Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | #ifndef _DNS_DNSTLSSOCKET_H |
| 18 | #define _DNS_DNSTLSSOCKET_H |
| 19 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 20 | #include <openssl/ssl.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 21 | #include <future> |
| 22 | #include <mutex> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 23 | |
| 24 | #include <android-base/thread_annotations.h> |
| 25 | #include <android-base/unique_fd.h> |
| 26 | #include <netdutils/Slice.h> |
| 27 | #include <netdutils/Status.h> |
| 28 | |
| 29 | #include "DnsTlsServer.h" |
| 30 | #include "IDnsTlsSocket.h" |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 31 | #include "LockedQueue.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 32 | |
| 33 | namespace android { |
| 34 | namespace net { |
| 35 | |
| 36 | class IDnsTlsSocketObserver; |
| 37 | class DnsTlsSessionCache; |
| 38 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 39 | // A class for managing a TLS socket that sends and receives messages in |
| 40 | // [length][value] format, with a 2-byte length (i.e. DNS-over-TCP format). |
| 41 | // This class is not aware of query-response pairing or anything else about DNS. |
| 42 | // For the observer: |
| 43 | // This class is not re-entrant: the observer is not permitted to wait for a call to query() |
| 44 | // or the destructor in a callback. Doing so will result in deadlocks. |
| 45 | // This class may call the observer at any time after initialize(), until the destructor |
| 46 | // returns (but not after). |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 47 | class DnsTlsSocket : public IDnsTlsSocket { |
| 48 | public: |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 49 | DnsTlsSocket(const DnsTlsServer& server, unsigned mark, |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 50 | IDnsTlsSocketObserver* _Nonnull observer, DnsTlsSessionCache* _Nonnull cache) |
| 51 | : mMark(mark), mServer(server), mObserver(observer), mCache(cache) {} |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 52 | ~DnsTlsSocket(); |
| 53 | |
| 54 | // Creates the SSL context for this session and connect. Returns false on failure. |
| 55 | // This method should be called after construction and before use of a DnsTlsSocket. |
| 56 | // Only call this method once per DnsTlsSocket. |
| 57 | bool initialize() EXCLUDES(mLock); |
| 58 | |
| 59 | // Send a query on the provided SSL socket. |query| contains |
| 60 | // the body of a query, not including the ID header. This function will typically return before |
| 61 | // the query is actually sent. If this function fails, DnsTlsSocketObserver will be |
| 62 | // notified that the socket is closed. |
| 63 | // Note that success here indicates successful sending, not receipt of a response. |
| 64 | // Thread-safe. |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 65 | bool query(uint16_t id, const netdutils::Slice query) override EXCLUDES(mLock); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 66 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 67 | private: |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 68 | // Lock to be held by the SSL event loop thread. This is not normally in contention. |
| 69 | std::mutex mLock; |
| 70 | |
| 71 | // Forwards queries and receives responses. Blocks until the idle timeout. |
| 72 | void loop() EXCLUDES(mLock); |
| 73 | std::unique_ptr<std::thread> mLoopThread GUARDED_BY(mLock); |
| 74 | |
| 75 | // On success, sets mSslFd to a socket connected to mAddr (the |
| 76 | // connection will likely be in progress if mProtocol is IPPROTO_TCP). |
| 77 | // On error, returns the errno. |
| 78 | netdutils::Status tcpConnect() REQUIRES(mLock); |
| 79 | |
| 80 | // Connect an SSL session on the provided socket. If connection fails, closing the |
| 81 | // socket remains the caller's responsibility. |
| 82 | bssl::UniquePtr<SSL> sslConnect(int fd) REQUIRES(mLock); |
| 83 | |
| 84 | // Disconnect the SSL session and close the socket. |
| 85 | void sslDisconnect() REQUIRES(mLock); |
| 86 | |
| 87 | // Writes a buffer to the socket. |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 88 | bool sslWrite(const netdutils::Slice buffer) REQUIRES(mLock); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 89 | |
| 90 | // Reads exactly the specified number of bytes from the socket, or fails. |
| 91 | // Returns SSL_ERROR_NONE on success. |
| 92 | // If |wait| is true, then this function always blocks. Otherwise, it |
| 93 | // will return SSL_ERROR_WANT_READ if there is no data from the server to read. |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 94 | int sslRead(const netdutils::Slice buffer, bool wait) REQUIRES(mLock); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 95 | |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 96 | bool sendQuery(const std::vector<uint8_t>& buf) REQUIRES(mLock); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 97 | bool readResponse() REQUIRES(mLock); |
| 98 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 99 | // It is only used for DNS-OVER-TLS internal test. |
| 100 | bool setTestCaCertificate() REQUIRES(mLock); |
| 101 | |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 102 | // Similar to query(), this function uses incrementEventFd to send a message to the |
| 103 | // loop thread. However, instead of incrementing the counter by one (indicating a |
| 104 | // new query), it wraps the counter to negative, which we use to indicate a shutdown |
| 105 | // request. |
| 106 | void requestLoopShutdown() EXCLUDES(mLock); |
| 107 | |
| 108 | // This function sends a message to the loop thread by incrementing mEventFd. |
| 109 | bool incrementEventFd(int64_t count) EXCLUDES(mLock); |
| 110 | |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 111 | // Queue of pending queries. query() pushes items onto the queue and notifies |
| 112 | // the loop thread by incrementing mEventFd. loop() reads items off the queue. |
| 113 | LockedQueue<std::vector<uint8_t>> mQueue; |
| 114 | |
| 115 | // eventfd socket used for notifying the SSL thread when queries are ready to send. |
| 116 | // This socket acts similarly to an atomic counter, incremented by query() and cleared |
| 117 | // by loop(). We have to use a socket because the SSL thread needs to wait in poll() |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 118 | // for input from either a remote server or a query thread. Since eventfd does not have |
| 119 | // EOF, we indicate a close request by setting the counter to a negative number. |
| 120 | // This file descriptor is opened by initialize(), and closed implicitly after |
| 121 | // destruction. |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 122 | base::unique_fd mEventFd; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 123 | |
| 124 | // SSL Socket fields. |
| 125 | bssl::UniquePtr<SSL_CTX> mSslCtx GUARDED_BY(mLock); |
| 126 | base::unique_fd mSslFd GUARDED_BY(mLock); |
| 127 | bssl::UniquePtr<SSL> mSsl GUARDED_BY(mLock); |
| 128 | static constexpr std::chrono::seconds kIdleTimeout = std::chrono::seconds(20); |
| 129 | |
| 130 | const unsigned mMark; // Socket mark |
| 131 | const DnsTlsServer mServer; |
| 132 | IDnsTlsSocketObserver* _Nonnull const mObserver; |
| 133 | DnsTlsSessionCache* _Nonnull const mCache; |
| 134 | }; |
| 135 | |
| 136 | } // end of namespace net |
| 137 | } // end of namespace android |
| 138 | |
| 139 | #endif // _DNS_DNSTLSSOCKET_H |