Ubuntu
gnupg2 package

  1. Bug #1788190
  2. Comment #0

Comment 0 for bug 1788190

Revision history for this message
wheelerlaw (wheelerlaw) wrote :

I discovered this while running the following apt-key command:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823

I was hoping apt-key would pick up the http_proxy environment variable, however it did not. So I had to pass it into gpg manually:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --keyserver-options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823

However, that still didn't work. So I messed around with running gnupg manually and found that the dirmngr has a bug in the implementation of its HTTP client. Essentially, dirmngr does not handle the http_proxy quite right, as it is still trying to resolve the hostname of the keyserver instead of just proxying the request through the HTTP proxy defined with the http-proxy argument.

I configured dirmngr to show all debugging output:
$ cat ~/.gnupg/dirmngr.conf
log-file /home/wlaw/.gnupg/dirmngr.log
verbose
debug all

Output of running gpg manually:

$ gpg --debug-level guru --keyserver hkp://keyserver.ubuntu.com:80 --keyserver-options http-proxy=$http_proxy --recv 2EE0EA64E40A89B84B2DF73499E82A75642AC823
gpg: enabled debug flags: packet mpi crypto filter iobuf memory cache memstat trust hashing ipc clock lookup extprog
gpg: DBG: [not enabled in the source] start
gpg: DBG: chan_3 <- # Home: /home/wlaw/.gnupg
gpg: DBG: chan_3 <- # Config: /home/wlaw/.gnupg/dirmngr.conf
gpg: DBG: chan_3 <- OK Dirmngr 2.2.4 at your service
gpg: DBG: connection to the dirmngr established
gpg: DBG: chan_3 -> GETINFO version
gpg: DBG: chan_3 <- D 2.2.4
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> OPTION http-proxy=http://localhost:3128/
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> KEYSERVER --clear hkp://keyserver.ubuntu.com:80
gpg: DBG: chan_3 <- OK
gpg: DBG: chan_3 -> KS_GET -- 0x2EE0EA64E40A89B84B2DF73499E82A75642AC823
gpg: DBG: chan_3 <- ERR 167772346 No keyserver available <Dirmngr>
gpg: keyserver receive failed: No keyserver available
gpg: DBG: chan_3 -> BYE
gpg: DBG: [not enabled in the source] stop
gpg: keydb: handles=0 locks=0 parse=0 get=0
gpg: build=0 update=0 insert=0 delete=0
gpg: reset=0 found=0 not=0 cache=0 not=0
gpg: kid_not_found_cache: count=0 peak=0 flushes=0
gpg: sig_cache: total=0 cached=0 good=0 bad=0
gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0
              outmix=0 getlvl1=0/0 getlvl2=0/0
gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpg: secmem usage: 0/65536 bytes in 0 blocks

Output of dirmngr.log:

$ cat ~/.gnupg/dirmngr.log
2018-08-21 10:18:41 dirmngr[22513.0] permanently loaded certificates: 139
2018-08-21 10:18:41 dirmngr[22513.0] runtime cached certificates: 0
2018-08-21 10:18:41 dirmngr[22513.0] trusted certificates: 139 (138,0,0,1)
2018-08-21 10:18:41 dirmngr[22513.6] handler for fd 6 started
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> # Home: /home/wlaw/.gnupg
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> # Config: /home/wlaw/.gnupg/dirmngr.conf
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK Dirmngr 2.2.4 at your service
2018-08-21 10:18:41 dirmngr[22513.6] connection from process 22512 (1000:1000)
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- GETINFO version
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> D 2.2.4
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- OPTION http-proxy=http://localhost:3128/
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- KEYSERVER --clear hkp://keyserver.ubuntu.com:80
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- KS_GET -- 0x2EE0EA64E40A89B84B2DF73499E82A75642AC823
2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: libdns initialized
2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): No name
2018-08-21 10:18:41 dirmngr[22513.6] resolving 'keyserver.ubuntu.com' failed: No name
2018-08-21 10:18:41 dirmngr[22513.6] number of system provided CAs: 138
2018-08-21 10:18:41 dirmngr[22513.6] DBG: http.c:connect_server: trying name='localhost' port=3128
2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(localhost): Success
2018-08-21 10:18:41 dirmngr[22513.6] can't connect to 'localhost': no IP address for host
2018-08-21 10:18:41 dirmngr[22513.6] error connecting to 'http://keyserver.ubuntu.com:80': Unknown host
2018-08-21 10:18:41 dirmngr[22513.6] marking host 'keyserver.ubuntu.com' as dead
2018-08-21 10:18:41 dirmngr[22513.6] DBG: dns: resolve_dns_name(keyserver.ubuntu.com): No name
2018-08-21 10:18:41 dirmngr[22513.6] resolving 'keyserver.ubuntu.com' failed: No name
2018-08-21 10:18:41 dirmngr[22513.6] host 'keyserver.ubuntu.com' marked as dead
2018-08-21 10:18:41 dirmngr[22513.6] command 'KS_GET' failed: No keyserver available
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> ERR 167772346 No keyserver available <Dirmngr>
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 <- BYE
2018-08-21 10:18:41 dirmngr[22513.6] DBG: chan_6 -> OK closing connection
2018-08-21 10:18:41 dirmngr[22513.6] handler for fd 6 terminated

This is only a problem when you're on a network that does not resolve DNS of internet hostnames (i.e. some sort of split-horizon setup). However, that shouldn't matter, because dirmngr should not be trying to resolve the address on its own if a proxy server has been defined and provided as an argument.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: gnupg2 2.2.4-1ubuntu1.1
ProcVersionSignature: Ubuntu 4.15.0-30.32-generic 4.15.18
Uname: Linux 4.15.0-30-generic x86_64
NonfreeKernelModules: talpa_vfshook talpa_pedconnector talpa_pedevice talpa_vcdevice talpa_core talpa_linux talpa_syscallhook wl nvidia_modeset nvidia
ApportVersion: 2.20.9-0ubuntu7.2
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Aug 21 10:04:02 2018
InstallationDate: Installed on 2018-04-06 (136 days ago)
InstallationMedia: Ubuntu 16.04.4 LTS "Xenial Xerus" - Release amd64 (20180228)
PackageArchitecture: all
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: gnupg2
UpgradeStatus: Upgraded to bionic on 2018-05-11 (101 days ago)