GnuTLS: A TLS packet with unexpected length was received.

2,649 views
Skip to first unread message

Michael Pope

unread,
Apr 5, 2017, 9:04:58 PM4/5/17
to mlu...@googlegroups.com
Hi MLUG,

I'm having a problem logging into the tax portal on our main machine
here. I've been on the forum for auskey linux help but it looks like
it's a local problem to do with my server.

I'm running Debian Wheezy on the broken machine. Here is the test I've
been doing;

Broken machine output;

$ wget --server-response
https://authentication.business.gov.au/S001v4.0/authenticate/q3
--2017-04-06 10:59:31--
https://authentication.business.gov.au/S001v4.0/authenticate/q3
Resolving authentication.business.gov.au
(authentication.business.gov.au)... 210.193.176.72
Connecting to authentication.business.gov.au
(authentication.business.gov.au)|210.193.176.72|:443... connected.
GnuTLS: A TLS packet with unexpected length was received.
Unable to establish SSL connection.


Correct output;

$ wget --server-response
https://authentication.business.gov.au/S001v4.0/authenticate/q3
--2017-04-06 10:55:03--
https://authentication.business.gov.au/S001v4.0/authenticate/q3
Resolving authentication.business.gov.au
(authentication.business.gov.au)... 143.174.192.33
Connecting to authentication.business.gov.au
(authentication.business.gov.au)|143.174.192.33|:443... connected.
HTTP request sent, awaiting response...
HTTP/1.1 404 Not Found
Cache-Control: private
Transfer-Encoding: chunked
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie:
Prod__CurrentStateId=zX6uObWYGbHDsEE7tdFoCEpGnSfwgwCr3qaxAmO7dLmhhPwa2vRYpvX0sIspVKek0WReoYEsp7SZmfNrHAXcWz3glri8xnoXZ1L+uPyLlI4T1lgXUD38WWrJgPEAD7xIS2Lki6GHBjSN4YZl1yCavOH4o1QeQVDogWHXU552gktl;
domain=authentication.business.gov.au; path=/; secure; HttpOnly
X-Powered-By: ASP.NET
Date: Thu, 06 Apr 2017 00:55:06 GMT
2017-04-06 10:55:04 ERROR 404: Not Found.

The correct output is from a VM on my broken machine which runs Debian
Wheezy also. It doesn't have any AUSkeys so we cannot lodge from there
but it does get up to the point in which it needs an AUSkey.


What is this GnuTLS problem I'm having and how do I fix it?

Here is what I've tried so far;
- [X] Try clearing cache = fail
- [X] Try my user = fail
- [X] Disable security.ssl.enable_ocsp_stapling in settings = fail
I reset this back to true.
- [X] Test compiling firefox 52 in /opt/firefox52 = fail
- [X] Try and fake the OS through the browser. = fail
Using User Agent Plugin I changed it to IE8 and also tried iPhone 3.0
- [X] Upgrade Java to 8u121 = fail
Java install worked, but I still have the problem
- [X] Upgraded tzdata-java = fail
- [X] Add exceptions in jcontrol -> security = fail
- [X] Try wget = fail
: ~/.java/deployment/log % wget
https://authentication.business.gov.au/S001v4.0/authenticate/q3
: --2017-04-05 15:26:33--
https://authentication.business.gov.au/S001v4.0/authenticate/q3
: Resolving authentication.business.gov.au
(authentication.business.gov.au)... 210.193.176.72
: Connecting to authentication.business.gov.au
(authentication.business.gov.au)|210.193.176.72|:443... connected.
: GnuTLS: A TLS packet with unexpected length was received.
: Unable to establish SSL connection.
- [X] Try on the test rig (Running Debian Jessie instead of Wheezy) = fail
- [X] Reboot the router = fail
- [X] Try in google-chrome = fail
- [X] Try installing libgnutlsxx28 from backports = fail
: ibp libgnutlsxx28
- [X] Restarting dbus = fail
- [X] Clearing firefox profile = fail
- [X] Create a new user and test with firefox. = fail

- [X] Try and break working VM by applying updates
- [X] libgnutls26
libgnutls-dev libgnutls-dev libgnutlsxx27:amd64 libgnutls26:amd64
libgnutls-openssl27:amd64
- [X] libcurl3-gnutls
- [X] ssl-cert
- [X] openssl libssl-dev libssl1.0.0
- [-] Try cloning working VM server to 'test_auskey' VM and apply all
upgrades
This is in the hope to break this copy, then we can prove that it's
one of the upgrades
- [X] Clone
- [X] Apply upgrades = still working in wget
- [X] Apply dist-upgrade = still working in wget
- [X] Copy sources.list from LTSP to test_auskey server, update and
upgrade.
The following packages will be upgraded:
: deb-multimedia-keyring gstreamer0.10-ffmpeg libavutil51 libdca0
libmp3lame0 libpostproc52 libssh-4
: libswscale2 libtag1-vanilla libtag1c2a libxcomp3 libxvidcore4 nxproxy


--
from
Michael

Michael Pope

unread,
Apr 5, 2017, 9:59:07 PM4/5/17
to mlu...@googlegroups.com
If I run tcpdump whilst I do this command I get
: sudo tcpdump 'host authentication.business.gov.au'
:
: 11:57:12.833677 IP 192.168.200.4.40482 >
authentication.business.gov.au.https: Flags [S], seq 3577345880, win
14600, options [mss 1460,sackOK,TS val 215379076 ecr 0,nop,wscale 7],
length 0
: 11:57:12.856814 IP authentication.business.gov.au.https >
192.168.200.4.40482: Flags [S.], seq 3095362086, ack 3577345881, win
4140, options [mss 1460,nop,nop,TS val 1090181383 ecr
215379076,sackOK,eol], length 0
: 11:57:12.856859 IP 192.168.200.4.40482 >
authentication.business.gov.au.https: Flags [.], ack 1, win 14600,
options [nop,nop,TS val 215379082 ecr 1090181383], length 0
: 11:57:12.857340 IP 192.168.200.4.40482 >
authentication.business.gov.au.https: Flags [P.], seq 1:157, ack 1, win
14600, options [nop,nop,TS val 215379082 ecr 1090181383], length 156
: 11:57:12.873303 IP authentication.business.gov.au.https >
192.168.200.4.40482: Flags [R.], seq 1, ack 1, win 4140, length 0

from
Michael

Daniel Cross

unread,
Apr 5, 2017, 11:47:19 PM4/5/17
to mlu...@googlegroups.com
That it doesn't work in browsers and wget makes me think it's an issue separate from gnutls.

I have no answers, but instead questions:
- version of browser/wget/gnutls on each machine?
- date + time + timezone of each machine.

oh, actually, it does look like you're hitting different IPs from each machine:
Broken machine - 210.193.176.72
Working Machine - 143.174.192.33 (which I also get here)

I suspect this is your issue. What do you get if you run a dig from each machine?

Daniel

--
You received this message because you are subscribed to the Google Groups "mlug-au" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mlug-au+unsubscribe@googlegroups.com.
To post to this group, send email to mlu...@googlegroups.com.
Visit this group at https://groups.google.com/group/mlug-au.
For more options, visit https://groups.google.com/d/optout.

Gary Pope

unread,
Apr 6, 2017, 2:05:26 AM4/6/17
to mlu...@googlegroups.com
Does this comparison help show the what happens on my server?

gaz@absvenom:~$ wget --server-response https://authentication.business.gov.au/S001v4.0/authenticate/q3
--2017-04-06 16:00:20--  https://authentication.business.gov.au/S001v4.0/authenticate/q3
Resolving authentication.business.gov.au (authentication.business.gov.au)... 143.174.200.33
Connecting to authentication.business.gov.au (authentication.business.gov.au)|143.174.200.33|:443... connected.

HTTP request sent, awaiting response...
  HTTP/1.1 404 Not Found
  Cache-Control: private
  Transfer-Encoding: chunked
  Server: Microsoft-IIS/7.5
  X-AspNet-Version: 4.0.30319
  Set-Cookie: Prod__CurrentStateId=sOEdp+TrSq+bM2ltow3W62iSyh7PHbZlKBxMZXQVIVLxagTKh/Vntc33EZb4DGqjFxyu6E5uBwU00wLvxEjDaY8U7hQhkk6MxsOx/oDKl3QM1mfqjsXmd0KBlFFEI2sN14z8ktJxAoPPcmEkEem2KZLyxrHsTBpZvr1rX61STbcX; domain=authentication.business.gov.au; path=/; secure; HttpOnly
  X-Powered-By: ASP.NET
  Date: Thu, 06 Apr 2017 06:00:14 GMT
2017-04-06 16:00:21 ERROR 404: Not Found.




gaz@absvenom:~$  uname -a
Linux absvenom.lan 3.13.3-031303-generic #201402131842 SMP Thu Feb 13 23:43:57 UTC 2014 x86_64 GNU/Linux

gaz@absvenom:~$ lsb_release -a
No LSB modules are available.
Distributor ID:    Debian
Description:    Debian GNU/Linux testing (stretch)
Release:    testing
Codename:    stretch

--
--
Gary A. Pope
B.Bus(ACC)
DIRECTOR


Alchester Business Systems
m: 0408-994799 anytime.
p: 03-97626293
e: g...@alchester.com.au
w: www.alchester.com.au
Remote: Communications powered by ABSoutback3!
“We take care of everything!"

Gary Pope

unread,
Apr 6, 2017, 2:08:13 AM4/6/17
to mlu...@googlegroups.com
Yep me too. maybe DNS or random use of multiple site IP's is throwing
a difference ???

Like Daniel, I too get better result when using the 143.174.200.33

Gary

az@absvenom:~$ ping authentication.business.gov.au
PING authentication.wip.business.gov.au (143.174.200.33) 56(84) bytes of
data.
^C
--- authentication.wip.business.gov.au ping statistics ---
6 packets transmitted, 0 received, 100% packet loss, time 5040ms








On 06/04/17 13:47, Daniel Cross wrote:
> That it doesn't work in browsers and wget makes me think it's an issue
> separate from gnutls.
>
> I have no answers, but instead questions:
> - version of browser/wget/gnutls on each machine?
> - date + time + timezone of each machine.
>
> oh, actually, it does look like you're hitting different IPs from each
> machine:
> Broken machine - 210.193.176.72
> Working Machine - 143.174.192.33 (which I also get here)
>
> I suspect this is your issue. What do you get if you run a dig from
> each machine?
>
> Daniel
>
> On 6 April 2017 at 11:59, Michael Pope <map...@gmail.com
> <mailto:map...@gmail.com>> wrote:
>
> If I run tcpdump whilst I do this command I get
> : sudo tcpdump 'host authentication.business.gov.au
> <http://authentication.business.gov.au>'
> :
> : 11:57:12.833677 IP 192.168.200.4.40482 >
> authentication.business.gov
> <http://authentication.business.gov>.au.https: Flags [S], seq
> 3577345880, win
> 14600, options [mss 1460,sackOK,TS val 215379076 ecr 0,nop,wscale 7],
> length 0
> : 11:57:12.856814 IP authentication.business.gov
> <http://authentication.business.gov>.au.https >
> 192.168.200.4.40482: Flags [S.], seq 3095362086, ack 3577345881, win
> 4140, options [mss 1460,nop,nop,TS val 1090181383 ecr
> 215379076,sackOK,eol], length 0
> : 11:57:12.856859 IP 192.168.200.4.40482 >
> authentication.business.gov
> <http://authentication.business.gov>.au.https: Flags [.], ack 1,
> win 14600,
> options [nop,nop,TS val 215379082 ecr 1090181383], length 0
> : 11:57:12.857340 IP 192.168.200.4.40482 >
> authentication.business.gov
> <http://authentication.business.gov>.au.https: Flags [P.], seq
> 1:157, ack 1, win
> 14600, options [nop,nop,TS val 215379082 ecr 1090181383], length 156
> : 11:57:12.873303 IP authentication.business.gov
> <http://authentication.business.gov>.au.https >
> 192.168.200.4.40482: Flags [R.], seq 1, ack 1, win 4140, length 0
>
> from
> Michael
>
> On 06/04/17 11:04, Michael Pope wrote:
> > Hi MLUG,
> >
> > I'm having a problem logging into the tax portal on our main machine
> > here. I've been on the forum for auskey linux help but it looks like
> > it's a local problem to do with my server.
> >
> > I'm running Debian Wheezy on the broken machine. Here is the
> test I've
> > been doing;
> >
> > Broken machine output;
> >
> > $ wget --server-response
> > https://authentication.business.gov.au/S001v4.0/authenticate/q3
> <https://authentication.business.gov.au/S001v4.0/authenticate/q3>
> > --2017-04-06 10:59:31--
> > https://authentication.business.gov.au/S001v4.0/authenticate/q3
> <https://authentication.business.gov.au/S001v4.0/authenticate/q3>
> > Resolving authentication.business.gov.au
> <http://authentication.business.gov.au>
> > (authentication.business.gov.au
> <http://authentication.business.gov.au>)... 210.193.176.72
> > Connecting to authentication.business.gov.au
> <http://authentication.business.gov.au>
> > (authentication.business.gov.au
> <http://authentication.business.gov.au>)|210.193.176.72|:443...
> connected.
> > GnuTLS: A TLS packet with unexpected length was received.
> > Unable to establish SSL connection.
> >
> >
> > Correct output;
> >
> > $ wget --server-response
> > https://authentication.business.gov.au/S001v4.0/authenticate/q3
> <https://authentication.business.gov.au/S001v4.0/authenticate/q3>
> > --2017-04-06 10:55:03--
> > https://authentication.business.gov.au/S001v4.0/authenticate/q3
> <https://authentication.business.gov.au/S001v4.0/authenticate/q3>
> > Resolving authentication.business.gov.au
> <http://authentication.business.gov.au>
> > (authentication.business.gov.au
> <http://authentication.business.gov.au>)... 143.174.192.33
> <tel:143.174.192.33>
> > Connecting to authentication.business.gov.au
> <http://authentication.business.gov.au>
> > (authentication.business.gov.au
> <http://authentication.business.gov.au>)|143.174.192.33
> <tel:143.174.192.33>|:443... connected.
> > HTTP request sent, awaiting response...
> > HTTP/1.1 404 Not Found
> > Cache-Control: private
> > Transfer-Encoding: chunked
> > Server: Microsoft-IIS/7.5
> > X-AspNet-Version: 4.0.30319
> > Set-Cookie:
> >
> Prod__CurrentStateId=zX6uObWYGbHDsEE7tdFoCEpGnSfwgwCr3qaxAmO7dLmhhPwa2vRYpvX0sIspVKek0WReoYEsp7SZmfNrHAXcWz3glri8xnoXZ1L+uPyLlI4T1lgXUD38WWrJgPEAD7xIS2Lki6GHBjSN4YZl1yCavOH4o1QeQVDogWHXU552gktl;
> > domain=authentication.business.gov.au
> <http://authentication.business.gov.au>; path=/; secure; HttpOnly
> > X-Powered-By: ASP.NET <http://ASP.NET>
> <https://authentication.business.gov.au/S001v4.0/authenticate/q3>
> > : Resolving authentication.business.gov.au
> <http://authentication.business.gov.au>
> > (authentication.business.gov.au
> <http://authentication.business.gov.au>)... 210.193.176.72
> > : Connecting to authentication.business.gov.au
> <http://authentication.business.gov.au>
> > (authentication.business.gov.au
> <http://authentication.business.gov.au>)|210.193.176.72|:443...
> send an email to mlug-au+u...@googlegroups.com
> <mailto:mlug-au%2Bunsu...@googlegroups.com>.
> To post to this group, send email to mlu...@googlegroups.com
> <mailto:mlu...@googlegroups.com>.
> Visit this group at https://groups.google.com/group/mlug-au
> <https://groups.google.com/group/mlug-au>.
> For more options, visit https://groups.google.com/d/optout
> <https://groups.google.com/d/optout>.
>
>
> --
> You received this message because you are subscribed to the Google
> Groups "mlug-au" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to mlug-au+u...@googlegroups.com
> <mailto:mlug-au+u...@googlegroups.com>.
> To post to this group, send email to mlu...@googlegroups.com
> <mailto:mlu...@googlegroups.com>.
> Visit this group at https://groups.google.com/group/mlug-au.
> For more options, visit https://groups.google.com/d/optout.


--
--
*Gary A. Pope*
B.Bus(ACC)
DIRECTOR
<http://www.alchester.com.au/reckon-accounts-clarified>

*Alchester Business Systems*
m: 0408-994799 anytime.
p: 03-97626293
e: g...@alchester.com.au <mailto:g...@alchester.com.au>
w: www.alchester.com.au <http://www.alchester.com.au>
Remote: Communications powered by ABSoutback3!
/_“We take care of everything!"_/
<http://www.linkedin.com/pub/gary-pope/2/550/822>

Michael Pope

unread,
Apr 6, 2017, 8:45:57 PM4/6/17
to mlu...@googlegroups.com
Found the problem, I had an old work around line in my /etc/hosts file
which was directing traffic to the wrong IP address. This was put there
a long time ago when the ATO DNS wasn't getting updated correctly and I
had to manually direct my server to the new ATO server. The ATO must of
changed IP addresses and now I've taken that out it all works. Thanks guys.

from
Michael

Robin Garen Aaberg

unread,
Apr 7, 2017, 4:52:06 AM4/7/17
to mlu...@googlegroups.com
Hate when those hosts files get yah. It's always DNS :)
> To unsubscribe from this group and stop receiving emails from it, send an email to mlug-au+u...@googlegroups.com.
> To post to this group, send email to mlu...@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages