August 2019 - tor-commits - lists.torproject.org

[meek/master] These can be ordinary error returns, not panics.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit f72a152760e912cd8c21ced335ad17fdea05a4e9 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 13:10:33 2019 -0600 These can be ordinary error returns, not panics. --- webextension/native/main.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/webextension/native/main.go b/webextension/native/main.go index 8771b72..44e2d82 100644 --- a/webextension/native/main.go +++ b/webextension/native/main.go @@ -127,7 +127,7 @@ func recvRequestSpec(r io.Reader) (requestSpec, error) { func sendResponseSpec(w io.Writer, spec responseSpec) error { encodedSpec, err := json.Marshal(spec) if err != nil { - panic(err) + return err } // len returns int, which is specified to be either 32 or 64 bits, so it // will never be truncated when converting to uint64. @@ -211,7 +211,7 @@ func roundTrip(req requestSpec, outToBrowserChan chan<- []byte) (responseSpec, e Request: req, }) if err != nil { - panic(err) + return nil, err } outToBrowserChan <- message

1 0

[meek/master] Add a suggested user.js file for Firefox.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 2d46d0be07b18e5b1f54f0528e1c7f89516c2d2d Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 25 19:06:02 2019 -0600 Add a suggested user.js file for Firefox. This is copied from projects/tor-browser/Bundle-Data/PTConfigs/meek-http-helper-user.js in tor-browser-build.git commit 4792ed5246d389caad036290e9ed34ff0ae1f0ad. --- webextension/README | 3 ++- webextension/firefox-user.js | 42 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) diff --git a/webextension/README b/webextension/README index 2b40172..7cb5267 100644 --- a/webextension/README +++ b/webextension/README @@ -43,7 +43,8 @@ These instructions require Firefox 65. 4. Run Firefox in a terminal so you can see its stdout. In Firefox, go to about:config and set browser.dom.window.dump.enabled=true - This enables the extension to write to stdout. + This enables the extension to write to stdout. See firefox-user.js + for other prefs you may want to set. 5. In Firefox, go to about:debugging and click "Load Temporary Add-on...". Find browser/manifest.json and click Open. diff --git a/webextension/firefox-user.js b/webextension/firefox-user.js new file mode 100644 index 0000000..fa13a9c --- /dev/null +++ b/webextension/firefox-user.js @@ -0,0 +1,42 @@ +// This is a user.js file for Firefox that sets preferences related to the +// meek-http-helper extension. The only preference essential to the operation of +// the extension is browser.dom.window.dump.enabled=true. The others provide +// failsafes and disable features that are not wanted in a headless browser. +// http://kb.mozillazine.org/User.js_file + +// The meek-http-helper extension uses dump to write its listening port number +// to stdout. +user_pref("browser.dom.window.dump.enabled", true); + +// Enable TLS session tickets (disabled by default in Tor Browser). Otherwise +// there is a missing TLS extension. +// https://trac.torproject.org/projects/tor/ticket/13442#comment:1 +user_pref("security.ssl.disable_session_identifiers", false); + +// Disable safe mode. In case of a crash, we don't want to prompt for a +// safe-mode browser that has extensions disabled. +// https://support.mozilla.org/en-US/questions/951221#answer-410562 +user_pref("toolkit.startup.max_resumed_crashes", -1); + +// Don't raise software update windows in this browser instance. +// https://trac.torproject.org/projects/tor/ticket/14203 +user_pref("app.update.enabled", false); + +// Set a failsafe blackhole proxy of 127.0.0.1:9, to prevent network interaction +// in case the user manages to open this profile with a normal browser UI (i.e., +// not headless with the meek-http-helper extension running). Port 9 is +// "discard", so it should work as a blackhole whether the port is open or +// closed. network.proxy.type=1 means "Manual proxy configuration". +// http://kb.mozillazine.org/Network.proxy.type +user_pref("network.proxy.type", 1); +user_pref("network.proxy.socks", "127.0.0.1"); +user_pref("network.proxy.socks_port", 9); +// Make sure DNS is also blackholed. network.proxy.socks_remote_dns is +// overridden by meek-http-helper at startup. +user_pref("network.proxy.socks_remote_dns", true); + +user_pref("extensions.enabledAddons", "meek-http-helper@bamsoftware.com:1.0"); + +// Ensure that distribution extensions (e.g., Tor Launcher) are not copied +// into the meek-http-helper profile. +user_pref("extensions.installDistroAddons", false);

1 0

[meek/master] Read the requestSpec outside of roundTrip.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 3c386e18948a161c925563dfb47212221ee85258 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 12:10:19 2019 -0600 Read the requestSpec outside of roundTrip. The difference here is that we don't send a JSON error response as a result of errors at this stage. --- webextension/native/main.go | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/webextension/native/main.go b/webextension/native/main.go index cbb48bf..e5f3a74 100644 --- a/webextension/native/main.go +++ b/webextension/native/main.go @@ -181,19 +181,10 @@ func sendWebExtensionMessage(w io.Writer, message []byte) error { // browser. Wait for the browser to send back a webExtensionRoundTripResponse // (which actually happens in inFromBrowserLoop--that function uses the ID to // find this goroutine again). Return a responseSpec object or an error. -func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (responseSpec, error) { - err := conn.SetReadDeadline(time.Now().Add(localReadTimeout)) - if err != nil { - return nil, err - } - req, err := readRequestSpec(conn) - if err != nil { - return nil, err - } - +func roundTrip(req requestSpec, outToBrowserChan chan<- []byte) (responseSpec, error) { // Generate an ID that will allow us to match a response to this request. idRaw := make([]byte, 8) - _, err = rand.Read(idRaw) + _, err := rand.Read(idRaw) if err != nil { return nil, err } @@ -251,7 +242,16 @@ type errorResponseSpec struct { func handleConn(conn net.Conn, outToBrowserChan chan<- []byte) error { defer conn.Close() - resp, err := roundTrip(conn, outToBrowserChan) + err := conn.SetReadDeadline(time.Now().Add(localReadTimeout)) + if err != nil { + return err + } + req, err := readRequestSpec(conn) + if err != nil { + return err + } + + resp, err := roundTrip(req, outToBrowserChan) if err != nil { resp = &errorResponseSpec{Error: err.Error()} }

1 0

[meek/master] Use const in a few more places.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit b4f23d54117ae915901d2fd3d51e97afb81b0ae1 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 11:05:49 2019 -0600 Use const in a few more places. --- webextension/browser/background.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index 038e548..5a23134 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -127,8 +127,8 @@ const proxyMutex = new Mutex(); async function roundtrip(params) { // Process the incoming request parameters and convert them into a Request. // https://developer.mozilla.org/en-US/docs/Web/API/Request/Request#Parameters - let input = params.url; - let init = { + const input = params.url; + const init = { method: params.method, body: params.body != null ? base64_decode(params.body) : undefined, // headers will get further treatment below in headersFn. @@ -152,7 +152,7 @@ async function roundtrip(params) { if (init.method !== "POST") { throw new Error("request spec failed validation: only POST is allowed"); } - let request = new Request(input, init); + const request = new Request(input, init); // We need to use a webRequest.onBeforeSendHeaders listener to override // certain header fields, including Host (creating a Request with them in @@ -162,7 +162,7 @@ async function roundtrip(params) { // used for a single request, by acquiring a lock here and releasing it // within the listener itself. The lock is acquired and released before any // network communication happens; i.e., it's fast. - let headersUnlock = await headersMutex.lock(); + const headersUnlock = await headersMutex.lock(); let headersCalled = false; function headersFn(details) { try { @@ -202,7 +202,7 @@ async function roundtrip(params) { // Similarly, for controlling the proxy for each request, we set a // proxy.onRequest listener, use it for one request, then remove it. - let proxyUnlock = await proxyMutex.lock(); + const proxyUnlock = await proxyMutex.lock(); let proxyCalled = false; // async to make exceptions visible to proxy.onError. // https://bugzilla.mozilla.org/show_bug.cgi?id=1528873#c1 @@ -303,7 +303,7 @@ browser.webRequest.onErrorOccurred.addListener( browser.proxy.settings.set({value: {proxyType: "system", proxyDNS: false}}); // Connect to our native process. -let port = browser.runtime.connectNative("meek.http.helper"); +const port = browser.runtime.connectNative("meek.http.helper"); port.onMessage.addListener(message => { switch (message.command) {

1 0

[meek/master] Try deleting the registry key before exiting.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit f7ca0eaf83c6abb6cac41e20f7daf011a79b3fd1 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 7 15:46:54 2019 -0700 Try deleting the registry key before exiting. --- meek-client-torbrowser/linux.go | 6 ++++++ meek-client-torbrowser/mac.go | 6 ++++++ meek-client-torbrowser/meek-client-torbrowser.go | 13 +++++++++++++ meek-client-torbrowser/windows.go | 20 +++++++++++++------- 4 files changed, 38 insertions(+), 7 deletions(-) diff --git a/meek-client-torbrowser/linux.go b/meek-client-torbrowser/linux.go index f728f1d..69ee7b7 100644 --- a/meek-client-torbrowser/linux.go +++ b/meek-client-torbrowser/linux.go @@ -29,3 +29,9 @@ func osSpecificCommandSetup(cmd *exec.Cmd) { func installHelperNativeManifest() error { return writeNativeManifestToFile(helperNativeManifestDir, helperNativeExecutablePath) } + +func uninstallHelperNativeManifest() error { + // Nothing to do here: the host manifest file is written inside the + // browser directory, so we assume we don't have to clean it up. + return nil +} diff --git a/meek-client-torbrowser/mac.go b/meek-client-torbrowser/mac.go index 995aca5..918a62e 100644 --- a/meek-client-torbrowser/mac.go +++ b/meek-client-torbrowser/mac.go @@ -42,3 +42,9 @@ func installHelperNativeManifest() error { // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… return writeNativeManifestToFile(filepath.Join(homeDir, "Mozilla", "NativeMessagingHosts"), helperNativeExecutablePath) } + +func uninstallHelperNativeManifest() error { + // Nothing to do here: the host manifest file is written inside the + // browser directory, so we assume we don't have to clean it up. + return nil +} diff --git a/meek-client-torbrowser/meek-client-torbrowser.go b/meek-client-torbrowser/meek-client-torbrowser.go index 0284280..b512b10 100644 --- a/meek-client-torbrowser/meek-client-torbrowser.go +++ b/meek-client-torbrowser/meek-client-torbrowser.go @@ -15,6 +15,11 @@ // executed as given, except that a --helper option is added that points to the // port number read from firefox. // +// On Windows, this program assumes that it has exclusive control over the +// HKEY_CURRENT_USER\SOFTWARE\Mozilla\NativeMessagingHosts\meek.http.helper +// registry key. It creates the key when run and tries to delete it when +// exiting. +// // This program proxies stdin and stdout to and from meek-client, so it is // actually meek-client that drives the pluggable transport negotiation with // tor. @@ -422,6 +427,14 @@ func main() { log.Print(err) } + // Make a best-effort attempt to remove the registry key that points to + // the meek.http.helper.json file on Windows, because the registry is + // persistent global state. + err = uninstallHelperNativeManifest() + if err != nil { + log.Printf("uninstalling native host manifest: %v", err) + } + var wg sync.WaitGroup if firefoxCmd != nil { wg.Add(1) diff --git a/meek-client-torbrowser/windows.go b/meek-client-torbrowser/windows.go index 907d1dc..d96a02d 100644 --- a/meek-client-torbrowser/windows.go +++ b/meek-client-torbrowser/windows.go @@ -22,6 +22,7 @@ const ( // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… helperNativeManifestDir = "TorBrowser/Data/Browser/.mozilla/native-messaging-hosts" helperNativeExecutablePath = "TorBrowser/Tor/PluggableTransports/meek-http-helper.exe" + registryKey = `SOFTWARE\Mozilla\NativeMessagingHosts\` + nativeAppName ) func osSpecificCommandSetup(cmd *exec.Cmd) { @@ -39,16 +40,21 @@ func installHelperNativeManifest() error { return err } - // TODO: Find a way to do this without having to write to the registry. - // https://bugs.torproject.org/29347#comment:9 + // On Windows we must set a registry key pointing to the host manifest. + // We'll attempt to delete the key in uninstallHelperNativeManifest. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… - k, _, err := registry.CreateKey( - registry.CURRENT_USER, - `SOFTWARE\Mozilla\NativeMessagingHosts\`+nativeAppName, - registry.WRITE, - ) + k, _, err := registry.CreateKey(registry.CURRENT_USER, registryKey, registry.WRITE) if err != nil { return err } return k.SetStringValue("", absManifestPath) } + +func uninstallHelperNativeManifest() error { + // Delete the registry key pointing to the host manifest. We don't + // delete any higher up the tree; e.g. an empty + // HKEY_CURRENT_USER\SOFTWARE\Mozilla\NativeMessagingHosts will remain + // even if it was not present before installHelperNativeManifest was + // called. + return registry.DeleteKey(registry.CURRENT_USER, registryKey) +}

1 0

[meek/master] New way to disable updates in headless Firefox (63+).
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 09754cb550795da768797d63dd57bc732f268c65 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 25 19:10:29 2019 -0600 New way to disable updates in headless Firefox (63+). https://bugs.torproject.org/29611 app.update.enabled doesn't exist anymore: https://bugzilla.mozilla.org/show_bug.cgi?id=1420514 --- webextension/firefox-user.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/webextension/firefox-user.js b/webextension/firefox-user.js index fa13a9c..b6786c9 100644 --- a/webextension/firefox-user.js +++ b/webextension/firefox-user.js @@ -21,6 +21,12 @@ user_pref("toolkit.startup.max_resumed_crashes", -1); // Don't raise software update windows in this browser instance. // https://trac.torproject.org/projects/tor/ticket/14203 user_pref("app.update.enabled", false); +// Firefox 63 removed the app.update.enabled pref. Instead, set the update check +// interval very high and otherwise neuter it as much as possible. +// https://bugzilla.mozilla.org/show_bug.cgi?id=1420514 +user_pref("app.update.interval", 999999999); // don't check for updates +user_pref("app.update.auto", false); // if downloaded, don't automatically install +user_pref("app.update.doorhanger", false); // don't show an update notice in the UI // Set a failsafe blackhole proxy of 127.0.0.1:9, to prevent network interaction // in case the user manages to open this profile with a normal browser UI (i.e.,

1 0

[meek/master] Throw an exception if headersFn is called more than once.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 89990602e8217c5f53a07c8922b5acee677e9e38 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 02:09:06 2019 -0600 Throw an exception if headersFn is called more than once. Re-use the catch handler. --- webextension/browser/background.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index fd34a5d..038e548 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -168,8 +168,7 @@ async function roundtrip(params) { try { // Sanity assertion: per-request listeners are called at most once. if (headersCalled) { - console.log("headersFn called more than once"); - return {cancel: true}; + throw new Error("headersFn called more than once"); } headersCalled = true;

1 0

[meek/master] Remove the legacy XPCOM firefox extension.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 1dd467e7d73e37cfa89f782f3a05dd98f20a16cd Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 25 18:57:54 2019 -0600 Remove the legacy XPCOM firefox extension. --- README | 9 +- firefox/chrome.manifest | 5 - firefox/components/main.js | 465 --------------------------------------------- firefox/install.rdf | 21 -- 4 files changed, 2 insertions(+), 498 deletions(-) diff --git a/README b/README index 35568b6..b4efead 100644 --- a/README +++ b/README @@ -35,8 +35,8 @@ with the --helper option pointing at a browser extension that has been set up separately. How it works is meek-client tells the browser what URL to request, the browser requests it and returns the payload to meek-client. The TLS implementation is that of the browser, so it better -blends in with allowed traffic. A browser extensions for Firefox is in -the firefox directory. +blends in with allowed traffic. A browser extension for Firefox is in +the webextension directory. Here is a summary of the programs that appear in subdirectories. @@ -44,11 +44,6 @@ appengine: Reflector web app that runs on Google App Engine. The reflector simply copies requests and responses to an instance of meek-server somewhere. -firefox: -Browser extension for TLS camouflage. Only works with versions of -Firefox below 60.0. Use the extension in the webextension for newer -versions of Firefox. - meek-client: The client transport plugin, run by a censored client. diff --git a/firefox/chrome.manifest b/firefox/chrome.manifest deleted file mode 100644 index ef6596c..0000000 --- a/firefox/chrome.manifest +++ /dev/null @@ -1,5 +0,0 @@ -# https://developer.mozilla.org/en-US/docs/How_to_Build_an_XPCOM_Component_in… -# https://developer.mozilla.org/en-US/docs/Mozilla/XPCOM/Receiving_startup_no… -component {e7bc2b9c-f454-49f3-a19f-14848a4d871d} components/main.js -contract @bamsoftware.com/meek-http-helper;1 {e7bc2b9c-f454-49f3-a19f-14848a4d871d} -category profile-after-change MeekHTTPHelper @bamsoftware.com/meek-http-helper;1 diff --git a/firefox/components/main.js b/firefox/components/main.js deleted file mode 100644 index 48f0978..0000000 --- a/firefox/components/main.js +++ /dev/null @@ -1,465 +0,0 @@ -// This is an extension that allows external programs to make HTTP requests -// using the browser's networking libraries. -// -// The extension opens a TCP socket listening on localhost on an ephemeral port. -// It writes the port number in a recognizable format to stdout so that a parent -// process can read it and connect. When the extension receives a connection, it -// reads a 4-byte big-endian length field, then tries to read that many bytes of -// data. The data is UTF-8–encoded JSON, having the format -// { -// "method": "POST", -// "url": "https://allowed.example/", -// "header": { -// "Host": "forbidden.example", -// "X-Session-Id": "XXXXXXXXXXX"} -// }, -// "proxy": { -// "type": "http", -// "host": "proxy.example", -// "port": 8080 -// }, -// "body": "...base64..." -// } -// The extension makes the request as commanded. It returns the response to the -// client as a JSON blob, preceded by a 4-byte length as before. If successful, -// the response looks like -// { -// "status": 200, -// "body": "...base64..." -// } -// If there is a network error, the "error" key will be defined. A 404 response -// or similar from the target web server is not considered such an error. -// { -// "error": "NS_ERROR_UNKNOWN_HOST" -// } -// The extension closes the connection after each transaction, and the client -// must reconnect to do another request. - -// https://developer.mozilla.org/en-US/docs/How_to_Build_an_XPCOM_Component_in… -// https://developer.mozilla.org/en-US/docs/Mozilla/JavaScript_code_modules/XP… -Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); - -// https://developer.mozilla.org/en-US/docs/Tools/Browser_Console#Console.jsm -Components.utils.import("resource://gre/modules/Console.jsm"); - -// Everything resides within the MeekHTTPHelper namespace. MeekHTTPHelper is -// also the type from which NSGetFactory is constructed, and it is the top-level -// nsIServerSocketListener. -function MeekHTTPHelper() { - this.wrappedJSObject = this; - this.handlers = []; -} -MeekHTTPHelper.prototype = { - classDescription: "meek HTTP helper component", - classID: Components.ID("{e7bc2b9c-f454-49f3-a19f-14848a4d871d}"), - contractID: "@bamsoftware.com/meek-http-helper;1", - - // https://developer.mozilla.org/en-US/docs/Mozilla/JavaScript_code_modules/XP… - QueryInterface: XPCOMUtils.generateQI([ - Components.interfaces.nsIObserver, - Components.interfaces.nsIServerSocketListener, - ]), - - // nsIObserver implementation. - observe: function(subject, topic, data) { - if (topic !== "profile-after-change") - return; - - try { - // Flush the preferences to disk so that pref values that were - // updated during startup are not lost, e.g., ones related to - // browser updates. - // We do this before we change the network.proxy.socks_remote_dns - // value since we do not want that change to be permanent. See - // https://bugs.torproject.org/16269. - let prefSvc = Components.classes["@mozilla.org/preferences-service;1"] - .getService(Components.interfaces.nsIPrefService); - prefSvc.savePrefFile(null); - - let prefs = Components.classes["@mozilla.org/preferences-service;1"] - .getService(Components.interfaces.nsIPrefBranch); - // Allow unproxied DNS, working around a Tor Browser patch: - // https://bugs.torproject.org/11183#comment:6. - // We set TRANSPARENT_PROXY_RESOLVES_HOST whenever we are asked to - // use a proxy, so name resolution uses the proxy despite this pref. - prefs.setBoolPref("network.proxy.socks_remote_dns", false); - - // https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIServe… - let serverSocket = Components.classes["@mozilla.org/network/server-socket;1"] - .createInstance(Components.interfaces.nsIServerSocket); - // Listen on an ephemeral port, loopback only, with default backlog. - serverSocket.init(-1, true, -1); - serverSocket.asyncListen(this); - // This output line is used by a controller program to find out what - // address the helper is listening on. For the dump call to have any - // effect, the pref browser.dom.window.dump.enabled must be true. - dump("meek-http-helper: listen 127.0.0.1:" + serverSocket.port + "\n"); - - // Block forever. - // https://developer.mozilla.org/en-US/Add-ons/Code_snippets/Threads#Waiting_f… - let thread = Components.classes["@mozilla.org/thread-manager;1"].getService().currentThread; - while (true) - thread.processNextEvent(true); - } finally { - let app = Components.classes["@mozilla.org/toolkit/app-startup;1"] - .getService(Components.interfaces.nsIAppStartup); - app.quit(app.eForceQuit); - } - }, - - // nsIServerSocketListener implementation. - onSocketAccepted: function(server, transport) { - // dump("onSocketAccepted " + transport.host + ":" + transport.port + "\n"); - // Stop referencing handlers that are no longer alive. - this.handlers = this.handlers.filter(function(h) { return h.transport.isAlive(); }); - this.handlers.push(new MeekHTTPHelper.LocalConnectionHandler(transport)); - }, - onStopListening: function(server, status) { - // dump("onStopListening status " + status + "\n"); - }, -}; - -// Global variables and functions. - -MeekHTTPHelper.LOCAL_READ_TIMEOUT = 2.0; -MeekHTTPHelper.LOCAL_WRITE_TIMEOUT = 2.0; - -// https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIProto… -MeekHTTPHelper.proxyProtocolService = Components.classes["@mozilla.org/network/protocol-proxy-service;1"] - .getService(Components.interfaces.nsIProtocolProxyService); - -// https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIIOSer… -MeekHTTPHelper.ioService = Components.classes["@mozilla.org/network/io-service;1"] - .getService(Components.interfaces.nsIIOService); -MeekHTTPHelper.httpProtocolHandler = MeekHTTPHelper.ioService.getProtocolHandler("http") - .QueryInterface(Components.interfaces.nsIHttpProtocolHandler); - -// Set the transport to time out at the given absolute deadline. -MeekHTTPHelper.refreshDeadline = function(transport, deadline) { - let timeout; - if (deadline === null) - timeout = 0xffffffff; - else - timeout = Math.max(0.0, Math.ceil((deadline - Date.now()) / 1000.0)); - transport.setTimeout(Components.interfaces.nsISocketTransport.TIMEOUT_READ_WRITE, timeout); -}; - -// Reverse-index the Components.results table. -MeekHTTPHelper.lookupStatus = function(status) { - for (let name in Components.results) { - if (Components.results[name] === status) - return name; - } - return null; -}; - -// Enforce restrictions on what requests we are willing to make. These can -// probably be loosened up. Try and rule out anything unexpected until we -// know we need otherwise. -MeekHTTPHelper.requestOk = function(req) { - if (req.method === undefined) { - dump("req missing \"method\".\n"); - return false; - } - if (req.url === undefined) { - dump("req missing \"url\".\n"); - return false; - } - - if (req.method !== "POST") { - dump("req.method is " + JSON.stringify(req.method) + ", not \"POST\".\n"); - return false; - } - if (!(req.url.startsWith("http://") || req.url.startsWith("https://"))) { - dump("req.url doesn't start with \"http://\" or \"https://\".\n"); - return false; - } - - return true; -}; - -// Return an nsIProxyInfo according to the given specification. Returns null on -// error. -// https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIProxy… -// The specification may look like: -// undefined -// {"type": "http", "host": "example.com", "port": 8080} -// {"type": "socks5", "host": "example.com", "port": 1080} -// {"type": "socks4a", "host": "example.com", "port": 1080} -MeekHTTPHelper.buildProxyInfo = function(spec) { - // https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Inter… - let flags = Components.interfaces.nsIProxyInfo.TRANSPARENT_PROXY_RESOLVES_HOST; - if (spec === undefined) { - // "direct"; i.e., no proxy. This is the default. - return MeekHTTPHelper.proxyProtocolService.newProxyInfo("direct", "", 0, flags, 0xffffffff, null); - } else if (spec.type === "http") { - // "http" proxy. Versions of Firefox before 32, and Tor Browser before - // 3.6.2, leak the covert Host header in HTTP proxy CONNECT requests. - // Using an HTTP proxy cannot provide effective obfuscation without such - // a patched Firefox. - // https://bugs.torproject.org/12146 - // https://gitweb.torproject.org/tor-browser.git/commit/?id=e08b91c78d919f66dd… - // https://bugzilla.mozilla.org/show_bug.cgi?id=1017769 - // https://hg.mozilla.org/mozilla-central/rev/a1f6458800d4 - return MeekHTTPHelper.proxyProtocolService.newProxyInfo("http", spec.host, spec.port, flags, 0xffffffff, null); - } else if (spec.type === "socks5") { - // "socks5" is tor's name. "socks" is XPCOM's name. - return MeekHTTPHelper.proxyProtocolService.newProxyInfo("socks", spec.host, spec.port, flags, 0xffffffff, null); - } else if (spec.type === "socks4a") { - // "socks4a" is tor's name. "socks4" is XPCOM's name. - return MeekHTTPHelper.proxyProtocolService.newProxyInfo("socks4", spec.host, spec.port, flags, 0xffffffff, null); - } - return null; -}; - -// Transmit an HTTP response over the given nsITransport. resp is an object with -// keys perhaps including "status", "body", and "error". -MeekHTTPHelper.sendResponse = function(transport, resp) { - // dump("sendResponse " + JSON.stringify(resp) + "\n"); - let outputStream = transport.openOutputStream(Components.interfaces.nsITransport.OPEN_BLOCKING, 0, 0); - let output = Components.classes["@mozilla.org/binaryoutputstream;1"] - .createInstance(Components.interfaces.nsIBinaryOutputStream); - output.setOutputStream(outputStream); - - let converter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"] - .createInstance(Components.interfaces.nsIScriptableUnicodeConverter); - converter.charset = "UTF-8"; - let s = JSON.stringify(resp); - let data = converter.convertToByteArray(s); - - let deadline = Date.now() + MeekHTTPHelper.LOCAL_WRITE_TIMEOUT * 1000; - try { - MeekHTTPHelper.refreshDeadline(transport, deadline); - output.write32(data.length); - MeekHTTPHelper.refreshDeadline(transport, deadline); - output.writeByteArray(data, data.length); - MeekHTTPHelper.refreshDeadline(transport, null); - } finally { - output.close(); - } -}; - -// LocalConnectionHandler handles each new client connection received on the -// socket opened by MeekHTTPHelper. It reads a JSON request, makes the request -// on the Internet, and writes the result back to the socket. Error handling -// happens within callbacks. -MeekHTTPHelper.LocalConnectionHandler = function(transport) { - this.transport = transport; - this.requestReader = null; - this.channel = null; - this.listener = null; - this.readRequest(this.makeRequest.bind(this)); -}; -MeekHTTPHelper.LocalConnectionHandler.prototype = { - readRequest: function(callback) { - this.requestReader = new MeekHTTPHelper.RequestReader(this.transport, callback); - }, - - makeRequest: function(req) { - // dump("makeRequest " + JSON.stringify(req) + "\n"); - if (!MeekHTTPHelper.requestOk(req)) { - MeekHTTPHelper.sendResponse(this.transport, {"error": "request failed validation"}); - return; - } - - // Check what proxy to use, if any. - // dump("using proxy " + JSON.stringify(req.proxy) + "\n"); - let proxyInfo = MeekHTTPHelper.buildProxyInfo(req.proxy); - if (proxyInfo === null) { - MeekHTTPHelper.sendResponse(this.transport, {"error": "can't create nsIProxyInfo from " + JSON.stringify(req.proxy)}); - return; - } - - // Construct an HTTP channel with the given nsIProxyInfo. - // https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIHttpC… - let uri = MeekHTTPHelper.ioService.newURI(req.url, null, null); - this.channel = MeekHTTPHelper.httpProtocolHandler.newProxiedChannel(uri, proxyInfo, 0, null) - .QueryInterface(Components.interfaces.nsIHttpChannel); - // Remove pre-set headers. Firefox's AddStandardRequestHeaders adds - // User-Agent, Accept, Accept-Language, and Accept-Encoding, and perhaps - // others. Just remove all of them. - let headers = []; - // https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Inter… - // https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Inter… - this.channel.visitRequestHeaders({visitHeader: function(key, value) { headers.push(key); }}) - for (let i = 0; i < headers.length; i++) { - if (headers[i] !== "Host") - this.channel.setRequestHeader(headers[i], "", false); - } - // Set our own headers. - if (req.header !== undefined) { - for (let key in req.header) { - this.channel.setRequestHeader(key, req.header[key], false); - } - } - if (req.body !== undefined) { - let body = atob(req.body); - let inputStream = Components.classes["@mozilla.org/io/string-input-stream;1"] - .createInstance(Components.interfaces.nsIStringInputStream); - inputStream.setData(body, body.length); - let uploadChannel = this.channel.QueryInterface(Components.interfaces.nsIUploadChannel); - uploadChannel.setUploadStream(inputStream, "application/octet-stream", body.length); - } - // https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIUploa… - // says we must set requestMethod after calling setUploadStream. - this.channel.requestMethod = req.method; - this.channel.redirectionLimit = 0; - - this.listener = new MeekHTTPHelper.HttpStreamListener(function(resp) { - MeekHTTPHelper.sendResponse(this.transport, resp); - }.bind(this)); - this.channel.asyncOpen(this.listener, this.channel); - }, -}; - -// RequestReader reads a JSON-encoded request from the given transport, and -// calls the given callback with the request as an argument. In case of error, -// the transport is closed and the callback is not called. -MeekHTTPHelper.RequestReader = function(transport, callback) { - this.transport = transport; - this.callback = callback; - - this.curThread = Components.classes["@mozilla.org/thread-manager;1"].getService().currentThread; - this.inputStream = this.transport.openInputStream(Components.interfaces.nsITransport.OPEN_BLOCKING, 0, 0); - - this.state = this.STATE_READING_LENGTH; - // Initially size the buffer to read the 4-byte length. - this.buf = new Uint8Array(4); - this.bytesToRead = this.buf.length; - this.deadline = Date.now() + MeekHTTPHelper.LOCAL_READ_TIMEOUT * 1000; - this.asyncWait(); -}; -MeekHTTPHelper.RequestReader.prototype = { - // The onInputStreamReady callback is called for all read events. These - // constants keep track of the state of parsing. - STATE_READING_LENGTH: 1, - STATE_READING_OBJECT: 2, - STATE_DONE: 3, - - // Do an asyncWait and handle the result. - asyncWait: function() { - MeekHTTPHelper.refreshDeadline(this.transport, this.deadline); - this.inputStream.asyncWait(this, 0, 0, this.curThread); - }, - - // nsIInputStreamCallback implementation. - onInputStreamReady: function(inputStream) { - try { - let input = Components.classes["@mozilla.org/binaryinputstream;1"] - .createInstance(Components.interfaces.nsIBinaryInputStream); - input.setInputStream(inputStream); - switch (this.state) { - case this.STATE_READING_LENGTH: - this.doStateReadingLength(input); - break; - case this.STATE_READING_OBJECT: - this.doStateReadingObject(input); - break; - } - if (this.state !== this.STATE_DONE) - this.asyncWait(); - } catch (e) { - this.transport.close(0); - throw e; - } - }, - - // Read into this.buf (up to its capacity) and decrement this.bytesToRead. - readIntoBuf: function(input) { - let n = Math.min(input.available(), this.bytesToRead); - let data = input.readByteArray(n); - this.buf.subarray(this.buf.length - this.bytesToRead).set(data); - this.bytesToRead -= n; - }, - - doStateReadingLength: function(input) { - this.readIntoBuf(input); - if (this.bytesToRead > 0) - return; - - let b = this.buf; - let len = (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3]; - if (len > 1000000) - throw Components.Exception("Object length is too large (" + len + " bytes)", Components.results.NS_ERROR_ILLEGAL_VALUE); - - this.state = this.STATE_READING_OBJECT; - this.buf = new Uint8Array(len); - this.bytesToRead = this.buf.length; - }, - - doStateReadingObject: function(input) { - this.readIntoBuf(input); - if (this.bytesToRead > 0) - return; - - let converter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"] - .createInstance(Components.interfaces.nsIScriptableUnicodeConverter); - converter.charset = "UTF-8"; - let s = converter.convertFromByteArray(this.buf, this.buf.length); - let req = JSON.parse(s); - - this.state = this.STATE_DONE; - this.buf = null; - this.bytesToRead = 0; - - MeekHTTPHelper.refreshDeadline(this.transport, null); - this.callback(req); - }, -}; - -// HttpStreamListener makes the requested HTTP request and calls the given -// callback with a representation of the response. The "error" key of the return -// value is defined if and only if there was an error. -MeekHTTPHelper.HttpStreamListener = function(callback) { - this.callback = callback; - // This is a list of binary strings that is concatenated in onStopRequest. - this.body = []; - this.length = 0; -}; -// https://developer.mozilla.org/en-US/docs/Creating_Sandboxed_HTTP_Connections -MeekHTTPHelper.HttpStreamListener.prototype = { - // https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIReque… - onStartRequest: function(req, context) { - // dump("onStartRequest\n"); - }, - onStopRequest: function(req, context, status) { - // dump("onStopRequest " + status + "\n"); - let resp = {}; - try { - resp.status = context.responseStatus; - } catch (e) { - if (e instanceof Components.interfaces.nsIXPCException - && e.result == Components.results.NS_ERROR_NOT_AVAILABLE) { - // Reading context.responseStatus can fail in this way when - // there is no HTTP response; e.g., when the connection is - // reset. - } - } - if (Components.isSuccessCode(status)) { - resp.body = btoa(this.body.join("")); - } else { - let err = MeekHTTPHelper.lookupStatus(status); - if (err !== null) - resp.error = err; - else - resp.error = "error " + String(status); - } - this.callback(resp); - }, - - // https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIStrea… - onDataAvailable: function(request, context, stream, sourceOffset, length) { - // dump("onDataAvailable " + length + " bytes\n"); - this.length += length; - let input = Components.classes["@mozilla.org/binaryinputstream;1"] - .createInstance(Components.interfaces.nsIBinaryInputStream); - input.setInputStream(stream); - this.body.push(String.fromCharCode.apply(null, input.readByteArray(length))); - if (this.length > 1000000) { - request.cancel(Components.results.NS_ERROR_ILLEGAL_VALUE); - return; - } - }, -}; - -let NSGetFactory = XPCOMUtils.generateNSGetFactory([MeekHTTPHelper]); diff --git a/firefox/install.rdf b/firefox/install.rdf deleted file mode 100644 index 6f67ded..0000000 --- a/firefox/install.rdf +++ /dev/null @@ -1,21 +0,0 @@ -<?xml version="1.0"?> - -<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:em="http://www.mozilla.org/2004/em-rdf#"> - <Description about="urn:mozilla:install-manifest"> - <em:id>meek-http-helper(a)bamsoftware.com</em:id> - <em:version>1.0</em:version> - <em:type>2</em:type> - -  - <em:targetApplication> - <Description> - <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> - <em:minVersion>24.0</em:minVersion> - <em:maxVersion>*</em:maxVersion> - </Description> - </em:targetApplication> - - <em:name>meek HTTP helper</em:name> - <em:description>Makes HTTP requests on behalf of meek-client.</em:description> - </Description> -</RDF>

1 0

[meek/master] Refactoring WebExtension native component.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 417a693ee7af7f2d7dfff4ce57a1fcbac8776153 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 13:29:22 2019 -0600 Refactoring WebExtension native component. The native component actually doesn't need to introspect the objects it passes to the browser, except for the "error" property of a response when it wants to report its own error. --- webextension/native/main.go | 58 +++++++++++++++++---------------------------- 1 file changed, 22 insertions(+), 36 deletions(-) diff --git a/webextension/native/main.go b/webextension/native/main.go index 9424715..cbb48bf 100644 --- a/webextension/native/main.go +++ b/webextension/native/main.go @@ -36,7 +36,7 @@ const ( roundTripTimeout = 120 * time.Second // Self-defense against a malfunctioning meek-client. We'll refuse to - // read encoded responses that are longer than this. + // read encoded requests that are longer than this. maxRequestSpecLength = 1000000 // Self-defense against a malfunctioning browser. We'll refuse to @@ -52,32 +52,16 @@ const ( // inFromBrowserLoop receives a webExtensionRoundTripResponse from the browser, // it is tagged with the same ID as the corresponding request. inFromBrowserLoop // looks up the matching channel and sends the response over it. -var requestResponseMap = make(map[string]chan<- *responseSpec) +var requestResponseMap = make(map[string]chan<- responseSpec) var requestResponseMapLock sync.Mutex // A specification of an HTTP request, as received via the socket from // "meek-client --helper". -type requestSpec struct { - Method string `json:"method,omitempty"` - URL string `json:"url,omitempty"` - Header map[string]string `json:"header,omitempty"` - Body []byte `json:"body,omitempty"` - Proxy *proxySpec `json:"proxy,omitempty"` -} - -type proxySpec struct { - Type string `json:"type"` - Host string `json:"host"` - Port int `json:"port"` -} +type requestSpec interface{} // A specification of an HTTP request or an error, as sent via the socket to // "meek-client --helper". -type responseSpec struct { - Error string `json:"error,omitempty"` - Status int `json:"status,omitempty"` - Body []byte `json:"body,omitempty"` -} +type responseSpec interface{} // A "roundtrip" command sent out to the browser over the stdout stream. It // encapsulates a requestSpec as received from the socket, plus @@ -87,17 +71,17 @@ type responseSpec struct { // command:"roundtrip" is to disambiguate with the other command we may send, // "report-address". type webExtensionRoundTripRequest struct { - Command string `json:"command"` // "roundtrip" - ID string `json:"id"` - Request *requestSpec `json:"request"` + Command string `json:"command"` // "roundtrip" + ID string `json:"id"` + Request requestSpec `json:"request"` } // A message received from the the browser over the stdin stream. It // encapsulates a responseSpec along with the ID of the webExtensionResponse // that resulted in this response. type webExtensionRoundTripResponse struct { - ID string `json:"id"` - Response *responseSpec `json:"response"` + ID string `json:"id"` + Response responseSpec `json:"response"` } // Read a requestSpec (receive from "meek-client --helper"). @@ -106,7 +90,7 @@ type webExtensionRoundTripResponse struct { // protocol: a 4-byte length, followed by a JSON object of that length. The only // difference is the byte order of the length: meek-client's is big-endian, // while WebExtension's is native-endian. -func readRequestSpec(r io.Reader) (*requestSpec, error) { +func readRequestSpec(r io.Reader) (requestSpec, error) { var length uint32 err := binary.Read(r, binary.BigEndian, &length) if err != nil { @@ -132,7 +116,7 @@ func readRequestSpec(r io.Reader) (*requestSpec, error) { } // Write a responseSpec (send to "meek-client --helper"). -func writeResponseSpec(w io.Writer, spec *responseSpec) error { +func writeResponseSpec(w io.Writer, spec responseSpec) error { encodedSpec, err := json.Marshal(spec) if err != nil { panic(err) @@ -151,11 +135,7 @@ func writeResponseSpec(w io.Writer, spec *responseSpec) error { } _, err = w.Write(encodedSpec) - if err != nil { - return err - } - - return nil + return err } // Receive a WebExtension message. @@ -201,7 +181,7 @@ func sendWebExtensionMessage(w io.Writer, message []byte) error { // browser. Wait for the browser to send back a webExtensionRoundTripResponse // (which actually happens in inFromBrowserLoop--that function uses the ID to // find this goroutine again). Return a responseSpec object or an error. -func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (*responseSpec, error) { +func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (responseSpec, error) { err := conn.SetReadDeadline(time.Now().Add(localReadTimeout)) if err != nil { return nil, err @@ -222,7 +202,7 @@ func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (*responseSpec, er // This is the channel over which inFromBrowserLoop will send the // response. Register it in requestResponseMap to enable // inFromBrowserLoop to match the corresponding response to it. - responseSpecChan := make(chan *responseSpec) + responseSpecChan := make(chan responseSpec) requestResponseMapLock.Lock() requestResponseMap[id] = responseSpecChan requestResponseMapLock.Unlock() @@ -241,7 +221,7 @@ func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (*responseSpec, er // Now wait for the browser to send the response back to us. // inFromBrowserLoop will find the proper channel by looking up the ID // in requestResponseMap. - var resp *responseSpec + var resp responseSpec timeout := time.NewTimer(roundTripTimeout) select { case resp = <-responseSpecChan: @@ -257,6 +237,12 @@ func roundTrip(conn net.Conn, outToBrowserChan chan<- []byte) (*responseSpec, er return resp, err } +// This is a responseSpec for errors that originate inside this program, as +// opposed to being relayed from the browser. +type errorResponseSpec struct { + Error string `json:"error"` +} + // Handle a socket connection, which is used for one request–response roundtrip // through the browser. Delegates the real work to roundTrip, which reads the // requestSpec from the socket and sends it through the browser. Here, we wrap @@ -267,7 +253,7 @@ func handleConn(conn net.Conn, outToBrowserChan chan<- []byte) error { resp, err := roundTrip(conn, outToBrowserChan) if err != nil { - resp = &responseSpec{Error: err.Error()} + resp = &errorResponseSpec{Error: err.Error()} } // Encode the response send it back out over the socket.

1 0

[meek/master] Refactoring, use a Request object.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 5a4d27132ece3de17164b97030c0a57f8f2a489d Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 02:08:33 2019 -0600 Refactoring, use a Request object. --- webextension/browser/background.js | 86 +++++++++++++++++++------------------- 1 file changed, 42 insertions(+), 44 deletions(-) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index 0b896e9..fd34a5d 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -124,42 +124,38 @@ function Mutex() { const headersMutex = new Mutex(); const proxyMutex = new Mutex(); -async function roundtrip(request) { - // Process the incoming request spec and convert it into parameters to the - // fetch API. Also enforce some restrictions on what kinds of requests we - // are willing to make. - // https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/… - let url; - let init = {}; +async function roundtrip(params) { + // Process the incoming request parameters and convert them into a Request. + // https://developer.mozilla.org/en-US/docs/Web/API/Request/Request#Parameters + let input = params.url; + let init = { + method: params.method, + body: params.body != null ? base64_decode(params.body) : undefined, + // headers will get further treatment below in headersFn. + headers: params.header != null ? params.header : {}, + // Do not read nor write from the browser's HTTP cache. + cache: "no-store", + // Don't send cookies. + credentials: "omit", + // Don't follow redirects (we'll get resp.status:0 if there is one). + redirect: "manual", + }; - if (request.url == null) { + // Also enforce restrictions on what kinds of requests we are willing to + // make. + if (input == null) { throw new Error("request spec failed validation: missing \"url\""); } - if (!(request.url.startsWith("http://") || request.url.startsWith("https://"))) { + if (!(input.startsWith("http://") || input.startsWith("https://"))) { throw new Error("request spec failed validation: only http and https URLs are allowed"); } - url = request.url; - - if (request.method !== "POST") { + if (init.method !== "POST") { throw new Error("request spec failed validation: only POST is allowed"); } - init.method = request.method; - - // Don't set init.headers; that is handled in the onBeforeSendHeaders listener. - - if (request.body != null && request.body !== "") { - init.body = base64_decode(request.body); - } - - // Do not read nor write from the browser's HTTP cache. - init.cache = "no-store"; - // Don't send cookies. - init.credentials = "omit"; - // Don't follow redirects (we'll get resp.status:0 if there is one). - init.redirect = "manual"; + let request = new Request(input, init); // We need to use a webRequest.onBeforeSendHeaders listener to override - // certain header fields, including Host (passing them to fetch in + // certain header fields, including Host (creating a Request with them in // init.headers does not work). But onBeforeSendHeaders is a global setting // (applies to all requests) and we need to be able to set different headers // per request. We make it so that any onBeforeSendHeaders listener is only @@ -177,21 +173,21 @@ async function roundtrip(request) { } headersCalled = true; - // Convert request.header from object to array form. - // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… - let headers = Object.entries(request.header != null ? request.header : {}) - .map(x => ({name: x[0], value: x[1]})); - // Remove all browser headers that conflict with requested headers. - let overrides = {}; - for (let name of Object.keys(headers)) { - overrides[name.toLowerCase()] = true; + let removals = new Map(); + for (let name of Object.keys(init.headers)) { + removals.set(name.toLowerCase()); } // Also remove some unnecessary or potentially tracking-enabling headers. for (let name of ["Accept", "Accept-Language", "Cookie", "Origin", "User-Agent"]) { - overrides[name.toLowerCase()] = true; + removals.set(name.toLowerCase()); + } + let requestHeaders = details.requestHeaders.filter(header => !removals.has(header.name.toLowerCase())); + // Append the requested headers in array form. + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… + for (let [name, value] of Object.entries(init.headers)) { + requestHeaders.push({name, value}); } - let browserHeaders = details.requestHeaders.filter(x => !(x.name.toLowerCase() in overrides)); - return {requestHeaders: browserHeaders.concat(headers)}; + return {requestHeaders}; } catch (error) { // In case of any error in the code above, play it safe and cancel // the request. @@ -220,7 +216,7 @@ async function roundtrip(request) { } proxyCalled = true; - return makeProxyInfo(request.proxy); + return makeProxyInfo(params.proxy); } finally { browser.proxy.onRequest.removeListener(proxyFn); proxyUnlock(); @@ -228,14 +224,14 @@ async function roundtrip(request) { } try { - // Set our listener that overrides the headers for this request. + // Set a listener that overrides the headers for this request. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… browser.webRequest.onBeforeSendHeaders.addListener( headersFn, {urls: ["http://*/*", "https://*/*"]}, ["blocking", "requestHeaders"] ); - // Set our listener that overrides the proxy for this request. + // Set a listener that overrides the proxy for this request. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… browser.proxy.onRequest.addListener( proxyFn, @@ -243,9 +239,11 @@ async function roundtrip(request) { ); // Now actually do the request and build a response object. - let resp = await fetch(url, init); - let body = await resp.arrayBuffer(); - return {status: resp.status, body: base64_encode(body)}; + let response = await fetch(request); + return { + status: response.status, + body: base64_encode(await response.arrayBuffer()), + }; } finally { // With certain errors (e.g. an invalid URL), our onBeforeSendHeaders // and onRequest listeners may never get called, and therefore never

1 0