{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2840","repository_url":"https://api.github.com/repos/QubesOS/qubes-issues","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2840/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2840/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2840/events","html_url":"https://github.com/QubesOS/qubes-issues/issues/2840","id":233151079,"number":2840,"title":"broken SSL connections after dom0 upgrade","user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars0.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-06-02T11:10:59Z","updated_at":"2017-06-02T16:53:08Z","closed_at":null,"body":"#### Qubes OS version (e.g., `R3.2`):\r\n\r\nR3.2\r\n\r\n#### Affected TemplateVMs (e.g., `fedora-23`, if applicable):\r\n\r\nall\r\n\r\n---\r\n\r\n### Expected behavior:\r\n\r\nhttps and ssh working normally\r\n\r\n### Actual behavior:\r\n\r\nhttps mostly and ssh fully broken\r\n\r\n### Steps to reproduce the behavior:\r\n\r\ngo to https://www.youtube.com\r\n\r\nclick on some link on youtube\r\n\r\nclick on some other link on youtube\r\n\r\n### General notes:\r\n\r\nIf I got to forums.whonix.org it loads. But when I click on \"latest\" it never finishes loading.\r\n(Just an example web site. Happens everywhere on https.)\r\n\r\nIt's happening since the latest dom0 upgrades.\r\n\r\nFrom a non-Qubes system, using the same network, everything works normal. My internet in http speed test is still very fast. So I guess my network connection is fine.\r\n\r\nSometimes (after browser or VM restart) it's possible to view a https page one time. But when clicking on some link there, it stops working. Http only websites still work fine.\r\n\r\nThis is happening in both Firefox and Chromium, in both debian-8, debian-stretch and Fedora.\r\n\r\nFirefox doesn't show any useful error message.\r\n\r\n> Secure Connection Failed\r\n\r\n> The connection to the server was reset while the page was loading.\r\n\r\n> The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.\r\n> Please contact the website owners to inform them of this problem.\r\n\r\nWhen that happens, in chromium most of the time get the following.\r\n\r\n```\r\n[2250:2284:0601/031907.837152:ERROR:ssl_client_socket_impl.cc(1135)] handshake failed; returned -1, SSL error code 1, net_error -100\r\n```\r\n\r\nRunning chromium with `chromium --use-spdy=off` helps a bit. A view more page views are possible until the same error message appears.\r\n\r\nI did run `sudo debsums -s` in my Debian TemplateVM to make sure no files (of the openssl package or so) are broken. Another Qubes R3.2 installation (very similar, for testing purposes) on my external USB hard drive has the very same symptoms, so I think we can exclude file corruption as well.\r\n\r\nThis bug is currently killing all my productivity.\r\n\r\nBooting with an older dom0 kernel didn't help. Booting with an older VM kernel setting in QVMM did not help either.\r\n\r\nHappens both on Wi-Fi and on wired internet connection.\r\n\r\nCompared with non-Qubes Debian on bare metal (different computer), I could not reproduce this issue. (I hope I can prevent booting by Qubes-only notebook with Debian.)\r\n\r\nWhile this issue is happening, I don't see any new messages in syslog or kern.log.\r\n\r\nQubes R3.2 fully updated on another computer does not show this issue either.\r\n\r\nAll very strange. Do we have a hardware specific kernel bug here that leads to preventing SSL connections? I may be able to remove the disk from the affected computer and (USB) boot it in the non-affected one to get higher certainty if that would be useful.\r\n\r\npossibly related:\r\n\r\nhttps://github.com/QubesOS/qubes-issues/issues/2778"},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/comments/305849419","html_url":"https://github.com/QubesOS/qubes-issues/issues/2840#issuecomment-305849419","issue_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/2840","id":305849419,"user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars0.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"created_at":"2017-06-02T16:53:08Z","updated_at":"2017-06-02T16:53:08Z","body":"Right.\r\n\r\n> Thanks. I'm curious: Did you upgrade everything in qubes-dom0-testing, or just the kernel?\r\n\r\nEverything. (Just a \"dumb\" run of \"sudo qubes-dom0-update\".)\r\n"}}
{"actor":{"display_login":"adrelanos"}}