http://bugzilla.novell.com/show_bug.cgi?id=526319 User rhafer@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c1 --- Comment #1 from Ralf Haferkamp 2009-07-29 05:34:35 MDT --- Hm, somehow the text of my report got cut off :(. Next try. The error message is: -------------------------- Die Aktion laesst sich nicht ausfuehren Verbindungsaufbau vom Server abgelehnt Details der Anfrage: Adresse: http://bugzilla.novell.com Protokoll: http Datum und Zeit: Mittwoch 29 Juli 2009 13:19 Zusaetzliche Information: bugzilla.novell.com: SSL-Aushandlung fehlgeschlagen -------------------------- Other sites (also through https work fine). Firefox (and Konqueror from KDE4:Factory on 11.1) is able to display bugzilla and build.opensuse.org. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User coolo@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c3 Stephan Kulow changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P1 - Urgent CC| |coolo@novell.com Severity|Normal |Major --- Comment #3 from Stephan Kulow 2009-07-30 09:57:53 MDT --- how about you read then the definition of major? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 Lubos Lunak changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P1 - Urgent |P2 - High Summary|konqueror doesn't load |konqueror doesn't load |build.opensuse.org and |rudin.suse.de:8894 and |bugzilla.novell.com |rudin.suse.de:8888 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User pat@indy.rr.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c6 patrick shanahan changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pat@indy.rr.com --- Comment #6 from patrick shanahan 2009-08-04 17:10:31 MDT --- I cannot log into en.opensuse.org or bugzilla.novell.com any more with konqueror. Verison: Version 4.3.00 (KDE 4.3.0) "release 152" Using KDE 4.3.00 (KDE 4.3.0) "release 152" The requested operation could not be completed Connection to Server Refused Details of the Request: URL: https://bugzilla.novell.com/show_bug.cgi?id=438993 Protocol: https Date and Time: Tuesday 04 August 2009 07:08 pm Additional Information: bugzilla.novell.com: SSL negotiation failed Description: The server bugzilla.novell.com refused to allow this computer to make a connection. Possible Causes: The server, while currently connected to the Internet, may not be configured to allow requests. The server, while currently connected to the Internet, may not be running the requested service (https). A network firewall (a device which restricts Internet requests), either protecting your network or the network of the server, may have intervened, preventing this request. Possible Solutions: Try again, either now or at a later time. Contact the administrator of the server for further assistance. Contact your appropriate computer support system, whether the system administrator, or technical support group for further assistance. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User llunak@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c8 Lubos Lunak changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |squan@web.de --- Comment #8 from Lubos Lunak 2009-08-12 05:18:59 MDT --- *** Bug 530268 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=530268 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 Lubos Lunak changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO CC| |dmueller@novell.com Info Provider| |gjhe@novell.com -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User llunak@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c11 Lubos Lunak changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |llunak@novell.com AssignedTo|kde-maintainers@suse.de |gjhe@novell.com --- Comment #11 from Lubos Lunak 2009-08-21 10:33:56 MDT --- Fun fun. It looks like this is nowhere near trivial, and I'm pretty clueless about these things. Yet I'm apparently at least lucky :). I cannot reproduce this problem with Konqueror from KDE4.1.3, in any way. This can be reproduced either on 11.2 (with either Konqueror or Arora) or on 11.1 after installing openssl-0.9.8k and installing Arora from KDE:KDE4:Factory:Desktop (which will probably pull in other things from the repo, at least Qt4 version 4.5.2, so if you do this on a production machine, revert this afterwards, KDE4.1.3 doesn't work very well with this Qt version). While searching for more info, I was also told: ===== ] the issue I'm thinking of is a server-side issue where if you send tls extensiosn on ssl3, the server incorrectly calculates the checksum, so fails the handshake ] the client-side workaround being not to send tls extension advertisements on ssl3 ] though, that server-side issue is only in old openssl versions ] IMO not a qt bug, or even an openssl client bug ] and most distros patch their openssl nowadays to not sent tls extensions on ssl3 ===== So I checked the RedHat openssl package and the patch called openssl-0.9.8g-no-extssl.patch looked to me reasonably close to what is mentioned above. And our openssl package with this patch applied makes both Konqueror and Arora on 11.2 work when accessing the affected sites. I have no idea what the patch really does. As far as I understand it, the Novell sites have broken HTTPS support and the patch makes openssl avoid triggering the brokeness. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User llunak@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c13 Lubos Lunak changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|konqueror doesn't load |openssl cannot load |rudin.suse.de:8894 and |build.opensuse.org and |rudin.suse.de:8888 |bugzilla.novell.com --- Comment #13 from Lubos Lunak 2009-08-21 23:28:15 MDT --- And I actually have a very simple testcase - 'openssl s_client -connect bugzilla.novell.com:443 -ssl3'. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User pat@indy.rr.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c15 --- Comment #15 from patrick shanahan 2009-08-22 06:42:24 MDT --- Here is more: x86_64 Factory/M6 08:35 wahoo:~ > openssl s_client -connect bugzilla.novell.com:443 -ssl3 CONNECTED(00000003) 14922:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt. c:530: 08:36 wahoo:~ > rpm -qa |grep qt4 libqt4-4.5.2-57.3 libqt4-x11-4.5.2-57.3 python-qt4-4.5.4-32.1 libqt4-qt3support-4.5.2-57.3 libqt4-x11-32bit-4.5.2-57.3 libpoppler-qt4-3-0.11.2-21.2 libqt4-qt3support-32bit-4.5.2-57.3 libqt4-sql-mysql-32bit-4.5.2-59.1 libqt4-32bit-4.5.2-57.3 libqt4-sql-sqlite-32bit-4.5.2-57.3 libqt4-sql-sqlite-4.5.2-57.3 libqt4-sql-32bit-4.5.2-57.3 qt4-qtscript-0.1.0-6.7 libqt4-sql-4.5.2-57.3 libqt4-sql-mysql-4.5.2-59.1 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User gjhe@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c17 --- Comment #17 from Guanjun He 2009-08-25 20:25:49 MDT --- (In reply to comment #14)

If this could be of any help:

On my machine (Factory Version), your test spit out the following:

alex@linux-jvwb:~> openssl s_client -connect bugzilla.novell.com:443 -ssl3 CONNECTED(00000003) 7372:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: alex@linux-jvwb:~>

And yes, its qt 4.5.2

alex@linux-jvwb:~> rpm -qa | grep qt4 libqt4-4.5.2-2.5 libqt4-sql-4.5.2-2.5 libpoppler-qt4-3-0.11.2-1.2 qt4-qtscript-doc-0.1.0-3.9 libqt4-x11-4.5.2-2.5 python-qt4-4.5.4-2.2 qt4-qtscript-0.1.0-3.9 libqt4-sql-sqlite-4.5.2-2.5 qt4-style-polyester-2.0.0-2.11 libqt4-qt3support-4.5.2-2.5 qt4-x11-tools-4.5.2-2.4

where I can get the Factory Version OS, I want to do more testing to debug the issuse.thanks -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User gjhe@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c19 Guanjun He changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #19 from Guanjun He 2009-08-26 00:39:05 MDT --- it's not an openssl bug,maybe the qt4.5.2's bug. the following is the detail description: 1. for qt4-4.4.3 , openssl-0.9.8k, every thing is ok, the simple steps are: SSL Client Hello SSLV3 ServerHello SSLV3 Certificate reset SSLV2 Client Hello SSLV3 Server Hello SSLV3 Certificate SSLV3 Client Key Exchange SSLV3 Change Cipher Spec application data... 2. for qt4-4.5.2 , openssl-0.9.8k, can not access bugzilla.novell.com, the simple steps are: SSL Client Hello SSLV3 ServerHello SSLV3 Certificate reset SSL Client Hello(still SSl,should try SSL2,maybe then SSL3) SSLV3 ServerHello SSLV3 Certificate reset endless loop timeout... so,this is not a bug of openssl.Client need to analyze the reply from server,SSL failed,then try SSL2,may be then SSL3,for this issuse,SSL2 is ok. if any concern,please info me.thanks -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 Lubos Lunak changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|openssl cannot load |openssl cannot load |rudin.suse.de:8894 and |build.opensuse.org and |rudin.suse.de:8888 |bugzilla.novell.com -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 Guanjun He changed: What |Removed |Added ---------------------------------------------------------------------------- Info Provider|metast@gmx.de |rhafer@novell.com -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User gjhe@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c26 --- Comment #26 from Guanjun He 2009-08-28 03:39:28 MDT --- Created an attachment (id=315731) --> (http://bugzilla.novell.com/attachment.cgi?id=315731) updated openssl package for i586 and x86_64 if these packages are not the for your arch,please info me.thanks -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User gjhe@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c28 --- Comment #28 from Guanjun He 2009-08-28 03:55:20 MDT --- (In reply to comment #27)

These packages make arora working for me again.

great,thanks -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User coolo@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c30 --- Comment #30 from Stephan Kulow 2009-08-31 06:16:40 MDT --- please do not submit to internal build service. our factory distribution is open and this openess relies on submits being visible on build.opensuse.org -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=526319 User binner@kde.org added comment http://bugzilla.novell.com/show_bug.cgi?id=526319#c32 Stephan Binner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #32 from Stephan Binner 2009-09-02 11:11:39 MDT --- Fixed package was checked into Factory. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.