File 4881-ssl-Add-missing-DTLS-over-SCTP-adaptions.p... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 4881-ssl-Add-missing-DTLS-over-SCTP-adaptions.patch of Package erlang (Revision 1e94e72e3f4fed1ca9cd5c2fd777ed02)

Currently displaying revision 1e94e72e3f4fed1ca9cd5c2fd777ed02 , Show latest

From 2c057d6b0e2393f0f062495aa68c31cd00eb9042 Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Thu, 1 Jun 2023 13:24:59 +0200
Subject: [PATCH 1/3] ssl: Add missing DTLS over SCTP adaptions

---
 lib/ssl/src/dtls_gen_connection.erl | 54 ++++++++++++++++++++---------
 1 file changed, 37 insertions(+), 17 deletions(-)

diff --git a/lib/ssl/src/dtls_gen_connection.erl b/lib/ssl/src/dtls_gen_connection.erl
index 4964d3d21f..f8d485632c 100644
--- a/lib/ssl/src/dtls_gen_connection.erl
+++ b/lib/ssl/src/dtls_gen_connection.erl
@@ -72,9 +72,8 @@
 
 %% See thread @ http://lists.cluenet.de/pipermail/ipv6-ops/2011-June/005755.html
 %% 1280 - headers
--define(PMTUEstimate, 1200).
-
-
+-define(PMTUEstimate_UDP, 1200).
+-define(PMTUEstimate_SCTP, 16384). % 2^14  RFC 6083
 
 %%====================================================================
 %% Internal application API
@@ -109,14 +108,20 @@ next_record(#state{handshake_env =
 next_record(#state{protocol_buffers =
 		       #protocol_buffers{dtls_cipher_texts = [#ssl_tls{epoch = Epoch} = CT | Rest]}
 		   = Buffers,
-		   connection_states = #{current_read := #{epoch := Epoch}} = ConnectionStates} = State) ->
+		   connection_states = #{current_read := #{epoch := Epoch}} = ConnectionStates,
+                   static_env = #static_env{data_tag = DataTag}} = State) ->
     CurrentRead = dtls_record:get_connection_state_by_epoch(Epoch, ConnectionStates, read),
-    case dtls_record:replay_detect(CT, CurrentRead) of
-        false ->
-            decode_cipher_text(State) ;
+    case is_reliable(DataTag) of
         true ->
-            %% Ignore replayed record
-            next_record(State#state{protocol_buffers = Buffers#protocol_buffers{dtls_cipher_texts = Rest}})
+            decode_cipher_text(State) ;
+        false ->
+            case dtls_record:replay_detect(CT, CurrentRead) of
+                false ->
+                    decode_cipher_text(State);
+                true ->
+                    %% Ignore replayed record
+                    next_record(State#state{protocol_buffers = Buffers#protocol_buffers{dtls_cipher_texts = Rest}})
+            end
     end;
 next_record(#state{protocol_buffers =
 		       #protocol_buffers{dtls_cipher_texts = [#ssl_tls{epoch = Epoch} | Rest]}
@@ -157,6 +162,11 @@ next_record(#state{protocol_specific = #{active_n_toggle := true,
 next_record(State) ->
     {no_record, State}.
 
+is_reliable(udp) ->
+    false;
+is_reliable(sctp) ->
+    true.
+   
 next_event(StateName, Record, State) ->
     next_event(StateName, Record, State, []).
 
@@ -245,7 +255,8 @@ new_flight() ->
       handshakes_after_change_cipher_spec => []}.
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
-                                                      transport_cb = Transport},
+                                                      transport_cb = Transport,
+                                                      data_tag = DataTag}, 
                              connection_env = #connection_env{negotiated_version = Version},
                              flight_buffer = #{handshakes := Flight,
 					       change_cipher_spec := undefined},
@@ -253,7 +264,7 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
                              ssl_options = #{log_level := LogLevel}} = State0,
                       Epoch) ->
     #{current_write := #{max_fragment_length := MaxFragmentLength}} = ConnectionStates0,
-    MaxSize = min(MaxFragmentLength, ?PMTUEstimate),
+    MaxSize = mtu(MaxFragmentLength, DataTag),
     {Encoded, ConnectionStates} =
 	encode_handshake_flight(lists:reverse(Flight), Version, MaxSize, Epoch, ConnectionStates0),
     send_packets(Transport, Socket, MaxSize, Encoded),
@@ -261,7 +272,8 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
    {State0#state{connection_states = ConnectionStates}, []};
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
-                                                      transport_cb = Transport},
+                                                      transport_cb = Transport,
+                                                      data_tag = DataTag},
                              connection_env = #connection_env{negotiated_version = Version},
 			     flight_buffer = #{handshakes := [_|_] = Flight0,
 					       change_cipher_spec := ChangeCipher,
@@ -270,7 +282,7 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
                              ssl_options = #{log_level := LogLevel}} = State0,
                       Epoch) ->
     #{current_write := #{max_fragment_length := MaxFragmentLength}} = ConnectionStates0,
-    MaxSize = min(MaxFragmentLength, ?PMTUEstimate),
+    MaxSize = mtu(MaxFragmentLength, DataTag),
     {HsBefore, ConnectionStates1} =
 	encode_handshake_flight(lists:reverse(Flight0), Version, MaxSize, Epoch, ConnectionStates0),
     {EncChangeCipher, ConnectionStates} = encode_change_cipher(ChangeCipher, Version, Epoch, ConnectionStates1),
@@ -280,7 +292,8 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
     {State0#state{connection_states = ConnectionStates}, []};
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
-                                                      transport_cb = Transport},
+                                                      transport_cb = Transport,
+                                                     data_tag = DataTag},
                              connection_env = #connection_env{negotiated_version = Version},
 			     flight_buffer = #{handshakes := [_|_] = Flight0,
 					       change_cipher_spec := ChangeCipher,
@@ -289,7 +302,7 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
                              ssl_options = #{log_level := LogLevel}} = State0,
                       Epoch) ->
     #{current_write := #{max_fragment_length := MaxFragmentLength}} = ConnectionStates0,
-    MaxSize = min(MaxFragmentLength, ?PMTUEstimate),
+    MaxSize = mtu(MaxFragmentLength, DataTag),
     {HsBefore, ConnectionStates1} =
 	encode_handshake_flight(lists:reverse(Flight0), Version, MaxSize, Epoch-1, ConnectionStates0),
     {EncChangeCipher, ConnectionStates2} = 
@@ -303,7 +316,8 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
     {State0#state{connection_states = ConnectionStates}, []};
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
-                                                      transport_cb = Transport},
+                                                      transport_cb = Transport,
+                                                      data_tag = DataTag},
                              connection_env = #connection_env{negotiated_version = Version},
 			     flight_buffer = #{handshakes := [],
 					       change_cipher_spec := ChangeCipher,
@@ -312,7 +326,7 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
                              ssl_options = #{log_level := LogLevel}} = State0,
                       Epoch) ->
     #{current_write := #{max_fragment_length := MaxFragmentLength}} = ConnectionStates0,
-    MaxSize = min(MaxFragmentLength, ?PMTUEstimate),
+    MaxSize = mtu(MaxFragmentLength, DataTag),
     {EncChangeCipher, ConnectionStates1} = 
 	encode_change_cipher(ChangeCipher, Version, Epoch-1, ConnectionStates0),
     {HsAfter, ConnectionStates} =
@@ -322,6 +336,12 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
     ssl_logger:debug(LogLevel, outbound, 'record', [HsAfter]),
     {State0#state{connection_states = ConnectionStates}, []}.
 
+
+mtu(MaxFragmentLength, udp) ->
+    min(MaxFragmentLength, ?PMTUEstimate_UDP);
+mtu(MaxFragmentLength, sctp) ->
+    min(MaxFragmentLength, ?PMTUEstimate_SCTP).
+
 %%% DTLS record protocol level application data messages 
 
 handle_protocol_record(#ssl_tls{type = ?APPLICATION_DATA, fragment = Data}, StateName0, State0) ->
-- 
2.35.3

Places

File 4881-ssl-Add-missing-DTLS-over-SCTP-adaptions.patch of Package erlang (Revision 1e94e72e3f4fed1ca9cd5c2fd777ed02)

Places