“client error (SendRequest)” when fetching certain https URLs over proxy

[0f-0b]

using client = Deno.createHttpClient({
  proxy: { url: "http://127.0.0.1:8888" },
});
await fetch("https://dl.deno.land", { client });

$ tinyproxy -d & # start an HTTP proxy on port 8888
[1] 97951
NOTICE    Jul 18 10:53:23.409 [97951]: Initializing tinyproxy ...
NOTICE    Jul 18 10:53:23.409 [97951]: Reloading config file (/opt/homebrew/etc/tinyproxy/tinyproxy.conf)
INFO      Jul 18 10:53:23.409 [97951]: Setting "Via" header to 'tinyproxy'
NOTICE    Jul 18 10:53:23.409 [97951]: Reloading config file finished
INFO      Jul 18 10:53:23.409 [97951]: listen_sock called with addr = '(NULL)'
INFO      Jul 18 10:53:23.409 [97951]: trying to listen on host[::], family[30], socktype[1], proto[6]
INFO      Jul 18 10:53:23.409 [97951]: listening on fd [4]
INFO      Jul 18 10:53:23.409 [97951]: trying to listen on host[0.0.0.0], family[2], socktype[1], proto[6]
INFO      Jul 18 10:53:23.409 [97951]: listening on fd [5]
INFO      Jul 18 10:53:23.409 [97951]: Not running as root, so not changing UID/GID.
INFO      Jul 18 10:53:23.409 [97951]: Setting the various signals.
INFO      Jul 18 10:53:23.409 [97951]: Starting main loop. Accepting connections.
$ deno run --unstable-http --allow-net a.ts
CONNECT   Jul 18 10:53:32.204 [97951]: Connect (file descriptor 6): 127.0.0.1
CONNECT   Jul 18 10:53:32.205 [97951]: Request (file descriptor 6): CONNECT dl.deno.land:443 HTTP/1.1
INFO      Jul 18 10:53:32.205 [97951]: No upstream proxy for dl.deno.land
INFO      Jul 18 10:53:32.205 [97951]: opensock: opening connection to dl.deno.land:443
INFO      Jul 18 10:53:32.209 [97951]: opensock: getaddrinfo returned for dl.deno.land:443
CONNECT   Jul 18 10:53:32.255 [97951]: Established connection to host "dl.deno.land" using file descriptor 7.
INFO      Jul 18 10:53:32.255 [97951]: Not sending client headers to remote machine
INFO      Jul 18 10:53:32.402 [97951]: Closed connection between local client (fd:6) and remote client (fd:7)
error: Uncaught (in promise) TypeError: client error (SendRequest)
await fetch("https://dl.deno.land", { client });
^
    at async mainFetch (ext:deno_fetch/26_fetch.js:170:12)
    at async fetch (ext:deno_fetch/26_fetch.js:391:7)
    at async …/a.ts:4:1
$ deno --version
deno 1.45.2+7b33623 (canary, aarch64-apple-darwin)
v8 12.7.224.13
typescript 5.5.2

Also tested with an HTTP proxy other than Tinyproxy and a Socks5 proxy. In both tests Deno threw the same error. The error did not happen in the previous canary version.

[moderation]

I'm seeing the same error in two scenarios:
When using a HTTPS_PROXY environment variable

const response = await fetch(Deno.args);
console.log(...response.headers);
console.log(await response.text());
export {};

and when explicitly specifying a proxy

const client = Deno.createHttpClient({
  proxy: {
    url: "http://localhost:9904",
  },
});

const response = await fetch(
  "https://ziglang.org/download/index.json",
  {
    client,
  },
);

deno --version
deno 1.45.3 (release, x86_64-unknown-linux-gnu)
v8 12.7.224.13
typescript 5.5.2

[bartlomieju]

@moderation I'm not able to repeat the problem when HTTP_PROXY env var is used, but I can definitely repeat the problem with explicit client arg to fetch. Looking into it.

[bartlomieju]

Bumping what I found so far: the problem only occurs when TLS is involved - ie. fetching https URL with a proxy results in this errors, but fetching http URL works fine. I'm able to reproduce this with both local and remote servers. I'm working on a test case

[garethj2]

I'm also seeing this problem in our CI/CD pipeline that uses proxy environment variables. The strange thing is it can't access local files that are available in the system.

• The file definitely exists and was working before.
• The only change here is upgrading Deno to 1.45.3.

> deno check --node-modules-dir=false --unstable-worker-options --unstable-ffi --unstable-temporal --config=tsconfig.json --import-map=import-map.json ./src/HaystackConnectorExt.ts
Download https://esm.sh/v124/haystack-core@2.0.60?target=deno
Download https://esm.sh/v124/haystack-nclient@3.0.44?target=deno
Download https://esm.sh/v124/fetch-cookie@2.0.5?target=deno
Download https://esm.sh/v124/@j2inn/comlink@4.4.2?target=deno
Download https://esm.sh/@j2inn/scram@1.0.6?target=deno
Download https://esm.sh/v110/@types/tough-cookie@4.0.2/index.d.ts?target=deno
Download https://jsr.io/@std/streams/meta.json
Download https://deno.land/x/negotiator@1.0.1/mod.ts
Download https://deno.land/x/deno_reflect@v0.2.1/mod.ts
Download https://deno.land/x/negotiator@1.0.1/src/charset.ts
Download https://deno.land/x/negotiator@1.0.1/src/encoding.ts
Download https://deno.land/x/negotiator@1.0.1/src/language.ts
Download https://deno.land/x/negotiator@1.0.1/src/media_type.ts
Download https://deno.land/x/deno_reflect@v0.2.1/Reflect.ts
Download https://deno.land/x/negotiator@1.0.1/src/types.ts
error: client error (SendRequest)
    at file:///builds/j2innovations/finx/finx/server/builtin/haystackConn/src/HaystackConnector.ts:26:8
Cleaning up project directory and file based variables

[bartlomieju]

@garethj2 can you elaborate a bit? Are you fetching file:// URL through a proxy?

[garethj2]

As shown in the command, I'm just using deno check on a file called ./src/HaystackConnectorExt.ts. This file just imports HaystackConnector.ts.

I can't reproduce it on my local dev machine but it happens every time in the CI/CD pipeline.

I can't speak for how deno check works but I'm guessing this is all related. FYI I'm upgrading from Deno 1.44.2.

[bartlomieju]

Got it, I misunderstood. That at file:/// is actually pointing out to the place where and import is placed.

[bartlomieju]

The issue was pin-pointed to wrong ALPN handling when http2 is used. We are working on a fix.

[garethj2]

@bartlomieju is this also effecting my use case regarding the import? Or is this a separate issue I should raise?

[bartlomieju]

It's the same issue.

[kolay-v]

This issue still persist in 1.45.4 when using socks5 proxy. My code

const client = Deno.createHttpClient({
    proxy: {
      url: "socks5://a:b@c:d",
    }
 })
 await fetch(`https://some.url`, {
  client,
});

error

TypeError: client error (SendRequest)
    at async mainFetch (ext:deno_fetch/26_fetch.js:170:12)
    at async fetch (ext:deno_fetch/26_fetch.js:391:7)

deno -v
deno 1.45.4

[kolay-v]

@bartlomieju could you please reopen this issue?

[pagoru]

@bartlomieju still happening with latest version 1.45.5

Using Deno.serve (without proxy) + inside a worker + fetch

Edit: nvm, I didn't know it was not merged yet to the latest release

[bartlomieju]

@pagoru you can upgrade to canary version to use the fix (deno upgrade --canary)

[emmanuel]

I'm hitting the same (or a similar) error on the Deno 2 RC while creating a bunch of users in Keycloak:

TypeError: error sending request from xxx.yyy.zzz.uuu:61307 for https://keycloak.example.com/admin/realms/test-realm/users (aaa.bbb.ccc.ddd:443): client error (SendRequest): http2 error: connection error received: not a result of an error
    at mainFetch (ext:deno_fetch/26_fetch.js:182:11)
    at eventLoopTick (ext:core/01_core.js:175:7)
    at async fetch (ext:deno_fetch/26_fetch.js:392:7)
    at async fetchWithError (file:///Users/emmanuel/Library/Caches/deno/npm/registry.npmjs.org/@keycloak/keycloak-admin-client/25.0.6/lib/utils/fetchWithError.js:11:22)
    at async Agent.#requestWithParams (file:///Users/emmanuel/Library/Caches/deno/npm/registry.npmjs.org/@keycloak/keycloak-admin-client/25.0.6/lib/resources/agent.js:127:25)

The error happens reliably (every single attempt), though not until after hundreds of requests have succeeded. @bartlomieju, any thoughts about whether this is likely the same issue, or something else?

[bartlomieju]

I think it's something else, I'd appreciate a separate issue.

[emmanuel]

Yeah, I agree with you. I think this is actually what I'm hitting: #21789

Thanks for the reply!