googleapis / googleapis/google-cloud-ruby

Ruby SDK doesn't send port on CONNECT via http_proxy

Open
#8,189 2 comments 0 reactions 0 assignees View on GitHub
api: secretmanager type: question
Dominant language
Ruby
Stars
1.4k
Forks
578
Avg merge
1d 11h
Merged PRs (30d)
166

Description

#### Environment details
- google-cloud-ruby/google-cloud-secret_manager/ version(s): 1.0.0

#### Steps to reproduce

1. install & run pproxy [1] ("pproxy -v -d")
2. $ export http_proxy=http://localhost:8080
3. $ strace -f -s 9999 ruby secrets.rb |& grep -i '"CONNECT ' | grep " send"

#### Code example

secrets.rb
```
# To run this script
#
# gem install google-cloud-secret_manager
# export GOOGLE_PROJECT=your-project-id
# Run with: ruby secrets.rb
#

require "google-cloud-secret_manager"

secret_manager_service = Google::Cloud::SecretManager.secret_manager_service
project_id = ENV['GOOGLE_PROJECT'] || raise("GOOGLE_PROJECT env variable is not set. It's required.")
puts "testing secret_manager_service.list_secrets for google project #{project_id}"
parent = "projects/#{project_id}"
resp = secret_manager_service.list_secrets(parent: parent)
puts "resp.count #{resp.count}"
```

#### Full backtrace

The proxy would display an error display an error about not being able to split "host:port" (`host_name, port = path.rsplit(':', 1)`)

Part of the trace shows the following CONNECT:
```
CONNECT secretmanager.googleapis.com HTTP/1.0
Host: secretmanager.googleapis.com
User-Agent: grpc-httpcli/0.0
```

#### Any additional information below

- it doesn't seem to pass the ":443" port number when it connects to a proxy via http_proxy / https_proxy
- we can observe the CONNECT in the trace did not include ":443", possibly because it is sending via HTTP/1.0
- RFC says "host:port" should always be passed [2]
- Tested with other proxies such as:
1. Squid proxy - works, seems clever enough to use 443
2. Zscaler proxy - not working, ends-up failing after forwarding subsequent requests to secretmanager.googleapis.com on port 80
- Python / gcloud worked fine through the proxies (seems like `https_proxy` was used and HTTP/1.1 was applied)

Is it possible to fix the SDK so that the CONNECT includes port and uses HTTP/1.1?
(If it is using a common library, it might be possible that the problem is not limited to this secrets manager API)

Thanks!

*Note: A related bug issue has also been raised internally

[1] https://pypi.org/project/pproxy/
[2] https://tools.ietf.org/html/rfc7231#section-4.3.6

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.