From 6a662a45f3d15ae6d0cd895320d21a566fb55fea Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Thu, 1 Sep 2011 14:01:36 +0000 Subject: [PATCH] PR: 2573 Submitted by: Robin Seggelmann Reviewed by: steve Fix DTLS buffering and decryption bug. --- ssl/d1_pkt.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index b840a15a12..e4f47e98e6 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -369,13 +369,13 @@ dtls1_process_record(SSL *s) enc_err = s->method->ssl3_enc->enc(s,0); if (enc_err <= 0) { - if (enc_err == 0) - /* SSLerr() and ssl3_send_alert() have been called */ - goto err; - - /* otherwise enc_err == -1 */ - al=SSL_AD_BAD_RECORD_MAC; - goto f_err; + /* decryption failed, silently discard message */ + if (enc_err < 0) + { + rr->length = 0; + s->packet_length = 0; + } + goto err; } #ifdef TLS_DEBUG @@ -616,10 +616,12 @@ again: /* If this record is from the next epoch (either HM or ALERT), * and a handshake is currently in progress, buffer it since it - * cannot be processed at this time. */ + * cannot be processed at this time. However, do not buffer + * anything while listening. + */ if (is_next_epoch) { - if (SSL_in_init(s) || s->in_handshake) + if ((SSL_in_init(s) || s->in_handshake) && !s->d1->listen) { dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), &rr->seq_num); } -- 2.25.1