Merge GH #567/GH #457 TLS refactoring and Callbacks interface

19 files changed, 1250 insertions, 652 deletions

diff --git a/src/lib/tls/info.txt b/src/lib/tls/info.txt
index b26179226..667726318 100644
--- a/src/lib/tls/info.txt
+++ b/src/lib/tls/info.txt
@@ -6,6 +6,7 @@ load_on auto
 credentials_manager.h
 tls_alert.h
 tls_blocking.h
+tls_callbacks.h
 tls_channel.h
 tls_ciphersuite.h
 tls_client.h
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp
index 23807215f..41a6f5c02 100644
--- a/src/lib/tls/msg_client_hello.cpp
+++ b/src/lib/tls/msg_client_hello.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Hello Request and Client Hello Messages
 * (C) 2004-2011,2015,2016 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -68,22 +69,20 @@ std::vector<byte> Hello_Request::serialize() const
 */
 Client_Hello::Client_Hello(Handshake_IO& io,
                            Handshake_Hash& hash,
-                           Protocol_Version version,
                            const Policy& policy,
                            RandomNumberGenerator& rng,
                            const std::vector<byte>& reneg_info,
-                           const std::vector<std::string>& next_protocols,
-                           const std::string& hostname,
-                           const std::string& srp_identifier) :
-   m_version(version),
+                           const Client_Hello::Settings& client_settings,
+                           const std::vector<std::string>& next_protocols) :
+   m_version(client_settings.protocol_version()),
    m_random(make_hello_random(rng, policy)),
-   m_suites(policy.ciphersuite_list(m_version, (srp_identifier != ""))),
+   m_suites(policy.ciphersuite_list(m_version,
+                                    client_settings.srp_identifier() != "")),
    m_comp_methods(policy.compression())
    {
    m_extensions.add(new Extended_Master_Secret);
    m_extensions.add(new Renegotiation_Extension(reneg_info));
-
-   m_extensions.add(new Server_Name_Indicator(hostname));
+   m_extensions.add(new Server_Name_Indicator(client_settings.hostname()));
    m_extensions.add(new Session_Ticket());
    m_extensions.add(new Supported_Elliptic_Curves(policy.allowed_ecc_curves()));
 
@@ -98,7 +97,7 @@ Client_Hello::Client_Hello(Handshake_IO& io,
       m_extensions.add(new Application_Layer_Protocol_Notification(next_protocols));
 
 #if defined(BOTAN_HAS_SRP6)
-   m_extensions.add(new SRP_Identifier(srp_identifier));
+   m_extensions.add(new SRP_Identifier(client_settings.srp_identifier()));
 #else
    if(!srp_identifier.empty())
       {
@@ -106,10 +105,10 @@ Client_Hello::Client_Hello(Handshake_IO& io,
       }
 #endif
 
-   BOTAN_ASSERT(policy.acceptable_protocol_version(version),
+   BOTAN_ASSERT(policy.acceptable_protocol_version(client_settings.protocol_version()),
                 "Our policy accepts the version we are offering");
 
-   if(policy.send_fallback_scsv(version))
+   if(policy.send_fallback_scsv(client_settings.protocol_version()))
       m_suites.push_back(TLS_FALLBACK_SCSV);
 
    hash.update(io.send(*this));
diff --git a/src/lib/tls/msg_server_hello.cpp b/src/lib/tls/msg_server_hello.cpp
index f8d0c63c7..f32625508 100644
--- a/src/lib/tls/msg_server_hello.cpp
+++ b/src/lib/tls/msg_server_hello.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Server Hello and Server Hello Done
 * (C) 2004-2011,2015,2016 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -23,17 +24,13 @@ Server_Hello::Server_Hello(Handshake_IO& io,
                            RandomNumberGenerator& rng,
                            const std::vector<byte>& reneg_info,
                            const Client_Hello& client_hello,
-                           const std::vector<byte>& new_session_id,
-                           Protocol_Version new_session_version,
-                           u16bit ciphersuite,
-                           byte compression,
-                           bool offer_session_ticket,
-                           const std::string& next_protocol) :
-   m_version(new_session_version),
-   m_session_id(new_session_id),
+                           const Server_Hello::Settings& server_settings,
+                           const std::string next_protocol) :
+   m_version(server_settings.protocol_version()),
+   m_session_id(server_settings.session_id()),
    m_random(make_hello_random(rng, policy)),
-   m_ciphersuite(ciphersuite),
-   m_comp_method(compression)
+   m_ciphersuite(server_settings.ciphersuite()),
+   m_comp_method(server_settings.compression())
    {
    if(client_hello.supports_extended_master_secret())
       m_extensions.add(new Extended_Master_Secret);
@@ -41,7 +38,7 @@ Server_Hello::Server_Hello(Handshake_IO& io,
    if(client_hello.secure_renegotiation())
       m_extensions.add(new Renegotiation_Extension(reneg_info));
 
-   if(client_hello.supports_session_ticket() && offer_session_ticket)
+   if(client_hello.supports_session_ticket() && server_settings.offer_session_ticket())
       m_extensions.add(new Session_Ticket());
 
    if(!next_protocol.empty() && client_hello.supports_alpn())
diff --git a/src/lib/tls/tls_blocking.cpp b/src/lib/tls/tls_blocking.cpp
index a1867b6b5..34ebc6c91 100644
--- a/src/lib/tls/tls_blocking.cpp
+++ b/src/lib/tls/tls_blocking.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Blocking API
 * (C) 2013 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -23,10 +24,13 @@ Blocking_Client::Blocking_Client(read_fn reader,
                                  const Protocol_Version& offer_version,
                                  const std::vector<std::string>& next) :
    m_read(reader),
-   m_channel(writer,
-             std::bind(&Blocking_Client::data_cb, this, _1, _2),
-             std::bind(&Blocking_Client::alert_cb, this, _1, _2, _3),
-             std::bind(&Blocking_Client::handshake_cb, this, _1),
+   m_callbacks(new TLS::Compat_Callbacks(
+               writer,
+               std::bind(&Blocking_Client::data_cb, this, _1, _2),
+               std::function<void (Alert)>(std::bind(&Blocking_Client::alert_cb, this, _1)),
+               std::bind(&Blocking_Client::handshake_cb, this, _1)
+             )),
+   m_channel(*m_callbacks.get(),
              session_manager,
              creds,
              policy,
@@ -35,6 +39,7 @@ Blocking_Client::Blocking_Client(read_fn reader,
              offer_version,
              next)
    {
+   printf("hi\n");
    }
 
 bool Blocking_Client::handshake_cb(const Session& session)
@@ -42,7 +47,7 @@ bool Blocking_Client::handshake_cb(const Session& session)
    return this->handshake_complete(session);
    }
 
-void Blocking_Client::alert_cb(const Alert& alert, const byte[], size_t)
+void Blocking_Client::alert_cb(const Alert& alert)
    {
    this->alert_notification(alert);
    }
diff --git a/src/lib/tls/tls_blocking.h b/src/lib/tls/tls_blocking.h
index 00e65cbaf..0f2986710 100644
--- a/src/lib/tls/tls_blocking.h
+++ b/src/lib/tls/tls_blocking.h
@@ -1,6 +1,7 @@
 /*
 * TLS Blocking API
 * (C) 2013 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -32,6 +33,7 @@ class BOTAN_DLL Blocking_Client
       typedef std::function<size_t (byte[], size_t)> read_fn;
       typedef std::function<void (const byte[], size_t)> write_fn;
 
+      BOTAN_DEPRECATED("Use the regular TLS::Client interface")
       Blocking_Client(read_fn reader,
                       write_fn writer,
                       Session_Manager& session_manager,
@@ -89,9 +91,10 @@ class BOTAN_DLL Blocking_Client
 
       void data_cb(const byte data[], size_t data_len);
 
-      void alert_cb(const Alert& alert, const byte data[], size_t data_len);
+      void alert_cb(const Alert& alert);
 
       read_fn m_read;
+      std::unique_ptr<Compat_Callbacks> m_callbacks;
       TLS::Client m_channel;
       secure_vector<byte> m_plaintext;
    };
diff --git a/src/lib/tls/tls_callbacks.h b/src/lib/tls/tls_callbacks.h
new file mode 100644
index 000000000..d7a68da31
--- /dev/null
+++ b/src/lib/tls/tls_callbacks.h
@@ -0,0 +1,205 @@
+/*
+* TLS Callbacks
+* (C) 2016 Matthias Gierlings
+*     2016 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_TLS_CALLBACKS_H__
+#define BOTAN_TLS_CALLBACKS_H__
+
+#include <botan/tls_session.h>
+#include <botan/tls_alert.h>
+namespace Botan {
+
+namespace TLS {
+
+class Handshake_Message;
+
+/**
+* Encapsulates the callbacks that a TLS channel will make which are due to
+* channel specific operations.
+*/
+class BOTAN_DLL Callbacks
+   {
+   public:
+       virtual ~Callbacks() {}
+
+       /**
+       * Mandatory callback: output function
+       * The channel will call this with data which needs to be sent to the peer
+       * (eg, over a socket or some other form of IPC). The array will be overwritten
+       * when the function returns so a copy must be made if the data cannot be
+       * sent immediately.
+       *
+       * @param data the vector of data to send
+       *
+       * @param size the number of bytes to send
+       */
+       virtual void tls_emit_data(const uint8_t data[], size_t size) = 0;
+
+       /**
+       * Mandatory callback: process application data
+       * Called when application data record is received from the peer.
+       * Again the array is overwritten immediately after the function returns.
+       *
+       * @param seq_no the underlying TLS/DTLS record sequence number
+       *
+       * @param data the vector containing the received record
+       *
+       * @param size the length of the received record, in bytes
+       */
+       virtual void tls_record_received(u64bit seq_no, const uint8_t data[], size_t size) = 0;
+
+       /**
+       * Mandary callback: alert received
+       * Called when an alert is received from the peer
+       * If fatal, the connection is closing. If not fatal, the connection may
+       * still be closing (depending on the error and the peer).
+       *
+       * @param alert the source of the alert
+       */
+       virtual void tls_alert(Alert alert) = 0;
+
+       /**
+       * Mandatory callback: session established
+       * Called when a session is established. Throw an exception to abort
+       * the connection.
+       *
+       * @param session the session descriptor
+       *
+       * @return return false to prevent the session from being cached,
+       * return true to cache the session in the configured session manager
+       */
+       virtual bool tls_session_established(const Session& session) = 0;
+
+       /**
+       * Optional callback: inspect handshake message
+       * Throw an exception to abort the handshake.
+       *
+       * @param message the handshake message
+       */
+       virtual void tls_inspect_handshake_msg(const Handshake_Message& message) {}
+
+       /**
+       * Optional callback for server: choose ALPN protocol
+       * ALPN (RFC 7301) works by the client sending a list of application
+       * protocols it is willing to negotiate. The server then selects which
+       * protocol to use, which is not necessarily even on the list that
+       * the client sent.
+       *
+       * @param client_protos the vector of protocols the client is willing to negotiate
+       *
+       * @return the protocol selected by the server, which need not be on the
+       * list that the client sent; if this is the empty string, the server ignores the
+       * client ALPN extension
+       */
+       virtual std::string tls_server_choose_app_protocol(const std::vector<std::string>& client_protos)
+          {
+          return "";
+          }
+
+       /**
+       * Optional callback: debug logging. (not currently used)
+       */
+       virtual bool tls_log_debug(const char*) { return false; }
+   };
+
+/**
+* TLS::Callbacks using std::function for compatability with the old API signatures.
+* This type is only provided for backward compatibility.
+* New implementations should derive from TLS::Callbacks instead.
+*/
+class BOTAN_DLL Compat_Callbacks final : public Callbacks
+   {
+   public:
+      typedef std::function<void (const byte[], size_t)> output_fn;
+      typedef std::function<void (const byte[], size_t)> data_cb;
+      typedef std::function<void (Alert, const byte[], size_t)> alert_cb;
+      typedef std::function<bool (const Session&)> handshake_cb;
+      typedef std::function<void (const Handshake_Message&)> handshake_msg_cb;
+      typedef std::function<std::string (std::vector<std::string>)> next_protocol_fn;
+
+      /**
+       * @param output_fn is called with data for the outbound socket
+       *
+       * @param app_data_cb is called when new application data is received
+       *
+       * @param alert_cb is called when a TLS alert is received
+       *
+       * @param handshake_cb is called when a handshake is completed
+       */
+       BOTAN_DEPRECATED("Use TLS::Callbacks (virtual interface).")
+       Compat_Callbacks(output_fn out, data_cb app_data_cb, alert_cb alert_cb,
+                        handshake_cb hs_cb, handshake_msg_cb hs_msg_cb = nullptr,
+                        next_protocol_fn next_proto = nullptr)
+          : m_output_function(out), m_app_data_cb(app_data_cb),
+            m_alert_cb(std::bind(alert_cb, std::placeholders::_1, nullptr, 0)),
+            m_hs_cb(hs_cb), m_hs_msg_cb(hs_msg_cb), m_next_proto(next_proto) {}
+
+       BOTAN_DEPRECATED("Use TLS::Callbacks (virtual interface).")
+       Compat_Callbacks(output_fn out, data_cb app_data_cb,
+                        std::function<void (Alert)> alert_cb,
+                        handshake_cb hs_cb,
+                        handshake_msg_cb hs_msg_cb = nullptr,
+                        next_protocol_fn next_proto = nullptr)
+          : m_output_function(out), m_app_data_cb(app_data_cb),
+            m_alert_cb(alert_cb),
+            m_hs_cb(hs_cb), m_hs_msg_cb(hs_msg_cb), m_next_proto(next_proto) {}
+
+       void tls_emit_data(const byte data[], size_t size) override
+          {
+          BOTAN_ASSERT(m_output_function != nullptr,
+                       "Invalid TLS output function callback.");
+          m_output_function(data, size);
+          }
+
+       void tls_record_received(u64bit /*seq_no*/, const byte data[], size_t size) override
+          {
+          BOTAN_ASSERT(m_app_data_cb != nullptr,
+                       "Invalid TLS app data callback.");
+          m_app_data_cb(data, size);
+          }
+
+       void tls_alert(Alert alert) override
+          {
+          BOTAN_ASSERT(m_alert_cb != nullptr,
+                       "Invalid TLS alert callback.");
+          m_alert_cb(alert);
+          }
+
+       bool tls_session_established(const Session& session) override
+          {
+          BOTAN_ASSERT(m_hs_cb != nullptr,
+                       "Invalid TLS handshake callback.");
+          return m_hs_cb(session);
+          }
+
+       std::string tls_server_choose_app_protocol(const std::vector<std::string>& client_protos) override
+          {
+          if(m_next_proto != nullptr) { return m_next_proto(client_protos); }
+          return "";
+          }
+
+       void tls_inspect_handshake_msg(const Handshake_Message& hmsg) override
+          {
+          // The handshake message callback is optional so we can
+          // not assume it has been set.
+          if(m_hs_msg_cb != nullptr) { m_hs_msg_cb(hmsg); }
+          }
+
+    private:
+         const output_fn m_output_function;
+         const data_cb m_app_data_cb;
+         const std::function<void (Alert)> m_alert_cb;
+         const handshake_cb m_hs_cb;
+         const handshake_msg_cb m_hs_msg_cb;
+         const next_protocol_fn m_next_proto;
+   };
+
+}
+
+}
+
+#endif
diff --git a/src/lib/tls/tls_channel.cpp b/src/lib/tls/tls_channel.cpp
index f445eef99..5f882af64 100644
--- a/src/lib/tls/tls_channel.cpp
+++ b/src/lib/tls/tls_channel.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Channels
-* (C) 2011,2012,2014,2015 Jack Lloyd
+* (C) 2011,2012,2014,2015,2016 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -18,32 +19,51 @@ namespace Botan {
 
 namespace TLS {
 
-Channel::Channel(output_fn output_fn,
-                 data_cb data_cb,
-                 alert_cb alert_cb,
-                 handshake_cb handshake_cb,
-                 handshake_msg_cb handshake_msg_cb,
+size_t TLS::Channel::IO_BUF_DEFAULT_SIZE = 10*1024;
+
+Channel::Channel(Callbacks& callbacks,
                  Session_Manager& session_manager,
                  RandomNumberGenerator& rng,
                  const Policy& policy,
                  bool is_datagram,
                  size_t reserved_io_buffer_size) :
    m_is_datagram(is_datagram),
-   m_data_cb(data_cb),
-   m_alert_cb(alert_cb),
-   m_output_fn(output_fn),
-   m_handshake_cb(handshake_cb),
-   m_handshake_msg_cb(handshake_msg_cb),
+   m_callbacks(callbacks),
    m_session_manager(session_manager),
    m_policy(policy),
    m_rng(rng)
    {
+   init(reserved_io_buffer_size);
+   }
+
+Channel::Channel(output_fn out,
+                 data_cb app_data_cb,
+                 alert_cb alert_cb,
+                 handshake_cb hs_cb,
+                 handshake_msg_cb hs_msg_cb,
+                 Session_Manager& session_manager,
+                 RandomNumberGenerator& rng,
+                 const Policy& policy,
+                 bool is_datagram,
+                 size_t io_buf_sz) :
+    m_is_datagram(is_datagram),
+    m_compat_callbacks(new Compat_Callbacks(out, app_data_cb, alert_cb, hs_cb, hs_msg_cb)),
+    m_callbacks(*m_compat_callbacks.get()),
+    m_session_manager(session_manager),
+    m_policy(policy),
+    m_rng(rng)
+    {
+    init(io_buf_sz);
+    }
+
+void Channel::init(size_t io_buf_sz)
+   {
    /* epoch 0 is plaintext, thus null cipher state */
    m_write_cipher_states[0] = nullptr;
    m_read_cipher_states[0] = nullptr;
 
-   m_writebuf.reserve(reserved_io_buffer_size);
-   m_readbuf.reserve(reserved_io_buffer_size);
+   m_writebuf.reserve(io_buf_sz);
+   m_readbuf.reserve(io_buf_sz);
    }
 
 void Channel::reset_state()
@@ -263,23 +283,19 @@ size_t Channel::received_data(const byte input[], size_t input_size)
       {
       while(!is_closed() && input_size)
          {
-         secure_vector<byte> record;
+         secure_vector<byte> record_data;
          u64bit record_sequence = 0;
          Record_Type record_type = NO_RECORD;
          Protocol_Version record_version;
 
          size_t consumed = 0;
 
+         Record_Raw_Input raw_input(input, input_size, consumed, m_is_datagram);
+         Record record(record_data, &record_sequence, &record_version, &record_type);
          const size_t needed =
             read_record(m_readbuf,
-                        input,
-                        input_size,
-                        m_is_datagram,
-                        consumed,
+                        raw_input,
                         record,
-                        &record_sequence,
-                        &record_version,
-                        &record_type,
                         m_sequence_numbers.get(),
                         std::bind(&TLS::Channel::read_cipher_state_epoch, this,
                                   std::placeholders::_1));
@@ -298,105 +314,21 @@ size_t Channel::received_data(const byte input[], size_t input_size)
          if(input_size == 0 && needed != 0)
             return needed; // need more data to complete record
 
-         if(record.size() > MAX_PLAINTEXT_SIZE)
+         if(record_data.size() > MAX_PLAINTEXT_SIZE)
             throw TLS_Exception(Alert::RECORD_OVERFLOW,
                                 "TLS plaintext record is larger than allowed maximum");
 
          if(record_type == HANDSHAKE || record_type == CHANGE_CIPHER_SPEC)
             {
-            if(!m_pending_state)
-               {
-               // No pending handshake, possibly new:
-               if(record_version.is_datagram_protocol())
-                  {
-                  if(m_sequence_numbers)
-                     {
-                     /*
-                     * Might be a peer retransmit under epoch - 1 in which
-                     * case we must retransmit last flight
-                     */
-                     sequence_numbers().read_accept(record_sequence);
-
-                     const u16bit epoch = record_sequence >> 48;
-
-                     if(epoch == sequence_numbers().current_read_epoch())
-                        {
-                        create_handshake_state(record_version);
-                        }
-                     else if(epoch == sequence_numbers().current_read_epoch() - 1)
-                        {
-                        BOTAN_ASSERT(m_active_state, "Have active state here");
-                        m_active_state->handshake_io().add_record(unlock(record),
-                                                                  record_type,
-                                                                  record_sequence);
-                        }
-                     }
-                  else if(record_sequence == 0)
-                     {
-                     create_handshake_state(record_version);
-                     }
-                  }
-               else
-                  {
-                  create_handshake_state(record_version);
-                  }
-               }
-
-            // May have been created in above conditional
-            if(m_pending_state)
-               {
-               m_pending_state->handshake_io().add_record(unlock(record),
-                                                          record_type,
-                                                          record_sequence);
-
-               while(auto pending = m_pending_state.get())
-                  {
-                  auto msg = pending->get_next_handshake_msg();
-
-                  if(msg.first == HANDSHAKE_NONE) // no full handshake yet
-                     break;
-
-                  process_handshake_msg(active_state(), *pending,
-                                        msg.first, msg.second);
-                  }
-               }
+            process_handshake_ccs(record_data, record_sequence, record_type, record_version);
             }
          else if(record_type == APPLICATION_DATA)
             {
-            if(!active_state())
-               throw Unexpected_Message("Application data before handshake done");
-
-            /*
-            * OpenSSL among others sends empty records in versions
-            * before TLS v1.1 in order to randomize the IV of the
-            * following record. Avoid spurious callbacks.
-            */
-            if(record.size() > 0)
-               m_data_cb(record.data(), record.size());
+            process_application_data(record_sequence, record_data);
             }
          else if(record_type == ALERT)
             {
-            Alert alert_msg(record);
-
-            if(alert_msg.type() == Alert::NO_RENEGOTIATION)
-               m_pending_state.reset();
-
-            m_alert_cb(alert_msg, nullptr, 0);
-
-            if(alert_msg.is_fatal())
-               {
-               if(auto active = active_state())
-                  m_session_manager.remove_entry(active->server_hello()->session_id());
-               }
-
-            if(alert_msg.type() == Alert::CLOSE_NOTIFY)
-               send_warning_alert(Alert::CLOSE_NOTIFY); // reply in kind
-
-            if(alert_msg.type() == Alert::CLOSE_NOTIFY || alert_msg.is_fatal())
-               {
-               reset_state();
-               return 0;
-               }
+            process_alert(record_data);
             }
          else if(record_type != NO_RECORD)
             throw Unexpected_Message("Unexpected record type " +
@@ -428,6 +360,108 @@ size_t Channel::received_data(const byte input[], size_t input_size)
       }
    }
 
+void Channel::process_handshake_ccs(const secure_vector<byte>& record,
+                                    u64bit record_sequence,
+                                    Record_Type record_type,
+                                    Protocol_Version record_version)
+   {
+   if(!m_pending_state)
+      {
+      // No pending handshake, possibly new:
+      if(record_version.is_datagram_protocol())
+         {
+         if(m_sequence_numbers)
+            {
+            /*
+            * Might be a peer retransmit under epoch - 1 in which
+            * case we must retransmit last flight
+            */
+            sequence_numbers().read_accept(record_sequence);
+
+            const u16bit epoch = record_sequence >> 48;
+
+            if(epoch == sequence_numbers().current_read_epoch())
+               {
+               create_handshake_state(record_version);
+               }
+            else if(epoch == sequence_numbers().current_read_epoch() - 1)
+               {
+               BOTAN_ASSERT(m_active_state, "Have active state here");
+               m_active_state->handshake_io().add_record(unlock(record),
+                                                         record_type,
+                                                         record_sequence);
+               }
+            }
+         else if(record_sequence == 0)
+            {
+            create_handshake_state(record_version);
+            }
+         }
+      else
+         {
+         create_handshake_state(record_version);
+         }
+      }
+
+   // May have been created in above conditional
+   if(m_pending_state)
+      {
+      m_pending_state->handshake_io().add_record(unlock(record),
+                                                 record_type,
+                                                 record_sequence);
+
+      while(auto pending = m_pending_state.get())
+         {
+         auto msg = pending->get_next_handshake_msg();
+
+         if(msg.first == HANDSHAKE_NONE) // no full handshake yet
+            break;
+
+         process_handshake_msg(active_state(), *pending,
+                               msg.first, msg.second);
+         }
+      }
+   }
+
+void Channel::process_application_data(u64bit seq_no, const secure_vector<byte>& record)
+   {
+   if(!active_state())
+      throw Unexpected_Message("Application data before handshake done");
+
+   /*
+   * OpenSSL among others sends empty records in versions
+   * before TLS v1.1 in order to randomize the IV of the
+   * following record. Avoid spurious callbacks.
+   */
+   if(record.size() > 0)
+      callbacks().tls_record_received(seq_no, record.data(), record.size());
+   }
+
+void Channel::process_alert(const secure_vector<byte>& record)
+    {
+    Alert alert_msg(record);
+
+    if(alert_msg.type() == Alert::NO_RENEGOTIATION)
+       m_pending_state.reset();
+
+    callbacks().tls_alert(alert_msg);
+
+    if(alert_msg.is_fatal())
+       {
+       if(auto active = active_state())
+          m_session_manager.remove_entry(active->server_hello()->session_id());
+       }
+
+    if(alert_msg.type() == Alert::CLOSE_NOTIFY)
+       send_warning_alert(Alert::CLOSE_NOTIFY); // reply in kind
+
+    if(alert_msg.type() == Alert::CLOSE_NOTIFY || alert_msg.is_fatal())
+       {
+       reset_state();
+       }
+    }
+
+
 void Channel::write_record(Connection_Cipher_State* cipher_state, u16bit epoch,
                            byte record_type, const byte input[], size_t length)
    {
@@ -436,16 +470,16 @@ void Channel::write_record(Connection_Cipher_State* cipher_state, u16bit epoch,
    Protocol_Version record_version =
       (m_pending_state) ? (m_pending_state->version()) : (m_active_state->version());
 
+   Record_Message record_message(record_type, 0, input, length);
+
    TLS::write_record(m_writebuf,
-                     record_type,
-                     input,
-                     length,
+                     record_message,
                      record_version,
                      sequence_numbers().next_write_sequence(epoch),
                      cipher_state,
                      m_rng);
 
-   m_output_fn(m_writebuf.data(), m_writebuf.size());
+   callbacks().tls_emit_data(m_writebuf.data(), m_writebuf.size());
    }
 
 void Channel::send_record_array(u16bit epoch, byte type, const byte input[], size_t length)
diff --git a/src/lib/tls/tls_channel.h b/src/lib/tls/tls_channel.h
index e0219c242..073af760f 100644
--- a/src/lib/tls/tls_channel.h
+++ b/src/lib/tls/tls_channel.h
@@ -1,6 +1,7 @@
 /*
 * TLS Channel
 * (C) 2011,2012,2014,2015 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -12,6 +13,7 @@
 #include <botan/tls_session.h>
 #include <botan/tls_alert.h>
 #include <botan/tls_session_manager.h>
+#include <botan/tls_callbacks.h>
 #include <botan/x509cert.h>
 #include <vector>
 #include <string>
@@ -37,7 +39,20 @@ class BOTAN_DLL Channel
       typedef std::function<void (Alert, const byte[], size_t)> alert_cb;
       typedef std::function<bool (const Session&)> handshake_cb;
       typedef std::function<void (const Handshake_Message&)> handshake_msg_cb;
+      static size_t IO_BUF_DEFAULT_SIZE;
 
+      Channel(Callbacks& callbacks,
+              Session_Manager& session_manager,
+              RandomNumberGenerator& rng,
+              const Policy& policy,
+              bool is_datagram,
+              size_t io_buf_sz = IO_BUF_DEFAULT_SIZE);
+
+      /**
+       * DEPRECATED. This constructor is only provided for backward
+       * compatibility and should not be used in new implementations.
+       */
+      BOTAN_DEPRECATED("Use TLS::Channel(TLS::Callbacks ...)")
       Channel(output_fn out,
               data_cb app_data_cb,
               alert_cb alert_cb,
@@ -47,7 +62,7 @@ class BOTAN_DLL Channel
               RandomNumberGenerator& rng,
               const Policy& policy,
               bool is_datagram,
-              size_t io_buf_sz = 16*1024);
+              size_t io_buf_sz = IO_BUF_DEFAULT_SIZE);
 
       Channel(const Channel&) = delete;
 
@@ -200,10 +215,12 @@ class BOTAN_DLL Channel
 
       const Policy& policy() const { return m_policy; }
 
-      bool save_session(const Session& session) const { return m_handshake_cb(session); }
+      bool save_session(const Session& session) const { return callbacks().tls_session_established(session); }
 
-      handshake_msg_cb get_handshake_msg_cb() const { return m_handshake_msg_cb; }
+      Callbacks& callbacks() const { return m_callbacks; }
    private:
+      void init(size_t io_buf_sze);
+
       void send_record(byte record_type, const std::vector<byte>& record);
 
       void send_record_under_epoch(u16bit epoch, byte record_type,
@@ -227,14 +244,21 @@ class BOTAN_DLL Channel
 
       const Handshake_State* pending_state() const { return m_pending_state.get(); }
 
+      /* methods to handle incoming traffic through Channel::receive_data. */
+      void process_handshake_ccs(const secure_vector<byte>& record,
+                                 u64bit record_sequence,
+                                 Record_Type record_type,
+                                 Protocol_Version record_version);
+
+      void process_application_data(u64bit req_no, const secure_vector<byte>& record);
+
+      void process_alert(const secure_vector<byte>& record);
+
       bool m_is_datagram;
 
       /* callbacks */
-      data_cb m_data_cb;
-      alert_cb m_alert_cb;
-      output_fn m_output_fn;
-      handshake_cb m_handshake_cb;
-      handshake_msg_cb m_handshake_msg_cb;
+      std::unique_ptr<Compat_Callbacks> m_compat_callbacks;
+      Callbacks& m_callbacks;
 
       /* external state */
       Session_Manager& m_session_manager;
diff --git a/src/lib/tls/tls_client.cpp b/src/lib/tls/tls_client.cpp
index 301c77c6b..f77521c03 100644
--- a/src/lib/tls/tls_client.cpp
+++ b/src/lib/tls/tls_client.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Client
 * (C) 2004-2011,2012,2015,2016 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -23,7 +24,7 @@ class Client_Handshake_State : public Handshake_State
    public:
       // using Handshake_State::Handshake_State;
 
-      Client_Handshake_State(Handshake_IO* io, handshake_msg_cb cb) : Handshake_State(io, cb) {}
+      Client_Handshake_State(Handshake_IO* io, Callbacks& cb) : Handshake_State(io, cb) {}
 
       const Public_Key& get_server_public_Key() const
          {
@@ -42,6 +43,23 @@ class Client_Handshake_State : public Handshake_State
 /*
 * TLS Client Constructor
 */
+Client::Client(Callbacks& callbacks,
+               Session_Manager& session_manager,
+               Credentials_Manager& creds,
+               const Policy& policy,
+               RandomNumberGenerator& rng,
+               const Server_Information& info,
+               const Protocol_Version& offer_version,
+               const std::vector<std::string>& next_protos,
+               size_t io_buf_sz) :
+   Channel(callbacks, session_manager, rng, policy, offer_version.is_datagram_protocol(),
+           io_buf_sz),
+   m_creds(creds),
+   m_info(info)
+   {
+   init(offer_version, next_protos);
+   }
+
 Client::Client(output_fn output_fn,
                data_cb proc_cb,
                alert_cb alert_cb,
@@ -59,10 +77,7 @@ Client::Client(output_fn output_fn,
    m_creds(creds),
    m_info(info)
    {
-   const std::string srp_identifier = m_creds.srp_identifier("tls-client", m_info.hostname());
-
-   Handshake_State& state = create_handshake_state(offer_version);
-   send_client_hello(state, false, offer_version, srp_identifier, next_protos);
+   init(offer_version, next_protos);
    }
 
 Client::Client(output_fn output_fn,
@@ -82,15 +97,22 @@ Client::Client(output_fn output_fn,
    m_creds(creds),
    m_info(info)
    {
+   init(offer_version, next_protos);
+   }
+
+void Client::init(const Protocol_Version& protocol_version,
+                  const std::vector<std::string>& next_protocols)
+   {
    const std::string srp_identifier = m_creds.srp_identifier("tls-client", m_info.hostname());
 
-   Handshake_State& state = create_handshake_state(offer_version);
-   send_client_hello(state, false, offer_version, srp_identifier, next_protos);
+   Handshake_State& state = create_handshake_state(protocol_version);
+   send_client_hello(state, false, protocol_version,
+                     srp_identifier, next_protocols);
    }
 
 Handshake_State* Client::new_handshake_state(Handshake_IO* io)
    {
-   return new Client_Handshake_State(io, get_handshake_msg_cb());
+   return new Client_Handshake_State(io, callbacks());
    }
 
 std::vector<X509_Certificate>
@@ -145,16 +167,15 @@ void Client::send_client_hello(Handshake_State& state_base,
 
    if(!state.client_hello()) // not resuming
       {
+      Client_Hello::Settings client_settings(version, m_info.hostname(), srp_identifier);
       state.client_hello(new Client_Hello(
          state.handshake_io(),
          state.hash(),
-         version,
          policy(),
          rng(),
          secure_renegotiation_data_for_client_hello(),
-         next_protocols,
-         m_info.hostname(),
-         srp_identifier));
+         client_settings,
+         next_protocols));
       }
 
    secure_renegotiation_check(state.client_hello());
@@ -419,11 +440,9 @@ void Client::process_handshake_msg(const Handshake_State* active_state,
                                "tls-client",
                                m_info.hostname());
 
-         state.client_certs(
-            new Certificate(state.handshake_io(),
-                            state.hash(),
-                            client_certs)
-            );
+         state.client_certs(new Certificate(state.handshake_io(),
+                                            state.hash(),
+                                            client_certs));
          }
 
       state.client_kex(
diff --git a/src/lib/tls/tls_client.h b/src/lib/tls/tls_client.h
index 45a741878..09af053af 100644
--- a/src/lib/tls/tls_client.h
+++ b/src/lib/tls/tls_client.h
@@ -1,6 +1,7 @@
 /*
 * TLS Client
 * (C) 2004-2011 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -22,9 +23,49 @@ namespace TLS {
 class BOTAN_DLL Client final : public Channel
    {
    public:
+
       /**
       * Set up a new TLS client session
       *
+      * @param callbacks contains a set of callback function references
+      *        required by the TLS client.
+      *
+      * @param session_manager manages session state
+      *
+      * @param creds manages application/user credentials
+      *
+      * @param policy specifies other connection policy information
+      *
+      * @param rng a random number generator
+      *
+      * @param server_info is identifying information about the TLS server
+      *
+      * @param offer_version specifies which version we will offer
+      *        to the TLS server.
+      *
+      * @param next_protocols specifies protocols to advertise with ALPN
+      *
+      * @param reserved_io_buffer_size This many bytes of memory will
+      *        be preallocated for the read and write buffers. Smaller
+      *        values just mean reallocations and copies are more likely.
+      */
+     Client(Callbacks& callbacks,
+            Session_Manager& session_manager,
+            Credentials_Manager& creds,
+            const Policy& policy,
+            RandomNumberGenerator& rng,
+            const Server_Information& server_info = Server_Information(),
+            const Protocol_Version& offer_version = Protocol_Version::latest_tls_version(),
+            const std::vector<std::string>& next_protocols = {},
+            size_t reserved_io_buffer_size = TLS::Client::IO_BUF_DEFAULT_SIZE
+         );
+
+      /**
+      * DEPRECATED. This constructor is only provided for backward
+      * compatibility and should not be used in new code.
+      * 
+      * Set up a new TLS client session
+      *
       * @param output_fn is called with data for the outbound socket
       *
       * @param app_data_cb is called when new application data is received
@@ -52,7 +93,7 @@ class BOTAN_DLL Client final : public Channel
       *        be preallocated for the read and write buffers. Smaller
       *        values just mean reallocations and copies are more likely.
       */
-
+      BOTAN_DEPRECATED("Use TLS::Client(TLS::Callbacks ...)")
       Client(output_fn out,
              data_cb app_data_cb,
              alert_cb alert_cb,
@@ -64,9 +105,14 @@ class BOTAN_DLL Client final : public Channel
              const Server_Information& server_info = Server_Information(),
              const Protocol_Version& offer_version = Protocol_Version::latest_tls_version(),
              const std::vector<std::string>& next_protocols = {},
-             size_t reserved_io_buffer_size = 16*1024
+             size_t reserved_io_buffer_size = TLS::Client::IO_BUF_DEFAULT_SIZE
          );
 
+      /**
+       * DEPRECATED. This constructor is only provided for backward
+       * compatibility and should not be used in new implementations.
+       */
+      BOTAN_DEPRECATED("Use TLS::Client(TLS::Callbacks ...)")
       Client(output_fn out,
              data_cb app_data_cb,
              alert_cb alert_cb,
@@ -83,6 +129,9 @@ class BOTAN_DLL Client final : public Channel
 
       const std::string& application_protocol() const { return m_application_protocol; }
    private:
+      void init(const Protocol_Version& protocol_version,
+                const std::vector<std::string>& next_protocols);
+
       std::vector<X509_Certificate>
          get_peer_cert_chain(const Handshake_State& state) const override;
 
diff --git a/src/lib/tls/tls_extensions.h b/src/lib/tls/tls_extensions.h
index a5aac0020..cfde0067c 100644
--- a/src/lib/tls/tls_extensions.h
+++ b/src/lib/tls/tls_extensions.h
@@ -1,6 +1,7 @@
 /*
 * TLS Extensions
 * (C) 2011,2012,2016 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -34,7 +35,6 @@ enum Handshake_Extension_Type {
    TLSEXT_SRP_IDENTIFIER         = 12,
    TLSEXT_SIGNATURE_ALGORITHMS   = 13,
    TLSEXT_USE_SRTP               = 14,
-   TLSEXT_HEARTBEAT_SUPPORT      = 15,
    TLSEXT_ALPN                   = 16,
 
    TLSEXT_EXTENDED_MASTER_SECRET = 23,
diff --git a/src/lib/tls/tls_handshake_msg.h b/src/lib/tls/tls_handshake_msg.h
index 7e527abf4..618ae8d76 100644
--- a/src/lib/tls/tls_handshake_msg.h
+++ b/src/lib/tls/tls_handshake_msg.h
@@ -1,6 +1,7 @@
 /*
 * TLS Handshake Message
 * (C) 2012 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -16,6 +17,9 @@ namespace Botan {
 
 namespace TLS {
 
+class Handshake_IO;
+class Handshake_Hash;
+
 /**
 * TLS Handshake Message Base Class
 */
diff --git a/src/lib/tls/tls_handshake_state.cpp b/src/lib/tls/tls_handshake_state.cpp
index afc32ba87..71cacdabd 100644
--- a/src/lib/tls/tls_handshake_state.cpp
+++ b/src/lib/tls/tls_handshake_state.cpp
@@ -8,6 +8,7 @@
 #include <botan/internal/tls_handshake_state.h>
 #include <botan/internal/tls_messages.h>
 #include <botan/internal/tls_record.h>
+#include <botan/tls_callbacks.h>
 
 namespace Botan {
 
@@ -174,8 +175,8 @@ std::string handshake_mask_to_string(u32bit mask)
 /*
 * Initialize the SSL/TLS Handshake State
 */
-Handshake_State::Handshake_State(Handshake_IO* io, handshake_msg_cb cb) :
-   m_msg_callback(cb),
+Handshake_State::Handshake_State(Handshake_IO* io, Callbacks& cb) :
+   m_callbacks(cb),
    m_handshake_io(io),
    m_version(m_handshake_io->initial_record_version())
    {
@@ -183,6 +184,11 @@ Handshake_State::Handshake_State(Handshake_IO* io, handshake_msg_cb cb) :
 
 Handshake_State::~Handshake_State() {}
 
+void Handshake_State::note_message(const Handshake_Message& msg)
+   {
+   m_callbacks.tls_inspect_handshake_msg(msg);
+   }
+
 void Handshake_State::hello_verify_request(const Hello_Verify_Request& hello_verify)
    {
    note_message(hello_verify);
diff --git a/src/lib/tls/tls_handshake_state.h b/src/lib/tls/tls_handshake_state.h
index 2943a8637..bdec10d14 100644
--- a/src/lib/tls/tls_handshake_state.h
+++ b/src/lib/tls/tls_handshake_state.h
@@ -24,6 +24,7 @@ class KDF;
 
 namespace TLS {
 
+class Callbacks;
 class Policy;
 
 class Hello_Verify_Request;
@@ -45,9 +46,7 @@ class Finished;
 class Handshake_State
    {
    public:
-      typedef std::function<void (const Handshake_Message&)> handshake_msg_cb;
-
-      Handshake_State(Handshake_IO* io, handshake_msg_cb cb);
+      Handshake_State(Handshake_IO* io, Callbacks& callbacks);
 
       virtual ~Handshake_State();
 
@@ -164,15 +163,10 @@ class Handshake_State
 
       const Handshake_Hash& hash() const { return m_handshake_hash; }
 
-      void note_message(const Handshake_Message& msg)
-         {
-         if(m_msg_callback)
-            m_msg_callback(msg);
-         }
-
+      void note_message(const Handshake_Message& msg);
    private:
 
-      handshake_msg_cb m_msg_callback;
+      Callbacks& m_callbacks;
 
       std::unique_ptr<Handshake_IO> m_handshake_io;
 
diff --git a/src/lib/tls/tls_messages.h b/src/lib/tls/tls_messages.h
index 3bee89e13..47ff7d3d8 100644
--- a/src/lib/tls/tls_messages.h
+++ b/src/lib/tls/tls_messages.h
@@ -1,6 +1,7 @@
 /*
 * TLS Messages
 * (C) 2004-2011,2015 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -61,6 +62,26 @@ class Hello_Verify_Request final : public Handshake_Message
 class Client_Hello final : public Handshake_Message
    {
    public:
+      class Settings
+      {
+          public:
+              Settings(const Protocol_Version version,
+                       const std::string& hostname = "",
+                       const std::string& srp_identifier = "")
+                  : m_new_session_version(version),
+                    m_hostname(hostname),
+                    m_srp_identifier(srp_identifier) {};
+
+              const Protocol_Version protocol_version() const { return m_new_session_version; };
+              const std::string& hostname() const { return m_hostname; };
+              const std::string& srp_identifier() const { return m_srp_identifier; }
+
+          private:
+              const Protocol_Version m_new_session_version;
+              const std::string m_hostname;
+              const std::string m_srp_identifier;
+      };
+
       Handshake_Type type() const override { return CLIENT_HELLO; }
 
       Protocol_Version version() const { return m_version; }
@@ -162,13 +183,11 @@ class Client_Hello final : public Handshake_Message
 
       Client_Hello(Handshake_IO& io,
                    Handshake_Hash& hash,
-                   Protocol_Version version,
                    const Policy& policy,
                    RandomNumberGenerator& rng,
                    const std::vector<byte>& reneg_info,
-                   const std::vector<std::string>& next_protocols,
-                   const std::string& hostname = "",
-                   const std::string& srp_identifier = "");
+                   const Client_Hello::Settings& client_settings,
+                   const std::vector<std::string>& next_protocols);
 
       Client_Hello(Handshake_IO& io,
                    Handshake_Hash& hash,
@@ -199,6 +218,35 @@ class Client_Hello final : public Handshake_Message
 class Server_Hello final : public Handshake_Message
    {
    public:
+      class Settings
+      {
+          public:
+              Settings(const std::vector<byte> new_session_id,
+                       Protocol_Version new_session_version,
+                       u16bit ciphersuite,
+                       byte compression,
+                       bool offer_session_ticket)
+                  : m_new_session_id(new_session_id),
+                    m_new_session_version(new_session_version),
+                    m_ciphersuite(ciphersuite),
+                    m_compression(compression),
+                    m_offer_session_ticket(offer_session_ticket) {};
+
+              const std::vector<byte>& session_id() const { return m_new_session_id; };
+              Protocol_Version protocol_version() const { return m_new_session_version; };
+              u16bit ciphersuite() const { return m_ciphersuite; };
+              byte compression() const { return m_compression; }
+              bool offer_session_ticket() const { return m_offer_session_ticket; }
+
+          private:
+              const std::vector<byte> m_new_session_id;
+              Protocol_Version m_new_session_version;
+              u16bit m_ciphersuite;
+              byte m_compression;
+              bool m_offer_session_ticket;
+      };
+
+
       Handshake_Type type() const override { return SERVER_HELLO; }
 
       Protocol_Version version() const { return m_version; }
@@ -262,12 +310,8 @@ class Server_Hello final : public Handshake_Message
                    RandomNumberGenerator& rng,
                    const std::vector<byte>& secure_reneg_info,
                    const Client_Hello& client_hello,
-                   const std::vector<byte>& new_session_id,
-                   Protocol_Version new_session_version,
-                   u16bit ciphersuite,
-                   byte compression,
-                   bool offer_session_ticket,
-                   const std::string& next_protocol);
+                   const Server_Hello::Settings& settings,
+                   const std::string next_protocol);
 
       Server_Hello(Handshake_IO& io,
                    Handshake_Hash& hash,
diff --git a/src/lib/tls/tls_record.cpp b/src/lib/tls/tls_record.cpp
index eacf313a8..e028c43a0 100644
--- a/src/lib/tls/tls_record.cpp
+++ b/src/lib/tls/tls_record.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Record Handling
 * (C) 2012,2013,2014,2015 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -152,7 +153,7 @@ Connection_Cipher_State::format_ad(u64bit msg_sequence,
    }
 
 void write_record(secure_vector<byte>& output,
-                  byte msg_type, const byte msg[], size_t msg_length,
+                  Record_Message msg,
                   Protocol_Version version,
                   u64bit seq,
                   Connection_Cipher_State* cs,
@@ -160,7 +161,7 @@ void write_record(secure_vector<byte>& output,
    {
    output.clear();
 
-   output.push_back(msg_type);
+   output.push_back(msg.get_type());
    output.push_back(version.major_version());
    output.push_back(version.minor_version());
 
@@ -172,17 +173,17 @@ void write_record(secure_vector<byte>& output,
 
    if(!cs) // initial unencrypted handshake records
       {
-      output.push_back(get_byte(0, static_cast<u16bit>(msg_length)));
-      output.push_back(get_byte(1, static_cast<u16bit>(msg_length)));
+      output.push_back(get_byte<u16bit>(0, static_cast<u16bit>(msg.get_size())));
+      output.push_back(get_byte<u16bit>(1, static_cast<u16bit>(msg.get_size())));
 
-      output.insert(output.end(), msg, msg + msg_length);
+      output.insert(output.end(), msg.get_data(), msg.get_data() + msg.get_size());
 
       return;
       }
 
    if(AEAD_Mode* aead = cs->aead())
       {
-      const size_t ctext_size = aead->output_length(msg_length);
+      const size_t ctext_size = aead->output_length(msg.get_size());
 
       const std::vector<byte> nonce = cs->aead_nonce(seq);
 
@@ -193,17 +194,16 @@ void write_record(secure_vector<byte>& output,
       output.push_back(get_byte(0, static_cast<u16bit>(rec_size)));
       output.push_back(get_byte(1, static_cast<u16bit>(rec_size)));
 
-      aead->set_ad(cs->format_ad(seq, msg_type, version, static_cast<u16bit>(msg_length)));
+      aead->set_ad(cs->format_ad(seq, msg.get_type(), version, static_cast<u16bit>(msg.get_size())));
 
       if(cs->nonce_bytes_from_record() > 0)
          {
          output += std::make_pair(&nonce[cs->nonce_bytes_from_handshake()], cs->nonce_bytes_from_record());
          }
-
       BOTAN_ASSERT(aead->start(nonce).empty(), "AEAD doesn't return anything from start");
 
       const size_t offset = output.size();
-      output += std::make_pair(msg, msg_length);
+      output += std::make_pair(msg.get_data(), msg.get_size());
       aead->finish(output, offset);
 
       BOTAN_ASSERT(output.size() == offset + ctext_size, "Expected size");
@@ -213,16 +213,16 @@ void write_record(secure_vector<byte>& output,
       return;
       }
 
-   cs->mac()->update(cs->format_ad(seq, msg_type, version, static_cast<u16bit>(msg_length)));
+   cs->mac()->update(cs->format_ad(seq, msg.get_type(), version, static_cast<u16bit>(msg.get_size())));
 
-   cs->mac()->update(msg, msg_length);
+   cs->mac()->update(msg.get_data(), msg.get_size());
 
    const size_t block_size = cs->block_size();
    const size_t iv_size = cs->iv_size();
    const size_t mac_size = cs->mac_size();
 
    const size_t buf_size = round_up(
-      iv_size + msg_length + mac_size + (block_size ? 1 : 0),
+      iv_size + msg.get_size() + mac_size + (block_size ? 1 : 0),
       block_size);
 
    if(buf_size > MAX_CIPHERTEXT_SIZE)
@@ -239,7 +239,7 @@ void write_record(secure_vector<byte>& output,
       rng.randomize(&output[output.size() - iv_size], iv_size);
       }
 
-   output.insert(output.end(), msg, msg + msg_length);
+   output.insert(output.end(), msg.get_data(), msg.get_data() + msg.get_size());
 
    output.resize(output.size() + mac_size);
    cs->mac()->final(&output[output.size() - mac_size]);
@@ -247,7 +247,7 @@ void write_record(secure_vector<byte>& output,
    if(block_size)
       {
       const size_t pad_val =
-         buf_size - (iv_size + msg_length + mac_size + 1);
+         buf_size - (iv_size + msg.get_size() + mac_size + 1);
 
       for(size_t i = 0; i != pad_val + 1; ++i)
          output.push_back(static_cast<byte>(pad_val));
@@ -461,65 +461,58 @@ void decrypt_record(secure_vector<byte>& output,
    }
 
 size_t read_tls_record(secure_vector<byte>& readbuf,
-                       const byte input[],
-                       size_t input_sz,
-                       size_t& consumed,
-                       secure_vector<byte>& record,
-                       u64bit* record_sequence,
-                       Protocol_Version* record_version,
-                       Record_Type* record_type,
+                       Record_Raw_Input& raw_input,
+                       Record& rec,
                        Connection_Sequence_Numbers* sequence_numbers,
                        get_cipherstate_fn get_cipherstate)
    {
-   consumed = 0;
-
    if(readbuf.size() < TLS_HEADER_SIZE) // header incomplete?
       {
       if(size_t needed = fill_buffer_to(readbuf,
-                                        input, input_sz, consumed,
+                                        raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(),
                                         TLS_HEADER_SIZE))
          return needed;
 
       BOTAN_ASSERT_EQUAL(readbuf.size(), TLS_HEADER_SIZE, "Have an entire header");
       }
 
-   *record_version = Protocol_Version(readbuf[1], readbuf[2]);
+   *rec.get_protocol_version() = Protocol_Version(readbuf[1], readbuf[2]);
 
-   BOTAN_ASSERT(!record_version->is_datagram_protocol(), "Expected TLS");
+   BOTAN_ASSERT(!rec.get_protocol_version()->is_datagram_protocol(), "Expected TLS");
 
-   const size_t record_len = make_u16bit(readbuf[TLS_HEADER_SIZE-2],
+   const size_t record_size = make_u16bit(readbuf[TLS_HEADER_SIZE-2],
                                          readbuf[TLS_HEADER_SIZE-1]);
 
-   if(record_len > MAX_CIPHERTEXT_SIZE)
+   if(record_size > MAX_CIPHERTEXT_SIZE)
       throw TLS_Exception(Alert::RECORD_OVERFLOW,
                           "Received a record that exceeds maximum size");
 
-   if(record_len == 0)
+   if(record_size == 0)
       throw TLS_Exception(Alert::DECODE_ERROR,
                           "Received a completely empty record");
 
    if(size_t needed = fill_buffer_to(readbuf,
-                                     input, input_sz, consumed,
-                                     TLS_HEADER_SIZE + record_len))
+                                     raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(),
+                                     TLS_HEADER_SIZE + record_size))
       return needed;
 
-   BOTAN_ASSERT_EQUAL(static_cast<size_t>(TLS_HEADER_SIZE) + record_len,
+   BOTAN_ASSERT_EQUAL(static_cast<size_t>(TLS_HEADER_SIZE) + record_size,
                       readbuf.size(),
                       "Have the full record");
 
-   *record_type = static_cast<Record_Type>(readbuf[0]);
+   *rec.get_type() = static_cast<Record_Type>(readbuf[0]);
 
    u16bit epoch = 0;
 
    if(sequence_numbers)
       {
-      *record_sequence = sequence_numbers->next_read_sequence();
+      *rec.get_sequence() = sequence_numbers->next_read_sequence();
       epoch = sequence_numbers->current_read_epoch();
       }
    else
       {
       // server initial handshake case
-      *record_sequence = 0;
+      *rec.get_sequence() = 0;
       epoch = 0;
       }
 
@@ -527,7 +520,7 @@ size_t read_tls_record(secure_vector<byte>& readbuf,
 
    if(epoch == 0) // Unencrypted initial handshake
       {
-      record.assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_len);
+      rec.get_data().assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_size);
       readbuf.clear();
       return 0; // got a full record
       }
@@ -537,37 +530,30 @@ size_t read_tls_record(secure_vector<byte>& readbuf,
 
    BOTAN_ASSERT(cs, "Have cipherstate for this epoch");
 
-   decrypt_record(record,
+   decrypt_record(rec.get_data(),
                   record_contents,
-                  record_len,
-                  *record_sequence,
-                  *record_version,
-                  *record_type,
+                  record_size,
+                  *rec.get_sequence(),
+                  *rec.get_protocol_version(),
+                  *rec.get_type(),
                   *cs);
 
    if(sequence_numbers)
-      sequence_numbers->read_accept(*record_sequence);
+      sequence_numbers->read_accept(*rec.get_sequence());
 
    readbuf.clear();
    return 0;
    }
 
 size_t read_dtls_record(secure_vector<byte>& readbuf,
-                        const byte input[],
-                        size_t input_sz,
-                        size_t& consumed,
-                        secure_vector<byte>& record,
-                        u64bit* record_sequence,
-                        Protocol_Version* record_version,
-                        Record_Type* record_type,
+                        Record_Raw_Input& raw_input,
+                        Record& rec,
                         Connection_Sequence_Numbers* sequence_numbers,
                         get_cipherstate_fn get_cipherstate)
    {
-   consumed = 0;
-
    if(readbuf.size() < DTLS_HEADER_SIZE) // header incomplete?
       {
-      if(fill_buffer_to(readbuf, input, input_sz, consumed, DTLS_HEADER_SIZE))
+      if(fill_buffer_to(readbuf, raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(), DTLS_HEADER_SIZE))
          {
          readbuf.clear();
          return 0;
@@ -576,38 +562,35 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
       BOTAN_ASSERT_EQUAL(readbuf.size(), DTLS_HEADER_SIZE, "Have an entire header");
       }
 
-   *record_version = Protocol_Version(readbuf[1], readbuf[2]);
+   *rec.get_protocol_version() = Protocol_Version(readbuf[1], readbuf[2]);
 
-   BOTAN_ASSERT(record_version->is_datagram_protocol(), "Expected DTLS");
+   BOTAN_ASSERT(rec.get_protocol_version()->is_datagram_protocol(), "Expected DTLS");
 
-   const size_t record_len = make_u16bit(readbuf[DTLS_HEADER_SIZE-2],
-                                         readbuf[DTLS_HEADER_SIZE-1]);
+   const size_t record_size = make_u16bit(readbuf[DTLS_HEADER_SIZE-2],
+                                          readbuf[DTLS_HEADER_SIZE-1]);
 
-   // Invalid packet:
-   if(record_len == 0 || record_len > MAX_CIPHERTEXT_SIZE)
-      {
-      readbuf.clear();
-      return 0;
-      }
+   if(record_size > MAX_CIPHERTEXT_SIZE)
+      throw TLS_Exception(Alert::RECORD_OVERFLOW,
+                          "Got message that exceeds maximum size");
 
-   if(fill_buffer_to(readbuf, input, input_sz, consumed, DTLS_HEADER_SIZE + record_len))
+   if(fill_buffer_to(readbuf, raw_input.get_data(), raw_input.get_size(), raw_input.get_consumed(), DTLS_HEADER_SIZE + record_size))
       {
       // Truncated packet?
       readbuf.clear();
       return 0;
       }
 
-   BOTAN_ASSERT_EQUAL(static_cast<size_t>(DTLS_HEADER_SIZE) + record_len, readbuf.size(),
+   BOTAN_ASSERT_EQUAL(static_cast<size_t>(DTLS_HEADER_SIZE) + record_size, readbuf.size(),
                       "Have the full record");
 
-   *record_type = static_cast<Record_Type>(readbuf[0]);
+   *rec.get_type() = static_cast<Record_Type>(readbuf[0]);
 
    u16bit epoch = 0;
 
-   *record_sequence = load_be<u64bit>(&readbuf[3], 0);
-   epoch = (*record_sequence >> 48);
+   *rec.get_sequence() = load_be<u64bit>(&readbuf[3], 0);
+   epoch = (*rec.get_sequence() >> 48);
 
-   if(sequence_numbers && sequence_numbers->already_seen(*record_sequence))
+   if(sequence_numbers && sequence_numbers->already_seen(*rec.get_sequence()))
       {
       readbuf.clear();
       return 0;
@@ -617,7 +600,7 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
 
    if(epoch == 0) // Unencrypted initial handshake
       {
-      record.assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_len);
+      rec.get_data().assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_size);
       readbuf.clear();
       return 0; // got a full record
       }
@@ -629,23 +612,23 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
 
       BOTAN_ASSERT(cs, "Have cipherstate for this epoch");
 
-      decrypt_record(record,
+      decrypt_record(rec.get_data(),
                      record_contents,
-                     record_len,
-                     *record_sequence,
-                     *record_version,
-                     *record_type,
+                     record_size,
+                     *rec.get_sequence(),
+                     *rec.get_protocol_version(),
+                     *rec.get_type(),
                      *cs);
       }
    catch(std::exception)
       {
       readbuf.clear();
-      *record_type = NO_RECORD;
+      *rec.get_type() = NO_RECORD;
       return 0;
       }
 
    if(sequence_numbers)
-      sequence_numbers->read_accept(*record_sequence);
+      sequence_numbers->read_accept(*rec.get_sequence());
 
    readbuf.clear();
    return 0;
@@ -654,24 +637,16 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
 }
 
 size_t read_record(secure_vector<byte>& readbuf,
-                   const byte input[],
-                   size_t input_sz,
-                   bool is_datagram,
-                   size_t& consumed,
-                   secure_vector<byte>& record,
-                   u64bit* record_sequence,
-                   Protocol_Version* record_version,
-                   Record_Type* record_type,
+                   Record_Raw_Input& raw_input,
+                   Record& rec,
                    Connection_Sequence_Numbers* sequence_numbers,
                    get_cipherstate_fn get_cipherstate)
    {
-   if(is_datagram)
-      return read_dtls_record(readbuf, input, input_sz, consumed,
-                              record, record_sequence, record_version, record_type,
+   if(raw_input.is_datagram())
+      return read_dtls_record(readbuf, raw_input, rec,
                               sequence_numbers, get_cipherstate);
    else
-      return read_tls_record(readbuf, input, input_sz, consumed,
-                             record, record_sequence, record_version, record_type,
+      return read_tls_record(readbuf, raw_input, rec,
                              sequence_numbers, get_cipherstate);
    }
 
diff --git a/src/lib/tls/tls_record.h b/src/lib/tls/tls_record.h
index e3b0b9b58..c16b919b5 100644
--- a/src/lib/tls/tls_record.h
+++ b/src/lib/tls/tls_record.h
@@ -1,6 +1,7 @@
 /*
 * TLS Record Handling
 * (C) 2004-2012 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -90,6 +91,80 @@ class Connection_Cipher_State
       size_t m_iv_size = 0;
    };
 
+class Record
+   {
+   public:
+      Record(secure_vector<byte>& data,
+             u64bit* sequence,
+             Protocol_Version* protocol_version,
+             Record_Type* type)
+         : m_data(data), m_sequence(sequence), m_protocol_version(protocol_version),
+           m_type(type), m_size(data.size()) {};
+
+      secure_vector<byte>& get_data() { return m_data; }
+
+      Protocol_Version* get_protocol_version() { return m_protocol_version; }
+
+      u64bit* get_sequence() { return m_sequence; }
+
+      Record_Type* get_type() { return m_type; }
+
+      size_t& get_size() { return m_size; }
+
+   private:
+      secure_vector<byte>& m_data;
+      u64bit* m_sequence;
+      Protocol_Version* m_protocol_version;
+      Record_Type* m_type;
+      size_t m_size;
+   };
+
+class Record_Message
+   {
+   public:
+      Record_Message(const byte* data, size_t size)
+         : m_type(0), m_sequence(0), m_data(data), m_size(size) {};
+      Record_Message(byte type, u64bit sequence, const byte* data, size_t size)
+         : m_type(type), m_sequence(sequence), m_data(data),
+           m_size(size) {};
+
+      byte& get_type() { return m_type; };
+      u64bit& get_sequence() { return m_sequence; };
+      const byte* get_data() { return m_data; };
+      size_t& get_size() { return m_size; };
+
+   private:
+      byte m_type;
+      u64bit m_sequence;
+      const byte* m_data;
+      size_t m_size;
+};
+
+class Record_Raw_Input
+   {
+   public:
+      Record_Raw_Input(const byte* data, size_t size, size_t& consumed,
+                       bool is_datagram)
+         : m_data(data), m_size(size), m_consumed(consumed),
+           m_is_datagram(is_datagram) {};
+
+      const byte*& get_data() { return m_data; };
+
+      size_t& get_size() { return m_size; };
+
+      size_t& get_consumed() { return m_consumed; };
+      void set_consumed(size_t consumed) { m_consumed = consumed; }
+
+      bool is_datagram() { return m_is_datagram; };
+
+   private:
+      const byte* m_data;
+      size_t m_size;
+      size_t& m_consumed;
+      bool m_is_datagram;
+   };
+
+
 /**
 * Create a TLS record
 * @param write_buffer the output record is placed here
@@ -103,7 +178,7 @@ class Connection_Cipher_State
 * @return number of bytes written to write_buffer
 */
 void write_record(secure_vector<byte>& write_buffer,
-                  byte msg_type, const byte msg[], size_t msg_length,
+                  Record_Message rec_msg,
                   Protocol_Version version,
                   u64bit msg_sequence,
                   Connection_Cipher_State* cipherstate,
@@ -117,14 +192,8 @@ typedef std::function<std::shared_ptr<Connection_Cipher_State> (u16bit)> get_cip
 * @return zero if full message, else number of bytes still needed
 */
 size_t read_record(secure_vector<byte>& read_buffer,
-                   const byte input[],
-                   size_t input_length,
-                   bool is_datagram,
-                   size_t& input_consumed,
-                   secure_vector<byte>& record,
-                   u64bit* record_sequence,
-                   Protocol_Version* record_version,
-                   Record_Type* record_type,
+                   Record_Raw_Input& raw_input,
+                   Record& rec,
                    Connection_Sequence_Numbers* sequence_numbers,
                    get_cipherstate_fn get_cipherstate);
 
diff --git a/src/lib/tls/tls_server.cpp b/src/lib/tls/tls_server.cpp
index 41b14ae08..2e546eab1 100644
--- a/src/lib/tls/tls_server.cpp
+++ b/src/lib/tls/tls_server.cpp
@@ -1,6 +1,7 @@
 /*
 * TLS Server
 * (C) 2004-2011,2012,2016 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -9,30 +10,41 @@
 #include <botan/internal/tls_handshake_state.h>
 #include <botan/internal/tls_messages.h>
 #include <botan/internal/stl_util.h>
+#include <botan/tls_magic.h>
 
 namespace Botan {
 
 namespace TLS {
 
-namespace {
-
 class Server_Handshake_State : public Handshake_State
    {
    public:
-      // using Handshake_State::Handshake_State;
+      Server_Handshake_State(Handshake_IO* io, Callbacks& cb)
+         : Handshake_State(io, cb) {}
+
+      Private_Key* server_rsa_kex_key() { return m_server_rsa_kex_key; }
+      void set_server_rsa_kex_key(Private_Key* key)
+         { m_server_rsa_kex_key = key; }
+
+      bool allow_session_resumption() const
+         { return m_allow_session_resumption; }
+      void set_allow_session_resumption(bool allow_session_resumption)
+         { m_allow_session_resumption = allow_session_resumption; }
 
-      Server_Handshake_State(Handshake_IO* io, handshake_msg_cb cb) : Handshake_State(io, cb) {}
 
+   private:
       // Used by the server only, in case of RSA key exchange. Not owned
-      Private_Key* server_rsa_kex_key = nullptr;
+      Private_Key* m_server_rsa_kex_key = nullptr;
 
       /*
       * Used by the server to know if resumption should be allowed on
       * a server-initiated renegotiation
       */
-      bool allow_session_resumption = true;
+      bool m_allow_session_resumption = true;
    };
 
+namespace {
+
 bool check_for_resume(Session& session_info,
                       Session_Manager& session_manager,
                       Credentials_Manager& credentials,
@@ -225,6 +237,19 @@ get_server_certs(const std::string& hostname,
 /*
 * TLS Server Constructor
 */
+Server::Server(Callbacks& callbacks,
+               Session_Manager& session_manager,
+               Credentials_Manager& creds,
+               const Policy& policy,
+               RandomNumberGenerator& rng,
+               bool is_datagram,
+               size_t io_buf_sz) :
+   Channel(callbacks, session_manager, rng, policy,
+           is_datagram, io_buf_sz),
+   m_creds(creds)
+   {
+   }
+
 Server::Server(output_fn output,
                data_cb data_cb,
                alert_cb alert_cb,
@@ -236,13 +261,15 @@ Server::Server(output_fn output,
                next_protocol_fn next_proto,
                bool is_datagram,
                size_t io_buf_sz) :
-   Channel(output, data_cb, alert_cb, handshake_cb, Channel::handshake_msg_cb(),
-           session_manager, rng, policy, is_datagram, io_buf_sz),
+   Channel(output, data_cb, alert_cb, handshake_cb,
+           Channel::handshake_msg_cb(), session_manager,
+           rng, policy, is_datagram, io_buf_sz),
    m_creds(creds),
    m_choose_next_protocol(next_proto)
    {
    }
 
+
 Server::Server(output_fn output,
                data_cb data_cb,
                alert_cb alert_cb,
@@ -263,8 +290,7 @@ Server::Server(output_fn output,
 
 Handshake_State* Server::new_handshake_state(Handshake_IO* io)
    {
-   std::unique_ptr<Handshake_State> state(
-      new Server_Handshake_State(io, get_handshake_msg_cb()));
+   std::unique_ptr<Handshake_State> state(new Server_Handshake_State(io, callbacks()));
 
    state->set_expected_next(CLIENT_HELLO);
    return state.release();
@@ -284,441 +310,516 @@ Server::get_peer_cert_chain(const Handshake_State& state) const
 void Server::initiate_handshake(Handshake_State& state,
                                 bool force_full_renegotiation)
    {
-   dynamic_cast<Server_Handshake_State&>(state).allow_session_resumption =
-      !force_full_renegotiation;
+   dynamic_cast<Server_Handshake_State&>(state).
+       set_allow_session_resumption(!force_full_renegotiation);
 
    Hello_Request hello_req(state.handshake_io());
    }
 
 /*
-* Process a handshake message
+* Process a CLIENT HELLO Message
 */
-void Server::process_handshake_msg(const Handshake_State* active_state,
-                                   Handshake_State& state_base,
-                                   Handshake_Type type,
-                                   const std::vector<byte>& contents)
-   {
-   Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);
-
-   state.confirm_transition_to(type);
-
-   /*
-   * The change cipher spec message isn't technically a handshake
-   * message so it's not included in the hash. The finished and
-   * certificate verify messages are verified based on the current
-   * state of the hash *before* this message so we delay adding them
-   * to the hash computation until we've processed them below.
-   */
-   if(type != HANDSHAKE_CCS && type != FINISHED && type != CERTIFICATE_VERIFY)
+void Server::process_client_hello_msg(const Handshake_State* active_state,
+                                      Server_Handshake_State& pending_state,
+                                      const std::vector<byte>& contents)
+{
+   const bool initial_handshake = !active_state;
+
+   if(!policy().allow_insecure_renegotiation() &&
+      !(initial_handshake || secure_renegotiation_supported()))
       {
-      state.hash().update(state.handshake_io().format(contents, type));
+      send_warning_alert(Alert::NO_RENEGOTIATION);
+      return;
       }
 
-   if(type == CLIENT_HELLO)
+   pending_state.client_hello(new Client_Hello(contents));
+   const Protocol_Version client_version = pending_state.client_hello()->version();
+
+   Protocol_Version negotiated_version;
+
+   const Protocol_Version latest_supported =
+      policy().latest_supported_version(client_version.is_datagram_protocol());
+
+   if((initial_handshake && client_version.known_version()) ||
+      (!initial_handshake && client_version == active_state->version()))
       {
-      const bool initial_handshake = !active_state;
+      /*
+      Common cases: new client hello with some known version, or a
+      renegotiation using the same version as previously
+      negotiated.
+      */
 
-      if(!policy().allow_insecure_renegotiation() &&
-         !(initial_handshake || secure_renegotiation_supported()))
+      negotiated_version = client_version;
+      }
+   else if(!initial_handshake && (client_version != active_state->version()))
+      {
+      /*
+      * If this is a renegotiation, and the client has offered a
+      * later version than what it initially negotiated, negotiate
+      * the old version. This matches OpenSSL's behavior. If the
+      * client is offering a version earlier than what it initially
+      * negotiated, reject as a probable attack.
+      */
+      if(active_state->version() > client_version)
          {
-         send_warning_alert(Alert::NO_RENEGOTIATION);
-         return;
+         throw TLS_Exception(Alert::PROTOCOL_VERSION,
+                              "Client negotiated " +
+                              active_state->version().to_string() +
+                              " then renegotiated with " +
+                              client_version.to_string());
          }
+      else
+         negotiated_version = active_state->version();
+      }
+   else
+      {
+      /*
+      New negotiation using a version we don't know. Offer them the
+      best we currently know and support
+      */
+      negotiated_version = latest_supported;
+      }
 
-      state.client_hello(new Client_Hello(contents));
+   if(!policy().acceptable_protocol_version(negotiated_version))
+      {
+      throw TLS_Exception(Alert::PROTOCOL_VERSION,
+                           "Client version " + negotiated_version.to_string() +
+                           " is unacceptable by policy");
+      }
 
-      const Protocol_Version client_version = state.client_hello()->version();
+   if(pending_state.client_hello()->sent_fallback_scsv())
+      {
+      if(latest_supported > client_version)
+         throw TLS_Exception(Alert::INAPPROPRIATE_FALLBACK,
+                              "Client signalled fallback SCSV, possible attack");
+      }
 
-      Protocol_Version negotiated_version;
+   secure_renegotiation_check(pending_state.client_hello());
 
-      const Protocol_Version latest_supported =
-         policy().latest_supported_version(client_version.is_datagram_protocol());
+   pending_state.set_version(negotiated_version);
 
-      if((initial_handshake && client_version.known_version()) ||
-         (!initial_handshake && client_version == active_state->version()))
-         {
-         /*
-         Common cases: new client hello with some known version, or a
-         renegotiation using the same version as previously
-         negotiated.
-         */
+   Session session_info;
+   const bool resuming =
+      pending_state.allow_session_resumption() &&
+      check_for_resume(session_info,
+                       session_manager(),
+                       m_creds,
+                       pending_state.client_hello(),
+                       std::chrono::seconds(policy().session_ticket_lifetime()));
 
-         negotiated_version = client_version;
-         }
-      else if(!initial_handshake && (client_version != active_state->version()))
-         {
-         /*
-         * If this is a renegotiation, and the client has offered a
-         * later version than what it initially negotiated, negotiate
-         * the old version. This matches OpenSSL's behavior. If the
-         * client is offering a version earlier than what it initially
-         * negotiated, reject as a probable attack.
-         */
-         if(active_state->version() > client_version)
-            {
-            throw TLS_Exception(Alert::PROTOCOL_VERSION,
-                                "Client negotiated " +
-                                active_state->version().to_string() +
-                                " then renegotiated with " +
-                                client_version.to_string());
-            }
-         else
-            negotiated_version = active_state->version();
-         }
-      else
-         {
-         /*
-         New negotiation using a version we don't know. Offer them the
-         best we currently know and support
-         */
-         negotiated_version = latest_supported;
-         }
+   bool have_session_ticket_key = false;
 
-      if(!policy().acceptable_protocol_version(negotiated_version))
-         {
-         throw TLS_Exception(Alert::PROTOCOL_VERSION,
-                             "Client version " + negotiated_version.to_string() +
-                             " is unacceptable by policy");
-         }
+   try
+      {
+      have_session_ticket_key =
+         m_creds.psk("tls-server", "session-ticket", "").length() > 0;
+      }
+   catch(...) {}
+
+   m_next_protocol = "";
+   if(pending_state.client_hello()->supports_alpn())
+      {
+      m_next_protocol = callbacks().tls_server_choose_app_protocol(pending_state.client_hello()->next_protocols());
 
-      if(state.client_hello()->sent_fallback_scsv())
+      // if the callback return was empty, fall back to the (deprecated) std::function
+      if(m_next_protocol.empty() && m_choose_next_protocol)
          {
-         if(latest_supported > client_version)
-            throw TLS_Exception(Alert::INAPPROPRIATE_FALLBACK,
-                                "Client signalled fallback SCSV, possible attack");
+         m_next_protocol = m_choose_next_protocol(pending_state.client_hello()->next_protocols());
          }
+      }
 
-      secure_renegotiation_check(state.client_hello());
+   if(resuming)
+      {
+      this->session_resume(pending_state, have_session_ticket_key, session_info);
+      }
+   else // new session
+      {
+      this->session_create(pending_state, have_session_ticket_key);
+      }
+}
 
-      state.set_version(negotiated_version);
+void Server::process_certificate_msg(Server_Handshake_State& pending_state,
+                                     const std::vector<byte>& contents)
+{
+   pending_state.client_certs(new Certificate(contents));
+   pending_state.set_expected_next(CLIENT_KEX);
+}
 
-      Session session_info;
-      const bool resuming =
-         state.allow_session_resumption &&
-         check_for_resume(session_info,
-                          session_manager(),
-                          m_creds,
-                          state.client_hello(),
-                          std::chrono::seconds(policy().session_ticket_lifetime()));
+void Server::process_client_key_exchange_msg(Server_Handshake_State& pending_state,
+                                             const std::vector<byte>& contents)
+{
+   if(pending_state.received_handshake_msg(CERTIFICATE) && !pending_state.client_certs()->empty())
+      pending_state.set_expected_next(CERTIFICATE_VERIFY);
+   else
+      pending_state.set_expected_next(HANDSHAKE_CCS);
 
-      bool have_session_ticket_key = false;
+   pending_state.client_kex(
+      new Client_Key_Exchange(contents, pending_state,
+                              pending_state.server_rsa_kex_key(),
+                              m_creds, policy(), rng())
+      );
 
-      try
-         {
-         have_session_ticket_key =
-            m_creds.psk("tls-server", "session-ticket", "").length() > 0;
-         }
-      catch(...) {}
+   pending_state.compute_session_keys();
+}
 
-      m_next_protocol = "";
-      if(m_choose_next_protocol && state.client_hello()->supports_alpn())
-         m_next_protocol = m_choose_next_protocol(state.client_hello()->next_protocols());
+void Server::process_change_cipher_spec_msg(Server_Handshake_State& pending_state)
+{
+   pending_state.set_expected_next(FINISHED);
+   change_cipher_spec_reader(SERVER);
+}
 
-      if(resuming)
-         {
-         // Only offer a resuming client a new ticket if they didn't send one this time,
-         // ie, resumed via server-side resumption. TODO: also send one if expiring soon?
-
-         const bool offer_new_session_ticket =
-            (state.client_hello()->supports_session_ticket() &&
-             state.client_hello()->session_ticket().empty() &&
-             have_session_ticket_key);
-
-         state.server_hello(new Server_Hello(
-               state.handshake_io(),
-               state.hash(),
-               policy(),
-               rng(),
-               secure_renegotiation_data_for_server_hello(),
-               *state.client_hello(),
-               session_info,
-               offer_new_session_ticket,
-               m_next_protocol
-            ));
-
-         secure_renegotiation_check(state.server_hello());
-
-         state.compute_session_keys(session_info.master_secret());
-
-         if(!save_session(session_info))
-            {
-            session_manager().remove_entry(session_info.session_id());
-
-            if(state.server_hello()->supports_session_ticket()) // send an empty ticket
-               {
-               state.new_session_ticket(
-                  new New_Session_Ticket(state.handshake_io(),
-                                         state.hash())
-                  );
-               }
-            }
+void Server::process_certificate_verify_msg(Server_Handshake_State& pending_state,
+                                            Handshake_Type type,
+                                            const std::vector<byte>& contents)
+{
+    pending_state.client_verify ( new Certificate_Verify ( contents, pending_state.version() ) );
+
+    const std::vector<X509_Certificate>& client_certs =
+        pending_state.client_certs()->cert_chain();
+
+    const bool sig_valid =
+        pending_state.client_verify()->verify ( client_certs[0], pending_state, policy() );
+
+    pending_state.hash().update ( pending_state.handshake_io().format ( contents, type ) );
+
+    /*
+    * Using DECRYPT_ERROR looks weird here, but per RFC 4346 is for
+    * "A handshake cryptographic operation failed, including being
+    * unable to correctly verify a signature, ..."
+    */
+    if ( !sig_valid )
+        throw TLS_Exception ( Alert::DECRYPT_ERROR, "Client cert verify failed" );
+
+    try
+        {
+        m_creds.verify_certificate_chain ( "tls-server", "", client_certs );
+        }
+    catch ( std::exception& e )
+        {
+        throw TLS_Exception ( Alert::BAD_CERTIFICATE, e.what() );
+        }
+
+    pending_state.set_expected_next ( HANDSHAKE_CCS );
+}
 
-         if(state.server_hello()->supports_session_ticket() && !state.new_session_ticket())
-            {
-            try
-               {
-               const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");
-
-               state.new_session_ticket(
-                  new New_Session_Ticket(state.handshake_io(),
-                                         state.hash(),
-                                         session_info.encrypt(ticket_key, rng()),
-                                         policy().session_ticket_lifetime())
-                  );
-               }
-            catch(...) {}
-
-            if(!state.new_session_ticket())
-               {
-               state.new_session_ticket(
-                  new New_Session_Ticket(state.handshake_io(), state.hash())
-                  );
-               }
-            }
+void Server::process_finished_msg(Server_Handshake_State& pending_state,
+                                  Handshake_Type type,
+                                  const std::vector<byte>& contents)
+{
+    pending_state.set_expected_next ( HANDSHAKE_NONE );
 
-         state.handshake_io().send(Change_Cipher_Spec());
+    pending_state.client_finished ( new Finished ( contents ) );
 
-         change_cipher_spec_writer(SERVER);
+    if ( !pending_state.client_finished()->verify ( pending_state, CLIENT ) )
+        throw TLS_Exception ( Alert::DECRYPT_ERROR,
+                              "Finished message didn't verify" );
 
-         state.server_finished(new Finished(state.handshake_io(), state, SERVER));
-         state.set_expected_next(HANDSHAKE_CCS);
-         }
-      else // new session
-         {
-         std::map<std::string, std::vector<X509_Certificate> > cert_chains;
+    if ( !pending_state.server_finished() )
+        {
+        // already sent finished if resuming, so this is a new session
 
-         const std::string sni_hostname = state.client_hello()->sni_hostname();
+        pending_state.hash().update ( pending_state.handshake_io().format ( contents, type ) );
 
-         cert_chains = get_server_certs(sni_hostname, m_creds);
+        Session session_info(
+            pending_state.server_hello()->session_id(),
+            pending_state.session_keys().master_secret(),
+            pending_state.server_hello()->version(),
+            pending_state.server_hello()->ciphersuite(),
+            pending_state.server_hello()->compression_method(),
+            SERVER,
+            pending_state.server_hello()->supports_extended_master_secret(),
+            get_peer_cert_chain ( pending_state ),
+            std::vector<byte>(),
+            Server_Information(pending_state.client_hello()->sni_hostname()),
+            pending_state.srp_identifier(),
+            pending_state.server_hello()->srtp_profile()
+            );
 
-         if(sni_hostname != "" && cert_chains.empty())
+        if ( save_session ( session_info ) )
             {
-            cert_chains = get_server_certs("", m_creds);
-
-            /*
-            * Only send the unrecognized_name alert if we couldn't
-            * find any certs for the requested name but did find at
-            * least one cert to use in general. That avoids sending an
-            * unrecognized_name when a server is configured for purely
-            * anonymous operation.
-            */
-            if(!cert_chains.empty())
-               send_alert(Alert(Alert::UNRECOGNIZED_NAME));
+            if ( pending_state.server_hello()->supports_session_ticket() )
+                {
+                try
+                    {
+                    const SymmetricKey ticket_key = m_creds.psk ( "tls-server", "session-ticket", "" );
+
+                    pending_state.new_session_ticket (
+                        new New_Session_Ticket ( pending_state.handshake_io(),
+                                                 pending_state.hash(),
+                                                 session_info.encrypt ( ticket_key, rng() ),
+                                                 policy().session_ticket_lifetime() )
+                    );
+                    }
+                catch ( ... ) {}
+                }
+            else
+                session_manager().save ( session_info );
             }
 
-         state.server_hello(new Server_Hello(
-               state.handshake_io(),
-               state.hash(),
-               policy(),
-               rng(),
-               secure_renegotiation_data_for_server_hello(),
-               *state.client_hello(),
-               make_hello_random(rng(), policy()), // new session ID
-               state.version(),
-               choose_ciphersuite(policy(), state.version(), m_creds, cert_chains, state.client_hello()),
-               choose_compression(policy(), state.client_hello()->compression_methods()),
-               have_session_ticket_key,
-               m_next_protocol)
+        if ( !pending_state.new_session_ticket() &&
+                pending_state.server_hello()->supports_session_ticket() )
+            {
+            pending_state.new_session_ticket (
+                new New_Session_Ticket ( pending_state.handshake_io(), pending_state.hash() )
             );
+            }
 
-         secure_renegotiation_check(state.server_hello());
+        pending_state.handshake_io().send ( Change_Cipher_Spec() );
 
-         const std::string sig_algo = state.ciphersuite().sig_algo();
-         const std::string kex_algo = state.ciphersuite().kex_algo();
+        change_cipher_spec_writer ( SERVER );
 
-         if(sig_algo != "")
-            {
-            BOTAN_ASSERT(!cert_chains[sig_algo].empty(),
-                         "Attempting to send empty certificate chain");
+        pending_state.server_finished ( new Finished ( pending_state.handshake_io(), pending_state, SERVER ) );
+        }
 
-            state.server_certs(new Certificate(state.handshake_io(),
-                                               state.hash(),
-                                               cert_chains[sig_algo]));
-            }
+    activate_session();
 
-         Private_Key* private_key = nullptr;
+}
 
-         if(kex_algo == "RSA" || sig_algo != "")
-            {
-            private_key = m_creds.private_key_for(
-               state.server_certs()->cert_chain()[0],
-               "tls-server",
-               sni_hostname);
+/*
+* Process a handshake message
+*/
+void Server::process_handshake_msg(const Handshake_State* active_state,
+                                   Handshake_State& state_base,
+                                   Handshake_Type type,
+                                   const std::vector<byte>& contents)
+   {
+   Server_Handshake_State& state = dynamic_cast<Server_Handshake_State&>(state_base);
+   state.confirm_transition_to(type);
 
-            if(!private_key)
-               throw Internal_Error("No private key located for associated server cert");
-            }
+   /*
+   * The change cipher spec message isn't technically a handshake
+   * message so it's not included in the hash. The finished and
+   * certificate verify messages are verified based on the current
+   * state of the hash *before* this message so we delay adding them
+   * to the hash computation until we've processed them below.
+   */
+   if(type != HANDSHAKE_CCS && type != FINISHED && type != CERTIFICATE_VERIFY)
+      {
+      state.hash().update(state.handshake_io().format(contents, type));
+      }
 
-         if(kex_algo == "RSA")
-            {
-            state.server_rsa_kex_key = private_key;
-            }
-         else
-            {
-            state.server_kex(new Server_Key_Exchange(state.handshake_io(),
-                                                     state, policy(),
-                                                     m_creds, rng(), private_key));
-            }
+   switch(type)
+      {
+      case CLIENT_HELLO:
+         this->process_client_hello_msg(active_state, state, contents);
+      break;
 
-         auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);
+      case CERTIFICATE:
+         this->process_certificate_msg(state, contents);
+      break;
 
-         std::vector<X509_DN> client_auth_CAs;
+      case CLIENT_KEX:
+         this->process_client_key_exchange_msg(state, contents);
+      break;
+
+      case CERTIFICATE_VERIFY:
+         this->process_certificate_verify_msg(state, type, contents);
+      break;
+
+      case HANDSHAKE_CCS:
+         this->process_change_cipher_spec_msg(state);
+      break;
+
+      case FINISHED:
+         this->process_finished_msg(state, type, contents);
+      break;
+
+      default:
+         throw Unexpected_Message("Unknown handshake message received");
+         break;
+      }
+   }
 
-         for(auto store : trusted_CAs)
+void Server::session_resume(Server_Handshake_State& pending_state,
+                            bool have_session_ticket_key,
+                            Session& session_info)
+   {
+      // Only offer a resuming client a new ticket if they didn't send one this time,
+      // ie, resumed via server-side resumption. TODO: also send one if expiring soon?
+
+      const bool offer_new_session_ticket =
+         (pending_state.client_hello()->supports_session_ticket() &&
+            pending_state.client_hello()->session_ticket().empty() &&
+            have_session_ticket_key);
+
+      pending_state.server_hello(new Server_Hello(
+            pending_state.handshake_io(),
+            pending_state.hash(),
+            policy(),
+            rng(),
+            secure_renegotiation_data_for_server_hello(),
+            *pending_state.client_hello(),
+            session_info,
+            offer_new_session_ticket,
+            m_next_protocol
+         ));
+
+      secure_renegotiation_check(pending_state.server_hello());
+
+      pending_state.compute_session_keys(session_info.master_secret());
+
+      if(!save_session(session_info))
+         {
+         session_manager().remove_entry(session_info.session_id());
+
+         if(pending_state.server_hello()->supports_session_ticket()) // send an empty ticket
             {
-            auto subjects = store->all_subjects();
-            client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
+            pending_state.new_session_ticket(
+               new New_Session_Ticket(pending_state.handshake_io(),
+                                       pending_state.hash())
+               );
             }
+         }
 
-         if(!client_auth_CAs.empty() && state.ciphersuite().sig_algo() != "")
+      if(pending_state.server_hello()->supports_session_ticket() && !pending_state.new_session_ticket())
+         {
+         try
             {
-            state.cert_req(
-               new Certificate_Req(state.handshake_io(), state.hash(),
-                                   policy(), client_auth_CAs, state.version()));
+            const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");
 
-            state.set_expected_next(CERTIFICATE);
+            pending_state.new_session_ticket(
+               new New_Session_Ticket(pending_state.handshake_io(),
+                                      pending_state.hash(),
+                                      session_info.encrypt(ticket_key, rng()),
+                                      policy().session_ticket_lifetime())
+               );
             }
+         catch(...) {}
 
-         /*
-         * If the client doesn't have a cert they want to use they are
-         * allowed to send either an empty cert message or proceed
-         * directly to the client key exchange, so allow either case.
-         */
-         state.set_expected_next(CLIENT_KEX);
-
-         state.server_hello_done(new Server_Hello_Done(state.handshake_io(), state.hash()));
+         if(!pending_state.new_session_ticket())
+            {
+            pending_state.new_session_ticket(
+               new New_Session_Ticket(pending_state.handshake_io(), pending_state.hash())
+               );
+            }
          }
-      }
-   else if(type == CERTIFICATE)
-      {
-      state.client_certs(new Certificate(contents));
 
-      state.set_expected_next(CLIENT_KEX);
-      }
-   else if(type == CLIENT_KEX)
-      {
-      if(state.received_handshake_msg(CERTIFICATE) && !state.client_certs()->empty())
-         state.set_expected_next(CERTIFICATE_VERIFY);
-      else
-         state.set_expected_next(HANDSHAKE_CCS);
+      pending_state.handshake_io().send(Change_Cipher_Spec());
 
-      state.client_kex(
-         new Client_Key_Exchange(contents, state,
-                                 state.server_rsa_kex_key,
-                                 m_creds, policy(), rng())
-         );
+      change_cipher_spec_writer(SERVER);
 
-      state.compute_session_keys();
-      }
-   else if(type == CERTIFICATE_VERIFY)
-      {
-      state.client_verify(new Certificate_Verify(contents, state.version()));
+      pending_state.server_finished(new Finished(pending_state.handshake_io(), pending_state, SERVER));
+      pending_state.set_expected_next(HANDSHAKE_CCS);
+   }
+
+void Server::session_create(Server_Handshake_State& pending_state,
+                            bool have_session_ticket_key)
+   {
+   std::map<std::string, std::vector<X509_Certificate> > cert_chains;
 
-      const std::vector<X509_Certificate>& client_certs =
-         state.client_certs()->cert_chain();
+   const std::string sni_hostname = pending_state.client_hello()->sni_hostname();
 
-      const bool sig_valid =
-         state.client_verify()->verify(client_certs[0], state, policy());
+   cert_chains = get_server_certs(sni_hostname, m_creds);
 
-      state.hash().update(state.handshake_io().format(contents, type));
+   if(sni_hostname != "" && cert_chains.empty())
+      {
+      cert_chains = get_server_certs("", m_creds);
 
       /*
-      * Using DECRYPT_ERROR looks weird here, but per RFC 4346 is for
-      * "A handshake cryptographic operation failed, including being
-      * unable to correctly verify a signature, ..."
+      * Only send the unrecognized_name alert if we couldn't
+      * find any certs for the requested name but did find at
+      * least one cert to use in general. That avoids sending an
+      * unrecognized_name when a server is configured for purely
+      * anonymous operation.
       */
-      if(!sig_valid)
-         throw TLS_Exception(Alert::DECRYPT_ERROR, "Client cert verify failed");
-
-      try
-         {
-         m_creds.verify_certificate_chain("tls-server", "", client_certs);
-         }
-      catch(std::exception& e)
-         {
-         throw TLS_Exception(Alert::BAD_CERTIFICATE, e.what());
-         }
-
-      state.set_expected_next(HANDSHAKE_CCS);
+      if(!cert_chains.empty())
+         send_alert(Alert(Alert::UNRECOGNIZED_NAME));
       }
-   else if(type == HANDSHAKE_CCS)
+
+      Server_Hello::Settings srv_settings(
+         make_hello_random(rng(), policy()), // new session ID
+                           pending_state.version(),
+                           choose_ciphersuite(policy(),
+                                              pending_state.version(),
+                                              m_creds,
+                                              cert_chains,
+                                              pending_state.client_hello()),
+                           choose_compression(policy(),
+                                              pending_state.client_hello()->compression_methods()),
+                           have_session_ticket_key);
+
+   pending_state.server_hello(new Server_Hello(
+         pending_state.handshake_io(),
+         pending_state.hash(),
+         policy(),
+         rng(),
+         secure_renegotiation_data_for_server_hello(),
+         *pending_state.client_hello(),
+         srv_settings,
+         m_next_protocol)
+      );
+
+   secure_renegotiation_check(pending_state.server_hello());
+
+   const std::string sig_algo = pending_state.ciphersuite().sig_algo();
+   const std::string kex_algo = pending_state.ciphersuite().kex_algo();
+
+   if(sig_algo != "")
       {
-      state.set_expected_next(FINISHED);
-      change_cipher_spec_reader(SERVER);
+      BOTAN_ASSERT(!cert_chains[sig_algo].empty(),
+                     "Attempting to send empty certificate chain");
+
+      pending_state.server_certs(new Certificate(pending_state.handshake_io(),
+                                                 pending_state.hash(),
+                                                 cert_chains[sig_algo]));
       }
-   else if(type == FINISHED)
-      {
-      state.set_expected_next(HANDSHAKE_NONE);
 
-      state.client_finished(new Finished(contents));
+   Private_Key* private_key = nullptr;
 
-      if(!state.client_finished()->verify(state, CLIENT))
-         throw TLS_Exception(Alert::DECRYPT_ERROR,
-                             "Finished message didn't verify");
+   if(kex_algo == "RSA" || sig_algo != "")
+      {
+      private_key = m_creds.private_key_for(
+         pending_state.server_certs()->cert_chain()[0],
+         "tls-server",
+         sni_hostname);
 
-      if(!state.server_finished())
-         {
-         // already sent finished if resuming, so this is a new session
+      if(!private_key)
+         throw Internal_Error("No private key located for associated server cert");
+      }
 
-         state.hash().update(state.handshake_io().format(contents, type));
+   if(kex_algo == "RSA")
+      {
+      pending_state.set_server_rsa_kex_key(private_key);
+      }
+   else
+      {
 
-         Session session_info(
-            state.server_hello()->session_id(),
-            state.session_keys().master_secret(),
-            state.server_hello()->version(),
-            state.server_hello()->ciphersuite(),
-            state.server_hello()->compression_method(),
-            SERVER,
-            state.server_hello()->supports_extended_master_secret(),
-            get_peer_cert_chain(state),
-            std::vector<byte>(),
-            Server_Information(state.client_hello()->sni_hostname()),
-            state.srp_identifier(),
-            state.server_hello()->srtp_profile()
-            );
+      pending_state.server_kex(new Server_Key_Exchange(pending_state.handshake_io(),
+                                                       pending_state, policy(),
+                                                       m_creds, rng(), private_key));
+      }
 
-         if(save_session(session_info))
-            {
-            if(state.server_hello()->supports_session_ticket())
-               {
-               try
-                  {
-                  const SymmetricKey ticket_key = m_creds.psk("tls-server", "session-ticket", "");
-
-                  state.new_session_ticket(
-                     new New_Session_Ticket(state.handshake_io(),
-                                            state.hash(),
-                                            session_info.encrypt(ticket_key, rng()),
-                                            policy().session_ticket_lifetime())
-                     );
-                  }
-               catch(...) {}
-               }
-            else
-               session_manager().save(session_info);
-            }
+   auto trusted_CAs = m_creds.trusted_certificate_authorities("tls-server", sni_hostname);
 
-         if(!state.new_session_ticket() &&
-            state.server_hello()->supports_session_ticket())
-            {
-            state.new_session_ticket(
-               new New_Session_Ticket(state.handshake_io(), state.hash())
-               );
-            }
+   std::vector<X509_DN> client_auth_CAs;
 
-         state.handshake_io().send(Change_Cipher_Spec());
+   for(auto store : trusted_CAs)
+      {
+      auto subjects = store->all_subjects();
+      client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
+      }
 
-         change_cipher_spec_writer(SERVER);
+   if(!client_auth_CAs.empty() && pending_state.ciphersuite().sig_algo() != "")
+      {
+      pending_state.cert_req(
+         new Certificate_Req(pending_state.handshake_io(),
+                             pending_state.hash(),
+                             policy(),
+                             client_auth_CAs,
+                             pending_state.version()));
+
+      pending_state.set_expected_next(CERTIFICATE);
+      }
 
-         state.server_finished(new Finished(state.handshake_io(), state, SERVER));
-         }
+   /*
+   * If the client doesn't have a cert they want to use they are
+   * allowed to send either an empty cert message or proceed
+   * directly to the client key exchange, so allow either case.
+   */
+   pending_state.set_expected_next(CLIENT_KEX);
 
-      activate_session();
-      }
-   else
-      throw Unexpected_Message("Unknown handshake message received");
+   pending_state.server_hello_done(new Server_Hello_Done(pending_state.handshake_io(), pending_state.hash()));
    }
-
 }
 
 }
diff --git a/src/lib/tls/tls_server.h b/src/lib/tls/tls_server.h
index 5ea2a1318..051eda445 100644
--- a/src/lib/tls/tls_server.h
+++ b/src/lib/tls/tls_server.h
@@ -1,6 +1,7 @@
 /*
 * TLS Server
 * (C) 2004-2011 Jack Lloyd
+*     2016 Matthias Gierlings
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
@@ -12,10 +13,13 @@
 #include <botan/credentials_manager.h>
 #include <vector>
 
+
 namespace Botan {
 
 namespace TLS {
 
+class Server_Handshake_State;
+
 /**
 * TLS Server
 */
@@ -26,7 +30,39 @@ class BOTAN_DLL Server final : public Channel
 
       /**
       * Server initialization
+      *
+      * @param callbacks contains a set of callback function references
+      *        required by the TLS client.
+      *
+      * @param session_manager manages session state
+      *
+      * @param creds manages application/user credentials
+      *
+      * @param policy specifies other connection policy information
+      *
+      * @param rng a random number generator
+      *
+      * @param is_datagram set to true if this server should expect DTLS
+      *        connections. Otherwise TLS connections are expected.
+      *
+      * @param reserved_io_buffer_size This many bytes of memory will
+      *        be preallocated for the read and write buffers. Smaller
+      *        values just mean reallocations and copies are more likely.
       */
+      Server(Callbacks& callbacks,
+             Session_Manager& session_manager,
+             Credentials_Manager& creds,
+             const Policy& policy,
+             RandomNumberGenerator& rng,
+             bool is_datagram = false,
+             size_t reserved_io_buffer_size = TLS::Server::IO_BUF_DEFAULT_SIZE
+         );
+
+      /**
+       * DEPRECATED. This constructor is only provided for backward
+       * compatibility and should not be used in new implementations.
+       */
+      BOTAN_DEPRECATED("Use TLS::Server(TLS::Callbacks ...)")
       Server(output_fn output,
              data_cb data_cb,
              alert_cb alert_cb,
@@ -37,9 +73,14 @@ class BOTAN_DLL Server final : public Channel
              RandomNumberGenerator& rng,
              next_protocol_fn next_proto = next_protocol_fn(),
              bool is_datagram = false,
-             size_t reserved_io_buffer_size = 16*1024
+             size_t reserved_io_buffer_size = TLS::Server::IO_BUF_DEFAULT_SIZE
          );
 
+      /**
+       * DEPRECATED. This constructor is only provided for backward
+       * compatibility and should not be used in new implementations.
+       */
+      BOTAN_DEPRECATED("Use TLS::Server(TLS::Callbacks ...)")
       Server(output_fn output,
              data_cb data_cb,
              alert_cb alert_cb,
@@ -73,12 +114,40 @@ class BOTAN_DLL Server final : public Channel
                                  Handshake_Type type,
                                  const std::vector<byte>& contents) override;
 
+      void process_client_hello_msg(const Handshake_State* active_state,
+                                    Server_Handshake_State& pending_state,
+                                    const std::vector<byte>& contents);
+
+      void process_certificate_msg(Server_Handshake_State& pending_state,
+                                   const std::vector<byte>& contents);
+
+      void process_client_key_exchange_msg(Server_Handshake_State& pending_state,
+                                           const std::vector<byte>& contents);
+
+      void process_change_cipher_spec_msg(Server_Handshake_State& pending_state);
+
+      void process_certificate_verify_msg(Server_Handshake_State& pending_state,
+                                          Handshake_Type type,
+                                          const std::vector<byte>& contents);
+
+      void process_finished_msg(Server_Handshake_State& pending_state,
+                                Handshake_Type type,
+                                const std::vector<byte>& contents);
+
+      void session_resume(Server_Handshake_State& pending_state,
+                          bool have_session_ticket_key,
+                          Session& session_info);
+
+      void session_create(Server_Handshake_State& pending_state,
+                          bool have_session_ticket_key);
+
       Handshake_State* new_handshake_state(Handshake_IO* io) override;
 
       Credentials_Manager& m_creds;
+      std::string m_next_protocol;
 
+      // Set by deprecated constructor, Server calls both this fn and Callbacks version
       next_protocol_fn m_choose_next_protocol;
-      std::string m_next_protocol;
    };
 
 }