Function ssl_do_handshake

crates/stdlib/src/ssl/compat.rs:1444–1603

Equivalent to OpenSSL's SSL_do_handshake() Performs TLS handshake by exchanging data with the peer until completion. This abstracts away the low-level rustls read_tls/write_tls loop. = SSL_do_handshake()

(
    conn: &mut TlsConnection,
    socket: &PySSLSocket,
    vm: &VirtualMachine,
)

///
/// = SSL_do_handshake()
pub(super) fn ssl_do_handshake(
    conn: &mut TlsConnection,
    socket: &PySSLSocket,
    vm: &VirtualMachine,
) -> SslResult<()> {
    // Check if handshake is already done
    if !conn.is_handshaking() {
        return Ok(());
    }

    let is_bio = socket.is_bio_mode();
    let is_server = matches!(conn, TlsConnection::Server(_));
    let mut first_iteration = true; // Track if this is the first loop iteration
    let mut iteration_count = 0;

    loop {
        iteration_count += 1;
        let mut made_progress = false;

        // IMPORTANT: In BIO mode, force initial write even if wants_write() is false
        // rustls requires write_tls() to be called to generate ClientHello/ServerHello
        let force_initial_write = is_bio && first_iteration;

        // Write TLS handshake data to socket/BIO
        let write_progress = handshake_write_loop(conn, socket, force_initial_write, vm)?;
        made_progress |= write_progress;

        // Read TLS handshake data from socket/BIO
        let (read_progress, is_first_sni_read) =
            handshake_read_data(conn, socket, is_bio, is_server, vm)?;
        made_progress |= read_progress;

        // Process TLS packets (state machine)
        if let Err(e) = conn.process_new_packets() {
            // Send close_notify on error
            if !is_bio {
                conn.send_close_notify();
                // Flush any pending TLS data before sending close_notify
                let _ = socket.flush_pending_tls_output(vm, None);
                // Actually send the close_notify alert using send_all_bytes
                // for proper partial send handling and retry logic
                if let Ok(alert_data) = ssl_write_tls_records(conn)
                    && !alert_data.is_empty()
                {
                    let _ = send_all_bytes(socket, alert_data, vm, None);
                }
            }

            // InvalidMessage during handshake means non-TLS data was received
            // before the handshake completed (e.g., HTTP request to TLS server)
            if matches!(e, rustls::Error::InvalidMessage(_)) {
                return Err(SslError::PreauthData);
            }

            // Certificate verification errors are already handled by from_rustls

            return Err(SslError::from_rustls(e));
        }