- tbb-commits - lists.torproject.org

[tor-browser-build/master] Add missing item to Changelog
by gk＠torproject.org 11 Oct '19

11 Oct '19

commit a116493b811c499dd4ff9cf8cec18db458b4b738 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Oct 11 06:51:48 2019 +0000 Add missing item to Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 3499f94..519e228 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -116,6 +116,7 @@ Tor Browser 9.0a6 -- September 4 2019 * Android * Bug 31010: Rebase mobile patches for Fennec 68 * Bug 31010: Don't use addTrustedTab() on mobile + * Bug 30607: Support Tor Browser running on Android Q * Build System: * All Platforms: * Bug 30585: Provide standalone clang 8 project across all platforms

1 0

[tor-browser-build/master] Bug 30665: Get Firefox 68 ESR Working with latest android toolchain
by gk＠torproject.org 11 Oct '19

11 Oct '19

commit a6a151402cef2a1e5ea6b3fbfc7aa6a90d9de507 Author: sisbell <shane.isbell(a)gmail.com> Date: Wed Oct 9 12:24:16 2019 -0700 Bug 30665: Get Firefox 68 ESR Working with latest android toolchain --- projects/firefox/1527534.patch | 139 ------------------------- projects/firefox/android-packages.patch | 10 -- projects/firefox/android-remove-emulator.patch | 23 ---- projects/firefox/build | 10 +- projects/firefox/config | 6 -- 5 files changed, 3 insertions(+), 185 deletions(-) diff --git a/projects/firefox/1527534.patch b/projects/firefox/1527534.patch deleted file mode 100644 index ad8720c..0000000 --- a/projects/firefox/1527534.patch +++ /dev/null @@ -1,139 +0,0 @@ -From dcd5a0e59bef209aa8301a427b749830876cdada Mon Sep 17 00:00:00 2001 -From: Jeff Gilbert <jgilbert(a)mozilla.com> -Date: Tue, 19 Feb 2019 15:43:39 -0800 -Subject: [PATCH] Bug 1527534 - Reuse LoadApitraceLibrary. r=lsalzman a=lizzard - -Differential Revision: https://phabricator.services.mozilla.com/D20418 - -diff --git a/gfx/gl/GLContextProviderEGL.cpp b/gfx/gl/GLContextProviderEGL.cpp -index d91d03aee6a9..f4d8c1f80176 100644 ---- a/gfx/gl/GLContextProviderEGL.cpp -+++ b/gfx/gl/GLContextProviderEGL.cpp -@@ -265,11 +265,8 @@ GLContextEGL::~GLContextEGL() { - } - - bool GLContextEGL::Init() { --#if defined(ANDROID) -- // We can't use LoadApitraceLibrary here because the GLContext -- // expects its own handle to the GL library -- if (!OpenLibrary(APITRACE_LIB)) --#endif -+ mLibrary = LoadApitraceLibrary(); -+ if (!mLibrary) { - if (!OpenLibrary(GLES2_LIB)) { - #if defined(XP_UNIX) - if (!OpenLibrary(GLES2_LIB2)) { -@@ -278,6 +275,7 @@ bool GLContextEGL::Init() { - } - #endif - } -+ } - - SetupLookupFunction(); - if (!InitWithPrefix("gl", true)) return false; -diff --git a/gfx/gl/GLLibraryEGL.cpp b/gfx/gl/GLLibraryEGL.cpp -index fe4bd9811949..ef693e283968 100644 ---- a/gfx/gl/GLLibraryEGL.cpp -+++ b/gfx/gl/GLLibraryEGL.cpp -@@ -63,9 +63,18 @@ static const char* sEGLExtensionNames[] = { - "EGL_ANGLE_device_creation_d3d11", - }; - --#if defined(ANDROID) -+PRLibrary* LoadApitraceLibrary() { -+ const char* path = nullptr; -+ -+#ifdef ANDROID -+ // We only need to explicitly dlopen egltrace -+ // on android as we can use LD_PRELOAD or other tricks -+ // on other platforms. We look for it in /data/local -+ // as that's writeable by all users. -+ path = "/data/local/tmp/egltrace.so"; -+#endif -+ if (!path) return nullptr; - --static PRLibrary* LoadApitraceLibrary() { - // Initialization of gfx prefs here is only needed during the unit tests... - gfxPrefs::GetSingleton(); - if (!gfxPrefs::UseApitrace()) { -@@ -73,7 +82,6 @@ static PRLibrary* LoadApitraceLibrary() { - } - - static PRLibrary* sApitraceLibrary = nullptr; -- - if (sApitraceLibrary) return sApitraceLibrary; - - nsAutoCString logFile; -@@ -87,20 +95,19 @@ static PRLibrary* LoadApitraceLibrary() { - nsAutoCString logPath; - logPath.AppendPrintf("%s/%s", getenv("GRE_HOME"), logFile.get()); - -+#ifndef XP_WIN // Windows is missing setenv and forbids PR_LoadLibrary. - // apitrace uses the TRACE_FILE environment variable to determine where - // to log trace output to - printf_stderr("Logging GL tracing output to %s", logPath.get()); - setenv("TRACE_FILE", logPath.get(), false); - -- printf_stderr("Attempting load of %s\n", APITRACE_LIB); -- -- sApitraceLibrary = PR_LoadLibrary(APITRACE_LIB); -+ printf_stderr("Attempting load of %s\n", path); -+ sApitraceLibrary = PR_LoadLibrary(path); -+#endif - - return sApitraceLibrary; - } - --#endif // ANDROID -- - #ifdef XP_WIN - // see the comment in GLLibraryEGL::EnsureInitialized() for the rationale here. - static PRLibrary* LoadLibraryForEGLOnWindows(const nsAString& filename) { -diff --git a/gfx/gl/GLLibraryEGL.h b/gfx/gl/GLLibraryEGL.h -index 069a2f0908d7..3f200bf76b3f 100644 ---- a/gfx/gl/GLLibraryEGL.h -+++ b/gfx/gl/GLLibraryEGL.h -@@ -18,18 +18,6 @@ - #include <bitset> - #include <vector> - --#ifdef ANDROID --// We only need to explicitly dlopen egltrace --// on android as we can use LD_PRELOAD or other tricks --// on other platforms. We look for it in /data/local --// as that's writeable by all users --// --// This should really go in GLLibraryEGL.cpp but we currently reference --// APITRACE_LIB in GLContextProviderEGL.cpp. Further refactoring --// will come in subsequent patches on Bug 732865 --#define APITRACE_LIB "/data/local/tmp/egltrace.so" --#endif -- - #if defined(MOZ_X11) - #define EGL_DEFAULT_DISPLAY ((EGLNativeDisplayType)mozilla::DefaultXDisplay()) - #else -@@ -49,6 +37,7 @@ class DataSourceSurface; - namespace gl { - - class GLContext; -+PRLibrary* LoadApitraceLibrary(); - - void BeforeEGLCall(const char* funcName); - void AfterEGLCall(const char* funcName); -diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h -index b2e094672b59..fae5bec1e78e 100644 ---- a/gfx/thebes/gfxPrefs.h -+++ b/gfx/thebes/gfxPrefs.h -@@ -433,9 +433,7 @@ class gfxPrefs final { - SmoothScrollMSDPhysicsRegularSpringConstant, int32_t, 1000); - - DECL_GFX_PREF(Once, "gfx.android.rgb16.force", AndroidRGB16Force, bool, false); --#if defined(ANDROID) - DECL_GFX_PREF(Once, "gfx.apitrace.enabled", UseApitrace, bool, false); --#endif - #if defined(RELEASE_OR_BETA) - // "Skip" means this is locked to the default value in beta and release. - DECL_GFX_PREF(Skip, "gfx.blocklist.all", BlocklistAll, int32_t, 0); --- -2.20.1 - diff --git a/projects/firefox/android-packages.patch b/projects/firefox/android-packages.patch deleted file mode 100644 index 3c70b41..0000000 --- a/projects/firefox/android-packages.patch +++ /dev/null @@ -1,10 +0,0 @@ -diff --git a/python/mozboot/mozboot/android-packages.txt b/python/mozboot/mozboot/android-packages.txt -index ac947a72f410..1a9aa21cb5d8 100644 ---- a/python/mozboot/mozboot/android-packages.txt -+++ b/python/mozboot/mozboot/android-packages.txt -@@ -1,5 +1,3 @@ - platform-tools - build-tools;27.0.3 - platforms;android-28 --emulator --docs diff --git a/projects/firefox/android-remove-emulator.patch b/projects/firefox/android-remove-emulator.patch deleted file mode 100644 index 9499983..0000000 --- a/projects/firefox/android-remove-emulator.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff --git a/build/moz.configure/android-sdk.configure b/build/moz.configure/android-sdk.configure -index a8ecc617850d..0a58597e2646 100644 ---- a/build/moz.configure/android-sdk.configure -+++ b/build/moz.configure/android-sdk.configure -@@ -87,10 +87,6 @@ def android_platform_tools(sdk_root): - tools) - - --@depends(android_sdk_root) --def android_emulator_path(sdk_root): -- return [os.path.join(sdk_root, 'emulator')] -- - - @template - def check_android_tools(tool, tool_dir): -@@ -108,7 +104,6 @@ def check_android_tools(tool, tool_dir): - - check_android_tools('zipalign', android_build_tools) - check_android_tools('adb', android_platform_tools) --check_android_tools('emulator', android_emulator_path) - - set_config('ANDROID_SDK_ROOT', android_sdk_root) - set_config('ANDROID_TOOLS', android_tools) diff --git a/projects/firefox/build b/projects/firefox/build index 7903bd3..456aa07 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -56,10 +56,6 @@ mv -f $rootdir/[% c('input_files_by_name/mozconfig') %] .mozconfig export ASAN_OPTIONS="detect_leaks=0" [% END -%] -[% IF c("var/android-armv7") -%] - cp /var/tmp/dist/android-toolchain/android-ndk/arm/lib64/libclang.so.6 /var/tmp/dist/android-toolchain/android-ndk/arm/lib64/libclang.so -[% END -%] - [% IF c("var/android") %] gradle_repo=/var/tmp/dist/gradle-dependencies export GRADLE_MAVEN_REPOSITORIES="file://$gradle_repo" @@ -71,9 +67,9 @@ mv -f $rootdir/[% c('input_files_by_name/mozconfig') %] .mozconfig # Move Android library dependencies so they will be included in the apk during the build cp $rootdir/[% c('input_files_by_name/topl') %]/* mobile/android/app cp $rootdir/[% c('input_files_by_name/tor-android-service') %]/* mobile/android/app - # Apply patches - patch -p1 < $rootdir/android-packages.patch - patch -p1 < $rootdir/android-remove-emulator.patch + # Move emulator to location that firefox build expects + mkdir /var/tmp/dist/android-toolchain/android-sdk-linux/emulator + cp /var/tmp/dist/android-toolchain/android-sdk-linux/tools/emulator /var/tmp/dist/android-toolchain/android-sdk-linux/emulator # Prepare building the multi-locale .apk including our own strings mkdir -p /var/tmp/dist/locales diff --git a/projects/firefox/config b/projects/firefox/config index 9da579a..63d2652 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -179,15 +179,9 @@ input_files: - project: tor-onion-proxy-library name: topl enable: '[% c("var/android") %]' - - filename: android-packages.patch - enable: '[% c("var/android") %]' - - filename: android-remove-emulator.patch - enable: '[% c("var/android") %]' - project: firefox-locale-bundle name: firefox-locale-bundle enable: '[% c("var/android") %]' - project: tba-translation name: tba-translation enable: '[% c("var/android") %]' - - filename: 1527534.patch - enable: '[% c("var/android") %]'

1 0

[tor-browser-spec/master] Update notes based on GeKo's comments.
by mikeperry＠torproject.org 11 Oct '19

11 Oct '19

commit d25eeb661b9d4975a1a7868f07d333b5332d39dd Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Oct 10 19:13:10 2019 -0500 Update notes based on GeKo's comments. --- audits/FF68_NETWORK_AUDIT | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/audits/FF68_NETWORK_AUDIT b/audits/FF68_NETWORK_AUDIT index f8965cb..93b0c9a 100644 --- a/audits/FF68_NETWORK_AUDIT +++ b/audits/FF68_NETWORK_AUDIT @@ -155,8 +155,9 @@ _SOCKET + Looks benign and also not new UDPSocket - - XXX: devtools debugger discovery still uses it + - devtools debugger discovery still uses it - ./devtools/shared/discovery/discovery.js + + Disabled via pref in #18546 + webrtc moved code + dom.udpsocket.enabled still false - fallback multicastDNS uses it (not new) @@ -167,14 +168,15 @@ TCPSocket SocketTransport + IOactivityMonitor, NetworkActivityMonitor? (old) - - XXX: presentation control service? I think this is old but moved + - presentation control service? I think this is old but moved - dom/presentation/PresentationTCPSessionTransport.cpp - - App to app service.. + + Patched - Dashboard - netwerk/base/Dashboard.cpp + Only examine opened sockets and cached DNS - - XXX: Roku control (old) + - Roku control (old) - ./toolkit/modules/secondscreen/RokuApp.jsm + + patched - NetworkConnectivityService?? This looks new - ./netwerk/base/NetworkConnectivityService.cpp + Uses DNS service and nsIChannels.. Proxy safe @@ -228,7 +230,7 @@ Android Java calls + ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + BaseResource.java (is this proxied? Who calls this?) + Lots of consumers.. - - XXX: Patch going back in: https://bugs.torproject.org/31934 + + Patch going back in: https://bugs.torproject.org/31934 + leanplum (disabled) + Adjust SDK uses execute directly + https://bugs.torproject.org/25906 disabled

1 0

[tor-browser-spec/master] Add Firefox 68 network audit notes
by mikeperry＠torproject.org 11 Oct '19

11 Oct '19

commit 8edeebec646e37161b78fabda6ab51f794df7fdb Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Oct 10 19:02:02 2019 -0500 Add Firefox 68 network audit notes --- audits/FF68_NETWORK_AUDIT | 311 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 311 insertions(+) diff --git a/audits/FF68_NETWORK_AUDIT b/audits/FF68_NETWORK_AUDIT new file mode 100644 index 0000000..f8965cb --- /dev/null +++ b/audits/FF68_NETWORK_AUDIT @@ -0,0 +1,311 @@ +Things to grep for in general when investigating changes: + +=============== Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +MDNS +TRR (DNS Trusted Recursive Resolver) + +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +============ Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +Misc PR_Socket + +=========== Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +============ Rust Portion ================ + +Rust + - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool? + - Check for new sendmsg and recvmsg usage + +============ Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + + + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + +------------------------------------------------------------------------------- +I followed the diff approach by doing `git diff esr60 esr68` and then +going over all the changes containing the above mentioned potentially dangerous +calls and features. + +Direct Paths to DNS resolution: + + PR_GetHostByName + + No new cals in diff +PR_GetIPNodeByName + + No new calls in diff +PR_GetAddrInfoByName + + Edited calls in diff, but no change +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + + One change in NSS unit tests ("127.0.0.1" to higher level call) + +MDNS: + + No substantive changes + +nsDNSService: + - nsDNSServiceDiscovery appears to support fallback JS mDNS option + + nsDNSServiceDiscovery itself is not new.. + + nsDNSService has an mProxyType now + - nsDNSService::AsyncResolveInternal()? + + Patch blocks this (XXX: Maybe should move to PreprocessHostName) + + nsDNSAsyncRequest + - nHostResolver::ResolveHost + + not used outside dnsservice + + nsDNSService::ResolveInternal() + + ResolveHost() with type now... + + Patched + + AsyncResolve, AsyncResolveNative, AsyncResolveByType + + AsyncResolveInternal() + + Patched + + Resolve() + + ResolveNative + + ResolveInternal() + + Patched + + What about our dns service patch? where did that go? + + https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-68.1.0e… + + https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-60.8.0e… +nsHostResolver: + + Only used by DNS service + + +SOCK_ + + libvpx has unit tests that use sockets + + many changes due to moved webrtc code.. + + All disabled and not compiled in + + Lots of python unittests + + Sctp code has sockets.. Is this used? + + by webrtc, which we disable + - rust/cloudabi has some... + + recordreplay has some but they are AF_UNIX + +SOCKET_ + + Again, lots due to moved WebRTC code + + Some android sockets in "LeanPlum" android lib + + leanplum is disabled + + Curl is in the tree now? lol + + Some sandboxing constants + +_SOCKET + - media/audioipc in rust? + - mio in rust? + + is media/mtransport/nr_socket_prsock.cpp off with webrtc? + + looks like yes + - IOActivityMonitor? + + Looks benign and also not new + +UDPSocket + - XXX: devtools debugger discovery still uses it + - ./devtools/shared/discovery/discovery.js + + webrtc moved code + + dom.udpsocket.enabled still false + - fallback multicastDNS uses it (not new) +TCPSocket + + devtools adbsocket uses, but to localhost + + mtransport uses, but disabled for webrtc + + Tests use + +SocketTransport + + IOactivityMonitor, NetworkActivityMonitor? (old) + - XXX: presentation control service? I think this is old but moved + - dom/presentation/PresentationTCPSessionTransport.cpp + - App to app service.. + - Dashboard + - netwerk/base/Dashboard.cpp + + Only examine opened sockets and cached DNS + - XXX: Roku control (old) + - ./toolkit/modules/secondscreen/RokuApp.jsm + - NetworkConnectivityService?? This looks new + - ./netwerk/base/NetworkConnectivityService.cpp + + Uses DNS service and nsIChannels.. Proxy safe + - TCPFastOpen (old, but flagged before) + - ./netwerk/base/TCPFastOpenLayer.cpp + - AttachTCPFastOpenIOLayer + + Appears to attach to nsSocketTransport such that it would only fast + open to the socks port.. + - TCPFastOpenConnect + + Only used via nsSocketTransport + +Extra: + PR_Socket() + + None + PR_Connect()? + + Minor changes + + +Misc XPCOM (including commands for pre-diff review approach) + + *SocketProvider + + Only minor changes + grep -R udp-socket . + + minor changes + grep -R tcp-socket . + + docstring only + grep for tcpsocket + + adb uses for 127.0.0.1 connection + + webrtc + grep -R "NS_" | grep SOCKET | grep "_C" + + indent and thread check changes; removed code + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + + minor changes to spdy and unittests + +Rust + + Check for new sendmsg and recvmsg usage + - XXX: only in mio, audioipc.. + - XXX: ask tjr to re-run tool? + +Android Java calls + - URLConnection (and HttpURLConnection) + + updater code moved; still looks ok + + BitmapConnection extends in mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java + + Some DRM thing + + Crashreporter + + leanplum (disabled) + + DefaultHttpDataSource (used only by exoplayer/HLS, which is disabled) + + tests + + grep -n openConnection\( mobile/android/thirdparty/ + + leanplum (disabled) + + UrlConnectionDownloader in mobile/android/thirdparty/com/squareup/picasso/ + + ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + + BaseResource.java (is this proxied? Who calls this?) + + Lots of consumers.. + - XXX: Patch going back in: https://bugs.torproject.org/31934 + + leanplum (disabled) + + Adjust SDK uses execute directly + + https://bugs.torproject.org/25906 disabled + + java.net + + mobile/android/geckoview/src/thirdparty/java/com/google/android/exoplayer2/upstream/UdpDataSource.java + + Not used anywhere + + also: https://gitweb.torproject.org/tor-browser.git/commit/mobile/android/geckovi… + + also https://gitweb.torproject.org/tor-browser.git/commit/mobile/android/moz.con… + - java.net.URL + - XXX: GeckoApplication.downloadImageForSetImage uses URL.openStream() + - XXX: GeckoActionProvider.downloadImageForIntent uses java.net.URL.openStream() + - XXX: GeckAppShell has many wrappers to create inputstreams from URLConnections + - Do these always have to be opened/connected first? + - XXX: GeckoMediaDrmBridgeV21.java - uses android.media.MediaDrm which seems to fetch stuff?? + - XXX: BitmapUtils.decodeUrl uses openStream for non-jar urls + - XXX: GeckoJarReader - tons of use.. Can this be used on remote jars? + - XXX: AbstractCommunicator.openConnectionAndSetHeaders() - uses url.openConnection() + - XXX: AbstractCommunicator.sendData() - uses url.getOutputStream().. maybe ok? + + javax.net + + TLSSocketFactory from sync + + not used + + ch.boye.httpclientandroidlib.conn.* (esp ssl) + + Not used + + ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + + Not used + - IntentHelper + + openUriExternal prompts if private browsing mode enabled + - XXX: Do we enable this? Can users turn it off? + - XXX: ./mobile/android/base/java/org/mozilla/gecko/activitystream/homepanel/menu/ActivityStreamContextMenu.java + - Uses intents to direct fetch URL + - XXX: Sets "show in private browsing mode" prompt to false + - XXX: ./mobile/android/base/java/org/mozilla/gecko/BrowserApp.java + - Also does telemetry via IntentHelper.openURIExternal + - XXX: Delegates to BrowserAppDelegate list in onNewIntent()... What's in this + list? + - XXX: ./mobile/android/base/java/org/mozilla/gecko/ChromeCastDisplay.java + - XXX: Looks like it might launch external service? + - XXX: ./mobile/android/base/java/org/mozilla/gecko/home/HomeFragment.java + - getHandlersFor* + - HelperApps.jsm + + browser.js uses prompt + + HelperAppDialog.js + - android.content.Intent? OMG everywhere :( + - startActivity + - XXX: ActivityHandlerHelper - Good candidate to patch for external + activities + - XXX: BrowserApp.onUrlOpenWithRefferer - Might be able to launch other + apps if OPEN_WITH_INTENT flag is set? + - XXX: CustomTabsActivity.java - Several methods + - XXX: WebAppActivity.onLoadRequest + - XXX: BasicGeckoViewPrompt.onFilePrompt() + - XXX: GeckoViewActivity.onExternalResponse() + + startActivities + + not used + + sendBroadcast + + Some wifi scanning/GPS stuff but is local broadcast.. + + sendOrderedBroadcast + + not used + + startService + + all use seems targeted to sub-components + - bindService + - XXX: SurfaceAllocator - no idea what is happening here :/ + - XXX: RemoteManager - no idea what is happening here :/ +- android.app.PendingIntent + - XXX: ChromeCastDisplay.java - probably want to make sure this is disabled? + - It uses RemotePresentationService + - XXX: CustomTabsActivity.performPendingIntent - again, hard to tell what is + happening here :/ +- android.app.DownloadManager + - XXX: BrowserApp.java uses it + - XXX: DownloadsIntegration.java uses it, but has a check for useSystemDownloadManager() ++ ActivityHandlerHelper.startIntentAndCatch + + Used only by other wrappers already covered + + + +TRR: + - assuming disabled by pref; deferring audit + +

1 0

[tor-browser-spec/master] Add a sketch for how we've done the network audits so far.
by mikeperry＠torproject.org 11 Oct '19

11 Oct '19

commit caf16ac6759033b770b557c606fff09c5b7d9bf2 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Oct 10 19:01:25 2019 -0500 Add a sketch for how we've done the network audits so far. --- audits/NETWORK_AUDIT_RUBRIC | 88 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) diff --git a/audits/NETWORK_AUDIT_RUBRIC b/audits/NETWORK_AUDIT_RUBRIC new file mode 100644 index 0000000..89ec61c --- /dev/null +++ b/audits/NETWORK_AUDIT_RUBRIC @@ -0,0 +1,88 @@ +`git diff esrA esrB` and then go over all the changes containing the +above mentioned potentially dangerous calls and features. Grep the diff for +the following strings and examine surrounding usage. + +=============== Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +MDNS +TRR (DNS Trusted Recursive Resolver) + +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +============ Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +Misc PR_Socket + +=========== Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +============ Rust Portion ================ + +Rust + - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool? + - Check for new sendmsg and recvmsg usage + +============ Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors +

1 0

[tor-browser/tor-browser-68.1.0esr-9.0-2] Update Torbutton to latest code
by gk＠torproject.org 10 Oct '19

10 Oct '19

commit 3e10c70290f8a292f074ca767610ff52af695715 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Oct 10 20:56:19 2019 +0000 Update Torbutton to latest code --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index 3509fb9c4e9d..e54639aab0c6 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit 3509fb9c4e9db216066a0d102f37d9e3d1434ef0 +Subproject commit e54639aab0c60274c14809cd9129b534bb79f92c

1 0

[tor-browser/tor-browser-68.1.0esr-9.0-2] Bug 31768: Introduce toolbar and network settings changes in onboarding
by gk＠torproject.org 10 Oct '19

10 Oct '19

commit 6126f44deb98e91efb4fb6a13dd7eb4c2c46d8e1 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Oct 9 16:54:54 2019 -0400 Bug 31768: Introduce toolbar and network settings changes in onboarding Update the "Tor Network" onboarding page to include a note that settings can now be accessed via the application preferences and add an "Adjust Your Tor Network Settings" action button which opens about:preferences#tor. Replace the Tor Browser 8.5 "update" onboarding tour with a 9.0 one that includes the revised "Tor Network" page and a revised "Toolbar" page. The latter explains that Torbutton's toolbar item has been removed ("Goodbye Onion Button") and explains how to access the New Identity feature using the hamburger menu and new toolbar item. --- browser/app/profile/000-tor-browser.js | 6 +- browser/components/uitour/UITour.jsm | 7 +++ browser/extensions/onboarding/api.js | 5 +- .../extensions/onboarding/content/Onboarding.jsm | 70 +++++++++++---------- .../onboarding/content/img/figure_tor-network.png | Bin 27931 -> 11982 bytes .../content/img/figure_tor-toolbar-layout.png | Bin 10569 -> 13269 bytes .../onboarding/content/onboarding-tour-agent.js | 6 ++ .../extensions/onboarding/content/onboarding.css | 4 ++ 8 files changed, 60 insertions(+), 38 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 49f5b6a37000..c146a83e26fe 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -347,9 +347,9 @@ pref("browser.download.panel.shown", true); pref("dom.securecontext.whitelist_onions", true); // Onboarding. -pref("browser.onboarding.tourset-version", 3); -pref("browser.onboarding.newtour", "welcome,privacy,tor-network,circuit-display,security,expect-differences,onion-services"); -pref("browser.onboarding.updatetour", "toolbar-update-8.5,security-update-8.5"); +pref("browser.onboarding.tourset-version", 4); +pref("browser.onboarding.newtour", "welcome,privacy,tor-network-9.0,circuit-display,security,expect-differences,onion-services"); +pref("browser.onboarding.updatetour", "toolbar-update-9.0,tor-network-9.0"); pref("browser.onboarding.skip-tour-button.hide", true); // prefs to disable jump-list entries in the taskbar on Windows (see bug #12885) diff --git a/browser/components/uitour/UITour.jsm b/browser/components/uitour/UITour.jsm index 2a4c81d69374..3753e55a81a1 100644 --- a/browser/components/uitour/UITour.jsm +++ b/browser/components/uitour/UITour.jsm @@ -72,11 +72,15 @@ const TOR_BROWSER_PAGE_ACTIONS_ALLOWED = new Set([ "showInfo", // restricted to TOR_BROWSER_TARGETS_ALLOWED "showMenu", // restricted to TOR_BROWSER_MENUS_ALLOWED "hideMenu", // restricted to TOR_BROWSER_MENUS_ALLOWED + "showHighlight", // restricted to TOR_BROWSER_TARGETS_ALLOWED + "hideHighlight", // restricted to TOR_BROWSER_TARGETS_ALLOWED + "openPreferences", "closeTab", "torBrowserOpenSecurityLevelPanel", ]); const TOR_BROWSER_TARGETS_ALLOWED = new Set([ + "torBrowser-newIdentityButton", "torBrowser-circuitDisplay", "torBrowser-circuitDisplay-diagram", "torBrowser-circuitDisplay-newCircuitButton", @@ -136,6 +140,9 @@ var UITour = { torBrowserCircuitDisplayTarget("circuit-display-nodes")], ["torBrowser-circuitDisplay-newCircuitButton", torBrowserCircuitDisplayTarget("circuit-reload-button")], + ["torBrowser-newIdentityButton", { + query: "#new-identity-button", + }], [ "accountStatus", diff --git a/browser/extensions/onboarding/api.js b/browser/extensions/onboarding/api.js index d11e525b9f8c..29b6f68a7914 100644 --- a/browser/extensions/onboarding/api.js +++ b/browser/extensions/onboarding/api.js @@ -39,13 +39,12 @@ const PREF_WHITELIST = [ // Tor Browser tours: "onboarding-tour-tor-welcome", "onboarding-tour-tor-privacy", - "onboarding-tour-tor-network", + "onboarding-tour-tor-network-9-0", "onboarding-tour-tor-circuit-display", "onboarding-tour-tor-security", "onboarding-tour-tor-expect-differences", "onboarding-tour-tor-onion-services", - "onboarding-tour-tor-toolbar-update-8-5", - "onboarding-tour-tor-security-update-8-5", + "onboarding-tour-tor-toolbar-update-9-0", #if 0 // Firefox tours. To reduce conflicts when rebasing against newer Firefox // code, we use the preprocessor to omit this code block. diff --git a/browser/extensions/onboarding/content/Onboarding.jsm b/browser/extensions/onboarding/content/Onboarding.jsm index 6d4dbfa35b40..4d991acf869d 100644 --- a/browser/extensions/onboarding/content/Onboarding.jsm +++ b/browser/extensions/onboarding/content/Onboarding.jsm @@ -119,19 +119,41 @@ var onboardingTourset = { return div; }, }, - "tor-network": { - id: "onboarding-tour-tor-network", + // In Tor Browser 9.0, we replaced the Tor Network panel with an updated one. + "tor-network-9.0": { + id: "onboarding-tour-tor-network-9-0", tourNameId: "onboarding.tour-tor-network", - instantComplete: true, + highlightId: "onboarding.tour-tor-update.prefix-new", getPage(win) { let div = win.document.createElement("div"); - createOnboardingTourDescription(div, + let desc = createOnboardingTourDescription(div, "onboarding.tour-tor-network.title", "onboarding.tour-tor-network.description"); + let additionalDesc = win.document.createElement("p"); + additionalDesc.className = "onboarding-tour-description-para2"; + additionalDesc.setAttribute("data-l10n-id", + "onboarding.tour-tor-network.description-para2"); + desc.appendChild(additionalDesc); + createOnboardingTourContent(div, "resource://onboarding/img/figure_tor-network.png"); - createOnboardingTourButton(div, - "onboarding-tour-tor-network-button", "onboarding.tour-tor-network.button"); + let btnContainer = createOnboardingTourButton(div, + "onboarding-tour-tor-network-action-button", "onboarding.tour-tor-network.action-button"); + btnContainer.className = "onboarding-tour-tor-action-button-container"; + // The next button (right side) is a "Done" button if we are displaying + // the tour to users who updated their browser; otherwise, it is a + // button that takes the user to the next onboarding page. + let nextBtnID, nextBtnL10nID; + if (this._tourType === "update") { + // Using the onion services IDs here seems like a mistake, but it + // provides the functionality and translated string ("Done") we need. + nextBtnID = "onboarding-tour-tor-onion-services-next-button"; + nextBtnL10nID = "onboarding.tour-tor-onion-services.next-button"; + } else { + nextBtnID = "onboarding-tour-tor-network-button"; + nextBtnL10nID = "onboarding.tour-tor-network.button"; + } + createOnboardingTourButton(div, nextBtnID, nextBtnL10nID); return div; }, }, @@ -156,7 +178,6 @@ var onboardingTourset = { "security": { id: "onboarding-tour-tor-security", tourNameId: "onboarding.tour-tor-security", - highlightId: "onboarding.tour-tor-update.prefix-new", getPage(win) { let div = win.document.createElement("div"); @@ -215,42 +236,27 @@ var onboardingTourset = { }, }, // Tour items for users who have updated their Tor Browser: - "toolbar-update-8.5": { - id: "onboarding-tour-tor-toolbar-update-8-5", + "toolbar-update-9.0": { + id: "onboarding-tour-tor-toolbar-update-9-0", tourNameId: "onboarding.tour-tor-toolbar", highlightId: "onboarding.tour-tor-update.prefix-updated", - instantComplete: true, getPage(win) { let div = win.document.createElement("div"); let desc = createOnboardingTourDescription(div, - "onboarding.tour-tor-toolbar-update-8.5.title", "onboarding.tour-tor-toolbar-update-8.5.description"); + "onboarding.tour-tor-toolbar-update-9.0.title", "onboarding.tour-tor-toolbar-update-9.0.description"); + let additionalDesc = win.document.createElement("p"); + additionalDesc.className = "onboarding-tour-description-para2"; + additionalDesc.setAttribute("data-l10n-id", + "onboarding.tour-tor-toolbar-update-9.0.description-para2"); + desc.appendChild(additionalDesc); createOnboardingTourContent(div, "resource://onboarding/img/figure_tor-toolbar-layout.png"); - createOnboardingTourButton(div, - "onboarding-tour-tor-toolbar-next-button", "onboarding.tour-tor-toolbar-update-8.5.next-button"); - - return div; - }, - }, - "security-update-8.5": { - id: "onboarding-tour-tor-security-update-8-5", - tourNameId: "onboarding.tour-tor-security", - highlightId: "onboarding.tour-tor-update.prefix-new", - getPage(win) { - let div = win.document.createElement("div"); - - let desc = createOnboardingTourDescription(div, - "onboarding.tour-tor-security-update-8.5.title", "onboarding.tour-tor-security-update-8.5.description"); - - createOnboardingTourContent(div, "resource://onboarding/img/figure_tor-security-level.png"); let btnContainer = createOnboardingTourButton(div, - "onboarding-tour-tor-security-button", "onboarding.tour-tor-security-level.button"); + "onboarding-tour-tor-toolbar-update-9-0-button", "onboarding.tour-tor-toolbar-update-9.0.button"); btnContainer.className = "onboarding-tour-tor-action-button-container"; - // It is confusing to use the two onion-services IDs below, but they - // provide the functionality and translated string ("Done") that we need. createOnboardingTourButton(div, - "onboarding-tour-tor-onion-services-next-button", "onboarding.tour-tor-onion-services.next-button"); + "onboarding-tour-tor-toolbar-next-button", "onboarding.tour-tor-toolbar-update-9.0.next-button"); return div; }, diff --git a/browser/extensions/onboarding/content/img/figure_tor-network.png b/browser/extensions/onboarding/content/img/figure_tor-network.png index fe0fa9408daa..87829397ab2a 100644 Binary files a/browser/extensions/onboarding/content/img/figure_tor-network.png and b/browser/extensions/onboarding/content/img/figure_tor-network.png differ diff --git a/browser/extensions/onboarding/content/img/figure_tor-toolbar-layout.png b/browser/extensions/onboarding/content/img/figure_tor-toolbar-layout.png index 624ef6514d39..6d8651e58c17 100644 Binary files a/browser/extensions/onboarding/content/img/figure_tor-toolbar-layout.png and b/browser/extensions/onboarding/content/img/figure_tor-toolbar-layout.png differ diff --git a/browser/extensions/onboarding/content/onboarding-tour-agent.js b/browser/extensions/onboarding/content/onboarding-tour-agent.js index a08320d0535a..7cdb10063f28 100644 --- a/browser/extensions/onboarding/content/onboarding-tour-agent.js +++ b/browser/extensions/onboarding/content/onboarding-tour-agent.js @@ -21,6 +21,12 @@ let onClick = evt => { case "onboarding-tour-tor-security-button": Mozilla.UITour.torBrowserOpenSecurityLevelPanel(); break; + case "onboarding-tour-tor-toolbar-update-9-0-button": + Mozilla.UITour.showHighlight("torBrowser-newIdentityButton", "zoom"); + break; + case "onboarding-tour-tor-network-action-button": + Mozilla.UITour.openPreferences("tor"); + break; #if 0 // Firefox onboarding actions. To reduce conflicts when rebasing against // newer Firefox code, we use the preprocessor to omit this code block. diff --git a/browser/extensions/onboarding/content/onboarding.css b/browser/extensions/onboarding/content/onboarding.css index f71ec1d13789..eb214de5e254 100644 --- a/browser/extensions/onboarding/content/onboarding.css +++ b/browser/extensions/onboarding/content/onboarding.css @@ -377,6 +377,10 @@ color: #420c5d; } +.onboarding-tour-description-para2 { + margin-top: 16px; +} + .onboarding-tour-description-suffix { margin-top: 6px; font-size: 13px;

1 0

[torbutton/master] Bug 31910: Replace meek_lite with meek in circuit display
by gk＠torproject.org 10 Oct '19

10 Oct '19

commit e54639aab0c60274c14809cd9129b534bb79f92c Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Oct 10 09:21:46 2019 -0400 Bug 31910: Replace meek_lite with meek in circuit display --- chrome/content/tor-circuit-display.js | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/chrome/content/tor-circuit-display.js b/chrome/content/tor-circuit-display.js index d21b0770..f75bd781 100644 --- a/chrome/content/tor-circuit-display.js +++ b/chrome/content/tor-circuit-display.js @@ -290,8 +290,13 @@ let updateCircuitDisplay = function () { for (let i = 0; i < nodeData.length; ++i) { let relayText; if (nodeData[i].type === "bridge") { - relayText = uiString("tor_bridge") + - ((nodeData[i].bridgeType !== "vanilla") ? `: ${nodeData[i].bridgeType}` : ""); + relayText = uiString("tor_bridge"); + let bridgeType = nodeData[i].bridgeType; + if (bridgeType === "meek_lite") { + relayText += ": meek"; + } else if (bridgeType !== "vanilla") { + relayText += ": " + bridgeType; + } } else { relayText = localizedCountryNameFromCode(nodeData[i].countryCode); }

1 0

[tor-browser/tor-browser-68.1.0esr-9.0-2] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 10 Oct '19

10 Oct '19

commit 293608f16682a977f22527bd74a449cd04d0fcd3 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Oct 9 09:43:30 2019 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 84e35f570181..49f5b6a37000 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -328,8 +328,10 @@ pref("security.family_safety.mode", 0); // Enforce SHA1 deprecation, see: bug 18042. pref("security.pki.sha1_enforcement_level", 2); -// Disable the language pack signing check for now, see: bug 26465 +// Disable the language pack signing check for now on macOS, see #31942 +#ifdef XP_MACOSX pref("extensions.langpacks.signatures.required", false); +#endif // Avoid report TLS errors to Mozilla. We might want to repurpose this feature // one day to help detecting bad relays (which is bug 19119). For now we just

1 0

[tor-browser/tor-browser-68.1.0esr-9.0-2] Bug 29013: Enable stack protection for Firefox on Windows
by boklm＠torproject.org 10 Oct '19

10 Oct '19

commit 4b8a33af9610111d87dc5a901d06bcc20f1cc7b0 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Oct 1 07:46:13 2019 +0000 Bug 29013: Enable stack protection for Firefox on Windows --- build/moz.configure/toolchain.configure | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/build/moz.configure/toolchain.configure b/build/moz.configure/toolchain.configure index 68364075f006..3bcf403bceec 100755 --- a/build/moz.configure/toolchain.configure +++ b/build/moz.configure/toolchain.configure @@ -1676,12 +1676,10 @@ def security_hardening_cflags(hardening_flag, asan, optimize, c_compiler, target # Enable only if hardening is not disabled and ASAN is # not on as ASAN will catch the crashes for us if compiler_is_gccish and not asan: - # mingw-clang cross-compile toolchain has bugs with stack protector - if target.os != 'WINNT' or c_compiler == 'gcc': - flags.append("-fstack-protector-strong") - ldflags.append("-fstack-protector-strong") - js_flags.append("-fstack-protector-strong") - js_ldflags.append("-fstack-protector-strong") + flags.append("-fstack-protector-strong") + ldflags.append("-fstack-protector-strong") + js_flags.append("-fstack-protector-strong") + js_ldflags.append("-fstack-protector-strong") # ASLR ------------------------------------------------ # ASLR (dynamicbase) is enabled by default in clang-cl; but the

1 0