Ensure TLS 1.3 is enabled for *.rtems.org

[Joel Sherrill]

Passing along a report from a user that their IT has blocked pages using TLS 1.2. This impacts at least the RSB downloading patches associated with RTEMS tickets.

Here is their curl verbose output in case it helps:

$ curl -vvvv https://devel.rtems.org/raw-attachment/ticket/4783/0001-checks.c-Ensure-argument-is-an-integer-v2.patch
*   Trying 140.211.10.146...
* TCP_NODELAY set
* Connected to devel.rtems.org (140.211.10.146) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS alert, bad record mac (532):
* error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac
* Closing connection 0
curl: (35) error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac

[Amar Takhar]

There is already a system update going on this will be fixed when everything is updated by default. Thanks for the report.

[Joel Sherrill]

Replying to Amar Takhar:

There is already a system update going on this will be fixed when everything is updated by default. Thanks for the report.

I assumed it was something that would be caught by your updates but wanted to make sure it was reported and known. If nothing else, it gives a test case and says someone noticed. :)

[Amar Takhar]

These updates happened back in 2022-05 (May). We pass with A+ from Qualsys so it must be a local error, see:

​https://www.ssllabs.com/ssltest/analyze.html?d=devel.rtems.org

I'll leave this open for now but there is nothing for me to do. It's possible it's a local forced caching proxy or an injected certificate that has an older version of TLS that is causing issues. Not sure what country are they in?

[Joel Sherrill]

They are in the US but at an organization with draconian IT policies. I'm sure part of this is on their side. Just no idea what.

With RTEMS.org now at TLS 1.3, there is nothing else we can do. We've asked the user to try again but it will be Monday before they can.

[Amar Takhar]

This was actually disabled back in May 2022 in response to the security reports from the OSL. It was never re-enabled after the software updates because I thought it would only properly work after an OS update.

Seems at least for devel.rtems.org this is not the case I enabled TLS 1.3 and we still have an A+ rating I'll try the rest of the services as I update them in the next few days.

[Joel Sherrill]

Thanks Amar. And now it is Monday and we have feedback from the user with the "interesting" IT. Some tool patches come from devel.rtems.org and that was resolved. But when using the RSB, a tarball of rtems-tools is requested from git.rtems.org and that apparently has the same issue.

The reporter doesn't know the services are on different jails so each one has to be addressed individually. I don't know if it matters that all services have TLS 1.3 enabled but the ones the RSB fetches from need it.

It was partially successful. 

The scripts now successfully pull the patches on the devel.rtems.org web server without issue. However, it appears that the script is attempting to pull a rtems-tools bzip from the git.rtems.org server and that still fails with the same error as before. It appears that server didn't get the TLS 1.3 upgrade.

The log is attached and the curl is below:

$ curl -vvvv https://git.rtems.org/rtems-tools/snapshot/rtems-tools-6970c47c70eeb9908c0b4344a53d4f1e6f206408.tar.bz2
*   Trying 140.211.10.143...
* TCP_NODELAY set
* Connected to git.rtems.org (140.211.10.143) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS alert, Server hello (2):
* error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac
* stopped the pause stream!
* Closing connection 0
curl: (35) error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac