March 2025 - tor-commits - lists.torproject.org

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.8.0esr-14.0-1] Bug 1956398 - Avoid duplicating pseudo-handles in ipc_channel_win.cc. r=nika a=RyanVM
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed to branch mullvad-browser-128.8.0esr-14.0-1 at The Tor Project / Applications / Mullvad Browser Commits: d922b3f0 by Yannis Juglaret at 2025-03-26T20:48:42+00:00 Bug 1956398 - Avoid duplicating pseudo-handles in ipc_channel_win.cc. r=nika a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D243135 - - - - - 1 changed file: - ipc/chromium/src/chrome/common/ipc_channel_win.cc Changes: ===================================== ipc/chromium/src/chrome/common/ipc_channel_win.cc ===================================== @@ -30,6 +30,34 @@ using namespace mozilla::ipc; +namespace { + +// This logic is borrowed from Chromium's `base/win/win_util.h`. It allows us +// to distinguish pseudo-handle values, such as returned by GetCurrentProcess() +// (-1), GetCurrentThread() (-2), and potentially more. The code there claims +// that fuzzers have found issues up until -12 with DuplicateHandle. +// +// https://source.chromium.org/chromium/chromium/src/+/36dbbf38697dd1e23ef8944… +inline bool IsPseudoHandle(HANDLE handle) { + auto handleValue = static_cast<int32_t>(reinterpret_cast<uintptr_t>(handle)); + return -12 <= handleValue && handleValue < 0; +} + +// A real handle is a handle that is not a pseudo-handle. Always preferably use +// this variant over ::DuplicateHandle. Only use stock ::DuplicateHandle if you +// explicitly need the ability to duplicate a pseudo-handle. +inline bool DuplicateRealHandle(HANDLE source_process, HANDLE source_handle, + HANDLE target_process, LPHANDLE target_handle, + DWORD desired_access, BOOL inherit_handle, + DWORD options) { + MOZ_RELEASE_ASSERT(!IsPseudoHandle(source_handle)); + return static_cast<bool>(::DuplicateHandle( + source_process, source_handle, target_process, target_handle, + desired_access, inherit_handle, options)); +} + +} // namespace + namespace IPC { //------------------------------------------------------------------------------ @@ -595,7 +623,7 @@ bool Channel::ChannelImpl::AcceptHandles(Message& msg) { nsTArray<mozilla::UniqueFileHandle> handles(num_handles); for (uint32_t handleValue : payload) { HANDLE ipc_handle = Uint32ToHandle(handleValue); - if (!ipc_handle || ipc_handle == INVALID_HANDLE_VALUE) { + if (!ipc_handle || IsPseudoHandle(ipc_handle)) { CHROMIUM_LOG(ERROR) << "Attempt to accept invalid or null handle from process " << other_pid_ << " for message " << msg.name() << " in AcceptHandles"; @@ -613,9 +641,10 @@ bool Channel::ChannelImpl::AcceptHandles(Message& msg) { CHROMIUM_LOG(ERROR) << "other_process_ is invalid in AcceptHandles"; return false; } - if (!::DuplicateHandle(other_process_, ipc_handle, GetCurrentProcess(), - getter_Transfers(local_handle), 0, FALSE, - DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE)) { + if (!DuplicateRealHandle( + other_process_, ipc_handle, GetCurrentProcess(), + getter_Transfers(local_handle), 0, FALSE, + DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE)) { DWORD err = GetLastError(); // Don't log out a scary looking error if this failed due to the target // process terminating. @@ -688,9 +717,9 @@ bool Channel::ChannelImpl::TransferHandles(Message& msg) { CHROMIUM_LOG(ERROR) << "other_process_ is invalid in TransferHandles"; return false; } - if (!::DuplicateHandle(GetCurrentProcess(), local_handle.get(), - other_process_, &ipc_handle, 0, FALSE, - DUPLICATE_SAME_ACCESS)) { + if (!DuplicateRealHandle(GetCurrentProcess(), local_handle.get(), + other_process_, &ipc_handle, 0, FALSE, + DUPLICATE_SAME_ACCESS)) { DWORD err = GetLastError(); // Don't log out a scary looking error if this failed due to the target // process terminating. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/d92… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/commit/d92… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-128.8.0esr-14.0-1-build3
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed new tag mullvad-browser-128.8.0esr-14.0-1-build3 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.8.0esr-14.5-1] 2 commits: fixup! MB 39: Add home page about:mullvad-browser
by Pier Angelo Vendrame (＠pierov) 26 Mar '25

26 Mar '25

Pier Angelo Vendrame pushed to branch mullvad-browser-128.8.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser Commits: 4ac56788 by Henry Wilkes at 2025-03-24T13:40:55+00:00 fixup! MB 39: Add home page about:mullvad-browser MB 410: Update learn more link text. - - - - - c4649816 by Henry Wilkes at 2025-03-24T13:40:56+00:00 fixup! Mullvad Browser strings MB 410: Update learn more link text. - - - - - 2 changed files: - browser/components/mullvad-browser/content/aboutMullvadBrowser.html - toolkit/locales/en-US/toolkit/global/mullvad-browser.ftl Changes: ===================================== browser/components/mullvad-browser/content/aboutMullvadBrowser.html ===================================== @@ -72,7 +72,7 @@ <a data-l10n-name="with-vpn-link" href="https://mullvad.net"></a> - + <a data-l10n-name="learn-more-link" href="https://mullvad.net/browser" ===================================== toolkit/locales/en-US/toolkit/global/mullvad-browser.ftl ===================================== @@ -15,7 +15,7 @@ mullvad-about-telemetryLink = Telemetry about-mullvad-browser-developed-by = Developed in collaboration between the <a data-l10n-name="tor-project-link">Tor Project</a> and <a data-l10n-name="mullvad-vpn-link">Mullvad VPN</a> about-mullvad-browser-use-vpn = Get more privacy by using the browser <a data-l10n-name="with-vpn-link">with Mullvad VPN</a>. -about-mullvad-browser-learn-more = Curious to learn more about the browser? <a data-l10n-name="learn-more-link">Take a dive into the mole hole</a>. +about-mullvad-browser-learn-more2 = Curious to learn more about the browser? <a data-l10n-name="learn-more-link">Read more on our website</a>. # Update message. # <a data-l10n-name="update-link"> should contain the link text and close with </a>. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/77… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/77… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Deleted tag mullvad-browser-128.8.0esr-14.5-1-build4
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan deleted tag mullvad-browser-128.8.0esr-14.5-1-build4 at The Tor Project / Applications / Mullvad Browser -- You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser][mullvad-browser-128.8.0esr-14.5-1] Deleted 2 commits: fixup! MB 39: Add home page about:mullvad-browser
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed to branch mullvad-browser-128.8.0esr-14.5-1 at The Tor Project / Applications / Mullvad Browser WARNING: The push did not contain any new commits, but force pushed to delete the commits and changes below. Deleted commits: 4ac56788 by Henry Wilkes at 2025-03-24T13:40:55+00:00 fixup! MB 39: Add home page about:mullvad-browser MB 410: Update learn more link text. - - - - - c4649816 by Henry Wilkes at 2025-03-24T13:40:56+00:00 fixup! Mullvad Browser strings MB 410: Update learn more link text. - - - - - 2 changed files: - browser/components/mullvad-browser/content/aboutMullvadBrowser.html - toolkit/locales/en-US/toolkit/global/mullvad-browser.ftl Changes: ===================================== browser/components/mullvad-browser/content/aboutMullvadBrowser.html ===================================== @@ -72,7 +72,7 @@ <a data-l10n-name="with-vpn-link" href="https://mullvad.net"></a> - + <a data-l10n-name="learn-more-link" href="https://mullvad.net/browser" ===================================== toolkit/locales/en-US/toolkit/global/mullvad-browser.ftl ===================================== @@ -15,7 +15,7 @@ mullvad-about-telemetryLink = Telemetry about-mullvad-browser-developed-by = Developed in collaboration between the <a data-l10n-name="tor-project-link">Tor Project</a> and <a data-l10n-name="mullvad-vpn-link">Mullvad VPN</a> about-mullvad-browser-use-vpn = Get more privacy by using the browser <a data-l10n-name="with-vpn-link">with Mullvad VPN</a>. -about-mullvad-browser-learn-more = Curious to learn more about the browser? <a data-l10n-name="learn-more-link">Take a dive into the mole hole</a>. +about-mullvad-browser-learn-more2 = Curious to learn more about the browser? <a data-l10n-name="learn-more-link">Read more on our website</a>. # Update message. # <a data-l10n-name="update-link"> should contain the link text and close with </a>. View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/77… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/77… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/mullvad-browser] Pushed new tag mullvad-browser-128.8.0esr-14.5-1-build4
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed new tag mullvad-browser-128.8.0esr-14.5-1-build4 at The Tor Project / Applications / Mullvad Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/tree/mullv… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser] Pushed new tag tor-browser-128.8.0esr-14.0-1-build3
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed new tag tor-browser-128.8.0esr-14.0-1-build3 at The Tor Project / Applications / Tor Browser -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/tree/tor-brows… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.8.0esr-14.0-1] Bug 1956398 - Avoid duplicating pseudo-handles in ipc_channel_win.cc. r=nika a=RyanVM
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed to branch tor-browser-128.8.0esr-14.0-1 at The Tor Project / Applications / Tor Browser Commits: cb0f7b5c by Yannis Juglaret at 2025-03-26T20:28:42+00:00 Bug 1956398 - Avoid duplicating pseudo-handles in ipc_channel_win.cc. r=nika a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D243135 - - - - - 1 changed file: - ipc/chromium/src/chrome/common/ipc_channel_win.cc Changes: ===================================== ipc/chromium/src/chrome/common/ipc_channel_win.cc ===================================== @@ -30,6 +30,34 @@ using namespace mozilla::ipc; +namespace { + +// This logic is borrowed from Chromium's `base/win/win_util.h`. It allows us +// to distinguish pseudo-handle values, such as returned by GetCurrentProcess() +// (-1), GetCurrentThread() (-2), and potentially more. The code there claims +// that fuzzers have found issues up until -12 with DuplicateHandle. +// +// https://source.chromium.org/chromium/chromium/src/+/36dbbf38697dd1e23ef8944… +inline bool IsPseudoHandle(HANDLE handle) { + auto handleValue = static_cast<int32_t>(reinterpret_cast<uintptr_t>(handle)); + return -12 <= handleValue && handleValue < 0; +} + +// A real handle is a handle that is not a pseudo-handle. Always preferably use +// this variant over ::DuplicateHandle. Only use stock ::DuplicateHandle if you +// explicitly need the ability to duplicate a pseudo-handle. +inline bool DuplicateRealHandle(HANDLE source_process, HANDLE source_handle, + HANDLE target_process, LPHANDLE target_handle, + DWORD desired_access, BOOL inherit_handle, + DWORD options) { + MOZ_RELEASE_ASSERT(!IsPseudoHandle(source_handle)); + return static_cast<bool>(::DuplicateHandle( + source_process, source_handle, target_process, target_handle, + desired_access, inherit_handle, options)); +} + +} // namespace + namespace IPC { //------------------------------------------------------------------------------ @@ -595,7 +623,7 @@ bool Channel::ChannelImpl::AcceptHandles(Message& msg) { nsTArray<mozilla::UniqueFileHandle> handles(num_handles); for (uint32_t handleValue : payload) { HANDLE ipc_handle = Uint32ToHandle(handleValue); - if (!ipc_handle || ipc_handle == INVALID_HANDLE_VALUE) { + if (!ipc_handle || IsPseudoHandle(ipc_handle)) { CHROMIUM_LOG(ERROR) << "Attempt to accept invalid or null handle from process " << other_pid_ << " for message " << msg.name() << " in AcceptHandles"; @@ -613,9 +641,10 @@ bool Channel::ChannelImpl::AcceptHandles(Message& msg) { CHROMIUM_LOG(ERROR) << "other_process_ is invalid in AcceptHandles"; return false; } - if (!::DuplicateHandle(other_process_, ipc_handle, GetCurrentProcess(), - getter_Transfers(local_handle), 0, FALSE, - DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE)) { + if (!DuplicateRealHandle( + other_process_, ipc_handle, GetCurrentProcess(), + getter_Transfers(local_handle), 0, FALSE, + DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE)) { DWORD err = GetLastError(); // Don't log out a scary looking error if this failed due to the target // process terminating. @@ -688,9 +717,9 @@ bool Channel::ChannelImpl::TransferHandles(Message& msg) { CHROMIUM_LOG(ERROR) << "other_process_ is invalid in TransferHandles"; return false; } - if (!::DuplicateHandle(GetCurrentProcess(), local_handle.get(), - other_process_, &ipc_handle, 0, FALSE, - DUPLICATE_SAME_ACCESS)) { + if (!DuplicateRealHandle(GetCurrentProcess(), local_handle.get(), + other_process_, &ipc_handle, 0, FALSE, + DUPLICATE_SAME_ACCESS)) { DWORD err = GetLastError(); // Don't log out a scary looking error if this failed due to the target // process terminating. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/cb0f7b5… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/cb0f7b5… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-build][main] Bug 41365: Indent download*.json files
by morgan (＠morgan) 26 Mar '25

26 Mar '25

morgan pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b1128a7e by Nicolas Vigier at 2025-03-26T17:14:40+00:00 Bug 41365: Indent download*.json files - - - - - 1 changed file: - tools/update-responses/update_responses Changes: ===================================== tools/update-responses/update_responses ===================================== @@ -465,11 +465,11 @@ sub write_downloads_json { downloads => get_version_downloads($config, $version), }; write_htdocs($channel, '.', 'downloads.json', - JSON->new->utf8->canonical->encode($data)); + JSON->new->utf8->canonical->pretty->encode($data)); my $pp_downloads = get_perplatform_downloads($config, $version, $tag); foreach my $os (keys %{$pp_downloads}) { write_htdocs($channel, '.', "download-$os.json", - JSON->new->utf8->canonical->encode($pp_downloads->{$os})); + JSON->new->utf8->canonical->pretty->encode($pp_downloads->{$os})); } } View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser][tor-browser-128.8.0esr-14.5-1] 2 commits: fixup! TB 41878: [android] Add standalone Tor Bootstrap
by Pier Angelo Vendrame (＠pierov) 26 Mar '25

26 Mar '25

Pier Angelo Vendrame pushed to branch tor-browser-128.8.0esr-14.5-1 at The Tor Project / Applications / Tor Browser Commits: 7db308d0 by Pier Angelo Vendrame at 2025-03-25T19:28:43+01:00 fixup! TB 41878: [android] Add standalone Tor Bootstrap TBB 41407: Use Lyrebird also for Snowflake. TBB 41410: Use the libLyrebird.so name. - - - - - 14f451f7 by Pier Angelo Vendrame at 2025-03-26T12:32:40+01:00 fixup! TB 40597: Implement TorSettings module Sync pt_config.json after tor-browser-build#41407. - - - - - 2 changed files: - mobile/android/fenix/app/src/main/assets/common/torrc-defaults - toolkit/content/pt_config.json Changes: ===================================== mobile/android/fenix/app/src/main/assets/common/torrc-defaults ===================================== @@ -4,6 +4,5 @@ AvoidDiskWrites 1 Log notice stdout CookieAuthentication 1 DormantCanceledByStartup 1 -ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,webtunnel exec ./libObfs4proxy.so -ClientTransportPlugin snowflake exec ./libSnowflake.so +ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,snowflake,webtunnel exec ./libLyrebird.so ClientTransportPlugin conjure exec ./libConjure.so -registerURL https://registration.refraction.network/api ===================================== toolkit/content/pt_config.json ===================================== @@ -1,14 +1,12 @@ { - "_comment": "Used for dev build, replaced for release builds in tor-browser-build. This file is copied from tor-browser-build 4ffa9e31:projects/tor-expert-bundle/pt_config.json", + "_comment": "Used for dev build, replaced for release builds in tor-browser-build. This file is copied from tor-browser-build efdc0f34475ac8e4df241d3c8ff7253e8470019f:projects/tor-expert-bundle/pt_config.json", "recommendedDefault" : "obfs4", "pluggableTransports" : { - "lyrebird" : "ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,webtunnel exec ${pt_path}lyrebird${pt_extension}", - "snowflake" : "ClientTransportPlugin snowflake exec ${pt_path}snowflake-client${pt_extension}", + "lyrebird" : "ClientTransportPlugin meek_lite,obfs2,obfs3,obfs4,scramblesuit,snowflake,webtunnel exec ${pt_path}lyrebird${pt_extension}", "conjure" : "ClientTransportPlugin conjure exec ${pt_path}conjure-client${pt_extension} -registerURL https://registration.refraction.network/api" }, "bridges" : { "meek-azure" : [ - "meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com", "meek_lite 192.0.2.20:80 url=https://1314488750.rsc.cdn77.org front=www.phpmyadmin.net utls=HelloRandomizedALPN" ], "obfs4" : [ View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/8fe2d6… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/8fe2d6… You're receiving this email because of your account on gitlab.torproject.org.

1 0