CVS commit: pkgsrc/net/tor

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Jun 24 18:12:01 UTC 2026

Modified Files:
        pkgsrc/net/tor: Makefile distinfo

Log Message:
tor: updated to 0.4.9.10

Changes in version 0.4.9.10 - 2026-06-23
Another release with an important security fix and major bugfixes. We
strongly recommend upgrading as soon as possible.

o Major bugfixes (conflux, security, TROVE):
  - Reject a CONFLUX_LINK cell that arrives on a circuit which already
    has attached streams. A malicious client could send a
    RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit,
    attaching an exit stream that would later end up orphan leaving a
    dangling circuit back-pointer and a use-after-free (UAF) when the
    circuit is freed. TROVE-2026-025. Fixes bug 41258; bugfix
    on 0.4.8.1-alpha.

o Major bugfixes (client):
  - Resume warning about unsafe socks protocols (socks4 or
    socks5-not-hostname) when SafeSocks is not set. Also resume
    warning every time when TestSocks is set. Fixes bug 41290; bugfix
    on 0.2.2.18-alpha and 0.2.4.11-alpha.

o Major bugfixes (clients):
  - Make clients more consistently expire entry guards 48 to 60 days
    after they are first used. Previously, we would sometimes expire
    entry guards after this intended range, but sometimes we would
    wait up to 120 days. Fixes bug 41280; bugfix on 0.3.0.1-alpha.

o Minor features (fallbackdir):
  - Regenerate fallback directories generated on June 23, 2026.

o Minor features (geoip data):
  - Update the geoip files to match the IPFire Location Database, as
    retrieved on 2026/06/23.

o Minor bugfixes (code security):
  - Add a defensive check in port_parse_ports_relay() to make it
    clearer to static analysis tools that there is no security
    problem. Fixes bug 41278; bugfix on 0.4.3.1-alpha.

o Minor bugfixes (client-side onion service):
  - Stop leaking memory in the case where the client fetches a well-
    formed onion descriptor but it turns out to not match the onion
    address we intended to fetch. Fixes bug 41264; bugfix
    on 0.3.2.1-alpha.

o Minor bugfixes (directory authorities):
  - Correctly omit "package" lines from the consensus. In proposal 301
    we tried to make a new consensus method that never generates
    "package" lines, but we got the logic wrong. Fixes bug 41293;
    bugfix on 0.4.9.1-alpha.

o Minor bugfixes (relay):
  - Avoid a mistaken BUG() warning and backtrace if a client sends an
    INTRODUCE1 cell using the legacy format from v2 onion services.
    This error case was already handled correctly, but there's no need
    to warn and backtrace. Fixes bug 41299; bugfix on 0.4.6.1-alpha.


To generate a diff of this commit:
cvs rdiff -u -r1.198 -r1.199 pkgsrc/net/tor/Makefile
cvs rdiff -u -r1.142 -r1.143 pkgsrc/net/tor/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/tor/Makefile
diff -u pkgsrc/net/tor/Makefile:1.198 pkgsrc/net/tor/Makefile:1.199
--- pkgsrc/net/tor/Makefile:1.198       Mon Jun  1 17:27:35 2026
+++ pkgsrc/net/tor/Makefile     Wed Jun 24 18:12:01 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.198 2026/06/01 17:27:35 wiz Exp $
+# $NetBSD: Makefile,v 1.199 2026/06/24 18:12:01 adam Exp $
 
-DISTNAME=      tor-0.4.9.9
+DISTNAME=      tor-0.4.9.10
 CATEGORIES=    net security
 MASTER_SITES=  https://dist.torproject.org/
 

Index: pkgsrc/net/tor/distinfo
diff -u pkgsrc/net/tor/distinfo:1.142 pkgsrc/net/tor/distinfo:1.143
--- pkgsrc/net/tor/distinfo:1.142       Mon Jun  1 17:27:35 2026
+++ pkgsrc/net/tor/distinfo     Wed Jun 24 18:12:01 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.142 2026/06/01 17:27:35 wiz Exp $
+$NetBSD: distinfo,v 1.143 2026/06/24 18:12:01 adam Exp $
 
-BLAKE2s (tor-0.4.9.9.tar.gz) = 54f08283b4fcb4baf6ee9ffd7638604cc0fb6de4f76bfbac4b77dd87ff583252
-SHA512 (tor-0.4.9.9.tar.gz) = 7a53e83b617feb35d2239596b5efdd0f7d83488d2c624a4d03404ab76e44c2e5951d559312aa319dcea6ddc08f8e5151fb688a07938aac9f649a4d0d4993ac8c
-Size (tor-0.4.9.9.tar.gz) = 10968833 bytes
+BLAKE2s (tor-0.4.9.10.tar.gz) = 1ebfdffb46c4c5e3ab275ae631406655fa7840996b9422928a3a1448557ef0b3
+SHA512 (tor-0.4.9.10.tar.gz) = 5dcd961f418addf3fd49b14a1e9e26a91413d980c1e670a88d8f8de611c6e7cde889a01fdbf08aeec87610417d64a39062e3e2dc4e42eebb49869cbc9290b4ce
+Size (tor-0.4.9.10.tar.gz) = 10855905 bytes