bugGNU Wget - Bugs: bug #45792, wget: Read error in TLS connection...

 
 

bug #45792: wget: Read error in TLS connection with openssl s_server -www server

Submitter:  Noël Köthe <nok>
Submitted:  Tue 18 Aug 2015 11:19:01 AM UTC
   
 
Category:  Protocol Issue Severity:  3 - Normal
Priority:  5 - Normal Status:  Invalid
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  1.16.3 Operating System:  None
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 08 Jan 2016 03:55:17 PM UTC, comment #1: 

Reproducable with (from wget source directory):
$ cd tests/certs
$ openssl s_server -CAfile x509-ca-cert.pem -key x509-server-key.pem -cert x509-server-cert.pem -www

From another console:
$ wget --ca-certificate tests/certs/x509-ca-cert.pem -O out.html https://localhost:4433
...
Read error at byte 6701 (The TLS connection was non-properly terminated.)
...

BTW, out.html is complete

Looking at the debug output reveals that the server response does not send a Content-Length header line. So the client does not know that the data is complete and leaves the connection open, waiting for more data to come or for the server to close the connection. Here we see the server closing the connection improperly which is interpreted as an error by Wget. And thus the retries.

Curl has the same problem, saying "The TLS connection was non-properly terminated" and returning with $? 56. Regarding the curl man page this is "Failure in receiving network data.".

This bug either has to be fixed in 'openssl s_server' (or in GnuTLS if and only if this is a misinterpretation of TLS standards by GnuTLS).

Tim Ruehsen <rockdaboot>
Group administrator
Tue 18 Aug 2015 11:19:01 AM UTC, original submission:  

Hello,

--8<--
What I set up a test server with:

  openssl s_server -CAfile ... -key ... -cert ... -www

and try wget with it, I get errors:

--2015-08-18 12:29:07--  https://www.vinc17.net:4433/
Resolving www.vinc17.net (www.vinc17.net)... 92.243.22.117, 2001:4b98:dc0:45:216:3eff:fe9b:eb2f
Connecting to www.vinc17.net (www.vinc17.net)|92.243.22.117|:4433... connected.
HTTP request sent, awaiting response... 200 ok
Length: unspecified [text/html]
Saving to: ‘index.html’

index.html              [ <=>                  ]   5.26K  --.-KB/s   in 0s    

2015-08-18 12:29:07 (204 MB/s) - Read error at byte 5386 (The TLS connection was non-properly terminated.).Retrying.

--2015-08-18 12:29:08--  (try: 2)  https://www.vinc17.net:4433/
Connecting to www.vinc17.net (www.vinc17.net)|92.243.22.117|:4433... connected.
HTTP request sent, awaiting response... 200 ok
Length: unspecified [text/html]
Saving to: ‘index.html’

index.html              [ <=>                  ]   5.26K  --.-KB/s   in 0s    

2015-08-18 12:29:08 (1.21 GB/s) - Read error at byte 5386 (The TLS connection was non-properly terminated.).Retrying.
...
--8<--
https://bugs.debian.org/744170

thx&regards

Noël

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by nok (Submitted the item)
  • -email is unavailable- added by nok
  •  

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-01-08 rockdaboot StatusNone Invalid
        Open/ClosedOpen Closed
        ReproducibilityNone Every Time
    2015-08-18 nok Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code