Filezilla fails establishing FTPES connexion since gnutls 3.0.0 update

Question

Hi all,
I'm running into some troubles since the last gnutls update ( 3.0.0-2 ).
Filezilla won't connect in FTPES to a server using a self signed certificate I'm running into the following error :
Status:    Connecting to xx.xxx.xxx.xx:21...
Status:    Connection established, waiting for welcome message...
Trace:    CFtpControlSocket::OnReceive()
Response:    220 ProFTPD 1.3.3a Server (XXXXXXX FTP SERVER) [::ffff:xx.xxx.xxx.xx]
Trace:    CFtpControlSocket::SendNextCommand()
Command:    AUTH TLS
Trace:    CFtpControlSocket::OnReceive()
Response:    234 AUTH TLS successful
Status:    Initializing TLS...
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::ContinueHandshake()
Trace:    CTlsSocket::OnSend()
Trace:    CTlsSocket::OnRead()
Trace:    CTlsSocket::ContinueHandshake()
Trace:    CTlsSocket::Failure(-12, 103)
Trace:    GnuTLS alert 40: Handshake failed
Error:    GnuTLS error -12: A TLS fatal alert has been received.
Trace:    CRealControlSocket::OnClose(103)
Trace:    CControlSocket::DoClose(64)
Trace:    CFtpControlSocket::ResetOperation(66)
Trace:    CControlSocket::ResetOperation(66)
Error:    Could not connect to server
Trace:    CFileZillaEnginePrivate::ResetOperation(66)
On the server side the tls error log shows :
Aug 18 20:02:05 mod_tls/2.4.1[21290]: TLS/TLS-C requested, starting TLS handshake
Aug 18 20:02:05 mod_tls/2.4.1[21290]: unable to accept TLS connection: protocol error:
  (1) error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Aug 18 20:02:05 mod_tls/2.4.1[21290]: TLS/TLS-C negotiation failed on control channel
Connexion with other clients such as lftp succeeds.
Is anyone else running into this issue ?
TeM
Last edited by TeM (2011-08-18 20:33:31)

Answer 1

Same happens for me, though I don't know how you got that log output. If I downgrade to gnutls-2.12.7-2-i686.pkg.tar.xz and filezilla-3.5.0-1-i686.pkg.tar.xz, then I can connect again. I don't know how to go about finding how to fix it.
Edit:
I thought it may have something to do with this that the OP pasted:
Aug 18 20:02:05 mod_tls/2.4.1[21290]: unable to accept TLS connection: protocol error:
(1) error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
But no:
$ gnutls-cli -v | head -n1
gnutls-cli (GnuTLS) 3.0.0
$ gnutls-cli -l | grep Ciphers
Ciphers: AES-256-CBC, AES-192-CBC, AES-128-CBC, AES-128-GCM, 3DES-CBC, DES-CBC, ARCFOUR-128, ARCFOUR-40, RC2-40, CAMELLIA-256-CBC, CAMELLIA-128-CBC, IDEA-PGP-CFB, 3DES-PGP-CFB, CAST5-PGP-CFB, BLOWFISH-PGP-CFB, SAFER-SK128-PGP-CFB, AES-128-PGP-CFB, AES-192-PGP-CFB, AES-256-PGP-CFB, TWOFISH-PGP-CFB, NULL
and
$ gnutls-cli -v | head -n1
gnutls-cli (GnuTLS) 2.12.7
$ gnutls-cli -l | grep Ciphers
Ciphers: AES-256-CBC, AES-128-CBC, 3DES-CBC, DES-CBC, ARCFOUR-128, ARCFOUR-40, RC2-40, CAMELLIA-256-CBC, CAMELLIA-128-CBC, NULL
According to that all the old ciphers are still there.
Last edited by SidK (2011-08-18 21:40:52)