Login | Register
My pages Projects Community openCollabNet

Discussions > users [DISABLED] > Re: Secure connection truncated due to libneon and 1.6.4

subversion
Discussion topic

Back to topic list

Re: Secure connection truncated due to libneon and 1.6.4

Author mdiers
Full name Michael Diers
Date 2009-09-02 03:58:50 PDT
Message Chris Nagele wrote:
> We've been trying to fix a strange issue at Beanstalk after migrating
> to Rackspace. I want to share the experience as it might help others.
>
> PROBLEM
>
> A small group of users were getting this error upon connecting to svn:
>
> svn: OPTIONS of
> 'https://myaccount.sv​n.beanstalkapp.com/m​yproject/trunk':​ SSL
> negotiation failed: Secure connection truncated
> (https://myaccount.sv​n.beanstalkapp.com)
>
> We found some commonality between them:
>
> * Using Ubuntu 9.04, Fedora 11, Debian 5
> * Using SVN 1.5 client or later
>
> It worked with:
> * ubuntu 8.04 - subversion 1.4.6
>
> A customer compiled Subversion against serf and it worked for him. He
> used libssl 0.9.8 and libserf instead of libneon.
>
> SOLUTION
>
> We have a Cisco load balancer (CSS) and had the ssl traffic decrypted
> there instead of doing it on the servers. The problem is that the CSS
> can't support TLS 1.1 connections. To fix this, we need to move SSL
> back to each server instance.
>
> We tested and this problem did not exist with the server using 1.6.3.
> I read that this is to due to supporting only serf in 1.6.4, but I am
> not sure. Ideally we would like to still use the CSS. If anyone has a
> recommendation it would be greatly appreciated.

Chris,

Debian and Ubuntu have switched to using libneon27-gnutls instead of
libneon27, so neon is now using GNU TLS instead of OpenSSL. There are
open bugs concerning SSL issues with this configuration, although it's
usually to do with client certificates.

https://bugs.launchp​ad.net/bugs/480041

Note that Subversion in Ubuntu 8.04 is in fact using libneon27 (or
libneon26, I forget), the OpenSSL version of neon.

As mentioned in the above bug report, you could try this as a workaround:

* install libneon27 (in addition to libneon27-gnutls)
* LD_PRELOAD=/usr/lib/​libneon.so.27 svn ...

--
Michael Diers, elego Software Solutions GmbH, http://www.elego.de

« Previous message in topic | 2 of 2 | Next message in topic »

Messages

Show all messages in topic

Subject
Author
Full name
Date posted
+
Secure connection truncated due to libneon and 1.6.4 Chris Nagele <wildbit at gmail dot com> Chris Nagele <wildbit at gmail dot com> 2009-09-01 11:13:04 PDT
     Re: Secure connection truncated due to libneon and 1.6.4 mdiers Michael Diers 2009-09-02 03:58:50 PDT
Messages per page: