Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Ken Chen | 5471dca | 2019-04-15 15:25:35 +0800 | [diff] [blame] | 17 | #define LOG_TAG "resolv" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 18 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 19 | #include "DnsTlsSocket.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 20 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 21 | #include <arpa/inet.h> |
| 22 | #include <arpa/nameser.h> |
| 23 | #include <errno.h> |
| 24 | #include <linux/tcp.h> |
| 25 | #include <openssl/err.h> |
| 26 | #include <openssl/sha.h> |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 27 | #include <sys/eventfd.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 28 | #include <sys/poll.h> |
Sehee Park | 2c11878 | 2019-05-07 13:02:45 +0900 | [diff] [blame] | 29 | #include <unistd.h> |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 30 | #include <algorithm> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 31 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 32 | #include "DnsTlsSessionCache.h" |
| 33 | #include "IDnsTlsSocketObserver.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 34 | |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 35 | #include <Fwmark.h> |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 36 | #include <android-base/logging.h> |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 37 | #include <android-base/stringprintf.h> |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 38 | #include <netdutils/SocketOption.h> |
| 39 | #include <netdutils/ThreadUtil.h> |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 40 | |
Sehee Park | 2c11878 | 2019-05-07 13:02:45 +0900 | [diff] [blame] | 41 | #include "private/android_filesystem_config.h" // AID_DNS |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 42 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 43 | // NOTE: Inject CA certificate for internal testing -- do NOT enable in production builds |
| 44 | #ifndef RESOLV_INJECT_CA_CERTIFICATE |
| 45 | #define RESOLV_INJECT_CA_CERTIFICATE 0 |
| 46 | #endif |
| 47 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 48 | namespace android { |
| 49 | |
| 50 | using netdutils::enableSockopt; |
| 51 | using netdutils::enableTcpKeepAlives; |
| 52 | using netdutils::isOk; |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 53 | using netdutils::Slice; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 54 | using netdutils::Status; |
| 55 | |
| 56 | namespace net { |
| 57 | namespace { |
| 58 | |
| 59 | constexpr const char kCaCertDir[] = "/system/etc/security/cacerts"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 60 | |
| 61 | int waitForReading(int fd) { |
| 62 | struct pollfd fds = { .fd = fd, .events = POLLIN }; |
| 63 | const int ret = TEMP_FAILURE_RETRY(poll(&fds, 1, -1)); |
| 64 | return ret; |
| 65 | } |
| 66 | |
| 67 | int waitForWriting(int fd) { |
| 68 | struct pollfd fds = { .fd = fd, .events = POLLOUT }; |
| 69 | const int ret = TEMP_FAILURE_RETRY(poll(&fds, 1, -1)); |
| 70 | return ret; |
| 71 | } |
| 72 | |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 73 | std::string markToFwmarkString(unsigned mMark) { |
| 74 | Fwmark mark; |
| 75 | mark.intValue = mMark; |
| 76 | return android::base::StringPrintf("%d, %d, %d, %d, %d", mark.netId, mark.explicitlySelected, |
| 77 | mark.protectedFromVpn, mark.permission, mark.uidBillingDone); |
| 78 | } |
| 79 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 80 | } // namespace |
| 81 | |
| 82 | Status DnsTlsSocket::tcpConnect() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 83 | LOG(DEBUG) << mMark << " connecting TCP socket"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 84 | int type = SOCK_NONBLOCK | SOCK_CLOEXEC; |
| 85 | switch (mServer.protocol) { |
| 86 | case IPPROTO_TCP: |
| 87 | type |= SOCK_STREAM; |
| 88 | break; |
| 89 | default: |
| 90 | return Status(EPROTONOSUPPORT); |
| 91 | } |
| 92 | |
| 93 | mSslFd.reset(socket(mServer.ss.ss_family, type, mServer.protocol)); |
| 94 | if (mSslFd.get() == -1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 95 | LOG(ERROR) << "Failed to create socket"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 96 | return Status(errno); |
| 97 | } |
| 98 | |
Sehee Park | 2c11878 | 2019-05-07 13:02:45 +0900 | [diff] [blame] | 99 | if (fchown(mSslFd.get(), AID_DNS, -1) == -1) { |
| 100 | LOG(WARNING) << "Failed to chown socket: %s" << strerror(errno); |
| 101 | } |
| 102 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 103 | const socklen_t len = sizeof(mMark); |
| 104 | if (setsockopt(mSslFd.get(), SOL_SOCKET, SO_MARK, &mMark, len) == -1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 105 | LOG(ERROR) << "Failed to set socket mark"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 106 | mSslFd.reset(); |
| 107 | return Status(errno); |
| 108 | } |
| 109 | |
| 110 | const Status tfo = enableSockopt(mSslFd.get(), SOL_TCP, TCP_FASTOPEN_CONNECT); |
| 111 | if (!isOk(tfo) && tfo.code() != ENOPROTOOPT) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 112 | LOG(WARNING) << "Failed to enable TFO: " << tfo.msg(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 113 | } |
| 114 | |
| 115 | // Send 5 keepalives, 3 seconds apart, after 15 seconds of inactivity. |
| 116 | enableTcpKeepAlives(mSslFd.get(), 15U, 5U, 3U).ignoreError(); |
| 117 | |
| 118 | if (connect(mSslFd.get(), reinterpret_cast<const struct sockaddr *>(&mServer.ss), |
| 119 | sizeof(mServer.ss)) != 0 && |
| 120 | errno != EINPROGRESS) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 121 | LOG(DEBUG) << "Socket failed to connect"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 122 | mSslFd.reset(); |
| 123 | return Status(errno); |
| 124 | } |
| 125 | |
| 126 | return netdutils::status::ok; |
| 127 | } |
| 128 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 129 | bool DnsTlsSocket::setTestCaCertificate() { |
| 130 | bssl::UniquePtr<BIO> bio( |
| 131 | BIO_new_mem_buf(mServer.certificate.data(), mServer.certificate.size())); |
| 132 | bssl::UniquePtr<X509> cert(PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr)); |
| 133 | if (!cert) { |
| 134 | LOG(ERROR) << "Failed to read cert"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 135 | return false; |
| 136 | } |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 137 | |
| 138 | X509_STORE* cert_store = SSL_CTX_get_cert_store(mSslCtx.get()); |
| 139 | if (!X509_STORE_add_cert(cert_store, cert.get())) { |
| 140 | LOG(ERROR) << "Failed to add cert"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 141 | return false; |
| 142 | } |
| 143 | return true; |
| 144 | } |
| 145 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 146 | // TODO: Try to use static sSslCtx instead of mSslCtx |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 147 | bool DnsTlsSocket::initialize() { |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 148 | // This method is called every time when a new SSL connection is created. |
| 149 | // This lock only serves to help catch bugs in code that calls this method. |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 150 | std::lock_guard guard(mLock); |
| 151 | if (mSslCtx) { |
| 152 | // This is a bug in the caller. |
| 153 | return false; |
| 154 | } |
| 155 | mSslCtx.reset(SSL_CTX_new(TLS_method())); |
| 156 | if (!mSslCtx) { |
| 157 | return false; |
| 158 | } |
| 159 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 160 | // Load system CA certs from CAPath for hostname verification. |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 161 | // |
| 162 | // For discussion of alternative, sustainable approaches see b/71909242. |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 163 | if (RESOLV_INJECT_CA_CERTIFICATE && !mServer.certificate.empty()) { |
| 164 | // Inject test CA certs from ResolverParamsParcel.caCertificate for internal testing. |
| 165 | LOG(WARNING) << "test CA certificate is valid"; |
| 166 | if (!setTestCaCertificate()) { |
| 167 | LOG(ERROR) << "Failed to set test CA certificate"; |
| 168 | return false; |
| 169 | } |
| 170 | } else { |
| 171 | if (SSL_CTX_load_verify_locations(mSslCtx.get(), nullptr, kCaCertDir) != 1) { |
| 172 | LOG(ERROR) << "Failed to load CA cert dir: " << kCaCertDir; |
| 173 | return false; |
| 174 | } |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 175 | } |
| 176 | |
| 177 | // Enable TLS false start |
| 178 | SSL_CTX_set_false_start_allowed_without_alpn(mSslCtx.get(), 1); |
| 179 | SSL_CTX_set_mode(mSslCtx.get(), SSL_MODE_ENABLE_FALSE_START); |
| 180 | |
| 181 | // Enable session cache |
| 182 | mCache->prepareSslContext(mSslCtx.get()); |
| 183 | |
| 184 | // Connect |
| 185 | Status status = tcpConnect(); |
| 186 | if (!status.ok()) { |
| 187 | return false; |
| 188 | } |
| 189 | mSsl = sslConnect(mSslFd.get()); |
| 190 | if (!mSsl) { |
| 191 | return false; |
| 192 | } |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 193 | |
| 194 | mEventFd.reset(eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 195 | |
| 196 | // Start the I/O loop. |
| 197 | mLoopThread.reset(new std::thread(&DnsTlsSocket::loop, this)); |
| 198 | |
| 199 | return true; |
| 200 | } |
| 201 | |
| 202 | bssl::UniquePtr<SSL> DnsTlsSocket::sslConnect(int fd) { |
| 203 | if (!mSslCtx) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 204 | LOG(ERROR) << "Internal error: context is null in sslConnect"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 205 | return nullptr; |
| 206 | } |
| 207 | if (!SSL_CTX_set_min_proto_version(mSslCtx.get(), TLS1_2_VERSION)) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 208 | LOG(ERROR) << "Failed to set minimum TLS version"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 209 | return nullptr; |
| 210 | } |
| 211 | |
| 212 | bssl::UniquePtr<SSL> ssl(SSL_new(mSslCtx.get())); |
| 213 | // This file descriptor is owned by mSslFd, so don't let libssl close it. |
| 214 | bssl::UniquePtr<BIO> bio(BIO_new_socket(fd, BIO_NOCLOSE)); |
| 215 | SSL_set_bio(ssl.get(), bio.get(), bio.get()); |
| 216 | bio.release(); |
| 217 | |
| 218 | if (!mCache->prepareSsl(ssl.get())) { |
| 219 | return nullptr; |
| 220 | } |
| 221 | |
| 222 | if (!mServer.name.empty()) { |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 223 | LOG(VERBOSE) << "Checking DNS over TLS hostname = " << mServer.name.c_str(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 224 | if (SSL_set_tlsext_host_name(ssl.get(), mServer.name.c_str()) != 1) { |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 225 | LOG(ERROR) << "Failed to set SNI to " << mServer.name; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 226 | return nullptr; |
| 227 | } |
| 228 | X509_VERIFY_PARAM* param = SSL_get0_param(ssl.get()); |
| 229 | if (X509_VERIFY_PARAM_set1_host(param, mServer.name.data(), mServer.name.size()) != 1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 230 | LOG(ERROR) << "Failed to set verify host param to " << mServer.name; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 231 | return nullptr; |
| 232 | } |
| 233 | // This will cause the handshake to fail if certificate verification fails. |
| 234 | SSL_set_verify(ssl.get(), SSL_VERIFY_PEER, nullptr); |
| 235 | } |
| 236 | |
| 237 | bssl::UniquePtr<SSL_SESSION> session = mCache->getSession(); |
| 238 | if (session) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 239 | LOG(DEBUG) << "Setting session"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 240 | SSL_set_session(ssl.get(), session.get()); |
| 241 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 242 | LOG(DEBUG) << "No session available"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 243 | } |
| 244 | |
| 245 | for (;;) { |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 246 | LOG(DEBUG) << " Calling SSL_connect with " << markToFwmarkString(mMark); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 247 | int ret = SSL_connect(ssl.get()); |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 248 | LOG(DEBUG) << " SSL_connect returned " << ret << " with " << markToFwmarkString(mMark); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 249 | if (ret == 1) break; // SSL handshake complete; |
| 250 | |
| 251 | const int ssl_err = SSL_get_error(ssl.get(), ret); |
| 252 | switch (ssl_err) { |
| 253 | case SSL_ERROR_WANT_READ: |
| 254 | if (waitForReading(fd) != 1) { |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 255 | PLOG(WARNING) << "SSL_connect read error, " << markToFwmarkString(mMark); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 256 | return nullptr; |
| 257 | } |
| 258 | break; |
| 259 | case SSL_ERROR_WANT_WRITE: |
| 260 | if (waitForWriting(fd) != 1) { |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 261 | PLOG(WARNING) << "SSL_connect write error, " << markToFwmarkString(mMark); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 262 | return nullptr; |
| 263 | } |
| 264 | break; |
| 265 | default: |
Chiachang Wang | 3237217 | 2019-07-06 13:54:18 +0800 | [diff] [blame] | 266 | PLOG(WARNING) << "SSL_connect ssl error =" << ssl_err << ", " |
| 267 | << markToFwmarkString(mMark); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 268 | return nullptr; |
| 269 | } |
| 270 | } |
| 271 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 272 | LOG(DEBUG) << mMark << " handshake complete"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 273 | |
| 274 | return ssl; |
| 275 | } |
| 276 | |
| 277 | void DnsTlsSocket::sslDisconnect() { |
| 278 | if (mSsl) { |
| 279 | SSL_shutdown(mSsl.get()); |
| 280 | mSsl.reset(); |
| 281 | } |
| 282 | mSslFd.reset(); |
| 283 | } |
| 284 | |
| 285 | bool DnsTlsSocket::sslWrite(const Slice buffer) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 286 | LOG(DEBUG) << mMark << " Writing " << buffer.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 287 | for (;;) { |
| 288 | int ret = SSL_write(mSsl.get(), buffer.base(), buffer.size()); |
| 289 | if (ret == int(buffer.size())) break; // SSL write complete; |
| 290 | |
| 291 | if (ret < 1) { |
| 292 | const int ssl_err = SSL_get_error(mSsl.get(), ret); |
| 293 | switch (ssl_err) { |
| 294 | case SSL_ERROR_WANT_WRITE: |
| 295 | if (waitForWriting(mSslFd.get()) != 1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 296 | LOG(DEBUG) << "SSL_write error"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 297 | return false; |
| 298 | } |
| 299 | continue; |
| 300 | case 0: |
| 301 | break; // SSL write complete; |
| 302 | default: |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 303 | LOG(DEBUG) << "SSL_write error " << ssl_err; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 304 | return false; |
| 305 | } |
| 306 | } |
| 307 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 308 | LOG(DEBUG) << mMark << " Wrote " << buffer.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 309 | return true; |
| 310 | } |
| 311 | |
| 312 | void DnsTlsSocket::loop() { |
| 313 | std::lock_guard guard(mLock); |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 314 | std::deque<std::vector<uint8_t>> q; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 315 | const int timeout_msecs = DnsTlsSocket::kIdleTimeout.count() * 1000; |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 316 | |
| 317 | Fwmark mark; |
| 318 | mark.intValue = mMark; |
| 319 | netdutils::setThreadName(android::base::StringPrintf("TlsListen_%u", mark.netId).c_str()); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 320 | while (true) { |
| 321 | // poll() ignores negative fds |
| 322 | struct pollfd fds[2] = { { .fd = -1 }, { .fd = -1 } }; |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 323 | enum { SSLFD = 0, EVENTFD = 1 }; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 324 | |
| 325 | // Always listen for a response from server. |
| 326 | fds[SSLFD].fd = mSslFd.get(); |
| 327 | fds[SSLFD].events = POLLIN; |
| 328 | |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 329 | // If we have pending queries, wait for space to write one. |
| 330 | // Otherwise, listen for new queries. |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 331 | // Note: This blocks the destructor until q is empty, i.e. until all pending |
| 332 | // queries are sent or have failed to send. |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 333 | if (!q.empty()) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 334 | fds[SSLFD].events |= POLLOUT; |
| 335 | } else { |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 336 | fds[EVENTFD].fd = mEventFd.get(); |
| 337 | fds[EVENTFD].events = POLLIN; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 338 | } |
| 339 | |
| 340 | const int s = TEMP_FAILURE_RETRY(poll(fds, std::size(fds), timeout_msecs)); |
| 341 | if (s == 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 342 | LOG(DEBUG) << "Idle timeout"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 343 | break; |
| 344 | } |
| 345 | if (s < 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 346 | LOG(DEBUG) << "Poll failed: " << errno; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 347 | break; |
| 348 | } |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 349 | if (fds[SSLFD].revents & (POLLIN | POLLERR | POLLHUP)) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 350 | if (!readResponse()) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 351 | LOG(DEBUG) << "SSL remote close or read error."; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 352 | break; |
| 353 | } |
| 354 | } |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 355 | if (fds[EVENTFD].revents & (POLLIN | POLLERR)) { |
| 356 | int64_t num_queries; |
| 357 | ssize_t res = read(mEventFd.get(), &num_queries, sizeof(num_queries)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 358 | if (res < 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 359 | LOG(WARNING) << "Error during eventfd read"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 360 | break; |
| 361 | } else if (res == 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 362 | LOG(WARNING) << "eventfd closed; disconnecting"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 363 | break; |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 364 | } else if (res != sizeof(num_queries)) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 365 | LOG(ERROR) << "Int size mismatch: " << res << " != " << sizeof(num_queries); |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 366 | break; |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 367 | } else if (num_queries < 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 368 | LOG(DEBUG) << "Negative eventfd read indicates destructor-initiated shutdown"; |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 369 | break; |
| 370 | } |
| 371 | // Take ownership of all pending queries. (q is always empty here.) |
| 372 | mQueue.swap(q); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 373 | } else if (fds[SSLFD].revents & POLLOUT) { |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 374 | // q cannot be empty here. |
| 375 | // Sending the entire queue here would risk a TCP flow control deadlock, so |
| 376 | // we only send a single query on each cycle of this loop. |
| 377 | // TODO: Coalesce multiple pending queries if there is enough space in the |
| 378 | // write buffer. |
| 379 | if (!sendQuery(q.front())) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 380 | break; |
| 381 | } |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 382 | q.pop_front(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 383 | } |
| 384 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 385 | LOG(DEBUG) << "Disconnecting"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 386 | sslDisconnect(); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 387 | LOG(DEBUG) << "Calling onClosed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 388 | mObserver->onClosed(); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 389 | LOG(DEBUG) << "Ending loop"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 390 | } |
| 391 | |
| 392 | DnsTlsSocket::~DnsTlsSocket() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 393 | LOG(DEBUG) << "Destructor"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 394 | // This will trigger an orderly shutdown in loop(). |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 395 | requestLoopShutdown(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 396 | { |
| 397 | // Wait for the orderly shutdown to complete. |
| 398 | std::lock_guard guard(mLock); |
| 399 | if (mLoopThread && std::this_thread::get_id() == mLoopThread->get_id()) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 400 | LOG(ERROR) << "Violation of re-entrance precondition"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 401 | return; |
| 402 | } |
| 403 | } |
| 404 | if (mLoopThread) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 405 | LOG(DEBUG) << "Waiting for loop thread to terminate"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 406 | mLoopThread->join(); |
| 407 | mLoopThread.reset(); |
| 408 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 409 | LOG(DEBUG) << "Destructor completed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 410 | } |
| 411 | |
| 412 | bool DnsTlsSocket::query(uint16_t id, const Slice query) { |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 413 | // Compose the entire message in a single buffer, so that it can be |
| 414 | // sent as a single TLS record. |
| 415 | std::vector<uint8_t> buf(query.size() + 4); |
| 416 | // Write 2-byte length |
| 417 | uint16_t len = query.size() + 2; // + 2 for the ID. |
| 418 | buf[0] = len >> 8; |
| 419 | buf[1] = len; |
| 420 | // Write 2-byte ID |
| 421 | buf[2] = id >> 8; |
| 422 | buf[3] = id; |
| 423 | // Copy body |
| 424 | std::memcpy(buf.data() + 4, query.base(), query.size()); |
| 425 | |
| 426 | mQueue.push(std::move(buf)); |
| 427 | // Increment the mEventFd counter by 1. |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 428 | return incrementEventFd(1); |
| 429 | } |
| 430 | |
| 431 | void DnsTlsSocket::requestLoopShutdown() { |
Bernie Innocenti | 97ee109 | 2019-03-28 15:52:59 +0900 | [diff] [blame] | 432 | if (mEventFd != -1) { |
| 433 | // Write a negative number to the eventfd. This triggers an immediate shutdown. |
| 434 | incrementEventFd(INT64_MIN); |
| 435 | } |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 436 | } |
| 437 | |
| 438 | bool DnsTlsSocket::incrementEventFd(const int64_t count) { |
Bernie Innocenti | 97ee109 | 2019-03-28 15:52:59 +0900 | [diff] [blame] | 439 | if (mEventFd == -1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 440 | LOG(ERROR) << "eventfd is not initialized"; |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 441 | return false; |
| 442 | } |
Bernie Innocenti | 97ee109 | 2019-03-28 15:52:59 +0900 | [diff] [blame] | 443 | ssize_t written = write(mEventFd.get(), &count, sizeof(count)); |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 444 | if (written != sizeof(count)) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 445 | LOG(ERROR) << "Failed to increment eventfd by " << count; |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 446 | return false; |
| 447 | } |
| 448 | return true; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 449 | } |
| 450 | |
| 451 | // Read exactly len bytes into buffer or fail with an SSL error code |
| 452 | int DnsTlsSocket::sslRead(const Slice buffer, bool wait) { |
| 453 | size_t remaining = buffer.size(); |
| 454 | while (remaining > 0) { |
| 455 | int ret = SSL_read(mSsl.get(), buffer.limit() - remaining, remaining); |
| 456 | if (ret == 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 457 | if (remaining < buffer.size()) |
| 458 | LOG(WARNING) << "SSL closed with " << remaining << " of " << buffer.size() |
| 459 | << " bytes remaining"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 460 | return SSL_ERROR_ZERO_RETURN; |
| 461 | } |
| 462 | |
| 463 | if (ret < 0) { |
| 464 | const int ssl_err = SSL_get_error(mSsl.get(), ret); |
| 465 | if (wait && ssl_err == SSL_ERROR_WANT_READ) { |
| 466 | if (waitForReading(mSslFd.get()) != 1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 467 | LOG(DEBUG) << "Poll failed in sslRead: " << errno; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 468 | return SSL_ERROR_SYSCALL; |
| 469 | } |
| 470 | continue; |
| 471 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 472 | LOG(DEBUG) << "SSL_read error " << ssl_err; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 473 | return ssl_err; |
| 474 | } |
| 475 | } |
| 476 | |
| 477 | remaining -= ret; |
| 478 | wait = true; // Once a read is started, try to finish. |
| 479 | } |
| 480 | return SSL_ERROR_NONE; |
| 481 | } |
| 482 | |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 483 | bool DnsTlsSocket::sendQuery(const std::vector<uint8_t>& buf) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 484 | if (!sslWrite(netdutils::makeSlice(buf))) { |
| 485 | return false; |
| 486 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 487 | LOG(DEBUG) << mMark << " SSL_write complete"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 488 | return true; |
| 489 | } |
| 490 | |
| 491 | bool DnsTlsSocket::readResponse() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 492 | LOG(DEBUG) << "reading response"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 493 | uint8_t responseHeader[2]; |
| 494 | int err = sslRead(Slice(responseHeader, 2), false); |
| 495 | if (err == SSL_ERROR_WANT_READ) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 496 | LOG(DEBUG) << "Ignoring spurious wakeup from server"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 497 | return true; |
| 498 | } |
| 499 | if (err != SSL_ERROR_NONE) { |
| 500 | return false; |
| 501 | } |
| 502 | // Truncate responses larger than MAX_SIZE. This is safe because a DNS packet is |
| 503 | // always invalid when truncated, so the response will be treated as an error. |
| 504 | constexpr uint16_t MAX_SIZE = 8192; |
| 505 | const uint16_t responseSize = (responseHeader[0] << 8) | responseHeader[1]; |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 506 | LOG(DEBUG) << mMark << " Expecting response of size " << responseSize; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 507 | std::vector<uint8_t> response(std::min(responseSize, MAX_SIZE)); |
| 508 | if (sslRead(netdutils::makeSlice(response), true) != SSL_ERROR_NONE) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 509 | LOG(DEBUG) << mMark << " Failed to read " << response.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 510 | return false; |
| 511 | } |
| 512 | uint16_t remainingBytes = responseSize - response.size(); |
| 513 | while (remainingBytes > 0) { |
| 514 | constexpr uint16_t CHUNK_SIZE = 2048; |
| 515 | std::vector<uint8_t> discard(std::min(remainingBytes, CHUNK_SIZE)); |
| 516 | if (sslRead(netdutils::makeSlice(discard), true) != SSL_ERROR_NONE) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 517 | LOG(DEBUG) << mMark << " Failed to discard " << discard.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 518 | return false; |
| 519 | } |
| 520 | remainingBytes -= discard.size(); |
| 521 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 522 | LOG(DEBUG) << mMark << " SSL_read complete"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 523 | |
| 524 | mObserver->onResponse(std::move(response)); |
| 525 | return true; |
| 526 | } |
| 527 | |
| 528 | } // end of namespace net |
| 529 | } // end of namespace android |