commit 6ff4802a9f4b76c791c2bf864b5446170474215f Author: Yawning Angel <yawning@schwanenlied.me> Date: Wed Nov 30 23:39:21 2016 +0000 Bug #20845: Make the Circuit Display runtime togglable (Default: Off) My tinfoil hat went *crinkle* after the recent SVG/JS fun. Until e10s is part of Tor Browser, the firefox process in all but the most casual threat models has zero business in knowing what the user's guard is. The Circuit Display (and the associated surrogate control port commands) now must explciitly be enabled like PulseAudio. --- data/ui/gtkui.ui | 44 ++++++++++++++++++++-- .../internal/tor/surrogate.go | 22 ++++++----- .../internal/ui/config/config.go | 12 ++++++ .../internal/ui/gtk/config.go | 6 +++ 4 files changed, 70 insertions(+), 14 deletions(-) diff --git a/data/ui/gtkui.ui b/data/ui/gtkui.ui index dd7067c..8d6dfd1 100644 --- a/data/ui/gtkui.ui +++ b/data/ui/gtkui.ui @@ -564,6 +564,42 @@ <property name="visible">True</property> <property name="can_focus">False</property> <property name="halign">start</property> + <property name="label" translatable="yes">Circuit Display</property> + </object> + <packing> + <property name="expand">True</property> + <property name="fill">True</property> + <property name="position">0</property> + </packing> + </child> + <child> + <object class="GtkSwitch" id="circuitDisplaySwitch"> + <property name="visible">True</property> + <property name="can_focus">True</property> + </object> + <packing> + <property name="expand">False</property> + <property name="fill">True</property> + <property name="position">1</property> + </packing> + </child> + </object> + <packing> + <property name="expand">False</property> + <property name="fill">True</property> + <property name="position">1</property> + </packing> + </child> + <child> + <object class="GtkBox"> + <property name="visible">True</property> + <property name="can_focus">False</property> + <property name="margin_bottom">6</property> + <child> + <object class="GtkLabel"> + <property name="visible">True</property> + <property name="can_focus">False</property> + <property name="halign">start</property> <property name="label" translatable="yes">Modifiable Extensions</property> </object> <packing> @@ -587,7 +623,7 @@ <packing> <property name="expand">False</property> <property name="fill">True</property> - <property name="position">1</property> + <property name="position">2</property> </packing> </child> <child> @@ -625,7 +661,7 @@ <packing> <property name="expand">False</property> <property name="fill">True</property> - <property name="position">2</property> + <property name="position">3</property> </packing> </child> <child> @@ -663,7 +699,7 @@ <packing> <property name="expand">False</property> <property name="fill">True</property> - <property name="position">3</property> + <property name="position">4</property> </packing> </child> <child> @@ -700,7 +736,7 @@ <packing> <property name="expand">False</property> <property name="fill">True</property> - <property name="position">4</property> + <property name="position">5</property> </packing> </child> </object> diff --git a/src/cmd/sandboxed-tor-browser/internal/tor/surrogate.go b/src/cmd/sandboxed-tor-browser/internal/tor/surrogate.go index ef22742..b26019a 100644 --- a/src/cmd/sandboxed-tor-browser/internal/tor/surrogate.go +++ b/src/cmd/sandboxed-tor-browser/internal/tor/surrogate.go @@ -401,7 +401,7 @@ func (c *ctrlProxyConn) onCmdGetinfo(splitCmd []string, raw []byte) error { return c.sendErrUnexpectedArgCount(cmdGetinfo, 2, len(splitCmd)) } - if strings.HasPrefix(splitCmd[1], prefixGetinfoNsId) || strings.HasPrefix(splitCmd[1], prefixGetinfoIpToCountry) { + if c.p.circuitMonitorEnabled && (strings.HasPrefix(splitCmd[1], prefixGetinfoNsId) || strings.HasPrefix(splitCmd[1], prefixGetinfoIpToCountry)) { // This *could* filter the relevant results to those that are actually // part of circuits that the user has, but that seems overly paranoid, // and ironically leaks more information. @@ -472,10 +472,12 @@ func (c *ctrlProxyConn) onCmdSignal(splitCmd []string, raw []byte) error { } func (c *ctrlProxyConn) onCmdSetEvents(splitCmd []string, raw []byte) error { + if !c.p.circuitMonitorEnabled { + return c.sendErrUnrecognizedCommand() + } + if len(splitCmd) == 1 { - if c.p.circuitMonitorEnabled { - c.p.circuitMonitor.deregister(c) - } + c.p.circuitMonitor.deregister(c) _, err := c.appConnWrite([]byte(responseOk)) return err } else if len(splitCmd) != 2 { @@ -485,8 +487,6 @@ func (c *ctrlProxyConn) onCmdSetEvents(splitCmd []string, raw []byte) error { respStr := "552 Unrecognized event \"" + splitCmd[1] + "\"" + crLf _, err := c.appConnWrite([]byte(respStr)) return err - } else if !c.p.circuitMonitorEnabled { - return c.sendErrUnrecognizedCommand() } c.p.circuitMonitor.register(c) _, err := c.appConnWrite([]byte(responseOk)) @@ -568,11 +568,13 @@ func launchCtrlProxy(cfg *config.Config, tor *Tor) (*ctrlProxy, error) { return nil, err } - p.circuitMonitor, err = initCircuitMonitor(p) - p.circuitMonitorEnabled = err == nil - if err != nil { - log.Printf("tor: failed to launch circuit display helper: %v", err) + if cfg.Sandbox.EnableCircuitDisplay { + p.circuitMonitor, err = initCircuitMonitor(p) + if err != nil { + log.Printf("tor: failed to launch circuit display helper: %v", err) + } } + p.circuitMonitorEnabled = p.circuitMonitor != nil && err == nil go p.acceptLoop() diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go b/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go index c29c0ae..7346c81 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/config/config.go @@ -195,6 +195,9 @@ type Sandbox struct { // sandbox. EnablePulseAudio bool `json:"enablePulseAudio"` + // EnableCircuitDisplay enables the Tor Browser circuit display. + EnableCircuitDisplay bool `json:"enableCircuitDisplay"` + // DesktopDir is the directory to be bind mounted instead of the default // bundle Desktop directory. DesktopDir string `json:"desktopDir,omitEmpty"` @@ -221,6 +224,15 @@ func (sb *Sandbox) SetEnablePulseAudio(b bool) { } } +// SetEnableCircuitDisplay sets tthe circit display enable and marks the config +// dirty. +func (sb *Sandbox) SetEnableCircuitDisplay(b bool) { + if sb.EnableCircuitDisplay != b { + sb.EnableCircuitDisplay = b + sb.cfg.isDirty = true + } +} + // SetVolatileExtensionsDir sets the sandbox extension directory write enable // and marks the config dirty. func (sb *Sandbox) SetVolatileExtensionsDir(b bool) { diff --git a/src/cmd/sandboxed-tor-browser/internal/ui/gtk/config.go b/src/cmd/sandboxed-tor-browser/internal/ui/gtk/config.go index 7a44cea..43e663f 100644 --- a/src/cmd/sandboxed-tor-browser/internal/ui/gtk/config.go +++ b/src/cmd/sandboxed-tor-browser/internal/ui/gtk/config.go @@ -62,6 +62,7 @@ type configDialog struct { // Sandbox config elements. pulseAudioBox *gtk3.Box pulseAudioSwitch *gtk3.Switch + circuitDisplaySwitch *gtk3.Switch volatileExtensionsSwitch *gtk3.Switch displayBox *gtk3.Box displayEntry *gtk3.Entry @@ -110,6 +111,7 @@ func (d *configDialog) loadFromConfig() { // XXX: Hide PulseAudio option if not available. forceAdv := false d.pulseAudioSwitch.SetActive(d.ui.Cfg.Sandbox.EnablePulseAudio) + d.circuitDisplaySwitch.SetActive(d.ui.Cfg.Sandbox.EnableCircuitDisplay) d.volatileExtensionsSwitch.SetActive(d.ui.Cfg.Sandbox.VolatileExtensionsDir) if d.ui.Cfg.Sandbox.Display != "" { d.displayEntry.SetText(d.ui.Cfg.Sandbox.Display) @@ -190,6 +192,7 @@ func (d *configDialog) onOk() error { } d.ui.Cfg.Sandbox.SetEnablePulseAudio(d.pulseAudioSwitch.GetActive()) + d.ui.Cfg.Sandbox.SetEnableCircuitDisplay(d.circuitDisplaySwitch.GetActive()) d.ui.Cfg.Sandbox.SetVolatileExtensionsDir(d.volatileExtensionsSwitch.GetActive()) if s, err := d.displayEntry.GetText(); err != nil { return err @@ -375,6 +378,9 @@ func (ui *gtkUI) initConfigDialog(b *gtk3.Builder) error { if d.pulseAudioSwitch, err = getSwitch(b, "pulseAudioSwitch"); err != nil { return err } + if d.circuitDisplaySwitch, err = getSwitch(b, "circuitDisplaySwitch"); err != nil { + return err + } if d.volatileExtensionsSwitch, err = getSwitch(b, "volatileExtensionsSwitch"); err != nil { return err }