Proxy error on SVN 1.8.1

[Guillaume Lasnier]

Hi all,
When issuing the following command, I get the following error:

$ svn -v log
svn: E120107: Unable to connect to a repository at URL
'https://svncvs.myhost.mydomain/repos/myrepo/trunk/hybris/bin/platform'
svn: E120107: Error running context: The proxy server returned an error
while setting up the SSL tunnel.


I am using subversion 1.8.1 on Mac OS X installed with homebrew.
I have configured the proxy the following way in ~/.subversion/servers :

[groups]
# group1 = *.collab.net
# othergroup = repository.blarggitywhoomph.com
# thirdgroup = *.example.com
mygroup = *.myhost.mydomain

# Information for my group:
[mygroup]
http-proxy-host = 192.168.xxx.xxx
http-proxy-port = 1234
http-proxy-username = john
http-proxy-password = doe


This configuration used to work with subversion 1.7.

Do have any idea?

--

Guillaume Lasnier

[Lieven Govaerts]

Hi,

On Mon, Jul 29, 2013 at 6:28 PM, Guillaume Lasnier
<guillaum...@hybris.com> wrote:
> Hi all,
> When issuing the following command, I get the following error:
>
> $ svn -v log
> svn: E120107: Unable to connect to a repository at URL
> 'https://svncvs.myhost.mydomain/repos/myrepo/trunk/hybris/bin/platform'
> svn: E120107: Error running context: The proxy server returned an error
> while setting up the SSL tunnel.

That error indicates the proxy returned an error to the CONNECT
request that svn uses to initiate the ssl tunnel.
What proxy server do you use? KeepAlive off? Specific authentication?

I think the easiest way to find out what's going on is to trace the
network traffic. Can you make a trace with fiddler or wireshark?

>
> I am using subversion 1.8.1 on Mac OS X installed with homebrew.
> I have configured the proxy the following way in ~/.subversion/servers :
>
> [groups]
> # group1 = *.collab.net
> # othergroup = repository.blarggitywhoomph.com
> # thirdgroup = *.example.com
> mygroup = *.myhost.mydomain
>
> # Information for my group:
> [mygroup]
> http-proxy-host = 192.168.xxx.xxx
> http-proxy-port = 1234
> http-proxy-username = john
> http-proxy-password = doe
>
>
> This configuration used to work with subversion 1.7.
>

Configuration looks ok, and if it has worked before then we should be
able to make it work in 1.8.1 too.

Lieven

[Guillaume Lasnier]

Hi Lieven,
Please find attached the tcpdump that dumps traffic between my laptop and
the proxy. The only information I could get about the proxy is that it's
an ISA server.

Regards

--
Guillaume Lasnier

[Lieven Govaerts]

Hi,

On Wed, Jul 31, 2013 at 11:30 AM, Guillaume Lasnier
<guillaum...@hybris.com> wrote:
> Hi Lieven,
> Please find attached the tcpdump that dumps traffic between my laptop and
> the proxy. The only information I could get about the proxy is that it's
> an ISA server.

from the trace I don't really see what's going on, the proxy returns
200 Connection Established so the ssl tunnel was setup correctly,
including proxy authentication.

Now I see that homebrew provides serf 1.2.1, also for Subversion 1.8.1
(*). Serf 1.3.0 is available which includes many fixes for the ssl
tunnel and authentication code. So I propose that you test with serf
1.3.0 first. You'll have to build svn and serf manually or wait for
the homebrew project to update serf to 1.3.0.

Note: your username and password can be extract from the trace you
sent, I suggest you change them.

Lieven

(*) https://github.com/mxcl/homebrew/commits/master/Library/Formula/serf.rb

[Lieven Govaerts]

Guillaume,

On Mon, Aug 5, 2013 at 9:03 AM, Lieven Govaerts <l...@apache.org> wrote:
> Hi,
>

> On Wed, Jul 31, 2013 at 11:30 AM, Guillaume Lasnier
> <guillaum...@hybris.com> wrote:
>> Hi Lieven,
>> Please find attached the tcpdump that dumps traffic between my laptop and
>> the proxy. The only information I could get about the proxy is that it's
>> an ISA server.
>
> from the trace I don't really see what's going on, the proxy returns
> 200 Connection Established so the ssl tunnel was setup correctly,
> including proxy authentication.

would it be possible for you to send me (privately) a wireshark trace
of the same operation but with svn 1.7 and neon? (if you still have
this client)
I got a report from a similar issue as yours with serf 1.3.0, so it's
possible that upgrading to serf 1.3.0 will not solve your issue.

thanks,

Lieven

[Daniel Shahaf]

Lieven Govaerts wrote on Mon, Aug 05, 2013 at 09:03:13 +0200:
> Now I see that homebrew provides serf 1.2.1, also for Subversion 1.8.1
> (*). Serf 1.3.0 is available which includes many fixes for the ssl
> tunnel and authentication code. So I propose that you test with serf
> 1.3.0 first. You'll have to build svn and serf manually or wait for
> the homebrew project to update serf to 1.3.0.

Shouldn't it be possible to avoid rebuilding Subversion by installing
serf-1.3 on top of serf-1.2? That's the point of shared libraries...

[Lieven Govaerts]

Hi,

On Mon, Jul 29, 2013 at 6:28 PM, Guillaume Lasnier
<guillaum...@hybris.com> wrote:

> Hi all,
> When issuing the following command, I get the following error:
>
> $ svn -v log
> svn: E120107: Unable to connect to a repository at URL
> 'https://svncvs.myhost.mydomain/repos/myrepo/trunk/hybris/bin/platform'
> svn: E120107: Error running context: The proxy server returned an error
> while setting up the SSL tunnel.
>

I was able to reproduce this issue with serf trunk, reported this as
serf issue 120:
https://code.google.com/p/serf/issues/detail?id=120

The trigger is that the proxy server is configured to close the
connection after each response. In apache that would be the "KeepAlive
Off" flag.

It's not clear what the actual root cause is, but now that we can
reproduce it we should be able to fix this soon.

thanks for the provided info!

Lieven