July 2021 - tbb-commits - lists.torproject.org

[tor-browser/tor-browser-78.12.0esr-10.5-1] Bug 13379: Sign our MAR files.
by sysrqb＠torproject.org 09 Jul '21

09 Jul '21

commit a944f69f3f2e380d86e5db6e1ba3cf22717cecf4 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Dec 17 16:37:11 2014 -0500 Bug 13379: Sign our MAR files. Configure with --enable-verify-mar (when updating, require a valid signature on the MAR file before it is applied). Use the Tor Browser version instead of the Firefox version inside the MAR file info block (necessary to prevent downgrade attacks). Use NSS on all platforms for checking MAR signatures (instead of using OS-native APIs, which Mozilla does on Mac OS and Windows). So that the NSS and NSPR libraries the updater depends on can be found at runtime, we add the firefox directory to the shared library search path on macOS. On Linux, rpath is used by Mozilla to solve that problem, but that approach won't work on macOS because the updater executable is copied during the update process to a location that is under TorBrowser-Data, and the location of TorBrowser-Data varies. Also includes the fix for bug 18900. --- .mozconfig | 1 + .mozconfig-asan | 1 + .mozconfig-mac | 1 + .mozconfig-mingw | 1 + modules/libmar/tool/mar.c | 6 +-- modules/libmar/tool/moz.build | 12 ++++-- modules/libmar/verify/moz.build | 14 +++--- .../mozapps/update/updater/updater-common.build | 24 +++++++++-- toolkit/mozapps/update/updater/updater.cpp | 25 +++++++---- toolkit/xre/moz.build | 3 ++ toolkit/xre/nsUpdateDriver.cpp | 50 ++++++++++++++++++++++ 11 files changed, 113 insertions(+), 25 deletions(-) diff --git a/.mozconfig b/.mozconfig index 18cd1f9b6487..c50c57d410de 100755 --- a/.mozconfig +++ b/.mozconfig @@ -37,3 +37,4 @@ ac_add_options MOZ_TELEMETRY_REPORTING= ac_add_options --disable-tor-launcher ac_add_options --with-tor-browser-version=dev-build ac_add_options --disable-tor-browser-update +ac_add_options --enable-verify-mar diff --git a/.mozconfig-asan b/.mozconfig-asan index 98ea6ac6f3fe..8bee813bfee8 100644 --- a/.mozconfig-asan +++ b/.mozconfig-asan @@ -30,6 +30,7 @@ ac_add_options --enable-official-branding ac_add_options --enable-default-toolkit=cairo-gtk3 ac_add_options --enable-tor-browser-update +ac_add_options --enable-verify-mar ac_add_options --disable-strip ac_add_options --disable-install-strip diff --git a/.mozconfig-mac b/.mozconfig-mac index 26e2b6b92fdb..5b4624ef1f67 100644 --- a/.mozconfig-mac +++ b/.mozconfig-mac @@ -43,6 +43,7 @@ ac_add_options --disable-debug ac_add_options --enable-tor-browser-data-outside-app-dir ac_add_options --enable-tor-browser-update +ac_add_options --enable-verify-mar ac_add_options --disable-crashreporter ac_add_options --disable-webrtc diff --git a/.mozconfig-mingw b/.mozconfig-mingw index 3ec6ff18a3e9..ce6ace1dad67 100644 --- a/.mozconfig-mingw +++ b/.mozconfig-mingw @@ -15,6 +15,7 @@ ac_add_options --enable-strip ac_add_options --enable-official-branding ac_add_options --enable-tor-browser-update +ac_add_options --enable-verify-mar ac_add_options --disable-bits-download # Let's make sure no preference is enabling either Adobe's or Google's CDM. diff --git a/modules/libmar/tool/mar.c b/modules/libmar/tool/mar.c index 0bf2cb4bd1d4..ea2b79924914 100644 --- a/modules/libmar/tool/mar.c +++ b/modules/libmar/tool/mar.c @@ -65,7 +65,7 @@ static void print_usage() { "signed_input_archive.mar base_64_encoded_signature_file " "changed_signed_output.mar\n"); printf("(i) is the index of the certificate to extract\n"); -# if defined(XP_MACOSX) || (defined(XP_WIN) && !defined(MAR_NSS)) +# if (defined(XP_MACOSX) || defined(XP_WIN)) && !defined(MAR_NSS) printf("Verify a MAR file:\n"); printf(" mar [-C workingDir] -D DERFilePath -v signed_archive.mar\n"); printf( @@ -149,7 +149,7 @@ int main(int argc, char** argv) { memset((void*)certBuffers, 0, sizeof(certBuffers)); #endif #if !defined(NO_SIGN_VERIFY) && \ - ((!defined(MAR_NSS) && defined(XP_WIN)) || defined(XP_MACOSX)) + (!defined(MAR_NSS) && (defined(XP_WIN) || defined(XP_MACOSX))) memset(DERFilePaths, 0, sizeof(DERFilePaths)); memset(fileSizes, 0, sizeof(fileSizes)); #endif @@ -181,7 +181,7 @@ int main(int argc, char** argv) { argc -= 2; } #if !defined(NO_SIGN_VERIFY) -# if (!defined(MAR_NSS) && defined(XP_WIN)) || defined(XP_MACOSX) +# if (!defined(MAR_NSS) && (defined(XP_WIN) || defined(XP_MACOSX))) /* -D DERFilePath, also matches -D[index] DERFilePath We allow an index for verifying to be symmetric with the import and export command line arguments. */ diff --git a/modules/libmar/tool/moz.build b/modules/libmar/tool/moz.build index 19653fb0b073..8953af0bb15c 100644 --- a/modules/libmar/tool/moz.build +++ b/modules/libmar/tool/moz.build @@ -35,15 +35,21 @@ if CONFIG['MOZ_BUILD_APP'] != 'tools/update-packaging': 'verifymar', ] + if CONFIG['TOR_BROWSER_UPDATE']: + DEFINES['MAR_NSS'] = True + if CONFIG['OS_ARCH'] == 'WINNT': USE_STATIC_LIBS = True OS_LIBS += [ 'ws2_32', - 'crypt32', - 'advapi32', ] - elif CONFIG['OS_ARCH'] == 'Darwin': + if not CONFIG['TOR_BROWSER_UPDATE']: + OS_LIBS += [ + 'crypt32', + 'advapi32', + ] + elif CONFIG['OS_ARCH'] == 'Darwin' and not CONFIG['TOR_BROWSER_UPDATE']: OS_LIBS += [ '-framework Security', ] diff --git a/modules/libmar/verify/moz.build b/modules/libmar/verify/moz.build index 9f7dc56f8f8a..e1c6ced31c37 100644 --- a/modules/libmar/verify/moz.build +++ b/modules/libmar/verify/moz.build @@ -16,15 +16,12 @@ FORCE_STATIC_LIB = True if CONFIG['OS_ARCH'] == 'WINNT': USE_STATIC_LIBS = True elif CONFIG['OS_ARCH'] == 'Darwin': - UNIFIED_SOURCES += [ - 'MacVerifyCrypto.cpp', - ] - OS_LIBS += [ - '-framework Security', + USE_LIBS += [ + 'nspr', + 'nss', + 'signmar', ] else: - DEFINES['MAR_NSS'] = True - LOCAL_INCLUDES += ['../sign'] USE_LIBS += [ 'nspr', 'nss', @@ -38,6 +35,9 @@ else: '-Wl,-rpath=\\$$ORIGIN', ] +DEFINES['MAR_NSS'] = True +LOCAL_INCLUDES += ['../sign'] + LOCAL_INCLUDES += [ '../src', ] diff --git a/toolkit/mozapps/update/updater/updater-common.build b/toolkit/mozapps/update/updater/updater-common.build index 5898e92d465d..9f8365df8ade 100644 --- a/toolkit/mozapps/update/updater/updater-common.build +++ b/toolkit/mozapps/update/updater/updater-common.build @@ -4,6 +4,10 @@ # License, v. 2.0. If a copy of the MPL was not distributed with this # file, You can obtain one at http://mozilla.org/MPL/2.0/. +DEFINES['MAR_NSS'] = True + +link_with_nss = DEFINES['MAR_NSS'] or (CONFIG['OS_ARCH'] == 'Linux' and CONFIG['MOZ_VERIFY_MAR_SIGNATURE']) + srcs = [ 'archivereader.cpp', 'updater.cpp', @@ -36,10 +40,14 @@ if CONFIG['OS_ARCH'] == 'WINNT': 'ws2_32', 'shell32', 'shlwapi', - 'crypt32', - 'advapi32', ] + if not link_with_nss: + OS_LIBS += [ + 'crypt32', + 'advapi32', + ] + USE_LIBS += [ 'bspatch', 'mar', @@ -47,6 +55,13 @@ USE_LIBS += [ 'xz-embedded', ] +if link_with_nss: + USE_LIBS += [ + 'nspr', + 'nss', + 'signmar', + ] + if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gtk': have_progressui = 1 srcs += [ @@ -61,9 +76,12 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa': ] OS_LIBS += [ '-framework Cocoa', - '-framework Security', '-framework SystemConfiguration', ] + if not link_with_nss: + OS_LIBS += [ + '-framework Security', + ] UNIFIED_SOURCES += [ '/toolkit/xre/updaterfileutils_osx.mm', ] diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp index 9a95c3b17761..aaec0b38dda0 100644 --- a/toolkit/mozapps/update/updater/updater.cpp +++ b/toolkit/mozapps/update/updater/updater.cpp @@ -106,9 +106,11 @@ struct UpdateServerThreadArgs { # define USE_EXECV #endif -#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && !defined(XP_MACOSX) -# include "nss.h" -# include "prerror.h" +#if defined(MOZ_VERIFY_MAR_SIGNATURE) +# if defined(MAR_NSS) || (!defined(XP_WIN) && !defined(XP_MACOSX)) +# include "nss.h" +# include "prerror.h" +# endif #endif #include "crctable.h" @@ -2738,8 +2740,13 @@ static void UpdateThreadFunc(void* param) { if (ReadMARChannelIDs(updateSettingsPath, &MARStrings) != OK) { rv = UPDATE_SETTINGS_FILE_CHANNEL; } else { +# ifdef TOR_BROWSER_UPDATE + const char* appVersion = TOR_BROWSER_VERSION_QUOTED; +# else + const char* appVersion = MOZ_APP_VERSION; +# endif rv = gArchiveReader.VerifyProductInformation(MARStrings.MARChannelID, - MOZ_APP_VERSION); + appVersion); } } } @@ -2940,11 +2947,10 @@ int NS_main(int argc, NS_tchar** argv) { } #endif -#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN) && !defined(XP_MACOSX) - // On Windows and Mac we rely on native APIs to do verifications so we don't - // need to initialize NSS at all there. - // Otherwise, minimize the amount of NSS we depend on by avoiding all the NSS - // databases. +#if defined(MOZ_VERIFY_MAR_SIGNATURE) +# if defined(MAR_NSS) || (!defined(XP_WIN) && !defined(XP_MACOSX)) + // If using NSS for signature verification, initialize NSS but minimize + // the portion we depend on by avoiding all of the NSS databases. if (NSS_NoDB_Init(nullptr) != SECSuccess) { PRErrorCode error = PR_GetError(); fprintf(stderr, "Could not initialize NSS: %s (%d)", PR_ErrorToName(error), @@ -2952,6 +2958,7 @@ int NS_main(int argc, NS_tchar** argv) { _exit(1); } #endif +#endif #ifdef XP_MACOSX if (!isElevated) { diff --git a/toolkit/xre/moz.build b/toolkit/xre/moz.build index 7ba3be2fe241..6afab145c2b6 100644 --- a/toolkit/xre/moz.build +++ b/toolkit/xre/moz.build @@ -214,6 +214,9 @@ for var in ('APP_VERSION', 'APP_ID'): if CONFIG['MOZ_BUILD_APP'] == 'browser': DEFINES['MOZ_BUILD_APP_IS_BROWSER'] = True +if CONFIG['TOR_BROWSER_UPDATE']: + DEFINES['MAR_NSS'] = True + LOCAL_INCLUDES += [ '../../other-licenses/nsis/Contrib/CityHash/cityhash', '../components/find', diff --git a/toolkit/xre/nsUpdateDriver.cpp b/toolkit/xre/nsUpdateDriver.cpp index 55d1982504ed..1cbee302719f 100644 --- a/toolkit/xre/nsUpdateDriver.cpp +++ b/toolkit/xre/nsUpdateDriver.cpp @@ -360,6 +360,42 @@ static nsresult GetUpdateDirFromAppDir(nsIFile* aAppDir, nsIFile** aResult) { # endif #endif +#if defined(TOR_BROWSER_UPDATE) && defined(MOZ_VERIFY_MAR_SIGNATURE) && \ + defined(MAR_NSS) && defined(XP_MACOSX) +/** + * Ideally we would save and restore the original library path value after + * the updater finishes its work (and before firefox is re-launched). + * Doing so would avoid potential problems like the following bug: + * https://bugzilla.mozilla.org/show_bug.cgi?id=1434033 + */ +/** + * Appends the specified path to the library path. + * This is used so that the updater can find libnss3.dylib and other + * shared libs. + * + * @param pathToAppend A new library path to prepend to the dynamic linker's + * search path. + */ +# include "prprf.h" +# define PATH_SEPARATOR ":" +# define LD_LIBRARY_PATH_ENVVAR_NAME "DYLD_LIBRARY_PATH" +static void AppendToLibPath(const char* pathToAppend) { + char* pathValue = getenv(LD_LIBRARY_PATH_ENVVAR_NAME); + if (nullptr == pathValue || '\0' == *pathValue) { + // Leak the string because that is required by PR_SetEnv. + char* s = + Smprintf("%s=%s", LD_LIBRARY_PATH_ENVVAR_NAME, pathToAppend).release(); + PR_SetEnv(s); + } else { + // Leak the string because that is required by PR_SetEnv. + char* s = Smprintf("%s=%s" PATH_SEPARATOR "%s", LD_LIBRARY_PATH_ENVVAR_NAME, + pathToAppend, pathValue) + .release(); + PR_SetEnv(s); + } +} +#endif + /** * Applies, switches, or stages an update. * @@ -606,6 +642,20 @@ static void ApplyUpdate(nsIFile* greDir, nsIFile* updateDir, nsIFile* appDir, PR_SetEnv("MOZ_SAFE_MODE_RESTART=1"); } +#if defined(TOR_BROWSER_UPDATE) && defined(MOZ_VERIFY_MAR_SIGNATURE) && \ + defined(MAR_NSS) && defined(XP_MACOSX) + // On macOS, append the app directory to the shared library search path + // so the system can locate the shared libraries that are needed by the + // updater, e.g., libnss3.dylib). + nsAutoCString appPath; + nsresult rv2 = appDir->GetNativePath(appPath); + if (NS_SUCCEEDED(rv2)) { + AppendToLibPath(appPath.get()); + } else { + LOG(("ApplyUpdate -- appDir->GetNativePath() failed (0x%x)\n", rv2)); + } +#endif + LOG(("spawning updater process [%s]\n", updaterPath.get())); #ifdef DEBUG dump_argv("ApplyUpdate updater", argv, argc);

1 0

[Git][tpo/applications/fenix] Pushed new tag tor-browser-90.0.0b6-11.0-1-build1
by Matthew Finkel (＠sysrqb) 08 Jul '21

08 Jul '21

Matthew Finkel pushed new tag tor-browser-90.0.0b6-11.0-1-build1 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-90.… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/fenix][tor-browser-90.0.0b6-11.0-1] squash! Add Tor integration and UI
by Matthew Finkel (＠sysrqb) 08 Jul '21

08 Jul '21

Matthew Finkel pushed to branch tor-browser-90.0.0b6-11.0-1 at The Tor Project / Applications / fenix Commits: 16dc16f5 by Matthew Finkel at 2021-07-08T20:16:18+00:00 squash! Add Tor integration and UI Bug 40179: Show Snowflake bridge option on Release - - - - - 1 changed file: - app/src/main/java/org/mozilla/fenix/settings/TorBridgeConfigFragment.kt Changes: ===================================== app/src/main/java/org/mozilla/fenix/settings/TorBridgeConfigFragment.kt ===================================== @@ -40,13 +40,6 @@ class TorBridgeConfigFragment : PreferenceFragmentCompat() { // `*` is Kotlin's "spread" operator, for expanding an Array as a vararg. addToRadioGroup(*builtinBridgeRadioGroups.toTypedArray()) - - // Snowflake is not available on Release at this time. - if (Config.channel.isRelease) { - radioSnowflake.apply { - isVisible = false - } - } } override fun onResume() { View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/commit/16dc16f51280f… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/commit/16dc16f51280f… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/fenix][tor-browser-90.0.0b6-11.0-1] squash! Modify UI/UX
by Matthew Finkel (＠sysrqb) 08 Jul '21

08 Jul '21

Matthew Finkel pushed to branch tor-browser-90.0.0b6-11.0-1 at The Tor Project / Applications / fenix Commits: f4b8b92d by Matthew Finkel at 2021-07-08T17:43:36+00:00 squash! Modify UI/UX Bug 40172: Find the Quit button - - - - - 2 changed files: - app/src/main/java/org/mozilla/fenix/components/toolbar/DefaultToolbarMenu.kt - app/src/main/java/org/mozilla/fenix/home/HomeMenu.kt Changes: ===================================== app/src/main/java/org/mozilla/fenix/components/toolbar/DefaultToolbarMenu.kt ===================================== @@ -73,7 +73,6 @@ open class DefaultToolbarMenu( private var isCurrentUrlBookmarked = false private var isBookmarkedJob: Job? = null - private val shouldDeleteDataOnQuit = context.settings().shouldDeleteBrowsingDataOnQuit private val shouldUseBottomToolbar = context.settings().shouldUseBottomToolbar private val accountManager = FenixAccountManager(context) @@ -578,7 +577,7 @@ open class DefaultToolbarMenu( //saveToCollectionItem, BrowserMenuDivider(), settingsItem, - if (shouldDeleteDataOnQuit) deleteDataOnQuit else null, + deleteDataOnQuit, if (shouldUseBottomToolbar) BrowserMenuDivider() else null, if (shouldUseBottomToolbar) menuToolbar else null ) ===================================== app/src/main/java/org/mozilla/fenix/home/HomeMenu.kt ===================================== @@ -229,7 +229,7 @@ class HomeMenu( @Suppress("ComplexMethod") private fun newCoreMenuItems(): List<BrowserMenuItem> { // val experiments = context.components.analytics.experiments - val settings = context.components.settings + // val settings = context.components.settings val bookmarksItem = BrowserMenuImageText( context.getString(R.string.library_bookmarks), @@ -316,7 +316,7 @@ class HomeMenu( whatsNewItem, helpItem, settingsItem, - if (settings.shouldDeleteBrowsingDataOnQuit) quitItem else null + quitItem ).also { items -> items.getHighlight()?.let { onHighlightPresent(it) } } View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/commit/f4b8b92d6c219… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/commit/f4b8b92d6c219… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[tor-browser-build/master] Add 10.5 and 10.5.1 changelog entries
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit f788bb7647399e3ff7b3589339b2da3945381ed7 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 18:05:28 2021 +0000 Add 10.5 and 10.5.1 changelog entries --- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 71 ++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index cdbeba9..06d533d 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,73 @@ +Tor Browser 10.5.1 -- July 7 2021 + * Android + * Bug 40324: Change Fenix variant to Release [fenix] + +Tor Browser 10.5 -- July 6 2021 + * All Platforms + * Update NoScript to 11.2.9 + * Update Tor Launcher to 0.2.30 + * Translations update + * Bug 25483: Provide Snowflake based on Pion for Windows, macOS, and Linux + * Bug 33761: Remove unnecessary snowflake dependencies + * Bug 40064: Bump libevent to 2.1.12 [tor-browser-build] + * Bug 40137: Migrate https-everywhere storage to idb [tor-browser] + * Bug 40261: Bump versions of snowflake and webrtc [tor-browser-build] + * Bug 40263: Update domain front for Snowflake [tor-browser-build] + * Bug 40302: Update version of snowflake [tor-browser-build] + * Bug 40030: DuckDuckGo redirect to html doesn't work [torbutton] + * Windows + OS X + Linux + * Bug 27476: Implement about:torconnect captive portal within Tor Browser [tor-browser] + * Bug 32228: Bookmark TPO support domains in Tor Browser + * Bug 33803: Add a secondary nightly MAR signing key [tor-browser] + * Bug 33954: Consider different approach for Bug 2176 + * Bug 34345: "Don't Bootstrap" Startup Mode + * Bug 40011: Rename tor-browser-brand.ftl to brand.ftl [torbutton] + * Bug 40012: Fix about:tor not loading some images in 82 [torbutton] + * Bug 40138: Move our primary nightly MAR signing key to tor-browser [tor-browser-build] + * Bug 40209: Implement Basic Crypto Safety [tor-browser] + * Bug 40428: Correct minor Cryptocurrency warning string typo [tor-browser] + * Bug 40429: Update Onboarding for 10.5 [tor-browser] + * Bug 40455: Block or recover background requests after bootstrap [tor-browser] + * Bug 40456: Update the SecureDrop HTTPS-Everywhere update channel [tor-browser] + * Bug 40475: Include clearing CORS preflight cache [tor-browser] + * Bug 40478: Onion alias url rewrite is broken [tor-browser] + * Bug 40484: Bootstrapping page show Quickstart text [tor-browser] + * Bug 40490: BridgeDB bridge captcha selection is broken in alpha [tor-browser] + * Bug 40495: Onion pattern is focusable by click on about:torconnect [tor-browser] + * Bug 40499: Onion Alias doesn't work with TOR_SKIP_LAUNCH [tor-browser] + * Android + * Bug 30318: Integrate snowflake into mobile Tor Browser + * Bug 40206: Disable the /etc/hosts parser [tor-browser] + * Linux + * Bug 40089: Remove CentOS 6 support for Tor Browser 10.5 [tor-browser] + * Build System + * All Platforms + * Update Go to 1.15.13 + * Bug 23631: Use rootless containers [tor-browser-build] + * Bug 33693: Change snowflake and meek dummy address [tor-browser] + * Bug 40016: getfpaths is not setting origin_project [rbm] + * Bug 40169: Update apt package cache after calling pre_pkginst, too [tor-browser-build] + * Bug 40194: Remove osname part in cbindgen filename [tor-browser-build] + * Windows + OS X + Linux + * Bug 40081: Build Mozilla code with --enable-rust-simd [tor-browser-build] + * Bug 40104: Use our TMPDIR when creating our .mar files [tor-browser-build] + * Bug 40133: Bump Rust version for ESR 78 to 1.43.0 [tor-browser-build] + * Bug 40166: Update apt cache before calling pre_pkginst in container-image config [tor-browser-build] + * Android + * Bug 28672: Android reproducible build of Snowflake + * Bug 40313: Use apt-get to install openjdk-8 .deb files with their dependencies [tor-browser-build] + * Windows + * Bug 34360: Bump binutils to 2.35.1 + * Bug 40131: Remove unused binutils patches [tor-browser-build] + * Linux + * Bug 26238: Move to Debian Jessie for our Linux builds + * Bug 31729: Support Wayland + * Bug 40041: Remove CentOS 6 support for 10.5 series [tor-browser-build] + * Bug 40103: Add i386 pkg-config path for linux-i686 [tor-browser-build] + * Bug 40112: Strip libstdc++ we ship [tor-browser-build] + * Bug 40118: Add missing libdrm dev package to firefox container [tor-browser-build] + * Bug 40235: Bump apt for Jessie containers [tor-browser-build] + Tor Browser 10.5a17 -- June 27 2021 * All Platforms * Update NoScript to 11.2.9 @@ -204,6 +274,7 @@ Tor Browser 10.5a11 -- February 23 2021 * Windows + OS X + Linux * Update Firefox to 78.8.0esr * Bug 40029: Create survey banner on about:tor for snowflake [torbutton] + * Bug 40209: Implement Basic Crypto Safety [tor-browser] * OS X + Linux * Update HTTPS Everywhere to 2021.1.27 * Bug 40212: Bump version of snowflake and webrtc [tor-browser-build]

1 0

[tor-browser/tor-browser-78.11.0esr-11.0-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit 2d2ed519296f68d734480447b832d59a9c7fed68 Author: Richard Pospesel <richard(a)torproject.org> Date: Wed Jul 7 16:37:16 2021 +0200 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- toolkit/mozapps/update/UpdateService.jsm | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/toolkit/mozapps/update/UpdateService.jsm b/toolkit/mozapps/update/UpdateService.jsm index 6d0c79222577..79881cba42d6 100644 --- a/toolkit/mozapps/update/UpdateService.jsm +++ b/toolkit/mozapps/update/UpdateService.jsm @@ -17,6 +17,12 @@ const { TorProtocolService } = ChromeUtils.import( "resource:///modules/TorProtocolService.jsm" ); +function _shouldRegisterBootstrapObserver(errorCode) { + return errorCode == PROXY_SERVER_CONNECTION_REFUSED && + !TorProtocolService.isBootstrapDone() && + TorProtocolService.ownsTorDaemon; +}; + const { Bits, BitsRequest, @@ -2697,9 +2703,7 @@ UpdateService.prototype = { AUSTLMY.pingCheckCode(this._pingSuffix, AUSTLMY.CHK_OFFLINE); } return; - } else if (update.errorCode == PROXY_SERVER_CONNECTION_REFUSED && - !TorProtocolService.isBootstrapDone() && - TorProtocolService.ownsTorDaemon) { + } else if (_shouldRegisterBootstrapObserver(update.errorCode)) { // Register boostrap observer to try again, but only when we own the // tor process. this._registerBootstrapObserver(); @@ -5234,6 +5238,7 @@ Downloader.prototype = { var state = this._patch.state; var shouldShowPrompt = false; var shouldRegisterOnlineObserver = false; + var shouldRegisterBootstrapObserver = false; var shouldRetrySoon = false; var deleteActiveUpdate = false; var retryTimeout = Services.prefs.getIntPref( @@ -5311,7 +5316,18 @@ Downloader.prototype = { ); shouldRegisterOnlineObserver = true; deleteActiveUpdate = false; - + } else if(_shouldRegisterBootstrapObserver(status)) { + // Register a bootstrap observer to try again. + // The bootstrap observer will continue the incremental download by + // calling downloadUpdate on the active update which continues + // downloading the file from where it was. + LOG("Downloader:onStopRequest - not bootstrapped, register bootstrap observer: true"); + AUSTLMY.pingDownloadCode( + this.isCompleteUpdate, + AUSTLMY.DWNLD_RETRY_OFFLINE + ); + shouldRegisterBootstrapObserver = true; + deleteActiveUpdate = false; // Each of NS_ERROR_NET_TIMEOUT, ERROR_CONNECTION_REFUSED, // NS_ERROR_NET_RESET and NS_ERROR_DOCUMENT_NOT_CACHED can be returned // when disconnecting the internet while a download of a MAR is in @@ -5429,7 +5445,7 @@ Downloader.prototype = { // Only notify listeners about the stopped state if we // aren't handling an internal retry. - if (!shouldRetrySoon && !shouldRegisterOnlineObserver) { + if (!shouldRetrySoon && !shouldRegisterOnlineObserver && !shouldRegisterBootstrapObserver) { // Make shallow copy in case listeners remove themselves when called. var listeners = this._listeners.concat(); var listenerCount = listeners.length; @@ -5577,6 +5593,9 @@ Downloader.prototype = { if (shouldRegisterOnlineObserver) { LOG("Downloader:onStopRequest - Registering online observer"); this.updateService._registerOnlineObserver(); + } else if (shouldRegisterBootstrapObserver) { + LOG("Downloader:onStopRequest - Registering bootstrap observer"); + this.updateService._registerBootstrapObserver(); } else if (shouldRetrySoon) { LOG("Downloader:onStopRequest - Retrying soon"); this.updateService._consecutiveSocketErrors++;

1 0

[tor-browser/tor-browser-78.11.0esr-11.0-1] Merge remote-tracking branch 'richardgl/40507' into tor-browser-78.11.0esr-11.0-1
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit f88e306850df18e6443db02c47eae443f2aefa25 Merge: 21083586165d 2d2ed519296f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 16:53:19 2021 +0000 Merge remote-tracking branch 'richardgl/40507' into tor-browser-78.11.0esr-11.0-1 toolkit/mozapps/update/UpdateService.jsm | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)

1 0

[tor-browser/tor-browser-78.11.0esr-10.5-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit 2d2ed519296f68d734480447b832d59a9c7fed68 Author: Richard Pospesel <richard(a)torproject.org> Date: Wed Jul 7 16:37:16 2021 +0200 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- toolkit/mozapps/update/UpdateService.jsm | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/toolkit/mozapps/update/UpdateService.jsm b/toolkit/mozapps/update/UpdateService.jsm index 6d0c79222577..79881cba42d6 100644 --- a/toolkit/mozapps/update/UpdateService.jsm +++ b/toolkit/mozapps/update/UpdateService.jsm @@ -17,6 +17,12 @@ const { TorProtocolService } = ChromeUtils.import( "resource:///modules/TorProtocolService.jsm" ); +function _shouldRegisterBootstrapObserver(errorCode) { + return errorCode == PROXY_SERVER_CONNECTION_REFUSED && + !TorProtocolService.isBootstrapDone() && + TorProtocolService.ownsTorDaemon; +}; + const { Bits, BitsRequest, @@ -2697,9 +2703,7 @@ UpdateService.prototype = { AUSTLMY.pingCheckCode(this._pingSuffix, AUSTLMY.CHK_OFFLINE); } return; - } else if (update.errorCode == PROXY_SERVER_CONNECTION_REFUSED && - !TorProtocolService.isBootstrapDone() && - TorProtocolService.ownsTorDaemon) { + } else if (_shouldRegisterBootstrapObserver(update.errorCode)) { // Register boostrap observer to try again, but only when we own the // tor process. this._registerBootstrapObserver(); @@ -5234,6 +5238,7 @@ Downloader.prototype = { var state = this._patch.state; var shouldShowPrompt = false; var shouldRegisterOnlineObserver = false; + var shouldRegisterBootstrapObserver = false; var shouldRetrySoon = false; var deleteActiveUpdate = false; var retryTimeout = Services.prefs.getIntPref( @@ -5311,7 +5316,18 @@ Downloader.prototype = { ); shouldRegisterOnlineObserver = true; deleteActiveUpdate = false; - + } else if(_shouldRegisterBootstrapObserver(status)) { + // Register a bootstrap observer to try again. + // The bootstrap observer will continue the incremental download by + // calling downloadUpdate on the active update which continues + // downloading the file from where it was. + LOG("Downloader:onStopRequest - not bootstrapped, register bootstrap observer: true"); + AUSTLMY.pingDownloadCode( + this.isCompleteUpdate, + AUSTLMY.DWNLD_RETRY_OFFLINE + ); + shouldRegisterBootstrapObserver = true; + deleteActiveUpdate = false; // Each of NS_ERROR_NET_TIMEOUT, ERROR_CONNECTION_REFUSED, // NS_ERROR_NET_RESET and NS_ERROR_DOCUMENT_NOT_CACHED can be returned // when disconnecting the internet while a download of a MAR is in @@ -5429,7 +5445,7 @@ Downloader.prototype = { // Only notify listeners about the stopped state if we // aren't handling an internal retry. - if (!shouldRetrySoon && !shouldRegisterOnlineObserver) { + if (!shouldRetrySoon && !shouldRegisterOnlineObserver && !shouldRegisterBootstrapObserver) { // Make shallow copy in case listeners remove themselves when called. var listeners = this._listeners.concat(); var listenerCount = listeners.length; @@ -5577,6 +5593,9 @@ Downloader.prototype = { if (shouldRegisterOnlineObserver) { LOG("Downloader:onStopRequest - Registering online observer"); this.updateService._registerOnlineObserver(); + } else if (shouldRegisterBootstrapObserver) { + LOG("Downloader:onStopRequest - Registering bootstrap observer"); + this.updateService._registerBootstrapObserver(); } else if (shouldRetrySoon) { LOG("Downloader:onStopRequest - Retrying soon"); this.updateService._consecutiveSocketErrors++;

1 0

[tor-browser/tor-browser-78.11.0esr-10.5-1] Merge remote-tracking branch 'richardgl/40507' into tor-browser-78.11.0esr-10.5-1
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit 9037e5de6dd14b0791528aeae78cf6c4b264bbf1 Merge: 21083586165d 2d2ed519296f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Jul 8 16:53:00 2021 +0000 Merge remote-tracking branch 'richardgl/40507' into tor-browser-78.11.0esr-10.5-1 toolkit/mozapps/update/UpdateService.jsm | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)

1 0

[tor-browser/tor-browser-78.11.0esr-11.0-1] fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser
by sysrqb＠torproject.org 08 Jul '21

08 Jul '21

commit a2581284372175491fbd55b5f44e4c681b9009dd Author: Richard Pospesel <richard(a)torproject.org> Date: Mon Jul 5 17:07:23 2021 +0200 fixup! Bug 27476: Implement about:torconnect captive portal within Tor Browser --- browser/components/torconnect/TorConnectParent.jsm | 11 +---------- .../torconnect/content/aboutTorConnect.js | 21 +++++---------------- browser/modules/TorConnect.jsm | 19 +++++++++++++++++-- dom/base/nsGlobalWindowOuter.cpp | 2 ++ toolkit/modules/RemotePageAccessManager.jsm | 4 ---- 5 files changed, 25 insertions(+), 32 deletions(-) diff --git a/browser/components/torconnect/TorConnectParent.jsm b/browser/components/torconnect/TorConnectParent.jsm index f775507a744f..54548891fbab 100644 --- a/browser/components/torconnect/TorConnectParent.jsm +++ b/browser/components/torconnect/TorConnectParent.jsm @@ -27,6 +27,7 @@ const gActiveTopics = [ kTorBootstrapStatusTopic, kTorBootstrapErrorTopic, kTorLogHasWarnOrErrTopic, + "torconnect:bootstrap-complete", ]; const gTorLauncherPrefs = { @@ -69,9 +70,6 @@ class TorConnectParent extends JSWindowActorParent { } } - get browser() { - return this.browsingContext.top.embedderElement; - } _OpenTorAdvancedPreferences() { const win = this.browsingContext.top.embedderElement.ownerGlobal; @@ -93,11 +91,6 @@ class TorConnectParent extends JSWindowActorParent { ); } - _GoToBrowserHome() { - const window = this.browser.ownerGlobal; - window.BrowserHome(); - } - receiveMessage(message) { switch (message.name) { case "TorBootstrapErrorOccurred": @@ -106,8 +99,6 @@ class TorConnectParent extends JSWindowActorParent { return TorProtocolService.retrieveBootstrapStatus(); case "OpenTorAdvancedPreferences": return this._OpenTorAdvancedPreferences(); - case "GoToBrowserHome": - return this._GoToBrowserHome(); case "GetLocalizedBootstrapStatus": const { status, keyword } = message.data; return TorLauncherUtil.getLocalizedBootstrapStatus(status, keyword); diff --git a/browser/components/torconnect/content/aboutTorConnect.js b/browser/components/torconnect/content/aboutTorConnect.js index 11301fa10cab..19fd335ccd13 100644 --- a/browser/components/torconnect/content/aboutTorConnect.js +++ b/browser/components/torconnect/content/aboutTorConnect.js @@ -15,10 +15,6 @@ const TorLauncherPrefs = { prompt_at_startup: "extensions.torlauncher.prompt_at_startup", } -const BrowserPrefs = { - homepage: "browser.startup.homepage", -} - class AboutTorConnect { log(...args) { console.log(...args); @@ -133,14 +129,6 @@ class AboutTorConnect { this.elemTitle.classList.add("error"); } - goToBrowserHome() { - this.hideElem(this.elemCancelButton); - - // redirect this about:torconnect to browser homepage - const homepage = RPMGetStringPref(BrowserPrefs.homepage); - window.location.replace(homepage); - } - set state(state) { const oldState = this.state; if (oldState === state) { @@ -158,7 +146,7 @@ class AboutTorConnect { this.setBootstrapErrorUI(); break; case AboutTorConnect.STATE_BOOTSTRAPPED: - this.goToBrowserHome(); + window.close(); break; } } @@ -219,8 +207,6 @@ class AboutTorConnect { // if bootstrap state is greater than 0. this.state = AboutTorConnect.STATE_INITIAL; return; - } else if (percentComplete >= 100) { - this.state = AboutTorConnect.STATE_BOOTSTRAPPED; } else if (percentComplete > 0) { this.state = AboutTorConnect.STATE_BOOTSTRAPPING; } @@ -306,7 +292,10 @@ class AboutTorConnect { RPMAddMessageListener(kTorQuickstartPrefChanged, ({ data }) => { // update checkbox with latest quickstart pref value this.elemQuickstartCheckbox.checked = data; - }) + }); + RPMAddMessageListener("torconnect:bootstrap-complete", () => { + this.state = AboutTorConnect.STATE_BOOTSTRAPPED; + }); } initKeyboardShortcuts() { diff --git a/browser/modules/TorConnect.jsm b/browser/modules/TorConnect.jsm index 2b8cd15e3b62..3125c84558db 100644 --- a/browser/modules/TorConnect.jsm +++ b/browser/modules/TorConnect.jsm @@ -3,11 +3,15 @@ var EXPORTED_SYMBOLS = ["TorConnect"]; const { Services } = ChromeUtils.import( - "resource://gre/modules/Services.jsm" + "resource://gre/modules/Services.jsm" +); + +const { BrowserWindowTracker } = ChromeUtils.import( + "resource:///modules/BrowserWindowTracker.jsm" ); const { TorProtocolService } = ChromeUtils.import( - "resource:///modules/TorProtocolService.jsm" + "resource:///modules/TorProtocolService.jsm" ); // TODO: move the bootstrap state management out of each of the individual @@ -29,6 +33,17 @@ var TorConnect = (() => { case "TorBootstrapStatus": const obj = subject?.wrappedJSObject; if (obj?.PROGRESS === 100) { + // open home page(s) in new tabs + const win = BrowserWindowTracker.getTopWindow() + const urls = Services.prefs.getStringPref("browser.startup.homepage").split('|'); + + let location="tab"; + for(const url of urls) { + win.openTrustedLinkIn(url, location); + // open subsequent tabs behind first tab + location = "tabshifted"; + } + Services.obs.notifyObservers(null, "torconnect:bootstrap-complete"); } break; diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp index abe1e56d9714..759060f131ff 100644 --- a/dom/base/nsGlobalWindowOuter.cpp +++ b/dom/base/nsGlobalWindowOuter.cpp @@ -6082,6 +6082,8 @@ void nsGlobalWindowOuter::CloseOuter(bool aTrustedCaller) { NS_ENSURE_SUCCESS_VOID(rv); if (!StringBeginsWith(url, NS_LITERAL_STRING("about:neterror")) && + // we want about:torconnect pages to be able to close themselves after bootstrap + !StringBeginsWith(url, NS_LITERAL_STRING("about:torconnect")) && !HadOriginalOpener() && !aTrustedCaller) { bool allowClose = mAllowScriptsToClose || diff --git a/toolkit/modules/RemotePageAccessManager.jsm b/toolkit/modules/RemotePageAccessManager.jsm index 0c001e707096..0927391c2ba7 100644 --- a/toolkit/modules/RemotePageAccessManager.jsm +++ b/toolkit/modules/RemotePageAccessManager.jsm @@ -183,7 +183,6 @@ let RemotePageAccessManager = { "about:torconnect": { RPMAddMessageListener: ["*"], RPMSendAsyncMessage: [ - "GoToBrowserHome", "OpenTorAdvancedPreferences", "TorRetrieveBootstrapStatus", "TorStopBootstrap", @@ -205,9 +204,6 @@ let RemotePageAccessManager = { RPMSetBoolPref: [ "extensions.torlauncher.quickstart", ], - RPMGetStringPref: [ - "browser.startup.homepage", - ], }, },

1 0