+pref("network.trr.uri", "https://doh-mullvad.quad9.net/dns-query");

+pref("network.trr.default_provider_uri", "https://doh-mullvad.quad9.net/dns-query");

+pref("doh-rollout.provider-list", "[{\"uri\":\"https://doh-mullvad.quad9.net/dns-query\",\"UIName\":\"Quad9 - no threat blocking\",\"schema\":0,\"autoDefault\":false,\"canonicalName\":\"\",\"id\":\"quad9-no-threat-blocking\",\"last_modified\":0},{\"uri\":\"https://dns.quad9.net/dns-query\",\"UIName\":\"Quad9 - secure: threat blocking\",\"schema\":0,\"autoDefault\":true,\"canonicalName\":\"\",\"id\":\"quad9-threat-blocking\",\"last_modified\":0}]");

+// mullvad-browser#537: migrate users from Mullvad DoH service.

+pref("mullvadbrowser.migration.show_doh_notification", false);

+  Services.scriptloader.loadSubScript("chrome://browser/content/mullvadDoHNotification.js", this);

+  <link rel="localization" href="toolkit/global/mullvad-browser.ftl"/>

+"use strict";

+

+window.addEventListener("load", () => {

+  // A notification to let users known that their DNS over HTTPS settings have

+  // changed because the mullvad DoH services has been discontinued and

+  // replaced. tor-browser#538.

+  const notification = {

+    // ProfileDataUpgrader.upgradeMB migration will set the `showPref`

+    // preference conditionally on whether the user is effected. We wait for

+    // this preference for confirmation.

+    showPref: "mullvadbrowser.migration.show_doh_notification",

+    shown: false,

+

+    init() {

+      Services.prefs.addObserver(this.showPref, this);

+      this.maybeShow();

+    },

+

+    observe() {

+      this.maybeShow();

+    },

+

+    async maybeShow() {

+      if (this.shown || !Services.prefs.getBoolPref(this.showPref, false)) {

+        return;

+      }

+      this.shown = true;

+      Services.prefs.removeObserver(this.showPref, this);

+

+      gNotificationBox.appendNotification(

+        "mullvad-doh-notification",

+        {

+          label: { "l10n-id": "mullvad-doh-notification-body" },

+          priority: gNotificationBox.PRIORITY_INFO_HIGH,

+          eventCallback: name => {

+            if (name === "dismissed") {

+              Services.prefs.clearUserPref(this.showPref);

+            }

+          },

+        },

+        [

+          {

+            "l10n-id": "moz-support-link-text",

+            link: "https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead",

+          },

+          {

+            "l10n-id": "mullvad-doh-notification-settings-button",

+            primary: true,

+            callback: () => {

+              window.openPreferences("privacy-doh");

+              Services.prefs.clearUserPref(this.showPref);

+              // Keep the notification open in case the user wants to click

+              // "Learn more".

+              return true;

+            },

+          },

+        ]

+      );

+    },

+  };

+  notification.init();

+});

+        content/browser/mullvadDoHNotification.js     (content/mullvadDoHNotification.js)

+  /**

+   * Run the profile data migration for Tor Browser if needed.

+   *

+   * @param {boolean} isNewProfile When true, just set the migration version

+   * without actually changing anything.

+   * @param {number} [currentVersion] The version to migrating from. To be used

+   * only by tests.

+   */

+  async upgradeMB(isNewProfile, currentVersion) {

+    // Version 3: Mullvad Browser 16.0a12: DoH migration (mullvad-browser#537).

+    const MB_MIGRATION_VERSION = 3;

+    if (currentVersion === undefined) {

+      currentVersion = Services.prefs.getIntPref(MIGRATION_PREF, 0);

+    }

+

+

+    if (currentVersion < 3) {

+      this.upgradeDoH();

+    }

+

+

+  upgradeDoH() {

+    const DOH_NOTIFICATION_PREF =

+      "mullvadbrowser.migration.show_doh_notification";

+    const DOH_URI_PREF = "network.trr.uri";

+    const DOH_MODE_PREF = "network.trr.mode";

+    const MULLVAD_ADBLOCK_URL = "https://adblock.dns.mullvad.net/dns-query";

+

+    const dohMode = Services.prefs.getIntPref(DOH_MODE_PREF, -1);

+    const usesAdBlock =

+      Services.prefs.getStringPref(DOH_URI_PREF, "") === MULLVAD_ADBLOCK_URL;

+    const usesCustomUri =

+      Services.prefs.prefHasUserValue(DOH_URI_PREF) && !usesAdBlock;

+    if (

+      dohMode === Ci.nsIDNSService.MODE_TRROFF ||

+      (dohMode === Ci.nsIDNSService.MODE_TRRONLY && usesCustomUri)

+    ) {

+      return;

+    }

+

+    Services.prefs.setIntPref(DOH_MODE_PREF, Ci.nsIDNSService.MODE_TRRONLY);

+    if (usesAdBlock) {

+      Services.prefs.clearUserPref(DOH_URI_PREF);

+    }

+    Services.prefs.setBoolPref(DOH_NOTIFICATION_PREF, true);

+  },

+            l10nId: "mullvad-preferences-doh-radio-always-on",

+            l10nId: "mullvad-preferences-doh-radio-off",

+    let l10nId = "mullvad-preferences-doh-overview-off";

+    } else if (deps.dohMode.value == Ci.nsIDNSService.MODE_TRRFIRST) {

+    } else if (deps.dohMode.value == Ci.nsIDNSService.MODE_TRRONLY) {

+      l10nId = "mullvad-preferences-doh-overview-always-on";

+  visible: () => false,

+/* Any copyright is dedicated to the Public Domain.

+https://creativecommons.org/publicdomain/zero/1.0/ */

+

+"use strict";

+

+const { ProfileDataUpgrader } = ChromeUtils.importESModule(

+  "moz-src:///browser/components/ProfileDataUpgrader.sys.mjs"

+);

+

+const DOH_NOTIFICATION_PREF = "mullvadbrowser.migration.show_doh_notification";

+const DOH_URI_PREF = "network.trr.uri";

+const DOH_MODE_PREF = "network.trr.mode";

+const MULLVAD_ADBLOCK_URL = "https://adblock.dns.mullvad.net/dns-query";

+

+/**

+ * Run a test case.

+ *

+ * The test takes for granted the final mode can be either off (only if it was

+ * already) or TRR-only in all other cases.

+ * The caller need to supply the expected outcomes for the other prefs.

+ *

+ * @param {number} mode The mode to set before the migration

+ * @param {string?} oldUri The URI to set before the migration, or null to clear

+ *   the related preference.

+ * @param {string?} newUri The expected new value for the preference, or null if

+ *   the preference should have its default value.

+ * @param {boolean} showNotification The expected value for the preference that

+ *   signals that the change notification should be shown to the UI.

+ */

+async function runTest(mode, oldUri, newUri, showNotification) {

+  info(`Running test for mode ${mode} and old uri ${oldUri}.`);

+

+  Services.prefs.setIntPref(DOH_MODE_PREF, mode);

+  if (oldUri !== null) {

+    Services.prefs.setStringPref(DOH_URI_PREF, oldUri);

+  } else {

+    Services.prefs.clearUserPref(DOH_URI_PREF);

+  }

+  Services.prefs.clearUserPref(DOH_NOTIFICATION_PREF);

+

+  await ProfileDataUpgrader.upgradeMB(false, 2);

+

+  if (newUri) {

+    Assert.equal(Services.prefs.getStringPref(DOH_URI_PREF), newUri);

+  } else {

+    Assert.ok(

+      !Services.prefs.prefHasUserValue(DOH_URI_PREF),

+      "The migration was supposed to clear the custom URI and so it did."

+    );

+  }

+

+  if (mode === Ci.nsIDNSService.MODE_TRROFF) {

+    Assert.equal(

+      Services.prefs.getIntPref(DOH_MODE_PREF, -1),

+      Ci.nsIDNSService.MODE_TRROFF,

+      "The migration did not turn on DoH."

+    );

+  } else {

+    Assert.equal(

+      Services.prefs.getIntPref(DOH_MODE_PREF, -1),

+      Ci.nsIDNSService.MODE_TRRONLY,

+      "Regardless of the starting mode, after the migration we are on TRR-only."

+    );

+  }

+

+  Assert.equal(

+    Services.prefs.getBoolPref(DOH_NOTIFICATION_PREF, false),

+    showNotification,

+    `The value for ${DOH_NOTIFICATION_PREF} is correct after the migration`

+  );

+}

+

+add_task(async function test_default_uri() {

+  // Max protection (our default): inherits the URI change, so we need to show

+  // the notification.

+  await runTest(Ci.nsIDNSService.MODE_TRRONLY, null, null, true);

+  // We move default and increased protection to maximum protection, and they

+  // inherit the default URI: show the notification.

+  await runTest(Ci.nsIDNSService.MODE_NATIVEONLY, null, null, true);

+  await runTest(Ci.nsIDNSService.MODE_TRRFIRST, null, null, true);

+});

+

+add_task(async function test_mullvad_adblock() {

+  // Mullvad Adblock was retired, so move to the default URI with maximum

+  // protection. Show the notification.

+  // This option could be set only with TRR first and TRR only, so test only

+  // those.

+  await runTest(

+    Ci.nsIDNSService.MODE_TRRFIRST,

+    MULLVAD_ADBLOCK_URL,

+    null,

+    true

+  );

+  await runTest(Ci.nsIDNSService.MODE_TRRONLY, MULLVAD_ADBLOCK_URL, null, true);

+});

+

+add_task(async function test_custom_provider() {

+  const CUSTOM_URL = "https://example.org/dns";

+  // Custom provider + TRR-only: nothing should change, do not show the

+  // notification.

+  await runTest(Ci.nsIDNSService.MODE_TRRONLY, CUSTOM_URL, CUSTOM_URL, false);

+  // Custom provider but TRR-first: we change it to TRR-only, so we should show

+  // a notification.

+  await runTest(Ci.nsIDNSService.MODE_TRRFIRST, CUSTOM_URL, CUSTOM_URL, true);

+  // Firefox's "default" mode and off automatically reset the provider URI, so

+  // we do not test them here.

+});

+

+add_task(async function test_update_doh_disabled() {

+  // No DoH: the migration should not turn it on. I.e., no changes, therefore no

+  // notification as well.

+  // Firefox resets the URL to the default one from the UI, so test only the

+  // default URI case.

+  await runTest(Ci.nsIDNSService.MODE_TRROFF, null, null, false);

+});

+["test_profileDataUpgrade_mullvad_doh.js"]

+tags = "mullvad-browser"

+

+

+## DNS over HTTPS settings customization.

+

+mullvad-preferences-doh-overview-always-on =

+    .label = Always on

+    .description = Always use secure DNS.

+mullvad-preferences-doh-overview-off =

+    .label = Off

+    .description = Use your default DNS resolver.

+mullvad-preferences-doh-radio-always-on =

+    .label = Always on

+    .description = Always use secure DNS

+mullvad-preferences-doh-radio-off =

+    .label = Off (recommended when using a VPN)

+    .description = Use your default DNS resolver

+

+## DNS over HTTPS provider changed notification.

+

+# The first sentence should be wrapped in '<strong>' and '</strong>'.

+# "Mullvad" is an organization name.

+mullvad-doh-notification-body = <strong>You default DNS Over HTTPS settings have been changed.</strong> Mullvad secure DNS service is being discontinued.

+mullvad-doh-notification-settings-button =

+    .label = Review settings