./net/tor, Anonymizing overlay network for TCP

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: pkgsrc-2016Q3, Version: 0.2.8.9, Package name: tor-0.2.8.9, Maintainer: athaba

The simple version: Tor provides a distributed network of servers ("onion
routers"). Users bounce their TCP streams (web traffic, FTP, SSH, etc.) around
the routers. This makes it hard for recipients, observers, and even the onion
routers themselves to track the source of the stream.

The complex version: Onion Routing is a connection-oriented anonymizing
communication service. Users choose a source-routed path through a set of
nodes, and negotiate a "virtual circuit" through the network, in which each
node knows its predecessor and successor, but no others. Traffic flowing down
the circuit is unwrapped by a symmetric key at each node, which reveals the
downstream node.


Required to run:
[devel/libevent]

Required to build:
[textproc/asciidoc]

Package options: doc

Master sites:

SHA1: fab0cb618bea15d19428dd820403ba3267b17b06
RMD160: b93b57e194d746a1fe8621a75946004f79b8c7c7
Filesize: 5182.396 KB

Version history: (Expand)

CVS history: (Expand)


   2016-11-03 20:02:18 by Benny Siegert | Files touched by this commit (2) 
Log message:
Pullup ticket #5145 - requested by wiz
net/tor: security fix

Revisions pulled up:
- net/tor/Makefile                                              1.112-1.113
- net/tor/distinfo                                              1.73-1.74

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Fri Sep 30 10:53:01 UTC 2016

   Modified Files:
   	pkgsrc/net/tor: Makefile distinfo

   Log message:
   Updated tor to 0.2.8.8.

   Changes in version 0.2.8.8 - 2016-09-23
     Tor 0.2.8.8 fixes two crash bugs present in previous versions of the
     0.2.8.x series. Relays running 0.2.8.x should upgrade, as should users
     who select public relays as their bridges.

     o Major bugfixes (crash):
       - Fix a complicated crash bug that could affect Tor clients
         configured to use bridges when replacing a networkstatus consensus
         in which one of their bridges was mentioned. OpenBSD users saw
         more crashes here, but all platforms were potentially affected.
         Fixes bug 20103; bugfix on 0.2.8.2-alpha.

     o Major bugfixes (relay, OOM handler):
       - Fix a timing-dependent assertion failure that could occur when we
         tried to flush from a circuit after having freed its cells because
         of an out-of-memory condition. Fixes bug 20203; bugfix on
         0.2.8.1-alpha. Thanks to "cypherpunks" for help diagnosing
         this one.

     o Minor feature (fallback directories):
       - Remove broken fallbacks from the hard-coded fallback directory
         list. Closes ticket 20190; patch by teor.

     o Minor features (geoip):
       - Update geoip and geoip6 to the September 6 2016 Maxmind GeoLite2
         Country database.

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Wed Oct 19 10:58:14 UTC 2016

   Modified Files:
   	pkgsrc/net/tor: Makefile distinfo

   Log message:
   Updated tor to 0.2.8.9.

   Changes in version 0.2.8.9 - 2016-10-17
     Tor 0.2.8.9 backports a fix for a security hole in previous versions
     of Tor that would allow a remote attacker to crash a Tor client,
     hidden service, relay, or authority. All Tor users should upgrade to
     this version, or to 0.2.9.4-alpha. Patches will be released for older
     versions of Tor.

     o Major features (security fixes, also in 0.2.9.4-alpha):
       - Prevent a class of security bugs caused by treating the contents
         of a buffer chunk as if they were a NUL-terminated string. At
         least one such bug seems to be present in all currently used
         versions of Tor, and would allow an attacker to remotely crash
         most Tor instances, especially those compiled with extra compiler
         hardening. With this defense in place, such bugs can't crash Tor,
         though we should still fix them as they occur. Closes ticket
         20384 (TROVE-2016-10-001).

     o Minor features (geoip):
       - Update geoip and geoip6 to the October 4 2016 Maxmind GeoLite2
         Country database.