Jira (PUP-9316) implement no_proxy in puppet.conf

[Elof Ofel (JIRA)]

Title: Message Title

Elof Ofel commented on PUP-9316   Re: implement no_proxy in puppet.conf Actually, the problem here was that puppet 5.5.16 and prior versions did not work in the manner the manual stated. The manual for http_proxy_host says "Environment variable http_proxy or HTTP_PROXY will override this value" but apparently it never did. But now in 5.5.17 this is fixed.   So this discussion doesn't really have to do explicitly with the 'no_proxy' variable, but rather with the rest of the environment variable handling that was changed in the commit.   In my case this fix became a major problem even though it was just a minor version upgrade.     Some logs just because you asked for them:   I have the new version 5.5.17: # dpkg -l | grep puppet ii puppet-agent 5.5.17-1stretch amd64 ii puppet5-release 5.0.0-7stretch all   I don't even have any 'no_proxy' ENV (but I do have a http_proxy): # env | grep -i proxy HTTP_PROXY=http://10.x.x.x:3128/ FTP_PROXY=http://10.x.x.x:3128/ https_proxy=http://10.x.x.x:3128/ http_proxy=http://10.x.x.x:3128/ HTTPS_PROXY=http://10.x.x.x:3128/ ftp_proxy=http://10.x.x.x:3128/   In puppet.conf I specify no proxy. # grep -i proxy /etc/puppetlabs/puppet/puppet.conf <no match>   According to the manual, puppet should use the proxy, but in 5.5.16 and earlier it didn't. But now in 5.5.17 it does. Debug output: # puppet agent -t --noop --debug --http_debug ... ... opening connection to 10.30.8.5:3128... opened <- "CONNECT mypuppetserver.foo.bar.se:8140 HTTP/1.1\r\nHost: mypuppetserver.foo.bar.se:8140\r\n\r\n" -> "HTTP/1.1 403 Forbidden\r\n" -> "Server: squid\r\n" -> "Mime-Version: 1.0\r\n" -> "Date: Fri, 25 Oct 2019 08:54:52 GMT\r\n" -> "Content-Type: text/html;charset=utf-8\r\n" -> "Content-Length: 3479\r\n" -> "X-Squid-Error: ERR_ACCESS_DENIED 0\r\n" -> "Vary: Accept-Language\r\n" -> "Content-Language: en\r\n" -> "X-Cache: MISS from proxy4\r\n" -> "X-Cache-Lookup: NONE from myproxy4:3128\r\n" -> "Connection: keep-alive\r\n" -> "\r\n" Conn close because of connect error 403 "Forbidden" Warning: Unable to fetch my node definition, but the agent run will continue: Warning: 403 "Forbidden" ... ...   So the traffic is now sent to my proxy (which it has never done before). The proxy says ERR_ACCESS_DENIED, which is correct since the puppet traffic has never passed through the proxy before.   Just to verify, I unset the proxy and try again: # unset HTTP_PROXY # unset HTTPS_PROXY # unset https_proxy # unset http_proxy # puppet agent -t --noop --debug --http_debug   Now 5.5.17 works fine using a direct connection (GET, not CONNECT to a proxy).     Just for comparison, I downgrade puppet back to 5.5.16: # dpkg -l | grep puppet ii puppet-agent 5.5.16-1stretch amd64 ii puppet5-release 5.0.0-7stretch all   I restore the ENV back to normal: # env | grep -i proxy HTTP_PROXY=http://10.x.x.x:3128/ FTP_PROXY=http://10.x.x.x:3128/ https_proxy=http://10.x.x.x:3128/ http_proxy=http://10.x.x.x:3128/ HTTPS_PROXY=http://10.x.x.x:3128/ ftp_proxy=http://10.x.x.x:3128/   I run puppet again: # puppet agent -t --noop --debug --http_debug It works. It uses direct GET, not CONNECT to a proxy.   So puppet 5.5.16 (and prior versions) has always been accessing the puppetserver directly, disregarding the ENV proxy settings even though the manual said they would be used.   All in all, the new behavior is the correct one, 'cause now puppet honor the ENV as it always should have. In my case this introduced a problem. To solve this, I will either allow puppet via the proxy or add my puppetserver IP and fqdn to the 'no_proxy' ENV variable.   Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.285347.1542320475000.6780.1571996640323%40Atlassian.JIRA.