Change Log

2014-04-17 Advanced Onion Router 0.3.0.
20
- corrected: the subdomain was not removed from an .onion address when searching
for its rendezvous descriptor (thanks to AyrA for reporting this problem on sf.
net)
- the OpenSSL library was updated to openssl-1.0.1g
- geoip_c.h was updated with GeoIPCountryWhois.csv released on April 2nd; there
are 93477 IP ranges having 102 ranges in the fake "A1" country; 98 ranges were a
pproximated to real countries
2013-12-10 Advanced Onion Router 0.3.0.19a
- corrected: possible buffer overflow when setting a huge OS version string
- corrected: when changing the default OS version, a buffer that was not allocat
ed with tor_malloc() was freed with tor_free() (thanks to anonymous for reportin
g this problem on sf.net)
- corrected: a generated AS path included some extra nodes that were before the
selected path in the AS tree from geoip_as.h
- the program that imports AS path definitions and generates the geoip_as.h file
is now included in the source code archive (as2asm)
- the AS path tree was updated with latest AS path definitions from cidr-report.
org; a few errors were corrected in the AS tree import algorithm
- geoip_c.h was updated with GeoIPCountryWhois.csv released on December 5th; the
re are 84715 IP ranges having 114 ranges in the fake "A1" country; 110 ranges we
re approximated to real countries
- updated language strings: 1248
2013-11-30 Advanced Onion Router 0.3.0.19
- corrected: possible buffer overflow when deleting Flash player's history from
a truncated .sol file (thanks to anonymous for reporting this problem on sf.net)
- corrected: when updating address maps using the "Associate addresses" dialog,
the displayed exit node was changed to "new exit"
- corrected: the number of downloaded bytes was not shown by the Blacklist plugi
n unless a language file was loaded
- corrected: when an application sent a Socks5 connection request followed by an
HTTP request without waiting for connection status for the Socks5 request, the
Socks5 connection status was prepended to the HTTP reply; this error prevented s
ome programs from using Socks5 with AdvOR, like the Tor Browser Bundle from torp
roject.org (thanks to anonymous for reporting this error on sf.net)
- corrected: the circuit build dialog could had been used to build a circuit wit
h no nodes (thanks to anonymous for reporting this problem on sf.net)
- updates from the "Associate addresses" dialog are scheduled instead of updatin
g address maps while the user changes them (thanks to anonymous for reporting th
is problem on sf.net)
- the function escaped() was replaced by esc_for_log() to solve some possible no
n-reentrancy problems and memory leaks caused by it
- added instructions for using the Dooble browser with AdvOR, a sample configura
tion file and a patch that prevents it from downloading scripts from Google to A
dvOR\Help\Dooble (readme.txt, AdvOR.ini and patch-dooble.*).
- the Blacklist plugin now has an URL for the "Primary threats" blacklist from i
blocklist.com (it can be selected from the URL history combo box)
- updated libraries: libevent-2.0.21-stable, openssl-1.0.1e, zlib-1.2.8, libntlm
-1.4
- geoip_c.h was updated with GeoIPCountryWhois.csv released on November 5th; the
re are 86068 IP ranges having 102 ranges in the fake "A1" country; 102 ranges we
re approximated to real countries
2013-04-23 Advanced Onion Router 0.3.0.18b
- corrected: the variable IdentityAutoChange was initialized with a wrong value
(thanks to anonymous for reporting this error on sf.net)
- corrected: a duplicate variable name "iplist" (a pointer in dlg_bypassbl.c and
an array in routerlist.c) caused a pointer to be overwritten with the first IP
address that was shown in the "Select IP" system tray menu (thanks to anonymous
for reporting this error on sf.net)
- corrected: when updating some settings from the "Private identity" page with n
ew language strings, a program restart was needed
- new option on the "Bypass Tor blacklists" page: "Save node statistics to exclu
de nodes that were restarted and have the same IP"; the list of IPs of exit node
s can be saved to a file to better estimate their longevity at a later time, for
detecting new nodes with a better accuracy (ExitSeenFlags)
- new option on the "Bypass Tor blacklists" page: "Assume blacklists remove IPs
that were not seen for [time_interval]"; IPs of nodes that were no longer seen f
or a long period of time can be automatically removed from AdvOR-iplist.dat to a
llow re-using IPs with websites that use blacklists that remove old entries (Exi
tMaxSeen)
- the "Hidden services" configuration page now has checkboxes near all configure
d hidden services to allow enabling/disabling them during AdvOR runtime (request
ed by anonymous on sf.net); all checkboxes are enabled by default and their stat
e is not saved to AdvOR.ini
- updated language strings: 3260, 3261
- corrected: possible buffer overflow in GetConnInfo() (thanks to anonymous for
reporting this error on sf.net)
- the procedure initmemunits() was moved from dlg_connections.c to dlg_util.c
- new configuration option: IdentityAutoChange
- new option on the "Private identity" page: "Show a completion MessageBox"; thi
s option can be used to disable the message box shown when the identity is chang
ed (IdentityFlags)
- new option on the "Private identity" page: "Every [time_interval] change my IP
|identity"; this option can be used to automatically change the exit IP or the i
dentity at a specified time interval (IdentityFlags, IdentityAutoChange); when t
his option is enabled, next IP is selected according to the configured exit sele
ction algorithm (details in the help file)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on April 2nd; there
are 169256 IP ranges having 455 ranges in the fake "A1" country; 451 ranges were
approximated to real countries
- updated language strings: 3247, 3248, 3249, 3250, 3251, 3252, 3253, 3254, 3255
, 3256, 3257, 3258, 3259
2013-03-20 Advanced Onion Router 0.3.0.16c
- corrected: if server mode was disabled while AdvOR was in hibernation mode, wh
en reconnecting to the OR network the server identity key remained set while ser
ver mode was disabled, triggering an assert in get_server_identity_key() (thanks
to anonymous for reporting this problem on sf.net)
- corrected: when changing server mode settings, dns_launch_correctness_checks()
could had been called before configuring the name servers (thanks to anonymous
for reporting this problem on sf.net)
- corrected: the "Hidden Services" page was initialized with the resource identi
fier of another page (thanks to anonymous for reporting this problem on sf.net)
- the AdvOR.ini sample for Firefox was updated to work with the latest "Tor Brow
ser" package from torproject.org
- corrected: the list with directory authorities was initialized with values fro
m a read-only location (thanks to anonymous for reporting this error on sf.net)
- corrected: address map association updates required a program restart (thanks
to anonymous for reporting this problem on sf.net)
- corrected: when re-connecting to the OR network, listeners were sometimes dela
yed, causing ports to stay closed for up to 60 seconds
- corrected: the procedures that disconnect AdvOR from the OR network are now sc
heduled (thanks to anonymous for reporting this problem on sf.net)
- the procedures related to the "Associated addresses" page were moved to a sepa
rate file, dlg_addrmaps.c
- added the option to use browser's original User-Agent string; the option is av
ailable on the "HTTP headers" page as "Don't anonymize browser type" (requested
by anonymous on sf.net)
- new option on the exit selection dialog: "Use only recent exits that are proba
bly not blacklisted yet" (requested by anonymous on sf.net); this option sets a
filter for recent nodes that are not in blacklists that were not updated recentl
y
- new page: "Bypass Tor blacklists" with options related to bypassing bans on we
bsites that use blacklists to ban Tor and other proxies (dlg_bypassbl.c)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on March 3rd; there
are 179875 IP ranges having 375 ranges in the fake "A1" country; 372 ranges were
approximated to real countries
, 3244, 3245, 3246
- corrected: if no hibernation interval is set, hibernation state is no longer c
hanged (thanks to anonymous for reporting this error on sf.net)
- corrected: init_keys() could had been called twice, when the OR port number wa
s changed (thanks to anonymous for reporting this error on sf.net)
- corrected: fast hibernation state changes could had caused the main thread to
be created twice (thanks to anonymous for reporting this error on sf.net)
- corrected a memory leak in parse_request_headers()
- corrected an infinite loop that could had been caused by using "--select-exit"
without specifying an exit node
- when updating the OR network, a failure to update the circuit tree due to insu
fficient system resources will cause a warning message to be shown, recommending
a system restart (thanks to anonymous for reporting this problem on sf.net; lan
guage string: 3234)
- the host banlist is now also checked when parsing HTTP headers to prevent a ba
nned host from being used in an HTTP request sent to a server that is not banned
- the welcome message now displays 2 available download locations for AdvOR, Sou
rceForge and SoftPedia (language string: 1248)
- new command line parameter: "--exec" that can be used to execute and intercept
at startup a program that was not added to the "Quick Start" list; if another i
nstance of AdvOR is already started from the same location, this parameter is pa
ssed to that instance (language string: 46)
- the license for the Csv2Asm program was changed from *unspecified* to Creative
Commons NonCommercial
- geoip_c.h was updated with GeoIPCountryWhois.csv released on December 4th; the
re are 105985 IP ranges having 369 ranges in the fake "A1" country; 367 ranges w
ere approximated to real countries
- updated language strings: 46, 1248, 3234
- corrected: when changing server descriptor types, AdvOR could try to free a bu
ffer that was already freed (thanks to anonymous for reporting this error on sf.
net)
- the csv2asm program now approximates GeoIP's "A1" fake country to a neighborin
g IP range's country that has the same AS path as the blacklisted IP range
- the "A1" country that has IP ranges blacklisted by MaxMind is shown using the
approximated country followed by an asterisk in node selection dialogs and in th
e "OR network" dialog
- country bans and the restriction to build circuits with IPs from different cou
ntries are verified using the approximated country instead of GeoIP's fake "A1"
country (this solves a security problem where a circuit like US-DE-A1 where A1=U
S could had been built)
- router selection dialogs no longer display "Anonymous Proxy" as a valid countr
y
- new option on the "Banned routers" page: "Do not use exits that were blacklist
ed by MaxMind's GeoIP" that can be enabled when country restrictions enforced by
some websites can't be bypassed because the website is using a GeoIP having bla
cklisted IP ranges
- geoip_c.h was updated with GeoIPCountryWhois.csv released on November 7th; the
re are 105478 IP ranges having 368 ranges in the fake "A1" country; 366 ranges w
ere approximated to real countries
- corrected: when remapping an address, if a plugin exported AdvTor_TranslateAdd
ress(), the new_address part of an addressmap_entry_t structure was freed withou
t undating it with the new remapped address; this error caused random crashes wh
en a plugin that exported AdvTor_TranslateAddress() (like the Blacklist plugin)
was loaded (thanks to anonymous for reporting this error on sf.net)
- the value for the source code file name pointer is written to AdvOR-crash.txt
instead of the file name pointed by it
- AdvOR.dll increases the reference count for WS2_32.dll to prevent an intercept
ed application from unloading it
- if more plugins export TranslateAddress and have the right to translate addres
ses, the address that was remapped by plugins is rewritten only once, after all
event handlers are called
- AdvOR no longer formats useless controller messages if no controller is connec
ted
- updated libraries: libevent-2.0.20-stable, openssl-1.0.1c
- geoip_c.h was updated with GeoIPCountryWhois.csv released on October 30th
- corrected: buffer overflow in dir_split_resource_into_fingerprints() (thanks t
o anonymous for reporting this error on sf.net)
- corrected: when the entry "No exit" was selected, AdvOR tried to use a country
from GeoIP when changing the identity
- added extra memory checks in addressmap_ent_free() and in aes_free_cipher() to
get better error reports for 2 bugs reported on sf.net forums
- corrected: the function start_of_month() was not updated to use tor_timegm() w
ith its new syntax (thanks to anonymous for reporting this error on sf.net)
- corrected: the original address of a socks request was not always set for requ
ests made by intercepted programs that were also configured to use AdvOR as a pr
oxy
- [tor-0.2.2.39] Fix an assertion failure in tor_timegm() that could be triggere
d by a badly formatted directory object. Bug found by fuzzing with Radamsa. Fixe
s bug 6811; bugfix on 0.2.0.20-rc.
- [tor-0.2.2.39] Do not crash when comparing an address with port value 0 to an
address policy. This bug could have been used to cause a remote assertion failur
e by or against directory authorities, or to allow some applications to crash cl
ients. Fixes bug 6690; bugfix on 0.2.1.10-alpha.
- corrected: buffer overflow when showing intercepted processes in the system tr
ay menus
- corrected: a huge list of command line parameters for an intercepted process c
ould had caused a buffer overflow in AdvOR.dll
- address map registrations are now scheduled when they are changed from the "As
sociate addresses" page
- new configuration option: SocksAuthenticator
- new option on the "Proxy" page: "User:password" (SocksAuthenticator) that allo
ws restricting the access to the local proxy with an username:password combinati
on (all proxy protocols are supported)
- if a prefix is entered for the .onion address when registering a new hidden se
rvice, an address name generator will try to find an address that starts with th
at prefix; the address generator shows a progress and it can be stopped anytime
- geoip_c.h was updated with GeoIPCountryWhois.csv released on October 2nd
, 3230, 3231
- corrected: when clearing temporary address maps, the same buffer could had bee
n freed twice from different threads (thanks to anonymous for reporting this err
or on sf.net)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on September 5th
- updated language strings: 2915 (typo reported by anonymous on sf.net)
- [tor-0.2.2.38] Avoid read-from-freed-memory and double-free bugs that could oc
cur when a DNS request fails while launching it. Fixes bug 6480; bugfix on 0.2.0
.1-alpha.
- [tor-0.2.2.38] Avoid an uninitialized memory read when reading a vote or conse
nsus document that has an unrecognized flavor name. This read could lead to a re
mote crash bug. Fixes bug 6530; bugfix on 0.2.2.6-alpha.
- [tor-0.2.2.38] Try to leak less information about what relays a client is choo
sing to a side-channel attacker. Previously, a Tor client would stop iterating t
hrough the list of available relays as soon as it had chosen one, thus finishing
a little earlier when it picked a router earlier in the list. If an attacker ca
n recover this timing information (nontrivial but not proven to be impossible),
they could learn some coarse-grained information about which relays a client was
picking (middle nodes in particular are likelier to be affected than exits). Th
e timing attack might be mitigated by other factors (see bug 6537 for some discu
ssion), but it's best not to take chances. Fixes bug 6537; bugfix on 0.0.8rc1.
- new hot keys: "Hide all intercepted applications" and "Un-hide and resume hidd
en applications" (they are mutually exclusive: when one is pressed, it is unregi
stered and the other is registered)
- new configuration options: HotkeyHideAll (default is `, disabled), HotkeyResto
reAll (default is Win+Ctrl+7, disabled)
- new options on the "System" page: "Hide all intercepted applications" (HotkeyH
ideAll), "Pause hidden applications" (HotkeyHideAll) and "Un-hide and resume hid
den applications" (HotkeyRestoreAll)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on August 8th
, 3220, 3221
- [tor-0.2.2.37] Work around a bug in OpenSSL that broke renegotiation with TLS
1.1 and TLS 1.2. Without this workaround, all attempts to speak the v2 Tor conne
ction protocol when both sides were using OpenSSL 1.0.1 would fail. Resolves tic
ket 6033.
- [tor-0.2.2.37] When waiting for a client to renegotiate, don't allow it to add
any bytes to the input buffer. This fixes a potential DoS issue. Fixes bugs 593
4 and 6007; bugfix on 0.2.0.20-rc.
- [tor-0.2.2.37] Fix an edge case where if we fetch or publish a hidden service
descriptor, we might build a 4-hop circuit and then use that circuit for exiting
afterwards -- even if the new last hop doesn't obey our ExitNodes config option
. Fixes bug 5283; bugfix on 0.2.0.10-alpha.
- [tor-0.2.2.37] Fix a build warning with Clang 3.1 related to our use of vaspri
ntf. Fixes bug 5969. Bugfix on 0.2.2.11-alpha.
- [tor-0.2.2.37] Tell GCC and Clang to check for any errors in format strings pa
ssed to the tor_v*(print|scan)f functions.
- corrected: circuit_is_acceptable() could had returned a circuit with a wrong p
urpose (thanks to anonymous for reporting this error on sf.net)
- corrected: a circuit with a high priority could had been returned even when it
had a wrong purpose (thanks to anonymous for reporting this error on sf.net)
- [tor-0.2.2.36] Change IP address for maatuska (v3 directory authority).
- [tor-0.2.2.36] Change IP address for ides (v3 directory authority), and rename
it to turtles.
- [tor-0.2.2.36] When building or running with any version of OpenSSL earlier th
an 0.9.8s or 1.0.0f, disable SSLv3 support. These OpenSSL versions have a bug (C
VE-2011-4576) in which their block cipher padding includes uninitialized data, p
otentially leaking sensitive information to any peer with whom they make a SSLv3
connection. Tor does not use SSL v3 by default, but a hostile client or server
could force an SSLv3 connection in order to gain information that they shouldn't
have been able to get. The best solution here is to upgrade to OpenSSL 0.9.8s o
r 1.0.0f (or later). But when building or running with a non-upgraded OpenSSL, w
e disable SSLv3 entirely to make sure that the bug can't happen.
- [tor-0.2.2.36] Never use a bridge or a controller-supplied node as an exit, ev
en if its exit policy allows it. Found by wanoskarnet. Fixes bug 5342. Bugfix on
0.1.1.15-rc (for controller-purpose descriptors) and 0.2.0.3-alpha (for bridge-
purpose descriptors).
- [tor-0.2.2.36] Only build circuits if we have a sufficient threshold of the to
tal descriptors that are marked in the consensus with the "Exit" flag. This miti
gates an attack proposed by wanoskarnet, in which all of a client's bridges coll
ude to restrict the exit nodes that the client knows about. Fixes bug 5343.
- [tor-0.2.2.36] Provide controllers with a safer way to implement the cookie au
thentication mechanism. With the old method, if another locally running program
could convince a controller that it was the Tor process, then that program could
trick the contoller into telling it the contents of an arbitrary 32-byte file.
The new "SAFECOOKIE" authentication method uses a challenge-response approach to
prevent this attack. Fixes bug 5185; implements proposal 193.
- [tor-0.2.2.36] Avoid logging uninitialized data when unable to decode a hidden
service descriptor cookie. Fixes bug 5647; bugfix on 0.2.1.5-alpha.
- [tor-0.2.2.36] Avoid a client-side assertion failure when receiving an INTRODU
CE2 cell on a general purpose circuit. Fixes bug 5644; bugfix on 0.2.1.6-alpha.
- [tor-0.2.2.36] Fix the SOCKET_OK test that we use to tell when socket creation
fails so that it works on Win64. Fixes part of bug 4533; bugfix on 0.2.2.29-bet
a. Bug found by wanoskarnet.
- [tor-0.2.2.36] Reject out-of-range times like 23:59:61 in parse_rfc1123_time()
. Fixes bug 5346; bugfix on 0.0.8pre3.
- [tor-0.2.2.36] Make our number-parsing functions always treat too-large values
as an error, even when those values exceed the width of the underlying type. Pr
eviously, if the caller provided these functions with minima or maxima set to th
e extreme values of the underlying integer type, these functions would return th
ose values on overflow rather than treating overflow as an error. Fixes part of
bug 5786; bugfix on 0.0.9.
- [tor-0.2.2.36] Correct parsing of certain date types in parse_http_time(). Wit
hout this patch, If-Modified-Since would behave incorrectly. Fixes bug 5346; bug
fix on 0.2.0.2-alpha. Patch from Esteban Manchado Velazques.
- [tor-0.2.2.36] Change the BridgePassword feature (part of the "bridge communit
y" design, which is not yet implemented) to use a time-independent comparison. T
he old behavior might have allowed an adversary to use timing to guess the Bridg
ePassword value. Fixes bug 5543; bugfix on 0.2.0.14-alpha.
- [tor-0.2.2.36] Detect and reject certain misformed escape sequences in configu
ration values. Previously, these values would cause us to crash if received in a
torrc file or over an authenticated control port. Bug found by Esteban Manchado
Velazquez, and independently by Robert Connolly from Matta Consulting who furth
er noted that it allows a post-authentication heap overflow. Patch by Alexander
Schrijver. Fixes bugs 5090 and 5402 (CVE 2012-1668); bugfix on 0.2.0.16-alpha.
- [tor-0.2.2.36] When sending an HTTP/1.1 proxy request, include a Host header.
Fixes bug 5593; bugfix on 0.2.2.1-alpha.
- [tor-0.2.2.36] Fix a NULL-pointer dereference on a badly formed SETCIRCUITPURP
OSE command. Found by mikeyc. Fixes bug 5796; bugfix on 0.2.2.9-alpha.
- [tor-0.2.2.36] If we hit the error case where routerlist_insert() replaces an
existing (old) server descriptor, make sure to remove that server descriptor fro
m the old_routers list. Fix related to bug 1776. Bugfix on 0.2.2.18-alpha.
- [tor-0.2.2.36] Directory authorities now reject versions of Tor older than 0.2
.1.30, and Tor versions between 0.2.2.1-alpha and 0.2.2.20-alpha inclusive. Thes
e versions accounted for only a small fraction of the Tor network, and have nume
rous known security issues. Resolves issue 4788.
- [tor-0.2.2.36] Feature removal: When sending or relaying a RELAY_EARLY cell, w
e used to convert it to a RELAY cell if the connection was using the v1 link pro
tocol. This was a workaround for older versions of Tor, which didn't handle RELA
Y_EARLY cells properly. Now that all supported versions can handle RELAY_EARLY c
ells, and now that we're enforcing the "no RELAY_EXTEND commands except in RELAY
_EARLY cells" rule, remove this workaround. Addresses bug 4786.
- geoip_c.h was updated with GeoIPCountryWhois.csv released on June 6th
- updated language strings: 3085, 3086, 3205, 3206, 3207, 3208
- corrected: tor_malloc() and tor_free() now require ownership of a critical sec
tion object (they are mutually exclusive; thanks to anonymous for reporting this
problem on sf.net)
- corrected: certain cookie lenghts could had caused the parser to enter an infi
nite loop (thanks to anonymous for reporting this error on sf.net)
- corrected: APPEND_STRING() used a maximum buffer size lower than MAX_HTTP_HEAD
ERS causing some User-Agent strings to be filtered out if the total size of the
adjusted headers exceeded 1024 bytes
- corrected: buffer size was not adjusted when appending accepted encodings (tha
nks to anonymous for reporting this error on sf.net)
- the crash notification message box shows application name and version (request
ed by Adem0x on sf.net)
- if AdvOR is started from a read-only location or file creation fails when writ
ing a crash report, a file save dialog will ask for another location for AdvOR-c
rash.txt (requested by Adem0x on sf.net)
- to ease error reporting, the crash report will only have information about ove
rwritten sentinels instead of having information about all allocated memory
- corrected: the buffer allocated for socks requests was not initialized when ca
lling AdvOR.dll (thanks to anonymous for reporting this error on sf.net)
- corrected: a wrong timestamp verification prevented new introduction circuits
from being built when accessing hidden services
- corrected: when calculating circuit build times, time() was used instead of ge
t_time()
- address lengths in proxy requests are no longer limited to 256 bytes
- the list with directory authorities is no longer limited to 65536 bytes
- the list with banned hosts is no longer limited to 65536 bytes
- address policies are stored as a hash table instead of keeping the hash table
separately
- all memory allocations are handled by tor_malloc() and tor_free() which checks
for buffer overflows when freeing allocated memory
- all assertion failures are handled by tor_assert() which allows a crash report
to be saved
- the exception handler can also save a list with all buffers allocated by tor_m
alloc()
2012-05-07 Advanced Onion Router 0.3.0.7g
- updated libraries: libevent-2.0.19-stable, openssl-1.0.1b
- geoip_c.h was updated with GeoIPCountryWhois.csv released on May 1st
2012-04-29 Advanced Onion Router 0.3.0.7f
- chunk sizes and content lengths are now 64-bit; AdvOR now supports downloading
/uploading files larger than 2 GB
- added more verifications for negative chunk sizes and content lengths
2012-04-29 Advanced Onion Router 0.3.0.7e
- corrected: integer overflow when parsing an invalid chunk size in server data
(thanks to connor011 for reporting this error)
2012-04-28 Advanced Onion Router 0.3.0.7d
- corrected: integer overflow when parsing an invalid chunk size received from c
lient (thanks to connor011 for reporting this error)
- corrected: possible buffer overflow when writing cookies
- if StackWalk64() is available, it will be used instead of StackWalk() when sav
ing crash reports
- added an exception handler that can save a full stack backtrace to help report
ing crashes (seh.c)
- new command line parameter: --no-seh which disables the built-in exception han
dler
- geoip_c.h was updated with GeoIPCountryWhois.csv released on April 3rd
- corrected: timeradd() and timersub() used wrong operands for updating microsec
onds (bugfix for AdvOR and Tor, all versions)
- corrected: buffer overflow when loading language files for plugins (thanks to
Re4 for reporting this error and for sharing test language files that helped rep
roducing this error)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on February 2nd
- corrected a change from version 0.3.0.6 in tor_addr_port_parse() that caused i
t to return errors when parsing proxy IP addresses (thanks to anonymous11 for re
porting this error)
- improved the search algorithm for addresses that are added to the context menu
s related to strings selected in the "Debug" window
- all router selection dialogs will show bandwidth capacities instead of bandwid
th rates for routers that are not banned
- the lists with favorite routers and with banned routers are no longer limited
to 65536 characters
- added instructions for using TorChat with AdvOR and configuration samples to A
dvOR\Help\TorChat (readme.txt, AdvOR.ini and torrc.txt).
- [tor-0.2.2.35] (this change was not applied because AdvOR already had a better
fix since 0.3.0.4b) Fix a heap overflow bug that could occur when trying to pul
l data into the first chunk of a buffer, when that chunk had already had some da
ta drained from it. Fixes CVE-2011-2778; bugfix on 0.2.0.16-alpha. Reported by "
Vektor".
- [tor-0.2.2.35] Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enable
d, so that it doesn't attempt to allocate a socketpair. This could cause some pr
oblems on Windows systems with overzealous firewalls. Fix for bug 4457; workarou
nd for Libevent versions 2.0.1-alpha through 2.0.15-stable.
- [tor-0.2.2.35] If we mark an OR connection for close based on a cell we proces
s, don't process any further cells on it. We already avoid further reads on mark
ed-for-close connections, but now we also discard the cells we'd already read. F
ixes bug 4299; bugfix on 0.2.0.10-alpha, which was the first version where we mi
ght mark a connection for close based on processing a cell on it.
- [tor-0.2.2.35] Correctly sanity-check that we don't underflow on a memory allo
cation (and then assert) for hidden service introduction point decryption. Bug d
iscovered by Dan Rosenberg. Fixes bug 4410; bugfix on 0.2.1.5-alpha.
- [tor-0.2.2.35] Fix a memory leak when we check whether a hidden service descri
ptor has any usable introduction points left. Fixes bug 4424. Bugfix on 0.2.2.25
-alpha.
- [tor-0.2.2.35] Detect failure to initialize Libevent. This fix provides better
detection for future instances of bug 4457.
- [tor-0.2.2.35] Avoid frequent calls to the fairly expensive cull_wedged_cpuwor
kers function. This was eating up hideously large amounts of time on some busy s
ervers. Fixes bug 4518; bugfix on 0.0.9.8.
- [tor-0.2.2.35] Resolve an integer overflow bug in smartlist_ensure_capacity().
Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by Mansour Moufid.
- [tor-0.2.2.35] When configuring, starting, or stopping an NT service, stop imm
ediately after the service configuration attempt has succeeded or failed. Fixes
bug 3963; bugfix on 0.2.0.7-alpha.
- [tor-0.2.2.35] When sending a NETINFO cell, include the original address recei
ved for the other side, not its canonical address. Found by "troll_un"; fixes bu
g 4349; bugfix on 0.2.0.10-alpha.
- [tor-0.2.2.35] Fix a memory leak in launch_direct_bridge_descriptor_fetch() th
at occurred when a client tried to fetch a descriptor for a bridge in ExcludeNod
es. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
- [tor-0.2.2.35] If we had ever tried to call tor_addr_to_str on an address of u
nknown type, we would have done a strdup on an uninitialized buffer. Now we won'
t. Fixes bug 4529; bugfix on 0.2.1.3-alpha. Reported by "troll_un".
- [tor-0.2.2.35] Correctly detect and handle transient lookup failures from tor_
addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha. Reported by "troll_un".
- [tor-0.2.2.35] Fix null-pointer access that could occur if TLS allocation fail
ed. Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
- [tor-0.2.2.35] Use tor_socket_t type for listener argument to accept(). Fixes
bug 4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
- [tor-0.2.2.35] Add two new config options for directory authorities: AuthDirFa
stGuarantee sets a bandwidth threshold for guaranteeing the Fast flag, and AuthD
irGuardBWGuarantee sets a bandwidth threshold that is always sufficient to satis
fy the bandwidth requirement for the Guard flag. Now it will be easier for resea
rchers to simulate Tor networks with different values. Resolves ticket 4484.
- corrected: the OR port was set while initializing keys (thanks to DavidWakelin
for reporting this error)
- corrected: when the option to reject .exitname.exit hostnames was enabled, add
resses that were mapped to exit nodes were also rejected (thanks to DavidWakelin
for reporting this problem)
- when the circuit path length is set to 1, the option "Do not use the public ke
y step for the entry node" will be disabled
- new configuration options: CorporateProxy, CorporateProxyDomain, CorporateProx
yAuthenticator and CorporateProxyProtocol (supported protocols: NTLM)
- added support for NTLM proxies (libntlm 1.3)
- new options on the "Bypass ISP filtering" page: "Always use this NTLM proxy" (
CorporateProxy, CorporateProxyProtocol), "workstation@domain" (CorporateProxyDom
ain), "Account (username:password)" (CorporateProxyAuthenticator)
- the NTLM proxy can be chained with ORProxy and/or DirProxy if needed; when ena
bled, the NTLM proxy is always the first proxy of a proxy chain
, 3200
- corrected: buffer overflow when repacking the first chunk of a buf_t buffer (b
ugfix for AdvOR and Tor, all versions)
- corrected: error when reading from client connections (thanks to Rex for repor
ting this error)
- the option "Allow invalid certification authorities from certificates for brid
ges.torproject.org" was removed; on error, a message box will ask if the downloa
d should be retried ignoring unrecognized CA's
- the options TunnelDirConns (BOOL) and PreferTunneledDirConns (BOOL) were merge
d as TunnelDirConns (UINT)
- all procedures that handle proxy requests for OR and directory connections wer
e moved to connection_proxy.c
- the options HttpsProxy, HttpsProxyAuthenticator, Socks4Proxy, Socks5Proxy, Soc
ks5ProxyUsername and Socks5ProxyPassword were merged as ORProxy, ORProxyAuthenti
cator and ORProxyProtocol (supported protocols: HTTPS, Socks4 and Socks5)
- added support for HTTPS, Socks4 and Socks5 proxies for HTTP directory connecti
ons
- the options HttpProxy and HttpProxyAuthenticator were replaced with DirProxy,
DirProxyAuthenticator and DirProxyProtocol (supported protocols: HTTP, HTTPS, So
cks4 and Socks5)
- updated language strings: 656, 2540, 2541, 2542, 2875, 2991, 2992, 2993, 2994,
2995, 2996, 2998, 3031, 3190
- the instructions for making a "Tor browser" with Firefox and the AdvOR.ini sam
ple for Firefox were updated to work with the latest "Tor Browser" package from
torproject.org (tor-browser-2.2.34-3_en-US.exe)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on December 7th
- corrected: when a duplicate router was found the plugins were notified with a
structure that was already freed (thanks to Neo for reporting this error)
- corrected: error loading hidden service keys (thanks to DeepAnger for reportin
g this error)
- corrected: when the options to reject hosts ending with ".exitname.exit" or ".
onion" were enabled, the suffix was searched from a wrong position
- corrected: hidden services are no longer added twice for versions 0 and 2 (sup
port for version 0 was removed from tor-0.2.2.34); HiddenServiceVersion was remo
ved
- new options on the "Connections" page: "Bandwidth rate per connection" (PerCon
nBWRate) and "Bandwidth burst per connection" (PerConnBWBurst)
- new options on the "Circuit build" page: "Learn circuit build timeout" (LearnC
ircuitBuildTimeout), "Stream timeout until trying a new circuit (seconds)" (Circ
uitStreamTimeout) and "Cell scale factor" (CircuitPriorityHalflife)
- new option on the "Become a server" page: "Refuse exit streams from unknown re
lays" (RefuseUnknownExits)
- new option on the "Private identity" page: "Reinitialize the global SSL contex
t" (IdentityFlags&IDENTITY_FLAG_REINIT_KEYS, default value: IDENTITY_FLAG_REINIT
_KEYS)
- the options AllowDotExit, HTTPFlags&HTTP_SETTING_REJECT_EXITNAME and HTTPFlags
&HTTP_SETTING_REJECT_ONION were merged as AllowTorHosts (default value: ALLOW_DO
T_ONION)
- the options "Reject requests for *.exitname.exit URL's" and "Reject requests f
or *.onion URL's" were moved from the "HTTP headers" page to the "Banned address
es" page
, 3189
- corrected: when entering hibernation, directory connections were not closed
- only routers that are not considered bad exits are added to the system tray me
nus unless they are added to favorites
- routers that are marked as invalid/not running/fake will have their bandwidth
rate prefixed by a question mark in the exit selection dialog
- a value of 0 for circuit build timeout / expiration time will cause the circui
t to never expire
- when downloading the network-status consensus, a failure to download from a di
rectory server will cause a new download attempt from another directory server i
mmediately if bootstrap_status is less than 80
- all files were updated with changes from tor-0.2.2.34 relative to tor-0.2.1.30
; all changes were corrected to remove goto's and some bugs were fixed; all file
I/O operations were modified to support UNICODE paths; latest versions of Tor c
onsider excluded nodes a banlist if "StrictNodes" is set - however, AdvOR alread
y considered excluded nodes a "strict" banlist since 0.1.0.x, so "StrictNodes" i
s used only for favorites
- [tor-0.2.2.34] new configuration options: AllowDotExit, CellStatistics, LearnC
ircuitBuildTimeout, CircuitStreamTimeout, CircuitPriorityHalflife, ClientRejectI
nternalAddresses, ConsensusParams, ControlPortFileGroupReadable, ControlPortWrit
eToFile, ControlSocketsGroupWritable, DirReqStatistics, DisableAllSwap, EntrySta
tistics, ExitPortStatistics, ExtraInfoStatistics, FetchDirInfoExtraEarly, FetchV
2Networkstatus, GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays, Socks4Proxy, Soc
ks5Proxy, Socks5ProxyUsername, Socks5ProxyPassword, PerConnBWBurst, PerConnBWRat
e, RefuseUnknownExits, V3BandwidthsFile, __OwningControllerProcess, VoteOnHidSer
vDirectoriesV2, _UsingTestNetworkDefaults, MinUptimeHidServDirectoryV2, Accounti
ngSecondsToReachSoftLimit, AccountingSoftLimitHitAt, AccountingBytesAtSoftLimit
- [tor-0.2.2.34] new state settings: BWHistoryReadMaxima, BWHistoryWriteMaxima,
BWHistoryDirReadEnds, BWHistoryDirReadInterval, BWHistoryDirReadValues, BWHistor
yDirReadMaxima, BWHistoryDirWriteEnds, BWHistoryDirWriteInterval, BWHistoryDirWr
iteValues, BWHistoryDirWriteMaxima, TotalBuildTimes, CircuitBuildAbandonedCount,
CircuitBuildTimeBin, BuildtimeHistogram
- [tor-0.2.2.34] configuration options that were removed: DirRecordUsageByCountr
y, DirRecordUsageGranularity, DirRecordUsageRetainIPs, DirRecordUsageSaveInterva
l, HSAuthorityRecordStats, RunTesting
- [tor-0.2.2.34] the limits for HttpProxyAuthenticator and HttpsProxyAuthenticat
or were changed from 48 characters to 512 characters
- updated libraries: libevent-2.0.16-stable, openssl-1.0.0e
- geoip_c.h was updated with GeoIPCountryWhois.csv released on November 1st
- updated language strings: 190, 191, 192, 230, 256, 270, 503, 504, 507, 608, 61
5, 616, 617, 618, 619, 620, 637, 639, 705, 1003, 1058, 1172, 1188, 1203, 1238, 1
239, 1240, 1300, 1310, 1658, 1807, 1994, 2931, 2932, 2933, 2934, 2935, 2936, 293
7, 2938, 2939, 2940, 2941, 2942, 2943, 2944, 2945, 2946, 2947, 2948, 2949, 2950,
2951, 2952, 2953, 2954, 2955, 2956, 2957, 2958, 2959, 2960, 2961, 2962, 2963, 2
964, 2965, 2966, 2967, 2968, 2969, 2970, 2971, 2972, 2973, 2974, 2975, 2976, 297
7, 2978, 2979, 2980, 2981, 2982, 2983, 2984, 2985, 2986, 2987, 2988, 2989, 2990,
2991, 2992, 2993, 2994, 2995, 2996, 2997, 2998, 2999, 3000, 3001, 3002, 3003, 3
004, 3005, 3006, 3007, 3008, 3009, 3010, 3011, 3012, 3013, 3014, 3015, 3016, 301
7, 3018, 3019, 3020, 3021, 3022, 3023, 3024, 3025, 3026, 3027, 3028, 3029, 3030,
3031, 3032, 3033, 3034, 3035, 3036, 3037, 3038, 3039, 3040, 3041, 3042, 3043, 3
044, 3045, 3046, 3047, 3048, 3049, 3050, 3051, 3052, 3053, 3054, 3055, 3056, 305
7, 3058, 3059, 3060, 3061, 3062, 3063, 3064, 3065, 3066, 3067, 3068, 3069, 3070,
3071, 3072, 3073, 3074, 3075, 3076, 3077, 3078, 3079, 3080, 3081, 3082, 3083, 3
084, 3085, 3086, 3087, 3088, 3089, 3090, 3091, 3092, 3093, 3094, 3095, 3096, 309
7, 3098, 3099, 3100, 3101, 3102, 3103, 3104, 3105, 3106, 3107, 3108, 3109, 3110,
3111, 3112, 3113, 3114, 3115, 3116, 3117, 3118, 3119, 3120, 3121, 3122, 3123, 3
124, 3125, 3126, 3127, 3128, 3129, 3130, 3131, 3132, 3133, 3134, 3135, 3136, 313
7, 3138, 3139, 3140, 3141, 3142, 3143, 3144, 3145, 3146, 3147, 3148, 3149, 3150,
3151, 3152, 3153, 3154, 3155, 3156, 3157, 3158, 3159, 3160, 3161, 3162, 3163, 3
164, 3165, 3166, 3167, 3168, 3169, 3170, 3171, 3172, 3173, 3174, 3175, 3176, 317
7, 3178, 3179, 3180
2011-08-08 Advanced Onion Router 0.3.0.1e
- corrected: a negative status was assigned to an unsigned variable in proxy_han
dle_client_data()
2011-08-05 Advanced Onion Router 0.3.0.1d
- corrected: invalid pointer access if headers with different line terminators w
ere received from a client in one request
- corrected: when a web redirect was sent as a response for a request on a conne
ction that was already associated with a different host the client was expected
to close the connection causing some clients to wait indefinitely for the remote
connection to be closed
- the directory Tor-info was renamed to "Help" and the file tor-manual.html was
removed; all text files related to the OR protocol were moved to Help\Tor
- added a help file with explanations for all GUI settings and commands ("Help\A
dvOR.html", "Help\Img")
- geoip_c.h was updated with GeoIPCountryWhois.csv released on August 4th
- HTTP servers that don't send any information about the length of the message t
hey return for statuses that allow/require an entity to be returned are assumed
to close the connection after sending the response (thanks to DeepAnger for repo
rting this problem)
- corrected: when processing server data, a wrong buffer size could had been ret
urned to _connection_write_to_buf_impl()
- corrected: the capitalization for rewritten uTorrent HTTP headers did not matc
h uTorrent's capitalization
- corrected the resize_info structure for the main dialog to make more room for
child dialogs
- uTorrent is now autodetected and its headers are re-generated as uTorrent head
ers (thanks to DeepAnger for reporting problems with some private trackers)
- added uTorrent version pairs that are used to generate identity-dependent majo
r browser versions when uTorrent is detected
- added: new browser type on the "HTTP headers" page: "Mask a BitTorrent client
as uTorrent" which can be used with BitTorrent clients that are not supported ye
t
- new page: "HTTP headers" with options related to changing HTTP headers and sho
wing HTTP requests and replies with or without full headers (LOG_NOTICE for head
ers, LOG_INFO for full HTTP traffic, original and adjusted)
- setting a public proxy in a client and intercepting it will cause AdvOR to cha
in the OR exit with that proxy (to bypass Tor blacklists)
- if proxy chains are detected, all requests for all proxies are rewritten to ap
ply all configured restrictions for each proxy in a chain
- if Opera Turbo traffic is detected in a proxy chain, Opera's unique identifier
and the screen resolution that are sent to the Opera Turbo servers are replaced
with identity-dependent random values
- added support for keep-alive HTTP connections
- added support for chunked HTTP transfers
- added support for multipart HTTP content types
- added support for identity-dependent fake HTTP headers with custom user-agent,
regional settings, fake extensions, fake OS, etc.; can generate fake headers to
mask a web browser as Chrome, Firefox, Internet Explorer, Opera, Safari, Bing b
ot, Googlebot, Yahoo! bot and Yandex bot
- added options to show original and adjusted HTTP headers in Debug (LOG_INFO fo
r full headers, LOG_NOTICE for requests)
- all HTTP cookies that are received during an identity session are cached; the
cookie cache is cleared when changing identities; all cookies that are not found
in cache are filtered from HTTP requests
- corrected: cookie lines were not always separated by new lines (thanks to Rex
for reporting this error)
- all dialogs that display a message show the message in an edit control with a
vertical scroll bar (requested by TT)
- when an application sends an HTTP request to a connection that is already atta
ched to a circuit for a different host, HTTP status 302 is returned to cause the
application to create a new connection for that request
- corrected: when the option to select a random user-agent using identity seeds
is enabled, the browser type "unknown" is no longer selected (AdvOR 0.3.0.1 test
3)
- added probabilities for all languages from all countries to increase chances o
f national languages being generated more often than languages spoken by minorit
ies
- fake IE extensions are generated using better frequencies taken from more head
er samples
- the generators for fake HTTP headers for Chrome, Firefox, Opera and Safari wer
e improved with more version pairs using HTTP header samples from http://userage
ntstring.com
- the header "X-Requested-With" is no longer removed when the option to remove u
nknown headers is enabled
- new option on the "Private Identity" page: "Disallow cookies used with previou
s identities"; if this option is enabled AdvOR itself will cache all cookies and
expire them when the identity is changed; cookies that are not found in cache a
re removed from all requests
- when the option to show full request headers is enabled, all HTTP traffic, inc
luding POST data, is logged if the log level is greater than "[6] Proxy"
- corrected: some settings from the "HTTP headers" page were not saved to AdvOR.
ini (thanks to Rex for reporting this problem) (AdvOR 0.3.0.1 test 5)
- added restrictions for minimum widths and heights for all child dialogs
- added scroll bars for all child dialogs that are resized to dimensions smaller
than minimum accepted values (requested by TT)
- the Blacklist plugin was updated to add support for scroll bars
- geoip_c.h was updated with GeoIPCountryWhois.csv released on July 5th
, 2905, 2906, 2907, 2908, 2909, 2910, 2911, 2912, 2913, 2914, 2915, 2916, 2917,
2918, 2919, 2920, 2921, 2922, 2923, 2924, 2925, 2926, 2927, 2928, 2929
- corrected: the parameter "--verify-lng" expected a language name instead of a
language file name; now both are accepted (thanks to mamont for reporting this p
roblem)
- corrected: the selection "No exit" was shown as an invalid exit in window titl
e and in the Debug window
- if the option "Always on top" is enabled, popup message boxes are created with
the MB_TOPMOST style
- new functions for plugins: lang_get_string(), lang_change_dialog_strings() and
a new event for plugins: AdvTor_LanguageChange()
- the Blacklist plugin is updated to version 1.02 with multi-language support; a
dded an example language file Blacklist-English.lng
- when hibernation mode is enabled, all connection requests from all intercepted
processes are rejected and logged
- the list with child dialogs was replaced with a tree view
- some options from the "Proxy" page were moved to 2 different new pages: "Banne
d addresses" and "Advanced proxy settings"
- the lists with banned routers and favorite routers were moved to 2 separate pa
ges
- tracked hosts and address maps were moved to a separate page
- new page: "Private identity" with options related to changes that happen when
changing identities
- added an editor for QuickStart menus
- when a process is not allowed to get the real local time, AdvOR.dll also inter
cepts FindFirstFileW and FindNextFileW to adjust file times
- added support for deleting Flash cookies, history, website personalizations an
d cache when changing identities
- added support for deleting cookies saved by Internet Explorer, Chrome, Safari,
Opera and Firefox when changing identities; cookie deletion procedures attempt
to invoke browser API's via remote threads
- geoip_c.h was updated with GeoIPCountryWhois.csv released on June 2nd
- the procedure that downloads bridges from https://bridges.torproject.org was r
ewritten to work with invalid certificates received from https://bridges.torproj
ect.org
- when disabling http/https proxies from the "Authorities" dialog, proxy address
es are no longer removed from configuration (requested by ktwh)
- corrected: the function tor_malloc() was replaced with GlobalAlloc() which is
thread-safe in procedures that convert UTF-8 language strings for GUI items (tha
nks to mamont for reporting this problem)
- new option on the "Bypass ISP filtering" page: "Allow invalid certification au
thorities for bridges.torproject.org" (default is disabled for security reasons;
downloading the list of bridges fails when this option is disabled if Internet
Explorer can't verify the certificate up to a trusted authority - when using Win
Inet functions for IE 6 on Windows XP SP2/3)
- if the language strings 0 and/or 1248 contain links to torproject.org they are
removed because some translations say torproject.org is the official website fo
r AdvOR (complaints were received from torproject.org that some users ask them a
bout AdvTor/AdvOR problems instead of using our forums)
- corrected: buffer overflow in plugin_load_lng() (thanks to mamont for reportin
g this problem)
- corrected: UNICODE language files were not converted to UTF-8
- the resource file was updated to include the option "Allow invalid certificati
on authorities from certificates for bridges.torproject.org"
- updated language strings: 1, 36, 50, 54, 59, 61, 97, 109, 110, 115, 117, 128,
130, 143, 144, 2677, 2799, 2800, 2801, 2802, 2803, 2804, 2805, 2806, 2807, 2808,
2809, 2810, 2811, 2812, 2813, 2814, 2815, 2816, 2817, 2818, 2819, 2820, 2821, 2
822, 2823, 2824, 2825, 2826, 2827, 2828, 2829, 2830, 2831, 2832, 2833, 2834, 283
5, 2836, 2837, 2838, 2839, 2840, 2841, 2842, 2843, 2844, 2845, 2846, 2847, 2848,
2849, 2850, 2851, 2852, 2853, 2854, 2855, 2856, 2857, 2858, 2859, 2860, 2861, 2
862, 2863, 2864, 2865, 2866, 2867, 2868, 2869, 2870, 2871, 2872, 2873, 2874, 287
5
- added mamont's changes to AdvOR-english.lng for special GUI effects (updated l
anguage strings: 47, 53, 57, 59, 60, 62, 1248, 2804, 2805, 2817)
- corrected: when an UNICODE language file was loaded, list view subitems for hi
dden services and plugins were not updated
- corrected: since language files were loaded using read_file_to_str(), language
files were opened in text mode and had CRLF (\r\n) converted to LF (\n), which
caused multi-line debug messages to be converted to single-line messages
- the restriction for minimum circuit bandwidth rate now uses BandwidthCapacity
instead of BandwidthRate (it uses what the router is known to handle instead of
what the router reported it can handle)
- the window title will show "Disconnected" when disconnecting from the OR netwo
rk (suggested by TT)
- new option for circuit context menus on the "Network information" page: "Prior
ity", which is used when deciding which circuits to use for a new client connect
ion when more circuits with different priorities exist; low priority circuits ar
e used only when no higher priority circuits are available
- new option for circuit context menus on the "Network information" page: "Avail
ability" which can be used to change expiration times or to prevent a manually b
uilt circuit from expiring (the default expiration time can be changed from the
"Circuit build" page)
- new option on the "System" page: "Encrypt all settings using AES"; if this opt
ion is enabled, all configuration files are gzipped and encrypted using a passwo
rd or a key file and saved to AdvOR.dat, original configuration files are delete
d; to revert the encryption and to save plain-text configuration files, after a
successfull login, the encryption can be disabled from the System dialog
- new functions for plugins: tor_malloc(), tor_free(), safe_malloc(), safe_free(
) (the "safe" functions attempt to allocate memory that is not cached to the Win
dows swap file)
- new functions for plugins: write_protected_file(), append_to_protected_file(),
read_protected_file(), protected_file_exists(); if encrypting configuration fil
es is enabled, "protected files" are gzipped and encrypted and saved to AdvOR.da
t
- an example plugin (C) that uses protected file operations was included in the
source code archive - Notes.dll (a simple text editor which saves a text file to
AdvOR.dat when encryption is enabled, and "AdvOR--notes.txt" when encryption is
disabled)
- an example plugin (asm) that uses AdvTor_HandleRead() was included in the sour
ce code archive - ShowURL.dll (a plugin that shows the complete URLs used with H
TTP proxy requests)
- new functions for plugins: tor_gzip_compress(), tor_gzip_uncompress(), tor_zli
b_new(), tor_zlib_process(), tor_zlib_free(), detect_compression_method()
- the plugin Blacklist.dll can now download and uncompress gzipped blacklists
, 2786, 2787, 2788, 2789, 2790, 2791, 2792, 2793, 2794, 2795, 2796, 2797, 2798
- corrected: if an invalid hostname was requested, the connection state was not
set (thanks to RoLex for reporting this error)
- the function CreateNewProcess() returns a process handle for the process that
was created
- new configuration option: SynchronizeExit which can have QuickStart menu items
as parameters, to start applications and to wait for them to terminate, then ex
it, or to exit when any of the SynchronizeExit applications exits, also terminat
ing all intercepted processes (for situations where AdvOR is only needed for one
application)
- added instructions on how to use the Tor Browser bundle from torproject.org wi
th AdvOR and a sample AdvOR.ini to AdvOR\Tor-info\Firefox (readme.txt and AdvOR.
ini).
- added instructions on how to use Opera as a portable "Tor Browser" and a sampl
e AdvOR.ini to AdvOR\Tor-info\Opera (readme.txt and AdvOR.ini).
- corrected: when the option to verify AS paths was enabled, the option to avoid
using nodes from same countries was no longer used
- all file I/O operations were moved to file_io.c
- all stdio file operations were replaced with Win32 UNICODE-enabled API; AdvOR
can now open files that have non-ANSI characters in their file names or in their
paths
- all process intercetion functions were modified to support UNICODE process nam
es, module names and UNICODE file names / paths
- all AdvOR files can be renamed to file names that have non-ANSI characters (th
e "AdvOR" prefix can be replaced with any UNICODE prefix)
- new command line parameter: --read-only which prevents modifying / saving conf
iguration files (if AdvOR is running from a read-only or write-protected locatio
n)
- when the read-only mode is enabled, the options to save settings and to save l
ogs are disabled and all file operations are emulated
- geoip_c.h was updated with GeoIPCountryWhois.csv released on April 3rd
- corrected: AdvOR.dll was checking for the old signature "AdvTor" instead of "A
dvOR" when releasing intercepted processes
- corrected: the options to avoid using in same circuit nodes from same subnets
and countries are no longer disabled when enabling the option to avoid AS path i
ntersections
- the code was restructured to get rid of all goto's inherited from Tor; some fu
nctions were optimized and some memory leaks were corrected
- directory servers running AdvOR no longer accept requests for "/tor/bytes.txt"
, "/tor/mallinfo.txt" and "/tor/dbg-stability.txt" ; requests for them will resu
lt in 404 errors
- new configuation option: Confirmations; currently it is used to configure conf
irmation dialogs that are shown at exit and when closing non-proxy connections o
f an intercepted process
- when changing the identity, more information is shown about the new identity w
hen possible
- the option "Circuit timeout when exiting program" was moved from the Circuit B
uild page to the "Become a Server" page as "Circuit timeout when entering hibern
ation"; this made room for a new option,
- new configuration option: CircuitBandwidthRate (default is disabled), which is
used to configure the minimum required bandwidth rate for circuits
- new option on the Circuit Build page: "Minimum circuit bandwidth rate"; if thi
s option is enabled, all circuits will be built with routers that have the minim
um required bandwidth rate
- updated language strings: 123, 2690, 2767, 2768, 2769, 2770, 2771, 2772, 2773,
2774, 2775, 2776
- added: new parameter for connection_t structures, timestamp_lastcircuit, which
must be greater than get_time()-MIN_CIRCUIT_PER_CONNECTION_TIME (default is 2 s
econds); this verification prevents routers with fake policies from causing too
many circuits for same connection to be build in a small period of time
- AS paths for all routers are shown on the Network Information page when select
ing a router from the circuit tree
- estimated AS paths and AS path intersections for circuits are shown on the Net
work Information page when selecting a circuit from the circuit tree
- new option on the Router Restrictions page: "Estimate AS paths and avoid AS pa
th intersections" to solve some of the problems described at http://blog.torproj
ect.org/blog/research-problem-measuring-safety-tor-network
- if the options to use consecutive exits from the exit list and to avoid AS pat
h intersections are enabled and no circuit can be built without AS path intersec
tions, another exit is selected
- new functions for plugins: as_from_ip (2.34), get_as_paths (2.35) and is_as_pa
th_safe (2.36)
- updated language strings: 2582, 2764, 2765, 2766
- the project was renamed from "Advanced TOR" to "Advanced Onion Router" (reques
ted by torproject.org)
- updated language strings: 1, 14, 19, 40, 45, 54, 62, 68, 85, 97, 221, 222, 223
, 935, 1246, 1247, 1248, 2511, 2515, 2529, 2671, 2688, 2689, 2692, 2718, 2740, 2
762
2011-03-06 AdvTor 0.2.0.7
- [tor-0.2.1.30] Stop sending a CLOCK_SKEW controller status event whenever we f
etch directory information from a relay that has a wrong clock. Instead, only in
form the controller when it's a trusted authority that claims our clock is wrong
. Bugfix on 0.1.2.6-alpha; fixes the rest of bug 1074.
- [tor-0.2.1.30] Fix a bounds-checking error that could allow an attacker to rem
otely crash a directory authority. Bugfix on 0.2.1.5-alpha. Found by "piebeer".
- [tor-0.2.1.30] If relays set RelayBandwidthBurst but not RelayBandwidthRate, T
or would ignore their RelayBandwidthBurst setting, potentially using more bandwi
dth than expected. Bugfix on 0.2.0.1-alpha. Reported by Paul Wouters. Fixes bug
2470.
- [tor-0.2.1.30] Adjust our TLS Diffie-Hellman parameters to match those used by
Apache's mod_ssl.
- [tor-0.2.1.30] Check for and reject overly long directory certificates and dir
ectory tokens before they have a chance to hit any assertions. Bugfix on 0.2.1.2
8. Found by "doorss".
- [tor-0.2.1.30] Bring the logic that gathers routerinfos and assesses the accep
tability of circuits into line. This prevents a Tor OP from getting locked in a
cycle of choosing its local OR as an exit for a path (due to a .exit request) an
d then rejecting the circuit because its OR is not listed yet. It also prevents
Tor clients from using an OR running in the same instance as an exit (due to a .
exit request) if the OR does not meet the same requirements expected of an OR ru
nning elsewhere. Fixes bug 1859; bugfix on 0.1.0.1-rc.
- geoip_c.h was updated with GeoIPCountryWhois.csv released on March 2nd
2011-03-05 AdvTor 0.2.0.6
- the list with filtered debug strings was moved from "System" to "Debug"
- new configuration options: HotkeyRestore (default is Win+Ctrl+T, disabled), Ho
tkeyNewIdentity (default is Win+N, disabled), HotkeyIntercept(default is Win+Ctr
l+I, disabled), HotkeyRelease (default is Win+Ctrl+R, disabled)) (requested by j
imjum)
- settings related to hot keys were added to the System dialog ("Hide / restore
Advanced TOR window", "New identity", "Intercept focused application", "Release
focused application")
- added: new option on exit node selection dialog: "Exit selection algorithm use
s consecutive displayed nodes from this list", which updates IdentityFlags (disa
bled by default); this option affects chosen exits; if this option is enabled, A
dvTor will always use a fixed exit that is changed only when choosing a new iden
tity (requested by jimjum)
- the blacklist plugin no longer shows a warning if it cannot load blacklist.txt
(the log level was changed from LOG_WARN to LOG_INFO)
, 2746, 2747, 2748, 2749, 2750, 2751, 2752, 2753, 2754, 2755, 2756, 2757, 2758,
2759, 2760, 2761, 2762
2011-02-12 AdvTor 0.2.0.5
- corrected: if all options related to publishing router descriptor were disable
d, the dialog initialization procedure for the "Become a Server" dialog was init
ializing publishing options from a null pointer (thanks to jimjum for reporting
this error)
- corrected: if no name servers can be found when connecting to Tor network and
Server mode is enabled, name servers will be configured at a later time (thanks
to jimjum for reporting this error)
- corrected: the function retry_all_listeners() was called while initializing di
alog controls for the "Become a Server" dialog (thanks to jimjum for reporting t
his error)
- corrected: changes from the "Become a Server" dialog that have non-reentrant c
alls to user32 and winsock32 functions are applied by run_scheduled_events() ins
tead of being applied directly (thanks to jimjum for reporting this error)
- corrected: the list with server descriptor settings was not re-initialized aft
er clearing it (thanks to jimjum for reporting this error)
- corrected: if no memory is allocated for packed_cell_t objects, statistics for
cell pool memory usage are no longer logged
- when best time delta is changed, timestamps for all existing connections are a
djusted to be relative to current fake local time
- the bandwith rate for banned routers is no longer shown in router selection di
alogs
- if the router list is sorted, all routers that are banned are sorted at the bo
ttom of the list
- if the router list is sorted and a router is selected, the list will be scroll
ed to place it in the center of the visible area
- if Tor is started, "Start Tor" becomes "Stop Tor" (requested by TT)
- new configuration option: WindowPos, which is used to store the size and posit
ion of the main dialog; this option is used only if it describes a window that h
as no parts outside the visible area of the screen (requested by TT)
- directory connections now have an exclusivity key EXCLUSIVITY_DIRCONN and inte
rnal connections have EXCLUSIVITY_INTERNAL
- plugins are not allowed to set EXCLUSIVITY_DIRCONN or EXCLUSIVITY_INTERNAL for
accepted client connections (the connection will be closed)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on February 1st
2011-01-23 AdvTor 0.2.0.4
- [tor-0.2.1.29] Fix a heap overflow bug where an adversary could cause heap cor
ruption. This bug probably allows remote code execution attacks. Reported by "de
buger". Fixes CVE-2011-0427. Bugfix on 0.1.2.10-rc.
- [tor-0.2.1.29] Prevent a denial-of-service attack by disallowing any zlib-comp
ressed data whose compression factor is implausibly high. Fixes part of bug 2324
; reported by "doorss".
- [tor-0.2.1.29] Zero out a few more keys in memory before freeing them. Fixes b
ug 2384 and part of bug 2385. These key instances found by "cypherpunks", based
on Andrew Case's report about being able to find sensitive data in Tor's memory
space if you have enough permissions. Bugfix on 0.0.2pre9.
- [tor-0.2.1.29] Add a check for SIZE_T_MAX to tor_realloc() to try to avoid und
erflow errors there too. Fixes the other part of bug 2324.
- [tor-0.2.1.29] Fix a bug where we would assert if we ever had a cached-descrip
tors.new file (or another file read directly into memory) of exactly SIZE_T_CEIL
ING bytes. Fixes bug 2326; bugfix on 0.2.1.25. Found by doorss.
- [tor-0.2.1.29] Fix some potential asserts and parsing issues with grossly malf
ormed router caches. Fixes bug 2352; bugfix on Tor 0.2.1.27. Found by doorss.
- [tor-0.2.1.29] Fix a bug with handling misformed replies to reverse DNS lookup
requests in DNSPort. Bugfix on Tor 0.2.0.1-alpha. Related to a bug reported by
doorss.
- [tor-0.2.1.29] Fix compilation on mingw when a pthreads compatibility library
has been installed. (We don't want to use it, so we shouldn't be including pthre
ad.h.) Fixes bug 2313; bugfix on 0.1.0.1-rc.
- [tor-0.2.1.29] Fix a bug where we would declare that we had run out of virtual
addresses when the address space was only half-exhausted. Bugfix on 0.1.2.1-alp
ha.
- [tor-0.2.1.29] Correctly handle the case where AutomapHostsOnResolve is set bu
t no virtual addresses are available. Fixes bug 2328; bugfix on 0.1.2.1-alpha. B
ug found by doorss.
- [tor-0.2.1.29] Correctly handle wrapping around to when we run out of virtual
address space. Found by cypherpunks, bugfix on 0.2.0.5-alpha.
- [tor-0.2.1.29] Introduce output size checks on all of our decryption functions
.
- updated language strings: 2731, 2732, 2733, 2734, 2735
2011-01-22 AdvTor 0.2.0.3
- corrected: if no router descriptors were downloaded, the function choose_good_
middle_server() no longer makes a list with excluded routers (used by the circui
t builder dialog when estimating new circuits)
- if a single router is selected as exit, the system tray menu option associated
with this router will be checked
- the circuit builder dialog has been re-designed; nodes can be edited or added
using 3 new dialogs for selecting entry nodes, exit nodes and for selecting midd
le nodes from the big list of all nodes; details about estimated/inserted nodes
are shown as comments
- when selecting a new exit, the selection is added to AdvTor's title before try
ing to use the selection to estimate new circuits
2011-01-05 AdvTor 0.2.0.2
- [tor-0.2.1.28] Fix a remotely exploitable bug that could be used to crash inst
ances of Tor remotely by overflowing on the heap. Remote-code execution hasn't b
een confirmed, but can't be ruled out. Everyone should upgrade. Bugfix on the 0.
1.1 series and later.
- [tor-0.2.1.28] Change IP address and ports for gabelmoo (v3 directory authorit
y).
- geoip_c.h was updated with GeoIPCountryWhois.csv released on Januray 3th
- corrected: AdvTor.dll did not disconnect the pipe after receiving a command fr
om another instance of AdvTor.exe
- corrected: when TrackHostExits or AddressMap were used, circuit length became
CircuitPathLength+1
- added: new options on exit node selection dialog: "close all existing connecti
ons" and "expire tracked hosts", which update a new configuration option "Identi
tyFlags" (both are enabled by default)
- added plugin callback functions that can be used by plugins, and plugin API, a
s described in plugins.txt (by default, newly added plugins have the rights for
all functions enabled)
- new configuration dialog: "Plugins", which allows unloading / reloading / disa
bling plugins and changing plugin priorities and rights
- plugins can host hidden services without the need to open any ports on local m
achine; an example of a hidden service plugin is included in the source code arc
hive (HiddenMessage.dll)
- the hidden service selection dialog allows selecting hidden services hosted by
plugins, if any; a plugin can host different hidden services
- added: new plugin Blacklist.dll, which allows banning blacklisted routers and
rejecting requests for addresses that resolve to a blacklisted IP
- the default value for FavoriteExitNodesPriority was changed from 100 to 50
- the default value for EnforceDistinctSubnets was changed from 1 to 2 (now the
default is to use nodes from different countries in the same circuit)
, 2703, 2704, 2705, 2706, 2707, 2708, 2709, 2710, 2711, 2712, 2713, 2714, 2715,
2716, 2717, 2718, 2719, 2720, 2721, 2722, 2723, 2724, 2725, 2726
2010-12-05 AdvTor v0.2.0.1
- corrected: when a NotifyFilter string was edited manually, the string returned
by WideCharToMultiByte was not terminated correctly
- corrected: when no NotifyFilter strings were added, a null pointer was used wi
th SetDlgItemTextL when initializing the "System" dialog
- corrected: the dialog that asks for the private key of a hidden service did no
t show the last letter of the hidden service's name (thanks to cc for reporting
this problem)
- corrected: when adding a new hidden service, the virtual ports were overwritte
n when registering the new service (thanks to cc for reporting this problem)
- corrected: the prototype of ShowOpenPorts was changed to allow the caller to s
pecify a parent dialog window and the dialog that contains the edit boxes that n
eed to be changed (thanks to cc for reporting this problem)
- new option for intercepting processes: "Exclusive exit", which determines AdvT
or to always use exit nodes that are different than the exits used by other proc
esses, to make sure that same exit node cannot know what different processes ope
ned by same user are doing (default is off)
- each intercepted process has a new generated exclusivity key, which, if used,
is inherited by child processes; a child process will use the exit nodes used by
parent process if possible, or new exits that are not used by processes that ha
ve different exclusivity keys
- a process that is not intercepted or that was intercepted without using the ex
clusivity key has a default exclusivity key which causes its newly chosen exits
to exclude exits associated with other keys
- if a process uses an exclusivity key and a single exit node is selected for al
l connections, that process will exclude selected exit node and use a different
one
- if a process uses an exclusivity key and a random exit node from a country is
selected for all connections, that process will always use a node from that coun
try that is not already used by processes with different exclusivity keys or it
will fail to choose an exit node
- if an exclusivity key is used, it will be shown in debug when a process is int
ercepted and when an intercepted process creates a new process
2010-12-03 AdvTor v0.2.0.0
- [tor-0.2.1.27] Resolve an incompatibility with OpenSSL 0.9.8p and OpenSSL 1.0.
0b: No longer set the tlsext_host_name extension on server SSL objects; but cont
inue to set it on client SSL objects. Our goal in setting it was to imitate a br
owser, not a vhosting server. Fixes bug 2204; bugfix on 0.2.1.1-alpha. (tortls.c
)
- [tor-0.2.1.27] Do not log messages to the controller while shrinking buffer fr
eelists. Doing so would sometimes make the controller connection try to allocate
a buffer chunk, which would mess up the internals of the freelist and cause an
assertion failure. Fixes bug 1125; fixed by Robert Ransom. Bugfix on 0.2.0.16-al
pha. (buffers.c)
- [tor-0.2.1.27] Learn our external IP address when we're a relay or bridge, eve
n if we set PublishServerDescriptor to 0. Bugfix on 0.2.0.3-alpha, where we intr
oduced bridge relays that don't need to publish to be useful. Fixes bug 2050. (c
onfig.c)
- [tor-0.2.1.27] Allow handshaking OR connections to take a full KeepalivePeriod
seconds to handshake. Previously, we would close them after IDLE_OR_CONN_TIMEOU
T (180) seconds, the same timeout as if they were open. Bugfix on 0.2.1.26; fixe
s bug 1840. Thanks to mingw-san for analysis help. (main.c)
- [tor-0.2.1.27] When you're using bridges and your network goes away and your b
ridges get marked as down, recover when you attempt a new socks connection (if t
he network is back), rather than waiting up to an hour to try fetching new descr
iptors for your bridges. Bugfix on 0.2.0.3-alpha; fixes bug 1981. (circuitbuild.
c)
- [tor-0.2.1.27] Fix an assertion failure that could occur in directory caches o
r bridge users when using a very short voting interval on a testing network. Dia
gnosed by Robert Hogan. Fixes bug 1141; bugfix on 0.2.0.8-alpha. (networkstatus.
c)
- [tor-0.2.1.27] Enforce multiplicity rules when parsing annotations. Bugfix on
0.2.0.8-alpha. Found by piebeer. (routerparse.c)
- [tor-0.2.1.27] Exit nodes didn't recognize EHOSTUNREACH as a plausible error c
ode, and so sent back END_STREAM_REASON_MISC. Clients now recognize a new stream
ending reason for this case: END_STREAM_REASON_NOROUTE. Servers can start sendi
ng this code when enough clients recognize it. Bugfix on 0.1.0.1-rc; fixes part
of bug 1793. (or.h, reasons.c, relay.c)
- [tor-0.2.1.27] Set up maatuska (run by Linus Nordberg) as the eighth v3 direct
ory authority. (dlg_authorities.c)
- corrected: the version of AdvTor.dll was not correctly verified
- geoip_c.h was updated with GeoIPCountryWhois.csv released on November 2nd
- AdvTor.dll now keeps a cache with connection information received from interce
pted processes
- if an intercepted program keeps its own DNS cache and the process is released
then re-intercepted, a warning will be shown when a connection attempt is made f
or a fake IP given by a previous instance of AdvTor.dll
- if a program already has established connections before intercepting it, AdvTo
r.dll will give the option to close existing connections after intercepting it
- client-side HTTP header filtering has been improved; "proxy-connection" is con
verted to "connection"; "connection: keep-alive" is replaced with "Connection: C
lose"; the following headers are removed: "x-forwarded-for", "via", "from", "pro
xy*" and "keep-alive"
- all settings from all pages from main dialog window were moved to separate chi
ld dialogs; to improve startup time, AdvTor will only create and initialize a ch
ild dialog window when there is a need to show it
- all procedures from dlg.h, dlg_bridges.h, dlg_graph.h and dlg_lang.h were move
d to separate files that have procedures for child dialog windows; the procedure
s for the main dialog were moved to dlg_main.c; the procedures for the "Proxy" d
ialog were moved to dlg_proxy.c; the procedures for the "Authorities" dialog wer
e moved to dlg_authorities.c; the procedures for the "Router restrictions" dialo
g were moved to dlg_routerres.c; the procedures for the "Circuit build" dialog w
ere moved to dlg_circuitbuild.c; the procedures for the "Connections" dialog wer
e moved to dlg_connections.c; the procedures for the "Bypass ISP filtering" dial
og were moved to dlg_bridges.c; the procedures for the "Hidden services" dialog
were moved to dlg_hs.c; the procedures for the "System" dialog were moved to dlg
_system.c; the procedures for the "Force TOR" dialog were moved to dlg_forcetor.
c; the procedures for the "Become a Server" dialog were moved to dlg_server.c; t
he procedures for the "Network information" dialog were moved to dlg_netinfo.c;
the procedures for the "Debug" dialog were moved to dlg_debug.c; the procedures
for the "About" dialog were moved to dlg_about.c; the procedures for the "Select
an Exit Node" dialog were moved to dlg_routers.c;
- the main AdvTor window and all child dialogs can be resized, each child dialog
has its own resize information (dlg_resize.c)
- updated language strings: 0060, 2687, 2688, 2689, 2690, 2691, 2692
2010-11-19 AdvTor v0.1.0.13
- when the exit is changed from system tray menu or from the exit node selection
dialog, a notification message will show the selection in debug window
- all file operations now use absolute paths because on some systems GetOpenFile
Name changes the directory even with OFN_NOCHANGEDIR flag set
- addresses of websites can also be banned by IP
- favorite routers are now added to the "Select IP" system tray menu and if ther
e are less than 30 IPs added, other routers are added that are not in banlist
- new configuration option: FavoriteExitNodesPriority which is a percent and it
is used when selecting a random exit node to decide if an exit node from favorit
es will be selected when StrictExitNodes is disabled (default is 100)
- new option for favorite exit nodes on "Router restrictions" page: "Priority" w
hich allows changing FavoriteExitNodesPriority
- added: context menus for circuit tree from "Network information" page that all
ow closing connections, destroying circuits, banning websites by hostname or IP,
banning nodes, adding nodes to favorites, etc.
, 2680, 2681, 2682, 2683, 2684, 2685, 2686
2010-11-17 AdvTor v0.1.0.12a
- corrected: connections that are marked for close are no longer added to circui
t tree on "Network information" page (thanks to RoLex for reporting this error)
- bridges are now sorted by country and then by IP and duplicates are removed (r
equested by jo)
2010-11-16 AdvTor v0.1.0.12
- corrected: if the option to start Tor automatically was enabled, the state of
"Start Tor" button was not set to BST_CHECKED (thanks to mamont for reporting th
is error)
- corrected: the option "Start Tor" from system tray menu did not set the state
of "Start Tor" button to BST_CHECKED
- corrected: when showing opened ports in hidden service selection dialog, the f
unction ShowOpenPorts() did not use the buffer it re-allocated
- the procedures that handle operations for connection tree items no longer use
stored pointers related to last selected item
- when changing identity, all existing connections of types OR, AP and EXIT are
marked for close
- the constant MAX_UNUSED_OPEN_CIRCUITS is now a configuration variable MaxUnuse
dOpenCircuits (default is 12)
- the configuration variable DisablePredictedCircuits was removed; a value of 0
for MaxUnusedOpenCircuits means that predicted circuits are disabled
- the option "Ports for services that have long-running connections" was moved f
rom "Circuit build" to "Connections"
- new option on "Circuit build" page: "Maximum number of unused predicted open c
ircuits"
- new bootstrap status: BOOTSTRAP_STATUS_STARTED; if MaxUnusedOpenCircuits is 0,
starting Tor will set bootstrap status to 100% because no predicted circuits ne
ed to be created
- added: new option "Stop Tor" available on system tray menus when Tor is starte
d
- updated language strings: 2669, 2670, 2671
2010-11-14 AdvTor v0.1.0.11
- corrected: the function add_all_streams() did not initialize the buffer it all
ocated for the string added to connection tree on Network Information page
- the button "Start Tor" is no longer disabled after starting Tor, it is now a c
heckbox; stopping Tor means entering hibernation mode (requested by cc)
- if an .onion address is specified, AdvTor will search existing hidden services
for its private key (requested by cc)
- if no private key for an entered .onion address is found, AdvTor will prompt t
he user to enter one (requested by cc)
- updated language strings: 2664, 2665, 2666, 2667, 2668
2010-11-12 AdvTor v0.1.0.10
- corrected: if acting on one of config options failed, all remaining options we
re ignored (thanks to fonsjko for reporting this error)
- added: new option to dump statistics to debug/log available in context menus
- added: new page "Network information" which contains information about circuit
s, processes that have their traffic redirected to OR network and bandwidth usag
e
- added: new circuit builder dialog which allows building a circuit by specifyin
g all nodes and/or to estimate a new good circuit path having specified length
, 2563, 2564, 2565, 2566, 2567, 2568, 2569, 2570, 2571, 2572, 2573, 2574, 2575,
2576, 2577, 2578, 2579, 2580, 2581, 2582, 2583, 2584, 2585, 2586, 2587, 2588, 25
89, 2590, 2591, 2592, 2593, 2594, 2595, 2596, 2597, 2598, 2599, 2600, 2601, 2602
, 2603, 2604, 2605, 2606, 2607, 2608, 2609, 2610, 2611, 2612, 2613, 2614, 2615,
2616, 2617, 2618, 2619, 2620, 2621, 2622, 2623, 2624, 2625, 2626, 2627, 2628, 26
29, 2630, 2631, 2632, 2633, 2634, 2635, 2636, 2637, 2638, 2639, 2640, 2641, 2642
, 2643, 2644, 2645, 2646, 2647, 2648, 2649, 2650, 2651, 2652, 2653, 2654, 2655,
2656, 2657, 2658, 2659, 2660, 2661, 2662, 2663
2010-11-02 AdvTor v0.1.0.9c
- the function rend_client_get_random_intro() could had selected a banned router
as introduction point to a hidden service
- the function onion_pick_cpath_exit() will no longer warn but fail if a request
ed exit router if found in banlist
- the procedure for clearing the debug edit window will also send EM_SETHANDLE w
hen needed, to prevent drawing UNICODE \0 on some systems (tested with Windows X
P SP2)
2010-11-01 AdvTor v0.1.0.9b
- corrected: if a banned node was requested as exit (using ".exit" suffix) it wa
s used by AdvTor to connect to specified address (thanks to fonsjko for reportin
g this problem)
2010-10-31 AdvTor v0.1.0.9a
- the strings for hidden service port selection dialog can now be loaded from la
nguage files (thanks to mamont for reporting this problem)
- updated language strings: 1248,2548,2549,2550,2551,2552,2553,2554
2010-10-29 AdvTor v0.1.0.9
- new page: "Bypass ISP filtering" with options related to bridges and proxies
- the options "Use bridges", "Update bridges from authority" and "All directory
actions are private" were moved to the "Bypass ISP filtering" page
- empty definitions found in loaded language file(s) are replaced with default s
trings
- Updated language strings: 0058,0124,0125,2536,2537,2538,2539,2540,2541,2542,25
43,2544,2545,2546
2010-10-26 AdvTor v0.1.0.8a
- the procedure for showing messages in debug window has been optimized to reduc
e CPU usage if too many strings are shown in a short period of time (for example
, when selecting log level to "[8] Debug")
- if no text is selected in debug window, the context menu will no longer show t
he option to filter selected text
2010-10-23 AdvTor v0.1.0.8
- corrected: the option LongLivedPorts could not be re-enabled after disabling i
t (thanks to mamont for reporting this error)
2010-10-20 AdvTor v0.1.0.8test5
- corrected: AdvTor.dll did not use the string 2517 from language file
- corrected: the words "bridge" and "hidden" from "Become a server" page are now
loaded from language file (thanks to mamont for reporting this error)
- the function updateDirStatus() now converts status strings from UTF-8 to UNICO
DE
- language strings changed: 0198, 0199
2010-10-18 AdvTor v0.1.0.8test4
- context menus for debug window will also load strings from language files if n
eeded
- NotifyFilter strings are now saved to AdvTor.ini as UTF-8
- message filtering procedure for debug window was adjusted to handle UTF-8 text
- language file strings added / changed: 2530, 2531, 2532, 2533, 2534, 2535
2010-10-14 AdvTor v0.1.0.8test3
- corrected: progressLog() did not convert language strings from UTF-8 to UNICOD
E (thanks to mamont for reporting this error)
- corrected: a language-dependent debug message from get_lang_str() caused crash
es when "Debug" log level was selected (thanks to mamont for reporting this erro
r)
- on some systems EM_REPLACESEL is ANSI only; for UNICODE / UTF-8 language files
, AdvTor will attempt to access the memory allocated for the Debug edit window d
irectly if possible
- added: new option to avoid using nodes from same countries in same circuit
- the option EnforceDistinctSubnets was converted from BOOL to UINT; a value of
1 means that AdvTor will avoid using nodes from same subnets in same circuit; a
value of 2 means that AdvTor will avoid using nodes from same countries in same
circuit
2010-10-09 AdvTor v0.1.0.8test1
- corrected: when parsing router information, geoip_get_country_by_ip() was not
called with a reversed IP
- corrected: geoip_get_country_by_ip() was not always converting the result to D
WORD
- added: new option to use language files, supported formats: ANSI, UNICODE, UTF
-8
- new command line parameter: --verify-lng to verify if a language file has form
atting errors
- banlist has priority over favorites
2010-09-28 AdvTor v0.1.0.7c
- corrected: if a specific country was selected in exit node selection dialog, t
he user needed to click on an item from node selection list to ban it even when
a node was already selected.
- corrected: attempting to ban the entry "random country" / "random router" caus
ed an invalid entry to be added to banlist
- countries can now be added to favorites or to banlist (requested by mamont)
2010-09-27 AdvTor v0.1.0.7b
- corrected: method 0xE0 was searched in Socks5 request buffer after it was clea
red
- added: new command line parameter "--select-exit" (requested by mamont)
2010-09-26 AdvTor v0.1.0.7a
- corrected: when a program was intercepted with the option to change icons enab
led, AdvTor.dll did not disable that option if the user disabled it from "Force
TOR" page (thanks to RoLex for reporting this error)
- removed the string "Shell_TrayWnd" because Avira bans programs that use it; Ad
vTor.dll now creates this string using 4 DWORDs because of this
2010-09-25 AdvTor v0.1.0.7
- corrected: the functions count_usable_descriptors() and update_consensus_route
r_descriptor_downloads() could expire consensus information even when the user s
elected the option to not connect to directory servers automatically
- corrected: in WSAAsyncSelect procedure, wrong parameters for the macro user32P
ostMessage could cause a message to be posted with an invalid window handle
- corrected: connection state was not set when an intercepted connection was usi
ng an entry from AdvTor.dll's cache
- removed: the option DataDirectory is useless, all data is written to AdvTor.ex
e's directory, and all files are prefixed by AdvTor.exe's file name (if AdvTor.e
xe is not renamed, the prefix is "AdvTor")
- if AdvTor.exe is renamed, also the window title will have its new name
- the range for generated fake IPs was changed from 127.* to 255.*
- added: new page: "Hidden services" with options related to hidden services
- options for hidden services are no longer saved in separate directories; Hidde
nServiceDir was renamed to HiddenServiceKey and it is an integer value specifyin
g a unique key for each hidden service
- added: new option on "Force TOR" page: "Change program icon to indicate AdvTor
.dll presence" - if this option is enabled when intercepting a program, top-leve
l windows created by the target process will have their icons changed (requested
by Hitt)
- for system tray icon animation, if changing icons is enabled, AdvTor.dll also
intercepts Shell_NotifyIcon from shell32.dll if it is loaded in target process
- new command line parameter: "--start" to connect to Tor network on startup (re
quested by Meka][Meka and mamont)
- new command line parameter: "--minimize" to minimize AdvTor window on startup
(requested by mamont)
- multiple QuickStart options with quoted menu items as values are accepted as c
ommand line parameters to run at startup applications associated with requested
QuickStart menu items (requested by Meka][Meka and mamont)
- a brief description of supported command-line parameters can be accessed with
"AdvTor --help" or "AdvTor /?"
- added: new Socks5 extension: SOCKS_COMMAND_SELECT_ROUTER; for more information
see socks-extensions.txt (5.)
2010-09-06 AdvTor v0.1.0.6
- corrected: the pointer for PostMessage was not initialized when needed in othe
r processes
- corrected: second different resolved .onion address by same process could not
be accessed if "Force TOR" was enabled
- corrected: if the option to download network status manually was enabled, netw
ork status still expired
- corrected: if another instance of AdvTor was running from a different director
y with the same name, AdvTor failed to create the pipe needed to communicate wit
h intercepted processes
- corrected: problems with Delphi libraries when AdvTor was resolving addresses
to fake IPs (thanks to RoLex for reporting these problems)
- corrected: high CPU usage when AdvTor could not create a pipe
- AdvTor.dll also intercepts WinExec and it converts calls to WinExec to calls t
o CreateProcessA (WinExec would call CreateProcessInternalA instead of CreatePro
cessA)
- AdvTor.dll now has a DNS cache; default expiration time for an entry that has
a resolved IP is 120 seconds
- removed: the option "Detect ASLR" - ASLR will always be handled by AdvTor.dll
- if "no exit" is selected, no warnings will be shown about failure to select a
good exit server
- new configuration option: ForceFlags - used to specify the default options for
faking local time, address IPs and for disallowing non-TCP sockets
- new option: "Run" available on "Force TOR" page that allows starting a process
protected by AdvTor
- new option: "Resolve only to fake IPs" available on "Force TOR" page, which if
enabled, returns an IP within range 127.16.* for all resolve requests instead o
f sending them to OR network; cache entries that have 127.16.* as IPs don't expi
re as long as resolving to fake IPs is enabled
- new option: "Disallow non TCP sockets" available on "Force TOR" page, to prote
ct against leaking the real IP through other protocols
- new menu: "Quick start" available on "Force TOR" page and on system tray menu
that allows starting applications protected by AdvTor with different settings fo
r each favorite process (requested by Meka][Meka)
- new configuration option: CircuitPathLength, also added to GUI on "Router rest
rictions" page - currently the maximum circuit length can be 10 routers, default
is 3
2010-08-28 AdvTor v0.1.0.5
- corrected: if LoadLibrary failed in target process, it was still shown as inte
rcepted
- corrected: when unloading the AdvTor.dll, UnloadDLL did not wait for PipeThrea
d to finish
- corrected: high CPU usage if no running exit nodes were found (thanks to RoLex
for reporting this problem)
- corrected: system tray menus were not closed when the user clicked outside the
m
- corrected: AdvTor.dll did not always close handles of remote threads
- corrected: AdvTor.dll did not always free the memory it allocated in other pro
cesses
- corrected: AdvTor.dll did not intercept process creation functions if the opti
on to fake local time was disabled
- corrected: intercepted processes that were not updated in GUI were not release
d when AdvTor exited
- corrected: intercepting functions in suspended processes sometimes failed
- corrected: AdvTor.dll could re-hook same procedure twice if a previous instanc
e was terminated from task manager
- corrected: AdvTor.exe will no longer attempt to intercept itself if the user s
elects it from process list (thanks to RoLex for reporting this error)
- if no running exit nodes can be found for selected country, the notification m
essage is shown only once, until a good exit node is found (thanks to RoLex for
reporting this problem)
- the confusing message "attempt to bypass proxy settings" is replaced with "red
irecting connection from address" (thanks to Meka][Meka for reporting this probl
em)
- system tray menu has a new submenu "Release" with all intercepted processes to
allow unloading AdvTor.dll from them
- AdvTor.dll now shows more information about interception failures
- AdvTor.dll no longer loads user32.dll in intercepted processes
- AdvTor.dll also intercepts functions gethostbyname, WSAAsyncGetHostByName, get
hostbyaddr, WSAAsyncGetHostByAddr (Windows 2000+), getnameinfo, GetNameInfoW, ge
taddrinfo, GetAddrInfoW (Windows XP SP2+) (thanks to RoLex for helping with test
s)
- programs that are intercepted by AdvTor will have all DNS queries and reverse
DNS queries resolved by OR network
- programs that are intercepted can access .onion addresses, AdvTor.dll will res
olve them to an IP within range 127.16.* (localhost) and will keep a cache with
geneated IPs and corresponding .onion addresses to use in connection requests
- process tree also shows PID values when selecting a window
- when AdvTor.dll sends a notification about an intercepted process that doesn't
respect proxy settings, it also shows the PID for that process (requested by Ro
Lex)
- the lists with exit nodes will also have an entry "no exit", for those who wan
t only to see where an intercepted program would connect, but without allowing i
t to connect or to send anything
- added verification for "localhost" so an intercepted process won't try to use
OR network to resolve it (Opera resolves "localhost" every time you save a file)
- added verification for "wpad" to prevent vulnerable applications from using OR
network to resolve it (Chrome, IE, Yahoo Messenger, etc.)
2010-08-21 AdvTor v0.1.0.4
- GeoIP information is included as a pre-compiled search tree, GeoIP lookup func
tions are written in asm; also, a conversion program is included to convert a do
wnloaded GeoIPCountryWhois.csv to geoip_c.h (csv2asm)
- AdvTor now also intercepts CreateProcessAsUser from advapi32.dll
- context menu from debug window has more options related to selected text if an
address is found in it: track exit for selected_host (config option: TrackHostE
xits), remember/forget exit for selected_host (config option: AddressMap)
- debug messages shown by AdvTor.dll have different severity levels
- current exit node is shown in title bar
- added a DialogBox for selecting a specific exit node or a country from which a
random exit node will be chosen (accessible from "New identity" or from systray
menu option "Advanced")
- added a "Process Finder" DialogBox to help selecting a process by selecting a
window it created
- system tray menu has a list with 30 usable exit nodes
- AdvTor verifies the minimum required version of AdvTor.dll (version 0.1.0.4 re
quires AdvTor.dll 0.1.0.4)
2010-08-10 AdvTor v0.1.0.3
- corrected: if Auto-Refresh was disabled, initialization progress was no longer
shown
- corrected: if Auto-Refresh was disabled, all log messages were shown as popup
MessageBox'es
- corrected: ASLR detection problems in Windows 2003 (thanks to RoLex for helpin
g with tests)
- corrected: the nickname was reset to local computer name if server options wer
e changed (thanks to The Architect for reporting this error)
- AdvTor can now force programs that use asynchronous sockets to use Tor
- AdvTor also intercepts process creation functions, to set proxy restrictions o
n child processes created by a restricted process
- if AdvTor.exe is renamed, AdvTor.dll must also be renamed
2010-07-31 AdvTor v0.1.0.2
- files were updated with changes relative to changelog for tor-0.2.1.26
- updated libraries: libevent-1.4.14b-stable, openssl-1.0.0a, zlib-1.2.5
- new page "Authorities" added for settings related to Directory Authorities
- lock file functions were removed in favour of WIN32 mutex objects
- the files "torrc" and "state" were merged as [torrc] and [state] sections of A
dvTor.ini which is saved as a standard .ini file located in AdvTor's directory
- all saved files have the prefix of AdvTor's executable name
- changing file name of AdvTor.exe will cause it to change the names of all save
d files (multiple different versions of AdvTor can exist in same directory, with
different names).
- new option added "LocalHost" that will be used by intercepted programs to reso
lve local IP address
- added: new option for advertised OS: "<< Random >>" which will select a random
OS at startup from a list with most frequently used ones
- added: new option for advertised Tor version: "<< Auto >>" which will select a
random recommended Tor version from the list received from authorities
2009-05-21 AdvTor v0.1.0.1
- AdvTor.dll can show the process name and the module that attempts to bypass pr
oxy settings if "Force Tor" is enabled
- AdvTor.dll supports more operating systems, including Vista
- AdvTor.dll can also force system services to use Tor
- added new page: "Become a Server", with options related to sharing bandwidth t
o help OR network
- exit policies are split in 2 policy groups, "Accept only" and "Banned IPs / po
rts"
2009-04-17 AdvTor v0.1.0.0
Changes relative to Tor 0.2.1.13-alpha
- all Tor related files are no longer hidden in "application data", they are loc
ated in AdvTor's install directory
- Tor no longer creates a console window for status messages, it has a GUI, sett
ings can be changed in real time without the need to restart the program
- firewall rule groups "FirewallPorts", "ReachableORAddresses", "ReachableDirAdd
resses" and "ReachableAddresses" have been merged as "ReachableAddresses"
- there is no longer any need for an external program to convert HTTP proxy traf
fic to Socks4/5 traffic, TOR also handles HTTP/HTTPS proxy requests on the Socks
4/5 port
- added: new log level "Proxy" that allows viewing in real time all connection/r
esolve attempts made by clients / browsers that use the TOR proxy
- added: support for banlist for websites when using AdvTor as proxy
- added: new option: "Force TOR" for processes, that injects AdvTor.dll in anoth
er process to hook Winsock calls and redirect them to AdvTor's proxy

Change Log

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Change Log

Uploaded by

Copyright:

Available Formats

2014-04-17 Advanced Onion Router 0.3.0.

You might also like