Hi there, Many open source projects provide access to their source code via remote cvs (usually pserver). Unfortunately, many people are prevented from using these facilities because they are behind firewalls which prevent uncontrolled tcp access outside of their LAN. However, this is also often the case for things like HTTPS and so Netscape have defined a way of circumventing these restrictions by tunnelling connections through HTTP. See http://home.netscape.com/newsref/std/tunneling_ssl.html. This facility can easily be added to cvs and the attached patch achieves this. To use the proxy www on port 8080 to connect to the external machine there.somedomain use: cvs -d :pserver;proxy=www;proxyport=8080:me＠there.somedomain:/somerepository The patch includes Jim Kingdon's port patch as many web servers restrict the use of CONNECT to well known ports. A way of circumventing this is to make a cvs server listen on one of these ports - for instance 443 the HTTPS port. To access a server set up in this way do: cvs -d :pserver;proxy=www;proxyport=8080;port=443:me＠there.somedomain:/somerepository The patch was inspired by ssh-tunnel.pl written by Urban Kaveus <urban(a)statt.ericsson.se&gt;. It adheres to HACKING so I hope it can be incorporated in the main development tree. andy ------------------------------------------------------------------------ Name: tunnel.patch tunnel.patch Type: Plain Text (text/plain) Encoding: quoted-printable ------------------------------------------------------------------------ --------------------------------------------------------------------------- " .sigs are like your face - rarely seen by you and uglier than you think" Dr Andy Piper, Technical Architect, Parallax Solutions Ltd mail: andyp(a)parallax.co.uk web: www.parallax.co.uk/~andyp

I have to wonder, living behind a corporate firewall myself at my day-job, how the person in charge of security would feel about this clever tunneling. Why is asking the company security guru to allow outbound connections to TCP port 443 not the right solution to this problem? Wriggling under the firewall might buy you some short term gain--- but it might also get you fired.

> Netscape have defined a way of circumventing these restrictions by > tunnelling connections through HTTP. See That makes a lot of sense (especially if the HTTP server does authentication, which I don't see any support for in your patch).

I've added your patch to http://www.cyclic.com/cvs/dev-net.html

> http://home.netscape.com/newsref/std/tunneling_ssl.html. When I try to access this URL, I get "file not found".

Well, there are lots of things to think about before then (for example, whether there are other ways to interface this kind of functionality to the CVS client, such as port forwarding). But sending in the patch and getting it on our web page is a good first step. I'd encourage people who need this to try out the patched CVS and provide feedback.