- tbb-commits - lists.torproject.org

[tor-browser-spec/master] Bug 40001: Add rebasing process document
by gk＠torproject.org 07 Jul '20

07 Jul '20

commit f857ef5ae6c8af955198bd28c7b54bf7df624b53 Author: Alex Catarineu <acat(a)torproject.org> Date: Mon Jun 22 18:17:44 2020 +0200 Bug 40001: Add rebasing process document --- processes/Rebasing | 161 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 161 insertions(+) diff --git a/processes/Rebasing b/processes/Rebasing new file mode 100644 index 0000000..144f5ab --- /dev/null +++ b/processes/Rebasing @@ -0,0 +1,161 @@ +Rebasing Tor Browser patches on top of a new Firefox version +============================================================ + +These instructions assume branches of Tor Browser code are maintained with git, +and consist of a sequence of patches (commits) applied on top of some commit +from the https://github.com/mozilla/gecko-dev.git mirror of the Mercurial +Gecko repositories. + +1) Rebase +--------- + +This consists of applying the Tor Browser patches (commits) from some branch on +top of a newer Firefox branch, and fixing up possible conflicts. There should be +a helper script that automates as much of this process as possible: + +Steps: + +- Move to the branch that contains the patches to be rebased and create a new + one, since it will be modified during the rebasing process: + `git checkout [current_tor_browser_branch] -b [new_rebased_branch_name]` +- Execute the rebase helper script: `./git-tbrebase [target_firefox_branch]`. + Responsibilities of the script: + - Get the list of Tor Browser patches from `current_tor_browser_branch`. + - Check whether some of the patches are already in `target_firefox_branch` + (e.g. backports) and mark them to be skipped in that case. + - Move to `target_firefox_branch` (e.g. + `git reset --hard [target_firefox_branch]`) and apply patches. + - Keep a log of all the process in a way that it can be used as a "rebase + report" for the reviewer. + - This should include, among other things, the time needed for resolving + patch conflicts. + - For each conflict, show the bugzilla tickets responsible for it, based on + `git blame` on the conflicting lines. + - After resolving a patch conflict, ask the rebaser whether comments need to + be added, and make sure these are included in the "rebase report". + - If there are patches that require manual steps when rebasing (e.g. copying + nightly branding folder to alpha, etc.), stop and warn about it. + - There could be instructions encoded in the commit message using some + convention. + - Or maybe run some script automatically, similarly to git hooks. +- In case of conflict: + - Resolve manually. + - Check whether the commit message needs to be changed due to the conflict + resolution (e.g. a partially uplifted patch), and do so if needed. + - Run `./git-tbrebase --continue` to continue with the process (or `--skip` or + `--abort`, similarly to `git rebase`). + +2) Build +-------- + +Ideally, we should do a full tor-browser-build here. But: + +- These can take quite long, and are not incremental. +- The `tor-browser-build` toolchains might need changes for newer Firefox + versions. + +At this stage, it should be fine to do a local build and use a `repackage_tb` +script which takes the latest linux64 Tor Browser build and repackages it with +the locally built Tor Browser from `obj-x86_64-pc-linux-gnu`. + +Steps: + +- Copy `tor-launcher` master to `browser/extensions`. +- Make sure `torbutton` submodule is correctly loaded: + `git submodule update --init` +- Edit `.mozconfig` to set + - `ac_add_options --enable-tests` + - `ac_add_options --enable-debug` + - `ac_add_options --enable-tor-launcher` + - `ac_add_options --enable-tor-browser-update` +- Optionally, add + `ac_add_options --with-ccache=/home/user/.mozbuild/sccache/sccache` to use + `sccache` for speeding up subsequent builds. +- `./mach build && ./mach package` +- `./repackage_tb` + +At the end, there should be a `tor-browser-linux64-version_en-US.tar.xz` +artifact, which is the repackaged Tor Browser. + +3) Manual testing +----------------- + +This should ideally not be needed, but until everything is covered by automated +testing we can do a quick manual test to catch the most obvious breakage: + +- Launch the repackaged browser and check: + - Tor is launched correctly. + - `about:tor` is displayed with no errors + - `about:preferences` is not broken. + - It's possible to navigate to some website (e.g. duckduckgo search) + - The circuit display is working and displayed correctly. + +4) Automated testing +-------------------- + +There should be a single script that runs all tests, but for now let's +list the individual commands: + +- `./run-tbb-tests` should run the Tor Browser unit tests locally. +- + `./tor-browser-bundle-testsuite/tbb-testsuite --no-xdummy tor-browser-linux64-version_en-US.tar.xz` + should run the Tor Browser testsuite. +- `./mach lint` should check for linting errors. + +5) Debug/Fix +------------ + +For each issue found while running tests, debug and/or fix it, then iterate 2-5 +until no more test failures are found. + +For fixing up a commit, a script `./git-tbedit [commit]` should be used, so that +the time spent editing the patch is tracked and included in the rebase report. + +6) Push for review +------------------ + +In the ticket for the rebase work, the rebaser should add a reference to the +rebased branch that has to be reviewed, and a rebase report, which should +contain, for every Tor Browser commit in the original branch: + +``` +[SKIPPED|PICKED|CONFLICT][original_hash][commit_summary] + (optional) Total time editing commit: + (optional) Comments: + Some comments relevant for the reviewer. + (optional) Conflicts: + List of conflicting files. +``` + +Other +----- + +- Picking Tor Browser patches and changes that landed after the rebase started. + +The rebasing and reviewing process can last long enough for newer patches and +changes to have landed after the process started. + +Doing a full rebase with a later tor-browser branch would be too costly, so we +need to identify the changes that landed between the branch that was originally +rebased and the newer Tor Browser branch and only apply those. + +Until this is properly automated, a suggested manual approach is to do: + +`git range-diff original_starting_commit~1..original_ending_commit new_starting_commit~1..new_ending_commit`, +so basically doing a range-diff between the original set of patches that were +rebased, and a more up-to-date set of patches. Then, we should manually be able +to pick the missing changes, as fixup or squash commits. + +- Reordering/squashing patches + +We should not mix rebasing changes + fixing conflicts with patch reordering and +squashing. More concretely, it should be possible to check with +`git diff original_tb_branch..reordered_and_squashed_tb_branch` that the +reordered branch contents are equivalent to the previous branch. + +- Double-checking that no patch was accidentally lost in the process + +While this should not be possible if most of the process is properly automated, +it should not be very costly to double-check it. For this, there could be a +script that compares the current rebased branch with the latest tor-browser +branch, and shows the differences (comparing the set of commit messages).

1 0

[tor-browser-spec/master] Change torbutton fixup instructions in ReleaseProcess
by gk＠torproject.org 04 Jul '20

04 Jul '20

commit 031a48a9c00b24ac6d71649e892fd306713276ca Author: Alex Catarineu <acat(a)torproject.org> Date: Fri Jul 3 12:57:24 2020 +0200 Change torbutton fixup instructions in ReleaseProcess --- processes/ReleaseProcess | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/processes/ReleaseProcess b/processes/ReleaseProcess index 1c2076e..563f263 100644 --- a/processes/ReleaseProcess +++ b/processes/ReleaseProcess @@ -7,7 +7,8 @@ # In particular: before tagging the tor-browser tag, the final code from # Torbutton needs to get included and in order to avoid unnecessary commit # inflation the commit for bumping the git submodule should be a fixup commit -# to the one with "Pick up latest Torbutton code" in its commit message. +# to the one with "Bug 25013: Add torbutton as a tor-browser submodule" in +# its commit message. #. Update changelog and relevant config files in tor-browser-build. cd tor-browser-build

1 0

[tor-browser-build/master] Fold in 9.5.1 Changelog
by gk＠torproject.org 01 Jul '20

01 Jul '20

commit 860a8a38dbca4c9e1ce21277f51860d194aec8d8 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jul 1 10:19:19 2020 +0000 Fold in 9.5.1 Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index e9126c2..fd03cd1 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -15,6 +15,19 @@ Tor Browser 10.0a2 -- June 30 2020 * Android * Bug 34372: Disable GeckoNetworkManager +Tor Browser 9.5.1 -- June 30 2020 + * All Platforms + * Update Firefox to 68.10.0esr + * Update NoScript to 11.0.32 + * Translations update + * Bug 40009: Improve tor's client auth stability + * Windows + OS X + Linux + * Bug 34361: "Prioritize .onion sites when known" appears under General + * Bug 34362: Improve Onion Service Authentication prompt + * Bug 34369: Fix learn more link in Onion Auth prompt + * Bug 34379: Fix learn more for Onion-Location + * Bug 34347: The Tor Network part on the onboarding is not new anymore + Tor Browser 10.0a1 -- June 2 2020 * All Platforms * Update Firefox to 68.9.0esr

1 0

[tor-browser-build/master] Release preparations for 10.0a2
by sysrqb＠torproject.org 27 Jun '20

27 Jun '20

commit a0cf2d77e652d2c5188c1e11b613d04e5d47da1b Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Jun 26 17:56:29 2020 +0000 Release preparations for 10.0a2 Versions bump and Changelog update. --- projects/firefox/config | 2 +- projects/tba-translation/config | 2 +- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 17 +++++++++++++++++ projects/tor-browser/config | 4 ++-- projects/tor/config | 2 +- rbm.conf | 4 ++-- 6 files changed, 24 insertions(+), 7 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index a64763e..019dfc1 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -8,7 +8,7 @@ git_submodule: 1 gpg_keyring: torbutton.gpg var: - firefox_platform_version: 68.9.0 + firefox_platform_version: 68.10.0 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 10.0 branding_directory: '[% IF c("var/android") %]mobile/android[% ELSE %]browser[% END %]/branding/alpha' diff --git a/projects/tba-translation/config b/projects/tba-translation/config index ab5c04e..520f570 100644 --- a/projects/tba-translation/config +++ b/projects/tba-translation/config @@ -3,5 +3,5 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' git_url: https://git.torproject.org/translation.git # We need to bump the commit before releasing but just pointing to a branch # might cause too much rebuidling of the Firefox part. -git_hash: d5bd416ac0cda30893e18f2eb511514bd2e698bd +git_hash: e93401f698cca39971395625e1f8de54b978ab88 version: '[% c("abbrev") %]' diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 224248c..e9126c2 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,20 @@ +Tor Browser 10.0a2 -- June 30 2020 + * All Platforms + * Update Firefox to 68.10.0esr + * Update NoScript to 11.0.32 + * Update Tor to 0.4.4.1-alpha + * Translations update + * Bug 34209: about:tor and about:tbupdate fail to load in debug build + * Bug 34250: Only listen to 'started' in noscript-control.js + * Bug 34383: Accept request if GetHost() in mixed content blocking check fails + * Windows + OS X + Linux + * Bug 34361: "Prioritize .onion sites when known" appears under General + * Bug 34362: Improve Onion Service Authentication prompt + * Bug 34369: Fix learn more link in Onion Auth prompt + * Bug 34379: Fix learn more for Onion-Location + * Android + * Bug 34372: Disable GeckoNetworkManager + Tor Browser 10.0a1 -- June 2 2020 * All Platforms * Update Firefox to 68.9.0esr diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 809bfa0..da6e40b 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -73,9 +73,9 @@ input_files: enable: '[% c("var/snowflake") && ! c("var/android") %]' - filename: Bundle-Data enable: '[% ! c("var/android") %]' - - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… + - URL: https://addons.cdn.mozilla.net/user-media/addons/722/noscript_security_suit… name: noscript - sha256sum: 99a70a78733fe7e21852f67bde090f6a57b5bdbd34ecbbdfcf481dc861965fd8 + sha256sum: 088c0b0f08529d88aacee3b1c09cfafe304b98cb2847c3fc255e05d1bf10bd6d - filename: 'RelativeLink/start-tor-browser.desktop' enable: '[% c("var/linux") %]' - filename: 'RelativeLink/execdesktop' diff --git a/projects/tor/config b/projects/tor/config index 912f839..72d7a8a 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -1,6 +1,6 @@ # vim: filetype=yaml sw=2 filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -version: 0.4.3.5 +version: 0.4.4.1-alpha git_hash: 'tor-[% c("version") %]' git_url: https://git.torproject.org/tor.git git_submodule: 1 diff --git a/rbm.conf b/rbm.conf index d0afe9a..0ccfc9d 100644 --- a/rbm.conf +++ b/rbm.conf @@ -24,10 +24,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '10.0a1' + torbrowser_version: '10.0a2' torbrowser_build: 'build1' torbrowser_incremental_from: - - 9.5a13 + - 10.0a1 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser/tor-browser-68.9.0esr-10.0-1] Merge remote-tracking branch 'gk/bug_34372_v2' into tor-browser-68.9.0esr-10.0-1
by sysrqb＠torproject.org 27 Jun '20

27 Jun '20

commit 4a1c5a32c190b219c3c520a72710aa2ff7b5f3f5 Merge: a745de73db61 4912857cacd8 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Jun 26 18:30:04 2020 +0000 Merge remote-tracking branch 'gk/bug_34372_v2' into tor-browser-68.9.0esr-10.0-1 .../geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor-browser/tor-browser-68.9.0esr-10.0-1] fixup! Bug 25741 - TBA: Disable GeckoNetworkManager
by sysrqb＠torproject.org 27 Jun '20

27 Jun '20

commit 4912857cacd85b02787a90b8939024b56d2b8cd1 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 10 12:46:33 2020 +0000 fixup! Bug 25741 - TBA: Disable GeckoNetworkManager Bug 34372: Disable GeckoNetworkManager We should only start and stop the network manager if we are *not* Tor Browser. --- .../geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java index 804b8f0000e9..6d28d919f8c4 100644 --- a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java +++ b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntime.java @@ -118,7 +118,7 @@ public final class GeckoRuntime implements Parcelable { Log.d(LOGTAG, "Lifecycle: onResume"); // Monitor network status and send change notifications to Gecko // while active. - if (BuildConfig.TOR_BROWSER_VERSION != "") { + if (BuildConfig.TOR_BROWSER_VERSION == "") { GeckoNetworkManager.getInstance().start(GeckoAppShell.getApplicationContext()); } } @@ -127,7 +127,7 @@ public final class GeckoRuntime implements Parcelable { void onPause() { Log.d(LOGTAG, "Lifecycle: onPause"); // Stop monitoring network status while inactive. - if (BuildConfig.TOR_BROWSER_VERSION != "") { + if (BuildConfig.TOR_BROWSER_VERSION == "") { GeckoNetworkManager.getInstance().stop(); } }

1 0

[tor-browser-build/maint-9.5] Pickup build2 for client auth stability
by sysrqb＠torproject.org 25 Jun '20

25 Jun '20

commit e94ba3a7677f7051a14b2304427ec8393a450fdc Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jun 24 20:11:37 2020 +0000 Pickup build2 for client auth stability --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 3e8689b..c65d3a8 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '9.5.1' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 9.5 project_name: tor-browser

1 0

[tor-browser-build/maint-9.5] Bug 40009: Improve tor's client auth stability
by gk＠torproject.org 25 Jun '20

25 Jun '20

commit bf0065b5c36c6b37fd493e408c220c7757c8eeec Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jun 24 18:38:18 2020 +0000 Bug 40009: Improve tor's client auth stability --- ...ve-accessor-semantic-of-client-cached-obj.patch | 212 +++++++++++++++++++++ projects/tor/build | 4 + projects/tor/config | 1 + 3 files changed, 217 insertions(+) diff --git a/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch b/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch new file mode 100644 index 0000000..1432039 --- /dev/null +++ b/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch @@ -0,0 +1,212 @@ +From 1810771799dd0b434ac2b5926297d64e383582e1 Mon Sep 17 00:00:00 2001 +From: David Goulet <dgoulet(a)torproject.org> +Date: Tue, 10 Mar 2020 10:58:51 -0400 +Subject: [PATCH] hs-v3: Improve accessor semantic of client cached object + +Add an inline helper function that indicates if the cached object contains a +decrypted descriptor or not. + +The descriptor object is NULL if tor is unable to decrypt it (lacking client +authorization) and some actions need to be done only when we have a decrypted +object. + +This improves code semantic. + +Fixes #33458 + +Signed-off-by: David Goulet <dgoulet(a)torproject.org> +--- + src/feature/hs/hs_cache.c | 64 +++++++++++++++++++++++++++++++-------- + src/test/test_hs_client.c | 46 ++++++++++++++++++++++++++++ + 2 files changed, 98 insertions(+), 12 deletions(-) + +diff --git a/src/feature/hs/hs_cache.c b/src/feature/hs/hs_cache.c +index 9cf408ca3e..44cd2505fd 100644 +--- a/src/feature/hs/hs_cache.c ++++ b/src/feature/hs/hs_cache.c +@@ -27,6 +27,21 @@ + static int cached_client_descriptor_has_expired(time_t now, + const hs_cache_client_descriptor_t *cached_desc); + ++/** Helper function: Return true iff the cache entry has a decrypted ++ * descriptor. ++ * ++ * A NULL desc object in the entry means that we were not able to decrypt the ++ * descriptor because we are likely lacking client authorization. It is still ++ * a valid entry but some operations can't be done without the decrypted ++ * descriptor thus this function MUST be used to safe guard access to the ++ * decrypted desc object. */ ++static inline bool ++entry_has_decrypted_descriptor(const hs_cache_client_descriptor_t *entry) ++{ ++ tor_assert(entry); ++ return (entry->desc != NULL); ++} ++ + /********************** Directory HS cache ******************/ + + /** Directory descriptor cache. Map indexed by blinded key. */ +@@ -341,8 +356,23 @@ static digest256map_t *hs_cache_client_intro_state; + static size_t + cache_get_client_entry_size(const hs_cache_client_descriptor_t *entry) + { +- return sizeof(*entry) + +- strlen(entry->encoded_desc) + hs_desc_obj_size(entry->desc); ++ size_t size = 0; ++ ++ if (entry == NULL) { ++ goto end; ++ } ++ size += sizeof(*entry); ++ ++ if (entry->encoded_desc) { ++ size += strlen(entry->encoded_desc); ++ } ++ ++ if (entry_has_decrypted_descriptor(entry)) { ++ size += hs_desc_obj_size(entry->desc); ++ } ++ ++ end: ++ return size; + } + + /** Remove a given descriptor from our cache. */ +@@ -659,14 +689,20 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) + * client authorization. */ + cache_entry = lookup_v3_desc_as_client(client_desc->key.pubkey); + if (cache_entry != NULL) { +- /* Signalling an undecrypted descriptor. We'll always replace the one we +- * have with the new one just fetched. */ +- if (cache_entry->desc == NULL) { ++ /* If the current or the new cache entry don't have a decrypted descriptor ++ * (missing client authorization), we always replace the current one with ++ * the new one. Reason is that we can't inspect the revision counter ++ * within the plaintext data so we blindly replace. */ ++ if (!entry_has_decrypted_descriptor(cache_entry) || ++ !entry_has_decrypted_descriptor(client_desc)) { + remove_v3_desc_as_client(cache_entry); + cache_client_desc_free(cache_entry); + goto store; + } + ++ /* From this point on, we know that the decrypted descriptor is in the ++ * current entry and new object thus safe to access. */ ++ + /* If we have an entry in our cache that has a revision counter greater + * than the one we just fetched, discard the one we fetched. */ + if (cache_entry->desc->plaintext_data.revision_counter > +@@ -740,11 +776,15 @@ cache_clean_v3_as_client(time_t now) + MAP_DEL_CURRENT(key); + entry_size = cache_get_client_entry_size(entry); + bytes_removed += entry_size; ++ + /* We just removed an old descriptor. We need to close all intro circuits +- * so we don't have leftovers that can be selected while lacking a +- * descriptor. We leave the rendezvous circuits opened because they could +- * be in use. */ +- hs_client_close_intro_circuits_from_desc(entry->desc); ++ * if the descriptor is decrypted so we don't have leftovers that can be ++ * selected while lacking a descriptor. Circuits are selected by intro ++ * authentication key thus we need the descriptor. We leave the rendezvous ++ * circuits opened because they could be in use. */ ++ if (entry_has_decrypted_descriptor(entry)) { ++ hs_client_close_intro_circuits_from_desc(entry->desc); ++ } + /* Entry is not in the cache anymore, destroy it. */ + cache_client_desc_free(entry); + /* Update our OOM. We didn't use the remove() function because we are in +@@ -793,7 +833,7 @@ hs_cache_lookup_as_client(const ed25519_public_key_t *key) + tor_assert(key); + + cached_desc = lookup_v3_desc_as_client(key->pubkey); +- if (cached_desc && cached_desc->desc) { ++ if (cached_desc && entry_has_decrypted_descriptor(cached_desc)) { + return cached_desc->desc; + } + +@@ -866,7 +906,7 @@ hs_cache_remove_as_client(const ed25519_public_key_t *key) + /* If we have a decrypted/decoded descriptor, attempt to close its + * introduction circuit(s). We shouldn't have circuit(s) without a + * descriptor else it will lead to a failure. */ +- if (cached_desc->desc) { ++ if (entry_has_decrypted_descriptor(cached_desc)) { + hs_client_close_intro_circuits_from_desc(cached_desc->desc); + } + /* Remove and free. */ +@@ -995,7 +1035,7 @@ hs_cache_client_new_auth_parse(const ed25519_public_key_t *service_pk) + } + + cached_desc = lookup_v3_desc_as_client(service_pk->pubkey); +- if (cached_desc == NULL || cached_desc->desc != NULL) { ++ if (cached_desc == NULL || entry_has_decrypted_descriptor(cached_desc)) { + /* No entry for that service or the descriptor is already decoded. */ + goto end; + } +diff --git a/src/test/test_hs_client.c b/src/test/test_hs_client.c +index 5f7fe9c404..bff71d2645 100644 +--- a/src/test/test_hs_client.c ++++ b/src/test/test_hs_client.c +@@ -965,6 +965,7 @@ test_close_intro_circuits_new_desc(void *arg) + (void) arg; + + hs_init(); ++ rend_cache_init(); + + /* This is needed because of the client cache expiration timestamp is based + * on having a consensus. See cached_client_descriptor_has_expired(). */ +@@ -989,6 +990,51 @@ test_close_intro_circuits_new_desc(void *arg) + circ->purpose = CIRCUIT_PURPOSE_C_INTRODUCING; + ocirc = TO_ORIGIN_CIRCUIT(circ); + ++ /* Build a descriptor _without_ client authorization and thus not ++ * decryptable. Make sure the close circuit code path is not triggered. */ ++ { ++ char *desc_encoded = NULL; ++ uint8_t descriptor_cookie[HS_DESC_DESCRIPTOR_COOKIE_LEN]; ++ curve25519_keypair_t client_kp; ++ hs_descriptor_t *desc = NULL; ++ ++ tt_int_op(0, OP_EQ, curve25519_keypair_generate(&client_kp, 0)); ++ crypto_rand((char *) descriptor_cookie, sizeof(descriptor_cookie)); ++ ++ desc = hs_helper_build_hs_desc_with_client_auth(descriptor_cookie, ++ &client_kp.pubkey, ++ &service_kp); ++ tt_assert(desc); ++ ret = hs_desc_encode_descriptor(desc, &service_kp, descriptor_cookie, ++ &desc_encoded); ++ tt_int_op(ret, OP_EQ, 0); ++ /* Associate descriptor intro key with the dummy circuit. */ ++ const hs_desc_intro_point_t *ip = ++ smartlist_get(desc->encrypted_data.intro_points, 0); ++ tt_assert(ip); ++ ocirc->hs_ident = hs_ident_circuit_new(&service_kp.pubkey); ++ ed25519_pubkey_copy(&ocirc->hs_ident->intro_auth_pk, ++ &ip->auth_key_cert->signed_key); ++ hs_descriptor_free(desc); ++ tt_assert(desc_encoded); ++ /* Put it in the cache. Should not be decrypted since the client ++ * authorization creds were not added to the global map. */ ++ ret = hs_cache_store_as_client(desc_encoded, &service_kp.pubkey); ++ tor_free(desc_encoded); ++ tt_int_op(ret, OP_EQ, HS_DESC_DECODE_NEED_CLIENT_AUTH); ++ ++ /* Clean cache with a future timestamp. It will trigger the clean up and ++ * attempt to close the circuit but only if the descriptor is decryptable. ++ * Cache object should be removed and circuit untouched. */ ++ hs_cache_clean_as_client(mock_ns.valid_after + (60 * 60 * 24)); ++ tt_assert(!hs_cache_lookup_as_client(&service_kp.pubkey)); ++ ++ /* Make sure the circuit still there. */ ++ tt_assert(circuit_get_next_intro_circ(NULL, true)); ++ /* Get rid of the ident, it will be replaced in the next tests. */ ++ hs_ident_circuit_free(ocirc->hs_ident); ++ } ++ + /* Build the first descriptor and cache it. */ + { + char *encoded; +-- +2.20.1 + diff --git a/projects/tor/build b/projects/tor/build index 30ecc7e..012ec98 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -91,6 +91,10 @@ openssldir=/var/tmp/dist/openssl/openssl [% END %] cd /var/tmp/build/[% project %]-[% c('version') %] + +# Cherry-pick patch until 0.4.3.6 is released. +patch -p1 < $rootdir/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch + # add git hash to micro-revision.i for #24995 echo '"[% c("abbrev", { abbrev_length => 16 }) %]"' > micro-revision.i ./autogen.sh diff --git a/projects/tor/config b/projects/tor/config index 912f839..1f57465 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -68,3 +68,4 @@ input_files: - name: zstd project: zstd enable: '[% c("var/android") %]' + - filename: 0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch

1 0

[tor-browser-build/maint-9.5] Add #40009 in ChangeLog
by gk＠torproject.org 25 Jun '20

25 Jun '20

commit e6b52336481796573e88e082c15142370a4ee8ae Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jun 24 19:37:04 2020 +0000 Add #40009 in ChangeLog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 7a589d9..c204a38 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -3,6 +3,7 @@ Tor Browser 9.5.1 -- June 30 2020 * Update Firefox to 68.10.0esr * Update NoScript to 11.0.32 * Translations update + * Bug 40009: Improve tor's client auth stability * Windows + OS X + Linux * Bug 34361: "Prioritize .onion sites when known" appears under General * Bug 34362: Improve Onion Service Authentication prompt

1 0

[tor-browser/tor-browser-68.9.0esr-10.0-1] fixup! Bug 23247: Communicating security expectations for .onion
by gk＠torproject.org 25 Jun '20

25 Jun '20

commit a745de73db61e6654554109b06ece81329a9244d Author: Alex Catarineu <acat(a)torproject.org> Date: Wed Jun 24 15:03:42 2020 +0200 fixup! Bug 23247: Communicating security expectations for .onion Fixes bug 34383. --- dom/security/nsMixedContentBlocker.cpp | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/dom/security/nsMixedContentBlocker.cpp b/dom/security/nsMixedContentBlocker.cpp index 2bbc2e8aecb3..fecbd5552ec3 100644 --- a/dom/security/nsMixedContentBlocker.cpp +++ b/dom/security/nsMixedContentBlocker.cpp @@ -746,16 +746,7 @@ nsresult nsMixedContentBlocker::ShouldLoad( return NS_OK; } if (!parentIsHttps) { - nsAutoCString parentHost; - rv = innerRequestingLocation->GetHost(parentHost); - if (NS_FAILED(rv)) { - NS_ERROR("requestingLocation->GetHost failed"); - *aDecision = REJECT_REQUEST; - return NS_OK; - } - - bool parentIsOnion = - StringEndsWith(parentHost, NS_LITERAL_CSTRING(".onion")); + bool parentIsOnion = IsPotentiallyTrustworthyOnion(innerRequestingLocation); if (!parentIsOnion) { *aDecision = ACCEPT; return NS_OK;

1 0