DTLS Bad MAC Checks
1. Make the decrypt and verify MAC failure cases behave the same with respect to DTLS messages. It should pretend the message never happened. 2. Allow the echoclient to survive the echoserver sending a message with a bad MAC. 3. Allow the server to survive the client sending a message with a bad MAC.
This commit is contained in:
@@ -47,6 +47,9 @@
|
||||
#endif
|
||||
#include <cyassl/openssl/ssl.h>
|
||||
#include <cyassl/test.h>
|
||||
#ifdef CYASSL_DTLS
|
||||
#include <cyassl/error-ssl.h>
|
||||
#endif
|
||||
|
||||
#include "examples/server/server.h"
|
||||
|
||||
@@ -294,6 +297,12 @@ static void ServerRead(WOLFSSL* ssl, char* input, int inputLen)
|
||||
if (ret < 0) break;
|
||||
}
|
||||
else
|
||||
#endif
|
||||
#ifdef CYASSL_DTLS
|
||||
if (wolfSSL_dtls(ssl) && err == DECRYPT_ERROR) {
|
||||
printf("Dropped client's message due to a bad MAC\n");
|
||||
}
|
||||
else
|
||||
#endif
|
||||
if (err != SSL_ERROR_WANT_READ) {
|
||||
printf("SSL_read input error %d, %s\n", err,
|
||||
|
||||
Reference in New Issue
Block a user