If you can't reproduce, are you sure these aren't cases where there is some proxy or other server breaking the connection?
I'm not aware of any issues. Brandon On Mon, Feb 27, 2017 at 12:27 PM, Kostya Vasilyev <[email protected]> wrote: > Hi, > > We've got an email app for Android, and lately seeing SSL handshake > failures specifically for smtp.gmail.com (and not for imap.gmail.com). > > The errors are happening deep down in Android OpenSSL / BoringSSL > code, a typical stack trace looks like this: > > javax.net.ssl.SSLHandshakeException: Handshake failed > at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake( > OpenSSLSocketImpl.java:429) > at com.android.org.conscrypt.OpenSSLSocketImpl.waitForHandshake( > OpenSSLSocketImpl.java:682) > at com.android.org.conscrypt.OpenSSLSocketImpl.getInputStream( > OpenSSLSocketImpl.java:644) > at org.kman.AquaMail.net.o.a(SourceFile:169) > at org.kman.AquaMail.net.j.a(SourceFile:279) > at org.kman.AquaMail.net.j.a(SourceFile:160) > at org.kman.AquaMail.mail.e.t.a(SourceFile:608) > at org.kman.AquaMail.mail.e.t.c(SourceFile:210) > at org.kman.AquaMail.core.t.a(SourceFile:76) > at org.kman.AquaMail.core.w.run(SourceFile:620) > at java.lang.Thread.run(Thread.java:762) > Caused by: javax.net.ssl.SSLProtocolException: SSL handshake > terminated: ssl=0x7e83740800: Failure in SSL library, usually a > protocol error > error:1000043e:SSL > routines:OPENSSL_internal:TLSV1_ALERT_INAPPROPRIATE_FALLBACK > (external/boringssl/src/ssl/s3_pkt.c:641 0x7e6b81c840:0x00000001) > at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method) > at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake( > OpenSSLSocketImpl.java:357) > ... 10 more > > Devices running Android 7 seem to be affected most (above), but not only. > > This one is from 5.1: > > javax.net.ssl.SSLHandshakeException: Handshake failed > at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake( > OpenSSLSocketImpl.java:405) > at com.android.org.conscrypt.OpenSSLSocketImpl.waitForHandshake( > OpenSSLSocketImpl.java:638) > at com.android.org.conscrypt.OpenSSLSocketImpl.getInputStream( > OpenSSLSocketImpl.java:600) > at org.kman.AquaMail.net.o.a(SourceFile:169) > at org.kman.AquaMail.net.j.a(SourceFile:279) > at org.kman.AquaMail.net.j.a(SourceFile:166) > at org.kman.AquaMail.mail.imap.bg.ab(SourceFile:912) > at org.kman.AquaMail.mail.imap.br.ac(SourceFile:44) > at org.kman.AquaMail.mail.imap.bg.ah(SourceFile:615) > at org.kman.AquaMail.mail.imap.bg.af(SourceFile:478) > at org.kman.AquaMail.mail.imap.bg.a(SourceFile:409) > at org.kman.AquaMail.mail.imap.bg.run(SourceFile:205) > at java.util.concurrent.ThreadPoolExecutor.runWorker( > ThreadPoolExecutor.java:1112) > at java.util.concurrent.ThreadPoolExecutor$Worker.run( > ThreadPoolExecutor.java:587) > at java.lang.Thread.run(Thread.java:818) > Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: > ssl=0xb79ecf80: Failure in SSL library, usually a protocol error > error:1407743E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert > inappropriate fallback (external/openssl/ssl/s23_clnt.c:770 > 0xae4d965b:0x00000000) > at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method) > at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake( > OpenSSLSocketImpl.java:323) > ... 14 more > > Our sockets typically have all of -- TLS 1.2, TLS 1.1, TLS 1.0 and SSL > v3 -- enabled, unless the user uses an app setting to turn off SSL v3. > > The list of "ciphers" is typically Android's default (+ some ciphers > re-enabled for compatibility on 5.0 and newer, Gmail app seems to do > that too), or if the user enables an app setting for "SSL hardening", > then we reorder ciphers to put e.g. ECDHE / AES-GCM and so on up > front. > > Looking at the output of "nmap --enum-ciphers" for smtp.gmail.com:465, > there are ciphers in common, so I don't really see any reason for the > error. > > And then I haven't been able to repro the issue with my phones, but > user reports keep coming in. > > Is there a known issue? Any plans to fix? > > Or anything we can do on our side? > > Thanks, > -- K > > _______________________________________________ > mailop mailing list > [email protected] > https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop >
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
