commit 2fad94b1931dfb3a86f257bda10a1edc1e3d364d
author Andres Amaya Garcia <andres.amayagarcia@arm.com> Mon Jun 26 15:11:59 2017 +0100
committer Simon Butcher <simon.butcher@arm.com> Thu Sep 14 20:18:37 2017 +0100
tree 38ac29b97e17788eb479b3af2f7ccf0a86bb6b5f
parent 72ea31b026e1fc61b01662474aa5125817b968bc

Dont send alert on invalid DTLS record type

Do not send fatal alerts when receiving a record with an invalid header
while running DTLS as this is not compliant behaviour.

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 661ae70..7dd55bf 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -3493,8 +3493,13 @@
         ssl->in_msgtype != MBEDTLS_SSL_MSG_APPLICATION_DATA )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
-        mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
-                                        MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
+
+#if defined(MBEDTLS_SSL_PROTO_DTLS)
+        if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+#endif /* MBEDTLS_SSL_PROTO_DTLS */
+            mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                    MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
+
         return( MBEDTLS_ERR_SSL_INVALID_RECORD );
     }