HTTPAPI_REQUEST_POST fails on Android P when using x509 certificates

[jdaragnes]

Environment:

• OS and version used: Android 9
• SDK version used: 1.2.9

Description of the issue:

On Android device, after generating successfully X509 certificate onboard using azure_prov_client, publishing messages through HTTP fails (using IoTHubClient_SendEventAsync).

On Android, boringSSL is used and forbids SSL renegotiation by default.

HTTPAPI_ExecuteRequest sets option for SSL connection and then calls curl_easy_perform that establishes the secure connection and posts the message.
But, as shown on attached wireshark trace screenshot, transaction fails due to SSL renegotiation forbidden by default in Android boringSSL.

Code sample exhibiting the issue:

https://github.com/Azure/azure-c-shared-utility/blob/ac6b01974515ffb31729a4f7374218b51a8239fb/adapters/httpapi_curl.c#L293

Stack trace of the issue:

recvfrom(int, void*, unsigned long pass_object_size0, int, sockaddr*, unsigned int*) (fd=7, buf=0x7ffff6cf6748, len=1, flags=0, src_addr=0x0 <_DYNAMIC>, addr_len=0x0 <_DYNAMIC>)
at out/soong/.intermediates/bionic/libc/libc.llndk/android_x86_64_vendor_shared/gen/include/bits/fortify/socket.h:57
#1 recv(int, void*, unsigned long pass_object_size0, int) (socket=7, buf=0x7ffff6cf6748, len=1, flags=0)
at out/soong/.intermediates/bionic/libc/libc.llndk/android_x86_64_vendor_shared/gen/include/bits/fortify/socket.h:86
#2 Curl_recv_plain (conn=0x7ffff6cf1000, num=0, buf=0x7ffff6cf6748 "", len=1, code=0x7ffff6500154) at external/curl/lib/sendf.c:446
#3 0x00007ffff76cd5c4 in Curl_read (conn=0x7ffff6cf1000, sockfd=7, buf=0x7ffff6cf6748 "", sizerequested=1, n=0x7ffff6500378) at external/curl/lib/sendf.c:741
#4 0x00007ffff76fc416 in CONNECT (conn=0x7ffff6cf1000, sockindex=0, hostname=0x7ffff6c8bdc0 , remote_port=443) at external/curl/lib/http_proxy.c:342
#5 0x00007ffff76fb9d3 in Curl_proxyCONNECT (conn=0x7ffff6cf1000, sockindex=0, hostname=0x7ffff6c8bdc0, remote_port=443) at external/curl/lib/http_proxy.c:672
#6 0x00007ffff76fb834 in Curl_proxy_connect (conn=0x7ffff6cf1000, sockindex=0) at external/curl/lib/http_proxy.c:125
#7 0x00007ffff76c5608 in Curl_http_connect (conn=0x7ffff6cf1000, done=0x7ffff6500835) at external/curl/lib/http.c:1345
#8 0x00007ffff76ee829 in multi_runsingle (multi=0x7ffff6c97400, now=..., data=0x7ffff6cd1a00) at external/curl/lib/multi.c:1525
#9 0x00007ffff76ede23 in curl_multi_perform (multi=0x7ffff6c97400, running_handles=0x7ffff6500954) at external/curl/lib/multi.c:2136
#10 0x00007ffff76e57cd in easy_transfer (multi=0x7ffff6c97400) at external/curl/lib/easy.c:695
#11 0x00007ffff76e44d0 in easy_perform (data=0x7ffff6cd1a00, events=false) at external/curl/lib/easy.c:781
#12 0x00007ffff76e4357 in curl_easy_perform (data=0x7ffff6cd1a00) at external/curl/lib/easy.c:800
#13 0x00005555555ba657 in HTTPAPI_ExecuteRequest (handle=0x7ffff6c2e5a0, requestType=HTTPAPI_REQUEST_POST,
relativePath=0x7ffff6c2e2a0 "/devices/dc1aa72cdcc410f90cf8c51a6402a7d6f388e95b/messages/events?api-version=2016-11-14", httpHeadersHandle=0x7ffff6c2b0b8,
content=0x7ffff6c4fc00 "{"hw":{"manufacturer":"unknown","name":"aosp_car_x86_64","randomUid":true,"},"level":"info","nam"..., contentLength=806, statusCode=0x7ffff650134c, responseHeadersHandle=0x7ffff6c2b140, responseContent=0x7ffff6c2c3c0)
at azure-iot-sdk-c/c-utility/adapters/httpapi_curl.c:579
#14 0x00005555555af963 in HTTPAPIEX_ExecuteRequest (handle=0x7ffff6c2d480, requestType=HTTPAPI_REQUEST_POST,
relativePath=0x7ffff6c2e2a0 "/devices/dc1aa72cdcc410f90cf8c51a6402a7d6f388e95b/messages/events?api-version=2016-11-14", requestHttpHeadersHandle=0x7ffff6c2b0b8, requestContent=0x7ffff6c2c2a0,
statusCode=0x7ffff650134c, responseHttpHeadersHandle=0x0 <_DYNAMIC>, responseContent=0x0 <_DYNAMIC>) at azure-iot-sdk-c/c-utility/src/httpapiex.c:411
#15 0x00005555555b0f07 in HTTPAPIEX_SAS_ExecuteRequest (sasHandle=0x0 <_DYNAMIC>, handle=0x7ffff6c2d480, requestType=HTTPAPI_REQUEST_POST,
relativePath=0x7ffff6c2e2a0 "/devices/dc1aa72cdcc410f90cf8c51a6402a7d6f388e95b/messages/events?api-version=2016-11-14", requestHttpHeadersHandle=0x7ffff6c2b0b8, requestContent=0x7ffff6c2c2a0,
statusCode=0x7ffff650134c, responseHeadersHandle=0x0 <_DYNAMIC>, responseContent=0x0 <_DYNAMIC>) at azure-iot-sdk-c/c-utility/src/httpapiexsas.c:171
#16 0x000055555559237e in DoEvent (handleData=0x7ffff6c2d540, deviceData=0x7ffff6c44140, iotHubClientHandle=0x7ffff6c9f000) at azure-iot-sdk-c/iothub_client/src/iothubtransporthttp.c:1673
#17 0x000055555558f4ff in IoTHubTransportHttp_DoWork (handle=0x7ffff6c2d540, iotHubClientHandle=0x7ffff6c9f000) at azure-iot-sdk-c/iothub_client/src/iothubtransporthttp.c:2329
#18 0x000055555558487b in IoTHubClientCore_LL_DoWork (iotHubClientHandle=0x7ffff6c9f000) at azure-iot-sdk-c/iothub_client/src/iothub_client_core_ll.c:1647
#19 0x0000555555580f79 in ScheduleWork_Thread (threadArgument=0x7ffff6c440a0) at azure-iot-sdk-c/iothub_client/src/iothub_client_core.c:697
#20 0x00005555555a5271 in ThreadWrapper (threadInstanceArg=0x7ffff6c2d780) at azure-iot-sdk-c/c-utility/adapters/threadapi_pthreads.c:34
#21 0x00007ffff7612bac in __pthread_start (arg=0x7ffff65014f0) at bionic/libc/bionic/pthread_create.cpp:254
#22 0x00007ffff75aaf2e in __start_thread (fn=0x7ffff7612b90 <__pthread_start(void*)>,

[lakshmisivareddy]

Hi @jdaragnes
prov_client and iothub_client uses same Provisioning Auth client Modules
in iothub_client case its is failing because it is not passing required device cert info to auth client module

[gregman-msft]

The IoT Hub service requires SSL renegotiation for using certain REST or WebSocket APIs. We are considering fixing this in a future version, but do not have an ETA for this work currently. Please consider enabling using a different SSL stack, such as OpenSSL, or looking into enabling renegotiation on boringSSL if this is still blocking you.

[az-iot-builder-01]

@jdaragnes, @lakshmisivareddy, @gregman-msft, thank you for your contribution to our open-sourced project! Please help us improve by filling out this 2-minute customer satisfaction survey