Configuration to use Mercurial with Bitbucket due to certificate rewriting proxy?

Question

I am trying to access BitBucket from work. The only access to the Internet is through an authentication HTTP proxy, which proxies HTTP on port 8080 and SSL on port 8070. This proxy server conducts a man-in-the-middle attack on SSL connections, browsers can only create HTTPS connections to the Internet from -for installing a fake Websense certificate for all customers.

I can connect to BitBucket using Git, but not using Mercurial. I am using Mercurial version 2.0.2.

With Git, I use the following configuration in .gitconfig

[user] name = Firstname Lastname email = [e-mail] [http] proxy = http://name: [e-mail] :8080 

And can clone the repository with the following command

 D:\MercurialTesting>git clone http:// [e-mail] /Firstname_Lastname/bb102repo.git test1 Cloning into 'test1'... Password for 'bitbucket.org': remote: Counting objects: 3, done. remote: Total 3 (delta 0), reused 0 (delta 0) Unpacking objects: 100% (3/3), done. D:\MercurialTesting> 

With the addition of this configuration setting

 [http] sslverify = false 

I can also clone the repository via https url https: // [e-mail] /Firstname_Lastname/bb102repo.git

Using Mercurial, although this is a different story. Using the following configuration in mercurial.ini

 [http_proxy] host = nnn.nnn.nnn.nnn:8080 user = [e-mail] passwd = password 

Mercurial will access my own Mercurial server at home without any problems.

 D:\MercurialTesting>hg --debug clone http://nnn.nnn.nnn.nnn/hg/Workspaces/Test1 using http://nnn.nnn.nnn.nnn/hg/Workspaces/Test1 proxying through http://nnn.nnn.nnn.nnn:8080 sending capabilities command http authorization required realm: Mercurial Repositories user: username password: http auth: user username, password ******* destination directory: Test1 query 1; heads sending batch command http auth: user username, password ******* requesting all changes sending getbundle command http auth: user username, password ******* adding changesets changesets: 1 chunks add changeset 711ff2c6f5b2 changesets: 2 chunks add changeset 9034b963b4c1 . . . 

Using the same configuration and trying to access BitBucket through Mercurial, it just hangs.

 D:\MercurialTesting>hg --debug clone http://bitbucket.org/Firstname_Lastname/bb101repo using http://bitbucket.org/Firstname_Lastname/bb101repo proxying through http://nnn.nnn.nnn.nnn:8080 sending capabilities command abort: error: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond D:\MercurialTesting> 

Using the same configuration with SSL through the url https://bitbucket.org/Firstname_Lastname/bb101repo Mercurial hangs exactly the same. During this process, Wireshark does not detect network activity at all.

Changing the settings in Mercurial.ini to match the port through which the proxy server serves SSL is not affected. Setting the http_proxy environment variable does not matter, but setting the https_proxy environment variable completely changes the output. Setting https_proxy and adding --insecure to the hg command invokes:

 D:\MercurialTesting>hg --debug clone http://bitbucket.org/Firstname_Lastname/bb101repo --insecure using http://bitbucket.org/Firstname_Lastname/bb101repo proxying through http://nnn.nnn.nnn.nnn:8080 sending capabilities command warning: bitbucket.org certificate with fingerprint 79:ce:0d:30:b0:17:29:6a:d1:9f:dd:d3:62:80:70:28:5e:9f:c2:e3 not verified (check hostfingerprints or web.cacerts config setting) http authorization required realm: Bitbucket.org HTTP user: Firstname_Lastname password: http auth: user Firstname_Lastname, password *** warning: bitbucket.org certificate with fingerprint 79:ce:0d:30:b0:17:29:6a:d1:9f:dd:d3:62:80:70:28:5e:9f:c2:e3 not verified (check hostfingerprints or web.cacerts config setting) abort: HTTP Error 502: Success D:\MercurialTesting> 

And now Wireshark detects the exchange between my workstation and the proxy server. What I find most confusing is that nothing changes the fact that I set https_proxy, hg always uses the http proxy parameter from Mercurial.ini and produces the same output above, regardless of whether I set the https_proxy to the correct data for SSL proxy or complete trash. The only difference is that if the https_proxy environment variable is not set at all, then hg just freezes, as described above.

The formats for https_proxy that I tried include all the options:

 https_proxy=ip.ip.ip.ip:8070 https_proxy=ip.ip.ip.ip:8080 https_proxy=username: [e-mail] :8070 https_proxy=username: [e-mail] :8080 https_proxy=http://ip.ip.ip.ip:8070 https_proxy=http://ip.ip.ip.ip:8080 https_proxy=http://username: [e-mail] :8070 https_proxy=http://username: [e-mail] :8080 

The results are the same no matter what I installed it on.

So the questions I could really help with are:

Why can I access my Mercurial repositories at home, but not on BitBucket?

Why can I access BitBucket using Git, but not with Mercurial, using the same configuration?

Does anyone have any ideas how I can make this work, or what can I check next?

Answer 1

I also connect through a proxy to bitbucket. Since my settings did not work as expected, I found this SO entry.

I noticed that if I use command line options then everything works.

hg --config http_proxy.host=192.168.1.1:8080 --config http_proxy.user=Vad1mo --config http_proxy.passwd=secret clone https://bitbucket.org/Vadimo/test

On the other hand, the same entries in Mercurial.ini did not work.

 [http_proxy] host = 192.168.1.1 port = 8080 user = Vad1mo passwd = internet 

By chance, I discovered a tiny difference between CMD and ini. In CMD, the port is sent to the host. In the ini file, this is a new entry.

Changing mercurial.ini for the host postfix for the host, as on the command line, solved the problem.

 [http_proxy] host = 192.168.1.1:8080 ;port = 8080 user = Vad1mo passwd = internet 

Perhaps this will also help you.

by the way. my hg version is 2.6.3

Answer 2

I ran into a similar problem with my proxy product - in fact, almost identical.

I still circumvented the issue by setting http_proxy in mercurial.ini and then connecting to BitBucket via my hg.io http address.

For example, my repository at https://bitbucket.org/mattgwagner/mattgwagner.com can be accessed through http://hg.io/mattgwagner/mattgwagner.com . Of course, this will send your password and connection in text form, but at least it allows me to connect.

This has become more useful to me when you use open source projects hosted on BitBucket for my use.

Mercurial.ini
[Http_proxy] host = 192.168.1.155:8080
no =
user = domainUsername
passwd = pass

Answer 3

Can you ssh go out? Bitbucket supports ssh access, and your proxy server wonders if it is allowed.