if (arguments.length > 1)

for (var j = 0, len = arguments.length; j < len; j++)

INCLUDE(arguments[j]);

else if (!_INCLUDED[name]) {

try {

LOADER.loadSubScript("chrome://https-everywhere/content/code/"

+ name + ".js");

_INCLUDED[name] = true;

} catch(e) {

dump("INCLUDE " + name + ": " + e + "\n");

}

}

this.prefs = CC["@mozilla.org/preferences-service;1"]

.getService(CI.nsIPrefBranch);

try {

// Check for torbutton

var tor_logger_component = CC["@torproject.org/torbutton-logger;1"];

if (tor_logger_component) {

this.tor_logger =

tor_logger_component.getService(CI.nsISupports).wrappedJSObject;

this.torbutton_installed = true;

}

} catch(e) {

this.torbutton_installed = false;

}

this.HTTPSEverywhere = CC["@eff.org/https-everywhere;1"]

.getService(Components.interfaces.nsISupports)

.wrappedJSObject;

/* The proxy test result starts out null until the test is attempted.

this.proxy_test_successful = null;

this.proxy_test_callback = null;

this.cto_url = "https://check.torproject.org/?TorButton=true";

// a regexp to match the above URL

this.cto_regexp = RegExp("^https://check\\.torproject\\.org/");

this.public_roots = root_ca_hashes;

// Clear these on cookies-cleared observer event

this.already_submitted = {};

this.delayed_submissions = {};

OS.addObserver(this, "cookie-changed", false);

// Figure out the url to submit to

this.submit_host = null;

this.findSubmissionTarget();

// Used to track current number of pending requests to the server

this.current_outstanding_requests = 0;

// Generate nonce to append to url, to catch in nsIProtocolProxyFilter

// and to protect against CSRF

this.csrf_nonce = "#"+Math.random().toString()+Math.random().toString();

this.compatJSON = Cc["@mozilla.org/dom/json;1"].createInstance(Ci.nsIJSON);

// Register observer

OS.addObserver(this, "http-on-examine-response", false);

// Register protocolproxyfilter

this.pps = CC["@mozilla.org/network/protocol-proxy-service;1"]

.getService(CI.nsIProtocolProxyService);

this.pps.registerFilter(this, 0);

this.wrappedJSObject = this;

this.client_asn = ASN_PRIVATE;

if (this.myGetBoolPref("send_asn"))

this.setupASNWatcher();

try {

NSS.initialize("");

} catch(e) {

this.log(WARN, "Failed to initialize NSS component:" + e);

}

this.testProxySettings();

this.log(DBUG, "Loaded observatory component!");

try {

// Do we have a valid channel argument?

if (!channel instanceof Ci.nsIChannel) {

return null;

}

var secInfo = channel.securityInfo;

// Print general connection security state

if (secInfo instanceof Ci.nsITransportSecurityInfo) {

secInfo.QueryInterface(Ci.nsITransportSecurityInfo);

} else {

return null;

}

if (secInfo instanceof Ci.nsISSLStatusProvider) {

return secInfo.QueryInterface(Ci.nsISSLStatusProvider).

SSLStatus.QueryInterface(Ci.nsISSLStatus).serverCert;

}

return null;

} catch(err) {

return null;

}

// Compute the URL that the Observatory will currently submit to

var host = this.prefs.getCharPref("extensions.https_everywhere._observatory.server_host");

// Rebuild the regexp iff the host has changed

if (host != this.submit_host) {

this.submit_host = host;

this.submit_url = "https://" + host + "/submit_cert";

this.submission_regexp = RegExp("^" + this.regExpEscape(this.submit_url));

}

// Borrowed from the Closure Library,

// https://closure-library.googlecode.com/svn/docs/closure_goog_string_string.js.source.html

return String(s).replace(/([-()\[\]{}+?*.$\^|,:#<!\\])/g, '\\$1').replace(/\x08/g, '\\x08');

this.log(NOTE, "cert warning for " + targetSite);

if (targetSite == "observatory.eff.org") {

this.log(WARN, "Suppressing observatory warning");

return true;

}

return false;

this.getClientASN();

this.max_ap = null;

// we currently do not actually do *any* ASN watching from the client

// (in other words, the db will not have ASNs for certs submitted

// through Tor, even if the user checks the "send ASN" option)

// all of this code for guessing at changes in our public IP via WiFi hints

// is therefore disabled

/*

this.client_asn = ASN_PRIVATE;

/*

// Fetch a new client ASN..

if (!this.myGetBoolPref("send_asn")) {

this.client_asn = ASN_PRIVATE;

return;

}

else if (!this.torbutton_installed) {

this.client_asn = ASN_IMPLICIT;

return;

}

// XXX As a possible base case: the user is running Tor, is not using

// bridges, and has send_asn enabled: should we ping an eff.org URL to

// learn our ASN?

return;

var len = new Object();

var derData = cert.getRawDER(len);

var ch = CC["@mozilla.org/security/hash;1"].createInstance(CI.nsICryptoHash);

ch.init(ch.MD5);

ch.update(derData,derData.length);

var h = ch.finish(false);

function toHexString(charCode) {

return ("0" + charCode.toString(16)).slice(-2);

}

return [toHexString(h.charCodeAt(i)) for (i in h)].join("").toUpperCase();

if (topic == "cookie-changed" && data == "cleared") {

this.already_submitted = {};

this.delayed_submissions = {};

this.log(INFO, "Cookies were cleared. Purging list of pending and already submitted certs");

return;

}

if (topic == "nsPref:changed") {

// XXX: We somehow need to only call this once. Right now, we'll make

// like 3 calls to getClientASN().. The only thing I can think

// of is a timer...

if (data == "network.proxy.ssl" || data == "network.proxy.ssl_port" ||

data == "network.proxy.socks" || data == "network.proxy.socks_port") {

this.log(INFO, "Proxy settings have changed. Getting new ASN");

this.getClientASN();

}

return;

}

if (topic == "network:offline-status-changed" && data == "online") {

this.log(INFO, "Browser back online. Getting new ASN.");

this.getClientASN();

return;

}

if ("http-on-examine-response" == topic) {

if (!this.observatoryActive()) return;

var host_ip = "-1";

var httpchannelinternal = subject.QueryInterface(Ci.nsIHttpChannelInternal);

try {

host_ip = httpchannelinternal.remoteAddress;

} catch(e) {

this.log(INFO, "Could not get server IP address.");

}

subject.QueryInterface(Ci.nsIHttpChannel);

var certchain = this.getSSLCert(subject);

if (certchain) {

var chainEnum = certchain.getChain();

var chainArray = [];

var chainArrayFpStr = '';

var fps = [];

for(var i = 0; i < chainEnum.length; i++) {

var cert = chainEnum.queryElementAt(i, Ci.nsIX509Cert);

chainArray.push(cert);

var fp = this.ourFingerprint(cert);

fps.push(fp);

chainArrayFpStr = chainArrayFpStr + fp;

}

var chain_hash = sha256_digest(chainArrayFpStr).toUpperCase();

this.log(INFO, "SHA-256 hash of cert chain for "+new String(subject.URI.host)+" is "+ chain_hash);

if(!this.myGetBoolPref("use_whitelist")) {

this.log(WARN, "Not using whitelist to filter cert chains.");

}

else if (this.isChainWhitelisted(chain_hash)) {

this.log(INFO, "This cert chain is whitelisted. Not submitting.");

return;

}

else {

this.log(INFO, "Cert chain is NOT whitelisted. Proceeding with submission.");

}

if (subject.URI.port == -1) {

this.submitChain(chainArray, fps, new String(subject.URI.host), subject, host_ip, false);

} else {

this.submitChain(chainArray, fps, subject.URI.host+":"+subject.URI.port, subject, host_ip, false);

}

}

}

if (!this.myGetBoolPref("enabled"))

return false;

if (this.torbutton_installed && this.proxy_test_successful) {

// Allow Tor users to choose if they want to submit

// during tor and/or non-tor

if (this.myGetBoolPref("submit_during_tor") &&

this.prefs.getBoolPref("extensions.torbutton.tor_enabled"))

return true;

if (this.myGetBoolPref("submit_during_nontor") &&

!this.prefs.getBoolPref("extensions.torbutton.tor_enabled"))

return true;

return false;

}

if (this.proxy_test_successful) {

return true;

} else if (this.myGetBoolPref("use_custom_proxy")) {

// no torbutton; the custom proxy is probably the user opting to

// submit certs without strong anonymisation. Because the

// anonymisation is weak, we avoid submitting during private browsing

// mode.

try {

var pbs = CC["@mozilla.org/privatebrowsing;1"].getService(CI.nsIPrivateBrowsingService);

if (pbs.privateBrowsingEnabled) return false;

} catch (e) { /* seamonkey or old firefox */ }

return true;

}

return false;

if (X509ChainWhitelist == null) {

this.log(WARN, "Could not find whitelist of popular certificate chains, so ignoring whitelist");

return false;

}

if (X509ChainWhitelist[chainhash] != null) {

return true;

}

return false;

// Return the position in the chain Array of the/a root CA

var rootidx = -1;

var nextInChain = certArray[0].issuer;

for (var i = 0; i < certArray.length; i++) {

// Find the next cert in the valid chain

if (certArray[i].equals(nextInChain)) {

if (certArray[i].issuerName == certArray[i].subjectName) {

// All X509 root certs are self-signed

this.log(INFO, "Got root cert at position: "+i);

rootidx = i;

break;

} else {

// This is an intermediate CA cert; keep looking for the root

nextInChain = certArray[i].issuer;

}

}

}

return rootidx;

// Make sure the chain we're working with is sane, even if Convergence is

// present.

// Convergence currently performs MITMs against the Firefox in order to

// get around https://bugzilla.mozilla.org/show_bug.cgi?id=644640. The

// end-entity cert produced by Convergence contains a copy of the real

// end-entity cert inside an X509v3 extension. We extract this and send

// it rather than the Convergence certs.

var convergence = Components.classes['@thoughtcrime.org/convergence;1'];

if (!convergence) return null;

convergence = convergence.getService().wrappedJSObject;

if (!convergence || !convergence.enabled) return null;

this.log(INFO, "Convergence uses its own internal root certs; not submitting those");

//this.log(WARN, convergence.certificateStatus.getVerificiationStatus(chain.certArray[0]));

try {

var certInfo = this.extractRealLeafFromConveregenceLeaf(chain.certArray[0]);

var b64Cert = certInfo["certificate"];

var certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);

chain.leaf = certDB.constructX509FromBase64(b64Cert);

chain.certArray = [chain.leaf];

chain.fps = [this.ourFingerprint(chain.leaf)];

} catch (e) {

this.log(WARN, "Failed to extract leaf cert from Convergence cert " + e);

chain.certArray = chain.certArray.slice(0,1);

chain.fps = chain.fps.slice(0,1);

}

// Copied from Convergence's CertificateStatus.getVerificiationStatus

var len = {};

var derEncoding = certificate.getRawDER(len);

var derItem = NSS.types.SECItem();

derItem.data = NSS.lib.ubuffer(derEncoding);

derItem.len = len.value;

var completeCertificate = NSS.lib.CERT_DecodeDERCertificate(derItem.address(), 1, null);

var extItem = NSS.types.SECItem();

var status = NSS.lib.CERT_FindCertExtension(completeCertificate,

NSS.lib.SEC_OID_NS_CERT_EXT_COMMENT,

extItem.address());

if (status != -1) {

var encoded = '';

var asArray = tcypes.cast(extItem.data, tcypes.ArrayType(tcypes.unsigned_char, extItem.len).ptr).contents;

var marker = false;

for (var i=0;i<asArray.length;i++) {

if (marker) {

encoded += String.fromCharCode(asArray[i]);

} else if (asArray[i] == 0x00) {

marker = true;

}

}

return JSON.parse(encoded);

}

// Return true if we should submit this chain to the SSL Observatory

var rootidx = this.findRootInChain(chain.certArray);

var ss= false;

if (chain.leaf.issuerName == chain.leaf.subjectName)

ss = true;

if (!this.myGetBoolPref("self_signed") && ss) {

this.log(INFO, "Not submitting self-signed cert for " + domain);

return false;

}

if (!ss && !this.myGetBoolPref("alt_roots")) {

if (rootidx == -1) {

// A cert with an unknown/absent Issuer. Out of caution, don't submit these

this.log(INFO, "Cert for " + domain + " issued by unknown CA " +

chain.leaf.issuerName + " (not submitting due to settings)");

return false;

} else if (!(chain.fps[rootidx] in this.public_roots)) {

// A cert with a known but non-public Issuer

this.log(INFO, "Got a private root cert. Ignoring domain "

+domain+" with root "+chain.fps[rootidx]);

return false;

}

}

if (chain.fps[0] in this.already_submitted) {

this.log(INFO, "Already submitted cert for "+domain+". Ignoring");

return false;

}

return true;

var base64Certs = [];

// Put all this chain data in one object so that it can be modified by

// subroutines if required

var c = {}; c.certArray = certArray; c.fps = fps; c.leaf = certArray[0];

this.processConvergenceChain(c);

if (!this.shouldSubmit(c,domain)) return;

// only try to submit now if there aren't too many outstanding requests

if (this.current_outstanding_requests > MAX_OUTSTANDING) {

this.log(WARN, "Too many outstanding requests ("+this.current_outstanding_requests+"), not submitting");

// if there are too many current requests but not too many

// delayed/pending ones, then delay this one

if (Object.keys(this.delayed_submissions).length < MAX_DELAYED)

if (!(c.fps[0] in this.delayed_submissions)) {

this.log(WARN, "Planning to retry submission...");

let retry = function() { this.submitChain(certArray, fps, domain, channel, host_ip, true); };

this.delayed_submissions[c.fps[0]] = retry;

}

return;

}

for (var i = 0; i < c.certArray.length; i++) {

var len = new Object();

var derData = c.certArray[i].getRawDER(len);

let result = "";

for (let j = 0, dataLength = derData.length; j < dataLength; ++j)

result += String.fromCharCode(derData[j]);

base64Certs.push(btoa(result));

}

var reqParams = [];

reqParams.push("domain="+domain);

reqParams.push("server_ip="+host_ip);

if (this.myGetBoolPref("testing")) {

reqParams.push("testing=1");

// The server can compute these, but they're a nice test suite item!

reqParams.push("fplist="+this.compatJSON.encode(c.fps));

}

reqParams.push("certlist="+this.compatJSON.encode(base64Certs));

if (resubmitting) {

reqParams.push("client_asn="+ASN_UNKNOWABLE);

}

else {

reqParams.push("client_asn="+this.client_asn);

}

if (this.myGetBoolPref("priv_dns")) {

reqParams.push("private_opt_in=1");

}

else {

reqParams.push("private_opt_in=0");

}

var params = reqParams.join("&") + "&padding=0";

var tot_len = BASE_REQ_SIZE;

this.log(INFO, "Submitting cert for "+domain);

this.log(DBUG, "submit_cert params: "+params);

// Pad to exp scale. This is done because the distribution of cert sizes

// is almost certainly pareto, and definitely not uniform.

for (tot_len = BASE_REQ_SIZE; tot_len < params.length; tot_len*=2);

while (params.length != tot_len) {

params += "0";

}

var that = this; // We have neither SSLObservatory nor this in scope in the lambda

var HTTPSEverywhere = CC["@eff.org/https-everywhere;1"]

.getService(Components.interfaces.nsISupports)

.wrappedJSObject;

var win = null;

if (channel) {

var browser = this.HTTPSEverywhere.getBrowserForChannel(channel);

if (browser) {

var win = browser.contentWindow;

}

}

var req = this.buildRequest(params);

req.timeout = TIMEOUT;

req.onreadystatechange = function(evt) {

if (req.readyState == 4) {

// pop off one outstanding request

that.current_outstanding_requests -= 1;

that.log(DBUG, "Popping one off of outstanding requests, current num is: "+that.current_outstanding_requests);

if (req.status == 200) {

that.log(INFO, "Successful cert submission");

if (!that.prefs.getBoolPref("extensions.https_everywhere._observatory.cache_submitted") &&

c.fps[0] in that.already_submitted) {

delete that.already_submitted[c.fps[0]];

}

// Retry up to two previously failed submissions

let n = 0;

for (let fp in that.delayed_submissions) {

that.log(WARN, "Retrying a submission...");

that.delayed_submissions[fp]();

delete that.delayed_submissions[fp];

if (++n >= 2) break;

}

} else if (req.status == 403) {

that.log(WARN, "The SSL Observatory has issued a warning about this certificate for " + domain);

try {

var warningObj = JSON.parse(req.responseText);

if (win) that.warnUser(warningObj, win, c.certArray[0]);

} catch(e) {

that.log(WARN, "Failed to process SSL Observatory cert warnings :( " + e);

that.log(WARN, req.responseText);

}

} else {

// Submission failed

if (c.fps[0] in that.already_submitted) {

delete that.already_submitted[c.fps[0]];

}

try {

that.log(WARN, "Cert submission failure "+req.status+": "+req.responseText);

} catch(e) {

that.log(WARN, "Cert submission failure and exception: "+e);

}

// If we don't have too many delayed submissions, and this isn't

// (somehow?) one of them, then plan to retry this submission later

if (Object.keys(that.delayed_submissions).length < MAX_DELAYED &&

c.fps[0] in that.delayed_submissions) {

that.log(WARN, "Planning to retry submission...");

let retry = function() { that.submitChain(certArray, fps, domain, channel, host_ip, true); };

that.delayed_submissions[c.fps[0]] = retry;

}

}

}

};

// Cache this here to prevent multiple submissions for all the content elements.

that.already_submitted[c.fps[0]] = true;

// add one to current outstanding request number

that.current_outstanding_requests += 1;

that.log(DBUG, "Adding outstanding request, current num is: "+that.current_outstanding_requests);

req.send(params);

var req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]

.createInstance(Ci.nsIXMLHttpRequest);

// We do this again in case the user altered about:config

this.findSubmissionTarget();

req.open("POST", this.submit_url+this.csrf_nonce, true);

// Send the proper header information along with the request

// Do not set gzip header.. It will ruin the padding

req.setRequestHeader("X-Privacy-Info", "EFF SSL Observatory: https://www.eff.org/r.22c");

req.setRequestHeader("Content-type", "application/x-www-form-urlencoded");

req.setRequestHeader("Content-length", params.length);

req.setRequestHeader("Connection", "close");

// Need to clear useragent and other headers..

req.setRequestHeader("User-Agent", "");

req.setRequestHeader("Accept", "");

req.setRequestHeader("Accept-Language", "");

req.setRequestHeader("Accept-Encoding", "");

req.setRequestHeader("Accept-Charset", "");

return req;

var aWin = CC['@mozilla.org/appshell/window-mediator;1']

.getService(CI.nsIWindowMediator)

.getMostRecentWindow('navigator:browser');

aWin.openDialog("chrome://https-everywhere/content/observatory-warning.xul",

"","chrome,centerscreen", warningObj, win, cert);

if (this.proxy_test_successful != null) {

/* Proxy test already ran. Callback immediately. */

callback_fcn(this.proxy_test_successful);

this.proxy_test_callback = null;

return;

} else {

this.proxy_test_callback = callback_fcn;

}

/* Plan:

this.proxy_test_successful = null;

try {

var req = Components.classes["@mozilla.org/xmlextras/xmlhttprequest;1"]

.createInstance(Components.interfaces.nsIXMLHttpRequest);

var url = this.cto_url + this.csrf_nonce;

req.open('GET', url, true);

req.channel.loadFlags |= Ci.nsIRequest.LOAD_BYPASS_CACHE;

req.overrideMimeType("text/xml");

var that = this; // Scope gymnastics for async callback

req.onreadystatechange = function (oEvent) {

if (req.readyState === 4) {

that.proxy_test_successful = false;

if(req.status == 200) {

if(!req.responseXML) {

that.log(INFO, "Tor check failed: No XML returned by check service.");

return;

}

var result = req.responseXML.getElementById('TorCheckResult');

if(result===null) {

that.log(INFO, "Tor check failed: Non-XML returned by check service.");

} else if(typeof(result.target) == 'undefined'

|| result.target === null) {

that.log(INFO, "Tor check failed: Busted XML returned by check service.");

} else if(result.target === "success") {

that.log(INFO, "Tor check succeeded.");

that.proxy_test_successful = true;

} else {

that.log(INFO, "Tor check failed: "+result.target);

}

} else {

that.log(INFO, "Tor check failed: HTTP Error "+req.status);

}

/* Notify the UI of the test result */

if (that.proxy_test_callback) {

that.proxy_test_callback(that.proxy_test_successful);

that.proxy_test_callback = null;

}

}

};

req.send(null);

} catch(e) {

this.proxy_test_successful = false;

if(e.result == 0x80004005) { // NS_ERROR_FAILURE

this.log(INFO, "Tor check failed: Proxy not running.");

}

this.log(INFO, "Tor check failed: Internal error: "+e);

if (this.proxy_test_callback) {

this.proxy_test_callback(this.proxy_test_successful);

this.proxy_test_callback = null;

}

}