[Security] DNS Leak appears with HTTP Proxy

[githuber4687]

Description

Steps to Reproduce

1. Connect a HTTP Proxy in system settings
2. Visit https://browserleaks.com/ip
3. Test DNS Leak

Actual result:

Expected result(from Edge Browser):

Reproduces how often:

Every Time/Always

Brave version (brave://version info)

Brave | 1.22.70 Chromium: 89.0.4389.105

Version/Channel Information:

• Can you reproduce this issue with the current release?
  Yes
• Can you reproduce this issue with the beta channel?
  Yes
• Can you reproduce this issue with the nightly channel?
  Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
  No
• Does the issue resolve itself when disabling Brave Rewards?
  No
• Is the issue reproducible on the latest version of Chrome?
  No (even Firefox)

[hollons]

Hi @githuber4687, thanks for reporting. Do you see the same leak in chrome? Do you have DNS over HTTPS enabled? Thanks in advance.

[diracdeltas]

do you have the same DNS over HTTPS settings in Brave and Chrome? you can see your DoH settings in brave://settings/security?search=dns

[githuber4687]

Hi @githuber4687, thanks for reporting. Do you see the same leak in chrome? Do you have DNS over HTTPS enabled? Thanks in advance.

Chrome does NOT have the same DNS leak issue. I have enabled DoH with my current service provider option. Thanks for your timely help.

[githuber4687]

do you have the same DNS over HTTPS settings in Brave and Chrome? you can see your DoH settings in brave://settings/security?search=dns

Chrome does NOT have the same DNS leak issue. I have enabled DoH with my current service provider option. Thanks for your timely help.

[fmarier]

Could you try with Secure DNS explicitly disabled? That's the configuration that Chrome uses since they haven't rolled out DoH to Linux users yet due to incompatibilities with some setups.

[githuber4687]

Could you try with Secure DNS explicitly disabled? That's the configuration that Chrome uses since they haven't rolled out DoH to Linux users yet due to incompatibilities with some setups.

Thanks for your suggestion. However, the issue still exists. After switch it off, the test on Brave Browser still shows my real DNS rather than the DNS configured on my proxy sever.

[githuber4687]

@fmarier With the help of wireshark, I found that with HTTP Proxy, Brave Browser still sends DNS queries to the DNS sever that set in my router (local DHCP sever). Maybe this is the cause. Thanks for your timely help.

[diracdeltas]

cc @antonok-edm in case this may have been fixed recently with the changes to cname adblocking

[stephendonner]

Verified PASSED using

Brave	1.34.76 Chromium: 97.0.4692.56 (Official Build) beta (x86_64)
Revision	04da6c66398ca50e603cc236a07dc7dfd3bbc750-refs/branch-heads/4692@{#990}
OS	macOS Version 11.6.1 (Build 20G224)

Steps:

1. new profile
2. found and used a SOCKS5 proxy server from the list at https://geonode.com/free-proxy-list
3. loaded dnsleaktest.com
4. clicked on Standard test
5. waited
6. confirmed my DNS resolvers aren't found and listed; instead, it showed IPs associated with that region

Example	Example

---

Verified PASSED using

Brave	1.34.76 Chromium: 97.0.4692.56 (Official Build) (64-bit)
Revision	04da6c66398ca50e603cc236a07dc7dfd3bbc750-refs/branch-heads/4692@{#990}
OS	Linux

Steps:

1. new profile
2. found and used a SOCKS5 proxy server from the list at https://geonode.com/free-proxy-list
3. loaded dnsleaktest.com
4. clicked on Standard test
5. waited
6. confirmed my DNS resolvers aren't found and listed; instead, it showed IPs associated with that region

Example	Example

[GeetaSarvadnya]

Verification PASSED on.

Brave | 1.34.78 Chromium: 97.0.4692.71 (Official Build) (64-bit)
-- | --
Revision | adefa7837d02a07a604c1e6eff0b3a09422ab88d-refs/branch-heads/4692@{#1247}
OS | Windows 10 Version 21H2 (Build 19044.1415)

Prerequisites: To test this issue Windows Firewall settings need to Turned OFF as the windows firewall is blocking the outbound DNS traffic hence I had to turn off all the 3 firewall settings (Domain/Private/Public). If anyone of these settings is ON socks 5 DNS leak tests cannot be successful.

Today myself and @srirambv tried a bunch of permutations and combinations for the DNS tests. If we setup Proxy server via Internet Options, it loads the page and detects the proxy server but when the DNS test is done it queries using the local ISP DNS not via the socks 5 DNS server, In this case DNS query is not getting proxied via the Proxy server which we setup in the Internet Options, hence it leaks the DNS (case 2)
Adding proxy manually via Manual proxy setup doesn't help either, myself and @stephendonner tested this multiple times yesterday. Usually, windows users will set proxy via Manual proxy setup not via cmd line options, probably we can file a follow-up issue for it, but looks like it's a windows Microsoft issue, not sure who will address the issue.

The only way we can test local DNS block successfully is by setting socks 5 proxy server via cmd line (case 1)

I have picked proxy servers from http://free-proxy.cz/en/proxylist/country/all/socks5/ping/all

Case 1. Setting the socks5 proxy at the app level via cmd line_PASSED

Steps:

1. Turn OFF all the Windows Firewall settings ((Domain/Private/Public)
2. Delete the existing profile from the profile folder
3. Clean profile, launch brave vis cmd line using brave.exe --proxy-server="socks5://104.218.193.144:45395"
4. loaded dnsleaktest.com
5. Clicked on Standard test and wait until it loads all the DNS requests
6. Confirmed my DNS resolvers aren't found and listed instead DNS query is getting proxied via the socks 5 Proxy server

Example	Example

Case 2. Setting the socks5 proxy in the Internet Options ->Connections->LAN settings->Proxy Server->Advanced->Proxy Settings-> set socks 5 proxy servers_FAILED

Steps:

1. Turn OFF all the Windows Firewall settings ((Domain/Private/Public)
2. Setup the proxy server in the Internet Options (shown in the image below)
3. Launch brave manually
4. loaded dnsleaktest.com
5. Observe the correct proxy detected (shown in the image below)
6. Clicked on Standard test and wait until it loads all the DNS requests
7. DNS query is not getting proxied via the Proxy server instead it leaks the local ISP DNS hence tests fails

Example	Example	Example