- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-78.2.0esr-10.0-1] fixup! Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit 56cae1cf95d18c741ac3e71986e224a4a635a754 Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Sep 8 18:55:02 2020 +0200 fixup! Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop --- browser/components/BrowserGlue.jsm | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 901d18a6b414..057a2121533c 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -1343,9 +1343,10 @@ BrowserGlue.prototype = { const HTTPS_EVERYWHERE_ID = "https-everywhere-eff(a)eff.org"; const HTTPS_EVERYWHERE_BUILTIN_URL = "resource://torbutton/content/extensions/https-everywhere/"; - // This does something similar as GeckoViewWebExtension.jsm: it tries to load the manifest - // to retrieve the version of the builtin and compares it to the currently installed one to - // see whether we need to install or not. Here we delegate that to + // This does something similar as GeckoViewWebExtension.jsm: it tries + // to load the manifest to retrieve the version of the builtin and + // compares it to the currently installed one to see whether we need + // to install or not. Here we delegate that to // AddonManager.maybeInstallBuiltinAddon. try { const resolvedURI = Services.io.newURI(

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] fixup! Bug 4234: Use the Firefox Update Process for Tor Browser.
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit ecadb5d3fe53bdc13f2d582ff0f0673c37ad8e9c Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Sep 4 17:53:04 2020 +0200 fixup! Bug 4234: Use the Firefox Update Process for Tor Browser. --- tools/update-packaging/make_full_update.sh | 13 ---- tools/update-packaging/make_incremental_update.sh | 74 +---------------------- 2 files changed, 2 insertions(+), 85 deletions(-) diff --git a/tools/update-packaging/make_full_update.sh b/tools/update-packaging/make_full_update.sh index e41d7870a9a2..fcf143339a1c 100755 --- a/tools/update-packaging/make_full_update.sh +++ b/tools/update-packaging/make_full_update.sh @@ -71,19 +71,6 @@ fi list_files files list_symlinks symlinks symlink_targets -# TODO When TOR_BROWSER_DATA_OUTSIDE_APP_DIR is used on all platforms, -# we should remove the following lines (which remove entire directories -# which, if present, contain old, unpacked copies of HTTPS Everywhere): -# Make sure we delete the pre 5.1.0 HTTPS Everywhere as well in case it -# exists. The extension ID got changed with the version bump to 5.1.0. -ext_path='TorBrowser/Data/Browser/profile.default/extensions' -if [ -d "$ext_dir" ]; then - directories_to_remove="$ext_path/https-everywhere(a)eff.org $ext_path/https-everywhere-eff(a)eff.org" -else - directories_to_remove="" -fi -# END TOR_BROWSER_DATA_OUTSIDE_APP_DIR removal - popd # Add the type of update to the beginning of the update manifests. diff --git a/tools/update-packaging/make_incremental_update.sh b/tools/update-packaging/make_incremental_update.sh index 816384147dee..5ff620a667d5 100755 --- a/tools/update-packaging/make_incremental_update.sh +++ b/tools/update-packaging/make_incremental_update.sh @@ -68,21 +68,6 @@ check_for_forced_update() { ## "true" *giggle* return 0; fi - -# TODO When TOR_BROWSER_DATA_OUTSIDE_APP_DIR is used on all platforms, -# we should remove the following lines: - # If the file in the skip list ends with /*, do a prefix match. - # This allows TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff(a)eff.org/* - # to be used to force all HTTPS Everywhere files to be updated. - f_suffix=${f##*/} - if [[ $f_suffix = "*" ]]; then - f_prefix="${f%\/\*}"; - if [[ $forced_file_chk == $f_prefix* ]]; then - ## 0 means "true" - return 0; - fi - fi -# END TOR_BROWSER_DATA_OUTSIDE_APP_DIR removal done ## 'false'... because this is bash. Oh yay! return 1; @@ -134,12 +119,10 @@ archivefiles="updatev2.manifest updatev3.manifest" # TODO When TOR_BROWSER_DATA_OUTSIDE_APP_DIR is used on all platforms, # we should remove the following lines: -# If the NoScript or HTTPS Everywhere extensions have changed between -# releases, add them to the "force updates" list. +# If the NoScript extension has changed between +# releases, add it to the "force updates" list. ext_path='TorBrowser/Data/Browser/profile.default/extensions' if [ -d "$newdir/$ext_path" ]; then - https_everywhere_dir='https-everywhere-eff(a)eff.org' - https_everywhere_xpi='https-everywhere-eff(a)eff.org.xpi' noscript='{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi' # NoScript is a packed extension, so we simply compare the old and the new @@ -153,59 +136,6 @@ if [ -d "$newdir/$ext_path" ]; then elif [ $rc -eq 1 ]; then requested_forced_updates="$requested_forced_updates $noscript_path" fi - - # As of HTTPS Everywhere 5.1.0, the extension ID gained "-eff". - # As of HTTPS Everywhere 5.2.2, the extension is packed (i.e., it remains - # an .xpi after it is installed in the browser profile). - force_https_update=0 - remove_unpacked_https_e_dirs=0 - unpacked_https_e_install_rdf="$ext_path/$https_everywhere_dir/install.rdf" - packed_https_e_path="$ext_path/$https_everywhere_xpi" - if [ -d "$newdir/$ext_path/$https_everywhere_dir" ]; then - # The new HTTPS-E extension is unpacked, and presumably the old one is - # too. We need to determine if any of the unpacked files have changed. - # Since that is messy, we simply compare the old install.rdf file to the - # new one. - diff "$olddir/$unpacked_https_e_install_rdf" \ - "$newdir/$unpacked_https_e_install_rdf" > /dev/null - rc=$? - if [ $rc -gt 1 -a -e "$olddir/$unpacked_https_e_install_rdf" ]; then - notice "Unexpected exit $rc from $unpacked_https_e_install_rdf diff command" - exit 2 - elif [ $rc -ge 1 ]; then - force_https_update=1 - remove_unpacked_https_e_dirs=1 - # In case we still ship an unpacked HTTPS-E extension but the user has - # updated to a packed one, arrange for the packed one to be removed. - extra_files_to_remove="$extra_files_to_remove $packed_https_e_path" - fi - elif [ -d "$olddir/$ext_path/$https_everywhere_dir" ]; then - # The old HTTPS-E extension is unpacked but the new one is packed. - force_https_update=1 - remove_unpacked_https_e_dirs=1 - else - # Both the old and new HTTPS-E extensions are packed. In this case we can - # simply compare the .xpi files to determine if the extension has changed. - diff -a "$olddir/$packed_https_e_path" "$newdir/$packed_https_e_path" > /dev/null - rc=$? - if [ $rc -gt 1 ]; then - notice "Unexpected exit $rc from $packed_https_e_path diff command" - exit 2 - elif [ $rc -eq 1 ]; then - force_https_update=1 - fi - fi - - if [ $force_https_update -ne 0 ]; then - requested_forced_updates="$requested_forced_updates $ext_path/$https_everywhere_dir/* $packed_https_e_path" - if [ "$remove_unpacked_https_e_dirs" -ne 0 ]; then - # The old version was unpacked, so remove the entire directory to ensure - # that the replace is "clean." Also, make sure we delete the pre 5.1.0 - # HTTPS Everywhere as well in case it exists (the extension ID got - # changed with the version bump to 5.1.0). - directories_to_remove="$directories_to_remove $ext_path/https-everywhere(a)eff.org $ext_path/$https_everywhere_dir" - fi - fi fi # END TOR_BROWSER_DATA_OUTSIDE_APP_DIR removal

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] fixup! Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit a71b2382c0405e9c707b790de570672ec885750e Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Sep 8 18:52:34 2020 +0200 fixup! Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop --- toolkit/mozapps/extensions/internal/XPIProvider.jsm | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index d199ac48ecae..dc5362bce3d8 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -1491,9 +1491,14 @@ var XPIStates = { continue; } - // Uninstall non-builtin https-everywhere-eff extension. - if (id === "https-everywhere-eff(a)eff.org" && !loc.isBuiltin) { - logger.debug("Uninstalling the HTTPS Everywhere extension."); + // Uninstall HTTPS Everywhere if it is installed in the user profile. + if ( + id === "https-everywhere-eff(a)eff.org" && + loc.name === KEY_APP_PROFILE + ) { + logger.debug( + "Uninstalling the HTTPS Everywhere extension from user profile." + ); loc.installer.uninstallAddon(id); changed = true; continue;

1 0

[tor-browser/tor-browser-78.2.0esr-10.0-1] Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit 0062275ca3ac484d8005fa057a5a02eb76b42517 Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Sep 4 12:34:35 2020 +0200 Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop This loads HTTPS Everywhere as a builtin addon from a hardcoded resource:// URI in desktop. It also ensures that the non-builtin HTTPS Everywhere addon is always uninstalled on browser startup. The reason of making this desktop-only is that there are some issues when installing a builtin extension from geckoview side, making the extension not available on first startup. So, at least for now we handle the Fenix case separately. --- browser/components/BrowserGlue.jsm | 36 ++++++++++++++++++++++ .../mozapps/extensions/internal/XPIProvider.jsm | 8 +++++ 2 files changed, 44 insertions(+) diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index ec38d0ca8b33..901d18a6b414 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -56,6 +56,13 @@ XPCOMUtils.defineLazyServiceGetter( "nsIPushService" ); +XPCOMUtils.defineLazyServiceGetters(this, { + resProto: [ + "@mozilla.org/network/protocol;1?name=resource", + "nsISubstitutingProtocolHandler", + ], +}); + const PREF_PDFJS_ISDEFAULT_CACHE_STATE = "pdfjs.enabledCache.state"; /** @@ -675,6 +682,7 @@ XPCOMUtils.defineLazyModuleGetters(this, { "resource://gre/modules/ContextualIdentityService.jsm", Corroborate: "resource://gre/modules/Corroborate.jsm", Discovery: "resource:///modules/Discovery.jsm", + ExtensionData: "resource://gre/modules/Extension.jsm", ExtensionsUI: "resource:///modules/ExtensionsUI.jsm", FirefoxMonitor: "resource:///modules/FirefoxMonitor.jsm", FxAccounts: "resource://gre/modules/FxAccounts.jsm", @@ -1330,6 +1338,34 @@ BrowserGlue.prototype = { "resource:///modules/themes/dark/" ); + // Install https-everywhere builtin addon if needed. + (async () => { + const HTTPS_EVERYWHERE_ID = "https-everywhere-eff(a)eff.org"; + const HTTPS_EVERYWHERE_BUILTIN_URL = + "resource://torbutton/content/extensions/https-everywhere/"; + // This does something similar as GeckoViewWebExtension.jsm: it tries to load the manifest + // to retrieve the version of the builtin and compares it to the currently installed one to + // see whether we need to install or not. Here we delegate that to + // AddonManager.maybeInstallBuiltinAddon. + try { + const resolvedURI = Services.io.newURI( + resProto.resolveURI(Services.io.newURI(HTTPS_EVERYWHERE_BUILTIN_URL)) + ); + const extensionData = new ExtensionData(resolvedURI); + const manifest = await extensionData.loadManifest(); + + await AddonManager.maybeInstallBuiltinAddon( + HTTPS_EVERYWHERE_ID, + manifest.version, + HTTPS_EVERYWHERE_BUILTIN_URL + ); + } catch (e) { + const log = Log.repository.getLogger("HttpsEverywhereBuiltinLoader"); + log.addAppender(new Log.ConsoleAppender(new Log.BasicFormatter())); + log.error("Could not install https-everywhere extension", e); + } + })(); + if (AppConstants.MOZ_NORMANDY) { Normandy.init(); } diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm index 794c206fb453..d199ac48ecae 100644 --- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm @@ -1491,6 +1491,14 @@ var XPIStates = { continue; } + // Uninstall non-builtin https-everywhere-eff extension. + if (id === "https-everywhere-eff(a)eff.org" && !loc.isBuiltin) { + logger.debug("Uninstalling the HTTPS Everywhere extension."); + loc.installer.uninstallAddon(id); + changed = true; + continue; + } + let xpiState = loc.get(id); if (!xpiState) { // If the location is not supported for sideloading, skip new

1 0

[tor-browser-build/master] Bug 40073: Repack omni.ja to include builtin HTTPS Everywhere
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit 7e49b0e534b6880aa4241c66f670e17d739b645a Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Sep 8 00:45:49 2020 +0200 Bug 40073: Repack omni.ja to include builtin HTTPS Everywhere --- projects/tor-browser/build | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index 2763ce4..33a3f42 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -45,7 +45,6 @@ mkdir -p "$TBDIR/$EXTSPATH" unzip -d $rootdir $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip MARTOOLS=$rootdir/mar-tools -mv [% c('input_files_by_name/https-everywhere') %] "$TBDIR/$EXTSPATH/https-everywhere-eff(a)eff.org.xpi" mv [% c('input_files_by_name/noscript') %] "$TBDIR/$EXTSPATH/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi" tar -C "$TBDIR" -xf [% c('input_files_by_name/obfs4') %] @@ -74,6 +73,18 @@ RBM_TB_EOF [% END %] tar -C ${TB_STAGE_DIR} -xf [% c('input_files_by_name/firefox') %]/tor-browser.tar.gz + +# Make unpacked HTTPS Everywhere available in resource://torbutton/content/extensions/https-everywhere/ as TB expects +TMP_HTTPS_EVERYWHERE_PATH=$rootdir/tmp_https_everywhere/ +mkdir $TMP_HTTPS_EVERYWHERE_PATH +pushd $TMP_HTTPS_EVERYWHERE_PATH +mkdir -p chrome/torbutton/content/extensions/https-everywhere/ +unzip $rootdir/[% c('input_files_by_name/https-everywhere') %] -d chrome/torbutton/content/extensions/https-everywhere/ +find . -exec [% c("var/touch") %] {} \; +zip -Xr "$TBDIR[% IF c("var/osx") %]/Contents/Resources[% END %]/omni.ja" chrome/ +popd +rm -rf $TMP_HTTPS_EVERYWHERE_PATH + tar -C "$TBDIR[% IF ! c("var/osx") %]/TorBrowser[% END %]" -xf [% c('input_files_by_name/tor') %]/tor.tar.gz [% IF c("var/namecoin") %] # Extract Electrum-NMC

1 0

[torbutton/master] Translations update
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit 33fed7848596b3da7d0e66309f94fdbdc21d253e Author: Georg Koppen <gk(a)torproject.org> Date: Wed Sep 9 08:13:41 2020 +0000 Translations update --- chrome/locale/fr/aboutDialog.dtd | 2 +- chrome/locale/fr/torbutton.properties | 2 +- chrome/locale/zh-CN/torbutton.properties | 2 +- chrome/locale/zh-TW/aboutTor.dtd | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/chrome/locale/fr/aboutDialog.dtd b/chrome/locale/fr/aboutDialog.dtd index 6630cd94..ede97d06 100644 --- a/chrome/locale/fr/aboutDialog.dtd +++ b/chrome/locale/fr/aboutDialog.dtd @@ -3,7 +3,7 @@ <!ENTITY project.tpoLink "le &vendorShortName;"> <!ENTITY project.end ", un organisme sans but lucratif qui s’efforce de protéger votre vie privée, vos données personnels et votre liberté en ligne."> -<!ENTITY help.start "Voulez-vous aider ?"> +<!ENTITY help.start "Souhaitez-vous aider ?">  <!ENTITY help.donateLink "Faites un don"> <!ENTITY help.or "ou"> diff --git a/chrome/locale/fr/torbutton.properties b/chrome/locale/fr/torbutton.properties index e22e0366..bc04d816 100644 --- a/chrome/locale/fr/torbutton.properties +++ b/chrome/locale/fr/torbutton.properties @@ -29,7 +29,7 @@ torbutton.title.prompt_torbrowser = Renseignements importants sur BoutonTor torbutton.popup.prompt_torbrowser = Dorénavant, BoutonTor fonctionne différemment : vous ne pouvez plus le désactiver.\n\nNous avons effectué ce changement, car il n’est pas sécuritaire d’utiliser BoutonTor dans un navigateur qui est aussi utilisé pour une navigation sans Tor. Trop de bogues ne pouvaient être réglés autrement.\n\nSi vous voulez continuer à utiliser Firefox normalement, vous devriez désinstaller BoutonTor et télécharger l’offre groupée du Navigateur Tor. Les propriétés de confidentialité du Navigateur Tor sont aussi supérieures à celles de Firefox, même s’il est utilisé avec BoutonTor.\n\nPour enlever BoutonTor, allez dans Outils->Modules complémentaires->Extensions et cliquer sur Supprimer à coté de BoutonTor. torbutton.popup.short_torbrowser = Renseignements importants sur BoutonTor !\n\nBoutonTor est dorénavant toujours activé.\n\nCliquer sur BoutonTor pour plus de précisons. -torbutton.popup.confirm_plugins = Les greffons tels que Flash peuvent nuire à la protection de vos données personnels et à votre anonymat.\n\nIls peuvent aussi contourner Tor afin de divulguer votre position actuelle ainsi que votre adresse IP.\n\nVoulez-vous vraiment activer les greffons ?\n\n +torbutton.popup.confirm_plugins = Les greffons tels que Flash peuvent nuire à la protection de vos données personnels et à votre anonymat.\n\nIls peuvent aussi contourner Tor afin de divulguer votre position actuelle ainsi que votre adresse IP.\n\nSouhaitez-vous vraiment activer les greffons ?\n\n torbutton.popup.never_ask_again = Ne plus me poser la question. torbutton.popup.confirm_newnym = Le Navigateur Tor fermera tous les fenêtres et onglets. Les sessions des sites Web seront toutes perdues.\n\nRedémarrer le Navigateur Tor maintenant pour réinitialiser votre identité ?\n\n diff --git a/chrome/locale/zh-CN/torbutton.properties b/chrome/locale/zh-CN/torbutton.properties index 4fdb1b88..59f1cd2c 100644 --- a/chrome/locale/zh-CN/torbutton.properties +++ b/chrome/locale/zh-CN/torbutton.properties @@ -140,5 +140,5 @@ onionLocation.onionAvailable=可用的 .onion onionLocation.learnMore=详细了解…… onionLocation.always=始终 onionLocation.askEverytime=每次询问 -onionLocation.prioritizeOnionsDescription=Prioritize .onion sites when known. +onionLocation.prioritizeOnionsDescription=请优先使用 .onion站点。 onionLocation.onionServicesTitle=洋葱服务 diff --git a/chrome/locale/zh-TW/aboutTor.dtd b/chrome/locale/zh-TW/aboutTor.dtd index 7ec4f35a..79e06ab4 100644 --- a/chrome/locale/zh-TW/aboutTor.dtd +++ b/chrome/locale/zh-TW/aboutTor.dtd @@ -27,5 +27,5 @@ <!ENTITY aboutTor.newsletter.tagline "將 Tor 的最新消息直接傳送到您的收件匣。"> <!ENTITY aboutTor.newsletter.link_text "訂閱 Tor 的新資訊。"> -<!ENTITY aboutTor.donationBanner.freeToUse "Tor is free to use because of donations from people like you."> +<!ENTITY aboutTor.donationBanner.freeToUse "由於有像您這樣的人的捐款，Tor 可以免費使用。"> <!ENTITY aboutTor.donationBanner.buttonA "立刻捐款">

1 0

[torbutton/master] Bug 40007: Move SecurityPrefs initialization to the StartupObserver component.
by gk＠torproject.org 09 Sep '20

09 Sep '20

commit d8e068679001c3c3fe0d08d8ad1c9193e7fa95df Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Sep 1 13:26:08 2020 +0200 Bug 40007: Move SecurityPrefs initialization to the StartupObserver component. With this change this will be properly initialized both in desktop and mobile, and we will not need additional tor-browser changes to load torbutton.js for GeckoView. --- chrome/content/torbutton.js | 3 --- components/startup-observer.js | 5 ++++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/chrome/content/torbutton.js b/chrome/content/torbutton.js index a9d4ccd1..d795f642 100644 --- a/chrome/content/torbutton.js +++ b/chrome/content/torbutton.js @@ -28,7 +28,6 @@ let { torbutton_log, torbutton_get_property_string, } = ChromeUtils.import("resource://torbutton/modules/utils.js", {}); -let SecurityPrefs = ChromeUtils.import("resource://torbutton/modules/security-prefs.js", {}); let { configureControlPortModule } = Cu.import("resource://torbutton/modules/tor-control-port.js", {}); const k_tb_last_browser_version_pref = "extensions.torbutton.lastBrowserVersion"; @@ -238,8 +237,6 @@ function torbutton_is_mobile() { torbutton_init = function() { torbutton_log(3, 'called init()'); - SecurityPrefs.initialize(); - if (m_tb_wasinited) { return; } diff --git a/components/startup-observer.js b/components/startup-observer.js index 368d05f9..f9697987 100644 --- a/components/startup-observer.js +++ b/components/startup-observer.js @@ -26,6 +26,7 @@ XPCOMUtils.defineLazyModuleGetters(this, { }); let NoScriptControl = ChromeUtils.import("resource://torbutton/modules/noscript-control.js", {}); +let SecurityPrefs = ChromeUtils.import("resource://torbutton/modules/security-prefs.js", {}); // Module specific constants const kMODULE_NAME = "Startup"; @@ -192,9 +193,11 @@ StartupObserver.prototype = { // but only for hackish reasons. this._prefs.setBoolPref("extensions.torbutton.startup", true); - // We need to listen for NoScript before it starts. + // We need to listen for NoScript before it starts. NoScriptControl.initialize(); + SecurityPrefs.initialize(); + this.setProxySettings(); }

1 0

[tor-browser-spec/master] Add Firefox 78 network audit done by mikeperry
by gk＠torproject.org 07 Sep '20

07 Sep '20

commit f10b4248c3fb66cdf16327695320bbc7f95fdef8 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 7 08:49:18 2020 +0000 Add Firefox 78 network audit done by mikeperry --- audits/FF78_NETWORK_AUDIT | 376 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 376 insertions(+) diff --git a/audits/FF78_NETWORK_AUDIT b/audits/FF78_NETWORK_AUDIT new file mode 100644 index 0000000..9259c72 --- /dev/null +++ b/audits/FF78_NETWORK_AUDIT @@ -0,0 +1,376 @@ +Summary of findings: https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34177 + +`git diff esrA esrB` and then go over all the changes containing the +above mentioned potentially dangerous calls and features. Grep the diff for +the following strings and examine surrounding usage. + +=============== Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +netwerk/dns/GetAddrInfo.cpp + - NativeDNSResolverOverride.. Don't see where stuff is added to this.. but + doesn't use DNS itself + +GetAddrInfo() + + checks network.dns.disabled pref.. + - Only used by nsHostResolver + +MDNS + + Some use by mtransport, which should be disabled by webrtc + +TRR (DNS Trusted Recursive Resolver) + - Has a perf test that uses nsDNSService + - Governed by network.trr.* prefs + - Bundled addon doh-rollout, govererned by doh-rollout.* + + TRR itself uses http channels which follow proxy prefs + - This impl is TRRServiceChannel + + Proxy passed in via CreateTRRServiceChannel proxyInfo arg + - TRR has its own cache that gets cleared on pref change + +Direct Paths to DNS resolution: +nsHostResolver::ResolveHost + - Does not check for SOCKS proxy or DNS pref + - Uses nsResolveHostCallback + + Calls down to NativeResolve, which checks network.dns.disabled pref +nsDNSService::Resolve + + Uses nsHostResolver::ResolveHost +nsDNSService::AsyncResolve + + -> AsyncResolveInternal +nsDNSService::AsyncResolveNative + + -> AsyncResolveInternal +nsDNSService::AsyncResolveWithTrrServer + + -> AsyncResolveInternal +nsDNSService::AsyncResolveInternal + + uses nsHostResolver::ResolveHost + +============ Misc Socket Portion ============== + +SOCK_ + + nsNetworkLinkService; checks routing tables but does not make connections + - RCNetStreamIO + - Just reformatting + + python tests + - third_party/rust/nix/src/sys/socket/mod.rs + - third_party/rust/socket2/src/sys/redox/mod.rs +SOCKET_ + + nsSocketTransport::ResolveHost + + Calls down to native, is blocked by pref + - nsSocketTransport::BuildSocket + - XXX now can connect via quic?? (mTypes[0] == quic) + - XXX: mUsingQuic + - uses mProxyHost + port?? + - pushes to nsSocketProvider layer (with quic) +_SOCKET + - Some kind of socket process sandbox? + + Errors and tests +UDPSocket + - nsSocketTransport::BuildSocket + - XXX: quic again +TCPSocket + - nsSocketTransport::BuildSocket + +PR_OpenUDPSocket +PR_NewUDPSocket + + No usage outside of tests +PR_NewTCPSocket + + No usage outside of tests +AsyncTCPSocket + + No usage +Misc PR_Socket + + No signficant changes + + +HTTP3 + Http3Session, Http3Stream + HttpConnectionUDP + nsHttpConnection::UsingHttp3 + nsHttpConnectionMgr::DispatchTransaction + + Live testing found no quic/http leaks unless http3 pref was flipped + +TCPFastOpen (https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27614) + - Attached in nsSocketTransport::InitiateSocket + - mProxyTransparent + - nsHttpConnectionMgr::nsHalfOpenSocket::FastOpenEnabled + - nsHttphandler::mUsingFastOpen + - Set by network.tcp.tcp_fastopen_enable pref.. + +=========== Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + - "quic does not have a SocketProvider" + grep -R udp-socket . + + No changes + grep -R tcp-socket . + + No changes + grep for tcpsocket + + Just tests + grep -R "NS_" | grep SOCKET | grep "_C" + + NS_SOCKETTRANSPORTSERVICE_CONTRACTID + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + + socket-transport-service + + just tests + +============ Rust Portion ================ + +Rust + - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool? + - Check for new sendmsg and recvmsg usage + +============ Android Portion ============= + +XXX: Fenix + 18:42 <+GeKo> application-services, android-components, fenix + 18:43 <+GeKo> for the former i applied the patches we already have in our tor-browser repo + https://bugs.torproject.org/34101 (Build Project for application-services) + https://bugs.torproject.org/33939 + https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34440 + https://gitlab.torproject.org/legacy/trac/-/issues/34324 + https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40004 + 18:47 <+GeKo> fenix mentions the android-components version at + https://gitlab.torproject.org/tpo/applications/fenix/-/blob/tor-browser-79.… + 18:47 <+GeKo> you could look at the respective tag in the android-components repo + https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40008 + 18:54 <+GeKo> mikeperry: for completeness sake: android-components hardcode the application-services version in + buildSrc/src/main/java/Dependencies.kt + 18:54 <+GeKo> in mozilla_appservices + 18:57 <+GeKo> mikeperry: the application-services repo is at: https://github.com/mozilla/application-services + 18:58 <+GeKo> the android-components one is at https://github.com/mozilla-mobile/android-components + 18:59 <+GeKo> you find the version of the first one used in the latter one at + https://github.com/mozilla-mobile/android-components/blob/master/buildSrc/s… + 18:59 <+GeKo> (currently) + 18:59 <+GeKo> which should give you a link from the fenix commit you look at down to application-services + + + + +=== Android: gecko-dev === + +Android Java calls + - URLConnection + - mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java + - XXX: Uses 'ProxySelector' to make http conns + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java + - XXX: Also ProxySelector + - ProxySelector + - mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/ProxySelector.java + - XXX: Seems to only inspect system proxy settings? + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - okhttp + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - android.net + - mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/BitmapUtils.java + - XXX: Does URI.openStream() ... + - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoSession.java + - XXX: LOAD_FLAGS_BYPASS_PROXY :/ + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/drm/HttpMediaDrmCallback.java + - XXX: DataSourceInputStream; DataSource + - DownloadRequest + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/offline/ProgressiveDownloader.java + - XXX: DataSpec + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/offline/SegmentDownloader.java + - XXX: CacheUtil + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/upstream/DefaultDataSource.java + - XXX: can do rtmp and udp via superclasses + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java + - Uses ProxySelector + - Can also use java.net.URL + - XXX: Whole exoplayer is a mess of stuff :/ + - android.webkit + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java + - onExternalResponse - ??? + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/offline/DownloadService.java + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + - Intent wrappers: + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt + - External app intercepter + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt + +=== android-components === + +Android Java calls + - URLConnection + - HttpURLConnection + - components/lib/crash/src/main/java/mozilla/components/lib/crash/service/MozillaSocorroService.kt + - XXX: Crash reporting + - components/lib/fetch-httpurlconnection/src/main/java/mozilla/components/lib/fetch/httpurlconnection/HttpURLConnectionClient.kt + - XXX: No proxy, but doesn't seem used except perhaps by Glean + - components/service/glean/src/main/java/mozilla/components/service/glean/net/ConceptFetchHttpUploader.kt + - XXX: glean ping + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - components/concept/fetch/src/main/java/mozilla/components/concept/fetch/Client.kt + - Abstract client interface: implementors use this to download stuff; + geckoview is a Client impl + - components/lib/fetch-httpurlconnection/src/main/java/mozilla/components/lib/fetch/httpurlconnection/HttpURLConnectionClient.kt + - XXX: Generic http Client; No proxy; does not seem used + - components/lib/crash/src/main/java/mozilla/components/lib/crash/service/MozillaSocorroService.kt + - XXX: Crash service openSteam + - java.net + - components/browser/engine-gecko-beta/src/main/java/mozilla/components/browser/engine/gecko/fetch/GeckoViewFetchClient.kt + - Calls into GeckoWebExecutor to fetch things + + components/lib/fetch-okhttp/src/main/java/mozilla/components/lib/fetch/okhttp/OkHttpClient.kt + + only used in tests + - javax.net + - okhttp3 + + components/lib/fetch-okhttp/src/main/java/mozilla/components/lib/fetch/okhttp/OkHttpClient.kt + + just used in tests + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - android.net + - components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt + - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngineView.kt + - XXX: Seems to use webkit to do stuff?? + - components/browser/icons/src/main/java/mozilla/components/browser/icons/loader/HttpIconLoader.kt + - Uses whatever httpclient is passed in + - android.webkit ************ + - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngine.kt + - Provides way to launch system webkit views; probably unsafe + - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/NestedWebView.kt + - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngineSession.kt + - XXX: loadURL via NestedWebView which I think comes from android.webkit? + (scoping unclear) + - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngineView.kt + - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/window/SystemWindowRequest.kt + - XXX: unclear if this is requests for "default browser" or another way + to launch webkit + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/AbstractFetchDownloadService.kt + - XXX: Abstract downloader that can use any HTTPClient (may be unsafe) + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt + - needs AppLinkInterceptor; no warning currently + - components/feature/contextmenu/src/main/java/mozilla/components/feature/contextmenu/ContextMenuCandidate.kt + - probably safe? just link sharing + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/AbstractFetchDownloadService.kt + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/DownloadsFeature.kt + Downloader apps + - components/feature/prompts/src/main/java/mozilla/components/feature/prompts/PromptContainer.kt + wrapper? + - components/feature/prompts/src/main/java/mozilla/components/feature/prompts/file/FilePicker.kt + - components/feature/pwa/src/main/java/mozilla/components/feature/pwa/WebAppInterceptor.kt + - components/feature/pwa/src/main/java/mozilla/components/feature/pwa/WebAppLauncherActivity.kt + - can launch "standalone actvity" for browser urls.. + - components/lib/crash/src/main/java/mozilla/components/lib/crash/prompt/CrashReporterActivity.kt + - components/support/ktx/src/main/java/mozilla/components/support/ktx/android/content/Context.kt + can call and access adressbook.. + - samples/browser/src/main/java/org/mozilla/samples/browser/DefaultComponents.kt + - can start "systemengine" + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/AbstractFetchDownloadService.kt + - uses httpClient rather than native android download manager + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/DownloadsFeature.kt + - uses android download mamanager :/ + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/manager/AndroidDownloadManager.kt + - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/manager/FetchDownloadManager.kt + - ActivityHandlerHelper.startIntentAndCatch + - Intent wrappers: + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt + - External app intercepter + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt + +=== application-services === + +Rust: + - components/fxa-client/src/http_client.rs + - XXX: Does oauth token refresh without proxy :/ + - XXX: More rust.. Suspicious components: + - fxa-client + - mozilla sync + - mozilla app service login + - Push notification support + +XXX: re-check this with script. Is this cut+paste error? nothing here, really? +Android Java calls + - URLConnection + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - okhttp3 + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - android.net + - android.webkit ************ + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + - Intent wrappers: + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt + - External app intercepter + - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt + + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser-build/master] Bug 40076: Use our hosted android-components repo
by gk＠torproject.org 05 Sep '20

05 Sep '20

commit 97879e51a841e688504c65f2b2f77b3f0e0b0a78 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Sep 4 16:51:06 2020 +0000 Bug 40076: Use our hosted android-components repo --- projects/android-components/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/android-components/config b/projects/android-components/config index 56380e6..181976e 100644 --- a/projects/android-components/config +++ b/projects/android-components/config @@ -2,7 +2,7 @@ version: 57.0.0 filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_hash: c84cf8e7736ee77c22c75ca9f0397b202e489991 # v57.0.0 -git_url: https://github.com/mozilla-mobile/android-components +git_url: https://gitlab.torproject.org/tpo/applications/android-components.git var: container:

1 0

[tor-browser-build/master] Bug 40054: Adapt build.android for Fenix
by sysrqb＠torproject.org 05 Sep '20

05 Sep '20

commit 07dbd7701e89ae984bb852d4b5113707066b3df3 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Sep 4 11:33:20 2020 +0000 Bug 40054: Adapt build.android for Fenix We can remove the workaround for #31564 as Fenix is using the Android Gradle Plugin 3.5.0 where the original reproducibility issue is supposed to be fixed (see: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/31564#n…) --- projects/tor-browser/build.android | 55 ++++++++------------------------------ projects/tor-browser/config | 8 +++--- 2 files changed, 15 insertions(+), 48 deletions(-) diff --git a/projects/tor-browser/build.android b/projects/tor-browser/build.android index 751db11..e349d88 100644 --- a/projects/tor-browser/build.android +++ b/projects/tor-browser/build.android @@ -1,58 +1,25 @@ #!/bin/bash [% c("var/set_default_env") -%] -ext_dir=assets/distribution/extensions +ext_dir=assets/extensions qa_apk=[% dest_dir %]/[% c('filename') %]/tor-browser-[% c("version") %]-[% c("var/osname") %]-multi-qa.apk -apk=$rootdir/[% c('input_files_by_name/firefox') %]/tor-browser-unsigned-unaligned.apk +apk=$rootdir/fenix/app-[% c("var/abi") %]*.apk +tar xavf $rootdir/[% c('input_files_by_name/fenix') %] + +# Bundle our extensions. We treat HTTPS-Everywhere and NoScript differently as +# the former should be an internal extension without getting any updates besides +# from Tor Browser releases. NoScript will be copied over to the profile folder +# being a "regular" browser extension. mkdir -p /var/tmp/build/$ext_dir [% dest_dir _ '/' _ c('filename') %] cd /var/tmp/build - -mv $rootdir/[% c('input_files_by_name/https-everywhere') %] $ext_dir/https-everywhere-eff(a)eff.org.xpi +unzip -d $ext_dir/https-everywhere $rootdir/[% c('input_files_by_name/https-everywhere') %] mv $rootdir/[% c('input_files_by_name/noscript') %] $ext_dir/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [% c('zip', { zip_src => [ '$ext_dir' ], zip_args => '$apk', }) %] -unzip $apk lib/* -zip -d $apk lib/\* - -[% IF c("var/android-x86") %] - [% c('zip', { - zip_src => [ 'lib/x86/*' ], - zip_args => '$apk', - }) %] -[% ELSIF c("var/android-x86_64") %] - [% c('zip', { - zip_src => [ 'lib/x86_64/*' ], - zip_args => '$apk', - }) %] -[% ELSIF c("var/android-armv7") %] - [% c('zip', { - zip_src => [ 'lib/armeabi-v7a/*' ], - zip_args => '$apk', - }) %] -[% ELSIF c("var/android-aarch64") %] - [% c('zip', { - zip_src => [ 'lib/arm64-v8a/*' ], - zip_args => '$apk', - }) %] -[% END %] - -rm -fR lib - -# Bug 31564: Android Gradle Plugin has a reproducibility bug. Decompile and recompile to fix ordering of resources.arsc files -apktool=$rootdir/[% c('input_files_by_name/apktool') %] -java -jar $apktool d --no-src -o decompiled $apk -java -jar $apktool b -o $apk decompiled -# Fix timestamps and remove extra field info from zip entries -unzip $apk -d tmp -rm $apk -cd tmp -[% c('zip', { - zip_src => [ '.' ], - zip_args => '-n ja $apk', - }) %] -# Sign a QA build. This apk is not a debug version and doesn't contain a debug flag in the manifest +# Sign a QA build. This .apk is not a debug version and doesn't contain a debug +# flag in the manifest. java -jar /usr/lib/android-sdk/build-tools/debian/apksigner.jar sign --verbose --min-sdk-version [% c("var/android_min_api") %] --ks $rootdir/android-qa.keystore --out $qa_apk --in $apk --ks-key-alias androidqakey --key-pass pass:android --ks-pass pass:android diff --git a/projects/tor-browser/config b/projects/tor-browser/config index fc81a4f..6398323 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -54,6 +54,10 @@ input_files: enable: '[% ! c("var/android") %]' - project: firefox name: firefox + enable: '[% ! c("var/android") %]' + - project: fenix + name: fenix + enable: '[% c("var/android") %]' - project: tor name: tor enable: '[% ! c("var/android") %]' @@ -100,10 +104,6 @@ input_files: # To generate a new keystore, see how-to-generate-keystore.txt - filename: android-qa.keystore enable: '[% c("var/android") %]' - - URL: https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.4.0.jar - name: apktool - sha256sum: a0f116e8916d6f21160e1559847bb8b8c32ee71900f321cafeadbe37b87ebcc1 - enable: '[% c("var/android") %]' - name: electrum-nmc project: electrum-nmc enable: '[% c("var/namecoin") %]'

1 0