January 2021 - tor-commits - lists.torproject.org

[tor-browser-build/master] Merge remote-tracking branch 'gitlab/merge-requests/202'
by gk＠torproject.org 27 Jan '21

27 Jan '21

commit 39b14d15d26f7b56e13c48c02f7fda1cbd6703eb Merge: 79f54e6 6d4081c Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 27 11:17:57 2021 +0000 Merge remote-tracking branch 'gitlab/merge-requests/202' tools/update-responses/README.md | 8 ++++---- tools/update-responses/update_responses | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-)

1 0

[tor-browser-build/master] Bug 33274: Use YAML::XS instead of YAML in update_responses
by gk＠torproject.org 27 Jan '21

27 Jan '21

commit 6d4081c0a5d5f7094203c208df5e633f9dada54c Author: Nicolas Vigier <boklm(a)torproject.org> Date: Sun Jan 24 22:04:05 2021 +0100 Bug 33274: Use YAML::XS instead of YAML in update_responses --- tools/update-responses/README.md | 8 ++++---- tools/update-responses/update_responses | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/update-responses/README.md b/tools/update-responses/README.md index 5209ed5..8326983 100644 --- a/tools/update-… [View More]

1 0

[tor-browser-spec/master] Bug 40012: Add FF85 audit
by gk＠torproject.org 27 Jan '21

27 Jan '21

commit b72a5306255a41b46a6b86d9189e3833cf35019e Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Jan 19 03:15:14 2021 +0000 Bug 40012: Add FF85 audit --- audits/FF85_NETWORK_AUDIT | 159 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 159 insertions(+) diff --git a/audits/FF85_NETWORK_AUDIT b/audits/FF85_NETWORK_AUDIT new file mode 100644 index 0000000..17ad0db --- /dev/null +++ b/audits/FF85_NETWORK_AUDIT @@ -0,0 +1,159 @@ +`git diff … [View More]2a47450172493d64c311336281c1860802b3c9fc 5a2e34d5821fa203454eb9a8b12d7749a7c50d00` +and then go over all the changes containing the +below mentioned potentially dangerous calls and features. Grep the diff for +the following strings and examine surrounding usage. + +=============== Native DNS Portion ============= + +PR_GetHostByName +PR_GetIPNodeByName +PR_GetAddrInfoByName +PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.) + +# FF85: Nothing new + +MDNS +TRR (DNS Trusted Recursive Resolver) +Direct Paths to DNS resolution: +nsDNSService::Resolve +nsDNSService::AsyncResolve +nsHostResolver::ResolveHost + +# FF85: +# Bug 1667743: +# - Deleting unused esni code +# - Review Result: Safe + +# Bug 1634065: +# - ensure nsIDNSService is only created on the main thread +# - Review Result: Safe + +# Bug 1678614 +# - Don't retry with native DNS if it's trr only mode +# - Review Result: Safe + +# Bug 1670982 +# - Make the bitfields in nsHostResolver atomic +# - Review Result: Safe + +============ Misc Socket Portion ============== + +SOCK_ +SOCKET_ +_SOCKET + +# FF85: +# - Bug 1675491 +# - Count number of bytes send and received over a socket +# - Review Result: Safe + +UDPSocket +TCPSocket + PR_NewTCPSocket + AsyncTCPSocket + +# FF85: Nothing of interest + + +Misc PR_Socket + +# FF85: Nothing new + +=========== Misc XPCOM Portion ================ + +Misc XPCOM (including commands for pre-diff review approach) + *SocketProvider + grep -R udp-socket . + grep -R tcp-socket . + grep for tcpsocket + grep -R "NS_" | grep SOCKET | grep "_C" + grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket + +# FF85: +# Bug 1673931: +# - Resolve Document/Element cycle, no harm +# - Review Result: Safe + +# Bug 1626278 +# - Shutdown MediaTransportHandlerSTS on STS shutdown +# - Review Result: Safe + +# Bug 1677759 +# - Mark STUN/TURN client contexts failed when we encounter a socket read/write failure for TCP +# - Review Result: Safe + +============ Rust Portion ================ + +Rust + - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool? + - Check for new sendmsg and recvmsg usage + +# FF85: +# Bug 1662868 +# - Create a Viaduct-based Glean uploader +# - Review Result: Safe + +============ Android Portion ============= + +Android Java calls + - URLConnection + - XXX: getInputStream? other methods? + - HttpURLConnection + - UrlConnectionDownloader + - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls) + - grep -n openConnection\( mobile/android/thirdparty/ + - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/ + - java.net + - javax.net + - ch.boye.httpclientandroidlib.conn.* (esp ssl) + - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl) + - Sudden appearance of thirdparty libs: + - OkHttp + - Retrofit + - Glide + - com.amitshekhar.android + - IntentHelper + - openUriExternal (can come from GeckoAppShell too) + - getHandlersForMimeType + - getHandlersForURL + - getHandlersForIntent + - android.content.Intent - too common; instead find launch methods: + - startActivity + - startActivities + - sendBroadcast + - sendOrderedBroadcast + - startService + - bindService + - android.app.PendingIntent + - android.app.DownloadManager + - ActivityHandlerHelper.startIntentAndCatch + +# FF85: Nothing new (using `java_audit.sh`) + +============ Application Services Portion ============= + +Start: 6a234c2b1e1972f11e585551d4cf2e40e84bf16f # v67.0.0 +End: 4cc798c8cd8a1e38ce88e0bb22a05692be63b164 # v67.2.0 + +# FF85: Nothing related to networking in Java/Koltlin/Rust code (using `java_audit.sh`) + +============ Android Components Portion ============= + +Start: 2095f1a5d0ed42c3680aa8582934ea2739ff02c9 # v67.0.17 +End: 21ce9abdda0bc4001a72835fbbe7d71026ac0e66 # v70.0.16 + +# FF85: Zero new usage found of known proxy-bypass APIs (using `java_audit.sh`) + +============ Fenix Portion ============= + +Start: 2d1e15692ebe5ec697abdeacaa332f25ce406a3b # v84.1.4 +End: 24995d51a12d8e0bb10166f9f286c68d23b84a6a # v85.1.0 + +# FF85: Nothing new (using `java_audit.sh`) + +============ Regression/Prior Vuln Review ========= + +Review proxy bypass bugs; check for new vectors to look for: + - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy + - Look for new features like these. Especially external app launch vectors + [View Less]

1 0

[tpo/master] Add new Tor Browser version 10.0.9
by sysrqb＠torproject.org 27 Jan '21

27 Jan '21

commit 188292053f3f92b0c24a4ab1f6a672aeb08988f0 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jan 27 04:52:16 2021 +0000 Add new Tor Browser version 10.0.9 --- databags/versions.ini | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/databags/versions.ini b/databags/versions.ini index 2c565127..72546801 100644 --- a/databags/versions.ini +++ b/databags/versions.ini @@ -1,9 +1,9 @@ [torbrowser-stable] -version = 10.0.8 +version = 10.0.9 win32 = 0.… [View More]

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gkgl/bug_40188_v2'
by sysrqb＠torproject.org 26 Jan '21

26 Jan '21

commit 79f54e66f8f2d181276a5b8e39867edde7dcbbb4 Merge: 47ab0aa a933946 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Jan 26 23:40:39 2021 +0000 Merge remote-tracking branch 'gkgl/bug_40188_v2' ...01-Revert-Bug-30318-Add-snowflake-support.patch | 78 ++++++++++++++++++++++ projects/tor-android-service/build | 4 +- projects/tor-android-service/config | 2 + projects/tor-onion-proxy-library/build | 29 +++++--- projects/tor-… [View More]

1 0

[tor-browser-build/master] Bug 40188: Build and ship snowflake only if it is enabled
by sysrqb＠torproject.org 26 Jan '21

26 Jan '21

commit a933946d441b87255de74271480a24332f5498c3 Author: Georg Koppen <gk(a)torproject.org> Date: Sat Jan 16 21:05:38 2021 +0000 Bug 40188: Build and ship snowflake only if it is enabled --- ...01-Revert-Bug-30318-Add-snowflake-support.patch | 78 ++++++++++++++++++++++ projects/tor-android-service/build | 4 +- projects/tor-android-service/config | 2 + projects/tor-onion-proxy-library/build | 29 +++++--- projects/tor-onion-proxy-… [View More]library/config | 5 ++ 5 files changed, 108 insertions(+), 10 deletions(-) diff --git a/projects/tor-android-service/0001-Revert-Bug-30318-Add-snowflake-support.patch b/projects/tor-android-service/0001-Revert-Bug-30318-Add-snowflake-support.patch new file mode 100644 index 0000000..b7be2ae --- /dev/null +++ b/projects/tor-android-service/0001-Revert-Bug-30318-Add-snowflake-support.patch @@ -0,0 +1,78 @@ +From f3cf622e537a1283b821b3f3ce8e396a01bcb84b Mon Sep 17 00:00:00 2001 +From: Georg Koppen <gk(a)torproject.org> +Date: Sat, 16 Jan 2021 20:56:30 +0000 +Subject: [PATCH] Revert "Bug 30318: Add snowflake support" + +This reverts commit ecc251d0a73f7e2034a271efd28036a0108b8688. + +diff --git a/service/src/main/assets/common/bridges.txt b/service/src/main/assets/common/bridges.txt +index 1525eba..fe37735 100644 +--- a/service/src/main/assets/common/bridges.txt ++++ b/service/src/main/assets/common/bridges.txt +@@ -13,5 +13,3 @@ obfs4 45.145.95.6:27015 C5B7CD6946FF10C5B3E89691A7D3F2C122D2117C cert=TD7PbUO0/0 + obfs4 [2a0c:4d80:42:702::1]:27015 C5B7CD6946FF10C5B3E89691A7D3F2C122D2117C cert=TD7PbUO0/0k6xYHMPW3vJxICfkMZNdkRrb63Zhl5j9dW3iRGiCx0A7mPhe5T2EDzQ35+Zw iat-mode=0 + obfs4 51.222.13.177:80 5EDAC3B810E12B01F6FD8050D2FD3E277B289A08 cert=2uplIpLQ0q9+0qMFrK5pkaYRDOe460LL9WHBvatgkuRr/SL31wBOEupaMMJ6koRE6Ld0ew iat-mode=0 + meek_lite 0.0.2.0:2 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com +- +-snowflake 0.0.3.0:1 2B280B23E1107BB62ABFC40DDCC8824814F80A72 +diff --git a/service/src/main/java/org/torproject/android/service/CustomTorInstaller.java b/service/src/main/java/org/torproject/android/service/CustomTorInstaller.java +index 52bc4fe..198c981 100644 +--- a/service/src/main/java/org/torproject/android/service/CustomTorInstaller.java ++++ b/service/src/main/java/org/torproject/android/service/CustomTorInstaller.java +@@ -40,17 +40,14 @@ public class CustomTorInstaller extends TorInstaller { + @Override + public InputStream openBridgesStream() throws IOException { + /* +- BridgesList is an overloaded field, which can cause some confusion. +- The list can be: +- 1) a filter like obfs4, meek, or snowflake OR +- 2) it can be a custom bridge +- For (1), we just pass back all bridges, the filter will occur +- elsewhere in the library. +- For (2) we return the bridge list as a raw stream. +- If length is greater than 9, then we know this is a custom bridge ++ BridgesList is an overloaded field, which can cause some confusion. The list can be: ++ 1) a filter like obfs4 or meek OR 2) it can be a custom bridge ++ For (1), we just pass back all bridges, the filter will occur elsewhere in the library. ++ For (2) we return the bridge list as a raw stream ++ If length is greater than 5, then we know this is a custom bridge + */ + String userDefinedBridgeList = Prefs.getBridgesList(); +- byte bridgeType = (byte) (userDefinedBridgeList.length() > 9 ? 1 : 0); ++ byte bridgeType = (byte) (userDefinedBridgeList.length() > 5 ? 1 : 0); + // Terrible hack. Must keep in sync with topl::addBridgesFromResources. + if (bridgeType == 0) { + switch (userDefinedBridgeList) { +@@ -60,9 +57,6 @@ public class CustomTorInstaller extends TorInstaller { + case "meek": + bridgeType = 3; + break; +- case "snowflake": +- bridgeType = 4; +- break; + } + } + +diff --git a/service/src/main/java/org/torproject/android/service/TorService.java b/service/src/main/java/org/torproject/android/service/TorService.java +index f1ddcda..32d7f30 100644 +--- a/service/src/main/java/org/torproject/android/service/TorService.java ++++ b/service/src/main/java/org/torproject/android/service/TorService.java +@@ -365,12 +365,10 @@ public final class TorService extends Service implements TorServiceConstants, Or + + //Check bridges to see if we need this + File nativeDir = new File(getApplicationInfo().nativeLibraryDir); +- File pluggableTransportObfs = new File(nativeDir, "libObfs4proxy.so"); +- if(!pluggableTransportObfs.canExecute()) pluggableTransportObfs.setExecutable(true); +- File pluggableTransportSnow = new File(nativeDir, "libSnowflake.so"); +- if(!pluggableTransportSnow.canExecute()) pluggableTransportSnow.setExecutable(true); ++ File pluggableTransport = new File(nativeDir, "libObfs4proxy.so"); ++ if(!pluggableTransport.canExecute()) pluggableTransport.setExecutable(true); + +- builder.configurePluggableTransportsFromSettings(pluggableTransportObfs, pluggableTransportSnow); ++ builder.configurePluggableTransportsFromSettings(pluggableTransport); + mDataService.updateConfigBuilder(builder); + onionProxyManager.getTorInstaller().updateTorConfigCustom + (builder.asString()); +-- +2.30.0 + diff --git a/projects/tor-android-service/build b/projects/tor-android-service/build index 3989001..7efd708 100644 --- a/projects/tor-android-service/build +++ b/projects/tor-android-service/build @@ -13,7 +13,9 @@ mkdir -p /var/tmp/build $output_dir tar -C /var/tmp/build -xf [% project %]-[% c('version') %].tar.gz cd /var/tmp/build/[% project %]-[% c('version') %] - +[% IF ! c("var/snowflake") %] + patch -p1 < $rootdir/0001-Revert-Bug-30318-Add-snowflake-support.patch +[% END %] # Replace pre-packaged tor library with the latest build rm -fR service/src/main/jniLibs/* [% FOREACH arch = ['armv7', 'aarch64', 'x86', 'x86_64'] -%] diff --git a/projects/tor-android-service/config b/projects/tor-android-service/config index 81a4159..d6d2fed 100644 --- a/projects/tor-android-service/config +++ b/projects/tor-android-service/config @@ -22,6 +22,8 @@ input_files: exec: '[% INCLUDE "fetch-gradle-dependencies" %]' - project: tor-onion-proxy-library name: topl + - filename: 0001-Revert-Bug-30318-Add-snowflake-support.patch + enable: '[% ! c("var/snowflake") %]' - project: tor name: tor-armv7 target_prepend: diff --git a/projects/tor-onion-proxy-library/build b/projects/tor-onion-proxy-library/build index 7865aa7..c9b1e7a 100644 --- a/projects/tor-onion-proxy-library/build +++ b/projects/tor-onion-proxy-library/build @@ -20,31 +20,42 @@ cd /var/tmp/build/[% project %]-[% c('version') %] # build will pull down the correct android tool versions patch -p1 < $rootdir/gradle.patch patch -p1 < $rootdir/0001-Bug-33931-Filter-bridges-in-stream-by-type.patch -patch -p1 < $rootdir/0001-Bug-30318-Add-snowflake-support.patch +[% IF c("var/snowflake") %] + patch -p1 < $rootdir/0001-Bug-30318-Add-snowflake-support.patch +[% END %] [% FOREACH arch = ['armv7', 'aarch64', 'x86', 'x86_64'] -%] # Extract obfs4proxy from TorBrowser/Tor/PluggableTransports/obfs4proxy tar --strip-components=4 -xf $rootdir/[% c('input_files_by_name/obfs4-' _ arch) %] - # Extract snowflake from TorBrowser/Tor/PluggableTransports/snowflake - tar --strip-components=4 -xf $rootdir/[% c('input_files_by_name/snowflake-' _ arch) %] - + [% IF c("var/snowflake") %] + # Extract snowflake from TorBrowser/Tor/PluggableTransports/snowflake + tar --strip-components=4 -xf $rootdir/[% c('input_files_by_name/snowflake-' _ arch) %] + [% END %] # Overwrite the obfs4proxy binary provided by Pluto and add Snowflake [% IF arch == "armv7" -%] cp obfs4proxy external/pluto/bin/armeabi-v7a/ cp obfs4proxy external/pluto/bin/armeabi/ - cp snowflake-client external/pluto/bin/armeabi-v7a/ - cp snowflake-client external/pluto/bin/armeabi/ + [% IF c("var/snowflake") %] + cp snowflake-client external/pluto/bin/armeabi-v7a/ + cp snowflake-client external/pluto/bin/armeabi/ + [% END %] [% ELSIF arch == "aarch64" -%] cp obfs4proxy external/pluto/bin/arm64-v8a/ - cp snowflake-client external/pluto/bin/arm64-v8a/ + [% IF c("var/snowflake") %] + cp snowflake-client external/pluto/bin/arm64-v8a/ + [% END %] [% ELSE -%] cp obfs4proxy external/pluto/bin/[% arch %]/ - cp snowflake-client external/pluto/bin/[% arch %]/ + [% IF c("var/snowflake") %] + cp snowflake-client external/pluto/bin/[% arch %]/ + [% END %] [% END -%] rm obfs4proxy - rm snowflake-client + [% IF c("var/snowflake") %] + rm snowflake-client + [% END %] [% END -%] # Build Android Libraries and Apps diff --git a/projects/tor-onion-proxy-library/config b/projects/tor-onion-proxy-library/config index 401142c..d07c37b 100644 --- a/projects/tor-onion-proxy-library/config +++ b/projects/tor-onion-proxy-library/config @@ -39,21 +39,26 @@ input_files: name: snowflake-armv7 target_prepend: - android-armv7 + enable: '[% c("var/snowflake") %]' - project: snowflake name: snowflake-aarch64 target_prepend: - android-aarch64 + enable: '[% c("var/snowflake") %]' - project: snowflake name: snowflake-x86 target_prepend: - android-x86 + enable: '[% c("var/snowflake") %]' - project: snowflake name: snowflake-x86_64 target_prepend: - android-x86_64 + enable: '[% c("var/snowflake") %]' - filename: 'gradle-dependencies-[% c("var/gradle_dependencies_version") %]' name: gradle-dependencies exec: '[% INCLUDE "fetch-gradle-dependencies" %]' - filename: gradle.patch - filename: 0001-Bug-33931-Filter-bridges-in-stream-by-type.patch - filename: 0001-Bug-30318-Add-snowflake-support.patch + enable: '[% c("var/snowflake") %]' [View Less]

1 0

[tpo/master] Add new Tor Browser version 10.5a8
by sysrqb＠torproject.org 26 Jan '21

26 Jan '21

commit a68ac0acb1894c53cf949a47599fc71c9ce3f0af Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Jan 26 22:50:54 2021 +0000 Add new Tor Browser version 10.5a8 --- databags/versions.ini | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/databags/versions.ini b/databags/versions.ini index 3a896782..2c565127 100644 --- a/databags/versions.ini +++ b/databags/versions.ini @@ -6,10 +6,10 @@ win32 = 0.4.4.6 version = 10.0.8 [torbrowser-alpha] -version = … [View More]

1 0

[tor/master] Fix a subtle memory leak in test_exorport.c
by nickm＠torproject.org 26 Jan '21

26 Jan '21

commit 37ea6cd9eb9bc4b6c0eb4f5d9cf70b97ea43eba4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 26 16:58:27 2021 -0500 Fix a subtle memory leak in test_exorport.c This is a _subtle_ bug introduced by d1494d14, which resolved connections that was allocated in the extorport/handshake test. So how did the connection get freed? Our test was set up so that every extorport connection would get the same ext_or_id. Two connections couldn't have the … [View More]

1 0

[translation/tails-misc_release] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release
by translation＠torproject.org 26 Jan '21

26 Jan '21

commit 07b70435f827fbe4764a9e9cf321b7baa8d08ff7 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jan 26 21:46:43 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release --- he.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/he.po b/he.po index 451c287bf5..7a1581bfb8 100644 --- a/he.po +++ b/he.po @@ -11,8 +11,8 @@ # ION, 2017-2020 # Johnny Diralenzo, 2015 # Kunda, 2014 -# Omer I.S. <… [View More]

1 0

[status-site/main] Edit readme with url
by hiro＠torproject.org 26 Jan '21

26 Jan '21

commit e67270aa452289974117bc65aa8e03fdc4ddb060 Author: hiro <hiro(a)torproject.org> Date: Tue Jan 26 19:21:31 2021 +0100 Edit readme with url --- README.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.txt b/README.txt index 4664609..e5829be 100644 --- a/README.txt +++ b/README.txt @@ -1,3 +1,5 @@ This is the default cState status page website directory/folder. https://github.com/cstate/example + +Available at: status.torproject.org

1 0