Some Signal domains not proxied when censorship circumvention is on

• I have searched open and closed issues for duplicates
• I am submitting a bug report for existing functionality that does not work as intended
• I have read https://github.com/signalapp/Signal-Android/wiki/Submitting-useful-bug-reports
• This isn't a feature request or a discussion topic

---

Bug description

signal.org should not be dialed at all in censored countries.

Steps to reproduce

• Enable censorship circumvention
• Use tcpdump or PCAPDroid or any capture software to log Signal
• Search or grep signal

Actual result: These signal domain appeared:

• updates2.signal.org
• cdsi.signal.org
• svr2.signal.org

Expected result: Nothing shoud appear.

svr2 appears when verifying PIN.

Note that cdsi and svr2 should be proxied as it appears in domain fronting configurations.

https://github.com/signalapp/Signal-Android/blob/5579df66ced70285446456cd05eb566ee0d48915/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.kt#L81

https://github.com/signalapp/Signal-Android/blob/5579df66ced70285446456cd05eb566ee0d48915/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.kt#L82

Screenshots

Device info

Device: Google Pixel 7
Android version: 14
Signal version: 7.16.3

Link to debug log

N/A

Start with app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.kt at the linked lines and trace how censorship circumvention selects domains. Reproduce with tcpdump or PCAPDroid while enabling the setting and checking PIN verification. Done means updates2.signal.org, cdsi.signal.org, and svr2.signal.org no longer appear as direct connections, with cdsi and svr2 proxied.