- tbb-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] Bump OpenSSL version to 1.0.1t
by gk＠torproject.org 23 May '16

23 May '16

commit fa1a28524e54632c4d434908a1931d8f2ab30764 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 23 10:47:47 2016 +0000 Bump OpenSSL version to 1.0.1t --- gitian/versions.alpha | 4 ++-- gitian/versions.nightly | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index b9239dc..99e47ea 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -48,7 +48,7 @@ NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 GITIAN_TAG=tor-browser-builder-4-1 -OPENSSL_VER=1.0.1s +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -98,7 +98,7 @@ NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 9ff7e8f..86ee3f8 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -52,7 +52,7 @@ SELFRANDO_TAG=8e49e7aa664625d8e4793579864231b151589d0f GITIAN_TAG=tor-browser-builder-4 -OPENSSL_VER=1.0.1s +OPENSSL_VER=1.0.1t GMP_VER=5.1.3 FIREFOX_LANG_VER=$FIREFOX_VERSION FIREFOX_LANG_BUILD=build1 @@ -104,7 +104,7 @@ NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs -OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 +OPENSSL_HASH=4a6ee491a2fdb22e519c76fdc2a628bb3cec12762cd456861d207996c8a07088 GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=da77bb0003fcca5ea8c4e8cb2da8828ded750c54afdcac29ec6f3b46ad5e3adf OSXSDK_OLD_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc

1 0

[tor-browser-bundle/master] Bug 18904: Update meek-http-helper profile on OS X
by gk＠torproject.org 23 May '16

23 May '16

commit b53cdc44638e7074a0433abf268ab101d4cd6b47 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 23 10:36:17 2016 +0000 Bug 18904: Update meek-http-helper profile on OS X This commit bumps the meek tag to 0.22-18371-3 which is including the changes on the pluggable transport side that are necessary to fix #18904. --- gitian/versions.alpha | 2 +- gitian/versions.nightly | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index f2023f0..c84324c 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -33,7 +33,7 @@ FTEPROXY_TAG=597f8378f6f4f3de570b8e1064c2e4cb8d67fbd0 # tag 0.2.19 LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0.2 GOPTLIB_TAG=0.5 -MEEK_TAG=0.22-18371-2 +MEEK_TAG=0.22-18371-3 FAKETIME_TAG=70aa6b394d9341522dffe8a5a5cf5929e82cc6b9 # unsigned v0.9.6 GOED25519_TAG=c4161f4c7483313562781c61b9a20aba73daf9de GOSIPHASH_TAG=42ba037e748c9062a75e0924705c43b893edefcd diff --git a/gitian/versions.nightly b/gitian/versions.nightly index cbc0a92..b97ed7c 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -40,7 +40,7 @@ FTEPROXY_TAG=master LIBDMG_TAG=dfd5e5cc3dc1191e37d3c3a6118975afdd1d7014 TXSOCKSX_TAG=216eb0894a1755872f4789f9458aa6cf543b8433 # unsigned habnabit/1.13.0.2 GOPTLIB_TAG=master -MEEK_TAG=0.22-18371-2 #master +MEEK_TAG=0.22-18371-3 #master FAKETIME_TAG=70aa6b394d9341522dffe8a5a5cf5929e82cc6b9 # unsigned v0.9.6 GOED25519_TAG=c4161f4c7483313562781c61b9a20aba73daf9de GOSIPHASH_TAG=42ba037e748c9062a75e0924705c43b893edefcd

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 19121: reinstate the update.xml hash check
by gk＠torproject.org 20 May '16

20 May '16

commit c179270e049f085ec8ae1ad443dd1b1fe1084728 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Fri May 20 11:08:51 2016 -0400 Bug 19121: reinstate the update.xml hash check This is a partial revert of commit f1241db6986e4b54473a1ed870f7584c75d51122. Revert most changes from Mozilla Bug 862173 "don't verify mar file hash when using mar signing to verify the mar file (lessens main thread I/O)." We kept the addition to the AppConstants API in case other JS code references it in the future. --- toolkit/mozapps/update/nsUpdateService.js | 7 ------- .../chrome/test_0061_check_verifyFailPartial_noComplete.xul | 4 ++-- .../chrome/test_0062_check_verifyFailComplete_noPartial.xul | 4 ++-- .../tests/chrome/test_0063_check_verifyFailPartialComplete.xul | 6 +++--- .../test_0064_check_verifyFailPartial_successComplete.xul | 4 ++-- .../chrome/test_0071_notify_verifyFailPartial_noComplete.xul | 4 ++-- .../chrome/test_0072_notify_verifyFailComplete_noPartial.xul | 4 ++-- .../chrome/test_0073_notify_verifyFailPartialComplete.xul | 6 +++--- .../test_0074_notify_verifyFailPartial_successComplete.xul | 4 ++-- .../chrome/test_0084_error_patchApplyFailure_verify_failed.xul | 2 +- toolkit/mozapps/update/tests/chrome/update.sjs | 10 +++++----- .../update/tests/unit_aus_update/downloadAndHashCheckMar.js | 8 +------- 12 files changed, 25 insertions(+), 38 deletions(-) diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js index e12636d..4495210 100644 --- a/toolkit/mozapps/update/nsUpdateService.js +++ b/toolkit/mozapps/update/nsUpdateService.js @@ -3714,13 +3714,6 @@ Downloader.prototype = { } LOG("Downloader:_verifyDownload downloaded size == expected size."); - - // The hash check is not necessary when mar signatures are used to verify - // the downloaded mar file. - if (AppConstants.MOZ_VERIFY_MAR_SIGNATURE) { - return true; - } - let fileStream = Cc["@mozilla.org/network/file-input-stream;1"]. createInstance(Ci.nsIFileInputStream); fileStream.init(destination, FileUtils.MODE_RDONLY, FileUtils.PERMS_FILE, 0); diff --git a/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul index ba2347c..fe877ee 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0061_check_verifyFailPartial_noComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and errors (partial patch with an invalid size)" +<window title="Update Wizard pages: update check, basic, download, and errors (partial patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -35,7 +35,7 @@ function runTest() { debugDump("entering"); let url = URL_HTTP_UPDATE_XML + "?showDetails=1&partialPatchOnly=1" + - "&invalidPartialSize=1" + getVersionParams(); + "&invalidPartialHash=1" + getVersionParams(); setUpdateURLOverride(url); gUP.checkForUpdates(); diff --git a/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul b/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul index 731a258..39c63c6 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0062_check_verifyFailComplete_noPartial.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and errors (complete patch with an invalid size)" +<window title="Update Wizard pages: update check, basic, download, and errors (complete patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -35,7 +35,7 @@ function runTest() { debugDump("entering"); let url = URL_HTTP_UPDATE_XML + "?showDetails=1&completePatchOnly=1" + - "&invalidCompleteSize=1" + getVersionParams(); + "&invalidCompleteHash=1" + getVersionParams(); setUpdateURLOverride(url); gUP.checkForUpdates(); diff --git a/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul index 65071bc..16ec709 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0063_check_verifyFailPartialComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and errors (partial and complete patches with invalid sizes)" +<window title="Update Wizard pages: update check, basic, download, and errors (partial and complete patches with invalid hashes)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -34,8 +34,8 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialSize=1" + - "&invalidCompleteSize=1" + getVersionParams(); + let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialHash=1" + + "&invalidCompleteHash=1" + getVersionParams(); setUpdateURLOverride(url); gUP.checkForUpdates(); diff --git a/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul index 6bb0eb8..73b9351 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0064_check_verifyFailPartial_successComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: update check, basic, download, and finished (partial patch with an invalid size and successful complete patch)" +<window title="Update Wizard pages: update check, basic, download, and finished (partial patch with an invalid hash and successful complete patch)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -34,7 +34,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialSize=1" + + let url = URL_HTTP_UPDATE_XML + "?showDetails=1&invalidPartialHash=1" + getVersionParams(); setUpdateURLOverride(url); diff --git a/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul index 8c09a67..ce087a9 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0071_notify_verifyFailPartial_noComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: errors (partial patch with an invalid size)" +<window title="Update Wizard pages: errors (partial patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,7 +27,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("partial", null, null, null, "1234", null, + let patches = getLocalPatchString("partial", null, null, "1234", null, null, STATE_DOWNLOADING); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul b/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul index 67f4556..01f4a2c 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0072_notify_verifyFailComplete_noPartial.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: errors (complete patch with an invalid size)" +<window title="Update Wizard pages: errors (complete patch with an invalid hash)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,7 +27,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("complete", null, null, null, "1234", null, + let patches = getLocalPatchString("complete", null, null, "1234", null, null, STATE_DOWNLOADING); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul index 8e9814e..ffa8048 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0073_notify_verifyFailPartialComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: errors (partial and complete patches with invalid sizes)" +<window title="Update Wizard pages: errors (partial and complete patches with invalid hashes)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,9 +27,9 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("partial", null, null, null, "1234", null, + let patches = getLocalPatchString("partial", null, null, "1234", null, null, STATE_DOWNLOADING) + - getLocalPatchString("complete", null, null, null, "1234", + getLocalPatchString("complete", null, null, "1234", null, "false"); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul b/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul index 1f5799e..708c6bf 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0074_notify_verifyFailPartial_successComplete.xul @@ -8,7 +8,7 @@ <?xml-stylesheet href="chrome://global/skin" type="text/css"?> <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?> -<window title="Update Wizard pages: finishedBackground (partial patch with an invalid size and successful complete patch)" +<window title="Update Wizard pages: finishedBackground (partial patch with an invalid hash and successful complete patch)" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="runTestDefault();"> <script type="application/javascript" @@ -27,7 +27,7 @@ const TESTS = [ { function runTest() { debugDump("entering"); - let patches = getLocalPatchString("partial", null, null, null, "1234", null, + let patches = getLocalPatchString("partial", null, null, "1234", null, null, STATE_DOWNLOADING) + getLocalPatchString("complete", null, null, null, null, "false"); diff --git a/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul b/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul index 6b742ad..8861e24 100644 --- a/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul +++ b/toolkit/mozapps/update/tests/chrome/test_0084_error_patchApplyFailure_verify_failed.xul @@ -42,7 +42,7 @@ function runTest() { let patches = getLocalPatchString("partial", null, null, null, null, null, STATE_PENDING) + getLocalPatchString("complete", slowDownloadURL, "MD5", - null, "1234", + "1234cd43a1c77e30191c53a329a3f99d", null, "false"); let updates = getLocalUpdateString(patches, null, null, null, Services.appinfo.version, diff --git a/toolkit/mozapps/update/tests/chrome/update.sjs b/toolkit/mozapps/update/tests/chrome/update.sjs index e054384..0f1e6ac 100644 --- a/toolkit/mozapps/update/tests/chrome/update.sjs +++ b/toolkit/mozapps/update/tests/chrome/update.sjs @@ -112,18 +112,18 @@ function handleRequest(aRequest, aResponse) { return; } - let size; + let hash; let patches = ""; if (!params.partialPatchOnly) { - size = SIZE_SIMPLE_MAR + (params.invalidCompleteSize ? "1" : ""); + hash = SHA512_HASH_SIMPLE_MAR + (params.invalidCompleteHash ? "e" : ""); patches += getRemotePatchString("complete", SERVICE_URL, "SHA512", - SHA512_HASH_SIMPLE_MAR, size); + hash, SIZE_SIMPLE_MAR); } if (!params.completePatchOnly) { - size = SIZE_SIMPLE_MAR + (params.invalidPartialSize ? "1" : ""); + hash = SHA512_HASH_SIMPLE_MAR + (params.invalidPartialHash ? "e" : ""); patches += getRemotePatchString("partial", SERVICE_URL, "SHA512", - SHA512_HASH_SIMPLE_MAR, size); + hash, SIZE_SIMPLE_MAR); } let type = params.type ? params.type : "major"; diff --git a/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js b/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js index 8727e37..c6b2f81 100644 --- a/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js +++ b/toolkit/mozapps/update/tests/unit_aus_update/downloadAndHashCheckMar.js @@ -23,13 +23,7 @@ function run_test() { // The mock XMLHttpRequest is MUCH faster overrideXHR(callHandleEvent); standardInit(); - // Only perform the non hash check tests when mar signing is enabled since the - // update service doesn't perform hash checks when mar signing is enabled. - if (IS_MAR_CHECKS_ENABLED) { - do_execute_soon(run_test_pt11); - } else { - do_execute_soon(run_test_pt1); - } + do_execute_soon(run_test_pt1); } // The HttpServer must be stopped before calling do_test_finished

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18885: Disable possible logging of TLS key material
by gk＠torproject.org 18 May '16

18 May '16

commit f5c58c88029648b608d75cdb06d82b06f0d30953 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 17 18:30:08 2016 +0000 Bug 18885: Disable possible logging of TLS key material This is a backport of the bugfix for #1183318 (https://hg.mozilla.org/projects/nss/rev/68d0b829490f) This is working for us as we are building Tor Browser optimized for all the platforms we support. --- security/nss/lib/ssl/Makefile | 7 +++++++ security/nss/lib/ssl/ssl3con.c | 6 ++++++ security/nss/lib/ssl/sslsock.c | 6 ++++++ 3 files changed, 19 insertions(+) diff --git a/security/nss/lib/ssl/Makefile b/security/nss/lib/ssl/Makefile index d56cbf2..abf54c9 100644 --- a/security/nss/lib/ssl/Makefile +++ b/security/nss/lib/ssl/Makefile @@ -39,6 +39,13 @@ CSRCS += unix_err.c endif endif +# Enable key logging by default in debug builds, but not opt builds. +# Logging still needs to be enabled at runtime through env vars. +NSS_ALLOW_SSLKEYLOGFILE ?= $(if $(BUILD_OPT),0,1) +ifeq (1,$(NSS_ALLOW_SSLKEYLOGFILE)) +DEFINES += -DNSS_ALLOW_SSLKEYLOGFILE=1 +endif + ####################################################################### # (5) Execute "global" rules. (OPTIONAL) # ####################################################################### diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c index 8f1c547..ac57812 100644 --- a/security/nss/lib/ssl/ssl3con.c +++ b/security/nss/lib/ssl/ssl3con.c @@ -6029,6 +6029,7 @@ done: return unwrappedWrappingKey; } +#ifdef NSS_ALLOW_SSLKEYLOGFILE /* hexEncode hex encodes |length| bytes from |in| and writes it as |length*2| * bytes to |out|. */ static void @@ -6042,6 +6043,7 @@ hexEncode(char *out, const unsigned char *in, unsigned int length) *(out++) = hextable[in[i] & 15]; } } +#endif /* Called from ssl3_SendClientKeyExchange(). */ /* Presently, this always uses PKCS11. There is no bypass for this. */ @@ -6081,6 +6083,7 @@ sendRSAClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) goto loser; } +#ifdef NSS_ALLOW_SSLKEYLOGFILE if (ssl_keylog_iob) { SECStatus extractRV = PK11_ExtractKeyValue(pms); if (extractRV == SECSuccess) { @@ -6112,6 +6115,7 @@ sendRSAClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey) } } } +#endif rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, isTLS ? enc_pms.len + 2 : enc_pms.len); @@ -10989,6 +10993,7 @@ ssl3_SendNextProto(sslSocket *ss) static void ssl3_RecordKeyLog(sslSocket *ss) { +#ifdef NSS_ALLOW_SSLKEYLOGFILE SECStatus rv; SECItem *keyData; char buf[14 /* "CLIENT_RANDOM " */ + @@ -11039,6 +11044,7 @@ ssl3_RecordKeyLog(sslSocket *ss) return; fflush(ssl_keylog_iob); return; +#endif } /* called from ssl3_SendClientSecondRound diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c index f735009..de9a1315 100644 --- a/security/nss/lib/ssl/sslsock.c +++ b/security/nss/lib/ssl/sslsock.c @@ -118,7 +118,11 @@ int ssl_lock_readers = 1; /* default true. */ char ssl_debug; char ssl_trace; FILE * ssl_trace_iob; + +#ifdef NSS_ALLOW_SSLKEYLOGFILE FILE * ssl_keylog_iob; +#endif + char lockStatus[] = "Locks are ENABLED. "; #define LOCKSTATUS_OFFSET 10 /* offset of ENABLED */ @@ -3118,6 +3122,7 @@ ssl_SetDefaultsFromEnvironment(void) SSL_TRACE(("SSL: debugging set to %d", ssl_debug)); } #endif /* DEBUG */ +#ifdef NSS_ALLOW_SSLKEYLOGFILE ev = getenv("SSLKEYLOGFILE"); if (ev && ev[0]) { ssl_keylog_iob = fopen(ev, "a"); @@ -3131,6 +3136,7 @@ ssl_SetDefaultsFromEnvironment(void) SSL_TRACE(("SSL: logging SSL/TLS secrets to %s", ev)); } } +#endif #ifndef NO_PKCS11_BYPASS ev = getenv("SSLBYPASS"); if (ev && ev[0]) {

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 17 May '16

17 May '16

commit 0651282ea94c4dddcec724f0ea6c21aecfd6b942 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue May 17 14:08:43 2016 -0400 fixup! TB4: Tor Browser's Firefox preference overrides. Set the heartbeat URL to an empty string as a defense in depth measure and disable the UITour backend (bug 19047). --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 91542b7..f4f4bfe 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -78,7 +78,11 @@ pref("datareporting.healthreport.about.reportUrl", "data:text/plain,"); // Make sure Selfsupport and Unified Telemetry are really disabled, see: #18738. pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); pref("browser.selfsupport.enabled", false); +pref("browser.selfsupport.url", ""); pref("toolkit.telemetry.unified", false); +// Disable the UITour backend so there is no chance that a remote page +// can use it to confuse Tor Browser users. +pref("browser.uitour.enabled", false); pref("security.mixed_content.block_active_content", false); // Disable until https://bugzilla.mozilla.org/show_bug.cgi?id=878890 is patched pref("browser.syncPromoViewsLeftMap", "{\"addons\":0, \"passwords\":0, \"bookmarks\":0}"); // Don't promote sync pref("services.sync.engine.prefs", false); // Never sync prefs, addons, or tabs with other browsers

1 0

[tor-browser-bundle/hardened-builds] Bug 19065: Don't delete Tor Browser icons
by gk＠torproject.org 17 May '16

17 May '16

commit 48055f68ba9954c402760b91a5096f98d6720665 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 17 12:10:37 2016 +0000 Bug 19065: Don't delete Tor Browser icons Deleting the extracted chrome/en-US folder is good but we should not delete the whole chrome folder as it contains the Tor Browser icons. --- gitian/descriptors/linux/gitian-bundle.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index eca8d0f..3e8ae2e 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -187,7 +187,7 @@ script: | # For the proper search engines in our language packs unzip omni.ja chrome/en-US/locale/browser/searchplugins* mv chrome/en-US/locale/browser/searchplugins ~/build - rm -rf chrome + rm -rf chrome/en-US unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle.

1 0

[tor-browser-bundle/master] Bug 19065: Don't delete Tor Browser icons
by gk＠torproject.org 17 May '16

17 May '16

commit 091cb50929055718277fcede5f61c61504ab8b87 Author: Georg Koppen <gk(a)torproject.org> Date: Tue May 17 12:10:37 2016 +0000 Bug 19065: Don't delete Tor Browser icons Deleting the extracted chrome/en-US folder is good but we should not delete the whole chrome folder as it contains the Tor Browser icons. --- gitian/descriptors/linux/gitian-bundle.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index 39ad811..20315ec 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -197,7 +197,7 @@ script: | # For the proper search engines in our language packs unzip omni.ja chrome/en-US/locale/browser/searchplugins* mv chrome/en-US/locale/browser/searchplugins ~/build - rm -rf chrome + rm -rf chrome/en-US unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle.

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Regression tests for Bug 15646: Prevent keyboard layout fingerprinting in KeyboardEvent
by gk＠torproject.org 17 May '16

17 May '16

commit de5346adae7452c79820958873cf6eca473f537f Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Dec 22 12:35:17 2015 -0800 Regression tests for Bug 15646: Prevent keyboard layout fingerprinting in KeyboardEvent --- dom/events/test/mochitest.ini | 1 + dom/events/test/test_tor_bug15646.html | 159 +++++++++++++++++++++++++++++++++ 2 files changed, 160 insertions(+) diff --git a/dom/events/test/mochitest.ini b/dom/events/test/mochitest.ini index e23b950..e7fb89c 100644 --- a/dom/events/test/mochitest.ini +++ b/dom/events/test/mochitest.ini @@ -192,3 +192,4 @@ support-files = [test_bug1013412.html] skip-if = buildapp == 'b2g' # no wheel events on b2g [test_dom_activate_event.html] +[test_tor_bug15646.html] diff --git a/dom/events/test/test_tor_bug15646.html b/dom/events/test/test_tor_bug15646.html new file mode 100644 index 0000000..463781f --- /dev/null +++ b/dom/events/test/test_tor_bug15646.html @@ -0,0 +1,159 @@ +<!DOCTYPE HTML> +<html> + +<head> + <title>Test for Bug 15646</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="application/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://trac.torproject.org/15466">Tor Bug 15646</a> +<p id="display"></p> +<div id="content" style="display: none"> + +</div> +<pre id="test"> +</pre> +<span id="testTarget" style="border: 1px solid black;">testTarget</span> +<script type="application/javascript;version=1.7"> + SimpleTest.waitForExplicitFinish(); + let miscKeyData = [ + ["Alt", "AltLeft", 18], + ["ArrowDown", "ArrowDown", 40], + ["ArrowLeft", "ArrowLeft", 37], + ["ArrowRight", "ArrowRight", 39], + ["ArrowUp", "ArrowUp", 38], + ["Backspace", "Backspace", 8], + ["CapsLock", "CapsLock", 20], + ["ContextMenu", "ContextMenu", 93], + ["Control", "ControlLeft", 17], + ["Delete", "Delete", 46], + ["End", "End", 35], + ["Enter", "Enter", 13], + ["Escape", "Escape", 27], + ["Help", "Help", 6], + ["Home", "Home", 36], + ["Insert", "Insert", 45], + ["Meta", "OSLeft", 91], + ["PageDown", "PageDown", 34], + ["PageUp", "PageUp", 33], + ["Pause", "Pause", 19], + ["PrintScreen", "PrintScreen", 44], + ["ScrollLock", "ScrollLock", 145], + ["Shift", "ShiftLeft", 16], + ["Tab", "Tab", 9], + [" ", "Space", 32], + [",", "Comma", 188], + [".", "Period", 190], + ["/", "Slash", 191], + [";", "Semicolon", 59], + ["'", "Quote", 222], + ["[", "BracketLeft", 219], + ["]", "BracketRight", 221], + ["`", "Backquote", 192], + ["\\", "Backslash", 220], + ["-", "Minus", 173], + ["=", "Equal", 61], + ]; + let uppers = [], lowers = []; + for (let i = 65; i < 91; ++i) { + let upperChar = String.fromCharCode(i); + lowers.push([upperChar.toLowerCase(), "Key" + upperChar, i]); + uppers.push([upperChar, "Key" + upperChar, i]); + } + let fnKeys = []; + for (let i = 1; i < 25; ++i) { + let keyName = "F" + i, + keyCode = i + 111; + fnKeys.push([keyName, keyName, keyCode]); + } + let digits = []; + for (let i = 0; i < 10; ++i) { + let keyName = "" + i, + keyCode = 48 + i; + digits.push([keyName, "Digit" + keyName, keyCode]); + } + let allKeyData = miscKeyData.concat(lowers).concat(fnKeys).concat(digits); + let pushPref = function (key, value) { + return new Promise(resolve => { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); + }; + let miscShiftKeyData = [ + ["!", "Digit1", 49], + ["@", "Digit2", 50], + ["#", "Digit3", 51], + ["$", "Digit4", 52], + ["%", "Digit5", 53], + ["^", "Digit6", 54], + ["&", "Digit7", 55], + ["*", "Digit8", 56], + ["(", "Digit9", 57], + [")", "Digit0", 48], + ["<", "Comma", 188], + [">", "Period", 190], + ["?", "Slash", 191], + [":", "Semicolon", 59], + ["\"", "Quote", 222], + ["{", "BracketLeft", 219], + ["}", "BracketRight", 221], + ["~", "Backquote", 192], + ["|", "Backslash", 220], + ["_", "Minus", 173], + ["+", "Equal", 61], + ]; + let allShiftKeyData = miscShiftKeyData.concat(uppers); + + // __dispatchAndListen(target, eventObject)__. + // Dispatch the given event to the target object. + // Return a promise that resolves to the event when + // that event is received by an event listener. + let dispatchAndListen = function (target, eventObject) { + let eventType = eventObject.type; + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction); + resolve(event); + }; + target.addEventListener(eventType, listenFunction); + target.dispatchEvent(eventObject); + }); + }; + + // Run tests asynchronously. + spawnTask(function* () { + for (let keyData of [allKeyData, allShiftKeyData]) { + for (let resistFingerprinting of [false, true]) { + let expectedShiftKey = keyData === allShiftKeyData && resistFingerprinting; + yield pushPref("privacy.resistFingerprinting", resistFingerprinting); + for (let [keyName, code, keyCode] of keyData) { + let keyboardEvent = new KeyboardEvent("keydown", { key : keyName, altKey : true, location : 2 }); + let receivedEvent = yield dispatchAndListen(document.body, keyboardEvent); + let expectedKeyCode = resistFingerprinting ? keyCode : 0; + is(receivedEvent.keyCode, expectedKeyCode, + "Event.keyCode should be " + expectedKeyCode); + is(receivedEvent.shiftKey, expectedShiftKey, + "Event.shiftKey should be " + expectedShiftKey); + if (expectedShiftKey) { + ok(!receivedEvent.altKey, + "Alt should be suppressed for fake shift keys."); + } + if (resistFingerprinting) { + let expectedCode = code; + is(receivedEvent.code, expectedCode, + "Event.code should be " + expectedCode); + ok(receivedEvent.location === 0 || receivedEvent.location === 1, + "Event.location should be 0 or 1."); + } + } + } + } + SimpleTest.finish(); + }); + +</script> +</body> +</html>

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Regression tests for Bug 17009: Pref to suppress some modifier key events
by gk＠torproject.org 17 May '16

17 May '16

commit b815400e8aae371dcc55141d202ae96155c4c78d Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Dec 23 09:52:05 2015 -0800 Regression tests for Bug 17009: Pref to suppress some modifier key events --- dom/tests/browser/browser.ini | 2 + dom/tests/browser/browser_tor_bug17009.html | 8 +++ dom/tests/browser/browser_tor_bug17009.js | 98 +++++++++++++++++++++++++++++ 3 files changed, 108 insertions(+) diff --git a/dom/tests/browser/browser.ini b/dom/tests/browser/browser.ini index 363758e..bd07b47 100644 --- a/dom/tests/browser/browser.ini +++ b/dom/tests/browser/browser.ini @@ -2,6 +2,7 @@ skip-if = e10s # Bug ?????? - most of these tests fail for currently unknown reasons. support-files = browser_frame_elements.html + browser_tor_bug17009.html page_privatestorageevent.html position.html test-console-api.html @@ -44,3 +45,4 @@ disabled = re-enable when bug 794920 is fixed [browser_xhr_sandbox.js] skip-if= buildapp == 'mulet' [browser_bug1004814.js] +[browser_tor_bug17009.js] diff --git a/dom/tests/browser/browser_tor_bug17009.html b/dom/tests/browser/browser_tor_bug17009.html new file mode 100644 index 0000000..455d547 --- /dev/null +++ b/dom/tests/browser/browser_tor_bug17009.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<head> + <meta charset="utf-8"> + <title>Tor Bug 17009 tests</title> +</head> +<body> + Testing that Alt and Shift keydown/keyup events aren't detected in content. +</body> diff --git a/dom/tests/browser/browser_tor_bug17009.js b/dom/tests/browser/browser_tor_bug17009.js new file mode 100644 index 0000000..794baa4 --- /dev/null +++ b/dom/tests/browser/browser_tor_bug17009.js @@ -0,0 +1,98 @@ +"use strict"; + +/*jshint esnext:true */ + +const CONTENT_PAGE = "http://example.com/browser/dom/tests/browser/browser_tor_bug17009.html"; + +// __pushPref(key, value)__. +// Set the given pref to a value. Returns a promise +// that resolves asynchronously when the pref is +// successfully set. +let pushPref = function (key, value) { + return new Promise(resolve => { + SpecialPowers.pushPrefEnv({"set": [[key, value]]}, resolve); + }); +}; + +// __listen(target, eventType, useCapture)__. +// Returns a promise that resolves after a single event +// of eventType is received by the target. +let listen = function (target, eventType, useCapture) { + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction, useCapture); + resolve(event); + }; + target.addEventListener(eventType, listenFunction, useCapture); + }); +}; + +// __soon()__. +// Wait a little bit before we continue. Returns a promise. +let soon = function () { + return new Promise(resolve => executeSoon(resolve)); +}; + +// __runTests(contentWindow)__. +// The main tests. We test to make sure that, when +// "privacy.suppressModifierKeyEvents" is true, then content +// will not see Alt or Shift keydown or keyup events, +// but chrome will still see those events. +// If the pref is off, then both content and chrome +// should see all events. +let runTests = function* (contentWindow) { + // Check behavior for both non-resistance and resistance. + for (let resistFingerprinting of [false, true]) { + yield pushPref("privacy.resistFingerprinting", resistFingerprinting); + // Check behavior, both non-suppressing and suppressing. + for (let suppressModifiers of [false, true]) { + yield pushPref("privacy.suppressModifierKeyEvents", suppressModifiers); + // Check both keydown and keyup events. + for (let eventType of ["keydown", "keyup"]) { + // Check Alt and Shift keys. + for (let modifierKey of ["Alt", "Shift"]) { + // Listen for a single key event in the content window. + let contentEventPromise = listen(contentWindow, eventType, false); + // Listen for a single key event in the chrome window. + let chromeEventPromise = listen(window, eventType, false); + // Generate a Alt or Shift key event. + EventUtils.synthesizeKey("VK_" + modifierKey.toUpperCase(), + { type : eventType }, contentWindow); + // Generate a dummy "x" key event that will only be handled if + // modifier key is successfully suppressed. + EventUtils.synthesizeKey("x", { type: eventType }, contentWindow); + // Collect the events received in content and chrome. + let contentEvent = yield contentEventPromise; + let chromeEvent = yield chromeEventPromise; + // We should always see the modifier key in chrome, regardless of the + // pref state. + is(chromeEvent.key, modifierKey, + modifierKey + " key should be seen in chrome."); + // If and only if fingerprinting resistance is active and suppression + // is enabled, we should see the dummy "x" key; otherwise we expect + // to see the modifier key as usual. + let expectedContentKey = resistFingerprinting && suppressModifiers + ? "x" : modifierKey; + is(contentEvent.key, expectedContentKey, + expectedContentKey + " key should be seen in content."); + } + } + } + } +}; + +// Run tests asynchronously to make testing event handling straightforward. +add_task(function* () { + // Set up a content tab and select it. + let tab = gBrowser.addTab(CONTENT_PAGE), + browser = gBrowser.getBrowserForTab(tab); + gBrowser.selectedTab = tab; + + // Wait for tab to be completely loaded, then run the tests. + yield listen(browser, "DOMContentLoaded", false); + yield soon(); + yield runTests(gBrowser.contentWindow); + + // cleanup + gBrowser.removeTab(tab); +});

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18886: Hide pocket menu items when Pocket is disabled
by gk＠torproject.org 17 May '16

17 May '16

commit 320de5db6d53f53aadfad785ce31826b3080e890 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri May 13 21:42:18 2016 -0700 Bug 18886: Hide pocket menu items when Pocket is disabled If the user toggles the value of "browser.pocket.enabled", then menu items (and pocket button) will be affected only after browser restart. --- browser/base/content/browser-places.js | 9 ++++++++- browser/base/content/nsContextMenu.js | 4 +++- browser/modules/ReaderParent.jsm | 7 +++++-- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js index 7e3ddcc..45a3af6 100644 --- a/browser/base/content/browser-places.js +++ b/browser/base/content/browser-places.js @@ -1553,7 +1553,14 @@ var BookmarkingUI = { }, updatePocketItemVisibility: function BUI_updatePocketItemVisibility(prefix) { - let hidden = !CustomizableUI.getPlacementOfWidget("pocket-button"); + // When the pocket button has been placed on the navigation bar or + // on the hamburger menu, then Pocket can be considered "active" and + // we should show the pocket menu item in various places. + // If, on the other hand, the pocket button is not present because + // the user has moved it out of the nav bar, or the browser started + // up with "browser.pocket.enabled" set to false, then we + // should not show the pocket menu items. + let hidden = document.getElementById("pocket-button") == null; document.getElementById(prefix + "pocket").hidden = hidden; document.getElementById(prefix + "pocketSeparator").hidden = hidden; }, diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js index 463809f..be42f80 100644 --- a/browser/base/content/nsContextMenu.js +++ b/browser/base/content/nsContextMenu.js @@ -225,7 +225,9 @@ nsContextMenu.prototype = { this.isContentSelected || this.onImage || this.onCanvas || this.onVideo || this.onAudio); let targetURI = (this.onSaveableLink || this.onPlainTextLink) ? this.linkURI : this.browser.currentURI; - let canPocket = CustomizableUI.getPlacementOfWidget("pocket-button") && + // Pocket is only "active" if the pocket button is present on the + // navigation bar or hamburger menu. + let canPocket = (document.getElementById("pocket-button") !== null) && window.pktApi && window.pktApi.isUserLoggedIn(); canPocket = canPocket && (targetURI.schemeIs("http") || targetURI.schemeIs("https") || (targetURI.schemeIs("about") && ReaderMode.getOriginalUrl(targetURI.spec))); diff --git a/browser/modules/ReaderParent.jsm b/browser/modules/ReaderParent.jsm index 0860989..4df8210 100644 --- a/browser/modules/ReaderParent.jsm +++ b/browser/modules/ReaderParent.jsm @@ -79,8 +79,11 @@ var ReaderParent = { break; case "Reader:PocketEnabledGet": { - let pocketPlacement = CustomizableUI.getPlacementOfWidget("pocket-button"); - let isPocketEnabled = pocketPlacement && pocketPlacement.area; + // Only when the pocket button is present on the navigation bar or + // the hamburger menu, should Pocket be considered "active". + let doc = message.target.ownerDocument; + let isPocketEnabled = (doc !== null) && + (doc.getElementById("pocket-button") !== null); message.target.messageManager.sendAsyncMessage("Reader:PocketEnabledData", { enabled: !!isPocketEnabled}); break; }

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18619: If indexedDB disabled, use in-memory db for asyncStorage.js
by gk＠torproject.org 17 May '16

17 May '16

commit 847b5368b573508a66c7ba38a2148fe36289fe23 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon May 16 11:00:16 2016 -0700 Bug 18619: If indexedDB disabled, use in-memory db for asyncStorage.js --- devtools/shared/async-storage.js | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/devtools/shared/async-storage.js b/devtools/shared/async-storage.js index 7bd05b6..4eb2889 100644 --- a/devtools/shared/async-storage.js +++ b/devtools/shared/async-storage.js @@ -42,10 +42,37 @@ const {Cc, Ci, Cu, Cr} = require("chrome"); const {indexedDB} = require("sdk/indexed-db"); const Promise = require("promise"); +const prefs = require("sdk/preferences/service"); + +// Substitute memory-only "database" when "dom.indexedDB.enabled" is false. +// Match the API and behavior of the indexedDB-based version. +const memoryDB = function () { + let dbMap = new Map(); + return { + getItem : k => { + let value = dbMap.get(k); + // Match the behavior of indexedDB-based implementation + // when an item is not present. + if (value === undefined) { + value = null; + } + return Promise.resolve(value); + }, + setItem : (k, v) => Promise.resolve(dbMap.set(k, v)), + removeItem : k => Promise.resolve(dbMap.delete(k)), + clear : () => Promise.resolve(dbMap.clear()), + length : () => Promise.resolve(dbMap.size), + key : n => Promise.resolve(Array.from(dbMap.keys())[n]) + }; +}; module.exports = (function() { "use strict"; + if (!prefs.get('dom.indexedDB.enabled', true)) { + return memoryDB(); + } + var DBNAME = "devtools-async-storage"; var DBVERSION = 1; var STORENAME = "keyvaluepairs";

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 17 May '16

17 May '16

commit d7657bf45be5e942a6d522c118d0b2e55c483ad6 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon May 16 16:32:19 2016 -0400 fixup! TB4: Tor Browser's Firefox preference overrides. Disable monitoring the connected state of Tor Browser users (bug 18945). --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index bd24118..91542b7 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -230,6 +230,7 @@ pref("network.http.pipelining.read-timeout", 60000); // Hacked pref: Now means "Attempt to pipeline at least this many requests together" pref("network.http.pipelining.max-optimistic-requests", 3); pref("security.ssl.disable_session_identifiers", true); +pref("network.manage-offline-status", false); // As a "defense in depth" measure, configure an empty push server URL (the // DOM Push features are disabled by default via other prefs).

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 1246614 - Check if system add-ons directory exists before trying to clean it. r=mossop
by gk＠torproject.org 17 May '16

17 May '16

commit ecf19e655e6f6b94c311f3c69e56fea31bdb4185 Author: Frank-Rainer Grahl <frgrahl(a)gmx.net> Date: Sun Feb 21 05:45:00 2016 +0100 Bug 1246614 - Check if system add-ons directory exists before trying to clean it. r=mossop --HG-- extra : rebase_source : 44545607f4434a8ad03cdc59306e02517056d42c --- toolkit/mozapps/extensions/internal/XPIProvider.jsm | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 94c33ea..ca51ae5 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -8023,6 +8023,12 @@ Object.assign(SystemAddonInstallLocation.prototype, { * to cleanup again next time. */ cleanDirectories: Task.async(function*() { + + // System add-ons directory does not exist + if (!(yield OS.File.exists(this._baseDir.path))) { + return; + } + let iterator; try { iterator = new OS.File.DirectoryIterator(this._baseDir.path);

1 0

[tor-launcher/master] Bug 18947: not starting on OS X if put into /Applications
by gk＠torproject.org 17 May '16

17 May '16

commit 7ee11f5d012773445cc21a86bb1e8d423b15093d Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon May 16 10:48:51 2016 -0400 Bug 18947: not starting on OS X if put into /Applications Display a better error message if tor exits and Tor Launcher was never able to establish a connection to the control port (pointing users to a possible error in their torrc may help them find and fix the startup problem themselves). --- src/chrome/locale/en/torlauncher.properties | 1 + src/components/tl-process.js | 21 ++++++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/src/chrome/locale/en/torlauncher.properties b/src/chrome/locale/en/torlauncher.properties index 6b471a3..24bb4d6 100644 --- a/src/chrome/locale/en/torlauncher.properties +++ b/src/chrome/locale/en/torlauncher.properties @@ -3,6 +3,7 @@ torlauncher.error_title=Tor Launcher +torlauncher.tor_exited_during_startup=Tor exited during startup. This might be due to an error in your torrc file, a bug in Tor or another program on your system, or faulty hardware. Until you fix the underlying problem and restart Tor, Tor Browser will not start. torlauncher.tor_exited=Tor unexpectedly exited. This might be due to a bug in Tor itself, another program on your system, or faulty hardware. Until you restart Tor, the Tor Browser will not able to reach any websites. If the problem persists, please send a copy of your Tor Log to the support team. torlauncher.tor_exited2=Restarting Tor will not close your browser tabs. torlauncher.tor_controlconn_failed=Could not connect to Tor control port. diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 7daa31f..ba50310 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -150,8 +150,25 @@ TorProcessService.prototype = { this.mProtocolSvc.TorCleanupConnection(); - var s = TorLauncherUtil.getLocalizedString("tor_exited") + "\n\n" + let s; + if (!this.mDidConnectToTorControlPort) + { + // The "tor_exited_during_startup" property string was added in + // May 2016. If it is available, we use it; otherwise, we fall back + // to the older "tor_exited" message (below). Once this new string + // has been translated into all of the languages that we ship, we + // can simplify this code. + let key = "tor_exited_during_startup"; + s = TorLauncherUtil.getLocalizedString(key) + if (s == key) // No string found for key. + s = undefined; + } + + if (!s) + { + s = TorLauncherUtil.getLocalizedString("tor_exited") + "\n\n" + TorLauncherUtil.getLocalizedString("tor_exited2"); + } TorLauncherLogger.log(4, s); var defaultBtnLabel = TorLauncherUtil.getLocalizedString("restart_tor"); var cancelBtnLabel = "OK"; @@ -178,6 +195,7 @@ TorProcessService.prototype = var haveConnection = this.mProtocolSvc.TorHaveControlConnection(); if (haveConnection) { + this.mDidConnectToTorControlPort = true; this.mControlConnTimer = null; this.mTorProcessStatus = this.kStatusRunning; this.mProtocolSvc.TorStartEventMonitor(); @@ -282,6 +300,7 @@ TorProcessService.prototype = // Private Member Variables //////////////////////////////////////////////// mTorProcessStatus: 0, // kStatusUnknown + mDidConnectToTorControlPort: false, // Have we ever made a connection? mIsBootstrapDone: false, mBootstrapErrorOccurred: false, mIsQuitting: false,

1 0

[tor-browser-bundle/master] Bug 18904: Mac OS meek-http-helper profile not updated
by gk＠torproject.org 16 May '16

16 May '16

commit 495885feb51d7f1faf6d4c0dc3dd8f47e9f1caa7 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu May 12 13:59:23 2016 -0400 Bug 18904: Mac OS meek-http-helper profile not updated When DATA_OUTSIDE_APP_DIR=1, add a meek-template-sha256sum.txt file to the meek-http-helper browser profile template. The meek-client-torbrowser program uses this file to automatically detect changes to the profile, e.g., after Tor Browser is updated. --- gitian/descriptors/mac/gitian-bundle.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index ff17520..1d200b5 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -181,6 +181,12 @@ script: | cat ~/build/torrc-defaults-appendix-mac >> $TORCONFIGPATH/torrc-defaults cat ~/build/bridge_prefs.js >> $EXTOVERRIDESPATH cat ~/build/meek-http-helper-user.js >> $MEEKPROFILEPATH/user.js + if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then + # Create the meek-template-sha256sum.txt file by generating a list + # of hashes (one for each file within the meek-http-helper profile) and + # and then generating one final hash from the contents of the list. + sha256sum `find $MEEKPROFILEPATH -type f | sort` | sha256sum | sed -e 's/ *-$//' > $MEEKPROFILEPATH/meek-template-sha256sum.txt + fi fi # If not building a multi-lingual package, suppress the language prompt. if [ "z$MULTI_LINGUAL" != "z1" ]; then

1 0

[torbutton/master] Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu
by gk＠torproject.org 16 May '16

16 May '16

commit d127873b498fb83e4f608b82a8d382df25183dd3 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Apr 25 23:03:17 2016 -0700 Bug 18743: Pref to hide 'Sign in to Sync' button in hamburger menu --- src/chrome/content/torbutton.js | 16 ++++++++++++++++ src/defaults/preferences/preferences.js | 1 + 2 files changed, 17 insertions(+) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index a8a4ce6..a293c44 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -236,6 +236,9 @@ var torbutton_unique_pref_observer = case "extensions.torbutton.restrict_thirdparty": torbutton_update_thirdparty_prefs(); break; + case "extensions.torbutton.hide_sync_ui": + torbutton_update_sync_ui(); + break; case "gfx.font_rendering.opentype_svg.enabled": case "javascript.options.ion.content": case "javascript.options.typeinference": @@ -625,6 +628,7 @@ function torbutton_init() { torbutton_update_toolbutton(mode); torbutton_update_statusbar(mode); torbutton_notify_if_update_needed(); + torbutton_update_sync_ui(); createTorCircuitDisplay(m_tb_control_host, m_tb_control_port, m_tb_control_pass, "extensions.torbutton.display_circuit"); @@ -3566,4 +3570,16 @@ function torbutton_is_homepage_url(aURI) return (urls.indexOf(aURI.spec) >= 0); } +// Check if "extensions.torbutton.hide_sync_ui" is enabled, and if so, +// hide the "Sign in to Sync" button on the hamburger menu. +function torbutton_update_sync_ui() +{ + try { + document.getElementById("PanelUI-footer-fxa").style.display = + getBoolPref("extensions.torbutton.hide_sync_ui") ? "none" : ""; + } catch (e) { + torbutton_log(5, 'Error updating the Sync UI: ' + e); + } +} + //vim:set ts=4 diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 548f4ed..c958ec4 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -9,6 +9,7 @@ pref("extensions.torbutton.display_panel",true); pref("extensions.torbutton.panel_style",'text'); pref("extensions.torbutton(a)torproject.org.description", "chrome://torbutton/locale/torbutton.properties"); pref("extensions.torbutton.updateNeeded", false); +pref("extensions.torbutton.hide_sync_ui", true); // proxy prefs pref("extensions.torbutton.settings_method",'recommended');

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Bug 12827: Create preference to disable SVG.
by gk＠torproject.org 16 May '16

16 May '16

commit 7ffe3230d2b6020394803784c140765e7c8e4b76 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue May 10 16:57:17 2016 -0400 fixup! Bug 12827: Create preference to disable SVG. When SVGs are disabled, do no load SVG images within the Page Info Media tab (bug 18770). --- image/ImageFactory.cpp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/image/ImageFactory.cpp b/image/ImageFactory.cpp index 9298d74..ec20c78 100644 --- a/image/ImageFactory.cpp +++ b/image/ImageFactory.cpp @@ -98,8 +98,10 @@ ImageFactory::CreateImage(nsIRequest* aRequest, nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest)); isBlocked = !NS_SVGEnabledForChannel(channel); if (!isBlocked && channel && !NS_SVGEnabledForChannel(nullptr)) { - // Special case for favicons: block this image load if SVGs are - // disallowed from content and if this image load originated from the + // This SVG was not blocked based on the channel but SVGs are + // disallowed from content. Check some special cases. + + // For favicons, block this SVG image load if it originated from the // favicon xul:image node within a tab. nsCOMPtr<nsILoadInfo> loadInfo; nsresult rv = channel->GetLoadInfo(getter_AddRefs(loadInfo)); @@ -111,6 +113,17 @@ ImageFactory::CreateImage(nsIRequest* aRequest, nsAutoString anonid; elem->GetAttribute(NS_LITERAL_STRING("anonid"), anonid); isBlocked = anonid.EqualsLiteral("tab-icon-image"); + + if (!isBlocked) { + // For the Page Info "Media" tab, block this SVG image load if + // it originated from a node within a chrome document that has + // an id of "thepreviewimage". + if (nsContentUtils::IsChromeDoc(node->OwnerDoc())) { + nsAutoString loadingID; + elem->GetId(loadingID); + isBlocked = loadingID.EqualsLiteral("thepreviewimage"); + } + } } } }

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] fixup! Regression tests for #5856: Do not expose physical screen info via window & window.screen.
by gk＠torproject.org 13 May '16

13 May '16

commit ec74b173f8a00e59aa42e0cf32e65ec2266cb477 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun May 8 23:33:39 2016 -0700 fixup! Regression tests for #5856: Do not expose physical screen info via window & window.screen. --- tbb-tests/test_tor_bug5856.html | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tbb-tests/test_tor_bug5856.html b/tbb-tests/test_tor_bug5856.html index 2eae453..7a9ab6f 100644 --- a/tbb-tests/test_tor_bug5856.html +++ b/tbb-tests/test_tor_bug5856.html @@ -27,7 +27,10 @@ https://trac.torproject.org/projects/tor/ticket/5856 ["window.screen.availLeft", 0], ["window.screen.availTop", 0], ["window.screen.width", "window.innerWidth"], - ["window.screen.height", "window.innerHeight"] + ["window.screen.height", "window.innerHeight"], + ["window.screen.orientation.type", "'landscape-primary'"], + ["window.screen.orientation.angle", 0], + ["window.screen.mozOrientation", "'landscape-primary'"], ]; pairs.map(checkPair);

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18958: Spoof screen.orientation values
by gk＠torproject.org 13 May '16

13 May '16

commit a086a5d0070821b1c4dfd2492bdc993c91353a2b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun May 8 22:23:42 2016 -0700 Bug 18958: Spoof screen.orientation values Make sure that screen.orientation.angle -> 0 and screen.orientation.type -> "landscape-primary" Also refactors screen.mozOrientation. --- dom/base/ScreenOrientation.cpp | 29 +++++++++++++++++++++++++++-- dom/base/ScreenOrientation.h | 2 ++ dom/base/nsGlobalWindow.cpp | 7 ++++--- dom/base/nsScreen.cpp | 38 ++++++++++++++++++++------------------ 4 files changed, 53 insertions(+), 23 deletions(-) diff --git a/dom/base/ScreenOrientation.cpp b/dom/base/ScreenOrientation.cpp index 868a1d5..fdea67a 100644 --- a/dom/base/ScreenOrientation.cpp +++ b/dom/base/ScreenOrientation.cpp @@ -15,6 +15,7 @@ #include "mozilla/Preferences.h" #include "mozilla/dom/Promise.h" +#include "nsContentUtils.h" using namespace mozilla; using namespace mozilla::dom; @@ -403,18 +404,23 @@ ScreenOrientation::UnlockDeviceOrientation() OrientationType ScreenOrientation::DeviceType() const { - return mType; + return ShouldResistFingerprinting() ? OrientationType::Landscape_primary + : mType; } uint16_t ScreenOrientation::DeviceAngle() const { - return mAngle; + return ShouldResistFingerprinting() ? 0 : mAngle; } OrientationType ScreenOrientation::GetType(ErrorResult& aRv) const { + if (ShouldResistFingerprinting()) { + return OrientationType::Landscape_primary; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { aRv.Throw(NS_ERROR_UNEXPECTED); @@ -427,6 +433,10 @@ ScreenOrientation::GetType(ErrorResult& aRv) const uint16_t ScreenOrientation::GetAngle(ErrorResult& aRv) const { + if (ShouldResistFingerprinting()) { + return 0; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { aRv.Throw(NS_ERROR_UNEXPECTED); @@ -489,6 +499,10 @@ ScreenOrientation::GetResponsibleDocument() const void ScreenOrientation::Notify(const hal::ScreenConfiguration& aConfiguration) { + if (ShouldResistFingerprinting()) { + return; + } + nsIDocument* doc = GetResponsibleDocument(); if (!doc) { return; @@ -564,6 +578,17 @@ ScreenOrientation::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) return ScreenOrientationBinding::Wrap(aCx, this, aGivenProto); } +bool +ScreenOrientation::ShouldResistFingerprinting() const +{ + bool resist = false; + nsCOMPtr<nsPIDOMWindow> owner = GetOwner(); + if (owner) { + resist = nsContentUtils::ShouldResistFingerprinting(owner->GetDocShell()); + } + return resist; +} + NS_IMPL_ISUPPORTS(ScreenOrientation::VisibleEventListener, nsIDOMEventListener) NS_IMETHODIMP diff --git a/dom/base/ScreenOrientation.h b/dom/base/ScreenOrientation.h index afb5e77..a6e51c7 100644 --- a/dom/base/ScreenOrientation.h +++ b/dom/base/ScreenOrientation.h @@ -102,6 +102,8 @@ private: void DispatchChangeEvent(); + bool ShouldResistFingerprinting() const; + LockPermission GetLockOrientationPermission(bool aCheckSandbox) const; // Gets the responsible document as defined in the spec. diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp index ed42538..6dc06b1 100644 --- a/dom/base/nsGlobalWindow.cpp +++ b/dom/base/nsGlobalWindow.cpp @@ -12820,8 +12820,8 @@ void nsGlobalWindow::EnableOrientationChangeListener() { MOZ_ASSERT(IsInnerWindow()); - - if (!mOrientationChangeObserver) { + if (!nsContentUtils::ShouldResistFingerprinting(mDocShell) + && !mOrientationChangeObserver) { mOrientationChangeObserver = new WindowOrientationObserver(this); } @@ -13671,7 +13671,8 @@ nsGlobalWindow::IsModalContentWindow(JSContext* aCx, JSObject* aGlobal) int16_t nsGlobalWindow::Orientation() const { - return WindowOrientationObserver::OrientationAngle(); + return nsContentUtils::ShouldResistFingerprinting(mDocShell) ? + 0 : WindowOrientationObserver::OrientationAngle(); } #endif diff --git a/dom/base/nsScreen.cpp b/dom/base/nsScreen.cpp index ad1642b..49c12eb 100644 --- a/dom/base/nsScreen.cpp +++ b/dom/base/nsScreen.cpp @@ -166,25 +166,21 @@ nsScreen::Orientation() const void nsScreen::GetMozOrientation(nsString& aOrientation) const { - if (ShouldResistFingerprinting()) { + switch (mScreenOrientation->DeviceType()) { + case OrientationType::Portrait_primary: + aOrientation.AssignLiteral("portrait-primary"); + break; + case OrientationType::Portrait_secondary: + aOrientation.AssignLiteral("portrait-secondary"); + break; + case OrientationType::Landscape_primary: aOrientation.AssignLiteral("landscape-primary"); - } else { - switch (mScreenOrientation->DeviceType()) { - case OrientationType::Portrait_primary: - aOrientation.AssignLiteral("portrait-primary"); - break; - case OrientationType::Portrait_secondary: - aOrientation.AssignLiteral("portrait-secondary"); - break; - case OrientationType::Landscape_primary: - aOrientation.AssignLiteral("landscape-primary"); - break; - case OrientationType::Landscape_secondary: - aOrientation.AssignLiteral("landscape-secondary"); - break; - default: - MOZ_CRASH("Unacceptable screen orientation type."); - } + break; + case OrientationType::Landscape_secondary: + aOrientation.AssignLiteral("landscape-secondary"); + break; + default: + MOZ_CRASH("Unacceptable screen orientation type."); } } @@ -236,6 +232,9 @@ bool nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations, ErrorResult& aRv) { + if (ShouldResistFingerprinting()) { + return false; + } ScreenOrientationInternal orientation = eScreenOrientation_None; for (uint32_t i = 0; i < aOrientations.Length(); ++i) { @@ -283,6 +282,9 @@ nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations, void nsScreen::MozUnlockOrientation() { + if (ShouldResistFingerprinting()) { + return; + } UpdateDocShellOrientationLock(GetOwner(), eScreenOrientation_None); mScreenOrientation->UnlockDeviceOrientation(); }

1 0

[tor-browser-bundle/hardened-builds] Bug 17406: Include SelfRando support in our nightlies
by gk＠torproject.org 12 May '16

12 May '16

commit 138470ca7ce810f62761af8c3989654ec4a611fa Author: Georg Koppen <gk(a)torproject.org> Date: Thu May 12 20:25:02 2016 +0000 Bug 17406: Include SelfRando support in our nightlies SelfRando is a new defense against code reuse attacks developed by the Radactor and Readactor++ people. We should give it a wider testing audience by including it in the nightly. --- RelativeLink/start-tor-browser | 3 + gitian/descriptors/linux/gitian-firefox.yml | 7 + gitian/descriptors/linux/gitian-utils.yml | 38 +++- gitian/fetch-inputs.sh | 4 +- gitian/gpg/ELFUTILS.gpg | Bin 0 -> 10483 bytes gitian/mkbundle-linux.sh | 9 +- gitian/patches/libfaketime-asan.patch | 268 ++++++++++++++++++++++++++-- gitian/verify-tags.sh | 3 +- gitian/versions.nightly | 4 + 9 files changed, 313 insertions(+), 23 deletions(-) diff --git a/RelativeLink/start-tor-browser b/RelativeLink/start-tor-browser index 2e7805d..19c5cfc 100755 --- a/RelativeLink/start-tor-browser +++ b/RelativeLink/start-tor-browser @@ -270,6 +270,9 @@ fi LD_LIBRARY_PATH="${HOME}/TorBrowser/Tor/" export LD_LIBRARY_PATH +export SELFRANDO_write_layout_file= +export NSS_DISABLE_HW_AES=1 + # We need to disable LSan which is enabled by default now. Otherwise we'll get # a crash during shutdown: https://bugs.torproject.org/10599#comment:59 ASAN_OPTIONS="detect_leaks=0" diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index e24a740..22686b7 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,12 +29,15 @@ remotes: "dir": "tor-browser" - "url": "https://github.com/wolfcw/libfaketime" "dir": "faketime" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils-linux64-utils.zip" - "gcc-linux64-utils.zip" - "re-dzip.sh" - "dzip.sh" - "versions" +- "self-rando-utils.zip" script: | source versions INSTDIR="$HOME/install" @@ -49,6 +52,7 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 # + unzip -d $INSTDIR self-rando-utils.zip # Preparing Binutils and GCC for Tor Browser unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip # Make sure gold is used with the hardening wrapper for full RELRO, see @@ -96,6 +100,9 @@ script: | # that feature it would hang sometimes for unknown but to libfaketime related # reasons. export LD_PRELOAD="" + # Self-Rando wrapper + export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" + export SELFRANDO_skip_shuffle= make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" # We need libfaketime for all the timestamps e.g. written into the libraries. # BUT we need to exclude |make build| from it. Otherwise the build fails close diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 72ead1b..15b26f4 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -24,10 +24,14 @@ packages: - "libssl-dev" # Needed for binutils (64bit) as we are building with PIE enabled. - "libstdc++6-4.7-pic" +# Needed for Selfrando +- "scons" reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" +- "url": "https://github.com/immunant/selfrando.git" + "dir": "selfrando" files: - "binutils.tar.bz2" - "gcc.tar.bz2" @@ -36,6 +40,7 @@ files: - "versions" - "dzip.sh" - "libfaketime-asan.patch" +- "elfutils.tar.bz2" script: | INSTDIR="$HOME/install" source versions @@ -56,11 +61,8 @@ script: | # The libstdc++ shipped by default is non-PIC which breaks the binutils build # if we build with DEB_BUILD_HARDENING_PIE=1. We need to install a PIC one AND # make sure it gets used before the non-PIC one would. - if [ $GBUILD_BITS == "64" ]; - then - ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a - export LDFLAGS="-L/home/debian -lstdc++" - fi + ln -s /usr/lib/gcc/x86_64-linux-gnu/4.7/libstdc++_pic.a libstdc++.a + export LDFLAGS="-L/home/debian -lstdc++" cd binutils* # We want to use gold as the linker in our toolchain mainly as it is way # faster when linking Tor Browser code (especially libxul). But apart from @@ -90,6 +92,31 @@ script: | cd .. export DEB_BUILD_HARDENING_FORMAT=1 + OPATH="$PATH" + OLD_LIBRARY_PATH="$LD_LIBRARY_PATH" + export PATH="$INSTDIR/binutils/bin:$INSTDIR/gcc/bin:$PATH" + export LD_LIBRARY_PATH="$INSTDIR/gcc/lib64/:$LD_LIBRARY_PATH" + + # Building Elfutils + tar xjf elfutils.tar.bz2 + cd elfutils*/ + ./configure --prefix=$INSTDIR/elfutils + make $MAKEOPTS + make install + cd .. + + # Building Selfrando + cd selfrando + scons -Q arch=x86_64 ADDN_CCFLAGS="-include $(ls $HOME/build/elfutils-*/libelf/elf.h) -I $INSTDIR/elfutils/include -fno-reorder-functions" ADDN_LINKFLAGS="-L $INSTDIR/elfutils/lib" + mkdir -p $INSTDIR/self-rando + cp sconsRelease/x86_64/bin/* $INSTDIR/self-rando/ + cd .. + + PATH="$OPATH" + unset OPATH + LD_LIBRARY_PATH="$OLD_LIBRARY_PATH" + unset OLD_LIBRARY_PATH + # Building Libevent cd libevent ./autogen.sh @@ -134,4 +161,5 @@ script: | ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh gmp-$GMP_VER-linux$GBUILD_BITS-utils.zip gmp + ~/build/dzip.sh self-rando-utils.zip self-rando cp *utils.zip $OUTDIR/ diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 027a47e..4f63374 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -112,7 +112,7 @@ update_git() { ############################################################################## # Get+verify sigs that exist -for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" @@ -236,6 +236,7 @@ ln -sf "$SETUPTOOLS_PACKAGE" setuptools.tar.gz ln -sf "$GMP_PACKAGE" gmp.tar.bz2 ln -sf "$PARSLEY_PACKAGE" parsley.tar.gz ln -sf "$GO_PACKAGE" go.tar.gz +ln -sf "$ELFUTILS_PACKAGE" elfutils.tar.bz2 # Fetch latest gitian-builder itself # XXX - this is broken if a non-standard inputs dir is selected using the command line flag. @@ -273,6 +274,7 @@ goxcrypto https://go.googlesource.com/crypto $GO_X_CRYPTO_TAG goxnet https://go.googlesource.com/net $GO_X_NET_TAG obfs4 https://git.torproject.org/pluggable-transports/obfs4.git $OBFS4_TAG noto-fonts https://github.com/googlei18n/noto-fonts $NOTOFONTS_TAG +selfrando https://github.com/immunant/selfrando.git $SELFRANDO_TAG EOF # HTTPS-Everywhere is special, too. We need to initialize the git submodules and diff --git a/gitian/gpg/ELFUTILS.gpg b/gitian/gpg/ELFUTILS.gpg new file mode 100644 index 0000000..f1cd4b3 Binary files /dev/null and b/gitian/gpg/ELFUTILS.gpg differ diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index a1674dd..48aac24 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -35,7 +35,7 @@ fi if [ -z "$VM_MEMORY" ]; then - export VM_MEMORY=4000 + export VM_MEMORY=6000 fi ./make-vms.sh @@ -104,13 +104,14 @@ if [ ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ ! -f inputs/gcc-$GCC_VER-linux64-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ - ! -f inputs/gmp-$GMP_VER-linux64-utils.zip ]; + ! -f inputs/gmp-$GMP_VER-linux64-utils.zip -o \ + ! -f inputs/self-rando-utils.zip ]; then echo echo "****** Starting Utilities Component of Linux Bundle (1/5 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit libevent=$LIBEVENT_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-utils.yml if [ $? -ne 0 ]; then #mv var/build.log ./utils-fail-linux.log.`date +%Y%m%d%H%M%S` @@ -169,7 +170,7 @@ then echo "****** Starting TorBrowser Component of Linux Bundle (3/5 for Linux) ******" echo - ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml + ./bin/gbuild -j $NUM_PROCS -m $VM_MEMORY --commit tor-browser=$TORBROWSER_TAG,faketime=$FAKETIME_TAG,selfrando=$SELFRANDO_TAG $DESCRIPTOR_DIR/linux/gitian-firefox.yml if [ $? -ne 0 ]; then #mv var/build.log ./firefox-fail-linux.log.`date +%Y%m%d%H%M%S` diff --git a/gitian/patches/libfaketime-asan.patch b/gitian/patches/libfaketime-asan.patch index 5346eae..ff3e62b 100644 --- a/gitian/patches/libfaketime-asan.patch +++ b/gitian/patches/libfaketime-asan.patch @@ -1,12 +1,3 @@ -From 0ef83e9a0631e25e62e1dbc483108742fc125304 Mon Sep 17 00:00:00 2001 -From: Georg Koppen <gk(a)torproject.org> -Date: Mon, 14 Sep 2015 14:27:36 +0000 -Subject: [PATCH] No dying anymore - ---- - libsanitizer/asan/asan_linux.cc | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - diff --git a/libsanitizer/asan/asan_linux.cc b/libsanitizer/asan/asan_linux.cc index c504168..1d1a6dd 100644 --- a/libsanitizer/asan/asan_linux.cc @@ -23,6 +14,259 @@ index c504168..1d1a6dd 100644 } } --- -1.7.10.4 - +diff --git a/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h b/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h +new file mode 100644 +index 0000000..5f13870 +--- /dev/null ++++ b/libsanitizer/sanitizer_common/SelfRandoAddressTranslator.h +@@ -0,0 +1,155 @@ ++// ++// Created by tf on 10/12/2015. ++// ++ ++#pragma once ++#include "sanitizer_internal_defs.h" ++#include "sanitizer_libc.h" ++#include "sanitizer_common.h" ++ ++#define PROT_READ 0x1 /* Page can be read. */ ++#define PROT_WRITE 0x2 /* Page can be written. */ ++#define PROT_EXEC 0x4 /* Page can be executed. */ ++#define PROT_NONE 0x0 /* Page can not be accessed. */ ++#define MAP_SHARED 0x01 /* Share changes. */ ++ ++namespace __sanitizer { ++ class SelfRandoAddressTranslator { ++ struct __attribute__((__packed__)) FunctionRecord { ++ void *undiv_addr; ++ void *div_addr; ++ u32 size; ++ }; ++ ++ struct __attribute__((__packed__)) LibraryRecord { ++ u32 version; ++ u32 seed; ++ void *file_base; ++ void *mem_base; ++ void *size; ++ ++ private: ++ char _name; ++ ++ public: ++ inline char *name() { return &_name; } ++ ++ inline FunctionRecord *function_records() { ++ return (FunctionRecord *) (&_name + internal_strlen(&_name) + 1); ++ } ++ ++ u8 *record_end() { ++ FunctionRecord *fr = function_records(); ++ while (fr->undiv_addr) { ++ fr++; ++ } ++ return (u8 *) fr + sizeof(void *); ++ } ++ }; ++ ++ // 16K loaded modules should be enough for everyone. ++ LibraryRecord* library_records_idx[1<<14]; ++ int library_records_idx_size; ++ u8 *library_records_end; ++ void add_library_record(LibraryRecord* lr); ++ ++ void read_layout_file(); ++ u8 *record_end(int i); ++ ++ public: ++ SelfRandoAddressTranslator(); ++ ++ uptr convertAddress(uptr original_address); ++ }; ++ ++ ++ ++ ++ SelfRandoAddressTranslator::SelfRandoAddressTranslator() { ++ Printf("SRAT init\n"); ++ read_layout_file(); ++ } ++ ++ void SelfRandoAddressTranslator::add_library_record(LibraryRecord* lr) { ++ library_records_idx_size++; ++ CHECK(library_records_idx_size <= 1<<14); ++ library_records_idx[library_records_idx_size - 1] = lr; ++ } ++ ++ u8* SelfRandoAddressTranslator::record_end(int i) { ++ if (i < library_records_idx_size - 1) { ++ return (u8 *) library_records_idx[i + 1] - sizeof(void *); ++ } else { ++ return library_records_end - sizeof(void*); ++ } ++ } ++ ++ void SelfRandoAddressTranslator::read_layout_file() { ++ uptr pid = internal_getpid(); ++ char filename[32]; ++ internal_snprintf(filename, 32, "/tmp/%d.mlf", pid); ++ ++ u8 buf[200]; // Current size of struct stat: 144 ++ if(0 != internal_stat(filename, &buf)) { ++ Printf("SRAT warning: cannot find Memory Layout File. Stack trace will be probably wrong.\n"); ++ return; ++ } ++ ++ uptr fd = OpenFile(filename, /*write*/ false); ++ uptr size = *(uptr*) (buf+48); ++ CHECK_NE(fd, -1); ++ u8 *f = (u8 *) internal_mmap(0, size, PROT_READ, MAP_SHARED, (int) fd, 0); ++ CHECK_NE(f, 0); ++ library_records_end = f + size; ++ ++ u8 *p = f; ++ while (p < library_records_end) { ++ LibraryRecord *lr = (LibraryRecord *) p; ++ add_library_record(lr); ++ CHECK_EQ(lr->version, 0x00000101); ++ p = lr->record_end(); ++ } ++ ++ } ++ ++ uptr SelfRandoAddressTranslator::convertAddress(uptr p) { ++// Printf("conv %p", p); ++ for (int i = 0; i < library_records_idx_size; ++i) { ++ LibraryRecord *lr = library_records_idx[i]; ++ ++ if (p > (uptr) lr->mem_base && p < (uptr) lr->mem_base + (uptr) lr->size) { ++ // found the correct library ++ ++ FunctionRecord *function_records = lr->function_records(); ++ ++ int a = 0; ++ int b = (int) ((FunctionRecord *) record_end(i) - function_records); ++// Printf(" (lib=>%s< a=%d b=%d)", lr->name(), a, b); ++ CHECK_EQ((u8 *) (function_records + b), record_end(i)); ++ ++ while (b - a > 1) { // bisection ++ int c = a + (b - a) / 2; ++ FunctionRecord *fr = &function_records[c]; ++ ++ if ((uptr) fr->div_addr > p) { // too high ++ b = c; ++ } else if ((uptr) fr->div_addr + (uptr) fr->size < p) { // too low ++ a = c; ++ } else { // found ++ b = c + 1; ++ a = c; ++ } ++ } ++ FunctionRecord *fr = &function_records[a]; ++ CHECK((uptr) fr->div_addr < p && p < (uptr) fr->div_addr + (uptr) fr->size); ++ ++ p = (p - (uptr) fr->div_addr + (uptr) fr->undiv_addr); ++ ++ break; ++ } ++ } ++ ++// Printf(" => %p\n", p); ++ return p; ++ } ++} +\ No newline at end of file +diff --git a/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc b/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc +index 5cc21d3..393a494 100644 +--- a/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc ++++ b/libsanitizer/sanitizer_common/sanitizer_symbolizer_posix_libcdep.cc +@@ -21,6 +21,7 @@ + #include "sanitizer_procmaps.h" + #include "sanitizer_symbolizer.h" + #include "sanitizer_symbolizer_libbacktrace.h" ++#include "SelfRandoAddressTranslator.h" + + #include <errno.h> + #include <stdlib.h> +@@ -512,7 +513,7 @@ class POSIXSymbolizer : public Symbolizer { + internal_symbolizer_(internal_symbolizer), + libbacktrace_symbolizer_(libbacktrace_symbolizer) {} + +- uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) { ++ virtual uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) { + BlockingMutexLock l(&mu_); + if (max_frames == 0) + return 0; +@@ -580,7 +581,7 @@ class POSIXSymbolizer : public Symbolizer { + return frame_id; + } + +- bool SymbolizeData(uptr addr, DataInfo *info) { ++ virtual bool SymbolizeData(uptr addr, DataInfo *info) { + BlockingMutexLock l(&mu_); + LoadedModule *module = FindModuleForAddress(addr); + if (module == 0) +@@ -606,7 +607,7 @@ class POSIXSymbolizer : public Symbolizer { + return true; + } + +- bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, ++ virtual bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, + uptr *module_address) { + BlockingMutexLock l(&mu_); + return FindModuleNameAndOffsetForAddress(pc, module_name, module_address); +@@ -720,9 +721,40 @@ class POSIXSymbolizer : public Symbolizer { + LibbacktraceSymbolizer *libbacktrace_symbolizer_; // Leaked. + }; + ++ ++ class SelfRandoPOSIXSymbolizer : public POSIXSymbolizer { ++ SelfRandoAddressTranslator translator; ++ ++ public: ++ SelfRandoPOSIXSymbolizer(ExternalSymbolizerInterface *external_symbolizer, ++ InternalSymbolizer *internal_symbolizer, ++ LibbacktraceSymbolizer *libbacktrace_symbolizer) ++ : POSIXSymbolizer(external_symbolizer, internal_symbolizer, libbacktrace_symbolizer), ++ translator() { } ++ ++ ++ private: ++ virtual uptr SymbolizePC(uptr addr, AddressInfo *frames, uptr max_frames) override { ++ uptr conv_addr = translator.convertAddress(addr); ++ uptr res = POSIXSymbolizer::SymbolizePC(conv_addr, frames, max_frames); ++ if (res == 1) frames->address = addr; ++ return res; ++ } ++ ++ virtual bool SymbolizeData(uptr addr, DataInfo *info) override { ++ addr = translator.convertAddress(addr); ++ return POSIXSymbolizer::SymbolizeData(addr, info); ++ } ++ ++ virtual bool GetModuleNameAndOffsetForPC(uptr pc, const char **module_name, uptr *module_address) override { ++ pc = translator.convertAddress(pc); ++ return POSIXSymbolizer::GetModuleNameAndOffsetForPC(pc, module_name, module_address); ++ }; ++ }; ++ + Symbolizer *Symbolizer::PlatformInit() { + if (!common_flags()->symbolize) { +- return new(symbolizer_allocator_) POSIXSymbolizer(0, 0, 0); ++ return new(symbolizer_allocator_) SelfRandoPOSIXSymbolizer(0, 0, 0); + } + InternalSymbolizer* internal_symbolizer = + InternalSymbolizer::get(&symbolizer_allocator_); +@@ -754,10 +786,11 @@ Symbolizer *Symbolizer::PlatformInit() { + } + } + +- return new(symbolizer_allocator_) POSIXSymbolizer( ++ return new(symbolizer_allocator_) SelfRandoPOSIXSymbolizer( + external_symbolizer, internal_symbolizer, libbacktrace_symbolizer); + } + ++ + } // namespace __sanitizer + + #endif // SANITIZER_POSIX diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 46cb01a..5268f85 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -118,10 +118,11 @@ siphash $GOSIPHASH_TAG goxcrypto $GO_X_CRYPTO_TAG goxnet $GO_X_NET_TAG noto-fonts $NOTOFONTS_TAG +selfrando $SELFRANDO_TAG EOF # Verify signatures on signed packages -for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP +for i in OPENSSL BINUTILS GCC PYCRYPTO PYTHON_MSI GMP ELFUTILS do PACKAGE="${i}_PACKAGE" URL="${i}_URL" diff --git a/gitian/versions.nightly b/gitian/versions.nightly index 088625b..9ff7e8f 100755 --- a/gitian/versions.nightly +++ b/gitian/versions.nightly @@ -48,6 +48,7 @@ GO_X_CRYPTO_TAG=master GO_X_NET_TAG=master OBFS4_TAG=master NOTOFONTS_TAG=720e34851382ee3c1ef024d8dffb68ffbfb234c2 +SELFRANDO_TAG=8e49e7aa664625d8e4793579864231b151589d0f GITIAN_TAG=tor-browser-builder-4 @@ -69,6 +70,7 @@ SETUPTOOLS_VER=1.4 PARSLEY_VER=1.2 GO_VER=1.4.2 NSIS_VER=2.51 +ELFUTILS_VER=0.160 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz @@ -99,6 +101,7 @@ NOTOJPFONT_PACKAGE=NotoSansJP-Regular.otf NOTOKRFONT_PACKAGE=NotoSansKR-Regular.otf NOTOSCFONT_PACKAGE=NotoSansSC-Regular.otf NOTOTCFONT_PACKAGE=NotoSansTC-Regular.otf +ELFUTILS_PACKAGE=elfutils-${ELFUTILS_VER}.tar.bz2 # Hashes for packages with weak sigs or no sigs OPENSSL_HASH=e7e81d82f3cd538ab0cdba494006d44aab9dd96b7f6233ce9971fb7c7916d511 @@ -157,3 +160,4 @@ NOTOJPFONT_URL=${NOTOCJKBASE_URL}/${NOTOJPFONT_PACKAGE} NOTOKRFONT_URL=${NOTOCJKBASE_URL}/${NOTOKRFONT_PACKAGE} NOTOSCFONT_URL=${NOTOCJKBASE_URL}/${NOTOSCFONT_PACKAGE} NOTOTCFONT_URL=${NOTOCJKBASE_URL}/${NOTOTCFONT_PACKAGE} +ELFUTILS_URL=https://fedorahosted.org/releases/e/l/elfutils/${ELFUTILS_VER}/${ELFUTILS_PACKAGE}

1 0

[tor-browser/tor-browser-45.1.0esr-6.0-1] Bug 18995: Regression test to ensure CacheStorage is disabled in private browsing
by gk＠torproject.org 11 May '16

11 May '16

commit cea5f1efcd9590885127a0763432143aca01524c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue May 10 16:51:08 2016 -0700 Bug 18995: Regression test to ensure CacheStorage is disabled in private browsing --- tbb-tests/browser.ini | 5 ++++ tbb-tests/browser_tor_bug18995.js | 50 +++++++++++++++++++++++++++++++++++++++ tbb-tests/bug18995.html | 31 ++++++++++++++++++++++++ tbb-tests/worker_bug_18995.html | 26 ++++++++++++++++++++ tbb-tests/worker_bug_18995.js | 8 +++++++ 5 files changed, 120 insertions(+) diff --git a/tbb-tests/browser.ini b/tbb-tests/browser.ini index f481660..9b6c47b 100644 --- a/tbb-tests/browser.ini +++ b/tbb-tests/browser.ini @@ -1,5 +1,10 @@ [DEFAULT] +support-files = + bug18995.html + worker_bug_18995.js + worker_bug_18995.html +[browser_tor_bug18995.js] [browser_tor_bug2950.js] [browser_tor_omnibox.js] [browser_tor_TB4.js] diff --git a/tbb-tests/browser_tor_bug18995.js b/tbb-tests/browser_tor_bug18995.js new file mode 100644 index 0000000..1f1801b --- /dev/null +++ b/tbb-tests/browser_tor_bug18995.js @@ -0,0 +1,50 @@ +// __browser_tor_bug18995.js__. +// In this test, we open a private browsing window, and load pages +// that test whether we can call `caches.open("test")` + +// Helper function. +// Returns a promise that is fulfilled when the first event of eventype +// arrives from the target. +let listen = function (target, eventType, useCapture) { + return new Promise(function (resolve, reject) { + let listenFunction = function (event) { + target.removeEventListener(eventType, listenFunction, useCapture); + resolve(event); + }; + target.addEventListener(eventType, listenFunction, useCapture); + }); +}; + +// The main test +add_task(function* () { + // First open the private browsing window + let privateWin = yield BrowserTestUtils.openNewBrowserWindow({private: true}); + let privateBrowser = privateWin.gBrowser.selectedBrowser; + + // We have two pages: (1) access CacheStorage in content page + // (2) access CacheStorage in worker + let testURIs = ["http://mochi.test:8888/browser/tbb-tests/bug18995.html", + "http://mochi.test:8888/browser/tbb-tests/worker_bug_18995.html"]; + for (let testURI of testURIs) { + // Load the test page + privateBrowser.loadURI(testURI); + // Wait for it too fully load + yield BrowserTestUtils.browserLoaded(privateBrowser); + // Get the <div id="result"/> in the content page + let resultDiv = privateBrowser.contentDocument.getElementById("result"); + // Send an event to the content page indicating we are ready to receive. + resultDiv.dispatchEvent(new Event("ready")); + // Wait for a signal from the content page that a result is ready. + yield listen(resultDiv, "result", false); + // Read the result from the result <div> + let resultValue = resultDiv.innerHTML; + // Print out the result + info("received: " + resultValue); + // If we are in PBM, then the promise returned by caches.open(...) + // is supposed to arrive at a rejection with a SecurityError. + ok(resultValue.contains("SecurityError"), + "CacheStorage should fail in private browsing mode"); + } + // Close the browser window because we are done testing. + yield BrowserTestUtils.closeWindow(privateWin); +}); diff --git a/tbb-tests/bug18995.html b/tbb-tests/bug18995.html new file mode 100644 index 0000000..445a26ab --- /dev/null +++ b/tbb-tests/bug18995.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + <title>Bug 18995 test</title> + </head> + <body> + <div id="result"></div> + <script type="application/javascript"> + let resultDiv = document.getElementById("result"); + // Wait for a signal from chrome to start. + resultDiv.addEventListener("ready", function () { + let resultEvent = new Event("result"); + // Test caches.open(...) + caches.open("test1").then(function (value) { + // We are not supposed to succeed, but if we do, + // post the result to resultDiv. + resultDiv.innerHTML = value.toString(); + // Notify chrome that the result is available. + resultDiv.dispatchEvent(resultEvent); + }, function (reason) { + // We should arrive here to fail. Post the result + // to resultDiv. + resultDiv.innerHTML = reason.toString(); + // Notify chrome that the result is available. + resultDiv.dispatchEvent(resultEvent); + }); + }); + </script> + </body> +</html> diff --git a/tbb-tests/worker_bug_18995.html b/tbb-tests/worker_bug_18995.html new file mode 100644 index 0000000..d9be95c --- /dev/null +++ b/tbb-tests/worker_bug_18995.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + <title>Bug 18995 test</title> + </head> + <body> + <div id="result"></div> + <script type="application/javascript"> + let resultDiv = document.getElementById("result"); + // Wait for a signal from chrome to start. + resultDiv.addEventListener("ready", function() { + // Run the test worker. + let worker = new Worker("worker_bug_18995.js"); + // Wait for a message from the worker, which should contain + // the result or the error from the caches.open(...) call. + worker.addEventListener("message", function (msg) { + // Put the result in our resultDiv. + resultDiv.innerHTML = msg.data; + // Notify chrome that the result is ready. + resultDiv.dispatchEvent(new Event("result")); + }); + }); + </script> + </body> +</html> diff --git a/tbb-tests/worker_bug_18995.js b/tbb-tests/worker_bug_18995.js new file mode 100644 index 0000000..11641e1 --- /dev/null +++ b/tbb-tests/worker_bug_18995.js @@ -0,0 +1,8 @@ +// Attempt to open a cache +caches.open("test2").then(function (value) { + // This is not supposed to happen. + self.postMessage(value.toString()); +}, function (reason) { + // We are supposed to fail. + self.postMessage(reason.toString()); +});

1 0

[tor-browser-bundle/hardened-builds] Bug 18915: Use our search plugins in localized builds
by gk＠torproject.org 11 May '16

11 May '16

commit 467796a7b7901fc22f26716860ed6ed8d4102416 Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 11 19:37:29 2016 +0000 Bug 18915: Use our search plugins in localized builds We are preparing the language packs we ship for using our search engines in the order we want. This is necessary due to https://bugzilla.mozilla.org/show_bug.cgi?id=1162569. --- gitian/descriptors/linux/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/mac/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/windows/gitian-bundle.yml | 40 +++++++++++++++++++++------- 3 files changed, 68 insertions(+), 10 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index b9bf0f9..eca8d0f 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -184,6 +184,10 @@ script: | cp -a ${TB_STAGE_DIR} ${PKG_DIR} # pushd ${PKG_DIR}/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -194,6 +198,21 @@ script: | # unzip linux-langpacks.zip LINUX_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_LINUX" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $LINUX_LOCALES + do + xpi=linux-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done # If we are building a multi-lingual package, add all of the language packs. if [ "z$MULTI_LINGUAL" = "z1" ]; then pushd linux-langpacks diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 0199cca..e046b57 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -184,6 +184,10 @@ script: | cd .. # pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -203,6 +207,21 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $MAC_LOCALES + do + xpi=mac-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 51565bf..5473bf3 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -152,8 +152,38 @@ script: | cp ../versions "Tor Browser"/Browser/TorBrowser/Docs/sources/ cp ../bundle.inputs "Tor Browser"/Browser/TorBrowser/Docs/sources/ + # + pushd "Tor Browser"/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome + unzip omni.ja defaults/preferences/000-tor-browser.js + cp defaults/preferences/000-tor-browser.js ~/build/ + # Set the locale bundle. + echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + zip -Xm omni.ja defaults/preferences/000-tor-browser.js + rm -rf defaults + popd + # + unzip ../win32-langpacks.zip WIN32_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_WIN32" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $WIN32_LOCALES + do + xpi=win32-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. @@ -175,16 +205,6 @@ script: | popd fi - # - pushd "Tor Browser"/Browser/browser/ - unzip omni.ja defaults/preferences/000-tor-browser.js - cp defaults/preferences/000-tor-browser.js ~/build/ - # Set the locale bundle. - echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js - zip -Xm omni.ja defaults/preferences/000-tor-browser.js - rm -rf defaults - popd - # # Recreate precomplete file (needs to be accurate for full MAR updates). pushd "Tor Browser"/Browser/ rm -f precomplete

1 0

[tor-browser-bundle/master] Bug 18915: Use our search plugins in localized builds
by gk＠torproject.org 11 May '16

11 May '16

commit 94c6a1c73291f8f456249d9719de57ff002fe6fe Author: Georg Koppen <gk(a)torproject.org> Date: Wed May 11 19:37:29 2016 +0000 Bug 18915: Use our search plugins in localized builds We are preparing the language packs we ship for using our search engines in the order we want. This is necessary due to https://bugzilla.mozilla.org/show_bug.cgi?id=1162569. --- gitian/descriptors/linux/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/mac/gitian-bundle.yml | 19 +++++++++++++ gitian/descriptors/windows/gitian-bundle.yml | 40 +++++++++++++++++++++------- 3 files changed, 68 insertions(+), 10 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index d5aaec4..39ad811 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -194,6 +194,10 @@ script: | cp -a ${TB_STAGE_DIR} ${PKG_DIR} # pushd ${PKG_DIR}/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. @@ -204,6 +208,21 @@ script: | # unzip linux-langpacks.zip LINUX_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_LINUX" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $LINUX_LOCALES + do + xpi=linux-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done # If we are building a multi-lingual package, add all of the language packs. if [ "z$MULTI_LINGUAL" = "z1" ]; then pushd linux-langpacks diff --git a/gitian/descriptors/mac/gitian-bundle.yml b/gitian/descriptors/mac/gitian-bundle.yml index 00cd4d1..ff17520 100644 --- a/gitian/descriptors/mac/gitian-bundle.yml +++ b/gitian/descriptors/mac/gitian-bundle.yml @@ -213,6 +213,10 @@ script: | cd .. # pushd $TORBROWSER_NAME.app/Contents/Resources/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome unzip omni.ja defaults/preferences/000-tor-browser.js cp defaults/preferences/000-tor-browser.js ~/build/ if [ "z$DATA_OUTSIDE_APP_DIR" = "z1" ]; then @@ -245,6 +249,21 @@ script: | unzip mac-langpacks.zip MAC_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_MAC" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $MAC_LOCALES + do + xpi=mac-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. diff --git a/gitian/descriptors/windows/gitian-bundle.yml b/gitian/descriptors/windows/gitian-bundle.yml index 4fe4bb6..da65142 100644 --- a/gitian/descriptors/windows/gitian-bundle.yml +++ b/gitian/descriptors/windows/gitian-bundle.yml @@ -161,8 +161,38 @@ script: | cp ../versions "Tor Browser"/Browser/TorBrowser/Docs/sources/ cp ../bundle.inputs "Tor Browser"/Browser/TorBrowser/Docs/sources/ + # + pushd "Tor Browser"/Browser/browser/ + # For the proper search engines in our language packs + unzip omni.ja chrome/en-US/locale/browser/searchplugins* + mv chrome/en-US/locale/browser/searchplugins ~/build + rm -rf chrome + unzip omni.ja defaults/preferences/000-tor-browser.js + cp defaults/preferences/000-tor-browser.js ~/build/ + # Set the locale bundle. + echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + zip -Xm omni.ja defaults/preferences/000-tor-browser.js + rm -rf defaults + popd + # + unzip ../win32-langpacks.zip WIN32_LOCALES="$BUNDLE_LOCALES $BUNDLE_LOCALES_WIN32" + # Prepare our language packs for using the proper search engines. See bug + # 18915 for more details. + for LANG in $WIN32_LOCALES + do + xpi=win32-langpacks/$LANG.xpi + unzip -d prep_$LANG $xpi + search_plugins_path=prep_$LANG/browser/chrome/$LANG/locale/browser + rm -rf $search_plugins_path/searchplugins + cp -rf ~/build/searchplugins $search_plugins_path + rm $xpi + cd prep_$LANG + zip -r9 ../$xpi * + cd .. + rm -rf prep_$LANG + done PKG_LOCALE="en-US" # If we are building a multi-lingual package, add all of the language packs # and use "ALL" in the package name and as the locale for update purposes. @@ -184,16 +214,6 @@ script: | popd fi - # - pushd "Tor Browser"/Browser/browser/ - unzip omni.ja defaults/preferences/000-tor-browser.js - cp defaults/preferences/000-tor-browser.js ~/build/ - # Set the locale bundle. - echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js - zip -Xm omni.ja defaults/preferences/000-tor-browser.js - rm -rf defaults - popd - # # Recreate precomplete file (needs to be accurate for full MAR updates). pushd "Tor Browser"/Browser/ rm -f precomplete

1 0

[tor-browser-bundle/hardened-builds] Bug 18976: Remove some FTE bridges
by gk＠torproject.org 11 May '16

11 May '16

commit 076028da65ee8d4785b65f818e7f8c19bf9e3f0b Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 9 07:53:06 2016 +0000 Bug 18976: Remove some FTE bridges --- Bundle-Data/PTConfigs/bridge_prefs.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 390d7a5..379f256 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,15 +8,10 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); -pref("extensions.torlauncher.default_bridge.fte.3", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); -pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); -pref("extensions.torlauncher.default_bridge.fte.5", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); -pref("extensions.torlauncher.default_bridge.fte.6", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); - -pref("extensions.torlauncher.default_bridge.fte-ipv6.1", "fte [2001:49f0:d002:1::2]:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1::c]:80 2BD466989944867075E872310EBAD65BC88C8AEF"); +pref("extensions.torlauncher.default_bridge.fte.1", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); +pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); +pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); +pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH");

1 0

[tor-browser-bundle/master] Bug 18976: Remove some FTE bridges
by gk＠torproject.org 11 May '16

11 May '16

commit bd2d6d501e88599a86b7a55a23f1731c0ec6ed74 Author: Georg Koppen <gk(a)torproject.org> Date: Mon May 9 07:53:06 2016 +0000 Bug 18976: Remove some FTE bridges --- Bundle-Data/PTConfigs/bridge_prefs.js | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 390d7a5..379f256 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -8,15 +8,10 @@ pref("extensions.torlauncher.default_bridge.obfs3.3", "obfs3 169.229.59.75:46328 pref("extensions.torlauncher.default_bridge.obfs3.4", "obfs3 109.105.109.163:38980 1E05F577A0EC0213F971D81BF4D86A9E4E8229ED"); pref("extensions.torlauncher.default_bridge.obfs3.5", "obfs3 109.105.109.163:47779 4C331FA9B3D1D6D8FB0D8FBBF0C259C360D97E6A"); -pref("extensions.torlauncher.default_bridge.fte.1", "fte 192.240.101.106:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte.2", "fte 50.7.176.114:80 2BD466989944867075E872310EBAD65BC88C8AEF"); -pref("extensions.torlauncher.default_bridge.fte.3", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); -pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); -pref("extensions.torlauncher.default_bridge.fte.5", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); -pref("extensions.torlauncher.default_bridge.fte.6", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); - -pref("extensions.torlauncher.default_bridge.fte-ipv6.1", "fte [2001:49f0:d002:1::2]:80 FDC5BA65D93B6BCA5EBDF8EF8E4FA936B7F1F8E5"); -pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1::c]:80 2BD466989944867075E872310EBAD65BC88C8AEF"); +pref("extensions.torlauncher.default_bridge.fte.1", "fte 131.252.210.150:8080 0E858AC201BF0F3FA3C462F64844CBFFC7297A42"); +pref("extensions.torlauncher.default_bridge.fte.2", "fte 128.105.214.161:8080 1E326AAFB3FCB515015250D8FCCC8E37F91A153B"); +pref("extensions.torlauncher.default_bridge.fte.3", "fte 128.105.214.162:8080 FC562097E1951DCC41B7D7F324D88157119BB56D"); +pref("extensions.torlauncher.default_bridge.fte.4", "fte 128.105.214.163:8080 A17A40775FBD2CA1184BF80BFC330A77ECF9D0E9"); pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH");

1 0