DTLS: add api to enforce records do not span datagrams #8642
Conversation
tests/api/test_dtls.c
Outdated
| WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; | ||
| WOLFSSL *ssl_c = NULL, *ssl_s = NULL; | ||
| struct test_memio_ctx test_ctx; | ||
| char * readBuf[50]; |
There was a problem hiding this comment.
The declaration of 'readBuf' as an array of char pointers is likely incorrect for use with wolfSSL_read, which expects a contiguous byte buffer. Consider changing it to 'unsigned char readBuf[50];' or 'char readBuf[50];' if signedness is not an issue.
| char * readBuf[50]; | |
| unsigned char readBuf[50]; |
Copilot uses AI. Check for mistakes.
tests/api/test_dtls.c
Outdated
| WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; | ||
| WOLFSSL *ssl_c = NULL, *ssl_s = NULL; | ||
| struct test_memio_ctx test_ctx; | ||
| char * readBuf[50]; |
There was a problem hiding this comment.
The declaration of 'readBuf' as an array of char pointers is likely unintended here, as wolfSSL_read is expected to write raw bytes into a contiguous buffer. Consider using 'unsigned char readBuf[50];' or 'char readBuf[50];' to avoid potential memory issues.
| char * readBuf[50]; | |
| unsigned char readBuf[50]; |
Copilot uses AI. Check for mistakes.
rizlik
force-pushed
the
dtls_no_span_records
branch
4 times, most recently
from
c818750 to
b8c12fb
Compare
|
retest this |
doc/dox_comments/header_files/ssl.h
Outdated
| - 0: Records cannot span datagrams. | ||
| - 1: Records can span datagrams (default behavior). | ||
| */ | ||
| int wolfSSL_dtls_set_records_can_span_datagrams(WOLFSSL* ssl, int value); |
There was a problem hiding this comment.
Since the RFC explicitly prohibits this, I would make this a compile time const. Its not something that users are going to be changing dynamically.
Each DTLS record MUST fit within a single datagram.
|
Jenkins retest this please for long-running job |
rizlik
force-pushed
the
dtls_no_span_records
branch
3 times, most recently
from
7147388 to
72a3693
Compare
|
retest this please |
rizlik
force-pushed
the
dtls_no_span_records
branch
4 times, most recently
from
c9b5fb0 to
a81e244
Compare
|
retest this please |
changes: - alert is sent if SanityCheckCipherText fails, with or without `WOLFSSL_EXTRA_ALERTS` defined - HandleDTLSDecryptFailed is invoked if `SanityCheckCipherText` fails
test_memio read and write callbacks now respect message boundaries, ensuring data is read and written in discrete chunks as sent. Updated tests to reflect this behavior. Changelog: - Added utility functions for managing message buffers in test_memio: `test_memio_clear_buffer`, `test_memio_inject_message`, `test_memio_drop_message`, and `test_memio_modify_message_len`. - Updated tests to use these utilities for improved clarity and maintainability.
rizlik
force-pushed
the
dtls_no_span_records
branch
from
a81e244 to
2095c71
Compare
rizlik
force-pushed
the
dtls_no_span_records
branch
from
2095c71 to
1bb45f5
Compare
|
retest this please |
Description
DTLS records should not span UDP datagrams, this PR adds an API to enforce it.