SSL troubles

[Sc0tTy]

I've been using AUTH TLS for a while now but i get random SSL errors during transfers.
[10:21:11] [L] 426 Connection closed: SSL library failure (error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac).
[10:21:11] [L] 226 ABOR command successful.
[10:21:11] [L] Transfer Failed!

When using AUTH SSL i get the following error during connect:
[11:12:30] [R] 150 Opening ASCII mode data connection for directory listing using SSL/TLS.
[11:12:30] [R] error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list
[11:12:30] [R] Failed SSL negotiation, disconnected
[11:12:30] [R] 426 Connection closed: SSL failure.
[11:12:30] [R] List Error

I've been googling for a while now, installed the latest OpenSSL-64 libs but nothing seems to work.. So i'm thinking theres something wrong with ioFTPD
This is my SSL config:



Explicit_Encryption = True

;Encryption_Protocol = SSL3

OpenSSL_Options = ALL

OpenSSL_Ciphers = DEFAULT:!LOW:!EXPORT

[Yil]

I've seen the first error myself and I'm pretty sure it was an interrupted transfer. I was downloading with flash and it just restarted and all was good.

The 2nd during the handshake could be any number of things.

ioFTPD just passes along the error from the OpenSSL lib so you can see what the problem is. See if you notice a pattern. It's possible there's a bug somewhere in ioFTPD, but it's got to be pretty rare. The only reason you're probably noticing this is because it reports something interesting instead of just a failed transfer like in the old days.

[Yil]

I just ran into a server that seemed to reject upload after upload with the SSL3_GET_RECORD:decryption failed or bad record mac) error. A little googling showed this to be an OpenSSL to OpenSSL issue a number of years ago with it popping up from time to time. I'm not sure what's going on, but this might be a more likely / serious problem than I thought. My guess is it's a real bug but not an ioFTPD bug. Keep me informed.

[Sc0tTy]

[18:57:29] [R] 150 Opening BINARY mode data connection for XXXXX.rXX using SSL/TLS.
[18:57:53] [L] 426- Connection reset
[18:57:53] [L] 426 Connection reset
[18:57:53] [R] 426-.----== ioNiNJA v1.0a ==---------------------------.
[18:57:53] [R] ABOR
[18:57:54] [R] 426-| + CRC-Check: FaileD! |
[18:57:54] [R] 426-`--------------------------------=====-------------'
[18:57:54] [R] 426 Connection closed: SSL library failure (error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac).

What i think happens is that the source doesnt see the FXP connection anymore and then breaks it of giving the ioFTPD SSL error

I also found this :
http://stackoverflow.com/questions/3...ultiprocessing

I think i get the error mostly when multiple users are sending...
Any ideas?

[Yil]

I believe any non-complete SSL stream can detect that it wasn't properly terminated and will result in a decryption failed error so it's not exactly the most useful error message. Why don't you try and look in the xferlog to see what it says. In particular the number of bytes received could be very useful to know.

The link is meaningless, it's about the python language...

[Sc0tTy]

Tue Jan 17 TIME 2012 14 IPADDRESS 31981568 FILE b _ i r USERNAME ftp 1 USERNAME l

Hmm that byte count is way off the filesize is 100MB

[ArtX]

i find i get most ssl erros with any site running drftpd

[Sc0tTy]

Problems here are with glFTPd and DRFTPd and the bigger the files the frequenter the problems

[Yil]

So you got ~31MB of a 100MB file and it got that far in roughly 24 seconds which meant it was going quite fast so the server didn't time out the connection or anything.

Unfortunately there isn't a simple way to figure out which side is having issues so you'll have to look at a number of things. My suggestion is to start with a memory test on the local server since I've had a few sticks of memory go bad over the years and the way the errors show up can be insidious sometimes. Then rule out the network card / CPU by transferring hundreds of gigs between the server and another local machine or laptop using SSL and use 'netstat -s' from a command prompt before and after to see if anything jumps out such as packet retransmissions or CRC errors. Use multiple transfers to stress things even more. This won't rule out specific SSL algorithm differences (though those OpenSSL guys are pretty savvy) but if you don't find a problem after all that then it's probably not your server and it's the other guys problem or a router between you (they can have memory fail as well).

[Sc0tTy]

I've been in contact with my ISP, it seems that the model modem i have has problems with downloading big files. The will send me a new modem ( and model ) and hopefully this will solve my problems.

I will keep you posted!