Closed basilrabi closed 2 years ago
Thumbs up for this very good bug report!
Can't repro this though with a minimal x0tigervncserver example, at least on Debian 11. Here's what I did:
$ apt install tigervnc-standalone-server #YYMV for Fedora
$ x0tigervncserver -rfbport 5901 -SecurityTypes TLSVnc -verbose -localhost no
You will require a password to access your desktops.
Password:
Verify:
Would you like to enter a view-only password (y/n)? n
Starting /usr/bin/X0tigervnc -rfbport 5901 -localhost=0 -SecurityTypes TLSVnc -PasswordFile /home/bk/.vnc/passwd -ClientWaitTimeMillis 30000
New X0tigervnc server 'denkpad:1 (bk)' on port 5901 for display :0.
Use xtigervncviewer -SecurityTypes TLSVnc -passwd /home/bk/.vnc/passwd denkpad:1 to connect to the VNC server.
Connecting with MultiVNC 2.0.3 gives a server log of:
$ cat .vnc/
denkpad:5901.log denkpad:5901.pid passwd
bk@denkpad:~$ cat .vnc/denkpad\:5901.log
Sun Dec 5 12:41:42 2021
Geometry: Desktop geometry is set to 1920x1080+0+0
XDesktop: XTest extension present - version 2.2
Main: Listening on port 5901
3NI3X0 New X0tigervnc server 'denkpad:1 (bk)' on port 5901 for display :0.
3NI3X0 Use xtigervncviewer -SecurityTypes TLSVnc -passwd /home/bk/.vnc/passwd denkpad:1 to connect to the VNC server.
Sun Dec 5 12:41:49 2021
Connections: accepted: 192.168.42.160::37896
SConnection: Client needs protocol version 3.8
SConnection: Client requests security type VeNCrypt(19)
SVeNCrypt: Client requests security type TLSVnc (258)
Sun Dec 5 12:41:55 2021
XDesktop: Enabling 8 buttons of X pointer device
XDesktop: Allocated shared memory image
VNCSConnST: Server default pixel format depth 24 (32bpp) little-endian rgb888
VNCSConnST: Client pixel format depth 24 (32bpp) little-endian bgr888
Sun Dec 5 12:42:00 2021
VNCSConnST: closing 192.168.42.160::37896: Clean disconnection
EncodeManager: Framebuffer updates: 1
EncodeManager: Tight:
EncodeManager: Solid: 4 rects, 2.07344 Mpixels
EncodeManager: 64 B (1:129591 ratio)
EncodeManager: Indexed RLE: 1 rects, 160 pixels
EncodeManager: 123 B (1:5.30081 ratio)
EncodeManager: Total: 5 rects, 2.0736 Mpixels
EncodeManager: 187 B (1:44355.4 ratio)
TLS: TLS session wasn't terminated gracefully
Connections: closed: 192.168.42.160::37896
ComparingUpdateTracker: 0 pixels in / 0 pixels out
ComparingUpdateTracker: (1:-nan ratio)
ldd /usr/bin/X0tigervnc
Can you try with the change highlighted in https://pagure.io/fedora-docs/release-notes/issue/470#comment-693309 ?
Tried running update-crypto-policies --set LEGACY
then rebooting the system. Tried it also while not rebooting the system. I still can't connect to tigervnc.
Can you try with the above x0tigervncserver commandline as well?
There seem to be no package providing the command x0tigervncserver
in fedora 35. However, I tried vncserver -rfbport 5901 -SecurityTypes TLSVnc -verbose -localhost no
. Log seems to be similar:
Xvnc TigerVNC 1.11.0 - built Jul 23 2021 00:00:00
Copyright (C) 1999-2020 TigerVNC Team and many others (see README.rst)
See https://www.tigervnc.org for information on TigerVNC.
Underlying X server release 12011000, The X.Org Foundation
Sun Dec 5 23:36:58 2021
vncext: VNC extension running!
vncext: Listening for VNC connections on all interface(s), port 5901
vncext: created VNC server for screen 0
(II) IGLX: Loaded and initialized swrast
(II) GLX: Initialized DRISWRAST GL provider for screen 0
Environment variable $XAUTHORITY not set, ignoring.
Sun Dec 5 23:37:02 2021
ComparingUpdateTracker: 0 pixels in / 0 pixels out
ComparingUpdateTracker: (1:-nan ratio)
Sun Dec 5 23:38:08 2021
Connections: accepted: 192.169.101.128::54744
SConnection: Client needs protocol version 3.8
SConnection: Client requests security type VeNCrypt(19)
SVeNCrypt: Client requests security type TLSVnc (258)
TLS: TLS Handshake failed: No supported cipher suites have been found.
TLS: TLS session wasn't terminated gracefully
SConnection: AuthFailureException: Authentication failure: TLS Handshake
failed
VNCSConnST: closing 192.169.101.128::54744: Clean disconnection
EncodeManager: Framebuffer updates: 0
EncodeManager: Total: 0 rects, 0 pixels
EncodeManager: 0 B (1:-nan ratio)
Connections: closed: 192.169.101.128::54744
ComparingUpdateTracker: 0 pixels in / 0 pixels out
ComparingUpdateTracker: (1:-nan ratio)
Please post the output of ldd /usr/bin/X0tigervnc
I can't find X0tigervnc
but for Xvnc
:
$ ldd /usr/bin/Xvnc
linux-vdso.so.1 (0x00007ffdf29f2000)
libjpeg.so.62 => /lib64/libjpeg.so.62 (0x00007f66f2f47000)
libpam.so.0 => /lib64/libpam.so.0 (0x00007f66f2f35000)
libz.so.1 => /lib64/libz.so.1 (0x00007f66f2f1b000)
libgnutls.so.30 => /lib64/libgnutls.so.30 (0x00007f66f2d0c000)
libnettle.so.8 => /lib64/libnettle.so.8 (0x00007f66f2cc2000)
libpixman-1.so.0 => /lib64/libpixman-1.so.0 (0x00007f66f2c16000)
libXfont2.so.2 => /lib64/libXfont2.so.2 (0x00007f66f2be5000)
libXau.so.6 => /lib64/libXau.so.6 (0x00007f66f2bdf000)
libXdmcp.so.6 => /lib64/libXdmcp.so.6 (0x00007f66f2bd7000)
libGL.so.1 => /lib64/libGL.so.1 (0x00007f66f2b50000)
libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007f66f2931000)
libm.so.6 => /lib64/libm.so.6 (0x00007f66f2855000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007f66f2839000)
libc.so.6 => /lib64/libc.so.6 (0x00007f66f262f000)
libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f66f2601000)
libeconf.so.0 => /lib64/libeconf.so.0 (0x00007f66f25f6000)
libp11-kit.so.0 => /lib64/libp11-kit.so.0 (0x00007f66f24c4000)
libidn2.so.0 => /lib64/libidn2.so.0 (0x00007f66f24a3000)
libunistring.so.2 => /lib64/libunistring.so.2 (0x00007f66f231c000)
libtasn1.so.6 => /lib64/libtasn1.so.6 (0x00007f66f2304000)
libhogweed.so.6 => /lib64/libhogweed.so.6 (0x00007f66f22c1000)
libgmp.so.10 => /lib64/libgmp.so.10 (0x00007f66f221e000)
/lib64/ld-linux-x86-64.so.2 (0x00007f66f32be000)
libfontenc.so.1 => /lib64/libfontenc.so.1 (0x00007f66f2214000)
libfreetype.so.6 => /lib64/libfreetype.so.6 (0x00007f66f2149000)
libGLX.so.0 => /lib64/libGLX.so.0 (0x00007f66f2115000)
libX11.so.6 => /lib64/libX11.so.6 (0x00007f66f1fcd000)
libXext.so.6 => /lib64/libXext.so.6 (0x00007f66f1fb8000)
libGLdispatch.so.0 => /lib64/libGLdispatch.so.0 (0x00007f66f1f00000)
libcap-ng.so.0 => /lib64/libcap-ng.so.0 (0x00007f66f1ef7000)
libffi.so.6 => /lib64/libffi.so.6 (0x00007f66f1eec000)
libbz2.so.1 => /lib64/libbz2.so.1 (0x00007f66f1ed7000)
libpng16.so.16 => /lib64/libpng16.so.16 (0x00007f66f1e9e000)
libharfbuzz.so.0 => /lib64/libharfbuzz.so.0 (0x00007f66f1dc8000)
libbrotlidec.so.1 => /lib64/libbrotlidec.so.1 (0x00007f66f1dba000)
libxcb.so.1 => /lib64/libxcb.so.1 (0x00007f66f1d8f000)
libglib-2.0.so.0 => /lib64/libglib-2.0.so.0 (0x00007f66f1c52000)
libgraphite2.so.3 => /lib64/libgraphite2.so.3 (0x00007f66f1c31000)
libbrotlicommon.so.1 => /lib64/libbrotlicommon.so.1 (0x00007f66f1c0e000)
libpcre.so.1 => /lib64/libpcre.so.1 (0x00007f66f1b96000)
I think the line
TLS: TLS Handshake failed: No supported cipher suites have been found.
is the most interesting one. Please post the output of gnutls-cli -l
on the server machine.
$ gnutls-cli -l
Cipher suites:
TLS_AES_128_GCM_SHA256 0x13, 0x01 TLS1.3
TLS_AES_256_GCM_SHA384 0x13, 0x02 TLS1.3
TLS_CHACHA20_POLY1305_SHA256 0x13, 0x03 TLS1.3
TLS_AES_128_CCM_SHA256 0x13, 0x04 TLS1.3
TLS_AES_128_CCM_8_SHA256 0x13, 0x05 TLS1.3
TLS_RSA_NULL_MD5 0x00, 0x01 TLS1.0
TLS_RSA_NULL_SHA1 0x00, 0x02 TLS1.0
TLS_RSA_NULL_SHA256 0x00, 0x3b TLS1.2
TLS_RSA_ARCFOUR_128_SHA1 0x00, 0x05 TLS1.0
TLS_RSA_ARCFOUR_128_MD5 0x00, 0x04 TLS1.0
TLS_RSA_3DES_EDE_CBC_SHA1 0x00, 0x0a TLS1.0
TLS_RSA_AES_128_CBC_SHA1 0x00, 0x2f TLS1.0
TLS_RSA_AES_256_CBC_SHA1 0x00, 0x35 TLS1.0
TLS_RSA_CAMELLIA_128_CBC_SHA256 0x00, 0xba TLS1.2
TLS_RSA_CAMELLIA_256_CBC_SHA256 0x00, 0xc0 TLS1.2
TLS_RSA_CAMELLIA_128_CBC_SHA1 0x00, 0x41 TLS1.0
TLS_RSA_CAMELLIA_256_CBC_SHA1 0x00, 0x84 TLS1.0
TLS_RSA_AES_128_CBC_SHA256 0x00, 0x3c TLS1.2
TLS_RSA_AES_256_CBC_SHA256 0x00, 0x3d TLS1.2
TLS_RSA_AES_128_GCM_SHA256 0x00, 0x9c TLS1.2
TLS_RSA_AES_256_GCM_SHA384 0x00, 0x9d TLS1.2
TLS_RSA_CAMELLIA_128_GCM_SHA256 0xc0, 0x7a TLS1.2
TLS_RSA_CAMELLIA_256_GCM_SHA384 0xc0, 0x7b TLS1.2
TLS_RSA_AES_128_CCM 0xc0, 0x9c TLS1.2
TLS_RSA_AES_256_CCM 0xc0, 0x9d TLS1.2
TLS_RSA_AES_128_CCM_8 0xc0, 0xa0 TLS1.2
TLS_RSA_AES_256_CCM_8 0xc0, 0xa1 TLS1.2
TLS_DHE_DSS_ARCFOUR_128_SHA1 0x00, 0x66 TLS1.0
TLS_DHE_DSS_3DES_EDE_CBC_SHA1 0x00, 0x13 TLS1.0
TLS_DHE_DSS_AES_128_CBC_SHA1 0x00, 0x32 TLS1.0
TLS_DHE_DSS_AES_256_CBC_SHA1 0x00, 0x38 TLS1.0
TLS_DHE_DSS_CAMELLIA_128_CBC_SHA256 0x00, 0xbd TLS1.2
TLS_DHE_DSS_CAMELLIA_256_CBC_SHA256 0x00, 0xc3 TLS1.2
TLS_DHE_DSS_CAMELLIA_128_CBC_SHA1 0x00, 0x44 TLS1.0
TLS_DHE_DSS_CAMELLIA_256_CBC_SHA1 0x00, 0x87 TLS1.0
TLS_DHE_DSS_AES_128_CBC_SHA256 0x00, 0x40 TLS1.2
TLS_DHE_DSS_AES_256_CBC_SHA256 0x00, 0x6a TLS1.2
TLS_DHE_DSS_AES_128_GCM_SHA256 0x00, 0xa2 TLS1.2
TLS_DHE_DSS_AES_256_GCM_SHA384 0x00, 0xa3 TLS1.2
TLS_DHE_DSS_CAMELLIA_128_GCM_SHA256 0xc0, 0x80 TLS1.2
TLS_DHE_DSS_CAMELLIA_256_GCM_SHA384 0xc0, 0x81 TLS1.2
TLS_DHE_RSA_3DES_EDE_CBC_SHA1 0x00, 0x16 TLS1.0
TLS_DHE_RSA_AES_128_CBC_SHA1 0x00, 0x33 TLS1.0
TLS_DHE_RSA_AES_256_CBC_SHA1 0x00, 0x39 TLS1.0
TLS_DHE_RSA_CAMELLIA_128_CBC_SHA256 0x00, 0xbe TLS1.2
TLS_DHE_RSA_CAMELLIA_256_CBC_SHA256 0x00, 0xc4 TLS1.2
TLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 0x00, 0x45 TLS1.0
TLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 0x00, 0x88 TLS1.0
TLS_DHE_RSA_AES_128_CBC_SHA256 0x00, 0x67 TLS1.2
TLS_DHE_RSA_AES_256_CBC_SHA256 0x00, 0x6b TLS1.2
TLS_DHE_RSA_AES_128_GCM_SHA256 0x00, 0x9e TLS1.2
TLS_DHE_RSA_AES_256_GCM_SHA384 0x00, 0x9f TLS1.2
TLS_DHE_RSA_CAMELLIA_128_GCM_SHA256 0xc0, 0x7c TLS1.2
TLS_DHE_RSA_CAMELLIA_256_GCM_SHA384 0xc0, 0x7d TLS1.2
TLS_DHE_RSA_CHACHA20_POLY1305 0xcc, 0xaa TLS1.2
TLS_DHE_RSA_AES_128_CCM 0xc0, 0x9e TLS1.2
TLS_DHE_RSA_AES_256_CCM 0xc0, 0x9f TLS1.2
TLS_DHE_RSA_AES_128_CCM_8 0xc0, 0xa2 TLS1.2
TLS_DHE_RSA_AES_256_CCM_8 0xc0, 0xa3 TLS1.2
TLS_ECDHE_RSA_NULL_SHA1 0xc0, 0x10 TLS1.0
TLS_ECDHE_RSA_3DES_EDE_CBC_SHA1 0xc0, 0x12 TLS1.0
TLS_ECDHE_RSA_AES_128_CBC_SHA1 0xc0, 0x13 TLS1.0
TLS_ECDHE_RSA_AES_256_CBC_SHA1 0xc0, 0x14 TLS1.0
TLS_ECDHE_RSA_AES_256_CBC_SHA384 0xc0, 0x28 TLS1.2
TLS_ECDHE_RSA_ARCFOUR_128_SHA1 0xc0, 0x11 TLS1.0
TLS_ECDHE_RSA_CAMELLIA_128_CBC_SHA256 0xc0, 0x76 TLS1.2
TLS_ECDHE_RSA_CAMELLIA_256_CBC_SHA384 0xc0, 0x77 TLS1.2
TLS_ECDHE_ECDSA_NULL_SHA1 0xc0, 0x06 TLS1.0
TLS_ECDHE_ECDSA_3DES_EDE_CBC_SHA1 0xc0, 0x08 TLS1.0
TLS_ECDHE_ECDSA_AES_128_CBC_SHA1 0xc0, 0x09 TLS1.0
TLS_ECDHE_ECDSA_AES_256_CBC_SHA1 0xc0, 0x0a TLS1.0
TLS_ECDHE_ECDSA_ARCFOUR_128_SHA1 0xc0, 0x07 TLS1.0
TLS_ECDHE_ECDSA_CAMELLIA_128_CBC_SHA256 0xc0, 0x72 TLS1.2
TLS_ECDHE_ECDSA_CAMELLIA_256_CBC_SHA384 0xc0, 0x73 TLS1.2
TLS_ECDHE_ECDSA_AES_128_CBC_SHA256 0xc0, 0x23 TLS1.2
TLS_ECDHE_RSA_AES_128_CBC_SHA256 0xc0, 0x27 TLS1.2
TLS_ECDHE_ECDSA_CAMELLIA_128_GCM_SHA256 0xc0, 0x86 TLS1.2
TLS_ECDHE_ECDSA_CAMELLIA_256_GCM_SHA384 0xc0, 0x87 TLS1.2
TLS_ECDHE_ECDSA_AES_128_GCM_SHA256 0xc0, 0x2b TLS1.2
TLS_ECDHE_ECDSA_AES_256_GCM_SHA384 0xc0, 0x2c TLS1.2
TLS_ECDHE_RSA_AES_128_GCM_SHA256 0xc0, 0x2f TLS1.2
TLS_ECDHE_RSA_AES_256_GCM_SHA384 0xc0, 0x30 TLS1.2
TLS_ECDHE_ECDSA_AES_256_CBC_SHA384 0xc0, 0x24 TLS1.2
TLS_ECDHE_RSA_CAMELLIA_128_GCM_SHA256 0xc0, 0x8a TLS1.2
TLS_ECDHE_RSA_CAMELLIA_256_GCM_SHA384 0xc0, 0x8b TLS1.2
TLS_ECDHE_RSA_CHACHA20_POLY1305 0xcc, 0xa8 TLS1.2
TLS_ECDHE_ECDSA_CHACHA20_POLY1305 0xcc, 0xa9 TLS1.2
TLS_ECDHE_ECDSA_AES_128_CCM 0xc0, 0xac TLS1.2
TLS_ECDHE_ECDSA_AES_256_CCM 0xc0, 0xad TLS1.2
TLS_ECDHE_ECDSA_AES_128_CCM_8 0xc0, 0xae TLS1.2
TLS_ECDHE_ECDSA_AES_256_CCM_8 0xc0, 0xaf TLS1.2
TLS_ECDHE_PSK_3DES_EDE_CBC_SHA1 0xc0, 0x34 TLS1.0
TLS_ECDHE_PSK_AES_128_CBC_SHA1 0xc0, 0x35 TLS1.0
TLS_ECDHE_PSK_AES_256_CBC_SHA1 0xc0, 0x36 TLS1.0
TLS_ECDHE_PSK_AES_128_CBC_SHA256 0xc0, 0x37 TLS1.2
TLS_ECDHE_PSK_AES_256_CBC_SHA384 0xc0, 0x38 TLS1.2
TLS_ECDHE_PSK_ARCFOUR_128_SHA1 0xc0, 0x33 TLS1.0
TLS_ECDHE_PSK_NULL_SHA1 0xc0, 0x39 TLS1.0
TLS_ECDHE_PSK_NULL_SHA256 0xc0, 0x3a TLS1.2
TLS_ECDHE_PSK_NULL_SHA384 0xc0, 0x3b TLS1.0
TLS_ECDHE_PSK_CAMELLIA_128_CBC_SHA256 0xc0, 0x9a TLS1.2
TLS_ECDHE_PSK_CAMELLIA_256_CBC_SHA384 0xc0, 0x9b TLS1.2
TLS_PSK_ARCFOUR_128_SHA1 0x00, 0x8a TLS1.0
TLS_PSK_3DES_EDE_CBC_SHA1 0x00, 0x8b TLS1.0
TLS_PSK_AES_128_CBC_SHA1 0x00, 0x8c TLS1.0
TLS_PSK_AES_256_CBC_SHA1 0x00, 0x8d TLS1.0
TLS_PSK_AES_128_CBC_SHA256 0x00, 0xae TLS1.2
TLS_PSK_AES_256_GCM_SHA384 0x00, 0xa9 TLS1.2
TLS_PSK_CAMELLIA_128_GCM_SHA256 0xc0, 0x8e TLS1.2
TLS_PSK_CAMELLIA_256_GCM_SHA384 0xc0, 0x8f TLS1.2
TLS_PSK_AES_128_GCM_SHA256 0x00, 0xa8 TLS1.2
TLS_PSK_NULL_SHA1 0x00, 0x2c TLS1.0
TLS_PSK_NULL_SHA256 0x00, 0xb0 TLS1.2
TLS_PSK_CAMELLIA_128_CBC_SHA256 0xc0, 0x94 TLS1.2
TLS_PSK_CAMELLIA_256_CBC_SHA384 0xc0, 0x95 TLS1.2
TLS_PSK_AES_256_CBC_SHA384 0x00, 0xaf TLS1.2
TLS_PSK_NULL_SHA384 0x00, 0xb1 TLS1.2
TLS_RSA_PSK_ARCFOUR_128_SHA1 0x00, 0x92 TLS1.0
TLS_RSA_PSK_3DES_EDE_CBC_SHA1 0x00, 0x93 TLS1.0
TLS_RSA_PSK_AES_128_CBC_SHA1 0x00, 0x94 TLS1.0
TLS_RSA_PSK_AES_256_CBC_SHA1 0x00, 0x95 TLS1.0
TLS_RSA_PSK_CAMELLIA_128_GCM_SHA256 0xc0, 0x92 TLS1.2
TLS_RSA_PSK_CAMELLIA_256_GCM_SHA384 0xc0, 0x93 TLS1.2
TLS_RSA_PSK_AES_128_GCM_SHA256 0x00, 0xac TLS1.2
TLS_RSA_PSK_AES_128_CBC_SHA256 0x00, 0xb6 TLS1.2
TLS_RSA_PSK_NULL_SHA1 0x00, 0x2e TLS1.0
TLS_RSA_PSK_NULL_SHA256 0x00, 0xb8 TLS1.2
TLS_RSA_PSK_AES_256_GCM_SHA384 0x00, 0xad TLS1.2
TLS_RSA_PSK_AES_256_CBC_SHA384 0x00, 0xb7 TLS1.2
TLS_RSA_PSK_NULL_SHA384 0x00, 0xb9 TLS1.2
TLS_RSA_PSK_CAMELLIA_128_CBC_SHA256 0xc0, 0x98 TLS1.2
TLS_RSA_PSK_CAMELLIA_256_CBC_SHA384 0xc0, 0x99 TLS1.2
TLS_DHE_PSK_ARCFOUR_128_SHA1 0x00, 0x8e TLS1.0
TLS_DHE_PSK_3DES_EDE_CBC_SHA1 0x00, 0x8f TLS1.0
TLS_DHE_PSK_AES_128_CBC_SHA1 0x00, 0x90 TLS1.0
TLS_DHE_PSK_AES_256_CBC_SHA1 0x00, 0x91 TLS1.0
TLS_DHE_PSK_AES_128_CBC_SHA256 0x00, 0xb2 TLS1.2
TLS_DHE_PSK_AES_128_GCM_SHA256 0x00, 0xaa TLS1.2
TLS_DHE_PSK_NULL_SHA1 0x00, 0x2d TLS1.0
TLS_DHE_PSK_NULL_SHA256 0x00, 0xb4 TLS1.2
TLS_DHE_PSK_NULL_SHA384 0x00, 0xb5 TLS1.2
TLS_DHE_PSK_AES_256_CBC_SHA384 0x00, 0xb3 TLS1.2
TLS_DHE_PSK_AES_256_GCM_SHA384 0x00, 0xab TLS1.2
TLS_DHE_PSK_CAMELLIA_128_CBC_SHA256 0xc0, 0x96 TLS1.2
TLS_DHE_PSK_CAMELLIA_256_CBC_SHA384 0xc0, 0x97 TLS1.2
TLS_DHE_PSK_CAMELLIA_128_GCM_SHA256 0xc0, 0x90 TLS1.2
TLS_DHE_PSK_CAMELLIA_256_GCM_SHA384 0xc0, 0x91 TLS1.2
TLS_PSK_AES_128_CCM 0xc0, 0xa4 TLS1.2
TLS_PSK_AES_256_CCM 0xc0, 0xa5 TLS1.2
TLS_DHE_PSK_AES_128_CCM 0xc0, 0xa6 TLS1.2
TLS_DHE_PSK_AES_256_CCM 0xc0, 0xa7 TLS1.2
TLS_PSK_AES_128_CCM_8 0xc0, 0xa8 TLS1.2
TLS_PSK_AES_256_CCM_8 0xc0, 0xa9 TLS1.2
TLS_DHE_PSK_AES_128_CCM_8 0xc0, 0xaa TLS1.2
TLS_DHE_PSK_AES_256_CCM_8 0xc0, 0xab TLS1.2
TLS_DHE_PSK_CHACHA20_POLY1305 0xcc, 0xad TLS1.2
TLS_ECDHE_PSK_CHACHA20_POLY1305 0xcc, 0xac TLS1.2
TLS_RSA_PSK_CHACHA20_POLY1305 0xcc, 0xae TLS1.2
TLS_PSK_CHACHA20_POLY1305 0xcc, 0xab TLS1.2
TLS_DH_ANON_ARCFOUR_128_MD5 0x00, 0x18 TLS1.0
TLS_DH_ANON_3DES_EDE_CBC_SHA1 0x00, 0x1b TLS1.0
TLS_DH_ANON_AES_128_CBC_SHA1 0x00, 0x34 TLS1.0
TLS_DH_ANON_AES_256_CBC_SHA1 0x00, 0x3a TLS1.0
TLS_DH_ANON_CAMELLIA_128_CBC_SHA256 0x00, 0xbf TLS1.2
TLS_DH_ANON_CAMELLIA_256_CBC_SHA256 0x00, 0xc5 TLS1.2
TLS_DH_ANON_CAMELLIA_128_CBC_SHA1 0x00, 0x46 TLS1.0
TLS_DH_ANON_CAMELLIA_256_CBC_SHA1 0x00, 0x89 TLS1.0
TLS_DH_ANON_AES_128_CBC_SHA256 0x00, 0x6c TLS1.2
TLS_DH_ANON_AES_256_CBC_SHA256 0x00, 0x6d TLS1.2
TLS_DH_ANON_AES_128_GCM_SHA256 0x00, 0xa6 TLS1.2
TLS_DH_ANON_AES_256_GCM_SHA384 0x00, 0xa7 TLS1.2
TLS_DH_ANON_CAMELLIA_128_GCM_SHA256 0xc0, 0x84 TLS1.2
TLS_DH_ANON_CAMELLIA_256_GCM_SHA384 0xc0, 0x85 TLS1.2
TLS_ECDH_ANON_NULL_SHA1 0xc0, 0x15 TLS1.0
TLS_ECDH_ANON_3DES_EDE_CBC_SHA1 0xc0, 0x17 TLS1.0
TLS_ECDH_ANON_AES_128_CBC_SHA1 0xc0, 0x18 TLS1.0
TLS_ECDH_ANON_AES_256_CBC_SHA1 0xc0, 0x19 TLS1.0
TLS_ECDH_ANON_ARCFOUR_128_SHA1 0xc0, 0x16 TLS1.0
TLS_SRP_SHA_3DES_EDE_CBC_SHA1 0xc0, 0x1a TLS1.0
TLS_SRP_SHA_AES_128_CBC_SHA1 0xc0, 0x1d TLS1.0
TLS_SRP_SHA_AES_256_CBC_SHA1 0xc0, 0x20 TLS1.0
TLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1 0xc0, 0x1c TLS1.0
TLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1 0xc0, 0x1b TLS1.0
TLS_SRP_SHA_DSS_AES_128_CBC_SHA1 0xc0, 0x1f TLS1.0
TLS_SRP_SHA_RSA_AES_128_CBC_SHA1 0xc0, 0x1e TLS1.0
TLS_SRP_SHA_DSS_AES_256_CBC_SHA1 0xc0, 0x22 TLS1.0
TLS_SRP_SHA_RSA_AES_256_CBC_SHA1 0xc0, 0x21 TLS1.0
TLS_GOSTR341112_256_28147_CNT_IMIT 0xc1, 0x02 TLS1.2
Certificate types: CTYPE-X.509, CTYPE-Raw Public Key
Protocols: VERS-TLS1.0, VERS-TLS1.1, VERS-TLS1.2, VERS-TLS1.3, VERS-DTLS0.9, VERS-DTLS1.0, VERS-DTLS1.2
Ciphers: AES-256-CBC, AES-192-CBC, AES-128-CBC, AES-128-GCM, AES-192-GCM, AES-256-GCM, AES-128-CCM, AES-256-CCM, AES-128-CCM-8, AES-256-CCM-8, ARCFOUR-128, ESTREAM-SALSA20-256, SALSA20-256, CHACHA20-32, CHACHA20-64, CAMELLIA-256-CBC, CAMELLIA-192-CBC, CAMELLIA-128-CBC, CHACHA20-POLY1305, CAMELLIA-128-GCM, CAMELLIA-256-GCM, GOST28147-TC26Z-CFB, GOST28147-CPA-CFB, GOST28147-CPB-CFB, GOST28147-CPC-CFB, GOST28147-CPD-CFB, AES-128-CFB8, AES-192-CFB8, AES-256-CFB8, AES-128-XTS, AES-256-XTS, AES-128-SIV, AES-256-SIV, GOST28147-TC26Z-CNT, MAGMA-CTR-ACPKM, KUZNYECHIK-CTR-ACPKM, 3DES-CBC, DES-CBC, RC2-40, NULL
MACs: SHA1, SHA256, SHA384, SHA512, SHA224, UMAC-96, UMAC-128, AEAD, MD5, GOSTR341194, STREEBOG-256, STREEBOG-512, AES-CMAC-128, AES-CMAC-256, AES-GMAC-128, AES-GMAC-192, AES-GMAC-256, GOST28147-TC26Z-IMIT, OMAC-MAGMA, OMAC-KUZNYECHIK
Digests: SHA1, SHA256, SHA384, SHA512, SHA224, MD5, GOSTR341194, STREEBOG-256, STREEBOG-512
Key exchange algorithms: ECDHE-RSA, ECDHE-ECDSA, RSA, DHE-RSA, DHE-DSS, PSK, RSA-PSK, DHE-PSK, ECDHE-PSK, SRP-DSS, SRP-RSA, SRP, ANON-DH, ANON-ECDH, VKO-GOST-12, RSA-EXPORT
Compression: COMP-NULL
Groups: GROUP-SECP256R1, GROUP-SECP384R1, GROUP-SECP521R1, GROUP-X25519, GROUP-GC256B, GROUP-GC512A, GROUP-X448, GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, GROUP-FFDHE8192
Public Key Systems: RSA, RSA-PSS, RSA, DSA, GOST R 34.10-2012-512, GOST R 34.10-2012-256, GOST R 34.10-2001, EC/ECDSA, EdDSA (Ed25519), EdDSA (Ed448), DH, ECDH (X25519), ECDH (X448)
PK-signatures: SIGN-RSA-SHA256, SIGN-RSA-SHA384, SIGN-RSA-SHA512, SIGN-RSA-PSS-SHA256, SIGN-RSA-PSS-RSAE-SHA256, SIGN-RSA-PSS-SHA384, SIGN-RSA-PSS-RSAE-SHA384, SIGN-RSA-PSS-SHA512, SIGN-RSA-PSS-RSAE-SHA512, SIGN-EdDSA-Ed25519, SIGN-EdDSA-Ed448, SIGN-ECDSA-SHA256, SIGN-ECDSA-SHA384, SIGN-ECDSA-SHA512, SIGN-ECDSA-SECP256R1-SHA256, SIGN-ECDSA-SECP384R1-SHA384, SIGN-ECDSA-SECP521R1-SHA512, SIGN-ECDSA-SHA3-224, SIGN-ECDSA-SHA3-256, SIGN-ECDSA-SHA3-384, SIGN-ECDSA-SHA3-512, SIGN-RSA-SHA3-224, SIGN-RSA-SHA3-256, SIGN-RSA-SHA3-384, SIGN-RSA-SHA3-512, SIGN-DSA-SHA3-224, SIGN-DSA-SHA3-256, SIGN-DSA-SHA3-384, SIGN-DSA-SHA3-512, SIGN-RSA-RAW, SIGN-RSA-SHA1, SIGN-RSA-SHA1, SIGN-RSA-SHA224, SIGN-RSA-RMD160, SIGN-DSA-SHA1, SIGN-DSA-SHA1, SIGN-DSA-SHA224, SIGN-DSA-SHA256, SIGN-RSA-MD5, SIGN-RSA-MD5, SIGN-RSA-MD2, SIGN-ECDSA-SHA1, SIGN-ECDSA-SHA224, SIGN-GOSTR341012-512, SIGN-GOSTR341012-256, SIGN-GOSTR341001, SIGN-DSA-SHA384, SIGN-DSA-SHA512
Alright, there's a difference:
$ git diff --word-diff fedora35.log debian11.log
diff --git a/fedora35.log b/debian11.log
index a6241c5..393c4aa 100644
--- a/fedora35.log
+++ b/debian11.log
@@ -195,6 +195,6 @@ MACs: SHA1, SHA256, SHA384, SHA512, SHA224, UMAC-96, UMAC-128, AEAD, MD5, GOSTR3
Digests: SHA1, SHA256, SHA384, SHA512, SHA224, MD5, GOSTR341194, STREEBOG-256, STREEBOG-512
Key exchange algorithms: ECDHE-RSA, ECDHE-ECDSA, RSA, DHE-RSA, DHE-DSS, PSK, RSA-PSK, DHE-PSK, ECDHE-PSK, SRP-DSS, SRP-RSA, SRP, ANON-DH, ANON-ECDH, VKO-GOST-12, RSA-EXPORT
Compression: COMP-NULL
Groups: {+GROUP-SECP192R1, GROUP-SECP224R1,+} GROUP-SECP256R1, GROUP-SECP384R1, GROUP-SECP521R1, GROUP-X25519, GROUP-GC256B, GROUP-GC512A, GROUP-X448, GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, GROUP-FFDHE8192
Public Key Systems: RSA, RSA-PSS, RSA, DSA, GOST R 34.10-2012-512, GOST R 34.10-2012-256, GOST R 34.10-2001, EC/ECDSA, EdDSA (Ed25519), EdDSA (Ed448), DH, ECDH (X25519), ECDH (X448)
PK-signatures: SIGN-RSA-SHA256, SIGN-RSA-SHA384, SIGN-RSA-SHA512, SIGN-RSA-PSS-SHA256, SIGN-RSA-PSS-RSAE-SHA256, SIGN-RSA-PSS-SHA384, SIGN-RSA-PSS-RSAE-SHA384, SIGN-RSA-PSS-SHA512, SIGN-RSA-PSS-RSAE-SHA512, SIGN-EdDSA-Ed25519, SIGN-EdDSA-Ed448, SIGN-ECDSA-SHA256, SIGN-ECDSA-SHA384, SIGN-ECDSA-SHA512, SIGN-ECDSA-SECP256R1-SHA256, SIGN-ECDSA-SECP384R1-SHA384, SIGN-ECDSA-SECP521R1-SHA512, SIGN-ECDSA-SHA3-224, SIGN-ECDSA-SHA3-256, SIGN-ECDSA-SHA3-384, SIGN-ECDSA-SHA3-512, SIGN-RSA-SHA3-224, SIGN-RSA-SHA3-256, SIGN-RSA-SHA3-384, SIGN-RSA-SHA3-512, SIGN-DSA-SHA3-224, SIGN-DSA-SHA3-256, SIGN-DSA-SHA3-384, SIGN-DSA-SHA3-512, SIGN-RSA-RAW, SIGN-RSA-SHA1, SIGN-RSA-SHA1, SIGN-RSA-SHA224, SIGN-RSA-RMD160, SIGN-DSA-SHA1, SIGN-DSA-SHA1, SIGN-DSA-SHA224, SIGN-DSA-SHA256, SIGN-RSA-MD5, SIGN-RSA-MD5, SIGN-RSA-MD2, SIGN-ECDSA-SHA1, SIGN-ECDSA-SHA224, SIGN-GOSTR341012-512, SIGN-GOSTR341012-256, SIGN-GOSTR341001, SIGN-DSA-SHA384, SIGN-DSA-SHA512
Debian has GROUP-SECP192R1, GROUP-SECP224R1 while Fedora has not...
I'm running into the same issue on Archlinux Here's the diff with the fedora and it seems like arch has the same result as debian.
diff --git a/fedora.log b/arch.log
index a6241c5..393c4aa 100644
--- a/fedora.log
+++ b/arch.log
@@ -195,6 +195,6 @@ MACs: SHA1, SHA256, SHA384, SHA512, SHA224, UMAC-96, UMAC-128, AEAD, MD5, GOSTR3
Digests: SHA1, SHA256, SHA384, SHA512, SHA224, MD5, GOSTR341194, STREEBOG-256, STREEBOG-512
Key exchange algorithms: ECDHE-RSA, ECDHE-ECDSA, RSA, DHE-RSA, DHE-DSS, PSK, RSA-PSK, DHE-PSK, ECDHE-PSK, SRP-DSS, SRP-RSA, SRP, ANON-DH, ANON-ECDH, VKO-GOST-12, RSA-EXPORT
Compression: COMP-NULL
Groups: {+GROUP-SECP192R1, GROUP-SECP224R1,+} GROUP-SECP256R1, GROUP-SECP384R1, GROUP-SECP521R1, GROUP-X25519, GROUP-GC256B, GROUP-GC512A, GROUP-X448, GROUP-FFDHE2048, GROUP-FFDHE3072, GROUP-FFDHE4096, GROUP-FFDHE6144, GROUP-FFDHE8192
Public Key Systems: RSA, RSA-PSS, RSA, DSA, GOST R 34.10-2012-512, GOST R 34.10-2012-256, GOST R 34.10-2001, EC/ECDSA, EdDSA (Ed25519), EdDSA (Ed448), DH, ECDH (X25519), ECDH (X448)
PK-signatures: SIGN-RSA-SHA256, SIGN-RSA-SHA384, SIGN-RSA-SHA512, SIGN-RSA-PSS-SHA256, SIGN-RSA-PSS-RSAE-SHA256, SIGN-RSA-PSS-SHA384, SIGN-RSA-PSS-RSAE-SHA384, SIGN-RSA-PSS-SHA512, SIGN-RSA-PSS-RSAE-SHA512, SIGN-EdDSA-Ed25519, SIGN-EdDSA-Ed448, SIGN-ECDSA-SHA256, SIGN-ECDSA-SHA384, SIGN-ECDSA-SHA512, SIGN-ECDSA-SECP256R1-SHA256, SIGN-ECDSA-SECP384R1-SHA384, SIGN-ECDSA-SECP521R1-SHA512, SIGN-ECDSA-SHA3-224, SIGN-ECDSA-SHA3-256, SIGN-ECDSA-SHA3-384, SIGN-ECDSA-SHA3-512, SIGN-RSA-SHA3-224, SIGN-RSA-SHA3-256, SIGN-RSA-SHA3-384, SIGN-RSA-SHA3-512, SIGN-DSA-SHA3-224, SIGN-DSA-SHA3-256, SIGN-DSA-SHA3-384, SIGN-DSA-SHA3-512, SIGN-RSA-RAW, SIGN-RSA-SHA1, SIGN-RSA-SHA1, SIGN-RSA-SHA224, SIGN-RSA-RMD160, SIGN-DSA-SHA1, SIGN-DSA-SHA1, SIGN-DSA-SHA224, SIGN-DSA-SHA256, SIGN-RSA-MD5, SIGN-RSA-MD5, SIGN-RSA-MD2, SIGN-ECDSA-SHA1, SIGN-ECDSA-SHA224, SIGN-GOSTR341012-512, SIGN-GOSTR341012-256, SIGN-GOSTR341001, SIGN-DSA-SHA384, SIGN-DSA-SHA512
My tigervnc logs when connection fails.
Tue Jan 11 15:11:33 2022
Connections: accepted: 192.168.1.112::42102
SConnection: Client needs protocol version 3.8
SConnection: Client requests security type VeNCrypt(19) SVeNCrypt: Client requests security type TLSVnc (258)
TLS: TLS Handshake failed: No supported cipher suites have been found.
SConnection: AuthFailureException: Authentication failure: TLS Handshake
failed
VNCSConnST: closing 192.168.1.112::42102: Clean disconnection
EncodeManager: Framebuffer updates: 0
EncodeManager: Total: 0 rects, 0 pixels
EncodeManager: 0 B (1:-nan ratio)
Connections: closed: 192.168.1.112::42102
ComparingUpdateTracker: 0 pixels in / 0 pixels out
ComparingUpdateTracker: (1:-nan ratio)
I can reproduce this with a Fedora 35 VM. If I include AECDH
(i.e. ADH:AECDH
) in LibVNCClient's cipher list, I can connect successfully using MultiVNC.
@basilrabi , @uttarayan21 can you please test this APK: app-debug.zip
@bk138 I am guessing that our ADH setup has lower key strength, because GnuTLS accepts the same cipher (GNUTLS_DH_ANON_AES_256_GCM_SHA384
) when offered by wolfSSL (used in AVNC). Using AECDH
simply enables Elliptic Curve ciphers like GNUTLS_ECDH_ANON_AES_256_CBC_SHA1
, and doesn't fix other ADH ciphers. So we should look more into this.
I tested the apk and it does work with my setup.
Coincidentally I tried using avnc in the meantime which works fine but I need to send the super key as modifier so I can't use it since it doesn't have that functionality.
Thank you @gujjwal00 , the APK works for me.
@uttarayan21 yeah, virtual Super key is currently missing.
@gujjwal00 thanks for doing the research, again! So we simply patch libvncclient? I have to admit I'm not too proficient with this cipher stuff...
Well, I am no expert either 😄.
And, adding AECDH
in libvncclient would solve this issue. Its a net-positive anyway, because EC cipher suits seems to be better comparatively. According to OpenSSL docs, we can simply use aNULL
in place of ADH
for the cipher list, it is similar to using ADH:AECDH
explicitly. Connection is successful with aNULL
too.
I will see if I can identify the issue with regular DH cipher suits, but GnuTLS is giving zero indication about what's wrong.
Thanks @gujjwal00! This will be in the next point release.
Is your bug report about the Desktop Multivnc or the Mobile MultiVNC?
Which MultiVNC version are you using? 2.0.1 (F-Droid) 2.0.3 (Google Playstore)
Describe the bug I am unable to connect to fedora 35 with tigervnc. It only returns "VNC connection failed!"
Log: MultiVNC
This is the log while connecting via MultiVNC
Log: VNC Viewer
This is the log when connecting via VNC Viewer in android
Config
To Reproduce
Expected Behavior Able to connect without error
For the Mobile Version (please complete the following information):