Bug 203014
|
Description
George
2015-09-10 13:31:14 UTC
It seems that the current security/tor-devel port is at 0.2.7.2, but the pkgs are out of sync only. My mistake since I was relying on freshports.org, but nevertheless the pkgs are out of sync. Created attachment 162605 [details]
[PATCH] security/tor: r400464
Minor typos and updates for pkg-message.in and tor.in.
Added a radio option to use one pluggable transport proxy (security/obfsproxy).
libevent was detected by the configure script without previous patch, so the patch was removed from files/ directory. "post-patch" kept as is. Checked support for 11.0-CURRENT, 10.2-STABLE and 9.3-RELEASE (considering old OSVERSION and OpenSSL version present on base system). As reported by #204123, OpenSSL from ports should be used instead.
Static tor was compiled to test the patch removal. It works.
Created attachment 162606 [details]
[PATCH] security/tor-devel: r400391
Same as the last one, for security/tor, but adds code to support tor-0.2.7.4-rc.
Minor typos and updates for pkg-message.in and tor.in.
Added a radio option to use one pluggable transport proxy (security/obfsproxy).
Once again, libevent was detected by the configure script without previous patch, so the patch was removed from files/ directory. "post-patch" kept as is. Checked support for 11.0-CURRENT, 10.2-STABLE and 9.3-RELEASE (considering old OSVERSION and OpenSSL version present on base system). As reported by #204123, OpenSSL from ports should be used instead.
Static tor was also compiled to test the patch removal.
Created attachment 162608 [details]
[LOG] Poudriere Bulk: 9.3-RELEASE, amd64 (security/tor)
Created attachment 162609 [details]
[LOG] Poudriere Bulk: 10.2-STABLE, amd64 (security/tor)
Created attachment 162610 [details]
[LOG] Poudriere Bulk: 11.0-CURRENT, amd64 (security/tor)
Created attachment 162611 [details]
[LOG] Poudriere Bulk: 9.3-RELEASE, amd64 (security/tor-devel)
Created attachment 162613 [details]
[LOG] Poudriere Bulk: 10.2-STABLE, amd64 (security/tor-devel)
Created attachment 162616 [details]
[LOG] Poudriere Bulk: 11.0-CURRENT, amd64 (security/tor-devel)
Created attachment 162630 [details]
[LOG] Poudriere Bulk: 10.2-STABLE, armv6 (security/tor)
Created attachment 162631 [details]
[LOG] Poudriere Bulk: 11.0-CURRENT, armv6 (security/tor)
Created attachment 162632 [details]
[LOG] Poudriere Bulk: 10.2-STABLE, armv6 (security/tor-devel)
Created attachment 162633 [details]
[LOG] Poudriere Bulk: 11.0-CURRENT, armv6 (security/tor-devel)
Created attachment 163253 [details]
[PATCH] security/tor: r400464
Following ideas and recommendations from danilo@ and garga@ for the BCP to code and contribute to the FreeBSD's Ports Collection, this patch (svn diff) aims to:
1. Adds all previous updates pointed by the last uploaded patch;
2. Changes OPTIONS_RADIO to OPTIONS_GROUP to group pluggable transports;
3. Solves an issue to build STATIC_TOR and TCMALLOC together.
Created attachment 163254 [details]
[PATCH] security/tor-devel: r400391
Same as the previously reported patch for security/tor, but updates and solves small issues related to security/tor-devel.
Created attachment 163337 [details] [PATCH] security/tor-devel: r400391 Again, following some BCP, this new patch: 1. Uses port options helpers; 2. Takes care of r399278; 2.1. https://reviews.freebsd.org/D3866 3. Adds a _precmd stage to better check "required_dirs="; 3.1. Rather than mkdir(1)+chown(8)+chmod(1) routines, uses install(1) 3.2. "check_required_before()" was breaking cheks before running new '_precmd' 3.3. "required_dirs=" was commented on patched rc script for future debugs Poudriere and manual config and testing for the patched-port worked as expected. Created attachment 163338 [details]
[PATCH] security/tor: r400464
Same as the last one but takes care of security/tor.
Created attachment 163340 [details]
[PATCH] security/tor: r400464
Corrects 2 small but serious typos on security/tor/Makefile.
Created attachment 163341 [details]
[LOG] Poudriere Bulk: 10.2-STABLE, i386 (security/tor)
Created attachment 163342 [details]
[LOG] Poudriere Bulk: 10.2-STABLE, i386 (security/tor-devel)
Created attachment 163355 [details]
[PATCH] security/tor: r400464
Handles old log files and creates a backup for it. If you are upgrading Tor from a previous version, Tor's rc script will fail with:
install: /var/log/tor exists but is not a directory
Previous logfile was the new logdir itself (/var/log/tor)! This patch updates everything else reported before and:
Check for an old log file;
Verify if the file content has Tor's log information;
Saves a backup!
Created attachment 163356 [details]
[PATCH] security/tor-devel: r400391
Same as the last one but for security/tor-devel.
Thanks.
If I recall correctly, the reason for the libevent changes, and for avoiding adding the clumsy LDFLAGS+="-L${LOCALBASE}/lib" whenever possible, was to fix the linking in the static case, and to avoid linking with the wrong libraries, such as openssl. I'll check that this works with the new tor-devel.
As far as the rc-script is concerned, I've resisted making such additions in the past when they're intended to avoid infrequent or one-time fixes, on the grounds that they add complexity to the script, often fail to handle custom configs properly, make assumptions about tools like awk, etc. being present when some of our users are running tor on smaller, stripped-down machines; and hide changes that really should be brought to the attention of users or administrators. Usually such changes are best handled manually, with a note in UPDATING or a pkg-message. This looks like such a case.
Created attachment 163538 [details] [PATCH] security/tor: r400464 This patch corrects everything else reported before, and updates "security/tor" to a new stable release. [ https://blog.torproject.org/blog/tor-0275-released-and-stable ] Thanks. But as I wrote before, we should do less in the rc script, rather than add machinery for an infrequent or one-time fix -- similar to the proposal in bug 204739 -- so I'll reconcile these two sets of changes. (In reply to Brendan Fabeny from comment #25) I agree. We don't want to pull a 'Lennart Poettering' and include features people didn't ask for. Most of the changes here in between, came from http://lists.nycbug.org/pipermail/tor-bsd/2015-November/000380.html Now that Chauhan points "L.P." it hurts... My perception was that we could help lazy people that forget (do not want) to read UPDATING and its change logs. Also, it's possible to minimize the impact on production relays running under FreeBSD machines. Created attachment 164153 [details] [PATCH] security/tor: r400464 This patch corrects everything else reported before by the last patches related to security/tor, and updates it to a new stable release (2.7.6). [ https://blog.torproject.org/blog/tor-0276-released ] I suggest to update it and split it into parts, as it probably won't apply any more, and parts will be easier to comprehend and discuss, and anyway need to be committed separately because some may need to be MFHd. After a quick glance:
- You can't omit ${PORTSDIR} from depends until a next quartely branch is created
- Datadir/logdir/piddir handling should be done in plist, not rc script. Backing up stuff does not belong to the port at all
- Test should be switched to new test framework
- MTMALLOC changes do not seem correct at all: you depend on shared library for static case, and use lib and build depends at the same time.
- OFSPROXY option is useless as it does nothing beyond adding a run-dependency
(In reply to Dmitry Marakasov from comment #29) Nice! I was really hoping to get a more clear feedback (like this one you did). Thank you very much for your time and concern amdmi3@. K.R., Vinícius Maintainer reset. Requesting feedback from new maintainer as to if these patches still apply. The current version is 0.2.8.9. This bug report needs to be closed as "overcome by events". Created attachment 176119 [details]
[PATCH] security/tor-devel: r424527
I did plan to release a new patch (suggestion) to take care of security/tor-devel, but right now there's no working code I can give you.
Nevertheless, I do think it might be useful to merge some useful "options helpers" and stuff... or provide a new starting point to both ports.
The (NOT WORKING) patch for security/tor-devel is attached, and comes with this considerations:
a) uses "options helpers", as recommended by porter's handbook;
b) '--enable-transparent' is no longer a valid config parameter;
c) proper OSVERSION for bumping openssl from ports is "< 1000015";
d) suggests the use of --with-tor-{user,group}=_tor;
e) it is a work in progress. it does not work yet :)
KR,
Vinícius
Thanks, I will look at the patched. Yuri Created attachment 176798 [details] [PATCH] security/tor-devel: r425755 (In reply to Yuri Victorovich from comment #35) Yuri, hi. Please take a look at this new patch when you have some time. It also updates security/tor-devel to version 0.2.9.5-alpha. This one is pretty much close to the best practices described by the Porter's Handbook, and let the user chose between 'ssl=base' or any other from ports. There's also the considerations pointed by brnrd@ (I think), to set USES+=ssl only when we try to compile Tor using ports' openssl/libressl from ports. I added/merged your warning about Tor2Web, as reported (and solved) on #210389. KR, Vinícius Comment on attachment 176798 [details]
[PATCH] security/tor-devel: r425755
Thanks Vinícius!
Poudriere logs OK on 9.3/10.1/11.0/12.0 i386/amd64 and 11.0-armv6 (10.1-armv6 and 12.0-armv6 failed on dependencies) Please note that the subject is wrong, it should be "security/tor-devel: Update and fix a few problems". Actually tor 0.2.9.5-alpha fails on FreeBSD 9.3 because its bundled copy of OpenSSL is too old, see the attached log. Created attachment 176829 [details]
poudriere log of 9.3-i386, OpenSSL too old
(In reply to Rene Ladan from comment #40) This was the issue since Tor 0.2.7.2-alpha, looking back at the ChangeLog. Is security/tor also failing on 9.3? I'll test-build current security/tor (0.2.8.9) on 9.3 i386 and amd64 security/tor builds fine on 9.3-i386, looking at the diff between the two ports, I thought that this typo was the culprit (around line 90):
-.if ${OSVERSION} < 1000000
-WITH_OPENSSL_PORT= yes
-.endif
-
-.if !defined(USE_GCC) && empty(CC:T:M*gcc4*) && \
-empty(PORT_OPTIONS:MSTATIC_TOR) && empty(ARCH:Mia64)
-CONFIGURE_ARGS+= --enable-gcc-hardening
-.else
-CONFIGURE_ARGS+= --disable-gcc-hardening
+.if ${OSVERSION} < 1000015
+DEFAULT_VERSIONS+= ssl=openssl
+# OPENSSL_PORT= security/openssl
+WITH_OPENSSLPORT= yes <-- missing space between OPENSSL and PORT ?
.endif
But that gives the same error. I think the solution is to always use OpenSSL from ports on 9.3. I'll test a patched Makefile
Created attachment 176832 [details] [PATCH] security/tor-devel: r425755 (In reply to Rene Ladan from comment #45) ooops! you are right. there was a little typo to be corrected... and this new patch solves it! yes; it's focused on security/tor-devel only. if everything goes well, security/tor can get/merge its updates. thank you very much for your time, and feedback :) Thank you for doing this! Go ahead and commit the patch if you are sure it fixes the problem. Yuri No, I doesn't fix it in my tests, see the rest of comment 45. I think you also have to adjust the configure flags/environment for FreeBSD 9.3. And not setting a default for SSLTLS seems to break the port in other ways, weird. Created attachment 176857 [details] [PATCH] security/tor-devel: r425808 (In reply to Rene Ladan from comment #48) hm... I did think that typo should handle the things properly. good to know it did not. thanks! your tests ran in a 9.3-release environment, so we can check OSVERSION for values <= 903000 and change OPTIONS_DEFAULT= to "SSLTLS_PORTS". that could do the trick. or, afaik, 903511 is the last documented OSVERSION (https://www.freebsd.org/doc/en_US.ISO8859-1/books/porters-handbook/versions-9.html) related to 9.x, and we should use it: .if ${OSVERSION} < 903511 OPTIONS_DEFAULT= SSLTLS_PORTS .endif the attached patch adds it to the Makefile // sorry for not running a test on 9.x before reporting it back; I need to setup+upgrade my env. kr, vinícius (In reply to Vinícius Zavam from comment #49) -${OSVERSION} < 903511 +${OSVERSION} <= 903511 Created attachment 176858 [details]
[PATCH] security/tor-devel: r425808
Created attachment 176873 [details]
[PATCH] security/tor-devel: r425808
latest patch.
Created attachment 176874 [details]
[LOG] security/tor-devel: r425808 (9.3-RELEASE-p50, amd64)
Created attachment 176875 [details]
[LOG] security/tor-devel: r425808 (9.3-RELEASE-p50, i386)
my poudriere's bulk logs are available at http://[2604:a880:400:d0::477:4001]/logs/ (because some files are bigger than the max allowed to attach here). if someone can test it against 9.3-stable, it would be great! same for other architectures like arm, aarch64 and/or mips. kr, vinícius I'm going to buy a couple new RPI3 devices this weekend with the goal of setting up a tor relay and/or bridge. I can give it a whirl soon-ish. @ Vinícius Zavam: I can reach your server but it refuses to serve the logs, instead it gives an HTTP 403 (In reply to Rene Ladan from comment #57) Wow! Sorry about that. Please try to get it now, and... if someone needs to reach it over v4: http://192.241.135.129/logs see also: bug#214567 is a simple update to 0.2.9.5-alpha. Created attachment 177615 [details] [PATCH] security/tor-devel: r427582 this patch obsoletes the last one; it updates security/tor-devel to version 0.2.9.6-rc. bug #215009 does not solves issues or improves security/tor-devel like this patch does. please test it and report any issues you might get with it! more information about this current patch, please refer to previous comments posted here. kr, vinícius PS: there's just one missing suggestion that this patch does not apply, and it is the presence of a default log file for the Tor daemon. Your new patch builds and runs fine on amd64, though I haven't tried anything other than starting it up. Additionally, I compiled with PIE, RELRO + BIND_NOW, and SafeStack enabled in HardenedBSD. Created attachment 177618 [details] [PATCH] security/tor-devel: r427582 (logging by default) (In reply to Shawn Webb from comment #61) tyvm, shawn! here I also add a new patch with an improved tor.in, so we get a default log for Tor (with 'notice' severity); its severity can easily be changed via sysrc(8), if needed. the current port does not ship with this feature. if you need to see/confirm that the Tor daemon is really running with a working circuit just check the log. What is the current status of this PR, are parts still applicable? (In reply to Rene Ladan from comment #63) The idea behind all patches and suggestions are definitely something we could apply to both ports. Unfortunately I decided to move all the efforts and new codes to a small/partial GitHub repository, and choose no longer to post or bump more things here. If there's any chance it hits "upstream" (official FreeBSD ports), I would be happy to help and work on merging stuff up. The current repository+branch with both ports and related works is https://github.com/egypcio/freebsd-ports/tree/torbsd Main changes in between official branch and the GH stuff? Makefiles were "completely" redesigned and the rc script does not support the idea of multi instances (if one wants to run Tor like that, should separate it using jails). pkg-message and pkg-descr cosmetics. Thank you very much for writing back! Very appreciated. This PR outlived its usefulness, any development is now done in a GitHub repository. |
