Wed Mar 18 16:43:49 2020 UTC ()
tor: update to 0.4.2.7.

Changes in version 0.4.2.7 - 2020-03-18
  This is the third stable release in the 0.4.2.x series. It backports
  numerous fixes from later releases, including a fix for TROVE-2020-
  002, a major denial-of-service vulnerability that affected all
  released Tor instances since 0.2.1.5-alpha. Using this vulnerability,
  an attacker could cause Tor instances to consume a huge amount of CPU,
  disrupting their operations for several seconds or minutes. This
  attack could be launched by anybody against a relay, or by a directory
  cache against any client that had connected to it. The attacker could
  launch this attack as much as they wanted, thereby disrupting service
  or creating patterns that could aid in traffic analysis. This issue
  was found by OSS-Fuzz, and is also tracked as CVE-2020-10592.

  We do not have reason to believe that this attack is currently being
  exploited in the wild, but nonetheless we advise everyone to upgrade
  as soon as packages are available.

  o Major bugfixes (security, denial-of-service, backport from 0.4.3.3-alpha):
    - Fix a denial-of-service bug that could be used by anyone to
      consume a bunch of CPU on any Tor relay or authority, or by
      directories to consume a bunch of CPU on clients or hidden
      services. Because of the potential for CPU consumption to
      introduce observable timing patterns, we are treating this as a
      high-severity security issue. Fixes bug 33119; bugfix on
      0.2.1.5-alpha. Found by OSS-Fuzz. We are also tracking this issue
      as TROVE-2020-002 and CVE-2020-10592.

  o Major bugfixes (circuit padding, memory leak, backport from 0.4.3.3-alpha):
    - Avoid a remotely triggered memory leak in the case that a circuit
      padding machine is somehow negotiated twice on the same circuit.
      Fixes bug 33619; bugfix on 0.4.0.1-alpha. Found by Tobias Pulls.
      This is also tracked as TROVE-2020-004 and CVE-2020-10593.

  o Major bugfixes (directory authority, backport from 0.4.3.3-alpha):
    - Directory authorities will now send a 503 (not enough bandwidth)
      code to clients when under bandwidth pressure. Known relays and
      other authorities will always be answered regardless of the
      bandwidth situation. Fixes bug 33029; bugfix on 0.1.2.5-alpha.

  o Minor features (continuous integration, backport from 0.4.3.2-alpha):
    - Stop allowing failures on the Travis CI stem tests job. It looks
      like all the stem hangs we were seeing before are now fixed.
      Closes ticket 33075.

  o Minor bugfixes (bridges, backport from 0.4.3.1-alpha):
    - Lowercase the configured value of BridgeDistribution before adding
      it to the descriptor. Fixes bug 32753; bugfix on 0.3.2.3-alpha.

  o Minor bugfixes (logging, backport from 0.4.3.2-alpha):
    - If we encounter a bug when flushing a buffer to a TLS connection,
      only log the bug once per invocation of the Tor process.
      Previously we would log with every occurrence, which could cause
      us to run out of disk space. Fixes bug 33093; bugfix
      on 0.3.2.2-alpha.

  o Minor bugfixes (onion services v3, backport from 0.4.3.3-alpha):
    - Fix an assertion failure that could result from a corrupted
      ADD_ONION control port command. Found by Saibato. Fixes bug 33137;
      bugfix on 0.3.3.1-alpha. This issue is also tracked
      as TROVE-2020-003.

  o Minor bugfixes (rust, build, backport from 0.4.3.2-alpha):
    - Fix a syntax warning given by newer versions of Rust that was
      creating problems for our continuous integration. Fixes bug 33212;
      bugfix on 0.3.5.1-alpha.

  o Testing (Travis CI, backport from 0.4.3.3-alpha):
    - Remove a redundant distcheck job. Closes ticket 33194.
    - Sort the Travis jobs in order of speed: putting the slowest jobs
      first takes full advantage of Travis job concurrency. Closes
      ticket 33194.
    - Stop allowing the Chutney IPv6 Travis job to fail. This job was
      previously configured to fast_finish (which requires
      allow_failure), to speed up the build. Closes ticket 33195.
    - When a Travis chutney job fails, use chutney's new "diagnostics.sh"
      tool to produce detailed diagnostic output. Closes ticket 32792.


(wiz)
diff -r1.151 -r1.152 pkgsrc/net/tor/Makefile
diff -r1.105 -r1.106 pkgsrc/net/tor/distinfo
cvs diff -r1.151 -r1.152 pkgsrc/net/tor/Makefile (expand / switch to unified diff)

--- pkgsrc/net/tor/Makefile 2020/01/30 21:02:49 1.151
+++ pkgsrc/net/tor/Makefile 2020/03/18 16:43:49 1.152
@@ -1,33 +1,33 @@ @@ -1,33 +1,33 @@
1# $NetBSD: Makefile,v 1.151 2020/01/30 21:02:49 leot Exp $ 1# $NetBSD: Makefile,v 1.152 2020/03/18 16:43:49 wiz Exp $
2 2
3DISTNAME= tor-0.4.2.6 3DISTNAME= tor-0.4.2.7
4CATEGORIES= net security 4CATEGORIES= net security
5MASTER_SITES= https://dist.torproject.org/ 5MASTER_SITES= https://dist.torproject.org/
6 6
7MAINTAINER= pkgsrc-users@NetBSD.org 7MAINTAINER= pkgsrc-users@NetBSD.org
8HOMEPAGE= https://www.torproject.org/ 8HOMEPAGE= https://www.torproject.org/
9COMMENT= Anonymizing overlay network for TCP 9COMMENT= Anonymizing overlay network for TCP
10LICENSE= modified-bsd 10LICENSE= modified-bsd
11 11
12USE_LANGUAGES= c99 12USE_LANGUAGES= c99
13USE_PKGLOCALEDIR= yes 13USE_PKGLOCALEDIR= yes
14USE_TOOLS+= perl:test pkg-config 14USE_TOOLS+= perl:test pkg-config
15# There are multiple reports of failure to build with BSD make, due to 15# There are multiple reports of failure to build with BSD make, due to
16# an apparent lack of firing the rule to create micro-revision.i. 16# an apparent lack of firing the rule to create micro-revision.i.
17# Work around this by using gmake, which is tiny compared to the 17# Work around this by using gmake, which is tiny compared to the
18# existing perl dependency, and unlikely to be needed on any given 18# existing perl dependency, and unlikely to be needed on any given
19# system just for tor. 19# system just for tor.
20USE_TOOLS+= gmake 20USE_TOOLS+= gmake bash:test
21GNU_CONFIGURE= yes 21GNU_CONFIGURE= yes
22CONFIGURE_ARGS+= --localstatedir=${VARBASE} 22CONFIGURE_ARGS+= --localstatedir=${VARBASE}
23CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFBASEDIR} 23CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFBASEDIR}
24CONFIGURE_ENV+= CPP=${CPP:Q} 24CONFIGURE_ENV+= CPP=${CPP:Q}
25 25
26TEST_TARGET= check 26TEST_TARGET= check
27 27
28TOR_USER?= tor 28TOR_USER?= tor
29TOR_GROUP?= tor 29TOR_GROUP?= tor
30PKG_GECOS.${TOR_USER}= Torifier 30PKG_GECOS.${TOR_USER}= Torifier
31PKG_HOME.${TOR_USER}= ${VARBASE}/chroot/tor 31PKG_HOME.${TOR_USER}= ${VARBASE}/chroot/tor
32BUILD_DEFS+= VARBASE 32BUILD_DEFS+= VARBASE
33PKG_SYSCONFSUBDIR= tor 33PKG_SYSCONFSUBDIR= tor
cvs diff -r1.105 -r1.106 pkgsrc/net/tor/distinfo (expand / switch to unified diff)

--- pkgsrc/net/tor/distinfo 2020/01/30 21:15:41 1.105
+++ pkgsrc/net/tor/distinfo 2020/03/18 16:43:49 1.106
@@ -1,30 +1,30 @@ @@ -1,30 +1,30 @@
1$NetBSD: distinfo,v 1.105 2020/01/30 21:15:41 leot Exp $ 1$NetBSD: distinfo,v 1.106 2020/03/18 16:43:49 wiz Exp $
2 2
3SHA1 (digest-0.7.2.crate) = 5b9c88bbbd10db277eb81489d4fd98222c81f654 3SHA1 (digest-0.7.2.crate) = 5b9c88bbbd10db277eb81489d4fd98222c81f654
4RMD160 (digest-0.7.2.crate) = e1754858a8cc3376e4b1faaa2ab950f5c5a9ff26 4RMD160 (digest-0.7.2.crate) = e1754858a8cc3376e4b1faaa2ab950f5c5a9ff26
5SHA512 (digest-0.7.2.crate) = 8232be4fbc7a77d437933d18423ed6c113abbc84084ceb998fac26413b374266975fd3c00e90131985c800dd0b83ff006dd9e77629d2e6ee19638bd67295ff85 5SHA512 (digest-0.7.2.crate) = 8232be4fbc7a77d437933d18423ed6c113abbc84084ceb998fac26413b374266975fd3c00e90131985c800dd0b83ff006dd9e77629d2e6ee19638bd67295ff85
6Size (digest-0.7.2.crate) = 8386 bytes 6Size (digest-0.7.2.crate) = 8386 bytes
7SHA1 (generic-array-0.9.0.crate) = 1cd2878b30397e19cd189367dd8a4ea71a14e2ec 7SHA1 (generic-array-0.9.0.crate) = 1cd2878b30397e19cd189367dd8a4ea71a14e2ec
8RMD160 (generic-array-0.9.0.crate) = 45975a0df06c24fe628f007f7cd77fc1c8ceb1d9 8RMD160 (generic-array-0.9.0.crate) = 45975a0df06c24fe628f007f7cd77fc1c8ceb1d9
9SHA512 (generic-array-0.9.0.crate) = e2a00d8856a4231a5c29bae592b2a84b98c70737058104fd67570af1220259994d11cb4506f1a1412f3c8a04576fe2617ef015600f677ecfccc8ff7a07425400 9SHA512 (generic-array-0.9.0.crate) = e2a00d8856a4231a5c29bae592b2a84b98c70737058104fd67570af1220259994d11cb4506f1a1412f3c8a04576fe2617ef015600f677ecfccc8ff7a07425400
10Size (generic-array-0.9.0.crate) = 10702 bytes 10Size (generic-array-0.9.0.crate) = 10702 bytes
11SHA1 (libc-0.2.39.crate) = 426579d6ce98e82c0531ebff2464582d0aea0567 11SHA1 (libc-0.2.39.crate) = 426579d6ce98e82c0531ebff2464582d0aea0567
12RMD160 (libc-0.2.39.crate) = 19f01e69a28f2d606d09eb8a8661e8ddceed782f 12RMD160 (libc-0.2.39.crate) = 19f01e69a28f2d606d09eb8a8661e8ddceed782f
13SHA512 (libc-0.2.39.crate) = 4b399306da2f4d85e84db5a0a2212bc784b6ab1fb0d4731b58256e47684b5a244dcad8a12088035985e933ca2880dca5ada7dc822443d1cf474f4e73bbe59aa1 13SHA512 (libc-0.2.39.crate) = 4b399306da2f4d85e84db5a0a2212bc784b6ab1fb0d4731b58256e47684b5a244dcad8a12088035985e933ca2880dca5ada7dc822443d1cf474f4e73bbe59aa1
14Size (libc-0.2.39.crate) = 325829 bytes 14Size (libc-0.2.39.crate) = 325829 bytes
15SHA1 (rand-0.5.0-pre.2.crate) = e55aa9ab4bb44ac92d40da0d99a64efdb2e33464 15SHA1 (rand-0.5.0-pre.2.crate) = e55aa9ab4bb44ac92d40da0d99a64efdb2e33464
16RMD160 (rand-0.5.0-pre.2.crate) = 74a094353fee28574d1ec86b9587ca30701685a0 16RMD160 (rand-0.5.0-pre.2.crate) = 74a094353fee28574d1ec86b9587ca30701685a0
17SHA512 (rand-0.5.0-pre.2.crate) = 7f7f9c77367c2f6c310ad8f15074b85af615c8c0777a1bcbdd2e56410ea057e932fe20263e747d78e1b940abe02d6ada9e4d66ec743b169eb78895b220f5aa7b 17SHA512 (rand-0.5.0-pre.2.crate) = 7f7f9c77367c2f6c310ad8f15074b85af615c8c0777a1bcbdd2e56410ea057e932fe20263e747d78e1b940abe02d6ada9e4d66ec743b169eb78895b220f5aa7b
18Size (rand-0.5.0-pre.2.crate) = 132485 bytes 18Size (rand-0.5.0-pre.2.crate) = 132485 bytes
19SHA1 (rand_core-0.2.0-pre.0.crate) = 21ea25e01766a26dbbd71997c5c3f358f3454980 19SHA1 (rand_core-0.2.0-pre.0.crate) = 21ea25e01766a26dbbd71997c5c3f358f3454980
20RMD160 (rand_core-0.2.0-pre.0.crate) = cbd3dc9ad06727ca36c296f4d33ec695e25b7bb9 20RMD160 (rand_core-0.2.0-pre.0.crate) = cbd3dc9ad06727ca36c296f4d33ec695e25b7bb9
21SHA512 (rand_core-0.2.0-pre.0.crate) = b14f88e529fe99b7b9774fc8e1233b44192e253a8a27bfc4da1a7ae99104b6b697068bd19faab85df3427e557a5182892f81f481dd89e8eb6921ec390ca752e9 21SHA512 (rand_core-0.2.0-pre.0.crate) = b14f88e529fe99b7b9774fc8e1233b44192e253a8a27bfc4da1a7ae99104b6b697068bd19faab85df3427e557a5182892f81f481dd89e8eb6921ec390ca752e9
22Size (rand_core-0.2.0-pre.0.crate) = 19211 bytes 22Size (rand_core-0.2.0-pre.0.crate) = 19211 bytes
23SHA1 (tor-0.4.2.6.tar.gz) = 3ca9fcefa74b3d2e4a28aeda1339b5eb65078e54 23SHA1 (tor-0.4.2.7.tar.gz) = a7a48e4199097b5198c86448b5871732fba2ac76
24RMD160 (tor-0.4.2.6.tar.gz) = fdd9733bbd72e565935011f22ead211469cb2be3 24RMD160 (tor-0.4.2.7.tar.gz) = 86d23f25cfec136a8b2abc0567fa2708f6078252
25SHA512 (tor-0.4.2.6.tar.gz) = 0e757cd6f48ca3ed5737978e8f63f1f267d2223479bfc7a431b71a6912040a4a9bc63cc97a73356ff998e03123b0a6a4519486c41359d1ef1f0fe30aa1fa168f 25SHA512 (tor-0.4.2.7.tar.gz) = a23c7eec8f399372227433c62c97278563a63e4cf03e475307915d395fb0b7efc461b4c8a077149e7b6df955ec26d52cd833dfe37fb650d23b3fcb1a4163d64d
26Size (tor-0.4.2.6.tar.gz) = 7600081 bytes 26Size (tor-0.4.2.7.tar.gz) = 7604875 bytes
27SHA1 (typenum-1.9.0.crate) = 76b18bc10204c28798cd32d10fd0df349d4cb5e4 27SHA1 (typenum-1.9.0.crate) = 76b18bc10204c28798cd32d10fd0df349d4cb5e4
28RMD160 (typenum-1.9.0.crate) = 6468f8efe8e91edac71dfd4e28c46581a2f0d457 28RMD160 (typenum-1.9.0.crate) = 6468f8efe8e91edac71dfd4e28c46581a2f0d457
29SHA512 (typenum-1.9.0.crate) = 8b72af1e370cf9d9308287baf4fc7c6096c4923d1c52fe0313c23c84077d74196aa4d997ecf195842d8242c871b0fd0da111f7914664be1841c97315e3ba6abb 29SHA512 (typenum-1.9.0.crate) = 8b72af1e370cf9d9308287baf4fc7c6096c4923d1c52fe0313c23c84077d74196aa4d997ecf195842d8242c871b0fd0da111f7914664be1841c97315e3ba6abb
30Size (typenum-1.9.0.crate) = 57747 bytes 30Size (typenum-1.9.0.crate) = 57747 bytes