ssl: Create hs_env

We want to decrease the size of the outer state tuple, and gain
ease of understanding by better grouping. This is the first step
of creating a hs_env (handshake environment) part of the state.
This change will be performed gradually to reduce merge conflicts
complexity and risk of introducing errors.

4 files changed, 148 insertions, 103 deletions

diff --git a/lib/ssl/src/dtls_connection.erl b/lib/ssl/src/dtls_connection.erl
index 2583667fa2..855cd0d123 100644
--- a/lib/ssl/src/dtls_connection.erl
+++ b/lib/ssl/src/dtls_connection.erl
@@ -107,9 +107,11 @@ pids(_) ->
 %%====================================================================
 %% State transition handling
 %%====================================================================	     
-next_record(#state{unprocessed_handshake_events = N} = State) when N > 0 ->
-    {no_record, State#state{unprocessed_handshake_events = N-1}};
-					 
+next_record(#state{handshake_env = 
+                       #handshake_env{unprocessed_handshake_events = N} = HsEnv} 
+            = State) when N > 0 ->
+    {no_record, State#state{handshake_env = 
+                                HsEnv#handshake_env{unprocessed_handshake_events = N-1}}};
 next_record(#state{protocol_buffers =
 		       #protocol_buffers{dtls_cipher_texts = [#ssl_tls{epoch = Epoch} = CT | Rest]}
 		   = Buffers,
@@ -249,19 +251,22 @@ handle_protocol_record(#ssl_tls{type = ?HANDSHAKE,
 				       fragment = Data}, 
 		    StateName, 
 		    #state{protocol_buffers = Buffers0,
-			   negotiated_version = Version} = State0) ->
+			   negotiated_version = Version} = State) ->
     try
 	case dtls_handshake:get_dtls_handshake(Version, Data, Buffers0) of
 	    {[], Buffers} ->
-		next_event(StateName, no_record, State0#state{protocol_buffers = Buffers});
+		next_event(StateName, no_record, State#state{protocol_buffers = Buffers});
 	    {Packets, Buffers} ->
-		State = State0#state{protocol_buffers = Buffers},
+		HsEnv = State#state.handshake_env,
 		Events = dtls_handshake_events(Packets),
                 {next_state, StateName, 
-                 State#state{unprocessed_handshake_events = unprocessed_events(Events)}, Events}
+                 State#state{protocol_buffers = Buffers,
+                             handshake_env = 
+                                 HsEnv#handshake_env{unprocessed_handshake_events 
+                                                     = unprocessed_events(Events)}}, Events}
 	end
     catch throw:#alert{} = Alert ->
-	    handle_own_alert(Alert, Version, StateName, State0)
+	    handle_own_alert(Alert, Version, StateName, State)
     end;
 %%% DTLS record protocol level change cipher messages
 handle_protocol_record(#ssl_tls{type = ?CHANGE_CIPHER_SPEC, fragment = Data}, StateName, State) ->
@@ -299,7 +304,7 @@ send_handshake(Handshake, #state{connection_states = ConnectionStates} = State)
     #{epoch := Epoch} = ssl_record:current_connection_state(ConnectionStates, write),
     send_handshake_flight(queue_handshake(Handshake, State), Epoch).
 
-queue_handshake(Handshake0, #state{tls_handshake_history = Hist0, 
+queue_handshake(Handshake0, #state{handshake_env = #handshake_env{tls_handshake_history = Hist0} = HsEnv, 
 				   negotiated_version = Version,
 				   flight_buffer = #{handshakes := HsBuffer0,
 						     change_cipher_spec := undefined,
@@ -308,9 +313,9 @@ queue_handshake(Handshake0, #state{tls_handshake_history = Hist0,
     Hist = update_handshake_history(Handshake0, Handshake, Hist0),
     State#state{flight_buffer = Flight0#{handshakes => [Handshake | HsBuffer0],
 					 next_sequence => Seq +1},
-		tls_handshake_history = Hist};
+	handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist}};
 
-queue_handshake(Handshake0, #state{tls_handshake_history = Hist0, 
+queue_handshake(Handshake0, #state{handshake_env = #handshake_env{tls_handshake_history = Hist0} = HsEnv, 
 				   negotiated_version = Version,
 				   flight_buffer = #{handshakes_after_change_cipher_spec := Buffer0,
 						     next_sequence := Seq} = Flight0} = State) ->
@@ -318,7 +323,7 @@ queue_handshake(Handshake0, #state{tls_handshake_history = Hist0,
     Hist = update_handshake_history(Handshake0, Handshake, Hist0),
     State#state{flight_buffer = Flight0#{handshakes_after_change_cipher_spec => [Handshake | Buffer0],
 					 next_sequence => Seq +1},
-		tls_handshake_history = Hist}.
+                handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist}}.
 
 queue_change_cipher(ChangeCipher, #state{flight_buffer = Flight,
 					 connection_states = ConnectionStates0} = State) -> 
@@ -330,10 +335,11 @@ queue_change_cipher(ChangeCipher, #state{flight_buffer = Flight,
 reinit(State) ->
     %% To be API compatible with TLS NOOP here
     reinit_handshake_data(State).
-reinit_handshake_data(#state{protocol_buffers = Buffers} = State) ->
+reinit_handshake_data(#state{protocol_buffers = Buffers,
+                             handshake_env = HsEnv} = State) ->
     State#state{premaster_secret = undefined,
 		public_key_info = undefined,
-                tls_handshake_history = ssl_handshake:init_handshake_history(),
+                handshake_env = HsEnv#handshake_env{tls_handshake_history = ssl_handshake:init_handshake_history()},
                 flight_state = {retransmit, ?INITIAL_RETRANSMIT_TIMEOUT},
 		flight_buffer = new_flight(),
                 protocol_buffers =
@@ -417,10 +423,10 @@ init({call, From}, {start, Timeout},
                                      role = client,
                                      session_cache = Cache,
                                      session_cache_cb = CacheCb},
+            handshake_env = #handshake_env{renegotiation = {Renegotiation, _}},
 	    ssl_options = SslOpts,
 	    session = #session{own_certificate = Cert} = Session0,
-	    connection_states = ConnectionStates0,
-	    renegotiation = {Renegotiation, _}
+	    connection_states = ConnectionStates0
 	   } = State0) ->
     Timer = ssl_connection:start_or_recv_cancel_timer(Timeout, From),
     Hello = dtls_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
@@ -487,6 +493,7 @@ hello(internal, #client_hello{cookie = <<>>,
       #state{static_env = #static_env{role = server,
                                       transport_cb = Transport,
                                       socket = Socket},
+             handshake_env = HsEnv,
              protocol_specific = #{current_cookie_secret := Secret}} = State0) ->
     {ok, {IP, Port}} = dtls_socket:peername(Transport, Socket),
     Cookie = dtls_handshake:cookie(Secret, IP, Port, Hello),
@@ -500,24 +507,30 @@ hello(internal, #client_hello{cookie = <<>>,
     State1 = prepare_flight(State0#state{negotiated_version = Version}),
     {State2, Actions} = send_handshake(VerifyRequest, State1),
     {Record, State} = next_record(State2),
-    next_event(?FUNCTION_NAME, Record, State#state{tls_handshake_history = ssl_handshake:init_handshake_history()}, Actions);
+    next_event(?FUNCTION_NAME, Record, 
+               State#state{handshake_env = HsEnv#handshake_env{
+                                             tls_handshake_history = 
+                                                 ssl_handshake:init_handshake_history()}}, 
+               Actions);
 hello(internal, #hello_verify_request{cookie = Cookie}, #state{static_env = #static_env{role = client,
                                                                                         host = Host,
                                                                                         port = Port,
                                                                                         session_cache = Cache,
                                                                                         session_cache_cb = CacheCb},
+                                                               handshake_env = #handshake_env{renegotiation = {Renegotiation, _}} = HsEnv,
 							       ssl_options = SslOpts,
 							       session = #session{own_certificate = OwnCert} 
 							       = Session0,
-							       connection_states = ConnectionStates0,
-                                                               renegotiation = {Renegotiation, _}
+							       connection_states = ConnectionStates0
 							      } = State0) ->
   
     Hello = dtls_handshake:client_hello(Host, Port, Cookie, ConnectionStates0,
 					SslOpts,
 					Cache, CacheCb, Renegotiation, OwnCert),
     Version = Hello#client_hello.client_version,
-    State1 = prepare_flight(State0#state{tls_handshake_history = ssl_handshake:init_handshake_history()}),
+    State1 = prepare_flight(State0#state{handshake_env =  
+                                             HsEnv#handshake_env{tls_handshake_history 
+                                                                 = ssl_handshake:init_handshake_history()}}),
     
     {State2, Actions} = send_handshake(Hello, State1), 
     State = State2#state{negotiated_version = Version, %% Requested version
@@ -560,9 +573,9 @@ hello(internal, #client_hello{cookie = Cookie} = Hello, #state{static_env = #sta
 hello(internal, #server_hello{} = Hello,
       #state{
          static_env = #static_env{role = client},
+         handshake_env = #handshake_env{renegotiation = {Renegotiation, _}},
          connection_states = ConnectionStates0,
          negotiated_version = ReqVersion,
-         renegotiation = {Renegotiation, _},
          ssl_options = SslOptions} = State) ->
     case dtls_handshake:hello(Hello, SslOptions, ConnectionStates0, Renegotiation) of
 	#alert{} = Alert ->
@@ -676,11 +689,12 @@ connection(internal, #hello_request{}, #state{static_env = #static_env{host = Ho
                                                                        session_cache = Cache,
                                                                        session_cache_cb = CacheCb
                                                                       },
+                                              handshake_env = #handshake_env{ renegotiation = {Renegotiation, _}},
                                               session = #session{own_certificate = Cert} = Session0,
 
                                               ssl_options = SslOpts,
-                                              connection_states = ConnectionStates0,
-                                              renegotiation = {Renegotiation, _}} = State0) ->
+                                              connection_states = ConnectionStates0
+                                             } = State0) ->
     
     Hello = dtls_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
 					Cache, CacheCb, Renegotiation, Cert),
@@ -702,7 +716,8 @@ connection(internal, #client_hello{} = Hello, #state{static_env = #static_env{ro
     %% initiated renegotiation we will disallow many client initiated
     %% renegotiations immediately after each other.
     erlang:send_after(?WAIT_TO_ALLOW_RENEGOTIATION, self(), allow_renegotiate),
-    {next_state, hello, State#state{allow_renegotiate = false, renegotiation = {true, peer}},
+    {next_state, hello, State#state{allow_renegotiate = false, 
+                                    handshake_env = #handshake_env{renegotiation = {true, peer}}},
      [{next_event, internal, Hello}]};
 connection(internal, #client_hello{}, #state{static_env = #static_env{role = server},
                                              allow_renegotiate = false} = State0) ->
@@ -774,6 +789,10 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, _}, User,
                     },
 
     #state{static_env = InitStatEnv,
+           handshake_env = #handshake_env{
+                              tls_handshake_history = ssl_handshake:init_handshake_history(),
+                              renegotiation = {false, first}
+                             },
            socket_options = SocketOptions,
 	   %% We do not want to save the password in the state so that
 	   %% could be written in the clear into error logs.
@@ -783,7 +802,6 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, _}, User,
 	   protocol_buffers = #protocol_buffers{},
 	   user_application = {Monitor, User},
 	   user_data_buffer = <<>>,
-	   renegotiation = {false, first},
 	   allow_renegotiate = SSLOptions#ssl_options.client_renegotiation,
 	   start_or_recv_from = undefined,
 	   flight_buffer = new_flight(),
@@ -836,9 +854,8 @@ handle_client_hello(#client_hello{client_version = ClientVersion} = Hello,
                            static_env = #static_env{port = Port,
                                                      session_cache = Cache,
                                                     session_cache_cb = CacheCb},
+                           handshake_env = #handshake_env{renegotiation = {Renegotiation, _}} = HsEnv,
 			   session = #session{own_certificate = Cert} = Session0,
-			   renegotiation = {Renegotiation, _},
-
 			   negotiated_protocol = CurrentProtocol,
 			   key_algorithm = KeyExAlg,
 			   ssl_options = SslOpts} = State0) ->
@@ -857,7 +874,7 @@ handle_client_hello(#client_hello{client_version = ClientVersion} = Hello,
 	    State = prepare_flight(State0#state{connection_states = ConnectionStates,
 						negotiated_version = Version,
 						hashsign_algorithm = HashSign,
-                                                client_hello_version = ClientVersion,
+                                                handshake_env = HsEnv#handshake_env{client_hello_version = ClientVersion},
 						session = Session,
 						negotiated_protocol = Protocol}),
 	    
@@ -1146,13 +1163,14 @@ send_application_data(Data, From, _StateName,
                       #state{static_env = #static_env{socket = Socket,
                                                       protocol_cb = Connection,
                                                       transport_cb = Transport},
+                             handshake_env = HsEnv,
                              negotiated_version = Version,
                              connection_states = ConnectionStates0,
                              ssl_options = #ssl_options{renegotiate_at = RenegotiateAt}} = State0) ->
        
     case time_to_renegotiate(Data, ConnectionStates0, RenegotiateAt) of
 	true ->
-	    renegotiate(State0#state{renegotiation = {true, internal}}, 
+	    renegotiate(State0#state{handshake_env = HsEnv#handshake_env{renegotiation = {true, internal}}}, 
                         [{next_event, {call, From}, {application_data, Data}}]);
 	false ->
 	    {Msgs, ConnectionStates} =
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index f2569aa573..2bfa9a52cd 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -356,8 +356,8 @@ handle_normal_shutdown(Alert, _, #state{static_env = #static_env{role = Role,
                                                                  transport_cb = Transport,
                                                                  protocol_cb = Connection,
                                                                  tracker = Tracker},
-					start_or_recv_from = StartFrom,
-                                        renegotiation = {false, first}} = State) ->
+                                        handshake_env = #handshake_env{renegotiation = {false, first}},
+					start_or_recv_from = StartFrom} = State) ->
     Pids = Connection:pids(State),
     alert_user(Pids, Transport, Tracker,Socket, StartFrom, Alert, Role, Connection);
 
@@ -401,8 +401,8 @@ handle_alert(#alert{level = ?WARNING, description = ?CLOSE_NOTIFY} = Alert,
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
 	     #state{static_env = #static_env{role = Role,
                                              protocol_cb = Connection},
-                    ssl_options = SslOpts,
-                    renegotiation = {true, internal}} = State) ->
+                    handshake_env = #handshake_env{renegotiation = {true, internal}},
+                    ssl_options = SslOpts} = State) ->
     log_alert(SslOpts#ssl_options.log_alert, Role, 
               Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
     handle_normal_shutdown(Alert, StateName, State),
@@ -411,26 +411,26 @@ handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert,
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, connection = StateName, 
 	     #state{static_env = #static_env{role = Role,
                                              protocol_cb = Connection},
-                    ssl_options = SslOpts,
-                    renegotiation = {true, From}
+                    handshake_env = #handshake_env{renegotiation = {true, From}} = HsEnv,
+                    ssl_options = SslOpts                 
 		   } = State0) ->
     log_alert(SslOpts#ssl_options.log_alert,  Role,
               Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
     gen_statem:reply(From, {error, renegotiation_rejected}),
     State = Connection:reinit_handshake_data(State0),
-    Connection:next_event(connection, no_record, State#state{renegotiation = undefined});
+    Connection:next_event(connection, no_record, State#state{handshake_env = HsEnv#handshake_env{renegotiation = undefined}});
 
 handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
 	     #state{static_env = #static_env{role = Role,
                                              protocol_cb = Connection},
-                    ssl_options = SslOpts,
-                    renegotiation = {true, From}
+                    handshake_env = #handshake_env{renegotiation = {true, From}} = HsEnv,
+                    ssl_options = SslOpts
 		  } = State0) ->
     log_alert(SslOpts#ssl_options.log_alert,  Role,
               Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
     gen_statem:reply(From, {error, renegotiation_rejected}),
     %% Go back to connection!
-    State = Connection:reinit(State0#state{renegotiation = undefined}),
+    State = Connection:reinit(State0#state{handshake_env = HsEnv#handshake_env{renegotiation = undefined}}),
     Connection:next_event(connection, no_record, State);
 
 %% Gracefully log and ignore all other warning alerts
@@ -607,7 +607,8 @@ handle_session(#server_hello{cipher_suite = CipherSuite,
 ssl_config(Opts, Role, State) ->
     ssl_config(Opts, Role, State, new).
 
-ssl_config(Opts, Role, #state{static_env = InitStatEnv0} =State0, Type) ->
+ssl_config(Opts, Role, #state{static_env = InitStatEnv0,
+                              handshake_env = HsEnv} = State0, Type) ->
     {ok, #{cert_db_ref := Ref, 
            cert_db_handle := CertDbHandle, 
            fileref_db_handle := FileRefHandle, 
@@ -634,8 +635,8 @@ ssl_config(Opts, Role, #state{static_env = InitStatEnv0} =State0, Type) ->
                          ssl_options = Opts},
     case Type of
         new ->
-            Handshake = ssl_handshake:init_handshake_history(),
-            State#state{tls_handshake_history = Handshake};
+            Hist = ssl_handshake:init_handshake_history(),
+            State#state{handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist}};
         continue ->
             State
     end.
@@ -728,15 +729,15 @@ abbreviated({call, From}, Msg, State, Connection) ->
     handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{static_env = #static_env{role = server},
+                   handshake_env = #handshake_env{tls_handshake_history = Hist},
 		   negotiated_version = Version,
 		   expecting_finished = true,
-		   tls_handshake_history = Handshake,
 		   session = #session{master_secret = MasterSecret},
 		   connection_states = ConnectionStates0} =
 		State0, Connection) ->
     case ssl_handshake:verify_connection(ssl:tls_version(Version), Finished, client,
 					 get_current_prf(ConnectionStates0, write),
-					 MasterSecret, Handshake) of
+					 MasterSecret, Hist) of
         verified ->
 	    ConnectionStates =
 		ssl_record:set_client_verify_data(current_both, Data, ConnectionStates0),
@@ -748,13 +749,13 @@ abbreviated(internal, #finished{verify_data = Data} = Finished,
     end;
 abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{static_env = #static_env{role = client},
-                   tls_handshake_history = Handshake0,
+                   handshake_env = #handshake_env{tls_handshake_history = Hist0},
 		   session = #session{master_secret = MasterSecret},
 		   negotiated_version = Version,
 		   connection_states = ConnectionStates0} = State0, Connection) ->
     case ssl_handshake:verify_connection(ssl:tls_version(Version), Finished, server,
 					 get_pending_prf(ConnectionStates0, write),
-					 MasterSecret, Handshake0) of
+					 MasterSecret, Hist0) of
         verified ->
 	    ConnectionStates1 =
 		ssl_record:set_server_verify_data(current_read, Data, ConnectionStates0),
@@ -1003,18 +1004,18 @@ cipher(info, Msg, State, _) ->
 cipher(internal, #certificate_verify{signature = Signature, 
 				     hashsign_algorithm = CertHashSign},
        #state{static_env = #static_env{role = server},
+              handshake_env = #handshake_env{tls_handshake_history = Hist},
 	      key_algorithm = KexAlg,
 	      public_key_info = PublicKeyInfo,
 	      negotiated_version = Version,
-	      session = #session{master_secret = MasterSecret},
-	      tls_handshake_history = Handshake
+	      session = #session{master_secret = MasterSecret}
 	     } = State, Connection) ->
     
     TLSVersion = ssl:tls_version(Version),
     %% Use negotiated value if TLS-1.2 otherwhise return default
     HashSign = negotiated_hashsign(CertHashSign, KexAlg, PublicKeyInfo, TLSVersion),
     case ssl_handshake:certificate_verify(Signature, PublicKeyInfo,
-					  TLSVersion, HashSign, MasterSecret, Handshake) of
+					  TLSVersion, HashSign, MasterSecret, Hist) of
 	valid ->
 	    Connection:next_event(?FUNCTION_NAME, no_record,
 				  State#state{cert_hashsign_algorithm = HashSign});
@@ -1038,11 +1039,11 @@ cipher(internal, #finished{verify_data = Data} = Finished,
 	      = Session0,
               ssl_options = SslOpts,
 	      connection_states = ConnectionStates0,
-	      tls_handshake_history = Handshake0} = State, Connection) ->
+	      handshake_env = #handshake_env{tls_handshake_history = Hist}} = State, Connection) ->
     case ssl_handshake:verify_connection(ssl:tls_version(Version), Finished,
 					 opposite_role(Role),
 					 get_current_prf(ConnectionStates0, read),
-					 MasterSecret, Handshake0) of
+					 MasterSecret, Hist) of
         verified ->
 	    Session = handle_session(Role, SslOpts, Host, Port, Session0),
 	    cipher_role(Role, Data, Session, 
@@ -1084,9 +1085,10 @@ connection({call, RecvFrom}, {recv, N, Timeout},
                                  start_or_recv_from = RecvFrom, 
                                  timer = Timer}, ?FUNCTION_NAME, Connection);
 
-connection({call, From}, renegotiate, #state{static_env = #static_env{protocol_cb = Connection}} = State,
+connection({call, From}, renegotiate, #state{static_env = #static_env{protocol_cb = Connection},
+                                             handshake_env = HsEnv} = State,
 	   Connection) ->
-    Connection:renegotiate(State#state{renegotiation = {true, From}}, []);
+    Connection:renegotiate(State#state{handshake_env = HsEnv#handshake_env{renegotiation = {true, From}}}, []);
 connection({call, From}, peer_certificate, 
 	   #state{session = #session{peer_certificate = Cert}} = State, _) ->
     hibernate_after(?FUNCTION_NAME, State, [{reply, From,  {ok, Cert}}]); 
@@ -1106,9 +1108,10 @@ connection({call, From}, negotiated_protocol,
 connection({call, From}, Msg, State, Connection) ->
     handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
 connection(cast, {internal_renegotiate, WriteState}, #state{static_env = #static_env{protocol_cb = Connection},
+                                                            handshake_env = HsEnv,
                                                             connection_states = ConnectionStates} 
            = State, Connection) -> 
-    Connection:renegotiate(State#state{renegotiation = {true, internal},
+    Connection:renegotiate(State#state{handshake_env = HsEnv#handshake_env{renegotiation = {true, internal}},
                                        connection_states = ConnectionStates#{current_write => WriteState}}, []);
 connection(cast, {dist_handshake_complete, DHandle},
            #state{ssl_options = #ssl_options{erl_dist = true},
@@ -1141,15 +1144,17 @@ downgrade(Type, Event, State, Connection) ->
 %% common or unexpected events for the state.
 %%--------------------------------------------------------------------
 handle_common_event(internal, {handshake, {#hello_request{} = Handshake, _}}, connection = StateName,  
-		    #state{static_env = #static_env{role = client}} = State, _) ->
+		    #state{static_env = #static_env{role = client}, 
+                           handshake_env = HsEnv} = State, _) ->
     %% Should not be included in handshake history
-    {next_state, StateName, State#state{renegotiation = {true, peer}}, [{next_event, internal, Handshake}]};
+    {next_state, StateName, State#state{handshake_env = HsEnv#handshake_env{renegotiation = {true, peer}}},
+     [{next_event, internal, Handshake}]};
 handle_common_event(internal, {handshake, {#hello_request{}, _}}, StateName,
                     #state{static_env = #static_env{role = client}}, _)
   when StateName =/= connection ->
     keep_state_and_data;
 handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName,
-		    #state{tls_handshake_history = Hs0} = State0,
+		    #state{handshake_env = #handshake_env{tls_handshake_history = Hist0} = HsEnv} = State0,
 		    Connection) ->
    
     PossibleSNI = Connection:select_sni_extension(Handshake),
@@ -1157,8 +1162,9 @@ handle_common_event(internal, {handshake, {Handshake, Raw}}, StateName,
     %% a client_hello, which needs to be determined by the connection callback.
     %% In other cases this is a noop
     State = handle_sni_extension(PossibleSNI, State0),
-    HsHist = ssl_handshake:update_handshake_history(Hs0, Raw),
-    {next_state, StateName, State#state{tls_handshake_history = HsHist}, 
+
+    Hist = ssl_handshake:update_handshake_history(Hist0, Raw),
+    {next_state, StateName, State#state{handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist}}, 
      [{next_event, internal, Handshake}]};
 handle_common_event(internal, {protocol_record, TLSorDTLSRecord}, StateName, State, Connection) -> 
     Connection:handle_protocol_record(TLSorDTLSRecord, StateName, State);
@@ -1321,7 +1327,7 @@ handle_info(allow_renegotiate, StateName, State) ->
     {next_state, StateName, State#state{allow_renegotiate = true}};
 
 handle_info({cancel_start_or_recv, StartFrom}, StateName,
-	    #state{renegotiation = {false, first}} = State) when StateName =/= connection ->
+	    #state{handshake_env = #handshake_env{renegotiation = {false, first}}} = State) when StateName =/= connection ->
     {stop_and_reply,
      {shutdown, user_timeout},
      {reply, StartFrom, {error, timeout}},
@@ -1406,7 +1412,7 @@ format_status(terminate, [_, StateName, State]) ->
     [{data, [{"State", {StateName, State#state{connection_states = ?SECRET_PRINTOUT,
 					       protocol_buffers =  ?SECRET_PRINTOUT,
 					       user_data_buffer = ?SECRET_PRINTOUT,
-					       tls_handshake_history =  ?SECRET_PRINTOUT,
+					       handshake_env =  ?SECRET_PRINTOUT,
 					       session =  ?SECRET_PRINTOUT,
 					       private_key =  ?SECRET_PRINTOUT,
 					       diffie_hellman_params = ?SECRET_PRINTOUT,
@@ -1562,16 +1568,16 @@ certify_client(#state{client_certificate_requested = false} = State, _) ->
     State.
 
 verify_client_cert(#state{static_env = #static_env{role = client},
+                          handshake_env = #handshake_env{tls_handshake_history = Hist},
                           client_certificate_requested = true,
 			  negotiated_version = Version,
 			  private_key = PrivateKey,
 			  session = #session{master_secret = MasterSecret,
 					     own_certificate = OwnCert},
-			  cert_hashsign_algorithm = HashSign,
-			  tls_handshake_history = Handshake0} = State, Connection) ->
+			  cert_hashsign_algorithm = HashSign} = State, Connection) ->
 
     case ssl_handshake:client_certificate_verify(OwnCert, MasterSecret,
-						 ssl:tls_version(Version), HashSign, PrivateKey, Handshake0) of
+						 ssl:tls_version(Version), HashSign, PrivateKey, Hist) of
         #certificate_verify{} = Verified ->
            Connection:queue_handshake(Verified, State);
 	ignore ->
@@ -1607,7 +1613,9 @@ server_certify_and_key_exchange(State0, Connection) ->
     request_client_cert(State2, Connection).
 
 certify_client_key_exchange(#encrypted_premaster_secret{premaster_secret= EncPMS},
-			    #state{private_key = Key, client_hello_version = {Major, Minor} = Version} = State, Connection) ->
+			    #state{private_key = Key, 
+                                   handshake_env = #handshake_env{client_hello_version = {Major, Minor} = Version}}
+                            = State, Connection) ->
     FakeSecret = make_premaster_secret(Version, rsa),
     %% Countermeasure for Bleichenbacher attack always provide some kind of premaster secret
     %% and fail handshake later.RFC 5246 section 7.4.7.1.
@@ -2034,14 +2042,15 @@ cipher_protocol(State, Connection) ->
     Connection:queue_change_cipher(#change_cipher_spec{}, State).
 
 finished(#state{static_env = #static_env{role = Role},
+                handshake_env = #handshake_env{tls_handshake_history = Hist},
                 negotiated_version = Version,
 		session = Session,
-                connection_states = ConnectionStates0,
-                tls_handshake_history = Handshake0} = State0, StateName, Connection) ->
+                connection_states = ConnectionStates0} = State0, 
+         StateName, Connection) ->
     MasterSecret = Session#session.master_secret,
     Finished = ssl_handshake:finished(ssl:tls_version(Version), Role,
 				       get_current_prf(ConnectionStates0, write),
-				       MasterSecret, Handshake0),
+				       MasterSecret, Hist),
     ConnectionStates = save_verify_data(Role, Finished, ConnectionStates0, StateName),
     Connection:send_handshake(Finished, State0#state{connection_states =
 								 ConnectionStates}).
@@ -2369,7 +2378,7 @@ handle_trusted_certs_db(#state{static_env = #static_env{cert_db_ref = Ref,
 	    ok
     end.
 
-prepare_connection(#state{renegotiation = Renegotiate, 
+prepare_connection(#state{handshake_env = #handshake_env{renegotiation = Renegotiate}, 
 			  start_or_recv_from = RecvFrom} = State0, Connection) 
   when Renegotiate =/= {false, first}, 
        RecvFrom =/= undefined ->
@@ -2379,18 +2388,18 @@ prepare_connection(State0, Connection) ->
     State = Connection:reinit(State0),
     {no_record, ack_connection(State)}.
 
-ack_connection(#state{renegotiation = {true, Initiater}} = State) when Initiater == peer;
-                                                                       Initiater == internal ->
-    State#state{renegotiation = undefined};
-ack_connection(#state{renegotiation = {true, From}} = State) ->    
+ack_connection(#state{handshake_env = #handshake_env{renegotiation = {true, Initiater}} = HsEnv} = State) when Initiater == peer;
+                                                                                                               Initiater == internal ->
+    State#state{handshake_env = HsEnv#handshake_env{renegotiation = undefined}};
+ack_connection(#state{handshake_env = #handshake_env{renegotiation = {true, From}} = HsEnv} = State) ->    
     gen_statem:reply(From, ok),
-    State#state{renegotiation = undefined};
-ack_connection(#state{renegotiation = {false, first}, 
+    State#state{handshake_env = HsEnv#handshake_env{renegotiation = undefined}};
+ack_connection(#state{handshake_env = #handshake_env{renegotiation = {false, first}} = HsEnv, 
 		      start_or_recv_from = StartFrom,
 		      timer = Timer} = State) when StartFrom =/= undefined ->
     gen_statem:reply(StartFrom, connected),
     cancel_timer(Timer),
-    State#state{renegotiation = undefined, 
+    State#state{handshake_env = HsEnv#handshake_env{renegotiation = undefined}, 
 		start_or_recv_from = undefined, timer = undefined};
 ack_connection(State) ->
     State.
diff --git a/lib/ssl/src/ssl_connection.hrl b/lib/ssl/src/ssl_connection.hrl
index dc8aa7619b..177fa37b83 100644
--- a/lib/ssl/src/ssl_connection.hrl
+++ b/lib/ssl/src/ssl_connection.hrl
@@ -51,8 +51,18 @@
                      cert_db_ref          :: certdb_ref() | 'undefined',
                      tracker              :: pid() | 'undefined' %% Tracker process for listen socket
                     }).
+
+-record(handshake_env, {
+                        client_hello_version  :: ssl_record:ssl_version() | 'undefined',
+                        unprocessed_handshake_events = 0    :: integer(),
+                        tls_handshake_history :: ssl_handshake:ssl_handshake_history() | secret_printout()
+                                               | 'undefined',
+                        renegotiation        :: undefined | {boolean(), From::term() | internal | peer}
+                       }).
+
 -record(state, {
                 static_env            :: #static_env{},
+                handshake_env         :: #handshake_env{} | secret_printout(),
                 %% Change seldome
                 user_application      :: {Monitor::reference(), User::pid()},
                 ssl_options           :: #ssl_options{},
@@ -68,12 +78,9 @@
                 connection_states     :: ssl_record:connection_states() | secret_printout(),
                 protocol_buffers      :: term() | secret_printout() , %% #protocol_buffers{} from tls_record.hrl or dtls_recor.hr
                 user_data_buffer     :: undefined | binary() | secret_printout(),
-
+                
                 %% Used only in HS
-                unprocessed_handshake_events = 0    :: integer(),
-                tls_handshake_history :: ssl_handshake:ssl_handshake_history() | secret_printout()
-                                       | 'undefined',
-                client_hello_version  :: ssl_record:ssl_version() | 'undefined',
+                
                 client_certificate_requested = false :: boolean(),
                 key_algorithm         :: ssl_cipher_format:key_algo(),
                 hashsign_algorithm = {undefined, undefined},
@@ -86,7 +93,6 @@
                 srp_params           :: #srp_user{} | secret_printout() | 'undefined',
                 srp_keys             ::{PublicKey :: binary(), PrivateKey :: binary()} | secret_printout() | 'undefined',
                 premaster_secret     :: binary() | secret_printout() | 'undefined',
-	  renegotiation        :: undefined | {boolean(), From::term() | internal | peer},
                 start_or_recv_from   :: term(),
                 timer                :: undefined | reference(), % start_or_recive_timer
                 hello,                %%:: #client_hello{} | #server_hello{},
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 8b24151d9f..da290528b5 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -143,9 +143,11 @@ pids(#state{protocol_specific = #{sender := Sender}}) ->
 %%====================================================================
 %% State transition handling
 %%====================================================================
-next_record(#state{unprocessed_handshake_events = N} = State) when N > 0 ->
-    {no_record, State#state{unprocessed_handshake_events = N-1}};
-					 
+next_record(#state{handshake_env = 
+                       #handshake_env{unprocessed_handshake_events = N} = HsEnv} 
+            = State) when N > 0 ->
+    {no_record, State#state{handshake_env = 
+                                HsEnv#handshake_env{unprocessed_handshake_events = N-1}}};
 next_record(#state{protocol_buffers =
 		       #protocol_buffers{tls_packets = [], tls_cipher_texts = [CT | Rest]}
 		   = Buffers,
@@ -227,8 +229,12 @@ handle_protocol_record(#ssl_tls{type = ?HANDSHAKE, fragment = Data},
                     connection ->
                         ssl_connection:hibernate_after(StateName, State, Events);
                     _ ->
+                        HsEnv = State#state.handshake_env,
                         {next_state, StateName, 
-                         State#state{unprocessed_handshake_events = unprocessed_events(Events)}, Events}
+                         State#state{protocol_buffers = Buffers,
+                                     handshake_env = 
+                                         HsEnv#handshake_env{unprocessed_handshake_events 
+                                                             = unprocessed_events(Events)}}, Events}
                 end
         end
     catch throw:#alert{} = Alert ->
@@ -263,15 +269,17 @@ handle_protocol_record(#ssl_tls{type = _Unknown}, StateName, State) ->
 renegotiation(Pid, WriteState) ->
     gen_statem:call(Pid, {user_renegotiate, WriteState}).
 
-renegotiate(#state{static_env = #static_env{role = client}} = State, Actions) ->
+renegotiate(#state{static_env = #static_env{role = client},
+                   handshake_env = HsEnv} = State, Actions) ->
     %% Handle same way as if server requested
     %% the renegotiation
     Hs0 = ssl_handshake:init_handshake_history(),
-    {next_state, connection, State#state{tls_handshake_history = Hs0}, 
+    {next_state, connection, State#state{handshake_env = HsEnv#handshake_env{tls_handshake_history = Hs0}}, 
      [{next_event, internal, #hello_request{}} | Actions]};
 renegotiate(#state{static_env = #static_env{role = server,
                                             socket = Socket,
                                             transport_cb = Transport},
+                   handshake_env = HsEnv,
 		   negotiated_version = Version,
 		   connection_states = ConnectionStates0} = State0, Actions) ->
     HelloRequest = ssl_handshake:hello_request(),
@@ -282,20 +290,20 @@ renegotiate(#state{static_env = #static_env{role = server,
     send(Transport, Socket, BinMsg),
     State = State0#state{connection_states = 
 			     ConnectionStates,
-			 tls_handshake_history = Hs0},
+			 handshake_env = HsEnv#handshake_env{tls_handshake_history = Hs0}},
     next_event(hello, no_record, State, Actions).
 	     
 send_handshake(Handshake, State) ->
     send_handshake_flight(queue_handshake(Handshake, State)).
 
 queue_handshake(Handshake, #state{negotiated_version = Version,
-				  tls_handshake_history = Hist0,
+				  handshake_env = #handshake_env{tls_handshake_history = Hist0} = HsEnv,
 				  flight_buffer = Flight0,
 				  connection_states = ConnectionStates0} = State0) ->
     {BinHandshake, ConnectionStates, Hist} =
 	encode_handshake(Handshake, Version, ConnectionStates0, Hist0),
     State0#state{connection_states = ConnectionStates,
-		 tls_handshake_history = Hist,
+                 handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist},
 		 flight_buffer = Flight0 ++ [BinHandshake]}.
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
@@ -318,14 +326,14 @@ reinit(#state{protocol_specific = #{sender := Sender},
     tls_sender:update_connection_state(Sender, Write, Version),
     reinit_handshake_data(State).
 
-reinit_handshake_data(State) ->
+reinit_handshake_data(#state{handshake_env = HsEnv} =State) ->
     %% premaster_secret, public_key_info and tls_handshake_info 
     %% are only needed during the handshake phase. 
     %% To reduce memory foot print of a connection reinitialize them.
      State#state{
        premaster_secret = undefined,
        public_key_info = undefined,
-       tls_handshake_history = ssl_handshake:init_handshake_history()
+       handshake_env = HsEnv#handshake_env{tls_handshake_history = ssl_handshake:init_handshake_history()}
      }.
 
 select_sni_extension(#client_hello{extensions = HelloExtensions}) ->
@@ -440,10 +448,10 @@ init({call, From}, {start, Timeout},
                                      socket = Socket,
                                      session_cache = Cache,
                                      session_cache_cb = CacheCb},
+            handshake_env = #handshake_env{renegotiation = {Renegotiation, _}} = HsEnv,
 	    ssl_options = SslOpts,
 	    session = #session{own_certificate = Cert} = Session0,
-	    connection_states = ConnectionStates0,
-	    renegotiation = {Renegotiation, _}
+	    connection_states = ConnectionStates0
 	   } = State0) ->
     Timer = ssl_connection:start_or_recv_cancel_timer(Timeout, From),
     Hello = tls_handshake:client_hello(Host, Port, ConnectionStates0, SslOpts,
@@ -459,7 +467,7 @@ init({call, From}, {start, Timeout},
                          negotiated_version = Version, %% Requested version
                          session =
                              Session0#session{session_id = Hello#client_hello.session_id},
-                         tls_handshake_history = Handshake,
+                         handshake_env = HsEnv#handshake_env{tls_handshake_history = Handshake},
                          start_or_recv_from = From,
 			  timer = Timer},
     next_event(hello, no_record, State);
@@ -505,8 +513,8 @@ hello(internal, #client_hello{client_version = ClientVersion} = Hello,
                              port = Port,
                              session_cache = Cache,
                              session_cache_cb = CacheCb},
+             handshake_env = #handshake_env{renegotiation = {Renegotiation, _}} = HsEnv,
              session = #session{own_certificate = Cert} = Session0,
-	     renegotiation = {Renegotiation, _},
 	     negotiated_protocol = CurrentProtocol,
 	     key_algorithm = KeyExAlg,
 	     ssl_options = SslOpts} = State) ->
@@ -526,7 +534,7 @@ hello(internal, #client_hello{client_version = ClientVersion} = Hello,
                           State#state{connection_states  = ConnectionStates,
                                       negotiated_version = Version,
                                       hashsign_algorithm = HashSign,
-                                      client_hello_version = ClientVersion,
+                                      handshake_env = HsEnv#handshake_env{client_hello_version = ClientVersion},
                                       session = Session,
                                       negotiated_protocol = Protocol})
     end;
@@ -534,7 +542,7 @@ hello(internal, #server_hello{} = Hello,
       #state{connection_states = ConnectionStates0,
 	     negotiated_version = ReqVersion,
 	     static_env = #static_env{role = client},
-	     renegotiation = {Renegotiation, _},
+             handshake_env = #handshake_env{renegotiation = {Renegotiation, _}},
 	     ssl_options = SslOptions} = State) ->
     case tls_handshake:hello(Hello, SslOptions, ConnectionStates0, Renegotiation) of
 	#alert{} = Alert ->
@@ -620,7 +628,7 @@ connection(internal, #hello_request{},
                                            port = Port,
                                            session_cache = Cache,
                                            session_cache_cb = CacheCb},
-                  renegotiation = {Renegotiation, peer},
+                  handshake_env = #handshake_env{renegotiation = {Renegotiation, peer}},
 		  session = #session{own_certificate = Cert} = Session0,
 		  ssl_options = SslOpts, 
                   protocol_specific = #{sender := Pid},
@@ -642,7 +650,7 @@ connection(internal, #hello_request{},
                                            port = Port,
                                            session_cache = Cache,
                                            session_cache_cb = CacheCb},
-                  renegotiation = {Renegotiation, _},
+                  handshake_env = #handshake_env{renegotiation = {Renegotiation, _}},
 		  session = #session{own_certificate = Cert} = Session0,
 		  ssl_options = SslOpts, 
 		  connection_states = ConnectionStates} = State0) ->
@@ -653,6 +661,7 @@ connection(internal, #hello_request{},
                                                                         = Hello#client_hello.session_id}}, Actions);
 connection(internal, #client_hello{} = Hello, 
 	   #state{static_env = #static_env{role = server},
+                  handshake_env = HsEnv,
                   allow_renegotiate = true,
                   connection_states = CS,
                   protocol_specific = #{sender := Sender}
@@ -666,7 +675,7 @@ connection(internal, #client_hello{} = Hello,
     {ok, Write} = tls_sender:renegotiate(Sender),
     next_event(hello, no_record, State#state{connection_states = CS#{current_write => Write},
                                              allow_renegotiate = false,
-                                             renegotiation = {true, peer}
+                                             handshake_env = HsEnv#handshake_env{renegotiation = {true, peer}}
                                             }, 
                [{next_event, internal, Hello}]);
 connection(internal, #client_hello{}, 
@@ -762,6 +771,10 @@ initial_state(Role, Sender, Host, Port, Socket, {SSLOptions, SocketOptions, Trac
                     },
     #state{
        static_env = InitStatEnv,
+       handshake_env = #handshake_env{
+                          tls_handshake_history = ssl_handshake:init_handshake_history(),
+                          renegotiation = {false, first}
+                         },
        socket_options = SocketOptions,
        ssl_options = SSLOptions,
        session = #session{is_resumable = new},
@@ -769,7 +782,6 @@ initial_state(Role, Sender, Host, Port, Socket, {SSLOptions, SocketOptions, Trac
        protocol_buffers = #protocol_buffers{},
        user_application = {UserMonitor, User},
        user_data_buffer = <<>>,
-       renegotiation = {false, first},
        allow_renegotiate = SSLOptions#ssl_options.client_renegotiation,
        start_or_recv_from = undefined,
        flight_buffer = [],