- Dillo-dev - lists.mailman3.com

Re: Firefox bookmarks plugin

by Rodrigo Arias

Hi, On Mon, Aug 26, 2024 at 01:31:13AM +0200, Diego wrote: >Good work and very interesting idea. Thanks! >If I can suggest a change I would add this lines to dpidrc at Makefile >the installation > ># Default dillo bookmarks dpi >#bookmarks=bookmarks/bookmarks.dpi ># ffbm: A Dillo plugin to sync bookmarks with Firefox >bookmarks=$(DPI_DIR)/$(BIN) > > >maybe it's time to patch dpidrc to make it more descriptive > >I sugest this >dpi_dir=/usr/local/lib/dillo/dpi > ># standard dillo distributed DPIs >#bookmarks=bookmarks/bookmarks.dpi >#cookies=cookies/cookies.dpi >#downloads=downloads/downloads.dpi >#vsource=vsource/vsource.filter.dpi The file dpidrc only registers the protocols (ftp: -> ftp dpi), the dpis are taken from the dpi_dir or ~/.dillo/dpi automatically. It doesn't require describing the available dpis in the file. Not sure what would be the advantage of doing so. Best, Rodrigo.

Aug. 27, 2024

Re: TLS connect error: "an EOF was observed that violates the protocol"

by Rodrigo Arias

Hi Alex, On Tue, Aug 27, 2024 at 09:56:46PM +0200, a1ex(a)dismail.de wrote: >Hi Rodrigo, > >On Tue, 27 Aug 2024 20:19:32 +0200 >Rodrigo Arias <rodarima(a)gmail.com> wrote: > >> >1) socks5 proxy on 127.0.0.1:8080 not working. >> >> There is currently no support for socks5 proxies, only HTTP proxies >> are supported. > >Thanks for confirming, the docs are not really clear on that. >Could be a nice feature for the future :) Yeah, unfortunately I only have two hands :-) >> >dillo-dev.auriga.wearlab.narkive.com:443 >> > >> >Is this site just broken/misconfigured? >> >> Cannot reproduce with LibreSSL 3.9.2 on Linux. >> ... >> Can you test with the latest LibreSSL 3.9.2? >> >> Is this it happening with the proxy enabled? Also, which user agent >> are you using in curl and Dillo? > >It happens with the stock user agent and no proxy, same with curl. I'm >running the latest snapshot of OpenBSD, which would have the latest >version of LibreSSL. > >I don't care about that site, my only worry is that the error can crash >Dillo. If it happens it is a bug on Dillo side as it is not handling all errors, regardless of the site. I would like to reproduce it to fix it. >This could be an OpenBSD specific issue which wouldn't show up on >Linux. Maybe this is a similar issue: >https://github.com/mitmproxy/mitmproxy/issues/7128 It could be, but I would first reject that is not due to mismatch of versions. The last LibreSSL as per https://www.libressl.org/ is: > The latest stable release is 3.9.2 Which should be printed in the first lines when starting Dillo: > TLS library: LibreSSL 3.9.2 If it says 3.9.0, then Dillo is not using the last release. I can try installing 3.9.0 and see if I can reproduce it with that one. Best, Rodrigo.

Aug. 27, 2024

Re: Issues with HTTP multipart/form-data file upload

by Rodrigo Arias

Hi Xavier, On Mon, Aug 26, 2024 at 01:27:29AM +0200, Xavier Del Campo Romero wrote: >Hello Dillo dev community, > >I am testing support among web browsers for slcl [1], a JS-less >minimalist web storage solution. slcl relies on >"multipart/form-data"-encoded HTTP requests to upload files to a server. >Whereas Dillo helped me to uncover a few wrong assumptions on my code, I >have realised a few issues on Dillo itself related to filue uploads that >should be considered. Glad to read that you also consider Dillo for slcl, and thanks for preparing the patches :-) >Issue #1: > >While Dillo is fine uploading small files (up to a few MiB), things go >wrong with larger files, so much that memory usage increases up to >multiple GiB and can even lock the system up. This is because Dillo is >designed to send requests always from memory, which means file contents >must be dumped into memory first, and this might be unfeasible for large >files. > >Suggestion: > >Instead, Dillo should ideally send file contents on-the-fly, so that >memory usage is kept to a minimum regardless the file size. Sounds good, not sure how complicated it would be to do this. >Issue #2: > >Even if Dillo generates a 70-byte, random boundary string (yet mostly >filled with '-', similarly to Firefox [2]), it ensures it is not found >anywhere inside the file contents. Again, this can be a serious >bottleneck in the case of large files, as it requires to scan the whole >file for a match. > >Suggestion: > >Define *all* of the 70 bytes in the boundary string as random, and >assume they would never be found inside a file. The chance of accidental >collision is so low that it is not worth the effort into checking them. > >Suggested patches: > >- 0001-dialog.cc-Generate-more-random-boundaries.patch) Yes, I think is a good idea. @@ -1246,6 +1246,24 @@ Dstr *DilloHtmlForm::buildQueryData(DilloHtmlInput *active_submit) return DataStr; } +static void generate_boundary(Dstr *boundary) +{ + for (int i = 0; i < 70; i++) { I think this is too long: > Boundary delimiters must not appear within the encapsulated material, > and must be no longer than 70 characters, not counting the two > leading hyphens. Shouldn't it be 68 then? + /* Extracted from RFC 2046, section 5.1.1. */ + static const char set[] = "abcdefghijklmnopqrstuvwxyz" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ" + "0123456789" + "'()+_,-./:=? "; I would leave out all the symbols to avoid quoting and only use A-Z a-z and 0-9. Assuming you are left with 62 symbols (26*2 + 10), the probability of finding a random 70 character string in a random sample of 70 characters is (using ** as ^): p = 1/62**70 = 3.4086e-126 But as you will be dealing with large files, each line of the input could match it. We are interested in the probability that a given boundary will mach any of the N lines. So we compute the probability that it will match none of the lines (1-p)**N and then the opposite of that (matches at least one line): 1 - (1 - p) ** N For example, a 1 TB encoded file, with 2**40/70 lines will have: p = 1 - (1 - 1/62**70) ** (2**40 / 70) Of occurring, which is around 5.354e-116. Which, if I computed it correctly, is still too small to worry about. + char s[sizeof " "] = {0}; Why sizeof " " instead of just 2? + + do { + *s = rand(); + } while (!strspn(s, set)); + + dStr_append(boundary, s); + } +} + /** * Generate a boundary string for use in separating the parts of a * multipart/form-data submission. >Issue #3: > >Dillo only supports uploading 1 file at a time. This is mostly because >it relies (probably temporarily?) on the a_Dialog_save_file function >[3]. However, this is not a limitation on the HTTP protocol, and other >implementation such as Firefox or Chromium-based browsers support this. > >Suggested patches: > >- 0002-dialog-Add-a_Dialog_select_files.patch >- 0003-WIP-multi-file-uploads.patch > >Conclusions: > >Dillo seems designed to always send requests from memory, so it is not >straightforward to break this assumption in order to support large file >uploads. 0003-WIP-multi-file-uploads.patch is an incomplete first step >into fixing this, but it surely needs deeper design changes. > >I did not put more effort into these patches for the time being because, >after seeing the potential complexity behind this task, I thought it was >a better idea to ask the community for feedback and guidelines. I'm not very familiar with this part of Dillo, so I'll have to check a bit more before providing more feedback. However, being able to upload multiple files at the same time sounds reasonable, so feel free to try on your own in the meanwhile. PS: When are you playing? Best, Rodrigo.

Aug. 27, 2024

Re: TLS connect error: "an EOF was observed that violates the protocol"

by a1ex＠dismail.de

Hi Rodrigo, On Tue, 27 Aug 2024 20:19:32 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > >1) socks5 proxy on 127.0.0.1:8080 not working. > > There is currently no support for socks5 proxies, only HTTP proxies > are supported. Thanks for confirming, the docs are not really clear on that. Could be a nice feature for the future :) > >dillo-dev.auriga.wearlab.narkive.com:443 > > > >Is this site just broken/misconfigured? > > Cannot reproduce with LibreSSL 3.9.2 on Linux. > ... > Can you test with the latest LibreSSL 3.9.2? > > Is this it happening with the proxy enabled? Also, which user agent > are you using in curl and Dillo? It happens with the stock user agent and no proxy, same with curl. I'm running the latest snapshot of OpenBSD, which would have the latest version of LibreSSL. I don't care about that site, my only worry is that the error can crash Dillo. This could be an OpenBSD specific issue which wouldn't show up on Linux. Maybe this is a similar issue: https://github.com/mitmproxy/mitmproxy/issues/7128 -Alex

Aug. 27, 2024

Re: TLS connect error: "an EOF was observed that violates the protocol"

by Rodrigo Arias

Hi Alex, On Tue, Aug 27, 2024 at 11:55:04AM +0200, a1ex(a)dismail.de wrote: >Hi, > >Here are 2 separate issues: > >1) socks5 proxy on 127.0.0.1:8080 not working. There is currently no support for socks5 proxies, only HTTP proxies are supported. >This is a proxy over ssh, for example: >ssh -N -D 8080 user(a)example.com > >in dillorc: >http_proxy="http://localhost:8080/" > >console output when trying to connect to a site: >Connecting to 127.0.0.1:8080 >CONNECT through proxy failed. Full reply not received: >(nothing) >** WARNING **: CCC: call on already finished chain. Flags=CCC_Ended > >This setup works fine under Firefox. > >I tried doing a tcpdump while attempting the connection, and there is no >activity. > >So, while trying to research this, I ran into another issue: > >2) Any time I go to a page on this site, Dillo crashes with the >following: > >Nav_open_url: new >url='https://dillo-dev.auriga.wearlab.narkive.com/WT0JYUZq/dillo-won-t-resolve-u…' Dns_server [0]: dillo-dev.auriga.wearlab.narkive.com is 149.248.211.108 >Connecting to 149.248.211.108:443 >TLS connect error: "an EOF was observed that violates the protocol" >Tls_close_by_key: Avoiding SSL shutdown >for: https://dillo-dev.auriga.wearlab.narkive.com/WT0JYUZq/dillo-won-t-resolve-u… fd 6 is done and failed >dillo(13689) in malloc(): write to free mem 0x60383b59140[24..31]@32 >Abort trap > >gdb output: >Program received signal SIGABRT, Aborted. >thrkill () at /tmp/-:2 >2 /tmp/-: No such file or directory. > in /tmp/- > >This is on OpenBSD-current amd64 with LibreSSL 3.9.0, running an >unmodified fresh checkout of Dillo master. Also tested on OpenBSD 7.5 >with the same result. > >I tested the site with: >https://www.ssllabs.com/ssltest/analyze.html?d=dillo-dev.auriga.wearlab.nar… > >There seem to be some handshake failures during the simulation. > >This probably is not be the fault of Dillo, but maybe there is a more >graceful to handle this, rather than crashing. > >Even a test with curl has issues: > >curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to >dillo-dev.auriga.wearlab.narkive.com:443 > >Is this site just broken/misconfigured? Cannot reproduce with LibreSSL 3.9.2 on Linux. % LD_LIBRARY_PATH=/usr/lib/libressl src/dillo https://dillo-dev.auriga.wearlab.narkive.com/WT0JYUZq/dillo-won-t-resolve-u… dillo_dns_init: Here we go! (threaded) TLS library: LibreSSL 3.9.2 Enabling cookies as from cookiesrc... Nav_open_url: new url='https://dillo-dev.auriga.wearlab.narkive.com/WT0JYUZq/dillo-won-t-resolve-u…' Dns_server [0]: dillo-dev.auriga.wearlab.narkive.com is 149.248.211.108 Connecting to 149.248.211.108:443 dillo-dev.auriga.wearlab.narkive.com: TLSv1.3, cipher TLS_AES_128_GCM_SHA256 sha256 2048-bit RSA: /CN=narkive.com sha256 2048-bit RSA: /C=US/O=Let's Encrypt/CN=R11 root: /C=US/O=Internet Security Research Group/CN=ISRG Root X1 NumPendingStyleSheets=1 Dns_server [0]: narkive.net is 188.114.97.5 188.114.96.5 narkive.net: TLSv1.3, cipher TLS_AES_256_GCM_SHA384 ecdsa-with-SHA256 256-bit EC: /CN=narkive.net ecdsa-with-SHA384 256-bit EC: /C=US/O=Google Trust Services/CN=WE1 sha256 384-bit EC: /C=US/O=Google Trust Services LLC/CN=GTS Root R4 root: /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA Can you test with the latest LibreSSL 3.9.2? Is this it happening with the proxy enabled? Also, which user agent are you using in curl and Dillo? Best, Rodrigo.

Aug. 27, 2024

TLS connect error: "an EOF was observed that violates the protocol"

by a1ex＠dismail.de

Hi, Here are 2 separate issues: 1) socks5 proxy on 127.0.0.1:8080 not working. This is a proxy over ssh, for example: ssh -N -D 8080 user(a)example.com in dillorc: http_proxy="http://localhost:8080/" console output when trying to connect to a site: Connecting to 127.0.0.1:8080 CONNECT through proxy failed. Full reply not received: (nothing) ** WARNING **: CCC: call on already finished chain. Flags=CCC_Ended This setup works fine under Firefox. I tried doing a tcpdump while attempting the connection, and there is no activity. So, while trying to research this, I ran into another issue: 2) Any time I go to a page on this site, Dillo crashes with the following: Nav_open_url: new url='https://dillo-dev.auriga.wearlab.narkive.com/WT0JYUZq/dillo-won-t-resolve-u…' Dns_server [0]: dillo-dev.auriga.wearlab.narkive.com is 149.248.211.108 Connecting to 149.248.211.108:443 TLS connect error: "an EOF was observed that violates the protocol" Tls_close_by_key: Avoiding SSL shutdown for: https://dillo-dev.auriga.wearlab.narkive.com/WT0JYUZq/dillo-won-t-resolve-u… fd 6 is done and failed dillo(13689) in malloc(): write to free mem 0x60383b59140[24..31]@32 Abort trap gdb output: Program received signal SIGABRT, Aborted. thrkill () at /tmp/-:2 2 /tmp/-: No such file or directory. in /tmp/- This is on OpenBSD-current amd64 with LibreSSL 3.9.0, running an unmodified fresh checkout of Dillo master. Also tested on OpenBSD 7.5 with the same result. I tested the site with: https://www.ssllabs.com/ssltest/analyze.html?d=dillo-dev.auriga.wearlab.nar… There seem to be some handshake failures during the simulation. This probably is not be the fault of Dillo, but maybe there is a more graceful to handle this, rather than crashing. Even a test with curl has issues: curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to dillo-dev.auriga.wearlab.narkive.com:443 Is this site just broken/misconfigured? Regards, Alex

Aug. 27, 2024

Re: Firefox bookmarks plugin

by Diego

Good work and very interesting idea. If I can suggest a change I would add this lines to dpidrc at Makefile the installation # Default dillo bookmarks dpi #bookmarks=bookmarks/bookmarks.dpi # ffbm: A Dillo plugin to sync bookmarks with Firefox bookmarks=$(DPI_DIR)/$(BIN) maybe it's time to patch dpidrc to make it more descriptive I sugest this dpi_dir=/usr/local/lib/dillo/dpi # standard dillo distributed DPIs #bookmarks=bookmarks/bookmarks.dpi #cookies=cookies/cookies.dpi #downloads=downloads/downloads.dpi #vsource=vsource/vsource.filter.dpi # protocols DPIs proto.file=file/file.dpi proto.ftp=ftp/ftp.filter.dpi proto.data=datauri/datauri.filter.dpi # dpid uses this line when no line for a protocol is found in this file proto.*=misc/ProtocolNotSupported.filter.dpi Thanks for all the work cheers! Diego. El dom, 25 ago 2024 a las 21:55, Rodrigo Arias (<rodarima(a)gmail.com>) escribió: > > Hi, > > Here is another small plugin to sync bookmarks with Firefox Sync: > > https://github.com/dillo-browser/dillo-plugin-ffbm > > It uses the ffsclient program to connect to the Firefox Sync server and > a few lines of shell script for plumbing. It replaces the builtin > bookmarks plugin when installed, so all menu buttons work as expected. > > Best, > Rodrigo > _______________________________________________ > Dillo-dev mailing list -- dillo-dev(a)mailman3.com > To unsubscribe send an email to dillo-dev-leave(a)mailman3.com

Aug. 25, 2024

Issues with HTTP multipart/form-data file upload

by Xavier Del Campo Romero

Hello Dillo dev community, I am testing support among web browsers for slcl [1], a JS-less minimalist web storage solution. slcl relies on "multipart/form-data"-encoded HTTP requests to upload files to a server. Whereas Dillo helped me to uncover a few wrong assumptions on my code, I have realised a few issues on Dillo itself related to filue uploads that should be considered. Issue #1: While Dillo is fine uploading small files (up to a few MiB), things go wrong with larger files, so much that memory usage increases up to multiple GiB and can even lock the system up. This is because Dillo is designed to send requests always from memory, which means file contents must be dumped into memory first, and this might be unfeasible for large files. Suggestion: Instead, Dillo should ideally send file contents on-the-fly, so that memory usage is kept to a minimum regardless the file size. Issue #2: Even if Dillo generates a 70-byte, random boundary string (yet mostly filled with '-', similarly to Firefox [2]), it ensures it is not found anywhere inside the file contents. Again, this can be a serious bottleneck in the case of large files, as it requires to scan the whole file for a match. Suggestion: Define *all* of the 70 bytes in the boundary string as random, and assume they would never be found inside a file. The chance of accidental collision is so low that it is not worth the effort into checking them. Suggested patches: - 0001-dialog.cc-Generate-more-random-boundaries.patch) Issue #3: Dillo only supports uploading 1 file at a time. This is mostly because it relies (probably temporarily?) on the a_Dialog_save_file function [3]. However, this is not a limitation on the HTTP protocol, and other implementation such as Firefox or Chromium-based browsers support this. Suggested patches: - 0002-dialog-Add-a_Dialog_select_files.patch - 0003-WIP-multi-file-uploads.patch Conclusions: Dillo seems designed to always send requests from memory, so it is not straightforward to break this assumption in order to support large file uploads. 0003-WIP-multi-file-uploads.patch is an incomplete first step into fixing this, but it surely needs deeper design changes. I did not put more effort into these patches for the time being because, after seeing the potential complexity behind this task, I thought it was a better idea to ask the community for feedback and guidelines. Thank you very much for reading. Best regards, Xavier Del Campo Romero [1]: https://gitea.privatedns.org/xavi/slcl [2]: https://github.com/dillo-browser/dillo/blob/8a360e32ac3136494a494379a6dbbac… [3]: https://github.com/dillo-browser/dillo/blob/8a360e32ac3136494a494379a6dbbac…

Aug. 25, 2024

Firefox bookmarks plugin

by Rodrigo Arias

Hi, Here is another small plugin to sync bookmarks with Firefox Sync: https://github.com/dillo-browser/dillo-plugin-ffbm It uses the ffsclient program to connect to the Firefox Sync server and a few lines of shell script for plumbing. It replaces the builtin bookmarks plugin when installed, so all menu buttons work as expected. Best, Rodrigo

Aug. 25, 2024

Re: [PATCH] Dark theme for downloads.dpi

by Rodrigo Arias

Hi, On Sat, Aug 24, 2024 at 06:40:33PM +0200, a1ex(a)dismail.de wrote: >Hi, > >On Sat, 24 Aug 2024 15:39:01 +0200 >Rodrigo Arias <rodarima(a)gmail.com> wrote: > >> I'm also thinking we may want to also include the icons, so we avoid >> the problem of having a single icon that must support dark and light >> backgrounds. In this case, maybe a layout like this may be more >> useful: >> >> ~/.dillo/theme/<name>/style.css >> ~/.dillo/theme/<name>/icons.png > >I agree that themed icons would be very nice, so your layout here makes >sense. > >Might be a bit of work to get Dillo to use icons.png instead of the >built-in pixmaps.h though :) > >Anyway, it sounds like this will be a pretty complicated patch. >Not sure where I can help, but can try if desired on smaller parts. Not sure if it would be an easy patch. You may want to review the issues in case you find some that seems more approachable. https://github.com/dillo-browser/dillo/issues I would also appreciate if someone can test this PR by doing some daily google searches over a week or so with the cookies disabled for google: https://github.com/dillo-browser/dillo/pull/251 The question is if it is better to leave the ucbcb=1 parameter in the URL by default or not: search_url="Google https://www.google.com/search?ie=UTF-8&oe=UTF-8&gbv=1&ucbcb=1&q=%s" I tried to skip the consent dialog by denying it by default so it doesn't appear, but I get mixed results even without cookies disabled. Some times it appears again and others it doesn't, not sure how they determine when it should appear. Maybe it is better to leave it out. Testing this PR would be helpful and doesn't require much effort, in case you are interested. I can only do limited tests before Google fingerprints my IP and then it never ask me consent again. (And yes, I'm aware of the implications of using Google, but it is the only search engine that gives me any result in very weird searches like part numbers of unknown electrical components) Best, Rodrigo.

Aug. 25, 2024

Re: [PATCH] dark mode for tooltips

by Rodrigo Arias

Hi Alex, Thanks for the patch. On Sat, Aug 24, 2024 at 10:39:21PM +0200, a1ex(a)dismail.de wrote: >Hi, > >As part of an overall dark mode for Dillo, we could also consider the >tooltips. Yes, I think a theme should affect all the elements of the browser and probably some other interactions. Best, Rodrigo.

Aug. 25, 2024

[PATCH] dark mode for tooltips

by a1ex＠dismail.de

Hi, As part of an overall dark mode for Dillo, we could also consider the tooltips. Here is an example which I think looks reasonable: --- a/src/tipwin.cc Sun Aug 11 22:21:59 2024 +++ b/src/tipwin.cc Sat Aug 24 22:17:21 2024 @@ -40,7 +40,7 @@ static void recent_timeout(void*); */ TipWin::TipWin() : Fl_Menu_Window(1, 1) // will autosize { - bgcolor = fl_color_cube(FL_NUM_RED - 1, FL_NUM_GREEN - 1, FL_NUM_BLUE - 2); + bgcolor = FL_WHITE; recent = 0; tip[0] = '\0'; cur_widget = NULL; @@ -50,8 +50,8 @@ TipWin::TipWin() : Fl_Menu_Window(1, 1) // will au void TipWin::draw() { - draw_box(FL_BORDER_BOX, 0, 0, w(), h(), bgcolor); - fl_color(FL_BLACK); + draw_box(FL_BORDER_FRAME, 0, 0, w(), h(), bgcolor); + fl_color(FL_WHITE); fl_font(labelfont(), labelsize()); fl_draw(tip, 3, 3, w() - 6, h() - 6, //Fl_Align(FL_ALIGN_LEFT | FL_ALIGN_WRAP)); Note that 'ui_main_bg_color' needs to be set to the desired dark color first. Regards, Alex

Aug. 24, 2024

Re: [PATCH] Dark theme for downloads.dpi

by a1ex＠dismail.de

Hi, On Sat, 24 Aug 2024 15:39:01 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I'm also thinking we may want to also include the icons, so we avoid > the problem of having a single icon that must support dark and light > backgrounds. In this case, maybe a layout like this may be more > useful: > > ~/.dillo/theme/<name>/style.css > ~/.dillo/theme/<name>/icons.png I agree that themed icons would be very nice, so your layout here makes sense. Might be a bit of work to get Dillo to use icons.png instead of the built-in pixmaps.h though :) Anyway, it sounds like this will be a pretty complicated patch. Not sure where I can help, but can try if desired on smaller parts. -Alex

Aug. 24, 2024

Re: [PATCH] Dark theme for downloads.dpi

by Rodrigo Arias

Hi, On Sat, Aug 24, 2024 at 02:15:13PM +0200, a1ex(a)dismail.de wrote: >That would be great. Maybe we could just have 2 separate theme css >files for light and dark mode, for example 'light.css' and 'dark.css' >in ~/.dillo might be easiest. I think I would place them under ~/.dillo/theme/ so we can select which one you want from the menu, based on the name you put to the .css file. >How do you envision this will work with the existing 'ui_*_color' prefs >in dillorc? Would we just override those if theming is enabled, or >should we get rid of them entirely and have everything controlled by >the theme? It would be nice to keep it working for some time, so users can slowly update to CSS themes. Maybe we can just auto-generate a legacy.css theme with the dillorc options. I'm also thinking we may want to also include the icons, so we avoid the problem of having a single icon that must support dark and light backgrounds. In this case, maybe a layout like this may be more useful: ~/.dillo/theme/<name>/style.css ~/.dillo/theme/<name>/icons.png Which also makes it easy to install new themes by just cloning a remote git repository. Best, Rodrigo.

Aug. 24, 2024

Re: [PATCH] Dark theme for downloads.dpi

by a1ex＠dismail.de

Hi Rodrigo, On Fri, 23 Aug 2024 01:12:38 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I'm wondering if we could add a mechanism to define themes without > having to rebuild Dillo. > > It would be nice to define some CSS-like styles that define the Dillo > interface colors and button styles too, and be able to switch among > them at runtime. As we already have the CSS parser, we could just use > CSS rules that apply to classes. > ... > I wanted to have at least a light and dark theme, so I can easily > switch from one to another quickly, probably with a single button > like the dark reader extension for Firefox: That would be great. Maybe we could just have 2 separate theme css files for light and dark mode, for example 'light.css' and 'dark.css' in ~/.dillo might be easiest. How do you envision this will work with the existing 'ui_*_color' prefs in dillorc? Would we just override those if theming is enabled, or should we get rid of them entirely and have everything controlled by the theme? > Here are some FLTK themes in Rust which also change the FLTK color > map: > > https://github.com/fltk-rs/fltk-theme/tree/main Thanks, there are some nice looking themes there, and might be a good source for ideas. I also found this, which is written in C++, but targets FLTK 1.4: https://github.com/MoAlyousef/Fl_Theme Regards, Alex

Aug. 24, 2024

Re: [PATCH] Dark theme for downloads.dpi

by Rodrigo Arias

On Wed, Aug 21, 2024 at 06:16:01PM +0200, a1ex(a)dismail.de wrote: >Hi, > >Here is a ligher and slightly more modern looking dark theme for >downloads.dpi. Very nice! I'm wondering if we could add a mechanism to define themes without having to rebuild Dillo. It would be nice to define some CSS-like styles that define the Dillo interface colors and button styles too, and be able to switch among them at runtime. As we already have the CSS parser, we could just use CSS rules that apply to classes. Example: Fl_Widget *o = new Fl_Box(ix,iy,iw,ih, "Got"); o->box(FL_THIN_UP_BOX); o->color(FL_BLACK); o->labelcolor(FL_WHITE); .downloads { color: "white"; /* Use white text by default */ } .downloads.got-header { border-style: thin-up-box; /* custom */ background: "black"; /* Inherits white text */ } I wanted to have at least a light and dark theme, so I can easily switch from one to another quickly, probably with a single button like the dark reader extension for Firefox: https://darkreader.org/ See this issue too: https://github.com/dillo-browser/dillo/issues/247 Here are some FLTK themes in Rust which also change the FLTK color map: https://github.com/fltk-rs/fltk-theme/tree/main Best, Rodrigo.

Aug. 22, 2024

Re: [PATCH v4] unveil patch

by Rodrigo Arias

Hi Alex, On Tue, Aug 20, 2024 at 08:09:16PM +0200, a1ex(a)dismail.de wrote: >Hi, > >Here is an updated version of the unveil patch. > >I think almost everything on the to-do list was completed, except >searching for a custom wget location. I don't see an especially easy >way of doing that, and it seems an unlikely edge-case for someone to >remove wget from the system default location. > >- Permissions have been tightened in dpis >- Checking for AUTHORITY env, fallback to ~/.Xauthority >- Prefs parser is aware of 'enable_unveil' >- Fix some non-strict code warnings >- dillorc 'enable_unveil' default setting >- Formatting, whitespace fixes >- ... > >I have done a fair amount of testing and it works for me. Unless there >is any further feedback or interest, I will leave it as-is for now. Thanks for the patch and for the effort. I'll test it on OpenBSD and the other platforms too to ensure nothing breaks. I'll try to get it merged for the 3.2.0 release. Best, Rodrigo.

Aug. 22, 2024

Re: [PATCH] Dark theme for downloads.dpi

by a1ex＠dismail.de

Hi, Here is a ligher and slightly more modern looking dark theme for downloads.dpi. Enjoy, Alex --- a/dpi/downloads.cc Sun Aug 11 22:21:59 2024 +++ b/dpi/downloads.cc Wed Aug 21 18:06:03 2024 @@ -240,7 +240,7 @@ ProgressBar::ProgressBar(int x, int y, int w, int h, c mShowPct = true; mShowMsg = false; box(FL_THIN_UP_BOX); - color(FL_WHITE); + color(FL_DARK_CYAN); } void ProgressBar::draw() @@ -259,16 +259,16 @@ void ProgressBar::draw() double pct = (mPresent - mMin) / mMax; r.w = r.w * pct + .5; - fl_rectf(r.x, r.y, r.w, r.h, FL_BLUE); + fl_rectf(r.x, r.y, r.w, r.h, FL_WHITE); if (mShowMsg) { - fl_color(FL_RED); + fl_color(FL_BLACK); fl_font(this->labelfont(), this->labelsize()); fl_draw(mMsg, x(), y(), w(), h(), FL_ALIGN_CENTER); } else if (mShowPct) { char buffer[30]; sprintf(buffer, "%d%%", int (pct * 100 + .5)); - fl_color(FL_RED); + fl_color(FL_BLACK); fl_font(this->labelfont(), this->labelsize()); fl_draw(buffer, x(), y(), w(), h(), FL_ALIGN_CENTER); } @@ -345,12 +345,14 @@ DLItem::DLItem(const char *full_filename, const char * WidgetDone = 0; WgetStatus = -1; - gw = 400, gh = 70; + gw = 420, gh = 85; group = new Fl_Group(0,0,gw,gh); group->begin(); + group->color(FL_DARK3); prTitle = new Fl_Box(24, 7, 290, 23); - prTitle->box(FL_RSHADOW_BOX); - prTitle->color(FL_WHITE); + prTitle->box(FL_THIN_UP_BOX); + prTitle->color(FL_BLACK); + prTitle->labelcolor(FL_WHITE); prTitle->align(FL_ALIGN_LEFT|FL_ALIGN_INSIDE|FL_ALIGN_CLIP); prTitle->copy_label(shortname); // Attach this 'log_text' to the tooltip @@ -364,67 +366,78 @@ DLItem::DLItem(const char *full_filename, const char * int ix = 122, iy = 37, iw = 50, ih = 14; Fl_Widget *o = new Fl_Box(ix,iy,iw,ih, "Got"); - o->box(FL_RFLAT_BOX); - o->color(FL_DARK2); + o->box(FL_THIN_UP_BOX); + o->color(FL_BLACK); + o->labelcolor(FL_WHITE); o->labelsize(12); o->tooltip("Downloaded Size"); prGot = new Fl_Box(ix,iy+14,iw,ih, "0KB"); prGot->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); - prGot->labelcolor(FL_BLUE); + prGot->labelcolor(FL_WHITE); prGot->labelsize(12); prGot->box(FL_NO_BOX); ix += iw; o = new Fl_Box(ix,iy,iw,ih, "Size"); - o->box(FL_RFLAT_BOX); - o->color(FL_DARK2); + o->box(FL_THIN_UP_BOX); + o->color(FL_BLACK); + o->labelcolor(FL_WHITE); o->labelsize(12); o->tooltip("Total Size"); prSize = new Fl_Box(ix,iy+14,iw,ih, "??"); prSize->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + prSize->labelcolor(FL_WHITE); prSize->labelsize(12); prSize->box(FL_NO_BOX); ix += iw; o = new Fl_Box(ix,iy,iw,ih, "Rate"); - o->box(FL_RFLAT_BOX); - o->color(FL_DARK2); + o->box(FL_THIN_UP_BOX); + o->color(FL_BLACK); + o->labelcolor(FL_WHITE); o->labelsize(12); o->tooltip("Current transfer Rate (KBytes/sec)"); prRate = new Fl_Box(ix,iy+14,iw,ih, "??"); prRate->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + prRate->labelcolor(FL_WHITE); prRate->labelsize(12); prRate->box(FL_NO_BOX); ix += iw; o = new Fl_Box(ix,iy,iw,ih, "~Rate"); - o->box(FL_RFLAT_BOX); - o->color(FL_DARK2); + o->box(FL_THIN_UP_BOX); + o->color(FL_BLACK); + o->labelcolor(FL_WHITE); o->labelsize(12); o->tooltip("Average transfer Rate (KBytes/sec)"); pr_Rate = new Fl_Box(ix,iy+14,iw,ih, "??"); pr_Rate->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + pr_Rate->labelcolor(FL_WHITE); pr_Rate->labelsize(12); pr_Rate->box(FL_NO_BOX); ix += iw; prETAt = o = new Fl_Box(ix,iy,iw,ih, "ETA"); - o->box(FL_RFLAT_BOX); - o->color(FL_DARK2); + o->box(FL_THIN_UP_BOX); + o->color(FL_BLACK); + o->labelcolor(FL_WHITE); o->labelsize(12); o->tooltip("Estimated Time of Arrival"); prETA = new Fl_Box(ix,iy+14,iw,ih, "??"); prETA->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + prETA->labelcolor(FL_WHITE); prETA->labelsize(12); prETA->box(FL_NO_BOX); prButton = new Fl_Button(326, 9, 44, 19, "Stop"); prButton->tooltip("Stop this transfer"); - prButton->box(FL_UP_BOX); + prButton->box(FL_THIN_UP_BOX); + prButton->color(FL_DARK2); + prButton->labelcolor(FL_BLACK); prButton->clear_visible_focus(); prButton->callback(prButton_scb, this); - group->box(FL_ROUNDED_BOX); + group->box(FL_THIN_UP_BOX); group->end(); }

Aug. 21, 2024

[PATCH] Dark theme for downloads.dpi

by a1ex＠dismail.de

Hi list, Here is a patch which provides a dark theme for downloads.dpi. Screenshot is attached. Maybe something like this could be a part of a future 'dark mode' option for Dillo. Feedback welcome! Regards, Alex --- a/dpi/downloads.cc Sun Aug 11 22:21:59 2024 +++ b/dpi/downloads.cc Wed Aug 21 13:13:41 2024 @@ -240,7 +240,7 @@ ProgressBar::ProgressBar(int x, int y, int w, int h, c mShowPct = true; mShowMsg = false; box(FL_THIN_UP_BOX); - color(FL_WHITE); + color(FL_YELLOW); } void ProgressBar::draw() @@ -259,16 +259,16 @@ void ProgressBar::draw() double pct = (mPresent - mMin) / mMax; r.w = r.w * pct + .5; - fl_rectf(r.x, r.y, r.w, r.h, FL_BLUE); + fl_rectf(r.x, r.y, r.w, r.h, FL_WHITE); if (mShowMsg) { - fl_color(FL_RED); + fl_color(FL_BLACK); fl_font(this->labelfont(), this->labelsize()); fl_draw(mMsg, x(), y(), w(), h(), FL_ALIGN_CENTER); } else if (mShowPct) { char buffer[30]; sprintf(buffer, "%d%%", int (pct * 100 + .5)); - fl_color(FL_RED); + fl_color(FL_BLACK); fl_font(this->labelfont(), this->labelsize()); fl_draw(buffer, x(), y(), w(), h(), FL_ALIGN_CENTER); } @@ -345,12 +345,14 @@ DLItem::DLItem(const char *full_filename, const char * WidgetDone = 0; WgetStatus = -1; - gw = 400, gh = 70; + gw = 420, gh = 85; group = new Fl_Group(0,0,gw,gh); group->begin(); + group->color(FL_BLACK); prTitle = new Fl_Box(24, 7, 290, 23); prTitle->box(FL_RSHADOW_BOX); - prTitle->color(FL_WHITE); + prTitle->color(FL_BLACK); + prTitle->labelcolor(FL_WHITE); prTitle->align(FL_ALIGN_LEFT|FL_ALIGN_INSIDE|FL_ALIGN_CLIP); prTitle->copy_label(shortname); // Attach this 'log_text' to the tooltip @@ -370,7 +372,7 @@ DLItem::DLItem(const char *full_filename, const char * o->tooltip("Downloaded Size"); prGot = new Fl_Box(ix,iy+14,iw,ih, "0KB"); prGot->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); - prGot->labelcolor(FL_BLUE); + prGot->labelcolor(FL_YELLOW); prGot->labelsize(12); prGot->box(FL_NO_BOX); @@ -382,6 +384,7 @@ DLItem::DLItem(const char *full_filename, const char * o->tooltip("Total Size"); prSize = new Fl_Box(ix,iy+14,iw,ih, "??"); prSize->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + prSize->labelcolor(FL_DARK2); prSize->labelsize(12); prSize->box(FL_NO_BOX); @@ -393,6 +396,7 @@ DLItem::DLItem(const char *full_filename, const char * o->tooltip("Current transfer Rate (KBytes/sec)"); prRate = new Fl_Box(ix,iy+14,iw,ih, "??"); prRate->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + prRate->labelcolor(FL_DARK2); prRate->labelsize(12); prRate->box(FL_NO_BOX); @@ -404,6 +408,7 @@ DLItem::DLItem(const char *full_filename, const char * o->tooltip("Average transfer Rate (KBytes/sec)"); pr_Rate = new Fl_Box(ix,iy+14,iw,ih, "??"); pr_Rate->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + pr_Rate->labelcolor(FL_DARK2); pr_Rate->labelsize(12); pr_Rate->box(FL_NO_BOX); @@ -415,16 +420,19 @@ DLItem::DLItem(const char *full_filename, const char * o->tooltip("Estimated Time of Arrival"); prETA = new Fl_Box(ix,iy+14,iw,ih, "??"); prETA->align(FL_ALIGN_CENTER|FL_ALIGN_INSIDE); + prETA->labelcolor(FL_DARK2); prETA->labelsize(12); prETA->box(FL_NO_BOX); prButton = new Fl_Button(326, 9, 44, 19, "Stop"); prButton->tooltip("Stop this transfer"); prButton->box(FL_UP_BOX); + prButton->color(FL_DARK2); + prButton->labelcolor(FL_BLACK); prButton->clear_visible_focus(); prButton->callback(prButton_scb, this); - group->box(FL_ROUNDED_BOX); + group->box(FL_THIN_UP_BOX); group->end(); } @@ -1056,9 +1064,9 @@ DLWin::DLWin(int ww, int wh) { mScroll->resizable(mPG); mWin->end(); mWin->resizable(mScroll); - mWin->callback(dlwin_esc_cb, NULL); + mWin->callback(dlwin_esc_cb, NULL); mWin->show(); - + // Set SIGCHLD handlers sigemptyset(&mask_sigchld); sigaddset(&mask_sigchld, SIGCHLD);

Aug. 21, 2024

Re: BUG FIX for the Clipboard copy function

by a1ex＠dismail.de

Hi, On Tue, 20 Aug 2024 17:33:24 -0000 batavinho(a)mail.com wrote: > Sorry about that guys! The correct value should be 2, not 1. > This solved the problem here. I'm on Linux running LXDE desktop > environment. > > Could you guys test it? > [code] > void FltkPlatform::copySelection(const char *text) > { > Fl::copy(text, strlen(text), 2); > } > [/code] This still breaks the existing functionality. It may act as a workaround for you, but as Rodrigo mentioned, the correct solution is to implement a better copy feature. In the meantime, you may want to experiment with using the middle-click selection paste feature, its very useful. -Alex

Aug. 20, 2024

[PATCH v4] unveil patch

by a1ex＠dismail.de

Hi, Here is an updated version of the unveil patch. I think almost everything on the to-do list was completed, except searching for a custom wget location. I don't see an especially easy way of doing that, and it seems an unlikely edge-case for someone to remove wget from the system default location. - Permissions have been tightened in dpis - Checking for AUTHORITY env, fallback to ~/.Xauthority - Prefs parser is aware of 'enable_unveil' - Fix some non-strict code warnings - dillorc 'enable_unveil' default setting - Formatting, whitespace fixes - ... I have done a fair amount of testing and it works for me. Unless there is any further feedback or interest, I will leave it as-is for now. Regards, Alex diff -upr a/configure.ac b/configure.ac --- a/configure.ac Sun Aug 11 22:21:59 2024 +++ b/configure.ac Tue Aug 20 19:08:02 2024 @@ -36,6 +36,11 @@ AC_ARG_ENABLE([insure], [enable_insure=$enableval], [enable_insure=no]) +AC_ARG_ENABLE([unveil], + [AS_HELP_STRING([--enable-unveil], [Build with support for unveil])], + [enable_unveil=$enableval], + [enable_unveil=no]) + AC_ARG_ENABLE([ipv6], [AS_HELP_STRING([--enable-ipv6], [Build with support for IPv6])], [enable_ipv6=$enableval], @@ -619,6 +624,9 @@ if test "x$enable_insure" = "xyes" ; then CC="insure -Zoi \"compiler $CC\"" LIBS="$LIBS -lstdc++-2-libc6.1-1-2.9.0" fi +if test "x$enable_unveil" = "xyes" ; then + AC_DEFINE([ENABLE_UNVEIL], [1], [Enable unveil]) +fi if test "x$enable_threaded_dns" = "xyes" ; then CFLAGS="$CFLAGS -DD_DNS_THREADED" fi @@ -726,4 +734,5 @@ _AS_ECHO([ GIF enabled : ${enable_gif}]) _AS_ECHO([ SVG enabled : ${enable_svg}]) _AS_ECHO([]) _AS_ECHO([ HTML tests : ${html_tests_ok}]) +_AS_ECHO([ unveil enabled : ${enable_unveil}]) _AS_ECHO([]) diff -upr a/dillorc b/dillorc --- a/dillorc Sun Aug 11 22:21:59 2024 +++ b/dillorc Tue Aug 20 19:08:02 2024 @@ -46,6 +46,9 @@ # height of the visible page area. #scroll_step=100 +# Enable unveil security feature (currently only available on OpenBSD) +#enable_unveil=NO + #------------------------------------------------------------------------- # RENDERING SECTION #------------------------------------------------------------------------- diff -upr a/dlib/dlib.c b/dlib/dlib.c --- a/dlib/dlib.c Sun Aug 11 22:21:59 2024 +++ b/dlib/dlib.c Tue Aug 20 19:08:02 2024 @@ -922,6 +922,100 @@ char *dGethomedir (void) } /** + * Return the save directory in a static string + */ +char *dGetsavedir (void) +{ + static char *dillorc = NULL; + dillorc = dStrconcat(dGethomedir(), "/", ".dillo/dillorc", NULL); + FILE *In; + int len; + char *rcline = NULL, *value = NULL, *p; + if ((In = fopen(dillorc, "r")) == NULL) { + DLIB_MSG("dGetsavedir: unable to open dillorc.\n"); + return (NULL); + } + while ((rcline = dGetline(In)) != NULL) { + if (strncmp(rcline, "save_dir", 8) == 0) + break; + dFree(rcline); + } + fclose(In); + if (!rcline) { + value = NULL; + DLIB_MSG("dGetsavedir: no 'save_dir' in dillorc..\n"); + } else { + len = (int) strlen(rcline); + if (len && rcline[len - 1] == '\n') + rcline[len - 1] = 0; + if ((p = strchr(rcline, '='))) { + while (*++p == ' '); + value = dStrdup(p); + } else { + value = NULL; + DLIB_MSG("dGetsavedir: error parsing value in dillorc.\n"); + } + } + dFree(rcline); + return (value); +} + +/** + * Return the enable_unveil value in a static string + */ +char *dGetenableunveil (void) +{ + static char *dillorc = NULL; + dillorc = dStrconcat(dGethomedir(), "/", ".dillo/dillorc", NULL); + FILE *In; + int len; + char *rcline = NULL, *value = NULL, *p; + if ((In = fopen(dillorc, "r")) == NULL) { + DLIB_MSG("dGetenableunveil: unable to open dillorc.\n"); + return (NULL); + } + while ((rcline = dGetline(In)) != NULL) { + if (strncmp(rcline, "enable_unveil", 13) == 0) + break; + dFree(rcline); + } + fclose(In); + if (!rcline) { + value = NULL; + DLIB_MSG("dGetenableunveil: no 'enable_unveil' in dillorc.\n"); + } else { + len = (int) strlen(rcline); + if (len && rcline[len - 1] == '\n') + rcline[len - 1] = 0; + if ((p = strchr(rcline, '='))) { + while (*++p == ' '); + value = dStrdup(p); + } else { + value = NULL; + DLIB_MSG("dGetenableunveil: error parsing value in dillorc.\n"); + } + } + dFree(rcline); + return (value); +} + +/** + * Use unveil on OpenBSD + */ +void *dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + int unveil(const char *path, const char *permissions); + if (unveil(path, perm) == -1) { + DLIB_MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + +/** * Get a line from a FILE stream. * Return value: read line on success, NULL on EOF. */ diff -upr a/dlib/dlib.h b/dlib/dlib.h --- a/dlib/dlib.h Sun Aug 11 22:21:59 2024 +++ b/dlib/dlib.h Tue Aug 20 19:08:02 2024 @@ -175,6 +175,9 @@ void dLib_show_messages(bool_t show); */ char *dGetcwd(void); char *dGethomedir(void); +char *dGetsavedir(void); +char *dGetenableunveil(void); +void *dUnveil(const char *path, const char *perm); char *dGetline(FILE *stream); int dClose(int fd); int dUsleep(unsigned long us); diff -upr a/dpi/bookmarks.c b/dpi/bookmarks.c --- a/dpi/bookmarks.c Sun Aug 11 22:21:59 2024 +++ b/dpi/bookmarks.c Tue Aug 20 19:08:02 2024 @@ -37,6 +37,7 @@ #include <signal.h> #include "../dpip/dpip.h" #include "dpiutil.h" +#include "../dlib/dlib.h" /* @@ -1606,7 +1607,6 @@ static void termination_handler(int signum) exit(signum); } - /* * -- MAIN ------------------------------------------------------------------- */ @@ -1616,6 +1616,21 @@ int main(void) { socklen_t address_size; char *tok; Dsh *sh; + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + char *dil_bm = dStrconcat(dGethomedir(), "/.dillo/bm.txt", NULL); + dUnveil(dil_bm, "rwc"); + dFree(dil_bm); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "r"); + dFree(dil_loc); + dUnveil(NULL, NULL); + #endif + } + } /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/cookies.c b/dpi/cookies.c --- a/dpi/cookies.c Sun Aug 11 22:21:59 2024 +++ b/dpi/cookies.c Tue Aug 20 19:08:02 2024 @@ -50,6 +50,7 @@ int main(void) #include <signal.h> #include "dpiutil.h" #include "../dpip/dpip.h" +#include "../dlib/dlib.h" /* @@ -1632,7 +1633,6 @@ static void termination_handler(int signum) exit(signum); } - /* * -- MAIN ------------------------------------------------------------------- */ @@ -1643,7 +1643,22 @@ int main(void) { int sock_fd, code; char *buf; Dsh *sh; - + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + char *cookiesrc_loc = dStrconcat(dGethomedir(), "/.dillo/cookiesrc", NULL); + dUnveil(cookiesrc_loc, "rwc"); + dFree(cookiesrc_loc); + char *cookies_loc = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL); + dUnveil(cookies_loc, "rwc"); + dFree(cookies_loc); + dUnveil(NULL, NULL); + #endif + } + } + /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/datauri.c b/dpi/datauri.c --- a/dpi/datauri.c Sun Aug 11 22:21:59 2024 +++ b/dpi/datauri.c Tue Aug 20 19:08:02 2024 @@ -21,6 +21,7 @@ #include "../dpip/dpip.h" #include "dpiutil.h" #include "../src/misc.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -290,6 +291,19 @@ int main(void) unsigned char *data; int rc; size_t data_size = 0; + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/tmp", "rwc"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo/dpid_comm_keys", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + dUnveil(NULL, NULL); + #endif + } + } /* Initialize the SockHandler */ sh = a_Dpip_dsh_new(STDIN_FILENO, STDOUT_FILENO, 8*1024); diff -upr a/dpi/downloads.cc b/dpi/downloads.cc --- a/dpi/downloads.cc Sun Aug 11 22:21:59 2024 +++ b/dpi/downloads.cc Tue Aug 20 19:08:13 2024 @@ -45,6 +45,7 @@ #include "config.h" #include "dpiutil.h" #include "../dpip/dpip.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -206,7 +207,6 @@ static char *escape_tooltip(const char *buf, ssize_t l return ret; } - /* * Global variables */ @@ -1098,13 +1098,37 @@ static void custLabelMeasure(const Fl_Label* o, int& W fl_measure(o->value, W, H, interpret_symbols); } - - //int main(int argc, char **argv) int main() { int ww = 420, wh = 85; - + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/tmp", "rwc"); + dUnveil("/etc/fonts", "r"); + dUnveil("/usr/local/bin/wget", "x"); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + char *xauth = getenv("AUTHORITY"); + if (xauth && strlen(xauth)) { + dUnveil(xauth, "r"); + } else { + dUnveil(xauth_loc, "r"); + } + dFree(xauth_loc); + dFree(xauth); + dUnveil("/usr/local/share/fonts", "r"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "r"); + dFree(dil_loc); + dUnveil(dGetsavedir(), "rw"); + dUnveil(NULL, NULL); + #endif + } + } + Fl::lock(); // Disable '@' and '&' interpretation in normal labels. diff -upr a/dpi/file.c b/dpi/file.c --- a/dpi/file.c Sun Aug 11 22:21:59 2024 +++ b/dpi/file.c Tue Aug 20 19:08:02 2024 @@ -37,6 +37,7 @@ #include "../dpip/dpip.h" #include "dpiutil.h" #include "d_size.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -1063,12 +1064,31 @@ static int File_check_fds(uint_t seconds) return st; } - int main(void) { struct sockaddr_in sin; socklen_t sin_sz; int sock_fd, c_st, st = 1; + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil(dGetsavedir(), "r"); + dUnveil("/tmp", "rw"); + char *home_loc = dStrconcat(dGethomedir(), "", NULL); + dUnveil(home_loc, "r"); + dFree(home_loc); + char *ssh_loc = dStrconcat(dGethomedir(), "/.ssh", NULL); + dUnveil(ssh_loc, ""); + dFree(ssh_loc); + char *config_loc = dStrconcat(dGethomedir(), "/.config", NULL); + dUnveil(config_loc, ""); + dFree(config_loc); + dUnveil(NULL, NULL); + #endif + } + } /* Arrange the cleanup function for abnormal terminations */ if (signal (SIGINT, termination_handler) == SIG_IGN) diff -upr a/dpi/ftp.c b/dpi/ftp.c --- a/dpi/ftp.c Sun Aug 11 22:21:59 2024 +++ b/dpi/ftp.c Tue Aug 20 19:08:02 2024 @@ -44,6 +44,7 @@ #include "../dpip/dpip.h" #include "dpiutil.h" #include "d_size.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -282,6 +283,21 @@ int main(int argc, char **argv) int st, rc; char *p, *d_cmd; + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/tmp", "rwc"); + dUnveil("/usr/local/bin/wget", "x"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "r"); + dFree(dil_loc); + dUnveil(dGetsavedir(), "rwc"); + dUnveil(NULL, NULL); + #endif + } + } + /* wget may need to write a temporary file... */ rc = chdir("/tmp"); if (rc == -1) { diff -upr a/dpi/vsource.c b/dpi/vsource.c --- a/dpi/vsource.c Sun Aug 11 22:21:59 2024 +++ b/dpi/vsource.c Tue Aug 20 19:08:02 2024 @@ -21,6 +21,7 @@ #include <errno.h> #include "../dpip/dpip.h" #include "dpiutil.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -188,6 +189,18 @@ int main(void) char *dpip_tag, *cmd = NULL, *cmd2 = NULL, *url = NULL, *size_str = NULL; char *d_cmd; + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "r"); + dFree(dil_loc); + dUnveil(NULL, NULL); + #endif + } + } + _MSG("starting...\n"); //sleep(20); diff -upr a/dpid/main.c b/dpid/main.c --- a/dpid/main.c Sun Aug 11 22:21:59 2024 +++ b/dpid/main.c Tue Aug 20 19:08:02 2024 @@ -236,6 +236,19 @@ int main(void) //daemon(0,0); /* Use 0,1 for feedback */ /* TODO: call setsid() ?? */ + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/usr/local/lib/dillo", "rx"); + dUnveil("/usr/local/etc/dillo", "r"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dUnveil(NULL, NULL); + #endif + } + } + /* Allow read and write access, but only for the user. * TODO: can this cause trouble with umount? */ umask(0077); diff -upr a/src/dillo.cc b/src/dillo.cc --- a/src/dillo.cc Sun Aug 11 22:21:59 2024 +++ b/src/dillo.cc Tue Aug 20 19:08:02 2024 @@ -463,7 +463,53 @@ int main(int argc, char **argv) fclose(fp); } dLib_show_messages(prefs.show_msg); - + + // Use unveil + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + const char *home = dGethomedir(); + const char *save = prefs.save_dir; + int nsave = strlen(save); + int nhome = strlen(home); + if (nsave <= nhome) { + /* Prevent save_dir="/home" and save_dir=$HOME */ + if (strncmp(save, home, nsave) == 0) { + MSG("save_dir cannot contain home\n"); + exit(1); + } + } + dUnveil("/usr/local/share/fonts", "r"); + dUnveil("/usr/local/share/icons", "r"); + dUnveil("/usr/X11R6/share/X11/locale", "r"); + dUnveil("/usr/X11R6/lib/X11/fonts", "r"); + dUnveil("/usr/local/etc/dillo", "r"); + dUnveil("/tmp", "rwc"); + dUnveil("/usr/local/bin/dpid", "x"); + dUnveil("/etc/fonts", "r"); + dUnveil("/etc/resolv.conf", "r"); + dUnveil("/etc/ssl/cert.pem", "r"); + dUnveil(prefs.save_dir, "rwc"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + char *icons_loc = dStrconcat(dGethomedir(), "/.icons", NULL); + dUnveil(icons_loc, "r"); + dFree(icons_loc); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + char *xauth = getenv("AUTHORITY"); + if (xauth && strlen(xauth)) { + dUnveil(xauth, "r"); + } else { + dUnveil(xauth_loc, "r"); + } + dFree(xauth_loc); + dFree(xauth); + dUnveil(NULL, NULL); + #endif + } + } + // initialize internal modules a_Dpi_init(); a_Dns_init(); diff -upr a/src/prefs.c b/src/prefs.c --- a/src/prefs.c Sun Aug 11 22:21:59 2024 +++ b/src/prefs.c Tue Aug 20 19:08:02 2024 @@ -72,6 +72,7 @@ void a_Prefs_init(void) prefs.http_strict_transport_security = TRUE; prefs.http_force_https = FALSE; prefs.http_user_agent = dStrdup(PREFS_HTTP_USER_AGENT); + prefs.enable_unveil = FALSE; prefs.limit_text_width = FALSE; prefs.adjust_min_width = TRUE; prefs.adjust_table_min_width = TRUE; diff -upr a/src/prefs.h b/src/prefs.h --- a/src/prefs.h Sun Aug 11 22:21:59 2024 +++ b/src/prefs.h Tue Aug 20 19:08:02 2024 @@ -100,6 +100,7 @@ typedef struct { bool_t http_persistent_conns; bool_t http_strict_transport_security; bool_t http_force_https; + bool_t enable_unveil; int32_t buffered_drawing; char *font_serif; char *font_sans_serif; diff -upr a/src/prefsparser.cc b/src/prefsparser.cc --- a/src/prefsparser.cc Sun Aug 11 22:21:59 2024 +++ b/src/prefsparser.cc Tue Aug 20 19:08:02 2024 @@ -182,6 +182,7 @@ void PrefsParser::parse(FILE *fp) PREFS_BOOL, 0 }, { "http_force_https", &prefs.http_force_https, PREFS_BOOL, 0 }, { "http_user_agent", &prefs.http_user_agent, PREFS_STRING, 0 }, + { "enable_unveil", &prefs.enable_unveil, PREFS_BOOL, 0 }, { "limit_text_width", &prefs.limit_text_width, PREFS_BOOL, 0 }, { "adjust_min_width", &prefs.adjust_min_width, PREFS_BOOL, 0 }, { "adjust_table_min_width", &prefs.adjust_table_min_width, PREFS_BOOL, 0 },

Aug. 20, 2024

Re: BUG FIX for the Clipboard copy function

by batavinho＠mail.com

Sorry about that guys! The correct value should be 2, not 1. This solved the problem here. I'm on Linux running LXDE desktop environment. Could you guys test it? [code] void FltkPlatform::copySelection(const char *text) { Fl::copy(text, strlen(text), 2); } [/code]

Aug. 20, 2024

Re: BUG FIX for the Clipboard copy function

by a1ex＠dismail.de

Hi Batavo, On Tue, 20 Aug 2024 16:01:09 +0200 Batavo Silva <batavinho(a)mail.com> wrote: > Hi Dillo devs! > Here is just a small bug fix for the Cipboard copy function. The 3rd > argument passed for the Fl::copy() function should be 1 (not 0) for > it to copy the input text to the clipboard buffer. > > This issue is found at line 702 of file dillo/dw/fltkplatform.cc: > [code] > void FltkPlatform::copySelection(const char *text) > { > Fl::copy(text, strlen(text), 0); // wrong > } > [/code] > > Change it to: > [code] > void FltkPlatform::copySelection(const char *text) > { > Fl::copy(text, strlen(text), 1); > } > [/code] > > Ref: > FLTK > Documentation: https://www.fltk.org/doc-1.3/group__fl__clipboard.html#ga221bc2fa9bd737a825… Unfortunately your above change breaks the selection buffer. For example, currently when I select some text with the mouse, then I can middle-click paste that text into any text input box. That no longer works with your change. Regards, Alex

Aug. 20, 2024

Re: BUG FIX for the Clipboard copy function

by Rodrigo Arias

Hi, On Tue, Aug 20, 2024 at 04:01:09PM +0200, Batavo Silva wrote: > Hi Dillo devs! > Here is just a small bug fix for the Cipboard copy function. The 3rd > argument passed for the Fl::copy() function should be 1 (not 0) for it > to copy the input text to the clipboard buffer. This is not a bug, it follows the primary selection behavior of X11 programs. We should add another way to copy the selection to the clipboard with Control+C (and paste with Control+V) and from the context menu, like other programs do. See: https://github.com/dillo-browser/dillo/issues/228 Best, Rodrigo.

Aug. 20, 2024

BUG FIX for the Clipboard copy function

by Batavo Silva

Hi Dillo devs! Here is just a small bug fix for the Cipboard copy function. The 3rd argument passed for the Fl::copy() function should be 1 (not 0) for it to copy the input text to the clipboard buffer. This issue is found at line 702 of file dillo/dw/fltkplatform.cc: [code] void FltkPlatform::copySelection(const char *text) { Fl::copy(text, strlen(text), 0); // wrong } [/code] Change it to: [code] void FltkPlatform::copySelection(const char *text) { Fl::copy(text, strlen(text), 1); } [/code] Ref: FLTK Documentation: https://www.fltk.org/doc-1.3/group__fl__clipboard.html#ga221bc2fa9bd737a825…

Aug. 20, 2024

Re: portability: gmake vs make

by Rodrigo Arias

Hi, On Sun, Aug 11, 2024 at 01:41:44AM +0200, a1ex(a)dismail.de wrote: > Hi Rodrigo, > > Looking at your recent commit: > > >Make Dillo strictly C99, C++11 and POSIX-2001 compliant, without > >depending on GNU extensions. > > Right now the OpenBSD port of Dillo is dependent on gmake (GNU make) to > build the package. > > Out of curiosity, I tried to use the native 'make' command: > > $ make > > [...] > Making all in doc > Using $< in a non-suffix rule context is a GNUmake idiom (Makefile:556) > *** Error 1 in . (Makefile:583 'all-recursive') > *** Error 2 in . (Makefile:380 'all') > > Everything else builds fine, except this error in doc. > > Here is the offending line: > > $ diff -up a/doc/Makefile.am b/doc/Makefile.am > --- a/doc/Makefile.am Sun Aug 11 00:01:58 2024 > +++ b/doc/Makefile.am Sun Aug 11 00:01:51 2024 > @@ -11,6 +11,6 @@ dillo.1: $(srcdir)/dillo.1.in Makefile > > # Use .in.html instead of .html.in so it is recognized as HTML. > user_help.html: $(srcdir)/user_help.in.html Makefile > - sed 's/__VERSION__/${VERSION}/g' $< > $@ > > DISTCLEANFILES = dillo.1 user_help.html > > > With that removed, there are no errors. We need that sed command to adjust the version in the generated documentation. I didn't knew $< was a GNU extension, but this patch should fix it: diff --git a/doc/Makefile.am b/doc/Makefile.am index 943e70d7..ae2ccd5d 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -11,6 +11,6 @@ dillo.1: $(srcdir)/dillo.1.in Makefile # Use .in.html instead of .html.in so it is recognized as HTML. user_help.html: $(srcdir)/user_help.in.html Makefile - sed 's/__VERSION__/${VERSION}/g' $< > $@ + sed 's/__VERSION__/${VERSION}/g' $(srcdir)/user_help.in.html > $@ DISTCLEANFILES = dillo.1 user_help.html Thanks!, Rodrigo.

Aug. 11, 2024

portability: gmake vs make

by a1ex＠dismail.de

Hi Rodrigo, Looking at your recent commit: >Make Dillo strictly C99, C++11 and POSIX-2001 compliant, without >depending on GNU extensions. Right now the OpenBSD port of Dillo is dependent on gmake (GNU make) to build the package. Out of curiosity, I tried to use the native 'make' command: $ make [...] Making all in doc Using $< in a non-suffix rule context is a GNUmake idiom (Makefile:556) *** Error 1 in . (Makefile:583 'all-recursive') *** Error 2 in . (Makefile:380 'all') Everything else builds fine, except this error in doc. Here is the offending line: $ diff -up a/doc/Makefile.am b/doc/Makefile.am --- a/doc/Makefile.am Sun Aug 11 00:01:58 2024 +++ b/doc/Makefile.am Sun Aug 11 00:01:51 2024 @@ -11,6 +11,6 @@ dillo.1: $(srcdir)/dillo.1.in Makefile # Use .in.html instead of .html.in so it is recognized as HTML. user_help.html: $(srcdir)/user_help.in.html Makefile - sed 's/__VERSION__/${VERSION}/g' $< > $@ DISTCLEANFILES = dillo.1 user_help.html With that removed, there are no errors. Regards, Alex

Aug. 10, 2024

[PATCH v3] unveil patch

by a1ex＠dismail.de

Hi, Here is a new version of the unveil patch. Some notable changes: - Dillo will exit if 'save_dir' is set to $HOME (only with unveil) - dUnveil() function moved to dlib - New 'enable_unveil' pref for dillorc - New dGetsavedir() function to parse 'save_dir' - New dGetenableunveil() function to parse 'enable_unveil' enable_unveil is not used by the prefs parser, but rather dGetenableunveil(). I still need to fix it so that we don't get this warning on the console: prefs: {enable_unveil} is not a recognized token. To-Do: - Localize wget and $AUTHORITY - ... As always, feedback is welcome. Regards, Alex diff -upr a/configure.ac b/configure.ac --- a/configure.ac Wed Aug 7 20:50:53 2024 +++ b/configure.ac Thu Aug 8 20:06:15 2024 @@ -36,6 +36,11 @@ AC_ARG_ENABLE([insure], [enable_insure=$enableval], [enable_insure=no]) +AC_ARG_ENABLE([unveil], + [AS_HELP_STRING([--enable-unveil], [Build with support for unveil])], + [enable_unveil=$enableval], + [enable_unveil=no]) + AC_ARG_ENABLE([ipv6], [AS_HELP_STRING([--enable-ipv6], [Build with support for IPv6])], [enable_ipv6=$enableval], @@ -619,6 +624,9 @@ if test "x$enable_insure" = "xyes" ; then CC="insure -Zoi \"compiler $CC\"" LIBS="$LIBS -lstdc++-2-libc6.1-1-2.9.0" fi +if test "x$enable_unveil" = "xyes" ; then + AC_DEFINE([ENABLE_UNVEIL], [1], [Enable unveil]) +fi if test "x$enable_threaded_dns" = "xyes" ; then CFLAGS="$CFLAGS -DD_DNS_THREADED" fi @@ -726,4 +734,5 @@ _AS_ECHO([ GIF enabled : ${enable_gif}]) _AS_ECHO([ SVG enabled : ${enable_svg}]) _AS_ECHO([]) _AS_ECHO([ HTML tests : ${html_tests_ok}]) +_AS_ECHO([ unveil enabled : ${enable_unveil}]) _AS_ECHO([]) diff -upr a/dlib/dlib.c b/dlib/dlib.c --- a/dlib/dlib.c Wed Aug 7 20:50:53 2024 +++ b/dlib/dlib.c Thu Aug 8 20:07:28 2024 @@ -922,6 +922,99 @@ char *dGethomedir (void) } /** + * Return the save directory in a static string + */ +char *dGetsavedir () +{ + static char *dillorc = NULL; + dillorc = dStrconcat(dGethomedir(), "/", ".dillo/dillorc", NULL); + FILE *In; + int len; + char *rcline = NULL, *value = NULL, *p; + if ((In = fopen(dillorc, "r")) == NULL) { + DLIB_MSG("dGetsavedir: unable to open dillorc.\n"); + return (NULL); + } + while ((rcline = dGetline(In)) != NULL) { + if (strncmp(rcline, "save_dir", 8) == 0) + break; + dFree(rcline); + } + fclose(In); + if (!rcline) { + value = NULL; + DLIB_MSG("dGetsavedir: no 'save_dir' in dillorc..\n"); + } else { + len = (int) strlen(rcline); + if (len && rcline[len - 1] == '\n') + rcline[len - 1] = 0; + if ((p = strchr(rcline, '='))) { + while (*++p == ' '); + value = dStrdup(p); + } else { + value = NULL; + DLIB_MSG("dGetsavedir: error parsing value in dillorc.\n"); + } + } + dFree(rcline); + return (value); +} + +/** + * Return the enable_unveil value in a static string + */ +char *dGetenableunveil () +{ + static char *dillorc = NULL; + dillorc = dStrconcat(dGethomedir(), "/", ".dillo/dillorc", NULL); + FILE *In; + int len; + char *rcline = NULL, *value = NULL, *p; + if ((In = fopen(dillorc, "r")) == NULL) { + DLIB_MSG("dGetenableunveil: unable to open dillorc.\n"); + return (NULL); + } + while ((rcline = dGetline(In)) != NULL) { + if (strncmp(rcline, "enable_unveil", 13) == 0) + break; + dFree(rcline); + } + fclose(In); + if (!rcline) { + value = NULL; + DLIB_MSG("dGetenableunveil: no 'enable_unveil' in dillorc.\n"); + } else { + len = (int) strlen(rcline); + if (len && rcline[len - 1] == '\n') + rcline[len - 1] = 0; + if ((p = strchr(rcline, '='))) { + while (*++p == ' '); + value = dStrdup(p); + } else { + value = NULL; + DLIB_MSG("dGetenableunveil: error parsing value in dillorc.\n"); + } + } + dFree(rcline); + return (value); +} + +/** + * Use unveil on OpenBSD + */ +void *dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + DLIB_MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + +/** * Get a line from a FILE stream. * Return value: read line on success, NULL on EOF. */ diff -upr a/dlib/dlib.h b/dlib/dlib.h --- a/dlib/dlib.h Wed Aug 7 20:50:53 2024 +++ b/dlib/dlib.h Thu Aug 8 20:07:26 2024 @@ -175,6 +175,9 @@ void dLib_show_messages(bool_t show); */ char *dGetcwd(void); char *dGethomedir(void); +char *dGetsavedir(); +char *dGetenableunveil(); +void *dUnveil(const char *path, const char *perm); char *dGetline(FILE *stream); int dClose(int fd); int dUsleep(unsigned long us); diff -upr a/dpi/bookmarks.c b/dpi/bookmarks.c --- a/dpi/bookmarks.c Wed Aug 7 20:50:53 2024 +++ b/dpi/bookmarks.c Thu Aug 8 20:08:40 2024 @@ -37,6 +37,7 @@ #include <signal.h> #include "../dpip/dpip.h" #include "dpiutil.h" +#include "../dlib/dlib.h" /* @@ -1606,7 +1607,6 @@ static void termination_handler(int signum) exit(signum); } - /* * -- MAIN ------------------------------------------------------------------- */ @@ -1616,6 +1616,18 @@ int main(void) { socklen_t address_size; char *tok; Dsh *sh; + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + char *dil_bm = dStrconcat(dGethomedir(), "/.dillo/bm.txt", NULL); + dUnveil(dil_bm, "rwc"); + dFree(dil_bm); + unveil(NULL, NULL); + #endif + } + } /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/cookies.c b/dpi/cookies.c --- a/dpi/cookies.c Wed Aug 7 20:50:53 2024 +++ b/dpi/cookies.c Thu Aug 8 20:08:40 2024 @@ -50,6 +50,7 @@ int main(void) #include <signal.h> #include "dpiutil.h" #include "../dpip/dpip.h" +#include "../dlib/dlib.h" /* @@ -1632,7 +1633,6 @@ static void termination_handler(int signum) exit(signum); } - /* * -- MAIN ------------------------------------------------------------------- */ @@ -1643,7 +1643,19 @@ int main(void) { int sock_fd, code; char *buf; Dsh *sh; - + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + unveil(NULL, NULL); + #endif + } + } + /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/datauri.c b/dpi/datauri.c --- a/dpi/datauri.c Wed Aug 7 20:50:53 2024 +++ b/dpi/datauri.c Thu Aug 8 20:08:40 2024 @@ -21,6 +21,7 @@ #include "../dpip/dpip.h" #include "dpiutil.h" #include "../src/misc.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -290,6 +291,19 @@ int main(void) unsigned char *data; int rc; size_t data_size = 0; + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/tmp", "rwc"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + unveil(NULL, NULL); + #endif + } + } /* Initialize the SockHandler */ sh = a_Dpip_dsh_new(STDIN_FILENO, STDOUT_FILENO, 8*1024); diff -upr a/dpi/downloads.cc b/dpi/downloads.cc --- a/dpi/downloads.cc Wed Aug 7 20:50:53 2024 +++ b/dpi/downloads.cc Thu Aug 8 20:08:40 2024 @@ -45,6 +45,7 @@ #include "config.h" #include "dpiutil.h" #include "../dpip/dpip.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -206,7 +207,6 @@ static char *escape_tooltip(const char *buf, ssize_t l return ret; } - /* * Global variables */ @@ -1098,13 +1098,30 @@ static void custLabelMeasure(const Fl_Label* o, int& W fl_measure(o->value, W, H, interpret_symbols); } - - //int main(int argc, char **argv) int main() { int ww = 420, wh = 85; - + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/tmp", "rwc"); + dUnveil("/etc/fonts", "r"); + dUnveil("/usr/local/bin/wget", "x"); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + dUnveil(xauth_loc, "r"); + dFree(xauth_loc); + dUnveil("/usr/local/share/fonts", "r"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + dUnveil(NULL, NULL); + #endif + } + } + Fl::lock(); // Disable '@' and '&' interpretation in normal labels. diff -upr a/dpi/file.c b/dpi/file.c --- a/dpi/file.c Wed Aug 7 20:50:53 2024 +++ b/dpi/file.c Thu Aug 8 20:08:40 2024 @@ -37,6 +37,7 @@ #include "../dpip/dpip.h" #include "dpiutil.h" #include "d_size.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -1063,12 +1064,24 @@ static int File_check_fds(uint_t seconds) return st; } - int main(void) { struct sockaddr_in sin; socklen_t sin_sz; int sock_fd, c_st, st = 1; + + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil(dGetsavedir(), "rw"); + dUnveil("/tmp", "rw"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + unveil(NULL, NULL); + #endif + } + } /* Arrange the cleanup function for abnormal terminations */ if (signal (SIGINT, termination_handler) == SIG_IGN) diff -upr a/dpi/ftp.c b/dpi/ftp.c --- a/dpi/ftp.c Wed Aug 7 20:50:53 2024 +++ b/dpi/ftp.c Thu Aug 8 20:08:40 2024 @@ -44,6 +44,7 @@ #include "../dpip/dpip.h" #include "dpiutil.h" #include "d_size.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -282,6 +283,21 @@ int main(int argc, char **argv) int st, rc; char *p, *d_cmd; + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/tmp", "rwc"); + dUnveil("/usr/local/bin/wget", "x"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + dUnveil(dGetsavedir(), "rwc"); + unveil(NULL, NULL); + #endif + } + } + /* wget may need to write a temporary file... */ rc = chdir("/tmp"); if (rc == -1) { diff -upr a/dpi/vsource.c b/dpi/vsource.c --- a/dpi/vsource.c Wed Aug 7 20:50:53 2024 +++ b/dpi/vsource.c Thu Aug 8 20:08:40 2024 @@ -21,6 +21,7 @@ #include <errno.h> #include "../dpip/dpip.h" #include "dpiutil.h" +#include "../dlib/dlib.h" /* * Debugging macros @@ -188,6 +189,18 @@ int main(void) char *dpip_tag, *cmd = NULL, *cmd2 = NULL, *url = NULL, *size_str = NULL; char *d_cmd; + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "r"); + dFree(dil_loc); + unveil(NULL, NULL); + #endif + } + } + _MSG("starting...\n"); //sleep(20); diff -upr a/dpid/main.c b/dpid/main.c --- a/dpid/main.c Wed Aug 7 20:50:53 2024 +++ b/dpid/main.c Thu Aug 8 20:07:44 2024 @@ -236,6 +236,19 @@ int main(void) //daemon(0,0); /* Use 0,1 for feedback */ /* TODO: call setsid() ?? */ + /* Use unveil on OpenBSD */ + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + dUnveil("/usr/local/lib/dillo", "rx"); + dUnveil("/usr/local/etc/dillo", "r"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + unveil(NULL, NULL); + #endif + } + } + /* Allow read and write access, but only for the user. * TODO: can this cause trouble with umount? */ umask(0077); diff -upr a/src/dillo.cc b/src/dillo.cc --- a/src/dillo.cc Wed Aug 7 20:50:53 2024 +++ b/src/dillo.cc Thu Aug 8 20:08:54 2024 @@ -463,7 +463,47 @@ int main(int argc, char **argv) fclose(fp); } dLib_show_messages(prefs.show_msg); - + + // Use unveil + if (dGetenableunveil() != NULL) { + if (strncmp(dGetenableunveil(), "YES", 3) == 0) { + #ifdef ENABLE_UNVEIL + const char *home = dGethomedir(); + const char *save = prefs.save_dir; + int nsave = strlen(save); + int nhome = strlen(home); + if (nsave <= nhome) { + /* Prevent save_dir="/home" and save_dir=$HOME */ + if (strncmp(save, home, nsave) == 0) { + MSG("save_dir cannot contain home\n"); + exit(1); + } + } + dUnveil("/usr/local/share/fonts", "r"); + dUnveil("/usr/local/share/icons", "r"); + dUnveil("/usr/X11R6/share/X11/locale", "r"); + dUnveil("/usr/X11R6/lib/X11/fonts", "r"); + dUnveil("/usr/local/etc/dillo", "r"); + dUnveil("/tmp", "rwc"); + dUnveil("/usr/local/bin/dpid", "x"); + dUnveil("/etc/fonts", "r"); + dUnveil("/etc/resolv.conf", "r"); + dUnveil("/etc/ssl/cert.pem", "r"); + dUnveil(prefs.save_dir, "rwc"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + char *icons_loc = dStrconcat(dGethomedir(), "/.icons", NULL); + dUnveil(icons_loc, "r"); + dFree(icons_loc); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + dUnveil(xauth_loc, "r"); + dFree(xauth_loc); + dUnveil(NULL, NULL); + #endif + } + } + // initialize internal modules a_Dpi_init(); a_Dns_init();

Aug. 8, 2024

Re: [PATCH] Toolbar zoom control button

by a1ex＠dismail.de

Hi, On Thu, 8 Aug 2024 14:45:33 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I'm working on a zoom icon that a bit more similar to the other > icons, but I'm having problems to avoid aliasing in the border due to > the limitations of XPM with the alpha transparency. > > I attach two screenshots, one (zoom.png) with the icon background set > to the same color of the menu so the alpha is blended properly (but > the icon is not transparent). > > And another one (zoom-alias.png) with the alpha cutoff at half, so > alpha values less than 127 are converted to transparent pixels. This > one shows some aliasing in the borders, but it works fine if you > change the menu color. > Not sure if there is a good solution to this problem, other than > manually making the aliasing work well with a sharp border. The other > icons cleverly avoid this problem by doing rectangular shapes. The reload button, especially the small one, shows the same issue. But for me it's barely noticable, and I think your icon looks fine! > I'm also considering leaving the save button by default for now, and > moving the zoom button to the right, so we preserve the "muscle > memory" of users. I need to play a bit more to see how it "feels". Yeah, I had also considered that, and agree it might be better to leave the save button. It could result in an unexpected surprise to users upgrading to a new version and saying "Hey, where's the save button!". Regards, Alex

Aug. 8, 2024

Re: [PATCH] Toolbar zoom control button

by Rodrigo Arias

Hi, On Tue, Aug 06, 2024 at 01:27:38PM +0200, Rodrigo Arias wrote: > Hi, > > On Tue, Aug 06, 2024 at 01:14:26PM +0200, a1ex(a)dismail.de wrote: > > > Thanks!, so far it seems to be working fine. > > > > > > I'll try to get it merged soon. > > > > Just wanted to check if there is anything else that needs to be > > addressed with this patch. If so, please let me know and I will work on > > it. > > I think it is good as-is, I just need to test it for a bit. I'll try to > merge it once I finish with other changes I'm working on. It is queued for > 3.2.0: > > https://github.com/dillo-browser/dillo/issues/235 I'm working on a zoom icon that a bit more similar to the other icons, but I'm having problems to avoid aliasing in the border due to the limitations of XPM with the alpha transparency. I attach two screenshots, one (zoom.png) with the icon background set to the same color of the menu so the alpha is blended properly (but the icon is not transparent). And another one (zoom-alias.png) with the alpha cutoff at half, so alpha values less than 127 are converted to transparent pixels. This one shows some aliasing in the borders, but it works fine if you change the menu color. Not sure if there is a good solution to this problem, other than manually making the aliasing work well with a sharp border. The other icons cleverly avoid this problem by doing rectangular shapes. I'm also considering leaving the save button by default for now, and moving the zoom button to the right, so we preserve the "muscle memory" of users. I need to play a bit more to see how it "feels". Best, Rodrigo.

Aug. 8, 2024

Re: [PATCH] Toolbar zoom control button

by Rodrigo Arias

Hi, On Tue, Aug 06, 2024 at 01:14:26PM +0200, a1ex(a)dismail.de wrote: >> Thanks!, so far it seems to be working fine. >> >> I'll try to get it merged soon. > >Just wanted to check if there is anything else that needs to be >addressed with this patch. If so, please let me know and I will work on >it. I think it is good as-is, I just need to test it for a bit. I'll try to merge it once I finish with other changes I'm working on. It is queued for 3.2.0: https://github.com/dillo-browser/dillo/issues/235 Best, Rodrigo.

Aug. 6, 2024

Re: [PATCH] Toolbar zoom control button

by a1ex＠dismail.de

Hi Rodrigo, On Sun, 14 Jul 2024 20:17:44 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > Hi, > > On Sun, Jul 14, 2024 at 07:02:50PM +0200, a1ex(a)dismail.de wrote: > >Hi list, > > > >Here is an improved version of my previous patch. > > > >The icon is fixed, it's basic but does the job. If someone wants to > >make a prettier one, I'm open to it. > > > >Other improvements as discussed with Rodrigo: > > > >- Middle click resets zoom level > >- There is now a 'show_zoom' preference in dillorc (enabled by > >default) > >- The save button has been disabled by default > >- The zoom button has been moved to the right of the refresh button > > > >Please let me know if you find any issues, and hope you enjoy it :) > > Thanks!, so far it seems to be working fine. > > I'll try to get it merged soon. Just wanted to check if there is anything else that needs to be addressed with this patch. If so, please let me know and I will work on it. Thanks, Alex

Aug. 6, 2024

Re: [PATCH v2] Unveil patch

by Rodrigo Arias

Hi, On Mon, Aug 05, 2024 at 05:42:54PM +0200, a1ex(a)dismail.de wrote: >Hi Rodrigo, > >On Mon, 5 Aug 2024 15:06:04 +0200 >Rodrigo Arias <rodarima(a)gmail.com> wrote: > >> >> I think we could just not allow $HOME to be set as save_dir (or any >> >> directory that contains $HOME, like /home) and refuse to start if >> >> this is the case. > >Sorry, I guess this is the part that confused me: >"(or any directory that contains $HOME, like /home)" > >I agree with it, just not sure how to implement while still allowing a >save_dir like '$HOME/Downloads', or '/home/user/Downloads'. > >Maybe it's a simple thing, but any help would be appreciated! By "contains" I mean that $HOME cannot be inside save_dir: bad: save_dir=/ bad: save_dir=/home bad: save_dir=/home/<theuser> ok: save_dir=/home/<theuser>/foo ok: save_dir=/tmp Here is a very simple check (doesn't handle /../ and other problems): const char *home = dGethomedir(); const char *save = prefs.save_dir; int nsave = strlen(save); int nhome = strlen(home); if (nsave <= nhome) { /* Prevent save_dir="/home" and save_dir=$HOME */ if (strncmp(save, home, nsave) == 0) { MSG("save_dir cannot contain home\n"); exit(1); } } Best, Rodrigo.

Aug. 5, 2024

Re: [PATCH v2] Unveil patch

by a1ex＠dismail.de

Hi Rodrigo, On Mon, 5 Aug 2024 15:06:04 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > >> I think we could just not allow $HOME to be set as save_dir (or any > >> directory that contains $HOME, like /home) and refuse to start if > >> this is the case. Sorry, I guess this is the part that confused me: "(or any directory that contains $HOME, like /home)" I agree with it, just not sure how to implement while still allowing a save_dir like '$HOME/Downloads', or '/home/user/Downloads'. Maybe it's a simple thing, but any help would be appreciated! > >Not sure I understand what this achieves. So '/home/user' would be > >blocked, but '/home/user/foo' would be allowed? Why not just > >explicitly block access to ~/.ssh with unveil, and then let the user > >do whatever they want after that? > > Yeah, but there may be a lot of other unknown directories we don't > want Dillo to access to (~/.config, ~/.cache, ...). So I think is a > good approach to block all directories in home, except the downloads > one. > > Another attack may involve encrypting ~/Pictures and asking for a > ransom, so we should prevent any access to home that is not required. I think it's unlikely that a user would explicitly choose $HOME as save_dir, but agree that it would be reasonable to take the precaution just in case. Thanks, Alex

Aug. 5, 2024

Re: [PATCH v2] Unveil patch

by Rodrigo Arias

Hi, On Sun, Aug 04, 2024 at 05:14:52PM +0200, a1ex(a)dismail.de wrote: >> If you see your SSH key in the stdout, the unveil() protection alone >> is not enough to mitigate this attack (check that the key exists >> first, I used id_rsa). This would also confirm that unveil() settings >> don't get inherited in forked children. > >I placed that after the last unveil call and made sure I used a valid >key path. Here is the console output: > >game over exploit, fopen failed: No such file or directory >>From what I am seeing, fork() inherits the unveil, and exec() does >>not. Hmm, I guess that makes more sense. I was thinking we could read the preferences only from Dillo, then unveil accordingly, and then all DPIs would already get the unveiled environment. But as you comment, on the exec() the unveil will reset, so we will need to re-read the dillorc file again. I think this is also a good approach in case someone runs the dpid by hand, so it adheres to what dillorc says. >> Maybe for now we can add a simple implementation of the parser just to >> parse the "save_dir" and the new "enable_unveil" (or similar) option, >> like dpid is doing for dpi_dir. > >Ok thanks, I will try to use that as an example and see if I can get >anywhere with it. Thanks! >> I think we could just not allow $HOME to be set as save_dir (or any >> directory that contains $HOME, like /home) and refuse to start if this >> is the case. > >Not sure I understand what this achieves. So '/home/user' would be >blocked, but '/home/user/foo' would be allowed? Why not just explicitly >block access to ~/.ssh with unveil, and then let the user do whatever >they want after that? Yeah, but there may be a lot of other unknown directories we don't want Dillo to access to (~/.config, ~/.cache, ...). So I think is a good approach to block all directories in home, except the downloads one. Another attack may involve encrypting ~/Pictures and asking for a ransom, so we should prevent any access to home that is not required. Best, Rodrigo.

Aug. 5, 2024

Re: Blurry font

by Rodrigo Arias

Hi, (I'll CC Miles as is not subscribed to the list) On Mon, Aug 05, 2024 at 12:42:26PM +0200, a1ex(a)dismail.de wrote: >Hi, > >On Sun, 4 Aug 2024 23:11:24 +0000 >Miles Wirht <milestheperson(a)posteo.net> wrote: > >> Hello! I've been using the dillo browser to open emails, and I've >> noticed that oftentimes fonts will render blurry, or if they don't, >> they'll become blurry upon a mouse click or any other interaction. Is >> thare an antialising option I'm missing, or is this a deeper issue? >> Thank you for your support. > >I haven't seen that issue before. Perhaps it's something configuration >specific on your end, it would be helpful to know what kind of >operating system and desktop environment you are running. Does the >problem ever happen with other programs, or just Dillo? Have you made >any changes in dillorc, like custom fonts or other display settings? Also, which version of Dillo and FLTK are you using? Any chance you have an HTML test page so we can try to reproduce? Best, Rodrigo.

Aug. 5, 2024

Debian package endorsement request

by Rodrigo Arias

Hi all, I've been trying to update the Dillo Debian package from 3.0.5 to the 3.1.1 version of our repository: https://github.com/dillo-browser/dillo As commented on Fediverse by the maintainer of the Debian package, Axel Beckert (in CC), it would help having an endorsement from previous developers, so we can avoid a xz situation due to the change in upstream: https://fosstodon.org/@xtaran@chaos.social/112909239587911469 Here are all the changes among 3.0.5 and 3.1.1, which contain a lot of commits from Sebastian: https://github.com/dillo-browser/dillo/compare/3.0.5...v3.1.1 And here since the last commit from the original mercurial repo: https://github.com/dillo-browser/dillo/compare/c9b817f5bb8ef2060aa36ebb5b08… I'm adding the dillo-dev mailing list, so we can have a public record, in case we have a similar trust problem in the future. Thanks in advance, Rodrigo.

Aug. 5, 2024

Re: Blurry font

by a1ex＠dismail.de

Hi, On Sun, 4 Aug 2024 23:11:24 +0000 Miles Wirht <milestheperson(a)posteo.net> wrote: > Hello! I've been using the dillo browser to open emails, and I've > noticed that oftentimes fonts will render blurry, or if they don't, > they'll become blurry upon a mouse click or any other interaction. Is > thare an antialising option I'm missing, or is this a deeper issue? > Thank you for your support. I haven't seen that issue before. Perhaps it's something configuration specific on your end, it would be helpful to know what kind of operating system and desktop environment you are running. Does the problem ever happen with other programs, or just Dillo? Have you made any changes in dillorc, like custom fonts or other display settings? Regards, Alex

Aug. 5, 2024

Blurry font

by Miles Wirht

Hello! I've been using the dillo browser to open emails, and I've noticed that oftentimes fonts will render blurry, or if they don't, they'll become blurry upon a mouse click or any other interaction. Is thare an antialising option I'm missing, or is this a deeper issue? Thank you for your support.

Aug. 4, 2024

Re: [PATCH v2] Unveil patch

by a1ex＠dismail.de

Hi, On Sun, 4 Aug 2024 13:14:24 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > If this is the case, unless we prevent Dillo from being able to fork > I don't think the unveil(2) protection is enough without pledge(2) to > prevent this attack. From what I am seeing, fork() inherits the unveil, and exec() does not. -Alex

Aug. 4, 2024

Re: [PATCH v2] Unveil patch

by a1ex＠dismail.de

Hi Rodrigo, On Sun, 4 Aug 2024 13:14:24 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I think an RCE bug could allow an attacker to write an exploit in an > HTML document (or image or any other thing parsed from the web) that > would cause Dillo to execute the fork() syscall and then access those > files and transfer the content to a remote host. See: > > https://en.wikipedia.org/wiki/Return-oriented_programming > > If this is the case, unless we prevent Dillo from being able to fork > I don't think the unveil(2) protection is enough without pledge(2) to > prevent this attack. > > We can test it by putting this code after the last unveil() call, as > if Dillo was running an exploit: > > int ret = fork(); > if (ret < 0) { > perror("fork failed"); > } else if (ret == 0) { > /* Child */ > FILE *f = fopen("/home/<theuser>/.ssh/id_rsa", "r"); // Adjust > path if (f == NULL) { > perror("game over exploit, fopen failed"); > } else { > int c; > while ((c = fgetc(f)) != EOF) > fputc(c, stdout); > fclose(f); > } > exit(0); > } > > If you see your SSH key in the stdout, the unveil() protection alone > is not enough to mitigate this attack (check that the key exists > first, I used id_rsa). This would also confirm that unveil() settings > don't get inherited in forked children. I placed that after the last unveil call and made sure I used a valid key path. Here is the console output: game over exploit, fopen failed: No such file or directory > Maybe for now we can add a simple implementation of the parser just to > parse the "save_dir" and the new "enable_unveil" (or similar) option, > like dpid is doing for dpi_dir. Ok thanks, I will try to use that as an example and see if I can get anywhere with it. > I think we could just not allow $HOME to be set as save_dir (or any > directory that contains $HOME, like /home) and refuse to start if this > is the case. Not sure I understand what this achieves. So '/home/user' would be blocked, but '/home/user/foo' would be allowed? Why not just explicitly block access to ~/.ssh with unveil, and then let the user do whatever they want after that? Regards, Alex

Aug. 4, 2024

Re: [PATCH v2] Unveil patch

by Rodrigo Arias

Hi, On Fri, Aug 02, 2024 at 01:04:32PM +0200, a1ex(a)dismail.de wrote: >> I think a simple approach to test this is to find out if we cannot >> read the ~/.ssh/id_rsa private keys from Dillo or plugins by any >> means. So far I think we could read them by forging a call to the >> file plugin and maybe by forking a new process that doesn't have the >> unveil() protections and then reading ~/.ssh/id_rsa from there. > >Right, but this attack vector seems pretty unlikely, and assumes the >system is already somehow compromised (by calling a malicious program >on the filesystem in an unveiled location). I think an RCE bug could allow an attacker to write an exploit in an HTML document (or image or any other thing parsed from the web) that would cause Dillo to execute the fork() syscall and then access those files and transfer the content to a remote host. See: https://en.wikipedia.org/wiki/Return-oriented_programming If this is the case, unless we prevent Dillo from being able to fork I don't think the unveil(2) protection is enough without pledge(2) to prevent this attack. We can test it by putting this code after the last unveil() call, as if Dillo was running an exploit: int ret = fork(); if (ret < 0) { perror("fork failed"); } else if (ret == 0) { /* Child */ FILE *f = fopen("/home/<theuser>/.ssh/id_rsa", "r"); // Adjust path if (f == NULL) { perror("game over exploit, fopen failed"); } else { int c; while ((c = fgetc(f)) != EOF) fputc(c, stdout); fclose(f); } exit(0); } If you see your SSH key in the stdout, the unveil() protection alone is not enough to mitigate this attack (check that the key exists first, I used id_rsa). This would also confirm that unveil() settings don't get inherited in forked children. >> >To-Do: >> >- Add prefs parsing to plugins to get 'save_dir' (may need help >> >here) >> >> I assume you could reuse the same prefs parser from Dillo, but we >> would need to link the DPIs with some of the code that is now only >> being linked in the browser. > >I have made some efforts to do that, but was not successful yet. I >included an example earlier of downloads.cc where I made some progress, >but still something missing. > >I still wonder if it makes more sense to just use a fixed location >(~/Downloads) if we are calling unveil, and override the save_dir with >that. This ties back to my response above. Maybe for now we can add a simple implementation of the parser just to parse the "save_dir" and the new "enable_unveil" (or similar) option, like dpid is doing for dpi_dir. Parsing the complete dillorc preferences requires splitting the preferences code into something that can be linked standalone in the dpis, which will require more effort. >> What happens if someone puts save_dir to $HOME?, should we restrict >> it maybe? > >To give access to ~/, and yet still protect ~/.ssh, we could do >something like this (simplified example): > >unveil("/home/user", "rwc"); >unveil("/home/user/.ssh", ""); > >But again, maybe it's better to override save_dir entirely if we are >using unveil. I think we could just not allow $HOME to be set as save_dir (or any directory that contains $HOME, like /home) and refuse to start if this is the case. Best, Rodrigo.

Aug. 4, 2024

Re: [PATCH v2] Unveil patch

by a1ex＠dismail.de

Hi Rodrigo, On Fri, 2 Aug 2024 01:23:56 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I'll be doing some tests with your patch when I have a moment. I'll > need to get an OpenBSD VM for testing probably. Sounds great! Let me know if you need any help getting OpenBSD set up. > In the meanwhile, I just wanted to link this compatibility unveil() > function for Linux, so I don't forget the link: > > https://github.com/rpki-client/rpki-client-portable/blob/master/compat/unve… Nice find. Not sure if this will be an issue: /* * This is by no means a proper implementation of unveil() but it is * good enough for rpki-client which uses only a few features. * rpki-client only uses 'r', 'rwc' and 'x' and for 'x' we need to do * some horrible hacks. */ > I think a simple approach to test this is to find out if we cannot > read the ~/.ssh/id_rsa private keys from Dillo or plugins by any > means. So far I think we could read them by forging a call to the > file plugin and maybe by forking a new process that doesn't have the > unveil() protections and then reading ~/.ssh/id_rsa from there. Right, but this attack vector seems pretty unlikely, and assumes the system is already somehow compromised (by calling a malicious program on the filesystem in an unveiled location). > I saw that the OpenBSD developers have placed an "uploads" directory > to place files to be available to be read from the browser, and only > that directory is allowed (along with the downloads dir). It doesn't > sound a bad idea to me. This way we can avoid leaving ~/ unprotected > in the file plugin. What do you think? I believe the approach OpenBSD takes with Firefox and Chromium is to only give the browser access to '~/Downloads', which can be used for both downloads and uploads. Basically, users on OpenBSD are already used to this restriction, most likely already have a ~/Downloads directory, and don't think they would be too troubled to have this restriction in Dillo, especially if it is well documented. > >To-Do: > >- Add prefs parsing to plugins to get 'save_dir' (may need help > >here) > > I assume you could reuse the same prefs parser from Dillo, but we > would need to link the DPIs with some of the code that is now only > being linked in the browser. I have made some efforts to do that, but was not successful yet. I included an example earlier of downloads.cc where I made some progress, but still something missing. I still wonder if it makes more sense to just use a fixed location (~/Downloads) if we are calling unveil, and override the save_dir with that. This ties back to my response above. > We can probably put the dUnveil() wrapper into dlib/ so it is > available in all the other parts. Thats a good point, I agree, and will work on it. > >+ dUnveil(prefs.save_dir, "rwc"); > > What happens if someone puts save_dir to $HOME?, should we restrict > it maybe? To give access to ~/, and yet still protect ~/.ssh, we could do something like this (simplified example): unveil("/home/user", "rwc"); unveil("/home/user/.ssh", ""); But again, maybe it's better to override save_dir entirely if we are using unveil. Regards, Alex

Aug. 2, 2024

Re: [PATCH v2] Unveil patch

by Diego

Hi. Sorry I can't help dillo more. I'm always very busy with my work. El vie, 2 ago 2024 a las 1:24, Rodrigo Arias (<rodarima(a)gmail.com>) escribió: > > >To-Do: > >- Add prefs parsing to plugins to get 'save_dir' (may need help here) > > I assume you could reuse the same prefs parser from Dillo, but we would > need to link the DPIs with some of the code that is now only being > linked in the browser. > > You could use dParser_parse_rc_line() from dlib/dlib.[hc] ../dlib/dlib.c:int dParser_parse_rc_line(char **line, char **name, char **value) ../dlib/dlib.h:int dParser_parse_rc_line(char **line, char **name, char **value); ./srch dParser_parse_rc_line keys.cc: st = dParser_parse_rc_line(&line, &keycomb, &command); prefsparser.cc: st = dParser_parse_rc_line(&line, &name, &value); ../dpid/dpid.c: st = dParser_parse_rc_line(&line, &service, &path); Salud! Diego

Aug. 2, 2024

Re: [PATCH v2] Unveil patch

by Rodrigo Arias

Hi, On Thu, Aug 01, 2024 at 05:12:09PM +0200, a1ex(a)dismail.de wrote: >Hi, > >Here is version 2 of my unveil patch. Many thanks to Rodrigo for his >kind assistance! Thank you Alex! I see this is progressing very well :-) I'll be doing some tests with your patch when I have a moment. I'll need to get an OpenBSD VM for testing probably. In the meanwhile, I just wanted to link this compatibility unveil() function for Linux, so I don't forget the link: https://github.com/rpki-client/rpki-client-portable/blob/master/compat/unve… I think a simple approach to test this is to find out if we cannot read the ~/.ssh/id_rsa private keys from Dillo or plugins by any means. So far I think we could read them by forging a call to the file plugin and maybe by forking a new process that doesn't have the unveil() protections and then reading ~/.ssh/id_rsa from there. I saw that the OpenBSD developers have placed an "uploads" directory to place files to be available to be read from the browser, and only that directory is allowed (along with the downloads dir). It doesn't sound a bad idea to me. This way we can avoid leaving ~/ unprotected in the file plugin. What do you think? >Improvements: >- Unveil is disabled by default. It can be enabled using: > configure --enable-unveil >- There is now a dUnveil() wrapper which simplifies the code and error > handling >- Locale check and custom cursor icons unveil fix > >To-Do: >- Add prefs parsing to plugins to get 'save_dir' (may need help here) I assume you could reuse the same prefs parser from Dillo, but we would need to link the DPIs with some of the code that is now only being linked in the browser. >- Add a dillorc pref to enable/disable unveil (same issue as above) >- Localize wget and $AUTHORITY >- A few other items from my previous to-do list > >Regards, >Alex > > > >diff -upr a/configure.ac b/configure.ac >--- a/configure.ac Sat Jul 27 12:54:47 2024 >+++ b/configure.ac Thu Aug 1 16:40:16 2024 >@@ -36,6 +36,11 @@ AC_ARG_ENABLE([insure], > [enable_insure=$enableval], > [enable_insure=no]) > >+AC_ARG_ENABLE([unveil], >+ [AS_HELP_STRING([--enable-unveil], [Build with support for unveil])], >+ [enable_unveil=$enableval], >+ [enable_unveil=no]) >+ > AC_ARG_ENABLE([ipv6], > [AS_HELP_STRING([--enable-ipv6], [Build with support for IPv6])], > [enable_ipv6=$enableval], >@@ -619,6 +624,9 @@ if test "x$enable_insure" = "xyes" ; then > CC="insure -Zoi \"compiler $CC\"" > LIBS="$LIBS -lstdc++-2-libc6.1-1-2.9.0" > fi >+if test "x$enable_unveil" = "xyes" ; then >+ AC_DEFINE([ENABLE_UNVEIL], [1], [Enable unveil]) >+fi > if test "x$enable_threaded_dns" = "xyes" ; then > CFLAGS="$CFLAGS -DD_DNS_THREADED" > fi >@@ -725,4 +733,5 @@ _AS_ECHO([ GIF enabled : ${enable_gif}]) > _AS_ECHO([ SVG enabled : ${enable_svg}]) > _AS_ECHO([]) > _AS_ECHO([ HTML tests : ${html_tests_ok}]) >+_AS_ECHO([ unveil enabled : ${enable_unveil}]) > _AS_ECHO([]) >diff -upr a/dpi/bookmarks.c b/dpi/bookmarks.c >--- a/dpi/bookmarks.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/bookmarks.c Thu Aug 1 16:40:50 2024 >@@ -1606,6 +1606,20 @@ static void termination_handler(int signum) > exit(signum); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} We can probably put the dUnveil() wrapper into dlib/ so it is available in all the other parts. > > /* > * -- MAIN ------------------------------------------------------------------- >@@ -1617,6 +1631,16 @@ int main(void) { > char *tok; > Dsh *sh; > >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ I think the #ifdef ENABLE_UNVEIL is enough here, as we may have other implementations handling it transparently for other platforms. Same for the other cases except inside dUnveil(). >+ char *dil_bm = dStrconcat(dGethomedir(), "/.dillo/bm.txt", NULL); >+ dUnveil(dil_bm, "rwc"); >+ dFree(dil_bm); >+ unveil(NULL, NULL); >+ #endif >+ #endif >+ > /* Arrange the cleanup function for terminations via exit() */ > atexit(cleanup); > >diff -upr a/dpi/cookies.c b/dpi/cookies.c >--- a/dpi/cookies.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/cookies.c Thu Aug 1 16:40:50 2024 >@@ -1632,6 +1632,20 @@ static void termination_handler(int signum) > exit(signum); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > > /* > * -- MAIN ------------------------------------------------------------------- >@@ -1643,6 +1657,16 @@ int main(void) { > int sock_fd, code; > char *buf; > Dsh *sh; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* Arrange the cleanup function for terminations via exit() */ > atexit(cleanup); >diff -upr a/dpi/datauri.c b/dpi/datauri.c >--- a/dpi/datauri.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/datauri.c Thu Aug 1 16:40:50 2024 >@@ -280,6 +280,21 @@ static unsigned char *datauri_get_data(char *url, size > return data; > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * > */ >@@ -289,6 +304,17 @@ int main(void) > unsigned char *data; > int rc; > size_t data_size = 0; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rwc"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* Initialize the SockHandler */ > sh = a_Dpip_dsh_new(STDIN_FILENO, STDOUT_FILENO, 8*1024); >diff -upr a/dpi/downloads.cc b/dpi/downloads.cc >--- a/dpi/downloads.cc Sat Jul 27 12:54:47 2024 >+++ b/dpi/downloads.cc Thu Aug 1 16:40:50 2024 >@@ -1098,12 +1098,45 @@ static void custLabelMeasure(const Fl_Label* o, int& W > fl_measure(o->value, W, H, interpret_symbols); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > >- > //int main(int argc, char **argv) > int main() > { > int ww = 420, wh = 85; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rwc"); >+ dUnveil("/etc/fonts", "r"); >+ dUnveil("/usr/local/bin/wget", "x"); >+ char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); >+ dUnveil(xauth_loc, "r"); >+ dFree(xauth_loc); >+ dUnveil("/usr/local/share/fonts", "r"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); >+ dUnveil(dl_loc, "rwc"); >+ dFree(dl_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > Fl::lock(); > >diff -upr a/dpi/file.c b/dpi/file.c >--- a/dpi/file.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/file.c Thu Aug 1 16:40:50 2024 >@@ -1063,6 +1063,20 @@ static int File_check_fds(uint_t seconds) > return st; > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > > int main(void) > { >@@ -1070,6 +1084,19 @@ int main(void) > socklen_t sin_sz; > int sock_fd, c_st, st = 1; > >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rw"); >+ char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); >+ dUnveil(dl_loc, "rw"); >+ dFree(dl_loc); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ unveil(NULL, NULL); >+ #endif >+ #endif >+ > /* Arrange the cleanup function for abnormal terminations */ > if (signal (SIGINT, termination_handler) == SIG_IGN) > signal (SIGINT, SIG_IGN); >diff -upr a/dpi/ftp.c b/dpi/ftp.c >--- a/dpi/ftp.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/ftp.c Thu Aug 1 16:40:50 2024 >@@ -272,6 +272,21 @@ static int try_ftp_transfer(char *url) > return (no_such_file ? -1 : (aborted ? -2 : nb)); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * > */ >@@ -281,6 +296,21 @@ int main(int argc, char **argv) > char *dpip_tag = NULL, *cmd = NULL, *url = NULL, *url2 = NULL; > int st, rc; > char *p, *d_cmd; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rwc"); >+ dUnveil("/usr/local/bin/wget", "x"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ char *dl_loc = dStrconcat(dGethomedir(), "/download", NULL); >+ dUnveil(dl_loc, "rwc"); >+ dFree(dl_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* wget may need to write a temporary file... */ > rc = chdir("/tmp"); >diff -upr a/dpi/vsource.c b/dpi/vsource.c >--- a/dpi/vsource.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/vsource.c Thu Aug 1 16:40:50 2024 >@@ -178,6 +178,21 @@ void send_html_text(Dsh *sh, const char *url, int data > a_Dpip_dsh_write_str(sh, 1, "</table></body></html>"); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * > */ >@@ -187,6 +202,16 @@ int main(void) > int data_size; > char *dpip_tag, *cmd = NULL, *cmd2 = NULL, *url = NULL, *size_str = NULL; > char *d_cmd; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "r"); >+ dFree(dil_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > _MSG("starting...\n"); > //sleep(20); >diff -upr a/dpid/main.c b/dpid/main.c >--- a/dpid/main.c Sat Jul 27 12:54:47 2024 >+++ b/dpid/main.c Thu Aug 1 16:41:04 2024 >@@ -220,6 +220,21 @@ static int get_open_max(void) > #endif > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /*! \todo > * \li Add a dpid_idle_timeout variable to dpidrc > * \bug Infinite loop if plugin crashes before it accepts a connection >@@ -236,6 +251,17 @@ int main(void) > services_list = NULL; > //daemon(0,0); /* Use 0,1 for feedback */ > /* TODO: call setsid() ?? */ >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/usr/local/lib/dillo", "rx"); >+ dUnveil("/usr/local/etc/dillo", "r"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* Allow read and write access, but only for the user. > * TODO: can this cause trouble with umount? */ >diff -upr a/src/dillo.cc b/src/dillo.cc >--- a/src/dillo.cc Sat Jul 27 12:54:47 2024 >+++ b/src/dillo.cc Thu Aug 1 16:40:06 2024 >@@ -379,6 +379,21 @@ static DilloUrl *makeStartUrl(char *str, bool local) > return start_url; > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * MAIN > */ >@@ -462,7 +477,34 @@ int main(int argc, char **argv) > fclose(fp); > } > dLib_show_messages(prefs.show_msg); >- >+ >+ // Use unveil on OpenBSD >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/usr/local/share/fonts", "r"); >+ dUnveil("/usr/local/share/icons", "r"); >+ dUnveil("/usr/X11R6/share/X11/locale", "r"); >+ dUnveil("/usr/X11R6/lib/X11/fonts", "r"); >+ dUnveil("/usr/local/etc/dillo", "r"); >+ dUnveil("/tmp", "rwc"); >+ dUnveil("/usr/local/bin/dpid", "x"); >+ dUnveil("/etc/fonts", "r"); >+ dUnveil("/etc/resolv.conf", "r"); >+ dUnveil("/etc/ssl/cert.pem", "r"); >+ dUnveil(prefs.save_dir, "rwc"); What happens if someone puts save_dir to $HOME?, should we restrict it maybe? >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ char *icons_loc = dStrconcat(dGethomedir(), "/.icons", NULL); >+ dUnveil(icons_loc, "r"); >+ dFree(icons_loc); >+ char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); >+ dUnveil(xauth_loc, "r"); >+ dFree(xauth_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif >+ > // initialize internal modules > a_Dpi_init(); > a_Dns_init(); >diff -upr a/configure.ac b/configure.ac >--- a/configure.ac Sat Jul 27 12:54:47 2024 >+++ b/configure.ac Thu Aug 1 16:40:16 2024 >@@ -36,6 +36,11 @@ AC_ARG_ENABLE([insure], > [enable_insure=$enableval], > [enable_insure=no]) > >+AC_ARG_ENABLE([unveil], >+ [AS_HELP_STRING([--enable-unveil], [Build with support for unveil])], >+ [enable_unveil=$enableval], >+ [enable_unveil=no]) >+ > AC_ARG_ENABLE([ipv6], > [AS_HELP_STRING([--enable-ipv6], [Build with support for IPv6])], > [enable_ipv6=$enableval], >@@ -619,6 +624,9 @@ if test "x$enable_insure" = "xyes" ; then > CC="insure -Zoi \"compiler $CC\"" > LIBS="$LIBS -lstdc++-2-libc6.1-1-2.9.0" > fi >+if test "x$enable_unveil" = "xyes" ; then >+ AC_DEFINE([ENABLE_UNVEIL], [1], [Enable unveil]) >+fi > if test "x$enable_threaded_dns" = "xyes" ; then > CFLAGS="$CFLAGS -DD_DNS_THREADED" > fi >@@ -725,4 +733,5 @@ _AS_ECHO([ GIF enabled : ${enable_gif}]) > _AS_ECHO([ SVG enabled : ${enable_svg}]) > _AS_ECHO([]) > _AS_ECHO([ HTML tests : ${html_tests_ok}]) >+_AS_ECHO([ unveil enabled : ${enable_unveil}]) > _AS_ECHO([]) >diff -upr a/dpi/bookmarks.c b/dpi/bookmarks.c >--- a/dpi/bookmarks.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/bookmarks.c Thu Aug 1 16:40:50 2024 >@@ -1606,6 +1606,20 @@ static void termination_handler(int signum) > exit(signum); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > > /* > * -- MAIN ------------------------------------------------------------------- >@@ -1617,6 +1631,16 @@ int main(void) { > char *tok; > Dsh *sh; > >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ char *dil_bm = dStrconcat(dGethomedir(), "/.dillo/bm.txt", NULL); >+ dUnveil(dil_bm, "rwc"); >+ dFree(dil_bm); >+ unveil(NULL, NULL); >+ #endif >+ #endif >+ > /* Arrange the cleanup function for terminations via exit() */ > atexit(cleanup); > >diff -upr a/dpi/cookies.c b/dpi/cookies.c >--- a/dpi/cookies.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/cookies.c Thu Aug 1 16:40:50 2024 >@@ -1632,6 +1632,20 @@ static void termination_handler(int signum) > exit(signum); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > > /* > * -- MAIN ------------------------------------------------------------------- >@@ -1643,6 +1657,16 @@ int main(void) { > int sock_fd, code; > char *buf; > Dsh *sh; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* Arrange the cleanup function for terminations via exit() */ > atexit(cleanup); >diff -upr a/dpi/datauri.c b/dpi/datauri.c >--- a/dpi/datauri.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/datauri.c Thu Aug 1 16:40:50 2024 >@@ -280,6 +280,21 @@ static unsigned char *datauri_get_data(char *url, size > return data; > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * > */ >@@ -289,6 +304,17 @@ int main(void) > unsigned char *data; > int rc; > size_t data_size = 0; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rwc"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* Initialize the SockHandler */ > sh = a_Dpip_dsh_new(STDIN_FILENO, STDOUT_FILENO, 8*1024); >diff -upr a/dpi/downloads.cc b/dpi/downloads.cc >--- a/dpi/downloads.cc Sat Jul 27 12:54:47 2024 >+++ b/dpi/downloads.cc Thu Aug 1 16:40:50 2024 >@@ -1098,12 +1098,45 @@ static void custLabelMeasure(const Fl_Label* o, int& W > fl_measure(o->value, W, H, interpret_symbols); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > >- > //int main(int argc, char **argv) > int main() > { > int ww = 420, wh = 85; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rwc"); >+ dUnveil("/etc/fonts", "r"); >+ dUnveil("/usr/local/bin/wget", "x"); >+ char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); >+ dUnveil(xauth_loc, "r"); >+ dFree(xauth_loc); >+ dUnveil("/usr/local/share/fonts", "r"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); >+ dUnveil(dl_loc, "rwc"); >+ dFree(dl_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > Fl::lock(); > >diff -upr a/dpi/file.c b/dpi/file.c >--- a/dpi/file.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/file.c Thu Aug 1 16:40:50 2024 >@@ -1063,6 +1063,20 @@ static int File_check_fds(uint_t seconds) > return st; > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} > > int main(void) > { >@@ -1070,6 +1084,19 @@ int main(void) > socklen_t sin_sz; > int sock_fd, c_st, st = 1; > >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rw"); >+ char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); >+ dUnveil(dl_loc, "rw"); >+ dFree(dl_loc); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ unveil(NULL, NULL); >+ #endif >+ #endif >+ > /* Arrange the cleanup function for abnormal terminations */ > if (signal (SIGINT, termination_handler) == SIG_IGN) > signal (SIGINT, SIG_IGN); >diff -upr a/dpi/ftp.c b/dpi/ftp.c >--- a/dpi/ftp.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/ftp.c Thu Aug 1 16:40:50 2024 >@@ -272,6 +272,21 @@ static int try_ftp_transfer(char *url) > return (no_such_file ? -1 : (aborted ? -2 : nb)); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * > */ >@@ -281,6 +296,21 @@ int main(int argc, char **argv) > char *dpip_tag = NULL, *cmd = NULL, *url = NULL, *url2 = NULL; > int st, rc; > char *p, *d_cmd; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/tmp", "rwc"); >+ dUnveil("/usr/local/bin/wget", "x"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ char *dl_loc = dStrconcat(dGethomedir(), "/download", NULL); >+ dUnveil(dl_loc, "rwc"); >+ dFree(dl_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* wget may need to write a temporary file... */ > rc = chdir("/tmp"); >diff -upr a/dpi/vsource.c b/dpi/vsource.c >--- a/dpi/vsource.c Sat Jul 27 12:54:47 2024 >+++ b/dpi/vsource.c Thu Aug 1 16:40:50 2024 >@@ -178,6 +178,21 @@ void send_html_text(Dsh *sh, const char *url, int data > a_Dpip_dsh_write_str(sh, 1, "</table></body></html>"); > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * > */ >@@ -187,6 +202,16 @@ int main(void) > int data_size; > char *dpip_tag, *cmd = NULL, *cmd2 = NULL, *url = NULL, *size_str = NULL; > char *d_cmd; >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "r"); >+ dFree(dil_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > _MSG("starting...\n"); > //sleep(20); >diff -upr a/dpid/main.c b/dpid/main.c >--- a/dpid/main.c Sat Jul 27 12:54:47 2024 >+++ b/dpid/main.c Thu Aug 1 16:41:04 2024 >@@ -220,6 +220,21 @@ static int get_open_max(void) > #endif > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /*! \todo > * \li Add a dpid_idle_timeout variable to dpidrc > * \bug Infinite loop if plugin crashes before it accepts a connection >@@ -236,6 +251,17 @@ int main(void) > services_list = NULL; > //daemon(0,0); /* Use 0,1 for feedback */ > /* TODO: call setsid() ?? */ >+ >+ /* Use unveil on OpenBSD */ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/usr/local/lib/dillo", "rx"); >+ dUnveil("/usr/local/etc/dillo", "r"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ unveil(NULL, NULL); >+ #endif >+ #endif > > /* Allow read and write access, but only for the user. > * TODO: can this cause trouble with umount? */ >diff -upr a/src/dillo.cc b/src/dillo.cc >--- a/src/dillo.cc Sat Jul 27 12:54:47 2024 >+++ b/src/dillo.cc Thu Aug 1 16:40:06 2024 >@@ -379,6 +379,21 @@ static DilloUrl *makeStartUrl(char *str, bool local) > return start_url; > } > >+/** >+ * Use unveil on OpenBSD >+ */ >+static void dUnveil(const char *path, const char *perm) >+{ >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ if (unveil(path, perm) == -1) { >+ MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); >+ exit(1); >+ } >+ #endif >+ #endif >+} >+ > /* > * MAIN > */ >@@ -462,7 +477,34 @@ int main(int argc, char **argv) > fclose(fp); > } > dLib_show_messages(prefs.show_msg); >- >+ >+ // Use unveil on OpenBSD >+ #ifdef ENABLE_UNVEIL >+ #ifdef __OpenBSD__ >+ dUnveil("/usr/local/share/fonts", "r"); >+ dUnveil("/usr/local/share/icons", "r"); >+ dUnveil("/usr/X11R6/share/X11/locale", "r"); >+ dUnveil("/usr/X11R6/lib/X11/fonts", "r"); >+ dUnveil("/usr/local/etc/dillo", "r"); >+ dUnveil("/tmp", "rwc"); >+ dUnveil("/usr/local/bin/dpid", "x"); >+ dUnveil("/etc/fonts", "r"); >+ dUnveil("/etc/resolv.conf", "r"); >+ dUnveil("/etc/ssl/cert.pem", "r"); >+ dUnveil(prefs.save_dir, "rwc"); >+ char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); >+ dUnveil(dil_loc, "rwc"); >+ dFree(dil_loc); >+ char *icons_loc = dStrconcat(dGethomedir(), "/.icons", NULL); >+ dUnveil(icons_loc, "r"); >+ dFree(icons_loc); >+ char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); >+ dUnveil(xauth_loc, "r"); >+ dFree(xauth_loc); >+ unveil(NULL, NULL); >+ #endif >+ #endif >+ > // initialize internal modules > a_Dpi_init(); > a_Dns_init(); >_______________________________________________ >Dillo-dev mailing list -- dillo-dev(a)mailman3.com >To unsubscribe send an email to dillo-dev-leave(a)mailman3.com

Aug. 1, 2024

[PATCH v2] Unveil patch

by a1ex＠dismail.de

Hi, Here is version 2 of my unveil patch. Many thanks to Rodrigo for his kind assistance! Improvements: - Unveil is disabled by default. It can be enabled using: configure --enable-unveil - There is now a dUnveil() wrapper which simplifies the code and error handling - Locale check and custom cursor icons unveil fix To-Do: - Add prefs parsing to plugins to get 'save_dir' (may need help here) - Add a dillorc pref to enable/disable unveil (same issue as above) - Localize wget and $AUTHORITY - A few other items from my previous to-do list Regards, Alex diff -upr a/configure.ac b/configure.ac --- a/configure.ac Sat Jul 27 12:54:47 2024 +++ b/configure.ac Thu Aug 1 16:40:16 2024 @@ -36,6 +36,11 @@ AC_ARG_ENABLE([insure], [enable_insure=$enableval], [enable_insure=no]) +AC_ARG_ENABLE([unveil], + [AS_HELP_STRING([--enable-unveil], [Build with support for unveil])], + [enable_unveil=$enableval], + [enable_unveil=no]) + AC_ARG_ENABLE([ipv6], [AS_HELP_STRING([--enable-ipv6], [Build with support for IPv6])], [enable_ipv6=$enableval], @@ -619,6 +624,9 @@ if test "x$enable_insure" = "xyes" ; then CC="insure -Zoi \"compiler $CC\"" LIBS="$LIBS -lstdc++-2-libc6.1-1-2.9.0" fi +if test "x$enable_unveil" = "xyes" ; then + AC_DEFINE([ENABLE_UNVEIL], [1], [Enable unveil]) +fi if test "x$enable_threaded_dns" = "xyes" ; then CFLAGS="$CFLAGS -DD_DNS_THREADED" fi @@ -725,4 +733,5 @@ _AS_ECHO([ GIF enabled : ${enable_gif}]) _AS_ECHO([ SVG enabled : ${enable_svg}]) _AS_ECHO([]) _AS_ECHO([ HTML tests : ${html_tests_ok}]) +_AS_ECHO([ unveil enabled : ${enable_unveil}]) _AS_ECHO([]) diff -upr a/dpi/bookmarks.c b/dpi/bookmarks.c --- a/dpi/bookmarks.c Sat Jul 27 12:54:47 2024 +++ b/dpi/bookmarks.c Thu Aug 1 16:40:50 2024 @@ -1606,6 +1606,20 @@ static void termination_handler(int signum) exit(signum); } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} /* * -- MAIN ------------------------------------------------------------------- @@ -1617,6 +1631,16 @@ int main(void) { char *tok; Dsh *sh; + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + char *dil_bm = dStrconcat(dGethomedir(), "/.dillo/bm.txt", NULL); + dUnveil(dil_bm, "rwc"); + dFree(dil_bm); + unveil(NULL, NULL); + #endif + #endif + /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/cookies.c b/dpi/cookies.c --- a/dpi/cookies.c Sat Jul 27 12:54:47 2024 +++ b/dpi/cookies.c Thu Aug 1 16:40:50 2024 @@ -1632,6 +1632,20 @@ static void termination_handler(int signum) exit(signum); } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} /* * -- MAIN ------------------------------------------------------------------- @@ -1643,6 +1657,16 @@ int main(void) { int sock_fd, code; char *buf; Dsh *sh; + + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + unveil(NULL, NULL); + #endif + #endif /* Arrange the cleanup function for terminations via exit() */ atexit(cleanup); diff -upr a/dpi/datauri.c b/dpi/datauri.c --- a/dpi/datauri.c Sat Jul 27 12:54:47 2024 +++ b/dpi/datauri.c Thu Aug 1 16:40:50 2024 @@ -280,6 +280,21 @@ static unsigned char *datauri_get_data(char *url, size return data; } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + /* * */ @@ -289,6 +304,17 @@ int main(void) unsigned char *data; int rc; size_t data_size = 0; + + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + dUnveil("/tmp", "rwc"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + unveil(NULL, NULL); + #endif + #endif /* Initialize the SockHandler */ sh = a_Dpip_dsh_new(STDIN_FILENO, STDOUT_FILENO, 8*1024); diff -upr a/dpi/downloads.cc b/dpi/downloads.cc --- a/dpi/downloads.cc Sat Jul 27 12:54:47 2024 +++ b/dpi/downloads.cc Thu Aug 1 16:40:50 2024 @@ -1098,12 +1098,45 @@ static void custLabelMeasure(const Fl_Label* o, int& W fl_measure(o->value, W, H, interpret_symbols); } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} - //int main(int argc, char **argv) int main() { int ww = 420, wh = 85; + + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + dUnveil("/tmp", "rwc"); + dUnveil("/etc/fonts", "r"); + dUnveil("/usr/local/bin/wget", "x"); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + dUnveil(xauth_loc, "r"); + dFree(xauth_loc); + dUnveil("/usr/local/share/fonts", "r"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + dUnveil(dl_loc, "rwc"); + dFree(dl_loc); + unveil(NULL, NULL); + #endif + #endif Fl::lock(); diff -upr a/dpi/file.c b/dpi/file.c --- a/dpi/file.c Sat Jul 27 12:54:47 2024 +++ b/dpi/file.c Thu Aug 1 16:40:50 2024 @@ -1063,6 +1063,20 @@ static int File_check_fds(uint_t seconds) return st; } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} int main(void) { @@ -1070,6 +1084,19 @@ int main(void) socklen_t sin_sz; int sock_fd, c_st, st = 1; + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + dUnveil("/tmp", "rw"); + char *dl_loc = dStrconcat(dGethomedir(), "/Downloads", NULL); + dUnveil(dl_loc, "rw"); + dFree(dl_loc); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + unveil(NULL, NULL); + #endif + #endif + /* Arrange the cleanup function for abnormal terminations */ if (signal (SIGINT, termination_handler) == SIG_IGN) signal (SIGINT, SIG_IGN); diff -upr a/dpi/ftp.c b/dpi/ftp.c --- a/dpi/ftp.c Sat Jul 27 12:54:47 2024 +++ b/dpi/ftp.c Thu Aug 1 16:40:50 2024 @@ -272,6 +272,21 @@ static int try_ftp_transfer(char *url) return (no_such_file ? -1 : (aborted ? -2 : nb)); } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + /* * */ @@ -281,6 +296,21 @@ int main(int argc, char **argv) char *dpip_tag = NULL, *cmd = NULL, *url = NULL, *url2 = NULL; int st, rc; char *p, *d_cmd; + + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + dUnveil("/tmp", "rwc"); + dUnveil("/usr/local/bin/wget", "x"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + char *dl_loc = dStrconcat(dGethomedir(), "/download", NULL); + dUnveil(dl_loc, "rwc"); + dFree(dl_loc); + unveil(NULL, NULL); + #endif + #endif /* wget may need to write a temporary file... */ rc = chdir("/tmp"); diff -upr a/dpi/vsource.c b/dpi/vsource.c --- a/dpi/vsource.c Sat Jul 27 12:54:47 2024 +++ b/dpi/vsource.c Thu Aug 1 16:40:50 2024 @@ -178,6 +178,21 @@ void send_html_text(Dsh *sh, const char *url, int data a_Dpip_dsh_write_str(sh, 1, "</table></body></html>"); } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + /* * */ @@ -187,6 +202,16 @@ int main(void) int data_size; char *dpip_tag, *cmd = NULL, *cmd2 = NULL, *url = NULL, *size_str = NULL; char *d_cmd; + + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "r"); + dFree(dil_loc); + unveil(NULL, NULL); + #endif + #endif _MSG("starting...\n"); //sleep(20); diff -upr a/dpid/main.c b/dpid/main.c --- a/dpid/main.c Sat Jul 27 12:54:47 2024 +++ b/dpid/main.c Thu Aug 1 16:41:04 2024 @@ -220,6 +220,21 @@ static int get_open_max(void) #endif } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + /*! \todo * \li Add a dpid_idle_timeout variable to dpidrc * \bug Infinite loop if plugin crashes before it accepts a connection @@ -236,6 +251,17 @@ int main(void) services_list = NULL; //daemon(0,0); /* Use 0,1 for feedback */ /* TODO: call setsid() ?? */ + + /* Use unveil on OpenBSD */ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + dUnveil("/usr/local/lib/dillo", "rx"); + dUnveil("/usr/local/etc/dillo", "r"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + unveil(NULL, NULL); + #endif + #endif /* Allow read and write access, but only for the user. * TODO: can this cause trouble with umount? */ diff -upr a/src/dillo.cc b/src/dillo.cc --- a/src/dillo.cc Sat Jul 27 12:54:47 2024 +++ b/src/dillo.cc Thu Aug 1 16:40:06 2024 @@ -379,6 +379,21 @@ static DilloUrl *makeStartUrl(char *str, bool local) return start_url; } +/** + * Use unveil on OpenBSD + */ +static void dUnveil(const char *path, const char *perm) +{ + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + if (unveil(path, perm) == -1) { + MSG("unveil(%s, %s) failed: %s\n", path, perm, strerror(errno)); + exit(1); + } + #endif + #endif +} + /* * MAIN */ @@ -462,7 +477,34 @@ int main(int argc, char **argv) fclose(fp); } dLib_show_messages(prefs.show_msg); - + + // Use unveil on OpenBSD + #ifdef ENABLE_UNVEIL + #ifdef __OpenBSD__ + dUnveil("/usr/local/share/fonts", "r"); + dUnveil("/usr/local/share/icons", "r"); + dUnveil("/usr/X11R6/share/X11/locale", "r"); + dUnveil("/usr/X11R6/lib/X11/fonts", "r"); + dUnveil("/usr/local/etc/dillo", "r"); + dUnveil("/tmp", "rwc"); + dUnveil("/usr/local/bin/dpid", "x"); + dUnveil("/etc/fonts", "r"); + dUnveil("/etc/resolv.conf", "r"); + dUnveil("/etc/ssl/cert.pem", "r"); + dUnveil(prefs.save_dir, "rwc"); + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + dUnveil(dil_loc, "rwc"); + dFree(dil_loc); + char *icons_loc = dStrconcat(dGethomedir(), "/.icons", NULL); + dUnveil(icons_loc, "r"); + dFree(icons_loc); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + dUnveil(xauth_loc, "r"); + dFree(xauth_loc); + unveil(NULL, NULL); + #endif + #endif + // initialize internal modules a_Dpi_init(); a_Dns_init();

Aug. 1, 2024

Re: dpid doesn't work if configured with "--program-suffix=-new"

by Kevin Koster

Detlef Vollmann wrote: > for the time being I'd like to install the current dillo version, > next to the old existing one. > So I configured with "--program-suffix=-new". > Browsing works fine, but plugins (including bm or file) can't be > started, as the binary is called "dpid-new" but dillo tries to > start "dpid". > > It probaly wouldn't work anyway as $HOME/.dillo is hardcoded > and there's no way to give a separate configuration directory > (and sharing .dillo between different version is probably not > a good idea). What about starting Dillo with: HOME=~/dillo-new dillo Then there's a script in the source code root directory called install-dpi-local. Running (from the Dillo source code dir): mkdir ~/dillo-new HOME=~/dillo-new ./install-dpi-local should install dpid and plug-ins to the ~/dillo-new/.dillo/dpi directory where dillo will find them when started in its own home. Alternatively you could manually make symlinks (if supported by your file system) in ~/dillo-new/.dillo/dpi to the "-new" binaries at their installed locations.

July 31, 2024

dpid doesn't work if configured with "--program-suffix=-new"

by Detlef Vollmann

Hello, for the time being I'd like to install the current dillo version, next to the old existing one. So I configured with "--program-suffix=-new". Browsing works fine, but plugins (including bm or file) can't be started, as the binary is called "dpid-new" but dillo tries to start "dpid". It probaly wouldn't work anyway as $HOME/.dillo is hardcoded and there's no way to give a separate configuration directory (and sharing .dillo between different version is probably not a good idea). But it would be cleaner not to support "--program-suffix". Detlef

July 31, 2024

Unveil discussion: TO-DO list

by a1ex＠dismail.de

Hi Rodrigo, Here are my initial thoughts on your review. Some of the stuff I will need help with, the rest I can probably manage on my own: On Sun, 28 Jul 2024 22:45:38 +0200 Rodrigo Arias <rodarima(a)gmail.com> wrote: > I recommend you add a configure switch (in configure.ac) to enable or > disable unveil(). By default you can keep it disabled and let the > user enable it manually, until we have more feedback to make it > enabled by default. Maybe by defining ENABLE_UNVEIL? You can take the > --enable-svg and ENABLE_SVG as an example. Ok, I think I can handle that. > You should also make a dillorc configure option to enable/disable the > unveil feature in runtime, so it can help debug problems. You can > make the dillorc option enabled by default, which will only take > action when unveil support has been compiled in. For dillo.cc that shouldn't be too hard. I would probably have more difficulties with with the plugins though. > The download directory is set in the dillorc configuration file, and > can be any other place. Is it viable to read the configuration first > and then unveil the appropriate directory? Got that partially working, but ran in to some challenges, see my earlier message. > You'll want to use the $(sysconfdir) autoconf variable: I can take a look, I didn't really consider portability at all since unveil is exclusive to OpenBSD, and will probably remain that way for some time. > As this won't be a simple patch, I suggest you open a PR in GitHub, > so the CI can compile your patch revisions for multiple platforms and > pass the tests. Otherwise I would have to spend the time to do it > myself. If this patch gets to a point where your concerns here are addressed, I will consider it. > The err() function is non-portable, please use Dillo MSG* macros or > perror() + exit(). This should be caught by the CI. > > Also, ensure the indentation is kept at 3 characters (not my > decision). Ok, that shouldn't be a problem. > You should find wget by locating it in the $PATH, not assuming it > would be here. Users may place their own wget binary somewhere else > and this would break the downloads. Will look at it. This brings up a completely separate question: why is wget hardcoded and not changeable as the downloader, and also has a hardcoded useragent which can't be changed by the user. To me, that's not ideal, and maybe you have some thoughts on it. > The .Xauthority file should be read from $AUTHORITY and then from > there if not set. I will try :) > Not sure if we want to constraint file:// like this. What if we are > using Dillo to read local HTML files in ~/? Would you prefer to just not do any unveil in file.c then? It's probably not a huge risk. > Plugins can also be found on the dpi_dir directory defined by the > user in the .dillo/dpidrc, so we would need to parse it first. I will look at it, but this could be more difficult for me. > I would also protect dpidrc from writing as well as dillorc. Agreed. No problem. Regards, Alex

July 30, 2024

Unveil discussion: save_dir

by a1ex＠dismail.de

Hi, I have managed to get dillo.cc to use the 'save_dir' preference to set which download path is unveiled. This was done by moving the unveil call to a point after which prefs are initialized and dillorc is parsed. Here is what the patch looks like: --- dillo.cc Sat Jun 29 16:33:08 2024 +++ dillo.cc Tue Jul 30 14:18:28 2024 @@ -23,6 +23,7 @@ #include <stdio.h> #include <unistd.h> +#include <err.h> #include <stdlib.h> #include <time.h> #include <sys/types.h> @@ -463,6 +464,58 @@ int main(int argc, char **argv) } dLib_show_messages(prefs.show_msg); + // Use unveil on OpenBSD + #ifdef __OpenBSD__ + if (unveil("/usr/local/share/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/share/icons", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/X11R6/share/X11/locale", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/X11R6/lib/X11/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/etc/dillo", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/bin/dpid", "x") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/resolv.conf", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/ssl/cert.pem", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil(prefs.save_dir, "rwc") == -1) { + err(1, "unveil failed"); + } + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + char *icons_loc = dStrconcat(dGethomedir(), "/.icons", NULL); + if (unveil(icons_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(icons_loc); + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + if (unveil(xauth_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(xauth_loc); + #endif + // initialize internal modules a_Dpi_init(); a_Dns_init(); I have tried to do the same for downloads.cc, but haven't quite got it yet. Since prefs are not initialized in downloads.cc, I tried to copy that from dillo.cc, but am getting some linker errors when compliling. I probably missed something obvious. Any ideas? ld: error: undefined symbol: a_Prefs_init >>> referenced by downloads.cc >>> downloads_dpi-downloads.o:(main) mv -f .deps/vsource.Tpo .deps/vsource.Po ld: error: undefined symbol: Paths::init() >>> referenced by downloads.cc >>> downloads_dpi-downloads.o:(main) ld: error: undefined symbol: Paths::getPrefsFP(char const*) >>> referenced by downloads.cc >>> downloads_dpi-downloads.o:(main) ld: error: undefined symbol: PrefsParser::parse(__sFILE*) >>> referenced by downloads.cc >>> downloads_dpi-downloads.o:(main) ld: error: undefined symbol: prefs >>> referenced by downloads.cc >>> downloads_dpi-downloads.o:(main) c++: error: linker command failed with exit code 1 (use -v to see invocation) Here is what I tried: --- downloads.cc Sat Jun 29 16:33:08 2024 +++ downloads.cc Tue Jul 30 15:07:04 2024 @@ -18,6 +18,7 @@ #include <stdlib.h> #include <string.h> #include <unistd.h> +#include <err.h> #include <errno.h> #include <fcntl.h> #include <ctype.h> @@ -42,6 +43,9 @@ #include <FL/Fl_Box.H> #include <FL/Fl_Button.H> +#include "../src/paths.hh" +#include "../src/prefs.h" +#include "../src/prefsparser.hh" #include "config.h" #include "dpiutil.h" #include "../dpip/dpip.h" @@ -1104,6 +1108,48 @@ static void custLabelMeasure(const Fl_Label* o, int& W int main() { int ww = 420, wh = 85; + FILE *fp; + + // set the default values for the preferences + a_Prefs_init(); + + // create ~/.dillo if not present + Paths::init(); + + // parse dillorc + if ((fp = Paths::getPrefsFP(PATHS_RC_PREFS))) { + PrefsParser::parse(fp); + } + + /* Use unveil on OpenBSD */ + #ifdef __OpenBSD__ + if (unveil("/tmp", "rwc") == -1) { + err(1, "unveil failed"); + } + if (unveil("/etc/fonts", "r") == -1) { + err(1, "unveil failed"); + } + if (unveil("/usr/local/bin/wget", "x") == -1) { + err(1, "unveil failed"); + } + char *xauth_loc = dStrconcat(dGethomedir(), "/.Xauthority", NULL); + if (unveil(xauth_loc, "r") == -1) { + err(1, "unveil failed"); + } + dFree(xauth_loc); + if (unveil("/usr/local/share/fonts", "r") == -1) { + err(1, "unveil failed"); + } + char *dil_loc = dStrconcat(dGethomedir(), "/.dillo", NULL); + if (unveil(dil_loc, "rwc") == -1) { + err(1, "unveil failed"); + } + dFree(dil_loc); + if (unveil(prefs.save_dir, "rwc") == -1) { + err(1, "unveil failed"); + } + unveil(NULL, NULL); + #endif Fl::lock(); Finally, I tried to also get ftp.c to use the 'save_dir' preference, but had less luck. I think the issue comes from the fact that this is a C program, and the others are C++. I'm wondering, is this whole unveil idea realistic at this point? Maybe I'm just too inexperienced to be doing this work. I am quite willing to keep going, but it will probably involve many more messages to the list with problems similar to the ones above. I don't want to overwhelm the list and devs with my beginner programming mistakes, it feels like I'm placing an unfair burden on you. Regards, Alex

July 30, 2024