Snap and proxy (WAS: Connection refused and no connectivity in Fedora 33 clean install)

Hello,

I’m having trouble getting any snap commands to work. In going through the docs for snap installation (first time ever using snap, and this machine has never had snap installed), I am unable to install the ‘hello-world’ snap:

$> snap install hello-world
error: cannot install "hello-world": Post "https://api.snapcraft.io/v2/snaps/refresh": dial tcp
   91.189.92.41:443: connect: connection refused

I found the snap debug connectivity command, and it as well reports problems:

$> snap debug connectivity
Connectivity status:
* api.snapcraft.io: unreachable
error: 1 servers unreachable

I have rebooted the machine as directed by the installation docs. It was rebooted right before trying the snap install command.

This machine is behind a proxy, so I wonder if that has something to do with it. I have set http_proxy, https_proxy, HTTP_PROXY, and HTTPS_PROXY to the right URL, and other command line utilities such as curl and wget work. In a browser, I am able to successfully navigate to the https://api.snapcraft.io URL, so it seems that the network path is open, including through the proxy. But I don’t know for sure what the snap command is trying to use, so I don’t know if proxy settings are really set correctly for it.

What else can I do to try to figure out what is failing?

$> snap version
snap    2.47.1-1.fc33
snapd   2.47.1-1.fc33
series  16
fedora  33
kernel  5.9.12-200.fc33.x86_64

I don’t see much to go on in journatcl’s output for snapd. Here is the output from the latest snap install hello-world command attempt:

$> journalctl --no-pager -xu snapd.service
...output snipped...
Dec 10 11:39:44 localhost systemd[1]: Starting Snap Daemon...
░░ Subject: A start job for unit snapd.service has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit snapd.service has begun execution.
░░ 
░░ The job identifier is 4698.
Dec 10 11:39:44 localhost snapd[7162]: AppArmor status: apparmor not enabled
Dec 10 11:39:44 localhost snapd[7162]: daemon.go:343: started snapd/2.47.1-1.fc33 (series 16; classic; devmode) fedora/33 (amd64) linux/5.9.12-200.fc33.x86_64.
Dec 10 11:39:44 localhost snapd[7162]: daemon.go:436: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
Dec 10 11:39:44 localhost snapd[7162]: api.go:999: Installing snap "hello-world" revision unset
Dec 10 11:39:44 localhost systemd[1]: Started Snap Daemon.
░░ Subject: A start job for unit snapd.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit snapd.service has finished successfully.
░░ 
░░ The job identifier is 4698.
Dec 10 11:40:07 localhost snapd[7162]: stateengine.go:150: state ensure error: Get "https://api.snapcraft.io/api/v1/snaps/sections": dial tcp 91.189.92.38:443: connect: connection refused
Dec 10 11:40:19 localhost snapd[7162]: daemon.go:542: gracefully waiting for running hooks
Dec 10 11:40:19 localhost snapd[7162]: daemon.go:544: done waiting for running hooks
Dec 10 11:40:19 localhost snapd[7162]: daemon stop requested to wait for socket activation
Dec 10 11:40:19 localhost systemd[1]: snapd.service: Succeeded.
░░ Subject: Unit succeeded
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ The unit snapd.service has successfully entered the 'dead' state.

What is journalctl --no-pager -u snapd ?

Also what is the output of

sudo xargs -0 -L1 -a /proc/$(pgrep --uid 0 snapd)/environ  | grep HTTP

Here is the journatctl output (the first command didn’t return anything, but after running snap install hello-world again, there was some output):

$> snap install hello-world
error: cannot install "hello-world": Post "https://api.snapcraft.io/v2/snaps/refresh": dial tcp
   91.189.92.38:443: connect: connection refused
$> journalctl --no-pager -u snapd
-- Logs begin at Thu 2020-12-10 16:03:29 MST, end at Thu 2020-12-10 16:36:46 MST. --
Dec 10 16:36:20 localhost systemd[1]: Starting Snap Daemon...
Dec 10 16:36:20 localhost snapd[16113]: AppArmor status: apparmor not enabled
Dec 10 16:36:20 localhost snapd[16113]: daemon.go:343: started snapd/2.47.1-1.fc33 (series 16; classic; devmode) fedora/33 (amd64) linux/5.9.12-200.fc33.x86_64.
Dec 10 16:36:20 localhost snapd[16113]: daemon.go:436: adjusting startup timeout by 30s (pessimistic estimate of 30s plus 5s per snap)
Dec 10 16:36:20 localhost systemd[1]: Started Snap Daemon.
Dec 10 16:36:20 localhost snapd[16113]: api.go:999: Installing snap "hello-world" revision unset
Dec 10 16:36:42 localhost snapd[16113]: stateengine.go:150: state ensure error: Get "https://api.snapcraft.io/api/v1/snaps/sections": dial tcp 91.189.92.38:443: connect: connection refused

For the xargs output, it looks like snapd is started on demand via a snapd.socket (according to systemctl status snapd.service, that is), so it isn’t running all of the time. I started it via systemctl and then the xargs command didn’t error out. But, it also didn’t print anything out:

$> xargs -0 -L1 -a /proc/$(pgrep --uid 0 snapd)/environ  | grep HTTP
xargs: Cannot open input file ‘/proc//environ’: No such file or directory
$> systemctl start snapd
$> xargs -0 -L1 -a /proc/$(pgrep --uid 0 snapd)/environ  | grep HTTP
$>

Thank you for looking in to this!

Does this work?

$ openssl s_client -connect api.snapcraft.io:443
$ openssl s_client -connect 91.189.92.38:443

Hmmm, they do not work:

$> openssl s_client -connect api.snapcraft.io:443
139827700959040:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
139827700959040:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
139827700959040:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
139827700959040:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
139827700959040:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
139827700959040:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
139827700959040:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
139827700959040:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
139827700959040:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
139827700959040:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
139827700959040:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
139827700959040:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
connect:errno=111
$> openssl s_client -connect 91.189.92.38:443
140073447827264:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
140073447827264:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
connect:errno=111

Since most of my connectivity issues on this host end up having to do with the proxy it is behind and the various ways the host needs to be configured to use it, I went looking to see how to get openssl to use a proxy. It doesn’t seem to look to environment variables such as HTTPS_PROXY. I did find that I was able to get a connection by using proxytunnel:

$> proxytunnel -d 91.189.92.38:443 -a 7000 &               
[1] 39561
$> openssl s_client -connect localhost:7000
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = api.snapcraft.io
verify return:1
...output snipped...

Does snap use openssl-like commands to get at api.snapcraft.io? If so, then I am fairly sure that the proxy configuration is the issue. Is there a way to configure snap to use a proxy? Alternatively, is there a way to use a solution like proxytunnel?

Thanks again!

You should be able to run:

$ snap set system proxy.http=http://someproxy:1234
$ snap set system proxy.https=https://someproxy:1234

Setting the proxy with those commands worked. I’ve been able to install the needed packages.

Thank you!

i solved this problem with this way :
1 - installing tor and create http proxy on 8118 port.
any way you can use any proxy instead of tor.

2 - set proxy for snap
# snap set system proxy.http=http://127.0.0.1:8118
# snap set system proxy.https=http://127.0.0.1:8118

3 - restarting snapd service
# systemctl restart snapd.service

i hope it work for you