February 2022 - tor-commits - lists.torproject.org

[tor-launcher/master] Bug 40773: Update the about:torconnect frontend page to match additional UI flows
by richard＠torproject.org 23 Feb '22

23 Feb '22

commit 7e084357e9a5c24592db6f6f9f536073cb3f0033 Author: Pier Angelo Vendrame <pierov(a)torproject.org> Date: Fri Feb 18 09:50:01 2022 +0100 Bug 40773: Update the about:torconnect frontend page to match additional UI flows --- src/components/tl-process.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/components/tl-process.js b/src/components/tl-process.js index 51369a6..d57092e 100644 --- a/src/components/tl-process.js +++ b/src/components/tl-process.js @@ -344,6 +344,11 @@ TorProcessService.prototype = this.mLastTorWarningReason = null; }, + _TorSetBootstrapErrorForDebug: function() + { + this.mBootstrapErrorOccurred = true; + }, + // Private Member Variables //////////////////////////////////////////////// mTorProcessStatus: 0, // kStatusUnknown

1 0

[tor-browser/tor-browser-91.6.0esr-11.5-1] squash! TB4: Tor Browser's Firefox preference overrides.
by richard＠torproject.org 23 Feb '22

23 Feb '22

commit 1f7b0babe6f5759720286a3cd07de16babc7c9d7 Author: Pier Angelo Vendrame <pierov(a)torproject.org> Date: Tue Feb 15 14:30:32 2022 +0100 squash! TB4: Tor Browser's Firefox preference overrides. Bug 19850: enabled HTTPS-Only by default --- browser/app/profile/000-tor-browser.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/browser/app/profile/000-tor-browser.js b/browser/app/profile/000-tor-browser.js index e42b9efc1b79..ea01ee4307c7 100644 --- a/browser/app/profile/000-tor-browser.js +++ b/browser/app/profile/000-tor-browser.js @@ -69,6 +69,10 @@ pref("browser.sessionstore.privacy_level", 2); pref("browser.privatebrowsing.forceMediaMemoryCache", true); pref("media.memory_cache_max_size", 16384); +// Enable HTTPS-Only mode +pref("dom.security.https_only_mode", true); +pref("dom.security.https_only_mode.upgrade_onion", false); + // Misc privacy: Remote pref("browser.send_pings", false); pref("geo.enabled", false);

1 0

[tor-browser/tor-browser-91.6.0esr-11.5-1] fixup! Bug 10760: Integrate TorButton to TorBrowser core
by richard＠torproject.org 23 Feb '22

23 Feb '22

commit fdb55a84f35b786f00dc4242bc0b2357e61f4154 Author: Richard Pospesel <richard(a)torproject.org> Date: Wed Feb 23 16:12:27 2022 +0000 fixup! Bug 10760: Integrate TorButton to TorBrowser core torbutton portion of bug 19850 --- toolkit/torproject/torbutton | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolkit/torproject/torbutton b/toolkit/torproject/torbutton index a7f607351517..c8f7cd3fec5d 160000 --- a/toolkit/torproject/torbutton +++ b/toolkit/torproject/torbutton @@ -1 +1 @@ -Subproject commit a7f6073515175a1f2d7a2bca1eaec2bfaff03c0c +Subproject commit c8f7cd3fec5d5845179fcf71ad46888f2d14c8b0

1 0

[torbutton/master] Bug 19850: Disable Plaintext HTTP Clearnet Connections
by richard＠torproject.org 23 Feb '22

23 Feb '22

commit c8f7cd3fec5d5845179fcf71ad46888f2d14c8b0 Author: Pier Angelo Vendrame <pierov(a)torproject.org> Date: Thu Feb 17 09:53:48 2022 +0100 Bug 19850: Disable Plaintext HTTP Clearnet Connections The HTTPS-Only mode of Firefox starts a background connection to verify whether HTTP is available, if the HTTPS connection does not start within a timeout. This commit disables this feature in Safer and Safest modes. --- modules/security-prefs.js | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/modules/security-prefs.js b/modules/security-prefs.js index d02e0d94..c41458fa 100644 --- a/modules/security-prefs.js +++ b/modules/security-prefs.js @@ -19,16 +19,17 @@ let log = (level, msg) => logger.log(level, msg); // bind NoScript settings to the extensions.torbutton.security_slider // (see noscript-control.js). const kSecuritySettings = { - // Preference name : [0, 1-high 2-m 3-m 4-low] - "javascript.options.ion" : [, false, false, false, true ], - "javascript.options.baselinejit" : [, false, false, false, true ], - "javascript.options.native_regexp" : [, false, false, false, true ], - "mathml.disabled" : [, true, true, true, false], - "gfx.font_rendering.graphite.enabled" : [, false, false, false, true ], - "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ], - "svg.disabled" : [, true, false, false, false], - "javascript.options.asmjs" : [, false, false, false, true ], - "javascript.options.wasm" : [, false, false, false, true ], + // Preference name : [0, 1-high 2-m 3-m 4-low] + "javascript.options.ion" : [, false, false, false, true ], + "javascript.options.baselinejit" : [, false, false, false, true ], + "javascript.options.native_regexp" : [, false, false, false, true ], + "mathml.disabled" : [, true, true, true, false], + "gfx.font_rendering.graphite.enabled" : [, false, false, false, true ], + "gfx.font_rendering.opentype_svg.enabled" : [, false, false, false, true ], + "svg.disabled" : [, true, false, false, false], + "javascript.options.asmjs" : [, false, false, false, true ], + "javascript.options.wasm" : [, false, false, false, true ], + "dom.security.https_only_mode_send_http_background_request" : [, false, false, false, true ], }; // The Security Settings prefs in question.

1 0

[translation/tbmanual-contentspot] new translations in tbmanual-contentspot
by translation＠torproject.org 23 Feb '22

23 Feb '22

commit 2959e8a5b85565d432f4b0b9a06fb1fb0996d08f Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 23 15:46:50 2022 +0000 new translations in tbmanual-contentspot --- contents+km.po | 25 ++++++++++++++----------- contents+ru.po | 2 +- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/contents+km.po b/contents+km.po index cd3a3cc19a..cf7ad00605 100644 --- a/contents+km.po +++ b/contents+km.po @@ -763,7 +763,7 @@ msgid "" " the command-line:" msgstr "" "មានកំណត់សម្គាល់ផ្សេងបន្ថែមទៀតដែលអាចប្រើបានជាមួយ 'start-tor-browser.desktop' " -"នៅលើ command-line : " +"នៅលើ command-line៖" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -780,12 +780,15 @@ msgstr "" msgid "" "| ‪`--register-app` | To register Tor Browser as a desktop application. |" msgstr "" -"| `--register-app` | ដើម្បីបញ្ចូលកម្មវិធី Tor នៅកម្មវិធី Desktop របស់អ្នក" +"| `--register-app` | សម្រាប់បញ្ចូលកម្មវិធីរុករក Tor នៅក្នុងកម្មវិធី Desktop" +" របស់អ្នក។" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "| ‪`--verbose` | To display Tor and Firefox output in the terminal. |" -msgstr "| `--verbose` | បង្ហាញកម្មវិធី Terminal របស់ Tor និង Firefox។" +msgstr "" +"| `--verbose` | សម្រាប់បង្ហាញលទ្ធផលរបស់កម្មវិធី Tor និង Firefox នៅក្នុង " +"Terminal។" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -803,29 +806,30 @@ msgid "" "background. |" msgstr "" "| `--detach` | សម្រាប់ផ្តាច់កម្មវិធី Terminal ចេញពី Tor " -"ហើយដាក់ដំណើរនៅផ្ទាំងខាងក្រោយ " +"ហើយដាក់ដំណើរនៅផ្ទាំងខាងក្រោយ។ " #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "" "| ‪`--unregister-app` | To unregister Tor Browser as a desktop application. " "|" -msgstr "| `--unregister-app` | សម្រាប់លុបកម្មវិធី Tor ចេញពីកម្មវិធី Desktop" +msgstr "| `--unregister-app` | សម្រាប់លុបកម្មវិធី Tor ចេញពីកម្មវិធី Desktop។" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "See here on how to [update Tor Browser](../updating/)." -msgstr "សូមពិនិត្យមើលពីរបៀបធ្វើ [បច្ចុប្បន្នភាពកម្មវិធី Tor](../updating/)." +msgstr "" +"សូមពិនិត្យមើលពីរបៀបធ្វើ [បច្ចុប្បន្នភាពកម្មវិធីរុករក Tor](../updating/)។" #: https//tb-manual.torproject.org/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.title) msgid "RUNNING TOR BROWSER FOR THE FIRST TIME" -msgstr "ចាប់ផ្តើមដំណើការកម្មវិធី Tor លើដំបូង" +msgstr "ចាប់ផ្តើមដំណើការកម្មវិធីរុករក Tor លើដំបូង" #: https//tb-manual.torproject.org/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.description) msgid "Learn how to use Tor Browser for the first time" -msgstr "ស្វែងយល់ពីរបៀបប្រើកម្ម Tor លើដំបូង" +msgstr "ស្វែងយល់ពីរបៀបប្រើកម្មវិធីរុករក Tor លើកដំបូង" #: https//tb-manual.torproject.org/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) @@ -842,9 +846,8 @@ msgid "" "This offers you the option to either connect directly to the Tor network, or" " to configure Tor Browser for your connection." msgstr "" -"ចំនុចនេះនិងបង្ហាញអ្នកពីជម្រើស ដើម្បីតភ្ជាប់ទៅប្រព័ន្ធបណ្តាញរបស់ Tor ដោយផ្ទាល" -" ឬធ្វើការកំណត់ពីការតភ្ជាប់ទៅកាន់ប្រព័ន្ធបណ្តាញរបស់ Tor " -"នៅលើប្រព័ន្ធបណ្តាញរបស់អ្នក" +"ចំណុចនេះបង្ហាញអ្នកពីជម្រើស ដើម្បីតភ្ជាប់ទៅប្រព័ន្ធបណ្តាញរបស់ Tor ដោយផ្ទាល់ ឬ" +" ដើម្បីកំណត់ពីការតភ្ជាប់ទៅកាន់កម្មវិធីរុករក Tor នៅលើប្រព័ន្ធបណ្តាញរបស់អ្នក។" #: https//tb-manual.torproject.org/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) diff --git a/contents+ru.po b/contents+ru.po index 693539585c..9e21db7e6b 100644 --- a/contents+ru.po +++ b/contents+ru.po @@ -357,7 +357,7 @@ msgstr "" #: https//tb-manual.torproject.org/about/ #: (content/about/contents+en.lrtopic.body) msgid "![How Tor works](/static/images/how-tor-works.png)" -msgstr "" +msgstr "![Как работает Tor](/static/images/how-tor-works.png)" #: https//tb-manual.torproject.org/about/ #: (content/about/contents+en.lrtopic.body)

1 0

[translation/communitytpo-contentspot] new translations in communitytpo-contentspot
by translation＠torproject.org 23 Feb '22

23 Feb '22

commit 14159eb4b894dcf9aaba537a118da6246672d9f7 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 23 15:45:10 2022 +0000 new translations in communitytpo-contentspot --- contents+ru.po | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/contents+ru.po b/contents+ru.po index 27491a8fc4..176fbc4f87 100644 --- a/contents+ru.po +++ b/contents+ru.po @@ -17473,7 +17473,7 @@ msgstr "" msgid "" "# externally reachable and must be different from the one specified for " "ORPort." -msgstr "" +msgstr "# доступен извне и отличаться от порта ORPort." #: https//community.torproject.org/relay/setup/bridge/fedora/ #: (content/relay/setup/bridge/fedora/contents+en.lrpage.body) @@ -18692,7 +18692,7 @@ msgstr "" #: https//community.torproject.org/relay/setup/guard/voidlinux/ #: (content/relay/setup/guard/voidlinux/contents+en.lrpage.body) msgid "# xbps-install -S tor" -msgstr "" +msgstr "# xbps-install -S tor" #: https//community.torproject.org/relay/setup/bridge/voidlinux/ #: (content/relay/setup/bridge/voidlinux/contents+en.lrpage.body) @@ -18734,13 +18734,16 @@ msgid "" "Different from most recent distributions, Void Linux does not uses " "**systemd**; it uses [runit](https://man.voidlinux.org/runit.8) instead." msgstr "" +"В отличие от многих других дистрибутивов, Void Linux не использует " +"**systemd**; вместо этого используется " +"[runit](https://man.voidlinux.org/runit.8)." #: https//community.torproject.org/relay/setup/bridge/voidlinux/ #: (content/relay/setup/bridge/voidlinux/contents+en.lrpage.body) #: https//community.torproject.org/relay/setup/guard/voidlinux/ #: (content/relay/setup/guard/voidlinux/contents+en.lrpage.body) msgid "To enable `tor`'s service on a booted system:" -msgstr "" +msgstr "Чтобы включить службу `tor` на загруженной системе:" #: https//community.torproject.org/relay/setup/bridge/voidlinux/ #: (content/relay/setup/bridge/voidlinux/contents+en.lrpage.body) @@ -18758,13 +18761,15 @@ msgid "" "started the `tor` daemon before and made changes do its configurations, you " "can restart it with:" msgstr "" +"Когда вы включите службу, она стартует автоматически. Если вы уже запускали " +"демон `tor` и вносили изменения в настройки, можете перезапустить его так:" #: https//community.torproject.org/relay/setup/bridge/voidlinux/ #: (content/relay/setup/bridge/voidlinux/contents+en.lrpage.body) #: https//community.torproject.org/relay/setup/guard/voidlinux/ #: (content/relay/setup/guard/voidlinux/contents+en.lrpage.body) msgid "# sv restart tor" -msgstr "" +msgstr "# sv restart tor" #: https//community.torproject.org/relay/setup/bridge/docker/ #: (content/relay/setup/bridge/docker/contents+en.lrpage.subtitle)

1 0

[tor/main] and fix those typos in the releasenotes too
by arma＠torproject.org 23 Feb '22

23 Feb '22

commit 37b0d464b84c421ce91308c01cccc7d3ff2a6457 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Feb 23 10:22:18 2022 -0500 and fix those typos in the releasenotes too --- ReleaseNotes | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/ReleaseNotes b/ReleaseNotes index be3094ab54..41b28e8307 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -4170,7 +4170,7 @@ Changes in version 0.4.2.5 - 2019-12-09 uses mutexes. Fixes bug 31614; bugfix on 0.2.5.2-alpha. - Disable backtrace signal handlers when shutting down tor. Fixes bug 31614; bugfix on 0.2.5.2-alpha. - - Rate-limit our the logging message about the obsolete .exit + - Rate-limit the logging message about the obsolete .exit notation. Previously, there was no limit on this warning, which could potentially be triggered many times by a hostile website. Fixes bug 31466; bugfix on 0.2.2.1-alpha. @@ -4515,7 +4515,7 @@ Changes in version 0.4.1.7 - 2019-12-09 uses mutexes. Fixes bug 31614; bugfix on 0.2.5.2-alpha. - Disable backtrace signal handlers when shutting down tor. Fixes bug 31614; bugfix on 0.2.5.2-alpha. - - Rate-limit our the logging message about the obsolete .exit + - Rate-limit the logging message about the obsolete .exit notation. Previously, there was no limit on this warning, which could potentially be triggered many times by a hostile website. Fixes bug 31466; bugfix on 0.2.2.1-alpha. @@ -4818,7 +4818,7 @@ Changes in version 0.4.0.6 - 2019-12-09 on 0.1.1.10-alpha. o Minor bugfixes (logging, backport from 0.4.2.2-alpha): - - Rate-limit our the logging message about the obsolete .exit + - Rate-limit the logging message about the obsolete .exit notation. Previously, there was no limit on this warning, which could potentially be triggered many times by a hostile website. Fixes bug 31466; bugfix on 0.2.2.1-alpha. @@ -4852,7 +4852,7 @@ Changes in version 0.4.0.6 - 2019-12-09 o Minor bugfixes (onion services, backport from 0.4.1.1-alpha): - Avoid a GCC 9.1.1 warning (and possible crash depending on libc - implemenation) when failing to load an onion service client + implementation) when failing to load an onion service client authorization file. Fixes bug 30475; bugfix on 0.3.5.1-alpha. o Minor bugfixes (out-of-memory handler, backport from 0.4.1.2-alpha): @@ -5245,7 +5245,7 @@ Changes in version 0.3.5.9 - 2019-12-09 on 0.1.1.10-alpha. o Minor bugfixes (logging, backport from 0.4.2.2-alpha): - - Rate-limit our the logging message about the obsolete .exit + - Rate-limit the logging message about the obsolete .exit notation. Previously, there was no limit on this warning, which could potentially be triggered many times by a hostile website. Fixes bug 31466; bugfix on 0.2.2.1-alpha. @@ -5283,7 +5283,7 @@ Changes in version 0.3.5.9 - 2019-12-09 o Minor bugfixes (onion services, backport from 0.4.1.1-alpha): - Avoid a GCC 9.1.1 warning (and possible crash depending on libc - implemenation) when failing to load an onion service client + implementation) when failing to load an onion service client authorization file. Fixes bug 30475; bugfix on 0.3.5.1-alpha. o Minor bugfixes (out-of-memory handler, backport from 0.4.1.2-alpha): @@ -5892,7 +5892,7 @@ Changes in version 0.4.1.5 - 2019-08-20 o Minor bugfixes (onion services): - Avoid a GCC 9.1.1 warning (and possible crash depending on libc - implemenation) when failing to load an onion service client + implementation) when failing to load an onion service client authorization file. Fixes bug 30475; bugfix on 0.3.5.1-alpha. - When refusing to launch a controller's HSFETCH request because of rate-limiting, respond to the controller with a new response,

1 0

[translation/support-portal] new translations in support-portal
by translation＠torproject.org 23 Feb '22

23 Feb '22

commit 772eb058ca4ce3bd2b64ec43f05029432e0e78df Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 23 15:18:20 2022 +0000 new translations in support-portal --- contents+nb.po | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/contents+nb.po b/contents+nb.po index d98fdb7e3b..cd5bd71212 100644 --- a/contents+nb.po +++ b/contents+nb.po @@ -7,6 +7,7 @@ # Emma Peel, 2022 # LarsMagnusHerland <lars.magnus(a)herland.priv.no>, 2022 # Transifex Bot <>, 2022 +# Imre Kristoffer Eilertsen <imreeil42(a)gmail.com>, 2022 # msgid "" msgstr "" @@ -14,7 +15,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2022-02-19 08:39+UTC\n" "PO-Revision-Date: 2018-10-02 22:41+0000\n" -"Last-Translator: Transifex Bot <>, 2022\n" +"Last-Translator: Imre Kristoffer Eilertsen <imreeil42(a)gmail.com>, 2022\n" "Language-Team: Norwegian Bokmål (https://www.transifex.com/otf/teams/1519/nb/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -206,7 +207,7 @@ msgstr "Ta kontakt" #: (dynamic) https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrglossary.title) msgid "Glossary" -msgstr "" +msgstr "Ordliste" #: (dynamic) https//support.torproject.org/misc/menu/ #: (content/misc/menu/contents+en.lrquestion.description)

1 0

[translation/communitytpo-contentspot] new translations in communitytpo-contentspot
by translation＠torproject.org 23 Feb '22

23 Feb '22

commit f850ba0c2c8290946a75b89be4ea74db0c026e17 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 23 15:15:16 2022 +0000 new translations in communitytpo-contentspot --- contents+ru.po | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/contents+ru.po b/contents+ru.po index 2b817888bc..27491a8fc4 100644 --- a/contents+ru.po +++ b/contents+ru.po @@ -17765,6 +17765,10 @@ msgid "" "use our [reachability test](https://bridges.torproject.org/scan/) to see if " "your obfs4 port is reachable from the Internet." msgstr "" +"* Обратите внимание: и OR-порт Tor, и порт obfs4 должны быть доступны. Если " +"ваш мост находится за межсетевым экраном или NAT, убедитесь, что оба порта " +"открыты. Чтобы проверить, доступен ли obfs4-порт из Интернета, можете " +"использовать [наш тест](https://bridges.torproject.org/scan/)." #: https//community.torproject.org/relay/setup/bridge/fedora/ #: (content/relay/setup/bridge/fedora/contents+en.lrpage.body) @@ -18194,6 +18198,10 @@ msgid "" "use [our reachability test](https://bridges.torproject.org/scan/) to see if " "your obfs4 port is reachable from the Internet." msgstr "" +"* Обратите внимание: и OR-порт Tor, и порт obfs4 должны быть доступны. Если " +"ваш мост находится за межсетевым экраном или NAT, убедитесь, что оба порта " +"открыты. Чтобы проверить, доступен ли obfs4-порт из Интернета, можете " +"использовать [наш тест](https://bridges.torproject.org/scan/)." #: https//community.torproject.org/relay/setup/bridge/openbsd/ #: (content/relay/setup/bridge/openbsd/contents+en.lrpage.body) @@ -18578,7 +18586,7 @@ msgstr "" #: (content/relay/setup/bridge/windows/contents+en.lrpage.body) msgid "* Note that both Tor's OR port and its obfs4 port must be reachable." msgstr "" -"* Обратите внимание: и OR-порт Tor, и пост obfs4 должны быть доступны." +"* Обратите внимание: и OR-порт Tor, и порт obfs4 должны быть доступны." #: https//community.torproject.org/relay/setup/bridge/windows/ #: (content/relay/setup/bridge/windows/contents+en.lrpage.body) @@ -18716,7 +18724,7 @@ msgstr "" #: https//community.torproject.org/relay/setup/bridge/archlinux/ #: (content/relay/setup/bridge/archlinux/contents+en.lrpage.body) msgid "### 5. Enable and Start `tor`" -msgstr "" +msgstr "### 5. Включите и запустите `tor`" #: https//community.torproject.org/relay/setup/bridge/voidlinux/ #: (content/relay/setup/bridge/voidlinux/contents+en.lrpage.body) @@ -19736,7 +19744,7 @@ msgstr "" #: https//community.torproject.org/relay/setup/bridge/debian-ubuntu/ #: (content/relay/setup/bridge/debian-ubuntu/contents+en.lrpage.body) msgid "Enable and Start `tor`:" -msgstr "" +msgstr "Включите и запустите `tor`:" #: https//community.torproject.org/relay/setup/bridge/debian-ubuntu/ #: (content/relay/setup/bridge/debian-ubuntu/contents+en.lrpage.body)

1 0

[bridgedb/main] Validate opendkim headers
by meskio＠torproject.org 23 Feb '22

23 Feb '22

commit 5bdf8a0ea8671d9b5e29f7daa8e74157c72681a8 Author: meskio <meskio(a)torproject.org> Date: Tue Feb 22 11:49:29 2022 +0100 Validate opendkim headers OpenDKIM does produce Authentication-Results header with a different format. Let's validate it. Related: tpa/team#40622 --- bridgedb/distributors/email/dkim.py | 30 ++++++++++++------- bridgedb/test/test_email_dkim.py | 59 ++++++++++++++++++++++++++++--------- 2 files changed, 64 insertions(+), 25 deletions(-) diff --git a/bridgedb/distributors/email/dkim.py b/bridgedb/distributors/email/dkim.py index 5cee31d..c8b3378 100644 --- a/bridgedb/distributors/email/dkim.py +++ b/bridgedb/distributors/email/dkim.py @@ -34,6 +34,11 @@ from __future__ import unicode_literals import logging +headers = { + "X-DKIM-Authentication-Results": lambda s: s.startswith('pass'), + "Authentication-Results": lambda s: 'dkim=pass' in s +} + def checkDKIM(message, rules): """Check the DKIM verification results header. @@ -50,7 +55,7 @@ def checkDKIM(message, rules): Otherwise, returns ``True``. - :type message: :api:`twisted.mail.smtp.rfc822.Message` + :type message: :api:`email.message.Message` :param message: The incoming client request email, including headers. :param dict rules: The list of configured ``EMAIL_DOMAIN_RULES`` for the canonical domain which the client's email request originated from. @@ -60,13 +65,16 @@ def checkDKIM(message, rules): logging.info("Checking DKIM verification results...") logging.debug("Domain has rules: %s" % ', '.join(rules)) - if 'dkim' in rules: - # getheader() returns the last of a given kind of header; we want - # to get the first, so we use getheaders() instead. - dkimHeaders = message.get("X-DKIM-Authentication-Results") - dkimHeader = dkimHeaders if dkimHeaders else "<no header>" - if not dkimHeader.startswith("pass"): - logging.info("Rejecting bad DKIM header on incoming email: %r " - % dkimHeader) - return False - return True + if 'dkim' not in rules: + return True + + foundHeader = False + for headerName, validHeader in headers.items(): + for dkimHeader in message.get_all(headerName, []): + foundHeader = True + if not validHeader(dkimHeader): + logging.info("Rejecting bad DKIM header on incoming email: %r " + % dkimHeader) + return False + + return foundHeader diff --git a/bridgedb/test/test_email_dkim.py b/bridgedb/test/test_email_dkim.py index 679575f..e36657f 100644 --- a/bridgedb/test/test_email_dkim.py +++ b/bridgedb/test/test_email_dkim.py @@ -25,21 +25,50 @@ class CheckDKIMTests(unittest.TestCase): def setUp(self): """Create fake email, distributor, and associated context data.""" - self.goodMessage = """\ + self.goodMessage = ["""\ From: user(a)gmail.com To: bridges@localhost X-DKIM-Authentication-Results: pass Subject: testing get bridges -""" - self.badMessage = """\ +""", +"""\ From: user(a)gmail.com To: bridges@localhost +Authentication-Results: gmail.com; + dkim=pass (1024-bit key; secure) header.d=gmail.com header.i=(a)gmail.com header.a=rsa-sha256 header.s=squak header.b=ZFZSqaMU; + dkim-atps=neutral Subject: testing get bridges -""" +"""] + self.badMessage = ["""\ +From: user(a)gmail.com +To: bridges@localhost +Subject: testing + +get bridges +""", +"""\ +From: user(a)gmail.com +To: bridges@localhost +Subject: testing +Authentication-Results: gmail.com; dkim=none; dkim-atps=neutral + +get bridges +""", +"""\ +From: user(a)gmail.com +To: bridges@localhost +Subject: testing +Authentication-Results: gmail.com; + dkim=pass (1024-bit key; secure) header.d=gmail.com header.i=(a)gmail.com header.a=rsa-sha256 header.s=squak header.b=ZFZSqaMU; + dkim-atps=neutral +Authentication-Results: gmail.com; dkim=none; dkim-atps=neutral + +get bridges +"""] self.domainRules = { 'gmail.com': ["ignore_dots", "dkim"], 'example.com': [], @@ -51,23 +80,25 @@ get bridges return email.message_from_string(messageString) def test_checkDKIM_good(self): - message = self._createMessage(self.goodMessage) - result = dkim.checkDKIM(message, - self.domainRules.get("gmail.com")) - self.assertTrue(result) + for msg in self.goodMessage: + message = self._createMessage(msg) + result = dkim.checkDKIM(message, + self.domainRules.get("gmail.com")) + self.assertTrue(result, msg="not good dkim for: %s" % msg) def test_checkDKIM_bad(self): - message = self._createMessage(self.badMessage) - result = dkim.checkDKIM(message, - self.domainRules.get("gmail.com")) - self.assertIs(result, False) + for msg in self.badMessage: + message = self._createMessage(msg) + result = dkim.checkDKIM(message, + self.domainRules.get("gmail.com")) + self.assertIs(result, False, msg="not expected good dkim for: %s" % msg) def test_checkDKIM_dunno(self): """A ``X-DKIM-Authentication-Results: dunno`` header should return False. """ - messageList = self.badMessage.split('\n') + messageList = self.badMessage[0].split('\n') messageList[2] = "X-DKIM-Authentication-Results: dunno" message = self._createMessage('\n'.join(messageList)) result = dkim.checkDKIM(message, @@ -78,7 +109,7 @@ get bridges """A good DKIM verification header, *plus* an ``X-DKIM-Authentication-Results: dunno`` header should return False. """ - messageList = self.badMessage.split('\n') + messageList = self.badMessage[0].split('\n') messageList.insert(2, "X-DKIM-Authentication-Results: dunno") message = self._createMessage('\n'.join(messageList)) result = dkim.checkDKIM(message,

1 0