From 70463dbb2daef69c23877eddff618f7a81087fee Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Wed, 8 May 2019 10:38:32 +0100 Subject: [PATCH] Expain rationale for handling of consecutive empty AD records --- library/ssl_tls.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 18a508d56..a8c3de942 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -4659,8 +4659,10 @@ static int ssl_prepare_record_content( mbedtls_ssl_context *ssl ) if( ssl->nb_zero > 3 ) { MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty " - "messages, possible DoS attack" ) ); - /* Q: Is that the right error code? */ + "messages, possible DoS attack" ) ); + /* Treat the records as if they were not properly authenticated, + * thereby failing the connection if we see more than allowed + * by the configured bad MAC threshold. */ return( MBEDTLS_ERR_SSL_INVALID_MAC ); } }