invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332

[jippie]

When running dirvish these errors pop up in the logging since I upgraded my system from Kubuntu 12.04 to 12.10. Dirvish is an rsync and perl based backup tool that connects through SSL to remote hosts. Unsure how to reproduce the errors with another / shorter method.

1) The release of Ubuntu you are using, via 'lsb_release -rd' or System -> About Ubuntu
Description: Ubuntu 12.10
Release: 12.10

2) The version of the package you are using, via 'apt-cache policy pkgname' or by checking in Software Center
libio-socket-ssl-perl:
  Installed: 1.76-1ubuntu1
  Candidate: 1.76-1ubuntu1
  Version table:
 *** 1.76-1ubuntu1 0
        500 http://nl.archive.ubuntu.com/ubuntu/ quantal/main amd64 Packages
        100 /var/lib/dpkg/status

dirvish:
  Installed: 1.2.1-1.2
  Candidate: 1.2.1-1.2
  Version table:
 *** 1.2.1-1.2 0
        500 http://nl.archive.ubuntu.com/ubuntu/ quantal/universe amd64 Packages
        100 /var/lib/dpkg/status

3) What you expected to happen
Post-Server: /snapshot/webserver/webserver-root/dirvish/post-server

4) What happened instead
Post-Server: /snapshot/webserver/webserver-root/dirvish/post-server
invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332
invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332
invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 332

5) Reproducability
100% with nightly backups for hosts connecting through rsync over ssh.

[jippie (jph4dotcom)]

I can reproduce the error with the 'sendemail' command. Notice not 'sendmail' but 'sendemail. Same error message.

[jippie (jph4dotcom)]

Comming to think about it, this problem is not with dirvish at all but with the sendemail program. I use sendemail in the dirvish post scripts to mail status updates to users.

sendemail:
  Installed: 1.56-2
  Candidate: 1.56-2
  Version table:
 *** 1.56-2 0
        500 http://nl.archive.ubuntu.com/ubuntu/ quantal/universe amd64 Packages
        100 /var/lib/dpkg/status

[jippie (jph4dotcom)]

Solved it for the time being by changing 'SSLv3 TLSv1'in sendemail line 1907 to 'SSLv3', but editing files installed by a package manager is bad practice. Also I don't think this is a proper solution. Here is the code sniplet:

1903 ## Start TLS if possible
1904 if ($conf{'tls_server'} == 1 and $conf{'tls_client'} == 1 and $opt{'tls'} =~ /^(yes|auto)$/) {
1905 printmsg("DEBUG => Starting TLS", 2);
1906 if (SMTPchat('STARTTLS')) { quit($conf{'error'}, 1); }

Original:
1907 if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv3 TLSv1')) {

Workaround:
1907 if (! IO::Socket::SSL->start_SSL($SERVER, SSL_version => 'SSLv3')) {

1908 quit("ERROR => TLS setup failed: " . IO::Socket::SSL::errstr(), 1);
1909 }
1910 printmsg("DEBUG => TLS: Using cipher: ". $SERVER->get_cipher(), 3);
1911 printmsg("DEBUG => TLS session initialized :)", 1);
1912
1913 ## Restart our SMTP session
1914 if (SMTPchat('EHLO ' . $opt{'fqdn'})) { quit($conf{'error'}, 1); }
1915 }
1916 elsif ($opt{'tls'} eq 'yes' and $conf{'tls_server'} == 0) {
1917 quit("ERROR => TLS not possible! Remote SMTP server, $conf{'server'}, does not support it.", 1);
1918 }

[Salvatore Bonaccorso (carnil)]

Hi

have found similar bug in Debian (http://bugs.debian.org/679911) for sendemail package. Reassigning there.

Regards,
Salvatore

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Will (war59312)]

Easier workaround is:

Replace:

m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))$}i

With:

m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))}i

[mabox (mabox)]

@war59312
It works, thank you!

[Will (war59312)]

Of course it does. ;)

Your welcome! :D

[pieterjanvu (pieterjanvu)]

@war59312
Sorry, noob question, but which file do we replace that in?

[Will (war59312)]

/usr/share/perl5/IO/Socket/SSL.pm

The file that has the bug after all. ;)

$ is very powerful as you have now witnessed. :p

[pieterjanvu (pieterjanvu)]

Cool. Thank you. Silly me, I was still looking in sendemail, even though that is what I didn't want to change. Is this a permanent fix, or can this get overwritten by a package upgrade? (in which case I hope that it'll be fixed by then).

[mabox (mabox)]

@war59312
Yes, in usr/share/perl5/IO/Socket/SSL.pm in line 1482.

[Will (war59312)]

@pieterjanvu Yes it can be overwritten by the package. So just a temporary work around for now.

But by then it should be fixed anyways. That is, once this bug has been marked fixed. ;)

I really would not worry about it. Not like SSL.pm is updated often and even if it does you will know right away when mail breaks again. :p

If you are using recommended pracitices...

When the new package tries to install, it will warn you that you have made modifications to the original file and asks if you want to override it with the one in the package or keep yous. It even goes so far as showing exact changes.

So not really an issue. Better to have mail working than worrying about a package maybe breaking it. ;)

[Darrell (darrell-infrabyte)]

Hi, I have tried the above by changing 'SSLv3 TLSv1' to 'SSLv3' <-- That didn't work.
I then changed it back and tried to change:
m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))$}i
With:
m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))}i

That didn't work either. I got the following error on both:

sendEmail[11597]: ERROR => TLS setup failed: SSL connect attempt failed with unknown error error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Anyone know how this could be.

Thank you
Darrell

[Will (war59312)]

Afraid that is a totally unrelated error.

[Unit 193 (unit193)]

This bug was fixed in debian version 1.56-3, which has been sync'd to Raring.