Firefox 15-based TBB: "proxy server refusing connections" to check.tpo
In the recent alpha testing bundles, Runa and I have both confirmed that on Linux and OSX, going to check.torproject.org results in Firefox claiming that the proxy server is refusing connections. We were both able to browse around to other websites. I know there's some magic communication between torbutton and check.tpo so I'm assuming the problem is there.
I've assigned this a priority of blocker because I cannot release the new bundles until it is fixed, but I hope my decision to do so does not cause you to have a heart attack, Mike.
Activity
The test to rule out an HTTPS-Everywhere issue could be to install 2.0 instead. https://www.eff.org/https-everywhere.
Either way, I won't really have time to look into this for a while. I also don't think it blocks an alpha release. Just mention it. Maybe someone will figure out at least the offending component/change for us?
Trac:
Priority: blocker to critical-
Also, if some check urls work and some don't, that also would be useful info.
Here is the check URL that works for TBB-2.2: https://check.torproject.org/?lang=en-US&small=1&uptodate=1
It is stored in browser.startup.homepage in about:config.
What value is ending up as your check URL? and what is the value of browser.startup.homepage?
Trac:
Cc: N/A to admin@insecure-complexity.comTesting on a both normal and obfsproxy bundles on OSX (32-bit and 64-bit), same result on all:
-
https://check.torproject.org/?lang=en-US&small=1&uptodate=1 is the URL it goes to and is what is stored in browser.startup.homepage
-
https://check.torproject.org does not load in the current or any new tab, before or after browsing to other sites (which work)
My argument that this is a blocker is primarily that some people rely on the obfsproxy bundles and they are only available as alpha bundles. While I understand that this doesn't actually affect how TBB works for any site except check.tpo, check.tpo is the first site it goes to and it looks like the bundle doesn't work. We can certainly issue a warning that there's some weird bug here, but I'd really love to get it fixed instead. Is there anything I can do to help with that? Right now I can't even downgrade them to 1.4.6 because of the sandbox exceptions... not a lot of great options.
-
-
Ok. Well, I traced this down to our nsIProtocolProxyFilter in Torbutton, which we were using to force our addon updates over Tor for Toggle mode users. Apparently in Firefox 15, it looks like they are now performing some kind of caching on the proxy argument to that filter, so that old proxy settings were getting passed through there from before we changed them based on the env var at startup.
I have no idea why they would cache the variable on a per-domain basis, but simply commenting out the proxy service observer in torbutton was enough to fix it in for me. Since we don't officially support toggle anymore, this hack to disable the filter entirely should be good enough for now.
However, HTTPS-Everywhere relies on the same filter API, so I guess we'll want to keep an eye on that.
I should be able publish a Torbutton release with this fix today or tomorrow.
Trac:
Actualpoints: N/A to 2 Sorry to pour gasoline on your fire, Mike, but we have a very urgent set of releases for 0.2.2.x and 0.2.3.x (see #6811 (moved) for more info). I have to release new packages ASAP... Nick and I are currently trying to decide whether it's worth delaying the 0.2.3.x TBBs for your new Torbutton. I'm not trying to pressure you one way or another, but do you have a better timeframe in mind? I'd like to avoid doing two urgent releases back to back if possible, but I probably can't delay for very long. ("Not very long" = tomorrow morning GMT, let's say before 11am.) Adding Nick to Cc in case he wants to be kept in the loop or thinks I am crazy with that timing.
Trac:
Cc: admin@insecure-complexity.com to admin@insecure-complexity.com, nickm-
I should be able publish a Torbutton release with this fix today or tomorrow. In the past, torbutton releases take just shy of a day of wallclock to complete at best. Exact timing depends on how fast the transifex update runs or if I skip it.
Do we need a TBB-beta series that has obfsproxy, tor 0.2.3.x, and FF 10.x ESR? Can we build all three of TBB-alpha, TBB-beta, and TBB-stable? It is starting to sound like need to..
If you able to create a TBB-beta with FF 10.x-ESR before tomorrow, perhaps that is the best route for the immediate term. Then we can work on fixing this for the next TBB-alpha build after that.
Trac:
Summary: torbutton 1.4.6.1 "proxy server refusing connections" to check.tpo to Firefox 15-based TBB: "proxy server refusing connections" to check.tpo -
Ok, more analysis: Something in FF15 definitely is caching proxy settings by url. Manually altering my proxy settings to new values allows previously loaded urls to still use the old proxy settings. Wow, good thing we jumped off the toggle ship early.
So the reason check.tp.o is failing is because the browser homepage is actually attempting to load before we set new proxy settings from our env vars, which causes it to use the original proxy settings (the previously set, now broken ones) for all subsequent loads.
I can try moving our proxy settings updates to an early-loaded XPCOM component and see if that helps...
The good news is that since they don't use a randomized socks port, I think our Windows builds should be fine...
I don't think right now is the time to make (or discuss) a third branch of TBB.
How about this: I'll set the Linux and OSX bundles to use fixed ports for now. Then we get all of our security updates, the bundles work properly (albeit very slightly differently than they did before), I don't have to make yet another branch of TBB, and you get some more time for Torbutton. Sound good?
Replying to erinn:
I'll set the Linux and OSX bundles to use fixed ports for now. Then we get all of our security updates, the bundles work properly (albeit very slightly differently than they did before), I don't have to make yet another branch of TBB, and you get some more time for Torbutton. Sound good?
I ended up doing this. I think it's mostly win-win, except for the few people who find it conflicts with any Tor they already have running. Let's revisit the three-branch discussion once Torbutton's done?
-
In case anyone was waiting for a signed official copy, you can now get them at https://www.torproject.org/dist/torbutton/torbutton-1.4.6.2.xpi and https://www.torproject.org/dist/torbutton/torbutton-1.4.6.2.xpi.asc.
Not sure how long I'm going to wait until I sign that copy for updates.. Maybe a couple hours?