Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2017 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Ken Chen | 5471dca | 2019-04-15 15:25:35 +0800 | [diff] [blame] | 17 | #define LOG_TAG "resolv" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 18 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 19 | #include "DnsTlsDispatcher.h" |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 20 | |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 21 | #include <netdutils/Stopwatch.h> |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 22 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 23 | #include "DnsTlsSocketFactory.h" |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 24 | #include "resolv_cache.h" |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 25 | #include "resolv_private.h" |
| 26 | #include "stats.pb.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 27 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 28 | #include <android-base/logging.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 29 | |
| 30 | namespace android { |
| 31 | namespace net { |
| 32 | |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 33 | using android::netdutils::IPSockAddr; |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 34 | using android::netdutils::Stopwatch; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 35 | using netdutils::Slice; |
| 36 | |
| 37 | // static |
| 38 | std::mutex DnsTlsDispatcher::sLock; |
| 39 | |
| 40 | DnsTlsDispatcher::DnsTlsDispatcher() { |
| 41 | mFactory.reset(new DnsTlsSocketFactory()); |
| 42 | } |
| 43 | |
| 44 | std::list<DnsTlsServer> DnsTlsDispatcher::getOrderedServerList( |
| 45 | const std::list<DnsTlsServer> &tlsServers, unsigned mark) const { |
| 46 | // Our preferred DnsTlsServer order is: |
| 47 | // 1) reuse existing IPv6 connections |
| 48 | // 2) reuse existing IPv4 connections |
| 49 | // 3) establish new IPv6 connections |
| 50 | // 4) establish new IPv4 connections |
| 51 | std::list<DnsTlsServer> existing6; |
| 52 | std::list<DnsTlsServer> existing4; |
| 53 | std::list<DnsTlsServer> new6; |
| 54 | std::list<DnsTlsServer> new4; |
| 55 | |
| 56 | // Pull out any servers for which we might have existing connections and |
| 57 | // place them at the from the list of servers to try. |
| 58 | { |
| 59 | std::lock_guard guard(sLock); |
| 60 | |
| 61 | for (const auto& tlsServer : tlsServers) { |
| 62 | const Key key = std::make_pair(mark, tlsServer); |
| 63 | if (mStore.find(key) != mStore.end()) { |
| 64 | switch (tlsServer.ss.ss_family) { |
| 65 | case AF_INET: |
| 66 | existing4.push_back(tlsServer); |
| 67 | break; |
| 68 | case AF_INET6: |
| 69 | existing6.push_back(tlsServer); |
| 70 | break; |
| 71 | } |
| 72 | } else { |
| 73 | switch (tlsServer.ss.ss_family) { |
| 74 | case AF_INET: |
| 75 | new4.push_back(tlsServer); |
| 76 | break; |
| 77 | case AF_INET6: |
| 78 | new6.push_back(tlsServer); |
| 79 | break; |
| 80 | } |
| 81 | } |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | auto& out = existing6; |
| 86 | out.splice(out.cend(), existing4); |
| 87 | out.splice(out.cend(), new6); |
| 88 | out.splice(out.cend(), new4); |
| 89 | return out; |
| 90 | } |
| 91 | |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 92 | DnsTlsTransport::Response DnsTlsDispatcher::query(const std::list<DnsTlsServer>& tlsServers, |
| 93 | res_state statp, const Slice query, |
| 94 | const Slice ans, int* resplen) { |
| 95 | const std::list<DnsTlsServer> orderedServers(getOrderedServerList(tlsServers, statp->_mark)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 96 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 97 | if (orderedServers.empty()) LOG(WARNING) << "Empty DnsTlsServer list"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 98 | |
| 99 | DnsTlsTransport::Response code = DnsTlsTransport::Response::internal_error; |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 100 | int serverCount = 0; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 101 | for (const auto& server : orderedServers) { |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 102 | DnsQueryEvent* dnsQueryEvent = |
| 103 | statp->event->mutable_dns_query_events()->add_dns_query_event(); |
Mike Yu | cb2bb7c | 2019-11-22 20:42:13 +0800 | [diff] [blame] | 104 | |
| 105 | bool connectTriggered = false; |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 106 | Stopwatch queryStopwatch; |
Mike Yu | cb2bb7c | 2019-11-22 20:42:13 +0800 | [diff] [blame] | 107 | code = this->query(server, statp->_mark, query, ans, resplen, &connectTriggered); |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 108 | |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 109 | dnsQueryEvent->set_latency_micros(saturate_cast<int32_t>(queryStopwatch.timeTakenUs())); |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 110 | dnsQueryEvent->set_dns_server_index(serverCount++); |
| 111 | dnsQueryEvent->set_ip_version(ipFamilyToIPVersion(server.ss.ss_family)); |
| 112 | dnsQueryEvent->set_protocol(PROTO_DOT); |
| 113 | dnsQueryEvent->set_type(getQueryType(query.base(), query.size())); |
Mike Yu | cb2bb7c | 2019-11-22 20:42:13 +0800 | [diff] [blame] | 114 | dnsQueryEvent->set_connected(connectTriggered); |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 115 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 116 | switch (code) { |
| 117 | // These response codes are valid responses and not expected to |
| 118 | // change if another server is queried. |
| 119 | case DnsTlsTransport::Response::success: |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 120 | dnsQueryEvent->set_rcode( |
| 121 | static_cast<NsRcode>(reinterpret_cast<HEADER*>(ans.base())->rcode)); |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 122 | resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent); |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 123 | return code; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 124 | case DnsTlsTransport::Response::limit_error: |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 125 | dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR); |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 126 | resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 127 | return code; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 128 | // These response codes might differ when trying other servers, so |
| 129 | // keep iterating to see if we can get a different (better) result. |
| 130 | case DnsTlsTransport::Response::network_error: |
lifr | 9498178 | 2019-05-17 21:15:19 +0800 | [diff] [blame] | 131 | // Sync from res_tls_send in res_send.cpp |
| 132 | dnsQueryEvent->set_rcode(NS_R_TIMEOUT); |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 133 | resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent); |
| 134 | break; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 135 | case DnsTlsTransport::Response::internal_error: |
lifr | d4d9fbb | 2019-07-31 20:18:35 +0800 | [diff] [blame] | 136 | dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR); |
Mike Yu | e655b1d | 2019-08-28 17:49:59 +0800 | [diff] [blame] | 137 | resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent); |
| 138 | break; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 139 | // No "default" statement. |
| 140 | } |
| 141 | } |
| 142 | |
| 143 | return code; |
| 144 | } |
| 145 | |
| 146 | DnsTlsTransport::Response DnsTlsDispatcher::query(const DnsTlsServer& server, unsigned mark, |
Mike Yu | cb2bb7c | 2019-11-22 20:42:13 +0800 | [diff] [blame] | 147 | const Slice query, const Slice ans, int* resplen, |
| 148 | bool* connectTriggered) { |
Mike Yu | d5389f1 | 2020-05-21 14:43:20 +0000 | [diff] [blame] | 149 | // TODO: This can cause the resolver to create multiple connections to the same DoT server |
| 150 | // merely due to different mark, such as the bit explicitlySelected unset. |
| 151 | // See if we can save them and just create one connection for one DoT server. |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 152 | const Key key = std::make_pair(mark, server); |
| 153 | Transport* xport; |
| 154 | { |
| 155 | std::lock_guard guard(sLock); |
| 156 | auto it = mStore.find(key); |
| 157 | if (it == mStore.end()) { |
| 158 | xport = new Transport(server, mark, mFactory.get()); |
| 159 | mStore[key].reset(xport); |
| 160 | } else { |
| 161 | xport = it->second.get(); |
| 162 | } |
| 163 | ++xport->useCount; |
| 164 | } |
| 165 | |
Mike Yu | 3c07ec6 | 2020-07-01 12:02:14 +0800 | [diff] [blame] | 166 | // Don't call this function and hold sLock at the same time because of the following reason: |
| 167 | // TLS handshake requires a lock which is also needed by this function, if the handshake gets |
| 168 | // stuck, this function also gets blocked. |
| 169 | const int connectCounter = xport->transport.getConnectCounter(); |
| 170 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 171 | LOG(DEBUG) << "Sending query of length " << query.size(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 172 | auto res = xport->transport.query(query); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 173 | LOG(DEBUG) << "Awaiting response"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 174 | const auto& result = res.get(); |
Mike Yu | 3c07ec6 | 2020-07-01 12:02:14 +0800 | [diff] [blame] | 175 | *connectTriggered = (xport->transport.getConnectCounter() > connectCounter); |
| 176 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 177 | DnsTlsTransport::Response code = result.code; |
| 178 | if (code == DnsTlsTransport::Response::success) { |
| 179 | if (result.response.size() > ans.size()) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 180 | LOG(DEBUG) << "Response too large: " << result.response.size() << " > " << ans.size(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 181 | code = DnsTlsTransport::Response::limit_error; |
| 182 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 183 | LOG(DEBUG) << "Got response successfully"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 184 | *resplen = result.response.size(); |
| 185 | netdutils::copy(ans, netdutils::makeSlice(result.response)); |
| 186 | } |
| 187 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 188 | LOG(DEBUG) << "Query failed: " << (unsigned int)code; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 189 | } |
| 190 | |
| 191 | auto now = std::chrono::steady_clock::now(); |
| 192 | { |
| 193 | std::lock_guard guard(sLock); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 194 | --xport->useCount; |
| 195 | xport->lastUsed = now; |
| 196 | cleanup(now); |
| 197 | } |
| 198 | return code; |
| 199 | } |
| 200 | |
| 201 | // This timeout effectively controls how long to keep SSL session tickets. |
| 202 | static constexpr std::chrono::minutes IDLE_TIMEOUT(5); |
| 203 | void DnsTlsDispatcher::cleanup(std::chrono::time_point<std::chrono::steady_clock> now) { |
| 204 | // To avoid scanning mStore after every query, return early if a cleanup has been |
| 205 | // performed recently. |
| 206 | if (now - mLastCleanup < IDLE_TIMEOUT) { |
| 207 | return; |
| 208 | } |
| 209 | for (auto it = mStore.begin(); it != mStore.end();) { |
| 210 | auto& s = it->second; |
| 211 | if (s->useCount == 0 && now - s->lastUsed > IDLE_TIMEOUT) { |
| 212 | it = mStore.erase(it); |
| 213 | } else { |
| 214 | ++it; |
| 215 | } |
| 216 | } |
| 217 | mLastCleanup = now; |
| 218 | } |
| 219 | |
| 220 | } // end of namespace net |
| 221 | } // end of namespace android |