apt-key net-update does not obey APT::Acquire::http::Proxy
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| apt (Ubuntu) |
Triaged
|
Medium
|
Unassigned | ||
Bug Description
[Impact]
IWBNI apt-key obeyed apt's network preferences like the rest of the apt-* tools do. The fix is to append a timeout option to wget which is invoked in apt-key during key retrieval. An example, would be attempting to reduce the number of retries wget performs in order to receive the gpg key. The default is 20 tries, however, if the firewall is set to DROP packets then thats a 90*20 timeout.
[Test Case]
# iptables -A OUTPUT -p tcp --dport 80 -j DROP
# wget -q -N http://
[endless hang] ^C
# iptables -F
# iptables -A OUTPUT -p tcp --dport 80 -j REJECT
# wget --timeout=90 -q -N http://
[returns in 90 seconds]
#
# iptables -F
# wget --timeout=90 -q -N http://
[returns instantly]
#
#
# iptables -A OUTPUT -p tcp --dport 80 -j DROP
# route del default
# wget --timeout=90 -q -N http://
[returns instantly]
[Regression Potential]
Potential for regression is minimal as this would allow apt-key to successfully timeout if the keyserver is unreachable and allow for continued operation required by other services (i.e. cron executed instances)
| Mark Goldfinch (mark-goldfinch) wrote | #1 |
| Dimas (dimasmjunior) wrote | #2 |
| Adelie (dave-solar1) wrote | #3 |
| Stanislas Couix (stanislas-couix) wrote | #4 |
| Changed in apt (Ubuntu): | |
| status: | New → Confirmed |
| Stéphane Loeuillet (leroutier) wrote | #5 |
| Mathias (mathias-me) wrote | #6 |
| Johannes Martin (jmartin-notamusica) wrote | #7 |
| Changed in apt (Ubuntu): | |
| status: | Confirmed → Triaged |
| importance: | Undecided → Medium |
| tags: | added: rls-mgr-p-tracking |
| tags: | added: precise |
| Changed in apt (Ubuntu Precise): | |
| importance: | Undecided → Medium |
| Changed in apt (Ubuntu Lucid): | |
| importance: | Undecided → Medium |
| status: | New → Triaged |
| Changed in apt (Ubuntu Precise): | |
| status: | New → Triaged |
| Changed in apt (Ubuntu Precise): | |
| milestone: | none → ubuntu-12.04.1 |
| description: | updated |
| description: | updated |
| Michael (miiichael) wrote | #8 |
| Launchpad Janitor (janitor) wrote | #9 |
| Changed in apt (Ubuntu Natty): | |
| status: | New → Confirmed |
| Changed in apt (Ubuntu Oneiric): | |
| status: | New → Confirmed |
| Changed in apt (Ubuntu Precise): | |
| milestone: | ubuntu-12.04.1 → precise-updates |
| Changed in apt (Ubuntu Natty): | |
| status: | Confirmed → Won't Fix |
| Changed in apt (Ubuntu Oneiric): | |
| status: | Confirmed → Won't Fix |
| Rolf Leggewie (r0lf) wrote | #12 |
| Changed in apt (Ubuntu Lucid): | |
| status: | Triaged → Won't Fix |
| Changed in apt (Ubuntu Precise): | |
| status: | Triaged → Won't Fix |
| no longer affects: | apt (Ubuntu Lucid) |
| no longer affects: | apt (Ubuntu Natty) |
| no longer affects: | apt (Ubuntu Oneiric) |
| no longer affects: | apt (Ubuntu Precise) |
I can confirm this is a problem for servers in environments which require the use of an http proxy for outbound HTTP:
Excerpt from ps uaxww at local time 08:15:
root 6779 0.0 0.3 2432 880 ? S 06:25 0:00 /USR/SBIN/CRON
root 6780 0.0 0.1 1772 484 ? Ss 06:25 0:00 /bin/sh -c test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
root 6781 0.0 0.2 1700 548 ? S 06:25 0:00 run-parts --report /etc/cron.daily
root 6783 0.0 0.2 1772 516 ? S 06:25 0:00 /bin/sh /etc/cron.daily/apt
root 6812 0.0 0.2 1772 516 ? S 06:42 0:00 /bin/sh /usr/bin/apt-key net-update
root 6816 0.0 0.5 3868 1428 ? S 06:42 0:00 wget -q -N http://
The problem machine is 8.04.2 server. In this current state "apt-key net-update" prevents unattended-upgrades from running.
Please see attached for a proposed patch to fix this problem..