TLS 2303 Bytes Packet Limit

RE: TLS 2303 Bytes Packet Limit

Martin Lesund — Fri, 20 Nov 2020 14:37:10 GMT

Hi GNotman,
It documented as a limitation in the mfw release notes.
That can be found in the .zip for the modem firmware.

*** Limitations
***************
- TLS/DTLS
    - Up to three simultaneous TLS/DTLS connections are possible.
    - Server certificate expiry time is not verified.
    - pkcs#8 is not supported.
    - Absolute maximum number of supported credentials is 32. The actual amount depends on size of
      credentials as memory area reserved for credentials may be a limiting factor as well.
    - DTLS supports PSK authentication only.
    - 2kB secure socket buffer size.
- Maximum number of raw sockets is 4.
- User plane data is supported in Cat M1 mode only.

It is listed 2kB, however 2303 is for the server you are connected to.
There are some variances in overhead for TLS, but documented limit is set to 2kB.
Setting higher could be possible, but is "out of spec" and therefore you could see some issues.

best regards,
Martin L.

RE: TLS 2303 Bytes Packet Limit

GNotman — Fri, 20 Nov 2020 13:07:33 GMT

Hi Martin,

Thanks, I understand that I can control the amount of file data requested in the Range header. I have been able to successfully download the FW file by applying a fragment size limit which leaves enough space for the header.

However, my main question is what is imposing the 2303 byte limit, and equally important is that limit constant?

RE: TLS 2303 Bytes Packet Limit

Martin Lesund — Fri, 20 Nov 2020 12:53:49 GMT

Hi GNotman,
The problem is that the HTTP-header is not a part of "CONFIG_DOWNLOAD_CLIENT_HTTP_FRAG_SIZE_2048",

so the fragment at 2048 + the HTTP header will be to big for the modem to receive.

Optimally you should use the fragment_size here: https://github.com/nrfconnect/sdk-nrf/blob/master/include/net/fota_download.h#L106

And do it dynamically as we do it in e.g. the Azure FOTA Sample: https://github.com/nrfconnect/sdk-nrf/blob/master/subsys/net/lib/azure_fota/azure_fota.c#L529

Best regards;
Martin L.