Expain rationale for handling of consecutive empty AD records
@@ -5082,7 +5082,9 @@ static int ssl_prepare_record_content( mbedtls_ssl_context *ssl )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
"messages, possible DoS attack" ) );
- /* Q: Is that the right error code? */
+ /* Treat the records as if they were not properly authenticated,
+ * thereby failing the connection if we see more than allowed
+ * by the configured bad MAC threshold. */
return( MBEDTLS_ERR_SSL_INVALID_MAC );
}
}
