- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-60.2.0esr-8.5-1] Bug 1475775 - Clean up old NSS DB file after upgrade if necessary. r=franziskus, r=mattn, a=RyanVM
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit e47b36fb220d31308765559a6ae09045ffebbf8f Author: David Keeler <dkeeler(a)mozilla.com> Date: Tue Jul 17 13:51:00 2018 -0700 Bug 1475775 - Clean up old NSS DB file after upgrade if necessary. r=franziskus, r=mattn, a=RyanVM Reviewers: franziskus, mattn Bug #: 1475775 Differential Revision: https://phabricator.services.mozilla.com/D2202 --HG-- rename : security/manager/ssl/tests/unit/test_sdr_preexisting_with_password.js => security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js rename : security/manager/ssl/tests/unit/test_sdr_preexisting_with_password/key3.db => security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db extra : source : 26ac31d53e50217dff8829e6d9bae18c7e36b812 extra : intermediate-source : 1e05e8939a189df7b3d8309ad7936079ec012057 --- security/manager/ssl/nsNSSComponent.cpp | 48 +++++++++ .../tests/unit/test_sdr_upgraded_with_password.js | 115 +++++++++++++++++++++ .../unit/test_sdr_upgraded_with_password/cert8.db | Bin 0 -> 65536 bytes .../unit/test_sdr_upgraded_with_password/cert9.db | Bin 0 -> 229376 bytes .../unit/test_sdr_upgraded_with_password/key3.db | Bin 0 -> 16384 bytes .../unit/test_sdr_upgraded_with_password/key4.db | Bin 0 -> 294912 bytes security/manager/ssl/tests/unit/xpcshell.ini | 4 + 7 files changed, 167 insertions(+) diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp index da5dd60222ad..5d887f99dde0 100644 --- a/security/manager/ssl/nsNSSComponent.cpp +++ b/security/manager/ssl/nsNSSComponent.cpp @@ -1940,6 +1940,51 @@ AttemptToRenameBothPKCS11ModuleDBVersions(const nsACString& profilePath) } return AttemptToRenamePKCS11ModuleDB(profilePath, sqlModuleDBFilename); } + +// When we changed from the old dbm database format to the newer sqlite +// implementation, the upgrade process left behind the existing files. Suppose a +// user had not set a password for the old key3.db (which is about 99% of +// users). After upgrading, both the old database and the new database are +// unprotected. If the user then sets a password for the new database, the old +// one will not be protected. In this scenario, we should probably just remove +// the old database (it would only be relevant if the user downgraded to a +// version of Firefox before 58, but we have to trade this off against the +// user's old private keys being unexpectedly unprotected after setting a +// password). +// This was never an issue on Android because we always used the new +// implementation. +static void +MaybeCleanUpOldNSSFiles(const nsACString& profilePath) +{ + UniquePK11SlotInfo slot(PK11_GetInternalKeySlot()); + if (!slot) { + return; + } + // Unfortunately we can't now tell the difference between "there already was a + // password when the upgrade happened" and "there was not a password but then + // the user added one after upgrading". + bool hasPassword = PK11_NeedLogin(slot.get()) && + !PK11_NeedUserInit(slot.get()); + if (!hasPassword) { + return; + } + nsCOMPtr<nsIFile> dbFile = do_CreateInstance("@mozilla.org/file/local;1"); + if (!dbFile) { + return; + } + nsresult rv = dbFile->InitWithNativePath(profilePath); + if (NS_FAILED(rv)) { + return; + } + NS_NAMED_LITERAL_CSTRING(keyDBFilename, "key3.db"); + rv = dbFile->AppendNative(keyDBFilename); + if (NS_FAILED(rv)) { + return; + } + // Since this isn't a directory, the `recursive` argument to `Remove` is + // irrelevant. + Unused << dbFile->Remove(false); +} #endif // ifndef ANDROID // Given a profile directory, attempt to initialize NSS. If nocertdb is true, @@ -1971,6 +2016,9 @@ InitializeNSSWithFallbacks(const nsACString& profilePath, bool nocertdb, SECStatus srv = ::mozilla::psm::InitializeNSS(profilePath, false, !safeMode); if (srv == SECSuccess) { MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("initialized NSS in r/w mode")); +#ifndef ANDROID + MaybeCleanUpOldNSSFiles(profilePath); +#endif // ifndef ANDROID return NS_OK; } #ifndef ANDROID diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js new file mode 100644 index 000000000000..4949c2cf7956 --- /dev/null +++ b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js @@ -0,0 +1,115 @@ +// -*- indent-tabs-mode: nil; js-indent-level: 2 -*- +// This Source Code Form is subject to the terms of the Mozilla Public +// License, v. 2.0. If a copy of the MPL was not distributed with this +// file, You can obtain one at http://mozilla.org/MPL/2.0/. + +"use strict"; + +// Tests that the SDR implementation is able to decrypt strings encrypted using +// a preexisting NSS key database that a) has a password and b) has already been +// upgraded from the old dbm format in a previous run of Firefox. +// To create such a database, run the xpcshell test +// `test_sdr_preexisting_with_password.js` and locate the file `key4.db` created +// in the xpcshell test profile directory. +// This does not apply to Android as the dbm implementation was never enabled on +// that platform. + +var gMockPrompter = { + passwordToTry: "password", + numPrompts: 0, + + // This intentionally does not use arrow function syntax to avoid an issue + // where in the context of the arrow function, |this != gMockPrompter| due to + // how objects get wrapped when going across xpcom boundaries. + promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + this.numPrompts++; + if (this.numPrompts > 1) { // don't keep retrying a bad password + return false; + } + equal(text, + "Please enter your master password.", + "password prompt text should be as expected"); + equal(checkMsg, null, "checkMsg should be null"); + ok(this.passwordToTry, "passwordToTry should be non-null"); + password.value = this.passwordToTry; + return true; + }, + + QueryInterface: XPCOMUtils.generateQI([Ci.nsIPrompt]), +}; + +// Mock nsIWindowWatcher. PSM calls getNewPrompter on this to get an nsIPrompt +// to call promptPassword. We return the mock one, above. +var gWindowWatcher = { + getNewPrompter: () => gMockPrompter, + QueryInterface: XPCOMUtils.generateQI([Ci.nsIWindowWatcher]), +}; + +function run_test() { + let windowWatcherCID = + MockRegistrar.register("@mozilla.org/embedcomp/window-watcher;1", + gWindowWatcher); + registerCleanupFunction(() => { + MockRegistrar.unregister(windowWatcherCID); + }); + + let profile = do_get_profile(); + let key3DBFile = do_get_file("test_sdr_upgraded_with_password/key3.db"); + key3DBFile.copyTo(profile, "key3.db"); + let key4DBFile = do_get_file("test_sdr_upgraded_with_password/key4.db"); + key4DBFile.copyTo(profile, "key4.db"); + // Unfortunately we have to also copy the certificate databases as well. + // Otherwise, NSS will think it has to create them, which will cause NSS to + // think it has to also do a migration, which will open key3.db and not close + // it until shutdown, which means that on Windows removing the file just after + // startup fails. Luckily users profiles will have both key and certificate + // databases anyway, so this is an accurate reflection of normal use. + let cert8DBFile = do_get_file("test_sdr_upgraded_with_password/cert8.db"); + cert8DBFile.copyTo(profile, "cert8.db"); + let cert9DBFile = do_get_file("test_sdr_upgraded_with_password/cert9.db"); + cert9DBFile.copyTo(profile, "cert9.db"); + + let sdr = Cc["@mozilla.org/security/sdr;1"] + .getService(Ci.nsISecretDecoderRing); + + let testcases = [ + // a full padding block + { ciphertext: "MDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECGeDHwVfyFqzBBAYvqMq/kDMsrARVNdC1C8d", + plaintext: "password" }, + // 7 bytes of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECCAzLDVmYG2/BAh3IoIsMmT8dQ==", + plaintext: "a" }, + // 6 bytes of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECPN8zlZzn8FdBAiu2acpT8UHsg==", + plaintext: "bb" }, + // 1 byte of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECD5px1eMKkJQBAgUPp35GlrDvQ==", + plaintext: "!seven!" }, + // 2 bytes of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECMh0hLtKDyUdBAixw9UZsMt+vA==", + plaintext: "sixsix" }, + // long plaintext requiring more than two blocks + { ciphertext: "MFoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECDRX1qi+/FX1BDATFIcIneQjvBuq3wdFxzllJt2VtUD69ACdOKAXH3eA87oHDvuHqOeCDwRy4UzoG5s=", + plaintext: "thisismuchlongerandsotakesupmultipleblocks" }, + // this differs from the previous ciphertext by one bit and demonstrates + // that this implementation does not enforce message integrity + { ciphertext: "MFoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECDRX1qi+/FX1BDAbFIcIneQjvBuq3wdFxzllJt2VtUD69ACdOKAXH3eA87oHDvuHqOeCDwRy4UzoG5s=", + plaintext: "nnLbuwLRkhlongerandsotakesupmultipleblocks" }, + ]; + + for (let testcase of testcases) { + let decrypted = sdr.decryptString(testcase.ciphertext); + equal(decrypted, testcase.plaintext, + "decrypted ciphertext should match expected plaintext"); + } + equal(gMockPrompter.numPrompts, 1, + "Should have been prompted for a password once"); + + // NSS does not close the old database when performing an upgrade. Thus, on + // Windows, we can't delete the old database file on the run that we perform + // an upgrade. However, we can delete it on subsequent runs. + let key3DBInProfile = do_get_profile(); + key3DBInProfile.append("key3.db"); + ok(!key3DBInProfile.exists(), + "key3.db should not exist after running with key4.db with a password"); +} diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert8.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert8.db new file mode 100644 index 000000000000..ac40a3325724 Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert8.db differ diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert9.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert9.db new file mode 100644 index 000000000000..163d07a6f325 Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert9.db differ diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db new file mode 100644 index 000000000000..cac0808ac32c Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db differ diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key4.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key4.db new file mode 100644 index 000000000000..8c853543cc3e Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key4.db differ diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini index 5e5a1190f170..db865f6757bb 100644 --- a/security/manager/ssl/tests/unit/xpcshell.ini +++ b/security/manager/ssl/tests/unit/xpcshell.ini @@ -32,6 +32,7 @@ support-files = test_pinning_dynamic/** test_sdr_preexisting/** test_sdr_preexisting_with_password/** + test_sdr_upgraded_with_password/** test_signed_apps/** test_signed_dir/** test_startcom_wosign/** @@ -153,6 +154,9 @@ requesttimeoutfactor = 2 [test_sdr_preexisting_with_password.js] # Not relevant to Android. See the comment in the test. skip-if = toolkit == 'android' +[test_sdr_upgraded_with_password.js] +# Not relevant to Android. See the comment in the test. +skip-if = toolkit == 'android' [test_session_resumption.js] run-sequentially = hardcoded ports [test_signed_apps.js]

1 0

[tor-browser-build/maint-8.0] Preparing a build2 for 8.0.1
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit eaf882ad3dd1c5fc2461d5ba898837de1eed66eb Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 20 08:24:35 2018 +0000 Preparing a build2 for 8.0.1 We pick up three patches that are planned for Firefox 60.2.1esr but we can't wait for the final release candidate as we run out of time before Mexico. Furthermore, back out the moat related fix in Tor Launcher. We want to give it a bit more testing time on alpha. --- projects/firefox/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++-- rbm.conf | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index ad9d7d8..9d675eb 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build4' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build5' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 4cc90f3..12ae6ff 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -11,9 +11,8 @@ Tor Browser 8.0.1 -- September 20 2018 * Bug 27427: Fix NoScript IPC for about:blank by whitelisting messages * Bug 27558: Update the link to "Your Guard note may not change" text * Translations update - * Update Tor Launcher to 0.2.16.5 + * Update Tor Launcher to 0.2.16.6 * Bug 27469: Adapt Moat URLs - * Bug 25405: Cannot use Moat if a meek bridge is configured * Translations update * Clean-up * Update NoScript to 10.1.9.6 @@ -22,6 +21,7 @@ Tor Browser 8.0.1 -- September 20 2018 * Bug 27543: QR code is broken on web.whatsapp.com * Bug 27264: Bookmark items are not visible on the boomark toolbar * Bug 27535: Enable TLS 1.3 draft version + * Backport of Mozilla bug 1490585, 1475775, and 1489744 * OS X * Bug 27482: Fix crash during start-up on macOS 10.9.x systems * Linux diff --git a/rbm.conf b/rbm.conf index 8ad5c34..529cd56 100644 --- a/rbm.conf +++ b/rbm.conf @@ -16,7 +16,7 @@ buildconf: var: torbrowser_version: '8.0.1' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 8.0 project_name: tor-browser

1 0

[tor-browser/tor-browser-60.2.0esr-8.0-1] Bug 1475775 - Clean up old NSS DB file after upgrade if necessary. r=franziskus, r=mattn, a=RyanVM
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit ae13b0bbbf37edc464def7231992529eaf4ab731 Author: David Keeler <dkeeler(a)mozilla.com> Date: Tue Jul 17 13:51:00 2018 -0700 Bug 1475775 - Clean up old NSS DB file after upgrade if necessary. r=franziskus, r=mattn, a=RyanVM Reviewers: franziskus, mattn Bug #: 1475775 Differential Revision: https://phabricator.services.mozilla.com/D2202 --HG-- rename : security/manager/ssl/tests/unit/test_sdr_preexisting_with_password.js => security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js rename : security/manager/ssl/tests/unit/test_sdr_preexisting_with_password/key3.db => security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db extra : source : 26ac31d53e50217dff8829e6d9bae18c7e36b812 extra : intermediate-source : 1e05e8939a189df7b3d8309ad7936079ec012057 --- security/manager/ssl/nsNSSComponent.cpp | 48 +++++++++ .../tests/unit/test_sdr_upgraded_with_password.js | 115 +++++++++++++++++++++ .../unit/test_sdr_upgraded_with_password/cert8.db | Bin 0 -> 65536 bytes .../unit/test_sdr_upgraded_with_password/cert9.db | Bin 0 -> 229376 bytes .../unit/test_sdr_upgraded_with_password/key3.db | Bin 0 -> 16384 bytes .../unit/test_sdr_upgraded_with_password/key4.db | Bin 0 -> 294912 bytes security/manager/ssl/tests/unit/xpcshell.ini | 4 + 7 files changed, 167 insertions(+) diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp index da5dd60222ad..5d887f99dde0 100644 --- a/security/manager/ssl/nsNSSComponent.cpp +++ b/security/manager/ssl/nsNSSComponent.cpp @@ -1940,6 +1940,51 @@ AttemptToRenameBothPKCS11ModuleDBVersions(const nsACString& profilePath) } return AttemptToRenamePKCS11ModuleDB(profilePath, sqlModuleDBFilename); } + +// When we changed from the old dbm database format to the newer sqlite +// implementation, the upgrade process left behind the existing files. Suppose a +// user had not set a password for the old key3.db (which is about 99% of +// users). After upgrading, both the old database and the new database are +// unprotected. If the user then sets a password for the new database, the old +// one will not be protected. In this scenario, we should probably just remove +// the old database (it would only be relevant if the user downgraded to a +// version of Firefox before 58, but we have to trade this off against the +// user's old private keys being unexpectedly unprotected after setting a +// password). +// This was never an issue on Android because we always used the new +// implementation. +static void +MaybeCleanUpOldNSSFiles(const nsACString& profilePath) +{ + UniquePK11SlotInfo slot(PK11_GetInternalKeySlot()); + if (!slot) { + return; + } + // Unfortunately we can't now tell the difference between "there already was a + // password when the upgrade happened" and "there was not a password but then + // the user added one after upgrading". + bool hasPassword = PK11_NeedLogin(slot.get()) && + !PK11_NeedUserInit(slot.get()); + if (!hasPassword) { + return; + } + nsCOMPtr<nsIFile> dbFile = do_CreateInstance("@mozilla.org/file/local;1"); + if (!dbFile) { + return; + } + nsresult rv = dbFile->InitWithNativePath(profilePath); + if (NS_FAILED(rv)) { + return; + } + NS_NAMED_LITERAL_CSTRING(keyDBFilename, "key3.db"); + rv = dbFile->AppendNative(keyDBFilename); + if (NS_FAILED(rv)) { + return; + } + // Since this isn't a directory, the `recursive` argument to `Remove` is + // irrelevant. + Unused << dbFile->Remove(false); +} #endif // ifndef ANDROID // Given a profile directory, attempt to initialize NSS. If nocertdb is true, @@ -1971,6 +2016,9 @@ InitializeNSSWithFallbacks(const nsACString& profilePath, bool nocertdb, SECStatus srv = ::mozilla::psm::InitializeNSS(profilePath, false, !safeMode); if (srv == SECSuccess) { MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("initialized NSS in r/w mode")); +#ifndef ANDROID + MaybeCleanUpOldNSSFiles(profilePath); +#endif // ifndef ANDROID return NS_OK; } #ifndef ANDROID diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js new file mode 100644 index 000000000000..4949c2cf7956 --- /dev/null +++ b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password.js @@ -0,0 +1,115 @@ +// -*- indent-tabs-mode: nil; js-indent-level: 2 -*- +// This Source Code Form is subject to the terms of the Mozilla Public +// License, v. 2.0. If a copy of the MPL was not distributed with this +// file, You can obtain one at http://mozilla.org/MPL/2.0/. + +"use strict"; + +// Tests that the SDR implementation is able to decrypt strings encrypted using +// a preexisting NSS key database that a) has a password and b) has already been +// upgraded from the old dbm format in a previous run of Firefox. +// To create such a database, run the xpcshell test +// `test_sdr_preexisting_with_password.js` and locate the file `key4.db` created +// in the xpcshell test profile directory. +// This does not apply to Android as the dbm implementation was never enabled on +// that platform. + +var gMockPrompter = { + passwordToTry: "password", + numPrompts: 0, + + // This intentionally does not use arrow function syntax to avoid an issue + // where in the context of the arrow function, |this != gMockPrompter| due to + // how objects get wrapped when going across xpcom boundaries. + promptPassword(dialogTitle, text, password, checkMsg, checkValue) { + this.numPrompts++; + if (this.numPrompts > 1) { // don't keep retrying a bad password + return false; + } + equal(text, + "Please enter your master password.", + "password prompt text should be as expected"); + equal(checkMsg, null, "checkMsg should be null"); + ok(this.passwordToTry, "passwordToTry should be non-null"); + password.value = this.passwordToTry; + return true; + }, + + QueryInterface: XPCOMUtils.generateQI([Ci.nsIPrompt]), +}; + +// Mock nsIWindowWatcher. PSM calls getNewPrompter on this to get an nsIPrompt +// to call promptPassword. We return the mock one, above. +var gWindowWatcher = { + getNewPrompter: () => gMockPrompter, + QueryInterface: XPCOMUtils.generateQI([Ci.nsIWindowWatcher]), +}; + +function run_test() { + let windowWatcherCID = + MockRegistrar.register("@mozilla.org/embedcomp/window-watcher;1", + gWindowWatcher); + registerCleanupFunction(() => { + MockRegistrar.unregister(windowWatcherCID); + }); + + let profile = do_get_profile(); + let key3DBFile = do_get_file("test_sdr_upgraded_with_password/key3.db"); + key3DBFile.copyTo(profile, "key3.db"); + let key4DBFile = do_get_file("test_sdr_upgraded_with_password/key4.db"); + key4DBFile.copyTo(profile, "key4.db"); + // Unfortunately we have to also copy the certificate databases as well. + // Otherwise, NSS will think it has to create them, which will cause NSS to + // think it has to also do a migration, which will open key3.db and not close + // it until shutdown, which means that on Windows removing the file just after + // startup fails. Luckily users profiles will have both key and certificate + // databases anyway, so this is an accurate reflection of normal use. + let cert8DBFile = do_get_file("test_sdr_upgraded_with_password/cert8.db"); + cert8DBFile.copyTo(profile, "cert8.db"); + let cert9DBFile = do_get_file("test_sdr_upgraded_with_password/cert9.db"); + cert9DBFile.copyTo(profile, "cert9.db"); + + let sdr = Cc["@mozilla.org/security/sdr;1"] + .getService(Ci.nsISecretDecoderRing); + + let testcases = [ + // a full padding block + { ciphertext: "MDoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECGeDHwVfyFqzBBAYvqMq/kDMsrARVNdC1C8d", + plaintext: "password" }, + // 7 bytes of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECCAzLDVmYG2/BAh3IoIsMmT8dQ==", + plaintext: "a" }, + // 6 bytes of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECPN8zlZzn8FdBAiu2acpT8UHsg==", + plaintext: "bb" }, + // 1 byte of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECD5px1eMKkJQBAgUPp35GlrDvQ==", + plaintext: "!seven!" }, + // 2 bytes of padding + { ciphertext: "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECMh0hLtKDyUdBAixw9UZsMt+vA==", + plaintext: "sixsix" }, + // long plaintext requiring more than two blocks + { ciphertext: "MFoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECDRX1qi+/FX1BDATFIcIneQjvBuq3wdFxzllJt2VtUD69ACdOKAXH3eA87oHDvuHqOeCDwRy4UzoG5s=", + plaintext: "thisismuchlongerandsotakesupmultipleblocks" }, + // this differs from the previous ciphertext by one bit and demonstrates + // that this implementation does not enforce message integrity + { ciphertext: "MFoEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECDRX1qi+/FX1BDAbFIcIneQjvBuq3wdFxzllJt2VtUD69ACdOKAXH3eA87oHDvuHqOeCDwRy4UzoG5s=", + plaintext: "nnLbuwLRkhlongerandsotakesupmultipleblocks" }, + ]; + + for (let testcase of testcases) { + let decrypted = sdr.decryptString(testcase.ciphertext); + equal(decrypted, testcase.plaintext, + "decrypted ciphertext should match expected plaintext"); + } + equal(gMockPrompter.numPrompts, 1, + "Should have been prompted for a password once"); + + // NSS does not close the old database when performing an upgrade. Thus, on + // Windows, we can't delete the old database file on the run that we perform + // an upgrade. However, we can delete it on subsequent runs. + let key3DBInProfile = do_get_profile(); + key3DBInProfile.append("key3.db"); + ok(!key3DBInProfile.exists(), + "key3.db should not exist after running with key4.db with a password"); +} diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert8.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert8.db new file mode 100644 index 000000000000..ac40a3325724 Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert8.db differ diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert9.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert9.db new file mode 100644 index 000000000000..163d07a6f325 Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/cert9.db differ diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db new file mode 100644 index 000000000000..cac0808ac32c Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key3.db differ diff --git a/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key4.db b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key4.db new file mode 100644 index 000000000000..8c853543cc3e Binary files /dev/null and b/security/manager/ssl/tests/unit/test_sdr_upgraded_with_password/key4.db differ diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini index 5e5a1190f170..db865f6757bb 100644 --- a/security/manager/ssl/tests/unit/xpcshell.ini +++ b/security/manager/ssl/tests/unit/xpcshell.ini @@ -32,6 +32,7 @@ support-files = test_pinning_dynamic/** test_sdr_preexisting/** test_sdr_preexisting_with_password/** + test_sdr_upgraded_with_password/** test_signed_apps/** test_signed_dir/** test_startcom_wosign/** @@ -153,6 +154,9 @@ requesttimeoutfactor = 2 [test_sdr_preexisting_with_password.js] # Not relevant to Android. See the comment in the test. skip-if = toolkit == 'android' +[test_sdr_upgraded_with_password.js] +# Not relevant to Android. See the comment in the test. +skip-if = toolkit == 'android' [test_session_resumption.js] run-sequentially = hardcoded ports [test_signed_apps.js]

1 0

[tor-browser/tor-browser-60.2.0esr-8.0-1] Bug 1490585 - Ensure we got an nsISSLStatus when deserializing in TransportSecurityInfo. r=jcj, a=RyanVM
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit 9b86848baf55860cfc3a341bd9c8b40e1fa0f89e Author: Dana Keeler <dkeeler(a)mozilla.com> Date: Thu Sep 13 16:59:21 2018 +0000 Bug 1490585 - Ensure we got an nsISSLStatus when deserializing in TransportSecurityInfo. r=jcj, a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D5803 --HG-- extra : source : 45359b962851973a70afbde575e6b89242d408de extra : intermediate-source : e9dd9434ad9ac15284429d904a45e4daf567c03b --- security/manager/ssl/TransportSecurityInfo.cpp | 7 +- .../ssl/tests/gtest/DeserializeCertTest.cpp | 86 ++++++++++++++++++++++ 2 files changed, 92 insertions(+), 1 deletion(-) diff --git a/security/manager/ssl/TransportSecurityInfo.cpp b/security/manager/ssl/TransportSecurityInfo.cpp index a57f91603ec4..c954e5517683 100644 --- a/security/manager/ssl/TransportSecurityInfo.cpp +++ b/security/manager/ssl/TransportSecurityInfo.cpp @@ -390,7 +390,12 @@ TransportSecurityInfo::Read(nsIObjectInputStream* stream) if (NS_FAILED(rv)) { return rv; } - mSSLStatus = BitwiseCast<nsSSLStatus*, nsISupports*>(supports.get()); + nsCOMPtr<nsISSLStatus> castGuard(do_QueryInterface(supports)); + if (castGuard) { + mSSLStatus = BitwiseCast<nsSSLStatus*, nsISSLStatus*>(castGuard.get()); + } else { + mSSLStatus = nullptr; + } nsCOMPtr<nsISupports> failedCertChainSupports; rv = NS_ReadOptionalObject(stream, true, getter_AddRefs(failedCertChainSupports)); diff --git a/security/manager/ssl/tests/gtest/DeserializeCertTest.cpp b/security/manager/ssl/tests/gtest/DeserializeCertTest.cpp index 868ecdba6b57..c3a4115b333d 100644 --- a/security/manager/ssl/tests/gtest/DeserializeCertTest.cpp +++ b/security/manager/ssl/tests/gtest/DeserializeCertTest.cpp @@ -94,3 +94,89 @@ TEST(psm_DeserializeCert, gecko46) ASSERT_EQ(NS_OK, rv); ASSERT_TRUE(cert); } + +TEST(psm_DeserializeCert, gecko64) +{ + // This is a serialization of nsITransportSecurityInfo from gecko 64. + // Deserialization should fail. + nsCString base64Serialization( + "FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAgAAgAAAAAAAAAAAAAAAAAAAAEAMQFmCjIm" + "kVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX2MIIF8jCCBNqgAwIBAgIQDmTF+8I2reFLFyrrQceMsDANBgkqhkiG" + "9w0BAQsFADBwMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMS8w" + "LQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNzdXJhbmNlIFNlcnZlciBDQTAeFw0xNTExMDMwMDAwMDBaFw0xODExMjgxMjAw" + "MDBaMIGlMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLTG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0lu" + "dGVybmV0IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczETMBEGA1UECxMKVGVjaG5vbG9neTEYMBYG" + "A1UEAxMPd3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs0CWL2FjPiXBl61lRfvvE0KzLJmG" + "9LWAC3bcBjgsH6NiVVo2dt6uXfzi5bTm7F3K7srfUBYkLO78mraM9qizrHoIeyofrV/n+pZZJauQsPjCPxMEJnRoD8Z4KpWKX0Ly" + "Du1SputoI4nlQ/htEhtiQnuoBfNZxF7WxcxGwEsZuS1KcXIkHl5VRJOreKFHTaXcB1qcZ/QRaBIv0yhxvK1yBTwWddT4cli6GfHc" + "Ce3xGMaSL328Fgs3jYrvG29PueB6VJi/tbbPu6qTfwp/H1brqdjh29U52Bhb0fJkM9DWxCP/Cattcc7az8EXnCO+LK8vkhw/kAiJ" + "WPKx4RBvgy73nwIDAQABo4ICUDCCAkwwHwYDVR0jBBgwFoAUUWj/kK8CB3U8zNllZGKiErhZcjswHQYDVR0OBBYEFKZPYB4fLdHn" + "8SOgKpUW5Oia6m5IMIGBBgNVHREEejB4gg93d3cuZXhhbXBsZS5vcmeCC2V4YW1wbGUuY29tggtleGFtcGxlLmVkdYILZXhhbXBs" + "ZS5uZXSCC2V4YW1wbGUub3Jngg93d3cuZXhhbXBsZS5jb22CD3d3dy5leGFtcGxlLmVkdYIPd3d3LmV4YW1wbGUubmV0MA4GA1Ud" + "DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwdQYDVR0fBG4wbDA0oDKgMIYuaHR0cDovL2NybDMuZGln" + "aWNlcnQuY29tL3NoYTItaGEtc2VydmVyLWc0LmNybDA0oDKgMIYuaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL3NoYTItaGEtc2Vy" + "dmVyLWc0LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20v" + "Q1BTMAgGBmeBDAECAjCBgwYIKwYBBQUHAQEEdzB1MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wTQYIKwYB" + "BQUHMAKGQWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJIaWdoQXNzdXJhbmNlU2VydmVyQ0EuY3J0MAwG" + "A1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAISomhGn2L0LJn5SJHuyVZ3qMIlRCIdvqe0Q6ls+C8ctRwRO3UU3x8q8OH+2" + "ahxlQmpzdC5al4XQzJLiLjiJ2Q1p+hub8MFiMmVPPZjb2tZm2ipWVuMRM+zgpRVM6nVJ9F3vFfUSHOb4/JsEIUvPY+d8/Krc+kPQ" + "wLvyieqRbcuFjmqfyPmUv1U9QoI4TQikpw7TZU0zYZANP4C/gj4Ry48/znmUaRvy2kvIl7gRQ21qJTK5suoiYoYNo3J9T+pXPGU7" + "Lydz/HwW+w0DpArtAaukI8aNX4ohFUKSwDSiIIWIWJiJGbEeIO0TIFwEVWTOnbNl/faPXpk5IRXicapqiILALwADAAAAAAEBAAAA" + "AAAABFAyNTYAAAAQUlNBLVBLQ1MxLVNIQTUxMgGVn7FlZRdIf6ub2JE75TGXrnTNpc0vRz+W9fC3//YsaAAAAANmCjImkVxP+7sg" + "iYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAX2MIIF8jCCBNqgAwIBAgIQDmTF+8I2reFLFyrrQceMsDANBgkqhkiG9w0BAQsF" + "ADBwMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQD" + "EyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNzdXJhbmNlIFNlcnZlciBDQTAeFw0xNTExMDMwMDAwMDBaFw0xODExMjgxMjAwMDBaMIGl" + "MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLTG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0" + "IENvcnBvcmF0aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczETMBEGA1UECxMKVGVjaG5vbG9neTEYMBYGA1UEAxMP" + "d3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs0CWL2FjPiXBl61lRfvvE0KzLJmG9LWAC3bc" + "BjgsH6NiVVo2dt6uXfzi5bTm7F3K7srfUBYkLO78mraM9qizrHoIeyofrV/n+pZZJauQsPjCPxMEJnRoD8Z4KpWKX0LyDu1Sputo" + "I4nlQ/htEhtiQnuoBfNZxF7WxcxGwEsZuS1KcXIkHl5VRJOreKFHTaXcB1qcZ/QRaBIv0yhxvK1yBTwWddT4cli6GfHcCe3xGMaS" + "L328Fgs3jYrvG29PueB6VJi/tbbPu6qTfwp/H1brqdjh29U52Bhb0fJkM9DWxCP/Cattcc7az8EXnCO+LK8vkhw/kAiJWPKx4RBv" + "gy73nwIDAQABo4ICUDCCAkwwHwYDVR0jBBgwFoAUUWj/kK8CB3U8zNllZGKiErhZcjswHQYDVR0OBBYEFKZPYB4fLdHn8SOgKpUW" + "5Oia6m5IMIGBBgNVHREEejB4gg93d3cuZXhhbXBsZS5vcmeCC2V4YW1wbGUuY29tggtleGFtcGxlLmVkdYILZXhhbXBsZS5uZXSC" + "C2V4YW1wbGUub3Jngg93d3cuZXhhbXBsZS5jb22CD3d3dy5leGFtcGxlLmVkdYIPd3d3LmV4YW1wbGUubmV0MA4GA1UdDwEB/wQE" + "AwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwdQYDVR0fBG4wbDA0oDKgMIYuaHR0cDovL2NybDMuZGlnaWNlcnQu" + "Y29tL3NoYTItaGEtc2VydmVyLWc0LmNybDA0oDKgMIYuaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL3NoYTItaGEtc2VydmVyLWc0" + "LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgG" + "BmeBDAECAjCBgwYIKwYBBQUHAQEEdzB1MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wTQYIKwYBBQUHMAKG" + "QWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJIaWdoQXNzdXJhbmNlU2VydmVyQ0EuY3J0MAwGA1UdEwEB" + "/wQCMAAwDQYJKoZIhvcNAQELBQADggEBAISomhGn2L0LJn5SJHuyVZ3qMIlRCIdvqe0Q6ls+C8ctRwRO3UU3x8q8OH+2ahxlQmpz" + "dC5al4XQzJLiLjiJ2Q1p+hub8MFiMmVPPZjb2tZm2ipWVuMRM+zgpRVM6nVJ9F3vFfUSHOb4/JsEIUvPY+d8/Krc+kPQwLvyieqR" + "bcuFjmqfyPmUv1U9QoI4TQikpw7TZU0zYZANP4C/gj4Ry48/znmUaRvy2kvIl7gRQ21qJTK5suoiYoYNo3J9T+pXPGU7Lydz/HwW" + "+w0DpArtAaukI8aNX4ohFUKSwDSiIIWIWJiJGbEeIO0TIFwEVWTOnbNl/faPXpk5IRXicapqiIJmCjImkVxP+7sgiYWmMt8FvcOX" + "mlQiTNWFiWlrbpbqgwAAAAAAAAS1MIIEsTCCA5mgAwIBAgIQBOHnpNxc8vNtwCtCuF0VnzANBgkqhkiG9w0BAQsFADBsMQswCQYD" + "VQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2Vy" + "dCBIaWdoIEFzc3VyYW5jZSBFViBSb290IENBMB4XDTEzMTAyMjEyMDAwMFoXDTI4MTAyMjEyMDAwMFowcDELMAkGA1UEBhMCVVMx" + "FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEvMC0GA1UEAxMmRGlnaUNlcnQgU0hBMiBI" + "aWdoIEFzc3VyYW5jZSBTZXJ2ZXIgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC24C/CJAbIbQRf1+8KZAayfSIm" + "ZRauQkCbztyfn3YHPsMwVYcZuU+UDlqUH1VWtMICKq/QmO4LQNfE0DtyyBSe75CxEamu0si4QzrZCwvV1ZX1QK/IHe1NnF9Xt4ZQ" + "aJn1itrSxwUfqJfJ3KSxgoQtxq2lnMcZgqaFD15EWCo3j/018QsIJzJa9buLnqS9UdAn4t07QjOjBSjEuyjMmqwrIw14xnvmXnG3" + "Sj4I+4G3FhahnSMSTeXXkgisdaScus0Xsh5ENWV/UyU50RwKmmMbGZJ0aAo3wsJSSMs5WqK24V3B3aAguCGikyZvFEohQcftbZvy" + "SC/zA/WiaJJTL17jAgMBAAGjggFJMIIBRTASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggr" + "BgEFBQcDAQYIKwYBBQUHAwIwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wSwYD" + "VR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDA9" + "BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAdBgNVHQ4EFgQUUWj/" + "kK8CB3U8zNllZGKiErhZcjswHwYDVR0jBBgwFoAUsT7DaQP4v0cB1JgmGggC72NkK8MwDQYJKoZIhvcNAQELBQADggEBABiKlYkD" + "5m3fXPwdaOpKj4PWUS+Na0QWnqxj9dJubISZi6qBcYRb7TROsLd5kinMLYBq8I4g4Xmk/gNHE+r1hspZcX30BJZr01lYPf7TMSVc" + "GDiEo+afgv2MW5gxTs14nhr9hctJqvIni5ly/D6q1UEL2tU2ob8cbkdJf17ZSHwD2f2LSaCYJkJA69aSEaRkCldUxPUd1gJea6zu" + "xICaEnL6VpPX/78whQYwvwt/Tv9XBZ0k7YXDK/umdaisLRbvfXknsuvCnQsH6qqF0wGjIChBWUMo0oHjqvbsezt3tkBigAVBRQHv" + "FwY+3sAzm2fTYS5yh+Rp/BIAV0AecPUeybRmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAPJMIIDxTCCAq2g" + "AwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBsMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5j" + "MRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5jZSBFViBSb290IENBMB4X" + "DTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UE" + "CxMQd3d3LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2UgRVYgUm9vdCBDQTCCASIwDQYJKoZI" + "hvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW" + "PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEMxChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuN" + "s8ckRZqnrG0AFFoEt7oT61EKmEFBIk5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3hzBWBOUR" + "tCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsgEsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQD" + "AgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaAFLE+w2kD+L9HAdSY" + "JhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3NecnzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlM" + "MUu4kehDLI6zeM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jFhS9OMPagMRYjyOfiZRYzy78a" + "G6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZd" + "kGCevEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep+OkuE6N36B9KAA=="); + + nsCOMPtr<nsISupports> transportSecurityInfo; + nsresult rv = NS_DeserializeObject(base64Serialization, getter_AddRefs(transportSecurityInfo)); + ASSERT_EQ(NS_ERROR_FACTORY_NOT_REGISTERED, rv); + ASSERT_FALSE(transportSecurityInfo); +}

1 0

[tor-browser/tor-browser-60.2.0esr-8.0-1] Bug 1489744 - Fix a bounds violation crash in the prefs parser. r=glandium, a=RyanVM
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit 982ef502b7c6d264afd3c403f20c9b6ef7840034 Author: Nicholas Nethercote <nnethercote(a)mozilla.com> Date: Tue Sep 11 09:36:07 2018 +1000 Bug 1489744 - Fix a bounds violation crash in the prefs parser. r=glandium, a=RyanVM Currently, if a get_char() call returns EOF, the index moves beyond the buffer's bounds and get_char() cannot be called again without triggering a panic. As a result, everywhere that encounters an EOF and then does subsequent parsing ungets the EOF... except there was one place that failed to do that: the match case for CharKind::Slash in get_token(). This meant that a single '/' at the end of the input could trigger a bounds violation (but only if it is the start of a new token). This EOF-unget requirement is subtle and easy to get wrong, so this patch eliminates it. get_char() now can be called repeatedly after an EOF, and will return EOF on each subsequent call. This means that some of the existing unget_char() calls can be removed. Some others are still necessary to get line numbers correct in error messages, but the outcome of mishandled cases is now much less drastic -- an incorrect line number in an error message instead of a panic. The patch also clarifies a couple of related comments. --HG-- extra : source : 5097db630d1fb51f7f3fcd5523a924fa823e77ce extra : intermediate-source : 2676e53112584b2c08b9a1bf02e15cd9bb0d0ee5 --- modules/libpref/parser/src/lib.rs | 70 +++++++++++++++++++---------------- modules/libpref/test/gtest/Parser.cpp | 9 +++-- 2 files changed, 45 insertions(+), 34 deletions(-) diff --git a/modules/libpref/parser/src/lib.rs b/modules/libpref/parser/src/lib.rs index 8d8b9a6125e4..5ea7650252f5 100644 --- a/modules/libpref/parser/src/lib.rs +++ b/modules/libpref/parser/src/lib.rs @@ -54,16 +54,10 @@ // This parser uses several important optimizations. // -// - Because "'\0' means EOF" is part of the grammar (see above) we can match -// EOF as a normal char/token, which means we can avoid a typical "do we -// still have chars remaining?" test in get_char(), which gives a speedup -// because get_char() is a very hot function. (Actually, Rust would -// bounds-check this function anyway, so we have get_char_unchecked() which -// is used for the two hottest call sites.) -// -// This also means EOF is representable by a u8. If EOF was represented by an -// out-of-band value such as -1 or 256, we'd have to return a larger type -// such as u16 or i16 from get_char(). +// - Because "'\0' means EOF" is part of the grammar (see above), EOF is +// representable by a u8. If EOF was represented by an out-of-band value such +// as -1 or 256, we'd have to return a larger type such as u16 or i16 from +// get_char(). // // - When starting a new token, it uses a lookup table with the first char, // which quickly identifies what kind of token it will be. Furthermore, if @@ -192,7 +186,7 @@ enum Token { #[derive(Clone, Copy, PartialEq)] enum CharKind { // These are ordered by frequency. See the comment in GetToken(). - SingleChar, // Unambiguous single-char tokens: [()+,-] + SingleChar, // Unambiguous single-char tokens: [()+,-] or EOF SpaceNL, // [\t\v\f \n] Keyword, // [A-Za-z_] Quote, // ["'] @@ -535,13 +529,21 @@ impl<'t> Parser<'t> { #[inline(always)] fn get_char(&mut self) -> u8 { - let c = self.buf[self.i]; - self.i += 1; - c + // We do the bounds check ourselves so we can return EOF on failure. + // (Although the buffer is guaranteed to end in an EOF char, we might + // go one char past that, whereupon we must return EOF again.) + if self.i < self.buf.len() { + let c = unsafe { *self.buf.get_unchecked(self.i) }; + self.i += 1; + c + } else { + debug_assert!(self.i == self.buf.len()); + EOF + } } - // This function skips the bounds check in non-optimized builds. Using it - // at the hottest two call sites gives a ~15% parsing speed boost. + // This function skips the bounds check in optimized builds. Using it at + // the hottest two call sites gives a ~15% parsing speed boost. #[inline(always)] unsafe fn get_char_unchecked(&mut self) -> u8 { debug_assert!(self.i < self.buf.len()); @@ -568,9 +570,11 @@ impl<'t> Parser<'t> { #[inline(always)] fn match_single_line_comment(&mut self) { loop { - // To reach here, the previous char must have been '/', and - // assertions elsewhere ensure that there must be at least one - // subsequent char (the '\0' for EOF). + // To reach here, the previous char must have been '/' (if this is + // the first loop iteration) or non-special (if this is the second + // or subsequent iteration), and assertions elsewhere ensure that + // there must be at least one subsequent char after those chars + // (the '\0' for EOF). let c = unsafe { self.get_char_unchecked() }; // All the special chars have value <= b'\r'. @@ -588,8 +592,6 @@ impl<'t> Parser<'t> { break; } EOF => { - // Unget EOF so subsequent calls to get_char() are safe. - self.unget_char(); break; } _ => continue @@ -615,8 +617,6 @@ impl<'t> Parser<'t> { self.match_char(b'\n'); } EOF => { - // Unget EOF so subsequent calls to get_char() are safe. - self.unget_char(); return false } _ => continue @@ -630,11 +630,10 @@ impl<'t> Parser<'t> { for _ in 0..ndigits { value = value << 4; match self.get_char() { - c @ b'0'... b'9' => value += (c - b'0') as u16, + c @ b'0'...b'9' => value += (c - b'0') as u16, c @ b'A'...b'F' => value += (c - b'A') as u16 + 10, c @ b'a'...b'f' => value += (c - b'a') as u16 + 10, _ => { - // Unget in case the char was a closing quote or EOF. self.unget_char(); return None; } @@ -716,7 +715,15 @@ impl<'t> Parser<'t> { return Token::Error("unterminated /* comment"); } } - _ => return Token::Error("expected '/' or '*' after '/'") + c @ _ => { + if c == b'\n' || c == b'\r' { + // Unget the newline char; the outer loop will + // reget it and adjust self.line_num + // appropriately. + self.unget_char(); + } + return Token::Error("expected '/' or '*' after '/'"); + } } continue; } @@ -871,9 +878,12 @@ impl<'t> Parser<'t> { } continue; // We don't want to str_buf.push(c2) below. } - _ => { - // Unget in case the char is an EOF. - self.unget_char(); + c @ _ => { + if c == b'\n' || c == b'\r' { + // Unget the newline char; the outer loop will + // reget it and adjust self.line_num appropriately. + self.unget_char(); + } self.string_error_token( &mut token, "unexpected escape sequence character after '\\'"); continue; @@ -894,8 +904,6 @@ impl<'t> Parser<'t> { } } else if c == EOF { - // Unget EOF so subsequent calls to get_char() are safe. - self.unget_char(); self.string_error_token(&mut token, "unterminated string literal"); break; diff --git a/modules/libpref/test/gtest/Parser.cpp b/modules/libpref/test/gtest/Parser.cpp index d5469dd38007..fe9dea87ee60 100644 --- a/modules/libpref/test/gtest/Parser.cpp +++ b/modules/libpref/test/gtest/Parser.cpp @@ -293,11 +293,14 @@ pref("string.bad-keyword", TRUE); "test:3: prefs parse error: unterminated /* comment\n" ); - // Malformed comment. + // Malformed comments (single slashes), followed by whitespace, newline, EOF. DEFAULT(R"( -/ comment - )", +/ comment; +/ +; /)", "test:2: prefs parse error: expected '/' or '*' after '/'\n" + "test:3: prefs parse error: expected '/' or '*' after '/'\n" + "test:4: prefs parse error: expected '/' or '*' after '/'\n" ); // C++-style comment ending in EOF (1).

1 0

[tor-launcher/maint-0.2.16] Version bump (0.2.16.6)
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit 020b7730ee1637728d6f90dad3fbe3b27b37a2d3 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 20 06:28:26 2018 +0000 Version bump (0.2.16.6) --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index a5d027e..6a0c65a 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.16.5</em:version> + <em:version>0.2.16.6</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-launcher/maint-0.2.16] Revert "Bug 25405: cannot use Moat if a meek bridge is configured"
by gk＠torproject.org 20 Sep '18

20 Sep '18

commit b48803c87dde780a0897fe85bf4d27c739eecfbe Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 20 06:18:03 2018 +0000 Revert "Bug 25405: cannot use Moat if a meek bridge is configured" This reverts commit a5791ec33537b5efefb5c64c240e48d9ce1c8721. Let's test this bugfix a bit more on the alpha series first. --- src/modules/tl-bridgedb.jsm | 9 ++------- src/modules/tl-util.jsm | 19 ++----------------- 2 files changed, 4 insertions(+), 24 deletions(-) diff --git a/src/modules/tl-bridgedb.jsm b/src/modules/tl-bridgedb.jsm index 8b7a1d6..339cb39 100644 --- a/src/modules/tl-bridgedb.jsm +++ b/src/modules/tl-bridgedb.jsm @@ -224,22 +224,17 @@ _MoatRequestor.prototype = } let ptStateDir = TorLauncherUtil.getTorFile("tordatadir", false); - let meekHelperProfileDir = TorLauncherUtil.getTorFile("pt-profiles-dir", - true); - if (!ptStateDir || !meekHelperProfileDir) + if (!ptStateDir) { let msg = TorLauncherUtil.getLocalizedString("datadir_missing"); return Promise.reject(new Error(msg)); } ptStateDir.append("pt_state"); // Match what tor uses. - meekHelperProfileDir.appendRelativePath("profile.moat-http-helper"); - let envAdditions = { TOR_PT_MANAGED_TRANSPORT_VER: "1", TOR_PT_STATE_LOCATION: ptStateDir.path, TOR_PT_EXIT_ON_STDIN_CLOSE: "1", - TOR_PT_CLIENT_TRANSPORTS: this.kTransport, - TOR_BROWSER_MEEK_PROFILE: meekHelperProfileDir.path }; + TOR_PT_CLIENT_TRANSPORTS: this.kTransport }; if (this.mLocalProxyURL) envAdditions.TOR_PT_PROXY = this.mLocalProxyURL; diff --git a/src/modules/tl-util.jsm b/src/modules/tl-util.jsm index 36abeaa..292f88b 100644 --- a/src/modules/tl-util.jsm +++ b/src/modules/tl-util.jsm @@ -561,8 +561,6 @@ let TorLauncherUtil = // Public path = "Tor\\torrc"; else if ("tordatadir" == aTorFileType) path = "Tor"; - else if ("pt-profiles-dir" == aTorFileType) - path = "Tor\\PluggableTransports"; } else if (this.isMac) { @@ -576,8 +574,6 @@ let TorLauncherUtil = // Public path = "Tor/torrc"; else if ("tordatadir" == aTorFileType) path = "Tor"; - else if ("pt-profiles-dir" == aTorFileType) - path = "Tor/PluggableTransports"; else if (isIPC) path = "Tor/" + ipcFileName; } @@ -593,8 +589,6 @@ let TorLauncherUtil = // Public path = "Tor/torrc"; else if ("tordatadir" == aTorFileType) path = "Tor"; - else if ("pt-profiles-dir" == aTorFileType) - path = "Tor/PluggableTransports"; else if (isIPC) path = "Tor/" + ipcFileName; } @@ -612,9 +606,7 @@ let TorLauncherUtil = // Public path = "Data\\Tor\\torrc"; else if ("tordatadir" == aTorFileType) path = "Data\\Tor"; - else if ("pt-profiles-dir" == aTorFileType) - path = "Data\\Browser"; - } + } else // Linux, Mac OS and others. { // This block is also used for the non-TorBrowser-Data/ case. @@ -628,8 +620,6 @@ let TorLauncherUtil = // Public path = "Data/Tor/torrc"; else if ("tordatadir" == aTorFileType) path = "Data/Tor"; - else if ("pt-profiles-dir" == aTorFileType) - path = "Data/Browser"; else if (isIPC) path = "Data/Tor/" + ipcFileName; } @@ -672,15 +662,10 @@ let TorLauncherUtil = // Public { try { - if (("tordatadir" == aTorFileType) || - ("pt-profiles-dir" == aTorFileType)) - { + if ("tordatadir" == aTorFileType) torFile.create(torFile.DIRECTORY_TYPE, 0o700); - } else - { torFile.create(torFile.NORMAL_FILE_TYPE, 0o600); - } } catch (e) {

1 0

[tor-browser-build/master] Fix typo in changelog
by gk＠torproject.org 19 Sep '18

19 Sep '18

commit 6a900e2af3a47e22f6390516ae2bc7a29ba7ba0a Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 18:09:04 2018 +0000 Fix typo in changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 60b61c0..0276ef5 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 8.0.1 -- September 20 2018 +Tor Browser 8.5a2 -- September 20 2018 * All platforms * Update Tor to 0.3.5.1-alpha * Update Torbutton to 2.1

1 0

[tor-browser-build/maint-8.0] Update 8.0.1 changelog
by gk＠torproject.org 19 Sep '18

19 Sep '18

commit 4825a7d9d091733957da2515161d8c0157428d9c Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 18:00:04 2018 +0000 Update 8.0.1 changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 64ef362..4cc90f3 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -24,6 +24,8 @@ Tor Browser 8.0.1 -- September 20 2018 * Bug 27535: Enable TLS 1.3 draft version * OS X * Bug 27482: Fix crash during start-up on macOS 10.9.x systems + * Linux + * Bug 26556: Fix broken Tor Browser icon path on Linux Tor Browser 8.0 -- September 5 2018 * All platforms

1 0

[tor-browser-build/master] Release preparations for 8.5a2
by gk＠torproject.org 19 Sep '18

19 Sep '18

commit 467bb22b75375c673fc3ad58653d647c7650bfc9 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 17:57:09 2018 +0000 Release preparations for 8.5a2 --- projects/firefox/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 33 ++++++++++++++++++++++ projects/tor-browser/config | 4 +-- projects/tor-launcher/config | 2 +- projects/tor/config | 2 +- projects/torbutton/config | 2 +- rbm.conf | 4 +-- 7 files changed, 41 insertions(+), 8 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 8ebbd4f..aca6ce9 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 7c33834..60b61c0 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,36 @@ +Tor Browser 8.0.1 -- September 20 2018 + * All platforms + * Update Tor to 0.3.5.1-alpha + * Update Torbutton to 2.1 + * Bug 27097: Tor News signup banner + * Bug 27663: Add New Identity menuitem again + * Bug 27175: Add pref to allow users to persist custom noscript settings + * Bug 27760: Use new NoScript API for IPC and fix about:blank issue + * Bug 26624: Only block OBJECT on highest slider level + * Bug 26555: Don't show IP address for meek or snowflake + * Bug 27478: Torbutton icons for dark theme + * Bug 27506+14520: Move status version to upper left corner for RTL locales + * Bug 27558: Update the link to "Your Guard note may not change" text + * Bug 21263: Remove outdated information from the README + * Translations update + * Update Tor Launcher to 0.2.16.5 + * Bug 27469: Adapt Moat URLs + * Translations update + * Clean-up + * Update NoScript to 10.1.9.6 + * Bug 27763: Restrict Torbutton signing exemption to mobile + * Bug 26146: Spoof HTTP User-Agent header for desktop platforms + * Bug 27543: QR code is broken on web.whatsapp.com + * Bug 27264: Bookmark items are not visible on the boomark toolbar + * Bug 27535: Enable TLS 1.3 draft version + * Bug 27623: Use MOZILLA_OFFICIAL for our builds + * Windows: + * Bug 26381: about:tor page does not load on first start on Windows + * Linux: + * Bug 27546: Fix vertical scrollbar behavior in Tor Browser 8 with Gtk3 + * Bug 27552: Use bundled dir on CentOS/RHEL 6 + * Bug 26556: Fix broken Tor Browser icon path on Linux + Tor Browser 8.5a1 -- September 5 2018 * All platforms * Update Firefox to 60.2.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 85754ae..1647b77 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -67,9 +67,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 68c3ef1b753210d376ab9b9c73fa053043f4f0f4cab219e317759fb32b104a27 + sha256sum: 336ae26d0a70688e6c2b3c14267c9e80f52f6f36c31f23b8242e0edae3666d42 - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index c5ddc0a..9e00653 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.16.4 +version: 0.2.16.5 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/tor/config b/projects/tor/config index c1a3878..451c9bb 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.3.4.7-rc +version: 0.3.5.1-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git git_submodule: 1 diff --git a/projects/torbutton/config b/projects/torbutton/config index f076b8f..a698691 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.0.6 +version: 2.1 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index cbbbf64..461849c 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '8.5a1' + torbrowser_version: '8.5a2' torbrowser_build: 'build1' torbrowser_incremental_from: - - 8.0a10 + - 8.5a1 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[torbutton/master] Release preparations for 2.1
by gk＠torproject.org 19 Sep '18

19 Sep '18

commit cd85d9dd4e0a225688d1785ff4cb421abca1e16a Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 17:45:16 2018 +0000 Release preparations for 2.1 Changelog update and version bump --- src/CHANGELOG | 5 +++++ src/install.rdf | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index 562842e9..8bffbe8b 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -1,3 +1,8 @@ +2.1 + * Bug 27175: Add pref to allow users to persist custom noscript settings + * Bug 27760: Use new NoScript API for IPC and fix about:blank issue + * Bug 21263: Remove outdated information from the README + 2.0.7 * Bug 27097: Tor News signup banner * Bug 27663: Add New Identity menuitem again diff --git a/src/install.rdf b/src/install.rdf index cd14a7dd..5df0f129 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -6,7 +6,7 @@ <em:name>Torbutton</em:name> <em:creator>Mike Perry</em:creator> <em:id>torbutton(a)torproject.org</em:id> - <em:version>2.0.7</em:version> + <em:version>2.1</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html.en</em:homepageURL> <em:iconURL>chrome://torbutton/skin/tor.png</em:iconURL>

1 0

[tor-browser/tor-browser-60.2.0esr-8.5-1] Bug 27623 - Export MOZILLA_OFFICIAL during desktop builds
by gk＠torproject.org 19 Sep '18

19 Sep '18

commit cfcf68c7ef27d33f072a405ef7e99815f5e34c1d Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon Sep 17 16:39:42 2018 -0400 Bug 27623 - Export MOZILLA_OFFICIAL during desktop builds This fixes a problem where some preferences had the wrong default value. Also see bug 27472 where we made a similar fix for Android. --- .mozconfig | 1 + .mozconfig-asan | 1 + .mozconfig-mac | 1 + .mozconfig-mingw | 1 + 4 files changed, 4 insertions(+) diff --git a/.mozconfig b/.mozconfig index 909f107f2948..b19e10a24940 100755 --- a/.mozconfig +++ b/.mozconfig @@ -3,6 +3,7 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --enable-optimize diff --git a/.mozconfig-asan b/.mozconfig-asan index 914195971e6e..be11dcbd967a 100644 --- a/.mozconfig-asan +++ b/.mozconfig-asan @@ -15,6 +15,7 @@ export HOST_LDFLAGS="-ldl" mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --enable-address-sanitizer diff --git a/.mozconfig-mac b/.mozconfig-mac index 540c5b375336..a9fbe7967ead 100644 --- a/.mozconfig-mac +++ b/.mozconfig-mac @@ -33,6 +33,7 @@ ac_add_options --with-macos-private-frameworks=$CROSS_PRIVATE_FRAMEWORKS mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-macos mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --enable-application=browser diff --git a/.mozconfig-mingw b/.mozconfig-mingw index 05dd4d6168a8..71494b6e1b78 100644 --- a/.mozconfig-mingw +++ b/.mozconfig-mingw @@ -7,6 +7,7 @@ ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --disable-debug

1 0

[tor-browser-build/master] Bug 27623: Export MOZILLA_OFFICIAL during desktop builds
by gk＠torproject.org 19 Sep '18

19 Sep '18

commit f49b8306354f68dcaf8efeec8a4bd8b5a8908e6b Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Sep 18 09:29:55 2018 -0400 Bug 27623: Export MOZILLA_OFFICIAL during desktop builds This fixes a problem where some preferences had the wrong default value. Also see bug 27472 where we made a similar fix for Android. --- projects/firefox/mozconfig-linux-i686 | 1 + projects/firefox/mozconfig-linux-x86_64 | 1 + projects/firefox/mozconfig-osx-x86_64 | 1 + projects/firefox/mozconfig-windows-i686 | 1 + projects/firefox/mozconfig-windows-x86_64 | 1 + 5 files changed, 5 insertions(+) diff --git a/projects/firefox/mozconfig-linux-i686 b/projects/firefox/mozconfig-linux-i686 index ec0adb9..ee5082a 100755 --- a/projects/firefox/mozconfig-linux-i686 +++ b/projects/firefox/mozconfig-linux-i686 @@ -3,6 +3,7 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 export CFLAGS=-m32 diff --git a/projects/firefox/mozconfig-linux-x86_64 b/projects/firefox/mozconfig-linux-x86_64 index 2e8e2fa..917e32c 100755 --- a/projects/firefox/mozconfig-linux-x86_64 +++ b/projects/firefox/mozconfig-linux-x86_64 @@ -3,6 +3,7 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --enable-optimize diff --git a/projects/firefox/mozconfig-osx-x86_64 b/projects/firefox/mozconfig-osx-x86_64 index 7ff17e1..5d56ad3 100644 --- a/projects/firefox/mozconfig-osx-x86_64 +++ b/projects/firefox/mozconfig-osx-x86_64 @@ -31,6 +31,7 @@ ac_add_options --with-macos-private-frameworks=$CROSS_PRIVATE_FRAMEWORKS mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-macos mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --enable-application=browser diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index a5e15f1..07e8851 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -10,6 +10,7 @@ ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --disable-debug diff --git a/projects/firefox/mozconfig-windows-x86_64 b/projects/firefox/mozconfig-windows-x86_64 index e7f857d..1665005 100644 --- a/projects/firefox/mozconfig-windows-x86_64 +++ b/projects/firefox/mozconfig-windows-x86_64 @@ -10,6 +10,7 @@ ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" mk_add_options MOZILLA_OFFICIAL=1 +export MOZILLA_OFFICIAL=1 mk_add_options BUILD_OFFICIAL=1 ac_add_options --disable-debug

1 0

[torbutton/master] Bug 27175: Add pref to allow users to persist custom noscript settings
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 461b828c70bb85501db99fdf077af71b69ef7e0a Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Sep 17 23:03:26 2018 -0700 Bug 27175: Add pref to allow users to persist custom noscript settings The pref is called "extensions.torbutton.noscript_persist". Warning! It is dangerous and could reveal what sites you have visited in the past. (We also use a pref named "extensions.torbutton.noscript_inited" to keep track of the first run.) --- src/defaults/preferences/preferences.js | 3 +++ src/modules/noscript-control.js | 31 +++++++++++++++++++++++-------- 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index fecf0e69..45b60ce8 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -48,6 +48,9 @@ pref("extensions.torbutton.prompt_torbrowser", true); pref("extensions.torbutton.confirm_plugins", true); pref("extensions.torbutton.confirm_newnym", true); +pref("extensions.torbutton.noscript_inited", false); +pref("extensions.torbutton.noscript_persist", false); + // Browser home page: pref("browser.startup.homepage", "chrome://torbutton/content/locale/non-localized.properties"); diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js index 621f2b7f..275f9dba 100644 --- a/src/modules/noscript-control.js +++ b/src/modules/noscript-control.js @@ -5,9 +5,10 @@ // ## Utilities const { utils: Cu } = Components; +const { Services } = Cu.import("resource://gre/modules/Services.jsm", {}); const { LegacyExtensionContext } = Cu.import("resource://gre/modules/LegacyExtensionsUtils.jsm", {}); -const { bindPrefAndInit } = +const { bindPref } = Cu.import("resource://torbutton/modules/utils.js", {}); let logger = Components.classes["@torproject.org/torbutton-logger;1"] .getService(Components.interfaces.nsISupports).wrappedJSObject; @@ -128,14 +129,28 @@ var initialize = () => { // Wait for the first message from NoScript to arrive, and then // bind the security_slider pref to the NoScript settings. let messageListener = (a,b,c) => { - log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`); - if (!["started", "pageshow"].includes(a.__meta.name)) { - return; + try { + log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`); + if (!["started", "pageshow"].includes(a.__meta.name)) { + return; + } + extensionContext.api.browser.runtime.onMessage.removeListener(messageListener); + let noscriptPersist = Services.prefs.getBoolPref("extensions.torbutton.noscript_persist", false); + let noscriptInited = Services.prefs.getBoolPref("extensions.torbutton.noscript_inited", false); + // Set the noscript safety level once if we have never run noscript + // before, or if we are not allowing noscript per-site settings to be + // persisted between browser sessions. Otherwise make sure that the + // security slider position, if changed, will rewrite the noscript + // settings. + bindPref("extensions.torbutton.security_slider", + sliderState => setNoScriptSafetyLevel(securitySliderToSafetyLevel(sliderState)), + !noscriptPersist || !noscriptInited); + if (!noscriptInited) { + Services.prefs.setBoolPref("extensions.torbutton.noscript_inited", true); + } + } catch (e) { + log(5, e.message); } - extensionContext.api.browser.runtime.onMessage.removeListener(messageListener); - bindPrefAndInit( - "extensions.torbutton.security_slider", - sliderState => setNoScriptSafetyLevel(securitySliderToSafetyLevel(sliderState))); }; extensionContext.api.browser.runtime.onMessage.addListener(messageListener); log(3, "Listening for message from NoScript.");

1 0

[torbutton/master] Bug 21263: Remove outdated information from the README
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 02f3a9334acb1b1b72ee27c3e81013f8706f20d1 Author: traumschule <traumschuleriebau(a)riseup.net> Date: Sat Sep 15 15:43:15 2018 +0200 Bug 21263: Remove outdated information from the README --- README | 155 ++++++++--------------------------------------------------------- 1 file changed, 17 insertions(+), 138 deletions(-) diff --git a/README b/README index 3b3af2d6..f4dc12d4 100644 --- a/README +++ b/README @@ -1,144 +1,23 @@ -Torbutton is a 1-click way for Firefox users to enable or disable the -browser's use of Tor. It adds a panel to the statusbar that says "Tor -Enabled" (in green) or "Tor Disabled" (in red). The user may click on the -panel to toggle the status. If the user (or some other extension) changes -the proxy settings, the change is automatically reflected in the -statusbar. +Torbutton comes pre-installed with Tor Browser and we urge you not to change it. +We do not recommend to install it to Firefox because this is not a sufficient +way to surf anonymously. -Some users may prefer a toolbar button instead of a statusbar panel. Such -a button is included, and one adds it to the toolbar by right-clicking on -the desired toolbar, selecting "Customize...", and then dragging the -Torbutton icon onto the toolbar. There is an option in the preferences to -hide the statusbar panel (Tools->Extensions, select Torbutton, and click -on Preferences). +Torbutton guarantees that DNS requests are sent through the Tor instance that +comes with Tor Browser. You should not change the proxy settings. -Newer Firefoxes have the ability to send DNS resolves through the socks -proxy, and Torbutton will make use of this feature if it is available in -your version of Firefox. +It’s strongly discouraged to install new Add-ons in Tor Browser, because they +can compromise both your privacy and your security. Plus, Tor Browser already +comes installed with two add-ons — HTTPS Everywhere and NoScript — which give +you a lot of added protection. - FAQ +You can read more about it here: +https://www.torproject.org/projects/torbrowser/design/ -1. I can't click on links or hit reload after I toggle Tor! Why? +Also have a look at this page for already answered questions: +https://trac.torproject.org/projects/tor/wiki/org/teams/CommunityTeam/Support_discuss - Due to Firefox Bug 409737, pages can still open popups and perform - Javascript redirects and history access after Tor has been toggled. These - popups and redirects can be blocked, but unfortunately they are - indistinguishable from normal user interactions with the page (such as - clicking on links, opening them in new tabs/windows, or using the history - buttons), and so those are blocked as a side effect. Once that Firefox bug - is fixed, this degree of isolation will become optional (for people who do - not want to accidentally click on links and give away information via - referrers). A workaround is to right click on the link, and open it in a - new tab or window. The tab or window won't load automatically, but you can - hit enter in the URL bar, and it will begin loading. Hitting enter in the - URL bar will also reload the page without clicking the reload button. +For other issues you should know about have a look at this blog post: +https://blog.torproject.org/toggle-or-not-toggle-end-torbutton -2. My browser is in some weird state where nothing works right! - - Try to disable Tor by clicking on the button, and then open a new window. - If that doesn't fix the issue, go to the preferences page and hit 'Restore - Defaults'. This should reset the extension and Firefox to a known good - configuration. If you can manage to reproduce whatever issue gets your - Firefox wedged, please file details at the bug tracker. - -3. When I toggle Tor, my sites that use javascript stop working. Why? - - Javascript can do things like wait until you have disabled Tor before - trying to contact its source site, thus revealing your IP address. As - such, Torbutton must disable Javascript, Meta-Refresh tags, and certain - CSS behavior when Tor state changes from the state that was used to load a - given page. These features are re-enabled when Torbutton goes back into - the state that was used to load the page, but in some cases (particularly - with Javascript and CSS) it is sometimes not possible to fully recover - from the resulting errors, and the page is broken. Unfortunately, the only - thing you can do (and still remain safe from having your IP address leak) - is to reload the page when you toggle Tor, or just ensure you do all your - work in a page before switching tor state. - -4. When I use Tor, Firefox is no longer filling in logins/search boxes for - me. Why? - - Currently, this is tied to the "Block history writes during Tor" setting. - If you have enabled that setting, all formfill functionality (both saving - and reading) is disabled. If this bothers you, you can uncheck that - option, but both history and forms will be saved. To prevent history - disclosure attacks via Non-Tor usage, it is recommended you disable - Non-Tor history reads if you allow history writing during Tor. - -5. Which Firefox extensions should I avoid using? - - This is a tough one. There are thousands of Firefox extensions: making a - complete list of ones that are bad for anonymity is near impossible. - However, here are a few examples that should get you started as to what - sorts of behavior are dangerous. - - 1. StumbleUpon, et al These extensions will send all sorts of information - about the websites you visit to the stumbleupon servers, and correlate - this information with a unique identifier. This is obviously terrible - for your anonymity. More generally, any sort of extension that - requires registration, or even extensions that provide information - about websites you visit should be suspect. - 2. FoxyProxy While FoxyProxy is a nice idea in theory, in practice it is - impossible to configure securely for Tor usage without Torbutton. Like - all vanilla third party proxy plugins, the main risks are plugin - leakage and history disclosure, followed closely by cookie theft - by exit nodes and tracking by adservers (see the Torbutton - Adversary Model for more information). However, even with Torbutton - installed in tandem and always enabled, it is still very difficult - (though not impossible) to configure FoxyProxy securely. Since - FoxyProxy's 'Patterns' mode only applies to specific urls, and not to - an entire tab, setting FoxyProxy to only send specific sites through - Tor will still allow adservers to still learn your real IP. Worse, if - those sites use offsite logging services such as Google Analytics, you - may still end up in their logs with your real IP. Malicious exit nodes - can also cooperate with sites to inject images into pages that bypass - your filters. Setting FoxyProxy to only send certain URLs via Non-Tor - is much more viable, but be very careful with the filters you allow. - For example, something as simple as allowing *google* to go via - Non-Tor will still cause you to end up in all the logs of all websites - that use Google Analytics! See this question on the FoxyProxy FAQ - for more information. - 3. NoScript Torbutton currently mitigates all known anonymity issues with - Javascript. While it may be tempting to get better security by - disabling Javascript for certain sites, you are far better off with an - all-or-nothing approach. NoScript is exceedingly complicated, and has - many subtleties that can surprise even advanced users. For example, - addons.mozilla.org verifies extension integrity via Javascript over - https, but downloads them in the clear. Not adding it to your - whitelist effectively means you are pulling down unverified - extensions. Worse still, using NoScript can actually disable - protections that Torbutton itself provides via Javascript, yet still - allow malicious exit nodes to compromise your anonymity via the - default whitelist (which they can spoof to inject any script they - want). - -6. Which Firefox extensions do you recommend? - - 1. RefControl Mentioned above, this extension allows more - fine-grained referrer spoofing than Torbutton currently provides. It - should break less sites than Torbutton's referrer spoofing option. - 2. SafeCache If you use Tor excessively, and rarely disable it, you - probably want to install this extension to minimize the ability of - sites to store long term identifiers in your cache. This extension - applies same origin policy to the cache, so that elements are - retrieved from the cache only if they are fetched from a document in - the same origin domain as the cached element. - -7. Are there any other issues I should be concerned about? - - There is currently one known unfixed security issue with Torbutton: it is - possible to unmask the javascript hooks that wrap the Date object to - conceal your timezone in Firefox 2, and the timezone masking code does not - work at all on Firefox 3. We are working with the Firefox team to fix one - of Bug 399274 or Bug 419598 to address this. In the meantime, it - is possible to set the TZ environment variable to UTC to cause the browser - to use UTC as your timezone. Under Linux, you can add an export TZ=UTC to - the /usr/bin/firefox script, or edit your system bashrc to do the same. - Under Windows, you can set either a User or System Environment - Variable for TZ via My Computer's properties. In MacOS, the situation is - a lot more complicated, unfortunately. - - In addition, RSS readers such as Firefox Livemarks can perform periodic - fetches. Due to Firefox Bug 436250, there is no way to disable - Livemark fetches during Tor. This can be a problem if you have a lot of - custom Livemark urls that can give away information about your identity. +For a list of all torbutton announcements see +https://blog.torproject.org/category/tags/torbutton

1 0

[torbutton/master] Revert "Fix NoScript IPC for about:blank by whitelisting messages"
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 0a7d19da90202e5d40851432400444dd6287ffd9 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 10:46:58 2018 +0000 Revert "Fix NoScript IPC for about:blank by whitelisting messages" This reverts commit efdc83fec6244d5f2e4b8880fef010a6e362d9dc. --- src/modules/noscript-control.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js index c1442950..934a4ef0 100644 --- a/src/modules/noscript-control.js +++ b/src/modules/noscript-control.js @@ -129,9 +129,6 @@ var initialize = () => { // bind the security_slider pref to the NoScript settings. let messageListener = (a,b,c) => { log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`); - if (a._messageName != "started" && a._messageName != "pageshow") { - return; - } extensionContext.api.browser.runtime.onMessage.removeListener(messageListener); bindPrefAndInit( "extensions.torbutton.security_slider",

1 0

[torbutton/master] Bug 27760: Fix NoScript IPC for about:blank by whitelisting messages
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 6016a170f0266cf926b7ff305796ba83cc353536 Author: Rusty Bird <rustybird(a)net-c.com> Date: Fri Sep 14 13:05:08 2018 +0000 Bug 27760: Fix NoScript IPC for about:blank by whitelisting messages If about:blank is the homepage (or has been passed as a command line parameter), NoScript will send a message named "fetchChildPolicy" _before_ "started". Torbutton would then send its "updateSettings" too soon, resulting in the dreaded error "Could not establish connection. Receiving end does not exist" (see bug 26520). Fix this by whitelisting the relevant messages from NoScript: "started" and also "pageshow" for a slightly more graceful failure mode in case Torbutton somehow misses NoScript startup. --- src/modules/noscript-control.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js index 934a4ef0..621f2b7f 100644 --- a/src/modules/noscript-control.js +++ b/src/modules/noscript-control.js @@ -129,6 +129,9 @@ var initialize = () => { // bind the security_slider pref to the NoScript settings. let messageListener = (a,b,c) => { log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`); + if (!["started", "pageshow"].includes(a.__meta.name)) { + return; + } extensionContext.api.browser.runtime.onMessage.removeListener(messageListener); bindPrefAndInit( "extensions.torbutton.security_slider",

1 0

[tor-browser-build/master] Bug 27546: Fix vertical scrollbar behavior in Tor Browser 8 with Gtk3
by boklm＠torproject.org 18 Sep '18

18 Sep '18

commit 768e2c34a7516ab6e4ce2389d76c45603c3aa2fe Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 09:45:03 2018 +0000 Bug 27546: Fix vertical scrollbar behavior in Tor Browser 8 with Gtk3 --- projects/tor-browser/build | 4 ++++ projects/tor-browser/config | 2 ++ projects/tor-browser/gtk3-settings.ini | 2 ++ 3 files changed, 8 insertions(+) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 4c228a9..85d7eaa 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -71,6 +71,10 @@ tar -C "$TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %]" -xf [% c('input [% INCLUDE 'RelativeLink/start-tor-browser' -%] RBM_TB_EOF chmod +x ${TB_STAGE_DIR}/Browser/start-tor-browser + # Make sure we get the desired scrollbar behavior with Gtk3, see bug 27546. + GTK_SETTINGS_DIR=${TB_STAGE_DIR}/Browser/.config/gtk-3.0 + mkdir -p $GTK_SETTINGS_DIR + cp $rootdir/gtk3-settings.ini $GTK_SETTINGS_DIR/settings.ini [% END %] tar -C ${TB_STAGE_DIR} -xf [% c('input_files_by_name/firefox') %]/tor-browser.tar.gz diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 7d1720b..85754ae 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -74,6 +74,8 @@ input_files: enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' enable: '[% c("var/linux") %]' + - filename: 'gtk3-settings.ini' + enable: '[% c("var/linux") %]' - project: libdmg-hfsplus name: libdmg enable: '[% c("var/osx") %]' diff --git a/projects/tor-browser/gtk3-settings.ini b/projects/tor-browser/gtk3-settings.ini new file mode 100644 index 0000000..55c8e89 --- /dev/null +++ b/projects/tor-browser/gtk3-settings.ini @@ -0,0 +1,2 @@ +[Settings] +gtk-primary-button-warps-slider = false

1 0

[tor-browser-build/master] Bug 27552: Use bundled dir on CentOS/RHEL 6
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit a0420227e3f10f159a40b08a70cbb8c66f64c342 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Sep 17 12:37:17 2018 +0200 Bug 27552: Use bundled dir on CentOS/RHEL 6 On CentOS/RHEL 6, add the bundled directory from the firefox package to the LD_LIBRARY_PATH. In addition, we don't reset anymore the previous LD_LIBRARY_PATH value, but only add new directories to it. This allows users to set LD_LIBRARY_PATH before starting the browser if additional libraries are needed. --- projects/firefox/start-firefox | 37 +++++++++++++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-) diff --git a/projects/firefox/start-firefox b/projects/firefox/start-firefox index dc30574..7e7685c 100644 --- a/projects/firefox/start-firefox +++ b/projects/firefox/start-firefox @@ -2,13 +2,46 @@ basedir=$(dirname "$0") -LD_LIBRARY_PATH="$basedir/TorBrowser/Tor/" +add_LD_LIBRARY_PATH() { + if test -z "$LD_LIBRARY_PATH" + then + LD_LIBRARY_PATH="$1" + else + LD_LIBRARY_PATH="$1:$LD_LIBRARY_PATH" + fi +} + +# Bug 27552: On CentOS/RHEL 6, we need to add the firefox bundled dir +# to LD_LIBRARY_PATH +if test -f /etc/system-release-cpe +then + if test "$(cut -d : -f 3 /etc/system-release-cpe)" = centos || \ + test "$(cut -d : -f 3 /etc/system-release-cpe)" = "enterprise_linux" + then + if test "$(cut -d : -f 5 /etc/system-release-cpe)" = "6" + then + if test -d /usr/lib64/firefox/bundled/lib64 + then + add_LD_LIBRARY_PATH /usr/lib64/firefox/bundled/lib64 + elif test -d /usr/lib/firefox/bundled/lib + then + add_LD_LIBRARY_PATH /usr/lib/firefox/bundled/lib + else + echo "Error: the firefox package (version 60 or more) is not installed." >&2 + echo "On CentOS/RHEL 6, Tor Browser requires the firefox package to be installed." >&2 + exit 1 + fi + fi + fi +fi + # Check if the system has a more recent version of libstdc++.so.6; if yes, use # that instead of the bundled version. "$basedir/abicheck" >/dev/null 2>&1 if [ $? -ne 0 ]; then - LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$basedir/TorBrowser/Tor/libstdc++/" + add_LD_LIBRARY_PATH "$basedir/TorBrowser/Tor/libstdc++/" fi +add_LD_LIBRARY_PATH "$basedir/TorBrowser/Tor/" export LD_LIBRARY_PATH exec "$basedir/firefox.real" "$@"

1 0

[torbutton/master] Merge remote-tracking branch 'arthur/27427_alpha'
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit ec1c0f448893775b660313042709a9b057b3ab75 Merge: 59f3b783 866e3974 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 09:49:29 2018 +0000 Merge remote-tracking branch 'arthur/27427_alpha' src/modules/noscript-control.js | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)

1 0

[torbutton/master] Revert "Bug 27427: Fix NoScript IPC for about:blank by whitelisting messages"
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 59f3b78349d8de267cf69fb8873971ff0d9ecf7b Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 09:48:54 2018 +0000 Revert "Bug 27427: Fix NoScript IPC for about:blank by whitelisting messages" This reverts commit 8ff3b44e478ebddf5a067d796f57a353beae2af0. --- src/modules/noscript-control.js | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js index cd1a1237..66a00528 100644 --- a/src/modules/noscript-control.js +++ b/src/modules/noscript-control.js @@ -125,12 +125,8 @@ var initialize = () => { // Wait for the first message from NoScript to arrive, and then // bind the security_slider pref to the NoScript settings. - let messageListener = (message,b,c) => { - log(3, `Message received from NoScript: ${JSON.stringify([message,b,c])}`); - if (message._messageName !== "started" && - message._messageName !== "pageshow") { - return; - } + let messageListener = (a,b,c) => { + log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`); extensionContext.api.browser.runtime.onMessage.removeListener(messageListener); bindPrefAndInit( "extensions.torbutton.security_slider",

1 0

[torbutton/master] Send updateSettings message using NoScript >= 10.1.9.2 protocol
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 866e3974597a3cc88a6ac9ef805de1b543eadbf7 Author: Rusty Bird <rustybird(a)net-c.com> Date: Fri Sep 14 13:05:10 2018 +0000 Send updateSettings message using NoScript >= 10.1.9.2 protocol --- src/modules/noscript-control.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js index 02fa1bc8..f6d5622b 100644 --- a/src/modules/noscript-control.js +++ b/src/modules/noscript-control.js @@ -51,8 +51,10 @@ const default_caps = [ // capabilities. Most things are blocked. let noscriptSettings = safetyLevel => ( { - "type": "NoScript.updateSettings", // backwards compatibility - "_messageName": "updateSettings", + "__meta": { + "name": "updateSettings", + "recipientInfo": null + }, "policy": { "DEFAULT": { "capabilities": default_caps[safetyLevel],

1 0

[torbutton/master] Fix NoScript IPC for about:blank by whitelisting messages
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit efdc83fec6244d5f2e4b8880fef010a6e362d9dc Author: Rusty Bird <rustybird(a)net-c.com> Date: Mon Sep 3 12:32:04 2018 +0000 Fix NoScript IPC for about:blank by whitelisting messages If about:blank is the homepage (or has been passed as a command line parameter), NoScript will send a message named "fetchChildPolicy" _before_ "started". Torbutton would then send its "updateSettings" too soon, resulting in the dreaded error "Could not establish connection. Receiving end does not exist" (see bug 26520). Fix this by whitelisting the relevant messages from NoScript: "started" and also "pageshow" for a slightly more graceful failure mode in case Torbutton somehow misses NoScript startup. --- src/modules/noscript-control.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js index a03755de..02fa1bc8 100644 --- a/src/modules/noscript-control.js +++ b/src/modules/noscript-control.js @@ -127,6 +127,9 @@ var initialize = () => { // bind the security_slider pref to the NoScript settings. let messageListener = (a,b,c) => { log(3, `Message received from NoScript: ${JSON.stringify([a,b,c])}`); + if (a._messageName != "started" && a._messageName != "pageshow") { + return; + } extensionContext.api.browser.runtime.onMessage.removeListener(messageListener); bindPrefAndInit( "extensions.torbutton.security_slider",

1 0

[tor-browser/tor-browser-60.2.0esr-8.5-1] Bug 26381: about:tor page does not load on first start on Windows
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 62001bb019dbf0956454f8fc550ccc1e81ee8d3c Author: Richard Pospesel <richard(a)torproject.org> Date: Sat Sep 15 04:01:17 2018 +0000 Bug 26381: about:tor page does not load on first start on Windows Child content processes require certain directories to be marked as readable or writeable when Sandboxing is enabled. The directories to be whitelisted are saved in static variables in sandboxBroker.cpp and are initialized in SandboxBroker::GeckoDependentInitialize(). Any child content process which is created before these directories are saved will be unable to read or write to them. The tor-launcher extension triggers the creation of a content process which hosts the tor network configuration settings window. This process is created before the whitelisted directories are saved. The network settings process doesn't need access to these directories to function, but subsequent content processes which are created once the settings window exits do need these directories to function. Sometimes, the creation of these subsequent processes is slow enough for the parent process to 'catch up' and create the whitelist resulting in the broken about:tor tab or broken white tab. A previous iteration of this patch moved the GeckoDependentInitialize() call directly above the call to DoStartup(). However, Mozilla dev Bob Owen objected to this since this places the call before various services are initialized which the SandboxBroker may depend on. Some experimentation would seem to confirm his objections: placing the whitelist init just prior to DoStartup() results in an empty value for the profile directory which prevents child processes reading the chrome and extensions directory. This patch inserts the GeckoDependentInitialize() call into DoStartup() just after the profile directory is known and queryable by the SandboxBroker, and before the 'profile-after-change' notification is fired. It also reverts the temp fix which reduced the sandbox level to 2 on windows. --- browser/app/profile/000-tor-browser.js | 5 ----- toolkit/xre/nsAppRunner.cpp | 6 ------ toolkit/xre/nsXREDirProvider.cpp | 19 +++++++++++++++++++ 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index bc7c4b05e3a1..38f72579760a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -329,11 +329,6 @@ pref("browser.onboarding.newtour", "welcome,privacy,tor-network,circuit-display, pref("browser.onboarding.updatetour", "welcome,privacy,tor-network,circuit-display,security,expect-differences,onion-services"); pref("browser.onboarding.skip-tour-button.hide", true); -#ifdef XP_WIN -// For now, reduce sandboxing level to 2 (see #26381). -pref("security.sandbox.content.level", 2); -#endif - #ifdef TOR_BROWSER_VERSION #expand pref("torbrowser.version", __TOR_BROWSER_VERSION__); #endif diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index 1000014aedd0..7889919ca677 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -5249,12 +5249,6 @@ XREMain::XRE_mainRun() // We intentionally leak the string here since it is required by PR_SetEnv. PR_SetEnv(saved.release()); } - -#if defined(MOZ_SANDBOX) - // Call SandboxBroker to initialize things that depend on Gecko machinery like - // the directory provider. - SandboxBroker::GeckoDependentInitialize(); -#endif #endif SaveStateForAppInitiatedRestart(); diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp index b54985292e81..72545d0eb422 100644 --- a/toolkit/xre/nsXREDirProvider.cpp +++ b/toolkit/xre/nsXREDirProvider.cpp @@ -66,6 +66,10 @@ #include "UIKitDirProvider.h" #endif +#if defined(MOZ_SANDBOX) && defined(XP_WIN) +#include "sandboxBroker.h" +#endif + #if defined(MOZ_CONTENT_SANDBOX) #include "mozilla/SandboxSettings.h" #include "nsIUUIDGenerator.h" @@ -1003,6 +1007,21 @@ nsXREDirProvider::DoStartup() policies->Observe(nullptr, "policies-startup", nullptr); } + #if defined(MOZ_SANDBOX) && defined(XP_WIN) + // Call SandboxBroker to initialize things that depend on Gecko machinery like + // the directory provider. + + // We insert this initialization code here so that any child content processes spawned by + // extensions (such as tor-launcher launching the network configuration window) will have + // all the requisite directories white-listed for read/write access + + // It's inserted here (rather than in XREMain::XRE_mainRun) because we need + // NS_APP_USER_PROFILE_50_DIR to be known + + // See tor bug #26381 and mozilla bug #1485836 + SandboxBroker::GeckoDependentInitialize(); + #endif + // Init the Extension Manager nsCOMPtr<nsIObserver> em = do_GetService("@mozilla.org/addons/integration;1"); if (em) {

1 0

[tor-browser-build/maint-8.0] Release preparations for 8.0.1
by gk＠torproject.org 18 Sep '18

18 Sep '18

commit 58526ef1fac442ce7424d9b1b5f9295c76ad68c7 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 18 09:16:02 2018 +0000 Release preparations for 8.0.1 Versions bump and Changelog update --- projects/firefox/config | 2 +- .../tor-browser/Bundle-Data/Docs/ChangeLog.txt | 27 ++++++++++++++++++++++ projects/tor-browser/config | 4 ++-- projects/tor-launcher/config | 2 +- projects/torbutton/config | 2 +- rbm.conf | 6 ++--- 6 files changed, 35 insertions(+), 8 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 124de7a..ad9d7d8 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build3' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build4' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index c46f139..64ef362 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,30 @@ +Tor Browser 8.0.1 -- September 20 2018 + * All platforms + * Update Tor to 0.3.4.8 + * Update Torbutton to 2.0.7 + * Bug 27097: Tor News signup banner + * Bug 27663: Add New Identity menuitem again + * Bug 26624: Only block OBJECT on highest slider level + * Bug 26555: Don't show IP address for meek or snowflake + * Bug 27478: Torbutton icons for dark theme + * Bug 27506+14520: Move status version to upper left corner for RTL locales + * Bug 27427: Fix NoScript IPC for about:blank by whitelisting messages + * Bug 27558: Update the link to "Your Guard note may not change" text + * Translations update + * Update Tor Launcher to 0.2.16.5 + * Bug 27469: Adapt Moat URLs + * Bug 25405: Cannot use Moat if a meek bridge is configured + * Translations update + * Clean-up + * Update NoScript to 10.1.9.6 + * Bug 27763: Restrict Torbutton signing exemption to mobile + * Bug 26146: Spoof HTTP User-Agent header for desktop platforms + * Bug 27543: QR code is broken on web.whatsapp.com + * Bug 27264: Bookmark items are not visible on the boomark toolbar + * Bug 27535: Enable TLS 1.3 draft version + * OS X + * Bug 27482: Fix crash during start-up on macOS 10.9.x systems + Tor Browser 8.0 -- September 5 2018 * All platforms * Update Firefox to 60.2.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 7d1720b..e0581f4 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -67,9 +67,9 @@ input_files: name: snowflake enable: '[% c("var/snowflake") %]' - filename: Bundle-Data - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 68c3ef1b753210d376ab9b9c73fa053043f4f0f4cab219e317759fb32b104a27 + sha256sum: 336ae26d0a70688e6c2b3c14267c9e80f52f6f36c31f23b8242e0edae3666d42 - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 19f16bb..9e00653 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 0.2.16.3 +version: 0.2.16.5 git_url: https://git.torproject.org/tor-launcher.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/projects/torbutton/config b/projects/torbutton/config index f076b8f..2b2df85 100644 --- a/projects/torbutton/config +++ b/projects/torbutton/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.0.6 +version: 2.0.7 git_url: https://git.torproject.org/torbutton.git git_hash: '[% c("version") %]' gpg_keyring: torbutton.gpg diff --git a/rbm.conf b/rbm.conf index 5cc88e4..8ad5c34 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '8.0' - torbrowser_build: 'build5' + torbrowser_version: '8.0.1' + torbrowser_build: 'build1' torbrowser_incremental_from: - - 7.5.6 + - 8.0 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0