Expain rationale for handling of consecutive empty AD records
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index d7291fe..1faac07 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5081,8 +5081,10 @@
if( ssl->nb_zero > 3 )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
- "messages, possible DoS attack" ) );
- /* Q: Is that the right error code? */
+ "messages, possible DoS attack" ) );
+ /* Treat the records as if they were not properly authenticated,
+ * thereby failing the connection if we see more than allowed
+ * by the configured bad MAC threshold. */
return( MBEDTLS_ERR_SSL_INVALID_MAC );
}
}