linux系统更新时,时常出现openssl error #135

vonl1 · 2022-05-14T10:25:48Z

vonl1
May 14, 2022

固件信息:Powered by LuCI Master (git-22.125.20933-1d73ea8) / OpenWrt R22.5.4

内核版本:5.15.39

错误信息

错误：无法从 mirrors.ustc.edu.cn : OpenSSL SSL_read: 

error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac, 

errno 0 获取文件 'linux-5.17.7.arch1-1-x86_64.pkg.tar.zst'

问题介绍

linux使用国内镜像更新系统时常出现这个问题,经过控制变量,排除是插件的问题(排除openclash和adguardhome),更换镜像站还不时出现同样的问题

用你编译的固件出现这个问题,然后我也手动编译一个5.15固件也出现同样的问题

在此怀疑是固件的问题

然后下午我编译一个5.10内核的固件,没有出现这种问题

Boos4721 · 2022-05-14T11:35:23Z

Boos4721
May 14, 2022
Maintainer

Raspi with Ubuntu

2 replies

vonl1 May 14, 2022
Author

5.10内核也让我遇到了

图一 archlinux 安装aur软件包过程中

图二下午才编译的5.10固件

Boos4721 May 14, 2022
Maintainer

5.10内核也让我遇到了

图一 archlinux 安装aur软件包过程中

图二下午才编译的5.10固件

CHECK UR NETWORK AND OPENSSL

jat001 · 2022-05-14T16:59:20Z

jat001
May 14, 2022

成功复现，经反复测试，只有有线连接有这种情况，连wifi是没问题的

这是用有线的，大部分情况下很快就断了

curl -v -o /dev/null https://mirrors.cloud.tencent.com/ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso                               
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 121.12.123.250:443...
* TCP_NODELAY set
* Connected to mirrors.cloud.tencent.com (121.12.123.250) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [112 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4012 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=\U5E7F\U4E1C\U7701; L=\U6DF1\U5733\U5E02; O=Shenzhen Tencent Computer Systems Company Limited; CN=mirrors.tencent.com
*  start date: Jun 10 00:00:00 2021 GMT
*  expire date: Jul 11 23:59:59 2022 GMT
*  subjectAltName: host "mirrors.cloud.tencent.com" matched cert's "mirrors.cloud.tencent.com"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert Secure Site CN CA G3
*  SSL certificate verify ok.
} [5 bytes data]
> GET /ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso HTTP/1.1
> Host: mirrors.cloud.tencent.com
> User-Agent: curl/7.68.0
> Accept: */*
>
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Etag: "6260f661-552f3000"
< Server: tws
< Date: Sat, 14 May 2022 16:32:02 GMT
< Content-Type: application/octet-stream
< X-Daa-Tunnel: hop_count=3
< Accept-Ranges: bytes
< X-Cache-Lookup: Cache Hit
< Last-Modified: Thu, 21 Apr 2022 06:14:57 GMT
< Content-Length: 1429155840
< X-NWS-LOG-UUID: 13211515239217403712
< Connection: keep-alive
< X-Cache-Lookup: Hit From Inner Cluster
<
{ [5 bytes data]
  2 1362M    2 37.5M    0     0  19.1M      0  0:01:11  0:00:01  0:01:10 19.1M* TLSv1.2 (OUT), TLS alert, bad record mac (532):
} [2 bytes data]
* OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac, errno 0
  2 1362M    2 38.1M    0     0  13.4M      0  0:01:41  0:00:02  0:01:39 13.4M
* Closing connection 0
curl: (56) OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac, errno 0

这是连wifi的，可以看到十分钟还没断

curl -v -o /dev/null https://mirrors.cloud.tencent.com/ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso                              
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 121.12.123.250:443...
* TCP_NODELAY set
* Connected to mirrors.cloud.tencent.com (121.12.123.250) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [112 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4012 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=\U5E7F\U4E1C\U7701; L=\U6DF1\U5733\U5E02; O=Shenzhen Tencent Computer Systems Company Limited; CN=mirrors.tencent.com
*  start date: Jun 10 00:00:00 2021 GMT
*  expire date: Jul 11 23:59:59 2022 GMT
*  subjectAltName: host "mirrors.cloud.tencent.com" matched cert's "mirrors.cloud.tencent.com"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert Secure Site CN CA G3
*  SSL certificate verify ok.
} [5 bytes data]
> GET /ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso HTTP/1.1
> Host: mirrors.cloud.tencent.com
> User-Agent: curl/7.68.0
> Accept: */*
>
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Etag: "6260f661-552f3000"
< Server: tws
< Date: Sat, 14 May 2022 16:32:02 GMT
< Content-Type: application/octet-stream
< X-Daa-Tunnel: hop_count=3
< Accept-Ranges: bytes
< X-Cache-Lookup: Cache Hit
< Last-Modified: Thu, 21 Apr 2022 06:14:57 GMT
< Content-Length: 1429155840
< X-NWS-LOG-UUID: 2041167099701984975
< Connection: keep-alive
< X-Cache-Lookup: Hit From Inner Cluster
<
{ [5 bytes data]
 46 1362M   46  639M    0     0  2315k      0  0:10:02  0:04:42  0:05:20 1394k

1 reply

Boos4721 May 14, 2022
Maintainer

成功复现，经反复测试，只有有线连接有这种情况，连wifi是没问题的

这是用有线的，大部分情况下很快就断了

curl -v -o /dev/null https://mirrors.cloud.tencent.com/ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso                               
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 121.12.123.250:443...
* TCP_NODELAY set
* Connected to mirrors.cloud.tencent.com (121.12.123.250) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [112 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4012 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=\U5E7F\U4E1C\U7701; L=\U6DF1\U5733\U5E02; O=Shenzhen Tencent Computer Systems Company Limited; CN=mirrors.tencent.com
*  start date: Jun 10 00:00:00 2021 GMT
*  expire date: Jul 11 23:59:59 2022 GMT
*  subjectAltName: host "mirrors.cloud.tencent.com" matched cert's "mirrors.cloud.tencent.com"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert Secure Site CN CA G3
*  SSL certificate verify ok.
} [5 bytes data]
> GET /ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso HTTP/1.1
> Host: mirrors.cloud.tencent.com
> User-Agent: curl/7.68.0
> Accept: */*
>
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Etag: "6260f661-552f3000"
< Server: tws
< Date: Sat, 14 May 2022 16:32:02 GMT
< Content-Type: application/octet-stream
< X-Daa-Tunnel: hop_count=3
< Accept-Ranges: bytes
< X-Cache-Lookup: Cache Hit
< Last-Modified: Thu, 21 Apr 2022 06:14:57 GMT
< Content-Length: 1429155840
< X-NWS-LOG-UUID: 13211515239217403712
< Connection: keep-alive
< X-Cache-Lookup: Hit From Inner Cluster
<
{ [5 bytes data]
  2 1362M    2 37.5M    0     0  19.1M      0  0:01:11  0:00:01  0:01:10 19.1M* TLSv1.2 (OUT), TLS alert, bad record mac (532):
} [2 bytes data]
* OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac, errno 0
  2 1362M    2 38.1M    0     0  13.4M      0  0:01:41  0:00:02  0:01:39 13.4M
* Closing connection 0
curl: (56) OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac, errno 0

这是连wifi的，可以看到十分钟还没断

curl -v -o /dev/null https://mirrors.cloud.tencent.com/ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso                              
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 121.12.123.250:443...
* TCP_NODELAY set
* Connected to mirrors.cloud.tencent.com (121.12.123.250) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [112 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4012 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [300 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [37 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CN; ST=\U5E7F\U4E1C\U7701; L=\U6DF1\U5733\U5E02; O=Shenzhen Tencent Computer Systems Company Limited; CN=mirrors.tencent.com
*  start date: Jun 10 00:00:00 2021 GMT
*  expire date: Jul 11 23:59:59 2022 GMT
*  subjectAltName: host "mirrors.cloud.tencent.com" matched cert's "mirrors.cloud.tencent.com"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert Secure Site CN CA G3
*  SSL certificate verify ok.
} [5 bytes data]
> GET /ubuntu-cdimage/ubuntu/releases/22.04/release/ubuntu-22.04-live-server-arm64.iso HTTP/1.1
> Host: mirrors.cloud.tencent.com
> User-Agent: curl/7.68.0
> Accept: */*
>
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Etag: "6260f661-552f3000"
< Server: tws
< Date: Sat, 14 May 2022 16:32:02 GMT
< Content-Type: application/octet-stream
< X-Daa-Tunnel: hop_count=3
< Accept-Ranges: bytes
< X-Cache-Lookup: Cache Hit
< Last-Modified: Thu, 21 Apr 2022 06:14:57 GMT
< Content-Length: 1429155840
< X-NWS-LOG-UUID: 2041167099701984975
< Connection: keep-alive
< X-Cache-Lookup: Hit From Inner Cluster
<
{ [5 bytes data]
 46 1362M   46  639M    0     0  2315k      0  0:10:02  0:04:42  0:05:20 1394k

Ty lastest firmware.

jat001 · 2022-05-14T19:48:29Z

jat001
May 14, 2022

搜了一下，这个错误不是个例，貌似只有在有线网络下，传输大文件时才会发生
https://forum.openwrt.org/t/adding-openwrt-support-for-xiaomi-ax3600/55049/3874

0 replies

jat001 · 2022-05-14T20:11:41Z

jat001
May 14, 2022

找到解决方案了
https://forum.openwrt.org/t/adding-openwrt-support-for-qnap-qhora-301w/96934/200
安装ethtool然后关掉所有lan口 (默认eth1 eth2 eth3) 的tcp segmentation offload (tso)功能就行，多次测试没问题了，代价是大流量时cpu占用更高了，但至少比不能用好

ethtool -K eth1 tso off

1 reply

Boos4721 May 15, 2022
Maintainer

找到解决方案了 https://forum.openwrt.org/t/adding-openwrt-support-for-qnap-qhora-301w/96934/200 安装ethtool然后关掉所有lan口 (默认eth1 eth2 eth3) 的tcp segmentation offload (tso)功能就行，多次测试没问题了，代价是大流量时cpu占用更高了，但至少比不能用好
ethtool -K eth1 tso off

Hum.

linux系统更新时,时常出现openssl error #135

Uh oh!

Uh oh!

vonl1 May 14, 2022

固件信息:Powered by LuCI Master (git-22.125.20933-1d73ea8) / OpenWrt R22.5.4

内核版本:5.15.39

错误信息

问题介绍

Replies: 4 comments · 4 replies

Uh oh!

Boos4721 May 14, 2022 Maintainer

Uh oh!

vonl1 May 14, 2022 Author

Uh oh!

Boos4721 May 14, 2022 Maintainer

Uh oh!

jat001 May 14, 2022

Uh oh!

Boos4721 May 14, 2022 Maintainer

Uh oh!

jat001 May 14, 2022

Uh oh!

Uh oh!

jat001 May 14, 2022

Uh oh!

Boos4721 May 15, 2022 Maintainer

vonl1
May 14, 2022

Replies: 4 comments 4 replies

Boos4721
May 14, 2022
Maintainer

vonl1 May 14, 2022
Author

Boos4721 May 14, 2022
Maintainer

jat001
May 14, 2022

Boos4721 May 14, 2022
Maintainer

jat001
May 14, 2022

jat001
May 14, 2022

Boos4721 May 15, 2022
Maintainer