commit 8b68d306f99ea22584874ab0804342e436bc7464
Author: Mike Perry <mikeperry-git(a)torproject.org>
Date: Mon May 6 15:51:06 2013 -0700
TB3: Tor Browser's official .mozconfigs.
Also:
Bug #9829.1: new .mozconfig file for the new cross-compiler and ESR24
Changes needed to build Mac in 64bit
Bug 10715: Enable Webgl for mingw-w64 again.
Disable ICU when cross-compiling; clean-up.
Bug 15773: Enable ICU on OS X
Bug 15990: Don't build the sandbox with …
[View More]mingw-w64
Bug 12761: Switch to ESR 38 for OS X
Updating .mozconfig-asan
Bug 12516: Compile hardenend Tor Browser with -fwrapv
Bug 18331: Switch to Mozilla's toolchain for building Tor Browser for OS X
Bug 17858: Cannot create incremental MARs for hardened builds.
Define HOST_CFLAGS, etc. to avoid compiling programs such as mbsdiff
(which is part of mar-tools and is not distributed to end-users) with
ASan.
Bug 13419: Add back ICU for Windows
Bug 21239: Use GTK2 for ESR52 Linux builds
Bug 23025: Add hardening flags for macOS
Bug 24478: Enable debug assertions and tests in our ASan builds
--enable-proxy-bypass-protection
Bug 27597: ASan build option in tor-browser-build is broken
Bug 27623 - Export MOZILLA_OFFICIAL during desktop builds
This fixes a problem where some preferences had the wrong default value.
Also see bug 27472 where we made a similar fix for Android.
Bug 30463: Explicitly disable MOZ_TELEMETRY_REPORTING
Bug 31450: Set proper BINDGEN_CFLAGS for ASan builds
Add an --enable-tor-browser-data-outside-app-dir configure option
Add --with-tor-browser-version configure option
Bug 21849: Don't allow SSL key logging.
Bug 31457: disable per-installation profiles
The dedicated profiles (per-installation) feature does not interact
well with our bundled profiles on Linux and Windows, and it also causes
multiple profiles to be created on macOS under TorBrowser-Data.
Bug 31935: Disable profile downgrade protection.
Since Tor Browser does not support more than one profile, disable
the prompt and associated code that offers to create one when a
version downgrade situation is detected.
Bug 32493: Disable MOZ_SERVICES_HEALTHREPORT
Bug 25741 - TBA: Disable features at compile-time
MOZ_NATIVE_DEVICES for casting and the media player
MOZ_TELEMETRY_REPORTING for telemetry
MOZ_DATA_REPORTING for all data reporting preferences (crashreport, telemetry, geo)
Bug 25741 - TBA: Add default configure options in dedicated file
Define MOZ_ANDROID_NETWORK_STATE and MOZ_ANDROID_LOCATION
Bug 29859: Disable HLS support for now
Add --disable-tor-launcher build option
Add --enable-tor-browser-update build option
Bug 33734: Set MOZ_NORMANDY to False
Bug 33851: Omit Parental Controls.
Bug 40061: Omit the Windows default browser agent from the build
Bug 40107: Adapt .mozconfig-asan for ESR 78
Bug 40252: Add --enable-rust-simd to our tor-browser mozconfig files
---
.mozconfig | 39 ++++++++++++++++++++++++
.mozconfig-android | 36 ++++++++++++++++++++++
.mozconfig-asan | 45 ++++++++++++++++++++++++++++
.mozconfig-mac | 56 +++++++++++++++++++++++++++++++++++
.mozconfig-mingw | 31 +++++++++++++++++++
browser/base/moz.build | 3 ++
browser/installer/Makefile.in | 8 +++++
browser/moz.configure | 8 ++---
build/moz.configure/old.configure | 6 ++++
mobile/android/confvars.sh | 9 ++++++
mobile/android/geckoview/build.gradle | 1 +
mobile/android/moz.configure | 17 +++++++++--
mobile/android/torbrowser.configure | 30 +++++++++++++++++++
old-configure.in | 49 ++++++++++++++++++++++++++++++
security/moz.build | 2 +-
security/nss/lib/ssl/Makefile | 2 +-
toolkit/modules/AppConstants.jsm | 9 ++++++
toolkit/modules/moz.build | 3 ++
18 files changed, 346 insertions(+), 8 deletions(-)
diff --git a/.mozconfig b/.mozconfig
new file mode 100755
index 000000000000..18cd1f9b6487
--- /dev/null
+++ b/.mozconfig
@@ -0,0 +1,39 @@
+. $topsrcdir/browser/config/mozconfig
+
+# This mozconfig file is not used in official Tor Browser builds.
+# It is only intended to be used when doing incremental Linux builds
+# during development. The platform-specific mozconfig configuration
+# files used in official Tor Browser releases can be found in the
+# tor-browser-build repo:
+# https://gitweb.torproject.org/builders/tor-browser-build.git/
+# under:
+# tor-browser-build/projects/firefox/mozconfig-$OS-$ARCH
+
+mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@
+mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser"
+export MOZILLA_OFFICIAL=1
+
+ac_add_options --enable-optimize
+ac_add_options --enable-rust-simd
+ac_add_options --enable-official-branding
+
+# Let's support GTK3 for ESR60
+ac_add_options --enable-default-toolkit=cairo-gtk3
+
+ac_add_options --disable-strip
+ac_add_options --disable-install-strip
+ac_add_options --disable-tests
+ac_add_options --disable-debug
+ac_add_options --disable-crashreporter
+ac_add_options --disable-webrtc
+ac_add_options --disable-parental-controls
+# Let's make sure no preference is enabling either Adobe's or Google's CDM.
+ac_add_options --disable-eme
+ac_add_options --enable-proxy-bypass-protection
+
+# Disable telemetry
+ac_add_options MOZ_TELEMETRY_REPORTING=
+
+ac_add_options --disable-tor-launcher
+ac_add_options --with-tor-browser-version=dev-build
+ac_add_options --disable-tor-browser-update
diff --git a/.mozconfig-android b/.mozconfig-android
new file mode 100755
index 000000000000..50015ec615ef
--- /dev/null
+++ b/.mozconfig-android
@@ -0,0 +1,36 @@
+mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-arm-linux-androideabi
+mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser"
+export MOZILLA_OFFICIAL=1
+
+ac_add_options --enable-optimize
+ac_add_options --enable-rust-simd
+ac_add_options --enable-official-branding
+
+# Android
+ac_add_options --enable-application=mobile/android
+ac_add_options --target=arm-linux-androideabi
+ac_add_options --with-android-ndk="$NDK_BASE" #Enter the android ndk location(ndk r17b)
+ac_add_options --with-android-sdk="$SDK_BASE" #Enter the android sdk location
+ac_add_options --with-branding=mobile/android/branding/alpha
+
+# Use Mozilla's Clang blobs
+CC="$HOME/.mozbuild/clang/bin/clang"
+CXX="$HOME/.mozbuild/clang/bin/clang++"
+
+#enable ccache to set amount of cache assigned for build.
+ac_add_options --with-ccache
+
+ac_add_options --enable-strip
+ac_add_options --disable-tests
+ac_add_options --disable-debug
+ac_add_options --disable-rust-debug
+
+ac_add_options --disable-updater
+ac_add_options --disable-crashreporter
+ac_add_options --disable-webrtc
+ac_add_options --disable-parental-controls
+
+ac_add_options --enable-proxy-bypass-protection
+
+# Disable telemetry
+ac_add_options MOZ_TELEMETRY_REPORTING=
diff --git a/.mozconfig-asan b/.mozconfig-asan
new file mode 100644
index 000000000000..98ea6ac6f3fe
--- /dev/null
+++ b/.mozconfig-asan
@@ -0,0 +1,45 @@
+. $topsrcdir/browser/config/mozconfig
+
+export CFLAGS="-fsanitize=address -Dxmalloc=myxmalloc"
+export CXXFLAGS="-fsanitize=address -Dxmalloc=myxmalloc"
+# We need to add -ldl explicitely due to bug 1213698
+export LDFLAGS="-fsanitize=address -ldl"
+
+# Define HOST_CFLAGS, etc. to avoid compiling programs such as mbsdiff
+# (which is part of mar-tools and is not distributed to end-users) with
+# ASan. See bug 17858.
+export HOST_CFLAGS=""
+export HOST_CXXFLAGS=""
+export HOST_LDFLAGS="-ldl"
+
+mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@
+mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser"
+export MOZILLA_OFFICIAL=1
+export BINDGEN_CFLAGS='--gcc-toolchain=/var/tmp/dist/gcc'
+
+ac_add_options --enable-address-sanitizer
+ac_add_options --disable-jemalloc
+ac_add_options --disable-elf-hack
+ac_add_options --with-clang-path=/var/tmp/dist/clang/bin/clang
+
+ac_add_options --enable-optimize
+ac_add_options --enable-rust-simd
+ac_add_options --enable-official-branding
+
+# Let's support GTK3 for ESR60
+ac_add_options --enable-default-toolkit=cairo-gtk3
+
+ac_add_options --enable-tor-browser-update
+
+ac_add_options --disable-strip
+ac_add_options --disable-install-strip
+ac_add_options --disable-tests
+ac_add_options --disable-debug
+ac_add_options --disable-crashreporter
+ac_add_options --disable-webrtc
+ac_add_options --disable-parental-controls
+ac_add_options --disable-eme
+ac_add_options --enable-proxy-bypass-protection
+
+# Disable telemetry
+ac_add_options MOZ_TELEMETRY_REPORTING=
diff --git a/.mozconfig-mac b/.mozconfig-mac
new file mode 100644
index 000000000000..26e2b6b92fdb
--- /dev/null
+++ b/.mozconfig-mac
@@ -0,0 +1,56 @@
+# ld needs libLTO.so from llvm
+mk_add_options "export LD_LIBRARY_PATH=$topsrcdir/clang/lib"
+
+CROSS_CCTOOLS_PATH=$topsrcdir/cctools
+CROSS_SYSROOT=$topsrcdir/MacOSX10.7.sdk
+CROSS_PRIVATE_FRAMEWORKS=$CROSS_SYSROOT/System/Library/PrivateFrameworks
+HARDENING_FLAGS="-Werror=format -Werror=format-security -fstack-protector-strong -D_FORTIFY_SOURCE=2"
+FLAGS="-target x86_64-apple-darwin10 -mlinker-version=136 -B $CROSS_CCTOOLS_PATH/bin -isysroot $CROSS_SYSROOT $HARDENING_FLAGS"
+
+export CC="$topsrcdir/clang/bin/clang $FLAGS"
+export CXX="$topsrcdir/clang/bin/clang++ $FLAGS"
+export CPP="$topsrcdir/clang/bin/clang $FLAGS -E"
+export LLVMCONFIG=$topsrcdir/clang/bin/llvm-config
+export LDFLAGS="-Wl,-syslibroot,$CROSS_SYSROOT -Wl,-dead_strip -Wl,-pie"
+export TOOLCHAIN_PREFIX=$CROSS_CCTOOLS_PATH/bin/x86_64-apple-darwin10-
+#TODO: bug 1184202 - would be nice if these could be detected with TOOLCHAIN_PREFIX automatically
+export AR=${TOOLCHAIN_PREFIX}ar
+export RANLIB=${TOOLCHAIN_PREFIX}ranlib
+export STRIP=${TOOLCHAIN_PREFIX}strip
+export OTOOL=${TOOLCHAIN_PREFIX}otool
+export DSYMUTIL=$topsrcdir/clang/bin/llvm-dsymutil
+
+export HOST_CC="$topsrcdir/clang/bin/clang"
+export HOST_CXX="$topsrcdir/clang/bin/clang++"
+export HOST_CPP="$topsrcdir/clang/bin/clang -E"
+export HOST_CFLAGS="-g"
+export HOST_CXXFLAGS="-g"
+export HOST_LDFLAGS="-g"
+
+ac_add_options --target=x86_64-apple-darwin
+ac_add_options --with-macos-private-frameworks=$CROSS_PRIVATE_FRAMEWORKS
+
+mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-macos
+mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser"
+export MOZILLA_OFFICIAL=1
+
+ac_add_options --enable-application=browser
+ac_add_options --enable-strip
+ac_add_options --enable-official-branding
+ac_add_options --enable-optimize
+ac_add_options --enable-rust-simd
+ac_add_options --disable-debug
+
+ac_add_options --enable-tor-browser-data-outside-app-dir
+ac_add_options --enable-tor-browser-update
+
+ac_add_options --disable-crashreporter
+ac_add_options --disable-webrtc
+ac_add_options --disable-parental-controls
+ac_add_options --disable-tests
+# Let's make sure no preference is enabling either Adobe's or Google's CDM.
+ac_add_options --disable-eme
+ac_add_options --enable-proxy-bypass-protection
+
+# Disable telemetry
+ac_add_options MOZ_TELEMETRY_REPORTING=
diff --git a/.mozconfig-mingw b/.mozconfig-mingw
new file mode 100644
index 000000000000..3ec6ff18a3e9
--- /dev/null
+++ b/.mozconfig-mingw
@@ -0,0 +1,31 @@
+CROSS_COMPILE=1
+
+ac_add_options --enable-application=browser
+ac_add_options --target=i686-w64-mingw32
+ac_add_options --with-toolchain-prefix=i686-w64-mingw32-
+ac_add_options --enable-default-toolkit=cairo-windows
+mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw
+mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser"
+export MOZILLA_OFFICIAL=1
+
+ac_add_options --disable-debug
+ac_add_options --enable-optimize
+ac_add_options --enable-rust-simd
+ac_add_options --enable-strip
+ac_add_options --enable-official-branding
+
+ac_add_options --enable-tor-browser-update
+ac_add_options --disable-bits-download
+
+# Let's make sure no preference is enabling either Adobe's or Google's CDM.
+ac_add_options --disable-eme
+ac_add_options --disable-crashreporter
+ac_add_options --disable-maintenance-service
+ac_add_options --disable-webrtc
+ac_add_options --disable-parental-controls
+ac_add_options --disable-tests
+ac_add_options --enable-proxy-bypass-protection
+
+# Disable telemetry
+ac_add_options MOZ_TELEMETRY_REPORTING=
+ac_add_options --disable-default-browser-agent
diff --git a/browser/base/moz.build b/browser/base/moz.build
index e136e0986a3c..ebb4cbf79fd0 100644
--- a/browser/base/moz.build
+++ b/browser/base/moz.build
@@ -71,4 +71,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'gtk', 'cocoa'):
if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'gtk'):
DEFINES['MENUBAR_CAN_AUTOHIDE'] = 1
+if CONFIG['TOR_BROWSER_UPDATE']:
+ DEFINES['TOR_BROWSER_UPDATE'] = 1
+
JAR_MANIFESTS += ['jar.mn']
diff --git a/browser/installer/Makefile.in b/browser/installer/Makefile.in
index b861ad214a64..0325f0ffab9a 100644
--- a/browser/installer/Makefile.in
+++ b/browser/installer/Makefile.in
@@ -82,6 +82,14 @@ endif
endif
endif
+ifdef TOR_BROWSER_DISABLE_TOR_LAUNCHER
+DEFINES += -DTOR_BROWSER_DISABLE_TOR_LAUNCHER
+endif
+
+ifdef TOR_BROWSER_UPDATE
+DEFINES += -DTOR_BROWSER_UPDATE
+endif
+
ifneq (,$(filter WINNT Darwin Android,$(OS_TARGET)))
DEFINES += -DMOZ_SHARED_MOZGLUE=1
endif
diff --git a/browser/moz.configure b/browser/moz.configure
index a251050feb9b..3b6b377235ca 100644
--- a/browser/moz.configure
+++ b/browser/moz.configure
@@ -5,11 +5,11 @@
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
imply_option('MOZ_PLACES', True)
-imply_option('MOZ_SERVICES_HEALTHREPORT', True)
+imply_option('MOZ_SERVICES_HEALTHREPORT', False)
imply_option('MOZ_SERVICES_SYNC', True)
-imply_option('MOZ_DEDICATED_PROFILES', True)
-imply_option('MOZ_BLOCK_PROFILE_DOWNGRADE', True)
-imply_option('MOZ_NORMANDY', True)
+imply_option('MOZ_DEDICATED_PROFILES', False)
+imply_option('MOZ_BLOCK_PROFILE_DOWNGRADE', False)
+imply_option('MOZ_NORMANDY', False)
with only_when(target_is_linux & compile_environment):
option(env='MOZ_NO_PIE_COMPAT',
diff --git a/build/moz.configure/old.configure b/build/moz.configure/old.configure
index 136abbcafa69..9b663a1bf4f1 100644
--- a/build/moz.configure/old.configure
+++ b/build/moz.configure/old.configure
@@ -248,6 +248,12 @@ def old_configure_options(*options):
'--with-user-appdir',
'--x-includes',
'--x-libraries',
+
+ # Tor additions.
+ '--with-tor-browser-version',
+ '--enable-tor-browser-update',
+ '--enable-tor-browser-data-outside-app-dir',
+ '--enable-tor-launcher',
)
def prepare_configure_options(host, target, all_options, *options):
# old-configure only supports the options listed in @old_configure_options
diff --git a/mobile/android/confvars.sh b/mobile/android/confvars.sh
index 77191834d240..47a6a8dbae1d 100644
--- a/mobile/android/confvars.sh
+++ b/mobile/android/confvars.sh
@@ -30,9 +30,18 @@ MOZ_ANDROID_BROWSER_INTENT_CLASS=org.mozilla.gecko.BrowserApp
MOZ_NO_SMART_CARDS=1
+# Adds MIME-type support for raw video
MOZ_RAW=1
# use custom widget for html:select
MOZ_USE_NATIVE_POPUP_WINDOWS=1
MOZ_APP_ID={aa3c5121-dab2-40e2-81ca-7ea25febc110}
+
+### Tor Browser for Android ###
+
+# Disable telemetry at compile-time
+unset MOZ_TELEMETRY_REPORTING
+
+# Disable data reporting at compile-time
+unset MOZ_DATA_REPORTING
diff --git a/mobile/android/geckoview/build.gradle b/mobile/android/geckoview/build.gradle
index 82d36c179c92..c1b51537031d 100644
--- a/mobile/android/geckoview/build.gradle
+++ b/mobile/android/geckoview/build.gradle
@@ -92,6 +92,7 @@ android {
buildConfigField 'String', "MOZ_APP_DISPLAYNAME", "\"${mozconfig.substs.MOZ_APP_DISPLAYNAME}\"";
buildConfigField 'String', "MOZ_APP_UA_NAME", "\"${mozconfig.substs.MOZ_APP_UA_NAME}\"";
buildConfigField 'String', "MOZ_UPDATE_CHANNEL", "\"${mozconfig.substs.MOZ_UPDATE_CHANNEL}\"";
+ buildConfigField 'String', "TOR_BROWSER_VERSION", "\"${mozconfig.substs.TOR_BROWSER_VERSION}\"";
// MOZILLA_VERSION is oddly quoted from autoconf, but we don't have to handle it specially in Gradle.
buildConfigField 'String', "MOZILLA_VERSION", "\"${mozconfig.substs.MOZILLA_VERSION}\"";
diff --git a/mobile/android/moz.configure b/mobile/android/moz.configure
index fa510f0a57d3..f7b4df4ac24a 100644
--- a/mobile/android/moz.configure
+++ b/mobile/android/moz.configure
@@ -10,7 +10,7 @@ project_flag('MOZ_ANDROID_EXCLUDE_FONTS',
project_flag('MOZ_ANDROID_HLS_SUPPORT',
help='Enable HLS (HTTP Live Streaming) support (currently using the ExoPlayer library)',
- default=True)
+ default=False)
option(env='FENNEC_NIGHTLY',
help='Enable experimental code for Fennec Nightly users. NOTE: This is *not* equivalent '
@@ -26,9 +26,12 @@ def fennec_nightly(nightly):
return bool(nightly)
imply_option('MOZ_NORMANDY', False)
-imply_option('MOZ_SERVICES_HEALTHREPORT', True)
imply_option('MOZ_ANDROID_HISTORY', True)
imply_option('--enable-small-chunk-size', True)
+# Comment this so we can imply |False| in torbrowser.configure
+# The Build system doesn't allow multiple imply_option()
+# calls with the same key.
+#imply_option('MOZ_SERVICES_HEALTHREPORT', True)
@depends(target)
def check_target(target):
@@ -39,6 +42,8 @@ def check_target(target):
'Build_Instructions/Simple_Firefox_for_Android_build '
'for more information about the necessary options.')
+include('torbrowser.configure')
+
include('../../toolkit/moz.configure')
include('../../build/moz.configure/android-sdk.configure')
include('../../build/moz.configure/java.configure')
@@ -50,3 +55,11 @@ option(env='MOZ_ANDROID_FAT_AAR_ARCHITECTURES',
help='Comma-separated list of Android CPU architectures like "armeabi-v7a,arm64-v8a,x86,x86_64"')
set_config('MOZ_ANDROID_FAT_AAR_ARCHITECTURES', depends('MOZ_ANDROID_FAT_AAR_ARCHITECTURES')(lambda x: x))
+
+project_flag('MOZ_ANDROID_NETWORK_STATE',
+ help='Include permission for accessing WiFi/network state on Android',
+ default=False)
+
+project_flag('MOZ_ANDROID_LOCATION',
+ help='Include permission for accessing fine and course-grain Location on Android',
+ default=False)
diff --git a/mobile/android/torbrowser.configure b/mobile/android/torbrowser.configure
new file mode 100644
index 000000000000..2ff6215eedc9
--- /dev/null
+++ b/mobile/android/torbrowser.configure
@@ -0,0 +1,30 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Set Tor Browser default config
+
+imply_option('MOZ_ANDROID_EXCLUDE_FONTS', False)
+
+# Disable uploading crash reports and dump files to an external server
+# This is still configured in old-configure. Uncomment when this moves
+# to the python config
+#imply_option('MOZ_CRASHREPORTER', False)
+
+# Disable uploading information about the browser configuration and
+# performance to an external server
+imply_option('MOZ_SERVICES_HEALTHREPORT', False)
+
+# Disable creating telemetry and data reports that are uploaded to an
+# external server
+# These aren't actually configure options. These are disabled in
+# confvars.sh, but they look like configure options so we'll document
+# them here, as well.
+#XXX: no confvars.sh here
+#imply_option('MOZ_TELEMETRY_REPORTING', False)
+#imply_option('MOZ_DATA_REPORTING', False)
+
+imply_option('MOZ_ANDROID_NETWORK_STATE', False);
+imply_option('MOZ_ANDROID_LOCATION', False);
diff --git a/old-configure.in b/old-configure.in
index dfb072b19cfb..2c3308a27657 100644
--- a/old-configure.in
+++ b/old-configure.in
@@ -1966,6 +1966,55 @@ if test -n "$MOZ_UPDATER"; then
AC_DEFINE(MOZ_UPDATER)
fi
+dnl ========================================================
+dnl Tor additions
+dnl ========================================================
+MOZ_ARG_WITH_STRING(tor-browser-version,
+[ --with-tor-browser-version=VERSION
+ Set Tor Browser version, e.g., 7.0a1],
+ TOR_BROWSER_VERSION="$withval")
+
+if test -z "$TOR_BROWSER_VERSION"; then
+ AC_MSG_ERROR([--with-tor-browser-version is required for Tor Browser.])
+fi
+
+MOZ_ARG_ENABLE_BOOL(tor-browser-update,
+[ --enable-tor-browser-update
+ Enable Tor Browser update],
+ TOR_BROWSER_UPDATE=1,
+ TOR_BROWSER_UPDATE= )
+
+if test -n "$TOR_BROWSER_UPDATE"; then
+ AC_DEFINE(TOR_BROWSER_UPDATE)
+fi
+
+MOZ_ARG_ENABLE_BOOL(tor-browser-data-outside-app-dir,
+[ --enable-tor-browser-data-outside-app-dir
+ Enable Tor Browser data outside of app directory],
+ TOR_BROWSER_DATA_OUTSIDE_APP_DIR=1,
+ TOR_BROWSER_DATA_OUTSIDE_APP_DIR= )
+
+if test -n "$TOR_BROWSER_DATA_OUTSIDE_APP_DIR"; then
+ AC_DEFINE(TOR_BROWSER_DATA_OUTSIDE_APP_DIR)
+fi
+
+AC_DEFINE_UNQUOTED(TOR_BROWSER_VERSION,$TOR_BROWSER_VERSION)
+AC_DEFINE_UNQUOTED(TOR_BROWSER_VERSION_QUOTED,"$TOR_BROWSER_VERSION")
+AC_SUBST(TOR_BROWSER_UPDATE)
+AC_SUBST(TOR_BROWSER_DATA_OUTSIDE_APP_DIR)
+
+MOZ_ARG_DISABLE_BOOL(tor-launcher,
+[ --disable-tor-launcher
+ Do not include Tor Launcher],
+ TOR_BROWSER_DISABLE_TOR_LAUNCHER=1,
+ TOR_BROWSER_DISABLE_TOR_LAUNCHER=)
+
+if test -n "$TOR_BROWSER_DISABLE_TOR_LAUNCHER"; then
+ AC_DEFINE(TOR_BROWSER_DISABLE_TOR_LAUNCHER)
+fi
+
+AC_SUBST(TOR_BROWSER_DISABLE_TOR_LAUNCHER)
+
dnl ========================================================
dnl parental controls (for Windows Vista)
dnl ========================================================
diff --git a/security/moz.build b/security/moz.build
index dec6f3ef7e21..f00f9fe5d7a7 100644
--- a/security/moz.build
+++ b/security/moz.build
@@ -85,7 +85,7 @@ gyp_vars['nss_dist_obj_dir'] = '$PRODUCT_DIR/dist/bin'
gyp_vars['disable_tests'] = 1
gyp_vars['disable_dbm'] = 1
gyp_vars['disable_libpkix'] = 1
-gyp_vars['enable_sslkeylogfile'] = 1
+gyp_vars['enable_sslkeylogfile'] = 0
# pkg-config won't reliably find zlib on our builders, so just force it.
# System zlib is only used for modutil and signtool unless
# SSL zlib is enabled, which we are disabling immediately below this.
diff --git a/security/nss/lib/ssl/Makefile b/security/nss/lib/ssl/Makefile
index 8a8b06f4b508..90571bb3e256 100644
--- a/security/nss/lib/ssl/Makefile
+++ b/security/nss/lib/ssl/Makefile
@@ -41,7 +41,7 @@ endif
# Enable key logging by default in debug builds, but not opt builds.
# Logging still needs to be enabled at runtime through env vars.
-NSS_ALLOW_SSLKEYLOGFILE ?= $(if $(BUILD_OPT),0,1)
+NSS_ALLOW_SSLKEYLOGFILE ?= 0
ifeq (1,$(NSS_ALLOW_SSLKEYLOGFILE))
DEFINES += -DNSS_ALLOW_SSLKEYLOGFILE=1
endif
diff --git a/toolkit/modules/AppConstants.jsm b/toolkit/modules/AppConstants.jsm
index 9b035435aed6..cd8ca2659626 100644
--- a/toolkit/modules/AppConstants.jsm
+++ b/toolkit/modules/AppConstants.jsm
@@ -341,6 +341,8 @@ this.AppConstants = Object.freeze({
MOZ_WIDGET_TOOLKIT: "@MOZ_WIDGET_TOOLKIT@",
ANDROID_PACKAGE_NAME: "@ANDROID_PACKAGE_NAME@",
+ TOR_BROWSER_VERSION: "@TOR_BROWSER_VERSION@",
+
DEBUG_JS_MODULES: "@DEBUG_JS_MODULES@",
MOZ_BING_API_CLIENTID: "@MOZ_BING_API_CLIENTID@",
@@ -418,4 +420,11 @@ this.AppConstants = Object.freeze({
#else
false,
#endif
+
+ TOR_BROWSER_UPDATE:
+#ifdef TOR_BROWSER_UPDATE
+ true,
+#else
+ false,
+#endif
});
diff --git a/toolkit/modules/moz.build b/toolkit/modules/moz.build
index e5858122fa1c..f000f35c126f 100644
--- a/toolkit/modules/moz.build
+++ b/toolkit/modules/moz.build
@@ -296,6 +296,9 @@ for var in ('MOZ_ALLOW_ADDON_SIDELOAD',
if CONFIG[var]:
DEFINES[var] = True
+if CONFIG['TOR_BROWSER_UPDATE']:
+ DEFINES['TOR_BROWSER_UPDATE'] = 1
+
JAR_MANIFESTS += ['jar.mn']
DEFINES['TOPOBJDIR'] = TOPOBJDIR
[View Less]
commit 1eb2a004fc89f363b18351f11649071cde6f8d1a
Author: Mike Perry <mikeperry-git(a)torproject.org>
Date: Tue Dec 4 16:03:13 2012 -0800
Bug 3547: Block all plugins.
We cannot use the @mozilla.org/extensions/blocklist;1 service, because we
actually want to stop plugins from ever entering the browser's process space
and/or executing code (for example, AV plugins that collect statistics/analyse
urls, magical toolbars that phone home or "help" the user, skype …
[View More]buttons that
ruin our day, and censorship filters). Hence we rolled our own.
See https://trac.torproject.org/projects/tor/ticket/3547#comment:6 for musings
on a better way. Until then, it is delta-darwinism for us.
---
dom/plugins/base/PluginFinder.cpp | 3 +++
1 file changed, 3 insertions(+)
diff --git a/dom/plugins/base/PluginFinder.cpp b/dom/plugins/base/PluginFinder.cpp
index 4e1c1fd53698..cace7d4ef6ba 100644
--- a/dom/plugins/base/PluginFinder.cpp
+++ b/dom/plugins/base/PluginFinder.cpp
@@ -480,6 +480,9 @@ nsresult PluginFinder::ScanPluginsDirectory(nsIFile* pluginsDir,
*aPluginsChanged = false;
+ // Block all plugins
+ return NS_OK;
+
#ifdef PLUGIN_LOGGING
nsAutoCString dirPath;
pluginsDir->GetNativePath(dirPath);
[View Less]
commit b5129b67c7f331487439f22daf0e9a0e06f5941e
Author: Arthur Edelstein <arthuredelstein(a)gmail.com>
Date: Wed Aug 27 16:25:00 2014 -0700
Bug 12620: TorBrowser regression tests
Regression tests for Bug #2950: Make Permissions Manager memory-only
Regression tests for TB4: Tor Browser's Firefox preference overrides.
Note: many more functional tests could be made here
Regression tests for #2874: Block Components.interfaces from content
…
[View More]Bug 18923: Add a script to run all Tor Browser specific tests
Regression tests for Bug #16441: Suppress "Reset Tor Browser" prompt.
---
run-tbb-tests | 60 +++++++++++++++
tbb-tests/browser.ini | 5 ++
tbb-tests/browser_tor_TB4.js | 162 +++++++++++++++++++++++++++++++++++++++
tbb-tests/browser_tor_bug2950.js | 74 ++++++++++++++++++
tbb-tests/mochitest.ini | 3 +
tbb-tests/moz.build | 10 +++
tbb-tests/test_tor_bug2874.html | 25 ++++++
toolkit/toolkit.mozbuild | 3 +-
8 files changed, 341 insertions(+), 1 deletion(-)
diff --git a/run-tbb-tests b/run-tbb-tests
new file mode 100755
index 000000000000..5e266f9ba4cd
--- /dev/null
+++ b/run-tbb-tests
@@ -0,0 +1,60 @@
+#!/bin/bash
+
+# This script runs all the Mochitest tests that have been added or
+# modified since the last ffxbld commit.
+#
+# It does not currently run XPCShell tests. We should change this if we
+# start using this type or other types of tests.
+#
+# The logs of the tests are stored in the tbb-tests.log file.
+# Ignored tests are listed in the tbb-tests-ignore.txt file.
+#
+# https://trac.torproject.org/projects/tor/ticket/18923
+
+IFS=$'\n'
+
+if [ -n "$USE_TESTS_LIST" ] && [ -f tbb-tests-list.txt ]
+then
+ echo "Using tests list from file tbb-tests-list.txt"
+ tests=($(cat tbb-tests-list.txt))
+else
+ ffxbld_commit=$(git log -500 --format='%an %H' | grep '^ffxbld ' \
+ | head -1 | cut -d ' ' -f 2)
+
+ tests=($(git diff --name-status "$ffxbld_commit" HEAD | \
+ grep -e '^[AM].*/test_[^/]\+\.\(html\|xul\)$' \
+ -e '^[AM].*/browser_[^/]\+\.js$' \
+ | sed 's/^[AM]\s\+//'))
+fi
+
+echo 'The following tests will be run:'
+for i in "${!tests[@]}"
+do
+ if [ -z "$USE_TESTS_LIST" ] \
+ && grep -q "^${tests[$i]}$" tbb-tests-ignore.txt
+ then
+ unset "tests[$i]"
+ continue
+ fi
+ echo "- ${tests[$i]}"
+done
+
+if [ -n "$WRITE_TESTS_LIST" ]
+then
+ rm -f tbb-tests-list.txt
+ for i in "${!tests[@]}"
+ do
+ echo "${tests[$i]}" >> tbb-tests-list.txt
+ done
+ exit 0
+fi
+
+rm -f tbb-tests.log
+echo $'\n''Starting tests'
+./mach mochitest --log-tbpl tbb-tests.log --setpref security.nocertdb=false \
+ "${tests[@]}"
+
+echo "*************************"
+echo "*************************"
+echo "Summary of failed tests:"
+grep --color=never TEST-UNEXPECTED-FAIL tbb-tests.log
diff --git a/tbb-tests/browser.ini b/tbb-tests/browser.ini
new file mode 100644
index 000000000000..f481660f1417
--- /dev/null
+++ b/tbb-tests/browser.ini
@@ -0,0 +1,5 @@
+[DEFAULT]
+
+[browser_tor_bug2950.js]
+[browser_tor_omnibox.js]
+[browser_tor_TB4.js]
diff --git a/tbb-tests/browser_tor_TB4.js b/tbb-tests/browser_tor_TB4.js
new file mode 100644
index 000000000000..af688bee0226
--- /dev/null
+++ b/tbb-tests/browser_tor_TB4.js
@@ -0,0 +1,162 @@
+// # Test for TB4: Tor Browser's Firefox preference overrides
+// Simple regression tests to check the value of each pref and
+// decides if it is set as expected.
+
+// TODO: Write unit tests to check that each pref setting here
+// causes the browser to have the desired behavior (a big task).
+
+function test() {
+
+let expectedPrefs = [
+ // Disable browser auto updaters and associated homepage notifications
+ ["app.update.auto", false],
+ ["app.update.enabled", false],
+ ["browser.search.update", false],
+ ["browser.rights.3.shown", true],
+ ["browser.startup.homepage_override.mstone", "ignore"],
+ ["startup.homepage_welcome_url", ""],
+ ["startup.homepage_override_url", ""],
+
+ // Disable the "Refresh" prompt that is displayed for stale profiles.
+ ["browser.disableResetPrompt", true],
+
+ // Disk activity: Disable Browsing History Storage
+ ["browser.privatebrowsing.autostart", true],
+ ["browser.cache.disk.enable", false],
+ ["browser.cache.offline.enable", false],
+ ["dom.indexedDB.enabled", false],
+ ["permissions.memory_only", true],
+ ["network.cookie.lifetimePolicy", 2],
+ ["security.nocertdb", true],
+
+ // Disk activity: TBB Directory Isolation
+ ["browser.download.useDownloadDir", false],
+ ["browser.shell.checkDefaultBrowser", false],
+ ["browser.download.manager.addToRecentDocs", false],
+
+ // Misc privacy: Disk
+ ["signon.rememberSignons", false],
+ ["browser.formfill.enable", false],
+ ["signon.autofillForms", false],
+ ["browser.sessionstore.privacy_level", 2],
+ ["media.cache_size", 0],
+
+ // Misc privacy: Remote
+ ["browser.send_pings", false],
+ ["geo.enabled", false],
+ ["geo.wifi.uri", ""],
+ ["browser.search.suggest.enabled", false],
+ ["browser.safebrowsing.malware.enabled", false],
+ ["extensions.ui.lastCategory", "addons://list/extension"],
+ ["datareporting.healthreport.uploadEnabled", false],
+ ["datareporting.policy.dataSubmissionEnabled", false],
+ ["security.mixed_content.block_active_content", false], // Disable until https://bugzilla.mozilla.org/show_bug.cgi?id=878890 is patched
+ ["browser.syncPromoViewsLeftMap", "{\"addons\":0, \"passwords\":0, \"bookmarks\":0}"], // Don't promote sync
+ ["services.sync.engine.prefs", false], // Never sync prefs, addons, or tabs with other browsers
+ ["services.sync.engine.addons", false],
+ ["services.sync.engine.tabs", false],
+ ["extensions.getAddons.cache.enabled", false], // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
+
+ // Fingerprinting
+ ["webgl.min_capability_mode", true],
+ ["webgl.disable-extensions", true],
+ ["dom.battery.enabled", false], // fingerprinting due to differing OS implementations
+ ["browser.display.max_font_attempts",10],
+ ["browser.display.max_font_count",10],
+ ["gfx.downloadable_fonts.fallback_delay", -1],
+ ["browser.startup.homepage_override.buildID", "20100101"],
+
+ // Third party stuff
+ ["network.cookie.cookieBehavior", 1],
+ ["security.enable_tls_session_tickets", false],
+ ["network.http.spdy.enabled", false], // Stores state and may have keepalive issues (both fixable)
+ ["network.http.spdy.enabled.v2", false], // Seems redundant, but just in case
+ ["network.http.spdy.enabled.v3", false], // Seems redundant, but just in case
+
+ // Proxy and proxy security
+ ["network.proxy.socks", "127.0.0.1"],
+ ["network.proxy.socks_port", 9150],
+ ["network.proxy.socks_remote_dns", true],
+ ["network.proxy.no_proxies_on", ""], // For fingerprinting and local service vulns (#10419)
+ ["network.proxy.type", 1],
+ ["network.security.ports.banned", "9050,9051,9150,9151"],
+ ["network.dns.disablePrefetch", true],
+ ["network.protocol-handler.external-default", false],
+ ["network.protocol-handler.external.mailto", false],
+ ["network.protocol-handler.external.news", false],
+ ["network.protocol-handler.external.nntp", false],
+ ["network.protocol-handler.external.snews", false],
+ ["network.protocol-handler.warn-external.mailto", true],
+ ["network.protocol-handler.warn-external.news", true],
+ ["network.protocol-handler.warn-external.nntp", true],
+ ["network.protocol-handler.warn-external.snews", true],
+
+ // Network and performance
+ ["network.http.pipelining", true],
+ ["network.http.pipelining.aggressive", true],
+ ["network.http.pipelining.maxrequests", 12],
+ ["network.http.pipelining.ssl", true],
+ ["network.http.proxy.pipelining", true],
+ ["security.ssl.enable_false_start", true],
+ ["network.http.keep-alive.timeout", 20],
+ ["network.http.connection-retry-timeout", 0],
+ ["network.http.max-persistent-connections-per-proxy", 256],
+ ["network.http.pipelining.reschedule-timeout", 15000],
+ ["network.http.pipelining.read-timeout", 60000],
+ // Hacked pref: Now means "Attempt to pipeline at least this many requests together"
+ ["network.http.pipelining.max-optimistic-requests", 3],
+ ["security.disable_session_identifiers", true],
+
+ // Extension support
+ ["extensions.autoDisableScopes", 0],
+ ["extensions.bootstrappedAddons", "{}"],
+ ["extensions.checkCompatibility.4.*", false],
+ ["extensions.databaseSchema", 3],
+ ["extensions.enabledAddons", "https-everywhere%40eff.org:3.1.4,%7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.6.1,torbutton%40torproject.org:1.5.2,ubufox%40ubuntu.com:2.6,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.5"],
+ ["extensions.enabledItems", "langpack-en-US@firefox.mozilla.org:,{73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.57,{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.4,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.8"],
+ ["extensions.enabledScopes", 1],
+ ["extensions.pendingOperations", false],
+ ["xpinstall.whitelist.add", ""],
+ ["xpinstall.whitelist.add.36", ""],
+
+ // Omnibox settings
+ ["keyword.URL", "https://startpage.com/do/search?q="],
+
+ // Hacks/workarounds: Direct2D seems to crash w/ lots of video cards w/ MinGW?
+ // Nvida cards also experience crashes without the second pref set to disabled
+ ["gfx.direct2d.disabled", true],
+ ["layers.acceleration.disabled", true],
+
+ // Security enhancements
+ // https://trac.torproject.org/projects/tor/ticket/9387#comment:17
+ ["javascript.options.ion.content", false],
+ ["javascript.options.baselinejit.content", false],
+ ["javascript.options.asmjs", false],
+ ["javascript.options.typeinference", false],
+
+ // Enable TLS 1.1 and 1.2:
+ // https://trac.torproject.org/projects/tor/ticket/11253
+ ["security.tls.version.max", 3],
+
+ // Version placeholder
+ ["torbrowser.version", "UNKNOWN"],
+
+ ];
+
+let getPref = function (prefName) {
+ let type = gPrefService.getPrefType(prefName);
+ if (type === gPrefService.PREF_INT) return gPrefService.getIntPref(prefName);
+ if (type === gPrefService.PREF_BOOL) return gPrefService.getBoolPref(prefName);
+ if (type === gPrefService.PREF_STRING) return gPrefService.getCharPref(prefName);
+ // Something went wrong.
+ throw new Error("Can't access pref " + prefName);
+};
+
+let testPref = function([key, expectedValue]) {
+ let foundValue = getPref(key);
+ is(foundValue, expectedValue, "Pref '" + key + "' should be '" + expectedValue +"'.");
+};
+
+expectedPrefs.map(testPref);
+
+} // end function test()
diff --git a/tbb-tests/browser_tor_bug2950.js b/tbb-tests/browser_tor_bug2950.js
new file mode 100644
index 000000000000..010cc6356202
--- /dev/null
+++ b/tbb-tests/browser_tor_bug2950.js
@@ -0,0 +1,74 @@
+// # Regression tests for tor Bug #2950, Make Permissions Manager memory-only
+// Ensures that permissions.sqlite file in profile directory is not written to,
+// even when we write a value to Firefox's permissions database.
+
+// The requisite test() function.
+function test() {
+
+// Needed because of asynchronous part later in the test.
+waitForExplicitFinish();
+
+// Shortcut
+let Ci = Components.interfaces;
+
+// ## utility functions
+
+// __uri(spec)__.
+// Creates an nsIURI instance from a spec
+// (string address such as "http://torproject.org").
+let uri = spec => Services.io.newURI(spec, null, null);
+
+// __setPermission(spec, key, value)__.
+// Sets the site permission of type key to value, for the site located at address spec.
+let setPermission = (spec, key, value) => SitePermissions.set(uri(spec), key, value);
+
+// __getPermission(spec, key)__.
+// Reads the site permission value for permission type key, for the site
+// located at address spec.
+let getPermission = (spec, key) => SitePermissions.get(uri(spec), key);
+
+// __profileDirPath__.
+// The Firefox Profile directory. Expected location of various persistent files.
+let profileDirPath = Services.dirsvc.get("ProfD", Components.interfaces.nsIFile).path;
+
+// __fileInProfile(fileName)__.
+// Returns an nsIFile instance corresponding to a file in the Profile directory.
+let fileInProfile = fileName => FileUtils.File(profileDirPath + "/" + fileName);
+
+// ## Now let's run the test.
+
+let SITE = "http://torproject.org",
+ KEY = "popup";
+
+let permissionsFile = fileInProfile("permissions.sqlite"),
+ lastModifiedTime = null,
+ newModifiedTime = null;
+if (permissionsFile.exists()) {
+ lastModifiedTime = permissionsFile.lastModifiedTime;
+}
+// Read the original value of the permission.
+let originalValue = getPermission(SITE, KEY);
+
+// We need to delay by at least 1000 ms, because that's the granularity
+// of file time stamps, it seems.
+window.setTimeout(
+ function () {
+ // Set the permission to a new value.
+ setPermission(SITE, KEY, (originalValue === 0) ? 1 : 0);
+ // Now read back the permission value again.
+ let newReadValue = getPermission(SITE, KEY);
+ // Compare to confirm that the permission
+ // value was successfully changed.
+ isnot(newReadValue, originalValue, "Set a value in permissions db (perhaps in memory).");;
+ // If file existed or now exists, get the current time stamp.
+ if (permissionsFile.exists()) {
+ newModifiedTime = permissionsFile.lastModifiedTime;
+ }
+ // If file was created or modified since we began this test,
+ // then permissions db is not memory only. Complain!
+ is(lastModifiedTime, newModifiedTime, "Don't write to permissions.sqlite file on disk.");
+ // We are done with the test.
+ finish();
+ }, 1100);
+
+} // test()
diff --git a/tbb-tests/mochitest.ini b/tbb-tests/mochitest.ini
new file mode 100644
index 000000000000..cc5172733bbe
--- /dev/null
+++ b/tbb-tests/mochitest.ini
@@ -0,0 +1,3 @@
+[DEFAULT]
+
+[test_tor_bug2874.html]
diff --git a/tbb-tests/moz.build b/tbb-tests/moz.build
new file mode 100644
index 000000000000..de8a41a67a5c
--- /dev/null
+++ b/tbb-tests/moz.build
@@ -0,0 +1,10 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+MOCHITEST_MANIFESTS += ['mochitest.ini']
+
+BROWSER_CHROME_MANIFESTS += [ 'browser.ini' ]
+
diff --git a/tbb-tests/test_tor_bug2874.html b/tbb-tests/test_tor_bug2874.html
new file mode 100644
index 000000000000..c0a956e9f687
--- /dev/null
+++ b/tbb-tests/test_tor_bug2874.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+Tor bug
+https://trac.torproject.org/projects/tor/ticket/2874
+-->
+<head>
+ <meta charset="utf-8">
+ <title>Test for Tor Bug 2874</title>
+ <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+ <script type="application/javascript">
+ is(typeof Components, 'undefined', "The global window object should not expose a Components property to untrusted content.");
+ </script>
+</head>
+<body>
+<a target="_blank" href="https://trac.torproject.org/projects/tor/ticket/2874">Tor Bug 2874</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/toolkit/toolkit.mozbuild b/toolkit/toolkit.mozbuild
index d092b8b22346..6e35a4602300 100644
--- a/toolkit/toolkit.mozbuild
+++ b/toolkit/toolkit.mozbuild
@@ -96,7 +96,8 @@ if CONFIG['MOZ_WEBRTC'] and CONFIG['COMPILE_ENVIRONMENT']:
]
if CONFIG['ENABLE_TESTS']:
- DIRS += ['/testing/specialpowers']
+ DIRS += ['/testing/specialpowers',
+ '/tbb-tests']
DIRS += [
'/testing/gtest',
[View Less]
commit 624f72d5c581c66c30f53389c42006405bcaeb8d
Author: Mike Perry <mikeperry-git(a)torproject.org>
Date: Wed Aug 27 15:19:10 2014 -0700
Bug 12974: Disable NTLM and Negotiate HTTP Auth
This is technically an embargoed Mozilla bug, so I probably shouldn't provide
too many details.
Suffice to say that NTLM and Negotiate auth are bad for Tor users, and I doubt
very many (or any of them) actually need it.
The Mozilla bug is https://bugzilla.mozilla.…
[View More]org/show_bug.cgi?id=1046421
---
extensions/auth/nsHttpNegotiateAuth.cpp | 4 ++++
netwerk/protocol/http/nsHttpNTLMAuth.cpp | 3 +++
2 files changed, 7 insertions(+)
diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp
index 99720475b9dd..1c08fcf3da7e 100644
--- a/extensions/auth/nsHttpNegotiateAuth.cpp
+++ b/extensions/auth/nsHttpNegotiateAuth.cpp
@@ -152,6 +152,10 @@ nsHttpNegotiateAuth::ChallengeReceived(nsIHttpAuthenticableChannel* authChannel,
nsIAuthModule* rawModule = (nsIAuthModule*)*continuationState;
*identityInvalid = false;
+
+ /* Always fail Negotiate auth for Tor Browser. We don't need it. */
+ return NS_ERROR_ABORT;
+
if (rawModule) {
return NS_OK;
}
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index 0a30de051014..891aaadfd758 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -168,6 +168,9 @@ nsHttpNTLMAuth::ChallengeReceived(nsIHttpAuthenticableChannel* channel,
*identityInvalid = false;
+ /* Always fail Negotiate auth for Tor Browser. We don't need it. */
+ return NS_ERROR_ABORT;
+
// Start a new auth sequence if the challenge is exactly "NTLM".
// If native NTLM auth apis are available and enabled through prefs,
// try to use them.
[View Less]
commit 2bf87ae29553b933450965c1bc43e7470c008d2e
Author: Kathy Brade <brade(a)pearlcrescent.com>
Date: Tue Feb 26 10:07:17 2019 -0500
Bug 28044: Integrate Tor Launcher into tor-browser
Build and package Tor Launcher as part of the browser (similar to
how pdfjs is handled).
If a Tor Launcher extension is present in the user's profile, it is
removed.
---
browser/extensions/moz.build | 5 +++++
browser/installer/package-manifest.in …
[View More] | 5 +++++
toolkit/mozapps/extensions/internal/XPIProvider.jsm | 10 ++++++++++
3 files changed, 20 insertions(+)
diff --git a/browser/extensions/moz.build b/browser/extensions/moz.build
index 4c9fa789d12a..fd2e65d01f02 100644
--- a/browser/extensions/moz.build
+++ b/browser/extensions/moz.build
@@ -12,3 +12,8 @@ DIRS += [
'webcompat',
'report-site-issue'
]
+
+if not CONFIG['TOR_BROWSER_DISABLE_TOR_LAUNCHER']:
+ DIRS += [
+ 'tor-launcher',
+ ]
diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index 7deaf1b51f9a..582a6e13d607 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -248,6 +248,11 @@
@RESPATH@/browser/chrome/browser.manifest
@RESPATH@/browser/chrome/pdfjs.manifest
@RESPATH@/browser/chrome/pdfjs/*
+#ifndef TOR_BROWSER_DISABLE_TOR_LAUNCHER
+@RESPATH@/browser/chrome/torlauncher.manifest
+@RESPATH@/browser/chrome/torlauncher/*
+@RESPATH@/browser/@PREF_DIR@/torlauncher-prefs.js
+#endif
@RESPATH@/chrome/toolkit@JAREXT@
@RESPATH@/chrome/toolkit.manifest
@RESPATH@/chrome/recording.manifest
diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
index ba67e5f6bee8..bcdf6f40d5ed 100644
--- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
@@ -1462,6 +1462,16 @@ var XPIStates = {
for (let [id, file] of loc.readAddons()) {
knownIds.delete(id);
+ // Since it is now part of the browser, uninstall the Tor Launcher
+ // extension. This will remove the Tor Launcher .xpi from user
+ // profiles on macOS.
+ if (id === "tor-launcher(a)torproject.org") {
+ logger.debug("Uninstalling the Tor Launcher extension.");
+ loc.installer.uninstallAddon(id);
+ changed = true;
+ continue;
+ }
+
let xpiState = loc.get(id);
if (!xpiState) {
// If the location is not supported for sideloading, skip new
[View Less]