April 2021 - tor-commits - lists.torproject.org

[translation/tails-misc_release] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release
by translation＠torproject.org 30 Apr '21

30 Apr '21

commit 0ffd6cf30f0921e88f2e3c51134b04ee4154fc88 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 30 16:46:28 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc_release --- is.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/is.po b/is.po index ef3f83743f..b445727e48 100644 --- a/is.po +++ b/is.po @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2021-04-27 13:32+0200\n" -"PO-Revision-Date: 2021-04-29 20:01+0000\n" +"PO-Revision-Date: 2021-04-30 16:43+0000\n" "Last-Translator: Sveinn í Felli <sv1(a)fellsnet.is>\n" "Language-Team: Icelandic (http://www.transifex.com/otf/torproject/language/is/)\n" "MIME-Version: 1.0\n"

1 0

[translation/tails-misc] https://gitweb.torproject.org/translation.git/commit/?h=tails-misc
by translation＠torproject.org 30 Apr '21

30 Apr '21

commit 04d5d25e204c1274fd9c2b230f5e2c8af61abdb3 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 30 16:45:39 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tails-misc --- is.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/is.po b/is.po index 16b6b19246..5770cffb1b 100644 --- a/is.po +++ b/is.po @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2021-04-27 13:32+0200\n" -"PO-Revision-Date: 2021-04-29 20:01+0000\n" +"PO-Revision-Date: 2021-04-30 16:43+0000\n" "Last-Translator: Sveinn í Felli <sv1(a)fellsnet.is>\n" "Language-Team: Icelandic (http://www.transifex.com/otf/torproject/language/is/)\n" "MIME-Version: 1.0\n" @@ -2245,7 +2245,7 @@ msgid "" "We replaced this additional setting in Tails 4.19 (May 2021) with a Tor Connection assistant integrated in Tails.\n" "\n" "You will be asked whether you want to use Tor bridges when connecting to Tor after starting Tails. If you want to work offline, enable the Offline Mode in the additional settings." -msgstr "" +msgstr "Við skiptum út þessari viðbótarstillingu í Tails 4.19 (May 2021) fyrir Tor-tengiaðstoð innbyggða í Tails.\n\nÞú munt fá spurningu um hvort þú viljir nota Tor-brýr þegar tengst er við Tor eftir að Tails er ræst. Ef þú vilt vinna án nettengingar, skaltu virkja ónettengdan ham í viðbótarstillingum." #: ../config/chroot_local-includes/usr/share/tails/greeter/additional_settings.ui.in:355 msgid "Offline Mode"

1 0

[tor-browser-build/master] Bug 40291: Correctly print the fenix minSdkVersion
by sysrqb＠torproject.org 30 Apr '21

30 Apr '21

commit 140a3aa26aead876fa7db60ea723ba99d45bfcfe Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Apr 28 10:52:11 2021 +0200 Bug 40291: Correctly print the fenix minSdkVersion --- projects/fenix/list_toolchain_updates_checks | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/fenix/list_toolchain_updates_checks b/projects/fenix/list_toolchain_updates_checks index 43dd1b4..1b8e02c 100644 --- a/projects/fenix/list_toolchain_updates_checks +++ b/projects/fenix/list_toolchain_updates_checks @@ -45,7 +45,7 @@ if (m/const\\s+val\\s+minSdkVersion\\s+=\\s+([^"]+)/) { EOF needed=$(cat buildSrc/src/main/java/Config.kt | perl -ne "$p") current=21 -check_update_needed compileSdkVersion "$needed" "$current" +check_update_needed minSdkVersion "$needed" "$current" # gradle

1 0

[tor-browser-build/master] Merge remote-tracking branch 'boklmgl/bug_40291'
by sysrqb＠torproject.org 30 Apr '21

30 Apr '21

commit bc6519bab313267581dee0c586621e2fe3c2f9f5 Merge: 3f77bdc 140a3aa Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Apr 30 16:39:41 2021 +0000 Merge remote-tracking branch 'boklmgl/bug_40291' projects/fenix/list_toolchain_updates_checks | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[tor-browser-build/master] Merge remote-tracking branch 'boklmgl/bug_40271_v4'
by sysrqb＠torproject.org 30 Apr '21

30 Apr '21

commit 3f77bdc701a1d1edc513a93edb8e940532e514ab Merge: 4545059 e2f729a Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Apr 30 16:38:02 2021 +0000 Merge remote-tracking branch 'boklmgl/bug_40271_v4' Makefile | 15 +++++++++++++++ projects/application-services/config | 17 ++++++++++++++--- projects/cbindgen/config | 9 +++++++++ projects/container-image/config | 22 +++++++++++----------- projects/lucetc/config | 10 ++++++++-- projects/uniffi-rs/config | 9 ++++++++- rbm.conf | 30 ++++++++++++++++++++++++++++++ 7 files changed, 95 insertions(+), 17 deletions(-)

1 0

[tor-browser-build/master] Bug 40285: Make projects/container-image use origin_step
by sysrqb＠torproject.org 30 Apr '21

30 Apr '21

commit 1973054e2f232f46dfcf99645c6e58c1f46ed051 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Apr 21 18:50:46 2021 +0200 Bug 40285: Make projects/container-image use origin_step --- projects/container-image/config | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/projects/container-image/config b/projects/container-image/config index e1274f2..721da60 100644 --- a/projects/container-image/config +++ b/projects/container-image/config @@ -5,8 +5,8 @@ pkg_type: build var: container: use_container: 1 - suite: '[% pc(c("origin_project"), "var/container/suite") %]' - arch: '[% pc(c("origin_project"), "var/container/arch") %]' + suite: '[% pc(c("origin_project"), "var/container/suite", { step => c("origin_step") }) %]' + arch: '[% pc(c("origin_project"), "var/container/arch", { step => c("origin_step") }) %]' lsb_release: id: Debian @@ -31,8 +31,8 @@ pre: | # Update the package cache so the container installs the most recent # version of required packages. apt-get update -y -q - [% IF pc(c('origin_project'), 'var/pre_pkginst') -%] - [% pc(c('origin_project'), 'var/pre_pkginst') %] + [% IF pc(c('origin_project'), 'var/pre_pkginst', { step => c('origin_step') }) -%] + [% pc(c('origin_project'), 'var/pre_pkginst', { step => c('origin_step') }) %] # Update the package cache again because `pre_pkginst` may change the # package manager configuration. apt-get update -y -q @@ -40,14 +40,14 @@ pre: | apt-get upgrade -y -q [% deps = []; - IF pc(c('origin_project'), 'var/deps'); - CALL deps.import(pc(c('origin_project'), 'var/deps')); + IF pc(c('origin_project'), 'var/deps', { step => c('origin_step') }); + CALL deps.import(pc(c('origin_project'), 'var/deps', { step => c('origin_step') })); END; - IF pc(c('origin_project'), 'var/arch_deps'); - CALL deps.import(pc(c('origin_project'), 'var/arch_deps')); + IF pc(c('origin_project'), 'var/arch_deps', { step => c('origin_step') }); + CALL deps.import(pc(c('origin_project'), 'var/arch_deps', { step => c('origin_step') })); END; IF deps.size; - IF pc(c('origin_project'), 'var/sort_deps'); + IF pc(c('origin_project'), 'var/sort_deps', { step => c('origin_step') }); deps = deps.sort; END; FOREACH pkg IN deps; @@ -59,8 +59,8 @@ pre: | END; END; -%] - [% IF pc(c('origin_project'), 'var/post_pkginst') -%] - [% pc(c('origin_project'), 'var/post_pkginst') %] + [% IF pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) -%] + [% pc(c('origin_project'), 'var/post_pkginst', { step => c('origin_step') }) %] [% END -%] remote_get: |

1 0

[tor-browser-build/master] Bug 40271: Improve process to generate rust vendor tarballs
by sysrqb＠torproject.org 30 Apr '21

30 Apr '21

commit e2f729af199613ae593947cf6c64235f3dbf90a0 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Apr 21 17:23:40 2021 +0200 Bug 40271: Improve process to generate rust vendor tarballs --- Makefile | 15 +++++++++++++++ projects/application-services/config | 17 ++++++++++++++--- projects/cbindgen/config | 9 +++++++++ projects/lucetc/config | 10 ++++++++-- projects/uniffi-rs/config | 9 ++++++++- rbm.conf | 30 ++++++++++++++++++++++++++++++ 6 files changed, 84 insertions(+), 6 deletions(-) diff --git a/Makefile b/Makefile index 1d16fa4..94010c1 100644 --- a/Makefile +++ b/Makefile @@ -228,6 +228,21 @@ get_gradle_dependencies_list-application-services: submodule-update get_gradle_dependencies_list-android-components: submodule-update $(rbm) build android-components --step get_gradle_dependencies_list --target nightly --target torbrowser-android-armv7 +cargo_vendor-application-services: submodule-update + $(rbm) build application-services --step cargo_vendor --target nightly + +cargo_vendor-cbindgen-android: submodule-update + $(rbm) build cbindgen --step cargo_vendor --target nightly --target android + +cargo_vendor-cbindgen: submodule-update + $(rbm) build cbindgen --step cargo_vendor --target nightly + +cargo_vendor-lucetc: submodule-update + $(rbm) build lucetc --step cargo_vendor --target nightly + +cargo_vendor-uniffi-rs: submodule-update + $(rbm) build uniffi-rs --step cargo_vendor --target nightly + submodule-update: git submodule update --init diff --git a/projects/application-services/config b/projects/application-services/config index 456ce87..ba5acc1 100644 --- a/projects/application-services/config +++ b/projects/application-services/config @@ -79,9 +79,7 @@ input_files: - URL: https://people.torproject.org/~gk/mirrors/sources/glean-parser-[% c('var/glean_parser') %].tar.bz2 sha256sum: 19dbdd4958022a1a638e0217489ab722fe7d4f588f1978a4ae162f93e75694c2 enable: '[% !c("var/fetch_gradle_dependencies") %]' - # `cargo vendor vendor -s components/external/nimbus-sdk/nimbus/Cargo.toml` - # in the `application-services` directory has vendored the sources, - # after applying update-cargo-lock.patch and viaduct-workaround.patch + # Use `make cargo_vendor-application-services` to re-generate the vendor tarball - URL: https://people.torproject.org/~boklm/mirrors/sources/application-services-v… c('var/rust_vendor_version') %].tar.bz2 sha256sum: 5f1c9e1bc0db283e88516bd1d78187145bacbf4aeb72972ac09875c1147d2215 - filename: no-git.patch @@ -106,3 +104,16 @@ steps: get_gradle_dependencies_list: '[% INCLUDE build %]' var: fetch_gradle_dependencies: 1 + + cargo_vendor: + filename: '[% project %]-vendor-[% c("version") %].tar.bz2' + var: + cargo_vendor_opts: '-s components/external/nimbus-sdk/nimbus/Cargo.toml' + pre_cargo_vendor: | + patch -p1 < $rootdir/update-cargo-lock.patch + patch -d components/external/nimbus-sdk -p1 < $rootdir/viaduct-workaround.patch + input_files: + - project: container-image + pkg_type: build + - filename: viaduct-workaround.patch + - filename: update-cargo-lock.patch diff --git a/projects/cbindgen/config b/projects/cbindgen/config index a4e9cb7..43c2fb8 100644 --- a/projects/cbindgen/config +++ b/projects/cbindgen/config @@ -23,5 +23,14 @@ input_files: - name: rust project: rust # `cargo vendor vendor` in the `cbindgen` directory has vendored the sources. + # Use `make cargo_vendor-cbindgen` or `make cargo_vendor-cbindgen-android` + # (for the Android version) to re-generate the vendor tarball - URL: https://people.torproject.org/~gk/mirrors/sources/cbindgen-vendor-[% c('version') %].tar.bz2 sha256sum: '[% c("var/cbindgen_vendor_hash") %]' + +steps: + cargo_vendor: + filename: '[% project %]-vendor-[% c("version") %].tar.bz2' + input_files: + - project: container-image + pkg_type: build diff --git a/projects/lucetc/config b/projects/lucetc/config index 0007201..1177b4f 100644 --- a/projects/lucetc/config +++ b/projects/lucetc/config @@ -27,8 +27,14 @@ input_files: project: rust - name: wasi-sysroot project: wasi-sysroot - # `cargo vendor vendor` in the `lucetc-sandbox-compiler` directory has vendored - # the sources. + # Use `make cargo_vendor-lucetc` to re-generate the vendor tarball - URL: https://people.torproject.org/~gk/mirrors/sources/lucetc-vendor.tar.bz2 sha256sum: 12ba97fca12177e7ed5b5409fcfdbd31dc7db2e82282768d99dee5bcb1b1246a - filename: Remove-march-native-from-COMMON_CFLAGS.patch + +steps: + cargo_vendor: + filename: '[% project %]-vendor-[% c("version") %].tar.bz2' + input_files: + - project: container-image + pkg_type: build diff --git a/projects/uniffi-rs/config b/projects/uniffi-rs/config index acd9d2d..c8ad51c 100644 --- a/projects/uniffi-rs/config +++ b/projects/uniffi-rs/config @@ -12,7 +12,14 @@ input_files: - project: container-image - name: rust project: rust - # `cargo vendor vendor` in the `uniffi-rs` directory has vendored the sources. + # Use `make cargo_vendor-uniffi-rs` to re-generate the vendor tarball - URL: https://people.torproject.org/~boklm/mirrors/sources/uniffi-rs-vendor-[% c('version') %].tar.bz2 sha256sum: 8f201df618b3e7bcaaf01a87e0d55171605b80abeb1b660fe4dd0b9bfc10a0d8 - filename: btreeset.patch + +steps: + cargo_vendor: + filename: '[% project %]-vendor-[% c("version") %].tar.bz2' + input_files: + - project: container-image + pkg_type: build diff --git a/rbm.conf b/rbm.conf index a7023f2..ec38441 100644 --- a/rbm.conf +++ b/rbm.conf @@ -15,10 +15,40 @@ steps: set -e mkdir -p '[% dest_dir %]' mv -vf '[% project %]-[% c("version") %].tar.xz' '[% dest_dir %]/[% c("filename") %]' + list_toolchain_updates: build_log: '-' list_toolchain_updates: '[% INCLUDE list_toolchain_updates %]' + cargo_vendor: + output_dir: "out/[% project %]/cargo_vendor" + var: + container: + suite: buster + arch: amd64 + pre_pkginst: '' + deps: + - cargo + - patch + cargo_vendor: | + #!/bin/bash + [% c("var/set_default_env") %] + tar -xf [% project %]-[% c('version') %].tar.gz + cd [% project %]-[% c('version') %] + [% c("var/pre_cargo_vendor") %] + cargo vendor vendor [% c("var/cargo_vendor_opts") %] + [% c('tar', { + tar_src => [ 'vendor' ], + tar_args => '-caf ' _ dest_dir _ '/' _ c('filename'), + }) %] + cd [% dest_dir %] + fname="out/[% project %]/cargo_vendor/[% c('filename') %]" + echo + echo "Finished creating $fname" + sha256sum "[% c('filename') %]" + echo "You can upload it with:" + echo " scp -p $fname people.torproject.org:public_html/mirrors/sources" + # buildconf contains build options that the user can change in rbm.local.conf # When adding a new option to buildconf, a default value should be defined # in var/build_id, so that changing this option does not affect the build_id.

1 0

[bridgedb/develop] Fix for issue #27984
by cohosh＠torproject.org 30 Apr '21

30 Apr '21

commit 6bbc11b2f0683d55390dfcc2c4409f51d866fe2e Author: agix <columbeff(a)gmail.com> Date: Thu Apr 29 15:15:56 2021 +0200 Fix for issue #27984 Changed the hostname check by using verify_certificate_hostname from the service identity package for complete hostname verification. Added wildcard certificates for testing and two additional test cases (test_verifyHostname_matching_wildcard & test_verifyHostname_matching_wildcard_multidns) --- bridgedb/crypto.py | 26 +++++++--- bridgedb/test/test_crypto.py | 118 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 138 insertions(+), 6 deletions(-) diff --git a/bridgedb/crypto.py b/bridgedb/crypto.py index 9bdf729..b2db8b2 100644 --- a/bridgedb/crypto.py +++ b/bridgedb/crypto.py @@ -54,6 +54,10 @@ from Crypto.PublicKey import RSA from twisted.internet import ssl from twisted.python.procutils import which +from service_identity.cryptography import verify_certificate_hostname +from cryptography.x509 import load_pem_x509_certificate +from service_identity import VerificationError, CertificateError, SubjectAltNameWarning + #: The hash digest to use for HMACs. DIGESTMOD = hashlib.sha1 @@ -340,16 +344,26 @@ class SSLVerifyingContextFactory(ssl.CertificateOptions): """ commonName = x509.get_subject().commonName logging.debug("Received cert at level %d: '%s'" % (depth, commonName)) + x509 = x509.to_cryptography() # We only want to verify that the hostname matches for the level 0 # certificate: if okay and (depth == 0): - cn = commonName.replace('*', '.*') - hostnamesMatch = re.search(cn, self.hostname) - if not hostnamesMatch: + try: + verify_certificate_hostname(x509, self.hostname) + logging.debug("Valid certificate subject CN for '%s': '%s'" + % (self.hostname, commonName)) + return True + except VerificationError: logging.warn("Invalid certificate subject CN for '%s': '%s'" % (self.hostname, commonName)) return False - logging.debug("Valid certificate subject CN for '%s': '%s'" - % (self.hostname, commonName)) - return True + except CertificateError: + logging.warn("Certificate contains invalid or unexpected data") + return False + except SubjectAltNameWarning: + logging.warn("Certificate contains no SAN, fallback to common name") + cn = commonName.replace('*', '.*') + hostnamesMatch = re.search(cn, self.hostname) + hostnamesMatch = True if hostnamesMatch else False + return hostnamesMatch \ No newline at end of file diff --git a/bridgedb/test/test_crypto.py b/bridgedb/test/test_crypto.py index f57d4f3..b1af96d 100644 --- a/bridgedb/test/test_crypto.py +++ b/bridgedb/test/test_crypto.py @@ -191,6 +191,90 @@ class SSLVerifyingContextFactoryTests(unittest.TestCase, "rR97EIYKFz7C6LMy/PIe8xFTIyKMtM59IcpUDIwCLlM9JtNdwN4VpyKy\n" "-----END CERTIFICATE-----\n") + _wildcardcertificate = ( + "-----BEGIN CERTIFICATE-----\n" + "MIIExjCCA66gAwIBAgIRAKy0RV8bAucyAgAAAABnMzYwDQYJKoZIhvcNAQELBQAw\n" + "QjELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFUdvb2dsZSBUcnVzdCBTZXJ2aWNlczET\n" + "MBEGA1UEAxMKR1RTIENBIDFPMTAeFw0yMDA1MDUwODMyMjlaFw0yMDA3MjgwODMy\n" + "MjlaMGUxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH\n" + "Ew1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKEwpHb29nbGUgTExDMRQwEgYDVQQDDAsq\n" + "Lmdvb2dsZS5hdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDuwtcBm/Zy4gj3P\n" + "aaBHMOHIypfqB7KBhbzJSux7ZQpuWhM4R4anNzOzjjrCyi4R+u2mkjeB/Bw6xzt8\n" + "ObtSEmWjggJdMIICWTAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH\n" + "AwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUOCAX+hzjxyujW0S+sRabV0fAspkw\n" + "HwYDVR0jBBgwFoAUmNH4bhDrz5vsYJ8YkBug630J/SswZAYIKwYBBQUHAQEEWDBW\n" + "MCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5wa2kuZ29vZy9ndHMxbzEwKwYIKwYB\n" + "BQUHMAKGH2h0dHA6Ly9wa2kuZ29vZy9nc3IyL0dUUzFPMS5jcnQwIQYDVR0RBBow\n" + "GIILKi5nb29nbGUuYXSCCWdvb2dsZS5hdDAhBgNVHSAEGjAYMAgGBmeBDAECAjAM\n" + "BgorBgEEAdZ5AgUDMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly9jcmwucGtpLmdv\n" + "b2cvR1RTMU8xLmNybDCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB3ALIeBcyLos2K\n" + "IE6HZvkruYolIGdr2vpw57JJUy3vi5BeAAABceQt+OQAAAQDAEgwRgIhANY9slOG\n" + "xYI8TgPHZ4QdaJAOkOUf+0OMQb47glFk/MAJAiEAlmNt5gNHqEKOhZAU5FB/PF9v\n" + "P6sD8oLupRxHiEMTtLIAdgBep3P531bA57U2SH3QSeAyepGaDIShEhKEGHWWgXFF\n" + "WAAAAXHkLfiiAAAEAwBHMEUCIQDcvmEUZcDHDCvX2cikDl8xTfGcWvKETvQL02qt\n" + "L/hVlQIgfvzN2SEzT2+VwuzgGbmC8CljAjVwxKMRc+BzlB0yFh4wDQYJKoZIhvcN\n" + "AQELBQADggEBAHsyJM0yEViV/Vo09mwmP3LAyNhK4hGl3+ueZRr7PE3zkbXA3Sb3\n" + "JAbdpaQJIGUb5PeiTCB5e/Zem8N6qh4WZOi09LVoVUvkOcCUTSFayRzkyTZK1gT5\n" + "9d/RWL4BfptK++pdkHWT24SnXw/OfeZBd537LWwhGo4X60RRmPIfvxenUcXlUull\n" + "ZKYMh5B/GkcHAUf6m79lsR5K82ryplDwHr7IpfPSlJyLZn7Y4n3G9HdFeqUVEw4y\n" + "J7GslEdOd8C5IaO0xLiw+A7kkUJ16LOYKncmaMnIdhL7ibpQltd8x9VHwM7tEw3g\n" + "52qHhy4vviLHs2SClrxmkINyRvqd9c/GHcI=\n" + "-----END CERTIFICATE-----\n") + + _wildcardmultidnscertificate = ( + "-----BEGIN CERTIFICATE-----\n" + "MIIJTzCCCDegAwIBAgIQGoaLDa+bxzQIAAAAAD69lzANBgkqhkiG9w0BAQsFADBC\n" + "MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMRMw\n" + "EQYDVQQDEwpHVFMgQ0EgMU8xMB4XDTIwMDUwNTA4MjIzNVoXDTIwMDcyODA4MjIz\n" + "NVowZjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcT\n" + "DU1vdW50YWluIFZpZXcxEzARBgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAMMDCou\n" + "Z29vZ2xlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMExBCpkvy8VuVVJ\n" + "gyrY19Q/NvVPzb+yNS371xwzVriYLDhyEyGXNf45D/qj7qIe9EqkpOylAUvF5+4x\n" + "NYr5INujggbmMIIG4jAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUH\n" + "AwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUn9s6xwZqJNPn2S7GBvgewUShDNcw\n" + "HwYDVR0jBBgwFoAUmNH4bhDrz5vsYJ8YkBug630J/SswZAYIKwYBBQUHAQEEWDBW\n" + "MCcGCCsGAQUFBzABhhtodHRwOi8vb2NzcC5wa2kuZ29vZy9ndHMxbzEwKwYIKwYB\n" + "BQUHMAKGH2h0dHA6Ly9wa2kuZ29vZy9nc3IyL0dUUzFPMS5jcnQwggSoBgNVHREE\n" + "ggSfMIIEm4IMKi5nb29nbGUuY29tgg0qLmFuZHJvaWQuY29tghYqLmFwcGVuZ2lu\n" + "ZS5nb29nbGUuY29tggkqLmJkbi5kZXaCEiouY2xvdWQuZ29vZ2xlLmNvbYIYKi5j\n" + "cm93ZHNvdXJjZS5nb29nbGUuY29tggYqLmcuY2+CDiouZ2NwLmd2dDIuY29tghEq\n" + "LmdjcGNkbi5ndnQxLmNvbYIKKi5nZ3BodC5jboIOKi5na2VjbmFwcHMuY26CFiou\n" + "Z29vZ2xlLWFuYWx5dGljcy5jb22CCyouZ29vZ2xlLmNhggsqLmdvb2dsZS5jbIIO\n" + "Ki5nb29nbGUuY28uaW6CDiouZ29vZ2xlLmNvLmpwgg4qLmdvb2dsZS5jby51a4IP\n" + "Ki5nb29nbGUuY29tLmFygg8qLmdvb2dsZS5jb20uYXWCDyouZ29vZ2xlLmNvbS5i\n" + "coIPKi5nb29nbGUuY29tLmNvgg8qLmdvb2dsZS5jb20ubXiCDyouZ29vZ2xlLmNv\n" + "bS50coIPKi5nb29nbGUuY29tLnZuggsqLmdvb2dsZS5kZYILKi5nb29nbGUuZXOC\n" + "CyouZ29vZ2xlLmZyggsqLmdvb2dsZS5odYILKi5nb29nbGUuaXSCCyouZ29vZ2xl\n" + "Lm5sggsqLmdvb2dsZS5wbIILKi5nb29nbGUucHSCEiouZ29vZ2xlYWRhcGlzLmNv\n" + "bYIPKi5nb29nbGVhcGlzLmNughEqLmdvb2dsZWNuYXBwcy5jboIUKi5nb29nbGVj\n" + "b21tZXJjZS5jb22CESouZ29vZ2xldmlkZW8uY29tggwqLmdzdGF0aWMuY26CDSou\n" + "Z3N0YXRpYy5jb22CEiouZ3N0YXRpY2NuYXBwcy5jboIKKi5ndnQxLmNvbYIKKi5n\n" + "dnQyLmNvbYIUKi5tZXRyaWMuZ3N0YXRpYy5jb22CDCoudXJjaGluLmNvbYIQKi51\n" + "cmwuZ29vZ2xlLmNvbYITKi53ZWFyLmdrZWNuYXBwcy5jboIWKi55b3V0dWJlLW5v\n" + "Y29va2llLmNvbYINKi55b3V0dWJlLmNvbYIWKi55b3V0dWJlZWR1Y2F0aW9uLmNv\n" + "bYIRKi55b3V0dWJla2lkcy5jb22CByoueXQuYmWCCyoueXRpbWcuY29tghphbmRy\n" + "b2lkLmNsaWVudHMuZ29vZ2xlLmNvbYILYW5kcm9pZC5jb22CG2RldmVsb3Blci5h\n" + "bmRyb2lkLmdvb2dsZS5jboIcZGV2ZWxvcGVycy5hbmRyb2lkLmdvb2dsZS5jboIE\n" + "Zy5jb4IIZ2dwaHQuY26CDGdrZWNuYXBwcy5jboIGZ29vLmdsghRnb29nbGUtYW5h\n" + "bHl0aWNzLmNvbYIKZ29vZ2xlLmNvbYIPZ29vZ2xlY25hcHBzLmNughJnb29nbGVj\n" + "b21tZXJjZS5jb22CGHNvdXJjZS5hbmRyb2lkLmdvb2dsZS5jboIKdXJjaGluLmNv\n" + "bYIKd3d3Lmdvby5nbIIIeW91dHUuYmWCC3lvdXR1YmUuY29tghR5b3V0dWJlZWR1\n" + "Y2F0aW9uLmNvbYIPeW91dHViZWtpZHMuY29tggV5dC5iZTAhBgNVHSAEGjAYMAgG\n" + "BmeBDAECAjAMBgorBgEEAdZ5AgUDMC8GA1UdHwQoMCYwJKAioCCGHmh0dHA6Ly9j\n" + "cmwucGtpLmdvb2cvR1RTMU8xLmNybDCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB3\n" + "ALIeBcyLos2KIE6HZvkruYolIGdr2vpw57JJUy3vi5BeAAABceQk7HEAAAQDAEgw\n" + "RgIhAMeaPA4eH4PQ6P80cE7pV9+cA+JzHsfEHXybUpJYTUUqAiEAtt6UgO7o9Bo5\n" + "T83b8KngOaFoAMEitVL5ckcpZHNtOaQAdgBep3P531bA57U2SH3QSeAyepGaDISh\n" + "EhKEGHWWgXFFWAAAAXHkJOyPAAAEAwBHMEUCIQDLXewTtt5w1Pykw4iJLVEBNWsU\n" + "8LazX+MIkUmuOpwJQwIgIXySwReiZv9FbIJ/73ytICnrPGNkD43+PVMge9cJ0gQw\n" + "DQYJKoZIhvcNAQELBQADggEBAM/x3sGLTHpoan0gd9XdVCG6HsQynQEzLL25kTvN\n" + "q14pRburIrsdFWhtEETqNJo7IG19PozR6IdJkQqEBYjw6D9rRniikWeski5MhcFD\n" + "fU3ycQ2I2ISlAd3HelYNbVDJ8zJWerEGk7dyi2O/UmRreXHhi+dry8IgTiSssYNA\n" + "fht9x4GVvFTT6gap4E1Qy5UFMBGMqXmhXNoH9bYX1oY6N+8xr5tkTSQfV0T1kXKJ\n" + "WUhnDkwMUnvwuMUEP7elcvp7OgOslSQ5zwjnR3zSDozO072YR+L9SGMICCZz1ha1\n" + "DMCTA95gzVKezFCaUidRU9UyHOFzltfYDt7HRlp7MwWoPLM=\n" + "-----END CERTIFICATE-----\n") + def setUp(self): """Create a fake reactor for these tests.""" self.reactor = self.createReactor() @@ -248,6 +332,40 @@ class SSLVerifyingContextFactoryTests(unittest.TestCase, result = contextFactory.verifyHostname(conn, x509, 0, 0, True) self.assertTrue(result) + def test_verifyHostname_matching_wildcard(self): + """Check that ``verifyHostname()`` returns ``True`` when the + ``SSLVerifyingContextFactory.hostname`` matches the one found in the + level 0 certificate subject SAN. The certificate includes a wildcard + for the common name & SAN. + """ + hostname = 'www.google.at' + url = 'https://' + hostname + '/recaptcha' + contextFactory = crypto.SSLVerifyingContextFactory(url) + self.assertEqual(contextFactory.hostname, hostname) + + x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, + self._wildcardcertificate) + conn = DummyEndpoint() + result = contextFactory.verifyHostname(conn, x509, 0, 0, True) + self.assertTrue(result) + + def test_verifyHostname_matching_wildcard_multidns(self): + """Check that ``verifyHostname()`` returns ``True`` when the + ``SSLVerifyingContextFactory.hostname`` matches the one found in the + level 0 certificate subject CN. This specific google.com certificate + inlcudes numerous SAN's. + """ + hostname = 'www.google.com' + url = 'https://' + hostname + '/recaptcha' + contextFactory = crypto.SSLVerifyingContextFactory(url) + self.assertEqual(contextFactory.hostname, hostname) + + x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, + self._wildcardmultidnscertificate) + conn = DummyEndpoint() + result = contextFactory.verifyHostname(conn, x509, 0, 0, True) + self.assertTrue(result) + def test_getContext(self): """The context factory's ``getContext()`` method should produce an ``OpenSSL.SSL.Context`` object.

1 0

[bridgedb/develop] Merge branch 'issue#27984' into 'develop'
by cohosh＠torproject.org 30 Apr '21

30 Apr '21

commit 188aca3a8835d881b866c29448a99d77c291f68e Merge: f4f1fbb 6bbc11b Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Fri Apr 30 16:18:56 2021 +0000 Merge branch 'issue#27984' into 'develop' Fix for issue #27984 See merge request tpo/anti-censorship/bridgedb!14 bridgedb/crypto.py | 26 +++++++--- bridgedb/test/test_crypto.py | 118 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 138 insertions(+), 6 deletions(-)

1 0

[tor-browser-build/master] Merge remote-tracking branch 'boklmgl/bug_40283'
by sysrqb＠torproject.org 30 Apr '21

30 Apr '21

commit 45450596db474b382c96511dabaf3f578f9cb2a7 Merge: a612f50 8345837 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Apr 30 16:16:39 2021 +0000 Merge remote-tracking branch 'boklmgl/bug_40283' README | 7 +++---- README.BUILD_ERRORS => doc/BUILD_ERRORS.txt | 0 README.HACKING => doc/HACKING.txt | 0 README.MAKEFILE => doc/MAKEFILE.txt | 0 .../common => doc}/how-to-create-gradle-dependencies-list.txt | 0 {projects/common => doc}/how-to-update-glean-parser.txt | 0 doc/rbm | 1 + projects/android-components/gradle-dependencies-list.txt | 2 +- projects/application-services/gradle-dependencies-list.txt | 2 +- projects/common/gen_gradle_deps_file.sh | 4 ++-- projects/fenix/gradle-dependencies-list.txt | 2 +- projects/geckoview/gradle-dependencies-list.txt | 2 +- projects/tor-android-service/gradle-dependencies-list.txt | 2 +- projects/tor-onion-proxy-library/gradle-dependencies-list.txt | 2 +- 14 files changed, 12 insertions(+), 12 deletions(-)

1 0