August 2018 - tor-commits - lists.torproject.org

[tor-browser-build/master] Bug 27101: fix tor build issue with rust enabled
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 3ba2bd456ac69f81ffbf5f0baa403ad005aeff34 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Aug 13 15:12:07 2018 +0200 Bug 27101: fix tor build issue with rust enabled Fix build issue introduced by the fix for #25485. --- projects/tor/build | 2 ++ 1 file changed, 2 insertions(+) diff --git a/projects/tor/build b/projects/tor/build index 89a5418..c8f63bc 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -57,6 +57,8 @@ openssldir=/var/tmp/dist/openssl chmod 700 "$distdir"/Tor/libstdc++/*.so* # This is needed to make RPATH unavailable. See bug 9150. export LD_LIBRARY_PATH="$distdir/Tor/" + # Add libstdc++ to LD_LIBRARY_PATH to avoid rust link issue (bug 27101) + export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$distdir/Tor/libstdc++/" [% END %] [% IF c("var/osx") %]

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] squash! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 975b6f238bf21fc0e567f7622871a3f55722913d Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Aug 1 09:44:12 2018 -0700 squash! TB4: Tor Browser's Firefox preference overrides. Bug 17252: Enable session identifiers with FPI Session tickets and session identifiers were isolated by OriginAttributes, so we can re-enable them by allowing the default value (true) of "security.ssl.disable_session_identifiers". The pref "security.enable_tls_session_tickets" is obsolete (removed in https://bugzilla.mozilla.org/917049) --- browser/app/profile/000-tor-browser.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 57d04f36bc3d..d0fdbe1040b4 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -174,7 +174,6 @@ pref("browser.cache.frecency_experiment", -1); // Third party stuff pref("privacy.firstparty.isolate", true); // Always enforce first party isolation pref("network.cookie.cookieBehavior", 1); -pref("security.enable_tls_session_tickets", false); pref("network.http.spdy.enabled", false); // Stores state and may have keepalive issues (both fixable) pref("network.http.spdy.enabled.v2", false); // Seems redundant, but just in case pref("network.http.spdy.enabled.v3", false); // Seems redundant, but just in case @@ -270,7 +269,6 @@ pref("network.http.pipelining.reschedule-timeout", 15000); pref("network.http.pipelining.read-timeout", 60000); // Hacked pref: Now means "Attempt to pipeline at least this many requests together" pref("network.http.pipelining.max-optimistic-requests", 3); -pref("security.ssl.disable_session_identifiers", true); pref("network.manage-offline-status", false); // No need to leak things to Mozilla, see bug 21790 pref("network.captive-portal-service.enabled", false);

1 0

[onionoo/master] Bump version to 6.2-1.16.1-dev.
by karsten＠torproject.org 13 Aug '18

13 Aug '18

commit 0c5d37441da66ce3af9a85ee8902dbe6a07fb352 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Aug 13 14:35:43 2018 +0200 Bump version to 6.2-1.16.1-dev. --- build.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.xml b/build.xml index 850b68b..cd69295 100644 --- a/build.xml +++ b/build.xml @@ -10,7 +10,7 @@ <property name="implementation-title" value="Onionoo" /> <property name="onionoo.protocol.version" value="6.2"/> <property name="release.version" - value="${onionoo.protocol.version}-1.16.1"/> + value="${onionoo.protocol.version}-1.16.1-dev"/> <property name="metricslibversion" value="2.4.0"/> <property name="jetty.version" value="-9.2.21.v20170120" /> <property name="warfile"

1 0

[onionoo/master] Prepare for 6.2-1.16.1 release.
by karsten＠torproject.org 13 Aug '18

13 Aug '18

commit 7d73a0c62723ac7423ab1223b6ab84a2f071cd0a Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Aug 13 09:40:20 2018 +0200 Prepare for 6.2-1.16.1 release. --- CHANGELOG.md | 2 +- build.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 55b0d63..d6a28c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -# Changes in version 6.2-1.16.? - 2018-08-?? +# Changes in version 6.2-1.16.1 - 2018-08-13 * Medium changes - Fix JSON serialization of history objects. diff --git a/build.xml b/build.xml index 5acacaa..850b68b 100644 --- a/build.xml +++ b/build.xml @@ -10,7 +10,7 @@ <property name="implementation-title" value="Onionoo" /> <property name="onionoo.protocol.version" value="6.2"/> <property name="release.version" - value="${onionoo.protocol.version}-1.16.0-dev"/> + value="${onionoo.protocol.version}-1.16.1"/> <property name="metricslibversion" value="2.4.0"/> <property name="jetty.version" value="-9.2.21.v20170120" /> <property name="warfile"

1 0

[onionoo/master] Fix JSON serialization of history objects.
by karsten＠torproject.org 13 Aug '18

13 Aug '18

commit 3be9f20055b0b427e5d8647540dc540330dd4332 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Aug 8 10:56:12 2018 +0200 Fix JSON serialization of history objects. Fixes #27039. --- CHANGELOG.md | 6 ++++++ .../java/org/torproject/onionoo/docs/GraphHistory.java | 15 +++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 99422f7..55b0d63 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +# Changes in version 6.2-1.16.? - 2018-08-?? + + * Medium changes + - Fix JSON serialization of history objects. + + # Changes in version 6.2-1.16.0 - 2018-08-03 * Medium changes diff --git a/src/main/java/org/torproject/onionoo/docs/GraphHistory.java b/src/main/java/org/torproject/onionoo/docs/GraphHistory.java index 495f01a..303bae4 100644 --- a/src/main/java/org/torproject/onionoo/docs/GraphHistory.java +++ b/src/main/java/org/torproject/onionoo/docs/GraphHistory.java @@ -3,8 +3,23 @@ package org.torproject.onionoo.docs; +import com.fasterxml.jackson.annotation.JsonAutoDetect; +import com.fasterxml.jackson.annotation.JsonInclude; +import com.fasterxml.jackson.databind.PropertyNamingStrategy; +import com.fasterxml.jackson.databind.annotation.JsonNaming; + import java.util.List; +/* Use snake_case for naming fields rather than camelCase. */ +(a)JsonNaming(PropertyNamingStrategy.SnakeCaseStrategy.class) +/* Exclude fields that are null or empty. */ +(a)JsonInclude(JsonInclude.Include.NON_EMPTY) +/* Only consider fields, no getters, setters, or constructors. */ +@JsonAutoDetect(creatorVisibility = JsonAutoDetect.Visibility.NONE, + fieldVisibility = JsonAutoDetect.Visibility.ANY, + getterVisibility = JsonAutoDetect.Visibility.NONE, + isGetterVisibility = JsonAutoDetect.Visibility.NONE, + setterVisibility = JsonAutoDetect.Visibility.NONE) public class GraphHistory { private String first;

1 0

[tor-browser/tor-browser-60.1.0esr-8.0-1] fixup! TB4: Tor Browser's Firefox preference overrides.
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit 49b80d55c275d4a59484b8e955d9d4eeac2d8d44 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Aug 1 07:59:54 2018 +0000 fixup! TB4: Tor Browser's Firefox preference overrides. Fixes bug 26409. We rely on the fix for Mozilla's bug 1039069 for providing a spoofed Accept-Language header/JS locale if the user wants to. --- browser/app/profile/000-tor-browser.js | 4 ---- 1 file changed, 4 deletions(-) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 1ab4dd39a13c..57d04f36bc3d 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -147,10 +147,6 @@ pref("browser.zoom.siteSpecific", false); pref("intl.charset.default", "windows-1252"); pref("browser.link.open_newwindow.restriction", 0); // Bug 9881: Open popups in new tabs (to avoid fullscreen popups) pref("dom.gamepad.enabled", false); // bugs.torproject.org/13023 -pref("javascript.use_us_english_locale", true); -// pref("intl.accept_languages", "en-us, en"); // Set by Torbutton -// pref("intl.accept_charsets", "iso-8859-1,*,utf-8"); // Set by Torbutton -// pref("intl.charsetmenu.browser.cache", "UTF-8"); // Set by Torbutton // Disable video statistics fingerprinting vector (bug 15757) pref("media.video_stats.enabled", false); // Set video VP9 to 0 for everyone (bug 22548)

1 0

[torbutton/master] Bug 26409: Remove spoofed locale implementation
by gk＠torproject.org 13 Aug '18

13 Aug '18

commit e950aeac23670983bedd84c6526bb9a865450a25 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Aug 1 08:04:21 2018 +0000 Bug 26409: Remove spoofed locale implementation In bug 1039069 Mozilla implemented the option of spoofing the locale in the Accept-Language header/JS locale if users with localized builds want that for better fingerprinting protection. That makes our workaround in Torbutton obsolete and we can remove it. Otherwise users start to get the respective language prompt twice, which is quite annoying. --- src/chrome/content/torbutton.js | 109 +----------------------------- src/chrome/locale/en/torbutton.properties | 1 - src/defaults/preferences/preferences.js | 2 - 3 files changed, 1 insertion(+), 111 deletions(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 18895927..d0195b46 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -12,7 +12,7 @@ let { showDialog } = Cu.import("resource://torbutton/modules/utils.js", {}); let { getLocale, unescapeTorString } = Cu.import("resource://torbutton/modules/utils.js", {}); let SecurityPrefs = Cu.import("resource://torbutton/modules/security-prefs.js", {}); let NoScriptControl = Cu.import("resource://torbutton/modules/noscript-control.js", {}); -let { bindPrefAndInit, observe } = Cu.import("resource://torbutton/modules/utils.js", {}); +let { bindPrefAndInit } = Cu.import("resource://torbutton/modules/utils.js", {}); Cu.importGlobalProperties(["XMLHttpRequest"]); @@ -170,7 +170,6 @@ var torbutton_unique_pref_observer = torbutton_use_nontor_proxy(); break; case "privacy.resistFingerprinting": - case "extensions.torbutton.spoof_english": torbutton_update_fingerprinting_prefs(); break; case "privacy.firstparty.isolate": @@ -463,36 +462,6 @@ var torbutton_abouttor_message_handler = { } }; -function torbutton_should_prompt_for_language_preference() { - return torbutton_get_general_useragent_locale().substring(0, 2) != "en" && - !m_tb_prefs.getBoolPref("extensions.torbutton.prompted_language"); -} - - -// Bug 1506 P3: This code asks the user once if they want to spoof their -// language to English. -// -// Asks the user whether Torbutton should make "English requests", and updates -// the extensions.torbutton.spoof_english preference accordingly. -function torbutton_prompt_for_language_preference() { - var prompts = Cc["@mozilla.org/embedcomp/prompt-service;1"] - .getService(Ci.nsIPromptService); - - // Display two buttons, both with string titles. - var flags = prompts.STD_YES_NO_BUTTONS; - - var message = torbutton_get_property_string("torbutton.popup.prompted_language"); - - m_tb_prefs.setBoolPref("extensions.torbutton.prompted_language", true); - // Display modal prompt, anchored to this window. - var response = prompts.confirmEx(window, "", message, flags, - null, null, null, null, {value: false}); - - // Update preferences to reflect their response and to prevent the prompt from - // being displayed again. - m_tb_prefs.setBoolPref("extensions.torbutton.spoof_english", response == 0); -} - function torbutton_confirm_plugins() { var any_plugins_enabled = false; var PH=Cc["@mozilla.org/plugin/host;1"].getService(Ci.nsIPluginHost); @@ -1641,23 +1610,6 @@ function torbutton_update_disk_prefs() { function torbutton_update_fingerprinting_prefs() { var mode = m_tb_prefs.getBoolPref("privacy.resistFingerprinting"); - if (m_tb_tbb) { - if (mode) { - // Governed also by the spoof_english dialog.. - if (m_tb_prefs.getBoolPref("extensions.torbutton.spoof_english")) { - m_tb_prefs.setCharPref("intl.accept_languages", "en-US, en"); - m_tb_prefs.setBoolPref("javascript.use_us_english_locale", true); - } else { - if(m_tb_prefs.prefHasUserValue("intl.accept_languages")) - m_tb_prefs.clearUserPref("intl.accept_languages"); - m_tb_prefs.setBoolPref("javascript.use_us_english_locale", false); - } - } else { - if(m_tb_prefs.prefHasUserValue("intl.accept_languages")) - m_tb_prefs.clearUserPref("intl.accept_languages"); - } - } - m_tb_prefs.setBoolPref("webgl.min_capability_mode", mode); m_tb_prefs.setBoolPref("webgl.disable-extensions", mode); m_tb_prefs.setBoolPref("dom.network.enabled", !mode); @@ -2019,8 +1971,6 @@ function torbutton_is_windowed(wind) { return true; } -let stopLanguagePromptObserver; - // Bug 1506 P3: This is needed pretty much only for the version check // and the window resizing. See comments for individual functions for // details @@ -2054,15 +2004,6 @@ function torbutton_new_window(event) Ci.nsIWebProgress.NOTIFY_STATE_DOCUMENT); } - // If the default language is not English and we have not already asked, - // add an http-on-modify-request observer that will show a "request English - // language web pages?" prompt the first time a content http or https page - // is opened. - if (torbutton_should_prompt_for_language_preference()) { - stopLanguagePromptObserver = observe("http-on-modify-request", - torbutton_http_connection_observed); - } - // Check the version on every new window. We're already pinging check in these cases. torbutton_do_async_versioncheck(); @@ -2238,54 +2179,6 @@ var torbutton_resizelistener = onSecurityChange: function() {} }; -function torbutton_http_connection_observed(aRequest, aData) { - // If we are loading an HTTP page from content, show the - // "request English language web pages?" prompt. - try { - let httpChannel = aRequest.QueryInterface(Ci.nsIHttpChannel); - if (!aRequest.URI.schemeIs("http") && !aRequest.URI.schemeIs("https")) { - return; - } - if (!httpChannel) return; - let notificationCallbacks = httpChannel.notificationCallbacks; - if (!notificationCallbacks) return; - let loadContext = notificationCallbacks.getInterface(Ci.nsILoadContext); - if (!loadContext) return; - if (!loadContext.isContent) return; - // The above QI did not throw, the scheme is http[s], and we know the - // load context is content, so we must have a true HTTP request from content. - // Stop the observer and display the prompt if another window has - // not already done so. - stopLanguagePromptObserver(); - - if (torbutton_should_prompt_for_language_preference()) { - if (torbutton_is_homepage_url(aRequest.URI)) { - // If the homepage is being loaded, display the prompt after a - // delay to avoid a problem where a blank prompt is displayed. - // In this case, the homepage will be loaded using the current - // spoof English setting, which is OK. - setTimeout(function() { - if (torbutton_should_prompt_for_language_preference()) - torbutton_prompt_for_language_preference(); - }, 2000); - } else { - // No delay is needed. Display the prompt and fix up the - // Accept-Language header before allowing the load to continue. - torbutton_prompt_for_language_preference(); - - // The Accept-Language header for this request was set when the - // channel was created. Reset it to match the value that will be - // used for future requests. - let val = torbutton_get_current_accept_language_value(aRequest.URI); - if (val) - httpChannel.setRequestHeader("Accept-Language", val, false); - } - } - } catch (e) { - torbutton_log(3, e.message); - } -} - // aURI should be an http or https nsIURI object. function torbutton_get_current_accept_language_value(aURI) { diff --git a/src/chrome/locale/en/torbutton.properties b/src/chrome/locale/en/torbutton.properties index d77af1ee..53573df0 100644 --- a/src/chrome/locale/en/torbutton.properties +++ b/src/chrome/locale/en/torbutton.properties @@ -21,7 +21,6 @@ torbutton.popup.external.suggest = To be safe, you should only open downloaded f torbutton.popup.launch = Download file torbutton.popup.cancel = Cancel torbutton.popup.dontask = Automatically download files from now on -torbutton.popup.prompted_language = To give you more privacy, Torbutton can request the English language version of web pages. This may cause web pages that you prefer to read in your native language to display in English instead.\n\nWould you like to request English language web pages for better privacy? torbutton.popup.no_newnym = Torbutton cannot safely give you a new identity. It does not have access to the Tor Control Port.\n\nAre you running Tor Browser Bundle? torbutton.title.prompt_torbrowser = Important Torbutton Information torbutton.popup.prompt_torbrowser = Torbutton works differently now: you can't turn it off any more.\n\nWe made this change because it isn't safe to use Torbutton in a browser that's also used for non-Tor browsing. There were too many bugs there that we couldn't fix any other way.\n\nIf you want to keep using Firefox normally, you should uninstall Torbutton and download Tor Browser Bundle. The privacy properties of Tor Browser are also superior to those of normal Firefox, even when Firefox is used with Torbutton.\n\nTo remove Torbutton, go to Tools->Addons->Extensions and then click the Remove button next to Torbutton. diff --git a/src/defaults/preferences/preferences.js b/src/defaults/preferences/preferences.js index 5cfb0eb3..ab9b4bf4 100644 --- a/src/defaults/preferences/preferences.js +++ b/src/defaults/preferences/preferences.js @@ -19,7 +19,6 @@ pref("extensions.torbutton.use_nontor_proxy",false); // State prefs: pref("extensions.torbutton.startup",false); pref("extensions.torbutton.inserted_button",false); -pref("extensions.torbutton.prompted_language",false); // TODO: This is just part of a stopgap until #14429 gets properly implemented. // See #7255 for details. We display the warning three times to make sure the @@ -29,7 +28,6 @@ pref("extensions.torbutton.maximize_warnings_remaining", 3); // Security prefs: pref("extensions.torbutton.cookie_protections",true); pref("extensions.torbutton.cookie_auto_protect",false); -pref("extensions.torbutton.spoof_english",true); pref("extensions.torbutton.clear_http_auth",true); pref("extensions.torbutton.close_newnym",true); pref("extensions.torbutton.resize_new_windows",true);

1 0

[torspec/master] Merge remote-tracking branch 'teor/ticket26829'
by nickm＠torproject.org 13 Aug '18

13 Aug '18

commit e9b22d7e3e95de6a1ce891601af0b585ac4e1e6e Merge: 2d33e5f cc7ef26 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 13 06:22:10 2018 -0400 Merge remote-tracking branch 'teor/ticket26829' bandwidth-file-spec.txt | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)

1 0

[torspec/master] bandwidth-file-spec: files should be generated atomically
by nickm＠torproject.org 13 Aug '18

13 Aug '18

commit cc7ef26f026170990ac11e41baa30c156a2464f5 Author: teor <teor2345(a)gmail.com> Date: Wed Jul 18 11:49:16 2018 +1000 bandwidth-file-spec: files should be generated atomically Closes 26829. --- bandwidth-file-spec.txt | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/bandwidth-file-spec.txt b/bandwidth-file-spec.txt index 0b2c7af..9a3f63f 100644 --- a/bandwidth-file-spec.txt +++ b/bandwidth-file-spec.txt @@ -358,11 +358,25 @@ In version 1.1.0, the KeyValue can be in any arbitrary order. header format. If there are, the parser MAY ignore conflicting keywords. -2.4. Implementation notes +2.4. Implementation details + +2.4.1 Writing bandwidth files atomically + +To avoid inconsistent reads, implementations SHOULD write bandwidth files +atomically. If the file is transferred from another host, it SHOULD be +written to a temporary path, then renamed to the V3BandwidthsFile path. + +sbws versions 0.7.0 and later write the bandwidth file to an archival location, +create a temporary symlink to that location, then atomically rename the symlink +to the configured V3BandwidthsFile path. + +Torflow does not write bandwidth files atomically. + +2.4.2. Additional KeyValue pair definitions KeyValue pairs in RelayLines that current implementations generate. -2.4.1. Simple Bandwidth Scanner +2.4.2.1. Simple Bandwidth Scanner Every RelayLine in sbws version 0.1.0 consists of: @@ -421,7 +435,7 @@ Every RelayLine in sbws version 0.1.0 consists of: The number of times that the bandwidth measurements for this relay failed because of other reasons. -2.4.2. Torflow +2.4.2.2. Torflow Torflow RelayLines include node_id and bw, and other KeyValue pairs [2].

1 0

[metrics-web/master] Update news.json to version 285 of doc/MetricsTimeline.
by karsten＠torproject.org 13 Aug '18

13 Aug '18

commit 16e2fe06c0bb79676d4a268b3df1d22586752e46 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Aug 13 09:15:46 2018 +0200 Update news.json to version 285 of doc/MetricsTimeline. --- src/main/resources/web/json/news.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/resources/web/json/news.json b/src/main/resources/web/json/news.json index 03d7f6a..8e5b86a 100644 --- a/src/main/resources/web/json/news.json +++ b/src/main/resources/web/json/news.json @@ -3292,7 +3292,7 @@ } ] }, { "start" : "2018-07-29", - "ongoing" : true, + "end" : "2018-08-08", "places" : [ "bd" ], "short_description" : "Protests over road safety in Dhaka, Bangladesh", "description" : "Protests over road safety in Dhaka, Bangladesh. Reports of mobile network throttling and blocking of Facebook.",

1 0