Connection issues with forgeapi.puppet.com over IPv6

[lweller]

forgeapi.puppet.com resolves to DNS CNAME record d3e1bbc2322vk3.cloudfront.net. wich itself resolces to a bunch of AAAA records. But currently no https conneciton to any of resolved IPv6 adresses is possible.

Is there an issue with IPv6 onectivity at Puppet side?

[malikparvez]

Hey @lweller I did a quick test it works for me maybe the issue at the client side which is trying to hit this ipv6

curl -g -6 "https://forgeapi.puppet.com" -v
* Host forgeapi.puppet.com:443 was resolved.
* IPv6: 2600:9000:2379:1200:1b:3556:90c0:93a1, 2600:9000:2379:d000:1b:3556:90c0:93a1, 2600:9000:2379:7000:1b:3556:90c0:93a1, 2600:9000:2379:9a00:1b:3556:90c0:93a1, 2600:9000:2379:de00:1b:3556:90c0:93a1, 2600:9000:2379:e800:1b:3556:90c0:93a1, 2600:9000:2379:be00:1b:3556:90c0:93a1, 2600:9000:2379:f000:1b:3556:90c0:93a1
* IPv4: (none)
*   Trying [2600:9000:2379:1200:1b:3556:90c0:93a1]:443...
* Connected to forgeapi.puppet.com (2600:9000:2379:1200:1b:3556:90c0:93a1) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=forge.puppet.com
*  start date: Mar  6 00:00:00 2024 GMT
*  expire date: Apr  5 23:59:59 2025 GMT
*  subjectAltName: host "forgeapi.puppet.com" matched cert's "forgeapi.puppet.com"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M02
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://forgeapi.puppet.com/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: forgeapi.puppet.com]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: forgeapi.puppet.com
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
< content-type: text/html;charset=utf-8
< content-length: 974
< date: Tue, 03 Dec 2024 17:44:21 GMT
< server: nginx
< last-modified: Tue, 12 Nov 2024 12:47:12 GMT
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
< x-frame-options: DENY
< vary: Accept-Encoding
< x-cache: Hit from cloudfront
< via: 1.1 d0fd84edde50ec44c2c9adee7d3cf8fc.cloudfront.net (CloudFront)
< x-amz-cf-pop: BOM78-P2
< x-amz-cf-id: YVTKwPOC7BzFIYX-rh7vSCt1DQLx9s5ezUsQiFhf5LPoainPkjsB6A==
< age: 280
< referrer-policy: strict-origin-when-cross-origin
< content-security-policy: default-src 'none'; img-src 'self' data: gravatar.com travis-ci.org *.puppetmodule.info *.travis-ci.org *.travis-ci.com cdn.redoc.ly img.shields.io coveralls.io cdn.cookielaw.org github.com *.trendemon.com *.google.com *.6sc.co *.6sc.com *.google-analytics.com *.googletagmanager.com *.gstatic.com *.google.co.in rawgithub.com rawgit.com *.githubusercontent.com; script-src 'self' 'unsafe-inline' *.perforce.com *.puppet.com *.puppetlabs.net *.google.com *.marketo.com *.marketo.net *.headway-widget.net *.headwayapp.co *.google-analytics.com *.googletagmanager.com *.trendemon.com cdn.cookielaw.org *.gstatic.com *.6sc.co *.6sc.com cdn.jsdelivr.net https://stats.g.doubleclick.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; connect-src 'self' *.puppet.com *.puppetlabs.net *.google-analytics.com *.google.com cdn.cookielaw.org geolocation.onetrust.com analytics.google.com *.virustotal.com *.google.co.in *.googletagmanager.com *.gstatic.com https://stats.g.doubleclick.net; frame-src 'self' headway-widget.net *.googletagmanager.com *.6sc.co *.6sc.com *.google.com fast.wistia.net *.puppet.com *.puppetlabs.net *.google.co.in *.gstatic.com *.google-analytics.com analytics.google.com https://td.doubleclick.net; worker-src 'self' blob: *.perforce.com *.puppet.com *.puppetlabs.net *.google.com *.marketo.com *.marketo.net *.headway-widget.net *.headwayapp.co *.google-analytics.com *.googletagmanager.com *.trendemon.com cdn.cookielaw.org *.gstatic.com *.6sc.co *.6sc.com cdn.jsdelivr.net; form-action 'self'; base-uri 'self'; frame-ancestors 'self' *.googletagmanager.com; font-src 'self' fonts.googleapis.com; object-src 'self';
< strict-transport-security: max-age=31536000; includeSubDomains; preload
<
<!DOCTYPE html>
<html>
  <head>
    <title>Puppet Forge API</title>
    <!-- needed for adaptive design -->
    <meta charset="utf-8"/>
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">

    <!--
    ReDoc doesn't change outer page styles
    -->
    <style>
      body {
        margin: 0;
        padding: 0;
      }

      h1 {
        margin-top: 20px !important;
      }
    </style>
  </head>
  <body>
    <div id="redoc-container"></div>
    <script src="https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js"></script>
    <script>
      Redoc.init('/v3/openapi.json', {
        expandResponses: "200",
        pathInMiddlePanel: true,
        theme: {
          spacing: {
            sectionVertical: 10,
          },
        },
      }, document.getElementById('redoc-container'));
    </script>
  </body>
</html>
* Connection #0 to host forgeapi.puppet.com left intact

[bcannoff]

I'm able to replicate the issue as well

curl -g -6 "https://forgeapi.puppet.com" -v
*   Trying 2600:9000:24d2:3e00:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:3e00:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:f400:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:f400:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:9600:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:9600:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:1800:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:1800:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:200:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:200:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:4400:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:4400:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:7600:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:7600:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
*   Trying 2600:9000:24d2:9a00:1b:3556:90c0:93a1:443...
* connect to 2600:9000:24d2:9a00:1b:3556:90c0:93a1 port 443 failed: Network is unreachable
* Failed to connect to forgeapi.puppet.com port 443 after 193 ms: Network is unreachable
* Closing connection 0
curl: (7) Failed to connect to forgeapi.puppet.com port 443 after 193 ms: Network is unreachable

[bcannoff]

As a workaround (using ubuntu 22.04) uncommented the following line in /etc/gai.conf
precedence ::ffff:0:0/96 100