aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-05-24Warn and ignore the MyFamily setting if BridgeRelay is also setNick Mathewson
Roger explains at http://archives.seul.org/tor/talk/Nov-2011/msg00209.html : "If you list your bridge as part of your family in the relay descriptor, then everybody can learn your bridge fingerprint, and they can look up your bridge's descriptor (and thus location) at the bridge directory authority." Now, we can't stop relays from listing bridges, but we can warn when we notice a bridge listing anybody, which might help some. This fixes bug 4657; it's a fix on 0.2.0.3-alpha, where bridges were first introduced.
2012-05-16Make the succeeding parse_http_time tests more obviously rightNick Mathewson
(When the correct answer is given in terms of seconds since the epoch, it's hard to be sure that it really is the right answer just by reading the code.)
2012-05-16Merge branch 'bug5346_squashed' into maint-0.2.2Nick Mathewson
2012-05-16Fix month check in parse_http_time, add testSebastian Hahn
2012-05-16Remove more dubiosity in struct tm handling. related to bug5346Nick Mathewson
2012-05-16changes file for branch bug5346Nick Mathewson
2012-05-16Reject an additional type of bad date in parse_http_timeNick Mathewson
2012-05-16Fix parse_http_time and add testsEsteban Manchado Velázquez
* It seems parse_http_time wasn't parsing correctly any date with commas (RFCs 1123 and 850). Fix that. * It seems parse_http_time was reporting the wrong month (they start at 0, not 1). Fix that. * Add some tests for parse_http_time, covering all three formats.
2012-05-16Correct the bulletproofing of routerlist_insert()Nick Mathewson
The original code updated some variables, but forgot to remove a replaced old-routerdesc from rl->old_routers. Related to bug 1776.
2012-05-15Clarify MaxCircuitDirtiness behavior with hidden services. Bug 5259.Nick Mathewson
2012-05-15Merge branch 'bug5796_022_squashed' into maint-0.2.2Nick Mathewson
2012-05-15Fix a crash bug on SETCIRCUITPURPOSE.Nick Mathewson
2012-05-15Merge remote-tracking branch 'karsten/geoip-may2012' into maint-0.2.2Nick Mathewson
2012-05-10fix over-wide line from f661747370Roger Dingledine
2012-05-10Merge branch 'bug5786_range_022' into maint-0.2.2Nick Mathewson
2012-05-10Add changes/bug5760Ravi Chandra Padmala
2012-05-10Add missing CRLFs to AUTHCHALLENGE failure repliesRavi Chandra Padmala
Fix #5760
2012-05-07Handle out-of-range values in tor_parse_* integer functionsNick Mathewson
The underlying strtoX functions handle overflow by saturating and setting errno to ERANGE. If the min/max arguments to the tor_parse_* functions are equal to the minimum/maximum of the underlying type, then with the old approach, we wouldn't treat a too-large value as genuinely broken. Found this while looking at bug 5786; bugfix on 19da1f36 (in Tor 0.0.9), which introduced these functions.
2012-05-07Update to the May 2012 GeoIP database.Karsten Loesing
2012-04-18Fix a log-uninitialized-buffer bug.Nick Mathewson
Fix for 5647; bugfix on 0.2.1.5-alpha.
2012-04-18rend_service_introduce(): do protocol violation check before anything else.George Kadianakis
(Cherry-picked from 6ba13e4 by nickm)
2012-04-11Merge branch 'bug5593' into maint-0.2.2Nick Mathewson
2012-04-11Update to the April 2012 GeoIP database.Karsten Loesing
2012-04-10Include a Host: header with any HTTP/1.1 proxy requestNick Mathewson
Bugfix on 0.2.2.1-alpha, which added the orginal HTTP proxy authentication code. Fix for bug 5593.
2012-04-04Wrap long line; strlen("ides")<strlen("turtles").Nick Mathewson
2012-04-05ides has become turtles, and gotten a new IP addressSebastian Hahn
As per ticket 5569
2012-04-01put a _ before or_options_t elements that aren't configurableRoger Dingledine
it's fine with me if we change the current convention, but we should actually decide to change it if we want to.
2012-04-01BridgePassword was never for debuggingRoger Dingledine
It is for the not-yet-implemented bridge community design.
2012-04-01Do not use strcmp() to compare an http authenticator to its expected valueNick Mathewson
This fixes a side-channel attack on the (fortunately unused!) BridgePassword option for bridge authorities. Fix for bug 5543; bugfix on 0.2.0.14-alpha.
2012-03-26Safe cookie authentication gets a changes fileNick Mathewson
2012-03-26Merge remote-tracking branch 'rransom-tor/safecookie-022-v3' into maint-0.2.2Nick Mathewson
2012-03-26Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2Nick Mathewson
2012-03-09Use a given name in the bug5090 message, at its holder's request.Nick Mathewson
2012-03-09Never choose a bridge as an exit. Bug 5342.Nick Mathewson
2012-03-09Revise "sufficient exit nodes" check to work with restrictive ExitNodesNick Mathewson
If you set ExitNodes so that only 1 exit node is accepted, the previous patch would have made you unable to build circuits.
2012-03-09Merge branch 'bug5343' into maint-0.2.2Nick Mathewson
2012-03-09Oops; credit bug5090 patch to flupzor. estebanm only found the bug.Nick Mathewson
2012-03-09Correctly handle broken escape sequences in torrc valuesNick Mathewson
Previously, malformatted torrc values could crash us. Patch by Esteban Manchado. Fixes bug 5090; fix on 0.2.0.16-alpha.
2012-03-08Require a threshold of exit nodes before building circuitsNick Mathewson
This mitigates an attack proposed by wanoskarnet, in which all of a client's bridges collude to restrict the exit nodes that the client knows about. Fixes bug 5343.
2012-03-08Fix compile warnings in openbsd mallocSebastian Hahn
2012-03-08Merge remote-tracking branch 'karsten/geoip-march2012' into maint-0.2.2Nick Mathewson
2012-03-08Update to the March 2012 GeoIP database.Karsten Loesing
2012-02-29new ip address for maatuskaRoger Dingledine
2012-02-22Implement 'safe cookie authentication'Robert Ransom
2012-02-22Add a sha256 hmac function, with testsNick Mathewson
(cherry picked from commit fdbb9cdf746bbf0c39c34188baa8872471183ff7)
2012-02-10Properly protect paths to sed, sha1sum, opensslSebastian Hahn
in Makefile.am, we used it without quoting it, causing build failure if your openssl/sed/sha1sum happened to live in a directory with a space in it (very common on windows)
2012-02-10Downgrade "missing a certificate" from notice to infoNick Mathewson
It was apparently getting mistaken for a problem, even though it was at notice. Fixes 5067; fix on 0.2.0.10-alpha.
2012-02-10Use correct CVE number for CVE-2011-4576. Found by fermenthor. bug 5066Nick Mathewson
2012-02-09Merge branch 'maint-0.2.1' into maint-0.2.2Roger Dingledine
2012-02-09Revert "add a "docs" to the manual URI as listed in torrc.sample.in"Roger Dingledine
This reverts commit 55e8cae81553678ec77ce6b8fb1bf2d5e483e0aa. The conversation from irc: > weasel: i had intended to leave torrc.sample.in alone in maint-0.2.2, since i don't want to make all your stable users have to deal with a torrc change. but nickm changed it. is it in fact the case that a change in that file means a change in the deb? <weasel> it means you'll prompt every single user who ever touched their torrc <weasel> and they will be asked if they like your new version better than what they have right now <weasel> so it's not great Instead I changed the website to redirect requests for the tor-manual URL listed in maint-0.2.2's torrc.sample.in so the link will still work.
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion