February 2015 - tor-commits - lists.torproject.org

[tor-browser/tor-browser-31.4.0esr-4.5-1] Bug 12430: Disable external jar: via preference
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit a4a1c52ccc7f8e5f60c2d0e35d40b3b5f5ddd71f Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 30 16:05:21 2015 +0000 Bug 12430: Disable external jar: via preference This is a patch written by Jeff Gibat (iSECPartners) to disable the jar: protocol handler via a preference. The preference is bound to the security slider settings (#9387). --- modules/libjar/nsJARChannel.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/libjar/nsJARChannel.cpp b/modules/libjar/nsJARChannel.cpp index d190973..f958554 100644 --- a/modules/libjar/nsJARChannel.cpp +++ b/modules/libjar/nsJARChannel.cpp @@ -898,6 +898,12 @@ nsJARChannel::OnDownloadComplete(nsIDownloader *downloader, mContentDisposition = NS_GetContentDispositionFromHeader(mContentDispositionHeader, this); } + // here we check preferences to see if all remote jar support should be disabled + if (Preferences::GetBool("network.jar.block-remote-files", true)) { + mIsUnsafe = true; + status = NS_ERROR_UNSAFE_CONTENT_TYPE; + } + if (NS_SUCCEEDED(status) && mIsUnsafe && !Preferences::GetBool("network.jar.open-unsafe-types", false)) { status = NS_ERROR_UNSAFE_CONTENT_TYPE;

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by mikeperry＠torproject.org 11 Feb '15

11 Feb '15

commit c8a640f0818a968170149dad9bd8ebc1198ee9f1 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 30 16:13:06 2015 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. --- browser/app/profile/000-tor-browser.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index fd0a35c..dff718a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -160,6 +160,11 @@ pref("layers.acceleration.disabled", true); // in FF24. This is a dangerous combination (spotted by iSec) pref("media.audio_data.enabled", false); +// If true, remote JAR files will not be opened, regardless of content type +// Patch done by Jeff Gibat (iSEC). We bind it to the security slider but allow +// jar: in default mode. +pref("network.jar.block-remote-files", false); + // Enable TLS 1.1 and 1.2: // https://trac.torproject.org/projects/tor/ticket/11253 pref("security.tls.version.max", 3);

1 0

[webwml/master] Added missing hr and s/GPG/GnuPG/
by sebastian＠torproject.org 11 Feb '15

11 Feb '15

commit 931eb98293943c1e26f1c3160e57ef288527cb37 Author: ilv <ilv(a)users.noreply.github.com> Date: Wed Feb 11 17:00:23 2015 -0300 Added missing hr and s/GPG/GnuPG/ --- docs/en/verifying-signatures.wml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index 5396bba..d4bc169 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -177,7 +177,9 @@ <p>See <a href="http://www.gnupg.org/documentation/">http://www.gnupg.org/documentation/</a> - to learn more about GPG.</p> + to learn more about GnuPG.</p> + + <hr> <a id="BuildVerification"></a> <h3><a class="anchor" href="#BuildVerification">

1 0

[webwml/master] Combined osx and linux instructions
by sebastian＠torproject.org 11 Feb '15

11 Feb '15

commit d63f66894a2cbe021267491610885a717047bd5a Author: ilv <ilv(a)users.noreply.github.com> Date: Wed Feb 11 16:56:33 2015 -0300 Combined osx and linux instructions --- docs/en/verifying-signatures.wml | 51 ++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/docs/en/verifying-signatures.wml b/docs/en/verifying-signatures.wml index 430e5e8..5396bba 100644 --- a/docs/en/verifying-signatures.wml +++ b/docs/en/verifying-signatures.wml @@ -103,18 +103,20 @@ to the developer. The best method is to meet the developer in person and exchange key fingerprints. </p> - <h3>Mac OS X</h3> + <h3>Mac OS X and Linux</h3> <hr> <p>You need to have GnuPG installed before you can verify - signatures. You can install it from <a - href="http://www.gpgtools.org/">http://www.gpgtools.org/</a>. + signatures. If you are using Mac OS X, you can install it from <a + href="http://www.gpgtools.org/">http://www.gpgtools.org/</a>. If you + are using Linux, then it's probably you already have GnuPG in your + system, as most Linux distributions come with it preinstalled. </p> - <p>Once it's installed, use GnuPG to import the key that signed + <p>The next step is to use GnuPG to import the key that signed your package. Erinn Clark signs the Tor Browsers. Import her - key (0x416F061063FEE659) by starting the terminal (under "Applications") - and typing:</p> + key (0x416F061063FEE659) by starting the terminal (under "Applications" + in Mac OS X) and typing:</p> <pre>gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 0x416F061063FEE659</pre> @@ -135,9 +137,14 @@ <p>To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the - package and its signature to your Desktop, run:</p> + package and its signature to your Desktop, run (where <version> stands + for the version of Tor Browser you downloaded):</p> - <pre>gpg --verify ~/Desktop/TorBrowser-<version-torbrowserbundleosx32>-osx32_en-US.dmg{.asc*,}</pre> + <strong>For Mac OS X users</strong>: + <pre>gpg --verify ~/Desktop/TorBrowser-<version>-osx32_en-US.dmg{.asc*,}</pre> + + <strong>For Linux users</strong> (change 32 by 64 if you have the 64-bit package): + <pre>gpg --verify ~/Desktop/tor-browser-linux32-<version>_en-US.tar.xz{.asc*,}</pre> <p>The output should say "Good signature": </p> @@ -158,30 +165,20 @@ to the developer. The best method is to meet the developer in person and exchange key fingerprints. </p> - - <h3>Linux</h3> - <hr> - - <p>Most Linux distributions come with gpg preinstalled, so users - who want to verify the Tor Browser for Linux (or the source - tarball) can just follow along with the instructions above for - "Mac OS X". </p> - - <p>If you're using the <b>Debian</b> Tor (not Tor Browser) packages, you - should read the - instructions on <a href="<page docs/debian>#packages">importing - these keys to apt</a>.</p> - - <p>If you're using the <b>RPMs</b> (for Tor, not Tor Browser), you can - manually verify the - signatures on the RPM packages by <pre>rpm -K filename.rpm</pre></p> + + <p> + If you're a Linux user and you're using the <b>Debian</b> Tor (not Tor + Browser) packages, you should read the instructions on <a + href="<page docs/debian>#packages">importing these keys to apt</a>. + If you're using the <b>RPMs</b> (for Tor, not Tor Browser), you can + manually verify the signatures on the RPM packages by + <pre>rpm -K filename.rpm</pre> + </p> <p>See <a href="http://www.gnupg.org/documentation/">http://www.gnupg.org/documentation/</a> to learn more about GPG.</p> - <hr> - <a id="BuildVerification"></a> <h3><a class="anchor" href="#BuildVerification"> Verifying sha256sums (advanced)</a></h3>

1 0

[tor/master] Put error messages to stderr
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit dfb409b8b0b9bfcc4531e0a41b1924d55128c991 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Feb 11 21:43:41 2015 +0100 Put error messages to stderr Thanks weasel :) Also remove stray debug output --- src/test/zero_length_keys.sh | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index eca750c..81ba3e0 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -27,12 +27,11 @@ fi DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` if [ -z "$DATA_DIR" ]; then - echo "Failure: mktemp invocation returned empty string" + echo "Failure: mktemp invocation returned empty string" >&2 exit 3 fi if [ ! -d "$DATA_DIR" ]; then - echo "$DATA_DIR" - echo "Failure: mktemp invocation result doesn't point to directory" + echo "Failure: mktemp invocation result doesn't point to directory" >&2 exit 3 fi trap "rm -rf '$DATA_DIR'" 0 @@ -43,7 +42,7 @@ TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 1234 if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then - echo "Failure: Previous tor keys present in tor data directory" + echo "Failure: Previous tor keys present in tor data directory" >&2 exit 3 else echo "Generating initial tor keys"

1 0

[tor/master] Merge branch 'bug14478_squashed'
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit f794a091647050efa97719581f99c453b38074dd Merge: 99e915d dfb409b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 11 15:59:41 2015 -0500 Merge branch 'bug14478_squashed' src/test/zero_length_keys.sh | 47 +++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 17 deletions(-)

1 0

[tor/master] Change exit code of zero_length_keys script
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit c5f176b9b0199b63ac55a5f833766dfe027f28b1 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Feb 11 21:40:49 2015 +0100 Change exit code of zero_length_keys script Weasel notes that exit codes above 128 are for when a script dies from a signal. --- src/test/zero_length_keys.sh | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index cd1b60d..eca750c 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -15,8 +15,8 @@ # Exit Statuses: # 0: test succeeded - tor regenerated/kept the files # 1: test failed - tor did not regenerate/keep the files -# 254: test failed - tor did not generate the key files on first run -# 255: a command failed - the test could not be completed +# 2: test failed - tor did not generate the key files on first run +# 3: a command failed - the test could not be completed # if [ $# -lt 1 ]; then @@ -28,12 +28,12 @@ fi DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` if [ -z "$DATA_DIR" ]; then echo "Failure: mktemp invocation returned empty string" - exit 255 + exit 3 fi if [ ! -d "$DATA_DIR" ]; then echo "$DATA_DIR" echo "Failure: mktemp invocation result doesn't point to directory" - exit 255 + exit 3 fi trap "rm -rf '$DATA_DIR'" 0 @@ -44,7 +44,7 @@ TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 1234 if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then echo "Failure: Previous tor keys present in tor data directory" - exit 255 + exit 3 else echo "Generating initial tor keys" $TOR --DataDirectory "$DATA_DIR" --PidFile "$DATA_DIR"/pid & @@ -60,11 +60,11 @@ else true #echo "tor generated the initial key files" else echo "Failure: tor failed to generate the initial key files" - exit 254 + exit 2 fi fi -#ls -lh "$DATA_DIR"/keys/ || exit 255 +#ls -lh "$DATA_DIR"/keys/ || exit 3 # backup and keep/delete/create zero-length files for the keys @@ -75,17 +75,17 @@ cp -r "$DATA_DIR"/keys "$DATA_DIR"/keys.old # delete keys for -d or -z if [ "$1" != "-e" ]; then FILE_DESC="regenerates deleted" - rm "$DATA_DIR"/keys/secret_id_key || exit 255 - rm "$DATA_DIR"/keys/secret_onion_key || exit 255 - rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 + rm "$DATA_DIR"/keys/secret_id_key || exit 3 + rm "$DATA_DIR"/keys/secret_onion_key || exit 3 + rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit 3 fi # create empty files for -z if [ "$1" = "-z" ]; then FILE_DESC="regenerates zero-length" - touch "$DATA_DIR"/keys/secret_id_key || exit 255 - touch "$DATA_DIR"/keys/secret_onion_key || exit 255 - touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 + touch "$DATA_DIR"/keys/secret_id_key || exit 3 + touch "$DATA_DIR"/keys/secret_onion_key || exit 3 + touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit 3 fi echo "Running tor again to check if it $FILE_DESC keys" @@ -96,7 +96,7 @@ sleep 5 kill $TOR_PID wait $TOR_PID -#ls -lh "$DATA_DIR"/keys/ || exit 255 +#ls -lh "$DATA_DIR"/keys/ || exit 3 # tor must always have non-zero-length key files if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] &&

1 0

[tor/master] Clean up after zero length key test
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit f84a54c159e89e90fb4b3ce07a9ddfbd6f1dc8a0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Fri Feb 6 23:21:20 2015 +0100 Clean up after zero length key test --- src/test/zero_length_keys.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 729baeb..7c99564 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -26,6 +26,12 @@ if [ $# -lt 1 ]; then fi DATA_DIR=`mktemp -d -t tor_zero_length_keys.XXXXXX` +if [ -z "$DATA_DIR" ]; then + echo "Failure: mktemp invocation returned empty string" + exit 255 +fi +trap "rm -rf '$DATA_DIR'" 0 + # DisableNetwork means that the ORPort won't actually be opened. # 'ExitRelay 0' suppresses a warning. TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0"

1 0

[tor/master] Check that mktemp result is a directory
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit 0a0c5d7c0e6d45789f4351c0b56511c80f13eaa0 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Feb 7 14:48:06 2015 +0100 Check that mktemp result is a directory Fixes part of bug #14478, patch idea suggested by an anonymous contributor. Thanks! --- src/test/zero_length_keys.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 7c99564..0dd67c1 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -30,6 +30,10 @@ if [ -z "$DATA_DIR" ]; then echo "Failure: mktemp invocation returned empty string" exit 255 fi +if [ -d "$DATA_DIR" ]; then + echo "Failure: mktemp invocation result doesn't point to directory" + exit 255 +fi trap "rm -rf '$DATA_DIR'" 0 # DisableNetwork means that the ORPort won't actually be opened.

1 0

[tor/master] Don't use invalid exit values in zero length key test
by nickm＠torproject.org 11 Feb '15

11 Feb '15

commit d695f7b4235bb1a54658e5a5ba2f7ce025ffda92 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Fri Feb 6 21:53:22 2015 +0100 Don't use invalid exit values in zero length key test Shell exit values must fall into the range of [0-255], so let's honour this. In practice, the "exit -1" from the old code set an exit value of 255 on most systems, so let's pick that. Fixes part of bug #14478, patch idea suggested by an anonymous contributor. Thanks! --- src/test/zero_length_keys.sh | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 3a99ca1..6c82c3d 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -13,10 +13,10 @@ # Check tor does not overwrite existing keys (existing behaviour) # # Exit Statuses: -# -2: test failed - tor did not generate the key files on first run -# -1: a command failed - the test could not be completed # 0: test succeeded - tor regenerated/kept the files # 1: test failed - tor did not regenerate/keep the files +# 254: test failed - tor did not generate the key files on first run +# 255: a command failed - the test could not be completed # if [ $# -lt 1 ]; then @@ -32,7 +32,7 @@ TOR="./src/or/tor --hush --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 1234 if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then echo "Failure: Previous tor keys present in tor data directory" - exit -1 + exit 255 else echo "Generating initial tor keys" $TOR --DataDirectory "$DATA_DIR" --PidFile "$DATA_DIR"/pid & @@ -47,11 +47,11 @@ else true #echo "tor generated the initial key files" else echo "Failure: tor failed to generate the initial key files" - exit -2 + exit 254 fi fi -#ls -lh "$DATA_DIR"/keys/ || exit -1 +#ls -lh "$DATA_DIR"/keys/ || exit 255 # backup and keep/delete/create zero-length files for the keys @@ -62,17 +62,17 @@ cp -r "$DATA_DIR"/keys "$DATA_DIR"/keys.old # delete keys for -d or -z if [ "$1" != "-e" ]; then FILE_DESC="regenerates deleted" - rm "$DATA_DIR"/keys/secret_id_key || exit -1 - rm "$DATA_DIR"/keys/secret_onion_key || exit -1 - rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit -1 + rm "$DATA_DIR"/keys/secret_id_key || exit 255 + rm "$DATA_DIR"/keys/secret_onion_key || exit 255 + rm "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 fi # create empty files for -z if [ "$1" = "-z" ]; then FILE_DESC="regenerates zero-length" - touch "$DATA_DIR"/keys/secret_id_key || exit -1 - touch "$DATA_DIR"/keys/secret_onion_key || exit -1 - touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit -1 + touch "$DATA_DIR"/keys/secret_id_key || exit 255 + touch "$DATA_DIR"/keys/secret_onion_key || exit 255 + touch "$DATA_DIR"/keys/secret_onion_key_ntor || exit 255 fi echo "Running tor again to check if it $FILE_DESC keys" @@ -83,7 +83,7 @@ sleep 5 kill $TOR_PID wait $TOR_PID -#ls -lh "$DATA_DIR"/keys/ || exit -1 +#ls -lh "$DATA_DIR"/keys/ || exit 255 # tor must always have non-zero-length key files if [ -s "$DATA_DIR"/keys/secret_id_key -a -s "$DATA_DIR"/keys/secret_onion_key -a -s "$DATA_DIR"/keys/secret_onion_key_ntor ]; then

1 0