Re-enable mtu assertion which previously failed for DTLS 1.3

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24524)

diff --git a/ssl/record/methods/dtls_meth.c b/ssl/record/methods/dtls_meth.c
index 8a631940ca8deb08f408a61706f37f8cd38942b8..9ecbfb9f8dcb33327f7e473551215d473d3b17d7 100644 (file)
--- a/ssl/record/methods/dtls_meth.c
+++ b/ssl/record/methods/dtls_meth.c
@@ -749,12 +749,16 @@ int dtls_post_encryption_processing(OSSL_RECORD_LAYER *rl,
 
 static size_t dtls_get_max_record_overhead(OSSL_RECORD_LAYER *rl)
 {
-    size_t blocksize = 0;
+    size_t blocksize = 0, contenttypelen = 0;
 
     if (rl->enc_ctx != NULL &&
         (EVP_CIPHER_CTX_get_mode(rl->enc_ctx) == EVP_CIPH_CBC_MODE))
         blocksize = EVP_CIPHER_CTX_get_block_size(rl->enc_ctx);
 
+    /* DTLSv1.3 adds an extra content type byte after payload data */
+    if (rl->version == DTLS1_3_VERSION)
+        contenttypelen = 1;
+
     /*
      * If we have a cipher in place then the tag is mandatory. If the cipher is
      * CBC mode then an explicit IV is also mandatory. If we know the digest,
@@ -777,7 +781,8 @@ static size_t dtls_get_max_record_overhead(OSSL_RECORD_LAYER *rl)
      * MTU size - so isn't very helpful. We just ignore potential expansion
      * due to compression.
      */
-    return DTLS1_RT_HEADER_LENGTH + rl->eivlen + blocksize + rl->taglen;
+    return DTLS1_RT_HEADER_LENGTH + rl->eivlen + blocksize + rl->taglen
+           + contenttypelen;
 }
 
 const OSSL_RECORD_METHOD ossl_dtls_record_method = {

diff --git a/ssl/statem/statem_dtls.c b/ssl/statem/statem_dtls.c
index 64e06e65b6cd4c193c6ae4e864c0240e0f6323f8..bac4ba48731f3661e257e610ba3fdf1c24f39d2b 100644 (file)
--- a/ssl/statem/statem_dtls.c
+++ b/ssl/statem/statem_dtls.c
@@ -272,11 +272,9 @@ int dtls1_do_write(SSL_CONNECTION *s, uint8_t type)
              * because in a production build, if this assert were ever to fail,
              * then the best thing to do is probably carry on regardless.
              */
-#if 0
-            /* TODO(DTLS-1.3): Re-enable this assert. */
             assert(s->s3.tmp.new_compression != NULL
                    || BIO_wpending(s->wbio) <= (int)s->d1->mtu);
-#endif
+
             if (type == SSL3_RT_HANDSHAKE && !s->d1->retransmitting) {
                 /*
                  * should not be done for 'Hello Request's, but in that case