Subject: [BUG] Push fails with dumb http to SabreDAV

From: Abbaad Haider <[email-masked]>
Date: Sat, 5 Jul 2014 20:00:08 -0400

Background:
I'm trying to host a git repository at my Box.com account, which
offers DAV access using a server called SabreDAV. I ran into a few
issues along the way. The first is that Box.com apparently doesn't
like it if a directory has a dot in the name. No big deal, just use
"foo" instead of "foo.git" for a bare repository. Next, it gives 404
errors when you try to GET a URL with an extraneous query string.
Solution: use GIT_SMART_HTTP=0. Authentication is handled by libcurl
automatically reading .netrc. I've gotten to the point where I can
clone a repository, but pushing changes back to origin hangs followed
by timeout. I don't know if this bug is in git or libcurl, but I think
it's the former (as explained below).

Problem (see also attachment):
When you try to push changes to the remote, it hangs, followed by
erroring out with "code 52", which is CURLE_GOT_NOTHING. Further
investigation shows that cURL successfully uses basic authentication
to GET a few files before trying a PROPFIND request on the
repository's root directory. The body of the request is in a separate
XML file asking the server about the supportedlock property.

The first time, cURL sends the request without authentication and
receives back 401 Unauthorized. The second time it tries the same
request using Basic authentication (this is the same pattern which
worked on the earlier GET requests). It gets back a 100-Continue, but
fails to upload the XML file like it did before (if you're following
along on the typescript, the verbose cURL output should say "* We are
completely uploaded and fine"). Instead it hangs for 60 seconds and
errors out with "Empty reply from server".

I don't think this bug is in libcurl, since it successfully executes
all the other commands. I will try to investigate further, but I think
it has something to do with the multi-pass authentication. Attached is a
typescript of the behavior (editorial comments are placed inside [[ ]],
and all user info has been scrubbed). In case the attachment doesn't go
through, I have also pasted the typescript to gist [1]. If anyone else
wants to reproduce the bug, Box.com does offer a free account.

[1] https://gist.githubusercontent.com/abbaad/d4a8ba1e36000eeb8e02/raw/dd5b10ae42b1936d8da33bd384c9affdb103f686/typescript.txt

--
Abbaad Haider
[email-masked]