Load symbols from cluster fails when behind a TLS intercepting proxy

[pearj]

When trying to load symbols from a cluster I get the following error:

/home/pearj/.vscode-server/extensions/rosshamish.kuskus-kusto-language-server-1.0.35/server/node_modules/azure-kusto-data/dist-esm/src/client.js:226
            const clientTimeout = properties.getClientTimeout();
                                             ^

TypeError: properties.getClientTimeout is not a function
    at KustoClient._getClientTimeout (/home/pearj/.vscode-server/extensions/rosshamish.kuskus-kusto-language-server-1.0.35/server/node_modules/azure-kusto-data/dist-esm/src/client.js:226:46)
    at KustoClient._execute (/home/pearj/.vscode-server/extensions/rosshamish.kuskus-kusto-language-server-1.0.35/server/node_modules/azure-kusto-data/dist-esm/src/client.js:113:30)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

Node.js v18.15.0
[Info  - 12:34:35 PM] Connection to server got closed. Server will restart.

Any idea what is causing this? I'm running vscode 1.84.2 inside WSL2

[rosshamish]

Could you try downgrading your kusto language server extension to 1.0.34 and see if you get the same issue? There was a version bump in the azure-kusto-data package recently which I'm guessing is the issue.

Aside - I'm not maintaining this repo much anymore. If you're interested to look into a fix, contributions are very welcome. There's some dev workflow instructions in kusto-language-server/README.md

[pearj]

Thanks for the quick reply.

Yes downgrading to 1.0.34 did help, interestingly the latest version 1.0.37 fails in a different way, it gets a 400 error with Axios.

I don't use Kusto that much, so I was more curious to see this working.

If I feel inspired I may have a go at fixing it myself

[rosshamish]

@pearj - I just merged a speculative fix for this in #148 and released it as v2.0.3 https://marketplace.visualstudio.com/items?itemName=rosshamish.kuskus-kusto-language-server

If you're still using this, consider updating the extension and letting me know if the fix is good on your end. If you still see issues, let me know and I'll re-open. Thanks.

[rosshamish]

Unable to verify this fix in the published v2.0.3 due to #74
[Edit: speculative fix for #74 is released in v2.0.4]

[rosshamish]

Fixed in 2.0.5

[pearj]

I tried v3.1.0 but loading symbols from the cluster fails to authenticate. Curiously I can't even find the language server output, maybe it hasn't initialised properly? It does say "Kuskus loaded!" though...

It just fails with:

[Kuskus] Failed to authenticate to https://help.kusto.windows.net//SampleLogs

[rosshamish]

Huh, is that after logging in with a regular microsoft account? Does it offer you a login page?

[pearj]

It doesn't offer a login page, it just dies straight away with and without a tenant id.

[rosshamish]

Do you get anything relevant-looking in Output for Extension Host ?

Also, is this on Windows, or Mac? Or any sort of browser app (e.g. github codespace) or other VM/virtualized type situation?

[pearj]

It only mentions this:

2024-04-30 15:00:12.636 [info] ExtensionService#_doActivateExtension rosshamish.kuskus-kusto-language-server, startup: false, activationEvent: 'onLanguage:kusto'

But that only happens when vscode launches, it doesn't log when the error happens.

[rosshamish]

Strange, I can't repro. I added error messages to that notification in #156 , it's releasing with https://github.com/rosshamish/kuskus/actions/runs/8889921549/job/24409058542 as v3.1.1. Could you update and reply back with the error message you get?

[pearj]

[Kuskus] Failed to authenticate to https://help.kusto.windows.net//SampleLogs with error Failed to get cloud info for cluster https://help.kusto.windows.net - AxiosError: Request failed with status code 400

[rosshamish]

Are you able to access that cluster normally from a web browser on that machine? https://dataexplorer.azure.com/clusters/help/databases/SampleLogs

[pearj]

Yeah that works fine.

I am behind a corporate proxy with TLS inspection, so maybe that's interfering somehow.

I have tried opening up the extension in development mode, but I haven't had any luck getting a breakpoint to trigger when I run the extension.

[rosshamish]

Ah yeah that must be involved. I tried setting some breakpoints now too and am also not having any luck. I do see that source maps are enabled in the tsconfig.json, and i do see them in the out/ dir ... maybe they're not getting picked up properly?

[pearj]

I managed to get break points working, and I put one at server/node_modules/azure-kusto-data/dist-esm/src/cloudSettings.js:69. It's dying trying to do a get of: https://help.kusto.windows.net/v1/rest/auth/metadata

It's getting a bad gateway, but in the browser and via curl it's fine. It's really weird, the response body looks like a proxy error message.

I switched to an alternate proxy and gets past the above issue, then it dies a bit later on with a generic network error.

After following different breakpoints for far too long, I eventually uncovered the real error:

RestError: self-signed certificate in certificate chain
    at ClientRequest.<anonymous> (/home/pearj/dev/kuskus/kusto-language-server/server/node_modules/@azure/core-rest-pipeline/dist/commonjs/nodeHttpClient.js:187:24)
    at Object.onceWrapper (node:events:632:26)
    at ClientRequest.emit (node:events:517:28)
    at TLSSocket.socketErrorListener (node:_http_client:501:9)
    at TLSSocket.emit (node:events:517:28)
    at emitErrorNT (node:internal/streams/destroy:151:8)
    at emitErrorCloseNT (node:internal/streams/destroy:116:3)
    at process.processTicksAndRejections (node:internal/process/task_queues:82:21)

If only the error handling code in @azure/core-rest-pipeline wouldn't hide the real error message.

Anyway now it's clear the TLS interception is breaking it, need to figure out how to tell it where the certificate store is...

[pearj]

So I got it working, you can close this now.

I added this to ~/.zprofile

export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

And closed all the VS Code windows, and it started working.

Well it worked a few times and then started dying with empty responses:

[Kuskus] Failed to authenticate to https://help.kusto.windows.net//SampleLogs with error Failed to parse response ({200}) with the following error [TypeError: Cannot read properties of undefined (reading 'TableName')].

I figure it will probably work again at some point, since it worked before, of course it works ok in the browser, and via curl when I run the same request using the http headers grabbed from the debugger.