Subject: [TLS] ClientHello and record layer version interop

From: [email-masked] (Martin Rex)
Date: Sat, 24 Jan 2015 08:49:07 +0100 (CET)

I'm seeing an increase in customer messages about newly
appearing TLS interop problems.  There seem to be TLSv1.0 servers
who threw out the baby with the bathtub and started rejecting
ClientHellos with client_version = (3,1) that come in SSLv3 records.

One of the servers identifies itself as "Sun-ONE-Web-Server/6.1"
and exhibits the following crazy behaviour:

   SSLv2-record with SSLv2 CLIENT-HELLO offering TLSv1.0:  TLSv1.0 ServerHello
*> SSLv3-record   with ClientHello offering TLSv1.0 ==>  Handshake failure
   TLSv1.0-record with ClientHello offering TLSv1.0 ==>  TLSv1.0 ServerHello
   TLSv1.2-record with ClientHello offering TLSv1.2 ==>  TLSv1.0 ServerHello

How widespread is that disease?  Does anyone know which kind of
servers/software exhibit this flaw and how many of them exist?

Server configuration changes (disabling SSLv3) in "response" to Poodle
seem to get applied slowly to production servers. 

-Martin

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Sat, 24 Jan 2015 03:25:17 -0500 (EST)

----- Original Message -----
> ClientHellos with client_version = (3,1) that come in SSLv3 records.
[...]
> servers/software exhibit this flaw and how many of them exist?

I got reported the same behavior for few servers as well.

The worst case server had:
    SSLv3-record   with ClientHello offering TLSv1.0 ==>  Handshake failure
    TLSv1.0-record with ClientHello offering TLSv1.0 ==>  TLSv1.0 ServerHello
    TLSv1.2-record with ClientHello offering TLSv1.2 ==>  Handshake failure

I eventually switched gnutls to send TLS 3.1 in the client hello record's version.
http://lists.gnutls.org/pipermail/gnutls-devel/2015-January/007403.html
http://lists.gnutls.org/pipermail/gnutls-help/2014-November/003673.html

regards,
Nikos