[Spice-devel] Neep help with ssl

Alexandre DERUMIER aderumier at odiso.com
Wed Apr 17 10:06:01 PDT 2013


>>If I read this correctly, you're getting the same error when using plain 
>>openssl client - that would suggest indeed suggest some problem with 
>>certificates and/or openssl library but certainly outside of scope of 
>>spice components. 

I finally get it working !, using tls-ciphers options.

theses cipher works for me:

spicec -h kvmtest1.odiso.net -s 60101 --ca-file ca-cert.pem --tls-ciphers DES-CBC-SHA
spicec -h kvmtest1.odiso.net -s 60101 --ca-file ca-cert.pem --tls-ciphers DES-CBC3-SHA
spicec -h kvmtest1.odiso.net -s 60101 --ca-file ca-cert.pem --tls-ciphers SEED-SHA


What is the default ciphers used if tls ciphers option is not specified ?

I see some bug report on openssl mailing list recently with aes cipher and "bad record mac" error, but it seem to be fixed now.


Thanks Again for help David !

Alexandre

----- Mail original ----- 

De: "David Jaša" <djasa at redhat.com> 
À: "Alexandre DERUMIER" <aderumier at odiso.com> 
Cc: spice-devel at lists.freedesktop.org 
Envoyé: Mercredi 17 Avril 2013 18:07:31 
Objet: Re: [Spice-devel] Neep help with ssl 

Alexandre DERUMIER píše v St 17. 04. 2013 v 17:07 +0200: 
> Here some news, 
> 
> the problem seem to be located on qemu-spice server side. 
> 
> I have reused my working certificates from proxmox (which works fine with vnc/tls and also https). 
> 
> 
> Maybe is it a compatibility problem with spice and openssl of debian wheezy (1.0.1e) ? 
> 
> soft stack versions are : 
> 
> - qemu 1.4.1 
> - spice 0.12.2 
> - libspice-protocol-dev 0.12.5 
> - openssl 1.0.1e 
> 
> 
> 
> 
> Here some tests results with openssl: 
> 
> 
> openssl client -> openssl server : OK 
> --------------------------------- 
> #openssl s_client -connect kvmtest1.odiso.net:60101 -CAfile ca-cert.pem 
> #openssl s_server -accept 60101 -cert server-cert.pem -key server-key.pem -CAfile ca-cert.pem 
> 
> 
> spicec client -> openssl server : OK 
> -------------------------------- 
> #spicec -h kvmtest1.odiso.net -s 60101 --ca-file ca-cert.pem 
> 
> #openssl s_server -accept 60101 -cert server-cert.pem -key server-key.pem -CAfile ca-cert.pem 
> 
> 
> 
> 
> spicec client -> spice server : FAIL 
> ------------------------------------ 
> #spicec -h kvmtest1.odiso.net -s 60101 --ca-file ca-cert.pem 
> 
> #qemu -spice tls-port=60101,disable-ticketing,x509-dir=/etc/pki/libvirt-spice 
> 
> 
> Error: failed to connect w/SSL, ssl_error error:00000001:lib(0):func(0):reason(1) 
> 140292888880376:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:s3_pkt.c:1256:SSL alert number 20 
> Warning: SSL Error: error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac 
> 
> 
> 
> 
> openssl client -> spice server : FAIL 
> -------------------------------------- 
> #openssl s_client -connect kvmtest1.odiso.net:60101 -CAfile ca-cert.pem 
> 
> #qemu -spice tls-port=60101,disable-ticketing,x509-dir=/etc/pki/libvirt-spice 
> 
> 
> 
> $ openssl s_client -connect kvmtest1.odiso.net:60101 -CAfile ca-cert.pem 
> CONNECTED(00000003) 
> depth=1 CN = Proxmox Virtual Environment, OU = 6a15223364e62b87b401fe3d05d9dceb, O = PVE Cluster Manager CA 
> verify return:1 
> depth=0 OU = PVE Cluster Node, O = Proxmox Virtual Environment, CN = kvmtest1.odiso.net 
> verify return:1 
> 140348776556200:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:s3_pkt.c:1256:SSL alert number 20 
> 140348776556200:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: 

If I read this correctly, you're getting the same error when using plain 
openssl client - that would suggest indeed suggest some problem with 
certificates and/or openssl library but certainly outside of scope of 
spice components. 

David 

> --- 
> Certificate chain 
> 0 s:/OU=PVE Cluster Node/O=Proxmox Virtual Environment/CN=kvmtest1.odiso.net 
> i:/CN=Proxmox Virtual Environment/OU=6a15223364e62b87b401fe3d05d9dceb/O=PVE Cluster Manager CA 
> 1 s:/CN=Proxmox Virtual Environment/OU=6a15223364e62b87b401fe3d05d9dceb/O=PVE Cluster Manager CA 
> i:/CN=Proxmox Virtual Environment/OU=6a15223364e62b87b401fe3d05d9dceb/O=PVE Cluster Manager CA 
> --- 
> Server certificate 
> -----BEGIN CERTIFICATE----- 
> MIIDuDCCAqCgAwIBAgIBBDANBgkqhkiG9w0BAQUFADByMSQwIgYDVQQDExtQcm94 
> bW94IFZpcnR1YWwgRW52aXJvbm1lbnQxKTAnBgNVBAsTIDZhMTUyMjMzNjRlNjJi 
> ODdiNDAxZmUzZDA1ZDlkY2ViMR8wHQYDVQQKExZQVkUgQ2x1c3RlciBNYW5hZ2Vy 
> IENBMB4XDTEyMDMyMjA4MTY0MloXDTIyMDMyMDA4MTY0MlowXjEZMBcGA1UECxMQ 
> UFZFIENsdXN0ZXIgTm9kZTEkMCIGA1UEChMbUHJveG1veCBWaXJ0dWFsIEVudmly 
> b25tZW50MRswGQYDVQQDExJrdm10ZXN0MS5vZGlzby5uZXQwggEiMA0GCSqGSIb3 
> DQEBAQUAA4IBDwAwggEKAoIBAQCt5fOEFyp909x8KWVQ4a7kclTYIhwbW/7XziyN 
> fBf8ybuS2OmqwANAVAccVjPzRto05fGYjZfuykpOapbUVLAv+9u3hSKKgPd6g9tI 
> u2Ltvb8G0aoibPjtfAL2++61QUuTQUJ7aVlpSE+vWrqTgviCapFVJGiGhl9zoPC7 
> XuVnMmkdiAR0fQa9zFpqHP7zajbVqHPWpStMJrfoX0/0vFBxLP8xCQXIjqOR6AIY 
> LnCYc8MEIh0WlyN3WN19MezcCuNjXA3twv+pQEgG82y0DkAaJFMtg1zMaKXfAYil 
> kr0ZbEptyZlyD3nWoBTLOe8yiw+Lb7WED6Ccfm4XpR6Y5SutAgMBAAGjbTBrMAkG 
> A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMAsGA1UdDwQEAwIF4DA+BgNVHREE 
> NzA1hwR/AAABgglsb2NhbGhvc3SHBAoDXh+CCGt2bXRlc3QxghJrdm10ZXN0MS5v 
> ZGlzby5uZXQwDQYJKoZIhvcNAQEFBQADggEBADWSVeDJHA6y45lmtmYOGfXQlSmI 
> zSLAzXm7brshvvyom+HEMYNmoMgwPZnt5wJgRF88uGzAFUlZSU8z62xtQwjEAVOC 
> cfXkoM/D0gVKFGvz5T4kBNrache5on++Co6WJhM+txwmBnfJ1aYV1LhOSbPDYGlF 
> sAVUPszYe+wDnxxDeaPRyW48+wMz4dMtcfQKmPJE1dvmdkYVxG7cAnYg8QIgMeBV 
> cnRghW8Ko0YEI4HJb75H49WNxgD2VtWMIyHyaN4SdxeFyan/KPqj8jbjO6JYBDHz 
> /FlXxrBhYijyvSSpwHk4+HN13grffREuq/DHgJ3SFqgxQx3sMQTuXsE3nuk= 
> -----END CERTIFICATE----- 
> subject=/OU=PVE Cluster Node/O=Proxmox Virtual Environment/CN=kvmtest1.odiso.net 
> issuer=/CN=Proxmox Virtual Environment/OU=6a15223364e62b87b401fe3d05d9dceb/O=PVE Cluster Manager CA 
> --- 
> No client certificate CA names sent 
> --- 
> SSL handshake has read 2144 bytes and written 326 bytes 
> --- 
> New, TLSv1/SSLv3, Cipher is AES256-SHA 
> Server public key is 2048 bit 
> Secure Renegotiation IS supported 
> Compression: NONE 
> Expansion: NONE 
> SSL-Session: 
> Protocol : TLSv1 
> Cipher : AES256-SHA 
> Session-ID: 
> Session-ID-ctx: 
> Master-Key: 8613FF06A8B943D3761042D44C080ECA4911AAE71A07C99C53971A5AF5E37373E23F520BF96342EA9DCE5C95D9EA48B9 
> Key-Arg : None 
> PSK identity: None 
> PSK identity hint: None 
> SRP username: None 
> Start Time: 1366211037 
> Timeout : 300 (sec) 
> Verify return code: 0 (ok) 
> --- 
> _______________________________________________ 
> Spice-devel mailing list 
> Spice-devel at lists.freedesktop.org 
> http://lists.freedesktop.org/mailman/listinfo/spice-devel 

-- 

David Jaša, RHCE 

SPICE QE based in Brno 
GPG Key: 22C33E24 
Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24 


More information about the Spice-devel mailing list