May 2017 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 9b5324a8bb68e1e8e10d113e087db24aee712fe4 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 12:49:08 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Mozilla still finds critical bugs in Graphite, let#s keep it disabled for now. Fixes bug 21726. --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 9483702..05899cc 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -245,6 +245,9 @@ pref("mathml.disabled", false); // Until we address at least the linkability concerns in #19417 let's disable // asmjs. pref("javascript.options.asmjs", false); +// Mozilla keeps still finding critical bugs in Graphite code. Disable it for +// now, see bug 21726. +pref("gfx.font_rendering.graphite.enabled"; false); // Network and performance pref("network.http.pipelining", true);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] Bug 22165: Block DoListAddresses when resisting fingerprinting
by gk＠torproject.org 12 May '17

12 May '17

commit 2c50abdbdd215f7a84211ce70d8c75a0a6f97187 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu May 11 13:58:24 2017 -0700 Bug 22165: Block DoListAddresses when resisting fingerprinting --- netwerk/base/NetworkInfoServiceCocoa.cpp | 6 ++++++ netwerk/base/NetworkInfoServiceLinux.cpp | 6 ++++++ netwerk/base/NetworkInfoServiceWindows.cpp | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/netwerk/base/NetworkInfoServiceCocoa.cpp b/netwerk/base/NetworkInfoServiceCocoa.cpp index 937c726..c2d8e2c 100644 --- a/netwerk/base/NetworkInfoServiceCocoa.cpp +++ b/netwerk/base/NetworkInfoServiceCocoa.cpp @@ -17,6 +17,8 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { @@ -26,6 +28,10 @@ ListInterfaceAddresses(int aFd, const char* aIface, AddrMapType& aAddrMap); nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return NS_ERROR_FAILURE; diff --git a/netwerk/base/NetworkInfoServiceLinux.cpp b/netwerk/base/NetworkInfoServiceLinux.cpp index 96627cf..6f72e9c 100644 --- a/netwerk/base/NetworkInfoServiceLinux.cpp +++ b/netwerk/base/NetworkInfoServiceLinux.cpp @@ -17,6 +17,8 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { @@ -26,6 +28,10 @@ ListInterfaceAddresses(int aFd, const char* aIface, AddrMapType& aAddrMap); nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + int fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { return NS_ERROR_FAILURE; diff --git a/netwerk/base/NetworkInfoServiceWindows.cpp b/netwerk/base/NetworkInfoServiceWindows.cpp index 2a9448e..9e01d81 100644 --- a/netwerk/base/NetworkInfoServiceWindows.cpp +++ b/netwerk/base/NetworkInfoServiceWindows.cpp @@ -12,12 +12,18 @@ #include "NetworkInfoServiceImpl.h" +#include "nsContentUtils.h" + namespace mozilla { namespace net { nsresult DoListAddresses(AddrMapType& aAddrMap) { + if (nsContentUtils::ShouldResistFingerprinting()) { + return NS_ERROR_FAILURE; + } + UniquePtr<MIB_IPADDRTABLE> ipAddrTable; DWORD size = sizeof(MIB_IPADDRTABLE);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 38e1a1966adbbcb5a15edbf300f33f5de8d7aae6 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 15:11:46 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. The old blocklist update system is still running. Thus, no need to contact the new, on Kinto based system in addition. Fixes bug 22071. --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 73cb896..9483702 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -29,6 +29,10 @@ pref("extensions.hotfix.id", ""); // Bug 16837: Disable hotfix updates as they m pref("app.update.staging.enabled", false); #endif +// No need to contact the Kinto-based blocklist system in addition to the old +// one which is still used, see bug 22071. +pref("services.blocklist.update_enabled", false); + // Disable "Slow startup" warnings and associated disk history // (bug #13346) pref("browser.slowStartup.notificationDisabled", true);

1 0

[tor-browser-bundle/master] Bug 22153: Fix broken feeds on higher security levels
by gk＠torproject.org 12 May '17

12 May '17

commit f367c1dca399a1b15e3da8e098c1de2d7fd36c72 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:21:04 2017 +0000 Bug 22153: Fix broken feeds on higher security levels We need to allow JavaScript on feed pages explicitly. Otherwise are those pages broken on higher security levels. --- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- .../Data/Browser/profile.default/preferences/extension-overrides.js | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/linux/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/mac/TorBrowser/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false); diff --git a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js index 2ad9731..53c1a25 100644 --- a/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js +++ b/Bundle-Data/windows/Data/Browser/profile.default/preferences/extension-overrides.js @@ -8,9 +8,9 @@ pref("extensions.https_everywhere.toolbar_hint_shown", true); # NoScript Preferences: pref("capability.policy.maonoscript.javascript.enabled", "allAccess"); -pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); -pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror"); +pref("capability.policy.maonoscript.sites", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.default", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); +pref("noscript.mandatory", "about: about:tbupdate chrome: resource: blob: mediasource: moz-safe-about: about:neterror about:certerror about:feeds"); pref("noscript.ABE.enabled", false); pref("noscript.ABE.notify", false); pref("noscript.ABE.wanIpAsLocal", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 7406c8357ef42e8ec3fa19dc2bb20e0b9f8f3025 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 10:23:09 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We disable the Microsoft's Family Safety for MitM concerns, see bug 21686. --- browser/app/profile/000-tor-browser.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index a948c45..73cb896 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -314,6 +314,9 @@ pref("security.tls.unrestricted_rc4_fallback", false); // Enforce certificate pinning, see: https://bugs.torproject.org/16206 pref("security.cert_pinning.enforcement_level", 2); +// Don't allow MitM via Microsoft Family Safety, see bug 21686 +pref("security.family_safety.mode", 0); + // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit 859140af51e3a6e9aee5b745cc2e48d061d7fb4f Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 10:31:59 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. No need to leak local network things to Mozilla, see bug 21790 --- browser/app/profile/000-tor-browser.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 5261c28..a948c45 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -257,7 +257,8 @@ pref("network.http.pipelining.read-timeout", 60000); pref("network.http.pipelining.max-optimistic-requests", 3); pref("security.ssl.disable_session_identifiers", true); pref("network.manage-offline-status", false); - +// No need to leak things to Mozilla, see bug 21790 +pref("network.captive-portal-service.enabled", false); // As a "defense in depth" measure, configure an empty push server URL (the // DOM Push features are disabled by default via other prefs). pref("dom.push.serverURL", "");

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit c56819cf6e7f9f394d2ce8553ccd77f7a6559644 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 13:28:50 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. We don't need any Mozilla experiments in Tor Browser. Let's make sure this feature is disabled. Fixes bug 22073. --- browser/app/profile/000-tor-browser.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 956eb2d..5261c28 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -80,6 +80,8 @@ pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); pref("browser.selfsupport.enabled", false); pref("browser.selfsupport.url", ""); pref("toolkit.telemetry.unified", false); +// No experiments, use Tor Browser. See 21797. +pref("experiments.enabled", false); // Disable the UITour backend so there is no chance that a remote page // can use it to confuse Tor Browser users. pref("browser.uitour.enabled", false);

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 12 May '17

12 May '17

commit e4848686fd6078cd9cbdf3c8a9fe979f0f9a7283 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 13:05:35 2017 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Hide the TLS error reporting checkbox for now as Mozilla seems to be the wrong party to get Tor Browser reports. One day we might want to repurpose this checkbox to point to our own infrastructure to help finding bad relays (see bug 19119). Fixes bug 22072. --- browser/app/profile/000-tor-browser.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 98cfec5..956eb2d 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -314,6 +314,11 @@ pref("security.cert_pinning.enforcement_level", 2); // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2); +// Avoid report TLS errors to Mozilla. We might want to repurpose this feature +// one day to help detecting bad relays (which is bug 19119). For now we just +// hide the checkbox, see bug 22072. +pref("security.ssl.errorReporting.enabled", false); + // Workaround for https://bugs.torproject.org/13579. Progress on // `about:downloads` is only shown if the following preference is set to `true` // in case the download panel got removed from the toolbar.

1 0

[tor-browser/tor-browser-52.1.0esr-7.0-2] fixup! TB3: Tor Browser's official .mozconfigs.
by gk＠torproject.org 12 May '17

12 May '17

commit b51157dc9a520a693c2fb27ab3213e3bdf1cb5f1 Author: Georg Koppen <gk(a)torproject.org> Date: Fri May 12 14:05:05 2017 +0000 fixup! TB3: Tor Browser's official .mozconfigs. The executables are not PIE anymore with the switch to ESR52. We need to set --enable-pie now even though we still use the hardening wrapper. Fixes #22238, patch by boklm. --- .mozconfig | 1 + .mozconfig-asan | 1 + 2 files changed, 2 insertions(+) diff --git a/.mozconfig b/.mozconfig index cde5b49..4398849 100755 --- a/.mozconfig +++ b/.mozconfig @@ -27,3 +27,4 @@ ac_add_options --disable-webrtc ac_add_options --disable-eme #ac_add_options --disable-ctypes ac_add_options --enable-jemalloc=4 +ac_add_options --enable-pie diff --git a/.mozconfig-asan b/.mozconfig-asan index 096bcc6..87e5008 100644 --- a/.mozconfig-asan +++ b/.mozconfig-asan @@ -41,3 +41,4 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc #ac_add_options --disable-ctypes ac_add_options --disable-eme +ac_add_options --enable-pie

1 0

[tor-browser-build/master] Remove FTE from OSX torrc-defaults
by boklm＠torproject.org 12 May '17

12 May '17

commit 747b697d335a023bae8da70671275a6750e7e02d Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri May 12 13:42:11 2017 +0200 Remove FTE from OSX torrc-defaults --- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 3 --- 1 file changed, 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix index f5eb5e4..271b36c 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix @@ -1,6 +1,3 @@ -## fteproxy configuration -ClientTransportPlugin fte exec PluggableTransports/fteproxy.bin --managed - ## obfs4proxy configuration ClientTransportPlugin obfs2,obfs3,obfs4,scramblesuit exec PluggableTransports/obfs4proxy

1 0