Arch Linux

Scifi

Member

Registered: 2010-02-15

Posts: 3

Handshake issues with apache + subversion + ssl

I have a server running subversion with apache. I started to have some issues with handshakes after an upgrade to openssl 1.0.0.
The weird thing seems to be that the repository seems to work for some setups, like my desktop for example, but the server itself cant seem to get the handshakes right, same thing for my laptop running windows and tortoise svn, my friend with a same version of tortoise svn on the other hand can checkout just fine.

The exact error goes: SSL handshake failed: SSL errorcode -1/1/336032856
or
SSL handshake failed: SSL error: A TLS warning alert has been received.

Here is one succesful and one failed attemp from my /var/log/httpd/error_log (with debug level logging)

[Succesfull]
[Wed Apr 14 22:51:03 2010] [info] Seeding PRNG with 144 bytes of entropy
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1866): OpenSSL: Handshake: start
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: before/accept initialization
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_io.c(1882): OpenSSL: read 11/11 bytes from BIO#23bb1d0 [mem: 24da8b0] (BIO dump follows)
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_io.c(1815): +-------------------------------------------------------------------------+
[The key visualization]
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_io.c(1860): +-------------------------------------------------------------------------+
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 read client hello A
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write server hello A
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write certificate A
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1274): [client 84.250.172.144] handing out temporary 1024 bit DH key
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write key exchange A
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write server done A
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 flush data
[Wed Apr 14 22:51:03 2010] [debug] ssl_engine_io.c(1882): OpenSSL: read 5/5 bytes from BIO#23bb1d0 [mem: 24da8b3] (BIO dump follows) <-- succes here

[Failure]
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1866): OpenSSL: Handshake: start
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: before/accept initialization
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_io.c(1882): OpenSSL: read 11/11 bytes from BIO#24ccb40 [mem: 24da8b0] (BIO dump follows)
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_io.c(1815): +-------------------------------------------------------------------------+
[Key visualization]
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_io.c(1860): +-------------------------------------------------------------------------+
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1993): [client 192.168.0.150] No matching SSL virtual host for servername 192.168.0.150 found (using defau$
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1884): OpenSSL: Write: SSLv3 read client hello C
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 read client hello A
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write server hello A
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write certificate A
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1274): [client 192.168.0.150] handing out temporary 1024 bit DH key
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write key exchange A
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 write server done A
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: SSLv3 flush data
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_io.c(1893): OpenSSL: I/O error, 5 bytes expected to read on BIO#24ccb40 [mem: 24da8b3] <-- something goes wrong here
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1903): OpenSSL: Exit: error in SSLv3 read client certificate A
[Wed Apr 14 23:09:37 2010] [debug] ssl_engine_kernel.c(1903): OpenSSL: Exit: error in SSLv3 read client certificate A
[Wed Apr 14 23:09:37 2010] [info] [client 192.168.0.150] (104)Connection reset by peer: SSL handshake interrupted by system [Hint: Stop button pressed in browser$
[Wed Apr 14 23:09:37 2010] [info] [client 192.168.0.150] Connection closed to child 3 with abortive shutdown (server www.example.com:443)

Even if client has the same open sll version doesn't realy seem to guarantee a succes.
I would like to know if anyone has idea what could be causing this? or is it possible to maby use some different package for apaches ssl encryption? or possibly just temporarily turn of the ssl somehow?

Thank you for your time.

CronLogic

Member

Registered: 2010-01-13

Posts: 6

Re: Handshake issues with apache + subversion + ssl

I am having the exact same issue...

reeter

Member

Registered: 2010-06-06

Posts: 1

Re: Handshake issues with apache + subversion + ssl

Have you found any clue for this problem ? I have the same one, between my archlinux svn server, and a Windows tortoise svn client...

eirikst

Member

Registered: 2010-06-15

Posts: 3

Re: Handshake issues with apache + subversion + ssl

I have the same problem from gentoo to my arch server.
I'm not sure what causes the problem but found a workaround.

On the client side, try to add this to your .subversion/servers

[global]
http-library = serf

I guess the problem is probably caused by neon combined with a bad ssl certificate on the server side.
My neon version is 0.29.3

Last edited by eirikst (2010-06-15 22:45:46)

jryarch

Member

Registered: 2008-06-09

Posts: 45

Re: Handshake issues with apache + subversion + ssl

Hi, having the same problem right now.. Is there any more info available about this problem? Are only some experiencing this? I don't know what is causing the problem and what I can do about it..

toffyrn

Member

Registered: 2008-10-07

Posts: 221

Re: Handshake issues with apache + subversion + ssl

I have the same problem, when trying to use svn from red hat or ubuntu which is using lower versions of openssl.

With my arch-pc's (openssl 1.0.0a) there is no problem.

Has anyone tried downgrading openssl?

Edit: Tried building an older version of openssl, but since 1.0.0 is required by some packages I dare not install it...

Last edited by toffyrn (2010-08-26 11:30:28)