• Registered: 2017-06-16
  • Posts: 5

Topic: [SOLVED] Using MAX_FRAG_LEN extension

Apparently, this is a very seldom used Client Hello extension, as I haven't found any packet examples using this extension.  I've seen code using an enum of 1,2,3,4 and also using 512,1024,2048, and 4096.  But, I haven't figured out which value is actually sent out to the server.  So, if I want a max of 1024, do you send out a 2 or 1024 (0x0400)?

Sutton

Share

  • From: Bozeman
  • Registered: 2014-05-09
  • Posts: 777

Re: [SOLVED] Using MAX_FRAG_LEN extension

Hi dodge55,

The enums correspond to the RFC 3546 Section 3.2 (https://www.ietf.org/rfc/rfc3546.txt)

In order to negotiate smaller maximum fragment lengths, clients MAY
   include an extension of type "max_fragment_length" in the (extended)
   client hello.  The "extension_data" field of this extension SHALL
   contain:

      enum{
          2^9(1), 2^10(2), 2^11(3), 2^12(4), (255)
      } MaxFragmentLength;

   whose value is the desired maximum fragment length.  The allowed
   values for this field are: 2^9, 2^10, 2^11, and 2^12

wolfSSL enums are defined in the <wolf-root>/wolfssl/ssl.h header file (see below):

 /* Fragment lengths */                                                           
 enum {                                                                           
     WOLFSSL_MFL_2_9  = 1, /*  512 bytes */                                       
     WOLFSSL_MFL_2_10 = 2, /* 1024 bytes */                                       
     WOLFSSL_MFL_2_11 = 3, /* 2048 bytes */                                       
     WOLFSSL_MFL_2_12 = 4, /* 4096 bytes */                                       
     WOLFSSL_MFL_2_13 = 5  /* 8192 bytes *//* wolfSSL ONLY!!! */                  
 };

wolfSSL provides the 5th option but that is unique to wolfSSL as indicated by the comment and would only work with wolfSSL on both ends of the connection. Options 1-4 are RFC and should work with any server that supports the extension IF the server implemented it correctly.

You would send either the "0x0001" or "0x0002"... etc.

Let me know if you have any other questions. We are always happy to help.


Regards,

Kaleb

Kaleb J. Himes's Website

Share