This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 258087 - Git SSL connection through Proxy fails
Summary: Git SSL connection through Proxy fails
Status: NEW
Alias: None
Product: platform
Classification: Unclassified
Component: Proxy (show other bugs)
Version: 8.1
Hardware: PC Windows 8.1
: P2 normal with 1 vote (vote)
Assignee: Libor Fischmeistr
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-02-21 22:50 UTC by bht
Modified: 2016-03-31 06:15 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Exception Reporter:


Attachments
messages.log (65.40 KB, application/octet-stream)
2016-02-21 22:50 UTC, bht
Details

Note You need to log in before you can comment on or make changes to this bug.
Description bht 2016-02-21 22:50:53 UTC
Created attachment 158587 [details]
messages.log

With a corporate proxy successfully configured in the IDE, I still cannot clone a repository, example https://github.com/Mashape/unirest-java.git.

I have read bug 245905 and added -J-Dgit.lib.proxyHttpTunneling=true to netbeans.conf. In proxy settings I have checked "Use the same proxy settings for all protocols" and "Proxy requires Explicit Authentication". I have not paid attention to "No Proxy hosts".

The proxy connection functions otherwise because I am able to upgrade the IDE over the internet flawlessly. Trying from another network without proxy works.

The error in the log is:

java.net.ConnectException: Connection time out: github.com
	at org.eclipse.jgit.util.HttpSupport.response(HttpSupport.java:174)
	at org.eclipse.jgit.transport.TransportHttp.connect(TransportHttp.java:475)
Caused: org.eclipse.jgit.errors.TransportException: https://github.com/Mashape/unirest-java.git: cannot open git-upload-pack

I am curious whether it would be possible for NetBeans to add some heuristics to dynamically analyze the problem so that in cases like mine, the next step, what to do to solve the problem becomes obvious. My motivation is that Netbeans is such a polished product that NetBeans should become the undisputed de facto tool of choice to get a dummy started.
Comment 1 Ondrej Vrabec 2016-02-22 07:00:46 UTC
(In reply to bht from comment #0)
> I have read bug 245905 and added -J-Dgit.lib.proxyHttpTunneling=true to
> netbeans.conf. In proxy settings I have checked "Use the same proxy settings
> for all protocols" and "Proxy requires Explicit Authentication". I have not
> paid attention to "No Proxy hosts".
Do you use proxy with authentication? Then I am afraid this would not work. SSH through proxy worked for me the last time I checked but never tried it with an authenticated proxy.

BTW, -J-Dgit.lib.proxyHttpTunneling=true is not the right way to go (it misuses your corporate HTTP proxy, but it should not be used that way). You should properly set up a socks proxy somewhere to make this fully work. Please make sure you have a working SOCKS proxy inside your corporate network. Plus such proxy should not need authentication. Thanks.
Comment 2 bht 2016-02-23 21:11:14 UTC
Thanks Ondrej for your helpful clarification. I have a few questions still:

If it does not work  with ssl over a firewall with password authentication, then this fact (1) might be documented somewhere, perhaps with a reference to a future action item that fixes it. We would want to know about it.

Can you imagine that the NetBeans IDE could provide clarification when encountering connection problems? I am thinking that perhaps the IDE attempts to make some successively more difficult connections, probing so to speak, how far it gets through the firewall, and make an assessment based on the result.

For example, if NetBeans can connect to some NetBeans resources such as the update server using different protocols, then perhaps try to connect to a NetBeans hosted git server, that would be helpful in eliminating frustration. Eventually, it might detect (1) and report it in the log and back to the user. Perhaps initiated by a connection test button, or in the background.

In this probing algorithm, knowledge accumulates through improvement of the algorithm itself and this would then allow to focus on the solution of the root cause problem.
Comment 3 bht 2016-02-26 00:20:57 UTC
NetBeans has in the "Advanced Proxy Options" the check box "Proxy Requires Explicit Authentication" which the user must check to run into this problem.

So perhaps in this case NetBeans can validate after the connection attempt using this information and show a panel with a URL pointing to a bug report on the web that indicates that this option may not be supported for GIT at this time until the bug is fixed.
Comment 4 Ondrej Vrabec 2016-03-18 14:27:15 UTC
A question to your setup. How do you connect if it does not work in NetBeans? Are you able to connect using commandline git tool? How do you connect to the repo normally?
Comment 5 bht 2016-03-21 08:47:05 UTC
Hi, in response to your question I can give the NetBeans team only a compliment. I don't know git at all. I trust NetBeans so much that I use it to learn many things :). But I will try to give an answer when I have time to experiment with command line git. The problem is that I do not have admin rights on that computer and that the network is what it is, well that is what this issue is about.
Comment 6 bht 2016-03-30 00:54:35 UTC
I installed a Windows git client from https://git-scm.com/download/win
PortableGit-2.8.0-64-bit.7z.exe

After basic configuration (path etc) I executed:

git config --global http.proxy http://proxyuser:proxypwd@proxy.server.com:8080

then 

git clone https://github.com/Mashape/unirest-java.git
Cloning into 'unirest-java'...
remote: Counting objects: 3875, done.
remote: Compressing objects: 100% (2/2), done.
emote: Total 3875 (delta 0), reused 0 (delta 0), pack-reused 3873
Receiving objects: 100% (3875/3875), 601.83 KiB | 436.00 KiB/s, done.
Resolving deltas: 100% (1181/1181), done.
Checking connectivity... done.

So this works.

Could NetBeans implement the suggested scheme which I would call "validate after failure", to identify the problem and suggest a solution?

Another useful piece of information might be the following: While NetBeans can connect to the update server and download and install updates (apparently using the configured proxy), it cannot upload bug reports automatically. I haven't created a bug for this yet.
Comment 7 Ondrej Vrabec 2016-03-30 04:52:44 UTC
(In reply to bht from comment #6)
Sorry, I have only just now realized you're talking about SSL over https protocol, I don't know why but I had been thinking all the time you're talking about SSH - which does not work generally over proxy.
Your connection should work out-of-the box, as long as you correctly fill in the proxy details in NB. I will shortly make a screenshot of my settings which generally works over proxy.
Comment 8 Ondrej Vrabec 2016-03-30 10:14:37 UTC
Connecting over https to github works fine for me in my office (behind a corporate proxy). It should work for you as well, if not I expect there is some problem with the proxy support I do not see right now.

There is "<local>" among the non-proxy hosts, could you please remove it and add "localhost, 127.0.0.1" instead? Does that make any difference?

Can you debug NetBeans? If you have done it before, could you debug URL.openConnection and HttpURLConnection.getResponseCode and let us know if URL.openConnection opens the connection to the proxy and at what place (with what message) the exception is thrown (in HttpURLConnection.getResponseCode)?
Comment 9 bht 2016-03-30 21:45:44 UTC
I have removed "<local>" from the non-proxy hosts, "localhost, 127.0.0.1" already existed - no success.

I cannot build NetBeans and debug this as suggested.

Seriously, would you please consider my previous suggestion to take NetBeans IDE to the next level and let it analyse the problem programmatically. To have the human factor play a major role in this critical area is just no longer acceptable. As the next step I would suggest that you add code to the daily build so we can use this to analyze the problem at my end. As I wrote earlier, the idea is that NetBeans should probe network connectivity using known resources on the internet. The code that you build now would be the foundation of that new functionality.
Comment 10 bht 2016-03-30 22:26:46 UTC
It looks like there is a problem with the non-proxy hosts string which does not affect all tools. You could use the string that you can get from the attached log file and experiment with it until git breaks at your end. In other words, I would expect that adding that whole string to your configuration breaks git. 

It is typical that in a corporate environment, this string, copied from some browser setting that is generated by a logon script somehow, accumulates some garbage over time. So perhaps NetBeans could validate it or outright replace it for the current connection. Some creativity in this area is certainly useful.
Comment 11 Ondrej Vrabec 2016-03-31 06:15:01 UTC
Libore, can you look at this? Seems to be a proxy issue. See especially comment #10