Flank proxy support using proxy auto config(pac)

[apolloniusoftyana]

We have added some googleapis.com urls to our proxy to support Flank, but it appears that during the Auth process (oauth2.googleapis.com) it is using a browser user agent. The browser appears to be using the OS proxy configuration in this case the proxy settings in macOS under System Preferences. Typically we use a proxy auto config file there, which currently with that file in place we don't see the traffic initiated by the flank script. But if we switch to a manual proxy config we can hit the proxy and the rules we put in place for Flank and Firebase allow the communication forward. Do you know why it would not accept the auto config if it is looking at the OS settings for this part of the communication. Note: we also have the proxy set as environment variables in Terminal and in our gcloud config, but like mentioned it appears like the auth process is using a browser user agent in the background which is utilizing the System Preference proxy settings.

[bootstraponline]

Hey, thanks for filing an issue!

Is it possible for you to provide steps to reproduce the problem? That'd be super helpful to validate potential fixes.

[apolloniusoftyana]

We are using an http proxy with authentication and Mac devices running macOS 10.14 - 10.15. The Mac devices are configured to use a .pac file that lays out where the proxies are, what to use for dns and what proxy exceptions there are. We then have a script that builds the apk file and the flank.yml before sending it off using "/usr/bin/env java -jar ~./flank/flank-8.1.0.jar firebase test android run --smart-flank-disable-upload=true --config ./flank.yml". When using the auto config .pac file the proxy does not see any traffic initiated after the build portion of the script, it appears to fail during the part of the flank operation just prior to when it would normally start uploading the apk file. Now if we manually configure the proxy into the mac system preferences then it works fine, although we did have to whitelist some www.googleapis.com locations. if you do a packet capture during the process to use flank to run firebase tests you should see a call to oauth2.googleapis.com using a browser user agent in the http header. This call is using the system proxy setting and does not appear to support proxy auto config but does respect manually configured proxies. I am hoping this helps, I am not incredibly versed in Flank/Firebase.

[apolloniusoftyana]

Please let me know if there is any additional info you need or if I can assist in any way.

[bootstraponline]

I talked with @inktomi, to help we'll need a specific set of steps to follow. You've provided a great description of the use case at Amex. That doesn't help us create a similar environment to reproduce the problem.

Ideal outcome is there's a reduced test case, maybe some sort of script, we can run that sets up a proxy, runs flank, and triggers the issue.

[apolloniusoftyana]

1. Create http proxy (does not need to be configured as traffic is not making it that far

2. Require all external traffic (internet) be passed through the proxy otherwise traffic is tombstoned

3. Create a proxy auto config file (pac) which defines the http proxy location and has exceptions for internal sites

4. Host the .pac file on an internal site

5. Configure a macOS device to use proxy auto config file in System Preferences

6. Configure mac terminal to use proxy eg "export http_proxy=

7. Configure Google Cloud SDK to use proxy eg "gcloud config set proxy/address

8. Configure Google Cloud SDK to use proxy type http eg "gcloud config set proxy/type

9. Configure Google Cloud SDK proxy port eg. "gcloud config set proxy/port <8080>

10. Enter credentials for proxy into env eg. export CLOUDSDK_PROXY_USERNAME=(proxy
    username) and
    export CLOUDSDK_PROXY_PASSWORD=(proxy password)

11. Run Flank to distribute test apk

12. Output should be something like "Request Failed, retrying 1x java.net.SocketTimeoutException: connect timed out"

13. Switch macOS device System Preferences to manual proxy config and enter http proxy url, port, username and password for both http and https proxies

14. You should then see the apk start to upload when you run the Flank test again.

*Currently we are only testing on local network, unable to produce positive results currently on VPN

[bootstraponline]

Thank you!

[apolloniusoftyana]

Let me know if you need more, we are still testing and trying to narrow down as much as we can. We did verify that if we run a test apk to Firebase directly it works.

[apolloniusoftyana]

How is the testing going? Is there any additional information you need from us, or is there anything we can do to help?

[bootstraponline]

@apolloniusoftyana Hey, thanks for checking in! We have this in our ranked column. A few higher priority issues are being worked on first (FTL rate limits which block execution). You can install https://www.zenhub.com/extension to see the ZenHub board on the Flank issue tracker.

[bootstraponline]

googleapis/google-api-java-client#1247 (comment)

[bootstraponline]

@apolloniusoftyana Square contributed proxy support. That might help with your use case? #2176