crypto/tls: handling a message longer than 12kB in record protocol

[gopherbot]

by thomas.berger@videxio.com:

In Go1.3

We sometime observe failing establishing of TLS1.2 connections

Error Message: tls: first record does not look like a TLS handshake


Root cause:

In file http://golang.org/src/pkg/crypto/tls/conn.go

Inside readRecord there is a check to ensure that the record is no longer than 12KB
(0x3000) (line 578):

if (typ != recordTypeAlert && typ != want) || vers >= 0x1000 || n >=
0x3000 {

However, some servers do have a lot of certificates installed, so we have observed more
than 12KB of data.

One example (depending on the server behind the load balancer):
Test: openssl s_client -connect sipfed0E.online.lync.com:5061 

We have observed 0x3013 as length in some server hellos (which is > 0x3000).

I suggest the limit is raised to a higher number.

Kind regards, 
Thomas M. Berger, videxio

[griesemer]

Comment 1:

Labels changed: added release-none, repo-main.

Owner changed to @rsc.

Status changed to Accepted.

[rsc]

Comment 2:

+agl

[gopherbot]

Comment 3 by zaozao:

Please don't be too conservative when increasing this limit. One of my real-world GRID
computing storage nodes just gave me a fluffy ClientHello just short of 0x3900 octets.

[mattkanwisher]

We are getting the same error to this connecting to a windows based sip ssl server also. Wondering if anyone else found out a solution

[bradfitz]

Assigned to @agl. Adam, if you advise what to do here, I can also send a CL, if that saves you any time.

[mattkanwisher]

much appreciated thanks

[justinsb]

I just hit this issue; the cause for me was that my server was requesting a client certificate, but I had forgotten to configure a list of trusted certificates. The server included every CA configured on my system in the CertificateRequest message, which (in my case) was ~11,000 bytes of data (and then I also had the server cert, hello etc).

It sounds like after this patch, users may now hit the message "tls: oversized record received with length %d". Remembering to configure the accepted CAs for client certs would fix the problem I hit.