- tbb-commits - lists.torproject.org

[torbutton/master] Merge remote-tracking branch 'arthur/13019' into bug13019
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit ef23e342a458cc00d7c797baec632db893203a1e Merge: 270eed4 dcbd978 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 22:05:23 2015 -0700 Merge remote-tracking branch 'arthur/13019' into bug13019 src/chrome/content/torbutton.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] fixup! Update 000-tor-browser.js
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit 87c82921ca1f1f7064ca9c9751e574767236cd5f Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 10:56:34 2015 +0000 fixup! Update 000-tor-browser.js Disable to search plugins on first start --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 2d93908..bf23c23 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/… [View More]

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] Bug 10280: Don't load any plugins into the address space.
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit eb596b885a5b8083a2789b837a59a0907f7bda0a Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 11:02:32 2015 +0000 Bug 10280: Don't load any plugins into the address space. If the pref "plugin.disable" is set, the user has to click an extra button to cause Firefox to actually scan the filesystem for plugins. Note: The strings for this patch are actually present in Torbutton. Patch by 'disgleirio'. --- dom/plugins/base/… [View More]nsPluginHost.cpp | 11 ++++ toolkit/mozapps/extensions/AddonManager.jsm | 5 ++ toolkit/mozapps/extensions/content/extensions.js | 68 ++++++++++++++++++++ toolkit/mozapps/extensions/content/extensions.xul | 21 ++++++ .../mozapps/extensions/internal/PluginProvider.jsm | 8 +++ 5 files changed, 113 insertions(+) diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp index 1efe59f..72e3942 100644 --- a/dom/plugins/base/nsPluginHost.cpp +++ b/dom/plugins/base/nsPluginHost.cpp @@ -3105,6 +3105,7 @@ NS_IMETHODIMP nsPluginHost::Observe(nsISupports *aSubject, sInst->Release(); } if (!strcmp(NS_PREFBRANCH_PREFCHANGE_TOPIC_ID, aTopic)) { + NS_ConvertUTF16toUTF8 prefName(someData); mPluginsDisabled = Preferences::GetBool("plugin.disable", false); mPluginsClickToPlay = Preferences::GetBool("plugins.click_to_play", false); // Unload or load plugins as needed @@ -3113,6 +3114,16 @@ NS_IMETHODIMP nsPluginHost::Observe(nsISupports *aSubject, } else { LoadPlugins(); } + if (prefName.Equals("plugin.disable")) { + nsCOMPtr<nsIObserverService> obsService = + mozilla::services::GetObserverService(); + if (obsService) { + nsAutoString pluginPolicy; + pluginPolicy = mPluginsDisabled ? NS_LITERAL_STRING("disabled") + : NS_LITERAL_STRING("enabled"); + obsService->NotifyObservers(nullptr, "plugin-policy-changed", pluginPolicy.get()); + } + } } if (!strcmp("blocklist-updated", aTopic)) { nsPluginTag* plugin = mPlugins; diff --git a/toolkit/mozapps/extensions/AddonManager.jsm b/toolkit/mozapps/extensions/AddonManager.jsm index 81f2670..03e5588 100644 --- a/toolkit/mozapps/extensions/AddonManager.jsm +++ b/toolkit/mozapps/extensions/AddonManager.jsm @@ -2364,6 +2364,11 @@ this.AddonManagerPrivate = { AddonManagerInternal.callAddonListeners.apply(AddonManagerInternal, aArgs); }, + callManagerListeners: function AMP_callManagerListeners(...aArgs) { + AddonManagerInternal.callManagerListeners.apply(AddonManagerInternal, + aArgs); + }, + AddonAuthor: AddonAuthor, AddonScreenshot: AddonScreenshot, diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js index 35d2392..775064e 100644 --- a/toolkit/mozapps/extensions/content/extensions.js +++ b/toolkit/mozapps/extensions/content/extensions.js @@ -820,6 +820,20 @@ var gViewController = { } }, + cmd_pluginEnable: { + isEnabled: function cmd_pluginEnable_isEnabled() true, + doCommand: function cmd_pluginEnable_doCommand() { + Services.prefs.setBoolPref("plugin.disable", false); + } + }, + + cmd_pluginDisable: { + isEnabled: function cmd_pluginDisable_isEnabled() true, + doCommand: function cmd_pluginDisable_doCommand() { + Services.prefs.setBoolPref("plugin.disable", true); + } + }, + cmd_toggleAutoUpdateDefault: { isEnabled: function cmd_toggleAutoUpdateDefault_isEnabled() true, doCommand: function cmd_toggleAutoUpdateDefault_doCommand() { @@ -2553,12 +2567,16 @@ var gListView = { node: null, _listBox: null, _emptyNotice: null, + _pluginEnableButton: null, + _pluginHeader: null, _type: null, initialize: function gListView_initialize() { this.node = document.getElementById("list-view"); this._listBox = document.getElementById("addon-list"); this._emptyNotice = document.getElementById("addon-list-empty"); + this._pluginEnableButton = document.getElementById("plugin-enable-button"); + this._pluginHeader = document.getElementsByClassName("plugin-info-container")[0]; var self = this; this._listBox.addEventListener("keydown", function listbox_onKeydown(aEvent) { @@ -2570,6 +2588,11 @@ var gListView = { }, false); }, + shutdown: function gListView_shutdown() { + AddonManager.removeAddonListener(this); + AddonManager.removeManagerListener(this); + }, + show: function gListView_show(aType, aRequest) { if (!(aType in AddonManager.addonTypes)) throw Components.Exception("Attempting to show unknown type " + aType, Cr.NS_ERROR_INVALID_ARG); @@ -2577,6 +2600,8 @@ var gListView = { this._type = aType; this.node.setAttribute("type", aType); this.showEmptyNotice(false); + this.showPluginHeader(false); + this.showPluginEnableButton(false); while (this._listBox.itemCount > 0) this._listBox.removeItemAt(0); @@ -2600,14 +2625,19 @@ var gListView = { for (let element of elements) self._listBox.appendChild(element); } + self.showPluginButton(); gEventManager.registerInstallListener(self); gViewController.updateCommands(); gViewController.notifyViewChanged(); + AddonManager.addAddonListener(self); /* for onUninstalled */ + AddonManager.addManagerListener(self); /* for onPluginPolicyChanged */ }); }, hide: function gListView_hide() { + AddonManager.removeAddonListener(this); + AddonManager.removeManagerListener(this); gEventManager.unregisterInstallListener(this); doPendingUninstalls(this._listBox); }, @@ -2658,6 +2688,44 @@ var gListView = { } }, + onUninstalled: function gListView_onUninstalled() { + this.showEmptyNotice(this._listBox.itemCount == 0); + }, + + showPluginEnableButton: function gListView_showPluginEnableButton(aShow) { + if (this._pluginEnableButton) + this._pluginEnableButton.hidden = !aShow; + }, + + showPluginHeader: function gListView_showPluginHeader(aShow) { + if (this._pluginHeader) + this._pluginHeader.hidden = !aShow; + }, + + showPluginButton: function gListView_showPluginButton() { + if (this._type == "plugin") { + var plugin_disable = false; + + try { + plugin_disable = Services.prefs.getBoolPref("plugin.disable") + } catch (e) {} + + if (plugin_disable == true) { + this.showPluginHeader(false); + this.showEmptyNotice(false); + this.showPluginEnableButton(true); + } else { + this.showPluginHeader(true); + this.showEmptyNotice(this._listBox.itemCount == 0); + this.showPluginEnableButton(false); + } + } + }, + + onPluginPolicyChanged: function gListView_onPluginPolicyChanged() { + this.showPluginButton(); + }, + addItem: function gListView_addItem(aObj, aIsInstall) { if (aObj.type != this._type) return; diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul index d247bdf..b64937b 100644 --- a/toolkit/mozapps/extensions/content/extensions.xul +++ b/toolkit/mozapps/extensions/content/extensions.xul @@ -86,6 +86,8 @@ <command id="cmd_forward"/> <command id="cmd_enableCheckCompatibility"/> <command id="cmd_pluginCheck"/> + <command id="cmd_pluginEnable"/> + <command id="cmd_pluginDisable"/> <command id="cmd_enableUpdateSecurity"/> <command id="cmd_toggleAutoUpdateDefault"/> <command id="cmd_resetAddonAutoUpdate"/> @@ -357,6 +359,14 @@ command="cmd_pluginCheck"/> <spacer flex="5000"/>  </hbox> + <vbox id="plugin-disable-button" class="global-info" flex="1" + align="end"> + <button class="button-plugin-disable" + label="&plugins.installed.disable;" + tooltiptext="&plugins.installed.disable.tip;" + command="cmd_pluginDisable"/> + <spacer flex="5000"/> + </vbox> </hbox> <hbox class="view-header global-info-container experiment-info-container"> <hbox class="global-info" flex="1" align="center"> @@ -386,6 +396,17 @@ </vbox> <spacer class="alert-spacer-after"/> </vbox> + <vbox id="plugin-enable-button" class="alert-container" flex="1" + hidden="true"> + <spacer class="alert-spacer-before"/> + <vbox class="alert"> + <label value="&plugins.installed.find;"/> + <button class="button-plugin-enable" + label="&plugins.installed.enable;" + command="cmd_pluginEnable"/> + </vbox> + <spacer class="alert-spacer-after"/> + </vbox> <richlistbox id="addon-list" class="list" flex="1"/> </vbox> diff --git a/toolkit/mozapps/extensions/internal/PluginProvider.jsm b/toolkit/mozapps/extensions/internal/PluginProvider.jsm index 7b6e335..65d41a7 100644 --- a/toolkit/mozapps/extensions/internal/PluginProvider.jsm +++ b/toolkit/mozapps/extensions/internal/PluginProvider.jsm @@ -52,6 +52,7 @@ var PluginProvider = { plugins: null, startup: function PL_startup() { + Services.obs.addObserver(this, "plugin-policy-changed", false); Services.obs.addObserver(this, LIST_UPDATED_TOPIC, false); Services.obs.addObserver(this, AddonManager.OPTIONS_NOTIFICATION_DISPLAYED, false); }, @@ -64,6 +65,7 @@ var PluginProvider = { this.plugins = null; Services.obs.removeObserver(this, AddonManager.OPTIONS_NOTIFICATION_DISPLAYED); Services.obs.removeObserver(this, LIST_UPDATED_TOPIC); + Services.obs.removeObserver(this, "plugin-policy-changed"); }, observe: function(aSubject, aTopic, aData) { @@ -89,6 +91,12 @@ var PluginProvider = { if (this.plugins) this.updatePluginList(); break; + case "plugin-policy-changed": + if (!this.plugins) + this.plugins ={}; + this.updatePluginList(); + AddonManagerPrivate.callManagerListeners("onPluginPolicyChanged"); + break; } }, [View Less]

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] fixup! Bug #5926: Allow customization of content JS locale.
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit 85253fe54b195202ee36907183c81bc8b79da7f4 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Mar 23 00:18:37 2015 -0700 fixup! Bug #5926: Allow customization of content JS locale. See https://trac.torproject.org/projects/tor/ticket/13019#comment:17 This changes commit 6b90e18cd63c6dcad3b2bee1d3a45a7e3645ff50. --- browser/base/content/test/general/mochitest.ini | 1 + .../test/general/test_bug_jsdefaultlocale.html | 41 ++++++++++++++… [View More]++++++ xpcom/build/nsXPComInit.cpp | 37 +++++++++--------- 3 files changed, 60 insertions(+), 19 deletions(-) diff --git a/browser/base/content/test/general/mochitest.ini b/browser/base/content/test/general/mochitest.ini index caccc6f..7f228fe 100644 --- a/browser/base/content/test/general/mochitest.ini +++ b/browser/base/content/test/general/mochitest.ini @@ -29,6 +29,7 @@ support-files = [test_bug364677.html] [test_bug395533.html] +[test_bug_jsdefaultlocale.html] [test_contextmenu.html] skip-if = toolkit == "gtk2" || toolkit == "gtk3" # disabled on Linux due to bug 513558 [test_contextmenu_input.html] diff --git a/browser/base/content/test/general/test_bug_jsdefaultlocale.html b/browser/base/content/test/general/test_bug_jsdefaultlocale.html new file mode 100644 index 0000000..6566ae0 --- /dev/null +++ b/browser/base/content/test/general/test_bug_jsdefaultlocale.html @@ -0,0 +1,41 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="utf-8"> + <title>Test for Tor Bug #13019: Prevent fingerprinting of JS-exposed locale</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://bugs.torproject.org">Bug 13019</a> +<p id="display"></p> +<pre id="test"></pre> +<script type="application/javascript;version=1.8"> +let prefName = "javascript.use_us_english_locale", + originalPrefValue = null, + date = new Date(); +// Read the current pref value. +try { + originalPrefValue = SpecialPowers.getBoolPref(prefName); +} catch (e) { } +// Enable pref "javascript.use_us_english_locale". +SpecialPowers.setBoolPref(prefName, true); +// Test that we are getting en-US locale everywhere it is exposed in JavaScript +is(Intl.Collator().resolvedOptions().locale, "en-US", "content JS locale from Intl.Collator"); +is(Intl.DateTimeFormat().resolvedOptions().locale, "en-US", "content JS locale Intl.DateTimeFormat"); +is(Intl.NumberFormat().resolvedOptions().locale, "en-US", "content JS locale from Intl.NumberFormat"); +is(date.toLocaleString(), date.toLocaleString("en-US"), "Date formatted by JS locale"); +// Return pref to its original value, if it had one. +if (originalPrefValue === null) { + SpecialPowers.clearUserPref(prefName); +} else { + SpecialPowers.setBoolPref(prefName, originalPrefValue); +} + +</script> +</body> +</html> diff --git a/xpcom/build/nsXPComInit.cpp b/xpcom/build/nsXPComInit.cpp index 979e10b..12e46d4 100644 --- a/xpcom/build/nsXPComInit.cpp +++ b/xpcom/build/nsXPComInit.cpp @@ -447,12 +447,12 @@ NS_IMPL_ISUPPORTS(NesteggReporter, nsIMemoryReporter) #endif /* MOZ_WEBM */ // Anonymous namespace for customizing the default locale that JavaScript -// uses, according to the value of the "javascript.default_locale" pref. +// uses, according to the value of the "javascript.use_us_english_locale" pref. // The current default locale can be detected in JavaScript by calling // `Intl.DateTimeFormat().resolvedOptions().locale` namespace { -#define DEFAULT_LOCALE_PREF "javascript.default_locale" +#define USE_US_ENGLISH_LOCALE_PREF "javascript.use_us_english_locale" static char* sSystemLocale; static char* sJSLocale; @@ -468,27 +468,26 @@ JSRuntime* GetRuntime() { return rt; } -// Takes the "javascript.default_locale" pref value and applies it. If the locale -// is empty, we fall back to the default system and JS locales. +// If the USE_US_ENGLISH_LOCALE_PREF is active, set all locales to US English. +// Otherwise, fall back to the default system and JS locales. static -void DefaultLocaleChangedCallback(const char* /* pref */, void* /* closure */) { +void UseUSEnglishLocalePrefChangedCallback(const char* /* pref */, void* /* closure */) { // Get a pointer to the default JS Runtime. JSRuntime* rt = GetRuntime(); if (rt) { - // Read the pref, which may contain a custom default locale to be used in JavaScript. - nsAutoCString prefLocale; - mozilla::Preferences::GetCString(DEFAULT_LOCALE_PREF, &prefLocale); + // Read the pref to see if we will use US English locale. + bool useUSEnglishLocale = mozilla::Preferences::GetBool(USE_US_ENGLISH_LOCALE_PREF, false); // Set the application-wide C-locale. Needed for Date.toLocaleFormat(). - setlocale(LC_ALL, prefLocale.IsEmpty() ? sSystemLocale : prefLocale.get()); + setlocale(LC_ALL, useUSEnglishLocale ? "en_US" : sSystemLocale); // Now override the JavaScript Runtime Locale that is used by the Intl API // as well as Date.toLocaleString, Number.toLocaleString, and String.localeCompare. - JS_SetDefaultLocale(rt, prefLocale.IsEmpty() ? sJSLocale : prefLocale.get()); + JS_SetDefaultLocale(rt, useUSEnglishLocale ? "en-US" : sJSLocale); } } static -void StartWatchingDefaultLocalePref() { - // Get the default system locale. To be used if pref is not available. +void StartWatchingUseUSEnglishLocalePref() { + // Get the default system locale. To be used if US English locale pref is deactivated. sSystemLocale = strdup(setlocale(LC_ALL,NULL)); // Store the default JavaScript locale. JSRuntime* rt = GetRuntime(); @@ -496,17 +495,17 @@ void StartWatchingDefaultLocalePref() { sJSLocale = strdup(JS_GetDefaultLocale(rt)); } // Now keep the locale updated with the current pref value. - mozilla::Preferences::RegisterCallbackAndCall(DefaultLocaleChangedCallback, DEFAULT_LOCALE_PREF); + mozilla::Preferences::RegisterCallbackAndCall(UseUSEnglishLocalePrefChangedCallback, USE_US_ENGLISH_LOCALE_PREF); } static -void StopWatchingDefaultLocalePref() { - mozilla::Preferences::UnregisterCallback(DefaultLocaleChangedCallback, DEFAULT_LOCALE_PREF); +void StopWatchingUseUSEnglishLocalePref() { + mozilla::Preferences::UnregisterCallback(UseUSEnglishLocalePrefChangedCallback, USE_US_ENGLISH_LOCALE_PREF); if (sSystemLocale) free(sSystemLocale); if (sJSLocale) JS_free(nullptr, sJSLocale); } -} // anonymous namespace for locale pref +} // anonymous namespace for locale hiding EXPORT_XPCOM_API(nsresult) NS_InitXPCOM2(nsIServiceManager* *result, @@ -766,8 +765,8 @@ NS_InitXPCOM2(nsIServiceManager* *result, mozilla::eventtracer::Init(); #endif - // Start watching the javascript.default_locale pref. - StartWatchingDefaultLocalePref(); + // Start watching the "javascript.use_us_english_locale" pref. + StartWatchingUseUSEnglishLocalePref(); return NS_OK; } @@ -1033,7 +1032,7 @@ ShutdownXPCOM(nsIServiceManager* servMgr) sExitManager = nullptr; } - StopWatchingDefaultLocalePref(); + StopWatchingUseUSEnglishLocalePref(); Omnijar::CleanUp(); [View Less]

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] fixup! Update 000-tor-browser.js
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit 5b1cca491d297458b702db86af061a8ab2a3cf7e Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Mar 25 10:05:14 2015 -0700 fixup! Update 000-tor-browser.js Add JS english spoofing pref. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index bf23c23..0198b98 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/… [View More]

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] Revert "Bug 10280: Don't load any plugins into the address space."
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit c7f790c503265c0b48a69668e34e65e8f7a8e5e5 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 17:22:03 2015 -0700 Revert "Bug 10280: Don't load any plugins into the address space." This reverts commit 7c5fee267428865a1d93c9e44df5c373f8d01569. --- dom/plugins/base/nsPluginHost.cpp | 11 --- toolkit/mozapps/extensions/content/extensions.js | 75 +------------------- toolkit/mozapps/extensions/content/extensions.xul | 23 ------… [View More] .../mozapps/extensions/internal/PluginProvider.jsm | 11 --- 4 files changed, 3 insertions(+), 117 deletions(-) diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp index 68ac197..1efe59f 100644 --- a/dom/plugins/base/nsPluginHost.cpp +++ b/dom/plugins/base/nsPluginHost.cpp @@ -3105,7 +3105,6 @@ NS_IMETHODIMP nsPluginHost::Observe(nsISupports *aSubject, sInst->Release(); } if (!strcmp(NS_PREFBRANCH_PREFCHANGE_TOPIC_ID, aTopic)) { - NS_ConvertUTF16toUTF8 prefName(someData); mPluginsDisabled = Preferences::GetBool("plugin.disable", false); mPluginsClickToPlay = Preferences::GetBool("plugins.click_to_play", false); // Unload or load plugins as needed @@ -3114,16 +3113,6 @@ NS_IMETHODIMP nsPluginHost::Observe(nsISupports *aSubject, } else { LoadPlugins(); } - if (prefName.Equals("plugin.disable")) { - nsCOMPtr<nsIObserverService> obsService = - mozilla::services::GetObserverService(); - if (obsService) { - nsAutoString pluginPolicy; - pluginPolicy = mPluginsDisabled ? NS_LITERAL_STRING("disabled") - : NS_LITERAL_STRING("enabled"); - obsService->NotifyObservers(nullptr, "plugins-policy-changed", pluginPolicy.get()); - } - } } if (!strcmp("blocklist-updated", aTopic)) { nsPluginTag* plugin = mPlugins; diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js index 6790841..35d2392 100644 --- a/toolkit/mozapps/extensions/content/extensions.js +++ b/toolkit/mozapps/extensions/content/extensions.js @@ -858,20 +858,6 @@ var gViewController = { } }, - cmd_goToEnablePlugins: { - isEnabled: function cmd_goToEnablePlugins_isEnabled() true, - doCommand: function cmd_goToEnablePlugins_doCommand() { - Services.prefs.setBoolPref("plugin.disable", false); - } - }, - - cmd_goToDisablePlugins: { - isEnabled: function cmd_goToDisablePlugins_isEnabled() true, - doCommand: function cmd_goToDisablePlugins_doCommand() { - Services.prefs.setBoolPref("plugin.disable", true); - } - }, - cmd_goToRecentUpdates: { isEnabled: function cmd_goToRecentUpdates_isEnabled() true, doCommand: function cmd_goToRecentUpdates_doCommand() { @@ -2567,17 +2553,12 @@ var gListView = { node: null, _listBox: null, _emptyNotice: null, - _pluginDisabledNotice: null, - _pluginEnabledNotice: null, _type: null, - _pluginListEmpty: false, initialize: function gListView_initialize() { this.node = document.getElementById("list-view"); this._listBox = document.getElementById("addon-list"); this._emptyNotice = document.getElementById("addon-list-empty"); - this._pluginDisabledNotice = document.getElementById("plugin-disabled"); - this._pluginEnabledNotice = document.getElementById("plugin-enabled"); var self = this; this._listBox.addEventListener("keydown", function listbox_onKeydown(aEvent) { @@ -2589,10 +2570,6 @@ var gListView = { }, false); }, - shutdown: function gListView_shutdown() { - AddonManager.removeAddonListener(this); - }, - show: function gListView_show(aType, aRequest) { if (!(aType in AddonManager.addonTypes)) throw Components.Exception("Attempting to show unknown type " + aType, Cr.NS_ERROR_INVALID_ARG); @@ -2600,12 +2577,9 @@ var gListView = { this._type = aType; this.node.setAttribute("type", aType); this.showEmptyNotice(false); - this.showPluginEnabledNotice(false); - this.showPluginDisabledNotice(false); while (this._listBox.itemCount > 0) this._listBox.removeItemAt(0); - this._pluginListEmpty = true; var self = this; getAddonsAndInstalls(aType, function show_getAddonsAndInstalls(aAddonsList, aInstallsList) { @@ -2620,22 +2594,20 @@ var gListView = { for (let installItem of aInstallsList) elements.push(createItem(installItem, true)); + self.showEmptyNotice(elements.length == 0); if (elements.length > 0) { sortElements(elements, ["uiState", "name"], true); for (let element of elements) self._listBox.appendChild(element); } - self.showAllNeedNotices(true); gEventManager.registerInstallListener(self); gViewController.updateCommands(); gViewController.notifyViewChanged(); - AddonManager.addAddonListener(self); }); }, hide: function gListView_hide() { - AddonManager.removeAddonListener(this); gEventManager.unregisterInstallListener(this); doPendingUninstalls(this._listBox); }, @@ -2644,43 +2616,6 @@ var gListView = { this._emptyNotice.hidden = !aShow; }, - showPluginDisabledNotice: function gListView_showPluginDisabledNotice(aShow) { - this._pluginDisabledNotice.hidden = !aShow; - }, - - showPluginEnabledNotice: function gListView_showPluginEnabledNotice(aShow) { - this._pluginEnabledNotice.hidden = !aShow; - }, - - showAllNeedNotices: function gListView_showAllNeedNotices(aShow) { - var empty_list = (this._listBox.itemCount == 0); - var show_empty_notice = true; - - if (this._type == "plugin") { - var update_notices = (this._pluginListEmpty != empty_list); - this._pluginListEmpty = empty_list; - - if (update_notices || aShow) { - var plugin_disable = false; - - try { - plugin_disable = Services.prefs.getBoolPref("plugin.disable") - } catch (e) {} - - if (plugin_disable == true) { - this.showPluginEnabledNotice(false); - this.showPluginDisabledNotice(true); - show_empty_notice = false; - } else { - this.showPluginDisabledNotice(false); - this.showPluginEnabledNotice(true); - } - } - } - if (show_empty_notice == true) - this.showEmptyNotice(empty_list); - }, - onSortChanged: function gListView_onSortChanged(aSortBy, aAscending) { sortList(this._listBox, aSortBy, aAscending); }, @@ -2723,10 +2658,6 @@ var gListView = { } }, - onUninstalled: function gListView_onUninstalled() { - this.showAllNeedNotices(false); - }, - addItem: function gListView_addItem(aObj, aIsInstall) { if (aObj.type != this._type) return; @@ -2742,7 +2673,7 @@ var gListView = { let item = createItem(aObj, aIsInstall); this._listBox.insertBefore(item, this._listBox.firstChild); - this.showAllNeedNotices(false); + this.showEmptyNotice(false); }, removeItem: function gListView_removeItem(aObj, aIsInstall) { @@ -2751,7 +2682,7 @@ var gListView = { for (let item of this._listBox.childNodes) { if (item[prop] == aObj) { this._listBox.removeChild(item); - this.showAllNeedNotices(false); + this.showEmptyNotice(this._listBox.itemCount == 0); return; } } diff --git a/toolkit/mozapps/extensions/content/extensions.xul b/toolkit/mozapps/extensions/content/extensions.xul index 1c2bb07..d247bdf 100644 --- a/toolkit/mozapps/extensions/content/extensions.xul +++ b/toolkit/mozapps/extensions/content/extensions.xul @@ -79,8 +79,6 @@ <command id="cmd_findAllUpdates"/> <command id="cmd_restartApp"/> <command id="cmd_goToDiscoverPane"/> - <command id="cmd_goToEnablePlugins"/> - <command id="cmd_goToDisablePlugins"/> <command id="cmd_goToRecentUpdates"/> <command id="cmd_goToAvailableUpdates"/> <command id="cmd_installFromFile"/> @@ -388,28 +386,7 @@ </vbox> <spacer class="alert-spacer-after"/> </vbox> - <vbox id="plugin-disabled" class="alert-container" - flex="1" hidden="true"> - <spacer class="alert-spacer-before"/> - <vbox class="alert"> - <label value="&plugins.installed.find;"/> - <button class="button-enableplugin" - label="&plugins.installed.enable;" - command="cmd_goToEnablePlugins"/> - </vbox> - <spacer class="alert-spacer-after"/> - </vbox> <richlistbox id="addon-list" class="list" flex="1"/> - <vbox id="plugin-enabled" class="view-header global-info-container" - hidden="true"> - <vbox class="global-info" flex="1" align="center"> - <button class="button-disableplugin" - label="&plugins.installed.disable;" - tooltiptext="&plugins.installed.disable.tip;" - command="cmd_goToDisablePlugins"/> - <spacer flex="5000"/>  - </vbox> - </vbox> </vbox>  diff --git a/toolkit/mozapps/extensions/internal/PluginProvider.jsm b/toolkit/mozapps/extensions/internal/PluginProvider.jsm index 2cf2583..7b6e335 100644 --- a/toolkit/mozapps/extensions/internal/PluginProvider.jsm +++ b/toolkit/mozapps/extensions/internal/PluginProvider.jsm @@ -52,7 +52,6 @@ var PluginProvider = { plugins: null, startup: function PL_startup() { - Services.obs.addObserver(this, "plugins-policy-changed", false); Services.obs.addObserver(this, LIST_UPDATED_TOPIC, false); Services.obs.addObserver(this, AddonManager.OPTIONS_NOTIFICATION_DISPLAYED, false); }, @@ -65,7 +64,6 @@ var PluginProvider = { this.plugins = null; Services.obs.removeObserver(this, AddonManager.OPTIONS_NOTIFICATION_DISPLAYED); Services.obs.removeObserver(this, LIST_UPDATED_TOPIC); - Services.obs.removeObserver(this, "plugins-policy-changed"); }, observe: function(aSubject, aTopic, aData) { @@ -91,15 +89,6 @@ var PluginProvider = { if (this.plugins) this.updatePluginList(); break; - case "plugins-policy-changed": - var plugin_policy = aData - if (!this.plugins) - this.plugins =[]; - this.updatePluginList(); - Services.obs.notifyObservers(null, - "plugin-provider-after-changed-policy", - plugin_policy); - break; } }, [View Less]

1 0

[tor-browser-bundle/master] Bug 13766: Raise MaxCircuitDirtiness to 2 hours
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit 824116042a03683ae20fa6e7d0768d8fd6fd6f95 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 21:43:03 2015 -0700 Bug 13766: Raise MaxCircuitDirtiness to 2 hours Well, 1 second shy, so we're sure the torbutton update pings go over new circuits. --- Bundle-Data/linux/Data/Tor/torrc-defaults | 1 + Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults | 1 + Bundle-Data/windows/Data/Tor/torrc-defaults | 1 + 3 files changed, … [View More]

1 0

[torbutton/master] Bug 13766: Raise update check frequency to 2 hours.
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit 270eed437c93987b8d0f31f52d3545321facb0e0 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 21:12:56 2015 -0700 Bug 13766: Raise update check frequency to 2 hours. To match Nick's suggested 2 hour circuit dirtiness timeout in #13766. --- src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 69efb5f..5eb704e 100644 --- a/src/… [View More]

1 0

[torbutton/master] Bug 13766: Set a 10 minute circuit dirty timeout for the catch-all circ.
by mikeperry＠torproject.org 25 Mar '15

25 Mar '15

commit 2359bd808367673ed7738a8b96b0fcb8571883dc Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 20:27:20 2015 -0700 Bug 13766: Set a 10 minute circuit dirty timeout for the catch-all circ. This will allow us to raise the circuit dirty timeout value for all other circs. --- src/components/domain-isolator.js | 36 ++++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 10 deletions(-) diff --git a/src/components/domain-isolator.js … [View More]b/src/components/domain-isolator.js index 6e6201e..a05fee2 100644 --- a/src/components/domain-isolator.js +++ b/src/components/domain-isolator.js @@ -53,6 +53,10 @@ let tor = tor || {}; // A mutable map that records what nonce we are using for each domain. tor.noncesForDomains = {}; +// __tor.unknownDirtySince__. +// Specifies when the current catch-all circuit was first used +tor.unknownDirtySince = Date.now(); + // __tor.socksProxyCredentials(originalProxy, domain)__. // Takes a proxyInfo object (originalProxy) and returns a new proxyInfo // object with the same properties, except the username is set to the @@ -74,6 +78,17 @@ tor.socksProxyCredentials = function (originalProxy, domain) { proxy.failoverProxy); }; +tor.newCircuitForDomain = function(domain) { + // Check if we already have a nonce. If not, create + // one for this domain. + if (!tor.noncesForDomains.hasOwnProperty(domain)) { + tor.noncesForDomains[domain] = 0; + } else { + tor.noncesForDomains[domain] += 1; + } + logger.eclog(3, "New domain isolation count " +tor.noncesForDomains[domain] + " for " + domain); +} + // __tor.isolateCircuitsByDomain()__. // For every HTTPChannel, replaces the default SOCKS proxy with one that authenticates // to the SOCKS server (the tor client process) with a username (the first party domain) @@ -93,8 +108,16 @@ tor.isolateCircuitsByDomain = function () { replacementProxy.username + ":" + replacementProxy.password); return replacementProxy; } catch (err) { - // If we fail, then just use the default proxyInfo. - return aProxy; + if (Date.now() - tor.unknownDirtySince > 1000*10*60) { + logger.eclog(3, "tor catchall circuit has been dirty for over 10 minutes. Rotating."); + tor.newCircuitForDomain("--unknown--"); + tor.unknownDirtySince = Date.now(); + } + let replacementProxy = tor.socksProxyCredentials(aProxy, "--unknown--"); + + logger.eclog(3, "tor SOCKS isolation catchall: " + aChannel.URI.spec + " via " + + replacementProxy.username + ":" + replacementProxy.password); + return replacementProxy; } }, 0); }; @@ -125,14 +148,7 @@ DomainIsolator.prototype = { } }, newCircuitForDomain: function (domain) { - // Check if we already have a nonce. If not, create - // one for this domain. - if (!tor.noncesForDomains.hasOwnProperty(domain)) { - tor.noncesForDomains[domain] = 0; - } else { - tor.noncesForDomains[domain] += 1; - } - logger.eclog(3, "New domain isolation count " +tor.noncesForDomains[domain] + " for " + domain); + tor.newCircuitForDomain(domain); }, wrappedJSObject: null [View Less]

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] Bug 15406: Only include forced updates if extensions differ.
by mikeperry＠torproject.org 24 Mar '15

24 Mar '15

commit 39e3a2b282d4d89c8c6498162ae155c018d79a68 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Mar 24 16:34:43 2015 -0400 Bug 15406: Only include forced updates if extensions differ. For the NoScript and HTTPS Everywhere extensions, only force files to be included in incremental MARs if the extension has changed. For NoScript we detect this by comparing the old and new .xpi files. For HTTPS Everywhere (which is unpacked) we only check install.rdf; … [View More] our assumption is that the version number will be changed for each new release. --- tools/update-packaging/make_incremental_update.sh | 41 ++++++++++++++++++--- 1 file changed, 35 insertions(+), 6 deletions(-) diff --git a/tools/update-packaging/make_incremental_update.sh b/tools/update-packaging/make_incremental_update.sh index 010101c..10af358 100755 --- a/tools/update-packaging/make_incremental_update.sh +++ b/tools/update-packaging/make_incremental_update.sh @@ -69,12 +69,8 @@ if [ $# = 0 ]; then exit 1 fi -# TODO: it would be better to pass these paths via command line options. -ext_path='TorBrowser/Data/Browser/profile.default/extensions' -https_everywhere='https-everywhere(a)eff.org' -noscript='{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi' -requested_forced_updates="$ext_path/$https_everywhere/* $ext_path/$noscript" -directories_to_remove="$ext_path/$https_everywhere" +requested_forced_updates="" +directories_to_remove="" while getopts "hqf:" flag do @@ -109,6 +105,39 @@ updatemanifestv2="$workdir/updatev2.manifest" updatemanifestv3="$workdir/updatev3.manifest" archivefiles="updatev2.manifest updatev3.manifest" +# If the NoScript or HTTPS Everywhere extensions have changed between +# releases, add them to the "force updates" list. +ext_path='TorBrowser/Data/Browser/profile.default/extensions' +https_everywhere='https-everywhere(a)eff.org' +noscript='{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi' + +# NoScript is a packed extension, so we simply compare the old and the new +# .xpi files. +noscript_path="$ext_path/$noscript" +diff -a "$olddir/$noscript_path" "$newdir/$noscript_path" > /dev/null +rc=$? +if [ $rc -gt 1 ]; then + notice "Unexpected exit $rc from $noscript_path diff command" + exit 2 +elif [ $rc -eq 1 ]; then + requested_forced_updates="$requested_forced_updates $noscript_path" +fi + +# HTTPS Everywhere is an unpacked extension, so we need to determine if any of +# the unpacked files have changed. Since that is messy, we simply compare the +# old extension's install.rdf file to the new one. +https_everywhere_install_rdf="$ext_path/$https_everywhere/install.rdf" +diff "$olddir/$https_everywhere_install_rdf" \ + "$newdir/$https_everywhere_install_rdf" > /dev/null +rc=$? +if [ $rc -gt 1 ]; then + notice "Unexpected exit $rc from $https_everywhere_install_rdf diff command" + exit 2 +elif [ $rc -eq 1 ]; then + requested_forced_updates="$requested_forced_updates $ext_path/$https_everywhere/*" + directories_to_remove="$directories_to_remove $ext_path/$https_everywhere" +fi + mkdir -p "$workdir" # On Mac, the precomplete file added by Bug 386760 will cause OS X to reload the [View Less]

1 0

[tor-browser/tor-browser-31.5.0esr-4.5-1] Bug 15406: Do not force updates for Torbutton and Tor Launcher.
by mikeperry＠torproject.org 24 Mar '15

24 Mar '15

commit 74d1e1309dd53363481140d463edae3a905cea97 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Mar 24 11:12:35 2015 -0400 Bug 15406: Do not force updates for Torbutton and Tor Launcher. Since we have disabled updates for Torbutton and Tor Launcher, there is no need to force these extensions to be updated (replaced) when generating our incremental MAR files. Also, we no longer force an update to the pdf.js extension (it is now built into the browser) … [View More]

1 0

[torbutton/master] Merge remote-tracking branch 'gk/bug_9387_v12'
by mikeperry＠torproject.org 24 Mar '15

24 Mar '15

commit 2acdf4d9ac039aee11351631a79ab0437dc4e39a Merge: 5ac0bb1 398eba8 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 24 14:16:00 2015 -0700 Merge remote-tracking branch 'gk/bug_9387_v12' src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[torbutton/master] Bug 9387: Security slider 1.0
by mikeperry＠torproject.org 24 Mar '15

24 Mar '15

commit 398eba8d5e2bf22afe41dbdd97044598ffbc2dd8 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 23 09:20:01 2015 +0000 Bug 9387: Security slider 1.0 --- src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 3db2dd7..69efb5f 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2243,7 +2243,7 @@ var … [View More]

1 0

[tor-browser-bundle/master] Upgrade go to 1.4.2.
by gk＠torproject.org 24 Mar '15

24 Mar '15

commit 4711e77ebda8c4fdbbb24110bf49d1b95d65d7c3 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 21 15:41:13 2015 -0700 Upgrade go to 1.4.2. https://golang.org/doc/go1.4 https://golang.org/doc/devel/release.html#go1.4 --- gitian/versions | 4 ++-- gitian/versions.alpha | 4 ++-- gitian/versions.beta | 4 ++-- gitian/versions.nightly | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/gitian/versions b/gitian/… [View More]versions index 7ad0edb..4b0c9a4 100755 --- a/gitian/versions +++ b/gitian/versions @@ -48,7 +48,7 @@ SETUPTOOLS_VER=1.4 LXML_VER=3.3.5 PARSLEY_VER=1.2 HTTPSE_VER=4.0.1 -GO_VER=1.3.3 +GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -93,7 +93,7 @@ M2CRYPTO_HASH=25b94498505c2d800ee465db0cc1aff097b1615adc3ac042a1c85ceca264fc0a PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 -GO_HASH=1bb6fde89cfe8b9756a875af55d994cce0994861227b5dc0f268c143d91cd5ff +GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e ## Non-git package URLs diff --git a/gitian/versions.alpha b/gitian/versions.alpha index c22890b..2e6cd80 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -53,7 +53,7 @@ SETUPTOOLS_VER=1.4 LXML_VER=3.3.5 PARSLEY_VER=1.2 HTTPSE_VER=5.0development.2 -GO_VER=1.3.3 +GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,7 +99,7 @@ M2CRYPTO_HASH=25b94498505c2d800ee465db0cc1aff097b1615adc3ac042a1c85ceca264fc0a PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 -GO_HASH=1bb6fde89cfe8b9756a875af55d994cce0994861227b5dc0f268c143d91cd5ff +GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e GONET_HASH=1812fec55256e1a6fe546111cc658520b80972f38826c94ec11ef24315d32353 diff --git a/gitian/versions.beta b/gitian/versions.beta index 19d117e..efb4bfb 100755 --- a/gitian/versions.beta +++ b/gitian/versions.beta @@ -47,7 +47,7 @@ SETUPTOOLS_VER=1.4 LXML_VER=3.3.5 PARSLEY_VER=1.2 HTTPSE_VER=3.5.1 -GO_VER=1.3.3 +GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -94,7 +94,7 @@ M2CRYPTO_HASH=25b94498505c2d800ee465db0cc1aff097b1615adc3ac042a1c85ceca264fc0a PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 -GO_HASH=1bb6fde89cfe8b9756a875af55d994cce0994861227b5dc0f268c143d91cd5ff +GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b ## Non-git package URLs OPENSSL_URL=https://www.openssl.org/source/${OPENSSL_PACKAGE} diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 2e4733e..cf0aecf 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -57,7 +57,7 @@ SETUPTOOLS_VER=1.4 LXML_VER=3.3.5 PARSLEY_VER=1.2 HTTPSE_VER=5.0development.2 -GO_VER=1.3.3 +GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -103,7 +103,7 @@ M2CRYPTO_HASH=25b94498505c2d800ee465db0cc1aff097b1615adc3ac042a1c85ceca264fc0a PY2EXE_HASH=610a8800de3d973ed5ed4ac505ab42ad058add18a68609ac09e6cf3598ef056c SETUPTOOLS_HASH=75d288687066ed124311d6ca5f40ffa92a0e81adcd7fff318c6e84082713cf39 PARSLEY_HASH=50d30cee70770fd44db7cea421cb2fb75af247c3a1cd54885c06b30a7c85dd23 -GO_HASH=1bb6fde89cfe8b9756a875af55d994cce0994861227b5dc0f268c143d91cd5ff +GO_HASH=299a6fd8f8adfdce15bc06bde926e7b252ae8e24dd5b16b7d8791ed79e7b5e9b GCC_HASH=d334781a124ada6f38e63b545e2a3b8c2183049515a1abab6d513f109f1d717e GONET_HASH=1812fec55256e1a6fe546111cc658520b80972f38826c94ec11ef24315d32353 [View Less]

1 0

[tor-browser-bundle/master] Use https URLs for golang.org.
by gk＠torproject.org 24 Mar '15

24 Mar '15

commit c0f7fa56c1a63cb5df18a3a4b55333ad6184252a Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 21 15:37:56 2015 -0700 Use https URLs for golang.org. --- gitian/versions | 2 +- gitian/versions.alpha | 2 +- gitian/versions.beta | 2 +- gitian/versions.nightly | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions b/gitian/versions index b97ec8a..7ad0edb 100755 --- a/gitian/versions +++ b/gitian/versions @@ -… [View More]

1 0

[tor-browser-bundle/master] Bug #14937: Hard-code meek and flashproxy node fingerprints
by gk＠torproject.org 24 Mar '15

24 Mar '15

commit bb029bff85d1973a08340404be50f7ceee83f59e Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 20 14:51:58 2015 -0700 Bug #14937: Hard-code meek and flashproxy node fingerprints See discussion in https://trac.torproject.org/projects/tor/ticket/14937?replyto=22#comment:17 and below. --- Bundle-Data/PTConfigs/bridge_prefs.js | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js … [View More]b/Bundle-Data/PTConfigs/bridge_prefs.js index f4a4f41..8e7fd43 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,11 +8,11 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.flashproxy.1", "flashproxy 0.0.1.0:1"); -pref("extensions.torlauncher.default_bridge.flashproxy.2", "flashproxy 0.0.1.0:2"); -pref("extensions.torlauncher.default_bridge.flashproxy.3", "flashproxy 0.0.1.0:3"); -pref("extensions.torlauncher.default_bridge.flashproxy.4", "flashproxy 0.0.1.0:4"); -pref("extensions.torlauncher.default_bridge.flashproxy.5", "flashproxy 0.0.1.0:5"); +pref("extensions.torlauncher.default_bridge.flashproxy.1", "flashproxy 0.0.1.0:1 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); +pref("extensions.torlauncher.default_bridge.flashproxy.2", "flashproxy 0.0.1.0:2 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); +pref("extensions.torlauncher.default_bridge.flashproxy.3", "flashproxy 0.0.1.0:3 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); +pref("extensions.torlauncher.default_bridge.flashproxy.4", "flashproxy 0.0.1.0:4 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); +pref("extensions.torlauncher.default_bridge.flashproxy.5", "flashproxy 0.0.1.0:5 4D6C0DF6DEC9398A4DEF07084F3CD395A96DD2AD"); pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 B629B0B607C8AC9349B5646C24E9D242184F5B6E"); pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); @@ -31,6 +31,6 @@ pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 178.209.52.110:443 pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 83.212.101.3:41213 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0"); -pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 url=https://meek-reflect.appspot.com/ front=www.google.com"); -pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); -pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 url=https://az668014.vo.msecnd.net/ front=ajax.aspnetcdn.com"); +pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 46D4A71197B8FA515A826C6B017C522FE264655B url=https://meek-reflect.appspot.com/ front=www.google.com"); +pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 4EE0CC769EB4B15A872F742EDE27D298A59DCADE url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com"); +pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 A2C13B7DFCAB1CBF3A884B6EB99A98067AB6EF44 url=https://az668014.vo.msecnd.net/ front=ajax.aspnetcdn.com"); [View Less]

1 0

[tor-browser-bundle/master] Merge remote-tracking branch 'arthur/14937'
by gk＠torproject.org 24 Mar '15

24 Mar '15

commit 5a9179b065e3015381fc6ea5bf4dccb0b04d3dd6 Merge: 4cce67a bb029bf Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 24 15:43:19 2015 +0000 Merge remote-tracking branch 'arthur/14937' Bundle-Data/PTConfigs/bridge_prefs.js | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)

1 0

[torbutton/master] Bug 14937: Show meek and flashproxy bridges in tor circuit display
by gk＠torproject.org 24 Mar '15

24 Mar '15

commit c6321626cf04db74a8c08af19331c686757adc85 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sat Mar 21 16:32:07 2015 -0700 Bug 14937: Show meek and flashproxy bridges in tor circuit display --- src/chrome/content/tor-circuit-display.js | 37 ++++++++++++++++------------- src/modules/tor-control-port.js | 4 +--- 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/src/chrome/content/tor-circuit-display.js b/src/chrome/content/tor-circuit-… [View More]display.js index a4ba919..8997757 100644 --- a/src/chrome/content/tor-circuit-display.js +++ b/src/chrome/content/tor-circuit-display.js @@ -47,7 +47,7 @@ let credentialsToNodeDataMap = {}, // __trimQuotes(s)__. // Removes quotation marks around a quoted string. -let trimQuotes = s => s ? s.match(/^\"(.*)\"$/)[1] : undefined; +let trimQuotes = s => s ? s.match(/^"(.*)"$/)[1] : undefined; // __getBridge(id)__. // Gets the bridge parameters for a given node ID. If the node @@ -89,7 +89,8 @@ let nodeDataForID = function* (controller, id) { if (result.ip) { // Get the country code for the node's IP address. try { - result.countryCode = yield controller.getInfo("ip-to-country/" + result.ip); + let countryCode = yield controller.getInfo("ip-to-country/" + result.ip); + result.countryCode = countryCode === "??" ? null : countryCode; } catch (e) { } } return result; @@ -190,22 +191,24 @@ let showCircuitDisplay = function (show) { let nodeLines = function (nodeData) { let result = []; for (let {ip, countryCode, type, bridgeType} of nodeData) { - let bridge = type === "bridge"; + let bridge = type === "bridge", + country = countryCode ? localizedCountryNameFromCode(countryCode) : null; result.push( - // For each relay, show its apparent host country. - (countryCode ? localizedCountryNameFromCode(countryCode) - : uiString("unknown_country")) + - (bridge ? - // As we have a bridge, don't show the IP address - // but show the bridge type. - " (" + uiString("tor_bridge") + - ((bridgeType !== "vanilla") ? (": " + bridgeType) : "") + ")" - : - // As we don't have a bridge, show the IP address - // of the node. Use unicode escapes to ensure that - // parentheses behave properly in both left-to-right - // and right-to-left languages. - " ‭ (" + (ip || uiString("ip_unknown")) + ")‬")); + bridge ? + // As we have a bridge, don't show the IP address + // but show the bridge type. + (uiString("tor_bridge") + + ((bridgeType !== "vanilla") ? (": " + bridgeType) : "") + + (country ? " (" + country + ")" : "")) + : + // For each non-bridge relay, show its host country and IP. + (country || uiString("unknown_country")) + + // As we don't have a bridge, show the IP address + // of the node. Use unicode escapes to ensure that + // parentheses behave properly in both left-to-right + // and right-to-left languages. + " ‭ (" + (ip || uiString("ip_unknown")) + ")‬" + ); } return result; }; diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index a55a0d8..710643e 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -476,11 +476,9 @@ info.bridgeParser = function(bridgeLine) { // Several bridge types have a similar format: } else { result.type = tokens[0]; - if (["fte", "obfs3", "obfs4", "scramblesuit"] + if (["flashproxy", "fte", "meek", "obfs3", "obfs4", "scramblesuit"] .indexOf(result.type) >= 0) { [result.address, result.ID] = tokens.slice(1); - } else if (result.type === "meek") { - // do nothing for now } } return result.type ? result : null; [View Less]

1 0

[torbutton/master] Merge remote-tracking branch 'arthur/14937+7'
by gk＠torproject.org 24 Mar '15

24 Mar '15

commit 5ac0bb12aaceb954d124e1e65cd47c37e28fcaa7 Merge: 55d3976 c632162 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 24 15:41:45 2015 +0000 Merge remote-tracking branch 'arthur/14937+7' src/chrome/content/tor-circuit-display.js | 37 ++++++++++++++++------------- src/modules/tor-control-port.js | 4 +--- 2 files changed, 21 insertions(+), 20 deletions(-)

1 0

[tor-browser-bundle/master] Bug 15437: Use Moritz' new key and new tag
by gk＠torproject.org 23 Mar '15

23 Mar '15

commit 4cce67a179e7978908e934069024ac8d832692d0 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 23 11:54:02 2015 +0000 Bug 15437: Use Moritz' new key and new tag --- gitian/gpg/tbb-windows-installer.gpg | Bin 15689 -> 53000 bytes gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/gpg/tbb-windows-installer.gpg b/gitian/gpg/tbb-windows-installer.gpg index … [View More]

1 0

[tor-browser-bundle/master] Bug 15428: Upgrade meek to 0.16.
by gk＠torproject.org 23 Mar '15

23 Mar '15

commit 1ef11b4dd2ee590b316029a365ce9156a9d949c3 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 21 21:59:55 2015 +0000 Bug 15428: Upgrade meek to 0.16. --- gitian/versions | 2 +- gitian/versions.alpha | 2 +- gitian/versions.beta | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/versions b/gitian/versions index b661fff..b97ec8a 100755 --- a/gitian/versions +++ b/gitian/versions @@ -25,7 +25,7 @@ FTEPROXY_TAG=… [View More]

1 0

[tor-browser-bundle/maint-4.0] Bug 15428: Upgrade meek to 0.16.
by gk＠torproject.org 23 Mar '15

23 Mar '15

commit 22d0af184ee6b3cdee11b159c3667cf72d4df364 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 21 21:59:55 2015 +0000 Bug 15428: Upgrade meek to 0.16. --- gitian/versions | 2 +- gitian/versions.alpha | 2 +- gitian/versions.beta | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/versions b/gitian/versions index c8d647b..14354af 100755 --- a/gitian/versions +++ b/gitian/versions @@ -25,7 +25,7 @@ FTEPROXY_TAG=… [View More]

1 0

[tor-browser-bundle/master] Merge remote-tracking branch 'yawning/bug12535'
by gk＠torproject.org 23 Mar '15

23 Mar '15

commit 5e26066db070aa30d879a022237478a37bb5d944 Merge: 474bbb5 9d26e00 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Mar 23 08:46:50 2015 +0000 Merge remote-tracking branch 'yawning/bug12535' .../linux/gitian-pluggable-transports.yml | 6 + .../mac/gitian-pluggable-transports.yml | 6 + .../windows/gitian-pluggable-transports.yml | 6 + gitian/patches/bug12535.patch | 1032 ++++++++++++++++++++ 4 files changed, 1050 insertions(+)

1 0

[tor-browser-bundle/master] Use a SOCKS5 listener instead of a SOCKS4a for goptlib.
by gk＠torproject.org 23 Mar '15

23 Mar '15

commit 9d26e0009fc6a8e89a48db2a976097459f14f45e Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Mar 23 01:02:39 2015 +0000 Use a SOCKS5 listener instead of a SOCKS4a for goptlib. This is done in the form of a patch that has yet to be merged into goptlib. Once the branch is merged, this change should be reverted, and the goptlib tag updated. --- .../linux/gitian-pluggable-transports.yml | 6 + .../mac/gitian-pluggable-transports.yml … [View More] | 6 + .../windows/gitian-pluggable-transports.yml | 6 + gitian/patches/bug12535.patch | 1032 ++++++++++++++++++++ 4 files changed, 1050 insertions(+) diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index 9596b7f..2f8e70e 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -55,6 +55,7 @@ files: - "openssl-linux32-utils.zip" - "openssl-linux64-utils.zip" - "go.net.tar.bz2" +- "bug12535.patch" script: | INSTDIR="$HOME/install" PTDIR="$INSTDIR/Tor/PluggableTransports" @@ -206,6 +207,11 @@ script: | # Building goptlib cd goptlib + git update-index --refresh -q + export GIT_COMMITTER_NAME="nobody" + export GIT_COMMITTER_EMAIL="nobody@localhost" + export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" + git am ~/build/bug12535.patch find -type f | xargs touch --date="$REFERENCE_DATETIME" mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports" ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/goptlib.git" diff --git a/gitian/descriptors/mac/gitian-pluggable-transports.yml b/gitian/descriptors/mac/gitian-pluggable-transports.yml index a1bdff9..0ed896e 100644 --- a/gitian/descriptors/mac/gitian-pluggable-transports.yml +++ b/gitian/descriptors/mac/gitian-pluggable-transports.yml @@ -51,6 +51,7 @@ files: - "multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz" - "dzip.sh" - "go.net.tar.bz2" +- "bug12535.patch" - "gmp-mac64-utils.zip" - "openssl-mac64-utils.zip" script: | @@ -232,6 +233,11 @@ script: | # Building goptlib cd goptlib + git update-index --refresh -q + export GIT_COMMITTER_NAME="nobody" + export GIT_COMMITTER_EMAIL="nobody@localhost" + export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" + git am ~/build/bug12535.patch find -type f | xargs touch --date="$REFERENCE_DATETIME" mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports" ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/goptlib.git" diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index 4ca477e..0ea6e6d 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -58,6 +58,7 @@ files: - "gmp-win32-utils.zip" - "gcclibs-win32-utils.zip" - "go.net.tar.bz2" +- "bug12535.patch" script: | # Set the timestamp on every .pyc file in a zip file, and re-dzip the zip file. function py2exe_zip_timestomp { @@ -308,6 +309,11 @@ script: | # Building goptlib cd goptlib + git update-index --refresh -q + export GIT_COMMITTER_NAME="nobody" + export GIT_COMMITTER_EMAIL="nobody@localhost" + export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" + git am ~/build/bug12535.patch find -type f | xargs touch --date="$REFERENCE_DATETIME" mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports" ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/goptlib.git" diff --git a/gitian/patches/bug12535.patch b/gitian/patches/bug12535.patch new file mode 100644 index 0000000..dae6818 --- /dev/null +++ b/gitian/patches/bug12535.patch @@ -0,0 +1,1032 @@ +From 743ae58b6c33dda837ffb1267867f564597dd59d Mon Sep 17 00:00:00 2001 +From: Yawning Angel <yawning(a)schwanenlied.me> +Date: Mon, 8 Sep 2014 18:24:08 +0000 +Subject: [PATCH] Replace the SOCKS4a listener with a SOCKS5 listener. + +The change is designed to be transparent to calling code and implements +enough of RFC1928/RFC1929 such that pluggable transports can be written. + +Notable incompatibilities/limitations: + * GSSAPI authentication is not supported. + * BND.ADDR/BND.PORT in responses is always "0.0.0.0:0" instead of the + bound address/port of the outgoing socket. + * RFC1929 Username/Password authentication is setup exclusively for + pluggable transport arguments. + * The BIND and UDP ASSOCIATE commands are not supported. +--- + pt.go | 5 +- + socks.go | 386 +++++++++++++++++++++++++++++++++++++------- + socks_test.go | 510 +++++++++++++++++++++++++++++++++++++++++----------------- + 3 files changed, 685 insertions(+), 216 deletions(-) + +diff --git a/pt.go b/pt.go +index 62dfc38..47f8273 100644 +--- a/pt.go ++++ b/pt.go +@@ -119,10 +119,11 @@ + // Extended ORPort Authentication: + // https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/217-ext-orpo…. + // +-// The package implements a SOCKS4a server sufficient for a Tor client transport ++// The package implements a SOCKS5 server sufficient for a Tor client transport + // plugin. + // +-// http://ftp.icm.edu.pl/packages/socks/socks4/SOCKS4.protocol ++// https://www.ietf.org/rfc/rfc1928.txt ++// https://www.ietf.org/rfc/rfc1929.txt + package pt + + import ( +diff --git a/socks.go b/socks.go +index 6ad6542..e4488e8 100644 +--- a/socks.go ++++ b/socks.go +@@ -9,11 +9,40 @@ import ( + ) + + const ( +- socksVersion = 0x04 +- socksCmdConnect = 0x01 +- socksResponseVersion = 0x00 +- socksRequestGranted = 0x5a +- socksRequestRejected = 0x5b ++ socksVersion = 0x05 ++ ++ socksAuthNoneRequired = 0x00 ++ socksAuthUsernamePassword = 0x02 ++ socksAuthNoAcceptableMethods = 0xff ++ ++ socksCmdConnect = 0x01 ++ socksRsv = 0x00 ++ ++ socksAtypeV4 = 0x01 ++ socksAtypeDomainName = 0x03 ++ socksAtypeV6 = 0x04 ++ ++ socksAuthRFC1929Ver = 0x01 ++ socksAuthRFC1929Success = 0x00 ++ socksAuthRFC1929Fail = 0x01 ++ ++ socksRepSucceeded = 0x00 ++ // "general SOCKS server failure" ++ SocksRepGeneralFailure = 0x01 ++ // "connection not allowed by ruleset" ++ SocksRepConnectionNotAllowed = 0x02 ++ // "Network unreachable" ++ SocksRepNetworkUnreachable = 0x03 ++ // "Host unreachable" ++ SocksRepHostUnreachable = 0x04 ++ // "Connection refused" ++ SocksRepConnectionRefused = 0x05 ++ // "TTL expired" ++ SocksRepTTLExpired = 0x06 ++ // "Command not supported" ++ SocksRepCommandNotSupported = 0x07 ++ // "Address type not supported" ++ SocksRepAddressNotSupported = 0x08 + ) + + // Put a sanity timeout on how long we wait for a SOCKS request. +@@ -25,6 +54,8 @@ type SocksRequest struct { + Target string + // The userid string sent by the client. + Username string ++ // The password string sent by the client. ++ Password string + // The parsed contents of Username as a key–value mapping. + Args Args + } +@@ -36,15 +67,23 @@ type SocksConn struct { + } + + // Send a message to the proxy client that access to the given address is +-// granted. If the IP field inside addr is not an IPv4 address, the IP portion +-// of the response will be four zero bytes. ++// granted. Addr is ignored, and "0.0.0.0:0" is always sent back for ++// BND.ADDR/BND.PORT in the SOCKS response. + func (conn *SocksConn) Grant(addr *net.TCPAddr) error { +- return sendSocks4aResponseGranted(conn, addr) ++ return sendSocks5ResponseGranted(conn) + } + +-// Send a message to the proxy client that access was rejected or failed. ++// Send a message to the proxy client that access was rejected or failed. This ++// sends back a "General Failure" error code. RejectReason should be used if ++// more specific error reporting is desired. + func (conn *SocksConn) Reject() error { +- return sendSocks4aResponseRejected(conn) ++ return conn.RejectReason(SocksRepGeneralFailure) ++} ++ ++// Send a message to the proxy client that access was rejected, with the ++// specific error code indicating the reason behind the rejection. ++func (conn *SocksConn) RejectReason(reason byte) error { ++ return sendSocks5ResponseRejected(conn, reason) + } + + // SocksListener wraps a net.Listener in order to read a SOCKS request on Accept. +@@ -138,7 +177,7 @@ func (ln *SocksListener) AcceptSocks() (*SocksConn, error) { + if err != nil { + return nil, err + } +- conn.Req, err = readSocks4aConnect(conn) ++ conn.Req, err = socks5Handshake(conn) + if err != nil { + conn.Close() + return nil, err +@@ -150,58 +189,251 @@ func (ln *SocksListener) AcceptSocks() (*SocksConn, error) { + return conn, nil + } + +-// Returns "socks4", suitable to be included in a call to Cmethod. ++// Returns "socks5", suitable to be included in a call to Cmethod. + func (ln *SocksListener) Version() string { +- return "socks4" ++ return "socks5" + } + +-// Read a SOCKS4a connect request. Returns a SocksRequest. +-func readSocks4aConnect(s io.Reader) (req SocksRequest, err error) { +- r := bufio.NewReader(s) ++// socks5handshake conducts the SOCKS5 handshake up to the point where the ++// client command is read and the proxy must open the outgoing connection. ++// Returns a SocksRequest. ++func socks5Handshake(s io.ReadWriter) (req SocksRequest, err error) { ++ rw := bufio.NewReadWriter(bufio.NewReader(s), bufio.NewWriter(s)) + +- var h [8]byte +- _, err = io.ReadFull(r, h[:]) +- if err != nil { ++ // Negotiate the authentication method. ++ var method byte ++ if method, err = socksNegotiateAuth(rw); err != nil { + return + } +- if h[0] != socksVersion { +- err = fmt.Errorf("SOCKS header had version 0x%02x, not 0x%02x", h[0], socksVersion) ++ ++ // Authenticate the client. ++ if err = socksAuthenticate(rw, method, &req); err != nil { + return + } +- if h[1] != socksCmdConnect { +- err = fmt.Errorf("SOCKS header had command 0x%02x, not 0x%02x", h[1], socksCmdConnect) ++ ++ // Read the command. ++ err = socksReadCommand(rw, &req) ++ return ++} ++ ++// socksNegotiateAuth negotiates the authentication method and returns the ++// selected method as a byte. On negotiation failures an error is returned. ++func socksNegotiateAuth(rw *bufio.ReadWriter) (method byte, err error) { ++ // Validate the version. ++ if err = socksReadByteVerify(rw, "version", socksVersion); err != nil { + return + } + +- var usernameBytes []byte +- usernameBytes, err = r.ReadBytes('\x00') +- if err != nil { ++ // Read the number of methods. ++ var nmethods byte ++ if nmethods, err = socksReadByte(rw); err != nil { + return + } +- req.Username = string(usernameBytes[:len(usernameBytes)-1]) + +- req.Args, err = parseClientParameters(req.Username) +- if err != nil { ++ // Read the methods. ++ var methods []byte ++ if methods, err = socksReadBytes(rw, int(nmethods)); err != nil { + return + } + +- var port int +- var host string ++ // Pick the most "suitable" method. ++ method = socksAuthNoAcceptableMethods ++ for _, m := range methods { ++ switch m { ++ case socksAuthNoneRequired: ++ // Pick Username/Password over None if the client happens to ++ // send both. ++ if method == socksAuthNoAcceptableMethods { ++ method = m ++ } ++ ++ case socksAuthUsernamePassword: ++ method = m ++ } ++ } ++ ++ // Send the negotiated method. ++ var msg [2]byte ++ msg[0] = socksVersion ++ msg[1] = method ++ if _, err = rw.Writer.Write(msg[:]); err != nil { ++ return ++ } ++ ++ if err = socksFlushBuffers(rw); err != nil { ++ return ++ } ++ return ++} ++ ++// socksAuthenticate authenticates the client via the chosen authentication ++// mechanism. ++func socksAuthenticate(rw *bufio.ReadWriter, method byte, req *SocksRequest) (err error) { ++ switch method { ++ case socksAuthNoneRequired: ++ // Straight into reading the connect. + +- port = int(h[2])<<8 | int(h[3])<<0 +- if h[4] == 0 && h[5] == 0 && h[6] == 0 && h[7] != 0 { +- var hostBytes []byte +- hostBytes, err = r.ReadBytes('\x00') +- if err != nil { ++ case socksAuthUsernamePassword: ++ if err = socksAuthRFC1929(rw, req); err != nil { + return + } +- host = string(hostBytes[:len(hostBytes)-1]) ++ ++ case socksAuthNoAcceptableMethods: ++ err = fmt.Errorf("SOCKS method select had no compatible methods") ++ return ++ ++ default: ++ err = fmt.Errorf("SOCKS method select picked a unsupported method 0x%02x", method) ++ return ++ } ++ ++ if err = socksFlushBuffers(rw); err != nil { ++ return ++ } ++ return ++} ++ ++// socksAuthRFC1929 authenticates the client via RFC 1929 username/password ++// auth. As a design decision any valid username/password is accepted as this ++// field is primarily used as an out-of-band argument passing mechanism for ++// pluggable transports. ++func socksAuthRFC1929(rw *bufio.ReadWriter, req *SocksRequest) (err error) { ++ sendErrResp := func() { ++ // Swallow the write/flush error here, we are going to close the ++ // connection and the original failure is more useful. ++ resp := []byte{socksAuthRFC1929Ver, socksAuthRFC1929Fail} ++ rw.Write(resp[:]) ++ socksFlushBuffers(rw) ++ } ++ ++ // Validate the fixed parts of the command message. ++ if err = socksReadByteVerify(rw, "auth version", socksAuthRFC1929Ver); err != nil { ++ sendErrResp() ++ return ++ } ++ ++ // Read the username. ++ var ulen byte ++ if ulen, err = socksReadByte(rw); err != nil { ++ return ++ } ++ if ulen < 1 { ++ sendErrResp() ++ err = fmt.Errorf("RFC1929 username with 0 length") ++ return ++ } ++ var uname []byte ++ if uname, err = socksReadBytes(rw, int(ulen)); err != nil { ++ return ++ } ++ req.Username = string(uname) ++ ++ // Read the password. ++ var plen byte ++ if plen, err = socksReadByte(rw); err != nil { ++ return ++ } ++ if plen < 1 { ++ sendErrResp() ++ err = fmt.Errorf("RFC1929 password with 0 length") ++ return ++ } ++ var passwd []byte ++ if passwd, err = socksReadBytes(rw, int(plen)); err != nil { ++ return ++ } ++ if !(plen == 1 && passwd[0] == 0x00) { ++ // tor will set the password to 'NUL' if there are no arguments. ++ req.Password = string(passwd) ++ } ++ ++ // Mash the username/password together and parse it as a pluggable ++ // transport argument string. ++ if req.Args, err = parseClientParameters(req.Username + req.Password); err != nil { ++ sendErrResp() + } else { +- host = net.IPv4(h[4], h[5], h[6], h[7]).String() ++ resp := []byte{socksAuthRFC1929Ver, socksAuthRFC1929Success} ++ _, err = rw.Write(resp[:]) ++ } ++ return ++} ++ ++// socksReadCommand reads a SOCKS5 client command and parses out the relevant ++// fields into a SocksRequest. Only CMD_CONNECT is supported. ++func socksReadCommand(rw *bufio.ReadWriter, req *SocksRequest) (err error) { ++ sendErrResp := func(reason byte) { ++ // Swallow errors that occur when writing/flushing the response, ++ // connection will be closed anyway. ++ sendSocks5ResponseRejected(rw, reason) ++ socksFlushBuffers(rw) ++ } ++ ++ // Validate the fixed parts of the command message. ++ if err = socksReadByteVerify(rw, "version", socksVersion); err != nil { ++ sendErrResp(SocksRepGeneralFailure) ++ return ++ } ++ if err = socksReadByteVerify(rw, "command", socksCmdConnect); err != nil { ++ sendErrResp(SocksRepCommandNotSupported) ++ return ++ } ++ if err = socksReadByteVerify(rw, "reserved", socksRsv); err != nil { ++ sendErrResp(SocksRepGeneralFailure) ++ return ++ } ++ ++ // Read the destination address/port. ++ // XXX: This should probably eventually send socks 5 error messages instead ++ // of rudely closing connections on invalid addresses. ++ var atype byte ++ if atype, err = socksReadByte(rw); err != nil { ++ return ++ } ++ var host string ++ switch atype { ++ case socksAtypeV4: ++ var addr []byte ++ if addr, err = socksReadBytes(rw, net.IPv4len); err != nil { ++ return ++ } ++ host = net.IPv4(addr[0], addr[1], addr[2], addr[3]).String() ++ ++ case socksAtypeDomainName: ++ var alen byte ++ if alen, err = socksReadByte(rw); err != nil { ++ return ++ } ++ if alen == 0 { ++ err = fmt.Errorf("SOCKS request had domain name with 0 length") ++ return ++ } ++ var addr []byte ++ if addr, err = socksReadBytes(rw, int(alen)); err != nil { ++ return ++ } ++ host = string(addr) ++ ++ case socksAtypeV6: ++ var rawAddr []byte ++ if rawAddr, err = socksReadBytes(rw, net.IPv6len); err != nil { ++ return ++ } ++ addr := make(net.IP, net.IPv6len) ++ copy(addr[:], rawAddr[:]) ++ host = fmt.Sprintf("[%s]", addr.String()) ++ ++ default: ++ sendErrResp(SocksRepAddressNotSupported) ++ err = fmt.Errorf("SOCKS request had unsupported address type 0x%02x", atype) ++ return + } ++ var rawPort []byte ++ if rawPort, err = socksReadBytes(rw, 2); err != nil { ++ return ++ } ++ port := int(rawPort[0])<<8 | int(rawPort[1])<<0 + +- if r.Buffered() != 0 { +- err = fmt.Errorf("%d bytes left after SOCKS header", r.Buffered()) ++ if err = socksFlushBuffers(rw); err != nil { + return + } + +@@ -209,34 +441,64 @@ func readSocks4aConnect(s io.Reader) (req SocksRequest, err error) { + return + } + +-// Send a SOCKS4a response with the given code and address. If the IP field +-// inside addr is not an IPv4 address, the IP portion of the response will be +-// four zero bytes. +-func sendSocks4aResponse(w io.Writer, code byte, addr *net.TCPAddr) error { +- var resp [8]byte +- resp[0] = socksResponseVersion ++// Send a SOCKS5 response with the given code. BND.ADDR/BND.PORT is always the ++// IPv4 address/port "0.0.0.0:0". ++func sendSocks5Response(w io.Writer, code byte) error { ++ resp := make([]byte, 4+4+2) ++ resp[0] = socksVersion + resp[1] = code +- resp[2] = byte((addr.Port >> 8) & 0xff) +- resp[3] = byte((addr.Port >> 0) & 0xff) +- ipv4 := addr.IP.To4() +- if ipv4 != nil { +- resp[4] = ipv4[0] +- resp[5] = ipv4[1] +- resp[6] = ipv4[2] +- resp[7] = ipv4[3] +- } ++ resp[2] = socksRsv ++ resp[3] = socksAtypeV4 ++ ++ // BND.ADDR/BND.PORT should be the address and port that the outgoing ++ // connection is bound to on the proxy, but Tor does not use this ++ // information, so all zeroes are sent. ++ + _, err := w.Write(resp[:]) + return err + } + +-var emptyAddr = net.TCPAddr{IP: net.IPv4(0, 0, 0, 0), Port: 0} ++// Send a SOCKS5 response code 0x00. ++func sendSocks5ResponseGranted(w io.Writer) error { ++ return sendSocks5Response(w, socksRepSucceeded) ++} + +-// Send a SOCKS4a response code 0x5a. +-func sendSocks4aResponseGranted(w io.Writer, addr *net.TCPAddr) error { +- return sendSocks4aResponse(w, socksRequestGranted, addr) ++// Send a SOCKS5 response with the provided failure reason. ++func sendSocks5ResponseRejected(w io.Writer, reason byte) error { ++ return sendSocks5Response(w, reason) + } + +-// Send a SOCKS4a response code 0x5b (with an all-zero address). +-func sendSocks4aResponseRejected(w io.Writer) error { +- return sendSocks4aResponse(w, socksRequestRejected, &emptyAddr) ++func socksFlushBuffers(rw *bufio.ReadWriter) error { ++ if err := rw.Writer.Flush(); err != nil { ++ return err ++ } ++ if rw.Reader.Buffered() > 0 { ++ return fmt.Errorf("%d bytes left after SOCKS message", rw.Reader.Buffered()) ++ } ++ return nil ++} ++ ++func socksReadByte(rw *bufio.ReadWriter) (byte, error) { ++ return rw.Reader.ReadByte() ++} ++ ++func socksReadBytes(rw *bufio.ReadWriter, n int) ([]byte, error) { ++ ret := make([]byte, n) ++ if _, err := io.ReadFull(rw.Reader, ret); err != nil { ++ return nil, err ++ } ++ return ret, nil + } ++ ++func socksReadByteVerify(rw *bufio.ReadWriter, descr string, expected byte) error { ++ val, err := socksReadByte(rw) ++ if err != nil { ++ return err ++ } ++ if val != expected { ++ return fmt.Errorf("SOCKS message field %s was 0x%02x, not 0x%02x", descr, val, expected) ++ } ++ return nil ++} ++ ++var _ net.Listener = (*SocksListener)(nil) +diff --git a/socks_test.go b/socks_test.go +index 18d141a..aa27d4c 100644 +--- a/socks_test.go ++++ b/socks_test.go +@@ -1,162 +1,368 @@ + package pt + + import ( ++ "bufio" + "bytes" ++ "encoding/hex" ++ "io" + "net" + "testing" + ) + +-func TestReadSocks4aConnect(t *testing.T) { +- badTests := [...][]byte{ +- []byte(""), +- // missing userid +- []byte("\x04\x01\x12\x34\x01\x02\x03\x04"), +- // missing \x00 after userid +- []byte("\x04\x01\x12\x34\x01\x02\x03\x04key=value"), +- // missing hostname +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00"), +- // missing \x00 after hostname +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00hostname"), +- // bad name–value mapping +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01userid\x00hostname\x00"), +- // bad version number +- []byte("\x03\x01\x12\x34\x01\x02\x03\x04\x00"), +- // BIND request +- []byte("\x04\x02\x12\x34\x01\x02\x03\x04\x00"), +- // SOCKS5 +- []byte("\x05\x01\x00"), +- } +- ipTests := [...]struct { +- input []byte +- addr net.TCPAddr +- userid string +- }{ +- { +- []byte("\x04\x01\x12\x34\x01\x02\x03\x04key=value\x00"), +- net.TCPAddr{IP: net.ParseIP("1.2.3.4"), Port: 0x1234}, +- "key=value", +- }, +- { +- []byte("\x04\x01\x12\x34\x01\x02\x03\x04\x00"), +- net.TCPAddr{IP: net.ParseIP("1.2.3.4"), Port: 0x1234}, +- "", +- }, +- } +- hostnameTests := [...]struct { +- input []byte +- target string +- userid string +- }{ +- { +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00hostname\x00"), +- "hostname:4660", +- "key=value", +- }, +- { +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01\x00hostname\x00"), +- "hostname:4660", +- "", +- }, +- { +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00\x00"), +- ":4660", +- "key=value", +- }, +- { +- []byte("\x04\x01\x12\x34\x00\x00\x00\x01\x00\x00"), +- ":4660", +- "", +- }, +- } +- +- for _, input := range badTests { +- var buf bytes.Buffer +- buf.Write(input) +- _, err := readSocks4aConnect(&buf) +- if err == nil { +- t.Errorf("%q unexpectedly succeeded", input) +- } +- } +- +- for _, test := range ipTests { +- var buf bytes.Buffer +- buf.Write(test.input) +- req, err := readSocks4aConnect(&buf) +- if err != nil { +- t.Errorf("%q unexpectedly returned an error: %s", test.input, err) +- } +- addr, err := net.ResolveTCPAddr("tcp", req.Target) +- if err != nil { +- t.Errorf("%q → target %q: cannot resolve: %s", test.input, +- req.Target, err) +- } +- if !tcpAddrsEqual(addr, &test.addr) { +- t.Errorf("%q → address %s (expected %s)", test.input, +- req.Target, test.addr.String()) +- } +- if req.Username != test.userid { +- t.Errorf("%q → username %q (expected %q)", test.input, +- req.Username, test.userid) +- } +- if req.Args == nil { +- t.Errorf("%q → unexpected nil Args from username %q", test.input, req.Username) +- } +- } +- +- for _, test := range hostnameTests { +- var buf bytes.Buffer +- buf.Write(test.input) +- req, err := readSocks4aConnect(&buf) +- if err != nil { +- t.Errorf("%q unexpectedly returned an error: %s", test.input, err) +- } +- if req.Target != test.target { +- t.Errorf("%q → target %q (expected %q)", test.input, +- req.Target, test.target) +- } +- if req.Username != test.userid { +- t.Errorf("%q → username %q (expected %q)", test.input, +- req.Username, test.userid) +- } +- if req.Args == nil { +- t.Errorf("%q → unexpected nil Args from username %q", test.input, req.Username) +- } +- } +-} +- +-func TestSendSocks4aResponse(t *testing.T) { +- tests := [...]struct { +- code byte +- addr net.TCPAddr +- expected []byte +- }{ +- { +- socksRequestGranted, +- net.TCPAddr{IP: net.ParseIP("1.2.3.4"), Port: 0x1234}, +- []byte("\x00\x5a\x12\x34\x01\x02\x03\x04"), +- }, +- { +- socksRequestRejected, +- net.TCPAddr{IP: net.ParseIP("1:2::3:4"), Port: 0x1234}, +- []byte("\x00\x5b\x12\x34\x00\x00\x00\x00"), +- }, +- } +- +- for _, test := range tests { +- var buf bytes.Buffer +- err := sendSocks4aResponse(&buf, test.code, &test.addr) +- if err != nil { +- t.Errorf("0x%02x %s unexpectedly returned an error: %s", test.code, &test.addr, err) +- } +- p := make([]byte, 1024) +- n, err := buf.Read(p) +- if err != nil { +- t.Fatal(err) +- } +- output := p[:n] +- if !bytes.Equal(output, test.expected) { +- t.Errorf("0x%02x %s → %v (expected %v)", +- test.code, &test.addr, output, test.expected) +- } ++// testReadWriter is a bytes.Buffer backed io.ReadWriter used for testing. The ++// Read and Write routines are to be used by the component being tested. Data ++// can be written to and read back via the writeHex and readHex routines. ++type testReadWriter struct { ++ readBuf bytes.Buffer ++ writeBuf bytes.Buffer ++} ++ ++func (c *testReadWriter) Read(buf []byte) (n int, err error) { ++ return c.readBuf.Read(buf) ++} ++ ++func (c *testReadWriter) Write(buf []byte) (n int, err error) { ++ return c.writeBuf.Write(buf) ++} ++ ++func (c *testReadWriter) writeHex(str string) (n int, err error) { ++ var buf []byte ++ if buf, err = hex.DecodeString(str); err != nil { ++ return ++ } ++ return c.readBuf.Write(buf) ++} ++ ++func (c *testReadWriter) readHex() string { ++ return hex.EncodeToString(c.writeBuf.Bytes()) ++} ++ ++func (c *testReadWriter) toBufio() *bufio.ReadWriter { ++ return bufio.NewReadWriter(bufio.NewReader(c), bufio.NewWriter(c)) ++} ++ ++func (c *testReadWriter) reset() { ++ c.readBuf.Reset() ++ c.writeBuf.Reset() ++} ++ ++// TestAuthInvalidVersion tests auth negotiation with an invalid version. ++func TestAuthInvalidVersion(t *testing.T) { ++ c := new(testReadWriter) ++ ++ // VER = 03, NMETHODS = 01, METHODS = [00] ++ c.writeHex("030100") ++ if _, err := socksNegotiateAuth(c.toBufio()); err == nil { ++ t.Error("socksNegotiateAuth(InvalidVersion) succeded") ++ } ++} ++ ++// TestAuthInvalidNMethods tests auth negotiaton with no methods. ++func TestAuthInvalidNMethods(t *testing.T) { ++ c := new(testReadWriter) ++ var err error ++ var method byte ++ ++ // VER = 05, NMETHODS = 00 ++ c.writeHex("0500") ++ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { ++ t.Error("socksNegotiateAuth(No Methods) failed:", err) ++ } ++ if method != socksAuthNoAcceptableMethods { ++ t.Error("socksNegotiateAuth(No Methods) picked unexpected method:", method) ++ } ++ if msg := c.readHex(); msg != "05ff" { ++ t.Error("socksNegotiateAuth(No Methods) invalid response:", msg) ++ } ++} ++ ++// TestAuthNoneRequired tests auth negotiaton with NO AUTHENTICATION REQUIRED. ++func TestAuthNoneRequired(t *testing.T) { ++ c := new(testReadWriter) ++ var err error ++ var method byte ++ ++ // VER = 05, NMETHODS = 01, METHODS = [00] ++ c.writeHex("050100") ++ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { ++ t.Error("socksNegotiateAuth(None) failed:", err) ++ } ++ if method != socksAuthNoneRequired { ++ t.Error("socksNegotiateAuth(None) unexpected method:", method) ++ } ++ if msg := c.readHex(); msg != "0500" { ++ t.Error("socksNegotiateAuth(None) invalid response:", msg) ++ } ++} ++ ++// TestAuthUsernamePassword tests auth negotiation with USERNAME/PASSWORD. ++func TestAuthUsernamePassword(t *testing.T) { ++ c := new(testReadWriter) ++ var err error ++ var method byte ++ ++ // VER = 05, NMETHODS = 01, METHODS = [02] ++ c.writeHex("050102") ++ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { ++ t.Error("socksNegotiateAuth(UsernamePassword) failed:", err) ++ } ++ if method != socksAuthUsernamePassword { ++ t.Error("socksNegotiateAuth(UsernamePassword) unexpected method:", method) ++ } ++ if msg := c.readHex(); msg != "0502" { ++ t.Error("socksNegotiateAuth(UsernamePassword) invalid response:", msg) + } + } ++ ++// TestAuthBoth tests auth negotiation containing both NO AUTHENTICATION ++// REQUIRED and USERNAME/PASSWORD. ++func TestAuthBoth(t *testing.T) { ++ c := new(testReadWriter) ++ var err error ++ var method byte ++ ++ // VER = 05, NMETHODS = 02, METHODS = [00, 02] ++ c.writeHex("05020002") ++ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { ++ t.Error("socksNegotiateAuth(Both) failed:", err) ++ } ++ if method != socksAuthUsernamePassword { ++ t.Error("socksNegotiateAuth(Both) unexpected method:", method) ++ } ++ if msg := c.readHex(); msg != "0502" { ++ t.Error("socksNegotiateAuth(Both) invalid response:", msg) ++ } ++} ++ ++// TestAuthUnsupported tests auth negotiation with a unsupported method. ++func TestAuthUnsupported(t *testing.T) { ++ c := new(testReadWriter) ++ var err error ++ var method byte ++ ++ // VER = 05, NMETHODS = 01, METHODS = [01] (GSSAPI) ++ c.writeHex("050101") ++ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { ++ t.Error("socksNegotiateAuth(Unknown) failed:", err) ++ } ++ if method != socksAuthNoAcceptableMethods { ++ t.Error("socksNegotiateAuth(Unknown) picked unexpected method:", method) ++ } ++ if msg := c.readHex(); msg != "05ff" { ++ t.Error("socksNegotiateAuth(Unknown) invalid response:", msg) ++ } ++} ++ ++// TestAuthUnsupported2 tests auth negotiation with supported and unsupported ++// methods. ++func TestAuthUnsupported2(t *testing.T) { ++ c := new(testReadWriter) ++ var err error ++ var method byte ++ ++ // VER = 05, NMETHODS = 03, METHODS = [00,01,02] ++ c.writeHex("0503000102") ++ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { ++ t.Error("socksNegotiateAuth(Unknown2) failed:", err) ++ } ++ if method != socksAuthUsernamePassword { ++ t.Error("socksNegotiateAuth(Unknown2) picked unexpected method:", method) ++ } ++ if msg := c.readHex(); msg != "0502" { ++ t.Error("socksNegotiateAuth(Unknown2) invalid response:", msg) ++ } ++} ++ ++// TestRFC1929InvalidVersion tests RFC1929 auth with an invalid version. ++func TestRFC1929InvalidVersion(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 03, ULEN = 5, UNAME = "ABCDE", PLEN = 5, PASSWD = "abcde" ++ c.writeHex("03054142434445056162636465") ++ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { ++ t.Error("socksAuthenticate(InvalidVersion) succeded") ++ } ++ if msg := c.readHex(); msg != "0101" { ++ t.Error("socksAuthenticate(InvalidVersion) invalid response:", msg) ++ } ++} ++ ++// TestRFC1929InvalidUlen tests RFC1929 auth with an invalid ULEN. ++func TestRFC1929InvalidUlen(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 01, ULEN = 0, UNAME = "", PLEN = 5, PASSWD = "abcde" ++ c.writeHex("0100056162636465") ++ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { ++ t.Error("socksAuthenticate(InvalidUlen) succeded") ++ } ++ if msg := c.readHex(); msg != "0101" { ++ t.Error("socksAuthenticate(InvalidUlen) invalid response:", msg) ++ } ++} ++ ++// TestRFC1929InvalidPlen tests RFC1929 auth with an invalid PLEN. ++func TestRFC1929InvalidPlen(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 01, ULEN = 5, UNAME = "ABCDE", PLEN = 0, PASSWD = "" ++ c.writeHex("0105414243444500") ++ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { ++ t.Error("socksAuthenticate(InvalidPlen) succeded") ++ } ++ if msg := c.readHex(); msg != "0101" { ++ t.Error("socksAuthenticate(InvalidPlen) invalid response:", msg) ++ } ++} ++ ++// TestRFC1929InvalidArgs tests RFC1929 auth with invalid pt args. ++func TestRFC1929InvalidPTArgs(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 01, ULEN = 5, UNAME = "ABCDE", PLEN = 5, PASSWD = "abcde" ++ c.writeHex("01054142434445056162636465") ++ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { ++ t.Error("socksAuthenticate(InvalidArgs) succeded") ++ } ++ if msg := c.readHex(); msg != "0101" { ++ t.Error("socksAuthenticate(InvalidArgs) invalid response:", msg) ++ } ++} ++ ++// TestRFC1929Success tests RFC1929 auth with valid pt args. ++func TestRFC1929Success(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 01, ULEN = 9, UNAME = "key=value", PLEN = 1, PASSWD = "\0" ++ c.writeHex("01096b65793d76616c75650100") ++ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err != nil { ++ t.Error("socksAuthenticate(Success) failed:", err) ++ } ++ if msg := c.readHex(); msg != "0100" { ++ t.Error("socksAuthenticate(Success) invalid response:", msg) ++ } ++ v, ok := req.Args.Get("key") ++ if v != "value" || !ok { ++ t.Error("RFC1929 k,v parse failure:", v) ++ } ++} ++ ++// TestRequestInvalidHdr tests SOCKS5 requests with invalid VER/CMD/RSV/ATYPE ++func TestRequestInvalidHdr(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 03, CMD = 01, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 ++ c.writeHex("030100017f000001235a") ++ if err := socksReadCommand(c.toBufio(), &req); err == nil { ++ t.Error("socksReadCommand(InvalidVer) succeded") ++ } ++ if msg := c.readHex(); msg != "05010001000000000000" { ++ t.Error("socksReadCommand(InvalidVer) invalid response:", msg) ++ } ++ c.reset() ++ ++ // VER = 05, CMD = 05, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 ++ c.writeHex("050500017f000001235a") ++ if err := socksReadCommand(c.toBufio(), &req); err == nil { ++ t.Error("socksReadCommand(InvalidCmd) succeded") ++ } ++ if msg := c.readHex(); msg != "05070001000000000000" { ++ t.Error("socksReadCommand(InvalidCmd) invalid response:", msg) ++ } ++ c.reset() ++ ++ // VER = 05, CMD = 01, RSV = 30, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 ++ c.writeHex("050130017f000001235a") ++ if err := socksReadCommand(c.toBufio(), &req); err == nil { ++ t.Error("socksReadCommand(InvalidRsv) succeded") ++ } ++ if msg := c.readHex(); msg != "05010001000000000000" { ++ t.Error("socksReadCommand(InvalidRsv) invalid response:", msg) ++ } ++ c.reset() ++ ++ // VER = 05, CMD = 01, RSV = 01, ATYPE = 05, DST.ADDR = 127.0.0.1, DST.PORT = 9050 ++ c.writeHex("050100057f000001235a") ++ if err := socksReadCommand(c.toBufio(), &req); err == nil { ++ t.Error("socksReadCommand(InvalidAtype) succeded") ++ } ++ if msg := c.readHex(); msg != "05080001000000000000" { ++ t.Error("socksAuthenticate(InvalidAtype) invalid response:", msg) ++ } ++ c.reset() ++} ++ ++// TestRequestIPv4 tests IPv4 SOCKS5 requests. ++func TestRequestIPv4(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 05, CMD = 01, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 ++ c.writeHex("050100017f000001235a") ++ if err := socksReadCommand(c.toBufio(), &req); err != nil { ++ t.Error("socksReadCommand(IPv4) failed:", err) ++ } ++ addr, err := net.ResolveTCPAddr("tcp", req.Target) ++ if err != nil { ++ t.Error("net.ResolveTCPAddr failed:", err) ++ } ++ if !tcpAddrsEqual(addr, &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 9050}) { ++ t.Error("Unexpected target:", addr) ++ } ++} ++ ++// TestRequestIPv6 tests IPv4 SOCKS5 requests. ++func TestRequestIPv6(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 05, CMD = 01, RSV = 00, ATYPE = 04, DST.ADDR = 0102:0304:0506:0708:090a:0b0c:0d0e:0f10, DST.PORT = 9050 ++ c.writeHex("050100040102030405060708090a0b0c0d0e0f10235a") ++ if err := socksReadCommand(c.toBufio(), &req); err != nil { ++ t.Error("socksReadCommand(IPv6) failed:", err) ++ } ++ addr, err := net.ResolveTCPAddr("tcp", req.Target) ++ if err != nil { ++ t.Error("net.ResolveTCPAddr failed:", err) ++ } ++ if !tcpAddrsEqual(addr, &net.TCPAddr{IP: net.ParseIP("0102:0304:0506:0708:090a:0b0c:0d0e:0f10"), Port: 9050}) { ++ t.Error("Unexpected target:", addr) ++ } ++} ++ ++// TestRequestFQDN tests FQDN (DOMAINNAME) SOCKS5 requests. ++func TestRequestFQDN(t *testing.T) { ++ c := new(testReadWriter) ++ var req SocksRequest ++ ++ // VER = 05, CMD = 01, RSV = 00, ATYPE = 04, DST.ADDR = example.com, DST.PORT = 9050 ++ c.writeHex("050100030b6578616d706c652e636f6d235a") ++ if err := socksReadCommand(c.toBufio(), &req); err != nil { ++ t.Error("socksReadCommand(FQDN) failed:", err) ++ } ++ if req.Target != "example.com:9050" { ++ t.Error("Unexpected target:", req.Target) ++ } ++} ++ ++// TestResponseNil tests nil address SOCKS5 responses. ++func TestResponseNil(t *testing.T) { ++ c := new(testReadWriter) ++ ++ b := c.toBufio() ++ if err := sendSocks5ResponseGranted(b); err != nil { ++ t.Error("sendSocks5ResponseGranted() failed:", err) ++ } ++ b.Flush() ++ if msg := c.readHex(); msg != "05000001000000000000" { ++ t.Error("sendSocks5ResponseGranted(nil) invalid response:", msg) ++ } ++} ++ ++var _ io.ReadWriter = (*testReadWriter)(nil) +-- +2.3.3 + [View Less]

1 0

[tor-browser-bundle/master] Bug 15265: Pull in golang.org/x/net
by gk＠torproject.org 23 Mar '15

23 Mar '15

commit 474bbb5e54acae925a849e77b8ef590e58ee0820 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Sat Mar 21 14:34:06 2015 +0000 Bug 15265: Pull in golang.org/x/net The new official home for "go.net" is on golang.org, which also uses git instead of hg (yay!). As of the *next* obfs4proxy release the old go.net tarball stuff can be ripped out (leaving it in for the while). --- gitian/descriptors/linux/gitian-pluggable-transports.yml | 12 +++++++++++- … [View More]

1 0