Unattended/provision URL not working

Support
1

Problem:
unattended/provision URL not working after upgrade from 1.23 to 1.24

My pxe files are rendered like this:

root@foreman-2-proxy-1:~# cat /srv/tftp/pxelinux.cfg/01-00-30-48-8a-5f-4c

DEFAULT linux
LABEL linux
KERNEL boot/debian-mirror-dgxKgBg5J79O-linux
APPEND initrd=boot/debian-mirror-dgxKgBg5J79O-initrd.gz interface=auto url=http://foreman-2-proxy-1.bla2.local:8000/unattended/provision ramdisk_size=10800 root=/dev/rd/0 rw auto hostname=sb0030488a5f4c.bla2.local auto=true domain=bla2.local locale=en_US
IPAPPEND 2

and hots cannot retrieve preseed or kickstart files.
If i manually replace that url with:

http://foreman-2-proxy-1.bla2.local:8000/unattended/provision?token=365e66fa-af34-46e7-8f20-cc4594100a77

everything is OK, installation finishes as expected (triede with debian, centos, xenserver and win2016)

if i fry spoof link directly from proxy:

root@foreman-2-proxy-1:~# curl http://foreman-2-proxy-1.bla2.local:8000/unattended/provision?spoof=10.137.111.94
Failed to proxy /provision for {"spoof"=>"10.137.111.94", "splat"=>[], "captures"=>["provision"], "kind"=>"provision"}: Error retrieving unattended/provision for {"spoof"=>"10.137.111.94", :url=>"http://foreman-2-proxy-1.bla2.local:8000"} from foreman-2-master.bla2.local: Net::HTTPFound

Please help me find a problem. It was all working like charm on 1.23 :slight_smile:
Additional details: I have proxy on separate machine. It seems to me that problem is in smart-proxy “templates feature” (which is enabled and active)

2

found this in foreman-proxy log:

2020-11-10T23:21:52 e9995088 [I] Started GET /unattended/provision 
2020-11-10T23:21:52 e9995088 [D] Template: request for unattended/provision using {:url=>"http://foreman-2-proxy-1.bla2.local:8000"} at foreman-2-master.bla2.local
2020-11-10T23:21:52 e9995088 [D] Retrieving a template from https://foreman-2-master.bla2.local//unattended/provision?url=http%3A%2F%2Fforeman-2-proxy-1.bla2.local%3A8000
2020-11-10T23:21:52 e9995088 [D] HTTP headers: {"USER_AGENT"=>"debian-installer", "ACCEPT"=>"*/*", "ACCEPT_ENCODING"=>"identity", "CONNECTION"=>"Keep-Alive", "X-Forwarded-For"=>"10.137.111.94, foreman-2-proxy-1.bla2.local"}
2020-11-10T23:21:52 e9995088 [E] Failed to proxy /provision for {"splat"=>[], "captures"=>["provision"], "kind"=>"provision"}: Error retrieving unattended/provision for {:url=>"http://foreman-2-proxy-1.bla2.local:8000"} from foreman-2-master.bla2.local: Net::HTTPNotFound
2020-11-10T23:21:52 e9995088 [W] Failed to proxy /provision for {"splat"=>[], "captures"=>["provision"], "kind"=>"provision"}: Error retrieving unattended/provision for {:url=>"http://foreman-2-proxy-1.bla2.local:8000"} from foreman-2-master.bla2.local: Net::HTTPNotFound
RuntimeError: Error retrieving unattended/provision for {:url=>"http://foreman-2-proxy-1.bla2.local:8000"} from foreman-2-master.bla2.local: Net::HTTPNotFound

and this in foreman production log:

2020-11-10T23:21:52 [I|app|8a9a5ae3] Started GET "/unattended/provision?url=http%3A%2F%2Fforeman-2-proxy-1.bla2.local%3A8000" for foreman-2-proxy-1.bla2.local at 2020-11-10 23:21:52 +0100
2020-11-10T23:21:52 [I|app|8a9a5ae3] Processing by UnattendedController#host_template as TEXT
2020-11-10T23:21:52 [I|app|8a9a5ae3]   Parameters: {"url"=>"http://foreman-2-proxy-1.bla2.local:8000", "kind"=>"provision", "unattended"=>{}}
2020-11-10T23:21:52 [E|app|8a9a5ae3] unattended: unable to find a host that matches the request from 10.137.100.121
2020-11-10T23:21:52 [I|app|8a9a5ae3]   Rendering text template
2020-11-10T23:21:52 [I|app|8a9a5ae3]   Rendered text template (0.0ms)

10.137.100.1211 is address of foreman-2-proxy-1.bla2.local

3

Just found this:


is this all it takes?
what if i have several proxy servers, i must list them ali in remote_addr ?

tested on one host and it works :slight_smile:
will do more tests tomorrow…

4

Foreman validates if the client which sends X-Forwarded-For is one of the known hosts from Administer - Settings - Provisioning - Remote addresses. Our installer automatically puts all smart proxies I think @ekohl (?)

Make sure the remote IP is there and then Foreman will start respecting those X-Forwarded-For HTTP headers. Maybe Foreman could resolve all smart proxy hostnames known in the database and append this to the verification list automatically.