git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] Disable dumb HTTP fallback with GIT_CURL_FALLBACK=0

From
Shawn Pearce <spearce@spearce.org>
Date
Sep 20, 2012, 23:05 UTC
Message-ID
<CAJo=hJvyEtTDVJ6+Gv1kgqs1=UQEVbLaSFMEmUmCX-JWRCrDxA@mail.gmail.com>
In-Reply-To
<20120920172408.GC18655@sigill.intra.peff.net>
On Thu, Sep 20, 2012 at 10:24 AM, Jeff King <peff@peff.net> wrote:
Show 14 quoted lines
> On Wed, Sep 19, 2012 at 10:57:35PM -0700, Shawn O. Pearce wrote:
>
>> > so transient errors on the initial smart
>> > contact can cause us to fall back to dumb,
>>
>> Transient errors is actually what is leading me down this path. We see
>> about 0.0455% of our requests to the Android hosting service as these
>> dumb fallbacks. This means the client never got a proper smart service
>> reply. Server logs suggest we sent a valid response, so I am
>> suspecting transient proxy errors, but its hard to debug because
>> clients discard the error.
>
> Yup, we see the same thing. I've tracked a few down manually to actual
> things like gateway timeouts on our reverse proxy.
Our reverse proxies also fail sometimes. :-)

But right now I am seeing failures in libcurl's SSL connection that may also be causing the smart connection failures. For example this trace, where libcurl was just not able to connect to respond to the 401 with a password. I suspect what is happening is the SSL session dropped out of cache on our servers, and libcurl couldn't reuse the existing SSL session. Instead of discarding the bad session and retrying, Git aborts. I'm willing to bet modern browsers just discard the bad session and start a new one, because clients can't assume the remote server will be able to remember their session forever.

* Couldn't find host android.googlesource.com in the .netrc file; using defaults
* About to connect() to android.googlesource.com port 443 (#0)
*   Trying 2607:f8b0:400e:c02::52... * Connected to
android.googlesource.com (2607:f8b0:400e:c02::52) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSL connection using RC4-SHA
* Server certificate:
*        subject: C=US; ST=California; L=Mountain View; O=Google Inc;
CN=*.googlecode.com
*        start date: 2012-08-16 12:25:39 GMT
*        expire date: 2013-06-07 19:43:27 GMT
*        subjectAltName: android.googlesource.com matched
*        issuer: C=US; O=Google Inc; CN=Google Internet Authority
*        SSL certificate verify ok.
> GET /a/platform/tools/build/info/refs?service=git-upload-pack HTTP/1.1
User-Agent: git/1.7.12.1.1.g9b7ccb3
Host: android.googlesource.com
Accept: */*
Pragma: no-cache
* The requested URL returned error: 401
* Closing connection #0
* Couldn't find host android.googlesource.com in the .netrc file; using defaults
* About to connect() to android.googlesource.com port 443 (#0)
*   Trying 2607:f8b0:400e:c02::52... * Connected to
android.googlesource.com (2607:f8b0:400e:c02::52) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSL re-using session ID
* Unknown SSL protocol error in connection to android.googlesource.com:443
* Expire cleared
* Closing connection #0
error: Unknown SSL protocol error in connection to
android.googlesource.com:443  while accessing
https://android.googlesource.com/a/platform/tools/build/info/refs?service=git-upload-pack
fatal: HTTP request failed
Previous: Jeff KingNext: Jeff King
Message 22 of 36 in “Disable dumb HTTP fallback with GIT_CURL_FALLBACK=0”
  1. Disable dumb HTTP fallback with GIT_CURL_FALLBACK=0Shawn O. Pearce, Sep 20, 2012
  2. Shawn PearceSep 20, 2012
  3. Jeff KingSep 20, 2012
  4. Jeff KingSep 20, 2012
  5. Shawn PearceSep 20, 2012
  6. Revert "retry request without query when info/refs?query fails"Shawn O. Pearce, Sep 20, 2012
  7. Junio C HamanoSep 20, 2012
  8. Junio C HamanoSep 20, 2012
  9. Jeff KingSep 20, 2012
  10. 0/2 smart http toggle switch fails"Jeff King, Sep 20, 2012
  11. 1/2 remote-curl: rename is_http variableJeff King, Sep 20, 2012
  12. 2/2 remote-curl: let users turn off smart httpJeff King, Sep 20, 2012
  13. Junio C HamanoSep 20, 2012
  14. Jeff KingSep 20, 2012
  15. Junio C HamanoSep 20, 2012
  16. Jeff KingSep 20, 2012
  17. Junio C HamanoSep 20, 2012
  18. Jeff KingSep 20, 2012
  19. Junio C HamanoSep 21, 2012
  20. Jeff KingSep 21, 2012
  21. Jeff KingSep 20, 2012
  22. Shawn PearceSep 20, 2012
  23. Jeff KingSep 21, 2012
  24. Shawn PearceSep 21, 2012
  25. Retry HTTP requests on SSL connect failuresShawn O. Pearce, Oct 1, 2012
  26. Junio C HamanoOct 1, 2012
  27. Junio C HamanoOct 1, 2012
  28. Jeff KingOct 1, 2012
  29. Junio C HamanoOct 1, 2012
  30. Jeff KingOct 1, 2012
  31. Shawn PearceOct 2, 2012
  32. Drew NorthupOct 2, 2012
  33. Drew NorthupOct 2, 2012
  34. Re* [PATCH] Disable dumb HTTP fallback with GIT_CURL_FALLBACK=0Junio C Hamano, Sep 20, 2012
  35. 1/2 Disable dumb HTTP fallback with GIT_DUMB_HTTP_FALLBACK=falseJunio C Hamano, Sep 20, 2012
  36. 2/2 remote-curl: make dumb-http fallback configurable per URLJunio C Hamano, Sep 20, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.