August 2014 - tor-commits - lists.torproject.org

[tor-browser-bundle/master] Bug 12103: Adding RELRO back to browser binaries.
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit d8e92e2f4d362216dfff1790026309e6c0a51b58 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 29 15:32:35 2014 -0700 Bug 12103: Adding RELRO back to browser binaries. We removed the build-id from browser binaries in bug 11042 as it turned out that despite the contents being exactly the same the build-id was not occasionally. But doing that with bjcopy destroyed RELRO protections as well. Having the build-id non-deterministic seems to be an ld issue as switching to gold solves this. --- gitian/descriptors/linux/gitian-firefox.yml | 6 ++++-- gitian/descriptors/linux/gitian-utils.yml | 20 ++++++++++++++++++++ gitian/mkbundle-linux.sh | 8 +++++++- 3 files changed, 31 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 90958c2..0cd4b28 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,6 +29,8 @@ remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" files: +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" - "python-linux32-utils.zip" - "python-linux64-utils.zip" - "re-dzip.sh" @@ -62,6 +64,8 @@ script: | ln -sf $INSTDIR/python/bin/python2.7 $INSTDIR/python/bin/python export PATH=$INSTDIR/python/bin:$PATH # + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + export PATH=$INSTDIR/binutils/bin:$PATH mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components # @@ -100,8 +104,6 @@ script: | cd $INSTDIR for LIB in Browser/*.so Browser/webapprt-stub Browser/mozilla-xremote-client Browser/firefox Browser/plugin-container Browser/components/*.so # Browser/updater do - # Build-ID is sometimes non-deterministic, and we use debuglink anyway - objcopy --remove-section=.note.gnu.build-id $LIB objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB objcopy --add-gnu-debuglink=./Debug/$LIB $LIB diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 34b1672..ea122db 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -15,6 +15,8 @@ packages: - "faketime" - "libtool" - "hardening-wrapper" +# Needed for compiling gold. +- "bison" # These packages are needed for Python due to HTTPS-Everywhere >= 3.5. - "libsqlite3-dev" - "zlib1g-dev" @@ -25,6 +27,7 @@ remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" files: +- "binutils.tar.bz2" - "openssl.tar.gz" - "python.tar.bz2" - "lxml.tar.gz" @@ -47,6 +50,22 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + # Building Binutils + tar xjf binutils.tar.bz2 + cd binutils* + # We want to use gold as the linker in our toolchain mainly as it is way + # faster when linking Tor Browser code (especially libxul). But apart from + # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well + # (see bug #12743). + ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold + make $MAKEOPTS + make install + # Make sure gold is used and not ld. + cd $INSTDIR/binutils/bin + rm ld + ln -sf ld.gold ld + cd ~/build + # Building Libevent cd libevent ./autogen.sh @@ -104,6 +123,7 @@ script: | # Grabbing the remaining results cd $INSTDIR + ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh python-$PYTHON_VER-linux$GBUILD_BITS-utils.zip python diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 7e90165..dd8e00a 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -98,7 +98,9 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ +if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ + ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ + ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ @@ -122,6 +124,8 @@ then cd inputs cp -a ../build/out/*-utils.zip . + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip @@ -141,6 +145,8 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip

1 0

[tor-browser-bundle/maint-3.6] Bug 12103: Adding RELRO back to browser binaries.
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 7df10ce04da9ed36a55e91c193fca29e88ac7a5f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Aug 29 20:28:39 2014 +0000 Bug 12103: Adding RELRO back to browser binaries. We removed the build-id from browser binaries in bug 11042 as it turned out that despite the contents being exactly the same the build-id was not occasionally. But doing that with bjcopy destroyed RELRO protections as well. Having the build-id non-deterministic seems to be an ld issue as switching to gold solves this. --- gitian/descriptors/linux/gitian-firefox.yml | 6 ++++-- gitian/descriptors/linux/gitian-utils.yml | 20 ++++++++++++++++++++ gitian/mkbundle-linux.sh | 8 +++++++- 3 files changed, 31 insertions(+), 3 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 7e6c598..cbd2b17 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -29,6 +29,8 @@ remotes: - "url": "https://git.torproject.org/tor-browser.git" "dir": "tor-browser" files: +- "binutils-linux32-utils.zip" +- "binutils-linux64-utils.zip" - "python-linux32-utils.zip" - "python-linux64-utils.zip" - "re-dzip.sh" @@ -62,6 +64,8 @@ script: | ln -sf $INSTDIR/python/bin/python2.7 $INSTDIR/python/bin/python export PATH=$INSTDIR/python/bin:$PATH # + unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + export PATH=$INSTDIR/binutils/bin:$PATH mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components # @@ -89,8 +93,6 @@ script: | cd $INSTDIR for LIB in Browser/*.so Browser/webapprt-stub Browser/mozilla-xremote-client Browser/firefox Browser/plugin-container Browser/components/*.so # Browser/updater do - # Build-ID is sometimes non-deterministic, and we use debuglink anyway - objcopy --remove-section=.note.gnu.build-id $LIB objcopy --only-keep-debug $LIB Debug/$LIB strip $LIB objcopy --add-gnu-debuglink=./Debug/$LIB $LIB diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index 34b1672..ea122db 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -15,6 +15,8 @@ packages: - "faketime" - "libtool" - "hardening-wrapper" +# Needed for compiling gold. +- "bison" # These packages are needed for Python due to HTTPS-Everywhere >= 3.5. - "libsqlite3-dev" - "zlib1g-dev" @@ -25,6 +27,7 @@ remotes: - "url": "https://github.com/libevent/libevent.git" "dir": "libevent" files: +- "binutils.tar.bz2" - "openssl.tar.gz" - "python.tar.bz2" - "lxml.tar.gz" @@ -47,6 +50,22 @@ script: | export DEB_BUILD_HARDENING_FORMAT=1 export DEB_BUILD_HARDENING_PIE=1 + # Building Binutils + tar xjf binutils.tar.bz2 + cd binutils* + # We want to use gold as the linker in our toolchain mainly as it is way + # faster when linking Tor Browser code (especially libxul). But apart from + # that it fixes #12103 and issues with ESR 31 and our Gitian setup as well + # (see bug #12743). + ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold + make $MAKEOPTS + make install + # Make sure gold is used and not ld. + cd $INSTDIR/binutils/bin + rm ld + ln -sf ld.gold ld + cd ~/build + # Building Libevent cd libevent ./autogen.sh @@ -104,6 +123,7 @@ script: | # Grabbing the remaining results cd $INSTDIR + ~/build/dzip.sh binutils-$BINUTILS_VER-linux$GBUILD_BITS-utils.zip binutils ~/build/dzip.sh openssl-$OPENSSL_VER-linux$GBUILD_BITS-utils.zip openssl ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-linux$GBUILD_BITS-utils.zip libevent ~/build/dzip.sh python-$PYTHON_VER-linux$GBUILD_BITS-utils.zip python diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 0d07364..ea6d171 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -98,7 +98,9 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ +if [ ! -f inputs/binutils-$BINUTILS_VER-linux32-utils.zip -o \ + ! -f inputs/binutils-$BINUTILS_VER-linux64-utils.zip -o \ + ! -f inputs/openssl-$OPENSSL_VER-linux32-utils.zip -o \ ! -f inputs/openssl-$OPENSSL_VER-linux64-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-linux64-utils.zip -o \ @@ -122,6 +124,8 @@ then cd inputs cp -a ../build/out/*-utils.zip . + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip @@ -141,6 +145,8 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs + ln -sf binutils-$BINUTILS_VER-linux32-utils.zip binutils-linux32-utils.zip + ln -sf binutils-$BINUTILS_VER-linux64-utils.zip binutils-linux64-utils.zip ln -sf openssl-$OPENSSL_VER-linux32-utils.zip openssl-linux32-utils.zip ln -sf openssl-$OPENSSL_VER-linux64-utils.zip openssl-linux64-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-linux32-utils.zip libevent-linux32-utils.zip

1 0

[tor-browser-bundle/master] add hardening for Windows bundles
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 9b138783e0f6e2423caba58bad777fc5622169db Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Aug 21 19:21:43 2014 -0400 add hardening for Windows bundles --- gitian/build-helpers/i686-w64-mingw32-g++ | 2 +- gitian/build-helpers/i686-w64-mingw32-gcc | 2 +- gitian/build-helpers/i686-w64-mingw32-ld | 7 +----- gitian/descriptors/windows/gitian-firefox.yml | 24 ++++++++------------ .../windows/gitian-pluggable-transports.yml | 12 ++++++++-- gitian/descriptors/windows/gitian-tor.yml | 16 +++++++------ gitian/descriptors/windows/gitian-utils.yml | 24 +++++++++++--------- gitian/mkbundle-windows.sh | 6 ++--- 8 files changed, 48 insertions(+), 45 deletions(-) diff --git a/gitian/build-helpers/i686-w64-mingw32-g++ b/gitian/build-helpers/i686-w64-mingw32-g++ index e3c13fd..b73f107 100755 --- a/gitian/build-helpers/i686-w64-mingw32-g++ +++ b/gitian/build-helpers/i686-w64-mingw32-g++ @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/usr/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -fstack-protector-all -pie -fPIE --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-g++ -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/gitian/build-helpers/i686-w64-mingw32-gcc b/gitian/build-helpers/i686-w64-mingw32-gcc index 830e11b..d4fd642 100755 --- a/gitian/build-helpers/i686-w64-mingw32-gcc +++ b/gitian/build-helpers/i686-w64-mingw32-gcc @@ -1,4 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -/usr/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -fstack-protector-all -pie -fPIE --param ssp-buffer-size=4 -fno-strict-overflow "$@" +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-gcc -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -fstack-protector --param ssp-buffer-size=4 -fno-strict-overflow "$@" diff --git a/gitian/build-helpers/i686-w64-mingw32-ld b/gitian/build-helpers/i686-w64-mingw32-ld index e085bdd..f8c61fd 100755 --- a/gitian/build-helpers/i686-w64-mingw32-ld +++ b/gitian/build-helpers/i686-w64-mingw32-ld @@ -1,9 +1,4 @@ #!/bin/sh # Hardened mingw gcc wrapper -if [ -x /usr/bin/i686-w64-mingw32-ld.orig ]; -then - /usr/bin/i686-w64-mingw32-ld.orig --dynamicbase --nxcompat -lssp -L/usr/lib/gcc/i686-w64-mingw32/4.6/ "$@" -else - /usr/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat -lssp -L/usr/lib/gcc/i686-w64-mingw32/4.6/ "$@" -fi +/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-ld --dynamicbase --nxcompat --enable-reloc-section -lssp -L$INSTDIR/gcclibs/ "$@" diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index 94b5eef..0968911 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -20,10 +20,10 @@ files: - "mingw-w64-win32-utils.zip" - "re-dzip.sh" - "dzip.sh" -# TODO: Hardening. -#- "i686-w64-mingw32-gcc" -#- "i686-w64-mingw32-g++" -#- "i686-w64-mingw32-ld" +- "gcclibs-win32-utils.zip" +- "i686-w64-mingw32-gcc" +- "i686-w64-mingw32-g++" +- "i686-w64-mingw32-ld" - "msvcr100.dll" - "versions" script: | @@ -38,8 +38,10 @@ script: | mkdir -p $INSTDIR/Browser/ mkdir -p $OUTDIR/ unzip -d $INSTDIR mingw-w64-win32-utils.zip + unzip -d $INSTDIR gcclibs-win32-utils.zip # Make sure our custom mingw gets used. export PATH=$INSTDIR/mingw-w64/bin:$PATH + # We don't want to link against msvcrt.dll due to bug 9084. i686-w64-mingw32-g++ -dumpspecs > msvcr100.spec sed 's/msvcrt/msvcr100/' -i msvcr100.spec @@ -73,22 +75,16 @@ script: | make -f client.mk configure find -type f | xargs touch --date="$REFERENCE_DATETIME" # - # FIXME: MinGW doens't like being built with hardening, and Firefox doesn't - # like being configured with it - # XXX: These changes cause the exes to crash on launch. - #mkdir -p ~/build/bin/ - #cp ~/build/i686* ~/build/bin/ - #export PATH=~/build/bin:$PATH - # XXX: the path to ld is hardcoded in mingw.. This forces gcc's linking to - # use our flags: - #sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - #sudo cp ~/build/bin/i686-w64-mingw32-ld /usr/bin/ + mkdir -p ~/build/bin/ + cp ~/build/i686* ~/build/bin/ + export PATH=~/build/bin:$PATH # make $MAKEOPTS -f client.mk build # make -C obj-* package INNER_MAKE_PACKAGE=true cp -a obj-*/dist/firefox/* $INSTDIR/Browser/ cp -a ~/build/msvcr100.dll $INSTDIR/Browser/ + cp -a $INSTDIR/gcclibs/libssp-0.dll $INSTDIR/Browser/ # # What the hell are these three bytes anyways? # FIXME: This was probably fixed by patching binutils. If we get matching diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index 1580152..bac9bf0 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -50,8 +50,10 @@ files: - "go.tar.gz" - "dzip.sh" - "pyc-timestamp.sh" +- "binutils-win32-utils.zip" - "openssl-win32-utils.zip" - "gmp-win32-utils.zip" +- "gcclibs-win32-utils.zip" script: | # Set the timestamp on every .pyc file in a zip file, and re-dzip the zip file. function py2exe_zip_timestomp { @@ -75,14 +77,20 @@ script: | export FAKETIME=$REFERENCE_DATETIME export TZ=UTC export LC_ALL=C - export CFLAGS="-mwindows" - export LDFLAGS="-mwindows" + export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" umask 0022 + unzip -d $INSTDIR binutils-win32-utils.zip unzip -d $INSTDIR gmp-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip + unzip -d $INSTDIR gcclibs-win32-utils.zip cp $INSTDIR/gmp/bin/*dll* $INSTDIR/Tor + export PATH=$INSTDIR/mingw-w64/bin:$PATH + sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig + sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ + # We need at least Wine 1.5.29 which is not in Ubuntu's main repository (see # below). Thus, we resort to a PPA and need therefore to determine the correct # network interface depending on the virtualization we use. diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index bc70839..65df589 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -35,6 +35,7 @@ files: - "openssl-win32-utils.zip" - "libevent-win32-utils.zip" - "zlib-win32-utils.zip" +- "gcclibs-win32-utils.zip" script: | INSTDIR="$HOME/install" source versions @@ -51,14 +52,17 @@ script: | unzip -d $INSTDIR zlib-win32-utils.zip unzip -d $INSTDIR libevent-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip + unzip -d $INSTDIR gcclibs-win32-utils.zip cp $INSTDIR/zlib/lib/*.dll $INSTDIR/Tor/ cp $INSTDIR/libevent/bin/*.dll $INSTDIR/Tor/ cp $INSTDIR/openssl/bin/*.dll $INSTDIR/Tor/ - # Make sure our custom ld gets used. - # See the we-need-only-the-binutils-comment in gitian-utils.yml for the - # reasoning behind the "mingw-w64" dir instead of an expected "binutils" one. + cp $INSTDIR/gcclibs/*.dll $INSTDIR/Tor/ + export PATH=$INSTDIR/mingw-w64/bin:$PATH + sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig + sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ + # Building tor cd tor git update-index --refresh -q @@ -89,8 +93,8 @@ script: | mkdir -p $OUTDIR/src #git archive HEAD | tar -x -C $OUTDIR/src # Let's avoid the console window popping up. - export CFLAGS="-mwindows" - export LDFLAGS="-mwindows" + export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" ./autogen.sh find -type f | xargs touch --date="$REFERENCE_DATETIME" ./configure --disable-asciidoc --host=i686-w64-mingw32 --with-libevent-dir=$INSTDIR/libevent --with-openssl-dir=$INSTDIR/openssl --prefix=$INSTDIR --with-zlib-dir=$INSTDIR/zlib/ @@ -100,8 +104,6 @@ script: | install -s $INSTDIR/bin/tor.exe $INSTDIR/Tor/ cp $INSTDIR/share/tor/geoip $INSTDIR/Data/Tor/ cp $INSTDIR/share/tor/geoip6 $INSTDIR/Data/Tor/ - cp -a /usr/lib/gcc/i686-w64-mingw32/4.6/libgcc_s_sjlj-1.dll $INSTDIR/Tor/ - cp -a /usr/lib/gcc/i686-w64-mingw32/4.6/libssp*.dll $INSTDIR/Tor/ # Grabbing the result cd $INSTDIR diff --git a/gitian/descriptors/windows/gitian-utils.yml b/gitian/descriptors/windows/gitian-utils.yml index 87dbe16..2d0b3db 100644 --- a/gitian/descriptors/windows/gitian-utils.yml +++ b/gitian/descriptors/windows/gitian-utils.yml @@ -31,6 +31,7 @@ files: - "gcc.tar.bz2" - "openssl.tar.gz" - "gmp.tar.bz2" +- "enable-reloc-section-ld.patch" - "peXXigen.patch" - "versions" - "dzip.sh" @@ -47,15 +48,11 @@ script: | # XXX: This is needed due to bug 10102. sed 's/= extern_rt_rel_d;/= extern_rt_rel_d;\n memset (extern_rt_rel_d, 0, PE_IDATA5_SIZE);/' -i ld/pe-dll.c # Zeroing timestamps in PE headers reliably, see bug 12753. + patch -p1 < ../enable-reloc-section-ld.patch patch -p1 < ../peXXigen.patch ./configure --prefix=$INSTDIR/mingw-w64 --target=i686-w64-mingw32 --disable-multilib make $MAKEOPTS make install - # XXX: We currently do this as we are not using our own compiler but only our - # own binutils for compiling tor. See bug 10077. Nevertheless, we need both - # for cross-compiling Tor Browser. - cd $INSTDIR - ~/build/dzip.sh binutils-$BINUTILS_VER-win32-utils.zip mingw-w64 # Make sure our ld etc. is found and used. export PATH=$INSTDIR/mingw-w64/bin:$PATH cd ~/build @@ -78,7 +75,7 @@ script: | sed 's/msvcrt/msvcr100/' -i gcc-*/gcc/config/i386/t-mingw-w32 # LDFLAGS_FOR_TARGET does not work for some reason. Thus, we take # CFLAGS_FOR_TARGET. - export CFLAGS_FOR_TARGET="-specs=/home/ubuntu/build/msvcr100.spec" + export CFLAGS_FOR_TARGET="-specs=/home/ubuntu/build/msvcr100.spec -Wl,--nxcompat -Wl,--dynamicbase" gcc-*/configure --prefix=$INSTDIR/mingw-w64 --target=i686-w64-mingw32 --disable-multilib --enable-languages=c,c++ make $MAKEOPTS all-gcc make install-gcc @@ -99,8 +96,12 @@ script: | cd .. # Second stage of gcc compilation cd gcc + find -type f | xargs touch --date="$REFERENCE_DATETIME" make $MAKEOPTS make install + mkdir -p $INSTDIR/gcclibs + cp i686-w64-mingw32/libssp/.libs/libssp-0.dll $INSTDIR/gcclibs + cp i686-w64-mingw32/libgcc/shlib/libgcc_s_sjlj-1.dll $INSTDIR/gcclibs cd .. # XXX: Build the libraries we include into the bundles deterministically. As @@ -111,12 +112,12 @@ script: | export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1 export FAKETIME=$REFERENCE_DATETIME # Building zlib - export CFLAGS="-mwindows" - export LDFLAGS="-mwindows" + export CFLAGS="-mwindows -fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security" + export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" cd zlib find -type f | xargs touch --date="$REFERENCE_DATETIME" - make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 - make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 install + make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" + make BINARY_PATH=$INSTDIR/zlib/lib INCLUDE_PATH=$INSTDIR/zlib/include LIBRARY_PATH=$INSTDIR/zlib/lib -f win32/Makefile.gcc PREFIX=i686-w64-mingw32- $MAKEOPTS SHARED_MODE=1 LOC="-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" install cd .. # Building Libevent @@ -133,7 +134,7 @@ script: | cd openssl-* find -type f | xargs touch --date="$REFERENCE_DATETIME" # TODO: Add enable-ec_nistp_64_gcc_128 for 64bit Windows. - ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw --prefix=$INSTDIR/openssl + ./Configure -shared --cross-compile-prefix=i686-w64-mingw32- mingw "-fstack-protector-all -Wstack-protector --param ssp-buffer-size=4 -fno-strict-overflow -Wno-missing-field-initializers -Wformat -Wformat-security -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs/" --prefix=$INSTDIR/openssl # Using $MAKEOPTS breaks the build. Might be the issue mentioned on # http://cblfs.cross-lfs.org/index.php/OpenSSL. make @@ -156,4 +157,5 @@ script: | ~/build/dzip.sh libevent-${LIBEVENT_TAG#release-}-win32-utils.zip libevent ~/build/dzip.sh openssl-$OPENSSL_VER-win32-utils.zip openssl ~/build/dzip.sh gmp-$GMP_VER-win32-utils.zip gmp + ~/build/dzip.sh gcclibs-$GCC_VER-win32-utils.zip gcclibs cp *-utils.zip $OUTDIR/ diff --git a/gitian/mkbundle-windows.sh b/gitian/mkbundle-windows.sh index 0af015d..9ef5c41 100755 --- a/gitian/mkbundle-windows.sh +++ b/gitian/mkbundle-windows.sh @@ -97,7 +97,7 @@ fi cd $GITIAN_DIR -if [ ! -f inputs/binutils-$BINUTILS_VER-win32-utils.zip -o \ +if [ ! -f inputs/gcclibs-$GCC_VER-win32-utils.zip -o \ ! -f inputs/mingw-w64-$GCC_VER-win32-utils.zip -o \ ! -f inputs/zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip -o \ ! -f inputs/libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip -o \ @@ -117,12 +117,12 @@ then cd inputs cp -a ../build/out/*-utils.zip . - ln -sf binutils-$BINUTILS_VER-win32-utils.zip binutils-win32-utils.zip ln -sf mingw-w64-$GCC_VER-win32-utils.zip mingw-w64-win32-utils.zip ln -sf zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip zlib-win32-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip libevent-win32-utils.zip ln -sf openssl-$OPENSSL_VER-win32-utils.zip openssl-win32-utils.zip ln -sf gmp-$GMP_VER-win32-utils.zip gmp-win32-utils.zip + ln -sf gcclibs-$GCC_VER-win32-utils.zip gcclibs-win32-utils.zip cd .. #cp -a result/utils-win-res.yml inputs/ else @@ -132,12 +132,12 @@ else # We might have built the utilities in the past but maybe the links are # pointing to the wrong version. Refresh them. cd inputs - ln -sf binutils-$BINUTILS_VER-win32-utils.zip binutils-win32-utils.zip ln -sf mingw-w64-$GCC_VER-win32-utils.zip mingw-w64-win32-utils.zip ln -sf zlib-${ZLIB_TAG_ORIG#v}-win32-utils.zip zlib-win32-utils.zip ln -sf libevent-${LIBEVENT_TAG_ORIG#release-}-win32-utils.zip libevent-win32-utils.zip ln -sf openssl-$OPENSSL_VER-win32-utils.zip openssl-win32-utils.zip ln -sf gmp-$GMP_VER-win32-utils.zip gmp-win32-utils.zip + ln -sf gcclibs-$GCC_VER-win32-utils.zip gcclibs-win32-utils.zip cd .. fi

1 0

[tor-browser-bundle/master] Merge remote-tracking branch 'erinn/tbb-4.x-hardening'
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 393ac6898933fc17d31edb6be518ca8c957c6034 Merge: 59cb26c e92aa0a Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Aug 29 15:11:04 2014 -0700 Merge remote-tracking branch 'erinn/tbb-4.x-hardening' gitian/build-helpers/i686-w64-mingw32-g++ | 2 +- gitian/build-helpers/i686-w64-mingw32-gcc | 2 +- gitian/build-helpers/i686-w64-mingw32-ld | 7 +- gitian/build-helpers/wine-wrappers/dllwrap.py | 2 +- gitian/build-helpers/wine-wrappers/g++.py | 2 +- gitian/build-helpers/wine-wrappers/gcc.py | 2 +- gitian/descriptors/windows/gitian-firefox.yml | 24 +-- .../windows/gitian-pluggable-transports.yml | 12 +- gitian/descriptors/windows/gitian-tor.yml | 18 +- gitian/descriptors/windows/gitian-utils.yml | 24 ++- gitian/mkbundle-windows.sh | 6 +- gitian/patches/enable-reloc-section-ld.patch | 216 ++++++++++++++++++++ 12 files changed, 264 insertions(+), 53 deletions(-) diff --cc gitian/descriptors/windows/gitian-firefox.yml index 4ea551f,0968911..d6a6756 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@@ -69,19 -72,12 +71,12 @@@ script: find -type f | xargs touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - make -f client.mk configure + make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL}" find -type f | xargs touch --date="$REFERENCE_DATETIME" # - # FIXME: MinGW doens't like being built with hardening, and Firefox doesn't - # like being configured with it - # XXX: These changes cause the exes to crash on launch. - #mkdir -p ~/build/bin/ - #cp ~/build/i686* ~/build/bin/ - #export PATH=~/build/bin:$PATH - # XXX: the path to ld is hardcoded in mingw.. This forces gcc's linking to - # use our flags: - #sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - #sudo cp ~/build/bin/i686-w64-mingw32-ld /usr/bin/ + mkdir -p ~/build/bin/ + cp ~/build/i686* ~/build/bin/ + export PATH=~/build/bin:$PATH # make $MAKEOPTS -f client.mk build #

1 0

[tor-browser-bundle/master] add --enable-reloc-section patch from skruffy
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit 1221eecfdc639fe412bc5fe051e3151e1ce5d6a9 Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Aug 21 19:23:30 2014 -0400 add --enable-reloc-section patch from skruffy --- gitian/patches/enable-reloc-section-ld.patch | 216 ++++++++++++++++++++++++++ 1 file changed, 216 insertions(+) diff --git a/gitian/patches/enable-reloc-section-ld.patch b/gitian/patches/enable-reloc-section-ld.patch new file mode 100644 index 0000000..f393f51 --- /dev/null +++ b/gitian/patches/enable-reloc-section-ld.patch @@ -0,0 +1,216 @@ +From 093b08a9e7af23a258306b710ebc4556d12f94f7 Mon Sep 17 00:00:00 2001 +From: Erinn Clark <erinn(a)torproject.org> +Date: Fri, 8 Aug 2014 14:23:44 -0400 +Subject: [PATCH] add relocation section so Windows bundles can have ASLR + +Patch by skruffy. + +--- + ld/emultempl/pe.em | 6 +++++ + ld/emultempl/pep.em | 8 ++++++- + ld/pe-dll.c | 63 ++++++++++++++++++++++++++++++----------------------- + ld/pe-dll.h | 1 + + 4 files changed, 50 insertions(+), 28 deletions(-) + +diff --git a/ld/emultempl/pe.em b/ld/emultempl/pe.em +index 5d6da9e..14c07f7 100644 +--- a/ld/emultempl/pe.em ++++ b/ld/emultempl/pe.em +@@ -268,6 +268,7 @@ fragment <<EOF + #define OPTION_TERMINAL_SERVER_AWARE (OPTION_WDM_DRIVER + 1) + /* Determinism. */ + #define OPTION_INSERT_TIMESTAMP (OPTION_TERMINAL_SERVER_AWARE + 1) ++#define OPTION_ENABLE_RELOC_SECTION (OPTION_INSERT_TIMESTAMP + 1) + + static void + gld${EMULATION_NAME}_add_options +@@ -310,6 +311,7 @@ gld${EMULATION_NAME}_add_options + {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, + {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, + {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, ++ {"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION}, + {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, + {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, + {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, +@@ -773,6 +775,9 @@ gld${EMULATION_NAME}_handle_option (int optc) + case OPTION_EXCLUDE_ALL_SYMBOLS: + pe_dll_exclude_all_symbols = 1; + break; ++ case OPTION_ENABLE_RELOC_SECTION: ++ pe_dll_enable_reloc_section = 1; ++ break; + case OPTION_EXCLUDE_LIBS: + pe_dll_add_excludes (optarg, EXCLUDELIBS); + break; +@@ -1839,6 +1844,7 @@ gld_${EMULATION_NAME}_finish (void) + if (link_info.shared + #if !defined(TARGET_IS_shpe) + || (!link_info.relocatable && pe_def_file->num_exports != 0) ++ || (!link_info.relocatable && pe_dll_enable_reloc_section) + #endif + ) + { +diff --git a/ld/emultempl/pep.em b/ld/emultempl/pep.em +index b738800..b566903 100644 +--- a/ld/emultempl/pep.em ++++ b/ld/emultempl/pep.em +@@ -242,7 +242,8 @@ enum options + OPTION_NO_BIND, + OPTION_WDM_DRIVER, + OPTION_INSERT_TIMESTAMP, +- OPTION_TERMINAL_SERVER_AWARE ++ OPTION_TERMINAL_SERVER_AWARE, ++ OPTION_ENABLE_RELOC_SECTION + }; + + static void +@@ -284,6 +285,7 @@ gld${EMULATION_NAME}_add_options + {"export-all-symbols", no_argument, NULL, OPTION_EXPORT_ALL}, + {"exclude-symbols", required_argument, NULL, OPTION_EXCLUDE_SYMBOLS}, + {"exclude-all-symbols", no_argument, NULL, OPTION_EXCLUDE_ALL_SYMBOLS}, ++ {"enable-reloc-section", no_argument, NULL, OPTION_ENABLE_RELOC_SECTION}, + {"exclude-libs", required_argument, NULL, OPTION_EXCLUDE_LIBS}, + {"exclude-modules-for-implib", required_argument, NULL, OPTION_EXCLUDE_MODULES_FOR_IMPLIB}, + {"kill-at", no_argument, NULL, OPTION_KILL_ATS}, +@@ -727,6 +729,9 @@ gld${EMULATION_NAME}_handle_option (int optc) + case OPTION_EXCLUDE_ALL_SYMBOLS: + pep_dll_exclude_all_symbols = 1; + break; ++ case OPTION_ENABLE_RELOC_SECTION: ++ pe_dll_enable_reloc_section = 1; ++ break; + case OPTION_EXCLUDE_LIBS: + pep_dll_add_excludes (optarg, EXCLUDELIBS); + break; +@@ -1618,6 +1623,7 @@ gld_${EMULATION_NAME}_finish (void) + + #ifdef DLL_SUPPORT + if (link_info.shared ++ || (!link_info.relocatable && pe_dll_enable_reloc_section) + || (!link_info.relocatable && pep_def_file->num_exports != 0)) + { + pep_dll_fill_sections (link_info.output_bfd, &link_info); +diff --git a/ld/pe-dll.c b/ld/pe-dll.c +index e9e133b..4230dc3 100644 +--- a/ld/pe-dll.c ++++ b/ld/pe-dll.c +@@ -152,6 +152,7 @@ def_file * pe_def_file = 0; + int pe_dll_export_everything = 0; + int pe_dll_exclude_all_symbols = 0; + int pe_dll_do_default_excludes = 1; ++int pe_dll_enable_reloc_section = 0; + int pe_dll_kill_ats = 0; + int pe_dll_stdcall_aliases = 0; + int pe_dll_warn_dup_exports = 0; +@@ -3370,8 +3371,15 @@ pe_dll_build_sections (bfd *abfd, struct bfd_link_info *info) + process_def_file_and_drectve (abfd, info); + + if (pe_def_file->num_exports == 0 && !info->shared) +- return; +- ++ { ++ if (pe_dll_enable_reloc_section) ++ { ++ build_filler_bfd (0); ++ pe_output_file_set_long_section_names (filler_bfd); ++ } ++ return; ++ } ++ + generate_edata (abfd, info); + build_filler_bfd (1); + pe_output_file_set_long_section_names (filler_bfd); +@@ -3386,13 +3394,9 @@ pe_exe_build_sections (bfd *abfd, struct bfd_link_info *info ATTRIBUTE_UNUSED) + pe_output_file_set_long_section_names (filler_bfd); + } + +-void +-pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) ++static void ++pe_dll_create_reloc (bfd *abfd, struct bfd_link_info *info) + { +- pe_dll_id_target (bfd_get_target (abfd)); +- pe_output_file_set_long_section_names (abfd); +- image_base = pe_data (abfd)->pe_opthdr.ImageBase; +- + generate_reloc (abfd, info); + if (reloc_sz > 0) + { +@@ -3409,38 +3413,43 @@ pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) + lang_do_assignments (lang_final_phase_enum); + } + +- fill_edata (abfd, info); +- +- if (info->shared && !info->pie) +- pe_data (abfd)->dll = 1; +- +- edata_s->contents = edata_d; + reloc_s->contents = reloc_d; + } + + void +-pe_exe_fill_sections (bfd *abfd, struct bfd_link_info *info) ++pe_dll_fill_sections (bfd *abfd, struct bfd_link_info *info) + { ++ if (!reloc_s && !edata_s) ++ return; + pe_dll_id_target (bfd_get_target (abfd)); + pe_output_file_set_long_section_names (abfd); + image_base = pe_data (abfd)->pe_opthdr.ImageBase; + +- generate_reloc (abfd, info); +- if (reloc_sz > 0) ++ if (reloc_s) ++ pe_dll_create_reloc (abfd, info); ++ ++ if (edata_s) + { +- bfd_set_section_size (filler_bfd, reloc_s, reloc_sz); ++ fill_edata (abfd, info); ++ edata_s->contents = edata_d; ++ } + +- /* Resize the sections. */ +- lang_reset_memory_regions (); +- lang_size_sections (NULL, TRUE); ++ if (info->shared && !info->pie) ++ pe_data (abfd)->dll = 1; + +- /* Redo special stuff. */ +- ldemul_after_allocation (); + +- /* Do the assignments again. */ +- lang_do_assignments (lang_final_phase_enum); +- } +- reloc_s->contents = reloc_d; ++} ++ ++void ++pe_exe_fill_sections (bfd *abfd, struct bfd_link_info *info) ++{ ++ if (!reloc_s) ++ return; ++ pe_dll_id_target (bfd_get_target (abfd)); ++ pe_output_file_set_long_section_names (abfd); ++ image_base = pe_data (abfd)->pe_opthdr.ImageBase; ++ ++ pe_dll_create_reloc (abfd, info); + } + + bfd_boolean +diff --git a/ld/pe-dll.h b/ld/pe-dll.h +index 4697390..2bf71d9 100644 +--- a/ld/pe-dll.h ++++ b/ld/pe-dll.h +@@ -31,6 +31,7 @@ extern def_file *pe_def_file; + extern int pe_dll_export_everything; + extern int pe_dll_exclude_all_symbols; + extern int pe_dll_do_default_excludes; ++extern int pe_dll_enable_reloc_section; + extern int pe_dll_kill_ats; + extern int pe_dll_stdcall_aliases; + extern int pe_dll_warn_dup_exports; +-- +2.0.1 +

1 0

[tor-browser-bundle/master] make Tor and the PTs build with our mingw compilers
by mikeperry＠torproject.org 29 Aug '14

29 Aug '14

commit e92aa0a6a20117a9badd0c116284e77afd8b9dbb Author: Erinn Clark <erinn(a)torproject.org> Date: Tue Aug 26 11:01:48 2014 -0400 make Tor and the PTs build with our mingw compilers --- gitian/build-helpers/wine-wrappers/dllwrap.py | 2 +- gitian/build-helpers/wine-wrappers/g++.py | 2 +- gitian/build-helpers/wine-wrappers/gcc.py | 2 +- gitian/descriptors/windows/gitian-pluggable-transports.yml | 8 ++------ gitian/descriptors/windows/gitian-tor.yml | 8 ++------ 5 files changed, 7 insertions(+), 15 deletions(-) diff --git a/gitian/build-helpers/wine-wrappers/dllwrap.py b/gitian/build-helpers/wine-wrappers/dllwrap.py index fdff035..8f339ff 100755 --- a/gitian/build-helpers/wine-wrappers/dllwrap.py +++ b/gitian/build-helpers/wine-wrappers/dllwrap.py @@ -10,7 +10,7 @@ import sys import common -args = ["/usr/bin/i686-w64-mingw32-dllwrap"] +args = ["/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-dllwrap"] sys.argv.pop(0) while sys.argv: a = sys.argv.pop(0) diff --git a/gitian/build-helpers/wine-wrappers/g++.py b/gitian/build-helpers/wine-wrappers/g++.py index 4738420..0688285 100755 --- a/gitian/build-helpers/wine-wrappers/g++.py +++ b/gitian/build-helpers/wine-wrappers/g++.py @@ -10,7 +10,7 @@ import sys import common -args = ["/usr/bin/i686-w64-mingw32-g++"] +args = ["/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-g++"] sys.argv.pop(0) while sys.argv: a = sys.argv.pop(0) diff --git a/gitian/build-helpers/wine-wrappers/gcc.py b/gitian/build-helpers/wine-wrappers/gcc.py index 493b27b..37bb1d8 100755 --- a/gitian/build-helpers/wine-wrappers/gcc.py +++ b/gitian/build-helpers/wine-wrappers/gcc.py @@ -10,7 +10,7 @@ import sys import common -args = ["/usr/bin/i686-w64-mingw32-gcc"] +args = ["/home/ubuntu/install/mingw-w64/bin/i686-w64-mingw32-gcc"] sys.argv.pop(0) while sys.argv: a = sys.argv.pop(0) diff --git a/gitian/descriptors/windows/gitian-pluggable-transports.yml b/gitian/descriptors/windows/gitian-pluggable-transports.yml index bac9bf0..93776b8 100644 --- a/gitian/descriptors/windows/gitian-pluggable-transports.yml +++ b/gitian/descriptors/windows/gitian-pluggable-transports.yml @@ -11,8 +11,6 @@ packages: - "swig" - "p7zip-full" - "m4" -- "mingw-w64" -- "g++-mingw-w64" - "python-dev" - "faketime" - "libtool" @@ -50,7 +48,7 @@ files: - "go.tar.gz" - "dzip.sh" - "pyc-timestamp.sh" -- "binutils-win32-utils.zip" +- "mingw-w64-win32-utils.zip" - "openssl-win32-utils.zip" - "gmp-win32-utils.zip" - "gcclibs-win32-utils.zip" @@ -81,15 +79,13 @@ script: | export LDFLAGS="-mwindows -Wl,--dynamicbase -Wl,--nxcompat -Wl,--enable-reloc-section -lssp -L$INSTDIR/gcclibs" umask 0022 - unzip -d $INSTDIR binutils-win32-utils.zip + unzip -d $INSTDIR mingw-w64-win32-utils.zip unzip -d $INSTDIR gmp-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip unzip -d $INSTDIR gcclibs-win32-utils.zip cp $INSTDIR/gmp/bin/*dll* $INSTDIR/Tor export PATH=$INSTDIR/mingw-w64/bin:$PATH - sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ # We need at least Wine 1.5.29 which is not in Ubuntu's main repository (see # below). Thus, we resort to a PPA and need therefore to determine the correct diff --git a/gitian/descriptors/windows/gitian-tor.yml b/gitian/descriptors/windows/gitian-tor.yml index 65df589..277f2d0 100644 --- a/gitian/descriptors/windows/gitian-tor.yml +++ b/gitian/descriptors/windows/gitian-tor.yml @@ -11,7 +11,6 @@ packages: - "autoconf" - "automake" - "autoconf2.13" -- "mingw-w64" - "faketime" - "libtool" reference_datetime: "2000-01-01 00:00:00" @@ -31,7 +30,7 @@ files: - "bug11200-hang-0.2.5.patch" - "binutils.tar.bz2" - "dzip.sh" -- "binutils-win32-utils.zip" +- "mingw-w64-win32-utils.zip" - "openssl-win32-utils.zip" - "libevent-win32-utils.zip" - "zlib-win32-utils.zip" @@ -48,7 +47,7 @@ script: | mkdir -p $INSTDIR/bin/ mkdir -p $INSTDIR/Tor/ mkdir -p $INSTDIR/Data/Tor/ - unzip -d $INSTDIR binutils-win32-utils.zip + unzip -d $INSTDIR mingw-w64-win32-utils.zip unzip -d $INSTDIR zlib-win32-utils.zip unzip -d $INSTDIR libevent-win32-utils.zip unzip -d $INSTDIR openssl-win32-utils.zip @@ -60,9 +59,6 @@ script: | export PATH=$INSTDIR/mingw-w64/bin:$PATH - sudo mv /usr/bin/i686-w64-mingw32-ld /usr/bin/i686-w64-mingw32-ld.orig - sudo cp $INSTDIR/mingw-w64/bin/i686-w64-mingw32-ld /usr/bin/ - # Building tor cd tor git update-index --refresh -q

1 0

[tor/master] Merge remote-tracking branch 'arma/bug12996b' into maint-0.2.5
by nickm＠torproject.org 29 Aug '14

29 Aug '14

commit 41058dce95b4e94c10b156728524d24d69620ed0 Merge: 4a6f5bb 7a878c1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 29 16:44:50 2014 -0400 Merge remote-tracking branch 'arma/bug12996b' into maint-0.2.5 changes/bug12996 | 5 +++++ src/or/onion_tap.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-)

1 0

[tor/master] Downgrade "Unexpected onionskin length after decryption" warning
by nickm＠torproject.org 29 Aug '14

29 Aug '14

commit 7a878c192f5000c5ef5d29a71924a41b6e5adf42 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Aug 29 16:38:54 2014 -0400 Downgrade "Unexpected onionskin length after decryption" warning It's now a protocol-warn, since there's nothing relay operators can do about a client that sends them a malformed create cell. Resolves bug 12996; bugfix on 0.0.6rc1. --- changes/bug12996 | 5 +++++ src/or/onion_tap.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/changes/bug12996 b/changes/bug12996 new file mode 100644 index 0000000..4b4fb0d --- /dev/null +++ b/changes/bug12996 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Downgrade "Unexpected onionskin length after decryption" warning + to a protocol-warn, since there's nothing relay operators can do + about a client that sends them a malformed create cell. Resolves + bug 12996; bugfix on 0.0.6rc1. diff --git a/src/or/onion_tap.c b/src/or/onion_tap.c index 9a9f374..65f8275 100644 --- a/src/or/onion_tap.c +++ b/src/or/onion_tap.c @@ -122,8 +122,9 @@ onion_skin_TAP_server_handshake( "Couldn't decrypt onionskin: client may be using old onion key"); goto err; } else if (len != DH_KEY_LEN) { - log_warn(LD_PROTOCOL, "Unexpected onionskin length after decryption: %ld", - (long)len); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Unexpected onionskin length after decryption: %ld", + (long)len); goto err; }

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.5'
by nickm＠torproject.org 29 Aug '14

29 Aug '14

commit f113a263deda8e1619f46cd913fc24ac28da832d Merge: d6fa823 41058dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 29 16:45:56 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.5' changes/bug12996 | 5 +++++ src/or/onion_tap.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.5] Resume expanding abbreviations for command-line options
by nickm＠torproject.org 29 Aug '14

29 Aug '14

commit 37a76d75dd38a1ebd45627bb6e29e40f60917188 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Aug 27 06:10:35 2014 -0400 Resume expanding abbreviations for command-line options The fix for bug 4647 accidentally removed our hack from bug 586 that rewrote HashedControlPassword to __HashedControlSessionPassword when it appears on the commandline (which allowed the user to set her own HashedControlPassword in the torrc file while the controller generates a fresh session password for each run). Fixes bug 12948; bugfix on 0.2.5.1-alpha. --- changes/bug12948 | 8 ++++++++ src/or/config.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/bug12948 b/changes/bug12948 new file mode 100644 index 0000000..431c0a1 --- /dev/null +++ b/changes/bug12948 @@ -0,0 +1,8 @@ + o Major bugfixes: + - Resume expanding abbreviations for command-line options. The fix + for bug 4647 accidentally removed our hack from bug 586 that rewrote + HashedControlPassword to __HashedControlSessionPassword when it + appears on the commandline (which allowed the user to set her + own HashedControlPassword in the torrc file while the controller + generates a fresh session password for each run). Fixes bug 12948; + bugfix on 0.2.5.1-alpha. diff --git a/src/or/config.c b/src/or/config.c index 6bb6209..921503b 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1932,7 +1932,8 @@ config_parse_commandline(int argc, char **argv, int ignore_errors, } param = tor_malloc_zero(sizeof(config_line_t)); - param->key = is_cmdline ? tor_strdup(argv[i]) : tor_strdup(s); + param->key = is_cmdline ? tor_strdup(argv[i]) : + tor_strdup(config_expand_abbrev(&options_format, s, 1, 1)); param->value = arg; param->command = command; param->next = NULL;

1 0