Docker pull error with Surface Dock "bad record MAC"

[ryankmcintyre]

• Your Windows build number:
  19018.1

• What you're doing and what's happening:
  WSL2 Ubuntu on a Surface Book connected to a Surface Dock with hardwired network connection through the dock (Surface Ethernet Adapter). When I run docker pull ubuntu, the result is local error: tls: bad record MAC and image isn't downloaded.

Unplugging network cable from the Surface Dock and using wireless, docker pull works fine. Using a different network adapter through USB and going through that wired connection, docker pull works fine. Error only results when using the network connection in the Surface Dock.

Similar to this and this issue, but now with a wired connection instead of wireless. I checked if there is a firmware update for the Dock and it's already on the latest (1.42.139) according to this doc.

Comparing network connection properties between the two ethernet connections, I don't see a difference.

• What's wrong / what should be happening instead:
  Image should be downloaded without MAC error

• Strace of the failing command, if applicable:
  Results from strace -o dockerpull.strace -f docker pull ubuntu when connected through Surface Dock: https://gist.github.com/ryankmcintyre/bd5d9ce2d323b42a6cd5f68588e8f8eb

• For WSL launch issues, please collect detailed logs.
  N/A

[ryankmcintyre]

@therealkenc What else can I provide beyond the initial description to help with repro?

[therealkenc]

A set of CLI steps that identifies the source of the "local error: tls: bad record MAC" error. It wouldn't be a trivial undertaking. Think openssl(1) experiments with -debug traces and possiblly wireshark. None of which is expected; just probably what it would take to track down.

The strace log you linked is always super appreciated. Will drop the need-repro tag (plenty else open with less). Maybe someone with a Surface Dock who can reproduce the problem locally with dive it.

[ryankmcintyre]

If anyone picks this up, I'd be happy to open up a remote session for some debugging/tracing with them. Or run some additional tools locally. I realize this is an edge case and not many folks have the same hardware setup I do.

[james-d-elliott]

Other reports suggest it was a driver/NIC issue. #4306

[therealkenc]

Other reports suggest it was a driver/NIC issue. #4306

Thanks! Given the symptoms that seems very plausible. Calling this a dupe for lack. [The alternative being this one remaining open and chirping crickets indefinitely.]

[ryankmcintyre]

@therealkenc If you check the original issue text you'll see I referred to 4306 and already eliminated that as the cause due to drivers being up to date. This issue isn't a dup of 4306. Up to you to keep it open with the hopes someone picks it up or close it since it doesn't seem anyone else is interested in fixing it.

[therealkenc]

It isn't that no one wants to fix it. There's no repro; or, at least, no flood of Surface Book users (of which, let's assume there are a few at MSFT) rushing to thumbs up the OP. The error strongly suggests (but does not prove) an unidentified external factor vs. something plausibly actionable within WSL.

This issue isn't a dup of 4306

That's fair. Your poison on open/closed status.

[james-d-elliott]

Also my intent was to help solve it, someone else had this issue and I discovered both of these issues via searching, so rather than ignoring the possible relation I wanted to mention it. I just didn't see the previous links due to how they were linked, small oversight on my part.

[stmax82]

I don't think this is a Surface Dock problem.. I'm struggling with this error since months and have to retry docker pulls and apt-get installs several times until everything goes through. Only on this one PC.. it's got some ASRock Z170 Extreme4 board and a "AVM FRITZ!WLAN Stick AC 860" Wifi adapter, all with latest drivers.

I'm not sure if it's a driver / NIC problem - I can curl debian isos day and night without a single error on Windows/PowerShell and in WSL2/Ubuntu/bash - but I get "bad record mac" errors when I try to curl the same debian iso in a docker container or when I try to docker pull something.

[stmax82]

I'm not sure if it's a driver / NIC problem - I can curl debian isos day and night without a single error on Windows/PowerShell and in WSL2/Ubuntu/bash - but I get "bad record mac" errors when I try to curl the same debian iso in a docker container or when I try to docker pull something.

Well let me update my opinion.. I now think it is a driver / NIC problem - I replaced my "Fritz!WLAN Stick AC860" with a new "TP-Link Archer T3U AC1300" wifi usb dongle and the TLS errors are gone. Nice.

I'm not sure how a faulty driver can cause that error though.. if there's data corruption somewhere in the network stack, shouldn't TCP handle that and request retransmission of faulty packets? Also not sure why errors only occurred within docker contains but never outside (see examples above).. oh well.. at least it works now.

[philicevic]

Also got the "Fritz!WLAN Stick AC860" - and got the same problems as @stmax82. But for me docker pulls do not work at all. I don't really know a lot about network stuff, but i would rather not replace the stick. Maybe anyone has an idea to overcome this?

[RedaDZ]

had the same problem, switched from 2.4Ghz to 5.0Ghz and it works. don't know if is due to that

[frank-buddy]

had the same problem, switched from 2.4Ghz to 5.0Ghz and it works. don't know if is due to that

also worked for me!

[SysCoder]

I was connected to a hard wired connection. After I went to WIFI, it worked.

I am using podman and Mac OS 13.2

WAT!?!?! weird issue.

[microsoft-github-policy-service]

This issue has been automatically closed since it has not had any activity for the past year. If you're still experiencing this issue please re-file this as a new issue or feature request.

Thank you!