Please sync tor 0.2.0.31-1 (universe) from Debian unstable (main)

As I communicated in IRC earlier today, we are well past Feature Freeze and bordering on beta freeze. During this phase it's not customary to import new versions of packages but focus on bugfixing.

Is there anything critically important in this new release that would affect the Intrepid version in a way not reconcilable after release? If so, please describe the extenuating circumstances for a freeze exception (i.e. if upstream has announced they will not allow older clients soon, etc)

0.2.x offers major fixes, but of course I do not know if they are enough to push this to Intrepid. Here are some of those fixes that I think might be the important ones:
    - Non-exit relays no longer answer "resolve" relay cells, so they
      can't be induced to do arbitrary DNS requests.
    - Reject requests for reverse-dns lookup of names that are in
      a private address space.
    - As a client, do not believe any server that tells us that an
      address maps to an internal address space.
    - If we're a relay, avoid picking ourselves as an introduction point,
      a rendezvous point, or as the final hop for internal circuits.
    - Detect size overflow in zlib code.
    - Avoid segfault in the case where a badly behaved v2 versioning
      directory sends a signed networkstatus with missing client-versions.

You can read the rest from http://archives.seul.org/or/announce/Aug-2008/msg00000.html

I think the intro to the announcement summarizes it best:

"Tor 0.2.0.30 switches to a more efficient directory distribution design,
adds features to make connections to the Tor network harder to block,
allows Tor to act as a DNS proxy, adds separate rate limiting for relayed
traffic to make it easier for clients to become relays, fixes a variety
of potential anonymity problems, and includes the usual huge pile of
other features and bug fixes."

The new directory protocol is a big improvement, and the DNS proxy is major new functionality which was lacking in 0.x.

I don't think the Tor network will be blocking the previous version in the immediate future, so we should be safe as far as that is concerned. I had hoped to get the request in earlier in the release cycle, but sometimes these things just don't work out. I'll leave it at the discretion of the Ubuntu people to whether this can be included or not. If not, please adjust the bug to apply to the next milestone.

Lenny has version 0.2.0.31-1.
It builds and installs correctly on intrepid, without adaptation to debian package.
install log:
(intrepid)fabrice@fabrice-desktop:/var/cache/pbuilder/result$ sudo dpkg -i tor_0.2.0.31-1_i386.deb
(Leyendo la base de datos ...
107308 ficheros y directorios instalados actualmente.)
Preparando para reemplazar tor 0.2.0.31-1 (usando tor_0.2.0.31-1_i386.deb) ...
Stopping tor daemon: tor.
Desempaquetando el reemplazo de tor ...
Configurando tor (0.2.0.31-1) ...
Raising maximum number of filedescriptors (ulimit -n) to 32768.
Starting tor daemon: tor...
Oct 08 19:43:23.706 [notice] Tor v0.2.0.31 (r16744). This is experimental software. Do not rely on it for strong anonymity. (Running on Linux i686)
Oct 08 19:43:23.708 [notice] Initialized libevent version 1.3e using method epoll. Good.
Oct 08 19:43:23.708 [notice] Opening Socks listener on 127.0.0.1:9050
done.

Procesando activadores para man-db ...

diffstat between 0.1.2 and 0.2.0.31.

debain/changelog:
tor (0.2.0.31-1) unstable; urgency=low

  * New upstream version.
  * Tweak a few error messages in the init script to use the proper variables
    (not that it should matter, the Right One has the same value, but still)
    and to list more possible error reasons.

 -- Peter Palfrader <email address hidden> Tue, 09 Sep 2008 09:56:54 +0200

tor (0.2.0.30-2) unstable; urgency=low

  * Stop requiring that the binary in /usr/sbin/tor is still the same as the
    one that actually is the running tor when we try to stop or reload the
    daemon using the init script. If the process is called tor, running as
    debian-tor, and the pid file agrees too then it probably is the Tor you
    want to stop (closes: #491246).

 -- Peter Palfrader <email address hidden> Fri, 18 Jul 2008 01:50:37 +0200

tor (0.2.0.30-1) unstable; urgency=low

  * New upstream version.

 -- Peter Palfrader <email address hidden> Wed, 16 Jul 2008 02:19:08 +0200

tor (0.2.0.29-rc-2) unstable; urgency=low

  * Upload to unstable.

 -- Peter Palfrader <email address hidden> Tue, 15 Jul 2008 22:16:08 +0200

tor (0.2.0.29-rc-1) experimental; urgency=low

  * New upstream version.
  * Warn the admin if the number of file descriptors on his system is
    tiny.

 -- Peter Palfrader <email address hidden> Wed, 09 Jul 2008 14:02:06 +0200

tor (0.2.0.28-rc-1) experimental; urgency=low

  * New upstream version.
  * Remove debian/patches/11_tor_as_root_more_helpful.dpatch as
    it is no longer needed: We now setuid() to the Tor user
    when run as root and it all just works.
  * Add comments to the dpatch headers so lintian shuts up.
  * Add patches/14_fix_geoip_warning: Change geoipdb open failed message.
  * Require unit tests to pass again.

 -- Peter Palfrader <email address hidden> Fri, 13 Jun 2008 10:28:36 +0200

tor (0.2.0.27-rc-1) experimental; urgency=low

  * New upstream version.
  * Add tor-geoipdb arch: all package for the geoip database.
  * Update debian/rules so that there now is a binary-common target
    and the binary-indep and binary-arch targets call make with
    proper DH_OPTIONS options. This is taken from the template
    that dh_make nowadays uses for multi-binary packages.
  * Unit tests are broken, yay.
  * Use ${binary:Version} to depend on the right tor binary package from
    the tor-dbg package instead of ${Source-Version}. Some guy on the
    internet said the latter was deprecated.
  * Add Homepage: https://www.torproject.org/ field to control file.
  * And mention www.tp.o instead of the old tor.eff.org in the long
    description.
  * No longer ignore failure of make clean in the clean target.
  * Support passing of parallel=<n> in build options.
  * Change declared Standards-Version to 3.8.0.

 -- Peter Palfrader <email address hidden> Fri, 06 Jun 2008 01:11:33 +0200

tor (0.2.0.26-rc-1) experimental; urgency=critical

  * New upstream version.
  * Conflict with old libssls.
  * On upgrading from versions prior to, including, 0.1.2.19-2, or
    from versions later than 0.2.0 and prior to 0.2.0.26-rc do the
    following, and if we are a server (we have a /var/lib/tor/keys
    directory)
    - move /var/lib/tor/keys/secret_onion_key out of the...

Upstream changelog:

Changes in version 0.2.0.31 - 2008-09-03
  o Major bugfixes:
    - Make sure that two circuits can never exist on the same connection
      with the same circuit ID, even if one is marked for close. This
      is conceivably a bugfix for bug 779. Bugfix on 0.1.0.4-rc.
    - Relays now reject risky extend cells: if the extend cell includes
      a digest of all zeroes, or asks to extend back to the relay that
      sent the extend cell, tear down the circuit. Ideas suggested
      by rovv.
    - If not enough of our entry guards are available so we add a new
      one, we might use the new one even if it overlapped with the
      current circuit's exit relay (or its family). Anonymity bugfix
      pointed out by rovv.

  o Minor bugfixes:
    - Recover 3-7 bytes that were wasted per memory chunk. Fixes bug
      794; bug spotted by rovv. Bugfix on 0.2.0.1-alpha.
    - Correctly detect the presence of the linux/netfilter_ipv4.h header
      when building against recent kernels. Bugfix on 0.1.2.1-alpha.
    - Pick size of default geoip filename string correctly on windows.
      Fixes bug 806. Bugfix on 0.2.0.30.
    - Make the autoconf script accept the obsolete --with-ssl-dir
      option as an alias for the actually-working --with-openssl-dir
      option. Fix the help documentation to recommend --with-openssl-dir.
      Based on a patch by "Dave". Bugfix on 0.2.0.1-alpha.
    - Disallow session resumption attempts during the renegotiation
      stage of the v2 handshake protocol. Clients should never be trying
      session resumption at this point, but apparently some did, in
      ways that caused the handshake to fail. Bug found by Geoff Goodell.
      Bugfix on 0.2.0.20-rc.
    - When using the TransPort option on OpenBSD, and using the User
      option to change UID and drop privileges, make sure to open
      /dev/pf before dropping privileges. Fixes bug 782. Patch from
      Christopher Davis. Bugfix on 0.1.2.1-alpha.
    - Try to attach connections immediately upon receiving a RENDEZVOUS2
      or RENDEZVOUS_ESTABLISHED cell. This can save a second or two
      on the client side when connecting to a hidden service. Bugfix
      on 0.0.6pre1. Found and fixed by Christian Wilms; resolves bug 743.
    - When closing an application-side connection because its circuit is
      getting torn down, generate the stream event correctly. Bugfix on
      0.1.2.x. Anonymous patch.

Changes in version 0.2.0.30 - 2008-07-15
  o Minor bugfixes:
    - Stop using __attribute__((nonnull)) with GCC: it can give us useful
      warnings (occasionally), but it can also cause the compiler to
      eliminate error-checking code. Suggested by Peter Gutmann.

Changes in version 0.2.0.29-rc - 2008-07-08
  o Major bugfixes:
    - If you have more than one bridge but don't know their keys,
      you would only launch a request for the descriptor of the first one
      on your list. (Tor considered launching requests for the others, but
      found that it already had a connection on the way for $0000...0000
      so it didn't open another.) Bugfix on 0.2.0.x.
    - If you have more than one bridge but don't know their keys, and the
     ...

We should always release with the latest Tor. +1 from me.

*nod*, please go ahead.

So please sync tor from Lenny repository

ACK from me, looks good.

Thanks,

James

[Updating] tor (0.1.2.19-3 [Ubuntu] < 0.2.0.31-1 [Debian])
 * Trying to add tor...
  - <tor_0.2.0.31.orig.tar.gz: downloading from http://ftp.debian.org/debian/>
  - <tor_0.2.0.31-1.dsc: downloading from http://ftp.debian.org/debian/>
  - <tor_0.2.0.31-1.diff.gz: downloading from http://ftp.debian.org/debian/>
I: tor [universe] -> tor_0.1.2.19-3 [universe].
I: tor [universe] -> tor-dbg_0.1.2.19-3 [universe].