^/repository urls should not redirect to https

[Andreas Hasenack]

When using repository management in Landscape and associating a computer with a repository profile, that computer will get http://<landscape-server>/repository/standalone/ style urls in sources.list.

With the way we deploy the frontend (haproxy in this case), though, http plaintext connections that do not start with /ping are transformed into https. apt will follow this redirect, and try to establish an https connection. If the CA that signed the server is unknown, it will fail:

"""
Err http://10.245.201.158 xenial-copy-of-mirror/main amd64 Packages
  server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
...
W: Failed to fetch http://10.245.201.158/repository/standalone/ubuntu/dists/xenial-copy-of-mirror/main/binary-amd64/Packages server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
"""

Note how the error can be confusing: the url apt is showing is an HTTP (non-SSL) one, yet it's complaining about a certificate validation problem.

I changed the haproxy.cfg file like below, and apt worked again with this server:

--- /etc/haproxy/haproxy.cfg.orig 2016-06-01 18:26:08.180009752 +0000
+++ /etc/haproxy/haproxy.cfg 2016-06-01 18:28:51.331242071 +0000
@@ -37,13 +37,14 @@
 frontend haproxy-1-80
     bind 0.0.0.0:80
     default_backend landscape-http
     mode http
     timeout client 300000
     acl ping path_beg -i /ping
- redirect scheme https unless ping
+ acl repository path_beg -i /repository
+ redirect scheme https unless ping OR repository
     use_backend landscape-ping if ping

 backend landscape-http
     mode http
     timeout server 300000
     balance leastconn

This has been happening since the introduction of the new charm way back. The reasons it was never caught before are:
a) robot tests, which exercise repository management with a real client, deploy quickstart with our old apache template, which kept the /repository URLs as http
b) manual testing, which just exercised the repository management API, not with real clients running apt-get against it

[Adam Collard (adam-collard)]

Hmm, I think this is going the wrong way.

We *should* be using TLS, and give the correct URL to the clients that are pulling packages from us. Getting the correct cert on their computers is a separate problem, which should be tackled.

[Andreas Hasenack (ahasenack)]

The repositories are signed, there is no need for https.
On Jun 2, 2016 06:45, "Adam Collard" <email address hidden> wrote:

> Hmm, I think this is going the wrong way.
>
> We *should* be using TLS, and give the correct URL to the clients that
> are pulling packages from us. Getting the correct cert on their
> computers is a separate problem, which should be tackled.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1588027
>
> Title:
> ^/repository urls should not redirect to https
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/landscape-charm/+bug/1588027/+subscriptions
>