SSL_write partial data handling and WANT_WRITE limits

Answer

When SSL_write returns a positive value less than the requested length and SSL_get_error yields SSL_ERROR_WANT_WRITE, that return value is the exact number of bytes the SSL object has already accepted from your buffer. The application must retry the write starting at buffer + ret.

How OpenSSL determines the byte offset

OpenSSL tracks how many bytes have been successfully passed to the underlying BIO_write call. If the BIO’s write function consumes fewer bytes than requested (or returns -1 with SSL_ERROR_WANT_WRITE), the SSL layer counts the bytes that were actually consumed and returns that count. The offset therefore reflects the point up to which the input buffer has been read, regardless of whether those bytes are still buffered inside the SSL object or have been handed to the transport.

Guaranteed internal‑buffer state on a mid‑record interruption

If a write is interrupted while a TLS record is being assembled, OpenSSL retains the incomplete record in its internal write buffer. The next call to SSL_write resumes from the beginning of that buffered partial record, preserving record integrity and preventing duplicate transmission of already‑sent bytes.

Retry pattern (the only steps you need)

1. Call ret = SSL_write(ssl, buf, len);
2. If ret <= 0, obtain err = SSL_get_error(ssl, ret);
3. If err == SSL_ERROR_WANT_WRITE or err == SSL_ERROR_WANT_READ, retry from buf + ret with the remaining length len - ret.
4. Repeat until ret == len or a fatal error occurs.

Verification and diagnostic detail

To confirm that your custom BIO behaves as expected, check that its write callback returns the number of bytes actually consumed, or -1 with SSL_ERROR_WANT_WRITE when it cannot accept more. If the callback does not report consumed bytes correctly, the offset tracking will be mismatched and you may need to adjust your retry logic.

You can observe this with OpenSSL’s built‑in debug callback:

BIO_set_callback(bio, BIO_debug_callback);
BIO_set_callback_arg(bio, (char *)"custom BIO");

Then run a minimal non‑blocking test that logs the return value of BIO_write alongside the SSL_write return and error.