Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 2458 insertions, 0 deletions

diff --git a/netwerk/base/nsProtocolProxyService.cpp b/netwerk/base/nsProtocolProxyService.cpp
new file mode 100644
index 0000000000..07a752a94f
--- /dev/null
+++ b/netwerk/base/nsProtocolProxyService.cpp
@@ -0,0 +1,2458 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=4 sw=2 sts=2 et: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/AutoRestore.h"
+
+#include "nsProtocolProxyService.h"
+#include "nsProxyInfo.h"
+#include "nsIClassInfoImpl.h"
+#include "nsIIOService.h"
+#include "nsIObserverService.h"
+#include "nsIProtocolHandler.h"
+#include "nsIProtocolProxyCallback.h"
+#include "nsIChannel.h"
+#include "nsICancelable.h"
+#include "nsDNSService2.h"
+#include "nsPIDNSService.h"
+#include "nsIPrefBranch.h"
+#include "nsIPrefService.h"
+#include "nsContentUtils.h"
+#include "nsCRT.h"
+#include "nsThreadUtils.h"
+#include "nsQueryObject.h"
+#include "nsSOCKSIOLayer.h"
+#include "nsString.h"
+#include "nsNetUtil.h"
+#include "nsNetCID.h"
+#include "prnetdb.h"
+#include "nsPACMan.h"
+#include "nsProxyRelease.h"
+#include "mozilla/Mutex.h"
+#include "mozilla/CondVar.h"
+#include "nsISystemProxySettings.h"
+#include "nsINetworkLinkService.h"
+#include "nsIHttpChannelInternal.h"
+#include "mozilla/dom/nsMixedContentBlocker.h"
+#include "mozilla/Logging.h"
+#include "mozilla/ScopeExit.h"
+#include "mozilla/StaticPrefs_network.h"
+#include "mozilla/Tokenizer.h"
+#include "mozilla/Unused.h"
+
+//----------------------------------------------------------------------------
+
+namespace mozilla {
+namespace net {
+
+extern const char kProxyType_HTTP[];
+extern const char kProxyType_HTTPS[];
+extern const char kProxyType_SOCKS[];
+extern const char kProxyType_SOCKS4[];
+extern const char kProxyType_SOCKS5[];
+extern const char kProxyType_DIRECT[];
+extern const char kProxyType_PROXY[];
+
+#undef LOG
+#define LOG(args) MOZ_LOG(gProxyLog, LogLevel::Debug, args)
+
+//----------------------------------------------------------------------------
+
+#define PROXY_PREF_BRANCH "network.proxy"
+#define PROXY_PREF(x) PROXY_PREF_BRANCH "." x
+
+//----------------------------------------------------------------------------
+
+// This structure is intended to be allocated on the stack
+struct nsProtocolInfo {
+  nsAutoCString scheme;
+  uint32_t flags = 0;
+  int32_t defaultPort = 0;
+};
+
+//----------------------------------------------------------------------------
+
+// Return the channel's proxy URI, or if it doesn't exist, the
+// channel's main URI.
+static nsresult GetProxyURI(nsIChannel* channel, nsIURI** aOut) {
+  nsresult rv = NS_OK;
+  nsCOMPtr<nsIURI> proxyURI;
+  nsCOMPtr<nsIHttpChannelInternal> httpChannel(do_QueryInterface(channel));
+  if (httpChannel) {
+    rv = httpChannel->GetProxyURI(getter_AddRefs(proxyURI));
+  }
+  if (!proxyURI) {
+    rv = channel->GetURI(getter_AddRefs(proxyURI));
+  }
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  proxyURI.forget(aOut);
+  return NS_OK;
+}
+
+//-----------------------------------------------------------------------------
+
+nsProtocolProxyService::FilterLink::FilterLink(uint32_t p,
+                                               nsIProtocolProxyFilter* f)
+    : position(p), filter(f), channelFilter(nullptr) {
+  LOG(("nsProtocolProxyService::FilterLink::FilterLink %p, filter=%p", this,
+       f));
+}
+nsProtocolProxyService::FilterLink::FilterLink(
+    uint32_t p, nsIProtocolProxyChannelFilter* cf)
+    : position(p), filter(nullptr), channelFilter(cf) {
+  LOG(("nsProtocolProxyService::FilterLink::FilterLink %p, channel-filter=%p",
+       this, cf));
+}
+
+nsProtocolProxyService::FilterLink::~FilterLink() {
+  LOG(("nsProtocolProxyService::FilterLink::~FilterLink %p", this));
+}
+
+//-----------------------------------------------------------------------------
+
+// The nsPACManCallback portion of this implementation should be run
+// on the main thread - so call nsPACMan::AsyncGetProxyForURI() with
+// a true mainThreadResponse parameter.
+class nsAsyncResolveRequest final : public nsIRunnable,
+                                    public nsPACManCallback,
+                                    public nsICancelable {
+ public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+
+  nsAsyncResolveRequest(nsProtocolProxyService* pps, nsIChannel* channel,
+                        uint32_t aResolveFlags,
+                        nsIProtocolProxyCallback* callback)
+      : mResolveFlags(aResolveFlags),
+        mPPS(pps),
+        mXPComPPS(pps),
+        mChannel(channel),
+        mCallback(callback) {
+    NS_ASSERTION(mCallback, "null callback");
+  }
+
+ private:
+  ~nsAsyncResolveRequest() {
+    if (!NS_IsMainThread()) {
+      // these xpcom pointers might need to be proxied back to the
+      // main thread to delete safely, but if this request had its
+      // callbacks called normally they will all be null and this is a nop
+
+      if (mChannel) {
+        NS_ReleaseOnMainThread("nsAsyncResolveRequest::mChannel",
+                               mChannel.forget());
+      }
+
+      if (mCallback) {
+        NS_ReleaseOnMainThread("nsAsyncResolveRequest::mCallback",
+                               mCallback.forget());
+      }
+
+      if (mProxyInfo) {
+        NS_ReleaseOnMainThread("nsAsyncResolveRequest::mProxyInfo",
+                               mProxyInfo.forget());
+      }
+
+      if (mXPComPPS) {
+        NS_ReleaseOnMainThread("nsAsyncResolveRequest::mXPComPPS",
+                               mXPComPPS.forget());
+      }
+    }
+  }
+
+  // Helper class to loop over all registered asynchronous filters.
+  // There is a cycle between nsAsyncResolveRequest and this class that
+  // is broken after the last filter has called back on this object.
+  class AsyncApplyFilters final : public nsIProxyProtocolFilterResult,
+                                  public nsIRunnable,
+                                  public nsICancelable {
+    // The reference counter is thread-safe, but the processing logic is
+    // considered single thread only.  We want the counter be thread safe,
+    // since this class can be released on a background thread.
+    NS_DECL_THREADSAFE_ISUPPORTS
+    NS_DECL_NSIPROXYPROTOCOLFILTERRESULT
+    NS_DECL_NSIRUNNABLE
+    NS_DECL_NSICANCELABLE
+
+    using Callback =
+        std::function<nsresult(nsAsyncResolveRequest*, nsIProxyInfo*, bool)>;
+
+    explicit AsyncApplyFilters(nsProtocolInfo& aInfo,
+                               Callback const& aCallback);
+    // This method starts the processing or filters.  If all of them
+    // answer synchronously (call back from within applyFilters) this method
+    // will return immediately and the returning result will carry return
+    // result of the callback given in constructor.
+    // This method is looping the registered filters (that have been copied
+    // locally) as long as an answer from a filter is obtained synchronously.
+    // Note that filters are processed serially to let them build a list
+    // of proxy info.
+    nsresult AsyncProcess(nsAsyncResolveRequest* aRequest);
+
+   private:
+    using FilterLink = nsProtocolProxyService::FilterLink;
+
+    virtual ~AsyncApplyFilters();
+    // Processes the next filter and loops until a filter is successfully
+    // called on or it has called back to us.
+    nsresult ProcessNextFilter();
+    // Called after the last filter has been processed (=called back or failed
+    // to be called on)
+    nsresult Finish();
+
+    nsProtocolInfo mInfo;
+    // This is nullified before we call back on the request or when
+    // Cancel() on this object has been called to break the cycle
+    // and signal to stop.
+    RefPtr<nsAsyncResolveRequest> mRequest;
+    Callback mCallback;
+    // A shallow snapshot of filters as they were registered at the moment
+    // we started to process filters for the given resolve request.
+    nsTArray<RefPtr<FilterLink>> mFiltersCopy;
+
+    nsTArray<RefPtr<FilterLink>>::index_type mNextFilterIndex;
+    // true when we are calling ProcessNextFilter() from inside AsyncProcess(),
+    // false otherwise.
+    bool mProcessingInLoop;
+    // true after a filter called back to us with a result, dropped to false
+    // just before we call a filter.
+    bool mFilterCalledBack;
+
+    // This keeps the initial value we pass to the first filter in line and also
+    // collects the result from each filter call.
+    nsCOMPtr<nsIProxyInfo> mProxyInfo;
+
+    // The logic is written as non-thread safe, assert single-thread usage.
+    nsCOMPtr<nsISerialEventTarget> mProcessingThread;
+  };
+
+  void EnsureResolveFlagsMatch() {
+    nsCOMPtr<nsProxyInfo> pi = do_QueryInterface(mProxyInfo);
+    if (!pi || pi->ResolveFlags() == mResolveFlags) {
+      return;
+    }
+
+    nsCOMPtr<nsIProxyInfo> proxyInfo =
+        pi->CloneProxyInfoWithNewResolveFlags(mResolveFlags);
+    mProxyInfo.swap(proxyInfo);
+  }
+
+ public:
+  nsresult ProcessLocally(nsProtocolInfo& info, nsIProxyInfo* pi,
+                          bool isSyncOK) {
+    SetResult(NS_OK, pi);
+
+    auto consumeFiltersResult = [isSyncOK](nsAsyncResolveRequest* ctx,
+                                           nsIProxyInfo* pi,
+                                           bool aCalledAsync) -> nsresult {
+      ctx->SetResult(NS_OK, pi);
+      if (isSyncOK || aCalledAsync) {
+        ctx->Run();
+        return NS_OK;
+      }
+
+      return ctx->DispatchCallback();
+    };
+
+    mAsyncFilterApplier = new AsyncApplyFilters(info, consumeFiltersResult);
+    // may call consumeFiltersResult() directly
+    return mAsyncFilterApplier->AsyncProcess(this);
+  }
+
+  void SetResult(nsresult status, nsIProxyInfo* pi) {
+    mStatus = status;
+    mProxyInfo = pi;
+  }
+
+  NS_IMETHOD Run() override {
+    if (mCallback) DoCallback();
+    return NS_OK;
+  }
+
+  NS_IMETHOD Cancel(nsresult reason) override {
+    NS_ENSURE_ARG(NS_FAILED(reason));
+
+    if (mAsyncFilterApplier) {
+      mAsyncFilterApplier->Cancel(reason);
+    }
+
+    // If we've already called DoCallback then, nothing more to do.
+    if (!mCallback) return NS_OK;
+
+    SetResult(reason, nullptr);
+    return DispatchCallback();
+  }
+
+  nsresult DispatchCallback() {
+    if (mDispatched) {  // Only need to dispatch once
+      return NS_OK;
+    }
+
+    nsresult rv = NS_DispatchToCurrentThread(this);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("unable to dispatch callback event");
+    } else {
+      mDispatched = true;
+      return NS_OK;
+    }
+
+    mCallback = nullptr;  // break possible reference cycle
+    return rv;
+  }
+
+ private:
+  // Called asynchronously, so we do not need to post another PLEvent
+  // before calling DoCallback.
+  void OnQueryComplete(nsresult status, const nsACString& pacString,
+                       const nsACString& newPACURL) override {
+    // If we've already called DoCallback then, nothing more to do.
+    if (!mCallback) return;
+
+    // Provided we haven't been canceled...
+    if (mStatus == NS_OK) {
+      mStatus = status;
+      mPACString = pacString;
+      mPACURL = newPACURL;
+    }
+
+    // In the cancelation case, we may still have another PLEvent in
+    // the queue that wants to call DoCallback.  No need to wait for
+    // it, just run the callback now.
+    DoCallback();
+  }
+
+  void DoCallback() {
+    bool pacAvailable = true;
+    if (mStatus == NS_ERROR_NOT_AVAILABLE && !mProxyInfo) {
+      // If the PAC service is not avail (e.g. failed pac load
+      // or shutdown) then we will be going direct. Make that
+      // mapping now so that any filters are still applied.
+      mPACString = "DIRECT;"_ns;
+      mStatus = NS_OK;
+
+      LOG(("pac not available, use DIRECT\n"));
+      pacAvailable = false;
+    }
+
+    // Generate proxy info from the PAC string if appropriate
+    if (NS_SUCCEEDED(mStatus) && !mProxyInfo && !mPACString.IsEmpty()) {
+      mPPS->ProcessPACString(mPACString, mResolveFlags,
+                             getter_AddRefs(mProxyInfo));
+      nsCOMPtr<nsIURI> proxyURI;
+      GetProxyURI(mChannel, getter_AddRefs(proxyURI));
+
+      // Now apply proxy filters
+      nsProtocolInfo info;
+      mStatus = mPPS->GetProtocolInfo(proxyURI, &info);
+
+      auto consumeFiltersResult = [pacAvailable](nsAsyncResolveRequest* self,
+                                                 nsIProxyInfo* pi,
+                                                 bool async) -> nsresult {
+        LOG(("DoCallback::consumeFiltersResult this=%p, pi=%p, async=%d", self,
+             pi, async));
+
+        self->mProxyInfo = pi;
+
+        if (pacAvailable) {
+          // if !pacAvailable, it was already logged above
+          LOG(("pac thread callback %s\n", self->mPACString.get()));
+        }
+
+        if (NS_SUCCEEDED(self->mStatus)) {
+          self->mPPS->MaybeDisableDNSPrefetch(self->mProxyInfo);
+        }
+
+        self->EnsureResolveFlagsMatch();
+        self->mCallback->OnProxyAvailable(self, self->mChannel,
+                                          self->mProxyInfo, self->mStatus);
+
+        return NS_OK;
+      };
+
+      if (NS_SUCCEEDED(mStatus)) {
+        mAsyncFilterApplier = new AsyncApplyFilters(info, consumeFiltersResult);
+        // This may call consumeFiltersResult() directly.
+        mAsyncFilterApplier->AsyncProcess(this);
+        return;
+      }
+
+      consumeFiltersResult(this, nullptr, false);
+    } else if (NS_SUCCEEDED(mStatus) && !mPACURL.IsEmpty()) {
+      LOG(("pac thread callback indicates new pac file load\n"));
+
+      nsCOMPtr<nsIURI> proxyURI;
+      GetProxyURI(mChannel, getter_AddRefs(proxyURI));
+
+      // trigger load of new pac url
+      nsresult rv = mPPS->ConfigureFromPAC(mPACURL, false);
+      if (NS_SUCCEEDED(rv)) {
+        // now that the load is triggered, we can resubmit the query
+        RefPtr<nsAsyncResolveRequest> newRequest =
+            new nsAsyncResolveRequest(mPPS, mChannel, mResolveFlags, mCallback);
+        rv = mPPS->mPACMan->AsyncGetProxyForURI(proxyURI, newRequest,
+                                                mResolveFlags, true);
+      }
+
+      if (NS_FAILED(rv)) {
+        mCallback->OnProxyAvailable(this, mChannel, nullptr, rv);
+      }
+
+      // do not call onproxyavailable() in SUCCESS case - the newRequest will
+      // take care of that
+    } else {
+      LOG(("pac thread callback did not provide information %" PRIX32 "\n",
+           static_cast<uint32_t>(mStatus)));
+      if (NS_SUCCEEDED(mStatus)) mPPS->MaybeDisableDNSPrefetch(mProxyInfo);
+      EnsureResolveFlagsMatch();
+      mCallback->OnProxyAvailable(this, mChannel, mProxyInfo, mStatus);
+    }
+
+    // We are on the main thread now and don't need these any more so
+    // release them to avoid having to proxy them back to the main thread
+    // in the dtor
+    mCallback = nullptr;  // in case the callback holds an owning ref to us
+    mPPS = nullptr;
+    mXPComPPS = nullptr;
+    mChannel = nullptr;
+    mProxyInfo = nullptr;
+  }
+
+ private:
+  nsresult mStatus{NS_OK};
+  nsCString mPACString;
+  nsCString mPACURL;
+  bool mDispatched{false};
+  uint32_t mResolveFlags;
+
+  nsProtocolProxyService* mPPS;
+  nsCOMPtr<nsIProtocolProxyService> mXPComPPS;
+  nsCOMPtr<nsIChannel> mChannel;
+  nsCOMPtr<nsIProtocolProxyCallback> mCallback;
+  nsCOMPtr<nsIProxyInfo> mProxyInfo;
+
+  RefPtr<AsyncApplyFilters> mAsyncFilterApplier;
+};
+
+NS_IMPL_ISUPPORTS(nsAsyncResolveRequest, nsICancelable, nsIRunnable)
+
+NS_IMPL_ISUPPORTS(nsAsyncResolveRequest::AsyncApplyFilters,
+                  nsIProxyProtocolFilterResult, nsICancelable, nsIRunnable)
+
+nsAsyncResolveRequest::AsyncApplyFilters::AsyncApplyFilters(
+    nsProtocolInfo& aInfo, Callback const& aCallback)
+    : mInfo(aInfo),
+      mCallback(aCallback),
+      mNextFilterIndex(0),
+      mProcessingInLoop(false),
+      mFilterCalledBack(false) {
+  LOG(("AsyncApplyFilters %p", this));
+}
+
+nsAsyncResolveRequest::AsyncApplyFilters::~AsyncApplyFilters() {
+  LOG(("~AsyncApplyFilters %p", this));
+
+  MOZ_ASSERT(!mRequest);
+  MOZ_ASSERT(!mProxyInfo);
+  MOZ_ASSERT(!mFiltersCopy.Length());
+}
+
+nsresult nsAsyncResolveRequest::AsyncApplyFilters::AsyncProcess(
+    nsAsyncResolveRequest* aRequest) {
+  LOG(("AsyncApplyFilters::AsyncProcess %p for req %p", this, aRequest));
+
+  MOZ_ASSERT(!mRequest, "AsyncApplyFilters started more than once!");
+
+  if (!(mInfo.flags & nsIProtocolHandler::ALLOWS_PROXY)) {
+    // Calling the callback directly (not via Finish()) since we
+    // don't want to prune.
+    return mCallback(aRequest, aRequest->mProxyInfo, false);
+  }
+
+  mProcessingThread = NS_GetCurrentThread();
+
+  mRequest = aRequest;
+  mProxyInfo = aRequest->mProxyInfo;
+
+  aRequest->mPPS->CopyFilters(mFiltersCopy);
+
+  // We want to give filters a chance to process in a single loop to prevent
+  // any current-thread dispatch delays when those are not needed.
+  // This code is rather "loopy" than "recursive" to prevent long stack traces.
+  do {
+    MOZ_ASSERT(!mProcessingInLoop);
+
+    mozilla::AutoRestore<bool> restore(mProcessingInLoop);
+    mProcessingInLoop = true;
+
+    nsresult rv = ProcessNextFilter();
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  } while (mFilterCalledBack);
+
+  return NS_OK;
+}
+
+nsresult nsAsyncResolveRequest::AsyncApplyFilters::ProcessNextFilter() {
+  LOG(("AsyncApplyFilters::ProcessNextFilter %p ENTER pi=%p", this,
+       mProxyInfo.get()));
+
+  RefPtr<FilterLink> filter;
+  do {
+    mFilterCalledBack = false;
+
+    if (!mRequest) {
+      // We got canceled
+      LOG(("  canceled"));
+      return NS_OK;  // should we let the consumer know?
+    }
+
+    if (mNextFilterIndex == mFiltersCopy.Length()) {
+      return Finish();
+    }
+
+    filter = mFiltersCopy[mNextFilterIndex++];
+
+    // Loop until a call to a filter succeeded.  Other option is to recurse
+    // but that would waste stack trace when a number of filters gets registered
+    // and all from some reason tend to fail.
+    // The !mFilterCalledBack part of the condition is there to protect us from
+    // calling on another filter when the current one managed to call back and
+    // then threw. We already have the result so take it and use it since
+    // the next filter will be processed by the root loop or a call to
+    // ProcessNextFilter has already been dispatched to this thread.
+    LOG(("  calling filter %p pi=%p", filter.get(), mProxyInfo.get()));
+  } while (!mRequest->mPPS->ApplyFilter(filter, mRequest->mChannel, mInfo,
+                                        mProxyInfo, this) &&
+           !mFilterCalledBack);
+
+  LOG(("AsyncApplyFilters::ProcessNextFilter %p LEAVE pi=%p", this,
+       mProxyInfo.get()));
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAsyncResolveRequest::AsyncApplyFilters::OnProxyFilterResult(
+    nsIProxyInfo* aProxyInfo) {
+  LOG(("AsyncApplyFilters::OnProxyFilterResult %p pi=%p", this, aProxyInfo));
+
+  MOZ_ASSERT(mProcessingThread && mProcessingThread->IsOnCurrentThread());
+  MOZ_ASSERT(!mFilterCalledBack);
+
+  if (mFilterCalledBack) {
+    LOG(("  duplicate notification?"));
+    return NS_OK;
+  }
+
+  mFilterCalledBack = true;
+
+  if (!mRequest) {
+    // We got canceled
+    LOG(("  canceled"));
+    return NS_OK;
+  }
+
+  mProxyInfo = aProxyInfo;
+
+  if (mProcessingInLoop) {
+    // No need to call/dispatch ProcessNextFilter(), we are in a control
+    // loop that will do this for us and save recursion/dispatching.
+    LOG(("  in a root loop"));
+    return NS_OK;
+  }
+
+  if (mNextFilterIndex == mFiltersCopy.Length()) {
+    // We are done, all filters have been called on!
+    Finish();
+    return NS_OK;
+  }
+
+  // Redispatch, since we don't want long stacks when filters respond
+  // synchronously.
+  LOG(("  redispatching"));
+  NS_DispatchToCurrentThread(this);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAsyncResolveRequest::AsyncApplyFilters::Run() {
+  LOG(("AsyncApplyFilters::Run %p", this));
+
+  MOZ_ASSERT(mProcessingThread && mProcessingThread->IsOnCurrentThread());
+
+  ProcessNextFilter();
+  return NS_OK;
+}
+
+nsresult nsAsyncResolveRequest::AsyncApplyFilters::Finish() {
+  LOG(("AsyncApplyFilters::Finish %p pi=%p", this, mProxyInfo.get()));
+
+  MOZ_ASSERT(mRequest);
+
+  mFiltersCopy.Clear();
+
+  RefPtr<nsAsyncResolveRequest> request;
+  request.swap(mRequest);
+
+  nsCOMPtr<nsIProxyInfo> pi;
+  pi.swap(mProxyInfo);
+
+  request->mPPS->PruneProxyInfo(mInfo, pi);
+  return mCallback(request, pi, !mProcessingInLoop);
+}
+
+NS_IMETHODIMP
+nsAsyncResolveRequest::AsyncApplyFilters::Cancel(nsresult reason) {
+  LOG(("AsyncApplyFilters::Cancel %p", this));
+
+  MOZ_ASSERT(mProcessingThread && mProcessingThread->IsOnCurrentThread());
+
+  // This will be called only from inside the request, so don't call
+  // its's callback.  Dropping the members means we simply break the cycle.
+  mFiltersCopy.Clear();
+  mProxyInfo = nullptr;
+  mRequest = nullptr;
+
+  return NS_OK;
+}
+
+// Bug 1366133: make GetPACURI off-main-thread since it may hang on Windows
+// platform
+class AsyncGetPACURIRequest final : public nsIRunnable {
+ public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+
+  using CallbackFunc = nsresult (nsProtocolProxyService::*)(bool, bool,
+                                                            nsresult,
+                                                            const nsACString&);
+
+  AsyncGetPACURIRequest(nsProtocolProxyService* aService,
+                        CallbackFunc aCallback,
+                        nsISystemProxySettings* aSystemProxySettings,
+                        bool aMainThreadOnly, bool aForceReload,
+                        bool aResetPACThread)
+      : mIsMainThreadOnly(aMainThreadOnly),
+        mService(aService),
+        mServiceHolder(do_QueryObject(aService)),
+        mCallback(aCallback),
+        mSystemProxySettings(aSystemProxySettings),
+        mForceReload(aForceReload),
+        mResetPACThread(aResetPACThread) {
+    MOZ_ASSERT(NS_IsMainThread());
+    Unused << mIsMainThreadOnly;
+  }
+
+  NS_IMETHOD Run() override {
+    MOZ_ASSERT(NS_IsMainThread() == mIsMainThreadOnly);
+
+    nsCString pacUri;
+    nsresult rv = mSystemProxySettings->GetPACURI(pacUri);
+
+    nsCOMPtr<nsIRunnable> event =
+        NewNonOwningCancelableRunnableMethod<bool, bool, nsresult, nsCString>(
+            "AsyncGetPACURIRequestCallback", mService, mCallback, mForceReload,
+            mResetPACThread, rv, pacUri);
+
+    return NS_DispatchToMainThread(event);
+  }
+
+ private:
+  ~AsyncGetPACURIRequest() {
+    NS_ReleaseOnMainThread("AsyncGetPACURIRequest::mServiceHolder",
+                           mServiceHolder.forget());
+  }
+
+  bool mIsMainThreadOnly;
+
+  nsProtocolProxyService* mService;  // ref-count is hold by mServiceHolder
+  nsCOMPtr<nsIProtocolProxyService2> mServiceHolder;
+  CallbackFunc mCallback;
+  nsCOMPtr<nsISystemProxySettings> mSystemProxySettings;
+
+  bool mForceReload;
+  bool mResetPACThread;
+};
+
+NS_IMPL_ISUPPORTS(AsyncGetPACURIRequest, nsIRunnable)
+
+//----------------------------------------------------------------------------
+
+//
+// apply mask to address (zeros out excluded bits).
+//
+// NOTE: we do the byte swapping here to minimize overall swapping.
+//
+static void proxy_MaskIPv6Addr(PRIPv6Addr& addr, uint16_t mask_len) {
+  if (mask_len == 128) return;
+
+  if (mask_len > 96) {
+    addr.pr_s6_addr32[3] =
+        PR_htonl(PR_ntohl(addr.pr_s6_addr32[3]) & (~0uL << (128 - mask_len)));
+  } else if (mask_len > 64) {
+    addr.pr_s6_addr32[3] = 0;
+    addr.pr_s6_addr32[2] =
+        PR_htonl(PR_ntohl(addr.pr_s6_addr32[2]) & (~0uL << (96 - mask_len)));
+  } else if (mask_len > 32) {
+    addr.pr_s6_addr32[3] = 0;
+    addr.pr_s6_addr32[2] = 0;
+    addr.pr_s6_addr32[1] =
+        PR_htonl(PR_ntohl(addr.pr_s6_addr32[1]) & (~0uL << (64 - mask_len)));
+  } else {
+    addr.pr_s6_addr32[3] = 0;
+    addr.pr_s6_addr32[2] = 0;
+    addr.pr_s6_addr32[1] = 0;
+    addr.pr_s6_addr32[0] =
+        PR_htonl(PR_ntohl(addr.pr_s6_addr32[0]) & (~0uL << (32 - mask_len)));
+  }
+}
+
+static void proxy_GetStringPref(nsIPrefBranch* aPrefBranch, const char* aPref,
+                                nsCString& aResult) {
+  nsAutoCString temp;
+  nsresult rv = aPrefBranch->GetCharPref(aPref, temp);
+  if (NS_FAILED(rv)) {
+    aResult.Truncate();
+  } else {
+    aResult.Assign(temp);
+    // all of our string prefs are hostnames, so we should remove any
+    // whitespace characters that the user might have unknowingly entered.
+    aResult.StripWhitespace();
+  }
+}
+
+static void proxy_GetIntPref(nsIPrefBranch* aPrefBranch, const char* aPref,
+                             int32_t& aResult) {
+  int32_t temp;
+  nsresult rv = aPrefBranch->GetIntPref(aPref, &temp);
+  if (NS_FAILED(rv)) {
+    aResult = -1;
+  } else {
+    aResult = temp;
+  }
+}
+
+static void proxy_GetBoolPref(nsIPrefBranch* aPrefBranch, const char* aPref,
+                              bool& aResult) {
+  bool temp;
+  nsresult rv = aPrefBranch->GetBoolPref(aPref, &temp);
+  if (NS_FAILED(rv)) {
+    aResult = false;
+  } else {
+    aResult = temp;
+  }
+}
+
+//----------------------------------------------------------------------------
+
+static const int32_t PROXYCONFIG_DIRECT4X = 3;
+static const int32_t PROXYCONFIG_COUNT = 6;
+
+NS_IMPL_ADDREF(nsProtocolProxyService)
+NS_IMPL_RELEASE(nsProtocolProxyService)
+NS_IMPL_CLASSINFO(nsProtocolProxyService, nullptr, nsIClassInfo::SINGLETON,
+                  NS_PROTOCOLPROXYSERVICE_CID)
+
+// NS_IMPL_QUERY_INTERFACE_CI with the nsProtocolProxyService QI change
+NS_INTERFACE_MAP_BEGIN(nsProtocolProxyService)
+  NS_INTERFACE_MAP_ENTRY(nsIProtocolProxyService)
+  NS_INTERFACE_MAP_ENTRY(nsIProtocolProxyService2)
+  NS_INTERFACE_MAP_ENTRY(nsIObserver)
+  NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
+  NS_INTERFACE_MAP_ENTRY(nsINamed)
+  NS_INTERFACE_MAP_ENTRY_CONCRETE(nsProtocolProxyService)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIProtocolProxyService)
+  NS_IMPL_QUERY_CLASSINFO(nsProtocolProxyService)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CI_INTERFACE_GETTER(nsProtocolProxyService, nsIProtocolProxyService,
+                            nsIProtocolProxyService2)
+
+nsProtocolProxyService::nsProtocolProxyService() : mSessionStart(PR_Now()) {}
+
+nsProtocolProxyService::~nsProtocolProxyService() {
+  // These should have been cleaned up in our Observe method.
+  NS_ASSERTION(mHostFiltersArray.Length() == 0 && mFilters.Length() == 0 &&
+                   mPACMan == nullptr,
+               "what happened to xpcom-shutdown?");
+}
+
+// nsProtocolProxyService methods
+nsresult nsProtocolProxyService::Init() {
+  // failure to access prefs is non-fatal
+  nsCOMPtr<nsIPrefBranch> prefBranch = do_GetService(NS_PREFSERVICE_CONTRACTID);
+  if (prefBranch) {
+    // monitor proxy prefs
+    prefBranch->AddObserver(PROXY_PREF_BRANCH, this, false);
+
+    // read all prefs
+    PrefsChanged(prefBranch, nullptr);
+  }
+
+  nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+  if (obs) {
+    // register for shutdown notification so we can clean ourselves up
+    // properly.
+    obs->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, false);
+    obs->AddObserver(this, NS_NETWORK_LINK_TOPIC, false);
+  }
+
+  return NS_OK;
+}
+
+// ReloadNetworkPAC() checks if there's a non-networked PAC in use then avoids
+// to call ReloadPAC()
+nsresult nsProtocolProxyService::ReloadNetworkPAC() {
+  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
+  if (!prefs) {
+    return NS_OK;
+  }
+
+  int32_t type;
+  nsresult rv = prefs->GetIntPref(PROXY_PREF("type"), &type);
+  if (NS_FAILED(rv)) {
+    return NS_OK;
+  }
+
+  if (type == PROXYCONFIG_PAC) {
+    nsAutoCString pacSpec;
+    prefs->GetCharPref(PROXY_PREF("autoconfig_url"), pacSpec);
+    if (!pacSpec.IsEmpty()) {
+      nsCOMPtr<nsIURI> pacURI;
+      rv = NS_NewURI(getter_AddRefs(pacURI), pacSpec);
+      if (!NS_SUCCEEDED(rv)) {
+        return rv;
+      }
+
+      nsProtocolInfo pac;
+      rv = GetProtocolInfo(pacURI, &pac);
+      if (!NS_SUCCEEDED(rv)) {
+        return rv;
+      }
+
+      if (!pac.scheme.EqualsLiteral("file") &&
+          !pac.scheme.EqualsLiteral("data")) {
+        LOG((": received network changed event, reload PAC"));
+        ReloadPAC();
+      }
+    }
+  } else if ((type == PROXYCONFIG_WPAD) || (type == PROXYCONFIG_SYSTEM)) {
+    ReloadPAC();
+  }
+
+  return NS_OK;
+}
+
+nsresult nsProtocolProxyService::AsyncConfigureFromPAC(bool aForceReload,
+                                                       bool aResetPACThread) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  bool mainThreadOnly;
+  nsresult rv = mSystemProxySettings->GetMainThreadOnly(&mainThreadOnly);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  nsCOMPtr<nsIRunnable> req = new AsyncGetPACURIRequest(
+      this, &nsProtocolProxyService::OnAsyncGetPACURI, mSystemProxySettings,
+      mainThreadOnly, aForceReload, aResetPACThread);
+
+  if (mainThreadOnly) {
+    return req->Run();
+  }
+
+  return NS_DispatchBackgroundTask(req.forget(),
+                                   nsIEventTarget::DISPATCH_NORMAL);
+}
+
+nsresult nsProtocolProxyService::OnAsyncGetPACURI(bool aForceReload,
+                                                  bool aResetPACThread,
+                                                  nsresult aResult,
+                                                  const nsACString& aUri) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (aResetPACThread) {
+    ResetPACThread();
+  }
+
+  if (NS_SUCCEEDED(aResult) && !aUri.IsEmpty()) {
+    ConfigureFromPAC(PromiseFlatCString(aUri), aForceReload);
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::Observe(nsISupports* aSubject, const char* aTopic,
+                                const char16_t* aData) {
+  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
+    mIsShutdown = true;
+    // cleanup
+    mHostFiltersArray.Clear();
+    mFilters.Clear();
+
+    if (mPACMan) {
+      mPACMan->Shutdown();
+      mPACMan = nullptr;
+    }
+
+    if (mReloadPACTimer) {
+      mReloadPACTimer->Cancel();
+      mReloadPACTimer = nullptr;
+    }
+
+    nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
+    if (obs) {
+      obs->RemoveObserver(this, NS_NETWORK_LINK_TOPIC);
+      obs->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
+    }
+
+  } else if (strcmp(aTopic, NS_NETWORK_LINK_TOPIC) == 0) {
+    nsCString converted = NS_ConvertUTF16toUTF8(aData);
+    const char* state = converted.get();
+    if (!strcmp(state, NS_NETWORK_LINK_DATA_CHANGED)) {
+      uint32_t delay = StaticPrefs::network_proxy_reload_pac_delay();
+      LOG(("nsProtocolProxyService::Observe call ReloadNetworkPAC() delay=%u",
+           delay));
+
+      if (delay) {
+        if (mReloadPACTimer) {
+          mReloadPACTimer->Cancel();
+          mReloadPACTimer = nullptr;
+        }
+        NS_NewTimerWithCallback(getter_AddRefs(mReloadPACTimer), this, delay,
+                                nsITimer::TYPE_ONE_SHOT);
+      } else {
+        ReloadNetworkPAC();
+      }
+    }
+  } else {
+    NS_ASSERTION(strcmp(aTopic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID) == 0,
+                 "what is this random observer event?");
+    nsCOMPtr<nsIPrefBranch> prefs = do_QueryInterface(aSubject);
+    if (prefs) PrefsChanged(prefs, NS_LossyConvertUTF16toASCII(aData).get());
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::Notify(nsITimer* aTimer) {
+  MOZ_ASSERT(aTimer == mReloadPACTimer);
+  ReloadNetworkPAC();
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::GetName(nsACString& aName) {
+  aName.AssignLiteral("nsProtocolProxyService");
+  return NS_OK;
+}
+
+void nsProtocolProxyService::PrefsChanged(nsIPrefBranch* prefBranch,
+                                          const char* pref) {
+  nsresult rv = NS_OK;
+  bool reloadPAC = false;
+  nsAutoCString tempString;
+  auto invokeCallback =
+      MakeScopeExit([&] { NotifyProxyConfigChangedInternal(); });
+
+  if (!pref || !strcmp(pref, PROXY_PREF("type"))) {
+    int32_t type = -1;
+    rv = prefBranch->GetIntPref(PROXY_PREF("type"), &type);
+    if (NS_SUCCEEDED(rv)) {
+      // bug 115720 - for ns4.x backwards compatibility
+      if (type == PROXYCONFIG_DIRECT4X) {
+        type = PROXYCONFIG_DIRECT;
+        // Reset the type so that the dialog looks correct, and we
+        // don't have to handle this case everywhere else
+        // I'm paranoid about a loop of some sort - only do this
+        // if we're enumerating all prefs, and ignore any error
+        if (!pref) prefBranch->SetIntPref(PROXY_PREF("type"), type);
+      } else if (type >= PROXYCONFIG_COUNT) {
+        LOG(("unknown proxy type: %" PRId32 "; assuming direct\n", type));
+        type = PROXYCONFIG_DIRECT;
+      }
+      mProxyConfig = type;
+      reloadPAC = true;
+    }
+
+    if (mProxyConfig == PROXYCONFIG_SYSTEM) {
+      mSystemProxySettings = do_GetService(NS_SYSTEMPROXYSETTINGS_CONTRACTID);
+      if (!mSystemProxySettings) mProxyConfig = PROXYCONFIG_DIRECT;
+      ResetPACThread();
+    } else {
+      if (mSystemProxySettings) {
+        mSystemProxySettings = nullptr;
+        ResetPACThread();
+      }
+    }
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("http"))) {
+    proxy_GetStringPref(prefBranch, PROXY_PREF("http"), mHTTPProxyHost);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("http_port"))) {
+    proxy_GetIntPref(prefBranch, PROXY_PREF("http_port"), mHTTPProxyPort);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("ssl"))) {
+    proxy_GetStringPref(prefBranch, PROXY_PREF("ssl"), mHTTPSProxyHost);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("ssl_port"))) {
+    proxy_GetIntPref(prefBranch, PROXY_PREF("ssl_port"), mHTTPSProxyPort);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("socks"))) {
+    proxy_GetStringPref(prefBranch, PROXY_PREF("socks"), mSOCKSProxyTarget);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("socks_port"))) {
+    proxy_GetIntPref(prefBranch, PROXY_PREF("socks_port"), mSOCKSProxyPort);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("socks_version"))) {
+    int32_t version;
+    proxy_GetIntPref(prefBranch, PROXY_PREF("socks_version"), version);
+    // make sure this preference value remains sane
+    if (version == 5) {
+      mSOCKSProxyVersion = 5;
+    } else {
+      mSOCKSProxyVersion = 4;
+    }
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("socks_remote_dns"))) {
+    proxy_GetBoolPref(prefBranch, PROXY_PREF("socks_remote_dns"),
+                      mSOCKSProxyRemoteDNS);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("proxy_over_tls"))) {
+    proxy_GetBoolPref(prefBranch, PROXY_PREF("proxy_over_tls"), mProxyOverTLS);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("enable_wpad_over_dhcp"))) {
+    proxy_GetBoolPref(prefBranch, PROXY_PREF("enable_wpad_over_dhcp"),
+                      mWPADOverDHCPEnabled);
+    reloadPAC = reloadPAC || mProxyConfig == PROXYCONFIG_WPAD;
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("failover_timeout"))) {
+    proxy_GetIntPref(prefBranch, PROXY_PREF("failover_timeout"),
+                     mFailedProxyTimeout);
+  }
+
+  if (!pref || !strcmp(pref, PROXY_PREF("no_proxies_on"))) {
+    rv = prefBranch->GetCharPref(PROXY_PREF("no_proxies_on"), tempString);
+    if (NS_SUCCEEDED(rv)) LoadHostFilters(tempString);
+  }
+
+  // We're done if not using something that could give us a PAC URL
+  // (PAC, WPAD or System)
+  if (mProxyConfig != PROXYCONFIG_PAC && mProxyConfig != PROXYCONFIG_WPAD &&
+      mProxyConfig != PROXYCONFIG_SYSTEM) {
+    return;
+  }
+
+  // OK, we need to reload the PAC file if:
+  //  1) network.proxy.type changed, or
+  //  2) network.proxy.autoconfig_url changed and PAC is configured
+
+  if (!pref || !strcmp(pref, PROXY_PREF("autoconfig_url"))) reloadPAC = true;
+
+  if (reloadPAC) {
+    tempString.Truncate();
+    if (mProxyConfig == PROXYCONFIG_PAC) {
+      prefBranch->GetCharPref(PROXY_PREF("autoconfig_url"), tempString);
+      if (mPACMan && !mPACMan->IsPACURI(tempString)) {
+        LOG(("PAC Thread URI Changed - Reset Pac Thread"));
+        ResetPACThread();
+      }
+    } else if (mProxyConfig == PROXYCONFIG_WPAD) {
+      LOG(("Auto-detecting proxy - Reset Pac Thread"));
+      ResetPACThread();
+    } else if (mSystemProxySettings) {
+      // Get System Proxy settings if available
+      AsyncConfigureFromPAC(false, false);
+    }
+    if (!tempString.IsEmpty() || mProxyConfig == PROXYCONFIG_WPAD) {
+      ConfigureFromPAC(tempString, false);
+    }
+  }
+}
+
+bool nsProtocolProxyService::CanUseProxy(nsIURI* aURI, int32_t defaultPort) {
+  int32_t port;
+  nsAutoCString host;
+
+  nsresult rv = aURI->GetAsciiHost(host);
+  if (NS_FAILED(rv) || host.IsEmpty()) return false;
+
+  rv = aURI->GetPort(&port);
+  if (NS_FAILED(rv)) return false;
+  if (port == -1) port = defaultPort;
+
+  PRNetAddr addr;
+  bool is_ipaddr = (PR_StringToNetAddr(host.get(), &addr) == PR_SUCCESS);
+
+  PRIPv6Addr ipv6;
+  if (is_ipaddr) {
+    // convert parsed address to IPv6
+    if (addr.raw.family == PR_AF_INET) {
+      // convert to IPv4-mapped address
+      PR_ConvertIPv4AddrToIPv6(addr.inet.ip, &ipv6);
+    } else if (addr.raw.family == PR_AF_INET6) {
+      // copy the address
+      memcpy(&ipv6, &addr.ipv6.ip, sizeof(PRIPv6Addr));
+    } else {
+      NS_WARNING("unknown address family");
+      return true;  // allow proxying
+    }
+  }
+
+  // Don't use proxy for local hosts (plain hostname, no dots)
+  if ((!is_ipaddr && mFilterLocalHosts && !host.Contains('.')) ||
+      // This method detects if we have network.proxy.allow_hijacking_localhost
+      // pref enabled. If it's true then this method will always return false
+      // otherwise it returns true if the host matches an address that's
+      // hardcoded to the loopback address.
+      (!StaticPrefs::network_proxy_allow_hijacking_localhost() &&
+       nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackHost(host))) {
+    LOG(("Not using proxy for this local host [%s]!\n", host.get()));
+    return false;  // don't allow proxying
+  }
+
+  int32_t index = -1;
+  while (++index < int32_t(mHostFiltersArray.Length())) {
+    const auto& hinfo = mHostFiltersArray[index];
+
+    if (is_ipaddr != hinfo->is_ipaddr) continue;
+    if (hinfo->port && hinfo->port != port) continue;
+
+    if (is_ipaddr) {
+      // generate masked version of target IPv6 address
+      PRIPv6Addr masked;
+      memcpy(&masked, &ipv6, sizeof(PRIPv6Addr));
+      proxy_MaskIPv6Addr(masked, hinfo->ip.mask_len);
+
+      // check for a match
+      if (memcmp(&masked, &hinfo->ip.addr, sizeof(PRIPv6Addr)) == 0) {
+        return false;  // proxy disallowed
+      }
+    } else {
+      uint32_t host_len = host.Length();
+      uint32_t filter_host_len = hinfo->name.host_len;
+
+      if (host_len >= filter_host_len) {
+        //
+        // compare last |filter_host_len| bytes of target hostname.
+        //
+        const char* host_tail = host.get() + host_len - filter_host_len;
+        if (!nsCRT::strncasecmp(host_tail, hinfo->name.host, filter_host_len)) {
+          // If the tail of the host string matches the filter
+
+          if (filter_host_len > 0 && hinfo->name.host[0] == '.') {
+            // If the filter was of the form .foo.bar.tld, all such
+            // matches are correct
+            return false;  // proxy disallowed
+          }
+
+          // abc-def.example.org should not match def.example.org
+          // however, *.def.example.org should match .def.example.org
+          // We check that the filter doesn't start with a `.`. If it does,
+          // then the strncasecmp above should suffice. If it doesn't,
+          // then we should only consider it a match if the strncasecmp happened
+          // at a subdomain boundary
+          if (host_len > filter_host_len && *(host_tail - 1) == '.') {
+            // If the host was something.foo.bar.tld and the filter
+            // was foo.bar.tld, it's still a match.
+            // the character right before the tail must be a
+            // `.` for this to work
+            return false;  // proxy disallowed
+          }
+
+          if (host_len == filter_host_len) {
+            // If the host and filter are of the same length,
+            // they should match
+            return false;  // proxy disallowed
+          }
+        }
+      }
+    }
+  }
+  return true;
+}
+
+// kProxyType\* may be referred to externally in
+// nsProxyInfo in order to compare by string pointer
+const char kProxyType_HTTP[] = "http";
+const char kProxyType_HTTPS[] = "https";
+const char kProxyType_PROXY[] = "proxy";
+const char kProxyType_SOCKS[] = "socks";
+const char kProxyType_SOCKS4[] = "socks4";
+const char kProxyType_SOCKS5[] = "socks5";
+const char kProxyType_DIRECT[] = "direct";
+
+const char* nsProtocolProxyService::ExtractProxyInfo(const char* start,
+                                                     uint32_t aResolveFlags,
+                                                     nsProxyInfo** result) {
+  *result = nullptr;
+  uint32_t flags = 0;
+
+  // see BNF in ProxyAutoConfig.h and notes in nsISystemProxySettings.idl
+
+  // find end of proxy info delimiter
+  const char* end = start;
+  while (*end && *end != ';') ++end;
+
+  // find end of proxy type delimiter
+  const char* sp = start;
+  while (sp < end && *sp != ' ' && *sp != '\t') ++sp;
+
+  uint32_t len = sp - start;
+  const char* type = nullptr;
+  switch (len) {
+    case 4:
+      if (nsCRT::strncasecmp(start, kProxyType_HTTP, 4) == 0) {
+        type = kProxyType_HTTP;
+      }
+      break;
+    case 5:
+      if (nsCRT::strncasecmp(start, kProxyType_PROXY, 5) == 0) {
+        type = kProxyType_HTTP;
+      } else if (nsCRT::strncasecmp(start, kProxyType_SOCKS, 5) == 0) {
+        type = kProxyType_SOCKS4;  // assume v4 for 4x compat
+        if (StaticPrefs::network_proxy_default_pac_script_socks_version() ==
+            5) {
+          type = kProxyType_SOCKS;
+        }
+      } else if (nsCRT::strncasecmp(start, kProxyType_HTTPS, 5) == 0) {
+        type = kProxyType_HTTPS;
+      }
+      break;
+    case 6:
+      if (nsCRT::strncasecmp(start, kProxyType_DIRECT, 6) == 0) {
+        type = kProxyType_DIRECT;
+      } else if (nsCRT::strncasecmp(start, kProxyType_SOCKS4, 6) == 0) {
+        type = kProxyType_SOCKS4;
+      } else if (nsCRT::strncasecmp(start, kProxyType_SOCKS5, 6) == 0) {
+        // map "SOCKS5" to "socks" to match contract-id of registered
+        // SOCKS-v5 socket provider.
+        type = kProxyType_SOCKS;
+      }
+      break;
+  }
+  if (type) {
+    int32_t port = -1;
+
+    // If it's a SOCKS5 proxy, do name resolution on the server side.
+    // We could use this with SOCKS4a servers too, but they might not
+    // support it.
+    if (type == kProxyType_SOCKS || mSOCKSProxyRemoteDNS) {
+      flags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
+    }
+
+    // extract host:port
+    start = sp;
+    while ((*start == ' ' || *start == '\t') && start < end) start++;
+
+    // port defaults
+    if (type == kProxyType_HTTP) {
+      port = 80;
+    } else if (type == kProxyType_HTTPS) {
+      port = 443;
+    } else {
+      port = 1080;
+    }
+
+    RefPtr<nsProxyInfo> pi = new nsProxyInfo();
+    pi->mType = type;
+    pi->mFlags = flags;
+    pi->mResolveFlags = aResolveFlags;
+    pi->mTimeout = mFailedProxyTimeout;
+
+    // www.foo.com:8080 and http://www.foo.com:8080
+    nsDependentCSubstring maybeURL(start, end - start);
+    nsCOMPtr<nsIURI> pacURI;
+
+    nsAutoCString urlHost;
+    // First assume the scheme is present, e.g. http://www.example.com:8080
+    if (NS_FAILED(NS_NewURI(getter_AddRefs(pacURI), maybeURL)) ||
+        NS_FAILED(pacURI->GetAsciiHost(urlHost)) || urlHost.IsEmpty()) {
+      // It isn't, assume www.example.com:8080
+      maybeURL.Insert("http://", 0);
+
+      if (NS_SUCCEEDED(NS_NewURI(getter_AddRefs(pacURI), maybeURL))) {
+        pacURI->GetAsciiHost(urlHost);
+      }
+    }
+
+    if (!urlHost.IsEmpty()) {
+      pi->mHost = urlHost;
+
+      int32_t tPort;
+      if (NS_SUCCEEDED(pacURI->GetPort(&tPort)) && tPort != -1) {
+        port = tPort;
+      }
+      pi->mPort = port;
+    }
+
+    pi.forget(result);
+  }
+
+  while (*end == ';' || *end == ' ' || *end == '\t') ++end;
+  return end;
+}
+
+void nsProtocolProxyService::GetProxyKey(nsProxyInfo* pi, nsCString& key) {
+  key.AssignASCII(pi->mType);
+  if (!pi->mHost.IsEmpty()) {
+    key.Append(' ');
+    key.Append(pi->mHost);
+    key.Append(':');
+    key.AppendInt(pi->mPort);
+  }
+}
+
+uint32_t nsProtocolProxyService::SecondsSinceSessionStart() {
+  PRTime now = PR_Now();
+
+  // get time elapsed since session start
+  int64_t diff = now - mSessionStart;
+
+  // convert microseconds to seconds
+  diff /= PR_USEC_PER_SEC;
+
+  // return converted 32 bit value
+  return uint32_t(diff);
+}
+
+void nsProtocolProxyService::EnableProxy(nsProxyInfo* pi) {
+  nsAutoCString key;
+  GetProxyKey(pi, key);
+  mFailedProxies.Remove(key);
+}
+
+void nsProtocolProxyService::DisableProxy(nsProxyInfo* pi) {
+  nsAutoCString key;
+  GetProxyKey(pi, key);
+
+  uint32_t dsec = SecondsSinceSessionStart();
+
+  // Add timeout to interval (this is the time when the proxy can
+  // be tried again).
+  dsec += pi->mTimeout;
+
+  // NOTE: The classic codebase would increase the timeout value
+  //       incrementally each time a subsequent failure occurred.
+  //       We could do the same, but it would require that we not
+  //       remove proxy entries in IsProxyDisabled or otherwise
+  //       change the way we are recording disabled proxies.
+  //       Simpler is probably better for now, and at least the
+  //       user can tune the timeout setting via preferences.
+
+  LOG(("DisableProxy %s %d\n", key.get(), dsec));
+
+  // If this fails, oh well... means we don't have enough memory
+  // to remember the failed proxy.
+  mFailedProxies.InsertOrUpdate(key, dsec);
+}
+
+bool nsProtocolProxyService::IsProxyDisabled(nsProxyInfo* pi) {
+  nsAutoCString key;
+  GetProxyKey(pi, key);
+
+  uint32_t val;
+  if (!mFailedProxies.Get(key, &val)) return false;
+
+  uint32_t dsec = SecondsSinceSessionStart();
+
+  // if time passed has exceeded interval, then try proxy again.
+  if (dsec > val) {
+    mFailedProxies.Remove(key);
+    return false;
+  }
+
+  return true;
+}
+
+nsresult nsProtocolProxyService::SetupPACThread(
+    nsISerialEventTarget* mainThreadEventTarget) {
+  if (mIsShutdown) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (mPACMan) return NS_OK;
+
+  mPACMan = new nsPACMan(mainThreadEventTarget);
+
+  bool mainThreadOnly;
+  nsresult rv;
+  if (mSystemProxySettings &&
+      NS_SUCCEEDED(mSystemProxySettings->GetMainThreadOnly(&mainThreadOnly)) &&
+      !mainThreadOnly) {
+    rv = mPACMan->Init(mSystemProxySettings);
+  } else {
+    rv = mPACMan->Init(nullptr);
+  }
+  if (NS_FAILED(rv)) {
+    mPACMan->Shutdown();
+    mPACMan = nullptr;
+  }
+  return rv;
+}
+
+nsresult nsProtocolProxyService::ResetPACThread() {
+  if (!mPACMan) return NS_OK;
+
+  mPACMan->Shutdown();
+  mPACMan = nullptr;
+  return SetupPACThread();
+}
+
+nsresult nsProtocolProxyService::ConfigureFromPAC(const nsCString& spec,
+                                                  bool forceReload) {
+  nsresult rv = SetupPACThread();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  bool autodetect = spec.IsEmpty();
+  if (!forceReload && ((!autodetect && mPACMan->IsPACURI(spec)) ||
+                       (autodetect && mPACMan->IsUsingWPAD()))) {
+    return NS_OK;
+  }
+
+  mFailedProxies.Clear();
+
+  mPACMan->SetWPADOverDHCPEnabled(mWPADOverDHCPEnabled);
+  return mPACMan->LoadPACFromURI(spec);
+}
+
+void nsProtocolProxyService::ProcessPACString(const nsCString& pacString,
+                                              uint32_t aResolveFlags,
+                                              nsIProxyInfo** result) {
+  if (pacString.IsEmpty()) {
+    *result = nullptr;
+    return;
+  }
+
+  const char* proxies = pacString.get();
+
+  nsProxyInfo *pi = nullptr, *first = nullptr, *last = nullptr;
+  while (*proxies) {
+    proxies = ExtractProxyInfo(proxies, aResolveFlags, &pi);
+    if (pi && (pi->mType == kProxyType_HTTPS) && !mProxyOverTLS) {
+      delete pi;
+      pi = nullptr;
+    }
+
+    if (pi) {
+      if (last) {
+        NS_ASSERTION(last->mNext == nullptr, "leaking nsProxyInfo");
+        last->mNext = pi;
+      } else {
+        first = pi;
+      }
+      last = pi;
+    }
+  }
+  *result = first;
+}
+
+// nsIProtocolProxyService2
+NS_IMETHODIMP
+nsProtocolProxyService::ReloadPAC() {
+  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID);
+  if (!prefs) return NS_OK;
+
+  int32_t type;
+  nsresult rv = prefs->GetIntPref(PROXY_PREF("type"), &type);
+  if (NS_FAILED(rv)) return NS_OK;
+
+  nsAutoCString pacSpec;
+  if (type == PROXYCONFIG_PAC) {
+    prefs->GetCharPref(PROXY_PREF("autoconfig_url"), pacSpec);
+  } else if (type == PROXYCONFIG_SYSTEM) {
+    if (mSystemProxySettings) {
+      AsyncConfigureFromPAC(true, true);
+    } else {
+      ResetPACThread();
+    }
+  }
+
+  if (!pacSpec.IsEmpty() || type == PROXYCONFIG_WPAD) {
+    ConfigureFromPAC(pacSpec, true);
+  }
+  return NS_OK;
+}
+
+// When sync interface is removed this can go away too
+// The nsPACManCallback portion of this implementation should be run
+// off the main thread, because it uses a condvar for signaling and
+// the main thread is blocking on that condvar -
+//  so call nsPACMan::AsyncGetProxyForURI() with
+// a false mainThreadResponse parameter.
+class nsAsyncBridgeRequest final : public nsPACManCallback {
+  NS_DECL_THREADSAFE_ISUPPORTS
+
+  nsAsyncBridgeRequest()
+      : mMutex("nsDeprecatedCallback"),
+        mCondVar(mMutex, "nsDeprecatedCallback") {}
+
+  void OnQueryComplete(nsresult status, const nsACString& pacString,
+                       const nsACString& newPACURL) override {
+    MutexAutoLock lock(mMutex);
+    mCompleted = true;
+    mStatus = status;
+    mPACString = pacString;
+    mPACURL = newPACURL;
+    mCondVar.Notify();
+  }
+
+  void Lock() MOZ_CAPABILITY_ACQUIRE(mMutex) { mMutex.Lock(); }
+  void Unlock() MOZ_CAPABILITY_RELEASE(mMutex) { mMutex.Unlock(); }
+  void Wait() { mCondVar.Wait(TimeDuration::FromSeconds(3)); }
+
+ private:
+  ~nsAsyncBridgeRequest() = default;
+
+  friend class nsProtocolProxyService;
+
+  Mutex mMutex;
+  CondVar mCondVar;
+
+  nsresult mStatus MOZ_GUARDED_BY(mMutex){NS_OK};
+  nsCString mPACString MOZ_GUARDED_BY(mMutex);
+  nsCString mPACURL MOZ_GUARDED_BY(mMutex);
+  bool mCompleted MOZ_GUARDED_BY(mMutex){false};
+};
+NS_IMPL_ISUPPORTS0(nsAsyncBridgeRequest)
+
+nsresult nsProtocolProxyService::AsyncResolveInternal(
+    nsIChannel* channel, uint32_t flags, nsIProtocolProxyCallback* callback,
+    nsICancelable** result, bool isSyncOK,
+    nsISerialEventTarget* mainThreadEventTarget) {
+  NS_ENSURE_ARG_POINTER(channel);
+  NS_ENSURE_ARG_POINTER(callback);
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = GetProxyURI(channel, getter_AddRefs(uri));
+  if (NS_FAILED(rv)) return rv;
+
+  *result = nullptr;
+  RefPtr<nsAsyncResolveRequest> ctx =
+      new nsAsyncResolveRequest(this, channel, flags, callback);
+
+  nsProtocolInfo info;
+  rv = GetProtocolInfo(uri, &info);
+  if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIProxyInfo> pi;
+  bool usePACThread;
+
+  // adapt to realtime changes in the system proxy service
+  if (mProxyConfig == PROXYCONFIG_SYSTEM) {
+    nsCOMPtr<nsISystemProxySettings> sp2 =
+        do_GetService(NS_SYSTEMPROXYSETTINGS_CONTRACTID);
+    if (sp2 != mSystemProxySettings) {
+      mSystemProxySettings = sp2;
+      ResetPACThread();
+    }
+  }
+
+  rv = SetupPACThread(mainThreadEventTarget);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  // SystemProxySettings and PAC files can block the main thread
+  // but if neither of them are in use, we can just do the work
+  // right here and directly invoke the callback
+
+  rv =
+      Resolve_Internal(channel, info, flags, &usePACThread, getter_AddRefs(pi));
+  if (NS_FAILED(rv)) return rv;
+
+  if (!usePACThread || !mPACMan) {
+    // we can do it locally
+    rv = ctx->ProcessLocally(info, pi, isSyncOK);
+    if (NS_SUCCEEDED(rv) && !isSyncOK) {
+      ctx.forget(result);
+    }
+    return rv;
+  }
+
+  // else kick off a PAC thread query
+  rv = mPACMan->AsyncGetProxyForURI(uri, ctx, flags, true);
+  if (NS_SUCCEEDED(rv)) ctx.forget(result);
+  return rv;
+}
+
+// nsIProtocolProxyService
+NS_IMETHODIMP
+nsProtocolProxyService::AsyncResolve2(
+    nsIChannel* channel, uint32_t flags, nsIProtocolProxyCallback* callback,
+    nsISerialEventTarget* mainThreadEventTarget, nsICancelable** result) {
+  return AsyncResolveInternal(channel, flags, callback, result, true,
+                              mainThreadEventTarget);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::AsyncResolve(
+    nsISupports* channelOrURI, uint32_t flags,
+    nsIProtocolProxyCallback* callback,
+    nsISerialEventTarget* mainThreadEventTarget, nsICancelable** result) {
+  nsresult rv;
+  // Check if we got a channel:
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(channelOrURI);
+  if (!channel) {
+    nsCOMPtr<nsIURI> uri = do_QueryInterface(channelOrURI);
+    if (!uri) {
+      return NS_ERROR_NO_INTERFACE;
+    }
+
+    // creating a temporary channel from the URI which is not
+    // used to perform any network loads, hence its safe to
+    // use systemPrincipal as the loadingPrincipal.
+    rv = NS_NewChannel(getter_AddRefs(channel), uri,
+                       nsContentUtils::GetSystemPrincipal(),
+                       nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
+                       nsIContentPolicy::TYPE_OTHER);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  return AsyncResolveInternal(channel, flags, callback, result, false,
+                              mainThreadEventTarget);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::NewProxyInfo(
+    const nsACString& aType, const nsACString& aHost, int32_t aPort,
+    const nsACString& aProxyAuthorizationHeader,
+    const nsACString& aConnectionIsolationKey, uint32_t aFlags,
+    uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
+    nsIProxyInfo** aResult) {
+  return NewProxyInfoWithAuth(aType, aHost, aPort, ""_ns, ""_ns,
+                              aProxyAuthorizationHeader,
+                              aConnectionIsolationKey, aFlags, aFailoverTimeout,
+                              aFailoverProxy, aResult);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::NewProxyInfoWithAuth(
+    const nsACString& aType, const nsACString& aHost, int32_t aPort,
+    const nsACString& aUsername, const nsACString& aPassword,
+    const nsACString& aProxyAuthorizationHeader,
+    const nsACString& aConnectionIsolationKey, uint32_t aFlags,
+    uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
+    nsIProxyInfo** aResult) {
+  static const char* types[] = {kProxyType_HTTP, kProxyType_HTTPS,
+                                kProxyType_SOCKS, kProxyType_SOCKS4,
+                                kProxyType_DIRECT};
+
+  // resolve type; this allows us to avoid copying the type string into each
+  // proxy info instance.  we just reference the string literals directly :)
+  const char* type = nullptr;
+  for (auto& t : types) {
+    if (aType.LowerCaseEqualsASCII(t)) {
+      type = t;
+      break;
+    }
+  }
+  NS_ENSURE_TRUE(type, NS_ERROR_INVALID_ARG);
+
+  // We have only implemented username/password for SOCKS proxies.
+  if ((!aUsername.IsEmpty() || !aPassword.IsEmpty()) &&
+      !aType.LowerCaseEqualsASCII(kProxyType_SOCKS) &&
+      !aType.LowerCaseEqualsASCII(kProxyType_SOCKS4)) {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
+  return NewProxyInfo_Internal(type, aHost, aPort, aUsername, aPassword,
+                               aProxyAuthorizationHeader,
+                               aConnectionIsolationKey, aFlags,
+                               aFailoverTimeout, aFailoverProxy, 0, aResult);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::GetFailoverForProxy(nsIProxyInfo* aProxy, nsIURI* aURI,
+                                            nsresult aStatus,
+                                            nsIProxyInfo** aResult) {
+  // Failover is supported through a variety of methods including:
+  // * PAC scripts (PROXYCONFIG_PAC and PROXYCONFIG_WPAD)
+  // * System proxy
+  // * Extensions
+  // With extensions the mProxyConfig can be any type and the extension
+  // is still involved in the proxy filtering.  It may have also supplied
+  // any number of failover proxies.  We cannot determine what the mix is
+  // here, so we will attempt to get a failover regardless of the config
+  // type.  MANUAL configuration will not disable a proxy.
+
+  // Verify that |aProxy| is one of our nsProxyInfo objects.
+  nsCOMPtr<nsProxyInfo> pi = do_QueryInterface(aProxy);
+  NS_ENSURE_ARG(pi);
+  // OK, the QI checked out.  We can proceed.
+
+  // Remember that this proxy is down.  If the user has manually configured some
+  // proxies we do not want to disable them.
+  if (mProxyConfig != PROXYCONFIG_MANUAL) {
+    DisableProxy(pi);
+  }
+
+  // NOTE: At this point, we might want to prompt the user if we have
+  //       not already tried going DIRECT.  This is something that the
+  //       classic codebase supported; however, IE6 does not prompt.
+
+  if (!pi->mNext) return NS_ERROR_NOT_AVAILABLE;
+
+  LOG(("PAC failover from %s %s:%d to %s %s:%d\n", pi->mType, pi->mHost.get(),
+       pi->mPort, pi->mNext->mType, pi->mNext->mHost.get(), pi->mNext->mPort));
+
+  *aResult = do_AddRef(pi->mNext).take();
+  return NS_OK;
+}
+
+namespace {  // anon
+
+class ProxyFilterPositionComparator {
+  using FilterLinkRef = RefPtr<nsProtocolProxyService::FilterLink>;
+
+ public:
+  bool Equals(const FilterLinkRef& a, const FilterLinkRef& b) const {
+    return a->position == b->position;
+  }
+  bool LessThan(const FilterLinkRef& a, const FilterLinkRef& b) const {
+    return a->position < b->position;
+  }
+};
+
+class ProxyFilterObjectComparator {
+  using FilterLinkRef = RefPtr<nsProtocolProxyService::FilterLink>;
+
+ public:
+  bool Equals(const FilterLinkRef& link, const nsISupports* obj) const {
+    return obj == nsCOMPtr<nsISupports>(do_QueryInterface(link->filter)) ||
+           obj == nsCOMPtr<nsISupports>(do_QueryInterface(link->channelFilter));
+  }
+};
+
+}  // namespace
+
+nsresult nsProtocolProxyService::InsertFilterLink(RefPtr<FilterLink>&& link) {
+  LOG(("nsProtocolProxyService::InsertFilterLink filter=%p", link.get()));
+
+  if (mIsShutdown) {
+    return NS_ERROR_FAILURE;
+  }
+
+  mFilters.AppendElement(link);
+  mFilters.Sort(ProxyFilterPositionComparator());
+
+  NotifyProxyConfigChangedInternal();
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::RegisterFilter(nsIProtocolProxyFilter* filter,
+                                       uint32_t position) {
+  UnregisterFilter(filter);  // remove this filter if we already have it
+
+  RefPtr<FilterLink> link = new FilterLink(position, filter);
+  return InsertFilterLink(std::move(link));
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::RegisterChannelFilter(
+    nsIProtocolProxyChannelFilter* channelFilter, uint32_t position) {
+  UnregisterChannelFilter(
+      channelFilter);  // remove this filter if we already have it
+
+  RefPtr<FilterLink> link = new FilterLink(position, channelFilter);
+  return InsertFilterLink(std::move(link));
+}
+
+nsresult nsProtocolProxyService::RemoveFilterLink(nsISupports* givenObject) {
+  LOG(("nsProtocolProxyService::RemoveFilterLink target=%p", givenObject));
+
+  nsresult rv =
+      mFilters.RemoveElement(givenObject, ProxyFilterObjectComparator())
+          ? NS_OK
+          : NS_ERROR_UNEXPECTED;
+  if (NS_SUCCEEDED(rv)) {
+    NotifyProxyConfigChangedInternal();
+  }
+
+  return rv;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::UnregisterFilter(nsIProtocolProxyFilter* filter) {
+  // QI to nsISupports so we can safely test object identity.
+  nsCOMPtr<nsISupports> givenObject = do_QueryInterface(filter);
+  return RemoveFilterLink(givenObject);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::UnregisterChannelFilter(
+    nsIProtocolProxyChannelFilter* channelFilter) {
+  // QI to nsISupports so we can safely test object identity.
+  nsCOMPtr<nsISupports> givenObject = do_QueryInterface(channelFilter);
+  return RemoveFilterLink(givenObject);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::GetProxyConfigType(uint32_t* aProxyConfigType) {
+  *aProxyConfigType = mProxyConfig;
+  return NS_OK;
+}
+
+void nsProtocolProxyService::LoadHostFilters(const nsACString& aFilters) {
+  if (mIsShutdown) {
+    return;
+  }
+
+  // check to see the owners flag? /!?/ TODO
+  if (mHostFiltersArray.Length() > 0) {
+    mHostFiltersArray.Clear();
+  }
+
+  // Reset mFilterLocalHosts - will be set to true if "<local>" is in pref
+  // string
+  mFilterLocalHosts = false;
+
+  if (aFilters.IsEmpty()) {
+    return;
+  }
+
+  //
+  // filter  = ( host | domain | ipaddr ["/" mask] ) [":" port]
+  // filters = filter *( "," LWS filter)
+  //
+  mozilla::Tokenizer t(aFilters);
+  mozilla::Tokenizer::Token token;
+  bool eof = false;
+  // while (*filters) {
+  while (!eof) {
+    // skip over spaces and ,
+    t.SkipWhites();
+    while (t.CheckChar(',')) {
+      t.SkipWhites();
+    }
+
+    nsAutoCString portStr;
+    nsAutoCString hostStr;
+    nsAutoCString maskStr;
+    t.Record();
+
+    bool parsingIPv6 = false;
+    bool parsingPort = false;
+    bool parsingMask = false;
+    while (t.Next(token)) {
+      if (token.Equals(mozilla::Tokenizer::Token::EndOfFile())) {
+        eof = true;
+        break;
+      }
+      if (token.Equals(mozilla::Tokenizer::Token::Char(',')) ||
+          token.Type() == mozilla::Tokenizer::TOKEN_WS) {
+        break;
+      }
+
+      if (token.Equals(mozilla::Tokenizer::Token::Char('['))) {
+        parsingIPv6 = true;
+        continue;
+      }
+
+      if (!parsingIPv6 && token.Equals(mozilla::Tokenizer::Token::Char(':'))) {
+        // Port is starting. Claim the previous as host.
+        if (parsingMask) {
+          t.Claim(maskStr);
+        } else {
+          t.Claim(hostStr);
+        }
+        t.Record();
+        parsingPort = true;
+        continue;
+      }
+
+      if (token.Equals(mozilla::Tokenizer::Token::Char('/'))) {
+        t.Claim(hostStr);
+        t.Record();
+        parsingMask = true;
+        continue;
+      }
+
+      if (token.Equals(mozilla::Tokenizer::Token::Char(']'))) {
+        parsingIPv6 = false;
+        continue;
+      }
+    }
+    if (!parsingPort && !parsingMask) {
+      t.Claim(hostStr);
+    } else if (parsingPort) {
+      t.Claim(portStr);
+    } else if (parsingMask) {
+      t.Claim(maskStr);
+    } else {
+      NS_WARNING("Could not parse this rule");
+      continue;
+    }
+
+    if (hostStr.IsEmpty()) {
+      continue;
+    }
+
+    // If the current host filter is "<local>", then all local (i.e.
+    // no dots in the hostname) hosts should bypass the proxy
+    if (hostStr.EqualsIgnoreCase("<local>")) {
+      mFilterLocalHosts = true;
+      LOG(
+          ("loaded filter for local hosts "
+           "(plain host names, no dots)\n"));
+      // Continue to next host filter;
+      continue;
+    }
+
+    // For all other host filters, create HostInfo object and add to list
+    HostInfo* hinfo = new HostInfo();
+    nsresult rv = NS_OK;
+
+    int32_t port = portStr.ToInteger(&rv);
+    if (NS_FAILED(rv)) {
+      port = 0;
+    }
+    hinfo->port = port;
+
+    int32_t maskLen = maskStr.ToInteger(&rv);
+    if (NS_FAILED(rv)) {
+      maskLen = 128;
+    }
+
+    // PR_StringToNetAddr can't parse brackets enclosed IPv6
+    nsAutoCString addrString = hostStr;
+    if (hostStr.First() == '[' && hostStr.Last() == ']') {
+      addrString = Substring(hostStr, 1, hostStr.Length() - 2);
+    }
+
+    PRNetAddr addr;
+    if (PR_StringToNetAddr(addrString.get(), &addr) == PR_SUCCESS) {
+      hinfo->is_ipaddr = true;
+      hinfo->ip.family = PR_AF_INET6;  // we always store address as IPv6
+      hinfo->ip.mask_len = maskLen;
+
+      if (hinfo->ip.mask_len == 0) {
+        NS_WARNING("invalid mask");
+        goto loser;
+      }
+
+      if (addr.raw.family == PR_AF_INET) {
+        // convert to IPv4-mapped address
+        PR_ConvertIPv4AddrToIPv6(addr.inet.ip, &hinfo->ip.addr);
+        // adjust mask_len accordingly
+        if (hinfo->ip.mask_len <= 32) hinfo->ip.mask_len += 96;
+      } else if (addr.raw.family == PR_AF_INET6) {
+        // copy the address
+        memcpy(&hinfo->ip.addr, &addr.ipv6.ip, sizeof(PRIPv6Addr));
+      } else {
+        NS_WARNING("unknown address family");
+        goto loser;
+      }
+
+      // apply mask to IPv6 address
+      proxy_MaskIPv6Addr(hinfo->ip.addr, hinfo->ip.mask_len);
+    } else {
+      nsAutoCString host;
+      if (hostStr.First() == '*') {
+        host = Substring(hostStr, 1);
+      } else {
+        host = hostStr;
+      }
+
+      if (host.IsEmpty()) {
+        hinfo->name.host = nullptr;
+        goto loser;
+      }
+
+      hinfo->name.host_len = host.Length();
+
+      hinfo->is_ipaddr = false;
+      hinfo->name.host = ToNewCString(host, mozilla::fallible);
+
+      if (!hinfo->name.host) goto loser;
+    }
+
+// #define DEBUG_DUMP_FILTERS
+#ifdef DEBUG_DUMP_FILTERS
+    printf("loaded filter[%zu]:\n", mHostFiltersArray.Length());
+    printf("  is_ipaddr = %u\n", hinfo->is_ipaddr);
+    printf("  port = %u\n", hinfo->port);
+    printf("  host = %s\n", hostStr.get());
+    if (hinfo->is_ipaddr) {
+      printf("  ip.family = %x\n", hinfo->ip.family);
+      printf("  ip.mask_len = %u\n", hinfo->ip.mask_len);
+
+      PRNetAddr netAddr;
+      PR_SetNetAddr(PR_IpAddrNull, PR_AF_INET6, 0, &netAddr);
+      memcpy(&netAddr.ipv6.ip, &hinfo->ip.addr, sizeof(hinfo->ip.addr));
+
+      char buf[256];
+      PR_NetAddrToString(&netAddr, buf, sizeof(buf));
+
+      printf("  ip.addr = %s\n", buf);
+    } else {
+      printf("  name.host = %s\n", hinfo->name.host);
+    }
+#endif
+
+    mHostFiltersArray.AppendElement(hinfo);
+    hinfo = nullptr;
+  loser:
+    delete hinfo;
+  }
+}
+
+nsresult nsProtocolProxyService::GetProtocolInfo(nsIURI* uri,
+                                                 nsProtocolInfo* info) {
+  AssertIsOnMainThread();
+  MOZ_ASSERT(uri, "URI is null");
+  MOZ_ASSERT(info, "info is null");
+
+  nsresult rv;
+
+  rv = uri->GetScheme(info->scheme);
+  if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIIOService> ios = do_GetIOService(&rv);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = ios->GetDynamicProtocolFlags(uri, &info->flags);
+  if (NS_FAILED(rv)) return rv;
+
+  rv = ios->GetDefaultPort(info->scheme.get(), &info->defaultPort);
+  return rv;
+}
+
+nsresult nsProtocolProxyService::NewProxyInfo_Internal(
+    const char* aType, const nsACString& aHost, int32_t aPort,
+    const nsACString& aUsername, const nsACString& aPassword,
+    const nsACString& aProxyAuthorizationHeader,
+    const nsACString& aConnectionIsolationKey, uint32_t aFlags,
+    uint32_t aFailoverTimeout, nsIProxyInfo* aFailoverProxy,
+    uint32_t aResolveFlags, nsIProxyInfo** aResult) {
+  if (aPort <= 0) aPort = -1;
+
+  nsCOMPtr<nsProxyInfo> failover;
+  if (aFailoverProxy) {
+    failover = do_QueryInterface(aFailoverProxy);
+    NS_ENSURE_ARG(failover);
+  }
+
+  RefPtr<nsProxyInfo> proxyInfo = new nsProxyInfo();
+
+  proxyInfo->mType = aType;
+  proxyInfo->mHost = aHost;
+  proxyInfo->mPort = aPort;
+  proxyInfo->mUsername = aUsername;
+  proxyInfo->mPassword = aPassword;
+  proxyInfo->mFlags = aFlags;
+  proxyInfo->mResolveFlags = aResolveFlags;
+  proxyInfo->mTimeout =
+      aFailoverTimeout == UINT32_MAX ? mFailedProxyTimeout : aFailoverTimeout;
+  proxyInfo->mProxyAuthorizationHeader = aProxyAuthorizationHeader;
+  proxyInfo->mConnectionIsolationKey = aConnectionIsolationKey;
+  failover.swap(proxyInfo->mNext);
+
+  proxyInfo.forget(aResult);
+  return NS_OK;
+}
+
+nsresult nsProtocolProxyService::Resolve_Internal(nsIChannel* channel,
+                                                  const nsProtocolInfo& info,
+                                                  uint32_t flags,
+                                                  bool* usePACThread,
+                                                  nsIProxyInfo** result) {
+  NS_ENSURE_ARG_POINTER(channel);
+
+  *usePACThread = false;
+  *result = nullptr;
+
+  if (!(info.flags & nsIProtocolHandler::ALLOWS_PROXY)) {
+    return NS_OK;  // Can't proxy this (filters may not override)
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = GetProxyURI(channel, getter_AddRefs(uri));
+  if (NS_FAILED(rv)) return rv;
+
+  // See bug #586908.
+  // Avoid endless loop if |uri| is the current PAC-URI. Returning OK
+  // here means that we will not use a proxy for this connection.
+  if (mPACMan && mPACMan->IsPACURI(uri)) return NS_OK;
+
+  // if proxies are enabled and this host:port combo is supposed to use a
+  // proxy, check for a proxy.
+  if ((mProxyConfig == PROXYCONFIG_DIRECT) ||
+      !CanUseProxy(uri, info.defaultPort)) {
+    return NS_OK;
+  }
+
+  bool mainThreadOnly;
+  if (mSystemProxySettings && mProxyConfig == PROXYCONFIG_SYSTEM &&
+      NS_SUCCEEDED(mSystemProxySettings->GetMainThreadOnly(&mainThreadOnly)) &&
+      !mainThreadOnly) {
+    *usePACThread = true;
+    return NS_OK;
+  }
+
+  if (mSystemProxySettings && mProxyConfig == PROXYCONFIG_SYSTEM) {
+    // If the system proxy setting implementation is not threadsafe (e.g
+    // linux gconf), we'll do it inline here. Such implementations promise
+    // not to block
+    // bug 1366133: this block uses GetPACURI & GetProxyForURI, which may
+    // hang on Windows platform. Fortunately, current implementation on
+    // Windows is not main thread only, so we are safe here.
+
+    nsAutoCString PACURI;
+    nsAutoCString pacString;
+
+    if (NS_SUCCEEDED(mSystemProxySettings->GetPACURI(PACURI)) &&
+        !PACURI.IsEmpty()) {
+      // There is a PAC URI configured. If it is unchanged, then
+      // just execute the PAC thread. If it is changed then load
+      // the new value
+
+      if (mPACMan && mPACMan->IsPACURI(PACURI)) {
+        // unchanged
+        *usePACThread = true;
+        return NS_OK;
+      }
+
+      ConfigureFromPAC(PACURI, false);
+      return NS_OK;
+    }
+
+    nsAutoCString spec;
+    nsAutoCString host;
+    nsAutoCString scheme;
+    int32_t port = -1;
+
+    uri->GetAsciiSpec(spec);
+    uri->GetAsciiHost(host);
+    uri->GetScheme(scheme);
+    uri->GetPort(&port);
+
+    if (flags & RESOLVE_PREFER_SOCKS_PROXY) {
+      LOG(("Ignoring RESOLVE_PREFER_SOCKS_PROXY for system proxy setting\n"));
+    } else if (flags & RESOLVE_PREFER_HTTPS_PROXY) {
+      scheme.AssignLiteral("https");
+    } else if (flags & RESOLVE_IGNORE_URI_SCHEME) {
+      scheme.AssignLiteral("http");
+    }
+
+    // now try the system proxy settings for this particular url
+    if (NS_SUCCEEDED(mSystemProxySettings->GetProxyForURI(spec, scheme, host,
+                                                          port, pacString))) {
+      nsCOMPtr<nsIProxyInfo> pi;
+      ProcessPACString(pacString, 0, getter_AddRefs(pi));
+
+      if (flags & RESOLVE_PREFER_SOCKS_PROXY &&
+          flags & RESOLVE_PREFER_HTTPS_PROXY) {
+        nsAutoCString type;
+        pi->GetType(type);
+        // DIRECT from ProcessPACString indicates that system proxy settings
+        // are not configured to use SOCKS proxy. Try https proxy as a
+        // secondary preferrable proxy. This is mainly for websocket whose
+        // proxy precedence is SOCKS > HTTPS > DIRECT.
+        if (type.EqualsLiteral(kProxyType_DIRECT)) {
+          scheme.AssignLiteral(kProxyType_HTTPS);
+          if (NS_SUCCEEDED(mSystemProxySettings->GetProxyForURI(
+                  spec, scheme, host, port, pacString))) {
+            ProcessPACString(pacString, 0, getter_AddRefs(pi));
+          }
+        }
+      }
+      pi.forget(result);
+      return NS_OK;
+    }
+  }
+
+  // if proxies are enabled and this host:port combo is supposed to use a
+  // proxy, check for a proxy.
+  if (mProxyConfig == PROXYCONFIG_DIRECT ||
+      (mProxyConfig == PROXYCONFIG_MANUAL &&
+       !CanUseProxy(uri, info.defaultPort))) {
+    return NS_OK;
+  }
+
+  // Proxy auto config magic...
+  if (mProxyConfig == PROXYCONFIG_PAC || mProxyConfig == PROXYCONFIG_WPAD) {
+    // Do not query PAC now.
+    *usePACThread = true;
+    return NS_OK;
+  }
+
+  // If we aren't in manual proxy configuration mode then we don't
+  // want to honor any manual specific prefs that might be still set
+  if (mProxyConfig != PROXYCONFIG_MANUAL) return NS_OK;
+
+  // proxy info values for manual configuration mode
+  const char* type = nullptr;
+  const nsACString* host = nullptr;
+  int32_t port = -1;
+
+  uint32_t proxyFlags = 0;
+
+  if ((flags & RESOLVE_PREFER_SOCKS_PROXY) && !mSOCKSProxyTarget.IsEmpty() &&
+      (IsHostLocalTarget(mSOCKSProxyTarget) || mSOCKSProxyPort > 0)) {
+    host = &mSOCKSProxyTarget;
+    if (mSOCKSProxyVersion == 4) {
+      type = kProxyType_SOCKS4;
+    } else {
+      type = kProxyType_SOCKS;
+    }
+    port = mSOCKSProxyPort;
+    if (mSOCKSProxyRemoteDNS) {
+      proxyFlags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
+    }
+  } else if ((flags & RESOLVE_PREFER_HTTPS_PROXY) &&
+             !mHTTPSProxyHost.IsEmpty() && mHTTPSProxyPort > 0) {
+    host = &mHTTPSProxyHost;
+    type = kProxyType_HTTP;
+    port = mHTTPSProxyPort;
+  } else if (!mHTTPProxyHost.IsEmpty() && mHTTPProxyPort > 0 &&
+             ((flags & RESOLVE_IGNORE_URI_SCHEME) ||
+              info.scheme.EqualsLiteral("http"))) {
+    host = &mHTTPProxyHost;
+    type = kProxyType_HTTP;
+    port = mHTTPProxyPort;
+  } else if (!mHTTPSProxyHost.IsEmpty() && mHTTPSProxyPort > 0 &&
+             !(flags & RESOLVE_IGNORE_URI_SCHEME) &&
+             info.scheme.EqualsLiteral("https")) {
+    host = &mHTTPSProxyHost;
+    type = kProxyType_HTTP;
+    port = mHTTPSProxyPort;
+  } else if (!mSOCKSProxyTarget.IsEmpty() &&
+             (IsHostLocalTarget(mSOCKSProxyTarget) || mSOCKSProxyPort > 0)) {
+    host = &mSOCKSProxyTarget;
+    if (mSOCKSProxyVersion == 4) {
+      type = kProxyType_SOCKS4;
+    } else {
+      type = kProxyType_SOCKS;
+    }
+    port = mSOCKSProxyPort;
+    if (mSOCKSProxyRemoteDNS) {
+      proxyFlags |= nsIProxyInfo::TRANSPARENT_PROXY_RESOLVES_HOST;
+    }
+  }
+
+  if (type) {
+    rv = NewProxyInfo_Internal(type, *host, port, ""_ns, ""_ns, ""_ns, ""_ns,
+                               proxyFlags, UINT32_MAX, nullptr, flags, result);
+    if (NS_FAILED(rv)) return rv;
+  }
+
+  return NS_OK;
+}
+
+void nsProtocolProxyService::MaybeDisableDNSPrefetch(nsIProxyInfo* aProxy) {
+  // Disable Prefetch in the DNS service if a proxy is in use.
+  if (!aProxy) return;
+
+  nsCOMPtr<nsProxyInfo> pi = do_QueryInterface(aProxy);
+  if (!pi || !pi->mType || pi->mType == kProxyType_DIRECT) return;
+
+  // To avoid getting DNS service recursively, we directly use
+  // GetXPCOMSingleton().
+  nsCOMPtr<nsIDNSService> dns = nsDNSService::GetXPCOMSingleton();
+  if (!dns) return;
+  nsCOMPtr<nsPIDNSService> pdns = do_QueryInterface(dns);
+  if (!pdns) return;
+
+  // We lose the prefetch optimization for the life of the dns service.
+  pdns->SetPrefetchEnabled(false);
+}
+
+void nsProtocolProxyService::CopyFilters(nsTArray<RefPtr<FilterLink>>& aCopy) {
+  MOZ_ASSERT(aCopy.Length() == 0);
+  aCopy.AppendElements(mFilters);
+}
+
+bool nsProtocolProxyService::ApplyFilter(
+    FilterLink const* filterLink, nsIChannel* channel,
+    const nsProtocolInfo& info, nsCOMPtr<nsIProxyInfo> list,
+    nsIProxyProtocolFilterResult* callback) {
+  nsresult rv;
+
+  // We prune the proxy list prior to invoking each filter.  This may be
+  // somewhat inefficient, but it seems like a good idea since we want each
+  // filter to "see" a valid proxy list.
+  PruneProxyInfo(info, list);
+
+  if (filterLink->filter) {
+    nsCOMPtr<nsIURI> uri;
+    Unused << GetProxyURI(channel, getter_AddRefs(uri));
+    if (!uri) {
+      return false;
+    }
+
+    rv = filterLink->filter->ApplyFilter(uri, list, callback);
+    return NS_SUCCEEDED(rv);
+  }
+
+  if (filterLink->channelFilter) {
+    rv = filterLink->channelFilter->ApplyFilter(channel, list, callback);
+    return NS_SUCCEEDED(rv);
+  }
+
+  return false;
+}
+
+void nsProtocolProxyService::PruneProxyInfo(const nsProtocolInfo& info,
+                                            nsIProxyInfo** list) {
+  if (!*list) return;
+
+  LOG(("nsProtocolProxyService::PruneProxyInfo ENTER list=%p", *list));
+
+  nsProxyInfo* head = nullptr;
+  CallQueryInterface(*list, &head);
+  if (!head) {
+    MOZ_ASSERT_UNREACHABLE("nsIProxyInfo must QI to nsProxyInfo");
+    return;
+  }
+  NS_RELEASE(*list);
+
+  // Pruning of disabled proxies works like this:
+  //   - If all proxies are disabled, return the full list
+  //   - Otherwise, remove the disabled proxies.
+  //
+  // Pruning of disallowed proxies works like this:
+  //   - If the protocol handler disallows the proxy, then we disallow it.
+
+  // Start by removing all disallowed proxies if required:
+  if (!(info.flags & nsIProtocolHandler::ALLOWS_PROXY_HTTP)) {
+    nsProxyInfo *last = nullptr, *iter = head;
+    while (iter) {
+      if ((iter->Type() == kProxyType_HTTP) ||
+          (iter->Type() == kProxyType_HTTPS)) {
+        // reject!
+        if (last) {
+          last->mNext = iter->mNext;
+        } else {
+          head = iter->mNext;
+        }
+        nsProxyInfo* next = iter->mNext;
+        iter->mNext = nullptr;
+        iter->Release();
+        iter = next;
+      } else {
+        last = iter;
+        iter = iter->mNext;
+      }
+    }
+    if (!head) {
+      return;
+    }
+  }
+
+  // Scan to see if all remaining non-direct proxies are disabled. If so, then
+  // we'll just bail and return them all.  Otherwise, we'll go and prune the
+  // disabled ones.
+
+  bool allNonDirectProxiesDisabled = true;
+
+  nsProxyInfo* iter;
+  for (iter = head; iter; iter = iter->mNext) {
+    if (!IsProxyDisabled(iter) && iter->mType != kProxyType_DIRECT) {
+      allNonDirectProxiesDisabled = false;
+      break;
+    }
+  }
+
+  if (allNonDirectProxiesDisabled &&
+      StaticPrefs::network_proxy_retry_failed_proxies()) {
+    LOG(("All proxies are disabled, so trying all again"));
+  } else {
+    // remove any disabled proxies.
+    nsProxyInfo* last = nullptr;
+    for (iter = head; iter;) {
+      if (IsProxyDisabled(iter)) {
+        // reject!
+        nsProxyInfo* reject = iter;
+
+        iter = iter->mNext;
+        if (last) {
+          last->mNext = iter;
+        } else {
+          head = iter;
+        }
+
+        reject->mNext = nullptr;
+        NS_RELEASE(reject);
+        continue;
+      }
+
+      // since we are about to use this proxy, make sure it is not on
+      // the disabled proxy list.  we'll add it back to that list if
+      // we have to (in GetFailoverForProxy).
+      //
+      // XXX(darin): It might be better to do this as a final pass.
+      //
+      EnableProxy(iter);
+
+      last = iter;
+      iter = iter->mNext;
+    }
+  }
+
+  // if only DIRECT was specified then return no proxy info, and we're done.
+  if (head && !head->mNext && head->mType == kProxyType_DIRECT) {
+    NS_RELEASE(head);
+  }
+
+  *list = head;  // Transfer ownership
+
+  LOG(("nsProtocolProxyService::PruneProxyInfo LEAVE list=%p", *list));
+}
+
+bool nsProtocolProxyService::GetIsPACLoading() {
+  return mPACMan && mPACMan->IsLoading();
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::AddProxyConfigCallback(
+    nsIProxyConfigChangedCallback* aCallback) {
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!aCallback) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  mProxyConfigChangedCallbacks.AppendElement(aCallback);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::RemoveProxyConfigCallback(
+    nsIProxyConfigChangedCallback* aCallback) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  mProxyConfigChangedCallbacks.RemoveElement(aCallback);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::NotifyProxyConfigChangedInternal() {
+  LOG(("nsProtocolProxyService::NotifyProxyConfigChangedInternal"));
+  MOZ_ASSERT(NS_IsMainThread());
+
+  for (const auto& callback : mProxyConfigChangedCallbacks) {
+    callback->OnProxyConfigChanged();
+  }
+  return NS_OK;
+}
+
+}  // namespace net
+}  // namespace mozilla