commit e5659b39d8bc51faecac5daa7f2cb9b63d4dccf8 Author: Igor Oliveira igt0@torproject.org Date: Mon Oct 29 12:30:14 2018 -0200

Bug 26690: Port padlock states for .onion services to mobile

Prior to this patch, TBA was showing onion services as insecure connection and SSL/TLS ones as encrypted connections(lock icon).

This patch fixes the issue adding several new onion icons to indicate all the various permutations of onions services hosted HTTP or HTTPS pages. --- .../src/main/res/drawable/site_security_icon.xml | 10 +++++++++- .../app/src/photon/res/drawable-hdpi/ic_onion.png | Bin 0 -> 807 bytes .../photon/res/drawable-hdpi/ic_onion_disabled.png | Bin 0 -> 975 bytes .../src/photon/res/drawable-hdpi/ic_onion_lock.png | Bin 0 -> 932 bytes .../app/src/photon/res/drawable-xhdpi/ic_onion.png | Bin 0 -> 1015 bytes .../res/drawable-xhdpi/ic_onion_disabled.png | Bin 0 -> 1260 bytes .../photon/res/drawable-xhdpi/ic_onion_lock.png | Bin 0 -> 1275 bytes .../src/photon/res/drawable-xxhdpi/ic_onion.png | Bin 0 -> 1592 bytes .../res/drawable-xxhdpi/ic_onion_disabled.png | Bin 0 -> 1892 bytes .../photon/res/drawable-xxhdpi/ic_onion_lock.png | Bin 0 -> 1899 bytes .../src/photon/res/drawable-xxxhdpi/ic_onion.png | Bin 0 -> 2099 bytes .../res/drawable-xxxhdpi/ic_onion_disabled.png | Bin 0 -> 2526 bytes .../photon/res/drawable-xxxhdpi/ic_onion_lock.png | Bin 0 -> 2568 bytes .../photon/res/drawable/security_mode_icon_nm.xml | 9 +++++++++ .../photon/res/drawable/security_mode_icon_pm.xml | 9 +++++++++ .../base/java/org/mozilla/gecko/SiteIdentity.java | 14 ++++++++++++++ .../mozilla/gecko/toolbar/SecurityModeUtil.java | 21 ++++++++++++++++----- .../mozilla/gecko/toolbar/SiteIdentityPopup.java | 17 +++++++++++------ mobile/android/chrome/content/browser.js | 14 +++++++++++++- 19 files changed, 81 insertions(+), 13 deletions(-)

diff --git a/mobile/android/app/src/main/res/drawable/site_security_icon.xml b/mobile/android/app/src/main/res/drawable/site_security_icon.xml index ac8624f861ad..f5f4c7775110 100644 --- a/mobile/android/app/src/main/res/drawable/site_security_icon.xml +++ b/mobile/android/app/src/main/res/drawable/site_security_icon.xml @@ -28,5 +28,13 @@ <item android:drawable="@drawable/ic_search_icon" android:maxLevel="6" /> - + <item + android:drawable="@drawable/ic_onion" + android:maxLevel="7"/> + <item + android:drawable="@drawable/ic_onion_lock" + android:maxLevel="8"/> + <item + android:drawable="@drawable/ic_onion_disabled" + android:maxLevel="9"/> </level-list> diff --git a/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion.png b/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion.png new file mode 100644 index 000000000000..1a61d982752b Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion.png differ diff --git a/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion_disabled.png b/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion_disabled.png new file mode 100644 index 000000000000..9669d12101fb Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion_disabled.png differ diff --git a/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion_lock.png b/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion_lock.png new file mode 100644 index 000000000000..b0f60fea5b28 Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-hdpi/ic_onion_lock.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion.png b/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion.png new file mode 100755 index 000000000000..074330c3a25a Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion_disabled.png b/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion_disabled.png new file mode 100755 index 000000000000..09db37998d33 Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion_disabled.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion_lock.png b/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion_lock.png new file mode 100755 index 000000000000..13799b7fa8f7 Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xhdpi/ic_onion_lock.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion.png b/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion.png new file mode 100755 index 000000000000..711bb3c8d8fa Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion_disabled.png b/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion_disabled.png new file mode 100755 index 000000000000..0d931669abf3 Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion_disabled.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion_lock.png b/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion_lock.png new file mode 100755 index 000000000000..f7a5c29b4c17 Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xxhdpi/ic_onion_lock.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion.png b/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion.png new file mode 100755 index 000000000000..97a0beabbe0c Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion_disabled.png b/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion_disabled.png new file mode 100755 index 000000000000..aec29bf6238b Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion_disabled.png differ diff --git a/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion_lock.png b/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion_lock.png new file mode 100755 index 000000000000..71df527b2a6a Binary files /dev/null and b/mobile/android/app/src/photon/res/drawable-xxxhdpi/ic_onion_lock.png differ diff --git a/mobile/android/app/src/photon/res/drawable/security_mode_icon_nm.xml b/mobile/android/app/src/photon/res/drawable/security_mode_icon_nm.xml index 0b6b496b0b34..bb0da0b843d2 100644 --- a/mobile/android/app/src/photon/res/drawable/security_mode_icon_nm.xml +++ b/mobile/android/app/src/photon/res/drawable/security_mode_icon_nm.xml @@ -28,5 +28,14 @@ <item android:drawable="@drawable/ic_search_icon" android:maxLevel="6" /> + <item + android:drawable="@drawable/ic_onion" + android:maxLevel="7"/> + <item + android:drawable="@drawable/ic_onion_lock" + android:maxLevel="8"/> + <item + android:drawable="@drawable/ic_onion_disabled" + android:maxLevel="9"/>

</level-list> diff --git a/mobile/android/app/src/photon/res/drawable/security_mode_icon_pm.xml b/mobile/android/app/src/photon/res/drawable/security_mode_icon_pm.xml index edbd269040d1..be47d7fe081f 100644 --- a/mobile/android/app/src/photon/res/drawable/security_mode_icon_pm.xml +++ b/mobile/android/app/src/photon/res/drawable/security_mode_icon_pm.xml @@ -28,5 +28,14 @@ <item android:drawable="@drawable/ic_search_icon" android:maxLevel="6" /> + <item + android:drawable="@drawable/ic_onion" + android:maxLevel="7"/> + <item + android:drawable="@drawable/ic_onion_lock" + android:maxLevel="8"/> + <item + android:drawable="@drawable/ic_onion_disabled" + android:maxLevel="9"/>

</level-list> diff --git a/mobile/android/base/java/org/mozilla/gecko/SiteIdentity.java b/mobile/android/base/java/org/mozilla/gecko/SiteIdentity.java index 1a046657329d..f5dcb5747386 100644 --- a/mobile/android/base/java/org/mozilla/gecko/SiteIdentity.java +++ b/mobile/android/base/java/org/mozilla/gecko/SiteIdentity.java @@ -25,6 +25,8 @@ public class SiteIdentity { private String mCountry; private String mVerifier; private String mOrigin; + private boolean mIsOnionHost; + private boolean mHasCert;

public enum SecurityMode { UNKNOWN, @@ -59,6 +61,8 @@ public class SiteIdentity { mCountry = null; mVerifier = null; mSecure = false; + mIsOnionHost = false; + mHasCert = false; }

public void reset() { @@ -110,6 +114,8 @@ public class SiteIdentity { mVerifier = identityData.getString("verifier"); mSecure = identityData.getBoolean("secure"); mSecurityException = identityData.getBoolean("securityException"); + mIsOnionHost = identityData.getBoolean("isOnionHost"); + mHasCert = identityData.getBoolean("hasCert"); }

public SecurityMode getSecurityMode() { @@ -152,6 +158,14 @@ public class SiteIdentity { return mSecure; }

+ public boolean isOnionHost() { + return mIsOnionHost; + } + + public boolean hasCert() { + return mHasCert; + } + public MixedMode getMixedModeActive() { return mMixedModeActive; } diff --git a/mobile/android/base/java/org/mozilla/gecko/toolbar/SecurityModeUtil.java b/mobile/android/base/java/org/mozilla/gecko/toolbar/SecurityModeUtil.java index ceb33b8e3acb..10bc83c279a1 100644 --- a/mobile/android/base/java/org/mozilla/gecko/toolbar/SecurityModeUtil.java +++ b/mobile/android/base/java/org/mozilla/gecko/toolbar/SecurityModeUtil.java @@ -35,6 +35,9 @@ public class SecurityModeUtil { LOCK_SECURE(1), LOCK_WARNING(-1), // not used for now. reserve for MixedDisplayContent icon, if any. LOCK_INSECURE(3), + ONION(7), + ONION_ACTIVATE(8), + ONION_DISABLED(9), WARNING(2), TRACKING_CONTENT_BLOCKED(4), TRACKING_CONTENT_LOADED(5); @@ -100,6 +103,8 @@ public class SecurityModeUtil { final MixedMode displayMixedMode = identity.getMixedModeDisplay(); final TrackingMode trackingMode = identity.getTrackingMode(); final boolean securityException = identity.isSecurityException(); + final boolean isOnionHost = identity.isOnionHost(); + final boolean hasCert = identity.hasCert();

if (securityException) { return IconType.WARNING; @@ -108,9 +113,9 @@ public class SecurityModeUtil { } else if (trackingMode == TrackingMode.TRACKING_CONTENT_BLOCKED) { return IconType.TRACKING_CONTENT_BLOCKED; } else if (activeMixedMode == MixedMode.LOADED) { - return IconType.LOCK_INSECURE; + return isOnionHost ? IconType.ONION_DISABLED : IconType.LOCK_INSECURE; } else if (displayMixedMode == MixedMode.LOADED) { - return IconType.WARNING; + return isOnionHost ? IconType.ONION_DISABLED : IconType.WARNING; }

// Chrome-UI checking is after tracking/mixed-content, even for about: pages, as they @@ -119,9 +124,15 @@ public class SecurityModeUtil { return IconType.DEFAULT; }

- return securityModeMap.containsKey(securityMode) - ? securityModeMap.get(securityMode) - : IconType.UNKNOWN; + if (securityMode == SecurityMode.UNKNOWN) { + return isOnionHost ? IconType.ONION : IconType.UNKNOWN; + } else if (securityMode == SecurityMode.IDENTIFIED) { + return isOnionHost ? (hasCert ? IconType.ONION_ACTIVATE : IconType.ONION) : IconType.LOCK_SECURE; + } else if (securityMode == SecurityMode.VERIFIED) { + return isOnionHost ? IconType.ONION_ACTIVATE : IconType.LOCK_SECURE; + } else { + return IconType.UNKNOWN; + } }

/** diff --git a/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java b/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java index 831f69f2bf09..df67f0a9b9ed 100644 --- a/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java +++ b/mobile/android/base/java/org/mozilla/gecko/toolbar/SiteIdentityPopup.java @@ -144,8 +144,9 @@ public class SiteIdentityPopup extends AnchoredPopup implements BundleEventListe init(); }

- final boolean isIdentityKnown = (siteIdentity.getSecurityMode() == SecurityMode.IDENTIFIED || - siteIdentity.getSecurityMode() == SecurityMode.VERIFIED); + final boolean isIdentityKnown = ((siteIdentity.getSecurityMode() == SecurityMode.IDENTIFIED || + siteIdentity.getSecurityMode() == SecurityMode.VERIFIED) && + siteIdentity.hasCert()); updateConnectionState(siteIdentity); toggleIdentityKnownContainerVisibility(isIdentityKnown);

@@ -322,7 +323,8 @@ public class SiteIdentityPopup extends AnchoredPopup implements BundleEventListe } else if (!siteIdentity.isSecure()) { if (siteIdentity.getMixedModeActive() == MixedMode.LOADED) { // Active Mixed Content loaded because user has disabled blocking. - mIcon.setImageResource(R.drawable.ic_lock_disabled); + int resId = siteIdentity.isOnionHost() ? R.drawable.ic_onion_disabled : R.drawable.ic_lock_disabled; + mIcon.setImageResource(resId); clearSecurityStateIcon(); mMixedContentActivity.setVisibility(View.VISIBLE); mMixedContentActivity.setText(R.string.mixed_content_protection_disabled); @@ -330,7 +332,8 @@ public class SiteIdentityPopup extends AnchoredPopup implements BundleEventListe mLink.setVisibility(View.VISIBLE); } else if (siteIdentity.getMixedModeDisplay() == MixedMode.LOADED) { // Passive Mixed Content loaded. - mIcon.setImageResource(R.drawable.ic_lock_inactive); + int resId = siteIdentity.isOnionHost() ? R.drawable.ic_onion_disabled : R.drawable.ic_lock_inactive; + mIcon.setImageResource(resId); setSecurityStateIcon(R.drawable.ic_warning_major, 1); mMixedContentActivity.setVisibility(View.VISIBLE); if (siteIdentity.getMixedModeActive() == MixedMode.BLOCKED) { @@ -342,7 +345,8 @@ public class SiteIdentityPopup extends AnchoredPopup implements BundleEventListe

} else { // Unencrypted connection with no mixed content. - mIcon.setImageResource(R.drawable.globe_light); + int resId = siteIdentity.isOnionHost() ? R.drawable.ic_onion : R.drawable.globe_light; + mIcon.setImageResource(resId); clearSecurityStateIcon();

mMixedContentActivity.setVisibility(View.GONE); @@ -361,7 +365,8 @@ public class SiteIdentityPopup extends AnchoredPopup implements BundleEventListe

} else { // Connection is secure. - mIcon.setImageResource(R.drawable.ic_lock); + int resId = siteIdentity.isOnionHost() ? (siteIdentity.hasCert() ? R.drawable.ic_onion_lock : R.drawable.ic_onion) : R.drawable.ic_lock; + mIcon.setImageResource(resId);

setSecurityStateIcon(R.drawable.img_check, 2); mSecurityState.setTextColor(ContextCompat.getColor(mContext, R.color.affirmative_green)); diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js index 51fe1422acc5..3e074009fad9 100644 --- a/mobile/android/chrome/content/browser.js +++ b/mobile/android/chrome/content/browser.js @@ -5558,6 +5558,12 @@ var IdentityHandler = { */ getIdentityData : function() { let result = {}; + + // Even if the connection is secure, it may not have a certificate + if (!this._lastStatus) { + return result; + } + let status = this._lastStatus.QueryInterface(Ci.nsISSLStatus); let cert = status.serverCert;

@@ -5585,6 +5591,10 @@ var IdentityHandler = { return result; },

+ isOnionHost: function isOnionHost() { + return this._uri.host.toLowerCase().endsWith(".onion"); + }, + /** * Determines the identity mode corresponding to the icon we show in the urlbar. */ @@ -5704,6 +5714,8 @@ var IdentityHandler = { };

result.host = this.getEffectiveHost(); + result.isOnionHost = this.isOnionHost(); + result.hasCert = !!this._lastStatus;

// Don't show identity data for pages with an unknown identity or if any // mixed content is loaded (mixed display content is loaded by default). @@ -5757,7 +5769,7 @@ var IdentityHandler = { // hasMatchingOverride does not handle that, so avoid calling it. // Updating the tooltip value in those cases isn't critical. // FIXME: Fixing bug 646690 would probably makes this check unnecessary - if (this._lastLocation.hostname && + if (this._lastLocation.hostname && iData.cert && this._overrideService.hasMatchingOverride(this._lastLocation.hostname, (this._lastLocation.port || 443), iData.cert, {}, {})) {