Re: FW: git via http protocol _and_ a proxy using NTLM authentication -- git 1.5.4.2 & curl 7.18.0

From: Mike Hommey <mh@glandium.org>
Date: Feb 27, 2008, 07:20 UTC
Message-ID: <20080227072012.GA23423@glandium.org>
In-Reply-To: <AA28F077645B324881335614E4F7C428034C01@win-ex01.bench.com>

On Tue, Feb 26, 2008 at 05:46:21PM -0600, Ken.Fuchs@bench.com wrote:

Show 20 quoted lines

> > Well, the CURLOPT_PROXY is set in transport.c as well which 
> > your patch didn't address.
> 
> Thanks, I just did a similar patch to transport.c:
> 
> $ diff -u ../git-1.5.4.2/transport.c.orig \
>           ../git-1.5.4.2/transport.c
> @@ -456,7 +456,8 @@
>         if (transport->remote->http_proxy)
>                 curl_easy_setopt(slot->curl, CURLOPT_PROXY,
>                                  transport->remote->http_proxy);
> -
> +       curl_easy_setopt(slot->curl, CURLOPT_PROXYAUTH,
> (long)CURLAUTH_NTLM);
> +       curl_easy_setopt(slot->curl, CURLOPT_PROXYUSERPWD,
> "<user-id>:<password>");
>         if (start_active_slot(slot)) {
>                 run_active_slot(slot);
>                 if (results.curl_result != CURLE_OK) {
> $

Starting with curl 7.14.1, you're supposed to be able to use the http://user:pass@proxy/ syntax, though I'm not sure it deals well with NTLM domains. You can probably leave CURLOPT_PROXYUSERPWD out if you set your proxy url correctly.

As for CURLOPT_PROXYAUTH, it would be better to set it from another config.

Note that remote.<name>.proxy config doesn't work as expected, you should use http.proxy which just work (and the change in transport.c is useless, then). I have, as part of by http-refactoring topic, a patch for remote.<name>.proxy to work better, though it doesn't support changing the proxy authentication method.

Show 13 quoted lines

> > If that's the case, I figure the verbose output 
> > should've shown some auth failures with the proxy?
> 
> No, actually the last 2 lines of debug output (unchanged) is:
> 
> * Connection #0 to host <proxy domain> left intact
> fatal: Couldn't find remote ref HEAD
> 
> So, the proxy communication via NTLM authentication seems to be working.
> The patch to transport.c did not change anything as far as I can see.
> 
> The fatal error is from remote.c.  Perhaps, it also requires some
> changes.

Does your remote have a HEAD ref ?

Mike