When the underlying BIO_write() fails to send a datagram, we leave the
offending record queued as 'pending'. The DTLS code doesn't expect this,
and we end up hitting an OPENSSL_assert() in do_dtls1_write().
The simple fix is just _not_ to leave it queued. In DTLS, dropping
packets is perfectly acceptable -- and even preferable. If we wanted a
service with retries and guaranteed delivery, we'd be using TCP.
PR: #1703
Submitted by: David Woodhouse <dwmw2@infradead.org>
diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index 7593ad9..1d6760e 100644
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -828,8 +828,16 @@
s->rwstate=SSL_NOTHING;
return(s->s3->wpend_ret);
}
- else if (i <= 0)
+ else if (i <= 0) {
+ if (s->version == DTLS1_VERSION ||
+ s->version == DTLS1_BAD_VER) {
+ /* For DTLS, just drop it. That's kind of the wh
+ole
+ point in using a datagram service */
+ wb->left = 0;
+ }
return(i);
+ }
wb->offset+=i;
wb->left-=i;
}
