Difference between revisions of "Porting/Tor Browser"

From RCS Wiki
Jump to navigation Jump to search
(Clarify that openssl and libevent build without errors now)
(→‎Morph Firefox ESR into Pseudo Tor Browser: Tor Browser Team has replaced Gitolite with GitLab)
 
(34 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
Early efforts to port Tor Browser to POWER are underway.  The primary challenge is that Tor Browser uses an unusual build system (rbm) in order to ensure reproducible builds.  While Tor's configuration of rbm can cross-compile for Windows and macOS targets, it is not configured out of the box to cross-compile for GNU/Linux targets.  As a result, our early efforts are focused on modifying Tor's rbm configuration to support cross-compiling for non-x86 GNU/Linux targets; it is expected that this will be useful not only for POWER but also for targets like ARM.
+
The POWER port of Tor Browser is mostly complete and is currently awaiting upstream review.  The primary challenge of this port was that Tor Browser uses an unusual build system (rbm) in order to ensure reproducible builds.  While Tor's configuration of rbm can cross-compile for Windows and macOS targets, it is not configured out of the box to cross-compile for GNU/Linux targets.  As a result, the porting efforts focused on modifying Tor's rbm configuration to support cross-compiling for non-x86 GNU/Linux targets.  This also yielded a working port for ARM, which is also awaiting upstream review.
  
−
Current source code is at: https://notabug.org/JeremyRand/tor-browser-build/src/armhf-esr60 (<code>armhf-esr60</code> branch)
+
Current source code is at:  
  
−
If you're interested in joining the effort, talk to Jeremy_Rand or Jeremy_Rand_Talos in #talos-workstation.
+
* https://notabug.org/JeremyRand/tor-browser-build/src/armhf-esr91 (<code>armhf-esr91</code> branch)
 +
* https://notabug.org/JeremyRand/tor-browser-build/src/ppc64le-esr91 (<code>ppc64le-esr91</code> branch)
 +
 
 +
If you're interested in joining the effort, talk to [[User:JeremyRand|JeremyRand]].
 +
 
 +
== Morph Firefox ESR into Pseudo Tor Browser ==
 +
 
 +
Users who need Tor Browser on POWER, can't build from source, and can't wait for official binaries from The Tor Project can use the following workaround to morph Firefox ESR into something that resembles Tor Browser (tested on Debian Buster and Debian Bullseye):
 +
 
 +
# Install Firefox ESR and Tor.
 +
# <code>curl --output 000-tor-browser-0.js http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser/-/raw/tor-browser-102.5.0esr-12.0-2-build1/browser/app/profile/000-tor-browser.js</code> (substitute the tag for whatever Tor Browser release you want to use)
 +
# <code>curl --output 001-base-profile.js http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser/-/raw/tor-browser-102.5.0esr-12.0-2-build1/browser/app/profile/001-base-profile.js</code> (use the same tag as the above line)
 +
# <code>grep -v "^# " 000-tor-browser-0.js | grep -v "^#expand" > 000-tor-browser-1.js</code>
 +
# <code>sed -r 's/#include (.*\.js)$/#include "\1"/' 000-tor-browser-1.js > 000-tor-browser-2.js</code>
 +
# <code>cpp -E -D XP_LINUX=1 -D MOZ_BUNDLED_FONTS=1 -o 000-tor-browser-3.js 000-tor-browser-2.js</code>
 +
# <code>grep -v "^# " 000-tor-browser-3.js > 000-tor-browser-4.js</code>
 +
# <code>sed "s/9150)/9050)/" 000-tor-browser-4.js > 000-tor-browser.js</code>
 +
# <code>rm 000-tor-browser-*.js</code>
 +
# <code>sudo mv 000-tor-browser.js /usr/share/firefox-esr/browser/defaults/preferences/</code>
 +
 
 +
The above trick works because most of Tor Browser's patches are upstreamed to Firefox, and are just hidden behind prefs.  Setting Tor Browser's prefs in a standard Firefox ESR instance yields a setup that resembles Tor Browser.
 +
 
 +
=== How secure is this? ===
 +
 
 +
It's not ideal.  Among other things, you don't get the protection of TorButton (such as first-party stream isolation).  That said, your browser fingerprint will probably be very similar to real Tor Browser.  I've found empirically that even Cloudflare's fingerprinting code thinks I'm using real Tor Browser.  It's not going to be as good as real Tor Browser, but it's probably the best thing you can get on POWER if you're not able to build real Tor Browser from source.
  
 
== Build instructions ==
 
== Build instructions ==
  
−
  <nowiki>./rbm/rbm build firefox --target nightly --target torbrowser-linux-arm
+
Use one of these (depending on which platform you're building for):
−
./rbm/rbm build openssl --target nightly --target torbrowser-linux-arm
+
 
−
./rbm/rbm build libevent --target nightly --target torbrowser-linux-arm</nowiki>
+
  <nowiki>make nightly-linux-arm</nowiki>
 +
 
 +
<nowiki>make nightly-linux-ppc64le</nowiki>
  
 
== Errors / Troubleshooting ==
 
== Errors / Troubleshooting ==
Line 15: Line 41:
 
=== Unfixed ===
 
=== Unfixed ===
  
−
==== Missing libssp.so.0 ====
+
=== Fixed ===
 +
 
 +
==== syscall not declared ====
 +
 
 +
<code>/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:69:31: error: 'syscall' was not declared in this scope</code>
 +
 
 +
* This is because <code>jsnativestack.cpp</code> forgot to <code>#include <unistd.h></code>.
 +
* This is fixed in all releases of Tor Browser based on ESR 60.
 +
* For ESR 52, I fixed it by applying a short patch to add the missing include.
 +
 
 +
==== getpid not declared ====
 +
 
 +
<code>/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:77:27: error: 'getpid' was not declared in this scope</code>
 +
 
 +
* Also caused by missing <code>#include <unistd.h></code> in <code>jsnativestack.cpp</code>
 +
* Same fixes as above.
 +
 
 +
==== Missing libssp.so.0 (file is actually gone) ====
 +
 
 +
<code>./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory</code>
 +
 
 +
* Workaround: copy <code>libssp.so*</code> from the <code>gcc-cross</code> output tar into the <code>Browser</code> directory of the <code>firefox</code> output.
 +
* Fixed in the Firefox rbm build script as of 2018 Oct 10.
 +
 
 +
==== Segfault ====
 +
 
 +
Segfault immediately on startup in <code>libxul.so</code>
 +
 
 +
* Only affects ESR 60; ESR 52 unaffected
 +
* Fixed by doing all of these:
 +
** Upgrade to gcc 7.3.0 / binutils 2.29.1
 +
** Build with <code>ac_add_options --disable-elf-hack</code>
 +
** Build with <code>ac_add_options --disable-stylo</code>
 +
* Possibly related bugs:
 +
** https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902231
 +
** https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1711337
 +
** https://bugzilla.mozilla.org/show_bug.cgi?id=1452128
 +
 
 +
==== Missing libssp.so.0 (file is present but Tor Browser doesn't see it) ====
  
 
<code>./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory</code>
 
<code>./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory</code>
  
 
* Workaround: add the <code>Browser</code> directory to your <code>LD_LIBRARY_PATH</code> in order for Tor Browser to find the library.
 
* Workaround: add the <code>Browser</code> directory to your <code>LD_LIBRARY_PATH</code> in order for Tor Browser to find the library.
−
* This should be fixable by porting the non-Firefox projects (one of which is responsible for setting the <code>LD_LIBRARY_PATH</code>).
+
* Fixed by editing the startup shell script.
 +
 
 +
==== SSE2 not detected ====
  
−
=== Fixed ===
+
* Workaround: just manually comment out the SSE2 check in the shell script.
 +
* Fixed by editing the startup shell script.
 +
 
 +
==== Missing Pluggable Transports ====
  
−
* <code>/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:69:31: error: 'syscall' was not declared in this scope</code>
+
The <code>fteproxy</code> and <code>snowflake</code> pluggable transports are disabled for non-x86 GNU/Linux targets.  These pluggable transports are already non-mandatory for building Tor Browser, and getting them to build for cross-compiled GNU/Linux targets was deemed to be too much of a time sink.
−
** This is because <code>jsnativestack.cpp</code> forgot to <code>#include <unistd.h></code>.  This is fixed in all releases of Tor Browser based on ESR 60.  Since we're still using ESR 52 for now, I fixed it by applying a short patch to add the missing include.
 
−
* <code>/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:77:27: error: 'getpid' was not declared in this scope</code>
 
−
** Also caused by missing <code>#include <unistd.h></code> in <code>jsnativestack.cpp</code>; same fixes as above.
 
−
* <code>./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory</code>
 
−
** Workaround: copy <code>libssp.so*</code> from the <code>gcc-cross</code> output tar into the <code>Browser</code> directory of the <code>firefox</code> output.
 
−
** Fixed in the Firefox rbm build script as of 2018 Oct 10.
 
−
* Segfault immediately on startup in <code>libxul.so</code>
 
−
** Only affects ESR 60; ESR 52 unaffected
 
−
** Fixed by doing all of these:
 
−
*** Upgrade to gcc 7.3.0 / binutils 2.29.1
 
−
*** Build with <code>ac_add_options --disable-elf-hack</code>
 
−
*** Build with <code>ac_add_options --disable-stylo</code>
 
−
** Possibly related bugs:
 
−
*** https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902231
 
−
*** https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1711337
 
−
*** https://bugzilla.mozilla.org/show_bug.cgi?id=1452128
 
  
 
== Task list ==
 
== Task list ==
Line 47: Line 100:
 
* (DONE!)  Build openssl without errors.
 
* (DONE!)  Build openssl without errors.
 
* (DONE!)  Build libevent without errors.
 
* (DONE!)  Build libevent without errors.
−
* Test the openssl and libevent binaries.
+
* (DONE!)  Build tor without errors.
−
* Build the projects besides firefox, openssl, and libevent.
+
* (DONE!)  Build firefox-langpacks without errors.
−
* Generalize the GNU/Linux cross-compiling changes so that they work on target arches besides armhf.  (ppc64be, ppc64le, and aarch64 are all likely to be useful.)
+
* (DONE!)  Build tor-launcher without errors.
 +
* (DONE!)  Build torbutton without errors.
 +
* (DONE!)  Build python without errors.
 +
* (DONE!)  Build https-everywhere without errors.
 +
* (DONE!)  Build fonts without errors.
 +
* (DONE!)  Build meek without errors.
 +
* (DONE!)  Build obfs4 without errors.
 +
* (DONE!)  Build tor-browser without errors.
 +
* (DONE!)  Build release without errors.
 +
* (DONE!)  Add linux-arm targets to Makefile.
 +
* (DONE!)  Test the openssl, libevent, tor, firefox-langpacks, tor-launcher, torbutton, python, https-everywhere, fonts, meek, obfs4, tor-browser, and release binaries.
 +
* (DONE!)  Re-enable the fteproxy and snowflake projects (low priority).
 +
* (DONE!)  Generalize the GNU/Linux cross-compiling changes so that they work on target arches besides armhf.  (ppc64be, ppc64le, and aarch64 are all likely to be useful.)
 +
* Fine-tune the compiler settings.  (Are we inadvertently excluding some ARM devices that we want to support?  Should we enable Neon?)
  
 
== Upstream Tickets ==
 
== Upstream Tickets ==
  
−
* http://ea5faa5po25cf7fb.onion/projects/tor/ticket/12631
+
* [http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser-build/-/issues/32355 Tor Browser for Linux/ARMv7 (x86_64 build arch)] (development effort is currently focused here)
 +
* [http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser-build/-/issues/28326 Tor Browser for PPC64LE]
 +
* [http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser-build/-/issues/40537 Tor Browser for ppc64]
  
 
[[Category:Ports]]
 
[[Category:Ports]]

Latest revision as of 17:48, 7 December 2022

The POWER port of Tor Browser is mostly complete and is currently awaiting upstream review. The primary challenge of this port was that Tor Browser uses an unusual build system (rbm) in order to ensure reproducible builds. While Tor's configuration of rbm can cross-compile for Windows and macOS targets, it is not configured out of the box to cross-compile for GNU/Linux targets. As a result, the porting efforts focused on modifying Tor's rbm configuration to support cross-compiling for non-x86 GNU/Linux targets. This also yielded a working port for ARM, which is also awaiting upstream review.

Current source code is at:

If you're interested in joining the effort, talk to JeremyRand.

Morph Firefox ESR into Pseudo Tor Browser

Users who need Tor Browser on POWER, can't build from source, and can't wait for official binaries from The Tor Project can use the following workaround to morph Firefox ESR into something that resembles Tor Browser (tested on Debian Buster and Debian Bullseye):

  1. Install Firefox ESR and Tor.
  2. curl --output 000-tor-browser-0.js http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser/-/raw/tor-browser-102.5.0esr-12.0-2-build1/browser/app/profile/000-tor-browser.js (substitute the tag for whatever Tor Browser release you want to use)
  3. curl --output 001-base-profile.js http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser/-/raw/tor-browser-102.5.0esr-12.0-2-build1/browser/app/profile/001-base-profile.js (use the same tag as the above line)
  4. grep -v "^# " 000-tor-browser-0.js | grep -v "^#expand" > 000-tor-browser-1.js
  5. sed -r 's/#include (.*\.js)$/#include "\1"/' 000-tor-browser-1.js > 000-tor-browser-2.js
  6. cpp -E -D XP_LINUX=1 -D MOZ_BUNDLED_FONTS=1 -o 000-tor-browser-3.js 000-tor-browser-2.js
  7. grep -v "^# " 000-tor-browser-3.js > 000-tor-browser-4.js
  8. sed "s/9150)/9050)/" 000-tor-browser-4.js > 000-tor-browser.js
  9. rm 000-tor-browser-*.js
  10. sudo mv 000-tor-browser.js /usr/share/firefox-esr/browser/defaults/preferences/

The above trick works because most of Tor Browser's patches are upstreamed to Firefox, and are just hidden behind prefs. Setting Tor Browser's prefs in a standard Firefox ESR instance yields a setup that resembles Tor Browser.

How secure is this?

It's not ideal. Among other things, you don't get the protection of TorButton (such as first-party stream isolation). That said, your browser fingerprint will probably be very similar to real Tor Browser. I've found empirically that even Cloudflare's fingerprinting code thinks I'm using real Tor Browser. It's not going to be as good as real Tor Browser, but it's probably the best thing you can get on POWER if you're not able to build real Tor Browser from source.

Build instructions

Use one of these (depending on which platform you're building for): 

make nightly-linux-arm

make nightly-linux-ppc64le

Errors / Troubleshooting

Unfixed

Fixed

syscall not declared

/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:69:31: error: 'syscall' was not declared in this scope

  • This is because jsnativestack.cpp forgot to #include <unistd.h>.
  • This is fixed in all releases of Tor Browser based on ESR 60.
  • For ESR 52, I fixed it by applying a short patch to add the missing include.

getpid not declared

/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:77:27: error: 'getpid' was not declared in this scope

  • Also caused by missing #include <unistd.h> in jsnativestack.cpp
  • Same fixes as above.

Missing libssp.so.0 (file is actually gone)

./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory

  • Workaround: copy libssp.so* from the gcc-cross output tar into the Browser directory of the firefox output.
  • Fixed in the Firefox rbm build script as of 2018 Oct 10.

Segfault

Segfault immediately on startup in libxul.so

Missing libssp.so.0 (file is present but Tor Browser doesn't see it)

./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory

  • Workaround: add the Browser directory to your LD_LIBRARY_PATH in order for Tor Browser to find the library.
  • Fixed by editing the startup shell script.

SSE2 not detected

  • Workaround: just manually comment out the SSE2 check in the shell script.
  • Fixed by editing the startup shell script.

Missing Pluggable Transports

The fteproxy and snowflake pluggable transports are disabled for non-x86 GNU/Linux targets. These pluggable transports are already non-mandatory for building Tor Browser, and getting them to build for cross-compiled GNU/Linux targets was deemed to be too much of a time sink.

Task list

  • (DONE!) Finish porting this to Firefox ESR 60.
  • (DONE!) Build openssl without errors.
  • (DONE!) Build libevent without errors.
  • (DONE!) Build tor without errors.
  • (DONE!) Build firefox-langpacks without errors.
  • (DONE!) Build tor-launcher without errors.
  • (DONE!) Build torbutton without errors.
  • (DONE!) Build python without errors.
  • (DONE!) Build https-everywhere without errors.
  • (DONE!) Build fonts without errors.
  • (DONE!) Build meek without errors.
  • (DONE!) Build obfs4 without errors.
  • (DONE!) Build tor-browser without errors.
  • (DONE!) Build release without errors.
  • (DONE!) Add linux-arm targets to Makefile.
  • (DONE!) Test the openssl, libevent, tor, firefox-langpacks, tor-launcher, torbutton, python, https-everywhere, fonts, meek, obfs4, tor-browser, and release binaries.
  • (DONE!) Re-enable the fteproxy and snowflake projects (low priority).
  • (DONE!) Generalize the GNU/Linux cross-compiling changes so that they work on target arches besides armhf. (ppc64be, ppc64le, and aarch64 are all likely to be useful.)
  • Fine-tune the compiler settings. (Are we inadvertently excluding some ARM devices that we want to support? Should we enable Neon?)

Upstream Tickets

Retrieved from "https://wiki.raptorcs.com/w/index.php?title=Porting/Tor_Browser&oldid=4070"