- tbb-commits - lists.torproject.org

[tor-browser-bundle/maint-4.0] 4.0.8 will be incremental from 4.0.6 only, since 4.0.7 thinks its 4.0.6.
by mikeperry＠torproject.org 08 Apr '15

08 Apr '15

commit d4e10e98af5237ed21796a4d48c3e09db6994959 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 8 11:27:06 2015 -0700 4.0.8 will be incremental from 4.0.6 only, since 4.0.7 thinks its 4.0.6. --- tools/update-responses/config.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 7d5c391..3470616 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -6,13 +6,13 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - release: 4.0.7 + release: 4.0.8 alpha: 4.5-alpha-2 versions: - 4.0.7: + 4.0.8: platformVersion: 31.6.0 detailsURL: https://www.torproject.org/projects/torbrowser.html.en - download_url: https://www.torproject.org/dist/torbrowser/4.0.7 + download_url: https://www.torproject.org/dist/torbrowser/4.0.8 incremental_from: - 4.0.6 4.5-alpha-2:

1 0

[tor-browser-bundle/maint-4.0] Update changelog and versions for 4.0.8.
by mikeperry＠torproject.org 08 Apr '15

08 Apr '15

commit 41f93db41d60f7ecc036e9916c9af1dbcda7c7d5 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 8 11:18:31 2015 -0700 Update changelog and versions for 4.0.8. --- Bundle-Data/Docs/ChangeLog.txt | 4 ++++ gitian/versions | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index c0630a0..9df5a76 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,7 @@ +Tor Browser 4.0.8 -- Apr 10 2015 + * All Platforms + * Bug 15637: Fix update loop + Tor Browser 4.0.7 -- Apr 9 2015 * All Platforms * Update Tor to 0.2.5.12 diff --git a/gitian/versions b/gitian/versions index 121fc41..78e5414 100755 --- a/gitian/versions +++ b/gitian/versions @@ -1,4 +1,4 @@ -TORBROWSER_VERSION=4.0.7 +TORBROWSER_VERSION=4.0.8 BUNDLE_LOCALES="ar de es-ES fa fr it ko nl pl pt-PT ru tr vi zh-CN" BUILD_PT_BUNDLES=1

1 0

[tor-browser-bundle/maint-4.0] Update NoScript once again.
by mikeperry＠torproject.org 07 Apr '15

07 Apr '15

commit 9edd486bd6f83fdbd2fd7a43966ccabd39a0a552 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Apr 7 14:17:36 2015 -0700 Update NoScript once again. --- Bundle-Data/Docs/ChangeLog.txt | 2 +- gitian/versions | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index eb89707..c0630a0 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,7 +1,7 @@ Tor Browser 4.0.7 -- Apr 9 2015 * All Platforms * Update Tor to 0.2.5.12 - * Update NoScript to 2.6.9.20 + * Update NoScript to 2.6.9.21 Tor Browser 4.0.6 -- Mar 31 2015 * All Platforms diff --git a/gitian/versions b/gitian/versions index 7e280c5..121fc41 100755 --- a/gitian/versions +++ b/gitian/versions @@ -53,7 +53,7 @@ GO_VER=1.3.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.20-sm+fn+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.21-sm+fn+fx.xpi HTTPSE_PACKAGE=https-everywhere-${HTTPSE_VER}.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz @@ -81,7 +81,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=daa2ac5e23728cd9d5fd39130673422b054b45d0d55237c08276e73fb3740bfe +NOSCRIPT_HASH=165704af79afb609dcb8d9eeb525be90a31e17a0b577f508b624c9098fd15c4c HTTPSE_HASH=30891fc7bd73213a4d8386c44fc53ab8037c9ec3d4b90caefbe6a7558ef7ac2c MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/maint-4.0] Update the update_responses config for 4.0.7.
by mikeperry＠torproject.org 07 Apr '15

07 Apr '15

commit d24e8e313966f03ffef11752a57a3158d8f947bf Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Apr 7 12:21:23 2015 -0700 Update the update_responses config for 4.0.7. --- tools/update-responses/config.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 682f5cc..7d5c391 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -6,16 +6,15 @@ build_targets: osx32: Darwin_x86-gcc3 osx64: Darwin_x86_64-gcc3 channels: - release: 4.0.6 + release: 4.0.7 alpha: 4.5-alpha-2 versions: - 4.0.6: + 4.0.7: platformVersion: 31.6.0 detailsURL: https://www.torproject.org/projects/torbrowser.html.en - download_url: https://www.torproject.org/dist/torbrowser/4.0.6 + download_url: https://www.torproject.org/dist/torbrowser/4.0.7 incremental_from: - - 4.0.4 - - 4.0.5 + - 4.0.6 4.5-alpha-2: platformVersion: 31.3.0 detailsURL: https://www.torproject.org/projects/torbrowser.html.en

1 0

[tor-browser-bundle/maint-4.0] Prep 4.0.7 for Tor update.
by mikeperry＠torproject.org 07 Apr '15

07 Apr '15

commit 7a7f2b736c41882a6e9dbd6a911490771b5ea97a Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Apr 6 23:52:09 2015 -0700 Prep 4.0.7 for Tor update. --- Bundle-Data/Docs/ChangeLog.txt | 5 +++++ gitian/versions | 8 ++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index e7707cb..eb89707 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,8 @@ +Tor Browser 4.0.7 -- Apr 9 2015 + * All Platforms + * Update Tor to 0.2.5.12 + * Update NoScript to 2.6.9.20 + Tor Browser 4.0.6 -- Mar 31 2015 * All Platforms * Update Firefox to 31.6.0esr diff --git a/gitian/versions b/gitian/versions index 5d41491..7e280c5 100755 --- a/gitian/versions +++ b/gitian/versions @@ -1,4 +1,4 @@ -TORBROWSER_VERSION=4.0.6 +TORBROWSER_VERSION=4.0.7 BUNDLE_LOCALES="ar de es-ES fa fr it ko nl pl pt-PT ru tr vi zh-CN" BUILD_PT_BUNDLES=1 @@ -9,7 +9,7 @@ FIREFOX_VERSION=31.6.0esr TORBROWSER_UPDATE_CHANNEL=release TORBROWSER_TAG=tor-browser-${FIREFOX_VERSION}-4.0-1-build1 -TOR_TAG=tor-0.2.5.11 +TOR_TAG=tor-0.2.5.12 TORLAUNCHER_TAG=0.2.7.0.2 TORBUTTON_TAG=1.7.0.2 HTTPSE_TAG=3.5.3 # XXX: HTTPSE_VER is used instead, pending #11630 @@ -53,7 +53,7 @@ GO_VER=1.3.3 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.19-fx+fn+sm.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.20-sm+fn+fx.xpi HTTPSE_PACKAGE=https-everywhere-${HTTPSE_VER}.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz @@ -81,7 +81,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=2579b91fb2f5491a12c49e543a9d2b2583dc82e2393ce1b0ab92b170dcc7c6ad +NOSCRIPT_HASH=daa2ac5e23728cd9d5fd39130673422b054b45d0d55237c08276e73fb3740bfe HTTPSE_HASH=30891fc7bd73213a4d8386c44fc53ab8037c9ec3d4b90caefbe6a7558ef7ac2c MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[torbutton/master] Bug #14429, Part 2. Run quantizer only once per window
by gk＠torproject.org 06 Apr '15

06 Apr '15

commit 046bce076aea058e41dfc05e7949429bdf800a2b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Sun Mar 29 23:09:27 2015 -0700 Bug #14429, Part 2. Run quantizer only once per window --- src/chrome/content/content-sizer.js | 14 ++++++-------- src/chrome/content/torbutton.js | 2 +- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/src/chrome/content/content-sizer.js b/src/chrome/content/content-sizer.js index af6bc80..f3710f7 100644 --- a/src/chrome/content/content-sizer.js +++ b/src/chrome/content/content-sizer.js @@ -5,10 +5,10 @@ /* jshint esnext: true */ -// __quantizeBrowserSizeOnLoad(window, xStep, yStep)__. -// Once a window is fully loaded, ensures that gBrowser width and height are multiples of +// __quantizeBrowserSize(window, xStep, yStep)__. +// Ensures that gBrowser width and height are multiples of // xStep and yStep. -let quantizeBrowserSizeOnLoad = function (window, xStep, yStep) { +let quantizeBrowserSize = function (window, xStep, yStep) { // Use Task.jsm to avoid callback hell. Cu.import("resource://gre/modules/Task.jsm"); @@ -247,7 +247,7 @@ let updateDimensions = function (gBrowser, xStep, yStep) { // __quantizeBrowserSizeNow(window, xStep, yStep)__. // Ensures that gBrowser width and height are multiples of xStep and yStep, and always as // large as possible inside the chrome window. -let quantizeBrowserSizeNow = function (window, xStep, yStep) { +let quantizeBrowserSizeMain = function (window, xStep, yStep) { let gBrowser = window.gBrowser, container = window.gBrowser.parentElement, updater = event => updateDimensions(gBrowser, xStep, yStep), @@ -278,9 +278,7 @@ let quantizeBrowserSizeNow = function (window, xStep, yStep) { bindPrefAndInit("extensions.torbutton.resize_windows", activate); }; -let onLoad = () => quantizeBrowserSizeNow(window, xStep, yStep); -window.gBrowser.addEventListener("load", onLoad, true); -return () => window.gBrowser.removeEventListener("load", onLoad, true); +quantizeBrowserSizeMain(window, xStep, yStep); -// quantizeBrowserSizeOnLoad +// quantizeBrowserSize }; diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index c071ec3..7d6486f 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -636,7 +636,7 @@ function torbutton_init() { createTorCircuitDisplay(m_tb_control_host, m_tb_control_port, m_tb_control_pass, "extensions.torbutton.display_circuit"); - quantizeBrowserSizeOnLoad(window, 200, 100); + quantizeBrowserSize(window, 200, 100); torbutton_log(3, 'init completed'); }

1 0

[torbutton/master] use correct function name
by gk＠torproject.org 06 Apr '15

06 Apr '15

commit c16e185af35ea05b0612e1453541fb6cadd5111b Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Apr 2 17:44:51 2015 -0700 use correct function name --- src/chrome/content/torbutton.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 44f62aa..ffa214f 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2221,7 +2221,7 @@ function torbutton_update_thirdparty_prefs() { m_tb_prefs.setIntPref("network.cookie.cookieBehavior", 0); } - pref("security.enable_tls_session_tickets", !mode); + m_tb_prefs.setBoolPref("security.enable_tls_session_tickets", !mode); // Force prefs to be synced to disk var prefService = Components.classes["@mozilla.org/preferences-service;1"]

1 0

[torbutton/master] Bug 15562: Bind SharedWorkers to thirdparty pref
by gk＠torproject.org 06 Apr '15

06 Apr '15

commit d8d7f2a0d36407d1461666487238b2321e506db4 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Apr 2 17:47:05 2015 -0700 Bug 15562: Bind SharedWorkers to thirdparty pref --- src/chrome/content/torbutton.js | 1 + 1 file changed, 1 insertion(+) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index ffa214f..c071ec3 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2221,6 +2221,7 @@ function torbutton_update_thirdparty_prefs() { m_tb_prefs.setIntPref("network.cookie.cookieBehavior", 0); } + m_tb_prefs.setBoolPref("dom.workers.sharedWorkers.enabled", !mode); m_tb_prefs.setBoolPref("security.enable_tls_session_tickets", !mode); // Force prefs to be synced to disk

1 0

[tor-browser/tor-browser-31.6.0esr-4.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 06 Apr '15

06 Apr '15

commit ff924f41b59068793d0785229619c33a2baa10ff Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Thu Apr 2 15:14:37 2015 -0700 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 0198b98..13bcf8e 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -95,6 +95,7 @@ pref("network.http.spdy.enabled", false); // Stores state and may have keepalive pref("network.http.spdy.enabled.v2", false); // Seems redundant, but just in case pref("network.http.spdy.enabled.v3", false); // Seems redundant, but just in case pref("privacy.thirdparty.isolate", 2); // Always enforce third party isolation +pref("dom.workers.sharedWorkers.enabled", false); // See https://bugs.torproject.org/15562 // Proxy and proxy security pref("network.proxy.socks", "127.0.0.1");

1 0

[torbutton/master] Bug 15533: Restore default security level
by gk＠torproject.org 02 Apr '15

02 Apr '15

commit 4f230f0344aa622de506766f65f4584e319ca49e Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 1 12:30:33 2015 +0000 Bug 15533: Restore default security level We changed the position of the security levels ("High" is now on top and "Low" on bottom) but forgot to adapt the logic responsible for restoring the default one (i.e. "Low"). --- src/chrome/content/preferences.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/preferences.js b/src/chrome/content/preferences.js index be77793..1ac89da 100644 --- a/src/chrome/content/preferences.js +++ b/src/chrome/content/preferences.js @@ -458,7 +458,7 @@ function torbutton_prefs_reset_defaults() { // Resetting the Security Slider preferences o_torprefs.setBoolPref('security_custom', false); - o_torprefs.setIntPref('security_slider', 1); + o_torprefs.setIntPref('security_slider', 4); chrome.torbutton_update_security_slider(); torbutton_log(4, "Preferences reset to defaults");

1 0

[tor-browser-bundle/master] Correct the 4.0.6 changelog entry.
by mikeperry＠torproject.org 31 Mar '15

31 Mar '15

commit f0e347d9bc11e0de91350fadc2e7e703e2380e17 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 31 13:56:51 2015 -0700 Correct the 4.0.6 changelog entry. --- Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 0292d82..056caf3 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -52,6 +52,7 @@ Tor Browser 4.0.6 -- Mar 31 2015 * All Platforms * Update Firefox to 31.6.0esr * Update meek to 0.16 + * Update OpenSSL to 1.0.1m Tor Browser 4.0.5 -- Mar 23 2015 * All Platforms

1 0

[torbutton/master] Fix small typo in comment
by gk＠torproject.org 31 Mar '15

31 Mar '15

commit fc0c8ed76346f2bb0b4d139ca444cbc404df5d07 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Mar 31 07:33:51 2015 +0000 Fix small typo in comment --- src/modules/tor-control-port.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index e4c7d16..de9f10a 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -606,7 +606,7 @@ event.messageToData = function (type, message) { // __event.watchEvent(controlSocket, type, filter, onData)__. // Watches for a particular type of event. If filter(data) returns true, the event's -// data is pass to the onData callback. Returns a zero arg function that +// data is passed to the onData callback. Returns a zero arg function that // stops watching the event. event.watchEvent = function (controlSocket, type, filter, onData) { return controlSocket.addNotificationCallback(new RegExp("^650." + type, "i"),

1 0

[torbutton/master] Bug #15510: Detach event watchers when finished
by gk＠torproject.org 31 Mar '15

31 Mar '15

commit f0e1d504dbf57f0c0041ae14f32a5a092a8a1afe Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Mar 30 14:50:27 2015 -0700 Bug #15510: Detach event watchers when finished --- src/chrome/content/tor-circuit-display.js | 15 +++++++++++---- src/modules/tor-control-port.js | 10 +++++----- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/chrome/content/tor-circuit-display.js b/src/chrome/content/tor-circuit-display.js index 917f1f0..4197944 100644 --- a/src/chrome/content/tor-circuit-display.js +++ b/src/chrome/content/tor-circuit-display.js @@ -129,7 +129,7 @@ let getCircuitStatusByID = function* (aController, circuitID) { // corresponding circuit. Whenever the first stream on a new circuit is seen, // looks up u+p and records the node data in the credentialsToNodeDataMap. let collectIsolationData = function (aController) { - aController.watchEvent( + return aController.watchEvent( "STREAM", streamEvent => streamEvent.StreamStatus === "SENTCONNECT", streamEvent => Task.spawn(function* () { @@ -313,10 +313,13 @@ let syncDisplayWithSelectedTab = (function() { // A reference to this function (called createTorCircuitDisplay) is exported as a global. let setupDisplay = function (host, port, password, enablePrefName) { let myController = null, + stopCollectingIsolationData = null, stop = function() { if (myController) { syncDisplayWithSelectedTab(false); - myController.close(); + if (stopCollectingIsolationData) { + stopCollectingIsolationData(); + } myController = null; } }, @@ -326,16 +329,20 @@ let setupDisplay = function (host, port, password, enablePrefName) { // An error has occurred. logger.eclog(5, err); logger.eclog(5, "Disabling tor display circuit because of an error."); + myController.close(); stop(); }); syncDisplayWithSelectedTab(true); - collectIsolationData(myController); + stopCollectingIsolationData = collectIsolationData(myController); } }; try { let unbindPref = bindPrefAndInit(enablePrefName, on => { if (on) start(); else stop(); }); // When this chrome window is unloaded, we need to unbind the pref. - window.addEventListener("unload", unbindPref); + window.addEventListener("unload", function () { + unbindPref(); + stop(); + }); } catch (e) { logger.eclog(5, "Error: " + e.message + "\n" + e.stack); } diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index 710643e..e4c7d16 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -606,9 +606,10 @@ event.messageToData = function (type, message) { // __event.watchEvent(controlSocket, type, filter, onData)__. // Watches for a particular type of event. If filter(data) returns true, the event's -// data is pass to the onData callback. +// data is pass to the onData callback. Returns a zero arg function that +// stops watching the event. event.watchEvent = function (controlSocket, type, filter, onData) { - controlSocket.addNotificationCallback(new RegExp("^650." + type, "i"), + return controlSocket.addNotificationCallback(new RegExp("^650." + type, "i"), function (message) { let data = event.messageToData(type, message); if (filter === null || filter(data)) { @@ -635,9 +636,8 @@ tor.controller = function (host, port, password, onError) { return { getInfo : key => info.getInfo(socket, key), getInfoMultiple : keys => info.getInfoMultiple(socket, keys), getConf : key => info.getConf(socket, key), - watchEvent : function (type, filter, onData) { - event.watchEvent(socket, type, filter, onData); - }, + watchEvent : (type, filter, onData) => + event.watchEvent(socket, type, filter, onData), isOpen : () => isOpen, close : () => { isOpen = false; socket.close(); } };

1 0

[torbutton/master] Bug #15472: Make node text black in circuit status UI.
by gk＠torproject.org 30 Mar '15

30 Mar '15

commit 6f5b6ea7b976c678ac1032378653f3dc286582e0 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri Mar 27 20:34:34 2015 -0700 Bug #15472: Make node text black in circuit status UI. --- src/chrome/skin/tor-circuit-display.css | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/chrome/skin/tor-circuit-display.css b/src/chrome/skin/tor-circuit-display.css index 004a68f..fc18f05 100644 --- a/src/chrome/skin/tor-circuit-display.css +++ b/src/chrome/skin/tor-circuit-display.css @@ -1,16 +1,16 @@ /* -This CSS file is for styling the tor circuit display. It consists of a title, +This CSS file is for styling the tor circuit display, which consists of a title, a domain, and a bulleted list. Each bullet in the circuit node list is supposed to represent a Tor circuit node, and lines drawn between them to represent Tor network inter-relay connections. -CSS for line between bullets is Derived in part from https://jsfiddle.net/5JP8Q/ - -Color the background to make circuit display distinct from the rest of popup. +CSS for line between bullets is derived in part from https://jsfiddle.net/5JP8Q/ */ -/* The circuit-display div encloses all other HTML elements. */ +/* The circuit-display div encloses all other HTML elements. + Color the background to make circuit display distinct + from the rest of the popup. */ div#circuit-display { background-color: #e8f4f4; font-family: Arial; @@ -40,6 +40,7 @@ div#circuit-display p#domain { ul#circuit-nodes { font-family: Arial; font-size: 14px; + color: black; margin-top: 8px; padding-left: 8px; padding-right: 8px;

1 0

[torbutton/master] Fix word order on security slider notification.
by mikeperry＠torproject.org 28 Mar '15

28 Mar '15

commit 71e3da38a123fed8c240311f3aec90fd632234a3 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 17:12:53 2015 -0700 Fix word order on security slider notification. Sorry, translators :/. --- src/chrome/locale/en/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/locale/en/torbutton.properties b/src/chrome/locale/en/torbutton.properties index ef1723e..ca048df 100644 --- a/src/chrome/locale/en/torbutton.properties +++ b/src/chrome/locale/en/torbutton.properties @@ -55,7 +55,7 @@ torbutton.popup.confirm_plugins = Plugins such as Flash can harm your privacy an torbutton.popup.never_ask_again = Never ask me again torbutton.popup.confirm_newnym = Tor Browser will close all windows and tabs. All website sessions will be lost.\n\nRestart Tor Browser now to reset your identity?\n\n -torbutton.slider_notification = The green onion menu has now a security slider which lets you adjust your security level. Check it out! +torbutton.slider_notification = The green onion menu now has a security slider which lets you adjust your security level. Check it out! torbutton.slider_notification_button = Open security settings torbutton.maximize_warning = Maximizing Tor Browser can allow websites to determine your monitor size, which can be used to track you. We recommend that you leave Tor Browser windows in their original default size.

1 0

[tor-browser-bundle/master] Actually include NoScript 2.6.9.19.
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit 73447ce681adb4f9e4f9d08c44b8ed47dd3e327c Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 14:31:11 2015 -0700 Actually include NoScript 2.6.9.19. --- gitian/versions.alpha | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/versions.alpha b/gitian/versions.alpha index 5c9ffb9..6976ea8 100755 --- a/gitian/versions.alpha +++ b/gitian/versions.alpha @@ -58,7 +58,7 @@ GO_VER=1.4.2 ## File names for the source packages OPENSSL_PACKAGE=openssl-${OPENSSL_VER}.tar.gz GMP_PACKAGE=gmp-${GMP_VER}.tar.bz2 -NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.15-sm+fn+fx.xpi +NOSCRIPT_PACKAGE=noscript_security_suite-2.6.9.19-fx+fn+sm.xpi HTTPSE_PACKAGE=https-everywhere-${HTTPSE_VER}.xpi TOOLCHAIN4_PACKAGE=x86_64-apple-darwin10.tar.xz TOOLCHAIN4_OLD_PACKAGE=multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz @@ -87,7 +87,7 @@ GMP_HASH=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160 OSXSDK_HASH=6602d8d5ddb371fbc02e2a5967d9bd0cd7358d46f9417753c8234b923f2ea6fc TOOLCHAIN4_HASH=7b71bfe02820409b994c5c33a7eab81a81c72550f5da85ff7af70da3da244645 TOOLCHAIN4_OLD_HASH=65c1b2d302358a6b95a26c6828a66908a199276193bb0b268f2dcc1a997731e9 -NOSCRIPT_HASH=63d866458e0261d20b612193f8f446728c991dd488c59e49d8f927c63e7eb9b4 +NOSCRIPT_HASH=2579b91fb2f5491a12c49e543a9d2b2583dc82e2393ce1b0ab92b170dcc7c6ad HTTPSE_HASH=059b6141b200c18f5903550d0ee6bdec1e1b874b7e069d246466e77bf3a436c2 MSVCR100_HASH=1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067 PYCRYPTO_HASH=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c

1 0

[tor-browser-bundle/master] Bug 15482: Restrict circuit lifetime extension to SOCKS-auth streams.
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit 351ecc463ff860e617e690ec709e80ec76f0be53 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 13:01:45 2015 -0700 Bug 15482: Restrict circuit lifetime extension to SOCKS-auth streams. That way people's non-TBB activity won't be affected. --- gitian/patches/bug15482.patch | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/gitian/patches/bug15482.patch b/gitian/patches/bug15482.patch index 5250fe4..df8a156 100644 --- a/gitian/patches/bug15482.patch +++ b/gitian/patches/bug15482.patch @@ -1,29 +1,37 @@ -From a9c7e6dc3508e78f4b296e38603dd34174e2a14c Mon Sep 17 00:00:00 2001 +From 748414784f71126b093aa7466908e00f71a7b046 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)torproject.org> -Date: Thu, 26 Mar 2015 22:38:45 -0700 -Subject: [PATCH] Bug 15482: Don't abandon circuits that are still being used - by TBB. +Date: Fri, 27 Mar 2015 12:57:37 -0700 +Subject: [PATCH] Bug 15482: Don't abandon circuits that are still in use for + browsing. -Reset timestamp_dirty every time we get a new stream request so that circuits -are not abandoned while still in use. +Only applies to connections with SOCKS auth set, so that non-web Tor +activity is not affected. + +Simpler version of Nick's patch because the randomness worried me, and I'm not +otherwise sure why we want a max here. --- - src/or/circuituse.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) + src/or/circuituse.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c -index d0d31ad..fff46cd 100644 +index d0d31ad..6cce4bf 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c -@@ -2264,8 +2264,10 @@ connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, +@@ -2264,8 +2264,15 @@ connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT; - if (!circ->base_.timestamp_dirty) - circ->base_.timestamp_dirty = time(NULL); -+ /* For Tor Browser, we want to avoid surprising the user by giving up on -+ * circuits while they are still being used, so we always reset the -+ * dirtiness timestamp. */ -+ circ->base_.timestamp_dirty = time(NULL); ++ if (!circ->base_.timestamp_dirty) { ++ circ->base_.timestamp_dirty = approx_time(); ++ } else if ((conn->entry_cfg.isolation_flags & ISO_SOCKSAUTH) && ++ (conn->socks_request->usernamelen || ++ conn->socks_request->passwordlen)) { ++ /* When stream isolation is in use and controlled by an application ++ * we are willing to keep using the stream. */ ++ circ->base_.timestamp_dirty = approx_time(); ++ } pathbias_count_use_attempt(circ);

1 0

[torbutton/master] Fix 1.9.1.0 changelog
by gk＠torproject.org 27 Mar '15

27 Mar '15

commit 3fd6a708722a56c6ba283ba55417c99c768dbf03 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Mar 27 15:04:45 2015 +0000 Fix 1.9.1.0 changelog --- src/CHANGELOG | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/CHANGELOG b/src/CHANGELOG index e9b5c6b..e140ff5 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -16,7 +16,8 @@ * Bug 14937: Show meek and flashproxy bridges in tor circuit display * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges * Bug 13019: Change locale hiding pref to boolean - * Bug 7255: Warn users about maximizing windows (off by default) + * Bug 7255: Warn users about maximizing windows + * Bug 14631: Improve profile access error msgs (strings). 1.9.0.0 * Bug 13882: Fix display of bridges after bridge settings have been changed

1 0

[tor-browser-bundle/master] Fix the 4.5a5 changelog
by gk＠torproject.org 27 Mar '15

27 Mar '15

commit 089db12fdc4ebd18e3fa2d5e970f4c5f8843990e Author: Georg Koppen <gk(a)torproject.org> Date: Fri Mar 27 14:57:42 2015 +0000 Fix the 4.5a5 changelog --- Bundle-Data/Docs/ChangeLog.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f27632f..0292d82 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -27,6 +27,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges * Bug 13019: Change locale hiding pref to boolean * Bug 7255: Warn users about maximizing windows + * Bug 14631: Improve profile access error msgs (strings). * Pluggable Transport Dependency Updates: * Bug 15448: Use golang 1.4.2 for meek and obs4proxy * Bug 15265: Switch go.net repo to golang.org/x/net @@ -43,6 +44,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Bug 13375: Create a hybrid GUI/desktop/shell launcher wrapper * Bug 12468: Only print/write log messages if launched with --debug * Windows + * Bug 3861: Begin signing Tor Browser for Windows the Windows way * Bug 15201: Disable 'runas Administrator' codepaths in updater * Bug 14688: Create shortcuts to desktop and start menu by default (optional)

1 0

[tor-browser-bundle/master] HTTPS-Everywhere is so easy to forget. Maybe because it works so well?
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit be94df05ea2c58a34e4084b74b653f277a136a44 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Mar 27 00:03:17 2015 -0700 HTTPS-Everywhere is so easy to forget. Maybe because it works so well? --- Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 40833da..f27632f 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -4,6 +4,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Update OpenSSL to 1.0.1m * Update Tor to 0.2.6.6 * Update NoScript to 2.6.9.19 + * Update HTTPS-Everywhere to 5.0 * Update meek to 0.16 * Update Tor Launcher to 0.2.7.3 * Bug 13983: Directory search path fix for Tor Messanger+TorBirdy

1 0

[tor-browser-bundle/master] 4.5a5 changelog fixes.
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit 123c74449aac2419d5968fd0c736996ee946c628 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Mar 26 23:58:36 2015 -0700 4.5a5 changelog fixes. --- Bundle-Data/Docs/ChangeLog.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index ffea36a..40833da 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -25,11 +25,10 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Bug 14937: Show meek and flashproxy bridges in tor circuit display * Bugs 13891+15207: Fix exceptions/errors in circuit display with bridges * Bug 13019: Change locale hiding pref to boolean - * Bug 7255: Warn users about maximizing windows (off by default) + * Bug 7255: Warn users about maximizing windows * Pluggable Transport Dependency Updates: * Bug 15448: Use golang 1.4.2 for meek and obs4proxy * Bug 15265: Switch go.net repo to golang.org/x/net - * Bug 12535: Use a SOCKS5 listener instead of a SOCKS4a for goptlib * Bug 14937: Hard-code meek and flashproxy node fingerprints * Bug 13019: Prevent Javascript from leaking system locale * Bug 10280: Improved fix to prevent loading plugins into address space

1 0

[tor-browser-bundle/master] Revert "Bug 13766: Raise MaxCircuitDirtiness to 2 hours"
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit a6b594ee52905336419e8148a77f96cde6488c42 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Mar 26 23:09:54 2015 -0700 Revert "Bug 13766: Raise MaxCircuitDirtiness to 2 hours" This reverts commit 824116042a03683ae20fa6e7d0768d8fd6fd6f95. --- Bundle-Data/linux/Data/Tor/torrc-defaults | 1 - Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults | 1 - Bundle-Data/windows/Data/Tor/torrc-defaults | 1 - 3 files changed, 3 deletions(-) diff --git a/Bundle-Data/linux/Data/Tor/torrc-defaults b/Bundle-Data/linux/Data/Tor/torrc-defaults index e502356..819b9e8 100644 --- a/Bundle-Data/linux/Data/Tor/torrc-defaults +++ b/Bundle-Data/linux/Data/Tor/torrc-defaults @@ -8,4 +8,3 @@ Log notice stdout SocksPort 9150 ControlPort 9151 CookieAuthentication 1 -MaxCircuitDirtiness 7199 diff --git a/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults b/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults index e502356..819b9e8 100644 --- a/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults +++ b/Bundle-Data/mac/TorBrowser/Data/Tor/torrc-defaults @@ -8,4 +8,3 @@ Log notice stdout SocksPort 9150 ControlPort 9151 CookieAuthentication 1 -MaxCircuitDirtiness 7199 diff --git a/Bundle-Data/windows/Data/Tor/torrc-defaults b/Bundle-Data/windows/Data/Tor/torrc-defaults index e502356..819b9e8 100644 --- a/Bundle-Data/windows/Data/Tor/torrc-defaults +++ b/Bundle-Data/windows/Data/Tor/torrc-defaults @@ -8,4 +8,3 @@ Log notice stdout SocksPort 9150 ControlPort 9151 CookieAuthentication 1 -MaxCircuitDirtiness 7199

1 0

[tor-browser-bundle/master] Bug 15482: Don't surprise users with new circuits while a page is in use
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit f73953b08c7df47dc47a9c9d4aa16e794a156acf Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Mar 26 23:05:23 2015 -0700 Bug 15482: Don't surprise users with new circuits while a page is in use This patch resets timestamp_dirty every time a new stream is attached to a circuit. --- gitian/descriptors/linux/gitian-tor.yml | 3 +++ gitian/descriptors/mac/gitian-tor.yml | 3 +++ gitian/descriptors/windows/gitian-tor.yml | 3 +++ gitian/patches/bug15482.patch | 32 +++++++++++++++++++++++++++++ 4 files changed, 41 insertions(+) diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index 7338f2d..b218486 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -21,6 +21,7 @@ files: - "versions" - "bug8402-master.patch" - "bug8405.patch" +- "bug15482.patch" - "dzip.sh" - "openssl-linux32-utils.zip" - "openssl-linux64-utils.zip" @@ -80,6 +81,8 @@ script: | then git am ~/build/bug8405.patch git am ~/build/bug8402-master.patch + else + git am ~/build/bug15482.patch fi mkdir -p $OUTDIR/src #git archive HEAD | tar -x -C $OUTDIR/src diff --git a/gitian/descriptors/mac/gitian-tor.yml b/gitian/descriptors/mac/gitian-tor.yml index 08408f8..3d0e0c6 100644 --- a/gitian/descriptors/mac/gitian-tor.yml +++ b/gitian/descriptors/mac/gitian-tor.yml @@ -17,6 +17,7 @@ files: - "versions" - "bug8402-master.patch" - "bug8405.patch" +- "bug15482.patch" - "apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb" - "multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz" - "dzip.sh" @@ -58,6 +59,8 @@ script: | then git am ~/build/bug8405.patch git am ~/build/bug8402-master.patch + else + git am ~/build/bug15482.patch fi mkdir -p $OUTDIR/src #git archive HEAD | tar -x -C $OUTDIR/src diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index 7db511b..87e1dc2 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -17,6 +17,7 @@ files: - "versions" - "bug8402-master.patch" - "bug8405.patch" +- "bug15482.patch" - "binutils.tar.bz2" - "dzip.sh" - "mingw-w64-win32-utils.zip" @@ -58,6 +59,8 @@ script: | then git am ~/build/bug8405.patch git am ~/build/bug8402-master.patch + else + git am ~/build/bug15482.patch fi mkdir -p $OUTDIR/src #git archive HEAD | tar -x -C $OUTDIR/src diff --git a/gitian/patches/bug15482.patch b/gitian/patches/bug15482.patch new file mode 100644 index 0000000..5250fe4 --- /dev/null +++ b/gitian/patches/bug15482.patch @@ -0,0 +1,32 @@ +From a9c7e6dc3508e78f4b296e38603dd34174e2a14c Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Thu, 26 Mar 2015 22:38:45 -0700 +Subject: [PATCH] Bug 15482: Don't abandon circuits that are still being used + by TBB. + +Reset timestamp_dirty every time we get a new stream request so that circuits +are not abandoned while still in use. +--- + src/or/circuituse.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/or/circuituse.c b/src/or/circuituse.c +index d0d31ad..fff46cd 100644 +--- a/src/or/circuituse.c ++++ b/src/or/circuituse.c +@@ -2264,8 +2264,10 @@ connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, + + base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT; + +- if (!circ->base_.timestamp_dirty) +- circ->base_.timestamp_dirty = time(NULL); ++ /* For Tor Browser, we want to avoid surprising the user by giving up on ++ * circuits while they are still being used, so we always reset the ++ * dirtiness timestamp. */ ++ circ->base_.timestamp_dirty = time(NULL); + + pathbias_count_use_attempt(circ); + +-- +1.9.1 +

1 0

[tor-browser-bundle/master] Update changelog for 15482.
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit 8a99ab949e082f8782b062b21e3fbaca3fa428db Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Mar 26 23:09:08 2015 -0700 Update changelog for 15482. --- Bundle-Data/Docs/ChangeLog.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index f357766..ffea36a 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -38,7 +38,7 @@ Tor Browser 4.5a5 -- Mar 31 2015 * Bug 12827: Create preference to disable SVG images (for security slider) * Bug 13548: Create preference to disable MathML (for security slider) * Bug 14631: Improve startup error messages for filesystem permissions issues - * Bug 13766: Keep content window Tor circuits open for 2 hours + * Bug 15482: Don't allow circuits to change while a site is in use * Linux * Bug 13375: Create a hybrid GUI/desktop/shell launcher wrapper * Bug 12468: Only print/write log messages if launched with --debug

1 0

[tor-browser-bundle/master] Revert "Use a SOCKS5 listener instead of a SOCKS4a for goptlib."
by mikeperry＠torproject.org 27 Mar '15

27 Mar '15

commit b45bf02c7559eecebf0924e507a4b2137e7042e6 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Mar 26 23:29:39 2015 -0700 Revert "Use a SOCKS5 listener instead of a SOCKS4a for goptlib." This reverts commit 9d26e0009fc6a8e89a48db2a976097459f14f45e, which broke the build. --- .../linux/gitian-pluggable-transports.yml | 6 - .../mac/gitian-pluggable-transports.yml | 6 - .../windows/gitian-pluggable-transports.yml | 6 - gitian/patches/bug12535.patch | 1032 -------------------- 4 files changed, 1050 deletions(-) diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index 6adf16c..1ae9c0c 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -57,7 +57,6 @@ files: - "openssl-linux32-utils.zip" - "openssl-linux64-utils.zip" - "go.net.tar.bz2" -- "bug12535.patch" script: | INSTDIR="$HOME/install" PTDIR="$INSTDIR/Tor/PluggableTransports" @@ -209,11 +208,6 @@ script: | # Building goptlib cd goptlib - git update-index --refresh -q - export GIT_COMMITTER_NAME="nobody" - export GIT_COMMITTER_EMAIL="nobody@localhost" - export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" - git am ~/build/bug12535.patch find -type f | xargs touch --date="$REFERENCE_DATETIME" mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports" ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/goptlib.git" diff --git a/gitian/descriptors/mac/gitian-pluggable-transports.yml b/gitian/descriptors/mac/gitian-pluggable-transports.yml index d72ab44..e2693e1 100644 --- a/gitian/descriptors/mac/gitian-pluggable-transports.yml +++ b/gitian/descriptors/mac/gitian-pluggable-transports.yml @@ -53,7 +53,6 @@ files: - "multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz" - "dzip.sh" - "go.net.tar.bz2" -- "bug12535.patch" - "gmp-mac64-utils.zip" - "openssl-mac64-utils.zip" script: | @@ -235,11 +234,6 @@ script: | # Building goptlib cd goptlib - git update-index --refresh -q - export GIT_COMMITTER_NAME="nobody" - export GIT_COMMITTER_EMAIL="nobody@localhost" - export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" - git am ~/build/bug12535.patch find -type f | xargs touch --date="$REFERENCE_DATETIME" mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports" ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/goptlib.git" diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index 0b0b5db..0f5ec84 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -60,7 +60,6 @@ files: - "gmp-win32-utils.zip" - "gcclibs-win32-utils.zip" - "go.net.tar.bz2" -- "bug12535.patch" script: | # Set the timestamp on every .pyc file in a zip file, and re-dzip the zip file. function py2exe_zip_timestomp { @@ -311,11 +310,6 @@ script: | # Building goptlib cd goptlib - git update-index --refresh -q - export GIT_COMMITTER_NAME="nobody" - export GIT_COMMITTER_EMAIL="nobody@localhost" - export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" - git am ~/build/bug12535.patch find -type f | xargs touch --date="$REFERENCE_DATETIME" mkdir -p "$GOPATH/src/git.torproject.org/pluggable-transports" ln -sf "$PWD" "$GOPATH/src/git.torproject.org/pluggable-transports/goptlib.git" diff --git a/gitian/patches/bug12535.patch b/gitian/patches/bug12535.patch deleted file mode 100644 index dae6818..0000000 --- a/gitian/patches/bug12535.patch +++ /dev/null @@ -1,1032 +0,0 @@ -From 743ae58b6c33dda837ffb1267867f564597dd59d Mon Sep 17 00:00:00 2001 -From: Yawning Angel <yawning(a)schwanenlied.me> -Date: Mon, 8 Sep 2014 18:24:08 +0000 -Subject: [PATCH] Replace the SOCKS4a listener with a SOCKS5 listener. - -The change is designed to be transparent to calling code and implements -enough of RFC1928/RFC1929 such that pluggable transports can be written. - -Notable incompatibilities/limitations: - * GSSAPI authentication is not supported. - * BND.ADDR/BND.PORT in responses is always "0.0.0.0:0" instead of the - bound address/port of the outgoing socket. - * RFC1929 Username/Password authentication is setup exclusively for - pluggable transport arguments. - * The BIND and UDP ASSOCIATE commands are not supported. ---- - pt.go | 5 +- - socks.go | 386 +++++++++++++++++++++++++++++++++++++------- - socks_test.go | 510 +++++++++++++++++++++++++++++++++++++++++----------------- - 3 files changed, 685 insertions(+), 216 deletions(-) - -diff --git a/pt.go b/pt.go -index 62dfc38..47f8273 100644 ---- a/pt.go -+++ b/pt.go -@@ -119,10 +119,11 @@ - // Extended ORPort Authentication: - // https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/217-ext-orpo…. - // --// The package implements a SOCKS4a server sufficient for a Tor client transport -+// The package implements a SOCKS5 server sufficient for a Tor client transport - // plugin. - // --// http://ftp.icm.edu.pl/packages/socks/socks4/SOCKS4.protocol -+// https://www.ietf.org/rfc/rfc1928.txt -+// https://www.ietf.org/rfc/rfc1929.txt - package pt - - import ( -diff --git a/socks.go b/socks.go -index 6ad6542..e4488e8 100644 ---- a/socks.go -+++ b/socks.go -@@ -9,11 +9,40 @@ import ( - ) - - const ( -- socksVersion = 0x04 -- socksCmdConnect = 0x01 -- socksResponseVersion = 0x00 -- socksRequestGranted = 0x5a -- socksRequestRejected = 0x5b -+ socksVersion = 0x05 -+ -+ socksAuthNoneRequired = 0x00 -+ socksAuthUsernamePassword = 0x02 -+ socksAuthNoAcceptableMethods = 0xff -+ -+ socksCmdConnect = 0x01 -+ socksRsv = 0x00 -+ -+ socksAtypeV4 = 0x01 -+ socksAtypeDomainName = 0x03 -+ socksAtypeV6 = 0x04 -+ -+ socksAuthRFC1929Ver = 0x01 -+ socksAuthRFC1929Success = 0x00 -+ socksAuthRFC1929Fail = 0x01 -+ -+ socksRepSucceeded = 0x00 -+ // "general SOCKS server failure" -+ SocksRepGeneralFailure = 0x01 -+ // "connection not allowed by ruleset" -+ SocksRepConnectionNotAllowed = 0x02 -+ // "Network unreachable" -+ SocksRepNetworkUnreachable = 0x03 -+ // "Host unreachable" -+ SocksRepHostUnreachable = 0x04 -+ // "Connection refused" -+ SocksRepConnectionRefused = 0x05 -+ // "TTL expired" -+ SocksRepTTLExpired = 0x06 -+ // "Command not supported" -+ SocksRepCommandNotSupported = 0x07 -+ // "Address type not supported" -+ SocksRepAddressNotSupported = 0x08 - ) - - // Put a sanity timeout on how long we wait for a SOCKS request. -@@ -25,6 +54,8 @@ type SocksRequest struct { - Target string - // The userid string sent by the client. - Username string -+ // The password string sent by the client. -+ Password string - // The parsed contents of Username as a key–value mapping. - Args Args - } -@@ -36,15 +67,23 @@ type SocksConn struct { - } - - // Send a message to the proxy client that access to the given address is --// granted. If the IP field inside addr is not an IPv4 address, the IP portion --// of the response will be four zero bytes. -+// granted. Addr is ignored, and "0.0.0.0:0" is always sent back for -+// BND.ADDR/BND.PORT in the SOCKS response. - func (conn *SocksConn) Grant(addr *net.TCPAddr) error { -- return sendSocks4aResponseGranted(conn, addr) -+ return sendSocks5ResponseGranted(conn) - } - --// Send a message to the proxy client that access was rejected or failed. -+// Send a message to the proxy client that access was rejected or failed. This -+// sends back a "General Failure" error code. RejectReason should be used if -+// more specific error reporting is desired. - func (conn *SocksConn) Reject() error { -- return sendSocks4aResponseRejected(conn) -+ return conn.RejectReason(SocksRepGeneralFailure) -+} -+ -+// Send a message to the proxy client that access was rejected, with the -+// specific error code indicating the reason behind the rejection. -+func (conn *SocksConn) RejectReason(reason byte) error { -+ return sendSocks5ResponseRejected(conn, reason) - } - - // SocksListener wraps a net.Listener in order to read a SOCKS request on Accept. -@@ -138,7 +177,7 @@ func (ln *SocksListener) AcceptSocks() (*SocksConn, error) { - if err != nil { - return nil, err - } -- conn.Req, err = readSocks4aConnect(conn) -+ conn.Req, err = socks5Handshake(conn) - if err != nil { - conn.Close() - return nil, err -@@ -150,58 +189,251 @@ func (ln *SocksListener) AcceptSocks() (*SocksConn, error) { - return conn, nil - } - --// Returns "socks4", suitable to be included in a call to Cmethod. -+// Returns "socks5", suitable to be included in a call to Cmethod. - func (ln *SocksListener) Version() string { -- return "socks4" -+ return "socks5" - } - --// Read a SOCKS4a connect request. Returns a SocksRequest. --func readSocks4aConnect(s io.Reader) (req SocksRequest, err error) { -- r := bufio.NewReader(s) -+// socks5handshake conducts the SOCKS5 handshake up to the point where the -+// client command is read and the proxy must open the outgoing connection. -+// Returns a SocksRequest. -+func socks5Handshake(s io.ReadWriter) (req SocksRequest, err error) { -+ rw := bufio.NewReadWriter(bufio.NewReader(s), bufio.NewWriter(s)) - -- var h [8]byte -- _, err = io.ReadFull(r, h[:]) -- if err != nil { -+ // Negotiate the authentication method. -+ var method byte -+ if method, err = socksNegotiateAuth(rw); err != nil { - return - } -- if h[0] != socksVersion { -- err = fmt.Errorf("SOCKS header had version 0x%02x, not 0x%02x", h[0], socksVersion) -+ -+ // Authenticate the client. -+ if err = socksAuthenticate(rw, method, &req); err != nil { - return - } -- if h[1] != socksCmdConnect { -- err = fmt.Errorf("SOCKS header had command 0x%02x, not 0x%02x", h[1], socksCmdConnect) -+ -+ // Read the command. -+ err = socksReadCommand(rw, &req) -+ return -+} -+ -+// socksNegotiateAuth negotiates the authentication method and returns the -+// selected method as a byte. On negotiation failures an error is returned. -+func socksNegotiateAuth(rw *bufio.ReadWriter) (method byte, err error) { -+ // Validate the version. -+ if err = socksReadByteVerify(rw, "version", socksVersion); err != nil { - return - } - -- var usernameBytes []byte -- usernameBytes, err = r.ReadBytes('\x00') -- if err != nil { -+ // Read the number of methods. -+ var nmethods byte -+ if nmethods, err = socksReadByte(rw); err != nil { - return - } -- req.Username = string(usernameBytes[:len(usernameBytes)-1]) - -- req.Args, err = parseClientParameters(req.Username) -- if err != nil { -+ // Read the methods. -+ var methods []byte -+ if methods, err = socksReadBytes(rw, int(nmethods)); err != nil { - return - } - -- var port int -- var host string -+ // Pick the most "suitable" method. -+ method = socksAuthNoAcceptableMethods -+ for _, m := range methods { -+ switch m { -+ case socksAuthNoneRequired: -+ // Pick Username/Password over None if the client happens to -+ // send both. -+ if method == socksAuthNoAcceptableMethods { -+ method = m -+ } -+ -+ case socksAuthUsernamePassword: -+ method = m -+ } -+ } -+ -+ // Send the negotiated method. -+ var msg [2]byte -+ msg[0] = socksVersion -+ msg[1] = method -+ if _, err = rw.Writer.Write(msg[:]); err != nil { -+ return -+ } -+ -+ if err = socksFlushBuffers(rw); err != nil { -+ return -+ } -+ return -+} -+ -+// socksAuthenticate authenticates the client via the chosen authentication -+// mechanism. -+func socksAuthenticate(rw *bufio.ReadWriter, method byte, req *SocksRequest) (err error) { -+ switch method { -+ case socksAuthNoneRequired: -+ // Straight into reading the connect. - -- port = int(h[2])<<8 | int(h[3])<<0 -- if h[4] == 0 && h[5] == 0 && h[6] == 0 && h[7] != 0 { -- var hostBytes []byte -- hostBytes, err = r.ReadBytes('\x00') -- if err != nil { -+ case socksAuthUsernamePassword: -+ if err = socksAuthRFC1929(rw, req); err != nil { - return - } -- host = string(hostBytes[:len(hostBytes)-1]) -+ -+ case socksAuthNoAcceptableMethods: -+ err = fmt.Errorf("SOCKS method select had no compatible methods") -+ return -+ -+ default: -+ err = fmt.Errorf("SOCKS method select picked a unsupported method 0x%02x", method) -+ return -+ } -+ -+ if err = socksFlushBuffers(rw); err != nil { -+ return -+ } -+ return -+} -+ -+// socksAuthRFC1929 authenticates the client via RFC 1929 username/password -+// auth. As a design decision any valid username/password is accepted as this -+// field is primarily used as an out-of-band argument passing mechanism for -+// pluggable transports. -+func socksAuthRFC1929(rw *bufio.ReadWriter, req *SocksRequest) (err error) { -+ sendErrResp := func() { -+ // Swallow the write/flush error here, we are going to close the -+ // connection and the original failure is more useful. -+ resp := []byte{socksAuthRFC1929Ver, socksAuthRFC1929Fail} -+ rw.Write(resp[:]) -+ socksFlushBuffers(rw) -+ } -+ -+ // Validate the fixed parts of the command message. -+ if err = socksReadByteVerify(rw, "auth version", socksAuthRFC1929Ver); err != nil { -+ sendErrResp() -+ return -+ } -+ -+ // Read the username. -+ var ulen byte -+ if ulen, err = socksReadByte(rw); err != nil { -+ return -+ } -+ if ulen < 1 { -+ sendErrResp() -+ err = fmt.Errorf("RFC1929 username with 0 length") -+ return -+ } -+ var uname []byte -+ if uname, err = socksReadBytes(rw, int(ulen)); err != nil { -+ return -+ } -+ req.Username = string(uname) -+ -+ // Read the password. -+ var plen byte -+ if plen, err = socksReadByte(rw); err != nil { -+ return -+ } -+ if plen < 1 { -+ sendErrResp() -+ err = fmt.Errorf("RFC1929 password with 0 length") -+ return -+ } -+ var passwd []byte -+ if passwd, err = socksReadBytes(rw, int(plen)); err != nil { -+ return -+ } -+ if !(plen == 1 && passwd[0] == 0x00) { -+ // tor will set the password to 'NUL' if there are no arguments. -+ req.Password = string(passwd) -+ } -+ -+ // Mash the username/password together and parse it as a pluggable -+ // transport argument string. -+ if req.Args, err = parseClientParameters(req.Username + req.Password); err != nil { -+ sendErrResp() - } else { -- host = net.IPv4(h[4], h[5], h[6], h[7]).String() -+ resp := []byte{socksAuthRFC1929Ver, socksAuthRFC1929Success} -+ _, err = rw.Write(resp[:]) -+ } -+ return -+} -+ -+// socksReadCommand reads a SOCKS5 client command and parses out the relevant -+// fields into a SocksRequest. Only CMD_CONNECT is supported. -+func socksReadCommand(rw *bufio.ReadWriter, req *SocksRequest) (err error) { -+ sendErrResp := func(reason byte) { -+ // Swallow errors that occur when writing/flushing the response, -+ // connection will be closed anyway. -+ sendSocks5ResponseRejected(rw, reason) -+ socksFlushBuffers(rw) -+ } -+ -+ // Validate the fixed parts of the command message. -+ if err = socksReadByteVerify(rw, "version", socksVersion); err != nil { -+ sendErrResp(SocksRepGeneralFailure) -+ return -+ } -+ if err = socksReadByteVerify(rw, "command", socksCmdConnect); err != nil { -+ sendErrResp(SocksRepCommandNotSupported) -+ return -+ } -+ if err = socksReadByteVerify(rw, "reserved", socksRsv); err != nil { -+ sendErrResp(SocksRepGeneralFailure) -+ return -+ } -+ -+ // Read the destination address/port. -+ // XXX: This should probably eventually send socks 5 error messages instead -+ // of rudely closing connections on invalid addresses. -+ var atype byte -+ if atype, err = socksReadByte(rw); err != nil { -+ return -+ } -+ var host string -+ switch atype { -+ case socksAtypeV4: -+ var addr []byte -+ if addr, err = socksReadBytes(rw, net.IPv4len); err != nil { -+ return -+ } -+ host = net.IPv4(addr[0], addr[1], addr[2], addr[3]).String() -+ -+ case socksAtypeDomainName: -+ var alen byte -+ if alen, err = socksReadByte(rw); err != nil { -+ return -+ } -+ if alen == 0 { -+ err = fmt.Errorf("SOCKS request had domain name with 0 length") -+ return -+ } -+ var addr []byte -+ if addr, err = socksReadBytes(rw, int(alen)); err != nil { -+ return -+ } -+ host = string(addr) -+ -+ case socksAtypeV6: -+ var rawAddr []byte -+ if rawAddr, err = socksReadBytes(rw, net.IPv6len); err != nil { -+ return -+ } -+ addr := make(net.IP, net.IPv6len) -+ copy(addr[:], rawAddr[:]) -+ host = fmt.Sprintf("[%s]", addr.String()) -+ -+ default: -+ sendErrResp(SocksRepAddressNotSupported) -+ err = fmt.Errorf("SOCKS request had unsupported address type 0x%02x", atype) -+ return - } -+ var rawPort []byte -+ if rawPort, err = socksReadBytes(rw, 2); err != nil { -+ return -+ } -+ port := int(rawPort[0])<<8 | int(rawPort[1])<<0 - -- if r.Buffered() != 0 { -- err = fmt.Errorf("%d bytes left after SOCKS header", r.Buffered()) -+ if err = socksFlushBuffers(rw); err != nil { - return - } - -@@ -209,34 +441,64 @@ func readSocks4aConnect(s io.Reader) (req SocksRequest, err error) { - return - } - --// Send a SOCKS4a response with the given code and address. If the IP field --// inside addr is not an IPv4 address, the IP portion of the response will be --// four zero bytes. --func sendSocks4aResponse(w io.Writer, code byte, addr *net.TCPAddr) error { -- var resp [8]byte -- resp[0] = socksResponseVersion -+// Send a SOCKS5 response with the given code. BND.ADDR/BND.PORT is always the -+// IPv4 address/port "0.0.0.0:0". -+func sendSocks5Response(w io.Writer, code byte) error { -+ resp := make([]byte, 4+4+2) -+ resp[0] = socksVersion - resp[1] = code -- resp[2] = byte((addr.Port >> 8) & 0xff) -- resp[3] = byte((addr.Port >> 0) & 0xff) -- ipv4 := addr.IP.To4() -- if ipv4 != nil { -- resp[4] = ipv4[0] -- resp[5] = ipv4[1] -- resp[6] = ipv4[2] -- resp[7] = ipv4[3] -- } -+ resp[2] = socksRsv -+ resp[3] = socksAtypeV4 -+ -+ // BND.ADDR/BND.PORT should be the address and port that the outgoing -+ // connection is bound to on the proxy, but Tor does not use this -+ // information, so all zeroes are sent. -+ - _, err := w.Write(resp[:]) - return err - } - --var emptyAddr = net.TCPAddr{IP: net.IPv4(0, 0, 0, 0), Port: 0} -+// Send a SOCKS5 response code 0x00. -+func sendSocks5ResponseGranted(w io.Writer) error { -+ return sendSocks5Response(w, socksRepSucceeded) -+} - --// Send a SOCKS4a response code 0x5a. --func sendSocks4aResponseGranted(w io.Writer, addr *net.TCPAddr) error { -- return sendSocks4aResponse(w, socksRequestGranted, addr) -+// Send a SOCKS5 response with the provided failure reason. -+func sendSocks5ResponseRejected(w io.Writer, reason byte) error { -+ return sendSocks5Response(w, reason) - } - --// Send a SOCKS4a response code 0x5b (with an all-zero address). --func sendSocks4aResponseRejected(w io.Writer) error { -- return sendSocks4aResponse(w, socksRequestRejected, &emptyAddr) -+func socksFlushBuffers(rw *bufio.ReadWriter) error { -+ if err := rw.Writer.Flush(); err != nil { -+ return err -+ } -+ if rw.Reader.Buffered() > 0 { -+ return fmt.Errorf("%d bytes left after SOCKS message", rw.Reader.Buffered()) -+ } -+ return nil -+} -+ -+func socksReadByte(rw *bufio.ReadWriter) (byte, error) { -+ return rw.Reader.ReadByte() -+} -+ -+func socksReadBytes(rw *bufio.ReadWriter, n int) ([]byte, error) { -+ ret := make([]byte, n) -+ if _, err := io.ReadFull(rw.Reader, ret); err != nil { -+ return nil, err -+ } -+ return ret, nil - } -+ -+func socksReadByteVerify(rw *bufio.ReadWriter, descr string, expected byte) error { -+ val, err := socksReadByte(rw) -+ if err != nil { -+ return err -+ } -+ if val != expected { -+ return fmt.Errorf("SOCKS message field %s was 0x%02x, not 0x%02x", descr, val, expected) -+ } -+ return nil -+} -+ -+var _ net.Listener = (*SocksListener)(nil) -diff --git a/socks_test.go b/socks_test.go -index 18d141a..aa27d4c 100644 ---- a/socks_test.go -+++ b/socks_test.go -@@ -1,162 +1,368 @@ - package pt - - import ( -+ "bufio" - "bytes" -+ "encoding/hex" -+ "io" - "net" - "testing" - ) - --func TestReadSocks4aConnect(t *testing.T) { -- badTests := [...][]byte{ -- []byte(""), -- // missing userid -- []byte("\x04\x01\x12\x34\x01\x02\x03\x04"), -- // missing \x00 after userid -- []byte("\x04\x01\x12\x34\x01\x02\x03\x04key=value"), -- // missing hostname -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00"), -- // missing \x00 after hostname -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00hostname"), -- // bad name–value mapping -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01userid\x00hostname\x00"), -- // bad version number -- []byte("\x03\x01\x12\x34\x01\x02\x03\x04\x00"), -- // BIND request -- []byte("\x04\x02\x12\x34\x01\x02\x03\x04\x00"), -- // SOCKS5 -- []byte("\x05\x01\x00"), -- } -- ipTests := [...]struct { -- input []byte -- addr net.TCPAddr -- userid string -- }{ -- { -- []byte("\x04\x01\x12\x34\x01\x02\x03\x04key=value\x00"), -- net.TCPAddr{IP: net.ParseIP("1.2.3.4"), Port: 0x1234}, -- "key=value", -- }, -- { -- []byte("\x04\x01\x12\x34\x01\x02\x03\x04\x00"), -- net.TCPAddr{IP: net.ParseIP("1.2.3.4"), Port: 0x1234}, -- "", -- }, -- } -- hostnameTests := [...]struct { -- input []byte -- target string -- userid string -- }{ -- { -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00hostname\x00"), -- "hostname:4660", -- "key=value", -- }, -- { -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01\x00hostname\x00"), -- "hostname:4660", -- "", -- }, -- { -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01key=value\x00\x00"), -- ":4660", -- "key=value", -- }, -- { -- []byte("\x04\x01\x12\x34\x00\x00\x00\x01\x00\x00"), -- ":4660", -- "", -- }, -- } -- -- for _, input := range badTests { -- var buf bytes.Buffer -- buf.Write(input) -- _, err := readSocks4aConnect(&buf) -- if err == nil { -- t.Errorf("%q unexpectedly succeeded", input) -- } -- } -- -- for _, test := range ipTests { -- var buf bytes.Buffer -- buf.Write(test.input) -- req, err := readSocks4aConnect(&buf) -- if err != nil { -- t.Errorf("%q unexpectedly returned an error: %s", test.input, err) -- } -- addr, err := net.ResolveTCPAddr("tcp", req.Target) -- if err != nil { -- t.Errorf("%q → target %q: cannot resolve: %s", test.input, -- req.Target, err) -- } -- if !tcpAddrsEqual(addr, &test.addr) { -- t.Errorf("%q → address %s (expected %s)", test.input, -- req.Target, test.addr.String()) -- } -- if req.Username != test.userid { -- t.Errorf("%q → username %q (expected %q)", test.input, -- req.Username, test.userid) -- } -- if req.Args == nil { -- t.Errorf("%q → unexpected nil Args from username %q", test.input, req.Username) -- } -- } -- -- for _, test := range hostnameTests { -- var buf bytes.Buffer -- buf.Write(test.input) -- req, err := readSocks4aConnect(&buf) -- if err != nil { -- t.Errorf("%q unexpectedly returned an error: %s", test.input, err) -- } -- if req.Target != test.target { -- t.Errorf("%q → target %q (expected %q)", test.input, -- req.Target, test.target) -- } -- if req.Username != test.userid { -- t.Errorf("%q → username %q (expected %q)", test.input, -- req.Username, test.userid) -- } -- if req.Args == nil { -- t.Errorf("%q → unexpected nil Args from username %q", test.input, req.Username) -- } -- } --} -- --func TestSendSocks4aResponse(t *testing.T) { -- tests := [...]struct { -- code byte -- addr net.TCPAddr -- expected []byte -- }{ -- { -- socksRequestGranted, -- net.TCPAddr{IP: net.ParseIP("1.2.3.4"), Port: 0x1234}, -- []byte("\x00\x5a\x12\x34\x01\x02\x03\x04"), -- }, -- { -- socksRequestRejected, -- net.TCPAddr{IP: net.ParseIP("1:2::3:4"), Port: 0x1234}, -- []byte("\x00\x5b\x12\x34\x00\x00\x00\x00"), -- }, -- } -- -- for _, test := range tests { -- var buf bytes.Buffer -- err := sendSocks4aResponse(&buf, test.code, &test.addr) -- if err != nil { -- t.Errorf("0x%02x %s unexpectedly returned an error: %s", test.code, &test.addr, err) -- } -- p := make([]byte, 1024) -- n, err := buf.Read(p) -- if err != nil { -- t.Fatal(err) -- } -- output := p[:n] -- if !bytes.Equal(output, test.expected) { -- t.Errorf("0x%02x %s → %v (expected %v)", -- test.code, &test.addr, output, test.expected) -- } -+// testReadWriter is a bytes.Buffer backed io.ReadWriter used for testing. The -+// Read and Write routines are to be used by the component being tested. Data -+// can be written to and read back via the writeHex and readHex routines. -+type testReadWriter struct { -+ readBuf bytes.Buffer -+ writeBuf bytes.Buffer -+} -+ -+func (c *testReadWriter) Read(buf []byte) (n int, err error) { -+ return c.readBuf.Read(buf) -+} -+ -+func (c *testReadWriter) Write(buf []byte) (n int, err error) { -+ return c.writeBuf.Write(buf) -+} -+ -+func (c *testReadWriter) writeHex(str string) (n int, err error) { -+ var buf []byte -+ if buf, err = hex.DecodeString(str); err != nil { -+ return -+ } -+ return c.readBuf.Write(buf) -+} -+ -+func (c *testReadWriter) readHex() string { -+ return hex.EncodeToString(c.writeBuf.Bytes()) -+} -+ -+func (c *testReadWriter) toBufio() *bufio.ReadWriter { -+ return bufio.NewReadWriter(bufio.NewReader(c), bufio.NewWriter(c)) -+} -+ -+func (c *testReadWriter) reset() { -+ c.readBuf.Reset() -+ c.writeBuf.Reset() -+} -+ -+// TestAuthInvalidVersion tests auth negotiation with an invalid version. -+func TestAuthInvalidVersion(t *testing.T) { -+ c := new(testReadWriter) -+ -+ // VER = 03, NMETHODS = 01, METHODS = [00] -+ c.writeHex("030100") -+ if _, err := socksNegotiateAuth(c.toBufio()); err == nil { -+ t.Error("socksNegotiateAuth(InvalidVersion) succeded") -+ } -+} -+ -+// TestAuthInvalidNMethods tests auth negotiaton with no methods. -+func TestAuthInvalidNMethods(t *testing.T) { -+ c := new(testReadWriter) -+ var err error -+ var method byte -+ -+ // VER = 05, NMETHODS = 00 -+ c.writeHex("0500") -+ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { -+ t.Error("socksNegotiateAuth(No Methods) failed:", err) -+ } -+ if method != socksAuthNoAcceptableMethods { -+ t.Error("socksNegotiateAuth(No Methods) picked unexpected method:", method) -+ } -+ if msg := c.readHex(); msg != "05ff" { -+ t.Error("socksNegotiateAuth(No Methods) invalid response:", msg) -+ } -+} -+ -+// TestAuthNoneRequired tests auth negotiaton with NO AUTHENTICATION REQUIRED. -+func TestAuthNoneRequired(t *testing.T) { -+ c := new(testReadWriter) -+ var err error -+ var method byte -+ -+ // VER = 05, NMETHODS = 01, METHODS = [00] -+ c.writeHex("050100") -+ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { -+ t.Error("socksNegotiateAuth(None) failed:", err) -+ } -+ if method != socksAuthNoneRequired { -+ t.Error("socksNegotiateAuth(None) unexpected method:", method) -+ } -+ if msg := c.readHex(); msg != "0500" { -+ t.Error("socksNegotiateAuth(None) invalid response:", msg) -+ } -+} -+ -+// TestAuthUsernamePassword tests auth negotiation with USERNAME/PASSWORD. -+func TestAuthUsernamePassword(t *testing.T) { -+ c := new(testReadWriter) -+ var err error -+ var method byte -+ -+ // VER = 05, NMETHODS = 01, METHODS = [02] -+ c.writeHex("050102") -+ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { -+ t.Error("socksNegotiateAuth(UsernamePassword) failed:", err) -+ } -+ if method != socksAuthUsernamePassword { -+ t.Error("socksNegotiateAuth(UsernamePassword) unexpected method:", method) -+ } -+ if msg := c.readHex(); msg != "0502" { -+ t.Error("socksNegotiateAuth(UsernamePassword) invalid response:", msg) - } - } -+ -+// TestAuthBoth tests auth negotiation containing both NO AUTHENTICATION -+// REQUIRED and USERNAME/PASSWORD. -+func TestAuthBoth(t *testing.T) { -+ c := new(testReadWriter) -+ var err error -+ var method byte -+ -+ // VER = 05, NMETHODS = 02, METHODS = [00, 02] -+ c.writeHex("05020002") -+ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { -+ t.Error("socksNegotiateAuth(Both) failed:", err) -+ } -+ if method != socksAuthUsernamePassword { -+ t.Error("socksNegotiateAuth(Both) unexpected method:", method) -+ } -+ if msg := c.readHex(); msg != "0502" { -+ t.Error("socksNegotiateAuth(Both) invalid response:", msg) -+ } -+} -+ -+// TestAuthUnsupported tests auth negotiation with a unsupported method. -+func TestAuthUnsupported(t *testing.T) { -+ c := new(testReadWriter) -+ var err error -+ var method byte -+ -+ // VER = 05, NMETHODS = 01, METHODS = [01] (GSSAPI) -+ c.writeHex("050101") -+ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { -+ t.Error("socksNegotiateAuth(Unknown) failed:", err) -+ } -+ if method != socksAuthNoAcceptableMethods { -+ t.Error("socksNegotiateAuth(Unknown) picked unexpected method:", method) -+ } -+ if msg := c.readHex(); msg != "05ff" { -+ t.Error("socksNegotiateAuth(Unknown) invalid response:", msg) -+ } -+} -+ -+// TestAuthUnsupported2 tests auth negotiation with supported and unsupported -+// methods. -+func TestAuthUnsupported2(t *testing.T) { -+ c := new(testReadWriter) -+ var err error -+ var method byte -+ -+ // VER = 05, NMETHODS = 03, METHODS = [00,01,02] -+ c.writeHex("0503000102") -+ if method, err = socksNegotiateAuth(c.toBufio()); err != nil { -+ t.Error("socksNegotiateAuth(Unknown2) failed:", err) -+ } -+ if method != socksAuthUsernamePassword { -+ t.Error("socksNegotiateAuth(Unknown2) picked unexpected method:", method) -+ } -+ if msg := c.readHex(); msg != "0502" { -+ t.Error("socksNegotiateAuth(Unknown2) invalid response:", msg) -+ } -+} -+ -+// TestRFC1929InvalidVersion tests RFC1929 auth with an invalid version. -+func TestRFC1929InvalidVersion(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 03, ULEN = 5, UNAME = "ABCDE", PLEN = 5, PASSWD = "abcde" -+ c.writeHex("03054142434445056162636465") -+ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { -+ t.Error("socksAuthenticate(InvalidVersion) succeded") -+ } -+ if msg := c.readHex(); msg != "0101" { -+ t.Error("socksAuthenticate(InvalidVersion) invalid response:", msg) -+ } -+} -+ -+// TestRFC1929InvalidUlen tests RFC1929 auth with an invalid ULEN. -+func TestRFC1929InvalidUlen(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 01, ULEN = 0, UNAME = "", PLEN = 5, PASSWD = "abcde" -+ c.writeHex("0100056162636465") -+ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { -+ t.Error("socksAuthenticate(InvalidUlen) succeded") -+ } -+ if msg := c.readHex(); msg != "0101" { -+ t.Error("socksAuthenticate(InvalidUlen) invalid response:", msg) -+ } -+} -+ -+// TestRFC1929InvalidPlen tests RFC1929 auth with an invalid PLEN. -+func TestRFC1929InvalidPlen(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 01, ULEN = 5, UNAME = "ABCDE", PLEN = 0, PASSWD = "" -+ c.writeHex("0105414243444500") -+ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { -+ t.Error("socksAuthenticate(InvalidPlen) succeded") -+ } -+ if msg := c.readHex(); msg != "0101" { -+ t.Error("socksAuthenticate(InvalidPlen) invalid response:", msg) -+ } -+} -+ -+// TestRFC1929InvalidArgs tests RFC1929 auth with invalid pt args. -+func TestRFC1929InvalidPTArgs(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 01, ULEN = 5, UNAME = "ABCDE", PLEN = 5, PASSWD = "abcde" -+ c.writeHex("01054142434445056162636465") -+ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err == nil { -+ t.Error("socksAuthenticate(InvalidArgs) succeded") -+ } -+ if msg := c.readHex(); msg != "0101" { -+ t.Error("socksAuthenticate(InvalidArgs) invalid response:", msg) -+ } -+} -+ -+// TestRFC1929Success tests RFC1929 auth with valid pt args. -+func TestRFC1929Success(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 01, ULEN = 9, UNAME = "key=value", PLEN = 1, PASSWD = "\0" -+ c.writeHex("01096b65793d76616c75650100") -+ if err := socksAuthenticate(c.toBufio(), socksAuthUsernamePassword, &req); err != nil { -+ t.Error("socksAuthenticate(Success) failed:", err) -+ } -+ if msg := c.readHex(); msg != "0100" { -+ t.Error("socksAuthenticate(Success) invalid response:", msg) -+ } -+ v, ok := req.Args.Get("key") -+ if v != "value" || !ok { -+ t.Error("RFC1929 k,v parse failure:", v) -+ } -+} -+ -+// TestRequestInvalidHdr tests SOCKS5 requests with invalid VER/CMD/RSV/ATYPE -+func TestRequestInvalidHdr(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 03, CMD = 01, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 -+ c.writeHex("030100017f000001235a") -+ if err := socksReadCommand(c.toBufio(), &req); err == nil { -+ t.Error("socksReadCommand(InvalidVer) succeded") -+ } -+ if msg := c.readHex(); msg != "05010001000000000000" { -+ t.Error("socksReadCommand(InvalidVer) invalid response:", msg) -+ } -+ c.reset() -+ -+ // VER = 05, CMD = 05, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 -+ c.writeHex("050500017f000001235a") -+ if err := socksReadCommand(c.toBufio(), &req); err == nil { -+ t.Error("socksReadCommand(InvalidCmd) succeded") -+ } -+ if msg := c.readHex(); msg != "05070001000000000000" { -+ t.Error("socksReadCommand(InvalidCmd) invalid response:", msg) -+ } -+ c.reset() -+ -+ // VER = 05, CMD = 01, RSV = 30, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 -+ c.writeHex("050130017f000001235a") -+ if err := socksReadCommand(c.toBufio(), &req); err == nil { -+ t.Error("socksReadCommand(InvalidRsv) succeded") -+ } -+ if msg := c.readHex(); msg != "05010001000000000000" { -+ t.Error("socksReadCommand(InvalidRsv) invalid response:", msg) -+ } -+ c.reset() -+ -+ // VER = 05, CMD = 01, RSV = 01, ATYPE = 05, DST.ADDR = 127.0.0.1, DST.PORT = 9050 -+ c.writeHex("050100057f000001235a") -+ if err := socksReadCommand(c.toBufio(), &req); err == nil { -+ t.Error("socksReadCommand(InvalidAtype) succeded") -+ } -+ if msg := c.readHex(); msg != "05080001000000000000" { -+ t.Error("socksAuthenticate(InvalidAtype) invalid response:", msg) -+ } -+ c.reset() -+} -+ -+// TestRequestIPv4 tests IPv4 SOCKS5 requests. -+func TestRequestIPv4(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 05, CMD = 01, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 -+ c.writeHex("050100017f000001235a") -+ if err := socksReadCommand(c.toBufio(), &req); err != nil { -+ t.Error("socksReadCommand(IPv4) failed:", err) -+ } -+ addr, err := net.ResolveTCPAddr("tcp", req.Target) -+ if err != nil { -+ t.Error("net.ResolveTCPAddr failed:", err) -+ } -+ if !tcpAddrsEqual(addr, &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 9050}) { -+ t.Error("Unexpected target:", addr) -+ } -+} -+ -+// TestRequestIPv6 tests IPv4 SOCKS5 requests. -+func TestRequestIPv6(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 05, CMD = 01, RSV = 00, ATYPE = 04, DST.ADDR = 0102:0304:0506:0708:090a:0b0c:0d0e:0f10, DST.PORT = 9050 -+ c.writeHex("050100040102030405060708090a0b0c0d0e0f10235a") -+ if err := socksReadCommand(c.toBufio(), &req); err != nil { -+ t.Error("socksReadCommand(IPv6) failed:", err) -+ } -+ addr, err := net.ResolveTCPAddr("tcp", req.Target) -+ if err != nil { -+ t.Error("net.ResolveTCPAddr failed:", err) -+ } -+ if !tcpAddrsEqual(addr, &net.TCPAddr{IP: net.ParseIP("0102:0304:0506:0708:090a:0b0c:0d0e:0f10"), Port: 9050}) { -+ t.Error("Unexpected target:", addr) -+ } -+} -+ -+// TestRequestFQDN tests FQDN (DOMAINNAME) SOCKS5 requests. -+func TestRequestFQDN(t *testing.T) { -+ c := new(testReadWriter) -+ var req SocksRequest -+ -+ // VER = 05, CMD = 01, RSV = 00, ATYPE = 04, DST.ADDR = example.com, DST.PORT = 9050 -+ c.writeHex("050100030b6578616d706c652e636f6d235a") -+ if err := socksReadCommand(c.toBufio(), &req); err != nil { -+ t.Error("socksReadCommand(FQDN) failed:", err) -+ } -+ if req.Target != "example.com:9050" { -+ t.Error("Unexpected target:", req.Target) -+ } -+} -+ -+// TestResponseNil tests nil address SOCKS5 responses. -+func TestResponseNil(t *testing.T) { -+ c := new(testReadWriter) -+ -+ b := c.toBufio() -+ if err := sendSocks5ResponseGranted(b); err != nil { -+ t.Error("sendSocks5ResponseGranted() failed:", err) -+ } -+ b.Flush() -+ if msg := c.readHex(); msg != "05000001000000000000" { -+ t.Error("sendSocks5ResponseGranted(nil) invalid response:", msg) -+ } -+} -+ -+var _ io.ReadWriter = (*testReadWriter)(nil) --- -2.3.3 -

1 0