mainSavannah Administration - Support: sr #109089, Cannot access cgit pages

 
 

sr #109089: Cannot access cgit pages

Submitter:  Leo Famulari <lfam>
Submitted:  Sat 09 Jul 2016 11:23:26 PM UTC
   
 
Category:  Source code repositories - web browsing Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  agn
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sun 17 Jul 2016 05:49:31 AM UTC, comment #7: 

gnu.org and www.gnu.org have indeed enabled HSTS. The headers are:

  HTTP/1.1 200 OK
  Date: Sun, 17 Jul 2016 05:41:27 GMT
  Server: Apache/2.4.7
  Content-Location: home.html
  Vary: negotiate,accept-language,Accept-Encoding
  TCN: choice
  Strict-Transport-Security: max-age=63072000
  Access-Control-Allow-Origin: (null)
  Accept-Ranges: bytes
  Cache-Control: max-age=0
  Expires: Sun, 17 Jul 2016 05:41:27 GMT
  Keep-Alive: timeout=3, max=100
  Connection: Keep-Alive
  Transfer-Encoding: chunked
  Content-Type: text/html
  Content-Language: en

However that does not include includeSubDomains directive. Therefore it should not apply to subdomains. See RFC 6797.

I tested this using both Firefox and Chromium. I first went to https://gnu.org/ which redirects to https://www.gnu.org/ to set up the environment with HSTS. Then I went to http://git.savannah.gnu.org/cgit/coreutils.git to see what it would do in both of those browsers. Both went to http and neither went to https.

I don't know what is going on yet. We will have to keep looking.

Bob Proulx <rwp>
Site Administrator
Sat 16 Jul 2016 05:09:48 PM UTC, comment #6: 

By the way, I found the following line in the file '~/.mozilla/firefox/$profile.default/SiteSecurityServiceState.txt', which I believe is what Firefox uses to keep track of sites that have enabled HSTS:

www.gnu.org:HSTS [remainder of line removed]

If HSTS is indeed enabled on gnu.org, I wouldn't expect to be able to load http://git.savannah.gnu.org/.

Leo Famulari <lfam>
Mon 11 Jul 2016 05:23:03 PM UTC, comment #5: 

Okay, it seems I misunderstood Efraim. Sorry!

I guess that something is wrong with my browser.

Leo Famulari <lfam>
Mon 11 Jul 2016 05:20:35 PM UTC, comment #4: 

I don't have any plugins that (explicity) rewrite or redirect HTTP -> HTTPS. I tried removing all references to Savannah from my browser history, clearing the cache, and using "Safe Mode", and I still had the problem.

I don't have the issue in a "Private Window" or another browser (Chromium).

I wonder if some server configuration changed recently that could be related?

There is at least one other person with the same problem. Here is a conversation I just had on the #guix channel on Freenode:

<lfam> So, is anybody else unable to view our Cgit repo? For example, by clicking from this page? https://savannah.gnu.org/projects/guix
<lfam> I can't make my browser not load git.savannah.gnu.org with HTTPS, which fails because the server does not support HTTPS
<lfam> If so, you should chime in: https://savannah.gnu.org/support/?109089
<efraim> when I click on it it loads correctly, when I add https at the beginning it fails with "ERR_SSL_PROTOCOL_ERROR"
<lfam> efraim: What browser are you using?
<efraim> chromium
<lfam> efraim: Do you have a Firefox derived browser available to try it in?
<lfam> I'd appreciate another data point :)
<lfam> If not, don't worry about building or installing it
<efraim> i have firefox on debian I can try
<lfam> I'm trying to figure out if something obscure broke in my Firefox or if there is actually something wrong on the Savannah servers
<efraim> when I click on it it defaults to http, https fails to load
<lfam> Okay, can I quote that line in my bug report?
<lfam> Or, can I quote this whole conversation?
<efraim> sure
<lfam> Thanks

Leo Famulari <lfam>
Sun 10 Jul 2016 11:56:30 PM UTC, comment #3: 

Check to see if you have a web browser plugin installed now that is automatically converting http to https such as BetterPrivacy or similar that is doing this for the cgit pages. I suspect something of that sort in your browser is what has caused the change.

Bob Proulx <rwp>
Site Administrator
Sun 10 Jul 2016 01:47:21 AM UTC, comment #2: 

Hello,

Currently savannah's cgit access does not support HTTPS (only HTTP).
For more details and previous discussions, see:
 http://lists.gnu.org/archive/html/savannah-users/2014-11/msg00003.html
 http://lists.gnu.org/archive/html/savannah-hackers/2016-03/msg00001.html

As a side note,
When I visited the 8sync's web page on Savannah,
the links for "Browse Sources Repository" use http:// (not https://) - thus it should "just work":  http://git.savannah.gnu.org/cgit/8sync.git

As such I'm closing this ticket.

regards,
 - assaf

Assaf Gordon <agn>
Site Administrator
Sat 09 Jul 2016 11:25:35 PM UTC, comment #1: 

I should clarify, I have been unable to access any cgit pages on Savannah. I can load cgit pages from other domains.

Leo Famulari <lfam>
Sat 09 Jul 2016 11:23:26 PM UTC, original submission:  

Recently, I have been unable to access any cgit pages in my web browser (Firefox 45.2.0).

For example, starting from 8sync's summary page [0], I click on "Browse Sources Repository", which tries to take me to a cgit page [1].

The browser fails to load the page and says "Secure Connection Failed
The connection to the server was reset while the page was loading. [...]". This error message lacks any more detail.

So, I tried using OpenSSL:

$ echo | openssl s_client -connect git.savannah.gnu.org:443
CONNECTED(00000003)
140221376419480:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1468106400
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

[0]
https://savannah.gnu.org/projects/8sync

[1]
https://git.savannah.gnu.org/cgit/8sync.git

Leo Famulari <lfam>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by agn (Posted a comment)
  • -email is unavailable- added by lfam (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-07-10 agn Assigned toNone agn
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code