- tor-commits - lists.torproject.org

[torbrowser/master] Merge branches 'firefox-6.0.1' and 'maint-2.2' into maint-2.2
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit a9695967ea91ee70f3b20ffe2f19c6442187d3c6 Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Sep 4 22:06:25 2011 +0100 Merge branches 'firefox-6.0.1' and 'maint-2.2' into maint-2.2

1 0

[torbrowser/master] remove the current-patches exclusion from our source tarball creation, since it has all of our firefox patches which people might want if they want to build tbb from scratch (closes: #3904)
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit f5f2dd950d8b9d54622913beba9069b2ecbb5be3 Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Sep 4 00:34:42 2011 +0100 remove the current-patches exclusion from our source tarball creation, since it has all of our firefox patches which people might want if they want to build tbb from scratch (closes: #3904) --- build-scripts/windows.mk | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/build-scripts/windows.mk b/build-scripts/windows.mk index 72909dd..200237b 100644 --- a/build-scripts/windows.mk +++ b/build-scripts/windows.mk @@ -474,6 +474,5 @@ srcdist: git clone -b maint-2.2 git://git.torproject.org/torbrowser.git \ $(SRCDESTPATH) cd $(SRCDEST); tar --exclude src/archived-patches \ - --exclude src/current-patches --exclude src/processtest \ - --exclude .git -czvf $(SRCNAME)-src.tar.gz $(SRCNAME) + --exclude src/processtest --exclude .git -czvf $(SRCNAME)-src.tar.gz $(SRCNAME)

1 0

[torbrowser/master] bump firefox to 6.0.2 and torbutton to 1.4.2
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit 46ab669999130dd7db6129ffd293cf878eec49e5 Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Sep 4 13:25:21 2011 +0100 bump firefox to 6.0.2 and torbutton to 1.4.2 --- build-scripts/versions.mk | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 666b28a..f2f3288 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -3,7 +3,7 @@ RELEASE_VER=2.2.32 HTTPSEVERY_VER=1.0.0development.5 -FIREFOX_VER=6.0.1 +FIREFOX_VER=6.0.2 LIBEVENT_VER=2.0.14-stable LIBPNG_VER=1.4.3 NOSCRIPT_VER=2.1.2.6 @@ -13,7 +13,7 @@ PIDGIN_VER=2.6.4 POLIPO_VER=1.0.4.1 QT_VER=4.6.2 TOR_VER=0.2.2.32 -TORBUTTON_VER=1.4.1 +TORBUTTON_VER=1.4.2 VIDALIA_VER=0.2.14 ZLIB_VER=1.4.0

1 0

[torbrowser/master] Clean up branch after accidental double-merge.
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit 0fb22986acb9e3f63296bbca0cba67964cbe71a0 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Sun Sep 4 14:55:24 2011 -0700 Clean up branch after accidental double-merge. I knew I should have deleted those old branches :/. --- ...th-headers-before-the-modify-request-obse.patch | 51 ------------ .../0007-Add-a-string-based-cacheKey.patch | 85 -------------------- src/current-patches/0007-Smash-the-state.patch | 37 --------- 3 files changed, 0 insertions(+), 173 deletions(-) diff --git a/src/current-patches/0006-Add-HTTP-auth-headers-before-the-modify-request-obse.patch b/src/current-patches/0006-Add-HTTP-auth-headers-before-the-modify-request-obse.patch deleted file mode 100644 index 3f270d6..0000000 --- a/src/current-patches/0006-Add-HTTP-auth-headers-before-the-modify-request-obse.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 8c2bf692deecb4efbfd2e9c4eba1d702b89a0f05 Mon Sep 17 00:00:00 2001 -From: Mike Perry <mikeperry-git(a)fscked.org> -Date: Fri, 2 Sep 2011 15:33:20 -0700 -Subject: [PATCH 6/6] Add HTTP auth headers before the modify-request observer. - -Otherwise, how are we supposed to modify them? - -Thanks to Georg Koppen for spotting both the problem and this fix. ---- - netwerk/protocol/http/nsHttpChannel.cpp | 11 +++++++---- - 1 files changed, 7 insertions(+), 4 deletions(-) - -diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index 7038338..7a3254e 100644 ---- a/netwerk/protocol/http/nsHttpChannel.cpp -+++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -311,9 +311,6 @@ nsHttpChannel::Connect(PRBool firstTime) - return NS_ERROR_DOCUMENT_NOT_CACHED; - } - -- // check to see if authorization headers should be included -- mAuthProvider->AddAuthorizationHeaders(); -- - if (mLoadFlags & LOAD_NO_NETWORK_IO) { - return NS_ERROR_DOCUMENT_NOT_CACHED; - } -@@ -3687,6 +3684,9 @@ nsHttpChannel::AsyncOpen(nsIStreamListener *listener, nsISupports *context) - - AddCookiesToRequest(); - -+ // check to see if authorization headers should be included -+ mAuthProvider->AddAuthorizationHeaders(); -+ - // notify "http-on-modify-request" observers - gHttpHandler->OnModifyRequest(this); - -@@ -4758,7 +4758,10 @@ nsHttpChannel::DoAuthRetry(nsAHttpConnection *conn) - // this authentication attempt (bug 84794). - // TODO: save cookies from auth response and send them here (bug 572151). - AddCookiesToRequest(); -- -+ -+ // check to see if authorization headers should be included -+ mAuthProvider->AddAuthorizationHeaders(); -+ - // notify "http-on-modify-request" observers - gHttpHandler->OnModifyRequest(this); - --- -1.7.3.4 - diff --git a/src/current-patches/0007-Add-a-string-based-cacheKey.patch b/src/current-patches/0007-Add-a-string-based-cacheKey.patch deleted file mode 100644 index 1e0dd0e..0000000 --- a/src/current-patches/0007-Add-a-string-based-cacheKey.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 62e7c05519aae2d515d8872525411b8fb4ff02a6 Mon Sep 17 00:00:00 2001 -From: Mike Perry <mikeperry-git(a)fscked.org> -Date: Fri, 2 Sep 2011 20:47:02 -0700 -Subject: [PATCH 7/7] Add a string-based cacheKey. - -Used for isolating cache according to same-origin policy. ---- - netwerk/base/public/nsICachingChannel.idl | 7 +++++++ - netwerk/protocol/http/nsHttpChannel.cpp | 22 ++++++++++++++++++++++ - netwerk/protocol/http/nsHttpChannel.h | 1 + - 3 files changed, 30 insertions(+), 0 deletions(-) - -diff --git a/netwerk/base/public/nsICachingChannel.idl b/netwerk/base/public/nsICachingChannel.idl -index 2da46d6..4ee5774 100644 ---- a/netwerk/base/public/nsICachingChannel.idl -+++ b/netwerk/base/public/nsICachingChannel.idl -@@ -98,6 +98,13 @@ interface nsICachingChannel : nsICacheInfoChannel - attribute nsISupports cacheKey; - - /** -+ * Set/get the cache domain... uniquely identifies the data in the cache -+ * for this channel. Holding a reference to this key does NOT prevent -+ * the cached data from being removed. -+ */ -+ attribute AUTF8String cacheDomain; -+ -+ /** - * Specifies whether or not the data should be cached to a file. This - * may fail if the disk cache is not present. The value of this attribute - * is usually only settable during the processing of a channel's -diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp -index 7a3254e..cef5eaa 100644 ---- a/netwerk/protocol/http/nsHttpChannel.cpp -+++ b/netwerk/protocol/http/nsHttpChannel.cpp -@@ -2379,6 +2379,12 @@ nsHttpChannel::AssembleCacheKey(const char *spec, PRUint32 postID, - cacheKey.Append(buf); - } - -+ if (strlen(mCacheDomain.get()) > 0) { -+ cacheKey.AppendLiteral("domain="); -+ cacheKey.Append(mCacheDomain.get()); -+ cacheKey.AppendLiteral("&"); -+ } -+ - if (!cacheKey.IsEmpty()) { - cacheKey.AppendLiteral("uri="); - } -@@ -4658,6 +4664,22 @@ nsHttpChannel::SetCacheForOfflineUse(PRBool value) - } - - NS_IMETHODIMP -+nsHttpChannel::GetCacheDomain(nsACString &value) -+{ -+ value = mCacheDomain; -+ -+ return NS_OK; -+} -+ -+NS_IMETHODIMP -+nsHttpChannel::SetCacheDomain(const nsACString &value) -+{ -+ mCacheDomain = value; -+ -+ return NS_OK; -+} -+ -+NS_IMETHODIMP - nsHttpChannel::GetOfflineCacheClientID(nsACString &value) - { - value = mOfflineCacheClientID; -diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h -index dd0d7f4..f5016a8 100644 ---- a/netwerk/protocol/http/nsHttpChannel.h -+++ b/netwerk/protocol/http/nsHttpChannel.h -@@ -312,6 +312,7 @@ private: - nsCOMPtr<nsICacheEntryDescriptor> mOfflineCacheEntry; - nsCacheAccessMode mOfflineCacheAccess; - nsCString mOfflineCacheClientID; -+ nsCString mCacheDomain; - - // auth specific data - nsCOMPtr<nsIHttpChannelAuthProvider> mAuthProvider; --- -1.7.3.4 - diff --git a/src/current-patches/0007-Smash-the-state.patch b/src/current-patches/0007-Smash-the-state.patch deleted file mode 100644 index 16b03ea..0000000 --- a/src/current-patches/0007-Smash-the-state.patch +++ /dev/null @@ -1,37 +0,0 @@ -From b6b74cdac09ed294ea1b965e39e4e9ae64c5cbd8 Mon Sep 17 00:00:00 2001 -From: Mike Perry <mikeperry-git(a)fscked.org> -Date: Sat, 3 Sep 2011 03:00:26 -0700 -Subject: [PATCH 7/7] Smash the state. - -What happened to you, Nederlanden? You used to be cool. - -This exemption is insecure as-is anyway, because we have no way of verifying -that DigiNotar wasn't compromised enough to allow the attacker to sign -certificates with an issuer string matching this exemption. The adversary -would then be able to create a chain of Entrust -> DigiNotar -> "Staat der -Nederlanden" -> *.torproject.org or *.google.com. ---- - security/manager/ssl/src/nsNSSCallbacks.cpp | 7 ------- - 1 files changed, 0 insertions(+), 7 deletions(-) - -diff --git a/security/manager/ssl/src/nsNSSCallbacks.cpp b/security/manager/ssl/src/nsNSSCallbacks.cpp -index 5e3a888..43e1c19 100644 ---- a/security/manager/ssl/src/nsNSSCallbacks.cpp -+++ b/security/manager/ssl/src/nsNSSCallbacks.cpp -@@ -1065,13 +1065,6 @@ PSM_SSL_BlacklistDigiNotar(CERTCertificate * serverCert, - } - } - } -- -- // By request of the Dutch government -- if (!strcmp(node->cert->issuerName, -- "CN=Staat der Nederlanden Root CA,O=Staat der Nederlanden,C=NL") && -- CERT_LIST_END(CERT_LIST_NEXT(node), serverCertChain)) { -- return 0; -- } - } - - if (isDigiNotarIssuedCert) --- -1.7.3.4 -

1 0

[torbrowser/master] [Linux] Stop shipping libcrypto.a and libssl.a in TBB for Linux
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit 07d32eaaade14ad0a24ea9f6c05ef8f5c9b5994d Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Aug 24 04:54:17 2011 -0400 [Linux] Stop shipping libcrypto.a and libssl.a in TBB for Linux The .a files are never used at runtime -- they are only used when statically linking a program. --- build-scripts/linux.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/build-scripts/linux.mk b/build-scripts/linux.mk index 1df7377..1b6aa12 100644 --- a/build-scripts/linux.mk +++ b/build-scripts/linux.mk @@ -288,7 +288,7 @@ install-binaries: # libpng cp -d $(LIBPNG)/libpng14.so* $(LIBSDIR) # OpenSSL - cp -d $(OPENSSL)/libcrypto.a $(OPENSSL)/libssl.a $(OPENSSL)/libssl.so* $(OPENSSL)/libcrypto.so* $(LIBSDIR) + cp -d $(OPENSSL)/libssl.so* $(OPENSSL)/libcrypto.so* $(LIBSDIR) # Vidalia cp $(VIDALIA) $(APPDIR) cp $(TOR) $(APPDIR)

1 0

[torbrowser/master] give all bundles pipelining prefs in prefs.js
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit e47a7e529eb36627d3d6fc0f23c33cdc1be3c281 Author: Erinn Clark <erinn(a)torproject.org> Date: Mon Sep 5 00:37:49 2011 +0100 give all bundles pipelining prefs in prefs.js --- build-scripts/config/no-polipo-4.0.js | 4 ++++ build-scripts/config/windows-4.0.js | 4 ++++ 2 files changed, 8 insertions(+), 0 deletions(-) diff --git a/build-scripts/config/no-polipo-4.0.js b/build-scripts/config/no-polipo-4.0.js index ae792bd..908402d 100644 --- a/build-scripts/config/no-polipo-4.0.js +++ b/build-scripts/config/no-polipo-4.0.js @@ -99,6 +99,10 @@ user_pref("intl.charsetmenu.browser.cache", "UTF-8"); user_pref("network.cookie.cookieBehavior", 1); user_pref("network.cookie.lifetimePolicy", 2); user_pref("network.cookie.prefsMigrated", true); +user_pref("network.http.pipelining", true); +user_pref("network.http.pipelining.maxrequests", 10); +user_pref("network.http.pipelining.ssl", true); +user_pref("network.http.proxy.pipelining", true); user_pref("network.hosts.pop_server", ""); user_pref("network.protocol-handler.external-default", false); user_pref("network.protocol-handler.external.mailto", false); diff --git a/build-scripts/config/windows-4.0.js b/build-scripts/config/windows-4.0.js index 6330c6f..3029145 100644 --- a/build-scripts/config/windows-4.0.js +++ b/build-scripts/config/windows-4.0.js @@ -107,6 +107,10 @@ user_pref("intl.charsetmenu.browser.cache", "UTF-8"); user_pref("network.cookie.cookieBehavior", 1); user_pref("network.cookie.lifetimePolicy", 2); user_pref("network.cookie.prefsMigrated", true); +user_pref("network.http.pipelining", true); +user_pref("network.http.pipelining.maxrequests", 10); +user_pref("network.http.pipelining.ssl", true); +user_pref("network.http.proxy.pipelining", true); user_pref("network.hosts.pop_server", ""); user_pref("network.protocol-handler.external-default", false); user_pref("network.protocol-handler.external.mailto", false);

1 0

[torbrowser/master] Merge branch 'bug2525' into maint-2.2
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit c2be90ce4415e5253bce489e8efb35ec9d21602f Merge: 0fb2298 c9742f2 Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Sep 4 23:53:18 2011 +0100 Merge branch 'bug2525' into maint-2.2 src/RelativeLink/RelativeLink.sh | 31 +++++++++++++++++++++++-------- 1 files changed, 23 insertions(+), 8 deletions(-)

1 0

[torbrowser/master] Merge branches 'bug3907+3666' and 'maint-2.2' into maint-2.2
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit 85e212a588510ae80435096b0c95cdf03a924ab8 Merge: a969596 9e3fe9a Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Sep 4 22:12:45 2011 +0100 Merge branches 'bug3907+3666' and 'maint-2.2' into maint-2.2 src/archived-patches/0005-Smash-the-state.patch | 37 +++++++++ ...th-headers-before-the-modify-request-obse.patch | 51 ++++++++++++ .../0007-Add-a-string-based-cacheKey.patch | 85 ++++++++++++++++++++ 3 files changed, 173 insertions(+), 0 deletions(-) diff --cc src/archived-patches/0005-Smash-the-state.patch index 0000000,0000000..16b03ea new file mode 100644 --- /dev/null +++ b/src/archived-patches/0005-Smash-the-state.patch @@@ -1,0 -1,0 +1,37 @@@ ++From b6b74cdac09ed294ea1b965e39e4e9ae64c5cbd8 Mon Sep 17 00:00:00 2001 ++From: Mike Perry <mikeperry-git(a)fscked.org> ++Date: Sat, 3 Sep 2011 03:00:26 -0700 ++Subject: [PATCH 7/7] Smash the state. ++ ++What happened to you, Nederlanden? You used to be cool. ++ ++This exemption is insecure as-is anyway, because we have no way of verifying ++that DigiNotar wasn't compromised enough to allow the attacker to sign ++certificates with an issuer string matching this exemption. The adversary ++would then be able to create a chain of Entrust -> DigiNotar -> "Staat der ++Nederlanden" -> *.torproject.org or *.google.com. ++--- ++ security/manager/ssl/src/nsNSSCallbacks.cpp | 7 ------- ++ 1 files changed, 0 insertions(+), 7 deletions(-) ++ ++diff --git a/security/manager/ssl/src/nsNSSCallbacks.cpp b/security/manager/ssl/src/nsNSSCallbacks.cpp ++index 5e3a888..43e1c19 100644 ++--- a/security/manager/ssl/src/nsNSSCallbacks.cpp +++++ b/security/manager/ssl/src/nsNSSCallbacks.cpp ++@@ -1065,13 +1065,6 @@ PSM_SSL_BlacklistDigiNotar(CERTCertificate * serverCert, ++ } ++ } ++ } ++- ++- // By request of the Dutch government ++- if (!strcmp(node->cert->issuerName, ++- "CN=Staat der Nederlanden Root CA,O=Staat der Nederlanden,C=NL") && ++- CERT_LIST_END(CERT_LIST_NEXT(node), serverCertChain)) { ++- return 0; ++- } ++ } ++ ++ if (isDigiNotarIssuedCert) ++-- ++1.7.3.4 ++

1 0

[torbrowser/master] update #3666 description courtesy of mikeperry
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit f41758010c2216ba82b27d8bb8fcacfc85616899 Author: Erinn Clark <erinn(a)torproject.org> Date: Mon Sep 5 00:47:48 2011 +0100 update #3666 description courtesy of mikeperry --- changelog.linux-2.2 | 2 +- changelog.osx-2.2 | 2 +- changelog.win-2.2 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/changelog.linux-2.2 b/changelog.linux-2.2 index ed7ee50..470125a 100644 --- a/changelog.linux-2.2 +++ b/changelog.linux-2.2 @@ -2,7 +2,7 @@ Tor Browser Bundle (2.2.32-3) alpha; suite=linux * Update Firefox to 6.0.2 * New Firefox patches - - Add a string-based cacheKey (closes: #3666) + - Improve cache APIs to enable better isolation (closes: #3666) - Provide auth headers to on-modify-request (closes: #3907) - Enable HTTP Pipelining as an experimental fingerprinting defense (closes: #3914) - Enable HTTP pipelining in TBB prefs.js too (closes: #3913) diff --git a/changelog.osx-2.2 b/changelog.osx-2.2 index d850cda..40d67cb 100644 --- a/changelog.osx-2.2 +++ b/changelog.osx-2.2 @@ -2,7 +2,7 @@ Tor Browser Bundle (2.2.32-3) alpha; suite=osx * Update Firefox to 6.0.2 * New Firefox patches - - Add a string-based cacheKey (closes: #3666) + - Improve cache APIs to enable better isolation (closes: #3666) - Provide auth headers to on-modify-request (closes: #3907) - Enable HTTP Pipelining as an experimental fingerprinting defense (closes: #3914) - Enable HTTP pipelining in TBB prefs.js too (closes: #3913) diff --git a/changelog.win-2.2 b/changelog.win-2.2 index ebede68..113f416 100644 --- a/changelog.win-2.2 +++ b/changelog.win-2.2 @@ -2,7 +2,7 @@ Tor Browser Bundle (2.2.32-3) alpha; suite=windows * Update Firefox to 6.0.2 * New Firefox patches - - Add a string-based cacheKey (closes: #3666) + - Improve cache APIs to enable better isolation (closes: #3666) - Provide auth headers to on-modify-request (closes: #3907) - Enable HTTP Pipelining as an experimental fingerprinting defense (closes: #3914) - Enable HTTP pipelining in TBB prefs.js too (closes: #3913)

1 0

[torbrowser/master] actually bump libpng version to 1.4.8
by erinn＠torproject.org 23 Oct '11

23 Oct '11

commit 6d1fdbf142071089720a8bfd353198a49e8b315d Author: Erinn Clark <erinn(a)torproject.org> Date: Mon Sep 5 00:53:55 2011 +0100 actually bump libpng version to 1.4.8 --- build-scripts/versions.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 4107c23..65d9abc 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -5,7 +5,7 @@ RELEASE_VER=2.2.32 HTTPSEVERY_VER=1.0.0development.5 FIREFOX_VER=6.0.2 LIBEVENT_VER=2.0.14-stable -LIBPNG_VER=1.4.3 +LIBPNG_VER=1.4.8 NOSCRIPT_VER=2.1.2.7 OPENSSL_VER=1.0.0d OTR_VER=3.2.0

1 0