Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Ken Chen | 5471dca | 2019-04-15 15:25:35 +0800 | [diff] [blame] | 17 | #define LOG_TAG "resolv" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 18 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 19 | #include "DnsTlsTransport.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 20 | |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 21 | #include <Fwmark.h> |
| 22 | #include <android-base/logging.h> |
| 23 | #include <android-base/stringprintf.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 24 | #include <arpa/inet.h> |
| 25 | #include <arpa/nameser.h> |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 26 | #include <netdutils/ThreadUtil.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 27 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 28 | #include "DnsTlsSocketFactory.h" |
| 29 | #include "IDnsTlsSocketFactory.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 30 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 31 | namespace android { |
| 32 | namespace net { |
| 33 | |
| 34 | std::future<DnsTlsTransport::Result> DnsTlsTransport::query(const netdutils::Slice query) { |
| 35 | std::lock_guard guard(mLock); |
| 36 | |
| 37 | auto record = mQueries.recordQuery(query); |
| 38 | if (!record) { |
| 39 | return std::async(std::launch::deferred, []{ |
| 40 | return (Result) { .code = Response::internal_error }; |
| 41 | }); |
| 42 | } |
| 43 | |
| 44 | if (!mSocket) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 45 | LOG(DEBUG) << "No socket for query. Opening socket and sending."; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 46 | doConnect(); |
| 47 | } else { |
| 48 | sendQuery(record->query); |
| 49 | } |
| 50 | |
| 51 | return std::move(record->result); |
| 52 | } |
| 53 | |
| 54 | bool DnsTlsTransport::sendQuery(const DnsTlsQueryMap::Query q) { |
| 55 | // Strip off the ID number and send the new ID instead. |
| 56 | bool sent = mSocket->query(q.newId, netdutils::drop(q.query, 2)); |
| 57 | if (sent) { |
| 58 | mQueries.markTried(q.newId); |
| 59 | } |
| 60 | return sent; |
| 61 | } |
| 62 | |
| 63 | void DnsTlsTransport::doConnect() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 64 | LOG(DEBUG) << "Constructing new socket"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 65 | mSocket = mFactory->createDnsTlsSocket(mServer, mMark, this, &mCache); |
| 66 | |
| 67 | if (mSocket) { |
| 68 | auto queries = mQueries.getAll(); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 69 | LOG(DEBUG) << "Initialization succeeded. Reissuing " << queries.size() << " queries."; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 70 | for(auto& q : queries) { |
| 71 | if (!sendQuery(q)) { |
| 72 | break; |
| 73 | } |
| 74 | } |
| 75 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 76 | LOG(DEBUG) << "Initialization failed."; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 77 | mSocket.reset(); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 78 | LOG(DEBUG) << "Failing all pending queries."; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 79 | mQueries.clear(); |
| 80 | } |
| 81 | } |
| 82 | |
| 83 | void DnsTlsTransport::onResponse(std::vector<uint8_t> response) { |
| 84 | mQueries.onResponse(std::move(response)); |
| 85 | } |
| 86 | |
| 87 | void DnsTlsTransport::onClosed() { |
| 88 | std::lock_guard guard(mLock); |
| 89 | if (mClosing) { |
| 90 | return; |
| 91 | } |
| 92 | // Move remaining operations to a new thread. |
| 93 | // This is necessary because |
| 94 | // 1. onClosed is currently running on a thread that blocks mSocket's destructor |
| 95 | // 2. doReconnect will call that destructor |
| 96 | if (mReconnectThread) { |
| 97 | // Complete cleanup of a previous reconnect thread, if present. |
| 98 | mReconnectThread->join(); |
| 99 | // Joining a thread that is trying to acquire mLock, while holding mLock, |
| 100 | // looks like it risks a deadlock. However, a deadlock will not occur because |
| 101 | // once onClosed is called, it cannot be called again until after doReconnect |
| 102 | // acquires mLock. |
| 103 | } |
| 104 | mReconnectThread.reset(new std::thread(&DnsTlsTransport::doReconnect, this)); |
| 105 | } |
| 106 | |
| 107 | void DnsTlsTransport::doReconnect() { |
| 108 | std::lock_guard guard(mLock); |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 109 | Fwmark mark; |
| 110 | mark.intValue = mMark; |
| 111 | netdutils::setThreadName(android::base::StringPrintf("TlsReconn_%u", mark.netId).c_str()); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 112 | if (mClosing) { |
| 113 | return; |
| 114 | } |
| 115 | mQueries.cleanup(); |
| 116 | if (!mQueries.empty()) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 117 | LOG(DEBUG) << "Fast reconnect to retry remaining queries"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 118 | doConnect(); |
| 119 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 120 | LOG(DEBUG) << "No pending queries. Going idle."; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 121 | mSocket.reset(); |
| 122 | } |
| 123 | } |
| 124 | |
| 125 | DnsTlsTransport::~DnsTlsTransport() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 126 | LOG(DEBUG) << "Destructor"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 127 | { |
| 128 | std::lock_guard guard(mLock); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 129 | LOG(DEBUG) << "Locked destruction procedure"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 130 | mQueries.clear(); |
| 131 | mClosing = true; |
| 132 | } |
| 133 | // It's possible that a reconnect thread was spawned and waiting for mLock. |
| 134 | // It's safe for that thread to run now because mClosing is true (and mQueries is empty), |
| 135 | // but we need to wait for it to finish before allowing destruction to proceed. |
| 136 | if (mReconnectThread) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 137 | LOG(DEBUG) << "Waiting for reconnect thread to terminate"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 138 | mReconnectThread->join(); |
| 139 | mReconnectThread.reset(); |
| 140 | } |
| 141 | // Ensure that the socket is destroyed, and can clean up its callback threads, |
| 142 | // before any of this object's fields become invalid. |
| 143 | mSocket.reset(); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 144 | LOG(DEBUG) << "Destructor completed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 145 | } |
| 146 | |
| 147 | // static |
| 148 | // TODO: Use this function to preheat the session cache. |
| 149 | // That may require moving it to DnsTlsDispatcher. |
Mike Yu | f48c3c7 | 2018-11-02 13:30:04 +0800 | [diff] [blame] | 150 | bool DnsTlsTransport::validate(const DnsTlsServer& server, unsigned netid, uint32_t mark) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 151 | LOG(DEBUG) << "Beginning validation on " << netid; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 152 | // Generate "<random>-dnsotls-ds.metric.gstatic.com", which we will lookup through |ss| in |
| 153 | // order to prove that it is actually a working DNS over TLS server. |
| 154 | static const char kDnsSafeChars[] = |
| 155 | "abcdefhijklmnopqrstuvwxyz" |
| 156 | "ABCDEFHIJKLMNOPQRSTUVWXYZ" |
| 157 | "0123456789"; |
| 158 | const auto c = [](uint8_t rnd) -> uint8_t { |
| 159 | return kDnsSafeChars[(rnd % std::size(kDnsSafeChars))]; |
| 160 | }; |
| 161 | uint8_t rnd[8]; |
| 162 | arc4random_buf(rnd, std::size(rnd)); |
| 163 | // We could try to use res_mkquery() here, but it's basically the same. |
| 164 | uint8_t query[] = { |
| 165 | rnd[6], rnd[7], // [0-1] query ID |
| 166 | 1, 0, // [2-3] flags; query[2] = 1 for recursion desired (RD). |
| 167 | 0, 1, // [4-5] QDCOUNT (number of queries) |
| 168 | 0, 0, // [6-7] ANCOUNT (number of answers) |
| 169 | 0, 0, // [8-9] NSCOUNT (number of name server records) |
| 170 | 0, 0, // [10-11] ARCOUNT (number of additional records) |
| 171 | 17, c(rnd[0]), c(rnd[1]), c(rnd[2]), c(rnd[3]), c(rnd[4]), c(rnd[5]), |
| 172 | '-', 'd', 'n', 's', 'o', 't', 'l', 's', '-', 'd', 's', |
| 173 | 6, 'm', 'e', 't', 'r', 'i', 'c', |
| 174 | 7, 'g', 's', 't', 'a', 't', 'i', 'c', |
| 175 | 3, 'c', 'o', 'm', |
| 176 | 0, // null terminator of FQDN (root TLD) |
| 177 | 0, ns_t_aaaa, // QTYPE |
| 178 | 0, ns_c_in // QCLASS |
| 179 | }; |
| 180 | const int qlen = std::size(query); |
| 181 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 182 | int replylen = 0; |
| 183 | DnsTlsSocketFactory factory; |
| 184 | DnsTlsTransport transport(server, mark, &factory); |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 185 | auto r = transport.query(netdutils::Slice(query, qlen)).get(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 186 | if (r.code != Response::success) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 187 | LOG(DEBUG) << "query failed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 188 | return false; |
| 189 | } |
| 190 | |
| 191 | const std::vector<uint8_t>& recvbuf = r.response; |
| 192 | if (recvbuf.size() < NS_HFIXEDSZ) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 193 | LOG(WARNING) << "short response: " << replylen; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 194 | return false; |
| 195 | } |
| 196 | |
| 197 | const int qdcount = (recvbuf[4] << 8) | recvbuf[5]; |
| 198 | if (qdcount != 1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 199 | LOG(WARNING) << "reply query count != 1: " << qdcount; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 200 | return false; |
| 201 | } |
| 202 | |
| 203 | const int ancount = (recvbuf[6] << 8) | recvbuf[7]; |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 204 | LOG(DEBUG) << netid << " answer count: " << ancount; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 205 | |
| 206 | // TODO: Further validate the response contents (check for valid AAAA record, ...). |
| 207 | // Note that currently, integration tests rely on this function accepting a |
| 208 | // response with zero records. |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 209 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 210 | return true; |
| 211 | } |
| 212 | |
| 213 | } // end of namespace net |
| 214 | } // end of namespace android |