- tbb-commits - lists.torproject.org

[tor-browser/tor-browser-45.2.0esr-6.5-1] Regression tests for Bug 1517: Reduce precision of time for Javascript.
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit b60b8871fa08feaaca24bcf6dff43df0cd1c5f29 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Fri May 27 11:31:48 2016 -0700 Regression tests for Bug 1517: Reduce precision of time for Javascript. --- tbb-tests/audio.ogg | Bin 0 -> 16521 bytes tbb-tests/mochitest.ini | 3 ++ tbb-tests/noaudio.webm | Bin 0 -> 105755 bytes tbb-tests/test_tor_bug1517.html | 79 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 82 insertions(+) diff --git a/tbb-tests/audio.ogg b/tbb-tests/audio.ogg new file mode 100644 index 0000000..d7f6a0c Binary files /dev/null and b/tbb-tests/audio.ogg differ diff --git a/tbb-tests/mochitest.ini b/tbb-tests/mochitest.ini index 2dc049a..3d2e7c9 100644 --- a/tbb-tests/mochitest.ini +++ b/tbb-tests/mochitest.ini @@ -1,8 +1,11 @@ [DEFAULT] support-files = + audio.ogg match.png mismatch.png + noaudio.webm +[test_tor_bug1517.html] [test_tor_bug2874.html] [test_tor_bug2875.html] [test_tor_bug4755.html] diff --git a/tbb-tests/noaudio.webm b/tbb-tests/noaudio.webm new file mode 100644 index 0000000..9207017 Binary files /dev/null and b/tbb-tests/noaudio.webm differ diff --git a/tbb-tests/test_tor_bug1517.html b/tbb-tests/test_tor_bug1517.html new file mode 100644 index 0000000..67d6693 --- /dev/null +++ b/tbb-tests/test_tor_bug1517.html @@ -0,0 +1,79 @@ +<!DOCTYPE HTML> +<html> + +<head> + <meta charset="utf-8"> + <title>Test for Tor Bug 1517</title> + <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script> + <script type="application/javascript" src="/tests/SimpleTest/SpawnTask.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://trac.torproject.org/projects/tor/ticket/1517">Tor Bug 1517</a> + + +<canvas id="test-canvas" width="100" height="100"></canvas> +<video id="test-video" + src="http://example.com/tests/tbb-tests/noaudio.webm"></video> +<audio id="test-audio" + src="http://example.com/tests/tbb-tests/audio.ogg"></audio> + + +<script type="application/javascript;version=1.7"> + SimpleTest.requestFlakyTimeout("testing JS time-based fingerprinting"); + + // __later(delay)__. + // Return a promise that resolves after the requested delay in ms. + let later = function (delay) { + return new Promise((resolve, reject) => { + window.setTimeout(resolve, delay); + }); + }; + + // The main testing task + add_task(function* () { + // Prepare for test of AudioContext.currentTime + let audioContext = new AudioContext(); + // Prepare for test of CanvasStream.currentTime + let canvas = document.getElementById("test-canvas"); + let context = canvas.getContext('2d'); + context.fillText("test", 20, 20); + let canvasStream = canvas.captureStream(25); + // Prepare for test of HTMLVideoElement.currentTime + let video = document.getElementById("test-video"); + video.currentTime = 1.25; + // Prepare for test of HTMLAudioElement.currenTime + let audio = document.getElementById("test-audio"); + audio.currentTime = 1.35; + // Allow ~150 ms to elapse, so we can get non-zero + // time values for all elements. + yield later(150); + // Known ways to generate time stamps, in milliseconds + let timeStampCodes = [ + 'performance.now()', + 'new Date().getTime()', + 'new Event("").timeStamp', + 'audioContext.currentTime * 1000', + 'canvasStream.currentTime * 1000', + 'video.currentTime * 1000', + 'audio.currentTime * 1000', + ]; + // Loop through each timeStampCode, evaluate it, + // and check if it is rounded to the nearest 100 ms. + for (let timeStampCode of timeStampCodes) { + let timeStamp = eval(timeStampCode); + let roundedTimeStamp = 100*Math.round(timeStamp/100); + ok(timeStamp === roundedTimeStamp, + "'" + timeStampCode + + "' should be rounded to nearest 100 ms; saw " + + timeStamp); + } + }); +</script> + + +</body> +</html>

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1234246 - Don't reprotect JIT code more than once when linking. r=nbp
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 076919bcd96dcced7020e6003c25425a15ff0cb7 Author: Jan de Mooij <jdemooij(a)mozilla.com> Date: Tue Dec 22 10:56:36 2015 +0100 Bug 1234246 - Don't reprotect JIT code more than once when linking. r=nbp --- js/src/irregexp/NativeRegExpMacroAssembler.cpp | 2 - js/src/jit/BaselineCompiler.cpp | 4 +- js/src/jit/BaselineJIT.cpp | 7 +- js/src/jit/BaselineJIT.h | 4 +- js/src/jit/CodeGenerator.cpp | 93 +++++++++++++------------- js/src/jit/Ion.cpp | 21 +++--- js/src/jit/IonCaches.cpp | 54 +++++++-------- js/src/jit/IonCaches.h | 7 +- js/src/jit/IonCode.h | 4 +- js/src/jit/IonTypes.h | 2 + js/src/jit/JitCompartment.h | 2 - js/src/jit/Linker.h | 3 +- js/src/jit/SharedIC.cpp | 2 +- 13 files changed, 104 insertions(+), 101 deletions(-) diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.cpp b/js/src/irregexp/NativeRegExpMacroAssembler.cpp index a699f5b..c154c79 100644 --- a/js/src/irregexp/NativeRegExpMacroAssembler.cpp +++ b/js/src/irregexp/NativeRegExpMacroAssembler.cpp @@ -465,8 +465,6 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only) writePerfSpewerJitCodeProfile(code, "RegExp"); #endif - AutoWritableJitCode awjc(code); - for (size_t i = 0; i < labelPatches.length(); i++) { LabelPatch& v = labelPatches[i]; MOZ_ASSERT(!v.label); diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp index 8a03334..3b88801 100644 --- a/js/src/jit/BaselineCompiler.cpp +++ b/js/src/jit/BaselineCompiler.cpp @@ -238,14 +238,12 @@ BaselineCompiler::compile() // All barriers are emitted off-by-default, toggle them on if needed. if (cx->zone()->needsIncrementalBarrier()) - baselineScript->toggleBarriers(true); + baselineScript->toggleBarriers(true, DontReprotect); // If profiler instrumentation is enabled, toggle instrumentation on. if (cx->runtime()->jitRuntime()->isProfilerInstrumentationEnabled(cx->runtime())) baselineScript->toggleProfilerInstrumentation(true); - AutoWritableJitCode awjc(code); - // Patch IC loads using IC entries. for (size_t i = 0; i < icLoadLabels_.length(); i++) { CodeOffset label = icLoadLabels_[i].label; diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp index f0dc265..6ae1d55 100644 --- a/js/src/jit/BaselineJIT.cpp +++ b/js/src/jit/BaselineJIT.cpp @@ -1023,8 +1023,6 @@ BaselineScript::toggleProfilerInstrumentation(bool enable) JitSpew(JitSpew_BaselineIC, " toggling profiling %s for BaselineScript %p", enable ? "on" : "off", this); - AutoWritableJitCode awjc(method()); - // Toggle the jump CodeLocationLabel enterToggleLocation(method_, CodeOffset(profilerEnterToggleOffset_)); CodeLocationLabel exitToggleLocation(method_, CodeOffset(profilerExitToggleOffset_)); @@ -1136,11 +1134,16 @@ jit::AddSizeOfBaselineData(JSScript* script, mozilla::MallocSizeOf mallocSizeOf, void jit::ToggleBaselineProfiling(JSRuntime* runtime, bool enable) { + JitRuntime* jrt = runtime->jitRuntime(); + if (!jrt) + return; + for (ZonesIter zone(runtime, SkipAtoms); !zone.done(); zone.next()) { for (gc::ZoneCellIter i(zone, gc::AllocKind::SCRIPT); !i.done(); i.next()) { JSScript* script = i.get<JSScript>(); if (!script->hasBaselineScript()) continue; + AutoWritableJitCode awjc(script->baselineScript()->method()); script->baselineScript()->toggleProfilerInstrumentation(enable); } } diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h index 1b35e6e..08ff74e 100644 --- a/js/src/jit/BaselineJIT.h +++ b/js/src/jit/BaselineJIT.h @@ -356,8 +356,8 @@ struct BaselineScript templateScope_ = templateScope; } - void toggleBarriers(bool enabled) { - method()->togglePreBarriers(enabled); + void toggleBarriers(bool enabled, ReprotectCode reprotect = Reprotect) { + method()->togglePreBarriers(enabled, reprotect); } bool containsCodeAddress(uint8_t* addr) const { diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index d921f1b..c6959f0 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -1446,7 +1446,7 @@ JitCompartment::generateRegExpExecStub(JSContext* cx) #endif if (cx->zone()->needsIncrementalBarrier()) - code->togglePreBarriers(true); + code->togglePreBarriers(true, DontReprotect); return code; } @@ -1579,7 +1579,7 @@ JitCompartment::generateRegExpTestStub(JSContext* cx) #endif if (cx->zone()->needsIncrementalBarrier()) - code->togglePreBarriers(true); + code->togglePreBarriers(true, DontReprotect); return code; } @@ -8259,61 +8259,58 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints) // Adopt fallback shared stubs from the compiler into the ion script. ionScript->adoptFallbackStubs(&stubSpace_); - { - AutoWritableJitCode awjc(code); - Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, invalidateEpilogueData_), + Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, invalidateEpilogueData_), + ImmPtr(ionScript), + ImmPtr((void*)-1)); + + for (size_t i = 0; i < ionScriptLabels_.length(); i++) { + Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, ionScriptLabels_[i]), ImmPtr(ionScript), ImmPtr((void*)-1)); - - for (size_t i = 0; i < ionScriptLabels_.length(); i++) { - Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, ionScriptLabels_[i]), - ImmPtr(ionScript), - ImmPtr((void*)-1)); - } + } #ifdef JS_TRACE_LOGGING - TraceLoggerThread* logger = TraceLoggerForMainThread(cx->runtime()); - for (uint32_t i = 0; i < patchableTraceLoggers_.length(); i++) { - Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, patchableTraceLoggers_[i]), - ImmPtr(logger), - ImmPtr(nullptr)); - } - - if (patchableTLScripts_.length() > 0) { - MOZ_ASSERT(TraceLogTextIdEnabled(TraceLogger_Scripts)); - TraceLoggerEvent event(logger, TraceLogger_Scripts, script); - ionScript->setTraceLoggerEvent(event); - uint32_t textId = event.payload()->textId(); - for (uint32_t i = 0; i < patchableTLScripts_.length(); i++) { - Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, patchableTLScripts_[i]), - ImmPtr((void*) uintptr_t(textId)), - ImmPtr((void*)0)); - } + TraceLoggerThread* logger = TraceLoggerForMainThread(cx->runtime()); + for (uint32_t i = 0; i < patchableTraceLoggers_.length(); i++) { + Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, patchableTraceLoggers_[i]), + ImmPtr(logger), + ImmPtr(nullptr)); + } + + if (patchableTLScripts_.length() > 0) { + MOZ_ASSERT(TraceLogTextIdEnabled(TraceLogger_Scripts)); + TraceLoggerEvent event(logger, TraceLogger_Scripts, script); + ionScript->setTraceLoggerEvent(event); + uint32_t textId = event.payload()->textId(); + for (uint32_t i = 0; i < patchableTLScripts_.length(); i++) { + Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, patchableTLScripts_[i]), + ImmPtr((void*) uintptr_t(textId)), + ImmPtr((void*)0)); } + } #endif - // Patch shared stub IC loads using IC entries - for (size_t i = 0; i < sharedStubs_.length(); i++) { - CodeOffset label = sharedStubs_[i].label; - - IonICEntry& entry = ionScript->sharedStubList()[i]; - entry = sharedStubs_[i].entry; - Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, label), - ImmPtr(&entry), - ImmPtr((void*)-1)); - - MOZ_ASSERT(entry.hasStub()); - MOZ_ASSERT(entry.firstStub()->isFallback()); + // Patch shared stub IC loads using IC entries + for (size_t i = 0; i < sharedStubs_.length(); i++) { + CodeOffset label = sharedStubs_[i].label; + + IonICEntry& entry = ionScript->sharedStubList()[i]; + entry = sharedStubs_[i].entry; + Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, label), + ImmPtr(&entry), + ImmPtr((void*)-1)); - entry.firstStub()->toFallbackStub()->fixupICEntry(&entry); - } + MOZ_ASSERT(entry.hasStub()); + MOZ_ASSERT(entry.firstStub()->isFallback()); - // for generating inline caches during the execution. - if (runtimeData_.length()) - ionScript->copyRuntimeData(&runtimeData_[0]); - if (cacheList_.length()) - ionScript->copyCacheEntries(&cacheList_[0], masm); + entry.firstStub()->toFallbackStub()->fixupICEntry(&entry); } + // for generating inline caches during the execution. + if (runtimeData_.length()) + ionScript->copyRuntimeData(&runtimeData_[0]); + if (cacheList_.length()) + ionScript->copyCacheEntries(&cacheList_[0], masm); + JitSpew(JitSpew_Codegen, "Created IonScript %p (raw %p)", (void*) ionScript, (void*) code->raw()); @@ -8363,7 +8360,7 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints) // since a GC can occur during code generation. All barriers are emitted // off-by-default, and are toggled on here if necessary. if (cx->zone()->needsIncrementalBarrier()) - ionScript->toggleBarriers(true); + ionScript->toggleBarriers(true, DontReprotect); // Attach any generated script counts to the script. if (IonScriptCounts* counts = extractScriptCounts()) diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp index 8e7063a..21baaf8 100644 --- a/js/src/jit/Ion.cpp +++ b/js/src/jit/Ion.cpp @@ -743,14 +743,14 @@ JitCompartment::toggleBarriers(bool enabled) { // Toggle barriers in compartment wide stubs that have patchable pre barriers. if (regExpExecStub_) - regExpExecStub_->togglePreBarriers(enabled); + regExpExecStub_->togglePreBarriers(enabled, Reprotect); if (regExpTestStub_) - regExpTestStub_->togglePreBarriers(enabled); + regExpTestStub_->togglePreBarriers(enabled, Reprotect); // Toggle barriers in baseline IC stubs. for (ICStubCodeMap::Enum e(*stubCodes_); !e.empty(); e.popFront()) { JitCode* code = *e.front().value().unsafeGet(); - code->togglePreBarriers(enabled); + code->togglePreBarriers(enabled, Reprotect); } } @@ -878,20 +878,23 @@ JitCode::finalize(FreeOp* fop) } void -JitCode::togglePreBarriers(bool enabled) +JitCode::togglePreBarriers(bool enabled, ReprotectCode reprotect) { - AutoWritableJitCode awjc(this); uint8_t* start = code_ + preBarrierTableOffset(); CompactBufferReader reader(start, start + preBarrierTableBytes_); - while (reader.more()) { + if (!reader.more()) + return; + + MaybeAutoWritableJitCode awjc(this, reprotect); + do { size_t offset = reader.readUnsigned(); CodeLocationLabel loc(this, CodeOffset(offset)); if (enabled) Assembler::ToggleToCmp(loc); else Assembler::ToggleToJmp(loc); - } + } while (reader.more()); } IonScript::IonScript() @@ -1269,9 +1272,9 @@ IonScript::Destroy(FreeOp* fop, IonScript* script) } void -IonScript::toggleBarriers(bool enabled) +IonScript::toggleBarriers(bool enabled, ReprotectCode reprotect) { - method()->togglePreBarriers(enabled); + method()->togglePreBarriers(enabled, reprotect); } void diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp index b5fe6de..36c2358 100644 --- a/js/src/jit/IonCaches.cpp +++ b/js/src/jit/IonCaches.cpp @@ -99,20 +99,6 @@ IonCache::CacheName(IonCache::Kind kind) return names[kind]; } -IonCache::LinkStatus -IonCache::linkCode(JSContext* cx, MacroAssembler& masm, IonScript* ion, JitCode** code) -{ - Linker linker(masm); - *code = linker.newCode<CanGC>(cx, ION_CODE); - if (!*code) - return LINK_ERROR; - - if (ion->invalidated()) - return CACHE_FLUSHED; - - return LINK_GOOD; -} - const size_t IonCache::MAX_STUBS = 16; // Helper class which encapsulates logic to attach a stub to an IC by hooking @@ -239,27 +225,20 @@ class IonCache::StubAttacher void patchRejoinJump(MacroAssembler& masm, JitCode* code) { rejoinOffset_.fixup(&masm); CodeLocationJump rejoinJump(code, rejoinOffset_); - AutoWritableJitCode awjc(code); PatchJump(rejoinJump, rejoinLabel_); } void patchStubCodePointer(JitCode* code) { if (hasStubCodePatchOffset_) { - AutoWritableJitCode awjc(code); Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, stubCodePatchOffset_), ImmPtr(code), STUB_ADDR); } } void patchNextStubJump(MacroAssembler& masm, JitCode* code) { - // Patch the previous nextStubJump of the last stub, or the jump from the - // codeGen, to jump into the newly allocated code. - PatchJump(cache_.lastJump_, CodeLocationLabel(code), Reprotect); - // If this path is not taken, we are producing an entry which can no // longer go back into the update function. if (hasNextStubOffset_) { - AutoWritableJitCode awjc(code); nextStubOffset_.fixup(&masm); CodeLocationJump nextStubJump(code, nextStubOffset_); PatchJump(nextStubJump, cache_.fallbackLabel_); @@ -285,21 +264,41 @@ IonCache::emitInitialJump(MacroAssembler& masm, RepatchLabel& entry) } void -IonCache::attachStub(MacroAssembler& masm, StubAttacher& attacher, Handle<JitCode*> code) +IonCache::attachStub(MacroAssembler& masm, StubAttacher& attacher, CodeLocationJump lastJump, + Handle<JitCode*> code) { MOZ_ASSERT(canAttachStub()); incrementStubCount(); + // Patch the previous nextStubJump of the last stub, or the jump from the + // codeGen, to jump into the newly allocated code. + PatchJump(lastJump, CodeLocationLabel(code), Reprotect); +} + +IonCache::LinkStatus +IonCache::linkCode(JSContext* cx, MacroAssembler& masm, StubAttacher& attacher, IonScript* ion, + JitCode** code) +{ + Linker linker(masm); + *code = linker.newCode<CanGC>(cx, ION_CODE); + if (!*code) + return LINK_ERROR; + + if (ion->invalidated()) + return CACHE_FLUSHED; + // Update the success path to continue after the IC initial jump. - attacher.patchRejoinJump(masm, code); + attacher.patchRejoinJump(masm, *code); // Replace the STUB_ADDR constant by the address of the generated stub, such // as it can be kept alive even if the cache is flushed (see // MarkJitExitFrame). - attacher.patchStubCodePointer(code); + attacher.patchStubCodePointer(*code); // Update the failure path. - attacher.patchNextStubJump(masm, code); + attacher.patchNextStubJump(masm, *code); + + return LINK_GOOD; } bool @@ -307,12 +306,13 @@ IonCache::linkAndAttachStub(JSContext* cx, MacroAssembler& masm, StubAttacher& a IonScript* ion, const char* attachKind, JS::TrackedOutcome trackedOutcome) { + CodeLocationJump lastJumpBefore = lastJump_; Rooted<JitCode*> code(cx); { // Need to exit the AutoFlushICache context to flush the cache // before attaching the stub below. AutoFlushICache afc("IonCache"); - LinkStatus status = linkCode(cx, masm, ion, code.address()); + LinkStatus status = linkCode(cx, masm, attacher, ion, code.address()); if (status != LINK_GOOD) return status != LINK_ERROR; } @@ -330,7 +330,7 @@ IonCache::linkAndAttachStub(JSContext* cx, MacroAssembler& masm, StubAttacher& a writePerfSpewerJitCodeProfile(code, "IonCache"); #endif - attachStub(masm, attacher, code); + attachStub(masm, attacher, lastJumpBefore, code); // Add entry to native => bytecode mapping for this stub if needed. if (cx->runtime()->jitRuntime()->isProfilerInstrumentationEnabled(cx->runtime())) { diff --git a/js/src/jit/IonCaches.h b/js/src/jit/IonCaches.h index f99dd2b..e3c3e35 100644 --- a/js/src/jit/IonCaches.h +++ b/js/src/jit/IonCaches.h @@ -293,10 +293,13 @@ class IonCache // monitoring/allocation caused an invalidation of the running ion script, // this function returns CACHE_FLUSHED. In case of allocation issue this // function returns LINK_ERROR. - LinkStatus linkCode(JSContext* cx, MacroAssembler& masm, IonScript* ion, JitCode** code); + LinkStatus linkCode(JSContext* cx, MacroAssembler& masm, StubAttacher& attacher, IonScript* ion, + JitCode** code); + // Fixup variables and update jumps in the list of stubs. Increment the // number of attached stubs accordingly. - void attachStub(MacroAssembler& masm, StubAttacher& attacher, Handle<JitCode*> code); + void attachStub(MacroAssembler& masm, StubAttacher& attacher, CodeLocationJump lastJump, + Handle<JitCode*> code); // Combine both linkStub and attachStub into one function. In addition, it // produces a spew augmented with the attachKind string. diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h index 085a907..63cdd64 100644 --- a/js/src/jit/IonCode.h +++ b/js/src/jit/IonCode.h @@ -123,7 +123,7 @@ class JitCode : public gc::TenuredCell hasBytecodeMap_ = true; } - void togglePreBarriers(bool enabled); + void togglePreBarriers(bool enabled, ReprotectCode reprotect); // If this JitCode object has been, effectively, corrupted due to // invalidation patching, then we have to remember this so we don't try and @@ -512,7 +512,7 @@ struct IonScript MOZ_ASSERT(locIndex < runtimeSize_); return (CacheLocation*) &runtimeData()[locIndex]; } - void toggleBarriers(bool enabled); + void toggleBarriers(bool enabled, ReprotectCode reprotect = Reprotect); void purgeCaches(); void unlinkFromRuntime(FreeOp* fop); void copySnapshots(const SnapshotWriter* writer); diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h index 8030f16..471cc42 100644 --- a/js/src/jit/IonTypes.h +++ b/js/src/jit/IonTypes.h @@ -776,6 +776,8 @@ enum class BarrierKind : uint32_t { TypeSet }; +enum ReprotectCode { Reprotect = true, DontReprotect = false }; + } // namespace jit } // namespace js diff --git a/js/src/jit/JitCompartment.h b/js/src/jit/JitCompartment.h index a5364cd..5f17664 100644 --- a/js/src/jit/JitCompartment.h +++ b/js/src/jit/JitCompartment.h @@ -518,8 +518,6 @@ class MOZ_STACK_CLASS AutoWritableJitCode } }; -enum ReprotectCode { Reprotect = true, DontReprotect = false }; - class MOZ_STACK_CLASS MaybeAutoWritableJitCode { mozilla::Maybe<AutoWritableJitCode> awjc_; diff --git a/js/src/jit/Linker.h b/js/src/jit/Linker.h index 4575d2e3..a0fd487 100644 --- a/js/src/jit/Linker.h +++ b/js/src/jit/Linker.h @@ -22,6 +22,7 @@ namespace jit { class Linker { MacroAssembler& masm; + mozilla::Maybe<AutoWritableJitCode> awjc; JitCode* fail(JSContext* cx) { ReportOutOfMemory(cx); @@ -68,7 +69,7 @@ class Linker return nullptr; if (masm.oom()) return fail(cx); - AutoWritableJitCode awjc(result, bytesNeeded); + awjc.emplace(result, bytesNeeded); code->copyFrom(masm); masm.link(code); if (masm.embedsNurseryPointers()) diff --git a/js/src/jit/SharedIC.cpp b/js/src/jit/SharedIC.cpp index 2867776..03f49a5 100644 --- a/js/src/jit/SharedIC.cpp +++ b/js/src/jit/SharedIC.cpp @@ -748,7 +748,7 @@ ICStubCompiler::getStubCode() // All barriers are emitted off-by-default, enable them if needed. if (cx->zone()->needsIncrementalBarrier()) - newStubCode->togglePreBarriers(true); + newStubCode->togglePreBarriers(true, DontReprotect); // Cache newly compiled stubcode. if (!comp->putStubCode(cx, stubKey, newStubCode))

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1215479 - Turn on W^X JIT code by default. r=luke
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit a66ec3f911f8cc247d4c2375e37ac0b9f1377a36 Author: Jan de Mooij <jdemooij(a)mozilla.com> Date: Mon Dec 28 21:05:50 2015 +0100 Bug 1215479 - Turn on W^X JIT code by default. r=luke --- js/src/jit/ExecutableAllocator.cpp | 4 ---- 1 file changed, 4 deletions(-) diff --git a/js/src/jit/ExecutableAllocator.cpp b/js/src/jit/ExecutableAllocator.cpp index 55ad6b6..1ce447f 100644 --- a/js/src/jit/ExecutableAllocator.cpp +++ b/js/src/jit/ExecutableAllocator.cpp @@ -88,8 +88,4 @@ ExecutableAllocator::addSizeOfCode(JS::CodeSizes* sizes) const } } -#if TARGET_OS_IPHONE bool ExecutableAllocator::nonWritableJitCode = true; -#else -bool ExecutableAllocator::nonWritableJitCode = false; -#endif

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1238694 - Limit the number of asm.js/wasm code allocations to avoid running into Linux kernel limits. r=luke
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 2f4d7ae9cfc9d3076a428aa381c6b40bb10166cf Author: Jan de Mooij <jdemooij(a)mozilla.com> Date: Tue Mar 15 14:33:07 2016 +0100 Bug 1238694 - Limit the number of asm.js/wasm code allocations to avoid running into Linux kernel limits. r=luke --- js/src/asmjs/AsmJSModule.cpp | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/js/src/asmjs/AsmJSModule.cpp b/js/src/asmjs/AsmJSModule.cpp index 3508270..08ac9a7 100644 --- a/js/src/asmjs/AsmJSModule.cpp +++ b/js/src/asmjs/AsmJSModule.cpp @@ -18,6 +18,7 @@ #include "asmjs/AsmJSModule.h" +#include "mozilla/Atomics.h" #include "mozilla/BinarySearch.h" #include "mozilla/Compression.h" #include "mozilla/EnumeratedRange.h" @@ -51,6 +52,7 @@ using namespace js; using namespace js::jit; using namespace js::wasm; using namespace js::frontend; +using mozilla::Atomic; using mozilla::BinarySearch; using mozilla::Compression::LZ4; using mozilla::MakeEnumeratedRange; @@ -61,17 +63,26 @@ using mozilla::PodZero; using mozilla::Swap; using JS::GenericNaN; +// Limit the number of concurrent wasm code allocations per process. Note that +// on Linux, the real maximum is ~32k, as each module requires 2 maps (RW/RX), +// and the kernel's default max_map_count is ~65k. +static Atomic<uint32_t> wasmCodeAllocations(0); +static const uint32_t MaxWasmCodeAllocations = 16384; + static uint8_t* AllocateExecutableMemory(ExclusiveContext* cx, size_t bytes) { - // On most platforms, this will allocate RWX memory. On iOS, or when - // --non-writable-jitcode is used, this will allocate RW memory. In this - // case, DynamicallyLinkModule will reprotect the code as RX. + // Allocate RW memory. DynamicallyLinkModule will reprotect the code as RX. unsigned permissions = ExecutableAllocator::initialProtectionFlags(ExecutableAllocator::Writable); - void* p = AllocateExecutableMemory(nullptr, bytes, permissions, "asm-js-code", AsmJSPageSize); - if (!p) + void* p = nullptr; + if (wasmCodeAllocations++ < MaxWasmCodeAllocations) + p = AllocateExecutableMemory(nullptr, bytes, permissions, "asm-js-code", AsmJSPageSize); + if (!p) { + wasmCodeAllocations--; ReportOutOfMemory(cx); + } + return (uint8_t*)p; } @@ -122,6 +133,8 @@ AsmJSModule::~AsmJSModule() exitDatum.baselineScript->removeDependentAsmJSModule(exit); } + MOZ_ASSERT(wasmCodeAllocations > 0); + wasmCodeAllocations--; DeallocateExecutableMemory(code_, pod.totalBytes_, AsmJSPageSize); }

1 0

[torbutton/maint-1.9.5] Changelog update
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 87dea299887fea005f1bc4fa90fbd55fdd693594 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jun 3 21:49:19 2016 +0000 Changelog update --- src/CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/src/CHANGELOG b/src/CHANGELOG index 7c99208..ecf6cba 100644 --- a/src/CHANGELOG +++ b/src/CHANGELOG @@ -4,6 +4,7 @@ * Bug 18905: Hide unusable items from help menu * Bug 16017: Allow users to more easily set a non-tor SSH proxy * Bug 17599: Provide shortcuts for New Identity and New Circuit + * Bug 18980: Remove obsolete toolbar button code * Bug 14429: Make sure the automatic resizing is disabled * Translation updates * Code clean-up

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1229284 - Remove support for SHA-1 hashes in genHPKPStaticPins.js. r=keeler
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 877657a30dd959d33921225260afe73d18aef977 Author: Cykesiopka <cykesiopka.bmo(a)gmail.com> Date: Thu Dec 17 07:52:00 2015 +0100 Bug 1229284 - Remove support for SHA-1 hashes in genHPKPStaticPins.js. r=keeler --- security/manager/tools/genHPKPStaticPins.js | 104 +++++++++------------------- 1 file changed, 32 insertions(+), 72 deletions(-) diff --git a/security/manager/tools/genHPKPStaticPins.js b/security/manager/tools/genHPKPStaticPins.js index c9e3472..8a91fff 100644 --- a/security/manager/tools/genHPKPStaticPins.js +++ b/security/manager/tools/genHPKPStaticPins.js @@ -10,6 +10,7 @@ // [absolute path to]/PreloadedHPKPins.json \ // [an unused argument - see bug 1205406] \ // [absolute path to]/StaticHPKPins.h +"use strict"; if (arguments.length != 3) { throw "Usage: genHPKPStaticPins.js " + @@ -28,7 +29,6 @@ var gCertDB = Cc["@mozilla.org/security/x509certdb;1"] .getService(Ci.nsIX509CertDB); const BUILT_IN_NICK_PREFIX = "Builtin Object Token:"; -const SHA1_PREFIX = "sha1/"; const SHA256_PREFIX = "sha256/"; const GOOGLE_PIN_PREFIX = "GOOGLE_PIN_"; @@ -53,7 +53,7 @@ const DOMAINHEADER = "/* Domainlist */\n" + " const bool mTestMode;\n" + " const bool mIsMoz;\n" + " const int32_t mId;\n" + - " const StaticPinset *pinset;\n" + + " const StaticPinset* pinset;\n" + "};\n\n"; const PINSETDEF = "/* Pinsets are each an ordered list by the actual value of the fingerprint */\n" + @@ -164,13 +164,13 @@ function getSKDFromPem(pem) { } /** - * Hashes |input| using the SHA1 algorithm in the following manner: - * btoa(sha1(atob(input))) + * Hashes |input| using the SHA-256 algorithm in the following manner: + * btoa(sha256(atob(input))) * * @argument {String} input Base64 string to decode and return the hash of. - * @returns {String} Base64 encoded SHA1 hash. + * @returns {String} Base64 encoded SHA-256 hash. */ -function sha1Base64(input) { +function sha256Base64(input) { let decodedValue; try { decodedValue = atob(input); @@ -191,7 +191,7 @@ function sha1Base64(input) { let hasher = Cc["@mozilla.org/security/hash;1"] .createInstance(Ci.nsICryptoHash); - hasher.init(hasher.SHA1); + hasher.init(hasher.SHA256); hasher.update(data, data.length); // true is passed so that the hasher returns a Base64 encoded string. @@ -201,11 +201,11 @@ function sha1Base64(input) { // Downloads the static certs file and tries to map Google Chrome nicknames // to Mozilla nicknames, as well as storing any hashes for pins for which we // don't have root PEMs. Each entry consists of a line containing the name of -// the pin followed either by a hash in the format "sha1/" + base64(hash), a -// hash in the format "sha256/" + base64(hash), a PEM encoded public key, or -// a PEM encoded certificate. For certificates that we have in our database, +// the pin followed either by a hash in the format "sha256/" + base64(hash), +// a PEM encoded public key, or a PEM encoded certificate. +// For certificates that we have in our database, // return a map of Google's nickname to ours. For ones that aren't return a -// map of Google's nickname to sha1 values. This code is modeled after agl's +// map of Google's nickname to SHA-256 values. This code is modeled after agl's // https://github.com/agl/transport-security-state-generate, which doesn't // live in the Chromium repo because go is not an official language in // Chromium. @@ -216,7 +216,7 @@ function sha1Base64(input) { // and stick the hash in certSKDToName // We MUST be able to find a corresponding cert nickname for the Chrome names, // otherwise we skip all pinsets referring to that Chrome name. -function downloadAndParseChromeCerts(filename, certSKDToName) { +function downloadAndParseChromeCerts(filename, certNameToSKD, certSKDToName) { // Prefixes that we care about. const BEGIN_CERT = "-----BEGIN CERTIFICATE-----"; const END_CERT = "-----END CERTIFICATE-----"; @@ -238,8 +238,7 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { let chromeNameToHash = {}; let chromeNameToMozName = {}; let chromeName; - for (let i = 0; i < lines.length; ++i) { - let line = lines[i]; + for (let line of lines) { // Skip comments and newlines. if (line.length == 0 || line[0] == '#') { continue; @@ -250,18 +249,9 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { state = POST_NAME; break; case POST_NAME: - // TODO(bug 1229284): Chromium no longer uses SHA1 hashes, so remove - // code like this supporting SHA1. - if (line.startsWith(SHA1_PREFIX) || - line.startsWith(SHA256_PREFIX)) { - if (line.startsWith(SHA1_PREFIX)) { - hash = line.substring(SHA1_PREFIX.length); - } else if (line.startsWith(SHA256_PREFIX)) { - hash = line.substring(SHA256_PREFIX.length); - } - // Store the entire prefixed hash, so we can disambiguate sha1 from - // sha256 later. - chromeNameToHash[chromeName] = line; + if (line.startsWith(SHA256_PREFIX)) { + hash = line.substring(SHA256_PREFIX.length); + chromeNameToHash[chromeName] = hash; certNameToSKD[chromeName] = hash; certSKDToName[hash] = chromeName; state = PRE_NAME; @@ -298,12 +288,9 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { case IN_PUB_KEY: if (line.startsWith(END_PUB_KEY)) { state = PRE_NAME; - // TODO(bug 1229284): Switch to SHA-256 instead. SHA1 is used here - // mainly to confirm that the changes made to support public keys are - // correct and don't change any hashes. - hash = sha1Base64(pemPubKey); + hash = sha256Base64(pemPubKey); pemPubKey = ""; - chromeNameToHash[chromeName] = SHA1_PREFIX + hash; + chromeNameToHash[chromeName] = hash; certNameToSKD[chromeName] = hash; certSKDToName[hash] = chromeName; } else { @@ -325,7 +312,6 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { // { // pinset_name : { // // Array of names with entries in certNameToSKD -// sha1_hashes: [], // sha256_hashes: [] // } // } @@ -344,20 +330,13 @@ function downloadAndParseChromePins(filename, chromePins.forEach(function(pin) { let valid = true; - let pinset = { name: pin.name, sha1_hashes: [], sha256_hashes: [] }; + let pinset = { name: pin.name, sha256_hashes: [] }; // Translate the Chrome pinset format to ours pin.static_spki_hashes.forEach(function(name) { if (name in chromeNameToHash) { let hash = chromeNameToHash[name]; - if (hash.startsWith(SHA1_PREFIX)) { - hash = hash.substring(SHA1_PREFIX.length); - pinset.sha1_hashes.push(certSKDToName[hash]); - } else if (hash.startsWith(SHA256_PREFIX)) { - hash = hash.substring(SHA256_PREFIX.length); - pinset.sha256_hashes.push(certSKDToName[hash]); - } else { - throw("Unsupported hash type: " + chromeNameToHash[name]); - } + pinset.sha256_hashes.push(certSKDToName[hash]); + // We should have already added hashes for all of these when we // imported the certificate file. if (!certNameToSKD[name]) { @@ -478,26 +457,18 @@ function genExpirationTime() { } function writeFullPinset(certNameToSKD, certSKDToName, pinset) { - // We aren't guaranteed to have sha1 hashes in our own imported pins. let prefix = "kPinset_" + pinset.name; - let sha1Name = "nullptr"; - let sha256Name = "nullptr"; - if (pinset.sha1_hashes && pinset.sha1_hashes.length > 0) { - writeFingerprints(certNameToSKD, certSKDToName, pinset.name, - pinset.sha1_hashes, "sha1"); - sha1Name = "&" + prefix + "_sha1"; - } - if (pinset.sha256_hashes && pinset.sha256_hashes.length > 0) { - writeFingerprints(certNameToSKD, certSKDToName, pinset.name, - pinset.sha256_hashes, "sha256"); - sha256Name = "&" + prefix + "_sha256"; + if (!pinset.sha256_hashes || pinset.sha256_hashes.length == 0) { + throw `ERROR: Pinset ${pinset.name} does not contain any hashes.`; } + writeFingerprints(certNameToSKD, certSKDToName, pinset.name, + pinset.sha256_hashes); writeString("static const StaticPinset " + prefix + " = {\n" + - " " + sha1Name + ",\n " + sha256Name + "\n};\n\n"); + " nullptr,\n &" + prefix + "_sha256\n};\n\n"); } -function writeFingerprints(certNameToSKD, certSKDToName, name, hashes, type) { - let varPrefix = "kPinset_" + name + "_" + type; +function writeFingerprints(certNameToSKD, certSKDToName, name, hashes) { + let varPrefix = "kPinset_" + name + "_sha256"; writeString("static const char* " + varPrefix + "_Data[] = {\n"); let SKDList = []; for (let certName of hashes) { @@ -595,23 +566,12 @@ function writeFile(certNameToSKD, certSKDToName, let mozillaPins = {}; gStaticPins.pinsets.forEach(function(pinset) { mozillaPins[pinset.name] = true; - // We aren't guaranteed to have sha1_hashes in our own JSON. - if (pinset.sha1_hashes) { - pinset.sha1_hashes.forEach(function(name) { - usedFingerprints[name] = true; - }); - } - if (pinset.sha256_hashes) { - pinset.sha256_hashes.forEach(function(name) { - usedFingerprints[name] = true; - }); - } + pinset.sha256_hashes.forEach(function (name) { + usedFingerprints[name] = true; + }); }); for (let key in chromeImportedPinsets) { let pinset = chromeImportedPinsets[key]; - pinset.sha1_hashes.forEach(function(name) { - usedFingerprints[name] = true; - }); pinset.sha256_hashes.forEach(function(name) { usedFingerprints[name] = true; }); @@ -663,7 +623,7 @@ function loadExtraCertificates(certStringList) { var extraCertificates = loadExtraCertificates(gStaticPins.extra_certificates); var [ certNameToSKD, certSKDToName ] = loadNSSCertinfo(extraCertificates); var [ chromeNameToHash, chromeNameToMozName ] = downloadAndParseChromeCerts( - gStaticPins.chromium_data.cert_file_url, certSKDToName); + gStaticPins.chromium_data.cert_file_url, certNameToSKD, certSKDToName); var [ chromeImportedPinsets, chromeImportedEntries ] = downloadAndParseChromePins(gStaticPins.chromium_data.json_file_url, chromeNameToHash, chromeNameToMozName, certNameToSKD, certSKDToName);

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1233328 - Part 1: Ignore SHA-1 pins in PublicKeyPinningService.cpp. r=keeler
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit cc0fcf624033578259dab28ccaaa90bbd85d3a12 Author: Cykesiopka <cykesiopka.bmo(a)gmail.com> Date: Wed Jan 20 20:40:01 2016 -0800 Bug 1233328 - Part 1: Ignore SHA-1 pins in PublicKeyPinningService.cpp. r=keeler --- security/manager/ssl/PublicKeyPinningService.cpp | 88 ++++++++---------------- security/manager/ssl/PublicKeyPinningService.h | 18 +++-- 2 files changed, 35 insertions(+), 71 deletions(-) diff --git a/security/manager/ssl/PublicKeyPinningService.cpp b/security/manager/ssl/PublicKeyPinningService.cpp index 073b3db..7fa7bf7 100644 --- a/security/manager/ssl/PublicKeyPinningService.cpp +++ b/security/manager/ssl/PublicKeyPinningService.cpp @@ -31,12 +31,11 @@ PRLogModuleInfo* gPublicKeyPinningLog = of the DER Encoded subject Public Key Info for the given cert */ static nsresult -GetBase64HashSPKI(const CERTCertificate* cert, SECOidTag hashType, - nsACString& hashSPKIDigest) +GetBase64HashSPKI(const CERTCertificate* cert, nsACString& hashSPKIDigest) { hashSPKIDigest.Truncate(); Digest digest; - nsresult rv = digest.DigestBuf(hashType, cert->derPublicKey.data, + nsresult rv = digest.DigestBuf(SEC_OID_SHA256, cert->derPublicKey.data, cert->derPublicKey.len); if (NS_FAILED(rv)) { return rv; @@ -48,24 +47,23 @@ GetBase64HashSPKI(const CERTCertificate* cert, SECOidTag hashType, } /* - * Returns true if a given cert matches any hashType fingerprints from the - * given pinset or the dynamicFingeprints array, false otherwise. + * Sets certMatchesPinset to true if a given cert matches any fingerprints from + * the given pinset or the dynamicFingerprints array, or to false otherwise. */ static nsresult -EvalCertWithHashType(const CERTCertificate* cert, SECOidTag hashType, - const StaticFingerprints* fingerprints, - const nsTArray<nsCString>* dynamicFingerprints, - /*out*/ bool& certMatchesPinset) +EvalCert(const CERTCertificate* cert, const StaticFingerprints* fingerprints, + const nsTArray<nsCString>* dynamicFingerprints, + /*out*/ bool& certMatchesPinset) { certMatchesPinset = false; if (!fingerprints && !dynamicFingerprints) { MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, - ("pkpin: No hashes found for hash type: %d\n", hashType)); + ("pkpin: No hashes found\n")); return NS_ERROR_INVALID_ARG; } nsAutoCString base64Out; - nsresult rv = GetBase64HashSPKI(cert, hashType, base64Out); + nsresult rv = GetBase64HashSPKI(cert, base64Out); if (NS_FAILED(rv)) { MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, ("pkpin: GetBase64HashSPKI failed!\n")); @@ -96,30 +94,25 @@ EvalCertWithHashType(const CERTCertificate* cert, SECOidTag hashType, } /* - * Returns true if a given chain matches any hashType fingerprints from the - * given pinset or the dynamicFingerprints array, false otherwise. + * Sets certListIntersectsPinset to true if a given chain matches any + * fingerprints from the given pinset or the dynamicFingerprints array, or to + * false otherwise. */ static nsresult -EvalChainWithHashType(const CERTCertList* certList, SECOidTag hashType, - const StaticPinset* pinset, - const nsTArray<nsCString>* dynamicFingerprints, - /*out*/ bool& certListIntersectsPinset) +EvalChain(const CERTCertList* certList, const StaticPinset* pinset, + const nsTArray<nsCString>* dynamicFingerprints, + /*out*/ bool& certListIntersectsPinset) { certListIntersectsPinset = false; CERTCertificate* currentCert; const StaticFingerprints* fingerprints = nullptr; if (pinset) { - if (hashType == SEC_OID_SHA256) { - fingerprints = pinset->sha256; - } else if (hashType == SEC_OID_SHA1) { - fingerprints = pinset->sha1; - } + fingerprints = pinset->sha256; } - // This can happen if dynamicFingerprints is null and the static pinset - // doesn't have any pins of this hash type. if (!fingerprints && !dynamicFingerprints) { - return NS_OK; + MOZ_ASSERT(false, "Must pass in at least one type of pinset"); + return NS_ERROR_FAILURE; } CERTCertListNode* node; @@ -130,9 +123,8 @@ EvalChainWithHashType(const CERTCertList* certList, SECOidTag hashType, ("pkpin: certArray subject: '%s'\n", currentCert->subjectName)); MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, ("pkpin: certArray issuer: '%s'\n", currentCert->issuerName)); - nsresult rv = EvalCertWithHashType(currentCert, hashType, fingerprints, - dynamicFingerprints, - certListIntersectsPinset); + nsresult rv = EvalCert(currentCert, fingerprints, dynamicFingerprints, + certListIntersectsPinset); if (NS_FAILED(rv)) { return rv; } @@ -145,29 +137,6 @@ EvalChainWithHashType(const CERTCertList* certList, SECOidTag hashType, } /** - * Given a pinset and certlist, return true if one of the certificates on - * the list matches a fingerprint in the pinset, false otherwise. - */ -static nsresult -EvalChainWithPinset(const CERTCertList* certList, - const StaticPinset* pinset, - /*out*/ bool& certListIntersectsPinset) -{ - certListIntersectsPinset = false; - // SHA256 is more trustworthy, try that first. - nsresult rv = EvalChainWithHashType(certList, SEC_OID_SHA256, pinset, - nullptr, certListIntersectsPinset); - if (NS_FAILED(rv)) { - return rv; - } - if (certListIntersectsPinset) { - return NS_OK; - } - return EvalChainWithHashType(certList, SEC_OID_SHA1, pinset, nullptr, - certListIntersectsPinset); -} - -/** Comparator for the is public key pinned host. */ static int @@ -184,8 +153,7 @@ PublicKeyPinningService::ChainMatchesPinset(const CERTCertList* certList, const nsTArray<nsCString>& aSHA256keys, /*out*/ bool& chainMatchesPinset) { - return EvalChainWithHashType(certList, SEC_OID_SHA256, nullptr, &aSHA256keys, - chainMatchesPinset); + return EvalChain(certList, nullptr, &aSHA256keys, chainMatchesPinset); } // Returns via one of the output parameters the most relevant pinning @@ -206,10 +174,9 @@ FindPinningInformation(const char* hostname, mozilla::pkix::Time time, if (!sssService) { return NS_ERROR_FAILURE; } - SiteHPKPState dynamicEntry; - TransportSecurityPreload *foundEntry = nullptr; - char *evalHost = const_cast<char*>(hostname); - char *evalPart; + TransportSecurityPreload* foundEntry = nullptr; + char* evalHost = const_cast<char*>(hostname); + char* evalPart; // Notice how the (xx = strchr) prevents pins for unqualified domain names. while (!foundEntry && (evalPart = strchr(evalHost, '.'))) { MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, @@ -293,13 +260,12 @@ CheckPinsForHostname(const CERTCertList* certList, const char* hostname, return NS_OK; } if (dynamicFingerprints.Length() > 0) { - return EvalChainWithHashType(certList, SEC_OID_SHA256, nullptr, - &dynamicFingerprints, chainHasValidPins); + return EvalChain(certList, nullptr, &dynamicFingerprints, chainHasValidPins); } if (staticFingerprints) { bool enforceTestModeResult; - rv = EvalChainWithPinset(certList, staticFingerprints->pinset, - enforceTestModeResult); + rv = EvalChain(certList, staticFingerprints->pinset, nullptr, + enforceTestModeResult); if (NS_FAILED(rv)) { return rv; } diff --git a/security/manager/ssl/PublicKeyPinningService.h b/security/manager/ssl/PublicKeyPinningService.h index 9a02ab9..601f624 100644 --- a/security/manager/ssl/PublicKeyPinningService.h +++ b/security/manager/ssl/PublicKeyPinningService.h @@ -18,13 +18,11 @@ class PublicKeyPinningService { public: /** - * Returns true if the given (host, certList) passes pinning checks, - * false otherwise. If the host is pinned, return true if one of the keys in - * the given certificate chain matches the pin set specified by the - * hostname. If the hostname is null or empty evaluate against all the - * possible names for the EE cert (Common Name (CN) plus all DNS Name: - * subject Alt Name entries). The certList's head is the EE cert and the - * tail is the trust anchor. + * Sets chainHasValidPins to true if the given (host, certList) passes pinning + * checks, or to false otherwise. If the host is pinned, returns true via + * chainHasValidPins if one of the keys in the given certificate chain matches + * the pin set specified by the hostname. The certList's head is the EE cert + * and the tail is the trust anchor. * Note: if an alt name is a wildcard, it won't necessarily find a pinset * that would otherwise be valid for it */ @@ -35,9 +33,9 @@ public: /*out*/ bool& chainHasValidPins, /*optional out*/ PinningTelemetryInfo* pinningTelemetryInfo); /** - * Returns true if there is any intersection between the certificate list - * and the pins specified in the aSHA256key array. Values passed in are - * assumed to be in base64 encoded form + * Sets chainMatchesPinset to true if there is any intersection between the + * certificate list and the pins specified in the aSHA256keys array. + * Values passed in are assumed to be in base64 encoded form. */ static nsresult ChainMatchesPinset(const CERTCertList* certList, const nsTArray<nsCString>& aSHA256keys,

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1233328 - Part 2: Use SHA-256 StaticFingerprints directly instead of StaticPinset since the SHA-1 StaticFingerprints entry will always be null. r=keeler
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 3832c89a58e2b526a40e6399dceec3c21524f01a Author: Cykesiopka <cykesiopka.bmo(a)gmail.com> Date: Wed Jan 20 20:45:29 2016 -0800 Bug 1233328 - Part 2: Use SHA-256 StaticFingerprints directly instead of StaticPinset since the SHA-1 StaticFingerprints entry will always be null. r=keeler --- security/manager/ssl/PublicKeyPinningService.cpp | 10 +- security/manager/ssl/StaticHPKPins.h | 259 ++++++----------------- security/manager/tools/genHPKPStaticPins.js | 10 +- 3 files changed, 75 insertions(+), 204 deletions(-) diff --git a/security/manager/ssl/PublicKeyPinningService.cpp b/security/manager/ssl/PublicKeyPinningService.cpp index 7fa7bf7..d6fcd0b 100644 --- a/security/manager/ssl/PublicKeyPinningService.cpp +++ b/security/manager/ssl/PublicKeyPinningService.cpp @@ -95,21 +95,17 @@ EvalCert(const CERTCertificate* cert, const StaticFingerprints* fingerprints, /* * Sets certListIntersectsPinset to true if a given chain matches any - * fingerprints from the given pinset or the dynamicFingerprints array, or to - * false otherwise. + * fingerprints from the given static fingerprints or the + * dynamicFingerprints array, or to false otherwise. */ static nsresult -EvalChain(const CERTCertList* certList, const StaticPinset* pinset, +EvalChain(const CERTCertList* certList, const StaticFingerprints* fingerprints, const nsTArray<nsCString>* dynamicFingerprints, /*out*/ bool& certListIntersectsPinset) { certListIntersectsPinset = false; CERTCertificate* currentCert; - const StaticFingerprints* fingerprints = nullptr; - if (pinset) { - fingerprints = pinset->sha256; - } if (!fingerprints && !dynamicFingerprints) { MOZ_ASSERT(false, "Must pass in at least one type of pinset"); return NS_ERROR_FAILURE; diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h index 7fb0c7e..f05af88 100644 --- a/security/manager/ssl/StaticHPKPins.h +++ b/security/manager/ssl/StaticHPKPins.h @@ -113,7 +113,7 @@ static const char kEquifax_Secure_eBusiness_CA_1Fingerprint[] = /* FacebookBackup */ static const char kFacebookBackupFingerprint[] = - "1ww8E0AYsR2oX5lndk2hwp2Uosk="; + "q4PO2G2cbkZhZ82+JgmRUyGMoAeozA+BSXVXQWB8XWQ="; /* GOOGLE_PIN_DigiCertECCSecureServerCA */ static const char kGOOGLE_PIN_DigiCertECCSecureServerCAFingerprint[] = @@ -213,7 +213,7 @@ static const char kGo_Daddy_Root_Certificate_Authority___G2Fingerprint[] = /* GoogleBackup2048 */ static const char kGoogleBackup2048Fingerprint[] = - "vq7OyjSnqOco9nyMCDGdy77eijM="; + "IPMbDAjLVSGntGO3WP53X/zilCVndez5YJ2+vJvhJsA="; /* Network Solutions Certificate Authority */ static const char kNetwork_Solutions_Certificate_AuthorityFingerprint[] = @@ -221,11 +221,11 @@ static const char kNetwork_Solutions_Certificate_AuthorityFingerprint[] = /* SpiderOak2 */ static const char kSpiderOak2Fingerprint[] = - "D0fS/hquA6QprluciyO1hlFUAxg="; + "7Y3UnxbffL8aFPXsOJBpGasgpDmngpIhAxGKdQRklQQ="; /* SpiderOak3 */ static const char kSpiderOak3Fingerprint[] = - "l5JoIXv4lztZ+C6TJWgxZCHQzS4="; + "LkER54vOdlygpTsbYvlpMq1CE/lDAG1AP9xmdtwvV2A="; /* Starfield Class 2 CA */ static const char kStarfield_Class_2_CAFingerprint[] = @@ -257,19 +257,19 @@ static const char kTestSPKIFingerprint[] = /* Tor1 */ static const char kTor1Fingerprint[] = - "juNxSTv9UANmpC9kF5GKpmWNx3Y="; + "bYz9JTDk89X3qu3fgswG+lBQso5vI0N1f0Rx4go4nLo="; /* Tor2 */ static const char kTor2Fingerprint[] = - "lia43lPolzSPVIq34Dw57uYcLD8="; + "xXCxhTdn7uxXneJSbQCqoAvuW3ZtQl2pDVTf2sewS8w="; /* Tor3 */ static const char kTor3Fingerprint[] = - "rzEyQIKOh77j87n5bjWUNguXF8Y="; + "CleC1qwUR8JPgH1nXvSe2VHxDe5/KfNs96EusbfSOfo="; /* Twitter1 */ static const char kTwitter1Fingerprint[] = - "Vv7zwhR9TtOIN/29MFI4cgHld40="; + "vU9M48LzD/CF34wE5PPf4nBwRyosy06X21J0ap8yS5s="; /* UTN USERFirst Email Root CA */ static const char kUTN_USERFirst_Email_Root_CAFingerprint[] = @@ -329,11 +329,11 @@ static const char kXRamp_Global_CA_RootFingerprint[] = /* YahooBackup1 */ static const char kYahooBackup1Fingerprint[] = - "uwnZN/atr9+khywDukPzmD9kFiY="; + "2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; /* YahooBackup2 */ static const char kYahooBackup2Fingerprint[] = - "Ui85k1YWcCl0z/4IlMvrDmI5zEo="; + "dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; /* thawte Primary Root CA */ static const char kthawte_Primary_Root_CAFingerprint[] = @@ -353,13 +353,8 @@ struct StaticFingerprints { const char* const* data; }; -struct StaticPinset { - const StaticFingerprints* sha1; - const StaticFingerprints* sha256; -}; - /* PreloadedHPKPins.json pinsets */ -static const char* kPinset_google_root_pems_sha256_Data[] = { +static const char* kPinset_google_root_pems_Data[] = { kEquifax_Secure_CAFingerprint, kComodo_Trusted_Services_rootFingerprint, kCOMODO_ECC_Certification_AuthorityFingerprint, @@ -416,17 +411,12 @@ static const char* kPinset_google_root_pems_sha256_Data[] = { kAffirmTrust_PremiumFingerprint, kAddTrust_Qualified_Certificates_RootFingerprint, }; -static const StaticFingerprints kPinset_google_root_pems_sha256 = { - sizeof(kPinset_google_root_pems_sha256_Data) / sizeof(const char*), - kPinset_google_root_pems_sha256_Data -}; - -static const StaticPinset kPinset_google_root_pems = { - nullptr, - &kPinset_google_root_pems_sha256 +static const StaticFingerprints kPinset_google_root_pems = { + sizeof(kPinset_google_root_pems_Data) / sizeof(const char*), + kPinset_google_root_pems_Data }; -static const char* kPinset_mozilla_sha256_Data[] = { +static const char* kPinset_mozilla_Data[] = { kGeoTrust_Global_CA_2Fingerprint, kthawte_Primary_Root_CA___G3Fingerprint, kthawte_Primary_Root_CAFingerprint, @@ -448,113 +438,61 @@ static const char* kPinset_mozilla_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, }; -static const StaticFingerprints kPinset_mozilla_sha256 = { - sizeof(kPinset_mozilla_sha256_Data) / sizeof(const char*), - kPinset_mozilla_sha256_Data +static const StaticFingerprints kPinset_mozilla = { + sizeof(kPinset_mozilla_Data) / sizeof(const char*), + kPinset_mozilla_Data }; -static const StaticPinset kPinset_mozilla = { - nullptr, - &kPinset_mozilla_sha256 -}; - -static const char* kPinset_mozilla_services_sha256_Data[] = { +static const char* kPinset_mozilla_services_Data[] = { kDigiCert_Global_Root_CAFingerprint, }; -static const StaticFingerprints kPinset_mozilla_services_sha256 = { - sizeof(kPinset_mozilla_services_sha256_Data) / sizeof(const char*), - kPinset_mozilla_services_sha256_Data -}; - -static const StaticPinset kPinset_mozilla_services = { - nullptr, - &kPinset_mozilla_services_sha256 +static const StaticFingerprints kPinset_mozilla_services = { + sizeof(kPinset_mozilla_services_Data) / sizeof(const char*), + kPinset_mozilla_services_Data }; -static const char* kPinset_mozilla_test_sha256_Data[] = { +static const char* kPinset_mozilla_test_Data[] = { kEnd_Entity_Test_CertFingerprint, }; -static const StaticFingerprints kPinset_mozilla_test_sha256 = { - sizeof(kPinset_mozilla_test_sha256_Data) / sizeof(const char*), - kPinset_mozilla_test_sha256_Data -}; - -static const StaticPinset kPinset_mozilla_test = { - nullptr, - &kPinset_mozilla_test_sha256 +static const StaticFingerprints kPinset_mozilla_test = { + sizeof(kPinset_mozilla_test_Data) / sizeof(const char*), + kPinset_mozilla_test_Data }; /* Chrome static pinsets */ -static const char* kPinset_test_sha256_Data[] = { +static const char* kPinset_test_Data[] = { kTestSPKIFingerprint, }; -static const StaticFingerprints kPinset_test_sha256 = { - sizeof(kPinset_test_sha256_Data) / sizeof(const char*), - kPinset_test_sha256_Data -}; - -static const StaticPinset kPinset_test = { - nullptr, - &kPinset_test_sha256 -}; - -static const char* kPinset_google_sha1_Data[] = { - kGoogleBackup2048Fingerprint, -}; -static const StaticFingerprints kPinset_google_sha1 = { - sizeof(kPinset_google_sha1_Data) / sizeof(const char*), - kPinset_google_sha1_Data +static const StaticFingerprints kPinset_test = { + sizeof(kPinset_test_Data) / sizeof(const char*), + kPinset_test_Data }; -static const char* kPinset_google_sha256_Data[] = { +static const char* kPinset_google_Data[] = { kGOOGLE_PIN_GoogleG2Fingerprint, + kGoogleBackup2048Fingerprint, kGeoTrust_Global_CAFingerprint, }; -static const StaticFingerprints kPinset_google_sha256 = { - sizeof(kPinset_google_sha256_Data) / sizeof(const char*), - kPinset_google_sha256_Data -}; - -static const StaticPinset kPinset_google = { - &kPinset_google_sha1, - &kPinset_google_sha256 +static const StaticFingerprints kPinset_google = { + sizeof(kPinset_google_Data) / sizeof(const char*), + kPinset_google_Data }; -static const char* kPinset_tor_sha1_Data[] = { - kTor1Fingerprint, - kTor2Fingerprint, +static const char* kPinset_tor_Data[] = { kTor3Fingerprint, -}; -static const StaticFingerprints kPinset_tor_sha1 = { - sizeof(kPinset_tor_sha1_Data) / sizeof(const char*), - kPinset_tor_sha1_Data -}; - -static const char* kPinset_tor_sha256_Data[] = { kDigiCert_High_Assurance_EV_Root_CAFingerprint, kGOOGLE_PIN_LetsEncryptAuthorityX1Fingerprint, + kTor1Fingerprint, kGOOGLE_PIN_RapidSSLFingerprint, kGOOGLE_PIN_LetsEncryptAuthorityX2Fingerprint, + kTor2Fingerprint, }; -static const StaticFingerprints kPinset_tor_sha256 = { - sizeof(kPinset_tor_sha256_Data) / sizeof(const char*), - kPinset_tor_sha256_Data -}; - -static const StaticPinset kPinset_tor = { - &kPinset_tor_sha1, - &kPinset_tor_sha256 -}; - -static const char* kPinset_twitterCom_sha1_Data[] = { - kTwitter1Fingerprint, -}; -static const StaticFingerprints kPinset_twitterCom_sha1 = { - sizeof(kPinset_twitterCom_sha1_Data) / sizeof(const char*), - kPinset_twitterCom_sha1_Data +static const StaticFingerprints kPinset_tor = { + sizeof(kPinset_tor_Data) / sizeof(const char*), + kPinset_tor_Data }; -static const char* kPinset_twitterCom_sha256_Data[] = { +static const char* kPinset_twitterCom_Data[] = { kVerisign_Class_2_Public_Primary_Certification_Authority___G2Fingerprint, kVerisign_Class_3_Public_Primary_Certification_Authority___G2Fingerprint, kGeoTrust_Global_CA_2Fingerprint, @@ -575,26 +513,14 @@ static const char* kPinset_twitterCom_sha256_Data[] = { kGeoTrust_Primary_Certification_Authority___G3Fingerprint, kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, -}; -static const StaticFingerprints kPinset_twitterCom_sha256 = { - sizeof(kPinset_twitterCom_sha256_Data) / sizeof(const char*), - kPinset_twitterCom_sha256_Data -}; - -static const StaticPinset kPinset_twitterCom = { - &kPinset_twitterCom_sha1, - &kPinset_twitterCom_sha256 -}; - -static const char* kPinset_twitterCDN_sha1_Data[] = { kTwitter1Fingerprint, }; -static const StaticFingerprints kPinset_twitterCDN_sha1 = { - sizeof(kPinset_twitterCDN_sha1_Data) / sizeof(const char*), - kPinset_twitterCDN_sha1_Data +static const StaticFingerprints kPinset_twitterCom = { + sizeof(kPinset_twitterCom_Data) / sizeof(const char*), + kPinset_twitterCom_Data }; -static const char* kPinset_twitterCDN_sha256_Data[] = { +static const char* kPinset_twitterCDN_Data[] = { kVerisign_Class_2_Public_Primary_Certification_Authority___G2Fingerprint, kComodo_Trusted_Services_rootFingerprint, kCOMODO_Certification_AuthorityFingerprint, @@ -635,19 +561,15 @@ static const char* kPinset_twitterCDN_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, kComodo_AAA_Services_rootFingerprint, + kTwitter1Fingerprint, kAddTrust_Qualified_Certificates_RootFingerprint, }; -static const StaticFingerprints kPinset_twitterCDN_sha256 = { - sizeof(kPinset_twitterCDN_sha256_Data) / sizeof(const char*), - kPinset_twitterCDN_sha256_Data +static const StaticFingerprints kPinset_twitterCDN = { + sizeof(kPinset_twitterCDN_Data) / sizeof(const char*), + kPinset_twitterCDN_Data }; -static const StaticPinset kPinset_twitterCDN = { - &kPinset_twitterCDN_sha1, - &kPinset_twitterCDN_sha256 -}; - -static const char* kPinset_dropbox_sha256_Data[] = { +static const char* kPinset_dropbox_Data[] = { kEntrust_Root_Certification_Authority___EC1Fingerprint, kGOOGLE_PIN_ThawtePremiumServerFingerprint, kthawte_Primary_Root_CA___G3Fingerprint, @@ -667,72 +589,35 @@ static const char* kPinset_dropbox_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, }; -static const StaticFingerprints kPinset_dropbox_sha256 = { - sizeof(kPinset_dropbox_sha256_Data) / sizeof(const char*), - kPinset_dropbox_sha256_Data -}; - -static const StaticPinset kPinset_dropbox = { - nullptr, - &kPinset_dropbox_sha256 -}; - -static const char* kPinset_facebook_sha1_Data[] = { - kFacebookBackupFingerprint, -}; -static const StaticFingerprints kPinset_facebook_sha1 = { - sizeof(kPinset_facebook_sha1_Data) / sizeof(const char*), - kPinset_facebook_sha1_Data +static const StaticFingerprints kPinset_dropbox = { + sizeof(kPinset_dropbox_Data) / sizeof(const char*), + kPinset_dropbox_Data }; -static const char* kPinset_facebook_sha256_Data[] = { +static const char* kPinset_facebook_Data[] = { kGOOGLE_PIN_DigiCertECCSecureServerCAFingerprint, kDigiCert_High_Assurance_EV_Root_CAFingerprint, kGOOGLE_PIN_SymantecClass3EVG3Fingerprint, + kFacebookBackupFingerprint, }; -static const StaticFingerprints kPinset_facebook_sha256 = { - sizeof(kPinset_facebook_sha256_Data) / sizeof(const char*), - kPinset_facebook_sha256_Data -}; - -static const StaticPinset kPinset_facebook = { - &kPinset_facebook_sha1, - &kPinset_facebook_sha256 +static const StaticFingerprints kPinset_facebook = { + sizeof(kPinset_facebook_Data) / sizeof(const char*), + kPinset_facebook_Data }; -static const char* kPinset_spideroak_sha1_Data[] = { +static const char* kPinset_spideroak_Data[] = { kSpiderOak2Fingerprint, kSpiderOak3Fingerprint, -}; -static const StaticFingerprints kPinset_spideroak_sha1 = { - sizeof(kPinset_spideroak_sha1_Data) / sizeof(const char*), - kPinset_spideroak_sha1_Data -}; - -static const char* kPinset_spideroak_sha256_Data[] = { kDigiCert_High_Assurance_EV_Root_CAFingerprint, kGeoTrust_Global_CAFingerprint, }; -static const StaticFingerprints kPinset_spideroak_sha256 = { - sizeof(kPinset_spideroak_sha256_Data) / sizeof(const char*), - kPinset_spideroak_sha256_Data -}; - -static const StaticPinset kPinset_spideroak = { - &kPinset_spideroak_sha1, - &kPinset_spideroak_sha256 +static const StaticFingerprints kPinset_spideroak = { + sizeof(kPinset_spideroak_Data) / sizeof(const char*), + kPinset_spideroak_Data }; -static const char* kPinset_yahoo_sha1_Data[] = { - kYahooBackup2Fingerprint, +static const char* kPinset_yahoo_Data[] = { kYahooBackup1Fingerprint, -}; -static const StaticFingerprints kPinset_yahoo_sha1 = { - sizeof(kPinset_yahoo_sha1_Data) / sizeof(const char*), - kPinset_yahoo_sha1_Data -}; - -static const char* kPinset_yahoo_sha256_Data[] = { kVerisign_Class_2_Public_Primary_Certification_Authority___G2Fingerprint, kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint, kGeoTrust_Primary_Certification_AuthorityFingerprint, @@ -740,6 +625,7 @@ static const char* kPinset_yahoo_sha256_Data[] = { kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint, kDigiCert_High_Assurance_EV_Root_CAFingerprint, kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint, + kYahooBackup2Fingerprint, kGeoTrust_Global_CAFingerprint, kVeriSign_Universal_Root_Certification_AuthorityFingerprint, kGeoTrust_Universal_CAFingerprint, @@ -747,14 +633,9 @@ static const char* kPinset_yahoo_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, }; -static const StaticFingerprints kPinset_yahoo_sha256 = { - sizeof(kPinset_yahoo_sha256_Data) / sizeof(const char*), - kPinset_yahoo_sha256_Data -}; - -static const StaticPinset kPinset_yahoo = { - &kPinset_yahoo_sha1, - &kPinset_yahoo_sha256 +static const StaticFingerprints kPinset_yahoo = { + sizeof(kPinset_yahoo_Data) / sizeof(const char*), + kPinset_yahoo_Data }; /* Domainlist */ @@ -764,7 +645,7 @@ struct TransportSecurityPreload { const bool mTestMode; const bool mIsMoz; const int32_t mId; - const StaticPinset *pinset; + const StaticFingerprints* pinset; }; /* Sort hostnames for binary search. */ @@ -1230,4 +1111,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { static const int32_t kUnknownId = -1; -static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1472903978258000); +static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1473437156700000); diff --git a/security/manager/tools/genHPKPStaticPins.js b/security/manager/tools/genHPKPStaticPins.js index 8a91fff..c1bbd01 100644 --- a/security/manager/tools/genHPKPStaticPins.js +++ b/security/manager/tools/genHPKPStaticPins.js @@ -53,17 +53,13 @@ const DOMAINHEADER = "/* Domainlist */\n" + " const bool mTestMode;\n" + " const bool mIsMoz;\n" + " const int32_t mId;\n" + - " const StaticPinset* pinset;\n" + + " const StaticFingerprints* pinset;\n" + "};\n\n"; const PINSETDEF = "/* Pinsets are each an ordered list by the actual value of the fingerprint */\n" + "struct StaticFingerprints {\n" + " const size_t size;\n" + " const char* const* data;\n" + - "};\n\n" + - "struct StaticPinset {\n" + - " const StaticFingerprints* sha1;\n" + - " const StaticFingerprints* sha256;\n" + "};\n\n"; // Command-line arguments @@ -463,12 +459,10 @@ function writeFullPinset(certNameToSKD, certSKDToName, pinset) { } writeFingerprints(certNameToSKD, certSKDToName, pinset.name, pinset.sha256_hashes); - writeString("static const StaticPinset " + prefix + " = {\n" + - " nullptr,\n &" + prefix + "_sha256\n};\n\n"); } function writeFingerprints(certNameToSKD, certSKDToName, name, hashes) { - let varPrefix = "kPinset_" + name + "_sha256"; + let varPrefix = "kPinset_" + name; writeString("static const char* " + varPrefix + "_Data[] = {\n"); let SKDList = []; for (let certName of hashes) {

1 0

[tor-browser-bundle/master] Bug 19202: Use cdn.tpo in mar files URLs
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 6c3d9be8b2fb74260145797c1bea664c4362e566 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 30 17:21:21 2016 +0200 Bug 19202: Use cdn.tpo in mar files URLs --- tools/update-responses/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/update-responses/config.yml b/tools/update-responses/config.yml index 615150b..fd6411b 100644 --- a/tools/update-responses/config.yml +++ b/tools/update-responses/config.yml @@ -15,7 +15,7 @@ versions: 6.0.1: platformVersion: 45.2.0 detailsURL: https://blog.torproject.org/blog/tor-browser-601-released - download_url: https://www.torproject.org/dist/torbrowser/6.0.1 + download_url: https://cdn.torproject.org/aus1/torbrowser/6.0.1 incremental_from: - 5.5.5 - 6.0 @@ -27,7 +27,7 @@ versions: 6.0a5: platformVersion: 45.1.0 detailsURL: https://blog.torproject.org/blog/tor-browser-60a5-released - download_url: https://www.torproject.org/dist/torbrowser/6.0a5 + download_url: https://cdn.torproject.org/aus1/torbrowser/6.0a5 incremental_from: - 6.0a4 migrate_archs:

1 0

[tor-browser-bundle/master] Bug 18291: Remove some uses of libfaketime
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 3acd55740d447b2afb47ab5da5e3eece93337829 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 23 19:58:44 2016 +0200 Bug 18291: Remove some uses of libfaketime Completely stop using libfaketime for Linux builds. For Windows builds we have to keep using it for the tor, pluggable-transports and bundle steps. For OSX builds, we keep it in the bundle steps for the timestamp added when creating the dmg file with genisoimage. --- gitian/descriptors/linux/gitian-bundle.yml | 16 ++++------- gitian/descriptors/linux/gitian-firefox.yml | 30 ++------------------ .../linux/gitian-pluggable-transports.yml | 4 +-- gitian/descriptors/linux/gitian-tor.yml | 4 +-- gitian/descriptors/linux/gitian-utils.yml | 17 +++++------ gitian/descriptors/mac/gitian-firefox.yml | 29 ++----------------- .../mac/gitian-pluggable-transports.yml | 4 +-- gitian/descriptors/mac/gitian-utils.yml | 33 ++++++++-------------- gitian/descriptors/windows/gitian-firefox.yml | 23 ++------------- gitian/descriptors/windows/gitian-utils.yml | 15 +++++----- .../patches/openssl-Make-build-reproducible.patch | 28 ++++++++++++++++++ 11 files changed, 67 insertions(+), 136 deletions(-) diff --git a/gitian/descriptors/linux/gitian-bundle.yml b/gitian/descriptors/linux/gitian-bundle.yml index 0316148..105cab7 100644 --- a/gitian/descriptors/linux/gitian-bundle.yml +++ b/gitian/descriptors/linux/gitian-bundle.yml @@ -28,8 +28,6 @@ remotes: "dir": "meek" - "url": "https://github.com/googlei18n/noto-fonts.git" "dir": "noto-fonts" -- "url": "https://github.com/wolfcw/libfaketime" - "dir": "faketime" files: - "tor-browser-linux32-gbuilt.zip" - "tor-browser-linux64-gbuilt.zip" @@ -61,21 +59,13 @@ files: script: | INSTDIR="$HOME/install" source versions + export REFERENCE_DATETIME export LIBRARY_PATH="$INSTDIR/lib" export TZ=UTC export LC_ALL=C export TORBROWSER_VERSION=`cat bare-version` umask 0022 - # Building libfaketime - cd faketime - make - DESTDIR="$INSTDIR/faketime" make install - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME=$REFERENCE_DATETIME - export FAKETIME_SKIP_CMDS="rsync" - cd .. - mkdir -p $OUTDIR/ # When we build with MULTI_LINGUAL=1, the browser will be packaged inside a # directory named tor-browser (instead of tor-browser_en-US). Therefore we @@ -202,6 +192,7 @@ script: | cp defaults/preferences/000-tor-browser.js ~/build/ # Set the locale of the bundle. echo "pref(\"general.useragent.locale\", \"en-US\");" >> defaults/preferences/000-tor-browser.js + touch --date="$REFERENCE_DATETIME" defaults/preferences/000-tor-browser.js zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults popd @@ -237,6 +228,7 @@ script: | # app.update.url). pushd ${PKG_DIR}/Browser/ echo ${PKG_LOCALE} > update.locale + touch --date="$REFERENCE_DATETIME" update.locale zip -Xm omni.ja update.locale popd fi @@ -267,6 +259,7 @@ script: | cp ~/build/000-tor-browser.js defaults/preferences/ # Set the locale of the bundle. echo "pref(\"general.useragent.locale\", \"$LANG\");" >> defaults/preferences/000-tor-browser.js + touch --date="$REFERENCE_DATETIME" defaults/preferences/000-tor-browser.js zip -Xm omni.ja defaults/preferences/000-tor-browser.js rm -rf defaults popd @@ -276,6 +269,7 @@ script: | # recreate precomplete file (needs to be accurate for full MAR updates). pushd tor-browser_$LANG/Browser/ echo "$LANG" > update.locale + touch --date="$REFERENCE_DATETIME" update.locale zip -Xm omni.ja update.locale rm -rf dictionaries rm -f precomplete diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 22dcbd4..1316ed8 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -28,8 +28,6 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" -- "url": "https://github.com/wolfcw/libfaketime" - "dir": "faketime" files: - "binutils-linux32-utils.zip" - "binutils-linux64-utils.zip" @@ -41,6 +39,7 @@ files: script: | source versions INSTDIR="$HOME/install" + export REFERENCE_DATETIME export CFLAGS="-frandom-seed=tor" export CXXFLAGS="-frandom-seed=tor" export TZ=UTC @@ -87,42 +86,17 @@ script: | mkdir -p $INSTDIR/Debug/Browser/components mkdir -p $INSTDIR/Debug/Browser/browser/components - # Building libfaketime - cd faketime - make - DESTDIR="$INSTDIR/faketime" make install - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME=$REFERENCE_DATETIME - cd .. - cd tor-browser # .git and the src takes up a lot of useless space, and we need the space to build rm -rf .git find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - # |configure| can't cope with nano seconds faked. And even if we would revert - # that feature it would hang sometimes for unknown but to libfaketime related - # reasons. - export LD_PRELOAD="" + export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" - # We need libfaketime for all the timestamps e.g. written into the libraries. - # BUT we need to exclude |make build| from it. Otherwise the build fails close - # to the end, see #12461 comment 8 and later. Additionally, we need to avoid - # breaking the ICU compilation. Exlcuding |bash| helps here. See #12461 - # comment 13. Finally, we need to exclude |python2.7| as not doing so would - # stall the build right at the beginning. See #13877. - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME_SKIP_CMDS="python2.7,bash,make" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build - # Packaging is broken with libfaketime enabled, thus we disable it again. See - # #12461 comments 11 and 12 for details. - export LD_PRELOAD="" make -C obj-* package INNER_MAKE_PACKAGE=true - # Without libfaketime enabled we would get different omni.ja and *debug.zip - # files. - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" cp -a obj-*/dist/firefox/* $INSTDIR/Browser/ # Remove firefox-bin (we don't use it, see ticket #10126) rm -f $INSTDIR/Browser/firefox-bin diff --git a/gitian/descriptors/linux/gitian-pluggable-transports.yml b/gitian/descriptors/linux/gitian-pluggable-transports.yml index a1cdc48..38804dd 100644 --- a/gitian/descriptors/linux/gitian-pluggable-transports.yml +++ b/gitian/descriptors/linux/gitian-pluggable-transports.yml @@ -7,7 +7,6 @@ architectures: - "i386" - "amd64" packages: -- "faketime" - "unzip" - "python-setuptools" - "python-dev" @@ -57,7 +56,7 @@ script: | INSTDIR="$HOME/install" PTDIR="$INSTDIR/Tor/PluggableTransports" mkdir -p $PTDIR - export FAKETIME=$REFERENCE_DATETIME + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C export PYTHON=python2 @@ -262,7 +261,6 @@ script: | cd ../.. # Grabbing the results and making sure timestamps don't spoil them - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 cd $INSTDIR ~/build/dzip.sh pluggable-transports-linux$GBUILD_BITS-gbuilt.zip Tor/ Docs/ cp pluggable-transports-linux$GBUILD_BITS-gbuilt.zip $OUTDIR/ diff --git a/gitian/descriptors/linux/gitian-tor.yml b/gitian/descriptors/linux/gitian-tor.yml index bc1dc67..bfb683a 100644 --- a/gitian/descriptors/linux/gitian-tor.yml +++ b/gitian/descriptors/linux/gitian-tor.yml @@ -7,7 +7,6 @@ architectures: - "i386" - "amd64" packages: -- "faketime" - "unzip" - "automake" - "libtool" @@ -30,7 +29,7 @@ files: script: | INSTDIR="$HOME/install" source versions - export FAKETIME=$REFERENCE_DATETIME + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 @@ -94,7 +93,6 @@ script: | done # Grabbing the results and making sure timestamps don't spoil them - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 ~/build/dzip.sh tor-linux$GBUILD_BITS-gbuilt.zip Data/ Tor/ ~/build/dzip.sh tor-linux$GBUILD_BITS-debug.zip Debug/ cp tor-linux$GBUILD_BITS-gbuilt.zip $OUTDIR/ diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index e8801cc..0adcf5d 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -7,7 +7,6 @@ architectures: - "i386" - "amd64" packages: -- "faketime" - "automake" - "libtool" - "zip" @@ -33,6 +32,7 @@ files: - "binutils.tar.bz2" - "gcc.tar.bz2" - "openssl.tar.gz" +- "openssl-Make-build-reproducible.patch" - "gmp.tar.bz2" - "versions" - "dzip.sh" @@ -41,7 +41,7 @@ script: | source versions export TZ=UTC export LC_ALL=C - export FAKETIME=$REFERENCE_DATETIME + export REFERENCE_DATETIME umask 0022 # Config options for hardening-wrapper @@ -76,10 +76,6 @@ script: | # anymore. It seems it got audited for those problems already: # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=48817. export DEB_BUILD_HARDENING_FORMAT=0 - # libfaketime gets into our way when building GCC 4.9.x. See: - # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61314 for details. Thus, we - # avoid it for the toolchain and cross our fingers. - # TODO: Test a newer libfaketime than 0.8. # Building GCC tar xjf gcc.tar.bz2 cd gcc-* @@ -99,9 +95,9 @@ script: | cd .. # Building OpenSSL - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 tar xzf openssl.tar.gz cd openssl-* + patch -p1 < ../openssl-Make-build-reproducible.patch find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" if [ $GBUILD_BITS == "64" ]; then @@ -115,8 +111,6 @@ script: | make install cd .. - export LD_PRELOAD="" - # Building GMP tar xjf gmp.tar.bz2 cd gmp-* @@ -131,7 +125,10 @@ script: | cd .. # Grabbing the remaining results and making sure timestamps don't spoil them - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 + # Since we stopped using libfaketime, the binutils, gcc, openssl, + # libevent archives are no longer reproducible. The main reason + # is that they include some .a archives which include timestamps. + # Those files are however not part of the files we ship. cd $INSTDIR ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh gcc-$GCC_VER-linux$GBUILD_BITS-utils.zip gcc diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index 17c4c8b..fdec679 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -15,8 +15,6 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" -- "url": "https://github.com/wolfcw/libfaketime" - "dir": "faketime" files: - "clang-linux64-wheezy-utils.zip" - "cctools.tar.gz" @@ -24,11 +22,11 @@ files: - "re-dzip.sh" - "dzip.sh" - "fix-info-plist.py" -- "libfaketime.patch" - "versions" script: | INSTDIR="$HOME/install/" source versions + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 @@ -36,18 +34,6 @@ script: | mkdir -p $INSTDIR/TorBrowser.app/Contents/MacOS/ mkdir -p $OUTDIR/ - # Building libfaketime. - cd faketime - export GIT_COMMITTER_NAME="nobody" - export GIT_COMMITTER_EMAIL="nobody@localhost" - export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" - git am ~/build/libfaketime.patch - make - DESTDIR="$INSTDIR/faketime" make install - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME=$REFERENCE_DATETIME - cd .. - cd tor-browser # Extracting all the necessary tools tar xaf ../MacOSX10.7.sdk.tar.gz @@ -62,20 +48,9 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - # |configure| can't cope with nano seconds faked. And even if we would revert - # that feature it would hang sometimes for unknown but to libfaketime related - # reasons. - export LD_PRELOAD="" + export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" - # We need libfaketime for all the timestamps e.g. written into the libraries. - # BUT we need to exclude |make build| from it. Otherwise the build fails close - # to the end, see #12812 comment 6 and #12461 comment 8 and later. - # Additionally, we need to exclude |rsync| due to #10153 which is reproducible - # reliably with the new libfaketime and |python2.7| as well as the build would - # stall otherwise right at the beginning. See #13877 for details. - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME_SKIP_CMDS="python2.7,rsync,make" make $MAKEOPTS -f client.mk build # make -C obj-macos package INNER_MAKE_PACKAGE=true diff --git a/gitian/descriptors/mac/gitian-pluggable-transports.yml b/gitian/descriptors/mac/gitian-pluggable-transports.yml index 33b134e..cb7ac5c 100644 --- a/gitian/descriptors/mac/gitian-pluggable-transports.yml +++ b/gitian/descriptors/mac/gitian-pluggable-transports.yml @@ -6,7 +6,6 @@ suites: architectures: - "i386" packages: -- "faketime" - "unzip" - "python-setuptools" - "python-dev" @@ -69,8 +68,7 @@ script: | INCLUDE_FTE=1 fi export LIBRARY_PATH="$INSTDIR/lib" - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 - export FAKETIME=$REFERENCE_DATETIME + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 diff --git a/gitian/descriptors/mac/gitian-utils.yml b/gitian/descriptors/mac/gitian-utils.yml index cef1533..33db2e8 100644 --- a/gitian/descriptors/mac/gitian-utils.yml +++ b/gitian/descriptors/mac/gitian-utils.yml @@ -7,7 +7,6 @@ architectures: - "i386" - "amd64" packages: -- "faketime" - "automake" - "libtool" - "zip" @@ -15,8 +14,6 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" -- "url": "https://github.com/wolfcw/libfaketime" - "dir": "faketime" - "url": "https://github.com/llvm-mirror/llvm" "dir": "llvm" - "url": "https://github.com/llvm-mirror/clang" @@ -27,13 +24,14 @@ files: - "apple-uni-sdk-10.6_20110407-0.flosoft1_i386.deb" - "multiarch-darwin11-cctools127.2-gcc42-5666.3-llvmgcc42-2336.1-Linux-120724.tar.xz" - "openssl.tar.gz" +- "openssl-Make-build-reproducible.patch" - "gmp.tar.bz2" - "versions" - "dzip.sh" -- "libfaketime.patch" script: | INSTDIR="$HOME/install" source versions + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 @@ -56,21 +54,13 @@ script: | make $MAKEOPTS make install cd $INSTDIR + # Since we stopped using libfaketime, the clang archive is no longer + # reproducible. The reason is that it includes some .a archives and + # other files which include timestamps. + # Those files are however not part of the files we ship. ~/build/dzip.sh clang-$CLANG_VER-linux64-wheezy-utils.zip clang cp *utils.zip $OUTDIR/ else - # Building libfaketime. - cd faketime - export GIT_COMMITTER_NAME="nobody" - export GIT_COMMITTER_EMAIL="nobody@localhost" - export GIT_COMMITTER_DATE="$REFERENCE_DATETIME" - git am ~/build/libfaketime.patch - make - DESTDIR="$INSTDIR/faketime" make install - export FAKETIME_SKIP_CMDS="make" - export FAKETIME=$REFERENCE_DATETIME - cd .. - # dpkg requires sbin directories in the PATH export PATH="/usr/sbin:/sbin:$PATH" sudo dpkg -i *.deb @@ -91,7 +81,6 @@ script: | ./autogen.sh find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" ./configure --disable-static --host=i686-apple-darwin11 --prefix=$INSTDIR/libevent - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" make $MAKEOPTS make install cd .. @@ -99,6 +88,7 @@ script: | # Building OpenSSL tar xzf openssl.tar.gz cd openssl-* + patch -p1 < ../openssl-Make-build-reproducible.patch find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit OS X. ./Configure --cross-compile-prefix=i686-apple-darwin11- $CFLAGS darwin64-x86_64-cc --prefix=$INSTDIR/openssl enable-ec_nistp_64_gcc_128 @@ -111,20 +101,19 @@ script: | # Building GMP tar xjf gmp.tar.bz2 cd gmp-* - # |configure| can't cope with nano seconds faked. And even if we would revert - # that feature it would hang sometimes for unknown but to libfaketime related - # reasons. - export LD_PRELOAD="" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # Even if we are not shipping libgmpxx anymore we still need --enable-xcc # during compile time. ./configure --host=x86_64-apple-darwin11 --prefix=$INSTDIR/gmp --disable-static --enable-shared --enable-cxx - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" make make install cd .. # Grabbing the results + # Since we stopped using libfaketime, the openssl archive is no + # longer reproducible. The main reason is that it includes some .a + # archives which include timestamps. + # Those files are however not part of the files we ship. cd $INSTDIR ~/build/dzip.sh openssl-$OPENSSL_VER-mac64-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-mac64-utils.zip libevent diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index 2686c5f..3261199 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -12,8 +12,6 @@ reference_datetime: "2000-01-01 00:00:00" remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" -- "url": "https://github.com/wolfcw/libfaketime" - "dir": "faketime" files: - "gcc-linux32-precise-utils.zip" - "mingw-w64-win32-utils.zip" @@ -28,6 +26,7 @@ files: script: | INSTDIR="$HOME/install" source versions + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 @@ -44,14 +43,6 @@ script: | export LD_LIBRARY_PATH=$INSTDIR/gcc/lib export PATH=$INSTDIR/mingw-w64/bin:$INSTDIR/gcc/bin:$PATH - # Building libfaketime - cd faketime - make - DESTDIR="$INSTDIR/faketime" make install - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME=$REFERENCE_DATETIME - cd .. - # We don't want to link against msvcrt.dll due to bug 9084. i686-w64-mingw32-g++ -dumpspecs > msvcr100.spec sed 's/msvcrt/msvcr100/' -i msvcr100.spec @@ -82,10 +73,7 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - # |configure| can't cope with nano seconds faked. And even if we would revert - # that feature it would hang sometimes for unknown but to libfaketime related - # reasons. - export LD_PRELOAD="" + export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # @@ -93,13 +81,6 @@ script: | cp ~/build/i686* ~/build/bin/ export PATH=~/build/bin:$PATH # - # We need libfaketime for all the timestamps e.g. written into the libraries. - # BUT we need to exclude |make build| from it. Otherwise the build fails close - # to the end, see #12811 comment 14 and #12461 comment 8 and later. - # Additionally, we need to exclude |python2.7| as well as the build would - # stall otherwise right at the beginning. See #13877 for details. - export LD_PRELOAD="$INSTDIR/faketime/usr/local/lib/faketime/libfaketime.so.1" - export FAKETIME_SKIP_CMDS="python2.7,make" make $MAKEOPTS -f client.mk build # make -C obj-* package INNER_MAKE_PACKAGE=true diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 2767bad..0876bff 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -5,7 +5,6 @@ suites: architectures: - "i386" packages: -- "faketime" - "automake" - "libtool" - "zip" @@ -28,6 +27,7 @@ files: - "binutils.tar.bz2" - "gcc.tar.bz2" - "openssl.tar.gz" +- "openssl-Make-build-reproducible.patch" - "gmp.tar.bz2" - "enable-reloc-section-ld.patch" - "peXXigen.patch" @@ -39,6 +39,7 @@ files: script: | INSTDIR="$HOME/install" source versions + export REFERENCE_DATETIME export TZ=UTC export LC_ALL=C umask 0022 @@ -115,13 +116,6 @@ script: | cp i686-w64-mingw32/libgcc/shlib/libgcc_s_sjlj-1.dll $INSTDIR/gcclibs cd .. - # XXX: Build the libraries we include into the bundles deterministically. As - # libfaketime breaks the mingw-w64 build (probably due to bug 11459) we omit - # the compiler and linker from it. It seems we get away with this strategy - # and the libgcc* and libss* which we ship, too, are still built in a - # reproducible fashion. - export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 - export FAKETIME=$REFERENCE_DATETIME # Building zlib export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" @@ -143,6 +137,7 @@ script: | # Building OpenSSL tar xzf openssl.tar.gz cd openssl-* + patch -p1 < ../openssl-Make-build-reproducible.patch find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit Windows. ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" --prefix=$INSTDIR/openssl @@ -185,6 +180,10 @@ script: | cd .. # Grabbing the remaining results + # Since we stopped using libfaketime, the gcc, gmp, zlib, openssl, + # libevent, mingw-w64 archives are no longer reproducible. The main + # reason is that they include some .a archives which include timestamps. + # Those files are however not part of the files we ship. cd $INSTDIR # We might want to bump binutils independent of bumping mingw-w64. touch binutils-$BINUTILS_VER-win32-utils.zip diff --git a/gitian/patches/openssl-Make-build-reproducible.patch b/gitian/patches/openssl-Make-build-reproducible.patch new file mode 100644 index 0000000..d86f5ba --- /dev/null +++ b/gitian/patches/openssl-Make-build-reproducible.patch @@ -0,0 +1,28 @@ +From b88c021b5a7c539f821b7b7c47c72138cc3c3271 Mon Sep 17 00:00:00 2001 +From: Kurt Roeckx <kurt(a)roeckx.be> +Date: Fri, 2 Jan 2015 12:27:57 +0100 +Subject: [PATCH] Make build reproducible + +It contained a date on when it was build. + +Reviewed-by: Rich Salz <rsalz(a)openssl.org> +--- + crypto/cversion.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/crypto/cversion.c b/crypto/cversion.c +index 9e6f50d78182..c417d1d1121f 100644 +--- a/crypto/cversion.c ++++ b/crypto/cversion.c +@@ -68,7 +68,11 @@ const char *SSLeay_version(int t) + return OPENSSL_VERSION_TEXT; + if (t == SSLEAY_BUILT_ON) { + #ifdef DATE ++# ifdef OPENSSL_USE_BUILD_DATE + return (DATE); ++# else ++ return("built on: reproducible build, date unspecified"); ++# endif + #else + return ("built on: date not available"); + #endif

1 0