Package: vsftpd
Version: 3.0.3-12
Severity: important
Dear Maintainer,
FTPS uploads using curl to a vsftpd server running on either Debian 10.1 or
Debian 10.3 and on either arm64 or amd64 don't seem to work for large files
(>=~50kB). Using the same curl command and vsftpd server worked for small files
of 1kB. I tried changing server configuration options both in curl and the
vsftpd server to no avail. I then tried using the same vsftpd configuration
file on a vsftpd server on both Debian 8 and Debian 9, and both worked for all
files sizes I tested (1kB-1GB). I also tried using filezilla to do an FTPS
upload of a large file (1GB) to the Debian 10 vsftpd server, which was
successful.
After much experimentation, it seems that the issue is related to the version
on libssl1.1 that is being used. In Debian 10, libssl1.1 is at version 1.1.1
while in Debian 9 it is at version 1.1.0. I installed libssl version
1.1.0j-1~deb9u1 on my Debian 10 server, and the FTPS upload started working for
large files.
To summarise:
curl -> Debian 10.3, vsftpd 3.0.3-12, libssl1.1 1.1.1d-0+deb10u2
doesn't work for large files
curl -> Debian 10.1, vsftpd 3.0.3-12, libssl1.1 1.1.1c-1 doesn't work
for large files
filezilla -> Debian 10.1, vsftpd 3.0.3-12, libssl1.1 1.1.1c-1 works
curl -> Debian 9.9, vsftpd 3.0.3-8 , libssl1.1 1.1.0j-1~deb9u1 works
curl -> Debian 10.1, vsftpd 3.0.3-8 , libssl1.1 1.1.1c-1 doesn't work
for large files
curl -> Debian 10.1, vsftpd 3.0.3-8 , libssl1.1 1.1.0j-1~deb9u1 works
curl -> Debian 10.1, vsftpd 3.0.3-12, libssl1.1 1.1.0j-1~deb9u1 works
The verbose curl output for the failed FTPS upload of a large file:
"
< 220 (vsFTPd 3.0.3)
> AUTH SSL
< 234 Proceed with negotiation.
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [88 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [155 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [6 bytes data]
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
{ [192 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2613 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
} [2664 bytes data]
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
} [264 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* SSL certificate verify ok.
} [5 bytes data]
> USER -
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1417 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1417 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
< 331 Please specify the password.
} [5 bytes data]
> PASS -
{ [5 bytes data]
< 230 Login successful.
} [5 bytes data]
> PBSZ 0
{ [5 bytes data]
< 200 PBSZ set to 0.
} [5 bytes data]
> PROT P
{ [5 bytes data]
< 200 PROT now Private.
} [5 bytes data]
> PWD
{ [5 bytes data]
< 257 "/" is the current directory
* Entry path is '/'
} [5 bytes data]
> CWD files
* ftp_perform ends with SECONDARY: 0
{ [5 bytes data]
< 250 Directory successfully changed.
} [5 bytes data]
> EPSV
* Connect data stream passively
{ [5 bytes data]
< 229 Entering Extended Passive Mode (|||10091|)
* Trying 10.0.5.52...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55bd9976be80)
* Connecting to -
* Connected to - } [5 bytes data]
> TYPE I
{ [5 bytes data]
< 200 Switching to Binary mode.
} [5 bytes data]
> STOR tmp1M.dat
{ [5 bytes data]
< 150 Ok to send data.
* Doing the SSL/TLS handshake on the data stream
* SSL re-using session ID
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1733 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [88 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1766 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [161 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [6 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* Server certificate:
* SSL certificate verify ok.
} [5 bytes data]
* We are completely uploaded and fine
* Remembering we are in dir "files/"
} [5 bytes data]
* TLSv1.3 (OUT), TLS alert, close notify (256):
} [2 bytes data]
< 426 Failure reading network stream.
* server did not report OK, got 426
100 1024k 0 0 100 1024k 0 2892k --:--:-- --:--:-- --:--:-- 2892k
* Connection #0 to host 10.0.5.52 left intact
curl: (18) server did not report OK, got 426
"
The verbose output of a successful upload of a small 1k file is identical
except instead of:
"
< 426 Failure reading network stream.
* server did not report OK, got 426
100 1024k 0 0 100 1024k 0 2892k --:--:-- --:--:-- --:--:-- 2892k
"
it has:
"
< 226 Transfer complete.
100 1024 0 0 100 1024 0 2860 --:--:-- --:--:-- --:--:-- 2860
"
Enabling debug_ssl in vsftpd returns this value in the logs when the upload of
a large file fails:
"
SSL ret: 18446744073709551615, SSL error:
error:00000000:lib(0):func(0):reason(0), errno: 32
"
-- Package-specific info:
-- System Information:
Debian Release: 10.3
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64
Kernel: Linux 4.19.0-8-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages vsftpd depends on:
ii adduser 3.118
ii debconf [debconf-2.0] 1.5.71
ii libc6 2.28-10
ii libcap2 1:2.25-2
ii libpam-modules 1.3.1-5
ii libpam0g 1.3.1-5
ii libssl1.1 1.1.1d-0+deb10u2
ii libwrap0 7.6.q-28
ii lsb-base 10.2019051400
ii netbase 5.6
ii procps 2:3.3.15-2
Versions of packages vsftpd recommends:
ii logrotate 3.14.0-4
ii ssl-cert 1.0.39
vsftpd suggests no packages.
-- Configuration Files:
/etc/vsftpd.conf changed [not included]
-- debconf information excluded
