- tor-commits - lists.torproject.org

[tor-browser/tor-browser-68.7.0esr-9.5-1] Revert "Bug 30575: Don't allow enterprise policies in Tor Browser"
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit 7d0d47db46531a32c88db85323cd771761b8bb5d Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Wed Apr 15 14:09:53 2020 -0400 Revert "Bug 30575: Don't allow enterprise policies in Tor Browser" This reverts commit d362cff17d44a82534ea553cbf50fa76906cc218. --- .../enterprisepolicies/EnterprisePolicies.js | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/toolkit/components/enterprisepolicies/EnterprisePolicies.js b/toolkit/components/enterprisepolicies/EnterprisePolicies.js index dd43d31cb3b0..db77b4717736 100644 --- a/toolkit/components/enterprisepolicies/EnterprisePolicies.js +++ b/toolkit/components/enterprisepolicies/EnterprisePolicies.js @@ -88,9 +88,25 @@ EnterprisePoliciesManager.prototype = { ), _initialize() { - // We don't want to have any enterprise policies in Tor Browser enabled as - // those can affect proxy settings etc. See: e.g. #30575. - this.status = Ci.nsIEnterprisePolicies.INACTIVE; + let provider = this._chooseProvider(); + + if (!provider) { + this.status = Ci.nsIEnterprisePolicies.INACTIVE; + return; + } + + if (provider.failed) { + this.status = Ci.nsIEnterprisePolicies.FAILED; + return; + } + + this.status = Ci.nsIEnterprisePolicies.ACTIVE; + this._parsedPolicies = {}; + Services.telemetry.scalarSet( + "policies.count", + Object.keys(provider.policies).length + ); + this._activatePolicies(provider.policies); }, _chooseProvider() {

1 0

[tor-browser/tor-browser-68.7.0esr-9.5-1] fixup! Bug 28005: Implement .onion alias urlbar rewrites
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit 0052c74b743756dafa4f3614f559dd8f8d1645c2 Author: Alex Catarineu <acat(a)torproject.org> Date: Tue Apr 28 18:25:36 2020 +0200 fixup! Bug 28005: Implement .onion alias urlbar rewrites --- browser/components/onionservices/HttpsEverywhereControl.jsm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browser/components/onionservices/HttpsEverywhereControl.jsm b/browser/components/onionservices/HttpsEverywhereControl.jsm index 87954461bab1..60c3b5fca282 100644 --- a/browser/components/onionservices/HttpsEverywhereControl.jsm +++ b/browser/components/onionservices/HttpsEverywhereControl.jsm @@ -16,9 +16,9 @@ const SECUREDROP_TOR_ONION_CHANNEL = { kty: "RSA", e: "AQAB", n: - "y0iWTVev1uYDVhLdc5uSHWke-9JlbxzqIsGkS95Pk5NsxdlkdbHpqaPr-5xL5FspX8QGo3HAT5hrUcPV_kz8x-HwGEm2-p9BQ6-yEPtr5QXQGGzNoizmj7HH-b0y5qx8iUFwAJ__PJWK4IwSgjIQqHMjmkOLc9N4bmRPULi6ZZMb-97FdeZsh34dVy2tpIzZaijRfRQSfeZkwRXZzOY-siGfOAzY_UcrHFli5zroTZAyDaetFm1z2-TdFLOvN8fi0o3mBbCB9SqhOUImPwSTNWTp2D6bHhI91mt7gr6fLnzHMGrTMh2DQ4vjt_98pe7WTUzuRCLa9Awb6JJgbYA4ySV1akAU0_iq6oCAE9PZbUgUw9UAH1ctRFml87F3HORUMMj5ZCLwRIrEXqrCJbV4f-Ius-ZO2wwlYTsEv8TmUzISpMwVjGOIpXwFIb65R_EX3_vIopauSoyZkvk3klly0Qe6KTy_gg1CZ_h2ZXPpLMwqlfFTDBPv2q8gyuzgkYXQes3FX-PbJ9Dsl5QO4icuEjV2NQ7iPwwIPAtj9cpqCD8-p9TqTKaZjOFC9-ryJpWsivGCbvN2JotmJ5Ax9rmnAMvQM09muCetFj_ZIgllcpeahaw6gxVXlSYIhb0J9V878KNuRJ2yPJFlBmgpFexvCcz8Jqs6JUfIrmUAGUXG9nE", + "p10BbUVc5Xj2S_-MH3bACNBaISo_r9e3PVPyTTjsGsdg2qSXvqUO42fBtpFAy0zUzIGS83v4JjiRdvKJaZTIvbC8AcpymzdsTqujMm8RPTSy3hO_8mXzGa4DEsIB1uNLnUWRBKXvSGCmT9kFyxhTpkYqokNBzafVihTU34tN2Md1xFHnmZGqfYtPtbJLWAa5Z1M11EyR4lIyUxIiPTV9t1XstDbWr3iS83REJrGEFmjG1-BAgx8_lDUTa41799N2yYEhgZud7bL0M3ei8s5OERjiion5uANkUV3-s2QqUZjiVA-XR_HizXjciaUWNd683KqekpNOZ_0STh_UGwpcwU-KwG07QyiCrLrRpz8S_vH8CqGrrcWY3GSzYe9dp34jJdO65oA-G8tK6fMXtvTCFDZI6oNNaXJH71F5J0YbqO2ZqwKYc2WSi0gKVl2wd9roOVjaBmkJqvocntYuNM7t38fDEWHn5KUkmrTbiG68Cy56tDUfpKl3D9Uj4LaMvxJ1tKGvzQ4k_60odT7gIxu6DqYjXUHZpwPsSGBq3njaD7boe4CUXF2K7ViOc87BsKxRNCzDD8OklRjjXzOTOBH3PqFJ93CJ-4ECE5t9STU20aZ8E-2zKB8vjKyCySE4-kcIvBBsnkwVaJTPy9Ft1qYybo-soXEWVEZATANNWklBt8k", }, - update_path_prefix: "https://redshiftzero.github.io/securedrop-httpse/", + update_path_prefix: "https://securedrop.org/https-everywhere/", scope: "^https?:\\/\\/[a-z0-9-]+(?:\\.[a-z0-9-]+)*\\.securedrop\\.tor\\.onion\\/", replaces_default_rulesets: false,

1 0

[tor-browser/tor-browser-68.7.0esr-9.5-1] Bug 32418: Allow updates to be disabled via an enterprise policy.
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit e577d655d2044e3b6636b0bccfbb5bd776148582 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Apr 16 17:07:09 2020 -0400 Bug 32418: Allow updates to be disabled via an enterprise policy. Restrict the Enterprise Policies mechanism to only consult a policies.json file (avoiding the Windows Registry and macOS's file system attributes). Add a few disabledByPolicy() checks to the update service to avoid extraneous (and potentially confusing) log messages when updates are disabled by policy. Sample content for distribution/policies.json: { "policies": { "DisableAppUpdate": true } } --- .../enterprisepolicies/EnterprisePolicies.js | 10 ++++++++++ toolkit/components/enterprisepolicies/moz.build | 4 +++- toolkit/mozapps/update/UpdateService.jsm | 20 ++++++++++++++++++++ 3 files changed, 33 insertions(+), 1 deletion(-) diff --git a/toolkit/components/enterprisepolicies/EnterprisePolicies.js b/toolkit/components/enterprisepolicies/EnterprisePolicies.js index db77b4717736..bc0171867dfa 100644 --- a/toolkit/components/enterprisepolicies/EnterprisePolicies.js +++ b/toolkit/components/enterprisepolicies/EnterprisePolicies.js @@ -2,6 +2,10 @@ * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +// To avoid accessing the Windows Registry or macOS' file system attributes, +// Tor Browser only supports policies.json. +#define JSON_POLICIES_ONLY MOZ_PROXY_BYPASS_PROTECTION + const { XPCOMUtils } = ChromeUtils.import( "resource://gre/modules/XPCOMUtils.jsm" ); @@ -11,9 +15,11 @@ const { AppConstants } = ChromeUtils.import( ); XPCOMUtils.defineLazyModuleGetters(this, { +#ifndef JSON_POLICIES_ONLY WindowsGPOParser: "resource://gre/modules/policies/WindowsGPOParser.jsm", macOSPoliciesParser: "resource://gre/modules/policies/macOSPoliciesParser.jsm", +#endif Policies: "resource:///modules/policies/Policies.jsm", JsonSchemaValidator: "resource://gre/modules/components-utils/JsonSchemaValidator.jsm", @@ -111,6 +117,7 @@ EnterprisePoliciesManager.prototype = { _chooseProvider() { let provider = null; +#ifndef JSON_POLICIES_ONLY if (AppConstants.platform == "win") { provider = new WindowsGPOPoliciesProvider(); } else if (AppConstants.platform == "macosx") { @@ -119,6 +126,7 @@ EnterprisePoliciesManager.prototype = { if (provider && provider.hasPolicies) { return provider; } +#endif provider = new JSONPoliciesProvider(); if (provider.hasPolicies) { @@ -547,6 +555,7 @@ class JSONPoliciesProvider { } } +#ifndef JSON_POLICIES_ONLY class WindowsGPOPoliciesProvider { constructor() { this._policies = null; @@ -608,6 +617,7 @@ class macOSPoliciesProvider { return this._failed; } } +#endif var components = [EnterprisePoliciesManager]; this.NSGetFactory = XPCOMUtils.generateNSGetFactory(components); diff --git a/toolkit/components/enterprisepolicies/moz.build b/toolkit/components/enterprisepolicies/moz.build index 8f7d7d8cfed7..7528f569bb3e 100644 --- a/toolkit/components/enterprisepolicies/moz.build +++ b/toolkit/components/enterprisepolicies/moz.build @@ -19,10 +19,12 @@ TEST_DIRS += [ if CONFIG['MOZ_WIDGET_TOOLKIT'] != "android": EXTRA_COMPONENTS += [ - 'EnterprisePolicies.js', 'EnterprisePolicies.manifest', 'EnterprisePoliciesContent.js', ] + EXTRA_PP_COMPONENTS += [ + 'EnterprisePolicies.js', + ] if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows': EXTRA_JS_MODULES.policies += [ diff --git a/toolkit/mozapps/update/UpdateService.jsm b/toolkit/mozapps/update/UpdateService.jsm index 282e1aecc5e8..5fbcc1536540 100644 --- a/toolkit/mozapps/update/UpdateService.jsm +++ b/toolkit/mozapps/update/UpdateService.jsm @@ -2772,6 +2772,10 @@ UpdateService.prototype = { _checkForBackgroundUpdates: function AUS__checkForBackgroundUpdates( isNotify ) { + if (this.disabledByPolicy) { + return; + } + this._isNotify = isNotify; // Histogram IDs: @@ -3293,6 +3297,14 @@ UpdateService.prototype = { * See nsIUpdateService.idl */ get canApplyUpdates() { + if (this.disabledByPolicy) { + LOG( + "UpdateService.canApplyUpdates - unable to apply updates, " + + "the option has been disabled by the administrator." + ); + return false; + } + return getCanApplyUpdates() && hasUpdateMutex(); }, @@ -3300,6 +3312,14 @@ UpdateService.prototype = { * See nsIUpdateService.idl */ get canStageUpdates() { + if (this.disabledByPolicy) { + LOG( + "UpdateService.canStageUpdates - unable to stage updates, " + + "the option has been disabled by the administrator." + ); + return false; + } + return getCanStageUpdates(); },

1 0

[tor-browser/tor-browser-68.7.0esr-9.5-1] Merge remote-tracking branch 'acatgh/34032' into tor-browser-68.7.0esr-9.5-1
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit f5bf259fa2f16c68f3dc12bf9e6d28f43ff8d7e1 Merge: f81583b0d6d7 0052c74b7437 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Apr 28 20:42:31 2020 +0000 Merge remote-tracking branch 'acatgh/34032' into tor-browser-68.7.0esr-9.5-1 browser/components/onionservices/HttpsEverywhereControl.jsm | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor-browser/tor-browser-68.7.0esr-9.5-1] Merge branch 'bradetpo/bug32418-01' into tor-browser-68.7.0esr-9.5-1
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit f81583b0d6d7eefd4b7384e8ee95d528ea4fb303 Merge: 5a8128b566fa e577d655d204 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Apr 28 20:04:14 2020 +0000 Merge branch 'bradetpo/bug32418-01' into tor-browser-68.7.0esr-9.5-1 .../enterprisepolicies/EnterprisePolicies.js | 32 ++++++++++++++++++++-- toolkit/components/enterprisepolicies/moz.build | 4 ++- toolkit/mozapps/update/UpdateService.jsm | 20 ++++++++++++++ 3 files changed, 52 insertions(+), 4 deletions(-)

1 0

[snowflake-webext/master] bump version to 0.2.3
by cohosh＠torproject.org 28 Apr '20

28 Apr '20

commit d05041a24a1bc0c87f7c00a018f27cb7238f8d91 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Apr 28 16:21:04 2020 -0400 bump version to 0.2.3 --- translation | 2 +- webext/manifest.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/translation b/translation index 9ce163a..a144799 160000 --- a/translation +++ b/translation @@ -1 +1 @@ -Subproject commit 9ce163a282fcd35e3cc6b642b0236e237dc56159 +Subproject commit a144799d59a75a4b2f812958378829469e7ea75f diff --git a/webext/manifest.json b/webext/manifest.json index c3ccfa7..7eacc11 100644 --- a/webext/manifest.json +++ b/webext/manifest.json @@ -1,7 +1,7 @@ { "manifest_version": 2, "name": "Snowflake", - "version": "0.2.2", + "version": "0.2.3", "description": "__MSG_appDesc__", "default_locale": "en_US", "background": {

1 0

[snowflake-webext/master] Update node wrtc version for web proxies
by cohosh＠torproject.org 28 Apr '20

28 Apr '20

commit 4d59bcbb4deace2e7acc5f4aaabde7da3f91884b Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Apr 28 14:32:13 2020 -0400 Update node wrtc version for web proxies --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 772746e..adceb3d 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,7 @@ }, "dependencies": { "cldr": "^5.4.1", - "wrtc": "^0.0.61", + "wrtc": "^0.4.4", "ws": "^3.3.1", "xmlhttprequest": "^1.8.0" }

1 0

[tor-browser-build/maint-9.0] Openssl version bump is only on Win/macOS/Linux
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit ccef18adc1cae3dc652c0b617d6db1d0b1df6631 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Apr 28 18:36:23 2020 +0000 Openssl version bump is only on Win/macOS/Linux --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 6f66cad..18c2c76 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -2,6 +2,7 @@ Tor Browser 9.0.10 -- May 5 2020 * All Platforms * Update Firefox to 68.8.0esr * Bump NoScript to 11.0.25 + * Windows + OS X + Linux * Bug 34017: Bump openssl version to 1.1.1g Tor Browser 9.0.9 -- April 7 2020

1 0

[snowflake/master] Restore check for nil writePipe in WebRTCPeer.Close.
by dcf＠torproject.org 28 Apr '20

28 Apr '20

commit 72cfb96edeb7c9a3c93d38539bc31a51e30dbe8d Author: David Fifield <david(a)bamsoftware.com> Date: Tue Apr 28 11:33:09 2020 -0600 Restore check for nil writePipe in WebRTCPeer.Close. I removed this check in 047d3214bfb46de07e5d9f223e4fb1ba24584c8a because NewWebRTCPeer always initializes writePipe, and it is never reset to nil. However tests used &WebRTCPeer{} which bypasses NewWebRTCPeer and leaves writePipe set to nil. https://bugs.torproject.org/34049#comment:3 https://bugs.torproject.org/34050 --- client/lib/webrtc.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/client/lib/webrtc.go b/client/lib/webrtc.go index edc8ab4..23cb3e1 100644 --- a/client/lib/webrtc.go +++ b/client/lib/webrtc.go @@ -236,7 +236,9 @@ func exchangeSDP(broker *BrokerChannel, offer *webrtc.SessionDescription) *webrt // Close all channels and transports func (c *WebRTCPeer) cleanup() { // Close this side of the SOCKS pipe. - c.writePipe.Close() + if c.writePipe != nil { // c.writePipe can be nil in tests. + c.writePipe.Close() + } if nil != c.transport { log.Printf("WebRTC: closing DataChannel") c.transport.Close()

1 0

[tor-browser-build/maint-9.0] Bug 34017 - Bump openssl version to 1.1.1g
by sysrqb＠torproject.org 28 Apr '20

28 Apr '20

commit b92fb2a97d0c15db625d979b7d24df628dad1477 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Tue Apr 28 17:19:41 2020 +0000 Bug 34017 - Bump openssl version to 1.1.1g --- projects/openssl/config | 4 ++-- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/projects/openssl/config b/projects/openssl/config index 8ee3b69..f5f16b0 100644 --- a/projects/openssl/config +++ b/projects/openssl/config @@ -1,5 +1,5 @@ # vim: filetype=yaml sw=2 -version: 1.1.1f +version: 1.1.1g filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' var: @@ -28,6 +28,6 @@ input_files: - name: '[% c("var/compiler") %]' project: '[% c("var/compiler") %]' - URL: 'https://www.openssl.org/source/openssl-[% c("version") %].tar.gz' - sha256sum: 186c6bfe6ecfba7a5b48c47f8a1673d0f3b0e5ba2e25602dd23b629975da3f35 + sha256sum: ddb04774f1e32f0c49751e21b67216ac87852ceb056b75209af2443400636d46 - filename: use-SOURCE_DATE_EPOCH.patch enable: '[% c("var/windows") %]' diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index b0b7a8c..6f66cad 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -2,6 +2,7 @@ Tor Browser 9.0.10 -- May 5 2020 * All Platforms * Update Firefox to 68.8.0esr * Bump NoScript to 11.0.25 + * Bug 34017: Bump openssl version to 1.1.1g Tor Browser 9.0.9 -- April 7 2020 * All Platforms

1 0