Commit graph

143 commits

Author SHA1 Message Date
Joachim Fasting 87677d0390
tor: 0.3.1.9 -> 0.3.2.9
- Adds next-generation onion services[1]
- Lots of fixes, e.g., for CVE-2017-8821, CVE-2017-8820, CVE-2017-8823,
  CVE-2017-8819, CVE-2017-8822, CVE-2017-8822
- Adds new option `NoExec` to disallow exec syscalls
2018-01-13 18:22:45 +01:00
Andreas Rammhold 959364c01d
tor: 0.3.1.8 -> 0.3.1.9 (CVE-2017-{8819,8820,8821,8822,8823})
More details in the release mail [1].

[1] https://lists.torproject.org/pipermail/tor-announce/2017-December/000147.html
2017-12-03 20:35:16 +01:00
c0bw3b 525380b472 treewide: abandon Google Code homepages 2017-11-03 18:52:28 +00:00
Joachim Fasting 5a64e446ff
tor: 0.3.1.7 -> 0.3.1.8
Quoth the release notes:

> It includes several bugfixes, including a bugfix for a crash issue that
had affected relays under memory pressure. It also adds a new directory
authority, Bastet.
2017-10-26 22:39:24 +02:00
Joachim Fasting fd3a9e6468
tor: enable parallel building 2017-09-22 22:37:15 +02:00
Joachim Fasting 1ee60e98e2
tor: 0.3.0.10 -> 0.3.1.7 2017-09-19 02:36:38 +02:00
Joachim Fasting 4751fca48c
tor: 0.3.0.9 -> 0.3.0.10
Fixes TPROXY on linux, fixes potential DOS on openbsd.
Otherwise mostly minor bugfixes.
2017-08-02 20:05:05 +02:00
Joachim Fasting d7ce6a83b1
tor: 0.3.0.8 -> 0.3.0.9
See https://blog.torproject.org/blog/tor-0309-released-security-update-clients
2017-07-01 13:37:37 +02:00
Joachim Fasting 8e706b051e
tor: 0.3.0.7 -> 0.3.0.8
Of particular note are fixes for hidden service crashing bugs
(TROVE-2017-004 and TROVE-2017-005).

See https://blog.torproject.org/blog/tor-0308-released-fix-hidden-services-also-are-02429-02514-02612-0278-02814-and-02911
2017-06-09 00:40:25 +02:00
Joachim Fasting 3cd189c3bc
tor: 0.3.0.6 -> 0.3.0.7
Contains a fix for TROVE-2017-002, a remotely triggered crashing bug
affecting tor relays (clients & releases pre 0.3.0 unaffected).
2017-05-16 11:14:14 +02:00
Joachim Fasting 7301bf8581
tor: 0.2.9.10 -> 0.3.0.6
First stable release in the 0.3 series.

https://blog.torproject.org/blog/tor-0306-released-new-series-stable
2017-04-27 19:26:59 +02:00
Joachim Fasting ecd0e1a2c7
torbrowser: reduce risk of stale Nix store references
This patch restructures the expression and wrapper to minimize Nix store
references captured by the user's state directory.

The previous version would write lots of references to the Nix store into
the user's state directory, resulting in synchronization issues between
the Store and the local state directory.  At best, this would cause TBB to
stop working when the version used to instantiate the local state was
garbage collected; at worst, a user would continue to use the old version
even after an upgrade.

To solve the issue, hard-code as much as possible at the Store side and
minimize the amount of stuff being copied into the local state dir.
Currently, only a few files generated at firefox startup and fontconfig
cache files end up capturing store paths; these files are simply removed
upon every startup.  Otherwise, no capture should occur and the user
should always be using the TBB associated with the tor-browser wrapper
script.

To check for stale Store paths, do
   `grep -Ero '/nix/store/[^/]+' ~/.local/share/tor-browser`
This command should *never* return any other store path than the one
associated with the current tor-browser wrapper script, even after an
update (assuming you've run tor-browser at least once after updating).
Deviations from this general rule are considered bugs from now on.

Note that no attempt has been made to support pluggable transports; they
are still broken with this patch (to be fixed in a follow-up patch).

User visible changes:
- Wrapper retains only environment variables required for TBB to work
- pulseaudioSupport can be toggled independently of mediaSupport (the
  latter weakly implies the former).
- Store local state under $TBB_HOME.  Defaults to $XDG_DATA_HOME/tor-browser
- Stop obnoxious first-run stuff (NoScript redirect, in particular)
- Set desktop item GenericName to Web Browser

Some minor enhancements:
- Disable Hydra builds
- Specify system -> source mapping to make it easier to
  extend supported platforms.
2017-03-25 15:59:18 +01:00
Joachim Fasting 74f8e0fd7a
torbrowser: 6.5 -> 6.5.1 2017-03-08 20:08:46 +01:00
Joachim Fasting c44a41c73f
tor: split out geoip data
Saves about 5.2 MiB.

To use geoip, add something like
```
GeoIPFile ${tor.geoip}/share/tor/geoip
GeoIPv6File ${tor.geoip}/share/tor/geoip6
```
to torrc
2017-03-02 12:40:33 +01:00
Joachim Fasting 05054e34c0
tor: 0.2.9.9 -> 0.2.9.10
The 0.2.9 series is now a long-term support release, which will
receive backported security fixes until at least 2020.

tor should now build against libressl, as in
```nix
tor.override { openssl = libressl; }
```

Also re-enable the test-suite; works fine on my end.
2017-03-01 23:56:34 +01:00
Bjørn Forsman 3d104ab2b3 gst-plugins-base: align attrname with pkgname 2017-02-27 12:16:26 +01:00
Bjørn Forsman 0591cd607b gst-plugins-good: align attrname with pkgname 2017-02-27 12:16:26 +01:00
Bjørn Forsman 4b2c7fe3d1 gst-ffmpeg: align attrname with pkgname 2017-02-27 12:16:26 +01:00
Joachim Fasting b18ff7ab82
torbrowser: make additional media playback support optional
This feature might not be appropriate for all users, leave it off by
default.

See 96be6a11a8
2017-01-28 12:27:24 +01:00
Joachim Fasting 4a4bc14260
torbrowser: fix url typo
I used nix-prefetch-url to generate the hashes, so of course this
mistake slipped by ...

Ref: 5bbe54272d
2017-01-26 14:44:33 +01:00
Joachim Fasting 5bbe54272d
torbrowser: 6.0.8 -> 6.5
Updates to firefox-esr 45.7, which fixes several critical
vulnerabilities [1]

[1]: https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/
2017-01-26 14:03:50 +01:00
Joachim Fasting bdfe638f31
tor: 0.2.8.12 -> 0.2.9.9 2017-01-25 00:58:37 +01:00
Joachim Fasting 3e92b56be3
tor: 0.2.8.10 -> 0.2.8.12
Notably contains fix for CVE-2016-1254

cc @grahamc
2016-12-19 23:49:17 +01:00
Joachim Fasting b55cef7514
torbrowser: prefer local builds
The build consists of downloading some stuff & writing a wrapper, the
additional Hydra load is hardly justified.
2016-12-14 03:45:50 +01:00
Joachim Fasting 2221130710
torbrowser: support pulseaudio playback 2016-12-14 03:13:18 +01:00
Joachim Fasting 96be6a11a8
torbrowser: support H.264 playback
Fixes https://github.com/NixOS/nixpkgs/issues/20840

Some notes for future reference:
- Firefox only supports legacy gstreamer (0.10)
- gmp and ffmpeg are appearantly used by gst-ffmpeg so must be in the
  library search path
- Setting GST_DEBUG="*:3" or so was useful in figuring out what to add
2016-12-14 03:13:02 +01:00
Joachim Fasting a26acf99ad
torbrowser: 6.0.7 -> 6.0.8 2016-12-13 23:47:57 +01:00
Joachim Fasting 07c0cdcba2
torsocks: enable install check 2016-12-05 13:18:54 +01:00
Joachim Fasting 95608c3e8d
torsocks: redo patching, ensure getcap is available 2016-12-05 13:18:50 +01:00
Joachim Fasting 8aebb6b181
torsocks: expression cleanups
- Remove redundant preConfigure
  torsocks installs into $libdir/torsocks, so setting libdir=$out/lib
  doesn't really help.  To put the shared objects into $out/lib we'd have
  to manually move them into $out and patch various files (the script
  itself expects $libdir/torsocks).
- Use nativeBuildInputs
2016-12-05 13:18:47 +01:00
Joachim Fasting 9353d8c1ea
torsocks: 2.1.0 -> 2.2.0 2016-12-05 13:18:08 +01:00
Joachim Fasting d06bf820ea
tor: 0.2.8.9 -> 0.2.8.10
Per upstream, this contains primarily stability & performance fixes.
Notably, the relase fixes a bug that would sometimes make clients
unusable after leaving standby mode, as well as plugging a memory leak.
2016-12-03 07:17:13 +01:00
Susan Potter 75cdbf48ae
torbrowser: 6.0.6 -> 6.0.7 2016-12-01 00:13:58 -06:00
Frederik Rietdijk 09a5864d28 tor-arm: use python2 2016-11-24 22:28:03 +01:00
Joachim Fasting f477bc98be
torbrowser: 6.0.5 -> 6.0.6 2016-11-15 22:57:35 +01:00
Frederik Rietdijk e56832d730 Merge remote-tracking branch 'upstream/master' into HEAD 2016-10-22 17:23:24 +02:00
Joachim Fasting b3ffc580ec
tor: 0.2.8.8 -> 0.2.8.9
Fixes a security hole that could be exploited for a denial of service
attack against a tor client, relay, hidden service, or authority [1].

[1]: https://trac.torproject.org/projects/tor/ticket/20384
2016-10-18 00:44:41 +02:00
Vladimír Čunát 6eeea6effd Python: more evaluation fixups. 2016-10-14 00:03:12 +02:00
Joachim Fasting f0c85376b2
tor: 0.2.8.7 -> 0.2.8.8
Fixes two crashing bugs, nothing else of note.
2016-09-24 15:47:28 +02:00
sternenseemann 7d20f1b5b7 torbrowser: 6.0.4 -> 6.0.5 2016-09-16 15:57:22 +02:00
Kirill Boltaev bccd75094f treewide: explicitly specify gtk and related package versions 2016-09-12 18:26:06 +03:00
Joachim Fasting 5a2dbb1b8b
tor: 0.2.7.6 -> 0.2.8.7
Also:
- Turn patchPhase into postPatch
- Add systemd and libcap on linux (and also pkgconfig for detection);
  we should be able to change the service unit to Type=notify
- Disable checks for now, the test-suite is failing in sandbox due to
  lack of network
2016-08-26 17:18:56 +02:00
Joachim Fasting cb5a2acaa1
torbrowser: 6.0.2 -> 6.0.4
Tested briefly on x86_64-linux

Closes: https://github.com/NixOS/nixpkgs/issues/17750
2016-08-17 20:53:47 +02:00
Joachim Fasting 9675384c7b
torbrowser: 6.0.1 -> 6.0.2 2016-06-23 00:55:54 +02:00
Joachim Fasting 8fc6ca75a9
torbrowser: 6.0 -> 6.0.1 2016-06-08 16:51:53 +02:00
Tuomas Tynkkynen bac26e08db Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
Joachim Fasting 961164a8a7
torbrowser: explicitly set paths to torrc-defaults and tor
This patch fixes an issue introduced by b897f825942b63ab790cad9ed66c8a79cbb3fc2d
where the bundled tor fails to run.

The error message claims that it cannot communicate with tor, but what actually
happens is that tor never runs at all, because it is invoked with a non-existent
rc file.  Specifying an absolute path to the torrc-defaults file fixes the
problem.  For good measure, we specify an absolute path to the tor executable
itself as well; we want as little autodetection logic as possible.

Note that users of torbrowser *must* remove the existing `~/.torbrowser4` folder
for this to take effect, otherwise torbrowser will continue to use extension
data from the previous release (this is why some existing users were able to
successfully use the new torbrowser version, see
https://github.com/NixOS/nixpkgs/pull/15854).
2016-05-31 23:37:20 +02:00
Mayeu - Cast 4e20fa47e0 torbrowser: 5.5.5 -> 6.0 (#15854) 2016-05-31 15:12:19 +02:00
Joachim Fasting 0a04f7a870
torbrowser: fix paths to pluggable transports
With this patch I'm at least able to connect using the obfs4 transport
2016-05-01 21:27:25 +02:00
Joachim Fasting 3994a236bb
tor-arm: build recipe improvements
- Fix install of man page
- Remove redundant for loop
- Access python interpreter via pythonPackages
- Remove redundant build inputs (captured via replacement anyway)
- Fix install location of sample rc file.  For whatever reason, the
  install script ends up thinking it needs to use tor-arm, so override
  it
- Clarify meta.description
2016-04-30 22:25:46 +02:00