diff options
| author | Ingela Anderton Andin <[email protected]> | 2017-08-10 17:05:42 +0200 |
|---|---|---|
| committer | Ingela Anderton Andin <[email protected]> | 2017-08-14 10:59:55 +0200 |
| commit | 6bd79e8f543da4777ba872a0edeaae8a9a90d5a8 (patch) | |
| tree | 1262f7f23b91637e0f4c69eaf5a5680044925621 /lib/ssl/test/ssl_basic_SUITE.erl | |
| parent | 6b293df5e86e85b255d3ccf55f83bd847867679f (diff) | |
| download | otp-6bd79e8f543da4777ba872a0edeaae8a9a90d5a8.tar.gz otp-6bd79e8f543da4777ba872a0edeaae8a9a90d5a8.tar.bz2 otp-6bd79e8f543da4777ba872a0edeaae8a9a90d5a8.zip | |
dtls: Customize alert handling for DTLS over UDP
From RFC 6347:
4.1.2.7. Handling Invalid Records
Unlike TLS, DTLS is resilient in the face of invalid records (e.g.,
invalid formatting, length, MAC, etc.). In general, invalid
records SHOULD be silently discarded, thus preserving the
association; however, an error MAY be logged for diagnostic
purposes. Implementations which choose to generate an alert
instead, MUST generate fatal level alerts to avoid attacks where
the attacker repeatedly probes the implementation to see how it
responds to various types of error. Note that if DTLS is run over
UDP, then any implementation which does this will be extremely
susceptible to denial-of-service (DoS) attacks because UDP forgery
is so easy. Thus, this practice is NOT RECOMMENDED for such
transports.
Diffstat (limited to 'lib/ssl/test/ssl_basic_SUITE.erl')
| -rw-r--r-- | lib/ssl/test/ssl_basic_SUITE.erl | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl index 12d255a5bc..cb70ccc2c5 100644 --- a/lib/ssl/test/ssl_basic_SUITE.erl +++ b/lib/ssl/test/ssl_basic_SUITE.erl @@ -518,7 +518,7 @@ alerts() -> [{doc, "Test ssl_alert:alert_txt/1"}]. alerts(Config) when is_list(Config) -> Descriptions = [?CLOSE_NOTIFY, ?UNEXPECTED_MESSAGE, ?BAD_RECORD_MAC, - ?DECRYPTION_FAILED, ?RECORD_OVERFLOW, ?DECOMPRESSION_FAILURE, + ?DECRYPTION_FAILED_RESERVED, ?RECORD_OVERFLOW, ?DECOMPRESSION_FAILURE, ?HANDSHAKE_FAILURE, ?BAD_CERTIFICATE, ?UNSUPPORTED_CERTIFICATE, ?CERTIFICATE_REVOKED,?CERTIFICATE_EXPIRED, ?CERTIFICATE_UNKNOWN, ?ILLEGAL_PARAMETER, ?UNKNOWN_CA, ?ACCESS_DENIED, ?DECODE_ERROR, |