Ensure that there is no "hidden" DNS lookup in secure socket code

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
 #include <string.h>
 
 #include <key.h>
 #include <keyt.h>
 #include <nss.h>
 #include <pk11pub.h>
 #include <prerror.h>
 #include <prinit.h>
 #include <prnetdb.h>
 #include <secmod.h>
 #include <ssl.h>
 #include <sslproto.h>
 
 #include "bin/builtin.h"
 #include "bin/dartutils.h"
 #include "bin/net/nss_memio.h"
+#include "bin/socket.h"
 #include "bin/thread.h"
 #include "bin/utils.h"
 #include "platform/utils.h"
 
 #include "include/dart_api.h"
 
 
 namespace dart {
 namespace bin {
 
@@ skipping 33 matching lines @@
   SSLFilter* filter = new SSLFilter;
   SetFilter(args, filter);
   filter->Init(dart_this);
   Dart_ExitScope();
 }
 
 
 void FUNCTION_NAME(SecureSocket_Connect)(Dart_NativeArguments args) {
   Dart_EnterScope();
   Dart_Handle host_name_object = ThrowIfError(Dart_GetNativeArgument(args, 1));
-  Dart_Handle port_object = ThrowIfError(Dart_GetNativeArgument(args, 2));
-  bool is_server = DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 3));
+  Dart_Handle host_sockaddr_storage_object =
+      ThrowIfError(Dart_GetNativeArgument(args, 2));
+  Dart_Handle port_object = ThrowIfError(Dart_GetNativeArgument(args, 3));
+  bool is_server = DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 4));
   Dart_Handle certificate_name_object =
-      ThrowIfError(Dart_GetNativeArgument(args, 4));
+      ThrowIfError(Dart_GetNativeArgument(args, 5));
   bool request_client_certificate =
-      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 5));
+      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 6));
   bool require_client_certificate =
-      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 6));
+      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 7));
   bool send_client_certificate =
-      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 7));
+      DartUtils::GetBooleanValue(Dart_GetNativeArgument(args, 8));
 
   const char* host_name = NULL;
   // TODO(whesse): Is truncating a Dart string containing \0 what we want?
   ThrowIfError(Dart_StringToCString(host_name_object, &host_name));
 
+  RawAddr raw_addr;
+  Dart_TypedData_Type type;
+  uint8_t* buffer = NULL;
+  intptr_t len;
+  ThrowIfError(Dart_TypedDataAcquireData(host_sockaddr_storage_object,
+                                         &type,
+                                         reinterpret_cast<void**>(&buffer),
+                                         &len));
+  ASSERT(static_cast<size_t>(len) <= sizeof(raw_addr));
+  memmove(&raw_addr, buffer, len);
+  Dart_TypedDataReleaseData(host_sockaddr_storage_object);
+
   int64_t port;
   if (!DartUtils::GetInt64Value(port_object, &port)) {
     FATAL("The range of port_object was checked in Dart - it cannot fail here");
   }
 
   const char* certificate_name = NULL;
   if (Dart_IsString(certificate_name_object)) {
     ThrowIfError(Dart_StringToCString(certificate_name_object,
                                       &certificate_name));
   }
   // If this is a server connection, it must have a certificate to connect with.
   ASSERT(!is_server || certificate_name != NULL);
 
   GetFilter(args)->Connect(host_name,
+                           &raw_addr,
                            static_cast<int>(port),
                            is_server,
                            certificate_name,
                            request_client_certificate,
                            require_client_certificate,
                            send_client_certificate);
   Dart_ExitScope();
 }
 
 
@@ skipping 331 matching lines @@
 Dart_Handle SSLFilter::PeerCertificate() {
   CERTCertificate* certificate = SSL_PeerCertificate(filter_);
   if (certificate == NULL) return Dart_Null();
   Dart_Handle x509_object = X509FromCertificate(certificate);
   CERT_DestroyCertificate(certificate);
   return x509_object;
 }
 
 
 void SSLFilter::Connect(const char* host_name,
+                        RawAddr* raw_addr,
                         int port,
                         bool is_server,
                         const char* certificate_name,
                         bool request_client_certificate,
                         bool require_client_certificate,
                         bool send_client_certificate) {
   is_server_ = is_server;
   if (in_handshake_) {
     ThrowException("Connect called while already in handshake state.");
   }
@@ skipping 93 matching lines @@
   status = SSL_BadCertHook(filter_,
                            BadCertificateCallback,
                            static_cast<void*>(this));
 
   PRBool as_server = is_server ? PR_TRUE : PR_FALSE;
   status = SSL_ResetHandshake(filter_, as_server);
   if (status != SECSuccess) {
     ThrowPRException("Failed SSL_ResetHandshake call");
   }
 
-  // SetPeerAddress
-  PRNetAddr host_address;
-  PRAddrInfo* info = PR_GetAddrInfoByName(host_name,
-                                          PR_AF_UNSPEC,
-                                          PR_AI_ADDRCONFIG);
-  if (info == NULL) {
-    ThrowPRException("Failed PR_GetAddrInfoByName call");
-  }
+  // Set the peer address from the address passed. The DNS has already
+  // been done in Dart code, so just use that address. This relies on
+  // following about PRNetAddr: "The raw member of the union is
+  // equivalent to struct sockaddr", which is stated in the NSS
+  // documentation.
+  PRNetAddr peername;
+  memset(&peername, 0, sizeof(peername));
+  ASSERT(sizeof(raw_addr->addr) < sizeof(peername));

[Anders Johnsen, 2013/06/19 08:44:53]

raw_addr->addr -> raw_addr->ss

or use

'static intptr_t SocketAddress::GetAddrLength(const RawAddr& addr)'

[Søren Gjesse, 2013/06/19 09:06:53]

Good Catch! Done.

+  memmove(&peername, &raw_addr->addr, sizeof(raw_addr->addr));

[Anders Johnsen, 2013/06/19 08:44:53]

Ditto

[Søren Gjesse, 2013/06/19 09:06:53]

Done.

 
-  PR_EnumerateAddrInfo(0, info, port, &host_address);
+  // Adjust the address family field for BSD, whose sockaddr
+  // structure has a one-byte length and one-byte address family
+  // field at the beginning.  PRNetAddr has a two-byte address
+  // family field at the beginning.
+  peername.raw.family = raw_addr->addr.sa_family;
 
-  memio_SetPeerName(filter_, &host_address);
-  PR_FreeAddrInfo(info);
+  memio_SetPeerName(filter_, &peername);
 }
 
 
 void SSLFilter::Handshake() {
   SECStatus status = SSL_ForceHandshake(filter_);
   if (status == SECSuccess) {
     if (in_handshake_) {
       ThrowIfError(Dart_InvokeClosure(
           Dart_HandleFromPersistent(handshake_complete_), 0, NULL));
       in_handshake_ = false;
@@ skipping 126 matching lines @@
         bytes_processed = 0;
       }
       break;
     }
   }
   return bytes_processed;
 }
 
 }  // namespace bin
 }  // namespace dart