Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 08 Oct 2014 13:13:29 +0000
From:      bugzilla-noreply@freebsd.org
To:        freebsd-ports-bugs@FreeBSD.org
Subject:   [Bug 194241] New: net/svnup can not connect to freebsd svn repos "SSL_connect error:1"
Message-ID:  <bug-194241-13@https.bugs.freebsd.org/bugzilla/>

next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194241

            Bug ID: 194241
           Summary: net/svnup can not connect to freebsd svn repos
                    "SSL_connect error:1"
           Product: Ports Tree
           Version: Latest
          Hardware: Any
                OS: Any
            Status: Needs Triage
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: freebsd-ports-bugs@FreeBSD.org
          Reporter: spil.oss@gmail.com
                CC: jcm@visi.com
                CC: jcm@visi.com
             Flags: maintainer-feedback?(jcm@visi.com)

Created attachment 148094
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=148094&action=edit
Patch to enable TLSv1

When I run svnup it returns a large amount of 
SSL_connect error:1
lines.

There seems to have been a change in the svnup servers that no longer allow it
to negotiate SSLv3 connections.
$ openssl s_client -connect svn0.eu.freebsd.org:443 -ssl3
CONNECTED(00000003)
34379134632:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake
failure:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_pkt.c:1260:SSL
alert number 40
34379134632:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
failure:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_pkt.c:596:

Negotiating a TLSv1(.1/.2) connection is fine.

The SSL connection is established with 
   connection->ctx = SSL_CTX_new(SSLv23_client_method()); 
which will be broken for people using security/libressl
then the code disables TLSv1 breaking the ssl session setup.
   SSL_CTX_set_options(connection->ctx, SSL_OP_ALL | SSL_OP_NO_TICKET |
SSL_OP_NO_TLSv1);

When I remove "| SSL_OP_NO_TLSv1" it compiles and runs fine.

--- Comment #1 from Bugzilla Automation <bugzilla@FreeBSD.org> ---
Maintainer CC'd

-- 
You are receiving this mail because:
You are the assignee for the bug.



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-194241-13>