Merge branch 'maint-0.3.3' into release-0.3.3

so they aren't mysteriously missing from the tarballs/etc

changes/25857

@@ -1,3 +0,0 @@
-  o Documentation:
-    - Correct an IPv6 error in the documentation for ExitPolicy.
-      Closes ticket 25857.  Patch from "CTassisF".

changes/TROVE-2018-005

@@ -1,6 +0,0 @@
-  o Major bugfixes (security, directory authority, denial-of-service):
-    - Fix a bug that could have allowed an attacker to force a
-      directory authority to use up all its RAM by passing it a
-      maliciously crafted protocol versions string. Fixes bug 25517;
-      bugfix on 0.2.9.4-alpha.  This issue is also tracked as
-      TROVE-2018-005.

changes/bug21394.2

@@ -1,7 +0,0 @@
-  o Minor bugfix (Exit node DNS retries):
-    - Re-attempt timed-out DNS queries 3 times before failure, since our
-      timeout is 5 seconds for them, but clients wait 10-15. Also allow
-      slightly more timeouts per resolver before giving up on it in the
-      case where an exit has multiple resolvers configured. Fixes bug 21394;
-      bugfix on 0.3.1.9.
-

changes/bug22310

@@ -1,8 +0,0 @@
-  o Major bugfixes (performance, load balancing):
-    - Directory authorities no longer vote in favor of the Guard flag
-      for relays that don't advertise directory support. Starting in Tor
-      0.3.0.1-alpha, Tor clients have been avoiding using such relays in
-      the Guard position, leading to increasingly broken load balancing
-      for the 5%-or-so of Guards that don't advertise directory support.
-      Fixes bug 22310; bugfix on 0.3.0.6.
-

changes/bug23693.1

@@ -1,4 +0,0 @@
-  o Minor bugfixes (relay, crash):
-    - Avoid a crash when running with DirPort set but ORPort tuned off.
-      Fixes a case of bug 23693; bugfix on 0.3.1.1-alpha.
-

changes/bug24031

@@ -1,13 +0,0 @@
-  o Major bugfixes (protover, voting):
-    - Revise Rust implementation of protover to use a more memory-efficient
-      voting algorithm and corresponding data structures, thus avoiding a
-      potential (but small impact) DoS attack where specially crafted protocol
-      strings would expand to several potential megabytes in memory.  In the
-      process, several portions of code were revised to be methods on new,
-      custom types, rather than functions taking interchangeable types, thus
-      increasing type safety of the module.  Custom error types and handling
-      were added as well, in order to facilitate better error dismissal/handling
-      in outside crates and avoid mistakenly passing an internal error string to
-      C over the FFI boundary.  Many tests were added, and some previous
-      differences between the C and Rust implementations have been
-      remedied. Fixes bug 24031; bugfix on 0.3.3.1-alpha.

changes/bug24767

@@ -1,5 +0,0 @@
-  o Major bugfixes (relay, connection):
-    - Refuse to connect again to a relay from which we failed previously with
-      a connection refused, timeout or error (at the TCP level). The relay
-      won't be retried for 60 seconds after the failure occured. Fixes bug
-      24767; bugfix on 0.0.6.

changes/bug24769

@@ -1,7 +0,0 @@
-  o Minor bugfixes (performance):
-    - Reduce the number of circuits that can be opened at once during the
-      circuit build timeout phase. This is done by increasing the idle timeout
-      to 3 minutes, and lowering the maximum number of concurrent learning
-      circuits to 10. Fixes bug 24769; bugfix on 0.3.1.1-alpha.
-
-

changes/bug24782

@@ -1,4 +0,0 @@
-  o Minor features (config options):
-    - Change the way the default value for MaxMemInQueues is calculated. We now
-      use 0.4 * RAM if the system have 8 GB RAM or more, otherwise we use the
-      former value of 0.75 * RAM. Closes ticket 24782.

changes/bug24854

@@ -1,3 +0,0 @@
-  o Code simplification and refactoring:
-    - Move the list of default directory authorities to their own file for
-      inclusion using the C preprocessor. Closes ticket 24854. Patch by "beastr0".

changes/bug24903

@@ -1,5 +0,0 @@
-  o Minor bugfixes (controller, reliability):
-    - Avoid a (nonfatal) assertion failure when extending a one-hop circuit
-      from the controller to become a multihop circuit. Fixes bug 24903;
-      bugfix on 0.2.5.2-alpha.
-

changes/bug24904

@@ -1,4 +0,0 @@
-  o Minor bugfix (channel, client):
-    - Better identify client connection when reporting to the geoip client
-      cache. Fixes bug 24904; bugfix on 0.3.1.7.
-

changes/bug24969

@@ -1,3 +0,0 @@
-  o Minor bugfixes (Linux seccomp2 sandbox):
-    - Allow the nanosleep() system call, which glibc uses to implement
-      sleep() and usleep(). Fixes bug 24969; bugfix on 0.2.5.1-alpha.

changes/bug24978

@@ -1,7 +0,0 @@
-  o Minor features (compatibility, OpenSSL):
-    - Tor will now support TLS1.3 once OpenSSL 1.1.1 is released.
-      Previous versions of Tor would not have worked with OpenSSL
-      1.1.1, since they neither disabled TLS 1.3 nor enabled any of the
-      ciphersuites it requires. Here we enable the TLS 1.3 ciphersuites.
-      Closes ticket 24978.
-

changes/bug24989

@@ -1,4 +0,0 @@
-  o Minor bugfixes (hidden services):
-    - Re-instate counting pending client HSDir fetch circuits against the
-      MaxClientCircuitsPending rate limit. Fixes bug 24989; bugfix on
-      0.3.3.0-alpha-dev.

changes/bug25120

@@ -1,4 +0,0 @@
-  o Minor features (logging):
-    - Clarify the log messages produced when getrandom() or a related
-      entropy-generation mechanism gives an error. Closes ticket
-      25120.

changes/bug25213

@@ -1,5 +0,0 @@
-  o Minor bugfixes (warnings, ipv6):
-    - Avoid a bug warning that could occur when trying to connect to
-      a relay over IPv6 on a Tor instance that downloads router descriptors,
-      but prefers to use microdescriptors. Fixes bug 25213; bugfix on
-      0.3.3.1-alpha.

changes/bug25223

@@ -1,4 +0,0 @@
-  o Minor bugfixes (DoS mitigation):
-    - Make sure we don't modify consensus parameters if we aren't a public
-      relay when a new consensus arrives. Fixes bug 25223; bugfix on
-      0.3.3.2-alpha.

changes/bug25226

@@ -1,4 +0,0 @@
-  o Major bugfixes (relay, denial of service):
-    - Impose a limit on circuit cell queue size. The limit can be controlled by
-      a consensus parameter. Fixes bug 25226; bugfix on 0.2.4.14-alpha.
-

changes/bug25249

@@ -1,3 +0,0 @@
-  o Minor bugfixes (spec conformance):
-    - Forbid "-0" as a protocol version. Fixes part of bug 25249; bugfix on
-      0.2.9.4-alpha.

changes/bug25249.2

@@ -1,3 +0,0 @@
-  o Minor bugfixes (spec conformance):
-    - Forbid UINT32_MAX as a protocol version.  Fixes part of bug 25249;
-      bugfix on 0.2.9.4-alpha.

changes/bug25296_032

@@ -1,5 +0,0 @@
-  o Minor bugfixes (documentation):
-    - Document that the PerConnBW{Rate,Burst} options will fall back to their
-      corresponding consensus parameters only if those parameters are
-      set. Previously we had claimed that these values would always be
-      set in the consensus. Fixes bug 25296; bugfix on 0.2.2.7-alpha.

changes/bug25306

@@ -1,6 +0,0 @@
-  o Minor bugfixes (hidden service v3):
-    - Avoid asserting when building descriptors in the next rotation time is
-      out of sync with the consensus valid after time. Instead, log a bug
-      warning with extra information to hunt down the cause of this assert.
-      Fixes bug 25306; bugfix on 0.3.2.1-alpha.
-

changes/bug25372

@@ -1,3 +0,0 @@
-  o Minor features (log messages):
-    - Improve log message in the out of memory handler to include information
-      about memory usage from the different compression backends. Closes ticket 25372.

changes/bug25378

@@ -1,4 +0,0 @@
-  o Documentation:
-    - Update the documentation for "Log" to include the current list
-      of logging domains. Closes ticket 25378.
-

changes/bug25415

@@ -1,4 +0,0 @@
-  o Major bugfixes (directory authority):
-    - Avoid a crash when testing router reachability on a router that could
-      have an ed25519 ID, but which does not. Fixes bug 25415; bugfix on
-      0.3.3.2-alpha.

changes/bug25450

@@ -1,8 +0,0 @@
-  o Minor bugfixes (testing):
-    - Avoid intermittent test failures due to relying on hidden service
-      introductory point creation within 5 seconds of real clock time.  The
-      time limit for the test has been increased to 500 seconds, which may
-      still result in intermittent failures (e.g. if the system doing the
-      testing enters sleep/hibernation or experiences some other clock jump).
-      However, this should elliminate test failures currently happening on
-      developer and CI systems.  Fixes bug 25450; bugfix on 0.3.1.3-alpha.

changes/bug25474

@@ -1,5 +0,0 @@
-  o Minor bugfixes (compilation):
-    - Fix a c99 compliance issue in our configuration script that was
-      causing compilation issues when compiling Tor with certain
-      versions of xtools. Fixes bug 25474; bugfix on 0.3.2.5-alpha.
-

changes/bug25479

@@ -1,4 +0,0 @@
-  o Major bugfixes (benchmarks):
-    - Fix a crash when running benchmark tests on win32 systems which
-      was due to an uninitialised mutex before logging and options
-      were initialised.  Fixes bug 25479; bugfix on 0.3.3.3-alpha.

changes/bug25560

@@ -1,5 +0,0 @@
-  o Minor bugfixes (testing, rust):
-    - Some of our Rust crates were not having their tests run with `make
-      test-rust` due to a static string in the `src/test/test_rust.sh` script
-      specifying which crates to test.  Rust crates are not automatically
-      detected and tested.  Fixes bug 25560; bugfix on 0.3.3.3-alpha.

changes/bug25581

@@ -1,4 +0,0 @@
-  o Minor bugfixes (configuration):
-    - Remove undescores from the _HSLayer{2,3}Nodes options. This expert-user
-      configuration can now be enabled as HSLayer{2,3}Nodes. Fixes bug 25581;
-      bugfix on 0.3.3.1-alpha

changes/bug25582

@@ -1,3 +0,0 @@
-  o Minor bugfixes (documentation):
-    - Revert a misformatting issue in the ExitPolicy
-      documentation. Fixes bug 25582; bugfix on 0.3.3.1-alpha.

changes/bug25617

@@ -1,5 +0,0 @@
-  o Minor bugfixes (controller):
-    - Restore the correct operation of the RESOLVE command, which had
-      been broken since we added the ability to enable/disable DNS
-      on specific listener ports. Fixes bug 25617; bugfix on 0.2.9.3-alpha.
-

changes/bug25629

@@ -1,3 +0,0 @@
-  o Minor bugfixes (C correctness):
-    - Fix a very unlikely null pointer dereference.  Fixes bug 25629;
-      bugfix on 0.2.9.15.  Found by Coverity; this is CID 1430932.

changes/bug25664

@@ -1,3 +0,0 @@
-  o New system requirements:
-    - When built with Rust, Tor now depends on version 0.2.39 of the libc
-      crate. Closes tickets 25310 and 25664.

changes/bug25679

@@ -1,4 +0,0 @@
-  o Minor bugfixes (compilation, rust):
-    - Build correctly when the rust dependencies submodule is loaded,
-      but the TOR_RUST_DEPENDENCIES environment variable is not set.
-      Fixes bug 25679; bugfix on 0.3.3.1-alpha.

changes/bug25691

@@ -1,6 +0,0 @@
-  o Minor bugfixes (client):
-    - When using a listed relay as a bridge, and also using
-      microdescriptors, and considering that relay as a non-bridge in
-      a circuit, consider its microdescriptor as a valid source of information
-      about that relay. Fixes bug 25691; bugfix on 0.3.3.4-alpha.
-

changes/bug25732

@@ -1,4 +0,0 @@
-  o Minor bugfixes (distribution, compilation):
-    - Actually include all of our Rust source in our source
-      distributions. (Previously, a few of the files were accidentally
-      omitted.) Fixes bug 25732; bugfix on 0.3.3.2-alpha.

changes/bug25733

@@ -1,4 +0,0 @@
-  o Minor bugfixes (Assert crash):
-    - Avoid an assert in the circuit build timeout code if we fail to
-      allow any circuits to actually complete. Fixes bug 25733;
-      bugfix on 0.2.2.2-alpha.

changes/bug25761

@@ -1,3 +0,0 @@
-  o Major bugfixes (onion service):
-    - Correctly detect when onion services get disabled after HUP.
-      Fixes bug 25761; bugfix on 0.3.2.1.

changes/bug25901

@@ -1,3 +0,0 @@
-  o Minor bugfixes (hidden service v3):
-    - Fix a memory leak when an hidden service v3 is configured and gets a
-      SIGHUP signal. Fixes bug 25901; bugfix on 0.3.2.1-alpha.

changes/bug26007

@@ -1,5 +0,0 @@
-  o Major bugfixes (directory authorities, security):
-    - When directory authorities read a zero-byte bandwidth file, they log
-      a warning with the contents of an uninitialised buffer. Log a warning
-      about the empty file instead.
-      Fixes bug 26007; bugfix on 0.2.2.1-alpha.

changes/bug26052

@@ -1,6 +0,0 @@
-  o Minor bugfixes (documentation):
-    - Stop saying in the manual that clients cache ipv4 dns answers
-      from exit relays. We haven't used them since 0.2.6.3-alpha, and
-      in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha,
-      but we forgot to say so in the man page. Fixes bug 26052; bugfix
-      on 0.3.2.6-alpha.

changes/bug26069

@@ -1,5 +0,0 @@
-  o Minor bugfixes (hidden service v3):
-    - When parsing the descriptor signature, look for the token plus an extra
-      white-space at the end. This is more correct but also will allow us to
-      support new fields that might start with "signature". Fixes bug 26069;
-      bugfix on 0.3.0.1-alpha.

changes/bug26072

@@ -1,5 +0,0 @@
-  o Minor bugfixes (correctness, client):
-    - Upon receiving a malformed connected cell, stop processing the cell
-      immediately.  Previously we would mark the connection for close, but
-      continue processing the cell as if the connection were open. Fixes bug
-      26072; bugfix on 0.2.4.7-alpha.

changes/bugs_25036_25055

@@ -1,7 +0,0 @@
-  o Minor bugfixes (networking):
-    - Tor will not reject IPv6 address strings from TorBrowser when they
-      are passed as hostnames in SOCKS5 requests. Fixes bug 25036,
-      bugfix on Tor 0.3.1.2.
-    - string_is_valid_hostname() will not consider IP strings to be valid
-      hostnames. Fixes bug 25055; bugfix on Tor 0.2.5.5.
-

changes/coveralls

@@ -1,3 +0,0 @@
-  o Minor features (continuous integration):
-    - Our Travis CI configuration now integrates with the Coveralls coverage
-      analysis tool. Closes ticket 25818.

changes/feature25313

@@ -1,4 +0,0 @@
-  o Minor features (sandbox):
-    - Explicitly permit the poll() system call when the Linux seccomp2-based
-      sandbox is enabled: apparently, some versions of libc use poll() when
-      calling getpwnam(). Closes ticket 25313.

changes/geoip-2018-03-08

@@ -1,4 +0,0 @@
-  o Minor features (geoip):
-    - Update geoip and geoip6 to the March 8 2018 Maxmind GeoLite2
-      Country database. Closes ticket 25469.
-

changes/geoip-2018-04-03

@@ -1,4 +0,0 @@
-  o Minor features (geoip):
-    - Update geoip and geoip6 to the April 3 2018 Maxmind GeoLite2
-      Country database. Closes ticket 25718.
-

changes/geoip-2018-05-01

@@ -1,4 +0,0 @@
-  o Minor features (geoip):
-    - Update geoip and geoip6 to the May 1 2018 Maxmind GeoLite2
-      Country database. Closes ticket 26104.
-

changes/refactor23814

@@ -1,4 +0,0 @@
-  o Code simplification and refactoring:
-    - Remove the old (deterministic) directory retry logic entirely:
-      We've used exponential backoff exclusively for some time.
-      Closes ticket 23814.

changes/ticket23635

@@ -1,3 +0,0 @@
-  o Documentation:
-    - Improved the documentation of AccountingStart paremeter.
-      Closes ticket 23635.

changes/ticket24343

@@ -1,6 +0,0 @@
-  o Minor bugfixes (man page, SocksPort):
-    - Remove dead code about the old "SocksSockets" option. To do so, the
-      SocksSocketsGroupWritable option has been renamed to
-      UnixSockssGroupWritable which does the same exact thing. The old option
-      is still usable but will warn that it is deprecated. Fixes bug 24343;
-      bugfix on 0.2.6.3.

changes/ticket25071

@@ -1,4 +0,0 @@
-  o Minor features (testing):
-    - Add a "make test-rust" target to run the rust tests only.
-      Closes ticket 25071.
-

changes/ticket25202

@@ -1,4 +0,0 @@
-  o Minor bugfixes (DoS mitigation):
-    - Add extra safety checks when refilling the circuit creation bucket to
-      ensure we never set a value that is above the allowed burst. Fixes
-      bug 25202; bugfix on 0.3.3.2-alpha.

changes/ticket25248

@@ -1,4 +0,0 @@
-  o Documentation (manpage, denial of service):
-    - Better detail the denial of service options by listing the different
-      mitigation in place. Closes ticket 25248.
-

changes/ticket25323

@@ -1,4 +0,0 @@
-  o Code simplification and refactoring:
-    - Update the "rust dependencies" submodule to be an project-level
-      repository, rather than a user repository. Closes ticket 25323.
-

changes/ticket25714

@@ -1,4 +0,0 @@
-  o Minor feature (continuous integration):
-    - Update the Travis CI configuration to use the stable Rust
-      channel, now that we have decided to require that.  Closes
-      ticket 25714.

changes/ticket26006

@@ -1,4 +0,0 @@
-  o Minor features (compilation, portability):
-    - Avoid some compilation warnings with recent versions
-      of LibreSSL. Closes ticket 26006.
-

changes/ticket26062

@@ -1,3 +0,0 @@
-  o Minor bugfixes (client):
-    - Don't consider Tor running as a client if the ControlPort is open. Fixes
-      bug 26062; bugfix on 0.2.9.4-alpha.

changes/travis_distcheck

@@ -1,4 +0,0 @@
-  o Minor features (continuous integration):
-    - Our .travis.yml configuration now includes support for testing
-      the results of "make distcheck". (It's not uncommon for "make check" to
-      pass but "make distcheck" to fail.)  Closes ticket 25814.

changes/trove-2018-001.1

@@ -1,6 +0,0 @@
-  o Major bugfixes (denial-of-service, directory authority):
-    - Fix a protocol-list handling bug that could be used to remotely crash
-      directory authorities with a null-pointer exception. Fixes bug 25074;
-      bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2018-001.
-
-

changes/trove-2018-004

@@ -1,8 +0,0 @@
-  o Minor bugfixes (denial-of-service):
-    - Fix a possible crash on malformed consensus. If a consensus had
-      contained an unparseable protocol line, it could have made clients
-      and relays crash with a null-pointer exception. To exploit this
-      issue, however, an attacker would need to be able to subvert the
-      directory-authority system. Fixes bug 25251; bugfix on
-      0.2.9.4-alpha. Also tracked as TROVE-2018-004.
-