<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p class="details" style="font-style: italic; color: #666;">
<a href="https://gitlab.com/wwang37">Weiqi Wang</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1230">#1230</a>
</p>
<div></div>
<h2 dir="auto">
<a id="user-content-description" class="anchor" href="#description" aria-hidden="true"></a>Description:</h2>
<p dir="auto">The client sends a message with type alert (\x15) and invalid version number (\x83\x01) GnuTLS responds with protocol_version alert. At terminal, GnuTLS server prints <code>Error in handshake: A packet with illegal or unsupported version was received</code>, thus I think the illegal and unsupported version are handled in the same way. However this doesn't seem to conform to RFC 5246.</p>
<p dir="auto">As per RFC 5246, the protocol version is defined as "recognized but not supported". Since the version used by client is \x83\x01, I think it should be interpreted as "not recognized".</p>
<p dir="auto">RFC 5246 also states that server MUST accept any value {03,XX} as record layer version. Combining the two requirements together, I think the logic should be</p>
<pre class="code highlight js-syntax-highlight language-plaintext" lang="plaintext" v-pre="true"><code><span id="LC1" class="line" lang="plaintext">If the record version is {03,XX} {</span>
<span id="LC2" class="line" lang="plaintext"> server accepts it</span>
<span id="LC3" class="line" lang="plaintext"> If the actual version is not supported {</span>
<span id="LC4" class="line" lang="plaintext"> send protocol_version alert</span>
<span id="LC5" class="line" lang="plaintext"> }</span>
<span id="LC6" class="line" lang="plaintext">}</span>
<span id="LC7" class="line" lang="plaintext">Else (the major version is not 03) {</span>
<span id="LC8" class="line" lang="plaintext"> the server shouldn't complain. //Because the version is not recognized, which means it's not the case of protocol_version alert.</span>
<span id="LC9" class="line" lang="plaintext">}</span></code></pre>
<blockquote dir="auto">
<p>protocol_version</p>
<p>The protocol version the client has attempted to negotiate is
recognized but not supported. (For example, old protocol versions
might be avoided for security reasons.)</p>
</blockquote>
<blockquote dir="auto">
<p>Earlier versions of the TLS specification were not fully clear on
what the record layer version number (TLSPlaintext.version) should
contain when sending ClientHello (i.e., before it is known which
version of the protocol will be employed). Thus, TLS servers
compliant with this specification MUST accept any value {03,XX} as
the record layer version number for ClientHello.</p>
</blockquote>
<h2 dir="auto">
<a id="user-content-version-of-gnutls-used" class="anchor" href="#version-of-gnutls-used" aria-hidden="true"></a>Version of gnutls used:</h2>
<p dir="auto">GnuTLS 3.7.0 commit <a href="https://gitlab.com/gnutls/gnutls/-/commit/7e44152fd4076afb0b64ed311fd092669e71fa1e" data-original="7e44152fd4076afb0b64ed311fd092669e71fa1e" data-link="false" data-link-reference="false" data-project="179611" data-commit="7e44152fd4076afb0b64ed311fd092669e71fa1e" data-reference-type="commit" data-container="body" data-placement="top" title="Merge branch 'wip/dueno/typo-fixes' into 'master'" class="gfm gfm-commit has-tooltip">7e44152f</a></p>
<h2 dir="auto">
<a id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" class="anchor" href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto">Ubuntu 18.04</p>
<h2 dir="auto">
<a id="user-content-how-reproducible" class="anchor" href="#how-reproducible" aria-hidden="true"></a>How reproducible:</h2>
<p dir="auto">Steps to Reproduce:</p>
<p dir="auto"><code>gnutls-serv --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-COMP-ALL:+COMP-NONE --x509keyfile /path/to/key.pem --x509certfile /path/to/cert.pem -p 44331 --noticket -a --http</code></p>
<p dir="auto"><code>echo -n -e "\x15\x83\x01\x00\x02\x02\x50" | nc 127.0.0.1 44331</code></p>
<h2 dir="auto">
<a id="user-content-actual-results" class="anchor" href="#actual-results" aria-hidden="true"></a>Actual results:</h2>
<p dir="auto">GnuTLS sends protocol_version alert. The capture file is attached.</p>
<h2 dir="auto">
<a id="user-content-expected-results" class="anchor" href="#expected-results" aria-hidden="true"></a>Expected results:</h2>
<p dir="auto">Not send protocol_version alert. Besides, in this specific case, I'm not sure whether unexpected_message should be sent since the server is expecting client hello but got an alert.</p>
<h2 dir="auto">
<a id="user-content-attachments" class="anchor" href="#attachments" aria-hidden="true"></a>Attachments:</h2>
<p dir="auto"><a href="https://gitlab.com/gnutls/gnutls/uploads/a58572b74253a93995591280e3b72a75/gnutls_capture.pcap" data-link="true" class="gfm">gnutls_capture.pcap</a></p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1230">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/22136df684f08be9e0862160053b7982/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1230"}}</script>
</p>
</div>
</body>
</html>