Re: GIT_SSH and mirror not working with git 2.30.1

From: Jeff King <peff@peff.net>
Date: Mar 16, 2021, 20:33 UTC
Message-ID: <YFEWLNZ09ycJQ5uM@coredump.intra.peff.net>
In-Reply-To: <e39d23615e084671965fc96174ac881e@lanl.gov>

On Tue, Mar 16, 2021 at 06:53:24PM +0000, Lamborn, Peter Craig wrote:

Show 18 quoted lines

> We have some machines behind firewalls and gateways that cannot access
> git repos directly.  We have been using GIT_SSH and mirror to push and
> pull git request through a less restricted machine.  This has been
> working for a while, specifically both git 2.24.1 and git 2.28 can
> handle the method we have been doing.
> [...]
> workstation$ cat ssh-hop.sh
> #!/bin/bash
>   
> MACHINE_REGEXP="<...>"
>   
> if [[ $1 =~ $MACHINE_REGEXP ]]; then
>   
>   exec ssh <gateway> ssh "$@"
>   
> else
>   exec ssh "$@"
> fi

I suspect the problem is that your script blindly matches "$1". Doing so makes the assumption that Git will never pass any other options to ssh. Traditionally Git _usually_ wouldn't do so (unless it needed specific options like "-p", "-4/-6", etc).

But in Git's newer "v2" protocol, we have to pass an environment variable across the wire, which requires using "-o". E.g.:

  [using v2.28]
  $ GIT_TRACE2_BRIEF=1 GIT_TRACE2=1 git ls-remote git@github.com:nosuch/repo 2>&1 | grep child_start
  child_start[0] ssh git@github.com 'git-upload-pack '\''nosuch/repo'\'''

  [using v2.29]
  $ GIT_TRACE2_BRIEF=1 GIT_TRACE2=1 git ls-remote git@github.com:nosuch/repo 2>&1 | grep child_start
  child_start[0] ssh -o SendEnv=GIT_PROTOCOL git@github.com 'git-upload-pack '\''nosuch/repo'\'''

> When you try the same thing with git 2.30.1, the "git push" commands
> still succeed.  But "git pull" returns this:

Using the new protocol became the default in v2.29. It also is only used for fetching, not pushing. So that explains why it's a problem in v2.30.1, and also why "git push" isn't affected.

> ssh: connect to host <destination machine> port 22: Operation timed out
> fatal: Could not read from remote repository.

This part is presumably just what happens when the "hop" behavior of your script doesn't kick in. A straight "ssh" is run under the hood, but your firewall probably times it out.

> Does git 2.30.1 change something about mirrors and/or GIT_SSH that
> would cause git pulls to fail?  Do we need to adjust our current
> process?

Adjusting your script to look for the hostname in the second-to-last argument would probably be more robust. But as Andreas noted, using ssh's ProxyJump feature would be better still.

-Peff