Connection closed - strange error, unable to connect from erlang VM to certain host

Question

IMPORTANT Proved that migration from 18.3 to 18.3.4 causes this issue, and migration back to 18.3 removes it.

Everything worked until one moment. Then it just stoped to work.

  def work do
    HTTPotion.get("https://ssl-third-party.com",
    ibrowse: [
      is_ssl: true,
      ssl_options: [
        certfile: Path.join(File.cwd!, "cert_dev.pem"),
        password: "pass" |> to_charlist,
      ]
      ])
  end

Which responds with:

%HTTPotion.ErrorResponse{message: "closed"}

I tried several erlang libs without elixir wrapping(hackney + ibrowse) from iex shell:

iex(5)> url = <<"https://ssl-third-party.com">>
iex(6)> headers = []
[]
iex(8)> payload = <<>>
""
iex(9)> options=[:insecure]
[:insecure]
iex(10)> :hackney.request(m, url, headers, payload, options)
{:error, :closed}
###
iex(1)> a = "https://ssl-third-party.com" |> to_char_list
iex(2)> :ibrowse.send_req(a, [], :get)
{:error, {:conn_failed, {:error, :closed}}}

While I can connect to other hosts.

Applications are started, I can make request from same session.

Connection works with simple curl request.

Erlang tested - 18.3.4/19.0.2

OS X El Capitan.

UPD1 also I noted this report during reinstalling all erlang-related packages:

20:25:01.535 [error] Failed updating session: 
   ProfileName: :httpc_mix
   SessionId:   {{'repo.hex.pm', 443}, #PID<0.163.0>}
   Pos:         7
   Value:       0
when
   Session (db) info: :undefined
   Session (db):      {:session, {{'repo.hex.pm', 443}, #PID<0.163.0>}, false, :https,
 {:sslsocket, {:gen_tcp, #Port<0.5536>, :tls_connection, :undefined},
  #PID<0.164.0>}, {:essl, []}, 1, :keep_alive, true}
   Session (record):  {:EXIT,
 {:badarg,
  [{:ets, :lookup,
    [:httpc_mix__session_db, {{'repo.hex.pm', 443}, #PID<0.163.0>}], []},
   {:httpc_manager, :lookup_session, 2, [file: 'httpc_manager.erl', line: 189]},
   {:httpc_handler, :update_session, 4,
    [file: 'httpc_handler.erl', line: 1909]},
   {:httpc_handler, :handle_empty_queue, 4,
    [file: 'httpc_handler.erl', line: 1368]},
   {:httpc_handler, :handle_info, 2, [file: 'httpc_handler.erl', line: 471]},
   {:gen_server, :try_dispatch, 4, [file: 'gen_server.erl', line: 601]},
   {:gen_server, :handle_msg, 5, [file: 'gen_server.erl', line: 667]},
   {:proc_lib, :init_p_do_apply, 3, [file: 'proc_lib.erl', line: 247]}]}}
   T: :error
   E: :badarg

20:25:01.536 [error] Failed updating session: 
   ProfileName: :httpc_mix
   SessionId:   {{'repo.hex.pm', 443}, #PID<0.163.0>}
   Pos:         9
   Value:       true
when
   Session (db) info: :undefined
   Session (db):      {:session, {{'repo.hex.pm', 443}, #PID<0.163.0>}, false, :https,
 {:sslsocket, {:gen_tcp, #Port<0.5536>, :tls_connection, :undefined},
  #PID<0.164.0>}, {:essl, []}, 1, :keep_alive, false}
   Session (record):  {:EXIT,
 {:badarg,
  [{:ets, :lookup,
    [:httpc_mix__session_db, {{'repo.hex.pm', 443}, #PID<0.163.0>}], []},
   {:httpc_manager, :lookup_session, 2, [file: 'httpc_manager.erl', line: 189]},
   {:httpc_handler, :update_session, 4,
    [file: 'httpc_handler.erl', line: 1909]},
   {:httpc_handler, :maybe_make_session_available, 2,
    [file: 'httpc_handler.erl', line: 1516]},
   {:httpc_handler, :answer_request, 3,
    [file: 'httpc_handler.erl', line: 1507]},
   {:httpc_handler, :terminate, 2, [file: 'httpc_handler.erl', line: 759]},
   {:gen_server, :try_terminate, 3, [file: 'gen_server.erl', line: 629]},
   {:gen_server, :terminate, 7, [file: 'gen_server.erl', line: 795]}]}}
   T: :error
   E: :badarg

20:25:01.541 [error] GenServer #PID<0.163.0> terminating
** (stop) {:failed_updating_session, [profile: :httpc_mix, session_id: {{'repo.hex.pm', 443}, #PID<0.163.0>}, pos: 9, value: true, etype: :error, error: :badarg, stacktrace: [{:ets, :update_element, [:httpc_mix__session_db, {{'repo.hex.pm', 443}, #PID<0.163.0>}, {9, true}], []}, {:httpc_manager, :update_session, 4, [file: 'httpc_manager.erl', line: 210]}, {:httpc_handler, :update_session, 4, [file: 'httpc_handler.erl', line: 1887]}, {:httpc_handler, :maybe_make_session_available, 2, [file: 'httpc_handler.erl', line: 1516]}, {:httpc_handler, :answer_request, 3, [file: 'httpc_handler.erl', line: 1507]}, {:httpc_handler, :terminate, 2, [file: 'httpc_handler.erl', line: 759]}, {:gen_server, :try_terminate, 3, [file: 'gen_server.erl', line: 629]}, {:gen_server, :terminate, 7, [file: 'gen_server.erl', line: 795]}]]}
    (inets) httpc_handler.erl:1911: :httpc_handler.update_session/4
    (inets) httpc_handler.erl:1516: :httpc_handler.maybe_make_session_available/2
    (inets) httpc_handler.erl:1507: :httpc_handler.answer_request/3
    (inets) httpc_handler.erl:759: :httpc_handler.terminate/2
    (stdlib) gen_server.erl:629: :gen_server.try_terminate/3
    (stdlib) gen_server.erl:795: :gen_server.terminate/7
    (stdlib) proc_lib.erl:247: :proc_lib.init_p_do_apply/3
Last message: {:ssl, {:sslsocket, {:gen_tcp, #Port<0.5536>, :tls_connection, :undefined}, #PID<0.164.0>}, "HTTP/1.1 200 OK\r\nx-amz-id-2: FGpS/bqXLPTNYV4oMTTIvqekRgbExlvO83ZoTR6deiB02Hsm4uqtctPYvP5lqryk/ZYK12/DCuM=\r\nx-amz-request-id: 346087C27C829E83\r\nx-amz-replication-status: COMPLETED\r\nCache-Control: public, max-age=604800\r\nx-amz-meta-surrogate-key: installs\r\nx-amz-version-id: IzHO194FIe8NSS4oev.5dtp2BgBltonw\r\nLast-Modified: Wed, 29 Jun 2016 00:00:27 GMT\r\nETag: \"e8a325a6ca33736d137e5b6f57fe4259\"\r\nContent-Type: binary/octet-stream\r\nServer: AmazonS3\r\nVia: 1.1 varnish\r\nFastly-Debug-Digest: 864530c58fa2f5e6f7b455ba1b8a8fd668c94f688c98b6cdc85319515ff6f6b1\r\nContent-Length: 350\r\nAccept-Ranges: bytes\r\nDate: Fri, 29 Jul 2016 17:25:01 GMT\r\nVia: 1.1 varnish\r\nAge: 235183\r\nConnection: keep-alive\r\nX-Served-By: cache-iad2144-IAD, cache-bma7023-BMA\r\nX-Cache: HIT, HIT\r\nX-Cache-Hits: 1, 1\r\nX-Timer: S1469813101.087231,VS0,VE0\r\n\r\njM3an/yCuclmNcCX0wzS9QhCHsJl+Xf6/FS5bAaQ5O9AAFMlkCnJt4vW08LNU6eL\nkfOsK+mVZ1n8Dk/+I8ThzpO1NZlH3UNYt/8OgK+ZfhFlrT0D1UZ/QEIR1/8TIC4v\nC25ibCcvxTK9zG93mAdrLLCLA6/o4NXeaMV6DOOZ31ZcMWjpCNjDLU1B20UsVSBN\nKzsLkI4QfgrtSt5Iquhs0wovJlpz/lZh7jEf58BTMWa/Z9Yl2EmEVsyO8Fie5RiF\np+KTkDILxY/QkKwSPE+0AcS5BR3dpJSsp8m5RVLUb/44b0KUKko+uPBmN8g6TSYP\nGSIG5Ay9BjXE0uAi2RTFEw==\n"}
State: {:state, {:request, #Reference<0.0.3.498>, #PID<0.70.0>, 0, :https, {'repo.hex.pm', 443}, '/installs/rebar3-1.x.csv.signed', [], :get, {:http_request_h, :undefined, 'keep-alive', :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, 'repo.hex.pm', :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, :undefined, [], 'Mix/1.3.2', :undefined, :undefined, :undefined, '0', :undefined, :undefined, :undefined, :undefined, :undefined, ...}, {[], []}, {:http_options, 'HTTP/1.1', :infinity, true, {:essl, []}, :undefined, true, :infinity, false}, 'https://repo.hex.pm/installs/rebar3-1.x.csv.signed', [], :none, [], 1469813101026, :undefined, :undefined, false}, {:session, {{'repo.hex.pm', 443}, #PID<0.163.0>}, false, :https, {:sslsocket, {:gen_tcp, #Port<0.5536>, :tls_connection, :undefined}, #PID<0.164.0>}, {:essl, []}, 1, :keep_alive, false}, :undefined, :undefined, :undefined, {:httpc_response, :parse, [:nolimit, true]}, {[], []}, {[], []}, :new, [], :nolimit, :nolimit, {:options, {:undefined, []}, {:undefined, []}, 0, 2, 5, 120000, 2, :disabled, false, :inet, :default, :default, []}, {:timers, [], :undefined}, :httpc_mix, :inactive}

UPD2

Probably must be OSX or >18.3 OTP bug: just made it on the other ubuntu computer Erlang version 18.3 and it worked fine, this one returns (Erlang shell):

httpc:request(get, {"https://ssl-third-party.com", []}, [], []).
{error,{failed_connect,[{to_address,{"https://ssl-third-party.com",
                                     443}},
                        {inet,[inet],closed}]}}

Can you try the same with `curl`? Seems like the connection is being closed, maybe the server is down? — Paweł Obrok, Jul 27 '16 at 18:45
@PawełObrok, yes, it works with curl. It worked fine until some point in my system, and then suddenly stoped — Joe Half Face, Jul 27 '16 at 19:06
18.3.4 has been tested but not 18.3.4.2? There are some SSL related changes between those two: "The TLS/SSL protocol version selection for the SSL server has been corrected to follow RFC 5246 Appendix E.1 especially in case where the list of supported versions has gaps. Now the server selects the highest protocol version it supports that is not higher than what the client supports." — J.J. Hakala, Aug 03 '16 at 19:22

score 3 · Answer 1 · answered Jul 30 '16 at 11:42

3

Sounds like you're running in to the same problem discussed in this erlang-questions mail thread recently. Apparently the SSL application changed cipher suite configurations between 18.3 patch versions which can lead to this problem.

In the mail thread I referenced the solution was to configure SSL to use TLS 1.2, i.e. setting

{versions, ['tlsv1.2']}

for the SSL application.

answered Jul 30 '16 at 11:42

johlo

5,422
1
18
32

this doesn't work for me... Raises error of wrong option. – Joe Half Face Aug 01 '16 at 13:03
`{{{:badmatch, %HTTPotion.ErrorResponse{message: "{:options, {'tlsv1.2', {:versions, ['tlsv1.2']}}}"}}` if someone helps me to reslove this ill approve answer – Joe Half Face Aug 01 '16 at 14:42
1

Using ibrowse in Erlang the following works for me: `ibrowse:send_req("https://aws.amazon.com", [], get, [], [{is_ssl, true}, {ssl_options, [{versions, ['tlsv1.2']}]}]).` Note the `ssl_options` key. – johlo Aug 02 '16 at 07:52

Connection closed - strange error, unable to connect from erlang VM to certain host

1 Answers1

Linked