Dear Maintainer,
FTPS uploads using curl to a vsftpd server running on either Debian 10.1 or Debian 10.3 and on either arm64 or amd64 don't seem to work for large files (>=~50kB). Using the same curl command and vsftpd server worked for small files of 1kB. I tried changing server configuration options both in curl and the vsftpd server to no avail. I then tried using the same vsftpd configuration file on a vsftpd server on both Debian 8 and Debian 9, and both worked for all files sizes I tested (1kB-1GB). I also tried using filezilla to do an FTPS upload of a large file (1GB) to the Debian 10 vsftpd server, which was successful.
After much experimentation, it seems that the issue is related to the version on libssl1.1 that is being used. In Debian 10, libssl1.1 is at version 1.1.1 while in Debian 9 it is at version 1.1.0. I installed libssl version 1.1.0j-1~deb9u1 on my Debian 10 server, and the FTPS upload started working for large files.
To summarise:
curl -> Debian 10.3, vsftpd 3.0.3-12, libssl1.1 1.1.1d-0+deb10u2 doesn't work for large files
curl -> Debian 10.1, vsftpd 3.0.3-12, libssl1.1 1.1.1c-1 doesn't work for large files
filezilla -> Debian 10.1, vsftpd 3.0.3-12, libssl1.1 1.1.1c-1 works
curl -> Debian 9.9, vsftpd 3.0.3-8 , libssl1.1 1.1.0j-1~deb9u1 works
curl -> Debian 10.1, vsftpd 3.0.3-8 , libssl1.1 1.1.1c-1 doesn't work for large files
curl -> Debian 10.1, vsftpd 3.0.3-8 , libssl1.1 1.1.0j-1~deb9u1 works
curl -> Debian 10.1, vsftpd 3.0.3-12, libssl1.1 1.1.0j-1~deb9u1 works
The verbose curl output for the failed FTPS upload of a large file:
"
< 220 (vsFTPd 3.0.3)
< 234 Proceed with negotiation.
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [88 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [155 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [6 bytes data]
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
{ [192 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2613 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
} [2664 bytes data]
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
} [264 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* SSL certificate verify ok.
} [5 bytes data]
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1417 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [1417 bytes data]
* old SSL session ID is stale, removing
{ [5 bytes data]
< 331 Please specify the password.
} [5 bytes data]
{ [5 bytes data]
< 230 Login successful.
} [5 bytes data]
{ [5 bytes data]
< 200 PBSZ set to 0.
} [5 bytes data]
{ [5 bytes data]
< 200 PROT now Private.
} [5 bytes data]
{ [5 bytes data]
< 257 "/" is the current directory
* Entry path is '/'
} [5 bytes data]
* ftp_perform ends with SECONDARY: 0
{ [5 bytes data]
< 250 Directory successfully changed.
} [5 bytes data]
* Connect data stream passively
{ [5 bytes data]
< 229 Entering Extended Passive Mode (|||10091|)
* Trying 10.0.5.52...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55bd9976be80)
* Connecting to -
* Connected to - } [5 bytes data]
{ [5 bytes data]
< 200 Switching to Binary mode.
} [5 bytes data]
{ [5 bytes data]
< 150 Ok to send data.
* Doing the SSL/TLS handshake on the data stream
* SSL re-using session ID
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1733 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [88 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [1766 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [161 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [6 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* Server certificate:
* SSL certificate verify ok.
} [5 bytes data]
* We are completely uploaded and fine
* Remembering we are in dir "files/"
} [5 bytes data]
* TLSv1.3 (OUT), TLS alert, close notify (256):
} [2 bytes data]
< 426 Failure reading network stream.
* server did not report OK, got 426
100 1024k 0 0 100 1024k 0 2892k --:--:-- --:--:-- --:--:-- 2892k
* Connection #0 to host 10.0.5.52 left intact
curl: (18) server did not report OK, got 426
"
The verbose output of a successful upload of a small 1k file is identical except instead of:
"
< 426 Failure reading network stream.
* server did not report OK, got 426
100 1024k 0 0 100 1024k 0 2892k --:--:-- --:--:-- --:--:-- 2892k
"
it has:
"
< 226 Transfer complete.
100 1024 0 0 100 1024 0 2860 --:--:-- --:--:-- --:--:-- 2860
"
Enabling debug_ssl in vsftpd returns this value in the logs when the upload of a large file fails:
"
SSL ret: 18446744073709551615, SSL error: error:00000000:lib(0):func(0):reason(0), errno: 32
"