<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p class="details" style="font-style: italic; color: #777;">
<a href="https://gitlab.com/richardfm">Richard Frith-Macdonald</a> created an issue:
</p>
<div></div>
<h2 dir="auto">
<a id="user-content-description-of-problem" class="anchor" href="#description-of-problem" aria-hidden="true"></a>Description of problem:</h2>
<p dir="auto">If a client attempts to connect to a server with 1.2 and 1.3 in the priority string, it fails with the error 'Detected downgrade to TLS 1.2 from TLS 1.3'</p>
<p dir="auto">I think this is because the priority string specifies 1.2 before 1.3, so while the client advertises itself as supporting both versions, the server picks the first one and responds using 1.2, which the client then thinks is an illegal downgrade.</p>
<p dir="auto">It's possible to work-around this by changing the client priority string to have 1.3 first (ie as the preferred version), but that means that the connection will be established using the oldest version that client and server support, ot the newest/best, which seems undesirable.</p>
<p dir="auto">If this is the case, there may be various ways to address the issue:
a. the server could ignore offers of older versions and select the highest one the client says it supports
b. the client could always offer higher versions before lower versions
c. the client could recognise that, if it offered 1.2 to the server, then a response of 1.2 is not a downgrade</p>
<h2 dir="auto">
<a id="user-content-version-of-gnutls-used" class="anchor" href="#version-of-gnutls-used" aria-hidden="true"></a>Version of gnutls used:</h2>
<p dir="auto">3.6.7</p>
<h2 dir="auto">
<a id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" class="anchor" href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto">Built from source</p>
<h2 dir="auto">
<a id="user-content-how-reproducible" class="anchor" href="#how-reproducible" aria-hidden="true"></a>How reproducible:</h2>
<p dir="auto">Steps to Reproduce:</p>
<p dir="auto">set gnutls-serv using --priority="NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2"
connect to it with gnutls-cli using --priority="NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2"</p>
<h2 dir="auto">
<a id="user-content-actual-results" class="anchor" href="#actual-results" aria-hidden="true"></a>Actual results:</h2>
<p dir="auto">|<1>| Detected downgrade to TLS 1.2 from TLS 1.3
*** Fatal error: An illegal parameter has been received.</p>
<h2 dir="auto">
<a id="user-content-expected-results" class="anchor" href="#expected-results" aria-hidden="true"></a>Expected results:</h2>
<p dir="auto">Connection established.</p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/837">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/6889d3201e2653f7a23c8d9f484eb308/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/837"}}</script>
</p>
</div>
</body>
</html>