Proxies should not poll if they cannot reach a bridge

When we had one Snowflake bridge, browser proxies would perform a reachability check before polling the broker. This prevented honest proxies, perhaps in censored areas, that will not work from being assigned to users.

Now that we support multiple Snowflake bridges, proxies no longer need to know specific bridge endpoints and instead specify a pattern of supported relays. A proxy only learns which relay to connect to after it has been matched with a client. This makes reachability checking before polling more difficult. In browser proxies, we still have proxies perform a reachability check for the default relay address which is statically set to snowflake.freehaven.net.

We've seen an increase in the number of Snowflake proxies from Iran since the start of the year, perhaps related to ongoing protests there. Given that we've dealt with misunderstandings in the past on "using Snowflake" as a client to circumvent censorship vs. running a proxy, it's worth looking at this again to see if we can weed out or provide feedback to proxies that cannot reach the bridge.

image