google / google/conscrypt

Setting valid TLS 1.3 cipher suites on a TLS 1.3-only server leads to a handshake exception

Open
#1,012 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

After attempting to set only supported TLS 1.3 cipher suites on a TLS 1.3-only server, handshakes fail, and the server reports an OpenSSL error saying "NO_CERTIFICATE_SET".
It seems to behave like this even if 2 or all 3 supported cipher suites are what's being set. Although the documentation says

> The TLS 1.3 cipher suites cannot be customized; they are always enabled when TLS 1.3 is enabled,

it goes on to say

> and any attempt to disable them via a call to setEnabledCipherSuites() is ignored.

so I would expect it to function as if it had never been called. When acting as a TLS client it did not seem to have the issue.

As far as I can tell, one guess is it's because Conscrypt is calling `NativeCrypto_SSL_set_cipher_lists` with an empty array. `SSLParametersImpl` does not store TLS 1.3 suites in `enabledCipherSuites`, and during `NativeSSL::initialize` it calls `NativeCrypto::setEnabledCipherSuites` using the field directly, which in turn passes the empty array to `SSL_set_cipher_lists`. At this point it's less clear, but native_crypto.cc's `NativeCrypto_SSL_set_cipher_lists` has a special check for `length == 0`.

Our workaround is to try not to change the suites, meaning internally `enabledCipherSuites` gets passed down containing some pre-TLS 1.3 suites.

Stack traces and exceptions:
```
javax.net.ssl.SSLHandshakeException: Read error: ssl=0xaa752b90: Failure in SSL library, usually a protocol error error:100000ae:SSL routines:OPENSSL_internal:NO_CERTIFICATE_SET (/home/user/boringssl/boringssl/ssl/tls13_server.cc:831 0xab2b4104:0x00000000)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.SSLUtils.toSSLHandshakeException(SSLUtils.java:361)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.convertException(ConscryptEngine.java:1138)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:923)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:751)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:716)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.Java8EngineWrapper.unwrap(Java8EngineWrapper.java:236)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.SSLSocketChannel2.unwrap(SSLSocketChannel2.java:203)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.SSLSocketChannel2.processHandshake(SSLSocketChannel2.java:163)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.SSLSocketChannel2.(SSLSocketChannel2.java:114)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.server.SSLParametersWebSocketServerFactory.wrapChannel(SSLParametersWebSocketServerFactory.java:77)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.server.WebSocketServer.doAccept(WebSocketServer.java:428)
at Java.WebSocket@1.4.1-20200120/org.java_websocket.server.WebSocketServer.run(WebSocketServer.java:343)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLProtocolException: Read error: ssl=0xaa752b90: Failure in SSL library, usually a protocol error error:100000ae:SSL routines:OPENSSL_internal:NO_CERTIFICATE_SET (/home/user/boringssl/boringssl/ssl/tls13_server.cc:831 0xab2b4104:0x00000000)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:567)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1099)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.readPlaintextDataHeap(ConscryptEngine.java:1119)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1091)
at org.conscrypt@2.5.2-linux-arm/org.conscrypt.ConscryptEngine.unwrap(ConscryptEngine.java:880)
... 10 common frames omitted
```

java -version:
```
openjdk version "11.0.4" 2019-07-16
OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.4+11)
OpenJDK Client VM AdoptOpenJDK (build 11.0.4+11, mixed mode)
```
uname -a:
```
Linux DEVHR1030049Q 4.9.59-company #1 PREEMPT Tue Oct 27 17:25:28 EDT 2020 armv7l armv7l armv7l GNU/Linux
```
We built our Conscrypt for ARM-32 OpenJDK, but at least one other person has seen this, on Android: https://stackoverflow.com/q/67401363/4163891

Mostly, the issue just made it a little less-straightforward to swap out our provider for Conscrypt. The error message was particularly confusing, so if this isn't a high priority, hopefully posting here helps others find it.

Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.