- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 1448771 - Update hnjstdio to handle additional functions from stdio.h that libhyphen wants to use. r=glandium, a=RyanVM
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit 20a839344bbb11759a15d38d283a9ff8862da30b Author: Jonathan Kew <jkew(a)mozilla.com> Date: Wed Mar 28 10:17:51 2018 +0100 Bug 1448771 - Update hnjstdio to handle additional functions from stdio.h that libhyphen wants to use. r=glandium, a=RyanVM --HG-- extra : source : 846bcaa210aa2264bec412c0595113964fafc972 --- intl/hyphenation/glue/hnjalloc.h | 6 +++++ intl/hyphenation/glue/hnjstdio.cpp | 50 ++++++++++++++++++++++++++------------ 2 files changed, 41 insertions(+), 15 deletions(-) diff --git a/intl/hyphenation/glue/hnjalloc.h b/intl/hyphenation/glue/hnjalloc.h index fec3a4bc9009..5cee1be1b6d7 100644 --- a/intl/hyphenation/glue/hnjalloc.h +++ b/intl/hyphenation/glue/hnjalloc.h @@ -31,6 +31,8 @@ #define fopen(path,mode) hnjFopen(path,mode) #define fclose(file) hnjFclose(file) #define fgets(buf,count,file) hnjFgets(buf,count,file) +#define feof(file) hnjFeof(file) +#define fgetc(file) hnjFgetc(file) typedef struct hnjFile_ hnjFile; @@ -44,6 +46,10 @@ int hnjFclose(hnjFile* f); char* hnjFgets(char* s, int n, hnjFile* f); +int hnjFeof(hnjFile* f); + +int hnjFgetc(hnjFile* f); + #ifdef __cplusplus } #endif diff --git a/intl/hyphenation/glue/hnjstdio.cpp b/intl/hyphenation/glue/hnjstdio.cpp index 660ebaf13291..8d50ae17f57b 100644 --- a/intl/hyphenation/glue/hnjstdio.cpp +++ b/intl/hyphenation/glue/hnjstdio.cpp @@ -22,6 +22,7 @@ struct hnjFile_ { char mBuffer[BUFSIZE]; uint32_t mCurPos; uint32_t mLimit; + bool mEOF; }; // replacement for fopen() @@ -58,6 +59,7 @@ hnjFopen(const char* aURISpec, const char* aMode) f->mStream = instream; f->mCurPos = 0; f->mLimit = 0; + f->mEOF = false; return f; } @@ -79,6 +81,27 @@ hnjFclose(hnjFile* f) return result; } +// replacement for fgetc() +int +hnjFgetc(hnjFile* f) +{ + if (f->mCurPos >= f->mLimit) { + f->mCurPos = 0; + + nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit); + if (NS_FAILED(rv)) { + f->mLimit = 0; + } + + if (f->mLimit == 0) { + f->mEOF = true; + return EOF; + } + } + + return f->mBuffer[f->mCurPos++]; +} + // replacement for fgets() // (not a full reimplementation, but sufficient for libhyphen's needs) char* @@ -88,24 +111,15 @@ hnjFgets(char* s, int n, hnjFile* f) int i = 0; while (i < n - 1) { - if (f->mCurPos < f->mLimit) { - char c = f->mBuffer[f->mCurPos++]; - s[i++] = c; - if (c == '\n' || c == '\r') { - break; - } - continue; - } - - f->mCurPos = 0; + int c = hnjFgetc(f); - nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit); - if (NS_FAILED(rv)) { - f->mLimit = 0; - return nullptr; + if (c == EOF) { + break; } - if (f->mLimit == 0) { + s[i++] = c; + + if (c == '\n' || c == '\r') { break; } } @@ -117,3 +131,9 @@ hnjFgets(char* s, int n, hnjFile* f) s[i] = '\0'; // null-terminate the returned string return s; } + +int +hnjFeof(hnjFile* f) +{ + return f->mEOF ? EOF : 0; +}

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 21537: Mark .onion cookies as secure
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit 1f33ee1778b0ad0f696977fbcbae67f72d34b99f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Apr 13 16:59:24 2018 +0000 Bug 21537: Mark .onion cookies as secure --- netwerk/cookie/nsCookieService.cpp | 60 ++++++++++++++++++++------------------ 1 file changed, 32 insertions(+), 28 deletions(-) diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp index cf1d91e2df36..f9390d7ef093 100644 --- a/netwerk/cookie/nsCookieService.cpp +++ b/netwerk/cookie/nsCookieService.cpp @@ -3112,6 +3112,26 @@ PathMatches(nsCookie* aCookie, const nsACString& aPath) { return true; } +static bool +IsSecureHost(nsIURI *aHostURI) { + bool isSecure = true; + // If SchemeIs fails, assume an insecure connection, to be on the safe side. + if (aHostURI && NS_FAILED(aHostURI->SchemeIs("https", &isSecure))) { + isSecure = false; + } + // In case HTTPS is not used check whether we have a .onion host in which + // case the cookie is secure, too. + if (aHostURI && !isSecure) { + nsresult rv; + nsAutoCString hostFromURI; + rv = aHostURI->GetAsciiHost(hostFromURI); + if (NS_SUCCEEDED(rv)) { + isSecure = StringEndsWith(hostFromURI, NS_LITERAL_CSTRING(".onion")); + } + } + return isSecure; +} + void nsCookieService::GetCookieStringInternal(nsIURI *aHostURI, bool aIsForeign, @@ -3164,13 +3184,10 @@ nsCookieService::GetCookieStringInternal(nsIURI *aHostURI, // If it changes, please update that function, or file a bug for someone // else to do so. - // check if aHostURI is using an https secure protocol. - // if it isn't, then we can't send a secure cookie over the connection. - // if SchemeIs fails, assume an insecure connection, to be on the safe side - bool isSecure; - if (NS_FAILED(aHostURI->SchemeIs("https", &isSecure))) { - isSecure = false; - } + // Check if aHostURI is using the HTTPS protocol or if the domain is a + // .onion. If it isn't, then we can't send a secure cookie over the + // connection. + bool isSecure = IsSecureHost(aHostURI); nsCookie *cookie; AutoTArray<nsCookie*, 8> foundCookieList; @@ -3316,20 +3333,10 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI, // so we can handle them separately. bool newCookie = ParseAttributes(aCookieHeader, cookieAttributes); - // Collect telemetry on how often secure cookies are set from non-secure - // origins, and vice-versa. - // - // 0 = nonsecure and "http:" - // 1 = nonsecure and "https:" - // 2 = secure and "http:" - // 3 = secure and "https:" - bool isHTTPS; - nsresult rv = aHostURI->SchemeIs("https", &isHTTPS); - if (NS_SUCCEEDED(rv)) { - Telemetry::Accumulate(Telemetry::COOKIE_SCHEME_SECURITY, - ((cookieAttributes.isSecure)? 0x02 : 0x00) | - ((isHTTPS)? 0x01 : 0x00)); - } + // Check if aHostURI is using the HTTPS protocol or if the domain is a + // .onion. If it isn't, then we can't send a secure cookie over the + // connection. + bool isSecure = IsSecureHost(aHostURI); int64_t currentTimeInUsec = PR_Now(); @@ -3369,7 +3376,7 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI, return newCookie; } // magic prefix checks. MUST be run after CheckDomain() and CheckPath() - if (!CheckPrefixes(cookieAttributes, isHTTPS)) { + if (!CheckPrefixes(cookieAttributes, isSecure)) { COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "failed the prefix tests"); return newCookie; } @@ -3457,13 +3464,10 @@ nsCookieService::AddInternal(const nsCookieKey &aKey, return; } - bool isSecure = true; - if (aHostURI && NS_FAILED(aHostURI->SchemeIs("https", &isSecure))) { - isSecure = false; - } + bool isSecure = IsSecureHost(aHostURI); - // If the new cookie is non-https and wants to set secure flag, - // browser have to ignore this new cookie. + // If the new cookie is non-https or not set by a .onion domain, and wants to + // set secure flag, browser have to ignore this new cookie. // (draft-ietf-httpbis-cookie-alone section 3.1) if (mLeaveSecureAlone && aCookie->IsSecure() && !isSecure) { COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, aCookieHeader,

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 1334776 - Store header names into nsHttpHeaderArray. r=mcmanus
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit cd2dd6a72bef0d0d5d405af3a1913bebb820fc02 Author: Dragana Damjanovic <dd.mozilla(a)gmail.com> Date: Thu Apr 27 16:48:36 2017 +0200 Bug 1334776 - Store header names into nsHttpHeaderArray. r=mcmanus Backported to TBB/ESR52 by Arthur Edelstein <arthuredelstein(a)gmail.com> --- dom/security/test/cors/test_CrossSiteXHR.html | 2 +- netwerk/protocol/http/HttpBaseChannel.cpp | 18 +--- netwerk/protocol/http/PHttpChannelParams.h | 15 +++- netwerk/protocol/http/nsHttpHeaderArray.cpp | 100 +++++++++++++++++---- netwerk/protocol/http/nsHttpHeaderArray.h | 36 ++++++-- netwerk/protocol/http/nsHttpRequestHead.cpp | 23 ++++- netwerk/protocol/http/nsHttpRequestHead.h | 4 +- netwerk/protocol/http/nsHttpResponseHead.cpp | 50 ++++++++--- netwerk/protocol/http/nsHttpResponseHead.h | 6 +- netwerk/test/unit/test_bug1064258.js | 2 +- .../test/unit/test_original_sent_received_head.js | 14 +-- 11 files changed, 204 insertions(+), 66 deletions(-) diff --git a/dom/security/test/cors/test_CrossSiteXHR.html b/dom/security/test/cors/test_CrossSiteXHR.html index b3cda3b871f3..d9aef5c60cd0 100644 --- a/dom/security/test/cors/test_CrossSiteXHR.html +++ b/dom/security/test/cors/test_CrossSiteXHR.html @@ -743,7 +743,7 @@ function runTest() { is(res.responseHeaders[header], test.responseHeaders[header], "|xhr.getResponseHeader()|wrong response header (" + header + ") in test for " + test.toSource()); - is(res.allResponseHeaders[header], test.responseHeaders[header], + is(res.allResponseHeaders[header.toLowerCase()], test.responseHeaders[header], "|xhr.getAllResponseHeaderss()|wrong response header (" + header + ") in test for " + test.toSource()); } diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp index e68bff1d115e..97120b97a5d3 100644 --- a/netwerk/protocol/http/HttpBaseChannel.cpp +++ b/netwerk/protocol/http/HttpBaseChannel.cpp @@ -1678,13 +1678,7 @@ HttpBaseChannel::SetRequestHeader(const nsACString& aHeader, return NS_ERROR_INVALID_ARG; } - nsHttpAtom atom = nsHttp::ResolveAtom(flatHeader.get()); - if (!atom) { - NS_WARNING("failed to resolve atom"); - return NS_ERROR_NOT_AVAILABLE; - } - - return mRequestHead.SetHeader(atom, flatValue, aMerge); + return mRequestHead.SetHeader(aHeader, flatValue, aMerge); } NS_IMETHODIMP @@ -1701,13 +1695,7 @@ HttpBaseChannel::SetEmptyRequestHeader(const nsACString& aHeader) return NS_ERROR_INVALID_ARG; } - nsHttpAtom atom = nsHttp::ResolveAtom(flatHeader.get()); - if (!atom) { - NS_WARNING("failed to resolve atom"); - return NS_ERROR_NOT_AVAILABLE; - } - - return mRequestHead.SetEmptyHeader(atom); + return mRequestHead.SetEmptyHeader(aHeader); } NS_IMETHODIMP @@ -1763,7 +1751,7 @@ HttpBaseChannel::SetResponseHeader(const nsACString& header, mResponseHeadersModified = true; - return mResponseHead->SetHeader(atom, value, merge); + return mResponseHead->SetHeader(header, value, merge); } NS_IMETHODIMP diff --git a/netwerk/protocol/http/PHttpChannelParams.h b/netwerk/protocol/http/PHttpChannelParams.h index 4df5c7832ee8..b04f57306c58 100644 --- a/netwerk/protocol/http/PHttpChannelParams.h +++ b/netwerk/protocol/http/PHttpChannelParams.h @@ -98,7 +98,11 @@ struct ParamTraits<mozilla::net::nsHttpHeaderArray::nsEntry> static void Write(Message* aMsg, const paramType& aParam) { - WriteParam(aMsg, aParam.header); + if (aParam.headerNameOriginal.IsEmpty()) { + WriteParam(aMsg, aParam.header); + } else { + WriteParam(aMsg, aParam.headerNameOriginal); + } WriteParam(aMsg, aParam.value); switch (aParam.variety) { case mozilla::net::nsHttpHeaderArray::eVarietyUnknown: @@ -124,11 +128,18 @@ struct ParamTraits<mozilla::net::nsHttpHeaderArray::nsEntry> static bool Read(const Message* aMsg, PickleIterator* aIter, paramType* aResult) { uint8_t variety; - if (!ReadParam(aMsg, aIter, &aResult->header) || + nsAutoCString header; + if (!ReadParam(aMsg, aIter, &header) || !ReadParam(aMsg, aIter, &aResult->value) || !ReadParam(aMsg, aIter, &variety)) return false; + mozilla::net::nsHttpAtom atom = mozilla::net::nsHttp::ResolveAtom(header); + aResult->header = atom; + if (!header.Equals(atom.get())) { + aResult->headerNameOriginal = header; + } + switch (variety) { case 0: aResult->variety = mozilla::net::nsHttpHeaderArray::eVarietyUnknown; diff --git a/netwerk/protocol/http/nsHttpHeaderArray.cpp b/netwerk/protocol/http/nsHttpHeaderArray.cpp index 670300dea50b..98c5a6b9ba47 100644 --- a/netwerk/protocol/http/nsHttpHeaderArray.cpp +++ b/netwerk/protocol/http/nsHttpHeaderArray.cpp @@ -18,8 +18,33 @@ namespace net { //----------------------------------------------------------------------------- // nsHttpHeaderArray <public> //----------------------------------------------------------------------------- + +nsresult +nsHttpHeaderArray::SetHeader(const nsACString &headerName, + const nsACString &value, + bool merge, + nsHttpHeaderArray::HeaderVariety variety) +{ + nsHttpAtom header = nsHttp::ResolveAtom(PromiseFlatCString(headerName).get()); + if (!header) { + NS_WARNING("failed to resolve atom"); + return NS_ERROR_NOT_AVAILABLE; + } + return SetHeader(header, headerName, value, merge, variety); +} + +nsresult +nsHttpHeaderArray::SetHeader(nsHttpAtom header, + const nsACString &value, + bool merge, + nsHttpHeaderArray::HeaderVariety variety) +{ + return SetHeader(header, EmptyCString(), value, merge, variety); +} + nsresult nsHttpHeaderArray::SetHeader(nsHttpAtom header, + const nsACString &headerName, const nsACString &value, bool merge, nsHttpHeaderArray::HeaderVariety variety) @@ -51,7 +76,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header, MOZ_ASSERT(!entry || variety != eVarietyRequestDefault, "Cannot set default entry which overrides existing entry!"); if (!entry) { - return SetHeader_internal(header, value, variety); + return SetHeader_internal(header, headerName, value, variety); } else if (merge && !IsSingletonHeader(header)) { return MergeHeader(header, entry, value, variety); } else { @@ -59,7 +84,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header, if (entry->variety == eVarietyResponseNetOriginalAndResponse) { MOZ_ASSERT(variety == eVarietyResponse); entry->variety = eVarietyResponseNetOriginal; - return SetHeader_internal(header, value, variety); + return SetHeader_internal(header, headerName, value, variety); } else { entry->value = value; entry->variety = variety; @@ -71,6 +96,7 @@ nsHttpHeaderArray::SetHeader(nsHttpAtom header, nsresult nsHttpHeaderArray::SetHeader_internal(nsHttpAtom header, + const nsACString &headerName, const nsACString &value, nsHttpHeaderArray::HeaderVariety variety) { @@ -79,14 +105,26 @@ nsHttpHeaderArray::SetHeader_internal(nsHttpAtom header, return NS_ERROR_OUT_OF_MEMORY; } entry->header = header; + // Only save original form of a header if it is different than the header + // atom string. + if (!headerName.Equals(header.get())) { + entry->headerNameOriginal = headerName; + } entry->value = value; entry->variety = variety; return NS_OK; } nsresult -nsHttpHeaderArray::SetEmptyHeader(nsHttpAtom header, HeaderVariety variety) +nsHttpHeaderArray::SetEmptyHeader(const nsACString &headerName, + HeaderVariety variety) { + nsHttpAtom header = nsHttp::ResolveAtom(PromiseFlatCString(headerName).get()); + if (!header) { + NS_WARNING("failed to resolve atom"); + return NS_ERROR_NOT_AVAILABLE; + } + MOZ_ASSERT((variety == eVarietyResponse) || (variety == eVarietyRequestDefault) || (variety == eVarietyRequestOverride), @@ -104,11 +142,12 @@ nsHttpHeaderArray::SetEmptyHeader(nsHttpAtom header, HeaderVariety variety) entry->variety = eVarietyResponseNetOriginal; } - return SetHeader_internal(header, EmptyCString(), variety); + return SetHeader_internal(header, headerName, EmptyCString(), variety); } nsresult nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, + const nsACString &headerNameOriginal, const nsACString &value, bool response) { @@ -125,7 +164,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, LOG(("Ignoring Empty Header: %s\n", header.get())); if (response) { // Set header as original but not as response header. - return SetHeader_internal(header, value, + return SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } return NS_OK; // ignore empty headers by default @@ -135,7 +174,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, if (response) { variety = eVarietyResponseNetOriginalAndResponse; } - return SetHeader_internal(header, value, variety); + return SetHeader_internal(header, headerNameOriginal, value, variety); } else if (!IsSingletonHeader(header)) { HeaderVariety variety = eVarietyRequestOverride; @@ -147,7 +186,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, return rv; } if (response) { - rv = SetHeader_internal(header, value, + rv = SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } return rv; @@ -164,7 +203,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, } if (response) { - return SetHeader_internal(header, value, + return SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } } @@ -174,6 +213,7 @@ nsHttpHeaderArray::SetHeaderFromNet(nsHttpAtom header, nsresult nsHttpHeaderArray::SetResponseHeaderFromCache(nsHttpAtom header, + const nsACString &headerNameOriginal, const nsACString &value, nsHttpHeaderArray::HeaderVariety variety) { @@ -183,7 +223,7 @@ nsHttpHeaderArray::SetResponseHeaderFromCache(nsHttpAtom header, "eVarietyResponseNetOriginal"); if (variety == eVarietyResponseNetOriginal) { - return SetHeader_internal(header, value, + return SetHeader_internal(header, headerNameOriginal, value, eVarietyResponseNetOriginal); } else { nsTArray<nsEntry>::index_type index = 0; @@ -203,7 +243,8 @@ nsHttpHeaderArray::SetResponseHeaderFromCache(nsHttpAtom header, } } while (index != mHeaders.NoIndex); // If we are here, we have not found an entry so add a new one. - return SetHeader_internal(header, value, eVarietyResponse); + return SetHeader_internal(header, headerNameOriginal, value, + eVarietyResponse); } } @@ -260,8 +301,16 @@ nsHttpHeaderArray::GetOriginalHeader(nsHttpAtom aHeader, if (entry.variety == eVarietyResponse) { continue; } + + nsAutoCString hdr; + if (entry.headerNameOriginal.IsEmpty()) { + hdr = nsDependentCString(entry.header); + } else { + hdr = entry.headerNameOriginal; + } + rv = NS_OK; - if (NS_FAILED(aVisitor->VisitHeader(nsDependentCString(entry.header), + if (NS_FAILED(aVisitor->VisitHeader(hdr, entry.value))) { break; } @@ -298,8 +347,14 @@ nsHttpHeaderArray::VisitHeaders(nsIHttpHeaderVisitor *visitor, nsHttpHeaderArray } else if (filter == eFilterResponseOriginal && entry.variety == eVarietyResponse) { continue; } - rv = visitor->VisitHeader( - nsDependentCString(entry.header), entry.value); + + nsAutoCString hdr; + if (entry.headerNameOriginal.IsEmpty()) { + hdr = nsDependentCString(entry.header); + } else { + hdr = entry.headerNameOriginal; + } + rv = visitor->VisitHeader(hdr, entry.value); if NS_FAILED(rv) { return rv; } @@ -310,6 +365,7 @@ nsHttpHeaderArray::VisitHeaders(nsIHttpHeaderVisitor *visitor, nsHttpHeaderArray /*static*/ nsresult nsHttpHeaderArray::ParseHeaderLine(const nsACString& line, nsHttpAtom *hdr, + nsACString *headerName, nsACString *val) { // @@ -360,6 +416,7 @@ nsHttpHeaderArray::ParseHeaderLine(const nsACString& line, // assign return values if (hdr) *hdr = atom; if (val) val->Assign(p, p2 - p + 1); + if (headerName) headerName->Assign(sub); return NS_OK; } @@ -397,7 +454,11 @@ nsHttpHeaderArray::Flatten(nsACString &buf, bool pruneProxyHeaders, continue; } - buf.Append(entry.header); + if (entry.headerNameOriginal.IsEmpty()) { + buf.Append(entry.header); + } else { + buf.Append(entry.headerNameOriginal); + } buf.AppendLiteral(": "); buf.Append(entry.value); buf.AppendLiteral("\r\n"); @@ -415,7 +476,12 @@ nsHttpHeaderArray::FlattenOriginalHeader(nsACString &buf) continue; } - buf.Append(entry.header); + if (entry.headerNameOriginal.IsEmpty()) { + buf.Append(entry.header); + } else { + buf.Append(entry.headerNameOriginal); + } + buf.AppendLiteral(": "); buf.Append(entry.value); buf.AppendLiteral("\r\n"); @@ -423,11 +489,13 @@ nsHttpHeaderArray::FlattenOriginalHeader(nsACString &buf) } const char * -nsHttpHeaderArray::PeekHeaderAt(uint32_t index, nsHttpAtom &header) const +nsHttpHeaderArray::PeekHeaderAt(uint32_t index, nsHttpAtom &header, + nsACString &headerNameOriginal) const { const nsEntry &entry = mHeaders[index]; header = entry.header; + headerNameOriginal = entry.headerNameOriginal; return entry.value.get(); } diff --git a/netwerk/protocol/http/nsHttpHeaderArray.h b/netwerk/protocol/http/nsHttpHeaderArray.h index 91b91f04aa1c..4c4b92911a5d 100644 --- a/netwerk/protocol/http/nsHttpHeaderArray.h +++ b/netwerk/protocol/http/nsHttpHeaderArray.h @@ -49,19 +49,30 @@ public: }; // Used by internal setters: to set header from network use SetHeaderFromNet + nsresult SetHeader(const nsACString &headerName, + const nsACString &value, + bool merge, HeaderVariety variety); nsresult SetHeader(nsHttpAtom header, const nsACString &value, bool merge, HeaderVariety variety); + nsresult SetHeader(nsHttpAtom header, + const nsACString &headerName, + const nsACString &value, + bool merge, HeaderVariety variety); // Used by internal setters to set an empty header - nsresult SetEmptyHeader(nsHttpAtom header, HeaderVariety variety); + nsresult SetEmptyHeader(const nsACString &headerName, HeaderVariety variety); // Merges supported headers. For other duplicate values, determines if error // needs to be thrown or 1st value kept. // For the response header we keep the original headers as well. - nsresult SetHeaderFromNet(nsHttpAtom header, const nsACString &value, + nsresult SetHeaderFromNet(nsHttpAtom header, + const nsACString &headerNameOriginal, + const nsACString &value, bool response); - nsresult SetResponseHeaderFromCache(nsHttpAtom header, const nsACString &value, + nsresult SetResponseHeaderFromCache(nsHttpAtom header, + const nsACString &headerNameOriginal, + const nsACString &value, HeaderVariety variety); nsresult GetHeader(nsHttpAtom header, nsACString &value) const; @@ -97,15 +108,17 @@ public: // parse a header line, return the header atom and a pointer to the // header value (the substring of the header line -- do not free). static nsresult ParseHeaderLine(const nsACString& line, - nsHttpAtom *header=nullptr, - nsACString* value=nullptr); + nsHttpAtom *header = nullptr, + nsACString *headerNameOriginal = nullptr, + nsACString* value = nullptr); void Flatten(nsACString &, bool pruneProxyHeaders, bool pruneTransients); void FlattenOriginalHeader(nsACString &); uint32_t Count() const { return mHeaders.Length(); } - const char *PeekHeaderAt(uint32_t i, nsHttpAtom &header) const; + const char *PeekHeaderAt(uint32_t i, nsHttpAtom &header, + nsACString &headerNameOriginal) const; void Clear(); @@ -113,6 +126,7 @@ public: struct nsEntry { nsHttpAtom header; + nsCString headerNameOriginal; nsCString value; HeaderVariety variety = eVarietyUnknown; @@ -140,7 +154,9 @@ private: int32_t LookupEntry(nsHttpAtom header, nsEntry **); nsresult MergeHeader(nsHttpAtom header, nsEntry *entry, const nsACString &value, HeaderVariety variety); - nsresult SetHeader_internal(nsHttpAtom header, const nsACString &value, + nsresult SetHeader_internal(nsHttpAtom header, + const nsACString &headerName, + const nsACString &value, HeaderVariety variety); // Header cannot be merged: only one value possible @@ -257,7 +273,11 @@ nsHttpHeaderArray::MergeHeader(nsHttpAtom header, if (entry->variety == eVarietyResponseNetOriginalAndResponse) { MOZ_ASSERT(variety == eVarietyResponse); entry->variety = eVarietyResponseNetOriginal; - nsresult rv = SetHeader_internal(header, newValue, eVarietyResponse); + // Copy entry->headerNameOriginal because in SetHeader_internal we are going + // to a new one and a realocation can happen. + nsCString headerNameOriginal = entry->headerNameOriginal; + nsresult rv = SetHeader_internal(header, headerNameOriginal, + newValue, eVarietyResponse); if (NS_FAILED(rv)) { return rv; } diff --git a/netwerk/protocol/http/nsHttpRequestHead.cpp b/netwerk/protocol/http/nsHttpRequestHead.cpp index 094a79457094..b366a8d54264 100644 --- a/netwerk/protocol/http/nsHttpRequestHead.cpp +++ b/netwerk/protocol/http/nsHttpRequestHead.cpp @@ -131,6 +131,20 @@ nsHttpRequestHead::Origin(nsACString &aOrigin) } nsresult +nsHttpRequestHead::SetHeader(const nsACString &h, const nsACString &v, + bool m /*= false*/) +{ + ReentrantMonitorAutoEnter mon(mReentrantMonitor); + + if (mInVisitHeaders) { + return NS_ERROR_FAILURE; + } + + return mHeaders.SetHeader(h, v, m, + nsHttpHeaderArray::eVarietyRequestOverride); +} + +nsresult nsHttpRequestHead::SetHeader(nsHttpAtom h, const nsACString &v, bool m /*= false*/) { @@ -158,7 +172,7 @@ nsHttpRequestHead::SetHeader(nsHttpAtom h, const nsACString &v, bool m, } nsresult -nsHttpRequestHead::SetEmptyHeader(nsHttpAtom h) +nsHttpRequestHead::SetEmptyHeader(const nsACString &h) { ReentrantMonitorAutoEnter mon(mReentrantMonitor); @@ -253,6 +267,7 @@ nsHttpRequestHead::ParseHeaderSet(const char *buffer) { ReentrantMonitorAutoEnter mon(mReentrantMonitor); nsHttpAtom hdr; + nsAutoCString headerNameOriginal; nsAutoCString val; while (buffer) { const char *eof = strchr(buffer, '\r'); @@ -262,9 +277,13 @@ nsHttpRequestHead::ParseHeaderSet(const char *buffer) if (NS_SUCCEEDED(nsHttpHeaderArray::ParseHeaderLine( nsDependentCSubstring(buffer, eof - buffer), &hdr, + &headerNameOriginal, &val))) { - mHeaders.SetHeaderFromNet(hdr, val, false); + mHeaders.SetHeaderFromNet(hdr, + headerNameOriginal, + val, + false); } buffer = eof + 1; if (*buffer == '\n') { diff --git a/netwerk/protocol/http/nsHttpRequestHead.h b/netwerk/protocol/http/nsHttpRequestHead.h index 415968083477..b7020d33a0ac 100644 --- a/netwerk/protocol/http/nsHttpRequestHead.h +++ b/netwerk/protocol/http/nsHttpRequestHead.h @@ -57,10 +57,12 @@ public: int32_t port); void Origin(nsACString &aOrigin); + nsresult SetHeader(const nsACString &h, const nsACString &v, + bool m=false); nsresult SetHeader(nsHttpAtom h, const nsACString &v, bool m=false); nsresult SetHeader(nsHttpAtom h, const nsACString &v, bool m, nsHttpHeaderArray::HeaderVariety variety); - nsresult SetEmptyHeader(nsHttpAtom h); + nsresult SetEmptyHeader(const nsACString &h); nsresult GetHeader(nsHttpAtom h, nsACString &v); nsresult ClearHeader(nsHttpAtom h); diff --git a/netwerk/protocol/http/nsHttpResponseHead.cpp b/netwerk/protocol/http/nsHttpResponseHead.cpp index 6d384c48872e..fa6430b8231f 100644 --- a/netwerk/protocol/http/nsHttpResponseHead.cpp +++ b/netwerk/protocol/http/nsHttpResponseHead.cpp @@ -137,6 +137,26 @@ nsHttpResponseHead::Immutable() } nsresult +nsHttpResponseHead::SetHeader(const nsACString &hdr, + const nsACString &val, + bool merge) +{ + ReentrantMonitorAutoEnter monitor(mReentrantMonitor); + + if (mInVisitHeaders) { + return NS_ERROR_FAILURE; + } + + nsHttpAtom atom = nsHttp::ResolveAtom(PromiseFlatCString(hdr).get()); + if (!atom) { + NS_WARNING("failed to resolve atom"); + return NS_ERROR_NOT_AVAILABLE; + } + + return SetHeader_locked(atom, hdr, val, merge); +} + +nsresult nsHttpResponseHead::SetHeader(nsHttpAtom hdr, const nsACString &val, bool merge) @@ -147,24 +167,25 @@ nsHttpResponseHead::SetHeader(nsHttpAtom hdr, return NS_ERROR_FAILURE; } - return SetHeader_locked(hdr, val, merge); + return SetHeader_locked(hdr, EmptyCString(), val, merge); } nsresult -nsHttpResponseHead::SetHeader_locked(nsHttpAtom hdr, +nsHttpResponseHead::SetHeader_locked(nsHttpAtom atom, + const nsACString &hdr, const nsACString &val, bool merge) { - nsresult rv = mHeaders.SetHeader(hdr, val, merge, + nsresult rv = mHeaders.SetHeader(atom, hdr, val, merge, nsHttpHeaderArray::eVarietyResponse); if (NS_FAILED(rv)) return rv; // respond to changes in these headers. we need to reparse the entire // header since the change may have merged in additional values. - if (hdr == nsHttp::Cache_Control) - ParseCacheControl(mHeaders.PeekHeader(hdr)); - else if (hdr == nsHttp::Pragma) - ParsePragma(mHeaders.PeekHeader(hdr)); + if (atom == nsHttp::Cache_Control) + ParseCacheControl(mHeaders.PeekHeader(atom)); + else if (atom == nsHttp::Pragma) + ParsePragma(mHeaders.PeekHeader(atom)); return NS_OK; } @@ -316,6 +337,7 @@ nsHttpResponseHead::ParseCachedOriginalHeaders(char *block) char *p = block; nsHttpAtom hdr = {0}; + nsAutoCString headerNameOriginal; nsAutoCString val; nsresult rv; @@ -331,12 +353,13 @@ nsHttpResponseHead::ParseCachedOriginalHeaders(char *block) *p = 0; if (NS_FAILED(nsHttpHeaderArray::ParseHeaderLine( - nsDependentCString(block, p - block), &hdr, &val))) { + nsDependentCString(block, p - block), &hdr, &headerNameOriginal, &val))) { return NS_OK; } rv = mHeaders.SetResponseHeaderFromCache(hdr, + headerNameOriginal, val, nsHttpHeaderArray::eVarietyResponseNetOriginal); @@ -567,18 +590,21 @@ nsresult nsHttpResponseHead::ParseHeaderLine_locked(const nsACString &line, bool originalFromNetHeaders) { nsHttpAtom hdr = {0}; + nsAutoCString headerNameOriginal; nsAutoCString val; - if (NS_FAILED(nsHttpHeaderArray::ParseHeaderLine(line, &hdr, &val))) { + if (NS_FAILED(nsHttpHeaderArray::ParseHeaderLine(line, &hdr, &headerNameOriginal, &val))) { return NS_OK; } nsresult rv; if (originalFromNetHeaders) { rv = mHeaders.SetHeaderFromNet(hdr, + headerNameOriginal, val, true); } else { rv = mHeaders.SetResponseHeaderFromCache(hdr, + headerNameOriginal, val, nsHttpHeaderArray::eVarietyResponse); } @@ -856,7 +882,8 @@ nsHttpResponseHead::UpdateHeaders(nsHttpResponseHead *aOther) uint32_t i, count = aOther->mHeaders.Count(); for (i=0; i<count; ++i) { nsHttpAtom header; - const char *val = aOther->mHeaders.PeekHeaderAt(i, header); + nsAutoCString headerNameOriginal; + const char *val = aOther->mHeaders.PeekHeaderAt(i, header, headerNameOriginal); if (!val) { continue; @@ -890,7 +917,8 @@ nsHttpResponseHead::UpdateHeaders(nsHttpResponseHead *aOther) LOG(("new response header [%s: %s]\n", header.get(), val)); // overwrite the current header value with the new value... - SetHeader_locked(header, nsDependentCString(val)); + SetHeader_locked(header, headerNameOriginal, + nsDependentCString(val)); } } diff --git a/netwerk/protocol/http/nsHttpResponseHead.h b/netwerk/protocol/http/nsHttpResponseHead.h index 0a912f4b403b..8b51386ea229 100644 --- a/netwerk/protocol/http/nsHttpResponseHead.h +++ b/netwerk/protocol/http/nsHttpResponseHead.h @@ -65,6 +65,8 @@ public: */ int64_t TotalEntitySize(); + nsresult SetHeader(const nsACString &h, const nsACString &v, + bool m=false); nsresult SetHeader(nsHttpAtom h, const nsACString &v, bool m=false); nsresult GetHeader(nsHttpAtom h, nsACString &v); void ClearHeader(nsHttpAtom h); @@ -137,8 +139,8 @@ public: bool HasContentType(); bool HasContentCharset(); private: - nsresult SetHeader_locked(nsHttpAtom h, const nsACString &v, - bool m=false); + nsresult SetHeader_locked(nsHttpAtom atom, const nsACString &h, + const nsACString &v, bool m=false); void AssignDefaultStatusText(); void ParseVersion(const char *); void ParseCacheControl(const char *); diff --git a/netwerk/test/unit/test_bug1064258.js b/netwerk/test/unit/test_bug1064258.js index 3f76837ae935..da982c2d6f07 100644 --- a/netwerk/test/unit/test_bug1064258.js +++ b/netwerk/test/unit/test_bug1064258.js @@ -133,7 +133,7 @@ function cacheCheck2(status, entry) do_check_eq(entry.dataSize, 0); try { do_check_neq(entry.getMetaDataElement("response-head"), null); - do_check_true(entry.getMetaDataElement("response-head").match('Etag: testetag')); + do_check_true(entry.getMetaDataElement("response-head").match('etag: testetag')); } catch (ex) { do_throw("Missing response head"); diff --git a/netwerk/test/unit/test_original_sent_received_head.js b/netwerk/test/unit/test_original_sent_received_head.js index c4d02d5d2299..eab359a108ae 100644 --- a/netwerk/test/unit/test_original_sent_received_head.js +++ b/netwerk/test/unit/test_original_sent_received_head.js @@ -114,11 +114,11 @@ function checkResponse(request, data, context) { var locationHeaderFound = 0; request.visitResponseHeaders({ visitHeader: function visit(aName, aValue) { - if (aName == "Link") { + if (aName == "link") { linkHeaderFound++; do_check_eq(aValue, "value1, value2"); } - if (aName == "Location") { + if (aName == "location") { locationHeaderFound++; do_check_eq(aValue, "loc"); } @@ -132,7 +132,7 @@ function checkResponse(request, data, context) { var locationOrgHeaderFound = 0; request.visitOriginalResponseHeaders({ visitHeader: function visitOrg(aName, aValue) { - if (aName == "Link") { + if (aName == "link") { if (linkOrgHeaderFound == 0) { do_check_eq(aValue, ""); } else if (linkOrgHeaderFound == 1 ) { @@ -142,7 +142,7 @@ function checkResponse(request, data, context) { } linkOrgHeaderFound++; } - if (aName == "Location") { + if (aName == "location") { locationOrgHeaderFound++; do_check_eq(aValue, "loc"); } @@ -176,7 +176,7 @@ function checkResponse(request, data, context) { var locationOrgHeaderFound2 = 0; request.visitOriginalResponseHeaders({ visitHeader: function visitOrg(aName, aValue) { - if (aName == "Link") { + if (aName == "link") { if (linkOrgHeaderFound2 == 0) { do_check_eq(aValue, ""); } else if (linkOrgHeaderFound2 == 1 ) { @@ -186,7 +186,7 @@ function checkResponse(request, data, context) { } linkOrgHeaderFound2++; } - if (aName == "Location") { + if (aName == "location") { locationOrgHeaderFound2++; do_check_eq(aValue, "loc"); } @@ -199,7 +199,7 @@ function checkResponse(request, data, context) { if (dbg) { print("============== Test GetResponseHeader"); } var linkOrgHeaderFound3 = 0; - request.getOriginalResponseHeader("Link",{ + request.getOriginalResponseHeader("link",{ visitHeader: function visitOrg(aName, aValue) { if (linkOrgHeaderFound3 == 0) { do_check_eq(aValue, "");

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit 76a19c911a7c847756d8ca20a70affdbcad56011 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 20 09:13:28 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes our bug 26424 (disabling UNC paths) and activates Mozilla's fix for https://bugzilla.mozilla.org/show_bug.cgi?id=1413868. --- browser/app/profile/000-tor-browser.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 6fa34860a7b5..f27c5dd93e04 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -255,6 +255,8 @@ pref("devtools.appmanager.enabled", false); pref("devtools.debugger.chrome-debugging-host", "127.0.0.1"); // Disable mozTCPSocket for sure (bug 18863) pref("dom.mozTCPSocket.enabled", false); +// Disable using UNC paths (bug 26424 and Mozilla's bug 1413868) +pref("network.file.disable_unc_paths", true); // Security slider pref("svg.in-content.enabled", true);

1 0

[tor-browser/tor-browser-52.8.0esr-7.5-1] Bug 1334776 - ResponseHeader Visitor will get original header casing. We need to fix it at some places in devtools.
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit 1a800384e6ee8c909a1147737cdebad189f6ca3d Author: Dragana Damjanovic <dd.mozilla(a)gmail.com> Date: Thu Apr 27 16:48:43 2017 +0200 Bug 1334776 - ResponseHeader Visitor will get original header casing. We need to fix it at some places in devtools. Backported to TBB/ESR52 by Arthur Edelstein <arthuredelstein(a)gmail.com> Fixes bug 25938. --- devtools/client/netmonitor/filter-predicates.js | 4 ++-- .../client/netmonitor/test/browser_net_copy_headers.js | 16 ++++++++-------- devtools/client/netmonitor/test/browser_net_filter-01.js | 4 ++-- .../netmonitor/test/browser_net_timing-division.js | 4 ++-- devtools/client/shared/AppCacheUtils.jsm | 8 ++++---- devtools/client/shared/curl.js | 8 ++++---- .../webconsole/net/test/mochitest/browser_net_headers.js | 4 ++-- ...er_webconsole_bug_630733_response_redirect_headers.js | 2 +- devtools/shared/webconsole/test/test_network_get.html | 8 ++++---- .../shared/webconsole/test/test_network_longstring.html | 4 ++-- devtools/shared/webconsole/test/test_network_post.html | 8 ++++---- 11 files changed, 35 insertions(+), 35 deletions(-) diff --git a/devtools/client/netmonitor/filter-predicates.js b/devtools/client/netmonitor/filter-predicates.js index 9c8e49c622b2..75ee422aad60 100644 --- a/devtools/client/netmonitor/filter-predicates.js +++ b/devtools/client/netmonitor/filter-predicates.js @@ -72,7 +72,7 @@ function isWS({ requestHeaders, responseHeaders }) { // Find the 'upgrade' header. let upgradeHeader = requestHeaders.headers.find(header => { - return (header.name == "Upgrade"); + return (header.name.toLowerCase() == "upgrade"); }); // If no header found on request, check response - mainly to get @@ -81,7 +81,7 @@ function isWS({ requestHeaders, responseHeaders }) { if (!upgradeHeader && responseHeaders && Array.isArray(responseHeaders.headers)) { upgradeHeader = responseHeaders.headers.find(header => { - return (header.name == "Upgrade"); + return (header.name.toLowerCase() == "upgrade"); }); } diff --git a/devtools/client/netmonitor/test/browser_net_copy_headers.js b/devtools/client/netmonitor/test/browser_net_copy_headers.js index 36ce2fb34789..bb582c8e1359 100644 --- a/devtools/client/netmonitor/test/browser_net_copy_headers.js +++ b/devtools/client/netmonitor/test/browser_net_copy_headers.js @@ -49,12 +49,12 @@ add_task(function* () { const EXPECTED_RESPONSE_HEADERS = [ `${httpVersion} ${status} ${statusText}`, - "Last-Modified: Sun, 3 May 2015 11:11:11 GMT", - "Content-Type: text/html", - "Content-Length: 465", - "Connection: close", - "Server: httpd.js", - "Date: Sun, 3 May 2015 11:11:11 GMT" + "last-modified: Sun, 3 May 2015 11:11:11 GMT", + "content-type: text/html", + "content-length: 465", + "connection: close", + "server: httpd.js", + "date: Sun, 3 May 2015 11:11:11 GMT" ].join("\n"); yield waitForClipboardPromise(function setup() { @@ -62,8 +62,8 @@ add_task(function* () { }, function validate(result) { // Fake the "Last-Modified" and "Date" headers because they will vary: result = String(result) - .replace(/Last-Modified: [^\n]+ GMT/, "Last-Modified: Sun, 3 May 2015 11:11:11 GMT") - .replace(/Date: [^\n]+ GMT/, "Date: Sun, 3 May 2015 11:11:11 GMT"); + .replace(/last-modified: [^\n]+ GMT/, "last-modified: Sun, 3 May 2015 11:11:11 GMT") + .replace(/date: [^\n]+ GMT/, "date: Sun, 3 May 2015 11:11:11 GMT"); return result === EXPECTED_RESPONSE_HEADERS; }); info("Clipboard contains the currently selected item's response headers."); diff --git a/devtools/client/netmonitor/test/browser_net_filter-01.js b/devtools/client/netmonitor/test/browser_net_filter-01.js index b0d76c6293e0..7b3a8c457dd3 100644 --- a/devtools/client/netmonitor/test/browser_net_filter-01.js +++ b/devtools/client/netmonitor/test/browser_net_filter-01.js @@ -181,9 +181,9 @@ add_task(function* () { "The details pane should still be visible after filtering."); is(RequestsMenu.items.length, visibility.length, - "There should be a specific amount of items in the requests menu."); + "There should be a specific amount of items in the requests menu."); is(RequestsMenu.visibleItems.length, visibility.filter(e => e).length, - "There should be a specific amount of visbile items in the requests menu."); + "There should be a specific amount of visbile items in the requests menu."); for (let i = 0; i < visibility.length; i++) { is(RequestsMenu.getItemAtIndex(i).target.hidden, !visibility[i], diff --git a/devtools/client/netmonitor/test/browser_net_timing-division.js b/devtools/client/netmonitor/test/browser_net_timing-division.js index 0114ba235500..ff2379dc28c4 100644 --- a/devtools/client/netmonitor/test/browser_net_timing-division.js +++ b/devtools/client/netmonitor/test/browser_net_timing-division.js @@ -48,9 +48,9 @@ add_task(function* () { let lastRequest = RequestsMenu.getItemAtIndex(1); info("First request happened at: " + - firstRequest.attachment.responseHeaders.headers.find(e => e.name == "Date").value); + firstRequest.attachment.responseHeaders.headers.find(e => e.name == "date").value); info("Last request happened at: " + - lastRequest.attachment.responseHeaders.headers.find(e => e.name == "Date").value); + lastRequest.attachment.responseHeaders.headers.find(e => e.name == "date").value); ok(secDivs.length, "There should be at least one division on the seconds time scale."); diff --git a/devtools/client/shared/AppCacheUtils.jsm b/devtools/client/shared/AppCacheUtils.jsm index a2beca993c32..7c8007d9ffe2 100644 --- a/devtools/client/shared/AppCacheUtils.jsm +++ b/devtools/client/shared/AppCacheUtils.jsm @@ -86,7 +86,7 @@ AppCacheUtils.prototype = { _parseManifest: function ACU__parseManifest(uriInfo) { let deferred = defer(); let manifestName = uriInfo.name; - let manifestLastModified = new Date(uriInfo.responseHeaders["Last-Modified"]); + let manifestLastModified = new Date(uriInfo.responseHeaders["last-modified"]); if (uriInfo.charset.toLowerCase() != "utf-8") { this._addError(0, "notUTF8", uriInfo.charset); @@ -158,7 +158,7 @@ AppCacheUtils.prototype = { // Check that the resource was not modified after the manifest was last // modified. If it was then the manifest file should be refreshed. let resourceLastModified = - new Date(uriInfo.responseHeaders["Last-Modified"]); + new Date(uriInfo.responseHeaders["last-modified"]); if (manifestLastModified < resourceLastModified) { this._addError(parsedUri.line, "fileChangedButNotManifest", @@ -230,12 +230,12 @@ AppCacheUtils.prototype = { result.requestHeaders = {}; request.visitRequestHeaders(function (header, value) { - result.requestHeaders[header] = value; + result.requestHeaders[header.toLowerCase()] = value; }); result.responseHeaders = {}; request.visitResponseHeaders(function (header, value) { - result.responseHeaders[header] = value; + result.responseHeaders[header.toLowerCase()] = value; }); deferred.resolve(result); diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js index 978cbad9c845..ae954fe9f412 100644 --- a/devtools/client/shared/curl.js +++ b/devtools/client/shared/curl.js @@ -80,14 +80,14 @@ const Curl = { postDataText = data.postDataText; postData.push("--data"); postData.push(escapeString(utils.writePostDataTextParams(postDataText))); - ignoredHeaders.add("Content-Length"); + ignoredHeaders.add("content-length"); } else if (multipartRequest) { postDataText = data.postDataText; postData.push("--data-binary"); let boundary = utils.getMultipartBoundary(data); let text = utils.removeBinaryDataFromMultipartText(postDataText, boundary); postData.push(escapeString(text)); - ignoredHeaders.add("Content-Length"); + ignoredHeaders.add("content-length"); } // Add method. @@ -118,11 +118,11 @@ const Curl = { } for (let i = 0; i < headers.length; i++) { let header = headers[i]; - if (header.name === "Accept-Encoding") { + if (header.name.toLowerCase() === "accept-encoding") { command.push("--compressed"); continue; } - if (ignoredHeaders.has(header.name)) { + if (ignoredHeaders.has(header.name.toLowerCase())) { continue; } command.push("-H"); diff --git a/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js b/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js index 4a47074ee194..14cde846c20c 100644 --- a/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js +++ b/devtools/client/webconsole/net/test/mochitest/browser_net_headers.js @@ -26,11 +26,11 @@ add_task(function* () { // Select "Headers" tab let tabBody = yield selectNetInfoTab(hud, netInfoBody, "headers"); let paramName = tabBody.querySelector( - ".netInfoParamName > span[title='Content-Type']"); + ".netInfoParamName > span[title='content-type']"); // Verify "Content-Type" header (name and value) ok(paramName, "Header name must exist"); - is(paramName.textContent, "Content-Type", + is(paramName.textContent, "content-type", "The header name must have proper value"); let paramValue = paramName.parentNode.nextSibling; diff --git a/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js b/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js index 5097499538c9..da4bdcf122ec 100644 --- a/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js +++ b/devtools/client/webconsole/test/browser_webconsole_bug_630733_response_redirect_headers.js @@ -87,7 +87,7 @@ function getContent() { function performTest() { function readHeader(name) { for (let header of headers) { - if (header.name == name) { + if (header.name.toLowerCase() == name.toLowerCase()) { return header.value; } } diff --git a/devtools/shared/webconsole/test/test_network_get.html b/devtools/shared/webconsole/test/test_network_get.html index 710c9b0d7516..c2313be12a30 100644 --- a/devtools/shared/webconsole/test/test_network_get.html +++ b/devtools/shared/webconsole/test/test_network_get.html @@ -196,13 +196,13 @@ function onResponseHeaders(aState, aResponse) ok(!!aResponse.rawHeaders, "response rawHeaders available"); checkHeadersOrCookies(aResponse.headers, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); checkRawHeaders(aResponse.rawHeaders, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); onResponseCookies = onResponseCookies.bind(null, aState); diff --git a/devtools/shared/webconsole/test/test_network_longstring.html b/devtools/shared/webconsole/test/test_network_longstring.html index d55136896917..9e6ea7771b63 100644 --- a/devtools/shared/webconsole/test/test_network_longstring.html +++ b/devtools/shared/webconsole/test/test_network_longstring.html @@ -212,8 +212,8 @@ function onResponseHeaders(aState, aResponse) ok(aResponse.headersSize > 0, "response headersSize > 0"); checkHeadersOrCookies(aResponse.headers, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, "x-very-short": "hello world", "x-very-long": { "type": "longString", diff --git a/devtools/shared/webconsole/test/test_network_post.html b/devtools/shared/webconsole/test/test_network_post.html index d96b9b0b7c24..a0b8edb648f8 100644 --- a/devtools/shared/webconsole/test/test_network_post.html +++ b/devtools/shared/webconsole/test/test_network_post.html @@ -204,13 +204,13 @@ function onResponseHeaders(aState, aResponse) ok(!!aResponse.rawHeaders, "response rawHeaders available"); checkHeadersOrCookies(aResponse.headers, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); checkRawHeaders(aResponse.rawHeaders, { - "Content-Type": /^application\/(json|octet-stream)$/, - "Content-Length": /^\d+$/, + "content-type": /^application\/(json|octet-stream)$/, + "content-length": /^\d+$/, }); onResponseCookies = onResponseCookies.bind(null, aState);

1 0

[tor-launcher/maint-0.2.14] Bug 20890: Increase control port connection timeout
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit f34e4cc7047a752f4c33736924b2133b371829b8 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed May 16 14:17:16 2018 -0400 Bug 20890: Increase control port connection timeout On slow computers, it can take longer than 30 seconds for Tor Launcher to connect to the tor control port. Increase the timeout to 5 minutes. --- src/components/tl-process.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 53c9919..2bf5a4c 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -38,8 +38,8 @@ TorProcessService.prototype = kWizardProgressPageID: "progress", kInitialControlConnDelayMS: 25, - kMaxControlConnRetryMS: 500, - kControlConnTimeoutMS: 30000, // Wait at most 30 seconds for tor to start. + kMaxControlConnRetryMS: 2000, // Retry at least every 2 seconds. + kControlConnTimeoutMS: 5*60*1000, // Wait at most 5 minutes for tor to start. kStatusUnknown: 0, // Tor process status. kStatusStarting: 1,

1 0

[tor-launcher/maint-0.2.14] Release preparations for 0.2.14.5
by gk＠torproject.org 20 Jun '18

20 Jun '18

commit 08db71c6c4a7f4465f890bd13f502bd54fe35389 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 20 10:54:43 2018 +0000 Release preparations for 0.2.14.5 Version bump --- src/install.rdf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/install.rdf b/src/install.rdf index 1604ac6..703b307 100644 --- a/src/install.rdf +++ b/src/install.rdf @@ -7,7 +7,7 @@ <em:creator>The Tor Project, Inc.</em:creator> <em:contributor>Pearl Crescent, LLC</em:contributor> <em:id>tor-launcher(a)torproject.org</em:id> - <em:version>0.2.14.4</em:version> + <em:version>0.2.14.5</em:version> <em:multiprocessCompatible>true</em:multiprocessCompatible> <em:homepageURL>https://www.torproject.org/projects/torbrowser.html</em:homepageURL> <em:updateURL>data:text/plain,</em:updateURL>

1 0

[tor-browser-build/master] Bug 23561: Fix NSIS builds for Windows 64
by boklm＠torproject.org 19 Jun '18

19 Jun '18

commit 951b1a7e01000f3dc1529c497b64d32cc0e58339 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Sun Jun 17 18:32:21 2018 -0400 Bug 23561: Fix NSIS builds for Windows 64 This commit adds support for building the 64-bit version of NSIS, and also bumps the version to 3.03. Doing this enables us to build MAR files in a 64-bit container for the 64-bit version of Tor Browser; see bug 26363 and bug 24477. The pe_checksum_fix.py doesn't work in a 64-bit container with the bundled python-pefile version so we build its latest version to fix this issue. This change is borrowed from commit bb32ec91b and updates python-pefile to 2017.11.5. The Debian package and the patches are no longer required as all changes were merged upstream in 3.01-1. (See the nsis changelog in Debian.) --- projects/nsis/build | 26 +++++++++++++++-------- projects/nsis/config | 10 ++++----- projects/nsis/no-insert-timestamp.patch | 28 ++++++++++++------------- projects/nsis/nsis-missing-unistd-include.patch | 11 ---------- projects/tor-browser/build | 13 +++++++----- projects/tor-browser/config | 22 +++++++------------ 6 files changed, 51 insertions(+), 59 deletions(-) diff --git a/projects/nsis/build b/projects/nsis/build index 5a7b59f..c6a6d3e 100755 --- a/projects/nsis/build +++ b/projects/nsis/build @@ -3,23 +3,31 @@ [% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] mkdir -p /var/tmp/build tar -C /var/tmp/build -xf nsis-[% c('version') %].tar.bz2 + +# NSIS requires zlib and we later set the path using ZLIB_W32. +tar -C /var/tmp/build -xf [% c('input_files_by_name/zlib') %] + cd /var/tmp/build/nsis-[% c('version') %]-src -tar -xf $rootdir/[% c('input_files_by_name/debian') %] -rm -f debian/patches/nsis_system_zlib.patch -rm -f debian/patches/parallel_build.patch -patch -p1 < $rootdir/nsis-missing-unistd-include.patch -for patch in $(grep '\.patch$' debian/patches/series) -do - [ -f debian/patches/$patch ] && patch -p1 < debian/patches/$patch -done # Adding --no-insert-timestamp to APPEND_LINKFLAGS is not working as it # is used for both the host and cross-compiled parts, but this option is # only valid for the Windows linker. Therefore we add it using a patch # to the cross-compilation part only. patch -p1 < $rootdir/no-insert-timestamp.patch + +[% IF c("var/windows-x86_64") %] + # Seems like setting TARGET_ARCH is not enough so we need to patch build.cpp + # manually; this is confirmed by a comment in the same file. + sed -i 's/m_target_type=TARGET_X86ANSI/m_target_type=TARGET_AMD64/' Source/build.cpp + [% SET target = "amd64" %] +[% ELSE %] + [% SET target = "x86" %] +[% END %] + [% SET scons_args = 'VERSION=' _ c("version") _ ' APPEND_CCFLAGS="-fgnu89-inline"' - _ " SKIPUTILS='NSIS Menu' XGCC_W32_PREFIX=i686-w64-mingw32-" + _ " SKIPUTILS='NSIS Menu' XGCC_W32_PREFIX=" _ c("arch") _ "-w64-mingw32-" + _ " TARGET_ARCH=" _ target + _ " ZLIB_W32=/var/tmp/build/zlib/" _ ' PREFIX=/var/tmp/dist/nsis' -%] scons [% scons_args %] scons [% scons_args %] install diff --git a/projects/nsis/config b/projects/nsis/config index 24adc36..81273ab 100644 --- a/projects/nsis/config +++ b/projects/nsis/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 2.51 +version: 3.03 filename: 'nsis-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: container: @@ -16,11 +16,9 @@ input_files: - project: container-image - filename: 'nsis-[% c("version") %].tar.bz2' URL: 'https://downloads.sourceforge.net/nsis/nsis-[% c("version") %]-src.tar.bz2' - sha256sum: 43d4c9209847e35eb6e2c7cd5a7586e1445374c056c2c7899e40a080e17a1be7 - - name: debian - URL: 'http://http.debian.net/debian/pool/main/n/nsis/nsis_2.51-1.debian.tar.xz' - sha256sum: 1dee6957b4a4b8dfe69bcf28bc7f301a13b96b3fa5a394e36c8926ae781e774a - - filename: nsis-missing-unistd-include.patch + sha256sum: abae7f4488bc6de7a4dd760d5f0e7cd3aad7747d4d7cd85786697c8991695eaa - filename: no-insert-timestamp.patch - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' + - name: zlib + project: zlib diff --git a/projects/nsis/no-insert-timestamp.patch b/projects/nsis/no-insert-timestamp.patch index e71af21..8053b82 100644 --- a/projects/nsis/no-insert-timestamp.patch +++ b/projects/nsis/no-insert-timestamp.patch @@ -1,27 +1,27 @@ -diff -ur nsis-2.51-src/SCons/Config/gnu nsis-2.51-src.n/SCons/Config/gnu ---- nsis-2.51-src/SCons/Config/gnu 2018-05-24 20:40:06.508000000 +0200 -+++ nsis-2.51-src.n/SCons/Config/gnu 2018-05-24 21:04:16.501000000 +0200 -@@ -89,6 +89,7 @@ +diff -ur nsis-3.03-src/SCons/Config/gnu nsis-3.03-src.n/SCons/Config/gnu +--- nsis-3.03-src/SCons/Config/gnu 2017-10-06 15:30:20.000000000 -0400 ++++ nsis-3.03-src.n/SCons/Config/gnu 2018-06-17 13:26:05.945495151 -0400 +@@ -102,6 +102,7 @@ + stub_env.Append(LINKFLAGS = ['$NODEFLIBS_FLAG']) # no standard libraries stub_env.Append(LINKFLAGS = ['$ALIGN_FLAG']) # 512 bytes align - stub_env.Append(LINKFLAGS = ['-Wl,-e,_WinMain@16']) # entry point stub_env.Append(LINKFLAGS = ['$MAP_FLAG']) # generate map file +stub_env.Append(LINKFLAGS = ['-Wl,--no-insert-timestamp']) # remove timestamps for reproducible builds - ### makensis environment - -@@ -125,6 +126,7 @@ + stub_uenv = stub_env.Clone() + stub_uenv.Append(CPPDEFINES = ['_UNICODE', 'UNICODE']) +@@ -142,6 +143,7 @@ plugin_env.Append(LINKFLAGS = ['$MAP_FLAG']) # generate map file - plugin_env.Append(LINKFLAGS = ['-static-libgcc']) # Make sure libgcc is statically linked in, for the plugins to work. - plugin_env.Append(LINKFLAGS = ['-static-libstdc++']) # Make sure libstdc++ is statically linked in, for the plugins to work. + plugin_env.Append(LINKFLAGS = ['-static-libgcc']) # remove libgcc*.dll dependency + plugin_env.Append(LINKFLAGS = ['-static-libstdc++']) # remove libstdc++*.dll dependency +plugin_env.Append(LINKFLAGS = ['-Wl,--no-insert-timestamp']) # remove timestamps for reproducible builds - ### cross-platform util environment - -@@ -148,6 +150,7 @@ + plugin_uenv = plugin_env.Clone() + plugin_uenv.Append(CPPDEFINES = ['_UNICODE', 'UNICODE']) +@@ -181,6 +183,7 @@ util_env.Append(LINKFLAGS = ['-mwindows']) # build windows executables util_env.Append(LINKFLAGS = ['$ALIGN_FLAG']) # 512 bytes align +util_env.Append(LINKFLAGS = ['-Wl,--no-insert-timestamp']) # remove timestamps for reproducible builds + conf = FlagsConfigure(util_env) - if not defenv['DEBUG'] and defenv['STRIP'] and defenv['STRIP_W32']: diff --git a/projects/nsis/nsis-missing-unistd-include.patch b/projects/nsis/nsis-missing-unistd-include.patch deleted file mode 100644 index 4f4fdd2..0000000 --- a/projects/nsis/nsis-missing-unistd-include.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- nsis-2.46-src.old/Source/util.h 2009-03-28 09:47:26.000000000 +0000 -+++ nsis-2.46-src/Source/util.h 2012-01-16 12:22:14.967416817 +0000 -@@ -17,6 +17,8 @@ - #ifndef _UTIL_H_ - #define _UTIL_H_ - -+#include <unistd.h> -+ - #include <string> // for std::string - - #include "boost/scoped_ptr.hpp" // for boost::scoped_ptr diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 52678ed..65c752b 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -43,11 +43,6 @@ mkdir -p "$TBDIR/$MEEKPROFILEPATH/extensions" # Extract the MAR tools. unzip -d $rootdir $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip MARTOOLS=$rootdir/mar-tools -[% IF c("var/windows-x86_64") -%] - # Workaround for bug 24477 - rm -Rf $MARTOOLS - unzip -d $rootdir $rootdir/mar-tools-linux32.zip -[% END -%] mv [% c('input_files_by_name/tor-launcher') %] "$TBDIR/$EXTSPATH/tor-launcher(a)torproject.org.xpi" mv [% c('input_files_by_name/torbutton') %] "$TBDIR/$EXTSPATH/torbutton(a)torproject.org.xpi" @@ -241,6 +236,14 @@ popd [% IF c("var/windows") %] + # We need to install a recent version of python-pefile so that it works + # in a x86_64 container: + # https://github.com/TheTorProject/tor-messenger-build/pull/10 + tar xf $rootdir/[% c('input_files_by_name/python-pefile') %] + cd $(echo [% c('input_files_by_name/python-pefile') %] | sed s/\.tar\.gz$//) + python setup.py install --user + cd .. + tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/nsis') %] export PATH="/var/tmp/dist/nsis/bin:$PATH" diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 225a0bb..820755c 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -28,17 +28,16 @@ targets: windows: var: arch_deps: - - python-pefile + - python-future + pre_pkginst: | + # enable jessie-backports for python-future + echo 'deb http://ftp.debian.org/debian jessie-backports main' >> /etc/apt/sources.list windows-i686: var: mar_osname: win32 windows-x86_64: var: mar_osname: win64 - # We use a 32bit container to be able to use a 32bit nsis and - # pe_checksum_fix.py - container: - arch: i386 input_files: - project: container-image @@ -79,18 +78,13 @@ input_files: enable: '[% c("var/osx") %]' - project: nsis name: nsis - target: - - '[% c("var/channel") %]' - - torbrowser-windows-i686 enable: '[% c("var/windows") %]' - name: tbb-windows-installer project: tbb-windows-installer enable: '[% c("var/windows") %]' - filename: pe_checksum_fix.py enable: '[% c("var/windows") %]' - # Workaround for bug 24477 - - URL: https://archive.torproject.org/tor-package-archive/torbrowser/7.5a7/mar-too… - sig_ext: asc - file_gpg_id: 1 - gpg_keyring: torbrowser.gpg - enable: '[% c("var/windows-x86_64") %]' + - name: python-pefile + URL: https://files.pythonhosted.org/packages/7e/9b/f99171190f04cd23768547dd34533… + sha256sum: 675c35ee0e1677db9e80d2f48d8a7ff2cf38e6207e8cd5e2a2c6d126db025854 + enable: '[% c("var/windows") %]'

1 0

[tor-browser-build/master] Bug 26362: Use old MAR format for update file creation
by boklm＠torproject.org 19 Jun '18

19 Jun '18

commit befc4910feb0eee2016e10000ed31e3fea7ef6b1 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 19 09:29:37 2018 +0000 Bug 26362: Use old MAR format for update file creation Mozilla switched from Bzip2 to LZMA as compression algorithm for MAR files during th Firefox 56. That means esr52-based Tor Browsers don't understand LZMA yet. Thus, we still use Bzip2 for the first esr60-based MAR files and switch afterwards to LZMA. --- Makefile | 8 ++++---- projects/tor-browser/build | 3 +++ 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 4c21a83..80e9983 100644 --- a/Makefile +++ b/Makefile @@ -113,13 +113,13 @@ signtag-alpha: submodule-update incrementals-release: submodule-update $(rbm) build release --step update_responses_config --target release --target create_unsigned_incrementals tools/update-responses/download_missing_versions release - tools/update-responses/gen_incrementals release + MAR_OLD_FORMAT=1 tools/update-responses/gen_incrementals release $(rbm) build release --step hash_incrementals --target release incrementals-alpha: submodule-update $(rbm) build release --step update_responses_config --target alpha --target create_unsigned_incrementals tools/update-responses/download_missing_versions alpha - tools/update-responses/gen_incrementals alpha + MAR_OLD_FORMAT=1 tools/update-responses/gen_incrementals alpha $(rbm) build release --step hash_incrementals --target alpha update_responses-release: submodule-update @@ -134,13 +134,13 @@ dmg2mar-release: submodule-update $(rbm) build release --step update_responses_config --target release --target signed $(rbm) build release --step dmg2mar --target release --target signed tools/update-responses/download_missing_versions release - CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals release + CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 MAR_OLD_FORMAT=1 tools/update-responses/gen_incrementals release dmg2mar-alpha: submodule-update $(rbm) build release --step update_responses_config --target alpha --target signed $(rbm) build release --step dmg2mar --target alpha --target signed tools/update-responses/download_missing_versions alpha - CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 tools/update-responses/gen_incrementals alpha + CHECK_CODESIGNATURE_EXISTS=1 MAR_SKIP_EXISTING=1 MAR_OLD_FORMAT=1 tools/update-responses/gen_incrementals alpha submodule-update: git submodule update --init diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 19aa657..52678ed 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -268,6 +268,9 @@ popd cd $distdir [% IF c("var/build_mar") -%] + # Let's use the bzip2 format for now so that users can update to the first + # esr60-based Tor Browser. + export MAR_OLD_FORMAT=1 # Create full MAR file and compressed package. MAR_FILE=tor-browser-[% c("var/mar_osname") %]-[% c("var/torbrowser_version") %]_${PKG_LOCALE}.mar MAR=$MARTOOLS/mar MBSDIFF=$MARTOOLS/mbsdiff $MARTOOLS/make_full_update.sh -q $OUTDIR/$MAR_FILE "$TBDIR"

1 0

[torbutton/master] Merge remote-tracking branch 'arthur/26128+1'
by gk＠torproject.org 19 Jun '18

19 Jun '18

commit 1e43e9c6ed448d9ca91235c38f5ea0b4d43c71cb Merge: 65b5371 3e1c144 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jun 19 08:17:29 2018 +0000 Merge remote-tracking branch 'arthur/26128+1' src/chrome/content/torbutton.js | 2 + src/modules/noscript-control.js | 126 ++++++++++++++++++++++++++++++++++++++++ src/modules/security-prefs.js | 8 +-- 3 files changed, 131 insertions(+), 5 deletions(-)

1 0

[torbutton/master] Bug 26128: Adapt security slider to WebExtensions version of NoScript
by gk＠torproject.org 19 Jun '18

19 Jun '18

commit 3e1c144a729f373b3ee70fd8d2a16646b2b6ad12 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Jun 6 21:54:58 2018 -0700 Bug 26128: Adapt security slider to WebExtensions version of NoScript We try to maintain the same security slider behavior as for the legacy version of NoScript. This patch uses a few tricks: 1. Using a LegacyExtensionContext (defined in LegacyExtensionsUtils.jsm) to send JSON objects to NoScript via sendMessage. 2. Taking advantage of an existing invocation of browser.runtime.onMessage.addListener(...) in NoScript's code that accepts a JSON object for updating NoScript's settings. 3. Providing NoScript with settings for a "site" whose "domain" is "http:", which causes NoScript to match non-https sites. (Thanks to Sukhbir Singh for help.) --- src/chrome/content/torbutton.js | 2 + src/modules/noscript-control.js | 126 ++++++++++++++++++++++++++++++++++++++++ src/modules/security-prefs.js | 8 +-- 3 files changed, 131 insertions(+), 5 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 7f750bc..11548d4 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -11,6 +11,7 @@ let { Services } = Cu.import("resource://gre/modules/Services.jsm", {}); let { showDialog } = Cu.import("resource://torbutton/modules/utils.js", {}); let { getLocale, unescapeTorString } = Cu.import("resource://torbutton/modules/utils.js", {}); let SecurityPrefs = Cu.import("resource://torbutton/modules/security-prefs.js", {}); +let NoScriptControl = Cu.import("resource://torbutton/modules/noscript-control.js", {}); let { bindPrefAndInit, observe } = Cu.import("resource://torbutton/modules/utils.js", {}); Cu.importGlobalProperties(["XMLHttpRequest"]); @@ -242,6 +243,7 @@ function torbutton_init() { torbutton_log(3, 'called init()'); SecurityPrefs.initialize(); + NoScriptControl.initialize(); if (m_tb_wasinited) { return; diff --git a/src/modules/noscript-control.js b/src/modules/noscript-control.js new file mode 100644 index 0000000..6270efe --- /dev/null +++ b/src/modules/noscript-control.js @@ -0,0 +1,126 @@ +// # NoScript settings control (for binding to Security Slider) + +/* jshint esversion:6 */ + +// ## Utilities + +const { utils: Cu } = Components; +const { LegacyExtensionContext } = + Cu.import("resource://gre/modules/LegacyExtensionsUtils.jsm", {}); +const { bindPrefAndInit } = + Cu.import("resource://torbutton/modules/utils.js", {}); + +// ## NoScript settings + +// Minimum and maximum capability states as controlled by NoScript. +const max_caps = ["fetch", "font", "frame", "media", "other", "script", "webgl"]; +const min_caps = ["frame", "other"]; + +// Untrusted capabilities for [Standard, Safer, Safest] safety levels. +const untrusted_caps = [ + max_caps, // standard safety: neither http nor https + ["frame", "font", "other"], // safer: http + min_caps, // safest: neither http nor https +]; + +// Default capabilities for [Standard, Safer, Safest] safety levels. +const default_caps = [ + max_caps, // standard: both http and https + ["fetch", "font", "frame", "other", "script", "webgl"], // safer: https only + min_caps, // safest: both http and https +]; + +// __noscriptSettings(safetyLevel)__. +// Produces NoScript settings with policy according to +// the safetyLevel which can be: +// 0 = Standard, 1 = Safer, 2 = Safest +// +// At the "Standard" safety level, we leave all sites at +// default with maximal capabilities. Essentially no content +// is blocked. +// +// At "Safer", we set all http sites to untrusted, +// and all https sites to default. Scripts are only permitted +// on https sites. Neither type of site is supposed to allow +// media, but both allow fonts (as we used in legacy NoScript). +// +// At "Safest", all sites are at default with minimal +// capabilities. Most things are blocked. +let noscriptSettings = safetyLevel => ( + { + "type": "NoScript.updateSettings", + "policy": { + "DEFAULT": { + "capabilities": default_caps[safetyLevel], + "temp": false + }, + "TRUSTED": { + "capabilities": max_caps, + "temp": false + }, + "UNTRUSTED": { + "capabilities": untrusted_caps[safetyLevel], + "temp": false + }, + "sites": { + "trusted": [], + "untrusted": [[], ["http:"], []][safetyLevel], + "custom": {}, + "temp": [] + }, + "enforced": true, + "autoAllowTop": false + }, + "tabId": -1 + }); + +// ## Communications + +// The extension ID for NoScript (WebExtension) +const noscriptID = "{73a6fe31-595d-460b-a920-fcc0f8843232}"; + +// A mock extension object that can communicate with another extension +// via the WebExtensions sendMessage/onMessage mechanism. +let extensionContext = new LegacyExtensionContext({ id : noscriptID }); + +// The component that handles WebExtensions' sendMessage. +let messageManager = extensionContext.messenger.messageManagers[0]; + +// __setNoScriptSettings(settings)__. +// NoScript listens for internal settings with onMessage. We can send +// a new settings JSON object according to NoScript's +// protocol and these are accepted! See the use of +// `browser.runtime.onMessage.addListener(...)` in NoScript's bg/main.js. +let sendNoScriptSettings = settings => + extensionContext.messenger.sendMessage(messageManager, settings, noscriptID); + +// __setNoScriptSafetyLevel(safetyLevel)__. +// Set NoScript settings according to a particular safety level +// (security slider level): 0 = Standard, 1 = Safer, 2 = Safest +let setNoScriptSafetyLevel = safetyLevel => + sendNoScriptSettings(noscriptSettings(safetyLevel)); + +// ## Slider binding + +// __securitySliderToSafetyLevel(sliderState)__. +// Converts the "extensions.torbutton.security_slider" pref value +// to a "safety level" value: 0 = Standard, 1 = Safer, 2 = Safest +let securitySliderToSafetyLevel = sliderState => [undefined, 2, 1, 1, 0][sliderState]; + +// Ensure binding only occurs once. +let initialized = false; + +// __initialize()__. +// The main function that binds the NoScript settings to the security +// slider pref state. +var initialize = () => { + if (initialized) { + return; + } + bindPrefAndInit( + "extensions.torbutton.security_slider", + sliderState => setNoScriptSafetyLevel(securitySliderToSafetyLevel(sliderState))); +}; + +// Export initialize() function for external use. +let EXPORTED_SYMBOLS = ["initialize"]; diff --git a/src/modules/security-prefs.js b/src/modules/security-prefs.js index 3d3630b..d269a1f 100644 --- a/src/modules/security-prefs.js +++ b/src/modules/security-prefs.js @@ -16,19 +16,17 @@ let log = (level, msg) => logger.log(level, msg); // __kSecuritySettings__. // A table of all prefs bound to the security slider, and the value // for each security setting. Note that 2-m and 3-m are identical, -// corresponding to the old 2-medium-high setting. +// corresponding to the old 2-medium-high setting. We also separately +// bind NoScript settings to the extensions.torbutton.security_slider +// (see noscript-control.js). const kSecuritySettings = { // Preference name : [0, 1-high 2-m 3-m 4-low] "javascript.options.ion" : [, false, false, false, true ], "javascript.options.baselinejit" : [, false, false, false, true ], "javascript.options.native_regexp" : [, false, false, false, true ], - "noscript.forbidMedia" : [, true, true, true, false], "media.webaudio.enabled" : [, false, false, false, true ], "mathml.disabled" : [, true, true, true, false], "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ], - "noscript.global" : [, false, false, false, true ], - "noscript.globalHttpsWhitelist" : [, false, true, true, false], - "noscript.forbidFonts" : [, true, false, false, false], "svg.in-content.enabled" : [, false, true, true, true ], };

1 0

[tor-browser/tor-browser-60.0.1esr-8.0-1] Bug 23247: Communicating security expectations for .onion
by gk＠torproject.org 19 Jun '18

19 Jun '18

commit 06fd55e2e061c7348f86d7f0ced3d64ffac9baad Author: Richard Pospesel <richard(a)torproject.org> Date: Fri Jun 8 13:38:40 2018 -0700 Bug 23247: Communicating security expectations for .onion Encrypting pages hosted on Onion Services with SSL/TLS is redundant (in terms of hiding content) as all traffic within the Tor network is already fully encrypted. Therefore, serving HTTP pages from an Onion Service is more or less fine. Prior to this patch, Tor Browser would mostly treat pages delivered via Onion Services as well as pages delivered in the ordinary fashion over the internet in the same way. This created some inconsistencies in behaviour and misinformation presented to the user relating to the security of pages delivered via Onion Services: - HTTP Onion Service pages did not have any 'lock' icon indicating the site was secure - HTTP Onion Service pages would be marked as unencrypted in the Page Info screen - Mixed-mode content restrictions did not apply to HTTP Onion Service pages embedding Non-Onion HTTP content This patch fixes the above issues, and also adds several new 'Onion' icons to the mix to indicate all of the various permutations of Onion Services hosted HTTP or HTTPS pages with HTTP or HTTPS content. Strings for Onion Service Page Info page are pulled from Torbutton's localization strings. --- browser/base/content/browser.js | 66 ++++++++++++++-------- browser/base/content/pageinfo/security.js | 57 +++++++++++++++---- .../shared/identity-block/identity-block.inc.css | 20 +++++++ .../shared/identity-block/onion-disabled.svg | 9 +++ .../themes/shared/identity-block/onion-lock.svg | 9 +++ browser/themes/shared/identity-block/onion.svg | 8 +++ browser/themes/shared/jar.inc.mn | 3 + dom/base/nsContentUtils.cpp | 21 +++++++ dom/base/nsContentUtils.h | 5 ++ dom/base/nsGlobalWindowOuter.cpp | 3 +- dom/presentation/PresentationRequest.cpp | 3 +- dom/security/nsMixedContentBlocker.cpp | 17 +++++- security/manager/ssl/nsSecureBrowserUIImpl.cpp | 57 +++++++++++-------- 13 files changed, 216 insertions(+), 62 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js index 68bbe3af99e9..fbfbf3e809ca 100644 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js @@ -7507,6 +7507,10 @@ var gIdentityHandler = { Services.prefs.getBoolPref("security.insecure_password.ui.enabled"); }, + get _uriIsOnionHost() { + return this._uriHasHost ? this._uri.host.toLowerCase().endsWith(".onion") : false; + }, + // smart getters get _identityPopup() { delete this._identityPopup; @@ -7806,12 +7810,12 @@ var gIdentityHandler = { get pointerlockFsWarningClassName() { // Note that the fullscreen warning does not handle _isSecureInternalUI. if (this._uriHasHost && this._isEV) { - return "verifiedIdentity"; + return this._uriIsOnionHost ? "onionVerifiedIdentity" : "verifiedIdentity"; } if (this._uriHasHost && this._isSecure) { - return "verifiedDomain"; + return this._uriIsOnionHost ? "onionVerifiedDomain" : "verifiedDomain"; } - return "unknownIdentity"; + return this._uriIsOnionHost ? "onionUnknownIdentity" : "unknownIdentity"; }, /** @@ -7832,9 +7836,10 @@ var gIdentityHandler = { let brandBundle = document.getElementById("bundle_brand"); icon_label = brandBundle.getString("brandShorterName"); } else if (this._uriHasHost && this._isEV) { - this._identityBox.className = "verifiedIdentity"; + let uriIsOnionHost = this._uriIsOnionHost; + this._identityBox.className = uriIsOnionHost ? "onionVerifiedIdentity" : "verifiedIdentity"; if (this._isMixedActiveContentBlocked) { - this._identityBox.classList.add("mixedActiveBlocked"); + this._identityBox.classList.add(uriIsOnionHost ? "onionMixedActiveBlocked" : "mixedActiveBlocked"); } if (!this._isCertUserOverridden) { @@ -7860,10 +7865,17 @@ var gIdentityHandler = { let extensionName = this._pageExtensionPolicy.name; icon_label = gNavigatorBundle.getFormattedString( "identity.extension.label", [extensionName]); - } else if (this._uriHasHost && this._isSecure) { - this._identityBox.className = "verifiedDomain"; + // _isSecure implicitly includes onion services, which may not have an SSL certificate + } else if (this._uriHasHost && this._isSecure && this._sslStatus != null) { + let uriIsOnionHost = this._uriIsOnionHost; + if (uriIsOnionHost) { + this._identityBox.className = this._sslStatus.serverCert.isSelfSigned ? "onionSelfSigned" : "onionVerifiedDomain"; + } else { + this._identityBox.className = "verifiedDomain"; + } + if (this._isMixedActiveContentBlocked) { - this._identityBox.classList.add("mixedActiveBlocked"); + this._identityBox.classList.add(uriIsOnionHost ? "onionMixedActiveBlocked" : "mixedActiveBlocked"); } if (!this._isCertUserOverridden) { // It's a normal cert, verifier is the CA Org. @@ -7878,31 +7890,37 @@ var gIdentityHandler = { // For net errors we should not show notSecure as it's likely confusing this._identityBox.className = "unknownIdentity"; } else { + let uriIsOnionHost = this._uriIsOnionHost; if (this._isBroken) { - this._identityBox.className = "unknownIdentity"; + this._identityBox.className = uriIsOnionHost ? "onionUnknownIdentity" : "unknownIdentity"; if (this._isMixedActiveContentLoaded) { - this._identityBox.classList.add("mixedActiveContent"); + this._identityBox.classList.add(uriIsOnionHost ? "onionMixedActiveContent" : "mixedActiveContent"); } else if (this._isMixedActiveContentBlocked) { - this._identityBox.classList.add("mixedDisplayContentLoadedActiveBlocked"); + this._identityBox.classList.add(uriIsOnionHost ? "onionMixedDisplayContentLoadedActiveBlocked" : "mixedDisplayContentLoadedActiveBlocked"); } else if (this._isMixedPassiveContentLoaded) { - this._identityBox.classList.add("mixedDisplayContent"); + this._identityBox.classList.add(uriIsOnionHost ? "onionMixedDisplayContent" : "mixedDisplayContent"); } else { this._identityBox.classList.add("weakCipher"); } } else { - let warnOnInsecure = Services.prefs.getBoolPref("security.insecure_connection_icon.enabled") || - (Services.prefs.getBoolPref("security.insecure_connection_icon.pbmode.enabled") && - PrivateBrowsingUtils.isWindowPrivate(window)); - let className = warnOnInsecure ? "notSecure" : "unknownIdentity"; - this._identityBox.className = className; - - let warnTextOnInsecure = Services.prefs.getBoolPref("security.insecure_connection_text.enabled") || - (Services.prefs.getBoolPref("security.insecure_connection_text.pbmode.enabled") && - PrivateBrowsingUtils.isWindowPrivate(window)); - if (warnTextOnInsecure) { - icon_label = gNavigatorBundle.getString("identity.notSecure.label"); - this._identityBox.classList.add("notSecureText"); + if (!uriIsOnionHost) { + let warnOnInsecure = Services.prefs.getBoolPref("security.insecure_connection_icon.enabled") || + (Services.prefs.getBoolPref("security.insecure_connection_icon.pbmode.enabled") && + PrivateBrowsingUtils.isWindowPrivate(window)); + let className = warnOnInsecure ? "notSecure" : "unknownIdentity"; + this._identityBox.className = className; + + let warnTextOnInsecure = Services.prefs.getBoolPref("security.insecure_connection_text.enabled") || + (Services.prefs.getBoolPref("security.insecure_connection_text.pbmode.enabled") && + PrivateBrowsingUtils.isWindowPrivate(window)); + if (warnTextOnInsecure) { + icon_label = gNavigatorBundle.getString("identity.notSecure.label"); + this._identityBox.classList.add("notSecureText"); + } + // http onion is secure + } else { + this._identityBox.className = "onionUnknownIdentity"; } } if (this._hasInsecureLoginForms) { diff --git a/browser/base/content/pageinfo/security.js b/browser/base/content/pageinfo/security.js index 2d6c5fb1d396..5a827488ccad 100644 --- a/browser/base/content/pageinfo/security.js +++ b/browser/base/content/pageinfo/security.js @@ -12,6 +12,10 @@ ChromeUtils.defineModuleGetter(this, "LoginHelper", ChromeUtils.defineModuleGetter(this, "PluralForm", "resource://gre/modules/PluralForm.jsm"); +XPCOMUtils.defineLazyGetter(this, "gTorButtonBundle", function() { + return Services.strings.createBundle("chrome://torbutton/locale/torbutton.properties"); +}); + var security = { init(uri, windowInfo) { this.uri = uri; @@ -48,6 +52,8 @@ var security = { (ui.state & Ci.nsIWebProgressListener.STATE_IS_INSECURE); var isEV = (ui.state & Ci.nsIWebProgressListener.STATE_IDENTITY_EV_TOPLEVEL); + var isOnion = hostName.endsWith(".onion"); + ui.QueryInterface(nsISSLStatusProvider); var status = ui.SSLStatus; @@ -65,6 +71,7 @@ var security = { isBroken, isMixed, isEV, + isOnion, cert, certificateTransparency: undefined }; @@ -121,6 +128,7 @@ var security = { isBroken, isMixed, isEV, + isOnion, cert: null, certificateTransparency: null }; @@ -257,20 +265,49 @@ function securityOnLoad(uri, windowInfo) { } msg2 = pkiBundle.getString("pageInfo_Privacy_None2"); } else if (info.encryptionStrength > 0) { - hdr = pkiBundle.getFormattedString("pageInfo_EncryptionWithBitsAndProtocol", - [info.encryptionAlgorithm, - info.encryptionStrength + "", - info.version]); + if (!info.isOnion) { + hdr = pkiBundle.getFormattedString("pageInfo_EncryptionWithBitsAndProtocol", + [info.encryptionAlgorithm, + info.encryptionStrength + "", + info.version]); + } else { + try { + hdr = gTorButtonBundle.formatStringFromName("pageInfo_OnionEncryptionWithBitsAndProtocol", + [info.encryptionAlgorithm, + info.encryptionStrength + "", + info.version], 3); + } catch(err) { + hdr = "Connection Encrypted (Onion Service, " + + info.encryptionAlgorithm + + ", " + + info.encryptionStrength + + " bit keys, " + + info.version + + ")"; + } + } msg1 = pkiBundle.getString("pageInfo_Privacy_Encrypted1"); msg2 = pkiBundle.getString("pageInfo_Privacy_Encrypted2"); security._cert = info.cert; } else { - hdr = pkiBundle.getString("pageInfo_NoEncryption"); - if (info.hostName != null) - msg1 = pkiBundle.getFormattedString("pageInfo_Privacy_None1", [info.hostName]); - else - msg1 = pkiBundle.getString("pageInfo_Privacy_None4"); - msg2 = pkiBundle.getString("pageInfo_Privacy_None2"); + if (!info.isOnion) { + hdr = pkiBundle.getString("pageInfo_NoEncryption"); + if (info.hostName != null) { + msg1 = pkiBundle.getFormattedString("pageInfo_Privacy_None1", [info.hostName]); + } else { + msg1 = pkiBundle.getString("pageInfo_Privacy_None4"); + } + msg2 = pkiBundle.getString("pageInfo_Privacy_None2"); + } else { + try { + hdr = gTorButtonBundle.GetStringFromName("pageInfo_OnionEncryption"); + } catch (err) { + hdr = "Connection Encrypted (Onion Service)"; + } + + msg1 = pkiBundle.getString("pageInfo_Privacy_Encrypted1"); + msg2 = pkiBundle.getString("pageInfo_Privacy_Encrypted2"); + } } setText("security-technical-shortform", hdr); setText("security-technical-longform1", msg1); diff --git a/browser/themes/shared/identity-block/identity-block.inc.css b/browser/themes/shared/identity-block/identity-block.inc.css index ac85070708c4..36bab9f13715 100644 --- a/browser/themes/shared/identity-block/identity-block.inc.css +++ b/browser/themes/shared/identity-block/identity-block.inc.css @@ -200,6 +200,26 @@ visibility: visible; } +#urlbar[pageproxystate="valid"] > #identity-box.onionUnknownIdentity > #connection-icon, +#urlbar[pageproxystate="valid"] > #identity-box.onionSelfSigned > #connection-icon { + list-style-image: url(chrome://browser/skin/onion.svg); + visibility: visible; +} + +#urlbar[pageproxystate="valid"] > #identity-box.onionVerifiedDomain > #connection-icon, +#urlbar[pageproxystate="valid"] > #identity-box.onionVerifiedIdentity > #connection-icon, +#urlbar[pageproxystate="valid"] > #identity-box.onionMixedActiveBlocked > #connection-icon { + list-style-image: url(chrome://browser/skin/onion-lock.svg); + visibility: visible; +} + +#urlbar[pageproxystate="valid"] > #identity-box.onionMixedActiveContent > #connection-icon, +#urlbar[pageproxystate="valid"] > #identity-box.onionMixedDisplayContentLoadedActiveBlocked > #connection-icon, +#urlbar[pageproxystate="valid"] > #identity-box.onionMixedDisplayContent > #connection-icon { + list-style-image: url(chrome://browser/skin/onion-disabled.svg); + visibility: visible; +} + #identity-box.extensionPage > #extension-icon { list-style-image: url(chrome://mozapps/skin/extensions/extensionGeneric-16.svg); visibility: visible; diff --git a/browser/themes/shared/identity-block/onion-disabled.svg b/browser/themes/shared/identity-block/onion-disabled.svg new file mode 100644 index 000000000000..f5b20a87a923 --- /dev/null +++ b/browser/themes/shared/identity-block/onion-disabled.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <title>onion-disabled</title> + <defs></defs> + <g id="onion-disabled" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> + <path d="M3.55670557,13.5290809 C2.58943965,12.7067569 2,11.5773827 2,10.2383803 C2,8.40140797 3.11044937,6.84614642 4.80245393,5.95790561 C4.86922061,5.92314081 4.937062,5.88953483 5.00557508,5.85697179 C5.34048317,5.68140952 5.95495153,5.31464081 6.18735866,4.8796172 C6.261514,4.74090562 6.26057363,4.55305979 6.20885297,4.4070476 C6.11172559,4.13310092 5.57517408,3.53792744 5.57517408,3.53792744 L6.39988357,3 L7.47070238,3.38224206 C7.23186151,2.5028722 6.97233174,1.62308364 8.87366696,4.4408921e-16 L8.87366696,0.000113687544 C8.14572562,0.965320936 8.77600936,1.33867083 8.69392696,2.02329722 C9.36752565,0.933374736 10.7903253,0.789787368 11.8884333,0.334923505 C10.6431583,1.59850841 9.72300609,3.05795044 8.87524898,3.88361241 L9.6358507,4.15511863 C9.6358507,4.15511863 9.27501511,4.42489353 9.52743882,4.95911272 C9.65035936,5.21926936 9.85710767,5.38741514 10.0560643,5.49588134 C10.2394376,5.55069385 10.4187806,5.61269109 10.5936905,5.68164129 C10.7858529,5.7574053 10.972 3418,5.84145128 11.1524919,5.93329454 L3.55670557,13.5290809 Z M5.3590214,14.5551922 L12.7674177,7.1467959 C13.5406039,7.99044704 14,9.05632625 14,10.2383803 C14,13.0968586 11.3137496,15 8,15 C7.05229776,15 6.15591919,14.8443406 5.3590214,14.5551922 Z" id="Combined-Shape" fill="#4A4A4A" fill-rule="nonzero"></path> + <path d="M13.7928932,1.29289322 C14.1834175,0.902368927 14.8165825,0.902368927 15.2071068,1.29289322 C15.5976311,1.68341751 15.5976311,2.31658249 15.2071068,2.70710678 L2.70710678,15.2071068 C2.31658249,15.5976311 1.68341751,15.5976311 1.29289322,15.2071068 C0.902368927,14.8165825 0.902368927,14.1834175 1.29289322,13.7928932 L13.7928932,1.29289322 Z" id="Line-2" fill="#D92D21" fill-rule="nonzero"></path> + </g> +</svg> diff --git a/browser/themes/shared/identity-block/onion-lock.svg b/browser/themes/shared/identity-block/onion-lock.svg new file mode 100644 index 000000000000..c88247eb19d7 --- /dev/null +++ b/browser/themes/shared/identity-block/onion-lock.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <title>onion+lock</title> + <defs></defs> + <g id="onion+lock" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> + <path d="M6.12228848,14.9544711 C3.22461281,14.6498012 1,12.8396709 1,10.2383803 C1,8.40140797 2.11044937,6.84614642 3.80245393,5.95790561 C3.86922061,5.92314081 3.937062,5.88953483 4.00557508,5.85697179 C4.34048317,5.68140952 4.95495153,5.31464081 5.18735866,4.8796172 C5.261514,4.74090562 5.26057363,4.55305979 5.20885297,4.4070476 C5.11172559,4.13310092 4.57517408,3.53792744 4.57517408,3.53792744 L5.39988357,3 L6.47070238,3.38224206 C6.23186151,2.5028722 5.97233174,1.62308364 7.87366696,0 L7.87366696,0.000113687544 C7.14572562,0.965320936 7.77600936,1.33867083 7.69392696,2.02329722 C8.36752565,0.933374736 9.79032527,0.789787368 10.8884333,0.334923505 C9.64315826,1.59850841 8.72300609,3.05795044 7.87524898,3.88361241 L8.6358507,4.15511863 C8.6358507,4.15511863 8.27501511,4.42489353 8.52743882,4.95911272 C8.56957789,5.04829846 8.6215686,5.12667085 8.67971976,5.19553247 C7.54569301,5.94640706 6.80000003,7.23368269 6.80000003,8.70000013 L6.80000003,8.80234816 C6.31732959,9.1249 1448 6,9.67479474 6,10.3000002 L6,14.3000003 C6,14.530995 6.04331804,14.7517071 6.12228848,14.9544711 Z" id="Combined-Shape" fill="#589A0F" fill-rule="nonzero"></path> + <path d="M11.0000002,5.5 C9.22720009,5.5 7.80000003,6.92720006 7.80000003,8.70000013 L7.80000003,9.50000016 C7.35680001,9.50000016 7,9.85680017 7,10.3000002 L7,14.3000003 C7,14.7432004 7.35680001,15.1000004 7.80000003,15.1000004 L14.2000003,15.1000004 C14.6432003,15.1000004 15.0000003,14.7432004 15.0000003,14.3000003 L15.0000003,10.3000002 C15.0000003,9.85680017 14.6432003,9.50000016 14.2000003,9.50000016 L14.2000003,8.70000013 C14.2000003,6.92720006 12.7728002,5.5 11.0000002,5.5 Z M11.0000002,7.10000006 C11.8864002,7.10000006 12.6000002,7.81360009 12.6000002,8.70000013 L12.6000002,9.50000016 L9.4000001,9.50000016 L9.4000001,8.70000013 C9.4000001,7.81360009 10.1136001,7.10000006 11.0000002,7.10000006 Z" id="Shape" fill="#589A0F" fill-rule="nonzero"></path> + </g> +</svg> diff --git a/browser/themes/shared/identity-block/onion.svg b/browser/themes/shared/identity-block/onion.svg new file mode 100644 index 000000000000..e102f41c5991 --- /dev/null +++ b/browser/themes/shared/identity-block/onion.svg @@ -0,0 +1,8 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <title>onion</title> + <defs></defs> + <g id="onion" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"> + <path d="M7.47070238,3.38224206 C7.23186151,2.5028722 6.97233174,1.62308364 8.87366696,4.4408921e-16 L8.87366696,0.000113687544 C8.14572562,0.965320936 8.77600936,1.33867083 8.69392696,2.02329722 C9.36752565,0.933374736 10.7903253,0.789787368 11.8884333,0.334923505 C10.6431583,1.59850841 9.72300609,3.05795044 8.87524898,3.88361241 L9.6358507,4.15511863 C9.6358507,4.15511863 9.27501511,4.42489353 9.52743882,4.95911272 C9.65035936,5.21926936 9.85710767,5.38741514 10.0560643,5.49588134 C10.2394376,5.55069385 10.4187806,5.61269109 10.5936905,5.68164129 C12.6087813,6.47613299 14,8.18134675 14,10.2383803 C14,13.0968586 11.3137496,15 8,15 C4.68625036,15 2,13.0968586 2,10.2383803 C2,8.40140797 3.11044937,6.84614642 4.80245393,5.95790561 C4.86922061,5.92314081 4.937062,5.88953483 5.00557508,5.85697179 C5.34048317,5.68140952 5.95495153,5.31464081 6.18735866,4.8796172 C6.261514,4.74090562 6.26057363,4.55305979 6.20885297,4.4070476 C6.11172559,4.13310092 5.57517408,3.53792744 5.57517408 ,3.53792744 L6.39988357,3 L7.47070238,3.38224206 Z" id="Combined-Shape" fill="#589A0F" fill-rule="nonzero"></path> + </g> +</svg> diff --git a/browser/themes/shared/jar.inc.mn b/browser/themes/shared/jar.inc.mn index 17debd82ddcd..3f59d7bfac19 100644 --- a/browser/themes/shared/jar.inc.mn +++ b/browser/themes/shared/jar.inc.mn @@ -45,6 +45,9 @@ skin/classic/browser/connection-secure.svg (../shared/identity-block/connection-secure.svg) skin/classic/browser/connection-mixed-passive-loaded.svg (../shared/identity-block/connection-mixed-passive-loaded.svg) skin/classic/browser/connection-mixed-active-loaded.svg (../shared/identity-block/connection-mixed-active-loaded.svg) + skin/classic/browser/onion.svg (../shared/identity-block/onion.svg) + skin/classic/browser/onion-lock.svg (../shared/identity-block/onion-lock.svg) + skin/classic/browser/onion-disabled.svg (../shared/identity-block/onion-disabled.svg) skin/classic/browser/identity-icon.svg (../shared/identity-block/identity-icon.svg) skin/classic/browser/identity-icon-notice.svg (../shared/identity-block/identity-icon-notice.svg) skin/classic/browser/info.svg (../shared/info.svg) diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index 63e1ac06bf2d..8257283e65a2 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -10039,6 +10039,27 @@ nsContentUtils::HttpsStateIsModern(nsIDocument* aDocument) return false; } +/* static */ bool +nsContentUtils::DocumentHasOnionURI(nsIDocument* aDocument) +{ + if (!aDocument) { + return false; + } + + nsIURI* uri = aDocument->GetDocumentURI(); + if (!uri) { + return false; + } + + nsAutoCString host; + if (NS_SUCCEEDED(uri->GetHost(host))) { + bool hasOnionURI = StringEndsWith(host, NS_LITERAL_CSTRING(".onion")); + return hasOnionURI; + } + + return false; +} + /* static */ void nsContentUtils::TryToUpgradeElement(Element* aElement) { diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h index 9ef79a569ea3..246dabf340de 100644 --- a/dom/base/nsContentUtils.h +++ b/dom/base/nsContentUtils.h @@ -3050,6 +3050,11 @@ public: static bool HttpsStateIsModern(nsIDocument* aDocument); /** + * Returns true of the document's URI is a .onion + */ + static bool DocumentHasOnionURI(nsIDocument* aDocument); + + /** * Try to upgrade an element. * https://html.spec.whatwg.org/multipage/custom-elements.html#concept-try-upg… */ diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp index 7d947b653f70..e4b847406085 100644 --- a/dom/base/nsGlobalWindowOuter.cpp +++ b/dom/base/nsGlobalWindowOuter.cpp @@ -1495,7 +1495,8 @@ nsGlobalWindowOuter::ComputeIsSecureContext(nsIDocument* aDocument, SecureContex return false; } - if (nsContentUtils::HttpsStateIsModern(aDocument)) { + if (nsContentUtils::HttpsStateIsModern(aDocument) || + nsContentUtils::DocumentHasOnionURI(aDocument)) { return true; } diff --git a/dom/presentation/PresentationRequest.cpp b/dom/presentation/PresentationRequest.cpp index 4c00150a359d..577aa3dd739e 100644 --- a/dom/presentation/PresentationRequest.cpp +++ b/dom/presentation/PresentationRequest.cpp @@ -512,7 +512,8 @@ PresentationRequest::IsProhibitMixedSecurityContexts(nsIDocument* aDocument) nsCOMPtr<nsIDocument> doc = aDocument; while (doc && !nsContentUtils::IsChromeDoc(doc)) { - if (nsContentUtils::HttpsStateIsModern(doc)) { + if (nsContentUtils::HttpsStateIsModern(doc) || + nsContentUtils::DocumentHasOnionURI(doc)) { return true; } diff --git a/dom/security/nsMixedContentBlocker.cpp b/dom/security/nsMixedContentBlocker.cpp index adc0bfd80e88..7b0e5088a4de 100644 --- a/dom/security/nsMixedContentBlocker.cpp +++ b/dom/security/nsMixedContentBlocker.cpp @@ -694,7 +694,7 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect, return NS_OK; } - // Check the parent scheme. If it is not an HTTPS page then mixed content + // Check the parent scheme. If it is not an HTTPS or .onion page then mixed content // restrictions do not apply. bool parentIsHttps; nsCOMPtr<nsIURI> innerRequestingLocation = NS_GetInnermostURI(requestingLocation); @@ -711,8 +711,19 @@ nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect, return NS_OK; } if (!parentIsHttps) { - *aDecision = ACCEPT; - return NS_OK; + nsAutoCString parentHost; + rv = innerRequestingLocation->GetHost(parentHost); + if (NS_FAILED(rv)) { + NS_ERROR("requestingLocation->GetHost failed"); + *aDecision = REJECT_REQUEST; + return NS_OK; + } + + bool parentIsOnion = StringEndsWith(parentHost, NS_LITERAL_CSTRING(".onion")); + if (!parentIsOnion) { + *aDecision = ACCEPT; + return NS_OK; + } } nsCOMPtr<nsIDocShell> docShell = NS_CP_GetDocShellFromContext(aRequestingContext); diff --git a/security/manager/ssl/nsSecureBrowserUIImpl.cpp b/security/manager/ssl/nsSecureBrowserUIImpl.cpp index a2f24df7c4af..336901f0226e 100644 --- a/security/manager/ssl/nsSecureBrowserUIImpl.cpp +++ b/security/manager/ssl/nsSecureBrowserUIImpl.cpp @@ -294,36 +294,35 @@ static uint32_t GetSecurityStateFromSecurityInfoAndRequest(nsISupports* info, uint32_t securityState; nsCOMPtr<nsITransportSecurityInfo> psmInfo(do_QueryInterface(info)); + MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - info is %p\n", + (nsISupports *)info)); if (!psmInfo) { MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - no nsITransportSecurityInfo for %p\n", (nsISupports *)info)); - return nsIWebProgressListener::STATE_IS_INSECURE; + securityState = nsIWebProgressListener::STATE_IS_INSECURE; + } else { + res = psmInfo->GetSecurityState(&securityState); + if (NS_FAILED(res)) { + MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - GetSecurityState failed: %" PRIu32 "\n", + static_cast<uint32_t>(res))); + securityState = nsIWebProgressListener::STATE_IS_BROKEN; + } } - MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - info is %p\n", - (nsISupports *)info)); - res = psmInfo->GetSecurityState(&securityState); - if (NS_FAILED(res)) { - MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - GetSecurityState failed: %" PRIu32 "\n", - static_cast<uint32_t>(res))); - securityState = nsIWebProgressListener::STATE_IS_BROKEN; + nsCOMPtr<nsIURI> uri; + nsCOMPtr<nsIChannel> channel(do_QueryInterface(request)); + if (channel) { + channel->GetURI(getter_AddRefs(uri)); + } else { + nsCOMPtr<imgIRequest> imgRequest(do_QueryInterface(request)); + if (imgRequest) { + imgRequest->GetURI(getter_AddRefs(uri)); + } } - if (securityState != nsIWebProgressListener::STATE_IS_INSECURE) { - // A secure connection does not yield a secure per-uri channel if the - // scheme is plain http. - - nsCOMPtr<nsIURI> uri; - nsCOMPtr<nsIChannel> channel(do_QueryInterface(request)); - if (channel) { - channel->GetURI(getter_AddRefs(uri)); - } else { - nsCOMPtr<imgIRequest> imgRequest(do_QueryInterface(request)); - if (imgRequest) { - imgRequest->GetURI(getter_AddRefs(uri)); - } - } - if (uri) { + if (uri) { + // http and ftp are always insecure + if (securityState != nsIWebProgressListener::STATE_IS_INSECURE) { bool isHttp, isFtp; if ((NS_SUCCEEDED(uri->SchemeIs("http", &isHttp)) && isHttp) || (NS_SUCCEEDED(uri->SchemeIs("ftp", &isFtp)) && isFtp)) { @@ -332,6 +331,18 @@ static uint32_t GetSecurityStateFromSecurityInfoAndRequest(nsISupports* info, securityState = nsIWebProgressListener::STATE_IS_INSECURE; } } + + // any protocol routed over tor is secure + if (securityState != nsIWebProgressListener::STATE_IS_SECURE) { + nsAutoCString host; + if (NS_SUCCEEDED(uri->GetHost(host))) { + if (StringEndsWith(host, NS_LITERAL_CSTRING(".onion"))) { + MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - " + "uri is onion.\n")); + securityState = nsIWebProgressListener::STATE_IS_SECURE; + } + } + } } MOZ_LOG(gSecureDocLog, LogLevel::Debug, ("SecureUI: GetSecurityState: - Returning %d\n",

1 0

[torbutton/master] Bug 23247: Communicating security expectations for .onion
by gk＠torproject.org 19 Jun '18

19 Jun '18

commit 65b5371aadb32835b99ca56fc8feb43bef81a78e Author: Richard Pospesel <richard(a)torproject.org> Date: Thu Jun 7 13:17:38 2018 -0700 Bug 23247: Communicating security expectations for .onion Added strings needed for Onion domain Page Info dialog to en locale --- src/chrome/locale/en/torbutton.properties | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/chrome/locale/en/torbutton.properties b/src/chrome/locale/en/torbutton.properties index 468a532..d77af1e 100644 --- a/src/chrome/locale/en/torbutton.properties +++ b/src/chrome/locale/en/torbutton.properties @@ -52,3 +52,7 @@ profileReadOnly=You cannot run %S from a read-only file system. Please copy %S profileReadOnlyMac=You cannot run %S from a read-only file system. Please copy %S to your Desktop or Applications folder before trying to use it. profileAccessDenied=%S does not have permission to access the profile. Please adjust your file system permissions and try again. profileMigrationFailed=Migration of your existing %S profile failed.\nNew settings will be used. + +# .Onion Page Info prompt. Strings are kept here for ease of translation. +pageInfo_OnionEncryptionWithBitsAndProtocol=Connection Encrypted (Onion Service, %1$S, %2$S bit keys, %3$S) +pageInfo_OnionEncryption=Connection Encrypted (Onion Service)

1 0

[tor-browser-build/master] Bug 26396: build mingw-w64-pthread with --no-insert-timestamp
by gk＠torproject.org 18 Jun '18

18 Jun '18

commit 5a43ceb3e0f3379f13764a8cd87d469fa7d774ed Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jun 18 11:44:39 2018 +0200 Bug 26396: build mingw-w64-pthread with --no-insert-timestamp --- projects/mingw-w64/build | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/mingw-w64/build b/projects/mingw-w64/build index 502ea94..1e25290 100644 --- a/projects/mingw-w64/build +++ b/projects/mingw-w64/build @@ -43,6 +43,7 @@ make install mkdir -p /var/tmp/build/builddir/mingw-w64/mingw-w64-pthread cd /var/tmp/build/builddir/mingw-w64/mingw-w64-pthread /var/tmp/build/[% project %]-[% c("version") %]/mingw-w64-libraries/winpthreads/configure \ + LDFLAGS="-Wl,--no-insert-timestamp" \ --host=[% c("arch") %]-w64-mingw32 --prefix=$distdir/[% c("arch") %]-w64-mingw32 make -j[% c("buildconf/num_procs") %] make install

1 0

[tor-browser-build/master] Bug 26250: Bump Rust version to 1.26.1
by boklm＠torproject.org 15 Jun '18

15 Jun '18

commit 61aac87c00ca7a1da9a1be9f2d181c7841769d4c Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 15 06:12:38 2018 +0000 Bug 26250: Bump Rust version to 1.26.1 Bumping Rust to 1.26.1 avoids intermittent Firefox compilation failures we have seen, similar to those Mozilla got and documented in https://bugzilla.mozilla.org/show_bug.cgi?id=1445413. --- projects/rust/binaryen.patch | 22 ---------------------- projects/rust/build | 9 +-------- projects/rust/config | 6 ++---- projects/rust/unwind.patch | 34 +++++++++++++++++++--------------- 4 files changed, 22 insertions(+), 49 deletions(-) diff --git a/projects/rust/binaryen.patch b/projects/rust/binaryen.patch deleted file mode 100644 index fee9b6a..0000000 --- a/projects/rust/binaryen.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 820f26810baf35c1961763f6b0013e4f7e7380da Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Thu, 12 Apr 2018 13:10:13 +0000 -Subject: [PATCH] Use our gcc/c++ - - -diff --git a/src/librustc_binaryen/build.rs b/src/librustc_binaryen/build.rs -index f23ff3cee5..2496dd1be9 100644 ---- a/src/librustc_binaryen/build.rs -+++ b/src/librustc_binaryen/build.rs -@@ -26,6 +26,8 @@ fn main() { - - Config::new("../binaryen") - .define("BUILD_STATIC_LIB", "ON") -+ .define("CMAKE_C_COMPILER", "gcc") -+ .define("CMAKE_CXX_COMPILER", "c++") - .build_target("binaryen") - .build(); - --- -2.16.3 - diff --git a/projects/rust/build b/projects/rust/build index af0f62b..936f49f 100644 --- a/projects/rust/build +++ b/projects/rust/build @@ -52,20 +52,13 @@ mkdir /var/tmp/build tar -C /var/tmp/build -xf [% c('input_files_by_name/rust') %] cd /var/tmp/build/rustc-[% c('version') %]-src -[% IF c("var/linux") %] - # binaryen hardcodes /usr/bin/cc and /usr/bin/c++ as the C and C++ compiler. - # But that is too old on Debian Wheezy which is why we need to patch it, so - # we can use our own GCC instead. - patch -p1 < $rootdir/binaryen.patch -[% END %] - [% IF c("var/windows-i686") %] # Cross-compiling for Windows 32bit is currently not possible without any # patches. The reason for that is libstd expecting DWARF unwinding while most # toolchains on Linux, targeting Windows 32bit, use SjLj unwinding. # See: https://github.com/rust-lang/rust/issues/12859 for discussion about # that and https://github.com/rust-lang/rust/pull/49633 for a newer attempt to - # fix this problem. We backport and apply the patch from neersighted. + # fix this problem. We apply the patch from neersighted. patch -p1 < $rootdir/unwind.patch [% END %] diff --git a/projects/rust/config b/projects/rust/config index 771b50b..b5547f9 100644 --- a/projects/rust/config +++ b/projects/rust/config @@ -1,8 +1,8 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -version: 1.25.0 +version: 1.26.1 var: - prev_version: 1.24.1 + prev_version: 1.25.0 container: use_container: 1 @@ -71,7 +71,5 @@ input_files: sig_ext: asc file_gpg_id: 1 gpg_keyring: rust.gpg - - filename: binaryen.patch - enable: '[% c("var/linux") %]' - filename: unwind.patch enable: '[% c("var/windows-i686") %]' diff --git a/projects/rust/unwind.patch b/projects/rust/unwind.patch index 8e2e0fc..3a191b9 100644 --- a/projects/rust/unwind.patch +++ b/projects/rust/unwind.patch @@ -1,4 +1,4 @@ -From f967c575e502e507ed51b7ed8d1e2a08525e6ae6 Mon Sep 17 00:00:00 2001 +From dd808373aefe6247975455006bbfb89aa6410ed9 Mon Sep 17 00:00:00 2001 From: Bjorn Neergaard <bjorn(a)neersighted.com> Date: Tue, 3 Apr 2018 19:01:07 -0600 Subject: [PATCH] Fix cross-compiling i686-pc-windows-gnu from Linux @@ -32,15 +32,15 @@ rethinking of how iOS is special-cased above, to avoid further duplication. Input on how to best structure this file is requested. diff --git a/src/bootstrap/compile.rs b/src/bootstrap/compile.rs -index c85b04ddc0..2f58f0d9fa 100644 +index e6aa78fba5..624f2ccfbe 100644 --- a/src/bootstrap/compile.rs +++ b/src/bootstrap/compile.rs -@@ -145,6 +145,11 @@ pub fn std_cargo(build: &Build, +@@ -146,6 +146,11 @@ pub fn std_cargo(build: &Builder, cargo.env("MACOSX_DEPLOYMENT_TARGET", target); } + // FIXME: Temporary detection of SJLJ MinGW compilers. -+ if build.build.contains("linux") && target == "i686-pc-windows-gnu" { ++ if build.build.build.contains("linux") && target == "i686-pc-windows-gnu" { + features.push_str(" sjlj_eh"); + } + @@ -48,7 +48,7 @@ index c85b04ddc0..2f58f0d9fa 100644 // stage0. This works fine if the local rust and being-built rust have the // same view of what the default allocator is, but fails otherwise. Since diff --git a/src/libstd/Cargo.toml b/src/libstd/Cargo.toml -index c1fe4a89d6..6c8cb330d8 100644 +index 1201759885..a06ef7e0e6 100644 --- a/src/libstd/Cargo.toml +++ b/src/libstd/Cargo.toml @@ -49,3 +49,4 @@ force_alloc_system = [] @@ -57,18 +57,19 @@ index c1fe4a89d6..6c8cb330d8 100644 wasm_syscall = [] +sjlj_eh = ["unwind/sjlj_eh"] diff --git a/src/libunwind/Cargo.toml b/src/libunwind/Cargo.toml -index fbd9789d2f..5e319c67fa 100644 +index fbd9789d2f..15a20d7ff4 100644 --- a/src/libunwind/Cargo.toml +++ b/src/libunwind/Cargo.toml -@@ -14,3 +14,6 @@ doc = false +@@ -14,3 +14,7 @@ doc = false [dependencies] core = { path = "../libcore" } libc = { path = "../rustc/libc_shim" } + +[features] +sjlj_eh = [] ++ diff --git a/src/libunwind/libunwind.rs b/src/libunwind/libunwind.rs -index e6fff7963f..6a57cf7c93 100644 +index aa73b11fb3..16c21be736 100644 --- a/src/libunwind/libunwind.rs +++ b/src/libunwind/libunwind.rs @@ -10,11 +10,6 @@ @@ -83,15 +84,15 @@ index e6fff7963f..6a57cf7c93 100644 use libc::{c_int, c_void, uintptr_t}; #[repr(C)] -@@ -84,7 +79,6 @@ pub type _Unwind_Exception_Cleanup_Fn = extern "C" fn(unwind_code: _Unwind_Reaso - exception: *mut _Unwind_Exception); +@@ -85,7 +80,6 @@ pub type _Unwind_Exception_Cleanup_Fn = extern "C" fn(unwind_code: _Unwind_Reaso extern "C" { - #[unwind] + #[cfg_attr(stage0, unwind)] + #[cfg_attr(not(stage0), unwind(allowed))] - pub fn _Unwind_Resume(exception: *mut _Unwind_Exception) -> !; pub fn _Unwind_DeleteException(exception: *mut _Unwind_Exception); pub fn _Unwind_GetLanguageSpecificData(ctx: *mut _Unwind_Context) -> *mut c_void; pub fn _Unwind_GetRegionStart(ctx: *mut _Unwind_Context) -> _Unwind_Ptr; -@@ -216,26 +210,49 @@ if #[cfg(all(any(target_os = "ios", not(target_arch = "arm"))))] { +@@ -217,28 +211,52 @@ if #[cfg(all(any(target_os = "ios", not(target_arch = "arm"))))] { pc } } @@ -103,7 +104,8 @@ index e6fff7963f..6a57cf7c93 100644 +if #[cfg(all(target_os = "ios", target_arch = "arm"))] { + // 32-bit iOS uses SjLj and does not provide _Unwind_Backtrace() extern "C" { - #[unwind] + #[cfg_attr(stage0, unwind)] + #[cfg_attr(not(stage0), unwind(allowed))] - pub fn _Unwind_RaiseException(exception: *mut _Unwind_Exception) -> _Unwind_Reason_Code; - pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn, - trace_argument: *mut c_void) @@ -121,7 +123,8 @@ index e6fff7963f..6a57cf7c93 100644 + +} else if #[cfg(feature = "sjlj_eh")] { extern "C" { - #[unwind] + #[cfg_attr(stage0, unwind)] + #[cfg_attr(not(stage0), unwind(allowed))] + pub fn _Unwind_SjLj_Resume(e: *mut _Unwind_Exception) -> !; pub fn _Unwind_SjLj_RaiseException(e: *mut _Unwind_Exception) -> _Unwind_Reason_Code; + pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn, @@ -140,7 +143,8 @@ index e6fff7963f..6a57cf7c93 100644 } +} else { + extern "C" { -+ #[unwind] ++ #[cfg_attr(stage0, unwind)] ++ #[cfg_attr(not(stage0), unwind(allowed))] + pub fn _Unwind_Resume(exception: *mut _Unwind_Exception) -> !; + pub fn _Unwind_RaiseException(exception: *mut _Unwind_Exception) -> _Unwind_Reason_Code; + pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn,

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gk/bug_26250_v5'
by boklm＠torproject.org 15 Jun '18

15 Jun '18

commit 85db911cee972e286b358bdabc50e0796823654d Merge: dc35588 61aac87 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Jun 15 22:01:27 2018 +0200 Merge remote-tracking branch 'gk/bug_26250_v5' projects/rust/binaryen.patch | 22 ---------------------- projects/rust/build | 9 +-------- projects/rust/config | 6 ++---- projects/rust/unwind.patch | 34 +++++++++++++++++++--------------- 4 files changed, 22 insertions(+), 49 deletions(-)

1 0

[tor-browser-build/master] Bug 25540: Don't ship sandboxed-tor-browser anymore
by boklm＠torproject.org 15 Jun '18

15 Jun '18

commit dc355882e235178d0a1889a7d96c5721faad2716 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 15 11:54:02 2018 +0000 Bug 25540: Don't ship sandboxed-tor-browser anymore sandboxed-tor-browser is not maintained anymore and Yawning requested to not ship it anymore in our alphas once we switch to Firefox 60 ESR. --- projects/goerrors/config | 17 ----------------- projects/gogb/config | 23 ----------------------- projects/gogb/gb-build-dir.patch | 31 ------------------------------- projects/release/build | 3 --- projects/release/config | 7 ------- projects/sandbox/build | 26 -------------------------- projects/sandbox/config | 32 -------------------------------- 7 files changed, 139 deletions(-) diff --git a/projects/goerrors/config b/projects/goerrors/config deleted file mode 100644 index 3c11fab..0000000 --- a/projects/goerrors/config +++ /dev/null @@ -1,17 +0,0 @@ -# vim: filetype=yaml sw=2 -version: '[% c("abbrev") %]' -git_url: https://github.com/pkg/errors -git_hash: 248dadf4e9068a0b3e79f02ed0a610d935de5302 -filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' - -build: '[% c("projects/go/var/build_go_lib") %]' - -var: - container: - use_container: 1 - go_lib: github.com/pkg/errors - -input_files: - - project: container-image - - name: go - project: go diff --git a/projects/gogb/config b/projects/gogb/config deleted file mode 100644 index dcf30f6..0000000 --- a/projects/gogb/config +++ /dev/null @@ -1,23 +0,0 @@ -# vim: filetype=yaml sw=2 -version: '[% c("abbrev") %]' -git_url: https://github.com/constabulary/gb -git_hash: 06cc925cce6592e922dcc4839a8b44feb384e71e -filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' - -build: '[% c("projects/go/var/build_go_lib") %]' - -var: - container: - use_container: 1 - go_lib: github.com/constabulary/gb - go_lib_install: github.com/constabulary/gb/cmd/gb - go_lib_deps: - - goerrors - -input_files: - - project: container-image - - name: go - project: go - - name: goerrors - project: goerrors - - filename: gb-build-dir.patch diff --git a/projects/gogb/gb-build-dir.patch b/projects/gogb/gb-build-dir.patch deleted file mode 100644 index a52ca69..0000000 --- a/projects/gogb/gb-build-dir.patch +++ /dev/null @@ -1,31 +0,0 @@ -From a7b198e3a32509197150d7c2767262a7319ff339 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Tue, 6 Dec 2016 21:34:16 +0000 -Subject: [PATCH] Make the gb build directory deterministic - - -diff --git a/context.go b/context.go -index 53c00da..d040082 100644 ---- a/context.go -+++ b/context.go -@@ -3,7 +3,6 @@ package gb - import ( - "fmt" - "io" -- "io/ioutil" - "os" - "os/exec" - "path/filepath" -@@ -136,7 +135,8 @@ func NewContext(p Project, opts ...func(*Context) error) (*Context, error) { - }, - GcToolchain(), - } -- workdir, err := ioutil.TempDir("", "gb") -+ workdir := filepath.Join(os.TempDir(), "gb") -+ err := os.Mkdir(workdir, 0777) - if err != nil { - return nil, err - } --- -2.10.2 - diff --git a/projects/release/build b/projects/release/build index a73f017..882d26d 100644 --- a/projects/release/build +++ b/projects/release/build @@ -20,9 +20,6 @@ mkdir -p "$destdir" [% END -%] [% IF c("var/torbrowser-linux-x86_64") -%] mv [% c('input_files_by_name/linux-x86_64') %]/* "$destdir"/ - [% IF ! c("var/release") %] - mv [% c('input_files_by_name/sandbox-linux-x86_64') %] "$destdir"/sandbox-[% pc('sandbox', 'version') %]-linux64.zip - [% END %] [% END -%] cd "$destdir" cat > .htaccess <<EOF diff --git a/projects/release/config b/projects/release/config index 2aba446..236325b 100644 --- a/projects/release/config +++ b/projects/release/config @@ -87,13 +87,6 @@ input_files: - '[% c("var/build_target") %]' - 'torbrowser-linux-x86_64[% c("var/debug-build") %]' - - name: sandbox-linux-x86_64 - project: sandbox - enable: '[% c("var/torbrowser-linux-x86_64") && ! c("var/release") %]' - target: - - '[% c("var/build_target") %]' - - torbrowser-linux-x86_64 - - name: linux-i686 project: tor-browser enable: '[% c("var/torbrowser-linux-i686") %]' diff --git a/projects/sandbox/build b/projects/sandbox/build deleted file mode 100644 index 8a3edb3..0000000 --- a/projects/sandbox/build +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -[% c("var/set_default_env") -%] -[% pc('go', 'var/setup', { go_tarfile => c('input_files_by_name/go') }) %] -distdir=/var/tmp/dist/[% project %] -mkdir -p $distdir - -tar -C /var/tmp/dist -xf [% c('input_files_by_name/gogb') %] - -mkdir -p /var/tmp/build -tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz -cd /var/tmp/build/[% project %]-[% c('version') %] - -# we don't have access to the git repository during the build -sed -i Makefile -e 's|git rev-parse --short HEAD > data/revision|echo [% c("abbrev") %] > data/revision|' -# Unset GOOS and GOARCH as they change some file names, and we don't need -# them as we are only building on x86_64 -unset GOOS -unset GOARCH -make -cp bin/sandboxed-tor-browser $distdir - -cd $distdir/.. -[% c('zip', { - zip_src => [ project ], - zip_args => dest_dir _ '/' _ c('filename'), - }) %] diff --git a/projects/sandbox/config b/projects/sandbox/config deleted file mode 100644 index 11fe6be..0000000 --- a/projects/sandbox/config +++ /dev/null @@ -1,32 +0,0 @@ -# vim: filetype=yaml sw=2 -version: 0.0.16 -git_url: https://git.torproject.org/tor-browser/sandboxed-tor-browser -git_hash: 'sandboxed-tor-browser-[% c("version") %]' -tag_gpg_id: 1 -gpg_keyring: obfs4.gpg -filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' - -var: - container: - use_container: 1 - suite: jessie - arch: amd64 - deps: - - libx11-dev - - pkg-config - - libgtk-3-dev - - libnotify-dev - - zip - -targets: - nightly: - git_hash: master - version: '[% c("abbrev") %]' - tag_gpg_id: 0 - -input_files: - - project: container-image - - name: go - project: go - - name: gogb - project: gogb

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gk/bug_23231'
by boklm＠torproject.org 15 Jun '18

15 Jun '18

commit 5e72f5077d7c974e30c9f48f2c554ded6e8358d1 Merge: b9a2dfe aa79add Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Jun 15 11:31:19 2018 +0200 Merge remote-tracking branch 'gk/bug_23231' projects/firefox/STL_win64.patch | 24 ------------------------ projects/firefox/build | 4 ---- projects/firefox/config | 2 -- 3 files changed, 30 deletions(-)

1 0

[tor-browser-build/master] Bug 23231: Remove our STL Wrappers workaround for Windows 64bit
by boklm＠torproject.org 15 Jun '18

15 Jun '18

commit aa79addec263ad31bad46f589e5964173b07d24f Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 14 19:52:09 2018 +0000 Bug 23231: Remove our STL Wrappers workaround for Windows 64bit The fix for https://bugzilla.mozilla.org/show_bug.cgi?id=1443823 makes our workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=1392604 obsolete, and we can remove it as it landed on esr60. --- projects/firefox/STL_win64.patch | 24 ------------------------ projects/firefox/build | 4 ---- projects/firefox/config | 2 -- 3 files changed, 30 deletions(-) diff --git a/projects/firefox/STL_win64.patch b/projects/firefox/STL_win64.patch deleted file mode 100644 index e528905..0000000 --- a/projects/firefox/STL_win64.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 8f8c1a1069d4907d3cedae578975225d8caeecaf Mon Sep 17 00:00:00 2001 -From: Nicolas Vigier <boklm(a)torproject.org> -Date: Sat, 12 Aug 2017 22:00:13 +0200 -Subject: [PATCH] Bug 23231: disable STL Wrappers on Windows - -Workaround for: -https://bugzilla.mozilla.org/show_bug.cgi?id=1392604 ---- - old-configure.in | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/old-configure.in b/old-configure.in -index f5a2f05..e247551 100644 ---- a/old-configure.in -+++ b/old-configure.in -@@ -1338,7 +1338,7 @@ MOZ_CXX11 - AC_LANG_C - - case "${OS_TARGET}" in --Darwin) -+WINNT|Darwin) - ;; - *) - STL_FLAGS="-I${DIST}/stl_wrappers" diff --git a/projects/firefox/build b/projects/firefox/build index 1b3a0d0..9f849b0 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -132,10 +132,6 @@ fi export CC='gcc -m32' [% END -%] -[% IF c("var/windows-x86_64") %] - patch -p1 < $rootdir/STL_win64.patch -[% END -%] - [% IF c("var/windows") %] patch -p1 < $rootdir/nsis-uninstall.patch [% END -%] diff --git a/projects/firefox/config b/projects/firefox/config index 9d0829d..c2cbebd 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -104,8 +104,6 @@ input_files: - project: gcc name: gcc enable: '[% c("var/windows") %]' - - filename: STL_win64.patch - enable: '[% c("var/windows-x86_64") %]' - filename: nsis-uninstall.patch enable: '[% c("var/windows") %]' - project: rust

1 0

[tor-browser-build/master] Bug 26304: Bump zlib to latest stable (1.2.11)
by boklm＠torproject.org 15 Jun '18

15 Jun '18

commit b9a2dfe610121f88be74d8569ee2b9f904132670 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 15 06:18:26 2018 +0000 Bug 26304: Bump zlib to latest stable (1.2.11) --- projects/zlib/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/zlib/config b/projects/zlib/config index 4ac96c9..2a98469 100644 --- a/projects/zlib/config +++ b/projects/zlib/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' -version: 1.2.8 +version: 1.2.11 git_hash: 'v[% c("version") %]' git_url: https://github.com/madler/zlib.git gpg_keyring: zlib.gpg

1 0

[tor-browser-build/master] Bug 26205: Don't build the uninstaller for Windows during Firefox compilation
by gk＠torproject.org 14 Jun '18

14 Jun '18

commit 0f6ebe396fad0834388fd2424218582b32493816 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jun 12 22:02:03 2018 -0400 Bug 26205: Don't build the uninstaller for Windows during Firefox compilation --- projects/firefox/build | 4 ++ projects/firefox/config | 2 + projects/firefox/nsis-uninstall.patch | 73 +++++++++++++++++++++++++++++++++++ 3 files changed, 79 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index 09620ae..1b3a0d0 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -136,6 +136,10 @@ fi patch -p1 < $rootdir/STL_win64.patch [% END -%] +[% IF c("var/windows") %] + patch -p1 < $rootdir/nsis-uninstall.patch +[% END -%] + [% IF c("var/osx") %] patch -p1 < $rootdir/no-dmg.patch [% END -%] diff --git a/projects/firefox/config b/projects/firefox/config index 120ad35..9d0829d 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -106,6 +106,8 @@ input_files: enable: '[% c("var/windows") %]' - filename: STL_win64.patch enable: '[% c("var/windows-x86_64") %]' + - filename: nsis-uninstall.patch + enable: '[% c("var/windows") %]' - project: rust name: rust - project: llvm diff --git a/projects/firefox/nsis-uninstall.patch b/projects/firefox/nsis-uninstall.patch new file mode 100644 index 0000000..765ef67 --- /dev/null +++ b/projects/firefox/nsis-uninstall.patch @@ -0,0 +1,73 @@ +From 4ef264b601ac92a0b385c40bd011ef94618a176a Mon Sep 17 00:00:00 2001 +From: Sukhbir Singh <sukhbir(a)torproject.org> +Date: Tue, 12 Jun 2018 21:58:24 -0400 +Subject: [PATCH 1/1] Bug 26205: Don't build the uninstaller for Windows during + Firefox compilation + +--- + browser/Makefile.in | 4 ---- + browser/installer/Makefile.in | 4 ---- + .../mozbuild/mozbuild/repackaging/installer.py | 17 +---------------- + 3 files changed, 1 insertion(+), 24 deletions(-) + +diff --git a/browser/Makefile.in b/browser/Makefile.in +index 2eb9e708f68e..0c9442183942 100644 +--- a/browser/Makefile.in ++++ b/browser/Makefile.in +@@ -6,10 +6,6 @@ include $(topsrcdir)/config/rules.mk + + ifdef MAKENSISU + +-# For Windows build the uninstaller during the application build since the +-# uninstaller is included with the application for mar file generation. +-libs:: +- $(MAKE) -C installer/windows uninstaller + ifdef MOZ_MAINTENANCE_SERVICE + $(MAKE) -C installer/windows maintenanceservice_installer + endif +diff --git a/browser/installer/Makefile.in b/browser/installer/Makefile.in +index 1bf11252ee06..dee6d5434106 100644 +--- a/browser/installer/Makefile.in ++++ b/browser/installer/Makefile.in +@@ -98,10 +98,6 @@ ifdef NECKO_WIFI + DEFINES += -DNECKO_WIFI + endif + +-ifdef MAKENSISU +-DEFINES += -DHAVE_MAKENSISU=1 +-endif +- + ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT)) + MOZ_PKG_MAC_DSSTORE=$(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/dsstore + MOZ_PKG_MAC_BACKGROUND=$(topsrcdir)/$(MOZ_BRANDING_DIRECTORY)/background.png +diff --git a/python/mozbuild/mozbuild/repackaging/installer.py b/python/mozbuild/mozbuild/repackaging/installer.py +index 9b49eb555153..1e6f6e73c3d8 100644 +--- a/python/mozbuild/mozbuild/repackaging/installer.py ++++ b/python/mozbuild/mozbuild/repackaging/installer.py +@@ -27,22 +27,7 @@ def repackage_installer(topsrcdir, tag, setupexe, package, output, package_name, + tmpdir = tempfile.mkdtemp() + old_cwd = os.getcwd() + try: +- if package: +- z = zipfile.ZipFile(package) +- z.extractall(tmpdir) +- z.close() +- +- # Copy setup.exe into the root of the install dir, alongside the +- # package. +- shutil.copyfile(setupexe, mozpath.join(tmpdir, mozpath.basename(setupexe))) +- +- # archive_exe requires us to be in the directory where the package is +- # unpacked (the tmpdir) +- os.chdir(tmpdir) +- +- sfx_package = mozpath.join(topsrcdir, sfx_stub) +- +- archive_exe(package_name, tag, sfx_package, output) ++ pass + + finally: + os.chdir(old_cwd) +-- +2.17.1 +

1 0

[tor-browser-build/master] Bug 26203: Update mozconfig for Windows nightly build
by gk＠torproject.org 14 Jun '18

14 Jun '18

commit 656090e748599053adfb9d0c31b6955ba7ef8129 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jun 12 22:04:06 2018 -0400 Bug 26203: Update mozconfig for Windows nightly build Also enable rust for all builds. --- projects/firefox/build | 8 +++----- projects/firefox/config | 1 - projects/firefox/mozconfig-windows-i686 | 3 +++ projects/firefox/mozconfig-windows-x86_64 | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 81032c6..09620ae 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -65,11 +65,9 @@ EOF export SELFRANDO_skip_shuffle= [% END -%] -[% IF ! c("var/windows") %] - mkdir -p /var/tmp/dist - tar -C /var/tmp/dist -xf [% c('input_files_by_name/rust') %] - export PATH="/var/tmp/dist/rust/bin:$PATH" -[% END -%] +mkdir -p /var/tmp/dist +tar -C /var/tmp/dist -xf [% c('input_files_by_name/rust') %] +export PATH="/var/tmp/dist/rust/bin:$PATH" [% IF c("var/linux") %] # Add llvm so stylo can build diff --git a/projects/firefox/config b/projects/firefox/config index 5bde93d..120ad35 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -108,7 +108,6 @@ input_files: enable: '[% c("var/windows-x86_64") %]' - project: rust name: rust - enable: '[% ! c("var/windows") %]' - project: llvm name: llvm enable: '[% c("var/linux") %]' diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index dfb3326..daeaed4 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -24,3 +24,6 @@ ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests +ac_add_options --disable-stylo # Bugzilla 1390583 +ac_add_options --disable-accessibility # https://sourceforge.net/p/mingw-w64/bugs/648/ +ac_add_options --disable-jemalloc # Bugzilla 1466192 diff --git a/projects/firefox/mozconfig-windows-x86_64 b/projects/firefox/mozconfig-windows-x86_64 index 669c124..568d88d 100644 --- a/projects/firefox/mozconfig-windows-x86_64 +++ b/projects/firefox/mozconfig-windows-x86_64 @@ -18,12 +18,12 @@ ac_add_options --enable-tor-browser-update ac_add_options --enable-signmar ac_add_options --enable-verify-mar -# We can't build the sandbox code with mingw-w64: -# https://bugzilla.mozilla.org/show_bug.cgi?id=1042426 -ac_add_options --disable-sandbox # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests +ac_add_options --disable-stylo # Bugzilla 1390583 +ac_add_options --disable-accessibility # https://sourceforge.net/p/mingw-w64/bugs/648/ +ac_add_options --disable-jemalloc # Bugzilla 1466192

1 0

[tor-browser-build/master] Bug 25837: Integrate fxc2 for Windows Tor Browser builds
by gk＠torproject.org 14 Jun '18

14 Jun '18

commit 57693e01837f0fc7c60bb056e5b752f5f67a987b Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Thu Jun 14 13:21:18 2018 +0000 Bug 25837: Integrate fxc2 for Windows Tor Browser builds This commit adds support for building and bundling fxc2 which is required for Windows cross-compilation on Linux. --- projects/firefox/build | 18 ++++++++++++++++++ projects/firefox/config | 8 ++++++++ projects/fxc2/build | 30 ++++++++++++++++++++++++++++++ projects/fxc2/config | 14 ++++++++++++++ 4 files changed, 70 insertions(+) diff --git a/projects/firefox/build b/projects/firefox/build index 0fd3da2..81032c6 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -34,6 +34,23 @@ EOF export PATH="$mingwdir/helpers:$PATH" [% END -%] +[% IF c("var/windows") %] + # Unpack fxc2. + mkdir -p /var/tmp/dist + tar -C /var/tmp/dist -xf [% c('input_files_by_name/fxc2') %] + fxcdir=/var/tmp/dist/fxc2/bin + cp $mingwdir/[% c("arch") %]-w64-mingw32/bin/libwinpthread-1.dll $fxcdir + export PATH="$fxcdir:$PATH" + # fxc2 requires Wine. + [% IF c("var/windows-x86_64") %] + export WINEARCH=win64 + [% END %] + export HOME=/var/tmp/home + mkdir -p $HOME + WINEROOT=$HOME/.wine/drive_c + wine wineboot -i +[% END -%] + [% IF c("var/linux") %] mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/binutils') %] @@ -161,6 +178,7 @@ rm -f js/src/configure cp -a obj-*/dist/firefox/* $distdir/Browser/ cp -a $rootdir/msvcr100.dll $distdir/Browser cp -a $gcclibs/libssp-0.dll $distdir/Browser + cp -a $fxcdir/d3dcompiler_47.dll $distdir/Browser [% END %] # Make MAR-based update tools available for use during the bundle phase. diff --git a/projects/firefox/config b/projects/firefox/config index 6cb17c7..5bde93d 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -65,6 +65,11 @@ targets: arch_deps: - rsync + windows: + var: + arch_deps: + - wine + windows-i686: var: martools_filename: mar-tools-win32.zip @@ -107,3 +112,6 @@ input_files: - project: llvm name: llvm enable: '[% c("var/linux") %]' + - project: fxc2 + name: fxc2 + enable: '[% c("var/windows") %]' diff --git a/projects/fxc2/build b/projects/fxc2/build new file mode 100644 index 0000000..46a7db8 --- /dev/null +++ b/projects/fxc2/build @@ -0,0 +1,30 @@ +#!/bin/bash +[% c("var/set_default_env") -%] +distdir="/var/tmp/dist/[% project %]" + +[% pc(c('var/compiler'), 'var/setup', { compiler_tarfile => c('input_files_by_name/' _ c('var/compiler')) }) %] + +mkdir -p /var/tmp/build +tar -C /var/tmp/build -xf [% project %]-[% c("version") %].tar.gz +cd /var/tmp/build/[% project %]-[% c("version") %] + +[% IF c("var/windows-i686") -%] + make x86 +[% ELSE -%] + make x64 +[% END -%] + +mkdir -p $distdir/bin/ +cp fxc2.exe $distdir/bin/ +[% IF c("var/windows-i686") -%] + cp dll/d3dcompiler_47_32.dll $distdir/bin/d3dcompiler_47.dll +[% ELSE -%] + cp dll/d3dcompiler_47.dll $distdir/bin/ +[% END -%] + +cd /var/tmp/dist + +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] diff --git a/projects/fxc2/config b/projects/fxc2/config new file mode 100644 index 0000000..aac9158 --- /dev/null +++ b/projects/fxc2/config @@ -0,0 +1,14 @@ +# vim: filetype=yaml sw=2 +version: '[% c("abbrev") %]' +git_url: https://github.com/azadi/fxc2.git +git_hash: 079f5c7b9f6ea0b7e5504bb53abf8709cc92835d +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' + +var: + container: + use_container: 1 + +input_files: + - project: container-image + - name: '[% c("var/compiler") %]' + project: '[% c("var/compiler") %]'

1 0

[tor-browser-build/master] Bug 26329: Fix Rust cross-compilation for 32bit Windows
by boklm＠torproject.org 14 Jun '18

14 Jun '18

commit 3751474686ba0d2cc7b8a4086114332cbc36e29c Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 14 11:26:47 2018 +0000 Bug 26329: Fix Rust cross-compilation for 32bit Windows --- projects/rust/build | 4 +- projects/rust/config | 2 +- projects/rust/panic-abort.patch | 36 ---------- projects/rust/unwind.patch | 154 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 157 insertions(+), 39 deletions(-) diff --git a/projects/rust/build b/projects/rust/build index 74ce74a..af0f62b 100644 --- a/projects/rust/build +++ b/projects/rust/build @@ -65,8 +65,8 @@ cd /var/tmp/build/rustc-[% c('version') %]-src # toolchains on Linux, targeting Windows 32bit, use SjLj unwinding. # See: https://github.com/rust-lang/rust/issues/12859 for discussion about # that and https://github.com/rust-lang/rust/pull/49633 for a newer attempt to - # fix this problem. - patch -p1 < $rootdir/panic-abort.patch + # fix this problem. We backport and apply the patch from neersighted. + patch -p1 < $rootdir/unwind.patch [% END %] mkdir build diff --git a/projects/rust/config b/projects/rust/config index 9d3030d..771b50b 100644 --- a/projects/rust/config +++ b/projects/rust/config @@ -73,5 +73,5 @@ input_files: gpg_keyring: rust.gpg - filename: binaryen.patch enable: '[% c("var/linux") %]' - - filename: panic-abort.patch + - filename: unwind.patch enable: '[% c("var/windows-i686") %]' diff --git a/projects/rust/panic-abort.patch b/projects/rust/panic-abort.patch deleted file mode 100644 index 1711ff7..0000000 --- a/projects/rust/panic-abort.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 2fe471643721f3967f1bdf28907b0a7247fdb705 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Thu, 26 Apr 2018 13:18:27 +0000 -Subject: [PATCH] Avoid cross-compilation breakage due to unwinding - incompatibilities - - -diff --git a/src/bootstrap/bin/rustc.rs b/src/bootstrap/bin/rustc.rs -index 55d104b182..85330f973b 100644 ---- a/src/bootstrap/bin/rustc.rs -+++ b/src/bootstrap/bin/rustc.rs -@@ -143,7 +143,8 @@ fn main() { - // workaround undefined references to `rust_eh_unwind_resume` generated - // otherwise, see issue https://github.com/rust-lang/rust/issues/43095. - if crate_name == "panic_abort" || -- crate_name == "compiler_builtins" && stage != "0" { -+ crate_name == "compiler_builtins" && stage != "0" || -+ target == "i686-pc-windows-gnu" { - cmd.arg("-C").arg("panic=abort"); - } - -diff --git a/src/libtest/lib.rs b/src/libtest/lib.rs -index 9ea5f39b71..bb689120af 100644 ---- a/src/libtest/lib.rs -+++ b/src/libtest/lib.rs -@@ -45,7 +45,6 @@ extern crate getopts; - extern crate term; - #[cfg(any(unix, target_os = "cloudabi"))] - extern crate libc; --extern crate panic_unwind; - - pub use self::TestFn::*; - pub use self::ColorConfig::*; --- -2.17.0 - diff --git a/projects/rust/unwind.patch b/projects/rust/unwind.patch new file mode 100644 index 0000000..8e2e0fc --- /dev/null +++ b/projects/rust/unwind.patch @@ -0,0 +1,154 @@ +From f967c575e502e507ed51b7ed8d1e2a08525e6ae6 Mon Sep 17 00:00:00 2001 +From: Bjorn Neergaard <bjorn(a)neersighted.com> +Date: Tue, 3 Apr 2018 19:01:07 -0600 +Subject: [PATCH] Fix cross-compiling i686-pc-windows-gnu from Linux + +This is still very rough and serves as a proof-of-concept for fixing +Linux -> 32-bit MinGW cross compilation workflow. Currently, clang and +GCC's MinGW targets both only support DW2 (DWARF) or SJLJ (Set Jump Long +Jump) unwinding on 32-bit Windows. + +The default for GCC (and the way it is shipped on every major distro) is +to use SJLJ on Windows, as DWARF cannot traverse non-DWARF frames. This +would work fine, except for the fact that libgcc (our C runtime on the +MinGW platform) exports symbols under a different name when configured +to use SJLJ-style unwinding, and uses a preprocessor macro internally to +alias them. + +Because of this, we have to detect this scenario and link to the correct +symbols ourselves. Linking has been tested with a full bootstrap on both +x86_64-unknown-linux-gnu and i686-pc-windows-gnu, as well as +cross-compilation of some of my own projects. + +Obviously, the detection is a bit unrefined. Right now we +unconditionally use SJLJ when compiling Linux -> MinGW. I'd like to add +feature detection using compiler build flags or autotools-style +compilation and object analysis. Input on the best way to proceed here +is welcome. + +Also, currently there is copy-pasted/duplicated code in libunwind. +Ideally, this could be reduced, but this would likely require a +rethinking of how iOS is special-cased above, to avoid further +duplication. Input on how to best structure this file is requested. + +diff --git a/src/bootstrap/compile.rs b/src/bootstrap/compile.rs +index c85b04ddc0..2f58f0d9fa 100644 +--- a/src/bootstrap/compile.rs ++++ b/src/bootstrap/compile.rs +@@ -145,6 +145,11 @@ pub fn std_cargo(build: &Build, + cargo.env("MACOSX_DEPLOYMENT_TARGET", target); + } + ++ // FIXME: Temporary detection of SJLJ MinGW compilers. ++ if build.build.contains("linux") && target == "i686-pc-windows-gnu" { ++ features.push_str(" sjlj_eh"); ++ } ++ + // When doing a local rebuild we tell cargo that we're stage1 rather than + // stage0. This works fine if the local rust and being-built rust have the + // same view of what the default allocator is, but fails otherwise. Since +diff --git a/src/libstd/Cargo.toml b/src/libstd/Cargo.toml +index c1fe4a89d6..6c8cb330d8 100644 +--- a/src/libstd/Cargo.toml ++++ b/src/libstd/Cargo.toml +@@ -49,3 +49,4 @@ force_alloc_system = [] + panic-unwind = ["panic_unwind"] + profiler = ["profiler_builtins"] + wasm_syscall = [] ++sjlj_eh = ["unwind/sjlj_eh"] +diff --git a/src/libunwind/Cargo.toml b/src/libunwind/Cargo.toml +index fbd9789d2f..5e319c67fa 100644 +--- a/src/libunwind/Cargo.toml ++++ b/src/libunwind/Cargo.toml +@@ -14,3 +14,6 @@ doc = false + [dependencies] + core = { path = "../libcore" } + libc = { path = "../rustc/libc_shim" } ++ ++[features] ++sjlj_eh = [] +diff --git a/src/libunwind/libunwind.rs b/src/libunwind/libunwind.rs +index e6fff7963f..6a57cf7c93 100644 +--- a/src/libunwind/libunwind.rs ++++ b/src/libunwind/libunwind.rs +@@ -10,11 +10,6 @@ + + #![allow(bad_style)] + +-macro_rules! cfg_if { +- ( $( if #[cfg( $meta:meta )] { $($it1:item)* } else { $($it2:item)* } )* ) => +- ( $( $( #[cfg($meta)] $it1)* $( #[cfg(not($meta))] $it2)* )* ) +-} +- + use libc::{c_int, c_void, uintptr_t}; + + #[repr(C)] +@@ -84,7 +79,6 @@ pub type _Unwind_Exception_Cleanup_Fn = extern "C" fn(unwind_code: _Unwind_Reaso + exception: *mut _Unwind_Exception); + extern "C" { + #[unwind] +- pub fn _Unwind_Resume(exception: *mut _Unwind_Exception) -> !; + pub fn _Unwind_DeleteException(exception: *mut _Unwind_Exception); + pub fn _Unwind_GetLanguageSpecificData(ctx: *mut _Unwind_Context) -> *mut c_void; + pub fn _Unwind_GetRegionStart(ctx: *mut _Unwind_Context) -> _Unwind_Ptr; +@@ -216,26 +210,49 @@ if #[cfg(all(any(target_os = "ios", not(target_arch = "arm"))))] { + pc + } + } ++} // cfg_if! + +-if #[cfg(not(all(target_os = "ios", target_arch = "arm")))] { +- // Not 32-bit iOS ++cfg_if! { ++if #[cfg(all(target_os = "ios", target_arch = "arm"))] { ++ // 32-bit iOS uses SjLj and does not provide _Unwind_Backtrace() + extern "C" { + #[unwind] +- pub fn _Unwind_RaiseException(exception: *mut _Unwind_Exception) -> _Unwind_Reason_Code; +- pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn, +- trace_argument: *mut c_void) +- -> _Unwind_Reason_Code; ++ pub fn _Unwind_Resume(exception: *mut _Unwind_Exception) -> !; ++ pub fn _Unwind_SjLj_RaiseException(e: *mut _Unwind_Exception) -> _Unwind_Reason_Code; + } +-} else { +- // 32-bit iOS uses SjLj and does not provide _Unwind_Backtrace() ++ ++ #[inline] ++ pub unsafe fn _Unwind_RaiseException(exc: *mut _Unwind_Exception) -> _Unwind_Reason_Code { ++ _Unwind_SjLj_RaiseException(exc) ++ } ++ ++} else if #[cfg(feature = "sjlj_eh")] { + extern "C" { + #[unwind] ++ pub fn _Unwind_SjLj_Resume(e: *mut _Unwind_Exception) -> !; + pub fn _Unwind_SjLj_RaiseException(e: *mut _Unwind_Exception) -> _Unwind_Reason_Code; ++ pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn, ++ trace_argument: *mut c_void) ++ -> _Unwind_Reason_Code; ++ } ++ ++ #[inline] ++ pub unsafe fn _Unwind_Resume(exc: *mut _Unwind_Exception) -> ! { ++ _Unwind_SjLj_Resume(exc) + } + + #[inline] + pub unsafe fn _Unwind_RaiseException(exc: *mut _Unwind_Exception) -> _Unwind_Reason_Code { + _Unwind_SjLj_RaiseException(exc) + } ++} else { ++ extern "C" { ++ #[unwind] ++ pub fn _Unwind_Resume(exception: *mut _Unwind_Exception) -> !; ++ pub fn _Unwind_RaiseException(exception: *mut _Unwind_Exception) -> _Unwind_Reason_Code; ++ pub fn _Unwind_Backtrace(trace: _Unwind_Trace_Fn, ++ trace_argument: *mut c_void) ++ -> _Unwind_Reason_Code; ++ } + } + } // cfg_if! +-- +2.17.1 +

1 0

[tor-browser/tor-browser-60.0.1esr-8.0-1] Bug 1456552 - Make Optimized MinGW builds use -O# instead of falling through and collecting a -O. r=ted, a=jcristau
by gk＠torproject.org 14 Jun '18

14 Jun '18

commit 77f47f2b623a4dffac9162570ea0eaf0c58aeb68 Author: Tom Ritter <tom(a)mozilla.com> Date: Wed May 16 16:32:47 2018 -0500 Bug 1456552 - Make Optimized MinGW builds use -O# instead of falling through and collecting a -O. r=ted, a=jcristau We use -O2 for js (because we can) and we use -O1 for the root because there is an x86 compiler bug that is not immediately bypassable MozReview-Commit-ID: CnDk2ko3jfo --HG-- extra : source : 87f1c846afc3eca37b82d8e86dd3fe451175ab21 --- js/src/old-configure.in | 2 ++ old-configure.in | 2 ++ 2 files changed, 4 insertions(+) diff --git a/js/src/old-configure.in b/js/src/old-configure.in index b9aa86c0d83b..e4df0b05c526 100644 --- a/js/src/old-configure.in +++ b/js/src/old-configure.in @@ -655,6 +655,8 @@ case "$target" in LIBS="$LIBS -lgdi32 -lwinmm -lwsock32" MOZ_FIX_LINK_PATHS= + MOZ_OPTIMIZE_FLAGS="-O2" + WIN32_CONSOLE_EXE_LDFLAGS=-mconsole WIN32_GUI_EXE_LDFLAGS=-mwindows else diff --git a/old-configure.in b/old-configure.in index dd2fb701cd79..3d3e631d52fd 100644 --- a/old-configure.in +++ b/old-configure.in @@ -870,6 +870,8 @@ case "$target" in LIBS="$LIBS -luuid -lgdi32 -lwinmm -lwsock32 -luserenv -lsecur32" MOZ_FIX_LINK_PATHS= + MOZ_OPTIMIZE_FLAGS="-O1" + WIN32_CONSOLE_EXE_LDFLAGS=-mconsole WIN32_GUI_EXE_LDFLAGS=-mwindows

1 0