Dtls handshake process optimization

.github/workflows/ci.yml

@@ -170,7 +170,7 @@ jobs:
   undefined-behavior-sanitizer:
     runs-on: ubuntu-20.04
     env:
-      UBSAN_OPTIONS: halt_on_error=1
+      UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
       CC: clang
       CXX: clang++
       AWS_KVS_LOG_LEVEL: 2

samples/kvsWebRTCClientMaster.c

@@ -19,7 +19,8 @@ INT32 main(INT32 argc, CHAR* argv[])
 #endif
 
 #ifdef IOT_CORE_ENABLE_CREDENTIALS
-    CHK_ERR((pChannelName = argc > 1 ? argv[1] : getenv(IOT_CORE_THING_NAME)) != NULL, STATUS_INVALID_OPERATION, "AWS_IOT_CORE_THING_NAME must be set");
+    CHK_ERR((pChannelName = argc > 1 ? argv[1] : getenv(IOT_CORE_THING_NAME)) != NULL, STATUS_INVALID_OPERATION,
+            "AWS_IOT_CORE_THING_NAME must be set");
 #else
     pChannelName = argc > 1 ? argv[1] : SAMPLE_CHANNEL_NAME;
 #endif

samples/kvsWebRTCClientViewer.c

@@ -51,7 +51,8 @@ INT32 main(INT32 argc, CHAR* argv[])
 #endif
 
 #ifdef IOT_CORE_ENABLE_CREDENTIALS
-    CHK_ERR((pChannelName = argc > 1 ? argv[1] : getenv(IOT_CORE_THING_NAME)) != NULL, STATUS_INVALID_OPERATION, "AWS_IOT_CORE_THING_NAME must be set");
+    CHK_ERR((pChannelName = argc > 1 ? argv[1] : getenv(IOT_CORE_THING_NAME)) != NULL, STATUS_INVALID_OPERATION,
+            "AWS_IOT_CORE_THING_NAME must be set");
 #else
     pChannelName = argc > 1 ? argv[1] : SAMPLE_CHANNEL_NAME;
 #endif

samples/kvsWebrtcClientMasterGstSample.c

@@ -396,7 +396,8 @@ INT32 main(INT32 argc, CHAR* argv[])
     signal(SIGINT, sigintHandler);
 
 #ifdef IOT_CORE_ENABLE_CREDENTIALS
-    CHK_ERR((pChannelName = argc > 1 ? argv[1] : getenv(IOT_CORE_THING_NAME)) != NULL, STATUS_INVALID_OPERATION, "AWS_IOT_CORE_THING_NAME must be set");
+    CHK_ERR((pChannelName = argc > 1 ? argv[1] : getenv(IOT_CORE_THING_NAME)) != NULL, STATUS_INVALID_OPERATION,
+            "AWS_IOT_CORE_THING_NAME must be set");
 #else
     pChannelName = argc > 1 ? argv[1] : SAMPLE_CHANNEL_NAME;
 #endif

src/include/com/amazonaws/kinesis/video/webrtcclient/Include.h

@@ -191,7 +191,7 @@ extern "C" {
 #define STATUS_SSL_PACKET_BEFORE_DTLS_READY               STATUS_DTLS_BASE + 0x00000004
 #define STATUS_SSL_UNKNOWN_SRTP_PROFILE                   STATUS_DTLS_BASE + 0x00000005
 #define STATUS_SSL_INVALID_CERTIFICATE_BITS               STATUS_DTLS_BASE + 0x00000006
-
+#define STATUS_DTLS_SESSION_ALREADY_FREED                 STATUS_DTLS_BASE + 0x00000007
 /*!@} */
 
 /////////////////////////////////////////////////////

src/source/Crypto/Dtls.h

@@ -43,6 +43,13 @@ typedef enum {
     RTC_DTLS_TRANSPORT_STATE_FAILED,     /* The transport has failed as the result of an error */
 } RTC_DTLS_TRANSPORT_STATE;
 
+typedef enum {
+    DTLS_STATE_HANDSHAKE_NEW,
+    DTLS_STATE_HANDSHAKE_IN_PROGRESS,
+    DTLS_STATE_HANDSHAKE_COMPLETED,
+    DTLS_STATE_HANDSHAKE_ERROR,
+} DTLS_HANDSHAKE_STATE;
+
 /* Callback that is fired when Dtls Server wishes to send packet */
 typedef VOID (*DtlsSessionOutboundPacketFunc)(UINT64, PBYTE, UINT32);
 
@@ -98,18 +105,22 @@ typedef struct {
 typedef struct __DtlsSession DtlsSession, *PDtlsSession;
 struct __DtlsSession {
     volatile ATOMIC_BOOL isStarted;
-    volatile ATOMIC_BOOL shutdown;
+    volatile ATOMIC_BOOL isShutdown;
+    volatile ATOMIC_BOOL isCleanUp;
     UINT32 certificateCount;
     DtlsSessionCallbacks dtlsSessionCallbacks;
     TIMER_QUEUE_HANDLE timerQueueHandle;
     UINT32 timerId;
     UINT64 dtlsSessionStartTime;
     UINT64 dtlsSessionSetupTime;
     RTC_DTLS_TRANSPORT_STATE state;
+    DTLS_HANDSHAKE_STATE handshakeState;
     MUTEX sslLock;
 
 #ifdef KVS_USE_OPENSSL
     volatile ATOMIC_BOOL sslInitFinished;
+    volatile SIZE_T objRefCount;
+    CVAR receivePacketCvar;
     // dtls message must fit into a UDP packet
     BYTE outgoingDataBuffer[MAX_UDP_PACKET_SIZE];
     UINT32 outgoingDataLen;
@@ -168,6 +179,7 @@ STATUS dtlsSessionShutdown(PDtlsSession);
 
 STATUS dtlsSessionOnOutBoundData(PDtlsSession, UINT64, DtlsSessionOutboundPacketFunc);
 STATUS dtlsSessionOnStateChange(PDtlsSession, UINT64, DtlsSessionOnStateChange);
+STATUS dtlsSessionHandshakeInThread(PDtlsSession, BOOL);
 
 /******** Internal Functions **********/
 STATUS dtlsValidateRtcCertificates(PRtcCertificate, PUINT32);

src/source/Crypto/Dtls_mbedtls.c

@@ -248,6 +248,12 @@ INT32 dtlsSessionKeyDerivationCallback(PVOID customData, const unsigned char* pM
     return 0;
 }
 
+STATUS dtlsSessionHandshakeInThread(PDtlsSession pDtlsSession, BOOL isServer)
+{
+    DLOGI("Threadpool based DTLS handshake not supported for mbedtls");
+    return STATUS_SUCCESS;
+}
+
 STATUS dtlsSessionStart(PDtlsSession pDtlsSession, BOOL isServer)
 {
     ENTERS();
@@ -327,7 +333,7 @@ STATUS dtlsSessionProcessPacket(PDtlsSession pDtlsSession, PBYTE pData, PINT32 p
 
     CHK(pDtlsSession != NULL && pData != NULL && pDataLen != NULL, STATUS_NULL_ARG);
     CHK(ATOMIC_LOAD_BOOL(&pDtlsSession->isStarted), STATUS_SSL_PACKET_BEFORE_DTLS_READY);
-    CHK(!ATOMIC_LOAD_BOOL(&pDtlsSession->shutdown), retStatus);
+    CHK(!ATOMIC_LOAD_BOOL(&pDtlsSession->isShutdown), retStatus);
 
     MUTEX_LOCK(pDtlsSession->sslLock);
     locked = TRUE;
@@ -384,7 +390,7 @@ STATUS dtlsSessionPutApplicationData(PDtlsSession pDtlsSession, PBYTE pData, INT
     BOOL iterate = TRUE;
 
     CHK(pData != NULL, STATUS_NULL_ARG);
-    CHK(!ATOMIC_LOAD_BOOL(&pDtlsSession->shutdown), retStatus);
+    CHK(!ATOMIC_LOAD_BOOL(&pDtlsSession->isShutdown), retStatus);
 
     MUTEX_LOCK(pDtlsSession->sslLock);
     locked = TRUE;
@@ -530,13 +536,13 @@ STATUS dtlsSessionShutdown(PDtlsSession pDtlsSession)
     MUTEX_LOCK(pDtlsSession->sslLock);
     locked = TRUE;
 
-    CHK(!ATOMIC_LOAD_BOOL(&pDtlsSession->shutdown), retStatus);
+    CHK(!ATOMIC_LOAD_BOOL(&pDtlsSession->isShutdown), retStatus);
 
     while (mbedtls_ssl_close_notify(&pDtlsSession->sslCtx) == MBEDTLS_ERR_SSL_WANT_WRITE) {
         // keep flushing outgoing buffer until nothing left
     }
 
-    ATOMIC_STORE_BOOL(&pDtlsSession->shutdown, TRUE);
+    ATOMIC_STORE_BOOL(&pDtlsSession->isShutdown, TRUE);
     CHK_STATUS(dtlsSessionChangeState(pDtlsSession, RTC_DTLS_TRANSPORT_STATE_CLOSED));
 
 CleanUp: