running MSDO behind the proxy

[osilberman]

provide a way to set a proxy in the devops task to avoid copying .npmrc manually to the account running pipeline on a self-hosted agent server

[davidknise]

Hi @osilberman, can you provide more details?

[davidknise]

I looked into this and realized eslint fails on my devbox due to a global @microsoft registry defined.

I've filed an item for the team to look into.

[osilberman]

Hi @davidknise thank you for your response. The reason of my question is this one (also filed here https://github.com/microsoft/security-devops-azdevops/issues/56)

I receive below error running the task on windows self-hosted agent. The error appeared starting 16th of June:

Installing Microsoft Security DevOps Cli version: Latest ##[debug]packageName = Microsoft.Security.Devops.Cli.win-x64 ##[debug]agentDirectory = C:\agt_work_msdo ##[debug]agentPackagesDirectory = C:\agt_work_msdo\packages ##[debug]agentVersionsDirectory = C:\agt_work_msdo\versions ##[debug]MSDO CLI version contains a latest quantifier: Latest. Continuing with install... ##[debug]MSDO_MICROSOFTSECURITYDEVOPSCLIWINX64_LATESTVERSION=undefined ##[debug]Fetching service index for: https://api.nuget.org/v3/index.json ##[debug]GET https://api.nuget.org/v3/index.json ##[debug]Error: Error calling url: Error: connect ECONNREFUSED 13.107.246.67:443 ##[debug]MSDO_MICROSOFTSECURITYDEVOPSCLIWINX64_LATESTVERSION=undefined ##[debug]Fetching service index for: https://api.nuget.org/v3/index.json ##[debug]GET https://api.nuget.org/v3/index.json ##[debug]Error: Error calling url: Error: connect ECONNREFUSED 13.107.246.67:443 ##[debug]MSDO_MICROSOFTSECURITYDEVOPSCLIWINX64_LATESTVERSION=undefined ##[debug]Fetching service index for: https://api.nuget.org/v3/index.json ##[debug]GET https://api.nuget.org/v3/index.json ##[debug]Error: Error calling url: Error: connect ECONNREFUSED 13.107.246.67:443 Exception occurred while initializing MSDO: ##[debug]task result: Failed ##[error]Error: Failed to install the MSDO CLI nuget package. ##[debug]Processed: ##vso[task.issue type=error;]Error: Failed to install the MSDO CLI nuget package. ##[debug]Processed: ##vso[task.complete result=Failed;]Error: Failed to install the MSDO CLI nuget package.

Does it have to do with your update? The agent version is the latest 2.218.1

Thank you!!

[exigopro]

Facing the same issue. I believe permitting access to api.nuget.org from your self-hosted agent might work. Will perform some testing.

[osilberman]

were you successful with your testing?

[CapgG-sleeke]

Hi,

I had the same issue and originally raised as incident here : Error: Failed to install the MSDO CLI nuget package while running behind proxy #59

I have tracked the issue down to a specific JS script : msdo-nuget-client.js

The ultimate issue is the msdo nuget client just doesnt handle a proxy.

is complete msdo has the tunnel library included so it is simple to update.

Add the below on line 37 :

const tunnel = __importStar(require("tunnel"));

the replace the function called resolveRequestOptions ( rough line 348 )

function resolveRequestOptions(accessToken) {
     // Add Proxy Support https over http
    let options = {
        method: 'GET',
        timeout: 2500,
        headers: {
            'Content-Type': 'application/json'
        }
	};			
    var tunnelineAgent = false;
	console.log(`## Info :: resolveRequestOptions :: Checking Proxy Env for Request Options`);
	if (process.env.http_proxy) {
		console.log(`## Info :: resolveRequestOptions :: Adding Proxy for Request Options`);
		try {
			const proxyurl = new URL(process.env.http_proxy);
	        tunnelineAgent = tunnel.httpsOverHttp({
                            proxy: {
                            host: proxyurl.hostname ,
                            port: proxyurl.port 
                            }
                        });
				options['agent'] = tunnelineAgent ;     
        } catch (error) {
	        console.log(`## warning proxy env variable malformed :: example http://proxyserver:8080 :: ${error}`);
		}
	} else {
		console.log(`## Info :: resolveRequestOptions :: No Proxy Env Request Options`);
    }
    if (!common.isNullOrWhiteSpace(accessToken)) {
	console.log(`## Info :: An accessToken is being used`);
        options['auth'] = `:${accessToken}`;
    } else {
	    console.log(`## Info :: No accessToken is being used`);
    }
    return options;
}

This then works a treat when having a proxy or not. This only really handles https over a http proxy though.

	        tunnelineAgent = tunnel.httpsOverHttp({
                            proxy: {
                            host: proxyurl.hostname ,
                            port: proxyurl.port 
                            }
                        });

it should really handle https over https it would be something like, but you need to use proxyurl.protocol == 'https:' to decide

	        tunnelineAgent = tunnel.httpsOverHttps({
                            proxy: {
                            host: proxyurl.hostname ,
                            port: proxyurl.port 
                            }
                        });