July 2016 - tor-commits - lists.torproject.org

[tor/master] Call purpose_needs_anonymity in authority_certs_fetch_missing
by nickm＠torproject.org 01 Jul '16

01 Jul '16

commit d3ca6fe475ab5e0cc9c80e0ff984bebe4160f689 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Jul 1 10:08:38 2016 +1000 Call purpose_needs_anonymity in authority_certs_fetch_missing --- src/or/directory.c | 2 +- src/or/directory.h | 4 ++-- src/or/routerlist.c | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/or/directory.c b/src/or/directory.c index 1fe4d68..68ec3b7 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -… [View More]122,7 +122,7 @@ static void connection_dir_close_consensus_fetches( /** Return true iff the directory purpose <b>dir_purpose</b> (and if it's * fetching descriptors, it's fetching them for <b>router_purpose</b>) * must use an anonymous connection to a directory. */ -STATIC int +int purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose) { if (get_options()->AllDirActionsPrivate) diff --git a/src/or/directory.h b/src/or/directory.h index afa3bcc..f04e7ab 100644 --- a/src/or/directory.h +++ b/src/or/directory.h @@ -132,12 +132,12 @@ int download_status_get_n_failures(const download_status_t *dls); int download_status_get_n_attempts(const download_status_t *dls); time_t download_status_get_next_attempt_at(const download_status_t *dls); +int purpose_needs_anonymity(uint8_t dir_purpose, uint8_t router_purpose); + #ifdef TOR_UNIT_TESTS /* Used only by directory.c and test_dir.c */ STATIC int parse_http_url(const char *headers, char **url); -STATIC int purpose_needs_anonymity(uint8_t dir_purpose, - uint8_t router_purpose); STATIC dirinfo_type_t dir_fetch_type(int dir_purpose, int router_purpose, const char *resource); STATIC int directory_handle_command_get(dir_connection_t *conn, diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 6ad276a..cae0241 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1076,8 +1076,8 @@ authority_certs_fetch_missing(networkstatus_t *status, time_t now, /* If we've just downloaded a consensus from a directory, re-use that * directory */ if (rs) { - /* Certificate fetches are one-hop, unless AllDirActionsPrivate is 1 */ - int get_via_tor = options->AllDirActionsPrivate; + int get_via_tor = purpose_needs_anonymity( + DIR_PURPOSE_FETCH_CERTIFICATE, 0); const dir_indirection_t indirection = get_via_tor ? DIRIND_ANONYMOUS : DIRIND_ONEHOP; directory_initiate_command_routerstatus(rs, @@ -1137,8 +1137,8 @@ authority_certs_fetch_missing(networkstatus_t *status, time_t now, /* If we've just downloaded a consensus from a directory, re-use that * directory */ if (rs) { - /* Certificate fetches are one-hop, unless AllDirActionsPrivate is 1 */ - int get_via_tor = options->AllDirActionsPrivate; + int get_via_tor = purpose_needs_anonymity( + DIR_PURPOSE_FETCH_CERTIFICATE, 0); const dir_indirection_t indirection = get_via_tor ? DIRIND_ANONYMOUS : DIRIND_ONEHOP; directory_initiate_command_routerstatus(rs, [View Less]

1 0

[tor/release-0.2.8] When tor can't find a directory, log less
by nickm＠torproject.org 01 Jul '16

01 Jul '16

commit 744077dd155c347092002d2fa642ebdaca651608 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Jul 1 14:26:00 2016 +1000 When tor can't find a directory, log less --- changes/bug18849 | 4 ++++ src/or/routerlist.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/changes/bug18849 b/changes/bug18849 new file mode 100644 index 0000000..b12a8da --- /dev/null +++ b/changes/bug18849 @@ -0,0 +1,4 @@ + o Minor bugfix (logging)… [View More]

1 0

[tor/master] When tor can't find a directory, log less
by nickm＠torproject.org 01 Jul '16

01 Jul '16

commit 744077dd155c347092002d2fa642ebdaca651608 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Jul 1 14:26:00 2016 +1000 When tor can't find a directory, log less --- changes/bug18849 | 4 ++++ src/or/routerlist.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/changes/bug18849 b/changes/bug18849 new file mode 100644 index 0000000..b12a8da --- /dev/null +++ b/changes/bug18849 @@ -0,0 +1,4 @@ + o Minor bugfix (logging)… [View More]

1 0

[tor/master] Merge branch 'maint-0.2.8'
by nickm＠torproject.org 01 Jul '16

01 Jul '16

commit 903ec20c0b4e3bc5de9fe7925380cbf87c107058 Merge: 64ee7bc 744077d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 1 09:54:08 2016 -0400 Merge branch 'maint-0.2.8' changes/bug18849 | 4 ++++ src/or/routerlist.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-)

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 01 Jul '16

01 Jul '16

commit 017245074e3a2c1c7ad4375911a586367e036b04 Merge: 34879d0 744077d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 1 09:54:01 2016 -0400 Merge branch 'maint-0.2.8' into release-0.2.8 changes/bug18849 | 4 ++++ src/or/routerlist.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.8] When tor can't find a directory, log less
by nickm＠torproject.org 01 Jul '16

01 Jul '16

commit 744077dd155c347092002d2fa642ebdaca651608 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Jul 1 14:26:00 2016 +1000 When tor can't find a directory, log less --- changes/bug18849 | 4 ++++ src/or/routerlist.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/changes/bug18849 b/changes/bug18849 new file mode 100644 index 0000000..b12a8da --- /dev/null +++ b/changes/bug18849 @@ -0,0 +1,4 @@ + o Minor bugfix (logging)… [View More]

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] squash! Bug 1517: Reduce precision of time for Javascript.
by gk＠torproject.org 01 Jul '16

01 Jul '16

commit f2291c41ff45ff3108ef05539fadf7fafac2e7cd Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Jun 21 14:31:45 2016 -0700 squash! Bug 1517: Reduce precision of time for Javascript. Bug 19478: Prevent File API from leaking ms-resolution current time --- dom/base/File.cpp | 3 ++- dom/base/MultipartBlobImpl.cpp | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/dom/base/File.cpp b/dom/base/File.cpp index 5cc20a7..694f8fb … [View More]

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] squash! Regression tests for Bug 1517: Reduce precision of time for Javascript.
by gk＠torproject.org 01 Jul '16

01 Jul '16

commit 0f601022eee81c9a0d2fd94a59e4719163d155e4 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Jun 21 14:34:52 2016 -0700 squash! Regression tests for Bug 1517: Reduce precision of time for Javascript. Plus tests for File API, e.g. `new File([], "").lastModifiedDate.getTime()` --- tbb-tests/test_tor_bug1517.html | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tbb-tests/test_tor_bug1517.html b/tbb-tests/test_tor_bug1517.html index 67d6693..2eed53e … [View More]

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Bug 16998: Isolate link rel=preconnect to first party
by gk＠torproject.org 01 Jul '16

01 Jul '16

commit be96c4f788ab616d94457bcc4dd1d098b156d62c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Jun 6 00:56:09 2016 -0700 Bug 16998: Isolate link rel=preconnect to first party --- dom/base/nsDocument.cpp | 8 +++++-- netwerk/base/nsIOService.cpp | 41 +++++++++++++++++++++++++++++---- netwerk/base/nsIOService.h | 1 + netwerk/base/nsISpeculativeConnect.idl | 11 ++++++++- netwerk/ipc/NeckoParent.cpp | 7 +++---… [View More] netwerk/ipc/NeckoParent.h | 3 ++- netwerk/ipc/PNecko.ipdl | 2 +- netwerk/protocol/http/nsHttpHandler.cpp | 27 ++++++++++++++++++---- netwerk/protocol/http/nsHttpHandler.h | 1 + 9 files changed, 84 insertions(+), 17 deletions(-) diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp index 586e199..e7077a9 100644 --- a/dom/base/nsDocument.cpp +++ b/dom/base/nsDocument.cpp @@ -246,6 +246,8 @@ #include "nsISpeculativeConnect.h" +#include "ThirdPartyUtil.h" + #ifdef MOZ_MEDIA_NAVIGATOR #include "mozilla/MediaManager.h" #endif // MOZ_MEDIA_NAVIGATOR @@ -9733,10 +9735,12 @@ nsDocument::MaybePreconnect(nsIURI* aOrigURI, mozilla::CORSMode aCORSMode) return; } + nsCString firstPartyHost; + ThirdPartyUtil::GetFirstPartyHost(this, firstPartyHost); if (aCORSMode == CORS_ANONYMOUS) { - speculator->SpeculativeAnonymousConnect(uri, nullptr); + speculator->SpeculativeAnonymousConnectIsolated(uri, firstPartyHost, nullptr); } else { - speculator->SpeculativeConnect(uri, nullptr); + speculator->SpeculativeConnectIsolated(uri, firstPartyHost, nullptr); } } diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp index ad86c95..a864d0e 100644 --- a/netwerk/base/nsIOService.cpp +++ b/netwerk/base/nsIOService.cpp @@ -51,6 +51,7 @@ #include "ClosingService.h" #include "ReferrerPolicy.h" #include "nsContentSecurityManager.h" +#include "ThirdPartyUtil.h" #ifdef MOZ_WIDGET_GONK #include "nsINetworkManager.h" @@ -1822,10 +1823,14 @@ IOServiceProxyCallback::OnProxyAvailable(nsICancelable *request, nsIChannel *cha nsLoadFlags loadFlags = 0; channel->GetLoadFlags(&loadFlags); + + nsCString firstPartyHost; + ThirdPartyUtil::GetFirstPartyHost(channel, firstPartyHost); + if (loadFlags & nsIRequest::LOAD_ANONYMOUS) { - speculativeHandler->SpeculativeAnonymousConnect(uri, mCallbacks); + speculativeHandler->SpeculativeAnonymousConnectIsolated(uri, firstPartyHost, mCallbacks); } else { - speculativeHandler->SpeculativeConnect(uri, mCallbacks); + speculativeHandler->SpeculativeConnectIsolated(uri, firstPartyHost, mCallbacks); } return NS_OK; @@ -1833,6 +1838,7 @@ IOServiceProxyCallback::OnProxyAvailable(nsICancelable *request, nsIChannel *cha nsresult nsIOService::SpeculativeConnectInternal(nsIURI *aURI, + const nsACString& aIsolationKey, nsIInterfaceRequestor *aCallbacks, bool aAnonymous) { @@ -1867,6 +1873,17 @@ nsIOService::SpeculativeConnectInternal(nsIURI *aURI, getter_AddRefs(channel)); NS_ENSURE_SUCCESS(rv, rv); + // If we have an isolation key, use it as the document URI for this channel. + if (!aIsolationKey.IsEmpty()) { + nsCOMPtr<nsIHttpChannelInternal> channelInternal(do_QueryInterface(channel)); + if (channelInternal) { + nsCString documentURISpec("https://"); + documentURISpec.Append(aIsolationKey); + nsCOMPtr<nsIURI> documentURI; + /* nsresult rv = */ NS_NewURI(getter_AddRefs(documentURI), documentURISpec); + channelInternal->SetDocumentURI(documentURI); + } + } if (aAnonymous) { nsLoadFlags loadFlags = 0; channel->GetLoadFlags(&loadFlags); @@ -1885,17 +1902,33 @@ nsIOService::SpeculativeConnectInternal(nsIURI *aURI, } NS_IMETHODIMP +nsIOService::SpeculativeConnectIsolated(nsIURI *aURI, + const nsACString& aIsolationKey, + nsIInterfaceRequestor *aCallbacks) +{ + return SpeculativeConnectInternal(aURI, aIsolationKey, aCallbacks, false); +} + +NS_IMETHODIMP nsIOService::SpeculativeConnect(nsIURI *aURI, nsIInterfaceRequestor *aCallbacks) { - return SpeculativeConnectInternal(aURI, aCallbacks, false); + return SpeculativeConnectInternal(aURI, EmptyCString(), aCallbacks, false); +} + +NS_IMETHODIMP +nsIOService::SpeculativeAnonymousConnectIsolated(nsIURI *aURI, + const nsACString& aIsolationKey, + nsIInterfaceRequestor *aCallbacks) +{ + return SpeculativeConnectInternal(aURI, aIsolationKey, aCallbacks, true); } NS_IMETHODIMP nsIOService::SpeculativeAnonymousConnect(nsIURI *aURI, nsIInterfaceRequestor *aCallbacks) { - return SpeculativeConnectInternal(aURI, aCallbacks, true); + return SpeculativeConnectInternal(aURI, EmptyCString(), aCallbacks, true); } void diff --git a/netwerk/base/nsIOService.h b/netwerk/base/nsIOService.h index e948ffd..308cee7 100644 --- a/netwerk/base/nsIOService.h +++ b/netwerk/base/nsIOService.h @@ -133,6 +133,7 @@ private: nsIChannel** result); nsresult SpeculativeConnectInternal(nsIURI *aURI, + const nsACString& aIsolationKey, nsIInterfaceRequestor *aCallbacks, bool aAnonymous); diff --git a/netwerk/base/nsISpeculativeConnect.idl b/netwerk/base/nsISpeculativeConnect.idl index 15d63e1..eed9570 100644 --- a/netwerk/base/nsISpeculativeConnect.idl +++ b/netwerk/base/nsISpeculativeConnect.idl @@ -8,7 +8,7 @@ interface nsIURI; interface nsIInterfaceRequestor; -[scriptable, uuid(d74a17ac-5b8a-4824-a309-b1f04a3c4aed)] +[scriptable, uuid(60cf321d-9f09-403a-b8b6-db221e6ca3a1)] interface nsISpeculativeConnect : nsISupports { /** @@ -21,6 +21,7 @@ interface nsISpeculativeConnect : nsISupports * to actually open the new channel. * * @param aURI the URI of the hinted transaction + * @param aIsolationKey the isolation key for the connection * @param aCallbacks any security callbacks for use with SSL for interfaces * such as nsIBadCertListener. May be null. * @@ -30,6 +31,14 @@ interface nsISpeculativeConnect : nsISupports void speculativeAnonymousConnect(in nsIURI aURI, in nsIInterfaceRequestor aCallbacks); + + void speculativeConnectIsolated(in nsIURI aURI, + in AUTF8String aIsolationKey, + in nsIInterfaceRequestor aCallbacks); + + void speculativeAnonymousConnectIsolated(in nsIURI aURI, + in AUTF8String aIsolationKey, + in nsIInterfaceRequestor aCallbacks); }; /** diff --git a/netwerk/ipc/NeckoParent.cpp b/netwerk/ipc/NeckoParent.cpp index 796e78f..fa4911b 100644 --- a/netwerk/ipc/NeckoParent.cpp +++ b/netwerk/ipc/NeckoParent.cpp @@ -728,15 +728,16 @@ NeckoParent::DeallocPRemoteOpenFileParent(PRemoteOpenFileParent* actor) } bool -NeckoParent::RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous) +NeckoParent::RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous, + const nsCString& aIsolationKey) { nsCOMPtr<nsISpeculativeConnect> speculator(gIOService); nsCOMPtr<nsIURI> uri = DeserializeURI(aURI); if (uri && speculator) { if (aAnonymous) { - speculator->SpeculativeAnonymousConnect(uri, nullptr); + speculator->SpeculativeAnonymousConnectIsolated(uri, aIsolationKey, nullptr); } else { - speculator->SpeculativeConnect(uri, nullptr); + speculator->SpeculativeConnectIsolated(uri, aIsolationKey, nullptr); } } diff --git a/netwerk/ipc/NeckoParent.h b/netwerk/ipc/NeckoParent.h index 508ab6f..900328c 100644 --- a/netwerk/ipc/NeckoParent.h +++ b/netwerk/ipc/NeckoParent.h @@ -167,7 +167,8 @@ protected: const uint32_t& flags, const nsCString& aNetworkInterface) override; virtual bool DeallocPDNSRequestParent(PDNSRequestParent*) override; - virtual bool RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous) override; + virtual bool RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous, + const nsCString& aFirstPartyHost) override; virtual bool RecvHTMLDNSPrefetch(const nsString& hostname, const uint16_t& flags) override; virtual bool RecvCancelHTMLDNSPrefetch(const nsString& hostname, diff --git a/netwerk/ipc/PNecko.ipdl b/netwerk/ipc/PNecko.ipdl index 2e1f2f5..0d0c7f8 100644 --- a/netwerk/ipc/PNecko.ipdl +++ b/netwerk/ipc/PNecko.ipdl @@ -89,7 +89,7 @@ parent: URIParams fileuri, OptionalURIParams appuri); - SpeculativeConnect(URIParams uri, bool anonymous); + SpeculativeConnect(URIParams uri, bool anonymous, nsCString isolationKey); HTMLDNSPrefetch(nsString hostname, uint16_t flags); CancelHTMLDNSPrefetch(nsString hostname, uint16_t flags, nsresult reason); diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp index e425c22..97461fe 100644 --- a/netwerk/protocol/http/nsHttpHandler.cpp +++ b/netwerk/protocol/http/nsHttpHandler.cpp @@ -2126,13 +2126,15 @@ nsHttpHandler::Observe(nsISupports *subject, nsresult nsHttpHandler::SpeculativeConnectInternal(nsIURI *aURI, + const nsACString& aIsolationKey, nsIInterfaceRequestor *aCallbacks, bool anonymous) { + nsCString isolationKey(aIsolationKey); if (IsNeckoChild()) { ipc::URIParams params; SerializeURI(aURI, params); - gNeckoChild->SendSpeculativeConnect(params, anonymous); + gNeckoChild->SendSpeculativeConnect(params, anonymous, isolationKey); return NS_OK; } @@ -2205,26 +2207,41 @@ nsHttpHandler::SpeculativeConnectInternal(nsIURI *aURI, nsAutoCString username; aURI->GetUsername(username); - // TODO: Fix isolation for speculative connect. nsHttpConnectionInfo *ci = - new nsHttpConnectionInfo(host, port, EmptyCString(), username, nullptr, EmptyCString(), usingSSL); + new nsHttpConnectionInfo(host, port, EmptyCString(), username, nullptr, aIsolationKey, usingSSL); ci->SetAnonymous(anonymous); return SpeculativeConnect(ci, aCallbacks); } NS_IMETHODIMP +nsHttpHandler::SpeculativeConnectIsolated(nsIURI *aURI, + const nsACString& aIsolationKey, + nsIInterfaceRequestor *aCallbacks) +{ + return SpeculativeConnectInternal(aURI, aIsolationKey, aCallbacks, false); +} + +NS_IMETHODIMP nsHttpHandler::SpeculativeConnect(nsIURI *aURI, nsIInterfaceRequestor *aCallbacks) { - return SpeculativeConnectInternal(aURI, aCallbacks, false); + return SpeculativeConnectInternal(aURI, EmptyCString(), aCallbacks, false); +} + +NS_IMETHODIMP +nsHttpHandler::SpeculativeAnonymousConnectIsolated(nsIURI *aURI, + const nsACString& aIsolationKey, + nsIInterfaceRequestor *aCallbacks) +{ + return SpeculativeConnectInternal(aURI, aIsolationKey, aCallbacks, true); } NS_IMETHODIMP nsHttpHandler::SpeculativeAnonymousConnect(nsIURI *aURI, nsIInterfaceRequestor *aCallbacks) { - return SpeculativeConnectInternal(aURI, aCallbacks, true); + return SpeculativeConnectInternal(aURI, EmptyCString(), aCallbacks, true); } void diff --git a/netwerk/protocol/http/nsHttpHandler.h b/netwerk/protocol/http/nsHttpHandler.h index 1205dad..cf15775 100644 --- a/netwerk/protocol/http/nsHttpHandler.h +++ b/netwerk/protocol/http/nsHttpHandler.h @@ -596,6 +596,7 @@ private: private: nsresult SpeculativeConnectInternal(nsIURI *aURI, + const nsACString& aIsolationKey, nsIInterfaceRequestor *aCallbacks, bool anonymous); }; [View Less]

1 0

[tor-browser/tor-browser-45.2.0esr-6.5-1] Revert "Bug 16998: Disable link rel=preconnect"
by gk＠torproject.org 01 Jul '16

01 Jul '16

commit b44b2b25bab1ebde9351c842f0ca66d2fdc87579 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Mon Jun 6 01:05:25 2016 -0700 Revert "Bug 16998: Disable link rel=preconnect" This reverts commit bba50a31b7c41ec4c74475ba083d23828fea8918. --- dom/base/nsDocument.cpp | 5 ----- 1 file changed, 5 deletions(-) diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp index ef6dc64..586e199 100644 --- a/dom/base/nsDocument.cpp +++ b/dom/base/nsDocument.cpp @@ -… [View More]

1 0