Tor browser context #473

darkdh · 2018-02-01T22:26:49Z

context creating options: "isolated_storage", "tor_proxy"
setTorNewIdentity API
automatically launch tor when tor browser context created and tear it
down when tor browser context destroyed

browser-laptop changes: https://github.com/brave/browser-laptop/tree/feature/tor

Auditors: @bridiver, @riastradh-brave, @diracdeltas

diracdeltas · 2018-02-02T00:10:11Z

lgtm but don't we still need to set ShouldUseProcessPerSite to true for the Tor browser context in order to ensure that different origins do not share a Site Instance?

darkdh · 2018-02-02T00:13:33Z

yeah, you are right. I forgot to do that.

requires brave/muon#473

bridiver · 2018-02-07T21:20:19Z

brave/browser/brave_browser_context.cc

@@ -643,6 +751,23 @@ void BraveBrowserContext::SetExitType(ExitType exit_type) {
  }
 }

+void BraveBrowserContext::SetTorNewIdentity(const GURL& url,


what is this used for?

it's tied to a button that the user clicks when they want a new Tor circuit. https://tb-manual.torproject.org/en-US/managing-identities.html

this doesn't seem to match the described functionality - "This option is useful if you want to prevent your subsequent browser activity from being linkable to what you were doing before. Selecting it will close all your open tabs and windows, clear all private information such as cookies and browsing history, and use new Tor circuits for all connections"

it looks like it just creates a new tor proxy, but based on the description I think each Tor identify would be similar to a session tab and create a new browser context

Sorry, it should be this New Tor Circuit for this Site

if we're trying to make this friendly for non-technical users I don't think New Tor Circuit for this site is going to help. I even had to dig a little bit to understand exactly what that means. Why don't we just do this anytime a user reloads a url (explicit reload vs normal navigation)?

We've already used different tor circuits for different sites. This function enable users to change it.
cc @riastradh-brave

The user-visible operation was just copied from the Tor Browser. It has not undergone any UX review on the Brave side, which certainly ought to happen before this is released. However, I expect that whatever manifestation it has to the user, we will probably want an operation to require a new Tor circuit for an origin -- possibly never used on its own, always in conjunction with other things, but I can't see that far ahead right now.

bridiver · 2018-02-07T21:22:10Z

brave/browser/brave_content_browser_client.cc

+      *partition_domain = site.host();
+      *partition_name = site.host();
+    }
+    *in_memory = true;


this should be set to brave_browser_context->IsOffTheRecord() so we don't run into problems later if we add support for persistent tor tabs

This is for the case of IsIsolatedStorage and it is always in memory https://github.com/brave/muon/pull/473/files#diff-df5c427fd693f9ebb2e5952cf0e9c8c7R388

IsIsolatedStorage does not imply in_memory so I still think this should use IsOffTheRecord

bridiver · 2018-02-07T21:24:04Z

brave/browser/brave_browser_context.cc

+    StoragePartitionDescriptor descriptor(partition_path, in_memory);
+    URLRequestContextGetterMap::iterator iter =
+      url_request_context_getter_map_.find(descriptor);
+  if (iter != url_request_context_getter_map_.end())


bridiver · 2018-02-07T21:32:02Z

brave/browser/brave_browser_context.cc

@@ -363,6 +436,36 @@ void BraveBrowserContext::UpdateDefaultZoomLevel() {
      ->OnDefaultZoomLevelChanged();
 }

+void BraveBrowserContext::TorSetProxy(


these methods have to be called on the IO thread

addressed in 393465d

bridiver

IO/UI thread issues

requires brave/muon#473

darkdh · 2018-03-14T22:19:43Z

brave/browser/brave_browser_context.cc

+  if (options.GetString("tor_proxy", &tor_proxy)) {
+    tor_proxy_ = GURL(tor_proxy);
+    if (!tor_process_.IsValid()) {
+      base::FilePath tor("/usr/local/bin/tor");


@jumde this path need to be changed depends on the binary location we want to bundle

i would slightly prefer that this be ./app/extensions/bin/tor (relative to root of browser-laptop) similar to what we will do with geth: https://github.com/brave/browser-laptop/pull/13177/files#diff-a108ee634057ec3892dd3354639d2117R11.

see getExtensionsPath in browser-laptop for how to get this path

that's better. we can export a option tor_bin_path and passing it from browser-laptop

and we can have a unified path among different platforms

darkdh · 2018-03-20T18:39:27Z

rebased to current master with C65

@bridiver

fix brave/browser-laptop#14021 Auditors: @bridiver, @jumde

…rocess

This is necessary because there is an unfortunate ordering issue with tor startup: it writes the control port first, and then the auth cookie, but we need both in order to connect to the control port. And it doesn't delete the auth cookie, so it can get stale. Hence we need to monitor writes to the auth cookie too.

@bridiver

fix brave/browser-laptop#14390 Auditors: @bridiver, @riastradh-brave

@darkdh

This is necessary because we use `persist:tor' since for hysterical raisins there's only one normal `private' partition with in_memory_ = true. We use the virtual method IsOffTheRecord() to discriminate instead. Fixes #608. Fixes brave/browser-laptop#14392. Auditors: @darkdh

@riastradh-brave

and launch new one with same arguments Auditors: @riastradh-brave, @diracdeltas

@riastradh-brave

…ion.getTorPid() NOTE: Use setTorLauncherCallback right after Session.fromPartition for tor browser context if you want to get pid after launch Auditors: @riastradh-brave, @diracdeltas

@riastradh-brave

because we don't want to spend extra cycles to keep track of expired keys fix #611 Auditors: @riastradh-brave

Don't just expire any old entries for the site we're browsing -- that may leave lots of other ones around in memory.

@darkdh

The timer is scheduled to run ten minutes after the last circuit that was created. This way, the last ten minutes of circuits are not guaranteed to stick around in memory indefinitely. Caveat: This doesn't _zero_ the memory, so it may still appear in `strings /proc/N/mem`. But it does make the memory available to be recycled, so it's not _guaranteed_ to still appear in `strings /proc/N/mem`. Also, timestamp the map entries. If we explicitly create a new map entry for a site by requesting a new identity, the old expiry queue entry will not delete it, but a new expiry queue entry will delete it. This way, circuits created by requesting a new identity are not shorter-lived than other circuits. We leave the old entries in the priority queue because there's no convenient way to delete them with std::priority_queue. In principle, this might leak space if you repeatedly request a new identity, but it can only leak as much space as you use by repeatedly requesting a new identity for a maximum of ten minutes. fix #611 real good this time Auditors: @darkdh Test Plan: 1. Search DDG for `what is my ip address'. 2. Record the IP address it reports. 3. Reload. 4. Confirm it's the same IP address. 5. Full-reload. 6. Confirm it's a different IP address. Record the new IP address. 7. Wait >10min. 8. Reload. 9. Confirm it's a different IP address again.

@bridiver

Auditor: @bridiver

@riastradh-brave

…lity process fix brave/browser-laptop#14636 SuicideOnChannelErrorFilter calls exit in OnChannelError() this will cause other endpoints listener can't finish their cleanup when pipe error happens(browser process crashed or be killed) and SuicideOnChannelErrorFilter::OnChannelError happens to be called before others. This should be fine for most of the cases but not tor_launcher service. `TorLauncher` requires StrongBinding::OnConnectionError to delete itself so that `~TorLauncher` will get called and terminate tor process. This should only happens on MacOS, SuicideOnChannelErrorFilter is guarded by OS_POSIX and Linux has `prctl(PR_SET_PDEATHSIG, SIGKILL)` so tor process will receive SIGKILL when tor_launcher utility process terminates prematurely Auditors: @riastradh-brave, @bridiver, @bbondy

@bridiver

…er_suppressed(noopener) specified because WebContentsImpl::CreateNewWindow will use target_url as new site instance The problem was cloning original site instance cause the inconsistency between original partition and target partition because tor browser context enforce isolation storage so every different site has its own storage partition fix brave/browser-laptop#14392 Test Plan: 1. Open tor tab 2. Visit site contains rel="noopener" href (https://jsfiddle.net/dqokhmsg/) 3. Click the link 4. Brave shouldn't crash Auditors: @bridiver, @bbondy

Prevent `SuicideOnChannelErrorFilter` to be added to tor_launcher utility process

Use new site instance for SessionStorageNamespaceImpl clone when opener_suppressed(noopener) specified

darkdh self-assigned this Feb 1, 2018

darkdh requested review from bridiver, diracdeltas and riastradh-brave February 1, 2018 22:26

darkdh added a commit to brave/browser-laptop that referenced this pull request Feb 1, 2018

Support isolated_storage and tor_proxy

b28c006

requires brave/muon#473

diracdeltas mentioned this pull request Feb 1, 2018

frontend changes for tor integration brave/browser-laptop#12987

Closed

diracdeltas added the feature/tor label Feb 2, 2018

diracdeltas pushed a commit to brave/browser-laptop that referenced this pull request Feb 6, 2018

Support isolated_storage and tor_proxy

dbf844e

requires brave/muon#473

bridiver reviewed Feb 7, 2018

View reviewed changes

bridiver suggested changes Feb 7, 2018

View reviewed changes

darkdh changed the title ~~Adding tor browser context support "isolated_storage" and "tor_proxy" options~~ Tor browser context Feb 16, 2018

darkdh added the PR/work-in-progress ⚒ label Feb 22, 2018

darkdh assigned jumde Feb 28, 2018

darkdh force-pushed the tor_browser_context branch from f2df25a to a7e7661 Compare February 28, 2018 23:33

diracdeltas pushed a commit to brave/browser-laptop that referenced this pull request Feb 28, 2018

Support isolated_storage and tor_proxy

dcfa949

requires brave/muon#473

riastradh-brave mentioned this pull request Mar 13, 2018

Configure tor subprocess to listen on custom port #530

Closed

darkdh commented Mar 14, 2018

View reviewed changes

darkdh added PR/needs-rebase ۞ and removed PR/work-in-progress ⚒ labels Mar 16, 2018

darkdh force-pushed the tor_browser_context branch from 9775ca9 to 5af2423 Compare March 20, 2018 18:38

darkdh removed the PR/needs-rebase ۞ label Mar 20, 2018

bridiver added the branch-5.1.x label Mar 20, 2018

bridiver added this to the 5.1.1 milestone Mar 20, 2018

darkdh added the PR/work-in-progress ⚒ label Mar 20, 2018

darkdh and others added 20 commits July 6, 2018 09:17

rename tor_imp -> tor_launcher_impl

a0c005f

linux header fix (Mac and Windows have build/precompile.h)

80a8283

Avoid compiler unused return value warning

bb6efb2

Inherits web requests handlers from default parition

579d7d2

fix brave/browser-laptop#14021 Auditors: @bridiver, @jumde

Use TorLauncherFactory to launch tor when browser context init

9b7ab85

Put tor console log into a file

b79be43

Config start_hidden in order to set wShowWindow = SW_HIDE for child p…

ee12072

…rocess

use start_hidden for utility process launching tor

92cc9e2

Add --TruncateLogFile and --pidfile

3a07530

Enable tor daemon control port.

bc12974

Fixes #602 - Add Overlay pref store for tor partition

1d26b72

Use network delegate to intercept every requests and apply proxy config

1588b13

fix brave/browser-laptop#14390 Auditors: @bridiver, @riastradh-brave

C67 rebase

982d067

Export Session.relaunchTor API which will terminate current tor process

86b4d81

and launch new one with same arguments Auditors: @riastradh-brave, @diracdeltas

Export Session.setTorLauncherCallback((result, pid) =>{...}) and Sess…

53efe51

…ion.getTorPid() NOTE: Use setTorLauncherCallback right after Session.fromPartition for tor browser context if you want to get pid after launch Auditors: @riastradh-brave, @diracdeltas

Retire tor circuit isolation key only when it is about to be used

5657527

because we don't want to spend extra cycles to keep track of expired keys fix #611 Auditors: @riastradh-brave

Use a priority queue to expire all >10min-old tor circuit records.

fbf2a29

Don't just expire any old entries for the site we're browsing -- that may leave lots of other ones around in memory.

darkdh force-pushed the tor_browser_context branch from cf215a0 to 845d425 Compare July 6, 2018 16:17

patch cleanup

1ee6a7f

Auditor: @bridiver

darkdh force-pushed the tor_browser_context branch from 845d425 to 1ee6a7f Compare July 12, 2018 22:17

darkdh added 4 commits July 12, 2018 15:19

Merge pull request #631 from brave/tor_cleanup

fb9327a

Prevent `SuicideOnChannelErrorFilter` to be added to tor_launcher utility process

Merge pull request #632 from brave/noopener_check

0ef0d3c

Use new site instance for SessionStorageNamespaceImpl clone when opener_suppressed(noopener) specified

bridiver approved these changes Jul 18, 2018

View reviewed changes

riastradh-brave approved these changes Jul 18, 2018

View reviewed changes

darkdh merged commit 4ffc7f0 into master Jul 18, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tor browser context #473

Tor browser context #473

darkdh commented Feb 1, 2018 •

edited

Loading

diracdeltas commented Feb 2, 2018

darkdh commented Feb 2, 2018

bridiver Feb 7, 2018

diracdeltas Feb 7, 2018

bridiver Feb 8, 2018

bridiver Feb 8, 2018

darkdh Feb 8, 2018

bridiver Feb 8, 2018 •

edited

Loading

darkdh Feb 8, 2018

riastradh-brave Feb 8, 2018

bridiver Feb 7, 2018

darkdh Mar 14, 2018

bridiver Mar 19, 2018

bridiver Feb 7, 2018

bridiver Feb 7, 2018

darkdh Feb 8, 2018

bridiver left a comment

darkdh Mar 14, 2018

diracdeltas Mar 15, 2018

darkdh Mar 15, 2018

darkdh Mar 15, 2018

darkdh commented Mar 20, 2018

Tor browser context #473

Tor browser context #473

Conversation

darkdh commented Feb 1, 2018 • edited Loading

diracdeltas commented Feb 2, 2018

darkdh commented Feb 2, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bridiver Feb 8, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bridiver left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

darkdh commented Mar 20, 2018

darkdh commented Feb 1, 2018 •

edited

Loading

bridiver Feb 8, 2018 •

edited

Loading