- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 13 Aug '20

13 Aug '20

commit bad0647c6b70b20a336f8c643a57e80fc3e62cf2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Aug 6 10:12:51 2020 -0400 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 48 ++++++++++++++++++++++++++- mobile/android/app/000-tor-browser-android.js | 3 ++ 2 files changed, 50 insertions(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 3be6e460b628..eae29579ded6 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -100,13 +100,50 @@ pref("browser.search.region", "US"); // The next two prefs disable GeoIP search pref("browser.search.geoip.url", ""); pref("browser.fixup.alternate.enabled", false); // Bug #16783: Prevent .onion fixups // Make sure there is no Tracking Protection active in Tor Browser, see: #17898. +pref("privacy.trackingprotection.enabled", false); pref("privacy.trackingprotection.pbmode.enabled", false); +pref("privacy.trackingprotection.annotate_channels", false); +pref("privacy.trackingprotection.cryptomining.enabled", false); +pref("privacy.trackingprotection.fingerprinting.enabled", false); +pref("privacy.trackingprotection.socialtracking.enabled", false); +pref("privacy.socialtracking.block_cookies.enabled", false); +pref("privacy.annotate_channels.strict_list.enabled", false); + // Disable the Pocket extension (Bug #18886 and #31602) pref("extensions.pocket.enabled", false); pref("network.http.referer.hideOnionSource", true); -// Disable ServiceWorkers by default +// Disable use of WiFi location information +pref("browser.region.network.scan", false); +pref("browser.region.network.url", ""); + +// Don't load Mozilla domains in a separate tab process +pref("browser.tabs.remote.separatedMozillaDomains", ""); + +// Avoid DNS lookups on search terms +pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0); + +// Disable about:newtab and "first run" experiments +pref("messaging-system.rsexperimentloader.enabled", false); +pref("trailhead.firstrun.branches", ""); + +// Clear the list of trusted recursive resolver services +pref("network.trr.resolvers", ""); + +// Disable crlite +pref("security.pki.crlite_mode", 0); + +// Disable website password breach alerts +pref("signon.management.page.breach-alerts.enabled", false); +pref("extensions.fxmonitor.enabled", false); + +// Remove mobile app tracking URLs +pref("signon.management.page.mobileAndroidURL", ""); +pref("signon.management.page.mobileAppleURL", ""); + +// Disable ServiceWorkers and push notifications by default pref("dom.serviceWorkers.enabled", false); +pref("dom.push.enabled", false); // Fingerprinting pref("webgl.disable-extensions", true); @@ -298,6 +335,15 @@ pref("browser.download.panel.shown", true); // Treat .onions as secure pref("dom.securecontext.whitelist_onions", true); +// Disable special URL bar behaviors +pref("browser.urlbar.suggest.topsites", false); +pref("browser.urlbar.update1.interventions", false); +pref("browser.urlbar.update1.searchTips", false); + +// Skip checking omni.ja and other files for corruption since the result +// is only reported via telemetry (which is disabled). +pref("corroborator.enabled", false); + // Onboarding. pref("browser.onboarding.tourset-version", 5); pref("browser.onboarding.newtour", "welcome,privacy,tor-network-9.0,circuit-display,security,expect-differences,onion-services,learn-more"); diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js index 23fd39beac77..61c8a0cd7fa1 100644 --- a/mobile/android/app/000-tor-browser-android.js +++ b/mobile/android/app/000-tor-browser-android.js @@ -30,6 +30,9 @@ pref("media.realtime_decoder.enabled", false); // Enable touch events on Android (highlighting text, etc) pref("dom.w3c_touch_events.enabled", 2); +// Ensure that pointer events are disabled +pref("dom.w3c_pointer_events.multiprocess.android.enabled", false); + // No HLS support for now due to browser freezing, see: #29859. pref("media.hls.enabled", false);

1 0

[tor-browser-build/master] Bug 40017: Enable stripping again on Windows
by gk＠torproject.org 11 Aug '20

11 Aug '20

commit cc88f7409ca972802f70a6d0d3ec4effc3486828 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Aug 11 09:46:23 2020 +0000 Bug 40017: Enable stripping again on Windows Mozilla fixed the regression in bug 1651680. --- projects/firefox/mozconfig-windows-i686 | 1 + projects/firefox/mozconfig-windows-x86_64 | 1 + 2 files changed, 2 insertions(+) diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index f32db84..3708dd7 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -23,6 +23,7 @@ export MOZILLA_OFFICIAL=1 ac_add_options --disable-debug ac_add_options --enable-optimize +ac_add_options --enable-strip ac_add_options --enable-official-branding ac_add_options --enable-tor-browser-update diff --git a/projects/firefox/mozconfig-windows-x86_64 b/projects/firefox/mozconfig-windows-x86_64 index 8dac1e8..52956e2 100644 --- a/projects/firefox/mozconfig-windows-x86_64 +++ b/projects/firefox/mozconfig-windows-x86_64 @@ -23,6 +23,7 @@ export MOZILLA_OFFICIAL=1 ac_add_options --disable-debug ac_add_options --enable-optimize +ac_add_options --enable-strip ac_add_options --enable-official-branding ac_add_options --enable-tor-browser-update

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 1651680 - Replace PKG_SKIP_STRIP with PKG_STRIP. r=nalexander
by gk＠torproject.org 11 Aug '20

11 Aug '20

commit 904d2bbec4fa8984cc29e27478ddcf69c4ba9594 Author: Mike Hommey <mh+mozilla(a)glandium.org> Date: Tue Aug 11 02:44:17 2020 +0000 Bug 1651680 - Replace PKG_SKIP_STRIP with PKG_STRIP. r=nalexander Differential Revision: https://phabricator.services.mozilla.com/D86648 --- moz.configure | 8 +------- python/mozbuild/mozpack/executables.py | 2 +- testing/testsuite-targets.mk | 2 +- toolkit/mozapps/installer/l10n-repack.py | 2 +- toolkit/mozapps/installer/strip.py | 2 +- toolkit/mozapps/installer/unpack.py | 2 +- 6 files changed, 6 insertions(+), 12 deletions(-) diff --git a/moz.configure b/moz.configure index e86018b1e814..f22c7185f300 100755 --- a/moz.configure +++ b/moz.configure @@ -682,13 +682,7 @@ set_config('ENABLE_STRIP', True, when='--enable-strip') js_option('--disable-install-strip', when=may_strip, help='Enable stripping of libs & executables when packaging') -# The nested depends is because depending on --enable-install-strip needs the -# `when=may_strip`, but we also need to test when may_strip is False. -@depends(depends('--enable-install-strip', when=may_strip)(lambda x: x), may_strip) -def pkg_skip_strip(install_strip, may_strip): - return not install_strip or not may_strip - -set_config('PKG_SKIP_STRIP', True, when=pkg_skip_strip) +set_config('PKG_STRIP', True, when='--enable-install-strip') @depends('--enable-strip', '--enable-install-strip', when=may_strip) diff --git a/python/mozbuild/mozpack/executables.py b/python/mozbuild/mozpack/executables.py index da12ab0aa33f..593a2e571a94 100644 --- a/python/mozbuild/mozpack/executables.py +++ b/python/mozbuild/mozpack/executables.py @@ -86,7 +86,7 @@ def may_strip(path): Return whether strip() should be called ''' from buildconfig import substs - return not substs.get('PKG_SKIP_STRIP') + return bool(substs.get('PKG_STRIP')) def strip(path): diff --git a/testing/testsuite-targets.mk b/testing/testsuite-targets.mk index 39a69c662ad0..157c030a09c3 100644 --- a/testing/testsuite-targets.mk +++ b/testing/testsuite-targets.mk @@ -195,7 +195,7 @@ stage-jstests: make-stage-dir ifdef OBJCOPY ifneq ($(OBJCOPY), :) # see build/autoconf/toolchain.m4:102 for why this is necessary -ifndef PKG_SKIP_STRIP +ifdef PKG_STRIP STRIP_COMPILED_TESTS := 1 endif endif diff --git a/toolkit/mozapps/installer/l10n-repack.py b/toolkit/mozapps/installer/l10n-repack.py index cf1b83dfe2c4..fbdadd0718a1 100644 --- a/toolkit/mozapps/installer/l10n-repack.py +++ b/toolkit/mozapps/installer/l10n-repack.py @@ -49,7 +49,7 @@ def main(): args = parser.parse_args() buildconfig.substs['USE_ELF_HACK'] = False - buildconfig.substs['PKG_SKIP_STRIP'] = True + buildconfig.substs['PKG_STRIP'] = False l10n.repack(args.build, args.l10n, extra_l10n=dict(args.extra_l10n), non_resources=args.non_resource, non_chrome=NON_CHROME) diff --git a/toolkit/mozapps/installer/strip.py b/toolkit/mozapps/installer/strip.py index d6e81f280bfa..734d6c8fa5a3 100644 --- a/toolkit/mozapps/installer/strip.py +++ b/toolkit/mozapps/installer/strip.py @@ -14,7 +14,7 @@ def strip(dir): copier = FileCopier() # The FileFinder will give use ExecutableFile instances for files # that can be stripped, and copying ExecutableFiles defaults to - # stripping them unless buildconfig.substs['PKG_SKIP_STRIP'] is set. + # stripping them when buildconfig.substs['PKG_STRIP'] is set. for p, f in FileFinder(dir, find_executables=True): copier.add(p, f) copier.copy(dir) diff --git a/toolkit/mozapps/installer/unpack.py b/toolkit/mozapps/installer/unpack.py index f7e9e00622a0..03af61b7b93c 100644 --- a/toolkit/mozapps/installer/unpack.py +++ b/toolkit/mozapps/installer/unpack.py @@ -18,7 +18,7 @@ def main(): options = parser.parse_args(sys.argv[1:]) buildconfig.substs['USE_ELF_HACK'] = False - buildconfig.substs['PKG_SKIP_STRIP'] = True + buildconfig.substs['PKG_STRIP'] = False unpack(options.directory, options.omnijar) if __name__ == "__main__":

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 1651680 - Support --enable-strip/--enable-install-strip on mingw. r=nalexander
by gk＠torproject.org 11 Aug '20

11 Aug '20

commit 8ebe00420de77ac6b8814359f6377e133f403494 Author: Mike Hommey <mh+mozilla(a)glandium.org> Date: Tue Aug 11 02:53:34 2020 +0000 Bug 1651680 - Support --enable-strip/--enable-install-strip on mingw. r=nalexander Differential Revision: https://phabricator.services.mozilla.com/D86649 --- moz.configure | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/moz.configure b/moz.configure index f22c7185f300..9b0e78460113 100755 --- a/moz.configure +++ b/moz.configure @@ -671,21 +671,30 @@ add_old_configure_assignment( 'MOZ_DISABLE_ICF', '1', when=depends('--enable-icf')(lambda x: not x)) -@depends(compile_environment, target) -def may_strip(compile_environment, target): - return compile_environment and target.kernel != 'WINNT' +js_option('--enable-strip', when=compile_environment, + help='Enable stripping of libs & executables') -js_option('--enable-strip', when=may_strip, help='Enable stripping of libs & executables') +# This should be handled as a `when` once bug 1617793 is fixed. +@depends('--enable-strip', c_compiler, when=compile_environment) +def enable_strip(strip, c_compiler): + if strip and c_compiler.type != 'clang-cl': + return True -set_config('ENABLE_STRIP', True, when='--enable-strip') +set_config('ENABLE_STRIP', enable_strip) -js_option('--disable-install-strip', when=may_strip, +js_option('--disable-install-strip', when=compile_environment, help='Enable stripping of libs & executables when packaging') -set_config('PKG_STRIP', True, when='--enable-install-strip') +# This should be handled as a `when` once bug 1617793 is fixed. +@depends('--enable-install-strip', c_compiler, when=compile_environment) +def enable_install_strip(strip, c_compiler): + if strip and c_compiler.type != 'clang-cl': + return True + +set_config('PKG_STRIP', enable_install_strip) -@depends('--enable-strip', '--enable-install-strip', when=may_strip) +@depends('--enable-strip', '--enable-install-strip', when=compile_environment) def strip(strip, install_strip): return strip or install_strip

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gkgl/bug_40037_v2'
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 0de43304b95255095b66a93fe326f82f818dca6a Merge: 01cb89f 99c1bd0 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Aug 10 17:17:27 2020 +0000 Merge remote-tracking branch 'gkgl/bug_40037_v2' projects/{clang => clang-source}/43909.patch | 0 projects/clang-source/build | 31 ++++ projects/clang-source/config | 32 ++++ projects/clang/build | 18 +- projects/clang/config | 23 +-- projects/fenix-clang/build | 18 +- projects/fenix-clang/config | 23 +-- projects/macosx-toolchain/43909.patch | 252 --------------------------- projects/macosx-toolchain/build | 30 +--- projects/macosx-toolchain/config | 25 +-- projects/mingw-w64-clang/build | 39 ++--- projects/mingw-w64-clang/config | 17 +- 12 files changed, 100 insertions(+), 408 deletions(-)

1 0

[tor-browser-build/master] Bug 40037: Add clang-source project
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 56eed81fdbfb786dc2248347d899cbbfd1c591b2 Author: Georg Koppen <gk(a)torproject.org> Date: Sun Aug 9 10:32:26 2020 +0000 Bug 40037: Add clang-source project --- projects/clang-source/build | 36 ++++++++++++++++++++++++++++++++++++ projects/clang-source/config | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) diff --git a/projects/clang-source/build b/projects/clang-source/build new file mode 100644 index 0000000..5aebfb1 --- /dev/null +++ b/projects/clang-source/build @@ -0,0 +1,36 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/dist +mkdir -p /var/tmp/build +cd /var/tmp/build +tar -xf $rootdir/[% c('input_files_by_name/llvm') %] +tar -xf $rootdir/[% c('input_files_by_name/clang') %] +tar -xf $rootdir/[% c('input_files_by_name/clang-tools-extra') %] +tar -xf $rootdir/[% c('input_files_by_name/libcxx') %] +tar -xf $rootdir/[% c('input_files_by_name/libcxxabi') %] +tar -xf $rootdir/[% c('input_files_by_name/lld') %] +tar -xf $rootdir/[% c('input_files_by_name/compiler-rt') %] +tar -xf $rootdir/[% c('input_files_by_name/libunwind') %] +mv llvm-* llvm +# LLVM has reproducibility issues when optimizing bitcode, which we need to +# patch. See: #32053 for more details. +patch -p1 < $rootdir/43909.patch +mv clang-* llvm/tools/clang +extra_dir=llvm/tools/clang/tools/extra +mkdir $extra_dir +mv clang-tools-extra-* $extra_dir +mv libcxx-* llvm/projects/libcxx +mv libcxxabi-* llvm/projects/libcxxabi +mv lld-* llvm/tools/lld +mv compiler-rt-* llvm/projects/compiler-rt +# We need libunwind only for mingw-w64-clang, don't include it as tightly by +# putting it into projects/ +mv libunwind-* llvm/libunwind +mv llvm $distdir + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/clang-source/config b/projects/clang-source/config new file mode 100644 index 0000000..d0ae90c --- /dev/null +++ b/projects/clang-source/config @@ -0,0 +1,32 @@ +# vim: filetype=yaml sw=2 +version: 9.0.1 +filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +gpg_keyring: clang.gpg +sig_ext: sig + +input_files: + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/llvm-[% c("version") %].src.tar.xz' + name: llvm + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/clang-[% c("version") %].src.tar.xz' + name: clang + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/clang-tools-extra-[% c("version") %].src.tar.xz' + name: clang-tools-extra + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libcxx-[% c("version") %].src.tar.xz' + name: libcxx + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libcxxabi-[% c("version") %].src.tar.xz' + name: libcxxabi + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/lld-[% c("version") %].src.tar.xz' + name: lld + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/compiler-rt-[% c("version") %].src.tar.xz' + name: compiler-rt + file_gpg_id: 1 + - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libunwind-[% c("version") %].src.tar.xz' + name: libunwind + file_gpg_id: 1 + - filename: 43909.patch

1 0

[tor-browser-build/master] Bug 40037: Move projects over to clang-source
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 99c1bd0186171c06fc5f07136e9efbd9192fb35a Author: Georg Koppen <gk(a)torproject.org> Date: Sun Aug 9 10:40:38 2020 +0000 Bug 40037: Move projects over to clang-source --- projects/{clang => clang-source}/43909.patch | 0 projects/clang-source/build | 27 ++- projects/clang/build | 18 +- projects/clang/config | 23 +-- projects/fenix-clang/build | 18 +- projects/fenix-clang/config | 23 +-- projects/macosx-toolchain/43909.patch | 252 --------------------------- projects/macosx-toolchain/build | 30 +--- projects/macosx-toolchain/config | 25 +-- projects/mingw-w64-clang/build | 39 ++--- projects/mingw-w64-clang/config | 17 +- 11 files changed, 48 insertions(+), 424 deletions(-) diff --git a/projects/clang/43909.patch b/projects/clang-source/43909.patch similarity index 100% rename from projects/clang/43909.patch rename to projects/clang-source/43909.patch diff --git a/projects/clang-source/build b/projects/clang-source/build index 5aebfb1..860b8e4 100644 --- a/projects/clang-source/build +++ b/projects/clang-source/build @@ -1,9 +1,5 @@ #!/bin/bash [% c("var/set_default_env") -%] -distdir=/var/tmp/dist/[% project %] -mkdir -p /var/tmp/dist -mkdir -p /var/tmp/build -cd /var/tmp/build tar -xf $rootdir/[% c('input_files_by_name/llvm') %] tar -xf $rootdir/[% c('input_files_by_name/clang') %] tar -xf $rootdir/[% c('input_files_by_name/clang-tools-extra') %] @@ -12,24 +8,23 @@ tar -xf $rootdir/[% c('input_files_by_name/libcxxabi') %] tar -xf $rootdir/[% c('input_files_by_name/lld') %] tar -xf $rootdir/[% c('input_files_by_name/compiler-rt') %] tar -xf $rootdir/[% c('input_files_by_name/libunwind') %] -mv llvm-* llvm + +mv llvm-[% c("version") %].src llvm # LLVM has reproducibility issues when optimizing bitcode, which we need to # patch. See: #32053 for more details. patch -p1 < $rootdir/43909.patch -mv clang-* llvm/tools/clang -extra_dir=llvm/tools/clang/tools/extra -mkdir $extra_dir -mv clang-tools-extra-* $extra_dir -mv libcxx-* llvm/projects/libcxx -mv libcxxabi-* llvm/projects/libcxxabi -mv lld-* llvm/tools/lld -mv compiler-rt-* llvm/projects/compiler-rt +mv clang-[% c("version") %].src llvm/tools/clang +# Having clang-tidy available seems like a good idea +mv clang-tools-extra-[% c("version") %].src llvm/tools/clang/tools/extra +mv libcxx-[% c("version") %].src llvm/projects/libcxx +mv libcxxabi-[% c("version") %].src llvm/projects/libcxxabi +mv lld-[% c("version") %].src llvm/tools/lld +mv compiler-rt-[% c("version") %].src llvm/projects/compiler-rt # We need libunwind only for mingw-w64-clang, don't include it as tightly by # putting it into projects/ -mv libunwind-* llvm/libunwind -mv llvm $distdir +mv libunwind-[% c("version") %].src llvm/libunwind +mv llvm [% project %] -cd /var/tmp/dist [% c('tar', { tar_src => [ project ], tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), diff --git a/projects/clang/build b/projects/clang/build index d61ed43..33688e5 100644 --- a/projects/clang/build +++ b/projects/clang/build @@ -15,22 +15,8 @@ export PATH="/var/tmp/dist/cmake/bin:$PATH" [% END -%] mkdir -p /var/tmp/build cd /var/tmp/build -tar -xf $rootdir/[% c('input_files_by_name/llvm') %] -tar -xf $rootdir/[% c('input_files_by_name/clang') %] -tar -xf $rootdir/[% c('input_files_by_name/libcxx') %] -tar -xf $rootdir/[% c('input_files_by_name/libcxxabi') %] -tar -xf $rootdir/[% c('input_files_by_name/lld') %] -tar -xf $rootdir/[% c('input_files_by_name/compiler-rt') %] -mv llvm-* llvm -# LLVM has reproducibility issues when optimizing bitcode, which we need to -# patch. See: #32053 for more details. -patch -p1 < $rootdir/43909.patch -mv clang-* llvm/tools/clang -mv libcxx-* llvm/projects/libcxx -mv libcxxabi-* llvm/projects/libcxxabi -mv lld-* llvm/tools/lld -mv compiler-rt-* llvm/projects/compiler-rt -cd llvm +tar -xf $rootdir/[% c('input_files_by_name/clang-source') %] +cd clang-source export LLVM_HOME=$(pwd) mkdir build cd build diff --git a/projects/clang/config b/projects/clang/config index c4b7efc..46d308a 100644 --- a/projects/clang/config +++ b/projects/clang/config @@ -1,8 +1,6 @@ # vim: filetype=yaml sw=2 version: 9.0.1 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -gpg_keyring: clang.gpg -sig_ext: sig var: container: @@ -18,22 +16,5 @@ input_files: enable: '[% c("var/linux") %]' - project: cmake name: cmake - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/llvm-[% c("version") %].src.tar.xz' - name: llvm - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/clang-[% c("version") %].src.tar.xz' - name: clang - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libcxx-[% c("version") %].src.tar.xz' - name: libcxx - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libcxxabi-[% c("version") %].src.tar.xz' - name: libcxxabi - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/lld-[% c("version") %].src.tar.xz' - name: lld - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/compiler-rt-[% c("version") %].src.tar.xz' - name: compiler-rt - file_gpg_id: 1 - - filename: 43909.patch + - project: clang-source + name: clang-source diff --git a/projects/fenix-clang/build b/projects/fenix-clang/build index d61ed43..33688e5 100644 --- a/projects/fenix-clang/build +++ b/projects/fenix-clang/build @@ -15,22 +15,8 @@ export PATH="/var/tmp/dist/cmake/bin:$PATH" [% END -%] mkdir -p /var/tmp/build cd /var/tmp/build -tar -xf $rootdir/[% c('input_files_by_name/llvm') %] -tar -xf $rootdir/[% c('input_files_by_name/clang') %] -tar -xf $rootdir/[% c('input_files_by_name/libcxx') %] -tar -xf $rootdir/[% c('input_files_by_name/libcxxabi') %] -tar -xf $rootdir/[% c('input_files_by_name/lld') %] -tar -xf $rootdir/[% c('input_files_by_name/compiler-rt') %] -mv llvm-* llvm -# LLVM has reproducibility issues when optimizing bitcode, which we need to -# patch. See: #32053 for more details. -patch -p1 < $rootdir/43909.patch -mv clang-* llvm/tools/clang -mv libcxx-* llvm/projects/libcxx -mv libcxxabi-* llvm/projects/libcxxabi -mv lld-* llvm/tools/lld -mv compiler-rt-* llvm/projects/compiler-rt -cd llvm +tar -xf $rootdir/[% c('input_files_by_name/clang-source') %] +cd clang-source export LLVM_HOME=$(pwd) mkdir build cd build diff --git a/projects/fenix-clang/config b/projects/fenix-clang/config index c4b7efc..46d308a 100644 --- a/projects/fenix-clang/config +++ b/projects/fenix-clang/config @@ -1,8 +1,6 @@ # vim: filetype=yaml sw=2 version: 9.0.1 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' -gpg_keyring: clang.gpg -sig_ext: sig var: container: @@ -18,22 +16,5 @@ input_files: enable: '[% c("var/linux") %]' - project: cmake name: cmake - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/llvm-[% c("version") %].src.tar.xz' - name: llvm - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/clang-[% c("version") %].src.tar.xz' - name: clang - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libcxx-[% c("version") %].src.tar.xz' - name: libcxx - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/libcxxabi-[% c("version") %].src.tar.xz' - name: libcxxabi - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/lld-[% c("version") %].src.tar.xz' - name: lld - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("version") %]/compiler-rt-[% c("version") %].src.tar.xz' - name: compiler-rt - file_gpg_id: 1 - - filename: 43909.patch + - project: clang-source + name: clang-source diff --git a/projects/macosx-toolchain/43909.patch b/projects/macosx-toolchain/43909.patch deleted file mode 100644 index 78d2a75..0000000 --- a/projects/macosx-toolchain/43909.patch +++ /dev/null @@ -1,252 +0,0 @@ -From c95310f2d4fd3c88241c3b5d6dbf6251d34a3256 Mon Sep 17 00:00:00 2001 -From: Nikita Popov <nikita.ppv(a)gmail.com> -Date: Sat, 16 Nov 2019 16:22:18 +0100 -Subject: [PATCH] Restructure caching - -Variant on D70103. The caching is switched to always use a BB to -cache entry map, which then contains per-value caches. A separate -set contains value handles with a deletion callback. This allows us -to properly invalidate overdefined values. - -A possible alternative would be to always cache by value first and -have per-BB maps/sets in the each cache entry. In that case we could -use a ValueMap and would avoid the separate value handle set. I went -with the BB indexing at the top level to make it easier to integrate -D69914, but possibly that's not the right choice. - -Differential Revision: https://reviews.llvm.org/D70376 - -diff --git a/llvm/lib/Analysis/LazyValueInfo.cpp b/llvm/lib/Analysis/LazyValueInfo.cpp -index 110c085d3f3..aa6862cb588 100644 ---- a/llvm/lib/Analysis/LazyValueInfo.cpp -+++ b/llvm/lib/Analysis/LazyValueInfo.cpp -@@ -133,12 +133,9 @@ namespace { - /// A callback value handle updates the cache when values are erased. - class LazyValueInfoCache; - struct LVIValueHandle final : public CallbackVH { -- // Needs to access getValPtr(), which is protected. -- friend struct DenseMapInfo<LVIValueHandle>; -- - LazyValueInfoCache *Parent; - -- LVIValueHandle(Value *V, LazyValueInfoCache *P) -+ LVIValueHandle(Value *V, LazyValueInfoCache *P = nullptr) - : CallbackVH(V), Parent(P) { } - - void deleted() override; -@@ -152,89 +149,63 @@ namespace { - /// This is the cache kept by LazyValueInfo which - /// maintains information about queries across the clients' queries. - class LazyValueInfoCache { -- /// This is all of the cached block information for exactly one Value*. -- /// The entries are sorted by the BasicBlock* of the -- /// entries, allowing us to do a lookup with a binary search. -- /// Over-defined lattice values are recorded in OverDefinedCache to reduce -- /// memory overhead. -- struct ValueCacheEntryTy { -- ValueCacheEntryTy(Value *V, LazyValueInfoCache *P) : Handle(V, P) {} -- LVIValueHandle Handle; -- SmallDenseMap<PoisoningVH<BasicBlock>, ValueLatticeElement, 4> BlockVals; -+ /// This is all of the cached information for one basic block. It contains -+ /// the per-value lattice elements, as well as a separate set for -+ /// overdefined values to reduce memory usage. -+ struct BlockCacheEntryTy { -+ SmallDenseMap<AssertingVH<Value>, ValueLatticeElement, 4> LatticeElements; -+ SmallDenseSet<AssertingVH<Value>, 4> OverDefined; - }; - -- /// This tracks, on a per-block basis, the set of values that are -- /// over-defined at the end of that block. -- typedef DenseMap<PoisoningVH<BasicBlock>, SmallPtrSet<Value *, 4>> -- OverDefinedCacheTy; -- /// Keep track of all blocks that we have ever seen, so we -- /// don't spend time removing unused blocks from our caches. -- DenseSet<PoisoningVH<BasicBlock> > SeenBlocks; -- -- /// This is all of the cached information for all values, -- /// mapped from Value* to key information. -- DenseMap<Value *, std::unique_ptr<ValueCacheEntryTy>> ValueCache; -- OverDefinedCacheTy OverDefinedCache; -- -+ /// Cached information per basic block. -+ DenseMap<PoisoningVH<BasicBlock>, BlockCacheEntryTy> BlockCache; -+ /// Set of value handles used to erase values from the cache on deletion. -+ DenseSet<LVIValueHandle, DenseMapInfo<Value *>> ValueHandles; - - public: - void insertResult(Value *Val, BasicBlock *BB, - const ValueLatticeElement &Result) { -- SeenBlocks.insert(BB); -- -+ auto &CacheEntry = BlockCache.try_emplace(BB).first->second; - // Insert over-defined values into their own cache to reduce memory - // overhead. - if (Result.isOverdefined()) -- OverDefinedCache[BB].insert(Val); -- else { -- auto It = ValueCache.find_as(Val); -- if (It == ValueCache.end()) { -- ValueCache[Val] = make_unique<ValueCacheEntryTy>(Val, this); -- It = ValueCache.find_as(Val); -- assert(It != ValueCache.end() && "Val was just added to the map!"); -- } -- It->second->BlockVals[BB] = Result; -- } -- } -- -- bool isOverdefined(Value *V, BasicBlock *BB) const { -- auto ODI = OverDefinedCache.find(BB); -- -- if (ODI == OverDefinedCache.end()) -- return false; -+ CacheEntry.OverDefined.insert(Val); -+ else -+ CacheEntry.LatticeElements.insert({ Val, Result }); - -- return ODI->second.count(V); -+ auto HandleIt = ValueHandles.find_as(Val); -+ if (HandleIt == ValueHandles.end()) -+ ValueHandles.insert({ Val, this }); - } - - bool hasCachedValueInfo(Value *V, BasicBlock *BB) const { -- if (isOverdefined(V, BB)) -- return true; -- -- auto I = ValueCache.find_as(V); -- if (I == ValueCache.end()) -+ auto It = BlockCache.find(BB); -+ if (It == BlockCache.end()) - return false; - -- return I->second->BlockVals.count(BB); -+ return It->second.OverDefined.count(V) || -+ It->second.LatticeElements.count(V); - } - - ValueLatticeElement getCachedValueInfo(Value *V, BasicBlock *BB) const { -- if (isOverdefined(V, BB)) -+ auto It = BlockCache.find(BB); -+ if (It == BlockCache.end()) -+ return ValueLatticeElement(); -+ -+ if (It->second.OverDefined.count(V)) - return ValueLatticeElement::getOverdefined(); - -- auto I = ValueCache.find_as(V); -- if (I == ValueCache.end()) -+ auto LatticeIt = It->second.LatticeElements.find(V); -+ if (LatticeIt == It->second.LatticeElements.end()) - return ValueLatticeElement(); -- auto BBI = I->second->BlockVals.find(BB); -- if (BBI == I->second->BlockVals.end()) -- return ValueLatticeElement(); -- return BBI->second; -+ -+ return LatticeIt->second; - } - - /// clear - Empty the cache. - void clear() { -- SeenBlocks.clear(); -- ValueCache.clear(); -- OverDefinedCache.clear(); -+ BlockCache.clear(); -+ ValueHandles.clear(); - } - - /// Inform the cache that a given value has been deleted. -@@ -248,23 +219,18 @@ namespace { - /// OldSucc might have (unless also overdefined in NewSucc). This just - /// flushes elements from the cache and does not add any. - void threadEdgeImpl(BasicBlock *OldSucc,BasicBlock *NewSucc); -- -- friend struct LVIValueHandle; - }; - } - - void LazyValueInfoCache::eraseValue(Value *V) { -- for (auto I = OverDefinedCache.begin(), E = OverDefinedCache.end(); I != E;) { -- // Copy and increment the iterator immediately so we can erase behind -- // ourselves. -- auto Iter = I++; -- SmallPtrSetImpl<Value *> &ValueSet = Iter->second; -- ValueSet.erase(V); -- if (ValueSet.empty()) -- OverDefinedCache.erase(Iter); -+ for (auto &Pair : BlockCache) { -+ Pair.second.LatticeElements.erase(V); -+ Pair.second.OverDefined.erase(V); - } - -- ValueCache.erase(V); -+ auto HandleIt = ValueHandles.find_as(V); -+ if (HandleIt != ValueHandles.end()) -+ ValueHandles.erase(HandleIt); - } - - void LVIValueHandle::deleted() { -@@ -274,18 +240,7 @@ void LVIValueHandle::deleted() { - } - - void LazyValueInfoCache::eraseBlock(BasicBlock *BB) { -- // Shortcut if we have never seen this block. -- DenseSet<PoisoningVH<BasicBlock> >::iterator I = SeenBlocks.find(BB); -- if (I == SeenBlocks.end()) -- return; -- SeenBlocks.erase(I); -- -- auto ODI = OverDefinedCache.find(BB); -- if (ODI != OverDefinedCache.end()) -- OverDefinedCache.erase(ODI); -- -- for (auto &I : ValueCache) -- I.second->BlockVals.erase(BB); -+ BlockCache.erase(BB); - } - - void LazyValueInfoCache::threadEdgeImpl(BasicBlock *OldSucc, -@@ -303,10 +258,11 @@ void LazyValueInfoCache::threadEdgeImpl(BasicBlock *OldSucc, - std::vector<BasicBlock*> worklist; - worklist.push_back(OldSucc); - -- auto I = OverDefinedCache.find(OldSucc); -- if (I == OverDefinedCache.end()) -+ auto I = BlockCache.find(OldSucc); -+ if (I == BlockCache.end() || I->second.OverDefined.empty()) - return; // Nothing to process here. -- SmallVector<Value *, 4> ValsToClear(I->second.begin(), I->second.end()); -+ SmallVector<Value *, 4> ValsToClear(I->second.OverDefined.begin(), -+ I->second.OverDefined.end()); - - // Use a worklist to perform a depth-first search of OldSucc's successors. - // NOTE: We do not need a visited list since any blocks we have already -@@ -320,10 +276,10 @@ void LazyValueInfoCache::threadEdgeImpl(BasicBlock *OldSucc, - if (ToUpdate == NewSucc) continue; - - // If a value was marked overdefined in OldSucc, and is here too... -- auto OI = OverDefinedCache.find(ToUpdate); -- if (OI == OverDefinedCache.end()) -+ auto OI = BlockCache.find(ToUpdate); -+ if (OI == BlockCache.end() || OI->second.OverDefined.empty()) - continue; -- SmallPtrSetImpl<Value *> &ValueSet = OI->second; -+ auto &ValueSet = OI->second.OverDefined; - - bool changed = false; - for (Value *V : ValsToClear) { -@@ -333,11 +289,6 @@ void LazyValueInfoCache::threadEdgeImpl(BasicBlock *OldSucc, - // If we removed anything, then we potentially need to update - // blocks successors too. - changed = true; -- -- if (ValueSet.empty()) { -- OverDefinedCache.erase(OI); -- break; -- } - } - - if (!changed) continue; --- -2.24.0 - diff --git a/projects/macosx-toolchain/build b/projects/macosx-toolchain/build index 0f67c38..5716a9e 100644 --- a/projects/macosx-toolchain/build +++ b/projects/macosx-toolchain/build @@ -2,19 +2,14 @@ [% c("var/set_default_env") -%] builddir=/var/tmp/build mkdir $builddir -distdir="/var/tmp/dist/[% project %]" +distdir=/var/tmp/dist/[% project %] mkdir -p "$distdir" tar -C /var/tmp/dist -xf [% c('input_files_by_name/cmake') %] tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] -tar -C /var/tmp/dist -xf [% c('input_files_by_name/clang_compiler') %] -tar -C $builddir -xf [% c('input_files_by_name/llvm') %] -tar -C $builddir -xf [% c('input_files_by_name/clang') %] -tar -C $builddir -xf [% c('input_files_by_name/libcxx') %] -tar -C $builddir -xf [% c('input_files_by_name/libcxxabi') %] -tar -C $builddir -xf [% c('input_files_by_name/lld') %] -tar -C $builddir -xf [% c('input_files_by_name/compiler-rt') %] +tar -C /var/tmp/dist -xf [% c('input_files_by_name/clang') %] tar -C $distdir -xf [% c('input_files_by_name/SDK') %] tar -C $distdir -xf [% c('input_files_by_name/cctools') %] +tar -C $builddir -xf [% c('input_files_by_name/clang-source') %] clangdir=/var/tmp/dist/clang/bin cctoolsdir=$distdir/cctools/bin @@ -24,19 +19,10 @@ sysrootdir=$distdir/MacOSX10.11.sdk/ export PATH="/var/tmp/dist/ninja:/var/tmp/dist/cmake/bin:$cctoolsdir:$PATH" export MACOSX_DEPLOYMENT_TARGET=[% c("var/macosx_deployment_target") %] -cd $builddir -mv llvm-* llvm -# LLVM has reproducibility issues when optimizing bitcode, which we need to -# patch. See: #32053 for more details. -patch -p1 < $rootdir/43909.patch -mv clang-* llvm/tools/clang -mv libcxx-* llvm/projects/libcxx -mv libcxxabi-* llvm/projects/libcxxabi -mv lld-* llvm/tools/lld -mv compiler-rt-* compiler-rt +cd $builddir/clang-source/projects patch -p1 < $rootdir/compiler-rt-cross-compile.patch patch -p1 < $rootdir/compiler-rt-no-codesign.patch -mv compiler-rt llvm/projects +cd .. mkdir build cd build # We follow quite closely Mozilla's build/build-clang/build-clang.py with the @@ -68,7 +54,7 @@ cmake -GNinja \ -DCMAKE_SYSTEM_VERSION=10.10 \ -DLLVM_ENABLE_THREADS=OFF \ -DCOMPILER_RT_BUILD_XRAY=OFF \ - -DLIBCXXABI_LIBCXX_INCLUDES=$builddir/llvm/projects/libcxx/include \ + -DLIBCXXABI_LIBCXX_INCLUDES=$builddir/clang-source/projects/libcxx/include \ -DCMAKE_OSX_SYSROOT=$sysrootdir \ -DCMAKE_FIND_ROOT_PATH=$sysrootdir \ -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM=NEVER \ @@ -78,13 +64,13 @@ cmake -GNinja \ -DCMAKE_OSX_ARCHITECTURES=x86_64 \ -DDARWIN_osx_ARCHS=x86_64 \ -DDARWIN_osx_SYSROOT=$sysrootdir \ - -DLLVM_DEFAULT_TARGET_TRIPLE=x86_64-apple-darwin $builddir/llvm + -DLLVM_DEFAULT_TARGET_TRIPLE=x86_64-apple-darwin $builddir/clang-source ninja install -v # We now have a native macosx64 toolchain. # What we want is a native linux64 toolchain which can target macosx64. # Overlay the linux64 toolchain that we used for this build. Note: we don't do -# any ASan builds for macOS (yet). Once we do we need to preserve at least +# any ASan builds for macOS (yet). Once we do that we need to preserve at least # `llvm-symbolizer` as that one seems to get shipped with sanitizer builds (at # least that's what Mozilla claims). cd $distdir diff --git a/projects/macosx-toolchain/config b/projects/macosx-toolchain/config index 937478b..95f650b 100644 --- a/projects/macosx-toolchain/config +++ b/projects/macosx-toolchain/config @@ -1,8 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' version: 10.11-1 -gpg_keyring: clang.gpg -sig_ext: sig var: container: use_container: 1 @@ -20,7 +18,7 @@ var: input_files: - project: container-image - - name: clang_compiler + - name: clang project: clang - name: cctools project: cctools @@ -33,24 +31,7 @@ input_files: - name: SDK URL: https://people.torproject.org/~gk/mirrors/sources/MacOSX10.11.sdk.tar.bz2 sha256sum: d11e410d757d023be66d2fe7eaa85a1d232da3ac04f177eff3d8b8275cd9ffca - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% pc("clang", "version") %]/llvm-[% pc("clang", "version") %].src.tar.xz' - name: llvm - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% pc("clang", "version") %]/clang-[% pc("clang", "version") %].src.tar.xz' - name: clang - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% pc("clang", "version") %]/libcxx-[% pc("clang", "version") %].src.tar.xz' - name: libcxx - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% pc("clang", "version") %]/libcxxabi-[% pc("clang", "version") %].src.tar.xz' - name: libcxxabi - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% pc("clang", "version") %]/lld-[% pc("clang", "version") %].src.tar.xz' - name: lld - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% pc("clang", "version") %]/compiler-rt-[% pc("clang", "version") %].src.tar.xz' - name: compiler-rt - file_gpg_id: 1 + - name: clang-source + project: clang-source - filename: compiler-rt-cross-compile.patch - filename: compiler-rt-no-codesign.patch - - filename: 43909.patch diff --git a/projects/mingw-w64-clang/build b/projects/mingw-w64-clang/build index ecb0e2c..44a913f 100644 --- a/projects/mingw-w64-clang/build +++ b/projects/mingw-w64-clang/build @@ -11,14 +11,7 @@ mkdir -p $builddir cd $builddir tar -xf $rootdir/mingw-w64-clang-[% c('version') %].tar.gz mv mingw-w64-clang-[% c('version') %] mingw-w64-clang -tar -xf $rootdir/[% c('input_files_by_name/libcxx') %] -mv libcxx-* libcxx -tar -xf $rootdir/[% c('input_files_by_name/libcxxabi') %] -mv libcxxabi-* libcxxabi -tar -xf $rootdir/[% c('input_files_by_name/libunwind') %] -mv libunwind-* libunwind -tar -xf $rootdir/[% c('input_files_by_name/compiler-rt') %] -mv compiler-rt-* compiler-rt +tar -xf $rootdir/[% c('input_files_by_name/clang-source') %] tar -xf $rootdir/[% c('input_files_by_name/llvm-mingw') %] # Adding the wrappers and symlinks we need @@ -98,9 +91,8 @@ make -j[% c("buildconf/num_procs") %] make -j[% c("buildconf/num_procs") %] install # compiler-rt -cd $builddir/compiler-rt +cd $builddir/clang-source/projects/compiler-rt mkdir build && cd build -CLANG_VERSION=$(basename $(dirname $(dirname $(dirname $($CC --print-libgcc-file-name -rtlib=compiler-rt))))) cmake -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_C_COMPILER=$CC \ -DCMAKE_SYSTEM_NAME=Windows \ @@ -109,13 +101,14 @@ cmake -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_C_COMPILER_WORKS=1 \ -DCMAKE_C_COMPILER_TARGET=$compiler_rt_machine-windows-gnu \ -DCOMPILER_RT_DEFAULT_TARGET_ONLY=TRUE \ - $builddir/compiler-rt/lib/builtins + $builddir/clang-source/projects/compiler-rt/lib/builtins make -j[% c("buildconf/num_procs") %] - mkdir -p $distdir/lib/clang/$CLANG_VERSION/lib/windows - cp lib/windows/libclang_rt.builtins-$compiler_rt_machine.a $distdir/lib/clang/$CLANG_VERSION/lib/windows/ + rtdir=$distdir/lib/clang/[% pc("clang-source", "version") %]/lib/windows + mkdir -p $rtdir + cp lib/windows/libclang_rt.builtins-$compiler_rt_machine.a $rtdir/ # libunwind -cd $builddir/libunwind +cd $builddir/clang-source/libunwind mkdir build && cd build cmake -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=$distdir/[% c("arch") %]-w64-mingw32 \ @@ -136,14 +129,14 @@ cmake -DCMAKE_BUILD_TYPE=Release \ -DLIBUNWIND_ENABLE_THREADS=TRUE \ -DLIBUNWIND_ENABLE_SHARED=FALSE \ -DLIBUNWIND_ENABLE_CROSS_UNWINDING=FALSE \ - -DCMAKE_CXX_FLAGS="-Wno-dll-attribute-on-redeclaration -nostdinc++ -I$builddir/libcxx/include -DPSAPI_VERSION=2" \ + -DCMAKE_CXX_FLAGS="-Wno-dll-attribute-on-redeclaration -nostdinc++ -I$builddir/clang-source/projects/libcxx/include -DPSAPI_VERSION=2" \ -DCMAKE_C_FLAGS="-Wno-dll-attribute-on-redeclaration" \ - $builddir/libunwind + $builddir/clang-source/libunwind make -j[% c("buildconf/num_procs") %] make -j[% c("buildconf/num_procs") %] install # libcxxabi -cd $builddir/libcxxabi +cd $builddir/clang-source/projects/libcxxabi mkdir build && cd build cmake -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=$distdir/[% c("arch") %]-w64-mingw32 \ @@ -162,16 +155,16 @@ cmake -DCMAKE_BUILD_TYPE=Release \ -DLIBCXXABI_ENABLE_THREADS=ON \ -DLIBCXXABI_TARGET_TRIPLE=[% c("arch") %]-w64-mingw32 \ -DLIBCXXABI_ENABLE_SHARED=OFF \ - -DLIBCXXABI_LIBCXX_INCLUDES=$builddir/libcxx/include \ + -DLIBCXXABI_LIBCXX_INCLUDES=$builddir/clang-source/projects/libcxx/include \ -DLLVM_NO_OLD_LIBSTDCXX=TRUE \ -DCXX_SUPPORTS_CXX11=TRUE \ -DCXX_SUPPORTS_CXX_STD=True \ -DCMAKE_CXX_FLAGS="-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS -D_LIBCPP_HAS_THREAD_API_WIN32" \ - $builddir/libcxxabi + $builddir/clang-source/projects/libcxxabi make -j[% c("buildconf/num_procs") %] VERBOSE=1 # libcxx -cd $builddir/libcxx +cd $builddir/clang-source/projects/libcxx mkdir build && cd build cmake -DCMAKE_BUILD_TYPE=Release \ -DCMAKE_INSTALL_PREFIX=$distdir/[% c("arch") %]-w64-mingw32 \ @@ -197,10 +190,10 @@ cmake -DCMAKE_BUILD_TYPE=Release \ -DLIBCXX_ENABLE_FILESYSTEM=OFF \ -DLIBCXX_ENABLE_STATIC_ABI_LIBRARY=TRUE \ -DLIBCXX_CXX_ABI=libcxxabi \ - -DLIBCXX_CXX_ABI_INCLUDE_PATHS=$builddir/libcxxabi/include \ - -DLIBCXX_CXX_ABI_LIBRARY_PATH=$builddir/libcxxabi/build/lib \ + -DLIBCXX_CXX_ABI_INCLUDE_PATHS=$builddir/clang-source/projects/libcxxabi/include \ + -DLIBCXX_CXX_ABI_LIBRARY_PATH=$builddir/clang-source/projects/libcxxabi/build/lib \ -DCMAKE_CXX_FLAGS="-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS" \ - $builddir/libcxx + $builddir/clang-source/projects/libcxx make -j[% c("buildconf/num_procs") %] VERBOSE=1 make -j[% c("buildconf/num_procs") %] install diff --git a/projects/mingw-w64-clang/config b/projects/mingw-w64-clang/config index 9ae0e61..1bf5954 100644 --- a/projects/mingw-w64-clang/config +++ b/projects/mingw-w64-clang/config @@ -3,9 +3,6 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: https://git.code.sf.net/p/mingw-w64/mingw-w64 git_hash: 1b373beec6d07478ffba33726bb3bb21f32e4411 version: '[% c("abbrev") %]' -llvm_version: 9.0.1 -gpg_keyring: clang.gpg -sig_ext: sig var: container: @@ -21,18 +18,8 @@ input_files: name: clang - project: cmake name: cmake - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("llvm_version") %]/libcxx-[% c("llvm_version") %].src.tar.xz' - name: libcxx - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("llvm_version") %]/libcxxabi-[% c("llvm_version") %].src.tar.xz' - name: libcxxabi - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("llvm_version") %]/libunwind-[% c("llvm_version") %].src.tar.xz' - name: libunwind - file_gpg_id: 1 - - URL: 'https://github.com/llvm/llvm-project/releases/download/llvmorg-[% c("llvm_version") %]/compiler-rt-[% c("llvm_version") %].src.tar.xz' - name: compiler-rt - file_gpg_id: 1 + - project: clang-source + name: clang-source - project: llvm-mingw name: llvm-mingw - filename: mingw-winrt.patch

1 0

[tor-browser-build/master] Bug 40010: Add NSS for application-services
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 53131fdc6d54bdd3bda261c64aa81fc3e8fbe228 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 30 10:12:32 2020 +0000 Bug 40010: Add NSS for application-services --- projects/nss/bug_13028.patch | 79 ++++++++++++++++++++++++ projects/nss/build | 139 +++++++++++++++++++++++++++++++++++++++++++ projects/nss/config | 27 +++++++++ projects/nss/config.patch | 37 ++++++++++++ projects/nss/configure.patch | 11 ++++ 5 files changed, 293 insertions(+) diff --git a/projects/nss/bug_13028.patch b/projects/nss/bug_13028.patch new file mode 100644 index 0000000..60bbd35 --- /dev/null +++ b/projects/nss/bug_13028.patch @@ -0,0 +1,79 @@ +From 2f0888c348561249d3083555db33c5619840dbfa Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Mon, 29 Sep 2014 14:30:19 -0700 +Subject: [PATCH] Bug 13028: Prevent potential proxy bypass cases. + +It looks like these cases should only be invoked in the NSS command line +tools, and not the browser, but I decided to patch them anyway because there +literally is a maze of network function pointers being passed around, and it's +very hard to tell if some random code might not pass in the proper proxied +versions of the networking code here by accident. + +diff --git a/security/nss/lib/certhigh/ocsp.c b/security/nss/lib/certhigh/ocsp.c +index cea8456606bf..86fa971cfbef 100644 +--- a/security/nss/lib/certhigh/ocsp.c ++++ b/security/nss/lib/certhigh/ocsp.c +@@ -2932,6 +2932,14 @@ ocsp_ConnectToHost(const char *host, PRUint16 port) + PRNetAddr addr; + char *netdbbuf = NULL; + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted OSCP direct connect to %s, port %u\n", host, ++ port); ++ goto loser; ++#endif ++ + sock = PR_NewTCPSocket(); + if (sock == NULL) + goto loser; +diff --git a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c +index e8698376b5be..85791d84a932 100644 +--- a/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c ++++ b/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c +@@ -1334,6 +1334,13 @@ pkix_pl_Socket_Create( + plContext), + PKIX_COULDNOTCREATESOCKETOBJECT); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct socket connect\n"); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif ++ + socket->isServer = isServer; + socket->timeout = timeout; + socket->clientSock = NULL; +@@ -1433,6 +1440,13 @@ pkix_pl_Socket_CreateByName( + + localCopyName = PL_strdup(serverName); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct connect to %s\n", serverName); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif ++ + sepPtr = strchr(localCopyName, ':'); + /* First strip off the portnum, if present, from the end of the name */ + if (sepPtr) { +@@ -1582,6 +1596,13 @@ pkix_pl_Socket_CreateByHostAndPort( + PKIX_ENTER(SOCKET, "pkix_pl_Socket_CreateByHostAndPort"); + PKIX_NULLCHECK_THREE(hostname, pStatus, pSocket); + ++ // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but ++ // we want to ensure nothing can ever hit this code in production. ++#if 1 ++ printf("Tor Browser BUG: Attempted pkix direct connect to %s, port %u\n", hostname, ++ portnum); ++ PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED); ++#endif + + prstatus = PR_GetHostByName(hostname, buf, sizeof(buf), &hostent); + +-- +2.27.0 + diff --git a/projects/nss/build b/projects/nss/build new file mode 100644 index 0000000..791a680 --- /dev/null +++ b/projects/nss/build @@ -0,0 +1,139 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +distdir=/var/tmp/dist/nss +builddir=/var/tmp/build/[% project %] +mkdir /var/tmp/build +tar -C /var/tmp/dist -xf [% c('input_files_by_name/ninja') %] +export PATH=/var/tmp/dist/ninja:$PATH + +# application-services uses a newer NDK, 21d, than all the other projects... +export ANDROID_NDK_API_VERSION=[% pc("fenix-android-toolchain", "var/android_ndk_version") %][% pc('fenix-android-toolchain', 'var/android_ndk_revision') %] +export ANDROID_NDK_HOME=/var/tmp/dist/[% c('var/compiler') %]/android-ndk/android-ndk-r$ANDROID_NDK_API_VERSION +# We need to add the new path to our build tools to PATH +export PATH=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH +export ANDROID_NDK_ROOT=$ANDROID_NDK_HOME +export NDK_HOST_TAG=linux-x86_64 + +nspr_64="" +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + gyp_arch="arm" +[% ELSIF c("var/configure_host") == "i686-linux-android" -%] + gyp_arch="ia32" +[% ELSIF c("var/configure_host") == "x86_64-linux-android" -%] + gyp_arch="x64" + nspr_64="--enable-64bit" +[% ELSIF c("var/configure_host") == "aarch64-linux-android" -%] + gyp_arch="arm64" + nspr_64="--enable-64bit" +[% END -%] + +export AR="[% c('var/cross_prefix') %]-ar" +# XXX: Mozilla really uses the NDK_API_VERSION here, which is weird. +export CC="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang" +export CXX="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang++" +export LD="[% c('var/cross_prefix') %]-ld" +export NM="[% c('var/cross_prefix') %]-nm" +export RANLIB="[% c('var/cross_prefix') %]-ranlib" +export READELF="[% c('var/cross_prefix') %]-readelf" + +tar -C /var/tmp/build -xf [% c('input_files_by_name/nss') %] +mv /var/tmp/build/[% project %]-[% c('version') %] $builddir +cd $builddir +# Early return hack to prevent NSPR Android setup +# which does not work with ndk unified headers and clang. See: +# application-services/libs/build-all.sh +cat $rootdir/configure.patch | patch nspr/configure +# Some NSS symbols clash with OpenSSL symbols, rename them using +# C preprocessor define macros. See: +# application-services/libs/build-all.sh +patch -p2 < $rootdir/config.patch +# Let's apply our proxy bypass defense-in-depth here as well to be on the safe +# side. +patch -p2 < $rootdir/bug_13028.patch + +# Building NSPR +mkdir $builddir/nspr_build +cd $builddir/nspr_build +../nspr/configure \ + $nspr_64 \ + --target=[% c("var/configure_host") %] \ + --disable-debug \ + --enable-optimize +make +cd .. + +# Building NSS +mkdir $builddir/nss_build +gyp -f ninja-android "$builddir/nss/nss.gyp" \ + --depth "$builddir/nss/" \ + --generator-output=. \ + -DOS=android \ + -Dnspr_lib_dir="$builddir/nspr_build/dist/lib" \ + -Dnspr_include_dir="$builddir/nspr_build/dist/include/nspr" \ + -Dnss_dist_dir="$builddir/nss_build" \ + -Dnss_dist_obj_dir="$builddir/nss_build" \ + -Dhost_arch="$gyp_arch" \ + -Dtarget_arch="$gyp_arch" \ + -Dstatic_libs=1 \ + -Ddisable_dbm=1 \ + -Dsign_libs=0 \ + -Denable_sslkeylogfile=0 \ + -Ddisable_tests=1 \ + -Ddisable_libpkix=1 + +gendir="$builddir/nss/out/Release" +ninja -C "$gendir" + +mkdir -p $distdir/include/nss +mkdir -p $distdir/lib +cp -p -L "$builddir/nss_build/lib/libcertdb.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libcerthi.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libcryptohi.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libfreebl_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnss_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnssb.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnssdev.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnsspki.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libnssutil.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libpk11wrap_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libpkcs12.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libpkcs7.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libsmime.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libsoftokn_static.a" "$distdir/lib" +cp -p -L "$builddir/nss_build/lib/libssl.a" "$distdir/lib" + +# HW specific. +# https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/… +[% IF c("var/configure_host") == "i686-linux-android" || c("var/configure_host") == "x86_64-linux-android"-%] + cp -p -L "$builddir/nss_build/lib/libgcm-aes-x86_c_lib.a" "$distdir/lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-androideabi" || c("var/configure_host") == "aarch64-linux-android"-%] + cp -p -L "$builddir/nss_build/lib/libarmv8_c_lib.a" "$distdir/lib" +[% END %] +[% IF c("var/configure_host") == "aarch64-linux-android" -%] + cp -p -L "$builddir/nss_build/lib/libgcm-aes-aarch64_c_lib.a" "$distdir/lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + cp -p -L "$builddir/nss_build/lib/libgcm-aes-arm32-neon_c_lib.a" "$distdir/lib" +[% END %] +# https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/… +# https://searchfox.org/nss/rev/08c4d05078d00089f8d7540651b0717a9d66f87e/lib/… +[% IF c("var/configure_host") == "x86_64-linux-android"-%] + cp -p -L "$builddir/nss_build/lib/libintel-gcm-wrap_c_lib.a" "$distdir/lib" + cp -p -L "$builddir/nss_build/lib/libintel-gcm-s_lib.a" "$distdir/lib" + cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx.a" "$distdir/lib" + cp -p -L "$builddir/nss_build/lib/libhw-acc-crypto-avx2.a" "$distdir/lib" +[% END %] +cp -p -L "$builddir/nspr_build/dist/lib/libplc4.a" "$distdir/lib" +cp -p -L "$builddir/nspr_build/dist/lib/libplds4.a" "$distdir/lib" +cp -p -L "$builddir/nspr_build/dist/lib/libnspr4.a" "$distdir/lib" + +cp -p -L -R "$builddir/nss_build/public/nss/"* "$distdir/include/nss" +cp -p -L -R "$builddir/nspr_build/dist/include/nspr/"* "$distdir/include/nss" + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/nss/config b/projects/nss/config new file mode 100644 index 0000000..e2b875e --- /dev/null +++ b/projects/nss/config @@ -0,0 +1,27 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +# The required versions for application-services can be found at the respective +# commit in libs/build-all.sh +version: 3.54 +# XXX: maybe that's extractable automatically from `version` somehow? +version_path: 3_54 +nspr_version: 4.26 +var: + container: + use_container: 1 + deps: + - build-essential + - gyp + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: ninja + project: ninja + - URL: 'https://ftp.mozilla.org/pub/security/nss/releases/NSS_[% c("version_path") %]_RTM/src/nss-[% c("version") %]-with-nspr-[% c("nspr_version") %].tar.gz' + name: nss + sha256sum: e0e81f0ff264d810f130d3cd9334722f7f883c752430483131d1ca5ac62d3f70 + - filename: configure.patch + - filename: config.patch + - filename: bug_13028.patch diff --git a/projects/nss/config.patch b/projects/nss/config.patch new file mode 100644 index 0000000..e7f5012 --- /dev/null +++ b/projects/nss/config.patch @@ -0,0 +1,37 @@ +From c11dc3a73349fc7d8fa451f9e3a4e3952aa54fd2 Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Wed, 1 Jul 2020 09:57:01 +0000 +Subject: [PATCH] Patch for building NSS for application-services + +See: application-services/libs/build-all.sh + +diff --git a/security/nss/coreconf/config.gypi b/security/nss/coreconf/config.gypi +index 62d3cc71ecaf..dd30de079081 100644 +--- a/security/nss/coreconf/config.gypi ++++ b/security/nss/coreconf/config.gypi +@@ -144,6 +144,23 @@ + '<(nspr_include_dir)', + '<(nss_dist_dir)/private/<(module)', + ], ++ 'defines': [ ++ 'HMAC_Update=NSS_HMAC_Update', ++ 'HMAC_Init=NSS_HMAC_Init', ++ 'CMAC_Update=NSS_CMAC_Update', ++ 'CMAC_Init=NSS_CMAC_Init', ++ 'MD5_Update=NSS_MD5_Update', ++ 'SHA1_Update=NSS_SHA1_Update', ++ 'SHA256_Update=NSS_SHA256_Update', ++ 'SHA224_Update=NSS_SHA224_Update', ++ 'SHA512_Update=NSS_SHA512_Update', ++ 'SHA384_Update=NSS_SHA384_Update', ++ 'SEED_set_key=NSS_SEED_set_key', ++ 'SEED_encrypt=NSS_SEED_encrypt', ++ 'SEED_decrypt=NSS_SEED_decrypt', ++ 'SEED_ecb_encrypt=NSS_SEED_ecb_encrypt', ++ 'SEED_cbc_encrypt=NSS_SEED_cbc_encrypt', ++ ], + 'conditions': [ + [ 'mozpkix_only==1 and OS=="linux"', { + 'include_dirs': [ +-- +2.27.0 diff --git a/projects/nss/configure.patch b/projects/nss/configure.patch new file mode 100644 index 0000000..4ce8465 --- /dev/null +++ b/projects/nss/configure.patch @@ -0,0 +1,11 @@ +@@ -2662,6 +2662,9 @@ + + case "$target" in + *-android*|*-linuxandroid*) ++ $as_echo "#define ANDROID 1" >>confdefs.h ++ ;; ++ unreachable) + if test -z "$android_ndk" ; then + as_fn_error $? "You must specify --with-android-ndk=/path/to/ndk when targeting Android." "$LINENO" 5 + fi +

1 0

[tor-browser-build/master] Bug 40011: Add SQLCipher for application-services
by sysrqb＠torproject.org 10 Aug '20

10 Aug '20

commit 01cb89f0a1c6e46db7add953cfb63b1924ee8377 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 1 14:32:40 2020 +0000 Bug 40011: Add SQLCipher for application-services --- projects/sqlcipher/build | 131 ++++++++++++++++++++++++++++++++++++++++++++++ projects/sqlcipher/config | 21 ++++++++ 2 files changed, 152 insertions(+) diff --git a/projects/sqlcipher/build b/projects/sqlcipher/build new file mode 100644 index 0000000..d364000 --- /dev/null +++ b/projects/sqlcipher/build @@ -0,0 +1,131 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] +distdir=/var/tmp/dist/sqlcipher +builddir=/var/tmp/build/[% project %] +mkdir /var/tmp/build +tar -C /var/tmp/dist -xf [% c('input_files_by_name/nss') %] + +# application-services uses a newer NDK, 21d, than all the other projects... +export ANDROID_NDK_API_VERSION=[% pc("fenix-android-toolchain", "var/android_ndk_version") %][% pc('fenix-android-toolchain', 'var/android_ndk_revision') %] +export ANDROID_NDK_HOME=/var/tmp/dist/[% c('var/compiler') %]/android-ndk/android-ndk-r$ANDROID_NDK_API_VERSION +# We need to add the new path to our build tools to PATH +export PATH=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH +export ANDROID_NDK_ROOT=$ANDROID_NDK_HOME +export NDK_HOST_TAG=linux-x86_64 + +export AR="[% c('var/cross_prefix') %]-ar" +# XXX: Mozilla really uses the NDK_API_VERSION here, which is weird. +export CC="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang" +export CXX="[% c('var/cross_prefix') %][% pc('fenix-android-toolchain', 'var/android_ndk_version') %]-clang++" +export LD="[% c('var/cross_prefix') %]-ld" +export RANLIB="[% c('var/cross_prefix') %]-ranlib" + +host="" +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + host="arm-linux" +[% ELSIF c("var/configure_host") == "i686-linux-android" -%] + host="i686-linux" +[% ELSIF c("var/configure_host") == "x86_64-linux-android" -%] + host="x86_64-linux" +[% ELSIF c("var/configure_host") == "aarch64-linux-android" -%] + host="arm-linux" +[% END -%] + +SQLCIPHER_CFLAGS=" \ + -DSQLITE_HAS_CODEC \ + -DSQLITE_SOUNDEX \ + -DHAVE_USLEEP=1 \ + -DSQLITE_MAX_VARIABLE_NUMBER=99999 \ + -DSQLITE_THREADSAFE=1 \ + -DSQLITE_DEFAULT_JOURNAL_SIZE_LIMIT=1048576 \ + -DNDEBUG=1 \ + -DSQLITE_ENABLE_MEMORY_MANAGEMENT=1 \ + -DSQLITE_ENABLE_LOAD_EXTENSION \ + -DSQLITE_ENABLE_COLUMN_METADATA \ + -DSQLITE_ENABLE_UNLOCK_NOTIFY \ + -DSQLITE_ENABLE_RTREE \ + -DSQLITE_ENABLE_STAT3 \ + -DSQLITE_ENABLE_STAT4 \ + -DSQLITE_ENABLE_JSON1 \ + -DSQLITE_ENABLE_FTS3_PARENTHESIS \ + -DSQLITE_ENABLE_FTS4 \ + -DSQLITE_ENABLE_FTS5 \ + -DSQLCIPHER_CRYPTO_NSS \ + -DSQLITE_ENABLE_DBSTAT_VTAB \ + -DSQLITE_SECURE_DELETE \ + -DSQLITE_DEFAULT_PAGE_SIZE=32768 \ + -DSQLITE_MAX_DEFAULT_PAGE_SIZE=32768 \ + -I/var/tmp/dist/nss/include \ +" + +LIBS="\ + -lcertdb \ + -lcerthi \ + -lcryptohi \ + -lfreebl_static \ + -lnspr4 \ + -lnss_static \ + -lnssb \ + -lnssdev \ + -lnsspki \ + -lnssutil \ + -lpk11wrap_static \ + -lplc4 \ + -lplds4 \ + -lsoftokn_static \ +" + +[% IF c("var/configure_host") == "i686-linux-android" || c("var/configure_host") == "x86_64-linux-android"-%] + LIBS="${LIBS} -lgcm-aes-x86_c_lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-android" || c("var/configure_host") == "aarch64-linux-android"-%] + LIBS="${LIBS} -larmv8_c_lib" +[% END %] +[% IF c("var/configure_host") == "aarch64-linux-android" -%] + LIBS="${LIBS} -lgcm-aes-aarch64_c_lib" +[% END %] +[% IF c("var/configure_host") == "arm-linux-androideabi" -%] + LIBS="${LIBS} -lgcm-aes-arm32-neon_c_lib" +[% END %] +[% IF c("var/configure_host") == "x86_64-linux-android"-%] + LIBS="${LIBS} -lintel-gcm-wrap_c_lib -lintel-gcm-s_lib -lhw-acc-crypto-avx -lhw-acc-crypto-avx2" +[% END %] + +tar -C /var/tmp/build -xf [% c('input_files_by_name/sqlcipher') %] +mv /var/tmp/build/[% project %]-[% c('version') %] $builddir +cd $builddir + +mkdir $builddir/build +cd build +../configure \ + --host="$host" \ + --with-pic \ + --verbose \ + --disable-shared \ + --with-crypto-lib=none \ + --disable-tcl \ + --enable-tempstore=yes \ + CFLAGS="${SQLCIPHER_CFLAGS}" \ + LDFLAGS="-L/var/tmp/dist/nss/lib" \ + LIBS="${LIBS} -llog -lm" + +make sqlite3.h +make sqlite3ext.h +make libsqlcipher.la + +mkdir -p $distdir/include/sqlcipher +mkdir -p $distdir/lib + +cp -p "$builddir/build/sqlite3.h" "$distdir/include/sqlcipher" +cp -p "$builddir/build/sqlite3ext.h" "$distdir/include/sqlcipher" +cp -p "$builddir/build/.libs/libsqlcipher.a" "$distdir/lib" + +# Just in case, ensure that the created binaries are not -w. +chmod +w "$distdir/lib/libsqlcipher.a" + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/sqlcipher/config b/projects/sqlcipher/config new file mode 100644 index 0000000..fb4ae3a --- /dev/null +++ b/projects/sqlcipher/config @@ -0,0 +1,21 @@ +# vim: filetype=yaml sw=2 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' +# The required versions for application-services can be found at the respective +# commit in libs/build-all.sh +version: 4.4.0 +var: + container: + use_container: 1 + deps: + - build-essential + - tcl + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]' + - name: nss + project: nss + - URL: 'https://github.com/sqlcipher/sqlcipher/archive/v[% c("version") %].tar.gz' + name: sqlcipher + sha256sum: 0924b2ae1079717954498bda78a30de20ce2a6083076b16214a711567821d148

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by gk＠torproject.org 10 Aug '20

10 Aug '20

commit 09628dac32ee9a839cfeef284e8531ddb161e15d Author: Georg Koppen <gk(a)torproject.org> Date: Mon Aug 10 07:35:16 2020 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 6a779b549e59..f55f5953c6ad 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 6a779b549e59dbb72ca81e0808619643a1a1926e +Subproject commit f55f5953c6adb6d75cad74fbb6c3b8fa2d617004

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 502fe9064244210138e634bdb44b1a1712092d21 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Aug 5 15:07:30 2020 -0400 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes #40066. --- browser/app/profile/000-tor-browser.js | 10 +--------- mobile/android/app/000-tor-browser-android.js | 10 ---------- 2 files changed, 1 insertion(+), 19 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index e86252ccd98c..3be6e460b628 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -33,10 +33,6 @@ pref("app.releaseNotesURL", "about:blank"); pref("app.update.staging.enabled", false); #endif -// No need to contact the Kinto-based blocklist system in addition to the old -// one which is still used, see bug 22071. -pref("services.blocklist.update_enabled", false); - // Disable "Slow startup" warnings and associated disk history // (bug #13346) pref("browser.slowStartup.notificationDisabled", true); @@ -73,7 +69,7 @@ pref("browser.ssb.enabled", false); // Misc privacy: Remote pref("browser.send_pings", false); pref("geo.enabled", false); -pref("geo.wifi.uri", ""); +pref("geo.provider.network.url", ""); pref("browser.search.suggest.enabled", false); pref("browser.safebrowsing.malware.enabled", false); pref("browser.safebrowsing.phishing.enabled", false); @@ -94,9 +90,6 @@ pref("datareporting.policy.dataSubmissionEnabled", false); pref("toolkit.telemetry.unified", false); pref("toolkit.telemetry.enabled", false); pref("toolkit.telemetry.updatePing.enabled", false); // Make sure updater telemetry is disabled; see #25909. -// No experiments, use Tor Browser. See 21797. -pref("experiments.enabled", false); -pref("browser.syncPromoViewsLeftMap", "{\"addons\":0, \"passwords\":0, \"bookmarks\":0}"); // Don't promote sync pref("identity.fxaccounts.enabled", false); // Disable sync by default pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs with other browsers pref("services.sync.engine.addons", false); @@ -133,7 +126,6 @@ pref("dom.w3c_pointer_events.enabled", false); pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now // Disable randomised Firefox HTTP cache decay user test groups (Bug: 13575) pref("security.webauth.webauthn", false); // Bug 26614: Disable Web Authentication API for now -pref("browser.cache.frecency_experiment", -1); // Disable intermediate preloading (Bug 30682) pref("security.remote_settings.intermediates.enabled", false); // Bug 2874: Block Components.interfaces from content diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js index db9e23063738..23fd39beac77 100644 --- a/mobile/android/app/000-tor-browser-android.js +++ b/mobile/android/app/000-tor-browser-android.js @@ -24,19 +24,9 @@ pref("privacy.clearOnShutdown.passwords",true); pref("privacy.clearOnShutdown.sessions",true); pref("privacy.clearOnShutdown.siteSettings",true); -// Disable Control media casting & mirroring features -pref("browser.casting.enabled", false); - // controls if we want camera support -pref("device.camera.enabled", false); pref("media.realtime_decoder.enabled", false); -// Do not fetch updated per-site user-agent strings from Mozilla -// See ua-update.json.in for the packaged UA override list -// See https://bugzilla.mozilla.org/show_bug.cgi?id=897221 -pref("general.useragent.updates.enabled", false); -pref("general.useragent.updates.url", ""); - // Enable touch events on Android (highlighting text, etc) pref("dom.w3c_touch_events.enabled", 2);

1 0

[tor-browser-build/master] Bug 40016: update Snowflake to discover NAT type
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 251a6f767679b14b4e13b09920fe909d41462814 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Thu Jul 9 13:03:30 2020 +0000 Bug 40016: update Snowflake to discover NAT type This updates Snowflake and the set of default stun servers used by the Snowflake client. --- projects/pion-stun/config | 2 +- projects/snowflake/config | 2 +- .../tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix | 2 +- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 2 +- .../tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix | 2 +- .../tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/projects/pion-stun/config b/projects/pion-stun/config index 37405eb..546e379 100644 --- a/projects/pion-stun/config +++ b/projects/pion-stun/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://github.com/pion/stun -git_hash: 51fef3542ed793994ff3da9c9b897fb23d744503 # v0.3.3 +git_hash: 4fa7a9d658b6037114fd35b6cb257979ed474a9b # v0.3.5 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' build: '[% c("projects/go/var/build_go_lib") %]' diff --git a/projects/snowflake/config b/projects/snowflake/config index 898fe70..10fe1cc 100644 --- a/projects/snowflake/config +++ b/projects/snowflake/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' git_url: https://git.torproject.org/pluggable-transports/snowflake.git -git_hash: 7043a055f9fb0680281ecffd7d458a43f2ce65b5 +git_hash: 82031289a3362ff3fa199628276d76e840491431 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix index ac89698..411c6e1 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix @@ -2,4 +2,4 @@ ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit exec ./TorBrowser/Tor/PluggableTransports/obfs4proxy ## snowflake configuration -ClientTransportPlugin snowflake exec ./TorBrowser/Tor/PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302 +ClientTransportPlugin snowflake exec ./TorBrowser/Tor/PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix index 154bda4..baa0a6e 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix @@ -2,4 +2,4 @@ ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit exec PluggableTransports/obfs4proxy ## snowflake configuration -ClientTransportPlugin snowflake exec PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302 +ClientTransportPlugin snowflake exec PluggableTransports/snowflake-client -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix b/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix index af16b3c..42502f4 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix +++ b/projects/tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix @@ -2,4 +2,4 @@ ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit exec TorBrowser\Tor\PluggableTransports\obfs4proxy.exe ## snowflake configuration -ClientTransportPlugin snowflake exec TorBrowser\Tor\PluggableTransports\snowflake-client.exe -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302 +ClientTransportPlugin snowflake exec TorBrowser\Tor\PluggableTransports\snowflake-client.exe -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 diff --git a/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch b/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch index 03e06aa..f168eed 100644 --- a/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch +++ b/projects/tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch @@ -71,7 +71,7 @@ index 2405097..bcb6a37 100644 - buffer.append("ClientTransportPlugin meek_lite,obfs3,obfs4 exec ").append(clientPath).append('\n'); + public TorConfigBuilder transportPlugin(String obfsPath, String snowPath) { + buffer.append("ClientTransportPlugin meek_lite,obfs3,obfs4 exec ").append(obfsPath).append('\n'); -+ buffer.append("ClientTransportPlugin snowflake exec ").append(snowPath).append(" -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302\n"); ++ buffer.append("ClientTransportPlugin snowflake exec ").append(snowPath).append(" -url https://snowflake-broker.azureedge.net/ -front ajax.aspnetcdn.com -ice stun:stun.l.google.com:19302,stun:stun.voip.blackberry.com:3478,stun:stun.altar.com.pl:3478,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.sonetel.net:3478,stun:stun.stunprotocol.org:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478\n"); return this; }

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gitlab/merge-requests/11' into master
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit de185dd7b4e5188905ed972496e69dd537bd0534 Merge: eeb2153 251a6f7 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 7 18:27:14 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/11' into master projects/pion-stun/config | 2 +- projects/snowflake/config | 2 +- .../tor-browser/Bundle-Data/PTConfigs/linux/torrc-defaults-appendix | 2 +- projects/tor-browser/Bundle-Data/PTConfigs/mac/torrc-defaults-appendix | 2 +- .../tor-browser/Bundle-Data/PTConfigs/windows/torrc-defaults-appendix | 2 +- .../tor-onion-proxy-library/0001-Bug-30318-Add-snowflake-support.patch | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-)

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 21952: Implement Onion-Location
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 9a78f236a3243d7748e44262ce5a0f1a4be44144 Author: Alex Catarineu <acat(a)torproject.org> Date: Thu Jul 2 21:38:54 2020 +0200 fixup! Bug 21952: Implement Onion-Location Fixes #40019. --- dom/base/Document.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp index acc59f5fe70c..0d49a6a18419 100644 --- a/dom/base/Document.cpp +++ b/dom/base/Document.cpp @@ -6029,16 +6029,17 @@ void Document::GetHeaderData(nsAtom* aHeaderField, nsAString& aData) const { static bool IsValidOnionLocation(nsIURI* aDocumentURI, nsIURI* aOnionLocationURI) { bool isHttpish; - nsAutoCString onionHost; + nsAutoCString host; return aDocumentURI && aOnionLocationURI && NS_SUCCEEDED(aDocumentURI->SchemeIs("https", &isHttpish)) && - isHttpish && + isHttpish && NS_SUCCEEDED(aDocumentURI->GetAsciiHost(host)) && + !StringEndsWith(host, NS_LITERAL_CSTRING(".onion")) && ((NS_SUCCEEDED(aOnionLocationURI->SchemeIs("http", &isHttpish)) && isHttpish) || (NS_SUCCEEDED(aOnionLocationURI->SchemeIs("https", &isHttpish)) && isHttpish)) && - NS_SUCCEEDED(aOnionLocationURI->GetAsciiHost(onionHost)) && - StringEndsWith(onionHost, NS_LITERAL_CSTRING(".onion")); + NS_SUCCEEDED(aOnionLocationURI->GetAsciiHost(host)) && + StringEndsWith(host, NS_LITERAL_CSTRING(".onion")); } void Document::SetHeaderData(nsAtom* aHeaderField, const nsAString& aData) {

1 0

[torbutton/master] Merge remote-tracking branch 'gitlab/merge-requests/3' into master
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit f55f5953c6adb6d75cad74fbb6c3b8fa2d617004 Merge: c36ccb58 0b80394c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 7 14:31:41 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/3' into master components/domain-isolator.js | 8 +++++++- components/dragDropFilter.js | 9 ++++++++- components/external-app-blocker.js | 9 ++++++++- components/startup-observer.js | 9 ++++++++- components/torCheckService.js | 9 ++++++++- components/torbutton-logger.js | 16 ++++++++-------- 6 files changed, 47 insertions(+), 13 deletions(-)

1 0

[torbutton/master] Bug 40002: Fix generateNSGetFactory being moved to ComponentUtils
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 0b80394c77f8d3c4f9df7594e692da857300b60f Author: Alex Catarineu <acat(a)torproject.org> Date: Thu Jul 30 20:53:07 2020 +0200 Bug 40002: Fix generateNSGetFactory being moved to ComponentUtils This was changed in https://bugzilla.mozilla.org/show_bug.cgi?id=1649554. --- components/domain-isolator.js | 8 +++++++- components/dragDropFilter.js | 9 ++++++++- components/external-app-blocker.js | 9 ++++++++- components/startup-observer.js | 9 ++++++++- components/torCheckService.js | 9 ++++++++- components/torbutton-logger.js | 16 ++++++++-------- 6 files changed, 47 insertions(+), 13 deletions(-) diff --git a/components/domain-isolator.js b/components/domain-isolator.js index 38d0abe8..06fe1e2e 100644 --- a/components/domain-isolator.js +++ b/components/domain-isolator.js @@ -11,6 +11,10 @@ const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + // Make the logger available. let logger = Cc["@torproject.org/torbutton-logger;1"] .getService(Ci.nsISupports).wrappedJSObject; @@ -199,4 +203,6 @@ DomainIsolator.prototype = { }; // Assign factory to global object. -const NSGetFactory = XPCOMUtils.generateNSGetFactory([DomainIsolator]); +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([DomainIsolator]) + : ComponentUtils.generateNSGetFactory([DomainIsolator]); diff --git a/components/dragDropFilter.js b/components/dragDropFilter.js index f48d1b38..361424d1 100644 --- a/components/dragDropFilter.js +++ b/components/dragDropFilter.js @@ -9,6 +9,10 @@ const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + // Module specific constants const kMODULE_NAME = "Torbutton Drag and Drop Handler"; const kCONTRACT_ID = "@torproject.org/torbutton-dragDropFilter;1"; @@ -79,4 +83,7 @@ DragDropFilter.prototype = } }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([DragDropFilter]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([DragDropFilter]) + : ComponentUtils.generateNSGetFactory([DragDropFilter]); diff --git a/components/external-app-blocker.js b/components/external-app-blocker.js index 89d6d252..2fa80d9d 100644 --- a/components/external-app-blocker.js +++ b/components/external-app-blocker.js @@ -16,6 +16,10 @@ const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { PromptUtils } = ChromeUtils.import("resource://gre/modules/SharedPromptUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + let { torbutton_get_property_string } = ChromeUtils.import("resource://torbutton/modules/utils.js", {}); // Module specific constants @@ -131,4 +135,7 @@ ExternalAppBlocker.prototype = }, }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([ExternalAppBlocker]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([ExternalAppBlocker]) + : ComponentUtils.generateNSGetFactory([ExternalAppBlocker]); diff --git a/components/startup-observer.js b/components/startup-observer.js index d2d1d610..c81eebab 100644 --- a/components/startup-observer.js +++ b/components/startup-observer.js @@ -15,6 +15,10 @@ const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + XPCOMUtils.defineLazyModuleGetters(this, { FileUtils: "resource://gre/modules/FileUtils.jsm", FileSource: "resource://gre/modules/L10nRegistry.jsm", @@ -205,4 +209,7 @@ StartupObserver.prototype = { _xpcom_categories: [{category:"profile-after-change"}], }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([StartupObserver]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([StartupObserver]) + : ComponentUtils.generateNSGetFactory([StartupObserver]); diff --git a/components/torCheckService.js b/components/torCheckService.js index 409cc2c5..07b1aa99 100644 --- a/components/torCheckService.js +++ b/components/torCheckService.js @@ -10,6 +10,10 @@ const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + // Module specific constants const kMODULE_NAME = "Torbutton Tor Check Service"; const kMODULE_CONTRACTID = "@torproject.org/torbutton-torCheckService;1"; @@ -131,4 +135,7 @@ TBTorCheckService.prototype = }, }; -var NSGetFactory = XPCOMUtils.generateNSGetFactory([TBTorCheckService]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([TBTorCheckService]) + : ComponentUtils.generateNSGetFactory([TBTorCheckService]); diff --git a/components/torbutton-logger.js b/components/torbutton-logger.js index 1c946fa7..d80d13c4 100644 --- a/components/torbutton-logger.js +++ b/components/torbutton-logger.js @@ -16,6 +16,10 @@ const kMODULE_CID = Components.ID("f36d72c9-9718-4134-b550-e109638331d7"); const { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); const { XPCOMUtils } = ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); +XPCOMUtils.defineLazyModuleGetters(this, { + ComponentUtils: "resource://gre/modules/ComponentUtils.jsm", +}); + function TorbuttonLogger() { // Register observer Services.prefs.addObserver("extensions.torbutton", this); @@ -154,11 +158,7 @@ TorbuttonLogger.prototype = } } -/** -* XPCOMUtils.generateNSGetFactory was introduced in Mozilla 2 (Firefox 4). -* XPCOMUtils.generateNSGetModule is for Mozilla 1.9.2 (Firefox 3.6). -*/ -if (XPCOMUtils.generateNSGetFactory) - var NSGetFactory = XPCOMUtils.generateNSGetFactory([TorbuttonLogger]); -else - var NSGetModule = XPCOMUtils.generateNSGetModule([TorbuttonLogger]); +// Assign factory to global object. +const NSGetFactory = XPCOMUtils.generateNSGetFactory + ? XPCOMUtils.generateNSGetFactory([TorbuttonLogger]) + : ComponentUtils.generateNSGetFactory([TorbuttonLogger]);

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 40025: Remove Mozilla add-on install permissions
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 988c57a8c8b2f0a2576920ade8468ef80b6fa32b Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jul 27 18:12:55 2020 +0200 Bug 40025: Remove Mozilla add-on install permissions --- browser/app/permissions | 6 ------ 1 file changed, 6 deletions(-) diff --git a/browser/app/permissions b/browser/app/permissions index da6b6728043d..5c4c302f5ba5 100644 --- a/browser/app/permissions +++ b/browser/app/permissions @@ -11,12 +11,6 @@ origin uitour 1 https://3g2upl4pq6kufc4m.onion origin uitour 1 about:tor -# XPInstall -origin install 1 https://addons.mozilla.org - # Remote troubleshooting origin remote-troubleshooting 1 https://support.mozilla.org -# addon install -origin install 1 https://private-network.firefox.com -origin install 1 https://fpn.firefox.com

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 26961: New user onboarding.
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit e0874b092e93e58c9abd70bdcdd87610cc7efc1e Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jul 27 18:11:27 2020 +0200 fixup! Bug 26961: New user onboarding. --- browser/app/permissions | 3 +++ 1 file changed, 3 insertions(+) diff --git a/browser/app/permissions b/browser/app/permissions index 06d71cd6e88c..da6b6728043d 100644 --- a/browser/app/permissions +++ b/browser/app/permissions @@ -17,3 +17,6 @@ origin install 1 https://addons.mozilla.org # Remote troubleshooting origin remote-troubleshooting 1 https://support.mozilla.org +# addon install +origin install 1 https://private-network.firefox.com +origin install 1 https://fpn.firefox.com

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 2176: Rebrand Firefox to TorBrowser
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit ec56b5afac8b53d295edf75c8b772098310c614c Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Aug 4 19:05:22 2020 +0200 fixup! Bug 2176: Rebrand Firefox to TorBrowser Fixes #40022. --- browser/branding/alpha/default22.png | Bin 0 -> 1240 bytes browser/branding/alpha/default24.png | Bin 0 -> 1368 bytes browser/branding/nightly/default22.png | Bin 0 -> 1377 bytes browser/branding/nightly/default24.png | Bin 0 -> 1509 bytes browser/branding/official/default22.png | Bin 0 -> 1250 bytes browser/branding/official/default24.png | Bin 0 -> 1405 bytes 6 files changed, 0 insertions(+), 0 deletions(-) diff --git a/browser/branding/alpha/default22.png b/browser/branding/alpha/default22.png new file mode 100644 index 000000000000..4feb2dbd400c Binary files /dev/null and b/browser/branding/alpha/default22.png differ diff --git a/browser/branding/alpha/default24.png b/browser/branding/alpha/default24.png new file mode 100644 index 000000000000..4387f97e3d62 Binary files /dev/null and b/browser/branding/alpha/default24.png differ diff --git a/browser/branding/nightly/default22.png b/browser/branding/nightly/default22.png new file mode 100644 index 000000000000..02c87a9e2db6 Binary files /dev/null and b/browser/branding/nightly/default22.png differ diff --git a/browser/branding/nightly/default24.png b/browser/branding/nightly/default24.png new file mode 100644 index 000000000000..34cfedb2d908 Binary files /dev/null and b/browser/branding/nightly/default24.png differ diff --git a/browser/branding/official/default22.png b/browser/branding/official/default22.png new file mode 100644 index 000000000000..41cc3543d39f Binary files /dev/null and b/browser/branding/official/default22.png differ diff --git a/browser/branding/official/default24.png b/browser/branding/official/default24.png new file mode 100644 index 000000000000..195cae90d3ed Binary files /dev/null and b/browser/branding/official/default24.png differ

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit fad325072ede8c2ced828385006cef7b6ebaa161 Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Jul 24 11:03:28 2020 +0200 fixup! Bug 10760: Integrate TorButton to TorBrowser core Fixes #33737 --- browser/base/content/aboutDialog.xhtml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/browser/base/content/aboutDialog.xhtml b/browser/base/content/aboutDialog.xhtml index 1ee820326dc6..02096fbfa3c0 100644 --- a/browser/base/content/aboutDialog.xhtml +++ b/browser/base/content/aboutDialog.xhtml @@ -28,7 +28,7 @@ data-l10n-id="aboutDialog-title" #endif role="dialog" - aria-describedby="version distribution distributionId communityDesc contributeDesc trademark" + aria-describedby="version distribution distributionId projectDesc helpDesc trademark trademarkTor" > #ifdef XP_MACOSX #include macWindow.inc.xhtml @@ -132,6 +132,9 @@ <label is="text-link" useoriginprincipal="true" href="about:credits" data-l10n-name="community-exp-creditsLink"></label> </description> </vbox> +  + <description class="text-blurb" id="communityDesc" data-l10n-id="community-2" hidden="true"></description> + <description class="text-blurb" id="contributeDesc" data-l10n-id="helpus" hidden="true"></description> <description class="text-blurb" id="projectDesc"> &project.start; <label is="text-link" href="https://www.torproject.org/">

1 0

[tor-browser-build/master] Move our nightly over to 78.1.0esr
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit eeb2153d798e2efb90e979a190d2bf63623f35c2 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 7 13:50:04 2020 +0000 Move our nightly over to 78.1.0esr --- projects/firefox/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/firefox/config b/projects/firefox/config index 9876240..d42474b 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 78.0.1 + firefox_platform_version: 78.1.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 10.0 branding_directory: '[% IF c("var/android") %]mobile/android[% ELSE %]browser[% END %]/branding/alpha'

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 32658: Create a new MAR signing key
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit ac66a7e4855af29ea929bf4089ad151688100f80 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 17 12:54:31 2020 +0000 Bug 32658: Create a new MAR signing key It's time for our rotation again: Move the backup key in the front position and add a new backup key. --- toolkit/mozapps/update/updater/release_primary.der | Bin 1225 -> 1229 bytes toolkit/mozapps/update/updater/release_secondary.der | Bin 1225 -> 1229 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/toolkit/mozapps/update/updater/release_primary.der b/toolkit/mozapps/update/updater/release_primary.der index 1d94f88ad73b..0103a171de88 100644 Binary files a/toolkit/mozapps/update/updater/release_primary.der and b/toolkit/mozapps/update/updater/release_primary.der differ diff --git a/toolkit/mozapps/update/updater/release_secondary.der b/toolkit/mozapps/update/updater/release_secondary.der index 474706c4b73c..fcee3944e9b7 100644 Binary files a/toolkit/mozapps/update/updater/release_secondary.der and b/toolkit/mozapps/update/updater/release_secondary.der differ

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 30237: Add v3 onion services client authentication prompt
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit 60ab0188e9e1daa2fef48db30bbc8bc19db70ba2 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Nov 12 16:11:05 2019 -0500 Bug 30237: Add v3 onion services client authentication prompt When Tor informs the browser that client authentication is needed, temporarily load about:blank instead of about:neterror and prompt for the user's key. If a correctly formatted key is entered, use Tor's ONION_CLIENT_AUTH_ADD control port command to add the key (via Torbutton's control port module) and reload the page. If the user cancels the prompt, display the standard about:neterror "Unable to connect" page. This requires a small change to browser/actors/NetErrorChild.jsm to account for the fact that the docShell no longer has the failedChannel information. The failedChannel is used to extract TLS-related error info, which is not applicable in the case of a canceled .onion authentication prompt. Add a leaveOpen option to PopupNotifications.show so we can display error messages within the popup notification doorhanger without closing the prompt. Add support for onion services strings to the TorStrings module. Add support for Tor extended SOCKS errors (Tor proposal 304) to the socket transport and SOCKS layers. Improved display of all of these errors will be implemented as part of bug 30025. Also fixes bug 19757: Add a "Remember this key" checkbox to the client auth prompt. Add an "Onion Services Authentication" section within the about:preferences "Privacy & Security section" to allow viewing and removal of v3 onion client auth keys that have been stored on disk. Also fixes bug 19251: use enhanced error pages for onion service errors. --- browser/actors/NetErrorChild.jsm | 7 + browser/base/content/aboutNetError.js | 10 +- browser/base/content/aboutNetError.xhtml | 1 + browser/base/content/browser.js | 10 + browser/base/content/browser.xhtml | 3 + browser/base/content/tab-content.js | 5 + browser/components/moz.build | 1 + .../content/authNotificationIcon.inc.xhtml | 6 + .../onionservices/content/authPopup.inc.xhtml | 16 ++ .../onionservices/content/authPreferences.css | 20 ++ .../content/authPreferences.inc.xhtml | 19 ++ .../onionservices/content/authPreferences.js | 66 +++++ .../components/onionservices/content/authPrompt.js | 316 +++++++++++++++++++++ .../components/onionservices/content/authUtil.jsm | 47 +++ .../onionservices/content/netError/browser.svg | 3 + .../onionservices/content/netError/network.svg | 3 + .../content/netError/onionNetError.css | 65 +++++ .../content/netError/onionNetError.js | 244 ++++++++++++++++ .../onionservices/content/netError/onionsite.svg | 7 + .../onionservices/content/onionservices.css | 69 +++++ .../onionservices/content/savedKeysDialog.js | 259 +++++++++++++++++ .../onionservices/content/savedKeysDialog.xhtml | 42 +++ browser/components/onionservices/jar.mn | 9 + browser/components/onionservices/moz.build | 1 + browser/components/preferences/preferences.xhtml | 1 + browser/components/preferences/privacy.inc.xhtml | 2 + browser/components/preferences/privacy.js | 7 + browser/themes/shared/notification-icons.inc.css | 3 + docshell/base/nsDocShell.cpp | 81 +++++- dom/ipc/BrowserParent.cpp | 21 ++ dom/ipc/BrowserParent.h | 3 + dom/ipc/PBrowser.ipdl | 9 + js/xpconnect/src/xpc.msg | 10 + netwerk/base/nsSocketTransport2.cpp | 6 + netwerk/socket/nsSOCKSIOLayer.cpp | 49 ++++ toolkit/modules/PopupNotifications.jsm | 6 + toolkit/modules/RemotePageAccessManager.jsm | 1 + .../lib/environments/frame-script.js | 1 + xpcom/base/ErrorList.py | 22 ++ 39 files changed, 1449 insertions(+), 2 deletions(-) diff --git a/browser/actors/NetErrorChild.jsm b/browser/actors/NetErrorChild.jsm index af9d6bd46128..de66e9eeda18 100644 --- a/browser/actors/NetErrorChild.jsm +++ b/browser/actors/NetErrorChild.jsm @@ -13,6 +13,8 @@ const { RemotePageChild } = ChromeUtils.import( "resource://gre/actors/RemotePageChild.jsm" ); +const { TorStrings } = ChromeUtils.import("resource:///modules/TorStrings.jsm"); + XPCOMUtils.defineLazyServiceGetter( this, "gSerializationHelper", @@ -29,6 +31,7 @@ class NetErrorChild extends RemotePageChild { "RPMPrefIsLocked", "RPMAddToHistogram", "RPMRecordTelemetryEvent", + "RPMGetTorStrings", ]; this.exportFunctions(exportableFunctions); } @@ -82,4 +85,8 @@ class NetErrorChild extends RemotePageChild { RPMRecordTelemetryEvent(category, event, object, value, extra) { Services.telemetry.recordEvent(category, event, object, value, extra); } + + RPMGetTorStrings() { + return Cu.cloneInto(TorStrings.onionServices, this.contentWindow); + } } diff --git a/browser/base/content/aboutNetError.js b/browser/base/content/aboutNetError.js index 053d26ade512..60db17f46eb9 100644 --- a/browser/base/content/aboutNetError.js +++ b/browser/base/content/aboutNetError.js @@ -3,6 +3,7 @@ * You can obtain one at http://mozilla.org/MPL/2.0/. */ /* eslint-env mozilla/frame-script */ +/* import-globals-from ../../components/onionservices/content/netError/onionNetError.js */ const formatter = new Intl.DateTimeFormat("default"); @@ -241,7 +242,10 @@ function initPage() { errDesc = document.getElementById("ed_generic"); } - setErrorPageStrings(err); + const isOnionError = err.startsWith("onionServices."); + if (!isOnionError) { + setErrorPageStrings(err); + } var sd = document.getElementById("errorShortDescText"); if (sd) { @@ -387,6 +391,10 @@ function initPage() { span.textContent = document.location.hostname; } } + + if (isOnionError) { + OnionServicesAboutNetError.initPage(document); + } } function setupErrorUI() { diff --git a/browser/base/content/aboutNetError.xhtml b/browser/base/content/aboutNetError.xhtml index 299aadddc82e..120d4637f533 100644 --- a/browser/base/content/aboutNetError.xhtml +++ b/browser/base/content/aboutNetError.xhtml @@ -208,5 +208,6 @@ </div> </div> </body> + <script src="chrome://browser/content/onionservices/netError/onionNetError.js"/> <script src="chrome://browser/content/aboutNetError.js"/> </html> diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js index 2e95c9890ee2..1b0867d198f5 100644 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js @@ -220,6 +220,11 @@ XPCOMUtils.defineLazyScriptGetter( ["SecurityLevelButton"], "chrome://browser/content/securitylevel/securityLevel.js" ); +XPCOMUtils.defineLazyScriptGetter( + this, + ["OnionAuthPrompt"], + "chrome://browser/content/onionservices/authPrompt.js" +); XPCOMUtils.defineLazyScriptGetter( this, "gEditItemOverlay", @@ -1883,6 +1888,9 @@ var gBrowserInit = { // Init the SecuritySettingsButton SecurityLevelButton.init(); + // Init the OnionAuthPrompt + OnionAuthPrompt.init(); + // Certain kinds of automigration rely on this notification to complete // their tasks BEFORE the browser window is shown. SessionStore uses it to // restore tabs into windows AFTER important parts like gMultiProcessBrowser @@ -2489,6 +2497,8 @@ var gBrowserInit = { SecurityLevelButton.uninit(); + OnionAuthPrompt.uninit(); + gAccessibilityServiceIndicator.uninit(); AccessibilityRefreshBlocker.uninit(); diff --git a/browser/base/content/browser.xhtml b/browser/base/content/browser.xhtml index a09f607f888e..48eeaa36c196 100644 --- a/browser/base/content/browser.xhtml +++ b/browser/base/content/browser.xhtml @@ -33,6 +33,7 @@ <?xml-stylesheet href="chrome://browser/skin/places/editBookmark.css" type="text/css"?> <?xml-stylesheet href="chrome://torbutton/skin/tor-circuit-display.css" type="text/css"?> <?xml-stylesheet href="chrome://torbutton/skin/torbutton.css" type="text/css"?> +<?xml-stylesheet href="chrome://browser/content/onionservices/onionservices.css" type="text/css"?> # All DTD information is stored in a separate file so that it can be shared by # hiddenWindowMac.xhtml. @@ -626,6 +627,7 @@ #include ../../components/downloads/content/downloadsPanel.inc.xhtml #include ../../../devtools/startup/enableDevToolsPopup.inc.xhtml #include ../../components/securitylevel/content/securityLevelPanel.inc.xhtml +#include ../../components/onionservices/content/authPopup.inc.xhtml #include browser-allTabsMenu.inc.xhtml <hbox id="downloads-animation-container"> @@ -994,6 +996,7 @@ data-l10n-id="urlbar-indexed-db-notification-anchor"/> <image id="password-notification-icon" class="notification-anchor-icon login-icon" role="button" data-l10n-id="urlbar-password-notification-anchor"/> +#include ../../components/onionservices/content/authNotificationIcon.inc.xhtml <stack id="plugins-notification-icon" class="notification-anchor-icon" role="button" align="center" data-l10n-id="urlbar-plugins-notification-anchor"> <image class="plugin-icon" /> <image id="plugin-icon-badge" /> diff --git a/browser/base/content/tab-content.js b/browser/base/content/tab-content.js index 30cfa891c1fb..c57244a962ee 100644 --- a/browser/base/content/tab-content.js +++ b/browser/base/content/tab-content.js @@ -19,6 +19,9 @@ ChromeUtils.defineModuleGetter( "BrowserUtils", "resource://gre/modules/BrowserUtils.jsm" ); +var { OnionAuthUtil } = ChromeUtils.import( + "chrome://browser/content/onionservices/authUtil.jsm" +); var { ActorManagerChild } = ChromeUtils.import( "resource://gre/modules/ActorManagerChild.jsm" @@ -101,5 +104,7 @@ if (Services.appinfo.processType == Services.appinfo.PROCESS_TYPE_CONTENT) { Services.obs.notifyObservers(this, "tab-content-frameloader-created"); +OnionAuthUtil.addCancelMessageListener(this, docShell); + // This is a temporary hack to prevent regressions (bug 1471327). void content; diff --git a/browser/components/moz.build b/browser/components/moz.build index 09e209dc9c3b..b660be047b14 100644 --- a/browser/components/moz.build +++ b/browser/components/moz.build @@ -41,6 +41,7 @@ DIRS += [ 'fxmonitor', 'migration', 'newtab', + 'onionservices', 'originattributes', 'pioneer', 'places', diff --git a/browser/components/onionservices/content/authNotificationIcon.inc.xhtml b/browser/components/onionservices/content/authNotificationIcon.inc.xhtml new file mode 100644 index 000000000000..91274d612739 --- /dev/null +++ b/browser/components/onionservices/content/authNotificationIcon.inc.xhtml @@ -0,0 +1,6 @@ +# Copyright (c) 2020, The Tor Project, Inc. + +<image id="tor-clientauth-notification-icon" + class="notification-anchor-icon tor-clientauth-icon" + role="button" + tooltiptext="&torbutton.onionServices.authPrompt.tooltip;"/> diff --git a/browser/components/onionservices/content/authPopup.inc.xhtml b/browser/components/onionservices/content/authPopup.inc.xhtml new file mode 100644 index 000000000000..bd0ec3aa0b00 --- /dev/null +++ b/browser/components/onionservices/content/authPopup.inc.xhtml @@ -0,0 +1,16 @@ +# Copyright (c) 2020, The Tor Project, Inc. + +<popupnotification id="tor-clientauth-notification" hidden="true"> + <popupnotificationcontent orient="vertical"> + <description id="tor-clientauth-notification-desc"/> + <label id="tor-clientauth-notification-learnmore" + class="text-link popup-notification-learnmore-link" + is="text-link"/> + <html:div> + <html:input id="tor-clientauth-notification-key" type="password"/> + <html:div id="tor-clientauth-warning"/> + <checkbox id="tor-clientauth-persistkey-checkbox" + label="&torbutton.onionServices.authPrompt.persistCheckboxLabel;"/> + </html:div> + </popupnotificationcontent> +</popupnotification> diff --git a/browser/components/onionservices/content/authPreferences.css b/browser/components/onionservices/content/authPreferences.css new file mode 100644 index 000000000000..b3fb79b26ddc --- /dev/null +++ b/browser/components/onionservices/content/authPreferences.css @@ -0,0 +1,20 @@ +/* Copyright (c) 2020, The Tor Project, Inc. */ + +#torOnionServiceKeys-overview-container { + margin-right: 30px; +} + +#onionservices-savedkeys-tree treechildren::-moz-tree-cell-text { + font-size: 80%; +} + +#onionservices-savedkeys-errorContainer { + margin-top: 4px; + min-height: 3em; +} + +#onionservices-savedkeys-errorIcon { + margin-right: 4px; + list-style-image: url("chrome://browser/skin/warning.svg"); + visibility: hidden; +} diff --git a/browser/components/onionservices/content/authPreferences.inc.xhtml b/browser/components/onionservices/content/authPreferences.inc.xhtml new file mode 100644 index 000000000000..f69c9dde66a2 --- /dev/null +++ b/browser/components/onionservices/content/authPreferences.inc.xhtml @@ -0,0 +1,19 @@ +# Copyright (c) 2020, The Tor Project, Inc. + +<groupbox id="torOnionServiceKeys" orient="vertical" + data-category="panePrivacy" hidden="true"> + <label><html:h2 id="torOnionServiceKeys-header"/></label> + <hbox> + <description id="torOnionServiceKeys-overview-container" flex="1"> + <html:span id="torOnionServiceKeys-overview" + class="tail-with-learn-more"/> + <label id="torOnionServiceKeys-learnMore" class="learnMore text-link" + is="text-link"/> + </description> + <vbox align="end"> + <button id="torOnionServiceKeys-savedKeys" + is="highlightable-button" + class="accessory-button"/> + </vbox> + </hbox> +</groupbox> diff --git a/browser/components/onionservices/content/authPreferences.js b/browser/components/onionservices/content/authPreferences.js new file mode 100644 index 000000000000..52f8272020cc --- /dev/null +++ b/browser/components/onionservices/content/authPreferences.js @@ -0,0 +1,66 @@ +// Copyright (c) 2020, The Tor Project, Inc. + +"use strict"; + +ChromeUtils.defineModuleGetter( + this, + "TorStrings", + "resource:///modules/TorStrings.jsm" +); + +/* + Onion Services Client Authentication Preferences Code + + Code to handle init and update of onion services authentication section + in about:preferences#privacy +*/ + +const OnionServicesAuthPreferences = { + selector: { + groupBox: "#torOnionServiceKeys", + header: "#torOnionServiceKeys-header", + overview: "#torOnionServiceKeys-overview", + learnMore: "#torOnionServiceKeys-learnMore", + savedKeysButton: "#torOnionServiceKeys-savedKeys", + }, + + init() { + // populate XUL with localized strings + this._populateXUL(); + }, + + _populateXUL() { + const groupbox = document.querySelector(this.selector.groupBox); + + let elem = groupbox.querySelector(this.selector.header); + elem.textContent = TorStrings.onionServices.authPreferences.header; + + elem = groupbox.querySelector(this.selector.overview); + elem.textContent = TorStrings.onionServices.authPreferences.overview; + + elem = groupbox.querySelector(this.selector.learnMore); + elem.setAttribute("value", TorStrings.onionServices.learnMore); + elem.setAttribute("href", TorStrings.onionServices.learnMoreURL); + + elem = groupbox.querySelector(this.selector.savedKeysButton); + elem.setAttribute( + "label", + TorStrings.onionServices.authPreferences.savedKeys + ); + elem.addEventListener("command", () => + OnionServicesAuthPreferences.onViewSavedKeys() + ); + }, + + onViewSavedKeys() { + gSubDialog.open( + "chrome://browser/content/onionservices/savedKeysDialog.xhtml" + ); + }, +}; // OnionServicesAuthPreferences + +Object.defineProperty(this, "OnionServicesAuthPreferences", { + value: OnionServicesAuthPreferences, + enumerable: true, + writable: false, +}); diff --git a/browser/components/onionservices/content/authPrompt.js b/browser/components/onionservices/content/authPrompt.js new file mode 100644 index 000000000000..d4a59ac46487 --- /dev/null +++ b/browser/components/onionservices/content/authPrompt.js @@ -0,0 +1,316 @@ +// Copyright (c) 2020, The Tor Project, Inc. + +"use strict"; + +XPCOMUtils.defineLazyModuleGetters(this, { + OnionAuthUtil: "chrome://browser/content/onionservices/authUtil.jsm", + CommonUtils: "resource://services-common/utils.js", + TorStrings: "resource:///modules/TorStrings.jsm", +}); + +const OnionAuthPrompt = (function() { + // OnionServicesAuthPrompt objects run within the main/chrome process. + // aReason is the topic passed within the observer notification that is + // causing this auth prompt to be displayed. + function OnionServicesAuthPrompt(aBrowser, aFailedURI, aReason, aOnionName) { + this._browser = aBrowser; + this._failedURI = aFailedURI; + this._reasonForPrompt = aReason; + this._onionName = aOnionName; + } + + OnionServicesAuthPrompt.prototype = { + show(aWarningMessage) { + let mainAction = { + label: TorStrings.onionServices.authPrompt.done, + accessKey: TorStrings.onionServices.authPrompt.doneAccessKey, + leaveOpen: true, // Callback is responsible for closing the notification. + callback: this._onDone.bind(this), + }; + + let dialogBundle = Services.strings.createBundle( + "chrome://global/locale/dialog.properties"); + + let cancelAccessKey = dialogBundle.GetStringFromName("accesskey-cancel"); + if (!cancelAccessKey) + cancelAccessKey = "c"; // required by PopupNotifications.show() + + let cancelAction = { + label: dialogBundle.GetStringFromName("button-cancel"), + accessKey: cancelAccessKey, + callback: this._onCancel.bind(this), + }; + + let _this = this; + let options = { + autofocus: true, + hideClose: true, + persistent: true, + removeOnDismissal: false, + eventCallback(aTopic) { + if (aTopic === "showing") { + _this._onPromptShowing(aWarningMessage); + } else if (aTopic === "shown") { + _this._onPromptShown(); + } else if (aTopic === "removed") { + _this._onPromptRemoved(); + } + } + }; + + this._prompt = PopupNotifications.show(this._browser, + OnionAuthUtil.domid.notification, "", + OnionAuthUtil.domid.anchor, + mainAction, [cancelAction], options); + }, + + _onPromptShowing(aWarningMessage) { + let xulDoc = this._browser.ownerDocument; + let descElem = xulDoc.getElementById(OnionAuthUtil.domid.description); + if (descElem) { + // Handle replacement of the onion name within the localized + // string ourselves so we can show the onion name as bold text. + // We do this by splitting the localized string and creating + // several HTML <span> elements. + while (descElem.firstChild) + descElem.removeChild(descElem.firstChild); + + let fmtString = TorStrings.onionServices.authPrompt.description; + let prefix = ""; + let suffix = ""; + const kToReplace = "%S"; + let idx = fmtString.indexOf(kToReplace); + if (idx < 0) { + prefix = fmtString; + } else { + prefix = fmtString.substring(0, idx); + suffix = fmtString.substring(idx + kToReplace.length); + } + + const kHTMLNS = "http://www.w3.org/1999/xhtml"; + let span = xulDoc.createElementNS(kHTMLNS, "span"); + span.textContent = prefix; + descElem.appendChild(span); + span = xulDoc.createElementNS(kHTMLNS, "span"); + span.id = OnionAuthUtil.domid.onionNameSpan; + span.textContent = this._onionName; + descElem.appendChild(span); + span = xulDoc.createElementNS(kHTMLNS, "span"); + span.textContent = suffix; + descElem.appendChild(span); + } + + // Set "Learn More" label and href. + let learnMoreElem = xulDoc.getElementById(OnionAuthUtil.domid.learnMore); + if (learnMoreElem) { + learnMoreElem.setAttribute("value", TorStrings.onionServices.learnMore); + learnMoreElem.setAttribute("href", TorStrings.onionServices.learnMoreURL); + } + + this._showWarning(aWarningMessage); + let checkboxElem = this._getCheckboxElement(); + if (checkboxElem) { + checkboxElem.checked = false; + } + }, + + _onPromptShown() { + let keyElem = this._getKeyElement(); + if (keyElem) { + keyElem.setAttribute("placeholder", + TorStrings.onionServices.authPrompt.keyPlaceholder); + this._boundOnKeyFieldKeyPress = this._onKeyFieldKeyPress.bind(this); + this._boundOnKeyFieldInput = this._onKeyFieldInput.bind(this); + keyElem.addEventListener("keypress", this._boundOnKeyFieldKeyPress); + keyElem.addEventListener("input", this._boundOnKeyFieldInput); + keyElem.focus(); + } + }, + + _onPromptRemoved() { + if (this._boundOnKeyFieldKeyPress) { + let keyElem = this._getKeyElement(); + if (keyElem) { + keyElem.value = ""; + keyElem.removeEventListener("keypress", + this._boundOnKeyFieldKeyPress); + this._boundOnKeyFieldKeyPress = undefined; + keyElem.removeEventListener("input", this._boundOnKeyFieldInput); + this._boundOnKeyFieldInput = undefined; + } + } + }, + + _onKeyFieldKeyPress(aEvent) { + if (aEvent.keyCode == aEvent.DOM_VK_RETURN) { + this._onDone(); + } else if (aEvent.keyCode == aEvent.DOM_VK_ESCAPE) { + this._prompt.remove(); + this._onCancel(); + } + }, + + _onKeyFieldInput(aEvent) { + this._showWarning(undefined); // Remove the warning. + }, + + _onDone() { + let keyElem = this._getKeyElement(); + if (!keyElem) + return; + + let base64key = this._keyToBase64(keyElem.value); + if (!base64key) { + this._showWarning(TorStrings.onionServices.authPrompt.invalidKey); + return; + } + + this._prompt.remove(); + + // Use Torbutton's controller module to add the private key to Tor. + let controllerFailureMsg = + TorStrings.onionServices.authPrompt.failedToSetKey; + try { + let { controller } = + Cu.import("resource://torbutton/modules/tor-control-port.js", {}); + let torController = controller(aError => { + this.show(controllerFailureMsg); + }); + let onionAddr = this._onionName.toLowerCase().replace(/\.onion$/, ""); + let checkboxElem = this._getCheckboxElement(); + let isPermanent = (checkboxElem && checkboxElem.checked); + torController.onionAuthAdd(onionAddr, base64key, isPermanent) + .then(aResponse => { + // Success! Reload the page. + this._browser.sendMessageToActor( + "Browser:Reload", + {}, + "BrowserTab" + ); + }) + .catch(aError => { + if (aError.torMessage) + this.show(aError.torMessage); + else + this.show(controllerFailureMsg); + }); + } catch (e) { + this.show(controllerFailureMsg); + } + }, + + _onCancel() { + // Arrange for an error page to be displayed. + this._browser.messageManager.sendAsyncMessage( + OnionAuthUtil.message.authPromptCanceled, + {failedURI: this._failedURI.spec, + reasonForPrompt: this._reasonForPrompt}); + }, + + _getKeyElement() { + let xulDoc = this._browser.ownerDocument; + return xulDoc.getElementById(OnionAuthUtil.domid.keyElement); + }, + + _getCheckboxElement() { + let xulDoc = this._browser.ownerDocument; + return xulDoc.getElementById(OnionAuthUtil.domid.checkboxElement); + }, + + _showWarning(aWarningMessage) { + let xulDoc = this._browser.ownerDocument; + let warningElem = + xulDoc.getElementById(OnionAuthUtil.domid.warningElement); + let keyElem = this._getKeyElement(); + if (warningElem) { + if (aWarningMessage) { + warningElem.textContent = aWarningMessage; + warningElem.removeAttribute("hidden"); + if (keyElem) + keyElem.className = "invalid"; + } else { + warningElem.setAttribute("hidden", "true"); + if (keyElem) + keyElem.className = ""; + } + } + }, + + // Returns undefined if the key is the wrong length or format. + _keyToBase64(aKeyString) { + if (!aKeyString) + return undefined; + + let base64key; + if (aKeyString.length == 52) { + // The key is probably base32-encoded. Attempt to decode. + // Although base32 specifies uppercase letters, we accept lowercase + // as well because users may type in lowercase or copy a key out of + // a tor onion-auth file (which uses lowercase). + let rawKey; + try { + rawKey = CommonUtils.decodeBase32(aKeyString.toUpperCase()); + } catch (e) {} + + if (rawKey) try { + base64key = btoa(rawKey); + } catch (e) {} + } else if ((aKeyString.length == 44) && + /^[a-zA-Z0-9+/]*=*$/.test(aKeyString)) { + // The key appears to be a correctly formatted base64 value. If not, + // tor will return an error when we try to add the key via the + // control port. + base64key = aKeyString; + } + + return base64key; + }, + }; + + let retval = { + init() { + Services.obs.addObserver(this, OnionAuthUtil.topic.clientAuthMissing); + Services.obs.addObserver(this, OnionAuthUtil.topic.clientAuthIncorrect); + }, + + uninit() { + Services.obs.removeObserver(this, OnionAuthUtil.topic.clientAuthMissing); + Services.obs.removeObserver(this, OnionAuthUtil.topic.clientAuthIncorrect); + }, + + // aSubject is the DOM Window or browser where the prompt should be shown. + // aData contains the .onion name. + observe(aSubject, aTopic, aData) { + if ((aTopic != OnionAuthUtil.topic.clientAuthMissing) && + (aTopic != OnionAuthUtil.topic.clientAuthIncorrect)) { + return; + } + + let browser; + if (aSubject instanceof Ci.nsIDOMWindow) { + let contentWindow = aSubject.QueryInterface(Ci.nsIDOMWindow); + browser = contentWindow.docShell.chromeEventHandler; + } else { + browser = aSubject.QueryInterface(Ci.nsIBrowser); + } + + if (!gBrowser.browsers.some(aBrowser => aBrowser == browser)) { + return; // This window does not contain the subject browser; ignore. + } + + let failedURI = browser.currentURI; + let authPrompt = new OnionServicesAuthPrompt(browser, failedURI, + aTopic, aData); + authPrompt.show(undefined); + } + }; + + return retval; +})(); /* OnionAuthPrompt */ + + +Object.defineProperty(this, "OnionAuthPrompt", { + value: OnionAuthPrompt, + enumerable: true, + writable: false +}); diff --git a/browser/components/onionservices/content/authUtil.jsm b/browser/components/onionservices/content/authUtil.jsm new file mode 100644 index 000000000000..c9d83774da1f --- /dev/null +++ b/browser/components/onionservices/content/authUtil.jsm @@ -0,0 +1,47 @@ +// Copyright (c) 2020, The Tor Project, Inc. + +"use strict"; + +var EXPORTED_SYMBOLS = [ + "OnionAuthUtil", +]; + +var { Services } = ChromeUtils.import("resource://gre/modules/Services.jsm"); + +const OnionAuthUtil = { + topic: { + clientAuthMissing: "tor-onion-services-clientauth-missing", + clientAuthIncorrect: "tor-onion-services-clientauth-incorrect", + }, + message: { + authPromptCanceled: "Tor:OnionServicesAuthPromptCanceled", + }, + domid: { + anchor: "tor-clientauth-notification-icon", + notification: "tor-clientauth", + description: "tor-clientauth-notification-desc", + learnMore: "tor-clientauth-notification-learnmore", + onionNameSpan: "tor-clientauth-notification-onionname", + keyElement: "tor-clientauth-notification-key", + warningElement: "tor-clientauth-warning", + checkboxElement: "tor-clientauth-persistkey-checkbox", + }, + + addCancelMessageListener(aTabContent, aDocShell) { + aTabContent.addMessageListener(this.message.authPromptCanceled, + (aMessage) => { + // Upon cancellation of the client authentication prompt, display + // the appropriate error page. When calling the docShell + // displayLoadError() function, we pass undefined for the failed + // channel so that displayLoadError() can determine that it should + // not display the client authentication prompt a second time. + let failedURI = Services.io.newURI(aMessage.data.failedURI); + let reasonForPrompt = aMessage.data.reasonForPrompt; + let errorCode = + (reasonForPrompt === this.topic.clientAuthMissing) ? + Cr.NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH : + Cr.NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH; + aDocShell.displayLoadError(errorCode, failedURI, undefined, undefined); + }); + }, +}; diff --git a/browser/components/onionservices/content/netError/browser.svg b/browser/components/onionservices/content/netError/browser.svg new file mode 100644 index 000000000000..b4c433b37bbb --- /dev/null +++ b/browser/components/onionservices/content/netError/browser.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="72" height="65" viewBox="0 0 72 65"> + <path fill="context-fill" fill-opacity="context-fill-opacity" d="M0.0 0.0C0.0 0.0 0.0 65.0 0.0 65.0C0.0 65.0 72.0 65.0 72.0 65.0C72.0 65.0 72.0 0.0 72.0 0.0C72.0 0.0 52.9019692 0.0 52.9019692 0.0C52.9019692 0.0 0.0 0.0 0.0 0.0C0.0 0.0 0.0 0.0 0.0 0.0M65.0 58.0C65.0 58.0 6.0 58.0 6.0 58.0C6.0 58.0 6.0 25.0 6.0 25.0C6.0 25.0 65.0 25.0 65.0 25.0C65.0 25.0 65.0 58.0 65.0 58.0C65.0 58.0 65.0 58.0 65.0 58.0M6.0 10.0C6.0 10.0 10.0 10.0 10.0 10.0C10.0 10.0 10.0 14.0 10.0 14.0C10.0 14.0 6.0 14.0 6.0 14.0C6.0 14.0 6.0 10.0 6.0 10.0C6.0 10.0 6.0 10.0 6.0 10.0M14.0 10.0C14.0 10.0 18.0 10.0 18.0 10.0C18.0 10.0 18.0 14.0 18.0 14.0C18.0 14.0 14.0 14.0 14.0 14.0C14.0 14.0 14.0 10.0 14.0 10.0C14.0 10.0 14.0 10.0 14.0 10.0M22.0 10.0C22.0 10.0 26.0 10.0 26.0 10.0C26.0 10.0 26.0 14.0 26.0 14.0C26.0 14.0 22.0 14.0 22.0 14.0C22.0 14.0 22.0 10.0 22.0 10.0C22.0 10.0 22.0 10.0 22.0 10.0" /> +</svg> diff --git a/browser/components/onionservices/content/netError/network.svg b/browser/components/onionservices/content/netError/network.svg new file mode 100644 index 000000000000..808c53dedd09 --- /dev/null +++ b/browser/components/onionservices/content/netError/network.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="72" height="54" viewBox="0 0 72 54"> + <path fill="context-fill" fill-opacity="context-fill-opacity" d="M14.0487805 54.0C6.28990244 54.0 0.0 47.3306322 0.0 39.1034585C0.0 32.0105634 4.68716488 26.0867675 10.9481707 24.585103C10.6902 23.574652 10.5365854 22.5107596 10.5365854 21.4138156C10.5365854 14.7292347 15.6471278 9.3103384 21.9512195 9.3103384C24.8076351 9.3103384 27.4126741 10.4393194 29.4146341 12.2780088C32.1344254 5.0777841 38.77452 0.0 46.5365854 0.0C56.7201249 0.0 64.9756098 8.7536733 64.9756098 19.5517479C64.9756098 20.7691677 64.8471688 21.9453428 64.6463415 23.1013144C69.0576849 26.0679606 72.0 31.2693674 72.0 37.2413909C72.0 46.5256603 64.9510244 54.0 56.195122 54.0C56.195122 54.0 14.0487805 54.0 14.0487805 54.0C14.0487805 54.0 14.0487805 54.0 14.0487805 54.0" /> +</svg> diff --git a/browser/components/onionservices/content/netError/onionNetError.css b/browser/components/onionservices/content/netError/onionNetError.css new file mode 100644 index 000000000000..58117ab93223 --- /dev/null +++ b/browser/components/onionservices/content/netError/onionNetError.css @@ -0,0 +1,65 @@ +/* Copyright (c) 2020, The Tor Project, Inc. */ + +:root { + --grey-70: #38383d; +} + +#onionErrorDiagramContainer { + margin: 60px auto; + width: 460px; /* 3 columns @ 140px plus 2 column gaps @ 20px */ + display: grid; + grid-row-gap: 15px; + grid-column-gap: 20px; + grid-template-columns: 1fr 1fr 1fr; +} + +#onionErrorDiagramContainer > div { + margin: auto; + position: relative; /* needed to allow overlay of the ok or error icon */ +} + +.onionErrorImage { + width: 72px; + height: 72px; + background-position: center; + background-repeat: no-repeat; + -moz-context-properties: fill; + fill: var(--grey-70); +} + +#onionErrorBrowserImage { + background-image: url("browser.svg"); +} + +#onionErrorNetworkImage { + background-image: url("network.svg"); +} + +#onionErrorOnionSiteImage { + background-image: url("onionsite.svg"); +} + +/* rules to support overlay of the ok or error icon */ +.onionErrorImage[status]::after { + content: " "; + position: absolute; + left: -18px; + top: 18px; + width: 36px; + height: 36px; + -moz-context-properties: fill; + fill: var(--in-content-page-background); + background-color: var(--grey-70); + background-repeat: no-repeat; + background-position: center; + border: 3px solid var(--in-content-page-background); + border-radius: 50%; +} + +.onionErrorImage[status="ok"]::after { + background-image: url("chrome://global/skin/icons/check.svg"); +} + +.onionErrorImage[status="error"]::after { + background-image: url("chrome://browser/skin/stop.svg"); +} diff --git a/browser/components/onionservices/content/netError/onionNetError.js b/browser/components/onionservices/content/netError/onionNetError.js new file mode 100644 index 000000000000..8fabb3f38eb7 --- /dev/null +++ b/browser/components/onionservices/content/netError/onionNetError.js @@ -0,0 +1,244 @@ +// Copyright (c) 2020, The Tor Project, Inc. + +"use strict"; + +/* eslint-env mozilla/frame-script */ + +var OnionServicesAboutNetError = { + _selector: { + header: ".title-text", + longDesc: "#errorLongDesc", + learnMoreContainer: "#learnMoreContainer", + learnMoreLink: "#learnMoreLink", + contentContainer: "#errorLongContent", + tryAgainButtonContainer: "#netErrorButtonContainer", + }, + _status: { + ok: "ok", + error: "error", + }, + + _diagramInfoMap: undefined, + + // Public functions (called from outside this file). + // + // This initPage() function may need to be updated if the structure of + // browser/base/content/aboutNetError.xhtml changes. Specifically, it + // references the following elements: + // query string parameter e + // class title-text + // id errorLongDesc + // id learnMoreContainer + // id learnMoreLink + // id errorLongContent + initPage(aDoc) { + const searchParams = new URLSearchParams(aDoc.documentURI.split("?")[1]); + const err = searchParams.get("e"); + + const errPrefix = "onionServices."; + const errName = err.substring(errPrefix.length); + + this._strings = RPMGetTorStrings(); + + const stringsObj = this._strings[errName]; + if (!stringsObj) { + return; + } + + this._insertStylesheet(aDoc); + + const pageTitle = stringsObj.pageTitle; + const header = stringsObj.header; + const longDescription = stringsObj.longDescription; // optional + const learnMoreURL = stringsObj.learnMoreURL; + + if (pageTitle) { + aDoc.title = pageTitle; + } + + if (header) { + const headerElem = aDoc.querySelector(this._selector.header); + if (headerElem) { + headerElem.textContent = header; + } + } + + const ld = aDoc.querySelector(this._selector.longDesc); + if (ld) { + if (longDescription) { + const hexErr = this._hexErrorFromName(errName); + ld.textContent = longDescription.replace("%S", hexErr); + } else { + // This onion service error does not have a long description. Since + // it is set to a generic error string by the code in + // browser/base/content/aboutNetError.js, hide it here. + ld.style.display = "none"; + } + } + + if (learnMoreURL) { + const lmContainer = aDoc.querySelector(this._selector.learnMoreContainer); + if (lmContainer) { + lmContainer.style.display = "block"; + } + const lmLink = lmContainer.querySelector(this._selector.learnMoreLink); + if (lmLink) { + lmLink.setAttribute("href", learnMoreURL); + } + } + + // Remove the "Try Again" button if the user made a typo in the .onion + // address since it is not useful in that case. + if (errName === "badAddress") { + const tryAgainButton = aDoc.querySelector( + this._selector.tryAgainButtonContainer + ); + if (tryAgainButton) { + tryAgainButton.style.display = "none"; + } + } + + this._insertDiagram(aDoc, errName); + }, // initPage() + + _insertStylesheet(aDoc) { + const url = + "chrome://browser/content/onionservices/netError/onionNetError.css"; + let linkElem = aDoc.createElement("link"); + linkElem.rel = "stylesheet"; + linkElem.href = url; + linkElem.type = "text/css"; + aDoc.head.appendChild(linkElem); + }, + + _insertDiagram(aDoc, aErrorName) { + // The onion error diagram consists of a grid of div elements. + // The first row contains three images (Browser, Network, Onionsite) and + // the second row contains labels for the images that are in the first row. + // The _diagramInfoMap describes for each type of onion service error + // whether a small ok or error status icon is overlaid on top of the main + // Browser/Network/Onionsite images. + if (!this._diagramInfoMap) { + this._diagramInfoMap = new Map(); + this._diagramInfoMap.set("descNotFound", { + browser: this._status.ok, + network: this._status.ok, + onionSite: this._status.error, + }); + this._diagramInfoMap.set("descInvalid", { + browser: this._status.ok, + network: this._status.error, + }); + this._diagramInfoMap.set("introFailed", { + browser: this._status.ok, + network: this._status.error, + }); + this._diagramInfoMap.set("rendezvousFailed", { + browser: this._status.ok, + network: this._status.error, + }); + this._diagramInfoMap.set("clientAuthMissing", { + browser: this._status.error, + }); + this._diagramInfoMap.set("clientAuthIncorrect", { + browser: this._status.error, + }); + this._diagramInfoMap.set("badAddress", { + browser: this._status.error, + }); + this._diagramInfoMap.set("introTimedOut", { + browser: this._status.ok, + network: this._status.error, + }); + } + + const diagramInfo = this._diagramInfoMap.get(aErrorName); + + const container = this._createDiv(aDoc, "onionErrorDiagramContainer"); + const imageClass = "onionErrorImage"; + + const browserImage = this._createDiv( + aDoc, + "onionErrorBrowserImage", + imageClass, + container + ); + if (diagramInfo && diagramInfo.browser) { + browserImage.setAttribute("status", diagramInfo.browser); + } + + const networkImage = this._createDiv( + aDoc, + "onionErrorNetworkImage", + imageClass, + container + ); + if (diagramInfo && diagramInfo.network) { + networkImage.setAttribute("status", diagramInfo.network); + } + + const onionSiteImage = this._createDiv( + aDoc, + "onionErrorOnionSiteImage", + imageClass, + container + ); + if (diagramInfo && diagramInfo.onionSite) { + onionSiteImage.setAttribute("status", diagramInfo.onionSite); + } + + let labelDiv = this._createDiv(aDoc, undefined, undefined, container); + labelDiv.textContent = this._strings.errorPage.browser; + labelDiv = this._createDiv(aDoc, undefined, undefined, container); + labelDiv.textContent = this._strings.errorPage.network; + labelDiv = this._createDiv(aDoc, undefined, undefined, container); + labelDiv.textContent = this._strings.errorPage.onionSite; + + const contentContainer = aDoc.querySelector( + this._selector.contentContainer + ); + if (contentContainer) { + contentContainer.insertBefore(container, contentContainer.firstChild); + } + }, // _insertDiagram() + + _createDiv(aDoc, aID, aClass, aParentElem) { + const div = aDoc.createElement("div"); + if (aID) { + div.id = aID; + } + if (aClass) { + div.setAttribute("class", aClass); + } + if (aParentElem) { + aParentElem.appendChild(div); + } + + return div; + }, + + _hexErrorFromName(aErrorName) { + // We do not have access to the original Tor SOCKS error code here, so + // perform a reverse mapping from the error name. + switch (aErrorName) { + case "descNotFound": + return "0xF0"; + case "descInvalid": + return "0xF1"; + case "introFailed": + return "0xF2"; + case "rendezvousFailed": + return "0xF3"; + case "clientAuthMissing": + return "0xF4"; + case "clientAuthIncorrect": + return "0xF5"; + case "badAddress": + return "0xF6"; + case "introTimedOut": + return "0xF7"; + } + + return ""; + }, +}; diff --git a/browser/components/onionservices/content/netError/onionsite.svg b/browser/components/onionservices/content/netError/onionsite.svg new file mode 100644 index 000000000000..1f2777e6acc7 --- /dev/null +++ b/browser/components/onionservices/content/netError/onionsite.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="70" height="63" viewBox="0 0 70 63"> + <g fill="context-fill" fill-opacity="context-fill-opacity"> + <path d="M64.0 2.0C64.0 2.0 4.0 2.0 4.0 2.0C2.8954305 2.0 2.0 2.81148389 2.0 3.8125C2.0 3.8125 2.0 58.1875 2.0 58.1875C2.0 59.1885161 2.8954305 60.0 4.0 60.0C4.0 60.0 36.0 60.0 36.0 60.0C36.0 60.0 36.0 56.375 36.0 56.375C36.0 56.375 6.0 56.375 6.0 56.375C6.0 56.375 6.0 41.875 6.0 41.875C6.0 41.875 38.0 41.875 38.0 41.875C38.0 41.875 38.0 38.25 38.0 38.25C38.0 38.25 6.0 38.25 6.0 38.25C6.0 38.25 6.0 23.75 6.0 23.75C6.0 23.75 62.0 23.75 62.0 23.75C62.0 23.75 62.0 36.4375 62.0 36.4375C62.0 36.4375 66.0 36.4375 66.0 36.4375C66.0 36.4375 66.0 3.8125 66.0 3.8125C66.0 2.81148389 65.1045695 2.0 64.0 2.0C64.0 2.0 64.0 2.0 64.0 2.0M62.0 20.125C62.0 20.125 6.0 20.125 6.0 20.125C6.0 20.125 6.0 5.625 6.0 5.625C6.0 5.625 62.0 5.625 62.0 5.625C62.0 5.625 62.0 20.125 62.0 20.125C62.0 20.125 62.0 20.125 62.0 20.125" /> + <path d="M24.0 47.0C24.0 47.0 24.0 51.0 24.0 51.0C24.0 51.0 20.0 51.0 20.0 51.0C20.0 51.0 20.0 47.0 20.0 47.0C20.0 47.0 24.0 47.0 24.0 47.0C24.0 47.0 24.0 47.0 24.0 47.0M16.0 47.0C16.0 47.0 16.0 51.0 16.0 51.0C16.0 51.0 12.0 51.0 12.0 51.0C12.0 51.0 12.0 47.0 12.0 47.0C12.0 47.0 16.0 47.0 16.0 47.0C16.0 47.0 16.0 47.0 16.0 47.0M56.0 29.0C56.0 29.0 56.0 33.0 56.0 33.0C56.0 33.0 52.0 33.0 52.0 33.0C52.0 33.0 52.0 29.0 52.0 29.0C52.0 29.0 56.0 29.0 56.0 29.0C56.0 29.0 56.0 29.0 56.0 29.0M48.0 29.0C48.0 29.0 48.0 33.0 48.0 33.0C48.0 33.0 12.0 33.0 12.0 33.0C12.0 33.0 12.0 29.0 12.0 29.0C12.0 29.0 48.0 29.0 48.0 29.0C48.0 29.0 48.0 29.0 48.0 29.0M22.0 11.0C22.0 11.0 22.0 15.0 22.0 15.0C22.0 15.0 10.0 15.0 10.0 15.0C10.0 15.0 10.0 11.0 10.0 11.0C10.0 11.0 22.0 11.0 22.0 11.0C22.0 11.0 22.0 11.0 22.0 11.0M70.0 0.0C70.0 0.0 70.0 36.5 70.0 36.5C70.0 36.5 65.0 36.5 65.0 36.5C65.0 36.5 65.0 4.5 65.0 4.5C65.0 4.5 5.0 4.5 5.0 4.5C5.0 4.5 5.0 58.5 5.0 58.5C5.0 58.5 36.0 58.5 36.0 58.5C36.0 58 .5 36.0 63.0 36.0 63.0C36.0 63.0 0.0 63.0 0.0 63.0C0.0 63.0 0.0 0.0 0.0 0.0C0.0 0.0 70.0 0.0 70.0 0.0C70.0 0.0 70.0 0.0 70.0 0.0M32.0 47.0C32.0 47.0 32.0 51.0 32.0 51.0C32.0 51.0 28.0 51.0 28.0 51.0C28.0 51.0 28.0 47.0 28.0 47.0C28.0 47.0 32.0 47.0 32.0 47.0C32.0 47.0 32.0 47.0 32.0 47.0M54.0 11.0C54.0 11.0 54.0 15.0 54.0 15.0C54.0 15.0 50.0 15.0 50.0 15.0C50.0 15.0 50.0 11.0 50.0 11.0C50.0 11.0 54.0 11.0 54.0 11.0C54.0 11.0 54.0 11.0 54.0 11.0M46.0 11.0C46.0 11.0 46.0 15.0 46.0 15.0C46.0 15.0 42.0 15.0 42.0 15.0C42.0 15.0 42.0 11.0 42.0 11.0C42.0 11.0 46.0 11.0 46.0 11.0C46.0 11.0 46.0 11.0 46.0 11.0M38.0 11.0C38.0 11.0 38.0 15.0 38.0 15.0C38.0 15.0 34.0 15.0 34.0 15.0C34.0 15.0 34.0 11.0 34.0 11.0C34.0 11.0 38.0 11.0 38.0 11.0C38.0 11.0 38.0 11.0 38.0 11.0M30.0 11.0C30.0 11.0 30.0 15.0 30.0 15.0C30.0 15.0 26.0 15.0 26.0 15.0C26.0 15.0 26.0 11.0 26.0 11.0C26.0 11.0 30.0 11.0 30.0 11.0C30.0 11.0 30.0 11.0 30.0 11.0" /> + <path d="M61.0 46.0C61.0 46.0 59.0 46.0 59.0 46.0C59.0 46.0 59.0 40.0 59.0 40.0C59.0 38.8954305 58.1045695 38.0 57.0 38.0C57.0 38.0 49.0 38.0 49.0 38.0C47.8954305 38.0 47.0 38.8954305 47.0 40.0C47.0 40.0 47.0 46.0 47.0 46.0C47.0 46.0 45.0 46.0 45.0 46.0C43.8954305 46.0 43.0 46.8954305 43.0 48.0C43.0 48.0 43.0 60.0 43.0 60.0C43.0 61.1045695 43.8954305 62.0 45.0 62.0C45.0 62.0 61.0 62.0 61.0 62.0C62.1045695 62.0 63.0 61.1045695 63.0 60.0C63.0 60.0 63.0 48.0 63.0 48.0C63.0 46.8954305 62.1045695 46.0 61.0 46.0C61.0 46.0 61.0 46.0 61.0 46.0M51.0 42.0C51.0 42.0 55.0 42.0 55.0 42.0C55.0 42.0 55.0 46.0 55.0 46.0C55.0 46.0 51.0 46.0 51.0 46.0C51.0 46.0 51.0 42.0 51.0 42.0C51.0 42.0 51.0 42.0 51.0 42.0M59.0 58.0C59.0 58.0 47.0 58.0 47.0 58.0C47.0 58.0 47.0 50.0 47.0 50.0C47.0 50.0 59.0 50.0 59.0 50.0C59.0 50.0 59.0 58.0 59.0 58.0C59.0 58.0 59.0 58.0 59.0 58.0" /> + </g> +</svg> diff --git a/browser/components/onionservices/content/onionservices.css b/browser/components/onionservices/content/onionservices.css new file mode 100644 index 000000000000..e2621ec8266d --- /dev/null +++ b/browser/components/onionservices/content/onionservices.css @@ -0,0 +1,69 @@ +/* Copyright (c) 2020, The Tor Project, Inc. */ + +@namespace html url("http://www.w3.org/1999/xhtml"); + +html|*#tor-clientauth-notification-onionname { + font-weight: bold; +} + +html|*#tor-clientauth-notification-key { + box-sizing: border-box; + width: 100%; + margin-top: 15px; + padding: 6px; +} + +/* Start of rules adapted from + * browser/components/newtab/css/activity-stream-mac.css (linux and windows + * use the same rules). + */ +html|*#tor-clientauth-notification-key.invalid { + border: 1px solid #D70022; + box-shadow: 0 0 0 1px #D70022, 0 0 0 4px rgba(215, 0, 34, 0.3); +} + +html|*#tor-clientauth-warning { + display: inline-block; + animation: fade-up-tt 450ms; + background: #D70022; + border-radius: 2px; + color: #FFF; + inset-inline-start: 3px; + padding: 5px 12px; + position: relative; + top: 6px; + z-index: 1; +} + +html|*#tor-clientauth-warning[hidden] { + display: none; +} + +html|*#tor-clientauth-warning::before { + background: #D70022; + bottom: -8px; + content: '.'; + height: 16px; + inset-inline-start: 12px; + position: absolute; + text-indent: -999px; + top: -7px; + transform: rotate(45deg); + white-space: nowrap; + width: 16px; + z-index: -1; +} + +@keyframes fade-up-tt { + 0% { + opacity: 0; + transform: translateY(15px); + } + 100% { + opacity: 1; + transform: translateY(0); + } +} +/* End of rules adapted from + * browser/components/newtab/css/activity-stream-mac.css + */ diff --git a/browser/components/onionservices/content/savedKeysDialog.js b/browser/components/onionservices/content/savedKeysDialog.js new file mode 100644 index 000000000000..b1376bbabe85 --- /dev/null +++ b/browser/components/onionservices/content/savedKeysDialog.js @@ -0,0 +1,259 @@ +// Copyright (c) 2020, The Tor Project, Inc. + +"use strict"; + +ChromeUtils.defineModuleGetter( + this, + "TorStrings", + "resource:///modules/TorStrings.jsm" +); + +ChromeUtils.defineModuleGetter( + this, + "controller", + "resource://torbutton/modules/tor-control-port.js" +); + +var gOnionServicesSavedKeysDialog = { + selector: { + dialog: "#onionservices-savedkeys-dialog", + intro: "#onionservices-savedkeys-intro", + tree: "#onionservices-savedkeys-tree", + onionSiteCol: "#onionservices-savedkeys-siteCol", + onionKeyCol: "#onionservices-savedkeys-keyCol", + errorIcon: "#onionservices-savedkeys-errorIcon", + errorMessage: "#onionservices-savedkeys-errorMessage", + removeButton: "#onionservices-savedkeys-remove", + removeAllButton: "#onionservices-savedkeys-removeall", + }, + + _tree: undefined, + _isBusy: false, // true when loading data, deleting a key, etc. + + // Public functions (called from outside this file). + async deleteSelectedKeys() { + this._setBusyState(true); + + const indexesToDelete = []; + const count = this._tree.view.selection.getRangeCount(); + for (let i = 0; i < count; ++i) { + const minObj = {}; + const maxObj = {}; + this._tree.view.selection.getRangeAt(i, minObj, maxObj); + for (let idx = minObj.value; idx <= maxObj.value; ++idx) { + indexesToDelete.push(idx); + } + } + + if (indexesToDelete.length > 0) { + const controllerFailureMsg = + TorStrings.onionServices.authPreferences.failedToRemoveKey; + try { + const torController = controller(aError => { + this._showError(controllerFailureMsg); + }); + + // Remove in reverse index order to avoid issues caused by index changes. + for (let i = indexesToDelete.length - 1; i >= 0; --i) { + await this._deleteOneKey(torController, indexesToDelete[i]); + } + } catch (e) { + if (e.torMessage) { + this._showError(e.torMessage); + } else { + this._showError(controllerFailureMsg); + } + } + } + + this._setBusyState(false); + }, + + async deleteAllKeys() { + this._tree.view.selection.selectAll(); + await this.deleteSelectedKeys(); + }, + + updateButtonsState() { + const haveSelection = this._tree.view.selection.getRangeCount() > 0; + const dialog = document.querySelector(this.selector.dialog); + const removeSelectedBtn = dialog.querySelector(this.selector.removeButton); + removeSelectedBtn.disabled = this._isBusy || !haveSelection; + const removeAllBtn = dialog.querySelector(this.selector.removeAllButton); + removeAllBtn.disabled = this._isBusy || this.rowCount === 0; + }, + + // Private functions. + _onLoad() { + document.mozSubdialogReady = this._init(); + }, + + async _init() { + await this._populateXUL(); + + window.addEventListener("keypress", this._onWindowKeyPress.bind(this)); + + // We don't use await here because we want _loadSavedKeys() to run + // in the background and not block loading of this dialog. + this._loadSavedKeys(); + }, + + async _populateXUL() { + const dialog = document.querySelector(this.selector.dialog); + const authPrefStrings = TorStrings.onionServices.authPreferences; + dialog.setAttribute("title", authPrefStrings.dialogTitle); + + let elem = dialog.querySelector(this.selector.intro); + elem.textContent = authPrefStrings.dialogIntro; + + elem = dialog.querySelector(this.selector.onionSiteCol); + elem.setAttribute("label", authPrefStrings.onionSite); + + elem = dialog.querySelector(this.selector.onionKeyCol); + elem.setAttribute("label", authPrefStrings.onionKey); + + elem = dialog.querySelector(this.selector.removeButton); + elem.setAttribute("label", authPrefStrings.remove); + + elem = dialog.querySelector(this.selector.removeAllButton); + elem.setAttribute("label", authPrefStrings.removeAll); + + this._tree = dialog.querySelector(this.selector.tree); + }, + + async _loadSavedKeys() { + const controllerFailureMsg = + TorStrings.onionServices.authPreferences.failedToGetKeys; + this._setBusyState(true); + + try { + this._tree.view = this; + + const torController = controller(aError => { + this._showError(controllerFailureMsg); + }); + + const keyInfoList = await torController.onionAuthViewKeys(); + if (keyInfoList) { + // Filter out temporary keys. + this._keyInfoList = keyInfoList.filter(aKeyInfo => { + if (!aKeyInfo.Flags) { + return false; + } + + const flags = aKeyInfo.Flags.split(","); + return flags.includes("Permanent"); + }); + + // Sort by the .onion address. + this._keyInfoList.sort((aObj1, aObj2) => { + const hsAddr1 = aObj1.hsAddress.toLowerCase(); + const hsAddr2 = aObj2.hsAddress.toLowerCase(); + if (hsAddr1 < hsAddr2) { + return -1; + } + return hsAddr1 > hsAddr2 ? 1 : 0; + }); + } + + // Render the tree content. + this._tree.rowCountChanged(0, this.rowCount); + } catch (e) { + if (e.torMessage) { + this._showError(e.torMessage); + } else { + this._showError(controllerFailureMsg); + } + } + + this._setBusyState(false); + }, + + // This method may throw; callers should catch errors. + async _deleteOneKey(aTorController, aIndex) { + const keyInfoObj = this._keyInfoList[aIndex]; + await aTorController.onionAuthRemove(keyInfoObj.hsAddress); + this._tree.view.selection.clearRange(aIndex, aIndex); + this._keyInfoList.splice(aIndex, 1); + this._tree.rowCountChanged(aIndex + 1, -1); + }, + + _setBusyState(aIsBusy) { + this._isBusy = aIsBusy; + this.updateButtonsState(); + }, + + _onWindowKeyPress(event) { + if (event.keyCode === KeyEvent.DOM_VK_ESCAPE) { + window.close(); + } else if (event.keyCode === KeyEvent.DOM_VK_DELETE) { + this.deleteSelectedKeys(); + } + }, + + _showError(aMessage) { + const dialog = document.querySelector(this.selector.dialog); + const errorIcon = dialog.querySelector(this.selector.errorIcon); + errorIcon.style.visibility = aMessage ? "visible" : "hidden"; + const errorDesc = dialog.querySelector(this.selector.errorMessage); + errorDesc.textContent = aMessage ? aMessage : ""; + }, + + // XUL tree widget view implementation. + get rowCount() { + return this._keyInfoList ? this._keyInfoList.length : 0; + }, + + getCellText(aRow, aCol) { + let val = ""; + if (this._keyInfoList && aRow < this._keyInfoList.length) { + const keyInfo = this._keyInfoList[aRow]; + if (aCol.id.endsWith("-siteCol")) { + val = keyInfo.hsAddress; + } else if (aCol.id.endsWith("-keyCol")) { + val = keyInfo.typeAndKey; + // Omit keyType because it is always "x25519". + const idx = val.indexOf(":"); + if (idx > 0) { + val = val.substring(idx + 1); + } + } + } + + return val; + }, + + isSeparator(index) { + return false; + }, + + isSorted() { + return false; + }, + + isContainer(index) { + return false; + }, + + setTree(tree) {}, + + getImageSrc(row, column) {}, + + getCellValue(row, column) {}, + + cycleHeader(column) {}, + + getRowProperties(row) { + return ""; + }, + + getColumnProperties(column) { + return ""; + }, + + getCellProperties(row, column) { + return ""; + }, +}; + +window.addEventListener("load", () => gOnionServicesSavedKeysDialog._onLoad()); diff --git a/browser/components/onionservices/content/savedKeysDialog.xhtml b/browser/components/onionservices/content/savedKeysDialog.xhtml new file mode 100644 index 000000000000..3db9bb05ea82 --- /dev/null +++ b/browser/components/onionservices/content/savedKeysDialog.xhtml @@ -0,0 +1,42 @@ +<?xml version="1.0"?> + + +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> +<?xml-stylesheet href="chrome://browser/skin/preferences/preferences.css" type="text/css"?> +<?xml-stylesheet href="chrome://browser/content/onionservices/authPreferences.css" type="text/css"?> + +<window id="onionservices-savedkeys-dialog" + windowtype="OnionServices:SavedKeys" + xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + style="width: 45em;"> + + <script src="chrome://browser/content/onionservices/savedKeysDialog.js"/> + + <vbox id="onionservices-savedkeys" class="contentPane" flex="1"> + <label id="onionservices-savedkeys-intro" + control="onionservices-savedkeys-tree"/> + <separator class="thin"/> + <tree id="onionservices-savedkeys-tree" flex="1" hidecolumnpicker="true" + width="750" + style="height: 20em;" + onselect="gOnionServicesSavedKeysDialog.updateButtonsState();"> + <treecols> + <treecol id="onionservices-savedkeys-siteCol" flex="1" persist="width"/> + <splitter class="tree-splitter"/> + <treecol id="onionservices-savedkeys-keyCol" flex="1" persist="width"/> + </treecols> + <treechildren/> + </tree> + <hbox id="onionservices-savedkeys-errorContainer" align="baseline" flex="1"> + <image id="onionservices-savedkeys-errorIcon"/> + <description id="onionservices-savedkeys-errorMessage" flex="1"/> + </hbox> + <separator class="thin"/> + <hbox id="onionservices-savedkeys-buttons"> + <button id="onionservices-savedkeys-remove" disabled="true" + oncommand="gOnionServicesSavedKeysDialog.deleteSelectedKeys();"/> + <button id="onionservices-savedkeys-removeall" + oncommand="gOnionServicesSavedKeysDialog.deleteAllKeys();"/> + </hbox> + </vbox> +</window> diff --git a/browser/components/onionservices/jar.mn b/browser/components/onionservices/jar.mn new file mode 100644 index 000000000000..9d6ce88d1841 --- /dev/null +++ b/browser/components/onionservices/jar.mn @@ -0,0 +1,9 @@ +browser.jar: + content/browser/onionservices/authPreferences.css (content/authPreferences.css) + content/browser/onionservices/authPreferences.js (content/authPreferences.js) + content/browser/onionservices/authPrompt.js (content/authPrompt.js) + content/browser/onionservices/authUtil.jsm (content/authUtil.jsm) + content/browser/onionservices/netError/ (content/netError/*) + content/browser/onionservices/onionservices.css (content/onionservices.css) + content/browser/onionservices/savedKeysDialog.js (content/savedKeysDialog.js) + content/browser/onionservices/savedKeysDialog.xhtml (content/savedKeysDialog.xhtml) diff --git a/browser/components/onionservices/moz.build b/browser/components/onionservices/moz.build new file mode 100644 index 000000000000..7e103239c8d6 --- /dev/null +++ b/browser/components/onionservices/moz.build @@ -0,0 +1 @@ +JAR_MANIFESTS += ['jar.mn'] diff --git a/browser/components/preferences/preferences.xhtml b/browser/components/preferences/preferences.xhtml index 5e341331da49..2d01c5c8b775 100644 --- a/browser/components/preferences/preferences.xhtml +++ b/browser/components/preferences/preferences.xhtml @@ -12,6 +12,7 @@ <?xml-stylesheet href="chrome://browser/skin/preferences/search.css"?> <?xml-stylesheet href="chrome://browser/skin/preferences/containers.css"?> <?xml-stylesheet href="chrome://browser/skin/preferences/privacy.css"?> +<?xml-stylesheet href="chrome://browser/content/onionservices/authPreferences.css"?> <?xml-stylesheet href="chrome://browser/content/securitylevel/securityLevelPreferences.css"?> <?xml-stylesheet href="chrome://browser/content/torpreferences/torPreferences.css"?> diff --git a/browser/components/preferences/privacy.inc.xhtml b/browser/components/preferences/privacy.inc.xhtml index f36145ea80d4..eb7587afa0e1 100644 --- a/browser/components/preferences/privacy.inc.xhtml +++ b/browser/components/preferences/privacy.inc.xhtml @@ -477,6 +477,8 @@ <label id="fips-desc" hidden="true" data-l10n-id="forms-master-pw-fips-desc"></label> </groupbox> +#include ../onionservices/content/authPreferences.inc.xhtml +  <groupbox id="formAutofillGroupBox" diff --git a/browser/components/preferences/privacy.js b/browser/components/preferences/privacy.js index 23fcffe7b5eb..15957b416a67 100644 --- a/browser/components/preferences/privacy.js +++ b/browser/components/preferences/privacy.js @@ -77,6 +77,12 @@ XPCOMUtils.defineLazyGetter(this, "AlertsServiceDND", function() { } }); +XPCOMUtils.defineLazyScriptGetter( + this, + ["OnionServicesAuthPreferences"], + "chrome://browser/content/onionservices/authPreferences.js" +); + // TODO: module import via ChromeUtils.defineModuleGetter XPCOMUtils.defineLazyScriptGetter( this, @@ -434,6 +440,7 @@ var gPrivacyPane = { this.trackingProtectionReadPrefs(); this.networkCookieBehaviorReadPrefs(); this._initTrackingProtectionExtensionControl(); + OnionServicesAuthPreferences.init(); this._initSecurityLevel(); Services.telemetry.setEventRecordingEnabled("pwmgr", true); diff --git a/browser/themes/shared/notification-icons.inc.css b/browser/themes/shared/notification-icons.inc.css index f17ddae9dc79..979ae9482244 100644 --- a/browser/themes/shared/notification-icons.inc.css +++ b/browser/themes/shared/notification-icons.inc.css @@ -117,6 +117,9 @@ list-style-image: url(chrome://browser/skin/notification-icons/indexedDB.svg); } +/* Reuse Firefox's login (key) icon for the Tor onion services auth. prompt */ +.popup-notification-icon[popupid="tor-clientauth"], +.tor-clientauth-icon, .popup-notification-icon[popupid="password"], .login-icon { list-style-image: url(chrome://browser/skin/login.svg); diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp index 585749aeaf38..675ee0592847 100644 --- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -3538,6 +3538,7 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI, } } else { // Errors requiring simple formatting + bool isOnionAuthError = false; switch (aError) { case NS_ERROR_MALFORMED_URI: // URI is malformed @@ -3620,10 +3621,44 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI, // HTTP/2 or HTTP/3 stack detected a protocol error error = "networkProtocolError"; break; - + case NS_ERROR_TOR_ONION_SVC_NOT_FOUND: + error = "onionServices.descNotFound"; + break; + case NS_ERROR_TOR_ONION_SVC_IS_INVALID: + error = "onionServices.descInvalid"; + break; + case NS_ERROR_TOR_ONION_SVC_INTRO_FAILED: + error = "onionServices.introFailed"; + break; + case NS_ERROR_TOR_ONION_SVC_REND_FAILED: + error = "onionServices.rendezvousFailed"; + break; + case NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH: + error = "onionServices.clientAuthMissing"; + isOnionAuthError = true; + break; + case NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH: + error = "onionServices.clientAuthIncorrect"; + isOnionAuthError = true; + break; + case NS_ERROR_TOR_ONION_SVC_BAD_ADDRESS: + error = "onionServices.badAddress"; + break; + case NS_ERROR_TOR_ONION_SVC_INTRO_TIMEDOUT: + error = "onionServices.introTimedOut"; + break; default: break; } + + // The presence of aFailedChannel indicates that we arrived here due to a + // failed connection attempt. Note that we will arrive here a second time + // if the user cancels the Tor client auth prompt, but in that case we + // will not have a failed channel and therefore we will not prompt again. + if (isOnionAuthError && aFailedChannel) { + // Display about:blank while the Tor client auth prompt is open. + errorPage.AssignLiteral("blank"); + } } // If the HTTPS-Only Mode upgraded this request and the upgrade might have @@ -3712,6 +3747,20 @@ nsDocShell::DisplayLoadError(nsresult aError, nsIURI* aURI, nsAutoString str; rv = stringBundle->FormatStringFromName(errorDescriptionID, formatStrs, str); + if (NS_FAILED(rv)) { + // As a fallback, check torbutton.properties for the error string. + const char bundleURL[] = "chrome://torbutton/locale/torbutton.properties"; + nsCOMPtr<nsIStringBundleService> stringBundleService = + mozilla::services::GetStringBundleService(); + if (stringBundleService) { + nsCOMPtr<nsIStringBundle> tbStringBundle; + if (NS_SUCCEEDED(stringBundleService->CreateBundle( + bundleURL, getter_AddRefs(tbStringBundle)))) { + rv = tbStringBundle->FormatStringFromName(errorDescriptionID, + formatStrs, str); + } + } + } NS_ENSURE_SUCCESS(rv, rv); messageStr.Assign(str); } @@ -6191,6 +6240,7 @@ nsresult nsDocShell::EndPageLoad(nsIWebProgress* aProgress, aStatus == NS_ERROR_NET_INADEQUATE_SECURITY || aStatus == NS_ERROR_NET_HTTP2_SENT_GOAWAY || aStatus == NS_ERROR_NET_HTTP3_PROTOCOL_ERROR || + NS_ERROR_GET_MODULE(aStatus) == NS_ERROR_MODULE_TOR || NS_ERROR_GET_MODULE(aStatus) == NS_ERROR_MODULE_SECURITY) { // Errors to be shown for any frame DisplayLoadError(aStatus, url, nullptr, aChannel); @@ -7748,6 +7798,35 @@ nsresult nsDocShell::CreateContentViewer(const nsACString& aContentType, FireOnLocationChange(this, aRequest, mCurrentURI, locationFlags); } + // Arrange to show a Tor onion service client authentication prompt if + // appropriate. + if ((mLoadType == LOAD_ERROR_PAGE) && failedChannel) { + nsresult status = NS_OK; + if (NS_SUCCEEDED(failedChannel->GetStatus(&status)) && + ((status == NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH) || + (status == NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH))) { + nsAutoCString onionHost; + failedURI->GetHost(onionHost); + const char* topic = (status == NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH) + ? "tor-onion-services-clientauth-missing" + : "tor-onion-services-clientauth-incorrect"; + if (XRE_IsContentProcess()) { + nsCOMPtr<nsIBrowserChild> browserChild = GetBrowserChild(); + if (browserChild) { + static_cast<BrowserChild*>(browserChild.get()) + ->SendShowOnionServicesAuthPrompt(onionHost, nsCString(topic)); + } + } else { + nsCOMPtr<nsPIDOMWindowOuter> browserWin = GetWindow(); + nsCOMPtr<nsIObserverService> obsSvc = services::GetObserverService(); + if (browserWin && obsSvc) { + obsSvc->NotifyObservers(browserWin, topic, + NS_ConvertUTF8toUTF16(onionHost).get()); + } + } + } + } + return NS_OK; } diff --git a/dom/ipc/BrowserParent.cpp b/dom/ipc/BrowserParent.cpp index dfd15c1fd17b..7749792cafb4 100644 --- a/dom/ipc/BrowserParent.cpp +++ b/dom/ipc/BrowserParent.cpp @@ -3941,6 +3941,27 @@ mozilla::ipc::IPCResult BrowserParent::RecvShowCanvasPermissionPrompt( return IPC_OK(); } +mozilla::ipc::IPCResult BrowserParent::RecvShowOnionServicesAuthPrompt( + const nsCString& aOnionName, const nsCString& aTopic) { + nsCOMPtr<nsIBrowser> browser = + mFrameElement ? mFrameElement->AsBrowser() : nullptr; + if (!browser) { + // If the tab is being closed, the browser may not be available. + // In this case we can ignore the request. + return IPC_OK(); + } + nsCOMPtr<nsIObserverService> os = services::GetObserverService(); + if (!os) { + return IPC_FAIL_NO_REASON(this); + } + nsresult rv = os->NotifyObservers(browser, aTopic.get(), + NS_ConvertUTF8toUTF16(aOnionName).get()); + if (NS_FAILED(rv)) { + return IPC_FAIL_NO_REASON(this); + } + return IPC_OK(); +} + mozilla::ipc::IPCResult BrowserParent::RecvVisitURI(nsIURI* aURI, nsIURI* aLastVisitedURI, const uint32_t& aFlags) { diff --git a/dom/ipc/BrowserParent.h b/dom/ipc/BrowserParent.h index 66509194edba..816945504b6c 100644 --- a/dom/ipc/BrowserParent.h +++ b/dom/ipc/BrowserParent.h @@ -763,6 +763,9 @@ class BrowserParent final : public PBrowserParent, mozilla::ipc::IPCResult RecvShowCanvasPermissionPrompt( const nsCString& aOrigin, const bool& aHideDoorHanger); + mozilla::ipc::IPCResult RecvShowOnionServicesAuthPrompt( + const nsCString& aOnionName, const nsCString& aTopic); + mozilla::ipc::IPCResult RecvSetSystemFont(const nsCString& aFontName); mozilla::ipc::IPCResult RecvGetSystemFont(nsCString* aFontName); diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl index ed31b32a4eb2..f36e2c6db353 100644 --- a/dom/ipc/PBrowser.ipdl +++ b/dom/ipc/PBrowser.ipdl @@ -592,6 +592,15 @@ parent: bool aNeedCollectSHistory, uint32_t aFlushId, bool aIsFinal, uint32_t aEpoch); + /** + * This function is used to notify the parent that it should display a + * onion services client authentication prompt. + * + * @param aOnionHost The hostname of the .onion that needs authentication. + * @param aTopic The reason for the prompt. + */ + async ShowOnionServicesAuthPrompt(nsCString aOnionHost, nsCString aTopic); + child: async NativeSynthesisResponse(uint64_t aObserverId, nsCString aResponse); async FlushTabState(uint32_t aFlushId, bool aIsFinal); diff --git a/js/xpconnect/src/xpc.msg b/js/xpconnect/src/xpc.msg index d884c6a85999..31e5e75ba35c 100644 --- a/js/xpconnect/src/xpc.msg +++ b/js/xpconnect/src/xpc.msg @@ -253,5 +253,15 @@ XPC_MSG_DEF(NS_ERROR_FINGERPRINTING_URI , "The URI is fingerprinti XPC_MSG_DEF(NS_ERROR_CRYPTOMINING_URI , "The URI is cryptomining") XPC_MSG_DEF(NS_ERROR_SOCIALTRACKING_URI , "The URI is social tracking") +/* Codes related to Tor */ +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_NOT_FOUND , "Tor onion service descriptor cannot be found") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_IS_INVALID , "Tor onion service descriptor is invalid") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_INTRO_FAILED , "Tor onion service introduction failed") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_REND_FAILED , "Tor onion service rendezvous failed") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH, "Tor onion service missing client authorization") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH , "Tor onion service wrong client authorization") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_BAD_ADDRESS , "Tor onion service bad address") +XPC_MSG_DEF(NS_ERROR_TOR_ONION_SVC_INTRO_TIMEDOUT , "Tor onion service introduction timed out") + /* Profile manager error codes */ XPC_MSG_DEF(NS_ERROR_DATABASE_CHANGED , "Flushing the profiles to disk would have overwritten changes made elsewhere.") diff --git a/netwerk/base/nsSocketTransport2.cpp b/netwerk/base/nsSocketTransport2.cpp index 7256280697c8..ce739e1f0de8 100644 --- a/netwerk/base/nsSocketTransport2.cpp +++ b/netwerk/base/nsSocketTransport2.cpp @@ -215,6 +215,12 @@ nsresult ErrorAccordingToNSPR(PRErrorCode errorCode) { default: if (psm::IsNSSErrorCode(errorCode)) { rv = psm::GetXPCOMFromNSSError(errorCode); + } else { + // If we received a Tor extended error code via SOCKS, pass it through. + nsresult res = nsresult(errorCode); + if (NS_ERROR_GET_MODULE(res) == NS_ERROR_MODULE_TOR) { + rv = res; + } } break; diff --git a/netwerk/socket/nsSOCKSIOLayer.cpp b/netwerk/socket/nsSOCKSIOLayer.cpp index 6f2743ed5c71..57af13a7c026 100644 --- a/netwerk/socket/nsSOCKSIOLayer.cpp +++ b/netwerk/socket/nsSOCKSIOLayer.cpp @@ -1004,6 +1004,55 @@ PRStatus nsSOCKSSocketInfo::ReadV5ConnectResponseTop() { "08, Address type not supported.")); c = PR_BAD_ADDRESS_ERROR; break; + case 0xF0: // Tor SOCKS5_HS_NOT_FOUND + LOGERROR( + ("socks5: connect failed: F0," + " Tor onion service descriptor can not be found.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_NOT_FOUND); + break; + case 0xF1: // Tor SOCKS5_HS_IS_INVALID + LOGERROR( + ("socks5: connect failed: F1," + " Tor onion service descriptor is invalid.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_IS_INVALID); + break; + case 0xF2: // Tor SOCKS5_HS_INTRO_FAILED + LOGERROR( + ("socks5: connect failed: F2," + " Tor onion service introduction failed.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_INTRO_FAILED); + break; + case 0xF3: // Tor SOCKS5_HS_REND_FAILED + LOGERROR( + ("socks5: connect failed: F3," + " Tor onion service rendezvous failed.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_REND_FAILED); + break; + case 0xF4: // Tor SOCKS5_HS_MISSING_CLIENT_AUTH + LOGERROR( + ("socks5: connect failed: F4," + " Tor onion service missing client authorization.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH); + break; + case 0xF5: // Tor SOCKS5_HS_BAD_CLIENT_AUTH + LOGERROR( + ("socks5: connect failed: F5," + " Tor onion service wrong client authorization.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH); + break; + case 0xF6: // Tor SOCKS5_HS_BAD_ADDRESS + LOGERROR( + ("socks5: connect failed: F6," + " Tor onion service bad address.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_BAD_ADDRESS); + break; + case 0xF7: // Tor SOCKS5_HS_INTRO_TIMEDOUT + LOGERROR( + ("socks5: connect failed: F7," + " Tor onion service introduction timed out.")); + c = static_cast<uint32_t>(NS_ERROR_TOR_ONION_SVC_INTRO_TIMEDOUT); + break; + default: LOGERROR(("socks5: connect failed.")); break; diff --git a/toolkit/modules/PopupNotifications.jsm b/toolkit/modules/PopupNotifications.jsm index d31f91ab00a5..6886c0b13c5d 100644 --- a/toolkit/modules/PopupNotifications.jsm +++ b/toolkit/modules/PopupNotifications.jsm @@ -406,6 +406,8 @@ PopupNotifications.prototype = { * will be dismissed instead of removed after running the callback. * - [optional] disabled (boolean): If this is true, the button * will be disabled. + * - [optional] leaveOpen (boolean): If this is true, the notification + * will not be removed after running the callback. * - [optional] disableHighlight (boolean): If this is true, the button * will not apply the default highlight style. * If null, the notification will have a default "OK" action button @@ -1884,6 +1886,10 @@ PopupNotifications.prototype = { this._dismiss(); return; } + + if (action.leaveOpen) { + return; + } } this._remove(notification); diff --git a/toolkit/modules/RemotePageAccessManager.jsm b/toolkit/modules/RemotePageAccessManager.jsm index 9734324cbd5f..eceaa7c857de 100644 --- a/toolkit/modules/RemotePageAccessManager.jsm +++ b/toolkit/modules/RemotePageAccessManager.jsm @@ -95,6 +95,7 @@ let RemotePageAccessManager = { ], RPMPrefIsLocked: ["security.tls.version.min"], RPMAddToHistogram: ["*"], + RPMGetTorStrings: ["*"], }, "about:newinstall": { RPMGetUpdateChannel: ["*"], diff --git a/tools/lint/eslint/eslint-plugin-mozilla/lib/environments/frame-script.js b/tools/lint/eslint/eslint-plugin-mozilla/lib/environments/frame-script.js index 28f5d864b0bd..cd0d6d4d3656 100644 --- a/tools/lint/eslint/eslint-plugin-mozilla/lib/environments/frame-script.js +++ b/tools/lint/eslint/eslint-plugin-mozilla/lib/environments/frame-script.js @@ -37,5 +37,6 @@ module.exports = { RPMRecordTelemetryEvent: false, RPMAddToHistogram: false, RPMRemoveMessageListener: false, + RPMGetTorStrings: false, }, }; diff --git a/xpcom/base/ErrorList.py b/xpcom/base/ErrorList.py index 6b1a05a91b31..5f35cf7771f9 100755 --- a/xpcom/base/ErrorList.py +++ b/xpcom/base/ErrorList.py @@ -85,6 +85,7 @@ modules["URL_CLASSIFIER"] = Mod(42) # ErrorResult gets its own module to reduce the chance of someone accidentally # defining an error code matching one of the ErrorResult ones. modules["ERRORRESULT"] = Mod(43) +modules["TOR"] = Mod(44) # NS_ERROR_MODULE_GENERAL should be used by modules that do not # care if return code values overlap. Callers of methods that @@ -1179,6 +1180,27 @@ with modules["ERRORRESULT"]: errors["NS_ERROR_INTERNAL_ERRORRESULT_RANGEERROR"] = FAILURE(5) +# ======================================================================= +# 44: Tor-specific error codes. +# ======================================================================= +with modules["TOR"]: + # Tor onion service descriptor can not be found. + errors["NS_ERROR_TOR_ONION_SVC_NOT_FOUND"] = FAILURE(1) + # Tor onion service descriptor is invalid. + errors["NS_ERROR_TOR_ONION_SVC_IS_INVALID"] = FAILURE(2) + # Tor onion service introduction failed. + errors["NS_ERROR_TOR_ONION_SVC_INTRO_FAILED"] = FAILURE(3) + # Tor onion service rendezvous failed. + errors["NS_ERROR_TOR_ONION_SVC_REND_FAILED"] = FAILURE(4) + # Tor onion service missing client authorization. + errors["NS_ERROR_TOR_ONION_SVC_MISSING_CLIENT_AUTH"] = FAILURE(5) + # Tor onion service wrong client authorization. + errors["NS_ERROR_TOR_ONION_SVC_BAD_CLIENT_AUTH"] = FAILURE(6) + # Tor onion service bad address. + errors["NS_ERROR_TOR_ONION_SVC_BAD_ADDRESS"] = FAILURE(7) + # Tor onion service introduction timed out. + errors["NS_ERROR_TOR_ONION_SVC_INTRO_TIMEDOUT"] = FAILURE(8) + # ======================================================================= # 51: NS_ERROR_MODULE_GENERAL # =======================================================================

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 32220: Improve the letterboxing experience
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit acaa1dcec496cf3b69f3cc47af9909bdf4f20851 Author: Richard Pospesel <richard(a)torproject.org> Date: Mon Oct 28 17:42:17 2019 -0700 Bug 32220: Improve the letterboxing experience CSS and JS changes to alter the UX surrounding letterboxing. The browser element containing page content is now anchored to the bottom of the toolbar, and the remaining letterbox margin is the same color as the firefox chrome. The letterbox margin and border are tied to the currently selected theme. Also adds a 'needsLetterbox' property to tabbrowser.xml to fix a race condition present when using the 'isEmpty' property. Using 'isEmpty' as a proxy for 'needsLetterbox' resulted in over-zealous/unnecessary letterboxing of about:blank tabs. --- browser/base/content/browser.css | 8 ++ browser/base/content/tabbrowser-tab.js | 9 +++ browser/themes/shared/tabs.inc.css | 6 ++ .../components/resistfingerprinting/RFPHelper.jsm | 94 +++++++++++++++++++--- 4 files changed, 105 insertions(+), 12 deletions(-) diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css index 808c03e88223..a0b1bf4a8951 100644 --- a/browser/base/content/browser.css +++ b/browser/base/content/browser.css @@ -85,6 +85,14 @@ body { display: none; } + +.browserStack > browser.letterboxing { + border-color: var(--chrome-content-separator-color); + border-style: solid; + border-width : 1px; + border-top: none; +} + %ifdef MENUBAR_CAN_AUTOHIDE #toolbar-menubar[autohide="true"] { overflow: hidden; diff --git a/browser/base/content/tabbrowser-tab.js b/browser/base/content/tabbrowser-tab.js index 183eff1bab86..7f376ab1d122 100644 --- a/browser/base/content/tabbrowser-tab.js +++ b/browser/base/content/tabbrowser-tab.js @@ -225,6 +225,15 @@ return true; } + get needsLetterbox() { + let browser = this.linkedBrowser; + if (isBlankPageURL(browser.currentURI.spec)) { + return false; + } + + return true; + } + get lastAccessed() { return this._lastAccessed == Infinity ? Date.now() : this._lastAccessed; } diff --git a/browser/themes/shared/tabs.inc.css b/browser/themes/shared/tabs.inc.css index b47842af766c..019da6ecf76f 100644 --- a/browser/themes/shared/tabs.inc.css +++ b/browser/themes/shared/tabs.inc.css @@ -33,6 +33,12 @@ background-color: #f9f9fa; } +/* extend down the toolbar's colors when letterboxing is enabled*/ +#tabbrowser-tabpanels.letterboxing { + background-color: var(--toolbar-bgcolor); + background-image: var(--toolbar-bgimage); +} + :root[privatebrowsingmode=temporary] #tabbrowser-tabpanels { /* Value for --in-content-page-background in aboutPrivateBrowsing.css */ background-color: #25003e; diff --git a/toolkit/components/resistfingerprinting/RFPHelper.jsm b/toolkit/components/resistfingerprinting/RFPHelper.jsm index 49010d1c8cb1..b906a067fd63 100644 --- a/toolkit/components/resistfingerprinting/RFPHelper.jsm +++ b/toolkit/components/resistfingerprinting/RFPHelper.jsm @@ -40,6 +40,7 @@ class _RFPHelper { // ============================================================================ constructor() { this._initialized = false; + this._borderDimensions = null; } init() { @@ -361,6 +362,24 @@ class _RFPHelper { }); } + getBorderDimensions(aBrowser) { + if (this._borderDimensions) { + return this._borderDimensions; + } + + const win = aBrowser.ownerGlobal; + const browserStyle = win.getComputedStyle(aBrowser); + + this._borderDimensions = { + top : parseInt(browserStyle.borderTopWidth), + right: parseInt(browserStyle.borderRightWidth), + bottom : parseInt(browserStyle.borderBottomWidth), + left : parseInt(browserStyle.borderLeftWidth), + }; + + return this._borderDimensions; + } + _addOrClearContentMargin(aBrowser) { let tab = aBrowser.getTabBrowser().getTabForBrowser(aBrowser); @@ -369,9 +388,13 @@ class _RFPHelper { return; } + // we add the letterboxing class even if the content does not need letterboxing + // in which case margins are set such that the borders are hidden + aBrowser.classList.add("letterboxing"); + // We should apply no margin around an empty tab or a tab with system // principal. - if (tab.isEmpty || aBrowser.contentPrincipal.isSystemPrincipal) { + if (!tab.needsLetterbox || aBrowser.contentPrincipal.isSystemPrincipal) { this._clearContentViewMargin(aBrowser); } else { this._roundContentView(aBrowser); @@ -539,10 +562,29 @@ class _RFPHelper { // Calculating the margins around the browser element in order to round the // content viewport. We will use a 200x100 stepping if the dimension set // is not given. - let margins = calcMargins(containerWidth, containerHeight); + + const borderDimensions = this.getBorderDimensions(aBrowser); + const marginDims = calcMargins(containerWidth, containerHeight - borderDimensions.top); + + let margins = { + top : 0, + right : 0, + bottom : 0, + left : 0, + }; + + // snap browser element to top + margins.top = 0; + // and leave 'double' margin at the bottom + margins.bottom = 2 * marginDims.height - borderDimensions.bottom; + // identical margins left and right + margins.right = marginDims.width - borderDimensions.right; + margins.left = marginDims.width - borderDimensions.left; + + const marginStyleString = `${margins.top}px ${margins.right}px ${margins.bottom}px ${margins.left}px`; // If the size of the content is already quantized, we do nothing. - if (aBrowser.style.margin == `${margins.height}px ${margins.width}px`) { + if (aBrowser.style.margin === marginStyleString) { log("_roundContentView[" + logId + "] is_rounded == true"); if (this._isLetterboxingTesting) { log( @@ -563,19 +605,35 @@ class _RFPHelper { "_roundContentView[" + logId + "] setting margins to " + - margins.width + - " x " + - margins.height + marginStyleString ); - // One cannot (easily) control the color of a margin unfortunately. - // An initial attempt to use a border instead of a margin resulted - // in offset event dispatching; so for now we use a colorless margin. - aBrowser.style.margin = `${margins.height}px ${margins.width}px`; + + // The margin background color is determined by the background color of the + // window's tabpanels#tabbrowser-tabpanels element + aBrowser.style.margin = marginStyleString; }); } _clearContentViewMargin(aBrowser) { + const borderDimensions = this.getBorderDimensions(aBrowser); + // set the margins such that the browser elements border is visible up top, but + // are rendered off-screen on the remaining sides + let margins = { + top : 0, + right : -borderDimensions.right, + bottom : -borderDimensions.bottom, + left : -borderDimensions.left, + }; + const marginStyleString = `${margins.top}px ${margins.right}px ${margins.bottom}px ${margins.left}px`; + + aBrowser.ownerGlobal.requestAnimationFrame(() => { + aBrowser.style.margin = marginStyleString; + }); + } + + _removeLetterboxing(aBrowser) { aBrowser.ownerGlobal.requestAnimationFrame(() => { + aBrowser.classList.remove("letterboxing"); aBrowser.style.margin = ""; }); } @@ -593,6 +651,11 @@ class _RFPHelper { aWindow.gBrowser.addTabsProgressListener(this); aWindow.addEventListener("TabOpen", this); + const tabPanel = aWindow.document.getElementById("tabbrowser-tabpanels"); + if (tabPanel) { + tabPanel.classList.add("letterboxing"); + } + // Rounding the content viewport. this._updateMarginsForTabsInWindow(aWindow); } @@ -616,10 +679,17 @@ class _RFPHelper { tabBrowser.removeTabsProgressListener(this); aWindow.removeEventListener("TabOpen", this); - // Clear all margins and tooltip for all browsers. + // revert tabpanel's background colors to default + const tabPanel = aWindow.document.getElementById("tabbrowser-tabpanels"); + if (tabPanel) { + tabPanel.classList.remove("letterboxing"); + } + + // and revert each browser element to default, + // restore default margins and remove letterboxing class for (let tab of tabBrowser.tabs) { let browser = tab.linkedBrowser; - this._clearContentViewMargin(browser); + this._removeLetterboxing(browser); } }

1 0

[tor-browser/tor-browser-78.1.0esr-10.0-1] Bug 24796 - Comment out excess permissions from GeckoView
by gk＠torproject.org 07 Aug '20

07 Aug '20

commit b89e268ad343794ce592f7238b006cadbf8802e4 Author: Matthew Finkel <Matthew.Finkel(a)gmail.com> Date: Wed Apr 11 17:52:59 2018 +0000 Bug 24796 - Comment out excess permissions from GeckoView The GeckoView AndroidManifest.xml is not preprocessed unlike Fennec's manifest, so we can't use the ifdef preprocessor guards around the permissions we do not want. Commenting the permissions is the next-best-thing. --- .../android/geckoview/src/main/AndroidManifest.xml | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/mobile/android/geckoview/src/main/AndroidManifest.xml b/mobile/android/geckoview/src/main/AndroidManifest.xml index 87ad6dc28047..4c8ab2a9d996 100644 --- a/mobile/android/geckoview/src/main/AndroidManifest.xml +++ b/mobile/android/geckoview/src/main/AndroidManifest.xml @@ -6,20 +6,32 @@ <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="org.mozilla.geckoview"> + +  + <uses-permission android:name="android.permission.INTERNET"/> <uses-permission android:name="android.permission.WAKE_LOCK"/> <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" /> + +  + <uses-feature android:name="android.hardware.touchscreen" android:required="false"/> + +  +  +  <uses-feature

1 0