Support all your favorite nonprofits with a single donation.

Donate safely, anonymously & monthly, in any amount. It's a smarter way to give online. Learn more
The Tor Project
Dedham, MA
givvers: emerssso + 4 others

Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.

The Tor Project is a 501(c)3 organization.

Latest News

Apr 28, 2016

A new hardened Tor Browser release is available. It can be found in the 6.0a5-hardened distribution directory and on the download page for hardened builds.

This release features important security updates to Firefox.

It contains a bunch of noteworthy changes. We switched the browser to Firefox ESR 45 and rebased our old patches/wrote new ones where necessary. We also ship a new Tor alpha version, 0.2.8.2, which makes meek usable again and contains a number of other improvements/stability fixes.

Note: There is no incremental update from 6.0a3-hardened available due to bug 17858. The internal updater should work, though, doing a complete update.

Here is the complete changelog since 6.0a4-hardened:

Tor Browser 6.0a5-hardened -- April 28 2016

  • All Platforms
    • Update Firefox to 45.1.0esr
    • Update Tor to 0.2.8.2-alpha
    • Update Torbutton to 1.9.5.3
      • Bug 18466: Make Torbutton compatible with Firefox ESR 45
      • Translation updates
    • Update Tor Launcher to 0.2.8.4
      • Bug 13252: Do not store data in the application bundle
      • Bug 10534: Don't advertise the help desk directly anymore
      • Translation updates
    • Update HTTPS-Everywhere to 5.1.6
    • Update NoScript to 2.9.0.11
    • Update meek to 0.22 (tag 0.22-18371-2)
      • Bug 18371: Symlinks are incompatible with Gatekeeper signing
    • Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45
    • Bug 18900: Fix broken updater on Linux
    • Bug 18042: Disable SHA1 certificate support
    • Bug 18821: Disable libmdns support for desktop and mobile
    • Bug 18848: Disable additional welcome URL shown on first start
    • Bug 14970: Exempt our extensions from signing requirement
    • Bug 16328: Disable MediaDevices.enumerateDevices
    • Bug 16673: Disable HTTP Alternative-Services
    • Bug 17167: Disable Mozilla's tracking protection
    • Bug 18603: Disable performance-based WebGL fingerprinting option
    • Bug 18738: Disable Selfsupport and Unified Telemetry
    • Bug 18799: Disable Network Tickler
    • Bug 18800: Remove DNS lookup in lockfile code
    • Bug 18801: Disable dom.push preferences
    • Bug 18802: Remove the JS-based Flash VM (Shumway)
    • Bug 18863: Disable MozTCPSocket explicitly
    • Bug 15640: Place Canvas MediaStream behind site permission
    • Bug 16326: Verify cache isolation for Request and Fetch APIs
    • Bug 18741: Fix OCSP and favicon isolation for ESR 45
    • Bug 16998: Disable for now
    • Bug 17506: Reenable building hardened Tor Browser with startup cache
    • Bug 18898: Exempt the meek extension from the signing requirement as well
    • Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile
    • Bug 18890: Test importScripts() for cache and network isolation
    • Bug 18726: Add new default obfs4 bridge (GreenBelt)
  • Build System
    • Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds
    • Bug 18699: Stripping fails due to obsolete Browser/components directory
    • Bug 18698: Include libgconf2-dev for our Linux builds

Apr 28, 2016

A new alpha Tor Browser release is available for download in the 6.0a5 distribution directory and on the alpha download page.

This release features important security updates to Firefox.

This will probably be our last alpha release before the stable 6.0 and it contains a bunch of noteworthy changes.

First, we switched the browser to Firefox ESR 45 and rebased our old patches/wrote new ones where necessary.

Second, we ship a new Tor alpha version, 0.2.8.2, which makes meek usable again and contains a number of other improvements/stability fixes.

Third, this alpha release introduces code signing for OS X in order to cope with Gatekeeper, the OS X mechanism for allowing only authorized applications to run. There were bundle layout changes necessary to adhere to code signing requirements. Please test that everything is still working as expected if you happen to have an OS X machine. We plan to post instructions for removing the code signing parts on our website soon. This should make it easier to compare the bundles we build with the actual bundles we ship.

The fourth highlight is the fix for an installer related DLL hijacking vulnerability. This vulnerability made it necessary to deploy a newer NSIS version to create our .exe files. Please test that the installer is still working as expected if you happen to have a Windows machine.

Known issues:

  • It seems there is a bug regarding our search engine selection in non-en-US bundles. The search engines actually used are the ones contained in the respective language packs but not those we ship. There is no easy workaround for this short of disabling the language pack or adding the search engines one wants to have by hand. We are sorry for this inconvenience.
  • An other issue is an error "Unable to start tor" after upgrading from an older version, on Mac OS (Bug 18928). Quitting and restarting a second time should fix the problem.

Here is the full changelog since 6.0a4:

Tor Browser 6.0a5 -- April 28 2016

  • All Platforms

    • Update Firefox to 45.1.0esr
    • Update Tor to 0.2.8.2-alpha
    • Update Torbutton to 1.9.5.3
      • Bug 18466: Make Torbutton compatible with Firefox ESR 45
      • Translation updates
    • Update Tor Launcher to 0.2.9.1
      • Bug 13252: Do not store data in the application bundle
      • Bug 10534: Don't advertise the help desk directly anymore
      • Translation updates
    • Update HTTPS-Everywhere to 5.1.6
    • Update NoScript to 2.9.0.11
    • Update meek to 0.22 (tag 0.22-18371-2)
      • Bug 18371: Symlinks are incompatible with Gatekeeper signing
    • Bug 15197 and child tickets: Rebase Tor Browser patches to ESR 45
    • Bug 18900: Fix broken updater on Linux
    • Bug 18042: Disable SHA1 certificate support
    • Bug 18821: Disable libmdns support for desktop and mobile
    • Bug 18848: Disable additional welcome URL shown on first start
    • Bug 14970: Exempt our extensions from signing requirement
    • Bug 16328: Disable MediaDevices.enumerateDevices
    • Bug 16673: Disable HTTP Alternative-Services
    • Bug 17167: Disable Mozilla's tracking protection
    • Bug 18603: Disable performance-based WebGL fingerprinting option
    • Bug 18738: Disable Selfsupport and Unified Telemetry
    • Bug 18799: Disable Network Tickler
    • Bug 18800: Remove DNS lookup in lockfile code
    • Bug 18801: Disable dom.push preferences
    • Bug 18802: Remove the JS-based Flash VM (Shumway)
    • Bug 18863: Disable MozTCPSocket explicitly
    • Bug 15640: Place Canvas MediaStream behind site permission
    • Bug 16326: Verify cache isolation for Request and Fetch APIs
    • Bug 18741: Fix OCSP and favicon isolation for ESR 45
    • Bug 16998: Disable <link rel="preconnect"> for now
    • Bug 18898: Exempt the meek extension from the signing requirement as well
    • Bug 18899: Don't copy Torbutton, TorLauncher, etc. into meek profile
    • Bug 18890: Test importScripts() for cache and network isolation
    • Bug 18726: Add new default obfs4 bridge (GreenBelt)
  • Windows

  • OS X

    • Bug 6540: Support OS X Gatekeeper
    • Bug 13252: Tor Browser should not store data in the application bundle
  • Build System

    • All Platforms
      • Bug 18127: Add LXC support for building with Debian guest VMs
      • Bug 16224: Don't use BUILD_HOSTNAME anymore in Firefox builds
    • Windows
      • Bug 17895: Use NSIS 2.51 for installer to avoid DLL hijacking
      • Bug 18290: Bump mingw-w64 commit we use
    • OS X
      • Bug 18331: Update toolchain for Firefox 45 ESR
      • Bug 18690: Switch to Debian Wheezy guest VMs
    • Linux
      • Bug 18699: Stripping fails due to obsolete Browser/components directory
      • Bug 18698: Include libgconf2-dev for our Linux builds

Apr 26, 2016

Tor Browser 5.5.5 is now available from the Tor Browser Project page and also from our distribution directory.

This release features important security updates to Firefox.

This release updates Firefox to 38.8.0esr. Additionally, we bump NoScript to version 2.9.0.11 and HTTPS-Everywhere to 5.1.6.

Moreover, we don't advertise our help desk anymore as we are currently restructuring our user support.

Here is the full changelog since 5.5.4:

Tor Browser 5.5.5 -- April 26 2016

  • All Platforms

    • Update Firefox to 38.8.0esr
    • Update Tor Launcher to 0.2.7.9

      • Bug 10534: Don't advertise the help desk directly anymore
      • Translation updates
    • Update HTTPS-Everywhere to 5.1.6
    • Update NoScript to 2.9.0.11
    • Bug 18726: Add new default obfs4 bridge (GreenBelt)

Apr 07, 2016

We are pleased to announce the new features available in the GetTor, a service that provides alternative ways to download Tor Browser, aimed for people who live in places with high levels of censorship (e.g. when www.torproject.org is blocked) or people who just don't want to expose the fact that they are downloading Tor Browser. This work adds important new download options and capabilities and includes improvements to the current code, deployment of new channels and providers, and some brand new features such as the GetTor API. We would also like to give special thanks to Nima Fatemi, who was in charge of the non-coding parts of this project (from funding to technical management).


Update note: we now have the [email protected] account for the XMPP channel. However, we will have the [email protected] account enabled for a couple of more weeks just in case you are still using it.


Landing page

A GetTor landing page has been created to offer information in one place (statistics, guides, etc.). If you are interested in what is going on with GetTor, following the landing page is highly recommended.


New Distribution Channels

In the past, GetTor has distributed packages by sending the bundles -- and then, later, just links -- via email. Now there are two more ways to interact with GetTor:


  1. Using Twitter: You can send a direct message to @get_tor account (you don't need to follow the @get_tor acount). Send the word help in a direct message to receive information on how to download the Tor Browser.

  2. Using XMPP: You can send a message to [email protected] using your favorite XMPP client. Simply enter help in an XMPP message to receive information on how to download the Tor Browser.


GitHub

GitHub is now a provider of Tor Browser (in addition to Dropbox and Google Drive), and the latest version of Tor Browser may be downloaded from our Github page and our Github repository.


Support for Android

Orbot is a free proxy (i.e. an intermediary) app that empowers other apps to use the Internet more securely. Orbot uses Tor to encrypt your Internet traffic and then hides it by sending it through a series of computers around the world. In addition to the download options provided by Guardian Project (Google Play, F-Droid, Direct download), GetTor provides yet another way to download Orbot to your mobile device. To do this, you have to reach one of our distribution channels and specify the android command (See Examples, at the bottom of this blog post). You will then receive instructions to download Orbot's Android Application Package (APK) file from Github, Google Drive or Dropbox. Once you have downloaded the APK file you can use it to install Orbot (similar to .exe files in Windows) and start using it.


Translated Versions of Tor Browser

GetTor provides a small set of translated packages focused on its end users. The available languages are Farsi, Chinese, Turkish, and English (which is the default). If you want to use this feature in the email autoresponder, for example, you send your request to:


    Farsi: [email protected]
    Chinese: [email protected]
    Turkish: [email protected]
    English: [email protected]


For the Twitter and XMPP channels, you just need to add the language word to the
message (e.g. linux fa will get you links for Tor Browser in Farsi).


Mirrors

There are many volunteers who use their own servers to provide mirrors of Tor Project's website. One or more of these mirrors may be not blocked in places where torproject.org is censored and could help in downloading Tor Browser. With this new release, you can request a list of these mirrors from GetTor by sending an email (or message, in case of Twitter and XMPP) with the word mirrors in the body of the text.


Statistics

Some basic but effective improvements have been made to collect anonymous data and compile meaningful statistics about GetTor usage, including requests per channel, operating system, and language. Safeguards have been implemented so that all information collected is anonymous, and it is erased on a daily basis -- we just keep the number and types of requests. Reports about this data will soon be available on GetTor's website.


RESTful API

One of GetTor's major new features is its API. In simple terms, an API is a set of rules and specifications that allow applications to communicate with each other (following these rules). This is helpful to developers who want to create new services or applications based on the information provided by the API. In this case, the GetTor API provides the following information:

  1. Links to download Tor Browser by provider, with filters for operating system and language.

  2. Links to download Tor Browser from Tor Project's website, with filters for choosing the release (latest version , etc.), operating system, and language.

  3. List of mirrors of Tor Project's website.



You can find more information on the API documentation.


Invitation to Collaborate

If you are a Tor user, a developer, good at writing content for non-technical users or anything else, we are happy to hear from you! You can use the comments section below, the tor-talk and tor-dev mailing lists, or come talk to us on IRC (#tor-dev on OFTC; our nicknames are ilv, sukhe and mrphs).


How to Ask for Tor Browser--Some Examples

To help you get started, here are a few examples of GetTor requests with different locales (languages) and operating systems:


Example 1 (Email): To get links for downloading Tor Browser in Farsi for Windows, send an email to [email protected] with the word windows in the body of the message.


Example 2 (Twitter): To get links for downloading Tor Browser in English for OS X, send a Direct Message to @get_tor with the words osx on it (you don't need to follow the account).


Example 3 (XMPP): To get links for downloading Tor Browser in Chinese for Linux, send a message to [email protected] account with the words linux zh on it.


Example 4 (Email): To get links for downloading Orbot for Android, send an email to [email protected] with the word android in the body of the message.

Apr 06, 2016

We are pleased to announce another public beta release of Tor Messenger. This release features important security updates to Instantbird. All users are highly encouraged to upgrade.

Mozilla's ESR cycle

This release of Tor Messenger is the first release based on Mozilla's ESR cycle. As with Tor Browser, all future releases will continue to pair with this cycle.

Secure Updater

We are well aware of the current pain in upgrading Tor Messenger and are actively working towards porting Tor Browser's updater patches (#14388) so that keeping Tor Messenger up to date is as seamless and easy as possible. We continue to apologize for the inconvenience.

Before upgrading, back up your OTR keys

Before upgrading to the new release, you will need to back up your OTR keys or simply generate new ones. Please see the following steps to back them up.

Downloads

Please note that Tor Messenger is still in beta. The purpose of this release is to help test the application and provide feedback. At-risk users should not depend on it for their privacy and safety.

Linux (32-bit)

Linux (64-bit)

Windows

OS X (Mac)

sha256sums.txt
sha256sums.txt.asc

The sha256sums.txt file containing hashes of the bundles is signed with the key 0x6887935AB297B391 (fingerprint: 3A0B 3D84 3708 9613 6B84 5E82 6887 935A B297 B391).

Changelog

Here is the complete changelog since v0.1.0b5:

Tor Messenger 0.1.0b6 -- April 06, 2016

  • All Platforms
    • Use the THUNDERBIRD_45_0b3_RELEASE tag on mozilla-esr45
    • Use the THUNDERBIRD_45_0b3_RELEASE tag on comm-esr45
    • Bug 18533: Disable sending fonts or colors as part of messages
    • ctypes-otr
      • GH 68: Don't close notification bar until verification succeeds (patch by Elias Rohrer)
      • GH 71: Improve verifying from the fingerprint manager (patch by Vu Quoc Huy)
      • GH 72: Generate keys automatically after account creation (patch by Vu Quoc Huy)

Apr 05, 2016

Can you tell us about your work?



I'm from East Africa. My background is in political science and I focus on the idea that consent in political systems helps build stability. I've been thinking about how to help communities circumvent or push back against information controls. When whistleblowers talk about corruption, there should be safe avenues of sharing that information without threatening their lives or their families.

How did you learn about Tor?

I didn't know that a web site could be blocked--I thought it was a problem with my computer--but then I saw in the comments section of a subreddit on Africa--it's mostly political--that some people could access a political web site. You want to know how they do it--you don't want to ask right there on reddit--so you research "access" "blocked" "website" as the key words.

This took me to Wikipedia and the article about circumvention tools. Then I learned about the routing through different servers to hide the source of a request.

I downloaded and installed Tor and it is slow--I thought it was a problem with my connection. But it worked! I could access websites that I could not access otherwise. Ethsat was blocked--a political and alternative media site that critiques the Ethiopian government and publishes info that is critical of government corruption.

[Ethsat is now blocked by CloudFlare and the site prohibits Firefox, which also means that it prohibits Tor. To circumvent this: Using the Tor browser, go to StartPage.com. Search for http://ethsat.com/, and click on the “proxy” link next to the search result. The disadvantage of this approach is that StartPage can see that a Tor IP address is visiting the website--but they won't know it's you. If you were to write your name on that website, you would de-anonymize yourself both to the website--and to StartPage. Thanks to Samdney for sharing this hack!
]

What was your reaction to CloudFlare CAPTCHAs when you first saw them?

You think the government is interfering or someone is playing around with it. You can't keep doing CAPTCHAs and they aren't working--you think something is broken here.

Doing one CAPTCHA is enough to identify if I'm human or not. [With repeated CAPTCHAs] I will run away from Tor. I won't use it. If CloudFlare really cares for security, then they should let people use Tor. Treat Tor like any other browser traffic.

What is your advice to other people in your country?

Use Tor -- For hundreds of thousands of people, it's the only way to access critical news.

Advice to other people like yourself?

You cannot purport to be fighting for society if you yourself are not secure. If you are not secure, you cannot secure others. The cobbler has no shoes. You are only as secure as your weakest browser. I most definitely would recommend Tor to frontline human rights defenders and journalists.

Any final thoughts?

Some people take it for granted that you can access any web site on the open Internet, but an Internet in which some web sites are blocked is not complete.

Other people are not as privileged--and Tor is giving them a fighting chance.

Apr 01, 2016

Wednesday, CloudFlare blogged that 94% of the requests it sees from Tor are "malicious." We find that unlikely, and we've asked CloudFlare to provide justification to back up this claim. We suspect this figure is based on a flawed methodology by which CloudFlare labels all traffic from an IP address that has ever sent spam as "malicious." Tor IP addresses are conduits for millions of people who are then blocked from reaching websites under CloudFlare's system.

We're interested in hearing CloudFlare's explanation of how they arrived at the 94% figure and why they choose to block so much legitimate Tor traffic. While we wait to hear from CloudFlare, here's what we know:

1) CloudFlare uses an IP reputation system to assign scores to IP addresses that generate malicious traffic. In their blog post, they mentioned obtaining data from Project Honey Pot, in addition to their own systems. Project Honey Pot has an IP reputation system that causes IP addresses to be labeled as "malicious" if they ever send spam to a select set of diagnostic machines that are not normally in use. CloudFlare has not described the nature of the IP reputation systems they use in any detail.

2) External research has found that CloudFlare blocks at least 80% of Tor IP addresses, and this number has been steadily increasing over time.

3) That same study found that it typically took 30 days for an event to happen that caused a Tor IP address to acquire a bad reputation and become blocked, but once it happens, innocent users continued to be punished for it for the duration of the study.

4) That study also showed a disturbing increase over time in how many IP addresses CloudFlare blocked without removal. CloudFlare's approach to blocking abusive traffic is incurring a large amount of false positives in the form of impeding normal traffic, thereby damaging the experience of many innocent Tor and non-Tor Internet users, as well as impacting the revenue streams of CloudFlare's own customers by causing frustrated or blocked users to go elsewhere.

5) A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found that the "conversion rate" of Tor IP addresses clicking on ads and performing commercial activity was "virtually equal" to that of non-Tor IP addresses).

CloudFlare disagrees with our use of the word "block" when describing its treatment of Tor traffic, but that's exactly what their system ultimately does in many cases. Users are either blocked outright with CAPTCHA server failure messages, or prevented from reaching websites with a long (and sometimes endless) loop of CAPTCHAs, many of which require the user to understand English in order to solve correctly. For users in developing nations who pay for Internet service by the minute, the problem is even worse as the CAPTCHAs load slowly and users may have to solve dozens each day with no guarantee of reaching a particular site. Rather than waste their limited Internet time, such users will either navigate away, or choose not to use Tor and put themselves at risk.

Also see our new fact sheet about CloudFlare and Tor: https://people.torproject.org/~lunar/20160331-CloudFlare_Fact_Sheet.pdf

Mar 28, 2016

Tor 0.2.8.2-alpha has been released! You can download the source from the Tor website. Packages should be available over the next week or so.

Tor 0.2.8.2-alpha is the second alpha in its series. It fixes numerous bugs in earlier versions of Tor, including some that prevented authorities using Tor 0.2.7.x from running correctly. IPv6 and directory support should also be much improved.

REMEMBER: This is an alpha release. Expect a lot of bugs. You should only run this release if you're willing to find bugs and report them.

Changes in version 0.2.8.2-alpha - 2016-03-28

  • New system requirements:
    • Tor no longer supports versions of OpenSSL with a broken implementation of counter mode. (This bug was present in OpenSSL 1.0.0, and was fixed in OpenSSL 1.0.0a.) Tor still detects, but no longer runs with, these versions.
    • Tor no longer attempts to support platforms where the "time_t" type is unsigned. (To the best of our knowledge, only OpenVMS does this, and Tor has never actually built on OpenVMS.) Closes ticket 18184.
    • Tor now uses Autoconf version 2.63 or later, and Automake 1.11 or later (released in 2008 and 2009 respectively). If you are building Tor from the git repository instead of from the source distribution, and your tools are older than this, you will need to upgrade. Closes ticket 17732.
  • Major bugfixes (security, pointers):
    • Avoid a difficult-to-trigger heap corruption attack when extending a smartlist to contain over 16GB of pointers. Fixes bug 18162; bugfix on 0.1.1.11-alpha, which fixed a related bug incompletely. Reported by Guido Vranken.

 

  • Major bugfixes (bridges, pluggable transports):
    • Modify the check for OR connections to private addresses. Allow bridges on private addresses, including pluggable transports that ignore the (potentially private) address in the bridge line. Fixes bug 18517; bugfix on 0.2.8.1-alpha. Reported by gk, patch by teor.
  • Major bugfixes (compilation):
    • Repair hardened builds under the clang compiler. Previously, our use of _FORTIFY_SOURCE would conflict with clang's address sanitizer. Fixes bug 14821; bugfix on 0.2.5.4-alpha.
  • Major bugfixes (crash on shutdown):
    • Correctly handle detaching circuits from muxes when shutting down. Fixes bug 18116; bugfix on 0.2.8.1-alpha.
    • Fix an assert-on-exit bug related to counting memory usage in rephist.c. Fixes bug 18651; bugfix on 0.2.8.1-alpha.
  • Major bugfixes (crash on startup):
    • Fix a segfault during startup: If a Unix domain socket was configured as listener (such as a ControlSocket or a SocksPort "unix:" socket), and tor was started as root but not configured to switch to another user, tor would segfault while trying to string compare a NULL value. Fixes bug 18261; bugfix on 0.2.8.1-alpha. Patch by weasel.
  • Major bugfixes (dns proxy mode, crash):
    • Avoid crashing when running as a DNS proxy. Fixes bug 16248; bugfix on 0.2.0.1-alpha. Patch from "cypherpunks".
  • Major bugfixes (relays, bridge clients):
    • Ensure relays always allow IPv4 OR and Dir connections. Ensure bridge clients use the address configured in the bridge line. Fixes bug 18348; bugfix on 0.2.8.1-alpha. Reported by sysrqb, patch by teor.
  • Major bugfixes (voting):
    • Actually enable support for authorities to match routers by their Ed25519 identities. Previously, the code had been written, but some debugging code that had accidentally been left in the codebase made it stay turned off. Fixes bug 17702; bugfix on 0.2.7.2-alpha.
    • When collating votes by Ed25519 identities, authorities now include a "NoEdConsensus" flag if the ed25519 value (or lack thereof) for a server does not reflect the majority consensus. Related to bug 17668; bugfix on 0.2.7.2-alpha.
    • When generating a vote with keypinning disabled, never include two entries for the same ed25519 identity. This bug was causing authorities to generate votes that they could not parse when a router violated key pinning by changing its RSA identity but keeping its Ed25519 identity. Fixes bug 17668; fixes part of bug 18318. Bugfix on 0.2.7.2-alpha.
  • Minor features (security, win32):
    • Set SO_EXCLUSIVEADDRUSE on Win32 to avoid a local port-stealing attack. Fixes bug 18123; bugfix on all tor versions. Patch by teor.
  • Minor features (bug-resistance):
    • Make Tor survive errors involving connections without a corresponding event object. Previously we'd fail with an assertion; now we produce a log message. Related to bug 16248.
  • Minor features (build):
    • Detect systems with FreeBSD-derived kernels (such as GNU/kFreeBSD) as having possible IPFW support. Closes ticket 18448. Patch from Steven Chamberlain.
  • Minor features (code hardening):
    • Use tor_snprintf() and tor_vsnprintf() even in external and low- level code, to harden against accidental failures to NUL- terminate. Part of ticket 17852. Patch from jsturgix. Found with Flawfinder.
  • Minor features (crypto):
    • Validate the hard-coded Diffie-Hellman parameters and ensure that p is a safe prime, and g is a suitable generator. Closes ticket 18221.
  • Minor features (geoip):
    • Update geoip and geoip6 to the March 3 2016 Maxmind GeoLite2 Country database.
  • Minor features (hidden service directory):
    • Streamline relay-side hsdir handling: when relays consider whether to accept an uploaded hidden service descriptor, they no longer check whether they are one of the relays in the network that is "supposed" to handle that descriptor. Implements ticket 18332.
  • Minor features (IPv6):
    • Add ClientPreferIPv6DirPort, which is set to 0 by default. If set to 1, tor prefers IPv6 directory addresses.
    • Add ClientUseIPv4, which is set to 1 by default. If set to 0, tor avoids using IPv4 for client OR and directory connections.
    • Try harder to obey the IP version restrictions "ClientUseIPv4 0", "ClientUseIPv6 0", "ClientPreferIPv6ORPort", and "ClientPreferIPv6DirPort". Closes ticket 17840; patch by teor.
  • Minor features (linux seccomp2 sandbox):
    • Reject attempts to change our Address with "Sandbox 1" enabled. Changing Address with Sandbox turned on would never actually work, but previously it would fail in strange and confusing ways. Found while fixing 18548.
  • Minor features (robustness):
    • Exit immediately with an error message if the code attempts to use Libevent without having initialized it. This should resolve some frequently-made mistakes in our unit tests. Closes ticket 18241.
  • Minor features (unix domain sockets):
    • Add a new per-socket option, RelaxDirModeCheck, to allow creating Unix domain sockets without checking the permissions on the parent directory. (Tor checks permissions by default because some operating systems only check permissions on the parent directory. However, some operating systems do look at permissions on the socket, and tor's default check is unneeded.) Closes ticket 18458. Patch by weasel.
  • Minor bugfixes (exit policies, security):
    • Refresh an exit relay's exit policy when interface addresses change. Previously, tor only refreshed the exit policy when the configured external address changed. Fixes bug 18208; bugfix on 0.2.7.3-rc. Patch by teor.
  • Minor bugfixes (security, hidden services):
    • Prevent hidden services connecting to client-supplied rendezvous addresses that are reserved as internal or multicast. Fixes bug 8976; bugfix on 0.2.3.21-rc. Patch by dgoulet and teor.
  • Minor bugfixes (build):
    • Do not link the unit tests against both the testing and non- testing versions of the static libraries. Fixes bug 18490; bugfix on 0.2.7.1-alpha.
    • Avoid spurious failures from configure files related to calling exit(0) in TOR_SEARCH_LIBRARY. Fixes bug 18625; bugfix on 0.2.0.1-alpha. Patch from "cypherpunks".
    • Silence spurious clang-scan warnings in the ed25519_donna code by explicitly initializing some objects. Fixes bug 18384; bugfix on 0.2.7.2-alpha. Patch by teor.
  • Minor bugfixes (client, bootstrap):
    • Count receipt of new microdescriptors as progress towards bootstrapping. Previously, with EntryNodes set, Tor might not successfully repopulate the guard set on bootstrapping. Fixes bug 16825; bugfix on 0.2.3.1-alpha.
  • Minor bugfixes (code correctness):
    • Update to the latest version of Trunnel, which tries harder to avoid generating code that can invoke memcpy(p,NULL,0). Bug found by clang address sanitizer. Fixes bug 18373; bugfix on 0.2.7.2-alpha.
  • Minor bugfixes (configuration):
    • Fix a tiny memory leak when parsing a port configuration ending in ":auto". Fixes bug 18374; bugfix on 0.2.3.3-alpha.
  • Minor bugfixes (containers):
    • If we somehow attempt to construct a heap with more than 1073741822 elements, avoid an integer overflow when maintaining the heap property. Fixes bug 18296; bugfix on 0.1.2.1-alpha.
  • Minor bugfixes (correctness):
    • Fix a bad memory handling bug that would occur if we had queued a cell on a channel's incoming queue. Fortunately, we can't actually queue a cell like that as our code is constructed today, but it's best to avoid this kind of error, even if there isn't any code that triggers it today. Fixes bug 18570; bugfix on 0.2.4.4-alpha.
  • Minor bugfixes (directory):
    • When generating a URL for a directory server on an IPv6 address, wrap the IPv6 address in square brackets. Fixes bug 18051; bugfix on 0.2.3.9-alpha. Patch from Malek.
  • Minor bugfixes (fallback directory mirrors):
    • When requesting extrainfo descriptors from a trusted directory server, check whether it is an authority or a fallback directory which supports extrainfo descriptors. Fixes bug 18489; bugfix on 0.2.4.7-alpha. Reported by atagar, patch by teor.
  • Minor bugfixes (hidden service, client):
    • Handle the case where the user makes several fast consecutive requests to the same .onion address. Previously, the first six requests would each trigger a descriptor fetch, each picking a directory (there are 6 overall) and the seventh one would fail because no directories were left, thereby triggering a close on all current directory connections asking for the hidden service. The solution here is to not close the connections if we have pending directory fetches. Fixes bug 15937; bugfix on 0.2.7.1-alpha.
  • Minor bugfixes (hidden service, control port):
    • Add the onion address to the HS_DESC event for the UPLOADED action both on success or failure. It was previously hardcoded with UNKNOWN. Fixes bug 16023; bugfix on 0.2.7.2-alpha.
  • Minor bugfixes (hidden service, directory):
    • Bridges now refuse "rendezvous2" (hidden service descriptor) publish attempts. Suggested by ticket 18332.
  • Minor bugfixes (linux seccomp2 sandbox):
    • Allow the setrlimit syscall, and the prlimit and prlimit64 syscalls, which some libc implementations use under the hood. Fixes bug 15221; bugfix on 0.2.5.1-alpha.
    • Avoid a 10-second delay when starting as a client with "Sandbox 1" enabled and no DNS resolvers configured. This should help TAILS start up faster. Fixes bug 18548; bugfix on 0.2.5.1-alpha.
    • Fix the sandbox's interoperability with unix domain sockets under setuid. Fixes bug 18253; bugfix on 0.2.8.1-alpha.
  • Minor bugfixes (logging):
    • When logging information about an unparsable networkstatus vote or consensus, do not say "vote" when we mean consensus. Fixes bug 18368; bugfix on 0.2.0.8-alpha.
    • Scrub service name in "unrecognized service ID" log messages. Fixes bug 18600; bugfix on 0.2.4.11-alpha.
    • Downgrade logs and backtraces about IP versions to info-level. Only log backtraces once each time tor runs. Assists in diagnosing bug 18351; bugfix on 0.2.8.1-alpha. Reported by sysrqb and Christian, patch by teor.
  • Minor bugfixes (memory safety):
    • Avoid freeing an uninitialized pointer when opening a socket fails in get_interface_addresses_ioctl(). Fixes bug 18454; bugfix on 0.2.3.11-alpha. Reported by toralf and "cypherpunks", patch by teor.
    • Correctly duplicate addresses in get_interface_address6_list(). Fixes bug 18454; bugfix on 0.2.8.1-alpha. Reported by toralf, patch by "cypherpunks".
    • Fix a memory leak in tor-gencert. Fixes part of bug 18672; bugfix on 0.2.0.1-alpha.
    • Fix a memory leak in "tor --list-fingerprint". Fixes part of bug 18672; bugfix on 0.2.5.1-alpha.
  • Minor bugfixes (private directory):
    • Prevent a race condition when creating private directories. Fixes part of bug 17852; bugfix on 0.0.2pre13. Part of ticket 17852. Patch from jsturgix. Found with Flawfinder.
  • Minor bugfixes (test networks, IPv6):
    • Allow internal IPv6 addresses in descriptors in test networks. Fixes bug 17153; bugfix on 0.2.3.16-alpha. Patch by teor, reported by karsten.
  • Minor bugfixes (testing):
    • We no longer disable assertions in the unit tests when coverage is enabled. Instead, we require you to say --disable-asserts-in-tests to the configure script if you need assertions disabled in the unit tests (for example, if you want to perform branch coverage). Fixes bug 18242; bugfix on 0.2.7.1-alpha.
  • Minor bugfixes (time parsing):
    • Avoid overflow in tor_timegm when parsing dates in and after 2038 on platforms with 32-bit time_t. Fixes bug 18479; bugfix on 0.0.2pre14. Patch by teor.
  • Minor bugfixes (tor-gencert):
    • Correctly handle the case where an authority operator enters a passphrase but sends an EOF before sending a newline. Fixes bug 17443; bugfix on 0.2.0.20-rc. Found by junglefowl.
  • Code simplification and refactoring:
    • Quote all the string interpolations in configure.ac -- even those which we are pretty sure can't contain spaces. Closes ticket 17744. Patch from zerosion.
    • Remove specialized code for non-inplace AES_CTR. 99% of our AES is inplace, so there's no need to have a separate implementation for the non-inplace code. Closes ticket 18258. Patch from Malek.
    • Simplify return types for some crypto functions that can't actually fail. Patch from Hassan Alsibyani. Closes ticket 18259.
  • Documentation:
    • Change build messages to refer to "Fedora" instead of "Fedora Core", and "dnf" instead of "yum". Closes tickets 18459 and 18426. Patches from "icanhasaccount" and "cypherpunks".
  • Removed features:
    • We no longer maintain an internal freelist in memarea.c. Allocators should be good enough to make this code unnecessary, and it's doubtful that it ever had any performance benefit.
  • Testing:
    • Fix several warnings from clang's address sanitizer produced in the unit tests.
    • Treat backtrace test failures as expected on FreeBSD until we solve bug 17808. Closes ticket 18204.