ST67W611M (T01): HTTPS download aborts at ~200 KB - TLS record buffer too small for 16 KB records?

[_rk_]

Hey,

 

I'm using the ST67W611M (NCP + STM32f7 host, X-CUBE-ST67W61, T01 firmware v2.0.97) in WiFi station mode, with TLS running on the NCP via W6X_Net_Socket(..., IPPROTO_TLS_1_2).
 

I'm trying to download a 750 KB file over HTTPS from a server that sits behind Cloudflare, and it reliably dies after about 200 KB - W6X_Net_Recv returns -1 ("ssl_read FAILED: -0x0001") and the socket goes DISCONNECTED. Same spot every time. So I took a packet capture to see what's actually happening (TLS 1.2, AES-128-GCM). Cloudflare uses dynamic record sizing, so its TLS record size grows over the connection: 1369 -> 4229 -> 16384 bytes. Everything up to the 4229-byte records comes through fine (~200 KB). But the moment the first full 16384-byte record arrives, the device immediately sends a fatal TLS alert and RSTs the connection - the abort clearly comes from the device, not from Cloudflare.

That made me suspect the NCP's TLS record buffer is simply too small to hold a full 16 KB record. Looking at the driver config, I noticed it mentions a fixed NCP receive buffer of 4608 bytes (3 * 1536) - which sits right between the record size that still works (4229) and the one that kills it (16384). And since 16384 is the maximum allowed TLS record size, Cloudflare isn't really doing anything wrong here.

• Is that right - does the T01 NCP have a fixed TLS record buffer that can't handle a full 16 KB record?

• If so, is there any AT command or config to make it bigger, or to have the NCP ask the server for smaller records (record_size_limit / max_fragment_length)?

 

 

[EPASZ.1]

Unfortunately, I’m not sure there is a way to achieve this with the T01 architecture. The buffer indeed has a fixed length in the module FW. You can try to increase the W6X_NET_RECV_BUFFER_SIZE (in w6x_config.h) which should be the setting for a separate buffer.

The only other valid option I see currently is to move to the T02 architecture.

[_rk_]

I already tried increasing W6X_NET_RECV_BUFFER_SIZE  to 18 KB and , W61_MAX_SPI_XFER but neither solved the issue. The problem always occurs once Cloudflare ramps up the TLS record size beyond 4 KB. I eventually worked around it by using HTTP Partial Content (206), which keeps the transferred chunks below the limit.