December 2011 - tor-commits - lists.torproject.org

[doctor/master] Don't attempt to sort Tor versions alphanumerically.
by karsten＠torproject.org 15 Dec '11

15 Dec '11

commit e61c16fbd282049b619040fe160cae996d372fd8 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu Dec 15 09:29:09 2011 +0100 Don't attempt to sort Tor versions alphanumerically. Spotted by Sebastian. --- .../torproject/doctor/MetricsWebsiteReport.java | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/org/torproject/doctor/MetricsWebsiteReport.java b/src/org/torproject/doctor/MetricsWebsiteReport.java index 9644c65..07f6805 100644 --- a/src/org/torproject/doctor/MetricsWebsiteReport.java +++ b/src/org/torproject/doctor/MetricsWebsiteReport.java @@ -325,7 +325,7 @@ public class MetricsWebsiteReport { this.bw.write(" <tr><td>(No votes.)</td><td></td></tr>\n"); } else { for (RelayNetworkStatusVote vote : this.downloadedVotes.values()) { - SortedSet<String> voteRecommendedClientVersions = + List<String> voteRecommendedClientVersions = vote.getRecommendedClientVersions(); if (voteRecommendedClientVersions != null) { if (downloadedConsensus.getRecommendedClientVersions().equals( @@ -353,7 +353,7 @@ public class MetricsWebsiteReport { + " </tr>\n"); } } - SortedSet<String> voteRecommendedServerVersions = + List<String> voteRecommendedServerVersions = vote.getRecommendedServerVersions(); if (voteRecommendedServerVersions != null) { if (downloadedConsensus.getRecommendedServerVersions().equals(

1 0

[doctor/master] Use a few updated method signatures in metrics-lib.
by karsten＠torproject.org 15 Dec '11

15 Dec '11

commit 4b9161d3797229b4951cf82ff9547bb1f907b96d Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu Dec 15 09:17:13 2011 +0100 Use a few updated method signatures in metrics-lib. --- src/org/torproject/doctor/Checker.java | 8 ++++---- .../torproject/doctor/MetricsWebsiteReport.java | 14 +++++++------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/org/torproject/doctor/Checker.java b/src/org/torproject/doctor/Checker.java index c78ebf6..ab7e92d 100644 --- a/src/org/torproject/doctor/Checker.java +++ b/src/org/torproject/doctor/Checker.java @@ -257,11 +257,11 @@ public class Checker { split(","))); SortedSet<String> conflicts = new TreeSet<String>(); for (RelayNetworkStatusVote vote : this.downloadedVotes) { - Map<String, String> voteConsensusParams = + Map<String, Integer> voteConsensusParams = vote.getConsensusParams(); boolean conflictOrInvalid = false; if (voteConsensusParams != null) { - for (Map.Entry<String, String> e : + for (Map.Entry<String, Integer> e : voteConsensusParams.entrySet()) { if (!downloadedConsensus.getConsensusParams().containsKey( e.getKey()) || @@ -271,7 +271,7 @@ public class Checker { !e.getKey().startsWith("bwauth"))) { StringBuilder message = new StringBuilder(); message.append(vote.getNickname()); - for (Map.Entry<String, String> p : + for (Map.Entry<String, Integer> p : voteConsensusParams.entrySet()) { message.append(" " + p.getKey() + "=" + p.getValue()); } @@ -344,7 +344,7 @@ public class Checker { for (RelayNetworkStatusVote vote : this.downloadedVotes) { boolean containsMeasuredBandwidths = false; for (NetworkStatusEntry entry : vote.getStatusEntries().values()) { - if (entry.getBandwidth().contains("Measured=")) { + if (entry.getMeasured() >= 0) { containsMeasuredBandwidths = true; break; } diff --git a/src/org/torproject/doctor/MetricsWebsiteReport.java b/src/org/torproject/doctor/MetricsWebsiteReport.java index ac60ae7..9644c65 100644 --- a/src/org/torproject/doctor/MetricsWebsiteReport.java +++ b/src/org/torproject/doctor/MetricsWebsiteReport.java @@ -426,14 +426,14 @@ public class MetricsWebsiteReport { + "cbtdisabled,cbtnummodes,cbtrecentcount,cbtmaxtimeouts," + "cbtmincircs,cbtquantile,cbtclosequantile,cbttestfreq," + "cbtmintimeout,cbtinitialtimeout").split(","))); - Map<String, String> consensusConsensusParams = + Map<String, Integer> consensusConsensusParams = downloadedConsensus.getConsensusParams(); for (RelayNetworkStatusVote vote : this.downloadedVotes.values()) { - Map<String, String> voteConsensusParams = + Map<String, Integer> voteConsensusParams = vote.getConsensusParams(); boolean conflictOrInvalid = false; if (voteConsensusParams != null) { - for (Map.Entry<String, String> e : + for (Map.Entry<String, Integer> e : voteConsensusParams.entrySet()) { if (!consensusConsensusParams.containsKey(e.getKey()) || !consensusConsensusParams.get(e.getKey()).equals( @@ -450,7 +450,7 @@ public class MetricsWebsiteReport { + " <td>" + vote.getNickname() + "</td>\n" + " <td>params"); - for (Map.Entry<String, String> e : + for (Map.Entry<String, Integer> e : voteConsensusParams.entrySet()) { this.bw.write(" " + e.getKey() + "=" + e.getValue()); } @@ -460,7 +460,7 @@ public class MetricsWebsiteReport { this.bw.write(" <tr>\n" + " <td>" + vote.getNickname() + "</td>\n" + " <td>params"); - for (Map.Entry<String, String> e : + for (Map.Entry<String, Integer> e : voteConsensusParams.entrySet()) { this.bw.write(" " + e.getKey() + "=" + e.getValue()); } @@ -473,7 +473,7 @@ public class MetricsWebsiteReport { + " <td>consensus" + "</td>\n" + " <td>params"); - for (Map.Entry<String, String> e : + for (Map.Entry<String, Integer> e : this.downloadedConsensus.getConsensusParams().entrySet()) { this.bw.write(" " + e.getKey() + "=" + e.getValue()); } @@ -546,7 +546,7 @@ public class MetricsWebsiteReport { for (RelayNetworkStatusVote vote : this.downloadedVotes.values()) { int bandwidthWeights = 0; for (NetworkStatusEntry entry : vote.getStatusEntries().values()) { - if (entry.getBandwidth().contains("Measured=")) { + if (entry.getMeasured() >= 0L) { bandwidthWeights++; } }

1 0

[metrics-lib/master] Make the vote and consensus interfaces more similar.
by karsten＠torproject.org 15 Dec '11

15 Dec '11

commit cb3934aa8c76bf4229572e366647c002d0aa161f Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu Dec 15 09:18:57 2011 +0100 Make the vote and consensus interfaces more similar. --- .../descriptor/RelayNetworkStatusVote.java | 2 +- .../impl/RelayNetworkStatusVoteImpl.java | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/org/torproject/descriptor/RelayNetworkStatusVote.java b/src/org/torproject/descriptor/RelayNetworkStatusVote.java index f591c10..9ff47ec 100644 --- a/src/org/torproject/descriptor/RelayNetworkStatusVote.java +++ b/src/org/torproject/descriptor/RelayNetworkStatusVote.java @@ -42,7 +42,7 @@ public interface RelayNetworkStatusVote extends Descriptor { public SortedSet<String> getKnownFlags(); /* Return consensus parameters. */ - public SortedMap<String, String> getConsensusParams(); + public SortedMap<String, Integer> getConsensusParams(); /* Return the directory nickname. */ public String getNickname(); diff --git a/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java b/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java index 238a512..c4d3226 100644 --- a/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java +++ b/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java @@ -115,7 +115,7 @@ public class RelayNetworkStatusVoteImpl for (String param : line.substring("params ".length()).split(" ")) { String paramName = param.split("=")[0]; - String paramValue = param.split("=")[1]; + int paramValue = Integer.parseInt(param.split("=")[1]); this.consensusParams.put(paramName, paramValue); } } @@ -255,10 +255,10 @@ public class RelayNetworkStatusVoteImpl return new TreeSet<String>(this.knownFlags); } - private SortedMap<String, String> consensusParams = - new TreeMap<String, String>(); - public SortedMap<String, String> getConsensusParams() { - return new TreeMap<String, String>(this.consensusParams); + private SortedMap<String, Integer> consensusParams = + new TreeMap<String, Integer>(); + public SortedMap<String, Integer> getConsensusParams() { + return new TreeMap<String, Integer>(this.consensusParams); } private String nickname;

1 0

[metrics-lib/master] Don't attempt to sort Tor versions alphanumerically.
by karsten＠torproject.org 15 Dec '11

15 Dec '11

commit 0c889f51401d9f324fc5ca4e385f6a6e65992349 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu Dec 15 09:29:42 2011 +0100 Don't attempt to sort Tor versions alphanumerically. Spotted by Sebastian. --- .../descriptor/RelayNetworkStatusConsensus.java | 4 ++-- .../descriptor/RelayNetworkStatusVote.java | 4 ++-- .../impl/RelayNetworkStatusConsensusImpl.java | 16 ++++++++-------- .../impl/RelayNetworkStatusVoteImpl.java | 20 ++++++++++---------- 4 files changed, 22 insertions(+), 22 deletions(-) diff --git a/src/org/torproject/descriptor/RelayNetworkStatusConsensus.java b/src/org/torproject/descriptor/RelayNetworkStatusConsensus.java index 42757ce..08ec8e4 100644 --- a/src/org/torproject/descriptor/RelayNetworkStatusConsensus.java +++ b/src/org/torproject/descriptor/RelayNetworkStatusConsensus.java @@ -32,11 +32,11 @@ public interface RelayNetworkStatusConsensus extends Descriptor { /* Return recommended server versions or null if the consensus doesn't * contain recommended server versions. */ - public SortedSet<String> getRecommendedServerVersions(); + public List<String> getRecommendedServerVersions(); /* Return recommended client versions or null if the consensus doesn't * contain recommended client versions. */ - public SortedSet<String> getRecommendedClientVersions(); + public List<String> getRecommendedClientVersions(); /* Return known relay flags. */ public SortedSet<String> getKnownFlags(); diff --git a/src/org/torproject/descriptor/RelayNetworkStatusVote.java b/src/org/torproject/descriptor/RelayNetworkStatusVote.java index 9ff47ec..6bfdd6f 100644 --- a/src/org/torproject/descriptor/RelayNetworkStatusVote.java +++ b/src/org/torproject/descriptor/RelayNetworkStatusVote.java @@ -32,11 +32,11 @@ public interface RelayNetworkStatusVote extends Descriptor { /* Return recommended server versions or null if the authority doesn't * recommend server versions. */ - public SortedSet<String> getRecommendedServerVersions(); + public List<String> getRecommendedServerVersions(); /* Return recommended client versions or null if the authority doesn't * recommend server versions. */ - public SortedSet<String> getRecommendedClientVersions(); + public List<String> getRecommendedClientVersions(); /* Return known relay flags. */ public SortedSet<String> getKnownFlags(); diff --git a/src/org/torproject/descriptor/impl/RelayNetworkStatusConsensusImpl.java b/src/org/torproject/descriptor/impl/RelayNetworkStatusConsensusImpl.java index 0771382..6721f4d 100644 --- a/src/org/torproject/descriptor/impl/RelayNetworkStatusConsensusImpl.java +++ b/src/org/torproject/descriptor/impl/RelayNetworkStatusConsensusImpl.java @@ -284,9 +284,9 @@ public class RelayNetworkStatusConsensusImpl line, parts); } - private SortedSet<String> parseClientOrServerVersions(String line, + private List<String> parseClientOrServerVersions(String line, String[] parts) throws DescriptorParseException { - SortedSet<String> result = new TreeSet<String>(); + List<String> result = new ArrayList<String>(); if (parts.length == 1) { return result; } else if (parts.length > 2) { @@ -397,16 +397,16 @@ public class RelayNetworkStatusConsensusImpl return this.distSeconds; } - private SortedSet<String> recommendedClientVersions; - public SortedSet<String> getRecommendedClientVersions() { + private List<String> recommendedClientVersions; + public List<String> getRecommendedClientVersions() { return this.recommendedClientVersions == null ? null : - new TreeSet<String>(this.recommendedClientVersions); + new ArrayList<String>(this.recommendedClientVersions); } - private SortedSet<String> recommendedServerVersions; - public SortedSet<String> getRecommendedServerVersions() { + private List<String> recommendedServerVersions; + public List<String> getRecommendedServerVersions() { return this.recommendedServerVersions == null ? null : - new TreeSet<String>(this.recommendedServerVersions); + new ArrayList<String>(this.recommendedServerVersions); } private SortedSet<String> knownFlags = new TreeSet<String>(); diff --git a/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java b/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java index c4d3226..a7a5328 100644 --- a/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java +++ b/src/org/torproject/descriptor/impl/RelayNetworkStatusVoteImpl.java @@ -100,11 +100,11 @@ public class RelayNetworkStatusVoteImpl this.votingDelay.add(Long.parseLong(votingDelayString)); } } else if (line.startsWith("client-versions ")) { - this.recommendedClientVersions = new TreeSet<String>( - Arrays.asList(line.split(" ")[1].split(","))); + this.recommendedClientVersions = + Arrays.asList(line.split(" ")[1].split(",")); } else if (line.startsWith("server-versions ")) { - this.recommendedServerVersions = new TreeSet<String>( - Arrays.asList(line.split(" ")[1].split(","))); + this.recommendedServerVersions = + Arrays.asList(line.split(" ")[1].split(",")); } else if (line.startsWith("known-flags ")) { for (String flag : line.substring("known-flags ".length()). split(" ")) { @@ -238,16 +238,16 @@ public class RelayNetworkStatusVoteImpl return new ArrayList<Long>(this.votingDelay); } - private SortedSet<String> recommendedClientVersions; - public SortedSet<String> getRecommendedClientVersions() { + private List<String> recommendedClientVersions; + public List<String> getRecommendedClientVersions() { return this.recommendedClientVersions == null ? null : - new TreeSet<String>(this.recommendedClientVersions); + new ArrayList<String>(this.recommendedClientVersions); } - private SortedSet<String> recommendedServerVersions; - public SortedSet<String> getRecommendedServerVersions() { + private List<String> recommendedServerVersions; + public List<String> getRecommendedServerVersions() { return this.recommendedServerVersions == null ? null : - new TreeSet<String>(this.recommendedServerVersions); + new ArrayList<String>(this.recommendedServerVersions); } private SortedSet<String> knownFlags = new TreeSet<String>();

1 0

r25257: {website} Update torbutton versions. (in website/trunk: include torbutton)
by Mike Perry 15 Dec '11

15 Dec '11

Author: mikeperry Date: 2011-12-15 07:17:09 +0000 (Thu, 15 Dec 2011) New Revision: 25257 Modified: website/trunk/include/versions.wmi website/trunk/torbutton/update.rdf Log: Update torbutton versions. Modified: website/trunk/include/versions.wmi =================================================================== --- website/trunk/include/versions.wmi 2011-12-15 03:23:34 UTC (rev 25256) +++ website/trunk/include/versions.wmi 2011-12-15 07:17:09 UTC (rev 25257) @@ -102,8 +102,8 @@ <define-tag file-source-alpha whitespace=delete>tor-<version-alpha>.tar.gz</define-tag> <define-tag package-source-alpha whitespace=delete>../dist/<file-source-alpha></define-tag> -<define-tag version-torbutton whitespace=delete>1.4.4.1 (11 Oct 2011)</define-tag> -<define-tag version-hash-torbutton whitespace=delete>sha1:95dc1e079da873aae9ca1beb7354fb8fdeaa7414</define-tag> +<define-tag version-torbutton whitespace=delete>1.4.5 (14 Oct 2011)</define-tag> +<define-tag version-hash-torbutton whitespace=delete>sha1:5f2e2d72343b2d4702ec24491a11babedd3650b9</define-tag> <define-tag version-torbutton-alpha whitespace=delete>None</define-tag> <define-tag version-hash-torbutton-alpha whitespace=delete>sha1:c7323cd408ebee28ee23b6a91fe056d59de668f5</define-tag> Modified: website/trunk/torbutton/update.rdf =================================================================== (Binary files differ)

1 0

[torbrowser/maint-2.2] Bug 4669: Enable TLS false start.
by erinn＠torproject.org 15 Dec '11

15 Dec '11

commit 34f7257ca3f4b1239cf8fccb314f57ddc9cf25f3 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Dec 8 17:02:03 2011 -0800 Bug 4669: Enable TLS false start. --- build-scripts/config/no-polipo.js | 1 + build-scripts/config/windows-4.0.js | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/build-scripts/config/no-polipo.js b/build-scripts/config/no-polipo.js index b8d7d17..1abd77d 100644 --- a/build-scripts/config/no-polipo.js +++ b/build-scripts/config/no-polipo.js @@ -175,3 +175,4 @@ user_pref("noscript.version", "2.0.7"); user_pref("plugin.disable_full_page_plugin_for_types", "application/asx,video/x-ms-asf-plugin,application/x-mplayer2,video/x-ms-asf,video/x-ms-wm,audio/x-ms-wma,audio/x-ms-wax,video/x-ms-wmv,video/x-ms-wvx,application/x-drm-v2,application/x-drm"); user_pref("plugin.expose_full_path", true); user_pref("plugin.scan.4xPluginFolder", false); +user_pref("security.ssl.enable_false_start", true); diff --git a/build-scripts/config/windows-4.0.js b/build-scripts/config/windows-4.0.js index 3d7b9a6..c06f9e9 100644 --- a/build-scripts/config/windows-4.0.js +++ b/build-scripts/config/windows-4.0.js @@ -178,3 +178,4 @@ user_pref("urlclassifier.tableversion.goog-white-domain", "1.481"); user_pref("urlclassifier.tableversion.goog-white-url", "1.371"); user_pref("xpinstall.whitelist.add", ""); user_pref("xpinstall.whitelist.add.36", ""); +user_pref("security.ssl.enable_false_start", true);

1 0

[torbrowser/maint-2.2] New patches for bugs 4099 and 4667.
by erinn＠torproject.org 15 Dec '11

15 Dec '11

commit 5424e9d5bd7dd8cb2f4577dff3a90d931ec50354 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Dec 8 17:02:35 2011 -0800 New patches for bugs 4099 and 4667. Session ID-removal and keep-alive connection closing patches. --- .../0010-Disable-SSL-Session-ID-tracking.patch | 28 ++++++++++++++ ...observer-event-to-close-persistent-connec.patch | 39 ++++++++++++++++++++ 2 files changed, 67 insertions(+), 0 deletions(-) diff --git a/src/current-patches/firefox/0010-Disable-SSL-Session-ID-tracking.patch b/src/current-patches/firefox/0010-Disable-SSL-Session-ID-tracking.patch new file mode 100644 index 0000000..b74a5c1 --- /dev/null +++ b/src/current-patches/firefox/0010-Disable-SSL-Session-ID-tracking.patch @@ -0,0 +1,28 @@ +From 6ec4ac9d2cafa8b400611a07d62c6279b3568204 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)fscked.org> +Date: Wed, 7 Dec 2011 19:36:38 -0800 +Subject: [PATCH 10/11] Disable SSL Session ID tracking. + +We can't easily bind SSL Session ID tracking to url bar domain, +so we have to disable them to satisfy +https://www.torproject.org/projects/torbrowser/design/#identifier-linkability. +--- + security/nss/lib/ssl/sslsock.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c +index 568b500..35540a8 100644 +--- a/security/nss/lib/ssl/sslsock.c ++++ b/security/nss/lib/ssl/sslsock.c +@@ -172,7 +172,7 @@ static sslOptions ssl_defaults = { + PR_TRUE, /* enableSSL2 */ + PR_TRUE, /* enableSSL3 */ + PR_TRUE, /* enableTLS */ /* now defaults to on in NSS 3.0 */ +- PR_FALSE, /* noCache */ ++ PR_TRUE, /* noCache */ + PR_FALSE, /* fdx */ + PR_TRUE, /* v2CompatibleHello */ + PR_TRUE, /* detectRollBack */ +-- +1.7.3.4 + diff --git a/src/current-patches/firefox/0011-Provide-an-observer-event-to-close-persistent-connec.patch b/src/current-patches/firefox/0011-Provide-an-observer-event-to-close-persistent-connec.patch new file mode 100644 index 0000000..d2cdfa3 --- /dev/null +++ b/src/current-patches/firefox/0011-Provide-an-observer-event-to-close-persistent-connec.patch @@ -0,0 +1,39 @@ +From 7f6e76f1cbab26bcd6dead6427a9a19460877434 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)fscked.org> +Date: Wed, 7 Dec 2011 20:05:19 -0800 +Subject: [PATCH 11/11] Provide an observer event to close persistent connections + +We need to prevent linkability across "New Identity", which includes closing +keep-alive connections. +--- + netwerk/protocol/http/nsHttpHandler.cpp | 7 +++++++ + 1 files changed, 7 insertions(+), 0 deletions(-) + +diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp +index f79f23e..ed70ecd 100644 +--- a/netwerk/protocol/http/nsHttpHandler.cpp ++++ b/netwerk/protocol/http/nsHttpHandler.cpp +@@ -321,6 +321,7 @@ nsHttpHandler::Init() + mObserverService->AddObserver(this, "net:clear-active-logins", PR_TRUE); + mObserverService->AddObserver(this, NS_PRIVATE_BROWSING_SWITCH_TOPIC, PR_TRUE); + mObserverService->AddObserver(this, "net:prune-dead-connections", PR_TRUE); ++ mObserverService->AddObserver(this, "net:prune-all-connections", PR_TRUE); + } + + return NS_OK; +@@ -1611,6 +1612,12 @@ nsHttpHandler::Observe(nsISupports *subject, + mConnMgr->PruneDeadConnections(); + } + } ++ else if (strcmp(topic, "net:prune-all-connections") == 0) { ++ if (mConnMgr) { ++ mConnMgr->ClosePersistentConnections(); ++ mConnMgr->PruneDeadConnections(); ++ } ++ } + + return NS_OK; + } +-- +1.7.3.4 +

1 0

[torbrowser/maint-2.3] Bug 4669: Enable TLS false start.
by erinn＠torproject.org 15 Dec '11

15 Dec '11

commit 34f7257ca3f4b1239cf8fccb314f57ddc9cf25f3 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Dec 8 17:02:03 2011 -0800 Bug 4669: Enable TLS false start. --- build-scripts/config/no-polipo.js | 1 + build-scripts/config/windows-4.0.js | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/build-scripts/config/no-polipo.js b/build-scripts/config/no-polipo.js index b8d7d17..1abd77d 100644 --- a/build-scripts/config/no-polipo.js +++ b/build-scripts/config/no-polipo.js @@ -175,3 +175,4 @@ user_pref("noscript.version", "2.0.7"); user_pref("plugin.disable_full_page_plugin_for_types", "application/asx,video/x-ms-asf-plugin,application/x-mplayer2,video/x-ms-asf,video/x-ms-wm,audio/x-ms-wma,audio/x-ms-wax,video/x-ms-wmv,video/x-ms-wvx,application/x-drm-v2,application/x-drm"); user_pref("plugin.expose_full_path", true); user_pref("plugin.scan.4xPluginFolder", false); +user_pref("security.ssl.enable_false_start", true); diff --git a/build-scripts/config/windows-4.0.js b/build-scripts/config/windows-4.0.js index 3d7b9a6..c06f9e9 100644 --- a/build-scripts/config/windows-4.0.js +++ b/build-scripts/config/windows-4.0.js @@ -178,3 +178,4 @@ user_pref("urlclassifier.tableversion.goog-white-domain", "1.481"); user_pref("urlclassifier.tableversion.goog-white-url", "1.371"); user_pref("xpinstall.whitelist.add", ""); user_pref("xpinstall.whitelist.add.36", ""); +user_pref("security.ssl.enable_false_start", true);

1 0

[torbrowser/maint-2.3] New patches for bugs 4099 and 4667.
by erinn＠torproject.org 15 Dec '11

15 Dec '11

commit 5424e9d5bd7dd8cb2f4577dff3a90d931ec50354 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Dec 8 17:02:35 2011 -0800 New patches for bugs 4099 and 4667. Session ID-removal and keep-alive connection closing patches. --- .../0010-Disable-SSL-Session-ID-tracking.patch | 28 ++++++++++++++ ...observer-event-to-close-persistent-connec.patch | 39 ++++++++++++++++++++ 2 files changed, 67 insertions(+), 0 deletions(-) diff --git a/src/current-patches/firefox/0010-Disable-SSL-Session-ID-tracking.patch b/src/current-patches/firefox/0010-Disable-SSL-Session-ID-tracking.patch new file mode 100644 index 0000000..b74a5c1 --- /dev/null +++ b/src/current-patches/firefox/0010-Disable-SSL-Session-ID-tracking.patch @@ -0,0 +1,28 @@ +From 6ec4ac9d2cafa8b400611a07d62c6279b3568204 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)fscked.org> +Date: Wed, 7 Dec 2011 19:36:38 -0800 +Subject: [PATCH 10/11] Disable SSL Session ID tracking. + +We can't easily bind SSL Session ID tracking to url bar domain, +so we have to disable them to satisfy +https://www.torproject.org/projects/torbrowser/design/#identifier-linkability. +--- + security/nss/lib/ssl/sslsock.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c +index 568b500..35540a8 100644 +--- a/security/nss/lib/ssl/sslsock.c ++++ b/security/nss/lib/ssl/sslsock.c +@@ -172,7 +172,7 @@ static sslOptions ssl_defaults = { + PR_TRUE, /* enableSSL2 */ + PR_TRUE, /* enableSSL3 */ + PR_TRUE, /* enableTLS */ /* now defaults to on in NSS 3.0 */ +- PR_FALSE, /* noCache */ ++ PR_TRUE, /* noCache */ + PR_FALSE, /* fdx */ + PR_TRUE, /* v2CompatibleHello */ + PR_TRUE, /* detectRollBack */ +-- +1.7.3.4 + diff --git a/src/current-patches/firefox/0011-Provide-an-observer-event-to-close-persistent-connec.patch b/src/current-patches/firefox/0011-Provide-an-observer-event-to-close-persistent-connec.patch new file mode 100644 index 0000000..d2cdfa3 --- /dev/null +++ b/src/current-patches/firefox/0011-Provide-an-observer-event-to-close-persistent-connec.patch @@ -0,0 +1,39 @@ +From 7f6e76f1cbab26bcd6dead6427a9a19460877434 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)fscked.org> +Date: Wed, 7 Dec 2011 20:05:19 -0800 +Subject: [PATCH 11/11] Provide an observer event to close persistent connections + +We need to prevent linkability across "New Identity", which includes closing +keep-alive connections. +--- + netwerk/protocol/http/nsHttpHandler.cpp | 7 +++++++ + 1 files changed, 7 insertions(+), 0 deletions(-) + +diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp +index f79f23e..ed70ecd 100644 +--- a/netwerk/protocol/http/nsHttpHandler.cpp ++++ b/netwerk/protocol/http/nsHttpHandler.cpp +@@ -321,6 +321,7 @@ nsHttpHandler::Init() + mObserverService->AddObserver(this, "net:clear-active-logins", PR_TRUE); + mObserverService->AddObserver(this, NS_PRIVATE_BROWSING_SWITCH_TOPIC, PR_TRUE); + mObserverService->AddObserver(this, "net:prune-dead-connections", PR_TRUE); ++ mObserverService->AddObserver(this, "net:prune-all-connections", PR_TRUE); + } + + return NS_OK; +@@ -1611,6 +1612,12 @@ nsHttpHandler::Observe(nsISupports *subject, + mConnMgr->PruneDeadConnections(); + } + } ++ else if (strcmp(topic, "net:prune-all-connections") == 0) { ++ if (mConnMgr) { ++ mConnMgr->ClosePersistentConnections(); ++ mConnMgr->PruneDeadConnections(); ++ } ++ } + + return NS_OK; + } +-- +1.7.3.4 +

1 0

[torbrowser/master] Bug 4669: Enable TLS false start.
by erinn＠torproject.org 15 Dec '11

15 Dec '11

commit 34f7257ca3f4b1239cf8fccb314f57ddc9cf25f3 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Dec 8 17:02:03 2011 -0800 Bug 4669: Enable TLS false start. --- build-scripts/config/no-polipo.js | 1 + build-scripts/config/windows-4.0.js | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/build-scripts/config/no-polipo.js b/build-scripts/config/no-polipo.js index b8d7d17..1abd77d 100644 --- a/build-scripts/config/no-polipo.js +++ b/build-scripts/config/no-polipo.js @@ -175,3 +175,4 @@ user_pref("noscript.version", "2.0.7"); user_pref("plugin.disable_full_page_plugin_for_types", "application/asx,video/x-ms-asf-plugin,application/x-mplayer2,video/x-ms-asf,video/x-ms-wm,audio/x-ms-wma,audio/x-ms-wax,video/x-ms-wmv,video/x-ms-wvx,application/x-drm-v2,application/x-drm"); user_pref("plugin.expose_full_path", true); user_pref("plugin.scan.4xPluginFolder", false); +user_pref("security.ssl.enable_false_start", true); diff --git a/build-scripts/config/windows-4.0.js b/build-scripts/config/windows-4.0.js index 3d7b9a6..c06f9e9 100644 --- a/build-scripts/config/windows-4.0.js +++ b/build-scripts/config/windows-4.0.js @@ -178,3 +178,4 @@ user_pref("urlclassifier.tableversion.goog-white-domain", "1.481"); user_pref("urlclassifier.tableversion.goog-white-url", "1.371"); user_pref("xpinstall.whitelist.add", ""); user_pref("xpinstall.whitelist.add.36", ""); +user_pref("security.ssl.enable_false_start", true);

1 0