[gnutls-help] 0-length handshake fragments with DTLS

Tue Sep 2 18:18:20 CEST 2014

On 02/09/2014 17:34, Nikos Mavrogiannopoulos wrote:
> It doesn't look like a feature either. Is there some way to easily
> reproduce that?
>
Using the certificate and key below, with gnutls 3.3.7, run:

gnutls-serv --x509certfile below.crt --x509keyfile below.key -u --mtu 104

and connect with gnutls-cli -u --insecure localhost

If everything goes as expected, the server's Certificate message will be 553
bytes long and split in 7 fragments of length 79, plus one fragment with offset
553 and length 0. This can be observed using wireshark for example. (Wireshark
flags this as an error "new fragment overlaps old data", which should rather be
a warning IMO.)

By the way, with the above test gnutls-cli says

|<1>| Invalid handshake packet headers. Discarding.

which might or might not be related.

hth,
Manuel.