Re: [git-users] Problem with cygwin git behind authentication proxy

2016-01-21 Thread Martin T.
I have a bash/vim/tmux workflow inherited from linux which I wanted to
replicate when i have to use windows. basically I almost never leave the
shell except when I use Firefox.

On Thu, Jan 21, 2016 at 10:47 AM Konstantin Khomoutov <
flatw...@users.sourceforge.net> wrote:

> On Wed, 20 Jan 2016 14:02:30 -0800 (PST)
> "Martin T."  wrote:
>
> > I am using Windows 7 x64.
> > I have installed Git for Windows and cygwin's git.
> [...]
> > But I get an authentication `407` error with cygwin's git:
> >
> > user > ~ > git config --get http.proxy
> > https://:@evilcorp.proxy.com:8080
> > user > ~ > git clone https://github.com/vim/vim
> > Cloning into 'vim'...
> > fatal: unable to access 'https://github.com/vim/vim/': Received
> > HTTP code 407 from proxy after CONNECT
> >
> > Setting the username and password in the proxy string does not change
> > the result.
> >
> > I have found this on the cywin mailing list which looks related to
> > that problem
> >
> > http://thread.gmane.org/gmane.os.cygwin/155039
> >
> > How can I fix that?
>
> I think the Git commit someone has spotted in that thread is a red
> herring: what you see from libCURL is it having chosen to go with
> Negotiate (which is GSS-SPNEGO in disguise) and then failing to
> actually find authentication mechanisms both your libCURL and the proxy
> both support.  If that's a Windows proxy, I'm pretty sure the set of
> the auth mechs it supports is either two -- NTLM and Kerberos, -- or
> just one, Kerberos.
>
> | * Read response immediately from proxy CONNECT
> | < HTTP/1.1 407 authenticationrequired
> | < Date: Wed, 20 Jan 2016 22:44:57 GMT
> | < Content-Type: text/html
> | < Cache-Control: no-cache
> | < Content-Length: 18471
> | < Proxy-Connection: Keep-Alive
> | < Proxy-Authenticate: Negotiate
> | * gss_init_sec_context() failed: : SPNEGO cannot find mechanisms to
> | negotiate < Proxy-Authenticate: Basic realm="Web Gateway"
> | <
> | * Received HTTP code 407 from proxy after CONNECT
> | * Expire cleared
> | * Curl_done
> | * Closing connection 0
> | * The cache now contains 0 members
> | fatal: unable to access 'https://github.com/Shougo/viproc.vim/':
> | Received HTTP code 407 from proxy after CONNECT
>
> On the one hand, your curl says it supports everything needed:
>
> | Features: Debug IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM
> | NTLM_WB SSL libz TLS-SRP UnixSockets Metalink
>
> But for some reason it fails negotiating.
>
> I'd try to play with Cygwin's curl while having Wireshark capturing the
> exchange: it has pretty good dissectors for SPNEGO, NTLMs and Kerberos,
> so pretty every time I had to debug a problem with somethig like this,
> I had success using Wireshark getting at the root of the problem.
>
> You might as well compare the exchanges between the curl from GfW and
> that one from Cygwin to spot the difference.
>
> P.S.
> Out of curiosity, why do you need Cygwin if there is Git for Windows?
>

-- 
You received this message because you are subscribed to the Google Groups "Git 
for human beings" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to git-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


Re: [git-users] Problem with cygwin git behind authentication proxy

2016-01-21 Thread Konstantin Khomoutov
On Wed, 20 Jan 2016 14:02:30 -0800 (PST)
"Martin T."  wrote:

> I am using Windows 7 x64.
> I have installed Git for Windows and cygwin's git.
[...]
> But I get an authentication `407` error with cygwin's git:
> 
> user > ~ > git config --get http.proxy
> https://:@evilcorp.proxy.com:8080
> user > ~ > git clone https://github.com/vim/vim
> Cloning into 'vim'...
> fatal: unable to access 'https://github.com/vim/vim/': Received
> HTTP code 407 from proxy after CONNECT
> 
> Setting the username and password in the proxy string does not change
> the result.
> 
> I have found this on the cywin mailing list which looks related to
> that problem 
> 
> http://thread.gmane.org/gmane.os.cygwin/155039
> 
> How can I fix that?

I think the Git commit someone has spotted in that thread is a red
herring: what you see from libCURL is it having chosen to go with
Negotiate (which is GSS-SPNEGO in disguise) and then failing to
actually find authentication mechanisms both your libCURL and the proxy
both support.  If that's a Windows proxy, I'm pretty sure the set of
the auth mechs it supports is either two -- NTLM and Kerberos, -- or
just one, Kerberos.

| * Read response immediately from proxy CONNECT
| < HTTP/1.1 407 authenticationrequired
| < Date: Wed, 20 Jan 2016 22:44:57 GMT
| < Content-Type: text/html
| < Cache-Control: no-cache
| < Content-Length: 18471
| < Proxy-Connection: Keep-Alive
| < Proxy-Authenticate: Negotiate
| * gss_init_sec_context() failed: : SPNEGO cannot find mechanisms to
| negotiate < Proxy-Authenticate: Basic realm="Web Gateway"
| <
| * Received HTTP code 407 from proxy after CONNECT
| * Expire cleared
| * Curl_done
| * Closing connection 0
| * The cache now contains 0 members
| fatal: unable to access 'https://github.com/Shougo/viproc.vim/':
| Received HTTP code 407 from proxy after CONNECT

On the one hand, your curl says it supports everything needed:

| Features: Debug IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM 
| NTLM_WB SSL libz TLS-SRP UnixSockets Metalink

But for some reason it fails negotiating.

I'd try to play with Cygwin's curl while having Wireshark capturing the
exchange: it has pretty good dissectors for SPNEGO, NTLMs and Kerberos,
so pretty every time I had to debug a problem with somethig like this,
I had success using Wireshark getting at the root of the problem.

You might as well compare the exchanges between the curl from GfW and
that one from Cygwin to spot the difference.

P.S.
Out of curiosity, why do you need Cygwin if there is Git for Windows?

-- 
You received this message because you are subscribed to the Google Groups "Git 
for human beings" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to git-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.