Discovery: GCP Hosts scan using IAP fails with the error 'WebSocketBadStatusException' object has no attribute 'startswith'

Knowledge Article

Article Number

000425924

Old Article Number

Article Type

Solutions to a Product Problem

Title

Discovery: GCP Hosts scan using IAP fails with the error 'WebSocketBadStatusException' object has no attribute 'startswith'

Summary

This may happen when using a proxy that doesn't allow traffic to the domains tunnel.cloudproxy.app and
mtls.tunnel.cloudproxy.app

Product

BMC Discovery

Component

BMC Discovery

Applies to

BMC Discovery GCP Scanning

Problem

Despite meeting all the necessary prerequisites(listed below), scanning GCP Hosts using IAP fails with the error: 'WebSocketBadStatusException' object has no attribute 'startswith'. The scan is conducted from an Appliance using an HTTP internet proxy (configured in GCP Credential).

Prerequisites:
The following permissions/roles are configured on the GCP Service account used for scanning:

Viewer
Compute Instance Admin (v1)
IAP-Secured Tunnel User
Service Account User

Additional Configurations:

Cloud Resource Manager API is enabled.
IAP API is enabled at every project level.
At least one firewall rule is created to allow ingress traffic from the IP range 35.235.240.0/20 (GCP IP range that IAP uses for TCP forwarding) on the required SSH/PowerShell ports.

Debug Log Report:
The following is reported in the discovery debug log:

websocket._exceptions.WebSocketBadStatusException:
Handshake status 403 DefaultErrorTe
.
.
Error Generated by (Proxy name/ID) : <HTTP Proxy Address>
In The Cloud : true
Client IP : <Client_IP>
Client Connection IP : <Client_Connection_IP>
Proxy IP: 0.0.0.0
Proxy Incoming Port : 8080
Proxy Incoming Protocol : HTTP
Proxy Outbound IP : 0.0.0.0
URL Host : tunnel.cloudproxy.app
URL : <URL>
URL Categories : Internet Services
URL Reputation : Minimal Risk
Block Reason : Default Error Template
Error Message :
User-Agent : invocation-id/f47b3b594daa42a98cfa0ac91cb83499 environment/None environment-version/None interactive/False
Ruleset : Block_FINAL
Rule : Block_all
OnPremProxy ID : <ID>

Cause

This error occurs because the configured HTTP internet proxy is blocking all socket connections or specific domains.

Solution

As documented here:

"IAP uses the following domains, which are owned by Google:

tunnel.cloudproxy.app
mtls.tunnel.cloudproxy.app (if certificate-based access is enabled)

If connecting through a proxy server or firewall, ensure they allow traffic to these domains and do not block WebSocket connections. Blocking traffic to these domains will prevent the use of IAP for TCP, resulting in various error messages."

Solution:

Allow traffic to the domains tunnel.cloudproxy.app and mtls.tunnel.cloudproxy.app (if certificate-based access is enabled), or bypass the proxy/firewall.

Attachment(s):