1.9.5.msysgit.1 and NTLM proxy

[baloo66]

I've got a problem with git and NTLM authentication:

while with 1.9.5.msysgit.0 everything is fine - after installation of 1.9.5.msysgit.1 after issuing

git clone --verbose https://bitbucket.org/atlassian_tutorial/tutorial-jira-add-workflow-extensions

I get the following

Cloning into tutorial-jira-add-workflow-extensions
POST git-upload-pack (350 bytes)

... then, after about 5 minutes

git fatal: The remote end hung up unexpectedly error: RPC failed; result=27, HTTP code = 0

If I set GIT_CURL_VERBOSE=1 and repeat the command above, I see the following

• GIT/libcurl tries CONNECT
• proxy: 407 Proxy Authentication Required with NTLM challenge
• GIT/libcurl tries CONNECT with NTLM response
• server: 200 Connection established,
  • Proxy replied OK to CONNECT request
  • successfully set certificate verify locations:
  • CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
  • SSL connection using TLSv1.0 / DHE-RSA-AES128-SHA
  • Server certificate:
  • ....
  • SSL certificate verify ok.
• GIT/libcurl GET ...repo..../info/refs?service=git-upload-pack HTTP/1.1
• server: 200 OK
  • Connection two minor patches to make git play more nicely in the mingw environment #1 to host wwwproxy.lbsbay.net left intact POST git-upload-pack (350 bytes)
  • Couldn't find host bitbucket.org in the _netrc file; using defaults
  • NTLM-proxy picked AND auth done set, clear picked!
  • Trying 172.20.249.49... (our proxy)
  • Connected to wwwproxy.xxxx.xxxx (172.20.249.49) port 8080 (#0)
  • Establish HTTP proxy tunnel to bitbucket.org:443

and from now on I see a loop of

• GIT/libcurl tries CONNECT
• proxy: 407 Proxy Authentication Required (without NTLM challenge)
  • Ignore 849 bytes of response-body
  • Connect me again please
  • successfully set certificate verify locations:
  • CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
  • SSL re-using session ID
  • Unknown SSL protocol error in connection to bitbucket.org:443
  • Couldn't find host bitbucket.org in the _netrc file; using defaults
  • Found bundle for host bitbucket.org: 0x3061988
  • NTLM-proxy picked AND auth done set, clear picked!
  • Hostname wwwproxy.lbsbay.net was found in DNS cache
  • Trying 172.20.249.49...
  • Connected to wwwproxy.lbsbay.net (172.20.249.49) port 8080 (two minor patches to make git play more nicely in the mingw environment #1)
  • Establish HTTP proxy tunnel to bitbucket.org:443
• GIT/libcurl tries CONNECT
• proxy: 407 Proxy Authentication Required (without NTLM challenge)
  • Ignore 849 bytes of response-body
  • Connect me again please
  • successfully set certificate verify locations:
  • CAfile: C:\Program Files (x86)\Git/bin/curl-ca-bundle.crt CApath: none
  • SSL re-using session ID
  • Unknown SSL protocol error in connection to bitbucket.org:443
  • Couldn't find host bitbucket.org in the _netrc file; using defaults
  • Found bundle for host bitbucket.org: 0x3061988
  • NTLM-proxy picked AND auth done set, clear picked!
  • Hostname wwwproxy.lbsbay.net was found in DNS cache
  • Trying 172.20.249.49...
  • Connected to wwwproxy.lbsbay.net (172.20.249.49) port 8080 (two minor patches to make git play more nicely in the mingw environment #1)
  • Establish HTTP proxy tunnel to bitbucket.org:443
• GIT/libcurl tries CONNECT

.... and so on and so on and so on

I am behind a ntlm-proxy

I am using 1.9.5.msysgit.1 on Windows 7 (to say it again: 1.9.4.msysgit.0 is doing fine)

Is that a problem of the proxy or of libcurl?

[t-b]

Thanks for the report and the detailed analysis.

Unknown SSL protocol error in connection to bitbucket.org:443
This looks like the problem.

According to 1 newer curl versions have disabled some TLS ciphers by default. Which might be the problem here.

Can you reproduce the bug with the command line curl program? And can you then try with --ciphers ALL if that helps?

[dscho]

@baloo66 please note that a little quicker feedback would help to keep tickets alive, and to work toward their resolution.