June 2017 - tbb-commits - lists.torproject.org

[torbutton/master] Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 2e301c0a5bbc62fd5f8e66ac973c71f0bc10c81b Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jun 1 10:48:56 2017 -0400 Bug 22459: Adapt our use of the nsIContentPolicy to e10s mode Load our content policy module as a process script instead of as a component so that our nsIContentPolicy filter runs in content processes. Our http-on-examine-response code that blocks redirects to internal URLs must continue to run in the chrome process only. --- src/chrome.manifest | 4 ---- src/components/content-policy.js | 34 +++++++++++++++++++++++++++++----- src/components/startup-observer.js | 7 +++++++ 3 files changed, 36 insertions(+), 9 deletions(-) diff --git a/src/chrome.manifest b/src/chrome.manifest index ed3f5cf..75bef4e 100644 --- a/src/chrome.manifest +++ b/src/chrome.manifest @@ -166,10 +166,6 @@ contract @torproject.org/domain-isolator;1 {e33fd6d4-270f-475f-a96f-ff3140279f68 category profile-after-change CookieJarSelector @torproject.org/cookie-jar-selector;1 -component {4c03be7d-492f-990e-f0da-f3689e564898} components/content-policy.js -contract @torproject.org/content-policy;1 {4c03be7d-492f-990e-f0da-f3689e564898} -category content-policy ContentPolicy @torproject.org/content-policy;1 - category profile-after-change StartupObserver @torproject.org/startup-observer;1 category profile-after-change DomainIsolator @torproject.org/domain-isolator;1 category profile-after-change ExtAppBlockerService @torproject.org/torbutton-extAppBlockerService;1 diff --git a/src/components/content-policy.js b/src/components/content-policy.js index 096827b..365a5e5 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -22,13 +22,22 @@ function ContentPolicy() { function (enabled) { that.uriFingerprinting = enabled; }); + + // Register as an nsIContentPolicy filter. + let registrar = Components.manager.QueryInterface(Ci.nsIComponentRegistrar); + registrar.registerFactory(this.classID, this.classDescription, + this.contractID, this); + + let catMan = Cc["@mozilla.org/categorymanager;1"] + .getService(Ci.nsICategoryManager); + catMan.addCategoryEntry("content-policy", this.contractID, this.contractID, + false, true); } ContentPolicy.prototype = { classDescription: "ContentPolicy", classID: Components.ID("{4c03be7d-492f-990e-f0da-f3689e564898}"), contractID: "@torproject.org/content-policy;1", - QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy]), uriWhitelist: { // Video playback. @@ -51,6 +60,19 @@ ContentPolicy.prototype = { "chrome://global/skin/dirListing/dirListing.css": Ci.nsIContentPolicy.TYPE_STYLESHEET, }, + // nsISupports + QueryInterface: XPCOMUtils.generateQI([Ci.nsIContentPolicy, Ci.nsIFactory, + Ci.nsISupportsWeakReference]), + + // nsIFactory + createInstance: function(outer, iid) + { + if (outer) + throw Cr.NS_ERROR_NO_AGGREGATION; + return this.QueryInterface(iid); + }, + + // nsIContentPolicy shouldLoad: function(aContentType, aContentLocation, aRequestOrigin, aContext, aMimeTypeGuess, aExtra) { // Accept if the user does not care, no content URI is available or scheme @@ -121,8 +143,10 @@ var requestObserver = { }, }; -// Firefox >= 4.0 (Old versions are extremely irrelevant). -var NSGetFactory = XPCOMUtils.generateNSGetFactory([ContentPolicy]); +// Create a content policy object; initialization is done in the contructor. +var cp = new ContentPolicy(); -// Register the request observer to handle redirects. -requestObserver.start(); +// In the chrome process, register the request observer to handle redirects. +if (Services.appinfo.processType == Services.appinfo.PROCESS_TYPE_DEFAULT) { + requestObserver.start(); +} diff --git a/src/components/startup-observer.js b/src/components/startup-observer.js index 6698b0b..65ca659 100644 --- a/src/components/startup-observer.js +++ b/src/components/startup-observer.js @@ -60,6 +60,13 @@ function StartupObserver() { } catch(e) { this.logger.log(4, "Early proxy change failed. Will try again at profile load. Error: "+e); } + + // Arrange for our nsIContentPolicy filter to be loaded in the + // default (chrome) process as well as in each content process. + let ppmm = Cc["@mozilla.org/parentprocessmessagemanager;1"] + .getService(Ci.nsIProcessScriptLoader); + ppmm.loadProcessScript("resource://torbutton/components/content-policy.js", + true); } StartupObserver.prototype = {

1 0

[torbutton/master] Bug 21627: Ignore HTTP 304 responses when checking redirects.
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit ad937183266423425e166b417659b1db14aaeced Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Jun 1 11:06:09 2017 -0400 Bug 21627: Ignore HTTP 304 responses when checking redirects. Avoid noise on the error console when a page is reloaded. Since 304 responses do not have Location headers, it is safe to ignore such responses inside our http-on-examine-response observer. --- src/components/content-policy.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/components/content-policy.js b/src/components/content-policy.js index 365a5e5..a63919c 100644 --- a/src/components/content-policy.js +++ b/src/components/content-policy.js @@ -128,9 +128,9 @@ var requestObserver = { // If this is a redirect... // - // Note: Technically `304 Not Modifed` isn't a redirect, but receiving that - // to the proscribed schemes is nonsensical. - if (aStatus >= 300 && aStatus < 400) { + // Note: `304 Not Modifed` isn't a redirect, so there is no Location header to check + // in that case. + if (aStatus >= 300 && aStatus < 400 && aStatus != 304) { let location = aChannel.getResponseHeader("Location"); let aUri = this.ioService.newURI(location, null, null);

1 0

[tor-launcher/master] Version bump
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 529f2711c9a3cb5a652c2d52c549fd6d095f7949 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 1 14:38:20 2017 +0000 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index c0a6e20..14b29ce 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.12.1</em:version> + <em:version>0.2.12.2</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/master] Translations update
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 16e8d4f1b7d43bdd3921c1cc44a40338ebc38c36 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 1 14:37:12 2017 +0000 Translations update --- src/chrome/locale/fa/network-settings.dtd | 2 +- src/chrome/locale/fa/progress.dtd | 2 +- src/chrome/locale/fa/torlauncher.properties | 6 +++--- src/chrome/locale/nb/torlauncher.properties | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/chrome/locale/fa/network-settings.dtd b/src/chrome/locale/fa/network-settings.dtd index 939cc7c..490a77b 100644 --- a/src/chrome/locale/fa/network-settings.dtd +++ b/src/chrome/locale/fa/network-settings.dtd @@ -25,7 +25,7 @@ <!ENTITY torSettings.proxyExplanation1 "در بیشتر موارد نیازی به پروکسی محلی نمی باشد. با این حال ممکن است برای اتصال از طریق شبکه شرکت، مدرسه، یا دانشگاه مورد نیاز باشد."> <!ENTITY torSettings.proxyExplanation2 "اگر مطمئن نیستید چگونه به این سوال پاسخ دهید، به تنظیمات اینترنت خود در مرورگر دیگری و یا تنظیمات شبکه کامپیوتر خود رجوع کنید تا ببینید آیا به پروکسی محلی نیاز دارید یا خیر."> <!ENTITY torSettings.enterProxy "تنظیمات پراکسی را وارد کنید."> -<!ENTITY torSettings.bridgePageTitle "پیکربندی پل تٌر"> +<!ENTITY torSettings.bridgePageTitle "پیکربندی پل تور"> <!ENTITY torSettings.bridgeQuestion "آیا شرکتی که از آن اینترنت گرفته اید (ISP)، دسترسی به شبکه تور را فیلتر، سانسور و یا مسدود می کند؟"> <!ENTITY torSettings.bridgeExplanation1 "اگر مطمئن نیستید چگونه به این سوال پاسخ دهید، گزینه 'نه' را انتخاب کنید (در صورتی که نتوانستید بدون استفاده از یک bridge به شبکه تٌر متصل شویدِ، می توانید در هر زمان یک bridge اضافه کنید)."> <!ENTITY torSettings.bridgeExplanation2 "در صورتی که 'بله' را انتخاب کنید، از شما درخواست خواهد شد که bridge های تٌر را تنظیم کنید. bridge ها رله هایی هستند که در هیچ کجا لیست نشده و به همین جهت مسدود کردن ارتباط با شبکه تٌر را سخت تر می کنند."> diff --git a/src/chrome/locale/fa/progress.dtd b/src/chrome/locale/fa/progress.dtd index f7d9e02..8646caa 100644 --- a/src/chrome/locale/fa/progress.dtd +++ b/src/chrome/locale/fa/progress.dtd @@ -1,4 +1,4 @@ -<!ENTITY torprogress.dialog.title "وضعیت تٌر"> +<!ENTITY torprogress.dialog.title "وضعیت تور"> <!ENTITY torprogress.openSettings "تنظیمات‌را باز کنید"> <!ENTITY torprogress.heading "درحال اتصال به شبکه تُر"> <!ENTITY torprogress.pleaseWait "لطفا صبر کنید. در حال برقراری ارتباط با شبکه تٌر.&160; این پروسه ممکن است چند دقیقه به طول بینجامد."> diff --git a/src/chrome/locale/fa/torlauncher.properties b/src/chrome/locale/fa/torlauncher.properties index ad5ef5e..8a827b5 100644 --- a/src/chrome/locale/fa/torlauncher.properties +++ b/src/chrome/locale/fa/torlauncher.properties @@ -31,7 +31,7 @@ torlauncher.error_bridge_bad_default_type=هیچ پلی از نوع %S موجو torlauncher.recommended_bridge=(توصیه شده) torlauncher.connect=اتصال -torlauncher.restart_tor=تور را دوباره شوروع کنید. +torlauncher.restart_tor=تور را ریستارت کنید. torlauncher.quit=خروج torlauncher.quit_win=خروج torlauncher.done=انجام شد @@ -50,10 +50,10 @@ torlauncher.bootstrapStatus.requesting_descriptors=درخواست اطلاعات torlauncher.bootstrapStatus.loading_descriptors=بارگذاری اطلاعات بازپخش torlauncher.bootstrapStatus.conn_or=درحال اتصال به شبکه تُر torlauncher.bootstrapStatus.handshake_or=برپایی یک جریان تُر -torlauncher.bootstrapStatus.done=متصل شده به شبکه تُر +torlauncher.bootstrapStatus.done=به شبکه تور متصل شد! torlauncher.bootstrapWarning.done=انجام شد -torlauncher.bootstrapWarning.connectrefused=اتصال ردشد +torlauncher.bootstrapWarning.connectrefused=اتصال رد شد torlauncher.bootstrapWarning.misc=گوناگون torlauncher.bootstrapWarning.resourcelimit=منابع ناکافی torlauncher.bootstrapWarning.identity=عدم تطبیق هویت diff --git a/src/chrome/locale/nb/torlauncher.properties b/src/chrome/locale/nb/torlauncher.properties index a7c890e..8e7a3f4 100644 --- a/src/chrome/locale/nb/torlauncher.properties +++ b/src/chrome/locale/nb/torlauncher.properties @@ -1,7 +1,7 @@ ### Copyright (c) 2016, The Tor Project, Inc. ### See LICENSE for licensing information. -torlauncher.error_title=Tor Launcher +torlauncher.error_title=Tor-oppstarteren torlauncher.tor_exited_during_startup=Tor ble avsluttet under oppstart. Dette kan ha sin årsak i en feil i din torrc-fil, en feil i Tor eller et annet program på din maskin, eller feilaktig maskinvare. Tor-nettleseren vil ikke starte før det bakenforliggende problemet er ordnet og du har startet det på ny. torlauncher.tor_exited=Tor avsluttet uventet. Dette kan være forårsaket av en feil i Tor, eller et annet program på ditt system, alternativt ødelagt maskinvare. Før omstart av Tor er gjennomført vil du ikke kunne nå noen nettsider. Hvis problemet vedvarer, send en kopi av din Tor-logg til brukerstøtte.

1 0

[tor-browser-bundle/master] Bug 22361: fix hardening of libraries built in linux/gitian-utils.yml
by gk＠torproject.org 01 Jun '17

01 Jun '17

commit 095845a8bc96997b50c5208d831ae32272ca6f85 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Jun 1 01:35:24 2017 +0200 Bug 22361: fix hardening of libraries built in linux/gitian-utils.yml With the changes to integrate Selfrando (#20683), we are using our build of gcc and binutils to build other libraries in the linux/gitian-utils.yml descriptor, which removed the use of the hardening wrappers. We fix that by adding the hardening wrappers to our builds of gcc and binutils. Because we add the wrappers to gcc and binutils zip files, we don't need to add them anymore in the other descriptors where they are used. --- gitian/descriptors/linux/gitian-firefox.yml | 19 --------------- .../linux/gitian-pluggable-transports.yml | 17 -------------- gitian/descriptors/linux/gitian-tor.yml | 17 -------------- gitian/descriptors/linux/gitian-utils.yml | 27 ++++++++++++++++++++-- gitian/descriptors/linux/gitian-webrtc.yml | 17 -------------- 5 files changed, 25 insertions(+), 72 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index ae0d14f..9edcb3a 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -64,26 +64,7 @@ script: | fi # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling Tor Browser. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - mv g++ g++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - ln -sf hardened-cc g++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH ARCH="" if [ $GBUILD_BITS == "64" ]; diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index cd936d5..207a7e5 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -94,24 +94,7 @@ script: | # Preparing Binutils and GCC for webrtc unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling Tor Browser. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH # GN needs libatomic.so.1 here. export LD_LIBRARY_PATH=$INSTDIR/gcc/lib diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index c00b4e7..116dd84 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -49,24 +49,7 @@ script: | # Preparing Binutils and GCC for tor unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling tor. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH ARCH="" if [ $GBUILD_BITS == "64" ]; diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index eb340b8..2680f1b 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -104,6 +104,27 @@ script: | make install cd .. + # Make sure we use the hardening wrapper + pushd $INSTDIR/gcc/bin + cp /usr/bin/hardened-cc ./ + mv gcc gcc.real + mv c++ c++.real + mv g++ g++.real + ln -sf hardened-cc gcc + ln -sf hardened-cc c++ + ln -sf hardened-cc g++ + popd + + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + pushd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + popd + export DEB_BUILD_HARDENING_FORMAT=1 export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" export LD_LIBRARY_PATH="$INSTDIR/gcc/lib$ARCH" @@ -191,9 +212,11 @@ script: | # libevent archives are no longer reproducible. The main reason # is that they include some .a archives which include timestamps. # Those files are however not part of the files we ship. + # We use the --symlinks zip option for binutils and gcc for the + # hardening wrappers symlinks cd $INSTDIR - ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils - ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc + ZIPOPTS='--symlinks' ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils + ZIPOPTS='--symlinks' ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp diff --git a/gitian/descriptors/linux/gitian-webrtc.yml b/gitian/descriptors/linux/gitian-webrtc.yml index ccf2d4a..9e7808c 100644 --- a/gitian/descriptors/linux/gitian-webrtc.yml +++ b/gitian/descriptors/linux/gitian-webrtc.yml @@ -49,24 +49,7 @@ script: | # Preparing Binutils and GCC for webrtc unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip - # Make sure gold is used with the hardening wrapper for full RELRO, see - # #13031. - cd $INSTDIR/binutils/bin - rm ld - cp /usr/bin/hardened-ld ./ - mv ld.gold ld.gold.real - ln -sf hardened-ld ld.gold - ln -sf ld.gold ld - cd ~/build unzip -d $INSTDIR gcc-linux$GBUILD_BITS-utils.zip - # Make sure we use the hardening wrapper when compiling Tor Browser. - cd $INSTDIR/gcc/bin - cp /usr/bin/hardened-cc ./ - mv gcc gcc.real - mv c++ c++.real - ln -sf hardened-cc gcc - ln -sf hardened-cc c++ - cd ~/build export PATH=$INSTDIR/gcc/bin:$INSTDIR/binutils/bin:$PATH # GN needs libatomic.so.1 here. export LD_LIBRARY_PATH=$INSTDIR/gcc/lib

1 0