Switchyomega: Secure Connection Failed on youtube

[evolighting]

While foxyproxy work fine , SwitchyOmega fail open youtube both in proxy and auto switch mode

SwitchyOmega 2.5.0
Mozilla/5.0 (X11; Linux x86_64; rv:56.0) Gecko/20100101 Firefox/56.0

{
    "event": "proxyScriptLog",
    "message": "Warning: Proxy script not initialized on handling: https://aus5.mozilla.org",
    "level": "warn"
}

[olloff]

Please see https://github.com/FelisCatus/SwitchyOmega/issues/1171
This is confirmed Firefox issue so it probably needs to be reviewed and fixed by Mozilla.

[evolighting]

@olloff
I'm using fedora 26, and in fact when proxy is using http protocol, everything would work just fine.
It is only happened when use a socks proxy server.

And it also fail on some https site, before failing showing 'performaning tls handshake' as status. while some other https website just seem to have no problem at all.

但是我觉得我遇到的并不是这个问题，因为其实我并没有使用Proxy script，或者这个东西就是那些规则么？
我不了解https的细节，并没有什么更多的想法。

[olloff]

Sorry, missed this Linux x86_64; line in your UA.
However, I couldn't reproduce this issue under Ubuntu 16.4 x64 using random socks proxy without auth. Youtube seems to load and play completely fine.

Indeed, from my previous experience, quite a lot of socks proxies are not capable to correctly load https websites. So if you can, try to test your setup with couple of another proxies.
Another obvious advice is to use proxy profile instead of switch profile while testing. Often it's very hard to realize if your issue caused by proxy issue or by some domain, used to serve resources to the blocked website (and which was missed in your setup).

[FelisCatus]

First, try setting network.proxy.socks_remote_dns to true in about:config. Also, when debugging these kind of issues, always use proxy mode since it rules out all issues caused by conditions and rule lists.

If it doesn't work, try visiting YouTube first, and then right clicking on the extension icon and select "Error log" to get the error log and see if whether Proxy script not initialized on handling is printed over and over. Pay special attention to see if youtube.com is also shown there. If so, you are probably affected by #1171.

Proxy script is just an internal term which is SwitchyOmega's implementation mechanism of all proxy settings on Firefox. You can be affected even if you didn't use anything special. However, I haven't seen #1171 happening on Linux yet and you might be the "lucky" one. Try updating to the most recent version of Firefox Nightly and see if it helps.

[evolighting]

@FelisCatus

1161 看了一下issue里的其他内容后我认为，我遇到的应该是和#1161那里一样的问题，不过由于网络环境等的不同，表现出来的不太一样。总结一下就是，http代理总是没有问题，socks代理在有的https网站上会有问题。

Thanks for your advice.
I have tried using setting "network.proxy.socks_remote_dns" to true all the time. And with SwitchyOmega
disabled, socks proxy work fine by browser proxy setting.

And when I try proxy mode I still get the connection fail issue.

What more , when I check the log file. ''Proxy script not initialized on handling" seem to be printed for every visited site , but only YouTube have the connecting issue.

And http mode proxy just work without problem. while the socks proxy don't.

For more detail, I'm using Shadowsocks-Qt5 for both socks and http proxy, on fedora 26. And firefox version is the up-to-date developer edition.I have tested it on most recent version of Firefox Nightly, and meet the same issue.

I think it is something about https with socks proxy on WebExtension? Since in my region YouTube is not accessible, may be socks proxy just fail at request. But it is also very strange that google.com , facebook and twitter witch are also inaccessible are not affected.

[olloff]

Lets try to search from another side.
Did you tried to test youtube connection without extension, using only system or browser settings?

What's the state of network.tcp.tcp_fastopen_enable on your browser (its been introduced in FF 56). Can you set it to false and test again after browser restart?
Few months ago there been reported issues with TFO, so this may be either regression or behavior related to proxy api.

And the last one, can you check http://ocsp.digicert.com (this one is ocsp responder I've got for google domains) with both proxy enabled and disabled? Though it couldn't block youtube, long ocsp answer can lead to extremely long page loading. It case you get no SSL-related errors this is likely variant too.

[evolighting]

@olloff
I think it is the same issue mentioned in #1161

The connection issue only happened with extension using a socks proxy, browser settings works fine.
And I can't visit youtube in my region for the reason.

network.tcp.tcp_fastopen_enable is false as default, and change it make no different.

And the last one showing me the dialog of download "ORS file (5 bytes)" for both case.

By the way ,the Shadowsocks-Qt5 log shows something like these when try visit youtube.

"Connecting 243.185.187.39:443 from 127.0.0.1:44852 Connecting 243.185.187.39:443 from 127.0.0.1:44856 Connecting 243.185.187.39:80 from 127.0.0.1:44860"

So it is likely to be caused by "DNS requests doesn't get resolved using the defined proxy" as mentioned in #1172 and more.

but setnetwork.proxy.socks_remote_dnsto true and network.dns.disablePrefetch to false not fix my problem.

[FelisCatus]

Doesn't look right, but no explanation has been found so far for this. Thanks for both of you for the research but right now I think we should just wait and see.

[FelisCatus]

1172.