./net/tor, Anonymizing overlay network for TCP

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 0.4.5.7nb2, Package name: tor-0.4.5.7nb2, Maintainer: pkgsrc-users

The simple version: Tor provides a distributed network of servers ("onion
routers"). Users bounce their TCP streams (web traffic, FTP, SSH, etc.) around
the routers. This makes it hard for recipients, observers, and even the onion
routers themselves to track the source of the stream.

The complex version: Onion Routing is a connection-oriented anonymizing
communication service. Users choose a source-routed path through a set of
nodes, and negotiate a "virtual circuit" through the network, in which each
node knows its predecessor and successor, but no others. Traffic flowing down
the circuit is unwrapped by a symmetric key at each node, which reveals the
downstream node.


Required to run:
[security/openssl] [devel/libevent] [archivers/zstd]

Required to build:
[textproc/asciidoc] [pkgtools/cwrappers]

Package options: doc, lzma, zstd

Master sites:

SHA1: 902bab16c39e8f54b97502d6dc04e6b484894bcd
RMD160: ec6375b290c6bed7a1acff002aed061d0965e191
Filesize: 7632.967 KB

Version history: (Expand)


CVS history: (Expand)


   2021-04-15 13:23:14 by Ryo ONODERA | Files touched by this commit (95)
Log message:
*: Recursive revbump from devel/nss
   2021-04-09 08:55:06 by Thomas Klausner | Files touched by this commit (95) | Package updated
Log message:
*: bump PKGREVISION for nss linking fix
   2021-03-16 17:25:21 by Thomas Klausner | Files touched by this commit (3) | Package updated
Log message:
tor: update to 0.4.5.7.

  Tor 0.4.5.7 fixes two important denial-of-service bugs in earlier
  versions of Tor.

  One of these vulnerabilities (TROVE-2021-001) would allow an attacker
  who can send directory data to a Tor instance to force that Tor
  instance to consume huge amounts of CPU. This is easiest to exploit
  against authorities, since anybody can upload to them, but directory
  caches could also exploit this vulnerability against relays or clients
  when they download. The other vulnerability (TROVE-2021-002) only
  affects directory authorities, and would allow an attacker to remotely
  crash the authority with an assertion failure. Patches have already
  been provided to the authority operators, to help ensure
  network stability.

  We recommend that everybody upgrade to one of the releases that fixes
  these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available
  to you.

  This release also updates our GeoIP data source, and fixes a few
  smaller bugs in earlier releases.

  o Major bugfixes (security, denial of service):
    - Disable the dump_desc() function that we used to dump unparseable
      information to disk. It was called incorrectly in several places,
      in a way that could lead to excessive CPU usage. Fixes bug 40286;
      bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021-
      001 and CVE-2021-28089.
    - Fix a bug in appending detached signatures to a pending consensus
      document that could be used to crash a directory authority. Fixes
      bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002
      and CVE-2021-28090.

  o Minor features (geoip data):
    - We have switched geoip data sources. Previously we shipped IP-to-
      country mappings from Maxmind's GeoLite2, but in 2019 they changed
      their licensing terms, so we were unable to update them after that
      point. We now ship geoip files based on the IPFire Location
      Database instead. (See https://location.ipfire.org/ for more
      information). This release updates our geoip files to match the
      IPFire Location Database as retrieved on 2021/03/12. Closes
      ticket 40224.

  o Minor bugfixes (directory authority):
    - Now that exit relays don't allow exit connections to directory
      authority DirPorts (to prevent network reentry), disable
      authorities' reachability self test on the DirPort. Fixes bug
      40287; bugfix on 0.4.5.5-rc.

  o Minor bugfixes (documentation):
    - Fix a formatting error in the documentation for
      VirtualAddrNetworkIPv6. Fixes bug 40256; bugfix on 0.2.9.4-alpha.

  o Minor bugfixes (Linux, relay):
    - Fix a bug in determining total available system memory that would
      have been triggered if the format of Linux's /proc/meminfo file
      had ever changed to include "MemTotal:" in the middle of a line.
      Fixes bug 40315; bugfix on 0.2.5.4-alpha.

  o Minor bugfixes (metrics port):
    - Fix a BUG() warning on the MetricsPort for an internal missing
      handler. Fixes bug 40295; bugfix on 0.4.5.1-alpha.

  o Minor bugfixes (onion service):
    - Remove a harmless BUG() warning when reloading tor configured with
      onion services. Fixes bug 40334; bugfix on 0.4.5.1-alpha.

  o Minor bugfixes (portability):
    - Fix a non-portable usage of "==" with "test" in the \ 
configure
      script. Fixes bug 40298; bugfix on 0.4.5.1-alpha.

  o Minor bugfixes (relay):
    - Remove a spammy log notice falsely claiming that the IPv4/v6
      address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha.
    - Do not query the address cache early in the boot process when
      deciding if a relay needs to fetch early directory information
      from an authority. This bug resulted in a relay falsely believing
      it didn't have an address and thus triggering an authority fetch
      at each boot. Related to our fix for 40300.

  o Removed features (mallinfo deprecated):
    - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it.
      Closes ticket 40309.
   2021-02-20 10:08:58 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
tor: switch to xz for liblzma

Bump PKGREVISION.
   2021-02-17 23:53:52 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
tor: enable lzma option by default

Recommended by an upstream developer.

Bump PKGREVISION.
   2021-02-15 20:01:31 by Thomas Klausner | Files touched by this commit (5) | Package updated
Log message:
tor: update to 0.4.5.6.

Changes in version 0.4.5.6 - 2021-02-15
  The Tor 0.4.5.x release series is dedicated to the memory of Karsten
  Loesing (1979-2020), Tor developer, cypherpunk, husband, and father.
  Karsten is best known for creating the Tor metrics portal and leading
  the metrics team, but he was involved in Tor from the early days. For
  example, while he was still a student he invented and implemented the
  v2 onion service directory design, and he also served as an ambassador
  to the many German researchers working in the anonymity field. We
  loved him and respected him for his patience, his consistency, and his
  welcoming approach to growing our community.

  This release series introduces significant improvements in relay IPv6
  address discovery, a new "MetricsPort" mechanism for relay operators
  to measure performance, LTTng support, build system improvements to
  help when using Tor as a static library, and significant bugfixes
  related to Windows relay performance. It also includes numerous
  smaller features and bugfixes.
   2021-02-03 20:55:28 by Thomas Klausner | Files touched by this commit (3) | Package updated
Log message:
tor: update to 0.4.4.7.

Changes in version 0.4.4.7 - 2021-02-03
  Tor 0.4.4.7 backports numerous bugfixes from later releases,
  including one that made v3 onion services more susceptible to
  denial-of-service attacks, and a feature that makes some kinds of
  DoS attacks harder to perform.

  o Major bugfixes (onion service v3, backport from 0.4.5.3-rc):
    - Stop requiring a live consensus for v3 clients and services, and
      allow a "reasonably live" consensus instead. This allows v3 onion
      services to work even if the authorities fail to generate a
      consensus for more than 2 hours in a row. Fixes bug 40237; bugfix
      on 0.3.5.1-alpha.

  o Major feature (exit, backport from 0.4.5.5-rc):
    - Re-entry into the network is now denied at the Exit level to all
      relays' ORPorts and authorities' ORPorts and DirPorts. This change
      should help mitgate a set of denial-of-service attacks. Closes
      ticket 2667.

  o Minor feature (build system, backport from 0.4.5.4-rc):
    - New "make lsp" command to generate the compile_commands.json file
      used by the ccls language server. The "bear" program is needed for
      this. Closes ticket 40227.

  o Minor features (compilation, backport from 0.4.5.2-rc):
    - Disable deprecation warnings when building with OpenSSL 3.0.0 or
      later. There are a number of APIs newly deprecated in OpenSSL
      3.0.0 that Tor still requires. (A later version of Tor will try to
      stop depending on these APIs.) Closes ticket 40165.

  o Minor features (crypto, backport from 0.4.5.3-rc):
    - Fix undefined behavior on our Keccak library. The bug only
      appeared on platforms with 32-byte CPU cache lines (e.g. armv5tel)
      and would result in wrong digests. Fixes bug 40210; bugfix on
      0.2.8.1-alpha. Thanks to Bernhard √úbelacker, Arnd Bergmann and
      weasel for diagnosing this.

  o Minor bugfixes (compatibility, backport from 0.4.5.1-rc):
    - Strip '\r' characters when reading text files on Unix platforms.
      This should resolve an issue where a relay operator migrates a
      relay from Windows to Unix, but does not change the line ending of
      Tor's various state files to match the platform, and the CRLF line
      endings from Windows end up leaking into other files such as the
      extra-info document. Fixes bug 33781; bugfix on 0.0.9pre5.

  o Minor bugfixes (compilation, backport from 0.4.5.3-rc):
    - Fix a compilation warning about unreachable fallthrough
      annotations when building with "--enable-all-bugs-are-fatal" on
      some compilers. Fixes bug 40241; bugfix on 0.3.5.4-alpha.

  o Minor bugfixes (SOCKS5, backport from 0.4.5.3-rc):
    - Handle partial SOCKS5 messages correctly. Previously, our code
      would send an incorrect error message if it got a SOCKS5 request
      that wasn't complete. Fixes bug 40190; bugfix on 0.3.5.1-alpha.

  o Minor bugfixes (testing, backport from 0.4.5.2-alpha):
    - Fix the `config/parse_tcp_proxy_line` test so that it works
      correctly on systems where the DNS provider hijacks invalid
      queries. Fixes part of bug 40179; bugfix on 0.4.3.1-alpha.
    - Fix our Python reference-implementation for the v3 onion service
      handshake so that it works correctly with the version of hashlib
      provided by Python 3.9. Fixes part of bug 40179; bugfix
      on 0.3.1.6-rc.
    - Fix the `tortls/openssl/log_one_error` test to work with OpenSSL
      3.0.0. Fixes bug 40170; bugfix on 0.2.8.1-alpha.
   2020-11-16 09:25:40 by Thomas Klausner | Files touched by this commit (1)
Log message:
tor: add upstream bug report URL about building problem with rust enabled