RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1420533 - no_proxy environment variable is ignored by the rhsmd process
Summary: no_proxy environment variable is ignored by the rhsmd process
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: python-rhsm
Version: 7.3
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Kevin Howell
QA Contact: John Sefler
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-08 22:01 UTC by John Sefler
Modified: 2017-08-01 19:20 UTC (History)
3 users (show)

Fixed In Version: subscription-manager-1.19.6-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 19:20:42 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github candlepin subscription-manager pull 1551 0 'None' closed 1420533: Add --noproxy option and "no_proxy" config 2021-02-11 13:47:50 UTC
Red Hat Bugzilla 1311429 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Product Errata RHBA-2017:2083 0 normal SHIPPED_LIVE python-rhsm and subscription-manager bug fix and enhancement update 2017-08-01 18:14:19 UTC

Internal Links: 1311429

Description John Sefler 2017-02-08 22:01:41 UTC 
Description of problem:
The work done to fix bug 1311429 is not sufficient.  Although no_proxy environment appears to be honored within the shell that the subscription-manager process is running, there is still an rhsmd process that is triggered during registration that is not honoring the no_proxy environment variable.  Observe below...

Version-Release number of selected component (if applicable):
[root@jsefler-rhel6 ~]# rpm -q subscription-manager python-rhsm
subscription-manager-1.18.9-1.el6.x86_64
python-rhsm-1.18.6-1.el6.x86_64


How reproducible:


Steps to Reproduce:
CONFIGURE RHSM.CONF TO USE A VALID PROXY AS WELL A VALID SERVER...
[root@jsefler-rhel6 ~]# subscription-manager config --server.hostname=subscription.rhsm.stage.redhat.com --server.port=443 --server.prefix=/subscription --server.proxy_hostname=auto-services.usersys.redhat.com --server.proxy_port=3128 --server.proxy_user=redhat --server.proxy_password=redhat

REGISTER WHILE TAILING LOGS TO ASSERT THE USE OF THE CONFIGURED PROXY...

[root@jsefler-rhel6 ~]# subscription-manager register --username=qa
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: fc9ce2cc-d02b-489c-a983-c92b7a492fa2 

[root@auto-services ~]# tail -f /var/log/squid/access.log 
1486590212.600   1552 10.16.6.87 TCP_MISS/200 6870 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590213.175    482 10.16.6.87 TCP_MISS/200 7601 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590215.826   2563 10.16.6.87 TCP_MISS/200 29645 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590216.449    525 10.16.6.87 TCP_MISS/200 7601 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590217.078    536 10.16.6.87 TCP_MISS/200 6822 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590217.655    487 10.16.6.87 TCP_MISS/200 7601 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590218.893   1000 10.16.6.87 TCP_MISS/200 6353 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590219.714    666 10.16.6.87 TCP_MISS/200 13888 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -
1486590220.682    550 10.16.6.87 TCP_MISS/200 13994 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -

[root@jsefler-rhel6 ~]# tail -f /var/log/rhsm/rhsm.log | grep proxy
2017-02-08 16:43:26,183 [INFO] subscription-manager:9680:MainThread @connection.py:758 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-02-08 16:43:26,183 [INFO] subscription-manager:9680:MainThread @connection.py:758 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=none
2017-02-08 16:43:34,521 [INFO] subscription-manager:9680:MainThread @connection.py:758 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=basic username=qa
2017-02-08 16:43:34,849 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:36,497 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:37,074 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:39,734 [INFO] subscription-manager:9680:MainThread @connection.py:758 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-02-08 16:43:39,736 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:40,346 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:40,976 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:41,695 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:42,808 [DEBUG] subscription-manager:9680:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128
2017-02-08 16:43:43,931 [INFO] rhsmd:9722:MainThread @connection.py:758 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-02-08 16:43:43,935 [DEBUG] rhsmd:9722:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128


THE DEMONSTRATION ABOVE PROVES THAT TRAFFIC IS GOING THROUGH THE CONFIGURED PROXY AS EXPECTED.

NOW LETS CLEAN THE SYSTEM AND TRY TO REGISTER AGAIN WITH A NO_PROXY="*" ENVIRONMENT VARIABLE THAT MATCHES THE CONFIGURED HOSTNAME.  IN THIS CASE WE EXPECT NO TRAFFIC THROUGH THE PROXY....

[root@jsefler-rhel6 ~]# subscription-manager clean
All local data removed
[root@jsefler-rhel6 ~]# NO_PROXY="*" subscription-manager register --username=qa
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: 5edffb2e-3f8e-44b2-86c4-5e4c188de960 

[root@auto-services ~]# tail -f /var/log/squid/access.log 
1486590528.456    612 10.16.6.87 TCP_MISS/200 14005 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.5.164.73 -

[root@jsefler-rhel6 ~]# tail -f /var/log/rhsm/rhsm.log | grep proxy
2017-02-08 16:48:51,555 [INFO] rhsmd:9820:MainThread @connection.py:758 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-02-08 16:48:51,559 [DEBUG] rhsmd:9820:MainThread @connection.py:476 - Using proxy: auto-services.usersys.redhat.com:3128

BANG!  EXPECTED THE TAIL OF BOTH LOGS TO BE EMPTY.



Actual results:
  Above, Despite the NO_PROXY="*" environment variable, there was still some traffic through the configured proxy that appears to have come from an 'rhsmd' process.

Expected results:
  If you are setting a no_proxy environment variable, then 'subscription-manager' AND 'rhsmd' should honor it.  In the demo above, only subscription-manager honored no_proxy. 

Additional info:
  Is there another way to force 'rhsmd' to load the same environment as 'subscription-manager'?
Comment 3 Shwetha Kallesh 2017-04-17 08:15:42 UTC 
Still see tail of both rhsm.log and /var/log/squid/access.log has some traffic proxy server, so marking bug as failed_qa


[root@dhcp35-160 ~]# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 0.9.51.21-1
subscription management rules: 5.15.1
subscription-manager: 1.19.7-1.el7
python-rhsm: 1.19.4-1.el7
[root@dhcp35-160 ~]# 


[root@dhcp35-160 ~]# subscription-manager clean
All local data removed

[root@dhcp35-160 ~]# NO_PROXY="*" subscription-manager register --username=qa 
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: 5b5a08ab-275e-4566-8f98-355779cbb1b2 


[root@dhcp35-160 ~]# tail -f /var/log/rhsm/rhsm.log | grep proxy
2017-04-17 13:39:46,071 [INFO] rhsmd:26245:MainThread @connection.py:774 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False



[root@auto-services ~]# tail -f /var/log/squid/access.log 
1492416483.670   1520 10.70.35.160 TCP_MISS/200 3549 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.24.204.73 -
Comment 4 Kevin Howell 2017-04-20 20:08:18 UTC 
Shwetha, actually, this test scenario needs to be revised. There is not an easy way to get rhsmd to respect environment variables, so the solution implemented was to allow specifying no_proxy in /etc/rhsm/rhsm.conf. The test scenario should involve setting no_proxy in the config file, not as an environment variable. Sorry that we didn't convey this in the BZ until now.

The original scenario presented in comment 0 will continue to fail. A customer who needs to use no_proxy should specify it in the config file.
Comment 5 Shwetha Kallesh 2017-05-03 12:16:49 UTC 
[root@dhcp71-191 ~]# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 0.9.51.21-1
subscription management rules: 5.15.1
subscription-manager: 1.19.12-1.el7
python-rhsm: 1.19.6-1.el7

Before setting no_proxy variable in /etc/rhsm/rshm.conf file

[root@dhcp71-191 ~]# NO_PROXY="*" subscription-manager register --username=shwetha_tier1_test 
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: 7451c8d4-7ee5-4cc1-9302-5b8c42db0882 


[root@dhcp71-191 ~]# tail -f /var/log/rhsm/rhsm.log | grep proxy
2017-05-03 08:14:19,402 [INFO] rhsmd:24173:MainThread @connection.py:780 - Connection built: http_proxy=auto-services.usersys.redhat.com:3128 host=subscription.rhsm.stage.redhat.com port=443 handler=/subscription auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
    return self._proxy_method(*args, **keywords)


[root@auto-services ~]#  tail -f /var/log/squid/access.log 
1493813530.657    539 10.16.71.191 TCP_MISS/200 3392 CONNECT subscription.rhsm.stage.redhat.com:443 redhat HIER_DIRECT/10.24.204.73 -


After setting no_proxy variable to "*" in rhsm.conf file

[root@dhcp71-191 ~]# subscription-manager config --server.hostname=subscription.rhsm.stage.redhat.com --server.port=443 --server.prefix=/subscription --server.proxy_hostname=auto-services.usersys.redhat.com --server.proxy_port=3128 --server.proxy_user=redhat --server.proxy_password=redhat

[root@dhcp71-191 ~]# subscription-manager config --server.no_proxy=*

[root@dhcp71-191 ~]# subscription-manager register --username=shwetha_tier1_test 
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: f1704c71-ac46-4464-987f-f89e07f6b29e 


[root@dhcp71-191 ~]# tail -f /var/log/rhsm/rhsm.log | grep proxy

[root@auto-services ~]#  tail -f /var/log/squid/access.log
Comment 6 errata-xmlrpc 2017-08-01 19:20:42 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2083
Note You need to log in before you can comment on or make changes to this bug.