yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-05-02 14:36:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add warnings about disabling replay detection

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-10-13 18:15:52 +02:00 committed by Paul Bakker
parent 37e08e1689
commit a6fcffe516
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
include/polarssl/config.h
View file

@ -931,6 +931,9 @@
* Requires: POLARSSL_SSL_TLS_C * Requires: POLARSSL_SSL_TLS_C
* POLARSSL_POLARSSL_PROTO_DTLS * POLARSSL_POLARSSL_PROTO_DTLS
* *
* \warning Disabling this is often a security risk!
* See ssl_set_dtls_anti_replay() for details.
*
* Comment this to disable anti-replay in DTLS. * Comment this to disable anti-replay in DTLS.
*/ */
#define POLARSSL_SSL_DTLS_ANTI_REPLAY #define POLARSSL_SSL_DTLS_ANTI_REPLAY
@ -945,6 +948,8 @@
* unless you know for sure amplification cannot be a problem in the * unless you know for sure amplification cannot be a problem in the
* environment in which your server operates. * environment in which your server operates.
* *
* \warning Disabling this can ba a security risk! (see above)
*
* Requires: POLARSSL_SSL_SRV_C * Requires: POLARSSL_SSL_SRV_C
* POLARSSL_POLARSSL_PROTO_DTLS * POLARSSL_POLARSSL_PROTO_DTLS
* *

9
include/polarssl/ssl.h
View file

@ -1279,10 +1279,17 @@ void ssl_set_dtls_cookies( ssl_context *ssl,
/** /**
* \brief Enable or disable anti-replay protection for DTLS. * \brief Enable or disable anti-replay protection for DTLS.
* (DTLS only, no effect on TLS.) * (DTLS only, no effect on TLS.)
* Default: enebled. * Default: enabled.
* *
* \param ssl SSL context * \param ssl SSL context
* \param mode SSL_ANTI_REPLAY_ENABLED or SSL_ANTI_REPLAY_DISABLED. * \param mode SSL_ANTI_REPLAY_ENABLED or SSL_ANTI_REPLAY_DISABLED.
*
* \warning Disabling this is a security risk unless the application
* protocol handles duplicated packets in a safe way. You
* should not disable this without careful consideration.
* However, if your application already detects duplicated
* packets and needs information about them to adjust its
* transmission strategy, then you'll want to disable this.
*/ */
void ssl_set_dtls_anti_replay( ssl_context *ssl, char mode ); void ssl_set_dtls_anti_replay( ssl_context *ssl, char mode );
#endif /* POLARSSL_SSL_DTLS_ANTI_REPLAY */ #endif /* POLARSSL_SSL_DTLS_ANTI_REPLAY */