Bug 527895 - can't connect to repositories that don't have TLS1.0 enabled with Bugzilla connector
Summary: can't connect to repositories that don't have TLS1.0 enabled with Bugzilla co...
Status: CLOSED MOVED
Alias: None
Product: z_Archived
Classification: Eclipse Foundation
Component: Mylyn (show other bugs)
Version: unspecified   Edit
Hardware: PC Windows 10
: P1 critical with 1 vote (vote)
Target Milestone: 3.24   Edit
Assignee: Frank Becker CLA
QA Contact: Frank Becker CLA
URL:
Whiteboard:
Keywords: helpwanted
: 540761 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-11-28 19:39 EST by Sam Davis CLA
Modified: 2018-11-12 15:49 EST (History)
6 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam Davis CLA 2017-11-28 19:39:23 EST
The bugzilla connector seems to not work with https://bugs.eclipse.org/bugs. If you create a new repo, refreshing the config fails and you can't create useful queries. If you do create a query, it retrieves tasks but fails to open them. In workspaces that already have the repo config from before, queries work fine. I tested the connector with https://landfill.bugzilla.org/bugzilla-5.0-branch/ and there were no problems so this seems to be specific to https://bugs.eclipse.org/bugs/.
Comment 1 Frank Becker CLA 2017-11-29 14:28:42 EST
Sam,

I run successful the unit tests for http://mylyn.org/bugzilla-5.0.3/ and http://localhost:2080/bugzilla-rest-5.0.3/.

Next step is to look where we fail in https://bugs.eclipse.org/bugs
Comment 2 Frank Becker CLA 2017-11-29 14:41:33 EST
We get the error in org.eclipse.mylyn.internal.bugzilla.core.BugzillaClient.getBugzillaLoginTokenIfExists(IProgressMonitor)

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
Comment 3 Eclipse Webmaster CLA 2017-11-29 16:53:44 EST
This may be a side effect of 527549.  We've re-enabled TLSv1.0, but I'll bet there's cipher issue. I've turned on some 'weaker' ciphers so let me know if that fixes this.  If it does we'll need to work out which cipher you actually need so I can disable the rest.

-M.
Comment 4 Frank Becker CLA 2017-11-30 10:52:49 EST
(In reply to comment #3)
> This may be a side effect of 527549.  We've re-enabled TLSv1.0, but I'll bet
> there's cipher issue. I've turned on some 'weaker' ciphers so let me know if
> that fixes this.  If it does we'll need to work out which cipher you actually
> need so I can disable the rest.
> 
> -M.

Yes, now I can connect to https://bugs.eclipse.org/bugs.
Comment 5 Frank Becker CLA 2017-11-30 11:45:24 EST
(In reply to comment #3)
> This may be a side effect of 527549.  We've re-enabled TLSv1.0, but I'll bet
> there's cipher issue. I've turned on some 'weaker' ciphers so let me know if
> that fixes this.  If it does we'll need to work out which cipher you actually
> need so I can disable the rest.
> 
> -M.

If you can tell me what steps you did when you disable TLSv1.0 and what ciphers get turned off I can try to chang my local test environment and prepers a fix so that mylyn bugzilla connector no longer need  TLSv1.0.

Or is it possible that you can only configure that https://bugs.eclipse.org/bugstest use your new settings?
Comment 6 Eclipse Webmaster CLA 2017-11-30 16:32:47 EST
(In reply to Frank Becker from comment #5)

> If you can tell me what steps you did when you disable TLSv1.0 

We simply removed TLS1.0 from the list of supported protocols on the webserver.  Since this has caused a little chaos externally and internally we've turned it back on for now.

> ciphers get turned off I can try to chang my local test environment and
> prepers a fix so that mylyn bugzilla connector no longer need  TLSv1.0.

We had turned off any AES128(most of which seem to be SSLv3) ciphers, but Java seems to like them so for now we've turned them on.

>Or is it possible that you can only configure that https://bugs.eclipse.org
>/bugstest use your new settings?

No, bugstest is served by the same hosts as the main instance, so it's sort of all or nothing.

-M.
Comment 7 Eclipse Genie CLA 2017-12-02 09:53:07 EST
New Gerrit change created: https://git.eclipse.org/r/112753
Comment 8 Eclipse Webmaster CLA 2018-01-08 16:11:43 EST
Anything else I can do here?

-M.
Comment 9 Frank Becker CLA 2018-01-09 05:55:20 EST
(In reply to Eclipse Webmaster from comment #8)
> Anything else I can do here?
> 
> -M.

Maybe someone can help my with the following problem.

For a Fix I need to merge some gerrit reviews for the needed changes of the local test environment.

But the build for review

   https://git.eclipse.org/r/112753 Hudson job https://hudson.eclipse.org/mylyn/job/gerrit-mylyn-commons/428/

fails and I have no idea how to solve the org.osgi.framework.BundleException error
(see https://hudson.eclipse.org/mylyn/view/Gerrit/job/gerrit-mylyn-commons/ws/org.eclipse.mylyn.commons.tests/target/work/configuration/1513626063219.log/*view*/).
Comment 10 Eclipse Webmaster CLA 2018-01-10 14:24:31 EST
Fred or Mikael, can you offer any insight?

-M.
Comment 11 Mikaël Barbero CLA 2018-01-15 03:47:06 EST
I guess other Mylyn committers could help here, as Frank's change does not touch anything beside a java file. Adding Sam to cc list.
Comment 12 Frank Becker CLA 2018-01-15 14:41:45 EST
(In reply to Mikaël Barbero from comment #11)
> I guess other Mylyn committers could help here, as Frank's change does not
> touch anything beside a java file. Adding Sam to cc list.

I think I have narrowed down the problem. I create review https://git.eclipse.org/r/115411
Comment 13 Mikaël Barbero CLA 2018-03-07 15:16:32 EST
I guess this one can be marked as resolved?
Comment 14 Frank Becker CLA 2018-03-08 15:05:21 EST
No this was not really fixed. We need a fix in mylyn and not by enable the removed TLS1.0
Comment 15 Frank Becker CLA 2018-03-08 16:29:24 EST
I can not reproduce this with my test environment.

I need the list of enabled ciphers so that i can compare this with my local apache2 settings.
Comment 16 Sam Davis CLA 2018-03-08 17:45:40 EST
Frank, are you saying the connector does not support repositories that don't have TLS1.0 enabled? If so, please update the summary of this bug accordingly.
Comment 18 Holger Voormann CLA 2018-11-06 13:06:24 EST
*** Bug 540761 has been marked as a duplicate of this bug. ***
Comment 19 Chris Jordan CLA 2018-11-06 14:17:07 EST
Evidently 540761 is not a /duplicate/. 540761 says "Unexpected error while creating task for error report" and this doesn't. All that can be deduced from your evidence is that they two may be causally related.
Comment 20 Frank Becker CLA 2018-11-12 15:49:15 EST
I can not setup my test environment so that I can reproduce this.

If someone has a test instance that I can access then I can continue on the Mylyn side.
Comment 21 Eclipse Webmaster CLA 2022-11-15 11:45:08 EST
Mylyn has been restructured, and our issue tracking has moved to GitHub [1].

We are closing ~14K Bugzilla issues to give the new team a fresh start. If you feel that this issue is still relevant, please create a new one on GitHub.

[1] https://github.com/orgs/eclipse-mylyn