Bug 2046337

Description of problem:

Certain actions like "Manifest Refresh", "Add Subscriptions" to manifest, Auto-Attach on Hosts, Docker type repo discovery and repo creation etc are failing while using an HTTP type proxy as the content_default_http_proxy, as the Satellite server tries to connect with candleping localhost:23443 at some point but via the proxy server and that action gets denied from proxt on localhost. 


Version-Release number of selected component (if applicable):

Satellite 6.10+

How reproducible:

Always


Steps to Reproduce:
1. Install Satellite 6.10+

2. Import a manifest with some subs in it

3. Try syncing some repos, performing manifest refresh and some repo discovery+creation of docker type content from registry.redhat.io .

4. Setup an external squid proxy which is HTTP in nature [i.e. no HTTPS\Authentication is required ]

5. Create a HTTP proxy in Satellite UI using the details of the external proxy and then Set that proxy entry as the content_default_http_proxy in Satellite.

6. Repeat the testing of all actions from step 3 while observing the satellite logs as well as the /var/log/squid/access.log from the external squid server./



Actual results:

At step 3, without proxy everything works fine.

At step 6, 

Repo sync : works fine

Manifest Refresh: Fails

Add Subscriptions: Fails

Auto-Attach on hosts: Fails

Discovery of Docker type repo: Successful But as soon as we try to create the discovery repo it fails and the task goes to Paused state.


With each of these failed attempts one constant issue is that, 

foreman reports:

403 "Forbidden" (Net::HTTPServerException)

As Satellite tries to connect to localhost:23443 via the external http proxy and proxy denies the same i.e.

1643210976.873      0 10.xx.xx.y TCP_DENIED/403 3903 CONNECT localhost:23443 - HIER_NONE/- text/html


Expected results:

Whether the proxy is HTTPS or HTTP in nature, no matter what actions are being performed, any connection to localhost or localhost:23443 should be done locally but not via proxy. 


Additional info:

For other satellite users,  the underlying cause is same but the error cound be "502 "cannotconnect" (Net::HTTPFatalError)" as well.

I have noticed that with HTTPS type proxy, certain action seems to work i.e. Manifest Refresh , Reduction of entitlement quantity of manifest etc but the action which fails, will show responses like:

503 "Service Unavailable" (Net::HTTPFatalError)

and external HTTPS squid proxy will show:

1643205659.835      2 10.xx.yy.xx TAG_NONE/503 0 CONNECT localhost:23443 satproxy HIER_NONE/- -


So again the underlying reason is the same i.e. Satellite tries to connect to candlepin on localhost:23443 via external proxy, whether the proxy is HTTP or HTTPS in nature.