Start a changelog for 0.4.1.7

34 files changed, 159 insertions, 146 deletions

diff --git a/ChangeLog b/ChangeLog
index 8f1af12587..5a1ad1aa9a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,162 @@
+Changes in version 0.4.1.7 - 2019-12-??
+  This release backports several bugfixes to improve stability and
+  correctness.  Anyone experiencing build problems or crashes with 0.4.1.6,
+  including all relays relying on AccountingMax, should upgrade.
+
+  o Major features (directory authorities, backport from 0.4.2.2-alpha):
+    - Directory authorities now reject relays running all currently
+      deprecated release series. The currently supported release series
+      are: 0.2.9, 0.3.5, 0.4.0, 0.4.1, and 0.4.2. Closes ticket 31549.
+
+  o Major bugfixes (embedded Tor, backport from 0.4.2.2-alpha):
+    - Avoid a possible crash when restarting Tor in embedded mode and
+      enabling a different set of publish/subscribe messages. Fixes bug
+      31898; bugfix on 0.4.1.1-alpha.
+
+  o Major bugfixes (relay, backport from 0.4.2.3-alpha):
+    - Relays now respect their AccountingMax bandwidth again. When
+      relays entered "soft" hibernation (which typically starts when
+      we've hit 90% of our AccountingMax), we had stopped checking
+      whether we should enter hard hibernation. Soft hibernation refuses
+      new connections and new circuits, but the existing circuits can
+      continue, meaning that relays could have exceeded their configured
+      AccountingMax. Fixes bug 32108; bugfix on 0.4.0.1-alpha.
+
+  o Major bugfixes (torrc parsing, backport from 0.4.2.2-alpha):
+    - Stop ignoring torrc options after an %include directive, when the
+      included directory ends with a file that does not contain any
+      config options (but does contain comments or whitespace). Fixes
+      bug 31408; bugfix on 0.3.1.1-alpha.
+
+  o Major bugfixes (v3 onion services, backport from 0.4.2.3-alpha):
+    - Onion services now always use the exact number of intro points
+      configured with the HiddenServiceNumIntroductionPoints option (or
+      fewer if nodes are excluded). Before, a service could sometimes
+      pick more intro points than configured. Fixes bug 31548; bugfix
+      on 0.3.2.1-alpha.
+
+  o Minor features (continuous integration, backport from 0.4.2.2-alpha):
+    - When building on Appveyor and Travis, pass the "-k" flag to make,
+      so that we are informed of all compilation failures, not just the
+      first one or two. Closes ticket 31372.
+
+  o Minor features (geoip, backport from 0.4.2.4-rc):
+    - Update geoip and geoip6 to the November 6 2019 Maxmind GeoLite2
+      Country database. Closes ticket 32440.
+
+  o Minor bugfixes (Appveyor CI, backport from 0.4.2.2-alpha):
+    - Avoid spurious errors when Appveyor CI fails before the install step.
+      Fixes bug 31884; bugfix on 0.3.4.2-alpha.
+
+  o Minor bugfixes (client, onion service v3, backport from 0.4.2.4-rc):
+    - Fix a BUG() assertion that occurs within a very small race window
+      between when a client intro circuit opens and when its descriptor
+      gets cleaned up from the cache. The circuit is now closed early,
+      which will trigger a re-fetch of the descriptor and continue the
+      connection. Fixes bug 28970; bugfix on 0.3.2.1-alpha.
+
+  o Minor bugfixes (connections, backport from 0.4.2.3-rc):
+    - Avoid trying to read data from closed connections, which can cause
+      needless loops in Libevent and infinite loops in Shadow. Fixes bug
+      30344; bugfix on 0.1.1.1-alpha.
+
+  o Minor bugfixes (error handling, backport from 0.4.2.1-alpha):
+    - On abort, try harder to flush the output buffers of log messages.
+      On some platforms (macOS), log messages could be discarded when
+      the process terminates. Fixes bug 31571; bugfix on 0.3.5.1-alpha.
+    - Report the tor version whenever an assertion fails. Previously, we
+      only reported the Tor version on some crashes, and some non-fatal
+      assertions. Fixes bug 31571; bugfix on 0.3.5.1-alpha.
+    - When tor aborts due to an error, close log file descriptors before
+      aborting. Closing the logs makes some OSes flush log file buffers,
+      rather than deleting buffered log lines. Fixes bug 31594; bugfix
+      on 0.2.5.2-alpha.
+
+  o Minor bugfixes (logging, backport from 0.4.2.2-alpha):
+    - Add a missing check for HAVE_PTHREAD_H, because the backtrace code
+      uses mutexes. Fixes bug 31614; bugfix on 0.2.5.2-alpha.
+    - Disable backtrace signal handlers when shutting down tor. Fixes
+      bug 31614; bugfix on 0.2.5.2-alpha.
+    - Rate-limit our the logging message about the obsolete .exit
+      notation. Previously, there was no limit on this warning, which
+      could potentially be triggered many times by a hostile website.
+      Fixes bug 31466; bugfix on 0.2.2.1-alpha.
+
+  o Minor bugfixes (logging, protocol violations, backport from 0.4.2.2-alpha):
+    - Do not log a nonfatal assertion failure when receiving a VERSIONS
+      cell on a connection using the obsolete v1 link protocol. Log a
+      protocol_warn instead. Fixes bug 31107; bugfix on 0.2.4.4-alpha.
+
+  o Minor bugfixes (mainloop, periodic events, in-process API, backport from 0.4.2.3-alpha):
+    - Reset the periodic events' "enabled" flag when Tor is shut down
+      cleanly. Previously, this flag was left on, which caused periodic
+      events not to be re-enabled when Tor was relaunched in-process
+      with tor_api.h after a shutdown. Fixes bug 32058; bugfix
+      on 0.3.3.1-alpha.
+
+  o Minor bugfixes (multithreading, backport from 0.4.2.2-alpha):
+    - Avoid some undefined behaviour when freeing mutexes. Fixes bug
+      31736; bugfix on 0.0.7.
+
+  o Minor bugfixes (process management, backport from 0.4.2.3-alpha):
+    - Remove overly strict assertions that triggered when a pluggable
+      transport failed to launch. Fixes bug 31091; bugfix
+      on 0.4.0.1-alpha.
+    - Remove an assertion in the Unix process backend. This assertion
+      would trigger when we failed to find the executable for a child
+      process. Fixes bug 31810; bugfix on 0.4.0.1-alpha.
+
+  o Minor bugfixes (relay, backport from 0.4.2.2-alpha):
+    - Avoid crashing when starting with a corrupt keys directory where
+      the old ntor key and the new ntor key are identical. Fixes bug
+      30916; bugfix on 0.2.4.8-alpha.
+
+  o Minor bugfixes (testing, backport from 0.4.2.3-alpha):
+    - When testing port rebinding, don't busy-wait for tor to log.
+      Instead, actually sleep for a short time before polling again.
+      Also improve the formatting of control commands and log messages.
+      Fixes bug 31837; bugfix on 0.3.5.1-alpha.
+
+  o Minor bugfixes (tests, SunOS, backport from 0.4.2.2-alpha):
+    - Avoid a map_anon_nofork test failure due to a signed/unsigned
+      integer comparison. Fixes bug 31897; bugfix on 0.4.1.1-alpha.
+
+  o Minor bugfixes (tls, logging, backport from 0.4.2.3-alpha):
+    - Log bugs about the TLS read buffer's length only once, rather than
+      filling the logs with similar warnings. Fixes bug 31939; bugfix
+      on 0.3.0.4-rc.
+
+  o Documentation (backport from 0.4.2.2-alpha):
+    - Explain why we can't destroy the backtrace buffer mutex. Explain
+      why we don't need to destroy the log mutex. Closes ticket 31736.
+
+  o Testing (continuous integration, backport from 0.4.2.3-alpha):
+    - Disable all but one Travis CI macOS build, to mitigate slow
+      scheduling of Travis macOS jobs. Closes ticket 32177.
+    - Run the chutney IPv6 networks as part of Travis CI. Closes
+      ticket 30860.
+    - Simplify the Travis CI build matrix, and optimise for build time.
+      Closes ticket 31859.
+    - Use Windows Server 2019 instead of Windows Server 2016 in our
+      Appveyor builds. Closes ticket 32086.
+
+  o Testing (continuous integration, backport from 0.4.2.4-rc):
+    - In Travis, use Xcode 11.2 on macOS 10.14. Closes ticket 32241.
+    - Use Ubuntu Bionic images for our Travis CI builds, so we can get a
+      recent version of coccinelle. But leave chutney on Ubuntu Trusty,
+      until we can fix some Bionic permissions issues (see ticket
+      32240). Related to ticket 31919.
+    - Install the mingw OpenSSL package in Appveyor. This makes sure
+      that the OpenSSL headers and libraries match in Tor's Appveyor
+      builds. (This bug was triggered by an Appveyor image update.)
+      Fixes bug 32449; bugfix on 0.3.5.6-rc.
+
+  o Testing (continuous integration, backport from 0.4.2.5):
+    - Require C99 standards-conforming code in Travis CI, but allow GNU gcc
+      extensions. Also activates clang's -Wtypedef-redefinition warnings.
+      Build some jobs with -std=gnu99, and some jobs without.
+      Closes ticket 32500.
+
 Changes in version 0.4.1.6 - 2019-09-19
   This release backports several bugfixes to improve stability and
   correctness.  Anyone experiencing build problems or crashes with 0.4.1.5,
diff --git a/changes/bug30344 b/changes/bug30344
deleted file mode 100644
index 37561bf944..0000000000
--- a/changes/bug30344
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor bugfixes (connection):
-    - Avoid reading data from closed connections, which can cause needless
-      loops in libevent and infinite loops in Shadow. Fixes bug 30344; bugfix
-      on 0.1.1.1-alpha.
diff --git a/changes/bug30916 b/changes/bug30916
deleted file mode 100644
index b006bfc75d..0000000000
--- a/changes/bug30916
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor bugfixes (relay):
-    - Avoid crashing when starting with a corrupt keys directory where
-      the old ntor key and the new ntor key are identical. Fixes bug 30916;
-      bugfix on 0.2.4.8-alpha.
diff --git a/changes/bug31107 b/changes/bug31107
deleted file mode 100644
index 9652927c30..0000000000
--- a/changes/bug31107
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor bugfixes (logging, protocol violations):
-    - Do not log a nonfatal assertion failure when receiving a VERSIONS
-      cell on a connection using the obsolete v1 link protocol. Log a
-      protocol_warn instead. Fixes bug 31107; bugfix on 0.2.4.4-alpha.
diff --git a/changes/bug31408 b/changes/bug31408
deleted file mode 100644
index 3e4ffa927d..0000000000
--- a/changes/bug31408
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Major bugfixes (torrc):
-    - Stop ignoring torrc options after an %include directive, when the
-      included directory ends with a file that does not contain any config
-      options. (But does contain comments or whitespace.)
-      Fixes bug 31408; bugfix on 0.3.1.1-alpha.
diff --git a/changes/bug31571 b/changes/bug31571
deleted file mode 100644
index 86de3537ba..0000000000
--- a/changes/bug31571
+++ /dev/null
@@ -1,7 +0,0 @@
-  o Minor bugfixes (error handling):
-    - Report the tor version whenever an assertion fails. Previously, we only
-      reported the Tor version on some crashes, and some non-fatal assertions.
-      Fixes bug 31571; bugfix on 0.3.5.1-alpha.
-    - On abort, try harder to flush the output buffers of log messages. On
-      some platforms (macOS), log messages can be discarded when the process
-      terminates. Fixes bug 31571; bugfix on 0.3.5.1-alpha.
diff --git a/changes/bug31594 b/changes/bug31594
deleted file mode 100644
index 75e6ec33cc..0000000000
--- a/changes/bug31594
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Minor bugfixes (error handling):
-    - When tor aborts due to an error, close log file descriptors before
-      aborting. Closing the logs makes some OSes flush log file buffers,
-      rather than deleting buffered log lines. Fixes bug 31594;
-      bugfix on 0.2.5.2-alpha.
diff --git a/changes/bug31614 b/changes/bug31614
deleted file mode 100644
index c425a9fcd4..0000000000
--- a/changes/bug31614
+++ /dev/null
@@ -1,9 +0,0 @@
-  o Minor bugfixes (logging):
-    - Disable backtrace signal handlers when shutting down tor.
-      Fixes bug 31614; bugfix on 0.2.5.2-alpha.
-    - Add a missing check for HAVE_PTHREAD_H, because the backtrace code uses
-      mutexes. Fixes bug 31614; bugfix on 0.2.5.2-alpha.
-  o Documentation:
-    - Explain why we can't destroy the backtrace buffer mutex. Explain why
-      we don't need to destroy the log mutex.
-      Closes ticket 31736.
diff --git a/changes/bug31736 b/changes/bug31736
deleted file mode 100644
index beb09e5069..0000000000
--- a/changes/bug31736
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Minor bugfixes (multithreading):
-    - Avoid some undefined behaviour when freeing mutexes.
-      Fixes bug 31736; bugfix on 0.0.7.
diff --git a/changes/bug31810 b/changes/bug31810
deleted file mode 100644
index 628d12f09b..0000000000
--- a/changes/bug31810
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor bugfixes (process management):
-    - Remove assertion in the Unix process backend. This assertion would trigger
-      when a new process is spawned where the executable is not found leading to
-      a stack trace from the child process. Fixes bug 31810; bugfix on 0.4.0.1-alpha.
diff --git a/changes/bug31837 b/changes/bug31837
deleted file mode 100644
index 0f976edfe0..0000000000
--- a/changes/bug31837
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Minor bugfixes (testing):
-    - When testing port rebinding, don't busy-wait for tor to log. Instead,
-      actually sleep for a short time before polling again. Also improve the
-      formatting of control commands and log messages.
-      Fixes bug 31837; bugfix on 0.3.5.1-alpha.
diff --git a/changes/bug31884 b/changes/bug31884
deleted file mode 100644
index ddb6c50d74..0000000000
--- a/changes/bug31884
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Minor bugfixes (Appveyor CI):
-    - Avoid spurious errors when Appveyor CI fails before the install step.
-      Fixes bug 31884; bugfix on 0.3.4.2-alpha.
diff --git a/changes/bug31897 b/changes/bug31897
deleted file mode 100644
index 81c63e704e..0000000000
--- a/changes/bug31897
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Minor bugfixes (tests, SunOS):
-    - Avoid a map_anon_nofork test failure due to a signed/unsigned integer
-      comparison. Fixes bug 31897; bugfix on 0.4.1.1-alpha.
diff --git a/changes/bug31898 b/changes/bug31898
deleted file mode 100644
index 6f3e0a5465..0000000000
--- a/changes/bug31898
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Major bugfixes (embedded Tor):
-    - Avoid a possible crash when restarting Tor in embedded mode and
-      enabling a different set of publish/subscribe messages. Fixes bug
-      31898; bugfix on 0.4.1.1-alpha.
diff --git a/changes/bug31939 b/changes/bug31939
deleted file mode 100644
index a36ea495d6..0000000000
--- a/changes/bug31939
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Minor bugfixes (tls, logging):
-    - Log TLS read buffer length bugs once, rather than filling the logs
-      with similar warnings. Fixes bug 31939; bugfix on 0.3.0.4-rc.
diff --git a/changes/bug32108 b/changes/bug32108
deleted file mode 100644
index 2806fa3e5d..0000000000
--- a/changes/bug32108
+++ /dev/null
@@ -1,8 +0,0 @@
-  o Major bugfixes (relay):
-    - Relays now respect their AccountingMax bandwidth again. When relays
-      entered "soft" hibernation (which typically starts when we've hit
-      90% of our AccountingMax), we had stopped checking whether we should
-      enter hard hibernation. Soft hibernation refuses new connections and
-      new circuits, but the existing circuits can continue, meaning that
-      relays could have exceeded their configured AccountingMax. Fixes
-      bug 32108; bugfix on 0.4.0.1-alpha.
diff --git a/changes/bug32449 b/changes/bug32449
deleted file mode 100644
index 213d8a1014..0000000000
--- a/changes/bug32449
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Minor bugfixes (CI, appveyor):
-    - Install the mingw OpenSSL package in Appveyor. This makes sure that
-      the OpenSSL headers and libraries match in Tor's Appveyor builds.
-      (This bug was triggered by an Appveyor image update.)
-      Fixes bug 32449; bugfix on 0.3.5.6-rc.
diff --git a/changes/geoip-2019-10-01 b/changes/geoip-2019-10-01
deleted file mode 100644
index c7ed17b5c4..0000000000
--- a/changes/geoip-2019-10-01
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor features (geoip):
-    - Update geoip and geoip6 to the October 1 2019 Maxmind GeoLite2
-      Country database. Closes ticket 31931.
-
diff --git a/changes/geoip-2019-11-06 b/changes/geoip-2019-11-06
deleted file mode 100644
index a470981012..0000000000
--- a/changes/geoip-2019-11-06
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor features (geoip):
-    - Update geoip and geoip6 to the November 6 2019 Maxmind GeoLite2
-      Country database. Closes ticket 32440.
-
diff --git a/changes/ticket28970 b/changes/ticket28970
deleted file mode 100644
index 138c575fcc..0000000000
--- a/changes/ticket28970
+++ /dev/null
@@ -1,6 +0,0 @@
-  o Minor bugfixes (clietn, hidden service v3):
-    - Fix a BUG() assertion that occurs within a very small race window between
-      a client intro circuit opens and its descriptor that gets cleaned up from
-      the cache. The circuit is now closed which will trigger a re-fetch of the
-      descriptor and continue the HS connection. Fixes bug 28970; bugfix on
-      0.3.2.1-alpha.
diff --git a/changes/ticket30860 b/changes/ticket30860
deleted file mode 100644
index b946f735c4..0000000000
--- a/changes/ticket30860
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Testing:
-    - Run the chutney IPv6 networks as part of Travis CI.
-      Closes ticket 30860.
diff --git a/changes/ticket31091 b/changes/ticket31091
deleted file mode 100644
index 3cb9a2c37b..0000000000
--- a/changes/ticket31091
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Minor bugfixes (pluggable transports):
-    - Remove overly strict assertions that triggers when a pluggable transport
-      is spawned in an unsuccessful manner. Fixes bug 31091; bugfix on 0.4.0.1-alpha.
diff --git a/changes/ticket31372_appveyor b/changes/ticket31372_appveyor
deleted file mode 100644
index e7bb03182e..0000000000
--- a/changes/ticket31372_appveyor
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor features (continuous integration):
-    - When building on Appveyor, pass the "-k" flag to make, so that
-      we are informed of all compilation failures, not just the first
-      one or two. Closes part of ticket 31372.
diff --git a/changes/ticket31372_travis b/changes/ticket31372_travis
deleted file mode 100644
index 403869b2ed..0000000000
--- a/changes/ticket31372_travis
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor features (continuous integration):
-    - When building on Travis, pass the "-k" flag to make, so that
-      we are informed of all compilation failures, not just the first
-      one or two. Closes part of ticket 31372.
diff --git a/changes/ticket31466 b/changes/ticket31466
deleted file mode 100644
index e535b4502e..0000000000
--- a/changes/ticket31466
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Minor bugfixes (logging):
-    - Rate-limit our the logging message about the obsolete .exit notation.
-      Previously, there was no limit on this warning, which could potentially
-      be triggered many times by a hostile website. Fixes bug 31466;
-      bugfix on 0.2.2.1-alpha.
diff --git a/changes/ticket31548 b/changes/ticket31548
deleted file mode 100644
index fef0b5d01f..0000000000
--- a/changes/ticket31548
+++ /dev/null
@@ -1,7 +0,0 @@
-  o Major bugfixes (hidden service v3):
-    - Make onion service always use the exact amount of configured intro points
-      (or less due to node exlusion). Before, a service could sometimes pick
-      more intro points than configured with the
-      HiddenServiceNumIntroductionPoints option. Fixes bug 31548; bugfix on
-      0.3.2.1-alpha.
-
diff --git a/changes/ticket31549 b/changes/ticket31549
deleted file mode 100644
index 2c27aca4fb..0000000000
--- a/changes/ticket31549
+++ /dev/null
@@ -1,4 +0,0 @@
-  o Minor features (authority):
-    - Directory authorities now reject relays running all currently
-      deprecated release series.  The currently supported release series
-      are: 0.2.9, 0.3.5, 0.4.0, 0.4.1, and 0.4.2.  Closes ticket 31549.
diff --git a/changes/ticket31859 b/changes/ticket31859
deleted file mode 100644
index dbc591e00b..0000000000
--- a/changes/ticket31859
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Testing:
-    - Simplify the Travis CI build matrix, and optimise for build time.
-      Closes ticket 31859.
diff --git a/changes/ticket31919_bionic b/changes/ticket31919_bionic
deleted file mode 100644
index eb41644555..0000000000
--- a/changes/ticket31919_bionic
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Minor features (continuous integration):
-    - Use Ubuntu Bionic images for our Travis CI builds, so we can get
-      a recent version of coccinelle. But leave chutney on Ubuntu Trusty,
-      until we can fix some Bionic permissions issues (see ticket 32240).
-      Related to ticket 31919.
diff --git a/changes/ticket32058 b/changes/ticket32058
deleted file mode 100644
index b40bcda416..0000000000
--- a/changes/ticket32058
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Minor bugfixes (mainloop, periodic events):
-    - Periodic events enabled flag was not unset properly when shutting down tor
-      cleanly. This had the side effect to not re-enable periodic events when
-      tor_api.h is used to relaunch tor after a shutdown. Fixes bug 32058;
-      bugfix on 0.3.3.1-alpha.
diff --git a/changes/ticket32086 b/changes/ticket32086
deleted file mode 100644
index b9312c2bea..0000000000
--- a/changes/ticket32086
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Testing:
-    - Use Windows Server 2019 instead of Windows Server 2016 in our
-      Appveyor builds. Closes ticket 32086.
diff --git a/changes/ticket32177 b/changes/ticket32177
deleted file mode 100644
index 6d6816acde..0000000000
--- a/changes/ticket32177
+++ /dev/null
@@ -1,3 +0,0 @@
-  o Testing:
-    - Disable all but one Travis CI macOS build, to mitigate slow scheduling
-      of Travis macOS jobs. Closes ticket 32177.
diff --git a/changes/ticket32241 b/changes/ticket32241
deleted file mode 100644
index 4243cec175..0000000000
--- a/changes/ticket32241
+++ /dev/null
@@ -1,2 +0,0 @@
-  o Testing (continuous integration):
-    - In Travis, use Xcode 11.2 on macOS 10.14. Closes ticket 32241.
diff --git a/changes/ticket32500 b/changes/ticket32500
deleted file mode 100644
index 2c0f35df72..0000000000
--- a/changes/ticket32500
+++ /dev/null
@@ -1,5 +0,0 @@
-  o Testing:
-    - Require C99 standards-conforming code in Travis CI, but allow GNU gcc
-      extensions. Also activates clang's -Wtypedef-redefinition warnings.
-      Build some jobs with -std=gnu99, and some jobs without.
-      Closes ticket 32500.