Start adding TLS (SSL) sockets to dart:io.

runtime/bin/tls_socket_impl.dart

Index: runtime/bin/tls_socket_impl.dart
diff --git a/runtime/bin/tls_socket_impl.dart b/runtime/bin/tls_socket_impl.dart
new file mode 100644
index 0000000000000000000000000000000000000000..141f567aa243f3a516bb42497b3c584c1b8bd486
--- /dev/null
+++ b/runtime/bin/tls_socket_impl.dart
@@ -0,0 +1,358 @@
+// Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+
+int  _logging = true;

[Mads Ager (google), 2012/07/31 10:16:01]

int?

We should remove this logging before comitting.

[Bill Hesse, 2012/08/08 17:00:05]

Done.

+
+void log(x) {

[Mads Ager (google), 2012/07/31 10:16:01]

_log? We do not want to expose log to users.

[Bill Hesse, 2012/08/08 17:00:05]

Done.

+  if (_logging) {print(x.toString());}
+}
+
+class _TlsSocket implements TlsSocket {
+  static final int _BUFFER_SIZE = 2048;
+
+  // Status states
+  static final int NOT_CONNECTED = 200;
+  static final int HANDSHAKE = 201;
+  static final int CONNECTED = 202;
+  static final int CLOSED = 203;
+
+  // Buffer identifiers.
+  static final int kReadPlaintext = 0;
+  static final int kWritePlaintext = 1;
+  static final int kReadEncrypted = 2;
+  static final int kWriteEncrypted = 3;
+  static final int kNumBuffers = 4;
+
+  // Constructs a new secure client socket.
+  _TlsSocket(String host,
+             int port)
+      : _socket = new Socket(host, port),
+        _tlsFilter = new _TlsFilter() {
+    _socket.onConnect = _tlsConnectHandler;
+    _socket.onWrite = _tlsWriteHandler;
+    _socket.onData = _tlsDataHandler;
+    _socket.onClosed = _tlsCloseHandler;
+    _tlsFilter.init();
+    _tlsFilter.registerHandshakeCallbacks(_tlsHandshakeStartHandler,
+                                          _tlsHandshakeFinishHandler);
+  }
+
+  void set onConnect(void callback()) {
+    _socketConnectHandler = callback;
+  }
+
+  void set onWrite(void callback()) {
+    _socketWriteHandler = callback;
+    // Reset the one-shot onWrite handler.
+    _socket.onWrite = _tlsWriteHandler;
+  }
+
+  void set onData(void callback()) {
+    _socketDataHandler = callback;
+  }
+
+  void set onClosed(void callback()) {
+    _socketCloseHandler = callback;
+  }
+
+  void _tlsConnectHandler() {
+    _tlsFilter.connect();
+    _connectPending = true;
+  }
+
+  void _tlsWriteHandler() {
+    log('  _TlsSocket._tlsWriteHandler entered');
+    if (_status == HANDSHAKE) {
+      _writeEncryptedData();
+      _readEncryptedData();
+      _tlsFilter.connect();
+      // Only do this if we have more data to write.
+      if (_tlsFilter.buffers[kWriteEncrypted].length > 0) {
+        _socket.onWrite = _tlsWriteHandler;
+      }
+    } else if (_status == CONNECTED) {
+      if (_socketWriteHandler != null) {
+        _socketWriteHandler();
+      }
+    }
+    log('  _TlsSocket._tlsWriteHandler exited');
+  }
+
+  void _tlsDataHandler() {
+    log('  _TlsSocket._tlsDataHandler entered');
+    if (_status == HANDSHAKE) {
+      _readEncryptedData();
+      _writeEncryptedData();
+      _tlsFilter.connect();
+        _socket.onWrite = _tlsWriteHandler;
+    } else {
+      if (scheduledDataEvent != null) {
+        scheduledDataEvent.cancel();
+        scheduledDataEvent = null;
+      }
+      if (_socketDataHandler != null) {
+        _readEncryptedData();
+        _socketDataHandler();
+      }
+    }
+    log('  _TlsSocket._tlsDataHandler exited');
+  }
+
+  void _tlsCloseHandler() {
+    _socketClosed = true;
+    _status = CLOSED;
+    _socket.close();
+    if (_filterEmpty) {
+      _fireCloseEvent();
+    } else {
+      _fireCloseEventPending = true;
+    }
+  }
+
+  void _tlsHandshakeStartHandler() {
+    log('  _TlsSocket._tlsHandshakeStartHandler entered');
+    _status = HANDSHAKE;
+    _socket.onWrite = _tlsWriteHandler;
+    log('  _TlsSocket._tlsHandshakeStartHandler exited');
+  }
+
+  void _tlsHandshakeFinishHandler() {
+    log('  _TlsSocket._tlsHandshakeFinishHandler entered');
+    _status = CONNECTED;
+    if (_connectPending && _socketConnectHandler != null) {
+      _connectPending = false;
+      _socketConnectHandler();
+    }
+    log('  _TlsSocket._tlsHandshakeFinishHandler exited');
+  }
+
+  void _fireCloseEvent() {
+    _fireCloseEventPending = false;
+    _tlsFilter.destroy();
+    _tlsFilter = null;
+    if (scheduledDataEvent != null) {
+      scheduledDataEvent.cancel();
+    }
+    if (_socketCloseHandler != null) {
+      _socketCloseHandler();
+    }
+  }
+
+  void close([bool halfClose]) {
+    log('  _TlsSocket.close called');
+    _socket.close(halfClose);
+    //    _readEncryptedData();

[Mads Ager (google), 2012/07/31 10:16:01]

Code in comments.

[Bill Hesse, 2012/08/08 17:00:05]

Done.

+    // _tlsFilter.destroy();
+  }
+
+  int readList(List<int> data, int offset, int bytes) {
+    _readEncryptedData();
+    if (offset < 0 || bytes < 0 || offset + bytes > data.length) {
+      throw new IllegalArgumentException(
+          "Invalid offset or bytes in TlsSocket.readList");
+    }
+    int bytes_read = 0;
+    var buffer = _tlsFilter.buffers[kReadPlaintext];
+    if (buffer.length == 0 && buffer.start != 0) {
+      throw "Unexpected buffer state in tls_socket readList";
+    }
+    if (buffer.length > 0) {
+      int to_read = Math.min(bytes, buffer.length);
+      data.setRange(offset, to_read, buffer.data, buffer.start);
+      buffer.start += to_read;
+      buffer.length -= to_read;
+      if (buffer.length == 0) {
+        buffer.start = 0;
+      }

[Søren Gjesse, 2012/07/31 09:07:15]

The 5 lines above here seems to be duplicated in several places. Could they be
refactored into a method on _TlsExternalBuffer? Perhaps combined with the
setRange into a "read"/"readList"/"readFrom" method.

[Bill Hesse, 2012/08/08 17:00:05]

Done.

+      bytes_read += to_read;
+    }
+    int new_bytes = _tlsFilter.processBuffer(kReadPlaintext);
+    if (new_bytes > 0) {
+      buffer.length += new_bytes;
+    }
+    if (bytes - bytes_read > 0 && buffer.length > 0) {
+      int to_read = Math.min(bytes - bytes_read, buffer.length);
+      data.setRange(offset + bytes_read, to_read, buffer.data, buffer.start);
+      buffer.start += to_read;
+      buffer.length -= to_read;
+      if (buffer.length == 0) {
+        buffer.start = 0;
+      }
+      bytes_read += to_read;
+    }
+
+    // If bytes_read is 0, then something is blocked or empty, and
+    // we are guaranteed an event when it becomes unblocked.
+    // Otherwise, give an event if there is data available, and
+    // there has been a read call since the last data event.
+    // This gives the invariant that:
+    // If there is data available, and there has been a read after the
+    // last data event (or no previous one fired), then we are guaranteed
+    // to get a data event.
+    _filterEmpty = (bytes_read == 0);
+    if (bytes_read > 0 && scheduledDataEvent == null) {
+      scheduledDataEvent = new Timer(0, (_) => _tlsDataHandler());
+    } else if (bytes_read == 0) {
+      if (_fireCloseEventPending) {
+        _fireCloseEvent();
+      } else if (scheduledDataEvent != null) {
+        scheduledDataEvent.cancel();
+        scheduledDataEvent = null;
+      }
+    }
+    print('                _fireCloseEventPending: $_fireCloseEventPending');

[Mads Ager (google), 2012/07/31 10:16:01]

Remove.

[Bill Hesse, 2012/08/08 17:00:05]

Done.

+    print('                _filterEmpty: $_filterEmpty');
+    print('                _socketClosed: $_socketClosed');
+    return bytes_read;
+  }
+
+
+  // Write the data to the socket, and flush it as much as possible
+  // without blocking.  If not all the data is written, enable the
+  // onWrite event.  If data is not all flushed, add handlers to all
+  // relevant events.
+  int writeList(List<int> data, int offset, int bytes) {
+    _writeEncryptedData();  // Tries to flush all post-filter stages.
+    var buffer = _tlsFilter.buffers[kWritePlaintext];
+    var free = _TlsExternalBuffer.kSize - buffer.start - buffer.length;

[Søren Gjesse, 2012/07/31 09:07:15]

Add this free calculation as a method on _TlsExternalBuffer?

[Bill Hesse, 2012/08/08 17:00:05]

Done.

+    if (bytes > free) {
+      bytes = free;
+    }
+    if (bytes > 0) {
+      buffer.data.setRange(buffer.start + buffer.length, bytes, data, offset);
+      buffer.length += bytes;

[Søren Gjesse, 2012/07/31 09:07:15]

Add an "add" method to _TlsExternalBuffer?

[Bill Hesse, 2012/08/08 17:00:05]

 Because sometimes we set the range, and sometimes an external native function
sets the range, I think adding the advanceStart(int numBytes) method is
sufficient.

+    }
+    int bytes_written = _tlsFilter.processBuffer(kWritePlaintext);
+    buffer.length -= bytes_written;
+    buffer.start += bytes_written;
+    if (buffer.length == 0) {
+      buffer.start = 0;
+    }
+    _readEncryptedData();
+    _writeEncryptedData();
+    print('start: ${buffer.start}');
+    print('length: ${buffer.length}');
+    return bytes;
+  }
+
+  void _readEncryptedData() {
+    log('    Entering _readEncryptedData');
+    // Read from the socket and write to the filter.
+    var buffer = _tlsFilter.buffers[kReadEncrypted];
+    while (true) {
+      if (buffer.length > 0) {
+        int bytes = _tlsFilter.processBuffer(kReadEncrypted);
+        if (bytes > 0) {
+          buffer.length -= bytes;
+          buffer.start += bytes;
+          if (buffer.length == 0) {
+            buffer.start = 0;
+          }
+        } else {
+          break;
+        }
+      } else if (!_socketClosed) {
+        var free = _TlsExternalBuffer.kSize - buffer.start - buffer.length;
+        int bytes =
+            _socket.readList(buffer.data, buffer.start + buffer.length, free);
+        log('      Read $bytes bytes from socket');
+        if (bytes <= 0) break;
+        buffer.length += bytes;
+      } else {
+        break;  // Socket is closed and read buffer is empty.
+      }
+    }
+    log('    Exiting _readEncryptedData');
+  }
+
+  void _writeEncryptedData() {
+    log('    Entering _writeEncryptedData');
+    // Write from the filter to the socket.
+    var buffer = _tlsFilter.buffers[kWriteEncrypted];
+    while (true) {
+      if (buffer.length > 0) {
+        int bytes = _socket.writeList(buffer.data, buffer.start, buffer.length);
+        if (bytes <= 0) break;
+        buffer.start += bytes;
+        buffer.length -= bytes;
+        if (buffer.length == 0) {
+          buffer.start = 0;
+        }
+      } else {
+        if (buffer.start != 0 || buffer.length != 0) {
+          print("Unexpected state in _writeEncryptedData");
+          throw "Unexpected state in _writeEncryptedData";
+        }
+        int bytes = _tlsFilter.processBuffer(kWriteEncrypted);
+        if (bytes <= 0) break;
+        buffer.length += bytes;
+      }
+      log('    Exiting _writeEncryptedData');
+    }
+  }
+
+  // _TlsSocket cannot extend _Socket and use _Socket's factory constructor.
+  Socket _socket;
+
+  var _status = NOT_CONNECTED;
+  bool _socketClosed = false;
+  bool _filterEmpty = false;
+  bool _connectPending = false;
+  bool _fireCloseEventPending = false;
+  Function _socketConnectHandler;
+  Function _socketWriteHandler;
+  Function _socketDataHandler;
+  Function _socketCloseHandler;
+  Timer scheduledDataEvent;
+
+  var _tlsFilter;
+}
+
+class _TlsExternalBuffer {
+  static final int kSize = 8 * 1024;
+  _TlsExternalBuffer() : start = 0, length = 0;
+  List data;  // This will be a ExternalByteArray, backed by C allocated data.
+  int start;
+  int length;

[Mads Ager (google), 2012/07/31 10:16:01]

Do you need an extra length field here? Is this different from data.length?

[Bill Hesse, 2012/08/08 17:00:05]

Yes it is.  This is the length of the valid data region of the buffer.

+}
+
+/**
+ * _TlsFilter wraps a filter that encrypts and decrypts data travelling
+ * over a TLS encrypted socket.  The filter also handles the handshaking
+ * and certificate verification.
+ *
+ * The filter exposes its input and output buffers as Dart objects that
+ * are backed by an external C array of bytes, so that both Dart code and
+ * native code can access the same data.
+ */
+class _TlsFilter extends NativeFieldWrapperClass1 {
+  _TlsFilter() {
+    buffers = new List<_TlsExternalBuffer>(_TlsSocket.kNumBuffers);
+    for (int i = 0; i < _TlsSocket.kNumBuffers; ++i) {
+      buffers[i] = new _TlsExternalBuffer();
+    }
+  }
+
+  void init() native "TlsSocket_Init";
+
+  void connect() native "TlsSocket_Connect";
+
+  void registerHandshakeCallbacks(Function startHandshakeHandler,
+                                  Function finishHandshakeHandler)
+      native "TlsSocket_RegisterHandshakeCallbacks";
+  int processBuffer(int bufferIndex) native "TlsSocket_ProcessBuffer";
+  int readPlaintext() native "TlsSocket_ReadPlaintext";
+  int writePlaintext() native "TlsSocket_WritePlaintext";
+  int readEncrypted() native "TlsSocket_ReadEncrypted";
+  int writeEncrypted() native "TlsSocket_WriteEncrypted";
+  void destroy() native "TlsSocket_Destroy";
+
+  bool get shouldRetry() => true;
+

[Mads Ager (google), 2012/07/31 10:16:01]

Remove this blank line?

[Bill Hesse, 2012/08/08 17:00:05]

 These functions have been removed.

+  bool get shouldRead() => true;
+  bool get shouldWrite() => true;
+
+  List<_TlsExternalBuffer> buffers;
+}