- tor-commits - lists.torproject.org

[flashproxy/master] Whitespace.
by dcf＠torproject.org 03 May '12

03 May '12

commit 5318a46a611070ca35f121c337bea58bf8b7da58 Author: David Fifield <david(a)bamsoftware.com> Date: Thu May 3 00:28:23 2012 -0700 Whitespace. --- doc/websocket-transport.txt | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/doc/websocket-transport.txt b/doc/websocket-transport.txt index 65b4e9c..ad1eef5 100644 --- a/doc/websocket-transport.txt +++ b/doc/websocket-transport.txt @@ -93,11 +93,11 @@ Examples Here are examples of WebSocket handshakes and the beginning of data transfer. The data is the beginning of a Tor connection (i.e., it - begins with a TLS handshake). Data are shown using C string syntax. "> - " at the beginning of a line indicates client-to-server communication; - "< " is server-to-client. "[...]" indicates contents omitted for - brevity. Newlines in the presentation are not significant. This - section is non-normative. + begins with a TLS handshake). Data are shown using C string syntax. + "> " at the beginning of a line indicates client-to-server + communication; "< " is server-to-client. "[...]" indicates contents + omitted for brevity. Newlines in the presentation are not significant. + This section is non-normative. Using "hybi"/RFC 6455 WebSocket with binary frames:

1 0

[flashproxy/master] Wording on buffering.
by dcf＠torproject.org 03 May '12

03 May '12

commit b7bd6a2338a32fd70e5068cf2d61c01537f939e9 Author: David Fifield <david(a)bamsoftware.com> Date: Thu May 3 00:24:44 2012 -0700 Wording on buffering. --- doc/websocket-transport.txt | 13 ++++++------- 1 files changed, 6 insertions(+), 7 deletions(-) diff --git a/doc/websocket-transport.txt b/doc/websocket-transport.txt index 45de461..65b4e9c 100644 --- a/doc/websocket-transport.txt +++ b/doc/websocket-transport.txt @@ -176,13 +176,12 @@ Considerations specific to pluggable transports messages SHOULD be sent in a single frame. Endpoints MUST limit the size of messages and frames that they will - buffer. Upon receiving such a message (when the sum of the length of - already-buffered data and the length of the next frame exceeds the - limit), the endpoint MUST close the connection and SHOULD do so with a - status code of 1009 (see RFC 6455 section 7.4.1). Endpoints MUST be - capable of receiving messages containing 1500 octets of binary data; - this may require buffering up to 2026 bytes of UTF-8–encoded base64 - text. + buffer. When the sum of the length of already-buffered data and the + length of the next frame exceeds the limit, the endpoint MUST close + the connection and SHOULD do so with a status code of 1009 (see RFC + 6455 section 7.4.1). Endpoints MUST be capable of receiving messages + containing up to 1500 octets of binary data; this may require + buffering up to 2026 bytes of UTF-8–encoded base64 text. Questions/extensions

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 03 May '12

03 May '12

commit dd8a108b8a9077475a9f4f31c2c80c988fa38550 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 3 06:45:26 2012 +0000 Update translations for https_everywhere --- ko/https-everywhere.dtd | 38 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 38 insertions(+), 0 deletions(-) diff --git a/ko/https-everywhere.dtd b/ko/https-everywhere.dtd new file mode 100644 index 0000000..d4166f3 --- /dev/null +++ b/ko/https-everywhere.dtd @@ -0,0 +1,38 @@ +<!ENTITY https-everywhere.about.title "HTTPS Everywhere에 대하여 +"> +<!ENTITY https-everywhere.about.ext_name "HTTPS Everywhere"> +<!ENTITY https-everywhere.about.ext_description ""> +<!ENTITY https-everywhere.about.version "Version"> +<!ENTITY https-everywhere.about.created_by ""> +<!ENTITY https-everywhere.about.librarians ""> +<!ENTITY https-everywhere.about.thanks ""> +<!ENTITY https-everywhere.about.contribute ""> +<!ENTITY https-everywhere.about.donate_tor ""> +<!ENTITY https-everywhere.about.tor_lang_code ""> +<!ENTITY https-everywhere.about.donate_eff ""> + +<!ENTITY https-everywhere.menu.about ""> +<!ENTITY https-everywhere.menu.observatory ""> +<!ENTITY https-everywhere.menu.globalEnable ""> +<!ENTITY https-everywhere.menu.globalDisable ""> + +<!ENTITY https-everywhere.prefs.title ""> +<!ENTITY https-everywhere.prefs.enable_all ""> +<!ENTITY https-everywhere.prefs.disable_all ""> +<!ENTITY https-everywhere.prefs.reset_defaults ""> +<!ENTITY https-everywhere.prefs.search ""> +<!ENTITY https-everywhere.prefs.site ""> +<!ENTITY https-everywhere.prefs.notes ""> +<!ENTITY https-everywhere.prefs.list_caption ""> +<!ENTITY https-everywhere.prefs.enabled ""> +<!ENTITY https-everywhere.prefs.ruleset_howto ""> +<!ENTITY https-everywhere.prefs.here_link ""> +<!ENTITY https-everywhere.prefs.toggle ""> +<!ENTITY https-everywhere.prefs.reset_default ""> +<!ENTITY https-everywhere.prefs.view_xml_source ""> + +<!ENTITY https-everywhere.source.downloading ""> +<!ENTITY https-everywhere.source.filename ""> +<!ENTITY https-everywhere.source.unable_to_download ""> + +

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 02 May '12

02 May '12

commit b7c9ca1369de09a244b0af8c8cbc06d53e26aad7 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 3 02:15:28 2012 +0000 Update translations for https_everywhere --- eo/https-everywhere.dtd | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) diff --git a/eo/https-everywhere.dtd b/eo/https-everywhere.dtd index 5933a1c..848a195 100644 --- a/eo/https-everywhere.dtd +++ b/eo/https-everywhere.dtd @@ -5,10 +5,10 @@ <!ENTITY https-everywhere.about.created_by "Kreita de"> <!ENTITY https-everywhere.about.librarians ""> <!ENTITY https-everywhere.about.thanks "Dankon al"> -<!ENTITY https-everywhere.about.contribute ""> -<!ENTITY https-everywhere.about.donate_tor ""> -<!ENTITY https-everywhere.about.tor_lang_code ""> -<!ENTITY https-everywhere.about.donate_eff ""> +<!ENTITY https-everywhere.about.contribute "Se vi volas "HTTPS Everywhere", vi devus konsideri"> +<!ENTITY https-everywhere.about.donate_tor "Donacante al Tor"> +<!ENTITY https-everywhere.about.tor_lang_code "en"> +<!ENTITY https-everywhere.about.donate_eff "Donacante al EFF"> <!ENTITY https-everywhere.menu.about "Pri HTTPS Everywhere"> <!ENTITY https-everywhere.menu.observatory ""> @@ -21,7 +21,7 @@ <!ENTITY https-everywhere.prefs.reset_defaults ""> <!ENTITY https-everywhere.prefs.search "Serĉi"> <!ENTITY https-everywhere.prefs.site "Retejo"> -<!ENTITY https-everywhere.prefs.notes "Rimarko"> +<!ENTITY https-everywhere.prefs.notes "Rimarkoj"> <!ENTITY https-everywhere.prefs.list_caption ""> <!ENTITY https-everywhere.prefs.enabled "Ŝaltita"> <!ENTITY https-everywhere.prefs.ruleset_howto ""> @@ -30,8 +30,8 @@ <!ENTITY https-everywhere.prefs.reset_default ""> <!ENTITY https-everywhere.prefs.view_xml_source ""> -<!ENTITY https-everywhere.source.downloading ""> -<!ENTITY https-everywhere.source.filename ""> -<!ENTITY https-everywhere.source.unable_to_download ""> +<!ENTITY https-everywhere.source.downloading "Elŝutante"> +<!ENTITY https-everywhere.source.filename "Arĥivonomo"> +<!ENTITY https-everywhere.source.unable_to_download "Ne eblas elŝuti la arĥivon">

1 0

[torbrowser/master] Add patch for #5741.
by mikeperry＠torproject.org 02 May '12

02 May '12

commit acaa131ffbc78c4355e49b7476941a1ad2c9da51 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:57:33 2012 -0700 Add patch for #5741. --- .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-) diff --git a/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch new file mode 100644 index 0000000..9b30987 --- /dev/null +++ b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch @@ -0,0 +1,132 @@ +From 93199734c06485660fb922c61f740191648a6dc6 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Wed, 2 May 2012 17:44:39 -0700 +Subject: [PATCH 18/18] Prevent WebSocket DNS leak. + +This is due to an improper implementation of the WebSocket spec by Mozilla. + +"There MUST be no more than one connection in a CONNECTING state. If multiple +connections to the same IP address are attempted simultaneously, the client +MUST serialize them so that there is no more than one connection at a time +running through the following steps. + +If the client cannot determine the IP address of the remote host (for +example, because all communication is being done through a proxy server that +performs DNS queries itself), then the client MUST assume for the purposes of +this step that each host name refers to a distinct remote host," + +https://tools.ietf.org/html/rfc6455#page-15 + +They implmented the first paragraph, but not the second... + +While we're at it, we also prevent the DNS service from being used to look up +anything other than IP addresses if socks_remote_dns is set to true, so this +bug can't turn up in other components or due to 3rd party addons. +--- + netwerk/dns/nsDNSService2.cpp | 24 ++++++++++++++++++++++- + netwerk/dns/nsDNSService2.h | 1 + + netwerk/protocol/websocket/WebSocketChannel.cpp | 8 +++++- + 3 files changed, 30 insertions(+), 3 deletions(-) + +diff --git a/netwerk/dns/nsDNSService2.cpp b/netwerk/dns/nsDNSService2.cpp +index 1bd5f38..eda0e48 100644 +--- a/netwerk/dns/nsDNSService2.cpp ++++ b/netwerk/dns/nsDNSService2.cpp +@@ -404,6 +404,7 @@ nsDNSService::Init() + bool enableIDN = true; + bool disableIPv6 = false; + bool disablePrefetch = false; ++ bool disableDNS = false; + int proxyType = nsIProtocolProxyService::PROXYCONFIG_DIRECT; + + nsAdoptingCString ipv4OnlyDomains; +@@ -427,6 +428,10 @@ nsDNSService::Init() + + // If a manual proxy is in use, disable prefetch implicitly + prefs->GetIntPref("network.proxy.type", &proxyType); ++ ++ // If the user wants remote DNS, we should fail any lookups that still ++ // make it here. ++ prefs->GetBoolPref("network.proxy.socks_remote_dns", &disableDNS); + } + + if (mFirstTime) { +@@ -444,7 +449,7 @@ nsDNSService::Init() + + // Monitor these to see if there is a change in proxy configuration + // If a manual proxy is in use, disable prefetch implicitly +- prefs->AddObserver("network.proxy.type", this, false); ++ prefs->AddObserver("network.proxy.", this, false); + } + } + +@@ -473,6 +478,7 @@ nsDNSService::Init() + mIDN = idn; + mIPv4OnlyDomains = ipv4OnlyDomains; // exchanges buffer ownership + mDisableIPv6 = disableIPv6; ++ mDisableDNS = disableDNS; + + // Disable prefetching either by explicit preference or if a manual proxy is configured + mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL); +@@ -584,6 +590,14 @@ nsDNSService::AsyncResolve(const nsACString &hostname, + if (mDisablePrefetch && (flags & RESOLVE_SPECULATE)) + return NS_ERROR_DNS_LOOKUP_QUEUE_FULL; + ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } ++ + res = mResolver; + idn = mIDN; + } +@@ -670,6 +684,14 @@ nsDNSService::Resolve(const nsACString &hostname, + MutexAutoLock lock(mLock); + res = mResolver; + idn = mIDN; ++ ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } + } + NS_ENSURE_TRUE(res, NS_ERROR_OFFLINE); + +diff --git a/netwerk/dns/nsDNSService2.h b/netwerk/dns/nsDNSService2.h +index 1749b41..3ec8eba 100644 +--- a/netwerk/dns/nsDNSService2.h ++++ b/netwerk/dns/nsDNSService2.h +@@ -70,4 +70,5 @@ private: + bool mDisableIPv6; + bool mDisablePrefetch; + bool mFirstTime; ++ bool mDisableDNS; + }; +diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp +index 22873d3..0875c12 100644 +--- a/netwerk/protocol/websocket/WebSocketChannel.cpp ++++ b/netwerk/protocol/websocket/WebSocketChannel.cpp +@@ -1875,8 +1875,12 @@ WebSocketChannel::ApplyForAdmission() + LOG(("WebSocketChannel::ApplyForAdmission: checking for concurrent open\n")); + nsCOMPtr<nsIThread> mainThread; + NS_GetMainThread(getter_AddRefs(mainThread)); +- dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); +- NS_ENSURE_SUCCESS(rv, rv); ++ rv = dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); ++ if (NS_FAILED(rv)) { ++ // Fall back to hostname on dispatch failure ++ mDNSRequest = nsnull; ++ OnLookupComplete(nsnull, nsnull, rv); ++ } + + return NS_OK; + } +-- +1.7.5.4 +

1 0

[torbrowser/master] Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3
by mikeperry＠torproject.org 02 May '12

02 May '12

commit 21d3ebcdc1eeb5dcbe2725ee6c0b08ec17228c32 Merge: ea18a10 acaa131 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:58:45 2012 -0700 Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3 .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-)

1 0

[torbrowser/maint-2.3] Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3
by mikeperry＠torproject.org 02 May '12

02 May '12

commit 21d3ebcdc1eeb5dcbe2725ee6c0b08ec17228c32 Merge: ea18a10 acaa131 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:58:45 2012 -0700 Merge remote-tracking branch 'origin/maint-2.2' into maint-2.3 .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-)

1 0

[torbrowser/maint-2.3] Add patch for #5741.
by mikeperry＠torproject.org 02 May '12

02 May '12

commit acaa131ffbc78c4355e49b7476941a1ad2c9da51 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:57:33 2012 -0700 Add patch for #5741. --- .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-) diff --git a/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch new file mode 100644 index 0000000..9b30987 --- /dev/null +++ b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch @@ -0,0 +1,132 @@ +From 93199734c06485660fb922c61f740191648a6dc6 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Wed, 2 May 2012 17:44:39 -0700 +Subject: [PATCH 18/18] Prevent WebSocket DNS leak. + +This is due to an improper implementation of the WebSocket spec by Mozilla. + +"There MUST be no more than one connection in a CONNECTING state. If multiple +connections to the same IP address are attempted simultaneously, the client +MUST serialize them so that there is no more than one connection at a time +running through the following steps. + +If the client cannot determine the IP address of the remote host (for +example, because all communication is being done through a proxy server that +performs DNS queries itself), then the client MUST assume for the purposes of +this step that each host name refers to a distinct remote host," + +https://tools.ietf.org/html/rfc6455#page-15 + +They implmented the first paragraph, but not the second... + +While we're at it, we also prevent the DNS service from being used to look up +anything other than IP addresses if socks_remote_dns is set to true, so this +bug can't turn up in other components or due to 3rd party addons. +--- + netwerk/dns/nsDNSService2.cpp | 24 ++++++++++++++++++++++- + netwerk/dns/nsDNSService2.h | 1 + + netwerk/protocol/websocket/WebSocketChannel.cpp | 8 +++++- + 3 files changed, 30 insertions(+), 3 deletions(-) + +diff --git a/netwerk/dns/nsDNSService2.cpp b/netwerk/dns/nsDNSService2.cpp +index 1bd5f38..eda0e48 100644 +--- a/netwerk/dns/nsDNSService2.cpp ++++ b/netwerk/dns/nsDNSService2.cpp +@@ -404,6 +404,7 @@ nsDNSService::Init() + bool enableIDN = true; + bool disableIPv6 = false; + bool disablePrefetch = false; ++ bool disableDNS = false; + int proxyType = nsIProtocolProxyService::PROXYCONFIG_DIRECT; + + nsAdoptingCString ipv4OnlyDomains; +@@ -427,6 +428,10 @@ nsDNSService::Init() + + // If a manual proxy is in use, disable prefetch implicitly + prefs->GetIntPref("network.proxy.type", &proxyType); ++ ++ // If the user wants remote DNS, we should fail any lookups that still ++ // make it here. ++ prefs->GetBoolPref("network.proxy.socks_remote_dns", &disableDNS); + } + + if (mFirstTime) { +@@ -444,7 +449,7 @@ nsDNSService::Init() + + // Monitor these to see if there is a change in proxy configuration + // If a manual proxy is in use, disable prefetch implicitly +- prefs->AddObserver("network.proxy.type", this, false); ++ prefs->AddObserver("network.proxy.", this, false); + } + } + +@@ -473,6 +478,7 @@ nsDNSService::Init() + mIDN = idn; + mIPv4OnlyDomains = ipv4OnlyDomains; // exchanges buffer ownership + mDisableIPv6 = disableIPv6; ++ mDisableDNS = disableDNS; + + // Disable prefetching either by explicit preference or if a manual proxy is configured + mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL); +@@ -584,6 +590,14 @@ nsDNSService::AsyncResolve(const nsACString &hostname, + if (mDisablePrefetch && (flags & RESOLVE_SPECULATE)) + return NS_ERROR_DNS_LOOKUP_QUEUE_FULL; + ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } ++ + res = mResolver; + idn = mIDN; + } +@@ -670,6 +684,14 @@ nsDNSService::Resolve(const nsACString &hostname, + MutexAutoLock lock(mLock); + res = mResolver; + idn = mIDN; ++ ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } + } + NS_ENSURE_TRUE(res, NS_ERROR_OFFLINE); + +diff --git a/netwerk/dns/nsDNSService2.h b/netwerk/dns/nsDNSService2.h +index 1749b41..3ec8eba 100644 +--- a/netwerk/dns/nsDNSService2.h ++++ b/netwerk/dns/nsDNSService2.h +@@ -70,4 +70,5 @@ private: + bool mDisableIPv6; + bool mDisablePrefetch; + bool mFirstTime; ++ bool mDisableDNS; + }; +diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp +index 22873d3..0875c12 100644 +--- a/netwerk/protocol/websocket/WebSocketChannel.cpp ++++ b/netwerk/protocol/websocket/WebSocketChannel.cpp +@@ -1875,8 +1875,12 @@ WebSocketChannel::ApplyForAdmission() + LOG(("WebSocketChannel::ApplyForAdmission: checking for concurrent open\n")); + nsCOMPtr<nsIThread> mainThread; + NS_GetMainThread(getter_AddRefs(mainThread)); +- dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); +- NS_ENSURE_SUCCESS(rv, rv); ++ rv = dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); ++ if (NS_FAILED(rv)) { ++ // Fall back to hostname on dispatch failure ++ mDNSRequest = nsnull; ++ OnLookupComplete(nsnull, nsnull, rv); ++ } + + return NS_OK; + } +-- +1.7.5.4 +

1 0

[torbrowser/maint-2.2] Add patch for #5741.
by mikeperry＠torproject.org 02 May '12

02 May '12

commit acaa131ffbc78c4355e49b7476941a1ad2c9da51 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed May 2 17:57:33 2012 -0700 Add patch for #5741. --- .../firefox/0018-Prevent-WebSocket-DNS-leak.patch | 132 ++++++++++++++++++++ 1 files changed, 132 insertions(+), 0 deletions(-) diff --git a/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch new file mode 100644 index 0000000..9b30987 --- /dev/null +++ b/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch @@ -0,0 +1,132 @@ +From 93199734c06485660fb922c61f740191648a6dc6 Mon Sep 17 00:00:00 2001 +From: Mike Perry <mikeperry-git(a)torproject.org> +Date: Wed, 2 May 2012 17:44:39 -0700 +Subject: [PATCH 18/18] Prevent WebSocket DNS leak. + +This is due to an improper implementation of the WebSocket spec by Mozilla. + +"There MUST be no more than one connection in a CONNECTING state. If multiple +connections to the same IP address are attempted simultaneously, the client +MUST serialize them so that there is no more than one connection at a time +running through the following steps. + +If the client cannot determine the IP address of the remote host (for +example, because all communication is being done through a proxy server that +performs DNS queries itself), then the client MUST assume for the purposes of +this step that each host name refers to a distinct remote host," + +https://tools.ietf.org/html/rfc6455#page-15 + +They implmented the first paragraph, but not the second... + +While we're at it, we also prevent the DNS service from being used to look up +anything other than IP addresses if socks_remote_dns is set to true, so this +bug can't turn up in other components or due to 3rd party addons. +--- + netwerk/dns/nsDNSService2.cpp | 24 ++++++++++++++++++++++- + netwerk/dns/nsDNSService2.h | 1 + + netwerk/protocol/websocket/WebSocketChannel.cpp | 8 +++++- + 3 files changed, 30 insertions(+), 3 deletions(-) + +diff --git a/netwerk/dns/nsDNSService2.cpp b/netwerk/dns/nsDNSService2.cpp +index 1bd5f38..eda0e48 100644 +--- a/netwerk/dns/nsDNSService2.cpp ++++ b/netwerk/dns/nsDNSService2.cpp +@@ -404,6 +404,7 @@ nsDNSService::Init() + bool enableIDN = true; + bool disableIPv6 = false; + bool disablePrefetch = false; ++ bool disableDNS = false; + int proxyType = nsIProtocolProxyService::PROXYCONFIG_DIRECT; + + nsAdoptingCString ipv4OnlyDomains; +@@ -427,6 +428,10 @@ nsDNSService::Init() + + // If a manual proxy is in use, disable prefetch implicitly + prefs->GetIntPref("network.proxy.type", &proxyType); ++ ++ // If the user wants remote DNS, we should fail any lookups that still ++ // make it here. ++ prefs->GetBoolPref("network.proxy.socks_remote_dns", &disableDNS); + } + + if (mFirstTime) { +@@ -444,7 +449,7 @@ nsDNSService::Init() + + // Monitor these to see if there is a change in proxy configuration + // If a manual proxy is in use, disable prefetch implicitly +- prefs->AddObserver("network.proxy.type", this, false); ++ prefs->AddObserver("network.proxy.", this, false); + } + } + +@@ -473,6 +478,7 @@ nsDNSService::Init() + mIDN = idn; + mIPv4OnlyDomains = ipv4OnlyDomains; // exchanges buffer ownership + mDisableIPv6 = disableIPv6; ++ mDisableDNS = disableDNS; + + // Disable prefetching either by explicit preference or if a manual proxy is configured + mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL); +@@ -584,6 +590,14 @@ nsDNSService::AsyncResolve(const nsACString &hostname, + if (mDisablePrefetch && (flags & RESOLVE_SPECULATE)) + return NS_ERROR_DNS_LOOKUP_QUEUE_FULL; + ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } ++ + res = mResolver; + idn = mIDN; + } +@@ -670,6 +684,14 @@ nsDNSService::Resolve(const nsACString &hostname, + MutexAutoLock lock(mLock); + res = mResolver; + idn = mIDN; ++ ++ PRNetAddr tempAddr; ++ if (mDisableDNS) { ++ // Allow IP lookups through, but nothing else. ++ if (PR_StringToNetAddr(hostname.BeginReading(), &tempAddr) != PR_SUCCESS) { ++ return NS_ERROR_UNKNOWN_PROXY_HOST; // XXX: NS_ERROR_NOT_IMPLEMENTED? ++ } ++ } + } + NS_ENSURE_TRUE(res, NS_ERROR_OFFLINE); + +diff --git a/netwerk/dns/nsDNSService2.h b/netwerk/dns/nsDNSService2.h +index 1749b41..3ec8eba 100644 +--- a/netwerk/dns/nsDNSService2.h ++++ b/netwerk/dns/nsDNSService2.h +@@ -70,4 +70,5 @@ private: + bool mDisableIPv6; + bool mDisablePrefetch; + bool mFirstTime; ++ bool mDisableDNS; + }; +diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp +index 22873d3..0875c12 100644 +--- a/netwerk/protocol/websocket/WebSocketChannel.cpp ++++ b/netwerk/protocol/websocket/WebSocketChannel.cpp +@@ -1875,8 +1875,12 @@ WebSocketChannel::ApplyForAdmission() + LOG(("WebSocketChannel::ApplyForAdmission: checking for concurrent open\n")); + nsCOMPtr<nsIThread> mainThread; + NS_GetMainThread(getter_AddRefs(mainThread)); +- dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); +- NS_ENSURE_SUCCESS(rv, rv); ++ rv = dns->AsyncResolve(hostName, 0, this, mainThread, getter_AddRefs(mDNSRequest)); ++ if (NS_FAILED(rv)) { ++ // Fall back to hostname on dispatch failure ++ mDNSRequest = nsnull; ++ OnLookupComplete(nsnull, nsnull, rv); ++ } + + return NS_OK; + } +-- +1.7.5.4 +

1 0

[flashproxy/master] Look for flashproxy-reg-http.py in the same directory as connector.py.
by dcf＠torproject.org 02 May '12

02 May '12

commit fbf164eb542e4d9a29ab66a3abd37ed588ba43cc Author: David Fifield <david(a)bamsoftware.com> Date: Wed May 2 13:54:18 2012 -0700 Look for flashproxy-reg-http.py in the same directory as connector.py. --- connector.py | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/connector.py b/connector.py index 3e2bfd9..8a2b7e1 100755 --- a/connector.py +++ b/connector.py @@ -605,8 +605,13 @@ def register(): if not options.register: return + # sys.path[0] is initialized to the directory containing the Python script file. + script_dir = sys.path[0] + if not script_dir: + # Maybe the script was read from stdin; in any case don't guess at the directory. + return + command = [os.path.join(script_dir, "flashproxy-reg-http.py")] spec = format_addr((None, options.remote_addr[1])) - command = ["./flashproxy-reg-http.py"] if options.facilitator_addr is None: log(u"Registering \"%s\"." % spec) else:

1 0