August 2019 - tor-commits - lists.torproject.org

[meek/master] Refactoring, use a Request object.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 5a4d27132ece3de17164b97030c0a57f8f2a489d Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 02:08:33 2019 -0600 Refactoring, use a Request object. --- webextension/browser/background.js | 86 +++++++++++++++++++------------------- 1 file changed, 42 insertions(+), 44 deletions(-) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index 0b896e9..fd34a5d 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -124,42 +124,38 @@ function Mutex() { const headersMutex = new Mutex(); const proxyMutex = new Mutex(); -async function roundtrip(request) { - // Process the incoming request spec and convert it into parameters to the - // fetch API. Also enforce some restrictions on what kinds of requests we - // are willing to make. - // https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/… - let url; - let init = {}; +async function roundtrip(params) { + // Process the incoming request parameters and convert them into a Request. + // https://developer.mozilla.org/en-US/docs/Web/API/Request/Request#Parameters + let input = params.url; + let init = { + method: params.method, + body: params.body != null ? base64_decode(params.body) : undefined, + // headers will get further treatment below in headersFn. + headers: params.header != null ? params.header : {}, + // Do not read nor write from the browser's HTTP cache. + cache: "no-store", + // Don't send cookies. + credentials: "omit", + // Don't follow redirects (we'll get resp.status:0 if there is one). + redirect: "manual", + }; - if (request.url == null) { + // Also enforce restrictions on what kinds of requests we are willing to + // make. + if (input == null) { throw new Error("request spec failed validation: missing \"url\""); } - if (!(request.url.startsWith("http://") || request.url.startsWith("https://"))) { + if (!(input.startsWith("http://") || input.startsWith("https://"))) { throw new Error("request spec failed validation: only http and https URLs are allowed"); } - url = request.url; - - if (request.method !== "POST") { + if (init.method !== "POST") { throw new Error("request spec failed validation: only POST is allowed"); } - init.method = request.method; - - // Don't set init.headers; that is handled in the onBeforeSendHeaders listener. - - if (request.body != null && request.body !== "") { - init.body = base64_decode(request.body); - } - - // Do not read nor write from the browser's HTTP cache. - init.cache = "no-store"; - // Don't send cookies. - init.credentials = "omit"; - // Don't follow redirects (we'll get resp.status:0 if there is one). - init.redirect = "manual"; + let request = new Request(input, init); // We need to use a webRequest.onBeforeSendHeaders listener to override - // certain header fields, including Host (passing them to fetch in + // certain header fields, including Host (creating a Request with them in // init.headers does not work). But onBeforeSendHeaders is a global setting // (applies to all requests) and we need to be able to set different headers // per request. We make it so that any onBeforeSendHeaders listener is only @@ -177,21 +173,21 @@ async function roundtrip(request) { } headersCalled = true; - // Convert request.header from object to array form. - // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… - let headers = Object.entries(request.header != null ? request.header : {}) - .map(x => ({name: x[0], value: x[1]})); - // Remove all browser headers that conflict with requested headers. - let overrides = {}; - for (let name of Object.keys(headers)) { - overrides[name.toLowerCase()] = true; + let removals = new Map(); + for (let name of Object.keys(init.headers)) { + removals.set(name.toLowerCase()); } // Also remove some unnecessary or potentially tracking-enabling headers. for (let name of ["Accept", "Accept-Language", "Cookie", "Origin", "User-Agent"]) { - overrides[name.toLowerCase()] = true; + removals.set(name.toLowerCase()); + } + let requestHeaders = details.requestHeaders.filter(header => !removals.has(header.name.toLowerCase())); + // Append the requested headers in array form. + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… + for (let [name, value] of Object.entries(init.headers)) { + requestHeaders.push({name, value}); } - let browserHeaders = details.requestHeaders.filter(x => !(x.name.toLowerCase() in overrides)); - return {requestHeaders: browserHeaders.concat(headers)}; + return {requestHeaders}; } catch (error) { // In case of any error in the code above, play it safe and cancel // the request. @@ -220,7 +216,7 @@ async function roundtrip(request) { } proxyCalled = true; - return makeProxyInfo(request.proxy); + return makeProxyInfo(params.proxy); } finally { browser.proxy.onRequest.removeListener(proxyFn); proxyUnlock(); @@ -228,14 +224,14 @@ async function roundtrip(request) { } try { - // Set our listener that overrides the headers for this request. + // Set a listener that overrides the headers for this request. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… browser.webRequest.onBeforeSendHeaders.addListener( headersFn, {urls: ["http://*/*", "https://*/*"]}, ["blocking", "requestHeaders"] ); - // Set our listener that overrides the proxy for this request. + // Set a listener that overrides the proxy for this request. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… browser.proxy.onRequest.addListener( proxyFn, @@ -243,9 +239,11 @@ async function roundtrip(request) { ); // Now actually do the request and build a response object. - let resp = await fetch(url, init); - let body = await resp.arrayBuffer(); - return {status: resp.status, body: base64_encode(body)}; + let response = await fetch(request); + return { + status: response.status, + body: base64_encode(await response.arrayBuffer()), + }; } finally { // With certain errors (e.g. an invalid URL), our onBeforeSendHeaders // and onRequest listeners may never get called, and therefore never

1 0

[meek/master] Note anticipated problems with proxy.settings.set in FF 67+.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 264bf24579caba974f330cb854680dcbb171879a Author: David Fifield <david(a)bamsoftware.com> Date: Tue Aug 27 11:22:50 2019 -0600 Note anticipated problems with proxy.settings.set in FF 67+. --- webextension/browser/background.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index 5a23134..4d8c8c2 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -300,6 +300,15 @@ browser.webRequest.onErrorOccurred.addListener( // Firefox 63 because of a bug. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… // https://bugzilla.mozilla.org/show_bug.cgi?id=1487121 +// +// This proxy.settings.set call may cause a problem in Firefox 67+, because in +// those versions, extensions additionally need the "Run in Private Windows" +// permission to use proxy.settings.set at all (not only in private windows). +// Lacking the permission, you get an error in the browser console: "Error: +// proxy.settings requires private browsing permission." We will need to find a +// way to install the extension such that it has the necessary permission. +// https://bugzilla.mozilla.org/show_bug.cgi?id=1525447 +// https://bugzilla.mozilla.org/show_bug.cgi?id=1526299 browser.proxy.settings.set({value: {proxyType: "system", proxyDNS: false}}); // Connect to our native process.

1 0

[meek/master] Cancel onBeforeSendHeaders in case of an exception.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 73719bb3fddaaddffba7554adabff55bb5bd12ea Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 01:29:59 2019 -0600 Cancel onBeforeSendHeaders in case of an exception. A typo during debugging caused the callback to crash and have no effect. --- webextension/browser/background.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index d26b744..c47d06b 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -192,6 +192,11 @@ async function roundtrip(request) { } let browserHeaders = details.requestHeaders.filter(x => !(x.name.toLowerCase() in overrides)); return {requestHeaders: browserHeaders.concat(headers)}; + } catch (error) { + // In case of any error in the code above, play it safe and cancel + // the request. + console.log(`${browser.runtime.id}: error in onBeforeSendHeaders: ${error.message}`); + return {cancel: true}; } finally { // Now that the listener has been called, remove it and release the // lock to allow the next request to set a different listener.

1 0

[meek/master] Minor Chrome compatibility.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit d86981fadd29c3364942f07dc9c70ec702905340 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Mar 30 02:02:09 2019 -0600 Minor Chrome compatibility. This doesn't hurt, but we're still reliant on Firefox for using the global "browser" object (instead of "chrome"), and especially for the proxy code, which has a totally different API in Chrome. --- webextension/browser/background.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/webextension/browser/background.js b/webextension/browser/background.js index c47d06b..0b896e9 100644 --- a/webextension/browser/background.js +++ b/webextension/browser/background.js @@ -336,7 +336,8 @@ port.onDisconnect.addListener(p => { // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… // "Note that in Google Chrome port.error is not supported: instead, use // runtime.lastError to get the error message." - if (p.error) { - console.log(`${browser.runtime.id}: disconnected because of error: ${p.error.message}`); + let error = p.error || browser.runtime.lastError; + if (error) { + console.log(`${browser.runtime.id}: disconnected because of error: ${error.message}`); } });

1 0

[meek/master] Make a separate webextension/browser directory.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit b1441a2135f2ae3cc2978622d008d39b73d52065 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 7 14:30:41 2019 -0700 Make a separate webextension/browser directory. --- webextension/README | 14 +++++++------- webextension/{ => browser}/Makefile | 0 webextension/{ => browser}/background.js | 0 webextension/{ => browser}/manifest.json | 0 webextension/{ => native}/meek.http.helper.json | 0 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/webextension/README b/webextension/README index a728842..5b958cb 100644 --- a/webextension/README +++ b/webextension/README @@ -12,18 +12,18 @@ These instructions require Firefox 65. 1. Compile the native application. cd native && go build -2. Edit meek.http.helper.json and set the "path" field to the path to - the native application. +2. Edit native/meek.http.helper.json and set the "path" field to the + path to the native application. "path": "/where/you/installed/native", -3. Copy the edited meek.http.helper.json file to the OS-appropriate - location. +3. Copy the edited native/meek.http.helper.json file to the + OS-appropriate location. # macOS mkdir -p ~/"Library/Application Support/Mozilla/NativeMessagingHosts/" - cp meek.http.helper.json ~/"Library/Application Support/Mozilla/NativeMessagingHosts/" + cp native/meek.http.helper.json ~/"Library/Application Support/Mozilla/NativeMessagingHosts/" # other Unix mkdir -p ~/.mozilla/native-messaging-hosts/ - cp meek.http.helper.json ~/.mozilla/native-messaging-hosts/ + cp native/meek.http.helper.json ~/.mozilla/native-messaging-hosts/ The meek.http.helper.json file is called the "host manifest" or "app manifest" and it tells the browser where to find the native part of the WebExtension. More information: @@ -35,7 +35,7 @@ These instructions require Firefox 65. This enables the extension to write to stdout. 5. In Firefox, go to about:debugging and click "Load Temporary - Add-on...". Find manifest.json and click Open. + Add-on...". Find browser/manifest.json and click Open. More information: https://developer.mozilla.org/en-US/docs/Tools/about:debugging#Loading_a_te… In the terminal, you should see a line like this, with a random port diff --git a/webextension/Makefile b/webextension/browser/Makefile similarity index 100% rename from webextension/Makefile rename to webextension/browser/Makefile diff --git a/webextension/background.js b/webextension/browser/background.js similarity index 100% rename from webextension/background.js rename to webextension/browser/background.js diff --git a/webextension/manifest.json b/webextension/browser/manifest.json similarity index 100% rename from webextension/manifest.json rename to webextension/browser/manifest.json diff --git a/webextension/meek.http.helper.json b/webextension/native/meek.http.helper.json similarity index 100% rename from webextension/meek.http.helper.json rename to webextension/native/meek.http.helper.json

1 0

[meek/master] Revise webextension instructions.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit a53ddab24652f72680a8dc917d826f5a780b9551 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 7 14:45:16 2019 -0700 Revise webextension instructions. --- README | 7 ++++++- webextension/README | 13 ++++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/README b/README index e2f04bd..35568b6 100644 --- a/README +++ b/README @@ -45,7 +45,9 @@ Reflector web app that runs on Google App Engine. The reflector simply copies requests and responses to an instance of meek-server somewhere. firefox: -Browser extension for TLS camouflage. +Browser extension for TLS camouflage. Only works with versions of +Firefox below 60.0. Use the extension in the webextension for newer +versions of Firefox. meek-client: The client transport plugin, run by a censored client. @@ -70,6 +72,9 @@ terminateprocess-buffer: An auxiliary program used on Windows to assist with cleanup of subprocesses. +webextension: +Browser extension for TLS camouflage. + wsgi: A WSGI Python reflector. diff --git a/webextension/README b/webextension/README index 5b958cb..2b40172 100644 --- a/webextension/README +++ b/webextension/README @@ -9,12 +9,16 @@ meek-client, because the extension cannot open a socket by itself. These instructions require Firefox 65. +== Native component == + 1. Compile the native application. cd native && go build 2. Edit native/meek.http.helper.json and set the "path" field to the path to the native application. - "path": "/where/you/installed/native", + "path": "/path/to/meek/webextension/native/native", + More information: + https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… 3. Copy the edited native/meek.http.helper.json file to the OS-appropriate location. @@ -24,11 +28,18 @@ These instructions require Firefox 65. # other Unix mkdir -p ~/.mozilla/native-messaging-hosts/ cp native/meek.http.helper.json ~/.mozilla/native-messaging-hosts/ + # Windows + Open regedit.exe and create a new registry key: + HKEY_CURRENT_USER\SOFTWARE\Mozilla\NativeMessagingHosts\meek.http.helper + Set the default value to the path to meek.http.helper.json: + C:\path\to\meek\webextension\native\meek.http.helper.json The meek.http.helper.json file is called the "host manifest" or "app manifest" and it tells the browser where to find the native part of the WebExtension. More information: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… +== Browser component == + 4. Run Firefox in a terminal so you can see its stdout. In Firefox, go to about:config and set browser.dom.window.dump.enabled=true

1 0

[meek/master] Make the native extension work with GOARCH=386.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 663c0c69f76c0fc86ea06a56efc0719bc3d7c4ab Author: David Fifield <david(a)bamsoftware.com> Date: Thu Feb 21 10:49:50 2019 -0700 Make the native extension work with GOARCH=386. --- webextension/native/endian_386.go | 8 ++++++++ webextension/native/main.go | 10 ++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/webextension/native/endian_386.go b/webextension/native/endian_386.go new file mode 100644 index 0000000..6a1e44e --- /dev/null +++ b/webextension/native/endian_386.go @@ -0,0 +1,8 @@ +// The WebExtension browser–app protocol uses native-endian length prefixes :/ +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + +package main + +import "encoding/binary" + +var NativeEndian = binary.LittleEndian diff --git a/webextension/native/main.go b/webextension/native/main.go index 5d071b3..9424715 100644 --- a/webextension/native/main.go +++ b/webextension/native/main.go @@ -138,8 +138,11 @@ func writeResponseSpec(w io.Writer, spec *responseSpec) error { panic(err) } + // len returns int, which is specified to be either 32 or 64 bits, so it + // will never be truncated when converting to uint64. + // https://golang.org/ref/spec#Numeric_types length := len(encodedSpec) - if length > math.MaxUint32 { + if uint64(length) > math.MaxUint32 { return fmt.Errorf("response spec is too long to represent: %d", length) } err = binary.Write(w, binary.BigEndian, uint32(length)) @@ -177,8 +180,11 @@ func recvWebExtensionMessage(r io.Reader) ([]byte, error) { // Send a WebExtension message. // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… func sendWebExtensionMessage(w io.Writer, message []byte) error { + // len returns int, which is specified to be either 32 or 64 bits, so it + // will never be truncated when converting to uint64. + // https://golang.org/ref/spec#Numeric_types length := len(message) - if length > math.MaxUint32 { + if uint64(length) > math.MaxUint32 { return fmt.Errorf("WebExtension message is too long to represent: %d", length) } err := binary.Write(w, NativeEndian, uint32(length))

1 0

[meek/master] Have meek-client-torbrowser write the native host manifest.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit c7b99db18bb4f60c5221bf62b7bee3eb0b558434 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Feb 20 13:27:32 2019 -0700 Have meek-client-torbrowser write the native host manifest. The WebExtension needs a JSON "host manifest" that both authorizes the extension to run a native executable, and tells the browser where to find the native executable. The path inside the manifest needs to be an absolute path, so we cannot just plunk down a static file; we have to know the path to where the browser is installed. meek-client-torbrowser rewrites the manifest on each startup, where the browser expects to find it. The is mostly self-contained and compatible with previous behavior, with one small exception on windows. On mac and linux, the browser expects to find the manifest in a well-known location (relative to $HOME, which in our case is inside the browser's directory tree or the ancillary TorBrowser-Data directory). But on windows, the path to the manifest needs to be stored in the registry. So meek-client-torbrowser not only writes the manifest file, it also writes a registry key pointing to the file. I'd like to try and find a way to do this that doesn't require modifying global state like this. This patch is tested on linux and windows but not mac. --- meek-client-torbrowser/linux.go | 7 ++ meek-client-torbrowser/mac.go | 19 +++++- meek-client-torbrowser/meek-client-torbrowser.go | 8 +++ meek-client-torbrowser/nativemanifest.go | 86 ++++++++++++++++++++++++ meek-client-torbrowser/windows.go | 37 +++++++++- 5 files changed, 155 insertions(+), 2 deletions(-) diff --git a/meek-client-torbrowser/linux.go b/meek-client-torbrowser/linux.go index 71b5cfb..f728f1d 100644 --- a/meek-client-torbrowser/linux.go +++ b/meek-client-torbrowser/linux.go @@ -15,6 +15,9 @@ const ( firefoxProfilePath = "TorBrowser/Data/Browser/profile.meek-http-helper" torDataDirFirefoxProfilePath = "" profileTemplatePath = "" + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + helperNativeManifestDir = "TorBrowser/Data/Browser/.mozilla/native-messaging-hosts" + helperNativeExecutablePath = "TorBrowser/Tor/PluggableTransports/meek-http-helper" ) func osSpecificCommandSetup(cmd *exec.Cmd) { @@ -22,3 +25,7 @@ func osSpecificCommandSetup(cmd *exec.Cmd) { // process terminates. Only works on Linux. cmd.SysProcAttr = &syscall.SysProcAttr{Pdeathsig: syscall.SIGTERM} } + +func installHelperNativeManifest() error { + return writeNativeManifestToFile(helperNativeManifestDir, helperNativeExecutablePath) +} diff --git a/meek-client-torbrowser/mac.go b/meek-client-torbrowser/mac.go index f88ed38..995aca5 100644 --- a/meek-client-torbrowser/mac.go +++ b/meek-client-torbrowser/mac.go @@ -5,7 +5,11 @@ package main -import "os/exec" +import ( + "os" + "os/exec" + "path/filepath" +) const ( // During startup of meek-client-torbrowser, the browser profile is @@ -20,8 +24,21 @@ const ( torDataDirFirefoxProfilePath = "PluggableTransports/profile.meek-http-helper" firefoxProfilePath = "../../../../TorBrowser-Data/Tor/PluggableTransports/profile.meek-http-helper" profileTemplatePath = "../../Resources/TorBrowser/Tor/PluggableTransports/template-profile.meek-http-helper" + helperNativeExecutablePath = "../Tor/PluggableTransports/meek-http-helper" ) func osSpecificCommandSetup(cmd *exec.Cmd) { // nothing } + +func installHelperNativeManifest() error { + var homeDir string + torDataDir := os.Getenv("TOR_BROWSER_TOR_DATA_DIR") + if torDataDir != "" { + homeDir = filepath.Join(torDataDir, "..", "Browser") + } else { + homeDir = "../../../../TorBrowser-Data/Browser" + } + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + return writeNativeManifestToFile(filepath.Join(homeDir, "Mozilla", "NativeMessagingHosts"), helperNativeExecutablePath) +} diff --git a/meek-client-torbrowser/meek-client-torbrowser.go b/meek-client-torbrowser/meek-client-torbrowser.go index 6ce7a12..0284280 100644 --- a/meek-client-torbrowser/meek-client-torbrowser.go +++ b/meek-client-torbrowser/meek-client-torbrowser.go @@ -242,6 +242,14 @@ func runFirefox() (cmd *exec.Cmd, stdout io.Reader, err error) { return } + // Install the meek.http.helper.json file that tells the browser where + // to find the native component of the meek-http-helper WebExtension. + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + err = installHelperNativeManifest() + if err != nil { + return + } + cmd = exec.Command(absFirefoxPath, "--headless", "--no-remote", "--profile", profilePath) osSpecificCommandSetup(cmd) cmd.Stderr = os.Stderr diff --git a/meek-client-torbrowser/nativemanifest.go b/meek-client-torbrowser/nativemanifest.go new file mode 100644 index 0000000..7c6abc7 --- /dev/null +++ b/meek-client-torbrowser/nativemanifest.go @@ -0,0 +1,86 @@ +// This code has to do with the native manifest of the meek-http-helper +// WebExtension. The native manifest contains the path to the native executable +// that the WebExtension runs via the native messaging API. +// +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + +package main + +import ( + "encoding/json" + "io/ioutil" + "log" + "os" + "path/filepath" +) + +// These values need to match the ones in the webextension directory. +const ( + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/WebE… + addOnID = "meek-http-helper(a)bamsoftware.com" + // This needs to match the value passed to runtime.connectNative in the + // JavaScript code. + nativeAppName = "meek.http.helper" +) + +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… +type nativeManifestJSON struct { + Name string `json:"name"` + Description string `json:"description"` + Path string `json:"path"` + Type string `json:"type"` + AllowedExtensions []string `json:"allowed_extensions"` +} + +// manifestDir is the directory of the eventual meek.http.helper.json file (the +// manifest itself). nativePath is the path to the native executable that is +// stored inside the manifest. +func writeNativeManifestToFile(manifestDir, nativePath string) error { + // "On Windows, this may be relative to the manifest itself. On OS X and + // Linux it must be absolute." + absNativePath, err := filepath.Abs(nativePath) + if err != nil { + return err + } + manifest := nativeManifestJSON{ + Name: nativeAppName, + Description: "Native half of meek-http-helper.", + Path: absNativePath, + Type: "stdio", + AllowedExtensions: []string{"meek-http-helper(a)bamsoftware.com"}, + } + + err = os.MkdirAll(manifestDir, 0755) + if err != nil { + return err + } + // First we'll write the new manifest into a temporary file. + tmpFile, err := ioutil.TempFile(manifestDir, nativeAppName+".json.tmp.") + if err != nil { + return err + } + // Write the JSON to the temporary file and rename it to the + // destination. Wrapped in a lambda to allow early return in case of + // error. + err = func() error { + err = json.NewEncoder(tmpFile).Encode(manifest) + if err != nil { + return err + } + err = tmpFile.Close() + if err != nil { + return err + } + return os.Rename(tmpFile.Name(), filepath.Join(manifestDir, nativeAppName+".json")) + }() + // If any error occurred during write/close/rename, try to remove the + // temporary file. + if err != nil { + err := os.Remove(tmpFile.Name()) + // Log this error but otherwise ignore it. + if err != nil { + log.Print(err) + } + } + return err +} diff --git a/meek-client-torbrowser/windows.go b/meek-client-torbrowser/windows.go index f837e6e..907d1dc 100644 --- a/meek-client-torbrowser/windows.go +++ b/meek-client-torbrowser/windows.go @@ -5,15 +5,50 @@ package main -import "os/exec" +import ( + "os/exec" + "path/filepath" + + "golang.org/x/sys/windows/registry" +) const ( firefoxPath = "./firefox.exe" firefoxProfilePath = "TorBrowser/Data/Browser/profile.meek-http-helper" torDataDirFirefoxProfilePath = "" profileTemplatePath = "" + // The location of the host manifest doesn't matter for windows. Just + // put it in the same place as on linux. + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + helperNativeManifestDir = "TorBrowser/Data/Browser/.mozilla/native-messaging-hosts" + helperNativeExecutablePath = "TorBrowser/Tor/PluggableTransports/meek-http-helper.exe" ) func osSpecificCommandSetup(cmd *exec.Cmd) { // nothing } + +func installHelperNativeManifest() error { + absManifestPath, err := filepath.Abs(filepath.Join(helperNativeManifestDir, nativeAppName+".json")) + if err != nil { + return err + } + + err = writeNativeManifestToFile(helperNativeManifestDir, helperNativeExecutablePath) + if err != nil { + return err + } + + // TODO: Find a way to do this without having to write to the registry. + // https://bugs.torproject.org/29347#comment:9 + // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Nati… + k, _, err := registry.CreateKey( + registry.CURRENT_USER, + `SOFTWARE\Mozilla\NativeMessagingHosts\`+nativeAppName, + registry.WRITE, + ) + if err != nil { + return err + } + return k.SetStringValue("", absManifestPath) +}

1 0

[meek/master] New bugzilla numbers for proxy-related bugs.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit 7d8af4043209065d4d226ad2f24725b9930fb4ee Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 7 13:56:44 2019 -0700 New bugzilla numbers for proxy-related bugs. --- webextension/background.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/webextension/background.js b/webextension/background.js index d5bbac7..d26b744 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -206,6 +206,7 @@ async function roundtrip(request) { let proxyCalled = false; // async to make exceptions visible to proxy.onError. // https://bugzilla.mozilla.org/show_bug.cgi?id=1528873#c1 + // https://bugzilla.mozilla.org/show_bug.cgi?id=1533505 async function proxyFn(details) { try { // Sanity assertion: per-request listeners are called at most once. @@ -264,7 +265,7 @@ async function roundtrip(request) { // essentially a "can't happen" state under correct configuration. Note that // proxy.onError doesn't get called for transient errors like a failure to // connect to the proxy, only for nonsensical ProxyInfo configurations. -// https://bugzilla.mozilla.org/show_bug.cgi?id=1528873 +// https://bugzilla.mozilla.org/show_bug.cgi?id=1533509 // https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… let proxyError = null; browser.proxy.onError.addListener(error => {

1 0

[meek/master] Set network.proxy.socks_remote_dns=false inside the WebExtension.
by dcf＠torproject.org 28 Aug '19

28 Aug '19

commit ce6633c8be5a4b1d85106ef2ecc02cb29d97d9ac Author: David Fifield <david(a)bamsoftware.com> Date: Wed Feb 20 19:26:48 2019 -0700 Set network.proxy.socks_remote_dns=false inside the WebExtension. This is to work around a Firefox patch that otherwise prevents DNS requests from being made when proxyType=="direct". Compare to https://gitweb.torproject.org/pluggable-transports/meek.git/commit/?id=32ca… --- webextension/background.js | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/webextension/background.js b/webextension/background.js index 00500a0..7ad06fe 100644 --- a/webextension/background.js +++ b/webextension/background.js @@ -277,6 +277,22 @@ browser.webRequest.onBeforeRequest.addListener( ["blocking"] ); +// Allow unproxied DNS, working around a Tor Browser patch: https://bugs.torproject.org/11183#comment:6. +// We manually override the proxy for every request, and in makeProxyInfo we set +// proxyDNS:true wherever necessary, so name resolution uses the proxy despite +// this pref. +// +// In Tor Browser, the pref changes here are only temporary. The +// meek-http-helper profile has a user.js file that sets a default blackhole +// proxy, as a safety feature in case something goes wrong running the headless +// browser. +// +// We only care to set proxyDNS here, but must additionally set proxyType until +// Firefox 63 because of a bug. +// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/… +// https://bugzilla.mozilla.org/show_bug.cgi?id=1487121 +browser.proxy.settings.set({value: {proxyType: "system", proxyDNS: false}}); + // Connect to our native process. let port = browser.runtime.connectNative("meek.http.helper");

1 0