1317281 - SonicWALL Firewall Appliance with Gateway Anti-Virus is currently blocking the 64-bit stub installer

Status: VERIFIED FIXED

(Firefox :: Installer, defect, P1)

Description

[Andrei Vaida [:avaida]]

[Preconditions]:
  - SonicWALL Firewall Appliance has to be installed and active:
    https://www.sonicwall.com/products/sonicwall-nsa/
  - The "Gateway Anti-Virus" option needs to be enabled for SonicWALL.

[Affected versions]: 
  all

[Affected platforms]: 
  Windows (all)

[Steps to reproduce]:
  1. Download the following 64-bit stub installer:
     https://bugzilla.mozilla.org/attachment.cgi?id=8805254
  2. Run the stub installer as administrator.
  3. Follow the setup wizard's steps to install Firefox.

[Expected result]: 
  Firefox is successfully installed via stub installer.

[Actual result]:
  - The stub installer hangs in the "Downloading Firefox" stage for a
    while and then the following alert is displayed:

       Gateway Anti-Virus Alert [...] This request is blocked by the
       Firewall Gateway Anti-Virus Service. Name: InstallCore.A_237
       (Adware) blocked.

  - As a result, the stub installer is blocked from downloading
    Firefox and the install process is cancelled.

[Regression range]: 
  This issue is not a regression.

[Additional notes]:
  - We are using SonicWALL Firewall Appliance in all of our offices,
    but for one of them we've recently enabled a specific option:
    Gateway Anti-Virus.
	
     - Based on a few tests across different offices, we concluded that
       only the office that had Gateway Anti-Virus enabled was showing
       this problem.
	
     - Initially, we've noticed that suddenly both 32-bit and 64-bit
       stub installers were being blocked.
	
     - Starting last Thursday and without any changes being made to our
       office's firewall rules, we noticed that 32-bit installers were
       no longer being blocked and I've double-checked that again today.
       As of this moment, only 64-bit stub installers get blocked, with
       the same alert notification.
	
  - These are the stub installers we've used to test the firewall's 
    behavior:

     - 64-bit (blocked):
        * https://bugzilla.mozilla.org/attachment.cgi?id=8805254

     - 32-bit (initially blocked, but now they're not):
        * https://mzl.la/2eXc5VD
        * https://mzl.la/19V7f56
        * https://mzl.la/2fyuVAG 
        * https://mzl.la/2g7bQcV

  - We tested the same firewall setup with other stub/web installers,
    to see whether it's something isolated to the Firefox stub:

     - Google Chrome: not blocked
     - Opera: blocked, reason: MalAgent.I_12705 (Trojan)
     - Torch: not blocked
     - Pale Moon: not blocked
     - Vivaldi: n/a, no web installer available
     - Maxthon: n/a, no web installer available
     - Yandex: n/a, no web installer available
     - Dropbox: not blocked
     - Google Drive: not blocked

Comment 1

[Chris Peterson [:cpeterson]]

The 64-bit stub installer might be blocked because it is a private developer build. I wonder if an official Firefox Nightly build would also be blocked. We won't know that until Matt lands the 64-bit stub installer in Nightly.

We should also reach out to SonicWALL.

Comment 2

[Molly Howell (she/her) (no longer active)]

(In reply to Chris Peterson [:cpeterson] from comment #1)
> The 64-bit stub installer might be blocked because it is a private developer
> build. I wonder if an official Firefox Nightly build would also be blocked.
> We won't know that until Matt lands the 64-bit stub installer in Nightly.

I made a build with release branding for this testing, and the URL to the full installer download is part of the branding, so that build should be indistinguishable from an official build from the point of view of a firewall.

Comment 3

[Andrei Vaida [:avaida]]

Following SonicWALL's latest signature update distribution, the 64-bit stub installer is no longer being blocked. We've confirmed this on 4 different machines from the same office and everything is working as intended.

Note that the firewall behavior has been tested with both the old 64-bit build and the new one (per Comment 2), provided by Matt.

Chris, Matt, you have our green light to close this. Let me know if you need any additional information on this matter. (needinfo?ing you both to make sure you're aware of this)

Comment 4

[Molly Howell (she/her) (no longer active)]

Thanks, Andrei!