CVS commit: pkgsrc/net/tor

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Sep  9 09:46:59 UTC 2026

Modified Files:
        pkgsrc/net/tor: Makefile distinfo

Log Message:
tor: updated to 0.4.9.12

Changes in version 0.4.9.12 - 2026-09-08

Another security release containing several high security fixes reported by
the exciting and controversial world of LLMs. One important note is that new
protocol versions are recommended for clients and relays (41316).
Furthermore, authorities will NOT accept relay descriptor containing TAP keys
anymore hence the importance for all relays to upgrade to the latest 0.4.9.x
stable version. We very strongly recommend upgrading as soon as possible.

o Major bugfixes (security):
  - Do not purge memory for OOM from within low-level code.
    Previously, we would handle OOM conditions from within
    append_cell_to_circuit_queue, which could appear at various places
    within our call stack, and lead to objects being freed at
    surprising points in the code, with attendent risk of use-after-
    free errors. Now we only check for OOM conditions there, and
    handle them from much higher in the stack. Fixes bugs 41341,
    41336, 41326, and 41363; bugfix on 0.2.4.14-alpha. Root-cause fix
    for TROVE-2026-043.
  - Fix a bug where a hostile cache could trick a client into falsely
    believing that certain relays' microdescriptors or router
    descriptors were unusable. Fixes bug 41358; bugfix on 0.2.6.1-alpha
    or earlier. Tracked as TROVE-2026-034.
  - Fix a use-after-free error that could occur if
    AutomapHostsOnResolve was set. Applications using
    AutomapHostsOnResolve with IPv4, or with small VirtualAddrNetwork
    values, are especially vulnerable. Fixes bug 41319; bugfix on
    0.2.1.29. Tracked as TROVE-2026-036.
  - Limit the size of consensus diffs, in bytes and in lines, to
    prevent a class of memory-based denial-of-service attacks. Fixes
    bug 41329; bugfix on 0.3.1.1-alpha. This is tracked
    as TROVE-2026-042.
  - Negotiate CGO cryptography with every hop that supports it.
    Previously, we failed to negotiate CGO with hops other than the
    final hop of a circuit, since we did not enable congestion-control
    with those hops. Now, we negotiate congestion-control _and_ CGO
    whenever we can. Fixes bug 41348; bugfix on 0.4.9.3-alpha. Tracked
    as TROVE-2026-033.
  - Reject the CC_RESPONSE extension in any handshakes for which
    congestion control was _not_ requested. Previously, clients would
    interpret this extension, which could put congestion control into
    an invalid state, leading to a possible remote crash attack. Fixes
    bug 41345; bugfix on 0.4.9.3-alpha. Tracked as TROVE-2026-032.
  - Validate DNS names for complience whenever providing or receiving
    them from evdns, to limit exposure to a class of application and
    library bugs. Fixes bug 41320; bugfix on 0.1.1.23.
    Resolves TROVE-2026-035.

o Major bugfixes (conflux, client, stream isolation):
  - Keep the stream isolation state in sync of a linked conflux set on
    every leg when attaching new streams. This is TROVE-2026-040.
    Fixes bug 41325; bugfix on 0.4.8.1-alpha.

o Minor feature (authority):
  - Reject 0.4.8.x series at the authority level. Closes ticket 41234.

o Minor features (directory authority):
  - Authorities now recommend additional protocols for clients and
    relays. Part of ticket 41316.
  - Provide a new `AuthDirSupport048Clients` option, which is disabled
    by default. When this option is disabled, authorities will accept
    router descriptors that do not contain TAP keys, and will be
    willing to generate microdescriptors without TAP keys in response
    to such descriptors. This introduces a new consensus method (36).
    Part of ticket 41316.

o Minor features (fallbackdir):
  - Regenerate fallback directories generated on September 08, 2026.

o Minor features (geoip data):
  - Update the geoip files to match the IPFire Location Database, as
    retrieved on 2026/09/08.

o Minor features (portability):
  - Fix seccomp compilation with recent versions of glibc. (Closes
    ticket 41317.)

o Minor bugfixes (controller):
  - Fix an assert that can happen if a controller requests an HSFETCH
    naming a relay that has a local descriptor but isn't in the
    consensus. Fixes bug 41367; bugfix on 0.2.7.1-alpha.

o Minor bugfixes (directory authorities):
  - If two shared-random-value commitments are equal, directory
    authorities now tie-break by authority identity during the reveal
    phase. Equal commits could happen if an evil authority republishes
    another's public commitment (and later its public reveal) as its
    own. Previously the two tied entries could cause honest
    authorities to disagree about the resulting SRV. Fixes bug 41356;
    bugfix on 0.2.9.1-alpha.

o Removed features:
  - Tor clients no longer accept consensus instructions to downgrade
    the congestion control algorithm. This is defense-in-depth for
    issues like 41345. Implements ticket 41361.


To generate a diff of this commit:
cvs rdiff -u -r1.200 -r1.201 pkgsrc/net/tor/Makefile
cvs rdiff -u -r1.144 -r1.145 pkgsrc/net/tor/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/tor/Makefile
diff -u pkgsrc/net/tor/Makefile:1.200 pkgsrc/net/tor/Makefile:1.201
--- pkgsrc/net/tor/Makefile:1.200       Mon Jun 29 12:38:29 2026
+++ pkgsrc/net/tor/Makefile     Wed Sep  9 09:46:59 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.200 2026/06/29 12:38:29 adam Exp $
+# $NetBSD: Makefile,v 1.201 2026/09/09 09:46:59 adam Exp $
 
-DISTNAME=      tor-0.4.9.11
+DISTNAME=      tor-0.4.9.12
 CATEGORIES=    net security
 MASTER_SITES=  https://dist.torproject.org/
 

Index: pkgsrc/net/tor/distinfo
diff -u pkgsrc/net/tor/distinfo:1.144 pkgsrc/net/tor/distinfo:1.145
--- pkgsrc/net/tor/distinfo:1.144       Mon Jun 29 12:38:29 2026
+++ pkgsrc/net/tor/distinfo     Wed Sep  9 09:46:59 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.144 2026/06/29 12:38:29 adam Exp $
+$NetBSD: distinfo,v 1.145 2026/09/09 09:46:59 adam Exp $
 
-BLAKE2s (tor-0.4.9.11.tar.gz) = 6618b6a4f7a41b9a1eb9753917857715306b21a7fe60fe096119c089a0630c13
-SHA512 (tor-0.4.9.11.tar.gz) = a9bf90c16998b68ca794dc717abc7bf681dcc2e6f4d1eb57badd0f1a3eb4a84347b2a41758d19dc20913655694ce4898c605c566cdeb8dd71be263a866263bb1
-Size (tor-0.4.9.11.tar.gz) = 10859160 bytes
+BLAKE2s (tor-0.4.9.12.tar.gz) = c729f5d008ac2320529703f456f3c155dac41f05664e46c67d00c2ec801c08da
+SHA512 (tor-0.4.9.12.tar.gz) = 5b83d49b6c87dfaa282b09efc37eb2fe3eeb2d8e830e2578985fee153a00de97283e34a2c804468fab4c8d04cc6cb196f39a68a61ebc470a2a470f9b0817c09c
+Size (tor-0.4.9.12.tar.gz) = 10961943 bytes