mozilla / policy-templates

Policy Templates for Firefox
Mozilla Public License 2.0
1.15k stars 415 forks source link

Firefox Proxy GPO Issue: SOCKS Host Configuration Inherited from HTTP Proxy Despite Being Disabled #1150

Closed ahmed-dabouni closed 2 months ago

ahmed-dabouni commented 2 months ago

Hi @mkaply !

First of all, I want to thank you for all your efforts in developing the Firefox GPOs; they are incredibly useful.

I’m encountering a potential bug related to setting proxy configurations via GPOs. I have configured the proxy policies as shown in the first screenshot:

Screenshot1

However, as shown in the second screenshot of Firefox's proxy settings, despite the "SOCKS Host" policy being set to "Disabled," the SOCKS field inherits the same IP address as the HTTP Proxy. This seems to happen due to the "Use HTTP proxy for HTTPS" option being checked.

Screenshot2

Here’s the detailed issue:

Conclusion: The "Use HTTP proxy for HTTPS" setting appears to be the root cause of the issue. When enabled, it incorrectly populates the SOCKS Host field with the same IP and port as the HTTP Proxy, despite the SOCKS Host policy being disabled. When this setting is disabled or not configured, the HTTPS Proxy does not populate in Firefox, and neither does the SOCKS Host field, which aligns with what we need as we intend to keep SOCKS Host empty.

enriluis commented 2 months ago

This issue happen to me today. i notice the error because my internet user's browser do not load web whatsapp qr code, them i research and notice this setting enabled after setting Mozilla Firefox proxy GPO, thanks for details.

ahmed-dabouni commented 2 months ago

Hi @enriluis, I found a workaround. Set all Proxy Policies to "Not Configured" and manage them through the "Preferences" Policy using the following JSON content:

{
  "network.proxy.http": {"Value": "123.123.123.123", "Status": "locked"},
  "network.proxy.http_port": {"Value": 80, "Status": "locked"},
  "network.proxy.ssl": {"Value": "123.123.123.123", "Status": "locked"},
  "network.proxy.ssl_port": {"Value": 80, "Status": "locked"},
  "network.proxy.share_proxy_settings": {"Value": true, "Status": "locked"},
  "network.proxy.socks": {"Value": "", "Status": "locked"},
  "network.proxy.socks_port": {"Type": "number", "Value": 0, "Status": "locked"},
  "network.proxy.type": {"Type": "number", "Value": 1, "Status": "locked"}
}

This resolves the issue.

mkaply commented 2 months ago

Obviously this is a workaround, but I do want to fix this :)

mkaply commented 2 months ago

I'm going to close this as it's being fixed in bugzilla.

https://bugzilla.mozilla.org/show_bug.cgi?id=1919318

I'll try to get this into the next ESR/release.

enriluis commented 2 months ago

thanks!

ahmed-dabouni commented 2 weeks ago

@mkaply

Hello,

This issue still persists. When the "Use HTTP Proxy for HTTPS" policy is enabled, it sets "UseHTTPProxyForAllProtocols" to "true" in about:policies. This unintentionally causes the HTTP proxy to apply to SOCKS as well. Could we reopen this ticket to address this?

Thank you

mkaply commented 2 weeks ago

What version of Firefox?

That code was removed and we only set the SSL proxy

https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/helpers/ProxyPolicies.sys.mjs#111

Here is the patch

https://phabricator.services.mozilla.com/D222497

ahmed-dabouni commented 2 weeks ago

What version of Firefox?

That code was removed and we only set the SSL proxy

https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/helpers/ProxyPolicies.sys.mjs#111

Here is the patch

https://phabricator.services.mozilla.com/D222497

We are currently using Firefox version 127.0.1 and the latest Firefox Policy release (6.4).

ahmed-dabouni commented 2 weeks ago

What version of Firefox?

That code was removed and we only set the SSL proxy

https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/helpers/ProxyPolicies.sys.mjs#111

Here is the patch

https://phabricator.services.mozilla.com/D222497

Apologies, the issue was indeed with the version. I upgraded Firefox to version 132.0.1, and now the policy works as expected. Thank you for the fix!