Question

I’m trying access our TFS server when VPN’d from home but it only gives me the following message:

Connecting to TFS...
git-tf: Permission denied: connect

I’m using a fully qualified URL and everything else works just fine over the VPN. Are there any authentication config settings I could try? I can’t find mention of anything online anywhere.

And of course when I’m in the office it works just fine.

EDIT – Stack trace from logs

2012-10-12 10:07:31,231 INFO  [main] (com.microsoft.tfs.core.config.httpclient.DefaultHTTPClientFactory) HttpClient configured for http://svrtfs2010.ms.innovativesol.com:8080/tfs/DefaultCollection, authenticating as innovative/jrusso
2012-10-12 10:07:31,535 INFO  [main] (com.microsoft.tfs.core.httpclient.HttpMethodDirector) I/O exception (java.net.SocketException) caught when processing request: Permission denied: connect
2012-10-12 10:07:31,535 INFO  [main] (com.microsoft.tfs.core.httpclient.HttpMethodDirector) Retrying request
2012-10-12 10:07:31,535 INFO  [main] (com.microsoft.tfs.core.httpclient.HttpMethodDirector) I/O exception (java.net.SocketException) caught when processing request: Permission denied: connect
2012-10-12 10:07:31,535 INFO  [main] (com.microsoft.tfs.core.httpclient.HttpMethodDirector) Retrying request
2012-10-12 10:07:31,535 INFO  [main] (com.microsoft.tfs.core.httpclient.HttpMethodDirector) I/O exception (java.net.SocketException) caught when processing request: Permission denied: connect
2012-10-12 10:07:31,535 INFO  [main] (com.microsoft.tfs.core.httpclient.HttpMethodDirector) Retrying request
2012-10-12 10:07:31,544 WARN  [main] (git-tf) Error executing command: pull --deep --rebase
com.microsoft.tfs.core.exceptions.TECoreException: Permission denied: connect
    at com.microsoft.tfs.core.exceptions.mappers.TECoreExceptionMapper.map(TECoreExceptionMapper.java:99)
    at com.microsoft.tfs.core.exceptions.mappers.LocationExceptionMapper.map(LocationExceptionMapper.java:32)
    at com.microsoft.tfs.core.clients.framework.location.internal.LocationWebServiceProxy.connect(LocationWebServiceProxy.java:76)
    at com.microsoft.tfs.core.clients.framework.location.LocationService.connect(LocationService.java:754)
    at com.microsoft.tfs.core.clients.framework.location.LocationService.ensureConnected(LocationService.java:884)
    at com.microsoft.tfs.core.clients.framework.location.LocationService.ensureAuthenticated(LocationService.java:923)
    at com.microsoft.tfs.core.TFSConnection.ensureAuthenticated(TFSConnection.java:739)
    at com.microsoft.gittf.client.clc.commands.framework.Command.getConnection(Command.java:354)
    at com.microsoft.gittf.client.clc.commands.framework.Command.getConnection(Command.java:326)
    at com.microsoft.gittf.client.clc.commands.framework.Command.getVersionControlClient(Command.java:474)
    at com.microsoft.gittf.client.clc.commands.framework.Command.getVersionControlService(Command.java:492)
    at com.microsoft.gittf.client.clc.commands.PullCommand.run(PullCommand.java:140)
    at com.microsoft.gittf.client.clc.Main.main(Main.java:319)
Caused by: com.microsoft.tfs.core.ws.runtime.exceptions.TransportException: Permission denied: connect
    at com.microsoft.tfs.core.ws.runtime.client.SOAPService.executeSOAPRequestInternal(SOAPService.java:744)
    at com.microsoft.tfs.core.ws.runtime.client.SOAPService.executeSOAPRequest(SOAPService.java:473)
    at ms.ws._LocationWebServiceSoap12Service.connect(_LocationWebServiceSoap12Service.java:384)
    at com.microsoft.tfs.core.clients.framework.location.internal.LocationWebServiceProxy.connect(LocationWebServiceProxy.java:70)
    ... 10 more
Caused by: java.net.SocketException: Permission denied: connect
    at java.net.DualStackPlainSocketImpl.waitForConnect(Native Method)
    at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
    at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
    at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
    at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
    at java.net.PlainSocketImpl.connect(Unknown Source)
    at java.net.SocksSocketImpl.connect(Unknown Source)
    at java.net.Socket.connect(Unknown Source)
    at com.microsoft.tfs.core.httpclient.protocol.DefaultProtocolSocketFactory.createSocket(DefaultProtocolSocketFactory.java:147)
    at com.microsoft.tfs.core.httpclient.HttpConnection.open(HttpConnection.java:862)
    at com.microsoft.tfs.core.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.open(MultiThreadedHttpConnectionManager.java:1690)
    at com.microsoft.tfs.core.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:495)
    at com.microsoft.tfs.core.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:197)
    at com.microsoft.tfs.core.httpclient.HttpClient.executeMethod(HttpClient.java:464)
    at com.microsoft.tfs.core.httpclient.HttpClient.executeMethod(HttpClient.java:376)
    at com.microsoft.tfs.core.ws.runtime.client.SOAPService.executeSOAPRequestInternal(SOAPService.java:588)
    ... 13 more

Answer 1

This is related to Java bug 703177. Java 7 brings IPv6 support, and Cisco’s VPN client reportedly rejects IPv6 traffic. You can force Java to use IPv4 as its transit with the java.net.preferIPv4Stack system property.

You will need to edit the git-tf launcher scripts that start the JVM in order to do this. You can add the -Djava.net.preferIPv4Stack=true argument to the launch line in both git-tf and git-tf.cmd.

The last lines of git-tf should be:

exec java -Xmx512m -classpath "$GITTF_CLASSPATH" \
    "-Dcom.microsoft.tfs.jni.native.base-directory=$BASE_DIRECTORY/native" \
    -Djava.net.preferIPv4Stack=true \
    com.microsoft.gittf.client.clc.Main "$@"

The 47th line of git-tf.cmd should be:

java -ea -Xmx512M -cp %GITTF_CLASSPATH% "-Dcom.microsoft.tfs.jni.native.base-directory=%BASE_DIRECTORY%native" -Djava.net.preferIPv4Stack=true com.microsoft.gittf.client.clc.Main %*