September 2019 - tor-commits - lists.torproject.org

[tor-browser/tor-browser-68.1.0esr-9.0-2] Bug 1578075 - Increase stack size of paint threads on macOS Catalina to 2MB. r=jrmuizel
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit 7813cebd9f79de65d16e262ce79b675e7ec132c3 Author: Lee Salzman <lsalzman(a)mozilla.com> Date: Thu Sep 26 02:31:15 2019 +0000 Bug 1578075 - Increase stack size of paint threads on macOS Catalina to 2MB. r=jrmuizel Still getting some crash reports on nightly with a 1MB stack. Let's try one more time with 2MB just to see if we can eliminate those. If this fails, then we may need to consider more drastic approaches like disabling OMTP in this case. Differential Revision: https://phabricator.services.mozilla.com/D47080 --HG-- extra : moz-landing-system : lando --- gfx/layers/PaintThread.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gfx/layers/PaintThread.cpp b/gfx/layers/PaintThread.cpp index 400e2d342b2f..40ba4d3954b1 100644 --- a/gfx/layers/PaintThread.cpp +++ b/gfx/layers/PaintThread.cpp @@ -79,7 +79,7 @@ static uint32_t GetPaintThreadStackSize() { #else // Workaround bug 1578075 by increasing the stack size of paint threads if (nsCocoaFeatures::OnCatalinaOrLater()) { - static const uint32_t kCatalinaPaintThreadStackSize = 1024 * 1024; + static const uint32_t kCatalinaPaintThreadStackSize = 2 * 1024 * 1024; static_assert(kCatalinaPaintThreadStackSize >= nsIThreadManager::DEFAULT_STACK_SIZE, "update default stack size of paint " "workers");

1 0

[tor-browser/tor-browser-68.1.0esr-9.0-2] Bug 1578075 - Increase stack size of paint thread/workers on OSX Catalina or higher to workaround crash from recursion in CoreText. r=jrmuizel, a=RyanVM
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit 632458daf11b954319219ea62e259f50b4fd9ed3 Author: Ryan Hunt <rhunt(a)eqrion.net> Date: Tue Sep 10 15:20:34 2019 +0000 Bug 1578075 - Increase stack size of paint thread/workers on OSX Catalina or higher to workaround crash from recursion in CoreText. r=jrmuizel, a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D45370 --HG-- extra : source : cd0ea6dafa051426035949cfbbfdeb04c1c05661 extra : intermediate-source : ffefc518e569164c2c2e62258504bdc69d111bb3 --- gfx/layers/PaintThread.cpp | 24 +++++++++++++++++++++++- widget/cocoa/nsCocoaFeatures.h | 1 + widget/cocoa/nsCocoaFeatures.mm | 5 +++++ 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/gfx/layers/PaintThread.cpp b/gfx/layers/PaintThread.cpp index 3ee7c86760ea..c35bf472d682 100644 --- a/gfx/layers/PaintThread.cpp +++ b/gfx/layers/PaintThread.cpp @@ -19,7 +19,11 @@ #include "mozilla/Preferences.h" #include "mozilla/SharedThreadPool.h" #include "mozilla/SyncRunnable.h" +#ifdef XP_MACOSX +#include "nsCocoaFeatures.h" +#endif #include "nsIPropertyBag2.h" +#include "nsIThreadManager.h" #include "nsServiceManagerUtils.h" #include "prsystem.h" @@ -69,11 +73,28 @@ void PaintThread::Start() { } } +static uint32_t GetPaintThreadStackSize() { +#ifndef XP_MACOSX + return nsIThreadManager::DEFAULT_STACK_SIZE; +#else + // Workaround bug 1578075 by increasing the stack size of paint threads + if (nsCocoaFeatures::OnCatalinaOrLater()) { + static const uint32_t kCatalinaPaintThreadStackSize = 512 * 1024; + static_assert(kCatalinaPaintThreadStackSize >= nsIThreadManager::DEFAULT_STACK_SIZE, + "update default stack size of paint " + "workers"); + return kCatalinaPaintThreadStackSize; + } + return nsIThreadManager::DEFAULT_STACK_SIZE; +#endif +} + bool PaintThread::Init() { MOZ_ASSERT(NS_IsMainThread()); RefPtr<nsIThread> thread; - nsresult rv = NS_NewNamedThread("PaintThread", getter_AddRefs(thread)); + nsresult rv = NS_NewNamedThread("PaintThread", getter_AddRefs(thread), + nullptr, GetPaintThreadStackSize()); if (NS_FAILED(rv)) { return false; } @@ -102,6 +123,7 @@ void PaintThread::InitPaintWorkers() { if (count != 1) { mPaintWorkers = SharedThreadPool::Get(NS_LITERAL_CSTRING("PaintWorker"), count); + mPaintWorkers->SetThreadStackSize(GetPaintThreadStackSize()); } } diff --git a/widget/cocoa/nsCocoaFeatures.h b/widget/cocoa/nsCocoaFeatures.h index a4581c4d3195..0cc5a2d5c165 100644 --- a/widget/cocoa/nsCocoaFeatures.h +++ b/widget/cocoa/nsCocoaFeatures.h @@ -24,6 +24,7 @@ class nsCocoaFeatures { static bool OnSierraOrLater(); static bool OnHighSierraOrLater(); static bool OnMojaveOrLater(); + static bool OnCatalinaOrLater(); static bool IsAtLeastVersion(int32_t aMajor, int32_t aMinor, int32_t aBugFix = 0); diff --git a/widget/cocoa/nsCocoaFeatures.mm b/widget/cocoa/nsCocoaFeatures.mm index 77bd3507e35f..41ca60e3b721 100644 --- a/widget/cocoa/nsCocoaFeatures.mm +++ b/widget/cocoa/nsCocoaFeatures.mm @@ -21,6 +21,7 @@ #define MAC_OS_X_VERSION_10_12_HEX 0x000010C0 #define MAC_OS_X_VERSION_10_13_HEX 0x000010D0 #define MAC_OS_X_VERSION_10_14_HEX 0x000010E0 +#define MAC_OS_X_VERSION_10_15_HEX 0x000010F0 #include "nsCocoaFeatures.h" #include "nsCocoaUtils.h" @@ -165,6 +166,10 @@ bool Gecko_OnHighSierraOrLater() { return nsCocoaFeatures::OnHighSierraOrLater() return (OSXVersion() >= MAC_OS_X_VERSION_10_14_HEX); } +/* static */ bool nsCocoaFeatures::OnCatalinaOrLater() { + return (OSXVersion() >= MAC_OS_X_VERSION_10_15_HEX); +} + /* static */ bool nsCocoaFeatures::IsAtLeastVersion(int32_t aMajor, int32_t aMinor, int32_t aBugFix) { return OSXVersion() >= GetVersion(aMajor, aMinor, aBugFix);

1 0

[tor-browser-build/master] Merge branch 'bug_27493'
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit ec79824470dcd6815ffd903c8c9974808859f9e5 Merge: 74f1468 e361790 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Sep 26 19:38:08 2019 +0000 Merge branch 'bug_27493' projects/firefox/mozconfig-android-aarch64 | 1 + projects/firefox/mozconfig-android-armv7 | 1 + projects/firefox/mozconfig-android-x86 | 1 + projects/firefox/mozconfig-linux-i686 | 4 ---- projects/firefox/mozconfig-linux-x86_64 | 4 ---- projects/firefox/mozconfig-osx-x86_64 | 3 --- projects/firefox/mozconfig-windows-i686 | 2 -- projects/firefox/mozconfig-windows-x86_64 | 2 -- 8 files changed, 3 insertions(+), 15 deletions(-) diff --cc projects/firefox/mozconfig-linux-i686 index 0a05864,da6cddf..95d14c1 --- a/projects/firefox/mozconfig-linux-i686 +++ b/projects/firefox/mozconfig-linux-i686 @@@ -18,8 -16,10 +16,7 @@@ export BINDGEN_CFLAGS='--gcc-toolchain= ac_add_options --target=i686-linux-gnu -# XXX: gold and lld break when linking libxul, resort to bfd -ac_add_options --enable-linker=bfd - ac_add_options --enable-optimize - #ac_add_options --disable-optimize ac_add_options --enable-official-branding # Let's support GTK3 for ESR60 @@@ -36,7 -38,3 +33,6 @@@ ac_add_options --disable-webrt # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --enable-proxy-bypass-protection - #ac_add_options --disable-ctypes + +# Bug 31448: ld.gold fails if we don't disable debug-symbols +ac_add_options --disable-debug-symbols diff --cc projects/firefox/mozconfig-windows-i686 index eaa704f,86e86e7..60cf1c1 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@@ -19,11 -19,12 +19,9 @@@ ac_add_options --with-toolchain-prefix= ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" - mk_add_options MOZILLA_OFFICIAL=1 export MOZILLA_OFFICIAL=1 - mk_add_options BUILD_OFFICIAL=1 ac_add_options --disable-debug -# Until we build on a 64bit host we need to hack around linker errors due to -# memory constraints -ac_add_options --disable-debug-symbols ac_add_options --enable-optimize ac_add_options --enable-strip ac_add_options --enable-official-branding

1 0

[tor-browser-build/master] Bug 27493: Clean up mozconfig options
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit e361790e2540af786386b6a13ac9477d82267db7 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Sep 3 11:38:14 2019 +0000 Bug 27493: Clean up mozconfig options --- projects/firefox/mozconfig-android-aarch64 | 1 + projects/firefox/mozconfig-android-armv7 | 1 + projects/firefox/mozconfig-android-x86 | 1 + projects/firefox/mozconfig-linux-i686 | 4 ---- projects/firefox/mozconfig-linux-x86_64 | 4 ---- projects/firefox/mozconfig-osx-x86_64 | 3 --- projects/firefox/mozconfig-windows-i686 | 2 -- projects/firefox/mozconfig-windows-x86_64 | 2 -- 8 files changed, 3 insertions(+), 15 deletions(-) diff --git a/projects/firefox/mozconfig-android-aarch64 b/projects/firefox/mozconfig-android-aarch64 index f5c1474..368ba6f 100644 --- a/projects/firefox/mozconfig-android-aarch64 +++ b/projects/firefox/mozconfig-android-aarch64 @@ -42,3 +42,4 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc ac_add_options --without-google-play-services +ac_add_options --enable-proxy-bypass-protection diff --git a/projects/firefox/mozconfig-android-armv7 b/projects/firefox/mozconfig-android-armv7 index 75e1d78..35eac27 100644 --- a/projects/firefox/mozconfig-android-armv7 +++ b/projects/firefox/mozconfig-android-armv7 @@ -42,3 +42,4 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc ac_add_options --without-google-play-services +ac_add_options --enable-proxy-bypass-protection diff --git a/projects/firefox/mozconfig-android-x86 b/projects/firefox/mozconfig-android-x86 index be1efd6..8447347 100644 --- a/projects/firefox/mozconfig-android-x86 +++ b/projects/firefox/mozconfig-android-x86 @@ -42,3 +42,4 @@ ac_add_options --disable-crashreporter ac_add_options --disable-webrtc ac_add_options --without-google-play-services +ac_add_options --enable-proxy-bypass-protection diff --git a/projects/firefox/mozconfig-linux-i686 b/projects/firefox/mozconfig-linux-i686 index c8f19a4..da6cddf 100755 --- a/projects/firefox/mozconfig-linux-i686 +++ b/projects/firefox/mozconfig-linux-i686 @@ -2,9 +2,7 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" -mk_add_options MOZILLA_OFFICIAL=1 export MOZILLA_OFFICIAL=1 -mk_add_options BUILD_OFFICIAL=1 # We want to build with clang now and point to the GCC toolchain until #29041 is # fixed. We explicitly need to define the host compiler as well as for some @@ -22,7 +20,6 @@ ac_add_options --target=i686-linux-gnu ac_add_options --enable-linker=bfd ac_add_options --enable-optimize -#ac_add_options --disable-optimize ac_add_options --enable-official-branding # Let's support GTK3 for ESR60 @@ -41,4 +38,3 @@ ac_add_options --disable-webrtc # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --enable-proxy-bypass-protection -#ac_add_options --disable-ctypes diff --git a/projects/firefox/mozconfig-linux-x86_64 b/projects/firefox/mozconfig-linux-x86_64 index 12f1b28..e0a764f 100755 --- a/projects/firefox/mozconfig-linux-x86_64 +++ b/projects/firefox/mozconfig-linux-x86_64 @@ -2,9 +2,7 @@ mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-@CONFIG_GUESS@ mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" -mk_add_options MOZILLA_OFFICIAL=1 export MOZILLA_OFFICIAL=1 -mk_add_options BUILD_OFFICIAL=1 # We want to build with clang now and point to the GCC toolchain until #29041 is # fixed. We explicitly need to define the host compiler as well as for some @@ -17,7 +15,6 @@ HOST_CXX=$CXX export BINDGEN_CFLAGS='--gcc-toolchain=/var/tmp/dist/gcc' ac_add_options --enable-optimize -#ac_add_options --disable-optimize ac_add_options --enable-official-branding # Let's support GTK3 for ESR60 @@ -36,4 +33,3 @@ ac_add_options --disable-webrtc # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --enable-proxy-bypass-protection -#ac_add_options --disable-ctypes diff --git a/projects/firefox/mozconfig-osx-x86_64 b/projects/firefox/mozconfig-osx-x86_64 index 07dd023..29e6617 100644 --- a/projects/firefox/mozconfig-osx-x86_64 +++ b/projects/firefox/mozconfig-osx-x86_64 @@ -27,9 +27,7 @@ ac_add_options --with-macos-private-frameworks=$CROSS_PRIVATE_FRAMEWORKS mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-macos mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" -mk_add_options MOZILLA_OFFICIAL=1 export MOZILLA_OFFICIAL=1 -mk_add_options BUILD_OFFICIAL=1 ac_add_options --enable-application=browser ac_add_options --enable-strip @@ -48,4 +46,3 @@ ac_add_options --disable-tests # Let's make sure no preference is enabling either Adobe's or Google's CDM. ac_add_options --disable-eme ac_add_options --enable-proxy-bypass-protection -# ac_add_options --disable-ctypes diff --git a/projects/firefox/mozconfig-windows-i686 b/projects/firefox/mozconfig-windows-i686 index 5538bc1..86e86e7 100644 --- a/projects/firefox/mozconfig-windows-i686 +++ b/projects/firefox/mozconfig-windows-i686 @@ -19,9 +19,7 @@ ac_add_options --with-toolchain-prefix=i686-w64-mingw32- ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" -mk_add_options MOZILLA_OFFICIAL=1 export MOZILLA_OFFICIAL=1 -mk_add_options BUILD_OFFICIAL=1 ac_add_options --disable-debug # Until we build on a 64bit host we need to hack around linker errors due to diff --git a/projects/firefox/mozconfig-windows-x86_64 b/projects/firefox/mozconfig-windows-x86_64 index c95525b..2a128ae 100644 --- a/projects/firefox/mozconfig-windows-x86_64 +++ b/projects/firefox/mozconfig-windows-x86_64 @@ -19,9 +19,7 @@ ac_add_options --with-toolchain-prefix=x86_64-w64-mingw32- ac_add_options --enable-default-toolkit=cairo-windows mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-mingw mk_add_options MOZ_APP_DISPLAYNAME="Tor Browser" -mk_add_options MOZILLA_OFFICIAL=1 export MOZILLA_OFFICIAL=1 -mk_add_options BUILD_OFFICIAL=1 ac_add_options --disable-debug ac_add_options --enable-optimize

1 0

[tor-browser-build/master] Bug 31844: Use DESTDIR instead of --prefix when building OpenSSL
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit abdfbfdb3f4122300c3f3f5e745af1c74a559102 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Sep 25 12:54:00 2019 +0200 Bug 31844: Use DESTDIR instead of --prefix when building OpenSSL This is fixing CVE-2019-1552: http://cve.circl.lu/cve/CVE-2019-1552 In oder to avoid changing the OPENSSLDIR to a directory that might be writable on the user system, we don't set the --prefix/--openssldir option anymore and use DESTDIR to select the packaging installation directory. --- projects/openssl/build | 5 +++-- projects/openssl/config | 2 ++ projects/tor/build | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/projects/openssl/build b/projects/openssl/build index 40dc526..d53185e 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -14,10 +14,11 @@ export CC='gcc -m32' export CC="cc [% c("var/FLAGS") %]" [% END -%] export SOURCE_DATE_EPOCH='[% c("timestamp") %]' -./Configure --prefix=$distdir [% c('var/configure_opts') %] +./Configure [% c('var/configure_opts') %] make -make install +make DESTDIR="$distdir" install cd /var/tmp/dist +ln -s '[% c("var/openssldir") %]' openssl/openssl [% c('tar', { tar_src => [ project ], tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), diff --git a/projects/openssl/config b/projects/openssl/config index 27b9526..f648598 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -3,6 +3,7 @@ version: 1.1.1d filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: + openssldir: 'usr/local' container: use_container: 1 @@ -17,6 +18,7 @@ targets: var: flag_mwindows: '' configure_opts: '-shared --cross-compile-prefix=[% c("arch") %]-w64-mingw32- mingw[% IF c("var/windows-x86_64") %]64[% END %] "[% c("var/CFLAGS") %] [% c("var/LDFLAGS") %]"' + openssldir: 'Program Files[% IF c("var/windows-i686") %] (x86)[% END %]/OpenSSL' osx-x86_64: var: configure_opts: --cross-compile-prefix=x86_64-apple-darwin11- darwin64-x86_64-cc enable-ec_nistp_64_gcc_128 diff --git a/projects/tor/build b/projects/tor/build index 0705626..2d10fb3 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -30,7 +30,7 @@ tar -C /var/tmp/dist -xf [% c('input_files_by_name/libevent') %] [% END %] tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz libeventdir=/var/tmp/dist/libevent -openssldir=/var/tmp/dist/openssl +openssldir=/var/tmp/dist/openssl/openssl [% IF c("var/windows") %] [% IF c("var/nightly") %]

1 0

[tor-browser-build/master] Bug 31844: Fix unquoted paths in OpenSSL Windows build
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit 7bab743e199ea3d3ba8ca3f5ba5289609035f37c Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Sep 25 14:10:12 2019 +0200 Bug 31844: Fix unquoted paths in OpenSSL Windows build The default OPENSSLDIR on Windows builds contain spaces and parenthesis, which break the build as the unquoted path is used in several places. We fix this by escaping the spaces and parenthesis. This is fixing part of the issues mentioned in: https://github.com/openssl/openssl/issues/9520 --- projects/openssl/build | 3 +++ projects/openssl/config | 2 ++ projects/openssl/escape-openssldir.patch | 28 ++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+) diff --git a/projects/openssl/build b/projects/openssl/build index d53185e..3ee3571 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -13,6 +13,9 @@ export CC='gcc -m32' ln -s $clangdir/bin/clang $clangdir/bin/x86_64-apple-darwin11-cc export CC="cc [% c("var/FLAGS") %]" [% END -%] +[% IF c("var/windows") -%] + patch -p1 < $rootdir/escape-openssldir.patch +[% END -%] export SOURCE_DATE_EPOCH='[% c("timestamp") %]' ./Configure [% c('var/configure_opts') %] make diff --git a/projects/openssl/config b/projects/openssl/config index f648598..2fc46ea 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -29,3 +29,5 @@ input_files: project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' sha256sum: 1e3a91bc1f9dfce01af26026f856e064eab4c8ee0a8f457b5ae30b40b8b711f2 + - filename: escape-openssldir.patch + enable: '[% c("var/windows") %]' diff --git a/projects/openssl/escape-openssldir.patch b/projects/openssl/escape-openssldir.patch new file mode 100644 index 0000000..684a179 --- /dev/null +++ b/projects/openssl/escape-openssldir.patch @@ -0,0 +1,28 @@ +diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl +index 7db7578a4b..e5ba20b589 100644 +--- a/Configurations/unix-Makefile.tmpl ++++ b/Configurations/unix-Makefile.tmpl +@@ -215,6 +215,7 @@ INSTALLTOP_dev={- # $prefix is used in the OPENSSLDIR perl snippet + $prefix_dev -} + INSTALLTOP_dir={- my $x = File::Spec::Win32->canonpath($prefix_dir); + $x =~ s|\\|/|g; ++ $x =~ s/([ ])/\\$1/g; + $x -} + OPENSSLDIR_dev={- # + # The logic here is that if no --openssldir was given, +@@ -239,6 +240,7 @@ OPENSSLDIR_dev={- # + $openssldir_dev -} + OPENSSLDIR_dir={- my $x = File::Spec::Win32->canonpath($openssldir_dir); + $x =~ s|\\|/|g; ++ $x =~ s/([ ])/\\$1/g; + $x -} + LIBDIR={- our $libdir = $config{libdir} || "lib"; + File::Spec::Win32->file_name_is_absolute($libdir) ? "" : $libdir -} +@@ -253,6 +255,7 @@ ENGINESDIR_dev={- use File::Spec::Win32; + $enginesdir_dev -} + ENGINESDIR_dir={- my $x = File::Spec::Win32->canonpath($enginesdir_dir); + $x =~ s|\\|/|g; ++ $x =~ s/([ ])/\\$1/g; + $x -} + # In a Windows environment, $(DESTDIR) is harder to contatenate with other + # directory variables, because both may contain devices. What we do here is

1 0

[tor-browser-build/master] Bug 31844: Update openssl linux Configure targets
by gk＠torproject.org 27 Sep '19

27 Sep '19

commit 74f146865135f2a655c936164ffa2f5c25a4d05e Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Sep 26 20:35:07 2019 +0200 Bug 31844: Update openssl linux Configure targets With the linux-generic64 target the build is broken if we don't add the no-asm option: https://github.com/openssl/openssl/issues/9839 We fix that by switching to the linux-x86_64 target. At the same time we also switch the linux-generic32 target to linux-x86. --- projects/openssl/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/openssl/config b/projects/openssl/config index 2fc46ea..0a60c24 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -10,10 +10,10 @@ var: targets: linux-x86_64: var: - configure_opts: -shared enable-ec_nistp_64_gcc_128 linux-generic64 + configure_opts: -shared enable-ec_nistp_64_gcc_128 linux-x86_64 linux-i686: var: - configure_opts: -shared linux-generic32 + configure_opts: -shared linux-x86 windows: var: flag_mwindows: ''

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 27 Sep '19

27 Sep '19

commit 393c1d47fda217875e2e3bcfdea0bf4104913864 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Sep 26 19:19:50 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+fa.po | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contents+fa.po b/contents+fa.po index c8c1307ff..7312281f2 100644 --- a/contents+fa.po +++ b/contents+fa.po @@ -250,7 +250,7 @@ msgstr "" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.title) msgid "DOWNLOADING" -msgstr "در حال دانلود" +msgstr "دانلود مرورگر تور" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.description) @@ -297,7 +297,7 @@ msgstr "" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) msgid "##### MIRRORS" -msgstr "##### آینه‌ها" +msgstr "##### سایت های جایگزین" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) @@ -331,7 +331,7 @@ msgstr "" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) msgid "###### TO USE GETTOR VIA EMAIL:" -msgstr "##### برای استفاده GetTor از طریق ایمیل:" +msgstr "##### برای استفاده GETTOR از طریق ایمیل:" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body)

1 0

[tor/master] Merge remote-tracking branch 'tor-github/pr/1308'
by nickm＠torproject.org 27 Sep '19

27 Sep '19

commit ffd857bbe125b6be442555079a15c896c0317c91 Merge: 40a22fb70 3e4526059 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 26 14:36:37 2019 -0400 Merge remote-tracking branch 'tor-github/pr/1308' changes/ticket31589 | 2 ++ scripts/maint/practracker/exceptions.txt | 2 +- src/feature/hs/hs_descriptor.c | 21 ++++++++++++--------- src/feature/hs/hs_descriptor.h | 5 ++--- src/test/fuzz/fuzz_hsdescv3.c | 11 ++++++++--- 5 files changed, 25 insertions(+), 16 deletions(-)

1 0

[tor/master] fix: Ticket #31589
by nickm＠torproject.org 27 Sep '19

27 Sep '19

commit 3e45260594d3b1c84a88e509f138dab4590903fd Author: AmreshVenugopal <amresh.venugopal(a)gmail.com> Date: Tue Sep 10 01:48:14 2019 +0530 fix: Ticket #31589 - The function `decrypt_desc_layer` has a cleaner interface. - `is_superencrypted_layer` changed from `int` -> `bool` [ticket details](https://trac.torproject.org/projects/tor/ticket/31589) add(changes/*): changes file fix(src/features/hs): is_superencrypted changed from `int` -> `bool` fix(changes/ticket31589): header add(changes/ticket31589): subsystem(onion services) to change --- changes/ticket31589 | 2 ++ scripts/maint/practracker/exceptions.txt | 2 +- src/feature/hs/hs_descriptor.c | 21 ++++++++++++--------- src/feature/hs/hs_descriptor.h | 5 ++--- src/test/fuzz/fuzz_hsdescv3.c | 11 ++++++++--- 5 files changed, 25 insertions(+), 16 deletions(-) diff --git a/changes/ticket31589 b/changes/ticket31589 new file mode 100644 index 000000000..673ab653e --- /dev/null +++ b/changes/ticket31589 @@ -0,0 +1,2 @@ + o Code simplification and refactoring (onion services): + - Interface for function `decrypt_desc_layer` cleaned up. Closes ticket 31589. diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index 4201282ba..44b22c7a2 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -244,7 +244,7 @@ problem function-size /src/feature/hs/hs_common.c:hs_get_responsible_hsdirs() 10 problem function-size /src/feature/hs/hs_config.c:config_service_v3() 107 problem function-size /src/feature/hs/hs_config.c:config_generic_service() 138 problem function-size /src/feature/hs/hs_descriptor.c:desc_encode_v3() 101 -problem function-size /src/feature/hs/hs_descriptor.c:decrypt_desc_layer() 105 +problem function-size /src/feature/hs/hs_descriptor.c:decrypt_desc_layer() 111 problem function-size /src/feature/hs/hs_descriptor.c:decode_introduction_point() 122 problem function-size /src/feature/hs/hs_descriptor.c:desc_decode_superencrypted_v3() 107 problem function-size /src/feature/hs/hs_descriptor.c:desc_decode_encrypted_v3() 107 diff --git a/src/feature/hs/hs_descriptor.c b/src/feature/hs/hs_descriptor.c index a8796c002..924ab3115 100644 --- a/src/feature/hs/hs_descriptor.c +++ b/src/feature/hs/hs_descriptor.c @@ -1477,10 +1477,8 @@ decrypt_descriptor_cookie(const hs_descriptor_t *desc, */ MOCK_IMPL(STATIC size_t, decrypt_desc_layer,(const hs_descriptor_t *desc, - const uint8_t *encrypted_blob, - size_t encrypted_blob_size, const uint8_t *descriptor_cookie, - int is_superencrypted_layer, + bool is_superencrypted_layer, char **decrypted_out)) { uint8_t *decrypted = NULL; @@ -1490,6 +1488,12 @@ decrypt_desc_layer,(const hs_descriptor_t *desc, uint8_t mac_key[DIGEST256_LEN], our_mac[DIGEST256_LEN]; const uint8_t *salt, *encrypted, *desc_mac; size_t encrypted_len, result_len = 0; + const uint8_t *encrypted_blob = (is_superencrypted_layer) + ? desc->plaintext_data.superencrypted_blob + : desc->superencrypted_data.encrypted_blob; + size_t encrypted_blob_size = (is_superencrypted_layer) + ? desc->plaintext_data.superencrypted_blob_size + : desc->superencrypted_data.encrypted_blob_size; tor_assert(decrypted_out); tor_assert(desc); @@ -1603,9 +1607,8 @@ desc_decrypt_superencrypted(const hs_descriptor_t *desc, char **decrypted_out) tor_assert(decrypted_out); superencrypted_len = decrypt_desc_layer(desc, - desc->plaintext_data.superencrypted_blob, - desc->plaintext_data.superencrypted_blob_size, - NULL, 1, &superencrypted_plaintext); + NULL, + true, &superencrypted_plaintext); if (!superencrypted_len) { log_warn(LD_REND, "Decrypting superencrypted desc failed."); @@ -1654,9 +1657,9 @@ desc_decrypt_encrypted(const hs_descriptor_t *desc, } encrypted_len = decrypt_desc_layer(desc, - desc->superencrypted_data.encrypted_blob, - desc->superencrypted_data.encrypted_blob_size, - descriptor_cookie, 0, &encrypted_plaintext); + descriptor_cookie, + false, &encrypted_plaintext); + if (!encrypted_len) { goto err; } diff --git a/src/feature/hs/hs_descriptor.h b/src/feature/hs/hs_descriptor.h index dbe0cb1c9..0a843f4f3 100644 --- a/src/feature/hs/hs_descriptor.h +++ b/src/feature/hs/hs_descriptor.h @@ -276,6 +276,7 @@ void hs_desc_authorized_client_free_(hs_desc_authorized_client_t *client); hs_desc_authorized_client_free_, (client)) hs_desc_authorized_client_t *hs_desc_build_fake_authorized_client(void); + void hs_desc_build_authorized_client(const uint8_t *subcredential, const curve25519_public_key_t * client_auth_pk, @@ -308,10 +309,8 @@ STATIC int desc_sig_is_valid(const char *b64_sig, const char *encoded_desc, size_t encoded_len); MOCK_DECL(STATIC size_t, decrypt_desc_layer,(const hs_descriptor_t *desc, - const uint8_t *encrypted_blob, - size_t encrypted_blob_size, const uint8_t *descriptor_cookie, - int is_superencrypted_layer, + bool is_superencrypted_layer, char **decrypted_out)); #endif /* defined(HS_DESCRIPTOR_PRIVATE) */ diff --git a/src/test/fuzz/fuzz_hsdescv3.c b/src/test/fuzz/fuzz_hsdescv3.c index 2cbd65589..9d4a6dbb5 100644 --- a/src/test/fuzz/fuzz_hsdescv3.c +++ b/src/test/fuzz/fuzz_hsdescv3.c @@ -35,16 +35,21 @@ mock_rsa_ed25519_crosscert_check(const uint8_t *crosscert, static size_t mock_decrypt_desc_layer(const hs_descriptor_t *desc, - const uint8_t *encrypted_blob, - size_t encrypted_blob_size, const uint8_t *descriptor_cookie, - int is_superencrypted_layer, + bool is_superencrypted_layer, char **decrypted_out) { (void)is_superencrypted_layer; (void)desc; (void)descriptor_cookie; const size_t overhead = HS_DESC_ENCRYPTED_SALT_LEN + DIGEST256_LEN; + const uint8_t *encrypted_blob = (is_superencrypted_layer) + ? desc->plaintext_data.superencrypted_blob + : desc->superencrypted_data.encrypted_blob; + size_t encrypted_blob_size = (is_superencrypted_layer) + ? desc->plaintext_data.superencrypted_blob_size + : desc->superencrypted_data.encrypted_blob_size; + if (encrypted_blob_size < overhead) return 0; *decrypted_out = tor_memdup_nulterm(

1 0