January 2019 - tor-commits - lists.torproject.org

[tor-browser-build/master] Bug 29158: Install updated apt packages (CVE-2019-3462)
by gk＠torproject.org 25 Jan '19

25 Jan '19

commit f9cbcb92e13bea3792733dd89d6efab4d62be7e2 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Jan 23 14:01:38 2019 +0100 Bug 29158: Install updated apt packages (CVE-2019-3462) --- projects/debootstrap-image/config | 79 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) diff --git a/projects/debootstrap-image/config b/projects/debootstrap-image/config index 5ee8c9a..a1d26cb 100644 --- a/projects/debootstrap-image/config +++ b/projects/debootstrap-image/config @@ -13,39 +13,102 @@ var: pre: | #!/bin/sh set -e + # Bug 29158: install fixed packages for apt vulnerability (CVE-2019-3462) + dpkg -i ./apt_1.6.6ubuntu0.1_amd64.deb ./libapt-pkg5.0_1.6.6ubuntu0.1_amd64.deb apt-get update -y apt-get install -y debian-archive-keyring ubuntu-keyring debootstrap debootstrap --arch=[% c("var/container/arch") %] [% c("var/container/debootstrap_opt") %] [% c("var/container/suite") %] base-image [% c("var/container/debootstrap_mirror") %] + [% IF c("var/apt_package_filename") || c("var/apt_utils_package_filename") || c("var/libapt_inst_package_filename") || c("var/libapt_pkg_package_filename") -%] + mkdir ./base-image/apt-update + mv [% c("var/apt_package_filename") %] [% c("var/apt_utils_package_filename") %] \ + [% c("var/libapt_inst_package_filename") %] [% c("var/libapt_pkg_package_filename") %] \ + ./base-image/apt-update + mount proc ./base-image/proc -t proc + mount sysfs ./base-image/sys -t sysfs + chroot ./base-image dpkg -i -R /apt-update + umount ./base-image/proc + umount ./base-image/sys + [% END -%] + [% IF c("var/minimal_apt_version") -%] + apt_version=$(dpkg --admindir=$(pwd)/base-image/var/lib/dpkg -s apt | grep '^Version: ' | cut -d ' ' -f 2) + echo "apt version: $apt_version" + dpkg --compare-versions "$apt_version" ge '[% c("var/minimal_apt_version") %]' + [% END -%] tar -C ./base-image -czf [% dest_dir %]/[% c("filename") %] . targets: wheezy-amd64: var: + minimal_apt_version: '0.9.7.9+deb7u8' + # https://deb.freexian.com/extended-lts/updates/ela-76-1-apt/ + apt_packages_baseurl: http://deb.freexian.com/extended-lts/pool/main/a/apt + apt_package_filename: apt_0.9.7.9+deb7u8_amd64.deb + apt_package_sha256sum: 83dcdb3f9c11df28b30b85bbb9dec341effbf36ee881a04dece3390082080761 + apt_utils_package_filename: apt-utils_0.9.7.9+deb7u8_amd64.deb + apt_utils_package_sha256sum: 91a4d0ec92a32f13e3acb37f71546d48c51a0df25f3b9eb6a96b73dfc93a11ed + libapt_inst_package_filename: libapt-inst1.5_0.9.7.9+deb7u8_amd64.deb + libapt_inst_package_sha256sum: 181c9c21e1b33496b251fc76ba8ed04acbb8e23006909d27795bbc287eddd027 + libapt_pkg_package_filename: libapt-pkg4.12_0.9.7.9+deb7u8_amd64.deb + libapt_pkg_package_sha256sum: b360dfb5a65ac2f7b81a2551d8a520ba2265785537d6d669869a159888b81999 + container: suite: wheezy arch: amd64 + wheezy-i386: var: + # Missing apt packages for i386: + # http://deb.freexian.com/extended-lts/pool/main/a/apt/ container: suite: wheezy arch: i386 + jessie-amd64: var: + minimal_apt_version: 1.0.9.8.5 + # https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html + apt_packages_baseurl: http://security.debian.org/debian-security/pool/updates/main/a/apt + apt_package_filename: apt_1.0.9.8.5_amd64.deb + apt_package_sha256sum: 4078748632abc19836d045f80f9d6933326065ca1d47367909a0cf7f29e7dfe8 + apt_utils_package_filename: apt-utils_1.0.9.8.5_amd64.deb + apt_utils_package_sha256sum: 87c55d9ccadcabd59674873c221357c774020c116afd978fb9df6d2d0303abf2 + libapt_inst_package_filename: libapt-inst1.5_1.0.9.8.5_amd64.deb + libapt_inst_package_sha256sum: f9615532b1577b3d1455fa51839ce91765f2860eb3a6810fb5e0de0c87253030 + libapt_pkg_package_filename: libapt-pkg4.12_1.0.9.8.5_amd64.deb + libapt_pkg_package_sha256sum: 295d9c69854a4cfbcb46001b09b853f5a098a04c986fc5ae01a0124c1c27e6bd + container: suite: jessie arch: amd64 + jessie-i386: var: + minimal_apt_version: 1.0.9.8.5 + # https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html + apt_packages_baseurl: http://security.debian.org/debian-security/pool/updates/main/a/apt + apt_package_filename: apt_1.0.9.8.5_i386.deb + apt_package_sha256sum: 13c230e9c544b1e67a8da413046bf1728526372170533b1a23e70cc99c40a228 + apt_utils_package_filename: apt-utils_1.0.9.8.5_i386.deb + apt_utils_package_sha256sum: 1a74b12c8bb6b3968a721f3aa96739073e4fe2ced9302792c533e21535bc9cf4 + libapt_inst_package_filename: libapt-inst1.5_1.0.9.8.5_i386.deb + libapt_inst_package_sha256sum: 5791661dd4ade72b61086fefdc209bd1f76ac7b7c812d6d4ba951b1a6232f0b9 + libapt_pkg_package_filename: libapt-pkg4.12_1.0.9.8.5_i386.deb + libapt_pkg_package_sha256sum: 201b6cf4625ed175e6a024ac1f7ca6c526ca79d859753c125b02cd69e26c349d + container: suite: jessie arch: i386 + buster-amd64: var: + minimal_apt_version: '1.8.0~alpha3.1' container: suite: buster arch: amd64 + stretch-amd64: var: + minimal_apt_version: 1.4.9 container: suite: stretch arch: amd64 @@ -54,3 +117,19 @@ input_files: - URL: 'http://cdimage.ubuntu.com/ubuntu-base/releases/[% c("var/ubuntu_version") %]/release/ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' filename: 'container-image_ubuntu-base-[% c("var/ubuntu_version") %]-base-amd64.tar.gz' sha256sum: ed76e649f65548a80b361b68011085ec4dde7bb762d667657acbef87765e1a12 + - URL: http://security.ubuntu.com/ubuntu/pool/main/a/apt/apt_1.6.6ubuntu0.1_amd64.… + sha256sum: df210f9e30cf9deba5fbe815203af854e5e77bdbbe0b96d0d1c0da46a6a8dd0a + - URL: http://security.ubuntu.com/ubuntu/pool/main/a/apt/libapt-pkg5.0_1.6.6ubuntu… + sha256sum: 0a05a97b1e9b8d52ee8df040a14c5fabdebbb2c2235ac495db29df34f4c8cec3 + - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/apt_package_filename") %]' + sha256sum: '[% c("var/apt_package_sha256sum") %]' + enable: '[% c("var/apt_package_filename") %]' + - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/apt_utils_package_filename") %]' + sha256sum: '[% c("var/apt_utils_package_sha256sum") %]' + enable: '[% c("var/apt_utils_package_filename") %]' + - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/libapt_inst_package_filename") %]' + sha256sum: '[% c("var/libapt_inst_package_sha256sum") %]' + enable: '[% c("var/libapt_inst_package_filename") %]' + - URL: '[% c("var/apt_packages_baseurl") %]/[% c("var/libapt_pkg_package_filename") %]' + sha256sum: '[% c("var/libapt_pkg_package_sha256sum") %]' + enable: '[% c("var/libapt_pkg_package_filename") %]'

1 0

[tor-browser-build/master] Merge remote-tracking branch 'boklm/bug_29158_v4'
by gk＠torproject.org 25 Jan '19

25 Jan '19

commit 15e8c5389b76e5fd8634a35c5bff1a5a7192a818 Merge: eb0e8e0 f9cbcb9 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 25 07:58:13 2019 +0000 Merge remote-tracking branch 'boklm/bug_29158_v4' projects/debootstrap-image/config | 79 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+)

1 0

[tor-browser-build/master] Bug 27503: Adapt mozconfig files to enable accessibility on Windows
by gk＠torproject.org 25 Jan '19

25 Jan '19

commit eb0e8e0d13c4325a7af1e469cce307fed8e122ee Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jan 22 11:03:53 2019 +0000 Bug 27503: Adapt mozconfig files to enable accessibility on Windows --- projects/firefox/mozconfig-windows-i686 | 1 - projects/firefox/mozconfig-windows-x86_64 | 1 - 2 files changed, 2 deletions(-) diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index 4045ce0..3314719 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -26,5 +26,4 @@ ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests ac_add_options --disable-stylo # Bugzilla 1390583 -ac_add_options --disable-accessibility # https://sourceforge.net/p/mingw-w64/bugs/648/ ac_add_options --disable-jemalloc # Bugzilla 1466192 diff --git a/projects/firefox/mozconfig-windows-x86_64 b/projects/firefox/mozconfig-windows-x86_64 index 9b757ea..62e32c5 100644 --- a/projects/firefox/mozconfig-windows-x86_64 +++ b/projects/firefox/mozconfig-windows-x86_64 @@ -26,5 +26,4 @@ ac_add_options --disable-maintenance-service ac_add_options --disable-webrtc ac_add_options --disable-tests ac_add_options --disable-stylo # Bugzilla 1390583 -ac_add_options --disable-accessibility # https://sourceforge.net/p/mingw-w64/bugs/648/ ac_add_options --disable-jemalloc # Bugzilla 1466192

1 0

[tor-browser-build/master] Bug 27503: Adapt mozconfig files to enable accessibility on Windows
by gk＠torproject.org 25 Jan '19

25 Jan '19

commit c4ba9b5e6a38971aad6e6d8331e16e7b3a773f1e Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jan 22 10:58:41 2019 +0000 Bug 27503: Adapt mozconfig files to enable accessibility on Windows When bumping mingw-w64 for the crash fix in #28874 we forgot to adapt our Windows mozconfig files to take into account that we don't need to define CXXFLAGS anymore. The changes landed in commit a91a7e405752bbdbe39101f7aaeb1e1d932199db in the mingw-w64 repo. --- projects/firefox/mozconfig-windows-i686 | 3 --- projects/firefox/mozconfig-windows-x86_64 | 3 --- 2 files changed, 6 deletions(-) diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index 07e8851..4045ce0 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -1,8 +1,5 @@ CROSS_COMPILE=1 -# https://bugzilla.mozilla.org/show_bug.cgi?id=1411401 -export CXXFLAGS="-DWIDL_EXPLICIT_AGGREGATE_RETURNS" - ac_add_options --enable-application=browser ac_add_options --target=i686-w64-mingw32 ac_add_options --with-toolchain-prefix=i686-w64-mingw32- diff --git a/projects/firefox/mozconfig-windows-x86_64 b/projects/firefox/mozconfig-windows-x86_64 index 1665005..9b757ea 100644 --- a/projects/firefox/mozconfig-windows-x86_64 +++ b/projects/firefox/mozconfig-windows-x86_64 @@ -1,8 +1,5 @@ CROSS_COMPILE=1 -# https://bugzilla.mozilla.org/show_bug.cgi?id=1411401 -export CXXFLAGS="-DWIDL_EXPLICIT_AGGREGATE_RETURNS" - ac_add_options --enable-application=browser ac_add_options --target=x86_64-w64-mingw32 ac_add_options --with-toolchain-prefix=x86_64-w64-mingw32-

1 0

[tor-browser/tor-browser-60.4.0esr-8.5-1] Bug 12885: Windows Jump Lists fail for Tor Browser
by gk＠torproject.org 25 Jan '19

25 Jan '19

commit f4606d1c1c35eb36edf3c7cd6b2904be01f19f32 Author: Richard Pospesel <richard(a)torproject.org> Date: Fri Jan 25 07:51:14 2019 +0000 Bug 12885: Windows Jump Lists fail for Tor Browser Jumplist entries are stored in a binary file in: %APPDATA%\\Microsoft\Windows\Recent\CustomDestinations\ and has a name in the form [a-f0-9]+.customDestinations-ms The hex at the front is unique per app, and is ultimately derived from something called the 'App User Model ID' (AUMID) via some unknown hashing method. The AUMID is provided as a key when programmatically creating, updating, and deleting a jumplist. The default behaviour in firefox is for the installer to define an AUMID for an app, and save it in the registry so that the jumplist data can be removed by the uninstaller. However, the Tor Browser does not set this (or any other) regkey during installation, so this codepath fails and the app's AUMID is left undefined. As a result the app's AUMID ends up being defined by windows, but unknowable by Tor Browser. This unknown AUMID is used to create and modify the jumplist, but the delete API requires that we provide the app's AUMID explicitly. Since we don't know what the AUMID is (since the expected regkey where it is normally stored does not exist) jumplist deletion will fail and we will leave behind a mostly empty customDestinations-ms file. The name of the file is derived from the binary path, so an enterprising person could reverse engineer how that hex name is calculated, and generate the name for Tor Browser's default Desktop installation path to determine whether a person had used Tor Browser in the past. The 'taskbar.grouping.useprofile' option that is enabled by this patch works around this AUMID problem by having firefox.exe create it's own AUMID based on the profile path (rather than looking for a regkey). This way, if a user goes in and enables and disables jumplist entries, the backing store is properly deleted. Unfortunately, all windows users currently have this file lurking in the above mentioned directory and this patch will not remove it since it was created with an unknown AUMID. However, another patch could be written which goes to that directory and deletes any item containing the 'Tor Browser' string. See bug 28996. --- browser/app/profile/000-tor-browser.js | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index 2b238dd87c1b..11027f4c9a3a 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -326,6 +326,18 @@ pref("browser.onboarding.newtour", "welcome,privacy,tor-network,circuit-display, pref("browser.onboarding.updatetour", "welcome,privacy,tor-network,circuit-display,security,expect-differences,onion-services"); pref("browser.onboarding.skip-tour-button.hide", true); +// prefs to disable jump-list entries in the taskbar on Windows (see bug #12885) +#ifdef XP_WIN +// this pref changes the app's set AUMID to be dependent on the profile path, rather than +// attempting to read it from the registry; this is necessary so that the file generated +// by the jumplist system can be properly deleted if it is disabled +pref("taskbar.grouping.useprofile", true); +pref("browser.taskbar.lists.enabled", false); +pref("browser.taskbar.lists.frequent.enabled", false); +pref("browser.taskbar.lists.tasks.enabled", false); +pref("browser.taskbar.lists.recent.enabled", false); +#endif + #ifdef TOR_BROWSER_VERSION #expand pref("torbrowser.version", __TOR_BROWSER_VERSION__); #endif

1 0

[meek/master] Remake man pages.
by dcf＠torproject.org 25 Jan '19

25 Jan '19

commit 6694796f7adfebfba57860d67bc944c88b06b879 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jan 25 00:25:47 2019 -0700 Remake man pages. --- doc/meek-client.1 | 2 -- 1 file changed, 2 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index 1657f7b..dd9d582 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -41,8 +41,6 @@ Configuration for meek\-client usually happens in a torrc file\&. .sp Per\-bridge options are configured with SOCKS args (key=value pairs in a Bridge line)\&. The possible SOCKS args are: .PP -\fBSOCKS args\fR -.PP \fBurl\fR=\fIURL\fR (required) .RS 4 The URL of a meek\-server instance\&. The domain name component will typically be hidden by the value in the

1 0

[translation/torbutton-torbuttonproperties_completed] Update translations for torbutton-torbuttonproperties_completed
by translation＠torproject.org 25 Jan '19

25 Jan '19

commit 14c3f09675196e9531bf90c54312991bfb6b9fea Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jan 25 07:18:15 2019 +0000 Update translations for torbutton-torbuttonproperties_completed --- he/torbutton.properties | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/he/torbutton.properties b/he/torbutton.properties index 8c2d7a151..90df66ce4 100644 --- a/he/torbutton.properties +++ b/he/torbutton.properties @@ -50,6 +50,11 @@ profileReadOnlyMac=אינך יכול להריץ את %S ממערכת קבצים profileAccessDenied=ל-%S אין הרשאה כדי לגשת אל הפרופיל. אנא התאם את הרשאות מערכת הקבצים שלך ונסה שוב. profileMigrationFailed=מיזוג של הפרופיל הקיים שלך %S נכשל.\nהגדרות חדשות יהיו בשימוש. +# "Downloading update" string for the hamburger menu (see #28885). +# This string is kept here for ease of translation. +# LOCALIZATION NOTE: %S is the application name. +updateDownloadingPanelUILabel=מוריד עדכון %S + # .Onion Page Info prompt. Strings are kept here for ease of translation. pageInfo_OnionEncryptionWithBitsAndProtocol=חיבור הוצפן (שירות בצל, %1$S, מפתחות %2$S סיביות, %3$S) pageInfo_OnionEncryption=חיבור הוצפן (שירות בצל)

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 25 Jan '19

25 Jan '19

commit 1fc00f7d80e77ffeed0e7be9d131f225393855a7 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jan 25 07:18:09 2019 +0000 Update translations for torbutton-torbuttonproperties --- he/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/he/torbutton.properties b/he/torbutton.properties index 8587d66d9..90df66ce4 100644 --- a/he/torbutton.properties +++ b/he/torbutton.properties @@ -53,7 +53,7 @@ profileMigrationFailed=מיזוג של הפרופיל הקיים שלך %S נכ # "Downloading update" string for the hamburger menu (see #28885). # This string is kept here for ease of translation. # LOCALIZATION NOTE: %S is the application name. -updateDownloadingPanelUILabel=Downloading %S update +updateDownloadingPanelUILabel=מוריד עדכון %S # .Onion Page Info prompt. Strings are kept here for ease of translation. pageInfo_OnionEncryptionWithBitsAndProtocol=חיבור הוצפן (שירות בצל, %1$S, מפתחות %2$S סיביות, %3$S)

1 0

[meek/master] Refactor meek-client man page.
by dcf＠torproject.org 25 Jan '19

25 Jan '19

commit 21ed1ecb458ae71b0297494d10b92d0f9a9f864c Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jan 25 00:16:08 2019 -0700 Refactor meek-client man page. --- doc/meek-client.1 | 50 +++++++++++++++++++++++++++++++------------- doc/meek-client.1.txt | 58 +++++++++++++++++++++++++++++++++++---------------- 2 files changed, 76 insertions(+), 32 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index c805eed..1657f7b 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -2,12 +2,12 @@ .\" Title: meek-client .\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> -.\" Date: 01/17/2019 +.\" Date: 01/25/2019 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" -.TH "MEEK\-CLIENT" "1" "01/17/2019" "\ \&" "\ \&" +.TH "MEEK\-CLIENT" "1" "01/25/2019" "\ \&" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -35,8 +35,29 @@ meek-client \- The meek client transport plugin .SH "DESCRIPTION" .sp meek\-client is a transport plugin for Tor that encodes a stream as a sequence of HTTP requests and responses\&. It has a \fBurl\fR option to control what destination server requests are directed to, and a \fBfront\fR option for domain name camouflage: The domain name in the URL is replaced by the front domain before the request is made, but the Host header inside the HTTP request still points to the original domain\&. The idea is to front through a domain that is not blocked to a domain that is blocked\&. +.SH "CONFIGURATION" .sp -Configuration for meek\-client usually appears in a torrc file\&. Most user configuration can happen either through SOCKS args (i\&.e\&., args on a Bridge line) or through command line options\&. SOCKS args take precedence per\-connection over command line options\&. For example, this configuration using SOCKS args: +Configuration for meek\-client usually happens in a torrc file\&. +.sp +Per\-bridge options are configured with SOCKS args (key=value pairs in a Bridge line)\&. The possible SOCKS args are: +.PP +\fBSOCKS args\fR +.PP +\fBurl\fR=\fIURL\fR (required) +.RS 4 +The URL of a meek\-server instance\&. The domain name component will typically be hidden by the value in the +\fBfront\fR +arg\&. +.RE +.PP +\fBfront\fR=\fIDOMAIN\fR +.RS 4 +Front domain name\&. If provided, this domain name will replace the domain name of +\fBurl\fR +in the DNS request and TLS SNI field\&. The URL\(cqs true domain name will still appear in the Host header of HTTP requests\&. +.RE +.sp +For backward compatibility, each SOCKS arg also has an equivalent command line option\&. For example, this configuration using SOCKS args: .sp .if n \{\ .RS 4 @@ -62,11 +83,11 @@ ClientTransportPlugin meek exec \&./meek\-client \-\-url=https://forbidden\&.exa .RE .\} .sp -The advantage of SOCKS args is that multiple Bridge lines can have different configurations\&. +SOCKS args are preferred over command line options because they allow you to have multiple Bridge lines with different settings\&. If a SOCKS arg and a command line option are both given for the same setting, the SOCKS arg takes precedence\&. .sp -The \fB\-\-helper\fR option prevents meek\-client from doing any network operations itself\&. Rather, it will send all requests through a browser extension, which must be set up separately\&. +The global \fB\-\-helper\fR option prevents meek\-client from doing any network operations itself\&. Rather, it will send all requests through a browser extension, which must be set up separately\&. .sp -You can also control an upstream proxy using torrc options: +A global proxy (applies to all Bridge lines) can be configured using special torrc options: .sp .if n \{\ .RS 4 @@ -80,22 +101,22 @@ Socks5Proxy localhost:1080 .RE .\} .sp -or, equivalently, using the \fB\-\-proxy\fR command\-line option\&. +or, equivalently, using the \fB\-\-proxy\fR command line option\&. The command line option takes precedence\&. .sp When the \fB\-\-helper\fR option is used, you can use any type of proxy: HTTP or SOCKS\&. Without \fB\-\-helper\fR, you can only use an HTTP proxy\&. .SH "OPTIONS" .PP \fB\-\-front\fR=\fIDOMAIN\fR .RS 4 -Front domain name\&. The +Front domain name\&. Prefer using the \fBfront\fR -SOCKS arg overrides the command line\&. +SOCKS arg on a bridge line over using this command line option\&. .RE .PP \fB\-\-helper\fR=\fIADDRESS\fR .RS 4 Address of HTTP helper browser extension\&. For example, -\fB\-\-helper 127\&.0\&.0\&.1:7000\fR\&. +\fB\-\-helper=127\&.0\&.0\&.1:7000\fR\&. .RE .PP \fB\-\-proxy\fR=\fIURL\fR @@ -103,11 +124,11 @@ Address of HTTP helper browser extension\&. For example, URL of upstream proxy\&. For example, \fB\-\-proxy=http://localhost:8080/\fR, \fB\-\-proxy=socks4a://localhost:1080\fR, or -\fB\-\-proxy=socks5://localhost:1080\fR\&. You would normally control the proxy using the +\fB\-\-proxy=socks5://localhost:1080\fR\&. Can also be configured using the \fBHTTPSProxy\fR, \fBSocks4Proxy\fR, or \fBSocks5Proxy\fR -configuration options in a torrc file, instead of using this option\&. +options in a torrc file\&. .RE .PP \fB\-\-log\fR=\fIFILENAME\fR @@ -117,8 +138,9 @@ Name of a file to write log messages to (default stderr)\&. .PP \fB\-\-url\fR=\fIURL\fR .RS 4 -URL to correspond with\&. The domain part of the URL may be modified by -\fB\-\-front\fR\&. +URL to correspond with\&. Prefer using the +\fBurl\fR +SOCKS arg on a bridge line over using this command line option\&. .RE .PP \fB\-h\fR, \fB\-\-help\fR diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index efbca1b..fbfda10 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -24,11 +24,29 @@ Host header inside the HTTP request still points to the original domain. The idea is to front through a domain that is not blocked to a domain that is blocked. -Configuration for meek-client usually appears in a torrc file. Most user -configuration can happen either through SOCKS args (i.e., args on a -Bridge line) or through command line options. SOCKS args take precedence -per-connection over command line options. For example, this -configuration using SOCKS args: +CONFIGURATION +------------- + +Configuration for meek-client usually happens in a torrc file. + +Per-bridge options are configured with SOCKS args +(key=value pairs in a Bridge line). +The possible SOCKS args are: + +**url**=__URL__ (required):: + The URL of a meek-server instance. + The domain name component will typically be hidden + by the value in the **front** arg. +**front**=__DOMAIN__:: + Front domain name. + If provided, this domain name will replace the domain name + of **url** in the DNS request and TLS SNI field. + The URL's true domain name will still appear in the Host header + of HTTP requests. + +For backward compatibility, each SOCKS arg also has an equivalent +command line option. +For example, this configuration using SOCKS args: ---- Bridge meek 0.0.2.0:1 url=https://forbidden.example/ front=allowed.example ClientTransportPlugin meek exec ./meek-client @@ -38,20 +56,24 @@ is the same as this one using command line options: Bridge meek 0.0.2.0:1 ClientTransportPlugin meek exec ./meek-client --url=https://forbidden.example/ --front=allowed.example ---- -The advantage of SOCKS args is that multiple Bridge lines can have different -configurations. +SOCKS args are preferred over command line options because they +allow you to have multiple Bridge lines with different settings. +If a SOCKS arg and a command line option are both given for the same setting, +the SOCKS arg takes precedence. -The **--helper** option prevents meek-client from doing any network +The global **--helper** option prevents meek-client from doing any network operations itself. Rather, it will send all requests through a browser extension, which must be set up separately. -You can also control an upstream proxy using torrc options: +A global proxy (applies to all Bridge lines) +can be configured using special torrc options: ---- HTTPSProxy localhost:8080 Socks4Proxy localhost:1080 Socks5Proxy localhost:1080 ---- -or, equivalently, using the **--proxy** command-line option. +or, equivalently, using the **--proxy** command line option. +The command line option takes precedence. When the **--helper** option is used, you can use any type of proxy: HTTP or SOCKS. Without **--helper**, you can only use an HTTP proxy. @@ -59,28 +81,28 @@ HTTP or SOCKS. Without **--helper**, you can only use an HTTP proxy. OPTIONS ------- **--front**=__DOMAIN__:: - Front domain name. The **front** SOCKS arg overrides the command - line. + Front domain name. Prefer using the **front** SOCKS arg + on a bridge line over using this command line option. **--helper**=__ADDRESS__:: Address of HTTP helper browser extension. For example, - **--helper 127.0.0.1:7000**. + **--helper=127.0.0.1:7000**. **--proxy**=__URL__:: URL of upstream proxy. For example, **--proxy=http://localhost:8080/**, **--proxy=socks4a://localhost:1080**, or **--proxy=socks5://localhost:1080**. - You would normally control the proxy - using the **HTTPSProxy**, **Socks4Proxy**, or **Socks5Proxy** - configuration options in a torrc file, instead of using this option. + Can also be configured using the + **HTTPSProxy**, **Socks4Proxy**, or **Socks5Proxy** + options in a torrc file. **--log**=__FILENAME__:: Name of a file to write log messages to (default stderr). **--url**=__URL__:: - URL to correspond with. The domain part of the URL may be modified - by **--front**. + URL to correspond with. Prefer using the **url** SOCKS arg + on a bridge line over using this command line option. **-h**, **--help**:: Display a help message and exit.

1 0

[tor-browser/tor-browser-60.4.0esr-8.5-1] Bug 27597: Package dom_bindings_test only with tests enabled
by gk＠torproject.org 25 Jan '19

25 Jan '19

commit 2d5a66c40885598133593c641fd8401a0b2f2fac Author: Georg Koppen <gk(a)torproject.org> Date: Sat Dec 15 19:52:32 2018 +0000 Bug 27597: Package dom_bindings_test only with tests enabled --- browser/installer/package-manifest.in | 2 +- mobile/android/installer/package-manifest.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in index 7c89a4f70b95..fadf205c229c 100644 --- a/browser/installer/package-manifest.in +++ b/browser/installer/package-manifest.in @@ -197,7 +197,7 @@ @RESPATH@/components/dom.xpt @RESPATH@/components/dom_base.xpt @RESPATH@/components/dom_bindings.xpt -#ifdef MOZ_DEBUG +#if defined(ENABLE_TESTS) && defined(MOZ_DEBUG) @RESPATH@/components/dom_bindings_test.xpt #endif @RESPATH@/components/dom_file.xpt diff --git a/mobile/android/installer/package-manifest.in b/mobile/android/installer/package-manifest.in index 69714f9eca7c..7fe0e97c2d3b 100644 --- a/mobile/android/installer/package-manifest.in +++ b/mobile/android/installer/package-manifest.in @@ -118,7 +118,7 @@ @BINPATH@/components/dom.xpt @BINPATH@/components/dom_base.xpt @BINPATH@/components/dom_bindings.xpt -#ifdef MOZ_DEBUG +#if defined(ENABLE_TESTS) && defined(MOZ_DEBUG) @BINPATH@/components/dom_bindings_test.xpt #endif @BINPATH@/components/dom_core.xpt

1 0