November 2011 - tor-commits - lists.torproject.org

[metrics-tasks/master] There's a new bwauth in town, and it's going to be orange.
by karsten＠torproject.org 09 Nov '11

09 Nov '11

commit d91ae44fe39a8ed68368427e8b90dc027c4aa41c Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Nov 9 08:27:56 2011 +0100 There's a new bwauth in town, and it's going to be orange. --- task-2394/ParseDescriptors.java | 2 ++ task-2394/bandwidth-comparison.R | 18 +++++++++++++++--- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/task-2394/ParseDescriptors.java b/task-2394/ParseDescriptors.java index 7ddab73..fbbc4b5 100644 --- a/task-2394/ParseDescriptors.java +++ b/task-2394/ParseDescriptors.java @@ -42,6 +42,8 @@ public class ParseDescriptors { "moria1"); bandwidthAuthorities.put("ED03BB616EB2F60BEC80151114BB25CEF515B226", "gabelmoo"); + bandwidthAuthorities.put("49015F787433103580E3B66A1707A00E60F2D15B", + "maatuska"); BufferedWriter bw = new BufferedWriter(new FileWriter( "bandwidth-comparison.csv")); bw.write("validafter,fingerprint,nickname,category," diff --git a/task-2394/bandwidth-comparison.R b/task-2394/bandwidth-comparison.R index 50739b7..56095ef 100644 --- a/task-2394/bandwidth-comparison.R +++ b/task-2394/bandwidth-comparison.R @@ -40,6 +40,7 @@ cdf_relays_category_votes <- function(data, category) { urras <- sort(d$urrasbandwidth * 1000 / d$descriptorbandwidth) moria1 <- sort(d$moria1bandwidth * 1000 / d$descriptorbandwidth) gabelmoo <- sort(d$gabelmoobandwidth * 1000 / d$descriptorbandwidth) + maatuska <- sort(d$maatuskabandwidth * 1000 / d$descriptorbandwidth) d <- data.frame(x = consensus, y = (1:length(consensus)) / length(consensus), source = "consensus", @@ -68,6 +69,12 @@ cdf_relays_category_votes <- function(data, category) { source = "gabelmoo", category = category)) } + if (length(maatuska) > 0) { + d <- rbind(d, data.frame(x = maatuska, + y = (1:length(maatuska)) / length(maatuska), + source = "maatuska", + category = category)) + } d } relays_category_votes <- rbind( @@ -87,7 +94,8 @@ scale_y_continuous("Fraction of relays\n", limits = c(0, 1), formatter = "percent") + scale_colour_manual("", c("consensus" = "black", "urras" = alpha("purple", 0.5), "ides" = alpha("red", 0.5), - "moria1" = alpha("green", 0.5), "gabelmoo" = alpha("blue", 0.5))) + + "moria1" = alpha("green", 0.5), "gabelmoo" = alpha("blue", 0.5), + "maatuska" = alpha("orange", 0.5))) + geom_vline(xintercept = 1, legend = FALSE, linetype = "dotted") + opts(title = paste("Measured vs. self-reported bandwidth ratios in", "consensus and votes\n"), legend.position = "right") @@ -127,7 +135,10 @@ cdf_measured_category_votes <- function(data, category) { measured = d$moria1bandwidth), "moria1", category), wecdf(data.frame( ratio = d$gabelmoobandwidth * 1000 / d$descriptorbandwidth, - measured = d$gabelmoobandwidth), "gabelmoo", category)) + measured = d$gabelmoobandwidth), "gabelmoo", category), + wecdf(data.frame( + ratio = d$maatuskabandwidth * 1000 / d$descriptorbandwidth, + measured = d$maatuskabandwidth), "maatuska", category)) d } measured_category_votes <- rbind( @@ -147,7 +158,8 @@ scale_y_continuous("Fraction of measured bandwidth\n", limits = c(0, 1), formatter = "percent") + scale_colour_manual("", c("consensus" = "black", "urras" = alpha("purple", 0.5), "ides" = alpha("red", 0.5), - "moria1" = alpha("green", 0.5), "gabelmoo" = alpha("blue", 0.5))) + + "moria1" = alpha("green", 0.5), "gabelmoo" = alpha("blue", 0.5), + "maatuska" = alpha("orange", 0.5))) + geom_vline(xintercept = 1, legend = FALSE, linetype = "dotted") + opts(title = paste("Measured vs. self-reported bandwidth ratios in", "consensus and votes\n"), legend.position = "right")

1 0

[metrics-tasks/master] Allow for the case that we're missing bwauth results (#2394).
by karsten＠torproject.org 09 Nov '11

09 Nov '11

commit 6eab08b32522d3d1640636822ba862578149f1b1 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Nov 9 08:16:58 2011 +0100 Allow for the case that we're missing bwauth results (#2394). --- task-2394/bandwidth-comparison.R | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) diff --git a/task-2394/bandwidth-comparison.R b/task-2394/bandwidth-comparison.R index a4b0329..50739b7 100644 --- a/task-2394/bandwidth-comparison.R +++ b/task-2394/bandwidth-comparison.R @@ -40,27 +40,34 @@ cdf_relays_category_votes <- function(data, category) { urras <- sort(d$urrasbandwidth * 1000 / d$descriptorbandwidth) moria1 <- sort(d$moria1bandwidth * 1000 / d$descriptorbandwidth) gabelmoo <- sort(d$gabelmoobandwidth * 1000 / d$descriptorbandwidth) - d <- rbind( - data.frame(x = consensus, + d <- data.frame(x = consensus, y = (1:length(consensus)) / length(consensus), source = "consensus", - category = category), - data.frame(x = urras, + category = category) + if (length(urras) > 0) { + d <- rbind(d, data.frame(x = urras, y = (1:length(urras)) / length(urras), source = "urras", - category = category), - data.frame(x = ides, + category = category)) + } + if (length(ides) > 0) { + d <- rbind(d, data.frame(x = ides, y = (1:length(ides)) / length(ides), source = "ides", - category = category), - data.frame(x = moria1, + category = category)) + } + if (length(moria1) > 0) { + d <- rbind(d, data.frame(x = moria1, y = (1:length(moria1)) / length(moria1), source = "moria1", - category = category), - data.frame(x = gabelmoo, + category = category)) + } + if (length(gabelmoo) > 0) { + d <- rbind(d, data.frame(x = gabelmoo, y = (1:length(gabelmoo)) / length(gabelmoo), source = "gabelmoo", category = category)) + } d } relays_category_votes <- rbind(

1 0

[metrics-tasks/master] Oops, looks like the Java file does care about filenames.
by karsten＠torproject.org 09 Nov '11

09 Nov '11

commit b372261323a670af7b72845b98c94fbf9bd7877a Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Nov 9 08:12:31 2011 +0100 Oops, looks like the Java file does care about filenames. --- task-2394/ParseDescriptors.java | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/task-2394/ParseDescriptors.java b/task-2394/ParseDescriptors.java index 641518d..7ddab73 100644 --- a/task-2394/ParseDescriptors.java +++ b/task-2394/ParseDescriptors.java @@ -21,7 +21,7 @@ public class ParseDescriptors { consensuses.put(filename, file); } else if (filename.endsWith("-votes")) { votes.put(filename, file); - } else if (filename.endsWith("-descriptors")) { + } else if (filename.endsWith("-serverdesc")) { descriptors.put(filename, file); } } @@ -90,7 +90,7 @@ public class ParseDescriptors { /* Parse referenced server descriptors to learn about exit policies * and reported bandwidths. */ - String descriptorsFilename = consensusTimestamp + "-descriptors"; + String descriptorsFilename = consensusTimestamp + "-serverdesc"; Map<String, String> parsedDescriptors = new HashMap<String, String>(); if (descriptors.containsKey(descriptorsFilename)) {

1 0

[metrics-tasks/master] Clarify the README a tiny bit (#2394).
by karsten＠torproject.org 09 Nov '11

09 Nov '11

commit ec81f22d558c63b51bed5009e8bf33863e81a6c5 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Nov 9 07:41:50 2011 +0100 Clarify the README a tiny bit (#2394). --- task-2394/README | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/task-2394/README b/task-2394/README index 774dff2..b58f1e8 100644 --- a/task-2394/README +++ b/task-2394/README @@ -13,7 +13,7 @@ Visualize self-reported vs. measured bandwidth of relays 2011-07-13-05-00-00-consensus 2011-07-13-05-00-00-votes - 2011-07-13-05-00-00-descriptors + 2011-07-13-05-00-00-serverdesc - Download Apache Commons Codec 1.4 or higher and put in in this directory.

1 0

[tor/master] Rewrite comment at head of eventdns.c
by nickm＠torproject.org 09 Nov '11

09 Nov '11

commit d4489a2851f6bfe429c33578e2f4f9c127598b8e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 9 00:23:44 2011 -0500 Rewrite comment at head of eventdns.c Let's make it more obvious to the everyday reader that eventdns.c is a) Based on Libevent's evdns.c b) Slated for demolition c) Supposed to keep API-compatibility with Libevent. d) Not worth tweaking unless there's a bug. --- src/or/eventdns.c | 20 +++++++++++++------- 1 files changed, 13 insertions(+), 7 deletions(-) diff --git a/src/or/eventdns.c b/src/or/eventdns.c index 29e2d3a..7cd5d80 100644 --- a/src/or/eventdns.c +++ b/src/or/eventdns.c @@ -1,12 +1,18 @@ -/* The original version of this module was written by Adam Langley; for - * a history of modifications, check out the subversion logs. +/* READ THIS COMMENT BEFORE HACKING THIS FILE. * - * When editing this module, try to keep it re-mergeable by Adam. Don't - * reformat the whitespace, add Tor dependencies, or so on. + * This eventdns.c copy has diverged a bit from Libevent's version, and it's + * no longer easy to resynchronize them. Once Tor requires Libevent 2.0, we + * will just dump this file and use Libevent's evdns code. * - * TODO: - * - Replace all externally visible magic numbers with #defined constants. - * - Write documentation for APIs of all external functions. + * Therefore, you probably shouldn't make any change here without making it to + * Libevent as well: it's not good for the implementation to diverge even + * more. Also, we can't shouldn't wantonly the API here (since Libevent APIs + * can't change in ways that break user behavior). Also, we shouldn't bother + * with cosmetic changes: the whole module is slated for demolition, so + * there's no point dusting the linebreaks or re-painting the parser. + * + * (We can't just drop the Libevent 2.0 evdns implementation in here instead, + * since it depends pretty heavily on parts of Libevent 2.0.) */ /* Async DNS Library

1 0

r25200: {website} add new mirror, refresh mirror status (in website/trunk: . include)
by Andrew Lewman 09 Nov '11

09 Nov '11

Author: phobos Date: 2011-11-09 02:45:31 +0000 (Wed, 09 Nov 2011) New Revision: 25200 Modified: website/trunk/include/mirrors-table.wmi website/trunk/update-mirrors.pl Log: add new mirror, refresh mirror status Modified: website/trunk/include/mirrors-table.wmi =================================================================== --- website/trunk/include/mirrors-table.wmi 2011-11-07 01:46:38 UTC (rev 25199) +++ website/trunk/include/mirrors-table.wmi 2011-11-09 02:45:31 UTC (rev 25200) @@ -86,23 +86,6 @@ <tr> - <td>IS</td> - - <td>torproject.is</td> - - <td>Up to date</td> - - <td> - </td> - <td><a href="http://torproject.is/dist/">http</a></td> - <td><a href="http://torproject.is/">http</a></td> - <td> - </td> - <td> - </td> - <td> - </td> - <td> - </td> -</tr> - -<tr> - <td>US</td> <td>BarkerJr</td> @@ -171,6 +154,23 @@ <tr> + <td>LT</td> + + <td></td> + + <td>Up to date</td> + + <td> - </td> + <td><a href="http://tor.vesta.nu/dist/">http</a></td> + <td><a href="http://tor.vesta.nu/">http</a></td> + <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> +</tr> + +<tr> + <td>AT</td> <td>FoDT.IT</td> @@ -241,6 +241,23 @@ <td>DE</td> + <td></td> + + <td>Up to date</td> + + <td> - </td> + <td><a href="http://mirror.open-networx.org/torproject.org/dist/">http</a></td> + <td><a href="http://mirror.open-networx.org/torproject.org/">http</a></td> + <td><a href="https://mirror.open-networx.org/torproject.org/dist/">https</a></td> + <td><a href="https://mirror.open-networx.org/torproject.org/">https</a></td> + <td> - </td> + <td> - </td> +</tr> + +<tr> + + <td>DE</td> + <td>factor.cc</td> <td>Up to date</td> @@ -290,6 +307,23 @@ <tr> + <td>DE</td> + + <td>beme it</td> + + <td>Up to date</td> + + <td> - </td> + <td><a href="http://tor.beme-it.de/dist/">http</a></td> + <td><a href="http://tor.beme-it.de/">http</a></td> + <td><a href="https://tor.beme-it.de/dist/">https</a></td> + <td><a href="https://tor.beme-it.de/">https</a></td> + <td> - </td> + <td><a href="rsync://tor.beme-it.de/tor">rsync</a></td> +</tr> + +<tr> + <td>US</td> <td>NW Linux</td> @@ -324,6 +358,23 @@ <tr> + <td>US</td> + + <td>AskApache</td> + + <td>Up to date</td> + + <td> - </td> + <td><a href="http://tor.askapache.com/dist/">http</a></td> + <td><a href="http://tor.askapache.com/">http</a></td> + <td> - </td> + <td> - </td> + <td> - </td> + <td> - </td> +</tr> + +<tr> + <td>FR</td> <td>LazyTiger</td> @@ -358,32 +409,32 @@ <tr> - <td>LT</td> + <td>DE</td> - <td></td> + <td>[[:bbs:]]</td> <td>Up to date</td> <td> - </td> - <td><a href="http://tor.vesta.nu/dist/">http</a></td> - <td><a href="http://tor.vesta.nu/">http</a></td> + <td><a href="http://tor.blingblingsquad.net/dist">http</a></td> + <td><a href="http://tor.blingblingsquad.net/">http</a></td> + <td><a href="https://tor.blingblingsquad.net/dist">https</a></td> + <td><a href="https://tor.blingblingsquad.net/">https</a></td> <td> - </td> <td> - </td> - <td> - </td> - <td> - </td> </tr> <tr> - <td>US</td> + <td>IS</td> - <td>AskApache</td> + <td>torproject.is</td> <td>Up to date</td> <td> - </td> - <td><a href="http://tor.askapache.com/dist/">http</a></td> - <td><a href="http://tor.askapache.com/">http</a></td> + <td><a href="http://torproject.is/dist/">http</a></td> + <td><a href="http://torproject.is/">http</a></td> <td> - </td> <td> - </td> <td> - </td> @@ -494,23 +545,6 @@ <tr> - <td>DE</td> - - <td>beme it</td> - - <td>Unknown</td> - - <td> - </td> - <td><a href="http://tor.beme-it.de/dist/">http</a></td> - <td><a href="http://tor.beme-it.de/">http</a></td> - <td><a href="https://tor.beme-it.de/dist/">https</a></td> - <td><a href="https://tor.beme-it.de/">https</a></td> - <td> - </td> - <td><a href="rsync://tor.beme-it.de/tor">rsync</a></td> -</tr> - -<tr> - <td>NL</td> <td></td> @@ -528,23 +562,6 @@ <tr> - <td>DE</td> - - <td>[[:bbs:]]</td> - - <td>Unknown</td> - - <td> - </td> - <td><a href="http://tor.blingblingsquad.net/dist">http</a></td> - <td><a href="http://tor.blingblingsquad.net/">http</a></td> - <td><a href="https://tor.blingblingsquad.net/dist">https</a></td> - <td><a href="https://tor.blingblingsquad.net/">https</a></td> - <td> - </td> - <td> - </td> -</tr> - -<tr> - <td>INT</td> <td>CoralCDN</td> Modified: website/trunk/update-mirrors.pl =================================================================== --- website/trunk/update-mirrors.pl 2011-11-07 01:46:38 UTC (rev 25199) +++ website/trunk/update-mirrors.pl 2011-11-09 02:45:31 UTC (rev 25200) @@ -730,6 +730,24 @@ httpsDistMirror => "", rsyncDistMirror => "", hiddenServiceMirror => "", + }, + mirror046 => { + adminContact => "", + orgName => "", + isoCC => "DE", + subRegion => "", + region => "DE", + ipv4 => "True", + ipv6 => "False", + loadBalanced => "No", + httpWebsiteMirror => "http://mirror.open-networx.org/torproject.org/", + httpsWebsiteMirror => "https://mirror.open-networx.org/torproject.org/", + rsyncWebsiteMirror => "", + ftpWebsiteMirror => "", + httpDistMirror => "http://mirror.open-networx.org/torproject.org/dist/", + httpsDistMirror => "https://mirror.open-networx.org/torproject.org/dist/", + rsyncDistMirror => "", + hiddenServiceMirror => "", } );

1 0

[torbrowser/maint-2.2] Update patches for FF8.
by erinn＠torproject.org 09 Nov '11

09 Nov '11

commit 2c7dd341b683944b7fb52e86fbc8434555570b41 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Nov 8 17:49:46 2011 -0800 Update patches for FF8. --- ...nents.interfaces-lookupMethod-from-conten.patch | 10 +++--- ...0002-Make-Permissions-Manager-memory-only.patch | 8 +++--- ...-Make-Intermediate-Cert-Store-memory-only.patch | 8 +++--- ...th-headers-before-the-modify-request-obse.patch | 12 ++++---- .../firefox/0005-Add-a-string-based-cacheKey.patch | 10 +++--- ...6-Randomize-HTTP-pipeline-order-and-depth.patch | 29 ++++++++++--------- .../0007-Block-all-plugins-except-flash.patch | 14 +++++----- ...ontent-pref-service-memory-only-clearable.patch | 4 +- ...owser-exit-when-not-launched-from-Vidalia.patch | 8 +++--- 9 files changed, 52 insertions(+), 51 deletions(-) diff --git a/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch b/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch index 70070d2..209f101 100644 --- a/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch +++ b/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch @@ -1,7 +1,7 @@ -From b31cf77e084355158252629efd6bf794212d807a Mon Sep 17 00:00:00 2001 +From 5087e59f2ada4c6fc2cea00f0fc5a529f3d9a2f4 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon, 20 Jun 2011 17:07:41 -0700 -Subject: [PATCH 1/8] Block Components.interfaces,lookupMethod from content +Subject: [PATCH 1/9] Block Components.interfaces,lookupMethod from content This patch removes the ability of content script to access Components.interfaces.* as well as call or access Components.lookupMethod. @@ -20,10 +20,10 @@ https://trac.torproject.org/projects/tor/ticket/2874 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/js/src/xpconnect/src/xpccomponents.cpp b/js/src/xpconnect/src/xpccomponents.cpp -index 664021e..9c8c415 100644 +index c36841c..af55624 100644 --- a/js/src/xpconnect/src/xpccomponents.cpp +++ b/js/src/xpconnect/src/xpccomponents.cpp -@@ -4393,7 +4393,9 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval) +@@ -4394,7 +4394,9 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval) NS_IMETHODIMP nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval) { @@ -34,7 +34,7 @@ index 664021e..9c8c415 100644 *_retval = xpc_CheckAccessList(methodName, allowed); return NS_OK; } -@@ -4402,7 +4404,9 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c +@@ -4403,7 +4405,9 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c NS_IMETHODIMP nsXPCComponents::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval) { diff --git a/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch b/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch index 0429cca..e0948b9 100644 --- a/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch +++ b/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch @@ -1,7 +1,7 @@ -From 9eff68b74bb38d535c1d09246c8c2893f05edd1b Mon Sep 17 00:00:00 2001 +From 21a59f630eb8cbcc5add31fa297e9edcd10d155f Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon, 20 Jun 2011 17:07:56 -0700 -Subject: [PATCH 2/8] Make Permissions Manager memory-only +Subject: [PATCH 2/9] Make Permissions Manager memory-only This patch exposes a pref 'permissions.memory_only' that properly isolates the permissions manager to memory, which is responsible for all user specified @@ -16,7 +16,7 @@ https://trac.torproject.org/projects/tor/ticket/2950 1 files changed, 31 insertions(+), 3 deletions(-) diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp -index 773a973..5387397 100644 +index f852218..4f0f58b 100644 --- a/extensions/cookie/nsPermissionManager.cpp +++ b/extensions/cookie/nsPermissionManager.cpp @@ -58,6 +58,10 @@ @@ -75,7 +75,7 @@ index 773a973..5387397 100644 NS_ENSURE_SUCCESS(rv, rv); mDBConn->GetConnectionReady(&ready); -@@ -805,7 +828,12 @@ NS_IMETHODIMP nsPermissionManager::Observe(nsISupports *aSubject, const char *aT +@@ -803,7 +826,12 @@ NS_IMETHODIMP nsPermissionManager::Observe(nsISupports *aSubject, const char *aT { ENSURE_NOT_CHILD_PROCESS; diff --git a/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch b/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch index 0d3c991..6538b1a 100644 --- a/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch +++ b/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch @@ -1,7 +1,7 @@ -From 6b2fed2b29f239c1c85e32bd417bacc3fd7155a7 Mon Sep 17 00:00:00 2001 +From c2b3fb6a517dfd6cad3670e8aeb0cce5c2cba342 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 19 Aug 2011 17:58:23 -0700 -Subject: [PATCH 3/8] Make Intermediate Cert Store memory-only. +Subject: [PATCH 3/9] Make Intermediate Cert Store memory-only. This patch makes the intermediate SSL cert store exist in memory only. @@ -12,10 +12,10 @@ https://trac.torproject.org/projects/tor/ticket/2949 1 files changed, 14 insertions(+), 1 deletions(-) diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp -index 11cb2bd..fd717f4 100644 +index c29aaf7..5488f06 100644 --- a/security/manager/ssl/src/nsNSSComponent.cpp +++ b/security/manager/ssl/src/nsNSSComponent.cpp -@@ -1757,8 +1757,21 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox) +@@ -1744,8 +1744,21 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox) // Ubuntu 8.04, which loads any nonexistent "<configdir>/libnssckbi.so" as // "/usr/lib/nss/libnssckbi.so". PRUint32 init_flags = NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE; diff --git a/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch b/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch index 24ab5fd..e0d9ee7 100644 --- a/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch +++ b/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch @@ -1,7 +1,7 @@ -From 273ae174b0db5c37d39bb4aefdf1ce3c14fee3d6 Mon Sep 17 00:00:00 2001 +From e03a22c70c5f68013a72bc4ca2624c6d889c22a4 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 2 Sep 2011 15:33:20 -0700 -Subject: [PATCH 4/8] Add HTTP auth headers before the modify-request observer. +Subject: [PATCH 4/9] Add HTTP auth headers before the modify-request observer. Otherwise, how are we supposed to modify them? @@ -11,10 +11,10 @@ Thanks to Georg Koppen for spotting both the problem and this fix. 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index cd11187..144ecb7 100644 +index 6cc90a9..bf60bb3 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -287,9 +287,6 @@ nsHttpChannel::Connect(PRBool firstTime) +@@ -286,9 +286,6 @@ nsHttpChannel::Connect(PRBool firstTime) return NS_ERROR_DOCUMENT_NOT_CACHED; } @@ -24,7 +24,7 @@ index cd11187..144ecb7 100644 if (mLoadFlags & LOAD_NO_NETWORK_IO) { return NS_ERROR_DOCUMENT_NOT_CACHED; } -@@ -3621,6 +3618,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) +@@ -3624,6 +3621,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) AddCookiesToRequest(); @@ -34,7 +34,7 @@ index cd11187..144ecb7 100644 // notify "http-on-modify-request" observers gHttpHandler->OnModifyRequest(this); -@@ -4693,7 +4693,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) +@@ -4700,7 +4700,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) // this authentication attempt (bug 84794). // TODO: save cookies from auth response and send them here (bug 572151). AddCookiesToRequest(); diff --git a/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch b/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch index 3d5fd54..d1bcc54 100644 --- a/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch +++ b/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch @@ -1,7 +1,7 @@ -From b777a0bc7898314cf13f8ad30a3ed072f4246941 Mon Sep 17 00:00:00 2001 +From bedc5d561ea3b17de6702274ee07f6c130e2cd95 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 2 Sep 2011 20:47:02 -0700 -Subject: [PATCH 5/8] Add a string-based cacheKey. +Subject: [PATCH 5/9] Add a string-based cacheKey. Used for isolating cache according to same-origin policy. --- @@ -29,10 +29,10 @@ index 2da46d6..4ee5774 100644 * may fail if the disk cache is not present. The value of this attribute * is usually only settable during the processing of a channel's diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index 144ecb7..0c8f8ae 100644 +index bf60bb3..b0a5d0d 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -2313,6 +2313,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, +@@ -2316,6 +2316,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, cacheKey.Append(buf); } @@ -45,7 +45,7 @@ index 144ecb7..0c8f8ae 100644 if (!cacheKey.IsEmpty()) { cacheKey.AppendLiteral("uri="); } -@@ -4593,6 +4599,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) +@@ -4600,6 +4606,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) } NS_IMETHODIMP diff --git a/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch b/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch index 76ce04d..f4ca4a4 100644 --- a/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch +++ b/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch @@ -1,25 +1,26 @@ -From f68b858073e7c16236430ee349fb565ac18cf3d4 Mon Sep 17 00:00:00 2001 +From efa29783b4f6fb53b37400e6f5da0ace157a1f08 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> -Date: Sat, 3 Sep 2011 00:10:35 -0700 -Subject: [PATCH 6/8] Randomize HTTP pipeline order and depth. - -Also turn up maximum depth to 12. +Date: Tue, 8 Nov 2011 17:34:54 -0800 +Subject: [PATCH 6/9] Randomize HTTP pipeline order and depth. This is an experimental defense against http://lorre.uni.lu/~andriy/papers/acmccs-wpes11-fingerprinting.pdf + +See also: +https://blog.torproject.org/blog/experimental-defense-website-traffic-fingerprinting --- netwerk/protocol/http/nsHttpConnectionMgr.cpp | 78 ++++++++++++++++++++++++- netwerk/protocol/http/nsHttpConnectionMgr.h | 4 + 2 files changed, 81 insertions(+), 1 deletions(-) diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp -index c754f83..6a522ec 100644 +index 3435d29..fbfee3f 100644 --- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp +++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp -@@ -93,6 +93,11 @@ nsHttpConnectionMgr::nsHttpConnectionMgr() - , mTimeOfNextWakeUp(LL_MAXUINT) +@@ -94,6 +94,11 @@ nsHttpConnectionMgr::nsHttpConnectionMgr() { LOG(("Creating nsHttpConnectionMgr @%x\n", this)); + mCT.Init(); + nsresult rv; + mRandomGenerator = do_GetService("@mozilla.org/security/random-generator;1", &rv); + if (NS_FAILED(rv)) { @@ -28,7 +29,7 @@ index c754f83..6a522ec 100644 } nsHttpConnectionMgr::~nsHttpConnectionMgr() -@@ -822,7 +827,7 @@ nsHttpConnectionMgr::DispatchTransaction(nsConnectionEntry *ent, +@@ -856,7 +861,7 @@ nsHttpConnectionMgr::DispatchTransaction(nsConnectionEntry *ent, nsHttpPipeline *pipeline = nsnull; if (conn->SupportsPipelining() && (caps & NS_HTTP_ALLOW_PIPELINING)) { LOG((" looking to build pipeline...\n")); @@ -37,7 +38,7 @@ index c754f83..6a522ec 100644 trans = pipeline; } -@@ -895,6 +900,77 @@ nsHttpConnectionMgr::BuildPipeline(nsConnectionEntry *ent, +@@ -929,6 +934,77 @@ nsHttpConnectionMgr::BuildPipeline(nsConnectionEntry *ent, return PR_TRUE; } @@ -116,7 +117,7 @@ index c754f83..6a522ec 100644 nsHttpConnectionMgr::ProcessNewTransaction(nsHttpTransaction *trans) { diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.h b/netwerk/protocol/http/nsHttpConnectionMgr.h -index 695cd8f..1806d17 100644 +index d6dba79..c6e295f 100644 --- a/netwerk/protocol/http/nsHttpConnectionMgr.h +++ b/netwerk/protocol/http/nsHttpConnectionMgr.h @@ -48,6 +48,7 @@ @@ -127,15 +128,15 @@ index 695cd8f..1806d17 100644 #include "nsIObserver.h" #include "nsITimer.h" -@@ -270,6 +271,7 @@ private: +@@ -275,6 +276,7 @@ private: nsresult DispatchTransaction(nsConnectionEntry *, nsAHttpTransaction *, PRUint8 caps, nsHttpConnection *); PRBool BuildPipeline(nsConnectionEntry *, nsAHttpTransaction *, nsHttpPipeline **); + PRBool BuildRandomizedPipeline(nsConnectionEntry *, nsAHttpTransaction *, nsHttpPipeline **); nsresult ProcessNewTransaction(nsHttpTransaction *); nsresult EnsureSocketThreadTargetIfOnline(); - nsresult CreateTransport(nsConnectionEntry *, nsHttpTransaction *); -@@ -345,6 +347,8 @@ private: + void ClosePersistentConnections(nsConnectionEntry *ent); +@@ -352,6 +354,8 @@ private: PRUint64 mTimeOfNextWakeUp; // Timer for next pruning of dead connections. nsCOMPtr<nsITimer> mTimer; diff --git a/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch b/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch index eae5f1f..1661c8f 100644 --- a/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch +++ b/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch @@ -1,7 +1,7 @@ -From 32c9fdda43a02e738cbe9c7207795ed92bf835b9 Mon Sep 17 00:00:00 2001 +From 0dec1ab529b55f8380890d1a39148a16f80f02de Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed, 28 Sep 2011 13:24:20 -0700 -Subject: [PATCH 7/8] Block all plugins except flash. +Subject: [PATCH 7/9] Block all plugins except flash. We cannot use the @mozilla.org/extensions/blocklist;1 service, because we actually want to stop plugins from ever entering the browser's process space @@ -17,10 +17,10 @@ on a better way. Until then, it is delta-darwinism for us. 2 files changed, 35 insertions(+), 0 deletions(-) diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp -index 2c2ad7d..eba8c24 100644 +index 7c2c5d1..1e1d983 100644 --- a/dom/plugins/base/nsPluginHost.cpp +++ b/dom/plugins/base/nsPluginHost.cpp -@@ -2014,6 +2014,35 @@ PRBool nsPluginHost::IsDuplicatePlugin(nsPluginTag * aPluginTag) +@@ -1953,6 +1953,35 @@ PRBool nsPluginHost::IsDuplicatePlugin(nsPluginTag * aPluginTag) return PR_FALSE; } @@ -56,7 +56,7 @@ index 2c2ad7d..eba8c24 100644 typedef NS_NPAPIPLUGIN_CALLBACK(char *, NP_GETMIMEDESCRIPTION)(void); nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, -@@ -2135,6 +2164,10 @@ nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, +@@ -2074,6 +2103,10 @@ nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, continue; } @@ -68,10 +68,10 @@ index 2c2ad7d..eba8c24 100644 if (!pluginTag) { nsPluginFile pluginFile(localfile); diff --git a/dom/plugins/base/nsPluginHost.h b/dom/plugins/base/nsPluginHost.h -index cb43042..41dbf63 100644 +index 4a537ba..038851a 100644 --- a/dom/plugins/base/nsPluginHost.h +++ b/dom/plugins/base/nsPluginHost.h -@@ -282,6 +282,8 @@ private: +@@ -276,6 +276,8 @@ private: // Loads all cached plugins info into mCachedPlugins nsresult ReadPluginInfo(); diff --git a/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch b/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch index 3b46894..22adcd5 100644 --- a/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch +++ b/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch @@ -1,7 +1,7 @@ -From cdf48e30d76f7e1c349cdf8597e9cdc94623b8d8 Mon Sep 17 00:00:00 2001 +From d5356d3d6d33ead6c5c7d149fd851a6666c2daac Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu, 8 Sep 2011 08:40:17 -0700 -Subject: [PATCH 8/8] Make content pref service memory-only + clearable +Subject: [PATCH 8/9] Make content pref service memory-only + clearable This prevents random urls from being inserted into content-prefs.sqllite in the profile directory as content prefs change (includes site-zoom and perhaps diff --git a/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch b/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch index 6659770..060c1c9 100644 --- a/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch +++ b/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch @@ -1,7 +1,7 @@ -From 369d7df54fe13dd69a069a43959bdabcc364e6e4 Mon Sep 17 00:00:00 2001 +From 64af9b4632e393451295a69257846537a1307b74 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Sun, 9 Oct 2011 22:50:07 -0700 -Subject: [PATCH] Make Tor Browser exit when not launched from Vidalia +Subject: [PATCH 9/9] Make Tor Browser exit when not launched from Vidalia Turns out the Windows 7 UI encourages users to "dock" their Tor Browser app for easy relaunch. If they manage to do this, we should fail closed rather @@ -16,10 +16,10 @@ actually be common. 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js -index 50f6963..ed2812c 100644 +index 200d457..371d45c 100644 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js -@@ -1203,6 +1203,21 @@ function BrowserStartup() { +@@ -1212,6 +1212,21 @@ function BrowserStartup() { prepareForStartup();

1 0

[torbrowser/maint-2.3] Update patches for FF8.
by erinn＠torproject.org 09 Nov '11

09 Nov '11

commit 2c7dd341b683944b7fb52e86fbc8434555570b41 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Nov 8 17:49:46 2011 -0800 Update patches for FF8. --- ...nents.interfaces-lookupMethod-from-conten.patch | 10 +++--- ...0002-Make-Permissions-Manager-memory-only.patch | 8 +++--- ...-Make-Intermediate-Cert-Store-memory-only.patch | 8 +++--- ...th-headers-before-the-modify-request-obse.patch | 12 ++++---- .../firefox/0005-Add-a-string-based-cacheKey.patch | 10 +++--- ...6-Randomize-HTTP-pipeline-order-and-depth.patch | 29 ++++++++++--------- .../0007-Block-all-plugins-except-flash.patch | 14 +++++----- ...ontent-pref-service-memory-only-clearable.patch | 4 +- ...owser-exit-when-not-launched-from-Vidalia.patch | 8 +++--- 9 files changed, 52 insertions(+), 51 deletions(-) diff --git a/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch b/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch index 70070d2..209f101 100644 --- a/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch +++ b/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch @@ -1,7 +1,7 @@ -From b31cf77e084355158252629efd6bf794212d807a Mon Sep 17 00:00:00 2001 +From 5087e59f2ada4c6fc2cea00f0fc5a529f3d9a2f4 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon, 20 Jun 2011 17:07:41 -0700 -Subject: [PATCH 1/8] Block Components.interfaces,lookupMethod from content +Subject: [PATCH 1/9] Block Components.interfaces,lookupMethod from content This patch removes the ability of content script to access Components.interfaces.* as well as call or access Components.lookupMethod. @@ -20,10 +20,10 @@ https://trac.torproject.org/projects/tor/ticket/2874 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/js/src/xpconnect/src/xpccomponents.cpp b/js/src/xpconnect/src/xpccomponents.cpp -index 664021e..9c8c415 100644 +index c36841c..af55624 100644 --- a/js/src/xpconnect/src/xpccomponents.cpp +++ b/js/src/xpconnect/src/xpccomponents.cpp -@@ -4393,7 +4393,9 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval) +@@ -4394,7 +4394,9 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval) NS_IMETHODIMP nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval) { @@ -34,7 +34,7 @@ index 664021e..9c8c415 100644 *_retval = xpc_CheckAccessList(methodName, allowed); return NS_OK; } -@@ -4402,7 +4404,9 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c +@@ -4403,7 +4405,9 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c NS_IMETHODIMP nsXPCComponents::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval) { diff --git a/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch b/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch index 0429cca..e0948b9 100644 --- a/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch +++ b/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch @@ -1,7 +1,7 @@ -From 9eff68b74bb38d535c1d09246c8c2893f05edd1b Mon Sep 17 00:00:00 2001 +From 21a59f630eb8cbcc5add31fa297e9edcd10d155f Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon, 20 Jun 2011 17:07:56 -0700 -Subject: [PATCH 2/8] Make Permissions Manager memory-only +Subject: [PATCH 2/9] Make Permissions Manager memory-only This patch exposes a pref 'permissions.memory_only' that properly isolates the permissions manager to memory, which is responsible for all user specified @@ -16,7 +16,7 @@ https://trac.torproject.org/projects/tor/ticket/2950 1 files changed, 31 insertions(+), 3 deletions(-) diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp -index 773a973..5387397 100644 +index f852218..4f0f58b 100644 --- a/extensions/cookie/nsPermissionManager.cpp +++ b/extensions/cookie/nsPermissionManager.cpp @@ -58,6 +58,10 @@ @@ -75,7 +75,7 @@ index 773a973..5387397 100644 NS_ENSURE_SUCCESS(rv, rv); mDBConn->GetConnectionReady(&ready); -@@ -805,7 +828,12 @@ NS_IMETHODIMP nsPermissionManager::Observe(nsISupports *aSubject, const char *aT +@@ -803,7 +826,12 @@ NS_IMETHODIMP nsPermissionManager::Observe(nsISupports *aSubject, const char *aT { ENSURE_NOT_CHILD_PROCESS; diff --git a/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch b/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch index 0d3c991..6538b1a 100644 --- a/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch +++ b/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch @@ -1,7 +1,7 @@ -From 6b2fed2b29f239c1c85e32bd417bacc3fd7155a7 Mon Sep 17 00:00:00 2001 +From c2b3fb6a517dfd6cad3670e8aeb0cce5c2cba342 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 19 Aug 2011 17:58:23 -0700 -Subject: [PATCH 3/8] Make Intermediate Cert Store memory-only. +Subject: [PATCH 3/9] Make Intermediate Cert Store memory-only. This patch makes the intermediate SSL cert store exist in memory only. @@ -12,10 +12,10 @@ https://trac.torproject.org/projects/tor/ticket/2949 1 files changed, 14 insertions(+), 1 deletions(-) diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp -index 11cb2bd..fd717f4 100644 +index c29aaf7..5488f06 100644 --- a/security/manager/ssl/src/nsNSSComponent.cpp +++ b/security/manager/ssl/src/nsNSSComponent.cpp -@@ -1757,8 +1757,21 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox) +@@ -1744,8 +1744,21 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox) // Ubuntu 8.04, which loads any nonexistent "<configdir>/libnssckbi.so" as // "/usr/lib/nss/libnssckbi.so". PRUint32 init_flags = NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE; diff --git a/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch b/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch index 24ab5fd..e0d9ee7 100644 --- a/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch +++ b/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch @@ -1,7 +1,7 @@ -From 273ae174b0db5c37d39bb4aefdf1ce3c14fee3d6 Mon Sep 17 00:00:00 2001 +From e03a22c70c5f68013a72bc4ca2624c6d889c22a4 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 2 Sep 2011 15:33:20 -0700 -Subject: [PATCH 4/8] Add HTTP auth headers before the modify-request observer. +Subject: [PATCH 4/9] Add HTTP auth headers before the modify-request observer. Otherwise, how are we supposed to modify them? @@ -11,10 +11,10 @@ Thanks to Georg Koppen for spotting both the problem and this fix. 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index cd11187..144ecb7 100644 +index 6cc90a9..bf60bb3 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -287,9 +287,6 @@ nsHttpChannel::Connect(PRBool firstTime) +@@ -286,9 +286,6 @@ nsHttpChannel::Connect(PRBool firstTime) return NS_ERROR_DOCUMENT_NOT_CACHED; } @@ -24,7 +24,7 @@ index cd11187..144ecb7 100644 if (mLoadFlags & LOAD_NO_NETWORK_IO) { return NS_ERROR_DOCUMENT_NOT_CACHED; } -@@ -3621,6 +3618,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) +@@ -3624,6 +3621,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) AddCookiesToRequest(); @@ -34,7 +34,7 @@ index cd11187..144ecb7 100644 // notify "http-on-modify-request" observers gHttpHandler->OnModifyRequest(this); -@@ -4693,7 +4693,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) +@@ -4700,7 +4700,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) // this authentication attempt (bug 84794). // TODO: save cookies from auth response and send them here (bug 572151). AddCookiesToRequest(); diff --git a/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch b/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch index 3d5fd54..d1bcc54 100644 --- a/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch +++ b/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch @@ -1,7 +1,7 @@ -From b777a0bc7898314cf13f8ad30a3ed072f4246941 Mon Sep 17 00:00:00 2001 +From bedc5d561ea3b17de6702274ee07f6c130e2cd95 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 2 Sep 2011 20:47:02 -0700 -Subject: [PATCH 5/8] Add a string-based cacheKey. +Subject: [PATCH 5/9] Add a string-based cacheKey. Used for isolating cache according to same-origin policy. --- @@ -29,10 +29,10 @@ index 2da46d6..4ee5774 100644 * may fail if the disk cache is not present. The value of this attribute * is usually only settable during the processing of a channel's diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index 144ecb7..0c8f8ae 100644 +index bf60bb3..b0a5d0d 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -2313,6 +2313,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, +@@ -2316,6 +2316,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, cacheKey.Append(buf); } @@ -45,7 +45,7 @@ index 144ecb7..0c8f8ae 100644 if (!cacheKey.IsEmpty()) { cacheKey.AppendLiteral("uri="); } -@@ -4593,6 +4599,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) +@@ -4600,6 +4606,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) } NS_IMETHODIMP diff --git a/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch b/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch index 76ce04d..f4ca4a4 100644 --- a/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch +++ b/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch @@ -1,25 +1,26 @@ -From f68b858073e7c16236430ee349fb565ac18cf3d4 Mon Sep 17 00:00:00 2001 +From efa29783b4f6fb53b37400e6f5da0ace157a1f08 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> -Date: Sat, 3 Sep 2011 00:10:35 -0700 -Subject: [PATCH 6/8] Randomize HTTP pipeline order and depth. - -Also turn up maximum depth to 12. +Date: Tue, 8 Nov 2011 17:34:54 -0800 +Subject: [PATCH 6/9] Randomize HTTP pipeline order and depth. This is an experimental defense against http://lorre.uni.lu/~andriy/papers/acmccs-wpes11-fingerprinting.pdf + +See also: +https://blog.torproject.org/blog/experimental-defense-website-traffic-fingerprinting --- netwerk/protocol/http/nsHttpConnectionMgr.cpp | 78 ++++++++++++++++++++++++- netwerk/protocol/http/nsHttpConnectionMgr.h | 4 + 2 files changed, 81 insertions(+), 1 deletions(-) diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp -index c754f83..6a522ec 100644 +index 3435d29..fbfee3f 100644 --- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp +++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp -@@ -93,6 +93,11 @@ nsHttpConnectionMgr::nsHttpConnectionMgr() - , mTimeOfNextWakeUp(LL_MAXUINT) +@@ -94,6 +94,11 @@ nsHttpConnectionMgr::nsHttpConnectionMgr() { LOG(("Creating nsHttpConnectionMgr @%x\n", this)); + mCT.Init(); + nsresult rv; + mRandomGenerator = do_GetService("@mozilla.org/security/random-generator;1", &rv); + if (NS_FAILED(rv)) { @@ -28,7 +29,7 @@ index c754f83..6a522ec 100644 } nsHttpConnectionMgr::~nsHttpConnectionMgr() -@@ -822,7 +827,7 @@ nsHttpConnectionMgr::DispatchTransaction(nsConnectionEntry *ent, +@@ -856,7 +861,7 @@ nsHttpConnectionMgr::DispatchTransaction(nsConnectionEntry *ent, nsHttpPipeline *pipeline = nsnull; if (conn->SupportsPipelining() && (caps & NS_HTTP_ALLOW_PIPELINING)) { LOG((" looking to build pipeline...\n")); @@ -37,7 +38,7 @@ index c754f83..6a522ec 100644 trans = pipeline; } -@@ -895,6 +900,77 @@ nsHttpConnectionMgr::BuildPipeline(nsConnectionEntry *ent, +@@ -929,6 +934,77 @@ nsHttpConnectionMgr::BuildPipeline(nsConnectionEntry *ent, return PR_TRUE; } @@ -116,7 +117,7 @@ index c754f83..6a522ec 100644 nsHttpConnectionMgr::ProcessNewTransaction(nsHttpTransaction *trans) { diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.h b/netwerk/protocol/http/nsHttpConnectionMgr.h -index 695cd8f..1806d17 100644 +index d6dba79..c6e295f 100644 --- a/netwerk/protocol/http/nsHttpConnectionMgr.h +++ b/netwerk/protocol/http/nsHttpConnectionMgr.h @@ -48,6 +48,7 @@ @@ -127,15 +128,15 @@ index 695cd8f..1806d17 100644 #include "nsIObserver.h" #include "nsITimer.h" -@@ -270,6 +271,7 @@ private: +@@ -275,6 +276,7 @@ private: nsresult DispatchTransaction(nsConnectionEntry *, nsAHttpTransaction *, PRUint8 caps, nsHttpConnection *); PRBool BuildPipeline(nsConnectionEntry *, nsAHttpTransaction *, nsHttpPipeline **); + PRBool BuildRandomizedPipeline(nsConnectionEntry *, nsAHttpTransaction *, nsHttpPipeline **); nsresult ProcessNewTransaction(nsHttpTransaction *); nsresult EnsureSocketThreadTargetIfOnline(); - nsresult CreateTransport(nsConnectionEntry *, nsHttpTransaction *); -@@ -345,6 +347,8 @@ private: + void ClosePersistentConnections(nsConnectionEntry *ent); +@@ -352,6 +354,8 @@ private: PRUint64 mTimeOfNextWakeUp; // Timer for next pruning of dead connections. nsCOMPtr<nsITimer> mTimer; diff --git a/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch b/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch index eae5f1f..1661c8f 100644 --- a/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch +++ b/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch @@ -1,7 +1,7 @@ -From 32c9fdda43a02e738cbe9c7207795ed92bf835b9 Mon Sep 17 00:00:00 2001 +From 0dec1ab529b55f8380890d1a39148a16f80f02de Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed, 28 Sep 2011 13:24:20 -0700 -Subject: [PATCH 7/8] Block all plugins except flash. +Subject: [PATCH 7/9] Block all plugins except flash. We cannot use the @mozilla.org/extensions/blocklist;1 service, because we actually want to stop plugins from ever entering the browser's process space @@ -17,10 +17,10 @@ on a better way. Until then, it is delta-darwinism for us. 2 files changed, 35 insertions(+), 0 deletions(-) diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp -index 2c2ad7d..eba8c24 100644 +index 7c2c5d1..1e1d983 100644 --- a/dom/plugins/base/nsPluginHost.cpp +++ b/dom/plugins/base/nsPluginHost.cpp -@@ -2014,6 +2014,35 @@ PRBool nsPluginHost::IsDuplicatePlugin(nsPluginTag * aPluginTag) +@@ -1953,6 +1953,35 @@ PRBool nsPluginHost::IsDuplicatePlugin(nsPluginTag * aPluginTag) return PR_FALSE; } @@ -56,7 +56,7 @@ index 2c2ad7d..eba8c24 100644 typedef NS_NPAPIPLUGIN_CALLBACK(char *, NP_GETMIMEDESCRIPTION)(void); nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, -@@ -2135,6 +2164,10 @@ nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, +@@ -2074,6 +2103,10 @@ nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, continue; } @@ -68,10 +68,10 @@ index 2c2ad7d..eba8c24 100644 if (!pluginTag) { nsPluginFile pluginFile(localfile); diff --git a/dom/plugins/base/nsPluginHost.h b/dom/plugins/base/nsPluginHost.h -index cb43042..41dbf63 100644 +index 4a537ba..038851a 100644 --- a/dom/plugins/base/nsPluginHost.h +++ b/dom/plugins/base/nsPluginHost.h -@@ -282,6 +282,8 @@ private: +@@ -276,6 +276,8 @@ private: // Loads all cached plugins info into mCachedPlugins nsresult ReadPluginInfo(); diff --git a/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch b/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch index 3b46894..22adcd5 100644 --- a/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch +++ b/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch @@ -1,7 +1,7 @@ -From cdf48e30d76f7e1c349cdf8597e9cdc94623b8d8 Mon Sep 17 00:00:00 2001 +From d5356d3d6d33ead6c5c7d149fd851a6666c2daac Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu, 8 Sep 2011 08:40:17 -0700 -Subject: [PATCH 8/8] Make content pref service memory-only + clearable +Subject: [PATCH 8/9] Make content pref service memory-only + clearable This prevents random urls from being inserted into content-prefs.sqllite in the profile directory as content prefs change (includes site-zoom and perhaps diff --git a/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch b/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch index 6659770..060c1c9 100644 --- a/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch +++ b/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch @@ -1,7 +1,7 @@ -From 369d7df54fe13dd69a069a43959bdabcc364e6e4 Mon Sep 17 00:00:00 2001 +From 64af9b4632e393451295a69257846537a1307b74 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Sun, 9 Oct 2011 22:50:07 -0700 -Subject: [PATCH] Make Tor Browser exit when not launched from Vidalia +Subject: [PATCH 9/9] Make Tor Browser exit when not launched from Vidalia Turns out the Windows 7 UI encourages users to "dock" their Tor Browser app for easy relaunch. If they manage to do this, we should fail closed rather @@ -16,10 +16,10 @@ actually be common. 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js -index 50f6963..ed2812c 100644 +index 200d457..371d45c 100644 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js -@@ -1203,6 +1203,21 @@ function BrowserStartup() { +@@ -1212,6 +1212,21 @@ function BrowserStartup() { prepareForStartup();

1 0

[torbrowser/master] Update patches for FF8.
by erinn＠torproject.org 09 Nov '11

09 Nov '11

commit 2c7dd341b683944b7fb52e86fbc8434555570b41 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Nov 8 17:49:46 2011 -0800 Update patches for FF8. --- ...nents.interfaces-lookupMethod-from-conten.patch | 10 +++--- ...0002-Make-Permissions-Manager-memory-only.patch | 8 +++--- ...-Make-Intermediate-Cert-Store-memory-only.patch | 8 +++--- ...th-headers-before-the-modify-request-obse.patch | 12 ++++---- .../firefox/0005-Add-a-string-based-cacheKey.patch | 10 +++--- ...6-Randomize-HTTP-pipeline-order-and-depth.patch | 29 ++++++++++--------- .../0007-Block-all-plugins-except-flash.patch | 14 +++++----- ...ontent-pref-service-memory-only-clearable.patch | 4 +- ...owser-exit-when-not-launched-from-Vidalia.patch | 8 +++--- 9 files changed, 52 insertions(+), 51 deletions(-) diff --git a/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch b/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch index 70070d2..209f101 100644 --- a/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch +++ b/src/current-patches/firefox/0001-Block-Components.interfaces-lookupMethod-from-conten.patch @@ -1,7 +1,7 @@ -From b31cf77e084355158252629efd6bf794212d807a Mon Sep 17 00:00:00 2001 +From 5087e59f2ada4c6fc2cea00f0fc5a529f3d9a2f4 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon, 20 Jun 2011 17:07:41 -0700 -Subject: [PATCH 1/8] Block Components.interfaces,lookupMethod from content +Subject: [PATCH 1/9] Block Components.interfaces,lookupMethod from content This patch removes the ability of content script to access Components.interfaces.* as well as call or access Components.lookupMethod. @@ -20,10 +20,10 @@ https://trac.torproject.org/projects/tor/ticket/2874 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/js/src/xpconnect/src/xpccomponents.cpp b/js/src/xpconnect/src/xpccomponents.cpp -index 664021e..9c8c415 100644 +index c36841c..af55624 100644 --- a/js/src/xpconnect/src/xpccomponents.cpp +++ b/js/src/xpconnect/src/xpccomponents.cpp -@@ -4393,7 +4393,9 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval) +@@ -4394,7 +4394,9 @@ nsXPCComponents::CanCreateWrapper(const nsIID * iid, char **_retval) NS_IMETHODIMP nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval) { @@ -34,7 +34,7 @@ index 664021e..9c8c415 100644 *_retval = xpc_CheckAccessList(methodName, allowed); return NS_OK; } -@@ -4402,7 +4404,9 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c +@@ -4403,7 +4405,9 @@ nsXPCComponents::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, c NS_IMETHODIMP nsXPCComponents::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval) { diff --git a/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch b/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch index 0429cca..e0948b9 100644 --- a/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch +++ b/src/current-patches/firefox/0002-Make-Permissions-Manager-memory-only.patch @@ -1,7 +1,7 @@ -From 9eff68b74bb38d535c1d09246c8c2893f05edd1b Mon Sep 17 00:00:00 2001 +From 21a59f630eb8cbcc5add31fa297e9edcd10d155f Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon, 20 Jun 2011 17:07:56 -0700 -Subject: [PATCH 2/8] Make Permissions Manager memory-only +Subject: [PATCH 2/9] Make Permissions Manager memory-only This patch exposes a pref 'permissions.memory_only' that properly isolates the permissions manager to memory, which is responsible for all user specified @@ -16,7 +16,7 @@ https://trac.torproject.org/projects/tor/ticket/2950 1 files changed, 31 insertions(+), 3 deletions(-) diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp -index 773a973..5387397 100644 +index f852218..4f0f58b 100644 --- a/extensions/cookie/nsPermissionManager.cpp +++ b/extensions/cookie/nsPermissionManager.cpp @@ -58,6 +58,10 @@ @@ -75,7 +75,7 @@ index 773a973..5387397 100644 NS_ENSURE_SUCCESS(rv, rv); mDBConn->GetConnectionReady(&ready); -@@ -805,7 +828,12 @@ NS_IMETHODIMP nsPermissionManager::Observe(nsISupports *aSubject, const char *aT +@@ -803,7 +826,12 @@ NS_IMETHODIMP nsPermissionManager::Observe(nsISupports *aSubject, const char *aT { ENSURE_NOT_CHILD_PROCESS; diff --git a/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch b/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch index 0d3c991..6538b1a 100644 --- a/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch +++ b/src/current-patches/firefox/0003-Make-Intermediate-Cert-Store-memory-only.patch @@ -1,7 +1,7 @@ -From 6b2fed2b29f239c1c85e32bd417bacc3fd7155a7 Mon Sep 17 00:00:00 2001 +From c2b3fb6a517dfd6cad3670e8aeb0cce5c2cba342 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 19 Aug 2011 17:58:23 -0700 -Subject: [PATCH 3/8] Make Intermediate Cert Store memory-only. +Subject: [PATCH 3/9] Make Intermediate Cert Store memory-only. This patch makes the intermediate SSL cert store exist in memory only. @@ -12,10 +12,10 @@ https://trac.torproject.org/projects/tor/ticket/2949 1 files changed, 14 insertions(+), 1 deletions(-) diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp -index 11cb2bd..fd717f4 100644 +index c29aaf7..5488f06 100644 --- a/security/manager/ssl/src/nsNSSComponent.cpp +++ b/security/manager/ssl/src/nsNSSComponent.cpp -@@ -1757,8 +1757,21 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox) +@@ -1744,8 +1744,21 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox) // Ubuntu 8.04, which loads any nonexistent "<configdir>/libnssckbi.so" as // "/usr/lib/nss/libnssckbi.so". PRUint32 init_flags = NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE; diff --git a/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch b/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch index 24ab5fd..e0d9ee7 100644 --- a/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch +++ b/src/current-patches/firefox/0004-Add-HTTP-auth-headers-before-the-modify-request-obse.patch @@ -1,7 +1,7 @@ -From 273ae174b0db5c37d39bb4aefdf1ce3c14fee3d6 Mon Sep 17 00:00:00 2001 +From e03a22c70c5f68013a72bc4ca2624c6d889c22a4 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 2 Sep 2011 15:33:20 -0700 -Subject: [PATCH 4/8] Add HTTP auth headers before the modify-request observer. +Subject: [PATCH 4/9] Add HTTP auth headers before the modify-request observer. Otherwise, how are we supposed to modify them? @@ -11,10 +11,10 @@ Thanks to Georg Koppen for spotting both the problem and this fix. 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index cd11187..144ecb7 100644 +index 6cc90a9..bf60bb3 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -287,9 +287,6 @@ nsHttpChannel::Connect(PRBool firstTime) +@@ -286,9 +286,6 @@ nsHttpChannel::Connect(PRBool firstTime) return NS_ERROR_DOCUMENT_NOT_CACHED; } @@ -24,7 +24,7 @@ index cd11187..144ecb7 100644 if (mLoadFlags & LOAD_NO_NETWORK_IO) { return NS_ERROR_DOCUMENT_NOT_CACHED; } -@@ -3621,6 +3618,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) +@@ -3624,6 +3621,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) AddCookiesToRequest(); @@ -34,7 +34,7 @@ index cd11187..144ecb7 100644 // notify "http-on-modify-request" observers gHttpHandler->OnModifyRequest(this); -@@ -4693,7 +4693,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) +@@ -4700,7 +4700,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) // this authentication attempt (bug 84794). // TODO: save cookies from auth response and send them here (bug 572151). AddCookiesToRequest(); diff --git a/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch b/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch index 3d5fd54..d1bcc54 100644 --- a/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch +++ b/src/current-patches/firefox/0005-Add-a-string-based-cacheKey.patch @@ -1,7 +1,7 @@ -From b777a0bc7898314cf13f8ad30a3ed072f4246941 Mon Sep 17 00:00:00 2001 +From bedc5d561ea3b17de6702274ee07f6c130e2cd95 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Fri, 2 Sep 2011 20:47:02 -0700 -Subject: [PATCH 5/8] Add a string-based cacheKey. +Subject: [PATCH 5/9] Add a string-based cacheKey. Used for isolating cache according to same-origin policy. --- @@ -29,10 +29,10 @@ index 2da46d6..4ee5774 100644 * may fail if the disk cache is not present. The value of this attribute * is usually only settable during the processing of a channel's diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index 144ecb7..0c8f8ae 100644 +index bf60bb3..b0a5d0d 100644 --- a/netwerk/protocol/http/nsHttpChannel.cpp +++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -2313,6 +2313,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, +@@ -2316,6 +2316,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, cacheKey.Append(buf); } @@ -45,7 +45,7 @@ index 144ecb7..0c8f8ae 100644 if (!cacheKey.IsEmpty()) { cacheKey.AppendLiteral("uri="); } -@@ -4593,6 +4599,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) +@@ -4600,6 +4606,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) } NS_IMETHODIMP diff --git a/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch b/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch index 76ce04d..f4ca4a4 100644 --- a/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch +++ b/src/current-patches/firefox/0006-Randomize-HTTP-pipeline-order-and-depth.patch @@ -1,25 +1,26 @@ -From f68b858073e7c16236430ee349fb565ac18cf3d4 Mon Sep 17 00:00:00 2001 +From efa29783b4f6fb53b37400e6f5da0ace157a1f08 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> -Date: Sat, 3 Sep 2011 00:10:35 -0700 -Subject: [PATCH 6/8] Randomize HTTP pipeline order and depth. - -Also turn up maximum depth to 12. +Date: Tue, 8 Nov 2011 17:34:54 -0800 +Subject: [PATCH 6/9] Randomize HTTP pipeline order and depth. This is an experimental defense against http://lorre.uni.lu/~andriy/papers/acmccs-wpes11-fingerprinting.pdf + +See also: +https://blog.torproject.org/blog/experimental-defense-website-traffic-fingerprinting --- netwerk/protocol/http/nsHttpConnectionMgr.cpp | 78 ++++++++++++++++++++++++- netwerk/protocol/http/nsHttpConnectionMgr.h | 4 + 2 files changed, 81 insertions(+), 1 deletions(-) diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp -index c754f83..6a522ec 100644 +index 3435d29..fbfee3f 100644 --- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp +++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp -@@ -93,6 +93,11 @@ nsHttpConnectionMgr::nsHttpConnectionMgr() - , mTimeOfNextWakeUp(LL_MAXUINT) +@@ -94,6 +94,11 @@ nsHttpConnectionMgr::nsHttpConnectionMgr() { LOG(("Creating nsHttpConnectionMgr @%x\n", this)); + mCT.Init(); + nsresult rv; + mRandomGenerator = do_GetService("@mozilla.org/security/random-generator;1", &rv); + if (NS_FAILED(rv)) { @@ -28,7 +29,7 @@ index c754f83..6a522ec 100644 } nsHttpConnectionMgr::~nsHttpConnectionMgr() -@@ -822,7 +827,7 @@ nsHttpConnectionMgr::DispatchTransaction(nsConnectionEntry *ent, +@@ -856,7 +861,7 @@ nsHttpConnectionMgr::DispatchTransaction(nsConnectionEntry *ent, nsHttpPipeline *pipeline = nsnull; if (conn->SupportsPipelining() && (caps & NS_HTTP_ALLOW_PIPELINING)) { LOG((" looking to build pipeline...\n")); @@ -37,7 +38,7 @@ index c754f83..6a522ec 100644 trans = pipeline; } -@@ -895,6 +900,77 @@ nsHttpConnectionMgr::BuildPipeline(nsConnectionEntry *ent, +@@ -929,6 +934,77 @@ nsHttpConnectionMgr::BuildPipeline(nsConnectionEntry *ent, return PR_TRUE; } @@ -116,7 +117,7 @@ index c754f83..6a522ec 100644 nsHttpConnectionMgr::ProcessNewTransaction(nsHttpTransaction *trans) { diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.h b/netwerk/protocol/http/nsHttpConnectionMgr.h -index 695cd8f..1806d17 100644 +index d6dba79..c6e295f 100644 --- a/netwerk/protocol/http/nsHttpConnectionMgr.h +++ b/netwerk/protocol/http/nsHttpConnectionMgr.h @@ -48,6 +48,7 @@ @@ -127,15 +128,15 @@ index 695cd8f..1806d17 100644 #include "nsIObserver.h" #include "nsITimer.h" -@@ -270,6 +271,7 @@ private: +@@ -275,6 +276,7 @@ private: nsresult DispatchTransaction(nsConnectionEntry *, nsAHttpTransaction *, PRUint8 caps, nsHttpConnection *); PRBool BuildPipeline(nsConnectionEntry *, nsAHttpTransaction *, nsHttpPipeline **); + PRBool BuildRandomizedPipeline(nsConnectionEntry *, nsAHttpTransaction *, nsHttpPipeline **); nsresult ProcessNewTransaction(nsHttpTransaction *); nsresult EnsureSocketThreadTargetIfOnline(); - nsresult CreateTransport(nsConnectionEntry *, nsHttpTransaction *); -@@ -345,6 +347,8 @@ private: + void ClosePersistentConnections(nsConnectionEntry *ent); +@@ -352,6 +354,8 @@ private: PRUint64 mTimeOfNextWakeUp; // Timer for next pruning of dead connections. nsCOMPtr<nsITimer> mTimer; diff --git a/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch b/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch index eae5f1f..1661c8f 100644 --- a/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch +++ b/src/current-patches/firefox/0007-Block-all-plugins-except-flash.patch @@ -1,7 +1,7 @@ -From 32c9fdda43a02e738cbe9c7207795ed92bf835b9 Mon Sep 17 00:00:00 2001 +From 0dec1ab529b55f8380890d1a39148a16f80f02de Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed, 28 Sep 2011 13:24:20 -0700 -Subject: [PATCH 7/8] Block all plugins except flash. +Subject: [PATCH 7/9] Block all plugins except flash. We cannot use the @mozilla.org/extensions/blocklist;1 service, because we actually want to stop plugins from ever entering the browser's process space @@ -17,10 +17,10 @@ on a better way. Until then, it is delta-darwinism for us. 2 files changed, 35 insertions(+), 0 deletions(-) diff --git a/dom/plugins/base/nsPluginHost.cpp b/dom/plugins/base/nsPluginHost.cpp -index 2c2ad7d..eba8c24 100644 +index 7c2c5d1..1e1d983 100644 --- a/dom/plugins/base/nsPluginHost.cpp +++ b/dom/plugins/base/nsPluginHost.cpp -@@ -2014,6 +2014,35 @@ PRBool nsPluginHost::IsDuplicatePlugin(nsPluginTag * aPluginTag) +@@ -1953,6 +1953,35 @@ PRBool nsPluginHost::IsDuplicatePlugin(nsPluginTag * aPluginTag) return PR_FALSE; } @@ -56,7 +56,7 @@ index 2c2ad7d..eba8c24 100644 typedef NS_NPAPIPLUGIN_CALLBACK(char *, NP_GETMIMEDESCRIPTION)(void); nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, -@@ -2135,6 +2164,10 @@ nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, +@@ -2074,6 +2103,10 @@ nsresult nsPluginHost::ScanPluginsDirectory(nsIFile *pluginsDir, continue; } @@ -68,10 +68,10 @@ index 2c2ad7d..eba8c24 100644 if (!pluginTag) { nsPluginFile pluginFile(localfile); diff --git a/dom/plugins/base/nsPluginHost.h b/dom/plugins/base/nsPluginHost.h -index cb43042..41dbf63 100644 +index 4a537ba..038851a 100644 --- a/dom/plugins/base/nsPluginHost.h +++ b/dom/plugins/base/nsPluginHost.h -@@ -282,6 +282,8 @@ private: +@@ -276,6 +276,8 @@ private: // Loads all cached plugins info into mCachedPlugins nsresult ReadPluginInfo(); diff --git a/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch b/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch index 3b46894..22adcd5 100644 --- a/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch +++ b/src/current-patches/firefox/0008-Make-content-pref-service-memory-only-clearable.patch @@ -1,7 +1,7 @@ -From cdf48e30d76f7e1c349cdf8597e9cdc94623b8d8 Mon Sep 17 00:00:00 2001 +From d5356d3d6d33ead6c5c7d149fd851a6666c2daac Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu, 8 Sep 2011 08:40:17 -0700 -Subject: [PATCH 8/8] Make content pref service memory-only + clearable +Subject: [PATCH 8/9] Make content pref service memory-only + clearable This prevents random urls from being inserted into content-prefs.sqllite in the profile directory as content prefs change (includes site-zoom and perhaps diff --git a/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch b/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch index 6659770..060c1c9 100644 --- a/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch +++ b/src/current-patches/firefox/0009-Make-Tor-Browser-exit-when-not-launched-from-Vidalia.patch @@ -1,7 +1,7 @@ -From 369d7df54fe13dd69a069a43959bdabcc364e6e4 Mon Sep 17 00:00:00 2001 +From 64af9b4632e393451295a69257846537a1307b74 Mon Sep 17 00:00:00 2001 From: Mike Perry <mikeperry-git(a)fscked.org> Date: Sun, 9 Oct 2011 22:50:07 -0700 -Subject: [PATCH] Make Tor Browser exit when not launched from Vidalia +Subject: [PATCH 9/9] Make Tor Browser exit when not launched from Vidalia Turns out the Windows 7 UI encourages users to "dock" their Tor Browser app for easy relaunch. If they manage to do this, we should fail closed rather @@ -16,10 +16,10 @@ actually be common. 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js -index 50f6963..ed2812c 100644 +index 200d457..371d45c 100644 --- a/browser/base/content/browser.js +++ b/browser/base/content/browser.js -@@ -1203,6 +1203,21 @@ function BrowserStartup() { +@@ -1212,6 +1212,21 @@ function BrowserStartup() { prepareForStartup();

1 0

[torspec/master] Document GETINFO items added for #3832
by nickm＠torproject.org 08 Nov '11

08 Nov '11

commit dc73a42c5a2e454b4d28368d001d7a4af4ca9c33 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Nov 8 10:58:12 2011 -0800 Document GETINFO items added for #3832 --- control-spec.txt | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index e745a1f..fd38ac7 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -458,6 +458,10 @@ "desc/id/<OR identity>" or "desc/name/<OR nickname>" -- the latest server descriptor for a given OR, NUL-terminated. + "md/id/<OR identity>" or "md/name/<OR nickname>" -- the latest + microdescriptor for a given OR. [First implemented in + 0.2.3.8-alpha.] + "desc-annotations/id/<OR identity>" -- outputs the annotations string (source, timestamp of arrival, purpose, etc) for the corresponding descriptor. [First implemented in 0.2.0.13-alpha.]

1 0