tor-commits August 2019

tor-commits@lists.torproject.org

19 participants
2737 discussions

[meek/master] Minimal draft of WebExtension port of meek-http-helper.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 6ea203b85aa8d98548ff6ef7cff8ce501ee401c3 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Feb 13 19:30:30 2019 -0700 Minimal draft of WebExtension port of meek-http-helper. Doesn't yet: * allow control of the Host header (domain fronting) * support a proxy --- webextension/README | 51 +++++ webextension/background.js | 159 +++++++++++++++ webextension/manifest.json | 22 ++ webextension/meek.http.helper.json | 9 + webextension/native/endian_amd64.go | 8 + webextension/native/main.go | 387 ++++++++++++++++++++++++++++++++++++ 6 files changed, 636 insertions(+) diff --git a/webextension/README b/webextension/README new file mode 100644 index 0000000..a728842 --- /dev/null +++ b/webextension/README @@ -0,0 +1,51 @@ +Installation guide for the meek-http-helper WebExtension. + +The WebExtension is made of two parts: the extension and the native +application. The extension itself is JavaScript, runs in the browser, +and is responsible for making HTTP requests as instructed. The native +application runs as a subprocess of the browser; its job is to open a +localhost socket and act as an intermediary between the extension and +meek-client, because the extension cannot open a socket by itself. + +These instructions require Firefox 65. + +1. Compile the native application. + cd native && go build + +2. Edit meek.http.helper.json and set the "path" field to the path to + the native application. + "path": "/where/you/installed/native", + +3. Copy the edited meek.http.helper.json file to the OS-appropriate + location. + # macOS + mkdir -p ~/"Library/Application Support/Mozilla/NativeMessagingHosts/" + cp meek.http.helper.json ~/"Library/Application Support/Mozilla/NativeMessagingHosts/" + # other Unix + mkdir -p ~/.mozilla/native-messaging-hosts/ + cp meek.http.helper.json ~/.mozilla/native-messaging-hosts/ + The meek.http.helper.json file is called the "host manifest" or "app + manifest" and it tells the browser where to find the native part of + the WebExtension. More information: + https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + +4. Run Firefox in a terminal so you can see its stdout. In Firefox, go + to about:config and set + browser.dom.window.dump.enabled=true + This enables the extension to write to stdout. + +5. In Firefox, go to about:debugging and click "Load Temporary + Add-on...". Find manifest.json and click Open. + More information: + https://developer.mozilla.org/en-US/docs/Tools/about:debugging#Loading_a_te… + In the terminal, you should see a line like this, with a random port + number in place of XXXX: + meek-http-helper: listen 127.0.0.1:XXXX + +Now the extension is running and ready to start making requests. You can +run "meek-client --helper", passing it the correct port number XXXX: + UseBridges 1 + ClientTransportPlugin meek exec ./meek-client --helper 127.0.0.1:XXXX --log meek-client.log + Bridge meek 0.0.2.0:1 url=https://meek.bamsoftware.com/ + +To debug, open the browser console with Ctrl+Shift+J. diff --git a/webextension/background.js b/webextension/background.js new file mode 100644 index 0000000..ba56e7f --- /dev/null +++ b/webextension/background.js @@ -0,0 +1,159 @@ +// This program is the browser part of the meek-http-helper WebExtension. Its +// purpose is to receive and execute commands from the native part. It +// understands two commands: "report-address" and "roundtrip". +// +// +// { +// "command": "report-address", +// "address": "127.0.0.1:XXXX" +// } +// The "report-address" command causes the extension to print to a line to +// stdout: +// meek-http-helper: listen 127.0.0.1:XXXX +// meek-client looks for this line to find out where the helper is listening. +// For this to work, you must set the pref browser.dom.window.dump.enabled. +// +// +// { +// "command": "roundtrip", +// "id": "...ID..." +// "request": { +// "method": "POST", +// "url": "https://allowed.example/", +// "header": { +// "Host": "forbidden.example", +// "X-Session-Id": ..., +// ... +// }, +// "proxy": { +// "type": "http", +// "host": "proxy.example", +// "port": 8080 +// }, +// "body": "...base64..." +// } +// } +// The "roundtrip" command causes the extension to make an HTTP request +// according to the given specification. It then sends a response back to the +// native part: +// { +// "id": "...ID...", +// "response": { +// "status": 200, +// "body": "...base64..." +// } +// } +// Or, if an error occurred: +// { +// "id": "...ID...", +// "response": { +// "error": "...error message..." +// } +// } +// The "id" field in the response will be the same as the one in the request, +// because that is what enables the native part to match up requests and +// responses. + +let port = browser.runtime.connectNative("meek.http.helper"); + +// Decode a base64-encoded string into an ArrayBuffer. +function base64_decode(enc_str) { + // First step is to decode the base64. atob returns a byte string; i.e., a + // string of 16-bit characters, each of whose character codes is restricted + // to the range 0x00–0xff. + let dec_str = atob(enc_str); + // Next, copy those character codes into an array of 8-bit elements. + let dec_array = new Uint8Array(dec_str.length); + for (let i = 0; i < dec_str.length; i++) { + dec_array[i] = dec_str.charCodeAt(i); + } + return dec_array.buffer; +} + +// Encode an ArrayBuffer into a base64-encoded string. +function base64_encode(dec_buf) { + let dec_array = new Uint8Array(dec_buf); + // Copy the elements of the array into a new byte string. + let dec_str = String.fromCharCode(...dec_array); + // base64-encode the byte string. + return btoa(dec_str); +} + +function roundtrip(id, request) { + // Process the incoming request spec and convert it into parameters to the + // fetch API. Also enforce some restrictions on what kinds of requests we + // are willing to make. + let url; + let init = {}; + try { + if (request.url == null) { + throw new Error("missing \"url\""); + } + if (!(request.url.startsWith("http://") || request.url.startsWith("https://"))) { + throw new Error("only http and https URLs are allowed"); + } + url = request.url; + + if (request.method !== "POST") { + throw new Error("only POST is allowed"); + } + init.method = request.method; + + if (request.header != null) { + init.headers = request.header; + } + + if (request.body != null && request.body !== "") { + init.body = base64_decode(request.body); + } + + // TODO: Host header + // TODO: strip Origin header? + // TODO: proxy + } catch (error) { + port.postMessage({id, response: {error: `request spec failed valiation: ${error.message}`}}); + return; + } + + // Now actually do the request and send the result back to the native + // process. + fetch(url, init) + .then(resp => resp.arrayBuffer().then(body => ({ + status: resp.status, + body: base64_encode(body), + }))) + // Convert any errors into an error response. + .catch(error => ({error: error.message})) + // Send the response (success or failure) back to the requester, tagged + // with its ID. + .then(response => port.postMessage({id, response})); +} + +port.onMessage.addListener((message) => { + switch (message.command) { + case "roundtrip": + roundtrip(message.id, message.request); + break; + case "report-address": + // Tell meek-client where our subprocess (the one that actually + // opens a socket) is listening. For the dump call to have any + // effect, the pref browser.dom.window.dump.enabled must be true. + // This output is supposed to be line-oriented, so ignore it if the + // address from the native part contains a newline. + if (message.address != null && message.address.indexOf("\n") == -1) { + dump(`meek-http-helper: listen ${message.address}\n`); + } + break; + default: + console.log(`${browser.runtime.id}: received unknown command: ${message.command}`); + } +}); + +port.onDisconnect.addListener((p) => { + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… + // "Note that in Google Chrome port.error is not supported: instead, use + // runtime.lastError to get the error message." + if (p.error) { + console.log(`${browser.runtime.id}: disconnected because of error: ${p.error.message}`); + } +}); diff --git a/webextension/manifest.json b/webextension/manifest.json new file mode 100644 index 0000000..2d44d87 --- /dev/null +++ b/webextension/manifest.json @@ -0,0 +1,22 @@ +{ + "manifest_version": 2, + "name": "meek HTTP helper", + "description": "Makes HTTP requests on behalf of meek-client.", + "version": "1.0", + + "browser_specific_settings": { + "gecko": { + "id": "meek-http-helper(a)bamsoftware.com" + } + }, + + "background": { + "scripts": ["background.js"] + }, + + "permissions": [ + "nativeMessaging", + "https://*/*", + "http://*/*" + ] +} diff --git a/webextension/meek.http.helper.json b/webextension/meek.http.helper.json new file mode 100644 index 0000000..269d5f8 --- /dev/null +++ b/webextension/meek.http.helper.json @@ -0,0 +1,9 @@ +{ + "name": "meek.http.helper", + "description": "Native half of meek-http-helper.", + "path": "/path/to/native", + "type": "stdio", + "allowed_extensions": [ + "meek-http-helper(a)bamsoftware.com" + ] +} diff --git a/webextension/native/endian_amd64.go b/webextension/native/endian_amd64.go new file mode 100644 index 0000000..6a1e44e --- /dev/null +++ b/webextension/native/endian_amd64.go @@ -0,0 +1,8 @@ +// The WebExtension browser–app protocol uses native-endian length prefixes :/ +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + +package main + +import "encoding/binary" + +var NativeEndian = binary.LittleEndian diff --git a/webextension/native/main.go b/webextension/native/main.go new file mode 100644 index 0000000..4c66993 --- /dev/null +++ b/webextension/native/main.go @@ -0,0 +1,387 @@ +// This program is the native part of the meek-http-helper WebExtension. Its +// purpose is to open a localhost TCP socket for communication with meek-client +// in its --helper mode (the WebExtension cannot open a socket on its own). This +// program is also in charge of multiplexing the many incoming socket +// connections over the single shared stdio stream to/from the WebExtension. + +package main + +import ( + "crypto/rand" + "encoding/binary" + "encoding/hex" + "encoding/json" + "fmt" + "io" + "math" + "net" + "os" + "os/signal" + "sync" + "syscall" + "time" +) + +const ( + // How long we'll wait for meek-client to send a request spec or receive + // a response spec over the socket. This can be short because it's all + // localhost communication. + localReadTimeout = 2 * time.Second + localWriteTimeout = 2 * time.Second + + // How long we'll wait, after sending a request spec to the browser, for + // the browser to come back with a response. This is meant to be + // generous; its purpose is to allow reclaiming memory in case the + // browser somehow drops a request spec. + roundTripTimeout = 120 * time.Second + + // Self-defense against a malfunctioning meek-client. We'll refuse to + // read encoded responses that are longer than this. + maxRequestSpecLength = 1000000 + + // Self-defense against a malfunctioning browser. We'll refuse to + // receive WebExtension messages that are longer than this. + maxWebExtensionMessageLength = 1000000 +) + +// We receive multiple (possibly concurrent) connections over our listening +// socket, and we must multiplex all their requests/responses to/from the +// browser over the single shared stdio stream. When handleConn sends a +// webExtensionRoundTripRequest to the browser, creates a channel to receive the +// response, and stores the ID–channel mapping in requestResponseMap. When +// inFromBrowserLoop receives a webExtensionRoundTripResponse from the browser, +// it is tagged with the same ID as the corresponding request. inFromBrowserLoop +// looks up the matching channel and sends the response over it. +var requestResponseMap = make(map[string]chan<- *responseSpec) +var requestResponseMapLock sync.Mutex + +// A specification of an HTTP request, as received via the socket from +// "meek-client --helper". +type requestSpec struct { + Method string `json:"method,omitempty"` + URL string `json:"url,omitempty"` + Header map[string]string `json:"header,omitempty"` + Body []byte `json:"body,omitempty"` + Proxy *proxySpec `json:"proxy,omitempty"` +} + +type proxySpec struct { + Type string `json:"type"` + Host string `json:"host"` + Port string `json:"port"` +} + +// A specification of an HTTP request or an error, as sent via the socket to +// "meek-client --helper". +type responseSpec struct { + Error string `json:"error,omitempty"` + Status int `json:"status,omitempty"` + Body []byte `json:"body,omitempty"` +} + +// A "roundtrip" command sent out to the browser over the stdout stream. It +// encapsulates a requestSpec as received from the socket, plus +// command:"roundtrip" and an ID, which used to match up the eventual reply with +// this request. +// +// command:"roundtrip" is to disambiguate with the other command we may send, +// "report-address". +type webExtensionRoundTripRequest struct { + Command string `json:"command"` // "roundtrip" + ID string `json:"id"` + Request *requestSpec `json:"request"` +} + +// A message received from the the browser over the stdin stream. It +// encapsulates a responseSpec along with the ID of the webExtensionResponse +// that resulted in this response. +type webExtensionRoundTripResponse struct { + ID string `json:"id"` + Response *responseSpec `json:"response"` +} + +// Read a requestSpec (receive from "meek-client --helper"). +// +// The meek-client protocol is coincidentally similar to the WebExtension stdio +// protocol: a 4-byte length, followed by a JSON object of that length. The only +// difference is the byte order of the length: meek-client's is big-endian, +// while WebExtension's is native-endian. +func readRequestSpec(r io.Reader) (*requestSpec, error) { + var length uint32 + err := binary.Read(r, binary.BigEndian, &length) + if err != nil { + return nil, err + } + if length > maxRequestSpecLength { + return nil, fmt.Errorf("request spec is too long: %d (max %d)", length, maxRequestSpecLength) + } + + encodedSpec := make([]byte, length) + _, err = io.ReadFull(r, encodedSpec) + if err != nil { + return nil, err + } + + spec := new(requestSpec) + err = json.Unmarshal(encodedSpec, spec) + if err != nil { + return nil, err + } + + return spec, nil +} + +// Write a responseSpec (send to "meek-client --helper"). +func writeResponseSpec(w io.Writer, spec *responseSpec) error { + encodedSpec, err := json.Marshal(spec) + if err != nil { + panic(err) + } + + length := len(encodedSpec) + if length > math.MaxUint32 { + return fmt.Errorf("response spec is too long to represent: %d", length) + } + err = binary.Write(w, binary.BigEndian, uint32(length)) + if err != nil { + return err + } + + _, err = w.Write(encodedSpec) + if err != nil { + return err + } + + return nil +} + +// Receive a WebExtension message. +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… +func recvWebExtensionMessage(r io.Reader) ([]byte, error) { + var length uint32 + err := binary.Read(r, NativeEndian, &length) + if err != nil { + return nil, err + } + if length > maxWebExtensionMessageLength { + return nil, fmt.Errorf("WebExtension message is too long: %d (max %d)", length, maxWebExtensionMessageLength) + } + message := make([]byte, length) + _, err = io.ReadFull(r, message) + if err != nil { + return nil, err + } + return message, nil +} + +// Send a WebExtension message. +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… +func sendWebExtensionMessage(w io.Writer, message []byte) error { + length := len(message) + if length > math.MaxUint32 { + return fmt.Errorf("WebExtension message is too long to represent: %d", length) + } + err := binary.Write(w, NativeEndian, uint32(length)) + if err != nil { + return err + } + _, err = w.Write(message) + return err +} + +// Handle a socket connection, which is used for one request–response roundtrip +// through the browser. We read a responseSpec from the socket and wrap it in a +// webExtensionRoundTripRequest, tagging it with a random ID. We register the ID +// in requestResponseMap and forward the webExtensionRoundTripRequest to the +// browser. Then we wait for the browser to send back a +// webExtensionRoundTripResponse, which actually happens in inFromBrowserLoop. +// inFromBrowserLoop uses the ID to find this goroutine again. +func handleConn(conn net.Conn, outToBrowserChan chan<- []byte) error { + defer conn.Close() + + err := conn.SetReadDeadline(time.Now().Add(localReadTimeout)) + if err != nil { + return err + } + req, err := readRequestSpec(conn) + if err != nil { + return err + } + + // Generate an ID that will allow us to match a response to this request. + idRaw := make([]byte, 8) + _, err = rand.Read(idRaw) + if err != nil { + return err + } + id := hex.EncodeToString(idRaw) + + // This is the channel over which inFromBrowserLoop will send the + // response. Register it in requestResponseMap to enable + // inFromBrowserLoop to match the corresponding response to it. + responseSpecChan := make(chan *responseSpec) + requestResponseMapLock.Lock() + requestResponseMap[id] = responseSpecChan + requestResponseMapLock.Unlock() + + // Encode and send the message to the browser. + message, err := json.Marshal(&webExtensionRoundTripRequest{ + Command: "roundtrip", + ID: id, + Request: req, + }) + if err != nil { + panic(err) + } + outToBrowserChan <- message + + // Now wait for the browser to send the response back to us. + // inFromBrowserLoop will find the proper channel by looking up the ID + // in requestResponseMap. + timeout := time.NewTimer(roundTripTimeout) + select { + case resp := <-responseSpecChan: + timeout.Stop() + // Encode the response send it back out over the socket. + err = conn.SetWriteDeadline(time.Now().Add(localWriteTimeout)) + if err != nil { + return err + } + err = writeResponseSpec(conn, resp) + if err != nil { + return err + } + case <-timeout.C: + // But don't wait forever, so as to allow reclaiming memory in + // case of a malfunction elsewhere. + requestResponseMapLock.Lock() + delete(requestResponseMap, id) + requestResponseMapLock.Unlock() + } + + return nil +} + +// Receive socket connections and dispatch them to handleConn. +func acceptLoop(ln net.Listener, outToBrowserChan chan<- []byte) error { + for { + conn, err := ln.Accept() + if err != nil { + if err, ok := err.(net.Error); ok && err.Temporary() { + continue + } + return err + } + go func() { + err := handleConn(conn, outToBrowserChan) + if err != nil { + fmt.Fprintln(os.Stderr, "handling socket request:", err) + } + }() + } +} + +// Read messages from the browser over stdin, and send them (matching using the +// ID field) over the channel that corresponds to the original request. This is +// the only function allowed to read from stdin. +func inFromBrowserLoop() error { + for { + message, err := recvWebExtensionMessage(os.Stdin) + if err != nil { + return err + } + var resp webExtensionRoundTripResponse + err = json.Unmarshal(message, &resp) + if err != nil { + return err + } + + // Look up what channel (previously registered in + // requestResponseMap by handleConn) should receive the + // response. + requestResponseMapLock.Lock() + responseSpecChan, ok := requestResponseMap[resp.ID] + delete(requestResponseMap, resp.ID) + requestResponseMapLock.Unlock() + + if !ok { + // Either the browser made up an ID that we never sent + // it, or (more likely) it took too long and handleConn + // stopped waiting. Just drop the response on the floor. + continue + } + responseSpecChan <- resp.Response + // Each socket Conn is good for one request–response exchange only. + close(responseSpecChan) + } +} + +// Read messages from outToBrowserChan and send them to the browser over the +// stdout channel. This is the only function allowed to write to stdout. +func outToBrowserLoop(outToBrowserChan <-chan []byte) error { + for message := range outToBrowserChan { + err := sendWebExtensionMessage(os.Stdout, message) + if err != nil { + return err + } + } + return nil +} + +func main() { + ln, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + fmt.Fprintln(os.Stderr, err) + os.Exit(1) + } + defer ln.Close() + + outToBrowserChan := make(chan []byte) + signalChan := make(chan os.Signal) + errChan := make(chan error) + + // Goroutine that handles new socket connections. + go func() { + errChan <- acceptLoop(ln, outToBrowserChan) + }() + + // Goroutine that writes WebExtension messages to stdout. + go func() { + errChan <- outToBrowserLoop(outToBrowserChan) + }() + + // Goroutine that reads WebExtension messages from stdin. + go func() { + err := inFromBrowserLoop() + if err == io.EOF { + // EOF is not an error. + err = nil + } + errChan <- err + }() + + // Tell the browser our listening socket address. + message, err := json.Marshal(struct { + Command string `json:"command"` + Address string `json:"address"` + }{ + Command: "report-address", + Address: ln.Addr().String(), + }) + if err != nil { + panic(err) + } + outToBrowserChan <- message + + // We quit when we receive a SIGTERM, or when our stdin is closed, or + // some irrecoverable error happens. + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + signal.Notify(signalChan, syscall.SIGTERM) + select { + case <-signalChan: + case err := <-errChan: + if err != nil { + fmt.Fprintln(os.Stderr, err) + } + } +}

1 0

[meek/master] Make roundtrip async.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 108a89f60bc3b7617c0e8556cbcefefc8926d1da Author: David Fifield <david(a)bamsoftware.com> Date: Fri Feb 15 12:08:01 2019 -0700 Make roundtrip async. roundtrip doesn't need to know the ID; tack that on in the onMessage listener. --- webextension/background.js | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/webextension/background.js b/webextension/background.js index fd39273..8092352 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -79,7 +79,7 @@ function base64_encode(dec_buf) { return btoa(dec_str); } -function roundtrip(id, request) { +async function roundtrip(request) { // Process the incoming request spec and convert it into parameters to the // fetch API. Also enforce some restrictions on what kinds of requests we // are willing to make. @@ -119,28 +119,26 @@ function roundtrip(id, request) { // TODO: strip Origin header? // TODO: proxy } catch (error) { - port.postMessage({id, response: {error: `request spec failed valiation: ${error.message}`}}); - return; + return {error: `request spec failed valiation: ${error.message}`}; } - // Now actually do the request and send the result back to the native - // process. - fetch(url, init) - .then(resp => resp.arrayBuffer().then(body => ({ - status: resp.status, - body: base64_encode(body), - }))) + // Now actually do the request and build a response object. + try { + let resp = await fetch(url, init); + let body = await resp.arrayBuffer(); + return {status: resp.status, body: base64_encode(body)}; + } catch (error) { // Convert any errors into an error response. - .catch(error => ({error: error.message})) - // Send the response (success or failure) back to the requester, tagged - // with its ID. - .then(response => port.postMessage({id, response})); + return {error: error.message}; + } } port.onMessage.addListener((message) => { switch (message.command) { case "roundtrip": - roundtrip(message.id, message.request); + // Do a roundtrip and send the result back to the native process. + roundtrip(message.request) + .then(response => port.postMessage({id: message.id, response})); break; case "report-address": // Tell meek-client where our subprocess (the one that actually

1 0

[meek/master] Strip unneeded headers by default.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 650f5d10115670a2b7fbe355dd11ea125256537b Author: David Fifield <david(a)bamsoftware.com> Date: Fri Feb 15 13:55:53 2019 -0700 Strip unneeded headers by default. These are: Accept Accept-Language Cookie Origin User-Agent Cf. https://bugs.torproject.org/12778 In the old extension we stripped *all* headers, except for Content-Length and Content-Type, which got set by nsIUploadChannel.setUploadStream; and Connection, which somehow automatically got the value "keep-alive". https://gitweb.torproject.org/pluggable-transports/meek.git/commit/?id=0e6c… In the new WebExtension, stripping all headers really strips them all, including Content-Length, without which web servers may refuse to deal with us. So instead, just delete an enumerated list of headers that seem unnecessary; or, like Cookie or Origin, may enable cross-session tracking. Before this change (url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com): Accept: */* Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cache-Control: no-cache Connection: keep-alive Content-Length: 0 Host: meek.azureedge.net Origin: moz-extension://3b29e17d-f486-48b9-8a03-782237114ad3 Pragma: no-cache TE: Trailers User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0 X-Session-Id: QE9IrvZFtFc After this change: Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Connection: keep-alive Content-Length: 0 Host: meek.azureedge.net Pragma: no-cache TE: Trailers X-Session-Id: CKOaxq4SVqM --- webextension/background.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/webextension/background.js b/webextension/background.js index 1ffb828..664e758 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -135,7 +135,6 @@ async function roundtrip(request) { // Don't follow redirects (we'll get resp.status:0 if there is one). init.redirect = "manual"; - // TODO: strip Origin header? // TODO: proxy } catch (error) { return {error: `request spec failed valiation: ${error.message}`}; @@ -165,6 +164,10 @@ async function roundtrip(request) { .map(x => ({name: x[0], value: x[1]})); // Remove all browser headers that conflict with requested headers. let overrides = Object.fromEntries(headers.map(x => [x.name.toLowerCase(), true])); + // Also remove some unnecessary or potentially tracking-enabling headers. + for (let name of ["Accept", "Accept-Language", "Cookie", "Origin", "User-Agent"]) { + overrides[name.toLowerCase()] = true; + } let browserHeaders = details.requestHeaders.filter(x => !(x.name.toLowerCase() in overrides)); return {requestHeaders: browserHeaders.concat(headers)}; } finally {

1 0

[meek/master] Allow specifying a proxy.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 20af52a95d2d07ec43dc2299e1c064fb7c632051 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Feb 19 00:44:15 2019 -0700 Allow specifying a proxy. Just like with headers, we can only control the proxy through a global event listener, namely proxy.onRequest. We use the same scheme of locking modifications to the events so that only one request at a time is affected. --- webextension/background.js | 68 ++++++++++++++++++++++++++++++++++++++++----- webextension/manifest.json | 1 + webextension/native/main.go | 2 +- 3 files changed, 63 insertions(+), 8 deletions(-) diff --git a/webextension/background.js b/webextension/background.js index 5aab472..3b24a37 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -77,6 +77,31 @@ function base64_encode(dec_buf) { return btoa(dec_str); } +// Return a proxy.ProxyInfo according to the given specification. +// +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… +// The specification may look like: +// undefined +// {"type": "http", "host": "example.com", "port": 8080} +// {"type": "socks5", "host": "example.com", "port": 1080} +// {"type": "socks4a", "host": "example.com", "port": 1080} +function makeProxyInfo(spec) { + if (spec == null) { + return {type: "direct"}; + } + switch (spec.type) { + case "http": + return {type: "http", host: spec.host, port: spec.port}; + // What tor calls "socks5", WebExtension calls "socks". + case "socks5": + return {type: "socks", host: spec.host, port: spec.port, proxyDNS: true}; + // What tor calls "socks4a", WebExtension calls "socks4". + case "socks4a": + return {type: "socks4", host: spec.host, port: spec.port, proxyDNS: true}; + }; + throw new Error(`unknown proxy type ${spec.type}`); +} + // A Mutex's lock function returns a promise that resolves to a function which, // when called, allows the next call to lock to proceed. // https://stackoverflow.com/a/51086893 @@ -95,8 +120,9 @@ function Mutex() { } } -// Enforces exclusive access to onBeforeSendHeaders listeners. +// Enforce exclusive access to onBeforeSendHeaders and onRequest listeners. const headersMutex = new Mutex(); +const proxyMutex = new Mutex(); async function roundtrip(request) { // Process the incoming request spec and convert it into parameters to the @@ -132,8 +158,6 @@ async function roundtrip(request) { // Don't follow redirects (we'll get resp.status:0 if there is one). init.redirect = "manual"; - // TODO: proxy - // We need to use a webRequest.onBeforeSendHeaders listener to override // certain header fields, including Host (passing them to fetch in // init.headers does not work). But onBeforeSendHeaders is a global setting @@ -173,6 +197,27 @@ async function roundtrip(request) { } } + // Similarly, for controlling the proxy for each request, we set a + // proxy.onRequest listener, use it for one request, then remove it. + let proxyUnlock = await proxyMutex.lock(); + let proxyCalled = false; + // async to make exceptions visible to proxy.onError. + // https://bugzilla.mozilla.org/show_bug.cgi?id=1528873#c1 + async function proxyFn(details) { + try { + // Sanity assertion: per-request listeners are called at most once. + if (proxyCalled) { + throw new Error("proxyFn called more than once"); + } + proxyCalled = true; + + return makeProxyInfo(request.proxy); + } finally { + browser.proxy.onRequest.removeListener(proxyFn); + proxyUnlock(); + } + } + try { // Set our listener that overrides the headers for this request. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… @@ -181,18 +226,27 @@ async function roundtrip(request) { {urls: ["http://*/*", "https://*/*"]}, ["blocking", "requestHeaders"] ); + // Set our listener that overrides the proxy for this request. + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… + browser.proxy.onRequest.addListener( + proxyFn, + {urls: ["http://*/*", "https://*/*"]} + ); // Now actually do the request and build a response object. let resp = await fetch(url, init); let body = await resp.arrayBuffer(); return {status: resp.status, body: base64_encode(body)}; } finally { - // With certain errors (e.g. an invalid URL), the onBeforeSendHeaders - // listener may never get called, and therefore never release its lock. - // Ensure that locks are released and listeners removed in any case. - // It's safe to release a lock or remove a listener more than once. + // With certain errors (e.g. an invalid URL), our onBeforeSendHeaders + // and onRequest listeners may never get called, and therefore never + // release their locks. Ensure that locks are released and listeners + // removed in any case. It's safe to release a lock or remove a listener + // more than once. browser.webRequest.onBeforeSendHeaders.removeListener(headersFn); headersUnlock(); + browser.proxy.onRequest.removeListener(proxyFn); + proxyUnlock(); } } diff --git a/webextension/manifest.json b/webextension/manifest.json index a079833..fc56723 100644 --- a/webextension/manifest.json +++ b/webextension/manifest.json @@ -16,6 +16,7 @@ "permissions": [ "nativeMessaging", + "proxy", "webRequest", "webRequestBlocking", "https://*/*", diff --git a/webextension/native/main.go b/webextension/native/main.go index 25fdab3..5d071b3 100644 --- a/webextension/native/main.go +++ b/webextension/native/main.go @@ -68,7 +68,7 @@ type requestSpec struct { type proxySpec struct { Type string `json:"type"` Host string `json:"host"` - Port string `json:"port"` + Port int `json:"port"` } // A specification of an HTTP request or an error, as sent via the socket to

1 0

[meek/master] Refactor: handle all roundtrip errors in onMessage listener.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit e99685d257a6dc7fbeacac7f11e49d1d9d894de8 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Feb 18 15:55:33 2019 -0700 Refactor: handle all roundtrip errors in onMessage listener. --- webextension/background.js | 55 +++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 30 deletions(-) diff --git a/webextension/background.js b/webextension/background.js index 664e758..da3d118 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -107,39 +107,35 @@ async function roundtrip(request) { // https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/… let url; let init = {}; - try { - if (request.url == null) { - throw new Error("missing \"url\""); - } - if (!(request.url.startsWith("http://") || request.url.startsWith("https://"))) { - throw new Error("only http and https URLs are allowed"); - } - url = request.url; - if (request.method !== "POST") { - throw new Error("only POST is allowed"); - } - init.method = request.method; - - // Don't set init.headers; that handled in the onBeforeSendHeaders - // listener. + if (request.url == null) { + throw new Error("request spec failed validation: missing \"url\""); + } + if (!(request.url.startsWith("http://") || request.url.startsWith("https://"))) { + throw new Error("request spec failed validation: only http and https URLs are allowed"); + } + url = request.url; - if (request.body != null && request.body !== "") { - init.body = base64_decode(request.body); - } + if (request.method !== "POST") { + throw new Error("request spec failed validation: only POST is allowed"); + } + init.method = request.method; - // Do not read nor write from the browser's HTTP cache. - init.cache = "no-store"; - // Don't send cookies. - init.credentials = "omit"; - // Don't follow redirects (we'll get resp.status:0 if there is one). - init.redirect = "manual"; + // Don't set init.headers; that is handled in the onBeforeSendHeaders listener. - // TODO: proxy - } catch (error) { - return {error: `request spec failed valiation: ${error.message}`}; + if (request.body != null && request.body !== "") { + init.body = base64_decode(request.body); } + // Do not read nor write from the browser's HTTP cache. + init.cache = "no-store"; + // Don't send cookies. + init.credentials = "omit"; + // Don't follow redirects (we'll get resp.status:0 if there is one). + init.redirect = "manual"; + + // TODO: proxy + // We need to use an onBeforeSendHeaders to override certain header fields, // including Host (passing them to fetch in init.headers does not work). But // onBeforeSendHeaders is a global setting (applies to all requests) and we @@ -191,9 +187,6 @@ async function roundtrip(request) { let resp = await fetch(url, init); let body = await resp.arrayBuffer(); return {status: resp.status, body: base64_encode(body)}; - } catch (error) { - // Convert any errors into an error response. - return {error: error.message}; } finally { // With certain errors (e.g. an invalid URL), the onBeforeSendHeaders // listener may never get called, and therefore never release its lock. @@ -209,6 +202,8 @@ port.onMessage.addListener((message) => { case "roundtrip": // Do a roundtrip and send the result back to the native process. roundtrip(message.request) + // Convert any error into an "error" response. + .catch(error => ({error: error.message})) .then(response => port.postMessage({id: message.id, response})); break; case "report-address":

1 0

[meek/master] Factor out roundTrip separate from handleConn.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 40e2c17304f43edfd25e67f46075d60499e9435e Author: David Fifield <david(a)bamsoftware.com> Date: Mon Feb 18 16:25:01 2019 -0700 Factor out roundTrip separate from handleConn. In handleConn, take any error that roundTrip produces, and wrap it in a responseSpec that has an Error member set. This allows us to return an error object back to meek-client in cases like this: $ printf '\x00\x00\x00\x44{"method":"POST","url":"https://meek.bamsoftware.com/","body":"abc"}' | ncat 127.0.0.1 1234 → \x00\x00\x00\x2f{"error":"illegal base64 data at input byte 0"} In this way, we separate errors that occur during the roundtrip from errors that occur while writing the response back to the socker. --- webextension/native/main.go | 64 ++++++++++++++++++++++++++------------------- 1 file changed, 37 insertions(+), 27 deletions(-) diff --git a/webextension/native/main.go b/webextension/native/main.go index 4c66993..25fdab3 100644 --- a/webextension/native/main.go +++ b/webextension/native/main.go @@ -46,7 +46,7 @@ const ( // We receive multiple (possibly concurrent) connections over our listening // socket, and we must multiplex all their requests/responses to/from the -// browser over the single shared stdio stream. When handleConn sends a +// browser over the single shared stdio stream. When roundTrip sends a // webExtensionRoundTripRequest to the browser, creates a channel to receive the // response, and stores the ID–channel mapping in requestResponseMap. When // inFromBrowserLoop receives a webExtensionRoundTripResponse from the browser, @@ -189,30 +189,27 @@ func sendWebExtensionMessage(w io.Writer, message []byte) error { return err } -// Handle a socket connection, which is used for one request–response roundtrip -// through the browser. We read a responseSpec from the socket and wrap it in a -// webExtensionRoundTripRequest, tagging it with a random ID. We register the ID -// in requestResponseMap and forward the webExtensionRoundTripRequest to the -// browser. Then we wait for the browser to send back a -// webExtensionRoundTripResponse, which actually happens in inFromBrowserLoop. -// inFromBrowserLoop uses the ID to find this goroutine again. -func handleConn(conn net.Conn, outToBrowserChan chan<- []byte) error { - defer conn.Close() - +// Read a responseSpec from the socket and wrap it in a +// webExtensionRoundTripRequest, tagging it with a random ID. Register the ID in +// requestResponseMap and forward the webExtensionRoundTripRequest to the +// browser. Wait for the browser to send back a webExtensionRoundTripResponse +// (which actually happens in inFromBrowserLoop--that function uses the ID to +// find this goroutine again). Return a responseSpec object or an error. +func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (*responseSpec, error) { err := conn.SetReadDeadline(time.Now().Add(localReadTimeout)) if err != nil { - return err + return nil, err } req, err := readRequestSpec(conn) if err != nil { - return err + return nil, err } // Generate an ID that will allow us to match a response to this request. idRaw := make([]byte, 8) _, err = rand.Read(idRaw) if err != nil { - return err + return nil, err } id := hex.EncodeToString(idRaw) @@ -238,28 +235,41 @@ func handleConn(conn net.Conn, outToBrowserChan chan<- []byte) error { // Now wait for the browser to send the response back to us. // inFromBrowserLoop will find the proper channel by looking up the ID // in requestResponseMap. + var resp *responseSpec timeout := time.NewTimer(roundTripTimeout) select { - case resp := <-responseSpecChan: + case resp = <-responseSpecChan: timeout.Stop() - // Encode the response send it back out over the socket. - err = conn.SetWriteDeadline(time.Now().Add(localWriteTimeout)) - if err != nil { - return err - } - err = writeResponseSpec(conn, resp) - if err != nil { - return err - } case <-timeout.C: // But don't wait forever, so as to allow reclaiming memory in // case of a malfunction elsewhere. requestResponseMapLock.Lock() delete(requestResponseMap, id) requestResponseMapLock.Unlock() + err = fmt.Errorf("timed out waiting for browser to reply") } + return resp, err +} - return nil +// Handle a socket connection, which is used for one request–response roundtrip +// through the browser. Delegates the real work to roundTrip, which reads the +// requestSpec from the socket and sends it through the browser. Here, we wrap +// any error from roundTrip in an "error" response and send the response back on +// the socket. +func handleConn(conn net.Conn, outToBrowserChan chan<- []byte) error { + defer conn.Close() + + resp, err := roundTrip(conn, outToBrowserChan) + if err != nil { + resp = &responseSpec{Error: err.Error()} + } + + // Encode the response send it back out over the socket. + err = conn.SetWriteDeadline(time.Now().Add(localWriteTimeout)) + if err != nil { + return err + } + return writeResponseSpec(conn, resp) } // Receive socket connections and dispatch them to handleConn. @@ -297,7 +307,7 @@ func inFromBrowserLoop() error { } // Look up what channel (previously registered in - // requestResponseMap by handleConn) should receive the + // requestResponseMap by roundTrip) should receive the // response. requestResponseMapLock.Lock() responseSpecChan, ok := requestResponseMap[resp.ID] @@ -306,7 +316,7 @@ func inFromBrowserLoop() error { if !ok { // Either the browser made up an ID that we never sent - // it, or (more likely) it took too long and handleConn + // it, or (more likely) it took too long and roundTrip // stopped waiting. Just drop the response on the floor. continue }

1 0

[meek/master] Makefile for building .xpi.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit b7ea0b9340d9fedf9840cc1889329f72b631fe22 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Feb 19 14:27:10 2019 -0700 Makefile for building .xpi. --- webextension/Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/webextension/Makefile b/webextension/Makefile new file mode 100644 index 0000000..3db640f --- /dev/null +++ b/webextension/Makefile @@ -0,0 +1,4 @@ +# https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Pack… +meek-http-helper(a)bamsoftware.com.xpi: manifest.json background.js + rm -f "$@" + zip -9 -X "$@" $^

1 0

[meek/master] Detect errors of proxy.onRequest.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 5622b46cbccd7901bfd8523f08918315801b5cea Author: David Fifield <david(a)bamsoftware.com> Date: Tue Feb 19 00:58:13 2019 -0700 Detect errors of proxy.onRequest. It turns out that if an error occurs in proxy.onRequest, Firefox will ignore it and continue on as if there were no proxy. This can happen, for example, if the "type" of a ProxyInfo isn't one of the recognized types, or if the ProxyInfo is missing a field like "host". https://bugzilla.mozilla.org/show_bug.cgi?id=1528873 To prevent silent failures like this, we register another pair of event listeners. Unlike the headers and proxy event listeners, these remain static for all requests, and are not overwritten with each new request: * proxy.onError detects when an error occurs. * webRequest.onBeforeRequest cancels all requests after an error I made the error condition be persistent because it's not something that should arise during normal operation. proxy.onError only gets called when an error occurs in proxy.onRequest, and that only happens when the proxy specification is bogus. It doesn't get called when there's an network error, for example. In order to make exceptions in proxy.onRequest be noticed by proxy.onError, I had to make it return a rejection promise rather than throw an exception. An exception just gets logged to the browser console and nothing else. --- webextension/background.js | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/webextension/background.js b/webextension/background.js index 3b24a37..b43e614 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -250,6 +250,30 @@ async function roundtrip(request) { } } +// If an error occurs in a proxy.onRequest listener (for instance if a ProxyInfo +// field is missing or invalid), the browser will ignore the proxy and just +// connect directly. It will, however, call proxy.onError listeners. Register a +// static proxy.onError listener that sets a global flag if an error ever +// occurs; and a static browser.onBeforeRequest listener which checks the flag +// and cancels every request if it is set. We could be less severe here (we +// probably only need to cancel the *next* request that occurs after a proxy +// error), but this setup is meant to be a fail-closed safety net for what is +// essentially a "can't happen" state under correct configuration. Note that +// proxy.onError doesn't get called for transient errors like a failure to +// connect to the proxy, only for nonsensical ProxyInfo configurations. +// https://bugzilla.mozilla.org/show_bug.cgi?id=1528873 +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… +let proxyError = null; +browser.proxy.onError.addListener(error => { + console.log(`proxy error, disabling: ${error.message}`); + proxyError = error; +}); +browser.webRequest.onBeforeRequest.addListener( + details => ({cancel: proxyError != null}), + {urls: ["http://*/*", "https://*/*"]}, + ["blocking"] +); + // Connect to our native process. let port = browser.runtime.connectNative("meek.http.helper");

1 0

[meek/master] Minor typo and style fixes.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 1ab1ad40006b040c2d49a1f4de6380245dad5d0a Author: David Fifield <david(a)bamsoftware.com> Date: Mon Feb 18 16:37:29 2019 -0700 Minor typo and style fixes. --- webextension/background.js | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/webextension/background.js b/webextension/background.js index da3d118..5aab472 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -54,8 +54,6 @@ // because that is what enables the native part to match up requests and // responses. -let port = browser.runtime.connectNative("meek.http.helper"); - // Decode a base64-encoded string into an ArrayBuffer. function base64_decode(enc_str) { // First step is to decode the base64. atob returns a byte string; i.e., a @@ -97,7 +95,7 @@ function Mutex() { } } -// Enforces exclusive access for onBeforeSendHeaders listeners. +// Enforces exclusive access to onBeforeSendHeaders listeners. const headersMutex = new Mutex(); async function roundtrip(request) { @@ -136,21 +134,22 @@ async function roundtrip(request) { // TODO: proxy - // We need to use an onBeforeSendHeaders to override certain header fields, - // including Host (passing them to fetch in init.headers does not work). But - // onBeforeSendHeaders is a global setting (applies to all requests) and we - // need to be able to set different headers per request. We make it so that - // any onBeforeSendHeaders listener is only used for a single request, by - // acquiring a lock here and releasing it within the listener itself. The - // lock is acquired and released before any network communication happens; - // i.e., it's fast. + // We need to use a webRequest.onBeforeSendHeaders listener to override + // certain header fields, including Host (passing them to fetch in + // init.headers does not work). But onBeforeSendHeaders is a global setting + // (applies to all requests) and we need to be able to set different headers + // per request. We make it so that any onBeforeSendHeaders listener is only + // used for a single request, by acquiring a lock here and releasing it + // within the listener itself. The lock is acquired and released before any + // network communication happens; i.e., it's fast. let headersUnlock = await headersMutex.lock(); let headersCalled = false; function headersFn(details) { try { - // Sanity assertion: any given listener is called at most once. + // Sanity assertion: per-request listeners are called at most once. if (headersCalled) { - throw new Error("headersFn called more than once"); + console.log("headersFn called more than once"); + return {cancel: true}; } headersCalled = true; @@ -168,18 +167,18 @@ async function roundtrip(request) { return {requestHeaders: browserHeaders.concat(headers)}; } finally { // Now that the listener has been called, remove it and release the - // lock to allow the next request to set different listener. + // lock to allow the next request to set a different listener. browser.webRequest.onBeforeSendHeaders.removeListener(headersFn); headersUnlock(); } - }; + } try { // Set our listener that overrides the headers for this request. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… browser.webRequest.onBeforeSendHeaders.addListener( headersFn, - {"urls": ["http://*/*", "https://*/*"]}, + {urls: ["http://*/*", "https://*/*"]}, ["blocking", "requestHeaders"] ); @@ -197,7 +196,10 @@ async function roundtrip(request) { } } -port.onMessage.addListener((message) => { +// Connect to our native process. +let port = browser.runtime.connectNative("meek.http.helper"); + +port.onMessage.addListener(message => { switch (message.command) { case "roundtrip": // Do a roundtrip and send the result back to the native process. @@ -221,7 +223,7 @@ port.onMessage.addListener((message) => { } }); -port.onDisconnect.addListener((p) => { +port.onDisconnect.addListener(p => { // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… // "Note that in Google Chrome port.error is not supported: instead, use // runtime.lastError to get the error message."

1 0

[meek/master] Change --invisible to --headless in the firefox command.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit fadb2ef6ee0df9ae69ffa5d7de27df2c1a611cf9 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Feb 19 20:23:56 2019 -0700 Change --invisible to --headless in the firefox command. The --help output no longer mentions --invisible. About --headless it says: --headless Run without a GUI. Also use double dashes in --no-remote and --profile, to match --help output. --- meek-client-torbrowser/meek-client-torbrowser.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meek-client-torbrowser/meek-client-torbrowser.go b/meek-client-torbrowser/meek-client-torbrowser.go index 38a9fc3..6ce7a12 100644 --- a/meek-client-torbrowser/meek-client-torbrowser.go +++ b/meek-client-torbrowser/meek-client-torbrowser.go @@ -197,7 +197,7 @@ func isBrowserProfileUpToDate(templatePath string, profilePath string) bool { func runFirefox() (cmd *exec.Cmd, stdout io.Reader, err error) { // Unset environment variables that Firefox sets after a restart (as // caused by, for example, an update or the installation of an add-on). - // XRE_PROFILE_PATH, in particular, overrides the -profile option that + // XRE_PROFILE_PATH, in particular, overrides the --profile option that // runFirefox sets, causing Firefox to run with profile.default instead // of profile.meek-http-helper, which conflicts with the profile.default // that is already running. See https://bugs.torproject.org/13247, @@ -242,7 +242,7 @@ func runFirefox() (cmd *exec.Cmd, stdout io.Reader, err error) { return } - cmd = exec.Command(absFirefoxPath, "--invisible", "-no-remote", "-profile", profilePath) + cmd = exec.Command(absFirefoxPath, "--headless", "--no-remote", "--profile", profilePath) osSpecificCommandSetup(cmd) cmd.Stderr = os.Stderr stdout, err = cmd.StdoutPipe()

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits August 2019