Merge pull request #9662 from gilles-peskine-arm/dtls_server-allow_unexpected_message_on_second_handshake-dev
dtls_server: allow unexpected message on second handshake
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c
index 20e53d3..6430ed2 100644
--- a/programs/ssl/dtls_server.c
+++ b/programs/ssl/dtls_server.c
@@ -289,7 +289,14 @@
ret = 0;
goto reset;
} else if (ret != 0) {
- printf(" failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", (unsigned int) -ret);
+ printf(" failed\n ! mbedtls_ssl_handshake returned -0x%x\n", (unsigned int) -ret);
+ if (ret == MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE) {
+ printf(" An unexpected message was received from our peer. If this happened at\n");
+ printf(" the beginning of the handshake, this is likely a duplicated packet or\n");
+ printf(" a close_notify alert from the previous connection, which is harmless.\n");
+ ret = 0;
+ }
+ printf("\n");
goto reset;
}
diff --git a/tests/opt-testcases/sample.sh b/tests/opt-testcases/sample.sh
index e2eaf24..88f3b12 100644
--- a/tests/opt-testcases/sample.sh
+++ b/tests/opt-testcases/sample.sh
@@ -334,11 +334,6 @@
-S "error" \
-C "ERROR"
-# The server complains of extra data after it closes the connection
-# because the client keeps sending data, so the server receives
-# more application data when it expects a new handshake. We consider
-# the test a success if both sides have sent and received application
-# data, no matter what happens afterwards.
run_test "Sample: dtls_client with dtls_server" \
-P 4433 \
"$PROGRAMS_DIR/dtls_server" \
@@ -348,13 +343,9 @@
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
+ -S "error" \
-C "error"
-# The server complains of extra data after it closes the connection
-# because the client keeps sending data, so the server receives
-# more application data when it expects a new handshake. We consider
-# the test a success if both sides have sent and received application
-# data, no matter what happens afterwards.
run_test "Sample: ssl_client2, dtls_server" \
-P 4433 \
"$PROGRAMS_DIR/dtls_server" \
@@ -364,6 +355,7 @@
-s "[1-9][0-9]* bytes written" \
-c "[1-9][0-9]* bytes read" \
-c "[1-9][0-9]* bytes written" \
+ -S "error" \
-C "error"
requires_protocol_version dtls12