- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-60.3.0esr-8.0-1] Bug 26381: about:tor page does not load on first start on Windows
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit dcf7cc2acd095e27d82b16424d4d23fb9b5d7559 Author: Richard Pospesel <richard(a)torproject.org> Date: Sat Sep 15 04:01:17 2018 +0000 Bug 26381: about:tor page does not load on first start on Windows Child content processes require certain directories to be marked as readable or writeable when Sandboxing is enabled. The directories to be whitelisted are saved in static variables in sandboxBroker.cpp and are initialized in SandboxBroker::GeckoDependentInitialize(). Any child content process which is created before these directories are saved will be unable to read or write to them. The tor-launcher extension triggers the creation of a content process which hosts the tor network configuration settings window. This process is created before the whitelisted directories are saved. The network settings process doesn't need access to these directories to function, but subsequent content processes which are created once the settings window exits do need these directories to function. Sometimes, the creation of these subsequent processes is slow enough for the parent process to 'catch up' and create the whitelist resulting in the broken about:tor tab or broken white tab. A previous iteration of this patch moved the GeckoDependentInitialize() call directly above the call to DoStartup(). However, Mozilla dev Bob Owen objected to this since this places the call before various services are initialized which the SandboxBroker may depend on. Some experimentation would seem to confirm his objections: placing the whitelist init just prior to DoStartup() results in an empty value for the profile directory which prevents child processes reading the chrome and extensions directory. This patch inserts the GeckoDependentInitialize() call into DoStartup() just after the profile directory is known and queryable by the SandboxBroker, and before the 'profile-after-change' notification is fired. It also reverts the temp fix which reduced the sandbox level to 2 on windows. --- browser/app/profile/000-tor-browser.js | 5 ----- toolkit/xre/nsAppRunner.cpp | 6 ------ toolkit/xre/nsXREDirProvider.cpp | 19 +++++++++++++++++++ 3 files changed, 19 insertions(+), 11 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 07005f326580..8f74748f2072 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -330,11 +330,6 @@ pref("browser.onboarding.newtour", "welcome,privacy,tor-network,circuit-display, pref("browser.onboarding.updatetour", "welcome,privacy,tor-network,circuit-display,security,expect-differences,onion-services"); pref("browser.onboarding.skip-tour-button.hide", true); -#ifdef XP_WIN -// For now, reduce sandboxing level to 2 (see #26381). -pref("security.sandbox.content.level", 2); -#endif - #ifdef TOR_BROWSER_VERSION #expand pref("torbrowser.version", __TOR_BROWSER_VERSION__); #endif diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp index 1000014aedd0..7889919ca677 100644 --- a/toolkit/xre/nsAppRunner.cpp +++ b/toolkit/xre/nsAppRunner.cpp @@ -5249,12 +5249,6 @@ XREMain::XRE_mainRun() // We intentionally leak the string here since it is required by PR_SetEnv. PR_SetEnv(saved.release()); } - -#if defined(MOZ_SANDBOX) - // Call SandboxBroker to initialize things that depend on Gecko machinery like - // the directory provider. - SandboxBroker::GeckoDependentInitialize(); -#endif #endif SaveStateForAppInitiatedRestart(); diff --git a/toolkit/xre/nsXREDirProvider.cpp b/toolkit/xre/nsXREDirProvider.cpp index b54985292e81..72545d0eb422 100644 --- a/toolkit/xre/nsXREDirProvider.cpp +++ b/toolkit/xre/nsXREDirProvider.cpp @@ -66,6 +66,10 @@ #include "UIKitDirProvider.h" #endif +#if defined(MOZ_SANDBOX) && defined(XP_WIN) +#include "sandboxBroker.h" +#endif + #if defined(MOZ_CONTENT_SANDBOX) #include "mozilla/SandboxSettings.h" #include "nsIUUIDGenerator.h" @@ -1003,6 +1007,21 @@ nsXREDirProvider::DoStartup() policies->Observe(nullptr, "policies-startup", nullptr); } + #if defined(MOZ_SANDBOX) && defined(XP_WIN) + // Call SandboxBroker to initialize things that depend on Gecko machinery like + // the directory provider. + + // We insert this initialization code here so that any child content processes spawned by + // extensions (such as tor-launcher launching the network configuration window) will have + // all the requisite directories white-listed for read/write access + + // It's inserted here (rather than in XREMain::XRE_mainRun) because we need + // NS_APP_USER_PROFILE_50_DIR to be known + + // See tor bug #26381 and mozilla bug #1485836 + SandboxBroker::GeckoDependentInitialize(); + #endif + // Init the Extension Manager nsCOMPtr<nsIObserver> em = do_GetService("@mozilla.org/addons/integration;1"); if (em) {

1 0

[tor-browser-build/maint-8.0] Bug 26475: Disable building Rust with Thin LTO
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit dd1d00a2fed85c8bb22c4f85bbc45da00d0e8c05 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Oct 15 09:48:59 2018 +0000 Bug 26475: Disable building Rust with Thin LTO Building Rust with Thin LTO enabled leads to Tor Browser builds on macOS and probably Linux not being reproducible. The exact reason for that is unknown at the moment, although it seems fixed testing nightly Rust source tarballs as of mid-September 2018. We therefore disable Thin LTO for now by setting `codegen-units` to `1`. --- projects/firefox/mozconfig-osx-x86_64 | 3 --- projects/rust/build | 10 ++++++++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/projects/firefox/mozconfig-osx-x86_64 b/projects/firefox/mozconfig-osx-x86_64 index 7ff17e1..1e30084 100644 --- a/projects/firefox/mozconfig-osx-x86_64 +++ b/projects/firefox/mozconfig-osx-x86_64 @@ -48,9 +48,6 @@ ac_add_options --disable-crashreporter ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests -# We need to disable for Stylo right now, as we have reproducibility issues on -# macOS with it enabled, see: #26475. -ac_add_options --disable-stylo # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme # ac_add_options --disable-ctypes diff --git a/projects/rust/build b/projects/rust/build index 936f49f..61a5d50 100644 --- a/projects/rust/build +++ b/projects/rust/build @@ -65,6 +65,16 @@ cd /var/tmp/build/rustc-[% c('version') %]-src mkdir build cd build ../configure --prefix=$distdir [% c("var/configure_opt") %] + +# We need to disable Thin LTO due to reproducibility issues on macOS and +# probably Linux. Alas, there is no direct option available in the config.toml +# in 1.26.1 yet, so we need to toggle this indirectly via `codegen-units`. +[% IF c("var/osx") || c("var/linux") %] + # It seems hard to pass the proper value via ./configure so we resort to our + # old friend `sed`. + sed -i 's/#codegen-units = 1/codegen-units = 1/' config.toml +[% END %] + make -j[% c("buildconf/num_procs") %] make install cd /var/tmp/dist

1 0

[tor-browser-build/maint-8.0] Update rbm to pick up fix for #28466
by gk＠torproject.org 05 Dec '18

05 Dec '18

commit 316463d531d66b0d8d5978fcaaa06f5d3eed0de7 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 28 13:38:28 2018 +0000 Update rbm to pick up fix for #28466 --- rbm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm b/rbm index 8adbc46..eb500fa 160000 --- a/rbm +++ b/rbm @@ -1 +1 @@ -Subproject commit 8adbc46dc9e8358abad75ac81faf4646d8165b9e +Subproject commit eb500fa9467fb4d7229c9ca87f202ef18603d023

1 0

[torbutton/master] Bug 28075: Tone down missing SOCKS credential warning
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 0b60f61087b514f74ea21513f14e691c2bd30493 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Oct 17 06:48:20 2018 +0000 Bug 28075: Tone down missing SOCKS credential warning --- src/chrome/content/tor-circuit-display.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/chrome/content/tor-circuit-display.js b/src/chrome/content/tor-circuit-display.js index 6105fea1..5fc92e48 100644 --- a/src/chrome/content/tor-circuit-display.js +++ b/src/chrome/content/tor-circuit-display.js @@ -310,7 +310,7 @@ let updateCircuitDisplay = function () { (nodeData[0].type === "bridge") ? "none" : "block"; } else { // Only show the Tor circuit if we have credentials and node data. - logger.eclog(5, "no SOCKS credentials found for current document."); + logger.eclog(4, "no SOCKS credentials found for current document."); } showCircuitDisplay(domain && nodeData); };

1 0

[tor-browser/tor-browser-60.3.0esr-8.0-1] Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit d69efa2fe8f1fcb625d74251283cfa0e4f25cc01 Author: Honza Bambas <honzab.moz(a)firemni.cz> Date: Wed Oct 31 02:13:00 2018 -0400 Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc --HG-- extra : source : 1ed273626bbd38cde17d7610ac5d7dad0aca91c1 extra : intermediate-source : c89f12000b079c50362ce52e661e3c5e24836a11 This backport fixes our bug 28608. --- modules/libpref/init/all.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index f5a2ec47593a..e358cfcfcb2d 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2275,9 +2275,9 @@ pref("network.auth.non-web-content-triggered-resources-http-auth-allow", false); // in that case default credentials will always be used. pref("network.auth.private-browsing-sso", false); -// Control how throttling of http responses works - number of ms that each -// suspend and resume period lasts (prefs named appropriately) -pref("network.http.throttle.enable", true); +// This feature is occasionally causing visible regressions (download too slow for +// too long time, jitter in video/audio in background tabs...) +pref("network.http.throttle.enable", false); pref("network.http.throttle.version", 1); // V1 prefs

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 2789cecf98cd603f835711378d76ed06b4369609 Author: Honza Bambas <honzab.moz(a)firemni.cz> Date: Wed Oct 31 02:13:00 2018 -0400 Bug 1503354 - Disable background HTTP response throttling for causing visible regressions. r=dragana, a=pascalc --HG-- extra : source : 1ed273626bbd38cde17d7610ac5d7dad0aca91c1 extra : intermediate-source : c89f12000b079c50362ce52e661e3c5e24836a11 This backport fixes our bug 28608. --- modules/libpref/init/all.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index f5a2ec47593a..e358cfcfcb2d 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -2275,9 +2275,9 @@ pref("network.auth.non-web-content-triggered-resources-http-auth-allow", false); // in that case default credentials will always be used. pref("network.auth.private-browsing-sso", false); -// Control how throttling of http responses works - number of ms that each -// suspend and resume period lasts (prefs named appropriately) -pref("network.http.throttle.enable", true); +// This feature is occasionally causing visible regressions (download too slow for +// too long time, jitter in video/audio in background tabs...) +pref("network.http.throttle.enable", false); pref("network.http.throttle.version", 1); // V1 prefs

1 0

[tor-browser/tor-browser-60.3.0esr-8.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 3c03aad30d2b2b0e92359f15a1a95cfb2354544e Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 21 10:02:20 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 25794 deals with pointer events and associated fingerprinting risks. There are patches we can backport from Mozilla, but they are not small and we should give them some baking time. Thus, let's disable pointer events for now. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index bc7c4b05e3a1..07005f326580 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,6 +150,7 @@ pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthe pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API +pref("dom.w3c_pointer_events.enabled", false); pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now // Disable randomised Firefox HTTP cache decay user test groups (Bug: 13575) pref("security.webauth.webauthn", false); // Bug 26614: Disable Web Authentication API for now

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit c20210b1a017c4e94157c1acfbef18e878202ff4 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Nov 21 10:02:20 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Bug 25794 deals with pointer events and associated fingerprinting risks. There are patches we can backport from Mozilla, but they are not small and we should give them some baking time. Thus, let's disable pointer events for now. --- browser/app/profile/000-tor-browser.js | 1 + 1 file changed, 1 insertion(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 38f72579760a..8f74748f2072 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -150,6 +150,7 @@ pref("media.webspeech.synth.enabled", false); // Bug 10283: Disable SpeechSynthe pref("dom.webaudio.enabled", false); // Bug 13017: Disable Web Audio API pref("dom.maxHardwareConcurrency", 1); // Bug 21675: Spoof single-core cpu pref("dom.w3c_touch_events.enabled", 0); // Bug 10286: Always disable Touch API +pref("dom.w3c_pointer_events.enabled", false); pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now // Disable randomised Firefox HTTP cache decay user test groups (Bug: 13575) pref("security.webauth.webauthn", false); // Bug 26614: Disable Web Authentication API for now

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 27762: Remove workarounds that allowed torbutton extension to load
by gk＠torproject.org 04 Dec '18

04 Dec '18

commit 057daaf3fa81f46d4a3653115990b462fe7b2551 Author: Igor Oliveira <igt0(a)torproject.org> Date: Tue Dec 4 07:18:46 2018 -0200 Bug 27762: Remove workarounds that allowed torbutton extension to load Since torbutton became a system extension, those workarounds (implemented in #27220 and #27271+#27763) are not needed anymore. --- mobile/android/app/000-tor-browser-android.js | 5 ----- toolkit/mozapps/extensions/internal/XPIInstall.jsm | 5 ----- 2 files changed, 10 deletions(-) diff --git a/mobile/android/app/000-tor-browser-android.js b/mobile/android/app/000-tor-browser-android.js index e7e337276acb..de51ec125406 100644 --- a/mobile/android/app/000-tor-browser-android.js +++ b/mobile/android/app/000-tor-browser-android.js @@ -54,10 +54,5 @@ pref("media.realtime_decoder.enabled", false); pref("general.useragent.updates.enabled", false); pref("general.useragent.updates.url", ""); -// Do not allow the user to install extensions from web -pref("xpinstall.enabled", false); -pref("extensions.enabledScopes", 1); -pref("extensions.autoDisableScopes", 1); - // Enable touch events on Android (highlighting text, etc) pref("dom.w3c_touch_events.enabled", 2); diff --git a/toolkit/mozapps/extensions/internal/XPIInstall.jsm b/toolkit/mozapps/extensions/internal/XPIInstall.jsm index 40b3b1d6434e..f97669951710 100644 --- a/toolkit/mozapps/extensions/internal/XPIInstall.jsm +++ b/toolkit/mozapps/extensions/internal/XPIInstall.jsm @@ -1029,11 +1029,6 @@ function getSignedStatus(aRv, aCert, aAddonID) { } function shouldVerifySignedState(aAddon) { - if (AppConstants.platform === "android" && - aAddon.id === "torbutton(a)torproject.org") { - return false; - } - // Updated system add-ons should always have their signature checked if (aAddon._installLocation.name == KEY_APP_SYSTEM_ADDONS) return true;

1 0

[tor-browser/tor-browser-60.3.0esr-8.5-1] Bug 1474626 - fix timestamp test and values, r=rpl
by gk＠torproject.org 03 Dec '18

03 Dec '18

commit b3d74f7db1cc0ddf54771e3e9e5de4b8549b0c88 Author: Shane Caraveo <scaraveo(a)mozilla.com> Date: Wed Jul 11 14:54:03 2018 -0300 Bug 1474626 - fix timestamp test and values, r=rpl The test was incorrect and the timestamp should be milliseconds, not microseconds. MozReview-Commit-ID: 2d79r6PHH4Z --HG-- extra : rebase_source : edd97899f0646f2cae2fbf119206ec470a6b97a0 --- .../extensions/test/mochitest/test_ext_webrequest_hsts.html | 6 +++++- toolkit/modules/addons/SecurityInfo.jsm | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html index df8b541808f9..b8385ca08843 100644 --- a/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html +++ b/toolkit/components/extensions/test/mochitest/test_ext_webrequest_hsts.html @@ -38,7 +38,11 @@ function getExtension() { browser.test.assertTrue(securityInfo.certificates.length == 1, "no certificate chain"); } let cert = securityInfo.certificates[0]; - browser.test.assertTrue(cert.validity.start < Date.now() < cert.validity.end, "cert validity is correct"); + let now = Date.now(); + browser.test.assertTrue(Number.isInteger(cert.validity.start), "cert start is integer"); + browser.test.assertTrue(Number.isInteger(cert.validity.end), "cert end is integer"); + browser.test.assertTrue(cert.validity.start < now, "cert start validity is correct"); + browser.test.assertTrue(now < cert.validity.end, "cert end validity is correct"); if (options.rawDER) { for (let cert of securityInfo.certificates) { browser.test.assertTrue(cert.rawDER.length > 0, "have rawDER"); diff --git a/toolkit/modules/addons/SecurityInfo.jsm b/toolkit/modules/addons/SecurityInfo.jsm index a931602b517a..de0084398aa6 100644 --- a/toolkit/modules/addons/SecurityInfo.jsm +++ b/toolkit/modules/addons/SecurityInfo.jsm @@ -214,8 +214,8 @@ const SecurityInfo = { subject: cert.subjectName, issuer: cert.issuerName, validity: { - start: cert.validity.notBefore, - end: cert.validity.notAfter, + start: cert.validity.notBefore ? Math.trunc(cert.validity.notBefore / 1000) : 0, + end: cert.validity.notAfter ? Math.trunc(cert.validity.notAfter / 1000) : 0, }, fingerprint: { sha1: cert.sha1Fingerprint,

1 0