Expain rationale for handling of consecutive empty AD records
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 18a508d..a8c3de9 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -4659,8 +4659,10 @@
if( ssl->nb_zero > 3 )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
- "messages, possible DoS attack" ) );
- /* Q: Is that the right error code? */
+ "messages, possible DoS attack" ) );
+ /* Treat the records as if they were not properly authenticated,
+ * thereby failing the connection if we see more than allowed
+ * by the configured bad MAC threshold. */
return( MBEDTLS_ERR_SSL_INVALID_MAC );
}
}