Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionOlivier BONHOMME
2016-08-03 09:01:40 UTC
Description of problem:
It is not possible to make a TLSv1.2 negotiation using the lftp packaged in RHEL-6 distribution (Even in the last release). Actually, even if gnutls has been patched in order to enable TLSv1.2 support, the structure defining the protocol priority excluded TLSv1.2 from the usable protocol in a default behaviour.
The issue is that lftp provided in RHEL-6 doesn't implement the ssl:priority directive which allows overriding GNUTLS negociation priority.
That's why it's not possible using TLSv1.2 protocol with lftp.
Version-Release number of selected component (if applicable): lftp-4.0.9-6.el6_8.2.
How reproducible:
Make a connection on a FTP server allowing only TLSv1.2 protocol.
Actual results:
lftp returns an error message provided by gnutls: A TLS packet with unexpected length was received. The FTP servers says that the negotiation is failed returning a 550 error code. (TLS Handshake failed)
Expected results:
The negotiation in TLSv1.2 should be okay and the FTP connection operational.
Additional info:
The ssl:priority option has been implemented on the following commit : https://github.com/lavv17/lftp/commit/b406805d2b3d4c9a88e24363980e5717e61d0948
RedHat team already did the job for RHEL-7 : https://git.centos.org/blob/rpms!lftp/373a02466b773fe2dbbfde702aec1848e006ba70/SOURCES!lftp-4.4.8-ssl-tls-restrict.patch
I've just tested the test RPM provided and here are my results.
Test case : A proftpd server forced to accept only TLSv1.2 connections (Directive TLSProtocol set to value TLSv1.2)
The RPM has been installed on a RHEL system.
The ssl:priority directive is now available into lftp software. I set the directive to "NORMAL:+VERS-TLS1.2" (GnuTLS priority string format)
The connection is now successful using lftp on the proftpd server. Authentication is OK and directory listing is OK.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHBA-2017-0701.html