0

I'm downloading a small sample tar file using curl and outputting verbose log to see the details:

curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /dev/null

And this is the tail of the output once download is finished:

...
...
< X-Content-Type-Options: nosniff
< Connection: close
< Content-Type: application/x-gzip
< 
{ [5 bytes data]
100  274k  100  274k    0     0   453k      0 --:--:-- --:--:-- --:--:--  457k
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, Client hello (1):
} [2 bytes data]

What is the meaning of TLSv1.2 (OUT), TLS alert, Client hello (1) after the connection is closed, is it trying to reconnect?

Is it being sent by the server, or by the client? If by the client then is it being sent by openssl or curl?

I have seen some curl outputs which don't have the string and Closing connection 0 is the last output, what does that mean?

0

Although it's related to HTTPS = TLS, I'm not sure this is really a security question. OTOH I don't know how to migrate and am not sure where would be better.

What is the meaning of TLSv1.2 (OUT), TLS alert, Client hello (1) after the connection is closed, is it trying to reconnect?

It's not after closing, it is part of closing, i.e. it is after initiating close. Specifically, the TLS client stack sends an alert record with level=1 (warning) in the first byte and description=0 (close_notify) in the second byte; this is a normal part of a client-initiated TLS close. The callback curl uses to log protocol actions (when requested with -v) lamely decodes all records as handshake records (even though here it correctly identifies the record as an alert record) so it misdecodes the first byte as a handshake message type (1=Client Hello).

Is it being sent by the server, or by the client? If by the client then is it being sent by openssl or curl?

It is sent by the client (curl is the client and OUT is sending). It is sent by the TLS stack used by curl, which isn't always OpenSSL, although it may be here. Unless you know for sure e.g. because you built it yourself, you can check with curl -V (uppercase vee) which stack your build of curl uses.

I have seen some curl outputs which don't have the string and Closing connection 0 is the last output, what does that mean?

curl should always log 'Closing connection' if you have specified -v (and not otherwise). It may not log the 'OUT ... alert ... 1' if either it is using a stack without the callback (which AFAIK could be anything other than OpenSSL) OR the server has closed quickly enough (like, immediately) after the end of data so that the client stack doesn't need to and can't notify the server -- or even before the end of data, but that should give an error indicating the data is incomplete. And of course even when curl does issue these outputs, it writes to stderr which in most environments can be redirected or discarded.

  • Thanks for the detailed explanation. – Josh Aug 29 '19 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.