1.9.5.msysgit.1 and NTLM proxy - Githubissues

msysgit / git

msysGit-based Git for Windows 1.x is now superseded by Git for Windows 2.x

http://github.com/git-for-windows/git

Other

1.01k stars 316 forks source link

1.9.5.msysgit.1 and NTLM proxy #339

Closed baloo66 closed 9 years ago

baloo66 commented 9 years ago

I've got a problem with git and NTLM authentication:

while with 1.9.5.msysgit.0 everything is fine - after installation of 1.9.5.msysgit.1 after issuing

git clone --verbose https://bitbucket.org/atlassian_tutorial/tutorial-jira-add-workflow-extensions

I get the following

Cloning into tutorial-jira-add-workflow-extensions
POST git-upload-pack (350 bytes)

... then, after about 5 minutes

git fatal: The remote end hung up unexpectedly error: RPC failed; result=27, HTTP code = 0

If I set GIT_CURL_VERBOSE=1 and repeat the command above, I see the following

GIT/libcurl tries CONNECT
proxy: 407 Proxy Authentication Required with NTLM challenge
GIT/libcurl tries CONNECT with NTLM response
server: 200 Connection established,
- Proxy replied OK to CONNECT request
- successfully set certificate verify locations:
- CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
- SSL connection using TLSv1.0 / DHE-RSA-AES128-SHA
- Server certificate:
- ....
- SSL certificate verify ok.
GIT/libcurl GET ...repo..../info/refs?service=git-upload-pack HTTP/1.1
server: 200 OK
- Connection #1 to host wwwproxy.lbsbay.net left intact POST git-upload-pack (350 bytes)
- Couldn't find host bitbucket.org in the _netrc file; using defaults
- NTLM-proxy picked AND auth done set, clear picked!
- Trying 172.20.249.49... (our proxy)
- Connected to wwwproxy.xxxx.xxxx (172.20.249.49) port 8080 (#0)
- Establish HTTP proxy tunnel to bitbucket.org:443

and from now on I see a loop of

GIT/libcurl tries CONNECT
proxy: 407 Proxy Authentication Required (without NTLM challenge)
- Ignore 849 bytes of response-body
- Connect me again please
- successfully set certificate verify locations:
- CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
- SSL re-using session ID
- Unknown SSL protocol error in connection to bitbucket.org:443
- Couldn't find host bitbucket.org in the _netrc file; using defaults
- Found bundle for host bitbucket.org: 0x3061988
- NTLM-proxy picked AND auth done set, clear picked!
- Hostname wwwproxy.lbsbay.net was found in DNS cache
- Trying 172.20.249.49...
- Connected to wwwproxy.lbsbay.net (172.20.249.49) port 8080 (#1)
- Establish HTTP proxy tunnel to bitbucket.org:443
GIT/libcurl tries CONNECT
proxy: 407 Proxy Authentication Required (without NTLM challenge)
- Ignore 849 bytes of response-body
- Connect me again please
- successfully set certificate verify locations:
- CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
- SSL re-using session ID
- Unknown SSL protocol error in connection to bitbucket.org:443
- Couldn't find host bitbucket.org in the _netrc file; using defaults
- Found bundle for host bitbucket.org: 0x3061988
- NTLM-proxy picked AND auth done set, clear picked!
- Hostname wwwproxy.lbsbay.net was found in DNS cache
- Trying 172.20.249.49...
- Connected to wwwproxy.lbsbay.net (172.20.249.49) port 8080 (#1)
- Establish HTTP proxy tunnel to bitbucket.org:443
GIT/libcurl tries CONNECT

.... and so on and so on and so on

I am behind a ntlm-proxy

I am using 1.9.5.msysgit.1 on Windows 7 (to say it again: 1.9.4.msysgit.0 is doing fine)

Is that a problem of the proxy or of libcurl?

t-b commented 9 years ago

Thanks for the report and the detailed analysis.

Unknown SSL protocol error in connection to bitbucket.org:443 This looks like the problem.

According to 1 newer curl versions have disabled some TLS ciphers by default. Which might be the problem here.

Can you reproduce the bug with the command line curl program? And can you then try with --ciphers ALL if that helps?

dscho commented 9 years ago

@baloo66 please note that a little quicker feedback would help to keep tickets alive, and to work toward their resolution.