Fix #206 (Implement SRV lookup)

Monal/Classes/MLDNSLookup.m

@@ -10,20 +10,19 @@
 @import Darwin.POSIX.sys.time; 
 
 @interface MLDNSLookup()
-
 @end
 
+BOOL isSecure=NO;
+
 @implementation MLDNSLookup
 
--(NSArray *) dnsDiscoverOnDomain:(NSString *) domain
+-(void) doDiscoveryWithSecure: (BOOL)secure andDomain: (NSString *) domain
 {
-    self.discoveredServers =[[NSMutableArray alloc] init];
-
-    DNSServiceRef sdRef;
+	DNSServiceRef sdRef;
     DNSServiceErrorType res;
 
-    NSString* serviceDiscoveryString=[NSString stringWithFormat:@"_xmpp-client._tcp.%@", domain];
-
+    isSecure = secure;
+    NSString* serviceDiscoveryString=[NSString stringWithFormat:@"_xmpp%s-client._tcp.%@", isSecure ? "s" : "", domain];
     res=DNSServiceQueryRecord(
                               &sdRef, 0, 0,
                               [serviceDiscoveryString UTF8String],
@@ -63,7 +62,17 @@ -(NSArray *) dnsDiscoverOnDomain:(NSString *) domain
         }
 
     }
+}
+
+-(NSArray *) dnsDiscoverOnDomain:(NSString *) domain
+{
+    self.discoveredServers =[[NSMutableArray alloc] init];
+
+    //mix xmpps and xmpp records as per XEP-0368
+    [self doDiscoveryWithSecure:YES andDomain:domain];
+    [self doDiscoveryWithSecure:NO andDomain:domain];
 
+    //we ignore weights here for simplicity
     NSSortDescriptor *descriptor = [[NSSortDescriptor alloc] initWithKey:@"priority"  ascending:YES];
     NSArray* sortArray =[NSArray arrayWithObjects:descriptor,nil];
     [self.discoveredServers sortUsingDescriptors:sortArray];
@@ -143,7 +152,7 @@ void print_rdata(int type, int len, const u_char *rdata, void* context)
         NSNumber* num=[NSNumber numberWithInt:ntohs(srv->priority)];
         NSNumber* theport=[NSNumber numberWithInt:portval];
         if(theserver && num && theport) {
-            NSDictionary* row=[NSDictionary dictionaryWithObjectsAndKeys:num,@"priority", theserver, @"server", theport, @"port",nil];
+            NSDictionary* row=[NSDictionary dictionaryWithObjectsAndKeys:num,@"priority", theserver,@"server", theport,@"port", [NSNumber numberWithBool:isSecure],@"isSecure", nil];
             [caller.discoveredServers addObject:row];
         }
     }

Monal/Classes/MLRegisterViewController.m

@@ -63,11 +63,10 @@ -(void) makeXMPPConnection {
 
     MLXMPPIdentity *identity = [[MLXMPPIdentity alloc] initWithJid:@"nothing@yax.im" password:@"nothing" andResource:@"MonalReg"];
 
-    MLXMPPServer *server = [[MLXMPPServer alloc] initWithHost:kRegServer andPort:[NSNumber numberWithInt:5222]];
+    MLXMPPServer *server = [[MLXMPPServer alloc] initWithHost:kRegServer andPort:[NSNumber numberWithInt:5222] andOldStyleSSL:NO];
 
     server.SSL=YES;
     server.selfSignedCert=NO;
-    server.oldStyleSSL=NO;
 
     self.xmppAccount= [[xmpp alloc] initWithServer:server andIdentity:identity];
 

Monal/Classes/MLXMPPManager.m

@@ -299,10 +299,9 @@ -(void) connectAccountWithDictionary:(NSDictionary*)account
     NSString *password = [SAMKeychain passwordForService:@"Monal" account:[NSString stringWithFormat:@"%@",[account objectForKey:kAccountID]]];
     MLXMPPIdentity *identity = [[MLXMPPIdentity alloc] initWithJid:[NSString stringWithFormat:@"%@@%@",[account objectForKey:kUsername],[account objectForKey:kDomain] ] password:password andResource:[account objectForKey:kResource]];
 
-    MLXMPPServer *server = [[MLXMPPServer alloc] initWithHost:[account objectForKey:kServer] andPort:[account objectForKey:kPort]];
+    MLXMPPServer *server = [[MLXMPPServer alloc] initWithHost:[account objectForKey:kServer] andPort:[account objectForKey:kPort] andOldStyleSSL:[[account objectForKey:kOldSSL] boolValue]];
 
     server.SSL=[[account objectForKey:kSSL] boolValue];
-    server.oldStyleSSL=[[account objectForKey:kOldSSL] boolValue];
     server.selfSignedCert=[[account objectForKey:kSelfSigned] boolValue];
 
     if(server.oldStyleSSL && !server.SSL ) server.SSL=YES; //tehcnically a config error but  understandable

Monal/Classes/MLXMPPServer.h

@@ -22,13 +22,15 @@ NS_ASSUME_NONNULL_BEGIN
 @property (nonatomic,assign) BOOL oldStyleSSL;
 @property (nonatomic,assign) BOOL selfSignedCert;
 
--(id) initWithHost:(NSString *) host andPort:(NSNumber *) port;
+-(id) initWithHost:(NSString *) host andPort:(NSNumber *) port andOldStyleSSL:(BOOL) oldStyleSSL;
 
 
 - (void) updateConnectServer:(NSString *) server;
 
 - (void) updateConnectPort:(NSNumber *) port;
 
+- (void) updateConnectTLS:(BOOL) isSecure;
+
 /**
  returns the currently connected server may be host or dns one.
  */
@@ -39,6 +41,11 @@ returns the currently connected port may be configured  or dns one.
 */
 - (NSNumber *) connectPort;
 
+/**
+returns the currently directTLS setting may be configured  or dns one.
+*/
+- (BOOL) connectTLS;
+
 @end
 
 NS_ASSUME_NONNULL_END

Monal/Classes/MLXMPPServer.m

@@ -22,18 +22,21 @@ @interface MLXMPPServer ()
  */
 @property (nonatomic, strong) NSString *serverInUse;
 @property (nonatomic, strong) NSNumber *portInUse;
+@property (nonatomic, assign) BOOL directTLSInUse;
 
 @end
 
 @implementation MLXMPPServer
 
--(id) initWithHost:(NSString *) host andPort:(NSNumber *) port{
+-(id) initWithHost:(NSString *) host andPort:(NSNumber *) port andOldStyleSSL:(BOOL) oldStyleSSL {
     self = [super init];
     self.host=host;
     self.port=port;
+    self.oldStyleSSL=oldStyleSSL;
 
     self.serverInUse=host;
     self.portInUse=port;
+    self.directTLSInUse=oldStyleSSL;
 
     return self;
 }
@@ -56,4 +59,13 @@ - (NSNumber *) connectPort {
     return self.portInUse;
 }
 
+- (void) updateConnectTLS:(BOOL) isSecure
+{
+    self.directTLSInUse = isSecure;
+}
+
+- (BOOL) connectTLS {
+    return self.directTLSInUse;
+}
+
 @end

Monal/Classes/xmpp.h

@@ -91,7 +91,8 @@ typedef void (^xmppDataCompletion)(NSData *captchaImage, NSDictionary *hiddenFie
 @property (nonatomic, readonly) xmppState accountState;
 
 // discovered properties
-@property (nonatomic,strong)  NSArray* discoveredServerList;
+@property (nonatomic,strong)  NSArray* discoveredServersList;
+@property (nonatomic,strong)  NSMutableArray* usableServersList;
 
 @property (nonatomic,strong)  NSArray*  roomList;
 @property (nonatomic, strong) NSArray* rosterList;

Monal/Classes/xmpp.m

@@ -8,6 +8,8 @@
 
 #import <CommonCrypto/CommonCrypto.h>
 #import <CFNetwork/CFSocketStream.h>
+#import <Security/SecureTransport.h>
+
 #import "xmpp.h"
 #import "DataLayer.h"
 #import "EncodingTools.h"
@@ -156,7 +158,9 @@ -(void) setupObjects
 {
     _accountState = kStateLoggedOut;
 
-    _discoveredServerList=[[NSMutableArray alloc] init];
+    _discoveredServersList=[[NSMutableArray alloc] init];
+    if(!_usableServersList)
+		    _usableServersList=[[NSMutableArray alloc] init];
     _inputDataBuffer=[[NSMutableData alloc] init];
     _inputBuffer=[[NSMutableString alloc] init];
     _outputQueue=[[NSMutableArray alloc] init];
@@ -242,14 +246,45 @@ -(void) setRunLoop
     [_iStream scheduleInRunLoop:[NSRunLoop mainRunLoop] forMode:NSDefaultRunLoopMode];
 }
 
+-(void) initTLS
+{
+	NSMutableDictionary *settings = [[NSMutableDictionary alloc] init];
+	[settings setObject:self.connectionProperties.identity.domain forKey:kCFStreamSSLPeerName];
+	if(self.connectionProperties.server.selfSignedCert)
+	{
+		DDLogInfo(@"configured self signed SSL");
+		[settings setObject:@NO forKey:kCFStreamSSLValidatesCertificateChain];
+	}
+
+	//this will create an sslContext and, if the underlying TCP socket is already connected, immediately start the ssl handshake
+	DDLogInfo(@"configuring SSL handshake");
+	if(CFReadStreamSetProperty((__bridge CFReadStreamRef)self->_iStream, kCFStreamPropertySSLSettings, (__bridge CFTypeRef)settings))
+		DDLogInfo(@"Set TLS properties on streams. Security level %@", [self->_iStream propertyForKey:NSStreamSocketSecurityLevelKey]);
+	else
+	{
+		DDLogError(@"not sure.. Could not confirm Set TLS properties on streams.");
+		DDLogInfo(@"Set TLS properties on streams.security level %@", [self->_iStream propertyForKey:NSStreamSocketSecurityLevelKey]);
+	}
+
+	//see this for extracting the sslcontext of the cfstream: https://stackoverflow.com/a/26726525/3528174
+	//see this for creating the proper protocols array: https://github.com/LLNL/FRS/blob/master/Pods/AWSIoT/AWSIoT/Internal/AWSIoTMQTTClient.m
+	//this will only have an effect if the TLS handshake was not already started (e.g. the TCP socket is not connected)
+	SSLContextRef sslContext = (__bridge SSLContextRef) [_iStream propertyForKey: (__bridge NSString *) kCFStreamPropertySSLContext ];
+	CFStringRef strs[1];
+	strs[0] = CFSTR("xmpp-client");
+	CFArrayRef protocols = CFArrayCreate(NULL, (void *)strs, 1, &kCFTypeArrayCallBacks);
+	SSLSetALPNProtocols(sslContext, protocols);
+	CFRelease(protocols);
+}
+
 -(void) createStreams
 {
-    DDLogInfo(@"stream  creating to  server: %@ port: %@", self.connectionProperties.server.connectServer, self.connectionProperties.server.port);
+    DDLogInfo(@"stream  creating to  server: %@ port: %@ directTLS: %@", self.connectionProperties.server.connectServer, self.connectionProperties.server.connectPort, self.connectionProperties.server.connectTLS ? @"YES" : @"NO");
 
     NSInputStream *localIStream;
     NSOutputStream *localOStream;
 
-    [NSStream getStreamsToHostWithName:self.connectionProperties.server.connectServer port:self.connectionProperties.server.port.integerValue inputStream:&localIStream outputStream:&localOStream];
+    [NSStream getStreamsToHostWithName:self.connectionProperties.server.connectServer port:self.connectionProperties.server.connectPort.integerValue inputStream:&localIStream outputStream:&localOStream];
 
     if(localIStream) {
         _iStream=localIStream;
@@ -276,37 +311,10 @@ -(void) createStreams
         DDLogInfo(@"streams created ok");
     }
 
-
-    if((self.connectionProperties.server.SSL==YES)  && (self.connectionProperties.server.oldStyleSSL==YES))
+    if(self.connectionProperties.server.connectTLS==YES)
     {
-        // do ssl stuff here
-        DDLogInfo(@"starting old style SSL");
-
-        NSMutableDictionary *settings = [ [NSMutableDictionary alloc ]
-                                         initWithObjectsAndKeys:
-                                         kCFStreamSocketSecurityLevelNegotiatedSSL,
-                                         kCFStreamSSLLevel,
-                                         nil ];
-
-        if(self.connectionProperties.server.selfSignedCert)
-        {
-            DDLogInfo(@"self signed SSL");
-            NSDictionary* secureOFF= [ [NSDictionary alloc ]
-                                      initWithObjectsAndKeys:
-                                      [NSNumber numberWithBool:NO], kCFStreamSSLValidatesCertificateChain, nil];
-
-            [settings addEntriesFromDictionary:secureOFF];
-
-
-
-        }
-
-        CFReadStreamSetProperty((__bridge CFReadStreamRef)_iStream,
-                                kCFStreamPropertySSLSettings, (__bridge CFTypeRef)settings);
-        CFWriteStreamSetProperty((__bridge CFWriteStreamRef)_oStream,
-                                 kCFStreamPropertySSLSettings, (__bridge CFTypeRef)settings);
-
-        DDLogInfo(@"connection secured");
+		DDLogInfo(@"starting directSSL");
+        [self initTLS];
     }
 
     MLXMLNode* xmlOpening = [[MLXMLNode alloc] initWithElement:@"xml"];
@@ -315,8 +323,7 @@ -(void) createStreams
     [self setRunLoop];
 
     dispatch_queue_t q_background = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);
-    dispatch_source_t streamTimer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0,q_background
-                                                           );
+    dispatch_source_t streamTimer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0,q_background);
 
     dispatch_source_set_timer(streamTimer,
                               dispatch_time(DISPATCH_TIME_NOW, 5ull * NSEC_PER_SEC),
@@ -347,16 +354,49 @@ -(void) createStreams
 
 -(void) connectionTask
 {
-    if(self.connectionProperties.server.oldStyleSSL==NO) {
-        // do DNS discovery if it hasn't already been set
-        if([_discoveredServerList count]==0) {
-            _discoveredServerList= [[[MLDNSLookup alloc] init] dnsDiscoverOnDomain:self.connectionProperties.identity.domain];
-        }
+	// do DNS discovery if it hasn't already been set
+	if([_discoveredServersList count]==0) {
+		_discoveredServersList=[[[MLDNSLookup alloc] init] dnsDiscoverOnDomain:self.connectionProperties.identity.domain];
     }
 
-    if([_discoveredServerList count]>0) {
-        [self.connectionProperties.server updateConnectServer:[[_discoveredServerList objectAtIndex:0] objectForKey:@"server"]];
-        [self.connectionProperties.server updateConnectPort:[[_discoveredServerList objectAtIndex:0] objectForKey:@"port"]];
+    //if all servers have been tried start over with the first one again
+    if([_discoveredServersList count]>0 && [_usableServersList count]==0)
+	{
+		DDLogWarn(@"All %lu SRV dns records tried, starting over again", (unsigned long)[_discoveredServersList count]);
+		_usableServersList = [_discoveredServersList mutableCopy];
+		for(NSDictionary *row in _usableServersList)
+		{
+			DDLogInfo(@"SRV entry: server=%@, port=%@, isSecure=%s (prio: %@)",
+				[row objectForKey:@"server"],
+				[row objectForKey:@"port"],
+				[[row objectForKey:@"isSecure"] boolValue] ? "YES" : "NO",
+				[row objectForKey:@"priority"]
+			);
+		}
+	}
+
+    if([_usableServersList count]>0) {
+		DDLogInfo(@"Using connection parameters discovered via SRV dns record: server=%@, port=%@, isSecure=%s, priority=%@",
+			[[_usableServersList objectAtIndex:0] objectForKey:@"server"],
+			[[_usableServersList objectAtIndex:0] objectForKey:@"port"],
+			[[[_usableServersList objectAtIndex:0] objectForKey:@"isSecure"] boolValue] ? "YES" : "NO",
+			[[_usableServersList objectAtIndex:0] objectForKey:@"priority"]
+		);
+        [self.connectionProperties.server updateConnectServer: [[_usableServersList objectAtIndex:0] objectForKey:@"server"]];
+        [self.connectionProperties.server updateConnectPort: [[_usableServersList objectAtIndex:0] objectForKey:@"port"]];
+		[self.connectionProperties.server updateConnectTLS: [[[_usableServersList objectAtIndex:0] objectForKey:@"isSecure"] boolValue]];
+		//remove this server so that the next connection attempt will try the next server in the list
+		[_usableServersList removeObjectAtIndex:0];
+		DDLogInfo(@"%lu SRV entries left:", (unsigned long)[_usableServersList count]);
+		for(NSDictionary *row in _usableServersList)
+		{
+			DDLogInfo(@"SRV entry: server=%@, port=%@, isSecure=%s (prio: %@)",
+				[row objectForKey:@"server"],
+				[row objectForKey:@"port"],
+				[[row objectForKey:@"isSecure"] boolValue] ? "YES" : "NO",
+				[row objectForKey:@"priority"]
+			);
+		}
     }
 
     [self createStreams];
@@ -1190,7 +1230,7 @@ -(void) requestSMAck
 		[self send:rNode];
 		self.smacksRequestInFlight=YES;
     } else  {
-        DDLogDebug(@"no smacks ack when there is nothing pending or a request already in flight...");
+        DDLogDebug(@"no smacks request, there is nothing pending or a request already in flight...");
     }
 }
 
@@ -1563,7 +1603,7 @@ -(void) processInput
 
 				if ((self.connectionProperties.server.SSL && self->_startTLSComplete)
 					|| (!self.connectionProperties.server.SSL && !self->_startTLSComplete)
-					|| (self.connectionProperties.server.SSL && self.connectionProperties.server.oldStyleSSL))
+					|| (self.connectionProperties.server.connectTLS==YES))
 				{
 					if(self.registration){
 						[self requestRegForm];
@@ -1778,30 +1818,7 @@ -(void) processInput
 			{
 				if(streamNode.startTLSProceed)
 				{
-					NSMutableDictionary *settings = [[NSMutableDictionary alloc] init];
-					[settings setObject:self.connectionProperties.identity.domain forKey:kCFStreamSSLPeerName];
-
-					[settings setObject:kCFStreamSocketSecurityLevelNegotiatedSSL forKey:kCFStreamSSLLevel];
-
-					if(self.connectionProperties.server.selfSignedCert)
-					{
-						[settings  setObject:@NO forKey:kCFStreamSSLValidatesCertificateChain];
-					}
-
-					if (CFReadStreamSetProperty((__bridge CFReadStreamRef)self->_iStream,
-												kCFStreamPropertySSLSettings, (__bridge CFTypeRef)settings) &&
-						CFWriteStreamSetProperty((__bridge CFWriteStreamRef)self->_oStream,
-													kCFStreamPropertySSLSettings, (__bridge CFTypeRef)settings))
-
-					{
-						DDLogInfo(@"Set TLS properties on streams. Security level %@", [self->_iStream propertyForKey:NSStreamSocketSecurityLevelKey]);
-
-					}
-					else
-					{
-						DDLogError(@"not sure.. Could not confirm Set TLS properties on streams.");
-						DDLogInfo(@"Set TLS properties on streams.security level %@", [self->_iStream propertyForKey:NSStreamSocketSecurityLevelKey]);
-					}
+					[self initTLS];
 
 					[self startStream];
 
@@ -1963,6 +1980,8 @@ -(void) processInput
 					self->_loginStarted=NO;
 					self.loginStartTimeStamp=nil;
 
+					//reset usable servers list so that the next connect starts with the highest prio server again
+					_usableServersList=[[NSMutableArray alloc] init];
 
 				}
 			}

Monal/Monal Tests/XMPP Tests/MLIQParserTest.m

@@ -32,7 +32,7 @@ - (void)setUp {
 
     MLXMPPIdentity *identity = [[MLXMPPIdentity alloc] initWithJid:self.jid  password:@"" andResource:self.resource];
 
-    MLXMPPServer *server = [[MLXMPPServer alloc] initWithHost:@"monal.im" andPort:@5222];
+    MLXMPPServer *server = [[MLXMPPServer alloc] initWithHost:@"monal.im" andPort:@5222 andOldStyleSSL:NO];
     server.SSL=YES;
 
     self.connectionProperties = [[MLXMPPConnection alloc] initWithServer:server andIdentity:identity];