tor-commits June 2016

tor-commits@lists.torproject.org

20 participants
1204 discussions

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1229284 - Remove support for SHA-1 hashes in genHPKPStaticPins.js. r=keeler
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 877657a30dd959d33921225260afe73d18aef977 Author: Cykesiopka <cykesiopka.bmo(a)gmail.com> Date: Thu Dec 17 07:52:00 2015 +0100 Bug 1229284 - Remove support for SHA-1 hashes in genHPKPStaticPins.js. r=keeler --- security/manager/tools/genHPKPStaticPins.js | 104 +++++++++------------------- 1 file changed, 32 insertions(+), 72 deletions(-) diff --git a/security/manager/tools/genHPKPStaticPins.js b/security/manager/tools/genHPKPStaticPins.js index c9e3472..8a91fff 100644 --- a/security/manager/tools/genHPKPStaticPins.js +++ b/security/manager/tools/genHPKPStaticPins.js @@ -10,6 +10,7 @@ // [absolute path to]/PreloadedHPKPins.json \ // [an unused argument - see bug 1205406] \ // [absolute path to]/StaticHPKPins.h +"use strict"; if (arguments.length != 3) { throw "Usage: genHPKPStaticPins.js " + @@ -28,7 +29,6 @@ var gCertDB = Cc["@mozilla.org/security/x509certdb;1"] .getService(Ci.nsIX509CertDB); const BUILT_IN_NICK_PREFIX = "Builtin Object Token:"; -const SHA1_PREFIX = "sha1/"; const SHA256_PREFIX = "sha256/"; const GOOGLE_PIN_PREFIX = "GOOGLE_PIN_"; @@ -53,7 +53,7 @@ const DOMAINHEADER = "/* Domainlist */\n" + " const bool mTestMode;\n" + " const bool mIsMoz;\n" + " const int32_t mId;\n" + - " const StaticPinset *pinset;\n" + + " const StaticPinset* pinset;\n" + "};\n\n"; const PINSETDEF = "/* Pinsets are each an ordered list by the actual value of the fingerprint */\n" + @@ -164,13 +164,13 @@ function getSKDFromPem(pem) { } /** - * Hashes |input| using the SHA1 algorithm in the following manner: - * btoa(sha1(atob(input))) + * Hashes |input| using the SHA-256 algorithm in the following manner: + * btoa(sha256(atob(input))) * * @argument {String} input Base64 string to decode and return the hash of. - * @returns {String} Base64 encoded SHA1 hash. + * @returns {String} Base64 encoded SHA-256 hash. */ -function sha1Base64(input) { +function sha256Base64(input) { let decodedValue; try { decodedValue = atob(input); @@ -191,7 +191,7 @@ function sha1Base64(input) { let hasher = Cc["@mozilla.org/security/hash;1"] .createInstance(Ci.nsICryptoHash); - hasher.init(hasher.SHA1); + hasher.init(hasher.SHA256); hasher.update(data, data.length); // true is passed so that the hasher returns a Base64 encoded string. @@ -201,11 +201,11 @@ function sha1Base64(input) { // Downloads the static certs file and tries to map Google Chrome nicknames // to Mozilla nicknames, as well as storing any hashes for pins for which we // don't have root PEMs. Each entry consists of a line containing the name of -// the pin followed either by a hash in the format "sha1/" + base64(hash), a -// hash in the format "sha256/" + base64(hash), a PEM encoded public key, or -// a PEM encoded certificate. For certificates that we have in our database, +// the pin followed either by a hash in the format "sha256/" + base64(hash), +// a PEM encoded public key, or a PEM encoded certificate. +// For certificates that we have in our database, // return a map of Google's nickname to ours. For ones that aren't return a -// map of Google's nickname to sha1 values. This code is modeled after agl's +// map of Google's nickname to SHA-256 values. This code is modeled after agl's // https://github.com/agl/transport-security-state-generate, which doesn't // live in the Chromium repo because go is not an official language in // Chromium. @@ -216,7 +216,7 @@ function sha1Base64(input) { // and stick the hash in certSKDToName // We MUST be able to find a corresponding cert nickname for the Chrome names, // otherwise we skip all pinsets referring to that Chrome name. -function downloadAndParseChromeCerts(filename, certSKDToName) { +function downloadAndParseChromeCerts(filename, certNameToSKD, certSKDToName) { // Prefixes that we care about. const BEGIN_CERT = "-----BEGIN CERTIFICATE-----"; const END_CERT = "-----END CERTIFICATE-----"; @@ -238,8 +238,7 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { let chromeNameToHash = {}; let chromeNameToMozName = {}; let chromeName; - for (let i = 0; i < lines.length; ++i) { - let line = lines[i]; + for (let line of lines) { // Skip comments and newlines. if (line.length == 0 || line[0] == '#') { continue; @@ -250,18 +249,9 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { state = POST_NAME; break; case POST_NAME: - // TODO(bug 1229284): Chromium no longer uses SHA1 hashes, so remove - // code like this supporting SHA1. - if (line.startsWith(SHA1_PREFIX) || - line.startsWith(SHA256_PREFIX)) { - if (line.startsWith(SHA1_PREFIX)) { - hash = line.substring(SHA1_PREFIX.length); - } else if (line.startsWith(SHA256_PREFIX)) { - hash = line.substring(SHA256_PREFIX.length); - } - // Store the entire prefixed hash, so we can disambiguate sha1 from - // sha256 later. - chromeNameToHash[chromeName] = line; + if (line.startsWith(SHA256_PREFIX)) { + hash = line.substring(SHA256_PREFIX.length); + chromeNameToHash[chromeName] = hash; certNameToSKD[chromeName] = hash; certSKDToName[hash] = chromeName; state = PRE_NAME; @@ -298,12 +288,9 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { case IN_PUB_KEY: if (line.startsWith(END_PUB_KEY)) { state = PRE_NAME; - // TODO(bug 1229284): Switch to SHA-256 instead. SHA1 is used here - // mainly to confirm that the changes made to support public keys are - // correct and don't change any hashes. - hash = sha1Base64(pemPubKey); + hash = sha256Base64(pemPubKey); pemPubKey = ""; - chromeNameToHash[chromeName] = SHA1_PREFIX + hash; + chromeNameToHash[chromeName] = hash; certNameToSKD[chromeName] = hash; certSKDToName[hash] = chromeName; } else { @@ -325,7 +312,6 @@ function downloadAndParseChromeCerts(filename, certSKDToName) { // { // pinset_name : { // // Array of names with entries in certNameToSKD -// sha1_hashes: [], // sha256_hashes: [] // } // } @@ -344,20 +330,13 @@ function downloadAndParseChromePins(filename, chromePins.forEach(function(pin) { let valid = true; - let pinset = { name: pin.name, sha1_hashes: [], sha256_hashes: [] }; + let pinset = { name: pin.name, sha256_hashes: [] }; // Translate the Chrome pinset format to ours pin.static_spki_hashes.forEach(function(name) { if (name in chromeNameToHash) { let hash = chromeNameToHash[name]; - if (hash.startsWith(SHA1_PREFIX)) { - hash = hash.substring(SHA1_PREFIX.length); - pinset.sha1_hashes.push(certSKDToName[hash]); - } else if (hash.startsWith(SHA256_PREFIX)) { - hash = hash.substring(SHA256_PREFIX.length); - pinset.sha256_hashes.push(certSKDToName[hash]); - } else { - throw("Unsupported hash type: " + chromeNameToHash[name]); - } + pinset.sha256_hashes.push(certSKDToName[hash]); + // We should have already added hashes for all of these when we // imported the certificate file. if (!certNameToSKD[name]) { @@ -478,26 +457,18 @@ function genExpirationTime() { } function writeFullPinset(certNameToSKD, certSKDToName, pinset) { - // We aren't guaranteed to have sha1 hashes in our own imported pins. let prefix = "kPinset_" + pinset.name; - let sha1Name = "nullptr"; - let sha256Name = "nullptr"; - if (pinset.sha1_hashes && pinset.sha1_hashes.length > 0) { - writeFingerprints(certNameToSKD, certSKDToName, pinset.name, - pinset.sha1_hashes, "sha1"); - sha1Name = "&" + prefix + "_sha1"; - } - if (pinset.sha256_hashes && pinset.sha256_hashes.length > 0) { - writeFingerprints(certNameToSKD, certSKDToName, pinset.name, - pinset.sha256_hashes, "sha256"); - sha256Name = "&" + prefix + "_sha256"; + if (!pinset.sha256_hashes || pinset.sha256_hashes.length == 0) { + throw `ERROR: Pinset ${pinset.name} does not contain any hashes.`; } + writeFingerprints(certNameToSKD, certSKDToName, pinset.name, + pinset.sha256_hashes); writeString("static const StaticPinset " + prefix + " = {\n" + - " " + sha1Name + ",\n " + sha256Name + "\n};\n\n"); + " nullptr,\n &" + prefix + "_sha256\n};\n\n"); } -function writeFingerprints(certNameToSKD, certSKDToName, name, hashes, type) { - let varPrefix = "kPinset_" + name + "_" + type; +function writeFingerprints(certNameToSKD, certSKDToName, name, hashes) { + let varPrefix = "kPinset_" + name + "_sha256"; writeString("static const char* " + varPrefix + "_Data[] = {\n"); let SKDList = []; for (let certName of hashes) { @@ -595,23 +566,12 @@ function writeFile(certNameToSKD, certSKDToName, let mozillaPins = {}; gStaticPins.pinsets.forEach(function(pinset) { mozillaPins[pinset.name] = true; - // We aren't guaranteed to have sha1_hashes in our own JSON. - if (pinset.sha1_hashes) { - pinset.sha1_hashes.forEach(function(name) { - usedFingerprints[name] = true; - }); - } - if (pinset.sha256_hashes) { - pinset.sha256_hashes.forEach(function(name) { - usedFingerprints[name] = true; - }); - } + pinset.sha256_hashes.forEach(function (name) { + usedFingerprints[name] = true; + }); }); for (let key in chromeImportedPinsets) { let pinset = chromeImportedPinsets[key]; - pinset.sha1_hashes.forEach(function(name) { - usedFingerprints[name] = true; - }); pinset.sha256_hashes.forEach(function(name) { usedFingerprints[name] = true; }); @@ -663,7 +623,7 @@ function loadExtraCertificates(certStringList) { var extraCertificates = loadExtraCertificates(gStaticPins.extra_certificates); var [ certNameToSKD, certSKDToName ] = loadNSSCertinfo(extraCertificates); var [ chromeNameToHash, chromeNameToMozName ] = downloadAndParseChromeCerts( - gStaticPins.chromium_data.cert_file_url, certSKDToName); + gStaticPins.chromium_data.cert_file_url, certNameToSKD, certSKDToName); var [ chromeImportedPinsets, chromeImportedEntries ] = downloadAndParseChromePins(gStaticPins.chromium_data.json_file_url, chromeNameToHash, chromeNameToMozName, certNameToSKD, certSKDToName);

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1233328 - Part 1: Ignore SHA-1 pins in PublicKeyPinningService.cpp. r=keeler
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit cc0fcf624033578259dab28ccaaa90bbd85d3a12 Author: Cykesiopka <cykesiopka.bmo(a)gmail.com> Date: Wed Jan 20 20:40:01 2016 -0800 Bug 1233328 - Part 1: Ignore SHA-1 pins in PublicKeyPinningService.cpp. r=keeler --- security/manager/ssl/PublicKeyPinningService.cpp | 88 ++++++++---------------- security/manager/ssl/PublicKeyPinningService.h | 18 +++-- 2 files changed, 35 insertions(+), 71 deletions(-) diff --git a/security/manager/ssl/PublicKeyPinningService.cpp b/security/manager/ssl/PublicKeyPinningService.cpp index 073b3db..7fa7bf7 100644 --- a/security/manager/ssl/PublicKeyPinningService.cpp +++ b/security/manager/ssl/PublicKeyPinningService.cpp @@ -31,12 +31,11 @@ PRLogModuleInfo* gPublicKeyPinningLog = of the DER Encoded subject Public Key Info for the given cert */ static nsresult -GetBase64HashSPKI(const CERTCertificate* cert, SECOidTag hashType, - nsACString& hashSPKIDigest) +GetBase64HashSPKI(const CERTCertificate* cert, nsACString& hashSPKIDigest) { hashSPKIDigest.Truncate(); Digest digest; - nsresult rv = digest.DigestBuf(hashType, cert->derPublicKey.data, + nsresult rv = digest.DigestBuf(SEC_OID_SHA256, cert->derPublicKey.data, cert->derPublicKey.len); if (NS_FAILED(rv)) { return rv; @@ -48,24 +47,23 @@ GetBase64HashSPKI(const CERTCertificate* cert, SECOidTag hashType, } /* - * Returns true if a given cert matches any hashType fingerprints from the - * given pinset or the dynamicFingeprints array, false otherwise. + * Sets certMatchesPinset to true if a given cert matches any fingerprints from + * the given pinset or the dynamicFingerprints array, or to false otherwise. */ static nsresult -EvalCertWithHashType(const CERTCertificate* cert, SECOidTag hashType, - const StaticFingerprints* fingerprints, - const nsTArray<nsCString>* dynamicFingerprints, - /*out*/ bool& certMatchesPinset) +EvalCert(const CERTCertificate* cert, const StaticFingerprints* fingerprints, + const nsTArray<nsCString>* dynamicFingerprints, + /*out*/ bool& certMatchesPinset) { certMatchesPinset = false; if (!fingerprints && !dynamicFingerprints) { MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, - ("pkpin: No hashes found for hash type: %d\n", hashType)); + ("pkpin: No hashes found\n")); return NS_ERROR_INVALID_ARG; } nsAutoCString base64Out; - nsresult rv = GetBase64HashSPKI(cert, hashType, base64Out); + nsresult rv = GetBase64HashSPKI(cert, base64Out); if (NS_FAILED(rv)) { MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, ("pkpin: GetBase64HashSPKI failed!\n")); @@ -96,30 +94,25 @@ EvalCertWithHashType(const CERTCertificate* cert, SECOidTag hashType, } /* - * Returns true if a given chain matches any hashType fingerprints from the - * given pinset or the dynamicFingerprints array, false otherwise. + * Sets certListIntersectsPinset to true if a given chain matches any + * fingerprints from the given pinset or the dynamicFingerprints array, or to + * false otherwise. */ static nsresult -EvalChainWithHashType(const CERTCertList* certList, SECOidTag hashType, - const StaticPinset* pinset, - const nsTArray<nsCString>* dynamicFingerprints, - /*out*/ bool& certListIntersectsPinset) +EvalChain(const CERTCertList* certList, const StaticPinset* pinset, + const nsTArray<nsCString>* dynamicFingerprints, + /*out*/ bool& certListIntersectsPinset) { certListIntersectsPinset = false; CERTCertificate* currentCert; const StaticFingerprints* fingerprints = nullptr; if (pinset) { - if (hashType == SEC_OID_SHA256) { - fingerprints = pinset->sha256; - } else if (hashType == SEC_OID_SHA1) { - fingerprints = pinset->sha1; - } + fingerprints = pinset->sha256; } - // This can happen if dynamicFingerprints is null and the static pinset - // doesn't have any pins of this hash type. if (!fingerprints && !dynamicFingerprints) { - return NS_OK; + MOZ_ASSERT(false, "Must pass in at least one type of pinset"); + return NS_ERROR_FAILURE; } CERTCertListNode* node; @@ -130,9 +123,8 @@ EvalChainWithHashType(const CERTCertList* certList, SECOidTag hashType, ("pkpin: certArray subject: '%s'\n", currentCert->subjectName)); MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, ("pkpin: certArray issuer: '%s'\n", currentCert->issuerName)); - nsresult rv = EvalCertWithHashType(currentCert, hashType, fingerprints, - dynamicFingerprints, - certListIntersectsPinset); + nsresult rv = EvalCert(currentCert, fingerprints, dynamicFingerprints, + certListIntersectsPinset); if (NS_FAILED(rv)) { return rv; } @@ -145,29 +137,6 @@ EvalChainWithHashType(const CERTCertList* certList, SECOidTag hashType, } /** - * Given a pinset and certlist, return true if one of the certificates on - * the list matches a fingerprint in the pinset, false otherwise. - */ -static nsresult -EvalChainWithPinset(const CERTCertList* certList, - const StaticPinset* pinset, - /*out*/ bool& certListIntersectsPinset) -{ - certListIntersectsPinset = false; - // SHA256 is more trustworthy, try that first. - nsresult rv = EvalChainWithHashType(certList, SEC_OID_SHA256, pinset, - nullptr, certListIntersectsPinset); - if (NS_FAILED(rv)) { - return rv; - } - if (certListIntersectsPinset) { - return NS_OK; - } - return EvalChainWithHashType(certList, SEC_OID_SHA1, pinset, nullptr, - certListIntersectsPinset); -} - -/** Comparator for the is public key pinned host. */ static int @@ -184,8 +153,7 @@ PublicKeyPinningService::ChainMatchesPinset(const CERTCertList* certList, const nsTArray<nsCString>& aSHA256keys, /*out*/ bool& chainMatchesPinset) { - return EvalChainWithHashType(certList, SEC_OID_SHA256, nullptr, &aSHA256keys, - chainMatchesPinset); + return EvalChain(certList, nullptr, &aSHA256keys, chainMatchesPinset); } // Returns via one of the output parameters the most relevant pinning @@ -206,10 +174,9 @@ FindPinningInformation(const char* hostname, mozilla::pkix::Time time, if (!sssService) { return NS_ERROR_FAILURE; } - SiteHPKPState dynamicEntry; - TransportSecurityPreload *foundEntry = nullptr; - char *evalHost = const_cast<char*>(hostname); - char *evalPart; + TransportSecurityPreload* foundEntry = nullptr; + char* evalHost = const_cast<char*>(hostname); + char* evalPart; // Notice how the (xx = strchr) prevents pins for unqualified domain names. while (!foundEntry && (evalPart = strchr(evalHost, '.'))) { MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, @@ -293,13 +260,12 @@ CheckPinsForHostname(const CERTCertList* certList, const char* hostname, return NS_OK; } if (dynamicFingerprints.Length() > 0) { - return EvalChainWithHashType(certList, SEC_OID_SHA256, nullptr, - &dynamicFingerprints, chainHasValidPins); + return EvalChain(certList, nullptr, &dynamicFingerprints, chainHasValidPins); } if (staticFingerprints) { bool enforceTestModeResult; - rv = EvalChainWithPinset(certList, staticFingerprints->pinset, - enforceTestModeResult); + rv = EvalChain(certList, staticFingerprints->pinset, nullptr, + enforceTestModeResult); if (NS_FAILED(rv)) { return rv; } diff --git a/security/manager/ssl/PublicKeyPinningService.h b/security/manager/ssl/PublicKeyPinningService.h index 9a02ab9..601f624 100644 --- a/security/manager/ssl/PublicKeyPinningService.h +++ b/security/manager/ssl/PublicKeyPinningService.h @@ -18,13 +18,11 @@ class PublicKeyPinningService { public: /** - * Returns true if the given (host, certList) passes pinning checks, - * false otherwise. If the host is pinned, return true if one of the keys in - * the given certificate chain matches the pin set specified by the - * hostname. If the hostname is null or empty evaluate against all the - * possible names for the EE cert (Common Name (CN) plus all DNS Name: - * subject Alt Name entries). The certList's head is the EE cert and the - * tail is the trust anchor. + * Sets chainHasValidPins to true if the given (host, certList) passes pinning + * checks, or to false otherwise. If the host is pinned, returns true via + * chainHasValidPins if one of the keys in the given certificate chain matches + * the pin set specified by the hostname. The certList's head is the EE cert + * and the tail is the trust anchor. * Note: if an alt name is a wildcard, it won't necessarily find a pinset * that would otherwise be valid for it */ @@ -35,9 +33,9 @@ public: /*out*/ bool& chainHasValidPins, /*optional out*/ PinningTelemetryInfo* pinningTelemetryInfo); /** - * Returns true if there is any intersection between the certificate list - * and the pins specified in the aSHA256key array. Values passed in are - * assumed to be in base64 encoded form + * Sets chainMatchesPinset to true if there is any intersection between the + * certificate list and the pins specified in the aSHA256keys array. + * Values passed in are assumed to be in base64 encoded form. */ static nsresult ChainMatchesPinset(const CERTCertList* certList, const nsTArray<nsCString>& aSHA256keys,

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 1233328 - Part 2: Use SHA-256 StaticFingerprints directly instead of StaticPinset since the SHA-1 StaticFingerprints entry will always be null. r=keeler
by gk＠torproject.org 03 Jun '16

03 Jun '16

commit 3832c89a58e2b526a40e6399dceec3c21524f01a Author: Cykesiopka <cykesiopka.bmo(a)gmail.com> Date: Wed Jan 20 20:45:29 2016 -0800 Bug 1233328 - Part 2: Use SHA-256 StaticFingerprints directly instead of StaticPinset since the SHA-1 StaticFingerprints entry will always be null. r=keeler --- security/manager/ssl/PublicKeyPinningService.cpp | 10 +- security/manager/ssl/StaticHPKPins.h | 259 ++++++----------------- security/manager/tools/genHPKPStaticPins.js | 10 +- 3 files changed, 75 insertions(+), 204 deletions(-) diff --git a/security/manager/ssl/PublicKeyPinningService.cpp b/security/manager/ssl/PublicKeyPinningService.cpp index 7fa7bf7..d6fcd0b 100644 --- a/security/manager/ssl/PublicKeyPinningService.cpp +++ b/security/manager/ssl/PublicKeyPinningService.cpp @@ -95,21 +95,17 @@ EvalCert(const CERTCertificate* cert, const StaticFingerprints* fingerprints, /* * Sets certListIntersectsPinset to true if a given chain matches any - * fingerprints from the given pinset or the dynamicFingerprints array, or to - * false otherwise. + * fingerprints from the given static fingerprints or the + * dynamicFingerprints array, or to false otherwise. */ static nsresult -EvalChain(const CERTCertList* certList, const StaticPinset* pinset, +EvalChain(const CERTCertList* certList, const StaticFingerprints* fingerprints, const nsTArray<nsCString>* dynamicFingerprints, /*out*/ bool& certListIntersectsPinset) { certListIntersectsPinset = false; CERTCertificate* currentCert; - const StaticFingerprints* fingerprints = nullptr; - if (pinset) { - fingerprints = pinset->sha256; - } if (!fingerprints && !dynamicFingerprints) { MOZ_ASSERT(false, "Must pass in at least one type of pinset"); return NS_ERROR_FAILURE; diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h index 7fb0c7e..f05af88 100644 --- a/security/manager/ssl/StaticHPKPins.h +++ b/security/manager/ssl/StaticHPKPins.h @@ -113,7 +113,7 @@ static const char kEquifax_Secure_eBusiness_CA_1Fingerprint[] = /* FacebookBackup */ static const char kFacebookBackupFingerprint[] = - "1ww8E0AYsR2oX5lndk2hwp2Uosk="; + "q4PO2G2cbkZhZ82+JgmRUyGMoAeozA+BSXVXQWB8XWQ="; /* GOOGLE_PIN_DigiCertECCSecureServerCA */ static const char kGOOGLE_PIN_DigiCertECCSecureServerCAFingerprint[] = @@ -213,7 +213,7 @@ static const char kGo_Daddy_Root_Certificate_Authority___G2Fingerprint[] = /* GoogleBackup2048 */ static const char kGoogleBackup2048Fingerprint[] = - "vq7OyjSnqOco9nyMCDGdy77eijM="; + "IPMbDAjLVSGntGO3WP53X/zilCVndez5YJ2+vJvhJsA="; /* Network Solutions Certificate Authority */ static const char kNetwork_Solutions_Certificate_AuthorityFingerprint[] = @@ -221,11 +221,11 @@ static const char kNetwork_Solutions_Certificate_AuthorityFingerprint[] = /* SpiderOak2 */ static const char kSpiderOak2Fingerprint[] = - "D0fS/hquA6QprluciyO1hlFUAxg="; + "7Y3UnxbffL8aFPXsOJBpGasgpDmngpIhAxGKdQRklQQ="; /* SpiderOak3 */ static const char kSpiderOak3Fingerprint[] = - "l5JoIXv4lztZ+C6TJWgxZCHQzS4="; + "LkER54vOdlygpTsbYvlpMq1CE/lDAG1AP9xmdtwvV2A="; /* Starfield Class 2 CA */ static const char kStarfield_Class_2_CAFingerprint[] = @@ -257,19 +257,19 @@ static const char kTestSPKIFingerprint[] = /* Tor1 */ static const char kTor1Fingerprint[] = - "juNxSTv9UANmpC9kF5GKpmWNx3Y="; + "bYz9JTDk89X3qu3fgswG+lBQso5vI0N1f0Rx4go4nLo="; /* Tor2 */ static const char kTor2Fingerprint[] = - "lia43lPolzSPVIq34Dw57uYcLD8="; + "xXCxhTdn7uxXneJSbQCqoAvuW3ZtQl2pDVTf2sewS8w="; /* Tor3 */ static const char kTor3Fingerprint[] = - "rzEyQIKOh77j87n5bjWUNguXF8Y="; + "CleC1qwUR8JPgH1nXvSe2VHxDe5/KfNs96EusbfSOfo="; /* Twitter1 */ static const char kTwitter1Fingerprint[] = - "Vv7zwhR9TtOIN/29MFI4cgHld40="; + "vU9M48LzD/CF34wE5PPf4nBwRyosy06X21J0ap8yS5s="; /* UTN USERFirst Email Root CA */ static const char kUTN_USERFirst_Email_Root_CAFingerprint[] = @@ -329,11 +329,11 @@ static const char kXRamp_Global_CA_RootFingerprint[] = /* YahooBackup1 */ static const char kYahooBackup1Fingerprint[] = - "uwnZN/atr9+khywDukPzmD9kFiY="; + "2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; /* YahooBackup2 */ static const char kYahooBackup2Fingerprint[] = - "Ui85k1YWcCl0z/4IlMvrDmI5zEo="; + "dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; /* thawte Primary Root CA */ static const char kthawte_Primary_Root_CAFingerprint[] = @@ -353,13 +353,8 @@ struct StaticFingerprints { const char* const* data; }; -struct StaticPinset { - const StaticFingerprints* sha1; - const StaticFingerprints* sha256; -}; - /* PreloadedHPKPins.json pinsets */ -static const char* kPinset_google_root_pems_sha256_Data[] = { +static const char* kPinset_google_root_pems_Data[] = { kEquifax_Secure_CAFingerprint, kComodo_Trusted_Services_rootFingerprint, kCOMODO_ECC_Certification_AuthorityFingerprint, @@ -416,17 +411,12 @@ static const char* kPinset_google_root_pems_sha256_Data[] = { kAffirmTrust_PremiumFingerprint, kAddTrust_Qualified_Certificates_RootFingerprint, }; -static const StaticFingerprints kPinset_google_root_pems_sha256 = { - sizeof(kPinset_google_root_pems_sha256_Data) / sizeof(const char*), - kPinset_google_root_pems_sha256_Data -}; - -static const StaticPinset kPinset_google_root_pems = { - nullptr, - &kPinset_google_root_pems_sha256 +static const StaticFingerprints kPinset_google_root_pems = { + sizeof(kPinset_google_root_pems_Data) / sizeof(const char*), + kPinset_google_root_pems_Data }; -static const char* kPinset_mozilla_sha256_Data[] = { +static const char* kPinset_mozilla_Data[] = { kGeoTrust_Global_CA_2Fingerprint, kthawte_Primary_Root_CA___G3Fingerprint, kthawte_Primary_Root_CAFingerprint, @@ -448,113 +438,61 @@ static const char* kPinset_mozilla_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, }; -static const StaticFingerprints kPinset_mozilla_sha256 = { - sizeof(kPinset_mozilla_sha256_Data) / sizeof(const char*), - kPinset_mozilla_sha256_Data +static const StaticFingerprints kPinset_mozilla = { + sizeof(kPinset_mozilla_Data) / sizeof(const char*), + kPinset_mozilla_Data }; -static const StaticPinset kPinset_mozilla = { - nullptr, - &kPinset_mozilla_sha256 -}; - -static const char* kPinset_mozilla_services_sha256_Data[] = { +static const char* kPinset_mozilla_services_Data[] = { kDigiCert_Global_Root_CAFingerprint, }; -static const StaticFingerprints kPinset_mozilla_services_sha256 = { - sizeof(kPinset_mozilla_services_sha256_Data) / sizeof(const char*), - kPinset_mozilla_services_sha256_Data -}; - -static const StaticPinset kPinset_mozilla_services = { - nullptr, - &kPinset_mozilla_services_sha256 +static const StaticFingerprints kPinset_mozilla_services = { + sizeof(kPinset_mozilla_services_Data) / sizeof(const char*), + kPinset_mozilla_services_Data }; -static const char* kPinset_mozilla_test_sha256_Data[] = { +static const char* kPinset_mozilla_test_Data[] = { kEnd_Entity_Test_CertFingerprint, }; -static const StaticFingerprints kPinset_mozilla_test_sha256 = { - sizeof(kPinset_mozilla_test_sha256_Data) / sizeof(const char*), - kPinset_mozilla_test_sha256_Data -}; - -static const StaticPinset kPinset_mozilla_test = { - nullptr, - &kPinset_mozilla_test_sha256 +static const StaticFingerprints kPinset_mozilla_test = { + sizeof(kPinset_mozilla_test_Data) / sizeof(const char*), + kPinset_mozilla_test_Data }; /* Chrome static pinsets */ -static const char* kPinset_test_sha256_Data[] = { +static const char* kPinset_test_Data[] = { kTestSPKIFingerprint, }; -static const StaticFingerprints kPinset_test_sha256 = { - sizeof(kPinset_test_sha256_Data) / sizeof(const char*), - kPinset_test_sha256_Data -}; - -static const StaticPinset kPinset_test = { - nullptr, - &kPinset_test_sha256 -}; - -static const char* kPinset_google_sha1_Data[] = { - kGoogleBackup2048Fingerprint, -}; -static const StaticFingerprints kPinset_google_sha1 = { - sizeof(kPinset_google_sha1_Data) / sizeof(const char*), - kPinset_google_sha1_Data +static const StaticFingerprints kPinset_test = { + sizeof(kPinset_test_Data) / sizeof(const char*), + kPinset_test_Data }; -static const char* kPinset_google_sha256_Data[] = { +static const char* kPinset_google_Data[] = { kGOOGLE_PIN_GoogleG2Fingerprint, + kGoogleBackup2048Fingerprint, kGeoTrust_Global_CAFingerprint, }; -static const StaticFingerprints kPinset_google_sha256 = { - sizeof(kPinset_google_sha256_Data) / sizeof(const char*), - kPinset_google_sha256_Data -}; - -static const StaticPinset kPinset_google = { - &kPinset_google_sha1, - &kPinset_google_sha256 +static const StaticFingerprints kPinset_google = { + sizeof(kPinset_google_Data) / sizeof(const char*), + kPinset_google_Data }; -static const char* kPinset_tor_sha1_Data[] = { - kTor1Fingerprint, - kTor2Fingerprint, +static const char* kPinset_tor_Data[] = { kTor3Fingerprint, -}; -static const StaticFingerprints kPinset_tor_sha1 = { - sizeof(kPinset_tor_sha1_Data) / sizeof(const char*), - kPinset_tor_sha1_Data -}; - -static const char* kPinset_tor_sha256_Data[] = { kDigiCert_High_Assurance_EV_Root_CAFingerprint, kGOOGLE_PIN_LetsEncryptAuthorityX1Fingerprint, + kTor1Fingerprint, kGOOGLE_PIN_RapidSSLFingerprint, kGOOGLE_PIN_LetsEncryptAuthorityX2Fingerprint, + kTor2Fingerprint, }; -static const StaticFingerprints kPinset_tor_sha256 = { - sizeof(kPinset_tor_sha256_Data) / sizeof(const char*), - kPinset_tor_sha256_Data -}; - -static const StaticPinset kPinset_tor = { - &kPinset_tor_sha1, - &kPinset_tor_sha256 -}; - -static const char* kPinset_twitterCom_sha1_Data[] = { - kTwitter1Fingerprint, -}; -static const StaticFingerprints kPinset_twitterCom_sha1 = { - sizeof(kPinset_twitterCom_sha1_Data) / sizeof(const char*), - kPinset_twitterCom_sha1_Data +static const StaticFingerprints kPinset_tor = { + sizeof(kPinset_tor_Data) / sizeof(const char*), + kPinset_tor_Data }; -static const char* kPinset_twitterCom_sha256_Data[] = { +static const char* kPinset_twitterCom_Data[] = { kVerisign_Class_2_Public_Primary_Certification_Authority___G2Fingerprint, kVerisign_Class_3_Public_Primary_Certification_Authority___G2Fingerprint, kGeoTrust_Global_CA_2Fingerprint, @@ -575,26 +513,14 @@ static const char* kPinset_twitterCom_sha256_Data[] = { kGeoTrust_Primary_Certification_Authority___G3Fingerprint, kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, -}; -static const StaticFingerprints kPinset_twitterCom_sha256 = { - sizeof(kPinset_twitterCom_sha256_Data) / sizeof(const char*), - kPinset_twitterCom_sha256_Data -}; - -static const StaticPinset kPinset_twitterCom = { - &kPinset_twitterCom_sha1, - &kPinset_twitterCom_sha256 -}; - -static const char* kPinset_twitterCDN_sha1_Data[] = { kTwitter1Fingerprint, }; -static const StaticFingerprints kPinset_twitterCDN_sha1 = { - sizeof(kPinset_twitterCDN_sha1_Data) / sizeof(const char*), - kPinset_twitterCDN_sha1_Data +static const StaticFingerprints kPinset_twitterCom = { + sizeof(kPinset_twitterCom_Data) / sizeof(const char*), + kPinset_twitterCom_Data }; -static const char* kPinset_twitterCDN_sha256_Data[] = { +static const char* kPinset_twitterCDN_Data[] = { kVerisign_Class_2_Public_Primary_Certification_Authority___G2Fingerprint, kComodo_Trusted_Services_rootFingerprint, kCOMODO_Certification_AuthorityFingerprint, @@ -635,19 +561,15 @@ static const char* kPinset_twitterCDN_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, kComodo_AAA_Services_rootFingerprint, + kTwitter1Fingerprint, kAddTrust_Qualified_Certificates_RootFingerprint, }; -static const StaticFingerprints kPinset_twitterCDN_sha256 = { - sizeof(kPinset_twitterCDN_sha256_Data) / sizeof(const char*), - kPinset_twitterCDN_sha256_Data +static const StaticFingerprints kPinset_twitterCDN = { + sizeof(kPinset_twitterCDN_Data) / sizeof(const char*), + kPinset_twitterCDN_Data }; -static const StaticPinset kPinset_twitterCDN = { - &kPinset_twitterCDN_sha1, - &kPinset_twitterCDN_sha256 -}; - -static const char* kPinset_dropbox_sha256_Data[] = { +static const char* kPinset_dropbox_Data[] = { kEntrust_Root_Certification_Authority___EC1Fingerprint, kGOOGLE_PIN_ThawtePremiumServerFingerprint, kthawte_Primary_Root_CA___G3Fingerprint, @@ -667,72 +589,35 @@ static const char* kPinset_dropbox_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, }; -static const StaticFingerprints kPinset_dropbox_sha256 = { - sizeof(kPinset_dropbox_sha256_Data) / sizeof(const char*), - kPinset_dropbox_sha256_Data -}; - -static const StaticPinset kPinset_dropbox = { - nullptr, - &kPinset_dropbox_sha256 -}; - -static const char* kPinset_facebook_sha1_Data[] = { - kFacebookBackupFingerprint, -}; -static const StaticFingerprints kPinset_facebook_sha1 = { - sizeof(kPinset_facebook_sha1_Data) / sizeof(const char*), - kPinset_facebook_sha1_Data +static const StaticFingerprints kPinset_dropbox = { + sizeof(kPinset_dropbox_Data) / sizeof(const char*), + kPinset_dropbox_Data }; -static const char* kPinset_facebook_sha256_Data[] = { +static const char* kPinset_facebook_Data[] = { kGOOGLE_PIN_DigiCertECCSecureServerCAFingerprint, kDigiCert_High_Assurance_EV_Root_CAFingerprint, kGOOGLE_PIN_SymantecClass3EVG3Fingerprint, + kFacebookBackupFingerprint, }; -static const StaticFingerprints kPinset_facebook_sha256 = { - sizeof(kPinset_facebook_sha256_Data) / sizeof(const char*), - kPinset_facebook_sha256_Data -}; - -static const StaticPinset kPinset_facebook = { - &kPinset_facebook_sha1, - &kPinset_facebook_sha256 +static const StaticFingerprints kPinset_facebook = { + sizeof(kPinset_facebook_Data) / sizeof(const char*), + kPinset_facebook_Data }; -static const char* kPinset_spideroak_sha1_Data[] = { +static const char* kPinset_spideroak_Data[] = { kSpiderOak2Fingerprint, kSpiderOak3Fingerprint, -}; -static const StaticFingerprints kPinset_spideroak_sha1 = { - sizeof(kPinset_spideroak_sha1_Data) / sizeof(const char*), - kPinset_spideroak_sha1_Data -}; - -static const char* kPinset_spideroak_sha256_Data[] = { kDigiCert_High_Assurance_EV_Root_CAFingerprint, kGeoTrust_Global_CAFingerprint, }; -static const StaticFingerprints kPinset_spideroak_sha256 = { - sizeof(kPinset_spideroak_sha256_Data) / sizeof(const char*), - kPinset_spideroak_sha256_Data -}; - -static const StaticPinset kPinset_spideroak = { - &kPinset_spideroak_sha1, - &kPinset_spideroak_sha256 +static const StaticFingerprints kPinset_spideroak = { + sizeof(kPinset_spideroak_Data) / sizeof(const char*), + kPinset_spideroak_Data }; -static const char* kPinset_yahoo_sha1_Data[] = { - kYahooBackup2Fingerprint, +static const char* kPinset_yahoo_Data[] = { kYahooBackup1Fingerprint, -}; -static const StaticFingerprints kPinset_yahoo_sha1 = { - sizeof(kPinset_yahoo_sha1_Data) / sizeof(const char*), - kPinset_yahoo_sha1_Data -}; - -static const char* kPinset_yahoo_sha256_Data[] = { kVerisign_Class_2_Public_Primary_Certification_Authority___G2Fingerprint, kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint, kGeoTrust_Primary_Certification_AuthorityFingerprint, @@ -740,6 +625,7 @@ static const char* kPinset_yahoo_sha256_Data[] = { kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint, kDigiCert_High_Assurance_EV_Root_CAFingerprint, kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint, + kYahooBackup2Fingerprint, kGeoTrust_Global_CAFingerprint, kVeriSign_Universal_Root_Certification_AuthorityFingerprint, kGeoTrust_Universal_CAFingerprint, @@ -747,14 +633,9 @@ static const char* kPinset_yahoo_sha256_Data[] = { kDigiCert_Global_Root_CAFingerprint, kGeoTrust_Primary_Certification_Authority___G2Fingerprint, }; -static const StaticFingerprints kPinset_yahoo_sha256 = { - sizeof(kPinset_yahoo_sha256_Data) / sizeof(const char*), - kPinset_yahoo_sha256_Data -}; - -static const StaticPinset kPinset_yahoo = { - &kPinset_yahoo_sha1, - &kPinset_yahoo_sha256 +static const StaticFingerprints kPinset_yahoo = { + sizeof(kPinset_yahoo_Data) / sizeof(const char*), + kPinset_yahoo_Data }; /* Domainlist */ @@ -764,7 +645,7 @@ struct TransportSecurityPreload { const bool mTestMode; const bool mIsMoz; const int32_t mId; - const StaticPinset *pinset; + const StaticFingerprints* pinset; }; /* Sort hostnames for binary search. */ @@ -1230,4 +1111,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = { static const int32_t kUnknownId = -1; -static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1472903978258000); +static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1473437156700000); diff --git a/security/manager/tools/genHPKPStaticPins.js b/security/manager/tools/genHPKPStaticPins.js index 8a91fff..c1bbd01 100644 --- a/security/manager/tools/genHPKPStaticPins.js +++ b/security/manager/tools/genHPKPStaticPins.js @@ -53,17 +53,13 @@ const DOMAINHEADER = "/* Domainlist */\n" + " const bool mTestMode;\n" + " const bool mIsMoz;\n" + " const int32_t mId;\n" + - " const StaticPinset* pinset;\n" + + " const StaticFingerprints* pinset;\n" + "};\n\n"; const PINSETDEF = "/* Pinsets are each an ordered list by the actual value of the fingerprint */\n" + "struct StaticFingerprints {\n" + " const size_t size;\n" + " const char* const* data;\n" + - "};\n\n" + - "struct StaticPinset {\n" + - " const StaticFingerprints* sha1;\n" + - " const StaticFingerprints* sha256;\n" + "};\n\n"; // Command-line arguments @@ -463,12 +459,10 @@ function writeFullPinset(certNameToSKD, certSKDToName, pinset) { } writeFingerprints(certNameToSKD, certSKDToName, pinset.name, pinset.sha256_hashes); - writeString("static const StaticPinset " + prefix + " = {\n" + - " nullptr,\n &" + prefix + "_sha256\n};\n\n"); } function writeFingerprints(certNameToSKD, certSKDToName, name, hashes) { - let varPrefix = "kPinset_" + name + "_sha256"; + let varPrefix = "kPinset_" + name; writeString("static const char* " + varPrefix + "_Data[] = {\n"); let SKDList = []; for (let certName of hashes) {

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 03 Jun '16

03 Jun '16

commit 6983a3a92ded3fb1a9b53a4f9c7e30427ba4b126 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 3 20:45:24 2016 +0000 Update translations for https_everywhere_completed --- it/https-everywhere.dtd | 1 + 1 file changed, 1 insertion(+) diff --git a/it/https-everywhere.dtd b/it/https-everywhere.dtd index 794f2c4..a24239d 100644 --- a/it/https-everywhere.dtd +++ b/it/https-everywhere.dtd @@ -5,6 +5,7 @@ <!ENTITY https-everywhere.about.created_by "Creato da"> <!ENTITY https-everywhere.about.and ", e"> <!ENTITY https-everywhere.about.librarians "Autori regole"> +<!ENTITY https-everywhere.about.add_new_rule "Aggiungi una nuova regola"> <!ENTITY https-everywhere.about.thanks "Grazie a"> <!ENTITY https-everywhere.about.many_contributors "Tanti e tanti collaboratori, compresi"> <!ENTITY https-everywhere.about.noscript "Inoltre, porzioni di HTTPS Everywhere sono basate su codice di NoScript, di Giorgio Maone ed altri. Noi siamo grati per il loro eccellente lavoro!">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 03 Jun '16

03 Jun '16

commit b6276d428afd579c581967b93818cee22876ae1d Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 3 20:45:16 2016 +0000 Update translations for https_everywhere --- it/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/it/https-everywhere.dtd b/it/https-everywhere.dtd index 48399eb..a24239d 100644 --- a/it/https-everywhere.dtd +++ b/it/https-everywhere.dtd @@ -5,7 +5,7 @@ <!ENTITY https-everywhere.about.created_by "Creato da"> <!ENTITY https-everywhere.about.and ", e"> <!ENTITY https-everywhere.about.librarians "Autori regole"> -<!ENTITY https-everywhere.about.add_new_rule "Add New Rule"> +<!ENTITY https-everywhere.about.add_new_rule "Aggiungi una nuova regola"> <!ENTITY https-everywhere.about.thanks "Grazie a"> <!ENTITY https-everywhere.about.many_contributors "Tanti e tanti collaboratori, compresi"> <!ENTITY https-everywhere.about.noscript "Inoltre, porzioni di HTTPS Everywhere sono basate su codice di NoScript, di Giorgio Maone ed altri. Noi siamo grati per il loro eccellente lavoro!">

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 03 Jun '16

03 Jun '16

commit efd24f0e58c9a407ebbe3a59c44aa18c671b9489 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 3 19:15:22 2016 +0000 Update translations for https_everywhere_completed --- nb/https-everywhere.dtd | 1 + 1 file changed, 1 insertion(+) diff --git a/nb/https-everywhere.dtd b/nb/https-everywhere.dtd index c43825f..8d36a26 100644 --- a/nb/https-everywhere.dtd +++ b/nb/https-everywhere.dtd @@ -5,6 +5,7 @@ <!ENTITY https-everywhere.about.created_by "Lagd av"> <!ENTITY https-everywhere.about.and ", og"> <!ENTITY https-everywhere.about.librarians "Regelsettbibliotekarer"> +<!ENTITY https-everywhere.about.add_new_rule "Legg til ny regel"> <!ENTITY https-everywhere.about.thanks "Takk til"> <!ENTITY https-everywhere.about.many_contributors "En masse bidragsytere, inkludert"> <!ENTITY https-everywhere.about.noscript "Også deler av HTTPS-everywhere er basert på kode fra NoScript, av Giorgio Maone og andre. Vi er takknemlige for deres utmerkede arbeid!">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 03 Jun '16

03 Jun '16

commit 0a61486b9dcf2439f37b94438de3b6319a13e2dd Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 3 19:15:16 2016 +0000 Update translations for https_everywhere --- nb/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nb/https-everywhere.dtd b/nb/https-everywhere.dtd index 46b370e..8d36a26 100644 --- a/nb/https-everywhere.dtd +++ b/nb/https-everywhere.dtd @@ -5,7 +5,7 @@ <!ENTITY https-everywhere.about.created_by "Lagd av"> <!ENTITY https-everywhere.about.and ", og"> <!ENTITY https-everywhere.about.librarians "Regelsettbibliotekarer"> -<!ENTITY https-everywhere.about.add_new_rule "Add New Rule"> +<!ENTITY https-everywhere.about.add_new_rule "Legg til ny regel"> <!ENTITY https-everywhere.about.thanks "Takk til"> <!ENTITY https-everywhere.about.many_contributors "En masse bidragsytere, inkludert"> <!ENTITY https-everywhere.about.noscript "Også deler av HTTPS-everywhere er basert på kode fra NoScript, av Giorgio Maone og andre. Vi er takknemlige for deres utmerkede arbeid!">

1 0

[nyx/master] mock_keybindings() test helper
by atagar＠torproject.org 03 Jun '16

03 Jun '16

commit 78f67af6cd294c231541433b2e6679981b8f9b8c Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Jun 3 10:12:59 2016 -0700 mock_keybindings() test helper Keybinding mocks were getting a bit verbose. Simple helper for mocking keyboard input. --- test/__init__.py | 15 ++++++++++++ test/popups.py | 70 +++++++------------------------------------------------- 2 files changed, 23 insertions(+), 62 deletions(-) diff --git a/test/__init__.py b/test/__init__.py index 3730254..861e46c 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -51,6 +51,21 @@ def require_curses(func): return wrapped +class mock_keybindings(object): + """ + Mocks the given keyboard inputs. + """ + + def __init__(self, *keys): + self._mock = patch('nyx.curses.key_input', side_effect = [nyx.curses.KeyInput(key) for key in keys]) + + def __enter__(self, *args): + self._mock.__enter__(*args) + + def __exit__(self, *args): + self._mock.__exit__(*args) + + def render(func, *args, **kwargs): """ Runs the given curses function, providing content that's rendered on the diff --git a/test/popups.py b/test/popups.py index 19ff0e1..c87bddf 100644 --- a/test/popups.py +++ b/test/popups.py @@ -10,7 +10,7 @@ import nyx.panel import nyx.popups import test -from test import require_curses +from test import require_curses, mock_keybindings from mock import patch, Mock EXPECTED_HELP_POPUP = """ @@ -335,15 +335,8 @@ class TestPopups(unittest.TestCase): # being selected (rather than three) because the act of selecing the third # closed the popup. - keypresses = [ - nyx.curses.KeyInput(curses.KEY_ENTER), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_ENTER), - nyx.curses.KeyInput(curses.KEY_ENTER), - ] - def draw_func(): - with patch('nyx.curses.key_input', side_effect = keypresses): + with mock_keybindings(curses.KEY_ENTER, curses.KEY_DOWN, curses.KEY_ENTER, curses.KEY_ENTER): return nyx.popups.select_sort_order('Config Option Ordering:', options, previous_order, {}) previous_order = ['Man Page Entry', 'Name', 'Is Set'] @@ -377,15 +370,8 @@ class TestPopups(unittest.TestCase): controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR' controller_mock.return_value = controller - keypresses = [ - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_ENTER), - ] - def draw_func(): - with patch('nyx.curses.key_input', side_effect = keypresses): + with mock_keybindings(curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_ENTER): return nyx.popups.new_select_event_types([]) rendered = test.render(draw_func) @@ -400,18 +386,8 @@ class TestPopups(unittest.TestCase): controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' controller_mock.return_value = controller - keypresses = [ - nyx.curses.KeyInput(curses.KEY_UP), - nyx.curses.KeyInput(curses.KEY_ENTER), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_ENTER), - ] - def draw_func(): - with patch('nyx.curses.key_input', side_effect = keypresses): + with mock_keybindings(curses.KEY_UP, curses.KEY_ENTER, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_ENTER): return nyx.popups.new_select_event_types([]) rendered = test.render(draw_func) @@ -426,21 +402,8 @@ class TestPopups(unittest.TestCase): controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' controller_mock.return_value = controller - keypresses = [ - nyx.curses.KeyInput(curses.KEY_LEFT), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_ENTER), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_RIGHT), - nyx.curses.KeyInput(curses.KEY_RIGHT), - nyx.curses.KeyInput(curses.KEY_LEFT), - nyx.curses.KeyInput(curses.KEY_ENTER), - ] - def draw_func(): - with patch('nyx.curses.key_input', side_effect = keypresses): + with mock_keybindings(curses.KEY_LEFT, curses.KEY_DOWN, curses.KEY_ENTER, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_RIGHT, curses.KEY_RIGHT, curses.KEY_LEFT, curses.KEY_ENTER): return nyx.popups.new_select_event_types([]) rendered = test.render(draw_func) @@ -455,17 +418,8 @@ class TestPopups(unittest.TestCase): controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' controller_mock.return_value = controller - keypresses = [ - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_RIGHT), - nyx.curses.KeyInput(curses.KEY_ENTER), - ] - def draw_func(): - with patch('nyx.curses.key_input', side_effect = keypresses): + with mock_keybindings(curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_RIGHT, curses.KEY_ENTER): return nyx.popups.new_select_event_types([]) rendered = test.render(draw_func) @@ -480,16 +434,8 @@ class TestPopups(unittest.TestCase): controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' controller_mock.return_value = controller - keypresses = [ - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_DOWN), - nyx.curses.KeyInput(curses.KEY_ENTER), - ] - def draw_func(): - with patch('nyx.curses.key_input', side_effect = keypresses): + with mock_keybindings(curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_DOWN, curses.KEY_ENTER): return nyx.popups.new_select_event_types(['CIRC_MINOR']) rendered = test.render(draw_func) @@ -504,7 +450,7 @@ class TestPopups(unittest.TestCase): self.assertEqual(False, rendered.return_value) def draw_func(): - with patch('nyx.curses.key_input', side_effect = [nyx.curses.KeyInput(curses.KEY_LEFT), nyx.curses.KeyInput(curses.KEY_ENTER)]): + with mock_keybindings(curses.KEY_LEFT, curses.KEY_ENTER): return nyx.popups.confirm_save_torrc(TORRC) rendered = test.render(draw_func)

1 0

[nyx/master] Added test for new event selection dialog
by atagar＠torproject.org 03 Jun '16

03 Jun '16

commit a976f7699c9ed63ca65c16da7110f68b65e67e7c Author: Sambuddha Basu <sambuddhabasu1(a)gmail.com> Date: Sat May 28 19:35:22 2016 -0700 Added test for new event selection dialog --- test/popups.py | 181 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 181 insertions(+) diff --git a/test/popups.py b/test/popups.py index d782b96..19ff0e1 100644 --- a/test/popups.py +++ b/test/popups.py @@ -111,6 +111,60 @@ Event Types:-------------------------------------------------------------------+ +------------------------------------------------------------------------------+ """.strip() +EXPECTED_NEW_EVENT_SELECTOR = """ +Event Types:-------------------------------------------------------------------+ +|Tor Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | +|Nyx Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | ++------------------------------------------------------------------------------+ +|[ ] CIRC [ ] CIRC_MINOR | +| [Ok] [Cancel]| ++------------------------------------------------------------------------------+ +""".strip() + +EXPECTED_NEW_EVENT_SELECTOR_UP_DOWN = """ +Event Types:-------------------------------------------------------------------+ +|Tor Runlevel: [X] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | +|Nyx Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | ++------------------------------------------------------------------------------+ +|[ ] CIRC [ ] CIRC_MINOR [ ] STREAM | +|[ ] ORCONN [ ] BW | +| [Ok] [Cancel]| ++------------------------------------------------------------------------------+ +""".strip() + +EXPECTED_NEW_EVENT_SELECTOR_LEFT_RIGHT = """ +Event Types:-------------------------------------------------------------------+ +|Tor Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | +|Nyx Runlevel: [X] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | ++------------------------------------------------------------------------------+ +|[ ] CIRC [ ] CIRC_MINOR [ ] STREAM | +|[ ] ORCONN [ ] BW | +| [Ok] [Cancel]| ++------------------------------------------------------------------------------+ +""".strip() + +EXPECTED_NEW_EVENT_SELECTOR_CANCEL = """ +Event Types:-------------------------------------------------------------------+ +|Tor Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | +|Nyx Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | ++------------------------------------------------------------------------------+ +|[ ] CIRC [ ] CIRC_MINOR [ ] STREAM | +|[ ] ORCONN [ ] BW | +| [Ok] [Cancel]| ++------------------------------------------------------------------------------+ +""".strip() + +EXPECTED_NEW_EVENT_SELECTOR_INITIAL_SELECTION = """ +Event Types:-------------------------------------------------------------------+ +|Tor Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | +|Nyx Runlevel: [ ] DEBUG [ ] INFO [ ] NOTICE [ ] WARN [ ] ERR | ++------------------------------------------------------------------------------+ +|[ ] CIRC [X] CIRC_MINOR [ ] STREAM | +|[ ] ORCONN [ ] BW | +| [Ok] [Cancel]| ++------------------------------------------------------------------------------+ +""".strip() + TORRC = """ ControlPort 9051 CookieAuthentication 1 @@ -317,6 +371,133 @@ class TestPopups(unittest.TestCase): @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) + @patch('nyx.tor_controller') + def test_new_select_event_types(self, controller_mock): + controller = Mock() + controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR' + controller_mock.return_value = controller + + keypresses = [ + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_ENTER), + ] + + def draw_func(): + with patch('nyx.curses.key_input', side_effect = keypresses): + return nyx.popups.new_select_event_types([]) + + rendered = test.render(draw_func) + self.assertEqual(EXPECTED_NEW_EVENT_SELECTOR, rendered.content) + self.assertEqual(set([]), rendered.return_value) + + @require_curses + @patch('nyx.popups._top', Mock(return_value = 0)) + @patch('nyx.tor_controller') + def test_new_select_event_types_up_down(self, controller_mock): + controller = Mock() + controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' + controller_mock.return_value = controller + + keypresses = [ + nyx.curses.KeyInput(curses.KEY_UP), + nyx.curses.KeyInput(curses.KEY_ENTER), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_ENTER), + ] + + def draw_func(): + with patch('nyx.curses.key_input', side_effect = keypresses): + return nyx.popups.new_select_event_types([]) + + rendered = test.render(draw_func) + self.assertEqual(EXPECTED_NEW_EVENT_SELECTOR_UP_DOWN, rendered.content) + self.assertEqual(set(['DEBUG']), rendered.return_value) + + @require_curses + @patch('nyx.popups._top', Mock(return_value = 0)) + @patch('nyx.tor_controller') + def test_new_select_event_types_left_right(self, controller_mock): + controller = Mock() + controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' + controller_mock.return_value = controller + + keypresses = [ + nyx.curses.KeyInput(curses.KEY_LEFT), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_ENTER), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_RIGHT), + nyx.curses.KeyInput(curses.KEY_RIGHT), + nyx.curses.KeyInput(curses.KEY_LEFT), + nyx.curses.KeyInput(curses.KEY_ENTER), + ] + + def draw_func(): + with patch('nyx.curses.key_input', side_effect = keypresses): + return nyx.popups.new_select_event_types([]) + + rendered = test.render(draw_func) + self.assertEqual(EXPECTED_NEW_EVENT_SELECTOR_LEFT_RIGHT, rendered.content) + self.assertEqual(set(['NYX_DEBUG']), rendered.return_value) + + @require_curses + @patch('nyx.popups._top', Mock(return_value = 0)) + @patch('nyx.tor_controller') + def test_new_select_event_types_cancel(self, controller_mock): + controller = Mock() + controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' + controller_mock.return_value = controller + + keypresses = [ + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_RIGHT), + nyx.curses.KeyInput(curses.KEY_ENTER), + ] + + def draw_func(): + with patch('nyx.curses.key_input', side_effect = keypresses): + return nyx.popups.new_select_event_types([]) + + rendered = test.render(draw_func) + self.assertEqual(EXPECTED_NEW_EVENT_SELECTOR_CANCEL, rendered.content) + self.assertEqual(None, rendered.return_value) + + @require_curses + @patch('nyx.popups._top', Mock(return_value = 0)) + @patch('nyx.tor_controller') + def test_new_select_event_types_initial_selection(self, controller_mock): + controller = Mock() + controller.get_info.return_value = 'DEBUG INFO NOTICE WARN ERR CIRC CIRC_MINOR STREAM ORCONN BW' + controller_mock.return_value = controller + + keypresses = [ + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_DOWN), + nyx.curses.KeyInput(curses.KEY_ENTER), + ] + + def draw_func(): + with patch('nyx.curses.key_input', side_effect = keypresses): + return nyx.popups.new_select_event_types(['CIRC_MINOR']) + + rendered = test.render(draw_func) + self.assertEqual(EXPECTED_NEW_EVENT_SELECTOR_INITIAL_SELECTION, rendered.content) + self.assertEqual(set(['CIRC_MINOR']), rendered.return_value) + + @require_curses + @patch('nyx.popups._top', Mock(return_value = 0)) def test_confirm_save_torrc(self): rendered = test.render(nyx.popups.confirm_save_torrc, TORRC) self.assertEqual(EXPECTED_SAVE_TORRC_CONFIRMATION, rendered.content)

1 0

[doctor/master] Suppress notifications for malformed dirreq-v3-ips lines
by atagar＠torproject.org 03 Jun '16

03 Jun '16

commit 96014b1ad9f349c88ae3df160e6a073a165857fa Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Jun 3 09:16:40 2016 -0700 Suppress notifications for malformed dirreq-v3-ips lines We've had a longstanding issue for months now where dirauths are accepting a malformed extrainfo descriptor... https://trac.torproject.org/projects/tor/ticket/16858 No point in continuing to spam myself. Unfortunately this will mask other legitimate issues until it's solved but meh - out of my hands. --- descriptor_checker.py | 2 ++ fallback_directories.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/descriptor_checker.py b/descriptor_checker.py index 953def1..91fd825 100755 --- a/descriptor_checker.py +++ b/descriptor_checker.py @@ -53,6 +53,8 @@ def main(): if not query.error: count = len(list(query)) log.debug(" %i descriptors retrieved from %s in %0.2fs" % (count, query.download_url, query.runtime)) + elif "'dirreq-v3-ips' line had non-ascii content" in str(query.error): + log.debug("Suppressing error due to malformed dirreq-v3-ips line: https://trac.torproject.org/projects/tor/ticket/16858") else: log.warn("Unable to retrieve the %s: %s" % (descriptor_type, query.error)) send_email(EMAIL_SUBJECT, descriptor_type, query) diff --git a/fallback_directories.py b/fallback_directories.py index b9d6cc1..4914118 100755 --- a/fallback_directories.py +++ b/fallback_directories.py @@ -61,7 +61,7 @@ def main(): issues.append('%s => Downloading the consensus took %0.1f seconds' % (relay.fingerprint, download_time)) issue_percent = 100.0 * len(issues) / len(fallback_directories) - log.info('%i ssues found (%i%%)' % (len(issues), issue_percent)) + log.info('%i issues found (%i%%)' % (len(issues), issue_percent)) if issue_percent >= NOTIFICATION_THRESHOLD: log.info('Sending notification')

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits June 2016