tor-commits February 2015

tor-commits@lists.torproject.org

15 participants
2121 discussions

[tor-browser/tor-browser-31.4.0esr-4.5-1] fixup! Bug 12430: Disable external jar: via preference
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit cc60be8eee7b39138adb44c09d0905f8fb7fb0c9 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Feb 11 14:52:15 2015 -0800 fixup! Bug 12430: Disable external jar: via preference Actually, we should block remote JARs before the load. --- modules/libjar/nsJARChannel.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/libjar/nsJARChannel.cpp b/modules/libjar/nsJARChannel.cpp index f958554..6fcdac8 100644 --- a/modules/libjar/nsJARChannel.cpp +++ b/modules/libjar/nsJARChannel.cpp @@ -764,6 +764,12 @@ nsJARChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *ctx) if (NS_FAILED(rv)) return rv; + // Check preferences to see if all remote jar support should be disabled + if (!mJarFile && Preferences::GetBool("network.jar.block-remote-files", true)) { + mIsUnsafe = true; + return NS_ERROR_UNSAFE_CONTENT_TYPE; + } + // These variables must only be set if we're going to trigger an // OnStartRequest, either from AsyncRead or OnDownloadComplete. // @@ -898,7 +904,8 @@ nsJARChannel::OnDownloadComplete(nsIDownloader *downloader, mContentDisposition = NS_GetContentDispositionFromHeader(mContentDispositionHeader, this); } - // here we check preferences to see if all remote jar support should be disabled + // This is a defense-in-depth check for the preferences to see if all remote jar + // support should be disabled. This check may not be needed. if (Preferences::GetBool("network.jar.block-remote-files", true)) { mIsUnsafe = true; status = NS_ERROR_UNSAFE_CONTENT_TYPE;

1 0

[webwml/master] Combined osx and linux instructions
by sebastian＠torproject.org 11 Feb '15

11 Feb '15

commit d63f66894a2cbe021267491610885a717047bd5a Author: ilv <ilv(a)users.noreply.github.com> Date: Wed Feb 11 16:56:33 2015 -0300 Combined osx and linux instructions --- docs/en/verifying-signatures.wml | 51 ++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index 430e5e8..5396bba 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -103,18 +103,20 @@ to the developer. The best method is to meet the developer in person and exchange key fingerprints. </p> - <h3>Mac OS X</h3> + <h3>Mac OS X and Linux</h3> <hr> <p>You need to have GnuPG installed before you can verify - signatures. You can install it from <a - href="http://www.gpgtools.org/">http://www.gpgtools.org/</a>. + signatures. If you are using Mac OS X, you can install it from <a + href="http://www.gpgtools.org/">http://www.gpgtools.org/</a>. If you + are using Linux, then it's probably you already have GnuPG in your + system, as most Linux distributions come with it preinstalled. </p> - <p>Once it's installed, use GnuPG to import the key that signed + <p>The next step is to use GnuPG to import the key that signed your package. Erinn Clark signs the Tor Browsers. Import her - key (0x416F061063FEE659) by starting the terminal (under "Applications") - and typing:</p> + key (0x416F061063FEE659) by starting the terminal (under "Applications" + in Mac OS X) and typing:</p> <pre>gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659</pre> @@ -135,9 +137,14 @@ <p>To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the - package and its signature to your Desktop, run:</p> + package and its signature to your Desktop, run (where <version> stands + for the version of Tor Browser you downloaded):</p> - <pre>gpg --verify ~/Desktop/TorBrowser-<version-torbrowserbundleosx32>-osx32_en-US.dmg{.asc*,}</pre> + <strong>For Mac OS X users</strong>: + <pre>gpg --verify ~/Desktop/TorBrowser-<version>-osx32_en-US.dmg{.asc*,}</pre> + + <strong>For Linux users</strong> (change 32 by 64 if you have the 64-bit package): + <pre>gpg --verify ~/Desktop/tor-browser-linux32-<version>_en-US.tar.xz{.asc*,}</pre> <p>The output should say "Good signature": </p> @@ -158,30 +165,20 @@ to the developer. The best method is to meet the developer in person and exchange key fingerprints. </p> - - <h3>Linux</h3> - <hr> - - <p>Most Linux distributions come with gpg preinstalled, so users - who want to verify the Tor Browser for Linux (or the source - tarball) can just follow along with the instructions above for - "Mac OS X". </p> - - <p>If you're using the <b>Debian</b> Tor (not Tor Browser) packages, you - should read the - instructions on <a href="<page docs/debian>#packages">importing - these keys to apt</a>.</p> - - <p>If you're using the <b>RPMs</b> (for Tor, not Tor Browser), you can - manually verify the - signatures on the RPM packages by <pre>rpm -K filename.rpm</pre></p> + + <p> + If you're a Linux user and you're using the <b>Debian</b> Tor (not Tor + Browser) packages, you should read the instructions on <a + href="<page docs/debian>#packages">importing these keys to apt</a>. + If you're using the <b>RPMs</b> (for Tor, not Tor Browser), you can + manually verify the signatures on the RPM packages by + <pre>rpm -K filename.rpm</pre> + </p> <p>See <a href="http://www.gnupg.org/documentation/">http://www.gnupg.org/documentation/</a> to learn more about GPG.</p> - <hr> - <a id="BuildVerification"></a> <h3><a class="anchor" href="#BuildVerification"> Verifying sha256sums (advanced)</a></h3>

1 0

[webwml/master] Added missing hr and s/GPG/GnuPG/
by sebastian＠torproject.org 11 Feb '15

11 Feb '15

commit 931eb98293943c1e26f1c3160e57ef288527cb37 Author: ilv <ilv(a)users.noreply.github.com> Date: Wed Feb 11 17:00:23 2015 -0300 Added missing hr and s/GPG/GnuPG/ --- docs/en/verifying-signatures.wml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index 5396bba..d4bc169 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -177,7 +177,9 @@ <p>See <a href="http://www.gnupg.org/documentation/">http://www.gnupg.org/documentation/</a> - to learn more about GPG.</p> + to learn more about GnuPG.</p> + + <hr> <a id="BuildVerification"></a> <h3><a class="anchor" href="#BuildVerification">

1 0

[tor/master] Avoid undefined behaviour of test
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit 6ecd6e27dab79f7b6ee913edca1bec219f1cd2a0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Feb 7 14:54:21 2015 +0100 Avoid undefined behaviour of test Fixes part of bug #14478, patch idea suggested by an anonymous contributor. Thanks! --- src/test/zero_length_keys.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 0dd67c1..cd1b60d 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -30,7 +30,8 @@ if [ -z "$DATA_DIR" ]; then echo "Failure: mktemp invocation returned empty string" exit 255 fi -if [ -d "$DATA_DIR" ]; then +if [ ! -d "$DATA_DIR" ]; then + echo "$DATA_DIR" echo "Failure: mktemp invocation result doesn't point to directory" exit 255 fi @@ -40,7 +41,8 @@ trap "rm -rf '$DATA_DIR'" 0 # 'ExitRelay 0' suppresses a warning. TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0" -if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then +if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && + [ -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then echo "Failure: Previous tor keys present in tor data directory" exit 255 else @@ -53,7 +55,8 @@ else wait $TOR_PID # tor must successfully generate non-zero-length key files - if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then + if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && + [ -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then true #echo "tor generated the initial key files" else echo "Failure: tor failed to generate the initial key files" @@ -96,7 +99,8 @@ wait $TOR_PID #ls -lh "$DATA_DIR"/keys/ || exit 255 # tor must always have non-zero-length key files -if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then +if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && + [ -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then # check if the keys are different to the old ones diff -q -r "$DATA_DIR"/keys "$DATA_DIR"/keys.old > /dev/null SAME_KEYS=$?

1 0

[tor/master] Remove useless export in zero length key test
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit 136b1d8ed0deefc74fb9ddd668695f940cb1b892 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Fri Feb 6 21:56:26 2015 +0100 Remove useless export in zero length key test Fixes part of bug #14478, patch idea suggested by an anonymous contributor. Thanks! --- src/test/zero_length_keys.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 6c82c3d..729baeb 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -25,7 +25,7 @@ if [ $# -lt 1 ]; then exit $? fi -export DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` +DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` # DisableNetwork means that the ORPort won't actually be opened. # 'ExitRelay 0' suppresses a warning. TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0"

1 0

[tor/master] Don't use invalid exit values in zero length key test
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit d695f7b4235bb1a54658e5a5ba2f7ce025ffda92 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Fri Feb 6 21:53:22 2015 +0100 Don't use invalid exit values in zero length key test Shell exit values must fall into the range of [0-255], so let's honour this. In practice, the "exit -1" from the old code set an exit value of 255 on most systems, so let's pick that. Fixes part of bug #14478, patch idea suggested by an anonymous contributor. Thanks! --- src/test/zero_length_keys.sh | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 3a99ca1..6c82c3d 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -13,10 +13,10 @@ # Check tor does not overwrite existing keys (existing behaviour) # # Exit Statuses: -# -2: test failed - tor did not generate the key files on first run -# -1: a command failed - the test could not be completed # 0: test succeeded - tor regenerated/kept the files # 1: test failed - tor did not regenerate/keep the files +# 254: test failed - tor did not generate the key files on first run +# 255: a command failed - the test could not be completed # if [ $# -lt 1 ]; then @@ -32,7 +32,7 @@ TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 1234 if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then echo "Failure: Previous tor keys present in tor data directory" - exit -1 + exit 255 else echo "Generating initial tor keys" $TOR --DataDirectory "$DATA_DIR" --PidFile "$DATA_DIR"/pid & @@ -47,11 +47,11 @@ else true #echo "tor generated the initial key files" else echo "Failure: tor failed to generate the initial key files" - exit -2 + exit 254 fi fi -#ls -lh "$DATA_DIR"/keys/ || exit -1 +#ls -lh "$DATA_DIR"/keys/ || exit 255 # backup and keep/delete/create zero-length files for the keys @@ -62,17 +62,17 @@ cp -r "$DATA_DIR"/keys "$DATA_DIR"/keys.old # delete keys for -d or -z if [ "$1" != "-e" ]; then FILE_DESC="regenerates deleted" - rm "$DATA_DIR"/keys/secret_id_key || exit -1 - rm "$DATA_DIR"/keys/secret_onion_key || exit -1 - rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit -1 + rm "$DATA_DIR"/keys/secret_id_key || exit 255 + rm "$DATA_DIR"/keys/secret_onion_key || exit 255 + rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 fi # create empty files for -z if [ "$1" = "-z" ]; then FILE_DESC="regenerates zero-length" - touch "$DATA_DIR"/keys/secret_id_key || exit -1 - touch "$DATA_DIR"/keys/secret_onion_key || exit -1 - touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit -1 + touch "$DATA_DIR"/keys/secret_id_key || exit 255 + touch "$DATA_DIR"/keys/secret_onion_key || exit 255 + touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 fi echo "Running tor again to check if it $FILE_DESC keys" @@ -83,7 +83,7 @@ sleep 5 kill $TOR_PID wait $TOR_PID -#ls -lh "$DATA_DIR"/keys/ || exit -1 +#ls -lh "$DATA_DIR"/keys/ || exit 255 # tor must always have non-zero-length key files if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then

1 0

[tor/master] Check that mktemp result is a directory
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit 0a0c5d7c0e6d45789f4351c0b56511c80f13eaa0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Feb 7 14:48:06 2015 +0100 Check that mktemp result is a directory Fixes part of bug #14478, patch idea suggested by an anonymous contributor. Thanks! --- src/test/zero_length_keys.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 7c99564..0dd67c1 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -30,6 +30,10 @@ if [ -z "$DATA_DIR" ]; then echo "Failure: mktemp invocation returned empty string" exit 255 fi +if [ -d "$DATA_DIR" ]; then + echo "Failure: mktemp invocation result doesn't point to directory" + exit 255 +fi trap "rm -rf '$DATA_DIR'" 0 # DisableNetwork means that the ORPort won't actually be opened.

1 0

[tor/master] Clean up after zero length key test
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit f84a54c159e89e90fb4b3ce07a9ddfbd6f1dc8a0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Fri Feb 6 23:21:20 2015 +0100 Clean up after zero length key test --- src/test/zero_length_keys.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 729baeb..7c99564 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -26,6 +26,12 @@ if [ $# -lt 1 ]; then fi DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` +if [ -z "$DATA_DIR" ]; then + echo "Failure: mktemp invocation returned empty string" + exit 255 +fi +trap "rm -rf '$DATA_DIR'" 0 + # DisableNetwork means that the ORPort won't actually be opened. # 'ExitRelay 0' suppresses a warning. TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0"

1 0

[tor/master] Change exit code of zero_length_keys script
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit c5f176b9b0199b63ac55a5f833766dfe027f28b1 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Feb 11 21:40:49 2015 +0100 Change exit code of zero_length_keys script Weasel notes that exit codes above 128 are for when a script dies from a signal. --- src/test/zero_length_keys.sh | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index cd1b60d..eca750c 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -15,8 +15,8 @@ # Exit Statuses: # 0: test succeeded - tor regenerated/kept the files # 1: test failed - tor did not regenerate/keep the files -# 254: test failed - tor did not generate the key files on first run -# 255: a command failed - the test could not be completed +# 2: test failed - tor did not generate the key files on first run +# 3: a command failed - the test could not be completed # if [ $# -lt 1 ]; then @@ -28,12 +28,12 @@ fi DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` if [ -z "$DATA_DIR" ]; then echo "Failure: mktemp invocation returned empty string" - exit 255 + exit 3 fi if [ ! -d "$DATA_DIR" ]; then echo "$DATA_DIR" echo "Failure: mktemp invocation result doesn't point to directory" - exit 255 + exit 3 fi trap "rm -rf '$DATA_DIR'" 0 @@ -44,7 +44,7 @@ TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 1234 if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then echo "Failure: Previous tor keys present in tor data directory" - exit 255 + exit 3 else echo "Generating initial tor keys" $TOR --DataDirectory "$DATA_DIR" --PidFile "$DATA_DIR"/pid & @@ -60,11 +60,11 @@ else true #echo "tor generated the initial key files" else echo "Failure: tor failed to generate the initial key files" - exit 254 + exit 2 fi fi -#ls -lh "$DATA_DIR"/keys/ || exit 255 +#ls -lh "$DATA_DIR"/keys/ || exit 3 # backup and keep/delete/create zero-length files for the keys @@ -75,17 +75,17 @@ cp -r "$DATA_DIR"/keys "$DATA_DIR"/keys.old # delete keys for -d or -z if [ "$1" != "-e" ]; then FILE_DESC="regenerates deleted" - rm "$DATA_DIR"/keys/secret_id_key || exit 255 - rm "$DATA_DIR"/keys/secret_onion_key || exit 255 - rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 + rm "$DATA_DIR"/keys/secret_id_key || exit 3 + rm "$DATA_DIR"/keys/secret_onion_key || exit 3 + rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit 3 fi # create empty files for -z if [ "$1" = "-z" ]; then FILE_DESC="regenerates zero-length" - touch "$DATA_DIR"/keys/secret_id_key || exit 255 - touch "$DATA_DIR"/keys/secret_onion_key || exit 255 - touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 + touch "$DATA_DIR"/keys/secret_id_key || exit 3 + touch "$DATA_DIR"/keys/secret_onion_key || exit 3 + touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit 3 fi echo "Running tor again to check if it $FILE_DESC keys" @@ -96,7 +96,7 @@ sleep 5 kill $TOR_PID wait $TOR_PID -#ls -lh "$DATA_DIR"/keys/ || exit 255 +#ls -lh "$DATA_DIR"/keys/ || exit 3 # tor must always have non-zero-length key files if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] &&

1 0

[tor/master] Merge branch 'bug14478_squashed'
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit f794a091647050efa97719581f99c453b38074dd Merge: 99e915d dfb409b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 11 15:59:41 2015 -0500 Merge branch 'bug14478_squashed' src/test/zero_length_keys.sh | 47 +++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 17 deletions(-)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits February 2015