Bug 1060411

Summary:	"An illegal TLS extension was received" error when doing homebanking
Product:	[Fedora] Fedora	Reporter:	Enrico Scholz <rh-bugzilla>
Component:	gnutls	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	20	CC:	jorton, nmavrogi, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	gnutls-3.1.20-1.fc20	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-02-07 03:15:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Enrico Scholz 2014-02-01 11:46:20 UTC

Description of problem:

When trying to connect to my credit institute with aqbanking, I get the error above.  This can be reproduced on cmdline with

$ gnutls-cli fints.comdirect.de
Processed 153 CA certificate(s).
Resolving 'fints.comdirect.de'...
Connecting to '193.41.133.14:443'...
*** Fatal error: An illegal TLS extension was received.
*** Handshake has failed
GnuTLS error: An illegal TLS extension was received.


Things are fine when using gnutls-2.8.5 from RHEL6.


Version-Release number of selected component (if applicable):

gnutls-3.1.18-3.fc20.x86_64


How reproducible:

100%

Comment 1 Nikos Mavrogiannopoulos 2014-02-01 19:19:52 UTC

It seems that the server includes in its ServerHello the "Supported Elliptic Curves Extension" which is only defined for usage in a ClientHello. That's an issue of the server mainly, but seeing that other implementations tolerate that gnutls could be more lenient with that server. 

A work around with that broken server would be to use the priority string "NORMAL:-CURVE-ALL".

Comment 2 Fedora Update System 2014-02-03 10:21:24 UTC

gnutls-3.1.20-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/gnutls-3.1.20-1.fc20

Comment 3 Fedora Update System 2014-02-04 02:43:26 UTC

Package gnutls-3.1.20-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing gnutls-3.1.20-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-1960/gnutls-3.1.20-1.fc20
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2014-02-07 03:15:54 UTC

gnutls-3.1.20-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.