Open Bug 536093 Opened 15 years ago Updated 4 years ago

DNS leakage socks

Categories

(Core :: Networking, defect, P5)

x86
Linux
defect

Tracking

()

People

(Reporter: ericjung, Unassigned)

Details

(Whiteboard: [necko-backlog])

Attachments

(2 files)

Note: this works in Firefox 3.0.x but not 3.5 and above. When implementing nsIProtocolProxyFilter::applyFilter() and returning: Cc["@mozilla.org/network/protocol-proxy-service;1"] .getService(Ci.nsIProtocolProxyService).newProxyInfo("socks5", myhost, myport, Ci.nsIProxyInfo.TRANSPARENT_PROXY_RESOLVES_HOST, 0, null) the 4th argument -- Ci.nsIProxyInfo.TRANSPARENT_PROXY_RESOLVES_HOST -- is ignored. This has no relation to the value of the network.proxy.socks_remote_dns preference. Why is this important? Because remote DNS lookups cannot be performed with Firefox 3.5+ and FoxyProxy, one of the top 25 Firefox addons. Using Wireshark with the filter "dns", you can see the different behaviors when switching between Firefox 3.0.x and Firefox 3.5+ (including nightlies).
I'm attaching a minimal test case, Bug536093.xpi. Steps to use: 1. Start a SOCKS5 server through a remote shell: ssh user@server.com -D 1080 where server.com is any remote host. You can now access the SOCKS server at localhost:1080. 2. Start wireshark (On linux, it needs sudo privileges). Apply the filter "dns" to see only DNS-related data. Alternatively, apply the filer "tcp.port==1080" or "socks" if you prefer to see the full SOCKS handshaking and other data. "tcp==1080" will show you all TCP data including SOCKS, while "socks" will show you only SOCKS-related data. 3. To witness the correct behavior (remote DNS lookups), install Bug536093.xpi in Firefox 3.0.x. Open the options dialog with Ctrl+F3 (Cmd+F3 on OS/X). Type "localhost" and "1080" in the hostname and port fields. Check TRANSPARENT_PROXY_RESOLVES_HOST and select SOCKS version 5. (See attached screenshot), Click OK. 4. Navigate to any URL; e.g., http://www.mozilla.org. In stdout, you'll see the addon outputting, "Using proxy localhost:1080 (SOCKS version 5) with host resolving DNS". In wireshark, you won't see any DNS lookups for mozilla.org. In fact, if you're using the "dns" wireshark filter and you don't have any other processes using the network, you won't see any activity in wireshark at all. 3. To witness the *incorrect* behavior (DNS lookups performed locally), install Bug536093.xpi in Firefox 3.5 or above (including nightlies). Open the options dialog with Ctrl+F3 (Cmd+F3 on OS/X). Type "localhost" and "1080" in the hostname and port fields. Check TRANSPARENT_PROXY_RESOLVES_HOST and select SOCKS version 5. (See attached screenshot), Click OK. 4. Navigate to any URL; e.g., http://www.mozilla.org. In stdout, you'll see the addon outputting, "Using proxy localhost:1080 (SOCKS version 5) with host resolving DNS". But in wireshark, you will see DNS lookups for mozilla.org on the local machine.
Attached image screenshot of minimal test case's UI (deleted) —
Summary: TRANSPARENT_PROXY_RESOLVES_HOST ignored → DNS leakage
Version: unspecified → Trunk
Summary: DNS leakage → DNS leakage socks
Whiteboard: [necko-backlog]
Priority: -- → P1
Priority: P1 → P3

Bulk-downgrade of unassigned, >=3 years untouched DOM/Storage bug's priority.

If you have reason to believe this is wrong, please write a comment and ni :jstutte.

Severity: major → S4
Priority: P3 → P5
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: