Fix oversized record length handling in TlsListener

[BrennanConroy]

https://datatracker.ietf.org/doc/html/rfc8446#section-5.1

The length (in bytes) of the following
TLSPlaintext.fragment. The length MUST NOT exceed 2^14 bytes. An
endpoint that receives a record that exceeds this length MUST
terminate the connection with a "record_overflow" alert.

We probably shouldn't throw the "record_overflow" alert here and let SslStream handle it, but we should make sure to handle cases where the length is greater than 2^14 (16k).

I chose to still pass the client hello to the user provided callback with a max of 2^14 bytes so applications can still observe the client hello.

[Copilot]

Pull request overview

This PR hardens TLS ClientHello sniffing in TlsListener when a peer advertises an oversized TLS record length, capping the bytes forwarded to the callback to the RFC-defined maximum plaintext fragment size.

Changes:

• Introduces MaxTlsRecordLength (16,384) and caps the parsed record length used for callback framing.
• Adds a regression test to ensure lengths > short.MaxValue don’t cause an exception and are capped when passed to the callback.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/Servers/Kestrel/Core/src/Middleware/TlsListener.cs	Caps parsed TLS record length to 16KB before slicing/passing bytes to the ClientHello callback.
src/Servers/Kestrel/Core/test/TlsListenerTests.cs	Adds regression coverage for oversized record length values (notably > 32,767) to ensure capping behavior.

[Copilot]

To avoid the signed/unsigned round-trip (and make the intent clearer), consider reading the record length as an unsigned 16-bit value directly (e.g., TryReadBigEndian(out ushort recordLength) if available in the target framework), then cap it and convert to the type needed for downstream slicing.

Suggested change

	// Record length (unsigned 16-bit, read as signed and convert)
	if (!reader.TryReadBigEndian(out recordLength))
	{
	return ClientHelloParseState.NotTlsClientHello;
	}
	// Convert to unsigned interpretation and cap at max TLS record size
	// If the record claims to be larger, we'll just pass what we can (up to 2^14 bytes)
	// We'll let SslStream decide how to handle the oversized record.
	recordLength = (short)Math.Min((ushort)recordLength, MaxTlsRecordLength);
	// Record length (unsigned 16-bit)
	ushort unsignedRecordLength;
	if (!reader.TryReadBigEndian(out unsignedRecordLength))
	{
	return ClientHelloParseState.NotTlsClientHello;
	}
	// Cap at max TLS record size. If the record claims to be larger, we'll just pass what we can (up to 2^14 bytes)
	// and let SslStream decide how to handle the oversized record.
	recordLength = (short)Math.Min(unsignedRecordLength, (ushort)MaxTlsRecordLength);