Tor: an anonymizing overlay network for TCP
Tor is a connection-based low-latency anonymous communication system which
addresses many flaws in the original onion routing design.
Tor is a toolset for a wide range of organizations and people that
want to improve their safety and security on the Internet. Using
Tor can help you anonymize web browsing and publishing, instant
messaging, IRC, SSH, and more. Tor also provides a platform on which
software developers can build new applications with built-in
anonymity, safety, and privacy features.
===> The following configuration options are available for tor-0.4.9.14:
DOCS=on: Build and/or install documentation
MANPAGES=on: Build and/or install manual pages
POW=on: Enable PoW (Proof of Work) module (licence changes to GPL)
STATIC_TOR=off: Build a static tor
TCMALLOC=off: Use the tcmalloc memory allocation library
====> Supported compression libraries
ZSTD=on: Zstandard compression support
LZMA=on: LZMA compression support
====> Tracing
LTTNG=off: Build with LTTng-UST instrumentation
USDT=off: Build with tracing USDT instrumentation
LOG_DEBUG=off: Build with tracing event to debug log
===> Use 'make config' to modify these settings
security/tor: update 0.4.9.5 → 0.4.9.6
Quoting the announcement at:
<https://lists.torproject.org/mailman3/hyperkitty/list/tor-announce@lists.torproject.org/message/MDZTQ6KHN7YPUPE2GQYYQQFNP3KCMK3M/>
Changes in version 0.4.9.6 - 2026-03-25
This is a security release fixing major bugfixes that could possibly lead to
remote crashing relays. We strongly recommend upgrading as soon as possible.
o Major bugfix (security):
- Fix a stack overflow of 11 bytes on malicious CREATED2. This lead
to a remote crash. TROVE-2026-003. Reported-by: Anas Cherni of
Calif.io. Fixes bug 41231; bugfix on 0.4.9.1-alpha.
o Major bugfix (security, conflux):
(Only the first 15 lines of the commit message are shown above )
security/tor: No longer cater to GCC 4.x
GCC 4.x has not been in use in the ports tree for quite a while
(short of one single port). Remove special casing for it which
essentially became a noop.
Approved by: yuri (maintainer)
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
security/tor: update 0.4.8.9 → 0.4.8.10
Log: https://forum.torproject.org/t/security-release-0-4-8-10/10536
This is a security release fixing a high severity bug (TROVE-2023-007)
affecting Exit relays supporting Conflux. We strongly recommend to update as
soon as possible.
o Major bugfixes (TROVE-2023-007, exit):
- Improper error propagation from a safety check in conflux leg
linking lead to a desynchronization of which legs were part of a
conflux set, ultimately causing a UAF and NULL pointer dereference
crash on Exit relays. Fixes bug 40897; bugfix on 0.4.8.1-alpha.
o Minor features (fallbackdir):
(Only the first 15 lines of the commit message are shown above )
security/tor: update 0.4.8.7 → 0.4.8.8
This update contains a fix to a remote crash bug (TROVE 2023 004).
It is highly recommended that all relay operators
upgrade to the new versions as soon as possible to maintain the
network stability and security.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/tor: Update 0.4.4.7 -> 0.4.5.6
Changelog:
https://lists.torproject.org/pipermail/tor-announce/2021-February/000214.html
- contains major and minor bugfixes and new features.
Port options LTTNG,USDT,LOG_DEBUG backported from security/tor-devel.
LIB_DEPENDS is fixes in STATIC_TOR option.
Reported by: upstream notification
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
security/tor: force rebuild after r503790
evutil_secure_rng_add_bytes became nop in r478104 on all FreeBSD
releases due to a bug in arc4random_addrandom ifdef. libevent 2.1.10
hidden it based on configure check. Looks like there were consumers.
PR: 238433
Reported by: yuri
Bump PORTREVISION for ports depending on the canonical version of GCC
defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t
GCC 8.2 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.
PR: 231590
security/tor: Fix build with mips64, powerpc64 and sparc64
Port changes:
* Add USES=compiler:c11
* Add USE_CSTD=gnu99
Situation with MIPS isn't clear, Nathan <ndowens@yahoo.com> says that it works
only after adding USES=autoreconf.
The Tor Project should resolve this discrepancy that autoreconf alters the
outcome: https://trac.torproject.org/projects/tor/ticket/27901
PR: 231779
Submitted by: Piotr Kubaj <pkubaj@anongoth.pl> (initial version)
security/tor: Update to 0.3.2.10
Backport of countermeasures to mitigate denial-of-service
attacks against the Tor network.
Changelog is in:
https://gitweb.torproject.org/tor.git/tree/ChangeLog
None of these fixes appear to be essential for clients, but relays
should upgrade.
Port changes:
* Changed the implementation of 'tor_setuid': now it is done through
the command line argument, instead of the torrc file.
Reported by: Nick Mathewson <nickm@torproject.org> (notification)
Approved by: tcberner (mentor, implicit)
security/tor: Update to 0.3.2.9
This release contains many new features and many bugfixes.
Plesee see the complete list here:
https://blog.torproject.org/tor-0329-released-we-have-new-stable-series
Additionally, this update adds "#include <osreldate.h>" to qualm the
compiler warning that was caused by the previous fix.
Now security/tor and security/tor-devel are identical.
Submitted by: myself
Reported by: upstream notification
Approved by: adamw (mentor)
Differential Revision: https://reviews.freebsd.org/D13820
security/tor: Unbreaking on systems without timingsafe_memcmp(3)
timingsafe_memcmp(3) has only been introduced in 12, therefore limiting its use
to 12.
Reported by: Martin Gehlen <zitlo@zitlo.de> (bug reporter)
Approved by: adamw (mentor)
Differential Revision: https://reviews.freebsd.org/D13502
Bump PORTREVISION for ports depending on the canonical version of GCC
(via Mk/bsd.default-versions.mk and lang/gcc) which has moved from
GCC 5.4 to GCC 6.4 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c++11-lib, c++11-lang,
c++14-lang, c++0x, c11, or gcc-c++11-lib.
PR: 219275
Begin deorbit burn of ia64. We have not attempted to build packages for
it for many years.
While here, alphabetize ARCHs, pet portlint, and modernize usages.
Approved by: portmgr (tier-2 blanket)
- security/tor: Implemented setuid feature
*The user should add tor_setuid=YES to /etc/rc.conf
to make tor do setuid in runtime after opening the
externally provided files.
PR: 218587
Submitted by: xmj
Approved by: Yuri Victorovich <yuri at rawbw.com> (maintainer)
Approved by: miwi (mentor)
Differential Revision: https://reviews.freebsd.org/D11223
security/tor: 0.3.0.6 -> 0.3.0.7
- medium-severity security bug in earlier versions of 0.3.0.x, where
an attacker could cause a Tor relay process to exit
PR: 219246
Relnotes: https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.0.7
Security: TROVE-2017-002
Submitted by: Yuri Victorovich <yuri@rawbw.com> (maintainer)
MFH: 2017Q2
