Jira (PUP-2172) Add exceptions to http_proxy_{port,host}

[James Ralston (JIRA)]

Title: Message Title

James Ralston commented on PUP-2172   Re: Add exceptions to http_proxy_{port,host} I'm re-opening this ticket, because I believe the severity of the problem hasn't been fully appreciated. Any security-competent site that requires outbound HTTP[S] traffic to use a network proxy will have configured the proxy to deny all requests for internal resources. (Otherwise, internal users can bypass internal network ACLs by routing requests through the proxy.) This means that any application that is proxy-aware must implement an exception list for the proxy. Without this exception list, the application is essentially offering its users two choices: You can access foreign resources, but not local resources. You can access local resources, but not foreign resources. We see this in the applications that rely on the curl-style (http_proxy, https_proxy, and no_proxy) environment variables. E.g.: $ set | grep proxy http_proxy=http://proxy.example.org:8080 https_proxy=http://proxy.example.org:8080 no_proxy=localhost,.example.org The no_proxy setting is not optional: without this, applications will not be able to access local resources. As a real-world example of just how critical the no_proxy list is, consider this example: package { 'r10k': ensure => present, provider => puppet_gem, } This cannot be implemented with sites that use a proxy. If I do not configure the agent to use the proxy, then the agent will fail to install the gem: Error: Execution of '/opt/puppetlabs/puppet/bin/gem install --no-rdoc --no-ri r10k' returned 2: ERROR: Could not find a valid gem 'r10k' (>= 0), here is why: Unable to download data from https://rubygems.org/ - Errno::ENETUNREACH: Failed to open TCP connection to api.rubygems.org:443 (Network is unreachable - connect(2) for "api.rubygems.org" port 443) (https://api.rubygems.org/specs.4.8.gz) But if I configure the agent to use the proxy, the agent will attempt to use the proxy to connect to the Puppet server, which fails: Warning: Unable to fetch my node definition, but the agent run will continue: Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppetserver.example.org] To put it as bluntly as possible: without the ability to add exception lists, Puppet's proxy handling is fundamentally broken, and for Puppet users who have to use a (properly-configured) proxy server, Puppet's broken proxy handling breaks core features of Puppet. (The only reason why Puppet has been usable for us until now is because up to this point, we have haven't needed to set proxy settings for Puppet, because we have only used package resources to install RPM packages, and we mirror all yum repositories locally. But we have customers who want to use Puppet package resources with other providers, and mirroring all of rubygems.org, pypi.python.org, et. al. locally just to work around Puppet's broken proxy handling is a really tough sell.) Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.