- tor-commits - lists.torproject.org

[tor-browser-spec/master] Commit partial progress FF45 audit doc.
by mikeperry＠torproject.org 08 Apr '16

08 Apr '16

commit f66c31f82b04376a31cd564b250a1ee6bb2cac0b Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Mar 21 10:49:26 2016 -0700 Commit partial progress FF45 audit doc. Still XPCOM remains, but that is relatively lower risk. --- audits/FF45_NETWORK_AUDIT | 412 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 412 insertions(+) diff --git a/audits/FF45_NETWORK_AUDIT b/audits/FF45_NETWORK_AUDIT new file mode 100644 index 0000000..2d749a8 --- /dev/null +++ b/audits/FF45_NETWORK_AUDIT @@ -0,0 +1,412 @@ +Lowest level resolver calls: + + PR_GetHostByName + + ./netwerk/protocol/rtsp/rtsp/RTSPConnectionHandler.h + - MOZ_RTSP -> Only on android. XXX: Verify disabled + + ./netwerk/protocol/rtsp/rtsp/ARTSPConnection.cpp + - MOZ_RTSP -> Only on android. XXX: Verify disabled + + ./security/nss/lib/certhigh/ocsp.c: + - Patched (XXX: Verify application) + + ./security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c + + pkix_pl_Socket_CreateByName() + - Patched (XXX: Verify application) + + pkix_pl_Socket_CreateByHostAndPort() + - Patched (XXX: Verify application) + + ./security/nss/cmd/ + + NSS cli commands only + + ./nsprpub/pr/src/misc/prnetdb.c + + Fallback for PR_GetAddrInfoByName + + ./nsprpub/pr/src/cplus/rcnetdb.cpp + + RCHostLookup::ByName() + + Still Not used + - ./toolkit/profile/nsProfileLock.cpp + - nsProfileLock::LockWithSymlink() looks up 127.0.0.1.. + - XXX: We should patch this. + + PR_GetIPNodeByName + + Used by tests only + + PR_StringToNetAddr + + Passes AI_NUMERICHOST to getaddrinfo. No resolution. + + + PR_GetAddrInfoByName + + ./security/nss/cmd/ usage (NSS cli commands only) + - ./netwerk/dns/mdns/libmdns/* + - XXX: New. Possibly android only? + + ./netwerk/dns/GetAddrInfo.cpp + + ./netwerk/dns/nsHostResolver.cpp + - nsHostResolver::ResolveHost() is entrypoint + + nsHostResolver::ThreadFunc() will resolve without SOCKS + + Only used by nsDNSService2 + - XXX: Watch out for the new parent/child interfaces.. + +MDNS: (./netwerk/dns/mdns/libmdns/) XXX + - @mozilla.org/toolkit/components/mdnsresponder/dns-sd;1 + - DNSSERVICEDISCOVERY_CONTRACT_ID + - ./dom/presentation/provider/MulticastDNSDeviceProvider.cpp + - XXX: Presentation API? + https://developer.mozilla.org/en-US/docs/Web/API/Presentation_API + - DNSSERVICEINFO_CONTRACT_ID + - ./dom/presentation/provider/MulticastDNSDeviceProvider.cpp + - @mozilla.org/toolkit/components/mdnsresponder/dns-info;1 + +Direct paths to DNS resolution: + + nsHostResolver::ResolveHost + + Only used by nsDNSService + + nsDNSService::Resolve + - Patched for safety (XXX: Verify application) + + nsDNSService::AsyncResolve + - Patched for safety (XXX: Verify application) + - ChildDNSService::AsyncResolve and ChildDNSService::Resolve + - Possibly only active if MOZILLA_XPCOMRT_API is defined.. But it seems to + be. + - ./netwerk/dns/ChildDNSService.cpp + - XXX: Should patch AsyncResolve and Resolve here, as we do in + nsDNSService. + - XXX: New parent/child interfaces DNSRequestParent and DNSRequestChild + + ./netwerk/ipc/NeckoParent.cpp + + Calls into DNS service via DNSRequestParent::DoAsyncResolve() + + ./netwerk/ipc/NeckoChild.cpp + +Misc UDP (SOCK_DGRAM, PR_DESC_SOCKET_UDP): + + PR_DESC_SOCKET_UDP + + ./nsprpub/pr/src/cplus/rcio.h + + RCIO (not used) + + RCFileIO (not used) + + RCNetStreamIO (not used) + + ./nsprpub/pr/src/io/prsocket.c + + PR_GetUDPMethods + + ./nsprpub/pr/src/md/os2/os2io.c + + ./nsprpub/pr/src/misc/prinit.c + + PR_GetInheritedFD + + ./nsprpub/pr/src/pthreads/ptio.c + + Reviewed below + + SOCK_DGRAM + - Android: XXX: Are these patched in Orfox? + - ./other-licenses/android/res_send.c + - ./other-licenses/android/res_init.c + - ./other-licenses/android/getaddrinfo.c + + ./hal/gonk/UeventPoller.cpp + + netlink stuff + + ./ipc/chromium/src/third_party/libevent/evdns.c + + evdns is unused + + ./ipc/chromium/src/third_party/libevent/evutil.c + + interface checking functions. Unused. + + ./media/webrtc/* + + Can be disabled still + + ./media/mtransport/third_party/nICEr/src/stun/addrs.c + + boils down to NrIceCtx::StartGathering + + Used only for PeerConnection, which we disable + + SCTP is only enabled with WEBRTC (see configure.in, netwerk/moz.build, and ./dom/base/moz.build) + + ./netwerk/sctp/src/netinet/sctputil.c + + ./netwerk/sctp/src/netinet/sctp_userspace.c + + ./netwerk/sctp/src/netinet/sctp_pcb.c + + ./netwerk/sctp/src/ifaddrs_android.cpp + + ./netwerk/sctp/src/user_recv_thread.c + + ./netwerk/wifi/nsWifiScannerFreeBSD.cpp + + GeoIP stuff. Is disabled. + + ./nsprpub/pr/src/io/prsocket.c + + PR_NewUDPSocket + + PR_OpenUDPSocket + + PR_Socket + + ./nsprpub/pr/src/pthreads/ptio.c + + PR_NewUDPSocket + + PR_OpenUDPSocket + + ./media/mtransport/nr_socket_prsock.cpp + + Disabled with WebRTC + + ./netwerk/base/src/nsUDPSocket.cpp + + Unused except for nsUDPSocketProvider + + RTSP is only on Android (see configure.in, pref: media.rtsp.enabled): + + ./netwerk/protocol/rtsp/rtsp/ARTPSession.cpp + + ./netwerk/protocol/rtsp/rtsp/ARTPConnection.cpp + + ./netwerk/protocol/rtsp/rtsp/ARTPWriter.cpp + + ./netwerk/protocol/rtsp/rtsp/UDPPusher.cpp + - ./netwerk/base/src/Tickler.cpp + - XXX: Sends a UDP packet to the gateway. Possibly governed by + network.predictor.enabled, but called from many places. + - XXX: A direct patch to nsHttpHandler::TickleWifi() or + the tickler itself may be a good idea + + ./netwerk/socket/nsUDPSocketProvider.cpp + + NewSocket(). Unused. + + ./netwerk/base/src/ProxyAutoConfig.cpp + + We don't use PAC. + + PR_ImportUDPSocket + + Only called if NSPR_INHERIT_FDS in environment + + Also only inherits existing UDP sockets + +Misc TCP (SOCK_STREAM, PR_DESC_SOCKET_TCP): + + PR_DESC_SOCKET_TCP + + ./netwerk/base/ClosingService.cpp + + Shutdown cleanup only + + ./netwerk/base/nsSocketTransportService2.cpp + + ./nsprpub/pr/src/cplus/rcio.h + + RCFileIO (not used) + + RCNetStreamIO (not used) + + ./nsprpub/pr/src/io/pripv6.c + + Underlying wrapper for PR_Socket + + ./nsprpub/pr/src/md/os2/os2io.c + + OS/2 only + + ./nsprpub/pr/src/io/prsocket.c + + ./nsprpub/pr/src/misc/prinit.c + + ./nsprpub/pr/src/pthreads/ptio.c + + SOCK_STREAM + + ./dom/bluetooth/bluez/BluetoothUnixSocketConnector.cpp + + bluetooth sockets only for B2G + + ./dom/system/gonk/VolumeManager.cpp + + local only + + Android stuff: disabled. XXX: Verify on OrFox + + ./other-licenses/android/res_send.c + + ./other-licenses/android/getaddrinfo.c + + ./mozglue/build/Nuwa.cpp + + ./netwerk/sctp/ + + Disabled with WebRTC + + ./netwerk/dns/GetAddrInfo.cpp + + Only available through dns service and mdns + + ./ipc/chromium/src/third_party/libevent/event.c + + ./ipc/chromium/src/third_party/libevent/evutil.c + + ./ipc/chromium/src/third_party/libevent/listener.c + + ./ipc/chromium/src/third_party/libevent/bufferevent_sock.c + + ./ipc/chromium/src/third_party/libevent/signal.c + + ./ipc/chromium/src/third_party/libevent/http.c + + ./ipc/chromium/src/third_party/libevent/event_iocp.c + + ./ipc/keystore/KeyStore.cpp + + AF_LOCAL only + + ./ipc/nfc/Nfc.cpp + + local/loopback only + + ./ipc/ril/Ril.cpp + + local/loopback only + + ./ipc/netd/Netd.cpp + + local only + + ./ipc/chromium/src/chrome/common/ipc_channel_posix.cc + + AF_UNIX/local only + + ./nsprpub/pr/src/misc/prnetdb.c + + ./media/webrtc/* - disabled + + ./mozglue/build/Nuwa.cpp + + Unix sockets only + + RTSP and SCTP are disabled if WebRTC is compiled out + + ./netwerk/protocol/rtsp/rtsp/ARTSPConnection.cpp + + ./netwerk/sctp/src/netinet/sctp_pcb.c + + ./netwerk/sctp/src/user_socket.c + + ./netwerk/sctp/datachannel/DataChannel.cpp + + ./nsprpub/pr/src/md/windows/ntio.c + + ./nsprpub/pr/src/cplus/rcnetio.cpp + + ./nsprpub/pr/src/io/prsocket.c + + ./nsprpub/pr/src/misc/prnetdb.c + + ./nsprpub/pr/src/pthreads/ptio.c + + ./toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/crash_generation_client.cc + + AF_UNIX socket.. + + PR_NewTCPSocket + + ./security/nss/lib/certhigh/ocsp.c + + ocsp_ConnectToHost. Patched for Defense in Depth + - XXX: Verify patch after rebase. + + ./security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c + + pkix_pl_Socket_CreateClient + + pkix_pl_Socket_CreateByHostAndPort and pkix_pl_Socket_CreateByName + and pkix_pl_Socket_Create + + PKIX_PL_LdapDefaultClient_Create is unused. Other two noted above. + + Patched in pkix_pl_Socket_Create anyway. + - XXX: Verify patch + + ./nsprpub/pr/src/cplus/rcnetio.cpp + + ./nsprpub/pr/src/io/prpolevt.c + + ./media/mtransport/nr_socket_prsock.cpp + + WebRTC only + + + PR_OpenTCPSocket + + ./netwerk/base/src/nsSocketTransport2.cpp + + ./netwerk/base/src/nsServerSocket.cpp + + ./netwerk/protocol/rtsp/rtsp/ARTSPConnection.cpp + + ./netwerk/socket/nsSOCKSIOLayer.cpp + + ./netwerk/socket/nsSOCKSSocketProvider.cpp + + ./netwerk/base/src/nsSocketTransportService2.cpp + + ./security/manager/ssl/src/nsNSSIOLayer.cpp + + nsSSLIOLayerNewSocket + + ./security/manager/ssl/src/nsTLSSocketProvider.cpp + + nsTLSSocketProvider::NewSocket + + ./security/manager/ssl/src/nsSSLSocketProvider.cpp + + nsSSLSocketProvider::NewSocket (nsISocketProvider) + + nsISocketProvider.newSocket + + used with proxy settings (and only in nsSocketTransport::BuildSocket) + + PR_ImportTCPSocket + +Misc PR_Socket: + + ./nsprpub/pr/src/io/prmapopt.c + + ./nsprpub/pr/src/cplus/rcnetio.cpp + + RCNetStreamIO::RCNetStreamIO + + +Misc Wrappers: + - UDPSocketChild: + + ./dom/push/PushServiceWebSocket.jsm + - XXX: Should be disabled by ServiceWorkers, but we should also + disable the dom.push.* prefs, as well, to remind us if/when + we enable service workers. + + ./netwerk/ipc/NeckoChild.cpp + + E10S stuff. Not relevant in ESR45. + + ./netwerk/ipc/NeckoParent.cpp + + E10S stuff. Not relevant in ESR45. + + /ipc/glue/Background* + + E10S gunk. Not relevant in ESR45. + - ./toolkit/modules/secondscreen/SimpleServiceDiscovery.jsm + - XXX: Bad news. seems included. + - UDPSocket + - ./dom/simplepush/PushService.jsm + - Should be FxOS only and disabled. + - ./dom/media/bridge/MediaModule.cpp + - Dependent on WebRTC. Should be disabled + - ./dom/webidl/UDPMessageEvent.webidl + - XXX: dom.udpsocket.enabled verify. + + ./dom/webidl/UDPSocket.webidl + + dom.udpsocket.enabled + - ./devtools/shared/discovery/discovery.js + - XXX: Did we disable this? I vaguely remember a ticket about the debugger.. + - TCPSocket + - ./dom/base/Navigator.cpp + - XXX: Controlled by pref dom.mozTCPSocket.enabled + + ./dom/network/TCPSocket.h and friends + + also dom.mozTCPSocket.enabled. + + ./netwerk/protocol/rtsp/rtsp/* + + Disabled + - ./browser/extensions/shumway/content/shumway.player.js + - XXX: Boo. Shumway tells people to flip the mozTCPSocket pref? + + webrtc and mtransport again, but disabled. + + +Misc XPCOM: + + *SocketProvider + + newSocket + + ./netwerk/base/src/nsSocketTransport2.cpp: + + used with proxy settings + + addToSocket + + @mozilla.org/*/udp-socket (grep -R udp-socket .) + + dom/push/PushService.jsm: + + WTF. _listenForUDPWakeup!!! + + Controlled by pref services.push.udp.wakeupEnabled + + And also services.push.enabled + + Currently false + - XXX: Verify false on android and in the future! + + ./dom/push/PushServiceWebSocket.jsm + + dom/network/UDPSocket.cpp: + + dom.udpsocket.enabled prefs this off + - XXX: Watch this in the future! + + dom/apps/PermissionsTable.jsm + + dom/webidl/SocketCommon.webidl + + dom/webidl/UDPSocket.webidl + + layout/build/nsLayoutModule.cpp + + ./netwerk/build/nsNetCID.h + - toolkit/devtools/discovery/discovery.js + - XXX: Wtf is this thing? Vaguely remember disabling it? + - Part of "WebIDE", but seemingly not enabled until FF39? + - toolkit/modules/secondscreen/SimpleServiceDiscovery.jsm + - XXX: wtf is this thing? + + @mozilla.org/*/tcp-socket-* (grep for tcp-socket) + + ./netwerk/protocol/rtsp/ (disabled) + - ./dom/network/TCPSocket.js + - XXX: possibly exposed via navigator.mozTCPSocket.. dom.mozTCPSocket.enabled pref control.. Android/FxOS only? + - https://developer.mozilla.org/en-US/docs/Web/API/Navigator/mozTCPSocket + + ./dom/network/TCPSocket.manifest + + ./dom/apps/tests/marketplace/marketplace_privileged_app.webapp + + ./dom/apps/PermissionsTable.jsm + - ./browser/extensions/shumway/chrome/RtmpUtils.jsm + - XXX: Shumway currently only enabled in nightly builds, but keep an eye + on this.. + - XXX: shumway.rtmp.enabled governs usage of createSocket + + ./browser/extensions/shumway/chrome/viewerWrapper.js + + ./browser/extensions/shumway/chrome/content.js + + ./browser/extensions/shumway/content/shumway.player.js can also use + mozTCPSocket + + ./layout/build/nsLayoutModule.cpp + + - @mozilla.org/network/*socket* (grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket) + - ./dom/presentation/provider/TCPPresentationServer.js + - ./dom/ipc/preload.js + - ./netwerk/protocol/websocket/WebSocketChannel.cpp + - ./devtools/shared/security/socket.js + - ./mobile/android/chrome/content/WebappRT.js + - ./browser/extensions/loop/chrome/content/modules/MozLoopPushHandler.jsm + - ./toolkit/modules/Sntp.jsm + - ./toolkit/modules/secondscreen/RokuApp.jsm + - ./toolkit/xre/nsAppRunner.cpp + + + ./addon-sdk/source/lib/sdk/io/stream.js + + Addon APIs + + ./dom/ipc/preload.js + + ./dom/network/TCPServerSocket.js + - ./mobile/android/chrome/content/WebappRT.js + - Debugger? + - XXX: Pretty sure this is only for 'webapps', but it sets some scary + prefs that might impact other browser operation if an app is + installed? + + ./netwerk/build/nsNetCID.h + - Debugger stuff + - XXX: Has several prefs: + - devtools.webide.enabled + - devtools.debugger.enabled? + - devtools.debugger.remote-enabled + - devtools.debugger.force-local + - devtools.remote.tls-handshake-timeout + - ./toolkit/devtools/server/main.js + - ./toolkit/devtools/client/connection-manager.js + - ./toolkit/devtools/client/dbg-client.jsm + - ./toolkit/devtools/security/socket.js + - ./toolkit/modules/Sntp.jsm + - B2G ntp + - ./toolkit/xre/nsAppRunner.cpp + + createTransport() + - ./netwerk/base/Dashboard.cpp + -XXX: What the hell is this? + + Found earlier: + + ./toolkit/devtools/security/socket.js: + + ./toolkit/modules/Sntp.jsm: + + ./toolkit/modules/secondscreen/RokuApp.jsm + + ./netwerk/protocol/http/nsHttpConnectionMgr.cpp + + ./netwerk/protocol/ftp/nsFtpConnectionThread.cpp + + ./netwerk/protocol/ftp/nsFtpControlConnection.cpp + +- Misc XPCOM Contract-ID/CID defines: + - NS_*SOCKET*_C should get them all (grep -R "NS_" | grep SOCKET | grep "_C") + + WebRTC and mtransport (disabled) + - gfx/layers/LayerScope.cpp + - XXX + + + NS_SOCKETTRANSPORTSERVICE_* + + Proxied if TCP + + Udp limited to mtransport and webrtc + + NS_UDPSOCKET_* + + + netwerk/protocol/websocket/WebSocketChannel.cpp: + + netwerk/protocol/http/nsHttpHandler.cpp: + + netwerk/protocol/http/nsHttpConnectionMgr.cpp: + + netwerk/protocol/http/TunnelUtils.cpp: + + netwerk/protocol/ftp/nsFtpConnectionThread.cpp: + + netwerk/protocol/ftp/nsFtpControlConnection.cpp + + netwerk/base/nsIOService.cpp: + + dom/media/bridge/MediaModule.cpp + + Compiled out by webrtc + + dom/workers/ServiceWorkerEvents.cpp: + + dom/bluetooth2/bluedroid/BluetoothDaemonInterface.cpp + + b2g only + + security/manager/ssl/src/SSLServerCertVerification.cpp: + + security/manager/ssl/src/nsNSSCallbacks.cpp: + + security/manager/ssl/src/nsNSSModule.cpp: + + security/manager/ssl/src/nsTLSSocketProvider.cpp: + + security/manager/ssl/src/SharedSSLState.cpp: + + ++ Gstreamer + + ./dom/media/gstreamer/GStreamerDecoder.cpp + + Uses ChannelMediaResource underneath, and ultimately an nsIChannel + + Only exception seems to be if an RtspMediaResource could be used, + but this appears to be FxOS-only. + + XXX: Note for FxOS tor support. This may be an issue. + +Android Java calls: + + Uses HttpURLConnection: + + mobile/android/base/CrashReporter.java + + mobile/android/base/SuggestClient.java + + mobile/android/base/distribution/Distribution.java + + Uses org.apache.http.client.* + + mobile/android/base/favicons/LoadFaviconTask.java + + Uses ch.boye.httpclientandroidlib.impl.client.*: + + mobile/android/base/sync/net/BaseResource.java + + mobile/android/base/CrashReporter.java + + mobile/android/base/SuggestClient.java + + mobile/android/base/distribution/Distribution.java + + mobile/android/search/java/org/mozilla/search/providers/SearchEngineManager.java + + mobile/android/stumbler/java/org/mozilla/mozstumbler/service/utils/AbstractCommunicator.java

1 0

[tor-browser-spec/master] FF45 review Woops. missed a note in the edit buffer.
by mikeperry＠torproject.org 08 Apr '16

08 Apr '16

commit 83524206efec79238be0f11e1b2566cb89595c3e Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 8 15:51:48 2016 -0700 FF45 review Woops. missed a note in the edit buffer. --- audits/FF45_NETWORK_AUDIT | 2 ++ 1 file changed, 2 insertions(+) diff --git a/audits/FF45_NETWORK_AUDIT b/audits/FF45_NETWORK_AUDIT index 2d749a8..a11efc9 100644 --- a/audits/FF45_NETWORK_AUDIT +++ b/audits/FF45_NETWORK_AUDIT @@ -315,6 +315,8 @@ Misc XPCOM: - @mozilla.org/network/*socket* (grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket) - ./dom/presentation/provider/TCPPresentationServer.js + - XXX: Server-side listening socket? MDN docs indicate the Presentation + stuff is not live yet - ./dom/ipc/preload.js - ./netwerk/protocol/websocket/WebSocketChannel.cpp - ./devtools/shared/security/socket.js

1 0

[torbutton/master] Bug 18466: Prevent ReferenceErrors in tor-control-port.js
by gk＠torproject.org 08 Apr '16

08 Apr '16

commit e6939a0043b8fc944ecfa4559efbd503d1d758c1 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Mar 2 17:27:25 2016 -0800 Bug 18466: Prevent ReferenceErrors in tor-control-port.js --- src/modules/tor-control-port.js | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index e1ee6bc..1cef898 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -39,7 +39,7 @@ log("Loading tor-control-port.js\n"); // ## io // I/O utilities namespace -let io = io || {}; +let io = {}; // __io.asyncSocketStreams(host, port)__. // Creates a pair of asynchronous input and output streams for a socket at the @@ -286,7 +286,7 @@ io.controlSocket = function (host, port, password, onError) { // ## utils // A namespace for utility functions -let utils = utils || {}; +let utils = {}; // __utils.identity(x)__. // Returns its argument unchanged. @@ -390,7 +390,7 @@ utils.rejectPromise = errorMessage => Promise.reject(new Error(errorMessage)); // ## info // A namespace for functions related to tor's GETINFO and GETCONF command. -let info = info || {}; +let info = {}; // __info.keyValueStringsFromMessage(messageText)__. // Takes a message (text) response to GETINFO or GETCONF and provides @@ -567,7 +567,7 @@ info.getConf = function (aControlSocket, key) { // ## event // Handlers for events -let event = event || {}; +let event = {}; // __event.parsers__. // A map of EVENT keys to parsing functions, which convert result strings to JavaScript @@ -603,7 +603,7 @@ event.watchEvent = function (controlSocket, type, filter, onData) { // ## tor // Things related to the main controller. -let tor = tor || {}; +let tor = {}; // __tor.controllerCache__. // A map from "host:port" to controller objects. Prevents redundant instantiation

1 0

[torbutton/master] Bug 18466: Get domain isolator working with FF45
by gk＠torproject.org 08 Apr '16

08 Apr '16

commit d454bd4ac3eb71b3945ff64704bb87fdb211d711 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Wed Mar 2 16:45:08 2016 -0800 Bug 18466: Get domain isolator working with FF45 --- src/components/domain-isolator.js | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/src/components/domain-isolator.js b/src/components/domain-isolator.js index caf45cf..2639322 100644 --- a/src/components/domain-isolator.js +++ b/src/components/domain-isolator.js @@ -18,7 +18,7 @@ let logger = Cc["@torproject.org/torbutton-logger;1"] // ## mozilla namespace. // Useful functionality for interacting with Mozilla services. -let mozilla = mozilla || {}; +let mozilla = {}; // __mozilla.protocolProxyService__. // Mozilla's protocol proxy service, useful for managing proxy connections made @@ -47,7 +47,7 @@ mozilla.registerProxyChannelFilter = function (filterFunction, positionIndex) { }; // ## tor functionality. -let tor = tor || {}; +let tor = {}; // __tor.noncesForDomains__. // A mutable map that records what nonce we are using for each domain. @@ -73,13 +73,14 @@ tor.socksProxyCredentials = function (originalProxy, domain) { } let proxy = originalProxy.QueryInterface(Ci.nsIProxyInfo); return mozilla.protocolProxyService - .newSOCKSProxyInfo(proxy.host, - proxy.port, - domain, // username - tor.noncesForDomains[domain].toString(), // password - proxy.flags, - proxy.failoverTimeout, - proxy.failoverProxy); + .newProxyInfoWithAuth("socks", + proxy.host, + proxy.port, + domain, // username + tor.noncesForDomains[domain].toString(), // password + proxy.flags, + proxy.failoverTimeout, + proxy.failoverProxy); }; tor.newCircuitForDomain = function(domain) {

1 0

[torbutton/master] Bug 18466: Make Torbutton compatible with ESR45
by gk＠torproject.org 08 Apr '16

08 Apr '16

commit e4f7079dd5d4ae44b8d10b48889d165eba20a660 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Apr 7 09:51:05 2016 +0000 Bug 18466: Make Torbutton compatible with ESR45 Our usage of |let| does not work anymore since changes in Firefox 44 landed. See: https://bugzilla.mozilla.org/show_bug.cgi?id=589199. --- src/components/domain-isolator.js | 6 +++--- src/modules/tor-control-port.js | 2 +- src/modules/utils.js | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/components/domain-isolator.js b/src/components/domain-isolator.js index 2639322..6cfd21e 100644 --- a/src/components/domain-isolator.js +++ b/src/components/domain-isolator.js @@ -30,7 +30,7 @@ mozilla.protocolProxyService = Cc["@mozilla.org/network/protocol-proxy-service;1 // Mozilla's Thirdy Party Utilities, for figuring out first party domain. mozilla.thirdPartyUtil = Cc["@mozilla.org/thirdpartyutil;1"] .getService(Ci.mozIThirdPartyUtil); - + // __mozilla.registerProxyChannelFilter(filterFunction, positionIndex)__. // Registers a proxy channel filter with the Mozilla Protocol Proxy Service, // which will help to decide the proxy to be used for a given channel. @@ -63,7 +63,7 @@ tor.unknownDirtySince = Date.now(); // __tor.socksProxyCredentials(originalProxy, domain)__. // Takes a proxyInfo object (originalProxy) and returns a new proxyInfo -// object with the same properties, except the username is set to the +// object with the same properties, except the username is set to the // the domain, and the password is a nonce. tor.socksProxyCredentials = function (originalProxy, domain) { // Check if we already have a nonce. If not, create @@ -113,7 +113,7 @@ tor.isolateCircuitsByDomain = function () { proxy = aProxy.QueryInterface(Ci.nsIProxyInfo), replacementProxy = tor.socksProxyCredentials(aProxy, firstPartyDomain); logger.eclog(3, "tor SOCKS: " + channel.URI.spec + " via " + - replacementProxy.username + ":" + replacementProxy.password); + replacementProxy.username + ":" + replacementProxy.password); return replacementProxy; } catch (err) { logger.eclog(3, err.message); diff --git a/src/modules/tor-control-port.js b/src/modules/tor-control-port.js index 1cef898..63c2cd9 100644 --- a/src/modules/tor-control-port.js +++ b/src/modules/tor-control-port.js @@ -641,7 +641,7 @@ tor.controller = function (host, port, password, onError) { // let replyPromise = c.getInfo("ip-to-country/16.16.16.16"); // // Close the controller permanently // c.close(); -let controller = function (host, port, password, onError) { +var controller = function (host, port, password, onError) { let dest = host + ":" + port, maybeController = tor.controllerCache[dest]; return (tor.controllerCache[dest] = diff --git a/src/modules/utils.js b/src/modules/utils.js index de3cca6..eb0746b 100644 --- a/src/modules/utils.js +++ b/src/modules/utils.js @@ -14,7 +14,7 @@ let prefs = Services.prefs; // __getPrefValue(prefName)__ // Returns the current value of a preference, regardless of its type. -let getPrefValue = function (prefName) { +var getPrefValue = function (prefName) { switch(prefs.getPrefType(prefName)) { case prefs.PREF_BOOL: return prefs.getBoolPref(prefName); case prefs.PREF_INT: return prefs.getIntPref(prefName); @@ -27,7 +27,7 @@ let getPrefValue = function (prefName) { // Applies prefHandler to the current value of pref specified by prefName. // Re-applies prefHandler whenever the value of the pref changes. // Returns a zero-arg function that unbinds the pref. -let bindPrefAndInit = function (prefName, prefHandler) { +var bindPrefAndInit = function (prefName, prefHandler) { let update = () => { prefHandler(getPrefValue(prefName)); }, observer = { observe : function (subject, topic, data) { if (data === prefName) { @@ -48,7 +48,7 @@ let env = Components.classes["@mozilla.org/process/environment;1"] // __getEnv(name)__. // Reads the environment variable of the given name. -let getEnv = function (name) { +var getEnv = function (name) { return env.exists(name) ? env.get(name) : undefined; };

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 08 Apr '16

08 Apr '16

commit db9b4e4f38196667baab09cfbe6078a779afa130 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 8 08:15:53 2016 +0000 Update translations for torbutton-torbuttonproperties --- ja/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ja/torbutton.properties b/ja/torbutton.properties index 33011f4..1f3cc35 100644 --- a/ja/torbutton.properties +++ b/ja/torbutton.properties @@ -76,4 +76,4 @@ profileProblemTitle=%S プロファイル問題 profileReadOnly=読み込み専用のファイルシステムでは %S を実行できません。 %S を別の場所に移動してからもう一度実行してください。 profileReadOnlyMac=読み込み専用のファイルシステムでは %S を実行できません。 %S をデスクトップやアプリケーションフォルダーに移動してからもう一度実行してください。 profileAccessDenied=%S はプロファイルにアクセスする権限がありません。権限を設定してからもう一度試してみてください。 -profileMigrationFailed=Migration of your existing %S profile failed.\nNew settings will be used. +profileMigrationFailed=存在しているプロファイル %S へのマイグレーションに失敗しました。\n新しい設定が適用されます。

1 0

[nyx/master] Adding @require_curses decorator
by atagar＠torproject.org 08 Apr '16

08 Apr '16

commit 60a576541d981ec8304cc91c2cf3f536f9bc7cbb Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Apr 7 10:34:22 2016 -0700 Adding @require_curses decorator Similar to the @require_controller and @require_online of Stem, adding a decorator for our tests that do curses operations. This skips the test if the screen size is too small, and mocks out a size that works even on my tiny netbook. --- test/__init__.py | 31 ++++++++++++++++++++++++++++--- test/popups.py | 28 ++++++++++++++-------------- 2 files changed, 42 insertions(+), 17 deletions(-) diff --git a/test/__init__.py b/test/__init__.py index 705e9b1..b606b4a 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -9,7 +9,6 @@ import unittest import nyx.curses from nyx import expand_path, join, uses_settings - from mock import patch, Mock __all__ = [ @@ -20,13 +19,39 @@ __all__ = [ 'tracker', ] -# If set we make test content we render for this many seconds. +SHOW_RENDERED_CONTENT = None # if set, tests render content this many seconds -SHOW_RENDERED_CONTENT = None +OUR_SCREEN_SIZE = None +TEST_SCREEN_SIZE = nyx.curses.Dimensions(80, 25) RenderResult = collections.namedtuple('RenderResult', ['content', 'return_value', 'runtime']) +def require_curses(func): + """ + Skips the test unless curses is available with a minimal dimension needed by + our tests. + """ + + if OUR_SCREEN_SIZE is None: + def _check_screen_size(): + global OUR_SCREEN_SIZE + OUR_SCREEN_SIZE = nyx.curses.screen_size() + + nyx.curses.start(_check_screen_size) + + def wrapped(self, *args, **kwargs): + if OUR_SCREEN_SIZE.width < TEST_SCREEN_SIZE.width: + self.skipTest("screen isn't wide enough") + elif OUR_SCREEN_SIZE.height < TEST_SCREEN_SIZE.height: + self.skipTest("screen isn't tall enough") + else: + with patch('nyx.curses.screen_size', Mock(return_value = TEST_SCREEN_SIZE)): + return func(self, *args, **kwargs) + + return wrapped + + def render(func, *args, **kwargs): """ Runs the given curses function, providing content that's rendered on the diff --git a/test/popups.py b/test/popups.py index 0394003..f38cb45 100644 --- a/test/popups.py +++ b/test/popups.py @@ -5,10 +5,12 @@ Unit tests for nyx.popups. import curses import unittest +import nyx.curses import nyx.panel import nyx.popups import test +from test import require_curses from mock import patch, Mock EXPECTED_HELP_POPUP = """ @@ -187,15 +189,13 @@ Consensus Descriptor (29787760145CD1A473552A2FC64C72A9A130820E):---------------+ | 20 -----BEGIN SIGNATURE----- | | 21 EUFm38gONCoDuY7ZWHyJtBKuvk6Xi1MPuKuecS5frP3fX0wiZSrOVcpX0X8J+4Hr | | 22 Fb5i+yuMIAXeEn6UhtjqhhZBbY9PW9GdZOMTH8hJpG+evURyr+10PZq6UElg86rA | -| 23 NCGI042p6+7UgCVT1x3WcLnq3ScV//s1wXHrUXa7vi0= | -| 24 -----END SIGNATURE----- | +------------------------------------------------------------------------------+ """.strip() class TestPopups(unittest.TestCase): + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) @patch('nyx.controller.get_controller') def test_help(self, get_controller_mock): header_panel = Mock() @@ -230,20 +230,20 @@ class TestPopups(unittest.TestCase): rendered = test.render(nyx.popups.show_help) self.assertEqual(EXPECTED_HELP_POPUP, rendered.content) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_about(self): rendered = test.render(nyx.popups.show_about) self.assertEqual(EXPECTED_ABOUT_POPUP, rendered.content) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_counts_when_empty(self): rendered = test.render(nyx.popups.show_counts, 'Client Locales', {}) self.assertEqual(EXPECTED_EMPTY_COUNTS, rendered.content) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_counts(self): clients = { 'fr': 5, @@ -256,16 +256,16 @@ class TestPopups(unittest.TestCase): rendered = test.render(nyx.popups.show_counts, 'Client Locales', clients, fill_char = '*') self.assertEqual(EXPECTED_COUNTS, rendered.content) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_select_from_list(self): options = ['each second', '5 seconds', '30 seconds', 'minutely', '15 minute', '30 minute', 'hourly', 'daily'] rendered = test.render(nyx.popups.select_from_list, 'Update Interval:', options, 'each second') self.assertEqual(EXPECTED_LIST_SELECTOR, rendered.content) self.assertEqual('each second', rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_select_sort_order(self): previous_order = ['Man Page Entry', 'Name', 'Is Set'] options = ['Name', 'Value', 'Value Type', 'Category', 'Usage', 'Summary', 'Description', 'Man Page Entry', 'Is Set'] @@ -274,8 +274,8 @@ class TestPopups(unittest.TestCase): self.assertEqual(EXPECTED_SORT_DIALOG_START, rendered.content) self.assertEqual(None, rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_select_sort_order_usage(self): # Use the dialog to make a selection. At the end we render two options as # being selected (rather than three) because the act of selecing the third @@ -299,24 +299,24 @@ class TestPopups(unittest.TestCase): self.assertEqual(EXPECTED_SORT_DIALOG_END, rendered.content) self.assertEqual(['Name', 'Summary', 'Description'], rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) @patch('nyx.controller.input_prompt', Mock(return_value = None)) def test_select_event_types_when_canceled(self): rendered = test.render(nyx.popups.select_event_types) self.assertEqual(EXPECTED_EVENT_SELECTOR, rendered.content) self.assertEqual(None, rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) @patch('nyx.controller.input_prompt', Mock(return_value = '2bwe')) def test_select_event_types_with_input(self): rendered = test.render(nyx.popups.select_event_types) self.assertEqual(EXPECTED_EVENT_SELECTOR, rendered.content) self.assertEqual(set(['NYX_INFO', 'ERR', 'WARN', 'BW', 'NYX_ERR', 'NYX_WARN', 'NYX_NOTICE']), rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_confirm_save_torrc(self): rendered = test.render(nyx.popups.confirm_save_torrc, TORRC) self.assertEqual(EXPECTED_SAVE_TORRC_CONFIRMATION, rendered.content) @@ -330,15 +330,15 @@ class TestPopups(unittest.TestCase): self.assertEqual(EXPECTED_SAVE_TORRC_CONFIRMATION, rendered.content) self.assertEqual(True, rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) def test_descriptor_without_fingerprint(self): rendered = test.render(nyx.popups.show_descriptor, None, nyx.curses.Color.RED, lambda key: key.match('esc')) self.assertEqual(EXPECTED_DESCRIPTOR_WITHOUT_FINGERPRINT, rendered.content) self.assertEqual(nyx.curses.KeyInput(27), rendered.return_value) + @require_curses @patch('nyx.popups._top', Mock(return_value = 0)) - @patch('nyx.curses.screen_size', Mock(return_value = nyx.curses.Dimensions(80, 60))) @patch('nyx.popups._descriptor_text', Mock(return_value = DESCRIPTOR_TEXT)) def test_descriptor(self): rendered = test.render(nyx.popups.show_descriptor, '29787760145CD1A473552A2FC64C72A9A130820E', nyx.curses.Color.RED, lambda key: key.match('esc'))

1 0

[translation/tails-openpgp-applet_completed] Update translations for tails-openpgp-applet_completed
by translation＠torproject.org 08 Apr '16

08 Apr '16

commit 25cecd982139e0024ab3cecf1577c74320541113 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 8 04:17:14 2016 +0000 Update translations for tails-openpgp-applet_completed --- zh_HK/openpgp-applet.pot | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zh_HK/openpgp-applet.pot b/zh_HK/openpgp-applet.pot index 7acb48f..1cd7e56 100644 --- a/zh_HK/openpgp-applet.pot +++ b/zh_HK/openpgp-applet.pot @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: tails(a)boum.org\n" "POT-Creation-Date: 2015-08-10 15:55+0200\n" -"PO-Revision-Date: 2016-04-07 07:21+0000\n" +"PO-Revision-Date: 2016-04-08 04:08+0000\n" "Last-Translator: Kin Kwok\n" "Language-Team: Chinese (Hong Kong) (http://www.transifex.com/otf/torproject/language/zh_HK/)\n" "MIME-Version: 1.0\n" @@ -143,7 +143,7 @@ msgstr "未選取鎖匙" msgid "" "You must select a private key to sign the message, or some public keys to " "encrypt the message, or both." -msgstr "須選取私人鎖匙對郵件進行簽名，或一些公匙嚟加密郵件，或兩者兼行。" +msgstr "須選取私人鎖匙對郵件進行簽名，或一啲公匙嚟加密郵件，或兩者兼行。" #: bin/openpgp-applet:664 msgid "No keys available"

1 0

[translation/tails-openpgp-applet] Update translations for tails-openpgp-applet
by translation＠torproject.org 08 Apr '16

08 Apr '16

commit 9427da3033cdab92e5574b48a84fcb728137bb55 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 8 04:17:10 2016 +0000 Update translations for tails-openpgp-applet --- zh_HK/openpgp-applet.pot | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zh_HK/openpgp-applet.pot b/zh_HK/openpgp-applet.pot index 7acb48f..1cd7e56 100644 --- a/zh_HK/openpgp-applet.pot +++ b/zh_HK/openpgp-applet.pot @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: tails(a)boum.org\n" "POT-Creation-Date: 2015-08-10 15:55+0200\n" -"PO-Revision-Date: 2016-04-07 07:21+0000\n" +"PO-Revision-Date: 2016-04-08 04:08+0000\n" "Last-Translator: Kin Kwok\n" "Language-Team: Chinese (Hong Kong) (http://www.transifex.com/otf/torproject/language/zh_HK/)\n" "MIME-Version: 1.0\n" @@ -143,7 +143,7 @@ msgstr "未選取鎖匙" msgid "" "You must select a private key to sign the message, or some public keys to " "encrypt the message, or both." -msgstr "須選取私人鎖匙對郵件進行簽名，或一些公匙嚟加密郵件，或兩者兼行。" +msgstr "須選取私人鎖匙對郵件進行簽名，或一啲公匙嚟加密郵件，或兩者兼行。" #: bin/openpgp-applet:664 msgid "No keys available"

1 0

[translation/tor-messenger-otrproperties_completed] Update translations for tor-messenger-otrproperties_completed
by translation＠torproject.org 08 Apr '16

08 Apr '16

commit 77c2a9a51967e515f0f29ccbdac0ed584f5eb15a Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 8 04:16:57 2016 +0000 Update translations for tor-messenger-otrproperties_completed --- zh_HK/otr.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zh_HK/otr.properties b/zh_HK/otr.properties index ed414b0..ec94b23 100644 --- a/zh_HK/otr.properties +++ b/zh_HK/otr.properties @@ -23,7 +23,7 @@ error.unreadable=你傳送咗一個無法閱讀嘅加密訊息。 error.malformed=你傳送咗一個有格式錯誤嘅訊息。 resent=[重發] tlv.disconnected=%S已終止與你嘅私人通訊；你也應該終止此通訊。 -query.msg=%S要求唔記錄私人通訊，但是你無支援呢種通訊嘅外掛。更多資訊，請參閱 http://otr.cypherpunks.ca/ 。 +query.msg=%S要求唔記錄私人通訊，但係你無支援呢種通訊嘅外掛。更多資訊，請參閱 http://otr.cypherpunks.ca/ 。 trust.unused=未使用\n trust.not_private=非私人 trust.unverified=未驗證

1 0