- tbb-commits - lists.torproject.org

[tor-browser-build/maint-8.0] Bug 26263: app icon positioned incorrectly in macOS DMG installer window
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit cb37fc36ffb8d21c99e90a61b6a31a8981b64e41 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Oct 16 17:29:59 2018 +0000 Bug 26263: app icon positioned incorrectly in macOS DMG installer window Use a new .DS_Store file that has the correct app icon position. Incorporate a new background image with updated Tor Browser branding, including @1x and @2x (Retina) images. Remove the .fseventsd/ directory, which is not needed in a DMG. These changes also fix bug 25151: Update Tor Browser branding on installation. --- .../Bundle-Data/mac-applications.dmg/.DS_Store | Bin 12292 -> 15365 bytes .../mac-applications.dmg/.background/background.png | Bin 50020 -> 0 bytes .../.background/background.tiff | Bin 0 -> 36170 bytes .../.fseventsd/0000000000400c60 | Bin 173 -> 0 bytes .../mac-applications.dmg/.fseventsd/fseventsd-uuid | 1 - 5 files changed, 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.DS_Store b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.DS_Store index aeb3104..deb29a7 100644 Binary files a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.DS_Store and b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.DS_Store differ diff --git a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.background/background.png b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.background/background.png deleted file mode 100644 index 94e4584..0000000 Binary files a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.background/background.png and /dev/null differ diff --git a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.background/background.tiff b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.background/background.tiff new file mode 100644 index 0000000..5d28d71 Binary files /dev/null and b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.background/background.tiff differ diff --git a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.fseventsd/0000000000400c60 b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.fseventsd/0000000000400c60 deleted file mode 100644 index e21068d..0000000 Binary files a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.fseventsd/0000000000400c60 and /dev/null differ diff --git a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.fseventsd/fseventsd-uuid b/projects/tor-browser/Bundle-Data/mac-applications.dmg/.fseventsd/fseventsd-uuid deleted file mode 100644 index 538367d..0000000 --- a/projects/tor-browser/Bundle-Data/mac-applications.dmg/.fseventsd/fseventsd-uuid +++ /dev/null @@ -1 +0,0 @@ -B29020CB-1603-4E1C-8C56-5C8A4434D120 \ No newline at end of file

1 0

[tor-browser-build/maint-8.0] Bug 27218: generate multiple bundles in parallel
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit 2d129f5c6b282c6e9e915339f7b4dfb0f54b5a80 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Oct 10 01:33:59 2018 +0200 Bug 27218: generate multiple bundles in parallel --- projects/tor-browser/build | 28 ++++++++++++++++++++++------ projects/tor-browser/config | 16 ++++++++++------ projects/tor-browser/ddmg.sh | 10 +++++----- projects/tor-browser/run_scripts | 30 ++++++++++++++++++++++++++++++ 4 files changed, 67 insertions(+), 17 deletions(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 4d51ec6..68050f9 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -5,6 +5,9 @@ export TORBROWSER_VERSION='[% c("version") %]' mkdir -p $distdir +scripts_dir=/var/tmp/build_scripts +mkdir -p "$scripts_dir" + OUTDIR='[% dest_dir _ "/" _ c("filename") %]' mkdir -p $OUTDIR @@ -252,8 +255,6 @@ popd mv $distdir/tbb-windows-installer ${TB_STAGE_DIR} [% END %] -cp -a ${TB_STAGE_DIR} $distdir/$PKG_DIR - [% IF c("var/windows") %] TBDIR="$distdir/$PKG_DIR/Tor Browser/Browser" [% ELSIF c("var/osx") %] @@ -262,6 +263,11 @@ cp -a ${TB_STAGE_DIR} $distdir/$PKG_DIR TBDIR="$distdir/$PKG_DIR/Browser" [% END %] +cat > "$scripts_dir/create-$PKG_DIR" << SCRIPT_EOF +#!/bin/bash +set -e +cp -a ${TB_STAGE_DIR} $distdir/$PKG_DIR + pushd "$TBDIR[% IF c("var/osx") %]/Contents/Resources/[% END %]" rm -f precomplete python $MARTOOLS/createprecomplete.py @@ -271,8 +277,8 @@ cd $distdir [% IF c("var/build_mar") -%] # Create full MAR file and compressed package. - MAR_FILE=tor-browser-[% c("var/mar_osname") %]-[% c("var/torbrowser_version") %]_${PKG_LOCALE}.mar - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE "$TBDIR" + [% SET mar_file = 'tor-browser-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_${PKG_LOCALE}.mar' %] + MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "$TBDIR" [% END -%] [% IF c("var/linux") %] @@ -298,6 +304,7 @@ cd $distdir popd [% END %] rm -rf $distdir/${PKG_DIR} +SCRIPT_EOF cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% IF c("var/linux-x86_64") -%] @@ -314,6 +321,7 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% SET lang = tmpl(lang); SET xpi = '$rootdir/' _ c('input_files_by_name/firefox-langpacks') _ '/' _ lang _ '.xpi'; SET tbdir = '$distdir/tor-browser_' _ lang; + SET mar_file = 'tor-browser-' _ c("var/mar_osname") _ '-' _ c("var/torbrowser_version") _ '_' _ lang _ '.mar'; IF c("var/osx"); SET browserdir = tbdir _ '/Tor Browser.app'; ELSIF c("var/windows"); @@ -322,6 +330,9 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ SET browserdir = tbdir _ '/Browser'; END; %] + cat > "$scripts_dir/create-tor-browser_[% lang %]" << SCRIPT_EOF +#!/bin/bash + set -e cp -a ${TB_STAGE_DIR} [% tbdir %] cp [% xpi %] "[% browserdir %]/$EXTSPATH/langpack-[% lang %](a)firefox.mozilla.org.xpi" @@ -349,9 +360,10 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ python $MARTOOLS/createprecomplete.py popd + cd $distdir + # Create full MAR file and compressed package for this locale. - MAR_FILE=tor-browser-[% c("var/mar_osname") %]-[% c("var/torbrowser_version") %]_[% lang %].mar - MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE "[% browserdir %]" + MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/[% mar_file %] "[% browserdir %]" [% IF c("var/linux") %] [% SET tardir = 'tor-browser_' _ lang; c('tar', { @@ -380,5 +392,9 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ popd [% END %] rm -rf [% tbdir %] +SCRIPT_EOF [% END %] [% END %] + +chmod 775 $rootdir/run_scripts "$scripts_dir"/* +$rootdir/run_scripts [% c("buildconf/num_procs") %] "$scripts_dir" diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 50d67e0..bb1c259 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -6,6 +6,14 @@ var: container: use_container: 1 ddmg: '[% INCLUDE ddmg.sh %]' + deps: + - python + - libparallel-forkmanager-perl + - libfile-slurp-perl + - zip + - unzip + - bzip2 + - xz-utils targets: linux-i686: @@ -17,14 +25,9 @@ targets: osx-x86_64: var: mar_osname: osx64 - deps: + arch_deps: - genisoimage - - zip - - unzip - - python - - bzip2 - faketime - - xz-utils windows: var: arch_deps: @@ -41,6 +44,7 @@ targets: input_files: - project: container-image + - filename: run_scripts - project: firefox name: firefox - project: tor diff --git a/projects/tor-browser/ddmg.sh b/projects/tor-browser/ddmg.sh index a715300..97fddb1 100755 --- a/projects/tor-browser/ddmg.sh +++ b/projects/tor-browser/ddmg.sh @@ -4,8 +4,8 @@ find [% src %] ! -executable -exec chmod 0644 {} \; find [% src %] -exec [% c("var/touch") %] {} \; -dmg_tmpdir=$(mktemp -d) -[% SET filelist = '"$dmg_tmpdir/filelist.txt"' %] +dmg_tmpdir=\$(mktemp -d) +[% SET filelist = '"\$dmg_tmpdir/filelist.txt"' %] pushd [% src %] find . -type f | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" > [% filelist %] find . -type l | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" >> [% filelist %] @@ -13,9 +13,9 @@ find . -type l | sed -e 's/^\.\///' | sort | xargs -i echo "{}={}" >> [% filelis export LD_PRELOAD=[% c("var/faketime_path") %] export FAKETIME="[% USE date; GET date.format(c('timestamp'), format = '%Y-%m-%d %H:%M:%S') %]" -genisoimage -D -V "Tor Browser" -no-pad -R -apple -o "$dmg_tmpdir/tbb-uncompressed.dmg" -path-list [% filelist %] -graft-points -gid 20 -dir-mode 0755 -new-dir-mode 0755 +genisoimage -D -V "Tor Browser" -no-pad -R -apple -o "\$dmg_tmpdir/tbb-uncompressed.dmg" -path-list [% filelist %] -graft-points -gid 20 -dir-mode 0755 -new-dir-mode 0755 -dmg dmg "$dmg_tmpdir/tbb-uncompressed.dmg" [% c('dmg_out', { error_if_undef => 1 }) %] +dmg dmg "\$dmg_tmpdir/tbb-uncompressed.dmg" [% c('dmg_out', { error_if_undef => 1 }) %] popd -rm -Rf "$dmg_tmpdir" +rm -Rf "\$dmg_tmpdir" diff --git a/projects/tor-browser/run_scripts b/projects/tor-browser/run_scripts new file mode 100755 index 0000000..4b85b50 --- /dev/null +++ b/projects/tor-browser/run_scripts @@ -0,0 +1,30 @@ +#!/usr/bin/perl -w +use strict; + +use Parallel::ForkManager; +use File::Slurp; + +sub exit_error { + print STDERR "Error: ", $_[0], "\n"; + chdir '/'; + exit (exists $_[1] ? $_[1] : 1); +} + +exit_error "Wrong number of arguments" unless @ARGV == 2; +my ($nb_threads, $scripts_dir) = @ARGV; +exit_error "Could not enter $scripts_dir" unless chdir $scripts_dir; +my $pm = Parallel::ForkManager->new($nb_threads); +$pm->run_on_finish( + sub { + my ($pid, $exit, $id) = @_; + exit_error "Error running $id" unless $exit == 0; + print "Finished $id\n"; + } +); +foreach my $script (sort(read_dir($scripts_dir))) { + $pm->start($script) and next; + print "Running $script\n"; + exit_error "Error running $script" unless system("./$script") == 0; + $pm->finish; +} +$pm->wait_all_children;

1 0

[tor-browser/tor-browser-60.3.0esr-8.0-1] Bug 26381: about:tor page does not load on first start on Windows
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit dcf7cc2acd095e27d82b16424d4d23fb9b5d7559 Author: Richard Pospesel <richard(a)torproject.org> Date: Sat Sep 15 04:01:17 2018 +0000 Bug 26381: about:tor page does not load on first start on Windows Child content processes require certain directories to be marked as readable or writeable when Sandboxing is enabled. The directories to be whitelisted are saved in static variables in sandboxBroker.cpp and are initialized in SandboxBroker::GeckoDependentInitialize(). Any child content process which is created before these directories are saved will be unable to read or write to them. The tor-launcher extension triggers the creation of a content process which hosts the tor network configuration settings window. This process is created before the whitelisted directories are saved. The network settings process doesn't need access to these directories to function, but subsequent content processes which are created once the settings window exits do need these directories to function. Sometimes, the creation of these subsequent processes is slow enough for the parent process to 'catch up' and create the whitelist resulting in the broken about:tor tab or broken white tab. A previous iteration of this patch moved the GeckoDependentInitialize() call directly above the call to DoStartup(). However, Mozilla dev Bob Owen objected to this since this places the call before various services are initialized which the SandboxBroker may depend on. Some experimentation would seem to confirm his objections: placing the whitelist init just prior to DoStartup() results in an empty value for the profile directory which prevents child processes reading the chrome and extensions directory. This patch inserts the GeckoDependentInitialize() call into DoStartup() just after the profile directory is known and queryable by the SandboxBroker, and before the 'profile-after-change' notification is fired. It also reverts the temp fix which reduced the sandbox level to 2 on windows. --- browser/app/profile/000-tor-browser.js | 5 ----- toolkit/xre/nsAppRunner.cpp | 6 ------ toolkit/xre/nsXREDirProvider.cpp | 19 +++++++++++++++++++ 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 07005f326580..8f74748f2072 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -330,11 +330,6 @@ pref("browser.onboarding.newtour", "welcome,privacy,tor-network,circuit-display, pref("browser.onboarding.updatetour", "welcome,privacy,tor-network,circuit-display,security,expect-differences,onion-services"); pref("browser.onboarding.skip-tour-button.hide", true); -#ifdef XP_WIN -// For now, reduce sandboxing level to 2 (see #26381). -pref("security.sandbox.content.level", 2); -#endif - #ifdef TOR_BROWSER_VERSION #expand pref("torbrowser.version", __TOR_BROWSER_VERSION__); #endif diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index 1000014aedd0..7889919ca677 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -5249,12 +5249,6 @@ XREMain::XRE_mainRun() // We intentionally leak the string here since it is required by PR_SetEnv. PR_SetEnv(saved.release()); } - -#if defined(MOZ_SANDBOX) - // Call SandboxBroker to initialize things that depend on Gecko machinery like - // the directory provider. - SandboxBroker::GeckoDependentInitialize(); -#endif #endif SaveStateForAppInitiatedRestart(); diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp index b54985292e81..72545d0eb422 100644 --- a/toolkit/xre/nsXREDirProvider.cpp +++ b/toolkit/xre/nsXREDirProvider.cpp @@ -66,6 +66,10 @@ #include "UIKitDirProvider.h" #endif +#if defined(MOZ_SANDBOX) && defined(XP_WIN) +#include "sandboxBroker.h" +#endif + #if defined(MOZ_CONTENT_SANDBOX) #include "mozilla/SandboxSettings.h" #include "nsIUUIDGenerator.h" @@ -1003,6 +1007,21 @@ nsXREDirProvider::DoStartup() policies->Observe(nullptr, "policies-startup", nullptr); } + #if defined(MOZ_SANDBOX) && defined(XP_WIN) + // Call SandboxBroker to initialize things that depend on Gecko machinery like + // the directory provider. + + // We insert this initialization code here so that any child content processes spawned by + // extensions (such as tor-launcher launching the network configuration window) will have + // all the requisite directories white-listed for read/write access + + // It's inserted here (rather than in XREMain::XRE_mainRun) because we need + // NS_APP_USER_PROFILE_50_DIR to be known + + // See tor bug #26381 and mozilla bug #1485836 + SandboxBroker::GeckoDependentInitialize(); + #endif + // Init the Extension Manager nsCOMPtr<nsIObserver> em = do_GetService("@mozilla.org/addons/integration;1"); if (em) {

1 0

[tor-browser-build/maint-8.0] Bug 26475: Disable building Rust with Thin LTO
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit dd1d00a2fed85c8bb22c4f85bbc45da00d0e8c05 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 15 09:48:59 2018 +0000 Bug 26475: Disable building Rust with Thin LTO Building Rust with Thin LTO enabled leads to Tor Browser builds on macOS and probably Linux not being reproducible. The exact reason for that is unknown at the moment, although it seems fixed testing nightly Rust source tarballs as of mid-September 2018. We therefore disable Thin LTO for now by setting `codegen-units` to `1`. --- projects/firefox/mozconfig-osx-x86_64 | 3 --- projects/rust/build | 10 ++++++++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/projects/firefox/mozconfig-osx-x86_64 b/projects/firefox/mozconfig-osx-x86_64 index 7ff17e1..1e30084 100644 --- a/projects/firefox/mozconfig-osx-x86_64 +++ b/projects/firefox/mozconfig-osx-x86_64 @@ -48,9 +48,6 @@ ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests -# We need to disable for Stylo right now, as we have reproducibility issues on -# macOS with it enabled, see: #26475. -ac_add_options --disable-stylo # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme # ac_add_options --disable-ctypes diff --git a/projects/rust/build b/projects/rust/build index 936f49f..61a5d50 100644 --- a/projects/rust/build +++ b/projects/rust/build @@ -65,6 +65,16 @@ cd /var/tmp/build/rustc-[% c('version') %]-src mkdir build cd build ../configure --prefix=$distdir [% c("var/configure_opt") %] + +# We need to disable Thin LTO due to reproducibility issues on macOS and +# probably Linux. Alas, there is no direct option available in the config.toml +# in 1.26.1 yet, so we need to toggle this indirectly via `codegen-units`. +[% IF c("var/osx") || c("var/linux") %] + # It seems hard to pass the proper value via ./configure so we resort to our + # old friend `sed`. + sed -i 's/#codegen-units = 1/codegen-units = 1/' config.toml +[% END %] + make -j[% c("buildconf/num_procs") %] make install cd /var/tmp/dist

1 0

[tor-browser-build/maint-8.0] Update rbm to pick up fix for #28466
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit 316463d531d66b0d8d5978fcaaa06f5d3eed0de7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 28 13:38:28 2018 +0000 Update rbm to pick up fix for #28466 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 8adbc46..eb500fa 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 8adbc46dc9e8358abad75ac81faf4646d8165b9e +Subproject commit eb500fa9467fb4d7229c9ca87f202ef18603d023

1 0

[torbutton/master] Bug 28075: Tone down missing SOCKS credential warning
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 0b60f61087b514f74ea21513f14e691c2bd30493 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Oct 17 06:48:20 2018 +0000 Bug 28075: Tone down missing SOCKS credential warning --- src/chrome/content/tor-circuit-display.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/tor-circuit-display.js b/src/chrome/content/tor-circuit-display.js index 6105fea1..5fc92e48 100644 --- a/src/chrome/content/tor-circuit-display.js +++ b/src/chrome/content/tor-circuit-display.js @@ -310,7 +310,7 @@ let updateCircuitDisplay = function () { (nodeData[0].type === "bridge") ? "none" : "block"; } else { // Only show the Tor circuit if we have credentials and node data. - logger.eclog(5, "no SOCKS credentials found for current document."); + logger.eclog(4, "no SOCKS credentials found for current document."); } showCircuitDisplay(domain && nodeData); };

1 0

[tor-browser/tor-browser-60.3.0esr-8.0-1] Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit d69efa2fe8f1fcb625d74251283cfa0e4f25cc01 Author: Honza Bambas <honzab.moz(a)firemni.cz> Date: Wed Oct 31 02:13:00 2018 -0400 Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc --HG-- extra : source : 1ed273626bbd38cde17d7610ac5d7dad0aca91c1 extra : intermediate-source : c89f12000b079c50362ce52e661e3c5e24836a11 This backport fixes our bug 28608. --- modules/libpref/init/all.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index f5a2ec47593a..e358cfcfcb2d 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2275,9 +2275,9 @@ pref("network.auth.non-web-content-triggered-resources-http-auth-allow", false); // in that case default credentials will always be used. pref("network.auth.private-browsing-sso", false); -// Control how throttling of http responses works - number of ms that each -// suspend and resume period lasts (prefs named appropriately) -pref("network.http.throttle.enable", true); +// This feature is occasionally causing visible regressions (download too slow for +// too long time, jitter in video/audio in background tabs...) +pref("network.http.throttle.enable", false); pref("network.http.throttle.version", 1); // V1 prefs

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 2789cecf98cd603f835711378d76ed06b4369609 Author: Honza Bambas <honzab.moz(a)firemni.cz> Date: Wed Oct 31 02:13:00 2018 -0400 Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc --HG-- extra : source : 1ed273626bbd38cde17d7610ac5d7dad0aca91c1 extra : intermediate-source : c89f12000b079c50362ce52e661e3c5e24836a11 This backport fixes our bug 28608. --- modules/libpref/init/all.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index f5a2ec47593a..e358cfcfcb2d 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2275,9 +2275,9 @@ pref("network.auth.non-web-content-triggered-resources-http-auth-allow", false); // in that case default credentials will always be used. pref("network.auth.private-browsing-sso", false); -// Control how throttling of http responses works - number of ms that each -// suspend and resume period lasts (prefs named appropriately) -pref("network.http.throttle.enable", true); +// This feature is occasionally causing visible regressions (download too slow for +// too long time, jitter in video/audio in background tabs...) +pref("network.http.throttle.enable", false); pref("network.http.throttle.version", 1); // V1 prefs

1 0

[tor-browser/tor-browser-60.3.0esr-8.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 3c03aad30d2b2b0e92359f15a1a95cfb2354544e Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 21 10:02:20 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 25794 deals with pointer events and associated fingerprinting risks. There are patches we can backport from Mozilla, but they are not small and we should give them some baking time. Thus, let's disable pointer events for now. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index bc7c4b05e3a1..07005f326580 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,6 +150,7 @@ pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthe pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API +pref("dom.w3c_pointer_events.enabled", false); pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now // Disable randomised Firefox HTTP cache decay user test groups (Bug: 13575) pref("security.webauth.webauthn", false); // Bug 26614: Disable Web Authentication API for now

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit c20210b1a017c4e94157c1acfbef18e878202ff4 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 21 10:02:20 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 25794 deals with pointer events and associated fingerprinting risks. There are patches we can backport from Mozilla, but they are not small and we should give them some baking time. Thus, let's disable pointer events for now. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 38f72579760a..8f74748f2072 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,6 +150,7 @@ pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthe pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API +pref("dom.w3c_pointer_events.enabled", false); pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now // Disable randomised Firefox HTTP cache decay user test groups (Bug: 13575) pref("security.webauth.webauthn", false); // Bug 26614: Disable Web Authentication API for now

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 27762: Remove workarounds that allowed torbutton extension to load
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 057daaf3fa81f46d4a3653115990b462fe7b2551 Author: Igor Oliveira <igt0(a)torproject.org> Date: Tue Dec 4 07:18:46 2018 -0200 Bug 27762: Remove workarounds that allowed torbutton extension to load Since torbutton became a system extension, those workarounds (implemented in #27220 and #27271+#27763) are not needed anymore. --- mobile/android/app/000-tor-browser-android.js | 5 ----- toolkit/mozapps/extensions/internal/XPIInstall.jsm | 5 ----- 2 files changed, 10 deletions(-) diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js index e7e337276acb..de51ec125406 100644 --- a/mobile/android/app/000-tor-browser-android.js +++ b/mobile/android/app/000-tor-browser-android.js @@ -54,10 +54,5 @@ pref("media.realtime_decoder.enabled", false); pref("general.useragent.updates.enabled", false); pref("general.useragent.updates.url", ""); -// Do not allow the user to install extensions from web -pref("xpinstall.enabled", false); -pref("extensions.enabledScopes", 1); -pref("extensions.autoDisableScopes", 1); - // Enable touch events on Android (highlighting text, etc) pref("dom.w3c_touch_events.enabled", 2); diff --git a/toolkit/mozapps/extensions/internal/XPIInstall.jsm b/toolkit/mozapps/extensions/internal/XPIInstall.jsm index 40b3b1d6434e..f97669951710 100644 --- a/toolkit/mozapps/extensions/internal/XPIInstall.jsm +++ b/toolkit/mozapps/extensions/internal/XPIInstall.jsm @@ -1029,11 +1029,6 @@ function getSignedStatus(aRv, aCert, aAddonID) { } function shouldVerifySignedState(aAddon) { - if (AppConstants.platform === "android" && - aAddon.id === "torbutton(a)torproject.org") { - return false; - } - // Updated system add-ons should always have their signature checked if (aAddon._installLocation.name == KEY_APP_SYSTEM_ADDONS) return true;

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1464481 - fix and test crash when getting registered channelwrapper, r=kmag
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit 1305066f21439675842aad91844e6b490df8c3e0 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Fri May 25 16:41:19 2018 -0400 Bug 1464481 - fix and test crash when getting registered channelwrapper, r=kmag MozReview-Commit-ID: LEGojHEb742 --HG-- extra : rebase_source : 7018cfef6b7415ea275dc2c3e414586396a9e2be --- dom/chrome-webidl/ChannelWrapper.webidl | 2 +- .../test/mochitest/test_ext_webrequest_hsts.html | 25 ++++++++++++++++++++++ toolkit/modules/addons/WebRequest.jsm | 4 +++- 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/dom/chrome-webidl/ChannelWrapper.webidl b/dom/chrome-webidl/ChannelWrapper.webidl index 2777aab65c8e..bc959d30d043 100644 --- a/dom/chrome-webidl/ChannelWrapper.webidl +++ b/dom/chrome-webidl/ChannelWrapper.webidl @@ -52,7 +52,7 @@ interface ChannelWrapper : EventTarget { * Returns the wrapper instance for the given channel. The same wrapper is * always returned for a given channel. */ - static ChannelWrapper getRegisteredChannel(unsigned long long aChannelId, + static ChannelWrapper? getRegisteredChannel(unsigned long long aChannelId, WebExtensionPolicy extension, TabParent? tabParent); diff --git a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html index ad4d4f32a657..849527ea4a80 100644 --- a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html +++ b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html @@ -185,6 +185,31 @@ add_task(async function test_hsts_header() { await extension.unload(); }); + +add_task(async function test_nonBlocking_securityInfo() { + let extension = ExtensionTestUtils.loadExtension({ + manifest: { + "permissions": [ + "webRequest", + "<all_urls>", + ], + }, + async background() { + let tab; + browser.webRequest.onHeadersReceived.addListener(async (details) => { + let securityInfo = await browser.webRequest.getSecurityInfo(details.requestId, {}); + browser.test.assertTrue(!securityInfo, "securityInfo undefined on http request"); + browser.tabs.remove(tab.id); + browser.test.notifyPass("success"); + }, {urls: ["<all_urls>"], types: ["main_frame"]}); + tab = await browser.tabs.create({url: "https://example.org/tests/toolkit/components/extensions/test/mochitest/file…"}); + }, + }); + await extension.startup(); + + await extension.awaitFinish("success"); + await extension.unload(); +}); </script> </head> <body> diff --git a/toolkit/modules/addons/WebRequest.jsm b/toolkit/modules/addons/WebRequest.jsm index a4c9e9859a21..6a95182a3876 100644 --- a/toolkit/modules/addons/WebRequest.jsm +++ b/toolkit/modules/addons/WebRequest.jsm @@ -1012,7 +1012,9 @@ var WebRequest = { getSecurityInfo: (details) => { let channel = ChannelWrapper.getRegisteredChannel(details.id, details.extension, details.tabParent); - return SecurityInfo.getSecurityInfo(channel.channel, details.options); + if (channel) { + return SecurityInfo.getSecurityInfo(channel.channel, details.options); + } }, };

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1474626 - fix timestamp test and values, r=rpl
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit b3d74f7db1cc0ddf54771e3e9e5de4b8549b0c88 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Wed Jul 11 14:54:03 2018 -0300 Bug 1474626 - fix timestamp test and values, r=rpl The test was incorrect and the timestamp should be milliseconds, not microseconds. MozReview-Commit-ID: 2d79r6PHH4Z --HG-- extra : rebase_source : edd97899f0646f2cae2fbf119206ec470a6b97a0 --- .../extensions/test/mochitest/test_ext_webrequest_hsts.html | 6 +++++- toolkit/modules/addons/SecurityInfo.jsm | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html index df8b541808f9..b8385ca08843 100644 --- a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html +++ b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html @@ -38,7 +38,11 @@ function getExtension() { browser.test.assertTrue(securityInfo.certificates.length == 1, "no certificate chain"); } let cert = securityInfo.certificates[0]; - browser.test.assertTrue(cert.validity.start < Date.now() < cert.validity.end, "cert validity is correct"); + let now = Date.now(); + browser.test.assertTrue(Number.isInteger(cert.validity.start), "cert start is integer"); + browser.test.assertTrue(Number.isInteger(cert.validity.end), "cert end is integer"); + browser.test.assertTrue(cert.validity.start < now, "cert start validity is correct"); + browser.test.assertTrue(now < cert.validity.end, "cert end validity is correct"); if (options.rawDER) { for (let cert of securityInfo.certificates) { browser.test.assertTrue(cert.rawDER.length > 0, "have rawDER"); diff --git a/toolkit/modules/addons/SecurityInfo.jsm b/toolkit/modules/addons/SecurityInfo.jsm index a931602b517a..de0084398aa6 100644 --- a/toolkit/modules/addons/SecurityInfo.jsm +++ b/toolkit/modules/addons/SecurityInfo.jsm @@ -214,8 +214,8 @@ const SecurityInfo = { subject: cert.subjectName, issuer: cert.issuerName, validity: { - start: cert.validity.notBefore, - end: cert.validity.notAfter, + start: cert.validity.notBefore ? Math.trunc(cert.validity.notBefore / 1000) : 0, + end: cert.validity.notAfter ? Math.trunc(cert.validity.notAfter / 1000) : 0, }, fingerprint: { sha1: cert.sha1Fingerprint,

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1471959 - leave keaGroupName and signatureSchemeName undefined if value is none, r=rpl
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit b81fe53f5fe1ecd749ca900ccfc1a00ae1fd9328 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Fri Jul 6 09:41:56 2018 -0300 Bug 1471959 - leave keaGroupName and signatureSchemeName undefined if value is none, r=rpl MozReview-Commit-ID: 2Ca7xCMOPAH --HG-- extra : rebase_source : 2fa9d6b80c9ead0d90927878ce10390791cbadd9 --- toolkit/components/extensions/schemas/web_request.json | 10 ++++++++++ toolkit/modules/addons/SecurityInfo.jsm | 8 ++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/toolkit/components/extensions/schemas/web_request.json b/toolkit/components/extensions/schemas/web_request.json index 508ca8b05f8f..6fe12f7b6ca5 100644 --- a/toolkit/components/extensions/schemas/web_request.json +++ b/toolkit/components/extensions/schemas/web_request.json @@ -269,6 +269,16 @@ "description": "The cipher suite used in this request if state is \"secure\".", "optional": true }, + "keaGroupName": { + "type": "string", + "description": "The key exchange algorithm used in this request if state is \"secure\".", + "optional": true + }, + "signatureSchemeName": { + "type": "string", + "description": "The signature scheme used in this request if state is \"secure\".", + "optional": true + }, "certificates": { "description": "Certificate data if state is \"secure\". Will only contain one entry unless <code>certificateChain</code> is passed as an option.", "type": "array", diff --git a/toolkit/modules/addons/SecurityInfo.jsm b/toolkit/modules/addons/SecurityInfo.jsm index 8c5cef18754d..a931602b517a 100644 --- a/toolkit/modules/addons/SecurityInfo.jsm +++ b/toolkit/modules/addons/SecurityInfo.jsm @@ -137,10 +137,14 @@ const SecurityInfo = { info.cipherSuite = SSLStatus.cipherName; // Key exchange group name. - info.keaGroupName = SSLStatus.keaGroupName; + if (SSLStatus.keaGroupName !== "none") { + info.keaGroupName = SSLStatus.keaGroupName; + } // Certificate signature scheme. - info.signatureSchemeName = SSLStatus.signatureSchemeName; + if (SSLStatus.signatureSchemeName !== "none") { + info.signatureSchemeName = SSLStatus.signatureSchemeName; + } info.isDomainMismatch = SSLStatus.isDomainMismatch; info.isExtendedValidation = SSLStatus.isExtendedValidation;

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1470516 - remove or fix localized values in securityInfo, r=rpl
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit 05cbc6e53b30707e32af750eb082a90f715cbf95 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Mon Jul 2 15:45:18 2018 -0300 Bug 1470516 - remove or fix localized values in securityInfo, r=rpl MozReview-Commit-ID: 3xURSfbPTmS --HG-- extra : rebase_source : aeb333a0c72120724a5a7d988f460e3c703b09c3 --- toolkit/components/extensions/schemas/web_request.json | 9 +++------ .../extensions/test/mochitest/test_ext_webrequest_hsts.html | 2 ++ toolkit/modules/addons/SecurityInfo.jsm | 5 ++--- 3 files changed, 7 insertions(+), 9 deletions(-) diff --git a/toolkit/components/extensions/schemas/web_request.json b/toolkit/components/extensions/schemas/web_request.json index ed1840cabe2a..508ca8b05f8f 100644 --- a/toolkit/components/extensions/schemas/web_request.json +++ b/toolkit/components/extensions/schemas/web_request.json @@ -189,10 +189,10 @@ }, "validity": { "type": "object", - "description": "Contains start and end dates in GMT.", + "description": "Contains start and end timestamps.", "properties": { - "startGMT": { "type": "string" }, - "endGMT": { "type": "string" } + "start": { "type": "integer" }, + "end": { "type": "integer" } } }, "fingerprint": { @@ -214,9 +214,6 @@ "sha256": { "type": "string" } } }, - "keyUsages": { - "type": "string" - }, "rawDER": { "optional": true, "type": "array", diff --git a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html index 849527ea4a80..df8b541808f9 100644 --- a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html +++ b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html @@ -37,6 +37,8 @@ function getExtension() { } else { browser.test.assertTrue(securityInfo.certificates.length == 1, "no certificate chain"); } + let cert = securityInfo.certificates[0]; + browser.test.assertTrue(cert.validity.start < Date.now() < cert.validity.end, "cert validity is correct"); if (options.rawDER) { for (let cert of securityInfo.certificates) { browser.test.assertTrue(cert.rawDER.length > 0, "have rawDER"); diff --git a/toolkit/modules/addons/SecurityInfo.jsm b/toolkit/modules/addons/SecurityInfo.jsm index 4984f76dd463..8c5cef18754d 100644 --- a/toolkit/modules/addons/SecurityInfo.jsm +++ b/toolkit/modules/addons/SecurityInfo.jsm @@ -210,8 +210,8 @@ const SecurityInfo = { subject: cert.subjectName, issuer: cert.issuerName, validity: { - startGMT: cert.validity.notBeforeGMT, - endGMT: cert.validity.notAfterGMT, + start: cert.validity.notBefore, + end: cert.validity.notAfter, }, fingerprint: { sha1: cert.sha1Fingerprint, @@ -222,7 +222,6 @@ const SecurityInfo = { subjectPublicKeyInfoDigest: { sha256: cert.sha256SubjectPublicKeyInfoDigest, }, - keyUsages: cert.keyUsages, }; if (options.rawDER) { certData.rawDER = cert.getRawDER({});

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1322748 add securityInfo to webRequest listeners, r=keeler, rpl
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit 1935dcf38ca112f9fbc9fe42c2289d77e4f95932 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Wed May 23 14:36:19 2018 -0400 Bug 1322748 add securityInfo to webRequest listeners, r=keeler,rpl MozReview-Commit-ID: Hen1tl1RWTC --HG-- extra : rebase_source : e5dae021438ece0477d89e1d4e91eaaf2ebfd06e --- toolkit/components/extensions/ext-webRequest.js | 8 + .../components/extensions/schemas/web_request.json | 171 ++++++++++++ .../test/mochitest/test_ext_webrequest_hsts.html | 28 +- toolkit/modules/addons/SecurityInfo.jsm | 297 +++++++++++++++++++++ toolkit/modules/addons/WebRequest.jsm | 21 +- toolkit/modules/moz.build | 1 + 6 files changed, 516 insertions(+), 10 deletions(-) diff --git a/toolkit/components/extensions/ext-webRequest.js b/toolkit/components/extensions/ext-webRequest.js index f953be4a6e40..19306816adc3 100644 --- a/toolkit/components/extensions/ext-webRequest.js +++ b/toolkit/components/extensions/ext-webRequest.js @@ -102,6 +102,14 @@ this.webRequest = class extends ExtensionAPI { onResponseStarted: new WebRequestEventManager(context, "onResponseStarted").api(), onErrorOccurred: new WebRequestEventManager(context, "onErrorOccurred").api(), onCompleted: new WebRequestEventManager(context, "onCompleted").api(), + getSecurityInfo: function(requestId, options = {}) { + return WebRequest.getSecurityInfo({ + id: requestId, + extension: context.extension.policy, + tabParent: context.xulBrowser.frameLoader.tabParent, + options, + }); + }, handlerBehaviorChanged: function() { // TODO: Flush all caches. }, diff --git a/toolkit/components/extensions/schemas/web_request.json b/toolkit/components/extensions/schemas/web_request.json index 97badfc797b9..ed1840cabe2a 100644 --- a/toolkit/components/extensions/schemas/web_request.json +++ b/toolkit/components/extensions/schemas/web_request.json @@ -177,6 +177,148 @@ } }, { + "id": "CertificateInfo", + "type": "object", + "description": "Contains the certificate properties of the request if it is a secure request.", + "properties": { + "subject": { + "type": "string" + }, + "issuer": { + "type": "string" + }, + "validity": { + "type": "object", + "description": "Contains start and end dates in GMT.", + "properties": { + "startGMT": { "type": "string" }, + "endGMT": { "type": "string" } + } + }, + "fingerprint": { + "type": "object", + "properties": { + "sha1": { "type": "string" }, + "sha256": { "type": "string" } + } + }, + "serialNumber": { + "type": "string" + }, + "isBuiltInRoot": { + "type": "boolean" + }, + "subjectPublicKeyInfoDigest": { + "type": "object", + "properties": { + "sha256": { "type": "string" } + } + }, + "keyUsages": { + "type": "string" + }, + "rawDER": { + "optional": true, + "type": "array", + "items": { + "type": "integer" + } + } + } + }, + { + "id": "CertificateTransparencyStatus", + "type": "string", + "enum": ["not_applicable", "policy_compliant", "policy_not_enough_scts", "policy_not_diverse_scts"] + }, + { + "id": "TransportWeaknessReasons", + "type": "string", + "enum": ["cipher"] + }, + { + "id": "SecurityInfo", + "type": "object", + "description": "Contains the security properties of the request (ie. SSL/TLS information).", + "properties": { + "state": { + "type": "string", + "enum": [ + "insecure", + "weak", + "broken", + "secure" + ] + }, + "errorMessage": { + "type": "string", + "description": "Error message if state is \"broken\"", + "optional": true + }, + "protocolVersion": { + "type": "string", + "description": "Protocol version if state is \"secure\"", + "enum": [ + "TLSv1", + "TLSv1.1", + "TLSv1.2", + "TLSv1.3", + "unknown" + ], + "optional": true + }, + "cipherSuite": { + "type": "string", + "description": "The cipher suite used in this request if state is \"secure\".", + "optional": true + }, + "certificates": { + "description": "Certificate data if state is \"secure\". Will only contain one entry unless <code>certificateChain</code> is passed as an option.", + "type": "array", + "items": { "$ref": "CertificateInfo" } + }, + "isDomainMismatch": { + "description": "The domain name does not match the certificate domain.", + "type": "boolean", + "optional": true + }, + "isExtendedValidation": { + "type": "boolean", + "optional": true + }, + "isNotValidAtThisTime": { + "description": "The certificate is either expired or is not yet valid. See <code>CertificateInfo.validity</code> for start and end dates.", + "type": "boolean", + "optional": true + }, + "isUntrusted": { + "type": "boolean", + "optional": true + }, + "certificateTransparencyStatus": { + "description": "Certificate transparency compliance per RFC 6962. See <code>https://www.certificate-transparency.org/what-is-ct</code> for more information.", + "$ref": "CertificateTransparencyStatus", + "optional": true + }, + "hsts": { + "type": "boolean", + "description": "True if host uses Strict Transport Security and state is \"secure\".", + "optional": true + }, + "hpkp": { + "type": "string", + "description": "True if host uses Public Key Pinning and state is \"secure\".", + "optional": true + }, + "weaknessReasons": { + "type": "array", + "items": { "$ref": "TransportWeaknessReasons" }, + "description": "list of reasons that cause the request to be considered weak, if state is \"weak\"", + "optional": true + } + } + }, + { "id": "UploadData", "type": "object", "properties": { @@ -225,6 +367,35 @@ "additionalProperties": {"type": "any"}, "isInstanceOf": "StreamFilter" } + }, + { + "name": "getSecurityInfo", + "type": "function", + "async": true, + "description": "Retrieves the security information for the request. Returns a promise that will resolve to a SecurityInfo object.", + "parameters": [ + { + "name": "requestId", + "type": "string" + }, + { + "name": "options", + "optional": true, + "type": "object", + "properties": { + "certificateChain": { + "type": "boolean", + "description": "Include the entire certificate chain.", + "optional": true + }, + "rawDER": { + "type": "boolean", + "description": "Include raw certificate data for processing by the extension.", + "optional": true + } + } + } + ] } ], "events": [ diff --git a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html index 4dce90cd377e..ad4d4f32a657 100644 --- a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html +++ b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html @@ -25,9 +25,35 @@ function getExtension() { browser.webRequest.onSendHeaders.addListener(details => { browser.test.assertEq(expect.shift(), "onSendHeaders"); }, {urls}, ["requestHeaders"]); - browser.webRequest.onHeadersReceived.addListener(details => { + + async function testSecurityInfo(details, options) { + let securityInfo = await browser.webRequest.getSecurityInfo(details.requestId, options); + browser.test.assertTrue(securityInfo && securityInfo.state == "secure", + "security info reflects https"); + + if (options.certificateChain) { + // Some of the tests here only produce a single cert in the chain. + browser.test.assertTrue(securityInfo.certificates.length >= 1, "have certificate chain"); + } else { + browser.test.assertTrue(securityInfo.certificates.length == 1, "no certificate chain"); + } + if (options.rawDER) { + for (let cert of securityInfo.certificates) { + browser.test.assertTrue(cert.rawDER.length > 0, "have rawDER"); + } + } + } + + browser.webRequest.onHeadersReceived.addListener(async (details) => { browser.test.assertEq(expect.shift(), "onHeadersReceived"); + // We exepect all requests to have been upgraded at this point. + browser.test.assertTrue(details.url.startsWith("https"), "connection is https"); + await testSecurityInfo(details, {}); + await testSecurityInfo(details, {certificateChain: true}); + await testSecurityInfo(details, {rawDER: true}); + await testSecurityInfo(details, {certificateChain: true, rawDER: true}); + let headers = details.responseHeaders || []; for (let header of headers) { if (header.name.toLowerCase() === "strict-transport-security") { diff --git a/toolkit/modules/addons/SecurityInfo.jsm b/toolkit/modules/addons/SecurityInfo.jsm new file mode 100644 index 000000000000..4984f76dd463 --- /dev/null +++ b/toolkit/modules/addons/SecurityInfo.jsm @@ -0,0 +1,297 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +"use strict"; + +const EXPORTED_SYMBOLS = ["SecurityInfo"]; + +ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); + +const wpl = Ci.nsIWebProgressListener; +XPCOMUtils.defineLazyServiceGetter(this, "NSSErrorsService", + "@mozilla.org/nss_errors_service;1", + "nsINSSErrorsService"); +XPCOMUtils.defineLazyServiceGetter(this, "sss", + "@mozilla.org/ssservice;1", + "nsISiteSecurityService"); + +// NOTE: SecurityInfo is largely reworked from the devtools NetworkHelper with changes +// to better support the WebRequest api. The objects returned are formatted specifically +// to pass through as part of a response to webRequest listeners. + +const SecurityInfo = { + /** + * Extracts security information from nsIChannel.securityInfo. + * + * @param {nsIChannel} channel + * If null channel is assumed to be insecure. + * @param {Object} options + * + * @returns {Object} + * Returns an object containing following members: + * - state: The security of the connection used to fetch this + * request. Has one of following string values: + * * "insecure": the connection was not secure (only http) + * * "weak": the connection has minor security issues + * * "broken": secure connection failed (e.g. expired cert) + * * "secure": the connection was properly secured. + * If state == broken: + * - errorMessage: full error message from + * nsITransportSecurityInfo. + * If state == secure: + * - protocolVersion: one of TLSv1, TLSv1.1, TLSv1.2, TLSv1.3. + * - cipherSuite: the cipher suite used in this connection. + * - cert: information about certificate used in this connection. + * See parseCertificateInfo for the contents. + * - hsts: true if host uses Strict Transport Security, + * false otherwise + * - hpkp: true if host uses Public Key Pinning, false otherwise + * If state == weak: Same as state == secure and + * - weaknessReasons: list of reasons that cause the request to be + * considered weak. See getReasonsForWeakness. + */ + getSecurityInfo(channel, options = {}) { + const info = { + state: "insecure", + }; + + /** + * Different scenarios to consider here and how they are handled: + * - request is HTTP, the connection is not secure + * => securityInfo is null + * => state === "insecure" + * + * - request is HTTPS, the connection is secure + * => .securityState has STATE_IS_SECURE flag + * => state === "secure" + * + * - request is HTTPS, the connection has security issues + * => .securityState has STATE_IS_INSECURE flag + * => .errorCode is an NSS error code. + * => state === "broken" + * + * - request is HTTPS, the connection was terminated before the security + * could be validated + * => .securityState has STATE_IS_INSECURE flag + * => .errorCode is NOT an NSS error code. + * => .errorMessage is not available. + * => state === "insecure" + * + * - request is HTTPS but it uses a weak cipher or old protocol, see + * https://hg.mozilla.org/mozilla-central/annotate/def6ed9d1c1a/ + * security/manager/ssl/nsNSSCallbacks.cpp#l1233 + * - request is mixed content (which makes no sense whatsoever) + * => .securityState has STATE_IS_BROKEN flag + * => .errorCode is NOT an NSS error code + * => .errorMessage is not available + * => state === "weak" + */ + + let securityInfo = channel.securityInfo; + if (!securityInfo) { + return info; + } + + securityInfo.QueryInterface(Ci.nsITransportSecurityInfo); + securityInfo.QueryInterface(Ci.nsISSLStatusProvider); + + const SSLStatus = securityInfo.SSLStatus; + if (NSSErrorsService.isNSSErrorCode(securityInfo.errorCode)) { + // The connection failed. + info.state = "broken"; + info.errorMessage = securityInfo.errorMessage; + if (options.certificateChain && SSLStatus.failedCertChain) { + info.certificates = this.getCertificateChain(SSLStatus.failedCertChain, options); + } + return info; + } + + const state = securityInfo.securityState; + + let uri = channel.URI; + if (uri && !uri.schemeIs("https") && !uri.schemeIs("wss")) { + // it is not enough to look at the transport security info - + // schemes other than https and wss are subject to + // downgrade/etc at the scheme level and should always be + // considered insecure. + // Leave info.state = "insecure"; + } else if (state & wpl.STATE_IS_SECURE) { + // The connection is secure if the scheme is sufficient + info.state = "secure"; + } else if (state & wpl.STATE_IS_BROKEN) { + // The connection is not secure, there was no error but there's some + // minor security issues. + info.state = "weak"; + info.weaknessReasons = this.getReasonsForWeakness(state); + } else if (state & wpl.STATE_IS_INSECURE) { + // This was most likely an https request that was aborted before + // validation. Return info as info.state = insecure. + return info; + } else { + // No known STATE_IS_* flags. + return info; + } + + // Cipher suite. + info.cipherSuite = SSLStatus.cipherName; + + // Key exchange group name. + info.keaGroupName = SSLStatus.keaGroupName; + + // Certificate signature scheme. + info.signatureSchemeName = SSLStatus.signatureSchemeName; + + info.isDomainMismatch = SSLStatus.isDomainMismatch; + info.isExtendedValidation = SSLStatus.isExtendedValidation; + info.isNotValidAtThisTime = SSLStatus.isNotValidAtThisTime; + info.isUntrusted = SSLStatus.isUntrusted; + + info.certificateTransparencyStatus = this.getTransparencyStatus(SSLStatus.certificateTransparencyStatus); + + // Protocol version. + info.protocolVersion = this.formatSecurityProtocol(SSLStatus.protocolVersion); + + if (options.certificateChain && SSLStatus.succeededCertChain) { + info.certificates = this.getCertificateChain(SSLStatus.succeededCertChain, options); + } else { + info.certificates = [this.parseCertificateInfo(SSLStatus.serverCert, options)]; + } + + // HSTS and HPKP if available. + if (uri && uri.host) { + // SiteSecurityService uses different storage if the channel is + // private. Thus we must give isSecureURI correct flags or we + // might get incorrect results. + let flags = 0; + if (channel instanceof Ci.nsIPrivateBrowsingChannel && channel.isChannelPrivate) { + flags = Ci.nsISocketProvider.NO_PERMANENT_STORAGE; + } + + info.hsts = sss.isSecureURI(sss.HEADER_HSTS, uri, flags); + info.hpkp = sss.isSecureURI(sss.HEADER_HPKP, uri, flags); + } else { + info.hsts = false; + info.hpkp = false; + } + + return info; + }, + + getCertificateChain(certChain, options = {}) { + let certificates = []; + for (let cert of XPCOMUtils.IterSimpleEnumerator(certChain.getEnumerator(), Ci.nsIX509Cert)) { + certificates.push(this.parseCertificateInfo(cert, options)); + } + return certificates; + }, + + /** + * Takes an nsIX509Cert and returns an object with certificate information. + * + * @param {nsIX509Cert} cert + * The certificate to extract the information from. + * @param {Object} options + * @returns {Object} + * An object with following format: + * { + * subject: subjectName, + * issuer: issuerName, + * validity: { start, end }, + * fingerprint: { sha1, sha256 } + * } + */ + parseCertificateInfo(cert, options = {}) { + if (!cert) { + return {}; + } + + let certData = { + subject: cert.subjectName, + issuer: cert.issuerName, + validity: { + startGMT: cert.validity.notBeforeGMT, + endGMT: cert.validity.notAfterGMT, + }, + fingerprint: { + sha1: cert.sha1Fingerprint, + sha256: cert.sha256Fingerprint, + }, + serialNumber: cert.serialNumber, + isBuiltInRoot: cert.isBuiltInRoot, + subjectPublicKeyInfoDigest: { + sha256: cert.sha256SubjectPublicKeyInfoDigest, + }, + keyUsages: cert.keyUsages, + }; + if (options.rawDER) { + certData.rawDER = cert.getRawDER({}); + } + return certData; + }, + + // Bug 1355903 Transparency is currently disabled using security.pki.certificate_transparency.mode + getTransparencyStatus(status) { + switch (status) { + case Ci.nsISSLStatus.CERTIFICATE_TRANSPARENCY_NOT_APPLICABLE: + return "not_applicable"; + case Ci.nsISSLStatus.CERTIFICATE_TRANSPARENCY_POLICY_COMPLIANT: + return "policy_compliant"; + case Ci.nsISSLStatus.CERTIFICATE_TRANSPARENCY_POLICY_NOT_ENOUGH_SCTS: + return "policy_not_enough_scts"; + case Ci.nsISSLStatus.CERTIFICATE_TRANSPARENCY_POLICY_NOT_DIVERSE_SCTS: + return "policy_not_diverse_scts"; + } + return "unknown"; + }, + + /** + * Takes protocolVersion of SSLStatus object and returns human readable + * description. + * + * @param {number} version + * One of nsISSLStatus version constants. + * @returns {string} + * One of TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 if version + * is valid, Unknown otherwise. + */ + formatSecurityProtocol(version) { + switch (version) { + case Ci.nsISSLStatus.TLS_VERSION_1: + return "TLSv1"; + case Ci.nsISSLStatus.TLS_VERSION_1_1: + return "TLSv1.1"; + case Ci.nsISSLStatus.TLS_VERSION_1_2: + return "TLSv1.2"; + case Ci.nsISSLStatus.TLS_VERSION_1_3: + return "TLSv1.3"; + } + return "unknown"; + }, + + /** + * Takes the securityState bitfield and returns reasons for weak connection + * as an array of strings. + * + * @param {number} state + * nsITransportSecurityInfo.securityState. + * + * @returns {array<string>} + * List of weakness reasons. A subset of { cipher } where + * * cipher: The cipher suite is consireded to be weak (RC4). + */ + getReasonsForWeakness(state) { + // If there's non-fatal security issues the request has STATE_IS_BROKEN + // flag set. See https://hg.mozilla.org/mozilla-central/file/44344099d119 + // /security/manager/ssl/nsNSSCallbacks.cpp#l1233 + let reasons = []; + + if (state & wpl.STATE_IS_BROKEN) { + if (state & wpl.STATE_USES_WEAK_CRYPTO) { + reasons.push("cipher"); + } + } + + return reasons; + }, +}; diff --git a/toolkit/modules/addons/WebRequest.jsm b/toolkit/modules/addons/WebRequest.jsm index 786a2d5dbe91..a4c9e9859a21 100644 --- a/toolkit/modules/addons/WebRequest.jsm +++ b/toolkit/modules/addons/WebRequest.jsm @@ -15,14 +15,12 @@ const {nsIHttpActivityObserver, nsISocketTransport} = Ci; ChromeUtils.import("resource://gre/modules/Services.jsm"); ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm"); -ChromeUtils.defineModuleGetter(this, "ExtensionUtils", - "resource://gre/modules/ExtensionUtils.jsm"); -ChromeUtils.defineModuleGetter(this, "WebRequestCommon", - "resource://gre/modules/WebRequestCommon.jsm"); -ChromeUtils.defineModuleGetter(this, "WebRequestUpload", - "resource://gre/modules/WebRequestUpload.jsm"); - -XPCOMUtils.defineLazyGetter(this, "ExtensionError", () => ExtensionUtils.ExtensionError); +XPCOMUtils.defineLazyModuleGetters(this, { + ExtensionUtils: "resource://gre/modules/ExtensionUtils.jsm", + WebRequestCommon: "resource://gre/modules/WebRequestCommon.jsm", + WebRequestUpload: "resource://gre/modules/WebRequestUpload.jsm", + SecurityInfo: "resource://gre/modules/SecurityInfo.jsm", +}); function runLater(job) { Services.tm.dispatchToMainThread(job); @@ -41,7 +39,7 @@ function parseExtra(extra, allowed = [], optionsObj = {}) { if (extra) { for (let ex of extra) { if (!allowed.includes(ex)) { - throw new ExtensionError(`Invalid option ${ex}`); + throw new ExtensionUtils.ExtensionError(`Invalid option ${ex}`); } } } @@ -1011,6 +1009,11 @@ var WebRequest = { // nsIHttpActivityObserver. onErrorOccurred: onErrorOccurred, + + getSecurityInfo: (details) => { + let channel = ChannelWrapper.getRegisteredChannel(details.id, details.extension, details.tabParent); + return SecurityInfo.getSecurityInfo(channel.channel, details.options); + }, }; Services.ppmm.loadProcessScript("resource://gre/modules/WebRequestContent.js", true); diff --git a/toolkit/modules/moz.build b/toolkit/modules/moz.build index 110fff7737f2..0a1e48b964c1 100644 --- a/toolkit/modules/moz.build +++ b/toolkit/modules/moz.build @@ -167,6 +167,7 @@ with Files('docs/**'): EXTRA_JS_MODULES += [ 'addons/MatchURLFilters.jsm', + 'addons/SecurityInfo.jsm', 'addons/WebNavigation.jsm', 'addons/WebNavigationContent.js', 'addons/WebNavigationFrames.jsm',

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1322748 add ability to get registered channelwrappers, r=kmag
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit c1774ae7fc74bef7956caca4fe1b8de1365f5d48 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Tue May 22 14:19:57 2018 -0400 Bug 1322748 add ability to get registered channelwrappers, r=kmag MozReview-Commit-ID: SphwWjzQuo --HG-- extra : rebase_source : 0b5193d7f4e9e7f27f9a7d622699b673781c3dd4 --- dom/chrome-webidl/ChannelWrapper.webidl | 8 ++++++++ .../extensions/webrequest/ChannelWrapper.cpp | 18 ++++++++++++++++++ .../components/extensions/webrequest/ChannelWrapper.h | 2 +- 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/dom/chrome-webidl/ChannelWrapper.webidl b/dom/chrome-webidl/ChannelWrapper.webidl index b8d921cea58d..2777aab65c8e 100644 --- a/dom/chrome-webidl/ChannelWrapper.webidl +++ b/dom/chrome-webidl/ChannelWrapper.webidl @@ -49,6 +49,14 @@ interface ChannelWrapper : EventTarget { static ChannelWrapper get(MozChannel channel); /** + * Returns the wrapper instance for the given channel. The same wrapper is + * always returned for a given channel. + */ + static ChannelWrapper getRegisteredChannel(unsigned long long aChannelId, + WebExtensionPolicy extension, + TabParent? tabParent); + + /** * A unique ID for for the requests which remains constant throughout the * redirect chain. */ diff --git a/toolkit/components/extensions/webrequest/ChannelWrapper.cpp b/toolkit/components/extensions/webrequest/ChannelWrapper.cpp index de4a7fee1a2a..52508f0f24ed 100644 --- a/toolkit/components/extensions/webrequest/ChannelWrapper.cpp +++ b/toolkit/components/extensions/webrequest/ChannelWrapper.cpp @@ -78,6 +78,24 @@ ChannelWrapper::Get(const GlobalObject& global, nsIChannel* channel) return wrapper.forget(); } +already_AddRefed<ChannelWrapper> +ChannelWrapper::GetRegisteredChannel(const GlobalObject& global, uint64_t aChannelId, const WebExtensionPolicy& aAddon, nsITabParent* aTabParent) +{ + nsIContentParent* contentParent = nullptr; + if (TabParent* parent = static_cast<TabParent*>(aTabParent)) { + contentParent = static_cast<nsIContentParent*>(parent->Manager()); + } + + auto& webreq = WebRequestService::GetSingleton(); + + nsCOMPtr<nsITraceableChannel> channel = webreq.GetTraceableChannel(aChannelId, aAddon.Id(), contentParent); + if (!channel) { + return nullptr; + } + nsCOMPtr<nsIChannel> chan(do_QueryInterface(channel)); + return ChannelWrapper::Get(global, chan); +} + void ChannelWrapper::SetChannel(nsIChannel* aChannel) { diff --git a/toolkit/components/extensions/webrequest/ChannelWrapper.h b/toolkit/components/extensions/webrequest/ChannelWrapper.h index 8ba238991070..750aed434f6a 100644 --- a/toolkit/components/extensions/webrequest/ChannelWrapper.h +++ b/toolkit/components/extensions/webrequest/ChannelWrapper.h @@ -121,7 +121,7 @@ public: NS_DECLARE_STATIC_IID_ACCESSOR(NS_CHANNELWRAPPER_IID) static already_AddRefed<extensions::ChannelWrapper> Get(const dom::GlobalObject& global, nsIChannel* channel); - + static already_AddRefed<extensions::ChannelWrapper> GetRegisteredChannel(const dom::GlobalObject& global, uint64_t aChannelId, const WebExtensionPolicy& aAddon, nsITabParent* aTabParent); uint64_t Id() const { return mId; }

1 0

[torbutton/master] Bug 28540: Use new text for 2018 donation banner
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit 4ad39b362dd7692b5e24841c616f63a5ca2bc67a Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Nov 20 17:25:48 2018 -0800 Bug 28540: Use new text for 2018 donation banner --- src/chrome/content/aboutTor/aboutTor-content.js | 2 +- src/chrome/content/aboutTor/aboutTor.xhtml | 24 +++++++++++++++--------- src/chrome/content/torbutton.js | 2 +- src/defaults/preferences/preferences.js | 2 +- 4 files changed, 18 insertions(+), 12 deletions(-) diff --git a/src/chrome/content/aboutTor/aboutTor-content.js b/src/chrome/content/aboutTor/aboutTor-content.js index d34bbe5c..e53266bd 100644 --- a/src/chrome/content/aboutTor/aboutTor-content.js +++ b/src/chrome/content/aboutTor/aboutTor-content.js @@ -72,7 +72,7 @@ var AboutTorListener = { sendAsyncMessage(that.kAboutTorHideDonationBanner); }); }); - bindPrefAndInit("extensions.torbutton.donation_banner_countdown", + bindPrefAndInit("extensions.torbutton.donation_banner_countdown2", countdown => { if (content.document && content.document.body) { content.document.body.setAttribute( diff --git a/src/chrome/content/aboutTor/aboutTor.xhtml b/src/chrome/content/aboutTor/aboutTor.xhtml index 94dd13f3..5f5fccdc 100644 --- a/src/chrome/content/aboutTor/aboutTor.xhtml +++ b/src/chrome/content/aboutTor/aboutTor.xhtml @@ -37,15 +37,17 @@ window.addEventListener("pageshow", function() { <div id="donation-banner-lines"> <div id="donation-banner-line1">&aboutTor.donationBanner.line1;</div> <div id="donation-banner-line2" - data-0="&aboutTor.donationBanner.line2a;" - data-1="&aboutTor.donationBanner.line2b;" - data-2="&aboutTor.donationBanner.line2c;" - data-3="&aboutTor.donationBanner.line2d;" - data-4="&aboutTor.donationBanner.line2e;" - data-5="&aboutTor.donationBanner.line2f;"> - &aboutTor.donationBanner.line2a; + data-6="&aboutTor.donationBanner.line2e;" + data-7="&aboutTor.donationBanner.line2f;" + data-8="&aboutTor.donationBanner.line2g;" + data-9="&aboutTor.donationBanner.line2h;" + data-10="&aboutTor.donationBanner.line2i;" + data-11="&aboutTor.donationBanner.line2j;"> + &aboutTor.donationBanner.line2e; </div> - <div id="donation-banner-line3">&aboutTor.donationBanner.line3;</div> + <div id="donation-banner-line3" + data-b="&aboutTor.donationBanner.line3b;"> + &aboutTor.donationBanner.line3;</div> <a id="donation-banner-button" href="https://www.torproject.org/donate/donate-sin-tbd0-0" type="button" @@ -58,13 +60,17 @@ window.addEventListener("pageshow", function() { </div> <script type="text/javascript"> <![CDATA[ - let lineChoice = Math.floor(Math.random() * 6); + let lineChoice = 6 + Math.floor(Math.random() * 6); let line2 = document.getElementById("donation-banner-line2"); let line2text = line2.getAttribute(`data-${lineChoice}`); let line2pieces = line2text.split(" "); let line2end = '<span>' + line2pieces.pop() + '</span>'; line2pieces.push(line2end); line2.innerHTML = line2pieces.join(" "); + line3 = document.getElementById("donation-banner-line3"); + if (lineChoice === 11) { + line3.innerHTML = line3.getAttribute("data-b"); + } let buttonChoice = Math.floor(Math.random() * 2); let button = document.getElementById("donation-banner-button"); button.innerHTML = button.getAttribute(`data-${buttonChoice}`); diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index ee13f461..8bd847f9 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -17,7 +17,7 @@ const k_tb_last_browser_version_pref = "extensions.torbutton.lastBrowserVersion" const k_tb_browser_update_needed_pref = "extensions.torbutton.updateNeeded"; const k_tb_last_update_check_pref = "extensions.torbutton.lastUpdateCheck"; const k_tb_tor_check_failed_topic = "Torbutton:TorCheckFailed"; -const k_tb_donation_banner_countdown = "extensions.torbutton.donation_banner_countdown"; +const k_tb_donation_banner_countdown = "extensions.torbutton.donation_banner_countdown2"; var m_tb_prefs = Services.prefs; diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 9beb3993..eb055a65 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -6,7 +6,7 @@ pref("extensions.torbutton.logmethod",1); // 0=stdout, 1=errorconsole, 2=debuglo pref("extensions.torbutton.display_circuit", true); pref("extensions.torbutton(a)torproject.org.description", "chrome://torbutton/locale/torbutton.properties"); pref("extensions.torbutton.updateNeeded", false); -pref("extensions.torbutton.donation_banner_countdown", 12); +pref("extensions.torbutton.donation_banner_countdown2", 12); // Tor check and proxy prefs pref("extensions.torbutton.test_enabled",true);

1 0

[tor-browser-build/master] Update OpenSSL to 1.0.2q
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit 30c764db2bbbde93ebee67e2b190a4d9c88873b9 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Dec 3 08:06:40 2018 +0000 Update OpenSSL to 1.0.2q --- projects/openssl/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/openssl/config b/projects/openssl/config index d3ed959..e91e820 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.0.2p +version: 1.0.2q filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: @@ -26,4 +26,4 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: 50a98e07b1a89eb8f6a99477f262df71c6fa7bef77df4dc83025a2845c827d00 + sha256sum: 5744cfcbcec2b1b48629f7354203bc1e5e9b5466998bbccc5b5fcde3b18eb684

1 0

[tor-browser-build/master] Tagging build2
by gk＠torproject.org 01 Dec '18

01 Dec '18

commit c1667c29be45ba7296dae3e268115137c4f687a5 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Dec 1 13:50:15 2018 +0000 Tagging build2 --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 5d1d861..0d53855 100644 --- a/rbm.conf +++ b/rbm.conf @@ -16,7 +16,7 @@ buildconf: var: torbrowser_version: '8.5a5' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 8.5a4 project_name: tor-browser

1 0

[tor-browser-build/master] Bug 28677: Copy all the bundles for our releases
by gk＠torproject.org 01 Dec '18

01 Dec '18

commit e9a2fc5a9d9ee5571ca6daf94ac367e14732cd50 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Dec 1 13:33:54 2018 +0000 Bug 28677: Copy all the bundles for our releases --- projects/release/build | 1 - 1 file changed, 1 deletion(-) diff --git a/projects/release/build b/projects/release/build index 2c9912f..e7c7410 100644 --- a/projects/release/build +++ b/projects/release/build @@ -6,7 +6,6 @@ destdir="[% dest_dir _ '/' _ c("var/publish_dir") %]" mkdir -p "$destdir" [% IF c("var/torbrowser-android-armv7") -%] mv [% c('input_files_by_name/android-armv7') %]/* "$destdir"/ - [% RETURN %] [% END -%] [% IF c("var/torbrowser-windows-i686") -%] mv [% c('input_files_by_name/windows-i686') %]/* "$destdir"/

1 0

[tor-browser-build/master] Bug 28185: Add smallerRichard to Tor Browser
by gk＠torproject.org 30 Nov '18

30 Nov '18

commit 03883ab8278cbc49deee0ee3285a2de4d215a929 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Nov 29 16:15:07 2018 +0000 Bug 28185: Add smallerRichard to Tor Browser --- projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js index ec76ce7..f58eb02 100644 --- a/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/projects/tor-browser/Bundle-Data/PTConfigs/bridge_prefs.js @@ -39,6 +39,7 @@ pref("extensions.torlauncher.default_bridge.obfs4.24", "obfs4 37.218.245.14:3822 pref("extensions.torlauncher.default_bridge.obfs4.25", "obfs4 85.31.186.98:443 011F2599C0E9B27EE74B353155E244813763C3E5 cert=ayq0XzCwhpdysn5o0EyDUbmSOx3X/oTEbzDMvczHOdBJKlvIdHHLJGkZARtT4dcBFArPPg iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.26", "obfs4 85.31.186.26:443 91A6354697E6B02A386312F68D82CF86824D3606 cert=PBwr+S8JTVZo6MPdHnkTwXJPILWADLqfMGoVvhZClMq/Urndyd42BwX9YFJHZnBB3H0XCw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.27", "obfs4 216.252.162.21:46089 0DB8799466902192B6C7576D58D4F7F714EC87C1 cert=XPUwcQPxEXExHfJYX58gZXN7mYpos7VNAHbkgERNFg+FCVNzuYo1Wp+uMscl3aR9hO2DRQ iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.28", "obfs4 144.217.20.138:80 FB70B257C162BF1038CA669D568D76F5B7F0BABB cert=vYIV5MgrghGQvZPIi1tJwnzorMgqgmlKaB77Y3Z9Q/v94wZBOAXkW+fdx4aSxLVnKO+xNw iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor-browser-build/master] Release preparations for 8.5a5
by gk＠torproject.org 30 Nov '18

30 Nov '18

commit 7b2b5ae4bac7863075fac61259328c9577e87475 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 30 07:28:43 2018 +0000 Release preparations for 8.5a5 Versions bump and Changelog update --- projects/firefox/config | 2 +- projects/https-everywhere/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 58 ++++++++++++++++++++++ projects/tor-browser/config | 4 +- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- projects/torbutton/config | 2 +- rbm.conf | 6 +-- 8 files changed, 68 insertions(+), 10 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 68918d9..81416a2 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 diff --git a/projects/https-everywhere/config b/projects/https-everywhere/config index e189eb9..b0b3ce9 100644 --- a/projects/https-everywhere/config +++ b/projects/https-everywhere/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2018.9.19 +version: 2018.10.31 git_url: https://git.torproject.org/https-everywhere.git git_hash: '[% c("version") %]' git_submodule: 1 diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 3bd05ed..5c3732b 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,61 @@ +Tor Browser 8.5a5 -- December 3 2018 + * All Platforms + * Update Torbutton to 2.1.2 + * Bug 25013: Integrate Torbutton into tor-browser for Android + * Bug 27111: Update about:tor desktop version to work on mobile + * Bug 28093: Update donation banner style to make it fit in small screens + * Bug 28543: about:tor has scroll bar between widths 900px and 1000px + * Bug 28039: Enable dump() if log method is 0 + * Bug 27701: Don't show App Blocker dialog on Android + * Bug 28187: Change tor circuit icon to torbutton.svg + * Bug 28515: Use en-US for english Torbutton strings + * Translations update + * Update Tor Launcher to 0.2.18 + * Bug 28039: Enable dump() if log method is 0 + * Translations update + * Update HTTPS Everywhere to 2018.10.31 + * Update NoScript to 10.2.0 + * Bug 22343: Make 'Save Page As' obey first-party isolation + * Bug 26540: Enabling pdfjs disableRange option prevents pdfs from loading + * Windows + * Update Tor to 0.3.5.5-alpha + * Bug 28310: Don't build obfs4 with module versioning support + * Bug 27827: Update Go to 1.11.1 + * Bug 28185: Add smallerRichard to Tor Browser + * Bug 28657: Remove broken FTE bridge from Tor Browser + * OS X + * Update Tor to 0.3.5.5-alpha + * Bug 28310: Don't build obfs4 with module versioning support + * Bug 27827: Update Go to 1.11.1 + * Bug 27827: Build snowflake reproducibly + * Bug 28258: Don't look for webrtc headers under talk/ + * Bug 28185: Add smallerRichard to Tor Browser + * Linux + * Update Tor to 0.3.5.5-alpha + * Bug 28310: Don't build obfs4 with module versioning support + * Bug 27827: Update Go to 1.11.1 + * Bug 27827: Build snowflake reproducibly + * Bug 28258: Don't look for webrtc headers under talk/ + * Bug 28185: Add smallerRichard to Tor Browser + * Bug 28657: Remove broken FTE bridge from Tor Browser + * Android + * Bug 28051: Fix up Orbot for inclusion into Tor Browser + * Bug 26690+25765: Port padlock states for .onion serices to mobile + * Bug 28507: Delete private data in the browser startup + * Bug 27111+25013: Configure Tor Browser for mobile to load about:tor + * Bug 27256: Enable TouchEvents on Android + * Bug 28640: Use system add-on and distributed preferences + * Build System + * Bug 27977: Build Orbot inside tor-browser-build + * Bug 27443: Update Firefox RBM config and build for Android + * Bug 27439: Add android target for rust compiler + * Bug 28469: Fix unsupported libbacktrace in Rust 1.26 + * Bug 28468: Modify Android toolchain to support Orbot + * Bug 28483: Modify Android Toolchain API Version + * Bug 28472: Add Android Makefile Rules + * Bug 28470: Add fetch gradle dependency script to common project + * Bug 28144: Update projects/tor-browser for Android + Tor Browser 8.5a4 -- October 23 2018 * All Platforms * Update Firefox to 60.3.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index e4e3a03..149b800 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -84,9 +84,9 @@ input_files: enable: '[% c("var/snowflake") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: e7ec0345c2174e64c7552ab708a59c8efd7c1078fedda64d9c9ad06a899194b9 + sha256sum: 23c7783eecabeb044aa1e38c93d43ce7c41957b1ea031016d39737712729c81d - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index ff5b387..4f2d2b7 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.17 +version: 0.2.18 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index cc6df23..4ba18d9 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.5.3-alpha +version: 0.3.5.5-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git git_submodule: 1 diff --git a/projects/torbutton/config b/projects/torbutton/config index b4d50be..2e48f31 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.1.1 +version: 2.1.2 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 87fe179..5d1d861 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '8.5a4' - torbrowser_build: 'build2' + torbrowser_version: '8.5a5' + torbrowser_build: 'build1' torbrowser_incremental_from: - - 8.5a3 + - 8.5a4 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Picking up latest Torbutton commits
by gk＠torproject.org 30 Nov '18

30 Nov '18

commit 8bc2ca14f51f4b57efcadd6f7405e0a4d48f2204 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Nov 30 07:22:59 2018 +0000 Picking up latest Torbutton commits --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index a41034ced7a6..68ad9e3d555d 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit a41034ced7a6c0fe590320d9da61d15df1fef42f +Subproject commit 68ad9e3d555d18d894c2ae0a1e8b3e797642ff54

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 28640 - Push notifications are disabled, so don't clear them
by gk＠torproject.org 30 Nov '18

30 Nov '18

commit 10ca4718681668db7b0bdba0e3dd207dbe352cd8 Author: Matthew Finkel <Matthew.Finkel(a)gmail.com> Date: Fri Nov 30 04:51:05 2018 +0000 Bug 28640 - Push notifications are disabled, so don't clear them This is a result of 28507. The new logic caused the stack trace: : ************************* : A coding exception was thrown and uncaught in a Task. : : Full message: TypeError: Cc['@mozilla.org/push/Service;1'] is undefined : Full stack: Sanitizer.prototype.items.siteSettings.clear</<@resource://gre/modules/Sanitizer.jsm:128:15 : Sanitizer.prototype.items.siteSettings.clear<@resource://gre/modules/Sanitizer.jsm:127:15 : TaskImpl_run@resource://gre/modules/Task.jsm:326:42 : TaskImpl@resource://gre/modules/Task.jsm:275:3 : asyncFunction@resource://gre/modules/Task.jsm:247:14 : _clear@resource://gre/modules/Sanitizer.jsm:59:14 : clearItem@resource://gre/modules/Sanitizer.jsm:40:14 : sanitize@chrome://browser/content/browser.js:1566:25 : onEvent@chrome://browser/content/browser.js:1787:9 : : ************************* --- mobile/android/modules/Sanitizer.jsm | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/mobile/android/modules/Sanitizer.jsm b/mobile/android/modules/Sanitizer.jsm index 3782c92172f9..2940dd81b217 100644 --- a/mobile/android/modules/Sanitizer.jsm +++ b/mobile/android/modules/Sanitizer.jsm @@ -124,18 +124,23 @@ Sanitizer.prototype = { sss.clearAll(); // Clear push subscriptions + // Avoid throwing an error because nsIPushService isn't implemented yield new Promise((resolve, reject) => { - let push = Cc["@mozilla.org/push/Service;1"] - .getService(Ci.nsIPushService); - push.clearForDomain("*", status => { - if (Components.isSuccessCode(status)) { - resolve(); - } else { - reject(new Error("Error clearing push subscriptions: " + - status)); - } - }); + reject(new Error("Error clearing push subscriptions")); }); + + //yield new Promise((resolve, reject) => { + // let push = Cc["@mozilla.org/push/Service;1"] + // .getService(Ci.nsIPushService); + // push.clearForDomain("*", status => { + // if (Components.isSuccessCode(status)) { + // resolve(); + // } else { + // reject(new Error("Error clearing push subscriptions: " + + // status)); + // } + // }); + //}); TelemetryStopwatch.finish("FX_SANITIZE_SITESETTINGS", refObj); }),

1 0