Deadlock with remote copies over long distances

[Valtteri Vuorikoski]

I'm setting up cfengine 2.0.5 on our network which includes machines
in multiple countries. Copies in the same location as the master work
fine, but when a remote host attempts to copy files, cfagent gets
stuck during a random file (and always the same file).

Debug output from cfagent:

Update of image /opt/magenta/local/cfengine/cache/inputs/update.conf from 
master /opt/magenta/local/cfengine/inputs/update.conf on geo0-hel-fi.magenta.net
CopyReg(/opt/magenta/local/cfengine/inputs/update.conf,/opt/magenta/local/cfengine/cache/inputs/update.conf)
This is a remote copy from server: master.magenta.net
Transaction Send[t 80][Packed text]
SendSocketStream, sent 88
RecvSocketStream(8)
(hangs here until interrupted)

truss shows one thread sitting in a recv() from a file descriptor which is
a connection to the remote host. truss also shows cfservd waiting in
recv(). Here is cfservd debug output:

Received: [SGET   64 2048] on socket 7
Confirm decryption, and thus validity of caller
SGET /opt/magenta/local/cfengine/inputs/update.conf with blocksize 2048
AccessControl(/opt/magenta/local/cfengine/inputs/update.conf)
AccessControl(/usr/opt/magenta/local/cfengine/inputs/update.conf,client.magenta.net)
 encrypt req1
Found a match for in access list 
(/usr/opt/magenta/local/cfengine/inputs/update.conf,/usr/opt/magenta)
FuzzyItemIn(213.157.xx.x)
IsWildItem(client.magenta.net,*.magenta.net)
Access privileges - match found
cfservd: Host geo0-ldn-uk.magenta.net granted access to 
/usr/opt/magenta/local/cfengine/inputs/updatef
CfGetFile(/opt/magenta/local/cfengine/inputs/update.conf on sd=7), size=1437
Transaction Send[m 1432][Packed text]
SendSocketStream, sent 1440
Cipher len of extra data is 8
Transaction Send[t 8][Packed text]
SendSocketStream, sent 16
Done with GetFile()
RecvSocketStream(8)

Both master and client are running pretty much the same version of
Solaris 2.8. Encryption is being used on all systems. These two both
have the same 0.9.6 series version of OpenSSL.

Ideas what might be wrong here?

-- 
 Valtteri Vuorikoski <address@hidden>
 Magenta Sites