lftp aborts with gnutls_record_recv error

[fanopanic]

I am not sure whether I should report this against lftp or gnutls11, I just
decided for lftp, because on my hoary installation, with the same libgnutls11,
lftp works (however ldd shows it's not even linked against it. Oh well...). If
you think it's wrong, move it or something.

lftp :~> open <email address hidden>
Password:
lftp <email address hidden>:~> ls
-rwxrwxr-x 1 fanopanic fanopanic 6070281 Jun 18 10:23 first_file_in_directory
ls: Fatal error: gnutls_record_recv: A TLS packet with unexpected length was
received.
lftp <email address hidden>:~>

with "ls" lftp always prints the first line, and then the error occurs. The
attempt to tab-complete a directory just fails. I can however GET a file, or
RMDIR a directory, if I know their names.

ftp without TLS/SSL works.

Locally I run Breezy (2.6.12-7-k7),

On the server runs ProFTPD Version 1.3.0rc2 with essentially:
<IfModule mod_tls.c>
TLSEngine on
TLSRequired ctrl
TLSProtocol SSLv23
</IfModule>

The tls.log there only says:
Aug 25 03:33:31 mod_tls/2.1[10109]: using default OpenSSL verification locations
(see $SSL_CERT_DIR)
Aug 25 03:33:31 mod_tls/2.1[10109]: TLS/TLS-C requested, starting TLS handshake
Aug 25 03:33:31 mod_tls/2.1[10109]: TLSv1/SSLv3 connection accepted, using
cipher AES256-SHA (256 bits)
Aug 25 03:33:31 mod_tls/2.1[10109]: Protection set to Private
Aug 25 03:33:31 mod_tls/2.1[10109]: starting TLS negotiation on data connection
Aug 25 03:33:31 mod_tls/2.1[10109]: TLSv1/SSLv3 data connection accepted, using
cipher AES256-SHA (256 bits)

I can't test it with other TLS-servers, because I have no other accounts.
If you need anything, just shout. I will add some tcpdump output tomorrow.

[Noël Köthe (noel)]

Am Dienstag, den 02.08.2005, 03:10 +0200 schrieb Berenyi Mihaly:

> the lftp in debian (with tls) can connect to ftps sites, but an ls
> command only prints the firts directory entry, and then this error:
> Fatal error: gnutls_record_recv: A TLS packet with unexpected length was
> received.

Please give more details.
Tell us a URL to reproduce, turn debug on, Paste your command and the
complete output.

--
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org

[Berenyi Mihaly (mihi-mail)]

i've attached the file output by debug -o
i've experienced the same thing with 3 ftps servers that i can recall
lftp.debug is from a proftpd on a freebsd
lftp.debug2 is from proftpd 1.2.10
lftp.debug3 is from wzdftpd 0.5.2
sorry, but none of the 3 servers i know are public (usteam may be, but
it's not accessible from outside hungary)
i just did an open and some ls and maybe cd in each case.
hope that helps
--
huf (Berenyi Mihaly) - <email address hidden> - http://mu.parawag.net
...........it's life jim, but not as we know it.............

[fanopanic (fanopanic)]

I am not sure whether I should report this against lftp or gnutls11, I just
decided for lftp, because on my hoary installation, with the same libgnutls11,
lftp works (however ldd shows it's not even linked against it. Oh well...). If
you think it's wrong, move it or something.

lftp :~> open <email address hidden>
Password:
lftp <email address hidden>:~> ls
-rwxrwxr-x 1 fanopanic fanopanic 6070281 Jun 18 10:23 first_file_in_directory
ls: Fatal error: gnutls_record_recv: A TLS packet with unexpected length was
received.
lftp <email address hidden>:~>

with "ls" lftp always prints the first line, and then the error occurs. The
attempt to tab-complete a directory just fails. I can however GET a file, or
RMDIR a directory, if I know their names.

ftp without TLS/SSL works.

Locally I run Breezy (2.6.12-7-k7),

On the server runs ProFTPD Version 1.3.0rc2 with essentially:
<IfModule mod_tls.c>
TLSEngine on
TLSRequired ctrl
TLSProtocol SSLv23
</IfModule>

The tls.log there only says:
Aug 25 03:33:31 mod_tls/2.1[10109]: using default OpenSSL verification locations
(see $SSL_CERT_DIR)
Aug 25 03:33:31 mod_tls/2.1[10109]: TLS/TLS-C requested, starting TLS handshake
Aug 25 03:33:31 mod_tls/2.1[10109]: TLSv1/SSLv3 connection accepted, using
cipher AES256-SHA (256 bits)
Aug 25 03:33:31 mod_tls/2.1[10109]: Protection set to Private
Aug 25 03:33:31 mod_tls/2.1[10109]: starting TLS negotiation on data connection
Aug 25 03:33:31 mod_tls/2.1[10109]: TLSv1/SSLv3 data connection accepted, using
cipher AES256-SHA (256 bits)

I can't test it with other TLS-servers, because I have no other accounts.
If you need anything, just shout. I will add some tcpdump output tomorrow.

[fanopanic (fanopanic)]

Versions of packages lftp depends on:
ii libc6 2.3.5-1ubuntu10 GNU C Library: Shared libraries an
ii libgcc1 1:4.0.1-4ubuntu5 GCC support library
ii libgcrypt11 1.2.1-3 LGPL Crypto library - runtime libr
ii libgnutls11 1.0.16-13.1 GNU TLS library - runtime library
ii libgpg-error0 1.0-1 library for common error values an
ii libncurses5 5.4-9ubuntu4 Shared libraries for terminal hand
ii libreadline5 5.0-10 GNU readline and history libraries
ii libtasn1-2 0.2.10-4 Manage ASN.1 structures (runtime)
ii netbase 4.21ubuntu2 Basic TCP/IP networking system
ii zlib1g 1:1.2.3-3ubuntu3 compression library - runtime

[fanopanic (fanopanic)]

Created an attachment (id=3397)
tcpdump output of a lftp session

[fanopanic (fanopanic)]

In all the hassle I forgot to mention I am using lftp 3.2.1-1.

btw. I took a look at the proftpd documentation, "TLSProtocol SSLv23" means
allowing both SSLv3 and TLSv1.

[fanopanic (fanopanic)]

Ok, furthermore tested it with vsftpd using TLSv1 (doesn't work either), with
lftp versions 3.2.1-1 & 3.2.3

Also found the corresponding debian bug report:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=320871

[oscar hellström (oscar)]

I can confirm this bug on Breezy wihth lftp 3.2.1 using Readline 5.0, GnuTLS 1.0.16.
I don't feel I need to provide the same output as above.

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Tue, 02 Aug 2005 03:10:40 +0200
From: Berenyi Mihaly <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: lftp does not work with ftps (can not list directories)

Package: lftp
Version: 3.2.1-2
Severity: important

the lftp in debian (with tls) can connect to ftps sites, but an ls
command only prints the firts directory entry, and then this error:
Fatal error: gnutls_record_recv: A TLS packet with unexpected length was
received.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12.2
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)

Versions of packages lftp depends on:
ii libc6 2.3.2.ds1-22 GNU C Library: Shared libraries an
ii libexpat1 1.95.8-3 XML parsing C library - runtime li
ii libgcc1 1:4.0.1-3 GCC support library
ii libgcrypt11 1.2.1-4 LGPL Crypto library - runtime libr
ii libgnutls12 1.2.5-3 the GNU TLS library - runtime libr
ii libgpg-error0 1.1-4 library for common error values an
ii libncurses5 5.4-9 Shared libraries for terminal hand
ii libreadline5 5.0-10 GNU readline and history libraries
ii libtasn1-2 0.2.13-1 Manage ASN.1 structures (runtime)
ii netbase 4.21 Basic TCP/IP networking system
ii zlib1g 1:1.2.3-1 compression library - runtime

lftp recommends no packages.

-- no debconf information

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Tue, 02 Aug 2005 09:14:50 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>, Berenyi Mihaly <email address hidden>
Subject: Re: Bug#320871: lftp does not work with ftps (can not list
 directories)

--=-dbf1tuKWd344rpL780r/
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Am Dienstag, den 02.08.2005, 03:10 +0200 schrieb Berenyi Mihaly:

> the lftp in debian (with tls) can connect to ftps sites, but an ls
> command only prints the firts directory entry, and then this error:
> Fatal error: gnutls_record_recv: A TLS packet with unexpected length was
> received.

Please give more details.
Tell us a URL to reproduce, turn debug on, Paste your command and the
complete output.

--=20
No=C3=A8l K=C3=B6the <noel debian.org>
Debian GNU/Linux, www.debian.org

--=-dbf1tuKWd344rpL780r/
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBC7x1q9/DnDzB9Vu0RAliHAJ9U2GxE6QIXqOehBXKnzXnLyJ0orACglBLT
lciJF+gcnJGT/fo0V2llBHQ=
=nvJK
-----END PGP SIGNATURE-----

--=-dbf1tuKWd344rpL780r/--

[Konstantinos Koukopoulos (kouk)]

I have encountered the same issue due to the following misconfiguration:

In lftp the configuration variable ftp:ssl-protect-list defaults to yes. Most
times if TLS is enabled on the server it will either be on both channels or
only on the control channel. So, when you connect to a server that requires
TLS only on the control channel then you should not use TLS for LISTs (which
happen on the data channel). The ftp:ssl-protect-list variable controls
exactly this, and since by default it is set to yes it creates problems with
servers that don't user TLS on the data channel.

Could the bug reporter check the value of ftp:ssl-protect-list? If it has the
default value of "yes" then perhaps he could try unsetting it to see if LISTs
work that way.

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Thu, 20 Oct 2005 18:22:27 +0300
From: Konstantinos Koukopoulos <email address hidden>
To: <email address hidden>
Subject: Re: Bug #320871: lftp does not work with ftps (can not list directories)

I have encountered the same issue due to the following misconfiguration:

In lftp the configuration variable ftp:ssl-protect-list defaults to yes. Most
times if TLS is enabled on the server it will either be on both channels or
only on the control channel. So, when you connect to a server that requires
TLS only on the control channel then you should not use TLS for LISTs (which
happen on the data channel). The ftp:ssl-protect-list variable controls
exactly this, and since by default it is set to yes it creates problems with
servers that don't user TLS on the data channel.

Could the bug reporter check the value of ftp:ssl-protect-list? If it has the
default value of "yes" then perhaps he could try unsetting it to see if LISTs
work that way.

[Noël Köthe (noel)]

Hello Berenyi,

does this info help you?

-------- Weitergeleitete Nachricht --------
>
> I have encountered the same issue due to the following misconfiguration:
>
> In lftp the configuration variable ftp:ssl-protect-list defaults to yes. Most
> times if TLS is enabled on the server it will either be on both channels or
> only on the control channel. So, when you connect to a server that requires
> TLS only on the control channel then you should not use TLS for LISTs (which
> happen on the data channel). The ftp:ssl-protect-list variable controls
> exactly this, and since by default it is set to yes it creates problems with
> servers that don't user TLS on the data channel.
>
> Could the bug reporter check the value of ftp:ssl-protect-list? If it has the
> default value of "yes" then perhaps he could try unsetting it to see if LISTs
> work that way.

--
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Fri, 21 Oct 2005 16:03:36 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>
Subject: [Fwd: Bug#320871: Bug #320871: lftp does not work with ftps (can
 not list directories)]

--=-WsjNbyb4MTTbozIKJJfx
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello Berenyi,

does this info help you?

-------- Weitergeleitete Nachricht --------
>=20
> I have encountered the same issue due to the following misconfiguration:
>=20
> In lftp the configuration variable ftp:ssl-protect-list defaults to yes. =
Most=20
> times if TLS is enabled on the server it will either be on both channels =
or=20
> only on the control channel. So, when you connect to a server that requir=
es=20
> TLS only on the control channel then you should not use TLS for LISTs (wh=
ich=20
> happen on the data channel). The ftp:ssl-protect-list variable controls=20
> exactly this, and since by default it is set to yes it creates problems w=
ith=20
> servers that don't user TLS on the data channel.
>=20
> Could the bug reporter check the value of ftp:ssl-protect-list? If it has=
 the=20
> default value of "yes" then perhaps he could try unsetting it to see if L=
ISTs=20
> work that way.

--=20
No=C3=A8l K=C3=B6the <noel debian.org>
Debian GNU/Linux, www.debian.org

--=-WsjNbyb4MTTbozIKJJfx
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBDWPU49/DnDzB9Vu0RAv19AJ9S5Ut9+DAHy4LPRWj4o25lBD0+gwCfU9O/
oEF5EognQNuCwFJ+EITsXpI=
=eixf
-----END PGP SIGNATURE-----

--=-WsjNbyb4MTTbozIKJJfx--

[Nils (linuxuser-knabber)]

I have the same problem like Berenyi and I tried setting ftp:ssl-protect-list
off, but then I get the error:

ls: 550 SSL/TLS required on the data channel

I've check the problem with a proftpd server.

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Thu, 24 Nov 2005 19:08:51 +0100
From: Nils <email address hidden>
To: <email address hidden>
Subject: Re: Bug #320871: lftp does not work with ftps (can not list directories)

I have the same problem like Berenyi and I tried setting ftp:ssl-protect-list
off, but then I get the error:

ls: 550 SSL/TLS required on the data channel

I've check the problem with a proftpd server.

[Andrew Joyce (joyce-webcreations)]

I am also experiencing this bug. Is there anything I can contribute to
help diagnose or isolate the problem. This is happening over a number
of different computers with lftp connecting to ProFTPd servers. Other
clients do not seem to experience this problem so I suspect that it is
lftp and not ProFTPd that has this bug.

Andrew

[Andrew Joyce (joyce-webcreations)]

severity 312216 important
tags 312216 - moreinfo
merge 312216 320871

These bugs address the same issue with lftp.

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Sun, 04 Dec 2005 01:50:54 -0500
From: Andrew Joyce <email address hidden>
To: <email address hidden>
Subject: Re: Bug #320871: lftp does not work with ftps (can not list directories)

--------------enig5DCF8EC1C60DAA2899B77A8B
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

I am also experiencing this bug. Is there anything I can contribute to
help diagnose or isolate the problem. This is happening over a number
of different computers with lftp connecting to ProFTPd servers. Other
clients do not seem to experience this problem so I suspect that it is
lftp and not ProFTPd that has this bug.

Andrew

--------------enig5DCF8EC1C60DAA2899B77A8B
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: GnuPT 2.7
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDkpHS881zU9syRTsRAvDqAKCnEU3B13piervzSQhTiHzCqh4yBQCgjjdo
6Jc3u43TzKqB8DDwdHr05qc=
=l+GG
-----END PGP SIGNATURE-----

--------------enig5DCF8EC1C60DAA2899B77A8B--

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Sun, 04 Dec 2005 02:10:57 -0500
From: Andrew Joyce <email address hidden>
To: <email address hidden>
Subject: Duplicate Reports

--------------enig7291FF0BD1ECC766E38BACB1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

severity 312216 important
tags 312216 - moreinfo
merge 312216 320871

These bugs address the same issue with lftp.

--------------enig7291FF0BD1ECC766E38BACB1
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: GnuPT 2.7
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDkpaH881zU9syRTsRAtMRAJkBk1GnevLJftli8TDTP+UsVPlR+ACfdIPl
e6YeoLvt+x5hokwYH6It1Ts=
=qYyX
-----END PGP SIGNATURE-----

--------------enig7291FF0BD1ECC766E38BACB1--

[Noël Köthe (noel)]

Source: lftp
Source-Version: 3.3.5-2

We believe that the bug you reported is fixed in the latest version of
lftp, which is due to be installed in the Debian FTP archive:

lftp_3.3.5-2.diff.gz
  to pool/main/l/lftp/lftp_3.3.5-2.diff.gz
lftp_3.3.5-2.dsc
  to pool/main/l/lftp/lftp_3.3.5-2.dsc
lftp_3.3.5-2_i386.deb
  to pool/main/l/lftp/lftp_3.3.5-2_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noèl Köthe <email address hidden> (supplier of updated lftp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 30 Dec 2005 08:41:30 +0100
Source: lftp
Binary: lftp
Architecture: source i386
Version: 3.3.5-2
Distribution: unstable
Urgency: medium
Maintainer: Noèl Köthe <email address hidden>
Changed-By: Noèl Köthe <email address hidden>
Description:
 lftp - Sophisticated command-line FTP/HTTP client programs
Closes: 312216 343307
Changes:
 lftp (3.3.5-2) unstable; urgency=medium
 .
   * applied gnutls patch http://<email address hidden>/msg02449.html
     (closes: Bug#312216)
   * added lftpget manpage
     (closes: Bug#343307)
Files:
 3fbbe08a061623ec33cd846d209a413a 611 net optional lftp_3.3.5-2.dsc
 70aa850efc6b43a42c5c4498c5af263f 11631 net optional lftp_3.3.5-2.diff.gz
 0fb0e570589251aebd62b40ff66c420b 577334 net optional lftp_3.3.5-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDtRQl9/DnDzB9Vu0RAqK3AJ9v3xn+AWT8bSSmSiD9AgUWaF/zIACfSjGc
Q+k68fMmyS+zB3U+yRaQOMY=
=w+mH
-----END PGP SIGNATURE-----

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Fri, 30 Dec 2005 03:17:10 -0800
From: =?utf-8?b?Tm/DqGwgS8O2dGhl?= <email address hidden>
To: <email address hidden>
Subject: Bug#312216: fixed in lftp 3.3.5-2

Source: lftp
Source-Version: 3.3.5-2

We believe that the bug you reported is fixed in the latest version of
lftp, which is due to be installed in the Debian FTP archive:

lftp_3.3.5-2.diff.gz
  to pool/main/l/lftp/lftp_3.3.5-2.diff.gz
lftp_3.3.5-2.dsc
  to pool/main/l/lftp/lftp_3.3.5-2.dsc
lftp_3.3.5-2_i386.deb
  to pool/main/l/lftp/lftp_3.3.5-2_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noèl Köthe <email address hidden> (supplier of updated lftp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 30 Dec 2005 08:41:30 +0100
Source: lftp
Binary: lftp
Architecture: source i386
Version: 3.3.5-2
Distribution: unstable
Urgency: medium
Maintainer: Noèl Köthe <email address hidden>
Changed-By: Noèl Köthe <email address hidden>
Description:
 lftp - Sophisticated command-line FTP/HTTP client programs
Closes: 312216 343307
Changes:
 lftp (3.3.5-2) unstable; urgency=medium
 .
   * applied gnutls patch http://<email address hidden>/msg02449.html
     (closes: Bug#312216)
   * added lftpget manpage
     (closes: Bug#343307)
Files:
 3fbbe08a061623ec33cd846d209a413a 611 net optional lftp_3.3.5-2.dsc
 70aa850efc6b43a42c5c4498c5af263f 11631 net optional lftp_3.3.5-2.diff.gz
 0fb0e570589251aebd62b40ff66c420b 577334 net optional lftp_3.3.5-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDtRQl9/DnDzB9Vu0RAqK3AJ9v3xn+AWT8bSSmSiD9AgUWaF/zIACfSjGc
Q+k68fMmyS+zB3U+yRaQOMY=
=w+mH
-----END PGP SIGNATURE-----

[Daniel Robitaille (robitaille)]

According to the recent change logs of lftp, this should be fixed in Dapper (Debian 312216):

lftp (3.4.0-1) unstable; urgency=low

  * new upstream release from 2005-12-31
    - lftpget(1) now in upstream
    - gnutls patch from 3.3.5-2 included

 -- Noèl Köthe <email address hidden> Sat, 31 Dec 2005 17:32:12 +0100

lftp (3.3.5-2) unstable; urgency=medium

  * applied gnutls patch http://<email address hidden>/msg02449.html
    (closes: Bug#312216)
  * added lftpget manpage
    (closes: Bug#343307)

 -- Noèl Köthe <email address hidden> Fri, 30 Dec 2005 08:41:30 +0100

[Daniel Robitaille (robitaille)]

Fixed in Debian

[Fabien Tassin (fta)]

confirmed fixed in gutsy's lftp 3.5.0-2