Merge branch 'ingela/ssl/renegotiate-with-new-tls-sender/ERL-803/OTP-15489' into maint

* ingela/ssl/renegotiate-with-new-tls-sender/ERL-803/OTP-15489:
  ssl: Fix renegotiation with new TLS sender
  ssl: Add renegotiate test case

4 files changed, 88 insertions, 4 deletions

diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index e8c8120f50..41d853977e 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1147,7 +1147,7 @@ handle_common_event(internal, {handshake, {#hello_request{} = Handshake, _}}, co
 handle_common_event(internal, {handshake, {#hello_request{}, _}}, StateName,
                     #state{static_env = #static_env{role = client}}, _)
   when StateName =/= connection ->
-    {keep_state_and_data};
+    keep_state_and_data;
 handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName,
 		    #state{tls_handshake_history = Hs0} = State0,
 		    Connection) ->
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 009ba0600d..9edf48fdef 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -620,12 +620,34 @@ connection(internal, #hello_request{},
                                            port = Port,
                                            session_cache = Cache,
                                            session_cache_cb = CacheCb},
+                  renegotiation = {Renegotiation, peer},
+		  session = #session{own_certificate = Cert} = Session0,
+		  ssl_options = SslOpts, 
+                  protocol_specific = #{sender := Pid},
+		  connection_states = ConnectionStates} = State0) ->
+    try tls_sender:peer_renegotiate(Pid) of
+        {ok, Write} ->
+            Hello = tls_handshake:client_hello(Host, Port, ConnectionStates, SslOpts,
+                                               Cache, CacheCb, Renegotiation, Cert),
+            {State, Actions} = send_handshake(Hello, State0#state{connection_states = ConnectionStates#{current_write => Write}}),
+            next_event(hello, no_record, State#state{session = Session0#session{session_id
+                                                                      = Hello#client_hello.session_id}}, Actions)
+        catch 
+            _:_ ->
+                {stop, {shutdown, sender_blocked}, State0}
+        end;
+connection(internal, #hello_request{},
+	   #state{static_env = #static_env{role = client,
+                                           host = Host,
+                                           port = Port,
+                                           session_cache = Cache,
+                                           session_cache_cb = CacheCb},
                   renegotiation = {Renegotiation, _},
 		  session = #session{own_certificate = Cert} = Session0,
-		  ssl_options = SslOpts,                
+		  ssl_options = SslOpts, 
 		  connection_states = ConnectionStates} = State0) ->
     Hello = tls_handshake:client_hello(Host, Port, ConnectionStates, SslOpts,
-				       Cache, CacheCb, Renegotiation, Cert),
+                                       Cache, CacheCb, Renegotiation, Cert),
     {State, Actions} = send_handshake(Hello, State0),
     next_event(hello, no_record, State#state{session = Session0#session{session_id
                                                                         = Hello#client_hello.session_id}}, Actions);
@@ -655,6 +677,7 @@ connection(internal, #client_hello{},
     send_alert_in_connection(Alert, State0),
     State = Connection:reinit_handshake_data(State0),
     next_event(?FUNCTION_NAME, no_record, State);
+
 connection(Type, Event, State) ->
     ssl_connection:?FUNCTION_NAME(Type, Event, State, ?MODULE).
 
diff --git a/lib/ssl/src/tls_sender.erl b/lib/ssl/src/tls_sender.erl
index 7520832f39..11fcc6def0 100644
--- a/lib/ssl/src/tls_sender.erl
+++ b/lib/ssl/src/tls_sender.erl
@@ -29,7 +29,7 @@
 
 %% API
 -export([start/0, start/1, initialize/2, send_data/2, send_alert/2,
-         send_and_ack_alert/2, setopts/2, renegotiate/1, downgrade/2,
+         send_and_ack_alert/2, setopts/2, renegotiate/1, peer_renegotiate/1, downgrade/2,
          update_connection_state/3, dist_tls_socket/1, dist_handshake_complete/3]).
 
 %% gen_statem callbacks
@@ -118,6 +118,15 @@ setopts(Pid, Opts) ->
 renegotiate(Pid) ->
     %% Needs error handling for external API
     call(Pid, renegotiate).
+
+%%--------------------------------------------------------------------
+-spec peer_renegotiate(pid()) -> {ok, WriteState::map()} | {error, term()}.
+%% Description: So TLS connection process can synchronize the 
+%% encryption state to be used when handshaking.
+%%--------------------------------------------------------------------
+peer_renegotiate(Pid) ->
+     gen_statem:call(Pid, renegotiate, ?DEFAULT_TIMEOUT).
+
 %%--------------------------------------------------------------------
 -spec update_connection_state(pid(), WriteState::map(), tls_record:tls_version()) -> ok. 
 %% Description: So TLS connection process can synchronize the 
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 5a38f5f9c1..3c8b25b912 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -91,6 +91,7 @@ all_versions_tests() ->
      erlang_server_openssl_client_anon_with_cert,
      erlang_server_openssl_client_reuse_session,
      erlang_client_openssl_server_renegotiate,
+     erlang_client_openssl_server_renegotiate_after_client_data,
      erlang_client_openssl_server_nowrap_seqnum,
      erlang_server_openssl_client_nowrap_seqnum,
      erlang_client_openssl_server_no_server_ca_cert,
@@ -800,6 +801,51 @@ erlang_client_openssl_server_renegotiate(Config) when is_list(Config) ->
     ssl_test_lib:close(Client),
      process_flag(trap_exit, false),
     ok.
+%%--------------------------------------------------------------------
+erlang_client_openssl_server_renegotiate_after_client_data() ->
+    [{doc,"Test erlang client when openssl server issuses a renegotiate after reading client data"}].
+erlang_client_openssl_server_renegotiate_after_client_data(Config) when is_list(Config) ->
+    process_flag(trap_exit, true),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+
+    {ClientNode, _, Hostname} = ssl_test_lib:run_where(Config),
+
+    ErlData = "From erlang to openssl",
+    OpenSslData = "From openssl to erlang",
+
+    Port = ssl_test_lib:inet_port(node()),
+    CertFile = proplists:get_value(certfile, ServerOpts),
+    KeyFile = proplists:get_value(keyfile, ServerOpts),
+    Version = ssl_test_lib:protocol_version(Config),
+
+    Exe = "openssl",
+    Args = ["s_server", "-accept", integer_to_list(Port),
+            ssl_test_lib:version_flag(Version),
+            "-cert", CertFile, "-key", KeyFile, "-msg"],
+
+    OpensslPort =  ssl_test_lib:portable_open_port(Exe, Args),
+
+    ssl_test_lib:wait_for_openssl_server(Port, proplists:get_value(protocol, Config)),
+
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                        {host, Hostname},
+                                        {from, self()},
+                                        {mfa, {?MODULE,
+                                               send_wait_send, [[ErlData, OpenSslData]]}},
+                                         {options, ClientOpts}]),
+
+    true = port_command(OpensslPort, ?OPENSSL_RENEGOTIATE),
+    ct:sleep(?SLEEP),
+    true = port_command(OpensslPort, OpenSslData),
+
+    ssl_test_lib:check_result(Client, ok),
+
+     %% Clean close down!   Server needs to be closed first !!
+    ssl_test_lib:close_port(OpensslPort),
+    ssl_test_lib:close(Client),
+     process_flag(trap_exit, false),
+    ok.
 
 %%--------------------------------------------------------------------
 
@@ -1924,6 +1970,12 @@ server_sent_garbage(Socket) ->
 	    {error, closed} == ssl:send(Socket, "data")
 	    
     end.
+
+send_wait_send(Socket, [ErlData, OpenSslData]) ->
+    ssl:send(Socket, ErlData),
+    ct:sleep(?SLEEP),
+    ssl:send(Socket, ErlData),
+    erlang_ssl_receive(Socket, OpenSslData).
     
 check_openssl_sni_support(Config) ->
     HelpText = os:cmd("openssl s_client --help"),