Re: [TLS] Renego Indication RI patch interaction with TLS major version interop

["Yngve N. Pettersen (Developer Opera Software ASA)" <[e-mail]>]

On Tue, 15 Jun 2010 23:31:58 +0200, Adam Langley <[e-mail]> wrote:

> On Tue, Jun 15, 2010 at 5:16 PM, Simon Josefsson <[e-mail]>  
> wrote:
>> jas@mocca:~$ gnutls-cli -p 443 www.paypal.com
>> Resolving 'www.paypal.com'...
>> Connecting to '64.4.241.49:443'...
>> *** Fatal error: A TLS packet with unexpected length was received.
>> *** Handshake has failed
>> GNUTLS ERROR: A TLS packet with unexpected length was received.
>> jas@mocca:~$
>
> Although I can confirm the brain damage exhibited by www.microsoft.com
> and www.ibm.com, www.paypal.com doesn't have an issue with a
> ClientHello advertising TLS version 1.2. It might have other problems,
> but see the attached handshake.

For reference, my prober utility (which is not testing everything, yet ;),  
like not checking record padding variation ) diagnoses www.paypal.com with  
the following:

   - Not renego patched
   - Version intolerant (refuses to negotiate with client specifying TLS  
NG, v4.x)
   - No version checking of RSA Client Key Exchange (CKE)
   - Does not support AES


www.microsoft.com and www.ibm.com results:

   - Not renego patched
   - Version intolerant (refuses to negotiate with client specifying TLS  
1.1 or higher)


For those interested, at present

   - 3.4% of 383531 probed servers are intolerant in the 3.x range (69%  
including the 4.x range, 83% of renego patched server also in the v4.x  
range)
   - 0.4% require RSA CKE version field to match negotiated version
   - 31.6% does not check the RSA CKE version field
   - 43 of 383531 servers mirror the client hello version back to the client
   - 990 of 383531 server use the record protocol field instead of the  
client hello version when negotiating
   - 99 of 383531 support TLS 1.1
   - 2 of 383531 support TLS 1.2 (both are known test servers)

Among renego patched servers, while virtually all are tolerant in the v3.x  
range, recently some that are version intolerant in the v3.x range has  
started to show up. From this week's run:

    live.rapidswholesale.com
    pazion.nl
    hypotheek-aanvragen.nl
    droog.com
    sso.u-bordeaux3.fr
    www.seekame.com

None of these six servers tolerate v3.4, "TLS 1.3" (multiple tests  
performed), TLS 1.2 was accepted. Most of them identify as Apache, but  
there is no commonality in version numbers, and I suspect that the block  
is done by a server or firewall in front of the servers.

There were also two other servers that showed up in this weeks run, but  
those detections may be false positives due to other issues.



-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************