Is it possible that a single handshake can have 2 TLS versions included?

Question

I am seeing different TLS versions (1.3 and 1.2) in the handshake and intermittently it fails with this error:

TLSv1.3 (OUT), TLS handshake, Client hello (1):.
2020-05-28T14:44:00Z.664        [thread-3752]   Info    TLSv1.3 (IN), TLS handshake, Server hello (2):.
2020-05-28T14:44:00Z.665        [thread-3752]   Info    TLSv1.2 (IN), TLS handshake, Certificate (11):.
2020-05-28T14:44:00Z.666        [thread-3752]   Info    TLSv1.2 (IN), TLS handshake, Server key exchange (12):.
2020-05-28T14:44:00Z.666        [thread-3752]   Info    TLSv1.2 (IN), TLS handshake, Server finished (14):.
2020-05-28T14:44:00Z.666        [thread-3752]   Info    TLSv1.2 (OUT), TLS handshake, Client key exchange (16):.
2020-05-28T14:44:00Z.667        [thread-3752]   Info    TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):.
2020-05-28T14:44:00Z.667        [thread-3752]   Info    TLSv1.2 (OUT), TLS handshake, Finished (20):.
2020-05-28T14:44:19Z.781        [thread-3752]   Info    OpenSSL SSL_connect: SSL_ERROR_SYSCALL

Answer 1

Due to backwards compatibility concerns, TLS uses a fake TLS version number in the record layer.

struct {
          ContentType type;
          ProtocolVersion legacy_record_version;
          uint16 length;
          opaque fragment[TLSPlaintext.length];
      } TLSPlaintext;

legacy_record_version:  MUST be set to 0x0303 for all records
      generated by a TLS 1.3 implementation other than an initial
      ClientHello (i.e., one not generated after a HelloRetryRequest),
      where it MAY also be 0x0301 for compatibility purposes.  This
      field is deprecated and MUST be ignored for all purposes.
      Previous versions of TLS would use other values in this field
      under some circumstances.

(from TLS1.3 RFC)

0x0300 is SSLv3, 0x0301 is TLS1.0, 0x0302 is TLS1.1, 0x0303 is TLS1.2.

Your tool displays this field and confuses you. Disregard this information, it is not useful. Replace or fix the tool, or just live with the fact that using TLS requires knowing about the backwards compatibility baggage.

In your transcript, it looks like the handshake succeeds, and then a syscall error happens. But that is not a logical error (like negotiation error caused by no common version or cipher suite, bad cryptographic authentication, etc). Instead that is a programming error, an error with the OS (probably socket) API. Help with programming errors is offered on stackoverflow.