search

ktls / af_ktls

Linux Kernel TLS/DTLS Module
GNU General Public License v2.0
157 stars 25 forks source link

DTLS sliding window improvements #49

Closed nmav closed 8 years ago

nmav commented 8 years ago

This set of patches improves the DTLS sliding window handling.

fridex commented 8 years ago

dtls-sw: handle separately the case of uninitialized window That is handle the case where the sliding window is uninitialized and a packet with sequence number of zero is received.

I am not sure here, when this can occur?

nmav commented 8 years ago

dtls-sw: handle separately the case of uninitialized window That is handle the case where the sliding window is uninitialized and a packet with sequence number of zero is received. I am not sure here, when this can occur?

On the first received packet on an epoch, which will have seq nr 0 and will be rejected as only values > start are accepted. I believe it has not been noticed with af_ktls because you don't see the first packet at all (it is the finished message). I found that issue when trying this implementation on gnutls.

fridex commented 8 years ago

Ah, now I see.

Should we merge it here? I would like to keep the implementation minimal and this (if I understand correctly) shouldn't occur in AF_KTLS since we will receive only application data - this should be handled in user space during the handshake?

Nevertheless using fixed size values in dtls_window is meaningful in my opinion.

nmav commented 8 years ago

Should we merge it here? I would like to keep the implementation minimal and this (if I understand correctly) shouldn't occur in AF_KTLS since we will receive only application data - this should be handled in user space during the handshake?

I cannot think of any case where that will be needed. It would be nice to have a comment about this limitation though.

nmav commented 8 years ago

I'll update the patches to remove that.