I'm working on a fresh ubuntu 18.04.01 in which I installed Docker version 18.09.1, build 4c52b90 by following the official install guide. I'm experiencing a weird issue regarding TLS 1.2
On the host I can curl to any URL with https without a problem. Here is an example with github, but works just fine with google and such.
$ curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.0g zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
$ curl -v https://github.com
* Rebuilt URL to: https://github.com/
* Trying 140.82.118.3...
* TCP_NODELAY set
* Connected to github.com (140.82.118.3) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
...
On a docker container I'm unable to reach https://github.org and others, while https://google.com for instance works just fine.
Here is curl version and connection to google
$ docker run -it --rm ubuntu:18.04 bash
$ root@66c5a69546fc:/# curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.0g zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
root@ 66c5a69546fc:/# curl -v https://google.com
* Rebuilt URL to: https://google.com/
* Trying 216.58.205.110...
* TCP_NODELAY set
* Connected to google.com (216.58.205.110) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
here is the curl to github that will eventually end in an handshake timeout
$ root@c69bad8b7d95:/# curl -v https://github.com
* Rebuilt URL to: https://github.com/
* Trying 140.82.118.3...
* TCP_NODELAY set
* Connected to github.com (140.82.118.3) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
while both ping and curl in http work fine
$ root@c69bad8b7d95:/# ping github.com
PING github.com (140.82.118.3) 56(84) bytes of data.
64 bytes from lb-git-ssh.net.am4-ams.github.net (140.82.118.3): icmp_seq=1 ttl=49 time=25.6 ms
64 bytes from lb-git-ssh.net.am4-ams.github.net (140.82.118.3): icmp_seq=2 ttl=49 time=25.7 ms
^C
--- github.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 25.644/25.685/25.726/0.041 ms
$ root@c69bad8b7d95:/# curl -v http://github.com
* Rebuilt URL to: http://github.com/
* Trying 140.82.118.4...
* TCP_NODELAY set
* Connected to github.com (140.82.118.4) port 80 (#0)
Is there a docker setting that I'm missing? I tried setting in daemon.json a different DNS, changing the bip for docker but nothing seems to work
Thank you for the help Alberto