Bug#733039: libgnutls28: wget fails with GnuTLS error after libgnutls28 upgrade
On 2013-12-26 Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On 12/24/2013 10:17 PM, Neil Roeth wrote: This command will illustrate the problem: wget -O- -q https://api.dreamhost.com/ I can confirm that 3.2.7 seems to hang for me, when i do: [...] Hello, just as another data point, Git bisect says: --- 3ff8313d3eb53eed1a509e45d5f5103c87c1900d is the first bad commit commit 3ff8313d3eb53eed1a509e45d5f5103c87c1900d Author: Nikos Mavrogiannopoulos n...@gnutls.org Date: Wed Oct 23 18:53:45 2013 +0200 Added camellia-gcm into the default priority levels, and prioritized GCM over CBC everywhere. --- cu Andreas -- `What a good friend you are to him, Dr. Maturin. His other friends are so grateful to you.' `I sew his ears on from time to time, sure' -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#733039: libgnutls28: wget fails with GnuTLS error after libgnutls28 upgrade
On 12/24/2013 10:17 PM, Neil Roeth wrote: This command will illustrate the problem: wget -O- -q https://api.dreamhost.com/ I can confirm that 3.2.7 seems to hang for me, when i do: gnutls-cli --priority NORMAL api.dreamhost.com However, i can connect cleanly with: gnutls-cli --priority NORMAL:-DHE-DSS api.dreamhost.com I can avoid the same hang if i substitute any large-ish class of ciphers anywhere i put DHE-DSS above. Looking at the traffic on the wire, it looks like the non-hanging connections offer a ClientHello of size 256 bytes, while the hanging connections have size = 256 bytes. this smells a lot like the F5 bug with certain sizes of TLS handshakes, being misinterpreted as SSLv2, as reported by Xiaoyong Wu: http://thread.gmane.org/gmane.ietf.tls/11187/focus=11227 The way to resolve this would be: if the client hello is = 256 byees, but 512 bytes, add a meaningless extension to push the size of the client hello above 512 bytes. I haven't tested this yet, unfortunately. --dkg signature.asc Description: OpenPGP digital signature
Bug#733039: libgnutls28: wget fails with GnuTLS error after libgnutls28 upgrade
Package: libgnutls28 Version: 3.2.7-3 Severity: important I use wget in a cron job to connect to a URL and retrieve some information. After an upgrade from libgnutls28:amd64 3.2.4-4 to 3.2.7-3, an attempt to reach an encrypted site with wget fails with this error: GnuTLS: Error in the pull function. Unable to establish SSL connection. Reverting to 3.2.4-4 enabled it to connect immediately. Please let me know if you would like me to generate any particular kind of debugging output that would help resolve this problem. -- System Information: Debian Release: jessie/sid APT prefers unstable APT policy: (990, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 3.11-1-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages libgnutls28 depends on: ii libc6 2.17-97 ii libgmp10 2:5.1.2+dfsg-3 ii libhogweed2 2.7.1-1 ii libnettle4 2.7.1-1 ii libp11-kit0 0.20.1-3 ii libtasn1-6 3.4-2 ii multiarch-support 2.17-97 ii zlib1g 1:1.2.8.dfsg-1 libgnutls28 recommends no packages. Versions of packages libgnutls28 suggests: pn gnutls-bin -- no debconf information -- Neil Roeth -- Neil Roeth
Bug#733039: libgnutls28: wget fails with GnuTLS error after libgnutls28 upgrade
On 2013-12-24 Neil Roeth n...@debian.org wrote: Package: libgnutls28 Version: 3.2.7-3 Severity: important I use wget in a cron job to connect to a URL and retrieve some information. After an upgrade from libgnutls28:amd64 3.2.4-4 to 3.2.7-3, an attempt to reach an encrypted site with wget fails with this error: GnuTLS: Error in the pull function. Unable to establish SSL connection. Reverting to 3.2.4-4 enabled it to connect immediately. Please let me know if you would like me to generate any particular kind of debugging output that would help resolve this problem. [...] Could you post the URI? Can you connect with gnutls-cli(-debug)? tia, cu Andreas -- `What a good friend you are to him, Dr. Maturin. His other friends are so grateful to you.' `I sew his ears on from time to time, sure' -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#733039: libgnutls28: wget fails with GnuTLS error after libgnutls28 upgrade
On 12/24/2013 08:04 AM, Andreas Metzler wrote: On 2013-12-24 Neil Roeth n...@debian.org wrote: Package: libgnutls28 Version: 3.2.7-3 Severity: important I use wget in a cron job to connect to a URL and retrieve some information. After an upgrade from libgnutls28:amd64 3.2.4-4 to 3.2.7-3, an attempt to reach an encrypted site with wget fails with this error: GnuTLS: Error in the pull function. Unable to establish SSL connection. Reverting to 3.2.4-4 enabled it to connect immediately. Please let me know if you would like me to generate any particular kind of debugging output that would help resolve this problem. [...] Could you post the URI? Can you connect with gnutls-cli(-debug)? tia, cu Andreas The URI is https://api.dreamhost.com/ This command will illustrate the problem: wget -O- -q https://api.dreamhost.com/ I get similar behavior with gnutls-cli, it connects with libgnutls28-3.2.4 and hangs with libgnutls28-3.2.7. Attached are the two logs. Thanks. -- Neil Roeth # dpkg -i libgnutls28_3.2.4-4_amd64.deb dpkg: warning: downgrading libgnutls28:amd64 from 3.2.7-3 to 3.2.4-4 (Reading database ... 308240 files and directories currently installed.) Preparing to unpack libgnutls28_3.2.4-4_amd64.deb ... Unpacking libgnutls28:amd64 (3.2.4-4) over (3.2.7-3) ... Setting up libgnutls28:amd64 (3.2.4-4) ... Processing triggers for libc-bin (2.17-97) ... # gnutls-cli -d 10 api.dreamhost.com |2| ASSERT: pkcs11.c:425 Processed 165 CA certificate(s). Resolving 'api.dreamhost.com'... Connecting to '75.119.208.14:443'... |4| REC[0xd0bab0]: Allocating epoch #0 |2| ASSERT: gnutls_constate.c:581 |4| REC[0xd0bab0]: Allocating epoch #1 |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_AES_128_GCM_SHA256 (C0.2B) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_AES_128_CBC_SHA1 (C0.09) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_AES_128_CBC_SHA256 (C0.23) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_AES_256_GCM_SHA384 (C0.2C) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_AES_256_CBC_SHA1 (C0.0A) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_AES_256_CBC_SHA384 (C0.24) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_3DES_EDE_CBC_SHA1 (C0.08) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_ECDSA_ARCFOUR_128_SHA1 (C0.07) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_AES_128_GCM_SHA256 (C0.2F) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_AES_128_CBC_SHA1 (C0.13) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_AES_128_CBC_SHA256 (C0.27) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_AES_256_GCM_SHA384 (C0.30) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_AES_256_CBC_SHA1 (C0.14) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_3DES_EDE_CBC_SHA1 (C0.12) |3| HSK[0xd0bab0]: Keeping ciphersuite: ECDHE_RSA_ARCFOUR_128_SHA1 (C0.11) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_AES_128_GCM_SHA256 (00.9C) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1 (00.2F) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_AES_128_CBC_SHA256 (00.3C) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1 (00.35) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_AES_256_CBC_SHA256 (00.3D) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_CAMELLIA_128_CBC_SHA1 (00.41) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_CAMELLIA_256_CBC_SHA1 (00.84) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1 (00.0A) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_ARCFOUR_SHA1 (00.05) |3| HSK[0xd0bab0]: Keeping ciphersuite: RSA_ARCFOUR_MD5 (00.04) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_AES_128_GCM_SHA256 (00.9E) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1 (00.33) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA256 (00.67) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1 (00.39) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA256 (00.6B) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_CAMELLIA_128_CBC_SHA1 (00.45) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_CAMELLIA_256_CBC_SHA1 (00.88) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1 (00.16) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_AES_128_GCM_SHA256 (00.A2) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1 (00.32) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA256 (00.40) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA1 (00.38) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA256 (00.6A) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_CAMELLIA_128_CBC_SHA1 (00.44) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_CAMELLIA_256_CBC_SHA1 (00.87) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1 (00.13) |3| HSK[0xd0bab0]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1 (00.66) |3| EXT[0xd0bab0]: Sending extension STATUS REQUEST (5 bytes) |3| EXT[0xd0bab0]: Sending extension SERVER NAME (22 bytes) |3| EXT[0xd0bab0]: Sending extension SAFE RENEGOTIATION (1 bytes) |3| EXT[0xd0bab0]:
