Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Mike Yu | 3e82906 | 2019-08-07 14:01:14 +0800 | [diff] [blame] | 17 | #pragma once |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 18 | |
| 19 | #include <list> |
| 20 | #include <map> |
Mike Yu | 303b0df | 2018-12-24 17:05:02 +0800 | [diff] [blame] | 21 | #include <mutex> |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 22 | #include <vector> |
| 23 | |
Mike Yu | 82ae84b | 2020-12-02 21:04:40 +0800 | [diff] [blame] | 24 | #include <android-base/result.h> |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 25 | #include <android-base/thread_annotations.h> |
Mike Yu | b0d27fa | 2021-05-13 16:44:18 +0800 | [diff] [blame] | 26 | #include <netdutils/BackoffSequence.h> |
Mike Yu | 3d5130d | 2020-12-21 17:57:18 +0800 | [diff] [blame] | 27 | #include <netdutils/DumpWriter.h> |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 28 | #include <netdutils/InternetAddresses.h> |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 29 | |
| 30 | #include "DnsTlsServer.h" |
Mike Yu | 3d5130d | 2020-12-21 17:57:18 +0800 | [diff] [blame] | 31 | #include "LockedQueue.h" |
Mike Yu | a6853e8 | 2020-12-11 19:47:06 +0800 | [diff] [blame] | 32 | #include "PrivateDnsValidationObserver.h" |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 33 | |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 34 | namespace android { |
| 35 | namespace net { |
| 36 | |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 37 | // TODO: decouple the dependency of DnsTlsServer. |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 38 | struct PrivateDnsStatus { |
| 39 | PrivateDnsMode mode; |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 40 | |
| 41 | // TODO: change the type to std::vector<DnsTlsServer>. |
Mike Yu | 3e82906 | 2019-08-07 14:01:14 +0800 | [diff] [blame] | 42 | std::map<DnsTlsServer, Validation, AddressComparator> serversMap; |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 43 | |
Mike Yu | 3e82906 | 2019-08-07 14:01:14 +0800 | [diff] [blame] | 44 | std::list<DnsTlsServer> validatedServers() const { |
| 45 | std::list<DnsTlsServer> servers; |
| 46 | |
| 47 | for (const auto& pair : serversMap) { |
| 48 | if (pair.second == Validation::success) { |
| 49 | servers.push_back(pair.first); |
| 50 | } |
| 51 | } |
| 52 | return servers; |
| 53 | } |
Bernie Innocenti | 23c6e2a | 2019-05-16 15:18:35 +0900 | [diff] [blame] | 54 | }; |
| 55 | |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 56 | class PrivateDnsConfiguration { |
| 57 | public: |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 58 | struct ServerIdentity { |
Mike Yu | 453b5e4 | 2021-02-19 20:03:07 +0800 | [diff] [blame] | 59 | const netdutils::IPSockAddr sockaddr; |
| 60 | const std::string provider; |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 61 | |
Mike Yu | cf56d23 | 2021-04-29 19:37:25 +0800 | [diff] [blame] | 62 | explicit ServerIdentity(const IPrivateDnsServer& server) |
| 63 | : sockaddr(server.addr()), provider(server.provider()) {} |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 64 | |
| 65 | bool operator<(const ServerIdentity& other) const { |
Mike Yu | 453b5e4 | 2021-02-19 20:03:07 +0800 | [diff] [blame] | 66 | return std::tie(sockaddr, provider) < std::tie(other.sockaddr, other.provider); |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 67 | } |
| 68 | bool operator==(const ServerIdentity& other) const { |
Mike Yu | 453b5e4 | 2021-02-19 20:03:07 +0800 | [diff] [blame] | 69 | return std::tie(sockaddr, provider) == std::tie(other.sockaddr, other.provider); |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 70 | } |
| 71 | }; |
| 72 | |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 73 | // The only instance of PrivateDnsConfiguration. |
| 74 | static PrivateDnsConfiguration& getInstance() { |
| 75 | static PrivateDnsConfiguration instance; |
| 76 | return instance; |
| 77 | } |
| 78 | |
| 79 | int set(int32_t netId, uint32_t mark, const std::vector<std::string>& servers, |
| 80 | const std::string& name, const std::string& caCert) EXCLUDES(mPrivateDnsLock); |
| 81 | |
| 82 | PrivateDnsStatus getStatus(unsigned netId) const EXCLUDES(mPrivateDnsLock); |
| 83 | |
| 84 | void clear(unsigned netId) EXCLUDES(mPrivateDnsLock); |
| 85 | |
| 86 | // Request the server to be revalidated on a connection tagged with |mark|. |
| 87 | // Returns a Result to indicate if the request is accepted. |
| 88 | base::Result<void> requestValidation(unsigned netId, const ServerIdentity& identity, |
| 89 | uint32_t mark) EXCLUDES(mPrivateDnsLock); |
| 90 | |
Mike Yu | 5448c9e | 2020-12-14 16:45:16 +0800 | [diff] [blame] | 91 | void setObserver(PrivateDnsValidationObserver* observer); |
| 92 | |
Mike Yu | 3d5130d | 2020-12-21 17:57:18 +0800 | [diff] [blame] | 93 | void dump(netdutils::DumpWriter& dw) const; |
| 94 | |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 95 | private: |
Mike Yu | cf56d23 | 2021-04-29 19:37:25 +0800 | [diff] [blame] | 96 | typedef std::map<ServerIdentity, std::unique_ptr<IPrivateDnsServer>> PrivateDnsTracker; |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 97 | |
Mike Yu | 6024824 | 2020-07-29 16:45:26 +0800 | [diff] [blame] | 98 | PrivateDnsConfiguration() = default; |
| 99 | |
Mike Yu | 82ae84b | 2020-12-02 21:04:40 +0800 | [diff] [blame] | 100 | // Launchs a thread to run the validation for |server| on the network |netId|. |
| 101 | // |isRevalidation| is true if this call is due to a revalidation request. |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 102 | void startValidation(const ServerIdentity& identity, unsigned netId, bool isRevalidation) |
Mike Yu | 82ae84b | 2020-12-02 21:04:40 +0800 | [diff] [blame] | 103 | REQUIRES(mPrivateDnsLock); |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 104 | |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 105 | bool recordPrivateDnsValidation(const ServerIdentity& identity, unsigned netId, bool success, |
Mike Yu | 82ae84b | 2020-12-02 21:04:40 +0800 | [diff] [blame] | 106 | bool isRevalidation) EXCLUDES(mPrivateDnsLock); |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 107 | |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 108 | void sendPrivateDnsValidationEvent(const ServerIdentity& identity, unsigned netId, bool success) |
paulhu | 0664f69 | 2020-12-14 16:48:26 +0800 | [diff] [blame] | 109 | REQUIRES(mPrivateDnsLock); |
| 110 | |
Mike Yu | f7717f5 | 2020-11-24 17:31:12 +0800 | [diff] [blame] | 111 | // Decide if a validation for |server| is needed. Note that servers that have failed |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 112 | // multiple validation attempts but for which there is still a validating |
| 113 | // thread running are marked as being Validation::in_process. |
Mike Yu | cf56d23 | 2021-04-29 19:37:25 +0800 | [diff] [blame] | 114 | bool needsValidation(const IPrivateDnsServer& server) const REQUIRES(mPrivateDnsLock); |
Mike Yu | 3334a5e | 2020-11-19 13:33:17 +0800 | [diff] [blame] | 115 | |
Mike Yu | fa985f7 | 2020-11-23 20:24:21 +0800 | [diff] [blame] | 116 | void updateServerState(const ServerIdentity& identity, Validation state, uint32_t netId) |
Mike Yu | 3334a5e | 2020-11-19 13:33:17 +0800 | [diff] [blame] | 117 | REQUIRES(mPrivateDnsLock); |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 118 | |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 119 | // For testing. |
Mike Yu | cf56d23 | 2021-04-29 19:37:25 +0800 | [diff] [blame] | 120 | base::Result<IPrivateDnsServer*> getPrivateDns(const ServerIdentity& identity, unsigned netId) |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 121 | EXCLUDES(mPrivateDnsLock); |
| 122 | |
Mike Yu | cf56d23 | 2021-04-29 19:37:25 +0800 | [diff] [blame] | 123 | base::Result<IPrivateDnsServer*> getPrivateDnsLocked(const ServerIdentity& identity, |
| 124 | unsigned netId) REQUIRES(mPrivateDnsLock); |
Mike Yu | ad96ef8 | 2021-02-20 18:35:14 +0800 | [diff] [blame] | 125 | |
Mike Yu | 82ae84b | 2020-12-02 21:04:40 +0800 | [diff] [blame] | 126 | mutable std::mutex mPrivateDnsLock; |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 127 | std::map<unsigned, PrivateDnsMode> mPrivateDnsModes GUARDED_BY(mPrivateDnsLock); |
Mike Yu | f7717f5 | 2020-11-24 17:31:12 +0800 | [diff] [blame] | 128 | |
| 129 | // Contains all servers for a network, along with their current validation status. |
| 130 | // In case a server is removed due to a configuration change, it remains in this map, |
| 131 | // but is marked inactive. |
| 132 | // Any pending validation threads will continue running because we have no way to cancel them. |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 133 | std::map<unsigned, PrivateDnsTracker> mPrivateDnsTransports GUARDED_BY(mPrivateDnsLock); |
Mike Yu | 0ee1dc9 | 2020-11-09 14:56:54 +0800 | [diff] [blame] | 134 | |
Mike Yu | 453b5e4 | 2021-02-19 20:03:07 +0800 | [diff] [blame] | 135 | void notifyValidationStateUpdate(const netdutils::IPSockAddr& sockaddr, Validation validation, |
Mike Yu | 7477054 | 2020-12-15 14:25:21 +0800 | [diff] [blame] | 136 | uint32_t netId) const REQUIRES(mPrivateDnsLock); |
Mike Yu | 0ee1dc9 | 2020-11-09 14:56:54 +0800 | [diff] [blame] | 137 | |
Mike Yu | a6853e8 | 2020-12-11 19:47:06 +0800 | [diff] [blame] | 138 | // TODO: fix the reentrancy problem. |
| 139 | PrivateDnsValidationObserver* mObserver GUARDED_BY(mPrivateDnsLock); |
Mike Yu | 0ee1dc9 | 2020-11-09 14:56:54 +0800 | [diff] [blame] | 140 | |
| 141 | friend class PrivateDnsConfigurationTest; |
Mike Yu | 3d5130d | 2020-12-21 17:57:18 +0800 | [diff] [blame] | 142 | |
Mike Yu | b0d27fa | 2021-05-13 16:44:18 +0800 | [diff] [blame] | 143 | // It's not const because PrivateDnsConfigurationTest needs to override it. |
| 144 | // TODO: make it const by dependency injection. |
| 145 | netdutils::BackoffSequence<>::Builder mBackoffBuilder = |
| 146 | netdutils::BackoffSequence<>::Builder() |
| 147 | .withInitialRetransmissionTime(std::chrono::seconds(60)) |
| 148 | .withMaximumRetransmissionTime(std::chrono::seconds(3600)); |
| 149 | |
Mike Yu | 3d5130d | 2020-12-21 17:57:18 +0800 | [diff] [blame] | 150 | struct RecordEntry { |
| 151 | RecordEntry(uint32_t netId, const ServerIdentity& identity, Validation state) |
| 152 | : netId(netId), serverIdentity(identity), state(state) {} |
| 153 | |
| 154 | const uint32_t netId; |
| 155 | const ServerIdentity serverIdentity; |
| 156 | const Validation state; |
| 157 | const std::chrono::system_clock::time_point timestamp = std::chrono::system_clock::now(); |
| 158 | }; |
| 159 | |
| 160 | LockedRingBuffer<RecordEntry> mPrivateDnsLog{100}; |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 161 | }; |
| 162 | |
Mike Yu | b601ff7 | 2018-11-01 20:07:00 +0800 | [diff] [blame] | 163 | } // namespace net |
| 164 | } // namespace android |