Greetings, We just released tor 0.4.9.15. Here is the announcement: https://forum.torproject.org/t/security-release-0-4-9-15/22332
For more information on the new DoS defenses, see: https://lists.torproject.org/mailman3/hyperkitty/list/[email protected]/thread/DO63TMBKGPNCUG2UBNBZ6PSJOXMP4VM4/ Here is the ChangeLog: Changes in version 0.4.9.15 - 2026-10-28 This is another security release that includes new DoS defenses against large volumes of directory requests received by relays. Another significant change is that the HSDir flag is now sticky, meaning it persists across restarts. This release primarily affects relays so please upgrade as soon as possible. o Directory authority changes: - Directory authorities now list the protocol capabilities "RELAY_NEGOTIATE_SUBPROTO" and "RELAY_CRYPT_CGO" as required for relays. This change will allow clients to assume that all relays support Counter Galois Onion encryption, and use it even for relays not currently listed in the consensus. - Directory authorities now list the protocol capabilities "DESC_NO_TAP" and "MICRODESC_NO_TAP" as required for clients and relays. This changes will allow us to remove TAP keys from onion desciptors and microdescriptors, saving a great deal of directory bandwidth. Because of this change, Tor versions 0.4.8 and earlier will no longer work on the network. o Major features (directory authority): - Directory authorities provide a new consensus method that omits _all_ TAP keys and family lists from microdescriptors. This change is not compatible with 0.4.8, but 0.4.8 is no longer supported. It will save a great deal of directory bandwidth. o Major bugfixes (directory authority): - Correctly handle the middle-only flag at directory authorities, to prevent it from getting clobbered by a newly created consensus. This prevents flip-flopping of the middleonly flag. Fixes bug 41457; bugfix on 0.4.9.14. o Minor features (denial of service mitigation): - Directory caches can now rate limit BEGIN_DIR cells per circuit, independently of the exit stream creation limit. This is controlled by the new DoSBeginDirRateEnabled, DoSBeginDirRate, DoSBeginDirBurst and DoSBeginDirDefenseType consensus parameters and torrc options, enabled by default. Refusals are reported in the heartbeat and in the relay_dos_total{type="begindir_rate_rejected"} metric. Part of ticket 41411. - Directory caches can now refuse any BEGIN_DIR after the first one on a circuit from an authenticated relay. This is controlled by the new DoSBeginDirLimitEnabled consensus parameter, disabled by default. Refusals are reported in the heartbeat and in the relay_dos_total{type="begindir_rejected"} metric. Closes ticket 41411. - Onion service directories now accept at most one descriptor fetch or upload per circuit from an authenticated relay, and close the circuit on any later one. This holds even when the BEGIN_DIR per- circuit limit is disabled. o Minor features (directory authority): - Directory authorities now assign the HSDir flag to a relay that had it in a recent consensus even if its uptime is below MinUptimeHidServDirectoryV2, so a restart no longer costs a relay its HSDir flag for 96 hours. All other HSDir requirements still apply. Fixes ticket 41175. o Minor features (directory performance): - Filter malformed directory request digests in linear time, avoiding repeated list shifting when rejecting invalid entries. Preserve digest ordering and the existing sorting and deduplication behavior. - Summarize invalid directory request digests and consensus diff header digests once per parsing call, instead of logging each rejected entry. Omit rejected digest strings from these diagnostics and from invalid consensus diff URL diagnostics. o Minor features (fallbackdir): - Regenerate fallback directories generated on October 28, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/10/28. o Minor features (performance): - Track connection membership in the active linked and closeable lists using indices, and update those indices when removing entries. Use the connection array index for membership checks and clear it on removal. This avoids repeated global list scans during activation and teardown. Report inconsistent indices nonfatally and recover with a list search before modifying the list. o Minor features (relay): - Relays now use a separate circuit for each directory request, so that directory caches can later limit relays to one BEGIN_DIR per circuit. o Minor bugfixes (conflux, control port): - Refuse ATTACHSTREAM onto a conflux circuit that has not finished linking. Such a leg is open but a stream that you attach to it will be silently dropped from the circuit (with a BUG() warning) when the set linked. Fixes bug 41454; bugfix on 0.4.8.1-alpha. o Minor bugfixes (onion service, control port): - Fix a memory leak of the parsed signing-key certificate and superencrypted blob (roughly the size of the descriptor) on every HSPOST control-port command. Fixes bug 41455; bugfix on 0.3.3.1-alpha. o Minor bugfixes (scheduling): - Fix a bug in smartlist_pqueue_remove that could schedulers (for circuits within a channel, and for channels on the internet connection) to serve items in the wrong order, leading to temporary starvation for higher-priority circuits. Fixes bug 41428; bugfix on 0.2.2.7-alpha. -- MCgfKt8Z71zgn/ZfkxQViFHsfNFGHjprU2EQX+0o9HQ=
signature.asc
Description: PGP signature
_______________________________________________ tor-announce mailing list -- [email protected] To unsubscribe send an email to [email protected]
