tor: update to 2.4.22

[feranick@…]

Tor in macports is currently in version 2.4.20 and it has been superseeded by 2.4.21 upstream. It should be upgraded accordingly in macports.

[feranick@…]

Tor 0.2.4.21 further improves security against potential adversaries who find breaking 1024-bit crypto doable, and backports several stability and robustness patches from the 0.2.5 branch.

Changelog:

Changes in version 0.2.4.21 - 2014-02-28

• Major features (client security):
  • When we choose a path for a 3-hop circuit, make sure it contains at least one relay that supports the NTor circuit extension handshake. Otherwise, there is a chance that we're building a circuit that's worth attacking by an adversary who finds breaking 1024-bit crypto doable, and that chance changes the game theory. Implements ticket 9777.

• Major bugfixes:
  • Do not treat streams that fail with reason END_STREAM_REASON_INTERNAL as indicating a definite circuit failure, since it could also indicate an ENETUNREACH connection error. Fixes part of bug 10777; bugfix on 0.2.4.8-alpha.

• Code simplification and refactoring:
  • Remove data structures which were introduced to implement the CellStatistics option: they are now redundant with the new timestamp field in the regular packed_cell_t data structure, which we did in 0.2.4.18-rc in order to resolve bug 9093. Resolves ticket 10870.

• Minor features:
  • Always clear OpenSSL bignums before freeing them -- even bignums that don't contain secrets. Resolves ticket 10793. Patch by Florent Daigniere.
  • Build without warnings under clang 3.4. (We have some macros that define static functions only some of which will get used later in the module. Starting with clang 3.4, these give a warning unless the unused attribute is set on them.) Resolves ticket 10904.
  • Update geoip and geoip6 files to the February 7 2014 Maxmind GeoLite2 Country database.

• Minor bugfixes:
  • Set the listen() backlog limit to the largest actually supported on the system, not to the value in a header file. Fixes bug 9716; bugfix on every released Tor.
  • Treat ENETUNREACH, EACCES, and EPERM connection failures at an exit node as a NOROUTE error, not an INTERNAL error, since they can apparently happen when trying to connect to the wrong sort of netblocks. Fixes part of bug 10777; bugfix on 0.1.0.1-rc.
  • Fix build warnings about missing "a2x" comment when building the manpages from scratch on OpenBSD; OpenBSD calls it "a2x.py". Fixes bug 10929; bugfix on 0.2.2.9-alpha. Patch from Dana Koch.
  • Avoid a segfault on SIGUSR1, where we had freed a connection but did not entirely remove it from the connection lists. Fixes bug 9602; bugfix on 0.2.4.4-alpha.
  • Fix a segmentation fault in our benchmark code when running with Fedora's OpenSSL package, or any other OpenSSL that provides ECDH but not P224. Fixes bug 10835; bugfix on 0.2.4.8-alpha.
  • Turn "circuit handshake stats since last time" log messages into a heartbeat message. Fixes bug 10485; bugfix on 0.2.4.17-rc.

• Documentation fixes:
  • Document that all but one DirPort entry must have the NoAdvertise flag set. Fixes bug 10470; bugfix on 0.2.3.3-alpha / 0.2.3.16-alpha.

[ryandesign (Ryan Carsten Schmidt)]

0.2.4.22 is out now.

[ryandesign (Ryan Carsten Schmidt)]

r121746