{"thread":{"id":"26335","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","startedAt":"2011-01-25T19:05:21Z","lastAt":"2011-01-26T22:18:09Z","messageCount":10,"participants":["Erik Faye-Lund","Mika Fischer","Daniel Stenberg"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"159854","messageId":"AANLkTi=UQR3cEbTj4N0W_4CLG9T1F+rmkLEew+WO4w5f@mail.gmail.com","threadId":"26335","inReplyTo":"0aa77107-bb31-4f74-90e2-02ce5155b0a0@l17g2000yqe.googlegroups.com","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Erik Faye-Lund","fromEmail":"kusmabite@gmail.com","sentAt":"2011-01-25T19:05:21Z","receivedAt":"2011-01-25T19:05:21Z","isPatch":false,"sender":{"key":"kusmabite@gmail.com","avatar":"https://avatars.githubusercontent.com/u/47073?v=4"},"body":"(CCing the mainline Git mailing list for insight)\n\nOn Tue, Jan 25, 2011 at 6:42 PM, Mika Fischer\n<mika.a.fischer@googlemail.com> wrote:\n> Hi,\n>\n> with the latest msysGit (1.7.3.1-preview20101002.exe), I cannot access\n> git repositories via https, if they are served by an apache using\n> OpenSSL 1.0.0\n>\n> The error is:\n> ----\n> error: error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)\n> while accessing https://server/repository/info/refs\n>\n> fatal: HTTP request failed\n> ----\n>\n> An apache using OpenSSL 0.9.8 works fine.\n>\n> There seem to be some SSL handshake issues, when curl and apache use\n> different versions of OpenSSL:\n> http://bugs.gentoo.org/332661\n\nThis issue is listed as an issue with Gentoo's OpenSSL 1.0.0 builds,\nand seems to be have resolved by adding back SSLv2 support.\n\n> http://comments.gmane.org/gmane.comp.web.curl.general/11154\n\nThis seems to be an issue with Fedora's OpenSSL 1.0.0 builds.\n\n> Any idea how to fix this? For instance, is it possible to configure\n> parameters that are passed to curl (passing -3 would fix it)? I could\n> also change the apache configuration if someone knows how to work\n> around this issue, although I already tried playing around with the\n> SSLProtocol option of Apache to no avail...\n>\n\nGit for Windows currently use OpenSSL 0.9.8k, so this sounds to me\nlike an issue in your server-end. Your server seems to simply be\nincompatible with OpenSSL 0.9.8-clients, which is the vast majority of\nSSL-clients out there.\n\nAFAICT, Git does not run curl, but use libcurl instead. It doesn't set\nCURLOPT_SSLVERSION, and Git for Windows use libcurl 7.21.1 where\neither SSLv3 or TLSv1 seems to be the default. So I don't know if\nthere's anything we can do about this on the Git side. You could try\nto set CURLOPT_SSLVERSION to work around the issue, but I don't think\nthis is something we'd want to do in a Git for Windows release.\n\n\nBut:\nThis issue seems like it might be related to this, which is a big issue:\nhttp://www.openssl.org/news/secadv_20101202.txt\n\nIn other words: We should probably upgrade OpenSSL. If not, Git for\nWindows will most likely be a security hole.\n\nBut we must do so while making sure we are compatible with 0.9.8. It\nseems to me like either 0.9.8q or 1.0.0c and beyond fixes the\nsecurity-hole. If 1.0.x breaks 0.9.8 support (It's unclear to me if it\ndoes or not - some sources say it does, some say it doesn't), perhaps\n0.9.8q is the safest route? It's probably also the version that needs\nthe least amount of patching to run, as it's closer to what we're\nalready building. This probably means we COULD have it ready for Git\nfor Windows 1.7.4.\n\n> Any help would be very much appreciated, as this makes git totally\n> useless under Windows for us, as all our repositories are accessed\n> through https...\n\nAs I said: I think this is a problem with your server, not Git for\nWindows. But I'm far from an expert on the subject, so I could be\nmistaken.\n"},{"id":"159880","messageId":"AANLkTinGLMcRJ9EuZY_k4GoKyg+r7hxcgnq3z0=qOemA@mail.gmail.com","threadId":"26335","inReplyTo":"AANLkTi=UQR3cEbTj4N0W_4CLG9T1F+rmkLEew+WO4w5f@mail.gmail.com","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Mika Fischer","fromEmail":"mika.a.fischer@googlemail.com","sentAt":"2011-01-26T09:15:59Z","receivedAt":"2011-01-26T09:15:59Z","isPatch":false,"sender":{"key":"mika.a.fischer@googlemail.com","avatar":null},"body":"Hi Erik,\n\nmany thanks for your comments!\n\nOn Tue, Jan 25, 2011 at 20:05, Erik Faye-Lund <kusmabite@gmail.com> wrote:\n>> with the latest msysGit (1.7.3.1-preview20101002.exe), I cannot access\n>> git repositories via https, if they are served by an apache using\n>> OpenSSL 1.0.0\n>>\n>> The error is:\n>> ----\n>> error: error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)\n>> while accessing https://server/repository/info/refs\n>>\n>> fatal: HTTP request failed\n>> ----\n>>\n>> An apache using OpenSSL 0.9.8 works fine.\n>>\n>> There seem to be some SSL handshake issues, when curl and apache use\n>> different versions of OpenSSL:\n>> http://bugs.gentoo.org/332661\n>\n> This issue is listed as an issue with Gentoo's OpenSSL 1.0.0 builds,\n> and seems to be have resolved by adding back SSLv2 support.\n>\n>> http://comments.gmane.org/gmane.comp.web.curl.general/11154\n>\n> This seems to be an issue with Fedora's OpenSSL 1.0.0 builds.\n\nI found something else, which seems to be more related to my exact issue:\nhttp://www.mentby.com/Group/curl/curl-outputs-ssl23getserverhello.html\n\nI've also tried doing \"openssl s_client -connect <server>:443\" with\nthe openssl command line tool that's included in the current msysgit,\nand that works just fine.\n\n> Git for Windows currently use OpenSSL 0.9.8k, so this sounds to me\n> like an issue in your server-end. Your server seems to simply be\n> incompatible with OpenSSL 0.9.8-clients, which is the vast majority of\n> SSL-clients out there.\n\nI find it hard to believe that something like this would have gone\nunnoticed for such a long time. Most Linux distributions nowadays come\nwith OpenSSL 1.0.0 and that would mean that any webserver set up on\nthem could not communicate with any client using OpenSSL 0.9.8. Since\nthe openssl command line tool works fine, I think it must be something\nmuch more specific and it must have something to do with curl.\n\nI'll see if I can get a more current version of curl to compile under Windows.\n\nI also wanted to try compiling a more current version of OpenSSL but\nthe build hangs at \"Generating DLL definition files\". Any idea what\nmight be the problem?\n\n> AFAICT, Git does not run curl, but use libcurl instead. It doesn't set\n> CURLOPT_SSLVERSION, and Git for Windows use libcurl 7.21.1 where\n> either SSLv3 or TLSv1 seems to be the default. So I don't know if\n> there's anything we can do about this on the Git side. You could try\n> to set CURLOPT_SSLVERSION to work around the issue, but I don't think\n> this is something we'd want to do in a Git for Windows release.\n\nThis environment variable has no effect for me, neither with git nor\nwith the command line client.\n\nBest,\n Mika\n"},{"id":"159882","messageId":"AANLkTimJznExH8N9fcgSC88HOPfaFDF7jFMTZUJauL9+@mail.gmail.com","threadId":"26335","inReplyTo":"AANLkTinGLMcRJ9EuZY_k4GoKyg+r7hxcgnq3z0=qOemA@mail.gmail.com","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Mika Fischer","fromEmail":"mika.a.fischer@googlemail.com","sentAt":"2011-01-26T09:54:46Z","receivedAt":"2011-01-26T09:54:46Z","isPatch":false,"sender":{"key":"mika.a.fischer@googlemail.com","avatar":null},"body":"On Wed, Jan 26, 2011 at 10:15, Mika Fischer\n<mika.a.fischer@googlemail.com> wrote:\n> I'll see if I can get a more current version of curl to compile under Windows.\n\nI did not manage to do do this.\n\nBut I noticed that the same problem occurs on OpenSuSE 11.2. So I\ncompiled the latest version of curl on OpenSuSE 11.2 and the problem\nis still present...\n\nBest,\n Mika\n"},{"id":"159883","messageId":"alpine.DEB.2.00.1101261056570.5603@tvnag.unkk.fr","threadId":"26335","inReplyTo":"AANLkTimJznExH8N9fcgSC88HOPfaFDF7jFMTZUJauL9+@mail.gmail.com","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2011-01-26T09:57:57Z","receivedAt":"2011-01-26T09:57:57Z","isPatch":false,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Wed, 26 Jan 2011, Mika Fischer wrote:\n\n>> I'll see if I can get a more current version of curl to compile under \n>> Windows.\n>\n> I did not manage to do do this.\n>\n> But I noticed that the same problem occurs on OpenSuSE 11.2. So I compiled \n> the latest version of curl on OpenSuSE 11.2 and the problem is still \n> present...\n\nAre these clean builds of libcurl and OpenSSL from source?\n\nI'll try to look into this.\n\n-- \n\n  / daniel.haxx.se\n"},{"id":"159884","messageId":"AANLkTikmM8VzM0hKmr7h7mTUO_z8wqvNFYShw2Pe982m@mail.gmail.com","threadId":"26335","inReplyTo":"alpine.DEB.2.00.1101261056570.5603@tvnag.unkk.fr","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Mika Fischer","fromEmail":"mika.a.fischer@googlemail.com","sentAt":"2011-01-26T10:04:45Z","receivedAt":"2011-01-26T10:04:45Z","isPatch":false,"sender":{"key":"mika.a.fischer@googlemail.com","avatar":null},"body":"On Wed, Jan 26, 2011 at 10:57, Daniel Stenberg <daniel@haxx.se> wrote:\n> Are these clean builds of libcurl and OpenSSL from source?\n\nI just compiled libcurl against the OpenSSL library of OpenSuSE 11.2 (0.9.8k).\n\nIf you want me to test other combinations/versions etc. just let me know.\n\n> I'll try to look into this.\n\nThanks a lot!\n\nBest,\n Mika\n"},{"id":"159890","messageId":"alpine.DEB.2.00.1101261422550.20831@tvnag.unkk.fr","threadId":"26335","inReplyTo":"AANLkTimJznExH8N9fcgSC88HOPfaFDF7jFMTZUJauL9+@mail.gmail.com","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2011-01-26T13:29:53Z","receivedAt":"2011-01-26T13:29:53Z","isPatch":false,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Wed, 26 Jan 2011, Mika Fischer wrote:\n\n> But I noticed that the same problem occurs on OpenSuSE 11.2. So I compiled \n> the latest version of curl on OpenSuSE 11.2 and the problem is still \n> present...\n\nSorry, but I can't repeat this problem. I tried this:\n\n1. I got OpenSSL 1.0.0c, built it and installed it.\n\n2. I started OpenSSL's little HTTPS server with this version:\n\n$ openssl s_server -HTTP -cert [PEM]\n\n(I verified, and this binary uses the lib statically so there's no funny lib \npath issues here.)\n\n3. I tried getting a file through this using curl 7.21.2 and my current dev \nversion of 7.21.4-DEV (see below for full details). Both managed to get it \nfine.\n\n>From this, I conclude that there's some additional factors necessary to make \nthis problem trigger. Can you figure out what?\n\nThe full curl -V outputs from my two test versions:\n\ncurl 7.21.2 (i486-pc-linux-gnu) libcurl/7.21.2 OpenSSL/0.9.8o zlib/1.2.3.4 \nlibidn/1.18 libssh2/1.2.6\nProtocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 \npop3s rtsp scp sftp smtp smtps telnet tftp\nFeatures: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz\n\ncurl 7.21.4-DEV (i686-pc-linux-gnu) libcurl/7.21.4-DEV OpenSSL/1.0.0c \nzlib/1.2.3.4 c-ares/1.7.5-DEV libidn/1.18 libssh2/1.2.8_DEV librtmp/2.2e\nProtocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 \npop3s rtmp rtsp scp sftp smtp smtps telnet tftp\nFeatures: AsynchDNS Debug TrackMemory GSS-Negotiate IDN IPv6 Largefile NTLM \nSSL libz\n\n-- \n\n  / daniel.haxx.se\n"},{"id":"159891","messageId":"AANLkTik7BbYTCgBymMiGfS9gxHXN_jY7Ftz8K4+aZRQx@mail.gmail.com","threadId":"26335","inReplyTo":"alpine.DEB.2.00.1101261422550.20831@tvnag.unkk.fr","subject":"Re: Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Erik Faye-Lund","fromEmail":"kusmabite@gmail.com","sentAt":"2011-01-26T14:29:53Z","receivedAt":"2011-01-26T14:29:53Z","isPatch":false,"sender":{"key":"kusmabite@gmail.com","avatar":"https://avatars.githubusercontent.com/u/47073?v=4"},"body":"On Wed, Jan 26, 2011 at 2:29 PM, Daniel Stenberg <daniel@haxx.se> wrote:\n> On Wed, 26 Jan 2011, Mika Fischer wrote:\n>\n>> But I noticed that the same problem occurs on OpenSuSE 11.2. So I compiled\n>> the latest version of curl on OpenSuSE 11.2 and the problem is still\n>> present...\n>\n> Sorry, but I can't repeat this problem. I tried this:\n>\n> 1. I got OpenSSL 1.0.0c, built it and installed it.\n>\n> 2. I started OpenSSL's little HTTPS server with this version:\n>\n> $ openssl s_server -HTTP -cert [PEM]\n>\n> (I verified, and this binary uses the lib statically so there's no funny lib\n> path issues here.)\n>\n> 3. I tried getting a file through this using curl 7.21.2 and my current dev\n> version of 7.21.4-DEV (see below for full details). Both managed to get it\n> fine.\n>\n> From this, I conclude that there's some additional factors necessary to make\n> this problem trigger. Can you figure out what?\n>\n> The full curl -V outputs from my two test versions:\n>\n> curl 7.21.2 (i486-pc-linux-gnu) libcurl/7.21.2 OpenSSL/0.9.8o zlib/1.2.3.4\n> libidn/1.18 libssh2/1.2.6\n> Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3\n> pop3s rtsp scp sftp smtp smtps telnet tftp\n> Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz\n>\n> curl 7.21.4-DEV (i686-pc-linux-gnu) libcurl/7.21.4-DEV OpenSSL/1.0.0c\n> zlib/1.2.3.4 c-ares/1.7.5-DEV libidn/1.18 libssh2/1.2.8_DEV librtmp/2.2e\n> Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3\n> pop3s rtmp rtsp scp sftp smtp smtps telnet tftp\n> Features: AsynchDNS Debug TrackMemory GSS-Negotiate IDN IPv6 Largefile NTLM\n> SSL libz\n>\n\nHere's the output from Git for Windows' curl -V:\n\n$ curl -V\ncurl 7.21.1 (i686-pc-mingw32) libcurl/7.21.1 OpenSSL/0.9.8k zlib/1.2.3\nProtocols: dict file ftp ftps http https imap imaps ldap ldaps pop3\npop3s rtsp smtp smtps telnet tftp\nFeatures: Largefile NTLM SSL SSPI libz\n"},{"id":"159892","messageId":"AANLkTi=Gey75oo-iaELVWg87cP+HgM3RQ60vPgwaEMpS@mail.gmail.com","threadId":"26335","inReplyTo":"alpine.DEB.2.00.1101261422550.20831@tvnag.unkk.fr","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Mika Fischer","fromEmail":"mika.a.fischer@googlemail.com","sentAt":"2011-01-26T15:13:33Z","receivedAt":"2011-01-26T15:13:33Z","isPatch":false,"sender":{"key":"mika.a.fischer@googlemail.com","avatar":null},"body":"On Wed, Jan 26, 2011 at 14:29, Daniel Stenberg <daniel@haxx.se> wrote:\n> 3. I tried getting a file through this using curl 7.21.2 and my current dev\n> version of 7.21.4-DEV (see below for full details). Both managed to get it\n> fine.\n\nSame here. curl can fetch fine from the openssl mini-httpd\n\n> From this, I conclude that there's some additional factors necessary to make\n> this problem trigger. Can you figure out what?\n\nSo to recap, we have the following situation:\n\ncurl/openssl 0.9.8k <-> apache/openssl 0.9.8k -> works\ncurl/openssl 1.0.0 <-> apache/openssl 0.9.8k -> works\ncurl/openssl 0.9.8k <-> apache/openssl 1.0.0 -> error\nopenssl 0.9.8k <-> apache/openssl 1.0.0 -> works\ncurl/openssl 0.9.8k <-> openssl 1.0.0 -> works\nopenssl 0.9.8k <-> openssl 1.0.0 -> works\n\nI'm not sure what to take away from this. Maybe it's a problem that is\npartly caused by both apache and curl?\n\nDo you know how I could debug this? I won't have much time during the\nday but I can test things in the evenings...\n\nJust FYI: To get something running, I downgraded our apache server to\nthe OpenSuSE 11.2 packages. Now it works again fine, with the same\nconfiguration as before...\n\nThe failing curl -V on OpenSuSE 11.2\ncurl 7.19.6 (x86_64-unknown-linux-gnu) libcurl/7.19.6 OpenSSL/0.9.8k\nzlib/1.2.3 libidn/1.10\nProtocols: tftp ftp telnet dict ldap http file https ftps\nFeatures: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz\n\ncurl -V on the problematic apache host running OpenSuSE 11.3\ncurl 7.20.1 (x86_64-unknown-linux-gnu) libcurl/7.20.1 OpenSSL/1.0.0\nzlib/1.2.3 libidn/1.15 libssh2/1.2.2_DEV\nProtocols: dict file ftp ftps http https imap imaps ldap pop3 pop3s\nrtsp scp sftp smtp smtps telnet tftp\nFeatures: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz\n\nBest,\n Mika\n"},{"id":"159925","messageId":"alpine.DEB.2.00.1101262244550.14066@tvnag.unkk.fr","threadId":"26335","inReplyTo":"AANLkTi=Gey75oo-iaELVWg87cP+HgM3RQ60vPgwaEMpS@mail.gmail.com","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2011-01-26T22:00:39Z","receivedAt":"2011-01-26T22:00:39Z","isPatch":false,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Wed, 26 Jan 2011, Mika Fischer wrote:\n\n> curl/openssl 0.9.8k <-> apache/openssl 1.0.0 -> error\n\n> I'm not sure what to take away from this. Maybe it's a problem that is \n> partly caused by both apache and curl?\n\nCould be. I just have a hard time to see why code in curl that has worked for \nso many years suddenly would stop working. It just so feels like else changed.\n\nThis error (or something similar to it) is often seen when we try to talk \nplain HTTP to a HTTPS server or vice versa. Did you verify that HTTPS was \nworking fine on that port when you ran the OpenSSL 1.0.0 version of the \nserver?\n\nPerhaps it is possible to add verbose level and further debug log stuff in the \nserver to see what makes it suddenly decide the handshake is bad.\n\n-- \n\n  / daniel.haxx.se\n"},{"id":"159927","messageId":"AANLkTimSd6QmwGfuk44ga=YG3TT7wuwLJQMP=eghhttu@mail.gmail.com","threadId":"26335","inReplyTo":"alpine.DEB.2.00.1101262244550.14066@tvnag.unkk.fr","subject":"Re: [msysGit] Git unable to access https repositories due to curl/OpenSSL 1.0.0 handshake issues","fromName":"Mika Fischer","fromEmail":"mika.a.fischer@googlemail.com","sentAt":"2011-01-26T22:18:09Z","receivedAt":"2011-01-26T22:18:09Z","isPatch":false,"sender":{"key":"mika.a.fischer@googlemail.com","avatar":null},"body":"On Wed, Jan 26, 2011 at 23:00, Daniel Stenberg <daniel@haxx.se> wrote:\n>> curl/openssl 0.9.8k <-> apache/openssl 1.0.0 -> error\n>\n>> I'm not sure what to take away from this. Maybe it's a problem that is\n>> partly caused by both apache and curl?\n>\n> Could be. I just have a hard time to see why code in curl that has worked\n> for so many years suddenly would stop working. It just so feels like else\n> changed.\n\nWell, it's definitely a possibility that neither Apache nor Curl are\nat fault but OpenSSL. The strange thing is that I could not produce\nany failure with the OpenSSL command line tool. But that doesn't mean\nthat openssl is completely innocent.\n\n> This error (or something similar to it) is often seen when we try to talk\n> plain HTTP to a HTTPS server or vice versa. Did you verify that HTTPS was\n> working fine on that port when you ran the OpenSSL 1.0.0 version of the\n> server?\n\nNo, it definitely worked before with curl/openssl 1.0.0 and all kinds\nof browsers. Also, as I wrote, it worked with the OpenSSL 0.9.8k\ncommand line tool.\n\n> Perhaps it is possible to add verbose level and further debug log stuff in\n> the server to see what makes it suddenly decide the handshake is bad.\n\nI didn't find much in this direction in the apache docs, unfortunately...\nhttp://httpd.apache.org/docs/2.2/mod/mod_ssl.html\n\nNext thing I'll try is to check whether I can reproduce this using a\ndifferent distribution that also uses OpenSSL 1.0.0. I'll let you know\nwhen I have the results...\n\nBest,\n Mika\n"}]}