{"thread":{"id":"40595","subject":"Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","startedAt":"2015-10-20T11:20:52Z","lastAt":"2015-10-21T18:45:43Z","messageCount":11,"participants":["Johan Laenen","Matthieu Moy","Enrique Tobis","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"271963","messageId":"loom.20151020T131513-529@post.gmane.org","threadId":"40595","inReplyTo":null,"subject":"Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Johan Laenen","fromEmail":"johan.laenen+cygwin@gmail.com","sentAt":"2015-10-20T11:20:52Z","receivedAt":"2015-10-20T11:20:52Z","isPatch":false,"sender":{"key":"johan.laenen+cygwin@gmail.com","avatar":null},"body":"Commit 5841520b makes it impossible to connect to github from behind my\ncompany's firewall.\n\nI'm running CYGWIN_NT-6.1 and the default git version 2.5.3 complains with a\nfatal error when trying to git pull:\n\n$ /bin/git --version\ngit version 2.5.3\n$ /bin/git pull\nfatal: unable to access 'https://github.com/gargle/french/': Unknown SSL\nprotocol error in connection to github.com:443\n\nTaking the sources of git 2.6.1. and compiling with commit 5841520b in\nhttp.c reverted gives me a working git.\n\nMy http.c now looks like:\n\n 466 if (curl_http_proxy) {\n 467 curl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);\n 468 #if LIBCURL_VERSION_NUM >= 0x070a07\n 469 curl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);\n 470 #endif\n 471 }\n\nAnd it works:\n\n$ git --version\ngit version 2.6.1\n$ git pull\nAlready up-to-date.\n\n\n\nGreetings,\n\nJohan\n"},{"id":"271964","messageId":"vpq37x54vav.fsf@grenoble-inp.fr","threadId":"40595","inReplyTo":"loom.20151020T131513-529@post.gmane.org","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2015-10-20T11:46:16Z","receivedAt":"2015-10-20T11:46:16Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"Hi,\n\nI'm just Cc-ing Enrique, the author of 5841520b.\n\nJohan Laenen writes:\n\n> Commit 5841520b makes it impossible to connect to github from behind my\n> company's firewall.\n>\n> I'm running CYGWIN_NT-6.1 and the default git version 2.5.3 complains with a\n> fatal error when trying to git pull:\n>\n> $ /bin/git --version\n> git version 2.5.3\n> $ /bin/git pull\n> fatal: unable to access 'https://github.com/gargle/french/': Unknown SSL\n> protocol error in connection to github.com:443\n>\n> Taking the sources of git 2.6.1. and compiling with commit 5841520b in\n> http.c reverted gives me a working git.\n>\n> My http.c now looks like:\n>\n> 466 if (curl_http_proxy) {\n> 467 curl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);\n> 468 #if LIBCURL_VERSION_NUM >= 0x070a07\n> 469 curl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);\n> 470 #endif\n> 471 }\n>\n> And it works:\n>\n> $ git --version\n> git version 2.6.1\n> $ git pull\n> Already up-to-date.\n>\n>\n>\n> Greetings,\n>\n> Johan\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"271970","messageId":"cbf2c2c2c137445ebb9e2c5f1012cb10@EXMBNJE8.ad.twosigma.com","threadId":"40595","inReplyTo":"vpq37x54vav.fsf@grenoble-inp.fr","subject":"RE: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Enrique Tobis","fromEmail":"enrique.tobis@twosigma.com","sentAt":"2015-10-20T13:39:55Z","receivedAt":"2015-10-20T13:39:55Z","isPatch":false,"sender":{"key":"enrique.tobis@twosigma.com","avatar":"https://avatars.githubusercontent.com/u/940401?v=4"},"body":"Hey!\n\nI'm really sorry to hear that.\n\nThat change should enable more forms of authentication with your proxy, but it does cause libcurl to choose the one it finds most secure, according to the docs (http://curl.haxx.se/libcurl/c/CURLOPT_HTTPAUTH.html) What kinds of authentication does your proxy use?\n\nThanks,\nEnrique\n\n-----Original Message-----\nFrom: Matthieu Moy [mailto:Matthieu.Moy@grenoble-inp.fr] \nSent: Tuesday, October 20, 2015 07:46\nTo: Johan Laenen\nCc: git@vger.kernel.org; Enrique Tobis\nSubject: Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.\n\nHi,\n\nI'm just Cc-ing Enrique, the author of 5841520b.\n\nJohan Laenen writes:\n\n> Commit 5841520b makes it impossible to connect to github from behind my\n> company's firewall.\n>\n> I'm running CYGWIN_NT-6.1 and the default git version 2.5.3 complains with a\n> fatal error when trying to git pull:\n>\n> $ /bin/git --version\n> git version 2.5.3\n> $ /bin/git pull\n> fatal: unable to access 'https://github.com/gargle/french/': Unknown SSL\n> protocol error in connection to github.com:443\n>\n> Taking the sources of git 2.6.1. and compiling with commit 5841520b in\n> http.c reverted gives me a working git.\n>\n> My http.c now looks like:\n>\n> 466 if (curl_http_proxy) {\n> 467 curl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);\n> 468 #if LIBCURL_VERSION_NUM >= 0x070a07\n> 469 curl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);\n> 470 #endif\n> 471 }\n>\n> And it works:\n>\n> $ git --version\n> git version 2.6.1\n> $ git pull\n> Already up-to-date.\n>\n>\n>\n> Greetings,\n>\n> Johan\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"271972","messageId":"loom.20151020T155923-458@post.gmane.org","threadId":"40595","inReplyTo":"cbf2c2c2c137445ebb9e2c5f1012cb10@EXMBNJE8.ad.twosigma.com","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Johan Laenen","fromEmail":"johan.laenen+cygwin@gmail.com","sentAt":"2015-10-20T14:23:40Z","receivedAt":"2015-10-20T14:23:40Z","isPatch":false,"sender":{"key":"johan.laenen+cygwin@gmail.com","avatar":null},"body":"Enrique Tobis twosigma.com> writes:\n\n> \n> Hey!\n> \n> I'm really sorry to hear that.\n> \n> That change should enable more forms of authentication with your proxy,\nbut it does cause libcurl to choose\n> the one it finds most secure, according to the docs\n> (http://curl.haxx.se/libcurl/c/CURLOPT_HTTPAUTH.html) What kinds of\nauthentication does your\n> proxy use?\n> \n> Thanks,\n> Enrique\n> \n\nHi,\n\nThanks for looking into this.\n\nI'm behind a NTLM proxy :/\n\nGreetings,\n\nJohan\n"},{"id":"271973","messageId":"loom.20151020T162917-340@post.gmane.org","threadId":"40595","inReplyTo":"loom.20151020T155923-458@post.gmane.org","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Johan Laenen","fromEmail":"johan.laenen+cygwin@gmail.com","sentAt":"2015-10-20T14:30:36Z","receivedAt":"2015-10-20T14:30:36Z","isPatch":false,"sender":{"key":"johan.laenen+cygwin@gmail.com","avatar":null},"body":"Johan Laenen gmail.com> writes:\n\nI'm not the only one. Another cygwin user is experiencing the exact same\nproblem, see http://permalink.gmane.org/gmane.os.cygwin/155039 for more info.\n\ngreetings,\n\nJohan\n"},{"id":"271976","messageId":"xmqqr3kp8qqe.fsf@gitster.mtv.corp.google.com","threadId":"40595","inReplyTo":"cbf2c2c2c137445ebb9e2c5f1012cb10@EXMBNJE8.ad.twosigma.com","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-10-20T16:11:21Z","receivedAt":"2015-10-20T16:11:21Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Enrique Tobis writes:\n\n> Hey!\n>\n> I'm really sorry to hear that.\n>\n> That change should enable more forms of authentication with your\n> proxy, but it does cause libcurl to choose the one it finds most\n> secure, according to the docs\n> (http://curl.haxx.se/libcurl/c/CURLOPT_HTTPAUTH.html) What kinds of\n> authentication does your proxy use?\n\nGood line of thought. The answer would reveal what non-working\nauthentication form the proxy claims to support is chosen because\nlibcurl considers more secure than the one the user wants to use.\nI'd imagine that the next step after that would be to make the list\nof authentication forms configurable so that the user can say \"hey\nmy proxy claims to support this one but it does not work\" to skip\nit?\n\nThat sounds like a similar approach as what we did for SSL ciphers\nin f6f2a9e4 (http: add support for specifying an SSL cipher list,\n2015-05-08) where some people had problems with certain cipher the\nserver/client claimed to support when it was in fact broken.\n\nThanks.\n"},{"id":"271981","messageId":"33632f538b4a406fb8f0e1eb2b016c43@EXMBNJE8.ad.twosigma.com","threadId":"40595","inReplyTo":"xmqqr3kp8qqe.fsf@gitster.mtv.corp.google.com","subject":"RE: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Enrique Tobis","fromEmail":"enrique.tobis@twosigma.com","sentAt":"2015-10-20T17:06:37Z","receivedAt":"2015-10-20T17:06:37Z","isPatch":false,"sender":{"key":"enrique.tobis@twosigma.com","avatar":"https://avatars.githubusercontent.com/u/940401?v=4"},"body":"\n\nFrom: Junio C Hamano [mailto:jch2355@gmail.com] On Behalf Of Junio C Hamano\n\n> Enrique Tobis writes:\n\n>> Hey!\n>>\n>> I'm really sorry to hear that.\n>>\n>> That change should enable more forms of authentication with your \n>> proxy, but it does cause libcurl to choose the one it finds most \n>> secure, according to the docs\n>> (http://curl.haxx.se/libcurl/c/CURLOPT_HTTPAUTH.html) What kinds of \n>> authentication does your proxy use?\n\n> Good line of thought. The answer would reveal what non-working authentication form the proxy claims to support is chosen because libcurl considers more secure than the one the user wants to use.\n> I'd imagine that the next step after that would be to make the list of authentication forms configurable so that the user can say \"hey my proxy claims to support this one but it does not work\" to skip it?\n\n> That sounds like a similar approach as what we did for SSL ciphers in f6f2a9e4 (http: add support for specifying an SSL cipher list,\n2015-05-08) where some people had problems with certain cipher the server/client claimed to support when it was in fact broken.\n\n> Thanks.\n\n@Junio: I agree. From the post in the cygwin mailing list that Johan mentioned, the problem seems to be that the proxy supports NEGOTIATE, NTLM and Basic, and libcurl is choosing NEGOTIATE. That choice fails for that user.\n\nThere is something I don't understand, though. Johan must be configuring his proxy either a) through git config files; or b) through environment variables. Johan says his proxy uses NTLM authentication. If he is doing a), then my change should not have had any impact. We were already setting CURLOPT_PROXYAUTH to CURLAUTH_ANY in that case. If it's b), then his proxy couldn't have been using NTLM authentication. In the old code path, only _BASIC was available as an authentication mechanism. That default is what prompted me to make the change in the first place.\n\n@Johan: how are you configuring your proxy? Git configuration or environment variables? Also, could you run GIT_CURL_VERBOSE=1 git pull and send the output. That should show the failing authentication method.\n\nThanks.\n"},{"id":"272023","messageId":"loom.20151021T073251-696@post.gmane.org","threadId":"40595","inReplyTo":"33632f538b4a406fb8f0e1eb2b016c43@EXMBNJE8.ad.twosigma.com","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Johan Laenen","fromEmail":"johan.laenen+cygwin@gmail.com","sentAt":"2015-10-21T05:34:20Z","receivedAt":"2015-10-21T05:34:20Z","isPatch":false,"sender":{"key":"johan.laenen+cygwin@gmail.com","avatar":null},"body":"Enrique Tobis twosigma.com> writes:\n\n> Johan: how are you configuring your proxy? Git configuration or\nenvironment variables? Also, could you\n\n\nI'm just using the https_proxy environment variable, not the git configuration:\n\n$ export https_proxy=http://:@myproxy:8080\n\n\n\nSorry for the multiple attemps at answering your questions, but the mailing\nlist keeps on complaining about spam :/\n"},{"id":"272027","messageId":"loom.20151021T091641-32@post.gmane.org","threadId":"40595","inReplyTo":"33632f538b4a406fb8f0e1eb2b016c43@EXMBNJE8.ad.twosigma.com","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Johan Laenen","fromEmail":"johan.laenen+cygwin@gmail.com","sentAt":"2015-10-21T07:19:40Z","receivedAt":"2015-10-21T07:19:40Z","isPatch":false,"sender":{"key":"johan.laenen+cygwin@gmail.com","avatar":null},"body":"Enrique Tobis twosigma.com> writes:\n\n> There is something I don't understand, though. Johan must be configuring\nhis proxy either a) through git\n> config files; or b) through environment variables. Johan says his proxy\nuses NTLM authentication. If he\n> is doing a), then my change should not have had any impact. We were\nalready setting CURLOPT_PROXYAUTH to\n> CURLAUTH_ANY in that case. If it's b), then his proxy couldn't have been\nusing NTLM authentication. In the\n> old code path, only _BASIC was available as an authentication mechanism.\nThat default is what prompted me\n> to make the change in the first place.\n\nInteresting!\n\nI tried both git versions, the one with the revert of commit 5841520b and\nthe one without and both gave me the fatal error \"Unknown SSL protocol error\nin connection to github.com:443\" when using the ~/.gitconfig [https] and\n[http] proxy settings instead of using the https_proxy environment variable.\n\nGreetings,\n\nJohan\n"},{"id":"272048","messageId":"xmqqh9lk5b42.fsf@gitster.mtv.corp.google.com","threadId":"40595","inReplyTo":"loom.20151021T091641-32@post.gmane.org","subject":"Re: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-10-21T18:29:17Z","receivedAt":"2015-10-21T18:29:17Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"[administrivia: please do not cull people out of the Cc: list]\n\nJohan Laenen writes:\n\n> Enrique Tobis twosigma.com> writes:\n>\n>> There is something I don't understand, though. Johan must be\n>> configuring his proxy either a) through git config files; or b)\n>> through environment variables. Johan says his proxy uses NTLM\n>> authentication. If he is doing a), then my change should not have\n>> had any impact. We were already setting CURLOPT_PROXYAUTH to\n>> CURLAUTH_ANY in that case. If it's b), then his proxy couldn't\n>> have been using NTLM authentication. In the old code path, only\n>> _BASIC was available as an authentication mechanism. That\n>> default is what prompted me to make the change in the first\n>> place.\n>\n> Interesting!\n>\n> I tried both git versions, the one with the revert of commit 5841520b and\n> the one without and both gave me the fatal error \"Unknown SSL protocol error\n> in connection to github.com:443\" when using the ~/.gitconfig [https] and\n> [http] proxy settings instead of using the https_proxy environment variable.\n\nOK, so the conclusion I draw here is that your NTLM setting is not\nworking at all, you have been using Basic auth happily before that\ncommit, and you have to either (1) get NTLM auth working, or (2)\nfind a way to tell Git that your proxy appears to support NTLM\nbut it is unusable and you need to use Basic.\n\nEven though you may be capable to do (1), other people in the same\nsituation might not be, in which case we would also need a way to do\n(2).\n\nAm I reading the above correctly?\n"},{"id":"272049","messageId":"d3ad25596c1f40dd8adc41174028d05b@EXMBNJE8.ad.twosigma.com","threadId":"40595","inReplyTo":"xmqqh9lk5b42.fsf@gitster.mtv.corp.google.com","subject":"RE: Commit 5841520b makes it impossible to connect to github from behind my company's firewall.","fromName":"Enrique Tobis","fromEmail":"enrique.tobis@twosigma.com","sentAt":"2015-10-21T18:45:43Z","receivedAt":"2015-10-21T18:45:43Z","isPatch":false,"sender":{"key":"enrique.tobis@twosigma.com","avatar":"https://avatars.githubusercontent.com/u/940401?v=4"},"body":"From: Junio C Hamano [mailto:jch2355@gmail.com] On Behalf Of Junio C Hamano\n\n[administrivia: please do not cull people out of the Cc: list]\n\nJohan Laenen writes:\n\n> Enrique Tobis twosigma.com> writes:\n>\n>> There is something I don't understand, though. Johan must be \n>> configuring his proxy either a) through git config files; or b) \n>> through environment variables. Johan says his proxy uses NTLM \n>> authentication. If he is doing a), then my change should not have had \n>> any impact. We were already setting CURLOPT_PROXYAUTH to CURLAUTH_ANY \n>> in that case. If it's b), then his proxy couldn't have been using \n>> NTLM authentication. In the old code path, only _BASIC was available \n>> as an authentication mechanism. That default is what prompted me to \n>> make the change in the first place.\n>\n> Interesting!\n>\n> I tried both git versions, the one with the revert of commit 5841520b \n> and the one without and both gave me the fatal error \"Unknown SSL \n> protocol error in connection to github.com:443\" when using the \n> ~/.gitconfig [https] and [http] proxy settings instead of using the https_proxy environment variable.\n\n> OK, so the conclusion I draw here is that your NTLM setting is not working at all, you have been using Basic auth happily before that commit, and you have to either (1) get NTLM auth working, or (2) find a way to tell Git that your proxy appears to support NTLM but it is unusable and you need to use Basic.\n\n> Even though you may be capable to do (1), other people in the same situation might not be, in which case we would also need a way to do (2).\n\n> Am I reading the above correctly?\n\nI draw almost the same conclusions. I agree that he seems to have been using Basic all along. Based on the verbose output Johan posted, I think libcurl is trying to do NEGOTIATE instead of NTLM, so that's what Johan would have to get working. I also agree that other people may need to do (2).\n"}]}