Could not handshake error in the pull function

GnuTLS on Ubuntu 18.04 fails with TLS handshake failed: ‘Error in the pull function’ #1411

Bug summary

I’m on Ubuntu 18.04 (elementary OS Juno), amd64 architecture, kernel 5.0.0-27-generic , using the Ubuntu repository, apt show gives the package version as 2.6-1 .

I’m connecting to bnc.irccloud.org:6697 via TLS, as documented on their blog.

I added the server like so:

GnuTLS shows the certificate as valid:

Here’s a text version of what I see:

The key lines appear to be:

OpenSSL also shows that the certificate is valid:

echo quit | openssl s_client -connect bnc.irccloud.com:6697

IRCCloud has also sent their TLS security test results, which show that everything is working alright.

It’s interesting to me that it’s trying a 2048-bit Diffie-Hellman exchange rather than using ECDH variants.

I have attempted to use the TLS workarounds described in the WeeChat FAQ, including disabling SSL verification, changing the supported ciphers, setting the GnuTLS CA certificate file, etc. and nothing seems to help the situation

Steps to reproduce

1. Using Ubuntu 18.04, install WeeChat using the provided Ubuntu repository.
2. Attempt to connect to bnc.irccloud.com:6697 with TLS enabled.
3. Observe that it cannot complete the TLS handshake.

Current behavior

Expected behavior

Suggested solutions

Additional information

• WeeChat version: 2.6-1
• OS, distribution and version: Ubuntu 18.04, amd64, kernel 5.0.0-27-generic.

The text was updated successfully, but these errors were encountered:

I have reported this issue just to leave a breadcrumb trail for others. It turns out that my office network seems to interfere with connecting to bnc.irccloud.com:6697 and this is what is killing the TLS connection.

It appears that this is what happens in order:

• Client opens TCP connection, sends its information like acceptable ciphers, etc.
• Server sends back its acceptable ciphers and its certificate.
• Client validates that the certificate is valid and then begins to initiate Diffie-Hellman key exchange.
• At this point, things fail for some reason: maybe my office network is attempting to MITM the connection?

In any case, hopefully this helps someone in the future. Try using multiple networks when attempting to debug issues like this.

Источник

TLS gnutls_handshake() failed: Error in pull function when using proxy server from client machine. #1920

Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/.):

What keywords did you search in NGINX Ingress controller issues before filing this one? (If you have found any duplicates, you should instead reply there.):

Is this a BUG REPORT or FEATURE REQUEST? (choose one):

NGINX Ingress controller version:

«name»: «nginx-ingress-controller»,
«image»: «quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.9.0»,
«args»: [
«/nginx-ingress-controller»,
«—default-backend-service=$(POD_NAMESPACE)/default-http-backend»,
«—configmap=$(POD_NAMESPACE)/nginx-configuration»,
«—tcp-services-configmap=$(POD_NAMESPACE)/tcp-services»,
«—udp-services-configmap=$(POD_NAMESPACE)/udp-services»,
«—annotations-prefix=nginx.ingress.kubernetes.io»

Environment:

• Cloud provider or hardware configuration: None — Bare-Metal
• OS (e.g. from /etc/os-release): Ubuntu 16.04
• Kernel (e.g. uname -a ): Linux nginx 4.4.0-104-generic

Add configuration and annotation for port_in_redirect #127 -Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

What happened: Ingress SSL connections do not work properly when using a proxy server on client machine attempting connections.

Standard http-server -S -C tls.crt -K tls.key -p 443 running on the exposed machine allows the connection through and works just fine.

But when using the nginx-ingress-controller the ssl connection does not establish. To clarify TLS works perfectly in chrome, firefox, iPhone, MacBook, etc. etc. Google crawls the site just fine using the SSL ports etc. But when routed through a proxy server the connection succeeds but there is an error message.

curl -v response below.

HTTP/1.1 200 Connection Established
Proxy replied OK to CONNECT request
ALPN, offering http/1.1
gnutls_handshake() failed: Error in the pull function.
Closing connection 0
curl: (35) gnutls_handshake() failed: Error in the pull function.

When I disabled the nginx-ingress-controller by setting the port to 8080 and 6443 and running the http-server command above and bound to 443 it works just fine.

What you expected to happen:
SSL to work

How to reproduce it (as minimally and precisely as possible):
route traffic through a http proxy server and you will see the error.

Anything else we need to know:
Zscalar is the proxy being used.

The text was updated successfully, but these errors were encountered:

Источник

16.04 — завиток: (35) gnutls_handshake () не удалось: ошибка в функции pull

При попытке подключиться к веб-сайтам HTTPS я получаю эту ошибку curl: (35) gnutls_handshake() failed: Error in the pull function..

curl -vvv «https://example.tld» * Rebuilt URL to: https://example.tld/ * Trying 1.2.3.4. * Connected to example.tld (1.2.3.4) port 443 (#0) * found 148 certificates in /etc/ssl/certs/ca-certificates.crt * found 592 certificates in /etc/ssl/certs * ALPN, offering http/1.1 * gnutls_handshake() failed: Error in the pull function. * Closing connection 0 curl: (35) gnutls_handshake() failed: Error in the pull function.

Конфигурация TLS этого веб-сайта, похоже, настроена правильно.

$ curl -V curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP UnixSockets $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial

2 ответа

Я получил это точное сообщение, когда пытался получить доступ к странице статистики https://mmonit.com/monit/ по https, но не имел белого, указанного в моем IP-адресе клиента для файла конфигурации monit.

Ваш вопрос не относится к monit, конечно, но, возможно, есть что-то, блокирующее запрос таким же образом (например, брандмауэр), поэтому ssl-рукопожатие не проходит.

Я получил это точное сообщение, когда пытался получить доступ к странице статистики https://mmonit.com/monit/ по https, но не имел белого, указанного в моем IP-адресе клиента, для файла конфигурации monit.

Ваш вопрос не относится к monit, конечно, но, возможно, есть что-то, блокирующее запрос таким же образом (например, брандмауэр), поэтому ssl-рукопожатие не проходит.

Источник

Bitbucket Support

Knowledge base

Products

Jira Software

Project and issue tracking

Jira Service Management

Service management and customer support

Jira Work Management

Manage any business project

Confluence

Bitbucket

Git code management

Resources

Documentation

Usage and admin help

Answers, support, and inspiration

Suggestions and bugs

Feature suggestions and bug reports

Marketplace

Billing and licensing

Frequently asked questions

Viewport

Confluence

error: gnutls_handshake() failed: A TLS warning alert has been received.

Related content

Still need help?

The Atlassian Community is here for you.

Symptoms

This issue can manifest in 2 ways:

First way:

Performing around a hundred of subsequent cloning or pushing operations directly to Bitbucket Server results in the following error:

Second way:

The error message below has been perceived while frequently running git fetch from clients when Bitbucket Server using HTTPS .

If you’re running into the error below, setting Git on your client to DEBUG should uncover the same message as seen in the First way:

Cause

We’ve seen this issue being caused by either one of the causes below:

1) Bitbucket Server:

This happens if your Bitbucket Server instance is running on a Java 7 that contains a bug in the TLS/SSL stack.

2) Git Client

The client performing the git fetch operation has run into a bug found libcurl3-gnutls introduced on the 7.21.6-3 release when using HTTPS.

Resolution

1) Bitbucket Server

As a workaround for this Java bug, you can attach the following parameter to your Tomcat HTTPS connector. The solution has been described here:

2) Git Client

As reported by a user on the previously linked bug, d owngrading libcurl3-gnutls from 7.21.6-3 to 7.21.0-1 is an easy way to solve this issue. See the user’s comment:

> I had the same problem, here.
> Downgrading libcurl3-gnutls from 7.21.6-3 to 7.21.0-1 fixed it for me.

Alternatively, if you are trying these operations from a client running Ubuntu, you can find on their forum a workaround to compile your git on the client with openssl , moving off from libcurl3-gnutls .

Quoting the solution from the Ubuntu forum above:

Then, edit debian/control file (run the command: gksu gedit debian/control ) and replace all instances of libcurl4-gnutls-dev with libcurl4-openssl-dev .

Then build the package (if it’s failing on test, you can remove the line TEST=test from the file debian/rules ):

Install the new package:

i386: sudo dpkg -i ../git_1.7.9.5-1_i386.deb

x86_64: sudo dpkg -i ../git_1.7.9.5-1_amd64.deb

Источник

Ubuntu 16.04 openssl s_client write:errno=104

I’m getting the following error when trying to connect to github.com, google.com, dropbox.com via https, but stackoverflow.com, askubuntu.com and the majority of https websites work.

• I’m behind a work proxy, but I can connect fine when using Fedora 28, it’s just on Ubuntu 16.04 that I have the problem. No one else in the office has the problem, but they are mostly using Macs.
• This is on my own desktop, not on a server/VM/Docker etc.
• I can connect to these websites via my mobile hotspot or on other WiFi networks
• Edit: I tested on a separate Thinkpad laptop with Ubuntu 16.04 and there is no problem on there. So it’s something specific to this machine (a Dell XPS 13 9370).

I’ve upgraded OpenSSL to the most recent version but that makes no difference:

I get the following error when running CURL:

There’s numerous other answers that have similar problems but I can’t find any that deal with my situation:

Here’s an example of it working with stackoverflow.com:

This is the relevant ifconfig details for the proxy connection:

Edit: Output of ldd $(which curl) :

Edit 2: Thanks to Simon Sutter for his comments. I have updated to Ubuntu 18.04 in an attempt to resolve it but there are still the similar problems.

Actually the curl error is now slightly different which is useful:

Searching for the SSL_ERROR_SYSCALL bug I came across a SO answer that suggests it might have something to do with IPv6 and suggests trying wget . This is what I get with wget :

Interestingly from that google makes an IPv6 request but stackoverflow doesn’t. However a further check shows that I have an issue with bitbucket.org too and that makes no indication of an IPv6 connection:

I did some further checking on this by disabling IPv6 but that made no difference — as in I get the same errors when running curl or wget .

Now because I’m on Ubuntu 18.04 here’s an updated set of checks.

Relevant ifconfig details:

env | grep -i proxy returns nothing.

If it is a certificate error somewhere in the chain I know that I did install a work CA certificate when I first setup the computer.

Edit 3:

Here’s a list of the sites that work:

• https://duckduckgo.com
• https://*.stackexchange.com
• https://stackoverflow.com
• https://www.getharvest.com/
• https://www.bbc.com/news
• https://egghead.io
• https://news.ycombinator.com
• https://www.speedtest.net/
• https://ipleak.net/ — indicates that I have no IPv6 connection
• https://*.atlassian.net (but bitbucket.org fails)

A list of the sites that fail:

• https://google.com
• https://dropbox.com
• https://outlook.live.com/owa/
• https://bitbucket.org
• https://www.facebook.com/
• https://www.slack.com
• https://twitter.com
• https://github.com

The site at https://outlook.office.com/owa/?bO=1 has experienced a network protocol violation that cannot be repaired.

Edit 4:

I think I’ve made some progress with my Ubuntu problems. It works on a separate Ubuntu 16 laptop that I’ve tried. Further, I think I’ve tracked it down to a firewall issue (via this Security.SE answer) and the handling of TLS v1.1 vs TLS v1.2.

I tracked down which sites I could access vs not access (above). An interesting example is bitbucket.org (fails) vs atlassian.net (works).

Then if I try with openssl (forcing TLS v1.1):

So I think that the firewall might be blocking TLS v1.2 traffic in some way.

On my other Ubuntu machine when I run:

Also the same works on​ a Mac that I tried.

Источник

Страницы: 1 [2]  Все   Вниз

0 Пользователей и 1 Гость просматривают эту тему.

Страницы: 1 [2]  Все   Вверх

as promised…

1. Installing OMV from DVD (+ administration settings — certificate, password etc) — it`s OK

2. No updates installing, no plugins installing, checking updates — it`s OK

3. Turn on «Community-maintained updates.» (off by defaut), save, check updates — «Could not handshake» and «no Release file»

4. Turn off «Community-maintained updates.», reset, save, check updates — «Could not handshake» and «no Release file»

5. Turn off «Community-maintained updates.», reset SEVERAL TIMES, check updates — it`s OK (may be timeout exists)

6. Install OMV-Extras via terminal — «Could not handshake» and «no Release file», but OMV-Extras presents in Plugins

7. Trying to add Extras plugin repo — unsuccesfull, «Could not handshake» and «no Release file», only way to revert config

8. While OMV-Extras is added, OMV-FIRSTAID don`t works (!) — see output

/root$ omv-firstaid
Traceback (most recent call last):
File "/usr/sbin/omv-firstaid", line 90, in <module>
sys.exit(main())
File "/usr/sbin/omv-firstaid", line 55, in main
modules = load_modules()
File "/usr/sbin/omv-firstaid", line 42, in load_modules
mod = __import__(modname)
File "/usr/share/openmediavault/firstaid/modules.d/61aptclean.py", line 22, in <module>
import openmediavault.procutils
ModuleNotFoundError: No module named 'openmediavault.procutils'

9. After uninstall OMV-Extras via web-admin — OMV-FIRSTAID is OK

10. The probability of successfully updates (or plugins) checking after this config manipulations about 5-10%

I remember — it was NEW fresh installation

Something wrong with new repos!

greplogs -l -e 'gnutls_handshake() failed: Error in the pull function.' --since=2022-05-10
2022-06-07T18:31:49-ef2567c/linux-amd64-longtest

This one contains more logging due to the inclusion of CL 409575:

go test proxy running at GOPROXY=http://127.0.0.1:33855/mod
--- FAIL: TestScript (0.01s)
    --- FAIL: TestScript/gopath_moved_repo (1.00s)
        script_test.go:272: 
            # (2022-06-07T18:54:31Z)
            # Test that 'go get -u' reports packages whose VCS configurations do not
            # match their import paths. (0.000s)
            # We need to execute a custom Go program to break the config files.
            #
            # git will ask for a username and password when we run 'go get -d -f -u',
            # so we also need to set GIT_ASKPASS. Conveniently, a single binary can
            # perform both tasks! (0.555s)
            # Test that 'go get -u' reports moved git packages. (0.439s)
            > [exec:git] go get -d rsc.io/pdf
            [stderr]
            # cd $WORK/gopath/src/rsc.io; git clone -- https://github.com/rsc/pdf $WORK/gopath/src/rsc.io/pdf
            Cloning into '$WORK/gopath/src/rsc.io/pdf'...
            18:54:31.678227 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
            18:54:31.681371 http.c:756              == Info:   Trying 140.82.114.3:443...
            18:54:31.706505 http.c:756              == Info: Connected to github.com (140.82.114.3) port 443 (#0)
            18:54:31.790700 http.c:756              == Info: found 387 certificates in /etc/ssl/certs
            18:54:31.790893 http.c:756              == Info: ALPN, offering h2
            18:54:31.790909 http.c:756              == Info: ALPN, offering http/1.1
            18:54:31.818991 http.c:756              == Info: SSL connection using TLS1.3 / ECDHE_RSA_AES_128_GCM_SHA256
            18:54:31.821982 http.c:756              == Info: 	 server certificate verification OK
            18:54:31.821996 http.c:756              == Info: 	 server certificate status verification SKIPPED
            18:54:31.822153 http.c:756              == Info: 	 common name: github.com (matched)
            18:54:31.822162 http.c:756              == Info: 	 server certificate expiration date OK
            18:54:31.822167 http.c:756              == Info: 	 server certificate activation date OK
            18:54:31.822180 http.c:756              == Info: 	 certificate public key: EC/ECDSA
            18:54:31.822185 http.c:756              == Info: 	 certificate version: #3
            18:54:31.822225 http.c:756              == Info: 	 subject: C=US,ST=California,L=San Francisco,O=GitHub, Inc.,CN=github.com
            18:54:31.822235 http.c:756              == Info: 	 start date: Tue, 15 Mar 2022 00:00:00 GMT
            18:54:31.822242 http.c:756              == Info: 	 expire date: Wed, 15 Mar 2023 23:59:59 GMT
            18:54:31.822264 http.c:756              == Info: 	 issuer: C=US,O=DigiCert Inc,CN=DigiCert TLS Hybrid ECC SHA384 2020 CA1
            18:54:31.822283 http.c:756              == Info: ALPN, server accepted to use h2
            18:54:31.822323 http.c:756              == Info: Using HTTP2, server supports multi-use
            18:54:31.822329 http.c:756              == Info: Connection state changed (HTTP/2 confirmed)
            18:54:31.822336 http.c:756              == Info: Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
            18:54:31.822429 http.c:756              == Info: Using Stream ID: 1 (easy handle 0x564ed7140430)
            18:54:31.822470 http.c:703              => Send header, 0000000191 bytes (0x000000bf)
            18:54:31.822479 http.c:715              => Send header: GET /rsc/pdf/info/refs?service=git-upload-pack HTTP/2
            18:54:31.822483 http.c:715              => Send header: Host: github.com
            18:54:31.822486 http.c:715              => Send header: user-agent: git/2.30.2
            18:54:31.822488 http.c:715              => Send header: accept: */*
            18:54:31.822493 http.c:715              => Send header: accept-encoding: deflate, gzip, br
            18:54:31.822496 http.c:715              => Send header: pragma: no-cache
            18:54:31.822499 http.c:715              => Send header: git-protocol: version=2
            18:54:31.822502 http.c:715              => Send header:
            18:54:31.847592 http.c:756              == Info: Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
            18:54:31.870791 http.c:703              <= Recv header, 0000000013 bytes (0x0000000d)
            18:54:31.870817 http.c:715              <= Recv header: HTTP/2 200
            18:54:31.870848 http.c:703              <= Recv header, 0000000026 bytes (0x0000001a)
            18:54:31.870853 http.c:715              <= Recv header: server: GitHub Babel 2.0
            18:54:31.870859 http.c:703              <= Recv header, 0000000059 bytes (0x0000003b)
            18:54:31.870863 http.c:715              <= Recv header: content-type: application/x-git-upload-pack-advertisement
            18:54:31.870867 http.c:703              <= Recv header, 0000000054 bytes (0x00000036)
            18:54:31.870870 http.c:715              <= Recv header: content-security-policy: default-src 'none'; sandbox
            18:54:31.870874 http.c:703              <= Recv header, 0000000040 bytes (0x00000028)
            18:54:31.870880 http.c:715              <= Recv header: expires: Fri, 01 Jan 1980 00:00:00 GMT
            18:54:31.870891 http.c:703              <= Recv header, 0000000018 bytes (0x00000012)
            18:54:31.870894 http.c:715              <= Recv header: pragma: no-cache
            18:54:31.870898 http.c:703              <= Recv header, 0000000053 bytes (0x00000035)
            18:54:31.870901 http.c:715              <= Recv header: cache-control: no-cache, max-age=0, must-revalidate
            18:54:31.870905 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
            18:54:31.870909 http.c:715              <= Recv header: vary: Accept-Encoding
            18:54:31.870913 http.c:703              <= Recv header, 0000000052 bytes (0x00000034)
            18:54:31.870917 http.c:715              <= Recv header: x-github-request-id: B303:511E:EDA6:1892A:629F9EE7
            18:54:31.870921 http.c:703              <= Recv header, 0000000023 bytes (0x00000017)
            18:54:31.870924 http.c:715              <= Recv header: x-frame-options: DENY
            18:54:31.870929 http.c:703              <= Recv header, 0000000002 bytes (0x00000002)
            18:54:31.870932 http.c:715              <= Recv header:
            18:54:31.885018 http.c:756              == Info: Closing connection 0
            18:54:31.889791 http.c:756              == Info: Couldn't find host github.com in the .netrc file; using defaults
            18:54:31.889821 http.c:756              == Info: Hostname github.com was found in DNS cache
            18:54:31.889849 http.c:756              == Info:   Trying 140.82.114.3:443...
            18:54:31.915207 http.c:756              == Info: Connected to github.com (140.82.114.3) port 443 (#1)
            18:54:31.994652 http.c:756              == Info: found 387 certificates in /etc/ssl/certs
            18:54:31.994958 http.c:756              == Info: ALPN, offering h2
            18:54:31.995010 http.c:756              == Info: ALPN, offering http/1.1
            18:54:31.995038 http.c:756              == Info: SSL re-using session ID
            18:54:32.024572 http.c:756              == Info: gnutls_handshake() failed: Error in the pull function.
            18:54:32.024663 http.c:756              == Info: Closing connection 1
            error: RPC failed; curl 35 gnutls_handshake() failed: Error in the pull function.
            fatal: expected flush after ref listing
            package rsc.io/pdf: exit status 128
            [exit status 1]
            FAIL: testdata/script/gopath_moved_repo.txt:21: unexpected command failure
            
FAIL
FAIL	cmd/go	177.649s