<html><body><div style="color:#000; background-color:#fff; font-family:verdana, helvetica, sans-serif;font-size:10pt"><div>Good Morning Kurt,</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;">just one question. I think Alessandro reasigned the bug to both libssl and libgnutls. Am I correct?</div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;">Question is because specifying the protocol solves the problem with libssl, not with libgnutls. When I test wget with --secure-protocol it works fine when compiled with libssl but it keeps failing with libgnutls.</div><div style="color:
rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;">Could you please confirm the fact that the case is still open in libgnutls or should I file a new bug?</div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;">Best regards.</div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: verdana,helvetica,sans-serif; background-color: transparent; font-style: normal;">Francisco.<br></div> <div style="font-family: verdana, helvetica, sans-serif; font-size:
10pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">De:</span></b> Debian Bug Tracking System <owner@bugs.debian.org><br> <b><span style="font-weight: bold;">Para:</span></b> rodrifra <sable_laser@yahoo.es> <br> <b><span style="font-weight: bold;">Enviado:</span></b> Miércoles 22 de Mayo de 2013 18:21<br> <b><span style="font-weight: bold;">Asunto:</span></b> Bug#709292 closed by Kurt Roeckx <kurt@roeckx.be> (Re: Bug#709292: curl: Connection to https server produces SSL error.)<br> </font> </div> <div class="y_msg_container"><br>This is an automatic notification regarding your Bug report<br>which was filed against the libssl1.0.0 package:<br><br>#709292: libssl1.0.0: "decryption failed or bad record mac" during handshake<br><br>It has been closed by Kurt Roeckx <<a ymailto="mailto:kurt@roeckx.be"
href="mailto:kurt@roeckx.be">kurt@roeckx.be</a>>.<br><br>Their explanation is attached below along with your original report.<br>If this explanation is unsatisfactory and you have not received a<br>better one in a separate message then please contact Kurt Roeckx <<a ymailto="mailto:kurt@roeckx.be" href="mailto:kurt@roeckx.be">kurt@roeckx.be</a>> by<br>replying to this email.<br><br><br>-- <br>709292: <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=709292" target="_blank">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=709292</a><br>Debian Bug Tracking System<br>Contact <a ymailto="mailto:owner@bugs.debian.org" href="mailto:owner@bugs.debian.org">owner@bugs.debian.org</a> with problems<br>On Wed, May 22, 2013 at 02:32:29PM +0200, Alessandro Ghedini wrote:<br>> reassign 709292 libssl1.0.0<br>> retitle 709292 libssl1.0.0: "decryption failed or bad record mac" during handshake<br>> clone 709292 -1<br>> reassign -1
libgnutls26<br>> retitle -1 libgnutls26: segfaults during handshake<br>> severity -1 important<br>> affects -1 wget<br>> kthxbye<br>> <br>> On Wed, May 22, 2013 at 01:37:35PM +0200, rodrifra wrote:<br>> > Package: curl<br>> > Version: 7.26.0-1+wheezy2<br>> > Severity: normal<br>> > <br>> > Dear Maintainer,<br>> > <br>> > Executing the following:<br>> > curl -o pruebacurl.html <a href="https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html" target="_blank">https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html</a><br>> > Produced the next error:<br>> > error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac<br>> > <br>> > Forcing SSLv3 solves the problem:<br>> > curl -3 -o
pruebacurl.html <a href="https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html" target="_blank">https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html</a><br>> <br>> If there's any bug, it's probably in the server's SSL implementation, since it<br>> can't do a proper TLS handshake, in any case it's not curl's fault. I'm<br>> reassigning this to openssl (which is what curl uses) to make sure there's<br>> nothing wrong with it.<br><br>Yes, this is the server's problems, nothing you can do about it<br>other than downgrading to a lower TLS version. TLS 1.0<br>should work in most cases. About 1% of the servers are known to<br>have this problem.<br><br>The problem is that we announce that we support TLS 1.2 to the server,<br>and the server should reply that it only supports 1.0, but just<br>closes the connection or does something else weird. This is
why<br>you also see this with gnutls.<br><br>There is nothing we can do in openssl or gnutls about this. What<br>could be done is that something like curl or wget tries to connect<br>again with a lower TLS version. But if you automate this, you<br>also need to think about version downgrade attacks.<br><br>Since we can't actually fix anything, and curl and wget have<br>options to use a lower protocol version, I'm just going to<br>close this bug.<br><br><br>KurtPackage: curl<br>Version: 7.26.0-1+wheezy2<br>Severity: normal<br><br>Dear Maintainer,<br><br> Executing the following:<br> curl -o pruebacurl.html <a href="https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html" target="_blank">https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html</a><br> Produced the next error:<br> error:1408F119:SSL
routines:SSL3_GET_RECORD:decryption failed or bad record mac<br><br> Forcing SSLv3 solves the problem:<br> curl -3 -o pruebacurl.html <a href="https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html" target="_blank">https://sede.dgt.gob.es/sede/faces/paginas/testra/testraIframe.xhtml?pagina=consulta.html</a><br><br> wget has same problem in latest stable version, but oldstable works fine.<br><br><br>-- System Information:<br>Debian Release: 7.0<br> APT prefers stable-updates<br> APT policy: (500, 'stable-updates'), (500, 'stable')<br>Architecture: amd64 (x86_64)<br><br>Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core)<br>Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8)<br>Shell: /bin/sh linked to /bin/bash<br><br>Versions of packages curl depends on:<br>ii libc6 2.13-38<br>ii libcurl3 7.26.0-1+wheezy2<br>ii zlib1g
1:1.2.7.dfsg-13<br><br>curl recommends no packages.<br><br>curl suggests no packages.<br><br>-- no debconf information<br><br><br></div> </div> </div> </div></body></html>