foxyproxy THESE FORUMS ARE CLOSED. NEW FORUMS AT FORUMS.GETFOXYPROXY.ORG

Hi Eric,

What several people (including me!) need is for each SOCKS5 proxy to handle its own DNS, because in many cases a hostname will only be understood on the far side of the particular proxy tunnel which matches that URL. This is similar to "split horizon" DNS, but managed within the browser - and it worked flawlessly up to FoxyProxy version 2.15.

That's very different from saying that one particular proxy should be responsible for *all* DNS lookups in Firefox, which is what 2.16 now seems to assume if that new box is ticked.

What seemed to happen (from the user's perspective) prior to 2.16 was:
1) Compare the URL with the configured proxies, and decide which proxy to use.
2) If it's a SOCKS5 proxy, and the global "use SOCKS for DNS" flag is set, then don't attempt any local DNS lookup (or, if FF does one anyway, throw away the result), and pass the hostname through to the SOCKS server to be looked up at the far side.
3) Otherwise, if it's a SOCKS4 proxy (or a SOCKS5 one without the "use SOCKS for DNS" flag set), look up the hostname locally and pass the IP address through to the SOCKS server.
4) Otherwise (direct connection, or HTTP proxy), do whatever Firefox normally does.

What 2.16 now seems to do is:
1) If any SOCKS5 proxy has the "use this proxy for DNS" option set, then unconditionally look up the hostname using that server.
2) If the lookup fails, bomb out, even if the proxy which matches the URL might have worked anyway with the unresolved hostname.
3) Only then decide which proxy to use.

I do like the idea of making the "use this proxy for DNS" a per-proxy setting, but it's crucial that this decision only happens *after* the correct proxy has been chosen, on a per-URL basis.

If there were in fact some local lookups happening with SOCKS5 proxies (as reported by a number of users), that is of course an issue if information leakage is a concern. However, for many common use-cases of FoxyProxy, leakage is not the primary concern - it's the ability to have separate DNS per proxy. Hopefully we can have both separate DNS *and* no leakage!

As an aside, HTTP proxies shouldn't need a local lookup either, because they work directly with the hostname. The only kinds of connection which require an IP address for the web server are "direct" and SOCKS4 (or SOCKS5 with "remote DNS" not selected), so ideally those would be the only circumstances where a local lookup is attempted.

Is there perhaps a combination of global options which FoxyProxy can set, to cause Firefox not to attempt any DNS lookups itself at all? Perhaps by telling FF that all URLs use a SOCKS5 proxy (even if they don't)? Then, in the specific cases where an IP address is required, FoxyProxy can do the local lookup, but only *after* it's decided what kind of proxy is needed for that particular URL and hence whether a lookup is needed.