Refactor record padding handling to eliminate middle padding pattern

.github/workflows/os-check.yml

@@ -137,6 +137,13 @@ jobs:
     # This should be a safe limit for the tests to run.
     timeout-minutes: 14
     steps:
+      # tlslite-ng is consumed by scripts/multi-msg-record.test (run from
+      # `make check`); without it that test is SKIPped.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - run: pip install tlslite-ng
+
       - name: Build and test wolfSSL
         uses: wolfSSL/actions-build-autotools-project@v1
         with:
@@ -181,6 +188,13 @@ jobs:
     # This should be a safe limit for the tests to run.
     timeout-minutes: 14
     steps:
+      # tlslite-ng is consumed by scripts/multi-msg-record.test (run from
+      # `make check`); without it that test is SKIPped.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - run: pip install tlslite-ng
+
       - name: Build and test wolfSSL
         uses: wolfSSL/actions-build-autotools-project@v1
         with:
@@ -207,6 +221,13 @@ jobs:
     # This should be a safe limit for the tests to run.
     timeout-minutes: 14
     steps:
+      # tlslite-ng is consumed by scripts/multi-msg-record.test (run from
+      # `make check`); without it that test is SKIPped.
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - run: pip install tlslite-ng
+
       - name: Build and test wolfSSL
         uses: wolfSSL/actions-build-autotools-project@v1
         with:
@@ -269,6 +290,12 @@ jobs:
     timeout-minutes: 14
     steps:
     - uses: actions/checkout@v4
+    # tlslite-ng is consumed by scripts/multi-msg-record.test (run from
+    # `make check`); without it that test is SKIPped.
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.x'
+    - run: pip install tlslite-ng
     - run: ./autogen.sh
     - name: user_settings_all.h with compatibility layer
       run: |

.gitignore

@@ -200,6 +200,7 @@ tracefile.txt
 *.bak
 *.dummy
 *.xcworkspace
+workspace.pid*/
 xcuserdata
 compile
 NTRU_algorithm/

scripts/include.am

@@ -106,9 +106,22 @@ endif
 dist_noinst_SCRIPTS+= scripts/unit.test
 noinst_SCRIPTS+= scripts/unit.test.in
 
+# multi-msg-record.test drives the wolfSSL example client against a
+# Python (tlslite-ng) peer to verify parsing of TLS records that carry
+# multiple handshake messages.  The script probes the client binary
+# at runtime for TLS 1.2, TLS 1.3 and secure-renegotiation support
+# and skips phases that are not compiled in.  The whole test exits 77
+# (SKIP) if python3 or tlslite-ng is missing or if nothing is
+# runnable.
+dist_noinst_SCRIPTS+= scripts/multi-msg-record.test
+
 endif
 endif
 
+# The Python half of multi-msg-record.test always ships in tarballs so
+# the wrapper can find it on the installed side.
+EXTRA_DIST+= scripts/multi-msg-record.py
+
 dist_noinst_SCRIPTS+= scripts/pem.test
 
 EXTRA_DIST +=  scripts/sniffer-static-rsa.pcap \