DTLS: add api to enforce records do not span datagrams #8642
Conversation
tests/api/test_dtls.c
Outdated
| WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; | ||
| WOLFSSL *ssl_c = NULL, *ssl_s = NULL; | ||
| struct test_memio_ctx test_ctx; | ||
| char * readBuf[50]; |
There was a problem hiding this comment.
The declaration of 'readBuf' as an array of char pointers is likely incorrect for use with wolfSSL_read, which expects a contiguous byte buffer. Consider changing it to 'unsigned char readBuf[50];' or 'char readBuf[50];' if signedness is not an issue.
| char * readBuf[50]; | |
| unsigned char readBuf[50]; |
Copilot is powered by AI, so mistakes are possible. Review output carefully before use.
tests/api/test_dtls.c
Outdated
| WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL; | ||
| WOLFSSL *ssl_c = NULL, *ssl_s = NULL; | ||
| struct test_memio_ctx test_ctx; | ||
| char * readBuf[50]; |
There was a problem hiding this comment.
The declaration of 'readBuf' as an array of char pointers is likely unintended here, as wolfSSL_read is expected to write raw bytes into a contiguous buffer. Consider using 'unsigned char readBuf[50];' or 'char readBuf[50];' to avoid potential memory issues.
| char * readBuf[50]; | |
| unsigned char readBuf[50]; |
Copilot is powered by AI, so mistakes are possible. Review output carefully before use.
rizlik
force-pushed
the
dtls_no_span_records
branch
4 times, most recently
from
c818750 to
b8c12fb
Compare
|
retest this |
| - 0: Records cannot span datagrams. | ||
| - 1: Records can span datagrams (default behavior). | ||
| */ | ||
| int wolfSSL_dtls_set_records_can_span_datagrams(WOLFSSL* ssl, int value); |
There was a problem hiding this comment.
Since the RFC explicitly prohibits this, I would make this a compile time const. Its not something that users are going to be changing dynamically.
Each DTLS record MUST fit within a single datagram.
|
Jenkins retest this please for long-running job |
rizlik
force-pushed
the
dtls_no_span_records
branch
2 times, most recently
from
cbab2d0 to
7147388
Compare
changes: - alert is sent if SanityCheckCipherText fails, with or without `WOLFSSL_EXTRA_ALERTS` defined - HandleDTLSDecryptFailed is invoked if `SanityCheckCipherText` fails
rizlik
force-pushed
the
dtls_no_span_records
branch
from
7147388 to
72a3693
Compare
|
retest this please |
Description
DTLS records should not span UDP datagrams, this PR adds an API to enforce it.