Endless looping of ssl_handshake() in mbedtls-1.3 upto 2.1.2

[lprot]

Description

• Type: Bug
• Priority: Major

---

Bug

OS
Ubuntu 16.04 LTS

mbed TLS build:
Version: 1.3.21 (affected versions are 1.3-2.1.2). Beginning from 2.1.3 upto 2.1.9 it's ok. OS version: Ubuntu 16.04 LTS Configuration: default config.h file
Compiler and options: just typed make in the root dir
Additional environment information:

Expected behavior
`/mbedtls-2.1.9/programs/ssl$ ./ssl_client2 server_name=streamserver.mno.netrix.hu server_port=443 debug_level=4

  . Seeding the random number generator... ok
  . Loading the CA root certificate ... ok (0 skipped)
  . Loading the client cert. and key... ok
  . Connecting to tcp/streamserver.mno.netrix.hu/443... ok
  . Setting up the SSL/TLS structure...ssl_tls.c:0085: |3| set_timer to 0 ms
 ok
  . Performing the SSL/TLS handshake...ssl_tls.c:6362: |2| => handshake
ssl_cli.c:3078: |2| client state: 0
ssl_tls.c:2409: |2| => flush output
ssl_tls.c:2421: |2| <= flush output
ssl_cli.c:3078: |2| client state: 1
ssl_tls.c:2409: |2| => flush output
ssl_tls.c:2421: |2| <= flush output
ssl_cli.c:0639: |2| => write client hello
ssl_cli.c:0677: |3| client hello, max version: [3:3]
ssl_cli.c:0615: |3| client hello, current time: 1517431371
ssl_cli.c:0686: |3| dumping 'client hello, random bytes' (32 bytes)
ssl_cli.c:0686: |3| 0000:  5a 72 2a 4b fd e2 27 c0 f5 99 6c 8c f2 0b 93 41  Zr*K..'...l....A
ssl_cli.c:0686: |3| 0010:  6a 24 01 85 ac 00 7d bc 59 22 e5 30 6b 9d c9 e2  j$....}.Y".0k...
ssl_cli.c:0739: |3| client hello, session id len.: 0
ssl_cli.c:0740: |3| dumping 'client hello, session id' (0 bytes)
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49196
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49200
ssl_cli.c:0801: |3| client hello, add ciphersuite: 159
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49325
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49311
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49188
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49192
ssl_cli.c:0801: |3| client hello, add ciphersuite: 107
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49162
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49172
ssl_cli.c:0801: |3| client hello, add ciphersuite: 57
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49327
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49315
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49287
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49291
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49277
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49267
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49271
ssl_cli.c:0801: |3| client hello, add ciphersuite: 196
ssl_cli.c:0801: |3| client hello, add ciphersuite: 136
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49195
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49199
ssl_cli.c:0801: |3| client hello, add ciphersuite: 158
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49324
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49310
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49187
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49191
ssl_cli.c:0801: |3| client hello, add ciphersuite: 103
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49161
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49171
ssl_cli.c:0801: |3| client hello, add ciphersuite: 51
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49326
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49314
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49286
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49290
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49276
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49266
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49270
ssl_cli.c:0801: |3| client hello, add ciphersuite: 190
ssl_cli.c:0801: |3| client hello, add ciphersuite: 69
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49160
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49170
ssl_cli.c:0801: |3| client hello, add ciphersuite: 22
ssl_cli.c:0801: |3| client hello, add ciphersuite: 171
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49319
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49208
ssl_cli.c:0801: |3| client hello, add ciphersuite: 179
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49206
ssl_cli.c:0801: |3| client hello, add ciphersuite: 145
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49297
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49307
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49303
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49323
ssl_cli.c:0801: |3| client hello, add ciphersuite: 170
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49318
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49207
ssl_cli.c:0801: |3| client hello, add ciphersuite: 178
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49205
ssl_cli.c:0801: |3| client hello, add ciphersuite: 144
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49296
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49302
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49306
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49322
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49204
ssl_cli.c:0801: |3| client hello, add ciphersuite: 143
ssl_cli.c:0801: |3| client hello, add ciphersuite: 157
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49309
ssl_cli.c:0801: |3| client hello, add ciphersuite: 61
ssl_cli.c:0801: |3| client hello, add ciphersuite: 53
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49202
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49194
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49167
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49198
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49190
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49157
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49313
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49275
ssl_cli.c:0801: |3| client hello, add ciphersuite: 192
ssl_cli.c:0801: |3| client hello, add ciphersuite: 132
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49293
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49273
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49289
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49269
ssl_cli.c:0801: |3| client hello, add ciphersuite: 156
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49308
ssl_cli.c:0801: |3| client hello, add ciphersuite: 60
ssl_cli.c:0801: |3| client hello, add ciphersuite: 47
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49201
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49193
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49166
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49197
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49189
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49156
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49312
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49274
ssl_cli.c:0801: |3| client hello, add ciphersuite: 186
ssl_cli.c:0801: |3| client hello, add ciphersuite: 65
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49292
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49272
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49288
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49268
ssl_cli.c:0801: |3| client hello, add ciphersuite: 10
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49165
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49155
ssl_cli.c:0801: |3| client hello, add ciphersuite: 173
ssl_cli.c:0801: |3| client hello, add ciphersuite: 183
ssl_cli.c:0801: |3| client hello, add ciphersuite: 149
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49299
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49305
ssl_cli.c:0801: |3| client hello, add ciphersuite: 172
ssl_cli.c:0801: |3| client hello, add ciphersuite: 182
ssl_cli.c:0801: |3| client hello, add ciphersuite: 148
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49298
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49304
ssl_cli.c:0801: |3| client hello, add ciphersuite: 147
ssl_cli.c:0801: |3| client hello, add ciphersuite: 169
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49317
ssl_cli.c:0801: |3| client hello, add ciphersuite: 175
ssl_cli.c:0801: |3| client hello, add ciphersuite: 141
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49295
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49301
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49321
ssl_cli.c:0801: |3| client hello, add ciphersuite: 168
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49316
ssl_cli.c:0801: |3| client hello, add ciphersuite: 174
ssl_cli.c:0801: |3| client hello, add ciphersuite: 140
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49294
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49300
ssl_cli.c:0801: |3| client hello, add ciphersuite: 49320
ssl_cli.c:0801: |3| client hello, add ciphersuite: 139
ssl_cli.c:0834: |3| client hello, got 131 ciphersuites
ssl_cli.c:0865: |3| client hello, compress len.: 1
ssl_cli.c:0867: |3| client hello, compress alg.: 0
ssl_cli.c:0074: |3| client hello, adding server name extension: streamserver.mno.netrix.hu
ssl_cli.c:0180: |3| client hello, adding signature_algorithms extension
ssl_cli.c:0264: |3| client hello, adding supported_elliptic_curves extension
ssl_cli.c:0327: |3| client hello, adding supported_point_formats extension
ssl_cli.c:0430: |3| client hello, adding encrypt_then_mac extension
ssl_cli.c:0464: |3| client hello, adding extended_master_secret extension
ssl_cli.c:0497: |3| client hello, adding session ticket extension
ssl_cli.c:0933: |3| client hello, total extension length: 107
ssl_tls.c:2694: |2| => write record
ssl_tls.c:2829: |3| output record: msgtype = 22, version = [3:1], msglen = 414
ssl_tls.c:2832: |4| dumping 'output record sent to network' (419 bytes)
ssl_tls.c:2832: |4| 0000:  16 03 01 01 9e 01 00 01 9a 03 03 5a 72 2a 4b fd  ...........Zr*K.
ssl_tls.c:2832: |4| 0010:  e2 27 c0 f5 99 6c 8c f2 0b 93 41 6a 24 01 85 ac  .'...l....Aj$...
ssl_tls.c:2832: |4| 0020:  00 7d bc 59 22 e5 30 6b 9d c9 e2 00 01 06 c0 2c  .}.Y".0k.......,
ssl_tls.c:2832: |4| 0030:  c0 30 00 9f c0 ad c0 9f c0 24 c0 28 00 6b c0 0a  .0.......$.(.k..
ssl_tls.c:2832: |4| 0040:  c0 14 00 39 c0 af c0 a3 c0 87 c0 8b c0 7d c0 73  ...9.........}.s
ssl_tls.c:2832: |4| 0050:  c0 77 00 c4 00 88 c0 2b c0 2f 00 9e c0 ac c0 9e  .w.....+./......
ssl_tls.c:2832: |4| 0060:  c0 23 c0 27 00 67 c0 09 c0 13 00 33 c0 ae c0 a2  .#.'.g.....3....
ssl_tls.c:2832: |4| 0070:  c0 86 c0 8a c0 7c c0 72 c0 76 00 be 00 45 c0 08  .....|.r.v...E..
ssl_tls.c:2832: |4| 0080:  c0 12 00 16 00 ab c0 a7 c0 38 00 b3 c0 36 00 91  .........8...6..
ssl_tls.c:2832: |4| 0090:  c0 91 c0 9b c0 97 c0 ab 00 aa c0 a6 c0 37 00 b2  .............7..
ssl_tls.c:2832: |4| 00a0:  c0 35 00 90 c0 90 c0 96 c0 9a c0 aa c0 34 00 8f  .5...........4..
ssl_tls.c:2832: |4| 00b0:  00 9d c0 9d 00 3d 00 35 c0 32 c0 2a c0 0f c0 2e  .....=.5.2.*....
ssl_tls.c:2832: |4| 00c0:  c0 26 c0 05 c0 a1 c0 7b 00 c0 00 84 c0 8d c0 79  .&.....{.......y
ssl_tls.c:2832: |4| 00d0:  c0 89 c0 75 00 9c c0 9c 00 3c 00 2f c0 31 c0 29  ...u.....<./.1.)
ssl_tls.c:2832: |4| 00e0:  c0 0e c0 2d c0 25 c0 04 c0 a0 c0 7a 00 ba 00 41  ...-.%.....z...A
ssl_tls.c:2832: |4| 00f0:  c0 8c c0 78 c0 88 c0 74 00 0a c0 0d c0 03 00 ad  ...x...t........
ssl_tls.c:2832: |4| 0100:  00 b7 00 95 c0 93 c0 99 00 ac 00 b6 00 94 c0 92  ................
ssl_tls.c:2832: |4| 0110:  c0 98 00 93 00 a9 c0 a5 00 af 00 8d c0 8f c0 95  ................
ssl_tls.c:2832: |4| 0120:  c0 a9 00 a8 c0 a4 00 ae 00 8c c0 8e c0 94 c0 a8  ................
ssl_tls.c:2832: |4| 0130:  00 8b 00 ff 01 00 00 6b 00 00 00 1f 00 1d 00 00  .......k........
ssl_tls.c:2832: |4| 0140:  1a 73 74 72 65 61 6d 73 65 72 76 65 72 2e 6d 6e  .streamserver.mn
ssl_tls.c:2832: |4| 0150:  6f 2e 6e 65 74 72 69 78 2e 68 75 00 0d 00 16 00  o.netrix.hu.....
ssl_tls.c:2832: |4| 0160:  14 06 03 06 01 05 03 05 01 04 03 04 01 03 03 03  ................
ssl_tls.c:2832: |4| 0170:  01 02 03 02 01 00 0a 00 18 00 16 00 19 00 1c 00  ................
ssl_tls.c:2832: |4| 0180:  18 00 1b 00 17 00 16 00 1a 00 15 00 14 00 13 00  ................
ssl_tls.c:2832: |4| 0190:  12 00 0b 00 02 01 00 00 16 00 00 00 17 00 00 00  ................
ssl_tls.c:2832: |4| 01a0:  23 00 00                                         #..
ssl_tls.c:2409: |2| => flush output
ssl_tls.c:2428: |2| message length: 419, out_left: 419
ssl_tls.c:2434: |2| ssl->f_send() returned 419 (-0xfffffe5d)
ssl_tls.c:2453: |2| <= flush output
ssl_tls.c:2841: |2| <= write record
ssl_cli.c:0959: |2| <= write client hello
ssl_cli.c:3078: |2| client state: 2
ssl_tls.c:2409: |2| => flush output
ssl_tls.c:2421: |2| <= flush output
ssl_cli.c:1283: |2| => parse server hello
ssl_tls.c:3719: |2| => read record
ssl_tls.c:2201: |2| => fetch input
ssl_tls.c:2359: |2| in_left: 0, nb_want: 5
ssl_tls.c:2383: |2| in_left: 0, nb_want: 5
ssl_tls.c:2384: |2| ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
ssl_tls.c:2396: |2| <= fetch input
ssl_tls.c:3466: |4| dumping 'input record header' (5 bytes)
ssl_tls.c:3466: |4| 0000:  15 03 03 00 02                                   .....
ssl_tls.c:3475: |3| input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c:2201: |2| => fetch input
ssl_tls.c:2359: |2| in_left: 5, nb_want: 7
ssl_tls.c:2383: |2| in_left: 5, nb_want: 7
ssl_tls.c:2384: |2| ssl->f_recv(_timeout)() returned 2 (-0xfffffffe)
ssl_tls.c:2396: |2| <= fetch input
ssl_tls.c:3644: |4| dumping 'input record from network' (7 bytes)
ssl_tls.c:3644: |4| 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c:4009: |2| got an alert message, type: [1:112]
ssl_tls.c:2201: |2| => fetch input
ssl_tls.c:2359: |2| in_left: 0, nb_want: 5
ssl_tls.c:2383: |2| in_left: 0, nb_want: 5
ssl_tls.c:2384: |2| ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
ssl_tls.c:2396: |2| <= fetch input
ssl_tls.c:3466: |4| dumping 'input record header' (5 bytes)
ssl_tls.c:3466: |4| 0000:  16 03 03 00 41                                   ....A
ssl_tls.c:3475: |3| input record: msgtype = 22, version = [3:3], msglen = 65
ssl_tls.c:2201: |2| => fetch input
ssl_tls.c:2359: |2| in_left: 5, nb_want: 70
ssl_tls.c:2383: |2| in_left: 5, nb_want: 70
ssl_tls.c:2384: |2| ssl->f_recv(_timeout)() returned 65 (-0xffffffbf)
ssl_tls.c:2396: |2| <= fetch input
ssl_tls.c:3644: |4| dumping 'input record from network' (70 bytes)
ssl_tls.c:3644: |4| 0000:  16 03 03 00 41 02 00 00 3d 03 03 4c b1 2a 7f 2a  ....A...=..L.*.*
ssl_tls.c:3644: |4| 0010:  6f a2 29 d9 7a 76 08 b0 fa 56 c1 85 26 83 92 55  o.).zv...V..&..U
ssl_tls.c:3644: |4| 0020:  05 d3 aa a1 de 3c 9c 7d dc 7e 13 00 c0 30 00 00  .....<.}.~...0..
ssl_tls.c:3644: |4| 0030:  15 00 00 00 00 ff 01 00 01 00 00 0b 00 04 03 00  ................
ssl_tls.c:3644: |4| 0040:  01 02 00 23 00 00                                ...#..
ssl_tls.c:3080: |3| handshake message: msglen = 65, type = 2, hslen = 65
ssl_tls.c:4054: |2| <= read record
ssl_cli.c:1358: |3| dumping 'server hello, version' (2 bytes)
ssl_cli.c:1358: |3| 0000:  03 03                                            ..
ssl_cli.c:1384: |3| server hello, current time: 1286679167
ssl_cli.c:1391: |3| dumping 'server hello, random bytes' (32 bytes)
ssl_cli.c:1391: |3| 0000:  4c b1 2a 7f 2a 6f a2 29 d9 7a 76 08 b0 fa 56 c1  L.*.*o.).zv...V.
ssl_cli.c:1391: |3| 0010:  85 26 83 92 55 05 d3 aa a1 de 3c 9c 7d dc 7e 13  .&..U.....<.}.~.
ssl_cli.c:1461: |3| server hello, session id len.: 0
ssl_cli.c:1462: |3| dumping 'server hello, session id' (0 bytes)
ssl_cli.c:1498: |3| no session has been resumed
ssl_cli.c:1500: |3| server hello, chosen ciphersuite: 49200
ssl_cli.c:1501: |3| server hello, compress alg.: 0
ssl_cli.c:1544: |2| server hello, total extension length: 21
ssl_cli.c:1663: |3| unknown extension found: 0 (ignoring)
ssl_cli.c:1562: |3| found renegotiation extension
ssl_cli.c:1640: |3| found supported_point_formats extension
ssl_cli.c:1128: |4| point format selected: 0
ssl_cli.c:1627: |3| found session_ticket extension
ssl_cli.c:1717: |2| <= parse server hello
ssl_cli.c:3078: |2| client state: 3
ssl_tls.c:2409: |2| => flush output
ssl_tls.c:2421: |2| <= flush output
ssl_tls.c:4270: |2| => parse certificate
ssl_tls.c:3719: |2| => read record
ssl_tls.c:2201: |2| => fetch input
ssl_tls.c:2359: |2| in_left: 0, nb_want: 5
ssl_tls.c:2383: |2| in_left: 0, nb_want: 5
ssl_tls.c:2384: |2| ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
ssl_tls.c:2396: |2| <= fetch input
ssl_tls.c:3466: |4| dumping 'input record header' (5 bytes)
ssl_tls.c:3466: |4| 0000:  16 03 03 09 be                                   .....
ssl_tls.c:3475: |3| input record: msgtype = 22, version = [3:3], msglen = 2494
ssl_tls.c:2201: |2| => fetch input
ssl_tls.c:2359: |2| in_left: 5, nb_want: 2499
ssl_tls.c:2383: |2| in_left: 5, nb_want: 2499
ssl_tls.c:2384: |2| ssl->f_recv(_timeout)() returned 2494 (-0xfffff642)
ssl_tls.c:2396: |2| <= fetch input
ssl_tls.c:3644: |4| dumping 'input record from network' (2499 bytes)

Actual behavior
mbedtls-1.3.21/programs/ssl$ ./ssl_client2 server_name=streamserver.mno.netrix.hu server_port=443 debug_level=4 |more

  . Seeding the random number generator... ok
  . Loading the CA root certificate ... ok (0 skipped)
  . Loading the client cert. and key... ok
  . Connecting to tcp/streamserver.mno.netrix.hu/443 ... ok
  . Setting up the SSL/TLS structure... ok
  . Performing the SSL/TLS handshake...ssl_tls.c(4523): => handshake
ssl_cli.c(2936): client state: 0
ssl_tls.c(2050): => flush output
ssl_tls.c(2068): <= flush output
ssl_cli.c(2936): client state: 1
ssl_tls.c(2050): => flush output
ssl_tls.c(2068): <= flush output
ssl_cli.c(0651): => write client hello
ssl_cli.c(0687): client hello, max version: [3:3]
ssl_cli.c(0696): client hello, current time: 1517431500
ssl_cli.c(0711): dumping 'client hello, random bytes' (32 bytes)
ssl_cli.c(0711): 0000:  5a 72 2a cc 95 48 ec 41 b1 60 42 aa ca ca 4c 2a  Zr*..H.A.`B...L*
ssl_cli.c(0711): 0010:  07 66 59 82 77 3b 08 86 07 f3 7a 68 81 db 47 32  .fY.w;....zh..G2
ssl_cli.c(0761): client hello, session id len.: 0
ssl_cli.c(0762): dumping 'client hello, session id' (0 bytes)
ssl_cli.c(0787): client hello, add ciphersuite: 49196
ssl_cli.c(0787): client hello, add ciphersuite: 49200
ssl_cli.c(0787): client hello, add ciphersuite: 159
ssl_cli.c(0787): client hello, add ciphersuite: 49325
ssl_cli.c(0787): client hello, add ciphersuite: 49311
ssl_cli.c(0787): client hello, add ciphersuite: 49188
ssl_cli.c(0787): client hello, add ciphersuite: 49192
ssl_cli.c(0787): client hello, add ciphersuite: 107
ssl_cli.c(0787): client hello, add ciphersuite: 49162
ssl_cli.c(0787): client hello, add ciphersuite: 49172
ssl_cli.c(0787): client hello, add ciphersuite: 57
ssl_cli.c(0787): client hello, add ciphersuite: 49327
ssl_cli.c(0787): client hello, add ciphersuite: 49315
ssl_cli.c(0787): client hello, add ciphersuite: 49287
ssl_cli.c(0787): client hello, add ciphersuite: 49291
ssl_cli.c(0787): client hello, add ciphersuite: 49277
ssl_cli.c(0787): client hello, add ciphersuite: 49267
ssl_cli.c(0787): client hello, add ciphersuite: 49271
ssl_cli.c(0787): client hello, add ciphersuite: 196
ssl_cli.c(0787): client hello, add ciphersuite: 136
ssl_cli.c(0787): client hello, add ciphersuite: 49195
ssl_cli.c(0787): client hello, add ciphersuite: 49199
ssl_cli.c(0787): client hello, add ciphersuite: 158
ssl_cli.c(0787): client hello, add ciphersuite: 49324
ssl_cli.c(0787): client hello, add ciphersuite: 49310
ssl_cli.c(0787): client hello, add ciphersuite: 49187
ssl_cli.c(0787): client hello, add ciphersuite: 49191
ssl_cli.c(0787): client hello, add ciphersuite: 103
ssl_cli.c(0787): client hello, add ciphersuite: 49161
ssl_cli.c(0787): client hello, add ciphersuite: 49171
ssl_cli.c(0787): client hello, add ciphersuite: 51
ssl_cli.c(0787): client hello, add ciphersuite: 49326
ssl_cli.c(0787): client hello, add ciphersuite: 49314
ssl_cli.c(0787): client hello, add ciphersuite: 49286
ssl_cli.c(0787): client hello, add ciphersuite: 49290
ssl_cli.c(0787): client hello, add ciphersuite: 49276
ssl_cli.c(0787): client hello, add ciphersuite: 49266
ssl_cli.c(0787): client hello, add ciphersuite: 49270
ssl_cli.c(0787): client hello, add ciphersuite: 190
ssl_cli.c(0787): client hello, add ciphersuite: 69
ssl_cli.c(0787): client hello, add ciphersuite: 49160
ssl_cli.c(0787): client hello, add ciphersuite: 49170
ssl_cli.c(0787): client hello, add ciphersuite: 22
ssl_cli.c(0787): client hello, add ciphersuite: 171
ssl_cli.c(0787): client hello, add ciphersuite: 49319
ssl_cli.c(0787): client hello, add ciphersuite: 49208
ssl_cli.c(0787): client hello, add ciphersuite: 179
ssl_cli.c(0787): client hello, add ciphersuite: 49206
ssl_cli.c(0787): client hello, add ciphersuite: 145
ssl_cli.c(0787): client hello, add ciphersuite: 49297
ssl_cli.c(0787): client hello, add ciphersuite: 49307
ssl_cli.c(0787): client hello, add ciphersuite: 49303
ssl_cli.c(0787): client hello, add ciphersuite: 49323
ssl_cli.c(0787): client hello, add ciphersuite: 170
ssl_cli.c(0787): client hello, add ciphersuite: 49318
ssl_cli.c(0787): client hello, add ciphersuite: 49207
ssl_cli.c(0787): client hello, add ciphersuite: 178
ssl_cli.c(0787): client hello, add ciphersuite: 49205
ssl_cli.c(0787): client hello, add ciphersuite: 144
ssl_cli.c(0787): client hello, add ciphersuite: 49296
ssl_cli.c(0787): client hello, add ciphersuite: 49302
ssl_cli.c(0787): client hello, add ciphersuite: 49306
ssl_cli.c(0787): client hello, add ciphersuite: 49322
ssl_cli.c(0787): client hello, add ciphersuite: 49204
ssl_cli.c(0787): client hello, add ciphersuite: 143
ssl_cli.c(0787): client hello, add ciphersuite: 157
ssl_cli.c(0787): client hello, add ciphersuite: 49309
ssl_cli.c(0787): client hello, add ciphersuite: 61
ssl_cli.c(0787): client hello, add ciphersuite: 53
ssl_cli.c(0787): client hello, add ciphersuite: 49202
ssl_cli.c(0787): client hello, add ciphersuite: 49194
ssl_cli.c(0787): client hello, add ciphersuite: 49167
ssl_cli.c(0787): client hello, add ciphersuite: 49198
ssl_cli.c(0787): client hello, add ciphersuite: 49190
ssl_cli.c(0787): client hello, add ciphersuite: 49157
ssl_cli.c(0787): client hello, add ciphersuite: 49313
ssl_cli.c(0787): client hello, add ciphersuite: 49275
ssl_cli.c(0787): client hello, add ciphersuite: 192
ssl_cli.c(0787): client hello, add ciphersuite: 132
ssl_cli.c(0787): client hello, add ciphersuite: 49293
ssl_cli.c(0787): client hello, add ciphersuite: 49273
ssl_cli.c(0787): client hello, add ciphersuite: 49289
ssl_cli.c(0787): client hello, add ciphersuite: 49269
ssl_cli.c(0787): client hello, add ciphersuite: 156
ssl_cli.c(0787): client hello, add ciphersuite: 49308
ssl_cli.c(0787): client hello, add ciphersuite: 60
ssl_cli.c(0787): client hello, add ciphersuite: 47
ssl_cli.c(0787): client hello, add ciphersuite: 49201
ssl_cli.c(0787): client hello, add ciphersuite: 49193
ssl_cli.c(0787): client hello, add ciphersuite: 49166
ssl_cli.c(0787): client hello, add ciphersuite: 49197
ssl_cli.c(0787): client hello, add ciphersuite: 49189
ssl_cli.c(0787): client hello, add ciphersuite: 49156
ssl_cli.c(0787): client hello, add ciphersuite: 49312
ssl_cli.c(0787): client hello, add ciphersuite: 49274
ssl_cli.c(0787): client hello, add ciphersuite: 186
ssl_cli.c(0787): client hello, add ciphersuite: 65
ssl_cli.c(0787): client hello, add ciphersuite: 49292
ssl_cli.c(0787): client hello, add ciphersuite: 49272
ssl_cli.c(0787): client hello, add ciphersuite: 49288
ssl_cli.c(0787): client hello, add ciphersuite: 49268
ssl_cli.c(0787): client hello, add ciphersuite: 10
ssl_cli.c(0787): client hello, add ciphersuite: 49165
ssl_cli.c(0787): client hello, add ciphersuite: 49155
ssl_cli.c(0787): client hello, add ciphersuite: 173
ssl_cli.c(0787): client hello, add ciphersuite: 183
ssl_cli.c(0787): client hello, add ciphersuite: 149
ssl_cli.c(0787): client hello, add ciphersuite: 49299
ssl_cli.c(0787): client hello, add ciphersuite: 49305
ssl_cli.c(0787): client hello, add ciphersuite: 172
ssl_cli.c(0787): client hello, add ciphersuite: 182
ssl_cli.c(0787): client hello, add ciphersuite: 148
ssl_cli.c(0787): client hello, add ciphersuite: 49298
ssl_cli.c(0787): client hello, add ciphersuite: 49304
ssl_cli.c(0787): client hello, add ciphersuite: 147
ssl_cli.c(0787): client hello, add ciphersuite: 169
ssl_cli.c(0787): client hello, add ciphersuite: 49317
ssl_cli.c(0787): client hello, add ciphersuite: 175
ssl_cli.c(0787): client hello, add ciphersuite: 141
ssl_cli.c(0787): client hello, add ciphersuite: 49295
ssl_cli.c(0787): client hello, add ciphersuite: 49301
ssl_cli.c(0787): client hello, add ciphersuite: 49321
ssl_cli.c(0787): client hello, add ciphersuite: 168
ssl_cli.c(0787): client hello, add ciphersuite: 49316
ssl_cli.c(0787): client hello, add ciphersuite: 174
ssl_cli.c(0787): client hello, add ciphersuite: 140
ssl_cli.c(0787): client hello, add ciphersuite: 49294
ssl_cli.c(0787): client hello, add ciphersuite: 49300
ssl_cli.c(0787): client hello, add ciphersuite: 49320
ssl_cli.c(0787): client hello, add ciphersuite: 139
ssl_cli.c(0820): client hello, got 131 ciphersuites
ssl_cli.c(0832): client hello, compress len.: 1
ssl_cli.c(0833): client hello, compress alg.: 0
ssl_cli.c(0076): client hello, adding server name extension: streamserver.mno.netrix.hu
ssl_cli.c(0179): client hello, adding signature_algorithms extension
ssl_cli.c(0323): client hello, adding supported_elliptic_curves extension
ssl_cli.c(0386): client hello, adding supported_point_formats extension
ssl_cli.c(0486): client hello, adding encrypt_then_mac extension
ssl_cli.c(0520): client hello, adding extended_master_secret extension
ssl_cli.c(0551): client hello, adding session ticket extension
ssl_cli.c(0899): client hello, total extension length: 107
ssl_tls.c(2081): => write record
ssl_tls.c(2149): output record: msgtype = 22, version = [3:1], msglen = 414
ssl_tls.c(2152): dumping 'output record sent to network' (419 bytes)
ssl_tls.c(2152): 0000:  16 03 01 01 9e 01 00 01 9a 03 03 5a 72 2a cc 95  ...........Zr*..
ssl_tls.c(2152): 0010:  48 ec 41 b1 60 42 aa ca ca 4c 2a 07 66 59 82 77  H.A.`B...L*.fY.w
ssl_tls.c(2152): 0020:  3b 08 86 07 f3 7a 68 81 db 47 32 00 01 06 c0 2c  ;....zh..G2....,
ssl_tls.c(2152): 0030:  c0 30 00 9f c0 ad c0 9f c0 24 c0 28 00 6b c0 0a  .0.......$.(.k..
ssl_tls.c(2152): 0040:  c0 14 00 39 c0 af c0 a3 c0 87 c0 8b c0 7d c0 73  ...9.........}.s
ssl_tls.c(2152): 0050:  c0 77 00 c4 00 88 c0 2b c0 2f 00 9e c0 ac c0 9e  .w.....+./......
ssl_tls.c(2152): 0060:  c0 23 c0 27 00 67 c0 09 c0 13 00 33 c0 ae c0 a2  .#.'.g.....3....
ssl_tls.c(2152): 0070:  c0 86 c0 8a c0 7c c0 72 c0 76 00 be 00 45 c0 08  .....|.r.v...E..
ssl_tls.c(2152): 0080:  c0 12 00 16 00 ab c0 a7 c0 38 00 b3 c0 36 00 91  .........8...6..
ssl_tls.c(2152): 0090:  c0 91 c0 9b c0 97 c0 ab 00 aa c0 a6 c0 37 00 b2  .............7..
ssl_tls.c(2152): 00a0:  c0 35 00 90 c0 90 c0 96 c0 9a c0 aa c0 34 00 8f  .5...........4..
ssl_tls.c(2152): 00b0:  00 9d c0 9d 00 3d 00 35 c0 32 c0 2a c0 0f c0 2e  .....=.5.2.*....
ssl_tls.c(2152): 00c0:  c0 26 c0 05 c0 a1 c0 7b 00 c0 00 84 c0 8d c0 79  .&.....{.......y
ssl_tls.c(2152): 00d0:  c0 89 c0 75 00 9c c0 9c 00 3c 00 2f c0 31 c0 29  ...u.....<./.1.)
ssl_tls.c(2152): 00e0:  c0 0e c0 2d c0 25 c0 04 c0 a0 c0 7a 00 ba 00 41  ...-.%.....z...A
ssl_tls.c(2152): 00f0:  c0 8c c0 78 c0 88 c0 74 00 0a c0 0d c0 03 00 ad  ...x...t........
ssl_tls.c(2152): 0100:  00 b7 00 95 c0 93 c0 99 00 ac 00 b6 00 94 c0 92  ................
ssl_tls.c(2152): 0110:  c0 98 00 93 00 a9 c0 a5 00 af 00 8d c0 8f c0 95  ................
ssl_tls.c(2152): 0120:  c0 a9 00 a8 c0 a4 00 ae 00 8c c0 8e c0 94 c0 a8  ................
ssl_tls.c(2152): 0130:  00 8b 00 ff 01 00 00 6b 00 00 00 1f 00 1d 00 00  .......k........
ssl_tls.c(2152): 0140:  1a 73 74 72 65 61 6d 73 65 72 76 65 72 2e 6d 6e  .streamserver.mn
ssl_tls.c(2152): 0150:  6f 2e 6e 65 74 72 69 78 2e 68 75 00 0d 00 16 00  o.netrix.hu.....
ssl_tls.c(2152): 0160:  14 06 01 05 01 04 01 03 01 02 01 06 03 05 03 04  ................
ssl_tls.c(2152): 0170:  03 03 03 02 03 00 0a 00 18 00 16 00 19 00 1c 00  ................
ssl_tls.c(2152): 0180:  18 00 1b 00 17 00 16 00 1a 00 15 00 14 00 13 00  ................
ssl_tls.c(2152): 0190:  12 00 0b 00 02 01 00 00 16 00 00 00 17 00 00 00  ................
ssl_tls.c(2152): 01a0:  23 00 00                                         #..
ssl_tls.c(2050): => flush output
ssl_tls.c(2055): message length: 419, out_left: 419
ssl_tls.c(2060): ssl->f_send() returned 419 (-0xfffffe5d)
ssl_tls.c(2068): <= flush output
ssl_tls.c(2161): <= write record
ssl_cli.c(0920): <= write client hello
ssl_cli.c(2936): client state: 2
ssl_tls.c(2050): => flush output
ssl_tls.c(2068): <= flush output
ssl_cli.c(1165): => parse server hello
ssl_tls.c(2170): => read record
ssl_tls.c(2011): => fetch input
ssl_tls.c(2025): in_left: 0, nb_want: 5
ssl_tls.c(2026): ssl->f_recv() returned 5 (-0xfffffffb)
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2025): in_left: 5, nb_want: 7
ssl_tls.c(2026): ssl->f_recv() returned 2 (-0xfffffffe)
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2261): input record: msgtype = 21, version = [3:3], msglen = 2
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
ssl_tls.c(2336): dumping 'input record from network' (7 bytes)
ssl_tls.c(2336): 0000:  15 03 03 00 02 01 70                             ......p
ssl_tls.c(2443): got an alert message, type: [1:112]
ssl_tls.c(2011): => fetch input
ssl_tls.c(2037): <= fetch input
Endless loop...

Steps to reproduce
./ssl_client2 server_name=streamserver.mno.netrix.hu server_port=443 debug_level=4

[simonbutcher]

Interesting bug! Thanks for letting us know. We'll look into it.

[lprot]

I'm using mbedtls 1.3.21 in the project that in turn uses rtmpdump which relies on mbedtls-1.3. Moving to 2.x is a big task for rtmpdump so we locked to use 1.3. I hope you can quickly fix this in 1.3 branch. After you fix it I will immediately test on the wide range of different servers. Also openssl 1.0.2 on the same server works ok. Thanks in advance.

[lprot]

Well I managed to fix it myself :) Just need to move ssl->in_left = 0; before checking that alert message arrived:

    ssl->in_left = 0;

    if( ssl->in_msgtype == SSL_MSG_ALERT )

Hope you will add my change to 1.3.22 :)

[RonEld]

Hi @lprot Thank you for fixing this issue. As you can see, version 1.3.22 has just been released, so your fix hasn't made it to that release. We will try incorporating your fix to next version, however we strongly recommend you update your version, which has many more enhancements. Please refer to https://tls.mbed.org/kb/how-to/upgrade-2.0 for assisstance in migrating to Mbed TLS 2.x

[ciarmcom]

ARM Internal Ref: IOTSSL-2077

[simonbutcher]

Hi @lprot,

I'm afraid, Mbed TLS 1.3 is now End of Life, as was first announced last June, and we have no plans to make a new version available.

We extended it's life beyond what was originally planned, but because we now want to create a new long term support branch with 2.7, we unfortunately have to end support for 1.3.

So I'm afraid I have to close the issue as we have no intention of fixing it.

[lprot]

Do that but just include this fix as it stays there for ages...