Split the maximum fragment length into two - an input and output MFL
Since the server might want to have a different maximum fragment length
for the outgoing messages than the negotiated one - introduce a new way of
computing it. This commit also adds additional ssl-opt.sh tests ensuring
that the maximum fragment lengths are set as expected.
mbedtls_ssl_get_max_frag_len() is now a deprecated function,
being an alias to mbedtls_ssl_get_output_max_frag_len(). The behaviour
of this function is the same as before.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
diff --git a/ChangeLog b/ChangeLog
index bcceebb..0547f69 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@
New deprecations
* Deprecate MBEDTLS_SSL_HW_RECORD_ACCEL that enables function hooks in the
SSL module for hardware acceleration of individual records.
+ * Deprecate mbedtls_ssl_get_max_frag_len() in favour of
+ mbedtls_ssl_get_output_max_frag_len() and
+ mbedtls_ssl_get_input_max_frag_len() to be more precise about which max
+ fragment length is desired.
Bugfix
* Fix compilation failure when both MBEDTLS_SSL_PROTO_DTLS and
@@ -13,6 +17,11 @@
Changes
* Mbed Crypto is no longer a Git submodule. The crypto part of the library
is back directly in the present repository.
+ * Split mbedtls_ssl_get_max_frag_len() into
+ mbedtls_ssl_get_output_max_frag_len() and
+ mbedtls_ssl_get_input_max_frag_len() to ensure that a sufficient input
+ buffer is allocated by the server (if MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
+ is defined), regardless of what MFL was configured for it.
= mbed TLS 2.21.0 branch released 2020-02-20
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 1a071fc..1c98a5e 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -3523,18 +3523,61 @@
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
/**
- * \brief Return the maximum fragment length (payload, in bytes).
- * This is the value negotiated with peer if any,
- * or the locally configured value.
+ * \brief Return the maximum fragment length (payload, in bytes) for
+ * the output buffer. For the client, this is the configured
+ * value. For the server, it is the minimum of two - the
+ * configured value and the negotiated one.
*
* \sa mbedtls_ssl_conf_max_frag_len()
* \sa mbedtls_ssl_get_max_record_payload()
*
* \param ssl SSL context
*
- * \return Current maximum fragment length.
+ * \return Current maximum fragment length for the output buffer.
*/
-size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl );
+size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl );
+
+/**
+ * \brief Return the maximum fragment length (payload, in bytes) for
+ * the input buffer. This is the negotiated maximum fragment
+ * length, or, if there is none, MBEDTLS_SSL_MAX_CONTENT_LEN.
+ * If it is not defined either, the value is 2^14. This function
+ * works as its predecessor, \c mbedtls_ssl_get_max_frag_len().
+ *
+ * \sa mbedtls_ssl_conf_max_frag_len()
+ * \sa mbedtls_ssl_get_max_record_payload()
+ *
+ * \param ssl SSL context
+ *
+ * \return Current maximum fragment length for the output buffer.
+ */
+size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl );
+
+#if !defined(MBEDTLS_DEPRECATED_REMOVED)
+
+#if defined(MBEDTLS_DEPRECATED_WARNING)
+#define MBEDTLS_DEPRECATED __attribute__((deprecated))
+#else
+#define MBEDTLS_DEPRECATED
+#endif
+
+/**
+ * \brief This function is a deprecated approach to getting the max
+ * fragment length. Its an alias for
+ * \c mbedtls_ssl_get_output_max_frag_len(), as the behaviour
+ * is the same. See \c mbedtls_ssl_get_output_max_frag_len() for
+ * more detail.
+ *
+ * \sa mbedtls_ssl_get_input_max_frag_len()
+ * \sa mbedtls_ssl_get_output_max_frag_len()
+ *
+ * \param ssl SSL context
+ *
+ * \return Current maximum fragment length for the output buffer.
+ */
+MBEDTLS_DEPRECATED size_t mbedtls_ssl_get_max_frag_len(
+ const mbedtls_ssl_context *ssl );
+#endif /* MBEDTLS_DEPRECATED_REMOVED */
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
/**
@@ -3555,7 +3598,8 @@
* when record compression is enabled.
*
* \sa mbedtls_ssl_set_mtu()
- * \sa mbedtls_ssl_get_max_frag_len()
+ * \sa mbedtls_ssl_get_output_max_frag_len()
+ * \sa mbedtls_ssl_get_input_max_frag_len()
* \sa mbedtls_ssl_get_record_expansion()
*
* \param ssl SSL context
@@ -3863,8 +3907,8 @@
* or negotiated with the peer), then:
* - with TLS, less bytes than requested are written.
* - with DTLS, MBEDTLS_ERR_SSL_BAD_INPUT_DATA is returned.
- * \c mbedtls_ssl_get_max_frag_len() may be used to query the
- * active maximum fragment length.
+ * \c mbedtls_ssl_get_output_max_frag_len() may be used to
+ * query the active maximum fragment length.
*
* \note Attempting to write 0 bytes will result in an empty TLS
* application record being sent.
diff --git a/include/mbedtls/ssl_internal.h b/include/mbedtls/ssl_internal.h
index 9ff61fd..f83d014 100644
--- a/include/mbedtls/ssl_internal.h
+++ b/include/mbedtls/ssl_internal.h
@@ -260,11 +260,11 @@
static inline uint32_t mbedtls_ssl_get_output_buflen( const mbedtls_ssl_context *ctx )
{
#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID)
- return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx )
+ return (uint32_t) mbedtls_ssl_get_output_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD
+ MBEDTLS_SSL_CID_OUT_LEN_MAX;
#else
- return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx )
+ return (uint32_t) mbedtls_ssl_get_output_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD;
#endif
}
@@ -272,11 +272,11 @@
static inline uint32_t mbedtls_ssl_get_input_buflen( const mbedtls_ssl_context *ctx )
{
#if defined (MBEDTLS_SSL_DTLS_CONNECTION_ID)
- return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx )
+ return (uint32_t) mbedtls_ssl_get_input_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD
+ MBEDTLS_SSL_CID_IN_LEN_MAX;
#else
- return (uint32_t) mbedtls_ssl_get_max_frag_len( ctx )
+ return (uint32_t) mbedtls_ssl_get_input_max_frag_len( ctx )
+ MBEDTLS_SSL_HEADER_LEN + MBEDTLS_SSL_PAYLOAD_OVERHEAD;
#endif
}
diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 18fa555..b4902be 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -214,7 +214,7 @@
size_t max_len = MBEDTLS_SSL_OUT_CONTENT_LEN;
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
- const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
+ const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
if( max_len > mfl )
max_len = mfl;
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 990fa5c..9b0a710 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -4889,7 +4889,42 @@
}
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
-size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
+size_t mbedtls_ssl_get_input_max_frag_len( const mbedtls_ssl_context *ssl )
+{
+ size_t max_len = MBEDTLS_SSL_MAX_CONTENT_LEN;
+ size_t read_mfl;
+
+ /* Use the configured MFL for the client if we're past SERVER_HELLO_DONE */
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
+ ssl->state >= MBEDTLS_SSL_SERVER_HELLO_DONE )
+ {
+ return ssl_mfl_code_to_length( ssl->conf->mfl_code );
+ }
+
+ /* Check if a smaller max length was negotiated */
+ if( ssl->session_out != NULL )
+ {
+ read_mfl = ssl_mfl_code_to_length( ssl->session_out->mfl_code );
+ if( read_mfl < max_len )
+ {
+ max_len = read_mfl;
+ }
+ }
+
+ // During a handshake, use the value being negotiated
+ if( ssl->session_negotiate != NULL )
+ {
+ read_mfl = ssl_mfl_code_to_length( ssl->session_negotiate->mfl_code );
+ if( read_mfl < max_len )
+ {
+ max_len = read_mfl;
+ }
+ }
+
+ return( max_len );
+}
+
+size_t mbedtls_ssl_get_output_max_frag_len( const mbedtls_ssl_context *ssl )
{
size_t max_len;
@@ -4914,6 +4949,13 @@
return( max_len );
}
+
+#if !defined(MBEDTLS_DEPRECATED_REMOVED)
+size_t mbedtls_ssl_get_max_frag_len( const mbedtls_ssl_context *ssl )
+{
+ return mbedtls_ssl_get_output_max_frag_len( ssl );
+}
+#endif /* !MBEDTLS_DEPRECATED_REMOVED */
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
@@ -4946,7 +4988,7 @@
#endif
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
- const size_t mfl = mbedtls_ssl_get_max_frag_len( ssl );
+ const size_t mfl = mbedtls_ssl_get_output_max_frag_len( ssl );
if( max_len > mfl )
max_len = mfl;
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index d6c3d77..f6284fe 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -2553,8 +2553,10 @@
mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" );
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
- mbedtls_printf( " [ Maximum fragment length is %u ]\n",
- (unsigned int) mbedtls_ssl_get_max_frag_len( &ssl ) );
+ mbedtls_printf( " [ Maximum input fragment length is %u ]\n",
+ (unsigned int) mbedtls_ssl_get_input_max_frag_len( &ssl ) );
+ mbedtls_printf( " [ Maximum output fragment length is %u ]\n",
+ (unsigned int) mbedtls_ssl_get_output_max_frag_len( &ssl ) );
#endif
#if defined(MBEDTLS_SSL_ALPN)
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index f1b5c37..845881f 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -3633,8 +3633,10 @@
mbedtls_printf( " [ Record expansion is unknown (compression) ]\n" );
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
- mbedtls_printf( " [ Maximum fragment length is %u ]\n",
- (unsigned int) mbedtls_ssl_get_max_frag_len( &ssl ) );
+ mbedtls_printf( " [ Maximum input fragment length is %u ]\n",
+ (unsigned int) mbedtls_ssl_get_input_max_frag_len( &ssl ) );
+ mbedtls_printf( " [ Maximum output fragment length is %u ]\n",
+ (unsigned int) mbedtls_ssl_get_output_max_frag_len( &ssl ) );
#endif
#if defined(MBEDTLS_SSL_ALPN)
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 35f742f..b0228d7 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -2925,8 +2925,10 @@
"$P_SRV debug_level=3" \
"$P_CLI debug_level=3" \
0 \
- -c "Maximum fragment length is $MAX_CONTENT_LEN" \
- -s "Maximum fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum output fragment length is $MAX_CONTENT_LEN" \
-C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \
@@ -2937,8 +2939,10 @@
"$P_SRV debug_level=3" \
"$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \
0 \
- -c "Maximum fragment length is $MAX_CONTENT_LEN" \
- -s "Maximum fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum output fragment length is $MAX_CONTENT_LEN" \
-C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \
@@ -2952,8 +2956,10 @@
"$P_SRV debug_level=3 dtls=1" \
"$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \
1 \
- -c "Maximum fragment length is $MAX_CONTENT_LEN" \
- -s "Maximum fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum output fragment length is $MAX_CONTENT_LEN" \
-C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \
@@ -2969,8 +2975,10 @@
"$P_SRV debug_level=3" \
"$P_CLI debug_level=3 request_size=$(( $MAX_CONTENT_LEN + 1))" \
0 \
- -C "Maximum fragment length is 16384" \
- -S "Maximum fragment length is 16384" \
+ -C "Maximum input fragment length is 16384" \
+ -C "Maximum output fragment length is 16384" \
+ -S "Maximum input fragment length is 16384" \
+ -S "Maximum output fragment length is 16384" \
-c "$(( $MAX_CONTENT_LEN + 1)) bytes written in 2 fragments" \
-s "$MAX_CONTENT_LEN bytes read" \
-s "1 bytes read"
@@ -2980,8 +2988,10 @@
"$P_SRV debug_level=3 dtls=1" \
"$P_CLI debug_level=3 dtls=1 request_size=$(( $MAX_CONTENT_LEN + 1))" \
1 \
- -C "Maximum fragment length is 16384" \
- -S "Maximum fragment length is 16384" \
+ -C "Maximum input fragment length is 16384" \
+ -C "Maximum output fragment length is 16384" \
+ -S "Maximum input fragment length is 16384" \
+ -S "Maximum output fragment length is 16384" \
-c "fragment larger than.*maximum "
requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
@@ -2989,8 +2999,178 @@
"$P_SRV debug_level=3" \
"$P_CLI debug_level=3 max_frag_len=4096" \
0 \
- -c "Maximum fragment length is 4096" \
- -s "Maximum fragment length is 4096" \
+ -c "Maximum input fragment length is 4096" \
+ -c "Maximum output fragment length is 4096" \
+ -s "Maximum input fragment length is 4096" \
+ -s "Maximum output fragment length is 4096" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 512, server 1024" \
+ "$P_SRV debug_level=3 max_frag_len=1024" \
+ "$P_CLI debug_level=3 max_frag_len=512" \
+ 0 \
+ -c "Maximum input fragment length is 512" \
+ -c "Maximum output fragment length is 512" \
+ -s "Maximum input fragment length is 512" \
+ -s "Maximum output fragment length is 512" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 512, server 2048" \
+ "$P_SRV debug_level=3 max_frag_len=2048" \
+ "$P_CLI debug_level=3 max_frag_len=512" \
+ 0 \
+ -c "Maximum input fragment length is 512" \
+ -c "Maximum output fragment length is 512" \
+ -s "Maximum input fragment length is 512" \
+ -s "Maximum output fragment length is 512" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 512, server 4096" \
+ "$P_SRV debug_level=3 max_frag_len=4096" \
+ "$P_CLI debug_level=3 max_frag_len=512" \
+ 0 \
+ -c "Maximum input fragment length is 512" \
+ -c "Maximum output fragment length is 512" \
+ -s "Maximum input fragment length is 512" \
+ -s "Maximum output fragment length is 512" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 1024, server 512" \
+ "$P_SRV debug_level=3 max_frag_len=512" \
+ "$P_CLI debug_level=3 max_frag_len=1024" \
+ 0 \
+ -c "Maximum input fragment length is 1024" \
+ -c "Maximum output fragment length is 1024" \
+ -s "Maximum input fragment length is 1024" \
+ -s "Maximum output fragment length is 512" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 1024, server 2048" \
+ "$P_SRV debug_level=3 max_frag_len=2048" \
+ "$P_CLI debug_level=3 max_frag_len=1024" \
+ 0 \
+ -c "Maximum input fragment length is 1024" \
+ -c "Maximum output fragment length is 1024" \
+ -s "Maximum input fragment length is 1024" \
+ -s "Maximum output fragment length is 1024" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 1024, server 4096" \
+ "$P_SRV debug_level=3 max_frag_len=4096" \
+ "$P_CLI debug_level=3 max_frag_len=1024" \
+ 0 \
+ -c "Maximum input fragment length is 1024" \
+ -c "Maximum output fragment length is 1024" \
+ -s "Maximum input fragment length is 1024" \
+ -s "Maximum output fragment length is 1024" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 2048, server 512" \
+ "$P_SRV debug_level=3 max_frag_len=512" \
+ "$P_CLI debug_level=3 max_frag_len=2048" \
+ 0 \
+ -c "Maximum input fragment length is 2048" \
+ -c "Maximum output fragment length is 2048" \
+ -s "Maximum input fragment length is 2048" \
+ -s "Maximum output fragment length is 512" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 2048, server 1024" \
+ "$P_SRV debug_level=3 max_frag_len=1024" \
+ "$P_CLI debug_level=3 max_frag_len=2048" \
+ 0 \
+ -c "Maximum input fragment length is 2048" \
+ -c "Maximum output fragment length is 2048" \
+ -s "Maximum input fragment length is 2048" \
+ -s "Maximum output fragment length is 1024" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 2048, server 4096" \
+ "$P_SRV debug_level=3 max_frag_len=4096" \
+ "$P_CLI debug_level=3 max_frag_len=2048" \
+ 0 \
+ -c "Maximum input fragment length is 2048" \
+ -c "Maximum output fragment length is 2048" \
+ -s "Maximum input fragment length is 2048" \
+ -s "Maximum output fragment length is 2048" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 4096, server 512" \
+ "$P_SRV debug_level=3 max_frag_len=512" \
+ "$P_CLI debug_level=3 max_frag_len=4096" \
+ 0 \
+ -c "Maximum input fragment length is 4096" \
+ -c "Maximum output fragment length is 4096" \
+ -s "Maximum input fragment length is 4096" \
+ -s "Maximum output fragment length is 512" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 4096, server 1024" \
+ "$P_SRV debug_level=3 max_frag_len=1024" \
+ "$P_CLI debug_level=3 max_frag_len=4096" \
+ 0 \
+ -c "Maximum input fragment length is 4096" \
+ -c "Maximum output fragment length is 4096" \
+ -s "Maximum input fragment length is 4096" \
+ -s "Maximum output fragment length is 1024" \
+ -c "client hello, adding max_fragment_length extension" \
+ -s "found max fragment length extension" \
+ -s "server hello, max_fragment_length extension" \
+ -c "found max_fragment_length extension"
+
+requires_config_enabled MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+run_test "Max fragment length: client 4096, server 2048" \
+ "$P_SRV debug_level=3 max_frag_len=2048" \
+ "$P_CLI debug_level=3 max_frag_len=4096" \
+ 0 \
+ -c "Maximum input fragment length is 4096" \
+ -c "Maximum output fragment length is 4096" \
+ -s "Maximum input fragment length is 4096" \
+ -s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
@@ -3001,8 +3181,10 @@
"$P_SRV debug_level=3 max_frag_len=4096" \
"$P_CLI debug_level=3" \
0 \
- -c "Maximum fragment length is $MAX_CONTENT_LEN" \
- -s "Maximum fragment length is 4096" \
+ -c "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -c "Maximum output fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum input fragment length is $MAX_CONTENT_LEN" \
+ -s "Maximum output fragment length is 4096" \
-C "client hello, adding max_fragment_length extension" \
-S "found max fragment length extension" \
-S "server hello, max_fragment_length extension" \
@@ -3014,7 +3196,8 @@
"$G_SRV" \
"$P_CLI debug_level=3 max_frag_len=4096" \
0 \
- -c "Maximum fragment length is 4096" \
+ -c "Maximum input fragment length is 4096" \
+ -c "Maximum output fragment length is 4096" \
-c "client hello, adding max_fragment_length extension" \
-c "found max_fragment_length extension"
@@ -3023,8 +3206,10 @@
"$P_SRV debug_level=3" \
"$P_CLI debug_level=3 max_frag_len=2048 request_size=2048" \
0 \
- -c "Maximum fragment length is 2048" \
- -s "Maximum fragment length is 2048" \
+ -c "Maximum input fragment length is 2048" \
+ -c "Maximum output fragment length is 2048" \
+ -s "Maximum input fragment length is 2048" \
+ -s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
@@ -3037,8 +3222,10 @@
"$P_SRV debug_level=3" \
"$P_CLI debug_level=3 max_frag_len=2048 request_size=2345" \
0 \
- -c "Maximum fragment length is 2048" \
- -s "Maximum fragment length is 2048" \
+ -c "Maximum input fragment length is 2048" \
+ -c "Maximum output fragment length is 2048" \
+ -s "Maximum input fragment length is 2048" \
+ -s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \
@@ -3052,8 +3239,10 @@
"$P_SRV debug_level=3 dtls=1" \
"$P_CLI debug_level=3 dtls=1 max_frag_len=2048 request_size=2345" \
1 \
- -c "Maximum fragment length is 2048" \
- -s "Maximum fragment length is 2048" \
+ -c "Maximum input fragment length is 2048" \
+ -c "Maximum output fragment length is 2048" \
+ -s "Maximum input fragment length is 2048" \
+ -s "Maximum output fragment length is 2048" \
-c "client hello, adding max_fragment_length extension" \
-s "found max fragment length extension" \
-s "server hello, max_fragment_length extension" \