googleapis / googleapis/google-cloud-ruby
Ruby SDK doesn't send port on CONNECT via http_proxy
- Dominant language
- Ruby
- Stars
- 1.4k
- Forks
- 578
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 166
Description
#### Environment details
- google-cloud-ruby/google-cloud-secret_manager/ version(s): 1.0.0
#### Steps to reproduce
1. install & run pproxy [1] ("pproxy -v -d")
2. $ export http_proxy=http://localhost:8080
3. $ strace -f -s 9999 ruby secrets.rb |& grep -i '"CONNECT ' | grep " send"
#### Code example
secrets.rb
```
# To run this script
#
# gem install google-cloud-secret_manager
# export GOOGLE_PROJECT=your-project-id
# Run with: ruby secrets.rb
#
require "google-cloud-secret_manager"
secret_manager_service = Google::Cloud::SecretManager.secret_manager_service
project_id = ENV['GOOGLE_PROJECT'] || raise("GOOGLE_PROJECT env variable is not set. It's required.")
puts "testing secret_manager_service.list_secrets for google project #{project_id}"
parent = "projects/#{project_id}"
resp = secret_manager_service.list_secrets(parent: parent)
puts "resp.count #{resp.count}"
```
#### Full backtrace
The proxy would display an error display an error about not being able to split "host:port" (`host_name, port = path.rsplit(':', 1)`)
Part of the trace shows the following CONNECT:
```
CONNECT secretmanager.googleapis.com HTTP/1.0
Host: secretmanager.googleapis.com
User-Agent: grpc-httpcli/0.0
```
#### Any additional information below
- it doesn't seem to pass the ":443" port number when it connects to a proxy via http_proxy / https_proxy
- we can observe the CONNECT in the trace did not include ":443", possibly because it is sending via HTTP/1.0
- RFC says "host:port" should always be passed [2]
- Tested with other proxies such as:
1. Squid proxy - works, seems clever enough to use 443
2. Zscaler proxy - not working, ends-up failing after forwarding subsequent requests to secretmanager.googleapis.com on port 80
- Python / gcloud worked fine through the proxies (seems like `https_proxy` was used and HTTP/1.1 was applied)
Is it possible to fix the SDK so that the CONNECT includes port and uses HTTP/1.1?
(If it is using a common library, it might be possible that the problem is not limited to this secrets manager API)
Thanks!
*Note: A related bug issue has also been raised internally
[1] https://pypi.org/project/pproxy/
[2] https://tools.ietf.org/html/rfc7231#section-4.3.6
Contributor guide
Assessment
This issue has not been assessed yet.