Re: [gentoo-user] wget SSL authentication problem?

[Miroslav Rovis]

On 170112-09:36+0000, Neil Bothwick wrote:
> On Thu, 12 Jan 2017 19:19:11 +1100, Adam Carter wrote:
>
> > > > wget
> > > > 'https://data.giss.nasa.gov/gistemp/tabledata_v3/GLB.Ts+dSST.txt'
> > > >
> > > > Resolving data.giss.nasa.gov... 128.183.4.33
> > > > Connecting to data.giss.nasa.gov|128.183.4.33|:443... connected.
> > > > OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3
> > > > alert handshake failure
> > > > Unable to establish SSL connection.
> > >
> >
> > Works ok here (~amd64) with the following versions/flags;
>
> Works here too. Could it be a certificate problem? Re-emerging
> ca-certificates and removing any dead symlinks to old certificates might
> help, but first I'd try cranking up the verbosity in wget.

Sure that "-S":
  -S,  --server-response           print server response
cranks up verbosity.

But, maybe you're playing with the wrong sample that behaves well in
three of us that posted, and bad in one machine only (Walter Dnes's).

How about when you get with:

wget -S \
	https://www.redhat.com/archives/virt-tools-list/2017-January.txt.gz \
	|& tee 2017-January.txt.gz.log

consistently same good size, same hash:

sha256sum 2017-January.txt.gz 2017-January.txt.gz.1

0ed31e4b55af11f341d7158741b3f1ab46c3b0eb07548063665fc038a50cc547
2017-January.txt.gz

0ed31e4b55af11f341d7158741b3f1ab46c3b0eb07548063665fc038a50cc547
2017-January.txt.gz.1

( formatted for mail, but 3 lines only )

but alas, not gunzip'able file!

(download it from
http://www.croatiafidelis.hr/foss/cap/cap-170112_wget-ssl/
and also find the log, done with "wget -S", there now:
2017-January.txt.gz.log
)

$ cat 2017-January.txt.gz | gunzip > 2017-January.txt

gzip: stdin: not in gzip format
$

And that's consistent, just rechecked. The hash is that same one as in
the dir on my NGO's site, and as in this email.

Is it because saves something from the attempt at using IPv6 first!
Don't know... And it is here that the network traces play important
role... But I get different results tracing with Tcpdump, then tracing
with Dumpcap... And it may be that in neither case is the
2017-January.txt.gz extractable correctly from traces. I only tried it
with the other wget-downloding file that's in that dir on my NGO's site,
and that other file, the wget-1.18.tar.xz, extract partly and
differently with tcpdump and with dumpcap...

However, I have more interfering issues. Interfering, because they're
network, but they are different network issues, unrelated. And also not
explainable in a sentence or two. Give me time, if you care, and check
the right file this time around... ;-)

And if the download shows like I described, then this is bug, and in
that case, pls. if anybody has the time, try and just give the address
of my samples to Giuseppe Scrivano, the Wget maintaner (a connational of
Croatia, Hrvoje Nikšić, whom I don't know, is the original author of
Wget), post the bug at the already given:

http://lists.gnu.org/mailman/listinfo/bug-wget

(of course, only if the download shows like I described above)

Give me more time, and I'll try and tell about those interfering
unrelated network issues.

(
And did anybody noticed that the network might be getting decryptable
for us final users, it the Wget's trend to decrypt SSL-keys into the
$SSLKEYLOGFILE catches up? Repasting the link from the first post:

Write TLS session keys to $SSLKEYLOGFILE
https://github.com/rg3/youtube-dl/issues/11614

Nobody understands how big thing that is, should the trend catch up?
youtube-dl, and then imagine, decrypting your conversations that you do
with git, just imagine, no more opaque conversations for the user!!

And then all the other FOSS programs that interact with the network! SSL
encrypted well for everybody else, noone can MiTM you, you passwords
secure, but the conversations opens up like a flower to you, and tells
you everything that happened on the network...

Which is not the case today. Exampli gratia: Youtube, the stinking
Schmoog's Youtube. It is as opaque as prison without light five storeys
underground! The self proclamed "do-no-evil" liers and factual spies on
almost the whole world!
)

Regards!
-- 
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr