# git clone against firewall 8 messages from 2010-01-14 to 2010-01-18. Participants: Sebastian Pipping, Junio C Hamano, Andreas Schwab, Andreas Krey. Thread: https://gitlist.dev/t/22228 ## Sebastian Pipping, 2010-01-14 23:45 Subject: git clone against firewall Message-ID: <4B4FACB1.2080902@hartwork.org> URL: https://gitlist.dev/e/4B4FACB1.2080902%40hartwork.org ``` hello! with a firewall blocking outgoing connections to port 9418 a git clone git://... of git 1.6.6 seems to never return, i.e. loop forever. in my rather automated environment (gentoo's tool layman calling git) this behavior is rather troublesome - i need some kind of abort-and-error instead: what i'm trying to do is loop over a number of clone URL alternatives of the same repository like .. git://git.overlays.gentoo.org/dev/dberkholz.git http://git.overlays.gentoo.org/gitroot/dev/dberkholz.git git+ssh://git@git.overlays.gentoo.org/dev/dberkholz.git .. and stop at the first clone that returns without error. are there means to make git fail in such a case or to apply a timout? if not please consider adding a related commandline option to git-clone. thank you. sebastian ``` ## Junio C Hamano, 2010-01-15 18:17 Subject: Re: git clone against firewall Message-ID: <7vzl4fz0zb.fsf@alter.siamese.dyndns.org> URL: https://gitlist.dev/e/7vzl4fz0zb.fsf%40alter.siamese.dyndns.org In-Reply-To: <4B4FACB1.2080902@hartwork.org> ``` Sebastian Pipping writes: > with a firewall blocking outgoing connections to port 9418 a > > git clone git://... > > of git 1.6.6 seems to never return, i.e. loop forever. in my rather > automated environment (gentoo's tool layman calling git) this behavior > is rather troublesome - i need some kind of abort-and-error instead: > what i'm trying to do is loop over a number of clone URL alternatives of > the same repository like .. > > git://git.overlays.gentoo.org/dev/dberkholz.git What do you exactly mean by "blocking"? In my environment at work, there is a firewall and I immedately get this: $ git clone git://git.overlays.gentoo.org/dev/dberkholz.git/ Initialized empty Git repository in /var/tmp/dberkholz/.git/ fatal: Unable to look up git.overlays.gentoo.org (port 9418) (Name or service not known) as my environment is quite isolated (it is not just a "NAT with selective port blocking"). I am guessing that you can resolve the hostname in your environment (i.e. you configured your NAT to let DNS go directly outside). What happens when you try the following? $ telnet git.overlays.gentoo.org 9418 Do you get: Trying 66.219.59.40... telnet: Unable to connect to remote host: Connection refused If you get something like: Trying 66.219.59.40... Connected to pelican.gentoo.org. Escape character is '^]'. then I don't think you are blocked, and if that is the case, there is not much we can do about it. I think your firewall can help, though, by not pretending to be allowing the connection and then blocking you halfway. ``` ## Sebastian Pipping, 2010-01-15 19:12 Subject: Re: git clone against firewall Message-ID: <4B50BE10.5010603@hartwork.org> URL: https://gitlist.dev/e/4B50BE10.5010603%40hartwork.org In-Reply-To: <7vzl4fz0zb.fsf@alter.siamese.dyndns.org> ``` On 01/15/10 19:17, Junio C Hamano wrote: > What do you exactly mean by "blocking"? I chose "BLOCK always" as action for that port in my home router (Netgear ProSafe 802.11g) config. No idea how it's exactly doing that. > I am guessing that you can resolve the hostname in your environment > (i.e. you configured your NAT to let DNS go directly outside). Name resolution works, yes. > What > happens when you try the following? > > $ telnet git.overlays.gentoo.org 9418 > > Do you get: > > Trying 66.219.59.40... > telnet: Unable to connect to remote host: Connection refused > > If you get something like: > > Trying 66.219.59.40... > Connected to pelican.gentoo.org. > Escape character is '^]'. > > then I don't think you are blocked, and if that is the case, there is not > much we can do about it. I get a loop/freeze on Trying 66.219.59.40... nothing more. Can you deduce from that, what's happening? > I think your firewall can help, though, by not pretending to be allowing > the connection and then blocking you halfway. I'm afraid I cannot configure that. Sebastian ``` ## Sebastian Pipping, 2010-01-15 19:19 Subject: Re: git clone against firewall Message-ID: <4B50BFD6.2090308@hartwork.org> URL: https://gitlist.dev/e/4B50BFD6.2090308%40hartwork.org In-Reply-To: <4B50BE10.5010603@hartwork.org> ``` On 01/15/10 20:12, Sebastian Pipping wrote: > I get a loop/freeze on > > Trying 66.219.59.40... > > nothing more. Can you deduce from that, what's happening? Wait, it actually times out: # date ; telnet git.overlays.gentoo.org 9418 ; date Fr 15. Jan 20:14:01 CET 2010 Trying 66.219.59.40... telnet: Unable to connect to remote host: Connection timed out Fr 15. Jan 20:17:10 CET 2010 Sebastian ``` ## Andreas Schwab, 2010-01-15 19:30 Subject: Re: git clone against firewall Message-ID: URL: https://gitlist.dev/e/m2aawf1804.fsf%40igel.home In-Reply-To: <4B50BE10.5010603@hartwork.org> ``` Sebastian Pipping writes: > I get a loop/freeze on > > Trying 66.219.59.40... > > nothing more. Can you deduce from that, what's happening? So your firewall is dropping the packets on the floor. Not much that can be done about that. Andreas. -- Andreas Schwab, schwab@linux-m68k.org GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5 "And now for something completely different." ``` ## Sebastian Pipping, 2010-01-15 19:33 Subject: Re: git clone against firewall Message-ID: <4B50C311.2040305@hartwork.org> URL: https://gitlist.dev/e/4B50C311.2040305%40hartwork.org In-Reply-To: ``` On 01/15/10 20:30, Andreas Schwab wrote: > Sebastian Pipping writes: > >> I get a loop/freeze on >> >> Trying 66.219.59.40... >> >> nothing more. Can you deduce from that, what's happening? > > So your firewall is dropping the packets on the floor. I see. > Not much that > can be done about that. My problem actually is not the dropping but that git doesn't stop trying. I actually want it to fail. Sebastian ``` ## Andreas Krey, 2010-01-15 23:03 Subject: Re: git clone against firewall Message-ID: <20100115230357.GA10163@inner.home.ulmdo.de> URL: https://gitlist.dev/e/20100115230357.GA10163%40inner.home.ulmdo.de In-Reply-To: <4B50C311.2040305@hartwork.org> ``` On Fri, 15 Jan 2010 20:33:37 +0000, Sebastian Pipping wrote: ... > > Not much that > > can be done about that. > > My problem actually is not the dropping but that git doesn't stop > trying. I actually want it to fail. It does. After the usual network timeout, which unfortunately is a few minutes, and thus not really useful for trying several machines: 74.43.91.xxx[0: 74.43.91.xxx]: errno=Connection timed out fatal: unable to connect a socket (Connection timed out) Andreas ``` ## Sebastian Pipping, 2010-01-18 02:04 Subject: Re: git clone against firewall Message-ID: <4B53C19B.1040809@hartwork.org> URL: https://gitlist.dev/e/4B53C19B.1040809%40hartwork.org In-Reply-To: <20100115230357.GA10163@inner.home.ulmdo.de> ``` On 01/16/10 00:03, Andreas Krey wrote: > It does. After the usual network timeout, which unfortunately is > a few minutes, and thus not really useful for trying several > machines: I would like to a ask for a timeout-after-n-seconds option then. Thanks in advance! Sebastian ```