tor-commits May 2012

tor-commits@lists.torproject.org

20 participants
844 discussions

[torbrowser/master] Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3
by mikeperry＠torproject.org 03 May '12

03 May '12

commit 21d3ebcdc1eeb5dcbe2725ee6c0b08ec17228c32 Merge: ea18a10 acaa131 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:58:45 2012 -0700 Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3 .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-)

1 0

[torbrowser/maint-2.3] Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3
by mikeperry＠torproject.org 03 May '12

03 May '12

1 0

[torbrowser/maint-2.3] Add patch for #5741.
by mikeperry＠torproject.org 03 May '12

03 May '12

commit acaa131ffbc78c4355e49b7476941a1ad2c9da51 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:57:33 2012 -0700 Add patch for #5741. --- .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-) diff --git a/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch new file mode 100644 index 0000000..9b30987 --- /dev/null +++ b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch @@ -0,0 +1,132 @@ +From 93199734c06485660fb922c61f740191648a6dc6 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Wed, 2 May 2012 17:44:39 -0700 +Subject: [PATCH 18/18] Prevent WebSocket DNS leak. + +This is due to an improper implementation of the WebSocket spec by Mozilla. + +"There MUST be no more than one connection in a CONNECTING state. If multiple +connections to the same IP address are attempted simultaneously, the client +MUST serialize them so that there is no more than one connection at a time +running through the following steps. + +If the client cannot determine the IP address of the remote host (for +example, because all communication is being done through a proxy server that +performs DNS queries itself), then the client MUST assume for the purposes of +this step that each host name refers to a distinct remote host," + +https://tools.ietf.org/html/rfc6455#page-15 + +They implmented the first paragraph, but not the second... + +While we're at it, we also prevent the DNS service from being used to look up +anything other than IP addresses if socks_remote_dns is set to true, so this +bug can't turn up in other components or due to 3rd party addons. +--- + netwerk/dns/nsDNSService2.cpp | 24 ++++++++++++++++++++++- + netwerk/dns/nsDNSService2.h | 1 + + netwerk/protocol/websocket/WebSocketChannel.cpp | 8 +++++- + 3 files changed, 30 insertions(+), 3 deletions(-) + +diff --git a/netwerk/dns/nsDNSService2.cpp b/netwerk/dns/nsDNSService2.cpp +index 1bd5f38..eda0e48 100644 +--- a/netwerk/dns/nsDNSService2.cpp ++++ b/netwerk/dns/nsDNSService2.cpp +@@ -404,6 +404,7 @@ nsDNSService::Init() + bool enableIDN = true; + bool disableIPv6 = false; + bool disablePrefetch = false; ++ bool disableDNS = false; + int proxyType = nsIProtocolProxyService::PROXYCONFIG_DIRECT; + + nsAdoptingCString ipv4OnlyDomains; +@@ -427,6 +428,10 @@ nsDNSService::Init() + + // If a manual proxy is in use, disable prefetch implicitly + prefs->GetIntPref("network.proxy.type", &proxyType); ++ ++ // If the user wants remote DNS, we should fail any lookups that still ++ // make it here. ++ prefs->GetBoolPref("network.proxy.socks_remote_dns", &disableDNS); + } + + if (mFirstTime) { +@@ -444,7 +449,7 @@ nsDNSService::Init() + + // Monitor these to see if there is a change in proxy configuration + // If a manual proxy is in use, disable prefetch implicitly +- prefs->AddObserver("network.proxy.type", this, false); ++ prefs->AddObserver("network.proxy.", this, false); + } + } + +@@ -473,6 +478,7 @@ nsDNSService::Init() + mIDN = idn; + mIPv4OnlyDomains = ipv4OnlyDomains; // exchanges buffer ownership + mDisableIPv6 = disableIPv6; ++ mDisableDNS = disableDNS; + + // Disable prefetching either by explicit preference or if a manual proxy is configured + mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL); +@@ -584,6 +590,14 @@ nsDNSService::AsyncResolve(const nsACString &hostname, + if (mDisablePrefetch && (flags & RESOLVE_SPECULATE)) + return NS_ERROR_DNS_LOOKUP_QUEUE_FULL; + ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } ++ + res = mResolver; + idn = mIDN; + } +@@ -670,6 +684,14 @@ nsDNSService::Resolve(const nsACString &hostname, + MutexAutoLock lock(mLock); + res = mResolver; + idn = mIDN; ++ ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } + } + NS_ENSURE_TRUE(res, NS_ERROR_OFFLINE); + +diff --git a/netwerk/dns/nsDNSService2.h b/netwerk/dns/nsDNSService2.h +index 1749b41..3ec8eba 100644 +--- a/netwerk/dns/nsDNSService2.h ++++ b/netwerk/dns/nsDNSService2.h +@@ -70,4 +70,5 @@ private: + bool mDisableIPv6; + bool mDisablePrefetch; + bool mFirstTime; ++ bool mDisableDNS; + }; +diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp +index 22873d3..0875c12 100644 +--- a/netwerk/protocol/websocket/WebSocketChannel.cpp ++++ b/netwerk/protocol/websocket/WebSocketChannel.cpp +@@ -1875,8 +1875,12 @@ WebSocketChannel::ApplyForAdmission() + LOG(("WebSocketChannel::ApplyForAdmission: checking for concurrent open\n")); + nsCOMPtr<nsIThread> mainThread; + NS_GetMainThread(getter_AddRefs(mainThread)); +- dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); +- NS_ENSURE_SUCCESS(rv, rv); ++ rv = dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); ++ if (NS_FAILED(rv)) { ++ // Fall back to hostname on dispatch failure ++ mDNSRequest = nsnull; ++ OnLookupComplete(nsnull, nsnull, rv); ++ } + + return NS_OK; + } +-- +1.7.5.4 +

1 0

[torbrowser/maint-2.2] Add patch for #5741.
by mikeperry＠torproject.org 03 May '12

03 May '12

1 0

[flashproxy/master] Look for flashproxy-reg-http.py in the same directory as connector.py.
by dcf＠torproject.org 02 May '12

02 May '12

commit fbf164eb542e4d9a29ab66a3abd37ed588ba43cc Author: David Fifield <david(a)bamsoftware.com> Date: Wed May 2 13:54:18 2012 -0700 Look for flashproxy-reg-http.py in the same directory as connector.py. --- connector.py | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/connector.py b/connector.py index 3e2bfd9..8a2b7e1 100755 --- a/connector.py +++ b/connector.py @@ -605,8 +605,13 @@ def register(): if not options.register: return + # sys.path[0] is initialized to the directory containing the Python script file. + script_dir = sys.path[0] + if not script_dir: + # Maybe the script was read from stdin; in any case don't guess at the directory. + return + command = [os.path.join(script_dir, "flashproxy-reg-http.py")] spec = format_addr((None, options.remote_addr[1])) - command = ["./flashproxy-reg-http.py"] if options.facilitator_addr is None: log(u"Registering \"%s\"." % spec) else:

1 0

[flashproxy/master] Longer delay after starting facilitator.
by dcf＠torproject.org 02 May '12

02 May '12

commit 3a7b0fe02dd448926ed19507cc5cb6855203f92c Author: David Fifield <david(a)bamsoftware.com> Date: Wed May 2 13:56:27 2012 -0700 Longer delay after starting facilitator. --- experiments/switching/remote-tor-alternating.sh | 2 +- experiments/switching/remote-tor-constant.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/experiments/switching/remote-tor-alternating.sh b/experiments/switching/remote-tor-alternating.sh index 2dd5787..cd21f07 100755 --- a/experiments/switching/remote-tor-alternating.sh +++ b/experiments/switching/remote-tor-alternating.sh @@ -35,7 +35,7 @@ PIDS_TO_KILL+=($!) echo "Start facilitator." "$FLASHPROXY_DIR"/facilitator.py -d --relay tor1.bamsoftware.com:9901 >/dev/null & PIDS_TO_KILL+=($!) -visible_sleep 5 +visible_sleep 15 echo "Start connector." "$FLASHPROXY_DIR"/connector.py >/dev/null & diff --git a/experiments/switching/remote-tor-constant.sh b/experiments/switching/remote-tor-constant.sh index dccf152..fbe56a5 100755 --- a/experiments/switching/remote-tor-constant.sh +++ b/experiments/switching/remote-tor-constant.sh @@ -34,7 +34,7 @@ PIDS_TO_KILL+=($!) echo "Start facilitator." "$FLASHPROXY_DIR"/facilitator.py -d --relay tor1.bamsoftware.com:9901 >/dev/null & PIDS_TO_KILL+=($!) -visible_sleep 5 +visible_sleep 15 echo "Start connector." "$FLASHPROXY_DIR"/connector.py >/dev/null &

1 0

[flashproxy/master] Use connector.py --register.
by dcf＠torproject.org 02 May '12

02 May '12

commit 8f2ec50ab9074d43bfbf0a0d35051406d1b02d7e Author: David Fifield <david(a)bamsoftware.com> Date: Wed May 2 13:56:44 2012 -0700 Use connector.py --register. --- experiments/switching/local-http-constant.sh | 3 +-- experiments/switching/remote-tor-alternating.sh | 3 +-- experiments/switching/remote-tor-constant.sh | 3 +-- 3 files changed, 3 insertions(+), 6 deletions(-) diff --git a/experiments/switching/local-http-constant.sh b/experiments/switching/local-http-constant.sh index f7a8aba..4eb51b2 100755 --- a/experiments/switching/local-http-constant.sh +++ b/experiments/switching/local-http-constant.sh @@ -45,9 +45,8 @@ PIDS_TO_KILL+=($!) visible_sleep 5 echo "Start connector." -"$FLASHPROXY_DIR"/connector.py >/dev/null & +"$FLASHPROXY_DIR"/connector.py --register --facilitator 127.0.0.1:9002 >/dev/null & PIDS_TO_KILL+=($!) -echo $'POST / HTTP/1.0\r\n\r\nclient=:9000' | socat - TCP-CONNECT:127.0.0.1:9002 visible_sleep 1 echo "Start browser." diff --git a/experiments/switching/remote-tor-alternating.sh b/experiments/switching/remote-tor-alternating.sh index cd21f07..4b0df87 100755 --- a/experiments/switching/remote-tor-alternating.sh +++ b/experiments/switching/remote-tor-alternating.sh @@ -38,9 +38,8 @@ PIDS_TO_KILL+=($!) visible_sleep 15 echo "Start connector." -"$FLASHPROXY_DIR"/connector.py >/dev/null & +"$FLASHPROXY_DIR"/connector.py --register --facilitator 127.0.0.1:9002 >/dev/null & PIDS_TO_KILL+=($!) -echo $'POST / HTTP/1.0\r\n\r\nclient=:9000' | socat - TCP-CONNECT:127.0.0.1:9002 visible_sleep 1 echo "Start Tor." diff --git a/experiments/switching/remote-tor-constant.sh b/experiments/switching/remote-tor-constant.sh index fbe56a5..7320999 100755 --- a/experiments/switching/remote-tor-constant.sh +++ b/experiments/switching/remote-tor-constant.sh @@ -37,9 +37,8 @@ PIDS_TO_KILL+=($!) visible_sleep 15 echo "Start connector." -"$FLASHPROXY_DIR"/connector.py >/dev/null & +"$FLASHPROXY_DIR"/connector.py --register --facilitator 127.0.0.1:9002 >/dev/null & PIDS_TO_KILL+=($!) -echo $'POST / HTTP/1.0\r\n\r\nclient=:9000' | socat - TCP-CONNECT:127.0.0.1:9002 visible_sleep 1 echo "Start Tor."

1 0

[flashproxy/master] Use the WebSocket port on the relay in switching experiment.
by dcf＠torproject.org 02 May '12

02 May '12

commit 9f8ed10416d0b2cc3aa3a46d7b9b5ba4794f6285 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Apr 27 00:50:54 2012 -0700 Use the WebSocket port on the relay in switching experiment. --- experiments/switching/remote-tor-alternating.sh | 2 +- experiments/switching/remote-tor-constant.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/experiments/switching/remote-tor-alternating.sh b/experiments/switching/remote-tor-alternating.sh index 0ab4511..2dd5787 100755 --- a/experiments/switching/remote-tor-alternating.sh +++ b/experiments/switching/remote-tor-alternating.sh @@ -33,7 +33,7 @@ echo "Start web server." PIDS_TO_KILL+=($!) echo "Start facilitator." -"$FLASHPROXY_DIR"/facilitator.py -d --relay tor1.bamsoftware.com >/dev/null & +"$FLASHPROXY_DIR"/facilitator.py -d --relay tor1.bamsoftware.com:9901 >/dev/null & PIDS_TO_KILL+=($!) visible_sleep 5 diff --git a/experiments/switching/remote-tor-constant.sh b/experiments/switching/remote-tor-constant.sh index 0b16fec..dccf152 100755 --- a/experiments/switching/remote-tor-constant.sh +++ b/experiments/switching/remote-tor-constant.sh @@ -32,7 +32,7 @@ echo "Start web server." PIDS_TO_KILL+=($!) echo "Start facilitator." -"$FLASHPROXY_DIR"/facilitator.py -d --relay tor1.bamsoftware.com >/dev/null & +"$FLASHPROXY_DIR"/facilitator.py -d --relay tor1.bamsoftware.com:9901 >/dev/null & PIDS_TO_KILL+=($!) visible_sleep 5

1 0

[flashproxy/master] Fix socat line, accidentally broken in a9dce418.
by dcf＠torproject.org 02 May '12

02 May '12

commit 3c7c11e61793509deb090216feb370d979f50e40 Author: David Fifield <david(a)bamsoftware.com> Date: Wed May 2 13:55:53 2012 -0700 Fix socat line, accidentally broken in a9dce418. --- experiments/switching/local-http-alternating.sh | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/experiments/switching/local-http-alternating.sh b/experiments/switching/local-http-alternating.sh index 0d3eb08..ee2dd70 100755 --- a/experiments/switching/local-http-alternating.sh +++ b/experiments/switching/local-http-alternating.sh @@ -54,9 +54,8 @@ PIDS_TO_KILL+=($!) visible_sleep 2 echo "Start socat." -"$FLASHPROXY_DIR"/connector.py >/dev/null & +"$SOCAT" TCP-LISTEN:2000,reuseaddr,fork SOCKS4A:127.0.0.1:dummy:0,socksport=9001 & PIDS_TO_KILL+=($!) -echo $'POST / HTTP/1.0\r\n\r\nclient=:9000' | socat - TCP-CONNECT:127.0.0.1:9002 visible_sleep 2

1 0

[arm/master] Parsing error with .desktop file
by atagar＠torproject.org 02 May '12

02 May '12

commit 9fd23e343861055b6d5b4893d5f161970aff2be4 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed May 2 07:05:11 2012 -0700 Parsing error with .desktop file Caught and fixed by miceliux on... https://trac.torproject.org/projects/tor/ticket/5735 --- src/resources/tor-arm.desktop | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/resources/tor-arm.desktop b/src/resources/tor-arm.desktop index bf922a5..da94017 100644 --- a/src/resources/tor-arm.desktop +++ b/src/resources/tor-arm.desktop @@ -9,4 +9,4 @@ Exec=arm -g Icon=tor-arm Terminal=false Type=Application -Categories=System;Monitor;GTK +Categories=System;Monitor;GTK;

1 0

← Newer
1
...
77
78
79
80
81
82
83
84
85
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits May 2012