Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Version 3.7.3-1 does not allow the client to connect with the cached repos.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
"apt update && apt dist-upgrade"

   * What was the outcome of this action?
...
Fehl:1 http://neutower:3142/http.debian.net/debian unstable InRelease
403 Configuration error (confusing proxy mode) or prohibited port (see
AllowUserPorts) [IP: 192.168.2.13 3142]
Fehl:2 http://neutower:3142/ftp.uni-stuttgart. ... tion/extra unstable
InRelease
403 Configuration error (confusing proxy mode) or prohibited port (see
AllowUserPorts) [IP: 192.168.2.13 3142]
Fehl:3 http://neutower:3142/packages.siduction.org/fixes unstable InRelease
403 Configuration error (confusing proxy mode) or prohibited port (see
AllowUserPorts) [IP: 192.168.2.13 3142]

...
N: Weitere Details zur Erzeugung von Paketdepots sowie zu deren
Benutzerkonfiguration finden Sie in der Handbuchseite apt-secure(8).
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art
durchgeführt werden, daher ist es standardmäßig deaktiviert.
E: Das Depot »http://neutower:3142/http.debian.net/debian unstable InRelease«
ist nicht mehr signiert.
E: Fehlschlag beim Holen von http://neutower:3142/http.debian.net/de ...
/InRelease 403 Configuration error (confusing proxy mode) or prohibited port
(see AllowUserPorts) [IP: 192.168.2.13 3142]
E: Fehlschlag beim Holen von http://neutower:3142/ftp.uni-stuttgart. ...
/InRelease 403 Configuration error (confusing proxy mode) or prohibited port
(see AllowUserPorts) [IP: 192.168.2.13 3142]
E: Das Depot »http://neutower:3142/ftp.uni-stuttgart. ... tion/extra unstable
InRelease« ist nicht mehr signiert.
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art
durchgeführt werden, daher ist es standardmäßig deaktiviert.
N: Weitere Details zur Erzeugung von Paketdepots sowie zu deren
Benutzerkonfiguration finden Sie in der Handbuchseite apt-secure(8).
E: Fehlschlag beim Holen von http://neutower:3142/packages.siduction ...
/InRelease 403 Configuration error (confusing proxy mode) or prohibited port
(see AllowUserPorts) [IP: 192.168.2.13 3142]
E: Das Depot »http://neutower:3142/packages.siduction.org/fixes unstable
InRelease« ist nicht mehr signiert.
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art
durchgeführt werden, daher ist es standardmäßig deaktiviert.
N: Weitere Details zur Erzeugung von Paketdepots sowie zu deren
Benutzerkonfiguration finden Sie in der Handbuchseite apt-secure(8).



   * What outcome did you expect instead?

I wanted to dist-upgrade my client.

*** End of the template - remove these template lines ***

Some annotations:

- I can connect from the computer (desktop) apt-cache-ng is running on. The
above errors came from a client (laptop).

- Reinstalling apt-cacher-ng Version 3.6.4-1 solves the problem. Connection
from client to server is possible again.

Same issue here:

Err :1 http://HTTPS///deb.debian.org/debian unstable InRelease
  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP : ::1 3142]
Lecture des listes de paquets... Fait
E: Impossible de récupérer http://HTTPS///deb.debian.org/debian/dists/unstable/InRelease  403  Configuration error (confusing proxy mode) or prohibited port (see AllowUserPorts) [IP : ::1 3142]

Hi Eduard,

Pierre-Elliott Bécue <peb@debian.org> wrote on 27/10/2021 at 20:52:10+0100:

This reported bug has been hanging since your release of apt-cacher-ng
3.7.3-1. It makes in my case http://HTTPS/// method to fetch https
sources not working anymore despite still being documented in the
package.

Are you aware of this situation? Is it intentional? Could it be fixed
via configuration? If it indeed is a bug, do you plan on fixing it
before bookworm becomes stable and nobody can use the http://HTTPS
feature anymore?

Cheers!

I also found this bug when 3.7 became available. I use this functionality to get
updates safely for all the Debian computers on my network.  Therefore, I
downgraded to 3.6.4-1 which worked fine for me.

Package: apt-cacher-ng
Version: 3.7.4-1+b2
Followup-For: Bug #997073

Hi,

git bisect suggests this bug was introduced with commit

commit 2b6d53888ae8bf13260c3ea86a52cd66ee0eec16
Author: Eduard Bloch <blade@debian.org>
Date:   Sat May 29 15:26:46 2021 +0200

    Converting port description type to plain uint16_t

    Slight reduction of memory footprint

This seems to have changed how "AllowUserPorts" works...

AFAICS, this can be worked around by setting

    AllowUserPorts: 80 443

or even

    AllowUserPorts: 0

if you trust your users.

Maybe "AllowUserPorts: 80 443" shoud be the default in future package
versions?

Regards, Tobias

PS: I could not reproduce the problem with non-https sources, so the
initial report seems to be either unrelated or a genuine configuration
error...

found 997073 3.7.5-1
severity 997073 important
thanks

This bug is still present in the trixie version of acng.
I can confirm that Tobias’ workaround of adding the line…

	AllowUserPorts: 80 443

… allows clients to connect through acng in trixie again.

Please involve upstream in fixing this (their mailing list
link points to old Alioth and is now dead). From the above
messages I assume that the old code used -1 for unset to
use a default set of ports, which now no longer works.

Meanwhile please include the/a workaround in the distro
packages for people to use.

bye,
//Thorsten