This sounds a lot like the issues discussed in the changelog entry for OpenSSL 1.0.1a, however it is unclear which of the 3 workarounds listed are enabled by default and if there are any special application requirements for using them.
See further comments inline below. On 3/1/2013 5:01 PM, LANGLOIS Olivier PIS -EXT wrote:
This is strange. I am contacting this list because a bug has been open against openssl 1.0.1.e package: https://bugs.archlinux.org/task/33919 Some people do experience the bug, some don’t I have executed the following successfully curl --trace curl.out -O https://aur.archlinux.org/packages/li/linux-ck/linux-ck.tar.gz
Please try the trace again with openssl s_client from each tested OpenSSL version, to eliminate any issues in the curl code, such as the issues discussed in openssl-1.0.1e/CHANGES under the heading "Changes between 1.0.1a and 1.0.1b [26 Apr 2012]".
with openssl 1.0.0.e (on ubuntu) : Protocol version used: 3.1
Note: Protocol field 3.1 == TLS 1.0 Note: Record length not reported in e-mail
with 1.0.1.d: Protocol version used: 3.2
Note: Protocol field 3.2 == TLS 1.1 Note: Record length not reported in e-mail
but doesn’t work with 1.0.1.e. Beside additional cypher suites supported by more recent versions the most obvious difference I see is the protocol version. Maybe the protocol version can be controlled by a conf file setting. Would it be possible for you to post your curl.out content? == Info: About to connect() to aur.archlinux.org port 443 (#0) == Info: Trying 78.46.78.247... == Info: Connected to aur.archlinux.org (78.46.78.247) port 443 (#0) == Info: successfully set certificate verify locations: == Info: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none == Info: SSLv3, TLS handshake, Client hello (1): => Send SSL data, 338 bytes (0x152) 0000: 01 00 01 4e *03 03* 51 30 cf 22 22 b6 85 06 ca e6 ...N..Q0."".....
Note: Protocol field 3.3 = TLS 1.2 Note: record length 0x014e is longer than 255
0010: f0 4f 24 fe 92 8e 8f 37 3d 1c d2 d7 96 4f 0f 75 .O$....7=....O.u 0020: 83 2b be 39 05 d8 00 00 a0 c0 30 c0 2c c0 28 c0 .+.9......0.,.(. 0030: 24 c0 14 c0 0a c0 22 c0 21 00 a3 00 9f 00 6b 00 $.....".!.....k. 0040: 6a 00 39 00 38 00 88 00 87 c0 32 c0 2e c0 2a c0 j.9.8.....2...*. 0050: 26 c0 0f c0 05 00 9d 00 3d 00 35 00 84 c0 12 c0 &.......=.5..... 0060: 08 c0 1c c0 1b 00 16 00 13 c0 0d c0 03 00 0a c0 ................ 0070: 2f c0 2b c0 27 c0 23 c0 13 c0 09 c0 1f c0 1e 00 /.+.'.#......... 0080: a2 00 9e 00 67 00 40 00 33 00 32 00 9a 00 99 00 [email protected]..... 0090: 45 00 44 c0 31 c0 2d c0 29 c0 25 c0 0e c0 04 00 E.D.1.-.).%..... 00a0: 9c 00 3c 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 ..<./...A....... 00b0: 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 ................ 00c0: 11 00 08 00 06 00 03 00 ff 01 00 00 85 00 00 00 ................ 00d0: 16 00 14 00 00 11 61 75 72 2e 61 72 63 68 6c 69 ......aur.archli 00e0: 6e 75 78 2e 6f 72 67 00 0b 00 04 03 00 01 02 00 nux.org......... 00f0: 0a 00 34 00 32 00 0e 00 0d 00 19 00 0b 00 0c 00 ..4.2........... 0100: 18 00 09 00 0a 00 16 00 17 00 08 00 06 00 07 00 ................ 0110: 14 00 15 00 04 00 05 00 12 00 13 00 01 00 02 00 ................ 0120: 03 00 0f 00 10 00 11 00 0d 00 22 00 20 06 01 06 ..........". ... 0130: 02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03 ................ 0140: 01 03 02 03 03 02 01 02 02 02 03 01 01 00 0f 00 ................ 0150: 01 01 .. == Info: Unknown SSL protocol error in connection to aur.archlinux.org:443 == Info: Closing connection 0 Protocol version is at byte offset 4 & 5. *From:*[email protected] [mailto:[email protected]] *On Behalf Of *Le Huang *Sent:* Thursday, February 28, 2013 8:17 PM *To:* [email protected] *Subject:* Re: TLS ClientHello v3.3 not supported by all servers Olivier, The command line you provided just worked fine in my box, in which a fresh openssl-1.0.1e installed. On Fri, Mar 1, 2013 at 7:31 AM, LANGLOIS Olivier PIS -EXT <[email protected] <mailto:[email protected]>> wrote: They just reset the connection upon the reception of the message. This is a new behavior from version 1.0.1-e 1.0.1-d was which sending ClientHello v3.2 are fine. How to reproduce: openssl s_client -connect aur.archlinux.org:443 <http://aur.archlinux.org:443>
Enjoy Jakob -- Jakob Bohm, CIO, Partner, WiseMo A/S. http://www.wisemo.com Transformervej 29, 2730 Herlev, Denmark. Direct +45 31 13 16 10 This public discussion message is non-binding and may contain errors. WiseMo - Remote Service Management for PCs, Phones and Embedded ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
