1486230 - Firefox for Android intermittently ignores proxy settings

Status: RESOLVED DUPLICATE of bug 507641

(Firefox for Android Graveyard :: General, defect)

Description

[micredd]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180807170231

Steps to reproduce:

1. On a vanilla install (no add-ons or special configuration), set browser to use a SOCKS5 proxy.
2. Disable DNS prefetching (network.dns.disablePrefetch=true).
3. Set browser to perform DNS look-ups via the SOCKS5 proxy (network.proxy.socks_remote_dns=true).
4. Start a packet capture of all traffic originating from the device.
5. Browse the Web as usual from the device.


Actual results:

Upon first loading the app, Fennec would make unproxied requests to various servers for Telemetry services and whatnot. Excusing these, however, Fennec would intermittently ignore its proxy settings throughout the course of a browsing session. This appeared in the packet capture as plain DNS look-ups for the sites I was browsing and direct browser<->server negotiations and GET requests interspersed with the expected SOCKS5 traffic.

This might represent a potential security issue for the user if, for example, the user has configured his/her browser to proxy through Tor.


Expected results:

Once the browser was configured to use a proxy, I would expect packet captures of the device to show it generating nothing but SOCKS5 traffic once the initial app load was complete.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Likely dupe of Bug 507641

Comment 2

[micredd]

(In reply to Kevin Brosnan [:kbrosnan] from comment #1)
> Likely dupe of Bug 507641

Having looked at #507641, I would agree, this looks to be the same issue. Most of the unproxied traffic was TLS, so I couldn't determine what was being done. However, in the unencrypted GET requests, yes, it was Fennec pulling the site's favicon.

Given that #507641 was filed nine years ago, it seems there's a lot of plumbing that would need to change to properly resolve these issues. If it meant less work for the developers, I'd be just as happy to get an about:config tunable that lets me disable pulling favicons.

Comment 3

[Bogdan Surd, QA [:bsurd, NI]]

@[e-mail] thank you for confirming!

Based on Comment 2 closing this as a dupe of Bug 507641.