Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-30 14:07:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't pass badmac_limit when it would have no effect

Browse Source 
Only set `badmac_limit` on the side that actually receives a message with a
bad MAC/tag (injected by the proxy).

Signed-off-by: Gilles Peskine <[email protected]>
This commit is contained in:
Gilles Peskine
2026-06-15 13:37:54 +02:00
parent a939d850c7
commit a145116bff
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ssl-opt.sh
+7 -7
View File
@@ -12774,7 +12774,7 @@ run_test "DTLS proxy: client: get invalid AD record then reject renego" \
-p "$P_PXY bad_ad_srv_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
exchanges=4 badmac_limit=99 debug_level=3" \
0 \
@@ -12796,7 +12796,7 @@ run_test "DTLS proxy: server: get invalid AD record then reject renego (cli)"
renegotiation=0 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
1 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
@@ -12813,7 +12813,7 @@ run_test "DTLS proxy: client: get invalid AD record then accept renego" \
-p "$P_PXY bad_ad_srv_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
@@ -12833,7 +12833,7 @@ run_test "DTLS proxy: server: get invalid AD record then accept renego (srv)"
renegotiate=1 renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
renegotiation=1 exchanges=4 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-s "=> renegotiate" \
@@ -12851,7 +12851,7 @@ run_test "DTLS proxy: server: get invalid AD record then accept renego (cli)"
renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
@@ -12911,7 +12911,7 @@ run_test "DTLS proxy: server: get invalid AD record then reject early renego
renegotiation=0 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
1 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
@@ -12930,7 +12930,7 @@ run_test "DTLS proxy: server: get invalid AD record then accept early renego
renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \