Added ssl_handshake_step() to allow single stepping the handshake

process

Single stepping the handshake process allows for better support of
non-blocking network stacks and for getting information from specific
handshake messages if wanted.

ChangeLog

@@ -1,6 +1,9 @@
 PolarSSL ChangeLog
 
 = Version Master
+Changes
+   * Added ssl_handshake_step() to allow single stepping the handshake process
+
 Bugfix
    * Memory leak when using RSA_PKCS_V21 operations fixed
    * Handle future version properly in ssl_write_certificate_request()

include/polarssl/ssl.h

@@ -970,6 +970,20 @@ const x509_cert *ssl_get_peer_cert( const ssl_context *ssl );
  */
 int ssl_handshake( ssl_context *ssl );
 
+/**
+ * \brief          Perform a single step of the SSL handshake
+ *
+ *                 Note: the state of the context (ssl->state) will be at
+ *                 the following state after execution of this function.
+ *                 Do not call this function if state is SSL_HANDSHAKE_OVER.
+ *
+ * \param ssl      SSL context
+ *
+ * \return         0 if successful, POLARSSL_ERR_NET_WANT_READ,
+ *                 POLARSSL_ERR_NET_WANT_WRITE, or a specific SSL error code.
+ */
+int ssl_handshake_step( ssl_context *ssl );
+
 /**
  * \brief          Perform an SSL renegotiation on the running connection
  *
@@ -1061,8 +1075,8 @@ void ssl_handshake_free( ssl_handshake_params *handshake );
 /*
  * Internal functions (do not call directly)
  */
-int ssl_handshake_client( ssl_context *ssl );
+int ssl_handshake_client_step( ssl_context *ssl );
-int ssl_handshake_server( ssl_context *ssl );
+int ssl_handshake_server_step( ssl_context *ssl );
 void ssl_handshake_wrapup( ssl_context *ssl );
 
 int ssl_send_fatal_handshake_failure( ssl_context *ssl );

library/ssl_cli.c

@@ -1274,20 +1274,19 @@ static int ssl_write_certificate_verify( ssl_context *ssl )
 }
 
 /*
- * SSL handshake -- client side
+ * SSL handshake -- client side -- single step
  */
-int ssl_handshake_client( ssl_context *ssl )
+int ssl_handshake_client_step( ssl_context *ssl )
 {
     int ret = 0;
 
-    SSL_DEBUG_MSG( 2, ( "=> handshake client" ) );
+    if( ssl->state == SSL_HANDSHAKE_OVER )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
 
-    while( ssl->state != SSL_HANDSHAKE_OVER )
-    {
     SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
 
     if( ( ret = ssl_flush_output( ssl ) ) != 0 )
-            break;
+        return( ret );
 
     switch( ssl->state )
     {
@@ -1382,13 +1381,6 @@ int ssl_handshake_client( ssl_context *ssl )
            return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
    }
 
-        if( ret != 0 )
-            break;
-    }
-
-    SSL_DEBUG_MSG( 2, ( "<= handshake client" ) );
-
     return( ret );
 }
-
 #endif

library/ssl_srv.c

@@ -1293,20 +1293,19 @@ static int ssl_parse_certificate_verify( ssl_context *ssl )
 }
 
 /*
- * SSL handshake -- server side
+ * SSL handshake -- server side -- single step
  */
-int ssl_handshake_server( ssl_context *ssl )
+int ssl_handshake_server_step( ssl_context *ssl )
 {
     int ret = 0;
 
-    SSL_DEBUG_MSG( 2, ( "=> handshake server" ) );
+    if( ssl->state == SSL_HANDSHAKE_OVER )
+        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
 
-    while( ssl->state != SSL_HANDSHAKE_OVER )
-    {
     SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
 
     if( ( ret = ssl_flush_output( ssl ) ) != 0 )
-            break;
+        return( ret );
 
     switch( ssl->state )
     {
@@ -1401,13 +1400,6 @@ int ssl_handshake_server( ssl_context *ssl )
             return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
     }
 
-        if( ret != 0 )
-            break;
-    }
-
-    SSL_DEBUG_MSG( 2, ( "<= handshake server" ) );
-
     return( ret );
 }
-
 #endif

library/ssl_tls.c

@@ -3513,24 +3513,42 @@ const int ssl_default_ciphersuites[] =
 };
 
 /*
- * Perform the SSL handshake
+ * Perform a single step of the SSL handshake
  */
-int ssl_handshake( ssl_context *ssl )
+int ssl_handshake_step( ssl_context *ssl )
 {
     int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
 
-    SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
-
 #if defined(POLARSSL_SSL_CLI_C)
     if( ssl->endpoint == SSL_IS_CLIENT )
-        ret = ssl_handshake_client( ssl );
+        ret = ssl_handshake_client_step( ssl );
 #endif
 
 #if defined(POLARSSL_SSL_SRV_C)
     if( ssl->endpoint == SSL_IS_SERVER )
-        ret = ssl_handshake_server( ssl );
+        ret = ssl_handshake_server_step( ssl );
 #endif
 
+    return( ret );
+}
+
+/*
+ * Perform the SSL handshake
+ */
+int ssl_handshake( ssl_context *ssl )
+{
+    int ret = 0;
+
+    SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
+
+    while( ssl->state != SSL_HANDSHAKE_OVER )
+    {
+        ret = ssl_handshake_step( ssl );
+
+        if( ret != 0 )
+            break;
+    }
+
     SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
 
     return( ret );