Firebase app seems to bypass proxy

JarnoRFB commented 6 months ago

Description

A client of mine wants to use our iPadOS app behind a proxy. While all normal connections to firebase work, all subscriptions to firestore do not work. The client reported that they can see in the firewall that some connections are bypassing the http proxy (WinGate), and directly use tcp, which is then blocked by the firewall. The connection to the proxy is configured in the iPad settings.

So my question is, whether it is possible to make the subscriptions go through the http proxy or just use http directly, which should already force it to through the proxy. Interestingly, the web version of our app that uses the same firebase backend works without problems. Any pointers are greatly appreciated!

Note: I was in contact with firebase support already as was directed towards GitHub.

Related issues

Reproducing the issue

Unfortunately, I can not reproduce the problem in my local network.

Firebase SDK Version

10.20.0

Xcode Version

15.2

Installation Method

Swift Package Manager

Firebase Product(s)

Firestore

Targeted Platforms

iOS

Relevant Log Output

No response

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

```json { "pins" : [ { "identity" : "abseil-cpp-binary", "kind" : "remoteSourceControl", "location" : "https://github.com/google/abseil-cpp-binary.git", "state" : { "revision" : "bfc0b6f81adc06ce5121eb23f628473638d67c5c", "version" : "1.2022062300.0" } }, { "identity" : "alamofire", "kind" : "remoteSourceControl", "location" : "https://github.com/Alamofire/Alamofire.git", "state" : { "revision" : "78424be314842833c04bc3bef5b72e85fff99204", "version" : "5.6.4" } }, { "identity" : "app-check", "kind" : "remoteSourceControl", "location" : "https://github.com/google/app-check.git", "state" : { "revision" : "3e464dad87dad2d29bb29a97836789bf0f8f67d2", "version" : "10.18.1" } }, { "identity" : "cryptoswift", "kind" : "remoteSourceControl", "location" : "https://github.com/krzyzanowskim/CryptoSwift.git", "state" : { "revision" : "19b3c3ceed117c5cc883517c4e658548315ba70b", "version" : "1.6.0" } }, { "identity" : "firebase-ios-sdk", "kind" : "remoteSourceControl", "location" : "https://github.com/firebase/firebase-ios-sdk.git", "state" : { "revision" : "b880ec8ec927a838c51c12862c6222c30d7097d7", "version" : "10.20.0" } }, { "identity" : "googleappmeasurement", "kind" : "remoteSourceControl", "location" : "https://github.com/google/GoogleAppMeasurement.git", "state" : { "revision" : "ceec9f28dea12b7cf3dabf18b5ed7621c88fd4aa", "version" : "10.20.0" } }, { "identity" : "googledatatransport", "kind" : "remoteSourceControl", "location" : "https://github.com/google/GoogleDataTransport.git", "state" : { "revision" : "a732a4b47f59e4f725a2ea10f0c77e93a7131117", "version" : "9.3.0" } }, { "identity" : "googleutilities", "kind" : "remoteSourceControl", "location" : "https://github.com/google/GoogleUtilities.git", "state" : { "revision" : "bc27fad73504f3d4af235de451f02ee22586ebd3", "version" : "7.12.1" } }, { "identity" : "grpc-binary", "kind" : "remoteSourceControl", "location" : "https://github.com/google/grpc-binary.git", "state" : { "revision" : "a673bc2937fbe886dd1f99c401b01b6d977a9c98", "version" : "1.49.1" } }, { "identity" : "gtm-session-fetcher", "kind" : "remoteSourceControl", "location" : "https://github.com/google/gtm-session-fetcher.git", "state" : { "revision" : "5ccda3981422a84186387dbb763ba739178b529c", "version" : "2.3.0" } }, { "identity" : "interop-ios-for-google-sdks", "kind" : "remoteSourceControl", "location" : "https://github.com/google/interop-ios-for-google-sdks.git", "state" : { "revision" : "2d12673670417654f08f5f90fdd62926dc3a2648", "version" : "100.0.0" } }, { "identity" : "iqkeyboardmanager", "kind" : "remoteSourceControl", "location" : "https://github.com/hackiftekhar/IQKeyboardManager.git", "state" : { "revision" : "1e442766a41e2948df25559eb03ab752c6d3aad0", "version" : "6.5.0" } }, { "identity" : "leveldb", "kind" : "remoteSourceControl", "location" : "https://github.com/firebase/leveldb.git", "state" : { "revision" : "0706abcc6b0bd9cedfbb015ba840e4a780b5159b", "version" : "1.22.2" } }, { "identity" : "lottie-spm", "kind" : "remoteSourceControl", "location" : "https://github.com/airbnb/lottie-spm.git", "state" : { "revision" : "26d84192430ed5b104d64b8086872bb4979d65a4", "version" : "4.4.0" } }, { "identity" : "nanopb", "kind" : "remoteSourceControl", "location" : "https://github.com/firebase/nanopb.git", "state" : { "revision" : "819d0a2173aff699fb8c364b6fb906f7cdb1a692", "version" : "2.30909.0" } }, { "identity" : "promises", "kind" : "remoteSourceControl", "location" : "https://github.com/google/promises.git", "state" : { "revision" : "e70e889c0196c76d22759eb50d6a0270ca9f1d9e", "version" : "2.3.1" } }, { "identity" : "sdwebimage", "kind" : "remoteSourceControl", "location" : "https://github.com/SDWebImage/SDWebImage.git", "state" : { "revision" : "c51ba84499268ea3020e6aee9e229c0f56b9d924", "version" : "5.16.0" } }, { "identity" : "sdwebimageswiftui", "kind" : "remoteSourceControl", "location" : "https://github.com/SDWebImage/SDWebImageSwiftUI", "state" : { "revision" : "e837c37d45449fbd3b4745c10c5b5274e73edead", "version" : "2.2.3" } }, { "identity" : "semaphore", "kind" : "remoteSourceControl", "location" : "https://github.com/groue/Semaphore", "state" : { "revision" : "f1c4a0acabeb591068dea6cffdd39660b86dec28", "version" : "0.0.8" } }, { "identity" : "starscream", "kind" : "remoteSourceControl", "location" : "https://github.com/daltoniam/Starscream.git", "state" : { "revision" : "ac6c0fc9da221873e01bd1a0d4818498a71eef33", "version" : "4.0.6" } }, { "identity" : "swift-power-assert", "kind" : "remoteSourceControl", "location" : "https://github.com/kishikawakatsumi/swift-power-assert", "state" : { "revision" : "2fa10dcbbff807fad73b4e2469b43300a50e9bbc", "version" : "0.12.0" } }, { "identity" : "swift-protobuf", "kind" : "remoteSourceControl", "location" : "https://github.com/apple/swift-protobuf.git", "state" : { "revision" : "ab3a58b7209a17d781c0d1dbb3e1ff3da306bae8", "version" : "1.20.3" } }, { "identity" : "swift-syntax", "kind" : "remoteSourceControl", "location" : "https://github.com/apple/swift-syntax.git", "state" : { "revision" : "ffa3cd6fc2aa62adbedd31d3efaf7c0d86a9f029", "version" : "509.0.1" } }, { "identity" : "viewinspector", "kind" : "remoteSourceControl", "location" : "https://github.com/nalexn/ViewInspector", "state" : { "branch" : "0.9.8", "revision" : "c4e73093f926247fd5805e53d3fe4b523e605502" } } ], "version" : 2 } ```

If using CocoaPods, the project's Podfile.lock

No response

google-oss-bot commented 6 months ago

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

JarnoRFB commented 6 months ago

Was able to reproduce the problem with the following steps:

Configure the proxy on iOS with an Ethernet connection.
Manually configure a wrong Gateway,
Disable the IPv6 DNS entry
Disable Wi-Fi

This way all traffic has to go through the proxy.

With this setup, I was not able to make any firestore subscriptions work.

However, when adding the following code to the AppDelegate

if let proxySettingsUnmanaged = CFNetworkCopySystemProxySettings() {
    let proxySettings = proxySettingsUnmanaged.takeRetainedValue()
    print("CFNetwork Proxies: \(proxySettings)")
    if let ip = (proxySettings as NSDictionary)["HTTPSProxy"] as? String,
        let port = (proxySettings as NSDictionary)["HTTPSPort"] as? Int {
        setenv("grpc_proxy", "http://\(ip):\(port)", 1)
    }
}

the connections are working again. I got the reference for the environment variable grpc_proxy from the grpc rerference. I still have to verify the solution with the client though.

ehsannas commented 6 months ago

Thanks for reporting @JarnoRFB . Let me know how it goes.

JarnoRFB commented 6 months ago

My client could confirm that this solution works on their network 👍 It would be nice if these implications would be documented somewhere, as it was extremely hard to find out that

gRPC was the reason for the problem
which variant of gRPC is actually used in the iOS SDK
that setting the grpc_proxy environment variable would actually provide a solution

jesus-mg-ios commented 5 months ago

Any updates on it?

firebase / firebase-ios-sdk