tls: use custom instead of socket based bio

source/extensions/transport_sockets/tls/BUILD

@@ -30,8 +30,14 @@ envoy_cc_extension(
 
 envoy_cc_library(
     name = "ssl_socket_lib",
-    srcs = ["ssl_socket.cc"],
-    hdrs = ["ssl_socket.h"],
+    srcs = [
+        "io_handle_bio.cc",
+        "ssl_socket.cc",
+    ],
+    hdrs = [
+        "io_handle_bio.h",
+        "ssl_socket.h",
+    ],
     external_deps = [
         "abseil_hash",
         "abseil_node_hash_map",

source/extensions/transport_sockets/tls/io_handle_bio.cc

@@ -0,0 +1,140 @@
+#include "extensions/transport_sockets/tls/io_handle_bio.h"
+
+#include "envoy/buffer/buffer.h"
+#include "envoy/network/io_handle.h"
+
+#include "openssl/bio.h"
+#include "openssl/err.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace TransportSockets {
+namespace Tls {
+
+namespace {
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+inline Envoy::Network::IoHandle* bio_io_handle(BIO* bio) {
+  return reinterpret_cast<Envoy::Network::IoHandle*>(bio->ptr);
+}
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+int io_handle_new(BIO* bio) {
+  bio->init = 0;
+  bio->num = -1;
+  bio->ptr = nullptr;
+  bio->flags = 0;
+  return 1;
+}
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+int io_handle_free(BIO* bio) {
+  if (bio == nullptr) {
+    return 0;
+  }
+
+  if (bio->shutdown) {
+    if (bio->init) {
+      bio_io_handle(bio)->close();
+    }
+    bio->init = 0;
+    bio->flags = 0;
+  }
+  return 1;
+}
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+int io_handle_read(BIO* b, char* out, int outl) {
+  if (out == nullptr) {
+    return 0;
+  }
+
+  Envoy::Buffer::RawSlice slice;
+  slice.mem_ = out;
+  slice.len_ = outl;
+  auto result = bio_io_handle(b)->readv(outl, &slice, 1);
+  BIO_clear_retry_flags(b);
+  if (!result.ok()) {
+    if (result.err_->getErrorCode() == Api::IoError::IoErrorCode::Again) {
+      BIO_set_retry_read(b);
+    }
+    return -1;
+  }
+  return result.rc_;
+}
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+int io_handle_write(BIO* b, const char* in, int inl) {
+  Envoy::Buffer::RawSlice slice;
+  slice.mem_ = const_cast<char*>(in);
+  slice.len_ = inl;
+  auto result = bio_io_handle(b)->writev(&slice, 1);
+  BIO_clear_retry_flags(b);
+  if (!result.ok()) {
+    if (result.err_->getErrorCode() == Api::IoError::IoErrorCode::Again) {
+      BIO_set_retry_write(b);
+    }
+    return -1;
+  }
+  return result.rc_;
+}
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+long io_handle_ctrl(BIO* b, int cmd, long num, void* ptr) {
+  long ret = 1;
+
+  switch (cmd) {
+  case BIO_C_SET_FD:
+    io_handle_free(b);
+    b->num = -1;
+    b->ptr = ptr;
+    b->shutdown = int(num);
+    b->init = 1;
+    break;
+  case BIO_C_GET_FD:
+    ret = -1;
+    *reinterpret_cast<void**>(ptr) = b->ptr;
+    break;
+  case BIO_CTRL_GET_CLOSE:
+    ret = b->shutdown;
+    break;
+  case BIO_CTRL_SET_CLOSE:
+    b->shutdown = int(num);
+    break;
+  case BIO_CTRL_FLUSH:
+    ret = 1;
+    break;
+  default:
+    ret = 0;
+    break;
+  }
+  return ret;
+}
+
+const BIO_METHOD methods_io_handlep = {
+    BIO_TYPE_SOCKET,    "io_handle",
+    io_handle_write,    io_handle_read,
+    nullptr /* puts */, nullptr /* gets, */,
+    io_handle_ctrl,     io_handle_new,
+    io_handle_free,     nullptr /* callback_ctrl */,
+};
+
+} // namespace
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+const BIO_METHOD* BIO_s_io_handle(void) { return &methods_io_handlep; }
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+BIO* BIO_new_io_handle(Envoy::Network::IoHandle* io_handle) {
+  BIO* ret;
+
+  ret = BIO_new(BIO_s_io_handle());
+  RELEASE_ASSERT(ret != nullptr, "");
+  BIO_ctrl(ret, BIO_C_SET_FD, 0, io_handle);
+  return ret;
+}
+
+} // namespace Tls
+} // namespace TransportSockets
+} // namespace Extensions
+} // namespace Envoy

source/extensions/transport_sockets/tls/io_handle_bio.h

@@ -0,0 +1,21 @@
+#pragma once
+
+#include "envoy/network/io_handle.h"
+
+#include "openssl/bio.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace TransportSockets {
+namespace Tls {
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+const BIO_METHOD* BIO_s_io_handle(void);
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+BIO* BIO_new_io_handle(Envoy::Network::IoHandle* io_handle);
+
+} // namespace Tls
+} // namespace TransportSockets
+} // namespace Extensions
+} // namespace Envoy

source/extensions/transport_sockets/tls/ssl_socket.cc

@@ -7,6 +7,7 @@
 #include "common/common/hex.h"
 #include "common/http/headers.h"
 
+#include "extensions/transport_sockets/tls/io_handle_bio.h"
 #include "extensions/transport_sockets/tls/utility.h"
 
 #include "absl/strings/str_replace.h"
@@ -67,9 +68,8 @@ void SslSocket::setTransportSocketCallbacks(Network::TransportSocketCallbacks& c
     provider->registerPrivateKeyMethod(rawSsl(), *this, callbacks_->connection().dispatcher());
   }
 
-  // TODO(fcoras): consider using BIO_s_mem or a BIO with custom read/write functions instead of a
-  // socket BIO which relies on access to a file descriptor.
-  BIO* bio = BIO_new_socket(callbacks_->ioHandle().fdDoNotUse(), 0);
+  // Use custom BIO that reads from/writes to IoHandle
+  BIO* bio = BIO_new_io_handle(&callbacks_->ioHandle());
   SSL_set_bio(rawSsl(), bio, bio);
 }
 

test/extensions/transport_sockets/tls/BUILD

@@ -99,6 +99,17 @@ envoy_cc_test(
     ],
 )
 
+envoy_cc_test(
+    name = "io_handle_bio_test",
+    srcs = ["io_handle_bio_test.cc"],
+    external_deps = ["ssl"],
+    deps = [
+        ":ssl_test_utils",
+        "//source/extensions/transport_sockets/tls:ssl_socket_lib",
+        "//test/mocks/network:io_handle_mocks",
+    ],
+)
+
 envoy_cc_test(
     name = "utility_test",
     srcs = [

test/extensions/transport_sockets/tls/io_handle_bio_test.cc

@@ -0,0 +1,62 @@
+#include "common/network/io_socket_error_impl.h"
+
+#include "extensions/transport_sockets/tls/io_handle_bio.h"
+
+#include "test/mocks/network/io_handle.h"
+
+#include "gmock/gmock.h"
+#include "gtest/gtest.h"
+#include "openssl/ssl.h"
+
+using testing::NiceMock;
+using testing::Return;
+
+namespace Envoy {
+namespace Extensions {
+namespace TransportSockets {
+namespace Tls {
+
+class IoHandleBioTest : public testing::Test {
+public:
+  IoHandleBioTest() { bio_ = BIO_new_io_handle(&io_handle_); }
+  ~IoHandleBioTest() override { BIO_free(bio_); }
+
+  BIO* bio_;
+  NiceMock<Network::MockIoHandle> io_handle_;
+};
+
+TEST_F(IoHandleBioTest, TestMiscApis) {
+  EXPECT_EQ(bio_->method->destroy(nullptr), 0);
+  EXPECT_EQ(bio_->method->bread(nullptr, nullptr, 0), 0);
+
+  int ret;
+  NiceMock<Network::MockIoHandle>* ptr;
+
+  ret = bio_->method->ctrl(bio_, BIO_C_GET_FD, 0, &ptr);
+  EXPECT_EQ(ret, -1);
+  EXPECT_EQ(ptr, &io_handle_);
+
+  ret = bio_->method->ctrl(bio_, BIO_CTRL_RESET, 0, nullptr);
+  EXPECT_EQ(ret, 0);
+
+  ret = bio_->method->ctrl(bio_, BIO_CTRL_SET_CLOSE, 1, nullptr);
+  EXPECT_EQ(ret, 1);
+
+  ret = bio_->method->ctrl(bio_, BIO_CTRL_GET_CLOSE, 0, nullptr);
+  EXPECT_EQ(ret, 1);
+
+  // avoid BIO_free assert in destructor
+  ret = bio_->method->ctrl(bio_, BIO_CTRL_SET_CLOSE, 0, nullptr);
+  EXPECT_EQ(ret, 1);
+
+  EXPECT_CALL(io_handle_, close())
+      .WillOnce(Return(testing::ByMove(Api::IoCallUint64Result{
+          0, Api::IoErrorPtr(nullptr, Network::IoSocketError::deleteIoError)})));
+  bio_->init = 1;
+  bio_->shutdown = 1;
+}
+
+} // namespace Tls
+} // namespace TransportSockets
+} // namespace Extensions
+} // namespace Envoy