test(s2n-quic): verify TLS buffering limits from providers

[boquan-fang]

Release Summary:

Resolved issues:

resolves #332

Description of changes:

Add two tests with S2N-TLS and Rustls TLS providers to verify that TLS providers already implement buffering limit for handshake messages. I checked both implementations and verify that both S2N-TLS and Rustls put a cap of 64KB on handshake messages: S2N Limit, Rustls Limit. The tests added in this PR will verify that behavior, which proves the RFC behavior.

The method I used to generate large handshake message is to fill the client alpn extension with 4665 fake-protocols. Each fake protocol is 13 bytes, and TLS providers write a one byte length prefix in front of each alpn. That would makes the alpn extension along to be 65310 bytes (14 * 4665). With other data in the Client Hello, the payload can easily exceed 64KB (65536 bytes).

I set up two event subscribers to listen for a connection closed event and a client hello handle event in the server. We expect the server to receive a tls_client_hello payload to be larger than 64KB and the server closes the connection after it attempt to parse the large Client Hello.

Call-outs:

• Update S2N-TLS version to v0.3.16, because we need the newest version to unblock sending large Client Hello. The previous problem is resolved in fix: tainted handshake.io and add large client hello test s2n-tls#5208.
• Those two TLS providers emit different error codes when it encountered a large Client Hello. S2N-TLS emit an UNEXPECTED_MESSAGE error while Rustls emits an INTERNAL_ERROR.
• We can't just append a tremendous amount of alpn into the alpn extensions. The entire extension size of S2N-TLS can be 16 bytes maximum (documented here). We can only append 4665 fake-protocols extension which makes the alpn extension size very close to UINT16_MAX. The rest of the data will make the entire Client Hello message to be larger than 64KB.

Relevant PR and Issues related to this on S2N-TLS and Rustls:
aws/s2n-tls#5208
rustls/rustls#698

Testing:

CI will run the tests for this PR. We should verify if the buffer_limit_test is passing:

test tests::buffer_limit::buffer_limit_test ... ok

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.