eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge 'iotssl-1099-incorrect-renego-dtls'

Browse source 
Fix an incorrect condition in ssl_check_ctr_renegotiate() that compared
64 bits of record counter instead of 48 bits as described in RFC 6347
Section 4.3.1. This would cause the function's return value to be
occasionally incorrect and the renegotiation routines to be triggered
at unexpected times.
This commit is contained in:
Simon Butcher 2017-02-02 23:47:08 +00:00
commit 1d4db5b7b5
5 changed files with 55 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/mbedtls/ssl.h
View file

@ -2183,7 +2183,7 @@ void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_
/**
* \brief Set record counter threshold for periodic renegotiation.
* (Default: 2^64 - 256.)
* (Default: 2^48 - 1)
*
* Renegotiation is automatically triggered when a record
* counter (outgoing or ingoing) crosses the defined
@ -2194,9 +2194,11 @@ void mbedtls_ssl_conf_renegotiation_enforced( mbedtls_ssl_config *conf, int max_
* Lower values can be used to enforce policies such as "keys
* must be refreshed every N packets with cipher X".
*
* \note When the transport is set to MBEDTLS_SSL_TRANSPORT_DATAGRAM,
* the maximum renegotiation period is 2^48 - 1.
*
* \param conf SSL configuration
* \param period The threshold value: a big-endian 64-bit number.
* Set to 2^64 - 1 to disable periodic renegotiation
*/
void mbedtls_ssl_conf_renegotiation_period( mbedtls_ssl_config *conf,
const unsigned char period[8] );