issue with TLS 1.2 session ticket handling as client during resumption

[Lucy Llewellyn]

Known upstream bug, that has been fixed upstream. There is an issue with session ticket handling in GnuTLS during session resumption.

The issue is intermittent, but can eventually be reproduced by running:

gnutls-cli --resume api.twitter.com 443

When you trigger the bug the output will finish with the following two lines:

*** Fatal error: An unexpected TLS packet was received.
*** handshake has failed: An unexpected TLS packet was received.

This is breaking the Cawbird Snap package based on Bionic/Core18.

The issue affects both Bionic and Eoan.

ProblemType: Bug
DistroRelease: Ubuntu 19.10
Package: gnutls-bin 3.6.9-5ubuntu1.1
ProcVersionSignature: User Name 5.3.0-46.38-generic 5.3.18
Uname: Linux 5.3.0-46-generic x86_64
ApportVersion: 2.20.11-0ubuntu8.8
Architecture: amd64
Date: Sat Apr 18 15:05:04 2020
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=C.UTF-8
 SHELL=/bin/bash
SourcePackage: gnutls28
UpgradeStatus: No upgrade log present (probably fresh install)

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "The upstream diff from MR1087 fixing the issue." seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Sebastien Bacher (seb128)]

The issue seems fixed in focal so it's about backporting to older series

[Mathew Hodson (mhodson)]

This was fixed in version 3.6.11

[Brian Murray (brian-murray)]

The Eoan Ermine has reached end of life, so this bug will not be fixed for that release

[William Wilson (jawn-smith)]

@diddledani the patch in comment 2 doesn't apply cleanly in bionic. Would you be able to redo the patch for bionic?

[Lucy Llewellyn (lucyllewy)]

There's quite a lot that doesn't apply cleanly against the source in bionic. I don't think I'm able to work through the issues with it safely.