[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [tor-browser-spec/master] Add Firefox 78 network audit done by mikeperry

To: tor-commits@xxxxxxxxxxxxxxxxxxxx, tbb-commits@xxxxxxxxxxxxxxxxxxxx
Subject: [tor-commits] [tor-browser-spec/master] Add Firefox 78 network audit done by mikeperry
From: gk@xxxxxxxxxxxxxx
Date: Mon, 7 Sep 2020 08:51:45 +0000 (UTC)
Delivered-to: archiver@xxxxxxxx
Delivery-date: Mon, 07 Sep 2020 04:52:01 -0400
List-archive: <http://lists.torproject.org/pipermail/tor-commits/>
List-help: <mailto:tor-commits-request@lists.torproject.org?subject=help>
List-id: "auto: code repository commits" <tor-commits.lists.torproject.org>
List-post: <mailto:tor-commits@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits>, <mailto:tor-commits-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-commits>, <mailto:tor-commits-request@lists.torproject.org?subject=unsubscribe>
Patch-author: Georg Koppen <gk@xxxxxxxxxxxxxx>
Sender: "tor-commits" <tor-commits-bounces@xxxxxxxxxxxxxxxxxxxx>
commit f10b4248c3fb66cdf16327695320bbc7f95fdef8
Author: Georg Koppen <gk@xxxxxxxxxxxxxx>
Date:   Mon Sep 7 08:49:18 2020 +0000

    Add Firefox 78 network audit done by mikeperry
---
 audits/FF78_NETWORK_AUDIT | 376 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 376 insertions(+)

diff --git a/audits/FF78_NETWORK_AUDIT b/audits/FF78_NETWORK_AUDIT
new file mode 100644
index 0000000..9259c72
--- /dev/null
+++ b/audits/FF78_NETWORK_AUDIT
@@ -0,0 +1,376 @@
+Summary of findings: https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34177
+
+`git diff esrA esrB` and then go over all the changes containing the
+above mentioned potentially dangerous calls and features. Grep the diff for
+the following strings and examine surrounding usage.
+
+=============== Native DNS Portion =============
+
+PR_GetHostByName
+PR_GetIPNodeByName
+PR_GetAddrInfoByName
+PR_StringToNetAddr (itself is good as it passes AI_NUMERICHOST to getaddrinfo. No resolution.)
+
+netwerk/dns/GetAddrInfo.cpp
+  - NativeDNSResolverOverride.. Don't see where stuff is added to this.. but
+    doesn't use DNS itself
+
+GetAddrInfo()
+  + checks network.dns.disabled pref..
+  - Only used by nsHostResolver
+
+MDNS
+  + Some use by mtransport, which should be disabled by webrtc
+
+TRR (DNS Trusted Recursive Resolver)
+  - Has a perf test that uses nsDNSService
+  - Governed by network.trr.* prefs
+  - Bundled addon doh-rollout, govererned by doh-rollout.*
+  + TRR itself uses http channels which follow proxy prefs
+    - This impl is TRRServiceChannel
+      + Proxy passed in via CreateTRRServiceChannel proxyInfo arg
+  - TRR has its own cache that gets cleared on pref change
+
+Direct Paths to DNS resolution:
+nsHostResolver::ResolveHost
+  - Does not check for SOCKS proxy or DNS pref
+  - Uses nsResolveHostCallback
+  + Calls down to NativeResolve, which checks network.dns.disabled pref
+nsDNSService::Resolve
+  + Uses nsHostResolver::ResolveHost
+nsDNSService::AsyncResolve
+  + -> AsyncResolveInternal
+nsDNSService::AsyncResolveNative
+  + -> AsyncResolveInternal
+nsDNSService::AsyncResolveWithTrrServer
+  + -> AsyncResolveInternal
+nsDNSService::AsyncResolveInternal
+  + uses nsHostResolver::ResolveHost
+
+============ Misc Socket Portion ==============
+
+SOCK_
+  + nsNetworkLinkService; checks routing tables but does not make connections
+  - RCNetStreamIO
+    - Just reformatting
+  + python tests
+  - third_party/rust/nix/src/sys/socket/mod.rs
+  - third_party/rust/socket2/src/sys/redox/mod.rs
+SOCKET_
+  + nsSocketTransport::ResolveHost
+    + Calls down to native, is blocked by pref
+  - nsSocketTransport::BuildSocket
+    - XXX now can connect via quic?? (mTypes[0] == quic)
+    - XXX: mUsingQuic
+    - uses mProxyHost + port??
+    - pushes to nsSocketProvider layer (with quic)
+_SOCKET
+  - Some kind of socket process sandbox?
+  + Errors and tests
+UDPSocket
+  - nsSocketTransport::BuildSocket
+    - XXX: quic again
+TCPSocket
+  - nsSocketTransport::BuildSocket
+
+PR_OpenUDPSocket
+PR_NewUDPSocket
+  + No usage outside of tests
+PR_NewTCPSocket
+  + No usage outside of tests
+AsyncTCPSocket
+  + No usage
+Misc PR_Socket
+  + No signficant changes
+
+
+HTTP3
+  Http3Session, Http3Stream
+  HttpConnectionUDP
+  nsHttpConnection::UsingHttp3
+  nsHttpConnectionMgr::DispatchTransaction
+  + Live testing found no quic/http leaks unless http3 pref was flipped
+
+TCPFastOpen (https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27614)
+  - Attached in nsSocketTransport::InitiateSocket
+  - mProxyTransparent
+  - nsHttpConnectionMgr::nsHalfOpenSocket::FastOpenEnabled
+    - nsHttphandler::mUsingFastOpen
+      - Set by network.tcp.tcp_fastopen_enable pref..
+
+=========== Misc XPCOM Portion ================
+
+Misc XPCOM (including commands for pre-diff review approach)
+ *SocketProvider
+   - "quic does not have a SocketProvider"
+ grep -R udp-socket .
+  + No changes
+ grep -R tcp-socket .
+  + No changes
+ grep for tcpsocket
+  + Just tests
+ grep -R "NS_" | grep SOCKET | grep "_C"
+  + NS_SOCKETTRANSPORTSERVICE_CONTRACTID
+ grep -R "@mozilla.org/network/" . | grep socket | grep -v udp-socket
+  + socket-transport-service
+    + just tests
+
+============ Rust Portion ================
+
+Rust
+ - XXX: What do we grep for here? Or do we rely on Ritter's compile-time tool?
+ - Check for new sendmsg and recvmsg usage
+
+============ Android Portion =============
+
+XXX: Fenix
+   18:42 <+GeKo> application-services, android-components, fenix
+   18:43 <+GeKo> for the former i applied the patches we already have in our tor-browser repo
+   https://bugs.torproject.org/34101 (Build Project for application-services)
+   https://bugs.torproject.org/33939
+   https://gitlab.torproject.org/tpo/applications/fenix/-/issues/34440
+   https://gitlab.torproject.org/legacy/trac/-/issues/34324
+   https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40004
+   18:47 <+GeKo> fenix mentions the android-components version at
+      https://gitlab.torproject.org/tpo/applications/fenix/-/blob/tor-browser-79.0-10.0-1/buildSrc/src/main/java/AndroidComponents.kt
+   18:47 <+GeKo> you could look at the respective tag in the android-components repo
+    https://gitlab.torproject.org/tpo/applications/fenix/-/issues/40008
+   18:54 <+GeKo> mikeperry: for completeness sake: android-components hardcode the application-services version in
+              buildSrc/src/main/java/Dependencies.kt
+   18:54 <+GeKo> in mozilla_appservices
+   18:57 <+GeKo> mikeperry: the application-services repo is at: https://github.com/mozilla/application-services
+   18:58 <+GeKo> the android-components one is at https://github.com/mozilla-mobile/android-components
+   18:59 <+GeKo> you find the version of the first one used in the latter one at
+              https://github.com/mozilla-mobile/android-components/blob/master/buildSrc/src/main/java/Dependencies.kt#L30
+   18:59 <+GeKo> (currently)
+   18:59 <+GeKo> which should give you a link from the fenix commit you look at down to application-services
+
+
+
+
+=== Android: gecko-dev ===
+
+Android Java calls
+ - URLConnection
+   - mobile/android/geckoview/src/main/java/org/mozilla/gecko/GeckoAppShell.java
+     - XXX: Uses 'ProxySelector' to make http conns
+   - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java
+     - XXX: Also ProxySelector
+ - ProxySelector
+   - mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/ProxySelector.java
+   - XXX: Seems to only inspect system proxy settings?
+ - UrlConnectionDownloader
+ - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls)
+ - grep -n openConnection\( mobile/android/thirdparty/
+ - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/
+ - java.net
+ - javax.net
+ - okhttp
+ - ch.boye.httpclientandroidlib.conn.* (esp ssl)
+ - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl)
+ - Sudden appearance of thirdparty libs:
+   - OkHttp
+   - Retrofit
+   - Glide
+   - com.amitshekhar.android
+ - android.net
+   - mobile/android/geckoview/src/main/java/org/mozilla/gecko/util/BitmapUtils.java
+     - XXX: Does URI.openStream() ...
+   - mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoSession.java
+     - XXX: LOAD_FLAGS_BYPASS_PROXY :/
+   - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/drm/HttpMediaDrmCallback.java
+     - XXX: DataSourceInputStream; DataSource
+     - DownloadRequest
+   - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/offline/ProgressiveDownloader.java
+     - XXX: DataSpec
+   - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/offline/SegmentDownloader.java
+     - XXX: CacheUtil
+   - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/upstream/DefaultDataSource.java
+     - XXX: can do rtmp and udp via superclasses
+   - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java
+     - Uses ProxySelector
+     - Can also use java.net.URL
+   - XXX: Whole exoplayer is a mess of stuff :/
+ - android.webkit
+ - IntentHelper
+   - openUriExternal (can come from GeckoAppShell too)
+   - getHandlersForMimeType
+   - getHandlersForURL
+   - getHandlersForIntent
+ - android.content.Intent - too common; instead find launch methods:
+   - startActivity
+     - mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java
+       - onExternalResponse - ???
+   - startActivities
+   - sendBroadcast
+   - sendOrderedBroadcast
+   - startService
+     - mobile/android/geckoview/src/thirdparty/java/org/mozilla/thirdparty/com/google/android/exoplayer2/offline/DownloadService.java
+   - bindService
+ - android.app.PendingIntent
+ - android.app.DownloadManager
+ - ActivityHandlerHelper.startIntentAndCatch
+ - Intent wrappers:
+   - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt
+     - External app intercepter
+   - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt
+
+=== android-components ===
+
+Android Java calls
+ - URLConnection
+ - HttpURLConnection
+   - components/lib/crash/src/main/java/mozilla/components/lib/crash/service/MozillaSocorroService.kt
+     - XXX: Crash reporting
+   - components/lib/fetch-httpurlconnection/src/main/java/mozilla/components/lib/fetch/httpurlconnection/HttpURLConnectionClient.kt
+     - XXX: No proxy, but doesn't seem used except perhaps by Glean
+   - components/service/glean/src/main/java/mozilla/components/service/glean/net/ConceptFetchHttpUploader.kt
+     - XXX: glean ping
+ - UrlConnectionDownloader
+ - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls)
+ - grep -n openConnection\( mobile/android/thirdparty/
+ - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/
+   - components/concept/fetch/src/main/java/mozilla/components/concept/fetch/Client.kt
+     - Abstract client interface: implementors use this to download stuff;
+       geckoview is a Client impl
+   - components/lib/fetch-httpurlconnection/src/main/java/mozilla/components/lib/fetch/httpurlconnection/HttpURLConnectionClient.kt
+     - XXX: Generic http Client; No proxy; does not seem used
+   - components/lib/crash/src/main/java/mozilla/components/lib/crash/service/MozillaSocorroService.kt
+     - XXX: Crash service openSteam
+ - java.net
+   - components/browser/engine-gecko-beta/src/main/java/mozilla/components/browser/engine/gecko/fetch/GeckoViewFetchClient.kt
+     - Calls into GeckoWebExecutor to fetch things
+   + components/lib/fetch-okhttp/src/main/java/mozilla/components/lib/fetch/okhttp/OkHttpClient.kt
+     + only used in tests
+ - javax.net
+ - okhttp3
+   + components/lib/fetch-okhttp/src/main/java/mozilla/components/lib/fetch/okhttp/OkHttpClient.kt
+     + just used in tests
+ - ch.boye.httpclientandroidlib.conn.* (esp ssl)
+ - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl)
+ - Sudden appearance of thirdparty libs:
+   - OkHttp
+   - Retrofit
+   - Glide
+   - com.amitshekhar.android
+ - android.net
+   - components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt
+   - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngineView.kt
+     - XXX: Seems to use webkit to do stuff??
+   - components/browser/icons/src/main/java/mozilla/components/browser/icons/loader/HttpIconLoader.kt
+     - Uses whatever httpclient is passed in
+ - android.webkit ************
+   - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngine.kt
+     - Provides way to launch system webkit views; probably unsafe
+   - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/NestedWebView.kt
+   - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngineSession.kt
+     - XXX: loadURL via NestedWebView which I think comes from android.webkit?
+       (scoping unclear)
+   - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/SystemEngineView.kt
+   - components/browser/engine-system/src/main/java/mozilla/components/browser/engine/system/window/SystemWindowRequest.kt
+     - XXX: unclear if this is requests for "default browser" or another way
+       to launch webkit
+   - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/AbstractFetchDownloadService.kt
+     - XXX: Abstract downloader that can use any HTTPClient (may be unsafe)
+ - IntentHelper
+   - openUriExternal (can come from GeckoAppShell too)
+   - getHandlersForMimeType
+   - getHandlersForURL
+   - getHandlersForIntent
+ - android.content.Intent - too common; instead find launch methods:
+   - startActivity
+     - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt
+       - needs AppLinkInterceptor; no warning currently
+     - components/feature/contextmenu/src/main/java/mozilla/components/feature/contextmenu/ContextMenuCandidate.kt
+       - probably safe? just link sharing
+     - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/AbstractFetchDownloadService.kt
+     - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/DownloadsFeature.kt
+       Downloader apps
+     - components/feature/prompts/src/main/java/mozilla/components/feature/prompts/PromptContainer.kt
+       wrapper?
+     - components/feature/prompts/src/main/java/mozilla/components/feature/prompts/file/FilePicker.kt
+     - components/feature/pwa/src/main/java/mozilla/components/feature/pwa/WebAppInterceptor.kt
+     - components/feature/pwa/src/main/java/mozilla/components/feature/pwa/WebAppLauncherActivity.kt
+       - can launch "standalone actvity" for browser urls..
+     - components/lib/crash/src/main/java/mozilla/components/lib/crash/prompt/CrashReporterActivity.kt
+     - components/support/ktx/src/main/java/mozilla/components/support/ktx/android/content/Context.kt
+       can call and access adressbook..
+     - samples/browser/src/main/java/org/mozilla/samples/browser/DefaultComponents.kt
+       - can start "systemengine"
+   - startActivities
+   - sendBroadcast
+   - sendOrderedBroadcast
+   - startService
+   - bindService
+ - android.app.PendingIntent
+ - android.app.DownloadManager
+   - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/AbstractFetchDownloadService.kt
+     - uses httpClient rather than native android download manager
+   - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/DownloadsFeature.kt
+     - uses android download mamanager :/
+   - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/manager/AndroidDownloadManager.kt
+   - components/feature/downloads/src/main/java/mozilla/components/feature/downloads/manager/FetchDownloadManager.kt
+ - ActivityHandlerHelper.startIntentAndCatch
+ - Intent wrappers:
+   - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt
+     - External app intercepter
+   - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt
+
+=== application-services ===
+
+Rust:
+ - components/fxa-client/src/http_client.rs
+   - XXX: Does oauth token refresh without proxy :/
+ - XXX: More rust.. Suspicious components:
+   - fxa-client
+   - mozilla sync
+   - mozilla app service login
+   - Push notification support
+
+XXX: re-check this with script. Is this cut+paste error? nothing here, really?
+Android Java calls
+ - URLConnection
+ - HttpURLConnection
+ - UrlConnectionDownloader
+ - ch.boye.httpclientandroidlib.impl.client.* (look for execute() calls)
+ - grep -n openConnection\( mobile/android/thirdparty/
+ - java.net.URL -- has SEVERAL proxy bypass URL fetching methods :/
+ - java.net
+ - javax.net
+ - okhttp3
+ - ch.boye.httpclientandroidlib.conn.* (esp ssl)
+ - ch.boye.httpclientandroidlib.impl.conn.* (esp ssl)
+ - Sudden appearance of thirdparty libs:
+   - OkHttp
+   - Retrofit
+   - Glide
+   - com.amitshekhar.android
+ - android.net
+ - android.webkit ************
+ - IntentHelper
+   - openUriExternal (can come from GeckoAppShell too)
+   - getHandlersForMimeType
+   - getHandlersForURL
+   - getHandlersForIntent
+ - android.content.Intent - too common; instead find launch methods:
+   - startActivity
+   - startActivities
+   - sendBroadcast
+   - sendOrderedBroadcast
+   - startService
+   - bindService
+ - android.app.PendingIntent
+ - android.app.DownloadManager
+ - ActivityHandlerHelper.startIntentAndCatch
+ - Intent wrappers:
+   - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt
+     - External app intercepter
+   - components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt
+
+
+============ Regression/Prior Vuln Review =========
+
+Review proxy bypass bugs; check for new vectors to look for:
+ - https://trac.torproject.org/projects/tor/query?keywords=~tbb-proxy
+   - Look for new features like these. Especially external app launch vectors
+

_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits
Prev by Author: [tor-commits] [tor-browser/tor-browser-81.0b9-10.0-1] Bug 40025: Remove Mozilla add-on install permissions
Next by Author: [tor-commits] [tor-browser/tor-browser-81.0b9-10.0-1] Bug 40091: Load HTTPS Everywhere as a builtin addon in desktop
Previous by thread: [tor-commits] [stem/master] Header link to github
Next by thread: [tor-commits] [translation/communitytpo-contentspot_completed] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot_completed
Index(es):
- Author
- Thread