- tbb-commits - lists.torproject.org

[Git][tpo/applications/android-components] Pushed new branch android-components-63.0.8-10.5-1
by Matthew Finkel 13 Nov '20

13 Nov '20

Matthew Finkel pushed new branch android-components-63.0.8-10.5-1 at The Tor Project / Applications / android-components -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/android-components/-/tree/an… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/fenix] Pushed new branch tor-browser-83.1.0-10.5-1
by Matthew Finkel 13 Nov '20

13 Nov '20

Matthew Finkel pushed new branch tor-browser-83.1.0-10.5-1 at The Tor Project / Applications / fenix -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/fenix/-/tree/tor-browser-83.… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[tor-browser/tor-browser-83.0b1-10.5-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by sysrqb＠torproject.org 13 Nov '20

13 Nov '20

commit eedb31b27afded29c441e34ccac246351f36b074 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 13 15:25:10 2020 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index b0739b02caac..968c2565ceb8 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit b0739b02caacea311d54192d22005aaa88505b11 +Subproject commit 968c2565ceb8417ef026cf639cd5c2e80f6057a4

1 0

[tor-browser-spec/master] Remove superfluous whitespace
by gk＠torproject.org 13 Nov '20

13 Nov '20

commit 05036de767648b6182bef604d4175bf2cbcc1b7d Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 13 14:47:32 2020 +0000 Remove superfluous whitespace --- audits/FF31_NETWORK_AUDIT | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/audits/FF31_NETWORK_AUDIT b/audits/FF31_NETWORK_AUDIT index c575dec..d4c39d5 100644 --- a/audits/FF31_NETWORK_AUDIT +++ b/audits/FF31_NETWORK_AUDIT @@ -15,7 +15,7 @@ Lowest level resolver calls: - pkix_HttpCertStore_FindSocketConnection - pkix_pl_HttpDefaultClient_RequestCreate - pkix_pl_HttpDefaultClient_RequestCreateFcn - - SEC_HttpClientFcnV1 vtable.createFcn and + - SEC_HttpClientFcnV1 vtable.createFcn and + ./security/manager/ssl/src/nsNSSCallbacks.cpp + Uses nsHTTPHttpInterface::createFcn() + ./security/manager/ssl/src/nsNSSCallbacks.h

1 0

[tor-browser-spec/master] More newline clean-up
by gk＠torproject.org 13 Nov '20

13 Nov '20

commit 45f5fd2e90d640873fd35877cfee57e2a8d7ddf2 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 13 08:47:53 2020 +0000 More newline clean-up --- audits/FF24_NETWORK_AUDIT | 3 --- 1 file changed, 3 deletions(-) diff --git a/audits/FF24_NETWORK_AUDIT b/audits/FF24_NETWORK_AUDIT index dc09ff9..2d8c2e8 100644 --- a/audits/FF24_NETWORK_AUDIT +++ b/audits/FF24_NETWORK_AUDIT @@ -35,7 +35,6 @@ Misc UDP (SOCK_DGRAM, PR_DESC_SOCKET_UDP): + PR_Socket + ./nsprpub/pr/src/pthreads/ptio.c + ./netwerk/socket/nsUDPSocketProvider.cpp - Misc TCP (SOCK_STREAM, PR_DESC_SOCKET_TCP): + ./nsprpub/pr/src/pthreads/ptio.c @@ -61,5 +60,3 @@ Misc XPCOM: + ./netwerk/protocol/ftp/nsFtpControlConnection.cpp: + ./dom/network/src/TCPSocket.js + open() - -

1 0

[tor-browser-spec/master] Remore superfluous whitespace and newlines
by gk＠torproject.org 13 Nov '20

13 Nov '20

commit f660dc9869ae292135464d8d855e4e00695b37a2 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 13 08:40:20 2020 +0000 Remore superfluous whitespace and newlines --- audits/FF17_NETWORK_AUDIT | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/audits/FF17_NETWORK_AUDIT b/audits/FF17_NETWORK_AUDIT index 8ec25ba..2343fad 100644 --- a/audits/FF17_NETWORK_AUDIT +++ b/audits/FF17_NETWORK_AUDIT @@ -1,4 +1,3 @@ - Lowest level resolver calls: - PR_GetHostByName + ./profile/dirserviceprovider/src/nsProfileLock.cpp @@ -64,7 +63,7 @@ Misc XPCOM: + open() Android may have DNS leaks.. - - ./mobile/android/base/httpclientandroidlib/impl/conn/DefaultClientConnectionOperator.java + - ./mobile/android/base/httpclientandroidlib/impl/conn/DefaultClientConnectionOperator.java nsDNSService/nsPIDNSService/nsIDNSService + calls nsHostResolver::ResolveHost @@ -73,12 +72,10 @@ nsDNSService/nsPIDNSService/nsIDNSService + ./netwerk/base/src/nsIOService.cpp (offline mode only) + ./netwerk/build/nsNetModule.cpp + ./netwerk/protocol/websocket/WebSocketChannel.cpp - + ./netwerk/build/nsNetCID.h + + ./netwerk/build/nsNetCID.h + ./netwerk/socket/nsSOCKSIOLayer.cpp (proxy lookup only) netwerk/base/src/nsSocketTransport2.cpp + nsSocketTransport::ResolveHost() has proper remote dns checks + Resolution is done by using hostname as sockaddr + PROXY_RESOLVES_HOST - -

1 0

[tor-browser-spec/master] Extend FF82 audit to 82.0.3
by gk＠torproject.org 13 Nov '20

13 Nov '20

commit c13d3773e679db5f6058c042adc80dd026da8d88 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 13 00:16:15 2020 +0000 Extend FF82 audit to 82.0.3 --- audits/FF82_NETWORK_AUDIT | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/audits/FF82_NETWORK_AUDIT b/audits/FF82_NETWORK_AUDIT index 705a544..9c8d45e 100644 --- a/audits/FF82_NETWORK_AUDIT +++ b/audits/FF82_NETWORK_AUDIT @@ -1,4 +1,4 @@ -`git diff cb11d5556759bd5bf174fbac719f51b2f02e2f0b 763b45bd9edb0073a2c6058dd3edc9254ec901e9` +`git diff cb11d5556759bd5bf174fbac719f51b2f02e2f0b da52a0a45d57d5cb6fb6eb399e7fc112bf4c9c95` and then go over all the changes containing the above mentioned potentially dangerous calls and features. Grep the diff for the following strings and examine surrounding usage.

1 0

[tor-browser-spec/master] Bug 40006: Add Fenix83 net audit
by gk＠torproject.org 13 Nov '20

13 Nov '20

commit e710f186f33a9e6601617ed2a0ab4fb46f99a667 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Nov 11 04:28:44 2020 +0000 Bug 40006: Add Fenix83 net audit --- audits/FF83_NETWORK_AUDIT | 132 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 132 insertions(+) diff --git a/audits/FF83_NETWORK_AUDIT b/audits/FF83_NETWORK_AUDIT new file mode 100644 index 0000000..539acd2 --- /dev/null +++ b/audits/FF83_NETWORK_AUDIT @@ -0,0 +1,132 @@ +`git diff da52a0a45d57d5cb6fb6eb399e7fc112bf4c9c95 1cb2c4893850a5b0a246f821a6390c07064c1227` +and then go over all the changes containing the +above mentioned potentially dangerous calls and features. Grep the diff for +the following strings and examine surrounding usage. + +=============== Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +# New DNS pref: network.dns.dns_query_single_label +# tor-browser#issues/40230 + +MDNS + +# FF83: Nothing new + +TRR (DNS Trusted Recursive Resolver) + +# FF83: trr moved to static prefs + +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +# FF83: eDontResolveRedirection - kernel things +# FF83: ResolveHost, asyncResolve - Adding IP hint support (1652670) + +============ Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET + +# FF83: Bug 1664900 - P5 - mv peerconnection to jsapi + +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +# FF83: Bug 1650145 - Replace all value uses of Empty[C]String by 0-length _ns literals + +Misc PR_Socket + +# FF83: Zero new instances of PR_Socket + +=========== Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +# FF83: Zero instances outside of tests and moved code + +============ Rust Portion ================ + +Rust + - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool? + - Check for new sendmsg and recvmsg usage + +# FF83: Zero new instances of sendmsg/recvmsg/connect outside of neqo + +============ Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + +# FF83: Only Google SafeBrowsing +https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/40217 + +============ Application Services Portion ============= + +(Same as FF82) + +============ Android Components Portion ============= + +Start: 0a93a5ecd39e5a7f80e453a0d1a863057465aca0 # v60.0.3 +End: 0a2993d44aae3d877bb97cee925096f83af01b3a # v63.0.8 + +Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`) + +============ Fenix Portion ============= + +Start: 998b62866dee35929ca0d81641df101c83ac1224 # v82.0.0-beta.4 +End: 5441935698f4d9e3606f3d6baf892f6e0106a2f6 # v83.1.0-rc.1 + +Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`) + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser-spec/master] Use specified commit in audit, not merge-base
by gk＠torproject.org 13 Nov '20

13 Nov '20

commit b517c451542bd7fb7663f5e8e41de1065a2207a7 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Nov 13 00:14:37 2020 +0000 Use specified commit in audit, not merge-base --- audits/java_audit.sh | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/audits/java_audit.sh b/audits/java_audit.sh index e085b57..3e94fa3 100644 --- a/audits/java_audit.sh +++ b/audits/java_audit.sh @@ -57,15 +57,15 @@ cd $REPO_DIR #function join_by { local d=$1; shift; local f=$1; shift; printf %s "$f" "${@/#/ $d}"; } #GREP_LINE="$(join_by \-G ${KEYWORDS[@]})" -base=`git merge-base ${OLD} ${NEW}` +#base=`git merge-base ${OLD} ${NEW}` -#if [ ! -f "release-${OLD}-${NEW}.diff" ]; -if [ ! -f "release-${base}-${NEW}.diff" ]; +if [ ! -f "release-${OLD}-${NEW}.diff" ]; +#if [ ! -f "release-${base}-${NEW}.diff" ]; then - #echo "Diffing release-${OLD}-${NEW}.diff" - echo "Diffing release-${base}-${NEW}.diff" - #git diff --color=always --color-moved origin/$OLD origin/$NEW -U20 > release-${OLD}-${NEW}.diff - git diff --color=always --color-moved $base $NEW -U20 > release-${base}-${NEW}.diff + echo "Diffing release-${OLD}-${NEW}.diff" + #echo "Diffing release-${base}-${NEW}.diff" + git diff --color=always --color-moved $OLD $NEW -U20 > release-${OLD}-${NEW}.diff + #git diff --color=always --color-moved $base $NEW -U20 > release-${base}-${NEW}.diff #git diff --color=always --color-moved -G${GREP_LINE} $OLD $NEW -U20 > release-${OLD}-${NEW}-G.diff fi @@ -79,7 +79,9 @@ GREP_LINE="$(join_by \| ${KEYWORDS[@]})" export GREP_COLOR="05;37;41" # XXX: Arg this sometimes misses file context -egrep -A40 -B40 --color=always "${GREP_LINE}" release-${base}-${NEW}.diff > keywords-${base}-${NEW}-$SCOPE.diff +#egrep -A40 -B40 --color=always "${GREP_LINE}" release-${base}-${NEW}.diff > keywords-${base}-${NEW}-$SCOPE.diff +egrep -A40 -B40 --color=always "${GREP_LINE}" release-${OLD}-${NEW}.diff > keywords-${OLD}-${NEW}-$SCOPE.diff echo "Diff generated. View it with:" -echo " less -R $REPO_DIR/keywords-$base-$NEW-$SCOPE.diff" +#echo " less -R $REPO_DIR/keywords-$base-$NEW-$SCOPE.diff" +echo " less -R $REPO_DIR/keywords-$OLD-$NEW-$SCOPE.diff"

1 0

[tor-browser-build/maint-10.0-desktop] Tor Browser 10.0.5 release preparations
by sysrqb＠torproject.org 12 Nov '20

12 Nov '20

commit e0a96b77fd9c81799734a3dab85b7452c7882a87 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Thu Nov 12 19:00:52 2020 +0000 Tor Browser 10.0.5 release preparations Version bumps and Changelog update --- projects/firefox-langpacks/config | 2 +- projects/firefox/config | 4 ++-- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 6 ++++++ projects/tor/config | 2 +- rbm.conf | 3 ++- 5 files changed, 12 insertions(+), 5 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 17a707a..34d6fad 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build2 + ff_build: build1 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' targets: diff --git a/projects/firefox/config b/projects/firefox/config index af0d742..4479b40 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,14 +1,14 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build3' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 78.4.0 + firefox_platform_version: 78.5.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 10.0 branding_directory: 'browser/branding/alpha' diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 526db49..3b26ac5 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,9 @@ +Tor Browser 10.0.5 -- November 17 2020 + * Windows + OS X + Linux + * Update Firefox to 78.5.0esr + * Update Tor to 0.4.4.6 + * Bug 40212: Add new default obfs4 bridge [tor-browser] + Tor Browser 10.0.4 -- November 9 2020 * Windows + OS X + Linux * Update NoScript to 11.1.5 diff --git a/projects/tor/config b/projects/tor/config index 429e7d6..3050d7d 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.4.4.5 +version: 0.4.4.6 git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git git_submodule: 1 diff --git a/rbm.conf b/rbm.conf index ad6d5f7..ac496bc 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,11 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0.4' + torbrowser_version: '10.0.5' torbrowser_build: 'build1' torbrowser_incremental_from: - 10.0.2 + - 10.0.4 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0