1579985 - Impossible to use proxies with DoH

Status: UNCONFIRMED

(Core :: Networking, defect, P3)

Description

[Yegor]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36

Steps to reproduce:

1. Enable DoH (any resolver) and set network.trr.mode = 3
2. Load a Pac file with a single proxy into the browser
3. Try to load any website

Actual results:

Firefox errors out on all requests with error "Unable to find the proxy server". Setting network.trr.mode = 2 "fixes" the issue.

Expected results:

Proxy hostname should have been resolved through DoH (it wasn't), and user should be able to proxy all requests though it.

Comment 1

[Yegor]

Considering DoH is about to become the default (https://bugzilla.mozilla.org/show_bug.cgi?id=1573840) this is a huge issue for all proxy extensions.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Hi Yegor,

Can you share the contents of the PAC file? How are you setting the PAC file?

Note that mode3 hasn't been thoroughly tested and will not be shipped by default in Firefox.

Comment 3

[Nhi Nguyen (:nhi)]

Note that in the description, it says this is not an issue if trr.mode = 2, which is what will be set in the DoH rollout. So the rollout will not affect functionality of proxy extensions.

Comment 4

[Yegor]

The Pac file can be as simple as this:

function FindProxyForURL(url, host) {
return "HTTPS stg-ie-003.windscribe.com";
}

Loading the proxy via the extension APIs has the same effect.

Comment 5

[Valentin Gosu [:valentin] (he/him)]

So, this is a bootstrapping problem.
Most likely we are trying to use the proxy for the DoH URL, but DNS doesn't yet work in mode 3, because TRR hasn't connected yet.

I can suggest

1. setting network.trr.bootstrapAddress to the IP address you get when resolving the URL in network.trr.uri
2. trying a PAC script that only contains IP addresses.

Comment 6

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 7

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

The product::component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit auto_nag documentation.

Comment 8

[Honza Bambas (:mayhemer)]

(In reply to Valentin Gosu [:valentin] (he/him) from comment #5)

2. trying a PAC script that only contains IP addresses.

Definitely not, if the proxy is a secure proxy we connect via TLS, which in the example definitely was one (HTTPS).

Comment 9

[Yegor]

(In reply to Valentin Gosu [:valentin] (he/him) from comment #5)

So, this is a bootstrapping problem.
Most likely we are trying to use the proxy for the DoH URL, but DNS doesn't yet work in mode 3, because TRR hasn't connected yet.

I can suggest

1. setting network.trr.bootstrapAddress to the IP address you get when resolving the URL in network.trr.uri
2. trying a PAC script that only contains IP addresses.

1. bootstrapAddress was already used at the time of the bug being filed.
2. As Honza suggested, this is not an option. It's a TLS proxy which requires valid TLS certs.

Comment 10

[Valentin Gosu [:valentin] (he/him)]

(In reply to Yegor from comment #9)

(In reply to Valentin Gosu [:valentin] (he/him) from comment #5)

So, this is a bootstrapping problem.
Most likely we are trying to use the proxy for the DoH URL, but DNS doesn't yet work in mode 3, because TRR hasn't connected yet.

I can suggest

1. setting network.trr.bootstrapAddress to the IP address you get when resolving the URL in network.trr.uri
2. trying a PAC script that only contains IP addresses.

1. bootstrapAddress was already used at the time of the bug being filed.
2. As Honza suggested, this is not an option. It's a TLS proxy which requires valid TLS certs.

Where is the PAC script loaded from?
Could you help us with some logs? https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging
Set the module list/ MOZ_LOG to timestamp,sync,nsHttp:5,cache2:5,nsSocketTransport:5,nsHostResolver:5
It's best to start with a new profile, and set all the prefs as you normally would.

Thanks assisting us with debugging this.

Comment 11

[Yegor]

The Pac file was loaded via "Network Settings" -> Automatic proxy configuration URL

Can just load this Pac file into the box: https://gist.githubusercontent.com/yegors/5df3ddbf95cd88a17f930b4857b6fc80/raw/bb5d761245f0aad6432adc7d91bd514cde967aa6/gistfile1.txt

The same issue occurs with the Firefox Private Network extension, once you enable DoH in trr.mode = 3.

I won't have time to test this in the next several days, but the issue is easily reproducible given the steps above.