Unknown SSL protocol error with HTTPS proxy decryption #373
Comments
|
@galehar could you try cloning with all the diagnostics enabled? My psychic debugger thinks something network-related is involved:
Feel free to strip out sensitive stuff, but there should be some extra info in here to help us troubleshoot further. |
|
Here is a trace of the connection with the sensitive stuff replaced. git pull
< HTTP/1.1 407 Proxy Authentication Required
|
|
Since 1.9.5 works, you could compare the verbose output of both... |
|
Well, I did compare the verbose output, but I didn't learn anything from it. With git 1.9.4, I get "SSL connection using DHE-RSA-AES256-SHA" and with git 2.5.1: "Unknown SSL protocol error in connection to mygitserver.company.com:443". Besides, the problem is not related to https decryption. It has been disabled today, and I can connect with git 1.9.4 without having to mess with sslCAInfo or sslVerify. Still same error with git 2.5.1. Here is the full log of the successful connection with git 1.9.4: $ git fetch
< HTTP/1.1 407 Proxy Authentication Required
< HTTP/1.1 407 Proxy Authentication Required
< HTTP/1.1 200 Connection established
< HTTP/1.1 401 Authorization Required
< HTTP/1.1 401 Authorization Required
< HTTP/1.1 200 OK
|
Without SSL, you certainly do not get this error with 1.9.5 and 2.5.1. What do you get instead? |
|
What do you mean without SSL? I can't disable SSL, I can only connect to the repository via https. The https decryption module for the proxy has been disabled, so it's not messing with certificates anymore. I can set sslVerify to false to disable certificate verification, but I still have to use SSL. |
Well, I took the meaning of
too literal, I guess. |
|
The best strategy from here would be to reduce the problem. If you can test with a host that does not need to go through the proxy, you could find out whether it is actually the proxy that does bad things. Try to think of ways to take out as much as possible, until you hit a spot where taking away one block "fixes" things. That way, you could identify the real culprits better and we have a chance of finding a solution for you. |
|
@galehar any luck yet with the investigation? |
|
Well, I tested from another network with a different proxy, and it worked fine. It was a different computer, but with the same OS and same git version. |
|
You could test with It is possible that the proxy gets confused with WebDAV commands... |
|
Hi, This is related to my original post here: I have exactly same issue. Everything is working correctly in 1.9.0 and 1.9.5 git versions but not with latest one ( 2.5.3 ) I've got exactly the same CURL Verbose output as @galehar Resulting in "Unknown SSL protocol error in connection to bitbucket:443" (Original output in the link Connection to my proxy is going through http (we don't have https proxy set). I've got Env Vars set in this way: HTTP_PROXY = http://user:pass@proxy.com:8080 Please note http in HTTPS_PROXY. This configuration works perfectly for 1.9 and 1.9.5 as mentioned on the beginning. Any ideas ? |
Could you compare the verbose output of |
|
Here is the curl output. I used -x option and didn't bother to authenticate on the repo. I can try to change that if you want. By the way, I have been able to replicate the issue with another repository. I really think the problem is caused by the proxy. |
|
@galehar I actually really was asking to compare the output, not to make me compare the output... ;-) BTW I surrounded your pasted log with proper Markdown so that I do not get eye cancer. |
|
@marsoltys maybe you can perform the analysis? My idea was to compare how |
|
I'm not sure how to pass password for repository as I'm already using -U for proxy details
|
|
You can configure proxies via the |
|
@dscho ok, here is what I've got with the curl / git comparison:
Then, between Host and User-Agent lines, it has an additionnal Proxy-Authorization line. |
|
I'm providing diff file with output from Git 1.9.5 and 2.5.3 https://www.dropbox.com/s/dyef5hby6mcvdxp/9EeIzRPQ.diff?dl=0 In my case first request / connection under 2.5.3 is failed "Unknown SSL..." - this is proxy request One line is interesting (don't know if this mean something): So if actual Proxy connection has been lost curl is not able to re-use session ID ? |
|
I have a hunch that curl/curl@f65e07c might fix this. |
|
I confirm the fix! I cloned the curl repo, compiled it, and replaced "C:\Program Files\Git\mingw64\libexec\git-core\libcurl-4.dll" with it. And it works! |
|
Awesome! Thanks! |
|
The proper course of action now is to determine how to fix this in Git for Windows. I see two options:
My preference would be 1. @galehar would you have time to help me do that? |
|
Okay, I'll start working on it. |
|
Sure I can help, although I'm not sure how. Do you need me to test something? |
|
I'll work on that |
|
@galehar assuming that you have an SDK, could you please download the package for your architecture from https://github.com/dscho/MINGW-packages/releases/tag/tmp-curl-ntlm-fix and install it with |
Under certain circumstances, an NTLM proxy connection will be reused. If that is the case, the state of the authentication needs to be handled properly. There is a bug in cURL 7.44.0 that has been fixed in cURL's `master` already (curl/curl@f65e07ca5) and this patch backports it. This fixes git-for-windows/git#373 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Under certain circumstances, an NTLM proxy connection will be reused. If that is the case, the state of the authentication needs to be handled properly. There is a bug in cURL 7.44.0 that has been fixed in cURL's `master` already (curl/curl@f65e07ca5) and this patch backports it. This fixes git-for-windows/git#373 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
When this will be available in release ? |
|
@marsoltys you'll have to wait and see. |
|
Ok. Thanks anyway for sorting this out! |
|
@marsoltys well, you could thank me by trying it out. |
|
Alright, I have installed the SDK and tested mingw-w64-x86_64-curl-7.44.0-3-any.pkg.tar.xz. It works. |
|
@galehar perfect, thanks! |
|
@dscho I'm not able to install SDK When installer asks me for proxy I'm giving it in format
after that it hangs... |
|
Maybe it's not really hanged, it spends a lot of time downloading packages. The first time, I thought it hanged. I killed it, deleted the lock filed and restarted the installer. It worked the second time for me. |
|
@marsoltys please do not high-jack this ticket. Open a new one, and give a verbose description and be liberal with pasting output verbatim. |
|
Git for Windows 2.6.0 comes with a fixed cURL. Let's hope that MSys2 picks up my Pull Request soon, then I can close this ticket. |
@marsoltys is it really too much to ask for a new ticket? In any case, I believe that I addressed this (it is most likely not hanging, just like @galehar suggested, but we won't know until you grace us with an answer to his question). |
|
I'm working in corporate environment and not always have time to answer / log a new ticket ... At home I do not have the same proxy so won't be able to investigate / reproduce steps made at work :) |
|
Package https://github.com/dscho/MINGW-packages/releases/tag/tmp-curl-ntlm-fix tested with SDK and I can confirm that it works. |
|
@marsoltys thank you very much! It would appear that the new package was uploaded today. So I will close this ticket. |
…alized-vars Avoid using uninitialized variables in `format_tracking_info()`
Since my company implemented HTTPS proxy decryption through bluecoat SSLVA, git 2.5.1 is unable to connect to the repository with https. I always get the error :
Unknown SSL protocol error in connection to ...
I did install the CA certificate from the company and I set http.sslCAInfo to point to it. The certificate is properly set, but I still get the Unkown SSL protocol error.
Setting http.sslVerify to false doesn't fix the problem, still the same issue.
I tried with curl to diagnose, and setting the CA certificate with the cacert option allows me to connect successfully, and so does using the insecure option.
I also tried with an old git version 1.9.4.msysgit.2, and with it, I've also been able to successfully connect by setting sslCAInfo properly or disabling sslVerify.
git 2.5.1 on the other hand doesn't work at all. I tried both 32 and 64 bit versions. This is on Windows 7 SP1 64 bits.
The text was updated successfully, but these errors were encountered: