mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-09 18:45:54 +02:00
1756190eab
Changes in version 0.4.7.13 - 2023-01-12
This version contains three major bugfixes, two for relays and one for
client being a security fix, TROVE-2022-002. We have added, for Linux, the
support for IP_BIND_ADDRESS_NO_PORT for relays using OutboundBindAddress.
We strongly recommend to upgrade to this version considering the important
congestion control fix detailed below.
o Major bugfixes (congestion control):
- Avoid incrementing the congestion window when the window is not
fully in use. Thia prevents overshoot in cases where long periods
of low activity would allow our congestion window to grow, and
then get followed by a burst, which would cause queue overload.
Also improve the increment checks for RFC3742. Fixes bug 40732;
bugfix on 0.4.7.5-alpha.
o Major bugfixes (relay):
- When opening a channel because of a circuit request that did not
include an Ed25519 identity, record the Ed25519 identity that we
actually received, so that we can use the channel for other
circuit requests that _do_ list an Ed25519 identity. (Previously
we had code to record this identity, but a logic bug caused it to
be disabled.) Fixes bug 40563; bugfix on 0.3.0.1-alpha. Patch
from "cypherpunks".
o Major bugfixes (TROVE-2022-002, client):
- The SafeSocks option had its logic inverted for SOCKS4 and
SOCKS4a. It would let the unsafe SOCKS4 pass but not the safe
SOCKS4a one. This is TROVE-2022-002 which was reported on
Hackerone by "cojabo". Fixes bug 40730; bugfix on 0.3.5.1-alpha.
o Minor feature (authority):
- Reject 0.4.6.x series at the authority level. Closes ticket 40664.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on January 12, 2023.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2023/01/12.
o Minor features (relays):
- Set the Linux-specific IP_BIND_ADDRESS_NO_PORT option on outgoing
sockets, allowing relays using OutboundBindAddress to make more
outgoing connections than ephemeral ports, as long as they are to
separate destinations. Related to issue 40597; patch by Alex
Xu (Hello71).
o Minor bugfixes (relay, metrics):
- Fix typo in a congestion control label on the MetricsPort. Fixes
bug 40727; bugfix on 0.4.7.12.
o Minor bugfixes (sandbox, authority):
- With the sandbox enabled, allow to write "my-consensus-
{ns|microdesc}" and to rename them as well. Fixes bug 40729;
bugfix on 0.3.5.1-alpha.
o Code simplifications and refactoring:
- Rely on actual error returned by the kernel when choosing what
resource exhaustion to log. Fixes issue 40613; Fix
on tor-0.4.6.1-alpha.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
125 lines
4.3 KiB
Plaintext
125 lines
4.3 KiB
Plaintext
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
###############################################################################
|
|
# Definitions
|
|
###############################################################################
|
|
|
|
include Config
|
|
|
|
SUMMARY = Anonymizing overlay network for TCP (The onion router)
|
|
|
|
VER = 0.4.7.13
|
|
|
|
THISAPP = tor-$(VER)
|
|
DL_FILE = $(THISAPP).tar.gz
|
|
DL_FROM = $(URL_IPFIRE)
|
|
DIR_APP = $(DIR_SRC)/$(THISAPP)
|
|
TARGET = $(DIR_INFO)/$(THISAPP)
|
|
PROG = tor
|
|
PAK_VER = 75
|
|
|
|
DEPS = libseccomp
|
|
|
|
SERVICES = tor
|
|
|
|
###############################################################################
|
|
# Top-level Rules
|
|
###############################################################################
|
|
|
|
objects = $(DL_FILE)
|
|
|
|
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
|
|
|
|
$(DL_FILE)_BLAKE2 = 338a0a541423f27f594a091307b5edeafc9826bb651c2bd050f3282c9355d9d43d1ef4791f3c98a37dc4c0f64bc40925ea1c1e32cbdff78b1a7308df501f279a
|
|
|
|
install : $(TARGET)
|
|
|
|
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
|
|
|
|
download :$(patsubst %,$(DIR_DL)/%,$(objects))
|
|
|
|
b2 : $(subst %,%_BLAKE2,$(objects))
|
|
|
|
dist:
|
|
@$(PAK)
|
|
|
|
###############################################################################
|
|
# Downloading, checking, b2sum
|
|
###############################################################################
|
|
|
|
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
|
|
@$(CHECK)
|
|
|
|
$(patsubst %,$(DIR_DL)/%,$(objects)) :
|
|
@$(LOAD)
|
|
|
|
$(subst %,%_BLAKE2,$(objects)) :
|
|
@$(B2SUM)
|
|
|
|
###############################################################################
|
|
# Installation Details
|
|
###############################################################################
|
|
|
|
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
|
|
@$(PREBUILD)
|
|
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
|
|
cd $(DIR_APP) && \
|
|
./configure \
|
|
--prefix=/usr \
|
|
--sysconfdir=/etc \
|
|
--localstatedir=/var \
|
|
--with-tor-user=tor \
|
|
--with-tor-group=tor
|
|
|
|
cd $(DIR_APP) && make $(MAKETUNING)
|
|
cd $(DIR_APP) && make install
|
|
|
|
# Install configuration files.
|
|
mkdir -pv /var/ipfire/tor /var/lib/tor /var/log/tor
|
|
touch /var/ipfire/tor/settings
|
|
mv /etc/tor/torrc.sample /var/ipfire/tor/torrc
|
|
ln -svf /var/ipfire/tor/torrc /etc/tor/torrc
|
|
|
|
# Adjust ownerships.
|
|
chown -R nobody:nobody /var/lib/tor /var/ipfire/tor
|
|
|
|
# Logrotate
|
|
mkdir -pv /etc/logrotate.d
|
|
install -v -m 644 $(DIR_SRC)/config/tor/tor.logrotate \
|
|
/etc/logrotate.d/tor
|
|
|
|
# Defaults
|
|
mkdir -pv /usr/share/tor
|
|
install -v -m 644 $(DIR_SRC)/config/tor/defaults-torrc \
|
|
/usr/share/tor/defaults-torrc
|
|
|
|
# Install initscripts
|
|
$(call INSTALL_INITSCRIPTS,$(SERVICES))
|
|
|
|
# Install start links and backup include file.
|
|
ln -sf ../init.d/tor /etc/rc.d/rc3.d/S60tor
|
|
ln -sf ../init.d/tor /etc/rc.d/rc0.d/K40tor
|
|
ln -sf ../init.d/tor /etc/rc.d/rc6.d/K40tor
|
|
install -v -m 644 $(DIR_SRC)/config/backup/includes/tor \
|
|
/var/ipfire/backup/addons/includes/tor
|
|
@rm -rf $(DIR_APP)
|
|
@$(POSTBUILD)
|