Hi there, I am working on a TLS server at present, but am having problems with handshaking on occasion.
The setup: * My TLS server sets up a TLS context, and three BIOs; an SSL bio, and a BIO pair (application and socket). * A remote party attempts to start a TLS handshake with my server, sending a Client Hello. * This data is read off the wire, and passed into the socket-side BIO for the OpenSSL library to read. * OpenSSL then puts its reply (i.e. Server Hello, Certificate Chain, Server Hello Done, etc) onto the socket-side BIO's read buffer. * My server reads the data from the socket-side BIO's read buffer, and sends it on the wire back to the remote party. Normally, this all works fine, and TLS connections are successfully established. However, if the Certificate Chain is very long, it will exceed the default BIO read buffer size (4096 bytes). Therefore, after I put the incoming data on the socket BIO, I read from that BIO, but I only read the first 4096 bytes. I can send these out onto the wire, but I cannot then get the rest of the message from the OpenSSL library, meaning that the handshake can never be finished. One solution would be to make the buffer size larger, but as the Certificate Chain could be arbitrarily large, this is not really a solution (plus it increases occupancy). What I would really like to do is find a way to "kick" the OpenSSL library so that it can put the remaining information onto the read buffer - I am pretty sure this is possible based on the command-line behaviour of the OpenSSL library, but I can't find a way to do this. Can you perhaps help? To be clear, I am doing: rc = BIO_write(connection->bio_network, in_data, in_data_len); ... out_data_len = BIO_pending(connection->bio_network); read_len = BIO_read(connection->bio_network, out_buffer, out_data_len); If read_len is 4096, there is clearly a problem if more data is yet to be read, yet I've tried all the interfaces I can think of (e.g. BIO_flush, etc), and looked where I can, yet I can't seem to find the solution. Do you know what I need to do? Thanks in advance, Salem
