July 2018 - tbb-commits - lists.torproject.org

[tor-browser-build/master] Bug 26251: Adapt macOS snowflake compilation to new toolchain
by boklm＠torproject.org 11 Jul '18

11 Jul '18

commit 6d3f0f5dfbec918368f3114ff96fdeb308c9d7a9 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Wed Jun 20 07:32:27 2018 -0400 Bug 26251: Adapt macOS snowflake compilation to new toolchain This commit adds support for building Snowflake (and its associated components, webrtc and go-webrtc) with our updated toolchain that uses clang 3.9.1 and macOS SDK 10.11 For clang, we add the '-Wno-unknown-warning-option' flag; see https://bugs.llvm.org/show_bug.cgi?id=24979 for more information. --- projects/webrtc/build | 10 ++++----- projects/webrtc/webrtc-mac.patch | 45 ++-------------------------------------- rbm.conf | 2 +- 3 files changed, 8 insertions(+), 49 deletions(-) diff --git a/projects/webrtc/build b/projects/webrtc/build index 43b8261..32a66b7 100644 --- a/projects/webrtc/build +++ b/projects/webrtc/build @@ -13,8 +13,8 @@ mkdir -p /var/tmp/dist [% END -%] [% IF c("var/osx") -%] # src/build/toolchain/mac/filter_libtool.py wants libtool to be called exactly "libtool". - ln -sf x86_64-apple-darwin10-libtool $cctoolsdir/libtool - export AR=x86_64-apple-darwin10-ar + ln -sf x86_64-apple-darwin11-libtool $cctoolsdir/libtool + export AR=x86_64-apple-darwin11-ar # Certain cross-compiling flags are set in webrtc-mac.patch because the build # system doesn't honor CFLAGS etc. environment variables. [% ELSE -%] @@ -63,14 +63,14 @@ cd $builddir # needs to be kept in sync with the SDK version. cat <<EOF > build/mac/find_sdk.py print("$sysrootdir") -print("10.7") +print("10.11") EOF cat <<EOF > build/config/mac/sdk_info.py print("machine_os_build=\"10.7\"") -print("sdk_build=\"10.7\"") +print("sdk_build=\"10.11\"") print("sdk_path=\"$sysrootdir\"") print("sdk_platform_path=\"$sysrootdir\"") -print("sdk_version=\"10.7\"") +print("sdk_version=\"10.11\"") print("xcode_build=\"7.3\"") print("xcode_version=\"0730\"") EOF diff --git a/projects/webrtc/webrtc-mac.patch b/projects/webrtc/webrtc-mac.patch index 5c9cedd..6b888bb 100644 --- a/projects/webrtc/webrtc-mac.patch +++ b/projects/webrtc/webrtc-mac.patch @@ -60,8 +60,8 @@ index 84180e6a..2054b46f 100644 sysroot, "-mmacosx-version-min=$mac_deployment_target", + "-target", -+ "x86_64-apple-darwin10", -+ "-mlinker-version=136", ++ "x86_64-apple-darwin11", ++ "-Wno-unknown-warning-option", + "-B", + "/var/tmp/dist/macosx-toolchain/cctools/bin", ] @@ -136,47 +136,6 @@ index 0928fa13..898edc1a 100644 -- 2.11.0 -From d9577991412310d3313d9dcd86453ce24f845c2e Mon Sep 17 00:00:00 2001 -From: David Fifield <david(a)bamsoftware.com> -Date: Mon, 26 Jun 2017 11:37:34 -0700 -Subject: [PATCH 4/8] Hack workaround to disable dispatch_queue_get_label. - -dispatch_queue_get_label and DISPATCH_CURRENT_QUEUE_LABEL require SDK -10.9+. I don't know if removing this code even makes sense, but it at -least won't crash immediately because of a null pointer. - -https://developer.apple.com/documentation/dispatch/dispatch_current_queue_label -https://developer.apple.com/library/content/releasenotes/General/APIDiffsMacOSX10_9/General.html - -FAILED: obj/webrtc/base/rtc_task_queue/sequenced_task_checker_impl.o ../../../../clang/bin/clang++ -MMD -MF obj/webrtc/base/rtc_task_queue/sequenced_task_checker_impl.o.d -DV8_DEPRECATION_WARNINGS -DNO_TCMALLOC -DUSE_EXTERNAL_POPUP_MENU=1 -DFULL_SAFE_BROWSING -DSAFE_BROWSING_CSD -DSAFE_BROWSING_DB_LOCAL -DCHROMIUM_BUILD -DENABLE_MEDIA_ROUTER=1 -DFIELDTRIAL_TESTING_ENABLED -DCR_XCODE_VERSION=0730 -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D_FORTIFY_SOURCE=2 -D__ASSERT_MACROS_DEFINE_VERSIONS_WITHOUT_UNDERSCORE=0 -DNDEBUG -DNVALGRIND -DDYNAMIC_ANNOTATIONS_ENABLED=0 -DEXPAT_RELATIVE_PATH -DHAVE_SCTP -DWEBRTC_POSIX -DWEBRTC_MAC -I../.. -Igen -fno-strict-aliasing -fstack-protector -Wno-builtin-macro-redefined -D__DATE__= -D__TIME__= -D__TIMESTAMP__= -arch x86_64 -Wall -Wpartial-availability -Wno-unused-local-typedefs -Wno-maybe-uninitialized -Wno-missing-field-initializers -Wno-unused-parameter -O2 -gdwarf-2 -isysroot /home/debian/build/MacOSX10.7.sdk -mmacosx-version-min=10.9 -targ et x86_64-apple-darwin10 -mlinker-version=136 -B /home/debian/build/cctools/bin -fvisibility=hidden -Wextra -Wno-unused-parameter -Wno-missing-field-initializers -Wno-strict-overflow -fvisibility-inlines-hidden -std=c++11 -stdlib=libc++ -Wno-narrowing -fno-rtti -fno-exceptions -Wnon-virtual-dtor -Woverloaded-virtual -c ../../webrtc/base/sequenced_task_checker_impl.cc -o obj/webrtc/base/rtc_task_queue/sequenced_task_checker_impl.o -warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option] -../../webrtc/base/sequenced_task_checker_impl.cc:34:46: error: use of undeclared identifier 'DISPATCH_CURRENT_QUEUE_LABEL' - current_queue = dispatch_queue_get_label(DISPATCH_CURRENT_QUEUE_LABEL); - ^ ---- - webrtc/base/sequenced_task_checker_impl.cc | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/webrtc/base/sequenced_task_checker_impl.cc b/webrtc/base/sequenced_task_checker_impl.cc -index f03e0b679..352b2162d 100644 ---- a/webrtc/base/sequenced_task_checker_impl.cc -+++ b/webrtc/base/sequenced_task_checker_impl.cc -@@ -30,8 +30,9 @@ bool SequencedTaskCheckerImpl::CalledSequentially() const { - #if defined(WEBRTC_MAC) - // If we're not running on a TaskQueue, use the system dispatch queue - // label as an identifier. -- if (current_queue == nullptr) -- current_queue = dispatch_queue_get_label(DISPATCH_CURRENT_QUEUE_LABEL); -+ // Disable this because dispatch_queue_get_label requires SDK 10.9+. -+ // if (current_queue == nullptr) -+ // current_queue = dispatch_queue_get_label(DISPATCH_CURRENT_QUEUE_LABEL); - #endif - CritScope scoped_lock(&lock_); - if (!attached_) { // true if previously detached. --- -2.11.0 - - From 62a6fa6376194ce673c220eef19fefeebe58fee1 Mon Sep 17 00:00:00 2001 From: David Fifield <david(a)bamsoftware.com> Date: Mon, 26 Jun 2017 11:41:16 -0700 diff --git a/rbm.conf b/rbm.conf index de5102d..bea9d3e 100644 --- a/rbm.conf +++ b/rbm.conf @@ -245,7 +245,7 @@ targets: LDFLAGS: "-Wl,-syslibroot,$sysrootdir -Wl,-dead_strip -Wl,-pie" locale_ja: ja-JP-mac # We only build snowflake for linux on the alpha and nightly channels for now. - snowflake: 0 #'[% c("var/alpha") || c("var/nightly") %]' + snowflake: '[% c("var/alpha") || c("var/nightly") %]' deps: - build-essential - python

1 0

[tor-browser-build/master] Fold in stable changelog
by gk＠torproject.org 06 Jul '18

06 Jul '18

commit 6d63b2ee1e3bfd0479ddc9abef9ae94eb097a668 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 6 12:37:02 2018 +0000 Fold in stable changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 516e81f..b8d30f1 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -86,6 +86,23 @@ Tor Browser 8.0a9 -- June 27 2018 * Bug 25540: Stop building and distributing sandboxed tor browser * Bug 25481: Rust support for tor-browser and tor +Tor Browser 7.5.6 -- June 26 2018 + * All platforms + * Update Firefox to 52.9.0esr + * Update Tor to 0.3.3.7 + * Update Tor Launcher to 0.2.14.5 + * Bug 20890: Increase control port connection timeout + * Update HTTPS Everywhere to 2018.6.21 + * Bug 26451: Prevent HTTPS Everywhere from freezing the browser + * Update NoScript to 5.1.8.6 + * Bug 21537: Mark .onion cookies as secure + * Bug 25938: Backport fix for cross-origin header leak (bug 1334776) + * Bug 25721: Backport patches from Mozilla's bug 1448771 + * Bug 25147+25458: Sanitize HTML fragments for chrome documents + * Bug 26221: Backport fix for leak in SHA256 in nsHttpConnectionInfo.cpp + * Windows + * Bug 26424: Disable UNC paths to prevent possible proxy bypasses + Tor Browser 8.0a8 -- June 10 2018 * All platforms * Update Firefox to 52.8.1esr

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] Revert "Bug 20283: Tor Browser should run without a `/proc` filesystem."
by gk＠torproject.org 04 Jul '18

04 Jul '18

commit 2edb3478a22331e0fc882e25874b9403ee2575ee Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 4 16:51:23 2018 +0000 Revert "Bug 20283: Tor Browser should run without a `/proc` filesystem." This reverts commit 5bd6e492edc3fc4df748d1228360c80fee38e276. --- js/src/util/NativeStack.cpp | 60 +++------------------------------------------ 1 file changed, 4 insertions(+), 56 deletions(-) diff --git a/js/src/util/NativeStack.cpp b/js/src/util/NativeStack.cpp index a695cb3bcd6c..2507374a36da 100644 --- a/js/src/util/NativeStack.cpp +++ b/js/src/util/NativeStack.cpp @@ -13,24 +13,10 @@ # if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) # include <pthread_np.h> # endif -# if defined(SOLARIS) || defined(AIX) -# include <ucontext.h> -# endif # if defined(ANDROID) && !defined(__aarch64__) # include <sys/types.h> # include <unistd.h> # endif -# if defined(XP_LINUX) && !defined(ANDROID) && defined(__GLIBC__) -# include <dlfcn.h> -# include <sys/syscall.h> -# include <sys/types.h> -# include <unistd.h> -static pid_t -gettid() -{ - return syscall(__NR_gettid); -} -# endif #else # error "Unsupported platform" #endif @@ -48,6 +34,8 @@ js::GetNativeStackBaseImpl() #elif defined(SOLARIS) +#include <ucontext.h> + JS_STATIC_ASSERT(JS_STACK_GROWTH_DIRECTION < 0); void* @@ -60,6 +48,8 @@ js::GetNativeStackBaseImpl() #elif defined(AIX) +#include <ucontext.h> + JS_STATIC_ASSERT(JS_STACK_GROWTH_DIRECTION < 0); void* @@ -71,48 +61,6 @@ js::GetNativeStackBaseImpl() context.uc_stack.ss_size; } -#elif defined(XP_LINUX) && !defined(ANDROID) && defined(__GLIBC__) -void* -js::GetNativeStackBaseImpl() -{ - // On the main thread, get stack base from glibc's __libc_stack_end rather than pthread APIs - // to avoid filesystem calls /proc/self/maps. Non-main threads spawned with pthreads can read - // this information directly from their pthread struct, but the main thread must go parse - // /proc/self/maps to figure the mapped stack address space ranges. We want to avoid reading - // from /proc/ so that firefox can run in sandboxed environments where /proc may not be mounted - if (gettid() == getpid()) { - void** pLibcStackEnd = (void**)dlsym(RTLD_DEFAULT, "__libc_stack_end"); - // If __libc_stack_end is not found, architecture specific frame pointer hopping will need - // to be implemented. - MOZ_RELEASE_ASSERT(pLibcStackEnd, "__libc_stack_end unavailable, unable to setup stack range for JS"); - void* stackBase = *pLibcStackEnd; - MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS"); - // We don't need to fix stackBase, as it already roughly points to beginning of the stack - return stackBase; - } else { - // Non-main threads have the required info stored in memory, so no filesystem calls are made. - pthread_t thread = pthread_self(); - pthread_attr_t sattr; - pthread_attr_init(&sattr); - pthread_getattr_np(thread, &sattr); - // stackBase will be the *lowest* address on all architectures. - void* stackBase = nullptr; - size_t stackSize = 0; - int rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize); - if (rc) { - MOZ_CRASH("call to pthread_attr_getstack failed, unable to setup stack range for JS"); - } - MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS"); - pthread_attr_destroy(&sattr); - -# if JS_STACK_GROWTH_DIRECTION > 0 - return stackBase; -# else - return static_cast<char*>(stackBase) + stackSize; -# endif - } -} - #else /* XP_UNIX */ void*

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] Bug 859782 - Firefox cannot start without /proc (chroot). r=sfink, evilpie, jld
by gk＠torproject.org 04 Jul '18

04 Jul '18

commit dbca4ee64600d9ab17e7c9abdc7dac76562def01 Author: Richard Pospesel <richard(a)torproject.org> Date: Tue Jun 19 08:00:58 2018 -0600 Bug 859782 - Firefox cannot start without /proc (chroot). r=sfink,evilpie,jld Firefox uses the current stack frame address and the stack size as a sort of heuristic for various things in the javascript engine. The js::GetNativeStackBaseImpl() function is used to get the base stack address (ie the address from which the stack grows, so this can be either the first or last memory address of the stack memory space depending on the CPU architecture). On Linux, this function is implemented using the pthreads APIs. For non-main threads, the queried thread info is stored in memory. The main thread does not have this information on hand, so it gets the stack memory range via the /proc/self/maps file ( see glibc's pthread_get_attr_np.c ). Fortunately (per discussions with the firefox devs in #jsapi) the base address only needs to be approximation. In reality, environment variables, args, and other things are stored in space between the end/beginning of the mapped stack memory and the 'top' of the stack space used by stack frames. We can get the top of this usable stack from __libc_stack_end, which is a void* set by glibc during program initialization. Non-main threads still get their stack-base through the usual pthreads APIs. This fixes bug 20283 on our side. --- js/src/util/NativeStack.cpp | 64 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 60 insertions(+), 4 deletions(-) diff --git a/js/src/util/NativeStack.cpp b/js/src/util/NativeStack.cpp index 2507374a36da..300b5259b5e5 100644 --- a/js/src/util/NativeStack.cpp +++ b/js/src/util/NativeStack.cpp @@ -13,10 +13,24 @@ # if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__) # include <pthread_np.h> # endif +# if defined(SOLARIS) || defined(AIX) +# include <ucontext.h> +# endif # if defined(ANDROID) && !defined(__aarch64__) # include <sys/types.h> # include <unistd.h> # endif +# if defined(XP_LINUX) && !defined(ANDROID) && defined(__GLIBC__) +# include <dlfcn.h> +# include <sys/syscall.h> +# include <sys/types.h> +# include <unistd.h> +static pid_t +gettid() +{ + return syscall(__NR_gettid); +} +# endif #else # error "Unsupported platform" #endif @@ -34,8 +48,6 @@ js::GetNativeStackBaseImpl() #elif defined(SOLARIS) -#include <ucontext.h> - JS_STATIC_ASSERT(JS_STACK_GROWTH_DIRECTION < 0); void* @@ -48,8 +60,6 @@ js::GetNativeStackBaseImpl() #elif defined(AIX) -#include <ucontext.h> - JS_STATIC_ASSERT(JS_STACK_GROWTH_DIRECTION < 0); void* @@ -61,6 +71,52 @@ js::GetNativeStackBaseImpl() context.uc_stack.ss_size; } +#elif defined(XP_LINUX) && !defined(ANDROID) && defined(__GLIBC__) +void* +js::GetNativeStackBaseImpl() +{ + + // On the main thread, get stack base from glibc's __libc_stack_end rather than pthread APIs + // to avoid filesystem calls /proc/self/maps. Non-main threads spawned with pthreads can read + // this information directly from their pthread struct, but the main thread must go parse + // /proc/self/maps to figure the mapped stack address space ranges. We want to avoid reading + // from /proc/ so that firefox can run in sandboxed environments where /proc may not be mounted + if (gettid() == getpid()) { + void** pLibcStackEnd = (void**)dlsym(RTLD_DEFAULT, "__libc_stack_end"); + + // If __libc_stack_end is not found, architecture specific frame pointer hopping will need + // to be implemented. + MOZ_RELEASE_ASSERT(pLibcStackEnd, "__libc_stack_end unavailable, unable to setup stack range for JS"); + void* stackBase = *pLibcStackEnd; + MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS"); + + // We don't need to fix stackBase, as it already roughly points to beginning of the stack + return stackBase; + } + + // Non-main threads have the required info stored in memory, so no filesystem calls are made. + pthread_t thread = pthread_self(); + pthread_attr_t sattr; + pthread_attr_init(&sattr); + pthread_getattr_np(thread, &sattr); + + // stackBase will be the *lowest* address on all architectures. + void* stackBase = nullptr; + size_t stackSize = 0; + int rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize); + if (rc) { + MOZ_CRASH("call to pthread_attr_getstack failed, unable to setup stack range for JS"); + } + MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS"); + pthread_attr_destroy(&sattr); + +# if JS_STACK_GROWTH_DIRECTION > 0 + return stackBase; +# else + return static_cast<char*>(stackBase) + stackSize; +# endif +} + #else /* XP_UNIX */ void*

1 0

[fpcentral/master] Bug 26623: recognize esr60 versions of Tor Browser
by gk＠torproject.org 04 Jul '18

04 Jul '18

commit a88dbe42b1478ba4a2142c3c8ae08d80511a7f73 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jul 3 19:44:23 2018 +0200 Bug 26623: recognize esr60 versions of Tor Browser --- fingerprint/acceptable/torbrowser80.json | 64 ++++++++++++++++++++++++++++++++ fingerprint/tags/browser.py | 9 ++++- 2 files changed, 72 insertions(+), 1 deletion(-) diff --git a/fingerprint/acceptable/torbrowser80.json b/fingerprint/acceptable/torbrowser80.json new file mode 100644 index 0000000..4c6522e --- /dev/null +++ b/fingerprint/acceptable/torbrowser80.json @@ -0,0 +1,64 @@ +{ + "mainTag": "Tor Browser 8.0", + "math": { + "asinh(1)": 0.8813735870195429, + "acosh(1e300)": "Infinity", + "atanh(05)": 0.5493061443340548, + "expm1(1)": 1.7182818284590455, + "cbrt(100)": 4.641588833612778, + "log1p(10)": 2.3978952727983707, + "sinh(1)": 1.1752011936438016, + "cosh(10)": 11013.232920103324, + "tanh(1)": 0.7615941559557649 + }, + "plugins": "", + "dnt": "NC", + "buildID": "20100101", + "screen": { + "width": [1000,800,600,400,200], + "height": [1000,900,800,700,600,500,400,300,200], + "depth": 24, + "availTop": 0, + "availLeft": 0, + "availHeight": [1000,900,800,700,600,500,400,300,200], + "availWidth": [1000,800,600,400,200], + "left": 0, + "top": 0 + }, + "storage": { + "local": "yes", + "session": "yes" + }, + "timezone": 0, + "cookies": "yes", + "platform": "Win32", + "Accept-Encoding": "gzip, deflate, br", + "Accept-Language": "en-US,en;q=0.5", + "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", + "Content-Type": "", + "Content-Length": "", + "audio": { + "nt_vc_output": { + "ac-sampleRate": 0, + "ac-state": 0, + "ac-maxChannelCount": 0, + "ac-numberOfInputs": 0, + "ac-numberOfOutputs": 0, + "ac-channelCount": 0, + "ac-channelCountMode": 0, + "ac-channelInterpretation": 0, + "an-fftSize": 0, + "an-frequencyBinCount": 0, + "an-minDecibels": 0, + "an-maxDecibels": 0, + "an-smoothingTimeConstant": 0, + "an-numberOfInputs": 0, + "an-numberOfOutputs": 0, + "an-channelCount": 0, + "an-channelCountMode": 0, + "an-channelInterpretation": 0 + }, + "pxi_output": 0, + "pxi_full_buffer_hash": "158e8189a3551fe4f2e564ac377b0f1e588a1ab3" + } +} diff --git a/fingerprint/tags/browser.py b/fingerprint/tags/browser.py index 405b8c8..daae5c1 100644 --- a/fingerprint/tags/browser.py +++ b/fingerprint/tags/browser.py @@ -5,6 +5,7 @@ tor4 = "Tor 4.X" tor5 = "Tor 5.X" tor6 = "Tor 6.X" torbrowser70 = "Tor Browser 7.0" +torbrowser80 = "Tor Browser 8.0" chrome = "Chrome" firefox = "Firefox" #NB: A Tor browser cannot have the Firefox tag edge = "Edge" @@ -20,7 +21,13 @@ class Browser(Tag): def checkTags(self, fp): ua = fp["User-Agent"] #We check first for UA from Tor browsers - if ua == "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0": + if ua == "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0": + return [torbrowser80] + elif ua == "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Firefox/60.0": + return [torbrowser80] + elif ua == "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0": + return [torbrowser80] + elif ua == "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0": return [torbrowser70] elif ua == "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0": return [tor6]

1 0