- tbb-commits - lists.torproject.org

[tor-browser-build/master] fixup! Bug 40166: Update apt cache before calling pre_pkginst in container-image config
by gk＠torproject.org 09 Dec '20

09 Dec '20

commit 89ce2757e57357aef59d3c9a598b742b7d6b0f1c Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 23:50:58 2020 +0000 fixup! Bug 40166: Update apt cache before calling pre_pkginst in container-image config Bug 40169: Update apt package cache after calling pre_pkginst, too The creation of some project containers require an updated apt cache before executing pre_pkginst, while others require updating the apt cache after executing pre_pkginst. --- projects/container-image/config | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/projects/container-image/config b/projects/container-image/config index e8f3f38..7520b8e 100644 --- a/projects/container-image/config +++ b/projects/container-image/config @@ -27,9 +27,14 @@ pre: | # [% c('var/container/suite') %] set -e export DEBIAN_FRONTEND=noninteractive + # Update the package cache so the container installs the most recent + # version of required packages. apt-get update -y -q [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] [% pc(c('origin_project'), 'var/pre_pkginst') %] + # Update the package cache again because `pre_pkginst` may change the + # package manager configuration. + apt-get update -y -q [% END -%] apt-get upgrade -y -q [%

1 0

[tor-browser-spec/master] Update Fenix84 net audit
by sysrqb＠torproject.org 09 Dec '20

09 Dec '20

commit d68aa868ef206168b44c639ac83ddae6274070fc Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Dec 8 23:06:41 2020 +0000 Update Fenix84 net audit --- audits/FF84_NETWORK_AUDIT | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/audits/FF84_NETWORK_AUDIT b/audits/FF84_NETWORK_AUDIT index 039dd96..a4c6ee0 100644 --- a/audits/FF84_NETWORK_AUDIT +++ b/audits/FF84_NETWORK_AUDIT @@ -1,4 +1,4 @@ -`git diff 1cb2c4893850a5b0a246f821a6390c07064c1227 9e429e392ec8446ff0f078f991d6332a307bc98f` +`git diff 1cb2c4893850a5b0a246f821a6390c07064c1227 11898884c81cd84cfaec46dffe1dbf42517e8301` and then go over all the changes containing the below mentioned potentially dangerous calls and features. Grep the diff for the following strings and examine surrounding usage. @@ -33,6 +33,13 @@ TRR (DNS Trusted Recursive Resolver) # Bug 1673590: # - Still protected by https://bugzil.la/1636411 +# Bug 1674088: +# - Increase TRR max failures and add new pref +# |network.trr.retry-timeout-ms| + +# Bug 1677806 +# - Set network.dns.dns_query_single_label to false + Direct Paths to DNS resolution: nsDNSService::Resolve @@ -139,14 +146,14 @@ End: 6a234c2b1e1972f11e585551d4cf2e40e84bf16f # v67.0.0 ============ Android Components Portion ============= Start: 0a2993d44aae3d877bb97cee925096f83af01b3a # v63.0.8 -End: 614386935ec94cac531eb8cb061409e9a8410d09 # v67.0.3 +End: 89973898761d54c7512bb74ea2c3489fca07bf8e # v67.0.10 # FF84: Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`) ============ Fenix Portion ============= Start: 5441935698f4d9e3606f3d6baf892f6e0106a2f6 # v83.1.0-rc.1 -End: 670e61b2b97d4f8066497e79178729c5802fe428 # v84.0.0-beta.2 +End: 8b4b9bde5f2dab9fec1631fbfc70d4e2c3b2d24e # v84.1.0-rc.1 # FF84: Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`)

1 0

[tor-browser-build/maint-10.0-android] Bug 40139: Pick up rbm commit for bug 40008
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 35e166b3fa2bba66355e6ccbad79de50cd92b20d Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Oct 28 22:08:13 2020 +0000 Bug 40139: Pick up rbm commit for bug 40008 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index a32239d..15c8476 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit a32239ddb1f465115cb4a8bb9f4b853c149506f3 +Subproject commit 15c84760ebe3f2677d1212aa00ef6f7485446a69

1 0

[tor-browser-build/maint-10.0-desktop] Bug 40139: Pick up rbm commit for bug 40008
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 84f086a26c83449131c0ba4d5cc371d9a55c8fe1 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Oct 28 22:08:13 2020 +0000 Bug 40139: Pick up rbm commit for bug 40008 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index a32239d..15c8476 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit a32239ddb1f465115cb4a8bb9f4b853c149506f3 +Subproject commit 15c84760ebe3f2677d1212aa00ef6f7485446a69

1 0

[tor-browser/tor-browser-78.5.0esr-10.0-1] Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 9cc097d454330ca53808b4a90bf3677c4f8a6f2d Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Oct 9 12:55:35 2020 +0200 Bug 40166: Disable security.certerrors.mitm.auto_enable_enterprise_roots --- browser/app/profile/000-tor-browser.js | 3 +++ browser/components/BrowserGlue.jsm | 14 ++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 6bc759bdf30b..5c65eff70fc0 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -323,6 +323,9 @@ pref("security.enterprise_roots.enabled", false); // Don't ping Mozilla for MitM detection, see bug 32321 pref("security.certerrors.mitm.priming.enabled", false); +// Don't automatically enable enterprise roots, see bug 40166 +pref("security.certerrors.mitm.auto_enable_enterprise_roots", false); + // Disable the language pack signing check for now on macOS, see #31942 #ifdef XP_MACOSX pref("extensions.langpacks.signatures.required", false); diff --git a/browser/components/BrowserGlue.jsm b/browser/components/BrowserGlue.jsm index 057a2121533c..3750230a250b 100644 --- a/browser/components/BrowserGlue.jsm +++ b/browser/components/BrowserGlue.jsm @@ -1319,6 +1319,20 @@ BrowserGlue.prototype = { // handle any UI migration this._migrateUI(); + // Clear possibly auto enabled enterprise_roots prefs (see bug 40166) + if ( + !Services.prefs.getBoolPref( + "security.certerrors.mitm.auto_enable_enterprise_roots" + ) && + Services.prefs.getBoolPref( + "security.enterprise_roots.auto-enabled", + false + ) + ) { + Services.prefs.clearUserPref("security.enterprise_roots.enabled"); + Services.prefs.clearUserPref("security.enterprise_roots.auto-enabled"); + } + if (!Services.prefs.prefHasUserValue(PREF_PDFJS_ISDEFAULT_CACHE_STATE)) { PdfJs.checkIsDefault(this._isNewProfile); }

1 0

[tor-browser-build/maint-10.0-android] Tag -build2
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit f2cff2bdabd356bdbd7f7c8183937678955df09f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 22:36:24 2020 +0000 Tag -build2 --- projects/obfs4/build | 2 +- rbm.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/obfs4/build b/projects/obfs4/build index 4840edf..c0437fc 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -24,12 +24,12 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxtext') %] mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] +patch -p1 < $rootdir/update_azure_hpkp.patch mkdir -p "$GOPATH/src/gitlab.com/yawning" ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git" cd obfs4proxy -patch -p1 < $rootdir/update_azure_hpkp.patch go build -ldflags '-s' cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR diff --git a/rbm.conf b/rbm.conf index 4300256..bb2982e 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '10.0.6' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.5a1 project_name: tor-browser

1 0

[tor-browser-build/maint-10.0-desktop] Tag -build2
by sysrqb＠torproject.org 08 Dec '20

08 Dec '20

commit 956ddcebd5f193aef83e1762c2e89c1b57d2e8c7 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 22:36:24 2020 +0000 Tag -build2 --- projects/obfs4/build | 2 +- rbm.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/obfs4/build b/projects/obfs4/build index 4840edf..c0437fc 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -24,12 +24,12 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/goxtext') %] mkdir -p /var/tmp/build tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] +patch -p1 < $rootdir/update_azure_hpkp.patch mkdir -p "$GOPATH/src/gitlab.com/yawning" ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git" cd obfs4proxy -patch -p1 < $rootdir/update_azure_hpkp.patch go build -ldflags '-s' cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR diff --git a/rbm.conf b/rbm.conf index a549fc4..9e1db9a 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '10.0.6' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.0.5 project_name: tor-browser

1 0

[tor-browser-build/maint-10.0-android] Bug 40175: Update obfs4proxy's TLS certificate public key pinning
by gk＠torproject.org 08 Dec '20

08 Dec '20

commit bdb60883a70c8ec906d3fb59d2f971a441b0d254 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 20:33:53 2020 +0000 Bug 40175: Update obfs4proxy's TLS certificate public key pinning --- projects/obfs4/build | 1 + projects/obfs4/config | 1 + projects/obfs4/update_azure_hpkp.patch | 56 ++++++++++++++++++++++++++++++++++ 3 files changed, 58 insertions(+) diff --git a/projects/obfs4/build b/projects/obfs4/build index 47c7228..4840edf 100644 --- a/projects/obfs4/build +++ b/projects/obfs4/build @@ -29,6 +29,7 @@ mkdir -p "$GOPATH/src/gitlab.com/yawning" ln -sf "$PWD" "$GOPATH/src/gitlab.com/yawning/obfs4.git" cd obfs4proxy +patch -p1 < $rootdir/update_azure_hpkp.patch go build -ldflags '-s' cp -a obfs4proxy[% IF c("var/windows") %].exe[% END %] $PTDIR diff --git a/projects/obfs4/config b/projects/obfs4/config index 21bdab6..749ff43 100644 --- a/projects/obfs4/config +++ b/projects/obfs4/config @@ -39,3 +39,4 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' enable: '[% c("var/android") %]' + - filename: update_azure_hpkp.patch diff --git a/projects/obfs4/update_azure_hpkp.patch b/projects/obfs4/update_azure_hpkp.patch new file mode 100644 index 0000000..a4324fc --- /dev/null +++ b/projects/obfs4/update_azure_hpkp.patch @@ -0,0 +1,56 @@ +From 1115c2e2eaca1a96865ae47aead9838aab45787e Mon Sep 17 00:00:00 2001 +From: Philipp Winter <phw(a)nymity.ch> +Date: Mon, 7 Dec 2020 10:23:44 -0800 +Subject: [PATCH] Update Azure's root CA certificate pins. + +Microsoft recently updated the root CA certificates that are served to +Azure clients. See the following article for more details: +https://docs.microsoft.com/en-us/azure/security/fundamentals/tls-certificate-changes + +This change broke meek-lite because none of its pins work anymore. That +means that Tor Browser users can no longer use meek-azure or moat as +both rely on meek-lite. + +This patch fixes the problem by updating the certificate pins. +--- + transports/meeklite/hpkp_lite.go | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/transports/meeklite/hpkp_lite.go b/transports/meeklite/hpkp_lite.go +index 0ff56f9..97ac590 100644 +--- a/transports/meeklite/hpkp_lite.go ++++ b/transports/meeklite/hpkp_lite.go +@@ -103,19 +103,22 @@ func init() { + pins: make(map[string]*pinEntry), + } + +- // Pin all of Microsoft's CA intermediary certificates for the +- // Tor Browser Azure bridge. ++ // Pin all of Microsoft Azure's root CA certificates for the Tor Browser ++ // Azure bridge. + // +- // See: https://www.microsoft.com/pki/mscorp/cps/default.htm ++ // See: https://docs.microsoft.com/en-us/azure/security/fundamentals/tls-certificat… + builtinPinDB.Add( + "ajax.aspnetcdn.com", + []string{ +- "CzdPous1hY3sIkO55pUH7vklXyIHVZAl/UnprSQvpEI=", // Microsoft IT SSL SHA2 - 2018-05-07 17:03:30 +- "xjXxgkOYlag7jCtR5DreZm9b61iaIhd+J3+b2LiybIw=", // Microsoft IT TLS CA 1 - 2024-05-20 12:51:28 +- "wBdPad95AU7OgLRs0FU/E6ILO1MSCM84kJ9y0H+TT7s=", // Microsoft IT TLS CA 2 - 2024-05-20 12:51:57 +- "wUY9EOTJmS7Aj4fDVCu/KeE++mV7FgIcbn4WhMz1I2k=", // Microsoft IT TLS CA 4 - 2024-05-20 12:52:38 +- "RCbqB+W8nwjznTeP4O6VjqcwdxIgI79eBpnBKRr32gc=", // Microsoft IT TLS CA 5 - 2024-05-20 12:53:03 ++ "i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY=", // DigiCert Global Root G2 - 2038-01-15 12:00:00 ++ "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=", // DigiCert Global Root CA - 2031-11-10 00:00:00 ++ "Y9mvm0exBk1JoQ57f9Vm28jKo5lFm/woKcVxrYxu80o=", // Baltimore CyberTrust Root - 2025-05-12 23:59:00 ++ "7KDxgUAs56hlKzG00DbfJH46MLf0GlDZHsT5CwBrQ6E=", // D-TRUST Root Class 3 CA 2 2009 - 2029-11-05 08:35:58 ++ "svcpi1K/LDysTd/nLeTWgqxYlXWVmC8rYjAa9ZfGmcU=", // Microsoft RSA Root Certificate Authority 2017 - 2042-07-18 23:00:23 ++ "NfU84SZGEeAzQP434ex9TMmGxWE9ynD9BKpEVF8tryg=", // Microsoft ECC Root Certificate Authority 2017 - 2042-07-18 23:16:04 + }, +- time.Date(2024, time.May, 20, 00, 00, 00, 00, time.UTC), ++ // As of 2020-12-07, we're getting the "DigiCert Global Root CA" ++ // certificate, so our expiration time matches this certificate. ++ time.Date(2031, time.November, 20, 00, 00, 00, 00, time.UTC), + ) + } +-- +2.20.1

1 0

[tor-browser-build/maint-10.0-android] Tor Browser 10.0.6 release preparations
by gk＠torproject.org 08 Dec '20

08 Dec '20

commit daad871752225d0ceb05626d6a1f2c18e83a7b35 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 20:34:58 2020 +0000 Tor Browser 10.0.6 release preparations Version bumps and Changelog update --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++++ rbm.conf | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 334c001..782e2f4 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,7 @@ +Tor Browser 10.0.6 -- December 8 2020 + * Android + * Bug 40175: Update obfs4proxy's TLS certificate public key pinning [tor-browser-build] + Tor Browser 10.0.5 -- November 27 2020 * Android * Update Fenix to 83.1.0 diff --git a/rbm.conf b/rbm.conf index bdfe028..4300256 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,7 +24,7 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0.5' + torbrowser_version: '10.0.6' torbrowser_build: 'build1' torbrowser_incremental_from: - 10.5a1

1 0

[tor-browser-build/maint-10.0-desktop] Tor Browser 10.0.6 release preparations
by gk＠torproject.org 08 Dec '20

08 Dec '20

commit 8d42112e1d89e064efd4929667ccfcedb02d6ef5 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Mon Dec 7 20:34:58 2020 +0000 Tor Browser 10.0.6 release preparations Version bumps and Changelog update --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++++ rbm.conf | 5 ++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 3b26ac5..d5027f4 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,7 @@ +Tor Browser 10.0.6 -- December 8 2020 + * Windows + OS X + Linux + * Bug 40175: Update obfs4proxy's TLS certificate public key pinning [tor-browser-build] + Tor Browser 10.0.5 -- November 17 2020 * Windows + OS X + Linux * Update Firefox to 78.5.0esr diff --git a/rbm.conf b/rbm.conf index ac496bc..a549fc4 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,11 +24,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0.5' + torbrowser_version: '10.0.6' torbrowser_build: 'build1' torbrowser_incremental_from: - - 10.0.2 - - 10.0.4 + - 10.0.5 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0