From 01692531c6c624524aa9736c2b174a84c4873ef7 Mon Sep 17 00:00:00 2001 From: Andres Amaya Garcia Date: Wed, 28 Jun 2017 09:26:46 +0100 Subject: [PATCH] Document code silently discarding invalid records --- library/ssl_tls.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 7dd55bf4b..b388156df 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -3495,6 +3495,8 @@ static int ssl_parse_record_header( mbedtls_ssl_context *ssl ) MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) ); #if defined(MBEDTLS_SSL_PROTO_DTLS) + /* Silently ignore invalid DTLS records as recommended by RFC 6347 + * Section 4.1.2.7 */ if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) #endif /* MBEDTLS_SSL_PROTO_DTLS */ mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,