Package: mandos-client Version: 1.7.15-1 Severity: important Dear Maintainer,
*** Reporter, please consider answering these questions, where appropriate *** * What led up to the situation? * What exactly did you do (or not do) that was effective (or ineffective)? * What was the outcome of this action? * What outcome did you expect instead? *** End of the template - remove these template lines *** Hello, I'm trying to install mandos-client on a Raspberry Pi and fall on a bug that looks very similar in its behaviour (but doesn't have the same cause) as bug #819982, ie. it fails with : Mandos plugin mandos-client: Trying to decrypt OpenPGP data Mandos plugin mandos-client: bad gpgme_op_decrypt: GPGME: Decryption failed plugins.d/mandos-client.c:422:2: runtime error: null pointer passed as argument 3, which is declared to never be null Mandos plugin mandos-client: Unsupported algorithm: (null) Mandos plugin mandos-client: Wrong key usage: 0 Mandos client version package is: 1.7.15-1 If I test the client per the manual instructions, it WORKS. If I unpack the initramfs, chroot into it and run the client, it WORKS. But when the system boots, it FAILS. During system boot, I can SSH into the running initramfs using dropbear, then if I run the client manually, it fails with the exact same error that I can see displayed on screen when booting unattended. The interesting line seems to be : plugins.d/mandos-client.c:422:2: runtime error: null pointer passed as argument 3, which is declared to never be null It is interesting to note that this message appears only at FIRST attempt. Afterwards the client retries every 10 seconds, and then only shows the : Mandos plugin mandos-client: bad gpgme_op_decrypt: GPGME: Decryption failed Mandos plugin mandos-client: Unsupported algorithm: (null) Mandos plugin mandos-client: Wrong key usage: 0 lines. Please find attached the two debug outputs when I get when running it - either from the actual intramfs : mandos_client_initramfs.txt - or from within a chroot : mandos_client_chroot.txt Any help in solving this will be greatly appreciated :-) Thanks in advance. *** mandos_client_initramfs.txt ~ # /lib/mandos/plugin-runner Mandos plugin mandos-client: Ignoring hook "." - not a file Mandos plugin mandos-client: Ignoring hook ".." - not a file Mandos plugin mandos-client: Hook "dhcplan.conf" is acceptable Mandos plugin mandos-client: Running network hook "dhcplan.conf" Mandos plugin mandos-client: Network hook "dhcplan.conf" ran successfully Mandos plugin mandos-client: Interface "eth0" is already up; good Mandos plugin mandos-client: No interfaces were brought up Mandos plugin mandos-client: Using only interface "eth0" Mandos plugin mandos-client: Initializing GnuTLS Mandos plugin mandos-client: Attempting to use OpenPGP public key /conf/conf.d/mandos/pubkey.txt and secret key /conf/conf.d/mandos/seckey.txt as GnuTLS credentials Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[_gnutls_openpgp_export]:166 Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[_gnutls_openpgp_export]:166 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[gnutls_openpgp_crt_get_preferred_key_id]:1644 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[gnutls_openpgp_crt_get_preferred_key_id]:1644 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: Signing using master PGP key Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: mpi.c[_gnutls_x509_read_uint]:246 Mandos plugin mandos-client: GnuTLS: ASSERT: dh.c[gnutls_dh_params_import_pkcs3]:373 Mandos plugin mandos-client: Tempdir /run/tmp/mandos4Vu7jb did not work, trying /tmp/mandosXXXXXX Mandos plugin mandos-client: Initializing GPGME Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Allocating epoch #0 Mandos plugin mandos-client: Setting up a TCP connection to [SERVER IP WAS HERE], port 9601 Mandos plugin mandos-client: Connection to: [SERVER IP WAS HERE], port 9601 Mandos plugin mandos-client: Establishing TLS session with [SERVER IP WAS HERE] Mandos plugin mandos-client: GnuTLS: ASSERT: constate.c[_gnutls_epoch_get]:600 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Allocating epoch #1 Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[get_last_packet]:1159 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: SSL 3.1 Handshake packet received. Epoch 0, length: 143 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Expected Packet Handshake(22) Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Received Packet Handshake(22) with length: 143 Mandos plugin mandos-client: GnuTLS: READ: Got 143 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 143 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 143 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 148 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Decrypted Packet[0] Handshake(22) with length: 143 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: CLIENT HELLO (1) was received. Length 139[139], frag offset 0, frag length: 139, sequence: 0 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Client's version: 3.3 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Selected version TLS1.2 Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Extended Master Secret/23' (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Encrypt-then-MAC/22' (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'OCSP Status Request/5' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Certificate Type/9' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Safe Renegotiation/65281' (1 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Session Ticket/35' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Supported curves/10' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Supported ECC Point Formats/11' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Signature Algorithms/13' Mandos plugin mandos-client: GnuTLS: ASSERT: db.c[_gnutls_server_restore_session]:272 Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Extended Master Secret/23' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Encrypt-then-MAC/22' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'OCSP Status Request/5' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Certificate Type/9' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Safe Renegotiation/65281' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Session Ticket/35' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Supported curves/10' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Supported ECC Point Formats/11' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Signature Algorithms/13' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Extended Master Secret/23' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Encrypt-then-MAC/22' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'OCSP Status Request/5' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Certificate Type/9' (2 bytes) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Selected certificate type OPENPGP (2) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Safe Renegotiation/65281' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Session Ticket/35' (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Supported curves/10' (6 bytes) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Selected ECC curve SECP384R1 (3) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Supported ECC Point Formats/11' (2 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'Signature Algorithms/13' (12 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: rcvd signature algo (5.1) RSA-SHA384 Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: rcvd signature algo (5.3) ECDSA-SHA384 Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: rcvd signature algo (6.1) RSA-SHA512 Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: rcvd signature algo (6.3) ECDSA-SHA512 Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: rcvd signature algo (4.2) DSA-SHA256 Mandos plugin mandos-client: GnuTLS: ASSERT: server_name.c[gnutls_server_name_get]:310 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Requested server name: '' Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Requested PK algorithm: EC/ECDSA (4) -- ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: certificate[0] PK algorithm: RSA (1) - ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Requested PK algorithm: RSA (1) -- ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: certificate[0] PK algorithm: RSA (1) - ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: ASSERT: cert.c[check_key_usage]:280 Mandos plugin mandos-client: GnuTLS: ASSERT: cert.c[check_key_usage]:280 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_AES_256_GCM_SHA384 (C0.30) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_CAMELLIA_256_GCM_SHA384 (C0.8B) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_CHACHA20_POLY1305 (CC.A8) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_AES_256_CBC_SHA384 (C0.28) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384 (C0.77) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_AES_256_GCM_SHA384 (00.9F) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_CAMELLIA_256_GCM_SHA384 (C0.7D) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_CHACHA20_POLY1305 (CC.AA) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_AES_256_CBC_SHA256 (00.6B) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA256 (00.C4) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_AES_256_CCM (C0.9F) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Requested cipher suites[size: 34]: Mandos plugin mandos-client: GnuTLS: 0xc0, 0x2c ECDHE_ECDSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: 0xc0, 0x87 ECDHE_ECDSA_CAMELLIA_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: 0xcc, 0xa9 ECDHE_ECDSA_CHACHA20_POLY1305 Mandos plugin mandos-client: GnuTLS: 0xc0, 0x24 ECDHE_ECDSA_AES_256_CBC_SHA384 Mandos plugin mandos-client: GnuTLS: 0xc0, 0x73 ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384 Mandos plugin mandos-client: GnuTLS: 0xc0, 0xad ECDHE_ECDSA_AES_256_CCM Mandos plugin mandos-client: GnuTLS: 0xc0, 0x30 ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Selected cipher suite: ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Selected Compression Method: NULL Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Extended Master Secret/23' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Encrypt-then-MAC/22' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Parsing extension 'OCSP Status Request/5' (5 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Certificate Type/9' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Safe Renegotiation/65281' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Session Ticket/35' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Supported curves/10' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Supported ECC Point Formats/11' Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Found extension 'Signature Algorithms/13' Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Safe renegotiation succeeded Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Sending extension Extended Master Secret (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Sending extension Certificate Type (1 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Sending extension Safe Renegotiation (1 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xb780b8]: Sending extension Supported ECC Point Formats (2 bytes) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: SessionID: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: SERVER HELLO was queued [96 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [SERVER HELLO] 96. Total 96 bytes. Mandos plugin mandos-client: GnuTLS: Sending PGP key ID 7590231119da2d24 (master) Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: CERTIFICATE was queued [2246 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [CERTIFICATE] 2246. Total 2342 bytes. Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: signing handshake data: using RSA-SHA384 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: Signing using master PGP key Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: SERVER KEY EXCHANGE was queued [621 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [SERVER KEY EXCHANGE] 621. Total 2963 bytes. Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: SERVER HELLO DONE was queued [4 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [SERVER HELLO DONE] 4. Total 2967 bytes. Mandos plugin mandos-client: GnuTLS: HWRITE FLUSH: 2967 bytes in buffer. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet Handshake(22) with length: 96 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 101 bytes for 0xa. Total 101 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[1] Handshake(22) in epoch 0 and length: 101 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 2871 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet Handshake(22) with length: 2246 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 2251 bytes for 0xa. Total 2352 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[2] Handshake(22) in epoch 0 and length: 2251 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 625 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet Handshake(22) with length: 621 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 626 bytes for 0xa. Total 2978 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[3] Handshake(22) in epoch 0 and length: 626 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 4 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet Handshake(22) with length: 4 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 9 bytes for 0xa. Total 2987 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[4] Handshake(22) in epoch 0 and length: 9 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 2987 bytes in buffer. Mandos plugin mandos-client: GnuTLS: WRITE: wrote 2987 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[get_last_packet]:1159 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: SSL 3.3 Handshake packet received. Epoch 0, length: 102 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Expected Packet Handshake(22) Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Received Packet Handshake(22) with length: 102 Mandos plugin mandos-client: GnuTLS: READ: Got 102 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 102 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 102 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 107 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Decrypted Packet[1] Handshake(22) with length: 102 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: CLIENT KEY EXCHANGE (16) was received. Length 98[98], frag offset 0, frag length: 98, sequence: 0 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: SSL 3.3 ChangeCipherSpec packet received. Epoch 0, length: 1 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Expected Packet ChangeCipherSpec(20) Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Received Packet ChangeCipherSpec(20) with length: 1 Mandos plugin mandos-client: GnuTLS: READ: Got 1 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 1 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 1 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 6 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Decrypted Packet[2] ChangeCipherSpec(20) with length: 1 Mandos plugin mandos-client: GnuTLS: INT: PREMASTER SECRET[48]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: CLIENT RANDOM[32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: SERVER RANDOM[32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: MASTER SECRET: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Initializing epoch #1 Mandos plugin mandos-client: GnuTLS: INT: KEY BLOCK[72]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: CLIENT WRITE KEY [32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: SERVER WRITE KEY [32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: CLIENT WRITE IV [4]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: SERVER WRITE IV [4]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Epoch #1 ready Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Cipher Suite: ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[get_last_packet]:1159 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: SSL 3.3 Handshake packet received. Epoch 0, length: 40 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Expected Packet Handshake(22) Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Received Packet Handshake(22) with length: 40 Mandos plugin mandos-client: GnuTLS: READ: Got 40 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 40 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 40 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 45 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Decrypted Packet[0] Handshake(22) with length: 16 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: FINISHED (20) was received. Length 12[12], frag offset 0, frag length: 12, sequence: 0 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: recording tls-unique CB (recv) Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [CHANGE CIPHER SPEC] 1. Total 1 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent ChangeCipherSpec Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Cipher Suite: ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: Initializing internal [write] cipher sessions Mandos plugin mandos-client: GnuTLS: HSK[0xb780b8]: FINISHED was queued [16 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [FINISHED] 16. Total 17 bytes. Mandos plugin mandos-client: GnuTLS: HWRITE FLUSH: 17 bytes in buffer. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet ChangeCipherSpec(20) with length: 1 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 6 bytes for 0xa. Total 6 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[5] ChangeCipherSpec(20) in epoch 0 and length: 6 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 16 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet Handshake(22) with length: 16 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: AES-256-GCM, MAC: AEAD, Epoch: 1 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 45 bytes for 0xa. Total 51 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[1] Handshake(22) in epoch 1 and length: 45 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 51 bytes in buffer. Mandos plugin mandos-client: GnuTLS: WRITE: wrote 51 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Start of epoch cleanup Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Epoch #0 freed Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: End of epoch cleanup Mandos plugin mandos-client: Retrieving OpenPGP encrypted password from [SERVER IP WAS HERE] Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: SSL 3.3 Application Data packet received. Epoch 0, length: 1213 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Expected Packet Application Data(23) Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Received Packet Application Data(23) with length: 1213 Mandos plugin mandos-client: GnuTLS: READ: Got 1213 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 1213 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 1213 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 1218 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Decrypted Packet[1] Application Data(23) with length: 1189 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: SSL 3.3 Alert packet received. Epoch 0, length: 26 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Expected Packet Application Data(23) Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Received Packet Alert(21) with length: 26 Mandos plugin mandos-client: GnuTLS: READ: Got 26 bytes from 0xa Mandos plugin mandos-client: GnuTLS: READ: read 26 bytes from 0xa Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 26 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 31 bytes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Decrypted Packet[2] Alert(21) with length: 2 Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Alert[1|0] - Close notify - was received Mandos plugin mandos-client: GnuTLS: ASSERT: record.c[_gnutls_recv_in_buffers]:1328 Mandos plugin mandos-client: Closing TLS session Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 0 bytes in buffer. Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[_gnutls_io_write_flush]:694 Mandos plugin mandos-client: GnuTLS: REC: Sending Alert[1|0] - Close notify Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Preparing Packet Alert(21) with length: 2 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xb780b8]: cipher: AES-256-GCM, MAC: AEAD, Epoch: 1 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 31 bytes for 0xa. Total 31 bytes. Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 31 bytes in buffer. Mandos plugin mandos-client: GnuTLS: WRITE: wrote 31 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Sent Packet[2] Alert(21) in epoch 1 and length: 31 Mandos plugin mandos-client: Trying to decrypt OpenPGP data Mandos plugin mandos-client: bad gpgme_op_decrypt: GPGME: Decryption failed plugins.d/mandos-client.c:422:2: runtime error: null pointer passed as argument 3, which is declared to never be null Mandos plugin mandos-client: Unsupported algorithm: (null) Mandos plugin mandos-client: Wrong key usage: 0 Mandos plugin mandos-client: Public key algorithm: RSA Mandos plugin mandos-client: Key ID: [HEX DATA WAS HERE] Mandos plugin mandos-client: Secret key available: Yes Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Start of epoch cleanup Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: End of epoch cleanup Mandos plugin mandos-client: GnuTLS: REC[0xb780b8]: Epoch #1 freed Mandos plugin mandos-client: Retrying in 10 seconds *** mandos_client_chroot.txt Mandos plugin mandos-client: Ignoring hook "." - not a file Mandos plugin mandos-client: Ignoring hook ".." - not a file Mandos plugin mandos-client: Hook "dhcplan.conf" is acceptable Mandos plugin mandos-client: Running network hook "dhcplan.conf" Mandos plugin mandos-client: Network hook "dhcplan.conf" ran successfully Mandos plugin mandos-client: Rejecting loopback interface "lo" Mandos plugin mandos-client: Interface "eth0" is good Mandos plugin mandos-client: Interface "wlan0" is good Mandos plugin mandos-client: Will use interface "eth0" Mandos plugin mandos-client: Will use interface "wlan0" Mandos plugin mandos-client: Interface "eth0" is already up; good Mandos plugin mandos-client: Interface "wlan0" is already up; good Mandos plugin mandos-client: No interfaces were brought up Mandos plugin mandos-client: Initializing GnuTLS Mandos plugin mandos-client: Attempting to use OpenPGP public key /conf/conf.d/mandos/pubkey.txt and secret key /conf/conf.d/mandos/seckey.txt as GnuTLS credentials Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[_gnutls_openpgp_export]:166 Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[_gnutls_openpgp_export]:166 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[gnutls_openpgp_crt_get_preferred_key_id]:1644 Mandos plugin mandos-client: GnuTLS: ASSERT: pgp.c[gnutls_openpgp_crt_get_preferred_key_id]:1644 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: Signing using master PGP key Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: stream.c[cdk_stream_getc]:952 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: This OpenPGP key implies using a GnuTLS security parameter "High". Mandos plugin mandos-client: A "High" GnuTLS security parameter implies 3072 DH bits; using that. Mandos plugin mandos-client: Tempdir /run/tmp/mandosaIuvtZ did not work, trying /tmp/mandosXXXXXX Mandos plugin mandos-client: Initializing GPGME Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Allocating epoch #0 Mandos plugin mandos-client: Setting up a TCP connection to [SERVER IP WAS HERE], port 9601 Mandos plugin mandos-client: Connection to: [SERVER IP WAS HERE], port 9601 Mandos plugin mandos-client: Establishing TLS session with [SERVER IP WAS HERE] Mandos plugin mandos-client: GnuTLS: ASSERT: constate.c[_gnutls_epoch_get]:600 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Allocating epoch #1 Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[get_last_packet]:1159 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: SSL 3.1 Handshake packet received. Epoch 0, length: 143 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Expected Packet Handshake(22) Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Received Packet Handshake(22) with length: 143 Mandos plugin mandos-client: GnuTLS: READ: Got 143 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 143 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 143 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 148 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Decrypted Packet[0] Handshake(22) with length: 143 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: CLIENT HELLO (1) was received. Length 139[139], frag offset 0, frag length: 139, sequence: 0 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Client's version: 3.3 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Selected version TLS1.2 Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Extended Master Secret/23' (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Encrypt-then-MAC/22' (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'OCSP Status Request/5' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Certificate Type/9' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Safe Renegotiation/65281' (1 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Session Ticket/35' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Supported curves/10' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Supported ECC Point Formats/11' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Signature Algorithms/13' Mandos plugin mandos-client: GnuTLS: ASSERT: db.c[_gnutls_server_restore_session]:272 Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Extended Master Secret/23' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Encrypt-then-MAC/22' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'OCSP Status Request/5' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Certificate Type/9' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Safe Renegotiation/65281' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Session Ticket/35' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Supported curves/10' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Supported ECC Point Formats/11' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Signature Algorithms/13' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Extended Master Secret/23' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Encrypt-then-MAC/22' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'OCSP Status Request/5' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Certificate Type/9' (2 bytes) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Selected certificate type OPENPGP (2) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Safe Renegotiation/65281' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Session Ticket/35' (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Supported curves/10' (6 bytes) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Selected ECC curve SECP384R1 (3) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Supported ECC Point Formats/11' (2 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'Signature Algorithms/13' (12 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: rcvd signature algo (5.1) RSA-SHA384 Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: rcvd signature algo (5.3) ECDSA-SHA384 Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: rcvd signature algo (6.1) RSA-SHA512 Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: rcvd signature algo (6.3) ECDSA-SHA512 Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: rcvd signature algo (4.2) DSA-SHA256 Mandos plugin mandos-client: GnuTLS: ASSERT: server_name.c[gnutls_server_name_get]:310 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Requested server name: '' Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Requested PK algorithm: EC/ECDSA (4) -- ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: certificate[0] PK algorithm: RSA (1) - ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Requested PK algorithm: RSA (1) -- ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: certificate[0] PK algorithm: RSA (1) - ctype: OPENPGP (2) Mandos plugin mandos-client: GnuTLS: ASSERT: cert.c[check_key_usage]:280 Mandos plugin mandos-client: GnuTLS: ASSERT: cert.c[check_key_usage]:280 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_AES_256_GCM_SHA384 (C0.30) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_CAMELLIA_256_GCM_SHA384 (C0.8B) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_CHACHA20_POLY1305 (CC.A8) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_AES_256_CBC_SHA384 (C0.28) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384 (C0.77) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_AES_256_GCM_SHA384 (00.9F) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_CAMELLIA_256_GCM_SHA384 (C0.7D) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_CHACHA20_POLY1305 (CC.AA) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_AES_256_CBC_SHA256 (00.6B) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA256 (00.C4) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Keeping ciphersuite: GNUTLS_DHE_RSA_AES_256_CCM (C0.9F) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Requested cipher suites[size: 34]: Mandos plugin mandos-client: GnuTLS: 0xc0, 0x2c ECDHE_ECDSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: 0xc0, 0x87 ECDHE_ECDSA_CAMELLIA_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: 0xcc, 0xa9 ECDHE_ECDSA_CHACHA20_POLY1305 Mandos plugin mandos-client: GnuTLS: 0xc0, 0x24 ECDHE_ECDSA_AES_256_CBC_SHA384 Mandos plugin mandos-client: GnuTLS: 0xc0, 0x73 ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384 Mandos plugin mandos-client: GnuTLS: 0xc0, 0xad ECDHE_ECDSA_AES_256_CCM Mandos plugin mandos-client: GnuTLS: 0xc0, 0x30 ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Selected cipher suite: ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Selected Compression Method: NULL Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Extended Master Secret/23' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Encrypt-then-MAC/22' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Parsing extension 'OCSP Status Request/5' (5 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Certificate Type/9' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Safe Renegotiation/65281' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Session Ticket/35' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Supported curves/10' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Supported ECC Point Formats/11' Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Found extension 'Signature Algorithms/13' Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Safe renegotiation succeeded Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Sending extension Extended Master Secret (0 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Sending extension Certificate Type (1 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Sending extension Safe Renegotiation (1 bytes) Mandos plugin mandos-client: GnuTLS: EXT[0xe122b8]: Sending extension Supported ECC Point Formats (2 bytes) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: SessionID: [SESSION ID WAS HERE] Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: SERVER HELLO was queued [96 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [SERVER HELLO] 96. Total 96 bytes. Mandos plugin mandos-client: GnuTLS: Sending PGP key ID [PGP KEY ID WAS HERE] (master) Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: CERTIFICATE was queued [2246 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [CERTIFICATE] 2246. Total 2342 bytes. Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: signing handshake data: using RSA-SHA384 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: Signing using master PGP key Mandos plugin mandos-client: GnuTLS: ASSERT: privkey.c[gnutls_openpgp_privkey_get_preferred_key_id]:1230 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: SERVER KEY EXCHANGE was queued [621 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [SERVER KEY EXCHANGE] 621. Total 2963 bytes. Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: SERVER HELLO DONE was queued [4 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [SERVER HELLO DONE] 4. Total 2967 bytes. Mandos plugin mandos-client: GnuTLS: HWRITE FLUSH: 2967 bytes in buffer. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet Handshake(22) with length: 96 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 101 bytes for 0x17. Total 101 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[1] Handshake(22) in epoch 0 and length: 101 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 2871 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet Handshake(22) with length: 2246 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 2251 bytes for 0x17. Total 2352 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[2] Handshake(22) in epoch 0 and length: 2251 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 625 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet Handshake(22) with length: 621 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 626 bytes for 0x17. Total 2978 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[3] Handshake(22) in epoch 0 and length: 626 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 4 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet Handshake(22) with length: 4 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 9 bytes for 0x17. Total 2987 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[4] Handshake(22) in epoch 0 and length: 9 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 2987 bytes in buffer. Mandos plugin mandos-client: GnuTLS: WRITE: wrote 2987 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[get_last_packet]:1159 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: SSL 3.3 Handshake packet received. Epoch 0, length: 102 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Expected Packet Handshake(22) Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Received Packet Handshake(22) with length: 102 Mandos plugin mandos-client: GnuTLS: READ: Got 102 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 102 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 102 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 107 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Decrypted Packet[1] Handshake(22) with length: 102 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: CLIENT KEY EXCHANGE (16) was received. Length 98[98], frag offset 0, frag length: 98, sequence: 0 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: SSL 3.3 ChangeCipherSpec packet received. Epoch 0, length: 1 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Expected Packet ChangeCipherSpec(20) Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Received Packet ChangeCipherSpec(20) with length: 1 Mandos plugin mandos-client: GnuTLS: READ: Got 1 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 1 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 1 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 6 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Decrypted Packet[2] ChangeCipherSpec(20) with length: 1 Mandos plugin mandos-client: GnuTLS: INT: PREMASTER SECRET[48]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: CLIENT RANDOM[32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: SERVER RANDOM[32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: MASTER SECRET: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Initializing epoch #1 Mandos plugin mandos-client: GnuTLS: INT: KEY BLOCK[72]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: CLIENT WRITE KEY [32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: SERVER WRITE KEY [32]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: CLIENT WRITE IV [4]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: INT: SERVER WRITE IV [4]: [HEX DATA WAS HERE] Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Epoch #1 ready Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Cipher Suite: ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[get_last_packet]:1159 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: SSL 3.3 Handshake packet received. Epoch 0, length: 40 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Expected Packet Handshake(22) Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Received Packet Handshake(22) with length: 40 Mandos plugin mandos-client: GnuTLS: READ: Got 40 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 40 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 40 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 45 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Decrypted Packet[0] Handshake(22) with length: 16 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: FINISHED (20) was received. Length 12[12], frag offset 0, frag length: 12, sequence: 0 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: recording tls-unique CB (recv) Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [CHANGE CIPHER SPEC] 1. Total 1 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent ChangeCipherSpec Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Cipher Suite: ECDHE_RSA_AES_256_GCM_SHA384 Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: Initializing internal [write] cipher sessions Mandos plugin mandos-client: GnuTLS: HSK[0xe122b8]: FINISHED was queued [16 bytes] Mandos plugin mandos-client: GnuTLS: HWRITE: enqueued [FINISHED] 16. Total 17 bytes. Mandos plugin mandos-client: GnuTLS: HWRITE FLUSH: 17 bytes in buffer. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet ChangeCipherSpec(20) with length: 1 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: NULL, MAC: MAC-NULL, Epoch: 0 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 6 bytes for 0x17. Total 6 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[5] ChangeCipherSpec(20) in epoch 0 and length: 6 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 16 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet Handshake(22) with length: 16 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: AES-256-GCM, MAC: AEAD, Epoch: 1 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 45 bytes for 0x17. Total 51 bytes. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[1] Handshake(22) in epoch 1 and length: 45 Mandos plugin mandos-client: GnuTLS: HWRITE: wrote 1 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 51 bytes in buffer. Mandos plugin mandos-client: GnuTLS: WRITE: wrote 51 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Start of epoch cleanup Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Epoch #0 freed Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: End of epoch cleanup Mandos plugin mandos-client: Retrieving OpenPGP encrypted password from [SERVER IP WAS HERE] Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: SSL 3.3 Application Data packet received. Epoch 0, length: 1213 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Expected Packet Application Data(23) Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Received Packet Application Data(23) with length: 1213 Mandos plugin mandos-client: GnuTLS: READ: Got 1213 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 1213 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 1213 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 1218 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Decrypted Packet[1] Application Data(23) with length: 1189 Mandos plugin mandos-client: GnuTLS: READ: Got 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 5 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 0 bytes into buffer. Adding 5 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 5 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: SSL 3.3 Alert packet received. Epoch 0, length: 26 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Expected Packet Application Data(23) Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Received Packet Alert(21) with length: 26 Mandos plugin mandos-client: GnuTLS: READ: Got 26 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: READ: read 26 bytes from 0x17 Mandos plugin mandos-client: GnuTLS: RB: Have 5 bytes into buffer. Adding 26 bytes. Mandos plugin mandos-client: GnuTLS: RB: Requested 31 bytes Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Decrypted Packet[2] Alert(21) with length: 2 Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Alert[1|0] - Close notify - was received Mandos plugin mandos-client: GnuTLS: ASSERT: record.c[_gnutls_recv_in_buffers]:1328 Mandos plugin mandos-client: Closing TLS session Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 0 bytes in buffer. Mandos plugin mandos-client: GnuTLS: ASSERT: buffers.c[_gnutls_io_write_flush]:694 Mandos plugin mandos-client: GnuTLS: REC: Sending Alert[1|0] - Close notify Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Preparing Packet Alert(21) with length: 2 and min pad: 0 Mandos plugin mandos-client: GnuTLS: ENC[0xe122b8]: cipher: AES-256-GCM, MAC: AEAD, Epoch: 1 Mandos plugin mandos-client: GnuTLS: WRITE: enqueued 31 bytes for 0x17. Total 31 bytes. Mandos plugin mandos-client: GnuTLS: WRITE FLUSH: 31 bytes in buffer. Mandos plugin mandos-client: GnuTLS: WRITE: wrote 31 bytes, 0 bytes left. Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Sent Packet[2] Alert(21) in epoch 1 and length: 31 Mandos plugin mandos-client: Trying to decrypt OpenPGP data Mandos plugin mandos-client: Decryption of OpenPGP data succeeded Mandos plugin mandos-client: Decrypted password is: [HEX PASSWORD WAS ECHOED THERE] [PASSWORD WAS ECHOED THERE] Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Start of epoch cleanup Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: End of epoch cleanup Mandos plugin mandos-client: GnuTLS: REC[0xe122b8]: Epoch #1 freed Mandos plugin mandos-client: /lib/mandos/plugins.d/mandos-client exiting Mandos plugin mandos-client: Ignoring hook "." - not a file Mandos plugin mandos-client: Ignoring hook ".." - not a file Mandos plugin mandos-client: Hook "dhcplan.conf" is acceptable Mandos plugin mandos-client: Running network hook "dhcplan.conf" Mandos plugin mandos-client: Network hook "dhcplan.conf" ran successfully Mandos plugin mandos-client: No interfaces needed to be taken down Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/S.gpg-agent" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/S.gpg-agent.browser" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/S.gpg-agent.extra" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/S.gpg-agent.ssh" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/private-keys-v1.d" Mandos plugin mandos-client: Unlinking "private-keys-v1.d/[HEX DATA WAS HERE].key" Mandos plugin mandos-client: Unlinking "private-keys-v1.d/[HEX DATA WAS HERE].key" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/pubring.kbx" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/pubring.kbx~" Mandos plugin mandos-client: Unlinking "/tmp/mandosb5Eb8b/trustdb.gpg" -- System Information: Distributor ID: Raspbian Description: Raspbian GNU/Linux 9.4 (stretch) Release: 9.4 Codename: stretch Architecture: armv7l Kernel: Linux 4.14.30-v7+ (SMP w/4 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages mandos-client depends on: ii adduser 3.115 ii cryptsetup 2:1.7.3-4 ii dpkg-dev 1.18.24 ii initramfs-tools 0.130 ii libavahi-common3 0.6.32-2 ii libavahi-core7 0.6.32-2 ii libc6 2.24-11+deb9u3 ii libgnutls30 3.5.8-5+deb9u3 ii libgpgme11 1.8.0-3 ii libnl-3-200 3.2.27-2 ii libnl-route-3-200 3.2.27-2 ii libubsan0 6.3.0-18+rpi1+deb9u1 Versions of packages mandos-client recommends: ii openssl 1.1.0f-3+deb9u2 ii ssh 1:7.4p1-10+deb9u3 mandos-client suggests no packages. -- Configuration Files: /etc/mandos/plugin-runner.conf changed [not included] -- no debconf information