Hi! I have an issue with a Ranch listener with client verification. In short, when using tls 1.2 it works as expected, but when using tls 1.3 clients always receive {:ok, socket}, even when the handshake process fails (i would have expected to receive {:error, {tls_alert, …}}. However, when trying to send to this socket, {:error, :closed} is received. Below is an example.

Listener:

def start_listener(opts) do
    versions = Keyword.get(opts, :versions)
    verify_fun = Keyword.get(opts, :verify_fun)

    key     = key()
    cacerts = cacerts()
    crt     = cert()

    socket_opts =
      [
        cacerts:              cacerts,
        key:                  key,
        cert:                 crt,
        versions:             versions,
        verify:               :verify_peer,
        fail_if_no_peer_cert: true,
        verify_fun:           {verify_fun, []},
        port:                 49665,
        ciphers: :ssl.cipher_suites(:all,:'tlsv1.2') ++ :ssl.cipher_suites(:all,:'tlsv1.3')
      ]

    opts = %{
      connection_type:      :supervisor,
      socket_opts:          socket_opts,
    }

    {:ok, _} = :ranch.start_listener(:Tls, :ranch_ssl, opts, Prot, cert_verification: true)
  end

Client connection:

def connect(tls_versions) do
    client_ca_cert = client_ca_cert()
    {client_cert, client_key} = generate_cert()

    :ssl.connect(
      {127, 0, 0, 1},
      49_665,
      [
        versions: tls_versions,
        ciphers: :ssl.cipher_suites(:all,:'tlsv1.2') ++ :ssl.cipher_suites(:all,:'tlsv1.3'),
        cacerts: [client_ca_cert],
        key: {:RSAPrivateKey, client_key},
        cert: client_cert,
      ]
    )
  end

When i try to connect with TLS 1.2 and a verify function that is guaranteed to fail it works as expected:

iex(1)> Listener.start_listener([versions: [:"tlsv1.2"], verify_fun: fn(_c, _r, _s) -> {:fail, :internal_error} end])
{:ok, #PID<0.207.0>}
iex(2)> Listener.connect([:"tlsv1.2"])

11:40:44.558 [warn]  Description: 'Authenticity is not established by certificate path validation'
     Reason: 'Option {verify, verify_peer} and cacertfile/cacerts is missing'

 
11:40:44.607 [info]  TLS :server: In state :certify at ssl_handshake.erl:2017 generated SERVER ALERT: Fatal - Handshake Failure
 - :internal_error
 
11:40:44.617 [info]  TLS :client: In state :cipher received SERVER ALERT: Fatal - Handshake Failure

{:error,
 {:tls_alert,
  {:handshake_failure,
   'TLS client: In state cipher received SERVER ALERT: Fatal - Handshake Failure\n'}}}

However, when doing the same with TLS 1.3, i get the successful message. It seems to be received before the handshake has failed:

iex(1)> Listener.start_listener([versions: [:"tlsv1.3"], verify_fun: fn(_c, _r, _s) -> {:fail, :internal_error} end])
{:ok, #PID<0.221.0>}
iex(2)> Listener.connect([:"tlsv1.3"])

11:42:51.559 [warn]  Description: 'Authenticity is not established by certificate path validation'
     Reason: 'Option {verify, verify_peer} and cacertfile/cacerts is missing'

{:ok,
 {:sslsocket, {:gen_tcp, #Port<0.7>, :tls_connection, :undefined},
  [#PID<0.240.0>, #PID<0.238.0>]}}
iex(3)> 
11:42:51.640 [info]  TLS :server: In state :wait_cert at ssl_handshake.erl:2017 generated SERVER ALERT: Fatal - Handshake Failure
 - :internal_error
 
11:42:51.665 [info]  TLS :client: In state :connection received SERVER ALERT: Fatal - Handshake Failure