Please use the Apache issue tracking system for new NetBeans issues (https://issues.apache.org/jira/projects/NETBEANS0/issues) !!

Bug 245905

Summary: Enable ssh proxy support for git
Product: versioncontrol Reporter: wvreeven <wvreeven>
Component: GitAssignee: Ondrej Vrabec <ovrabec>
Status: RESOLVED FIXED QA Contact: issues <issues.netbeans.org>
Priority: P2 CC: git
Version: 8.0   
Target Milestone: 8.1   
Hardware: PC   
OS: Linux   
Whiteboard:
Issue Type: ENHANCEMENT Exception Report:
Attachments: Netbeans messages.log file
Messages.log file from 2015-03-05

Description wvreeven 2014-07-23 07:58:28 UTC
In my work environment I am using git via ssh and I am behind a firewall that blocks outgoing ssh connections. When I am trying to use git via ssh to connect to a remote repository, the connection is refused by the firewall. I have set up a SOCKS 5 proxy, but Netbeans is unable to use it giving the error

ProxyHTTP: java.io.IOException

Using OpenSSH from the command line I can connect to the remote repository using the command line option

-o ProxyCommand='nc -X 5 -x localhost:18444 %h %p'

Please make sure Netbeans can use this too.
Comment 1 Ondrej Vrabec 2014-07-28 13:38:35 UTC
This works in general. Tools -> Options -> General allows you to set proxy, so choose manual, set proxy host and in More... setup the proxy for all protocols (especially SOCKS). Then try to clone.
Note that setting proxy in commandline has no effect because NetBeans does not use CLI git client.
I am behind a corporate proxy and can connect to github over ssh this way. The only thing that does not work is connecting over a proxy that requires credentials.
Comment 2 wvreeven 2014-07-28 14:37:11 UTC
Thanks for the reply and elaborate explanation. It still doesn't work for me. Maybe I should make myself clearer.

First of all, I have set up the proxy configuration In Netbeans as you describe. However, I am not using a proxy that allows HTTP and other protocols. I am using a SOCKS 5 only proxy. I have set up this proxy by creating an ssh connection to my remote host as follows

ssh -D 9999 <remote host>

This creates a SOCKS 5 proxy that can be used by any application as a tunnel through the firewall. I can use this e.g. with Firefox, Chrome, Squirrel SQL, Eclipse, but not with git in Netbeans. When I use git from the command line, I can use this SOCKS 5 proxy perfectly ok.

When I use the "Test connection" button in the Tools -> Options -> General window, this error message is displayed

Unexpected end of file from server

which makes sense, cause a SOCKS 5 proxy is not an HTTP proxy. 

Secondly, I discovered that I provided the wrong proxy port. Sorry for the confusion. However, when I specify the correct one, I get this reply

ProxyHTTP: com.jcraft.jsch.JSchException: java.net.SocketException: Malformed reply from SOCKS server

This means that Netbeans only supports SOCKS 4 and not SOCKS 5. Please make sure Netbeans (also) supports SOCKS 5 proxies.
Comment 3 Ondrej Vrabec 2014-08-27 14:34:02 UTC
well, in NetBeans the default proxy for SSH is HTTP proxy with ssh tunneling. To be honest i don't know much about proxies, so i have no idea what should be the default or how to find out what kind should be used (SOCKS4, SOCKS5 or HTTP).
For start i might be able at least to setup s commandline switch you can provide as a hint to NetBeans
Comment 4 Ondrej Vrabec 2014-08-27 15:15:49 UTC
fix: http://hg.netbeans.org/core-main/rev/d2626fc22821
Comment 5 Quality Engineering 2014-08-28 02:39:32 UTC
Integrated into 'main-silver', will be available in build *201408280001* on http://bits.netbeans.org/dev/nightly/ (upload may still be in progress)

Changeset: http://hg.netbeans.org/main-silver/rev/d2626fc22821
User: Ondrej Vrabec <ovrabec@netbeans.org>
Log: #245905 - Enable ssh proxy support for git
Correctly using SOCKS5 proxy as default. Leaving HTTPS_PROXY tunneling on a commandline switch.
Comment 6 wvreeven 2014-09-02 09:18:07 UTC
I downloaded the latest nightly snapshot (netbeans-trunk-nightly-201409020001-javaee-linux.sh) and I have troubles testing the implementation. 

Where am I supposed to set the git.lib.proxyHttpTunneling boolean exactly?

According to your code changes, I am supposed to set the value of this boolean to FALSE. What is the default value of this boolean? If it is FALSE (as I expect) then I shouldn't have to set anything, right?

Apart from this, I think I may have opened this issue in the wrong section. The only way to set the proxy settings is via the global proxy settings for Netbeans and this affects more than git. Can you confirm this is the case? If yes, I'll close this issue and will open a new one in a different section.
Comment 7 Ondrej Vrabec 2014-09-02 09:28:40 UTC
(In reply to wvreeven from comment #6)
> Where am I supposed to set the git.lib.proxyHttpTunneling boolean exactly?
Nowhere.
> According to your code changes, I am supposed to set the value of this
> boolean to FALSE. What is the default value of this boolean? If it is FALSE
> (as I expect) then I shouldn't have to set anything, right?
Exactly, it is set to false and you do not set any property.
> Apart from this, I think I may have opened this issue in the wrong section.
> The only way to set the proxy settings is via the global proxy settings for
> Netbeans and this affects more than git. Can you confirm this is the case?
> If yes, I'll close this issue and will open a new one in a different section.
Yes, Git uses whatever is set in Tools -> Options in the Proxy settings. You are supposed to set "SOCKS Proxy" to whatever you use as a proxy. So you should open Manual Proxy Settings and set the SOCKS proxy to "localhost", port 18444 (i think that's your proxy port).
Comment 8 wvreeven 2014-09-02 12:08:27 UTC
Thanks for the quick reply. In that case, it doesn't work. When I select Git -> Remote -> Push to Upstream a popup is shown with the message

ProxySOCKS5: com.jcraft.jsch.JSchException: java.net.SocketException: Malformed reply from SOCKS server
Comment 9 Ondrej Vrabec 2014-09-02 12:19:51 UTC
> ProxySOCKS5: com.jcraft.jsch.JSchException: java.net.SocketException: Malformed reply from SOCKS server
Well in that case i cannot help you. JSch is trying to connect to the proxy (as you can see, now it expects SOCKS5). If it does not work and you're sure its address is correct then there must be problem either in JSch or on your proxy.
Can you at least attach the full IDE log with the error?
Comment 10 wvreeven 2014-09-02 12:29:32 UTC
Created attachment 149000 [details]
Netbeans messages.log file

As requested I attach the messages.log file. Please let me know if you need other files or more info.
Comment 11 wvreeven 2014-09-08 07:26:51 UTC
I did some more testing and this seems to be an issue in git only. When I specify the settings for my SOCKS5 proxy in the NetBeans preferences and I do *NOT* start the proxy, the NetBeans Start Page contents fail to load. When I do start the proxy, the contents load perfectly ok.

I had another look at the man page of OpenSSH and it turns out that OpenSSH supports both SOCKS4 and SOCKS5. However, when I set up the proxy and try to do a remote push, I still get this error:

ProxySOCKS5: com.jcraft.jsch.JSchException: java.net.SocketException: Malformed reply from SOCKS server

Did the logs I made available to you give you any more insight in this error?
Comment 12 Ondrej Vrabec 2015-03-03 14:33:28 UTC
For me this works:
1) ssh -D 9999 TARGET_MACHINE   run in shell
2) in NetBeans Tools -> Options -> General, select Manual proxy settings -> click on More
3) HTTP Proxy set to localhost/9999, check Use the same proxy settings for all protocols
4) Set No Proxy Hosts to "localhost, ..."

Now i am able to clone a repository from another repository
Did you forget to exclude localhost from proxy connections? If i remove it from No Proxy Hosts, i'm getting:
ProxySOCKS5: com.jcraft.jsch.JSchException: java.net.SocketException: Malformed reply from SOCKS server
logged into console.
Comment 13 wvreeven 2015-03-04 21:13:48 UTC
Many thanks for getting back to this!

I tried your instructions from home, where I don't need a proxy. First I tried to pull via ssh from a repository I have on another machine in my home network and that worked just fine. Then I opened an ssh connection using the -D option from the command line and I comfigured the proxy settings as you suggested. Then, when I try to pull, I see the message

Incorrect credentials for repository at <host>/<repo>

When I look in the Netbeans messages.log, I see this stack trace pasted below. I get this stack trace regardless of whether I am using a key or a password.

INFO [org.netbeans.modules.git]: <user>@<host>:<repo>: ProxyHTTP: java.io.IOException
java.io.IOException
	at com.jcraft.jsch.ProxyHTTP.connect(ProxyHTTP.java:107)
Caused: com.jcraft.jsch.JSchException: ProxyHTTP
	at com.jcraft.jsch.ProxyHTTP.connect(ProxyHTTP.java:158)
	at com.jcraft.jsch.Session.connect(Session.java:210)
	at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:116)
Caused: org.eclipse.jgit.errors.TransportException: <user>@<host>:<repo>: ProxyHTTP: java.io.IOException
	at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:159)
	at org.netbeans.libs.git.jgit.JGitSshSessionFactory.getSession(JGitSshSessionFactory.java:125)
	at org.eclipse.jgit.transport.SshTransport.getSession(SshTransport.java:121)
	at org.eclipse.jgit.transport.TransportGitSsh$SshFetchConnection.<init>(TransportGitSsh.java:248)
	at org.eclipse.jgit.transport.TransportGitSsh.openFetch(TransportGitSsh.java:147)
	at org.netbeans.libs.git.jgit.commands.ListRemoteObjectsCommand.runTransportCommand(ListRemoteObjectsCommand.java:74)
Caused: org.netbeans.libs.git.GitException$AuthorizationException: <user>@<host>:<repo>: ProxyHTTP: java.io.IOException
	at org.netbeans.libs.git.jgit.commands.TransportCommand.handleException(TransportCommand.java:256)
	at org.netbeans.libs.git.jgit.commands.ListRemoteObjectsCommand.runTransportCommand(ListRemoteObjectsCommand.java:87)
	at org.netbeans.libs.git.jgit.commands.TransportCommand.run(TransportCommand.java:191)
	at org.netbeans.libs.git.jgit.commands.GitCommand$1.run(GitCommand.java:80)
	at org.netbeans.libs.git.jgit.commands.GitCommand$1.run(GitCommand.java:77)
	at java.security.AccessController.doPrivileged(Native Method)
	at org.netbeans.libs.git.jgit.commands.GitCommand.execute(GitCommand.java:77)
	at org.netbeans.libs.git.GitClient.listRemoteBranches(GitClient.java:861)
	at org.netbeans.modules.git.client.GitClient$35.call(GitClient.java:589)
	at org.netbeans.modules.git.client.GitClient$35.call(GitClient.java:585)
	at org.openide.util.NetworkSettings.suppressAuthenticationDialog(NetworkSettings.java:140)
	at org.netbeans.modules.git.client.GitClient$CommandInvoker$1$1.call(GitClient.java:885)
	at org.netbeans.modules.git.client.GitClient$CommandInvoker$1.call(GitClient.java:906)
	at org.netbeans.modules.git.client.GitClient$CommandInvoker.runMethodIntern(GitClient.java:918)
	at org.netbeans.modules.git.client.GitClient$CommandInvoker.runMethod(GitClient.java:851)
	at org.netbeans.modules.git.client.GitClient$CommandInvoker.runMethod(GitClient.java:829)
	at org.netbeans.modules.git.client.GitClient$CommandInvoker.access$400(GitClient.java:823)
	at org.netbeans.modules.git.client.GitClient.listRemoteBranches(GitClient.java:585)
[catch] at org.netbeans.modules.git.ui.clone.RepositoryStep$RepositoryStepProgressSupport.perform(RepositoryStep.java:325)
	at org.netbeans.modules.git.client.GitProgressSupport.performIntern(GitProgressSupport.java:114)
	at org.netbeans.modules.git.client.GitProgressSupport.run(GitProgressSupport.java:107)
	at org.openide.util.RequestProcessor$Task.run(RequestProcessor.java:1423)
	at org.openide.util.RequestProcessor$Processor.run(RequestProcessor.java:2033)
Comment 14 Ondrej Vrabec 2015-03-05 07:53:26 UTC
What urprises me about the exception you posted is:
> ProxyHTTP: java.io.IOException
It should not try to attempt to connect via a HTTP proxy. On my machine it gets through SOCKS5 proy. Only if i run the IDE with -J-Dgit.lib.proxyHttpTunneling=true does it ends in the HTTP proxy and fails on the same line as for you. You're not using that switch are you?

Are you trying the latest dev build? Can you also please attach the IDE log one more time? I would like to check your setup again.
Comment 15 wvreeven 2015-03-05 08:12:00 UTC
Yeah I noticed the "ProxyHTTP: java.io.IOException" bit as well. I am not using the -J-Dgit.lib.proxyHttpTunneling=true switch so I don't know why this is happening. I am using the 8.0.2 release of Netbeans. And see the second attachment for the latest messages.log file.
Comment 16 wvreeven 2015-03-05 08:12:38 UTC
Created attachment 152404 [details]
Messages.log file from 2015-03-05
Comment 17 Ondrej Vrabec 2015-03-05 09:20:15 UTC
(In reply to wvreeven from comment #15)
> I am using the 8.0.2 release of Netbeans. And see the
> second attachment for the latest messages.log file.
Could you please download and try it in a dev build? My fix for this issue is not in 8.0.2, it will be part of 8.1.
http://bits.netbeans.org/download/trunk/nightly/latest/

1) download and install the dev build
2) start and setup the proxy the same way as in Comment #12
3) try git pull/fetch
4) attach any exception logged during the connect attempt
Comment 18 wvreeven 2015-03-05 09:59:32 UTC
With the dev build cloning works fine. Thanks a lot!!!
Comment 19 Ondrej Vrabec 2015-03-05 10:02:30 UTC
(In reply to wvreeven from comment #18)
> With the dev build cloning works fine. Thanks a lot!!!
Good to hear it.
Comment 20 ekubovsky 2015-03-26 18:15:12 UTC
Hello!

Had a similar issue. The error message was:
ProxyHTTP: com.jcraft.jsch.JSchException: java.net.SocketException: Malformed reply from SOCKS server

My system's configuration:
Product Version: NetBeans IDE 8.0.2 (Build 201411181905)
Updates: NetBeans IDE is updated to version NetBeans 8.0.2 Patch 1
Java: 1.8.0_25; Java HotSpot(TM) 64-Bit Server VM 25.25-b02
Runtime: Java(TM) SE Runtime Environment 1.8.0_25-b18
System: Windows 7 version 6.1 running on amd64; Cp1252; en_US (nb)

Our git server uses gitosis to control access credentials. 
That means we connect to git using our SSH keys...

I was able to workaround the issue by simply adding the git server address to "No Proxy Hosts" list. That's it.

Thanks!
By use of this website, you agree to the NetBeans Policies and Terms of Use. © 2014, Oracle Corporation and/or its affiliates. Sponsored by Oracle logo