September 2016 - tor-commits - lists.torproject.org

[tor-browser-bundle/hardened-builds] Bug 19528: set MOZ_BUILD_DATE based on firefox version
by gk＠torproject.org 09 Sep '16

09 Sep '16

commit ac62d42011e18a5cf124d3265b3b62a931c17e9a Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Sep 9 14:07:39 2016 +0200 Bug 19528: set MOZ_BUILD_DATE based on firefox version The MOZ_BUILD_DATE environment variable is used as the build id. --- gitian/build-helpers/get-moz-build-date | 18 ++++++++++++++++++ gitian/descriptors/linux/gitian-firefox.yml | 3 ++- gitian/descriptors/mac/gitian-firefox.yml | 3 ++- gitian/descriptors/windows/gitian-firefox.yml | 3 ++- tools/update-responses/update_responses | 27 ++++++++++++++++++++++++++- 5 files changed, 50 insertions(+), 4 deletions(-) diff --git a/gitian/build-helpers/get-moz-build-date b/gitian/build-helpers/get-moz-build-date new file mode 100755 index 0000000..168a8c7 --- /dev/null +++ b/gitian/build-helpers/get-moz-build-date @@ -0,0 +1,18 @@ +#!/usr/bin/perl -w +# Generate a MOZ_BUILD_DATE based on firefox version number + +use strict; + +my ($year) = split('-', `git show -s --format='%ci'`); + +die "missing argument" unless @ARGV; +my $version = $ARGV[0]; +$version =~ s/\D+$//; +my @v = split(/[\.ab]/, $version); +push @v, '0' if @v < 4; +push @v, '0' if @v < 4; +my $day_of_month = int(($v[0] - 45) / 5); +my $date = 101010101 + $year * 10000000000 + $day_of_month * 1000000 + + $v[1] * 10000 + $v[2] * 100 + $v[3]; +$date += 100000000 unless $version =~ m/[ab]/; +print "export MOZ_BUILD_DATE=$date\n"; diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index f32ee40..89f68fa 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -32,6 +32,7 @@ remotes: files: - "binutils-linux64-utils.zip" - "gcc-linux64-utils.zip" +- "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "versions" @@ -92,7 +93,7 @@ script: | # Self-Rando wrapper export PATH="$HOME/build/selfrando/Tools/TorBrowser/tc-wrapper/:$PATH" export SELFRANDO_skip_shuffle= - export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) + eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # Without disabling LSan our build is blowing up: diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index 302f2a4..fea3139 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -17,6 +17,7 @@ files: - "gcc-linux64-precise-utils.zip" - "MacOSX10.7.sdk.tar.gz" - "x86_64-apple-darwin10.tar.xz" +- "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "fix-info-plist.py" @@ -65,7 +66,7 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) + eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index 3261199..788b053 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -15,6 +15,7 @@ remotes: files: - "gcc-linux32-precise-utils.zip" - "mingw-w64-win32-utils.zip" +- "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "gcclibs-win32-utils.zip" @@ -73,7 +74,7 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) + eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index faa1037..498132e 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -238,6 +238,30 @@ sub channel_to_version { return map { $config->{channels}{$_} } @channels; } +sub get_buildinfos { + my ($config, $version) = @_; + return if exists $config->{versions}{$version}{buildID}; + my $files = $config->{versions}{$version}{files}; + foreach my $os (keys %$files) { + foreach my $lang (keys %{$files->{$os}}) { + next unless $files->{$os}{$lang}{complete}; + my $tmpdir = File::Temp->newdir(); + extract_mar(mar_filename($version, $os, $lang), "$tmpdir"); + my $appfile = "$tmpdir/application.ini" if -f "$tmpdir/application.ini"; + $appfile = "$tmpdir/Contents/Resources/application.ini" + if -f "$tmpdir/Contents/Resources/application.ini"; + exit_error "Could not find application.ini" unless $appfile; + foreach my $line (read_file("$tmpdir/application.ini")) { + if ($line =~ m/^BuildID=(.*)$/) { + $config->{versions}{$version}{buildID} = $1; + return; + } + } + exit_error "Could not extract buildID from application.ini"; + } + } +} + sub get_response { my ($config, $version, $os, @patches) = @_; my $res; @@ -257,7 +281,7 @@ sub get_response { displayVersion => $version, appVersion => $version, platformVersion => get_config($config, $version, $os, 'platformVersion'), - buildID => '20000101000000', + buildID => get_config($config, $version, $os, 'buildID'), detailsURL => get_config($config, $version, $os, 'detailsURL'), actions => 'showURL', openURL => get_config($config, $version, $os, 'detailsURL'), @@ -281,6 +305,7 @@ sub write_responses { foreach my $channel (@channels) { my $version = $config->{channels}{$channel}; get_version_files($config, $version); + get_buildinfos($config, $version); my $files = $config->{versions}{$version}{files}; my $migrate_archs = $config->{versions}{$version}{migrate_archs} // {}; foreach my $old_os (keys %$migrate_archs) {

1 0

[tor-browser-bundle/master] Bug 19410: Add script to convert dmg files to mar files
by gk＠torproject.org 09 Sep '16

09 Sep '16

commit 23bea36eb8d8d27ca00b2394757be08530cb7f19 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Sep 9 13:46:49 2016 +0200 Bug 19410: Add script to convert dmg files to mar files We are also adding the dmg2mars and dmg2mars-alpha makefile rules to run the script and regenerate the incremental mars. --- gitian/Makefile | 10 +++ tools/dmg2mar | 136 +++++++++++++++++++++++++++++ tools/update-responses/get_channel_version | 1 + tools/update-responses/update_responses | 6 ++ 4 files changed, 153 insertions(+) diff --git a/gitian/Makefile b/gitian/Makefile index 50d4328..59efd0e 100644 --- a/gitian/Makefile +++ b/gitian/Makefile @@ -45,6 +45,16 @@ signmars-alpha: signmars-nightly: ./signmars.sh versions.nightly +dmg2mars: + cd $(shell ../tools/update-responses/get_channel_version release) && ../../tools/dmg2mar + $(TORSOCKS) ../tools/update-responses/download_missing_versions release + ../tools/update-responses/gen_incrementals release + +dmg2mars-alpha: + cd $(shell ../tools/update-responses/get_channel_version alpha) && ../../tools/dmg2mar + $(TORSOCKS) ../tools/update-responses/download_missing_versions alpha + ../tools/update-responses/gen_incrementals alpha + update_responses: ../tools/update-responses/update_responses release diff --git a/tools/dmg2mar b/tools/dmg2mar new file mode 100755 index 0000000..47a543a --- /dev/null +++ b/tools/dmg2mar @@ -0,0 +1,136 @@ +#!/usr/bin/perl -w +# +# This script converts all dmg files from the current directory and +# listed in the sha256sums-unsigned-build.txt file to full update +# mar files. After code signing the dmg files, this script can be used +# to update the mar files. +# +# A recent version of p7zip is required to extract the dmg files, such +# as 15.14. The version in Debian Jessie (9.20) is not recent enough. +# It is possible to install the p7zip-full package from Debian testing, +# or build p7zip from sources: +# $ p7zipdir=/some_directory/p7zip +# $ mkdir $p7zipdir +# $ cd $p7zipdir +# $ wget http://snapshot.debian.org/archive/debian/20160417T044336Z/pool/main/p/p7zi… +# $ echo 'e9e696e2fa77b00445a4d85fa07506debeae01943fdc1bee1472152d7d1386af p7zip_15.14.1+dfsg.orig.tar.xz' | sha256sum -c +# $ wget http://snapshot.debian.org/archive/debian/20160515T161830Z/pool/main/p/p7zi… +# $ echo 'f4db6803535fc30b6ae9db5aabfd9f57a851c6773d72073847ec5e3731b7af37 p7zip_15.14.1+dfsg-2.debian.tar.xz' | sha256sum -c +# $ tar xvf p7zip_15.14.1+dfsg-2.debian.tar.xz +# $ tar xvf p7zip_15.14.1+dfsg.orig.tar.xz +# $ cd p7zip_15.14.1/ +# $ for patch in $(cat ../debian/patches/series ); do patch -p1 < ../debian/patches/$patch; done +# $ make 7z +# $ mkdir $p7zipdir/bin +# $ echo '#!/bin/sh' > $p7zipdir/bin/7z +# $ echo "export LD_LIBRARY_PATH=$PWD/bin" >> $p7zipdir/bin/7z +# $ echo "exec $PWD/bin/7z "'"$@"' >> $p7zipdir/bin/7z +# $ chmod +x $p7zipdir/bin/7z +# $ export "PATH=$p7zipdir/bin:$PATH" + +use strict; +use IO::CaptureOutput qw(capture_exec); +use File::Slurp; +use Parallel::ForkManager; +use Cwd; + +sub exit_error { + print STDERR "Error: ", $_[0], "\n"; + chdir '/'; + exit (exists $_[1] ? $_[1] : 1); +} + +sub osname { + my ($osname) = capture_exec('uname', '-s'); + my ($arch) = capture_exec('uname', '-m'); + chomp($osname, $arch); + if ($osname eq 'Linux' && $arch eq 'x86_64') { + return 'linux64'; + } + if ($osname eq 'Linux' && $arch =~ m/^i.86$/) { + return 'linux32'; + } + exit_error 'Unknown OS'; +} + +my $martools_tmpdir; +sub extract_martools { + my $osname = osname; + my $marzip = getcwd . "/mar-tools-$osname.zip"; + $martools_tmpdir = File::Temp->newdir(); + my $old_cwd = getcwd; + chdir $martools_tmpdir; + my (undef, undef, $success) = capture_exec('unzip', $marzip); + chdir $old_cwd; + exit_error "Error extracting $marzip" unless $success; + $ENV{PATH} = "$martools_tmpdir/mar-tools:$ENV{PATH}"; + if ($ENV{LD_LIBRARY_PATH}) { + $ENV{LD_LIBRARY_PATH} .= ":$martools_tmpdir/mar-tools"; + } else { + $ENV{LD_LIBRARY_PATH} = "$martools_tmpdir/mar-tools"; + } + $ENV{MAR} = "$martools_tmpdir/mar-tools/mar"; + $ENV{MSBDIFF} = "$martools_tmpdir/mar-tools/mbsdiff"; +} + +sub get_nbprocs { + return $ENV{NUM_PROCS} if defined $ENV{NUM_PROCS}; + if (-f '/proc/cpuinfo') { + return scalar grep { m/^processor\s+:\s/ } read_file '/proc/cpuinfo'; + } + return 4; +} + +sub get_dmg_files_from_sha256sums { + exit_error "Missing sha256sums-unsigned-build.txt file" + unless -f 'sha256sums-unsigned-build.txt'; + my @files; + foreach my $line (read_file('sha256sums-unsigned-build.txt')) { + my (undef, $filename) = split ' ', $line; + chomp $filename; + next unless $filename =~ m/^TorBrowser-(.+)-osx64_(.+)\.dmg$/; + push @files, { filename => $filename, version => $1, lang => $2 }; + } + return @files; +} + +sub convert_files { + my $pm = Parallel::ForkManager->new(get_nbprocs); + $pm->run_on_finish(sub { print "Finished $_[2]\n" }); + foreach my $file (get_dmg_files_from_sha256sums) { + my $output = "tor-browser-osx64-$file->{version}_$file->{lang}.mar"; + my $step_name = "$file->{filename} -> $output"; + print "Starting $step_name\n"; + $pm->start($step_name) and next; + my $tmpdir = File::Temp->newdir(); + my (undef, $err, $success) = capture_exec('7z', 'x', "-o$tmpdir", + $file->{filename}); + exit_error "Error extracting $file->{filename}: $err" unless $success; + unlink $output; + (undef, $err, $success) = capture_exec('make_full_update.sh', '-q', + $output, "$tmpdir/TorBrowser.app"); + exit_error "Error updating $output: $err" unless $success; + $pm->finish; + } + $pm->wait_all_children; +} + +sub remove_incremental_mars { + exit_error "Missing sha256sums-unsigned-build.incrementals.txt file" + unless -f 'sha256sums-unsigned-build.incrementals.txt'; + foreach my $line (read_file('sha256sums-unsigned-build.incrementals.txt')) { + my (undef, $filename) = split ' ', $line; + chomp $filename; + next unless $filename =~ m/^tor-browser-osx64.+\.incremental\.mar$/; + next unless -f $filename; + print "Removing $filename\n"; + unlink $filename; + } +} + +# Set LC_ALL=C to avoid reproducibility issues when creating mar files +$ENV{LC_ALL} = 'C'; + +extract_martools; +convert_files; +remove_incremental_mars; diff --git a/tools/update-responses/get_channel_version b/tools/update-responses/get_channel_version new file mode 120000 index 0000000..3766925 --- /dev/null +++ b/tools/update-responses/get_channel_version @@ -0,0 +1 @@ +update_responses \ No newline at end of file diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index 498132e..b83ac29 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -596,6 +596,12 @@ my %actions = ( download_missing_versions($config, @channels); }, check_update_responses_deployement => \&check_update_responses, + get_channel_version => sub { + my ($config) = @_; + exit_error "Wrong arguments" unless @ARGV == 1; + exit_error "Unknown channel" unless $config->{channels}{$ARGV[0]}; + print $config->{channels}{$ARGV[0]}, "\n"; + }, ); my $action = fileparse($PROGRAM_NAME);

1 0

[tor/master] Move the donna-fuzzing tests into test_slow.
by nickm＠torproject.org 09 Sep '16

09 Sep '16

commit 05110c9294f64b494600b056670f62ca89b52b0b Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 9 08:55:11 2016 -0400 Move the donna-fuzzing tests into test_slow. This shaves another 3-4 seconds off the main-path tests for me, which is again worth it, according to XKCD#1204. --- src/test/test.h | 1 + src/test/test_crypto.c | 90 --------------------------------------------- src/test/test_crypto_slow.c | 80 ++++++++++++++++++++++++++++++++++++++++ src/test/testing_common.c | 19 ++++++++++ 4 files changed, 100 insertions(+), 90 deletions(-) diff --git a/src/test/test.h b/src/test/test.h index c0643e1..0b1b626 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -169,6 +169,7 @@ struct crypto_pk_t *pk_generate(int idx); #define NS_UNMOCK(name) UNMOCK(name) extern const struct testcase_setup_t passthrough_setup; +const struct testcase_setup_t ed25519_test_setup; extern struct testcase_t accounting_tests[]; extern struct testcase_t addr_tests[]; diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 9cae1e8..3756fd0 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -2139,24 +2139,6 @@ test_crypto_curve25519_persist(void *arg) tor_free(tag); } -static void * -ed25519_testcase_setup(const struct testcase_t *testcase) -{ - crypto_ed25519_testing_force_impl(testcase->setup_data); - return testcase->setup_data; -} -static int -ed25519_testcase_cleanup(const struct testcase_t *testcase, void *ptr) -{ - (void)testcase; - (void)ptr; - crypto_ed25519_testing_restore_impl(); - return 1; -} -static const struct testcase_setup_t ed25519_test_setup = { - ed25519_testcase_setup, ed25519_testcase_cleanup -}; - static void test_crypto_ed25519_simple(void *arg) { @@ -2619,77 +2601,6 @@ test_crypto_ed25519_testvectors(void *arg) } static void -test_crypto_ed25519_fuzz_donna(void *arg) -{ - const unsigned iters = 1024; - uint8_t msg[1024]; - unsigned i; - (void)arg; - - tt_assert(sizeof(msg) == iters); - crypto_rand((char*) msg, sizeof(msg)); - - /* Fuzz Ed25519-donna vs ref10, alternating the implementation used to - * generate keys/sign per iteration. - */ - for (i = 0; i < iters; ++i) { - const int use_donna = i & 1; - uint8_t blinding[32]; - curve25519_keypair_t ckp; - ed25519_keypair_t kp, kp_blind, kp_curve25519; - ed25519_public_key_t pk, pk_blind, pk_curve25519; - ed25519_signature_t sig, sig_blind; - int bit = 0; - - crypto_rand((char*) blinding, sizeof(blinding)); - - /* Impl. A: - * 1. Generate a keypair. - * 2. Blinded the keypair. - * 3. Sign a message (unblinded). - * 4. Sign a message (blinded). - * 5. Generate a curve25519 keypair, and convert it to Ed25519. - */ - ed25519_set_impl_params(use_donna); - tt_int_op(0, OP_EQ, ed25519_keypair_generate(&kp, i&1)); - tt_int_op(0, OP_EQ, ed25519_keypair_blind(&kp_blind, &kp, blinding)); - tt_int_op(0, OP_EQ, ed25519_sign(&sig, msg, i, &kp)); - tt_int_op(0, OP_EQ, ed25519_sign(&sig_blind, msg, i, &kp_blind)); - - tt_int_op(0, OP_EQ, curve25519_keypair_generate(&ckp, i&1)); - tt_int_op(0, OP_EQ, ed25519_keypair_from_curve25519_keypair( - &kp_curve25519, &bit, &ckp)); - - /* Impl. B: - * 1. Validate the public key by rederiving it. - * 2. Validate the blinded public key by rederiving it. - * 3. Validate the unblinded signature (and test a invalid signature). - * 4. Validate the blinded signature. - * 5. Validate the public key (from Curve25519) by rederiving it. - */ - ed25519_set_impl_params(!use_donna); - tt_int_op(0, OP_EQ, ed25519_public_key_generate(&pk, &kp.seckey)); - tt_mem_op(pk.pubkey, OP_EQ, kp.pubkey.pubkey, 32); - - tt_int_op(0, OP_EQ, ed25519_public_blind(&pk_blind, &kp.pubkey, blinding)); - tt_mem_op(pk_blind.pubkey, OP_EQ, kp_blind.pubkey.pubkey, 32); - - tt_int_op(0, OP_EQ, ed25519_checksig(&sig, msg, i, &pk)); - sig.sig[0] ^= 15; - tt_int_op(-1, OP_EQ, ed25519_checksig(&sig, msg, sizeof(msg), &pk)); - - tt_int_op(0, OP_EQ, ed25519_checksig(&sig_blind, msg, i, &pk_blind)); - - tt_int_op(0, OP_EQ, ed25519_public_key_from_curve25519_public_key( - &pk_curve25519, &ckp.pubkey, bit)); - tt_mem_op(pk_curve25519.pubkey, OP_EQ, kp_curve25519.pubkey.pubkey, 32); - } - - done: - ; -} - -static void test_crypto_ed25519_storage(void *arg) { (void)arg; @@ -2995,7 +2906,6 @@ struct testcase_t crypto_tests[] = { ED25519_TEST(convert, 0), ED25519_TEST(blinding, 0), ED25519_TEST(testvectors, 0), - ED25519_TEST(fuzz_donna, TT_FORK), { "ed25519_storage", test_crypto_ed25519_storage, 0, NULL, NULL }, { "siphash", test_crypto_siphash, 0, NULL, NULL }, { "failure_modes", test_crypto_failure_modes, TT_FORK, NULL, NULL }, diff --git a/src/test/test_crypto_slow.c b/src/test/test_crypto_slow.c index 6f3e40e..26b3d40 100644 --- a/src/test/test_crypto_slow.c +++ b/src/test/test_crypto_slow.c @@ -503,9 +503,88 @@ test_crypto_pwbox(void *arg) tor_free(decoded); } +static void +test_crypto_ed25519_fuzz_donna(void *arg) +{ + const unsigned iters = 1024; + uint8_t msg[1024]; + unsigned i; + (void)arg; + + tt_assert(sizeof(msg) == iters); + crypto_rand((char*) msg, sizeof(msg)); + + /* Fuzz Ed25519-donna vs ref10, alternating the implementation used to + * generate keys/sign per iteration. + */ + for (i = 0; i < iters; ++i) { + const int use_donna = i & 1; + uint8_t blinding[32]; + curve25519_keypair_t ckp; + ed25519_keypair_t kp, kp_blind, kp_curve25519; + ed25519_public_key_t pk, pk_blind, pk_curve25519; + ed25519_signature_t sig, sig_blind; + int bit = 0; + + crypto_rand((char*) blinding, sizeof(blinding)); + + /* Impl. A: + * 1. Generate a keypair. + * 2. Blinded the keypair. + * 3. Sign a message (unblinded). + * 4. Sign a message (blinded). + * 5. Generate a curve25519 keypair, and convert it to Ed25519. + */ + ed25519_set_impl_params(use_donna); + tt_int_op(0, OP_EQ, ed25519_keypair_generate(&kp, i&1)); + tt_int_op(0, OP_EQ, ed25519_keypair_blind(&kp_blind, &kp, blinding)); + tt_int_op(0, OP_EQ, ed25519_sign(&sig, msg, i, &kp)); + tt_int_op(0, OP_EQ, ed25519_sign(&sig_blind, msg, i, &kp_blind)); + + tt_int_op(0, OP_EQ, curve25519_keypair_generate(&ckp, i&1)); + tt_int_op(0, OP_EQ, ed25519_keypair_from_curve25519_keypair( + &kp_curve25519, &bit, &ckp)); + + /* Impl. B: + * 1. Validate the public key by rederiving it. + * 2. Validate the blinded public key by rederiving it. + * 3. Validate the unblinded signature (and test a invalid signature). + * 4. Validate the blinded signature. + * 5. Validate the public key (from Curve25519) by rederiving it. + */ + ed25519_set_impl_params(!use_donna); + tt_int_op(0, OP_EQ, ed25519_public_key_generate(&pk, &kp.seckey)); + tt_mem_op(pk.pubkey, OP_EQ, kp.pubkey.pubkey, 32); + + tt_int_op(0, OP_EQ, ed25519_public_blind(&pk_blind, &kp.pubkey, blinding)); + tt_mem_op(pk_blind.pubkey, OP_EQ, kp_blind.pubkey.pubkey, 32); + + tt_int_op(0, OP_EQ, ed25519_checksig(&sig, msg, i, &pk)); + sig.sig[0] ^= 15; + tt_int_op(-1, OP_EQ, ed25519_checksig(&sig, msg, sizeof(msg), &pk)); + + tt_int_op(0, OP_EQ, ed25519_checksig(&sig_blind, msg, i, &pk_blind)); + + tt_int_op(0, OP_EQ, ed25519_public_key_from_curve25519_public_key( + &pk_curve25519, &ckp.pubkey, bit)); + tt_mem_op(pk_curve25519.pubkey, OP_EQ, kp_curve25519.pubkey.pubkey, 32); + } + + done: + ; +} + #define CRYPTO_LEGACY(name) \ { #name, test_crypto_ ## name , 0, NULL, NULL } +#define ED25519_TEST_ONE(name, fl, which) \ + { #name "/ed25519_" which, test_crypto_ed25519_ ## name, (fl), \ + &ed25519_test_setup, (void*)which } + +#define ED25519_TEST(name, fl) \ + ED25519_TEST_ONE(name, (fl), "donna"), \ + ED25519_TEST_ONE(name, (fl), "ref10") + struct testcase_t slow_crypto_tests[] = { CRYPTO_LEGACY(s2k_rfc2440), #ifdef HAVE_LIBSCRYPT @@ -527,6 +606,7 @@ struct testcase_t slow_crypto_tests[] = { { "scrypt_vectors", test_crypto_scrypt_vectors, 0, NULL, NULL }, { "pbkdf2_vectors", test_crypto_pbkdf2_vectors, 0, NULL, NULL }, { "pwbox", test_crypto_pwbox, 0, NULL, NULL }, + ED25519_TEST(fuzz_donna, TT_FORK), END_OF_TESTCASES }; diff --git a/src/test/testing_common.c b/src/test/testing_common.c index dedacf8..2858c9e 100644 --- a/src/test/testing_common.c +++ b/src/test/testing_common.c @@ -213,6 +213,25 @@ passthrough_test_cleanup(const struct testcase_t *testcase, void *ptr) return 1; } + +static void * +ed25519_testcase_setup(const struct testcase_t *testcase) +{ + crypto_ed25519_testing_force_impl(testcase->setup_data); + return testcase->setup_data; +} +static int +ed25519_testcase_cleanup(const struct testcase_t *testcase, void *ptr) +{ + (void)testcase; + (void)ptr; + crypto_ed25519_testing_restore_impl(); + return 1; +} +const struct testcase_setup_t ed25519_test_setup = { + ed25519_testcase_setup, ed25519_testcase_cleanup +}; + const struct testcase_setup_t passthrough_setup = { passthrough_test_setup, passthrough_test_cleanup };

1 0

[tor/master] Re-enable RSA cacheing in tests, with a better design.
by nickm＠torproject.org 09 Sep '16

09 Sep '16

commit 5ec395b27fd9ccb3fcac627d1ae323c4d06130f3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 9 08:47:41 2016 -0400 Re-enable RSA cacheing in tests, with a better design. This makes tests faster and saves about 6 seconds for me, which makes it worth it, according to https://xkcd.com/1205. --- src/test/testing_common.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/src/test/testing_common.c b/src/test/testing_common.c index 29f36a3..dedacf8 100644 --- a/src/test/testing_common.c +++ b/src/test/testing_common.c @@ -156,30 +156,30 @@ remove_directory(void) } /** Define this if unit tests spend too much time generating public keys*/ -#undef CACHE_GENERATED_KEYS +#define CACHE_GENERATED_KEYS -static crypto_pk_t *pregen_keys[5] = {NULL, NULL, NULL, NULL, NULL}; -#define N_PREGEN_KEYS ARRAY_LENGTH(pregen_keys) +#define N_PREGEN_KEYS 11 +static crypto_pk_t *pregen_keys[N_PREGEN_KEYS]; +static int next_key_idx; /** Generate and return a new keypair for use in unit tests. If we're using - * the key cache optimization, we might reuse keys: we only guarantee that - * keys made with distinct values for <b>idx</b> are different. The value of - * <b>idx</b> must be at least 0, and less than N_PREGEN_KEYS. */ + * the key cache optimization, we might reuse keys. "idx" is ignored. + * Our only guarantee is that we won't reuse a key till this function has been + * called several times. The order in which keys are returned is slightly + * randomized, so that tests that depend on a particular order will not be + * reliable. */ crypto_pk_t * pk_generate(int idx) { - int res; + (void) idx; #ifdef CACHE_GENERATED_KEYS - tor_assert(idx < N_PREGEN_KEYS); - if (! pregen_keys[idx]) { - pregen_keys[idx] = crypto_pk_new(); - res = crypto_pk_generate_key(pregen_keys[idx]); - tor_assert(!res); - } - return crypto_pk_dup_key(pregen_keys[idx]); + /* Either skip 1 or 2 keys. */ + next_key_idx += crypto_rand_int_range(1,3); + next_key_idx %= N_PREGEN_KEYS; + return crypto_pk_dup_key(pregen_keys[next_key_idx]); #else crypto_pk_t *result; - (void) idx; + int res; result = crypto_pk_new(); res = crypto_pk_generate_key(result); tor_assert(!res); @@ -307,6 +307,14 @@ main(int c, const char **v) } tor_set_failed_assertion_callback(an_assertion_failed); +#ifdef CACHE_GENERATED_KEYS + for (i = 0; i < N_PREGEN_KEYS; ++i) { + pregen_keys[i] = crypto_pk_new(); + int r = crypto_pk_generate_key(pregen_keys[i]); + tor_assert(r == 0); + } +#endif + atexit(remove_directory); int have_failed = (tinytest_main(c, v, testgroups) != 0);

1 0

[translation/tails-misc_completed] Update translations for tails-misc_completed
by translation＠torproject.org 09 Sep '16

09 Sep '16

commit b90722bf552dc5b57f6ea74049ff5ececdee4bbb Author: Translation commit bot <translation(a)torproject.org> Date: Fri Sep 9 12:46:14 2016 +0000 Update translations for tails-misc_completed --- hr_HR.po | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hr_HR.po b/hr_HR.po index f0d978e..389f296 100644 --- a/hr_HR.po +++ b/hr_HR.po @@ -13,8 +13,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2016-09-02 16:02+0200\n" -"PO-Revision-Date: 2016-09-03 08:57+0000\n" -"Last-Translator: carolyn <carolyn(a)anhalt.org>\n" +"PO-Revision-Date: 2016-09-09 12:46+0000\n" +"Last-Translator: Igor <lyricaltumor(a)gmail.com>\n" "Language-Team: Croatian (Croatia) (http://www.transifex.com/otf/torproject/language/hr_HR/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -231,7 +231,7 @@ msgid "" "monitor what you are doing in Tails. Only free software can be considered " "trustworthy, for both the host operating system and the virtualization " "software." -msgstr "Operativni sustav i virtualizacijski software mogu nadgledati što radite u Tails-u. Samo se slobodan software može smatrati vjerodostojnim, kako za operativni sustav tako i za virtualizacijski software." +msgstr "Operativni sustav i virtualizacijski software mogu nadgledati što radite u Tailsu. Samo se slobodan software može smatrati vjerodostojnim, kako za operativni sustav tako i za virtualizacijski software." #: config/chroot_local-includes/usr/local/lib/tails-virt-notify-user:79 msgid "Learn more"

1 0

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 09 Sep '16

09 Sep '16

commit a77674d0e4fd52266661c22d710cd9975a20bb71 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Sep 9 12:46:10 2016 +0000 Update translations for tails-misc --- hr_HR.po | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hr_HR.po b/hr_HR.po index f0d978e..389f296 100644 --- a/hr_HR.po +++ b/hr_HR.po @@ -13,8 +13,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2016-09-02 16:02+0200\n" -"PO-Revision-Date: 2016-09-03 08:57+0000\n" -"Last-Translator: carolyn <carolyn(a)anhalt.org>\n" +"PO-Revision-Date: 2016-09-09 12:46+0000\n" +"Last-Translator: Igor <lyricaltumor(a)gmail.com>\n" "Language-Team: Croatian (Croatia) (http://www.transifex.com/otf/torproject/language/hr_HR/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -231,7 +231,7 @@ msgid "" "monitor what you are doing in Tails. Only free software can be considered " "trustworthy, for both the host operating system and the virtualization " "software." -msgstr "Operativni sustav i virtualizacijski software mogu nadgledati što radite u Tails-u. Samo se slobodan software može smatrati vjerodostojnim, kako za operativni sustav tako i za virtualizacijski software." +msgstr "Operativni sustav i virtualizacijski software mogu nadgledati što radite u Tailsu. Samo se slobodan software može smatrati vjerodostojnim, kako za operativni sustav tako i za virtualizacijski software." #: config/chroot_local-includes/usr/local/lib/tails-virt-notify-user:79 msgid "Learn more"

1 0

[tor-browser-bundle/master] Bug 19528: set MOZ_BUILD_DATE based on firefox version
by gk＠torproject.org 09 Sep '16

09 Sep '16

commit ba7f0fcf914e889f78c0562a46e6026462f10ac8 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Fri Sep 9 14:07:39 2016 +0200 Bug 19528: set MOZ_BUILD_DATE based on firefox version The MOZ_BUILD_DATE environment variable is used as the build id. --- gitian/build-helpers/get-moz-build-date | 18 ++++++++++++++++++ gitian/descriptors/linux/gitian-firefox.yml | 3 ++- gitian/descriptors/mac/gitian-firefox.yml | 3 ++- gitian/descriptors/windows/gitian-firefox.yml | 3 ++- tools/update-responses/update_responses | 27 ++++++++++++++++++++++++++- 5 files changed, 50 insertions(+), 4 deletions(-) diff --git a/gitian/build-helpers/get-moz-build-date b/gitian/build-helpers/get-moz-build-date new file mode 100755 index 0000000..168a8c7 --- /dev/null +++ b/gitian/build-helpers/get-moz-build-date @@ -0,0 +1,18 @@ +#!/usr/bin/perl -w +# Generate a MOZ_BUILD_DATE based on firefox version number + +use strict; + +my ($year) = split('-', `git show -s --format='%ci'`); + +die "missing argument" unless @ARGV; +my $version = $ARGV[0]; +$version =~ s/\D+$//; +my @v = split(/[\.ab]/, $version); +push @v, '0' if @v < 4; +push @v, '0' if @v < 4; +my $day_of_month = int(($v[0] - 45) / 5); +my $date = 101010101 + $year * 10000000000 + $day_of_month * 1000000 + + $v[1] * 10000 + $v[2] * 100 + $v[3]; +$date += 100000000 unless $version =~ m/[ab]/; +print "export MOZ_BUILD_DATE=$date\n"; diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 1316ed8..14799d6 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -33,6 +33,7 @@ files: - "binutils-linux64-utils.zip" - "gcc-linux32-utils.zip" - "gcc-linux64-utils.zip" +- "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "versions" @@ -92,7 +93,7 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) + eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/mac/gitian-firefox.yml b/gitian/descriptors/mac/gitian-firefox.yml index fdec679..bd7d7f7 100644 --- a/gitian/descriptors/mac/gitian-firefox.yml +++ b/gitian/descriptors/mac/gitian-firefox.yml @@ -19,6 +19,7 @@ files: - "clang-linux64-wheezy-utils.zip" - "cctools.tar.gz" - "MacOSX10.7.sdk.tar.gz" +- "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "fix-info-plist.py" @@ -48,7 +49,7 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) + eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" make $MAKEOPTS -f client.mk build diff --git a/gitian/descriptors/windows/gitian-firefox.yml b/gitian/descriptors/windows/gitian-firefox.yml index 3261199..788b053 100644 --- a/gitian/descriptors/windows/gitian-firefox.yml +++ b/gitian/descriptors/windows/gitian-firefox.yml @@ -15,6 +15,7 @@ remotes: files: - "gcc-linux32-precise-utils.zip" - "mingw-w64-win32-utils.zip" +- "get-moz-build-date" - "re-dzip.sh" - "dzip.sh" - "gcclibs-win32-utils.zip" @@ -73,7 +74,7 @@ script: | find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" rm -f configure rm -f js/src/configure - export MOZ_BUILD_DATE=$(date -d "$REFERENCE_DATETIME" +%Y%m%d%H%M%S) + eval $(~/build/get-moz-build-date $(cat browser/config/version.txt)) make -f client.mk configure CONFIGURE_ARGS="--with-tor-browser-version=${TORBROWSER_VERSION} --enable-update-channel=${TORBROWSER_UPDATE_CHANNEL} --enable-bundled-fonts" find -type f -print0 | xargs -0 touch --date="$REFERENCE_DATETIME" # diff --git a/tools/update-responses/update_responses b/tools/update-responses/update_responses index faa1037..498132e 100755 --- a/tools/update-responses/update_responses +++ b/tools/update-responses/update_responses @@ -238,6 +238,30 @@ sub channel_to_version { return map { $config->{channels}{$_} } @channels; } +sub get_buildinfos { + my ($config, $version) = @_; + return if exists $config->{versions}{$version}{buildID}; + my $files = $config->{versions}{$version}{files}; + foreach my $os (keys %$files) { + foreach my $lang (keys %{$files->{$os}}) { + next unless $files->{$os}{$lang}{complete}; + my $tmpdir = File::Temp->newdir(); + extract_mar(mar_filename($version, $os, $lang), "$tmpdir"); + my $appfile = "$tmpdir/application.ini" if -f "$tmpdir/application.ini"; + $appfile = "$tmpdir/Contents/Resources/application.ini" + if -f "$tmpdir/Contents/Resources/application.ini"; + exit_error "Could not find application.ini" unless $appfile; + foreach my $line (read_file("$tmpdir/application.ini")) { + if ($line =~ m/^BuildID=(.*)$/) { + $config->{versions}{$version}{buildID} = $1; + return; + } + } + exit_error "Could not extract buildID from application.ini"; + } + } +} + sub get_response { my ($config, $version, $os, @patches) = @_; my $res; @@ -257,7 +281,7 @@ sub get_response { displayVersion => $version, appVersion => $version, platformVersion => get_config($config, $version, $os, 'platformVersion'), - buildID => '20000101000000', + buildID => get_config($config, $version, $os, 'buildID'), detailsURL => get_config($config, $version, $os, 'detailsURL'), actions => 'showURL', openURL => get_config($config, $version, $os, 'detailsURL'), @@ -281,6 +305,7 @@ sub write_responses { foreach my $channel (@channels) { my $version = $config->{channels}{$channel}; get_version_files($config, $version); + get_buildinfos($config, $version); my $files = $config->{versions}{$version}{files}; my $migrate_archs = $config->{versions}{$version}{migrate_archs} // {}; foreach my $old_os (keys %$migrate_archs) {

1 0

[translation/tails-onioncircuits] Update translations for tails-onioncircuits
by translation＠torproject.org 09 Sep '16

09 Sep '16

commit ba0d4e439b35506b027b0724ec1a424e16fa779c Author: Translation commit bot <translation(a)torproject.org> Date: Fri Sep 9 09:48:35 2016 +0000 Update translations for tails-onioncircuits --- vi/onioncircuits.pot | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/vi/onioncircuits.pot b/vi/onioncircuits.pot index 5d9fafd..0adfac5 100644 --- a/vi/onioncircuits.pot +++ b/vi/onioncircuits.pot @@ -3,13 +3,14 @@ # This file is distributed under the same license as the PACKAGE package. # # Translators: +# Khanh Nguyen <nguyenduykhanh85(a)gmail.com>, 2016 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2016-05-31 14:42+0200\n" -"PO-Revision-Date: 2016-06-01 09:23+0000\n" -"Last-Translator: carolyn <carolyn(a)anhalt.org>\n" +"PO-Revision-Date: 2016-09-09 09:20+0000\n" +"Last-Translator: Khanh Nguyen <nguyenduykhanh85(a)gmail.com>\n" "Language-Team: Vietnamese (http://www.transifex.com/otf/torproject/language/vi/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -19,7 +20,7 @@ msgstr "" #: ../onioncircuits:81 msgid "You are not connected to Tor yet..." -msgstr "" +msgstr "Bạn chưa kết nối vào Tor..." #: ../onioncircuits:95 msgid "Onion Circuits"

1 0

[translation/torbutton-abouttbupdatedtd] Update translations for torbutton-abouttbupdatedtd
by translation＠torproject.org 09 Sep '16

09 Sep '16

commit 8af2fe9cb2ee707a6aa8a7a7421898e8b5f1991f Author: Translation commit bot <translation(a)torproject.org> Date: Fri Sep 9 09:48:29 2016 +0000 Update translations for torbutton-abouttbupdatedtd --- vi/abouttbupdate.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vi/abouttbupdate.dtd b/vi/abouttbupdate.dtd index 37567bd..4f0a9d4 100644 --- a/vi/abouttbupdate.dtd +++ b/vi/abouttbupdate.dtd @@ -1,4 +1,4 @@ -<!ENTITY aboutTBUpdate.title "Tor Browser Update"> +<!ENTITY aboutTBUpdate.title "Cập nhật về Trình duyệt Tor"> <!ENTITY aboutTBUpdate.updated "Tor Browser has been updated."> <!ENTITY aboutTBUpdate.linkPrefix "For the most up-to-date information about this release, "> <!ENTITY aboutTBUpdate.linkLabel "visit our website">

1 0

[translation/tails-iuk] Update translations for tails-iuk
by translation＠torproject.org 09 Sep '16

09 Sep '16

commit 5dfa9983fa3867d7e8d251bc7e741e679f9ce186 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Sep 9 09:46:38 2016 +0000 Update translations for tails-iuk --- vi.po | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/vi.po b/vi.po index 4ff48de..52a1ce1 100644 --- a/vi.po +++ b/vi.po @@ -3,14 +3,14 @@ # This file is distributed under the same license as the PACKAGE package. # # Translators: -# Khanh Nguyen <nguyenduykhanh85(a)gmail.com>, 2015 +# Khanh Nguyen <nguyenduykhanh85(a)gmail.com>, 2015-2016 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2016-05-25 16:55+0200\n" -"PO-Revision-Date: 2016-05-26 08:49+0000\n" -"Last-Translator: carolyn <carolyn(a)anhalt.org>\n" +"PO-Revision-Date: 2016-09-09 09:19+0000\n" +"Last-Translator: Khanh Nguyen <nguyenduykhanh85(a)gmail.com>\n" "Language-Team: Vietnamese (http://www.transifex.com/otf/torproject/language/vi/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -23,7 +23,7 @@ msgstr "" msgid "" "For debugging information, execute the following command: sudo tails-" "debugging-info" -msgstr "" +msgstr "Để có thông tin gỡ rỗi, thực thi dòng lệnh dưới đây: sudo tails-debugging-info" #: ../lib/Tails/IUK/Frontend.pm:217 msgid "Error while checking for upgrades"

1 0