Update to 0.2.4.22:

Changes in version 0.2.4.22 - 2014-05-16
  Tor 0.2.4.22 backports numerous high-priority fixes from the Tor 0.2.5
  alpha release series. These include blocking all authority signing
  keys that may have been affected by the OpenSSL "heartbleed" bug,
  choosing a far more secure set of TLS ciphersuites by default, closing
  a couple of memory leaks that could be used to run a target relay out
  of RAM, and several others.

  o Major features (security, backport from 0.2.5.4-alpha):
    - Block authority signing keys that were used on authorities
      vulnerable to the "heartbleed" bug in OpenSSL (CVE-2014-0160). (We
      don't have any evidence that these keys _were_ compromised; we're
      doing this to be prudent.) Resolves ticket 11464.

  o Major bugfixes (security, OOM):
    - Fix a memory leak that could occur if a microdescriptor parse
      fails during the tokenizing step. This bug could enable a memory
      exhaustion attack by directory servers. Fixes bug 11649; bugfix
      on 0.2.2.6-alpha.

  o Major bugfixes (TLS cipher selection, backport from 0.2.5.4-alpha):
    - The relay ciphersuite list is now generated automatically based on
      uniform criteria, and includes all OpenSSL ciphersuites with
      acceptable strength and forward secrecy. Previously, we had left
      some perfectly fine ciphersuites unsupported due to omission or
      typo. Resolves bugs 11513, 11492, 11498, 11499. Bugs reported by
      'cypherpunks'. Bugfix on 0.2.4.8-alpha.
    - Relays now trust themselves to have a better view than clients of
      which TLS ciphersuites are better than others. (Thanks to bug
      11513, the relay list is now well-considered, whereas the client
      list has been chosen mainly for anti-fingerprinting purposes.)
      Relays prefer: AES over 3DES; then ECDHE over DHE; then GCM over
      CBC; then SHA384 over SHA256 over SHA1; and last, AES256 over
      AES128. Resolves ticket 11528.
    - Clients now try to advertise the same list of ciphersuites as
      Firefox 28. This change enables selection of (fast) GCM
      ciphersuites, disables some strange old ciphers, and stops
      advertising the ECDH (not to be confused with ECDHE) ciphersuites.
      Resolves ticket 11438.

  o Minor bugfixes (configuration, security):
    - When running a hidden service, do not allow TunneledDirConns 0:
      trying to set that option together with a hidden service would
      otherwise prevent the hidden service from running, and also make
      it publish its descriptors directly over HTTP. Fixes bug 10849;
      bugfix on 0.2.1.1-alpha.

  o Minor bugfixes (controller, backport from 0.2.5.4-alpha):
    - Avoid sending a garbage value to the controller when a circuit is
      cannibalized. Fixes bug 11519; bugfix on 0.2.3.11-alpha.

  o Minor bugfixes (exit relay, backport from 0.2.5.4-alpha):
    - Stop leaking memory when we successfully resolve a PTR record.
      Fixes bug 11437; bugfix on 0.2.4.7-alpha.

  o Minor bugfixes (bridge client, backport from 0.2.5.4-alpha):
    - Avoid 60-second delays in the bootstrapping process when Tor is
      launching for a second time while using bridges. Fixes bug 9229;
      bugfix on 0.2.0.3-alpha.

  o Minor bugfixes (relays and bridges, backport from 0.2.5.4-alpha):
    - Give the correct URL in the warning message when trying to run a
      relay on an ancient version of Windows. Fixes bug 9393.

  o Minor bugfixes (compilation):
    - Fix a compilation error when compiling with --disable-curve25519.
      Fixes bug 9700; bugfix on 0.2.4.17-rc.

  o Minor bugfixes:
    - Downgrade the warning severity for the the "md was still
      referenced 1 node(s)" warning. Tor 0.2.5.4-alpha has better code
      for trying to diagnose this bug, and the current warning in
      earlier versions of tor achieves nothing useful. Addresses warning
      from bug 7164.

  o Minor features (log verbosity, backport from 0.2.5.4-alpha):
    - When we run out of usable circuit IDs on a channel, log only one
      warning for the whole channel, and describe how many circuits
      there were on the channel. Fixes part of ticket 11553.

  o Minor features (security, backport from 0.2.5.4-alpha):
    - Decrease the lower limit of MaxMemInCellQueues to 256 MBytes (but
      leave the default at 8GBytes), to better support Raspberry Pi
      users. Fixes bug 9686; bugfix on 0.2.4.14-alpha.

  o Documentation (backport from 0.2.5.4-alpha):
    - Correctly document that we search for a system torrc file before
      looking in ~/.torrc. Fixes documentation side of 9213; bugfix on
      0.2.3.18-rc.


Changes in version 0.2.4.21 - 2014-02-28
  Tor 0.2.4.21 further improves security against potential adversaries who
  find breaking 1024-bit crypto doable, and backports several stability
  and robustness patches from the 0.2.5 branch.

  o Major features (client security):
    - When we choose a path for a 3-hop circuit, make sure it contains
      at least one relay that supports the NTor circuit extension
      handshake. Otherwise, there is a chance that we're building
      a circuit that's worth attacking by an adversary who finds
      breaking 1024-bit crypto doable, and that chance changes the game
      theory. Implements ticket 9777.

  o Major bugfixes:
    - Do not treat streams that fail with reason
      END_STREAM_REASON_INTERNAL as indicating a definite circuit failure,
      since it could also indicate an ENETUNREACH connection error. Fixes
      part of bug 10777; bugfix on 0.2.4.8-alpha.

  o Code simplification and refactoring:
    - Remove data structures which were introduced to implement the
      CellStatistics option: they are now redundant with the new timestamp
      field in the regular packed_cell_t data structure, which we did
      in 0.2.4.18-rc in order to resolve bug 9093. Resolves ticket 10870.

  o Minor features:
    - Always clear OpenSSL bignums before freeing them -- even bignums
      that don't contain secrets. Resolves ticket 10793. Patch by
      Florent Daigniere.
    - Build without warnings under clang 3.4. (We have some macros that
      define static functions only some of which will get used later in
      the module. Starting with clang 3.4, these give a warning unless the
      unused attribute is set on them.) Resolves ticket 10904.
    - Update geoip and geoip6 files to the February 7 2014 Maxmind
      GeoLite2 Country database.

  o Minor bugfixes:
    - Set the listen() backlog limit to the largest actually supported
      on the system, not to the value in a header file. Fixes bug 9716;
      bugfix on every released Tor.
    - Treat ENETUNREACH, EACCES, and EPERM connection failures at an
      exit node as a NOROUTE error, not an INTERNAL error, since they
      can apparently happen when trying to connect to the wrong sort
      of netblocks. Fixes part of bug 10777; bugfix on 0.1.0.1-rc.
    - Fix build warnings about missing "a2x" comment when building the
      manpages from scratch on OpenBSD; OpenBSD calls it "a2x.py".
      Fixes bug 10929; bugfix on 0.2.2.9-alpha. Patch from Dana Koch.
    - Avoid a segfault on SIGUSR1, where we had freed a connection but did
      not entirely remove it from the connection lists. Fixes bug 9602;
      bugfix on 0.2.4.4-alpha.
    - Fix a segmentation fault in our benchmark code when running with
      Fedora's OpenSSL package, or any other OpenSSL that provides
      ECDH but not P224. Fixes bug 10835; bugfix on 0.2.4.8-alpha.
    - Turn "circuit handshake stats since last time" log messages into a
      heartbeat message. Fixes bug 10485; bugfix on 0.2.4.17-rc.

  o Documentation fixes:
    - Document that all but one DirPort entry must have the NoAdvertise
      flag set. Fixes bug 10470; bugfix on 0.2.3.3-alpha / 0.2.3.16-alpha.


Changes in version 0.2.4.20 - 2013-12-22
  Tor 0.2.4.20 fixes potentially poor random number generation for users
  who 1) use OpenSSL 1.0.0 or later, 2) set "HardwareAccel 1" in their
  torrc file, 3) have "Sandy Bridge" or "Ivy Bridge" Intel processors,
  and 4) have no state file in their DataDirectory (as would happen on
  first start). Users who generated relay or hidden service identity
  keys in such a situation should discard them and generate new ones.

  This release also fixes a logic error that caused Tor clients to build
  many more preemptive circuits than they actually need.

  o Major bugfixes:
    - Do not allow OpenSSL engines to replace the PRNG, even when
      HardwareAccel is set. The only default builtin PRNG engine uses
      the Intel RDRAND instruction to replace the entire PRNG, and
      ignores all attempts to seed it with more entropy. That's
      cryptographically stupid: the right response to a new alleged
      entropy source is never to discard all previously used entropy
      sources. Fixes bug 10402; works around behavior introduced in
      OpenSSL 1.0.0. Diagnosis and investigation thanks to "coderman"
      and "rl1987".
    - Fix assertion failure when AutomapHostsOnResolve yields an IPv6
      address. Fixes bug 10465; bugfix on 0.2.4.7-alpha.
    - Avoid launching spurious extra circuits when a stream is pending.
      This fixes a bug where any circuit that _wasn't_ unusable for new
      streams would be treated as if it were, causing extra circuits to
      be launched. Fixes bug 10456; bugfix on 0.2.4.12-alpha.

  o Minor bugfixes:
    - Avoid a crash bug when starting with a corrupted microdescriptor
      cache file. Fixes bug 10406; bugfix on 0.2.2.6-alpha.
    - If we fail to dump a previously cached microdescriptor to disk, avoid
      freeing duplicate data later on. Fixes bug 10423; bugfix on
      0.2.4.13-alpha. Spotted by "bobnomnom".


Changes in version 0.2.4.19 - 2013-12-11
  The Tor 0.2.4 release series is dedicated to the memory of Aaron Swartz
  (1986-2013). Aaron worked on diverse projects including helping to guide
  Creative Commons, playing a key role in stopping SOPA/PIPA, bringing
  transparency to the U.S government's PACER documents, and contributing
  design and development for Tor and Tor2Web. Aaron was one of the latest
  martyrs in our collective fight for civil liberties and human rights,
  and his death is all the more painful because he was one of us.

  Tor 0.2.4.19, the first stable release in the 0.2.4 branch, features
  a new circuit handshake and link encryption that use ECC to provide
  better security and efficiency; makes relays better manage circuit
  creation requests; uses "directory guards" to reduce client enumeration
  risks; makes bridges collect and report statistics about the pluggable
  transports they support; cleans up and improves our geoip database;
  gets much closer to IPv6 support for clients, bridges, and relays; makes
  directory authorities use measured bandwidths rather than advertised
  ones when computing flags and thresholds; disables client-side DNS
  caching to reduce tracking risks; and fixes a big bug in bridge
  reachability testing. This release introduces two new design
  abstractions in the code: a new "channel" abstraction between circuits
  and or_connections to allow for implementing alternate relay-to-relay
  transports, and a new "circuitmux" abstraction storing the queue of
  circuits for a channel. The release also includes many stability,
  security, and privacy fixes.

  o Major features (new circuit handshake):
    - Tor now supports a new circuit extension handshake designed by Ian
      Goldberg, Douglas Stebila, and Berkant Ustaoglu. Our original
      circuit extension handshake, later called "TAP", was a bit slow
      (especially on the relay side), had a fragile security proof, and
      used weaker keys than we'd now prefer. The new circuit handshake
      uses Dan Bernstein's "curve25519" elliptic-curve Diffie-Hellman
      function, making it significantly more secure than the older
      handshake, and significantly faster. Tor can use one of two built-in
      pure-C curve25519-donna implementations by Adam Langley, or it
      can link against the "nacl" library for a tuned version if present.

      The built-in version is very fast for 64-bit systems when building
      with GCC. The built-in 32-bit version is still faster than the
      old TAP protocol, but using libnacl is better on most such hosts.

      Implements proposal 216; closes ticket 7202.

  o Major features (better link encryption):
    - Relays can now enable the ECDHE TLS ciphersuites when available
      and appropriate. These ciphersuites let us negotiate forward-secure
      TLS secret keys more safely and more efficiently than with our
      previous use of Diffie-Hellman modulo a 1024-bit prime. By default,
      public relays prefer the (faster) P224 group, and bridges prefer
      the (more common) P256 group; you can override this with the
      TLSECGroup option.

      This feature requires clients running 0.2.3.17-beta or later,
      and requires both sides to be running OpenSSL 1.0.0 or later
      with ECC support. OpenSSL 1.0.1, with the compile-time option
      "enable-ec_nistp_64_gcc_128", is highly recommended.

      Implements the relay side of proposal 198; closes ticket 7200.

    - Re-enable TLS 1.1 and 1.2 when built with OpenSSL 1.0.1e or later.
      Resolves ticket 6055. (OpenSSL before 1.0.1 didn't have TLS 1.1 or
      1.2, and OpenSSL from 1.0.1 through 1.0.1d had bugs that prevented
      renegotiation from working with TLS 1.1 or 1.2, so we had disabled
      them to solve bug 6033.)

  o Major features (relay performance):
    - Instead of limiting the number of queued onionskins (aka circuit
      create requests) to a fixed, hard-to-configure number, we limit
      the size of the queue based on how many we expect to be able to
      process in a given amount of time. We estimate the time it will
      take to process an onionskin based on average processing time
      of previous onionskins. Closes ticket 7291. You'll never have to
      configure MaxOnionsPending again.
    - Relays process the new "NTor" circuit-level handshake requests
      with higher priority than the old "TAP" circuit-level handshake
      requests. We still process some TAP requests to not totally starve
      0.2.3 clients when NTor becomes popular. A new consensus parameter
      "NumNTorsPerTAP" lets us tune the balance later if we need to.
      Implements ticket 9574.

  o Major features (client bootstrapping resilience):
    - Add a new "FallbackDir" torrc option to use when we can't use
      a directory mirror from the consensus (either because we lack a
      consensus, or because they're all down). Currently, all authorities
      are fallbacks by default, and there are no other default fallbacks,
      but that will change. This option will allow us to give clients a
      longer list of servers to try to get a consensus from when first
      connecting to the Tor network, and thereby reduce load on the
      directory authorities. Implements proposal 206, "Preconfigured
      directory sources for bootstrapping". We also removed the old
      "FallbackNetworkstatus" option, since we never got it working well
      enough to use it. Closes bug 572.
    - If we have no circuits open, use a relaxed timeout (the
      95th-percentile cutoff) until a circuit succeeds. This heuristic
      should allow Tor to succeed at building circuits even when the
      network connection drastically changes. Should help with bug 3443.

  o Major features (use of guards):
    - Support directory guards (proposal 207): when possible, clients now
      use their entry guards for non-anonymous directory requests. This
      can help prevent client enumeration. Note that this behavior only
      works when we have a usable consensus directory, and when options
      about what to download are more or less standard. In the future we
      should re-bootstrap from our guards, rather than re-bootstrapping
      from the preconfigured list of directory sources that ships with
      Tor. Resolves ticket 6526.
    - Raise the default time that a client keeps an entry guard from
      "1-2 months" to "2-3 months", as suggested by Tariq Elahi's WPES
      2012 paper. (We would make it even longer, but we need better client
      load balancing first.) Also, make the guard lifetime controllable
      via a new GuardLifetime torrc option and a GuardLifetime consensus
      parameter. Start of a fix for bug 8240; bugfix on 0.1.1.11-alpha.

  o Major features (bridges with pluggable transports):
    - Bridges now report the pluggable transports they support to the
      bridge authority, so it can pass the supported transports on to
      bridgedb and/or eventually do reachability testing. Implements
      ticket 3589.
    - Automatically forward the TCP ports of pluggable transport
      proxies using tor-fw-helper if PortForwarding is enabled. Implements
      ticket 4567.

  o Major features (geoip database):
    - Maxmind began labelling Tor relays as being in country "A1",
      which breaks by-country node selection inside Tor. Now we use a
      script to replace "A1" ("Anonymous Proxy") entries in our geoip
      file with real country codes. This script fixes about 90% of "A1"
      entries automatically and uses manual country code assignments to
      fix the remaining 10%. See src/config/README.geoip for details.
      Fixes bug 6266.
    - Add GeoIP database for IPv6 addresses. The new config option
      is GeoIPv6File.
    - Update to the October 2 2013 Maxmind GeoLite Country database.

  o Major features (IPv6):
    - Clients who set "ClientUseIPv6 1" may connect to entry nodes over
      IPv6. Set "ClientPreferIPv6ORPort 1" to make this even more likely
      to happen. Implements ticket 5535.
    - All kind of relays, not just bridges, can now advertise an IPv6
      OR port. Implements ticket 6362.
    - Relays can now exit to IPv6 addresses: make sure that you have IPv6
      connectivity, then set the IPv6Exit flag to 1. Also make sure your
      exit policy reads as you would like: the address * applies to all
      address families, whereas *4 is IPv4 address only, and *6 is IPv6
      addresses only. On the client side, you'll need to wait for enough
      exits to support IPv6, apply the "IPv6Traffic" flag to a SocksPort,
      and use Socks5. Closes ticket 5547, implements proposal 117 as
      revised in proposal 208.
    - Bridge authorities now accept IPv6 bridge addresses and include
      them in network status documents. Implements ticket 5534.
    - Directory authorities vote on IPv6 OR ports. Implements ticket 6363.

  o Major features (directory authorities):
    - Directory authorities now prefer using measured bandwidths to
      advertised ones when computing flags and thresholds. Resolves
      ticket 8273.
    - Directory authorities that vote measured bandwidths about more
      than a threshold number of relays now treat relays with
      unmeasured bandwidths as having bandwidth 0 when computing their
      flags. Resolves ticket 8435.
    - Directory authorities now support a new consensus method (17)
      where they cap the published bandwidth of relays for which
      insufficient bandwidth measurements exist. Fixes part of bug 2286.
    - Directory authorities that set "DisableV2DirectoryInfo_ 1" no longer
      serve any v2 directory information. Now we can test disabling the
      old deprecated v2 directory format, and see whether doing so has
      any effect on network load. Begins to fix bug 6783.

  o Major features (build and portability):
    - Switch to a nonrecursive Makefile structure. Now instead of each
      Makefile.am invoking other Makefile.am's, there is a master
      Makefile.am that includes the others. This change makes our build
      process slightly more maintainable, and improves parallelism for
      building with make -j. Original patch by Stewart Smith; various
      fixes by Jim Meyering.
    - Where available, we now use automake's "silent" make rules by
      default, so that warnings are easier to spot. You can get the old
      behavior with "make V=1". Patch by Stewart Smith for ticket 6522.
    - Resume building correctly with MSVC and Makefile.nmake. This patch
      resolves numerous bugs and fixes reported by ultramage, including
      7305, 7308, 7309, 7310, 7312, 7313, 7315, 7316, and 7669.

  o Security features:
    - Switch to a completely time-invariant approach for picking nodes
      weighted by bandwidth. Our old approach would run through the
      part of the loop after it had made its choice slightly slower
      than it ran through the part of the loop before it had made its
      choice. Addresses ticket 6538.
    - Disable the use of Guard nodes when in Tor2WebMode. Guard usage
      by tor2web clients allows hidden services to identify tor2web
      clients through their repeated selection of the same rendezvous
      and introduction point circuit endpoints (their guards). Resolves
      ticket 6888.

  o Major bugfixes (relay denial of service):
    - When we have too much memory queued in circuits (according to a new
      MaxMemInCellQueues option), close the circuits that have the oldest
      queued cells, on the theory that those are most responsible for
      us running low on memory. This prevents us from running out of
      memory as a relay if circuits fill up faster than they can be
      drained. Fixes bugs 9063 and 9093; bugfix on the 54th commit of
      Tor. This bug is a further fix beyond bug 6252, whose fix was
      merged into 0.2.3.21-rc.
    - Reject bogus create and relay cells with 0 circuit ID or 0 stream
      ID: these could be used to create unexpected streams and circuits
      which would count as "present" to some parts of Tor but "absent"
      to others, leading to zombie circuits and streams or to a bandwidth
      denial-of-service. Fixes bug 7889; bugfix on every released version
      of Tor. Reported by "oftc_must_be_destroyed".
    - Avoid a bug where our response to TLS renegotiation under certain
      network conditions could lead to a busy-loop, with 100% CPU
      consumption. Fixes bug 5650; bugfix on 0.2.0.16-alpha.

  o Major bugfixes (asserts, crashes, leaks):
    - Prevent the get_freelists() function from running off the end of
      the list of freelists if it somehow gets an unrecognized
      allocation. Fixes bug 8844; bugfix on 0.2.0.16-alpha. Reported by
      eugenis.
    - Avoid a memory leak where we would leak a consensus body when we
      find that a consensus which we couldn't previously verify due to
      missing certificates is now verifiable. Fixes bug 8719; bugfix
      on 0.2.0.10-alpha.
    - If we are unable to save a microdescriptor to the journal, do not
      drop it from memory and then reattempt downloading it. Fixes bug
      9645; bugfix on 0.2.2.6-alpha.
    - Fix an assertion failure that would occur when disabling the
      ORPort setting on a running Tor process while accounting was
      enabled. Fixes bug 6979; bugfix on 0.2.2.18-alpha.
    - Avoid an assertion failure on OpenBSD (and perhaps other BSDs)
      when an exit connection with optimistic data succeeds immediately
      rather than returning EINPROGRESS. Fixes bug 9017; bugfix on
      0.2.3.1-alpha.
    - Fix a memory leak that would occur whenever a configuration
      option changed. Fixes bug 8718; bugfix on 0.2.3.3-alpha.

  o Major bugfixes (relay rate limiting):
    - When a TLS write is partially successful but incomplete, remember
      that the flushed part has been flushed, and notice that bytes were
      actually written. Reported and fixed pseudonymously. Fixes bug 7708;
      bugfix on Tor 0.1.0.5-rc.
    - Raise the default BandwidthRate/BandwidthBurst values from 5MB/10MB
      to 1GB/1GB. The previous defaults were intended to be "basically
      infinite", but it turns out they're now limiting our 100mbit+
      relays and bridges. Fixes bug 6605; bugfix on 0.2.0.10-alpha (the
      last time we raised it).
    - No longer stop reading or writing on cpuworker connections when
      our rate limiting buckets go empty. Now we should handle circuit
      handshake requests more promptly. Resolves bug 9731.

  o Major bugfixes (client-side privacy):
    - When we mark a circuit as unusable for new circuits, have it
      continue to be unusable for new circuits even if MaxCircuitDirtiness
      is increased too much at the wrong time, or the system clock jumps
      backwards. Fixes bug 6174; bugfix on 0.0.2pre26.
    - If ClientDNSRejectInternalAddresses ("do not believe DNS queries
      which have resolved to internal addresses") is set, apply that
      rule to IPv6 as well. Fixes bug 8475; bugfix on 0.2.0.7-alpha.
    - When an exit relay rejects a stream with reason "exit policy", but
      we only know an exit policy summary (e.g. from the microdesc
      consensus) for it, do not mark the relay as useless for all exiting.
      Instead, mark just the circuit as unsuitable for that particular
      address. Fixes part of bug 7582; bugfix on 0.2.3.2-alpha.

  o Major bugfixes (stream isolation):
    - Allow applications to get proper stream isolation with
      IsolateSOCKSAuth. Many SOCKS5 clients that want to offer
      username/password authentication also offer "no authentication". Tor
      had previously preferred "no authentication", so the applications
      never actually sent Tor their auth details. Now Tor selects
      username/password authentication if it's offered. You can disable
      this behavior on a per-SOCKSPort basis via PreferSOCKSNoAuth. Fixes
      bug 8117; bugfix on 0.2.3.3-alpha.
    - Follow the socks5 protocol when offering username/password
      authentication. The fix for bug 8117 exposed this bug, and it
      turns out real-world applications like Pidgin do care. Bugfix on
      0.2.3.2-alpha; fixes bug 8879.

  o Major bugfixes (client circuit building):
    - Alter circuit build timeout measurement to start at the point
      where we begin the CREATE/CREATE_FAST step (as opposed to circuit
      initialization). This should make our timeout measurements more
      uniform. Previously, we were sometimes including ORconn setup time
      in our circuit build time measurements. Should resolve bug 3443.
    - If the circuit build timeout logic is disabled (via the consensus,
      or because we are an authority), then don't build testing circuits.
      Fixes bug 9657; bugfix on 0.2.2.14-alpha.

  o Major bugfixes (client-side DNS):
    - Turn off the client-side DNS cache by default. Updating and using
      the DNS cache is now configurable on a per-client-port
      level. SOCKSPort, DNSPort, etc lines may now contain
      {No,}Cache{IPv4,IPv6,}DNS lines to indicate that we shouldn't
      cache these types of DNS answers when we receive them from an
      exit node in response to an application request on this port, and
      {No,}UseCached{IPv4,IPv6,DNS} lines to indicate that if we have
      cached DNS answers of these types, we shouldn't use them. It's
      potentially risky to use cached DNS answers at the client, since
      doing so can indicate to one exit what answers we've gotten
      for DNS lookups in the past. With IPv6, this becomes especially
      problematic. Using cached DNS answers for requests on the same
      circuit would present less linkability risk, since all traffic
      on a circuit is already linkable, but it would also provide
      little performance benefit: the exit node caches DNS replies
      too. Implements a simplified version of Proposal 205. Implements
      ticket 7570.

  o Major bugfixes (hidden service privacy):
    - Limit hidden service descriptors to at most ten introduction
      points, to slow one kind of guard enumeration. Fixes bug 9002;
      bugfix on 0.1.1.11-alpha.

  o Major bugfixes (directory fetching):
    - If the time to download the next old-style networkstatus is in
      the future, do not decline to consider whether to download the
      next microdescriptor networkstatus. Fixes bug 9564; bugfix on
      0.2.3.14-alpha.
    - We used to always request authority certificates by identity digest,
      meaning we'd get the newest one even when we wanted one with a
      different signing key. Then we would complain about being given
      a certificate we already had, and never get the one we really
      wanted. Now we use the "fp-sk/" resource as well as the "fp/"
      resource to request the one we want. Fixes bug 5595; bugfix on
      0.2.0.8-alpha.

  o Major bugfixes (bridge reachability):
    - Bridges now send AUTH_CHALLENGE cells during their v3 handshakes;
      previously they did not, which prevented them from receiving
      successful connections from relays for self-test or bandwidth
      testing. Also, when a relay is extending a circuit to a bridge,
      it needs to send a NETINFO cell, even when the bridge hasn't sent
      an AUTH_CHALLENGE cell. Fixes bug 9546; bugfix on 0.2.3.6-alpha.

  o Major bugfixes (control interface):
    - When receiving a new configuration file via the control port's
      LOADCONF command, do not treat the defaults file as absent.
      Fixes bug 9122; bugfix on 0.2.3.9-alpha.

  o Major bugfixes (directory authorities):
    - Stop marking every relay as having been down for one hour every
      time we restart a directory authority. These artificial downtimes
      were messing with our Stable and Guard flag calculations. Fixes
      bug 8218 (introduced by the fix for 1035). Bugfix on 0.2.2.23-alpha.
    - When computing directory thresholds, ignore any rejected-as-sybil
      nodes during the computation so that they can't influence Fast,
      Guard, etc. (We should have done this for proposal 109.) Fixes
      bug 8146.
    - When marking a node as a likely sybil, reset its uptime metrics
      to zero, so that it cannot time towards getting marked as Guard,
      Stable, or HSDir. (We should have done this for proposal 109.) Fixes
      bug 8147.
    - Fix a bug in the voting algorithm that could yield incorrect results
      when a non-naming authority declared too many flags. Fixes bug 9200;
      bugfix on 0.2.0.3-alpha.

  o Internal abstraction features:
    - Introduce new channel_t abstraction between circuits and
      or_connection_t to allow for implementing alternate OR-to-OR
      transports. A channel_t is an abstract object which can either be a
      cell-bearing channel, which is responsible for authenticating and
      handshaking with the remote OR and transmitting cells to and from
      it, or a listening channel, which spawns new cell-bearing channels
      at the request of remote ORs. Implements part of ticket 6465.
    - Make a channel_tls_t subclass of channel_t, adapting it to the
      existing or_connection_t code. The V2/V3 protocol handshaking
      code which formerly resided in command.c has been moved below the
      channel_t abstraction layer and may be found in channeltls.c now.
      Implements the rest of ticket 6465.
    - Introduce new circuitmux_t storing the queue of circuits for
      a channel; this encapsulates and abstracts the queue logic and
      circuit selection policy, and allows the latter to be overridden
      easily by switching out a policy object. The existing EWMA behavior
      is now implemented as a circuitmux_policy_t. Resolves ticket 6816.

  o New build requirements:
    - Tor now requires OpenSSL 0.9.8 or later. OpenSSL 1.0.0 or later is
      strongly recommended.
    - Tor maintainers now require Automake version 1.9 or later to build
      Tor from the Git repository. (Automake is not required when building
      from a source distribution.)

  o Minor features (protocol):
    - No longer include the "opt" prefix when generating routerinfos
      or v2 directories: it has been needless since Tor 0.1.2. Closes
      ticket 5124.
    - Reject EXTEND cells sent to nonexistent streams. According to the
      spec, an EXTEND cell sent to _any_ nonzero stream ID is invalid, but
      we were only checking for stream IDs that were currently in use.
      Found while hunting for more instances of bug 6271. Bugfix on
      0.0.2pre8, which introduced incremental circuit construction.
    - Tor relays and clients now support a better CREATE/EXTEND cell
      format, allowing the sender to specify multiple address, identity,
      and handshake types. Implements Robert Ransom's proposal 200;
      closes ticket 7199.
    - Reject as invalid most directory objects containing a NUL.
      Belt-and-suspender fix for bug 8037.

  o Minor features (security):
Remove tor-dev, used for upgrading net/tor.
Import libffi-3.1 as wip/libffi.

The libffi library provides a portable, high level programming
interface to various calling conventions.  This allows a programmer to
call any function specified by a call interface description at
run-time.

Some programs may not know at the time of compilation what arguments
are to be passed to a function.  For instance, an interpreter may be
told at run-time about the number and types of arguments used to call
a given function.  Libffi can be used in such programs to provide a
bridge from the interpreter program to compiled code.

Ffi stands for Foreign Function Interface.  A foreign function
interface is the popular name for the interface that allows code
written in one language to call code written in another language.  The
libffi library really only provides the lowest, machine dependent
layer of a fully featured foreign function interface.  A layer must
exist above libffi that handles type conversions for values passed
between the two languages.
+ libffi