Issues reaching api.teletype.atom.io behind a proxy

[as-cii]

Originally reported by @jrschumacher on Nov 15th 2017

Prerequisites

• Put an X between the brackets on this line if you have done all of the following:
  • Followed all applicable steps in the debugging guide
  • Checked the FAQs on the message board for common solutions
  • Checked that your issue isn't already filed?

Description

When trying to start teletype in an environment which sits behind a firewall I get the following error:

Failed to initialize the teletype package
Establishing a teletype connection failed with error: Failed to fetch 

This is a result of this query:

Request URL:https://api.teletype.atom.io/protocol-version
Request Method:GET
Status Code:407 Proxy Authentication Required (from disk cache)

Note: I am running CNTLM which interfaces with the proxy. I have PROXY, HTTP_PROXY, HTTPS_PROXY, proxy, http_proxy, https_proxy configured. My local network settings are all configured to work with the proxy. Additionally apm is configured to work with my proxy settings.

Steps to Reproduce

1. Enable the teletype plugin behind a proxy

Expected behavior:

I expect the plug to enable without an error message

Actual behavior:

I receive the error message described above.

Reproduces how often:

100%

Versions

Atom    : 1.22.0
Electron: 1.6.15
Chrome  : 56.0.2924.87
Node    : 7.4.0
apm  1.18.8
npm  3.10.10
node 6.9.5 x64
python 2.7.10
git 2.14.1

macos 10.12.6 (16G29)

Additional Information

> apm config list
; cli configs
globalconfig = "/Users/rschumacher/.atom/.apm/.apmrc"
user-agent = "npm/3.10.10 node/v6.9.5 darwin x64"
userconfig = "/Users/rschumacher/.atom/.apmrc"

; environment configs
proxy = "http://localhost:3128/"

; project config /Users/rschumacher/.npmrc
https-proxy = "http://localhost:3128/"
proxy = "http://localhost:3128/"
strict-ssl = false

[jrschumacher]

@as-cii thanks for creating this

[jrschumacher]

@as-cii is there any other information or tests I could provide you?

[as-cii]

You are very welcome, @jrschumacher. Thank you for helping us investigate this problem.

So my current thinking is that this might be a problem with the proxy credentials, as the 407 error is indicating. Perhaps Electron is trying to show an authentication dialog but Atom is preventing that? Electron exposes an app.on('login') API that we may use for that.

A few things that might be worth trying to get a sanity check:

• Can you reach https://api.teletype.atom.io via curl? e.g. curl https://api.teletype.atom.io/protocol-version
• If you open the DevTools on Atom, what happens if you call fetch("https://api.teletype.atom.io/protocol-version")?

Depending on what the output of the above commands is, we should maybe experiment with the aforementioned Electron API. Thanks for your continued help on this, @jrschumacher! ⚡️

[bac]

1. Yes:

curl https://api.teletype.atom.io/protocol-version
{"version":4}

fetch("https://api.teletype.atom.io/protocol-version")
Promise {[[PromiseStatus]]: "pending", [[PromiseValue]]: undefined}
VM1285:1 GET https://api.teletype.atom.io/protocol-version net::ERR_INSECURE_RESPONSE
(anonymous) @ VM1285:1
index.html:1 Uncaught (in promise) TypeError: Failed to fetch

So teletype does not appear to be using the cert I've installed for our proxy. For pip to work, for example, I have to add configuration like:

cert = /etc/ssl/certs/ca-certificates.crt

Does teletype need something similar?

[as-cii]

Thanks for the feedback, @bac! Yes, it is possible that Electron needs to be configured to read that particular certificate. I think there are some APIs to allow that (https://electronjs.org/docs/api/session#sessetcertificateverifyprocproc), but we would need to experiment and see if they offer what we need for this issue.

Have you got Chrome installed on your machine? If so, do you remember configuring the certificate in Chrome too?

[krzkowalczyk]

I got the same issue, but I've managed to resolve it.
Electron uses chromium ca trust store which uses NSS Shared DB. Once I've added certificates to this store teletype succesfully connected to api.

More infor here : https://chromium.googlesource.com/chromium/src/+/lkcr/docs/linux_cert_management.md

[jasonrudolph]

@krzkowalczyk: Thanks for sharing this solution! 🙇

@bac @jrschumacher: Can you give this approach a try and let us know if it resolves this issue for you?

[kevteljeur]

Hi, I'm still having trouble with this. I tried making my own proxy (to... proxy through the proxy, if you follow, with a valid user/pass) which worked for talking to Teletype server, but not for Pusher (it didn't work entirely, only partially). I was curious more than anything. Anyway, now I'm experimenting with adding a proxy option to the Teletype config UI, and getting Teletype and Pusher to use that.

I think that fetch will not work, since that will be stopped by the proxy, but maybe there's another way around it.

[jasonrudolph]

@kevteljeur: Thanks for looking into this. If you find a solution that resolves the issue for you, or if you know of a way for us to reproduce the issue, please let us know.

[kevteljeur]

Actually, on closer inspection, I've hit a wall. I figured out how I could work with fetch to basically shim proxy support into the fetch call, so that it would function through a proxy (untested) but... Pusher is the web version, which doesn't have proxy support, and not the Node version, which does. Not sure where I can go from here.

Teletype would be a great tool for what I'm doing with other devs, but that damn proxy issue.

Updated to add what I'm trying to achieve: An additional field for specifying a proxy to use for Teletype (I looked at reading it from process.env, but that would be an assumption, especially if the developer had set up a local instance of Teletype server to use).

[kevteljeur]

So I've been trying to look at how a request via a proxy is structured; I don't know a lot about this, so I can't make effective use of the time I have available for it (I spent some time studying the npm Request module yesterday). Does anyone know if a request can be restructured for sending though a proxy in clientside JavaScript? If so, then it is possible, by modifying the fetch request (to Teletype server) and setting headers and URLs for Pusher.js. Combined with my suggested proxy field above, this is doable. I just don't know what modifications to make to the requests for that to be tested.

Also, I see that Slack (using Electronjs for their app) is able to do it. But their app is not open.

Does anyone know enough about proxies to be able to assist? I'd be happy to code up and field test any proposals. Teletype is a great feature, and I can't imagine that my team will be the only one benefitting from using Teletype behind an authenticated proxy.

[jrschumacher]

@jasonrudolph This only works for Linux it seems. I'm running on OSX High Sierra.

[jrschumacher]

Have you got Chrome installed on your machine? If so, do you remember configuring the certificate in Chrome too?

@as-cii For Chrome I didn't need to add a custom cert. It uses the cert in the Keychain Access.app. In Firefox it is required to install the custom cert as they don't use the system certs.