chore: sync with probe-cli v3.17.0-alpha.1-75-g9626fffd

ooni · Jun 4, 2023 · 39c7d08 · 39c7d08
1 parent 083e9f0
commit 39c7d08
Show file tree

Hide file tree

Showing 29 changed files with 121 additions and 265 deletions.
diff --git a/UPSTREAM b/UPSTREAM
@@ -1 +1 @@
-v3.17.0-alpha.1-68-ge8feee59
+v3.17.0-alpha.1-75-g9626fffd
diff --git a/go.mod b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/ooni/netem v0.0.0-20230316075930-83d9720a67f9
 	github.com/ooni/oocrypto v0.5.1
 	github.com/ooni/oohttp v0.6.1
-	github.com/ooni/probe-assets v0.15.0
+	github.com/ooni/probe-assets v0.16.0
 	github.com/pborman/getopt/v2 v2.1.0
 	github.com/pion/stun v0.3.5
 	github.com/pkg/errors v0.9.1

diff --git a/go.sum b/go.sum
@@ -612,8 +612,8 @@ github.com/ooni/oocrypto v0.5.1 h1:7LD07H2LA7mAQIVhZ1k6eHlRxN7ux/mHhoFdBUgWFSQ=
 github.com/ooni/oocrypto v0.5.1/go.mod h1:lqrqVa4E9D0tCMmprzbwuokAIvX949HAlUs5crZne3c=
 github.com/ooni/oohttp v0.6.1 h1:lftBsmunh6pzAReLyaSwdez10cJtYRlpC2fa0062HJQ=
 github.com/ooni/oohttp v0.6.1/go.mod h1:/7fPgmXNkMSXBpLOdARkhyn3vsNAtmZ0C3G5C/KLd6Q=
-github.com/ooni/probe-assets v0.15.0 h1:VFOnVO4rypeI6Qfn25Uck1YhAlu3BJQqC9Vrp8nL8C0=
-github.com/ooni/probe-assets v0.15.0/go.mod h1:+otUATjJ8T7NsTKhmkXAKLW9oy0NhbcggXhlKzZHqVI=
+github.com/ooni/probe-assets v0.16.0 h1:X2Zb73KEMmzPM36qMIRDukdGEL/KuUY5OQgBcJHxJ6g=
+github.com/ooni/probe-assets v0.16.0/go.mod h1:+otUATjJ8T7NsTKhmkXAKLW9oy0NhbcggXhlKzZHqVI=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
 github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=

diff --git a/pkg/cmd/buildtool/android_test.go b/pkg/cmd/buildtool/android_test.go
@@ -702,12 +702,12 @@ func TestAndroidBuildCdepsOpenSSL(t *testing.T) {
 		expect: []buildtooltest.ExecExpectations{{
 			Env: []string{},
 			Argv: []string{
-				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
+				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"tar", "-xf", "openssl-1.1.1t.tar.gz",
+				"tar", "-xf", "openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
@@ -763,12 +763,12 @@ func TestAndroidBuildCdepsOpenSSL(t *testing.T) {
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
+				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"tar", "-xf", "openssl-1.1.1t.tar.gz",
+				"tar", "-xf", "openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
@@ -824,12 +824,12 @@ func TestAndroidBuildCdepsOpenSSL(t *testing.T) {
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
+				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"tar", "-xf", "openssl-1.1.1t.tar.gz",
+				"tar", "-xf", "openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
@@ -885,12 +885,12 @@ func TestAndroidBuildCdepsOpenSSL(t *testing.T) {
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
+				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"tar", "-xf", "openssl-1.1.1t.tar.gz",
+				"tar", "-xf", "openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},

diff --git a/pkg/cmd/buildtool/cdepsopenssl.go b/pkg/cmd/buildtool/cdepsopenssl.go
@@ -27,13 +27,13 @@ func cdepsOpenSSLBuildMain(globalEnv *cBuildEnv, deps buildtoolmodel.Dependencie
 	defer restore()
 
 	// See https://github.com/Homebrew/homebrew-core/blob/master/Formula/openssl@1.1.rb
-	cdepsMustFetch("https://www.openssl.org/source/openssl-1.1.1t.tar.gz")
+	cdepsMustFetch("https://www.openssl.org/source/openssl-1.1.1u.tar.gz")
 	deps.VerifySHA256( // must be mockable
-		"8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b",
-		"openssl-1.1.1t.tar.gz",
+		"e2f8d84b523eecd06c7be7626830370300fbcc15386bf5142d72758f6963ebc6",
+		"openssl-1.1.1u.tar.gz",
 	)
-	must.Run(log.Log, "tar", "-xf", "openssl-1.1.1t.tar.gz")
-	_ = deps.MustChdir("openssl-1.1.1t") // must be mockable
+	must.Run(log.Log, "tar", "-xf", "openssl-1.1.1u.tar.gz")
+	_ = deps.MustChdir("openssl-1.1.1u") // must be mockable
 
 	mydir := filepath.Join(topdir, "CDEPS", "openssl")
 	for _, patch := range cdepsMustListPatches(mydir) {
@@ -47,12 +47,12 @@ func cdepsOpenSSLBuildMain(globalEnv *cBuildEnv, deps buildtoolmodel.Dependencie
 	mergedEnv := cBuildMerge(globalEnv, localEnv)
 	envp := cBuildExportOpenSSL(mergedEnv)
 
-	// QUIRK: OpenSSL-1.1.1t wants ANDROID_NDK_HOME
+	// QUIRK: OpenSSL-1.1.1u wants ANDROID_NDK_HOME
 	if mergedEnv.ANDROID_NDK_ROOT != "" {
 		envp.Append("ANDROID_NDK_HOME", mergedEnv.ANDROID_NDK_ROOT)
 	}
 
-	// QUIRK: OpenSSL-1.1.1t wants the PATH to contain the
+	// QUIRK: OpenSSL-1.1.1u wants the PATH to contain the
 	// directory where the Android compiler lives.
 	if mergedEnv.BINPATH != "" {
 		envp.Append("PATH", cdepsPrependToPath(mergedEnv.BINPATH))

diff --git a/pkg/cmd/buildtool/linuxcdeps_test.go b/pkg/cmd/buildtool/linuxcdeps_test.go
@@ -92,12 +92,12 @@ func TestLinuxCdepsBuildMain(t *testing.T) {
 		expect: []buildtooltest.ExecExpectations{{
 			Env: []string{},
 			Argv: []string{
-				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
+				"curl", "-fsSLO", "https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},
 			Argv: []string{
-				"tar", "-xf", "openssl-1.1.1t.tar.gz",
+				"tar", "-xf", "openssl-1.1.1u.tar.gz",
 			},
 		}, {
 			Env: []string{},

diff --git a/pkg/experiment/echcheck/handshake.go b/pkg/experiment/echcheck/handshake.go
@@ -50,7 +50,7 @@ func handshakeWithExtension(ctx context.Context, conn net.Conn, zeroTime time.Ti
 
 // We are creating the pool just once because there is a performance penalty
 // when creating it every time. See https://github.com/ooni/probe/issues/2413.
-var certpool = netxlite.NewDefaultCertPool()
+var certpool = netxlite.NewMozillaCertPool()
 
 // genTLSConfig generates tls.Config from a given SNI
 func genTLSConfig(sni string) *tls.Config {

diff --git a/pkg/experiment/ndt7/dial.go b/pkg/experiment/ndt7/dial.go
@@ -29,21 +29,18 @@ func newDialManager(ndt7URL string, logger model.Logger, userAgent string) dialM
 	}
 }
 
-// We force using our bundled CA pool, which should fix
-// https://github.com/ooni/probe/issues/2031. We are creating
-// the pool just once because there is a performance penalty
-// when creating it every time. See https://github.com/ooni/probe/issues/2413.
-var certpool = netxlite.NewDefaultCertPool()
-
 func (mgr dialManager) dialWithTestName(ctx context.Context, testName string) (*websocket.Conn, error) {
 	reso := netxlite.NewStdlibResolver(mgr.logger)
 	dlr := netxlite.NewDialerWithResolver(mgr.logger, reso)
 	dlr = bytecounter.WrapWithContextAwareDialer(dlr)
 	// Implements shaping if the user builds using `-tags shaping`
 	// See https://github.com/ooni/probe/issues/2112
 	dlr = netxlite.NewMaybeShapingDialer(dlr)
+	// See https://github.com/ooni/probe/issues/2413 to understand
+	// why we're using nil to force netxlite to use the cached
+	// default Mozilla cert pool.
 	tlsConfig := &tls.Config{
-		RootCAs: certpool,
+		RootCAs: nil,
 	}
 	dialer := websocket.Dialer{
 		NetDialContext:  dlr.DialContext,

diff --git a/pkg/experiment/riseupvpn/riseupvpn.go b/pkg/experiment/riseupvpn/riseupvpn.go
@@ -186,7 +186,7 @@ func (m Measurer) Run(ctx context.Context, args *model.ExperimentArgs) error {
 	measurement.TestKeys = testkeys
 	urlgetter.RegisterExtensions(measurement)
 
-	certPool := netxlite.NewDefaultCertPool()
+	certPool := netxlite.NewMozillaCertPool()
 
 	// used multiple times below
 	multi := urlgetter.Multi{

diff --git a/pkg/experiment/signal/signal.go b/pkg/experiment/signal/signal.go
@@ -15,7 +15,7 @@ import (
 
 const (
 	testName    = "signal"
-	testVersion = "0.2.2"
+	testVersion = "0.2.3"
 
 	signalCA = `-----BEGIN CERTIFICATE-----
 MIID7zCCAtegAwIBAgIJAIm6LatK5PNiMA0GCSqGSIb3DQEBBQUAMIGNMQswCQYD
@@ -149,7 +149,7 @@ func (m Measurer) Run(ctx context.Context, args *model.ExperimentArgs) error {
 	defer cancel()
 	urlgetter.RegisterExtensions(measurement)
 
-	certPool := netxlite.NewDefaultCertPool()
+	certPool := netxlite.NewMozillaCertPool()
 	signalCAByteSlice := [][]byte{
 		[]byte(signalCA),
 		[]byte(signalCANew),

diff --git a/pkg/experiment/signal/signal_test.go b/pkg/experiment/signal/signal_test.go
@@ -17,7 +17,7 @@ func TestNewExperimentMeasurer(t *testing.T) {
 	if measurer.ExperimentName() != "signal" {
 		t.Fatal("unexpected name")
 	}
-	if measurer.ExperimentVersion() != "0.2.2" {
+	if measurer.ExperimentVersion() != "0.2.3" {
 		t.Fatal("unexpected version")
 	}
 }
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		v3.17.0-alpha.1-68-ge8feee59
		v3.17.0-alpha.1-75-g9626fffd