September 2021 - tor-commits - lists.torproject.org

[tor-browser-build/maint-10.5] Tag 10.5.6 build 2
by sysrqb＠torproject.org 03 Sep '21

03 Sep '21

commit 62c85623166b445b53bcc806860839dfc91c121f Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Sep 3 22:53:53 2021 +0000 Tag 10.5.6 build 2 --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 3 +++ rbm.conf | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index a039c19..776a6e8 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -2,6 +2,9 @@ Tor Browser 10.5.6 -- September 7 2021 * Windows + OS X + Linux * Update Openssl to 1.1.1l * Update Firefox to 78.14.0esr + * Build System + * OS X + * Bug 40358: Make OpenSSL 1.1.1l buildable for macOS [tor-browser-build] Tor Browser 10.5.5 -- August 18 2021 * All Platforms diff --git a/rbm.conf b/rbm.conf index 560db9b..ad632a9 100644 --- a/rbm.conf +++ b/rbm.conf @@ -58,7 +58,7 @@ buildconf: var: torbrowser_version: '10.5.6' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 10.5.5 project_name: tor-browser

1 0

[tor-browser-build/maint-10.5] Bug 40358: Make OpenSSL 1.1.1l buildable for macOS
by sysrqb＠torproject.org 03 Sep '21

03 Sep '21

commit 269b0bf650e10d830f46b50ad298f4523e1eae51 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Fri Sep 3 20:51:55 2021 +0000 Bug 40358: Make OpenSSL 1.1.1l buildable for macOS --- .../0001-Revert-apple-getentropy-removal.patch | 39 ++++++++++++++++++++++ projects/openssl/build | 1 + projects/openssl/config | 2 ++ 3 files changed, 42 insertions(+) diff --git a/projects/openssl/0001-Revert-apple-getentropy-removal.patch b/projects/openssl/0001-Revert-apple-getentropy-removal.patch new file mode 100644 index 0000000..d101203 --- /dev/null +++ b/projects/openssl/0001-Revert-apple-getentropy-removal.patch @@ -0,0 +1,39 @@ +From 8b9e95ae8a9d81b1942be28cba95c35f2303ee2d Mon Sep 17 00:00:00 2001 +From: Matthew Finkel <sysrqb(a)torproject.org> +Date: Fri, 3 Sep 2021 20:48:53 +0000 +Subject: [PATCH] Revert "apple getentropy removal" + +This reverts commit b58ac9f1e3f828b5c65c9edd5bb86603a4886a26. +--- + crypto/rand/rand_unix.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c +index 43f1069d15..2dfced2052 100644 +--- a/crypto/rand/rand_unix.c ++++ b/crypto/rand/rand_unix.c +@@ -34,9 +34,6 @@ + #if defined(__OpenBSD__) + # include <sys/param.h> + #endif +-#if defined(__APPLE__) +-# include <CommonCrypto/CommonRandom.h> +-#endif + + #if defined(OPENSSL_SYS_UNIX) || defined(__DJGPP__) + # include <sys/types.h> +@@ -381,11 +378,6 @@ static ssize_t syscall_random(void *buf, size_t buflen) + if (errno != ENOSYS) + return -1; + } +-# elif defined(__APPLE__) +- if (CCRandomGenerateBytes(buf, buflen) == kCCSuccess) +- return (ssize_t)buflen; +- +- return -1; + # else + union { + void *p; +-- +2.25.1 + diff --git a/projects/openssl/build b/projects/openssl/build index f8c4cbf..bf0b16f 100644 --- a/projects/openssl/build +++ b/projects/openssl/build @@ -12,6 +12,7 @@ export CC='gcc -m32' # Tricking OpenSSL into using our clang as cross-compiler ln -s $clangdir/bin/clang $clangdir/bin/x86_64-apple-darwin-cc export CC="cc [% c("var/FLAGS") %]" + patch -p1 < $rootdir/0001-Revert-apple-getentropy-removal.patch [% END -%] export SOURCE_DATE_EPOCH='[% c("timestamp") %]' ./Configure [% c('var/configure_opts') %] diff --git a/projects/openssl/config b/projects/openssl/config index e679b0b..f0f6ef3 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -32,3 +32,5 @@ input_files: project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' sha256sum: 0b7a3e5e59c34827fe0c3a74b7ec8baef302b98fa80088d7f9153aa16fa76bd1 + - filename: 0001-Revert-apple-getentropy-removal.patch + enable: '[% c("var/osx") %]'

1 0

[meek/main] Fix markup in meek-server man page.
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit ae42cad2499b0b139ded386eec3a5f99f0493ab0 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:39:09 2021 -0600 Fix markup in meek-server man page. --- doc/meek-server.1 | 22 ++++++++++++++++------ doc/meek-server.1.txt | 4 ++-- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/doc/meek-server.1 b/doc/meek-server.1 index 3b7a07e..1084a46 100644 --- a/doc/meek-server.1 +++ b/doc/meek-server.1 @@ -2,12 +2,12 @@ .\" Title: meek-server .\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> -.\" Date: 01/17/2019 +.\" Date: 09/03/2021 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" -.TH "MEEK\-SERVER" "1" "01/17/2019" "\ \&" "\ \&" +.TH "MEEK\-SERVER" "1" "09/03/2021" "\ \&" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -128,10 +128,20 @@ or \fB\-\-disable\-tls\fR is used\&. .RE -.sp -\fB\-\-disable\-tls\fR: Use plain HTTP rather than HTTPS\&. This option is only for testing purposes\&. Don\(cqt use it in production\&. -.sp -\fB\-\-key\fR=\fIFILENAME\fR: Name of a PEM\-encoded TLS private key file\&. Required unless \fB\-\-acme\-hostnames\fR or \fB\-\-disable\-tls\fR is used\&. +.PP +\fB\-\-disable\-tls\fR +.RS 4 +Use plain HTTP rather than HTTPS\&. This option is only for testing purposes\&. Don\(cqt use it in production\&. +.RE +.PP +\fB\-\-key\fR=\fIFILENAME\fR +.RS 4 +Name of a PEM\-encoded TLS private key file\&. Required unless +\fB\-\-acme\-hostnames\fR +or +\fB\-\-disable\-tls\fR +is used\&. +.RE .PP \fB\-\-log\fR=\fIFILENAME\fR .RS 4 diff --git a/doc/meek-server.1.txt b/doc/meek-server.1.txt index 6d705e1..80940cb 100644 --- a/doc/meek-server.1.txt +++ b/doc/meek-server.1.txt @@ -67,11 +67,11 @@ OPTIONS Name of a PEM-encoded TLS certificate file. Required unless **--acme-hostnames** or **--disable-tls** is used. -**--disable-tls**: +**--disable-tls**:: Use plain HTTP rather than HTTPS. This option is only for testing purposes. Don't use it in production. -**--key**=__FILENAME__: +**--key**=__FILENAME__:: Name of a PEM-encoded TLS private key file. Required unless **--acme-hostnames** or **--disable-tls** is used.

1 0

[meek/main] programVersion = "0.37.0"
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit 53974afcd281204a9e7622d7454c10a49192d619 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:47:28 2021 -0600 programVersion = "0.37.0" --- meek-server/meek-server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index 154a65d..0e9c2e8 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -44,7 +44,7 @@ import ( ) const ( - programVersion = "0.36.0" + programVersion = "0.37.0" ptMethodName = "meek" // Reject session ids shorter than this, as a weak defense against

1 0

[meek/main] programVersion = "0.36.0"
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit 87f29032d03ebdd5a0ec597c2bb38515a1b721aa Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:40:40 2021 -0600 programVersion = "0.36.0" --- meek-server/meek-server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index df6886c..154a65d 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -44,7 +44,7 @@ import ( ) const ( - programVersion = "0.34" + programVersion = "0.36.0" ptMethodName = "meek" // Reject session ids shorter than this, as a weak defense against

1 0

[meek/main] Actually recognize utls=HelloChrome_83 in meek-client.
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit 17083fc53147161fda0784a116026e29e2debee2 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:46:34 2021 -0600 Actually recognize utls=HelloChrome_83 in meek-client. To match documentation added in 7aa47e7ffc9ca99999153d2d2e79c55c90e7e618. --- doc/meek-client.1.txt | 1 - meek-client/utls.go | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index 28faff5..fce9e6f 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -51,7 +51,6 @@ with the named TLS fingerprint for TLS camouflage. This arg is incompatible with the **--helper** command line option. The possible values of __CLIENTHELLOID__ are: -// https://github.com/refraction-networking/utls/blob/0b2885c8c0d4467cfe981367… - HelloRandomizedALPN - HelloRandomizedNoALPN - HelloFirefox_55 diff --git a/meek-client/utls.go b/meek-client/utls.go index e7f2b5f..bcd386f 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -252,6 +252,7 @@ func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls } // When you update this map, also update the man page in doc/meek-client.1.txt. +// https://github.com/refraction-networking/utls/blob/master/u_common.go var clientHelloIDMap = map[string]*utls.ClientHelloID{ // No HelloCustom: not useful for external configuration. // No HelloRandomized: doesn't negotiate consistent ALPN. @@ -269,6 +270,7 @@ var clientHelloIDMap = map[string]*utls.ClientHelloID{ "hellochrome_62": &utls.HelloChrome_62, "hellochrome_70": &utls.HelloChrome_70, "hellochrome_72": &utls.HelloChrome_72, + "hellochrome_83": &utls.HelloChrome_83, "helloios_auto": &utls.HelloIOS_Auto, "helloios_11_1": &utls.HelloIOS_11_1, "helloios_12_1": &utls.HelloIOS_12_1,

1 0

[meek/main] Document equalities of "_Auto" utls fingerprints.
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit 339f3d8ea06d765283d177bd4a273befae0bbb42 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:38:20 2021 -0600 Document equalities of "_Auto" utls fingerprints. --- doc/meek-client.1 | 6 +++--- doc/meek-client.1.txt | 7 ++++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index 0929310..9f45591 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -139,7 +139,7 @@ HelloFirefox_65 .sp -1 .IP \(bu 2.3 .\} -HelloFirefox_Auto +HelloFirefox_Auto = HelloFirefox_65 .RE .sp .RS 4 @@ -205,7 +205,7 @@ HelloChrome_83 .sp -1 .IP \(bu 2.3 .\} -HelloChrome_Auto +HelloChrome_Auto = HelloChrome_83 .RE .sp .RS 4 @@ -238,7 +238,7 @@ HelloIOS_12_1 .sp -1 .IP \(bu 2.3 .\} -HelloIOS_Auto +HelloIOS_Auto = HelloIOS_12_1 .RE .sp As a special case, the values "none" and "HelloGolang" are recognized as aliases for omitting the diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index e378e53..28faff5 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -51,22 +51,23 @@ with the named TLS fingerprint for TLS camouflage. This arg is incompatible with the **--helper** command line option. The possible values of __CLIENTHELLOID__ are: +// https://github.com/refraction-networking/utls/blob/0b2885c8c0d4467cfe981367… - HelloRandomizedALPN - HelloRandomizedNoALPN - HelloFirefox_55 - HelloFirefox_56 - HelloFirefox_63 - HelloFirefox_65 -- HelloFirefox_Auto +- HelloFirefox_Auto = HelloFirefox_65 - HelloChrome_58 - HelloChrome_62 - HelloChrome_70 - HelloChrome_72 - HelloChrome_83 -- HelloChrome_Auto +- HelloChrome_Auto = HelloChrome_83 - HelloIOS_11_1 - HelloIOS_12_1 -- HelloIOS_Auto +- HelloIOS_Auto = HelloIOS_12_1 As a special case, the values "none" and "HelloGolang" are recognized as aliases for

1 0

[meek/main] Remove TestCopyPublicFieldsHTTPTransport.
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit ae328538b8b582f2e594d8e3fcf192e8f70b8b16 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Sep 2 07:06:23 2021 -0600 Remove TestCopyPublicFieldsHTTPTransport. This ought to have been removed in bc887de694bc2d2381af099d5c38f0e9efd76c4b. https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/meek/4… --- meek-client/utls_test.go | 35 ----------------------------------- 1 file changed, 35 deletions(-) diff --git a/meek-client/utls_test.go b/meek-client/utls_test.go index eebb1db..b7e96a2 100644 --- a/meek-client/utls_test.go +++ b/meek-client/utls_test.go @@ -11,41 +11,6 @@ import ( utls "github.com/refraction-networking/utls" ) -func TestCopyPublicFieldsHTTPTransport(t *testing.T) { - src := http.DefaultTransport.(*http.Transport) - dst := &http.Transport{} - copyPublicFields(dst, src) - // Test various fields that we might care about a copy of http.Transport - // having. - if dst.DisableKeepAlives != src.DisableKeepAlives { - t.Errorf("mismatch on DisableKeepAlives") - } - if dst.DisableCompression != src.DisableCompression { - t.Errorf("mismatch on DisableCompression") - } - if dst.MaxIdleConns != src.MaxIdleConns { - t.Errorf("mismatch on MaxIdleConns") - } - if dst.MaxIdleConnsPerHost != src.MaxIdleConnsPerHost { - t.Errorf("mismatch on MaxIdleConnsPerHost") - } - if dst.MaxConnsPerHost != src.MaxConnsPerHost { - t.Errorf("mismatch on MaxConnsPerHost") - } - if dst.IdleConnTimeout != src.IdleConnTimeout { - t.Errorf("mismatch on IdleConnTimeout") - } - if dst.ResponseHeaderTimeout != src.ResponseHeaderTimeout { - t.Errorf("mismatch on ResponseHeaderTimeout") - } - if dst.ExpectContinueTimeout != src.ExpectContinueTimeout { - t.Errorf("mismatch on ExpectContinueTimeout") - } - if dst.MaxResponseHeaderBytes != src.MaxResponseHeaderBytes { - t.Errorf("mismatch on MaxResponseHeaderBytes") - } -} - // Test that the name lookup of NewUTLSRoundTripper is case-insensitive. func TestNewUTLSRoundTripperCase(t *testing.T) { mixed, err := NewUTLSRoundTripper("HelloFirefox_Auto", nil, nil)

1 0

[meek/main] Use a non-empty ServerName in TestProxyHTTPSCONNECT.
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit d9d57c24616a52f3f591fd49e4a5b34e2567fef3 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:27:01 2021 -0600 Use a non-empty ServerName in TestProxyHTTPSCONNECT. The crypto/tls server, since go1.12, requires that if a server_name extension is present, it is not empty. With go1.12 and later, this test was failing with proxy_test.go:95: local error: tls: unexpected message The specific commit that added the empty server_name check was: https://go-review.googlesource.com/c/go/+/144115 https://github.com/golang/go/commit/4c8b09e9183390d6ab80d3f53a9fe5f6ace92f0… Note the comment "enforcing a couple more 'must not be empty' on the unmarshaling side". Wireshark also complains in a packet capture: [Expert Info (Warning/Protocol): Vector length 0 is smaller than minimum 1] https://bugs.torproject.org/tpo/anti-censorship/pluggable-transports/meek/4… --- meek-client/proxy_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index b44c9a2..88ab387 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -226,7 +226,7 @@ func requestResultingFromDialHTTPS(t *testing.T, makeProxy func(addr net.Addr) ( func TestProxyHTTPSCONNECT(t *testing.T) { req, err := requestResultingFromDialHTTPS(t, func(addr net.Addr) (*httpProxy, error) { - return ProxyHTTPS("tcp", addr.String(), nil, proxy.Direct, &utls.Config{InsecureSkipVerify: true}, &utls.HelloFirefox_Auto) + return ProxyHTTPS("tcp", addr.String(), nil, proxy.Direct, &utls.Config{InsecureSkipVerify: true, ServerName: testHost}, &utls.HelloFirefox_Auto) }, "tcp", testAddr) if err != nil { panic(err)

1 0

[meek/main] Update utls to v0.0.0-20210713165636-0b2885c8c0d4.
by dcf＠torproject.org 03 Sep '21

03 Sep '21

commit 7aa47e7ffc9ca99999153d2d2e79c55c90e7e618 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Sep 3 15:33:25 2021 -0600 Update utls to v0.0.0-20210713165636-0b2885c8c0d4. --- doc/meek-client.1 | 15 +++++++++++++-- doc/meek-client.1.txt | 1 + go.mod | 2 +- go.sum | 4 ++-- 4 files changed, 17 insertions(+), 5 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index 8215537..0929310 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -2,12 +2,12 @@ .\" Title: meek-client .\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> -.\" Date: 04/29/2020 +.\" Date: 09/03/2021 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" -.TH "MEEK\-CLIENT" "1" "04/29/2020" "\ \&" "\ \&" +.TH "MEEK\-CLIENT" "1" "09/03/2021" "\ \&" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -194,6 +194,17 @@ HelloChrome_72 .sp -1 .IP \(bu 2.3 .\} +HelloChrome_83 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} HelloChrome_Auto .RE .sp diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index bd1ce5b..e378e53 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -62,6 +62,7 @@ The possible values of __CLIENTHELLOID__ are: - HelloChrome_62 - HelloChrome_70 - HelloChrome_72 +- HelloChrome_83 - HelloChrome_Auto - HelloIOS_11_1 - HelloIOS_12_1 diff --git a/go.mod b/go.mod index 1216057..c0cb0cb 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.13 require ( git.torproject.org/pluggable-transports/goptlib.git v1.1.0 - github.com/refraction-networking/utls v0.0.0-20190909200633-43c36d3c1f57 + github.com/refraction-networking/utls v0.0.0-20210713165636-0b2885c8c0d4 golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79 golang.org/x/net v0.0.0-20200425230154-ff2c4b7c35a0 golang.org/x/sys v0.0.0-20200428200454-593003d681fa diff --git a/go.sum b/go.sum index effe803..0bc985f 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ git.torproject.org/pluggable-transports/goptlib.git v1.1.0 h1:LMQAA8pAho+QtYrrVNimJQiINNEwcwuuD99vezD/PAo= git.torproject.org/pluggable-transports/goptlib.git v1.1.0/go.mod h1:YT4XMSkuEXbtqlydr9+OxqFAyspUv0Gr9qhM3B++o/Q= -github.com/refraction-networking/utls v0.0.0-20190909200633-43c36d3c1f57 h1:SL1K0QAuC1b54KoY1pjPWe6kSlsFHwK9/oC960fKrTY= -github.com/refraction-networking/utls v0.0.0-20190909200633-43c36d3c1f57/go.mod h1:tz9gX959MEFfFN5whTIocCLUG57WiILqtdVxI8c6Wj0= +github.com/refraction-networking/utls v0.0.0-20210713165636-0b2885c8c0d4 h1:n9NMHJusHylTmtaJ0Qe0VV9dkTZLiwAxHmrI/l98GeE= +github.com/refraction-networking/utls v0.0.0-20210713165636-0b2885c8c0d4/go.mod h1:tz9gX959MEFfFN5whTIocCLUG57WiILqtdVxI8c6Wj0= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79 h1:IaQbIIB2X/Mp/DKctl6ROxz1KyMlKp4uyvL6+kQ7C88= golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=

1 0