Setting valid TLS 1.3 cipher suites on a TLS 1.3-only server leads to a handshake exception
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 326
- Avg merge
- 16h 22m
- Merged PRs (30d)
- 17
Description
After attempting to set only supported TLS 1.3 cipher suites on a TLS 1.3-only server, handshakes fail, and the server reports an OpenSSL error saying "NO_CERTIFICATE_SET".
It seems to behave like this even if 2 or all 3 supported cipher suites are what's being set. Although the documentation says
> The TLS 1.3 cipher suites cannot be customized; they are always enabled when TLS 1.3 is enabled,
it goes on to say
> and any attempt to disable them via a call to setEnabledCipherSuites() is ignored.
so I would expect it to function as if it had never been called. When acting as a TLS client it did not seem to have the issue.
As far as I can tell, one guess is it's because Conscrypt is calling `NativeCrypto_SSL_set_cipher_lists` with an empty array. `SSLParametersImpl` does not store TLS 1.3 suites in `enabledCipherSuites`, and during `NativeSSL::initialize` it calls `NativeCrypto::setEnabledCipherSuites` using the field directly, which in turn passes the empty array to `SSL_set_cipher_lists`. At this point it's less clear, but native_crypto.cc's `NativeCrypto_SSL_set_cipher_lists` has a special check for `length == 0`.
Our workaround is to try not to change the suites, meaning internally `enabledCipherSuites` gets passed down containing some pre-TLS 1.3 suites.
Stack traces and exceptions:
```
javax.net.ssl.SSLHandshakeException: Read error: ssl=0xaa752b90: Failure in SSL library, usually a protocol error error:100000ae:SSL routines:OPENSSL_internal:NO_CERTIFICATE_SET (/home/user/boringssl/boringssl/ssl/tls13_server.cc:831 0xab2b4104:0x00000000)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:361)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1138)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:923)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:751)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:716)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.Java8EngineWrapper.unwrap(Java8EngineWrapper.java:236)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.SSLSocketChannel2.unwrap(SSLSocketChannel2.java:203)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.SSLSocketChannel2.processHandshake(SSLSocketChannel2.java:163)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.SSLSocketChannel2.(SSLSocketChannel2.java:114)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.server.SSLParametersWebSocketServerFactory.wrapChannel(SSLParametersWebSocketServerFactory.java:77)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.server.WebSocketServer.doAccept(WebSocketServer.java:428)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.server.WebSocketServer.run(WebSocketServer.java:343)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLProtocolException: Read error: ssl=0xaa752b90: Failure in SSL library, usually a protocol error error:100000ae:SSL routines:OPENSSL_internal:NO_CERTIFICATE_SET (/home/user/boringssl/boringssl/ssl/tls13_server.cc:831 0xab2b4104:0x00000000)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:567)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1099)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.readPlaintextDataHeap(ConscryptEngine.java:1119)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1091)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:880)
... 10 common frames omitted
```
java -version:
```
openjdk version "11.0.4" 2019-07-16
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.4+11)
OpenJDK Client VM AdoptOpenJDK (build 11.0.4+11, mixed mode)
```
uname -a:
```
Linux DEVHR1030049Q 4.9.59-company #1 PREEMPT Tue Oct 27 17:25:28 EDT 2020 armv7l armv7l armv7l GNU/Linux
```
We built our Conscrypt for ARM-32 OpenJDK, but at least one other person has seen this, on Android: https://stackoverflow.com/q/67401363/4163891
Mostly, the issue just made it a little less-straightforward to swap out our provider for Conscrypt. The error message was particularly confusing, so if this isn't a high priority, hopefully posting here helps others find it.
Thanks
Contributor guide
Assessment
This issue has not been assessed yet.