[mbedtls3] mbedlts would breaks the record size limit when sending big record
#293
Labels
mbedlts would breaks the record size limit when sending big record
#293
About TLS record limit, current upstream
mbedtlshas some problems that cause bugs:record_size_limitextension to negotiation max record size between client and server. But:mbedtlscurrently (ver: 3.4.0) does not support it and just ignore that extension.mbedltswill send a TLS record with record length > 2^14 which breaks the RFC, as a result, causing client's record overflow error.It has been ensure problem 2 cause: clients (especially common browsers) will throw "record_overflow" alert to server when server try to send a record that bigger than 2^14 .
From wireshark, I saw it sends a record with length field value:
16416which is 32 bigger the 2^14.So current temporary solution is to manually set the
MBEDTLS_SSL_OUT_CONTENT_LENto a smaller number, see #294This may also related to the our
async_writefunction undermbedtls/src/ssl/context.rs.But further investigation is needed to identify real reason for this.
Ref:
https://www.rfc-editor.org/rfc/rfc8446#section-5.1
https://datatracker.ietf.org/doc/html/rfc8449
The text was updated successfully, but these errors were encountered: