code: boolean needToSplitPayload(CipherBox cipher, ProtocolVersion protocol) {
          return (protocol.v <= ProtocolVersion.TLS10.v) &&
                  cipher.isCBCMode() && !isFirstAppOutputRecord &&
                  Record.enableCBCProtection;
      }
docs: /*
  Need to split the payload except the following cases:
  
  1. protocol version is TLS 1.1 or later;
  2. bulk cipher does not use CBC mode, including null bulk cipher suites.
  3. the payload is the first application record of a freshly
  negotiated TLS session.
  4. the CBC protection is disabled;
  
  More details, please refer to
  EngineOutputRecord.write(EngineArgs, MAC, CipherBox).