Re: [Burp-users] Stuck on Phase4 (shuffling)

[Graham K. <gr...@gr...>]

On Wed, December 24, 2014 8:25 am, Moter Pent wrote:
> Thanks Graham,
>
> We're past that problem and on to a new one.  Backups are still failing
> but
> now in phase 2.  From the client's syslog/messages I see:
>
> Dec 23 01:23:10 deept burp[1147]: before client
> Dec 23 01:23:10 deept burp[1147]: begin client
> Dec 23 01:23:10 deept burp[1147]: auth ok
> Dec 23 01:23:10 deept burp[1147]: Server version: 1.4.28
> Dec 23 01:23:10 deept burp[1147]: nocsr ok
> Dec 23 01:23:10 deept burp[1147]: SSL is using cipher:
> DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256)
> Mac=AEAD
> Dec 23 01:23:11 deept burp[1147]: Compression level: 9
> Dec 23 01:23:11 deept burp[1147]: /usr/local/bin/backup_pre.sh returned: 0
> Dec 23 01:23:11 deept burp[1147]: do backup client
> Dec 23 01:23:11 deept burp[1147]: Phase 1 begin (file system scan)
> Dec 23 01:32:51 deept burp[1147]: Phase 1 end (file system scan)
> Dec 23 01:32:51 deept burp[1147]: Phase 2 begin (send file data)
> Dec 23 04:58:15 deept burp[1147]: Got SSL_ERROR_SYSCALL in write
> Dec 23 04:58:15 deept burp[1147]: SSL write problem: 5, errno=104
> (Connection reset by peer)
> Dec 23 04:58:15 deept burp[1147]: error in do_write
> Dec 23 04:58:15 deept burp[1147]: Error in phase 2
> Dec 23 04:58:15 deept burp[1147]: Phase 2 end (send file data)
> Dec 23 04:58:15 deept burp[1147]: error in backup
> Dec 23 04:58:15 deept burp[1147]: after client
>
> ...and from the server...
>
> 2014-12-23 01:23:11: burp[28067] Client version: 1.4.28
> 2014-12-23 01:23:11: burp[28067] Begin phase1 (file system scan)
> 2014-12-23 01:32:51: burp[28067] End phase1 (file system scan)
> 2014-12-23 01:32:51: burp[28067] Begin phase2 (receive file data)
> 2014-12-23 04:58:15: burp[28067] SSL read problem: 1, errno=0 (Success)
> 2014-12-23 04:58:15: burp[28067] error in async_rw
> 2014-12-23 04:58:15: burp[28067] End phase2 (receive file data)
> 2014-12-23 04:58:15: burp[28067] error in backup phase 2
>
> Both the server and client are running CentoOS 6.5 with the following
> OpenSSL packages:
>
> openssl-1.0.1e-30.el6_6.4.x86_64
> openssl-devel-1.0.1e-30.el6_6.4.x86_64
>
> Thoughts?


The problem seems to have been on the server side as the client's message
looks like it was just shutting down due to the server closing the
connection.
On the server side, 'SSL read problem: 1' means SSL error code
'SSL_ERROR_SSL', which means:

      A failure in the SSL library occurred, usually a protocol error.
      The OpenSSL error queue contains more information on the error.

So, I don't know what happened.
Strange that it is only happening for one client.
I am not doing anything with the 'error queue' at this point.
If the problem is repeatable, we could try putting more debug in to try
to get 'more information on the error' (which I should do for this code
anyway).