#9338: Unable to connect to the GTalk with GnuTLS 2.8

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
-------------------------+--------------------------------------------------
 Reporter:  LukynZ       |     Owner:  darkrain42
     Type:  defect       |    Status:  new      
Component:  Google Talk  |   Version:  2.5.6    
 Keywords:               |  
-------------------------+--------------------------------------------------
 Hi, after update of GnuTLS to the version 2.8, Pidgin can't connect to the
 GTalk account with Read Error msg. Downgrade of GnuTLS back to the
 previous version solve this problem.

 Here is the debug:

 {{{
 (08:57:11) jabber: xmlParseChunk returned warning 100
 (08:57:11) gnutls: receive failed: A TLS packet with unexpected length was
 received.
 (08:57:11) jabber: Disconnected: Input/output error
 (08:57:11) gnutls: send failed: The specified session has been invalidated
 for some reason.
 (08:57:11) gnutls: receive failed: The specified session has been
 invalidated for some reason.
 (08:57:11) jabber: Disconnected: Input/output error
 (08:57:11) gnutls: send failed: The specified session has been invalidated
 for some reason.
 (08:57:11) account: Disconnecting account 0x94f6038
 (08:57:11) connection: Disconnecting connection 0x988aa78
 (08:57:11) connection: Deactivating keepalive.
 (08:57:11) jabber: XML parser error for JabberStream 0x99630e8: Domain 1,
 code 5, level 3: Extra content at the end of the document
 (08:57:11) connection: Destroying connection 0x988aa78
 }}}

--
Ticket URL: <http://developer.pidgin.im/ticket/9338>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by nite):

 Confirmed, the exactly same debug output with Pidgin 2.5.6 and GnuTLS
 versions 2.8.0 and 2.8.1. Works fine with GnuTLS 2.6.6. Gentoo (Funtoo)
 linux amd64.

 It doesn't happen straight after the connection though, a few messages are
 exchanged with the server (presence, icon pictures), sometimes I can see
 my contacts blink in the roster before I get the error.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:1>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  pending    
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------
Changes (by darkrain42):

  * status:  new => pending


Comment:

 LukynZ, what version of GnuTLS did you downgrade to? Does your experience
 match nite's (i.e. it works for a while and then disconnects)?

 What are the few lines right before it disconnects (relating to jabber)?

 Are there versions of GnuTLS between 2.6 and 2.8 (some of the 2.7 series)
 that you can test with?

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:2>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  pending    
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------
Changes (by LukynZ):

  * status:  pending => new


Comment:

 Replying to [comment:2 darkrain42]:
 > LukynZ, what version of GnuTLS did you downgrade to? Does your
 experience match nite's (i.e. it works for a while and then disconnects)?

 Downgrading to version 2.6.6. Experience is exactly same. Buddylist just
 blink and disconnect. And I am using gentoo too.

 > What are the few lines right before it disconnects (relating to jabber)?

 ok with few lines before

 {{{
 (22:47:05) jabber: Recv (ssl)(269): <presence from="xxxx@.../Home"
 to="xxxx@.../Pidgin479E05B0"><show>away</show><c
 node="http://pidgin.im/caps" ver="2.5.6" ext="mood moodn nick nickn tune
 tunen avatarmeta avatardata bob avatar"
 xmlns="http://jabber.org/protocol/caps"/></presence>
 (22:47:05) blist: Updating buddy status for xxxx@... (XMPP)
 (22:47:05) nautilus: saved blist online
 (22:47:05) cap: Executing: insert into cap_status (buddy, account,
 protocol, status, event_time) values(xxxx@...,
 xxxx@.../Pidgin, prpl-jabber, away, now());
 (22:47:05) jabber: xmlParseChunk returned warning 100
 (22:47:05) gnutls: receive failed: A TLS packet with unexpected length was
 received.
 (22:47:05) jabber: Disconnected: Input/output error
 (22:47:05) gnutls: receive failed: The specified session has been
 invalidated for some reason.
 (22:47:05) jabber: Disconnected: Input/output error
 (22:47:05) account: Disconnecting account 0x93985a0
 (22:47:05) connection: Disconnecting connection 0x965ff80
 (22:47:05) connection: Deactivating keepalive.
 (22:47:05) jabber: XML parser error for JabberStream 0x9652100: Domain 1,
 code 5, level 3: Extra content at the end of the document
 (22:47:05) connection: Destroying connection 0x965ff80
 }}}

 > Are there versions of GnuTLS between 2.6 and 2.8 (some of the 2.7
 series) that you can test with?


 There is no version between 2.6.6 and 2.8 I can test. :(

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:3>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by darkrain42):

 Could you tcpdump the SSL stream (`tcpdump -s0 -w output.pcap port 5222`)
 and either attach it to this ticket or email it to me (my nick -at-
 pidgin.im)?

 If you have Pidgin configured to use "old-style ssl" in the account
 settings, you'll need to change 5222 to 5223.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:4>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by LukynZ):

 ok, check your mail

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:5>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by tante):

 I posted the bug in the Gentoo Bugzilla and on the gnutls Mailing list
 (http://lists.gnu.org/archive/html/gnutls-devel/2009-06/msg00022.html), a
 developer on the mailing list asked for a patch to be applied to get some
 gnutls debug data (http://lists.gnu.org/archive/html/gnutls-
 devel/2009-06/msg00023.html), maybe something can be worked out?

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:6>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by darkrain42):

 tante: Thank you for doing that.

 I just got a chance to look at the packet capture and don't see anything
 terribly relevant (there seem to be a lot of retransmissions, that's about
 it).

 I'm in the process of compile-testing a patch which I'll upload in just a
 minute that will add gnutls debug output (at level 7). Please test with
 the patch (if you post it just to the mailing list, add a comment on the
 ticket).

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:7>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by tante):

 Ok, I applied the patch to Gentoo's 2.5.6 pidgin version and used
 gnutls-2.8.1.

 I activated _just_ one jabber account (tante@...) and got the error
 that was described earlier (connection first works but terminates after
 seconds).

 I captured the whole shebang running "pidgin -d > out.txt" which is quite
 long (636K), the relevant part is between the lines 14780 and 14789:

 ----------- snip ---------

 (18:46:06) gnutls: lvl 7: READ: read 32 bytes from 0x12

 (18:46:06) gnutls: lvl 7: 0000 - 6e 96 ae f5 6d 3a b6 24 4c 03 57 95 3c fa
 fa 89

 (18:46:06) gnutls: lvl 7: 0001 - 44 21 4c 6c 1c 09 ca 0c 83 52 c2 ca e8 77
 d4 f0

 (18:46:06) gnutls: lvl 7: 0002 -

 (18:46:06) gnutls: lvl 7: RB: Have 5 bytes into buffer. Adding 32 bytes.

 (18:46:06) gnutls: lvl 7: RB: Requested 37 bytes

 (18:46:06) gnutls: lvl 4: REC[0x10bc700]: Decrypted Packet[104] Alert(21)
 with length: 2

 (18:46:06) gnutls: lvl 4: REC[0x10bc700]: Alert[2|20] - Bad record MAC -
 was received

 (18:46:06) gnutls: lvl 2: ASSERT: gnutls_record.c:695

 (18:46:06) gnutls: lvl 2: ASSERT: gnutls_record.c:1048

 (18:46:06) gnutls: receive failed: A TLS fatal alert has been received.
 (18:46:06) jabber: Disconnected: Input/output error
 (18:46:06) account: Disconnecting account 0x7f75a0
 (18:46:06) connection: Disconnecting connection 0x1097050
 (18:46:06) connection: Deactivating keepalive.
 (18:46:06) gnutls: lvl 4: REC: Sending Alert[1|0] - Close notify

 ------- snip ---------

 Hope this helps? I'll attach the whole dump to the bug report.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:8>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by chaz6):

 If it helps, I have the same problem using the stock GnuTLS 2.8.1 compiled
 directly from source.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:9>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by jas):

 Replying to [comment:7 darkrain42]:
 > I'm in the process of compile-testing a patch which I'll upload in just
 a minute that will add gnutls debug output (at level 7). Please test with
 the patch (if you post it just to the mailing list, add a comment on the
 ticket).

 Thanks for this.  It seems like the final \n isn't needed though?  The
 debug log posted by tante contains an extra \n for every line, so I
 suspect purple_debug_misc is adding one internally.

 /Simon

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:10>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by deryni):

 The purple_debug functions do not add newlines, which means that the
 gnutls debug messages include them.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:11>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by jas):

 Replying to [comment:11 deryni]:
 > The purple_debug functions do not add newlines, which means that the
 gnutls debug messages include them.

 Ah right.  So if you want to commit this into pidgin code base, the \n
 should be removed.  And the value 7 should probably be configurable, and
 maybe the default should be 0.

 /Simon

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:12>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by jas):

 Replying to [comment:8 tante]:
 > Ok, I applied the patch to Gentoo's 2.5.6 pidgin version and used
 gnutls-2.8.1.

 Thanks! Could you also generate a similar bug but using gnutls-2.6.x?
 I.e., one that works for you. It helps to compare the logs.

 Unfortunately I don't recognize this type of error -- it seems the
 handshake works fine, and even sending quite some data, but after a while
 it fails with a bad MAC error.

 I know it is boring work, but maybe you could try experimental releases
 gnutls 2.7.x to see where the problem is introduced. Install 2.6.x, check
 if it works, install 2.8.x confirm that it fails, install 2.7.y and check
 if it works, and increment y until you run into a problem. I'd expect the
 problem to be 0 =< y =< 8, so if you want to do a binary search instead,
 test 8 first to rule out a problem with the later 2.7.y's, and then 2.7.4.
 Just reporting this result will help me inspect code changes.

 /Simon

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:13>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by tante):

 After having uploaded the "working" setup debug output I'll try building
 2.7 versions of gnutls and see whether we find where it breaks.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:14>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by tante):

 This is weird.
 I tried gnutls 2.7.4, 2.7.8 and 2.7.9 and I couldn't reproduce the bug.
 With 2.7.4. and 2.7.8 the first jabber connection failed but then things
 were perfectly fine.

 Since I have no clue what triggers the actual bug it could be connected to
 the fact that it's somewhat early here and not too many contacts online
 but I have no clue. Anything else I can do to provide more data?

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:15>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by jas):

 Of course, in case it isn't obvious, this _could_ be a problem on the
 server side at GTalk that is being worked on at Google's side.

 It wasn't clear to me, can you still reproduce the problem using gnutls
 2.8.x?  There were only minor changes between 2.7.9 and 2.8.1.  So if
 2.7.9 works and 2.8.1 doesn't, we should be able to find the problematic
 code more easily.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:17>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by tante):

 Replying to [comment:16 jas]:

 > Strange.  Just a small suspicion: are you sure you are using the newly
 built gnutls?  Maybe you could add debug output line that looks like:

 I have written custom ebuilds for gnutls so they were replacing the
 version I had had installed before.

 > ssl_gnutls_log(0, "gnutls api %s abi version %s", GNUTLS_VERSION,
 gnutls_check_version (NULL));

 I'll add that line anyways.

 > You could test 2.7.14 too, to see if the problem was introduced after
 2.7.9.  This strikes me as unlikely though, but you never know.  But
 please make sure you run with the debug logging added above, so we are
 sure you get the expected gnutls version.

 Will do more testing, thanks for the input.

 > /Simon

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:18>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by tante):

 I modified the patch to include the line you gave me right after the
 "gnutls_global_set_log_function(ssl_gnutls_log); " line but not it doesn't
 compile anymore.
 {{{
 ssl-gnutls.c: In function ‘ssl_gnutls_init_gnutls’:
 ssl-gnutls.c:71: error: ‘GNUTLS_VERSION’ undeclared (first use in this
 function)
 ssl-gnutls.c:71: error: (Each undeclared identifier is reported only once
 ssl-gnutls.c:71: error: for each function it appears in.)
 ssl-gnutls.c:71: error: too many arguments to function ‘ssl_gnutls_log’
 }}}

 As I said, I'm not a C guy so I might have added it to a stupid location.

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:19>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker

[Pidgin]

#9338: Unable to connect to the GTalk with GnuTLS 2.8
--------------------+-------------------------------------------------------
 Reporter:  LukynZ  |        Owner:  darkrain42
     Type:  defect  |       Status:  new        
Milestone:          |    Component:  Google Talk
  Version:  2.5.6   |   Resolution:            
 Keywords:          |  
--------------------+-------------------------------------------------------

Comment(by jas):

 Replying to [comment:19 tante]:
 > ssl-gnutls.c:71: error: ‘GNUTLS_VERSION’ undeclared (first use in this
 function)

 Oops, please use LIBGNUTLS_VERSION instead.

 /Simon

--
Ticket URL: <http://developer.pidgin.im/ticket/9338#comment:20>
Pidgin <http://pidgin.im>
Pidgin
_______________________________________________
Tracker mailing list
Tracker@...
http://pidgin.im/cgi-bin/mailman/listinfo/tracker