cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-11-04 04:32:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

Split the maximum fragment length into two - an input and output MFL

Browse Source 
Since the server might want to have a different maximum fragment length
for the outgoing messages than the negotiated one - introduce a new way of
computing it. This commit also adds additional ssl-opt.sh tests ensuring
that the maximum fragment lengths are set as expected. 
mbedtls_ssl_get_max_frag_len() is now a deprecated function,
being an alias to mbedtls_ssl_get_output_max_frag_len(). The behaviour
of this function is the same as before.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
This commit is contained in:
Andrzej Kurek 2020-04-03 05:25:29 -04:00
parent d4a720f541
commit 90c6e84a9c
No known key found for this signature in database
GPG Key ID: 89A90840DC388527
8 changed files with 328 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -5,6 +5,10 @@ mbed TLS ChangeLog (Sorted per branch, date)
New deprecations New deprecations
* Deprecate MBEDTLS_SSL_HW_RECORD_ACCEL that enables function hooks in the * Deprecate MBEDTLS_SSL_HW_RECORD_ACCEL that enables function hooks in the
SSL module for hardware acceleration of individual records. SSL module for hardware acceleration of individual records.
* Deprecate mbedtls_ssl_get_max_frag_len() in favour of
mbedtls_ssl_get_output_max_frag_len() and
mbedtls_ssl_get_input_max_frag_len() to be more precise about which max
fragment length is desired.
Bugfix Bugfix
* Fix compilation failure when both MBEDTLS_SSL_PROTO_DTLS and * Fix compilation failure when both MBEDTLS_SSL_PROTO_DTLS and
@ -13,6 +17,11 @@ Bugfix
Changes Changes
* Mbed Crypto is no longer a Git submodule. The crypto part of the library * Mbed Crypto is no longer a Git submodule. The crypto part of the library
is back directly in the present repository. is back directly in the present repository.
* Split mbedtls_ssl_get_max_frag_len() into
mbedtls_ssl_get_output_max_frag_len() and
mbedtls_ssl_get_input_max_frag_len() to ensure that a sufficient input
buffer is allocated by the server (if MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
is defined), regardless of what MFL was configured for it.
= mbed TLS 2.21.0 branch released 2020-02-20 = mbed TLS 2.21.0 branch released 2020-02-20

60
include/mbedtls/ssl.h
View File

@ -3523,18 +3523,61 @@ int mbedtls_ssl_get_record_expansion( const mbedtls_ssl_context *ssl );
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
/** /**
* \brief Return the maximum fragment length (payload, in bytes). * \brief Return the maximum fragment length (payload, in bytes) for
* This is the value negotiated with peer if any, * the output buffer. For the client, this is the configured
* or the locally configured value. * value. For the server, it is the minimum of two - the
* configured value and the negotiated one.
* *
* \sa mbedtls_ssl_conf_max_frag_len() * \sa mbedtls_ssl_conf_max_frag_len()
* \sa mbedtls_ssl_get_max_record_payload() * \sa mbedtls_ssl_get_max_record_payload()
* *
* \param ssl SSL context * \param ssl SSL context
* *
* \return Current maximum fragment length. * \return Current maximum fragment length for the output buffer.
*/ */
size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl ); size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl );
/**
* \brief Return the maximum fragment length (payload, in bytes) for
* the input buffer. This is the negotiated maximum fragment
* length, or, if there is none, MBEDTLS_SSL_MAX_CONTENT_LEN.
* If it is not defined either, the value is 2^14. This function
* works as its predecessor, \c mbedtls_ssl_get_max_frag_len().
*
* \sa mbedtls_ssl_conf_max_frag_len()
* \sa mbedtls_ssl_get_max_record_payload()
*
* \param ssl SSL context
*
* \return Current maximum fragment length for the output buffer.
*/
size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl );
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
#if defined(MBEDTLS_DEPRECATED_WARNING)
#define MBEDTLS_DEPRECATED __attribute__((deprecated))
#else
#define MBEDTLS_DEPRECATED
#endif
/**
* \brief This function is a deprecated approach to getting the max
* fragment length. Its an alias for
* \c mbedtls_ssl_get_output_max_frag_len(), as the behaviour
* is the same. See \c mbedtls_ssl_get_output_max_frag_len() for
* more detail.
*
* \sa mbedtls_ssl_get_input_max_frag_len()
* \sa mbedtls_ssl_get_output_max_frag_len()
*
* \param ssl SSL context
*
* \return Current maximum fragment length for the output buffer.
*/
MBEDTLS_DEPRECATED size_t mbedtls_ssl_get_max_frag_len(
const mbedtls_ssl_context *ssl );
#endif /* MBEDTLS_DEPRECATED_REMOVED */
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
/** /**
@ -3555,7 +3598,8 @@ size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl );
* when record compression is enabled. * when record compression is enabled.
* *
* \sa mbedtls_ssl_set_mtu() * \sa mbedtls_ssl_set_mtu()
* \sa mbedtls_ssl_get_max_frag_len() * \sa mbedtls_ssl_get_output_max_frag_len()
* \sa mbedtls_ssl_get_input_max_frag_len()
* \sa mbedtls_ssl_get_record_expansion() * \sa mbedtls_ssl_get_record_expansion()
* *
* \param ssl SSL context * \param ssl SSL context
@ -3863,8 +3907,8 @@ int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
* or negotiated with the peer), then: * or negotiated with the peer), then:
* - with TLS, less bytes than requested are written. * - with TLS, less bytes than requested are written.
* - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned. * - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned.
* \c mbedtls_ssl_get_max_frag_len() may be used to query the * \c mbedtls_ssl_get_output_max_frag_len() may be used to
* active maximum fragment length. * query the active maximum fragment length.
* *
* \note Attempting to write 0 bytes will result in an empty TLS * \note Attempting to write 0 bytes will result in an empty TLS
* application record being sent. * application record being sent.

8
include/mbedtls/ssl_internal.h
View File

@ -260,11 +260,11 @@
static inline uint32_t mbedtls_ssl_get_output_buflen( const mbedtls_ssl_context *ctx ) static inline uint32_t mbedtls_ssl_get_output_buflen( const mbedtls_ssl_context *ctx )
{ {
#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID) #if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID)
return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx ) return (uint32_t) mbedtls_ssl_get_output_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD
+ MBEDTLS_SSL_CID_OUT_LEN_MAX; + MBEDTLS_SSL_CID_OUT_LEN_MAX;
#else #else
return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx ) return (uint32_t) mbedtls_ssl_get_output_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD;
#endif #endif
} }
@ -272,11 +272,11 @@ static inline uint32_t mbedtls_ssl_get_output_buflen( const mbedtls_ssl_context
static inline uint32_t mbedtls_ssl_get_input_buflen( const mbedtls_ssl_context *ctx ) static inline uint32_t mbedtls_ssl_get_input_buflen( const mbedtls_ssl_context *ctx )
{ {
#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID) #if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID)
return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx ) return (uint32_t) mbedtls_ssl_get_input_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD
+ MBEDTLS_SSL_CID_IN_LEN_MAX; + MBEDTLS_SSL_CID_IN_LEN_MAX;
#else #else
return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx ) return (uint32_t) mbedtls_ssl_get_input_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD; + MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD;
#endif #endif
} }

2
library/ssl_msg.c
View File

@ -214,7 +214,7 @@ static int ssl_get_remaining_payload_in_datagram( mbedtls_ssl_context const *ssl
size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN; size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl ); const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
if( max_len > mfl ) if( max_len > mfl )
max_len = mfl; max_len = mfl;

46
library/ssl_tls.c
View File

@ -4889,7 +4889,42 @@ const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
} }
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl ) size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
{
size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
size_t read_mfl;
/* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
{
return ssl_mfl_code_to_length( ssl->conf->mfl_code );
}
/* Check if a smaller max length was negotiated */
if( ssl->session_out != NULL )
{
read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
if( read_mfl < max_len )
{
max_len = read_mfl;
}
}
// During a handshake, use the value being negotiated
if( ssl->session_negotiate != NULL )
{
read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
if( read_mfl < max_len )
{
max_len = read_mfl;
}
}
return( max_len );
}
size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
{ {
size_t max_len; size_t max_len;
@ -4914,6 +4949,13 @@ size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
return( max_len ); return( max_len );
} }
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
{
return mbedtls_ssl_get_output_max_frag_len( ssl );
}
#endif /* !MBEDTLS_DEPRECATED_REMOVED */
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
#if defined(MBEDTLS_SSL_PROTO_DTLS) #if defined(MBEDTLS_SSL_PROTO_DTLS)
@ -4946,7 +4988,7 @@ int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl )
#endif #endif
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl ); const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
if( max_len > mfl ) if( max_len > mfl )
max_len = mfl; max_len = mfl;

6
programs/ssl/ssl_client2.c
View File

@ -2553,8 +2553,10 @@ int main( int argc, char *argv[] )
mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" ); mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" );
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_printf( " [ Maximum fragment length is %u ]\n", mbedtls_printf( " [ Maximum input fragment length is %u ]\n",
(unsigned int) mbedtls_ssl_get_max_frag_len( &ssl ) ); (unsigned int) mbedtls_ssl_get_input_max_frag_len( &ssl ) );
mbedtls_printf( " [ Maximum output fragment length is %u ]\n",
(unsigned int) mbedtls_ssl_get_output_max_frag_len( &ssl ) );
#endif #endif
#if defined(MBEDTLS_SSL_ALPN) #if defined(MBEDTLS_SSL_ALPN)

6
programs/ssl/ssl_server2.c
View File

@ -3633,8 +3633,10 @@ handshake:
mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" ); mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" );
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedtls_printf( " [ Maximum fragment length is %u ]\n", mbedtls_printf( " [ Maximum input fragment length is %u ]\n",
(unsigned int) mbedtls_ssl_get_max_frag_len( &ssl ) ); (unsigned int) mbedtls_ssl_get_input_max_frag_len( &ssl ) );
mbedtls_printf( " [ Maximum output fragment length is %u ]\n",
(unsigned int) mbedtls_ssl_get_output_max_frag_len( &ssl ) );
#endif #endif
#if defined(MBEDTLS_SSL_ALPN) #if defined(MBEDTLS_SSL_ALPN)

231
tests/ssl-opt.sh
View File

@ -2925,8 +2925,10 @@ run_test "Max fragment length: enabled, default" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI debug_level=3" \ "$P_CLI debug_level=3" \
0 \ 0 \
-c "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
-s "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum output fragment length is $MAX_CONTENT_LEN" \
-C "client hello, adding max_fragment_length extension" \ -C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \ -S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \ -S "server hello, max_fragment_length extension" \
@ -2937,8 +2939,10 @@ run_test "Max fragment length: enabled, default, larger message" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \ "$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \
0 \ 0 \
-c "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
-s "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum output fragment length is $MAX_CONTENT_LEN" \
-C "client hello, adding max_fragment_length extension" \ -C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \ -S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \ -S "server hello, max_fragment_length extension" \
@ -2952,8 +2956,10 @@ run_test "Max fragment length, DTLS: enabled, default, larger message" \
"$P_SRV debug_level=3 dtls=1" \ "$P_SRV debug_level=3 dtls=1" \
"$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \ "$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \
1 \ 1 \
-c "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
-s "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum output fragment length is $MAX_CONTENT_LEN" \
-C "client hello, adding max_fragment_length extension" \ -C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \ -S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \ -S "server hello, max_fragment_length extension" \
@ -2969,8 +2975,10 @@ run_test "Max fragment length: disabled, larger message" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \ "$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \
0 \ 0 \
-C "Maximum fragment length is 16384" \ -C "Maximum input fragment length is 16384" \
-S "Maximum fragment length is 16384" \ -C "Maximum output fragment length is 16384" \
-S "Maximum input fragment length is 16384" \
-S "Maximum output fragment length is 16384" \
-c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \ -c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \
-s "$MAX_CONTENT_LEN bytes read" \ -s "$MAX_CONTENT_LEN bytes read" \
-s "1 bytes read" -s "1 bytes read"
@ -2980,8 +2988,10 @@ run_test "Max fragment length DTLS: disabled, larger message" \
"$P_SRV debug_level=3 dtls=1" \ "$P_SRV debug_level=3 dtls=1" \
"$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \ "$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \
1 \ 1 \
-C "Maximum fragment length is 16384" \ -C "Maximum input fragment length is 16384" \
-S "Maximum fragment length is 16384" \ -C "Maximum output fragment length is 16384" \
-S "Maximum input fragment length is 16384" \
-S "Maximum output fragment length is 16384" \
-c "fragment larger than.*maximum " -c "fragment larger than.*maximum "
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
@ -2989,8 +2999,178 @@ run_test "Max fragment length: used by client" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI debug_level=3 max_frag_len=4096" \ "$P_CLI debug_level=3 max_frag_len=4096" \
0 \ 0 \
-c "Maximum fragment length is 4096" \ -c "Maximum input fragment length is 4096" \
-s "Maximum fragment length is 4096" \ -c "Maximum output fragment length is 4096" \
-s "Maximum input fragment length is 4096" \
-s "Maximum output fragment length is 4096" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 512, server 1024" \
"$P_SRV debug_level=3 max_frag_len=1024" \
"$P_CLI debug_level=3 max_frag_len=512" \
0 \
-c "Maximum input fragment length is 512" \
-c "Maximum output fragment length is 512" \
-s "Maximum input fragment length is 512" \
-s "Maximum output fragment length is 512" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 512, server 2048" \
"$P_SRV debug_level=3 max_frag_len=2048" \
"$P_CLI debug_level=3 max_frag_len=512" \
0 \
-c "Maximum input fragment length is 512" \
-c "Maximum output fragment length is 512" \
-s "Maximum input fragment length is 512" \
-s "Maximum output fragment length is 512" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 512, server 4096" \
"$P_SRV debug_level=3 max_frag_len=4096" \
"$P_CLI debug_level=3 max_frag_len=512" \
0 \
-c "Maximum input fragment length is 512" \
-c "Maximum output fragment length is 512" \
-s "Maximum input fragment length is 512" \
-s "Maximum output fragment length is 512" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 1024, server 512" \
"$P_SRV debug_level=3 max_frag_len=512" \
"$P_CLI debug_level=3 max_frag_len=1024" \
0 \
-c "Maximum input fragment length is 1024" \
-c "Maximum output fragment length is 1024" \
-s "Maximum input fragment length is 1024" \
-s "Maximum output fragment length is 512" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 1024, server 2048" \
"$P_SRV debug_level=3 max_frag_len=2048" \
"$P_CLI debug_level=3 max_frag_len=1024" \
0 \
-c "Maximum input fragment length is 1024" \
-c "Maximum output fragment length is 1024" \
-s "Maximum input fragment length is 1024" \
-s "Maximum output fragment length is 1024" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 1024, server 4096" \
"$P_SRV debug_level=3 max_frag_len=4096" \
"$P_CLI debug_level=3 max_frag_len=1024" \
0 \
-c "Maximum input fragment length is 1024" \
-c "Maximum output fragment length is 1024" \
-s "Maximum input fragment length is 1024" \
-s "Maximum output fragment length is 1024" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 2048, server 512" \
"$P_SRV debug_level=3 max_frag_len=512" \
"$P_CLI debug_level=3 max_frag_len=2048" \
0 \
-c "Maximum input fragment length is 2048" \
-c "Maximum output fragment length is 2048" \
-s "Maximum input fragment length is 2048" \
-s "Maximum output fragment length is 512" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 2048, server 1024" \
"$P_SRV debug_level=3 max_frag_len=1024" \
"$P_CLI debug_level=3 max_frag_len=2048" \
0 \
-c "Maximum input fragment length is 2048" \
-c "Maximum output fragment length is 2048" \
-s "Maximum input fragment length is 2048" \
-s "Maximum output fragment length is 1024" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 2048, server 4096" \
"$P_SRV debug_level=3 max_frag_len=4096" \
"$P_CLI debug_level=3 max_frag_len=2048" \
0 \
-c "Maximum input fragment length is 2048" \
-c "Maximum output fragment length is 2048" \
-s "Maximum input fragment length is 2048" \
-s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 4096, server 512" \
"$P_SRV debug_level=3 max_frag_len=512" \
"$P_CLI debug_level=3 max_frag_len=4096" \
0 \
-c "Maximum input fragment length is 4096" \
-c "Maximum output fragment length is 4096" \
-s "Maximum input fragment length is 4096" \
-s "Maximum output fragment length is 512" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 4096, server 1024" \
"$P_SRV debug_level=3 max_frag_len=1024" \
"$P_CLI debug_level=3 max_frag_len=4096" \
0 \
-c "Maximum input fragment length is 4096" \
-c "Maximum output fragment length is 4096" \
-s "Maximum input fragment length is 4096" \
-s "Maximum output fragment length is 1024" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
-c "found max_fragment_length extension"
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
run_test "Max fragment length: client 4096, server 2048" \
"$P_SRV debug_level=3 max_frag_len=2048" \
"$P_CLI debug_level=3 max_frag_len=4096" \
0 \
-c "Maximum input fragment length is 4096" \
-c "Maximum output fragment length is 4096" \
-s "Maximum input fragment length is 4096" \
-s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \ -c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \ -s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \ -s "server hello, max_fragment_length extension" \
@ -3001,8 +3181,10 @@ run_test "Max fragment length: used by server" \
"$P_SRV debug_level=3 max_frag_len=4096" \ "$P_SRV debug_level=3 max_frag_len=4096" \
"$P_CLI debug_level=3" \ "$P_CLI debug_level=3" \
0 \ 0 \
-c "Maximum fragment length is $MAX_CONTENT_LEN" \ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum fragment length is 4096" \ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
-s "Maximum input fragment length is $MAX_CONTENT_LEN" \
-s "Maximum output fragment length is 4096" \
-C "client hello, adding max_fragment_length extension" \ -C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \ -S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \ -S "server hello, max_fragment_length extension" \
@ -3014,7 +3196,8 @@ run_test "Max fragment length: gnutls server" \
"$G_SRV" \ "$G_SRV" \
"$P_CLI debug_level=3 max_frag_len=4096" \ "$P_CLI debug_level=3 max_frag_len=4096" \
0 \ 0 \
-c "Maximum fragment length is 4096" \ -c "Maximum input fragment length is 4096" \
-c "Maximum output fragment length is 4096" \
-c "client hello, adding max_fragment_length extension" \ -c "client hello, adding max_fragment_length extension" \
-c "found max_fragment_length extension" -c "found max_fragment_length extension"
@ -3023,8 +3206,10 @@ run_test "Max fragment length: client, message just fits" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \ "$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \
0 \ 0 \
-c "Maximum fragment length is 2048" \ -c "Maximum input fragment length is 2048" \
-s "Maximum fragment length is 2048" \ -c "Maximum output fragment length is 2048" \
-s "Maximum input fragment length is 2048" \
-s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \ -c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \ -s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \ -s "server hello, max_fragment_length extension" \
@ -3037,8 +3222,10 @@ run_test "Max fragment length: client, larger message" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \ "$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \
0 \ 0 \
-c "Maximum fragment length is 2048" \ -c "Maximum input fragment length is 2048" \
-s "Maximum fragment length is 2048" \ -c "Maximum output fragment length is 2048" \
-s "Maximum input fragment length is 2048" \
-s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \ -c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \ -s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \ -s "server hello, max_fragment_length extension" \
@ -3052,8 +3239,10 @@ run_test "Max fragment length: DTLS client, larger message" \
"$P_SRV debug_level=3 dtls=1" \ "$P_SRV debug_level=3 dtls=1" \
"$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \ "$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \
1 \ 1 \
-c "Maximum fragment length is 2048" \ -c "Maximum input fragment length is 2048" \
-s "Maximum fragment length is 2048" \ -c "Maximum output fragment length is 2048" \
-s "Maximum input fragment length is 2048" \
-s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \ -c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \ -s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \ -s "server hello, max_fragment_length extension" \