Closed Bug 1623582 Opened 6 years ago Closed 6 years ago

Firefox does not work with Google Meet behind an HTTP proxy

Categories

(Core :: WebRTC: Networking, defect)

68 Branch
defect
Not set
normal

Tracking

()

RESOLVED INACTIVE

People

(Reporter: marco.gaiarin, Unassigned)

Details

(Keywords: enterprise)

Attachments

(1 file)

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0

Steps to reproduce:

Win7 64bit machine, in a corporate LAN, behind an http proxy (squid), the only method to access internet. FF 68 ESR latest version.

I've tried to do a 'Google Meet' videoconference.

Actual results:

FF connects, screen 'freeze' (i see avatar on screen) then after a couple of seconds (20-30) disconnect with error:
impossibile avviare la videochiamata a causa di un errore di rete
verifica le impostazioni di firewall e riprova
in italian, raw translation:
unable to start the videocall because of a network error
check your firewall settings and restart

On proxy logs i see:
1584609711.155 30410 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 195857 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -
1584609714.935 55 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 948 POST http://ocsp.digicert.com/ - HIER_DIRECT/ocsp.digicert.com application/ocsp-response
1584609715.010 57 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 509 GET http://detectportal.firefox.com/success.txt - HIER_DIRECT/detectportal.firefox.com text/plain
1584609716.529 244 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 1297 POST http://ocsp.usertrust.com/ - HIER_DIRECT/ocsp.usertrust.com application/ocsp-response
1584609716.601 315 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 1297 POST http://ocsp.usertrust.com/ - HIER_DIRECT/ocsp.usertrust.com application/ocsp-response
1584609716.630 345 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 1297 POST http://ocsp.usertrust.com/ - HIER_DIRECT/ocsp.usertrust.com application/ocsp-response
1584609716.639 103 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 1042 POST http://ocsp.sectigo.com/ - HIER_DIRECT/ocsp.sectigo.com application/ocsp-response
1584609716.660 57 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 1042 POST http://ocsp.sectigo.com/ - HIER_DIRECT/ocsp.sectigo.com application/ocsp-response
1584609716.682 49 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 1042 POST http://ocsp.sectigo.com/ - HIER_DIRECT/ocsp.sectigo.com application/ocsp-response
1584609716.695 556 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 16057 CONNECT easylist-downloads.adblockplus.org:443 - HIER_DIRECT/easylist-downloads.adblockplus.org -
1584609716.699 559 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 7679 CONNECT notification.adblockplus.org:443 - HIER_DIRECT/notification.adblockplus.org -
1584609716.981 841 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 601431 CONNECT easylist-downloads.adblockplus.org:443 - HIER_DIRECT/easylist-downloads.adblockplus.org -
1584609719.468 61273 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 3806 CONNECT shavar.services.mozilla.com:443 - HIER_DIRECT/shavar.services.mozilla.com -
1584609727.576 11436 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 29522 CONNECT easylist-downloads.adblockplus.org:443 - HIER_DIRECT/easylist-downloads.adblockplus.org -
1584609749.780 47 DOMINIQUE.dyn.sv.lnf.it TAG_NONE/503 0 CONNECT redirector.gvt1.com:443 - HIER_NONE/- -
1584609766.293 86708 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 167402 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -
1584609771.473 115520 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 5352 CONNECT snippets.cdn.mozilla.net:443 - HIER_DIRECT/snippets.cdn.mozilla.net -
1584609771.473 116247 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 3675 CONNECT search.services.mozilla.com:443 - HIER_DIRECT/search.services.mozilla.com -
1584609775.788 61448 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 3755 CONNECT incoming.telemetry.mozilla.org:443 - HIER_DIRECT/incoming.telemetry.mozilla.org -
1584609776.475 117349 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 259009 CONNECT safebrowsing.googleapis.com:443 - HIER_DIRECT/safebrowsing.googleapis.com -
1584609776.507 60368 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 0 CONNECT easylist-downloads.adblockplus.org:443 - HIER_DIRECT/easylist-downloads.adblockplus.org -
1584609779.476 116891 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 7877 CONNECT sec-tws-prod-vip.webex.com:443 - HIER_DIRECT/sec-tws-prod-vip.webex.com -
1584609795.482 116279 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 4771 CONNECT fonts.googleapis.com:443 - HIER_DIRECT/fonts.googleapis.com -
1584609795.482 115950 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 43418 CONNECT fonts.gstatic.com:443 - HIER_DIRECT/fonts.gstatic.com -
1584609795.482 116282 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 5682 CONNECT fonts.googleapis.com:443 - HIER_DIRECT/fonts.googleapis.com -
1584609798.484 116335 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 117331 CONNECT www.gstatic.com:443 - HIER_DIRECT/www.gstatic.com -
1584609801.486 117187 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 88210 CONNECT firefox.settings.services.mozilla.com:443 - HIER_DIRECT/firefox.settings.services.mozilla.com -
1584609801.486 116581 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 10657 CONNECT content-signature-2.cdn.mozilla.net:443 - HIER_DIRECT/content-signature-2.cdn.mozilla.net -
1584609806.487 125386 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 6236 CONNECT play.google.com:443 - HIER_DIRECT/play.google.com -
1584609825.491 143746 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 11579 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584609825.492 143168 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 11882 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584609825.492 147340 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 709734 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -
1584609825.492 115379 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 8533 CONNECT lh3.googleusercontent.com:443 - HIER_DIRECT/lh3.googleusercontent.com -
1584609825.493 115484 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 6667 CONNECT lh3.googleusercontent.com:443 - HIER_DIRECT/lh3.googleusercontent.com -
1584609825.493 115396 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 2040 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -
1584609826.492 146958 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 271947 CONNECT fonts.gstatic.com:443 - HIER_DIRECT/fonts.gstatic.com -
1584609829.494 147417 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 11617 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584609865.501 116033 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 5280 CONNECT aus5.mozilla.org:443 - HIER_DIRECT/aus5.mozilla.org -
1584609865.502 184780 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 16866 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -

while on firewall logs i see:
13 29.789041707 10.5.2.147 → 74.125.250.129 STUN 62 Binding Request
14 29.789140496 10.5.1.254 → 10.5.2.147 ICMP 90 Destination unreachable (Communication administratively filtered)
15 29.889550320 10.5.2.147 → 74.125.250.129 STUN 62 Binding Request
16 29.889652994 10.5.1.254 → 10.5.2.147 ICMP 90 Destination unreachable (Communication administratively filtered)
17 30.090519786 10.5.2.147 → 74.125.250.129 STUN 62 Binding Request
18 30.090624704 10.5.1.254 → 10.5.2.147 ICMP 90 Destination unreachable (Communication administratively filtered)
19 30.491220621 10.5.2.147 → 74.125.250.129 STUN 62 Binding Request
20 30.491343152 10.5.1.254 → 10.5.2.147 ICMP 90 Destination unreachable (Communication administratively filtered)
21 30.736594669 10.5.2.147 → 74.125.250.76 STUN 150 Binding Request user: ekvhiprNLdk2LgAo:e3291ada
22 30.736726347 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
23 30.756640989 10.5.2.147 → 108.177.126.127 STUN 150 Binding Request user: ekvhiprNLdk2LgAo:e3291ada
24 30.756753049 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
25 30.836377208 10.5.2.147 → 74.125.250.76 STUN 150 Binding Request user: ekvhiprNLdk2LgAo:e3291ada
26 30.836476198 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)

so, a sequence of STUN connection tries, that clearly the firewall block.

Expected results:

On the same box i've fired up Chrome (latest version 80), that connect pervectly in videoconference.

On squid logs i see:
1584610099.399 112 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 3781 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -
1584610101.587 17 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 0 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584610101.587 17 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 0 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584610102.065 0 DOMINIQUE.dyn.sv.lnf.it TCP_DENIED/403 3750 CONNECT 74.125.250.42:19305 - HIER_NONE/- text/html
1584610102.066 0 DOMINIQUE.dyn.sv.lnf.it TCP_DENIED/403 3747 CONNECT 66.102.1.127:19305 - HIER_NONE/- text/html
1584610102.129 64 DOMINIQUE.dyn.sv.lnf.it TCP_DENIED/407 3941 CONNECT 66.102.1.127:443 - HIER_NONE/- text/html
1584610102.130 64 DOMINIQUE.dyn.sv.lnf.it TCP_DENIED/407 3945 CONNECT 74.125.250.42:443 - HIER_NONE/- text/html
1584610102.140 7 DOMINIQUE.dyn.sv.lnf.it TCP_DENIED/407 4296 CONNECT 66.102.1.127:443 - HIER_NONE/- text/html
1584610102.140 7 DOMINIQUE.dyn.sv.lnf.it TCP_DENIED/407 4300 CONNECT 74.125.250.42:443 - HIER_NONE/- text/html
1584610110.216 10606 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 4362 CONNECT clients6.google.com:443 - HIER_DIRECT/clients6.google.com -
1584610114.647 52 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 277 HEAD http://redirector.gvt1.com/edgedl/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/proxy.sv.lnf.it text/html
1584610118.644 2 DOMINIQUE.dyn.sv.lnf.it TAG_NONE/503 0 CONNECT redirector.gvt1.com:443 - HIER_NONE/- -
1584610122.814 129 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/200 571 HEAD http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610129.992 117 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 1418 CONNECT lh3.googleusercontent.com:443 - HIER_DIRECT/lh3.googleusercontent.com -
1584610132.868 30727 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 173 CONNECT 66.102.1.127:443 gaio HIER_DIRECT/66.102.1.127 -
1584610135.896 71 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/206 5504 GET http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610153.886 61 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/206 7857 GET http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610159.198 57056 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 509014 CONNECT 74.125.250.42:443 gaio HIER_DIRECT/74.125.250.42 -
1584610160.885 60 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/206 8282 GET http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610161.888 63 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/206 10567 GET http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610162.904 79 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/206 23287 GET http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610163.955 99704 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 163366 CONNECT ssl.gstatic.com:443 - HIER_DIRECT/ssl.gstatic.com -
1584610163.955 16294 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 807608 CONNECT safebrowsing.googleapis.com:443 - HIER_DIRECT/safebrowsing.googleapis.com -
1584610163.985 95 DOMINIQUE.dyn.sv.lnf.it TCP_MISS/206 47584 GET http://dl.google.com/release2/chrome_component/JMPoiR99aknFUMQ7HfmM3A_80.230.200/bOTNMKIbBeN706DMCSR0vg - HIER_DIRECT/dl.google.com application/octet-stream
1584610163.992 106790 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 57026 CONNECT apis.google.com:443 - HIER_DIRECT/apis.google.com -
1584610163.992 107453 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 4915 CONNECT accounts.google.com:443 - HIER_DIRECT/accounts.google.com -
1584610163.992 107045 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 192105 CONNECT www.gstatic.com:443 - HIER_DIRECT/www.gstatic.com -
1584610163.992 106441 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 5184 CONNECT update.googleapis.com:443 - HIER_DIRECT/update.googleapis.com -
1584610163.992 107454 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 63915 CONNECT www.google.com:443 - HIER_DIRECT/www.google.com -
1584610163.993 107455 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 7203 CONNECT clients2.google.com:443 - HIER_DIRECT/clients2.google.com -
1584610163.994 64707 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 1058368 CONNECT meet.google.com:443 - HIER_DIRECT/meet.google.com -
1584610163.994 107062 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 7935 CONNECT fonts.googleapis.com:443 - HIER_DIRECT/fonts.googleapis.com -
1584610163.994 106780 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 19325 CONNECT ogs.google.com:443 - HIER_DIRECT/ogs.google.com -
1584610163.994 64203 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 4810 CONNECT clients1.google.com:443 - HIER_DIRECT/clients1.google.com -
1584610163.994 64383 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 29273 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584610163.995 49768 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 5296 CONNECT clients4.google.com:443 - HIER_DIRECT/clients4.google.com -
1584610163.994 63697 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 5853 CONNECT play.google.com:443 - HIER_DIRECT/play.google.com -
1584610163.995 62478 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 10551 CONNECT hangouts.clients6.google.com:443 - HIER_DIRECT/hangouts.clients6.google.com -
1584610163.994 34120 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 8894 CONNECT lh3.googleusercontent.com:443 - HIER_DIRECT/lh3.googleusercontent.com -
1584610163.994 53776 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 9356 CONNECT play.google.com:443 - HIER_DIRECT/play.google.com -
1584610163.994 64288 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 305355 CONNECT fonts.gstatic.com:443 - HIER_DIRECT/fonts.gstatic.com -
1584610163.995 62398 DOMINIQUE.dyn.sv.lnf.it TCP_TUNNEL/200 117270 CONNECT www.gstatic.com:443 - HIER_DIRECT/www.gstatic.com -

Note the TCP_DENIED row: to port 19305 because it is not an allowed port; to port 443 because CONNECT to an IP address is forbidden by an ACL.

on firewall, the same STUN tries:
180 449.651188450 10.5.2.147 → 74.125.250.42 STUN 150 Binding Request user: RALxukdaYpygZTE1:EGyB
181 449.651297357 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
182 449.699723223 10.5.2.147 → 66.102.1.127 STUN 150 Binding Request user: RALxukdaYpygZTE1:EGyB
183 449.699848897 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
184 449.747827153 10.5.2.147 → 74.125.250.42 STUN 150 Binding Request user: RALxukdaYpygZTE1:EGyB
185 449.747944884 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
186 449.796513228 10.5.2.147 → 66.102.1.127 STUN 150 Binding Request user: RALxukdaYpygZTE1:EGyB
187 449.796626486 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
188 449.845650533 10.5.2.147 → 74.125.250.42 STUN 150 Binding Request user: RALxukdaYpygZTE1:EGyB
189 449.845755840 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)
190 449.894526819 10.5.2.147 → 66.102.1.127 STUN 150 Binding Request user: RALxukdaYpygZTE1:EGyB
191 449.894676262 10.5.1.254 → 10.5.2.147 ICMP 178 Destination unreachable (Communication administratively filtered)

Component: Untriaged → Networking
Product: Firefox → Core

Hi Reporter,

Could you try to get the http log?
Also, I think maybe webrtc is the right component for this.

Component: Networking → WebRTC: Networking
Flags: needinfo?(gaio)
Whiteboard: [enterprise]

Attached the log as requested.

I've pasted the meet link in browser, enabled log, click 'join', approve the connection (from another PC, of course), wait that the connection fail, stop the log.

Thanks.

Flags: needinfo?(gaio)

A copy of about:webrtc would probably be helpful here.

Flags: needinfo?(gaio)

Ahem, sorry, i've not understood.

I've oipened about:webrtc, and save the page, but is rather empty. I've to save it after a connection try? Before?

I'm a little ignorant of WebRTC, so, please, be specific. Thanks.

Try refreshing the about:webrtc page. Yes, you'll want to save it after a connection try, before closing the tab that is trying to connect.

about:webrtc should give you info from peer connections in every tab that is still open, whether the page has pc.close()d its peer connections or not. But if you close the tab they'll disappear.

To isolate the problem, it is best to open about:webrtc ahead of time and click "Clear History" and "Clear log" and make sure it is empty. Then come back after the connection attempt, refresh the about:webrtc page, and save it. Hope that helps.

I think i've just done that, on my bugreport.

Anyway (and sorry, i've a bit forgot about this in this COVID time...) after some days also Chrome depicted the same behaviour as FF (eg, does not connect). Looking at Meet docs, i've hit:

https://support.google.com/a/answer/1279090

eg, i've opened firewall to 74.125.250.0/24. Probably now also FF works, but i'm not able to test it now.

Still is a bit strange that WebRTC works 'sometimes' behind a proxy. Boh.

Flags: needinfo?(gaio)

Marking this as inactive for now. If this becomes a problem again, feel free to reopen it.

Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Resolution: --- → INACTIVE
Keywords: enterprise
Whiteboard: [enterprise]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: