Skip to content

Correct reassembly logic in sniffer. Fix handshake message size in BuildCertificateStatus. Ensure MTU is set properly when using SCTP with DTLS. Improve SCTP examples. #11211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kareem-wolfssl wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Correct reassembly logic in sniffer. Fix handshake message size in BuildCertificateStatus. Ensure MTU is set properly when using SCTP with DTLS. Improve SCTP examples. #11211

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c78077a
Correct reassembly logic in sniffer and add test.
kareem-wolfssl Aug 19, 2026
325d785
Fix handshake message size in BuildCertificateStatus and add test.
kareem-wolfssl Aug 19, 2026
d786efc
Ensure MTU is set properly when using SCTP with DTLS. Add return cod…
kareem-wolfssl Aug 19, 2026
7cd32b7
Code review feedback
kareem-wolfssl Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 35 additions & 10 deletions examples/sctp/sctp-client-dtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,17 @@ static int err_sys(const char* msg)
perror(msg);
exit(EXIT_FAILURE);
}

/* errno says nothing about a wolfSSL failure, so report the library error. */
static void err_ssl(WOLFSSL* ssl, int ret, const char* msg)
{
char buf[WOLFSSL_MAX_ERROR_SZ];

fprintf(stderr, "%s: %s\n", msg,
wolfSSL_ERR_error_string((unsigned long)wolfSSL_get_error(ssl, ret),
buf));
exit(EXIT_FAILURE);
}
#endif /* WOLFSSL_SCTP && WOLFSSL_DTLS && !WOLFSSL_NO_TLS12 */

int main(int argc, char **argv)
Expand Down Expand Up @@ -101,30 +112,44 @@ int main(int argc, char **argv)
printf("Cipher Suite is %s\n",
wolfSSL_CIPHER_get_name(wolfSSL_get_current_cipher(ssl)));

wolfSSL_write(ssl, response, (int)strlen(response));
int len = (int)strlen(response);
ret = wolfSSL_write(ssl, response, len);
if (ret != len)
err_ssl(ssl, ret, "ssl write failed");

int got = wolfSSL_read(ssl, buffer, sizeof(buffer) - 1);
if (got > 0) {
buffer[got] = 0;
printf("server said: %s\n", buffer);
}
if (got <= 0)
err_ssl(ssl, got, "ssl read failed");
buffer[got] = 0;
printf("server said: %s\n", buffer);

unsigned char bigBuf[4096];
unsigned int i;

for (i = 0; i < (int)sizeof(bigBuf); i++)
for (i = 0; i < sizeof(bigBuf); i++)
bigBuf[i] = (unsigned char)(i & 0xFF);
wolfSSL_write(ssl, bigBuf, sizeof(bigBuf));

ret = wolfSSL_write(ssl, bigBuf, sizeof(bigBuf));
if (ret != (int)sizeof(bigBuf))
err_ssl(ssl, ret, "ssl write of big message failed");
memset(bigBuf, 0, sizeof(bigBuf));

wolfSSL_read(ssl, bigBuf, sizeof(bigBuf));
ret = wolfSSL_read(ssl, bigBuf, sizeof(bigBuf));
if (ret != (int)sizeof(bigBuf))
err_ssl(ssl, ret, "ssl read of big message failed");
for (i = 0; i < sizeof(bigBuf); i++) {
if (bigBuf[i] != (unsigned char)(i & 0xFF)) {
fprintf(stderr, "big message check fail\n");
break;
exit(EXIT_FAILURE);
}
}

wolfSSL_shutdown(ssl);
ret = wolfSSL_shutdown(ssl);
if (ret == WOLFSSL_SHUTDOWN_NOT_DONE)
ret = wolfSSL_shutdown(ssl);
if (ret != WOLFSSL_SUCCESS)
err_ssl(ssl, ret, "ssl shutdown failed");

wolfSSL_free(ssl);
wolfSSL_CTX_free(ctx);

Expand Down
42 changes: 34 additions & 8 deletions examples/sctp/sctp-server-dtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,17 @@ static int err_sys(const char* msg)
perror(msg);
exit(EXIT_FAILURE);
}

/* errno says nothing about a wolfSSL failure, so report the library error. */
static void err_ssl(WOLFSSL* ssl, int ret, const char* msg)
{
char buf[WOLFSSL_MAX_ERROR_SZ];

fprintf(stderr, "%s: %s\n", msg,
wolfSSL_ERR_error_string((unsigned long)wolfSSL_get_error(ssl, ret),
buf));
exit(EXIT_FAILURE);
}
#endif /* WOLFSSL_SCTP && WOLFSSL_DTLS && !WOLFSSL_NO_TLS12 */

int main(int argc, char **argv)
Expand Down Expand Up @@ -113,18 +124,33 @@ int main(int argc, char **argv)
wolfSSL_CIPHER_get_name(wolfSSL_get_current_cipher(ssl)));

int got = wolfSSL_read(ssl, buffer, sizeof(buffer) - 1);
if (got > 0) {
buffer[got] = 0;
printf("client said: %s\n", buffer);
}
wolfSSL_write(ssl, response, (int)strlen(response));
if (got <= 0)
err_ssl(ssl, got, "ssl read failed");
buffer[got] = 0;
printf("client said: %s\n", buffer);

int len = (int)strlen(response);
ret = wolfSSL_write(ssl, response, len);
if (ret != len)
err_ssl(ssl, ret, "ssl write failed");

unsigned char bigBuf[4096];

wolfSSL_read(ssl, bigBuf, sizeof(bigBuf));
wolfSSL_write(ssl, bigBuf, sizeof(bigBuf));
ret = wolfSSL_read(ssl, bigBuf, sizeof(bigBuf));
if (ret != (int)sizeof(bigBuf))
err_ssl(ssl, ret, "ssl read of big message failed");
ret = wolfSSL_write(ssl, bigBuf, sizeof(bigBuf));
if (ret != (int)sizeof(bigBuf))
err_ssl(ssl, ret, "ssl write of big message failed");

/* Wait for the peer's close_notify so the socket is not torn down under
* the client while it is still shutting down. */
ret = wolfSSL_shutdown(ssl);
if (ret == WOLFSSL_SHUTDOWN_NOT_DONE)
ret = wolfSSL_shutdown(ssl);
if (ret != WOLFSSL_SUCCESS)
err_ssl(ssl, ret, "ssl shutdown failed");

wolfSSL_shutdown(ssl);
wolfSSL_free(ssl);
wolfSSL_CTX_free(ctx);

Expand Down
17 changes: 13 additions & 4 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28192,8 +28192,10 @@ static int BuildCertificateStatus(WOLFSSL* ssl, byte type, buffer* status,
XMEMCPY(output + idx, status[i].buffer, status[i].length);
idx += status[i].length;
}
/* Send Message. Handled message fragmentation in the function if needed */
ret = SendHandshakeMsg(ssl, output, (sendSz - headerSz), certificate_status,
/* Send Message. Handled message fragmentation in the function if needed.
* idx is the fill cursor, so idx - headerSz is the body actually written.
* sendSz may carry the cipher expansion slack on top of it. */
ret = SendHandshakeMsg(ssl, output, (idx - headerSz), certificate_status,
"Certificate Status");
XFREE(output, ssl->heap, DYNAMIC_TYPE_OCSP);

Expand Down Expand Up @@ -28981,10 +28983,17 @@ int SendData(WOLFSSL* ssl, const void* data, size_t sz)
}
#if defined(WOLFSSL_DTLS)
if (ssl->options.dtls) {
int mtu;

#if defined(WOLFSSL_DTLS_MTU)
int mtu = ssl->dtlsMtuSz;
mtu = ssl->dtlsMtuSz;
#elif defined(WOLFSSL_SCTP)
/* An SCTP association is a reliable stream, so it is bounded by
* the configured record size rather than by a datagram MTU. A
* connection that never enabled SCTP still is. */
mtu = IsDtlsNotSctpMode(ssl) ? MAX_MTU : ssl->dtlsMtuSz;
#else
int mtu = MAX_MTU;
mtu = MAX_MTU;
#endif
outputSz = wolfssl_local_GetRecordSize(ssl, (word32)buffSz, 1);
if (outputSz > mtu) {
Expand Down
93 changes: 42 additions & 51 deletions src/sniffer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5831,6 +5831,44 @@ static int AddFinCapture(SnifferSession* session, word32 sequence)
return 1;
}

/* Trim an in-order frame against the head of the reassembly list and queue
* anything that reaches past it.
* On entry *sslFrame is positioned at 'expected' and holds *sslBytes bytes. */
static void TrimAgainstReassembly(SnifferSession* session,
PacketBuffer* reassemblyList, word32 expected,
int* sslBytes, const byte** sslFrame,
char* error)
{
word32 newEnd;

if (*sslBytes <= 0)
return;
/* newEnd is one past the frame's last byte, while a list entry's begin and
* end are both inclusive. */
newEnd = expected + (word32)*sslBytes;

if (newEnd > reassemblyList->begin) {
Trace(OVERLAP_REASSEMBLY_BEGIN_STR);

/* keep only what comes before the list entry, the rest is already
held */
*sslBytes = (reassemblyList->begin > expected) ?
(int)(reassemblyList->begin - expected) : 0;
}
if ((reassemblyList->end >= expected) &&
(newEnd - 1 > reassemblyList->end)) {
/* may be past reassembly list end (could have more on list)
so try to add what's past the front->end */
word32 offset = reassemblyList->end - expected + 1;

Trace(OVERLAP_REASSEMBLY_END_STR);

AddToReassembly(session->flags.side, reassemblyList->end + 1,
*sslFrame + offset,
(int)(newEnd - reassemblyList->end - 1), session, error);
}
}

/* Adjust incoming sequence based on side */
/* returns 0 on success (continue), -1 on error, 1 on success (end) */
static int AdjustSequence(TcpInfo* tcpInfo, SnifferSession* session,
Expand Down Expand Up @@ -5868,37 +5906,13 @@ static int AdjustSequence(TcpInfo* tcpInfo, SnifferSession* session,
Trace(OVERLAP_DUPLICATE_STR);
}

/* The following conditional block is duplicated below. It is the
* same action but for a different setup case. If changing this
* block be sure to also update the block below. */
if (reassemblyList) {
word32 newEnd;

/* adjust to expected, remove duplicate */
*sslFrame += overlap;
*sslBytes = (*sslBytes > overlap) ? *sslBytes - overlap : 0;

newEnd = *expected + *sslBytes;
if (newEnd > reassemblyList->begin) {
int covered_data_len;

Trace(OVERLAP_REASSEMBLY_BEGIN_STR);

/* remove bytes already on reassembly list */
covered_data_len = newEnd - reassemblyList->begin;
*sslFrame += covered_data_len;
*sslBytes = (*sslBytes > covered_data_len) ?
*sslBytes - covered_data_len : 0;
}
if ((*sslBytes > 0) && (newEnd > reassemblyList->end)) {
Trace(OVERLAP_REASSEMBLY_END_STR);

/* may be past reassembly list end (could have more on list)
so try to add what's past the front->end */
AddToReassembly(session->flags.side, reassemblyList->end + 1,
*sslFrame + (reassemblyList->end - *expected + 1),
newEnd - reassemblyList->end, session, error);
}
TrimAgainstReassembly(session, reassemblyList, *expected,
sslBytes, sslFrame, error);
}
else if (*sslBytes > 0) {
if (real + *sslBytes - 1 > *seqLast) {
Expand Down Expand Up @@ -5964,32 +5978,9 @@ static int AdjustSequence(TcpInfo* tcpInfo, SnifferSession* session,
*sslFrame, *sslBytes, session, error);
ret = 0;
}
/* The following conditional block is duplicated above. It is the
* same action but for a different setup case. If changing this
* block be sure to also update the block above. */
else if (reassemblyList) {
word32 newEnd = *expected + *sslBytes;

if (newEnd > reassemblyList->begin) {
int covered_data_len;

Trace(OVERLAP_REASSEMBLY_BEGIN_STR);

/* remove bytes already on reassembly list */
covered_data_len = newEnd - reassemblyList->begin;
*sslFrame += covered_data_len;
*sslBytes = (*sslBytes > covered_data_len) ?
*sslBytes - covered_data_len : 0;
}
if ((*sslBytes > 0) && (newEnd > reassemblyList->end)) {
Trace(OVERLAP_REASSEMBLY_END_STR);

/* may be past reassembly list end (could have more on list)
so try to add what's past the front->end */
AddToReassembly(session->flags.side, reassemblyList->end + 1,
*sslFrame + (reassemblyList->end - *expected + 1),
newEnd - reassemblyList->end, session, error);
}
TrimAgainstReassembly(session, reassemblyList, *expected, sslBytes,
sslFrame, error);
}
}
else {
Expand Down
Loading
Loading