tor-0.3.5.18-28.1

- tor 0.3.5.18
  see /usr/share/doc/packages/tor/ChangeLog for details

- tor 0.3.5.12:
  * Check channels+circuits on relays more thoroughly
    (TROVE-2020-005, boo#1178741)
  * Update list of 144 fallback directories to 2020-07
  * Not affected by out-of-bound memory access (CVE-2020-15572, boo#1173979)
  * Fix DoS defenses on bridges with a pluggable transport
  * Warn if the ContactInfo field is not set

- tor 0.3.5.12:
  * Check channels+circuits on relays more thoroughly
    (TROVE-2020-005, boo#1178741)
  * Update list of 144 fallback directories to 2020-07
  * Not affected by out-of-bound memory access (CVE-2020-15572, boo#1173979)
  * Fix DoS defenses on bridges with a pluggable transport
  * Warn if the ContactInfo field is not set

- tor 0.3.5.10:
  * CVE-2020-10592: CPU consumption DoS and timing patterns (boo#1167013)
  * CVE-2020-10593: circuit padding memory leak (boo#1167014)
  * Add tor-print-ed-signing-cert binary
  * More added features

- tor 0.3.5.10:
  * CVE-2020-10592: CPU consumption DoS and timing patterns (boo#1167013)
  * CVE-2020-10593: circuit padding memory leak (boo#1167014)
  * Add tor-print-ed-signing-cert binary
  * More added features

- tor 0.3.4.8 (boo#1107847):
  * improvements for running in low-power and embedded environments
  * preliminary changes for new bandwidth measurement system
  * refine anti-denial-of-service code

- tor 0.3.3.10:
  * various build and compatibility fixes
  * The control port now exposes the list of HTTPTunnelPorts and
    ExtOrPorts via GETINFO net/listeners/httptunnel and
    net/listeners/extor respectively
  * Authorities no longer vote to make the subprotocol version
    "LinkAuth=1" a requirement: it is unsupportable with NSS, and
    hasn't been needed since Tor 0.3.0.1-alpha
  * When voting for recommended versions, make sure that all of the
    versions are well-formed and parsable
  * various minor bug fixes on onion services

- tor 0.3.3.9:
  * move to a new bridge authority
  * backport some bug fixes
- refresh upstream signing keyring

- tor 0.3.3.8:
  * directory authority memory leak fix
  * various minor bug fixes

- tor 0.3.3.7:
  * Add an IPv6 address for the "dannenberg" directory authority
  * Improve accuracy of the BUILDTIMEOUT_SET control port event's
    TIMEOUT_RATE and CLOSE_RATE fields
  * Only select relays when tor has descriptors that it prefers to
    use for them, avoiding nonfatal errors later

- tor 0.3.3.6:
  * new stable release series
  * controller support and other improvements for v3 onion services
  * official support for embedding Tor within other application
  * Improvements to IPv6 support
  * Relay option ReducedExitPolicy to configure a reasonable default
  * Revent DoS via malicious protocol version string (boo#1094283)
  * Many other other bug fixes and improvements

- tor 0.3.4.11:
  * CVE-2019-8955 prevent attackers from making tor run
    out of memory and crash (boo#1126340)

- tor 0.3.4.11:
  * CVE-2019-8955 prevent attackers from making tor run
    out of memory and crash (boo#1126340)

- tor 0.3.4.10:
  * OpenSSL compatibility fixes
  * Fixes for relay bugs
  * update fallback directory list

- tor 0.3.4.9:
  * Various bug fixes, including a bandwidth management bug that
    was causing memory exhaustion on relays

- tor 0.3.2.9:
  * new onion service design (v3), not default
  * new circuit scheduler algorithm for improved performance
  * directory authority updates
  * many other updates and improvements

- tor 0.3.2.10:
  * CVE-2018-0490: remote crash vulnerability against directory
    authorities (boo#1083845, TROVE-2018-001)
  * CVE-2018-0491: remote relay crash (boo#1083846, TROVE-2018-002)
  * New system for improved resistance to DoS attacks against relays
  * Various other bug fixes

- tor 0.3.1.9 with the following security fixes that prevent some
  traffic confirmation, DoS and other problems (bsc#1070849):
  * CVE-2017-8819: Replay-cache ineffective for v2 onion services
  * CVE-2017-8820: Remote DoS attack against directory authorities
  * CVE-2017-8821: An attacker can make Tor ask for a password
  * CVE-2017-8822: Relays can pick themselves in a circuit path
  * CVE-2017-8823: Use-after-free in onion service v2

- tor 0.3.1.8:
  * Add "Bastet" as a ninth directory authority to the default list
  * The directory authority "Longclaw" has changed its IP address
  * Fix a timing-based assertion failure that could occur when the
    circuit out-of-memory handler freed a connection's output buffer
  * Update geoip and geoip6 to the October 4 2017 Maxmind GeoLite2
    Country database
- drop tor-0.3.1.7-fix-zstd-i586.patch, upstreamed

- tor 0.3.1.7:
  * Serve and download directory information in more compact
    formats
  * New padding padding system to resist netflow-based traffic
    analysis
  * Improve protection against identification of tor traffic by ISP
    via ConnectionPadding option
  * Reduce the number of long-term connections open between relays
- add tor-0.3.1.7-fix-zstd-i586.patch to fix 32 bit build with zstd

- tor 0.3.0.11:
  * CVE-2017-0380: hidden services with the SafeLogging option
    disabled could disclose the stack TROVE-2017-008, boo#1059194
  * Update geoip and geoip6 to the September 6 2017 Maxmind GeoLite2
    Country database.
  * drop tor-0.3.0.7-gcc7-fallthrough.patch, now upstream

- tor 0.3.0.10
  * Fix a typo that had prevented TPROXY-based transparent proxying
    from working under Linux.
  * Avoid an assertion failure bug affecting our implementation of
    inet_pton(AF_INET6) on certain OpenBSD systems.

- tor 0.3.0.9:
  * CVE-2017-0377: Fix path selection bug that would allow a client
    to use a guard that was in the same network family as a chosen
    exit relay (bsc#1046845)
  * Don't block bootstrapping when a primary bridge is offline and
    tor cannot get its descriptor
  * When starting with an old consensus, do not add new entry guards
    unless the consensus is "reasonably live" (under 1 day old).
  * Update geoip and geoip6 to the June 8 2017 Maxmind GeoLite2
    Country database.

- tor 0.3.0.8 fixing a pair of bugs that would allow an attacker to
  remotely crash a hidden service with an assertion failure
  * CVE-2017-0375: remotely triggerable assertion failure when a
    hidden service handles a malformed BEGIN cell (bsc#1043455)
  * CVE-2017-0376: remotely triggerable assertion failure caused by
    receiving a BEGIN_DIR cell on a hidden service rendezvous
    circuit (bsc#1043456)
- further bug fixes:
  * link handshake fixes when changing x509 certificates
  * Regenerate link and authentication certificates whenever the key
    that signs them changes; also, regenerate link certificates
    whenever the signed key changes
  * When sending an Ed25519 signing->link certificate in a CERTS cell,
    send the certificate that matches the x509 certificate that was
    used on the TLS connection
  * Stop rejecting v3 hidden service descriptors because their size
    did not match an old padding rule

- fix build with GCC 7: warning-errors on implicit fallthrough
  add tor-0.3.0.7-gcc7-fallthrough.patch bsc#1041262

- tor 0.3.0.7:
  * Fix an assertion failure in the hidden service directory code,
    which could be used by an attacker to remotely cause a Tor
    relay process to exit. TROVE-2017-002 bsc#1039211
  * Update geoip and geoip6 to the May 2 2017 Maxmind GeoLite2
    Country database.
  * Tor no longer refuses to download microdescriptors or
    descriptors if they are listed as "published in the future"
  * The getpid() system call is now permitted under the Linux
    seccomp2 sandbox, to avoid crashing with versions of OpenSSL
    (and other libraries) that attempt to learn the process's PID
    by using the syscall rather than the VDSO code

- tor 0.3.0.6:
  * clients and relays now use Ed25519 keys to authenticate their
    link connections to relays, rather than the old RSA1024 keys
    that they used before.
  * replace the guard selection and replacement algorithm to behave
    more robustly in the presence of unreliable networks, and to
    resist guard-capture attacks.
  * numerous other small features and bugfixes
  * groundwork for the upcoming hidden-services revamp

- tor 0.2.9.10:
  * directory authority: During voting, when marking a relay as a
    probable sybil, do not clear its BadExit flag: sybils can still
    be bad in other ways too.
  * IPv6 Exits: Stop rejecting all IPv6 traffic on Exits whose exit
    policy rejects any IPv6 addresses. Instead, only reject a port
    over IPv6 if the exit policy rejects that port on more than an
    IPv6 /16 of addresses.
  * parsing: Fix an integer underflow bug when comparing malformed
    Tor versions. This bug could crash Tor when built with
  - -enable-expensive-hardening, or on Tor 0.2.9.1-alpha through
    Tor 0.2.9.8, which were built with -ftrapv by default. In other
    cases it was harmless. Part of TROVE-2017-001 boo#1027539
  * Directory authorities now reject descriptors that claim to be
    malformed versions of Tor
  * Reject version numbers with components that exceed INT32_MAX.
  * Update geoip and geoip6 to the February 8 2017 Maxmind GeoLite2
    Country database.
  * The tor-resolve command line tool now rejects hostnames over 255
    characters in length

- tor 0.2.9.9:
  * Downgrade the "-ftrapv" option from "always on" to "only on
    when --enable-expensive-hardening is provided." This hardening
    option, like others, can turn survivable bugs into crashes --
    and having it on by default made a (relatively harmless)
    integer overflow bug into a denial-of-service bug
  * Fix a client-side onion service reachability bug
  * Update geoip and geoip6 to the January 4 2017 Maxmind GeoLite2
    Country database.

- Remove conditionals for the sle11 as we won't build there due to
  openssl requirements. This reduces the logic in the spec file
  quite a bit

- tor 0.2.9.8, the first stable release in the 0.2.9.x series:
  * make mandatory a number of security features that were formerly
    optional
  * support a new shared-randomness protocol that will form the
    basis for next generation hidden services
  * single-hop hidden service mode for optimizing .onion services
    that don't actually want to be hidden,
  * try harder not to overload the directory authorities with
    excessive downloads
  * support a better protocol versioning scheme for improved
    compatibility with other implementations of the Tor protocol
  * deprecated options for security: CacheDNS, CacheIPv4DNS,
    CacheIPv6DNS, UseDNSCache, UseIPv4Cache, and UseIPv6Cache,
    AllowDotExit, AllowInvalidNodes, AllowSingleHopCircuits,
    AllowSingleHopExits, ClientDNSRejectInternalAddresses,
    CloseHSClientCircuitsImmediatelyOnTimeout,
    CloseHSServiceRendCircuitsImmediatelyOnTimeout,
    ExcludeSingleHopRelays, FastFirstHopPK, TLSECGroup,
    UseNTorHandshake, and WarnUnsafeSocks.
  * *ListenAddress options are now deprecated as unnecessary: the
    corresponding *Port options should be used instead. The
    affected options are:
    ControlListenAddress, DNSListenAddress, DirListenAddress,
    NATDListenAddress, ORListenAddress, SocksListenAddress,
    and TransListenAddress.

- tor 0.2.8.12:
  * CVE-2016-1254: A hostile hidden service could cause tor clients
    to crash (bsc#1016343)
  * update fallback directory list
  * Update geoip and geoip6 to the December 7 2016 Maxmind GeoLite2
    Country database.

- recommend torsocks as it is needed by included torify

- tor 0.2.8.11:
  * Fix compilation with OpenSSL 1.1

- tor 0.2.8.10:
  * When Tor leaves standby because of a new application request,
    open circuits as needed to serve that request
  * Clients now respond to new application stream requests
    immediately when they arrive, rather than waiting up to one
    second before starting to handle them
  * small portability and memory handling issues
  * Update geoip and geoip6 to the November 3 2016 Maxmind GeoLite2
    Country database.

- tor 0.2.8.9:
  * security fix: prevent remote DoS TROVE-2016-10-001 boo#1005292
  * Update geoip and geoip6 to the October 4 2016 Maxmind GeoLite2
    Country database.
  * Update signing key

- tor 0.2.8.8:
  * fixes some crash bugs when using bridges
  * fixes a timing-dependent assertion
  * removes broken fallbacks from the hard-coded fallback directory
    list
  * Updates geoip and geoip6 to the September 6 2016 Maxmind
    GeoLite2 Country database

- tor 0.2.8.7:
  * The "Tonga" bridge authority has been retired; the new bridge
    authority is "Bifroest"
  * Only use the ReachableAddresses option to restrict the first
    hop in a path. In earlier versions of 0.2.8.x, it would apply
    to every hop in the path, with a possible degradation in
    anonymity for anyone using an uncommon ReachableAddress setting

- tor 0.2.8.6:
  * improve client bootstrapping performance
  * improved identity keys for relays (authority side)
  * numerous bug fixes and performance improvements