1296513 - DTLS record with a large sequence number gap causes DTLS to spin

Status: RESOLVED DUPLICATE of bug 1296514

(NSS :: Libraries, defect)

Description

[Martin Thomson [:mt:]]

Say that we expect to receive packet number 3.  If we instead receive packet 2^48-1, we will scroll the receive window forward one octet at a time:

http://searchfox.org/nss/rev/462a77115abebd0f3cd9cb56dbc350a25b9be706/lib/ssl/dtlscon.c#1130

I believe that it's possible to trigger this code with an unauthenticated packet.  That might only happen during the handshake, but I first ran into this with encrypted packets.

Without the patch, the test for DTLS 1.0, which uses AES, takes 5s on my machine.  I'm not patient enough to wait for the ChaCha one.

Comment 1

[Franziskus Kiefer [:franziskus]]

Looks like something went wrong here. Closing this as duplicate.