Re: [Burp-users] Stuck on Phase4 (shuffling)

[Moter P. <mot...@gm...>]

I agree that it is odd that only one particular client is having the
problem as I do have a dozen or so other clients deployed.

If there is anything I can do to assist in any way I'm glad to do so.

I did find another post to the list describing the same issue from back in
2012 though there never was any sort of resolution or response from the
contributor.  Link here -->
http://sourceforge.net/p/burp/mailman/message/28664724/

On Wed, Dec 24, 2014 at 12:38 PM, Graham Keeling <gr...@gr...> wrote:

> On Wed, December 24, 2014 8:25 am, Moter Pent wrote:
> > Thanks Graham,
> >
> > We're past that problem and on to a new one.  Backups are still failing
> > but
> > now in phase 2.  From the client's syslog/messages I see:
> >
> > Dec 23 01:23:10 deept burp[1147]: before client
> > Dec 23 01:23:10 deept burp[1147]: begin client
> > Dec 23 01:23:10 deept burp[1147]: auth ok
> > Dec 23 01:23:10 deept burp[1147]: Server version: 1.4.28
> > Dec 23 01:23:10 deept burp[1147]: nocsr ok
> > Dec 23 01:23:10 deept burp[1147]: SSL is using cipher:
> > DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256)
> > Mac=AEAD
> > Dec 23 01:23:11 deept burp[1147]: Compression level: 9
> > Dec 23 01:23:11 deept burp[1147]: /usr/local/bin/backup_pre.sh returned:
> 0
> > Dec 23 01:23:11 deept burp[1147]: do backup client
> > Dec 23 01:23:11 deept burp[1147]: Phase 1 begin (file system scan)
> > Dec 23 01:32:51 deept burp[1147]: Phase 1 end (file system scan)
> > Dec 23 01:32:51 deept burp[1147]: Phase 2 begin (send file data)
> > Dec 23 04:58:15 deept burp[1147]: Got SSL_ERROR_SYSCALL in write
> > Dec 23 04:58:15 deept burp[1147]: SSL write problem: 5, errno=104
> > (Connection reset by peer)
> > Dec 23 04:58:15 deept burp[1147]: error in do_write
> > Dec 23 04:58:15 deept burp[1147]: Error in phase 2
> > Dec 23 04:58:15 deept burp[1147]: Phase 2 end (send file data)
> > Dec 23 04:58:15 deept burp[1147]: error in backup
> > Dec 23 04:58:15 deept burp[1147]: after client
> >
> > ...and from the server...
> >
> > 2014-12-23 01:23:11: burp[28067] Client version: 1.4.28
> > 2014-12-23 01:23:11: burp[28067] Begin phase1 (file system scan)
> > 2014-12-23 01:32:51: burp[28067] End phase1 (file system scan)
> > 2014-12-23 01:32:51: burp[28067] Begin phase2 (receive file data)
> > 2014-12-23 04:58:15: burp[28067] SSL read problem: 1, errno=0 (Success)
> > 2014-12-23 04:58:15: burp[28067] error in async_rw
> > 2014-12-23 04:58:15: burp[28067] End phase2 (receive file data)
> > 2014-12-23 04:58:15: burp[28067] error in backup phase 2
> >
> > Both the server and client are running CentoOS 6.5 with the following
> > OpenSSL packages:
> >
> > openssl-1.0.1e-30.el6_6.4.x86_64
> > openssl-devel-1.0.1e-30.el6_6.4.x86_64
> >
> > Thoughts?
>
>
> The problem seems to have been on the server side as the client's message
> looks like it was just shutting down due to the server closing the
> connection.
> On the server side, 'SSL read problem: 1' means SSL error code
> 'SSL_ERROR_SSL', which means:
>
>       A failure in the SSL library occurred, usually a protocol error.
>       The OpenSSL error queue contains more information on the error.
>
> So, I don't know what happened.
> Strange that it is only happening for one client.
> I am not doing anything with the 'error queue' at this point.
> If the problem is repeatable, we could try putting more debug in to try
> to get 'more information on the error' (which I should do for this code
> anyway).
>
>