{"thread":{"id":"29127","subject":"Access to git repository through squid proxy: The remote end hung up unexpectedly","startedAt":"2011-12-10T08:56:07Z","lastAt":"2011-12-12T09:25:55Z","messageCount":5,"participants":["Mathieu Peltier","Konstantin Khomoutov"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"180749","messageId":"CACjeFCA4h_w2UmYywMBV_P+YZcWAE=zRUz-z5eTfAO+oxWKPjw@mail.gmail.com","threadId":"29127","inReplyTo":null,"subject":"Access to git repository through squid proxy: The remote end hung up unexpectedly","fromName":"Mathieu Peltier","fromEmail":"mathieu.peltier@gmail.com","sentAt":"2011-12-10T08:56:07Z","receivedAt":"2011-12-10T08:56:07Z","isPatch":false,"sender":{"key":"mathieu.peltier@gmail.com","avatar":null},"body":"Hi,\nI am trying to access a git repository (git:// URL) through a squid proxy.\n\nsquid allows CONNECT for port 9418:\n$ more /etc/squid/squid.conf\n...\nacl password proxy_auth REQUIRED\nacl git_port port 9418\n...\nhttp_access allow CONNECT git_port password\nhttp_access deny CONNECT !SSL_ports\n\nThe proxy server can connect to git server :\n$ telnet git.server.org 9418\nTrying w.x.y.z...\nConnected to git.server.org.\nEscape character is '^]'.\n\nHere is the error I get on the client side:\n$ git config --list\ncore.gitproxy=gitproxy.sh\n\n$ more ~/bin/gitproxy.sh\n#!/bin/sh\nPROXY=x.domain.org\nPROXYPORT=8080\nPROXYAUTH=user:pass\nDEBUG=\"-d -d -d -d\"\nexec socat $DEBUG - PROXY:$PROXY:$1:$2,proxyport=$PROXYPORT,proxyauth=$PROXYAUTH\n\n$ git clone git://git.server.org/gitroot/repo/repo\nInitialized empty Git repository in /tmp/GIT/repo/.git/\n...\n2011/12/09 12:22:44 socat[21428] D socat version 1.7.1.3 on Aug 23 2010 23:26:54\n2011/12/09 12:22:44 socat[21428] D setenv(\"SOCAT_VERSION\", \"1.7.1.3\", 1)\n...\n2011/12/09 12:22:44 socat[21428] D running on Linux version #1 SMP Tue\nMar 23 09:47:08 UTC 2010, release x.y\n2011/12/09 12:22:44 socat[21428] D argv[0]: \"socat\"\n2011/12/09 12:22:44 socat[21428] D argv[1]: \"-d\"\n2011/12/09 12:22:44 socat[21428] D argv[2]: \"-d\"\n2011/12/09 12:22:44 socat[21428] D argv[3]: \"-d\"\n2011/12/09 12:22:44 socat[21428] D argv[4]: \"-d\"\n2011/12/09 12:22:44 socat[21428] D argv[5]: \"-\"\n2011/12/09 12:22:44 socat[21428] D argv[6]:\n\"PROXY:x.domain.org:git.server.org:9418,proxyport=8080,proxyauth=user:pass\"\n...\n2011/12/09 12:22:44 socat[21428] I setting option \"proxyport\" to \"8080\"\n2011/12/09 12:22:44 socat[21428] I setting option\n\"proxy-authorization\" to \"user:pass\"\n...\n2011/12/09 12:22:44 socat[21428] I sending \"CONNECT\ngit.server.org:9418 HTTP/1.0\\r\\n\"\n...\n2011/12/09 12:22:44 socat[21428] I proxy_connect: received answer\n\"HTTP/1.1 403 OK\\r\\n\"\n2011/12/09 12:22:44 socat[21428] E CONNECT git.server.org:9418: OK\n2011/12/09 12:22:44 socat[21428] N exit(1)\n2011/12/09 12:22:44 socat[21428] I shutdown(3, 2)\n2011/12/09 12:22:44 socat[21428] D shutdown()  -> 0\nfatal: The remote end hung up unexpectedly\n\nI tried to use also nc but I get the same error.\nAny advice?\nThanks in advance,\nMathieu\n"},{"id":"180801","messageId":"20111210193753.994055f2.kostix@domain007.com","threadId":"29127","inReplyTo":"CACjeFCA4h_w2UmYywMBV_P+YZcWAE=zRUz-z5eTfAO+oxWKPjw@mail.gmail.com","subject":"Re: Access to git repository through squid proxy: The remote end hung up unexpectedly","fromName":"Konstantin Khomoutov","fromEmail":"flatworm@users.sourceforge.net","sentAt":"2011-12-10T15:37:53Z","receivedAt":"2011-12-10T15:37:53Z","isPatch":false,"sender":{"key":"flatworm@users.sourceforge.net","avatar":null},"body":"On Sat, 10 Dec 2011 09:56:07 +0100\nMathieu Peltier <mathieu.peltier@gmail.com> wrote:\n\n> Hi,\n> I am trying to access a git repository (git:// URL) through a squid\n> proxy.\n> \n> squid allows CONNECT for port 9418:\n[...]\n> 2011/12/09 12:22:44 socat[21428] D shutdown()  -> 0\n> fatal: The remote end hung up unexpectedly\n> \n> I tried to use also nc but I get the same error.\n> Any advice?\nI think you have to verify the git-daemon (you did not say you're using\ngit-daemon, but it can be presupposed based on the port number) works\nby itself before starting to wrap it into layers of complexity.\nWhat happens if you try to clone a git repo directly, without any\ntunneling?  If this is not possible, try to clone on the host running\ngit-daemon (use an URL like git://localhost/path/to/repo.git).\nIf it fails (I suppose it will), try increasing the daemon verbosity\n(see git-daemon) manpage.\nAfter all, may be it's as simple as forgetting to `touch` git-export-ok\nfile in the repository you're trying to clone.\n\nP.S.\nAs a side note: why are you trying to implement such a strange setup?\nWhy not just use plain old SSH which just works and provides good level\nof security (contrary to Basic HTTP authentication you might be using).\nIf you need a level of control about who can do what with the repository\nyou could look at https://github.com/sitaramc/gitolite\n"},{"id":"180806","messageId":"CACjeFCCRtJn=JL0v5kJt2wNSDpQyYBme6B0_OpHo4LOVyie89Q@mail.gmail.com","threadId":"29127","inReplyTo":"20111210193753.994055f2.kostix@domain007.com","subject":"Re: Access to git repository through squid proxy: The remote end hung up unexpectedly","fromName":"Mathieu Peltier","fromEmail":"mathieu.peltier@gmail.com","sentAt":"2011-12-10T17:56:57Z","receivedAt":"2011-12-10T17:56:57Z","isPatch":false,"sender":{"key":"mathieu.peltier@gmail.com","avatar":null},"body":"> What happens if you try to clone a git repo directly, without any\n> tunneling?  If this is not possible, try to clone on the host running\n[...]\n> As a side note: why are you trying to implement such a strange setup?\n\nIt works from another machine without proxy. In fact I am trying to\nallow use of git in a corporate environment (for example to access\nread-only git repositories of sf.net only accessible through git\nprotocol). See for example:\nhttp://www.emilsit.net/blog/archives/how-to-use-the-git-protocol-through-a-http-connect-proxy/\nThanks.Mathieu\n"},{"id":"180814","messageId":"20111210225818.GM2525@localhost.localdomain","threadId":"29127","inReplyTo":"CACjeFCA4h_w2UmYywMBV_P+YZcWAE=zRUz-z5eTfAO+oxWKPjw@mail.gmail.com","subject":"Re: Access to git repository through squid proxy: The remote end hung up unexpectedly","fromName":"Konstantin Khomoutov","fromEmail":"flatworm@users.sourceforge.net","sentAt":"2011-12-10T22:58:19Z","receivedAt":"2011-12-10T22:58:19Z","isPatch":false,"sender":{"key":"flatworm@users.sourceforge.net","avatar":null},"body":"On Sat, Dec 10, 2011 at 09:56:07AM +0100, Mathieu Peltier wrote:\n\n[...]\n> 2011/12/09 12:22:44 socat[21428] I setting option \"proxyport\" to \"8080\"\n> 2011/12/09 12:22:44 socat[21428] I setting option\n> \"proxy-authorization\" to \"user:pass\"\n> ...\n> 2011/12/09 12:22:44 socat[21428] I sending \"CONNECT\n> git.server.org:9418 HTTP/1.0\\r\\n\"\n> ...\n> 2011/12/09 12:22:44 socat[21428] I proxy_connect: received answer\n> \"HTTP/1.1 403 OK\\r\\n\"\n> 2011/12/09 12:22:44 socat[21428] E CONNECT git.server.org:9418: OK\n> 2011/12/09 12:22:44 socat[21428] N exit(1)\n> 2011/12/09 12:22:44 socat[21428] I shutdown(3, 2)\n> 2011/12/09 12:22:44 socat[21428] D shutdown()  -> 0\n> fatal: The remote end hung up unexpectedly\n[...]\n\nHTTP 403 means \"access denied\" or \"forbidden\".\nIIRC, a proxy (or any other HTTP-speaking server) should respond with\nthe 401 code when a client first requests a protected resource, and the\nclient is then supposed to retry its request but this time it should\nprovide an authentication info (and the auth mech selected).\nYou have an ellipsis in your debug output in the place that exchange is\nsupposed to be happening so I'm unable to dig deeper.\n\nLooks like either your socat supplies incorrect credentials or proxy\ndoes not ask socat to actually authenticate and just denies the request.\n"},{"id":"180918","messageId":"CACjeFCCnm91jz-CZ3QmHwZOoQzvECD=LWP_W+vviO7m8QaxM2Q@mail.gmail.com","threadId":"29127","inReplyTo":"20111210225818.GM2525@localhost.localdomain","subject":"Re: Access to git repository through squid proxy: The remote end hung up unexpectedly","fromName":"Mathieu Peltier","fromEmail":"mathieu.peltier@gmail.com","sentAt":"2011-12-12T09:25:55Z","receivedAt":"2011-12-12T09:25:55Z","isPatch":false,"sender":{"key":"mathieu.peltier@gmail.com","avatar":null},"body":"> Looks like either your socat supplies incorrect credentials or proxy\n> does not ask socat to actually authenticate and just denies the request.\n\nThe problem is solved. Sorry in fact it was just a problem with the\nproxy configuration: the squid proxy was configured to use another\nproxy server which was denying to use HTTP connect on 9418 port...\nThanks for you help.\nMathieu\n"}]}