Porting/Tor Browser

Early efforts to port Tor Browser to POWER are underway. The primary challenge is that Tor Browser uses an unusual build system (rbm) in order to ensure reproducible builds. While Tor's configuration of rbm can cross-compile for Windows and macOS targets, it is not configured out of the box to cross-compile for GNU/Linux targets. As a result, our early efforts are focused on modifying Tor's rbm configuration to support cross-compiling for non-x86 GNU/Linux targets; it is expected that this will be useful not only for POWER but also for targets like ARM.

Current source code is at: https://notabug.org/JeremyRand/tor-browser-build/src/armhf-esr60 (armhf-esr60 branch)

If you're interested in joining the effort, talk to JeremyRand.

Morph Firefox ESR into Pseudo Tor Browser

Users who need Tor Browser on POWER, can't build from source, and can't wait for official binaries from The Tor Project can use the following workaround to morph Firefox ESR into something that resembles Tor Browser (tested on Debian Buster and Debian Bullseye):

1. Install Firefox ESR and Tor.
2. curl --output 000-tor-browser-0.js http://jqs44zhtxl2uo6gk.onion/tor-browser.git/plain/browser/app/profile/000-tor-browser.js?h=tor-browser-78.3.0esr-10.0-2-build2 (substitute the tag for whatever Tor Browser release you want to use)
3. grep -v "^# " 000-tor-browser-0.js | grep -v "^#expand" > 000-tor-browser-1.js
4. cpp -E -D XP_LINUX=1 -D MOZ_BUNDLED_FONTS=1 -o 000-tor-browser-2.js 000-tor-browser-1.js
5. grep -v "^# " 000-tor-browser-2.js > 000-tor-browser-3.js
6. sed "s/9150)/9050)/" 000-tor-browser-3.js > 000-tor-browser.js
7. rm 000-tor-browser-*.js
8. sudo mv 000-tor-browser.js /usr/share/firefox-esr/browser/defaults/preferences/
9. Launch Firefox; install HTTPS Everywhere from the Mozilla Addons repo.

The above trick works because most of Tor Browser's patches are upstreamed to Firefox, and are just hidden behind prefs. Setting Tor Browser's prefs in a standard Firefox ESR instance yields a setup that resembles Tor Browser.

How secure is this?

It's not ideal. Among other things, you don't get the protection of TorButton (such as first-party stream isolation). That said, your browser fingerprint will probably be very similar to real Tor Browser. I've found empirically that even Cloudflare's fingerprinting code thinks I'm using real Tor Browser. It's not going to be as good as real Tor Browser, but it's probably the best thing you can get on POWER if you're not able to build real Tor Browser from source.

Build instructions

make nightly-linux-arm

Errors / Troubleshooting

Unfixed

Missing Pluggable Transports

The fteproxy and snowflake pluggable transports are disabled for non-x86 GNU/Linux targets. These pluggable transports are already non-mandatory for building Tor Browser, and getting them to build for cross-compiled GNU/Linux targets was deemed to be too much of a time sink.

Fixed

syscall not declared

/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:69:31: error: 'syscall' was not declared in this scope

• This is because jsnativestack.cpp forgot to #include <unistd.h>.
• This is fixed in all releases of Tor Browser based on ESR 60.
• For ESR 52, I fixed it by applying a short patch to add the missing include.

getpid not declared

/var/tmp/build/firefox-f8f42fea2af3/js/src/jsnativestack.cpp:77:27: error: 'getpid' was not declared in this scope

• Also caused by missing #include <unistd.h> in jsnativestack.cpp
• Same fixes as above.

Missing libssp.so.0 (file is actually gone)

./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory

• Workaround: copy libssp.so* from the gcc-cross output tar into the Browser directory of the firefox output.
• Fixed in the Firefox rbm build script as of 2018 Oct 10.

Segfault

Segfault immediately on startup in libxul.so

• Only affects ESR 60; ESR 52 unaffected
• Fixed by doing all of these:
  • Upgrade to gcc 7.3.0 / binutils 2.29.1
  • Build with ac_add_options --disable-elf-hack
  • Build with ac_add_options --disable-stylo
• Possibly related bugs:
  • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902231
  • https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1711337
  • https://bugzilla.mozilla.org/show_bug.cgi?id=1452128

Missing libssp.so.0 (file is present but Tor Browser doesn't see it)

./firefox: error while loading shared libraries: libssp.so.0: cannot open shared object file: No such file or directory

• Workaround: add the Browser directory to your LD_LIBRARY_PATH in order for Tor Browser to find the library.
• Fixed by editing the startup shell script.

SSE2 not detected

• Workaround: just manually comment out the SSE2 check in the shell script.
• Fixed by editing the startup shell script.

Task list

• (DONE!) Finish porting this to Firefox ESR 60.
• (DONE!) Build openssl without errors.
• (DONE!) Build libevent without errors.
• (DONE!) Build tor without errors.
• (DONE!) Build firefox-langpacks without errors.
• (DONE!) Build tor-launcher without errors.
• (DONE!) Build torbutton without errors.
• (DONE!) Build python without errors.
• (DONE!) Build https-everywhere without errors.
• (DONE!) Build fonts without errors.
• (DONE!) Build meek without errors.
• (DONE!) Build obfs4 without errors.
• (DONE!) Build tor-browser without errors.
• (DONE!) Build release without errors.
• (DONE!) Add linux-arm targets to Makefile.
• Test the openssl, libevent, tor, firefox-langpacks, tor-launcher, torbutton, python, https-everywhere, fonts, meek, obfs4, tor-browser, and release binaries.
• Re-enable the fteproxy and snowflake projects (low priority).
• Fine-tune the compiler settings. (Are we inadvertently excluding some ARM devices that we want to support? Should we enable Neon?)
• Generalize the GNU/Linux cross-compiling changes so that they work on target arches besides armhf. (ppc64be, ppc64le, and aarch64 are all likely to be useful.)

Upstream Tickets

• Tor Browser for ARM architecture (development effort is currently focused here)
• Tor Browser for PPC64LE