1

I am trying to achieve DTLS over SCTP using OpenSSL with c++ on Linux (Fedora21 x86_64)

Problematic Code:

BIO *sbio=BIO_new_dgram_sctp( m_sctp_socket,BIO_NOCLOSE)

Could you please let me know on why OpenSSL is asserting ?

Crashing frame:

#0  0x00007f86fbed98d7 in __GI_raise (sig=sig@entry=6) at    ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f86fbedb53a in __GI_abort () at abort.c:89
#2  0x00007f86fcf7512f in OpenSSLDie () from /lib64/libcrypto.so.1.0.0
#3  0x00007f86fd028c3a in BIO_new_dgram_sctp () from /lib64/libcrypto.so.1.0.0

Gettting the below assertion message runtime at BIO_new_dgram_sctp()

bss_dgram.c(1041): OpenSSL internal error, assertion failed: auth_data

SCTP support in kernel checked:

[blackmamba@fedora21]$ checksctp
SCTP supported

Enabled auth chunk in sysctl 

net.sctp.auth_enable = 1

OpenSSL version

OpenSSL 1.0.2a 19 Mar 2015
Black Mamba
  • 31
  • 2
  • OpenSSL often does not validate, so my first guess would be `m_sctp_socket` is not valid. You should probably grab Master from Git (since you are using 1.0.2a). I know there's been some fixes checked in recently for DTLS in general. Also see this discussion about DTLS and BIOs on the OpenSSL mailing list: [DTLS and packet loss](http://openssl.6102.n7.nabble.com/openssl-users-DTLS-and-packet-loss-td58394.html) and [DTLS fragmentation and mem BIO](http://openssl.6102.n7.nabble.com/openssl-users-DTLS-fragmentation-and-mem-BIO-td58462.html). – jww Jun 06 '15 at 22:49

1 Answers1

0

I was facing this problem and then issue got resolved after i call an API "BIO_new_dgram_sctp" on listener socket just before accepting new connections.

    try
    {
        ivSocket->doListen();
    }
    catch(SocketException& anException)
    {
        //Destroy this thread
        _close();
    }


    /* If security is enabled */
    if ((ivSecurity == eTLS) && (ivTransport == eSCTP))
    {
      /* Create DTLS/SCTP BIO and connect */
      BIO *bio = BIO_new_dgram_sctp(ivSocket->getSocketId(), BIO_CLOSE);        
    }

    /* call select on read and write FD's */
    /* Accept new connection that returns new FD and then call SSL_Accept for new FD */
mahesh gs
  • 61
  • 2