Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Ken Chen | 5471dca | 2019-04-15 15:25:35 +0800 | [diff] [blame] | 17 | #define LOG_TAG "resolv" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 18 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 19 | #include "DnsTlsDispatcher.h" |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 20 | #include <netdutils/Stopwatch.h> |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 21 | #include "DnsTlsSocketFactory.h" |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 22 | #include "resolv_private.h" |
| 23 | #include "stats.pb.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 24 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 25 | #include <android-base/logging.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 26 | |
| 27 | namespace android { |
| 28 | namespace net { |
| 29 | |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 30 | using android::netdutils::Stopwatch; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 31 | using netdutils::Slice; |
| 32 | |
| 33 | // static |
| 34 | std::mutex DnsTlsDispatcher::sLock; |
| 35 | |
| 36 | DnsTlsDispatcher::DnsTlsDispatcher() { |
| 37 | mFactory.reset(new DnsTlsSocketFactory()); |
| 38 | } |
| 39 | |
| 40 | std::list<DnsTlsServer> DnsTlsDispatcher::getOrderedServerList( |
| 41 | const std::list<DnsTlsServer> &tlsServers, unsigned mark) const { |
| 42 | // Our preferred DnsTlsServer order is: |
| 43 | // 1) reuse existing IPv6 connections |
| 44 | // 2) reuse existing IPv4 connections |
| 45 | // 3) establish new IPv6 connections |
| 46 | // 4) establish new IPv4 connections |
| 47 | std::list<DnsTlsServer> existing6; |
| 48 | std::list<DnsTlsServer> existing4; |
| 49 | std::list<DnsTlsServer> new6; |
| 50 | std::list<DnsTlsServer> new4; |
| 51 | |
| 52 | // Pull out any servers for which we might have existing connections and |
| 53 | // place them at the from the list of servers to try. |
| 54 | { |
| 55 | std::lock_guard guard(sLock); |
| 56 | |
| 57 | for (const auto& tlsServer : tlsServers) { |
| 58 | const Key key = std::make_pair(mark, tlsServer); |
| 59 | if (mStore.find(key) != mStore.end()) { |
| 60 | switch (tlsServer.ss.ss_family) { |
| 61 | case AF_INET: |
| 62 | existing4.push_back(tlsServer); |
| 63 | break; |
| 64 | case AF_INET6: |
| 65 | existing6.push_back(tlsServer); |
| 66 | break; |
| 67 | } |
| 68 | } else { |
| 69 | switch (tlsServer.ss.ss_family) { |
| 70 | case AF_INET: |
| 71 | new4.push_back(tlsServer); |
| 72 | break; |
| 73 | case AF_INET6: |
| 74 | new6.push_back(tlsServer); |
| 75 | break; |
| 76 | } |
| 77 | } |
| 78 | } |
| 79 | } |
| 80 | |
| 81 | auto& out = existing6; |
| 82 | out.splice(out.cend(), existing4); |
| 83 | out.splice(out.cend(), new6); |
| 84 | out.splice(out.cend(), new4); |
| 85 | return out; |
| 86 | } |
| 87 | |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 88 | DnsTlsTransport::Response DnsTlsDispatcher::query(const std::list<DnsTlsServer>& tlsServers, |
| 89 | res_state statp, const Slice query, |
| 90 | const Slice ans, int* resplen) { |
| 91 | const std::list<DnsTlsServer> orderedServers(getOrderedServerList(tlsServers, statp->_mark)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 92 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 93 | if (orderedServers.empty()) LOG(WARNING) << "Empty DnsTlsServer list"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 94 | |
| 95 | DnsTlsTransport::Response code = DnsTlsTransport::Response::internal_error; |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 96 | int serverCount = 0; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 97 | for (const auto& server : orderedServers) { |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 98 | DnsQueryEvent* dnsQueryEvent = |
| 99 | statp->event->mutable_dns_query_events()->add_dns_query_event(); |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 100 | Stopwatch queryStopwatch; |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 101 | code = this->query(server, statp->_mark, query, ans, resplen); |
| 102 | |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 103 | dnsQueryEvent->set_latency_micros(saturate_cast<int32_t>(queryStopwatch.timeTakenUs())); |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 104 | dnsQueryEvent->set_dns_server_index(serverCount++); |
| 105 | dnsQueryEvent->set_ip_version(ipFamilyToIPVersion(server.ss.ss_family)); |
| 106 | dnsQueryEvent->set_protocol(PROTO_DOT); |
| 107 | dnsQueryEvent->set_type(getQueryType(query.base(), query.size())); |
| 108 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 109 | switch (code) { |
| 110 | // These response codes are valid responses and not expected to |
| 111 | // change if another server is queried. |
| 112 | case DnsTlsTransport::Response::success: |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 113 | dnsQueryEvent->set_rcode( |
| 114 | static_cast<NsRcode>(reinterpret_cast<HEADER*>(ans.base())->rcode)); |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 115 | return code; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 116 | case DnsTlsTransport::Response::limit_error: |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 117 | dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 118 | return code; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 119 | // These response codes might differ when trying other servers, so |
| 120 | // keep iterating to see if we can get a different (better) result. |
| 121 | case DnsTlsTransport::Response::network_error: |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 122 | // Sync from res_tls_send in res_send.cpp |
| 123 | dnsQueryEvent->set_rcode(NS_R_TIMEOUT); |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 124 | continue; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 125 | case DnsTlsTransport::Response::internal_error: |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 126 | dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 127 | continue; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 128 | // No "default" statement. |
| 129 | } |
| 130 | } |
| 131 | |
| 132 | return code; |
| 133 | } |
| 134 | |
| 135 | DnsTlsTransport::Response DnsTlsDispatcher::query(const DnsTlsServer& server, unsigned mark, |
| 136 | const Slice query, |
| 137 | const Slice ans, int *resplen) { |
| 138 | const Key key = std::make_pair(mark, server); |
| 139 | Transport* xport; |
| 140 | { |
| 141 | std::lock_guard guard(sLock); |
| 142 | auto it = mStore.find(key); |
| 143 | if (it == mStore.end()) { |
| 144 | xport = new Transport(server, mark, mFactory.get()); |
| 145 | mStore[key].reset(xport); |
| 146 | } else { |
| 147 | xport = it->second.get(); |
| 148 | } |
| 149 | ++xport->useCount; |
| 150 | } |
| 151 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 152 | LOG(DEBUG) << "Sending query of length " << query.size(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 153 | auto res = xport->transport.query(query); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 154 | LOG(DEBUG) << "Awaiting response"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 155 | const auto& result = res.get(); |
| 156 | DnsTlsTransport::Response code = result.code; |
| 157 | if (code == DnsTlsTransport::Response::success) { |
| 158 | if (result.response.size() > ans.size()) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 159 | LOG(DEBUG) << "Response too large: " << result.response.size() << " > " << ans.size(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 160 | code = DnsTlsTransport::Response::limit_error; |
| 161 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 162 | LOG(DEBUG) << "Got response successfully"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 163 | *resplen = result.response.size(); |
| 164 | netdutils::copy(ans, netdutils::makeSlice(result.response)); |
| 165 | } |
| 166 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 167 | LOG(DEBUG) << "Query failed: " << (unsigned int)code; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 168 | } |
| 169 | |
| 170 | auto now = std::chrono::steady_clock::now(); |
| 171 | { |
| 172 | std::lock_guard guard(sLock); |
| 173 | --xport->useCount; |
| 174 | xport->lastUsed = now; |
| 175 | cleanup(now); |
| 176 | } |
| 177 | return code; |
| 178 | } |
| 179 | |
| 180 | // This timeout effectively controls how long to keep SSL session tickets. |
| 181 | static constexpr std::chrono::minutes IDLE_TIMEOUT(5); |
| 182 | void DnsTlsDispatcher::cleanup(std::chrono::time_point<std::chrono::steady_clock> now) { |
| 183 | // To avoid scanning mStore after every query, return early if a cleanup has been |
| 184 | // performed recently. |
| 185 | if (now - mLastCleanup < IDLE_TIMEOUT) { |
| 186 | return; |
| 187 | } |
| 188 | for (auto it = mStore.begin(); it != mStore.end();) { |
| 189 | auto& s = it->second; |
| 190 | if (s->useCount == 0 && now - s->lastUsed > IDLE_TIMEOUT) { |
| 191 | it = mStore.erase(it); |
| 192 | } else { |
| 193 | ++it; |
| 194 | } |
| 195 | } |
| 196 | mLastCleanup = now; |
| 197 | } |
| 198 | |
| 199 | } // end of namespace net |
| 200 | } // end of namespace android |