netwerk/base/nsProtocolProxyService.cpp

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim:set ts=4 sw=2 sts=2 et: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "mozilla/ArrayUtils.h"
   8 #include "mozilla/Attributes.h"
   9 #include "mozilla/AutoRestore.h"
  10
  11 #include "nsProtocolProxyService.h"
  12 #include "nsProxyInfo.h"
  13 #include "nsIClassInfoImpl.h"
  14 #include "nsIIOService.h"
  15 #include "nsIObserverService.h"
  16 #include "nsIProtocolHandler.h"
  17 #include "nsIProtocolProxyCallback.h"
  18 #include "nsIChannel.h"
  19 #include "nsICancelable.h"
  20 #include "nsIDNSService.h"
  21 #include "nsPIDNSService.h"
  22 #include "nsIPrefBranch.h"
  23 #include "nsIPrefService.h"
  24 #include "nsContentUtils.h"
  25 #include "nsCRT.h"
  26 #include "nsThreadUtils.h"
  27 #include "nsQueryObject.h"
  28 #include "nsSOCKSIOLayer.h"
  29 #include "nsString.h"
  30 #include "nsNetUtil.h"
  31 #include "nsNetCID.h"
  32 #include "plstr.h"
  33 #include "prnetdb.h"
  34 #include "nsPACMan.h"
  35 #include "nsProxyRelease.h"
  36 #include "mozilla/Mutex.h"
  37 #include "mozilla/CondVar.h"
  38 #include "nsISystemProxySettings.h"
  39 #include "nsINetworkLinkService.h"
  40 #include "nsIHttpChannelInternal.h"
  41 #include "mozilla/dom/nsMixedContentBlocker.h"
  42 #include "mozilla/Logging.h"
  43 #include "mozilla/StaticPrefs_network.h"
  44 #include "mozilla/Tokenizer.h"
  45 #include "mozilla/Unused.h"
  46 #include "mozilla/StaticPrefs_network.h"
  47
  48 //----------------------------------------------------------------------------
  49
  50 namespace mozilla {
  51 namespace net {
  52
  53 extern const char kProxyType_HTTP[];
  54 extern const char kProxyType_HTTPS[];
  55 extern const char kProxyType_SOCKS[];
  56 extern const char kProxyType_SOCKS4[];
  57 extern const char kProxyType_SOCKS5[];
  58 extern const char kProxyType_DIRECT[];
  59
  60 #undef LOG
  61 #define LOG(args) MOZ_LOG(gProxyLog, LogLevel::Debug, args)
  62
  63 //----------------------------------------------------------------------------
  64
  65 #define PROXY_PREF_BRANCH "network.proxy"
  66 #define PROXY_PREF(x) PROXY_PREF_BRANCH "." x
  67
  68 //----------------------------------------------------------------------------
  69
  70 // This structure is intended to be allocated on the stack
  71 struct nsProtocolInfo {
  72   nsAutoCString scheme;
  73   uint32_t flags = 0;
  74   int32_t defaultPort = 0;
  75 };
  76
  77 //----------------------------------------------------------------------------
  78
  79 // Return the channel's proxy URI, or if it doesn't exist, the
  80 // channel's main URI.
  81 static nsresult GetProxyURI(nsIChannel* channel, nsIURI** aOut) {
  82   nsresult rv = NS_OK;
  83   nsCOMPtr<nsIURI> proxyURI;
  84   nsCOMPtr<nsIHttpChannelInternal> httpChannel(do_QueryInterface(channel));
  85   if (httpChannel) {
  86     rv = httpChannel->GetProxyURI(getter_AddRefs(proxyURI));
  87   }
  88   if (!proxyURI) {
  89     rv = channel->GetURI(getter_AddRefs(proxyURI));
  90   }
  91   if (NS_FAILED(rv)) {
  92     return rv;
  93   }
  94   proxyURI.forget(aOut);
  95   return NS_OK;
  96 }
  97
  98 //-----------------------------------------------------------------------------
  99
 100 nsProtocolProxyService::FilterLink::FilterLink(uint32_t p,
 101                                                nsIProtocolProxyFilter* f)
 102     : position(p), filter(f), channelFilter(nullptr) {
 103   LOG(("nsProtocolProxyService::FilterLink::FilterLink %p, filter=%p", this,
 104        f));
 105 }
 106 nsProtocolProxyService::FilterLink::FilterLink(
 107     uint32_t p, nsIProtocolProxyChannelFilter* cf)
 108     : position(p), filter(nullptr), channelFilter(cf) {
 109   LOG(("nsProtocolProxyService::FilterLink::FilterLink %p, channel-filter=%p",
 110        this, cf));
 111 }
 112
 113 nsProtocolProxyService::FilterLink::~FilterLink() {
 114   LOG(("nsProtocolProxyService::FilterLink::~FilterLink %p", this));
 115 }
 116
 117 //-----------------------------------------------------------------------------
 118
 119 // The nsPACManCallback portion of this implementation should be run
 120 // on the main thread - so call nsPACMan::AsyncGetProxyForURI() with
 121 // a true mainThreadResponse parameter.
 122 class nsAsyncResolveRequest final : public nsIRunnable,
 123                                     public nsPACManCallback,
 124                                     public nsICancelable {
 125  public:
 126   NS_DECL_THREADSAFE_ISUPPORTS
 127
 128   nsAsyncResolveRequest(nsProtocolProxyService* pps, nsIChannel* channel,
 129                         uint32_t aResolveFlags,
 130                         nsIProtocolProxyCallback* callback)
 131       : mResolveFlags(aResolveFlags),
 132         mPPS(pps),
 133         mXPComPPS(pps),
 134         mChannel(channel),
 135         mCallback(callback) {
 136     NS_ASSERTION(mCallback, "null callback");
 137   }
 138
 139  private:
 140   ~nsAsyncResolveRequest() {
 141     if (!NS_IsMainThread()) {
 142       // these xpcom pointers might need to be proxied back to the
 143       // main thread to delete safely, but if this request had its
 144       // callbacks called normally they will all be null and this is a nop
 145
 146       if (mChannel) {
 147         NS_ReleaseOnMainThread("nsAsyncResolveRequest::mChannel",
 148                                mChannel.forget());
 149       }
 150
 151       if (mCallback) {
 152         NS_ReleaseOnMainThread("nsAsyncResolveRequest::mCallback",
 153                                mCallback.forget());
 154       }
 155
 156       if (mProxyInfo) {
 157         NS_ReleaseOnMainThread("nsAsyncResolveRequest::mProxyInfo",
 158                                mProxyInfo.forget());
 159       }
 160
 161       if (mXPComPPS) {
 162         NS_ReleaseOnMainThread("nsAsyncResolveRequest::mXPComPPS",
 163                                mXPComPPS.forget());
 164       }
 165     }
 166   }
 167
 168   // Helper class to loop over all registered asynchronous filters.
 169   // There is a cycle between nsAsyncResolveRequest and this class that
 170   // is broken after the last filter has called back on this object.
 171   class AsyncApplyFilters final : public nsIProxyProtocolFilterResult,
 172                                   public nsIRunnable,
 173                                   public nsICancelable {
 174     // The reference counter is thread-safe, but the processing logic is
 175     // considered single thread only.  We want the counter be thread safe,
 176     // since this class can be released on a background thread.
 177     NS_DECL_THREADSAFE_ISUPPORTS
 178     NS_DECL_NSIPROXYPROTOCOLFILTERRESULT
 179     NS_DECL_NSIRUNNABLE
 180     NS_DECL_NSICANCELABLE
 181
 182     using Callback =
 183         std::function<nsresult(nsAsyncResolveRequest*, nsIProxyInfo*, bool)>;
 184
 185     explicit AsyncApplyFilters(nsProtocolInfo& aInfo,
 186                                Callback const& aCallback);
 187     // This method starts the processing or filters.  If all of them
 188     // answer synchronously (call back from within applyFilters) this method
 189     // will return immediately and the returning result will carry return
 190     // result of the callback given in constructor.
 191     // This method is looping the registered filters (that have been copied
 192     // locally) as long as an answer from a filter is obtained synchronously.
 193     // Note that filters are processed serially to let them build a list
 194     // of proxy info.
 195     nsresult AsyncProcess(nsAsyncResolveRequest* aRequest);
 196
 197    private:
 198     using FilterLink = nsProtocolProxyService::FilterLink;
 199
 200     virtual ~AsyncApplyFilters();
 201     // Processes the next filter and loops until a filter is successfully
 202     // called on or it has called back to us.
 203     nsresult ProcessNextFilter();
 204     // Called after the last filter has been processed (=called back or failed
 205     // to be called on)
 206     nsresult Finish();
 207
 208     nsProtocolInfo mInfo;
 209     // This is nullified before we call back on the request or when
 210     // Cancel() on this object has been called to break the cycle
 211     // and signal to stop.
 212     RefPtr<nsAsyncResolveRequest> mRequest;
 213     Callback mCallback;
 214     // A shallow snapshot of filters as they were registered at the moment
 215     // we started to process filters for the given resolve request.
 216     nsTArray<RefPtr<FilterLink>> mFiltersCopy;
 217
 218     nsTArray<RefPtr<FilterLink>>::index_type mNextFilterIndex;
 219     // true when we are calling ProcessNextFilter() from inside AsyncProcess(),
 220     // false otherwise.
 221     bool mProcessingInLoop;
 222     // true after a filter called back to us with a result, dropped to false
 223     // just before we call a filter.
 224     bool mFilterCalledBack;
 225
 226     // This keeps the initial value we pass to the first filter in line and also
 227     // collects the result from each filter call.
 228     nsCOMPtr<nsIProxyInfo> mProxyInfo;
 229
 230     // The logic is written as non-thread safe, assert single-thread usage.
 231     nsCOMPtr<nsISerialEventTarget> mProcessingThread;
 232   };
 233
 234   void EnsureResolveFlagsMatch() {
 235     nsCOMPtr<nsProxyInfo> pi = do_QueryInterface(mProxyInfo);
 236     if (!pi || pi->ResolveFlags() == mResolveFlags) {
 237       return;
 238     }
 239
 240     nsCOMPtr<nsIProxyInfo> proxyInfo =
 241         pi->CloneProxyInfoWithNewResolveFlags(mResolveFlags);
 242     mProxyInfo.swap(proxyInfo);
 243   }
 244
 245  public:
 246   nsresult ProcessLocally(nsProtocolInfo& info, nsIProxyInfo* pi,
 247                           bool isSyncOK) {
 248     SetResult(NS_OK, pi);
 249
 250     auto consumeFiltersResult = [isSyncOK](nsAsyncResolveRequest* ctx,
 251                                            nsIProxyInfo* pi,
 252                                            bool aCalledAsync) -> nsresult {
 253       ctx->SetResult(NS_OK, pi);
 254       if (isSyncOK || aCalledAsync) {
 255         ctx->Run();
 256         return NS_OK;
 257       }
 258
 259       return ctx->DispatchCallback();
 260     };
 261
 262     mAsyncFilterApplier = new AsyncApplyFilters(info, consumeFiltersResult);
 263     // may call consumeFiltersResult() directly
 264     return mAsyncFilterApplier->AsyncProcess(this);
 265   }
 266
 267   void SetResult(nsresult status, nsIProxyInfo* pi) {
 268     mStatus = status;
 269     mProxyInfo = pi;
 270   }
 271
 272   NS_IMETHOD Run() override {
 273     if (mCallback) DoCallback();
 274     return NS_OK;
 275   }
 276
 277   NS_IMETHOD Cancel(nsresult reason) override {
 278     NS_ENSURE_ARG(NS_FAILED(reason));
 279
 280     if (mAsyncFilterApplier) {
 281       mAsyncFilterApplier->Cancel(reason);
 282     }
 283
 284     // If we've already called DoCallback then, nothing more to do.
 285     if (!mCallback) return NS_OK;
 286
 287     SetResult(reason, nullptr);
 288     return DispatchCallback();
 289   }
 290
 291   nsresult DispatchCallback() {
 292     if (mDispatched) {  // Only need to dispatch once
 293       return NS_OK;
 294     }
 295
 296     nsresult rv = NS_DispatchToCurrentThread(this);
 297     if (NS_FAILED(rv)) {
 298       NS_WARNING("unable to dispatch callback event");
 299     } else {
 300       mDispatched = true;
 301       return NS_OK;
 302     }
 303
 304     mCallback = nullptr;  // break possible reference cycle
 305     return rv;
 306   }
 307
 308  private:
 309   // Called asynchronously, so we do not need to post another PLEvent
 310   // before calling DoCallback.
 311   void OnQueryComplete(nsresult status, const nsACString& pacString,
 312                        const nsACString& newPACURL) override {
 313     // If we've already called DoCallback then, nothing more to do.
 314     if (!mCallback) return;
 315
 316     // Provided we haven't been canceled...
 317     if (mStatus == NS_OK) {
 318       mStatus = status;
 319       mPACString = pacString;
 320       mPACURL = newPACURL;
 321     }
 322
 323     // In the cancelation case, we may still have another PLEvent in
 324     // the queue that wants to call DoCallback.  No need to wait for
 325     // it, just run the callback now.
 326     DoCallback();
 327   }
 328
 329   void DoCallback() {
 330     bool pacAvailable = true;
 331     if (mStatus == NS_ERROR_NOT_AVAILABLE && !mProxyInfo) {
 332       // If the PAC service is not avail (e.g. failed pac load
 333       // or shutdown) then we will be going direct. Make that
 334       // mapping now so that any filters are still applied.
 335       mPACString = "DIRECT;"_ns;
 336       mStatus = NS_OK;
 337
 338       LOG(("pac not available, use DIRECT\n"));
 339       pacAvailable = false;
 340     }
 341
 342     // Generate proxy info from the PAC string if appropriate
 343     if (NS_SUCCEEDED(mStatus) && !mProxyInfo && !mPACString.IsEmpty()) {
 344       mPPS->ProcessPACString(mPACString, mResolveFlags,
 345                              getter_AddRefs(mProxyInfo));
 346       nsCOMPtr<nsIURI> proxyURI;
 347       GetProxyURI(mChannel, getter_AddRefs(proxyURI));
 348
 349       // Now apply proxy filters
 350       nsProtocolInfo info;
 351       mStatus = mPPS->GetProtocolInfo(proxyURI, &info);
 352
 353       auto consumeFiltersResult = [pacAvailable](nsAsyncResolveRequest* self,
 354                                                  nsIProxyInfo* pi,
 355                                                  bool async) -> nsresult {
 356         LOG(("DoCallback::consumeFiltersResult this=%p, pi=%p, async=%d", self,
 357              pi, async));
 358
 359         self->mProxyInfo = pi;
 360
 361         if (pacAvailable) {
 362           // if !pacAvailable, it was already logged above
 363           LOG(("pac thread callback %s\n", self->mPACString.get()));
 364         }
 365
 366         if (NS_SUCCEEDED(self->mStatus)) {
 367           self->mPPS->MaybeDisableDNSPrefetch(self->mProxyInfo);
 368         }
 369
 370         self->EnsureResolveFlagsMatch();
 371         self->mCallback->OnProxyAvailable(self, self->mChannel,
 372                                           self->mProxyInfo, self->mStatus);
 373
 374         return NS_OK;
 375       };
 376
 377       if (NS_SUCCEEDED(mStatus)) {
 378         mAsyncFilterApplier = new AsyncApplyFilters(info, consumeFiltersResult);
 379         // This may call consumeFiltersResult() directly.
 380         mAsyncFilterApplier->AsyncProcess(this);
 381         return;
 382       }
 383
 384       consumeFiltersResult(this, nullptr, false);
 385     } else if (NS_SUCCEEDED(mStatus) && !mPACURL.IsEmpty()) {
 386       LOG(("pac thread callback indicates new pac file load\n"));
 387
 388       nsCOMPtr<nsIURI> proxyURI;
 389       GetProxyURI(mChannel, getter_AddRefs(proxyURI));
 390
 391       // trigger load of new pac url
 392       nsresult rv = mPPS->ConfigureFromPAC(mPACURL, false);
 393       if (NS_SUCCEEDED(rv)) {
 394         // now that the load is triggered, we can resubmit the query
 395         RefPtr<nsAsyncResolveRequest> newRequest =
 396             new nsAsyncResolveRequest(mPPS, mChannel, mResolveFlags, mCallback);
 397         rv = mPPS->mPACMan->AsyncGetProxyForURI(proxyURI, newRequest,
 398                                                 mResolveFlags, true);
 399       }
 400
 401       if (NS_FAILED(rv)) {
 402         mCallback->OnProxyAvailable(this, mChannel, nullptr, rv);
 403       }
 404
 405       // do not call onproxyavailable() in SUCCESS case - the newRequest will
 406       // take care of that
 407     } else {
 408       LOG(("pac thread callback did not provide information %" PRIX32 "\n",
 409            static_cast<uint32_t>(mStatus)));
 410       if (NS_SUCCEEDED(mStatus)) mPPS->MaybeDisableDNSPrefetch(mProxyInfo);
 411       EnsureResolveFlagsMatch();
 412       mCallback->OnProxyAvailable(this, mChannel, mProxyInfo, mStatus);
 413     }
 414
 415     // We are on the main thread now and don't need these any more so
 416     // release them to avoid having to proxy them back to the main thread
 417     // in the dtor
 418     mCallback = nullptr;  // in case the callback holds an owning ref to us
 419     mPPS = nullptr;
 420     mXPComPPS = nullptr;
 421     mChannel = nullptr;
 422     mProxyInfo = nullptr;
 423   }
 424
 425  private:
 426   nsresult mStatus{NS_OK};
 427   nsCString mPACString;
 428   nsCString mPACURL;
 429   bool mDispatched{false};
 430   uint32_t mResolveFlags;
 431
 432   nsProtocolProxyService* mPPS;
 433   nsCOMPtr<nsIProtocolProxyService> mXPComPPS;
 434   nsCOMPtr<nsIChannel> mChannel;
 435   nsCOMPtr<nsIProtocolProxyCallback> mCallback;
 436   nsCOMPtr<nsIProxyInfo> mProxyInfo;
 437
 438   RefPtr<AsyncApplyFilters> mAsyncFilterApplier;
 439 };
 440
 441 NS_IMPL_ISUPPORTS(nsAsyncResolveRequest, nsICancelable, nsIRunnable)
 442
 443 NS_IMPL_ISUPPORTS(nsAsyncResolveRequest::AsyncApplyFilters,
 444                   nsIProxyProtocolFilterResult, nsICancelable, nsIRunnable)
 445
 446 nsAsyncResolveRequest::AsyncApplyFilters::AsyncApplyFilters(
 447     nsProtocolInfo& aInfo, Callback const& aCallback)
 448     : mInfo(aInfo),
 449       mCallback(aCallback),
 450       mNextFilterIndex(0),
 451       mProcessingInLoop(false),
 452       mFilterCalledBack(false) {
 453   LOG(("AsyncApplyFilters %p", this));
 454 }
 455
 456 nsAsyncResolveRequest::AsyncApplyFilters::~AsyncApplyFilters() {
 457   LOG(("~AsyncApplyFilters %p", this));
 458
 459   MOZ_ASSERT(!mRequest);
 460   MOZ_ASSERT(!mProxyInfo);
 461   MOZ_ASSERT(!mFiltersCopy.Length());
 462 }
 463
 464 nsresult nsAsyncResolveRequest::AsyncApplyFilters::AsyncProcess(
 465     nsAsyncResolveRequest* aRequest) {
 466   LOG(("AsyncApplyFilters::AsyncProcess %p for req %p", this, aRequest));
 467
 468   MOZ_ASSERT(!mRequest, "AsyncApplyFilters started more than once!");
 469
 470   if (!(mInfo.flags & nsIProtocolHandler::ALLOWS_PROXY)) {
 471     // Calling the callback directly (not via Finish()) since we
 472     // don't want to prune.
 473     return mCallback(aRequest, aRequest->mProxyInfo, false);
 474   }
 475
 476   mProcessingThread = NS_GetCurrentThread();
 477
 478   mRequest = aRequest;
 479   mProxyInfo = aRequest->mProxyInfo;
 480
 481   aRequest->mPPS->CopyFilters(mFiltersCopy);
 482
 483   // We want to give filters a chance to process in a single loop to prevent
 484   // any current-thread dispatch delays when those are not needed.
 485   // This code is rather "loopy" than "recursive" to prevent long stack traces.
 486   do {
 487     MOZ_ASSERT(!mProcessingInLoop);
 488
 489     mozilla::AutoRestore<bool> restore(mProcessingInLoop);
 490     mProcessingInLoop = true;
 491
 492     nsresult rv = ProcessNextFilter();
 493     if (NS_FAILED(rv)) {
 494       return rv;
 495     }
 496   } while (mFilterCalledBack);
 497
 498   return NS_OK;
 499 }
 500
 501 nsresult nsAsyncResolveRequest::AsyncApplyFilters::ProcessNextFilter() {
 502   LOG(("AsyncApplyFilters::ProcessNextFilter %p ENTER pi=%p", this,
 503        mProxyInfo.get()));
 504
 505   RefPtr<FilterLink> filter;
 506   do {
 507     mFilterCalledBack = false;
 508
 509     if (!mRequest) {
 510       // We got canceled
 511       LOG(("  canceled"));
 512       return NS_OK;  // should we let the consumer know?
 513     }
 514
 515     if (mNextFilterIndex == mFiltersCopy.Length()) {
 516       return Finish();
 517     }
 518
 519     filter = mFiltersCopy[mNextFilterIndex++];
 520
 521     // Loop until a call to a filter succeeded.  Other option is to recurse
 522     // but that would waste stack trace when a number of filters gets registered
 523     // and all from some reason tend to fail.
 524     // The !mFilterCalledBack part of the condition is there to protect us from
 525     // calling on another filter when the current one managed to call back and
 526     // then threw. We already have the result so take it and use it since
 527     // the next filter will be processed by the root loop or a call to
 528     // ProcessNextFilter has already been dispatched to this thread.
 529     LOG(("  calling filter %p pi=%p", filter.get(), mProxyInfo.get()));
 530   } while (!mRequest->mPPS->ApplyFilter(filter, mRequest->mChannel, mInfo,
 531                                         mProxyInfo, this) &&
 532            !mFilterCalledBack);
 533
 534   LOG(("AsyncApplyFilters::ProcessNextFilter %p LEAVE pi=%p", this,
 535        mProxyInfo.get()));
 536   return NS_OK;
 537 }
 538
 539 NS_IMETHODIMP
 540 nsAsyncResolveRequest::AsyncApplyFilters::OnProxyFilterResult(
 541     nsIProxyInfo* aProxyInfo) {
 542   LOG(("AsyncApplyFilters::OnProxyFilterResult %p pi=%p", this, aProxyInfo));
 543
 544   MOZ_ASSERT(mProcessingThread && mProcessingThread->IsOnCurrentThread());
 545   MOZ_ASSERT(!mFilterCalledBack);
 546
 547   if (mFilterCalledBack) {
 548     LOG(("  duplicate notification?"));
 549     return NS_OK;
 550   }
 551
 552   mFilterCalledBack = true;
 553
 554   if (!mRequest) {
 555     // We got canceled
 556     LOG(("  canceled"));
 557     return NS_OK;
 558   }
 559
 560   mProxyInfo = aProxyInfo;
 561
 562   if (mProcessingInLoop) {
 563     // No need to call/dispatch ProcessNextFilter(), we are in a control
 564     // loop that will do this for us and save recursion/dispatching.
 565     LOG(("  in a root loop"));
 566     return NS_OK;
 567   }
 568
 569   if (mNextFilterIndex == mFiltersCopy.Length()) {
 570     // We are done, all filters have been called on!
 571     Finish();
 572     return NS_OK;
 573   }
 574
 575   // Redispatch, since we don't want long stacks when filters respond
 576   // synchronously.
 577   LOG(("  redispatching"));
 578   NS_DispatchToCurrentThread(this);
 579   return NS_OK;
 580 }
 581
 582 NS_IMETHODIMP
 583 nsAsyncResolveRequest::AsyncApplyFilters::Run() {
 584   LOG(("AsyncApplyFilters::Run %p", this));
 585
 586   MOZ_ASSERT(mProcessingThread && mProcessingThread->IsOnCurrentThread());
 587
 588   ProcessNextFilter();
 589   return NS_OK;
 590 }
 591
 592 nsresult nsAsyncResolveRequest::AsyncApplyFilters::Finish() {
 593   LOG(("AsyncApplyFilters::Finish %p pi=%p", this, mProxyInfo.get()));
 594
 595   MOZ_ASSERT(mRequest);
 596
 597   mFiltersCopy.Clear();
 598
 599   RefPtr<nsAsyncResolveRequest> request;
 600   request.swap(mRequest);
 601
 602   nsCOMPtr<nsIProxyInfo> pi;
 603   pi.swap(mProxyInfo);
 604
 605   request->mPPS->PruneProxyInfo(mInfo, pi);
 606   return mCallback(request, pi, !mProcessingInLoop);
 607 }
 608
 609 NS_IMETHODIMP
 610 nsAsyncResolveRequest::AsyncApplyFilters::Cancel(nsresult reason) {
 611   LOG(("AsyncApplyFilters::Cancel %p", this));
 612
 613   MOZ_ASSERT(mProcessingThread && mProcessingThread->IsOnCurrentThread());
 614
 615   // This will be called only from inside the request, so don't call
 616   // its's callback.  Dropping the members means we simply break the cycle.
 617   mFiltersCopy.Clear();
 618   mProxyInfo = nullptr;
 619   mRequest = nullptr;
 620
 621   return NS_OK;
 622 }
 623
 624 // Bug 1366133: make GetPACURI off-main-thread since it may hang on Windows
 625 // platform
 626 class AsyncGetPACURIRequest final : public nsIRunnable {
 627  public:
 628   NS_DECL_THREADSAFE_ISUPPORTS
 629
 630   using CallbackFunc = nsresult (nsProtocolProxyService::*)(bool, bool,
 631                                                             nsresult,
 632                                                             const nsACString&);
 633
 634   AsyncGetPACURIRequest(nsProtocolProxyService* aService,
 635                         CallbackFunc aCallback,
 636                         nsISystemProxySettings* aSystemProxySettings,
 637                         bool aMainThreadOnly, bool aForceReload,
 638                         bool aResetPACThread)
 639       : mIsMainThreadOnly(aMainThreadOnly),
 640         mService(aService),
 641         mServiceHolder(do_QueryObject(aService)),
 642         mCallback(aCallback),
 643         mSystemProxySettings(aSystemProxySettings),
 644         mForceReload(aForceReload),
 645         mResetPACThread(aResetPACThread) {
 646     MOZ_ASSERT(NS_IsMainThread());
 647     Unused << mIsMainThreadOnly;
 648   }
 649
 650   NS_IMETHOD Run() override {
 651     MOZ_ASSERT(NS_IsMainThread() == mIsMainThreadOnly);
 652
 653     nsCString pacUri;
 654     nsresult rv = mSystemProxySettings->GetPACURI(pacUri);
 655
 656     nsCOMPtr<nsIRunnable> event =
 657         NewNonOwningCancelableRunnableMethod<bool, bool, nsresult, nsCString>(
 658             "AsyncGetPACURIRequestCallback", mService, mCallback, mForceReload,
 659             mResetPACThread, rv, pacUri);
 660
 661     return NS_DispatchToMainThread(event);
 662   }
 663
 664  private:
 665   ~AsyncGetPACURIRequest() {
 666     NS_ReleaseOnMainThread("AsyncGetPACURIRequest::mServiceHolder",
 667                            mServiceHolder.forget());
 668   }
 669
 670   bool mIsMainThreadOnly;
 671
 672   nsProtocolProxyService* mService;  // ref-count is hold by mServiceHolder
 673   nsCOMPtr<nsIProtocolProxyService2> mServiceHolder;
 674   CallbackFunc mCallback;
 675   nsCOMPtr<nsISystemProxySettings> mSystemProxySettings;
 676
 677   bool mForceReload;
 678   bool mResetPACThread;
 679 };
 680
 681 NS_IMPL_ISUPPORTS(AsyncGetPACURIRequest, nsIRunnable)
 682
 683 //----------------------------------------------------------------------------
 684
 685 //
 686 // apply mask to address (zeros out excluded bits).
 687 //
 688 // NOTE: we do the byte swapping here to minimize overall swapping.
 689 //
 690 static void proxy_MaskIPv6Addr(PRIPv6Addr& addr, uint16_t mask_len) {
 691   if (mask_len == 128) return;
 692
 693   if (mask_len > 96) {
 694     addr.pr_s6_addr32[3] =
 695         PR_htonl(PR_ntohl(addr.pr_s6_addr32[3]) & (~0uL << (128 - mask_len)));
 696   } else if (mask_len > 64) {
 697     addr.pr_s6_addr32[3] = 0;
 698     addr.pr_s6_addr32[2] =
 699         PR_htonl(PR_ntohl(addr.pr_s6_addr32[2]) & (~0uL << (96 - mask_len)));
 700   } else if (mask_len > 32) {
 701     addr.pr_s6_addr32[3] = 0;
 702     addr.pr_s6_addr32[2] = 0;
 703     addr.pr_s6_addr32[1] =
 704         PR_htonl(PR_ntohl(addr.pr_s6_addr32[1]) & (~0uL << (64 - mask_len)));
 705   } else {
 706     addr.pr_s6_addr32[3] = 0;
 707     addr.pr_s6_addr32[2] = 0;
 708     addr.pr_s6_addr32[1] = 0;
 709     addr.pr_s6_addr32[0] =
 710         PR_htonl(PR_ntohl(addr.pr_s6_addr32[0]) & (~0uL << (32 - mask_len)));
 711   }
 712 }
 713
 714 static void proxy_GetStringPref(nsIPrefBranch* aPrefBranch, const char* aPref,
 715                                 nsCString& aResult) {
 716   nsAutoCString temp;
 717   nsresult rv = aPrefBranch->GetCharPref(aPref, temp);
 718   if (NS_FAILED(rv)) {
 719     aResult.Truncate();
 720   } else {
 721     aResult.Assign(temp);
 722     // all of our string prefs are hostnames, so we should remove any
 723     // whitespace characters that the user might have unknowingly entered.
 724     aResult.StripWhitespace();
 725   }
 726 }
 727
 728 static void proxy_GetIntPref(nsIPrefBranch* aPrefBranch, const char* aPref,
 729                              int32_t& aResult) {
 730   int32_t temp;
 731   nsresult rv = aPrefBranch->GetIntPref(aPref, &temp);
 732   if (NS_FAILED(rv)) {
 733     aResult = -1;
 734   } else {
 735     aResult = temp;
 736   }
 737 }
 738
 739 static void proxy_GetBoolPref(nsIPrefBranch* aPrefBranch, const char* aPref,
 740                               bool& aResult) {
 741   bool temp;
 742   nsresult rv = aPrefBranch->GetBoolPref(aPref, &temp);
 743   if (NS_FAILED(rv)) {
 744     aResult = false;
 745   } else {
 746     aResult = temp;
 747   }
 748 }
 749
 750 //----------------------------------------------------------------------------
 751
 752 static const int32_t PROXYCONFIG_DIRECT4X = 3;
 753 static const int32_t PROXYCONFIG_COUNT = 6;
 754
 755 NS_IMPL_ADDREF(nsProtocolProxyService)
 756 NS_IMPL_RELEASE(nsProtocolProxyService)
 757 NS_IMPL_CLASSINFO(nsProtocolProxyService, nullptr, nsIClassInfo::SINGLETON,
 758                   NS_PROTOCOLPROXYSERVICE_CID)
 759
 760 // NS_IMPL_QUERY_INTERFACE_CI with the nsProtocolProxyService QI change
 761 NS_INTERFACE_MAP_BEGIN(nsProtocolProxyService)
 762   NS_INTERFACE_MAP_ENTRY(nsIProtocolProxyService)
 763   NS_INTERFACE_MAP_ENTRY(nsIProtocolProxyService2)
 764   NS_INTERFACE_MAP_ENTRY(nsIObserver)
 765   NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
 766   NS_INTERFACE_MAP_ENTRY(nsINamed)
 767   NS_INTERFACE_MAP_ENTRY_CONCRETE(nsProtocolProxyService)
 768   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIProtocolProxyService)
 769   NS_IMPL_QUERY_CLASSINFO(nsProtocolProxyService)
 770 NS_INTERFACE_MAP_END
 771
 772 NS_IMPL_CI_INTERFACE_GETTER(nsProtocolProxyService, nsIProtocolProxyService,
 773                             nsIProtocolProxyService2)
 774
 775 nsProtocolProxyService::nsProtocolProxyService() : mSessionStart(PR_Now()) {}
 776
 777 nsProtocolProxyService::~nsProtocolProxyService() {
 778   // These should have been cleaned up in our Observe method.
 779   NS_ASSERTION(mHostFiltersArray.Length() == 0 && mFilters.Length() == 0 &&
 780                    mPACMan == nullptr,
 781                "what happened to xpcom-shutdown?");
 782 }
 783
 784 // nsProtocolProxyService methods
 785 nsresult nsProtocolProxyService::Init() {
 786   // failure to access prefs is non-fatal
 787   nsCOMPtr<nsIPrefBranch> prefBranch = do_GetService(NS_PREFSERVICE_CONTRACTID);
 788   if (prefBranch) {
 789     // monitor proxy prefs
 790     prefBranch->AddObserver(PROXY_PREF_BRANCH, this, false);
 791
 792     // read all prefs
 793     PrefsChanged(prefBranch, nullptr);
 794   }
 795
 796   nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
 797   if (obs) {
 798     // register for shutdown notification so we can clean ourselves up
 799     // properly.
 800     obs->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, false);
 801     obs->AddObserver(this, NS_NETWORK_LINK_TOPIC, false);
 802   }
 803
 804   return NS_OK;
 805 }
 806
 807 // ReloadNetworkPAC() checks if there's a non-networked PAC in use then avoids
 808 // to call ReloadPAC()
 809 nsresult nsProtocolProxyService::ReloadNetworkPAC() {
 810   nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
 811   if (!prefs) {
 812     return NS_OK;
 813   }
 814
 815   int32_t type;
 816   nsresult rv = prefs->GetIntPref(PROXY_PREF("type"), &type);
 817   if (NS_FAILED(rv)) {
 818     return NS_OK;
 819   }
 820
 821   if (type == PROXYCONFIG_PAC) {
 822     nsAutoCString pacSpec;
 823     prefs->GetCharPref(PROXY_PREF("autoconfig_url"), pacSpec);
 824     if (!pacSpec.IsEmpty()) {
 825       nsCOMPtr<nsIURI> pacURI;
 826       rv = NS_NewURI(getter_AddRefs(pacURI), pacSpec);
 827       if (!NS_SUCCEEDED(rv)) {
 828         return rv;
 829       }
 830
 831       nsProtocolInfo pac;
 832       rv = GetProtocolInfo(pacURI, &pac);
 833       if (!NS_SUCCEEDED(rv)) {
 834         return rv;
 835       }
 836
 837       if (!pac.scheme.EqualsLiteral("file") &&
 838           !pac.scheme.EqualsLiteral("data")) {
 839         LOG((": received network changed event, reload PAC"));
 840         ReloadPAC();
 841       }
 842     }
 843   } else if ((type == PROXYCONFIG_WPAD) || (type == PROXYCONFIG_SYSTEM)) {
 844     ReloadPAC();
 845   }
 846
 847   return NS_OK;
 848 }
 849
 850 nsresult nsProtocolProxyService::AsyncConfigureFromPAC(bool aForceReload,
 851                                                        bool aResetPACThread) {
 852   MOZ_ASSERT(NS_IsMainThread());
 853
 854   bool mainThreadOnly;
 855   nsresult rv = mSystemProxySettings->GetMainThreadOnly(&mainThreadOnly);
 856   if (NS_WARN_IF(NS_FAILED(rv))) {
 857     return rv;
 858   }
 859
 860   nsCOMPtr<nsIRunnable> req = new AsyncGetPACURIRequest(
 861       this, &nsProtocolProxyService::OnAsyncGetPACURI, mSystemProxySettings,
 862       mainThreadOnly, aForceReload, aResetPACThread);
 863
 864   if (mainThreadOnly) {
 865     return req->Run();
 866   }
 867
 868   return NS_DispatchBackgroundTask(req.forget(),
 869                                    nsIEventTarget::DISPATCH_NORMAL);
 870 }
 871
 872 nsresult nsProtocolProxyService::OnAsyncGetPACURI(bool aForceReload,
 873                                                   bool aResetPACThread,
 874                                                   nsresult aResult,
 875                                                   const nsACString& aUri) {
 876   MOZ_ASSERT(NS_IsMainThread());
 877
 878   if (aResetPACThread) {
 879     ResetPACThread();
 880   }
 881
 882   if (NS_SUCCEEDED(aResult) && !aUri.IsEmpty()) {
 883     ConfigureFromPAC(PromiseFlatCString(aUri), aForceReload);
 884   }
 885
 886   return NS_OK;
 887 }
 888
 889 NS_IMETHODIMP
 890 nsProtocolProxyService::Observe(nsISupports* aSubject, const char* aTopic,
 891                                 const char16_t* aData) {
 892   if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
 893     mIsShutdown = true;
 894     // cleanup
 895     mHostFiltersArray.Clear();
 896     mFilters.Clear();
 897
 898     if (mPACMan) {
 899       mPACMan->Shutdown();
 900       mPACMan = nullptr;
 901     }
 902
 903     if (mReloadPACTimer) {
 904       mReloadPACTimer->Cancel();
 905       mReloadPACTimer = nullptr;
 906     }
 907
 908     nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
 909     if (obs) {
 910       obs->RemoveObserver(this, NS_NETWORK_LINK_TOPIC);
 911       obs->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
 912     }
 913
 914   } else if (strcmp(aTopic, NS_NETWORK_LINK_TOPIC) == 0) {
 915     nsCString converted = NS_ConvertUTF16toUTF8(aData);
 916     const char* state = converted.get();
 917     if (!strcmp(state, NS_NETWORK_LINK_DATA_CHANGED)) {
 918       uint32_t delay = StaticPrefs::network_proxy_reload_pac_delay();
 919       LOG(("nsProtocolProxyService::Observe call ReloadNetworkPAC() delay=%u",
 920            delay));
 921
 922       if (delay) {
 923         if (mReloadPACTimer) {
 924           mReloadPACTimer->Cancel();
 925           mReloadPACTimer = nullptr;
 926         }
 927         NS_NewTimerWithCallback(getter_AddRefs(mReloadPACTimer), this, delay,
 928                                 nsITimer::TYPE_ONE_SHOT);
 929       } else {
 930         ReloadNetworkPAC();
 931       }
 932     }
 933   } else {
 934     NS_ASSERTION(strcmp(aTopic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID) == 0,
 935                  "what is this random observer event?");
 936     nsCOMPtr<nsIPrefBranch> prefs = do_QueryInterface(aSubject);
 937     if (prefs) PrefsChanged(prefs, NS_LossyConvertUTF16toASCII(aData).get());
 938   }
 939   return NS_OK;
 940 }
 941
 942 NS_IMETHODIMP
 943 nsProtocolProxyService::Notify(nsITimer* aTimer) {
 944   MOZ_ASSERT(aTimer == mReloadPACTimer);
 945   ReloadNetworkPAC();
 946   return NS_OK;
 947 }
 948
 949 NS_IMETHODIMP
 950 nsProtocolProxyService::GetName(nsACString& aName) {
 951   aName.AssignLiteral("nsProtocolProxyService");
 952   return NS_OK;
 953 }
 954
 955 void nsProtocolProxyService::PrefsChanged(nsIPrefBranch* prefBranch,
 956                                           const char* pref) {
 957   nsresult rv = NS_OK;
 958   bool reloadPAC = false;
 959   nsAutoCString tempString;
 960
 961   if (!pref || !strcmp(pref, PROXY_PREF("type"))) {
 962     int32_t type = -1;
 963     rv = prefBranch->GetIntPref(PROXY_PREF("type"), &type);
 964     if (NS_SUCCEEDED(rv)) {
 965       // bug 115720 - for ns4.x backwards compatibility
 966       if (type == PROXYCONFIG_DIRECT4X) {
 967         type = PROXYCONFIG_DIRECT;
 968         // Reset the type so that the dialog looks correct, and we
 969         // don't have to handle this case everywhere else
 970         // I'm paranoid about a loop of some sort - only do this
 971         // if we're enumerating all prefs, and ignore any error
 972         if (!pref) prefBranch->SetIntPref(PROXY_PREF("type"), type);
 973       } else if (type >= PROXYCONFIG_COUNT) {
 974         LOG(("unknown proxy type: %" PRId32 "; assuming direct\n", type));
 975         type = PROXYCONFIG_DIRECT;
 976       }
 977       mProxyConfig = type;
 978       reloadPAC = true;
 979     }
 980
 981     if (mProxyConfig == PROXYCONFIG_SYSTEM) {
 982       mSystemProxySettings = do_GetService(NS_SYSTEMPROXYSETTINGS_CONTRACTID);
 983       if (!mSystemProxySettings) mProxyConfig = PROXYCONFIG_DIRECT;
 984       ResetPACThread();
 985     } else {
 986       if (mSystemProxySettings) {
 987         mSystemProxySettings = nullptr;
 988         ResetPACThread();
 989       }
 990     }
 991   }
 992
 993   if (!pref || !strcmp(pref, PROXY_PREF("http"))) {
 994     proxy_GetStringPref(prefBranch, PROXY_PREF("http"), mHTTPProxyHost);
 995   }
 996
 997   if (!pref || !strcmp(pref, PROXY_PREF("http_port"))) {
 998     proxy_GetIntPref(prefBranch, PROXY_PREF("http_port"), mHTTPProxyPort);
 999   }
1000
1001   if (!pref || !strcmp(pref, PROXY_PREF("ssl"))) {
1002     proxy_GetStringPref(prefBranch, PROXY_PREF("ssl"), mHTTPSProxyHost);
1003   }
1004
1005   if (!pref || !strcmp(pref, PROXY_PREF("ssl_port"))) {
1006     proxy_GetIntPref(prefBranch, PROXY_PREF("ssl_port"), mHTTPSProxyPort);
1007   }
1008
1009   if (!pref || !strcmp(pref, PROXY_PREF("socks"))) {
1010     proxy_GetStringPref(prefBranch, PROXY_PREF("socks"), mSOCKSProxyTarget);
1011   }
1012
1013   if (!pref || !strcmp(pref, PROXY_PREF("socks_port"))) {
1014     proxy_GetIntPref(prefBranch, PROXY_PREF("socks_port"), mSOCKSProxyPort);
1015   }
1016
1017   if (!pref || !strcmp(pref, PROXY_PREF("socks_version"))) {
1018     int32_t version;
1019     proxy_GetIntPref(prefBranch, PROXY_PREF("socks_version"), version);
1020     // make sure this preference value remains sane
1021     if (version == 5) {
1022       mSOCKSProxyVersion = 5;
1023     } else {
1024       mSOCKSProxyVersion = 4;
1025     }
1026   }
1027
1028   if (!pref || !strcmp(pref, PROXY_PREF("socks_remote_dns"))) {
1029     proxy_GetBoolPref(prefBranch, PROXY_PREF("socks_remote_dns"),
1030                       mSOCKSProxyRemoteDNS);
1031   }
1032
1033   if (!pref || !strcmp(pref, PROXY_PREF("proxy_over_tls"))) {
1034     proxy_GetBoolPref(prefBranch, PROXY_PREF("proxy_over_tls"), mProxyOverTLS);
1035   }
1036
1037   if (!pref || !strcmp(pref, PROXY_PREF("enable_wpad_over_dhcp"))) {
1038     proxy_GetBoolPref(prefBranch, PROXY_PREF("enable_wpad_over_dhcp"),
1039                       mWPADOverDHCPEnabled);
1040     reloadPAC = reloadPAC || mProxyConfig == PROXYCONFIG_WPAD;
1041   }
1042
1043   if (!pref || !strcmp(pref, PROXY_PREF("failover_timeout"))) {
1044     proxy_GetIntPref(prefBranch, PROXY_PREF("failover_timeout"),
1045                      mFailedProxyTimeout);
1046   }
1047
1048   if (!pref || !strcmp(pref, PROXY_PREF("no_proxies_on"))) {
1049     rv = prefBranch->GetCharPref(PROXY_PREF("no_proxies_on"), tempString);
1050     if (NS_SUCCEEDED(rv)) LoadHostFilters(tempString);
1051   }
1052
1053   // We're done if not using something that could give us a PAC URL
1054   // (PAC, WPAD or System)
1055   if (mProxyConfig != PROXYCONFIG_PAC && mProxyConfig != PROXYCONFIG_WPAD &&
1056       mProxyConfig != PROXYCONFIG_SYSTEM) {
1057     return;
1058   }
1059
1060   // OK, we need to reload the PAC file if:
1061   //  1) network.proxy.type changed, or
1062   //  2) network.proxy.autoconfig_url changed and PAC is configured
1063
1064   if (!pref || !strcmp(pref, PROXY_PREF("autoconfig_url"))) reloadPAC = true;
1065
1066   if (reloadPAC) {
1067     tempString.Truncate();
1068     if (mProxyConfig == PROXYCONFIG_PAC) {
1069       prefBranch->GetCharPref(PROXY_PREF("autoconfig_url"), tempString);
1070       if (mPACMan && !mPACMan->IsPACURI(tempString)) {
1071         LOG(("PAC Thread URI Changed - Reset Pac Thread"));
1072         ResetPACThread();
1073       }
1074     } else if (mProxyConfig == PROXYCONFIG_WPAD) {
1075       LOG(("Auto-detecting proxy - Reset Pac Thread"));
1076       ResetPACThread();
1077     } else if (mSystemProxySettings) {
1078       // Get System Proxy settings if available
1079       AsyncConfigureFromPAC(false, false);
1080     }
1081     if (!tempString.IsEmpty() || mProxyConfig == PROXYCONFIG_WPAD) {
1082       ConfigureFromPAC(tempString, false);
1083     }
1084   }
1085 }
1086
1087 bool nsProtocolProxyService::CanUseProxy(nsIURI* aURI, int32_t defaultPort) {
1088   int32_t port;
1089   nsAutoCString host;
1090
1091   nsresult rv = aURI->GetAsciiHost(host);
1092   if (NS_FAILED(rv) || host.IsEmpty()) return false;
1093
1094   rv = aURI->GetPort(&port);
1095   if (NS_FAILED(rv)) return false;
1096   if (port == -1) port = defaultPort;
1097
1098   PRNetAddr addr;
1099   bool is_ipaddr = (PR_StringToNetAddr(host.get(), &addr) == PR_SUCCESS);
1100
1101   PRIPv6Addr ipv6;
1102   if (is_ipaddr) {
1103     // convert parsed address to IPv6
1104     if (addr.raw.family == PR_AF_INET) {
1105       // convert to IPv4-mapped address
1106       PR_ConvertIPv4AddrToIPv6(addr.inet.ip, &ipv6);
1107     } else if (addr.raw.family == PR_AF_INET6) {
1108       // copy the address
1109       memcpy(&ipv6, &addr.ipv6.ip, sizeof(PRIPv6Addr));
1110     } else {
1111       NS_WARNING("unknown address family");
1112       return true;  // allow proxying
1113     }
1114   }
1115
1116   // Don't use proxy for local hosts (plain hostname, no dots)
1117   if ((!is_ipaddr && mFilterLocalHosts && !host.Contains('.')) ||
1118       // This method detects if we have network.proxy.allow_hijacking_localhost
1119       // pref enabled. If it's true then this method will always return false
1120       // otherwise it returns true if the host matches an address that's
1121       // hardcoded to the loopback address.
1122       (!StaticPrefs::network_proxy_allow_hijacking_localhost() &&
1123        nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackHost(host))) {
1124     LOG(("Not using proxy for this local host [%s]!\n", host.get()));
1125     return false;  // don't allow proxying
1126   }
1127
1128   int32_t index = -1;
1129   while (++index < int32_t(mHostFiltersArray.Length())) {
1130     const auto& hinfo = mHostFiltersArray[index];
1131
1132     if (is_ipaddr != hinfo->is_ipaddr) continue;
1133     if (hinfo->port && hinfo->port != port) continue;
1134
1135     if (is_ipaddr) {
1136       // generate masked version of target IPv6 address
1137       PRIPv6Addr masked;
1138       memcpy(&masked, &ipv6, sizeof(PRIPv6Addr));
1139       proxy_MaskIPv6Addr(masked, hinfo->ip.mask_len);
1140
1141       // check for a match
1142       if (memcmp(&masked, &hinfo->ip.addr, sizeof(PRIPv6Addr)) == 0) {
1143         return false;  // proxy disallowed
1144       }
1145     } else {
1146       uint32_t host_len = host.Length();
1147       uint32_t filter_host_len = hinfo->name.host_len;
1148
1149       if (host_len >= filter_host_len) {
1150         //
1151         // compare last |filter_host_len| bytes of target hostname.
1152         //
1153         const char* host_tail = host.get() + host_len - filter_host_len;
1154         if (!nsCRT::strncasecmp(host_tail, hinfo->name.host, filter_host_len)) {
1155           // If the tail of the host string matches the filter
1156
1157           if (filter_host_len > 0 && hinfo->name.host[0] == '.') {
1158             // If the filter was of the form .foo.bar.tld, all such
1159             // matches are correct
1160             return false;  // proxy disallowed
1161           }
1162
1163           // abc-def.example.org should not match def.example.org
1164           // however, *.def.example.org should match .def.example.org
1165           // We check that the filter doesn't start with a `.`. If it does,
1166           // then the strncasecmp above should suffice. If it doesn't,
1167           // then we should only consider it a match if the strncasecmp happened
1168           // at a subdomain boundary
1169           if (host_len > filter_host_len && *(host_tail - 1) == '.') {
1170             // If the host was something.foo.bar.tld and the filter
1171             // was foo.bar.tld, it's still a match.
1172             // the character right before the tail must be a
1173             // `.` for this to work
1174             return false;  // proxy disallowed
1175           }
1176
1177           if (host_len == filter_host_len) {
1178             // If the host and filter are of the same length,
1179             // they should match
1180             return false;  // proxy disallowed
1181           }
1182         }
1183       }
1184     }
1185   }
1186   return true;
1187 }
1188
1189 // kProxyType\* may be referred to externally in
1190 // nsProxyInfo in order to compare by string pointer
1191 const char kProxyType_HTTP[] = "http";
1192 const char kProxyType_HTTPS[] = "https";
1193 const char kProxyType_PROXY[] = "proxy";
1194 const char kProxyType_SOCKS[] = "socks";
1195 const char kProxyType_SOCKS4[] = "socks4";
1196 const char kProxyType_SOCKS5[] = "socks5";
1197 const char kProxyType_DIRECT[] = "direct";
1198
1199 const char* nsProtocolProxyService::ExtractProxyInfo(const char* start,
1200                                                      uint32_t aResolveFlags,
1201                                                      nsProxyInfo** result) {
1202   *result = nullptr;
1203   uint32_t flags = 0;
1204
1205   // see BNF in ProxyAutoConfig.h and notes in nsISystemProxySettings.idl
1206
1207   // find end of proxy info delimiter
1208   const char* end = start;
1209   while (*end && *end != ';') ++end;
1210
1211   // find end of proxy type delimiter
1212   const char* sp = start;
1213   while (sp < end && *sp != ' ' && *sp != '\t') ++sp;
1214
1215   uint32_t len = sp - start;
1216   const char* type = nullptr;
1217   switch (len) {
1218     case 4:
1219       if (nsCRT::strncasecmp(start, kProxyType_HTTP, 4) == 0) {
1220         type = kProxyType_HTTP;
1221       }
1222       break;
1223     case 5:
1224       if (nsCRT::strncasecmp(start, kProxyType_PROXY, 5) == 0) {
1225         type = kProxyType_HTTP;
1226       } else if (nsCRT::strncasecmp(start, kProxyType_SOCKS, 5) == 0) {
1227         type = kProxyType_SOCKS4;  // assume v4 for 4x compat
1228         if (StaticPrefs::network_proxy_default_pac_script_socks_version() ==
1229             5) {
1230           type = kProxyType_SOCKS;
1231         }
1232       } else if (nsCRT::strncasecmp(start, kProxyType_HTTPS, 5) == 0) {
1233         type = kProxyType_HTTPS;
1234       }
1235       break;
1236     case 6:
1237       if (nsCRT::strncasecmp(start, kProxyType_DIRECT, 6) == 0) {
1238         type = kProxyType_DIRECT;
1239       } else if (nsCRT::strncasecmp(start, kProxyType_SOCKS4, 6) == 0) {
1240         type = kProxyType_SOCKS4;
1241       } else if (nsCRT::strncasecmp(start, kProxyType_SOCKS5, 6) == 0) {
1242         // map "SOCKS5" to "socks" to match contract-id of registered
1243         // SOCKS-v5 socket provider.
1244         type = kProxyType_SOCKS;
1245       }
1246       break;
1247   }
1248   if (type) {
1249     int32_t port = -1;
1250
1251     // If it's a SOCKS5 proxy, do name resolution on the server side.
1252     // We could use this with SOCKS4a servers too, but they might not
1253     // support it.
1254     if (type == kProxyType_SOCKS || mSOCKSProxyRemoteDNS) {
1255       flags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
1256     }
1257
1258     // extract host:port
1259     start = sp;
1260     while ((*start == ' ' || *start == '\t') && start < end) start++;
1261
1262     // port defaults
1263     if (type == kProxyType_HTTP) {
1264       port = 80;
1265     } else if (type == kProxyType_HTTPS) {
1266       port = 443;
1267     } else {
1268       port = 1080;
1269     }
1270
1271     RefPtr<nsProxyInfo> pi = new nsProxyInfo();
1272     pi->mType = type;
1273     pi->mFlags = flags;
1274     pi->mResolveFlags = aResolveFlags;
1275     pi->mTimeout = mFailedProxyTimeout;
1276
1277     // www.foo.com:8080 and http://www.foo.com:8080
1278     nsDependentCSubstring maybeURL(start, end - start);
1279     nsCOMPtr<nsIURI> pacURI;
1280
1281     nsAutoCString urlHost;
1282     // First assume the scheme is present, e.g. http://www.example.com:8080
1283     if (NS_FAILED(NS_NewURI(getter_AddRefs(pacURI), maybeURL)) ||
1284         NS_FAILED(pacURI->GetAsciiHost(urlHost)) || urlHost.IsEmpty()) {
1285       // It isn't, assume www.example.com:8080
1286       maybeURL.Insert("http://", 0);
1287
1288       if (NS_SUCCEEDED(NS_NewURI(getter_AddRefs(pacURI), maybeURL))) {
1289         pacURI->GetAsciiHost(urlHost);
1290       }
1291     }
1292
1293     if (!urlHost.IsEmpty()) {
1294       pi->mHost = urlHost;
1295
1296       int32_t tPort;
1297       if (NS_SUCCEEDED(pacURI->GetPort(&tPort)) && tPort != -1) {
1298         port = tPort;
1299       }
1300       pi->mPort = port;
1301     }
1302
1303     pi.forget(result);
1304   }
1305
1306   while (*end == ';' || *end == ' ' || *end == '\t') ++end;
1307   return end;
1308 }
1309
1310 void nsProtocolProxyService::GetProxyKey(nsProxyInfo* pi, nsCString& key) {
1311   key.AssignASCII(pi->mType);
1312   if (!pi->mHost.IsEmpty()) {
1313     key.Append(' ');
1314     key.Append(pi->mHost);
1315     key.Append(':');
1316     key.AppendInt(pi->mPort);
1317   }
1318 }
1319
1320 uint32_t nsProtocolProxyService::SecondsSinceSessionStart() {
1321   PRTime now = PR_Now();
1322
1323   // get time elapsed since session start
1324   int64_t diff = now - mSessionStart;
1325
1326   // convert microseconds to seconds
1327   diff /= PR_USEC_PER_SEC;
1328
1329   // return converted 32 bit value
1330   return uint32_t(diff);
1331 }
1332
1333 void nsProtocolProxyService::EnableProxy(nsProxyInfo* pi) {
1334   nsAutoCString key;
1335   GetProxyKey(pi, key);
1336   mFailedProxies.Remove(key);
1337 }
1338
1339 void nsProtocolProxyService::DisableProxy(nsProxyInfo* pi) {
1340   nsAutoCString key;
1341   GetProxyKey(pi, key);
1342
1343   uint32_t dsec = SecondsSinceSessionStart();
1344
1345   // Add timeout to interval (this is the time when the proxy can
1346   // be tried again).
1347   dsec += pi->mTimeout;
1348
1349   // NOTE: The classic codebase would increase the timeout value
1350   //       incrementally each time a subsequent failure occurred.
1351   //       We could do the same, but it would require that we not
1352   //       remove proxy entries in IsProxyDisabled or otherwise
1353   //       change the way we are recording disabled proxies.
1354   //       Simpler is probably better for now, and at least the
1355   //       user can tune the timeout setting via preferences.
1356
1357   LOG(("DisableProxy %s %d\n", key.get(), dsec));
1358
1359   // If this fails, oh well... means we don't have enough memory
1360   // to remember the failed proxy.
1361   mFailedProxies.InsertOrUpdate(key, dsec);
1362 }
1363
1364 bool nsProtocolProxyService::IsProxyDisabled(nsProxyInfo* pi) {
1365   nsAutoCString key;
1366   GetProxyKey(pi, key);
1367
1368   uint32_t val;
1369   if (!mFailedProxies.Get(key, &val)) return false;
1370
1371   uint32_t dsec = SecondsSinceSessionStart();
1372
1373   // if time passed has exceeded interval, then try proxy again.
1374   if (dsec > val) {
1375     mFailedProxies.Remove(key);
1376     return false;
1377   }
1378
1379   return true;
1380 }
1381
1382 nsresult nsProtocolProxyService::SetupPACThread(
1383     nsISerialEventTarget* mainThreadEventTarget) {
1384   if (mIsShutdown) {
1385     return NS_ERROR_FAILURE;
1386   }
1387
1388   if (mPACMan) return NS_OK;
1389
1390   mPACMan = new nsPACMan(mainThreadEventTarget);
1391
1392   bool mainThreadOnly;
1393   nsresult rv;
1394   if (mSystemProxySettings &&
1395       NS_SUCCEEDED(mSystemProxySettings->GetMainThreadOnly(&mainThreadOnly)) &&
1396       !mainThreadOnly) {
1397     rv = mPACMan->Init(mSystemProxySettings);
1398   } else {
1399     rv = mPACMan->Init(nullptr);
1400   }
1401   if (NS_FAILED(rv)) {
1402     mPACMan->Shutdown();
1403     mPACMan = nullptr;
1404   }
1405   return rv;
1406 }
1407
1408 nsresult nsProtocolProxyService::ResetPACThread() {
1409   if (!mPACMan) return NS_OK;
1410
1411   mPACMan->Shutdown();
1412   mPACMan = nullptr;
1413   return SetupPACThread();
1414 }
1415
1416 nsresult nsProtocolProxyService::ConfigureFromPAC(const nsCString& spec,
1417                                                   bool forceReload) {
1418   nsresult rv = SetupPACThread();
1419   NS_ENSURE_SUCCESS(rv, rv);
1420
1421   bool autodetect = spec.IsEmpty();
1422   if (!forceReload && ((!autodetect && mPACMan->IsPACURI(spec)) ||
1423                        (autodetect && mPACMan->IsUsingWPAD()))) {
1424     return NS_OK;
1425   }
1426
1427   mFailedProxies.Clear();
1428
1429   mPACMan->SetWPADOverDHCPEnabled(mWPADOverDHCPEnabled);
1430   return mPACMan->LoadPACFromURI(spec);
1431 }
1432
1433 void nsProtocolProxyService::ProcessPACString(const nsCString& pacString,
1434                                               uint32_t aResolveFlags,
1435                                               nsIProxyInfo** result) {
1436   if (pacString.IsEmpty()) {
1437     *result = nullptr;
1438     return;
1439   }
1440
1441   const char* proxies = pacString.get();
1442
1443   nsProxyInfo *pi = nullptr, *first = nullptr, *last = nullptr;
1444   while (*proxies) {
1445     proxies = ExtractProxyInfo(proxies, aResolveFlags, &pi);
1446     if (pi && (pi->mType == kProxyType_HTTPS) && !mProxyOverTLS) {
1447       delete pi;
1448       pi = nullptr;
1449     }
1450
1451     if (pi) {
1452       if (last) {
1453         NS_ASSERTION(last->mNext == nullptr, "leaking nsProxyInfo");
1454         last->mNext = pi;
1455       } else {
1456         first = pi;
1457       }
1458       last = pi;
1459     }
1460   }
1461   *result = first;
1462 }
1463
1464 // nsIProtocolProxyService2
1465 NS_IMETHODIMP
1466 nsProtocolProxyService::ReloadPAC() {
1467   nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
1468   if (!prefs) return NS_OK;
1469
1470   int32_t type;
1471   nsresult rv = prefs->GetIntPref(PROXY_PREF("type"), &type);
1472   if (NS_FAILED(rv)) return NS_OK;
1473
1474   nsAutoCString pacSpec;
1475   if (type == PROXYCONFIG_PAC) {
1476     prefs->GetCharPref(PROXY_PREF("autoconfig_url"), pacSpec);
1477   } else if (type == PROXYCONFIG_SYSTEM) {
1478     if (mSystemProxySettings) {
1479       AsyncConfigureFromPAC(true, true);
1480     } else {
1481       ResetPACThread();
1482     }
1483   }
1484
1485   if (!pacSpec.IsEmpty() || type == PROXYCONFIG_WPAD) {
1486     ConfigureFromPAC(pacSpec, true);
1487   }
1488   return NS_OK;
1489 }
1490
1491 // When sync interface is removed this can go away too
1492 // The nsPACManCallback portion of this implementation should be run
1493 // off the main thread, because it uses a condvar for signaling and
1494 // the main thread is blocking on that condvar -
1495 //  so call nsPACMan::AsyncGetProxyForURI() with
1496 // a false mainThreadResponse parameter.
1497 class nsAsyncBridgeRequest final : public nsPACManCallback {
1498   NS_DECL_THREADSAFE_ISUPPORTS
1499
1500   nsAsyncBridgeRequest()
1501       : mMutex("nsDeprecatedCallback"),
1502         mCondVar(mMutex, "nsDeprecatedCallback") {}
1503
1504   void OnQueryComplete(nsresult status, const nsACString& pacString,
1505                        const nsACString& newPACURL) override {
1506     MutexAutoLock lock(mMutex);
1507     mCompleted = true;
1508     mStatus = status;
1509     mPACString = pacString;
1510     mPACURL = newPACURL;
1511     mCondVar.Notify();
1512   }
1513
1514   void Lock() { mMutex.Lock(); }
1515   void Unlock() { mMutex.Unlock(); }
1516   void Wait() { mCondVar.Wait(TimeDuration::FromSeconds(3)); }
1517
1518  private:
1519   ~nsAsyncBridgeRequest() = default;
1520
1521   friend class nsProtocolProxyService;
1522
1523   Mutex mMutex;
1524   CondVar mCondVar;
1525
1526   nsresult mStatus{NS_OK};
1527   nsCString mPACString;
1528   nsCString mPACURL;
1529   bool mCompleted{false};
1530 };
1531 NS_IMPL_ISUPPORTS0(nsAsyncBridgeRequest)
1532
1533 nsresult nsProtocolProxyService::AsyncResolveInternal(
1534     nsIChannel* channel, uint32_t flags, nsIProtocolProxyCallback* callback,
1535     nsICancelable** result, bool isSyncOK,
1536     nsISerialEventTarget* mainThreadEventTarget) {
1537   NS_ENSURE_ARG_POINTER(channel);
1538   NS_ENSURE_ARG_POINTER(callback);
1539
1540   nsCOMPtr<nsIURI> uri;
1541   nsresult rv = GetProxyURI(channel, getter_AddRefs(uri));
1542   if (NS_FAILED(rv)) return rv;
1543
1544   *result = nullptr;
1545   RefPtr<nsAsyncResolveRequest> ctx =
1546       new nsAsyncResolveRequest(this, channel, flags, callback);
1547
1548   nsProtocolInfo info;
1549   rv = GetProtocolInfo(uri, &info);
1550   if (NS_FAILED(rv)) return rv;
1551
1552   nsCOMPtr<nsIProxyInfo> pi;
1553   bool usePACThread;
1554
1555   // adapt to realtime changes in the system proxy service
1556   if (mProxyConfig == PROXYCONFIG_SYSTEM) {
1557     nsCOMPtr<nsISystemProxySettings> sp2 =
1558         do_GetService(NS_SYSTEMPROXYSETTINGS_CONTRACTID);
1559     if (sp2 != mSystemProxySettings) {
1560       mSystemProxySettings = sp2;
1561       ResetPACThread();
1562     }
1563   }
1564
1565   rv = SetupPACThread(mainThreadEventTarget);
1566   if (NS_FAILED(rv)) {
1567     return rv;
1568   }
1569
1570   // SystemProxySettings and PAC files can block the main thread
1571   // but if neither of them are in use, we can just do the work
1572   // right here and directly invoke the callback
1573
1574   rv =
1575       Resolve_Internal(channel, info, flags, &usePACThread, getter_AddRefs(pi));
1576   if (NS_FAILED(rv)) return rv;
1577
1578   if (!usePACThread || !mPACMan) {
1579     // we can do it locally
1580     rv = ctx->ProcessLocally(info, pi, isSyncOK);
1581     if (NS_SUCCEEDED(rv) && !isSyncOK) {
1582       ctx.forget(result);
1583     }
1584     return rv;
1585   }
1586
1587   // else kick off a PAC thread query
1588   rv = mPACMan->AsyncGetProxyForURI(uri, ctx, flags, true);
1589   if (NS_SUCCEEDED(rv)) ctx.forget(result);
1590   return rv;
1591 }
1592
1593 // nsIProtocolProxyService
1594 NS_IMETHODIMP
1595 nsProtocolProxyService::AsyncResolve2(
1596     nsIChannel* channel, uint32_t flags, nsIProtocolProxyCallback* callback,
1597     nsISerialEventTarget* mainThreadEventTarget, nsICancelable** result) {
1598   return AsyncResolveInternal(channel, flags, callback, result, true,
1599                               mainThreadEventTarget);
1600 }
1601
1602 NS_IMETHODIMP
1603 nsProtocolProxyService::AsyncResolve(
1604     nsISupports* channelOrURI, uint32_t flags,
1605     nsIProtocolProxyCallback* callback,
1606     nsISerialEventTarget* mainThreadEventTarget, nsICancelable** result) {
1607   nsresult rv;
1608   // Check if we got a channel:
1609   nsCOMPtr<nsIChannel> channel = do_QueryInterface(channelOrURI);
1610   if (!channel) {
1611     nsCOMPtr<nsIURI> uri = do_QueryInterface(channelOrURI);
1612     if (!uri) {
1613       return NS_ERROR_NO_INTERFACE;
1614     }
1615
1616     // creating a temporary channel from the URI which is not
1617     // used to perform any network loads, hence its safe to
1618     // use systemPrincipal as the loadingPrincipal.
1619     rv = NS_NewChannel(getter_AddRefs(channel), uri,
1620                        nsContentUtils::GetSystemPrincipal(),
1621                        nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
1622                        nsIContentPolicy::TYPE_OTHER);
1623     NS_ENSURE_SUCCESS(rv, rv);
1624   }
1625
1626   return AsyncResolveInternal(channel, flags, callback, result, false,
1627                               mainThreadEventTarget);
1628 }
1629
1630 NS_IMETHODIMP
1631 nsProtocolProxyService::NewProxyInfo(
1632     const nsACString& aType, const nsACString& aHost, int32_t aPort,
1633     const nsACString& aProxyAuthorizationHeader,
1634     const nsACString& aConnectionIsolationKey, uint32_t aFlags,
1635     uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
1636     nsIProxyInfo** aResult) {
1637   return NewProxyInfoWithAuth(aType, aHost, aPort, ""_ns, ""_ns,
1638                               aProxyAuthorizationHeader,
1639                               aConnectionIsolationKey, aFlags, aFailoverTimeout,
1640                               aFailoverProxy, aResult);
1641 }
1642
1643 NS_IMETHODIMP
1644 nsProtocolProxyService::NewProxyInfoWithAuth(
1645     const nsACString& aType, const nsACString& aHost, int32_t aPort,
1646     const nsACString& aUsername, const nsACString& aPassword,
1647     const nsACString& aProxyAuthorizationHeader,
1648     const nsACString& aConnectionIsolationKey, uint32_t aFlags,
1649     uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
1650     nsIProxyInfo** aResult) {
1651   static const char* types[] = {kProxyType_HTTP, kProxyType_HTTPS,
1652                                 kProxyType_SOCKS, kProxyType_SOCKS4,
1653                                 kProxyType_DIRECT};
1654
1655   // resolve type; this allows us to avoid copying the type string into each
1656   // proxy info instance.  we just reference the string literals directly :)
1657   const char* type = nullptr;
1658   for (auto& t : types) {
1659     if (aType.LowerCaseEqualsASCII(t)) {
1660       type = t;
1661       break;
1662     }
1663   }
1664   NS_ENSURE_TRUE(type, NS_ERROR_INVALID_ARG);
1665
1666   // We have only implemented username/password for SOCKS proxies.
1667   if ((!aUsername.IsEmpty() || !aPassword.IsEmpty()) &&
1668       !aType.LowerCaseEqualsASCII(kProxyType_SOCKS) &&
1669       !aType.LowerCaseEqualsASCII(kProxyType_SOCKS4)) {
1670     return NS_ERROR_NOT_IMPLEMENTED;
1671   }
1672
1673   return NewProxyInfo_Internal(type, aHost, aPort, aUsername, aPassword,
1674                                aProxyAuthorizationHeader,
1675                                aConnectionIsolationKey, aFlags,
1676                                aFailoverTimeout, aFailoverProxy, 0, aResult);
1677 }
1678
1679 NS_IMETHODIMP
1680 nsProtocolProxyService::GetFailoverForProxy(nsIProxyInfo* aProxy, nsIURI* aURI,
1681                                             nsresult aStatus,
1682                                             nsIProxyInfo** aResult) {
1683   // Failover is supported through a variety of methods including:
1684   // * PAC scripts (PROXYCONFIG_PAC and PROXYCONFIG_WPAD)
1685   // * System proxy
1686   // * Extensions
1687   // With extensions the mProxyConfig can be any type and the extension
1688   // is still involved in the proxy filtering.  It may have also supplied
1689   // any number of failover proxies.  We cannot determine what the mix is
1690   // here, so we will attempt to get a failover regardless of the config
1691   // type.  MANUAL configuration will not disable a proxy.
1692
1693   // Verify that |aProxy| is one of our nsProxyInfo objects.
1694   nsCOMPtr<nsProxyInfo> pi = do_QueryInterface(aProxy);
1695   NS_ENSURE_ARG(pi);
1696   // OK, the QI checked out.  We can proceed.
1697
1698   // Remember that this proxy is down.  If the user has manually configured some
1699   // proxies we do not want to disable them.
1700   if (mProxyConfig != PROXYCONFIG_MANUAL) {
1701     DisableProxy(pi);
1702   }
1703
1704   // NOTE: At this point, we might want to prompt the user if we have
1705   //       not already tried going DIRECT.  This is something that the
1706   //       classic codebase supported; however, IE6 does not prompt.
1707
1708   if (!pi->mNext) return NS_ERROR_NOT_AVAILABLE;
1709
1710   LOG(("PAC failover from %s %s:%d to %s %s:%d\n", pi->mType, pi->mHost.get(),
1711        pi->mPort, pi->mNext->mType, pi->mNext->mHost.get(), pi->mNext->mPort));
1712
1713   *aResult = do_AddRef(pi->mNext).take();
1714   return NS_OK;
1715 }
1716
1717 namespace {  // anon
1718
1719 class ProxyFilterPositionComparator {
1720   using FilterLinkRef = RefPtr<nsProtocolProxyService::FilterLink>;
1721
1722  public:
1723   bool Equals(const FilterLinkRef& a, const FilterLinkRef& b) const {
1724     return a->position == b->position;
1725   }
1726   bool LessThan(const FilterLinkRef& a, const FilterLinkRef& b) const {
1727     return a->position < b->position;
1728   }
1729 };
1730
1731 class ProxyFilterObjectComparator {
1732   using FilterLinkRef = RefPtr<nsProtocolProxyService::FilterLink>;
1733
1734  public:
1735   bool Equals(const FilterLinkRef& link, const nsISupports* obj) const {
1736     return obj == nsCOMPtr<nsISupports>(do_QueryInterface(link->filter)) ||
1737            obj == nsCOMPtr<nsISupports>(do_QueryInterface(link->channelFilter));
1738   }
1739 };
1740
1741 }  // namespace
1742
1743 nsresult nsProtocolProxyService::InsertFilterLink(RefPtr<FilterLink>&& link) {
1744   LOG(("nsProtocolProxyService::InsertFilterLink filter=%p", link.get()));
1745
1746   if (mIsShutdown) {
1747     return NS_ERROR_FAILURE;
1748   }
1749
1750   mFilters.AppendElement(link);
1751   mFilters.Sort(ProxyFilterPositionComparator());
1752   return NS_OK;
1753 }
1754
1755 NS_IMETHODIMP
1756 nsProtocolProxyService::RegisterFilter(nsIProtocolProxyFilter* filter,
1757                                        uint32_t position) {
1758   UnregisterFilter(filter);  // remove this filter if we already have it
1759
1760   RefPtr<FilterLink> link = new FilterLink(position, filter);
1761   return InsertFilterLink(std::move(link));
1762 }
1763
1764 NS_IMETHODIMP
1765 nsProtocolProxyService::RegisterChannelFilter(
1766     nsIProtocolProxyChannelFilter* channelFilter, uint32_t position) {
1767   UnregisterChannelFilter(
1768       channelFilter);  // remove this filter if we already have it
1769
1770   RefPtr<FilterLink> link = new FilterLink(position, channelFilter);
1771   return InsertFilterLink(std::move(link));
1772 }
1773
1774 nsresult nsProtocolProxyService::RemoveFilterLink(nsISupports* givenObject) {
1775   LOG(("nsProtocolProxyService::RemoveFilterLink target=%p", givenObject));
1776
1777   return mFilters.RemoveElement(givenObject, ProxyFilterObjectComparator())
1778              ? NS_OK
1779              : NS_ERROR_UNEXPECTED;
1780 }
1781
1782 NS_IMETHODIMP
1783 nsProtocolProxyService::UnregisterFilter(nsIProtocolProxyFilter* filter) {
1784   // QI to nsISupports so we can safely test object identity.
1785   nsCOMPtr<nsISupports> givenObject = do_QueryInterface(filter);
1786   return RemoveFilterLink(givenObject);
1787 }
1788
1789 NS_IMETHODIMP
1790 nsProtocolProxyService::UnregisterChannelFilter(
1791     nsIProtocolProxyChannelFilter* channelFilter) {
1792   // QI to nsISupports so we can safely test object identity.
1793   nsCOMPtr<nsISupports> givenObject = do_QueryInterface(channelFilter);
1794   return RemoveFilterLink(givenObject);
1795 }
1796
1797 NS_IMETHODIMP
1798 nsProtocolProxyService::GetProxyConfigType(uint32_t* aProxyConfigType) {
1799   *aProxyConfigType = mProxyConfig;
1800   return NS_OK;
1801 }
1802
1803 void nsProtocolProxyService::LoadHostFilters(const nsACString& aFilters) {
1804   if (mIsShutdown) {
1805     return;
1806   }
1807
1808   // check to see the owners flag? /!?/ TODO
1809   if (mHostFiltersArray.Length() > 0) {
1810     mHostFiltersArray.Clear();
1811   }
1812
1813   // Reset mFilterLocalHosts - will be set to true if "<local>" is in pref
1814   // string
1815   mFilterLocalHosts = false;
1816
1817   if (aFilters.IsEmpty()) {
1818     return;
1819   }
1820
1821   //
1822   // filter  = ( host | domain | ipaddr ["/" mask] ) [":" port]
1823   // filters = filter *( "," LWS filter)
1824   //
1825   mozilla::Tokenizer t(aFilters);
1826   mozilla::Tokenizer::Token token;
1827   bool eof = false;
1828   // while (*filters) {
1829   while (!eof) {
1830     // skip over spaces and ,
1831     t.SkipWhites();
1832     while (t.CheckChar(',')) {
1833       t.SkipWhites();
1834     }
1835
1836     nsAutoCString portStr;
1837     nsAutoCString hostStr;
1838     nsAutoCString maskStr;
1839     t.Record();
1840
1841     bool parsingIPv6 = false;
1842     bool parsingPort = false;
1843     bool parsingMask = false;
1844     while (t.Next(token)) {
1845       if (token.Equals(mozilla::Tokenizer::Token::EndOfFile())) {
1846         eof = true;
1847         break;
1848       }
1849       if (token.Equals(mozilla::Tokenizer::Token::Char(',')) ||
1850           token.Type() == mozilla::Tokenizer::TOKEN_WS) {
1851         break;
1852       }
1853
1854       if (token.Equals(mozilla::Tokenizer::Token::Char('['))) {
1855         parsingIPv6 = true;
1856         continue;
1857       }
1858
1859       if (!parsingIPv6 && token.Equals(mozilla::Tokenizer::Token::Char(':'))) {
1860         // Port is starting. Claim the previous as host.
1861         if (parsingMask) {
1862           t.Claim(maskStr);
1863         } else {
1864           t.Claim(hostStr);
1865         }
1866         t.Record();
1867         parsingPort = true;
1868         continue;
1869       }
1870
1871       if (token.Equals(mozilla::Tokenizer::Token::Char('/'))) {
1872         t.Claim(hostStr);
1873         t.Record();
1874         parsingMask = true;
1875         continue;
1876       }
1877
1878       if (token.Equals(mozilla::Tokenizer::Token::Char(']'))) {
1879         parsingIPv6 = false;
1880         continue;
1881       }
1882     }
1883     if (!parsingPort && !parsingMask) {
1884       t.Claim(hostStr);
1885     } else if (parsingPort) {
1886       t.Claim(portStr);
1887     } else if (parsingMask) {
1888       t.Claim(maskStr);
1889     } else {
1890       NS_WARNING("Could not parse this rule");
1891       continue;
1892     }
1893
1894     if (hostStr.IsEmpty()) {
1895       continue;
1896     }
1897
1898     // If the current host filter is "<local>", then all local (i.e.
1899     // no dots in the hostname) hosts should bypass the proxy
1900     if (hostStr.EqualsIgnoreCase("<local>")) {
1901       mFilterLocalHosts = true;
1902       LOG(
1903           ("loaded filter for local hosts "
1904            "(plain host names, no dots)\n"));
1905       // Continue to next host filter;
1906       continue;
1907     }
1908
1909     // For all other host filters, create HostInfo object and add to list
1910     HostInfo* hinfo = new HostInfo();
1911     nsresult rv = NS_OK;
1912
1913     int32_t port = portStr.ToInteger(&rv);
1914     if (NS_FAILED(rv)) {
1915       port = 0;
1916     }
1917     hinfo->port = port;
1918
1919     int32_t maskLen = maskStr.ToInteger(&rv);
1920     if (NS_FAILED(rv)) {
1921       maskLen = 128;
1922     }
1923
1924     // PR_StringToNetAddr can't parse brackets enclosed IPv6
1925     nsAutoCString addrString = hostStr;
1926     if (hostStr.First() == '[' && hostStr.Last() == ']') {
1927       addrString = Substring(hostStr, 1, hostStr.Length() - 2);
1928     }
1929
1930     PRNetAddr addr;
1931     if (PR_StringToNetAddr(addrString.get(), &addr) == PR_SUCCESS) {
1932       hinfo->is_ipaddr = true;
1933       hinfo->ip.family = PR_AF_INET6;  // we always store address as IPv6
1934       hinfo->ip.mask_len = maskLen;
1935
1936       if (hinfo->ip.mask_len == 0) {
1937         NS_WARNING("invalid mask");
1938         goto loser;
1939       }
1940
1941       if (addr.raw.family == PR_AF_INET) {
1942         // convert to IPv4-mapped address
1943         PR_ConvertIPv4AddrToIPv6(addr.inet.ip, &hinfo->ip.addr);
1944         // adjust mask_len accordingly
1945         if (hinfo->ip.mask_len <= 32) hinfo->ip.mask_len += 96;
1946       } else if (addr.raw.family == PR_AF_INET6) {
1947         // copy the address
1948         memcpy(&hinfo->ip.addr, &addr.ipv6.ip, sizeof(PRIPv6Addr));
1949       } else {
1950         NS_WARNING("unknown address family");
1951         goto loser;
1952       }
1953
1954       // apply mask to IPv6 address
1955       proxy_MaskIPv6Addr(hinfo->ip.addr, hinfo->ip.mask_len);
1956     } else {
1957       nsAutoCString host;
1958       if (hostStr.First() == '*') {
1959         host = Substring(hostStr, 1);
1960       } else {
1961         host = hostStr;
1962       }
1963
1964       if (host.IsEmpty()) {
1965         hinfo->name.host = nullptr;
1966         goto loser;
1967       }
1968
1969       hinfo->name.host_len = host.Length();
1970
1971       hinfo->is_ipaddr = false;
1972       hinfo->name.host = ToNewCString(host, mozilla::fallible);
1973
1974       if (!hinfo->name.host) goto loser;
1975     }
1976
1977 //#define DEBUG_DUMP_FILTERS
1978 #ifdef DEBUG_DUMP_FILTERS
1979     printf("loaded filter[%zu]:\n", mHostFiltersArray.Length());
1980     printf("  is_ipaddr = %u\n", hinfo->is_ipaddr);
1981     printf("  port = %u\n", hinfo->port);
1982     printf("  host = %s\n", hostStr.get());
1983     if (hinfo->is_ipaddr) {
1984       printf("  ip.family = %x\n", hinfo->ip.family);
1985       printf("  ip.mask_len = %u\n", hinfo->ip.mask_len);
1986
1987       PRNetAddr netAddr;
1988       PR_SetNetAddr(PR_IpAddrNull, PR_AF_INET6, 0, &netAddr);
1989       memcpy(&netAddr.ipv6.ip, &hinfo->ip.addr, sizeof(hinfo->ip.addr));
1990
1991       char buf[256];
1992       PR_NetAddrToString(&netAddr, buf, sizeof(buf));
1993
1994       printf("  ip.addr = %s\n", buf);
1995     } else {
1996       printf("  name.host = %s\n", hinfo->name.host);
1997     }
1998 #endif
1999
2000     mHostFiltersArray.AppendElement(hinfo);
2001     hinfo = nullptr;
2002   loser:
2003     delete hinfo;
2004   }
2005 }
2006
2007 nsresult nsProtocolProxyService::GetProtocolInfo(nsIURI* uri,
2008                                                  nsProtocolInfo* info) {
2009   MOZ_ASSERT(uri, "URI is null");
2010   MOZ_ASSERT(info, "info is null");
2011
2012   nsresult rv;
2013
2014   rv = uri->GetScheme(info->scheme);
2015   if (NS_FAILED(rv)) return rv;
2016
2017   nsCOMPtr<nsIIOService> ios = do_GetIOService(&rv);
2018   if (NS_FAILED(rv)) return rv;
2019
2020   nsCOMPtr<nsIProtocolHandler> handler;
2021   rv = ios->GetProtocolHandler(info->scheme.get(), getter_AddRefs(handler));
2022   if (NS_FAILED(rv)) return rv;
2023
2024   rv = handler->DoGetProtocolFlags(uri, &info->flags);
2025   if (NS_FAILED(rv)) return rv;
2026
2027   rv = handler->GetDefaultPort(&info->defaultPort);
2028   return rv;
2029 }
2030
2031 nsresult nsProtocolProxyService::NewProxyInfo_Internal(
2032     const char* aType, const nsACString& aHost, int32_t aPort,
2033     const nsACString& aUsername, const nsACString& aPassword,
2034     const nsACString& aProxyAuthorizationHeader,
2035     const nsACString& aConnectionIsolationKey, uint32_t aFlags,
2036     uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
2037     uint32_t aResolveFlags, nsIProxyInfo** aResult) {
2038   if (aPort <= 0) aPort = -1;
2039
2040   nsCOMPtr<nsProxyInfo> failover;
2041   if (aFailoverProxy) {
2042     failover = do_QueryInterface(aFailoverProxy);
2043     NS_ENSURE_ARG(failover);
2044   }
2045
2046   RefPtr<nsProxyInfo> proxyInfo = new nsProxyInfo();
2047
2048   proxyInfo->mType = aType;
2049   proxyInfo->mHost = aHost;
2050   proxyInfo->mPort = aPort;
2051   proxyInfo->mUsername = aUsername;
2052   proxyInfo->mPassword = aPassword;
2053   proxyInfo->mFlags = aFlags;
2054   proxyInfo->mResolveFlags = aResolveFlags;
2055   proxyInfo->mTimeout =
2056       aFailoverTimeout == UINT32_MAX ? mFailedProxyTimeout : aFailoverTimeout;
2057   proxyInfo->mProxyAuthorizationHeader = aProxyAuthorizationHeader;
2058   proxyInfo->mConnectionIsolationKey = aConnectionIsolationKey;
2059   failover.swap(proxyInfo->mNext);
2060
2061   proxyInfo.forget(aResult);
2062   return NS_OK;
2063 }
2064
2065 nsresult nsProtocolProxyService::Resolve_Internal(nsIChannel* channel,
2066                                                   const nsProtocolInfo& info,
2067                                                   uint32_t flags,
2068                                                   bool* usePACThread,
2069                                                   nsIProxyInfo** result) {
2070   NS_ENSURE_ARG_POINTER(channel);
2071
2072   *usePACThread = false;
2073   *result = nullptr;
2074
2075   if (!(info.flags & nsIProtocolHandler::ALLOWS_PROXY)) {
2076     return NS_OK;  // Can't proxy this (filters may not override)
2077   }
2078
2079   nsCOMPtr<nsIURI> uri;
2080   nsresult rv = GetProxyURI(channel, getter_AddRefs(uri));
2081   if (NS_FAILED(rv)) return rv;
2082
2083   // See bug #586908.
2084   // Avoid endless loop if |uri| is the current PAC-URI. Returning OK
2085   // here means that we will not use a proxy for this connection.
2086   if (mPACMan && mPACMan->IsPACURI(uri)) return NS_OK;
2087
2088   // if proxies are enabled and this host:port combo is supposed to use a
2089   // proxy, check for a proxy.
2090   if ((mProxyConfig == PROXYCONFIG_DIRECT) ||
2091       !CanUseProxy(uri, info.defaultPort)) {
2092     return NS_OK;
2093   }
2094
2095   bool mainThreadOnly;
2096   if (mSystemProxySettings && mProxyConfig == PROXYCONFIG_SYSTEM &&
2097       NS_SUCCEEDED(mSystemProxySettings->GetMainThreadOnly(&mainThreadOnly)) &&
2098       !mainThreadOnly) {
2099     *usePACThread = true;
2100     return NS_OK;
2101   }
2102
2103   if (mSystemProxySettings && mProxyConfig == PROXYCONFIG_SYSTEM) {
2104     // If the system proxy setting implementation is not threadsafe (e.g
2105     // linux gconf), we'll do it inline here. Such implementations promise
2106     // not to block
2107     // bug 1366133: this block uses GetPACURI & GetProxyForURI, which may
2108     // hang on Windows platform. Fortunately, current implementation on
2109     // Windows is not main thread only, so we are safe here.
2110
2111     nsAutoCString PACURI;
2112     nsAutoCString pacString;
2113
2114     if (NS_SUCCEEDED(mSystemProxySettings->GetPACURI(PACURI)) &&
2115         !PACURI.IsEmpty()) {
2116       // There is a PAC URI configured. If it is unchanged, then
2117       // just execute the PAC thread. If it is changed then load
2118       // the new value
2119
2120       if (mPACMan && mPACMan->IsPACURI(PACURI)) {
2121         // unchanged
2122         *usePACThread = true;
2123         return NS_OK;
2124       }
2125
2126       ConfigureFromPAC(PACURI, false);
2127       return NS_OK;
2128     }
2129
2130     nsAutoCString spec;
2131     nsAutoCString host;
2132     nsAutoCString scheme;
2133     int32_t port = -1;
2134
2135     uri->GetAsciiSpec(spec);
2136     uri->GetAsciiHost(host);
2137     uri->GetScheme(scheme);
2138     uri->GetPort(&port);
2139
2140     if (flags & RESOLVE_PREFER_SOCKS_PROXY) {
2141       LOG(("Ignoring RESOLVE_PREFER_SOCKS_PROXY for system proxy setting\n"));
2142     } else if (flags & RESOLVE_PREFER_HTTPS_PROXY) {
2143       scheme.AssignLiteral("https");
2144     } else if (flags & RESOLVE_IGNORE_URI_SCHEME) {
2145       scheme.AssignLiteral("http");
2146     }
2147
2148     // now try the system proxy settings for this particular url
2149     if (NS_SUCCEEDED(mSystemProxySettings->GetProxyForURI(spec, scheme, host,
2150                                                           port, pacString))) {
2151       nsCOMPtr<nsIProxyInfo> pi;
2152       ProcessPACString(pacString, 0, getter_AddRefs(pi));
2153
2154       if (flags & RESOLVE_PREFER_SOCKS_PROXY &&
2155           flags & RESOLVE_PREFER_HTTPS_PROXY) {
2156         nsAutoCString type;
2157         pi->GetType(type);
2158         // DIRECT from ProcessPACString indicates that system proxy settings
2159         // are not configured to use SOCKS proxy. Try https proxy as a
2160         // secondary preferrable proxy. This is mainly for websocket whose
2161         // proxy precedence is SOCKS > HTTPS > DIRECT.
2162         if (type.EqualsLiteral(kProxyType_DIRECT)) {
2163           scheme.AssignLiteral(kProxyType_HTTPS);
2164           if (NS_SUCCEEDED(mSystemProxySettings->GetProxyForURI(
2165                   spec, scheme, host, port, pacString))) {
2166             ProcessPACString(pacString, 0, getter_AddRefs(pi));
2167           }
2168         }
2169       }
2170       pi.forget(result);
2171       return NS_OK;
2172     }
2173   }
2174
2175   // if proxies are enabled and this host:port combo is supposed to use a
2176   // proxy, check for a proxy.
2177   if (mProxyConfig == PROXYCONFIG_DIRECT ||
2178       (mProxyConfig == PROXYCONFIG_MANUAL &&
2179        !CanUseProxy(uri, info.defaultPort))) {
2180     return NS_OK;
2181   }
2182
2183   // Proxy auto config magic...
2184   if (mProxyConfig == PROXYCONFIG_PAC || mProxyConfig == PROXYCONFIG_WPAD) {
2185     // Do not query PAC now.
2186     *usePACThread = true;
2187     return NS_OK;
2188   }
2189
2190   // If we aren't in manual proxy configuration mode then we don't
2191   // want to honor any manual specific prefs that might be still set
2192   if (mProxyConfig != PROXYCONFIG_MANUAL) return NS_OK;
2193
2194   // proxy info values for manual configuration mode
2195   const char* type = nullptr;
2196   const nsACString* host = nullptr;
2197   int32_t port = -1;
2198
2199   uint32_t proxyFlags = 0;
2200
2201   if ((flags & RESOLVE_PREFER_SOCKS_PROXY) && !mSOCKSProxyTarget.IsEmpty() &&
2202       (IsHostLocalTarget(mSOCKSProxyTarget) || mSOCKSProxyPort > 0)) {
2203     host = &mSOCKSProxyTarget;
2204     if (mSOCKSProxyVersion == 4) {
2205       type = kProxyType_SOCKS4;
2206     } else {
2207       type = kProxyType_SOCKS;
2208     }
2209     port = mSOCKSProxyPort;
2210     if (mSOCKSProxyRemoteDNS) {
2211       proxyFlags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
2212     }
2213   } else if ((flags & RESOLVE_PREFER_HTTPS_PROXY) &&
2214              !mHTTPSProxyHost.IsEmpty() && mHTTPSProxyPort > 0) {
2215     host = &mHTTPSProxyHost;
2216     type = kProxyType_HTTP;
2217     port = mHTTPSProxyPort;
2218   } else if (!mHTTPProxyHost.IsEmpty() && mHTTPProxyPort > 0 &&
2219              ((flags & RESOLVE_IGNORE_URI_SCHEME) ||
2220               info.scheme.EqualsLiteral("http"))) {
2221     host = &mHTTPProxyHost;
2222     type = kProxyType_HTTP;
2223     port = mHTTPProxyPort;
2224   } else if (!mHTTPSProxyHost.IsEmpty() && mHTTPSProxyPort > 0 &&
2225              !(flags & RESOLVE_IGNORE_URI_SCHEME) &&
2226              info.scheme.EqualsLiteral("https")) {
2227     host = &mHTTPSProxyHost;
2228     type = kProxyType_HTTP;
2229     port = mHTTPSProxyPort;
2230   } else if (!mSOCKSProxyTarget.IsEmpty() &&
2231              (IsHostLocalTarget(mSOCKSProxyTarget) || mSOCKSProxyPort > 0)) {
2232     host = &mSOCKSProxyTarget;
2233     if (mSOCKSProxyVersion == 4) {
2234       type = kProxyType_SOCKS4;
2235     } else {
2236       type = kProxyType_SOCKS;
2237     }
2238     port = mSOCKSProxyPort;
2239     if (mSOCKSProxyRemoteDNS) {
2240       proxyFlags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
2241     }
2242   }
2243
2244   if (type) {
2245     rv = NewProxyInfo_Internal(type, *host, port, ""_ns, ""_ns, ""_ns, ""_ns,
2246                                proxyFlags, UINT32_MAX, nullptr, flags, result);
2247     if (NS_FAILED(rv)) return rv;
2248   }
2249
2250   return NS_OK;
2251 }
2252
2253 void nsProtocolProxyService::MaybeDisableDNSPrefetch(nsIProxyInfo* aProxy) {
2254   // Disable Prefetch in the DNS service if a proxy is in use.
2255   if (!aProxy) return;
2256
2257   nsCOMPtr<nsProxyInfo> pi = do_QueryInterface(aProxy);
2258   if (!pi || !pi->mType || pi->mType == kProxyType_DIRECT) return;
2259
2260   nsCOMPtr<nsIDNSService> dns = do_GetService(NS_DNSSERVICE_CONTRACTID);
2261   if (!dns) return;
2262   nsCOMPtr<nsPIDNSService> pdns = do_QueryInterface(dns);
2263   if (!pdns) return;
2264
2265   // We lose the prefetch optimization for the life of the dns service.
2266   pdns->SetPrefetchEnabled(false);
2267 }
2268
2269 void nsProtocolProxyService::CopyFilters(nsTArray<RefPtr<FilterLink>>& aCopy) {
2270   MOZ_ASSERT(aCopy.Length() == 0);
2271   aCopy.AppendElements(mFilters);
2272 }
2273
2274 bool nsProtocolProxyService::ApplyFilter(
2275     FilterLink const* filterLink, nsIChannel* channel,
2276     const nsProtocolInfo& info, nsCOMPtr<nsIProxyInfo> list,
2277     nsIProxyProtocolFilterResult* callback) {
2278   nsresult rv;
2279
2280   // We prune the proxy list prior to invoking each filter.  This may be
2281   // somewhat inefficient, but it seems like a good idea since we want each
2282   // filter to "see" a valid proxy list.
2283   PruneProxyInfo(info, list);
2284
2285   if (filterLink->filter) {
2286     nsCOMPtr<nsIURI> uri;
2287     Unused << GetProxyURI(channel, getter_AddRefs(uri));
2288     if (!uri) {
2289       return false;
2290     }
2291
2292     rv = filterLink->filter->ApplyFilter(uri, list, callback);
2293     return NS_SUCCEEDED(rv);
2294   }
2295
2296   if (filterLink->channelFilter) {
2297     rv = filterLink->channelFilter->ApplyFilter(channel, list, callback);
2298     return NS_SUCCEEDED(rv);
2299   }
2300
2301   return false;
2302 }
2303
2304 void nsProtocolProxyService::PruneProxyInfo(const nsProtocolInfo& info,
2305                                             nsIProxyInfo** list) {
2306   if (!*list) return;
2307
2308   LOG(("nsProtocolProxyService::PruneProxyInfo ENTER list=%p", *list));
2309
2310   nsProxyInfo* head = nullptr;
2311   CallQueryInterface(*list, &head);
2312   if (!head) {
2313     MOZ_ASSERT_UNREACHABLE("nsIProxyInfo must QI to nsProxyInfo");
2314     return;
2315   }
2316   NS_RELEASE(*list);
2317
2318   // Pruning of disabled proxies works like this:
2319   //   - If all proxies are disabled, return the full list
2320   //   - Otherwise, remove the disabled proxies.
2321   //
2322   // Pruning of disallowed proxies works like this:
2323   //   - If the protocol handler disallows the proxy, then we disallow it.
2324
2325   // Start by removing all disallowed proxies if required:
2326   if (!(info.flags & nsIProtocolHandler::ALLOWS_PROXY_HTTP)) {
2327     nsProxyInfo *last = nullptr, *iter = head;
2328     while (iter) {
2329       if ((iter->Type() == kProxyType_HTTP) ||
2330           (iter->Type() == kProxyType_HTTPS)) {
2331         // reject!
2332         if (last) {
2333           last->mNext = iter->mNext;
2334         } else {
2335           head = iter->mNext;
2336         }
2337         nsProxyInfo* next = iter->mNext;
2338         iter->mNext = nullptr;
2339         iter->Release();
2340         iter = next;
2341       } else {
2342         last = iter;
2343         iter = iter->mNext;
2344       }
2345     }
2346     if (!head) {
2347       return;
2348     }
2349   }
2350
2351   // Scan to see if all remaining non-direct proxies are disabled. If so, then
2352   // we'll just bail and return them all.  Otherwise, we'll go and prune the
2353   // disabled ones.
2354
2355   bool allNonDirectProxiesDisabled = true;
2356
2357   nsProxyInfo* iter;
2358   for (iter = head; iter; iter = iter->mNext) {
2359     if (!IsProxyDisabled(iter) && iter->mType != kProxyType_DIRECT) {
2360       allNonDirectProxiesDisabled = false;
2361       break;
2362     }
2363   }
2364
2365   if (allNonDirectProxiesDisabled) {
2366     LOG(("All proxies are disabled, so trying all again"));
2367   } else {
2368     // remove any disabled proxies.
2369     nsProxyInfo* last = nullptr;
2370     for (iter = head; iter;) {
2371       if (IsProxyDisabled(iter)) {
2372         // reject!
2373         nsProxyInfo* reject = iter;
2374
2375         iter = iter->mNext;
2376         if (last) {
2377           last->mNext = iter;
2378         } else {
2379           head = iter;
2380         }
2381
2382         reject->mNext = nullptr;
2383         NS_RELEASE(reject);
2384         continue;
2385       }
2386
2387       // since we are about to use this proxy, make sure it is not on
2388       // the disabled proxy list.  we'll add it back to that list if
2389       // we have to (in GetFailoverForProxy).
2390       //
2391       // XXX(darin): It might be better to do this as a final pass.
2392       //
2393       EnableProxy(iter);
2394
2395       last = iter;
2396       iter = iter->mNext;
2397     }
2398   }
2399
2400   // if only DIRECT was specified then return no proxy info, and we're done.
2401   if (head && !head->mNext && head->mType == kProxyType_DIRECT) {
2402     NS_RELEASE(head);
2403   }
2404
2405   *list = head;  // Transfer ownership
2406
2407   LOG(("nsProtocolProxyService::PruneProxyInfo LEAVE list=%p", *list));
2408 }
2409
2410 bool nsProtocolProxyService::GetIsPACLoading() {
2411   return mPACMan && mPACMan->IsLoading();
2412 }
2413
2414 }  // namespace net
2415 }  // namespace mozilla