Skip to content
English
Submit an issue
Go to rosemanlabs.com
  • There are no suggestions because the search field is empty.

Network proxy debugging

In some cases, your organization might have hardened security requirements with respect to the domains that can be reached from the company network. If all network is routed via a proxy, this might cause issues when the traffic between the client and the engine is intercepted or blocked. This article helps to assess and debug those issues. 

Proxy blocks HTTP-traffic

When traffic to and from the engine/platform is blocked, 

  • In platform: A white page when logging in to the platform, or a page mentioning connection issues.
  • In python/crandas: An error when trying to connect to the engine. These can be SSL-related errors or protocol errors. For example:
    • 'WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProtocolError('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))': /crandas/' 

Debugging

When either of the above happens, your proxy was configured to block traffic to *.rosemancloud.com

Please contact your network/security team to allowlist this domain. You can test if this was successful by logging in to the platform. You can also check if the engine endpoint is available by testing <vdl-envname>-node0.rosemancloud.com/api/v1(replace <vdl-envname> by the name of the environment).

Proxy strips headers from HTTP-traffic

You might also encounter the following when connecting to the engine via crandas (e.g. after running cd.connect('<vdl-envname>.vdlconn') ):

  • '401 Unauthorized. Please provide a valid API Token through the connection file or parameters and make sure your client is up-to-date.' 

In this case, the proxy strips some of the HTTPS-headers, including the Python client's API-token. This causes the engine to reject the incoming connection.

To test if this is the case, you can try to send an HTTPS-request to the engine's endpoint and check the result. E.g. try the following in the CLI. The <API-token> can be found in the connection file, which cn be downloaded from the platform. You can paste the token it as-is:

curl -H "Authorization: Basic <api-token>" -kd '{"mpcinfo": "yes"}' https://<vdl-envname>-node0.rosemancloud.com/api/v1

A correct result should look something like:


{"buildinfo":"Build: v1.22.2","maxint":"9409569905028393238","number_of_parties":3,"threshold":1}

When the authorization header is stripped, you should see the following:

{"error": "401 Unauthorized. Please provide a valid API Token through the connection file or parameters and make sure your client is up-to-date.", "status": 401 }

In this case, please ask your network/security team to allowlist *.rosemancloud.com for TLS-passthrough and to preserve the HTTPS-headers on this domain.