-
-
Notifications
You must be signed in to change notification settings - Fork 4.7k
bug: TLS Handshake Failure #5749
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
When making a curl call to against localstack in a container, it causes localstack to die and restart.
I am using a Mac M1 that has been upgraded to Monterey 12.3.
From what I can tell, this is related to the security cipher that curl uses, as the browser works correct, and I can get it to work correctly if I force a specific cipher that matches the browser. ie
curl -v -k --ciphers TLS_AES_256_GCM_SHA384 https://localhost:4566/health
Expected Behavior
The localstack service should not crash and restart.
How are you starting LocalStack?
With a docker-compose file
Steps To Reproduce
I am using the default docker-compose in the master branch.
How are you starting localstack (e.g., bin/localstack command, arguments, or docker-compose.yml)
docker-compose up -d
Steps to reproduce:
- Clone localstack project locally
- Run
docker-compose up -d - run this command
curl -v -k https://localhost:4566/health
Expected: A response would be returned with the service health.
Actual:
* Trying 127.0.0.1:4566...
* Connected to localhost (127.0.0.1) port 4566 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:4566
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:4566
Important Note: Visiting it in the browser is successful. Also, forcing the cipher is successful.
Environment
- OS: MacOS Monterey 12.3
- LocalStack: latest
- curl --version
curl 7.79.1 (x86_64-apple-darwin21.0) libcurl/7.79.1 (SecureTransport) LibreSSL/3.3.5 zlib/1.2.11 nghttp2/1.45.1
Release-Date: 2021-09-22
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL UnixSockets
### Anything else?
I spent the day attempting to debug this directly in the container to find the root of the issue. However, it appears to die before the request ever even makes it to the localstack python code (as that's where I was debugging). I wasn't sure where to troubleshoot further or find logs additional logs. The only info that shows up in the localstack logs is this:
2022-03-24 13:26:41,955 INFO exited: infra (terminated by SIGSEGV; not expected)
2022-03-24 13:26:42,969 INFO spawned: 'infra' with pid 5130
If you need more troubleshooting info, please let me know.