Version in base suite: 0.4.8.16-1 Base version: tor_0.4.8.16-1 Target version: tor_0.4.9.6-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/tor/tor_0.4.8.16-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/t/tor/tor_0.4.9.6-0+deb13u1.dsc CODE_OF_CONDUCT | 3 ChangeLog | 1038 LICENSE | 27 Makefile.am | 8 Makefile.in | 589 README.md | 13 ReleaseNotes | 576 acinclude.m4 | 5 configure | 397 configure.ac | 123 contrib/win32build/tor-mingw.nsi.in | 2 debian/.debian-ci.yml | 18 debian/changelog | 67 debian/micro-revision.i | 2 debian/misc/backport | 4 debian/misc/build-tor-sources | 553 debian/tests/control | 2 debian/tests/setup-onion-service | 10 doc/asciidoc-helper.sh | 6 doc/man/tor-gencert.1.in | 4 doc/man/tor-print-ed-signing-cert.1.in | 4 doc/man/tor-resolve.1.in | 4 doc/man/tor.1.in | 110 doc/man/tor.1.txt | 128 doc/man/tor.html.in | 186 doc/man/torify.1.in | 4 m4/ax_check_compile_flag.m4 | 76 orconfig.h.in | 46 scripts/maint/practracker/practracker.py | 4 src/app/config/config.c | 42 src/app/config/fallback_dirs.inc | 1002 src/app/config/include.am | 1 src/app/config/or_options_st.h | 17 src/app/config/resolve_addr.c | 9 src/app/config/tor_cmdline_mode.h | 1 src/app/main/main.c | 69 src/app/main/ntmain.c | 7 src/app/main/shutdown.c | 1 src/config/geoip |118318 +++++++++++++++----------- src/config/geoip6 |128280 ++++++++++++++++++++++++----- src/config/torrc.sample.in | 4 src/core/crypto/hs_ntor.c | 9 src/core/crypto/include.am | 16 src/core/crypto/onion_crypto.c | 313 src/core/crypto/onion_crypto.h | 16 src/core/crypto/onion_tap.c | 246 src/core/crypto/onion_tap.h | 40 src/core/crypto/relay_crypto.c | 448 src/core/crypto/relay_crypto.h | 45 src/core/crypto/relay_crypto_cgo.c | 583 src/core/crypto/relay_crypto_cgo.h | 206 src/core/crypto/relay_crypto_st.h | 40 src/core/crypto/relay_crypto_tor1.c | 313 src/core/crypto/relay_crypto_tor1.h | 33 src/core/crypto/tor1_crypt_st.h | 39 src/core/mainloop/connection.c | 29 src/core/mainloop/cpuworker.c | 26 src/core/mainloop/cpuworker.h | 2 src/core/mainloop/include.am | 6 src/core/mainloop/mainloop.c | 1 src/core/or/channel.c | 5 src/core/or/channel.h | 1 src/core/or/channelpadding.c | 47 src/core/or/channelpadding.h | 4 src/core/or/channeltls.c | 98 src/core/or/circuit_st.h | 12 src/core/or/circuitbuild.c | 236 src/core/or/circuitbuild.h | 8 src/core/or/circuitlist.c | 16 src/core/or/circuitlist.h | 1 src/core/or/circuitpadding.c | 25 src/core/or/circuitpadding.h | 10 src/core/or/circuituse.c | 45 src/core/or/command.c | 23 src/core/or/conflux.c | 155 src/core/or/conflux.h | 25 src/core/or/conflux_cell.c | 61 src/core/or/conflux_cell.h | 10 src/core/or/conflux_params.c | 21 src/core/or/conflux_params.h | 1 src/core/or/conflux_pool.c | 92 src/core/or/conflux_pool.h | 10 src/core/or/conflux_st.h | 6 src/core/or/congestion_control_common.c | 110 src/core/or/congestion_control_common.h | 11 src/core/or/congestion_control_flow.c | 96 src/core/or/congestion_control_flow.h | 7 src/core/or/connection_edge.c | 413 src/core/or/connection_edge.h | 13 src/core/or/connection_or.c | 218 src/core/or/connection_or.h | 5 src/core/or/crypt_path.c | 63 src/core/or/crypt_path.h | 22 src/core/or/crypt_path_st.h | 15 src/core/or/dos.c | 127 src/core/or/dos.h | 34 src/core/or/dos_options.inc | 13 src/core/or/edge_connection_st.h | 12 src/core/or/extend_info_st.h | 9 src/core/or/extendinfo.c | 30 src/core/or/extendinfo.h | 2 src/core/or/half_edge_st.h | 4 src/core/or/include.am | 46 src/core/or/onion.c | 158 src/core/or/onion.h | 7 src/core/or/or.h | 119 src/core/or/or_circuit_st.h | 13 src/core/or/orconn_event.h | 18 src/core/or/policies.c | 8 src/core/or/protover.c | 28 src/core/or/protover.h | 8 src/core/or/reasons.c | 38 src/core/or/relay.c | 582 src/core/or/relay.h | 39 src/core/or/relay_crypto_st.h | 38 src/core/or/relay_msg.c | 286 src/core/or/relay_msg.h | 88 src/core/or/relay_msg_st.h | 47 src/core/or/scheduler_kist.c | 14 src/core/or/sendme.c | 228 src/core/or/sendme.h | 11 src/core/or/status.c | 7 src/core/or/versions.c | 15 src/core/proto/include.am | 2 src/core/proto/proto_socks.c | 37 src/ext/include.am | 29 src/ext/polyval/ctmul.c | 311 src/ext/polyval/ctmul64.c | 133 src/ext/polyval/pclmul.c | 253 src/ext/polyval/polyval.c | 561 src/ext/polyval/polyval.h | 185 src/feature/client/bridges.c | 6 src/feature/client/circpathbias.c | 62 src/feature/client/circpathbias.h | 6 src/feature/client/dnsserv.c | 3 src/feature/client/entrynodes.c | 17 src/feature/client/entrynodes.h | 2 src/feature/client/include.am | 2 src/feature/client/transports.c | 158 src/feature/client/transports.h | 6 src/feature/control/btrack_orconn_cevent.c | 4 src/feature/control/control.c | 4 src/feature/control/control_auth.c | 39 src/feature/control/control_auth.h | 4 src/feature/control/control_cmd.c | 47 src/feature/control/control_cmd.h | 3 src/feature/control/control_events.c | 17 src/feature/control/control_events.h | 5 src/feature/control/control_fmt.c | 18 src/feature/control/control_getinfo.c | 6 src/feature/control/include.am | 6 src/feature/dirauth/dirauth_config.c | 55 src/feature/dirauth/dirauth_options.inc | 3 src/feature/dirauth/dirvote.c | 189 src/feature/dirauth/dirvote.h | 36 src/feature/dirauth/process_descs.c | 14 src/feature/dirauth/voteflags.c | 17 src/feature/dircache/dircache.c | 8 src/feature/dircache/dirserv.c | 17 src/feature/dirclient/dirclient.c | 12 src/feature/dircommon/dir_connection_st.h | 4 src/feature/dircommon/directory.c | 34 src/feature/dircommon/directory.h | 1 src/feature/dircommon/include.am | 2 src/feature/dirparse/microdesc_parse.c | 18 src/feature/dirparse/parsecommon.c | 13 src/feature/dirparse/parsecommon.h | 3 src/feature/dirparse/routerparse.c | 258 src/feature/dirparse/routerparse.h | 10 src/feature/hibernate/hibernate.c | 9 src/feature/hibernate/hibernate.h | 1 src/feature/hibernate/include.am | 2 src/feature/hs/hs_cache.c | 44 src/feature/hs/hs_cache.h | 1 src/feature/hs/hs_cell.c | 23 src/feature/hs/hs_circuit.c | 16 src/feature/hs/hs_client.c | 3 src/feature/hs/hs_common.c | 2 src/feature/hs/hs_common.h | 9 src/feature/hs/hs_config.h | 2 src/feature/hs/hs_descriptor.c | 127 src/feature/hs/hs_service.c | 36 src/feature/hs/hs_service.h | 5 src/feature/hs/include.am | 10 src/feature/hs_common/include.am | 2 src/feature/metrics/include.am | 4 src/feature/nodelist/include.am | 4 src/feature/nodelist/microdesc.c | 6 src/feature/nodelist/microdesc_st.h | 14 src/feature/nodelist/networkstatus.c | 7 src/feature/nodelist/node_select.h | 2 src/feature/nodelist/nodelist.c | 155 src/feature/nodelist/nodelist.h | 9 src/feature/nodelist/routerinfo_st.h | 14 src/feature/nodelist/routerlist.c | 31 src/feature/nodelist/torcert.h | 1 src/feature/relay/circuitbuild_relay.c | 25 src/feature/relay/circuitbuild_relay.h | 11 src/feature/relay/dns.c | 33 src/feature/relay/dns.h | 4 src/feature/relay/ext_orport.c | 3 src/feature/relay/include.am | 4 src/feature/relay/onion_queue.c | 90 src/feature/relay/relay_config.c | 28 src/feature/relay/relay_handshake.c | 96 src/feature/relay/relay_handshake.h | 3 src/feature/relay/relay_metrics.c | 71 src/feature/relay/relay_metrics.h | 6 src/feature/relay/relay_periodic.c | 2 src/feature/relay/router.c | 167 src/feature/relay/router.h | 2 src/feature/relay/routerkeys.c | 353 src/feature/relay/routerkeys.h | 24 src/feature/relay/selftest.c | 16 src/feature/relay/selftest.h | 2 src/feature/rend/include.am | 4 src/feature/stats/geoip_stats.c | 9 src/feature/stats/geoip_stats.h | 7 src/feature/stats/include.am | 2 src/feature/stats/rephist.c | 35 src/feature/stats/rephist.h | 6 src/lib/cc/compat_compiler.h | 6 src/lib/compress/compress.c | 13 src/lib/conf/include.am | 6 src/lib/confmgt/include.am | 8 src/lib/crypt_ops/aes.h | 18 src/lib/crypt_ops/aes_nss.c | 145 src/lib/crypt_ops/aes_openssl.c | 442 src/lib/crypt_ops/compat_openssl.h | 28 src/lib/crypt_ops/crypto_dh.c | 20 src/lib/crypt_ops/crypto_dh.h | 2 src/lib/crypt_ops/crypto_dh_nss.c | 6 src/lib/crypt_ops/crypto_dh_openssl.c | 58 src/lib/crypt_ops/crypto_hkdf.c | 5 src/lib/crypt_ops/crypto_init.c | 3 src/lib/crypt_ops/crypto_openssl_mgt.c | 119 src/lib/crypt_ops/crypto_openssl_mgt.h | 20 src/lib/crypt_ops/crypto_rsa_openssl.c | 39 src/lib/crypt_ops/include.am | 6 src/lib/ctime/include.am | 4 src/lib/defs/dh_sizes.h | 5 src/lib/defs/include.am | 6 src/lib/dispatch/dispatch_cfg.c | 2 src/lib/dispatch/include.am | 4 src/lib/err/backtrace.h | 8 src/lib/evloop/token_bucket.c | 2 src/lib/evloop/workqueue.c | 193 src/lib/fdio/fdio.c | 28 src/lib/fdio/fdio.h | 1 src/lib/fdio/include.am | 2 src/lib/fs/conffile.c | 2 src/lib/fs/files.c | 7 src/lib/fs/files.h | 4 src/lib/fs/path.c | 3 src/lib/geoip/include.am | 2 src/lib/lock/include.am | 2 src/lib/log/log.c | 6 src/lib/log/log_sys.c | 29 src/lib/log/util_bug.c | 27 src/lib/log/util_bug.h | 29 src/lib/math/include.am | 6 src/lib/metrics/include.am | 8 src/lib/net/include.am | 4 src/lib/net/socket.c | 8 src/lib/osinfo/include.am | 4 src/lib/process/daemon.c | 3 src/lib/process/process_unix.c | 35 src/lib/process/restrict.c | 4 src/lib/process/waitpid.c | 3 src/lib/sandbox/sandbox.c | 268 src/lib/sandbox/sandbox.h | 3 src/lib/smartlist_core/include.am | 6 src/lib/string/util_string.c | 2 src/lib/term/include.am | 2 src/lib/time/compat_time.c | 9 src/lib/time/compat_time.h | 4 src/lib/time/include.am | 2 src/lib/tls/ciphers.inc | 38 src/lib/tls/ciphers_v13.inc | 15 src/lib/tls/include.am | 1 src/lib/tls/tortls.c | 59 src/lib/tls/tortls.h | 20 src/lib/tls/tortls_internal.h | 20 src/lib/tls/tortls_nss.c | 121 src/lib/tls/tortls_openssl.c | 939 src/lib/tls/tortls_st.h | 10 src/lib/tls/x509_openssl.c | 11 src/test/bench.c | 261 src/test/cgo_vectors.inc | 651 src/test/compression_bomb.h | 864 src/test/fakecircs.c | 7 src/test/include.am | 51 src/test/test.c | 211 src/test/test.h | 1 src/test/test_bridges.c | 12 src/test/test_cell_formats.c | 868 src/test/test_circuitbuild.c | 36 src/test/test_circuitlist.c | 10 src/test/test_circuitpadding.c | 54 src/test/test_config.c | 4 src/test/test_conflux_cell.c | 17 src/test/test_conflux_pool.c | 26 src/test/test_crypto.c | 293 src/test/test_crypto_cgo.c | 647 src/test/test_crypto_ope.c | 4 src/test/test_crypto_openssl.c | 5 src/test/test_dir.c | 253 src/test/test_dirvote.c | 25 src/test/test_entrynodes.c | 73 src/test/test_extorport.c | 2 src/test/test_geoip.c | 13 src/test/test_hs_client.c | 22 src/test/test_hs_control.c | 17 src/test/test_hs_intropoint.c | 2 src/test/test_hs_service.c | 12 src/test/test_include.sh | 2 src/test/test_link_handshake.c | 111 src/test/test_microdesc.c | 112 src/test/test_nodelist.c | 20 src/test/test_ntor_v3.c | 7 src/test/test_proto_http.c | 27 src/test/test_protover.c | 10 src/test/test_rebind.sh | 2 src/test/test_relaycell.c | 231 src/test/test_relaycrypt.c | 21 src/test/test_router.c | 4 src/test/test_routerkeys.c | 84 src/test/test_sandbox.c | 20 src/test/test_sendme.c | 139 src/test/test_socks.c | 65 src/test/test_status.c | 13 src/test/test_tortls.c | 232 src/test/test_tortls.h | 1 src/test/test_tortls_openssl.c | 520 src/test/test_util.c | 36 src/test/test_util_format.c | 2 src/tools/include.am | 10 src/tools/tor-resolve.c | 2 src/trunnel/include.am | 41 src/trunnel/link_handshake.c | 1562 src/trunnel/link_handshake.h | 632 src/trunnel/sendme_cell.c | 84 src/trunnel/sendme_cell.h | 25 src/trunnel/subproto_request.c | 456 src/trunnel/subproto_request.h | 157 345 files changed, 193343 insertions(+), 80888 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpl89dm1lw/tor_0.4.8.16-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpl89dm1lw/tor_0.4.9.6-0+deb13u1.dsc: no acceptable signature found diff -Nru tor-0.4.8.16/CODE_OF_CONDUCT tor-0.4.9.6/CODE_OF_CONDUCT --- tor-0.4.8.16/CODE_OF_CONDUCT 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/CODE_OF_CONDUCT 2026-03-25 14:30:34.000000000 +0000 @@ -3,5 +3,4 @@ participate. For the latest version of our Code of Conduct, please see -https://gitweb.torproject.org/community/policies.git/plain/code_of_conduct.txt - +https://community.torproject.org/policies/code_of_conduct/ diff -Nru tor-0.4.8.16/ChangeLog tor-0.4.9.6/ChangeLog --- tor-0.4.8.16/ChangeLog 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/ChangeLog 2026-03-25 14:30:34.000000000 +0000 @@ -1,20 +1,872 @@ -Changes in version 0.4.8.16 - 2025-03-24 - This is quick second release since 0.4.8.15 due to a typo in a directory - authority rule file. This only affects directory authorities. Regardless, - upgrading to latest stable is always desired. +Changes in version 0.4.9.6 - 2026-03-25 + This is a security release fixing major bugfixes that could possibly lead to + remote crashing relays. We strongly recommend upgrading as soon as possible. + + o Major bugfix (security): + - Fix a stack overflow of 11 bytes on malicious CREATED2. This lead + to a remote crash. TROVE-2026-003. Reported-by: Anas Cherni of + Calif.io. Fixes bug 41231; bugfix on 0.4.9.1-alpha. + + o Major bugfix (security, conflux): + - Fix a memory compare using the wrong length. This could lead to a + remote crash when using the conflux subsystem. TROVE-2026-004. + Fixes bug 41232; bugfix on 0.4.8.1-alpha. + + o Minor bugfixes (security): + - Fix a series of defense in depth security issues found across the + codebase. Fixes bug 41228; bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (portability): + - (Hopefully) fix our polyval implementation on big-endian + platforms. Fixes bug 41215; bugfix on 0.4.9.3-alpha. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on March 25, 2026. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2026/03/25. + + +Changes in version 0.4.9.5 - 2026-02-12 + This first stable release in the 0.4.9 series introduces a new + circuit-level encryption design for better client security, as well + as a more scalable way for large relay operators to annotate which + relays they run so clients can avoid using too many of them in a + single circuit. + + o Major features (cryptography): + - Clients and relays can now negotiate Counter Galois Onion (CGO) + relay cryptography, as designed by Jean Paul Degabriele, + Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam. CGO + provides improved resistance to several kinds of tagging attacks, + better forward secrecy, and better forgery resistance. Closes + ticket 41047. Implements proposal 359. + + o Major features (path selection): + - Clients and relays now support "happy families", a system to + simplify relay family operation and improve directory performance. + With "happy families", relays in a family share a secret "family + key", which they use to prove their membership in the family. + Implements proposal 321; closes ticket 41009. Note that until + enough clients are upgraded, relay operators will still need to + configure MyFamily lists. But once clients no longer depend on + those lists, we will be able to remove them entirely, thereby + simplifying family operation, and making microdescriptor downloads + approximately 80% smaller. For more information, see + https://community.torproject.org/relay/setup/post-install/family-ids/ + + o Major bugfixes (conflux): + - Ensure conflux guards obey family and subnet restrictions. Fixes + bug 40976; bugfix on 0.4.8.1-alpha. + + o Major bugfixes (controller events): + - Fix spikes occurring in bandwidth cache events on control connection. + Fixes bug 31524; bugfix on 0.0.9pre5. + + o Major bugfixes (sandbox): + - Fix sandbox to work on architectures that use Linux's generic + syscall interface, extending support for AArch64 (ARM64) and + adding support for RISC-V, allowing test_include.sh and the + sandbox unit tests to pass on these systems even when building + with fragile hardening enabled. Fixes bugs 40465 and 40599; bugfix + on 0.2.5.1-alpha. + + o Minor features (client security, reliability): + - When KeepaliveIsolateSOCKSAuth is keeping a circuit alive, expire + the circuit based on when it was last in use for any stream, not + (as we did before) based on when a stream was last attached to it. + Closes ticket 41157. Implements a minimal version of Proposal 368. + + o Minor features (exit relays): + - Implement reevaluating new exit policy against existing + connections. This is controlled by new config option + ReevaluateExitPolicy, defaulting to 0. Closes ticket 40676. + - Implement a token-bucket based rate limiter for stream creation + and resolve request. It is configured by the DoSStream* family of + configuration options. Closes ticket 40736. + - Add Monero ports to the ReducedExitPolicy. Closes ticket 41168. + + o Minor features (bridges): + - Save complete bridge lines to 'datadir/bridgelines'. Closes + ticket 29128. + + o Minor features (client extensibility): + - Implement new HTTPTunnelPort features for interoperability with + Arti's HTTP CONNECT proxy. This work adds new headers to requests + to and replies from the HttpConnectPort, support for OPTIONS + requests, tightens the expected syntax for Proxy-Authorization, + and increases defense-in-depth against some kinds of cross-site + HTTP attacks. Closes ticket 41156. Implements proposal 365. + - Detect invalid SOCKS5 username/password combinations according to + new extended parameters syntax. (Currently, this rejects any + SOCKS5 username beginning with "", except for the username + "0". Such usernames are now reserved to communicate + additional parameters with other Tor implementations.) Implements + proposal 351. + + o Minor features (sandboxing): + - Allow the fstatat64 and statx syscalls on i386 architecture when + glibc >= 2.33. On i386, glibc uses fstatat64 instead of newfstatat + for stat operations, and statx for time64 support. Without this, + SIGHUP configuration reload fails when using sandbox mode with + %include directives on i386 with Debian Bookworm or newer. + - Allow the lstat64 syscall on i386 architecture. This syscall is + used by glob() in glibc 2.36+ when processing %include directives + with directory patterns. + + o Minor features (security): + - Increase the size of our finite-field Diffie Hellman TLS group + (which we should never actually use!) to 2048 bits. Part of + ticket 41067. + - Require TLS version 1.2 or later. (Version 1.3 support will be + required in the near future.) Part of ticket 41067. + - Update TLS 1.2 client cipher list to match current Firefox. Part + of ticket 41067. + - Verify needle is smaller than haystack before calling memmem. + Closes ticket 40854. + + o Minor features (onion services): + - Add 3 more keywords to the ADD_ONION control command: + PoWDefensesEnabled, PoWQueueRate and PoWQueueBurst which correspond + to HiddenServicePoWDefensesEnabled, HiddenServicePoWQueueRate and + HiddenServicePoWQueueBurst from torrc. + - Reduce the minimum value of hsdir_interval to match recent tor- + spec change. + + o Minor feature (directory authority): + - Introduce MinimalAcceptedServerVersion to allow configuring + the minimum accepted relay version without requiring a new tor + release. Closes ticket 40817. + + o Minor features (metrics port): + - New metrics on the MetricsPort for the number of BUG() calls that + occurred at runtime. Fixes bugs 40839 and 41104; bugfix on + 0.4.7.1-alpha. + - Handle rephist tracking of ntor and ntor_v3 handshakes + individually such that MetricsPort exposes the correct values. + Fixes bug 40638; bugfix on 0.4.7.11. + - Add new metrics for relays on the MetricsPort namely the count of + drop cell, destroy cell and the number of circuit protocol + violation seen that lead to a circuit close. Closes ticket 40816. + + o Minor features (forward-compatibility): + - We now correctly parse microdescriptors and router descriptors + that do not include TAP onion keys. (For backward compatibility, + authorities continue to require these keys.) Implements part of + proposal 350. + + o Minor features (portability, android): + - Use /data/local/tmp for data storage on Android by default. Closes + ticket 40487. Patch from Hans-Christoph Steiner. + + o Minor features (directory authority): + - Export unsigned consensus documents once we have seen a threshold + of signatures, as a step toward the consensus transparency + experiment. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on February 12, 2026. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, + as retrieved on 2026/02/12. + + o Minor features (windows): + - Various compilation fixes for our Windows CI. Closes ticket 41214. + + o Minor bugfixes (exit relays): + - Clip every returned DNS TTL to 60 (RESOLVED) in order to mitigate + an exit DNS cache oracle. Fixes bug 40979; bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (spec conformance): + - Set the length field correctly on RELAY_COMMAND_CONFLUX_SWITCH + messages. Previously, it was always set to the maximum value. + Fixes bug 41056; bugfix on 0.4.8.1-alpha. + - Do not treat "15" as a recognized remote END reason code. + Formerly, we treated it as synonymous with a local ENTRYPOLICY, + which isn't a valid remote code at all. Fixes bug 41171; bugfix + on 0.2.0.8-alpha. + + o Minor bugfixes (tooling): + - Fix a false positive valgrind related to inspecting a bitfield + next to another uninitialized bitfield. Fixes bug 41182; bugfix + on 0.3.3.2-alpha. + - Fix minor warnings from newer versions of shellcheck and clang. + Fixes bug 41166; bugfix on 0.4.3.1-alpha and several + other versions. + - Fix a warning when compiling with GCC 14.2. Closes 41032. + + o Minor bugfixes (threads): + - Make thread control POSIX compliant. Fixes bug 41109; bugfix + on 0.4.8.17. + + o Minor bugfix (client DNS): + - Handle empty DNS reply without sending back an error and instead + send back NOERROR (RFC1035 error code 0x0). Fixes bug 40248; + bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (directory authorities): + - After we added layer-two vanguards, directory authorities wouldn't + think any of their vanguards were suitable for circuits, leading + to a "Failed to find node for hop #2 of our path. Discarding this + circuit." log message once per second from startup until they made + a fresh consensus. Now they look to their existing consensus on + startup, letting them build circuits properly from the beginning. + Fixes bug 40802; bugfix on 0.4.7.1-alpha. + + o Minor bugfixes (tests): + - Fix a test failure with OpenSSL builds running at security level 1 + or greater, which does not permit SHA-1 certificates. Fixes bug + 41021; bugfix on 0.2.8.1-alpha. + + o Minor bugfixes (bridges): + - Don't warn when BridgeRelay is 1 and ExitRelay is explicitly set + to 0. Fixes bug 40884; bugfix on 0.4.8.3-rc. + + o Minor bugfixes (conflux, client): + - Avoid a non fatal assert caused by data coming in on a conflux set + that is being freed during shutdown. Fixes bug 40870; bugfix + on 0.4.8.1-alpha. + + o Minor bugfixes (testing network): + - Enabling TestingTorNetwork no longer forces fast hidden service + intro point rotation. This reduces noise and errors when using + hidden services with TestingTorNetwork enabled. Fixes bug 40922; + bugfix on 0.3.2.1-alpha. + + o Minor bugfixes (relay): + - Refuse to overwrite an existing *.secret_family_key when running + tor --keygen-family. Fixes bug 41184; bugfix on 0.4.9.1-alpha. + + o New system requirements: + - When built with LibreSSL, Tor now requires LibreSSL 3.7 or later. + Part of ticket 41059. + - When built with OpenSSL, Tor now requires OpenSSL 1.1.1 or later. + (We strongly recommend 3.0 or later, but still build with 1.1.1, + even though it is not supported by the OpenSSL team, due to its + presence in Debian oldstable.) Part of ticket 41059. + + o Removed features (relays): + - Relays no longer support clients that falsely advertise TLS + ciphers they don't really support. (Clients have not done this + since 0.2.3.17-beta). Part of ticket 41031. + - Relays no longer support clients that require obsolete v1 and v2 + link handshakes. (The v3 link handshake has been supported since + 0.2.3.6-alpha). Part of ticket 41031. + - Relays no longer support the obsolete TAP circuit extension + protocol. (For backward compatibility, however, relays still + continue to include TAP keys in their descriptors.) Implements + part of proposal 350. + - Relays no longer support the obsolete "RSA-SHA256-TLSSecret" + authentication method, which used a dangerously short RSA key, and + which required access TLS session internals. The current method + ("Ed25519-SHA256-RFC5705") has been supported since 0.3.0.1-alpha. + Closes ticket 41020. + + o Removed features (directory authorities): + - Directory authorities no longer support consensus methods before + method 32. Closes ticket 40835. + - We include a new consensus method that removes support for + computing "package" lines in consensus documents. This feature was + never used, and support for including it in our votes was removed + in 0.4.2.1-alpha. Finishes implementation of proposal 301. + + +Changes in version 0.4.9.4-rc - 2026-01-28 + Finally, the release candidate for the 0.4.9.x series. It consists of minor + features and several bugfixes. Nothing major has been added since the alpha. + If everything goes well, the next version will be the first stable. + + o Minor features (security, reliability): + - When KeepaliveIsolateSOCKSAuth is keeping a circuit alive, expire + the circuit based on when it was last in use for any stream, not + (as we did before) based on when a stream was last attached to it. + Closes ticket 41157. Implements a minimal version of Proposal 368. + + o Minor feature (Exit): + - Add Monero ports to the ReducedExitPolicy. Closes ticket 41168. + + o Minor features (HTTPTunnelPort): + - Implement new HTTPTunnelPort features for interoperability with + Arti's HTTP CONNECT proxy. This work adds new headers to requests + to and replies from the HttpConnectPort, support for OPTIONS + requests, tightens the expected syntax for Proxy-Authorization, + and increases defense-in-depth against some kinds of cross-site + HTTP attacks. Closes ticket 41156. Implements proposal 365. + + o Minor features (linux seccomp2 sandbox): + - Allow the fstatat64 and statx syscalls on i386 architecture when + glibc >= 2.33. On i386, glibc uses fstatat64 instead of newfstatat + for stat operations, and statx for time64 support. Without this, + SIGHUP configuration reload fails when using sandbox mode with + %include directives on i386 with Debian Bookworm or newer. + - Allow the lstat64 syscall on i386 architecture. This syscall is + used by glob() in glibc 2.36+ when processing %include directives + with directory patterns. + + o Minor bugfixes (DNS, exit): + - Clip every returned DNS TTL to 60 (RESOLVED) in order to mitigate + an exit DNS cache oracle. Fixes bug 40979; bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (spec conformance): + - Do not treat "15" as a recognized remote END reason code. + Formerly, we treated it as synonymous with a local ENTRYPOLICY, + which isn't a valid remote code at all. Fixes bug 41171; bugfix + on 0.2.0.8-alpha. + + o Minor bugfixes (tooling): + - Fix a false positive valgrind related to inspecting a bitfield + next to another uninitialized bitfield. Fixes bug 41182; bugfix + on 0.3.3.2-alpha. + + o Minor bugfixes (warnings): + - Fix minor warnings from newer versions of shellcheck and clang. + Fixes bug 41166; bugfix on 0.4.3.1-alpha and several + other versions. + + +Changes in version 0.4.8.22 - 2026-01-28 + This is likely the very last release of the 0.4.8.x series. Three major + bugfixes detailed below including two affecting directory servers (basically + all relays). We strongly recommend upgrading as soon as possible. + + o Major bugfixes (security): + - Avoid an out-of-bounds read error that could occur with + V1-formatted EXTEND cells. Fixes bug 41180; bugfix on 0.4.8.1-alpha. + This is tracked as TROVE-2025-016. + + o Major bugfixes (directory servers): + - Allow old clients to fetch the consensus even if they use version + 0 of the SENDME protocol. In mid 2025 we changed the required + minimum version of the "FlowCtrl" protocol to 1, meaning directory + caches hang up on clients that send a version 0 SENDME cell. Since + old clients were no longer able to retrieve the consensus, they + couldn't learn about this required minimum version -- meaning + we've had many many old clients loading down directory servers for + the past months. Fixes bug 41191; bugfix on 0.4.1.1-alpha. + - Don't count networkstatus serves until they finish. When we + started serving a consensus document but the client didn't receive + all of it, we were still counting that as a success in our stats. + This mistake, which can be triggered for example by obsolete + clients or by DPI-based censorship, led to wildly inflated user + counts because we estimate total users in the world based on + successful consensus fetches. Fixes bug 41192; bugfix + on 0.2.1.1-alpha. + + o Minor feature (testing, CI): + - Bump the CI version of chutney to the current version as of + 2026-01-21 (3338f5c). + + o Minor features (debugging, compression): + - Do not check for compression bombs for buffers smaller than 5MB + (increased from 64 KB). Fixes ticket 40739; bugfix on 0.2.1.29. + + o Minor features (directory servers): + - Track how many times directory servers begin serving networkstatus + documents, so we can compare it to the number of times we finish + serving them. Motivated by the fixes in ticket 41192. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on January 28, 2026. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2026/01/28. + + o Minor bugfixes (relay): + - Downgrade "Error relaying cell across rendezvous" log warn to info + as the error condition is possible under normal circumstances. Fixes + bug 40951; bugfix on 0.3.5.1-alpha. + + o Code simplification and refactoring: + - Simplify SOCKS4a parsing to avoid the (false) appearance of + integer underflows, and to make the logic more obvious. Fixes bug + 41190; bugfix on 0.3.5.1-alpha. + + +Changes in version 0.4.8.21 - 2025-11-17 + This release is a continuation of the previous one and addresses additional + Conflux-related issues identified through further testing and feedback from + relay operators. We strongly recommend upgrading as soon as possible. + + o Major bugfixes (conflux, exit): + - When dequeuing out-of-order conflux cells, the circuit could be + closed in between two dequeues, which could lead to mishandling + a NULL pointer. Fixes bug 41162; bugfix on 0.4.8.4. + + o Minor feature (compiler flag): + - Add -mbranch-protection=standard for arm64. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on November 17, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/11/17. + + o Minor bugfixes (bridges, pluggable transport): + - Fix a bug causing the initial tor process to hang instead of + exiting with RunAsDaemon, when pluggable transports are used. + Fixes bug 41088; bugfix on 0.4.8.1-alpha. + + +Changes in version 0.4.8.20 - 2025-11-10 + This release fixes several bugs related to Conflux edge cases as well as + adding a new hardening compiler flag if supported. + + o Minor feature (compiler flag): + - Add -fcf-protection=full if supported by the compiler. + Implements ticket 41139. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on November 10, 2025. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/11/10. + + o Minor bugfixes (conflux fragile asserts): + - Fix the root cause of some conflux fragile asserts when a control + port listener is attached. Fixes bug 41037; bugfix on 0.4.8.16. + + o Minor bugfixes (conflux, relay): + - Fix a series of conflux edge cases about sequence number + arithmetic and OOM handler kicking in under heavy memory pressure. + Fixes bug 41155; bugfix on 0.4.8.4. + + +Changes in version 0.4.8.19 - 2025-10-06 + This release provides major bugfixes for a LibreSSL issue and a flow control + C-tor specific problem (not protocol). We strongly recommend you upgrade as + soon as possible. + + o Major bugfixes (client, TLS): + - Fix some clients not being able to connect to LibreSSL relays. + Fixes bug 41134; bugfix on 0.4.8.17. + + o Minor bugfixes (stream flow control performance): + - Use a 5 ms grace period to allow an edge connection to flush its + stream data to the socket before sending an XOFF. This + significantly reduces the number of XON/XOFF messages sent when + (1) the application is reading stream data at a fast rate, and (2) + conflux is enabled. Fixes part of bug 41130; bugfix on 0.4.7.2-alpha. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on October 06, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/10/06. + + o Minor bugfix (process): + - Avoid closing all possible FDs when spawning a process (PT). On + some systems, this could lead to 3+ minutes hang. Fixes bug 40990; + bugfix on 0.3.5.1-alpha. + + +Changes in version 0.4.9.3-alpha - 2025-09-16 + This is the third alpha release and likely the last before going stable. + This release contains the new CGO circuit encryption. See proposal 359 for + more details. Several TLS minor fixes which will strengthen the link + security. + + o New system requirements: + - When built with LibreSSL, Tor now requires LibreSSL 3.7 or later. + Part of ticket 41059. + - When built with OpenSSL, Tor now requires OpenSSL 1.1.1 or later. + (We strongly recommend 3.0 or later, but still build with 1.1.1, + even though it is not supported by the OpenSSL team, due to its + presence in Debian oldstable.) Part of ticket 41059. + + o Major features (cell format): + - Tor now has (unused) internal support to encode and decode relay + messages in the new format required by our newer CGO encryption + algorithm. Closes ticket 41051. Part of proposal 359. + + o Major features (cryptography): + - Clients and relays can now negotiate Counter Galois Onion (CGO) + relay cryptography, as designed by Jean Paul Degabriele, + Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam. CGO + provides improved resistance to several kinds of tagging attacks, + better forward secrecy, and better forgery resistance. Closes + ticket 41047. Implements proposal 359. + + o Major bugfixes (onion service directory cache): + - Preserve the download counter of an onion service descriptor + across descriptor uploads, so that recently updated descriptors + don't get pruned if there is memory pressure soon after update. + Additionally, create a separate torrc option MaxHSDirCacheBytes + that defaults to the former 20% of MaxMemInQueues threshold, but + can be controlled by relay operators under DoS. Also enforce this + threshold during HSDir uploads. Fixes bug 41006; bugfix + on 0.4.8.14. + + o Minor features (security): + - Increase the size of our finite-field Diffie Hellman TLS group + (which we should never actually use!) to 2048 bits. Part of + ticket 41067. + - Require TLS version 1.2 or later. (Version 1.3 support will be + required in the near future.) Part of ticket 41067. + - Update TLS 1.2 client cipher list to match current Firefox. Part + of ticket 41067. + + o Minor features (security, TLS): + - When we are running with OpenSSL 3.5.0 or later, support using the + ML-KEM768 for post-quantum key agreement. Closes ticket 41041. + + o Minor feature (client, TLS): + - Set the TLS 1.3 cipher list instead of falling back on the + default value. + + o Minor feature (padding, logging): + - Reduce the amount of messages being logged related to channel + padding timeout when log level is "notice". + + o Minor features (bridges): + - Save complete bridge lines to 'datadir/bridgelines'. Closes + ticket 29128. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on September 16, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/09/16. + + o Minor features (hidden services): + - Reduce the minimum value of hsdir_interval to match recent tor- + spec change. + + o Minor features (hsdesc POW): + - Tolerate multiple PoW schemes in onion service descriptors, for + future extensibility. Implements torspec ticket 272. + + o Minor features (performance TLS): + - When running with with OpenSSL 3.0.0 or later, support using + X25519 for TLS key agreement. (This should slightly improve + performance for TLS session establishment.) + + o Minor features (portability): + - Fix warnings when compiling with GCC 15. Closes ticket 41079. + + o Minor bugfix (conflux): + - Remove the pending nonce if we realize that the nonce of the + unlinked circuit is not tracked anymore. Should avoid the non + fatal assert triggered with a control port circuit event. Fixes + bug 41037; bugfix on 0.4.8.15. + + o Minor bugfixes (bridges, pluggable transport): + - Fix a bug causing the initial tor process to hang instead of + exiting with RunAsDaemon, when pluggable transports are used. + Fixes bug 41088; bugfix on 0.4.9.1-alpha. + + o Minor bugfixes (circuit handling): + - Prevent circuit_mark_for_close() from being called twice on the + same circuit. Fixes bug 40951; bugfix on 0.4.8.16-dev. + - Prevent circuit_mark_for_close() from being called twice on the + same circuit. Second fix attempt Fixes bug 41106; bugfix + on 0.4.8.17 + + o Minor bugfixes (compilation): + - Fix linking on systems without a working stdatomic.h. Fixes bug + 41076; bugfix on 0.4.9.1-alpha. + + o Minor bugfixes (compiler warnings): + - Make sure the two bitfields in the half-closed edge struct are + unsigned, as we're using them for boolean values and assign 1 to + them. Fixes bug 40911; bugfix on 0.4.7.2-alpha. + + o Minor bugfixes (logging, metrics port): + - Count BUG statements for the MetricsPort only if they are warnings + or errors. Fixes bug 41104; bugfix on 0.4.7.1-alpha. Patch + contributed by shadowcoder. + + o Minor bugfixes (protocol): + - Set the length field correctly on RELAY_COMMAND_CONFLUX_SWITCH + messages. Previously, it was always set to the maximum value. + Fixes bug 41056; bugfix on 0.4.8.1-alpha. + + o Minor bugfixes (relay): + - Fix a crash when FamilyKeyDir is a path that cannot be read. Fixes + bug 41043; bugfix on 0.4.9.2-alpha. + + o Minor bugfixes (threads): + - Make thread control POSIX compliant. Fixes bug 41109; bugfix + on 0.4.8.17-dev. + + o Removed features: + - Relays no longer support clients that falsely advertise TLS + ciphers they don't really support. (Clients have not done this + since 0.2.3.17-beta). Part of ticket 41031. + - Relays no longer support clients that require obsolete v1 and v2 + link handshakes. (The v3 link handshake has been supported since + 0.2.3.6-alpha). Part of ticket 41031. + + +Changes in version 0.4.8.18 - 2025-09-16 + This is a minor release with a major onion service directory cache (HSDir) + bug fix. A series of minor bugfixes as well. As always, we strongly recommend + to upgrade as soon as possible. + + o Major bugfixes (onion service directory cache): + - Preserve the download counter of an onion service descriptor + across descriptor uploads, so that recently updated descriptors + don't get pruned if there is memory pressure soon after update. + Additionally, create a separate torrc option MaxHSDirCacheBytes + that defaults to the former 20% of MaxMemInQueues threshold, but + can be controlled by relay operators under DoS. Also enforce this + threshold during HSDir uploads. Fixes bug 41006; bugfix + on 0.4.8.14. + + o Minor feature (padding, logging): + - Reduce the amount of messages being logged related to channel + padding timeout when log level is "notice". + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on September 16, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/09/16. + + o Minor bugfix (conflux): + - Remove the pending nonce if we realize that the nonce of the + unlinked circuit is not tracked anymore. Should avoid the non + fatal assert triggered with a control port circuit event. Fixes + bug 41037; bugfix on 0.4.8.15. + + o Minor bugfixes (circuit handling): + - Prevent circuit_mark_for_close() from being called twice on the + same circuit. Second fix attempt Fixes bug 41106; bugfix + on 0.4.8.17. + + +Changes in version 0.4.8.17 - 2025-06-30 + This is a minor providing a series of minor features especially in the realm + of TLS. It also brings a new set of recommended and required sub protocols. + And finally, few minor bugfixes, nothing major. As always, we strongly + recommend you upgrade as soon as possible. + + o Minor features (security, TLS): + - When we are running with OpenSSL 3.5.0 or later, support using the + ML-KEM768 for post-quantum key agreement. Closes ticket 41041. + + o Minor feature (client, TLS): + - Set the TLS 1.3 cipher list instead of falling back on the + default value. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on June 30, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/06/30. + + o Minor features (hsdesc POW): + - Tolerate multiple PoW schemes in onion service descriptors, for + future extensibility. Implements torspec ticket 272. + + o Minor features (performance TLS): + - When running with with OpenSSL 3.0.0 or later, support using + X25519 for TLS key agreement. (This should slightly improve + performance for TLS session establishment.) + + o Minor features (portability): + - Fix warnings when compiling with GCC 15. Closes ticket 41079. + + o Minor features (recommended protocols): + - Directory authorities now vote to recommend that clients support + certain protocols beyond those that are required. These include + improved support for connecting to relays on IPv6, NtorV3, and + congestion control. Part of ticket 40836. + + o Minor features (required protocols): + - Directory authorities now vote to require clients to support the + authenticated SENDME feature, which was introduced in + 0.4.1.1-alpha. Part of ticket 40836. + - Directory authorities now vote to require relays to support + certain protocols, all of which have been implemented since + 0.4.7.4-alpha or earlier. These include improved support for + connecting to relays on IPv6, NtorV3, running as a rate-limited + introduction point, authenticated SENDMEs, and congestion control. + Part of ticket 40836. + + o Minor bugfix (conflux): + - Avoid a non fatal assert when describing a conflux circuit on the + control port after being prepped to be freed. Fixes bug 41037; + bugfix on 0.4.8.15. + + o Minor bugfixes (circuit handling): + - Prevent circuit_mark_for_close() from being called twice on the + same circuit. Fixes bug 40951; bugfix on 0.4.8.16-dev. + + o Minor bugfixes (compiler warnings): + - Make sure the two bitfields in the half-closed edge struct are + unsigned, as we're using them for boolean values and assign 1 to + them. Fixes bug 40911; bugfix on 0.4.7.2-alpha. + + o Minor bugfixes (threads, memory): + - Improvements in cleanup of resources used by threads. Fixes bug + 40991; bugfix on 0.4.8.13-dev. + - Rework start and exit of worker threads. + + +Changes in version 0.4.9.2-alpha - 2025-04-02 + This is the second alpha of the 0.4.9.x series. We have several new minor + features and a big one, the happy families that was long awaited by relay + operators. This release also fixes a number of bugs including major ones. + + o Major feature (happy families): + - Clients and relays now support "happy families", a system to + simplify relay family operation and improve directory performance. + With "happy families", relays in a family shares a secret "family + key", which they use to prove their membership in the family. + Implements proposal 321; closes ticket 41009. Note that until + enough clients are upgraded, relay operators will still need to + configure MyFamily lists. But once clients no longer depend on + those lists, we will be able to remove them entirely, thereby + simplifying family operation, and making microdescriptor downloads + approximately 80% smaller. For more information, see + https://community.torproject.org/relay/setup/post-install/family-ids/ + + o Major features (client): + - Clients now respect "happy families" per proposal 321. This + feature will eventually allow a much more compact representation + for relay families, for a significant savings in directory + download size. + + o Minor feature (onion service, control port): + - Add 3 more keywords to the ADD_ONION control command: + PoWDefensesEnabled, PoWQueueRate and PoWQueueBurst which correspond + to HiddenServicePoWDefensesEnabled, HiddenServicePoWQueueRate and + HiddenServicePoWQueueBurst from torrc. + + o Minor feature (testing, CI): + - Use a fixed version of chutney (be881a1e) instead of its current + HEAD. This version should also be preferred when testing locally. + + o Minor features (compilation): + - Fix a warning when compiling with GCC 14.2. Closes 41032. + + o Minor features (continuous integration): + - Upgrade CI runners to use Debian Bookworm instead of Bullseye. + Closes ticket 41029. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on February 05, 2025. + - Regenerate fallback directories generated on March 20, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/02/05. + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/03/20. + - Update the geoip files to match the IPFire Location Database, as retrieved on 2025/03/24. + o Minor features (recommended protocols): + - Directory authorities now vote to recommend that clients support + certain protocols beyond those that are required. These include + improved support for connecting to relays on IPv6, NtorV3, and + congestion control. Part of ticket 40836. + + o Minor features (required protocols): + - Directory authorities now vote to require clients to support the + authenticated SENDME feature, which was introduced in + 0.4.1.1-alpha. Part of ticket 40836. + - Directory authorities now vote to require relays to support + certain protocols, all of which have been implemented since + 0.4.7.4-alpha or earlier. These include improved support for + connecting to relays on IPv6, NtorV3, running as a rate-limited + introduction point, authenticated SENDMEs, and congestion control. + Part of ticket 40836. + + o Major bugfix (control-events, bw-cache): + - Fixes spikes occurring in bandwidth cache on control connection. + Fixes bug 31524; bugfix on 0.4.8.12-dev. + + o Major bugfixes (conflux): + - Ensure conflux guards obey family and subnet restrictions. Fixes + bug 40976; bugfix on 0.4.8.13. + + o Major bugfixes (onion service directory cache): + - When the OOM killer kicks in, cleanup the descriptor cache of an + HSDir by looking at the lowest downloaded count instead of time in + cache. Fixes bug 40996; bugfix on 0.3.5.1-alpha. + + o Minor bugfix (client DNS): + - Handle empty DNS reply without sending back an error and instead + send back NOERROR (RFC1035 error code 0x0). Fixes bug 40248; + bugfix on 0.3.5.1-alpha. + + o Minor bugfix (conflux): + - Avoid a non fatal assert when describing a conflux circuit on the + control port after being prepped to be freed. Fixes bug 41037; + bugfix on 0.4.8.15. + o Minor bugfix (dirauth): - Fix typo in flag assignment approved-routers file. Fixes bug 41035; bugfix on 0.4.8.15 + o Minor bugfixes (control port): + - Correctly report conflux pair information to controller fields + Fixes bug 40872; bugfix on 0.4.8.1-alpha + + o Minor bugfixes (directory authorities): + - After we added layer-two vanguards, directory authorities wouldn't + think any of their vanguards were suitable for circuits, leading + to a "Failed to find node for hop #2 of our path. Discarding this + circuit." log message once per second from startup until they made + a fresh consensus. Now they look to their existing consensus on + startup, letting them build circuits properly from the beginning. + Fixes bug 40802; bugfix on 0.4.7.1-alpha. + + o Minor bugfixes (relay flag usage): + - Fix client usage of the MiddleOnly flag so that MiddleOnly relays + are not used as HS IP or RP by clients or services. Additionally, + give dirauths the ability to remove specific flags, as an + alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha + + o Minor bugfixes (sandbox, bwauth): + - Fix sandbox to work for bandwidth authority. Fixes bug 40933; + bugfix on 0.2.2.1-alpha + + o Minor bugfixes (tests): + - Fix a test failure with OpenSSL builds running at security level 1 + or greater, which does not permit SHA-1 certificates. (Fixes bug + 41021; bugfix on 0.2.8.1-alpha.) + + o Minor bugfixes (threads, memory): + - Improvements in cleanup of resources used by threads. Fixes bug + 40991; bugfix on 0.4.8.13-dev. + - Rework start and exit of worker threads. + + o Removed features: + - Relays no longer support the obsolete "RSA-SHA256-TLSSecret" + authentication method, which used a dangerously short RSA key, and + which required access TLS session internals. The current method + ("Ed25519-SHA256-RFC5705") has been supported since 0.3.0.1-alpha. + Closes ticket 41020. + + +Changes in version 0.4.8.16 - 2025-03-24 + This is a quick second release since 0.4.8.15 due to a typo in a directory + authority rule file. This only affects directory authorities. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/03/24. + + o Minor bugfix (dirauth): + - Fix typo in flag assignment approved-routers file. Fixes bug + 41035; bugfix on 0.4.8.15. + + Changes in version 0.4.8.15 - 2025-03-20 This is a minor release fixing a sandbox issue for bandwidth authority and a conflux issue on the control port. It also has a client fix about relay flag - usage. We strongly recommend to update as soon as possible as usual. + usage. o Minor feature (testing, CI): - Use a fixed version of chutney (be881a1e) instead of its current @@ -32,18 +884,18 @@ retrieved on 2025/03/20. o Minor bugfixes (control port): - - Correctly report conflux pair information to controller fields - Fixes bug 40872; bugfix on 0.4.8.1-alpha + - Correctly report conflux pair information to controller fields. + Fixes bug 40872; bugfix on 0.4.8.1-alpha. o Minor bugfixes (relay flag usage): - Fix client usage of the MiddleOnly flag so that MiddleOnly relays are not used as HS IP or RP by clients or services. Additionally, give dirauths the ability to remove specific flags, as an - alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha + alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha. o Minor bugfixes (sandbox, bwauth): - Fix sandbox to work for bandwidth authority. Fixes bug 40933; - bugfix on 0.2.2.1-alpha + bugfix on 0.2.2.1-alpha. Changes in version 0.4.8.14 - 2025-02-05 @@ -74,9 +926,142 @@ 40989; bugfix on 0.4.8.13. +Changes in version 0.4.9.1-alpha - 2024-12-03 + This is the first alpha of the 0.4.9.x series. This release mostly consists + of bugfixes including some major ones. There are several minor features in + this release but no large new subsystem. + + o Major bugfixes (sandbox): + - Fix sandbox to work on architectures that use Linux's generic + syscall interface, extending support for AArch64 (ARM64) and + adding support for RISC-V, allowing test_include.sh and the + sandbox unit tests to pass on these systems even when building + with fragile hardening enabled. Fixes bugs 40465 and 40599; bugfix + on 0.2.5.1-alpha. + + o Minor feature (defense in depth): + - Verify needle is smaller than haystack before calling memmem. + Closes ticket 40854. + + o Minor feature (directory authority): + - Introduce MinimalAcceptedServerVersion to allow modification of + minimal accepted version for relays without requiring a new tor + release. Closes ticket 40817. + + o Minor feature (exit policies): + - Implement reevaluating new exit policy against existing + connections. This is controlled by new config option + ReevaluateExitPolicy, defaulting to 0. Closes ticket 40676. + + o Minor feature (exit relay, DoS resistance): + - Implement a token-bucket based rate limiter for stream creation + and resolve request. It is configured by the DoSStream* family of + configuration options. Closes ticket 40736. + + o Minor feature (metrics port): + - New metrics on the MetricsPort for the number of BUG() that + occurred at runtime. Closes MR 760. + + o Minor feature (metrics port, relay): + - Add new metrics for relays on the MetricsPort namely the count of + drop cell, destroy cell and the number of circuit protocol + violation seen that lead to a circuit close. Closes ticket 40816. + + o Minor feature (testing): + - test-network now unconditionally includes IPv6 instead of trying + to detect IPv6 support. + + o Minor feature (testing, CI): + - Use a fixed version of chutney (be881a1e) instead of its current + HEAD. This version should also be preferred when testing locally. + + o Minor features (forward-compatibility): + - We now correctly parse microdescriptors and router descriptors + that do not include TAP onion keys. (For backward compatibility, + authorities continue to require these keys.) Implements part of + proposal 350. + + o Minor features (portability, android): + - Use /data/local/tmp for data storage on Android by default. Closes + ticket 40487. Patch from Hans-Christoph Steiner. + + o Minor features (SOCKS): + - Detect invalid SOCKS5 username/password combinations according to + new extended parameters syntax. (Currently, this rejects any + SOCKS5 username beginning with "", except for the username + "0". Such usernames are now reserved to communicate + additional parameters with other Tor implementations.) Implements + proposal 351. + + o Minor bugfix (MetricsPort, relay): + - Handle rephist tracking of ntor and ntor_v3 handshakes + individually such that MetricsPort exposes the correct values. + Fixes bug 40638; bugfix on 0.4.7.11. + + o Minor bugfix (process): + - Avoid closing all possible FDs when spawning a process (PT). On + some systems, this could lead to 3+ minutes hang. Fixes bug 40990; + bugfix on 0.3.5.1-alpha. + + o Minor bugfix (relay, sandbox): + - Disable a sandbox unit test that is failing on Debian Sid breaking + our nightly packages. Fixes bug 40918; bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (bridge): + - Don't warn when BridgeRelay is 1 and ExitRelay is explicitly set + to 0. Fixes bug 40884; bugfix on 0.4.8.3-rc. + + o Minor bugfixes (compiler warnings): + - Make sure the two bitfields in the half-closed edge struct are + unsigned, as we're using them for boolean values and assign 1 to + them. Fixes bug 40911; bugfix on 0.4.7.2-alpha. + + o Minor bugfixes (conflux, client): + - Avoid a non fatal assert caused by data coming in on a conflux set + that is being freed during shutdown. Fixes bug 40870; bugfix + on 0.4.8.1-alpha. + + o Minor bugfixes (memory): + - Fix a pointer free that wasn't set to NULL afterwards which could + be reused by calling back in the free all function. Fixes bug + 40989; bugfix on 0.4.8.13. + + o Minor bugfixes (sandbox, bwauth): + - Fix sandbox to work for bandwidth authority. Fixes bug 40933; + bugfix on 0.2.2.1-alpha + + o Minor bugfixes (testing): + - Enabling TestingTorNetwork no longer forces fast hidden service + intro point rotation. This reduces noise and errors when using + hidden services with TestingTorNetwork enabled. Fixes bug 40922; + bugfix on 0.3.2.1-alpha. + + o Minor bugfixes (tor-resolve): + - Create socket with correct family as given by sockshost, fixes + IPv6. Fixes bug 40982; bugfix on 0.4.9.0-alpha. + + o Removed features: + - Directory authorities no longer support consensus methods before + method 32. Closes ticket 40835. + + o Removed features (directory authority): + - We include a new consensus method that removes support for + computing "package" lines in consensus documents. This feature was + never used, and support for including it in our votes was removed + in 0.4.2.1-alpha. Finishes implementation of proposal 301. + + o Removed features (obsolete): + - Relays no longer support the obsolete TAP circuit extension + protocol. (For backward compatibility, however, relays still + continue to include TAP keys in their descriptors.) Implements + part of proposal 350. + - Removed some vestigial code for selecting the TAP circuit + extension protocol. + + Changes in version 0.4.8.13 - 2024-10-24 - This is minor release fixing an important client circuit building (Conflux - related) bug which lead to performance degradation and extra load on the + This minor release fixes an important client circuit building (conflux + related) bug which led to performance degradation and extra load on the network. Some minor memory leaks fixes as well as an important minor feature for pluggable transports. We strongly recommend to update as soon as possible for clients in order to neutralize this conflux bug. @@ -89,7 +1074,7 @@ which added overall load to the network, used bandwidth and battery from clients that weren't actively using their Tor, and kept sockets open on guards which added connection padding - essentially forever. Fixes bug 40981; bugfix on 0.4.8.1-alpha; + essentially forever. Fixes bug 40981; bugfix on 0.4.8.1-alpha. o Minor feature (bridges, pluggable transport): - Add STATUS TYPE=version handler for Pluggable Transport. This @@ -143,11 +1128,11 @@ Changes in version 0.4.8.11 - 2024-04-10 - This is a minor release mostly to upgrade the fallbackdir list. Worth noting - also that directory authority running this version will now automatically + This is a minor release mostly to upgrade the fallbackdir list. + Directory authorities running this version will now automatically reject relays running the end of life 0.4.7.x version. - o Minor feature (authority): + o Minor features (directory authorities): - Reject 0.4.7.x series at the authority level. Closes ticket 40896. o Minor feature (dirauth, tor26): @@ -180,7 +1165,7 @@ o Major bugfixes (TROVE-2023-007, exit): - Improper error propagation from a safety check in conflux leg - linking lead to a desynchronization of which legs were part of a + linking led to a desynchronization of which legs were part of a conflux set, ultimately causing a UAF and NULL pointer dereference crash on Exit relays. Fixes bug 40897; bugfix on 0.4.8.1-alpha. @@ -192,8 +1177,8 @@ retrieved on 2023/12/08. o Minor bugfixes (bridges, statistics): - - Correctly report statistics for client count over Pluggable - transport. Fixes bug 40871; bugfix on 0.4.8.4 + - Correctly report statistics for client count over pluggable + transports. Fixes bug 40871; bugfix on 0.4.8.4. Changes in version 0.4.8.9 - 2023-11-09 @@ -215,7 +1200,7 @@ o Major bugfixes (onion service, TROVE-2023-006): - Fix a possible hard assert on a NULL pointer when recording a failed rendezvous circuit on the service side for the MetricsPort. - Fixes bug 40883; bugfix on 0.4.8.1-alpha + Fixes bug 40883; bugfix on 0.4.8.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 09, 2023. @@ -228,7 +1213,7 @@ Changes in version 0.4.8.8 - 2023-11-03 We are releasing today a fix for a high security issue, TROVE-2023-004, that is affecting relays. Also a few minor bugfixes detailed below. Please upgrade - as soon as posssible. + as soon as possible. o Major bugfixes (TROVE-2023-004, relay): - Mitigate an issue when Tor compiled with OpenSSL can crash during @@ -271,11 +1256,10 @@ Changes in version 0.4.8.6 - 2023-09-18 - This version contains an important fix for onion service regarding congestion - control and its reliability. Apart from that, uneeded BUG warnings have been - suppressed especially about a compression bomb seen on relays. We strongly - recommend, in particular onion service operators, to upgrade as soon as - possible to this latest stable. + This version contains an important fix for onion services regarding + congestion control and its reliability. Apart from that, unneeded BUG + warnings have been suppressed especially about a compression bomb seen + on relays. o Major bugfixes (onion service): - Fix a reliability issue where services were expiring their @@ -468,7 +1452,7 @@ o Minor bugfixes (conflux): - Count leg launch attempts prior to attempting to launch them. This - avoids inifinite launch attempts due to internal circuit building + avoids infinite launch attempts due to internal circuit building failures. Additionally, double-check that we have enough exits in our consensus overall, before attempting to launch conflux sets. Fixes bug 40811; bugfix on 0.4.8.1-alpha. @@ -674,7 +1658,7 @@ o Major bugfixes (congestion control): - Avoid incrementing the congestion window when the window is not - fully in use. Thia prevents overshoot in cases where long periods + fully in use. This prevents overshoot in cases where long periods of low activity would allow our congestion window to grow, and then get followed by a burst, which would cause queue overload. Also improve the increment checks for RFC3742. Fixes bug 40732; diff -Nru tor-0.4.8.16/LICENSE tor-0.4.9.6/LICENSE --- tor-0.4.8.16/LICENSE 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/LICENSE 2026-03-25 14:30:34.000000000 +0000 @@ -383,6 +383,33 @@ or promote products derived from this Software. =============================================================================== +Parts of src/ext/polyval are based on Thomas Pornin's GHASH implementation in +BearSSL, and distributed under the following license: + + Copyright (c) 2016 Thomas Pornin + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + SOFTWARE. + + +=============================================================================== If you got Tor as a static binary with OpenSSL included, then you should know: "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)" diff -Nru tor-0.4.8.16/Makefile.am tor-0.4.9.6/Makefile.am --- tor-0.4.8.16/Makefile.am 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/Makefile.am 2026-03-25 14:30:34.000000000 +0000 @@ -50,12 +50,12 @@ src/lib/libtor-sandbox.a \ src/lib/libtor-container.a \ src/lib/libtor-net.a \ - src/lib/libtor-thread.a \ src/lib/libtor-memarea.a \ src/lib/libtor-math.a \ src/lib/libtor-meminfo.a \ src/lib/libtor-osinfo.a \ src/lib/libtor-log.a \ + src/lib/libtor-thread.a \ src/lib/libtor-lock.a \ src/lib/libtor-fdio.a \ src/lib/libtor-string.a \ @@ -86,13 +86,13 @@ src/lib/libtor-sandbox-testing.a \ src/lib/libtor-container-testing.a \ src/lib/libtor-net-testing.a \ - src/lib/libtor-thread-testing.a \ src/lib/libtor-memarea-testing.a \ src/lib/libtor-math-testing.a \ src/lib/libtor-meminfo-testing.a \ src/lib/libtor-osinfo-testing.a \ src/lib/libtor-term-testing.a \ src/lib/libtor-log-testing.a \ + src/lib/libtor-thread-testing.a \ src/lib/libtor-lock-testing.a \ src/lib/libtor-fdio-testing.a \ src/lib/libtor-string-testing.a \ @@ -112,7 +112,8 @@ src/lib/libtor-tls.a \ src/lib/libtor-crypt-ops.a \ $(LIBKECCAK_TINY) \ - $(LIBDONNA) + $(LIBDONNA) \ + $(LIBPOLYVAL) if BUILD_MODULE_POW TOR_CRYPTO_LIBS += $(EQUIX_LIBS) @@ -126,6 +127,7 @@ src/lib/libtor-crypt-ops-testing.a \ $(LIBKECCAK_TINY) \ $(LIBDONNA) \ + $(LIBPOLYVAL) \ $(EQUIX_LIBS) endif diff -Nru tor-0.4.8.16/Makefile.in tor-0.4.9.6/Makefile.in --- tor-0.4.8.16/Makefile.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/Makefile.in 2026-03-25 14:30:34.000000000 +0000 @@ -221,11 +221,11 @@ @UNITTESTS_ENABLED_TRUE@am__append_60 = src/core/libtor-app-testing.a @USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@am__append_61 = \ -@USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@ src/core/or/trace_probes_cc.c \ +@USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@ src/core/or/trace_probes_cc.c \ @USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@ src/core/or/trace_probes_circuit.c @USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@am__append_62 = \ -@USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@ src/core/or/trace_probes_cc.h \ +@USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@ src/core/or/trace_probes_cc.h \ @USE_TRACING_INSTRUMENTATION_LTTNG_TRUE@ src/core/or/trace_probes_circuit.h @BUILD_MODULE_DIRAUTH_TRUE@am__append_63 = $(MODULE_DIRAUTH_SOURCES) @@ -257,7 +257,7 @@ @COVERAGE_ENABLED_FALSE@@USEPYTHON_TRUE@am__append_74 = src/test/test_rebind.sh \ @COVERAGE_ENABLED_FALSE@@USEPYTHON_TRUE@ src/test/test_include.sh @USE_PERL_TRUE@am__append_75 = \ -@USE_PERL_TRUE@ scripts/maint/checkSpaceTest.sh +@USE_PERL_TRUE@ scripts/maint/checkSpaceTest.sh @UNITTESTS_ENABLED_TRUE@am__append_76 = \ @UNITTESTS_ENABLED_TRUE@ src/test/test \ @@ -317,6 +317,7 @@ @UNITTESTS_ENABLED_TRUE@ src/test/test_crypto.c \ @UNITTESTS_ENABLED_TRUE@ src/test/test_crypto_ope.c \ @UNITTESTS_ENABLED_TRUE@ src/test/test_crypto_rng.c \ +@UNITTESTS_ENABLED_TRUE@ src/test/test_crypto_cgo.c \ @UNITTESTS_ENABLED_TRUE@ src/test/test_data.c \ @UNITTESTS_ENABLED_TRUE@ src/test/test_dir.c \ @UNITTESTS_ENABLED_TRUE@ src/test/test_dirauth_ports.c \ @@ -519,9 +520,11 @@ am__src_core_libtor_app_testing_a_SOURCES_DIST = \ src/core/crypto/hs_ntor.c src/core/crypto/onion_crypto.c \ src/core/crypto/onion_fast.c src/core/crypto/onion_ntor.c \ - src/core/crypto/onion_ntor_v3.c src/core/crypto/onion_tap.c \ - src/core/crypto/relay_crypto.c src/core/mainloop/connection.c \ - src/core/mainloop/cpuworker.c src/core/mainloop/mainloop.c \ + src/core/crypto/onion_ntor_v3.c src/core/crypto/relay_crypto.c \ + src/core/crypto/relay_crypto_cgo.c \ + src/core/crypto/relay_crypto_tor1.c \ + src/core/mainloop/connection.c src/core/mainloop/cpuworker.c \ + src/core/mainloop/mainloop.c \ src/core/mainloop/mainloop_pubsub.c \ src/core/mainloop/mainloop_sys.c src/core/mainloop/netstatus.c \ src/core/mainloop/periodic.c src/core/or/address_set.c \ @@ -539,9 +542,10 @@ src/core/or/or_periodic.c src/core/or/or_sys.c \ src/core/or/orconn_event.c src/core/or/policies.c \ src/core/or/protover.c src/core/or/reasons.c \ - src/core/or/relay.c src/core/or/scheduler.c \ - src/core/or/scheduler_kist.c src/core/or/scheduler_vanilla.c \ - src/core/or/sendme.c src/core/or/congestion_control_common.c \ + src/core/or/relay.c src/core/or/relay_msg.c \ + src/core/or/scheduler.c src/core/or/scheduler_kist.c \ + src/core/or/scheduler_vanilla.c src/core/or/sendme.c \ + src/core/or/congestion_control_common.c \ src/core/or/congestion_control_vegas.c \ src/core/or/congestion_control_flow.c src/core/or/conflux.c \ src/core/or/conflux_cell.c src/core/or/conflux_params.c \ @@ -701,8 +705,9 @@ src/core/crypto/libtor_app_testing_a-onion_fast.$(OBJEXT) \ src/core/crypto/libtor_app_testing_a-onion_ntor.$(OBJEXT) \ src/core/crypto/libtor_app_testing_a-onion_ntor_v3.$(OBJEXT) \ - src/core/crypto/libtor_app_testing_a-onion_tap.$(OBJEXT) \ src/core/crypto/libtor_app_testing_a-relay_crypto.$(OBJEXT) \ + src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.$(OBJEXT) \ + src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.$(OBJEXT) \ src/core/mainloop/libtor_app_testing_a-connection.$(OBJEXT) \ src/core/mainloop/libtor_app_testing_a-cpuworker.$(OBJEXT) \ src/core/mainloop/libtor_app_testing_a-mainloop.$(OBJEXT) \ @@ -739,6 +744,7 @@ src/core/or/libtor_app_testing_a-protover.$(OBJEXT) \ src/core/or/libtor_app_testing_a-reasons.$(OBJEXT) \ src/core/or/libtor_app_testing_a-relay.$(OBJEXT) \ + src/core/or/libtor_app_testing_a-relay_msg.$(OBJEXT) \ src/core/or/libtor_app_testing_a-scheduler.$(OBJEXT) \ src/core/or/libtor_app_testing_a-scheduler_kist.$(OBJEXT) \ src/core/or/libtor_app_testing_a-scheduler_vanilla.$(OBJEXT) \ @@ -873,7 +879,9 @@ am__src_core_libtor_app_a_SOURCES_DIST = src/core/crypto/hs_ntor.c \ src/core/crypto/onion_crypto.c src/core/crypto/onion_fast.c \ src/core/crypto/onion_ntor.c src/core/crypto/onion_ntor_v3.c \ - src/core/crypto/onion_tap.c src/core/crypto/relay_crypto.c \ + src/core/crypto/relay_crypto.c \ + src/core/crypto/relay_crypto_cgo.c \ + src/core/crypto/relay_crypto_tor1.c \ src/core/mainloop/connection.c src/core/mainloop/cpuworker.c \ src/core/mainloop/mainloop.c \ src/core/mainloop/mainloop_pubsub.c \ @@ -893,9 +901,10 @@ src/core/or/or_periodic.c src/core/or/or_sys.c \ src/core/or/orconn_event.c src/core/or/policies.c \ src/core/or/protover.c src/core/or/reasons.c \ - src/core/or/relay.c src/core/or/scheduler.c \ - src/core/or/scheduler_kist.c src/core/or/scheduler_vanilla.c \ - src/core/or/sendme.c src/core/or/congestion_control_common.c \ + src/core/or/relay.c src/core/or/relay_msg.c \ + src/core/or/scheduler.c src/core/or/scheduler_kist.c \ + src/core/or/scheduler_vanilla.c src/core/or/sendme.c \ + src/core/or/congestion_control_common.c \ src/core/or/congestion_control_vegas.c \ src/core/or/congestion_control_flow.c src/core/or/conflux.c \ src/core/or/conflux_cell.c src/core/or/conflux_params.c \ @@ -1055,8 +1064,9 @@ src/core/crypto/onion_fast.$(OBJEXT) \ src/core/crypto/onion_ntor.$(OBJEXT) \ src/core/crypto/onion_ntor_v3.$(OBJEXT) \ - src/core/crypto/onion_tap.$(OBJEXT) \ src/core/crypto/relay_crypto.$(OBJEXT) \ + src/core/crypto/relay_crypto_cgo.$(OBJEXT) \ + src/core/crypto/relay_crypto_tor1.$(OBJEXT) \ src/core/mainloop/connection.$(OBJEXT) \ src/core/mainloop/cpuworker.$(OBJEXT) \ src/core/mainloop/mainloop.$(OBJEXT) \ @@ -1086,6 +1096,7 @@ src/core/or/orconn_event.$(OBJEXT) \ src/core/or/policies.$(OBJEXT) src/core/or/protover.$(OBJEXT) \ src/core/or/reasons.$(OBJEXT) src/core/or/relay.$(OBJEXT) \ + src/core/or/relay_msg.$(OBJEXT) \ src/core/or/scheduler.$(OBJEXT) \ src/core/or/scheduler_kist.$(OBJEXT) \ src/core/or/scheduler_vanilla.$(OBJEXT) \ @@ -1288,6 +1299,12 @@ @BUILD_KECCAK_TINY_TRUE@am_src_ext_keccak_tiny_libkeccak_tiny_a_OBJECTS = src/ext/keccak-tiny/libkeccak_tiny_a-keccak-tiny-unrolled.$(OBJEXT) src_ext_keccak_tiny_libkeccak_tiny_a_OBJECTS = \ $(am_src_ext_keccak_tiny_libkeccak_tiny_a_OBJECTS) +src_ext_polyval_libpolyval_a_AR = $(AR) $(ARFLAGS) +src_ext_polyval_libpolyval_a_LIBADD = +am_src_ext_polyval_libpolyval_a_OBJECTS = \ + src/ext/polyval/libpolyval_a-polyval.$(OBJEXT) +src_ext_polyval_libpolyval_a_OBJECTS = \ + $(am_src_ext_polyval_libpolyval_a_OBJECTS) src_lib_libcurve25519_donna_a_AR = $(AR) $(ARFLAGS) src_lib_libcurve25519_donna_a_LIBADD = am__src_lib_libcurve25519_donna_a_SOURCES_DIST = \ @@ -2249,7 +2266,7 @@ src/trunnel/sendme_cell.c src/trunnel/flow_control_cells.c \ src/trunnel/congestion_control.c src/trunnel/socks5.c \ src/trunnel/netinfo.c src/trunnel/circpad_negotiation.c \ - src/trunnel/conflux.c + src/trunnel/conflux.c src/trunnel/subproto_request.c am__objects_107 = src/ext/trunnel/trunnel_libor_trunnel_testing_a-trunnel.$(OBJEXT) \ src/trunnel/libor_trunnel_testing_a-ed25519_cert.$(OBJEXT) \ src/trunnel/libor_trunnel_testing_a-extension.$(OBJEXT) \ @@ -2265,7 +2282,8 @@ src/trunnel/libor_trunnel_testing_a-socks5.$(OBJEXT) \ src/trunnel/libor_trunnel_testing_a-netinfo.$(OBJEXT) \ src/trunnel/libor_trunnel_testing_a-circpad_negotiation.$(OBJEXT) \ - src/trunnel/libor_trunnel_testing_a-conflux.$(OBJEXT) + src/trunnel/libor_trunnel_testing_a-conflux.$(OBJEXT) \ + src/trunnel/libor_trunnel_testing_a-subproto_request.$(OBJEXT) @UNITTESTS_ENABLED_TRUE@am_src_trunnel_libor_trunnel_testing_a_OBJECTS = \ @UNITTESTS_ENABLED_TRUE@ $(am__objects_107) src_trunnel_libor_trunnel_testing_a_OBJECTS = \ @@ -2288,7 +2306,8 @@ src/trunnel/libor_trunnel_a-socks5.$(OBJEXT) \ src/trunnel/libor_trunnel_a-netinfo.$(OBJEXT) \ src/trunnel/libor_trunnel_a-circpad_negotiation.$(OBJEXT) \ - src/trunnel/libor_trunnel_a-conflux.$(OBJEXT) + src/trunnel/libor_trunnel_a-conflux.$(OBJEXT) \ + src/trunnel/libor_trunnel_a-subproto_request.$(OBJEXT) am_src_trunnel_libor_trunnel_a_OBJECTS = $(am__objects_108) src_trunnel_libor_trunnel_a_OBJECTS = \ $(am_src_trunnel_libor_trunnel_a_OBJECTS) @@ -2697,51 +2716,52 @@ src/test/test_containers.c src/test/test_controller.c \ src/test/test_controller_events.c src/test/test_crypto.c \ src/test/test_crypto_ope.c src/test/test_crypto_rng.c \ - src/test/test_data.c src/test/test_dir.c \ - src/test/test_dirauth_ports.c src/test/test_dirvote.c \ - src/test/test_dir_common.c src/test/test_dir_handle_get.c \ - src/test/test_dispatch.c src/test/test_dos.c \ - src/test/test_entryconn.c src/test/test_entrynodes.c \ - src/test/test_geoip.c src/test/test_guardfraction.c \ - src/test/test_extorport.c src/test/test_hs_common.c \ - src/test/test_hs_config.c src/test/test_hs_cell.c \ - src/test/test_hs_ntor.c src/test/test_hs_service.c \ - src/test/test_hs_client.c src/test/test_hs_intropoint.c \ - src/test/test_hs_control.c src/test/test_hs_ob.c \ - src/test/test_handles.c src/test/test_hs_cache.c \ - src/test/test_hs_descriptor.c src/test/test_hs_dos.c \ - src/test/test_hs_metrics.c src/test/test_hs_pow.c \ - src/test/test_keypin.c src/test/test_link_handshake.c \ - src/test/test_logging.c src/test/test_mainloop.c \ - src/test/test_metrics.c src/test/test_microdesc.c \ - src/test/test_namemap.c src/test/test_netinfo.c \ - src/test/test_nodelist.c src/test/test_ntor_v3.c \ - src/test/test_oom.c src/test/test_oos.c \ - src/test/test_options.c src/test/test_options_act.c \ - src/test/test_pem.c src/test/test_periodic_event.c \ - src/test/test_policy.c src/test/test_process.c \ - src/test/test_process_descs.c src/test/test_prob_distr.c \ - src/test/test_procmon.c src/test/test_proto_haproxy.c \ - src/test/test_proto_http.c src/test/test_proto_misc.c \ - src/test/test_protover.c src/test/test_pt.c \ - src/test/test_pubsub_build.c src/test/test_pubsub_msg.c \ - src/test/test_relay.c src/test/test_relaycell.c \ - src/test/test_relaycrypt.c src/test/test_replay.c \ - src/test/test_router.c src/test/test_routerkeys.c \ - src/test/test_routerlist.c src/test/test_routerset.c \ - src/test/test_sandbox.c src/test/test_scheduler.c \ - src/test/test_sendme.c src/test/test_shared_random.c \ - src/test/test_socks.c src/test/test_statefile.c \ - src/test/test_stats.c src/test/test_status.c \ - src/test/test_storagedir.c src/test/test_threads.c \ - src/test/test_token_bucket.c src/test/test_tortls.c \ - src/test/test_util.c src/test/test_util_format.c \ - src/test/test_util_process.c src/test/test_voting_flags.c \ - src/test/test_voting_schedule.c src/test/test_x509.c \ - src/test/test_helpers.c src/test/test_dns.c \ - src/test/test_parsecommon.c src/test/testing_common.c \ - src/test/testing_rsakeys.c src/ext/tinytest.c \ - src/test/test_crypto_openssl.c src/test/test_tortls_openssl.c + src/test/test_crypto_cgo.c src/test/test_data.c \ + src/test/test_dir.c src/test/test_dirauth_ports.c \ + src/test/test_dirvote.c src/test/test_dir_common.c \ + src/test/test_dir_handle_get.c src/test/test_dispatch.c \ + src/test/test_dos.c src/test/test_entryconn.c \ + src/test/test_entrynodes.c src/test/test_geoip.c \ + src/test/test_guardfraction.c src/test/test_extorport.c \ + src/test/test_hs_common.c src/test/test_hs_config.c \ + src/test/test_hs_cell.c src/test/test_hs_ntor.c \ + src/test/test_hs_service.c src/test/test_hs_client.c \ + src/test/test_hs_intropoint.c src/test/test_hs_control.c \ + src/test/test_hs_ob.c src/test/test_handles.c \ + src/test/test_hs_cache.c src/test/test_hs_descriptor.c \ + src/test/test_hs_dos.c src/test/test_hs_metrics.c \ + src/test/test_hs_pow.c src/test/test_keypin.c \ + src/test/test_link_handshake.c src/test/test_logging.c \ + src/test/test_mainloop.c src/test/test_metrics.c \ + src/test/test_microdesc.c src/test/test_namemap.c \ + src/test/test_netinfo.c src/test/test_nodelist.c \ + src/test/test_ntor_v3.c src/test/test_oom.c \ + src/test/test_oos.c src/test/test_options.c \ + src/test/test_options_act.c src/test/test_pem.c \ + src/test/test_periodic_event.c src/test/test_policy.c \ + src/test/test_process.c src/test/test_process_descs.c \ + src/test/test_prob_distr.c src/test/test_procmon.c \ + src/test/test_proto_haproxy.c src/test/test_proto_http.c \ + src/test/test_proto_misc.c src/test/test_protover.c \ + src/test/test_pt.c src/test/test_pubsub_build.c \ + src/test/test_pubsub_msg.c src/test/test_relay.c \ + src/test/test_relaycell.c src/test/test_relaycrypt.c \ + src/test/test_replay.c src/test/test_router.c \ + src/test/test_routerkeys.c src/test/test_routerlist.c \ + src/test/test_routerset.c src/test/test_sandbox.c \ + src/test/test_scheduler.c src/test/test_sendme.c \ + src/test/test_shared_random.c src/test/test_socks.c \ + src/test/test_statefile.c src/test/test_stats.c \ + src/test/test_status.c src/test/test_storagedir.c \ + src/test/test_threads.c src/test/test_token_bucket.c \ + src/test/test_tortls.c src/test/test_util.c \ + src/test/test_util_format.c src/test/test_util_process.c \ + src/test/test_voting_flags.c src/test/test_voting_schedule.c \ + src/test/test_x509.c src/test/test_helpers.c \ + src/test/test_dns.c src/test/test_parsecommon.c \ + src/test/testing_common.c src/test/testing_rsakeys.c \ + src/ext/tinytest.c src/test/test_crypto_openssl.c \ + src/test/test_tortls_openssl.c @UNITTESTS_ENABLED_TRUE@am__objects_126 = \ @UNITTESTS_ENABLED_TRUE@ src/test/test-fakecircs.$(OBJEXT) \ @UNITTESTS_ENABLED_TRUE@ src/test/test-log_test_helpers.$(OBJEXT) \ @@ -2788,6 +2808,7 @@ @UNITTESTS_ENABLED_TRUE@ src/test/test-test_crypto.$(OBJEXT) \ @UNITTESTS_ENABLED_TRUE@ src/test/test-test_crypto_ope.$(OBJEXT) \ @UNITTESTS_ENABLED_TRUE@ src/test/test-test_crypto_rng.$(OBJEXT) \ +@UNITTESTS_ENABLED_TRUE@ src/test/test-test_crypto_cgo.$(OBJEXT) \ @UNITTESTS_ENABLED_TRUE@ src/test/test-test_data.$(OBJEXT) \ @UNITTESTS_ENABLED_TRUE@ src/test/test-test_dir.$(OBJEXT) \ @UNITTESTS_ENABLED_TRUE@ src/test/test-test_dirauth_ports.$(OBJEXT) \ @@ -3082,14 +3103,16 @@ src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_fast.Po \ src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor.Po \ src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor_v3.Po \ - src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Po \ src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Po \ + src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Po \ + src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Po \ src/core/crypto/$(DEPDIR)/onion_crypto.Po \ src/core/crypto/$(DEPDIR)/onion_fast.Po \ src/core/crypto/$(DEPDIR)/onion_ntor.Po \ src/core/crypto/$(DEPDIR)/onion_ntor_v3.Po \ - src/core/crypto/$(DEPDIR)/onion_tap.Po \ src/core/crypto/$(DEPDIR)/relay_crypto.Po \ + src/core/crypto/$(DEPDIR)/relay_crypto_cgo.Po \ + src/core/crypto/$(DEPDIR)/relay_crypto_tor1.Po \ src/core/mainloop/$(DEPDIR)/connection.Po \ src/core/mainloop/$(DEPDIR)/cpuworker.Po \ src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Po \ @@ -3171,6 +3194,7 @@ src/core/or/$(DEPDIR)/libtor_app_testing_a-protover.Po \ src/core/or/$(DEPDIR)/libtor_app_testing_a-reasons.Po \ src/core/or/$(DEPDIR)/libtor_app_testing_a-relay.Po \ + src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Po \ src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Po \ src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_kist.Po \ src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_vanilla.Po \ @@ -3188,6 +3212,7 @@ src/core/or/$(DEPDIR)/protover.Po \ src/core/or/$(DEPDIR)/reasons.Po \ src/core/or/$(DEPDIR)/relay.Po \ + src/core/or/$(DEPDIR)/relay_msg.Po \ src/core/or/$(DEPDIR)/scheduler.Po \ src/core/or/$(DEPDIR)/scheduler_kist.Po \ src/core/or/$(DEPDIR)/scheduler_vanilla.Po \ @@ -3277,6 +3302,7 @@ src/ext/keccak-tiny/$(DEPDIR)/libkeccak_tiny_a-keccak-tiny-unrolled.Po \ src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_a-mulodi4.Po \ src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_testing_a-mulodi4.Po \ + src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Po \ src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Po \ src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_testing_a-trunnel.Po \ src/feature/api/$(DEPDIR)/core_libtor_app_testing_a-tor_api.Po \ @@ -3881,6 +3907,7 @@ src/test/$(DEPDIR)/test-test_controller.Po \ src/test/$(DEPDIR)/test-test_controller_events.Po \ src/test/$(DEPDIR)/test-test_crypto.Po \ + src/test/$(DEPDIR)/test-test_crypto_cgo.Po \ src/test/$(DEPDIR)/test-test_crypto_ope.Po \ src/test/$(DEPDIR)/test-test_crypto_openssl.Po \ src/test/$(DEPDIR)/test-test_crypto_rng.Po \ @@ -4104,6 +4131,7 @@ src/trunnel/$(DEPDIR)/libor_trunnel_a-pwbox.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_a-sendme_cell.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_a-socks5.Po \ + src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-channelpadding_negotiation.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-circpad_negotiation.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-conflux.Po \ @@ -4116,6 +4144,7 @@ src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-pwbox.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-sendme_cell.Po \ src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-socks5.Po \ + src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Po \ src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_establish_intro.Po \ src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_introduce1.Po \ src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_rendezvous.Po \ @@ -4146,6 +4175,7 @@ $(src_ext_equix_libequix_a_SOURCES) \ $(src_ext_equix_libhashx_a_SOURCES) \ $(src_ext_keccak_tiny_libkeccak_tiny_a_SOURCES) \ + $(src_ext_polyval_libpolyval_a_SOURCES) \ $(src_lib_libcurve25519_donna_a_SOURCES) \ $(src_lib_libtor_buf_testing_a_SOURCES) \ $(src_lib_libtor_buf_a_SOURCES) \ @@ -4290,6 +4320,7 @@ $(src_ext_equix_libequix_a_SOURCES) \ $(src_ext_equix_libhashx_a_SOURCES) \ $(am__src_ext_keccak_tiny_libkeccak_tiny_a_SOURCES_DIST) \ + $(src_ext_polyval_libpolyval_a_SOURCES) \ $(am__src_lib_libcurve25519_donna_a_SOURCES_DIST) \ $(src_lib_libtor_buf_testing_a_SOURCES) \ $(src_lib_libtor_buf_a_SOURCES) \ @@ -4507,7 +4538,9 @@ src/ext/equix/hashx/src/virtual_memory.h \ src/ext/equix/include/equix.h src/ext/equix/src/context.h \ src/ext/equix/src/solver_heap.h src/ext/equix/src/solver.h \ - src/ext/keccak-tiny/keccak-tiny.h src/lib/arch/bytes.h \ + src/ext/keccak-tiny/keccak-tiny.h src/ext/polyval/polyval.h \ + src/ext/polyval/pclmul.c src/ext/polyval/ctmul64.c \ + src/ext/polyval/ctmul.c src/lib/arch/bytes.h \ src/lib/buf/buffers.h src/lib/err/backtrace.h \ src/lib/err/torerr.h src/lib/err/torerr_sys.h \ src/lib/cc/compat_compiler.h src/lib/cc/ctassert.h \ @@ -4606,16 +4639,17 @@ src/lib/thread/numcpus.h src/lib/thread/thread_sys.h \ src/lib/thread/threads.h src/lib/time/compat_time.h \ src/lib/time/time_sys.h src/lib/time/tvdiff.h \ - src/lib/tls/ciphers.inc src/lib/tls/buffers_tls.h \ - src/lib/tls/nss_countbytes.h src/lib/tls/tortls.h \ - src/lib/tls/tortls_internal.h src/lib/tls/tortls_st.h \ - src/lib/tls/tortls_sys.h src/lib/tls/x509.h \ - src/lib/tls/x509_internal.h src/lib/trace/trace.h \ - src/lib/trace/trace_sys.h src/lib/trace/events.h \ - src/lib/trace/debug.h src/lib/trace/usdt/usdt.h \ - src/lib/trace/lttng/lttng.h src/lib/version/git_revision.h \ - src/lib/version/torversion.h src/lib/wallclock/approx_time.h \ - src/lib/wallclock/timeval.h src/lib/wallclock/time_to_tm.h \ + src/lib/tls/ciphers.inc src/lib/tls/ciphers_v13.inc \ + src/lib/tls/buffers_tls.h src/lib/tls/nss_countbytes.h \ + src/lib/tls/tortls.h src/lib/tls/tortls_internal.h \ + src/lib/tls/tortls_st.h src/lib/tls/tortls_sys.h \ + src/lib/tls/x509.h src/lib/tls/x509_internal.h \ + src/lib/trace/trace.h src/lib/trace/trace_sys.h \ + src/lib/trace/events.h src/lib/trace/debug.h \ + src/lib/trace/usdt/usdt.h src/lib/trace/lttng/lttng.h \ + src/lib/version/git_revision.h src/lib/version/torversion.h \ + src/lib/wallclock/approx_time.h src/lib/wallclock/timeval.h \ + src/lib/wallclock/time_to_tm.h \ src/lib/wallclock/tor_gettimeofday.h \ src/lib/wallclock/wallclock_sys.h src/ext/trunnel/trunnel.h \ src/ext/trunnel/trunnel-impl.h src/trunnel/trunnel-local.h \ @@ -4628,12 +4662,15 @@ src/trunnel/sendme_cell.h src/trunnel/flow_control_cells.h \ src/trunnel/congestion_control.h src/trunnel/socks5.h \ src/trunnel/netinfo.h src/trunnel/circpad_negotiation.h \ - src/trunnel/conflux.h src/core/crypto/hs_ntor.h \ - src/core/crypto/onion_crypto.h src/core/crypto/onion_fast.h \ - src/core/crypto/onion_ntor.h src/core/crypto/onion_ntor_v3.h \ - src/core/crypto/onion_tap.h src/core/crypto/relay_crypto.h \ - src/core/mainloop/connection.h src/core/mainloop/cpuworker.h \ - src/core/mainloop/mainloop.h \ + src/trunnel/conflux.h src/trunnel/subproto_request.h \ + src/core/crypto/hs_ntor.h src/core/crypto/onion_crypto.h \ + src/core/crypto/onion_fast.h src/core/crypto/onion_ntor.h \ + src/core/crypto/onion_ntor_v3.h src/core/crypto/relay_crypto.h \ + src/core/crypto/relay_crypto_st.h \ + src/core/crypto/relay_crypto_cgo.h \ + src/core/crypto/relay_crypto_tor1.h \ + src/core/crypto/tor1_crypt_st.h src/core/mainloop/connection.h \ + src/core/mainloop/cpuworker.h src/core/mainloop/mainloop.h \ src/core/mainloop/mainloop_pubsub.h \ src/core/mainloop/mainloop_state.inc \ src/core/mainloop/mainloop_state_st.h \ @@ -4669,8 +4706,9 @@ src/core/or/origin_circuit_st.h src/core/or/policies.h \ src/core/or/port_cfg_st.h src/core/or/protover.h \ src/core/or/reasons.h src/core/or/relay.h \ - src/core/or/relay_crypto_st.h src/core/or/scheduler.h \ - src/core/or/sendme.h src/core/or/congestion_control_flow.h \ + src/core/or/relay_msg.h src/core/or/relay_msg_st.h \ + src/core/or/scheduler.h src/core/or/sendme.h \ + src/core/or/congestion_control_flow.h \ src/core/or/congestion_control_common.h \ src/core/or/congestion_control_vegas.h src/core/or/conflux.h \ src/core/or/conflux_cell.h src/core/or/conflux_params.h \ @@ -4815,17 +4853,18 @@ src/app/config/fallback_dirs.inc src/app/config/testnet.inc \ src/app/main/main.h src/app/main/ntmain.h \ src/app/main/risky_options.h src/app/main/shutdown.h \ - src/app/main/subsysmgr.h src/test/fakechans.h \ - src/test/fakecircs.h src/test/hs_test_helpers.h \ - src/test/log_test_helpers.h src/test/opts_test_helpers.h \ - src/test/resolve_test_helpers.h src/test/rng_test_helpers.h \ - src/test/test.h src/test/ptr_helpers.h src/test/test_helpers.h \ + src/app/main/subsysmgr.h src/test/compression_bomb.h \ + src/test/fakechans.h src/test/fakecircs.h \ + src/test/hs_test_helpers.h src/test/log_test_helpers.h \ + src/test/opts_test_helpers.h src/test/resolve_test_helpers.h \ + src/test/rng_test_helpers.h src/test/test.h \ + src/test/ptr_helpers.h src/test/test_helpers.h \ src/test/test_dir_common.h src/test/test_connection.h \ src/test/test_tortls.h src/test/test_descriptors.inc \ src/test/example_extrainfo.inc \ src/test/failing_routerdescs.inc src/test/ed25519_vectors.inc \ - src/test/test_hs_descriptor.inc src/test/vote_descriptors.inc \ - src/test/fuzz/fuzzing.h + src/test/cgo_vectors.inc src/test/test_hs_descriptor.inc \ + src/test/vote_descriptors.inc src/test/fuzz/fuzzing.h HEADERS = $(noinst_HEADERS) am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \ $(LISP)orconfig.h.in @@ -5288,9 +5327,9 @@ top_srcdir = @top_srcdir@ ACLOCAL_AMFLAGS = -I m4 noinst_LIBRARIES = $(LIBED25519_REF10) $(LIBED25519_DONNA) \ - $(EQUIX_LIBS) $(am__append_6) src/lib/libtor-buf.a \ - $(am__append_7) src/lib/libtor-err.a $(am__append_8) \ - src/lib/libtor-ctime.a $(am__append_9) \ + $(EQUIX_LIBS) $(am__append_6) $(LIBPOLYVAL) \ + src/lib/libtor-buf.a $(am__append_7) src/lib/libtor-err.a \ + $(am__append_8) src/lib/libtor-ctime.a $(am__append_9) \ src/lib/libtor-compress.a $(am__append_10) \ src/lib/libtor-confmgt.a $(am__append_11) \ src/lib/libtor-container.a $(am__append_12) \ @@ -5542,7 +5581,7 @@ # ADD_C_FILE: INSERT HEADERS HERE. noinst_HEADERS = $(EXTHEADERS) $(ED25519_REF10_HDRS) \ $(ED25519_DONNA_HDRS) $(EQUIX_HDRS) $(am__append_5) \ - src/lib/arch/bytes.h src/lib/buf/buffers.h \ + $(POLYVAL_HDRS) src/lib/arch/bytes.h src/lib/buf/buffers.h \ src/lib/err/backtrace.h src/lib/err/torerr.h \ src/lib/err/torerr_sys.h src/lib/cc/compat_compiler.h \ src/lib/cc/ctassert.h src/lib/cc/tokpaste.h \ @@ -5640,11 +5679,11 @@ src/lib/thread/numcpus.h src/lib/thread/thread_sys.h \ src/lib/thread/threads.h src/lib/time/compat_time.h \ src/lib/time/time_sys.h src/lib/time/tvdiff.h \ - src/lib/tls/ciphers.inc src/lib/tls/buffers_tls.h \ - src/lib/tls/nss_countbytes.h src/lib/tls/tortls.h \ - src/lib/tls/tortls_internal.h src/lib/tls/tortls_st.h \ - src/lib/tls/tortls_sys.h src/lib/tls/x509.h \ - src/lib/tls/x509_internal.h $(TRACEHEADERS) \ + src/lib/tls/ciphers.inc src/lib/tls/ciphers_v13.inc \ + src/lib/tls/buffers_tls.h src/lib/tls/nss_countbytes.h \ + src/lib/tls/tortls.h src/lib/tls/tortls_internal.h \ + src/lib/tls/tortls_st.h src/lib/tls/tortls_sys.h \ + src/lib/tls/x509.h src/lib/tls/x509_internal.h $(TRACEHEADERS) \ src/lib/version/git_revision.h src/lib/version/torversion.h \ src/lib/wallclock/approx_time.h src/lib/wallclock/timeval.h \ src/lib/wallclock/time_to_tm.h \ @@ -5652,8 +5691,11 @@ src/lib/wallclock/wallclock_sys.h $(TRUNNELHEADERS) \ src/core/crypto/hs_ntor.h src/core/crypto/onion_crypto.h \ src/core/crypto/onion_fast.h src/core/crypto/onion_ntor.h \ - src/core/crypto/onion_ntor_v3.h src/core/crypto/onion_tap.h \ - src/core/crypto/relay_crypto.h src/core/mainloop/connection.h \ + src/core/crypto/onion_ntor_v3.h src/core/crypto/relay_crypto.h \ + src/core/crypto/relay_crypto_st.h \ + src/core/crypto/relay_crypto_cgo.h \ + src/core/crypto/relay_crypto_tor1.h \ + src/core/crypto/tor1_crypt_st.h src/core/mainloop/connection.h \ src/core/mainloop/cpuworker.h src/core/mainloop/mainloop.h \ src/core/mainloop/mainloop_pubsub.h \ src/core/mainloop/mainloop_state.inc \ @@ -5690,8 +5732,9 @@ src/core/or/origin_circuit_st.h src/core/or/policies.h \ src/core/or/port_cfg_st.h src/core/or/protover.h \ src/core/or/reasons.h src/core/or/relay.h \ - src/core/or/relay_crypto_st.h src/core/or/scheduler.h \ - src/core/or/sendme.h src/core/or/congestion_control_flow.h \ + src/core/or/relay_msg.h src/core/or/relay_msg_st.h \ + src/core/or/scheduler.h src/core/or/sendme.h \ + src/core/or/congestion_control_flow.h \ src/core/or/congestion_control_common.h \ src/core/or/congestion_control_vegas.h src/core/or/conflux.h \ src/core/or/conflux_cell.h src/core/or/conflux_params.h \ @@ -5836,17 +5879,18 @@ src/app/main/main.h src/app/main/ntmain.h \ src/app/main/risky_options.h src/app/main/shutdown.h \ src/app/main/subsysmgr.h src/app/main/ntmain.h \ - src/test/fakechans.h src/test/fakecircs.h \ - src/test/hs_test_helpers.h src/test/log_test_helpers.h \ - src/test/opts_test_helpers.h src/test/resolve_test_helpers.h \ - src/test/rng_test_helpers.h src/test/test.h \ - src/test/ptr_helpers.h src/test/test_helpers.h \ + src/test/compression_bomb.h src/test/fakechans.h \ + src/test/fakecircs.h src/test/hs_test_helpers.h \ + src/test/log_test_helpers.h src/test/opts_test_helpers.h \ + src/test/resolve_test_helpers.h src/test/rng_test_helpers.h \ + src/test/test.h src/test/ptr_helpers.h src/test/test_helpers.h \ src/test/test_dir_common.h src/test/test_connection.h \ src/test/test_tortls.h src/test/test_descriptors.inc \ src/test/example_extrainfo.inc \ src/test/failing_routerdescs.inc src/test/ed25519_vectors.inc \ - src/test/test_descriptors.inc src/test/test_hs_descriptor.inc \ - src/test/vote_descriptors.inc src/test/fuzz/fuzzing.h + src/test/cgo_vectors.inc src/test/test_descriptors.inc \ + src/test/test_hs_descriptor.inc src/test/vote_descriptors.inc \ + src/test/fuzz/fuzzing.h CLEANFILES = micro-revision.i micro-revision.tmp $(asciidoc_product) DISTCLEANFILES = $(html_in) $(man_in) MOSTLYCLEANFILES = libtor.a $(am__append_2) @@ -5880,12 +5924,12 @@ src/lib/libtor-sandbox.a \ src/lib/libtor-container.a \ src/lib/libtor-net.a \ - src/lib/libtor-thread.a \ src/lib/libtor-memarea.a \ src/lib/libtor-math.a \ src/lib/libtor-meminfo.a \ src/lib/libtor-osinfo.a \ src/lib/libtor-log.a \ + src/lib/libtor-thread.a \ src/lib/libtor-lock.a \ src/lib/libtor-fdio.a \ src/lib/libtor-string.a \ @@ -5916,13 +5960,13 @@ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-sandbox-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-container-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-net-testing.a \ -@UNITTESTS_ENABLED_TRUE@ src/lib/libtor-thread-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-memarea-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-math-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-meminfo-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-osinfo-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-term-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-log-testing.a \ +@UNITTESTS_ENABLED_TRUE@ src/lib/libtor-thread-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-lock-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-fdio-testing.a \ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-string-testing.a \ @@ -5939,7 +5983,7 @@ # Internal crypto libraries used in Tor TOR_CRYPTO_LIBS = src/lib/libtor-tls.a src/lib/libtor-crypt-ops.a \ - $(LIBKECCAK_TINY) $(LIBDONNA) $(am__append_1) + $(LIBKECCAK_TINY) $(LIBDONNA) $(LIBPOLYVAL) $(am__append_1) # Variants of the above for linking the testing variant of tor (for coverage # and tests) @@ -5948,6 +5992,7 @@ @UNITTESTS_ENABLED_TRUE@ src/lib/libtor-crypt-ops-testing.a \ @UNITTESTS_ENABLED_TRUE@ $(LIBKECCAK_TINY) \ @UNITTESTS_ENABLED_TRUE@ $(LIBDONNA) \ +@UNITTESTS_ENABLED_TRUE@ $(LIBPOLYVAL) \ @UNITTESTS_ENABLED_TRUE@ $(EQUIX_LIBS) @@ -5977,15 +6022,15 @@ TOR_LIBS_CRYPTLIB = @TOR_OPENSSL_LIBS@ $(am__append_4) TOR_CFLAGS_CRYPTLIB = $(am__append_3) EXTHEADERS = \ - src/ext/ht.h \ - src/ext/byteorder.h \ - src/ext/tinytest.h \ + src/ext/ht.h \ + src/ext/byteorder.h \ + src/ext/tinytest.h \ src/ext/tor_readpassphrase.h \ - src/ext/strlcat.c \ - src/ext/strlcpy.c \ - src/ext/getdelim.c \ + src/ext/strlcat.c \ + src/ext/strlcpy.c \ + src/ext/getdelim.c \ src/ext/tinytest_macros.h \ - src/ext/tor_queue.h \ + src/ext/tor_queue.h \ src/ext/siphash.h \ src/ext/compat_blake2.h \ src/ext/timeouts/timeout.h \ @@ -6168,6 +6213,19 @@ @BUILD_KECCAK_TINY_TRUE@ src/ext/keccak-tiny/keccak-tiny.h @BUILD_KECCAK_TINY_TRUE@LIBKECCAK_TINY = src/ext/keccak-tiny/libkeccak-tiny.a +src_ext_polyval_libpolyval_a_CFLAGS = \ + @CFLAGS_CONSTTIME@ + +src_ext_polyval_libpolyval_a_SOURCES = \ + src/ext/polyval/polyval.c + +POLYVAL_HDRS = \ + src/ext/polyval/polyval.h \ + src/ext/polyval/pclmul.c \ + src/ext/polyval/ctmul64.c \ + src/ext/polyval/ctmul.c + +LIBPOLYVAL = src/ext/polyval/libpolyval.a # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_buf_a_SOURCES = \ @@ -6195,8 +6253,8 @@ # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_ctime_a_SOURCES = \ - $(mulodi4_source) \ - src/ext/csiphash.c \ + $(mulodi4_source) \ + src/ext/csiphash.c \ src/lib/ctime/di_ops.c src_lib_libtor_ctime_testing_a_SOURCES = \ @@ -6222,10 +6280,10 @@ # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_confmgt_a_SOURCES = \ - src/lib/confmgt/confmgt.c \ - src/lib/confmgt/structvar.c \ - src/lib/confmgt/type_defs.c \ - src/lib/confmgt/typedvar.c \ + src/lib/confmgt/confmgt.c \ + src/lib/confmgt/structvar.c \ + src/lib/confmgt/type_defs.c \ + src/lib/confmgt/typedvar.c \ src/lib/confmgt/unitparse.c src_lib_libtor_confmgt_testing_a_SOURCES = \ @@ -6419,7 +6477,7 @@ # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_math_a_SOURCES = \ - src/lib/math/fp.c \ + src/lib/math/fp.c \ src/lib/math/laplace.c \ src/lib/math/prob_distr.c @@ -6452,8 +6510,8 @@ # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_metrics_a_SOURCES = \ src/lib/metrics/metrics_store.c \ - src/lib/metrics/metrics_store_entry.c \ - src/lib/metrics/metrics_common.c \ + src/lib/metrics/metrics_store_entry.c \ + src/lib/metrics/metrics_common.c \ src/lib/metrics/prometheus.c src_lib_libtor_metrics_testing_a_SOURCES = \ @@ -6465,7 +6523,7 @@ # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_net_a_SOURCES = \ src/lib/net/address.c \ - src/lib/net/alertsock.c \ + src/lib/net/alertsock.c \ src/lib/net/buffers_net.c \ src/lib/net/gethostname.c \ src/lib/net/inaddr.c \ @@ -6549,7 +6607,7 @@ # ADD_C_FILE: INSERT SOURCES HERE. src_lib_libtor_smartlist_core_a_SOURCES = \ - src/lib/smartlist_core/smartlist_core.c \ + src/lib/smartlist_core/smartlist_core.c \ src/lib/smartlist_core/smartlist_split.c src_lib_libtor_smartlist_core_testing_a_SOURCES = \ @@ -6658,45 +6716,48 @@ src/trunnel/congestion_control.trunnel \ src/trunnel/socks5.trunnel \ src/trunnel/circpad_negotiation.trunnel \ - src/trunnel/conflux.trunnel + src/trunnel/conflux.trunnel \ + src/trunnel/subproto_request.trunnel TRUNNELSOURCES = \ src/ext/trunnel/trunnel.c \ src/trunnel/ed25519_cert.c \ src/trunnel/extension.c \ src/trunnel/link_handshake.c \ - src/trunnel/pwbox.c \ - src/trunnel/hs/cell_establish_intro.c \ + src/trunnel/pwbox.c \ + src/trunnel/hs/cell_establish_intro.c \ src/trunnel/hs/cell_introduce1.c \ src/trunnel/hs/cell_rendezvous.c \ src/trunnel/channelpadding_negotiation.c \ - src/trunnel/sendme_cell.c \ - src/trunnel/flow_control_cells.c \ - src/trunnel/congestion_control.c \ + src/trunnel/sendme_cell.c \ + src/trunnel/flow_control_cells.c \ + src/trunnel/congestion_control.c \ src/trunnel/socks5.c \ src/trunnel/netinfo.c \ src/trunnel/circpad_negotiation.c \ - src/trunnel/conflux.c + src/trunnel/conflux.c \ + src/trunnel/subproto_request.c TRUNNELHEADERS = \ - src/ext/trunnel/trunnel.h \ - src/ext/trunnel/trunnel-impl.h \ - src/trunnel/trunnel-local.h \ - src/trunnel/ed25519_cert.h \ + src/ext/trunnel/trunnel.h \ + src/ext/trunnel/trunnel-impl.h \ + src/trunnel/trunnel-local.h \ + src/trunnel/ed25519_cert.h \ src/trunnel/extension.h \ - src/trunnel/link_handshake.h \ - src/trunnel/pwbox.h \ - src/trunnel/hs/cell_establish_intro.h \ + src/trunnel/link_handshake.h \ + src/trunnel/pwbox.h \ + src/trunnel/hs/cell_establish_intro.h \ src/trunnel/hs/cell_introduce1.h \ src/trunnel/hs/cell_rendezvous.h \ src/trunnel/channelpadding_negotiation.h \ - src/trunnel/sendme_cell.h \ - src/trunnel/flow_control_cells.h \ - src/trunnel/congestion_control.h \ - src/trunnel/socks5.h \ + src/trunnel/sendme_cell.h \ + src/trunnel/flow_control_cells.h \ + src/trunnel/congestion_control.h \ + src/trunnel/socks5.h \ src/trunnel/netinfo.h \ src/trunnel/circpad_negotiation.h \ - src/trunnel/conflux.h + src/trunnel/conflux.h \ + src/trunnel/subproto_request.h src_trunnel_libor_trunnel_a_SOURCES = $(TRUNNELSOURCES) src_trunnel_libor_trunnel_a_CPPFLAGS = \ @@ -6751,7 +6812,9 @@ LIBTOR_APP_A_SOURCES = src/core/crypto/hs_ntor.c \ src/core/crypto/onion_crypto.c src/core/crypto/onion_fast.c \ src/core/crypto/onion_ntor.c src/core/crypto/onion_ntor_v3.c \ - src/core/crypto/onion_tap.c src/core/crypto/relay_crypto.c \ + src/core/crypto/relay_crypto.c \ + src/core/crypto/relay_crypto_cgo.c \ + src/core/crypto/relay_crypto_tor1.c \ src/core/mainloop/connection.c src/core/mainloop/cpuworker.c \ src/core/mainloop/mainloop.c \ src/core/mainloop/mainloop_pubsub.c \ @@ -6771,9 +6834,10 @@ src/core/or/or_periodic.c src/core/or/or_sys.c \ src/core/or/orconn_event.c src/core/or/policies.c \ src/core/or/protover.c src/core/or/reasons.c \ - src/core/or/relay.c src/core/or/scheduler.c \ - src/core/or/scheduler_kist.c src/core/or/scheduler_vanilla.c \ - src/core/or/sendme.c src/core/or/congestion_control_common.c \ + src/core/or/relay.c src/core/or/relay_msg.c \ + src/core/or/scheduler.c src/core/or/scheduler_kist.c \ + src/core/or/scheduler_vanilla.c src/core/or/sendme.c \ + src/core/or/congestion_control_common.c \ src/core/or/congestion_control_vegas.c \ src/core/or/congestion_control_flow.c src/core/or/conflux.c \ src/core/or/conflux_cell.c src/core/or/conflux_params.c \ @@ -6902,7 +6966,7 @@ MODULE_RELAY_SOURCES = \ src/feature/relay/circuitbuild_relay.c \ src/feature/relay/dns.c \ - src/feature/relay/ext_orport.c \ + src/feature/relay/ext_orport.c \ src/feature/relay/routermode.c \ src/feature/relay/relay_config.c \ src/feature/relay/relay_handshake.c \ @@ -7007,8 +7071,8 @@ TEST_CHUTNEY_FLAVORS_IPV6_MIXED = mixed+hs-v3-ipv6 src_test_AM_CPPFLAGS = -DSHARE_DATADIR="\"$(datadir)\"" \ -DLOCALSTATEDIR="\"$(localstatedir)\"" \ - -DBINDIR="\"$(bindir)\"" \ - -DTOR_UNIT_TESTS \ + -DBINDIR="\"$(bindir)\"" \ + -DTOR_UNIT_TESTS \ $(AM_CPPFLAGS) @@ -7075,7 +7139,7 @@ @TOR_LDFLAGS_libevent@ src_test_bench_LDADD = \ - libtor.a \ + libtor.a \ @TOR_ZLIB_LIBS@ @TOR_LIB_MATH@ @TOR_LIBEVENT_LIBS@ \ $(TOR_LIBS_CRYPTLIB) @TOR_LIB_WS32@ @TOR_LIB_IPHLPAPI@ @TOR_LIB_SHLWAPI@ @TOR_LIB_GDI@ @TOR_LIB_USERENV@ \ @CURVE25519_LIBS@ \ @@ -7120,7 +7184,7 @@ libtor.a \ @TOR_ZLIB_LIBS@ @TOR_LIB_MATH@ \ $(TOR_LIBS_CRYPTLIB) @TOR_LIB_WS32@ @TOR_LIB_IPHLPAPI@ @TOR_LIB_SHLWAPI@ @TOR_LIB_GDI@ \ - @CURVE25519_LIBS@ @TOR_TRACE_LIBS@ + @CURVE25519_LIBS@ @TOR_TRACE_LIBS@ src_test_test_hs_ntor_cl_AM_CPPFLAGS = \ $(AM_CPPFLAGS) @@ -7130,7 +7194,7 @@ @UNITTESTS_ENABLED_TRUE@ $(TOR_UTIL_TESTING_LIBS) \ @UNITTESTS_ENABLED_TRUE@ @TOR_LIB_MATH@ \ @UNITTESTS_ENABLED_TRUE@ @TOR_LIB_WS32@ @TOR_LIB_IPHLPAPI@ @TOR_LIB_SHLWAPI@ @TOR_LIB_GDI@ @TOR_LIB_USERENV@ \ -@UNITTESTS_ENABLED_TRUE@ @TOR_TRACE_LIBS@ +@UNITTESTS_ENABLED_TRUE@ @TOR_TRACE_LIBS@ @UNITTESTS_ENABLED_TRUE@src_test_test_bt_cl_CFLAGS = $(AM_CFLAGS) $(TEST_CFLAGS) @UNITTESTS_ENABLED_TRUE@src_test_test_bt_cl_CPPFLAGS = $(src_test_AM_CPPFLAGS) $(TEST_CPPFLAGS) @@ -7139,7 +7203,7 @@ src_tools_tor_resolve_LDADD = \ src/trunnel/libor-trunnel.a \ $(TOR_UTIL_LIBS) \ - $(TOR_CRYPTO_LIBS) $(TOR_LIBS_CRYPTLIB)\ + $(TOR_CRYPTO_LIBS) $(TOR_LIBS_CRYPTLIB)\ @TOR_LIB_MATH@ @TOR_LIB_WS32@ @TOR_LIB_IPHLPAPI@ @TOR_LIB_SHLWAPI@ @TOR_LIB_USERENV@ @COVERAGE_ENABLED_TRUE@src_tools_tor_cov_resolve_SOURCES = src/tools/tor-resolve.c @@ -7164,8 +7228,8 @@ src_tools_tor_print_ed_signing_cert_LDFLAGS = @TOR_LDFLAGS_zlib@ @TOR_LDFLAGS_openssl@ src_tools_tor_print_ed_signing_cert_LDADD = \ src/trunnel/libor-trunnel.a \ - $(TOR_CRYPTO_LIBS) \ - $(TOR_UTIL_LIBS) \ + $(TOR_CRYPTO_LIBS) \ + $(TOR_UTIL_LIBS) \ @TOR_LIB_MATH@ $(TOR_LIBS_CRYPTLIB) \ @TOR_LIB_WS32@ @TOR_LIB_USERENV@ @TOR_LIB_SHLWAPI@ @TOR_LIB_GDI@ @@ -7180,8 +7244,8 @@ @COVERAGE_ENABLED_TRUE@@USE_NSS_FALSE@ @TOR_LIB_WS32@ @TOR_LIB_IPHLPAPI@ @TOR_LIB_SHLWAPI@ @TOR_LIB_GDI@ @CURVE25519_LIBS@ @BUILD_LIBTORRUNNER_TRUE@src_tools_libtorrunner_a_SOURCES = \ -@BUILD_LIBTORRUNNER_TRUE@ src/tools/tor_runner.c \ -@BUILD_LIBTORRUNNER_TRUE@ src/feature/api/tor_api.c +@BUILD_LIBTORRUNNER_TRUE@ src/tools/tor_runner.c \ +@BUILD_LIBTORRUNNER_TRUE@ src/feature/api/tor_api.c confdir = $(sysconfdir)/tor tordatadir = $(datadir)/tor @@ -7777,10 +7841,13 @@ src/core/crypto/libtor_app_testing_a-onion_ntor_v3.$(OBJEXT): \ src/core/crypto/$(am__dirstamp) \ src/core/crypto/$(DEPDIR)/$(am__dirstamp) -src/core/crypto/libtor_app_testing_a-onion_tap.$(OBJEXT): \ +src/core/crypto/libtor_app_testing_a-relay_crypto.$(OBJEXT): \ src/core/crypto/$(am__dirstamp) \ src/core/crypto/$(DEPDIR)/$(am__dirstamp) -src/core/crypto/libtor_app_testing_a-relay_crypto.$(OBJEXT): \ +src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.$(OBJEXT): \ + src/core/crypto/$(am__dirstamp) \ + src/core/crypto/$(DEPDIR)/$(am__dirstamp) +src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.$(OBJEXT): \ src/core/crypto/$(am__dirstamp) \ src/core/crypto/$(DEPDIR)/$(am__dirstamp) src/core/mainloop/$(am__dirstamp): @@ -7903,6 +7970,9 @@ src/core/or/libtor_app_testing_a-relay.$(OBJEXT): \ src/core/or/$(am__dirstamp) \ src/core/or/$(DEPDIR)/$(am__dirstamp) +src/core/or/libtor_app_testing_a-relay_msg.$(OBJEXT): \ + src/core/or/$(am__dirstamp) \ + src/core/or/$(DEPDIR)/$(am__dirstamp) src/core/or/libtor_app_testing_a-scheduler.$(OBJEXT): \ src/core/or/$(am__dirstamp) \ src/core/or/$(DEPDIR)/$(am__dirstamp) @@ -8505,11 +8575,15 @@ src/core/crypto/onion_ntor_v3.$(OBJEXT): \ src/core/crypto/$(am__dirstamp) \ src/core/crypto/$(DEPDIR)/$(am__dirstamp) -src/core/crypto/onion_tap.$(OBJEXT): src/core/crypto/$(am__dirstamp) \ - src/core/crypto/$(DEPDIR)/$(am__dirstamp) src/core/crypto/relay_crypto.$(OBJEXT): \ src/core/crypto/$(am__dirstamp) \ src/core/crypto/$(DEPDIR)/$(am__dirstamp) +src/core/crypto/relay_crypto_cgo.$(OBJEXT): \ + src/core/crypto/$(am__dirstamp) \ + src/core/crypto/$(DEPDIR)/$(am__dirstamp) +src/core/crypto/relay_crypto_tor1.$(OBJEXT): \ + src/core/crypto/$(am__dirstamp) \ + src/core/crypto/$(DEPDIR)/$(am__dirstamp) src/core/mainloop/connection.$(OBJEXT): \ src/core/mainloop/$(am__dirstamp) \ src/core/mainloop/$(DEPDIR)/$(am__dirstamp) @@ -8590,6 +8664,8 @@ src/core/or/$(DEPDIR)/$(am__dirstamp) src/core/or/relay.$(OBJEXT): src/core/or/$(am__dirstamp) \ src/core/or/$(DEPDIR)/$(am__dirstamp) +src/core/or/relay_msg.$(OBJEXT): src/core/or/$(am__dirstamp) \ + src/core/or/$(DEPDIR)/$(am__dirstamp) src/core/or/scheduler.$(OBJEXT): src/core/or/$(am__dirstamp) \ src/core/or/$(DEPDIR)/$(am__dirstamp) src/core/or/scheduler_kist.$(OBJEXT): src/core/or/$(am__dirstamp) \ @@ -9248,6 +9324,20 @@ $(AM_V_at)-rm -f src/ext/keccak-tiny/libkeccak-tiny.a $(AM_V_AR)$(src_ext_keccak_tiny_libkeccak_tiny_a_AR) src/ext/keccak-tiny/libkeccak-tiny.a $(src_ext_keccak_tiny_libkeccak_tiny_a_OBJECTS) $(src_ext_keccak_tiny_libkeccak_tiny_a_LIBADD) $(AM_V_at)$(RANLIB) src/ext/keccak-tiny/libkeccak-tiny.a +src/ext/polyval/$(am__dirstamp): + @$(MKDIR_P) src/ext/polyval + @: > src/ext/polyval/$(am__dirstamp) +src/ext/polyval/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) src/ext/polyval/$(DEPDIR) + @: > src/ext/polyval/$(DEPDIR)/$(am__dirstamp) +src/ext/polyval/libpolyval_a-polyval.$(OBJEXT): \ + src/ext/polyval/$(am__dirstamp) \ + src/ext/polyval/$(DEPDIR)/$(am__dirstamp) + +src/ext/polyval/libpolyval.a: $(src_ext_polyval_libpolyval_a_OBJECTS) $(src_ext_polyval_libpolyval_a_DEPENDENCIES) $(EXTRA_src_ext_polyval_libpolyval_a_DEPENDENCIES) src/ext/polyval/$(am__dirstamp) + $(AM_V_at)-rm -f src/ext/polyval/libpolyval.a + $(AM_V_AR)$(src_ext_polyval_libpolyval_a_AR) src/ext/polyval/libpolyval.a $(src_ext_polyval_libpolyval_a_OBJECTS) $(src_ext_polyval_libpolyval_a_LIBADD) + $(AM_V_at)$(RANLIB) src/ext/polyval/libpolyval.a src/ext/curve25519_donna/$(am__dirstamp): @$(MKDIR_P) src/ext/curve25519_donna @: > src/ext/curve25519_donna/$(am__dirstamp) @@ -10989,6 +11079,9 @@ src/trunnel/libor_trunnel_testing_a-conflux.$(OBJEXT): \ src/trunnel/$(am__dirstamp) \ src/trunnel/$(DEPDIR)/$(am__dirstamp) +src/trunnel/libor_trunnel_testing_a-subproto_request.$(OBJEXT): \ + src/trunnel/$(am__dirstamp) \ + src/trunnel/$(DEPDIR)/$(am__dirstamp) src/trunnel/libor-trunnel-testing.a: $(src_trunnel_libor_trunnel_testing_a_OBJECTS) $(src_trunnel_libor_trunnel_testing_a_DEPENDENCIES) $(EXTRA_src_trunnel_libor_trunnel_testing_a_DEPENDENCIES) src/trunnel/$(am__dirstamp) $(AM_V_at)-rm -f src/trunnel/libor-trunnel-testing.a @@ -11042,6 +11135,9 @@ src/trunnel/libor_trunnel_a-conflux.$(OBJEXT): \ src/trunnel/$(am__dirstamp) \ src/trunnel/$(DEPDIR)/$(am__dirstamp) +src/trunnel/libor_trunnel_a-subproto_request.$(OBJEXT): \ + src/trunnel/$(am__dirstamp) \ + src/trunnel/$(DEPDIR)/$(am__dirstamp) src/trunnel/libor-trunnel.a: $(src_trunnel_libor_trunnel_a_OBJECTS) $(src_trunnel_libor_trunnel_a_DEPENDENCIES) $(EXTRA_src_trunnel_libor_trunnel_a_DEPENDENCIES) src/trunnel/$(am__dirstamp) $(AM_V_at)-rm -f src/trunnel/libor-trunnel.a @@ -11484,6 +11580,8 @@ src/test/$(DEPDIR)/$(am__dirstamp) src/test/test-test_crypto_rng.$(OBJEXT): src/test/$(am__dirstamp) \ src/test/$(DEPDIR)/$(am__dirstamp) +src/test/test-test_crypto_cgo.$(OBJEXT): src/test/$(am__dirstamp) \ + src/test/$(DEPDIR)/$(am__dirstamp) src/test/test-test_data.$(OBJEXT): src/test/$(am__dirstamp) \ src/test/$(DEPDIR)/$(am__dirstamp) src/test/test-test_dir.$(OBJEXT): src/test/$(am__dirstamp) \ @@ -11830,6 +11928,7 @@ -rm -f src/ext/equix/src/*.$(OBJEXT) -rm -f src/ext/keccak-tiny/*.$(OBJEXT) -rm -f src/ext/mulodi/*.$(OBJEXT) + -rm -f src/ext/polyval/*.$(OBJEXT) -rm -f src/ext/trunnel/*.$(OBJEXT) -rm -f src/feature/api/*.$(OBJEXT) -rm -f src/feature/client/*.$(OBJEXT) @@ -11921,14 +12020,16 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_fast.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor_v3.Po@am__quote@ # am--include-marker -@AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/onion_crypto.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/onion_fast.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/onion_ntor.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/onion_ntor_v3.Po@am__quote@ # am--include-marker -@AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/onion_tap.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/relay_crypto.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/relay_crypto_cgo.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/core/crypto/$(DEPDIR)/relay_crypto_tor1.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/mainloop/$(DEPDIR)/connection.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/mainloop/$(DEPDIR)/cpuworker.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Po@am__quote@ # am--include-marker @@ -12010,6 +12111,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-protover.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-reasons.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-relay.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_kist.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_vanilla.Po@am__quote@ # am--include-marker @@ -12027,6 +12129,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/protover.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/reasons.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/relay.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/relay_msg.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/scheduler.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/scheduler_kist.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/core/or/$(DEPDIR)/scheduler_vanilla.Po@am__quote@ # am--include-marker @@ -12116,6 +12219,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/ext/keccak-tiny/$(DEPDIR)/libkeccak_tiny_a-keccak-tiny-unrolled.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_a-mulodi4.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_testing_a-mulodi4.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_testing_a-trunnel.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/feature/api/$(DEPDIR)/core_libtor_app_testing_a-tor_api.Po@am__quote@ # am--include-marker @@ -12725,6 +12829,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_controller.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_controller_events.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_crypto.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_crypto_cgo.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_crypto_ope.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_crypto_openssl.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/test/$(DEPDIR)/test-test_crypto_rng.Po@am__quote@ # am--include-marker @@ -12948,6 +13053,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_a-pwbox.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_a-sendme_cell.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_a-socks5.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-channelpadding_negotiation.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-circpad_negotiation.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-conflux.Po@am__quote@ # am--include-marker @@ -12960,6 +13066,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-pwbox.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-sendme_cell.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-socks5.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_establish_intro.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_introduce1.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_rendezvous.Po@am__quote@ # am--include-marker @@ -13059,20 +13166,6 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-onion_ntor_v3.obj `if test -f 'src/core/crypto/onion_ntor_v3.c'; then $(CYGPATH_W) 'src/core/crypto/onion_ntor_v3.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/onion_ntor_v3.c'; fi` -src/core/crypto/libtor_app_testing_a-onion_tap.o: src/core/crypto/onion_tap.c -@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-onion_tap.o -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Tpo -c -o src/core/crypto/libtor_app_testing_a-onion_tap.o `test -f 'src/core/crypto/onion_tap.c' || echo '$(srcdir)/'`src/core/crypto/onion_tap.c -@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/crypto/onion_tap.c' object='src/core/crypto/libtor_app_testing_a-onion_tap.o' libtool=no @AMDEPBACKSLASH@ -@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-onion_tap.o `test -f 'src/core/crypto/onion_tap.c' || echo '$(srcdir)/'`src/core/crypto/onion_tap.c - -src/core/crypto/libtor_app_testing_a-onion_tap.obj: src/core/crypto/onion_tap.c -@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-onion_tap.obj -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Tpo -c -o src/core/crypto/libtor_app_testing_a-onion_tap.obj `if test -f 'src/core/crypto/onion_tap.c'; then $(CYGPATH_W) 'src/core/crypto/onion_tap.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/onion_tap.c'; fi` -@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/crypto/onion_tap.c' object='src/core/crypto/libtor_app_testing_a-onion_tap.obj' libtool=no @AMDEPBACKSLASH@ -@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-onion_tap.obj `if test -f 'src/core/crypto/onion_tap.c'; then $(CYGPATH_W) 'src/core/crypto/onion_tap.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/onion_tap.c'; fi` - src/core/crypto/libtor_app_testing_a-relay_crypto.o: src/core/crypto/relay_crypto.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-relay_crypto.o -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Tpo -c -o src/core/crypto/libtor_app_testing_a-relay_crypto.o `test -f 'src/core/crypto/relay_crypto.c' || echo '$(srcdir)/'`src/core/crypto/relay_crypto.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Po @@ -13087,6 +13180,34 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-relay_crypto.obj `if test -f 'src/core/crypto/relay_crypto.c'; then $(CYGPATH_W) 'src/core/crypto/relay_crypto.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/relay_crypto.c'; fi` +src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.o: src/core/crypto/relay_crypto_cgo.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.o -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Tpo -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.o `test -f 'src/core/crypto/relay_crypto_cgo.c' || echo '$(srcdir)/'`src/core/crypto/relay_crypto_cgo.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/crypto/relay_crypto_cgo.c' object='src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.o `test -f 'src/core/crypto/relay_crypto_cgo.c' || echo '$(srcdir)/'`src/core/crypto/relay_crypto_cgo.c + +src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.obj: src/core/crypto/relay_crypto_cgo.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.obj -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Tpo -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.obj `if test -f 'src/core/crypto/relay_crypto_cgo.c'; then $(CYGPATH_W) 'src/core/crypto/relay_crypto_cgo.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/relay_crypto_cgo.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/crypto/relay_crypto_cgo.c' object='src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_cgo.obj `if test -f 'src/core/crypto/relay_crypto_cgo.c'; then $(CYGPATH_W) 'src/core/crypto/relay_crypto_cgo.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/relay_crypto_cgo.c'; fi` + +src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.o: src/core/crypto/relay_crypto_tor1.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.o -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Tpo -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.o `test -f 'src/core/crypto/relay_crypto_tor1.c' || echo '$(srcdir)/'`src/core/crypto/relay_crypto_tor1.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/crypto/relay_crypto_tor1.c' object='src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.o `test -f 'src/core/crypto/relay_crypto_tor1.c' || echo '$(srcdir)/'`src/core/crypto/relay_crypto_tor1.c + +src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.obj: src/core/crypto/relay_crypto_tor1.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.obj -MD -MP -MF src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Tpo -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.obj `if test -f 'src/core/crypto/relay_crypto_tor1.c'; then $(CYGPATH_W) 'src/core/crypto/relay_crypto_tor1.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/relay_crypto_tor1.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Tpo src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/crypto/relay_crypto_tor1.c' object='src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/crypto/libtor_app_testing_a-relay_crypto_tor1.obj `if test -f 'src/core/crypto/relay_crypto_tor1.c'; then $(CYGPATH_W) 'src/core/crypto/relay_crypto_tor1.c'; else $(CYGPATH_W) '$(srcdir)/src/core/crypto/relay_crypto_tor1.c'; fi` + src/core/mainloop/libtor_app_testing_a-connection.o: src/core/mainloop/connection.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/mainloop/libtor_app_testing_a-connection.o -MD -MP -MF src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Tpo -c -o src/core/mainloop/libtor_app_testing_a-connection.o `test -f 'src/core/mainloop/connection.c' || echo '$(srcdir)/'`src/core/mainloop/connection.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Tpo src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Po @@ -13591,6 +13712,20 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/or/libtor_app_testing_a-relay.obj `if test -f 'src/core/or/relay.c'; then $(CYGPATH_W) 'src/core/or/relay.c'; else $(CYGPATH_W) '$(srcdir)/src/core/or/relay.c'; fi` +src/core/or/libtor_app_testing_a-relay_msg.o: src/core/or/relay_msg.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/or/libtor_app_testing_a-relay_msg.o -MD -MP -MF src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Tpo -c -o src/core/or/libtor_app_testing_a-relay_msg.o `test -f 'src/core/or/relay_msg.c' || echo '$(srcdir)/'`src/core/or/relay_msg.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Tpo src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/or/relay_msg.c' object='src/core/or/libtor_app_testing_a-relay_msg.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/or/libtor_app_testing_a-relay_msg.o `test -f 'src/core/or/relay_msg.c' || echo '$(srcdir)/'`src/core/or/relay_msg.c + +src/core/or/libtor_app_testing_a-relay_msg.obj: src/core/or/relay_msg.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/or/libtor_app_testing_a-relay_msg.obj -MD -MP -MF src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Tpo -c -o src/core/or/libtor_app_testing_a-relay_msg.obj `if test -f 'src/core/or/relay_msg.c'; then $(CYGPATH_W) 'src/core/or/relay_msg.c'; else $(CYGPATH_W) '$(srcdir)/src/core/or/relay_msg.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Tpo src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/core/or/relay_msg.c' object='src/core/or/libtor_app_testing_a-relay_msg.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -c -o src/core/or/libtor_app_testing_a-relay_msg.obj `if test -f 'src/core/or/relay_msg.c'; then $(CYGPATH_W) 'src/core/or/relay_msg.c'; else $(CYGPATH_W) '$(srcdir)/src/core/or/relay_msg.c'; fi` + src/core/or/libtor_app_testing_a-scheduler.o: src/core/or/scheduler.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_core_libtor_app_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_core_libtor_app_testing_a_CFLAGS) $(CFLAGS) -MT src/core/or/libtor_app_testing_a-scheduler.o -MD -MP -MF src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Tpo -c -o src/core/or/libtor_app_testing_a-scheduler.o `test -f 'src/core/or/scheduler.c' || echo '$(srcdir)/'`src/core/or/scheduler.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Tpo src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Po @@ -16545,6 +16680,20 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(src_ext_keccak_tiny_libkeccak_tiny_a_CFLAGS) $(CFLAGS) -c -o src/ext/keccak-tiny/libkeccak_tiny_a-keccak-tiny-unrolled.obj `if test -f 'src/ext/keccak-tiny/keccak-tiny-unrolled.c'; then $(CYGPATH_W) 'src/ext/keccak-tiny/keccak-tiny-unrolled.c'; else $(CYGPATH_W) '$(srcdir)/src/ext/keccak-tiny/keccak-tiny-unrolled.c'; fi` +src/ext/polyval/libpolyval_a-polyval.o: src/ext/polyval/polyval.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(src_ext_polyval_libpolyval_a_CFLAGS) $(CFLAGS) -MT src/ext/polyval/libpolyval_a-polyval.o -MD -MP -MF src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Tpo -c -o src/ext/polyval/libpolyval_a-polyval.o `test -f 'src/ext/polyval/polyval.c' || echo '$(srcdir)/'`src/ext/polyval/polyval.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Tpo src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/ext/polyval/polyval.c' object='src/ext/polyval/libpolyval_a-polyval.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(src_ext_polyval_libpolyval_a_CFLAGS) $(CFLAGS) -c -o src/ext/polyval/libpolyval_a-polyval.o `test -f 'src/ext/polyval/polyval.c' || echo '$(srcdir)/'`src/ext/polyval/polyval.c + +src/ext/polyval/libpolyval_a-polyval.obj: src/ext/polyval/polyval.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(src_ext_polyval_libpolyval_a_CFLAGS) $(CFLAGS) -MT src/ext/polyval/libpolyval_a-polyval.obj -MD -MP -MF src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Tpo -c -o src/ext/polyval/libpolyval_a-polyval.obj `if test -f 'src/ext/polyval/polyval.c'; then $(CYGPATH_W) 'src/ext/polyval/polyval.c'; else $(CYGPATH_W) '$(srcdir)/src/ext/polyval/polyval.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Tpo src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/ext/polyval/polyval.c' object='src/ext/polyval/libpolyval_a-polyval.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(src_ext_polyval_libpolyval_a_CFLAGS) $(CFLAGS) -c -o src/ext/polyval/libpolyval_a-polyval.obj `if test -f 'src/ext/polyval/polyval.c'; then $(CYGPATH_W) 'src/ext/polyval/polyval.c'; else $(CYGPATH_W) '$(srcdir)/src/ext/polyval/polyval.c'; fi` + src/ext/curve25519_donna/lib_libcurve25519_donna_a-curve25519-donna-c64.o: src/ext/curve25519_donna/curve25519-donna-c64.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(src_lib_libcurve25519_donna_a_CFLAGS) $(CFLAGS) -MT src/ext/curve25519_donna/lib_libcurve25519_donna_a-curve25519-donna-c64.o -MD -MP -MF src/ext/curve25519_donna/$(DEPDIR)/lib_libcurve25519_donna_a-curve25519-donna-c64.Tpo -c -o src/ext/curve25519_donna/lib_libcurve25519_donna_a-curve25519-donna-c64.o `test -f 'src/ext/curve25519_donna/curve25519-donna-c64.c' || echo '$(srcdir)/'`src/ext/curve25519_donna/curve25519-donna-c64.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/ext/curve25519_donna/$(DEPDIR)/lib_libcurve25519_donna_a-curve25519-donna-c64.Tpo src/ext/curve25519_donna/$(DEPDIR)/lib_libcurve25519_donna_a-curve25519-donna-c64.Po @@ -20031,6 +20180,20 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_trunnel_libor_trunnel_testing_a_CFLAGS) $(CFLAGS) -c -o src/trunnel/libor_trunnel_testing_a-conflux.obj `if test -f 'src/trunnel/conflux.c'; then $(CYGPATH_W) 'src/trunnel/conflux.c'; else $(CYGPATH_W) '$(srcdir)/src/trunnel/conflux.c'; fi` +src/trunnel/libor_trunnel_testing_a-subproto_request.o: src/trunnel/subproto_request.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_trunnel_libor_trunnel_testing_a_CFLAGS) $(CFLAGS) -MT src/trunnel/libor_trunnel_testing_a-subproto_request.o -MD -MP -MF src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Tpo -c -o src/trunnel/libor_trunnel_testing_a-subproto_request.o `test -f 'src/trunnel/subproto_request.c' || echo '$(srcdir)/'`src/trunnel/subproto_request.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Tpo src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/trunnel/subproto_request.c' object='src/trunnel/libor_trunnel_testing_a-subproto_request.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_trunnel_libor_trunnel_testing_a_CFLAGS) $(CFLAGS) -c -o src/trunnel/libor_trunnel_testing_a-subproto_request.o `test -f 'src/trunnel/subproto_request.c' || echo '$(srcdir)/'`src/trunnel/subproto_request.c + +src/trunnel/libor_trunnel_testing_a-subproto_request.obj: src/trunnel/subproto_request.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_trunnel_libor_trunnel_testing_a_CFLAGS) $(CFLAGS) -MT src/trunnel/libor_trunnel_testing_a-subproto_request.obj -MD -MP -MF src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Tpo -c -o src/trunnel/libor_trunnel_testing_a-subproto_request.obj `if test -f 'src/trunnel/subproto_request.c'; then $(CYGPATH_W) 'src/trunnel/subproto_request.c'; else $(CYGPATH_W) '$(srcdir)/src/trunnel/subproto_request.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Tpo src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/trunnel/subproto_request.c' object='src/trunnel/libor_trunnel_testing_a-subproto_request.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_testing_a_CPPFLAGS) $(CPPFLAGS) $(src_trunnel_libor_trunnel_testing_a_CFLAGS) $(CFLAGS) -c -o src/trunnel/libor_trunnel_testing_a-subproto_request.obj `if test -f 'src/trunnel/subproto_request.c'; then $(CYGPATH_W) 'src/trunnel/subproto_request.c'; else $(CYGPATH_W) '$(srcdir)/src/trunnel/subproto_request.c'; fi` + src/ext/trunnel/trunnel_libor_trunnel_a-trunnel.o: src/ext/trunnel/trunnel.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_a_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT src/ext/trunnel/trunnel_libor_trunnel_a-trunnel.o -MD -MP -MF src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Tpo -c -o src/ext/trunnel/trunnel_libor_trunnel_a-trunnel.o `test -f 'src/ext/trunnel/trunnel.c' || echo '$(srcdir)/'`src/ext/trunnel/trunnel.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Tpo src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Po @@ -20255,6 +20418,20 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_a_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o src/trunnel/libor_trunnel_a-conflux.obj `if test -f 'src/trunnel/conflux.c'; then $(CYGPATH_W) 'src/trunnel/conflux.c'; else $(CYGPATH_W) '$(srcdir)/src/trunnel/conflux.c'; fi` +src/trunnel/libor_trunnel_a-subproto_request.o: src/trunnel/subproto_request.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_a_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT src/trunnel/libor_trunnel_a-subproto_request.o -MD -MP -MF src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Tpo -c -o src/trunnel/libor_trunnel_a-subproto_request.o `test -f 'src/trunnel/subproto_request.c' || echo '$(srcdir)/'`src/trunnel/subproto_request.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Tpo src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/trunnel/subproto_request.c' object='src/trunnel/libor_trunnel_a-subproto_request.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_a_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o src/trunnel/libor_trunnel_a-subproto_request.o `test -f 'src/trunnel/subproto_request.c' || echo '$(srcdir)/'`src/trunnel/subproto_request.c + +src/trunnel/libor_trunnel_a-subproto_request.obj: src/trunnel/subproto_request.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_a_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT src/trunnel/libor_trunnel_a-subproto_request.obj -MD -MP -MF src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Tpo -c -o src/trunnel/libor_trunnel_a-subproto_request.obj `if test -f 'src/trunnel/subproto_request.c'; then $(CYGPATH_W) 'src/trunnel/subproto_request.c'; else $(CYGPATH_W) '$(srcdir)/src/trunnel/subproto_request.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Tpo src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/trunnel/subproto_request.c' object='src/trunnel/libor_trunnel_a-subproto_request.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_trunnel_libor_trunnel_a_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o src/trunnel/libor_trunnel_a-subproto_request.obj `if test -f 'src/trunnel/subproto_request.c'; then $(CYGPATH_W) 'src/trunnel/subproto_request.c'; else $(CYGPATH_W) '$(srcdir)/src/trunnel/subproto_request.c'; fi` + src/app/main/tor_cov-tor_main.o: src/app/main/tor_main.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_app_tor_cov_CPPFLAGS) $(CPPFLAGS) $(src_app_tor_cov_CFLAGS) $(CFLAGS) -MT src/app/main/tor_cov-tor_main.o -MD -MP -MF src/app/main/$(DEPDIR)/tor_cov-tor_main.Tpo -c -o src/app/main/tor_cov-tor_main.o `test -f 'src/app/main/tor_main.c' || echo '$(srcdir)/'`src/app/main/tor_main.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/app/main/$(DEPDIR)/tor_cov-tor_main.Tpo src/app/main/$(DEPDIR)/tor_cov-tor_main.Po @@ -21795,6 +21972,20 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_test_test_CPPFLAGS) $(CPPFLAGS) $(src_test_test_CFLAGS) $(CFLAGS) -c -o src/test/test-test_crypto_rng.obj `if test -f 'src/test/test_crypto_rng.c'; then $(CYGPATH_W) 'src/test/test_crypto_rng.c'; else $(CYGPATH_W) '$(srcdir)/src/test/test_crypto_rng.c'; fi` +src/test/test-test_crypto_cgo.o: src/test/test_crypto_cgo.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_test_test_CPPFLAGS) $(CPPFLAGS) $(src_test_test_CFLAGS) $(CFLAGS) -MT src/test/test-test_crypto_cgo.o -MD -MP -MF src/test/$(DEPDIR)/test-test_crypto_cgo.Tpo -c -o src/test/test-test_crypto_cgo.o `test -f 'src/test/test_crypto_cgo.c' || echo '$(srcdir)/'`src/test/test_crypto_cgo.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/test/$(DEPDIR)/test-test_crypto_cgo.Tpo src/test/$(DEPDIR)/test-test_crypto_cgo.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/test/test_crypto_cgo.c' object='src/test/test-test_crypto_cgo.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_test_test_CPPFLAGS) $(CPPFLAGS) $(src_test_test_CFLAGS) $(CFLAGS) -c -o src/test/test-test_crypto_cgo.o `test -f 'src/test/test_crypto_cgo.c' || echo '$(srcdir)/'`src/test/test_crypto_cgo.c + +src/test/test-test_crypto_cgo.obj: src/test/test_crypto_cgo.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_test_test_CPPFLAGS) $(CPPFLAGS) $(src_test_test_CFLAGS) $(CFLAGS) -MT src/test/test-test_crypto_cgo.obj -MD -MP -MF src/test/$(DEPDIR)/test-test_crypto_cgo.Tpo -c -o src/test/test-test_crypto_cgo.obj `if test -f 'src/test/test_crypto_cgo.c'; then $(CYGPATH_W) 'src/test/test_crypto_cgo.c'; else $(CYGPATH_W) '$(srcdir)/src/test/test_crypto_cgo.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/test/$(DEPDIR)/test-test_crypto_cgo.Tpo src/test/$(DEPDIR)/test-test_crypto_cgo.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='src/test/test_crypto_cgo.c' object='src/test/test-test_crypto_cgo.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_test_test_CPPFLAGS) $(CPPFLAGS) $(src_test_test_CFLAGS) $(CFLAGS) -c -o src/test/test-test_crypto_cgo.obj `if test -f 'src/test/test_crypto_cgo.c'; then $(CYGPATH_W) 'src/test/test_crypto_cgo.c'; else $(CYGPATH_W) '$(srcdir)/src/test/test_crypto_cgo.c'; fi` + src/test/test-test_data.o: src/test/test_data.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(src_test_test_CPPFLAGS) $(CPPFLAGS) $(src_test_test_CFLAGS) $(CFLAGS) -MT src/test/test-test_data.o -MD -MP -MF src/test/$(DEPDIR)/test-test_data.Tpo -c -o src/test/test-test_data.o `test -f 'src/test/test_data.c' || echo '$(srcdir)/'`src/test/test_data.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) src/test/$(DEPDIR)/test-test_data.Tpo src/test/$(DEPDIR)/test-test_data.Po @@ -24108,6 +24299,8 @@ -rm -f src/ext/keccak-tiny/$(am__dirstamp) -rm -f src/ext/mulodi/$(DEPDIR)/$(am__dirstamp) -rm -f src/ext/mulodi/$(am__dirstamp) + -rm -f src/ext/polyval/$(DEPDIR)/$(am__dirstamp) + -rm -f src/ext/polyval/$(am__dirstamp) -rm -f src/ext/trunnel/$(DEPDIR)/$(am__dirstamp) -rm -f src/ext/trunnel/$(am__dirstamp) -rm -f src/feature/api/$(DEPDIR)/$(am__dirstamp) @@ -24267,14 +24460,16 @@ -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_fast.Po -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor.Po -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor_v3.Po - -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Po -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Po + -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Po + -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Po -rm -f src/core/crypto/$(DEPDIR)/onion_crypto.Po -rm -f src/core/crypto/$(DEPDIR)/onion_fast.Po -rm -f src/core/crypto/$(DEPDIR)/onion_ntor.Po -rm -f src/core/crypto/$(DEPDIR)/onion_ntor_v3.Po - -rm -f src/core/crypto/$(DEPDIR)/onion_tap.Po -rm -f src/core/crypto/$(DEPDIR)/relay_crypto.Po + -rm -f src/core/crypto/$(DEPDIR)/relay_crypto_cgo.Po + -rm -f src/core/crypto/$(DEPDIR)/relay_crypto_tor1.Po -rm -f src/core/mainloop/$(DEPDIR)/connection.Po -rm -f src/core/mainloop/$(DEPDIR)/cpuworker.Po -rm -f src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Po @@ -24356,6 +24551,7 @@ -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-protover.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-reasons.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-relay.Po + -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_kist.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_vanilla.Po @@ -24373,6 +24569,7 @@ -rm -f src/core/or/$(DEPDIR)/protover.Po -rm -f src/core/or/$(DEPDIR)/reasons.Po -rm -f src/core/or/$(DEPDIR)/relay.Po + -rm -f src/core/or/$(DEPDIR)/relay_msg.Po -rm -f src/core/or/$(DEPDIR)/scheduler.Po -rm -f src/core/or/$(DEPDIR)/scheduler_kist.Po -rm -f src/core/or/$(DEPDIR)/scheduler_vanilla.Po @@ -24462,6 +24659,7 @@ -rm -f src/ext/keccak-tiny/$(DEPDIR)/libkeccak_tiny_a-keccak-tiny-unrolled.Po -rm -f src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_a-mulodi4.Po -rm -f src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_testing_a-mulodi4.Po + -rm -f src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Po -rm -f src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Po -rm -f src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_testing_a-trunnel.Po -rm -f src/feature/api/$(DEPDIR)/core_libtor_app_testing_a-tor_api.Po @@ -25071,6 +25269,7 @@ -rm -f src/test/$(DEPDIR)/test-test_controller.Po -rm -f src/test/$(DEPDIR)/test-test_controller_events.Po -rm -f src/test/$(DEPDIR)/test-test_crypto.Po + -rm -f src/test/$(DEPDIR)/test-test_crypto_cgo.Po -rm -f src/test/$(DEPDIR)/test-test_crypto_ope.Po -rm -f src/test/$(DEPDIR)/test-test_crypto_openssl.Po -rm -f src/test/$(DEPDIR)/test-test_crypto_rng.Po @@ -25294,6 +25493,7 @@ -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-pwbox.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-sendme_cell.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-socks5.Po + -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-channelpadding_negotiation.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-circpad_negotiation.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-conflux.Po @@ -25306,6 +25506,7 @@ -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-pwbox.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-sendme_cell.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-socks5.Po + -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Po -rm -f src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_establish_intro.Po -rm -f src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_introduce1.Po -rm -f src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_rendezvous.Po @@ -25388,14 +25589,16 @@ -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_fast.Po -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor.Po -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_ntor_v3.Po - -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-onion_tap.Po -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto.Po + -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_cgo.Po + -rm -f src/core/crypto/$(DEPDIR)/libtor_app_testing_a-relay_crypto_tor1.Po -rm -f src/core/crypto/$(DEPDIR)/onion_crypto.Po -rm -f src/core/crypto/$(DEPDIR)/onion_fast.Po -rm -f src/core/crypto/$(DEPDIR)/onion_ntor.Po -rm -f src/core/crypto/$(DEPDIR)/onion_ntor_v3.Po - -rm -f src/core/crypto/$(DEPDIR)/onion_tap.Po -rm -f src/core/crypto/$(DEPDIR)/relay_crypto.Po + -rm -f src/core/crypto/$(DEPDIR)/relay_crypto_cgo.Po + -rm -f src/core/crypto/$(DEPDIR)/relay_crypto_tor1.Po -rm -f src/core/mainloop/$(DEPDIR)/connection.Po -rm -f src/core/mainloop/$(DEPDIR)/cpuworker.Po -rm -f src/core/mainloop/$(DEPDIR)/libtor_app_testing_a-connection.Po @@ -25477,6 +25680,7 @@ -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-protover.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-reasons.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-relay.Po + -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-relay_msg.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_kist.Po -rm -f src/core/or/$(DEPDIR)/libtor_app_testing_a-scheduler_vanilla.Po @@ -25494,6 +25698,7 @@ -rm -f src/core/or/$(DEPDIR)/protover.Po -rm -f src/core/or/$(DEPDIR)/reasons.Po -rm -f src/core/or/$(DEPDIR)/relay.Po + -rm -f src/core/or/$(DEPDIR)/relay_msg.Po -rm -f src/core/or/$(DEPDIR)/scheduler.Po -rm -f src/core/or/$(DEPDIR)/scheduler_kist.Po -rm -f src/core/or/$(DEPDIR)/scheduler_vanilla.Po @@ -25583,6 +25788,7 @@ -rm -f src/ext/keccak-tiny/$(DEPDIR)/libkeccak_tiny_a-keccak-tiny-unrolled.Po -rm -f src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_a-mulodi4.Po -rm -f src/ext/mulodi/$(DEPDIR)/lib_libtor_ctime_testing_a-mulodi4.Po + -rm -f src/ext/polyval/$(DEPDIR)/libpolyval_a-polyval.Po -rm -f src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_a-trunnel.Po -rm -f src/ext/trunnel/$(DEPDIR)/trunnel_libor_trunnel_testing_a-trunnel.Po -rm -f src/feature/api/$(DEPDIR)/core_libtor_app_testing_a-tor_api.Po @@ -26192,6 +26398,7 @@ -rm -f src/test/$(DEPDIR)/test-test_controller.Po -rm -f src/test/$(DEPDIR)/test-test_controller_events.Po -rm -f src/test/$(DEPDIR)/test-test_crypto.Po + -rm -f src/test/$(DEPDIR)/test-test_crypto_cgo.Po -rm -f src/test/$(DEPDIR)/test-test_crypto_ope.Po -rm -f src/test/$(DEPDIR)/test-test_crypto_openssl.Po -rm -f src/test/$(DEPDIR)/test-test_crypto_rng.Po @@ -26415,6 +26622,7 @@ -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-pwbox.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-sendme_cell.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-socks5.Po + -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_a-subproto_request.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-channelpadding_negotiation.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-circpad_negotiation.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-conflux.Po @@ -26427,6 +26635,7 @@ -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-pwbox.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-sendme_cell.Po -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-socks5.Po + -rm -f src/trunnel/$(DEPDIR)/libor_trunnel_testing_a-subproto_request.Po -rm -f src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_establish_intro.Po -rm -f src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_introduce1.Po -rm -f src/trunnel/hs/$(DEPDIR)/libor_trunnel_a-cell_rendezvous.Po diff -Nru tor-0.4.8.16/README.md tor-0.4.9.6/README.md --- tor-0.4.8.16/README.md 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/README.md 2026-03-25 14:30:34.000000000 +0000 @@ -58,13 +58,16 @@ Download new versions: -- https://www.torproject.org/download/download.html +- https://www.torproject.org/download/tor -Documentation, including links to installation and setup instructions: +How to verify Tor source: -- https://www.torproject.org/docs/documentation.html +- https://support.torproject.org/little-t-tor/ -Frequently Asked Questions: +Documentation and Frequently Asked Questions: -- https://www.torproject.org/docs/faq.html +- https://support.torproject.org/ +How to run a Tor relay: + +- https://community.torproject.org/relay/ diff -Nru tor-0.4.8.16/ReleaseNotes tor-0.4.9.6/ReleaseNotes --- tor-0.4.8.16/ReleaseNotes 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/ReleaseNotes 2026-03-25 14:30:34.000000000 +0000 @@ -2,10 +2,531 @@ release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.4.9.6 - 2026-03-25 + This is a security release fixing major bugfixes that could possibly lead to + remote crashing relays. We strongly recommend upgrading as soon as possible. + + o Major bugfix (security): + - Fix a stack overflow of 11 bytes on malicious CREATED2. This lead + to a remote crash. TROVE-2026-003. Reported-by: Anas Cherni of + Calif.io. Fixes bug 41231; bugfix on 0.4.9.1-alpha. + + o Major bugfix (security, conflux): + - Fix a memory compare using the wrong length. This could lead to a + remote crash when using the conflux subsystem. TROVE-2026-004. + Fixes bug 41232; bugfix on 0.4.8.1-alpha. + + o Minor bugfixes (security): + - Fix a series of defense in depth security issues found across the + codebase. Fixes bug 41228; bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (portability): + - (Hopefully) fix our polyval implementation on big-endian + platforms. Fixes bug 41215; bugfix on 0.4.9.3-alpha. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on March 25, 2026. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2026/03/25. + + +Changes in version 0.4.9.5 - 2026-02-12 + This first stable release in the 0.4.9 series introduces a new + circuit-level encryption design for better client security, as well + as a more scalable way for large relay operators to annotate which + relays they run so clients can avoid using too many of them in a + single circuit. + + o Major features (cryptography): + - Clients and relays can now negotiate Counter Galois Onion (CGO) + relay cryptography, as designed by Jean Paul Degabriele, + Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam. CGO + provides improved resistance to several kinds of tagging attacks, + better forward secrecy, and better forgery resistance. Closes + ticket 41047. Implements proposal 359. + + o Major features (path selection): + - Clients and relays now support "happy families", a system to + simplify relay family operation and improve directory performance. + With "happy families", relays in a family share a secret "family + key", which they use to prove their membership in the family. + Implements proposal 321; closes ticket 41009. Note that until + enough clients are upgraded, relay operators will still need to + configure MyFamily lists. But once clients no longer depend on + those lists, we will be able to remove them entirely, thereby + simplifying family operation, and making microdescriptor downloads + approximately 80% smaller. For more information, see + https://community.torproject.org/relay/setup/post-install/family-ids/ + + o Major bugfixes (conflux): + - Ensure conflux guards obey family and subnet restrictions. Fixes + bug 40976; bugfix on 0.4.8.1-alpha. + + o Major bugfixes (controller events): + - Fix spikes occurring in bandwidth cache events on control connection. + Fixes bug 31524; bugfix on 0.0.9pre5. + + o Major bugfixes (sandbox): + - Fix sandbox to work on architectures that use Linux's generic + syscall interface, extending support for AArch64 (ARM64) and + adding support for RISC-V, allowing test_include.sh and the + sandbox unit tests to pass on these systems even when building + with fragile hardening enabled. Fixes bugs 40465 and 40599; bugfix + on 0.2.5.1-alpha. + + o Minor features (client security, reliability): + - When KeepaliveIsolateSOCKSAuth is keeping a circuit alive, expire + the circuit based on when it was last in use for any stream, not + (as we did before) based on when a stream was last attached to it. + Closes ticket 41157. Implements a minimal version of Proposal 368. + + o Minor features (exit relays): + - Implement reevaluating new exit policy against existing + connections. This is controlled by new config option + ReevaluateExitPolicy, defaulting to 0. Closes ticket 40676. + - Implement a token-bucket based rate limiter for stream creation + and resolve request. It is configured by the DoSStream* family of + configuration options. Closes ticket 40736. + - Add Monero ports to the ReducedExitPolicy. Closes ticket 41168. + + o Minor features (bridges): + - Save complete bridge lines to 'datadir/bridgelines'. Closes + ticket 29128. + + o Minor features (client extensibility): + - Implement new HTTPTunnelPort features for interoperability with + Arti's HTTP CONNECT proxy. This work adds new headers to requests + to and replies from the HttpConnectPort, support for OPTIONS + requests, tightens the expected syntax for Proxy-Authorization, + and increases defense-in-depth against some kinds of cross-site + HTTP attacks. Closes ticket 41156. Implements proposal 365. + - Detect invalid SOCKS5 username/password combinations according to + new extended parameters syntax. (Currently, this rejects any + SOCKS5 username beginning with "", except for the username + "0". Such usernames are now reserved to communicate + additional parameters with other Tor implementations.) Implements + proposal 351. + + o Minor features (sandboxing): + - Allow the fstatat64 and statx syscalls on i386 architecture when + glibc >= 2.33. On i386, glibc uses fstatat64 instead of newfstatat + for stat operations, and statx for time64 support. Without this, + SIGHUP configuration reload fails when using sandbox mode with + %include directives on i386 with Debian Bookworm or newer. + - Allow the lstat64 syscall on i386 architecture. This syscall is + used by glob() in glibc 2.36+ when processing %include directives + with directory patterns. + + o Minor features (security): + - Increase the size of our finite-field Diffie Hellman TLS group + (which we should never actually use!) to 2048 bits. Part of + ticket 41067. + - Require TLS version 1.2 or later. (Version 1.3 support will be + required in the near future.) Part of ticket 41067. + - Update TLS 1.2 client cipher list to match current Firefox. Part + of ticket 41067. + - Verify needle is smaller than haystack before calling memmem. + Closes ticket 40854. + + o Minor features (onion services): + - Add 3 more keywords to the ADD_ONION control command: + PoWDefensesEnabled, PoWQueueRate and PoWQueueBurst which correspond + to HiddenServicePoWDefensesEnabled, HiddenServicePoWQueueRate and + HiddenServicePoWQueueBurst from torrc. + - Reduce the minimum value of hsdir_interval to match recent tor- + spec change. + + o Minor feature (directory authority): + - Introduce MinimalAcceptedServerVersion to allow configuring + the minimum accepted relay version without requiring a new tor + release. Closes ticket 40817. + + o Minor features (metrics port): + - New metrics on the MetricsPort for the number of BUG() calls that + occurred at runtime. Fixes bugs 40839 and 41104; bugfix on + 0.4.7.1-alpha. + - Handle rephist tracking of ntor and ntor_v3 handshakes + individually such that MetricsPort exposes the correct values. + Fixes bug 40638; bugfix on 0.4.7.11. + - Add new metrics for relays on the MetricsPort namely the count of + drop cell, destroy cell and the number of circuit protocol + violation seen that lead to a circuit close. Closes ticket 40816. + + o Minor features (forward-compatibility): + - We now correctly parse microdescriptors and router descriptors + that do not include TAP onion keys. (For backward compatibility, + authorities continue to require these keys.) Implements part of + proposal 350. + + o Minor features (portability, android): + - Use /data/local/tmp for data storage on Android by default. Closes + ticket 40487. Patch from Hans-Christoph Steiner. + + o Minor features (directory authority): + - Export unsigned consensus documents once we have seen a threshold + of signatures, as a step toward the consensus transparency + experiment. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on February 12, 2026. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, + as retrieved on 2026/02/12. + + o Minor features (windows): + - Various compilation fixes for our Windows CI. Closes ticket 41214. + + o Minor bugfixes (exit relays): + - Clip every returned DNS TTL to 60 (RESOLVED) in order to mitigate + an exit DNS cache oracle. Fixes bug 40979; bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (spec conformance): + - Set the length field correctly on RELAY_COMMAND_CONFLUX_SWITCH + messages. Previously, it was always set to the maximum value. + Fixes bug 41056; bugfix on 0.4.8.1-alpha. + - Do not treat "15" as a recognized remote END reason code. + Formerly, we treated it as synonymous with a local ENTRYPOLICY, + which isn't a valid remote code at all. Fixes bug 41171; bugfix + on 0.2.0.8-alpha. + + o Minor bugfixes (tooling): + - Fix a false positive valgrind related to inspecting a bitfield + next to another uninitialized bitfield. Fixes bug 41182; bugfix + on 0.3.3.2-alpha. + - Fix minor warnings from newer versions of shellcheck and clang. + Fixes bug 41166; bugfix on 0.4.3.1-alpha and several + other versions. + - Fix a warning when compiling with GCC 14.2. Closes 41032. + + o Minor bugfixes (threads): + - Make thread control POSIX compliant. Fixes bug 41109; bugfix + on 0.4.8.17. + + o Minor bugfix (client DNS): + - Handle empty DNS reply without sending back an error and instead + send back NOERROR (RFC1035 error code 0x0). Fixes bug 40248; + bugfix on 0.3.5.1-alpha. + + o Minor bugfixes (directory authorities): + - After we added layer-two vanguards, directory authorities wouldn't + think any of their vanguards were suitable for circuits, leading + to a "Failed to find node for hop #2 of our path. Discarding this + circuit." log message once per second from startup until they made + a fresh consensus. Now they look to their existing consensus on + startup, letting them build circuits properly from the beginning. + Fixes bug 40802; bugfix on 0.4.7.1-alpha. + + o Minor bugfixes (tests): + - Fix a test failure with OpenSSL builds running at security level 1 + or greater, which does not permit SHA-1 certificates. Fixes bug + 41021; bugfix on 0.2.8.1-alpha. + + o Minor bugfixes (bridges): + - Don't warn when BridgeRelay is 1 and ExitRelay is explicitly set + to 0. Fixes bug 40884; bugfix on 0.4.8.3-rc. + + o Minor bugfixes (conflux, client): + - Avoid a non fatal assert caused by data coming in on a conflux set + that is being freed during shutdown. Fixes bug 40870; bugfix + on 0.4.8.1-alpha. + + o Minor bugfixes (testing network): + - Enabling TestingTorNetwork no longer forces fast hidden service + intro point rotation. This reduces noise and errors when using + hidden services with TestingTorNetwork enabled. Fixes bug 40922; + bugfix on 0.3.2.1-alpha. + + o Minor bugfixes (relay): + - Refuse to overwrite an existing *.secret_family_key when running + tor --keygen-family. Fixes bug 41184; bugfix on 0.4.9.1-alpha. + + o New system requirements: + - When built with LibreSSL, Tor now requires LibreSSL 3.7 or later. + Part of ticket 41059. + - When built with OpenSSL, Tor now requires OpenSSL 1.1.1 or later. + (We strongly recommend 3.0 or later, but still build with 1.1.1, + even though it is not supported by the OpenSSL team, due to its + presence in Debian oldstable.) Part of ticket 41059. + + o Removed features (relays): + - Relays no longer support clients that falsely advertise TLS + ciphers they don't really support. (Clients have not done this + since 0.2.3.17-beta). Part of ticket 41031. + - Relays no longer support clients that require obsolete v1 and v2 + link handshakes. (The v3 link handshake has been supported since + 0.2.3.6-alpha). Part of ticket 41031. + - Relays no longer support the obsolete TAP circuit extension + protocol. (For backward compatibility, however, relays still + continue to include TAP keys in their descriptors.) Implements + part of proposal 350. + - Relays no longer support the obsolete "RSA-SHA256-TLSSecret" + authentication method, which used a dangerously short RSA key, and + which required access TLS session internals. The current method + ("Ed25519-SHA256-RFC5705") has been supported since 0.3.0.1-alpha. + Closes ticket 41020. + + o Removed features (directory authorities): + - Directory authorities no longer support consensus methods before + method 32. Closes ticket 40835. + - We include a new consensus method that removes support for + computing "package" lines in consensus documents. This feature was + never used, and support for including it in our votes was removed + in 0.4.2.1-alpha. Finishes implementation of proposal 301. + + +Changes in version 0.4.8.22 - 2026-01-28 + This is likely the very last release of the 0.4.8.x series. Three major + bugfixes detailed below including two affecting directory servers (basically + all relays). We strongly recommend upgrading as soon as possible. + + o Major bugfixes (security): + - Avoid an out-of-bounds read error that could occur with + V1-formatted EXTEND cells. Fixes bug 41180; bugfix on 0.4.8.1-alpha. + This is tracked as TROVE-2025-016. + + o Major bugfixes (directory servers): + - Allow old clients to fetch the consensus even if they use version + 0 of the SENDME protocol. In mid 2025 we changed the required + minimum version of the "FlowCtrl" protocol to 1, meaning directory + caches hang up on clients that send a version 0 SENDME cell. Since + old clients were no longer able to retrieve the consensus, they + couldn't learn about this required minimum version -- meaning + we've had many many old clients loading down directory servers for + the past months. Fixes bug 41191; bugfix on 0.4.1.1-alpha. + - Don't count networkstatus serves until they finish. When we + started serving a consensus document but the client didn't receive + all of it, we were still counting that as a success in our stats. + This mistake, which can be triggered for example by obsolete + clients or by DPI-based censorship, led to wildly inflated user + counts because we estimate total users in the world based on + successful consensus fetches. Fixes bug 41192; bugfix + on 0.2.1.1-alpha. + + o Minor feature (testing, CI): + - Bump the CI version of chutney to the current version as of + 2026-01-21 (3338f5c). + + o Minor features (debugging, compression): + - Do not check for compression bombs for buffers smaller than 5MB + (increased from 64 KB). Fixes ticket 40739; bugfix on 0.2.1.29. + + o Minor features (directory servers): + - Track how many times directory servers begin serving networkstatus + documents, so we can compare it to the number of times we finish + serving them. Motivated by the fixes in ticket 41192. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on January 28, 2026. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2026/01/28. + + o Minor bugfixes (relay): + - Downgrade "Error relaying cell across rendezvous" log warn to info + as the error condition is possible under normal circumstances. Fixes + bug 40951; bugfix on 0.3.5.1-alpha. + + o Code simplification and refactoring: + - Simplify SOCKS4a parsing to avoid the (false) appearance of + integer underflows, and to make the logic more obvious. Fixes bug + 41190; bugfix on 0.3.5.1-alpha. + + +Changes in version 0.4.8.21 - 2025-11-17 + This release is a continuation of the previous one and addresses additional + Conflux-related issues identified through further testing and feedback from + relay operators. We strongly recommend upgrading as soon as possible. + + o Major bugfixes (conflux, exit): + - When dequeuing out-of-order conflux cells, the circuit could be + closed in between two dequeues, which could lead to mishandling + a NULL pointer. Fixes bug 41162; bugfix on 0.4.8.4. + + o Minor feature (compiler flag): + - Add -mbranch-protection=standard for arm64. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on November 17, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/11/17. + + o Minor bugfixes (bridges, pluggable transport): + - Fix a bug causing the initial tor process to hang instead of + exiting with RunAsDaemon, when pluggable transports are used. + Fixes bug 41088; bugfix on 0.4.8.1-alpha. + + +Changes in version 0.4.8.20 - 2025-11-10 + This release fixes several bugs related to Conflux edge cases as well as + adding a new hardening compiler flag if supported. + + o Minor feature (compiler flag): + - Add -fcf-protection=full if supported by the compiler. + Implements ticket 41139. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on November 10, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/11/10. + + o Minor bugfixes (conflux fragile asserts): + - Fix the root cause of some conflux fragile asserts when a control + port listener is attached. Fixes bug 41037; bugfix on 0.4.8.16. + + o Minor bugfixes (conflux, relay): + - Fix a series of conflux edge cases about sequence number + arithmetic and OOM handler kicking in under heavy memory pressure. + Fixes bug 41155; bugfix on 0.4.8.4. + + +Changes in version 0.4.8.19 - 2025-10-06 + This release provides major bugfixes for a LibreSSL issue and a flow control + C-tor specific problem (not protocol). We strongly recommend you upgrade as + soon as possible. + + o Major bugfixes (client, TLS): + - Fix some clients not being able to connect to LibreSSL relays. + Fixes bug 41134; bugfix on 0.4.8.17. + + o Minor bugfixes (stream flow control performance): + - Use a 5 ms grace period to allow an edge connection to flush its + stream data to the socket before sending an XOFF. This + significantly reduces the number of XON/XOFF messages sent when + (1) the application is reading stream data at a fast rate, and (2) + conflux is enabled. Fixes part of bug 41130; bugfix on 0.4.7.2-alpha. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on October 06, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/10/06. + + o Minor bugfix (process): + - Avoid closing all possible FDs when spawning a process (PT). On + some systems, this could lead to 3+ minutes hang. Fixes bug 40990; + bugfix on 0.3.5.1-alpha. + + +Changes in version 0.4.8.18 - 2025-09-16 + This is a minor release with a major onion service directory cache (HSDir) + bug fix. A series of minor bugfixes as well. As always, we strongly recommend + to upgrade as soon as possible. + + o Major bugfixes (onion service directory cache): + - Preserve the download counter of an onion service descriptor + across descriptor uploads, so that recently updated descriptors + don't get pruned if there is memory pressure soon after update. + Additionally, create a separate torrc option MaxHSDirCacheBytes + that defaults to the former 20% of MaxMemInQueues threshold, but + can be controlled by relay operators under DoS. Also enforce this + threshold during HSDir uploads. Fixes bug 41006; bugfix + on 0.4.8.14. + + o Minor feature (padding, logging): + - Reduce the amount of messages being logged related to channel + padding timeout when log level is "notice". + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on September 16, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/09/16. + + o Minor bugfix (conflux): + - Remove the pending nonce if we realize that the nonce of the + unlinked circuit is not tracked anymore. Should avoid the non + fatal assert triggered with a control port circuit event. Fixes + bug 41037; bugfix on 0.4.8.15. + + o Minor bugfixes (circuit handling): + - Prevent circuit_mark_for_close() from being called twice on the + same circuit. Second fix attempt Fixes bug 41106; bugfix + on 0.4.8.17. + + +Changes in version 0.4.8.17 - 2025-06-30 + This is a minor providing a series of minor features especially in the realm + of TLS. It also brings a new set of recommended and required sub protocols. + And finally, few minor bugfixes, nothing major. As always, we strongly + recommend you upgrade as soon as possible. + + o Minor features (security, TLS): + - When we are running with OpenSSL 3.5.0 or later, support using the + ML-KEM768 for post-quantum key agreement. Closes ticket 41041. + + o Minor feature (client, TLS): + - Set the TLS 1.3 cipher list instead of falling back on the + default value. + + o Minor features (fallbackdir): + - Regenerate fallback directories generated on June 30, 2025. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2025/06/30. + + o Minor features (hsdesc POW): + - Tolerate multiple PoW schemes in onion service descriptors, for + future extensibility. Implements torspec ticket 272. + + o Minor features (performance TLS): + - When running with with OpenSSL 3.0.0 or later, support using + X25519 for TLS key agreement. (This should slightly improve + performance for TLS session establishment.) + + o Minor features (portability): + - Fix warnings when compiling with GCC 15. Closes ticket 41079. + + o Minor features (recommended protocols): + - Directory authorities now vote to recommend that clients support + certain protocols beyond those that are required. These include + improved support for connecting to relays on IPv6, NtorV3, and + congestion control. Part of ticket 40836. + + o Minor features (required protocols): + - Directory authorities now vote to require clients to support the + authenticated SENDME feature, which was introduced in + 0.4.1.1-alpha. Part of ticket 40836. + - Directory authorities now vote to require relays to support + certain protocols, all of which have been implemented since + 0.4.7.4-alpha or earlier. These include improved support for + connecting to relays on IPv6, NtorV3, running as a rate-limited + introduction point, authenticated SENDMEs, and congestion control. + Part of ticket 40836. + + o Minor bugfix (conflux): + - Avoid a non fatal assert when describing a conflux circuit on the + control port after being prepped to be freed. Fixes bug 41037; + bugfix on 0.4.8.15. + + o Minor bugfixes (circuit handling): + - Prevent circuit_mark_for_close() from being called twice on the + same circuit. Fixes bug 40951; bugfix on 0.4.8.16-dev. + + o Minor bugfixes (compiler warnings): + - Make sure the two bitfields in the half-closed edge struct are + unsigned, as we're using them for boolean values and assign 1 to + them. Fixes bug 40911; bugfix on 0.4.7.2-alpha. + + o Minor bugfixes (threads, memory): + - Improvements in cleanup of resources used by threads. Fixes bug + 40991; bugfix on 0.4.8.13-dev. + - Rework start and exit of worker threads. + + Changes in version 0.4.8.16 - 2025-03-24 - This is quick second release since 0.4.8.15 due to a typo in a directory - authority rule file. This only affects directory authorities. Regardless, - upgrading to latest stable is always desired. + This is a quick second release since 0.4.8.15 due to a typo in a directory + authority rule file. This only affects directory authorities. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as @@ -13,13 +534,13 @@ o Minor bugfix (dirauth): - Fix typo in flag assignment approved-routers file. Fixes bug - 41035; bugfix on 0.4.8.15 + 41035; bugfix on 0.4.8.15. Changes in version 0.4.8.15 - 2025-03-20 This is a minor release fixing a sandbox issue for bandwidth authority and a conflux issue on the control port. It also has a client fix about relay flag - usage. We strongly recommend to update as soon as possible as usual. + usage. o Minor feature (testing, CI): - Use a fixed version of chutney (be881a1e) instead of its current @@ -37,18 +558,18 @@ retrieved on 2025/03/20. o Minor bugfixes (control port): - - Correctly report conflux pair information to controller fields - Fixes bug 40872; bugfix on 0.4.8.1-alpha + - Correctly report conflux pair information to controller fields. + Fixes bug 40872; bugfix on 0.4.8.1-alpha. o Minor bugfixes (relay flag usage): - Fix client usage of the MiddleOnly flag so that MiddleOnly relays are not used as HS IP or RP by clients or services. Additionally, give dirauths the ability to remove specific flags, as an - alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha + alternative to MiddleOnly. Fixes bug 41023; bugfix on 0.4.7.2-alpha. o Minor bugfixes (sandbox, bwauth): - Fix sandbox to work for bandwidth authority. Fixes bug 40933; - bugfix on 0.2.2.1-alpha + bugfix on 0.2.2.1-alpha. Changes in version 0.4.8.14 - 2025-02-05 @@ -80,8 +601,8 @@ Changes in version 0.4.8.13 - 2024-10-24 - This is minor release fixing an important client circuit building (Conflux - related) bug which lead to performance degradation and extra load on the + This minor release fixes an important client circuit building (conflux + related) bug which led to performance degradation and extra load on the network. Some minor memory leaks fixes as well as an important minor feature for pluggable transports. We strongly recommend to update as soon as possible for clients in order to neutralize this conflux bug. @@ -94,7 +615,7 @@ which added overall load to the network, used bandwidth and battery from clients that weren't actively using their Tor, and kept sockets open on guards which added connection padding - essentially forever. Fixes bug 40981; bugfix on 0.4.8.1-alpha; + essentially forever. Fixes bug 40981; bugfix on 0.4.8.1-alpha. o Minor feature (bridges, pluggable transport): - Add STATUS TYPE=version handler for Pluggable Transport. This @@ -148,11 +669,11 @@ Changes in version 0.4.8.11 - 2024-04-10 - This is a minor release mostly to upgrade the fallbackdir list. Worth noting - also that directory authority running this version will now automatically + This is a minor release mostly to upgrade the fallbackdir list. + Directory authorities running this version will now automatically reject relays running the end of life 0.4.7.x version. - o Minor feature (authority): + o Minor features (directory authorities): - Reject 0.4.7.x series at the authority level. Closes ticket 40896. o Minor feature (dirauth, tor26): @@ -185,7 +706,7 @@ o Major bugfixes (TROVE-2023-007, exit): - Improper error propagation from a safety check in conflux leg - linking lead to a desynchronization of which legs were part of a + linking led to a desynchronization of which legs were part of a conflux set, ultimately causing a UAF and NULL pointer dereference crash on Exit relays. Fixes bug 40897; bugfix on 0.4.8.1-alpha. @@ -197,8 +718,8 @@ retrieved on 2023/12/08. o Minor bugfixes (bridges, statistics): - - Correctly report statistics for client count over Pluggable - transport. Fixes bug 40871; bugfix on 0.4.8.4 + - Correctly report statistics for client count over pluggable + transports. Fixes bug 40871; bugfix on 0.4.8.4. Changes in version 0.4.8.9 - 2023-11-09 @@ -220,7 +741,7 @@ o Major bugfixes (onion service, TROVE-2023-006): - Fix a possible hard assert on a NULL pointer when recording a failed rendezvous circuit on the service side for the MetricsPort. - Fixes bug 40883; bugfix on 0.4.8.1-alpha + Fixes bug 40883; bugfix on 0.4.8.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 09, 2023. @@ -233,7 +754,7 @@ Changes in version 0.4.8.8 - 2023-11-03 We are releasing today a fix for a high security issue, TROVE-2023-004, that is affecting relays. Also a few minor bugfixes detailed below. Please upgrade - as soon as posssible. + as soon as possible. o Major bugfixes (TROVE-2023-004, relay): - Mitigate an issue when Tor compiled with OpenSSL can crash during @@ -276,6 +797,11 @@ Changes in version 0.4.8.6 - 2023-09-18 + This version contains an important fix for onion services regarding + congestion control and its reliability. Apart from that, unneeded BUG + warnings have been suppressed especially about a compression bomb seen + on relays. + o Major bugfixes (onion service): - Fix a reliability issue where services were expiring their introduction points every consensus update. This caused @@ -420,8 +946,8 @@ o Minor features (testing): - All Rust code is now linted (cargo clippy) as part of GitLab CI, and - existing warnings have been fixed. - Any unit tests written in Rust now - run as part of GitLab CI. + existing warnings have been fixed. + - Any unit tests written in Rust now run as part of GitLab CI. o Minor feature (CI): - Update CI to use Debian Bullseye for runners. @@ -550,7 +1076,7 @@ o Minor bugfixes (conflux): - Count leg launch attempts prior to attempting to launch them. This - avoids inifinite launch attempts due to internal circuit building + avoids infinite launch attempts due to internal circuit building failures. Additionally, double-check that we have enough exits in our consensus overall, before attempting to launch conflux sets. Fixes bug 40811; bugfix on 0.4.8.1-alpha. @@ -631,7 +1157,7 @@ o Major bugfixes (congestion control): - Avoid incrementing the congestion window when the window is not - fully in use. Thia prevents overshoot in cases where long periods + fully in use. This prevents overshoot in cases where long periods of low activity would allow our congestion window to grow, and then get followed by a burst, which would cause queue overload. Also improve the increment checks for RFC3742. Fixes bug 40732; @@ -1222,7 +1748,7 @@ Exit, Guard, HSDir, and V2Dir; and in favor of BadExit. Implements part of proposal 335. Based on a patch from Neel Chauhan. - o Major features (Proposal 332, onion services, guard selection algorithm): + o Major features (Proposal 333, onion services, guard selection algorithm): - Clients and onion services now choose four long-lived "layer 2" guard relays for use as the middle hop in all onion circuits. These relays are kept in place for a randomized duration averaging diff -Nru tor-0.4.8.16/acinclude.m4 tor-0.4.9.6/acinclude.m4 --- tor-0.4.8.16/acinclude.m4 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/acinclude.m4 2026-03-25 14:30:34.000000000 +0000 @@ -9,6 +9,8 @@ [ if test -d "$1/lib"; then LDFLAGS="-L$1/lib $LDFLAGS" + elif test -d "$1/lib64"; then + LDFLAGS="-L$1/lib64 $LDFLAGS" else LDFLAGS="-L$1 $LDFLAGS" fi @@ -28,6 +30,9 @@ if test -d "$1/lib"; then TOR_LDFLAGS_$2="-L$1/lib" TOR_LIBDIR_$2="$1/lib" + elif test -d "$1/lib64"; then + TOR_LDFLAGS_$2="-L$1/lib64" + TOR_LIBDIR_$2="$1/lib64" else TOR_LDFLAGS_$2="-L$1" TOR_LIBDIR_$2="$1" diff -Nru tor-0.4.8.16/configure tor-0.4.9.6/configure --- tor-0.4.8.16/configure 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/configure 2026-03-25 14:30:34.000000000 +0000 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for tor 0.4.8.16. +# Generated by GNU Autoconf 2.69 for tor 0.4.9.6. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. @@ -577,8 +577,8 @@ # Identity of this package. PACKAGE_NAME='tor' PACKAGE_TARNAME='tor' -PACKAGE_VERSION='0.4.8.16' -PACKAGE_STRING='tor 0.4.8.16' +PACKAGE_VERSION='0.4.9.6' +PACKAGE_STRING='tor 0.4.9.6' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1473,7 +1473,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures tor 0.4.8.16 to adapt to many kinds of systems. +\`configure' configures tor 0.4.9.6 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1543,7 +1543,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of tor 0.4.8.16:";; + short | recursive ) echo "Configuration of tor 0.4.9.6:";; esac cat <<\_ACEOF @@ -1765,7 +1765,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -tor configure 0.4.8.16 +tor configure 0.4.9.6 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2470,7 +2470,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by tor $as_me 0.4.8.16, which was +It was created by tor $as_me 0.4.9.6, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2836,7 +2836,7 @@ # only shuts down for missing "required protocols" when those protocols # are listed as required by a consensus after this date. -$as_echo "#define APPROX_RELEASE_DATE \"2025-03-24\"" >>confdefs.h +$as_echo "#define APPROX_RELEASE_DATE \"2026-03-25\"" >>confdefs.h # "foreign" means we don't follow GNU package layout standards @@ -3357,7 +3357,7 @@ # Define the identity of the package. PACKAGE='tor' - VERSION='0.4.8.16' + VERSION='0.4.9.6' cat >>confdefs.h <<_ACEOF @@ -8977,6 +8977,41 @@ fi +saved_CFLAGS="$CFLAGS" +CFLAGS="$CFLAGS -Werror" +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for __attribute__((nonstring))" >&5 +$as_echo_n "checking for __attribute__((nonstring))... " >&6; } +if ${tor_cv_c_attr_nonstring+:} false; then : + $as_echo_n "(cached) " >&6 +else + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + __attribute__((nonstring)) const char foo[5] = "abcde"; + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + tor_cv_c_attr_nonstring=yes +else + tor_cv_c_attr_nonstring=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $tor_cv_c_attr_nonstring" >&5 +$as_echo "$tor_cv_c_attr_nonstring" >&6; } +CFLAGS="$saved_CFLAGS" + +if test "$tor_cv_c_attr_nonstring" = "yes"; then + +$as_echo "#define HAVE_ATTR_NONSTRING 1" >>confdefs.h + +fi + TORUSER=_tor # Check whether --with-tor-user was given. @@ -10209,6 +10244,8 @@ if test -d "$tor_trydir/lib"; then LDFLAGS="-L$tor_trydir/lib $LDFLAGS" + elif test -d "$tor_trydir/lib64"; then + LDFLAGS="-L$tor_trydir/lib64 $LDFLAGS" else LDFLAGS="-L$tor_trydir $LDFLAGS" fi @@ -10377,6 +10414,8 @@ if test -d "$tor_cv_library_libevent_dir/lib"; then LDFLAGS="-L$tor_cv_library_libevent_dir/lib $LDFLAGS" + elif test -d "$tor_cv_library_libevent_dir/lib64"; then + LDFLAGS="-L$tor_cv_library_libevent_dir/lib64 $LDFLAGS" else LDFLAGS="-L$tor_cv_library_libevent_dir $LDFLAGS" fi @@ -10396,6 +10435,9 @@ if test -d "$tor_cv_library_libevent_dir/lib"; then TOR_LDFLAGS_libevent="-L$tor_cv_library_libevent_dir/lib" TOR_LIBDIR_libevent="$tor_cv_library_libevent_dir/lib" + elif test -d "$tor_cv_library_libevent_dir/lib64"; then + TOR_LDFLAGS_libevent="-L$tor_cv_library_libevent_dir/lib64" + TOR_LIBDIR_libevent="$tor_cv_library_libevent_dir/lib64" else TOR_LDFLAGS_libevent="-L$tor_cv_library_libevent_dir" TOR_LIBDIR_libevent="$tor_cv_library_libevent_dir" @@ -10859,6 +10901,35 @@ fi + + save_CFLAGS="$CFLAGS" + save_LIBS="$LIBS" + LIBS="$LIBS $NSS_LIBS" + CFLAGS="$CFLAGS $NSS_CFLAGS" + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether NSS defines ssl_kea_ecdh_hybrid(_psk)" >&5 +$as_echo_n "checking whether NSS defines ssl_kea_ecdh_hybrid(_psk)... " >&6; } + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + + #include + int v = (int) ssl_kea_ecdh_hybrid_psk; + int v2 = (int) ssl_kea_ecdh_hybrid; + +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; }; + +$as_echo "#define NSS_HAS_ECDH_HYBRID 1" >>confdefs.h + + +else + { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 +$as_echo "no" >&6; } +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + LIBS="$save_LIBS" + CPPFLAGS="$save_CPPFLAGS" fi @@ -10881,8 +10952,8 @@ fi -{ $as_echo "$as_me:${as_lineno-$LINENO}: Now, we'll look for OpenSSL >= 1.0.1" >&5 -$as_echo "$as_me: Now, we'll look for OpenSSL >= 1.0.1" >&6;} +{ $as_echo "$as_me:${as_lineno-$LINENO}: Now, we'll look for OpenSSL." >&5 +$as_echo "$as_me: Now, we'll look for OpenSSL." >&6;} tryopenssldir="" @@ -10931,6 +11002,8 @@ if test -d "$tor_trydir/lib"; then LDFLAGS="-L$tor_trydir/lib $LDFLAGS" + elif test -d "$tor_trydir/lib64"; then + LDFLAGS="-L$tor_trydir/lib64 $LDFLAGS" else LDFLAGS="-L$tor_trydir $LDFLAGS" fi @@ -11080,6 +11153,8 @@ if test -d "$tor_cv_library_openssl_dir/lib"; then LDFLAGS="-L$tor_cv_library_openssl_dir/lib $LDFLAGS" + elif test -d "$tor_cv_library_openssl_dir/lib64"; then + LDFLAGS="-L$tor_cv_library_openssl_dir/lib64 $LDFLAGS" else LDFLAGS="-L$tor_cv_library_openssl_dir $LDFLAGS" fi @@ -11099,6 +11174,9 @@ if test -d "$tor_cv_library_openssl_dir/lib"; then TOR_LDFLAGS_openssl="-L$tor_cv_library_openssl_dir/lib" TOR_LIBDIR_openssl="$tor_cv_library_openssl_dir/lib" + elif test -d "$tor_cv_library_openssl_dir/lib64"; then + TOR_LDFLAGS_openssl="-L$tor_cv_library_openssl_dir/lib64" + TOR_LIBDIR_openssl="$tor_cv_library_openssl_dir/lib64" else TOR_LDFLAGS_openssl="-L$tor_cv_library_openssl_dir" TOR_LIBDIR_openssl="$tor_cv_library_openssl_dir" @@ -11221,14 +11299,35 @@ CPPFLAGS="$TOR_CPPFLAGS_openssl $CPPFLAGS" -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL >= 3.0.0" >&5 -$as_echo_n "checking for OpenSSL >= 3.0.0... " >&6; } +for ac_header in openssl/engine.h +do : + ac_fn_c_check_header_mongrel "$LINENO" "openssl/engine.h" "ac_cv_header_openssl_engine_h" "$ac_includes_default" +if test "x$ac_cv_header_openssl_engine_h" = xyes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_OPENSSL_ENGINE_H 1 +_ACEOF + +else + as_fn_error $? "Missing required header openssl/engine.h. + +On Debian/Ubuntu install: libssl-dev +On Fedora/RHEL install: openssl-devel-engine + +Then re-run configure." "$LINENO" 5 +fi + +done + + + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL implementation" >&5 +$as_echo_n "checking for OpenSSL implementation... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include -#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L -#error "you_have_version_3" +#if defined(LIBRESSL_VERSION_NUMBER) +#error "this is libressl, no worries" #endif int @@ -11240,25 +11339,30 @@ } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : - { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 -$as_echo "no" >&6; } -else - { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 -$as_echo "yes" >&6; }; + openssl_impl=openssl + { $as_echo "$as_me:${as_lineno-$LINENO}: result: OpenSSL" >&5 +$as_echo "OpenSSL" >&6; } $as_echo "#define OPENSSL_SUPPRESS_DEPRECATED 1" >>confdefs.h + +else + openssl_impl=libressl + { $as_echo "$as_me:${as_lineno-$LINENO}: result: LibreSSL" >&5 +$as_echo "LibreSSL" >&6; } + fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL < 1.0.1" >&5 -$as_echo_n "checking for OpenSSL < 1.0.1... " >&6; } +if test "x$openssl_impl" = "xopenssl"; then +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL < 1.1.1" >&5 +$as_echo_n "checking for OpenSSL < 1.1.1... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include -#if OPENSSL_VERSION_NUMBER < 0x1000100fL -#error "too old" +#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10101000L +#error "openssl too old" #endif int @@ -11273,20 +11377,23 @@ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } else - as_fn_error $? "OpenSSL is too old. We require 1.0.1 or later. You can specify a path to a newer one with --with-openssl-dir." "$LINENO" 5 + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } + as_fn_error $? "Your version of OpenSSL is too old. We require 1.1.1 or later, and you should use 3.5 if possible." "$LINENO" 5 + fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext +fi -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether LibreSSL TLS 1.3 APIs are busted" >&5 -$as_echo_n "checking whether LibreSSL TLS 1.3 APIs are busted... " >&6; } +if test "x$openssl_impl" = "xlibressl"; then +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for LibreSSL < 3.7.0" >&5 +$as_echo_n "checking for LibreSSL < 3.7.0... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include -#if defined(LIBRESSL_VERSION_NUMBER) && \ - LIBRESSL_VERSION_NUMBER >= 0x3020100fL && \ - LIBRESSL_VERSION_NUMBER < 0x3040100fL -#error "oh no" +#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3070000fL +#error "libressl too old" #endif int @@ -11301,9 +11408,13 @@ { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } else - as_fn_error $? "This version of LibreSSL won't work with Tor. Please upgrade to LibreSSL 3.4.1 or later. (Or downgrade to 3.2.0 if you really must.)" "$LINENO" 5 + { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 +$as_echo "yes" >&6; } + as_fn_error $? "Your version of LibreSSL is too old. We require 3.7.0 or later." "$LINENO" 5 + fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext +fi cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ @@ -11377,30 +11488,10 @@ { $as_echo "$as_me:${as_lineno-$LINENO}: result: $openssl_ver_mismatch" >&5 $as_echo "$openssl_ver_mismatch" >&6; } -ac_fn_c_check_member "$LINENO" "struct ssl_method_st" "get_cipher_by_char" "ac_cv_member_struct_ssl_method_st_get_cipher_by_char" "#include - -" -if test "x$ac_cv_member_struct_ssl_method_st_get_cipher_by_char" = xyes; then : - -cat >>confdefs.h <<_ACEOF -#define HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR 1 -_ACEOF - - -fi - - for ac_func in \ - ERR_load_KDF_strings \ EVP_PBE_scrypt \ - SSL_CIPHER_find \ - SSL_CTX_set1_groups_list \ SSL_CTX_set_security_level \ - SSL_SESSION_get_master_key \ - SSL_get_client_ciphers \ - SSL_get_client_random \ - SSL_get_server_random \ - TLS_method \ + SSL_set_ciphersuites do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` @@ -11414,56 +11505,6 @@ done -ac_fn_c_check_member "$LINENO" "SSL" "state" "ac_cv_member_SSL_state" "#include - -" -if test "x$ac_cv_member_SSL_state" = xyes; then : - -cat >>confdefs.h <<_ACEOF -#define HAVE_SSL_STATE 1 -_ACEOF - - -fi - - -# The cast to long int works around a bug in the HP C Compiler -# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects -# declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'. -# This bug is HP SR number 8606223364. -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking size of SHA_CTX" >&5 -$as_echo_n "checking size of SHA_CTX... " >&6; } -if ${ac_cv_sizeof_SHA_CTX+:} false; then : - $as_echo_n "(cached) " >&6 -else - if ac_fn_c_compute_int "$LINENO" "(long int) (sizeof (SHA_CTX))" "ac_cv_sizeof_SHA_CTX" "$ac_includes_default -#include - -"; then : - -else - if test "$ac_cv_type_SHA_CTX" = yes; then - { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 -$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} -as_fn_error 77 "cannot compute sizeof (SHA_CTX) -See \`config.log' for more details" "$LINENO" 5; } - else - ac_cv_sizeof_SHA_CTX=0 - fi -fi - -fi -{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sizeof_SHA_CTX" >&5 -$as_echo "$ac_cv_sizeof_SHA_CTX" >&6; } - - - -cat >>confdefs.h <<_ACEOF -#define SIZEOF_SHA_CTX $ac_cv_sizeof_SHA_CTX -_ACEOF - - - fi # enable_nss @@ -11598,6 +11639,8 @@ if test -d "$tor_trydir/lib"; then LDFLAGS="-L$tor_trydir/lib $LDFLAGS" + elif test -d "$tor_trydir/lib64"; then + LDFLAGS="-L$tor_trydir/lib64 $LDFLAGS" else LDFLAGS="-L$tor_trydir $LDFLAGS" fi @@ -11744,6 +11787,8 @@ if test -d "$tor_cv_library_zlib_dir/lib"; then LDFLAGS="-L$tor_cv_library_zlib_dir/lib $LDFLAGS" + elif test -d "$tor_cv_library_zlib_dir/lib64"; then + LDFLAGS="-L$tor_cv_library_zlib_dir/lib64 $LDFLAGS" else LDFLAGS="-L$tor_cv_library_zlib_dir $LDFLAGS" fi @@ -11763,6 +11808,9 @@ if test -d "$tor_cv_library_zlib_dir/lib"; then TOR_LDFLAGS_zlib="-L$tor_cv_library_zlib_dir/lib" TOR_LIBDIR_zlib="$tor_cv_library_zlib_dir/lib" + elif test -d "$tor_cv_library_zlib_dir/lib64"; then + TOR_LDFLAGS_zlib="-L$tor_cv_library_zlib_dir/lib64" + TOR_LIBDIR_zlib="$tor_cv_library_zlib_dir/lib64" else TOR_LDFLAGS_zlib="-L$tor_cv_library_zlib_dir" TOR_LIBDIR_zlib="$tor_cv_library_zlib_dir" @@ -13455,6 +13503,141 @@ +# From https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html: +# +# Enable code instrumentation to increase program security by checking that +# target addresses of control-flow transfer instructions are valid. This +# prevents diverting the flow of control to an unexpected target. This is +# intended to protect against such threats as Return-oriented Programming +# (ROP), and similarly call/jmp-oriented programming (COP/JOP). + + + + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the compiler accepts -fcf-protection=full" >&5 +$as_echo_n "checking whether the compiler accepts -fcf-protection=full... " >&6; } +if ${tor_cv_cflags__fcf_protection_full+:} false; then : + $as_echo_n "(cached) " >&6 +else + + tor_saved_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS -pedantic -Werror -fcf-protection=full" + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + tor_cv_cflags__fcf_protection_full=yes +else + tor_cv_cflags__fcf_protection_full=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + if test x != x; then + + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + tor_can_link__fcf_protection_full=yes +else + tor_can_link__fcf_protection_full=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext + + fi + CFLAGS="$tor_saved_CFLAGS" + +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $tor_cv_cflags__fcf_protection_full" >&5 +$as_echo "$tor_cv_cflags__fcf_protection_full" >&6; } + if test x$tor_cv_cflags__fcf_protection_full = xyes; then + CFLAGS="$CFLAGS -fcf-protection=full" + else + true + fi + + + +# The equivalent for arm64 (#41139) + + + + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the compiler accepts -mbranch-protection=standard" >&5 +$as_echo_n "checking whether the compiler accepts -mbranch-protection=standard... " >&6; } +if ${tor_cv_cflags__mbranch_protection_standard+:} false; then : + $as_echo_n "(cached) " >&6 +else + + tor_saved_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS -pedantic -Werror -mbranch-protection=standard" + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + tor_cv_cflags__mbranch_protection_standard=yes +else + tor_cv_cflags__mbranch_protection_standard=no +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext + if test x != x; then + + cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + tor_can_link__mbranch_protection_standard=yes +else + tor_can_link__mbranch_protection_standard=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext + + fi + CFLAGS="$tor_saved_CFLAGS" + +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $tor_cv_cflags__mbranch_protection_standard" >&5 +$as_echo "$tor_cv_cflags__mbranch_protection_standard" >&6; } + if test x$tor_cv_cflags__mbranch_protection_standard = xyes; then + CFLAGS="$CFLAGS -mbranch-protection=standard" + else + true + fi + + + + if test "x$enable_seccomp" != "xno"; then for ac_header in seccomp.h @@ -28823,8 +29006,8 @@ - { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Wextra-semi" >&5 -$as_echo_n "checking whether C compiler accepts -Wextra-semi... " >&6; } + { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler accepts -Wextra-semi" >&5 +$as_echo_n "checking whether the C compiler accepts -Wextra-semi... " >&6; } if ${ax_cv_check_cflags__Werror__Wextra_semi+:} false; then : $as_echo_n "(cached) " >&6 else @@ -29706,7 +29889,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by tor $as_me 0.4.8.16, which was +This file was extended by tor $as_me 0.4.9.6, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -29772,7 +29955,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -tor config.status 0.4.8.16 +tor config.status 0.4.9.6 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff -Nru tor-0.4.8.16/configure.ac tor-0.4.9.6/configure.ac --- tor-0.4.8.16/configure.ac 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/configure.ac 2026-03-25 14:30:34.000000000 +0000 @@ -4,7 +4,7 @@ dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.4.8.16]) +AC_INIT([tor],[0.4.9.6]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4]) @@ -18,7 +18,7 @@ # version number changes. Tor uses it to make sure that it # only shuts down for missing "required protocols" when those protocols # are listed as required by a consensus after this date. -AC_DEFINE(APPROX_RELEASE_DATE, ["2025-03-24"], # for 0.4.8.16 +AC_DEFINE(APPROX_RELEASE_DATE, ["2026-03-25"], # for 0.4.9.6 [Approximate date when this software was released. (Updated when the version changes.)]) # "foreign" means we don't follow GNU package layout standards @@ -570,6 +570,21 @@ AC_DEFINE(HAVE_ATTR_FALLTHROUGH, [1], [defined if we have the fallthrough attribute.]) fi +saved_CFLAGS="$CFLAGS" +CFLAGS="$CFLAGS -Werror" +AC_CACHE_CHECK([for __attribute__((nonstring))], + tor_cv_c_attr_nonstring, + [AC_COMPILE_IFELSE( + [AC_LANG_PROGRAM([], + [[ __attribute__((nonstring)) const char foo[5] = "abcde"; ]])], + [tor_cv_c_attr_nonstring=yes], + [tor_cv_c_attr_nonstring=no] )]) +CFLAGS="$saved_CFLAGS" + +if test "$tor_cv_c_attr_nonstring" = "yes"; then + AC_DEFINE(HAVE_ATTR_NONSTRING, [1], [defined if we have the nonstring attribute.]) +fi + TORUSER=_tor AC_ARG_WITH(tor-user, AS_HELP_STRING(--with-tor-user=NAME, [specify username for tor daemon]), @@ -979,6 +994,23 @@ [have_nss=no; AC_MSG_ERROR([You asked for NSS but I can't find it, $pkg_config_user_action, or set NSS_CFLAGS and NSS_LIBS.])]) AC_SUBST(NSS_CFLAGS) AC_SUBST(NSS_LIBS) + + save_CFLAGS="$CFLAGS" + save_LIBS="$LIBS" + LIBS="$LIBS $NSS_LIBS" + CFLAGS="$CFLAGS $NSS_CFLAGS" + AC_MSG_CHECKING([whether NSS defines ssl_kea_ecdh_hybrid(_psk)]) + AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ + #include + int v = (int) ssl_kea_ecdh_hybrid_psk; + int v2 = (int) ssl_kea_ecdh_hybrid; + ]], [[]])], + [ AC_MSG_RESULT([yes]); + AC_DEFINE(NSS_HAS_ECDH_HYBRID, 1, [whether nss defines ecdh_hybrid key exchange.]) + ], + [ AC_MSG_RESULT([no]) ]) + LIBS="$save_LIBS" + CPPFLAGS="$save_CPPFLAGS" fi dnl ------------------------------------------------------ @@ -1000,7 +1032,7 @@ fi ]) -AC_MSG_NOTICE([Now, we'll look for OpenSSL >= 1.0.1]) +AC_MSG_NOTICE([Now, we'll look for OpenSSL.]) TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI $TOR_LIB_WS32 $TOR_LIB_CRYPT32], [#include char *getenv(const char *);], @@ -1040,38 +1072,58 @@ dnl work. (See ticket tor#40166.) For now, we disable the deprecation dnl warnings. -AC_MSG_CHECKING([for OpenSSL >= 3.0.0]) +dnl --- Check for OpenSSL engine header --- +AC_CHECK_HEADERS([openssl/engine.h], [], + [AC_MSG_ERROR([Missing required header openssl/engine.h. + +On Debian/Ubuntu install: libssl-dev +On Fedora/RHEL install: openssl-devel-engine + +Then re-run configure.])]) + + +AC_MSG_CHECKING([for OpenSSL implementation]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include -#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L -#error "you_have_version_3" +#if defined(LIBRESSL_VERSION_NUMBER) +#error "this is libressl, no worries" #endif ]], [[]])], - [ AC_MSG_RESULT([no]) ], - [ AC_MSG_RESULT([yes]); - AC_DEFINE(OPENSSL_SUPPRESS_DEPRECATED, 1, [disable openssl deprecated-function warnings]) ]) + [ openssl_impl=openssl + AC_MSG_RESULT([OpenSSL]) + AC_DEFINE(OPENSSL_SUPPRESS_DEPRECATED, 1, [disable openssl deprecated-function warnings]) + ], + [ openssl_impl=libressl + AC_MSG_RESULT([LibreSSL]) + ]) -AC_MSG_CHECKING([for OpenSSL < 1.0.1]) +if test "x$openssl_impl" = "xopenssl"; then +AC_MSG_CHECKING([for OpenSSL < 1.1.1]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include -#if OPENSSL_VERSION_NUMBER < 0x1000100fL -#error "too old" +#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10101000L +#error "openssl too old" #endif ]], [[]])], [ AC_MSG_RESULT([no]) ], - [ AC_MSG_ERROR([OpenSSL is too old. We require 1.0.1 or later. You can specify a path to a newer one with --with-openssl-dir.]) ]) + [ AC_MSG_RESULT([yes]) + AC_MSG_ERROR([Your version of OpenSSL is too old. We require 1.1.1 or later, and you should use 3.5 if possible.]) + ]) +fi -AC_MSG_CHECKING([whether LibreSSL TLS 1.3 APIs are busted]) +if test "x$openssl_impl" = "xlibressl"; then +AC_MSG_CHECKING([for LibreSSL < 3.7.0]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include -#if defined(LIBRESSL_VERSION_NUMBER) && \ - LIBRESSL_VERSION_NUMBER >= 0x3020100fL && \ - LIBRESSL_VERSION_NUMBER < 0x3040100fL -#error "oh no" +#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3070000fL +#error "libressl too old" #endif ]], [[]])], [ AC_MSG_RESULT([no]) ], - [ AC_MSG_ERROR([This version of LibreSSL won't work with Tor. Please upgrade to LibreSSL 3.4.1 or later. (Or downgrade to 3.2.0 if you really must.)]) ]) + [ AC_MSG_RESULT([yes]) + AC_MSG_ERROR([Your version of LibreSSL is too old. We require 3.7.0 or later.]) + ]) +fi AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include @@ -1108,34 +1160,14 @@ fi], [openssl_ver_mismatch=cross]) AC_MSG_RESULT([$openssl_ver_mismatch]) -AC_CHECK_MEMBERS([struct ssl_method_st.get_cipher_by_char], , , -[#include -]) - dnl OpenSSL functions which we might not have. In theory, we could just dnl check the openssl version number, but in practice that gets pretty dnl confusing with LibreSSL, OpenSSL, and various distributions' patches dnl to them. AC_CHECK_FUNCS([ \ - ERR_load_KDF_strings \ EVP_PBE_scrypt \ - SSL_CIPHER_find \ - SSL_CTX_set1_groups_list \ SSL_CTX_set_security_level \ - SSL_SESSION_get_master_key \ - SSL_get_client_ciphers \ - SSL_get_client_random \ - SSL_get_server_random \ - TLS_method \ - ]) - -dnl Check if OpenSSL structures are opaque -AC_CHECK_MEMBERS([SSL.state], , , -[#include -]) - -AC_CHECK_SIZEOF(SHA_CTX, , [AC_INCLUDES_DEFAULT() -#include + SSL_set_ciphersuites ]) fi # enable_nss @@ -1474,6 +1506,17 @@ dnl code will work. TOR_CHECK_CFLAGS(-fasynchronous-unwind-tables) +# From https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html: +# +# Enable code instrumentation to increase program security by checking that +# target addresses of control-flow transfer instructions are valid. This +# prevents diverting the flow of control to an unexpected target. This is +# intended to protect against such threats as Return-oriented Programming +# (ROP), and similarly call/jmp-oriented programming (COP/JOP). +TOR_CHECK_CFLAGS(-fcf-protection=full) +# The equivalent for arm64 (#41139) +TOR_CHECK_CFLAGS(-mbranch-protection=standard) + dnl ============================================================ dnl Check for libseccomp diff -Nru tor-0.4.8.16/contrib/win32build/tor-mingw.nsi.in tor-0.4.9.6/contrib/win32build/tor-mingw.nsi.in --- tor-0.4.8.16/contrib/win32build/tor-mingw.nsi.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/contrib/win32build/tor-mingw.nsi.in 2026-03-25 14:30:34.000000000 +0000 @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.4.8.16" +!define VERSION "0.4.9.6" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff -Nru tor-0.4.8.16/debian/.debian-ci.yml tor-0.4.9.6/debian/.debian-ci.yml --- tor-0.4.8.16/debian/.debian-ci.yml 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/.debian-ci.yml 2026-04-05 21:20:34.000000000 +0000 @@ -50,7 +50,7 @@ - rm -rf build-env - *apt-init - apt-get install sudo - - apt-get install build-essential + - apt-get install adduser build-essential - apt-get install $(cat debian/.debian-ci/"${CI_JOB_NAME}"/build-depends) - adduser --system --group --disabled-password --shell /bin/sh --home "$CI_PROJECT_DIR"/build-env "${BUILDUSER}" artifacts: @@ -68,7 +68,7 @@ - rm -rf build-env binary-packages - *apt-init - apt-get install sudo - - apt-get install build-essential devscripts reprepro fakeroot + - apt-get install adduser build-essential devscripts reprepro fakeroot #image: ${DOCKER_ARCH}/${OS}:${SUITE}${IMAGE_EXTENSION} image: containers.torproject.org/tpo/tpa/base-images/${OS}:${SUITE} retry: @@ -150,29 +150,25 @@ .matrix_full: &matrix_full - OS: debian - SUITE: [ 'sid', 'bullseye', 'bookworm', 'trixie' ] + SUITE: [ 'sid', 'bookworm', 'trixie', 'forky' ] DOCKER_ARCH: amd64 HOSTING_PROVIDER_TAG: tpa - OS: debian - SUITE: [ 'sid', 'bullseye', 'bookworm', 'trixie' ] + SUITE: [ 'sid', 'bookworm', 'trixie', 'forky' ] DOCKER_ARCH: arm64 HOSTING_PROVIDER_TAG: osuosl - OS: debian - SUITE: 'bullseye' - DOCKER_ARCH: amd64 - HOSTING_PROVIDER_TAG: tpa - - OS: debian SUITE: 'bookworm' DOCKER_ARCH: amd64 HOSTING_PROVIDER_TAG: tpa SPECIAL: [ 'bpo12' ] - OS: ubuntu - SUITE: [ 'focal', 'jammy', 'noble', 'oracular' ] + SUITE: [ 'jammy', 'noble', 'plucky', 'questing' ] DOCKER_ARCH: amd64 HOSTING_PROVIDER_TAG: tpa - OS: ubuntu - SUITE: [ 'focal', 'jammy', 'noble', 'oracular' ] + SUITE: [ 'jammy', 'noble', 'plucky', 'questing' ] DOCKER_ARCH: arm64 HOSTING_PROVIDER_TAG: osuosl @@ -291,4 +287,4 @@ paths: - binary-packages - source-packages - expire_in: 1 month + expire_in: 6 months diff -Nru tor-0.4.8.16/debian/changelog tor-0.4.9.6/debian/changelog --- tor-0.4.8.16/debian/changelog 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/changelog 2026-04-05 21:20:34.000000000 +0000 @@ -1,3 +1,70 @@ +tor (0.4.9.6-0+deb13u1) trixie-security; urgency=medium + + * Upload 0.4.9.x tree to debian-security: Fixes, among other things: + - TROVE-2026-004 (memory compare using the wrong length) + - TROVE-2025-016 (out-of-bounds read error with V1 EXTEND cells) + + -- Peter Palfrader Sun, 05 Apr 2026 09:31:58 +0200 + +tor (0.4.9.6-1) unstable; urgency=medium + + * New upstream version. + * Drop 64b5638b backport patch + + -- Jérôme Charaoui Wed, 25 Mar 2026 14:55:12 -0400 + +tor (0.4.9.5-2) unstable; urgency=medium + + * Include 64b5638b from + https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/990 + to fix issues on big-endian systems (closes: #1128946) + * tests/setup-onion-service: include onionshare -> onionshare-cli dependency + change from the debian-main branch, also dropping the unzip dependency. + + -- Peter Palfrader Thu, 26 Feb 2026 12:29:42 +0100 + +tor (0.4.9.5-1) unstable; urgency=medium + + * New upsteam tree. + + -- Jérôme Charaoui Thu, 12 Feb 2026 13:11:02 -0500 + +tor (0.4.8.22-1) unstable; urgency=medium + + * New upstream version. + + -- Jérôme Charaoui Wed, 28 Jan 2026 14:36:16 -0500 + +tor (0.4.8.21-1) unstable; urgency=medium + + * New upstream version. + + -- Jérôme Charaoui Mon, 17 Nov 2025 15:05:05 -0500 + +tor (0.4.8.20-1) unstable; urgency=medium + + * New upstream version. + + -- Jérôme Charaoui Mon, 10 Nov 2025 15:37:11 -0500 + +tor (0.4.8.19-1) unstable; urgency=medium + + * New upstream version. + + -- Gabriel Filion Thu, 09 Oct 2025 16:31:29 -0400 + +tor (0.4.8.18-1) unstable; urgency=medium + + * New upstream version. + + -- Jérôme Charaoui Tue, 16 Sep 2025 13:05:13 -0400 + +tor (0.4.8.17-1) unstable; urgency=medium + + * New upstream version. + + -- Gabriel Filion Thu, 17 Jul 2025 15:37:06 -0400 + tor (0.4.8.16-1) unstable; urgency=medium * New upstream version. diff -Nru tor-0.4.8.16/debian/micro-revision.i tor-0.4.9.6/debian/micro-revision.i --- tor-0.4.8.16/debian/micro-revision.i 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/micro-revision.i 2026-04-05 21:20:34.000000000 +0000 @@ -1 +1 @@ -"0d7c17a48a27e0c3" +"67d83a6b7dd2a191" diff -Nru tor-0.4.8.16/debian/misc/backport tor-0.4.9.6/debian/misc/backport --- tor-0.4.8.16/debian/misc/backport 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/misc/backport 2026-04-05 21:20:34.000000000 +0000 @@ -41,6 +41,7 @@ bullseye d11.bullseye 1 bookworm d12.bookworm 1 trixie d13.trixie 1 +forky d14.forky 1 lenny-bpo bpo5 1 lenny-backports squeeze-bpo bpo6 1 squeeze-backports @@ -51,6 +52,7 @@ bullseye-bpo bpo11 1 bullseye-backports bookworm-bpo bpo12 1 bookworm-backports trixie-bpo bpo13 1 trixie-backports +forky-bpo bpo14 1 forky-backports dapper dapper 1 edgy edgy 1 @@ -90,6 +92,8 @@ mantic mantic 1 noble noble 1 oracular oracular 1 +plucky plucky 1 +questing questing 1 EOF ) if [ -z "$result" ] ; then diff -Nru tor-0.4.8.16/debian/misc/build-tor-sources tor-0.4.9.6/debian/misc/build-tor-sources --- tor-0.4.8.16/debian/misc/build-tor-sources 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/misc/build-tor-sources 2026-04-05 21:20:34.000000000 +0000 @@ -33,315 +33,326 @@ # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -assert_files_dont_exist () { - local pkg="$1"; shift - local debian_version="$1"; - if [ -z "$debian_version" ]; then - echo "assert_files_dont_exist called without debian_version" >&2 - exit 1; - fi - - if [ -e "${pkg}_$debian_version.diff.gz" ] ; then - echo "${pkg}_$debian_version.diff.gz already exists" >&2 - exit 1; - fi - if [ -e "${pkg}_$debian_version.dsc" ] ; then - echo "${pkg}_$debian_version.dsc already exists" >&2 - exit 1; - fi - if [ -e "${pkg}_$debian_version""_amd64.deb" ] ; then - echo "${pkg}_$debian_version""_amd64.deb already exists" >&2 - exit 1; - fi - if [ -e "${pkg}_$debian_version""_amd64.changes" ] ; then - echo "${pkg}_$debian_version""_amd64.changes already exists" >&2 - exit 1; - fi +assert_files_dont_exist() { + local pkg="$1" + shift + local debian_version="$1" + if [ -z "$debian_version" ]; then + echo "assert_files_dont_exist called without debian_version" >&2 + exit 1 + fi + + if [ -e "${pkg}_$debian_version.diff.gz" ]; then + echo "${pkg}_$debian_version.diff.gz already exists" >&2 + exit 1 + fi + if [ -e "${pkg}_$debian_version.dsc" ]; then + echo "${pkg}_$debian_version.dsc already exists" >&2 + exit 1 + fi + if [ -e "${pkg}_$debian_version""_amd64.deb" ]; then + echo "${pkg}_$debian_version""_amd64.deb already exists" >&2 + exit 1 + fi + if [ -e "${pkg}_$debian_version""_amd64.changes" ]; then + echo "${pkg}_$debian_version""_amd64.changes already exists" >&2 + exit 1 + fi } get_debian_version() { - local dir="$1"; shift - local which="${1:-}"; shift - - if [ -z "$which" ]; then - ( cd $dir && dpkg-parsechangelog | grep-dctrl -n -s Version '' ) - else - local v=$(get_debian_version $dir) - case "$which" in - upstream) echo "${v%-*}" ;; - debrev) echo "${v##*-}" ;; - *) - echo >&2 "Unknown key '$which' in get_debian_version" - exit 1 - esac - fi + local dir="$1" + shift + local which="${1:-}" + shift + + if [ -z "$which" ]; then + (cd $dir && dpkg-parsechangelog | grep-dctrl -n -s Version '') + else + local v=$(get_debian_version $dir) + case "$which" in + upstream) echo "${v%-*}" ;; + debrev) echo "${v##*-}" ;; + *) + echo >&2 "Unknown key '$which' in get_debian_version" + exit 1 + ;; + esac + fi } # remove_completely ... 0 replace hardening-includes with hardening-wrapper # 1 get rid entirely hardening_backport() { - local remove_completely="$1" + local remove_completely="$1" - sed -i -e '/^Build-Depends/ s/, *hardening-includes//' debian/control - if [ "$remove_completely" = 0 ]; then - sed -i -e '/^Build-Depends/ s/$/, hardening-wrapper/' debian/control - fi - - if [ "$remove_completely" = 0 ]; then - sed -i -e 's#include /usr/share/hardening-includes/hardening.make#export DEB_BUILD_HARDENING=1#' debian/rules - sed -i -e '/export DEB_BUILD_HARDENING=1/ a export DEB_BUILD_HARDENING_DEBUG=1' debian/rules - else - sed -i -e 's#include /usr/share/hardening-includes/hardening.make##' debian/rules - fi - - if [ "$remove_completely" = 0 ]; then - dch --append "Replace hardening-includes use with hardening-wrapper." - else - dch --append "Completely remove hardening-includes use." - fi + sed -i -e '/^Build-Depends/ s/, *hardening-includes//' debian/control + if [ "$remove_completely" = 0 ]; then + sed -i -e '/^Build-Depends/ s/$/, hardening-wrapper/' debian/control + fi + + if [ "$remove_completely" = 0 ]; then + sed -i -e 's#include /usr/share/hardening-includes/hardening.make#export DEB_BUILD_HARDENING=1#' debian/rules + sed -i -e '/export DEB_BUILD_HARDENING=1/ a export DEB_BUILD_HARDENING_DEBUG=1' debian/rules + else + sed -i -e 's#include /usr/share/hardening-includes/hardening.make##' debian/rules + fi + + if [ "$remove_completely" = 0 ]; then + dch --append "Replace hardening-includes use with hardening-wrapper." + else + dch --append "Completely remove hardening-includes use." + fi } remove_runit() { - if grep -q dh-runit debian/control; then - sed -i -e '/^Build-Depends/ s/, *dh-runit\([^,]*\)\?//' debian/control - dch --append "Remove dh-runit build dependency and --with-runit for backport." - fi - sed -i -e "s/--with[[:space:]]*runit//" debian/rules + if grep -q dh-runit debian/control; then + sed -i -e '/^Build-Depends/ s/, *dh-runit\([^,]*\)\?//' debian/control + dch --append "Remove dh-runit build dependency and --with-runit for backport." + fi + sed -i -e "s/--with[[:space:]]*runit//" debian/rules } old_dh_systemd() { - dch --append "Restore build-dependency on dh-systemd and lower debhelper version requirement to 9.20160114" - sed -i -e '/^Build-Depends/ s/debhelper [^,]*, */debhelper (>= 9.20160114), dh-systemd [linux-any], /' debian/control + dch --append "Restore build-dependency on dh-systemd and lower debhelper version requirement to 9.20160114" + sed -i -e '/^Build-Depends/ s/debhelper [^,]*, */debhelper (>= 9.20160114), dh-systemd [linux-any], /' debian/control } systemd_in_lib() { - dch --append "Keep systemd files in /lib (as opposed to /usr/lib)" - sed -i -e 's,usr/lib/systemd,lib/systemd,' debian/tor.install debian/tor.dirs + dch --append "Keep systemd files in /lib (as opposed to /usr/lib)" + sed -i -e 's,usr/lib/systemd,lib/systemd,' debian/tor.install debian/tor.dirs } - bp1() { - local pkg="$1"; shift - local dir="$1"; shift - local sid_debian_version="$1"; shift - local dist="$1"; shift - - dpkg-source -x ${pkg}_$sid_debian_version.dsc - (cd $dir; backport $dist) + local pkg="$1" + shift + local dir="$1" + shift + local sid_debian_version="$1" + shift + local dist="$1" + shift + + dpkg-source -x ${pkg}_$sid_debian_version.dsc + ( + cd $dir + backport $dist + ) } bp2() { - local pkg="$1"; shift - local dir="$1"; shift - local origtar="$1"; shift - - local debian_version=$(get_debian_version $dir) - assert_files_dont_exist $pkg $debian_version - dpkg-source -b $dir $origtar - rm -r $dir + local pkg="$1" + shift + local dir="$1" + shift + local origtar="$1" + shift + + local debian_version=$(get_debian_version $dir) + assert_files_dont_exist $pkg $debian_version + dpkg-source -b $dir $origtar + rm -r $dir } backport_all() { - local pkg="$1"; shift - local dir="$1"; shift - local origtar="$1"; shift - local sid_debian_version="$1"; shift - - # sid - ################################################# - # null - -# # buster -# ################################################# -# bp1 $pkg $dir $sid_debian_version buster -# (cd $dir; systemd_in_lib) -# (cd $dir; remove_runit) -# bp2 $pkg $dir $origtar - - # bullseye - ################################################# - bp1 $pkg $dir $sid_debian_version bullseye - (cd $dir; systemd_in_lib) - bp2 $pkg $dir $origtar - - # bookworm - ################################################# - bp1 $pkg $dir $sid_debian_version bookworm - (cd $dir; systemd_in_lib) - bp2 $pkg $dir $origtar - - # trixie - ################################################# - bp1 $pkg $dir $sid_debian_version trixie - bp2 $pkg $dir $origtar - - - # focal (EOL: 2025-04, 2030-04) - ################################################# - bp1 $pkg $dir $sid_debian_version focal - (cd $dir; systemd_in_lib) - bp2 $pkg $dir $origtar - - # jammy (EOL: 2027-04-21, 2032-04) - ################################################# - bp1 $pkg $dir $sid_debian_version jammy - (cd $dir; systemd_in_lib) - bp2 $pkg $dir $origtar - - # noble (EOL: 2036-04) - ################################################# - bp1 $pkg $dir $sid_debian_version noble - bp2 $pkg $dir $origtar - - # oracular (EOL: 2025-07) - ################################################# - bp1 $pkg $dir $sid_debian_version oracular - bp2 $pkg $dir $origtar - - ################################################# - ## BPO - ################################################# - - # Backport to bookworm(debian 12) backports - dpkg-source -x ${pkg}_$sid_debian_version.dsc - ( - cd $dir - dch --bpo '' - systemd_in_lib - head debian/changelog - ) - bp2 $pkg $dir $origtar - - # Backport to bullseye(debian 11) sloppy backports - dpkg-source -x ${pkg}_$sid_debian_version.dsc - ( - cd $dir - dch --bpo '' - systemd_in_lib - head debian/changelog - sed -i -e '1,3s/bookworm-backports/bullseye-backports-sloppy/' debian/changelog - sed -i -e '1s/bpo12/bpo11/' debian/changelog - ) - bp2 $pkg $dir $origtar + local pkg="$1" + shift + local dir="$1" + shift + local origtar="$1" + shift + local sid_debian_version="$1" + shift + + # sid + ################################################# + # null + + # bookworm + ################################################# + bp1 $pkg $dir $sid_debian_version bookworm + ( + cd $dir + systemd_in_lib + ) + bp2 $pkg $dir $origtar + + # trixie + ################################################# + bp1 $pkg $dir $sid_debian_version trixie + bp2 $pkg $dir $origtar + + # forky + ################################################# + bp1 $pkg $dir $sid_debian_version forky + bp2 $pkg $dir $origtar + + # jammy (EOL: 2027-04-21, 2032-04) + ################################################# + bp1 $pkg $dir $sid_debian_version jammy + ( + cd $dir + systemd_in_lib + ) + bp2 $pkg $dir $origtar + + # noble (EOL: 2036-04) + ################################################# + bp1 $pkg $dir $sid_debian_version noble + bp2 $pkg $dir $origtar + + # plucky (EOL: 2026-01) + ################################################# + bp1 $pkg $dir $sid_debian_version plucky + bp2 $pkg $dir $origtar + + # questing (EOL: 2026-07) + ################################################# + bp1 $pkg $dir $sid_debian_version questing + bp2 $pkg $dir $origtar + + ################################################# + ## BPO + ################################################# + + # Backport to trixie(debian 13) backports + dpkg-source -x ${pkg}_$sid_debian_version.dsc + ( + cd $dir + dch --bpo '' + head debian/changelog + ) + bp2 $pkg $dir $origtar + + # Backport to bookworm(debian 12) sloppy backports + dpkg-source -x ${pkg}_$sid_debian_version.dsc + ( + cd $dir + dch --bpo '' + systemd_in_lib + head debian/changelog + sed -i -e '1,3s/trixie-backports/bookworm-backports-sloppy/' debian/changelog + sed -i -e '1s/bpo13/bpo12/' debian/changelog + ) + bp2 $pkg $dir $origtar } main() { - local origtar="$1"; shift - local deb_revision="$1"; shift - local gitdir="$1"; shift - local pkg="$1"; shift - - [ -d local-build ] || mkdir local-build - - if [ -z "$origtar" ] ; then - echo "Usage: $0 [debian-revision]" >&2 - exit 1; - fi - - - if [ ! -e "$origtar" ] ; then - echo "$origtar does not exist." >&2 - exit 1; - fi - - if [ "${origtar#${pkg}-}" != $origtar ]; then - ver="$origtar" - ver=${ver#${pkg}-} - ver=${ver%.tar.gz} - neworig="${pkg}_$ver.orig.tar.gz" - if ! [ -e "$neworig" ]; then - ln -v "$origtar" "$neworig" - fi - echo "Using $neworig instead of $origtar" - origtar="$neworig" - fi - - local dir - local dir_version - dir=`tar tzf $origtar 2>/dev/null | head -n1` - dir="${dir%%/}" - dir_version="${dir##${pkg}-}" - if [ -e "$dir" ] ; then - echo "$dir already exists." >&2 - exit 1; - fi - tar xzf $origtar - git clone -n -s "$gitdir" git-"$dir" - local tag="debian-${pkg}-$dir_version-${deb_revision//\~/_}" - (cd "git-$dir" && git checkout $tag) - if diff -qr "git-$dir" "$dir" --exclude .git | grep -v '^Only in ' | grep --color .; then - echo "Differenced detected." - exit 1 - fi - (cd "git-$dir" && echo "\"`git rev-parse --short=16 "$tag"`\"" > "debian/micro-revision.i") - cp -av "git-$dir/debian" "$dir" - rm -rf "git-$dir" - - - debian_upstream_version=$(get_debian_version $dir upstream) - if [ "$origtar" != "${pkg}_$debian_upstream_version.orig.tar.gz" ] ; then - echo "possible mismatch: $origtar but $debian_upstream_version in debian/changelog" >&2 - exit 1; - fi - - debian_version=$(get_debian_version $dir) - sid_debian_version="$debian_version" - assert_files_dont_exist $pkg $debian_version - dpkg-source -b $dir $origtar - rm -r $dir - - - - # local - ################################################# - cd local-build - dpkg-source -x ../${pkg}_$debian_version.dsc - cd ${pkg}-$debian_upstream_version - debuild -j8 -rfakeroot -uc -us - cd ../.. - + local origtar="$1" + shift + local deb_revision="$1" + shift + local gitdir="$1" + shift + local pkg="$1" + shift + + [ -d local-build ] || mkdir local-build + + if [ -z "$origtar" ]; then + echo "Usage: $0 [debian-revision]" >&2 + exit 1 + fi + + if [ ! -e "$origtar" ]; then + echo "$origtar does not exist." >&2 + exit 1 + fi + + if [ "${origtar#${pkg}-}" != $origtar ]; then + ver="$origtar" + ver=${ver#${pkg}-} + ver=${ver%.tar.gz} + neworig="${pkg}_$ver.orig.tar.gz" + if ! [ -e "$neworig" ]; then + ln -v "$origtar" "$neworig" + fi + echo "Using $neworig instead of $origtar" + origtar="$neworig" + fi + + local dir + local dir_version + dir=$(tar tzf $origtar 2>/dev/null | head -n1) + dir="${dir%%/}" + dir_version="${dir##${pkg}-}" + if [ -e "$dir" ]; then + echo "$dir already exists." >&2 + exit 1 + fi + tar xzf $origtar + git clone -n -s "$gitdir" git-"$dir" + local tag="debian-${pkg}-$dir_version-${deb_revision//\~/_}" + (cd "git-$dir" && git checkout $tag) + if diff -qr "git-$dir" "$dir" --exclude .git | grep -v '^Only in ' | grep --color .; then + echo "Differenced detected." + exit 1 + fi + (cd "git-$dir" && echo "\"$(git rev-parse --short=16 "$tag")\"" >"debian/micro-revision.i") + cp -av "git-$dir/debian" "$dir" + rm -rf "git-$dir" + + debian_upstream_version=$(get_debian_version $dir upstream) + if [ "$origtar" != "${pkg}_$debian_upstream_version.orig.tar.gz" ]; then + echo "possible mismatch: $origtar but $debian_upstream_version in debian/changelog" >&2 + exit 1 + fi + + debian_version=$(get_debian_version $dir) + sid_debian_version="$debian_version" + assert_files_dont_exist $pkg $debian_version + dpkg-source -b $dir $origtar + rm -r $dir + + # local + ################################################# + cd local-build + dpkg-source -x ../${pkg}_$debian_version.dsc + cd ${pkg}-$debian_upstream_version + debuild -j8 -rfakeroot -uc -us + cd ../.. - [ "$DO_BACKPORTS" -gt 0 ] && backport_all "$pkg" "$dir" "$origtar" "$sid_debian_version" + [ "$DO_BACKPORTS" -gt 0 ] && backport_all "$pkg" "$dir" "$origtar" "$sid_debian_version" - echo - echo "All done" + echo + echo "All done" } usage() { - cat << EOF + cat < EOF } # this is hardcoded to weasel's directory layout. sorry. case "$(basename $0)" in - build-tor-sources) - DO_BACKPORTS=1 - while getopts "hB" option; do - case "$option" in - h) - usage - exit - ;; - B) - DO_BACKPORTS=0 - ;; - *) - usage >&2 - exit 1 - ;; - esac - done - shift $(($OPTIND - 1)) - - set -e - set -x - GITDIR="${GITDIR:-$HOME/projects/tor/tor}" - if ! [ -e "$GITDIR/.git" ] ; then - echo >&2 "\$GITDIR does not exist or does not have a .git. It needs to point to the tor git repository." - exit 1 - fi - PKG="tor" - DO_BPO=1 - main "${1:-}" ${2:-1} $GITDIR $PKG - ;; +build-tor-sources) + DO_BACKPORTS=1 + while getopts "hB" option; do + case "$option" in + h) + usage + exit + ;; + B) + DO_BACKPORTS=0 + ;; + *) + usage >&2 + exit 1 + ;; + esac + done + shift $(($OPTIND - 1)) + + set -e + set -x + GITDIR="${GITDIR:-$HOME/projects/tor/tor}" + if ! [ -e "$GITDIR/.git" ]; then + echo >&2 "\$GITDIR does not exist or does not have a .git. It needs to point to the tor git repository." + exit 1 + fi + PKG="tor" + DO_BPO=1 + main "${1:-}" ${2:-1} $GITDIR $PKG + ;; esac diff -Nru tor-0.4.8.16/debian/tests/control tor-0.4.9.6/debian/tests/control --- tor-0.4.8.16/debian/tests/control 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/tests/control 2026-04-05 21:20:34.000000000 +0000 @@ -4,5 +4,5 @@ # Restrictions: isolation-container Tests: setup-onion-service -Depends: tor, netcat-openbsd, torsocks, curl, onionshare, colorized-logs, unzip, diffutils +Depends: tor, netcat-openbsd, torsocks, curl, onionshare-cli, colorized-logs, diffutils Restrictions: flaky diff -Nru tor-0.4.8.16/debian/tests/setup-onion-service tor-0.4.9.6/debian/tests/setup-onion-service --- tor-0.4.8.16/debian/tests/setup-onion-service 2026-04-05 21:20:33.000000000 +0000 +++ tor-0.4.9.6/debian/tests/setup-onion-service 2026-04-05 21:20:34.000000000 +0000 @@ -89,7 +89,7 @@ echo "================" fi echo "(Re-)Launching onionshare." - pipetty onionshare --debug data > "$ONIONSHARELOG" 2>&1 & + pipetty onionshare-cli --public --verbose data > "$ONIONSHARELOG" 2>&1 & onionsharepid="$!" fi } @@ -139,7 +139,7 @@ timeout=600 while [ "$timeout" -ge 0 ]; do - url=$(grep '^http.*\.onion/' "$ONIONSHARELOG" || true) + url=$(grep --only-matching 'http.*\.onion' "$ONIONSHARELOG" || true) [ -n "$url" ] && break sleep 1 launchshare @@ -156,7 +156,7 @@ --retry 5 \ --max-time 300 \ --location \ - -o data.zip \ + -o data.out \ --stderr - \ "$url/download" && rc=0 || rc=$? @@ -167,9 +167,7 @@ echo "Comparing file." -(mkdir unzip && cd unzip && unzip ../data.zip) - -if cmp data unzip/data; then +if cmp data data.out; then echo "Successfully downloaded file." exit 0 else diff -Nru tor-0.4.8.16/doc/asciidoc-helper.sh tor-0.4.9.6/doc/asciidoc-helper.sh --- tor-0.4.8.16/doc/asciidoc-helper.sh 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/asciidoc-helper.sh 2026-03-25 14:30:34.000000000 +0000 @@ -12,8 +12,10 @@ exit 1 fi -SOURCE_DATE_EPOCH="$(git -C "$(dirname "$0")" show --no-patch --format='%ct')" -export SOURCE_DATE_EPOCH +if [ -z "$SOURCE_DATE_EPOCH" ]; then + SOURCE_DATE_EPOCH="$(git -C "$(dirname "$0")" show --no-patch --format='%ct')" + export SOURCE_DATE_EPOCH +fi output=$3 diff -Nru tor-0.4.8.16/doc/man/tor-gencert.1.in tor-0.4.9.6/doc/man/tor-gencert.1.in --- tor-0.4.8.16/doc/man/tor-gencert.1.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/tor-gencert.1.in 2026-03-25 14:30:34.000000000 +0000 @@ -2,12 +2,12 @@ .\" Title: tor-gencert .\" Author: Tor Project, Inc. .\" Generator: DocBook XSL Stylesheets vsnapshot -.\" Date: 03/24/2025 +.\" Date: 03/25/2026 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TOR\-GENCERT" "1" "03/24/2025" "Tor" "Tor Manual" +.TH "TOR\-GENCERT" "1" "03/25/2026" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- diff -Nru tor-0.4.8.16/doc/man/tor-print-ed-signing-cert.1.in tor-0.4.9.6/doc/man/tor-print-ed-signing-cert.1.in --- tor-0.4.8.16/doc/man/tor-print-ed-signing-cert.1.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/tor-print-ed-signing-cert.1.in 2026-03-25 14:30:34.000000000 +0000 @@ -2,12 +2,12 @@ .\" Title: tor-print-ed-signing-cert .\" Author: Tor Project, Inc. .\" Generator: DocBook XSL Stylesheets vsnapshot -.\" Date: 03/24/2025 +.\" Date: 03/25/2026 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TOR\-PRINT\-ED\-SIGN" "1" "03/24/2025" "Tor" "Tor Manual" +.TH "TOR\-PRINT\-ED\-SIGN" "1" "03/25/2026" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- diff -Nru tor-0.4.8.16/doc/man/tor-resolve.1.in tor-0.4.9.6/doc/man/tor-resolve.1.in --- tor-0.4.8.16/doc/man/tor-resolve.1.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/tor-resolve.1.in 2026-03-25 14:30:34.000000000 +0000 @@ -2,12 +2,12 @@ .\" Title: tor-resolve .\" Author: Peter Palfrader .\" Generator: DocBook XSL Stylesheets vsnapshot -.\" Date: 03/24/2025 +.\" Date: 03/25/2026 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TOR\-RESOLVE" "1" "03/24/2025" "Tor" "Tor Manual" +.TH "TOR\-RESOLVE" "1" "03/25/2026" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- diff -Nru tor-0.4.8.16/doc/man/tor.1.in tor-0.4.9.6/doc/man/tor.1.in --- tor-0.4.8.16/doc/man/tor.1.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/tor.1.in 2026-03-25 14:30:34.000000000 +0000 @@ -2,12 +2,12 @@ .\" Title: tor .\" Author: [FIXME: author] [see http://www.docbook.org/tdg5/en/html/author] .\" Generator: DocBook XSL Stylesheets vsnapshot -.\" Date: 03/24/2025 +.\" Date: 03/25/2026 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TOR" "1" "03/24/2025" "Tor" "Tor Manual" +.TH "TOR" "1" "03/25/2026" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -220,6 +220,16 @@ directory of your Tor daemon, and make sure that they are owned by the user actually running the Tor daemon on your system\&. .RE .PP +\fB\-\-keygen\-family\fR \fIbasename\fR +.RS 4 +Generate a new family ID key in +\fIbasename\fR\&.secret_family_key\&. To use this key, install it on every relay in your family\&. (Put it in the relay\(cqs +KeyDirectory\&.) Also, store the corresponding family ID in +\fIbasename\fR\&.public_family_id\&. Then enable the corresponding FamilyID option on your relays\&. This command overwrites these files if they already exist\&. See +https://community\&.torproject\&.org/relay/setup/post\-install/family\-ids/ +for more information\&. +.RE +.PP \fB\-\-passphrase\-fd\fR \fIFILEDES\fR .RS 4 File descriptor to read the passphrase from\&. Note that unlike with the tor\-gencert program, the entire file contents are read and used as the passphrase, including any trailing newlines\&. If the file descriptor is not specified, the passphrase is read from the terminal by default\&. @@ -799,7 +809,7 @@ Tor can scrub potentially sensitive strings from log messages (e\&.g\&. addresses) by replacing them with the string [scrubbed]\&. This way logs can still be useful, but they don\(cqt leave behind personally identifying information about what sites a user might have visited\&. -If this option is set to 0, Tor will not perform any scrubbing, if it is set to 1, all potentially sensitive strings are replaced\&. If it is set to relay, all log messages generated when acting as a relay are sanitized, but all messages generated when acting as a client are not\&. Note: Tor may not heed this option when logging at log levels below Notice\&. (Default: 1) +If this option is set to 0, Tor will not perform any scrubbing, if it is set to 1, all potentially sensitive strings are replaced\&. If it is set to relay, all log messages generated when acting as a relay are sanitized, but all messages generated when acting as a client are not\&. Note: Tor may not heed this option when logging at log levels more verbose than Notice\&. (Default: 1) .RE .PP \fBSandbox\fR \fB0\fR|\fB1\fR @@ -901,7 +911,7 @@ .RS 4 .\} .nf -The only protocol supported right now \*(Aqhaproxy\*(Aq\&. This option is only for +The only protocol supported right now is \*(Aqhaproxy\*(Aq\&. This option is only for clients\&. (Default: none) + .fi .if n \{\ @@ -2293,6 +2303,14 @@ If ExitRelay is set to "auto", then Tor checks the ExitPolicy, ReducedExitPolicy, and IPv6Exit options\&. If at least one of these options is set, Tor behaves as if ExitRelay were set to 1\&. If none of these exit policy options are set, Tor behaves as if ExitRelay were set to 0\&. (Default: auto) .RE .PP +\fBReevaluateExitPolicy\fR \fB0\fR|\fB1\fR +.RS 4 +If set, reevaluate the exit policy on existing connections when reloading configuration\&. + + +When the exit policy of an exit node change while reloading configuration, connections made prior to this change could violate the new policy\&. By setting this to 1, Tor will check if such connections exist, and mark them for termination\&. (Default: 0) +.RE +.PP \fBExtendAllowPrivateAddresses\fR \fB0\fR|\fB1\fR .RS 4 When this option is enabled, Tor will connect to relays on localhost, RFC1918 addresses, and so on\&. In particular, Tor will make direct OR connections, and Tor routers allow EXTEND requests, to these private addresses\&. (Tor will always allow connections to bridges, proxies, and pluggable transports configured on private addresses\&.) Enabling this option can create security issues; you should probably leave it off\&. (Default: 0) @@ -2341,6 +2359,14 @@ message designed to help developers instrumenting Tor\(cqs main event loop\&. (Default: 0) .RE .PP +\fBMaxHSDirCacheBytes\fR \fIN\fR \fBbytes\fR|\fBKBytes\fR|\fBMBytes\fR|\fBGBytes\fR +.RS 4 +This option configures a threshold of Hidden Service Directory memory consumption above which your Tor relay will begin to prune the least\-frequently accessed hidden service descriptors from the relay\(cqs HSDir cache\&. If set to 0, this will default to 20% of MaxMemInQueues\&. (Default: 0) + + +This pruning used to be done as part of MaxMemInQueues, but it has been decoupled to allow more fine\-grained control of descriptor cache size under DDoS conditions\&. +.RE +.PP \fBMaxMemInQueues\fR \fIN\fR \fBbytes\fR|\fBKBytes\fR|\fBMBytes\fR|\fBGBytes\fR .RS 4 This option configures a threshold above which Tor will assume that it needs to stop queueing or buffering data because it\(cqs about to run out of memory\&. If it hits this threshold, it will begin killing circuits until it has recovered at least 10% of this memory\&. Do not set this option too low, or your relay may be unreliable under load\&. This option only affects some queues, so the actual process size will be larger than this\&. If this option is set to 0, Tor will try to pick a reasonable default based on your system\(cqs physical memory\&. (Default: 0) @@ -2364,6 +2390,29 @@ Note: do not use MyFamily when configuring your Tor instance as a bridge\&. .RE .PP +\fBFamilyId\fR \fIident\fR +.RS 4 +Configure this relay to be part of a family identified by a shared secret family key with the given key identity\&. A corresponding family key must be stored in the relay\(cqs key directory, with a filename ending with "\&.secret_family_key"\&. This option can appear multiple times\&. Family keys are generated with "\-\-keygen\-family"; this also generates the value you should use in the +\fIident\fR +field in a file ending with "\&.public_family_id"\&. For information on generating and installing a family key, see +https://community\&.torproject\&.org/relay/setup/post\-install/family\-ids/ + +In the future, this will be the preferred way for relays to advertise family membership\&. But for now, relay families should configure both this option +\fIand\fR +MyFamily, so older clients will still recognize the relays\*(Aq family membership\&. + +(Note that if the seccomp2 Sandbox feature is enabled, it is not possible to change the key filenames while Tor is running\&.) +.RE +.PP +\fBFamilyId\fR \fB * \fR +.RS 4 +Configure this relay to be part of +\fIevery\fR +family identified by any family ID key found in the family key directory\&. Only filenames ending with "\&.secret\e_family\e_key" are considered\&. Specifying family IDs in this way makes it unnecessary to adjust the configuration file if the family key is rotated, but it increases the likelihood of accidentally using a different set of family keys than the ones you had expected\&. +.RE +.sp +\fBFamilyKeyDirectory\fR \fIdirectory\fR: Configure a directory to use, in place of the key directory, when searching for family ID keys\&. +.PP \fBNickname\fR \fIname\fR .RS 4 Set the server\(cqs nickname to \*(Aqname\*(Aq\&. Nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a\-zA\-Z0\-9]\&. If not set, @@ -2902,6 +2951,36 @@ Refuse establishment of rendezvous points for single hop clients\&. In other words, if a client directly connects to the relay and sends an ESTABLISH_RENDEZVOUS cell, it is silently dropped\&. "auto" means use the consensus parameter\&. If not defined in the consensus, the value is 0\&. (Default: auto) .RE .sp +The following options are useful only for a exit relay\&. +.PP +\fBDoSStreamCreationEnabled\fR \fB0\fR|\fB1\fR|\fBauto\fR +.RS 4 +Enable the stream DoS mitigation\&. If set to 1 (enabled), tor will apply rate limit on the creation of new streams and dns requests per circuit\&. "auto" means use the consensus parameter\&. If not defined in the consensus, the value is 0\&. (Default: auto) +.RE +.PP +\fBDoSStreamCreationDefenseType\fR \fINUM\fR +.RS 4 +This is the type of defense applied to a detected circuit or stream for the stream mitigation\&. The possible values are: + +1: No defense\&. + +2: Reject the stream or resolve request\&. + +3: Close the circuit creating too many streams\&. + +"0" means use the consensus parameter\&. If not defined in the consensus, the value is 2\&. (Default: 0) +.RE +.PP +\fBDoSStreamCreationRate\fR \fINUM\fR +.RS 4 +The allowed rate of stream creation from a single circuit per second\&. Coupled with the burst (see below), if the limit is reached, actions can be taken against the stream or circuit (DoSStreamCreationDefenseType)\&. If not defined or set to 0, it is controlled by a consensus parameter\&. If not defined in the consensus, the value is 100\&. (Default: 0) +.RE +.PP +\fBDoSStreamCreationBurst\fR \fINUM\fR +.RS 4 +The allowed burst of stream creation from a circuit per second\&. See the DoSStreamCreationRate for more details on this detection\&. If not defined or set to 0, it is controlled by a consensus parameter\&. If not defined in the consensus, the value is 300\&. (Default: 0) +.RE +.sp For onion services, mitigations are a work in progress and multiple options are currently available\&. .sp The introduction point defense is a rate limit on the number of introduction requests that will be forwarded to a service by each of its honest introduction point routers\&. This can prevent some types of overwhelming floods from reaching the service, but it will also prevent legitimate clients from establishing new connections\&. @@ -2935,7 +3014,7 @@ .sp This might be too much for your use case or not, fine tuning these values is hard and are likely different for each service operator\&. .sp -Why is this not helping reachability of the service? Because the defenses are at the introduction point, an attacker can easily flood all introduction point rendering the service unavailable due to no client being able to pass through\&. But, the service itself is not overwhelmed with connetions allowing it to function properly for the few clients that were able to go through or other any services running on the same tor instance\&. +Why is this not helping reachability of the service? Because the defenses are at the introduction point, an attacker can easily flood all introduction point rendering the service unavailable due to no client being able to pass through\&. But, the service itself is not overwhelmed with connections allowing it to function properly for the few clients that were able to go through or other any services running on the same tor instance\&. .sp The bottom line is that this protects the network by preventing an onion service to flood the network with new rendezvous circuits that is reducing load on the network\&. .sp @@ -3108,7 +3187,7 @@ .PP \fBAuthDirRejectRequestsUnderLoad\fR \fB0\fR|\fB1\fR .RS 4 -If set, the directory authority will start rejecting directory requests from non relay connections by sending a 503 error code if it is under bandwidth pressure (reaching the configured limit if any)\&. Relays will always tried to be answered even if this is on\&. (Default: 1) +If set, the directory authority will start rejecting directory requests from non relay connections by sending a 503 error code if it is under bandwidth pressure (reaching the configured limit if any)\&. Relays will always be answered even if this is on\&. (Default: 1) .RE .sp \fBAuthDirBadExitCCs\fR \fICC\fR,\&... @@ -3224,6 +3303,11 @@ should be set too\&. .RE .PP +\fBMinimalAcceptedServerVersion\fR \fISTRING\fR +.RS 4 +STRING is the oldest Tor version accepted by the directory authority for relays and bridge\&. Any older version will be rejected\&. (Default: 0\&.4\&.7\&.0\-alpha\-dev) +.RE +.PP \fBV3AuthDistDelay\fR \fIN\fR \fBseconds\fR|\fBminutes\fR|\fBhours\fR .RS 4 V3 authoritative directories only\&. Configures the server\(cqs preferred delay between publishing its consensus and signature and assuming it has all the signatures from all the other authorities\&. Note that the actual time used is not the server\(cqs preferred time, but the consensus of all preferences\&. (Default: 5 minutes) @@ -4012,6 +4096,13 @@ file holds the previously generated key, which the relay uses to handle any requests that were made by clients that didn\(cqt have the new one\&. .RE .PP +\fIKeyDirectory\fR/\fIkeyname\fR\fB\&.secret_family_key\fR +.RS 4 +A relay family\(cqs family identity key\&. Used to prove membership in a relay family\&. See +https://community\&.torproject\&.org/relay/setup/post\-install/family\-ids/ +for more information\&. +.RE +.PP \fIDataDirectory\fR/\fBfingerprint\fR .RS 4 Only used by servers\&. Contains the fingerprint of the server\(cqs RSA identity key\&. @@ -4027,6 +4118,11 @@ Only used by bridges\&. Contains the hashed fingerprint of the bridge\(cqs identity key\&. (That is, the hash of the hash of the identity key\&.) .RE .PP +\fIDataDirectory\fR/\fBbridgelines\fR +.RS 4 +Only used by bridges\&. Contains the bridge lines that clients can use to connect using pluggable transports\&. +.RE +.PP \fIDataDirectory\fR/\fBapproved\-routers\fR .RS 4 Only used by authoritative directory servers\&. Each line lists a status and an identity, separated by whitespace\&. Identities can be hex\-encoded RSA fingerprints, or base\-64 encoded ed25519 public keys\&. See the @@ -4101,7 +4197,7 @@ Only used by servers\&. This file is used to collect approximate counts of what fraction of the traffic is hidden service rendezvous traffic, and approximately how many hidden services the relay has seen\&. .RE .PP -\fIDataDirectory\fR/\fBnetworkstatus\-bridges`\fR +\fIDataDirectory\fR/\fBnetworkstatus\-bridges\fR .RS 4 Only used by authoritative bridge directories\&. Contains information about bridges that have self\-reported themselves to the bridge authority\&. .RE diff -Nru tor-0.4.8.16/doc/man/tor.1.txt tor-0.4.9.6/doc/man/tor.1.txt --- tor-0.4.8.16/doc/man/tor.1.txt 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/tor.1.txt 2026-03-25 14:30:34.000000000 +0000 @@ -168,6 +168,16 @@ make sure that they are owned by the user actually running the Tor daemon on your system. +[[opt-keygen-family]] **`--keygen-family`** __basename__:: + Generate a new family ID key in __basename__`.secret_family_key`. + To use this key, install it on every relay in your family. + (Put it in the relay's `KeyDirectory`.) + Also, store the corresponding family ID in __basename__`.public_family_id`. + Then enable the corresponding FamilyID option on your relays. + This command overwrites these files if they already exist. + See https://community.torproject.org/relay/setup/post-install/family-ids/ + for more information. + **`--passphrase-fd`** __FILEDES__:: File descriptor to read the passphrase from. Note that unlike with the tor-gencert program, the entire file contents are read and used as @@ -906,7 +916,8 @@ set to 1, all potentially sensitive strings are replaced. If it is set to relay, all log messages generated when acting as a relay are sanitized, but all messages generated when acting as a client are not. - Note: Tor may not heed this option when logging at log levels below Notice. + Note: Tor may not heed this option when logging at log levels more + verbose than Notice. (Default: 1) [[Sandbox]] **Sandbox** **0**|**1**:: @@ -1010,7 +1021,7 @@ equivalent option for directory connections, because all Tor client versions that support this option download directory documents via OR connections. + + - The only protocol supported right now 'haproxy'. This option is only for + The only protocol supported right now is 'haproxy'. This option is only for clients. (Default: none) + + The HAProxy version 1 proxy protocol is described in detail at @@ -2385,6 +2396,16 @@ policy options are set, Tor behaves as if ExitRelay were set to 0. (Default: auto) +[[ReevaluateExitPolicy]] **ReevaluateExitPolicy** **0**|**1**:: + If set, reevaluate the exit policy on existing connections when reloading + configuration. + + + + When the exit policy of an exit node change while reloading configuration, + connections made prior to this change could violate the new policy. By + setting this to 1, Tor will check if such connections exist, and mark them + for termination. + (Default: 0) + [[ExtendAllowPrivateAddresses]] **ExtendAllowPrivateAddresses** **0**|**1**:: When this option is enabled, Tor will connect to relays on localhost, RFC1918 addresses, and so on. In particular, Tor will make direct OR @@ -2429,6 +2450,16 @@ level __notice__ message designed to help developers instrumenting Tor's main event loop. (Default: 0) +[[MaxHSDirCacheBytes]] **MaxHSDirCacheBytes** __N__ **bytes**|**KBytes**|**MBytes**|**GBytes**:: + This option configures a threshold of Hidden Service Directory memory + consumption above which your Tor relay will begin to prune the least-frequently + accessed hidden service descriptors from the relay's HSDir cache. + If set to 0, this will default to 20% of MaxMemInQueues. (Default: 0) + + + + This pruning used to be done as part of MaxMemInQueues, but it has been + decoupled to allow more fine-grained control of descriptor cache size under + DDoS conditions. + [[MaxMemInQueues]] **MaxMemInQueues** __N__ **bytes**|**KBytes**|**MBytes**|**GBytes**:: This option configures a threshold above which Tor will assume that it needs to stop queueing or buffering data because it's about to run out of @@ -2462,6 +2493,40 @@ Note: do not use MyFamily when configuring your Tor instance as a bridge. +[[FamilyId]] **FamilyId** __ident__:: + Configure this relay to be part of a family + identified by a shared secret family key with the given key identity. + A corresponding family key must be stored in the relay's key directory, + with a filename ending with ".secret\_family\_key". + This option can appear multiple times. + Family keys are generated with "--keygen-family"; + this also generates the value you should use in the __ident__ field + in a file ending with ".public\_family\_id". + For information on generating and installing a family + key, see https://community.torproject.org/relay/setup/post-install/family-ids/ + + + In the future, this will be the preferred way for relays + to advertise family membership. + But for now, relay families should configure + both this option _and_ MyFamily, so older clients + will still recognize the relays' family membership. + + + (Note that if the seccomp2 Sandbox feature is enabled, + it is not possible to change the key filenames while Tor is running.) + +[[FamilyIdStar]] **FamilyId** ** * **:: + Configure this relay to be part of _every_ family + identified by any family ID key found in the family key directory. + Only filenames ending with ".secret\_family\_key" are considered. + Specifying family IDs in this way makes it unnecessary to adjust the + configuration file if the family key is rotated, + but it increases the likelihood of accidentally using a different + set of family keys than the ones you had expected. + +[[FamilyKeyDirectory]] **FamilyKeyDirectory** __directory__: + Configure a directory to use, in place of the key directory, + when searching for family ID keys. + [[Nickname]] **Nickname** __name__:: Set the server's nickname to \'name'. Nicknames must be between 1 and 19 characters inclusive, and must contain only the characters [a-zA-Z0-9]. @@ -3026,6 +3091,44 @@ consensus parameter. If not defined in the consensus, the value is 0. (Default: auto) +The following options are useful only for a exit relay. + +[[DoSStreamCreationEnabled]] **DoSStreamCreationEnabled** **0**|**1**|**auto**:: + + Enable the stream DoS mitigation. If set to 1 (enabled), tor will apply + rate limit on the creation of new streams and dns requests per circuit. + "auto" means use the consensus parameter. If not defined in the consensus, + the value is 0. (Default: auto) + +[[DoSStreamCreationDefenseType]] **DoSStreamCreationDefenseType** __NUM__:: + + This is the type of defense applied to a detected circuit or stream for the + stream mitigation. The possible values are: + + + 1: No defense. + + + 2: Reject the stream or resolve request. + + + 3: Close the circuit creating too many streams. + + + "0" means use the consensus parameter. If not defined in the consensus, the value is 2. + (Default: 0) + +[[DoSStreamCreationRate]] **DoSStreamCreationRate** __NUM__:: + + The allowed rate of stream creation from a single circuit per second. Coupled + with the burst (see below), if the limit is reached, actions can be taken + against the stream or circuit (DoSStreamCreationDefenseType). If not defined or + set to 0, it is controlled by a consensus parameter. If not defined in the + consensus, the value is 100. (Default: 0) + +[[DoSStreamCreationBurst]] **DoSStreamCreationBurst** __NUM__:: + + The allowed burst of stream creation from a circuit per second. + See the DoSStreamCreationRate for more details on this detection. If + not defined or set to 0, it is controlled by a consensus parameter. If not + defined in the consensus, the value is 300. (Default: 0) + For onion services, mitigations are a work in progress and multiple options are currently available. @@ -3080,7 +3183,7 @@ Why is this not helping reachability of the service? Because the defenses are at the introduction point, an attacker can easily flood all introduction point rendering the service unavailable due to no client being able to pass through. -But, the service itself is not overwhelmed with connetions allowing it to +But, the service itself is not overwhelmed with connections allowing it to function properly for the few clients that were able to go through or other any services running on the same tor instance. @@ -3252,7 +3355,7 @@ If set, the directory authority will start rejecting directory requests from non relay connections by sending a 503 error code if it is under bandwidth pressure (reaching the configured limit if any). Relays will - always tried to be answered even if this is on. (Default: 1) + always be answered even if this is on. (Default: 1) //Out of order because it logically belongs with the other CCs options. [[AuthDirBadExitCCs]] **AuthDirBadExitCCs** __CC__,... + @@ -3370,6 +3473,11 @@ multiple times: the values from multiple lines are spliced together. When this is set then **VersioningAuthoritativeDirectory** should be set too. +[[MinimalAcceptedServerVersion]] **MinimalAcceptedServerVersion** __STRING__:: + STRING is the oldest Tor version accepted by the directory authority for + relays and bridge. Any older version will be rejected. + (Default: 0.4.7.0-alpha-dev) + [[V3AuthDistDelay]] **V3AuthDistDelay** __N__ **seconds**|**minutes**|**hours**:: V3 authoritative directories only. Configures the server's preferred delay between publishing its consensus and signature and assuming it has all the @@ -3987,6 +4095,12 @@ generated key, which the relay uses to handle any requests that were made by clients that didn't have the new one. +__KeyDirectory__/__keyname__**`.secret_family_key`**:: + A relay family's family identity key. + Used to prove membership in a relay family. + See https://community.torproject.org/relay/setup/post-install/family-ids/ + for more information. + __DataDirectory__/**`fingerprint`**:: Only used by servers. Contains the fingerprint of the server's RSA identity key. @@ -3999,6 +4113,10 @@ Only used by bridges. Contains the hashed fingerprint of the bridge's identity key. (That is, the hash of the hash of the identity key.) +__DataDirectory__/**`bridgelines`**:: + Only used by bridges. Contains the bridge lines that clients can use to + connect using pluggable transports. + __DataDirectory__/**`approved-routers`**:: Only used by authoritative directory servers. Each line lists a status and an identity, separated by whitespace. Identities can be hex-encoded RSA @@ -4064,7 +4182,7 @@ of what fraction of the traffic is hidden service rendezvous traffic, and approximately how many hidden services the relay has seen. -__DataDirectory__/**networkstatus-bridges`**:: +__DataDirectory__/**`networkstatus-bridges`**:: Only used by authoritative bridge directories. Contains information about bridges that have self-reported themselves to the bridge authority. diff -Nru tor-0.4.8.16/doc/man/tor.html.in tor-0.4.9.6/doc/man/tor.html.in --- tor-0.4.8.16/doc/man/tor.html.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/tor.html.in 2026-03-25 14:30:34.000000000 +0000 @@ -1008,6 +1008,21 @@ daemon on your system.

+ --keygen-family basename +
+
+

+ Generate a new family ID key in basename.secret_family_key. + To use this key, install it on every relay in your family. + (Put it in the relay’s KeyDirectory.) + Also, store the corresponding family ID in basename.public_family_id. + Then enable the corresponding FamilyID option on your relays. + This command overwrites these files if they already exist. + See https://community.torproject.org/relay/setup/post-install/family-ids/ + for more information. +

+
+
--passphrase-fd FILEDES
@@ -2148,7 +2163,8 @@ set to 1, all potentially sensitive strings are replaced. If it is set to relay, all log messages generated when acting as a relay are sanitized, but all messages generated when acting as a client are not. - Note: Tor may not heed this option when logging at log levels below Notice. + Note: Tor may not heed this option when logging at log levels more + verbose than Notice. (Default: 1)

@@ -2301,7 +2317,7 @@

-
The only protocol supported right now 'haproxy'. This option is only for
+
The only protocol supported right now is 'haproxy'. This option is only for
 clients. (Default: none) +
@@ -4419,6 +4435,21 @@

+ ReevaluateExitPolicy 0|1 +
+
+

+ If set, reevaluate the exit policy on existing connections when reloading + configuration.
+
+ When the exit policy of an exit node change while reloading configuration, + connections made prior to this change could violate the new policy. By + setting this to 1, Tor will check if such connections exist, and mark them + for termination. + (Default: 0) +

+
+
ExtendAllowPrivateAddresses 0|1
@@ -4503,6 +4534,21 @@

+ MaxHSDirCacheBytes N bytes|KBytes|MBytes|GBytes +
+
+

+ This option configures a threshold of Hidden Service Directory memory + consumption above which your Tor relay will begin to prune the least-frequently + accessed hidden service descriptors from the relay’s HSDir cache. + If set to 0, this will default to 20% of MaxMemInQueues. (Default: 0)
+
+ This pruning used to be done as part of MaxMemInQueues, but it has been + decoupled to allow more fine-grained control of descriptor cache size under + DDoS conditions. +

+
+
MaxMemInQueues N bytes|KBytes|MBytes|GBytes
@@ -4551,6 +4597,51 @@

+ FamilyId ident +
+
+

+ Configure this relay to be part of a family + identified by a shared secret family key with the given key identity. + A corresponding family key must be stored in the relay’s key directory, + with a filename ending with ".secret_family_key". + This option can appear multiple times. + Family keys are generated with "--keygen-family"; + this also generates the value you should use in the ident field + in a file ending with ".public_family_id". + For information on generating and installing a family + key, see https://community.torproject.org/relay/setup/post-install/family-ids/ +
+ In the future, this will be the preferred way for relays + to advertise family membership. + But for now, relay families should configure + both this option and MyFamily, so older clients + will still recognize the relays' family membership. +
+ (Note that if the seccomp2 Sandbox feature is enabled, + it is not possible to change the key filenames while Tor is running.) +

+
+
+ FamilyId * +
+
+

+ Configure this relay to be part of every family + identified by any family ID key found in the family key directory. + Only filenames ending with ".secret\_family\_key" are considered. + Specifying family IDs in this way makes it unnecessary to adjust the + configuration file if the family key is rotated, + but it increases the likelihood of accidentally using a different + set of family keys than the ones you had expected. +

+
+
+

FamilyKeyDirectory directory: + Configure a directory to use, in place of the key directory, + when searching for family ID keys.

+
+
Nickname name
@@ -5411,6 +5502,61 @@

+

The following options are useful only for a exit relay.

+
+
+ DoSStreamCreationEnabled 0|1|auto +
+
+

+ Enable the stream DoS mitigation. If set to 1 (enabled), tor will apply + rate limit on the creation of new streams and dns requests per circuit. + "auto" means use the consensus parameter. If not defined in the consensus, + the value is 0. (Default: auto) +

+
+
+ DoSStreamCreationDefenseType NUM +
+
+

+ This is the type of defense applied to a detected circuit or stream for the + stream mitigation. The possible values are: +
+ 1: No defense. +
+ 2: Reject the stream or resolve request. +
+ 3: Close the circuit creating too many streams. +
+ "0" means use the consensus parameter. If not defined in the consensus, the value is 2. + (Default: 0) +

+
+
+ DoSStreamCreationRate NUM +
+
+

+ The allowed rate of stream creation from a single circuit per second. Coupled + with the burst (see below), if the limit is reached, actions can be taken + against the stream or circuit (DoSStreamCreationDefenseType). If not defined or + set to 0, it is controlled by a consensus parameter. If not defined in the + consensus, the value is 100. (Default: 0) +

+
+
+ DoSStreamCreationBurst NUM +
+
+

+ The allowed burst of stream creation from a circuit per second. + See the DoSStreamCreationRate for more details on this detection. If + not defined or set to 0, it is controlled by a consensus parameter. If not + defined in the consensus, the value is 300. (Default: 0) +

+
+

For onion services, mitigations are a work in progress and multiple options are currently available.

The introduction point defense is a rate limit on the number of introduction @@ -5476,7 +5622,7 @@

Why is this not helping reachability of the service? Because the defenses are at the introduction point, an attacker can easily flood all introduction point rendering the service unavailable due to no client being able to pass through. -But, the service itself is not overwhelmed with connetions allowing it to +But, the service itself is not overwhelmed with connections allowing it to function properly for the few clients that were able to go through or other any services running on the same tor instance.

The bottom line is that this protects the network by preventing an onion @@ -5749,7 +5895,7 @@ If set, the directory authority will start rejecting directory requests from non relay connections by sending a 503 error code if it is under bandwidth pressure (reaching the configured limit if any). Relays will - always tried to be answered even if this is on. (Default: 1) + always be answered even if this is on. (Default: 1)

@@ -5960,6 +6106,16 @@

+ MinimalAcceptedServerVersion STRING +
+
+

+ STRING is the oldest Tor version accepted by the directory authority for + relays and bridge. Any older version will be rejected. + (Default: 0.4.7.0-alpha-dev) +

+
+
V3AuthDistDelay N seconds|minutes|hours
@@ -7053,6 +7209,17 @@

+KeyDirectory/keyname.secret_family_key +
+
+

+ A relay family’s family identity key. + Used to prove membership in a relay family. + See https://community.torproject.org/relay/setup/post-install/family-ids/ + for more information. +

+
+
DataDirectory/fingerprint
@@ -7080,6 +7247,15 @@

+DataDirectory/bridgelines +
+
+

+ Only used by bridges. Contains the bridge lines that clients can use to + connect using pluggable transports. +

+
+
DataDirectory/approved-routers
@@ -7210,7 +7386,7 @@

-DataDirectory/networkstatus-bridges` +DataDirectory/networkstatus-bridges

diff -Nru tor-0.4.8.16/doc/man/torify.1.in tor-0.4.9.6/doc/man/torify.1.in --- tor-0.4.8.16/doc/man/torify.1.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/doc/man/torify.1.in 2026-03-25 14:30:34.000000000 +0000 @@ -2,12 +2,12 @@ .\" Title: torify .\" Author: Tor Project, Inc. .\" Generator: DocBook XSL Stylesheets vsnapshot -.\" Date: 03/24/2025 +.\" Date: 03/25/2026 .\" Manual: Tor Manual .\" Source: Tor .\" Language: English .\" -.TH "TORIFY" "1" "03/24/2025" "Tor" "Tor Manual" +.TH "TORIFY" "1" "03/25/2026" "Tor" "Tor Manual" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- diff -Nru tor-0.4.8.16/m4/ax_check_compile_flag.m4 tor-0.4.9.6/m4/ax_check_compile_flag.m4 --- tor-0.4.8.16/m4/ax_check_compile_flag.m4 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/m4/ax_check_compile_flag.m4 2026-03-25 14:30:34.000000000 +0000 @@ -1,43 +1,45 @@ - # Copyright (c) 2008 Guido U. Draheim - # Copyright (c) 2011 Maarten Bosmans - # - # This program is free software: you can redistribute it and/or modify it - # under the terms of the GNU General Public License as published by the - # Free Software Foundation, either version 3 of the License, or (at your - # option) any later version. - # - # This program is distributed in the hope that it will be useful, but - # WITHOUT ANY WARRANTY; without even the implied warranty of - # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General - # Public License for more details. - # - # You should have received a copy of the GNU General Public License along - # with this program. If not, see . - # - # As a special exception, the respective Autoconf Macro's copyright owner - # gives unlimited permission to copy, distribute and modify the configure - # scripts that are the output of Autoconf when processing the Macro. You - # need not follow the terms of the GNU General Public License when using - # or distributing such scripts, even though portions of the text of the - # Macro appear in them. The GNU General Public License (GPL) does govern - # all other use of the material that constitutes the Autoconf Macro. - # - # This special exception to the GPL applies to versions of the Autoconf - # Macro released by the Autoconf Archive. When you make and distribute a - # modified version of the Autoconf Macro, you may extend this special - # exception to the GPL to apply to your modified version as well. - # Copying and distribution of this file, with or without modification, are - # permitted in any medium without royalty provided the copyright notice - # and this notice are preserved. This file is offered as-is, without any - # warranty. +# =========================================================================== +# https://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html +# =========================================================================== +# +# SYNOPSIS +# +# AX_CHECK_COMPILE_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS], [INPUT]) +# +# DESCRIPTION +# +# Check whether the given FLAG works with the current language's compiler +# or gives an error. (Warnings, however, are ignored) +# +# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on +# success/failure. +# +# If EXTRA-FLAGS is defined, it is added to the current language's default +# flags (e.g. CFLAGS) when the check is done. The check is thus made with +# the flags: "CFLAGS EXTRA-FLAGS FLAG". This can for example be used to +# force the compiler to issue an error when a bad flag is given. +# +# INPUT gives an alternative input source to AC_COMPILE_IFELSE. +# +# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this +# macro in sync with AX_CHECK_{PREPROC,LINK}_FLAG. +# +# LICENSE +# +# Copyright (c) 2008 Guido U. Draheim +# Copyright (c) 2011 Maarten Bosmans +# +# Copying and distribution of this file, with or without modification, are +# permitted in any medium without royalty provided the copyright notice +# and this notice are preserved. This file is offered as-is, without any +# warranty. - #serial 5 - #serial 6 +#serial 7 - AC_DEFUN([AX_CHECK_COMPILE_FLAG], - [AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF +AC_DEFUN([AX_CHECK_COMPILE_FLAG], +[AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_[]_AC_LANG_ABBREV[]flags_$4_$1])dnl -AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [ +AC_CACHE_CHECK([whether the _AC_LANG compiler accepts $1], CACHEVAR, [ ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS _AC_LANG_PREFIX[]FLAGS="$[]_AC_LANG_PREFIX[]FLAGS $4 $1" AC_COMPILE_IFELSE([m4_default([$5],[AC_LANG_PROGRAM()])], diff -Nru tor-0.4.8.16/orconfig.h.in tor-0.4.9.6/orconfig.h.in --- tor-0.4.8.16/orconfig.h.in 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/orconfig.h.in 2026-03-25 14:30:34.000000000 +0000 @@ -6,7 +6,7 @@ /* All assert failures are fatal */ #undef ALL_BUGS_ARE_FATAL -/* # for 0.4.8.16 Approximate date when this software was released. (Updated +/* # for 0.4.9.6 Approximate date when this software was released. (Updated when the version changes.) */ #undef APPROX_RELEASE_DATE @@ -95,6 +95,9 @@ /* defined if we have the fallthrough attribute. */ #undef HAVE_ATTR_FALLTHROUGH +/* defined if we have the nonstring attribute. */ +#undef HAVE_ATTR_NONSTRING + /* Define to 1 if you have the `backtrace' function. */ #undef HAVE_BACKTRACE @@ -141,9 +144,6 @@ /* Define to 1 if you have the header file. */ #undef HAVE_ERRNO_H -/* Define to 1 if you have the `ERR_load_KDF_strings' function. */ -#undef HAVE_ERR_LOAD_KDF_STRINGS - /* Define to 1 if you have the `evdns_base_get_nameserver_addr' function. */ #undef HAVE_EVDNS_BASE_GET_NAMESERVER_ADDR @@ -381,6 +381,9 @@ /* Define to 1 if you have the header file. */ #undef HAVE_NET_PFVAR_H +/* Define to 1 if you have the header file. */ +#undef HAVE_OPENSSL_ENGINE_H + /* Define to 1 if you have the `pipe' function. */ #undef HAVE_PIPE @@ -441,29 +444,11 @@ /* Define to 1 if the system has the type `ssize_t'. */ #undef HAVE_SSIZE_T -/* Define to 1 if you have the `SSL_CIPHER_find' function. */ -#undef HAVE_SSL_CIPHER_FIND - -/* Define to 1 if you have the `SSL_CTX_set1_groups_list' function. */ -#undef HAVE_SSL_CTX_SET1_GROUPS_LIST - /* Define to 1 if you have the `SSL_CTX_set_security_level' function. */ #undef HAVE_SSL_CTX_SET_SECURITY_LEVEL -/* Define to 1 if you have the `SSL_get_client_ciphers' function. */ -#undef HAVE_SSL_GET_CLIENT_CIPHERS - -/* Define to 1 if you have the `SSL_get_client_random' function. */ -#undef HAVE_SSL_GET_CLIENT_RANDOM - -/* Define to 1 if you have the `SSL_get_server_random' function. */ -#undef HAVE_SSL_GET_SERVER_RANDOM - -/* Define to 1 if you have the `SSL_SESSION_get_master_key' function. */ -#undef HAVE_SSL_SESSION_GET_MASTER_KEY - -/* Define to 1 if `state' is a member of `SSL'. */ -#undef HAVE_SSL_STATE +/* Define to 1 if you have the `SSL_set_ciphersuites' function. */ +#undef HAVE_SSL_SET_CIPHERSUITES /* Define to 1 if you have the `statvfs' function. */ #undef HAVE_STATVFS @@ -525,10 +510,6 @@ /* Define to 1 if `sin_len' is a member of `struct sockaddr_in'. */ #undef HAVE_STRUCT_SOCKADDR_IN_SIN_LEN -/* Define to 1 if `get_cipher_by_char' is a member of `struct ssl_method_st'. - */ -#undef HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR - /* Define to 1 if `tcpi_snd_mss' is a member of `struct tcp_info'. */ #undef HAVE_STRUCT_TCP_INFO_TCPI_SND_MSS @@ -634,9 +615,6 @@ /* Define to 1 if you have the `timingsafe_memcmp' function. */ #undef HAVE_TIMINGSAFE_MEMCMP -/* Define to 1 if you have the `TLS_method' function. */ -#undef HAVE_TLS_METHOD - /* Compiled with tracing support */ #undef HAVE_TRACING @@ -691,6 +669,9 @@ /* Define to 1 iff malloc(0) returns a pointer */ #undef MALLOC_ZERO_WORKS +/* whether nss defines ecdh_hybrid key exchange. */ +#undef NSS_HAS_ECDH_HYBRID + /* Define to 1 iff memset(0) sets pointers to NULL */ #undef NULL_REP_IS_ZERO_BYTES @@ -742,9 +723,6 @@ /* The size of `pid_t', as computed by sizeof. */ #undef SIZEOF_PID_T -/* The size of `SHA_CTX', as computed by sizeof. */ -#undef SIZEOF_SHA_CTX - /* The size of `short', as computed by sizeof. */ #undef SIZEOF_SHORT diff -Nru tor-0.4.8.16/scripts/maint/practracker/practracker.py tor-0.4.9.6/scripts/maint/practracker/practracker.py --- tor-0.4.8.16/scripts/maint/practracker/practracker.py 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/scripts/maint/practracker/practracker.py 2026-03-25 14:30:34.000000000 +0000 @@ -24,7 +24,7 @@ from __future__ import print_function from __future__ import unicode_literals -import codecs, os, sys +import io, os, sys import metrics import util @@ -64,7 +64,7 @@ ####################################################### def open_file(fname): - return codecs.open(fname, 'r', encoding='utf-8') + return io.open(fname, 'r', encoding='utf-8') def consider_file_size(fname, f): """Consider the size of 'f' and yield an FileSizeItem for it. diff -Nru tor-0.4.8.16/src/app/config/config.c tor-0.4.9.6/src/app/config/config.c --- tor-0.4.8.16/src/app/config/config.c 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/src/app/config/config.c 2026-03-25 14:30:34.000000000 +0000 @@ -470,6 +470,9 @@ V(UseDefaultFallbackDirs, BOOL, "1"), OBSOLETE("FallbackNetworkstatusFile"), + VAR("FamilyId", LINELIST, FamilyId_lines, NULL), + VAR_IMMUTABLE("FamilyKeyDirectory", + FILENAME, FamilyKeyDirectory_option, NULL), V(FascistFirewall, BOOL, "0"), V(FirewallPorts, CSV, ""), OBSOLETE("FastFirstHopPK"), @@ -483,6 +486,13 @@ #ifdef _WIN32 V(GeoIPFile, FILENAME, ""), V(GeoIPv6File, FILENAME, ""), +#elif defined(__ANDROID__) + /* Android apps use paths that are configured at runtime. + * /data/local/tmp is guaranteed to exist, but will only be + * usable by the 'shell' and 'root' users, so this fallback is + * for debugging only. */ + V(GeoIPFile, FILENAME, "/data/local/tmp/geoip"), + V(GeoIPv6File, FILENAME, "/data/local/tmp/geoip6"), #else V(GeoIPFile, FILENAME, SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"), @@ -558,6 +568,7 @@ V(MaxClientCircuitsPending, POSINT, "32"), V(MaxConsensusAgeForDiffs, INTERVAL, "0 seconds"), VAR("MaxMemInQueues", MEMUNIT, MaxMemInQueues_raw, "0"), + VAR("MaxHSDirCacheBytes", MEMUNIT, MaxHSDirCacheBytes, "0"), OBSOLETE("MaxOnionsPending"), V(MaxOnionQueueDelay, MSEC_INTERVAL, "0"), V(MaxUnparseableDescSizeToLog, MEMUNIT, "10 MB"), @@ -637,6 +648,7 @@ V(RephistTrackTime, INTERVAL, "24 hours"), V_IMMUTABLE(RunAsDaemon, BOOL, "0"), V(ReducedExitPolicy, BOOL, "0"), + V(ReevaluateExitPolicy, BOOL, "0"), OBSOLETE("RunTesting"), // currently unused V_IMMUTABLE(Sandbox, BOOL, "0"), V(SafeLogging, STRING, "1"), @@ -996,6 +1008,7 @@ config_line_t *changes = config_get_changes(get_options_mgr(), old_options, new_val); control_event_conf_changed(changes); + connection_reapply_exit_policy(changes); config_free_lines(changes); } @@ -1035,11 +1048,17 @@ } tor_free(options->DataDirectory); tor_free(options->CacheDirectory); + tor_free(options->FamilyKeyDirectory); tor_free(options->KeyDirectory); tor_free(options->BridgePassword_AuthDigest_); tor_free(options->command_arg); tor_free(options->master_key_fname); config_free_lines(options->MyFamily); + if (options->FamilyIds) { + SMARTLIST_FOREACH(options->FamilyIds, + ed25519_public_key_t *, k, tor_free(k)); + smartlist_free(options->FamilyIds); + } } /** Release all memory allocated in options @@ -2479,6 +2498,9 @@ .command=CMD_LIST_FINGERPRINT }, { .name="--keygen", .command=CMD_KEYGEN }, + { .name="--keygen-family", + .command=CMD_KEYGEN_FAMILY, + .takes_argument=ARGUMENT_NECESSARY }, { .name="--key-expiration", .takes_argument=ARGUMENT_OPTIONAL, .command=CMD_KEY_EXPIRATION }, @@ -6898,6 +6920,15 @@ } else { return tor_strdup(get_windows_conf_root()); } +#elif defined(__ANDROID__) + /* Android apps can only use paths that are configured at runtime. + * /data/local/tmp is guaranteed to exist, but is only usable by the + * 'shell' and 'root' users, so this fallback is for debugging only. */ + if (val) { + return tor_strdup(val); + } else { + return tor_strdup("/data/local/tmp"); + } #else /* !defined(_WIN32) */ const char *d = val; if (!d) @@ -6962,6 +6993,17 @@ options->CacheDirectory = tor_strdup(options->DataDirectory); } + tor_free(options->FamilyKeyDirectory); + if (options->FamilyKeyDirectory_option) { + options->FamilyKeyDirectory = + get_data_directory(options->FamilyKeyDirectory_option); + if (!options->FamilyKeyDirectory) + return -1; + } else { + /* Default to the key directory. */ + options->FamilyKeyDirectory = tor_strdup(options->KeyDirectory); + } + return 0; } diff -Nru tor-0.4.8.16/src/app/config/fallback_dirs.inc tor-0.4.9.6/src/app/config/fallback_dirs.inc --- tor-0.4.8.16/src/app/config/fallback_dirs.inc 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/src/app/config/fallback_dirs.inc 2026-03-25 14:30:34.000000000 +0000 @@ -3,1104 +3,1108 @@ /* timestamp=20210412000000 */ /* source=offer-list */ // -// Generated on: Thu, 20 Mar 2025 14:40:50 +0000 +// Generated on: Wed, 25 Mar 2026 14:14:46 +0000 -"154.53.164.216 orport=9090 id=C90A0A41CE492723902DC55B2512A608FE733F0E" -/* nickname=ren */ +"46.232.251.183 orport=9001 id=66EEF68A3307E63D59CE34969A710F1FA697DE83" +" ipv6=[2a03:4000:2b:41f:0:1d:0:fe]:9001" +/* nickname=theonlyone */ /* extrainfo=0 */ /* ===== */ , -"185.225.18.102 orport=9001 id=2FA6A81D52476C4D64ED5F385CBF5FBE4937F4CB" -/* nickname=gralrush */ +"109.70.100.245 orport=443 id=9E03B94B16FF39EA2019CE7BF5C6C8BBF84CD675" +" ipv6=[2a03:e600:100:c3::10]:443" +/* nickname=lamarr */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.95 orport=9100 id=80F322ED0995F27CD26B5A9DE7B804F92E8ACA94" -" ipv6=[2a12:a800:2:1:45:141:215:95]:9100" -/* nickname=Quetzalcoatl */ -/* extrainfo=0 */ -/* ===== */ -, -"68.71.25.194 orport=9007 id=9A3776C96E94D7EEBE2A3FA4CA4EA4E6DC0DC4AF" -/* nickname=FuckWater */ +"64.65.1.64 orport=443 id=55B3EAD57AF13B6306ACF59ECCDC5E6E24EF575A" +/* nickname=wifisfuneral */ /* extrainfo=0 */ /* ===== */ , -"2.58.56.220 orport=8430 id=7F35906CE8E33C7FB60E9EA12101AB4CBE13403C" -" ipv6=[2a12:a800:1:1:2:58:56:220]:8430" -/* nickname=Quetzalcoatl */ +"141.95.86.17 orport=9001 id=C94D0985BD317B514DDBED8ECD5EC99FB60DD1F6" +" ipv6=[2001:41d0:701:1100::5a30]:9001" +/* nickname=DemonsysEU */ /* extrainfo=0 */ /* ===== */ , -"158.69.204.36 orport=80 id=C7A46C866B963FC0F5C0E9DCE375C869D40F23E4" -/* nickname=stars2 */ +"64.65.1.67 orport=443 id=4A167C3AA47077BA679DDFA3167CF98464CEAFE5" +/* nickname=ralofamerica */ /* extrainfo=0 */ /* ===== */ , -"46.229.55.118 orport=9001 id=FE857C3043412FD5454ED5FEF55C4C572E5B70CF" -/* nickname=volodymir */ +"192.121.108.118 orport=9001 id=A02AB2C40AB744F451CCCE38781D8E05676CC15E" +" ipv6=[2a09:be40:28fb:1337::f00d]:9001" +/* nickname=Relay06MaskAD */ /* extrainfo=0 */ /* ===== */ , -"135.148.100.233 orport=443 id=EFC68FF70A36CF8DE5E8437F2DCCFADF7A94A421" -" ipv6=[2604:2dc0:100:38e9::1]:443" -/* nickname=null */ +"62.66.145.248 orport=9001 id=32D6F1E338860568A1E3CA1CFD4D84EC7485EC34" +/* nickname=LilleVemmelund */ /* extrainfo=0 */ /* ===== */ , -"204.8.96.158 orport=443 id=90BF7147B422A1BABEFA503656EBD17987424441" -" ipv6=[2620:7:6001::158]:80" -/* nickname=Quintex69 */ +"194.147.140.102 orport=995 id=2C6D0929C0D00B3461670AF874B5418164A7D1F2" +" ipv6=[2001:67c:440:f887:194:147:140:102]:995" +/* nickname=tor102 */ /* extrainfo=0 */ /* ===== */ , -"82.149.227.126 orport=443 id=CF6A6080091BB210AA3892FEFE2F6A396DA08DF3" -" ipv6=[2a01:440:108:11:82:149:227:126]:443" -/* nickname=cryzrelay01 */ +"45.84.107.84 orport=443 id=9CB75E6343DDB8E38F78A20E9525604F05988FA2" +/* nickname=MicrosoftSucks */ /* extrainfo=0 */ /* ===== */ , -"192.42.116.189 orport=9003 id=F7B94B1A67B563459C6A7C6AD7D5B8031E127B26" -" ipv6=[2001:67c:6ec:203:192:42:116:189]:9003" -/* nickname=NTH37R4 */ +"5.255.127.222 orport=9001 id=4B61EC04E1797D8688475BD24EDA450914497D84" +/* nickname=Dopamine */ /* extrainfo=0 */ /* ===== */ , -"51.210.179.144 orport=9000 id=698EB2D58F67A26E4EEB93B302DBB67E46B6AA34" -/* nickname=prsv */ +"45.80.158.93 orport=143 id=F260B54AD13D7A9AAA72E67DD583F30037EF7FFA" +" ipv6=[2a12:a800:2:1:45:80:158:93]:143" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"45.145.166.175 orport=9000 id=AF90C647D5AE15BD1D8ED81845D49E2F4F181884" -" ipv6=[2a04:ecc0:8:a8:4567:fd2e:0:1]:9000" -/* nickname=prsv */ +"45.138.16.107 orport=9100 id=D88B5B35EF4D5EF11F5B670C364F812D0349B8DB" +" ipv6=[2a12:a800:2:1:45:138:16:107]:9100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"137.226.34.45 orport=9005 id=27E1B97D9491013EF48479D4F47002F3358E0D92" -" ipv6=[2a00:8a60:e012:a00::9001]:9005" -/* nickname=FTPhalifaxRWTH */ +"45.95.169.43 orport=9001 id=213038B323FF8737A55C9DA15FEA1C9BBC4785D3" +/* nickname=Challanger */ /* extrainfo=0 */ /* ===== */ , -"88.151.194.118 orport=443 id=7B842FB48CFF19898C8336A11CAA3F425C90F9B5" -/* nickname=BiggerBetter */ +"66.42.113.136 orport=443 id=D1D586F7356CD497AA7344A1A04F16B62B97E3C5" +/* nickname=marleybone3a */ /* extrainfo=0 */ /* ===== */ , -"94.23.172.32 orport=444 id=799ECF332DECA02C49DE21FF022F7E2DBECDA771" -/* nickname=Waeswynn */ +"171.25.193.131 orport=443 id=8F1C04C57F554DBCA7E02F6BC200AA474DC833AE" +" ipv6=[2001:67c:289c:4::132]:443" +/* nickname=DFRI126 */ /* extrainfo=0 */ /* ===== */ , -"217.160.247.34 orport=9001 id=11AC67307B362B77569AF314A9A7A06B9195DF19" -" ipv6=[2a01:239:2b6:b400::1]:9001" -/* nickname=jhsthirdtorrelay */ +"23.129.64.176 orport=443 id=E234C5568893454711240DAD886FE315EF275DDB" +" ipv6=[2620:18c:0:192::e0:176]:443" +/* nickname=dimensiondoor */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.96 orport=993 id=C688B3EF9AB0354EB2794174519BB9ED9E6467E7" -" ipv6=[2a0b:f4c2:4::96]:993" -/* nickname=Digitalcourage4ipab */ +"62.72.47.105 orport=8100 id=9DA3641B237AF84095C3D057F472106F1E32CCB0" +" ipv6=[2407:3640:2259:6302::1]:8100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"37.48.90.84 orport=9001 id=C1F9375437CAA5C5BF1AA4C8E78107BF61883FD5" -/* nickname=ThePlace */ +"185.232.68.247 orport=443 id=F31A8ECBF669CC4E6B1C14866EBD25C13A70F296" +" ipv6=[2a03:4000:4e:f3:689c:c6ff:fe24:89b4]:443" +/* nickname=CryptoCactus */ /* extrainfo=0 */ /* ===== */ , -"194.147.140.106 orport=993 id=6259DA604D98D6FE14AB557BB6479BA75FC43558" -" ipv6=[2001:67c:440:f887:194:147:140:106]:993" -/* nickname=tor106 */ +"82.160.220.21 orport=9001 id=A262706ED4F731025FAFBF56636C224EEF51B127" +/* nickname=speedtest10ge */ /* extrainfo=0 */ /* ===== */ , -"185.40.4.101 orport=444 id=E6B550BFD6A35725EFADA0DFD07511532FC18AE8" -" ipv6=[2a0e:4005:1002:ffff:185:40:4:101]:444" +"95.214.53.96 orport=8447 id=FD4831DD801161346FACD52452633088EA356271" +" ipv6=[2a03:cfc0:8000:7::5fd6:3560]:8447" /* nickname=bauruine */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.114 orport=8100 id=74F49CD5F9E94EDBF1F8D8705B4C64E88C1CC344" -" ipv6=[2a12:a800:2:1:45:141:215:114]:8100" -/* nickname=Quetzalcoatl */ +"45.76.61.27 orport=9001 id=CA3A394AAF64EE2E91296348BBBC66DCCEAA5FA5" +/* nickname=ugh */ /* extrainfo=0 */ /* ===== */ , -"172.105.6.34 orport=9001 id=D7F59CFB13A93E4C0BF867374B66547E226A7255" -" ipv6=[2600:3c04::f03c:93ff:fece:e1d1]:9050" -/* nickname=AndroidFighter */ +"51.195.119.154 orport=9300 id=959779FD7167FD412B3B098457B04433F572AAEB" +" ipv6=[2001:41d0:701:1100::3231]:9300" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"5.199.162.155 orport=9001 id=6997013CB77B6F530540332626C23ACFE52C5096" -/* nickname=QuakeSARGE */ +"94.23.121.150 orport=8080 id=4D0F2ADB9CD55C3EBD14823D54B6541B99A51C19" +/* nickname=Unnamed */ /* extrainfo=0 */ /* ===== */ , -"103.251.167.20 orport=9001 id=30626238638AE65194814663A4651AFC04BC8D60" -" ipv6=[2a01:6340:2:501::20]:9001" -/* nickname=mentoreth */ +"124.198.131.173 orport=143 id=B6AF9746C05714E5B90063F44DC2C7FF5F96E051" +" ipv6=[2a12:a800:11:1:124:198:131:173]:143" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"185.241.208.204 orport=9200 id=2308F5B08A85F8600DEC23F9C127E1F16E988595" -" ipv6=[2a12:a800:2:1:185:241:208:204]:9200" -/* nickname=Aramis */ +"23.129.64.215 orport=443 id=3809938D5786CD2886C856578316AE3FF62FCCBD" +" ipv6=[2620:18c:0:192::e0:215]:443" +/* nickname=eo215 */ /* extrainfo=0 */ /* ===== */ , -"212.132.108.187 orport=443 id=D2A2E8F9CF83FBFF86C29612902F644AE9CB62DC" -/* nickname=tstarlit144 */ +"87.98.237.152 orport=9001 id=DFCE8C606B821A59D0E0E11AEF8C30FD22BBCC2B" +/* nickname=Unnamed */ /* extrainfo=0 */ /* ===== */ , -"80.64.181.152 orport=1025 id=61C52DFC090FD1B1AA0C1F431DC535249C311EB9" -" ipv6=[2a02:238:f04b:4125::]:1025" -/* nickname=Datenschredder */ +"104.244.79.44 orport=9100 id=CCCFD8D5FD21AC796234D914F1B7CC33ADCE52F8" +" ipv6=[2605:6400:30:f38b:28b3:cd24:51f3:e412]:9100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"157.90.112.145 orport=9001 id=4E8BF739B5E7835776EDD72CF9CAA402ACE00055" -" ipv6=[2a01:4f8:c2c:e8a0::1]:9001" -/* nickname=COtto */ +"83.228.205.178 orport=8888 id=26C55AC78E6B2C3BB9DF304DBDD8A1E1D7D5F4DF" +" ipv6=[2001:1600:13:101::c39]:8888" +/* nickname=CyberDiplomacy */ /* extrainfo=0 */ /* ===== */ , -"185.82.126.13 orport=443 id=60553CA7FB840C5CDA60950E33C71585DF774258" -/* nickname=se4andersio */ +"194.26.192.186 orport=9200 id=1C62E9E7977A0C9B6F5D14FFCAF5515C95204C8D" +" ipv6=[2a12:a800:1:1:194:26:192:186]:9200" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.61 orport=7100 id=460D13CE3971BD2138760A892FBCF0F464C26F63" -" ipv6=[2a12:a800:2:1:45:141:215:61]:7100" -/* nickname=Quetzalcoatl */ +"46.20.33.223 orport=9100 id=B1AAE82FBCB8ECB429A6149626D3BB6410364EA1" +/* nickname=0uijabroad */ /* extrainfo=0 */ /* ===== */ , -"172.219.92.78 orport=9905 id=C0100C150EA96E1CBBBFB3B770EFCD50C5F55F8F" -/* nickname=hereyago */ +"46.4.74.237 orport=8080 id=4CF204F66452C89712B9CF513A213C1F03D8F706" +" ipv6=[2a01:4f8:140:522c::2]:8080" +/* nickname=Indigold */ /* extrainfo=0 */ /* ===== */ , -"184.174.38.53 orport=9001 id=A508096AA0C899F4E6ECD1D9C35037B89008BCBA" -" ipv6=[2a02:c206:3010:8083::1]:9001" -/* nickname=SafeAndEffective */ +"64.65.62.48 orport=443 id=EC488394FDF79BF2E846DA5D4148FC18163BB29B" +/* nickname=lildarkie */ /* extrainfo=0 */ /* ===== */ , -"37.59.29.77 orport=9111 id=371C00BF5F71AC45FBD5FE74504A6D2408BAD5E0" -/* nickname=Unnamed */ +"102.130.127.117 orport=443 id=26B466A5152B058DB26878731AE453D22A8F4B21" +/* nickname=alpha191 */ /* extrainfo=0 */ /* ===== */ , -"23.88.44.26 orport=6969 id=D22F93E2675F17BFF6D232F479B59E788FEAF903" -" ipv6=[2a01:4f8:c17:49c0::1]:6969" -/* nickname=sig9gianni */ +"192.42.116.45 orport=443 id=0DE135A4D0ECCB5D57F8B71BF8E22958FC4146A7" +" ipv6=[2001:67c:e60:c0c:192:42:116:45]:443" +/* nickname=NTH45R1 */ /* extrainfo=0 */ /* ===== */ , -"144.217.32.158 orport=9002 id=CB248D83FA220EE9DC0990A39C31A77F740874A0" -/* nickname=roomformushroom */ +"38.190.150.6 orport=9004 id=00E1290EBA8EE2D60119754DBD9AD1067B2A7712" +/* nickname=xkoloke */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.73 orport=9000 id=2070E51315036FEB76FC2E0B03A320724234A9A4" -" ipv6=[2a0b:f4c2:3::73]:9000" -/* nickname=CCCStuttgartBer */ +"185.243.218.138 orport=443 id=EC99A6385A22B6A9552AB10DCFC37F1682BCB321" +" ipv6=[2a03:94e0:ffff:185:243:218:0:138]:443" +/* nickname=lukast */ /* extrainfo=0 */ /* ===== */ , -"131.188.40.188 orport=11180 id=EBE718E1A49EE229071702964F8DB1F318075FF8" -" ipv6=[2001:638:a000:4140::ffff:188]:11180" -/* nickname=fluxe4 */ +"185.227.70.134 orport=443 id=1F348BF999D4F7BE263270F5A24F69FCCEC1399C" +" ipv6=[2a12:bec0:20b:6b35::1]:443" +/* nickname=fluffypancakes006nl */ /* extrainfo=0 */ /* ===== */ , -"64.52.108.69 orport=443 id=64CB2B32C10ADD4B93D725B7DED238CCCD6D6DBA" -" ipv6=[2602:fc81:1:1::9:a600]:443" -/* nickname=permanentrecord */ +"45.80.158.142 orport=110 id=2EF3F194E34705F9E13021BAC7B394653329243A" +" ipv6=[2a12:a800:2:1:45:80:158:142]:110" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"46.38.254.168 orport=40000 id=E1E32C01926FAF7E046DF112A0385196A5125EC0" -/* nickname=Unnamed */ +"205.206.0.92 orport=9109 id=F86698F2977D6A1216215C2CCE540BC84A8508DC" +/* nickname=edmCentral0 */ /* extrainfo=0 */ /* ===== */ , -"209.233.88.131 orport=9001 id=0C8D8FF15A3B58AE4A019105C50130DD1CF8F1BF" -/* nickname=Unnamed */ +"45.80.158.249 orport=8430 id=D138382EBA7B84EF8BBC669B0A961AF758AC8FA8" +" ipv6=[2a12:a800:2:1:45:80:158:249]:8430" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"152.53.111.174 orport=9088 id=CA037B9E5174A5DCF1B3E4DB06B22E8DA76A1FE0" -/* nickname=PiratenparteiNERD */ +"194.26.192.46 orport=9100 id=EDC46D5E697DBE2C8F2F7C8D8B26EC2FCB3F2F33" +" ipv6=[2a12:a800:1:1:194:26:192:46]:9100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"95.143.193.125 orport=443 id=01181B31BE5860C7D66DA88F88AD522C06470FD9" -/* nickname=motauri */ +"199.241.137.60 orport=9001 id=8D8DAD240CECFE9B48DC5F2C6EA20D042D5B8733" +" ipv6=[2602:ff16:6:0:1:297:0:1]:9001" +/* nickname=ac1dburn */ /* extrainfo=0 */ /* ===== */ , -"159.69.138.31 orport=9001 id=1C0736CF3744A3B87C2D2269B8BD3388C7E60552" -" ipv6=[2a01:4f8:231:1ed8:106::106]:9001" -/* nickname=FreedomFries2 */ +"94.100.6.11 orport=443 id=03E107A3663E912664F4A934DFF451262C218357" +/* nickname=Wildtwister */ /* extrainfo=0 */ /* ===== */ , -"157.245.243.70 orport=80 id=959C5AE1A34683F60C2DF7F4F48FEA24406E31E8" -/* nickname=HelpingOut */ +"62.210.181.63 orport=18256 id=6DF9B54DF49AEB5992B9AF8D4ECFA7BCC7447A8B" +" ipv6=[2001:bc8:32d7:2006::]:18256" +/* nickname=Belize */ /* extrainfo=0 */ /* ===== */ , -"45.138.16.113 orport=9000 id=DFA97DED4CE79FF6F31DAF917C2810CCE8729E9D" -" ipv6=[2a12:a800:2:1:45:138:16:113]:9000" -/* nickname=Quetzalcoatl */ +"74.208.11.136 orport=6733 id=8A67C5D1B659355698ADE012AF2C7B0EB3B3F1A9" +/* nickname=NotTheNSA */ /* extrainfo=0 */ /* ===== */ , -"62.182.84.241 orport=9001 id=2062C6FE40ED6329F02EAC8FB8DE3B682F9910EC" -/* nickname=EpicTor4 */ +"195.176.3.23 orport=443 id=BCF55F865EE6EF17E25EFEAF851BC429F190B85D" +" ipv6=[2001:620:20d0::23]:443" +/* nickname=DigiGesTor5e1 */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.19 orport=143 id=0863252662246FFF6914F380711C75DC4027BD75" -" ipv6=[2a12:a800:2:1:45:141:215:19]:143" +"45.9.156.101 orport=8100 id=E492BA484812A7FED594F2852473876779617E16" +" ipv6=[2a0e:bfc7:0:3::2d83]:8100" /* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"51.75.70.246 orport=443 id=8646226690C1D4F2DDC3021F89909A26A8C32A27" -/* nickname=anonkaisx */ +"45.80.171.18 orport=9001 id=DA71126E1D0B11605533B7AD399DD5A7EC8E2F0E" +" ipv6=[2a10:3781:1f::5]:9001" +/* nickname=blackstar */ /* extrainfo=0 */ /* ===== */ , -"45.138.16.76 orport=110 id=A07B7614425A9716BB135CC502210209923659F8" -" ipv6=[2a12:a800:2:1:45:138:16:76]:110" -/* nickname=Quetzalcoatl */ +"45.138.16.230 orport=9700 id=662C083862D68475A41777EC9D9163E51FE90110" +" ipv6=[2a12:a800:2:1:45:138:16:230]:9700" +/* nickname=Aramis */ /* extrainfo=0 */ /* ===== */ , -"202.61.204.53 orport=443 id=B8B338E861F9B201A35DEB180C68053FA56C2DBE" -" ipv6=[2a03:4000:5b:e1::8]:443" -/* nickname=mullbinde8 */ +"208.72.67.116 orport=9063 id=19F03506712EBF7F1E791C11C4CA13877F9AB84B" +/* nickname=GlobalEntry */ /* extrainfo=0 */ /* ===== */ , -"114.23.164.80 orport=9001 id=CB81BCFD44FC142616BB5983648BD8AF01930789" -/* nickname=ss23voyager */ +"64.65.1.103 orport=443 id=6562CB938FE7B45629B8AEE4C8478D02A27D4492" +/* nickname=youngdolph */ /* extrainfo=0 */ /* ===== */ , -"194.147.140.107 orport=443 id=D3433B2F0860FEFBEC1677E67F8110F5655A4E86" -" ipv6=[2001:67c:440:f887:194:147:140:107]:443" -/* nickname=tor107 */ +"135.181.67.210 orport=443 id=DC7E7D9AB7AD52F03B856E6DC278E9D92BF19B33" +" ipv6=[2a01:4f9:4b:4e97::6666]:443" +/* nickname=s6tor2 */ /* extrainfo=0 */ /* ===== */ , -"140.78.100.14 orport=5443 id=C1CA4E603F152E8C86E864F4FBF1162A3BFDF587" -/* nickname=INSRelay14at5443 */ +"96.9.98.188 orport=443 id=E68789BC34CFC5B932E827C463E104ECFB9FA060" +/* nickname=liltjay */ /* extrainfo=0 */ /* ===== */ , -"95.23.252.197 orport=9001 id=16530D8CCD6A7C2C13564A573E9B23CE1A4AD24F" -/* nickname=mypirelay */ +"185.73.240.205 orport=443 id=A60AFA6FFB2EEB8E4A4C531FBA6A78AF586AACB7" +/* nickname=adlon */ /* extrainfo=0 */ /* ===== */ , -"88.80.26.2 orport=9001 id=A041465163D91E5F11B230F089784EB6CEF653CB" -" ipv6=[2a00:16b0:1:243::7012:3117]:9001" -/* nickname=PRQseTORexit2 */ +"181.215.45.194 orport=9001 id=426E5509BEA3CEB670EAB6789872B729C178A7BE" +" ipv6=[2a0e:b107:1ef0:0:181:215:45:194]:9001" +/* nickname=relaytorparacba */ /* extrainfo=0 */ /* ===== */ , -"118.27.12.40 orport=9001 id=2A0AC8016D9A0297BE4CCA1C575DFCEC9866E681" -" ipv6=[2400:8500:1801:406:118:27:12:40]:9001" -/* nickname=SaruTorHebi */ +"84.167.246.41 orport=9002 id=BCB8813996025205A8BDDED17DF0372367207205" +/* nickname=crmh */ /* extrainfo=0 */ /* ===== */ , -"151.189.64.113 orport=9001 id=A29D2A78A8A954819E220CEFBEBCE95D2FCFA54D" -/* nickname=RoteServerPaul */ +"194.26.192.186 orport=9300 id=53A6473ACE36671C79AB985D3237C179E850FA62" +" ipv6=[2a12:a800:1:1:194:26:192:186]:9300" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"23.92.34.43 orport=443 id=0E947CA987F0D5890E2374556483D59148877C30" -/* nickname=JimmyHardingMi10046 */ +"185.82.127.213 orport=443 id=24E9CFAE081B16E87B490C596C18B00EE6FF8413" +/* nickname=se3andersio */ /* extrainfo=0 */ /* ===== */ , -"94.23.76.52 orport=443 id=DB1629B59707F744A0C7933E56B6802786FFC317" -/* nickname=deimos */ +"5.254.118.191 orport=9001 id=A7AA32CA10E1BEDA1E976A659FD96CA99C2D86FE" +/* nickname=Dominos */ /* extrainfo=0 */ /* ===== */ , -"95.141.83.155 orport=443 id=F148A022E5E2BAD006E29C82C8D47C047A29958F" -" ipv6=[2a02:f58:4:300:216:3eff:fec2:a1f9]:443" -/* nickname=Unnamed */ +"192.42.116.65 orport=443 id=0055DB090820D7C08999EC1598FD6EA6365861AD" +" ipv6=[2001:67c:e60:c0c:192:42:116:65]:443" +/* nickname=NTH65R1 */ /* extrainfo=0 */ /* ===== */ , -"142.44.227.24 orport=9191 id=310229E3B5C106CE63F98C24F91F56370647BBB0" -/* nickname=iamphoenix */ +"185.233.100.23 orport=19001 id=4A39E7D2C121F664CFD9B5DF80CE9E70BB8B3C16" +" ipv6=[2a0c:e300:b:b::b]:19001" +/* nickname=elenagb4 */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.39 orport=10039 id=7ABED1F6664D1153F1402838D3B32AF6F2CABE17" -" ipv6=[2a0b:f4c2:2::39]:10039" -/* nickname=ForPrivacyNET */ +"45.80.158.167 orport=7100 id=09257AB36470E686491710153FF9412ACC53F2A0" +" ipv6=[2a12:a800:2:1:45:80:158:167]:7100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"23.19.225.69 orport=443 id=06BC159DAA7EB0DB626B2E1B6EFA1E9F0907CD8B" -/* nickname=Unnamed */ +"45.80.158.93 orport=8430 id=F5A47B1E8397139628FA424C1C7A560232E35EB4" +" ipv6=[2a12:a800:2:1:45:80:158:93]:8430" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"37.48.120.47 orport=110 id=4D9AF7BB47633B2B7B72D529562BFDA47A5821C9" -/* nickname=Taco */ +"212.47.233.86 orport=9001 id=B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20" +" ipv6=[2001:bc8:710:5bcb:dc00:ff:fe5e:e8b5]:9001" +/* nickname=netimanmu */ /* extrainfo=0 */ /* ===== */ , -"68.71.25.194 orport=9011 id=413E3AE5AB2371689AE5F4E1A32029037ACDFD22" -/* nickname=GunOil */ +"23.191.200.7 orport=443 id=5BC542BEC38E8D373D21C6A79CC9348DC28BD62C" +/* nickname=UnredactedRadack */ /* extrainfo=0 */ /* ===== */ , -"185.107.57.66 orport=443 id=90C9567666C9E4B1C0CB7E50968AC2752AA6D088" -/* nickname=wix */ +"23.108.55.71 orport=443 id=DF885E50651903A212EE519BE5A58397AD2E0975" +/* nickname=hamburger */ /* extrainfo=0 */ /* ===== */ , -"116.203.135.195 orport=9001 id=DA3FD24EDEA501C7133307CA73E991AC5B1D76BF" -" ipv6=[2a01:4f8:1c1e:68bd::1]:9001" -/* nickname=Eigentor */ +"86.54.28.49 orport=443 id=98CDDAF76419C5DBCBCF512D87E3F99BA5F22770" +/* nickname=OMICRON */ /* extrainfo=0 */ /* ===== */ , -"89.58.34.53 orport=9001 id=01B8F18C11CE2877E8190FA2C81808CD087515C0" -" ipv6=[2a03:4000:64:fe8:c853:14ff:fe86:7a3d]:9001" -/* nickname=root1Moh */ +"62.210.122.182 orport=9201 id=B91A1EB30E66D52026EFCD1E96BFC0E966C83E6D" +" ipv6=[2001:bc8:32d7:10b::f1fa:9201]:9201" +/* nickname=Assange008fr2 */ /* extrainfo=0 */ /* ===== */ , -"148.251.151.125 orport=9001 id=97E4BAB582717350E6FF6160899FA9B665C834E3" -" ipv6=[2a01:4f8:210:504b::3]:9001" -/* nickname=LSTorRelay01 */ +"74.140.253.100 orport=9001 id=F84C674E4932768107D6460318CC0F73EF8CF493" +/* nickname=DisrodRelay */ /* extrainfo=0 */ /* ===== */ , -"79.141.165.172 orport=9001 id=D6EDD332AC04B1D1E8FEFB3F32F4C050CDB3A95B" -/* nickname=DELIGHT */ +"194.180.191.93 orport=9001 id=677347441FDD2AEA22BD364A7174D277E929B255" +/* nickname=abnormalbonus */ /* extrainfo=0 */ /* ===== */ , -"65.109.30.253 orport=28713 id=AEF02E45E067CC18559ED5E851859E3AAB7AAA84" -/* nickname=NowhereDOTmoe */ +"64.65.2.12 orport=443 id=8D55E78059CB694ABD69DEED64D444862B79D8E1" +/* nickname=hitboy */ /* extrainfo=0 */ /* ===== */ , -"139.99.134.168 orport=443 id=0F53B4B16768A8A18B838103DD500068C4D656EB" -/* nickname=whynot1 */ +"64.65.1.20 orport=443 id=A69AAF75702AB9041A3EDA1918F930377E13F39D" +/* nickname=statquo */ /* extrainfo=0 */ /* ===== */ , -"192.121.108.237 orport=9001 id=A9C6FEA058C3E53ECDA61E8FDAD0F940718DE8CE" -/* nickname=HjelmEnterprises02 */ +"218.236.76.26 orport=9002 id=0A30E1467618B1AC167D012C9718C57B4E5F68F3" +/* nickname=Unnamed */ /* extrainfo=0 */ /* ===== */ , -"150.230.20.28 orport=9001 id=054AF5AE5DA4AA0B81D7155542AF204252CB6D61" -" ipv6=[2603:c022:c002:b0e:f620:461d:1cc1:fa75]:9001" -/* nickname=Plusle */ +"96.9.98.27 orport=443 id=C6426F3974070BEBB6F4E019EBC96F4A2A3C8DB7" +/* nickname=yungpinch */ /* extrainfo=0 */ /* ===== */ , -"82.197.160.67 orport=9001 id=B8F9E02E70A2A32E6EF1C04FC9F9A7B87435E50A" -/* nickname=haustre1 */ +"176.65.148.3 orport=443 id=7FF8F83DD10D3E685B6846D5C32593C1B62A9945" +" ipv6=[2a05:b0c7:655b::1]:443" +/* nickname=nix */ /* extrainfo=0 */ /* ===== */ , -"152.70.140.84 orport=9001 id=02B4B5B92EE60D5317A0DB301175737AB8F1718A" -/* nickname=Shado */ +"207.90.194.2 orport=443 id=A39D10B59C0614DFFE296DC2C55F7C4C8557D485" +" ipv6=[2602:ffd5:1:29c::1]:443" +/* nickname=fluffypancakes002ca */ /* extrainfo=0 */ /* ===== */ , -"213.165.86.67 orport=14960 id=CAD9DF79A3B4C0A23BBEECE5E546D7FD2016459E" -" ipv6=[2a01:239:331:7200::1]:14960" -/* nickname=theshowmustgoon */ +"185.220.101.203 orport=443 id=B7E9849D446FC57D4BDED937B8E17F3AACE1FA06" +" ipv6=[2a0b:f4c2:2:1::203]:443" +/* nickname=ForPrivacyNET */ /* extrainfo=0 */ /* ===== */ , -"185.119.117.229 orport=443 id=629301C063FC047171C8A0F1520A9D7CF60308EC" -" ipv6=[2a00:63c1:13:229:fa53:5051:8c88:ff1e]:443" -/* nickname=ekanu */ +"64.65.2.35 orport=443 id=8E663773B6489347EE34C6D3FFCFD9D6FC80A2DE" +/* nickname=timbaland */ /* extrainfo=0 */ /* ===== */ , -"45.134.91.219 orport=9001 id=8C88990D44239803692CFAA68DDC74FEB5E6E9C7" -" ipv6=[2a0c:9a40:2805:1::198f]:9001" -/* nickname=droidtakeover */ +"64.65.62.20 orport=443 id=A92C33AE18D64EEC719FAF3038FD8F52462BA3FD" +/* nickname=hdbearfaced */ /* extrainfo=0 */ /* ===== */ , -"45.11.59.28 orport=443 id=2FF8FFB28EAA635E291D623E03F231AC265F28F9" -/* nickname=AnneMarie */ +"74.123.98.18 orport=443 id=A2C85DB6C3D64D7178D24848FD8A0E59347F2E6D" +/* nickname=tournament */ /* extrainfo=0 */ /* ===== */ , -"192.121.44.26 orport=9001 id=5975858B6A1F37CCC96026B946EACF08E1772D0E" -/* nickname=Playstar01 */ +"77.68.20.86 orport=443 id=07C17931AE2E17F95681FA2A91C7F7CDB068BF48" +" ipv6=[2a00:da00:f412:c100::1]:443" +/* nickname=SidNYGiants */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.200 orport=8443 id=674F66D7D8C6F0DF9997B3C9423AA153C988FE77" -" ipv6=[2a0b:f4c2:2:1::200]:8443" -/* nickname=ForPrivacyNET */ +"15.204.103.3 orport=9030 id=4D4748577DC4F963A9BACF51E1D49B86F12CE23E" +" ipv6=[2604:2dc0:200:2903::]:9030" +/* nickname=Solsticist */ /* extrainfo=0 */ /* ===== */ , -"66.78.40.183 orport=9300 id=0E1AA3CDB938089905F4DD651F6810C7EBAD283F" -/* nickname=mursec */ +"51.15.243.22 orport=443 id=1C7D71A2581DE79C5CFC4ED1FF75D5BE30F01BB7" +/* nickname=BabyOnion */ /* extrainfo=0 */ /* ===== */ , -"188.165.222.73 orport=443 id=AEF6C1FBA0FC16F4931638BF065085B974D3E90F" -/* nickname=MidwayStation */ +"171.25.193.234 orport=80 id=CF1C1804C33CD69D8A75587FABC63D5D0E2980FA" +" ipv6=[2001:67c:289c:2::234]:80" +/* nickname=DFRI10 */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.206 orport=8443 id=ADF0D51946DA3294C1F242B0ACADC91FF5F058EF" -" ipv6=[2a0b:f4c2:2:1::206]:8443" -/* nickname=ForPrivacyNET */ +"188.214.132.18 orport=9001 id=EA9E042A05E851076A657639CD0C84D8DA86A76F" +/* nickname=blockaide */ /* extrainfo=0 */ /* ===== */ , -"128.31.0.13 orport=443 id=A53C46F5B157DD83366D45A8E99A244934A14C46" -/* nickname=csailmitexit */ +"185.153.182.11 orport=9001 id=BEBE82BEAB014983F55DD4CA94CE33E3751B1FDA" +/* nickname=Assange044tr */ /* extrainfo=0 */ /* ===== */ , -"140.238.145.127 orport=9001 id=9F7A69E381CA06322EB44F81DE7928BF7BDD60C0" -/* nickname=tendies1 */ +"178.236.254.48 orport=9000 id=121212BF2F3ED5FA26B65CB376394F4EA322FEBE" +" ipv6=[2a0b:4141:820:138::2]:9000" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.138 orport=11138 id=3158BE2413AC6A8F0BC3EC343BB056F6D24F2E53" -" ipv6=[2a0b:f4c2:1::138]:11138" -/* nickname=relayon1138 */ +"86.14.169.71 orport=443 id=417AA3C8D226DDD79A8047D7F217B21D9C63C21F" +" ipv6=[2001:470:681e::dead:c0de]:443" +/* nickname=sudokill */ /* extrainfo=0 */ /* ===== */ , -"185.207.125.14 orport=443 id=58D4282355F0149BD9D8230AAF803CE3EA4C00CA" -" ipv6=[2a0d:8144:0:120::]:443" -/* nickname=AntonPann4 */ +"89.58.17.228 orport=46856 id=593A4431DA2E315883406AECE1D1188E02F23D8F" +" ipv6=[2a0a:4cc0:0:f0a:a45c:7aff:fe13:2781]:46856" +/* nickname=klarheit */ /* extrainfo=0 */ /* ===== */ , -"45.138.16.107 orport=9100 id=D88B5B35EF4D5EF11F5B670C364F812D0349B8DB" -" ipv6=[2a12:a800:2:1:45:138:16:107]:9100" -/* nickname=Quetzalcoatl */ +"196.200.160.95 orport=9001 id=483E50E35E3CFFA1B69F1AC6B452053AEB7C9581" +" ipv6=[2001:4310:f1::95]:9001" +/* nickname=toky0 */ /* extrainfo=0 */ /* ===== */ , -"198.50.223.16 orport=443 id=896364B7996F5DFBA0E15D1A2E06D0B98B555DD6" -" ipv6=[2607:5300:203:7ac5:198:50:223:16]:443" -/* nickname=blackmamba */ +"147.189.174.139 orport=9001 id=8F229BC977B322E10826E1605386799E5273ED73" +/* nickname=zgato */ /* extrainfo=0 */ /* ===== */ , -"213.144.135.21 orport=443 id=BB5FAE50BCE5B13C810CD17A931A0498E4681D41" -" ipv6=[2a02:168:6a16:1130::32:101]:443" -/* nickname=YoYuD1N01NoExit */ +"185.244.194.156 orport=4711 id=B13BF9FB86663B2D587611B5F3369873919AC54F" +" ipv6=[2a03:4000:27:71a:1853:7aff:feaf:449b]:4711" +/* nickname=makeitfoss */ /* extrainfo=0 */ /* ===== */ , -"195.90.217.102 orport=443 id=B3CA62427654C23F99DA9100D7B0916E6E0FE365" -/* nickname=FatalFurry */ +"205.185.113.180 orport=9001 id=80914004BD527CE984A1576CA63AAA77944D9D2B" +" ipv6=[2605:6400:20:482:3920:1829:1839:1293]:9001" +/* nickname=anonymityiscool */ /* extrainfo=0 */ /* ===== */ , -"65.109.67.182 orport=8080 id=C4AD03D01F7A6C29045B9F1034237B40D1384E66" -" ipv6=[2a01:4f9:5a:442b::4]:8080" -/* nickname=Enkidu4 */ +"140.78.100.37 orport=8443 id=CFB535715442BC0E9F6AF224A794BBFA02D0B343" +/* nickname=INSRelay37at8443 */ /* extrainfo=0 */ /* ===== */ , -"146.70.222.42 orport=443 id=EDDD1EE1E5EF2C35C70C8FED5A52EF46E08597AF" -/* nickname=Unnamed */ +"209.250.2.254 orport=443 id=205ED2C309999F0F18767A1ECCD384B580070BA9" +" ipv6=[2001:470:1f19:c2::9090:1]:9090" +/* nickname=RazorsEdge */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.88 orport=9000 id=1E3C197C8C922128FF049856E0536FF9CB4E5E8C" -" ipv6=[2a12:a800:2:1:45:141:215:88]:9000" +"45.9.156.193 orport=7430 id=7C9FC7C99D7F83980E621BA8D4E0D40FCE53104F" +" ipv6=[2a0e:bfc7::216:3cff:feae:41de]:7430" /* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"144.6.189.17 orport=9000 id=627D47EC57C18B4CF3E135B76177C73BE8F4B965" -" ipv6=[2403:5804:8b55:3:0:73:636f:6d6f]:9000" -/* nickname=SCOMO */ +"195.88.75.18 orport=9001 id=3F1B13B101DB4D043D0DA18272B8646D3132EE47" +/* nickname=rarelotus */ /* extrainfo=0 */ /* ===== */ , -"94.142.241.41 orport=443 id=8E84C81FA99A70AFD2751B761435D2A301CFFBAB" -/* nickname=NTH100R4 */ +"107.174.64.206 orport=9954 id=34C5ECB828A275A472F78CE0BBC0884E17E14B1D" +/* nickname=opencommunity */ /* extrainfo=0 */ /* ===== */ , -"185.182.193.16 orport=8443 id=DC0B2CF7EFBE640DF3D1615EB8FE50E82FB53B45" -/* nickname=serv01 */ +"64.65.1.72 orport=443 id=6FE1A22BAC0635BA510E2EFE1249D7AA4BECBE67" +/* nickname=xalisoflow */ /* extrainfo=0 */ /* ===== */ , -"209.182.200.18 orport=443 id=D80A169627F8819A8814A134A6CDA9B6E553CF42" -/* nickname=Unnamed */ +"104.167.241.4 orport=443 id=4625F385CA5364CDD63C791893973B0CAD49C4E0" +" ipv6=[2602:fccf:100:3::14]:9001" +/* nickname=HoustonTexas4Torcom */ /* extrainfo=0 */ /* ===== */ , -"209.141.45.81 orport=5060 id=1E89F4CDEE77841C380A4FBB82FB997219867424" -" ipv6=[2605:6400:20:c26:5163:253e:1ef6:d896]:5060" -/* nickname=hogman5 */ +"64.65.0.33 orport=443 id=7EA091DF4CE4256ED35DC113D4921867CBF03A0E" +/* nickname=megaran */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.81 orport=9000 id=42708A12892506EBCD881BCB3648E78D93DC2781" -" ipv6=[2a12:a800:2:1:45:141:215:81]:9000" +"45.141.215.200 orport=7430 id=4BDF25CD6E8482C0E835F6A70918540F4FC4CF22" +" ipv6=[2a12:a800:2:1:45:141:215:200]:7430" /* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.202 orport=8443 id=9A338F384C5FD3A3604E3250CCF5F5F7629D7717" -" ipv6=[2a0b:f4c2:2:1::202]:8443" -/* nickname=ForPrivacyNET */ +"96.9.98.58 orport=443 id=843E20D60EB7EF118FE8F4F4ACABD1AACE59E9B3" +/* nickname=smokepurpp */ /* extrainfo=0 */ /* ===== */ , -"94.23.88.117 orport=443 id=D870744F618F20F3A63592B4F9B0BB919FC1BED0" -/* nickname=Unnamed */ +"45.11.248.196 orport=9001 id=60DC7DDDCD659C47D4644EDF97E2ACC3C6B18EEB" +" ipv6=[2a00:6340:2043:5000::1]:9001" +/* nickname=surveyor */ /* extrainfo=0 */ /* ===== */ , -"193.182.111.133 orport=443 id=F30B55F9F9140A9D47CF6AC775E7A4CB1BD478E1" -" ipv6=[2a03:8600::a6]:443" -/* nickname=ParadiseTorRelay6 */ +"37.187.122.8 orport=9001 id=221E976B546E60048A01950250399B8534D4E4B7" +" ipv6=[2001:41d0:a:f308::1]:9001" +/* nickname=malechick */ /* extrainfo=0 */ /* ===== */ , -"80.67.167.81 orport=19008 id=16D3252B519861248FDEABE05A6F3B97BC510557" -" ipv6=[2a0e:e701:1198::1]:19008" -/* nickname=arecoque8 */ +"80.94.92.99 orport=9200 id=D1968B63E1105F5E71CC28026687F3C86A46C46E" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"45.80.158.205 orport=9000 id=E84F41FA1D1FA303FD7A99A35E50ACEF4269868C" -" ipv6=[2a12:a800:2:1:45:80:158:205]:9000" -/* nickname=Quetzalcoatl */ +"185.4.134.104 orport=9001 id=C6E3910CBADCA6D2D7E932AB31A038EDD6A6FB79" +" ipv6=[2a02:c500:2:110::8709:9001]:9001" +/* nickname=Assange023gr */ /* extrainfo=0 */ /* ===== */ , -"198.251.88.18 orport=8080 id=8A5ACFC8FDF21A3D836DB7ECEBA6538392F496E6" -" ipv6=[2605:6400:30:f174:42:42:42:42]:443" -/* nickname=Polyphemus16 */ +"164.215.103.126 orport=9001 id=2144EC311E714F30648F2B62546E2CA28FDBD36B" +/* nickname=caseyjones */ /* extrainfo=0 */ /* ===== */ , -"15.204.140.9 orport=8443 id=3FB88013FAC7AB8F479F33F5B484BE9F444330C3" -/* nickname=Parzival */ +"217.123.118.44 orport=9001 id=047DFF9DBA6A7DB666626F7F4560A1D7B1135F73" +/* nickname=VegetaSSJ */ /* extrainfo=0 */ /* ===== */ , -"84.252.120.63 orport=443 id=873914828C1161F02771F51AC7D97456317FC041" -" ipv6=[2a0c:2500:571:6bf:f10d:eb5:1b24:f5d1]:443" -/* nickname=SLAVAUKRAINI */ +"64.65.3.35 orport=443 id=5BCA9F58CA3C8C130998C8F853921DD56CEF0C2C" +/* nickname=youngma */ /* extrainfo=0 */ /* ===== */ , -"185.40.4.150 orport=8166 id=3287F79D9C1687BF7F3A9D140369CA64D2FD111B" -/* nickname=terNOicebeer17 */ +"38.29.158.193 orport=9001 id=269885C61FD6CFCC54BD86B88A82565956A42F55" +/* nickname=fr33domNod3 */ /* extrainfo=0 */ /* ===== */ , -"77.174.62.158 orport=9001 id=752AA93C16DC039D86F88C8CAC5AC43CA3A87DDD" -" ipv6=[2a02:a468:8d92:1:1e86:bff:fe20:2c8]:9001" -/* nickname=op2 */ +"198.28.165.248 orport=36325 id=A526EA0B6BB1C7B2B7163E834963FC1884A6914E" +/* nickname=vici */ /* extrainfo=0 */ /* ===== */ , -"37.120.171.64 orport=9002 id=47D55C9BD170C948961EF1B6C5D1AEB4CF8F7D06" -" ipv6=[2a03:4000:6:537c::4]:9002" -/* nickname=Unnamed */ +"185.194.143.87 orport=35897 id=54625FCF74D8311F3175349A1F879A0A298D5CA8" +" ipv6=[2a03:4000:1c:555::11e8]:43741" +/* nickname=TorNode05 */ /* extrainfo=0 */ /* ===== */ , -"158.101.203.38 orport=9001 id=145223A4F761DD9F0E14DCDF5120FED4F998FDC6" -" ipv6=[2603:c022:c002:b0e:df68:94b3:52b1:5f2c]:9001" -/* nickname=Minun */ +"23.141.40.7 orport=443 id=375DCBB2DBD94E5263BC0C015F0C9E756669617E" +" ipv6=[2620:b0:2000:102::7]:443" +/* nickname=nitrogen */ /* extrainfo=0 */ /* ===== */ , -"87.236.195.216 orport=1000 id=50161FF42B11B87C4CDD210CF9CB490A7B088DBB" -/* nickname=Perseverance */ +"152.53.252.155 orport=443 id=D19E920B886D664E21EB88AF7D955CA4FC570181" +" ipv6=[2a0a:4cc0:c0:bbbd:4660:c905:736b:bee8]:443" +/* nickname=jilfrg60 */ /* extrainfo=0 */ /* ===== */ , -"148.251.85.195 orport=9030 id=77A3ADC5D455778B53C2803761916DFB7DA0A790" -" ipv6=[2a01:4f8:202:6096::2]:9030" -/* nickname=redvader */ +"74.108.36.251 orport=9001 id=192B3306D8A064510CE6363D5AFFB563E789D246" +/* nickname=LittleIsland */ /* extrainfo=0 */ /* ===== */ , -"51.81.155.229 orport=8443 id=FD10A98858ED6B883D0C46157081C12C386C9167" -/* nickname=bludger2 */ +"5.45.99.251 orport=8080 id=75C0B7A2650BD317CE0FF4EE37DEA093AAD9019B" +" ipv6=[2a03:4000:5:b1:14bb:a9ff:fe0f:70c3]:8080" +/* nickname=northerndownpour */ /* extrainfo=0 */ /* ===== */ , -"95.214.53.96 orport=8446 id=C549A2169DAF079B61520C29E567589FE3F8E606" -" ipv6=[2a03:cfc0:8000:7::5fd6:3560]:8446" -/* nickname=bauruine */ +"5.180.82.224 orport=443 id=BA36742C1FBA693619E085899AC6970C5D3F2A53" +/* nickname=khajiitthief */ /* extrainfo=0 */ /* ===== */ , -"140.78.100.39 orport=5443 id=B97715C8A1EE72679C74480F301B11AC015B4C54" -/* nickname=INSRelay39at5443 */ +"91.92.109.23 orport=443 id=81D4A9FB174118AA4809B4EE209982FFF215E8A9" +/* nickname=whatscrackin */ /* extrainfo=0 */ /* ===== */ , -"70.39.91.99 orport=81 id=315D1201A80DCA0AB6D5BA6514F9152FDEFEA0E0" -/* nickname=elites4 */ +"192.34.87.86 orport=9001 id=CBC8D277C35BCE9512BA45479CF8141FC6A2CD73" +/* nickname=iamthatdude */ /* extrainfo=0 */ /* ===== */ , -"217.160.24.47 orport=9001 id=45431BF8AB66C673942C1E344BB520625CE5F817" -" ipv6=[2a01:239:27f:4400::1]:9001" -/* nickname=observatory123 */ +"198.23.133.146 orport=9001 id=B00A2DE75DEB8ABB3058290CE311A3D9D096797A" +/* nickname=DebbieDoesTor2023 */ /* extrainfo=0 */ /* ===== */ , -"194.5.101.253 orport=443 id=62CDBF67AD8C00076CEA20C2BC56A8CCBC2C5D0A" -/* nickname=nrdtrn01 */ +"92.205.161.164 orport=80 id=65369D044C659CD299E35763914FFD0FC9AD4509" +" ipv6=[2a00:1169:11c:3e00::]:443" +/* nickname=Charybdis5 */ /* extrainfo=0 */ /* ===== */ , -"5.254.118.189 orport=9001 id=234B06E4DA915D527C897E21FD1E9F08012E2962" -/* nickname=Pizzahut */ +"24.125.17.222 orport=443 id=EB044ED4110BA4A6D546992B457DFD13C52B96E5" +/* nickname=mammoth */ /* extrainfo=0 */ /* ===== */ , -"72.235.129.116 orport=4443 id=77AC367C04CBA86B93DAA29B7CB3DD12CD363F06" -/* nickname=hnlexit2 */ +"193.189.100.197 orport=445 id=3C518040CA63BB9EA6B2BE3F514B7168DCC72A74" +" ipv6=[2a0f:df00:0:255::197]:445" +/* nickname=TORKeFFORG30 */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.169 orport=9000 id=552C2E2AFDD1B740A38CA9768C51EC011B2AF701" -" ipv6=[2a12:a800:2:1:45:141:215:169]:9000" -/* nickname=Quetzalcoatl */ +"89.106.71.126 orport=9001 id=C588F709A5D9CF37358E456003645CDC74BC8B3C" +" ipv6=[2a02:2fc0:11::71:126]:9001" +/* nickname=DediZoneRelay */ /* extrainfo=0 */ /* ===== */ , -"57.129.44.38 orport=9200 id=1B0AAE2012DB8E364A42739906249E1E8959A216" -/* nickname=prsv */ +"23.137.248.69 orport=443 id=A24CB2FAB0B4CC1F1965CC7FA332AB1184617DDA" +" ipv6=[2602:fc24:11:16f9::1]:443" +/* nickname=AntonPann8 */ /* extrainfo=0 */ /* ===== */ , -"200.122.181.2 orport=443 id=7D33FC2D047493C6A514F5A4C1D70FCA54EA55DD" -/* nickname=Michelangelo */ +"217.154.188.247 orport=443 id=8B8A8328539BF34221C1F136D6EAA48EFCAD379D" +" ipv6=[2001:ba0:215:f000::1]:443" +/* nickname=0x011 */ /* extrainfo=0 */ /* ===== */ , -"116.12.180.234 orport=443 id=98A6022D39DD25902D7728B65BE28E5557F5B914" -/* nickname=maplefire */ +"51.15.96.2 orport=443 id=56344DEE34D3343090D00AD88CE2D58B50712C81" +" ipv6=[2001:bc8:1640:777:dc00:ff:fe12:d075]:443" +/* nickname=gh5d4h56s468r784s32 */ /* extrainfo=0 */ /* ===== */ , -"74.215.154.5 orport=9001 id=74B065244F5B429E55DA072D8C0D1C787167AAC2" -" ipv6=[2600:2b00:9358:2004:aab8:e0ff:fe00:87f3]:9001" -/* nickname=evequefou */ +"185.244.192.184 orport=9100 id=3AD0E099EA0F64B6202BEE3B737A9FE5D554A3CC" +" ipv6=[2a03:4000:27:36:c813:6dff:fe0e:b93e]:9100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"92.60.37.143 orport=9001 id=F50CF02A0E6A9D9B25F7EB220FC26F7BD1B74999" -" ipv6=[2a03:4000:33:255:2895:5dff:fe24:437d]:9001" -/* nickname=flowjob02 */ +"23.129.64.140 orport=443 id=C98CD99E2BF5F1D7EFA5ED90646AF809CE8F75DF" +" ipv6=[2620:18c:0:192::e0:140]:443" +/* nickname=kiriakou */ /* extrainfo=0 */ /* ===== */ , -"185.162.249.126 orport=9001 id=DB5DE88B4914F60CDEEF581ECCA8DEA59EF26A90" -" ipv6=[2a03:4000:1a:6f8:98f0:87ff:fe6a:29af]:9001" -/* nickname=Piratenpartei06 */ +"64.65.2.44 orport=443 id=5CA1EBAC7D56273D719B3405DC361DCFEACC4863" +/* nickname=statikselektah */ /* extrainfo=0 */ /* ===== */ , -"45.141.215.28 orport=9100 id=1D764756B76BCD821D57242649DE50F4C872F4EF" -" ipv6=[2a12:a800:2:1:45:141:215:28]:9100" -/* nickname=Aramis */ +"185.255.122.39 orport=443 id=406A030C4A33800DA8E8CDCA72DAFC446A3787AC" +/* nickname=Unnamed */ /* extrainfo=0 */ /* ===== */ , -"185.241.208.245 orport=9000 id=C3F9572611FF1084615219D8CE3AE6848C1DCCAD" -/* nickname=RDPdotSH */ +"74.215.154.5 orport=9003 id=1D4F6F26E34E2C571F25E93605EDBC95626760FD" +" ipv6=[2600:2b00:939e:710d:aab8:e0ff:fe00:87f2]:9003" +/* nickname=evequefou3 */ /* extrainfo=0 */ /* ===== */ , -"78.142.18.219 orport=9444 id=3EF2D316BC791FF4B9460B41A6C31EC44C525619" -/* nickname=bauruine */ +"144.126.133.74 orport=143 id=ACB30ED82CA61B49E38E5969505D7E2F29897AA1" +" ipv6=[2605:a140:2262:7686::1]:143" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"178.248.249.172 orport=9050 id=F1CC14C298442FAFF00762BA4339ECBED1AC0F92" -/* nickname=msbobo4 */ +"185.181.60.181 orport=443 id=335E993222204F6B4817134506494A6441DEFB6B" +" ipv6=[2a03:94e0:ffff:185:181:60:0:181]:443" +/* nickname=DowntimePatrol1 */ /* extrainfo=0 */ /* ===== */ , -"193.63.58.76 orport=9001 id=462C4C97170DE94F251A46F4C741032864AD1BFB" -/* nickname=gnosti */ +"185.42.170.203 orport=443 id=5D263037FC175596B3A344132B0B755EB8FB1D1C" +/* nickname=anduinExit01 */ /* extrainfo=0 */ /* ===== */ , -"45.138.16.76 orport=7430 id=601021EEAF3207505D67DEB77F40A9914A9B8856" -" ipv6=[2a12:a800:2:1:45:138:16:76]:7430" -/* nickname=Quetzalcoatl */ +"77.20.3.30 orport=433 id=781817A50379EE962CC031A7C059791CEF11ACC4" +/* nickname=DocTor */ /* extrainfo=0 */ /* ===== */ , -"192.129.10.18 orport=443 id=828DF913997A261E05F894F11CD39573356B368E" -" ipv6=[2001:638:a004:4111:192:129:10:18]:443" -/* nickname=FAUtor */ +"203.55.81.1 orport=443 id=5D9D80195162D7D77506EAF768F00F70A51CD191" +/* nickname=lunar1 */ /* extrainfo=0 */ /* ===== */ , -"73.61.87.62 orport=9001 id=1FFDC7F90DBCDE587C3524FB3FBB50B818565357" -/* nickname=Chrysophylax */ +"5.135.68.65 orport=443 id=1580298405E54F02FF6F66637C3FC7077D363CDC" +" ipv6=[2001:41d0:303:9d44::1]:443" +/* nickname=Scalpay */ /* extrainfo=0 */ /* ===== */ , -"195.90.200.83 orport=9001 id=8639EC2D472AEC280B11288ADADBCC9A6711EC1B" -/* nickname=TorRelayFL */ +"45.138.16.164 orport=8100 id=2FDB0E08C563AB5D225FDBD553D117C96D1160ED" +" ipv6=[2a12:a800:2:1:45:138:16:164]:8100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"192.42.116.211 orport=9001 id=24896D19C6DCF62050A1A46EE3C2C10DA125A867" -" ipv6=[2001:67c:6ec:203:192:42:116:211]:9001" -/* nickname=NTH14R2 */ +"37.187.149.125 orport=9001 id=46BACCCE4BC3CAA63D2FE770DA2AE3CF401B9CF0" +" ipv6=[2001:41d0:a:557d::1]:9001" +/* nickname=SORgaming */ /* extrainfo=0 */ /* ===== */ , -"46.149.125.9 orport=9001 id=21E86043B0AA1DD258F7801BEE21D2227844EC79" -" ipv6=[2001:470:6e:f0::2]:9001" -/* nickname=hpproSW3 */ +"64.65.1.210 orport=443 id=08CBCC075BD2511E989823846F8F9505380F2740" +/* nickname=shotgunshane */ /* extrainfo=0 */ /* ===== */ , -"162.247.74.202 orport=443 id=47E49319DD67784F1E65B5793371BE467365979E" -/* nickname=CalyxInstitute15 */ +"64.65.2.26 orport=443 id=556C9A64ED5489352B402ABB784B70CAE243D37C" +/* nickname=marleymarl */ /* extrainfo=0 */ /* ===== */ , -"116.203.17.238 orport=9001 id=28090710ABE433A47021F22208B3EC245A912900" -/* nickname=dismail */ +"96.9.98.88 orport=443 id=E237E9F386F14456E99EED36B1FAC4F9F77B0F80" +/* nickname=stormyz */ /* extrainfo=0 */ /* ===== */ , -"57.129.5.162 orport=443 id=FE05FEFAE7AED4F3D05C3A308999EA2113EC3383" -" ipv6=[2001:41d0:701:1100::cb3]:443" -/* nickname=mitFineRelee */ +"64.65.62.25 orport=443 id=722C8F1B5ADA4C274F36D7DD8A32DE7F3298242A" +/* nickname=lilwayne1 */ /* extrainfo=0 */ /* ===== */ , -"172.81.131.87 orport=443 id=1776B82878E571E3969A6A7F7EA140A8853F11DB" -" ipv6=[2605:aa80:c007:1736::]:443" -/* nickname=pushypebble */ +"45.84.107.200 orport=9100 id=9E2E162267A5F615AD8942EBAF90DC4297BC3D72" +" ipv6=[2a0d:bbc7::f816:3eff:feec:9f18]:9100" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"185.241.208.71 orport=143 id=AE8F944F2843C8072E491BA301B9F6EEFD6BDFDB" -" ipv6=[2a12:a800:2:1:185:241:208:71]:143" -/* nickname=Quetzalcoatl */ +"109.69.218.176 orport=443 id=FA7136FD4F8A727810A22ED2096AF60F872C2F41" +/* nickname=vandewoestijne */ /* extrainfo=0 */ /* ===== */ , -"51.15.232.19 orport=21 id=D49BB7514C78F68303D879AF7C3D5D67148F599B" -" ipv6=[2001:bc8:710:93a0:dc00:ff:fe7d:88a9]:21" -/* nickname=Layer13 */ +"64.65.1.142 orport=443 id=60EC7FF9D1922E8BE72878C15DD85932EE786ACA" +/* nickname=latto */ /* extrainfo=0 */ /* ===== */ , -"194.164.245.205 orport=443 id=E4C6E31D745BE31F9E150F3BEEE19235D9629FC9" -" ipv6=[2a13:d207:0:40e::1]:443" -/* nickname=tetris */ +"171.25.193.39 orport=81 id=9A561CA579F0918D4E0C7A8533801B91C56FD605" +" ipv6=[2001:67c:289c:2::40]:81" +/* nickname=DFRI79 */ /* extrainfo=0 */ /* ===== */ , -"94.23.45.103 orport=9001 id=EFA4C5E7E9215E8A3C7A8F3C74D3139667DA92A5" -" ipv6=[2001:41d0:2:2e67::1]:9001" -/* nickname=thicancyborg */ +"66.92.214.63 orport=9001 id=0E33CE0721903F24B5680E1105D19EC4D7D335EB" +/* nickname=forest07 */ /* extrainfo=0 */ /* ===== */ , -"107.189.6.124 orport=443 id=4746E2B86718D5391CCF18C258460C321945DBD8" -/* nickname=anarchy99 */ +"64.65.2.54 orport=443 id=8A5B9A2D0B37BE2F8ECFB14396EB4D432131D907" +/* nickname=bustarhymes */ /* extrainfo=0 */ /* ===== */ , -"185.129.61.10 orport=443 id=45D276D6A51DAE5C6F39A655ECE647DDEA9FAEF4" -" ipv6=[2001:67c:89c:702:1ce:1ce:babe:10]:443" -/* nickname=dotsrcExit10 */ +"78.47.189.21 orport=1984 id=B939F036D9BF7FEA590BE961BFAB4C2E0641AC36" +" ipv6=[2a01:4f8:c0c:358b::1]:1984" +/* nickname=ReDHumus */ /* extrainfo=0 */ /* ===== */ , -"23.105.163.117 orport=443 id=27132CE932038B4F34F3BB50299C8D8805735512" -/* nickname=catpain */ +"64.65.0.56 orport=443 id=FB6F6C38348F3879C568F7AD7282697E69274E77" +/* nickname=bishoplamont */ /* extrainfo=0 */ /* ===== */ , -"102.130.117.25 orport=443 id=9A0AAF2E43BE3744CD1D6CD532C861F5A568F7A9" -/* nickname=lnag */ +"140.78.100.26 orport=5443 id=70B2D83BFCA9502E37EAF49DC685166718EADEFE" +/* nickname=INSRelay26at5443 */ /* extrainfo=0 */ /* ===== */ , -"65.21.1.225 orport=9001 id=55C6187EB2BEBC968F4C89D25F4350889E6BC251" -" ipv6=[2a01:4f9:c011:8cca::1]:9001" -/* nickname=Freya */ +"92.27.11.80 orport=9001 id=C7865D58EEFE96B92333E3C8BE3C0AAAA0000EEF" +" ipv6=[2001:470:1f08:4c7::2]:9001" +/* nickname=RealityNews */ /* extrainfo=0 */ /* ===== */ , -"72.211.49.235 orport=443 id=66C7803C5F95CEC0D78004E15A0E4399CD0E4787" -/* nickname=nasrag01 */ +"96.9.98.140 orport=443 id=24167CC4D183585A6AA4192B770F611F9D69C043" +/* nickname=famousdex */ /* extrainfo=0 */ /* ===== */ , -"94.100.6.13 orport=9001 id=25F701E5ED2556CFEA55D81AF937EFBCDF9464FB" -/* nickname=cruffty9 */ +"50.103.128.207 orport=9006 id=D0B5734B42303C9FEDF5BDA1C2383C6195909A88" +/* nickname=raspberry */ /* extrainfo=0 */ /* ===== */ , -"171.25.193.20 orport=9050 id=FD1B84A26BC18B32D115B1B8A7048D6FC85248EE" -" ipv6=[2001:67c:289c::20]:9050" -/* nickname=DFRI35 */ +"81.16.33.42 orport=443 id=F21DFB7CCD5EEF3E021086EC96EF7CFCAA72F4F3" +/* nickname=pangea07 */ /* extrainfo=0 */ /* ===== */ , -"195.246.230.153 orport=9001 id=690137D4A1E3ACA5D35B09CD68DA8A3AE0291141" -/* nickname=Kheldell */ +"78.142.18.219 orport=8443 id=C05DCC87D7667D08EE4370D6CDB8CBEB6E0B4313" +/* nickname=bauruine */ /* extrainfo=0 */ /* ===== */ , -"68.8.241.30 orport=9001 id=581BB3AD0D242262B9168C2F17E2E909321BB0A0" -/* nickname=gothamKneadsMe */ +"171.25.193.36 orport=9001 id=F140945C1C795A367B0ACC5F67741857B73FA4B2" +" ipv6=[2001:67c:289c:2::35]:9001" +/* nickname=DFRI57 */ /* extrainfo=0 */ /* ===== */ , -"107.189.8.181 orport=443 id=DB451037C23AF3D028AE1B7E2F82BE5CA77B98A5" -" ipv6=[2605:6400:30:f49b:e2ee:34f8:c854:6f63]:443" -/* nickname=NgePTimE */ +"178.17.174.164 orport=443 id=9BAAA9CBA3109C2C807F2E84D5C9C0C8C147DCE6" +" ipv6=[2a00:1dc0:caff:73::a568]:443" +/* nickname=calator */ /* extrainfo=0 */ /* ===== */ , -"194.55.13.207 orport=443 id=B8F8E84576DE8CC6CDE136D2374F9385A2AFFAD0" -" ipv6=[2a03:4000:31:2f::2430]:9050" -/* nickname=cookieandtea */ +"64.65.62.115 orport=443 id=CE77E80343CCF0D68FAE60EC6637EF1829F64805" +/* nickname=jaykae */ /* extrainfo=0 */ /* ===== */ , -"165.73.242.163 orport=443 id=147321EDE839D266601E65A7FAAD306749B1EEC5" -/* nickname=AlexGraywood */ +"185.244.129.163 orport=9001 id=C171B79FF282D3394129D66D83AFEA85548138D1" +/* nickname=Sinker */ /* extrainfo=0 */ /* ===== */ , -"45.77.112.107 orport=443 id=3FBB6F16075E45BE8BC9BB7034D03A9B4EB6B6C7" -" ipv6=[2001:19f0:9003:9c8:ec4:7aff:fe8f:69aa]:443" -/* nickname=Aid6 */ +"82.67.111.215 orport=9001 id=E58D998896E2464A989D4107AB4403C8AD9F32AE" +/* nickname=GigaTorOfHell2 */ /* extrainfo=0 */ /* ===== */ , -"193.31.27.127 orport=9001 id=54476788A1AA7C348F20390DFC52ACA1352F4C57" -/* nickname=luna */ +"216.197.207.48 orport=9001 id=C366391E67A29CE959A15193D0CF2F9ED94F3578" +/* nickname=jorcanada */ /* extrainfo=0 */ /* ===== */ , -"86.60.148.189 orport=9001 id=16187AC3BDC2A0B030731AF5E27764022A7AFA51" -/* nickname=aurora */ +"140.238.97.211 orport=9001 id=0B53297F0BD687103A00A514E7D2AB83C70F3700" +/* nickname=ruffletor */ /* extrainfo=0 */ /* ===== */ , -"212.132.108.236 orport=443 id=66FB8688C203C247CEA828209FB4901D4BDCF4B9" -/* nickname=Vendetta7 */ +"124.198.131.121 orport=8430 id=8B70848F74BD5A90F6B9E0CB555E7D8C18FF325F" +" ipv6=[2a12:a800:11:1:124:198:131:121]:8430" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"217.79.179.177 orport=9001 id=3E53D3979DB07EFD736661C934A1DED14127B684" -" ipv6=[2001:4ba0:fff9:131:6c4f::90d3]:9001" -/* nickname=Unnamed */ +"50.65.178.92 orport=9001 id=E690103F3E388A3D9C125936F1AE5C64C1A26D51" +" ipv6=[2604:3d09:667c:9560::9]:9001" +/* nickname=affinezeussv */ /* extrainfo=0 */ /* ===== */ , -"45.138.16.76 orport=9000 id=90A83D3A6D53619211909E96EDC30C910676A32B" -" ipv6=[2a12:a800:2:1:45:138:16:76]:9000" -/* nickname=Quetzalcoatl */ +"73.68.62.87 orport=8443 id=CDB2605D2BD28DA31CC91956E8BAD147B7DF8AF9" +/* nickname=2mpdhack */ /* extrainfo=0 */ /* ===== */ , -"217.160.98.239 orport=9001 id=428CAF26607664A176DCD3549EC2BC40253F82D6" -/* nickname=RelayUli */ +"172.245.106.179 orport=9001 id=C300E4E60EB8A73ED017540B36A3C6CEEBBCD2A9" +" ipv6=[2001:470:1f07:8b9::f7ae]:9001" +/* nickname=breaker39 */ /* extrainfo=0 */ /* ===== */ , -"5.135.83.4 orport=9001 id=1172983321801BBFC519E081F967B77484CE71E8" -/* nickname=SparkLowway */ +"150.230.22.185 orport=9001 id=C42AB0BC0F7B4B7BB660F582B73C6A83AA89D245" +/* nickname=GEamsterdam */ /* extrainfo=0 */ /* ===== */ , -"199.247.31.1 orport=24752 id=D1B228DE5DEF2F8087AEBED4E2115EC5840ACC25" -/* nickname=Unnamed */ +"51.38.112.15 orport=9100 id=89F95502BDA81E44B67BADBFFF00DA80CDD4AFB5" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"185.112.146.168 orport=443 id=ED2F15C1B1BC20E3FA9618E949EB5872386F4AF4" -/* nickname=egdelord4life */ +"5.39.81.102 orport=9001 id=5500BAEEDC61A6685F687019196E1765171301D5" +" ipv6=[2001:41d0:8:9366::1]:9001" +/* nickname=p1onX01 */ /* extrainfo=0 */ /* ===== */ , -"79.137.198.213 orport=443 id=2AB6D4CE7A4D46ADA4F21C537A05A68DE088280B" -/* nickname=cozybeardev */ +"64.65.1.30 orport=443 id=6DE6F463227B87923C12C83157C21ECC8764E9B2" +/* nickname=joegifted */ /* extrainfo=0 */ /* ===== */ , -"51.81.93.108 orport=443 id=24523E7B004983EC4CA5033EBC9B7293F12F237C" -/* nickname=Luna */ +"64.65.2.43 orport=443 id=0842C38D6CDA0C9DA41032A43A4F30BF5264E13B" +/* nickname=pmddawn */ /* extrainfo=0 */ /* ===== */ , -"185.82.217.49 orport=9001 id=9665A1A6EB9B98C57E446A483E75E05F0539B41B" -" ipv6=[2a02:27aa::41]:9001" -/* nickname=Assange038bg */ +"45.138.16.240 orport=7430 id=B85E978AEE73A9604FD9B124E1D834080AFC3FA4" +" ipv6=[2a12:a800:2:1:45:138:16:240]:7430" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"64.31.10.6 orport=9000 id=BE9EECDBA47C16B8F687164D8F7E28620E0410D1" -/* nickname=sideshowbob */ +"195.218.16.136 orport=9001 id=2D8768E3EA8B974ADB69F7FA8140DBEAFC14C8F0" +/* nickname=NotMyMothersRelay */ /* extrainfo=0 */ /* ===== */ , -"84.149.73.149 orport=9005 id=CFB8CE28D1B12EEB8662511AFBC1D0C6F79065A8" -/* nickname=mytorrelay */ +"5.2.79.190 orport=9001 id=02A8CCB1FB70984226231283596DA734A80E3F6F" +/* nickname=onionDAOrel0aded1 */ /* extrainfo=0 */ /* ===== */ , -"111.69.37.214 orport=9001 id=9D70BB1EF20AD789574CD9D9BB2C1D2E9151B874" -/* nickname=Mak */ +"45.13.104.185 orport=9001 id=234D670EAA794F092F7BD758D5D2AA7F4E3FFBE3" +" ipv6=[2a0b:cbc0:1100:1a::1]:9001" +/* nickname=Ceres */ /* extrainfo=0 */ /* ===== */ , -"185.184.71.94 orport=9001 id=5AC2115B2C6E5A2382484EAEE5D9C7E9C229807A" -/* nickname=ididnteditheconfig */ +"124.198.131.62 orport=9000 id=49B422AB305669407516E4A0D4CE5BEACE3E2432" +" ipv6=[2a12:a800:11:1:124:198:131:62]:9000" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"195.90.215.218 orport=9997 id=C78689CFDC3EFB435FD62BE874639AEAAC9C353F" -/* nickname=TorTempel3 */ +"192.121.44.27 orport=9001 id=ABC5A7A6D5C609512F5D7CD2B490CE7366F00D60" +" ipv6=[2a09:be40:28ff:50:c4c9:3dff:fea3:f4fa]:9001" +/* nickname=Playstar02 */ /* extrainfo=0 */ /* ===== */ , -"116.255.1.163 orport=9001 id=6F42D6F51123C09886464A959F7F04D5AD494E96" -/* nickname=badc0ded */ +"64.65.1.144 orport=443 id=DEB01655570C9BCB968F6EEA95B2E4F85F6C99CF" +/* nickname=shine1k */ /* extrainfo=0 */ /* ===== */ , -"185.40.4.101 orport=12443 id=8CB12C1DDD2071C6F6CB09D73523689F1D351788" -" ipv6=[2a0e:4005:1002:ffff:185:40:4:101]:12443" -/* nickname=bauruine */ +"64.65.1.52 orport=443 id=137E23C6BA0863C229D68A64C0E0BD0F2D17D6D2" +/* nickname=greasymiami */ /* extrainfo=0 */ /* ===== */ , -"5.255.125.196 orport=443 id=CE9ED7FB244F80F6310A6DC399F904C202FD8068" -" ipv6=[2a04:52c0:130:896e::1]:443" -/* nickname=Truancy */ +"107.189.30.236 orport=9000 id=A4F42AE65F11634C42A3F3952E719F47091BD36F" +" ipv6=[2605:6400:30:f5a3:5bb1:af4e:c969:c73e]:9000" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"45.134.225.36 orport=10444 id=80A7B26CBDADE9CCEAEC648286CEA43C6AEA1903" -/* nickname=bauruine */ +"178.20.55.16 orport=19001 id=CFAB19E23290F5BA1F7FF24494D26FBD4E4DF6CE" +" ipv6=[2a00:1b88:4::2]:19001" +/* nickname=marcuse4 */ /* extrainfo=0 */ /* ===== */ , -"130.51.22.104 orport=6969 id=B5CDCE60218E99E5D1964B41D1BC307B54913C79" -/* nickname=halloworldtor */ +"82.223.103.104 orport=53421 id=5F6C321216267A086F6B3634BA4664297C504F5E" +" ipv6=[2001:ba0:214:a800::1]:53421" +/* nickname=TORkedOff */ /* extrainfo=0 */ /* ===== */ , -"172.233.187.241 orport=443 id=9B7A16AABCAFA62B6F10E7877B9F5728C838891B" -" ipv6=[2a01:7e04::f03c:95ff:fee8:7462]:443" -/* nickname=Unnamed */ +"108.181.57.251 orport=443 id=AFEAF3A9E0DB1D837BE8FF1983BA0C65A3E71D73" +/* nickname=osterreich */ /* extrainfo=0 */ /* ===== */ , -"185.101.139.172 orport=443 id=9CBD49371BDB88FB8FB278C25AE8A9F1DE1498EA" -/* nickname=NightRelay */ +"124.198.131.114 orport=8100 id=52F1B080FB427CEE1D3D190B97776B704879FA08" +" ipv6=[2a12:a800:11:1:124:198:131:114]:8100" +/* nickname=Quetzalcoatl */ /* extrainfo=0 */ /* ===== */ , -"94.16.31.131 orport=443 id=0B4190C676FAAD34EB2DCB9A288939476CEBCF32" -" ipv6=[2a00:11c0:60:2cf:d8b5:30ff:fe27:f208]:443" -/* nickname=FasterRelay */ +"135.125.183.193 orport=9300 id=949838C7EDCBC3AA0FF057935D2E7AD9184389BD" +" ipv6=[2001:41d0:701:1100::9e20]:9300" +/* nickname=prsv */ /* extrainfo=0 */ /* ===== */ , -"2.58.52.163 orport=9004 id=BBA4AC0A7CC698E97926AF69CE9A58AC26523CF9" -/* nickname=SomeTorinAS200462 */ +"37.221.195.103 orport=9001 id=C54AB7F3CCAB01BAF61A6F7337AE1F60D8BB940D" +" ipv6=[2a03:4000:8:61b:85e:b6ff:fefa:8752]:9001" +/* nickname=fedoriansRelayTor */ /* extrainfo=0 */ /* ===== */ , -"86.86.126.113 orport=443 id=FC83153EA2FF3807029506A4B30A27D953DD98D4" -" ipv6=[2a02:a452:9bf7:1:82ee:73ff:fe67:f076]:9001" -/* nickname=oneup */ +"45.89.127.221 orport=9001 id=9CCC3E2BC7FA56F602020AC9D77FE19A3727D0DD" +/* nickname=apalaris */ /* extrainfo=0 */ /* ===== */ , -"194.164.173.152 orport=21344 id=B4DBFFC07EB79EEC4F68F1EC657A9A6D3420F54B" -" ipv6=[2001:ba0:200:7a00:0:d26c:bdd4:6841]:21344" -/* nickname=gnampf4i33 */ +"23.129.64.202 orport=443 id=60904553C1C40F3C503F3F10E2F7F6DEBECD6CBF" +" ipv6=[2620:18c:0:192::e0:202]:443" +/* nickname=eo202 */ /* extrainfo=0 */ /* ===== */ , -"89.185.85.140 orport=443 id=F59D3D313A027703E51DC7DF793F2ED106C2E372" -" ipv6=[2a12:5940:9101::2]:443" -/* nickname=cozybeardev */ +"188.172.228.104 orport=443 id=83C8D4A066522D230D640FE3592A810C59669B25" +" ipv6=[2a0a:4cc0:3:10d::42]:443" +/* nickname=Totoro4220 */ /* extrainfo=0 */ /* ===== */ , -"194.26.192.77 orport=8100 id=7C6FDF1CEE7C924EE06C064708C9E1CC0BC8835C" -" ipv6=[2a12:a800:1:1:194:26:192:77]:8100" -/* nickname=Quetzalcoatl */ +"15.204.140.9 orport=8443 id=3FB88013FAC7AB8F479F33F5B484BE9F444330C3" +/* nickname=Parzival */ /* extrainfo=0 */ /* ===== */ , -"144.76.201.253 orport=4080 id=BA13324719485DC3B5FF258C21603287F1AFFD06" -" ipv6=[2a01:4f8:200:82ca::2]:4080" -/* nickname=freeassange */ +"95.216.145.1 orport=1066 id=B9C8AA1EA320CF1BD3E0D158C3E76705A2CB9D2C" +" ipv6=[2a01:4f9:c010:8fb::bee]:1066" +/* nickname=karnak */ /* extrainfo=0 */ /* ===== */ , -"185.220.101.142 orport=11142 id=B0543A3DF8D402F53998E03CFE1B35845DB27D9D" -" ipv6=[2a0b:f4c2:1::142]:11142" -/* nickname=relayon1142 */ +"144.217.90.187 orport=9001 id=7040C1F5728746C5FB5E12845101A26EE8636D7E" +" ipv6=[2607:5300:201:3100::5b0d]:9001" +/* nickname=SaruTorUmidanuki */ /* extrainfo=0 */ /* ===== */ , -"193.105.134.150 orport=9001 id=1808CDA40FDEFE9F1A117F89477BADC882C08A63" -/* nickname=ferrarizSchumacher */ +"51.81.222.62 orport=9001 id=7BC8F2680657BE6C51B51FF6EE113E739D85EDDE" +" ipv6=[2604:2dc0:202:300::ed3]:9001" +/* nickname=Tor2DotTeitelNet */ /* extrainfo=0 */ /* ===== */ , -"167.114.103.133 orport=443 id=D5E9356A5958E4891A124FB749829B30EB7F8D29" -/* nickname=Osiris */ +"82.153.138.57 orport=9003 id=6C5496CC85F96FF6B4BE0B2952A523BEB84184E6" +/* nickname=obzgs5tbmn4q */ /* extrainfo=0 */ /* ===== */ , -"65.49.20.10 orport=9001 id=D35682AB6E29D91AA030E03A9BEB42700D96A1EF" -/* nickname=BraveKhafre */ +"107.189.7.144 orport=9100 id=4EFF3D0C9DE539CF1E27BFC5B3E23BC7CB2D41A9" +" ipv6=[2605:6400:30:f1fa:f57f:d285:3ed9:ee27]:9100" +/* nickname=Quetzalcoatl */ +/* extrainfo=0 */ +/* ===== */ +, +"78.142.18.219 orport=12444 id=92F187D29A0F0DAEB929511D8870F3E9F0F46D46" +/* nickname=bauruine */ /* extrainfo=0 */ /* ===== */ , diff -Nru tor-0.4.8.16/src/app/config/include.am tor-0.4.9.6/src/app/config/include.am --- tor-0.4.8.16/src/app/config/include.am 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/src/app/config/include.am 2026-03-25 14:30:34.000000000 +0000 @@ -16,7 +16,6 @@ src/app/config/statefile.h \ src/app/config/tor_cmdline_mode.h - noinst_HEADERS += \ src/app/config/auth_dirs.inc \ src/app/config/fallback_dirs.inc \ diff -Nru tor-0.4.8.16/src/app/config/or_options_st.h tor-0.4.9.6/src/app/config/or_options_st.h --- tor-0.4.8.16/src/app/config/or_options_st.h 2025-03-24 15:23:12.000000000 +0000 +++ tor-0.4.9.6/src/app/config/or_options_st.h 2026-03-25 14:30:34.000000000 +0000 @@ -89,6 +89,10 @@ char *KeyDirectory; /**< Where to store keys data, as modified. */ int KeyDirectoryGroupReadable; /**< Boolean: Is the KeyDirectory g+r? */ + char *FamilyKeyDirectory_option; /**< Where to look for family ID keys, + * as configured by the user. */ + char *FamilyKeyDirectory; /**< Where to look for family ID keys. */ + char *CacheDirectory_option; /**< Where to store cached data, as * configured by the user. */ char *CacheDirectory; /**< Where to store cached data, as modified. */ @@ -141,6 +145,8 @@ * Includes OutboundBindAddresses and * configured ports. */ int ReducedExitPolicy; /**