January 2021 - tbb-commits - lists.torproject.org

[Git][tpo/applications/fenix] Pushed new branch tor-browser-85.1.0-10.5-1
by Matthew Finkel 21 Jan '21

21 Jan '21

Matthew Finkel pushed new branch tor-browser-85.1.0-10.5-1 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-85.… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[tor-browser-spec/master] Update FF78 audit
by sysrqb＠torproject.org 21 Jan '21

21 Jan '21

commit 82a0f0b04a7ef60b8693f932c24ecf0464a1ca14 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jan 21 19:58:15 2021 +0000 Update FF78 audit --- audits/FF78_NETWORK_AUDIT | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/audits/FF78_NETWORK_AUDIT b/audits/FF78_NETWORK_AUDIT index 81308ea..02a2270 100644 --- a/audits/FF78_NETWORK_AUDIT +++ b/audits/FF78_NETWORK_AUDIT @@ -1,6 +1,6 @@ Summary of findings: https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34177 -`git diff 8da33f6c34c0ca5b1d7bca58ca86cb5e436333e8 0b024105bfcb2304529100c159eda55374dceec3` +`git diff 8da33f6c34c0ca5b1d7bca58ca86cb5e436333e8 56ab7e2d173accfa5cde46659c7b801c8dab2a3e` and then go over all the changes containing the above mentioned potentially dangerous calls and features. Grep the diff for the following strings and examine surrounding usage.

1 0

[tor-browser-build/master] Bug 33693: Change snowflake and meek dummy address
by gk＠torproject.org 21 Jan '21

21 Jan '21

commit 8bd845464ae14bf56e0187dfa6f6e773a6593f55 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Wed Jan 20 10:52:53 2021 -0500 Bug 33693: Change snowflake and meek dummy address The previous dummy addresses of form 0.0.X.0 were marked by Tor as internal, causing bandwidth events to be skipped. This changes pluggable transport dummy addresses to the 192.0.2.0/24 range. --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index c414212..22e9984 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -18,6 +18,6 @@ pref("extensions.torlauncher.default_bridge.obfs4.13", "obfs4 45.145.95.6:27015 pref("extensions.torlauncher.default_bridge.obfs4.14", "obfs4 [2a0c:4d80:42:702::1]:27015 C5B7CD6946FF10C5B3E89691A7D3F2C122D2117C cert=TD7PbUO0/0k6xYHMPW3vJxICfkMZNdkRrb63Zhl5j9dW3iRGiCx0A7mPhe5T2EDzQ35+Zw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.15", "obfs4 51.222.13.177:80 5EDAC3B810E12B01F6FD8050D2FD3E277B289A08 cert=2uplIpLQ0q9+0qMFrK5pkaYRDOe460LL9WHBvatgkuRr/SL31wBOEupaMMJ6koRE6Ld0ew iat-mode=0"); -pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek_lite 0.0.2.0:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); +pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek_lite 192.0.2.2:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com"); -pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72"); +pref("extensions.torlauncher.default_bridge.snowflake.1", "snowflake 192.0.2.3:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72");

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gitlab/merge-requests/192'
by gk＠torproject.org 21 Jan '21

21 Jan '21

commit bde528acb3ac70bffb69f5dfa55a6595761b7b56 Merge: c2dce3c 8bd8454 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 21 08:08:14 2021 +0000 Merge remote-tracking branch 'gitlab/merge-requests/192' projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor-browser-bundle-testsuite/master] Merge remote-tracking branch 'gitlab/merge-requests/9'
by gk＠torproject.org 21 Jan '21

21 Jan '21

commit eb5817550cd018de28e7bf0c0c0e7f16128d7406 Merge: 97c7e5d b0171e4 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jan 21 07:42:53 2021 +0000 Merge remote-tracking branch 'gitlab/merge-requests/9' TBBTestSuite/Tests/TorBootstrap.pm | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

1 0

[tor-browser-bundle-testsuite/master] Bug 40016: Start Tor with DisableNetwork=1
by gk＠torproject.org 21 Jan '21

21 Jan '21

commit b0171e40c3a40f45d62a41265a27c66778a346b0 Author: Alex Catarineu <acat(a)torproject.org> Date: Wed Jan 20 13:19:54 2021 +0100 Bug 40016: Start Tor with DisableNetwork=1 This should be closer to how it's done by tor-launcher and should help us catch issues like tor-browser#40282. --- TBBTestSuite/Tests/TorBootstrap.pm | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/TBBTestSuite/Tests/TorBootstrap.pm b/TBBTestSuite/Tests/TorBootstrap.pm index 006be59..252ce67 100644 --- a/TBBTestSuite/Tests/TorBootstrap.pm +++ b/TBBTestSuite/Tests/TorBootstrap.pm @@ -62,6 +62,10 @@ sub monitor_bootstrap { print $sock 'AUTHENTICATE "', $control_passwd, "\"\n"; my $r = <$sock>; exit_error "Authentication error: $r" unless $r =~ m/^250 OK/; + + print $sock "SETCONF DisableNetwork=0\n"; + $r = <$sock>; + exit_error "SETCONF DisableNetwork=0 error: $r" unless $r =~ m/^250 OK/; my $i = 0; while (1) { print $sock "GETINFO status/bootstrap-phase\n"; @@ -162,7 +166,8 @@ sub start_tor { 'GeoIPFile', winpath($tbbinfos->{torgeoip}), 'ClientOnionAuthDir', winpath("$tbbinfos->{datadir}/Tor/onion-auth"), '__SocksPort', "$options->{'tor-socks-port'} ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth", - '__OwningControllerProcess', winpid($$)); + '__OwningControllerProcess', winpid($$), + 'DisableNetwork', '1'); $tbbinfos->{torpid} = fork; if ($tbbinfos->{torpid} == 0) { $ENV{LD_LIBRARY_PATH} = "$tbbinfos->{tbbdir}:$tbbinfos->{tordir}";

1 0

[tor-browser-build/maint-10.0-desktop] Pick up Firefox's build2
by sysrqb＠torproject.org 20 Jan '21

20 Jan '21

commit 24786d3dc04e3776a91570cf723218c19d059dde Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jan 20 21:58:24 2021 +0000 Pick up Firefox's build2 --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 4 ++-- rbm.conf | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 34d6fad..17a707a 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' targets: diff --git a/projects/firefox/config b/projects/firefox/config index f0ea1f4..1ffe7b0 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 @@ -49,7 +49,7 @@ targets: branding_directory: 'browser/branding/official' nightly: - git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1' + git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2' tag_gpg_id: 0 var: branding_directory: 'browser/branding/nightly' diff --git a/rbm.conf b/rbm.conf index bb94119..776ddbe 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '10.0.9' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.0.7 - 10.0.8

1 0

[tor-browser-build/maint-10.0-desktop] Tor Browser 10.0.9 release preparations
by sysrqb＠torproject.org 20 Jan '21

20 Jan '21

commit d268b64f6e1d627d39c53775eaf5773be9850811 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jan 20 17:52:22 2021 +0000 Tor Browser 10.0.9 release preparations Version bumps and Changelog update --- projects/firefox/config | 2 +- projects/go/config | 4 ++-- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 9 +++++++++ projects/tor-browser/config | 4 ++-- rbm.conf | 3 ++- 5 files changed, 16 insertions(+), 6 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 04ea384..f0ea1f4 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 78.6.1 + firefox_platform_version: 78.7.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 10.0 branding_directory: 'browser/branding/alpha' diff --git a/projects/go/config b/projects/go/config index 1651b90..f22c283 100644 --- a/projects/go/config +++ b/projects/go/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.14.13 +version: 1.14.14 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' var: @@ -118,7 +118,7 @@ input_files: enable: '[% ! c("var/linux") %]' - URL: 'https://golang.org/dl/go[% c("version") %].src.tar.gz' name: go - sha256sum: ba1d244c6b5c0ed04aa0d7856d06aceb89ed31b895de6ff783efb1cc8ab6b177 + sha256sum: 6204bf32f58fae0853f47f1bd0c51d9e0ac11f1ffb406bed07a0a8b016c8a76f - URL: 'https://golang.org/dl/go[% c("var/go14_version") %].src.tar.gz' name: go14 sha256sum: 9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 90989b8..384b2e1 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,12 @@ +Tor Browser 10.0.9 -- January 26 2021 + * Windows + OS X + Linux + * Update Firefox to 78.7.0esr + * Update NoScript to 11.1.8 + * Bug 40249: Remove EOY 2020 Campaign [tor-browser] + * Build System + * Windows + OS X + Linux + * Update Go to 1.14.14 + Tor Browser 10.0.8 -- January 12 2021 * Windows + OS X + Linux * Update Firefox to 78.6.1esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 2aa9849..35d53f0 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -77,9 +77,9 @@ input_files: enable: '[% c("var/snowflake") && ! c("var/android") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 9d65fc25020aa1f02d9a80112227cd4c1e4588db6d87372d87a8f15132084c43 + sha256sum: 5f68a63637e286433089aeb3b6a0aa930317dd988184876b5d6dcff2ca07bb34 - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/rbm.conf b/rbm.conf index 678f9b2..bb94119 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0.8' + torbrowser_version: '10.0.9' torbrowser_build: 'build1' torbrowser_incremental_from: - 10.0.7 + - 10.0.8 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser/tor-browser-78.7.0esr-10.0-1] Bug 23104: Add a default line height compensation
by sysrqb＠torproject.org 20 Jan '21

20 Jan '21

commit 290b99b1ff1c086ac42f60210c126576f9bf7f74 Author: Igor Oliveira <igor.oliveira(a)posteo.net> Date: Sun Dec 10 18:16:59 2017 -0200 Bug 23104: Add a default line height compensation Many fonts have issues with their vertical metrics. they are used to influence the height of ascenders and depth of descenders. Gecko uses it to calculate the line height (font height + ascender + descender), however because of that idiosyncratic behavior across multiple operating systems, it can be used to identify the user's OS. The solution proposed in the patch uses a default factor to be multiplied with the font size, simulating the concept of ascender and descender. This way all operating systems will have the same line height only and only if the frame is outside the chrome. --- layout/generic/ReflowInput.cpp | 19 ++++++++--- layout/generic/test/mochitest.ini | 1 + layout/generic/test/test_tor_bug23104.html | 51 ++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+), 5 deletions(-) diff --git a/layout/generic/ReflowInput.cpp b/layout/generic/ReflowInput.cpp index 5b1f6d62043a..5da354f86558 100644 --- a/layout/generic/ReflowInput.cpp +++ b/layout/generic/ReflowInput.cpp @@ -30,6 +30,7 @@ #include <algorithm> #include "mozilla/dom/HTMLInputElement.h" #include "nsGridContainerFrame.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::css; @@ -2690,7 +2691,8 @@ void ReflowInput::CalculateBlockSideMargins(LayoutFrameType aFrameType) { // For risk management, we use preference to control the behavior, and // eNoExternalLeading is the old behavior. -static nscoord GetNormalLineHeight(nsFontMetrics* aFontMetrics) { +static nscoord GetNormalLineHeight(nsIContent* aContent, + nsFontMetrics* aFontMetrics) { MOZ_ASSERT(nullptr != aFontMetrics, "no font metrics"); nscoord normalLineHeight; @@ -2698,6 +2700,12 @@ static nscoord GetNormalLineHeight(nsFontMetrics* aFontMetrics) { nscoord externalLeading = aFontMetrics->ExternalLeading(); nscoord internalLeading = aFontMetrics->InternalLeading(); nscoord emHeight = aFontMetrics->EmHeight(); + + if (nsContentUtils::ShouldResistFingerprinting() && + !aContent->IsInChromeDocument()) { + return NSToCoordRound(emHeight * NORMAL_LINE_HEIGHT_FACTOR); + } + switch (GetNormalLineHeightCalcControl()) { case eIncludeExternalLeading: normalLineHeight = emHeight + internalLeading + externalLeading; @@ -2715,7 +2723,8 @@ static nscoord GetNormalLineHeight(nsFontMetrics* aFontMetrics) { return normalLineHeight; } -static inline nscoord ComputeLineHeight(ComputedStyle* aComputedStyle, +static inline nscoord ComputeLineHeight(nsIContent* aContent, + ComputedStyle* aComputedStyle, nsPresContext* aPresContext, nscoord aBlockBSize, float aFontSizeInflation) { @@ -2743,7 +2752,7 @@ static inline nscoord ComputeLineHeight(ComputedStyle* aComputedStyle, RefPtr<nsFontMetrics> fm = nsLayoutUtils::GetFontMetricsForComputedStyle( aComputedStyle, aPresContext, aFontSizeInflation); - return GetNormalLineHeight(fm); + return GetNormalLineHeight(aContent, fm); } nscoord ReflowInput::CalcLineHeight() const { @@ -2765,7 +2774,7 @@ nscoord ReflowInput::CalcLineHeight(nsIContent* aContent, float aFontSizeInflation) { MOZ_ASSERT(aComputedStyle, "Must have a ComputedStyle"); - nscoord lineHeight = ComputeLineHeight(aComputedStyle, aPresContext, + nscoord lineHeight = ComputeLineHeight(aContent, aComputedStyle, aPresContext, aBlockBSize, aFontSizeInflation); NS_ASSERTION(lineHeight >= 0, "ComputeLineHeight screwed up"); @@ -2778,7 +2787,7 @@ nscoord ReflowInput::CalcLineHeight(nsIContent* aContent, if (!lh.IsNormal()) { RefPtr<nsFontMetrics> fm = nsLayoutUtils::GetFontMetricsForComputedStyle( aComputedStyle, aPresContext, aFontSizeInflation); - nscoord normal = GetNormalLineHeight(fm); + nscoord normal = GetNormalLineHeight(aContent, fm); if (lineHeight < normal) { lineHeight = normal; } diff --git a/layout/generic/test/mochitest.ini b/layout/generic/test/mochitest.ini index f6678d8d8e4e..c1602bbbc6b1 100644 --- a/layout/generic/test/mochitest.ini +++ b/layout/generic/test/mochitest.ini @@ -161,3 +161,4 @@ skip-if = debug == true || tsan # the test is slow. tsan: bug 1612707 [test_reframe_for_lazy_load_image.html] support-files = file_reframe_for_lazy_load_image.html +[test_tor_bug23104.html] diff --git a/layout/generic/test/test_tor_bug23104.html b/layout/generic/test/test_tor_bug23104.html new file mode 100644 index 000000000000..ae73a3446037 --- /dev/null +++ b/layout/generic/test/test_tor_bug23104.html @@ -0,0 +1,51 @@ +<!DOCTYPE HTML> +<meta charset="UTF-8"> +<html> +<head> + <title>Test for Tor Bug #23104: CSS line-height reveals the platform Tor browser is running</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="application/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <style type="text/css"> + span { + background-color: #000; + color: #fff; + font-size: 16.5px; + } + </style> +</head> +<body> +<span id="test1">Test1</span> +<span id="test2">كلمة</span> +<span id="test3">ação</span> +<script type="application/javascript;version=1.7"> + +let setPref = function* (key, value) { + return new Promise(function(resolve, reject) { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); +} + +function getStyle(el, styleprop) { + el = document.getElementById(el); + return document.defaultView.getComputedStyle(el, null).getPropertyValue(styleprop); +} + +function validateElement(elementName, isFingerprintResistent) { + var fontSize = getStyle(elementName, 'font-size'); + var lineHeight = getStyle(elementName, 'line-height'); + var validationCb = isFingerprintResistent ? is : isnot; + validationCb(parseFloat(lineHeight), parseFloat(fontSize) * 1.2, 'Line Height validation'); +} + +add_task(function* () { + for (let resistFingerprintingValue of [true, false]) { + yield setPref("privacy.resistFingerprinting", resistFingerprintingValue); + for (let elementId of ['test1', 'test2', 'test3']) { + validateElement(elementId, resistFingerprintingValue); + } + } +}); + +</script> +</body> +</html>

1 0

[tor-browser/tor-browser-78.7.0esr-10.0-1] Bug 26353: Prevent speculative connect that violated FPI.
by sysrqb＠torproject.org 20 Jan '21

20 Jan '21

commit 93fa807fb21eaa56de5f8c9d02e94aa7cbe027b2 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sat Jul 14 08:50:55 2018 -0700 Bug 26353: Prevent speculative connect that violated FPI. Connections were observed in the catch-all circuit when the user entered an https or http URL in the URL bar, or typed a search term. --- toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm b/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm index ffa42297073e..82c7a3b950c2 100644 --- a/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm +++ b/toolkit/components/remotebrowserutils/RemoteWebNavigation.jsm @@ -74,6 +74,9 @@ class RemoteWebNavigation { fixupFlags |= Services.uriFixup.FIXUP_FLAG_PRIVATE_CONTEXT; } uri = Services.uriFixup.createFixupURI(aURI, fixupFlags); +/******************************************************************************* + TOR BROWSER: Disable the following speculative connect until + we can make it properly obey first-party isolation. // We know the url is going to be loaded, let's start requesting network // connection before the content process asks. @@ -97,6 +100,7 @@ class RemoteWebNavigation { } Services.io.speculativeConnect(uri, principal, null); } +*******************************************************************************/ } catch (ex) { // Can't setup speculative connection for this uri string for some // reason (such as failing to parse the URI), just ignore it.

1 0