Home / server / Questions / 314414
Accepted
amarillion
Asked: 2011-09-23 07:03:20 +0800 CST

Is our company firewall blocking http PROPFIND?

  • 772

Subversion is an essential tool for programmers. It is a real pain if subversion is suddenly blocked because of a reconfiguration of a company firewall. This has actually happened to me two times at two different jobs now.

Subversion traffic is over http (port 80), but, as far as I understand, it is special in the sense that it makes use of the PROPFIND http request type, which is not part of ordinary web traffic.

To prove that indeed PROPFIND was being blocked by our firewall, I did the following:

  • svn command from inside the company works fine. For example:

    svn log http://svn.bigcat.unimaas.nl/pathvisio

  • The same svn commands from outside the company hangs indefinitely. I confirmed this on three different outside locations. (A collegue reported a timeout message that mentions PROPFIND)
  • Browsing to this page: http://svn.bigcat.unimaas.nl/pathvisio/ works fine from inside and outside.

  • To show that it's not somehow a subversion problem, you can get the same effect with curl. The following command works from inside, but hangs indefinitely from outside:

    curl http://svn.bigcat.unimaas.nl/pathvisio/ -H "Depth: 0" --request PROPFIND

  • An ordinary GET request works both inside and outside:

    curl http://svn.bigcat.unimaas.nl/pathvisio/

In both jobs, when I raised the issue with ICTS, their response was something like: "port 80 is open, we can't reproduce", and they just ignore my talk on http request types.

My questions are:

  • To be absolutely sure, is my method sufficient to prove that the problem is in blocking PROPFIND?
  • Do firewalls commonly block PROPFIND?
  • Can you give me suggestions how to explain this problem in the right language / terminology so that ICTS responds to it? I never administered a company firewall, I have no idea how that goes.
firewall svn

3 Answers

  1. Best Answer

    I think your method is sufficient to indicate that the firewall seems to be blocking PROPFIND requests. And yes, it's not uncommon for firewalls to block HTTP methods that are rarely (or less commonly used). There's not really any special language you need to use to explain it to them, a good firewall administrator will already know that he's got these lesser used methods blocked.

    • 2

  2. Use a network capture software like Wireshark to see the traffic when using SVN and when using a web browser and compare the two captures. Use "Follow TCP stream" from the context menu of Wireshark to see the HTTP conversation.

    • 1
    • Do firewalls commonly block PROPFIND?

    I am sure, no.

    • -2