[Pkg-puppet-devel] Bug#889527: puppet: Puppet master/agent on testing/buster fails with SSL errors

[clayton]

Package: puppet
Version: 4.10.4-2
Severity: important

I have been running puppet master on testing for (many?) years, withou
major mishap until recently, when I started to get what looks to me
like SSL errors. Is there an SSL library problem?

On an up-to-date testing machine, running agent against a master on the
same machine, I am getting these errors:

# puppet agent --test --verbose --debug > /tmp/puppet-debug.txt
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_read: decryption failed or bad record mac
Error: /File[/var/cache/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_read: decryption failed or bad record mac
Error: /File[/var/cache/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_read: decryption failed or bad record mac
Error: /File[/var/cache/puppet/lib]: Failed to generate additional resources using 'eval_generate': SSL_read: decryption failed or bad record mac
Error: /File[/var/cache/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_read: decryption failed or bad record mac
Error: Could not retrieve catalog from remote server: SSL_read: decryption failed or bad record mac
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_read: decryption failed or bad record mac

This has been going on for weeks, I thought it would just go away
but no such luck.

I will e-mail the debug output once I have a bug report number for this.

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (990, 'testing'), (700, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.14.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages puppet depends on:
ii  adduser              3.116
ii  facter               2.4.6-1
ii  hiera                3.2.0-2
ii  init-system-helpers  1.51
ii  lsb-base             9.20170808
ii  ruby                 1:2.3.3
ii  ruby-augeas          1:0.5.0-3+b5
ii  ruby-deep-merge      1.1.1-1
ii  ruby-rgen            0.8.0-1
ii  ruby-safe-yaml       1.0.4-1
ii  ruby-shadow          2.4.1-1+b3

Versions of packages puppet recommends:
ii  debconf-utils  1.5.65
ii  lsb-release    9.20170808
ii  ruby-selinux   2.7-2+b1

Versions of packages puppet suggests:
pn  ruby-rrd  <none>

-- no debconf information