TLS handshake timeouts

1,011 views
Skip to first unread message

tim....@10gen.com

unread,
Jun 22, 2015, 4:48:53 PM6/22/15
to golan...@googlegroups.com
Hello,

We have a customer using a Go program of ours that is experiencing TLS Handshake timeouts when trying to download a binary over HTTPS from Amazon's S3 service.  I have isolated the problem to a simple Go program:

------------------------------

package main


import (

"fmt"

"net/http"

"time"

)


var HttpTransport *http.Transport = &http.Transport{

ResponseHeaderTimeout: time.Minute,

TLSHandshakeTimeout:   5 * time.Minute,

}


var HttpClient *http.Client = &http.Client{

Transport: HttpTransport,

}


func main() {

url := "https://s3.amazonaws.com/mongodb-mms-build-agent/releases/prod/mongodb-mms-automation-agent-2.0.6.1148-1.linux_x86_64.tar.gz"

req, err := http.NewRequest("HEAD", url, nil)

if err != nil {

panic(fmt.Sprintf("Failed to create HEAD request: %v", err))

}


req.Header.Add("Accept-Encoding", "gzip")

resp, err := HttpClient.Do(req)

if resp != nil {

defer resp.Body.Close()

}


if err != nil {

panic(fmt.Sprintf("Failed to HEAD %v : %v", url, err))

}


if resp.StatusCode != 200 {

panic(fmt.Sprintf("Expected 200 status code when downloading %s but got %d instead", url, resp.StatusCode))

}


fmt.Printf("HEAD %v succeeded\n", url)

}


------------------------------


After 5 minutes, the program prints:


> time ./head-agent-go142-2

panic: Failed to HEAD 

https://s3.amazonaws.com/mongodb-mms-build-agent/releases/prod/mongodb-mms-automation-agent-2.0.6.1148-1.linux_x86_64.tar.gz 

: Head 

https://s3.amazonaws.com/mongodb-mms-build-agent/releases/prod/mongodb-mms-automation-agent-2.0.6.1148-1.linux_x86_64.tar.gz

net/http: TLS handshake timeout

goroutine 1 [running]:

main.main()

/home/ubuntu/MMSSUPPORT-6586/head-agent2.go:32 +0x430

goroutine 17 [syscall, 2 minutes, locked to thread]:

runtime.goexit()

/usr/local/go/src/runtime/asm_amd64.s:2232 +0x1

real 5m0.029s

user 0m0.003s

sys 0m0.006s


This is using Go 1.4.2.  


Running curl against the url successfully works in their environment.


If they change the url to https://www.google.com/ or https://mms.mongodb.com/, the HEAD request runs successfully.


The problem only appears to happen in their environment.  We are unable to reproduce the problem in our environment.


The problem appears to be a combination of three things:


1. The customer's environment (as it doesn't happen in our environment)

2. Go (as curl works fine)

3. An s3 url (as google and mongodb urls worked fine).


Any ideas what may be going wrong or how to further debug the issue?


Thank you,

Tim Olsen



agl

unread,
Jun 22, 2015, 8:38:07 PM6/22/15
to golan...@googlegroups.com
I would have them get a packet capture with `tcpdump -i ethXXX -s 9999 -w /tmp/dump tcp port 443` (where ethXXX needs to be replaced with the actual interface name). From that you might be able to see something useful.

Perhaps they have MTU issues that cause the Amazon reply to be dropped for some reason?
Reply all
Reply to author
Forward
0 new messages