- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-60.0.1esr-8.0-1] Bug 1463509 - SOCKS support for Alternative Services r=valentin
by gk＠torproject.org 14 Jun '18

14 Jun '18

commit 8a68f975ee5faa39efa26a79062476ab50dd18ab Author: Patrick McManus <mcmanus(a)ducksong.com> Date: Tue May 22 13:50:56 2018 -0400 Bug 1463509 - SOCKS support for Alternative Services r=valentin MozReview-Commit-ID: 1oXnQuzOqsC --HG-- extra : rebase_source : 84bfaec48c5fc216da6586e7f06f118292d3fb17 --- netwerk/base/nsSocketTransport2.cpp | 32 +++++++++++++++++++++-------- netwerk/protocol/http/AlternateServices.cpp | 8 +++++++- netwerk/protocol/http/AlternateServices.h | 4 ++++ netwerk/protocol/http/nsHttpChannel.cpp | 5 ++--- 4 files changed, 37 insertions(+), 12 deletions(-) diff --git a/netwerk/base/nsSocketTransport2.cpp b/netwerk/base/nsSocketTransport2.cpp index df01e62f55d3..aa9232f4698c 100644 --- a/netwerk/base/nsSocketTransport2.cpp +++ b/netwerk/base/nsSocketTransport2.cpp @@ -1170,7 +1170,7 @@ nsSocketTransport::BuildSocket(PRFileDesc *&fd, bool &proxyTransparent, bool &us uint32_t controlFlags = 0; uint32_t i; - for (i=0; i<mTypeCount; ++i) { + for (i = 0; i < mTypeCount; ++i) { nsCOMPtr<nsISocketProvider> provider; SOCKET_LOG((" pushing io layer [%u:%s]\n", i, mTypes[i])); @@ -1199,12 +1199,30 @@ nsSocketTransport::BuildSocket(PRFileDesc *&fd, bool &proxyTransparent, bool &us // if this is the first type, we'll want the // service to allocate a new socket + // Most layers _ESPECIALLY_ PSM want the origin name here as they + // will use it for secure checks, etc.. and any connection management + // differences between the origin name and the routed name can be + // taken care of via DNS. However, SOCKS is a special case as there is + // no DNS. in the case of SOCKS and PSM the PSM is a separate layer + // and receives the origin name. + const char *socketProviderHost = host; + int32_t socketProviderPort = port; + if (mProxyTransparentResolvesHost && + (!strcmp(mTypes[0], "socks") || !strcmp(mTypes[0], "socks4"))) { + SOCKET_LOG(("SOCKS %d Host/Route override: %s:%d -> %s:%d\n", + mHttpsProxy, + socketProviderHost, socketProviderPort, + mHost.get(), mPort)); + socketProviderHost = mHost.get(); + socketProviderPort = mPort; + } + // when https proxying we want to just connect to the proxy as if // it were the end host (i.e. expect the proxy's cert) rv = provider->NewSocket(mNetAddr.raw.family, - mHttpsProxy ? mProxyHost.get() : host, - mHttpsProxy ? mProxyPort : port, + mHttpsProxy ? mProxyHost.get() : socketProviderHost, + mHttpsProxy ? mProxyPort : socketProviderPort, proxyInfo, mOriginAttributes, controlFlags, mTlsFlags, &fd, getter_AddRefs(secinfo)); @@ -1213,8 +1231,7 @@ nsSocketTransport::BuildSocket(PRFileDesc *&fd, bool &proxyTransparent, bool &us NS_NOTREACHED("NewSocket succeeded but failed to create a PRFileDesc"); rv = NS_ERROR_UNEXPECTED; } - } - else { + } else { // the socket has already been allocated, // so we just want the service to add itself // to the stack (such as pushing an io layer) @@ -1245,9 +1262,8 @@ nsSocketTransport::BuildSocket(PRFileDesc *&fd, bool &proxyTransparent, bool &us secCtrl->SetNotificationCallbacks(callbacks); // remember if socket type is SSL so we can ProxyStartSSL if need be. usingSSL = isSSL; - } - else if ((strcmp(mTypes[i], "socks") == 0) || - (strcmp(mTypes[i], "socks4") == 0)) { + } else if ((strcmp(mTypes[i], "socks") == 0) || + (strcmp(mTypes[i], "socks4") == 0)) { // since socks is transparent, any layers above // it do not have to worry about proxy stuff proxyInfo = nullptr; diff --git a/netwerk/protocol/http/AlternateServices.cpp b/netwerk/protocol/http/AlternateServices.cpp index 2ce3d333d60d..f4cfa800715b 100644 --- a/netwerk/protocol/http/AlternateServices.cpp +++ b/netwerk/protocol/http/AlternateServices.cpp @@ -46,6 +46,12 @@ SchemeIsHTTPS(const nsACString &originScheme, bool &outIsHTTPS) return NS_OK; } +bool +AltSvcMapping::AcceptableProxy(nsProxyInfo *proxyInfo) +{ + return !proxyInfo || proxyInfo->IsDirect() || proxyInfo->IsSOCKS(); +} + void AltSvcMapping::ProcessHeader(const nsCString &buf, const nsCString &originScheme, const nsCString &originHost, int32_t originPort, @@ -59,7 +65,7 @@ AltSvcMapping::ProcessHeader(const nsCString &buf, const nsCString &originScheme return; } - if (proxyInfo && !proxyInfo->IsDirect()) { + if (!AcceptableProxy(proxyInfo)) { LOG(("AltSvcMapping::ProcessHeader ignoring due to proxy\n")); return; } diff --git a/netwerk/protocol/http/AlternateServices.h b/netwerk/protocol/http/AlternateServices.h index 051f010801b4..688586ba5b89 100644 --- a/netwerk/protocol/http/AlternateServices.h +++ b/netwerk/protocol/http/AlternateServices.h @@ -66,6 +66,10 @@ public: nsIInterfaceRequestor *callbacks, nsProxyInfo *proxyInfo, uint32_t caps, const OriginAttributes &originAttributes); + // AcceptableProxy() decides whether a particular proxy configuration (pi) is suitable + // for use with Alt-Svc. No proxy (including a null pi) is suitable. + static bool AcceptableProxy(nsProxyInfo *pi); + const nsCString &AlternateHost() const { return mAlternateHost; } const nsCString &OriginHost() const { return mOriginHost; } uint32_t OriginPort() const { return mOriginPort; } diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp index 28ff7709863e..35b4b4dfeb1e 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp @@ -6163,9 +6163,8 @@ nsHttpChannel::BeginConnect() RefPtr<AltSvcMapping> mapping; if (!mConnectionInfo && mAllowAltSvc && // per channel !(mLoadFlags & LOAD_FRESH_CONNECTION) && - (scheme.EqualsLiteral("http") || - scheme.EqualsLiteral("https")) && - (!proxyInfo || proxyInfo->IsDirect()) && + AltSvcMapping::AcceptableProxy(proxyInfo) && + (scheme.EqualsLiteral("http") || scheme.EqualsLiteral("https")) && (mapping = gHttpHandler->GetAltServiceMapping(scheme, host, port, mPrivateBrowsing,

1 0

[tor-browser/tor-browser-60.0.1esr-8.0-1] Revert "Bug 23916: Add new MAR signing key"
by gk＠torproject.org 13 Jun '18

13 Jun '18

commit d77a0ec835e8ee8e4beab614722c02fa7fd96119 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 13 08:58:27 2018 +0000 Revert "Bug 23916: Add new MAR signing key" This reverts commit e984b8c54c7592057c060f7a2e13b378a355b1d0. --- toolkit/mozapps/update/updater/release_primary.der | Bin 1229 -> 1225 bytes toolkit/mozapps/update/updater/release_secondary.der | Bin 1229 -> 1225 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/toolkit/mozapps/update/updater/release_primary.der b/toolkit/mozapps/update/updater/release_primary.der index cce786025698..1d94f88ad73b 100644 Binary files a/toolkit/mozapps/update/updater/release_primary.der and b/toolkit/mozapps/update/updater/release_primary.der differ diff --git a/toolkit/mozapps/update/updater/release_secondary.der b/toolkit/mozapps/update/updater/release_secondary.der index caf3eca56804..474706c4b73c 100644 Binary files a/toolkit/mozapps/update/updater/release_secondary.der and b/toolkit/mozapps/update/updater/release_secondary.der differ

1 0

[tor-browser/tor-browser-60.0.1esr-8.0-1] Bug 26045: Add new MAR signing keys
by gk＠torproject.org 13 Jun '18

13 Jun '18

commit 1f78032d48850e0197608ac1d9906a095e2a4c06 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 13 09:03:59 2018 +0000 Bug 26045: Add new MAR signing keys We need to have new MAR singning keys for our watershed update: both keys we shipped so far need to get replaced by news ones, now using SHA-384 as their hash algorithm. --- toolkit/mozapps/update/updater/release_primary.der | Bin 1225 -> 1229 bytes toolkit/mozapps/update/updater/release_secondary.der | Bin 1225 -> 1229 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/toolkit/mozapps/update/updater/release_primary.der b/toolkit/mozapps/update/updater/release_primary.der index 1d94f88ad73b..ec74f89dc807 100644 Binary files a/toolkit/mozapps/update/updater/release_primary.der and b/toolkit/mozapps/update/updater/release_primary.der differ diff --git a/toolkit/mozapps/update/updater/release_secondary.der b/toolkit/mozapps/update/updater/release_secondary.der index 474706c4b73c..0103a171de88 100644 Binary files a/toolkit/mozapps/update/updater/release_secondary.der and b/toolkit/mozapps/update/updater/release_secondary.der differ

1 0

[tor-browser-build/master] Merge remote-tracking branch 'boklm/bug_26354'
by gk＠torproject.org 13 Jun '18

13 Jun '18

commit f606f5d9d55a171e0a6f57ad58e1052c9f7c149d Merge: 3cab74a 17d7ca8 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jun 13 09:35:34 2018 +0000 Merge remote-tracking branch 'boklm/bug_26354' projects/release/update_responses_config.yml | 3 +-- projects/tor-browser/RelativeLink/start-tor-browser | 5 +++++ 2 files changed, 6 insertions(+), 2 deletions(-)

1 0

[tor-browser-build/master] Bug 26354: check for SSE2 support before updating Linux users
by gk＠torproject.org 13 Jun '18

13 Jun '18

commit 17d7ca8fb2be71b72b429c59fed8a10c042a4a49 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 12 20:09:56 2018 +0200 Bug 26354: check for SSE2 support before updating Linux users We were setting the minSupportedInstructionSet attribute for the win32 updates only. We now set it on all platforms. --- projects/release/update_responses_config.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/projects/release/update_responses_config.yml b/projects/release/update_responses_config.yml index 1a9b0cf..6861124 100644 --- a/projects/release/update_responses_config.yml +++ b/projects/release/update_responses_config.yml @@ -38,8 +38,7 @@ versions: osx32: osx64 migrate_langs: pt-PT: pt-BR - win32: - minSupportedInstructionSet: SSE2 + minSupportedInstructionSet: SSE2 osx32: minSupportedOSVersion: 13.0.0 osx64:

1 0

[tor-browser-build/master] Bug 26354: check for SSE2 support in start-tor-browser
by gk＠torproject.org 13 Jun '18

13 Jun '18

commit fb3315fbc961f924012dcf97d346ce9527f85505 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Jun 12 20:02:49 2018 +0200 Bug 26354: check for SSE2 support in start-tor-browser --- projects/tor-browser/RelativeLink/start-tor-browser | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/projects/tor-browser/RelativeLink/start-tor-browser b/projects/tor-browser/RelativeLink/start-tor-browser index 0590eed..6639f44 100755 --- a/projects/tor-browser/RelativeLink/start-tor-browser +++ b/projects/tor-browser/RelativeLink/start-tor-browser @@ -96,6 +96,11 @@ if [ "`id -u`" -eq 0 ]; then exit 1 fi +if ! grep -q '^flags\s*:.* sse2' /proc/cpuinfo; then + complain "Tor Browser requires a CPU with SSE2 support. Exiting." + exit 1 +fi + tbb_usage () { printf "\nTor Browser Script Options\n" printf " --verbose Display Tor and Firefox output in the terminal\n"

1 0

[tor-browser-build/master] Bug 26234: add update_responses option to specify rewrite rules
by gk＠torproject.org 13 Jun '18

13 Jun '18

commit 3cab74acf8a2f2a311c133544ccc8c00a43e00a2 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Jun 11 17:49:03 2018 +0200 Bug 26234: add update_responses option to specify rewrite rules Add the htaccess_rewrite_rules option which can be used to specify rewrite rules to be added to the generated .htaccess files. --- tools/update-responses/update_responses | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index 1df35b3..77b9c96 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -376,6 +376,7 @@ sub write_htaccess { my $flags = "[last]"; foreach my $channel (@channels) { my $htaccess = "RewriteEngine On\n"; + $htaccess .= $config->{htaccess_rewrite_rules}{$channel} // ''; my $version = $config->{channels}{$channel}; my $migrate_langs = $config->{versions}{$version}{migrate_langs} // {}; my $files = $config->{versions}{$version}{files};

1 0

[tor-browser-build/maint-7.5] Release preparations for 7.5.5
by gk＠torproject.org 08 Jun '18

08 Jun '18

commit d0e565d00e236e331f8ebf040b4225b6875d471f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 8 21:25:47 2018 +0000 Release preparations for 7.5.5 Changelog update and versions bump --- projects/firefox/config | 4 ++-- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 5 +++++ rbm.conf | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index 886cfdc..e91d1ca 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,13 +1,13 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_platform_version: 52.8.0 + firefox_platform_version: 52.8.1 firefox_version: '[% c("var/firefox_platform_version") %]esr' torbrowser_branch: 7.5 torbrowser_update_channel: alpha diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 7f5a736..5d52b10 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -1,3 +1,8 @@ +Tor Browser 7.5.5 -- June 10 2018 + * All platforms + * Update Firefox to 52.8.1esr + * Bug 26098: Remove amazon-meek + Tor Browser 7.5.4 -- May 9 2018 * All platforms * Update Firefox to 52.8.0esr diff --git a/rbm.conf b/rbm.conf index ca427f9..4329958 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,10 @@ buildconf: git_signtag_opt: '-s' var: - torbrowser_version: '7.5.4' + torbrowser_version: '7.5.5' torbrowser_build: 'build1' torbrowser_incremental_from: - - 7.5.3 + - 7.5.4 project_name: tor-browser multi_lingual: 0 build_mar: 1

1 0

[tor-browser-build/master] Bug 24632: Make sure to use "Tor Browser.app" for `browserdir` on macOS
by gk＠torproject.org 07 Jun '18

07 Jun '18

commit fcb2a3707af71bcd564bf0dd8a563835eeea6b9b Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 7 10:40:47 2018 +0000 Bug 24632: Make sure to use "Tor Browser.app" for `browserdir` on macOS --- projects/tor-browser/build | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/tor-browser/build b/projects/tor-browser/build index d807633..19aa657 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -311,7 +311,7 @@ cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ SET xpi = '$rootdir/' _ c('input_files_by_name/firefox-langpacks') _ '/' _ lang _ '.xpi'; SET tbdir = '$distdir/tor-browser_' _ lang; IF c("var/osx"); - SET browserdir = tbdir _ '/TorBrowser.app'; + SET browserdir = tbdir _ '/Tor Browser.app'; ELSIF c("var/windows"); SET browserdir = tbdir _ '/Tor Browser/Browser'; ELSE;

1 0

[tor-browser-build/master] Bug 24632: Install xz-utils for macOS MAR file creation
by gk＠torproject.org 07 Jun '18

07 Jun '18

commit aabed936170b9ea88df2037e8d452dc5d9915f20 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 7 10:39:48 2018 +0000 Bug 24632: Install xz-utils for macOS MAR file creation --- projects/tor-browser/config | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/config b/projects/tor-browser/config index 62ed70c..225a0bb 100644 --- a/projects/tor-browser/config +++ b/projects/tor-browser/config @@ -24,6 +24,7 @@ targets: - python - bzip2 - faketime + - xz-utils windows: var: arch_deps:

1 0