From cbc94fbdf4b877a7d2f7f7045ec2fd1c25d6c717 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Jun 2026 13:37:54 +0200 Subject: [PATCH] Don't pass badmac_limit when it would have no effect Only set `badmac_limit` on the side that actually receives a message with a bad MAC/tag (injected by the proxy). Signed-off-by: Gilles Peskine --- tests/ssl-opt.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 41280a7ab2..5b966d5a38 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -11780,7 +11780,7 @@ run_test "DTLS proxy: client: get invalid AD record then reject renego" \ -p "$P_PXY bad_ad_srv_once=1" \ "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \ renegotiate=1 renegotiation=1 exchanges=4 \ - badmac_limit=99 debug_level=3" \ + debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ exchanges=4 badmac_limit=99 debug_level=3" \ 0 \ @@ -11802,7 +11802,7 @@ run_test "DTLS proxy: server: get invalid AD record then reject renego (cli)" renegotiation=0 exchanges=4 \ badmac_limit=99 debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ - renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \ + renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \ 1 \ -s "discarding invalid record (mac)" \ -c "=> renegotiate" \ @@ -11819,7 +11819,7 @@ run_test "DTLS proxy: client: get invalid AD record then accept renego" \ -p "$P_PXY bad_ad_srv_once=1" \ "$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \ renegotiate=1 renegotiation=1 exchanges=4 \ - badmac_limit=99 debug_level=3" \ + debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \ 0 \ @@ -11839,7 +11839,7 @@ run_test "DTLS proxy: server: get invalid AD record then accept renego (srv)" renegotiate=1 renegotiation=1 exchanges=4 \ badmac_limit=99 debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ - renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \ + renegotiation=1 exchanges=4 debug_level=3" \ 0 \ -s "discarding invalid record (mac)" \ -s "=> renegotiate" \ @@ -11857,7 +11857,7 @@ run_test "DTLS proxy: server: get invalid AD record then accept renego (cli)" renegotiation=1 exchanges=4 \ badmac_limit=99 debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ - renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \ + renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \ 0 \ -s "discarding invalid record (mac)" \ -c "=> renegotiate" \ @@ -11917,7 +11917,7 @@ run_test "DTLS proxy: server: get invalid AD record then reject early renego renegotiation=0 exchanges=4 \ badmac_limit=99 debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ - renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \ + renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \ 1 \ -s "discarding invalid record (mac)" \ -c "=> renegotiate" \ @@ -11936,7 +11936,7 @@ run_test "DTLS proxy: server: get invalid AD record then accept early renego renegotiation=1 exchanges=4 \ badmac_limit=99 debug_level=3" \ "$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \ - renegotiation=1 renegotiate=2 exchanges=4 badmac_limit=99 debug_level=3" \ + renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \ 0 \ -s "discarding invalid record (mac)" \ -c "=> renegotiate" \