Per-profile / per-app HTTP proxy server setting?

twistero

Android in general supports setting an HTTP proxy server in quite a few places. It can be set on specific WiFi connections, on specific APNs, on the built-in VPNs, and globally via adb (settings put global http_proxy). When configured this way, individual apps that support this feature somehow knows to make their network requests through the proxy. (Apps not supporting this feature simply ignore the proxy.)

Is there a way to configure an HTTP proxy on a per-profile or per-app basis? I only want some of my apps to use a proxy, not all of them.

With GrapheneOS's profile support, I can already use VPNs per profile, so I have a profile that contains all my apps requiring a VPN. I'm hoping to do something similar with HTTP proxy servers.

gristle-cause

Have you checked out RethinkDNS?

twistero

gristle-cause This looks like a proxifier app, which is not what I'm looking for.

Proxifier apps works by pretending to be a VPN to the Android OS, locally intercepting all TCP (and sometimes UDP) connections and redirecting them through proxy servers. I don't want something this "heavy-handed".

user2025

Rethink has option to apply enforce or exclude settings per application.

twistero

user2025
So I downloaded Rethink to take a closer look. It is indeed a proxifier app. While it does allow me to selectively apply an HTTP proxy server to individual apps, it works by hijacking its TCP connections and shoving them through the proxy server. I want to avoid this kind of apps for a few reasons: 1. By not being aware of the proxy server, the app itself must resolve domain names, thus to prevent DNS leaks the proxifier app must hijack DNS as well (which Rethink does pretty well, admittedly), and the proxy server never gets the chance to do DNS resolutions at its end. I would rather have the app be aware of the proxy server and actively use it, so that it properly delegate DNS resolution to the proxy server. 2. Everything achievable by a proxifier app is already achievable by VPN apps, so they are just added complexity for no benefit for me.

Now, I did find this GitHub issue for Rethink that seems to do what I want: https://github.com/celzero/rethink-app/issues/44 However the actual app does not have this feature, and I cannot find the referenced API in the app's source code, so the devs probably did not implement it as mentioned.

So what I am looking for is basically a "VPN" app that does nothing to the tunneled traffic, but only sets an HTTP proxy via VpnService.Builder.setHttpProxy .

ignoramous

rdns dev here

twistero So I downloaded Rethink to take a closer look. It is indeed a proxifier app.

Thanks. I hope you don't mean "proxifier app" as an insult (:

twistero Now, I did find this GitHub issue for Rethink that seems to do what I want: https://github.com/celzero/rethink-app/issues/44 However the actual app does not have this feature

Yeah, so we implemented this with VpnService.Builder.setHttpProxy API but we then implemented our own "proxy layer" because that settings does nothing! The apps have to basically read the set HTTP proxy, and redirect their queries through it. Most popular browsers (like Chrome and Firefox) do so, but that doesn't mean every other app does it. This makes it pretty useless if you're concerned about "leaks" (like I take you're given you're also particular about what/who resolves DNS queries).

twistero By not being aware of the proxy server, the app itself must resolve domain names

Rethink will, by default, proxy DNS over the proxy unless Configure -> DNS -> Never proxy DNS is enabled (it won't proxy System DNS, which is going to be local to the connected active network anyway and so may well be unreachable from the said proxy).

twistero So what I am looking for is basically a "VPN" app that does nothing to the tunneled traffic, but only sets an HTTP proxy via VpnService.Builder.setHttpProxy .

You don't need an app, can use adb commands to do so: https://stackoverflow.com/questions/73314382/setting-a-proxy-using-adb

user2025

tbh...ive kind of lost you here...sorry.
What if the bad actor / payload uses IP control center and command rather than a DNS "name" ?

What apps are you trying to enforce thisbway ?
Whats the difference in terms of Privacy, Security and ANONYMITY ?

On PCs im using PortMaster, combined with specific DNS servers paid from controlD and , with the built-in SPN network, i mansge to achieve wonders in QubesOS and Windows 10 .

twistero

ignoramous

ignoramous Thanks. I hope you don't mean "proxifier app" as an insult (:

Certainly not ;-) Thank you for making Rethink, I believe it's very useful for many people.

ignoramous Yeah, so we implemented this with VpnService.Builder.setHttpProxy API but we then implemented our own "proxy layer" because that settings does nothing! The apps have to basically read the set HTTP proxy, and redirect their queries through it. Most popular browsers (like Chrome and Firefox) do so, but that doesn't mean every other app does it.

You are correct of course, but this behavior happens to be what I want.

So to explain why I want this weird thing:
On my previous device without GrapheneOS, I ran a proxy server locally on the phone, and use adb to set my global http proxy to it. The proxy server has complex logic in it to decide whether to forward the request to a remote proxy, or to make the request locally, and crucially the DNS resolution must be in the same place as the request: that is, if the request is to be made locally, the its IP address must be resolved using the local DNS server. This means the proxy server must do the resolution itself, which in turn means the app must be actively using the proxy, instead of passively being hijacked to do so.
If I want to achieve the same effect with a proxifier app like Rethink, I will have to port all the upstream selection logic into the proxifier app.
As for some apps not respecting system proxy settings, I simply avoided those and found alternatives.

Now, with GrapheneOS, I use separate profiles, and only want to apply my proxy settings in certain profiles. This means I cannot use adb anymore, since that applies to the whole phone regardless of profile.
So far the only possible method I found is to use setHTTPProxy on a VPN. If you know any other methods, I'll highly appreciate it.

ignoramous

twistero If I want to achieve the same effect with a proxifier app like Rethink, I will have to port all the upstream selection logic into the proxifier app

If we implemented "PAC file" support, would it help? https://github.com/celzero/rethink-app/issues/426

twistero I use separate profiles, and only want to apply my proxy settings in certain profiles. This means I cannot use adb anymore, since that applies to the whole phone regardless of profile.
So far the only possible method I found is to use setHTTPProxy on a VPN. If you know any other methods

Ah, gotcha. And no, I don't. Sorry.

twistero

ignoramous If we implemented "PAC file" support, would it help? https://github.com/celzero/rethink-app/issues/426

For my particular use case, no. Having looked at the PAC specification, it's somewhat surprising how much it can do, and sounds like supporting it will require a full on javascript engine. My proxy server uses even more unconventional methods though.

ignoramous

twistero For my particular use case, no.

Gotcha. To cover for usecases such as yours, I'll see if we can bring in "SetHttpProxy" functionality back under a special setting. I've re-opened: https://github.com/celzero/rethink-app/issues/44

twistero

ignoramous

ignoramous To cover for usecases such as yours, I'll see if we can bring in "SetHttpProxy" functionality back under a special setting.

That would be awesome, thanks! No pressure.
Just curious, IIUC for Rethink to do what it does, it needs to take over the default route with its TUN interface and essentially NAT all the traffic. I wonder whether VpnService allows using setHttpProxy without actually needing to intercept and NAT actual traffic.