Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-11 11:27:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

dtls: Error out on invalid/unexpected record header

Browse Source 
Error out on invalid/unexpected record header
when reading the DTLS 1.2 ClientHello.

Signed-off-by: Ronald Cron <[email protected]>
This commit is contained in:
Ronald Cron
2026-03-25 08:44:16 +01:00
parent 315c970fbe
commit 676d74e4c7
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/ssl_msg.c
+24
View File
@@ -4750,6 +4750,30 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl)
ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD; ret = MBEDTLS_ERR_SSL_UNEXPECTED_RECORD;
} }
#if defined(MBEDTLS_SSL_SRV_C)
/*
* When retrieving the DTLS ClientHello on server side, error out
* when detecting an invalid or unexpected record.
*/
if ((ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) &&
(ssl->state == MBEDTLS_SSL_CLIENT_HELLO)
#if defined(MBEDTLS_SSL_RENEGOTIATION)
&& (ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE)
#endif
) {
/*
* For backward compatibility, return
* MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE rather than
* MBEDTLS_ERR_SSL_UNEXPECTED_RECORD.
*/
if (ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD) {
return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
} else {
return ret;
}
}
#endif /* MBEDTLS_SSL_SRV_C */
if (ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD) { if (ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD) {
#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C) #if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && defined(MBEDTLS_SSL_SRV_C)
/* Reset in pointers to default state for TLS/DTLS records, /* Reset in pointers to default state for TLS/DTLS records,