March 2015 - tbb-commits - lists.torproject.org

[tor-browser-bundle/master] Correct the 4.0.6 changelog entry.
by mikeperry＠torproject.org 31 Mar '15

31 Mar '15

commit f0e347d9bc11e0de91350fadc2e7e703e2380e17 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 31 13:56:51 2015 -0700 Correct the 4.0.6 changelog entry. --- Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 0292d82..056caf3 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -52,6 +52,7 @@ Tor Browser 4.0.6 -- Mar 31 2015 * All Platforms * Update Firefox to 31.6.0esr * Update meek to 0.16 + * Update OpenSSL to 1.0.1m Tor Browser 4.0.5 -- Mar 23 2015 * All Platforms

1 0

[torbutton/master] Fix small typo in comment
by gk＠torproject.org 31 Mar '15

31 Mar '15

commit fc0c8ed76346f2bb0b4d139ca444cbc404df5d07 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 31 07:33:51 2015 +0000 Fix small typo in comment --- src/modules/tor-control-port.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index e4c7d16..de9f10a 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -606,7 +606,7 @@ event.messageToData = function (type, message) { // __event.watchEvent(controlSocket, type, filter, onData)__. // Watches for a particular type of event. If filter(data) returns true, the event's -// data is pass to the onData callback. Returns a zero arg function that +// data is passed to the onData callback. Returns a zero arg function that // stops watching the event. event.watchEvent = function (controlSocket, type, filter, onData) { return controlSocket.addNotificationCallback(new RegExp("^650." + type, "i"),

1 0

[torbutton/master] Bug #15510: Detach event watchers when finished
by gk＠torproject.org 31 Mar '15

31 Mar '15

commit f0e1d504dbf57f0c0041ae14f32a5a092a8a1afe Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Mar 30 14:50:27 2015 -0700 Bug #15510: Detach event watchers when finished --- src/chrome/content/tor-circuit-display.js | 15 +++++++++++---- src/modules/tor-control-port.js | 10 +++++----- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/chrome/content/tor-circuit-display.js b/src/chrome/content/tor-circuit-display.js index 917f1f0..4197944 100644 --- a/src/chrome/content/tor-circuit-display.js +++ b/src/chrome/content/tor-circuit-display.js @@ -129,7 +129,7 @@ let getCircuitStatusByID = function* (aController, circuitID) { // corresponding circuit. Whenever the first stream on a new circuit is seen, // looks up u+p and records the node data in the credentialsToNodeDataMap. let collectIsolationData = function (aController) { - aController.watchEvent( + return aController.watchEvent( "STREAM", streamEvent => streamEvent.StreamStatus === "SENTCONNECT", streamEvent => Task.spawn(function* () { @@ -313,10 +313,13 @@ let syncDisplayWithSelectedTab = (function() { // A reference to this function (called createTorCircuitDisplay) is exported as a global. let setupDisplay = function (host, port, password, enablePrefName) { let myController = null, + stopCollectingIsolationData = null, stop = function() { if (myController) { syncDisplayWithSelectedTab(false); - myController.close(); + if (stopCollectingIsolationData) { + stopCollectingIsolationData(); + } myController = null; } }, @@ -326,16 +329,20 @@ let setupDisplay = function (host, port, password, enablePrefName) { // An error has occurred. logger.eclog(5, err); logger.eclog(5, "Disabling tor display circuit because of an error."); + myController.close(); stop(); }); syncDisplayWithSelectedTab(true); - collectIsolationData(myController); + stopCollectingIsolationData = collectIsolationData(myController); } }; try { let unbindPref = bindPrefAndInit(enablePrefName, on => { if (on) start(); else stop(); }); // When this chrome window is unloaded, we need to unbind the pref. - window.addEventListener("unload", unbindPref); + window.addEventListener("unload", function () { + unbindPref(); + stop(); + }); } catch (e) { logger.eclog(5, "Error: " + e.message + "\n" + e.stack); } diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index 710643e..e4c7d16 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -606,9 +606,10 @@ event.messageToData = function (type, message) { // __event.watchEvent(controlSocket, type, filter, onData)__. // Watches for a particular type of event. If filter(data) returns true, the event's -// data is pass to the onData callback. +// data is pass to the onData callback. Returns a zero arg function that +// stops watching the event. event.watchEvent = function (controlSocket, type, filter, onData) { - controlSocket.addNotificationCallback(new RegExp("^650." + type, "i"), + return controlSocket.addNotificationCallback(new RegExp("^650." + type, "i"), function (message) { let data = event.messageToData(type, message); if (filter === null || filter(data)) { @@ -635,9 +636,8 @@ tor.controller = function (host, port, password, onError) { return { getInfo : key => info.getInfo(socket, key), getInfoMultiple : keys => info.getInfoMultiple(socket, keys), getConf : key => info.getConf(socket, key), - watchEvent : function (type, filter, onData) { - event.watchEvent(socket, type, filter, onData); - }, + watchEvent : (type, filter, onData) => + event.watchEvent(socket, type, filter, onData), isOpen : () => isOpen, close : () => { isOpen = false; socket.close(); } };

1 0

[torbutton/master] Bug #15472: Make node text black in circuit status UI.
by gk＠torproject.org 30 Mar '15

30 Mar '15

commit 6f5b6ea7b976c678ac1032378653f3dc286582e0 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 27 20:34:34 2015 -0700 Bug #15472: Make node text black in circuit status UI. --- src/chrome/skin/tor-circuit-display.css | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/chrome/skin/tor-circuit-display.css b/src/chrome/skin/tor-circuit-display.css index 004a68f..fc18f05 100644 --- a/src/chrome/skin/tor-circuit-display.css +++ b/src/chrome/skin/tor-circuit-display.css @@ -1,16 +1,16 @@ /* -This CSS file is for styling the tor circuit display. It consists of a title, +This CSS file is for styling the tor circuit display, which consists of a title, a domain, and a bulleted list. Each bullet in the circuit node list is supposed to represent a Tor circuit node, and lines drawn between them to represent Tor network inter-relay connections. -CSS for line between bullets is Derived in part from https://jsfiddle.net/5JP8Q/ - -Color the background to make circuit display distinct from the rest of popup. +CSS for line between bullets is derived in part from https://jsfiddle.net/5JP8Q/ */ -/* The circuit-display div encloses all other HTML elements. */ +/* The circuit-display div encloses all other HTML elements. + Color the background to make circuit display distinct + from the rest of the popup. */ div#circuit-display { background-color: #e8f4f4; font-family: Arial; @@ -40,6 +40,7 @@ div#circuit-display p#domain { ul#circuit-nodes { font-family: Arial; font-size: 14px; + color: black; margin-top: 8px; padding-left: 8px; padding-right: 8px;

1 0

[torbutton/master] Fix word order on security slider notification.
by mikeperry＠torproject.org 28 Mar '15

28 Mar '15

commit 71e3da38a123fed8c240311f3aec90fd632234a3 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 17:12:53 2015 -0700 Fix word order on security slider notification. Sorry, translators :/. --- src/chrome/locale/en/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/locale/en/torbutton.properties b/src/chrome/locale/en/torbutton.properties index ef1723e..ca048df 100644 --- a/src/chrome/locale/en/torbutton.properties +++ b/src/chrome/locale/en/torbutton.properties @@ -55,7 +55,7 @@ torbutton.popup.confirm_plugins = Plugins such as Flash can harm your privacy an torbutton.popup.never_ask_again = Never ask me again torbutton.popup.confirm_newnym = Tor Browser will close all windows and tabs. All website sessions will be lost.\n\nRestart Tor Browser now to reset your identity?\n\n -torbutton.slider_notification = The green onion menu has now a security slider which lets you adjust your security level. Check it out! +torbutton.slider_notification = The green onion menu now has a security slider which lets you adjust your security level. Check it out! torbutton.slider_notification_button = Open security settings torbutton.maximize_warning = Maximizing Tor Browser can allow websites to determine your monitor size, which can be used to track you. We recommend that you leave Tor Browser windows in their original default size.

1 0

[tor-browser-bundle/master] Actually include NoScript 2.6.9.19.
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit 73447ce681adb4f9e4f9d08c44b8ed47dd3e327c Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 14:31:11 2015 -0700 Actually include NoScript 2.6.9.19. --- gitian/versions.alpha | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 5c9ffb9..6976ea8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -58,7 +58,7 @@ GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.15-sm+fn+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.19-fx+fn+sm.xpi HTTPSE_PACKAGE=https-everywhere-${HTTPSE_VER}.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz @@ -87,7 +87,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=63d866458e0261d20b612193f8f446728c991dd488c59e49d8f927c63e7eb9b4 +NOSCRIPT_HASH=2579b91fb2f5491a12c49e543a9d2b2583dc82e2393ce1b0ab92b170dcc7c6ad HTTPSE_HASH=059b6141b200c18f5903550d0ee6bdec1e1b874b7e069d246466e77bf3a436c2 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/master] Bug 15482: Restrict circuit lifetime extension to SOCKS-auth streams.
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit 351ecc463ff860e617e690ec709e80ec76f0be53 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 13:01:45 2015 -0700 Bug 15482: Restrict circuit lifetime extension to SOCKS-auth streams. That way people's non-TBB activity won't be affected. --- gitian/patches/bug15482.patch | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/gitian/patches/bug15482.patch b/gitian/patches/bug15482.patch index 5250fe4..df8a156 100644 --- a/gitian/patches/bug15482.patch +++ b/gitian/patches/bug15482.patch @@ -1,29 +1,37 @@ -From a9c7e6dc3508e78f4b296e38603dd34174e2a14c Mon Sep 17 00:00:00 2001 +From 748414784f71126b093aa7466908e00f71a7b046 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)torproject.org> -Date: Thu, 26 Mar 2015 22:38:45 -0700 -Subject: [PATCH] Bug 15482: Don't abandon circuits that are still being used - by TBB. +Date: Fri, 27 Mar 2015 12:57:37 -0700 +Subject: [PATCH] Bug 15482: Don't abandon circuits that are still in use for + browsing. -Reset timestamp_dirty every time we get a new stream request so that circuits -are not abandoned while still in use. +Only applies to connections with SOCKS auth set, so that non-web Tor +activity is not affected. + +Simpler version of Nick's patch because the randomness worried me, and I'm not +otherwise sure why we want a max here. --- - src/or/circuituse.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) + src/or/circuituse.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c -index d0d31ad..fff46cd 100644 +index d0d31ad..6cce4bf 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c -@@ -2264,8 +2264,10 @@ connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, +@@ -2264,8 +2264,15 @@ connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT; - if (!circ->base_.timestamp_dirty) - circ->base_.timestamp_dirty = time(NULL); -+ /* For Tor Browser, we want to avoid surprising the user by giving up on -+ * circuits while they are still being used, so we always reset the -+ * dirtiness timestamp. */ -+ circ->base_.timestamp_dirty = time(NULL); ++ if (!circ->base_.timestamp_dirty) { ++ circ->base_.timestamp_dirty = approx_time(); ++ } else if ((conn->entry_cfg.isolation_flags & ISO_SOCKSAUTH) && ++ (conn->socks_request->usernamelen || ++ conn->socks_request->passwordlen)) { ++ /* When stream isolation is in use and controlled by an application ++ * we are willing to keep using the stream. */ ++ circ->base_.timestamp_dirty = approx_time(); ++ } pathbias_count_use_attempt(circ);

1 0

[torbutton/master] Fix 1.9.1.0 changelog
by gk＠torproject.org 27 Mar '15

27 Mar '15

commit 3fd6a708722a56c6ba283ba55417c99c768dbf03 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Mar 27 15:04:45 2015 +0000 Fix 1.9.1.0 changelog --- src/CHANGELOG | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index e9b5c6b..e140ff5 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -16,7 +16,8 @@ * Bug 14937: Show meek and flashproxy bridges in tor circuit display * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges * Bug 13019: Change locale hiding pref to boolean - * Bug 7255: Warn users about maximizing windows (off by default) + * Bug 7255: Warn users about maximizing windows + * Bug 14631: Improve profile access error msgs (strings). 1.9.0.0 * Bug 13882: Fix display of bridges after bridge settings have been changed

1 0

[tor-browser-bundle/master] Fix the 4.5a5 changelog
by gk＠torproject.org 27 Mar '15

27 Mar '15

commit 089db12fdc4ebd18e3fa2d5e970f4c5f8843990e Author: Georg Koppen <gk(a)torproject.org> Date: Fri Mar 27 14:57:42 2015 +0000 Fix the 4.5a5 changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f27632f..0292d82 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -27,6 +27,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges * Bug 13019: Change locale hiding pref to boolean * Bug 7255: Warn users about maximizing windows + * Bug 14631: Improve profile access error msgs (strings). * Pluggable Transport Dependency Updates: * Bug 15448: Use golang 1.4.2 for meek and obs4proxy * Bug 15265: Switch go.net repo to golang.org/x/net @@ -43,6 +44,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Bug 13375: Create a hybrid GUI/desktop/shell launcher wrapper * Bug 12468: Only print/write log messages if launched with --debug * Windows + * Bug 3861: Begin signing Tor Browser for Windows the Windows way * Bug 15201: Disable 'runas Administrator' codepaths in updater * Bug 14688: Create shortcuts to desktop and start menu by default (optional)

1 0

[tor-browser-bundle/master] HTTPS-Everywhere is so easy to forget. Maybe because it works so well?
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit be94df05ea2c58a34e4084b74b653f277a136a44 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 00:03:17 2015 -0700 HTTPS-Everywhere is so easy to forget. Maybe because it works so well? --- Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40833da..f27632f 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -4,6 +4,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Update OpenSSL to 1.0.1m * Update Tor to 0.2.6.6 * Update NoScript to 2.6.9.19 + * Update HTTPS-Everywhere to 5.0 * Update meek to 0.16 * Update Tor Launcher to 0.2.7.3 * Bug 13983: Directory search path fix for Tor Messanger+TorBirdy

1 0