Bug#505092: "apt-get update" stuck at "99% [Waiting for headers]" on my PPPoE link

[Teodor <mteodor@gmail.com>]

I've had the same problem here on my PPPoE link: the "update" is stuck
forever at 99%. The good news is that I've found a workarround for
this and possibly the cause.

The PPPoE auto configuration adds this line to the firewall:
  iptables -t mangle -A FORWARD -o ppp0 -p TCP --tcp-flags SYN,RST SYN
-m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
With this firewall rule that adjusts the TCPMSS value there "update"
finishes as usual. Only if I don't have the "clamp-mss-to-pmtu" in the
firewall the "update" process gets stuck at "99% [Waiting for
headers]".
Usually at boot I had this line, but if I was restarting the firewall
this rule was removed and thus the "99%" problem (also some sites are
unreachable without this firewall rule).

Note that if there is no "diff" to be downloaded (done already for
today), the "update" finishes with/without this firewall rule. To be
able to reproduce it again I had to add a new mirror in my
'sources.list' and these are the last repeating messages with
'strace':
99% [Waiting for headers]
                                                            30B/s 0s)
= 140
select(10, [5 6 7 9], [], NULL, {0, 500000}) = 0 (Timeout)
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
99% [Waiting for headers]
                                                            30B/s 0s)
= 140
select(10, [5 6 7 9], [], NULL, {0, 500000}) = 0 (Timeout)
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
99% [Waiting for headers]) = 166
select(10, [5 6 7 9], [], NULL, {0, 500000}) = 0 (Timeout)
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
99% [Waiting for headers]) = 26aders]"..., 26
select(10, [5 6 7 9], [], NULL, {0, 500000}^C <unfinished ...>

With the above firewall workarround this is the 'strace' message at
the same point:
Hit http://ftp.ro.debian.org lenny/main Packages/DiffIndex
) = 86
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
99% [Waiting for headers]) = 26aders]"..., 26
select(10, [5 6 7 9], [], NULL, {0, 500000}) = 1 (in [6], left {0, 500000})
read(6, "200 URI Start\nURI: http://ftp.de.";..., 64000) = 154
Get:3 http://ftp.de.debian.org lenny/main Packages [5269kB]
) = 87
stat("/var/lib/apt/lists/partial/ftp.de.debian.org_debian_dists_lenny_main_binary-amd64_Packages",
{st_mode=S_IFREG|0644, st_size=369777, ...}) = 0
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
8% [3 Packages 369777/5269kB 7%]) = 59r8% [3 "..., 59
select(10, [5 6 7 9], [], NULL, {0, 500000}) = 0 (Timeout)
stat("/var/lib/apt/lists/partial/ftp.de.debian.org_debian_dists_lenny_main_binary-amd64_Packages",
{st_mode=S_IFREG|0644, st_size=646257, ...}) = 0
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[..]

In conclussion this behaviour is IMO a side effect off some ISP
policies, thus not a problem in dpkg/apt or the packages archieve. I
hope this helps!

Cheers