- Dillo-dev - lists.mailman3.com

Github et alia login/cookies issue

by miroslav.rovis1＠zg.ht.hr

Forgot to post the Gentoo Forums' my new post's address. Correcting that below. On Tue, Jul 07, 2015 at 05:25:32PM +0200, miroslav.rovis1 at zg.ht.hr wrote: > On Tue, Jul 07, 2015 at 04:57:57PM +0200, miroslav.rovis1 at zg.ht.hr wrote: > > On Tue, Jul 07, 2015 at 01:53:22PM +0000, eocene wrote: > > > miroslav.rovis1 wrote: > > https://forums.grsecurity.net > > Deply RBAC on Dillo browser > https://forums.grsecurity.net/viewtopic.php?f=5&t=4228 > And I've posted on Gentoo Forums, with a note about the paxctl-ng being deployed yesterday, id est before the reports in this thread. INCLUDED: Deploy paxctl-ng XATTR markings on Dillo browser https://forums.gentoo.org/viewtopic-t-1021518.html INCLUDED NOW. A sad note: The cookies.txt is not anymore being written to, and I haven't made any changes in my Dillo configuration: $ ls -l ~/.dillo/cookies.txt -rw------- 1 miro miro 24868 2015-07-07 11:34 /home/miro/.dillo/cookies.txt $ ( It is now: 2014-10-12 16:36 ) and I have, obviously logged in to post on Gentoo Forums. -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

Github et alia login/cookies issue

by miroslav.rovis1＠zg.ht.hr

On Tue, Jul 07, 2015 at 05:25:32PM +0200, miroslav.rovis1 at zg.ht.hr wrote: > On Tue, Jul 07, 2015 at 04:57:57PM +0200, miroslav.rovis1 at zg.ht.hr wrote: > > On Tue, Jul 07, 2015 at 01:53:22PM +0000, eocene wrote: > > > miroslav.rovis1 wrote: > > https://forums.grsecurity.net > > Deply RBAC on Dillo browser > https://forums.grsecurity.net/viewtopic.php?f=5&t=4228 > And I've posted on Gentoo Forums, with a note about the paxctl-ng being deployed yesterday, id est before the reports in this thread. A sad note: The cookies.txt is not anymore being written to, and I haven't made any changes in my Dillo configuration: $ ls -l ~/.dillo/cookies.txt -rw------- 1 miro miro 24868 2015-07-07 11:34 /home/miro/.dillo/cookies.txt $ ( It is now: 2014-10-12 16:36 ) and I have, obviously logged in to post on Gentoo Forums. -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

Github et alia login/cookies issue

by miroslav.rovis1＠zg.ht.hr

On Tue, Jul 07, 2015 at 04:57:57PM +0200, miroslav.rovis1 at zg.ht.hr wrote: > On Tue, Jul 07, 2015 at 01:53:22PM +0000, eocene wrote: > > miroslav.rovis1 wrote: > > > On Tue, Jul 07, 2015 at 10:27:30AM +0200, miroslav.rovis1 at zg.ht.hr wrote: ... > So next is posting the relevant current configuration on: > > https://forums.grsecurity.net Deply RBAC on Dillo browser https://forums.grsecurity.net/viewtopic.php?f=5&t=4228 > _______________________________________________ > Dillo-dev mailing list > Dillo-dev at dillo.org > http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

Github et alia login/cookies issue

by miroslav.rovis1＠zg.ht.hr

On Tue, Jul 07, 2015 at 01:53:22PM +0000, eocene wrote: > miroslav.rovis1 wrote: > > On Tue, Jul 07, 2015 at 10:27:30AM +0200, miroslav.rovis1 at zg.ht.hr wrote: > > > "Something went wrong with that request. Please try again." > > ... > > > $ cat ~/.dillo/cookiesrc > > > DEFAULT DENY > > > .github.com ACCEPT > > ... > > > $ > > > > > ... > > > LATER. I even got (and all the conf is the same, .gitbub,com is in > > > cookiesrc), just this morning 2015-07-07 09:35 right now, the: > > > > > > "Cookies must be enabled to use GitHub." > > I see what the problems are with github cookies. > > 1. In cookiesrc, ".github.com" is for subdomains of github, and "github.com" > is for that host itself, so you need a "github.com" rule. > Yeah. It did occur to me, and I had removed the leading '.'. So that line in 'cookiesrc' now looks: github.com ACCEPT But I still can't log in, and it probably is the 2. below that you write. > 2. I was reluctant to follow the full date parsing in RFC 6265 until I had a > compelling reason, but you have brought me a compelling reason. github's > cookies have expiration dates like "Sat, 07 Jul 2035 13:24:19 -0000", which > appears to be legal, but dillo doesn't recognize it. So I'll work on it. > > (By the way, I wonder why they think their cookie should last for 20 years. > Makes me feel that I haven't been wasting my time with being careful with > Year 2038 overflow on 32-bit machines...) > However, it's even worse than that. I get maybe a thousand of lines per minute such as: Jul 7 16:22:04 g0n kernel: grsec: (miro:U:/usr/lib64/dillo/dpi) exec of /usr/lib64/dillo/dpi/cookies/cookies.dpi (/usr/lib64/dillo/dpi/cookies/cookies.dpi ) by /usr/lib64/dillo/dpi/cookies/cookies.dpi[dpid:1362] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/dpid[dpid:6224] uid/euid:1000/1000 gid/egid:1000/1000 Now, the explanation is I use: # cat /proc/sys/kernel/grsecurity/exec_logging 1 # the exec_logging functionality of the grsecurity-patched kernel. Excessive logs, true, but often I get the clues from those logs... I said it was worse, and it this sense. My: ~/.dillo/cookies.txt had only that one line that I send in the message: http://lists.dillo.org/pipermail/dillo-dev/2015-July/010582.html but now it has a huge many more of them: $ ls -l ~/.dillo/cookies.txt -rw------- 1 miro miro 24868 2015-07-07 11:34 /home/miro/.dillo/cookies.txt $ $ cat ~/.dillo/cookies.txt | wc -l 108 $ , and almost all those lines are from phpbb2mysql: $ cat ~/.dillo/cookies.txt | grep -v phpbb2mysql # HTTP Cookie File # This is a generated file! Do not edit. # [domain subdomains path secure expiry_time name value] [cookies dpi]: Enabling cookies as per cookiesrc... [cookies dpi]: Cookies loaded: 1. [cookies dpi]: (v.1) accepting connections... [cookies dpi]: denied SET for github.com [cookies dpi]: denied SET for github.com [cookies dpi]: denied SET for github.com Equally, all those lines are from forums.gentoo.org: $ cat ~/.dillo/cookies.txt | grep -v forums.gentoo.org # HTTP Cookie File # This is a generated file! Do not edit. # [domain subdomains path secure expiry_time name value] [cookies dpi]: Enabling cookies as per cookiesrc... [cookies dpi]: Cookies loaded: 1. [cookies dpi]: (v.1) accepting connections... [cookies dpi]: denied SET for github.com [cookies dpi]: denied SET for github.com [cookies dpi]: denied SET for github.com They look I can if I need to, look up all the variants, or encrypt then to your key, or plaintext if someone convinces me there should be nothing dangerous in revealing cookie content in this massive fashion; I don't know, will be thankful for any advice)... So those lines look like (a random one of those cca 100: [cookies dpi]: forums.gentoo.org GETTING: Cookie: phpbb2mysql_sid_s=a0cdf2e2eb297aa1127ff47385553234; phpbb2mysql_data_s=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%34333s%3A6%3A%22182646%22%3B%7D; phpbb2mysql_t=a%3A2%3A%7Bi%3A1016338%3Bi%3A1436261111%3Bi%3A1021456%3Bi%3A1436261138%3B%7D (I changed just a few chars for my protection, really little knowledge of cookies) And I have done more work, and intend to do more, but I'll try and get, I think I wrote that in some of the previous mails, the opinion from forums.gresecurity.net on how to deply gradm, the grsecurity administration utility, how to reconfofigure it on Dillo... If I manage to open forums.gresecurity.net, because for some, probably related reason, I can't currently. I tried, and it was just the Stop icon with an 'x' in it going red, but wouldn't open. Then I tried killing dillo (first I tried without '-9', not shown below): # ps aux | grep dillo root 1477 0.0 0.0 11584 2044 pts/10 S+ 16:36 0:00 grep --colour=auto dillo miro 4527 0.0 0.0 4284 1424 tty6 S 10:30 0:00 /usr/lib64/dillo/dpi/bookmarks/bookmarks.dpi miro 4528 0.0 0.0 4408 1692 tty6 S 10:30 0:00 /usr/lib64/dillo/dpi/file/file.dpi miro 4905 0.0 0.0 4288 1460 tty6 S 10:55 0:00 /usr/lib64/dillo/dpi/cookies/cookies.dpi miro 6225 0.0 0.0 4284 1260 tty6 S 16:14 0:00 /usr/lib64/dillo/dpi/bookmarks/bookmarks.dpi # And: # killall -9 4527 4528 4905 6225 4527: no process found 4528: no process found 4905: no process found 6225: no process found # But still: # ps aux | grep dillo root 1485 0.0 0.0 11584 2168 pts/10 S+ 16:37 0:00 grep --colour=auto dillo miro 4527 0.0 0.0 4284 1424 tty6 S 10:30 0:00 /usr/lib64/dillo/dpi/bookmarks/bookmarks.dpi miro 4528 0.0 0.0 4408 1692 tty6 S 10:30 0:00 /usr/lib64/dillo/dpi/file/file.dpi miro 4905 0.0 0.0 4288 1460 tty6 S 10:55 0:00 /usr/lib64/dillo/dpi/cookies/cookies.dpi miro 6225 0.0 0.0 4284 1260 tty6 S 16:14 0:00 /usr/lib64/dillo/dpi/bookmarks/bookmarks.dpi # Anyway, all the dillo windows are close. Trying again: forums.gresecurity.net No. Finding it in https://duckduckgo.com/html and opening it from there: worked. Now, let me explain how it went (and I hope some of the advanced users --or maybe even spender or PaX Team-- if they are reading this, I hope it helps diagnose the problems, btwn you, devs od Dillo, and them, the grsec/PaX devs. (I will, next, try and post my dillo related configuration in a new post that I will try and open in forums.gresecurity.net and then it will be a complete report, without that post to be it is not yet.) So, let me explain how it went: The link (be it from grsecurity.net or from debian net domain, which I tried also, as I wanted to show you that I evangelize for you, in digressiona: http://forums.debian.net/viewtopic.php?f=16&t=108616&p=584160#p584160 where find: because I really like Gentoo and (Debian/Devuan?), and Dillo and Postfix, and a lot of other programs ) So [the link] begins to open, and those maybe 1000 lines per minute begin to flood my /var/log/messages, Another typical one, just like the one that I already gave closer to the start of this message of mine: Jul 7 16:47:16 g0n kernel: grsec: (miro:U:/usr/lib64/dillo/dpi) exec of /usr/lib64/dillo/dpi/cookies/cookies.dpi (/usr/lib64/dillo/dpi/cookies/cookies.dpi ) by /usr/lib64/dillo/dpi/cookies/cookies.dpi[dpid:28919] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/bin/dpid[dpid:28798] uid/euid:1000/1000 gid/egid:1000/1000 Then I, in another terminal, as root, issue: # killall dpid which for grsecurity.net page opening need be done maybe once or rarely twice if at all, but for debian.net page opening needs to be done a few times, as it keeps restarting... And, if I missed to explain something, I'll try and remember and explain in the next message. As I said, for this to be complete, I need to get a better understanding of how to sort my /etc/grsec/policy for my Dillo. So next is posting the relevant current configuration on: https://forums.grsecurity.net -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

Github et alia login/cookies issue

by eocene＠gmx.com

miroslav.rovis1 wrote: > On Tue, Jul 07, 2015 at 10:27:30AM +0200, miroslav.rovis1 at zg.ht.hr wrote: > > "Something went wrong with that request. Please try again." > ... > > $ cat ~/.dillo/cookiesrc > > DEFAULT DENY > > .github.com ACCEPT > ... > > $ > > > ... > > LATER. I even got (and all the conf is the same, .gitbub,com is in > > cookiesrc), just this morning 2015-07-07 09:35 right now, the: > > > > "Cookies must be enabled to use GitHub." I see what the problems are with github cookies. 1. In cookiesrc, ".github.com" is for subdomains of github, and "github.com" is for that host itself, so you need a "github.com" rule. 2. I was reluctant to follow the full date parsing in RFC 6265 until I had a compelling reason, but you have brought me a compelling reason. github's cookies have expiration dates like "Sat, 07 Jul 2035 13:24:19 -0000", which appears to be legal, but dillo doesn't recognize it. So I'll work on it. (By the way, I wonder why they think their cookie should last for 20 years. Makes me feel that I haven't been wasting my time with being careful with Year 2038 overflow on 32-bit machines...)

July 7, 2015

The FAQ example on png/redirection not anymore accurate

by eocene＠gmx.com

miroslav.rovis1 wrote: > Correct me if I'm wrong, but what I write is in my best understanding > and with the intention to help my most used browser get even better. > > The FAQ entry: > "Why doesn't Dillo display certain images?" > at: > http://www.dillo.org/FAQ.html#q28 > > doesn't show any of: > ... > ... 'blog.reuters.com' to 'ad.doubleclick.net' > ... > > as the text currently reads, which probably means they have read our FAQ > and decided to change those redirections. Rewrote the FAQ entry in an effort to emphasize that it was showing what was happening at the time and isn't exactly what you're likely to see today. The hope is that people see the principle involved from the example, that sometimes it blocked things that you wanted, and sometimes it blocked things that you did not want.

July 7, 2015

Github et alia login/cookies issue

by miroslav.rovis1＠zg.ht.hr

On Tue, Jul 07, 2015 at 10:27:30AM +0200, miroslav.rovis1 at zg.ht.hr wrote: > "Something went wrong with that request. Please try again." ... > $ cat ~/.dillo/cookiesrc > DEFAULT DENY > .github.com ACCEPT ... > $ > ... > LATER. I even got (and all the conf is the same, .gitbub,com is in > cookiesrc), just this morning 2015-07-07 09:35 right now, the: > > "Cookies must be enabled to use GitHub." ... > Could it be an issue with hardened? What I did yesterday (I began > writing this message yesterday, which is all before the "LATER" mark > above), is I applied paxctl-ng -m on the binaries in > /usr/lib64/dillo/dpi/*/<the binary>, id est: I disabled the MPROTEXT on > them. I also have a text prepared on those, hopefully I send it next. > It certainly is (also) an issue with the hardened. I fix somewhat my /etc/grsec/policy (and some other errors are gone), but... Let me see: no, from the github I still get: "Cookies must be enabled to use GitHub." and stubbornly so... I'll try and see if I can get any insight into this on forums,grsecurity.net and will report back. > -- > Miroslav Rovis > Zagreb, Croatia > http://www.CroatiaFidelis.hr > _______________________________________________ > Dillo-dev mailing list > Dillo-dev at dillo.org > http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

Github et alia login/cookies issue

by miroslav.rovis1＠zg.ht.hr

"Something went wrong with that request. Please try again." is what I get (in bottom of the login page). The: $ cat ~/.dillo/cookiesrc DEFAULT DENY .github.com ACCEPT .devuan.org ACCEPT .gentoo.org ACCEPT .wikibooks.org ACCEPT .grsecurity.net ACCEPT $ contains them. And the: $ cat ~/.dillo/cookies.txt # HTTP Cookie File # This is a generated file! Do not edit. # [domain subdomains path secure expiry_time name value] $ is empty! I saw no errors in /var/log/messages though! But I'll try something. If it works for me, it might be useful for others, if not, maybe I get some help on it. I've always been able to login fine into forums.debian.net, forums.gentoo,org, forums.grsecurity.net and forum.sleuthkit.org (after Google stopped banning me, in the captcha that they use to register; Google, the surveillor of the world, is my distasteful enemy... Nobody should be afraid of them, lots of us Liliputians will always overcome any ugly Gullivers like the Schmoog is). --- All the above was prepared for sending yesterday, 2015-07-06. LATER. I even got (and all the conf is the same, .gitbub,com is in cookiesrc), just this morning 2015-07-07 09:35 right now, the: "Cookies must be enabled to use GitHub." when making another attemt to log into Github. But that was when I rebooted into my old: 3.19.6-hardened kernel maybe half hour ago (for unrelated reasons). And take a look at the following: This is the cookies.txt file, Only gentoo wrote in it, so far (and I accessed all those since, and esp. I took care to try the github). # HTTP Cookie File # This is a generated file! Do not edit. # [domain subdomains path secure expiry_time name value] forums.gentoo.org TRUE / TRUE 1467787565 phpbb2mysql_data_s a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A6%3A%22334555%22%3B%7D Don't know if there's any secrets detrimental for me, that I'd be revealing, do modified some numbers in that forums.gentoo.org entry, just in case. I need to be on the fonts issue (but I think some of you, is it even you, Jorge, who do the development in gentoo, not sure)... I thought I'd still post this, as this might be a useful report for you, devs. OTOH, I'll post the emerge --info and more when I try the bug report on the fonts. Just: $ uname -r 4.0.7-hardened-150705 $ Could it be an issue with hardened? What I did yesterday (I began writing this message yesterday, which is all before the "LATER" mark above), is I applied paxctl-ng -m on the binaries in /usr/lib64/dillo/dpi/*/<the binary>, id est: I disabled the MPROTEXT on them. I also have a text prepared on those, hopefully I send it next. -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

Fonts not found issue persists in 3.0.5

by miroslav.rovis1＠zg.ht.hr

I got the new Dillo version 3.0.5 (in the master air-gapped box, which I yet have to clone onto this, for online, same hardware box), as it is available in gentoo: https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/www-client/dillo/ but my problem with fonts (the FAQ issue http://www.dillo.org/FAQ.html#q27) to which eocene has kindly given the tip for in his message: http://lists.dillo.org/pipermail/dillo-dev/2015-April/010500.html For people reading this message offline, I'll paste his advice, since it is also important: If you go to dw/fltkplatform.cc and, in FltkFont::initSystemFonts(), remove the leading underscore in _MSG("Found font: %s%s%s\n", name, t & FL_BOLD ? " bold" : "", to get MSG("Found font: %s%s%s\n", name, t & FL_BOLD ? " bold" : "", and recompile, what does dillo say when you run it? And I was saying that that problem I still have in my 3.0.5. I hoped it would have been solved, but since it hasn't been, for me who am not really a developer, to go and recompile means first get (finally, it's been waiting for me since long) a little really deeper and dirty with the Gentoo ebuild system, and, basically compile my own ebuild... or... Or get Gentoo developers to do it for all of the Dillo Gentoo users. Since my eyes are sore from too small and non configurable fonts, I'm afraid I will have to do one of the above... For the latter, since this issue has been discussed, and previous to eocene's message you can see that I extensively described it, what do kind Dillo devs think: the second route to take, which is: file a bug on Gentoo bugzilla with basically updated real output from the new Dillo 3.0.5, might probably be shorter route to get this issue fixed? That is what I should try first, isn't it. Oh, well, I hope I haven't been too lengthy.,, Another issue I also have. Can't log into: https://github.com/miroR And was able to log into it with lynx, and open my new repo https://github.com/miroR/flowstamp So it doesn't seem to be github follows the big JS-and-all browsers else-get-lost policy like soo many... Depending on the soonness of the fonts solution, I'd be willing to provide more information, such as the full screencast/traffic-dump of my future attempt to log into Github, so we get this done... Depending on that being solved (I'm not expert by any means, and who knows if I get any help from Gentoo devs, who are overworked). Really depending on the fonts issue being solve first, as my eyes hurt (born with somewhat poor eyesight, but getting worse, am 58 ys of age). Cheers, and keep up the good work. I hope you all keep in harmony, as soo much if missing for Dillo to become a complete browser... I'll be pretty sad if any bad rifts were to appear among the team... Pls. find the right way between yourselves, and do only what is right and honest for all of you! Much is missing in the Dillo, but, you seem to be the strongest around that keep free! Free from surveillors! I was really right when in what I posted on: Secure: yes, Though Features Missing; and Bugs http://lists.dillo.org/pipermail/dillo-dev/2015-April/010495.html (too much to paste for offline readers, but in short, I compared the Firefox harvesting on users with the sea-calm when online of kind and secure Dillo) Kind regards, -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015

The FAQ example on png/redirection not anymore accurate

by miroslav.rovis1＠zg.ht.hr

Correct me if I'm wrong, but what I write is in my best understanding and with the intention to help my most used browser get even better. The FAQ entry: "Why doesn't Dillo display certain images?" at: http://www.dillo.org/FAQ.html#q28 doesn't show any of: ... ... 'blog.reuters.com' to 'ad.doubleclick.net' ... as the text currently reads, which probably means they have read our FAQ and decided to change those redirections. This is what I actually get when I uncomment the line which is commented the way the built-in default settings are, as it says in the top of ~/.dillo/dillorc to read: show_msg=YES (but it shows the same even if I leave if commented out; it's the default, I retried with it commented out: same) $ Domain: Default accept. dillo_dns_init: Here we go! (threaded) Enabling cookies as from cookiesrc... ** WARNING **: preferred sans-serif font "DejaVu Sans" not found. ** WARNING **: preferred serif font "DejaVu Serif" not found. ** WARNING **: preferred monospace font "DejaVu Sans Mono" not found. ** WARNING **: preferred cursive font "URW Chancery L" not found. ** WARNING **: preferred fantasy font "DejaVu Sans" not found. Nav_open_url: new url='about:splash' Nav_open_url: new url='http://en.wikipedia.org' Dns_server [0]: en.wikipedia.org is 91.198.174.192 2620:0:862:ed1a::1 Connecting to 91.198.174.192 Nav_open_url: new url='https://en.wikipedia.org/' Nav_open_url: new url='https://en.wikipedia.org/wiki/Main_Page' NumPendingStyleSheets=1 NumPendingStyleSheets=2 Png_error_handling: iCCP: known incorrect sRGB profile So probably the example should be changed to reflect this changed reality, so users would not get confused as they will probably see none of those 'reuters' lines in the messages on their terminal. Maybe it would be sufficient to just rewrite that item of the FAQ to mean that previously they would have seen those messages... Don't know. Again, correct me if I'm wrong. On another note, I got the new 3.0.5, as it is available in gentoo, but I have the same fonts not found issue which I had previously described (and it's there in yesterday's real output form my system, further above; it was yesterday, the delay being for unrelated reasons), and about which (the fonts not found issue) I will next send another message, with different, appropriate subject, to this list, I hope. Cheers! -- Miroslav Rovis Zagreb, Croatia http://www.CroatiaFidelis.hr

July 7, 2015