Re: [Burp-users] Stuck on Phase4 (shuffling)

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Does the connection between the server and the client transit any kind of 
firewall? Could the connection be idle for a long time, and the firewall is 
sending a reset to both ends because it doesn't like long-running idle TCP 
connections. I've seen some Cisco firewalls with this (mis)behavior.

j

On Tuesday, December 23, 2014 15:25:10 Moter Pent wrote:
> Thanks Graham,
> 
> We're past that problem and on to a new one.  Backups are still failing but
> now in phase 2.  From the client's syslog/messages I see:
> 
> Dec 23 01:23:10 deept burp[1147]: before client
> Dec 23 01:23:10 deept burp[1147]: begin client
> Dec 23 01:23:10 deept burp[1147]: auth ok
> Dec 23 01:23:10 deept burp[1147]: Server version: 1.4.28
> Dec 23 01:23:10 deept burp[1147]: nocsr ok
> Dec 23 01:23:10 deept burp[1147]: SSL is using cipher:
> DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256)
> Mac=AEAD
> Dec 23 01:23:11 deept burp[1147]: Compression level: 9
> Dec 23 01:23:11 deept burp[1147]: /usr/local/bin/backup_pre.sh returned: 0
> Dec 23 01:23:11 deept burp[1147]: do backup client
> Dec 23 01:23:11 deept burp[1147]: Phase 1 begin (file system scan)
> Dec 23 01:32:51 deept burp[1147]: Phase 1 end (file system scan)
> Dec 23 01:32:51 deept burp[1147]: Phase 2 begin (send file data)
> Dec 23 04:58:15 deept burp[1147]: Got SSL_ERROR_SYSCALL in write
> Dec 23 04:58:15 deept burp[1147]: SSL write problem: 5, errno=104
> (Connection reset by peer)
> Dec 23 04:58:15 deept burp[1147]: error in do_write
> Dec 23 04:58:15 deept burp[1147]: Error in phase 2
> Dec 23 04:58:15 deept burp[1147]: Phase 2 end (send file data)
> Dec 23 04:58:15 deept burp[1147]: error in backup
> Dec 23 04:58:15 deept burp[1147]: after client
> 
> ...and from the server...
> 
> 2014-12-23 01:23:11: burp[28067] Client version: 1.4.28
> 2014-12-23 01:23:11: burp[28067] Begin phase1 (file system scan)
> 2014-12-23 01:32:51: burp[28067] End phase1 (file system scan)
> 2014-12-23 01:32:51: burp[28067] Begin phase2 (receive file data)
> 2014-12-23 04:58:15: burp[28067] SSL read problem: 1, errno=0 (Success)
> 2014-12-23 04:58:15: burp[28067] error in async_rw
> 2014-12-23 04:58:15: burp[28067] End phase2 (receive file data)
> 2014-12-23 04:58:15: burp[28067] error in backup phase 2
> 
> Both the server and client are running CentoOS 6.5 with the following
> OpenSSL packages:
> 
> openssl-1.0.1e-30.el6_6.4.x86_64
> openssl-devel-1.0.1e-30.el6_6.4.x86_64
> 
> Thoughts?
> 
> On Tue, Dec 23, 2014 at 1:10 PM, Graham Keeling <gr...@gr...> wrote:
> > (Going back on list)...
> > 
> > Yes, the lines that you marked are the correct ones.
> > 
> > On Tue, December 23, 2014 6:37 am, Moter Pent wrote:
> > > Sorry.  By "files" I actually meant "lines".
> > > 
> > > On Mon, Dec 22, 2014 at 1:37 PM, Moter Pent <mot...@gm...> wrote:
> > >> Ah, that's much better.  I have created a backup just in case but want
> > >> to
> > >> make sure I get the correct lines, here's a snippit from the manifest.
> > >> My
> > >> assumption is that I want to zap the files marked with the -> (I left
> > >> some
> > >> leading and trailing lines in for context).  Sound right?
> > >> 
> > >> ...
> > >> r0040hA mAAQ EH9 C BAAFL BAAAA A BAA BAA I BUEJGq BJJyAb BTCnjJ A A J
> > >> d0015/home/someuser/archive
> > >> 
> > >> -> t0023t/home/someuser/archive/a_someuser.nsf
> > >> -> r0047hA mAIs IG0 B BAAFL BAAAA A M5UAAA BAA BnJzY BUW8XC BUW8XE
> > >> BUW8XE
> > >> A A J
> > >> -> f0022/home/someuser/archive/a_someuser.nsf
> > >> -> x002C13846446080:55fb6aed93ec645beb4cac6d31fa3a1a
> > >> 
> > >> r0040hA mAAR EH9 F BAAFL BAAAA A BAA BAA I BTmgjW BHq2Va BTCnjJ A A J
> > >> d0014/home/someuser/citrix
> > >> ...
> > >> 
> > >> On Tue, Dec 23, 2014 at 4:26 AM, Graham Keeling <gr...@gr...> wrote:
> > >>> On Tue, December 23, 2014 6:04 am, Moter Pent wrote:
> > >>> > Thanks Graham,
> > >>> > 
> > >>> >> Is it always the same file that it complains about?
> > >>> > 
> > >>> > Yes.
> > >>> > 
> > >>> >> I would see if the file exists ...
> > >>> > 
> > >>> > I have managed to clobber (delete) these files while trying to
> > >>> 
> > >>> resolve
> > >>> the
> > >>> 
> > >>> > issue.
> > >>> > They no longer exist.
> > >>> > 
> > >>> >> *) Edit the manifest fragments in the 'finishing' directory to
> > >>> 
> > >>> remove
> > >>> 
> > >>> >>    mentions of somefile.nsf. Then burp will not try to do anything
> > >>> 
> > >>> with
> > >>> 
> > >>> > it when
> > >>> > 
> > >>> >>    it resumes. The files to edit are called 'phase2' and
> > >>> 
> > >>> 'unchanged'.
> > >>> If
> > >>> 
> > >>> > you
> > >>> > 
> > >>> >>    want to try this, let me know and I will help you with the lines
> > >>> 
> > >>> that
> > >>> 
> > >>> > you
> > >>> > 
> > >>> >>    need to delete.
> > >>> > 
> > >>> > This sounds like a good option though I can't seem to find any files
> > >>> > called
> > >>> > 'phase2' or 'unchanged' in the finishing directory.  What am I
> > >>> 
> > >>> missing?
> > >>> 
> > >>> Ah, sorry, by phase4, they have been merged into a single file. You
> > >>> should
> > >>> have a manifest or manifest.gz. If gz, you will want to gunzip it,
> > >>> then
> > >>> remove the linss related to the file, then gzip it again.
> > >>> 
> > >>> There will be four adjacent lines to delete.
> > >>> One represents file stats/permissions/etc.
> > >>> One represents the location of the file on the server.
> > >>> One represents the location of the file on the client.
> > >>> One starts with 'x' and represents the size of the data, and a
> > >>> checksum.
> > >>> 
> > >>> 
> > >>> Best make a copy of the manifest before you delete anything.
> > 
> > --------------------------------------------------------------------------
> > ---- Dive into the World of Parallel Programming! The Go Parallel Website,
> > sponsored by Intel and developed in partnership with Slashdot Media, is
> > your
> > hub for all things parallel software development, from weekly thought
> > leadership blogs to news, videos, case studies, tutorials and more. Take a
> > look and join the conversation now. http://goparallel.sourceforge.net
> > _______________________________________________
> > Burp-users mailing list
> > Bur...@li...
> > https://lists.sourceforge.net/lists/listinfo/burp-users

-- 
Joshua J. Kugler - Fairbanks, Alaska
Azariah Enterprises - Programming and Website Design
jo...@az... - Jabber: ped...@gm...
PGP Key: http://pgp.mit.edu/  ID 0x73B13B6A