16 subnet and node family restrictions are removed for hidden service circuits\&. Additionally, we allow the guard node to be present as the Rend, HSDir, and IP node, and as the hop before it\&. This is done to prevent the adversary from inferring information about our guard, layer2, and layer3 node choices at later points in the path\&. + This option is meant to be managed by a Tor controller such as https://github\&.com/mikeperry\-tor/vanguards that selects and updates this set of nodes for you\&. Hence it does not do load balancing if fewer than 20 nodes are selected, and if no nodes in HSLayer3Nodes are currently available for use, Tor will not work\&. Please use extreme care if you are setting this option manually\&. @@ -1458,12 +1518,15 @@ Microdescriptors are a smaller version o .RS 4 These options override the default behavior of Tor\(cqs (\fBcurrently experimental\fR) path bias detection algorithm\&. To try to find broken or misbehaving guard nodes, Tor looks for nodes where more than a certain fraction of circuits through that guard fail to get built\&. + The PathBiasCircThreshold option controls how many circuits we need to build through a guard before we make these checks\&. The PathBiasNoticeRate, PathBiasWarnRate and PathBiasExtremeRate options control what fraction of circuits must succeed through a guard so we won\(cqt write log messages\&. If less than PathBiasExtremeRate circuits succeed \fBand\fR PathBiasDropGuards is set to 1, we disable use of that guard\&. + When we have seen more than PathBiasScaleThreshold circuits through a guard, we scale our observations by 0\&.5 (governed by the consensus) so that new observations don\(cqt get swamped by old ones\&. + By default, or if a negative value is provided for one of these options, Tor uses reasonable defaults from the networkstatus consensus document\&. If no defaults are available there, these options default to 150, \&.70, \&.50, \&.30, 0, and 300 respectively\&. .RE .sp @@ -1477,8 +1540,10 @@ By default, or if a negative value is pr .RS 4 Similar to the above options, these options override the default behavior of Tor\(cqs (\fBcurrently experimental\fR) path use bias detection algorithm\&. + Where as the path bias parameters govern thresholds for successfully building circuits, these four path use bias parameters govern thresholds only for circuit usage\&. Circuits which receive no stream usage are not counted by this detection algorithm\&. A used circuit is considered successful if it is capable of carrying streams or otherwise receiving well\-formed responses to RELAY cells\&. + By default, or if a negative value is provided for one of these options, Tor uses reasonable defaults from the networkstatus consensus document\&. If no defaults are available there, these options default to 20, \&.80, \&.60, and 100, respectively\&. .RE .PP @@ -1510,22 +1575,22 @@ If this option is set to 1, Tor prefers .PP \fBPathsNeededToBuildCircuits\fR \fINUM\fR .RS 4 -Tor clients don\(cqt build circuits for user traffic until they know about enough of the network so that they could potentially construct enough of the possible paths through the network\&. If this option is set to a fraction between 0\&.25 and 0\&.95, Tor won\(cqt build circuits until it has enough descriptors or microdescriptors to construct that fraction of possible paths\&. Note that setting this option too low can make your Tor client less anonymous, and setting it too high can prevent your Tor client from bootstrapping\&. If this option is negative, Tor will use a default value chosen by the directory authorities\&. If the directory authorities do not choose a value, Tor will default to 0\&.6\&. (Default: \-1\&.) +Tor clients don\(cqt build circuits for user traffic until they know about enough of the network so that they could potentially construct enough of the possible paths through the network\&. If this option is set to a fraction between 0\&.25 and 0\&.95, Tor won\(cqt build circuits until it has enough descriptors or microdescriptors to construct that fraction of possible paths\&. Note that setting this option too low can make your Tor client less anonymous, and setting it too high can prevent your Tor client from bootstrapping\&. If this option is negative, Tor will use a default value chosen by the directory authorities\&. If the directory authorities do not choose a value, Tor will default to 0\&.6\&. (Default: \-1) .RE .PP -\fBClientBootstrapConsensusAuthorityDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBClientBootstrapConsensusAuthorityDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download consensuses from authorities if they are bootstrapping (that is, they don\(cqt have a usable, reasonably live consensus)\&. Only used by clients fetching from a list of fallback directory mirrors\&. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures\&. (Default: 6, 11, 3600, 10800, 25200, 54000, 111600, 262800) +Initial delay in seconds for when clients should download consensuses from authorities if they are bootstrapping (that is, they don\(cqt have a usable, reasonably live consensus)\&. Only used by clients fetching from a list of fallback directory mirrors\&. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures\&. (Default: 6) .RE .PP -\fBClientBootstrapConsensusFallbackDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBClientBootstrapConsensusFallbackDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download consensuses from fallback directory mirrors if they are bootstrapping (that is, they don\(cqt have a usable, reasonably live consensus)\&. Only used by clients fetching from a list of fallback directory mirrors\&. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures\&. (Default: 0, 1, 4, 11, 3600, 10800, 25200, 54000, 111600, 262800) +Initial delay in seconds for when clients should download consensuses from fallback directory mirrors if they are bootstrapping (that is, they don\(cqt have a usable, reasonably live consensus)\&. Only used by clients fetching from a list of fallback directory mirrors\&. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures\&. (Default: 0) .RE .PP -\fBClientBootstrapConsensusAuthorityOnlyDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download consensuses from authorities if they are bootstrapping (that is, they don\(cqt have a usable, reasonably live consensus)\&. Only used by clients which don\(cqt have or won\(cqt fetch from a list of fallback directory mirrors\&. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures\&. (Default: 0, 3, 7, 3600, 10800, 25200, 54000, 111600, 262800) +Initial delay in seconds for when clients should download consensuses from authorities if they are bootstrapping (that is, they don\(cqt have a usable, reasonably live consensus)\&. Only used by clients which don\(cqt have or won\(cqt fetch from a list of fallback directory mirrors\&. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by connection failures\&. (Default: 0) .RE .PP \fBClientBootstrapConsensusMaxInProgressTries\fR \fINUM\fR @@ -1564,6 +1629,7 @@ Note: as of Oct 2017, the BridgeDB part .RS 4 Administrative contact information for this relay or bridge\&. This line can be used to contact you if your relay or bridge is misconfigured or something else goes wrong\&. Note that we archive and publish all descriptors containing these lines and that Google indexes them, so spammers might also collect them\&. You may want to obscure the fact that it\(cqs an email address and/or generate a new address for this purpose\&. + ContactInfo \fBmust\fR be set to a working address if you run more than one relay or bridge\&. (Really, everybody running a relay or bridge should set it\&.) @@ -1573,34 +1639,45 @@ be set to a working address if you run m .RS 4 Tells Tor whether to run as an exit relay\&. If Tor is running as a non\-bridge server, and ExitRelay is set to 1, then Tor allows traffic to exit according to the ExitPolicy option (or the default ExitPolicy if none is specified)\&. + If ExitRelay is set to 0, no traffic is allowed to exit, and the ExitPolicy option is ignored\&. + If ExitRelay is set to "auto", then Tor behaves as if it were set to 1, but warns the user if this would cause traffic to exit\&. In a future version, the default value will be 0\&. (Default: auto) .RE .PP \fBExitPolicy\fR \fIpolicy\fR,\fIpolicy\fR,\fI\&...\fR .RS 4 -Set an exit policy for this server\&. Each policy is of the form "\fBaccept[6]\fR|\fBreject[6]\fR\fIADDR\fR[/\fIMASK\fR][:\fIPORT\fR]"\&. If /\fIMASK\fR +Set an exit policy for this server\&. Each policy is of the form "\fBaccept[6]\fR|\fBreject[6]\fR +\fIADDR\fR[/\fIMASK\fR][:\fIPORT\fR]"\&. If /\fIMASK\fR is omitted then this policy just applies to the host given\&. Instead of giving a host or network you can also use "*" to denote the universe (0\&.0\&.0\&.0/0 and ::/0), or *4 to denote all IPv4 addresses, and *6 to denote all IPv6 addresses\&. \fIPORT\fR can be a single port number, an interval of ports "\fIFROM_PORT\fR\-\fITO_PORT\fR", or "*"\&. If \fIPORT\fR is omitted, that means "*"\&. + For example, "accept 18\&.7\&.22\&.69:*,reject 18\&.0\&.0\&.0/8:*,accept *:*" would reject any IPv4 traffic destined for MIT except for web\&.mit\&.edu, and accept any other IPv4 or IPv6 traffic\&. + Tor also allows IPv6 exit policy entries\&. For instance, "reject6 [FC00::]/7:*" rejects all destinations that share 7 most significant bit prefix with address FC00::\&. Respectively, "accept6 [C000::]/3:*" accepts all destinations that share 3 most significant bit prefix with address C000::\&. + accept6 and reject6 only produce IPv6 exit policy entries\&. Using an IPv4 address with accept6 or reject6 is ignored and generates a warning\&. accept/reject allows either IPv4 or IPv6 addresses\&. Use *4 as an IPv4 wildcard address, and *6 as an IPv6 wildcard address\&. accept/reject * expands to matching IPv4 and IPv6 wildcard address rules\&. + To specify all IPv4 and IPv6 internal and link\-local networks (including 0\&.0\&.0\&.0/8, 169\&.254\&.0\&.0/16, 127\&.0\&.0\&.0/8, 192\&.168\&.0\&.0/16, 10\&.0\&.0\&.0/8, 172\&.16\&.0\&.0/12, [::]/8, [FC00::]/7, [FE80::]/10, [FEC0::]/10, [FF00::]/8, and [::]/127), you can use the "private" alias instead of an address\&. ("private" always produces rules for IPv4 and IPv6 addresses, even when used with accept6/reject6\&.) + Private addresses are rejected by default (at the beginning of your exit policy), along with any configured primary public IPv4 and IPv6 addresses\&. These private addresses are rejected unless you set the ExitPolicyRejectPrivate config option to 0\&. For example, once you\(cqve done that, you could allow HTTP to 127\&.0\&.0\&.1 and block all other connections to internal networks with "accept 127\&.0\&.0\&.1:80,reject private:*", though that may also allow connections to your own computer that are addressed to its public (external) IP address\&. See RFC 1918 and RFC 3330 for more details about internal and reserved IP address space\&. See ExitPolicyRejectLocalInterfaces if you want to block every address on the relay, even those that aren\(cqt advertised in the descriptor\&. + This directive can be specified multiple times so you don\(cqt have to put it all on one line\&. + Policies are considered first to last, and the first match wins\&. If you want to allow the same ports on IPv4 and IPv6, write your rules using accept/reject *\&. If you want to allow different ports on IPv4 and IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules using accept/reject *4\&. If you want to _replace_ the default exit policy, end your exit policy with either a reject *:* or an accept *:*\&. Otherwise, you\(cqre _augmenting_ (prepending to) the default exit policy\&. + If you want to use a reduced exit policy rather than the default exit policy, set "ReducedExitPolicy 1"\&. If you want to \fIreplace\fR the default exit policy with your custom exit policy, end your exit policy with either a reject @@ -1610,6 +1687,7 @@ or an accept \fIaugmenting\fR (prepending to) the default or reduced exit policy\&. + The default exit policy is: .sp .if n \{\ @@ -1651,8 +1729,10 @@ Reject all IPv4 and IPv6 addresses that .RS 4 If set, use a reduced exit policy rather than the default one\&. + The reduced exit policy is an alternative to the default exit policy\&. It allows as many Internet services as possible while still blocking the majority of TCP ports\&. Currently, the policy allows approximately 65 ports\&. This reduces the odds that your node will be used for peer\-to\-peer applications\&. + The reduced exit policy is: .sp .if n \{\ @@ -1768,8 +1848,10 @@ If we have more onionskins queued for pr .RS 4 Declare that this Tor relay is controlled or administered by a group or organization identical or similar to that of the other relays, defined by their (possibly $\-prefixed) identity fingerprints\&. This option can be repeated many times, for convenience in defining large families: all fingerprints in all MyFamily lines are merged into one list\&. When two relays both declare that they are in the same \*(Aqfamily\*(Aq, Tor clients will not use them in the same circuit\&. (Each relay only needs to list the other servers in its family; it doesn\(cqt need to list itself, but it won\(cqt hurt if it does\&.) Do not list any bridge relay as it would compromise its concealment\&. + When listing a node, it\(cqs better to list it by fingerprint than by nickname: fingerprints are more reliable\&. + If you run more than one relay, the MyFamily option on each relay \fBmust\fR list all other relays, as described above\&. @@ -1777,7 +1859,9 @@ list all other relays, as described abov .PP \fBNickname\fR \fIname\fR .RS 4 -Set the server\(cqs nickname to \*(Aqname\*(Aq\&. Nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a\-zA\-Z0\-9]\&. +Set the server\(cqs nickname to \*(Aqname\*(Aq\&. Nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a\-zA\-Z0\-9]\&. If not set, +\fBUnnamed\fR +will be used\&. Relays can always be uniquely identified by their identity fingerprints\&. .RE .PP \fBNumCPUs\fR \fInum\fR @@ -1789,6 +1873,7 @@ How many processes to use at once for de .RS 4 Advertise this port to listen for connections from Tor clients and servers\&. This option is required to be a Tor server\&. Set it to "auto" to have Tor pick a port for you\&. Set it to 0 to not run an ORPort at all\&. This option can occur more than once\&. (Default: 0) + Tor recognizes these flags on each ORPort: .PP \fBNoAdvertise\fR @@ -1816,20 +1901,11 @@ If the address is absent, or resolves to For obvious reasons, NoAdvertise and NoListen are mutually exclusive, and IPv4Only and IPv6Only are mutually exclusive\&. .RE .PP -\fBPortForwarding\fR \fB0\fR|\fB1\fR -.RS 4 -Attempt to automatically forward the DirPort and ORPort on a NAT router connecting this Tor server to the Internet\&. If set, Tor will try both NAT\-PMP (common on Apple routers) and UPnP (common on routers from other manufacturers)\&. (Default: 0) -.RE -.PP -\fBPortForwardingHelper\fR \fIfilename\fR|\fIpathname\fR -.RS 4 -If PortForwarding is set, use this executable to configure the forwarding\&. If set to a filename, the system path will be searched for the executable\&. If set to a path, only the specified path will be executed\&. (Default: tor\-fw\-helper) -.RE -.PP \fBPublishServerDescriptor\fR \fB0\fR|\fB1\fR|\fBv3\fR|\fBbridge\fR,\fB\&...\fR .RS 4 This option specifies which descriptors Tor will publish when acting as a relay\&. You can choose multiple arguments, separated by commas\&. + If this option is set to 0, Tor will not publish its descriptors to any directories\&. (This is useful if you\(cqre testing out your server, or if you\(cqre using a Tor controller that handles directory publishing for you\&.) Otherwise, Tor will publish its descriptors of all type(s) specified\&. The default is "1", which means "if running as a relay or bridge, publish descriptors to the appropriate authorities"\&. Other possibilities are "v3", meaning "publish as if you\(cqre a relay", and "bridge", meaning "publish as if you\(cqre a bridge"\&. .RE .PP @@ -1959,7 +2035,7 @@ Relays only\&. When this option is enabl .PP \fBPaddingStatistics\fR \fB0\fR|\fB1\fR .RS 4 -Relays only\&. When this option is enabled, Tor collects statistics for padding cells sent and received by this relay, in addition to total cell counts\&. These statistics are rounded, and omitted if traffic is low\&. This information is important for load balancing decisions related to padding\&. (Default: 1) +Relays only\&. When this option is enabled, Tor collects statistics for padding cells sent and received by this relay, in addition to total cell counts\&. These statistics are rounded, and omitted if traffic is low\&. This information is important for load balancing decisions related to padding\&. If ExtraInfoStatistics is enabled, it will be published as a part of extra\-info document\&. (Default: 1) .RE .PP \fBDirReqStatistics\fR \fB0\fR|\fB1\fR @@ -2026,6 +2102,11 @@ Store secret keys in DIR\&. Can not be c .RS 4 If this option is set to 0, don\(cqt allow the filesystem group to read the KeywDirectory\&. If the option is set to 1, make the KeyDirectory readable by the default GID\&. (Default: 0) .RE +.PP +\fBRephistTrackTime\fR \fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR|\fBdays\fR|\fBweeks\fR +.RS 4 +Tells an authority, or other node tracking node reliability and history, that fine\-grained information about nodes can be discarded when it hasn\(cqt changed for a given amount of time\&. (Default: 24 hours) +.RE .SH "DIRECTORY SERVER OPTIONS" .sp The following options are useful only for directory servers\&. (Relays with enough bandwidth automatically become directory servers; see DirCache for details\&.) @@ -2041,6 +2122,7 @@ If this option is nonzero, advertise the \fBNoAdvertise\fR flag set\&. (Default: 0) + The same flags are supported here as are supported by ORPort\&. .RE .PP @@ -2262,6 +2344,7 @@ Authoritative directories only\&. A set \fBAuthDirListBadExits\fR is set\&. + (The address pattern syntax here and in the options below is the same as for exit policies, except that you don\(cqt need to say "accept" or "reject", and ports are not needed\&.) .RE .PP @@ -2356,11 +2439,6 @@ V3 authoritative directories only\&. Con If set, the directory authority will sign consensuses not only with its own signing key, but also with a "legacy" key and certificate with a different identity\&. This feature is used to migrate directory authority keys in the event of a compromise\&. (Default: 0) .RE .PP -\fBRephistTrackTime\fR \fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR|\fBdays\fR|\fBweeks\fR -.RS 4 -Tells an authority, or other node tracking node reliability and history, that fine\-grained information about nodes can be discarded when it hasn\(cqt changed for a given amount of time\&. (Default: 24 hours) -.RE -.PP \fBAuthDirHasIPv6Connectivity\fR \fB0\fR|\fB1\fR .RS 4 Authoritative directories only\&. When set to 0, OR ports with an IPv6 address are not included in the authority\(cqs votes\&. When set to 1, IPv6 OR ports are tested for reachability like IPv4 OR ports\&. If the reachability test succeeds, the authority votes for the IPv6 ORPort, and votes Running for the relay\&. If the reachability test fails, the authority does not vote for the IPv6 ORPort, and does not vote Running (Default: 0) @@ -2488,11 +2566,14 @@ Number of introduction points the hidden .RS 4 \fBExperimental \- Non Anonymous\fR Hidden Services on a tor instance in HiddenServiceSingleHopMode make one\-hop (direct) circuits between the onion service server, and the introduction and rendezvous points\&. (Onion service descriptors are still posted using 3\-hop paths, to avoid onion service directories blocking the service\&.) This option makes every hidden service instance hosted by a tor instance a Single Onion Service\&. One\-hop circuits make Single Onion servers easily locatable, but clients remain location\-anonymous\&. However, the fact that a client is accessing a Single Onion rather than a Hidden Service may be statistically distinguishable\&. + + \fBWARNING:\fR Once a hidden service directory has been used by a tor instance in HiddenServiceSingleHopMode, it can \fBNEVER\fR be used again for a hidden service\&. It is best practice to create a new hidden service directory, key, and address for each new Single Onion Service and Hidden Service\&. It is not possible to run Single Onion Services and Hidden Services from the same tor instance: they should be run on different servers with different IP addresses\&. + HiddenServiceSingleHopMode requires HiddenServiceNonAnonymousMode to be set to 1\&. Since a Single Onion service is non\-anonymous, you can not configure a SOCKSPort on a tor instance that is running in \fBHiddenServiceSingleHopMode\fR\&. Can not be changed while tor is running\&. (Default: 0) .RE @@ -2520,12 +2601,9 @@ EnforceDistinctSubnets 0 AssumeReachable 1 AuthDirMaxServersPerAddr 0 AuthDirMaxServersPerAuthAddr 0 -ClientBootstrapConsensusAuthorityDownloadSchedule 0, 2, - 4 (for 40 seconds), 8, 16, 32, 60 -ClientBootstrapConsensusFallbackDownloadSchedule 0, 1, - 4 (for 40 seconds), 8, 16, 32, 60 -ClientBootstrapConsensusAuthorityOnlyDownloadSchedule 0, 1, - 4 (for 40 seconds), 8, 16, 32, 60 +ClientBootstrapConsensusAuthorityDownloadInitialDelay 0 +ClientBootstrapConsensusFallbackDownloadInitialDelay 0 +ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay 0 ClientDNSRejectInternalAddresses 0 ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 @@ -2540,17 +2618,16 @@ TestingV3AuthInitialVoteDelay 20 seconds TestingV3AuthInitialDistDelay 20 seconds TestingAuthDirTimeToLearnReachability 0 minutes TestingEstimatedDescriptorPropagationTime 0 minutes -TestingServerDownloadSchedule 0, 0, 0, 5, 10, 15, 20, 30, 60 -TestingClientDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 -TestingServerConsensusDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 -TestingClientConsensusDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 -TestingBridgeDownloadSchedule 10, 30, 60 -TestingBridgeBootstrapDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 +TestingServerDownloadInitialDelay 0 +TestingClientDownloadInitialDelay 0 +TestingServerConsensusDownloadInitialDelay 0 +TestingClientConsensusDownloadInitialDelay 0 +TestingBridgeDownloadInitialDelay 10 +TestingBridgeBootstrapDownloadInitialDelay 0 TestingClientMaxIntervalWithoutRequest 5 seconds TestingDirConnectionMaxStall 30 seconds TestingEnableConnBwEvent 1 TestingEnableCellStatsEvent 1 -TestingEnableTbEmptyEvent 1 .fi .if n \{\ .RE @@ -2604,46 +2681,46 @@ is set\&. (Default: 10 minutes) Minimum value for the Fast flag\&. Overrides the ordinary minimum taken from the consensus when TestingTorNetwork is set\&. (Default: 0\&.) .RE .PP -\fBTestingServerDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBTestingServerDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when servers should download things in general\&. Changing this requires that +Initial delay in seconds for when servers should download things in general\&. Changing this requires that \fBTestingTorNetwork\fR -is set\&. (Default: 0, 0, 0, 60, 60, 120, 300, 900, 2147483647) +is set\&. (Default: 0) .RE .PP -\fBTestingClientDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBTestingClientDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download things in general\&. Changing this requires that +Initial delay in seconds for when clients should download things in general\&. Changing this requires that \fBTestingTorNetwork\fR -is set\&. (Default: 0, 0, 60, 300, 600, 2147483647) +is set\&. (Default: 0) .RE .PP -\fBTestingServerConsensusDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBTestingServerConsensusDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when servers should download consensuses\&. Changing this requires that +Initial delay in seconds for when servers should download consensuses\&. Changing this requires that \fBTestingTorNetwork\fR -is set\&. (Default: 0, 0, 60, 300, 600, 1800, 1800, 1800, 1800, 1800, 3600, 7200) +is set\&. (Default: 0) .RE .PP -\fBTestingClientConsensusDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBTestingClientConsensusDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download consensuses\&. Changing this requires that +Initial delay in seconds for when clients should download consensuses\&. Changing this requires that \fBTestingTorNetwork\fR -is set\&. (Default: 0, 0, 60, 300, 600, 1800, 3600, 3600, 3600, 10800, 21600, 43200) +is set\&. (Default: 0) .RE .PP -\fBTestingBridgeDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBTestingBridgeDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download each bridge descriptor when they know that one or more of their configured bridges are running\&. Changing this requires that +Initial delay in seconds for when clients should download each bridge descriptor when they know that one or more of their configured bridges are running\&. Changing this requires that \fBTestingTorNetwork\fR -is set\&. (Default: 10800, 25200, 54000, 111600, 262800) +is set\&. (Default: 10800) .RE .PP -\fBTestingBridgeBootstrapDownloadSchedule\fR \fIN\fR,\fIN\fR,\fI\&...\fR +\fBTestingBridgeBootstrapDownloadInitialDelay\fR \fIN\fR .RS 4 -Schedule for when clients should download each bridge descriptor when they have just started, or when they can not contact any of their bridges\&. Changing this requires that +Initial delay in seconds for when clients should download each bridge descriptor when they have just started, or when they can not contact any of their bridges\&. Changing this requires that \fBTestingTorNetwork\fR -is set\&. (Default: 0, 30, 90, 600, 3600, 10800, 25200, 54000, 111600, 262800) +is set\&. (Default: 0) .RE .PP \fBTestingClientMaxIntervalWithoutRequest\fR \fIN\fR \fBseconds\fR|\fBminutes\fR @@ -2666,6 +2743,7 @@ A list of identity fingerprints, country \fBExcludeNodes\fR option for more information on how to specify nodes\&. + In order for this option to have any effect, \fBTestingTorNetwork\fR has to be set\&. See the @@ -2679,6 +2757,7 @@ If True (1), a node will never receive t \fBTestingDirAuthVoteExit\fR list, regardless of its uptime, bandwidth, or exit policy\&. + In order for this option to have any effect, \fBTestingTorNetwork\fR has to be set\&. @@ -2690,6 +2769,7 @@ A list of identity fingerprints and coun \fBExcludeNodes\fR option for more information on how to specify nodes\&. + In order for this option to have any effect, \fBTestingTorNetwork\fR has to be set\&. @@ -2701,6 +2781,7 @@ If True (1), a node will never receive t \fBTestingDirAuthVoteGuard\fR list, regardless of its uptime and bandwidth\&. + In order for this option to have any effect, \fBTestingTorNetwork\fR has to be set\&. @@ -2712,6 +2793,7 @@ A list of identity fingerprints and coun \fBExcludeNodes\fR option for more information on how to specify nodes\&. + In order for this option to have any effect, \fBTestingTorNetwork\fR must be set\&. @@ -2723,6 +2805,7 @@ If True (1), a node will never receive t \fBTestingDirAuthVoteHSDir\fR list, regardless of its uptime and DirPort\&. + In order for this option to have any effect, \fBTestingTorNetwork\fR has to be set\&. @@ -2742,13 +2825,6 @@ If this option is set, then Tor controll is set\&. (Default: 0) .RE .PP -\fBTestingEnableTbEmptyEvent\fR \fB0\fR|\fB1\fR -.RS 4 -If this option is set, then Tor controllers may register for TB_EMPTY events\&. Changing this requires that -\fBTestingTorNetwork\fR -is set\&. (Default: 0) -.RE -.PP \fBTestingMinExitFlagThreshold\fR \fIN\fR \fBKBytes\fR|\fBMBytes\fR|\fBGBytes\fR|\fBTBytes\fR|\fBKBits\fR|\fBMBits\fR|\fBGBits\fR|\fBTBits\fR .RS 4 Sets a lower\-bound for assigning an exit flag when running as an authority on a testing network\&. Overrides the usual default lower bound of 4 KB\&. (Default: 0) @@ -2772,7 +2848,7 @@ Overrides the default lifetime for a sig .RS 4 How early before the official expiration of a an Ed25519 signing key do we replace it and issue a new key? (Default: 3 hours for link and auth; 1 day for signing\&.) .RE -.SH "NON-PERSISTENT OPTIONS" +.SH "NON\-PERSISTENT OPTIONS" .sp These options are not saved to the torrc file by the "SAVECONF" controller command\&. Other options of this type are documented in control\-spec\&.txt, section 5\&.4\&. End\-users should mostly ignore them\&. .PP diff -pruN 0.3.3.9-1/doc/tor.1.txt 0.3.4.8-1/doc/tor.1.txt --- 0.3.3.9-1/doc/tor.1.txt 2018-07-13 18:25:23.000000000 +0000 +++ 0.3.4.8-1/doc/tor.1.txt 2018-06-15 21:20:53.000000000 +0000 @@ -311,7 +311,9 @@ GENERAL OPTIONS other than controller connections, and we close (and don't reattempt) any outbound connections. Controllers sometimes use this option to avoid using - the network until Tor is fully configured. (Default: 0) + the network until Tor is fully configured. Tor will make still certain + network-related calls (like DNS lookups) as a part of its configuration + process, even if DisableNetwork is set. (Default: 0) [[ConstrainedSockets]] **ConstrainedSockets** **0**|**1**:: If set, Tor will tell the kernel to attempt to shrink the buffers for all @@ -366,7 +368,8 @@ GENERAL OPTIONS [[ControlSocket]] **ControlSocket** __Path__:: Like ControlPort, but listens on a Unix domain socket, rather than a TCP - socket. '0' disables ControlSocket (Unix and Unix-like systems only.) + socket. '0' disables ControlSocket. (Unix and Unix-like systems only.) + (Default: 0) [[ControlSocketsGroupWritable]] **ControlSocketsGroupWritable** **0**|**1**:: If this option is set to 0, don't allow the filesystem group to read and @@ -786,17 +789,15 @@ GENERAL OPTIONS This is useful when running on flash memory or other media that support only a limited number of writes. (Default: 0) -[[CircuitPriorityHalflife]] **CircuitPriorityHalflife** __NUM1__:: +[[CircuitPriorityHalflife]] **CircuitPriorityHalflife** __NUM__:: If this value is set, we override the default algorithm for choosing which - circuit's cell to deliver or relay next. When the value is 0, we - round-robin between the active circuits on a connection, delivering one - cell from each in turn. When the value is positive, we prefer delivering - cells from whichever connection has the lowest weighted cell count, where - cells are weighted exponentially according to the supplied - CircuitPriorityHalflife value (in seconds). If this option is not set at - all, we use the behavior recommended in the current consensus - networkstatus. This is an advanced option; you generally shouldn't have - to mess with it. (Default: not set) + circuit's cell to deliver or relay next. It is delivered first to the + circuit that has the lowest weighted cell count, where cells are weighted + exponentially according to this value (in seconds). If the value is -1, it + is taken from the consensus if possible else it will fallback to the + default value of 30. Minimum: 1, Maximum: 2147483647. This can be defined + as a float value. This is an advanced option; you generally shouldn't have + to mess with it. (Default: -1) [[CountPrivateBandwidth]] **CountPrivateBandwidth** **0**|**1**:: If this option is set, then Tor's rate-limiting applies not only to @@ -813,10 +814,9 @@ GENERAL OPTIONS [[NoExec]] **NoExec** **0**|**1**:: If this option is set to 1, then Tor will never launch another - executable, regardless of the settings of PortForwardingHelper, - ClientTransportPlugin, or ServerTransportPlugin. Once this - option has been set to 1, it cannot be set back to 0 without - restarting Tor. (Default: 0) + executable, regardless of the settings of ClientTransportPlugin + or ServerTransportPlugin. Once this option has been set to 1, + it cannot be set back to 0 without restarting Tor. (Default: 0) [[Schedulers]] **Schedulers** **KIST**|**KISTLite**|**Vanilla**:: Specify the scheduler type that tor should use. The scheduler is @@ -1294,9 +1294,11 @@ The following options are useful only fo 2 minutes) [[TokenBucketRefillInterval]] **TokenBucketRefillInterval** __NUM__ [**msec**|**second**]:: - Set the refill interval of Tor's token bucket to NUM milliseconds. - NUM must be between 1 and 1000, inclusive. Note that the configured - bandwidth limits are still expressed in bytes per second: this + Set the refill delay interval of Tor's token bucket to NUM milliseconds. + NUM must be between 1 and 1000, inclusive. When Tor is out of bandwidth, + on a connection or globally, it will wait up to this long before it tries + to use that connection again. + Note that bandwidth limits are still expressed in bytes per second: this option only affects the frequency with which Tor checks to see whether previously exhausted connections may read again. Can not be changed while tor is running. (Default: 100 msec) @@ -1353,6 +1355,13 @@ The following options are useful only fo number from the guard-n-primary-guards-to-use consensus parameter, and default to 1 if the consensus parameter isn't set. (Default: 0) +[[NumPrimaryGuards]] **NumPrimaryGuards** __NUM__:: + If UseEntryGuards is set to 1, we will try to pick NUM routers for our + primary guard list, which is the set of routers we strongly prefer when + connecting to the Tor network. If NUM is 0, we try to learn the number from + the guard-n-primary-guards consensus parameter, and default to 3 if the + consensus parameter isn't set. (Default: 0) + [[NumDirectoryGuards]] **NumDirectoryGuards** __NUM__:: If UseEntryGuards is set to 1, we try to make sure we have at least NUM routers to use as directory guards. If this option is set to 0, use the @@ -1406,7 +1415,7 @@ The following options are useful only fo [[HTTPTunnelPort]] **HTTPTunnelPort** \['address':]__port__|**auto** [_isolation flags_]:: Open this port to listen for proxy connections using the "HTTP CONNECT" - protocol instead of SOCKS. Set this to 0 + protocol instead of SOCKS. Set this to 0 if you don't want to allow "HTTP CONNECT" connections. Set the port to "auto" to have Tor pick a port for you. This directive can be specified multiple times to bind to multiple addresses/ports. See @@ -1446,7 +1455,7 @@ The following options are useful only fo Set this to "default", or leave it unconfigured, to use regular IPTables on Linux, or to use pf +rdr-to+ rules on *BSD systems. + + - (Default: "default".) + (Default: "default") [[NATDPort]] **NATDPort** \['address':]__port__|**auto** [_isolation flags_]:: Open this port to listen for connections from old versions of ipfw (as @@ -1583,6 +1592,14 @@ The following options are useful only fo which means that nodes specified in ExcludeNodes will not be picked. + + When either this option or HSLayer3Nodes are set, the /16 subnet + and node family restrictions are removed for hidden service + circuits. Additionally, we allow the guard node to be present + as the Rend, HSDir, and IP node, and as the hop before it. This + is done to prevent the adversary from inferring information + about our guard, layer2, and layer3 node choices at later points + in the path. + + This option is meant to be managed by a Tor controller such as https://github.com/mikeperry-tor/vanguards that selects and updates this set of nodes for you. Hence it does not do load @@ -1628,6 +1645,14 @@ The following options are useful only fo ExcludeNodes have higher priority than HSLayer3Nodes, which means that nodes specified in ExcludeNodes will not be picked. + + + When either this option or HSLayer2Nodes are set, the /16 subnet + and node family restrictions are removed for hidden service + circuits. Additionally, we allow the guard node to be present + as the Rend, HSDir, and IP node, and as the hop before it. This + is done to prevent the adversary from inferring information + about our guard, layer2, and layer3 node choices at later points + in the path. + This option is meant to be managed by a Tor controller such as https://github.com/mikeperry-tor/vanguards that selects and @@ -1738,34 +1763,31 @@ The following options are useful only fo prevent your Tor client from bootstrapping. If this option is negative, Tor will use a default value chosen by the directory authorities. If the directory authorities do not choose a value, Tor will default to 0.6. - (Default: -1.) + (Default: -1) -[[ClientBootstrapConsensusAuthorityDownloadSchedule]] **ClientBootstrapConsensusAuthorityDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download consensuses from authorities +[[ClientBootstrapConsensusAuthorityDownloadInitialDelay]] **ClientBootstrapConsensusAuthorityDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download consensuses from authorities if they are bootstrapping (that is, they don't have a usable, reasonably live consensus). Only used by clients fetching from a list of fallback directory mirrors. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, which are advanced by - connection failures. (Default: 6, 11, 3600, 10800, 25200, 54000, 111600, - 262800) + connection failures. (Default: 6) -[[ClientBootstrapConsensusFallbackDownloadSchedule]] **ClientBootstrapConsensusFallbackDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download consensuses from fallback +[[ClientBootstrapConsensusFallbackDownloadInitialDelay]] **ClientBootstrapConsensusFallbackDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download consensuses from fallback directory mirrors if they are bootstrapping (that is, they don't have a usable, reasonably live consensus). Only used by clients fetching from a list of fallback directory mirrors. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, - which are advanced by connection failures. (Default: 0, 1, 4, 11, 3600, - 10800, 25200, 54000, 111600, 262800) + which are advanced by connection failures. (Default: 0) -[[ClientBootstrapConsensusAuthorityOnlyDownloadSchedule]] **ClientBootstrapConsensusAuthorityOnlyDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download consensuses from authorities +[[ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay]] **ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download consensuses from authorities if they are bootstrapping (that is, they don't have a usable, reasonably live consensus). Only used by clients which don't have or won't fetch from a list of fallback directory mirrors. This schedule is advanced by (potentially concurrent) connection attempts, unlike other schedules, - which are advanced by connection failures. (Default: 0, 3, 7, 3600, - 10800, 25200, 54000, 111600, 262800) + which are advanced by connection failures. (Default: 0) [[ClientBootstrapConsensusMaxInProgressTries]] **ClientBootstrapConsensusMaxInProgressTries** __NUM__:: Try this many simultaneous connections to download a consensus before @@ -1896,7 +1918,7 @@ is non-zero): If you want to use a reduced exit policy rather than the default exit policy, set "ReducedExitPolicy 1". If you want to _replace_ the default exit policy with your custom exit policy, end your exit policy with either - a reject *:* or an accept *:*. Otherwise, you’re _augmenting_ (prepending + a reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to) the default or reduced exit policy. + + The default exit policy is: @@ -2059,6 +2081,8 @@ is non-zero): [[Nickname]] **Nickname** __name__:: Set the server's nickname to \'name'. Nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a-zA-Z0-9]. + If not set, **Unnamed** will be used. Relays can always be uniquely identified + by their identity fingerprints. [[NumCPUs]] **NumCPUs** __num__:: How many processes to use at once for decrypting onionskins and other @@ -2094,18 +2118,6 @@ is non-zero): For obvious reasons, NoAdvertise and NoListen are mutually exclusive, and IPv4Only and IPv6Only are mutually exclusive. -[[PortForwarding]] **PortForwarding** **0**|**1**:: - Attempt to automatically forward the DirPort and ORPort on a NAT router - connecting this Tor server to the Internet. If set, Tor will try both - NAT-PMP (common on Apple routers) and UPnP (common on routers from other - manufacturers). (Default: 0) - -[[PortForwardingHelper]] **PortForwardingHelper** __filename__|__pathname__:: - If PortForwarding is set, use this executable to configure the forwarding. - If set to a filename, the system path will be searched for the executable. - If set to a path, only the specified path will be executed. - (Default: tor-fw-helper) - [[PublishServerDescriptor]] **PublishServerDescriptor** **0**|**1**|**v3**|**bridge**,**...**:: This option specifies which descriptors Tor will publish when acting as a relay. You can @@ -2269,7 +2281,8 @@ is non-zero): sent and received by this relay, in addition to total cell counts. These statistics are rounded, and omitted if traffic is low. This information is important for load balancing decisions related to padding. - (Default: 1) + If ExtraInfoStatistics is enabled, it will be published + as a part of extra-info document. (Default: 1) [[DirReqStatistics]] **DirReqStatistics** **0**|**1**:: Relays and bridges only. @@ -2368,6 +2381,11 @@ is non-zero): KeywDirectory. If the option is set to 1, make the KeyDirectory readable by the default GID. (Default: 0) +[[RephistTrackTime]] **RephistTrackTime** __N__ **seconds**|**minutes**|**hours**|**days**|**weeks**:: + Tells an authority, or other node tracking node reliability and history, + that fine-grained information about nodes can be discarded when it hasn't + changed for a given amount of time. (Default: 24 hours) + DIRECTORY SERVER OPTIONS ------------------------ @@ -2737,11 +2755,6 @@ on the public Tor network. different identity. This feature is used to migrate directory authority keys in the event of a compromise. (Default: 0) -[[RephistTrackTime]] **RephistTrackTime** __N__ **seconds**|**minutes**|**hours**|**days**|**weeks**:: - Tells an authority, or other node tracking node reliability and history, - that fine-grained information about nodes can be discarded when it hasn't - changed for a given amount of time. (Default: 24 hours) - [[AuthDirHasIPv6Connectivity]] **AuthDirHasIPv6Connectivity** **0**|**1**:: Authoritative directories only. When set to 0, OR ports with an IPv6 address are not included in the authority's votes. When set to 1, @@ -2909,12 +2922,9 @@ The following options are used for runni AssumeReachable 1 AuthDirMaxServersPerAddr 0 AuthDirMaxServersPerAuthAddr 0 - ClientBootstrapConsensusAuthorityDownloadSchedule 0, 2, - 4 (for 40 seconds), 8, 16, 32, 60 - ClientBootstrapConsensusFallbackDownloadSchedule 0, 1, - 4 (for 40 seconds), 8, 16, 32, 60 - ClientBootstrapConsensusAuthorityOnlyDownloadSchedule 0, 1, - 4 (for 40 seconds), 8, 16, 32, 60 + ClientBootstrapConsensusAuthorityDownloadInitialDelay 0 + ClientBootstrapConsensusFallbackDownloadInitialDelay 0 + ClientBootstrapConsensusAuthorityOnlyDownloadInitialDelay 0 ClientDNSRejectInternalAddresses 0 ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 @@ -2929,17 +2939,16 @@ The following options are used for runni TestingV3AuthInitialDistDelay 20 seconds TestingAuthDirTimeToLearnReachability 0 minutes TestingEstimatedDescriptorPropagationTime 0 minutes - TestingServerDownloadSchedule 0, 0, 0, 5, 10, 15, 20, 30, 60 - TestingClientDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 - TestingServerConsensusDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 - TestingClientConsensusDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 - TestingBridgeDownloadSchedule 10, 30, 60 - TestingBridgeBootstrapDownloadSchedule 0, 0, 5, 10, 15, 20, 30, 60 + TestingServerDownloadInitialDelay 0 + TestingClientDownloadInitialDelay 0 + TestingServerConsensusDownloadInitialDelay 0 + TestingClientConsensusDownloadInitialDelay 0 + TestingBridgeDownloadInitialDelay 10 + TestingBridgeBootstrapDownloadInitialDelay 0 TestingClientMaxIntervalWithoutRequest 5 seconds TestingDirConnectionMaxStall 30 seconds TestingEnableConnBwEvent 1 TestingEnableCellStatsEvent 1 - TestingEnableTbEmptyEvent 1 [[TestingV3AuthInitialVotingInterval]] **TestingV3AuthInitialVotingInterval** __N__ **minutes**|**hours**:: Like V3AuthVotingInterval, but for initial voting interval before the first @@ -2974,37 +2983,31 @@ The following options are used for runni Minimum value for the Fast flag. Overrides the ordinary minimum taken from the consensus when TestingTorNetwork is set. (Default: 0.) -[[TestingServerDownloadSchedule]] **TestingServerDownloadSchedule** __N__,__N__,__...__:: - Schedule for when servers should download things in general. Changing this - requires that **TestingTorNetwork** is set. (Default: 0, 0, 0, 60, 60, 120, - 300, 900, 2147483647) - -[[TestingClientDownloadSchedule]] **TestingClientDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download things in general. Changing this - requires that **TestingTorNetwork** is set. (Default: 0, 0, 60, 300, 600, - 2147483647) - -[[TestingServerConsensusDownloadSchedule]] **TestingServerConsensusDownloadSchedule** __N__,__N__,__...__:: - Schedule for when servers should download consensuses. Changing this - requires that **TestingTorNetwork** is set. (Default: 0, 0, 60, 300, 600, - 1800, 1800, 1800, 1800, 1800, 3600, 7200) - -[[TestingClientConsensusDownloadSchedule]] **TestingClientConsensusDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download consensuses. Changing this - requires that **TestingTorNetwork** is set. (Default: 0, 0, 60, 300, 600, - 1800, 3600, 3600, 3600, 10800, 21600, 43200) +[[TestingServerDownloadInitialDelay]] **TestingServerDownloadInitialDelay** __N__:: + Initial delay in seconds for when servers should download things in general. Changing this + requires that **TestingTorNetwork** is set. (Default: 0) + +[[TestingClientDownloadInitialDelay]] **TestingClientDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download things in general. Changing this + requires that **TestingTorNetwork** is set. (Default: 0) + +[[TestingServerConsensusDownloadInitialDelay]] **TestingServerConsensusDownloadInitialDelay** __N__:: + Initial delay in seconds for when servers should download consensuses. Changing this + requires that **TestingTorNetwork** is set. (Default: 0) + +[[TestingClientConsensusDownloadInitialDelay]] **TestingClientConsensusDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download consensuses. Changing this + requires that **TestingTorNetwork** is set. (Default: 0) -[[TestingBridgeDownloadSchedule]] **TestingBridgeDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download each bridge descriptor when they +[[TestingBridgeDownloadInitialDelay]] **TestingBridgeDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download each bridge descriptor when they know that one or more of their configured bridges are running. Changing - this requires that **TestingTorNetwork** is set. (Default: 10800, 25200, - 54000, 111600, 262800) + this requires that **TestingTorNetwork** is set. (Default: 10800) -[[TestingBridgeBootstrapDownloadSchedule]] **TestingBridgeBootstrapDownloadSchedule** __N__,__N__,__...__:: - Schedule for when clients should download each bridge descriptor when they +[[TestingBridgeBootstrapDownloadInitialDelay]] **TestingBridgeBootstrapDownloadInitialDelay** __N__:: + Initial delay in seconds for when clients should download each bridge descriptor when they have just started, or when they can not contact any of their bridges. - Changing this requires that **TestingTorNetwork** is set. (Default: 0, 30, - 90, 600, 3600, 10800, 25200, 54000, 111600, 262800) + Changing this requires that **TestingTorNetwork** is set. (Default: 0) [[TestingClientMaxIntervalWithoutRequest]] **TestingClientMaxIntervalWithoutRequest** __N__ **seconds**|**minutes**:: When directory clients have only a few descriptors to request, they batch @@ -3077,11 +3080,6 @@ The following options are used for runni events. Changing this requires that **TestingTorNetwork** is set. (Default: 0) -[[TestingEnableTbEmptyEvent]] **TestingEnableTbEmptyEvent** **0**|**1**:: - If this option is set, then Tor controllers may register for TB_EMPTY - events. Changing this requires that **TestingTorNetwork** is set. - (Default: 0) - [[TestingMinExitFlagThreshold]] **TestingMinExitFlagThreshold** __N__ **KBytes**|**MBytes**|**GBytes**|**TBytes**|**KBits**|**MBits**|**GBits**|**TBits**:: Sets a lower-bound for assigning an exit flag when running as an authority on a testing network. Overrides the usual default lower bound diff -pruN 0.3.3.9-1/doc/tor-gencert.1.in 0.3.4.8-1/doc/tor-gencert.1.in --- 0.3.3.9-1/doc/tor-gencert.1.in 2018-01-19 07:28:49.000000000 +0000 +++ 0.3.4.8-1/doc/tor-gencert.1.in 2018-06-25 18:12:28.000000000 +0000 @@ -1,13 +1,13 @@ '\" t .\" Title: tor-gencert .\" Author: Nick Mathewson -.\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 01/19/2018 +.\" Generator: DocBook XSL Stylesheets vsnapshot +.\" Date: 06/25/2018 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TOR\-GENCERT" "1" "01/19/2018" "Tor" "Tor Manual" +.TH "TOR\-GENCERT" "1" "06/25/2018" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- diff -pruN 0.3.3.9-1/doc/tor-gencert.html.in 0.3.4.8-1/doc/tor-gencert.html.in --- 0.3.3.9-1/doc/tor-gencert.html.in 2018-01-19 07:28:50.000000000 +0000 +++ 0.3.4.8-1/doc/tor-gencert.html.in 2018-06-25 18:12:24.000000000 +0000 @@ -3,7 +3,7 @@ - + tor-gencert(1)