blob: a29912051ba56de3adc4c8fe906e03bf79bc84bc [file] [log] [blame]
Mattias Falk89c1e972011-04-29 14:48:51 +02001/*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "ResolverController"
18#define DBG 0
19
Pierre Imaibeedec32016-04-13 06:44:51 +090020#include <algorithm>
21#include <cstdlib>
Ben Schwartze7601812017-04-28 16:38:29 -040022#include <map>
23#include <mutex>
24#include <set>
Pierre Imaibeedec32016-04-13 06:44:51 +090025#include <string>
Ben Schwartze7601812017-04-28 16:38:29 -040026#include <thread>
27#include <utility>
Pierre Imaibeedec32016-04-13 06:44:51 +090028#include <vector>
Logan Chien3f461482018-04-23 14:31:32 +080029#include <log/log.h>
Elliott Hughes970274a2012-09-11 18:56:36 -070030#include <net/if.h>
Pierre Imaibeedec32016-04-13 06:44:51 +090031#include <sys/socket.h>
32#include <netdb.h>
David 'Digit' Turner4da10dd2012-01-13 13:43:43 +010033
Ben Schwartze7601812017-04-28 16:38:29 -040034#include <arpa/inet.h>
Pierre Imaibeedec32016-04-13 06:44:51 +090035
Pierre Imai3a272072016-04-19 16:17:07 +090036#include <android-base/strings.h>
Ben Schwartzcbdd64a2017-08-23 18:21:46 -040037#include <android-base/thread_annotations.h>
Pierre Imaibeedec32016-04-13 06:44:51 +090038#include <android/net/INetd.h>
dalyk6250dbd2017-12-28 16:20:04 -050039#include <android/net/metrics/INetdEventListener.h>
Mattias Falk89c1e972011-04-29 14:48:51 +020040
Pierre Imai3a272072016-04-19 16:17:07 +090041#include "DumpWriter.h"
dalyk6250dbd2017-12-28 16:20:04 -050042#include "EventReporter.h"
Mike Yu2cc198a2018-11-02 13:30:04 +080043#include "Fwmark.h"
Ben Schwartze7601812017-04-28 16:38:29 -040044#include "NetdConstants.h"
Mike Yu2cc198a2018-11-02 13:30:04 +080045#include "Permission.h"
Mattias Falk89c1e972011-04-29 14:48:51 +020046#include "ResolverController.h"
Pierre Imaibeedec32016-04-13 06:44:51 +090047#include "ResolverStats.h"
Mike Yu5ae61542018-10-19 22:11:43 +080048#include "netd_resolv/DnsTlsServer.h"
49#include "netd_resolv/DnsTlsTransport.h"
Bernie Innocenti189eb502018-10-01 23:10:18 +090050#include "netd_resolv/params.h"
51#include "netd_resolv/resolv.h"
52#include "netd_resolv/stats.h"
Erik Klined739c212018-04-24 23:09:39 +090053#include "netdutils/BackoffSequence.h"
Mattias Falk89c1e972011-04-29 14:48:51 +020054
Lorenzo Colitti7035f222017-02-13 18:29:00 +090055namespace android {
Lorenzo Colitti7035f222017-02-13 18:29:00 +090056
Erik Klined739c212018-04-24 23:09:39 +090057using netdutils::BackoffSequence;
58
59namespace net {
Ben Schwartze7601812017-04-28 16:38:29 -040060namespace {
61
Ben Schwartz4204ecf2017-10-02 12:35:48 -040062std::string addrToString(const sockaddr_storage* addr) {
63 char out[INET6_ADDRSTRLEN] = {0};
64 getnameinfo((const sockaddr*)addr, sizeof(sockaddr_storage), out,
Yi Kongbdfd57e2018-07-25 13:26:10 -070065 INET6_ADDRSTRLEN, nullptr, 0, NI_NUMERICHOST);
Ben Schwartz4204ecf2017-10-02 12:35:48 -040066 return std::string(out);
67}
Ben Schwartze7601812017-04-28 16:38:29 -040068
Ben Schwartz008f74c2017-12-07 17:27:20 -050069bool parseServer(const char* server, sockaddr_storage* parsed) {
70 addrinfo hints = {
71 .ai_family = AF_UNSPEC,
72 .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV
73 };
74 addrinfo* res;
75
76 int err = getaddrinfo(server, "853", &hints, &res);
77 if (err != 0) {
78 ALOGW("Failed to parse server address (%s): %s", server, gai_strerror(err));
79 return false;
Ben Schwartze7601812017-04-28 16:38:29 -040080 }
Ben Schwartz008f74c2017-12-07 17:27:20 -050081
82 memcpy(parsed, res->ai_addr, res->ai_addrlen);
83 freeaddrinfo(res);
84 return true;
Ben Schwartze7601812017-04-28 16:38:29 -040085}
86
Erik Kline1564d482018-03-07 17:09:35 +090087const char* getPrivateDnsModeString(PrivateDnsMode mode) {
88 switch (mode) {
89 case PrivateDnsMode::OFF: return "OFF";
90 case PrivateDnsMode::OPPORTUNISTIC: return "OPPORTUNISTIC";
91 case PrivateDnsMode::STRICT: return "STRICT";
92 }
93}
94
Erik Klinefb757532018-01-18 20:12:06 +090095constexpr const char* validationStatusToString(ResolverController::Validation value) {
96 switch (value) {
97 case ResolverController::Validation::in_process: return "in_process";
98 case ResolverController::Validation::success: return "success";
99 case ResolverController::Validation::fail: return "fail";
100 case ResolverController::Validation::unknown_server: return "unknown_server";
101 case ResolverController::Validation::unknown_netid: return "unknown_netid";
102 default: return "unknown_status";
103 }
104}
105
Erik Klined739c212018-04-24 23:09:39 +0900106
107class PrivateDnsConfiguration {
108 public:
109 typedef ResolverController::PrivateDnsStatus PrivateDnsStatus;
110 typedef ResolverController::Validation Validation;
111 typedef std::map<DnsTlsServer, Validation, AddressComparator> PrivateDnsTracker;
112
Mike Yu2cc198a2018-11-02 13:30:04 +0800113 int set(uint32_t netId, uint32_t mark, const std::vector<std::string>& servers,
114 const std::string& name, const std::set<std::vector<uint8_t>>& fingerprints) {
Erik Klined739c212018-04-24 23:09:39 +0900115 if (DBG) {
Mike Yu2cc198a2018-11-02 13:30:04 +0800116 ALOGD("PrivateDnsConfiguration::set(%u, 0x%x, %zu, %s, %zu)", netId, mark,
117 servers.size(), name.c_str(), fingerprints.size());
Erik Klined739c212018-04-24 23:09:39 +0900118 }
119
120 const bool explicitlyConfigured = !name.empty() || !fingerprints.empty();
121
122 // Parse the list of servers that has been passed in
123 std::set<DnsTlsServer> tlsServers;
124 for (size_t i = 0; i < servers.size(); ++i) {
125 sockaddr_storage parsed;
126 if (!parseServer(servers[i].c_str(), &parsed)) {
127 return -EINVAL;
128 }
129 DnsTlsServer server(parsed);
130 server.name = name;
131 server.fingerprints = fingerprints;
132 tlsServers.insert(server);
133 }
134
Bernie Innocentiabf8a342018-08-10 15:17:16 +0900135 std::lock_guard guard(mPrivateDnsLock);
Erik Klined739c212018-04-24 23:09:39 +0900136 if (explicitlyConfigured) {
137 mPrivateDnsModes[netId] = PrivateDnsMode::STRICT;
138 } else if (!tlsServers.empty()) {
139 mPrivateDnsModes[netId] = PrivateDnsMode::OPPORTUNISTIC;
140 } else {
141 mPrivateDnsModes[netId] = PrivateDnsMode::OFF;
142 mPrivateDnsTransports.erase(netId);
143 return 0;
144 }
145
146 // Create the tracker if it was not present
147 auto netPair = mPrivateDnsTransports.find(netId);
148 if (netPair == mPrivateDnsTransports.end()) {
149 // No TLS tracker yet for this netId.
150 bool added;
151 std::tie(netPair, added) = mPrivateDnsTransports.emplace(netId, PrivateDnsTracker());
152 if (!added) {
153 ALOGE("Memory error while recording private DNS for netId %d", netId);
154 return -ENOMEM;
155 }
156 }
157 auto& tracker = netPair->second;
158
159 // Remove any servers from the tracker that are not in |servers| exactly.
160 for (auto it = tracker.begin(); it != tracker.end();) {
161 if (tlsServers.count(it->first) == 0) {
162 it = tracker.erase(it);
163 } else {
164 ++it;
165 }
166 }
167
168 // Add any new or changed servers to the tracker, and initiate async checks for them.
169 for (const auto& server : tlsServers) {
Erik Kline533a8422018-06-14 15:16:27 +0900170 if (needsValidation(tracker, server)) {
Mike Yu2cc198a2018-11-02 13:30:04 +0800171 validatePrivateDnsProvider(server, tracker, netId, mark);
Erik Klined739c212018-04-24 23:09:39 +0900172 }
173 }
174 return 0;
175 }
176
177 PrivateDnsStatus getStatus(unsigned netId) {
178 PrivateDnsStatus status{PrivateDnsMode::OFF, {}};
179
180 // This mutex is on the critical path of every DNS lookup.
181 //
182 // If the overhead of mutex acquisition proves too high, we could reduce
183 // it by maintaining an atomic_int32_t counter of TLS-enabled netids, or
184 // by using an RWLock.
Bernie Innocentiabf8a342018-08-10 15:17:16 +0900185 std::lock_guard guard(mPrivateDnsLock);
Erik Klined739c212018-04-24 23:09:39 +0900186
187 const auto mode = mPrivateDnsModes.find(netId);
188 if (mode == mPrivateDnsModes.end()) return status;
189 status.mode = mode->second;
190
191 const auto netPair = mPrivateDnsTransports.find(netId);
192 if (netPair != mPrivateDnsTransports.end()) {
193 for (const auto& serverPair : netPair->second) {
194 if (serverPair.second == Validation::success) {
195 status.validatedServers.push_back(serverPair.first);
196 }
197 }
198 }
199
200 return status;
201 }
202
203 void clear(unsigned netId) {
204 if (DBG) {
205 ALOGD("PrivateDnsConfiguration::clear(%u)", netId);
206 }
Bernie Innocentiabf8a342018-08-10 15:17:16 +0900207 std::lock_guard guard(mPrivateDnsLock);
Erik Klined739c212018-04-24 23:09:39 +0900208 mPrivateDnsModes.erase(netId);
209 mPrivateDnsTransports.erase(netId);
210 }
211
212 void dump(DumpWriter& dw, unsigned netId) {
Bernie Innocentiabf8a342018-08-10 15:17:16 +0900213 std::lock_guard guard(mPrivateDnsLock);
Erik Klined739c212018-04-24 23:09:39 +0900214
215 const auto& mode = mPrivateDnsModes.find(netId);
216 dw.println("Private DNS mode: %s", getPrivateDnsModeString(
217 (mode != mPrivateDnsModes.end()) ? mode->second : PrivateDnsMode::OFF));
218 const auto& netPair = mPrivateDnsTransports.find(netId);
219 if (netPair == mPrivateDnsTransports.end()) {
220 dw.println("No Private DNS servers configured");
221 } else {
222 const auto& tracker = netPair->second;
223 dw.println("Private DNS configuration (%zu entries)", tracker.size());
224 dw.incIndent();
225 for (const auto& kv : tracker) {
226 const auto& server = kv.first;
227 const auto status = kv.second;
228 dw.println("%s name{%s} status{%s}",
229 addrToString(&(server.ss)).c_str(),
230 server.name.c_str(),
231 validationStatusToString(status));
232 }
233 dw.decIndent();
234 }
235 }
236
237 private:
238 void validatePrivateDnsProvider(const DnsTlsServer& server, PrivateDnsTracker& tracker,
Mike Yu2cc198a2018-11-02 13:30:04 +0800239 unsigned netId, uint32_t mark) REQUIRES(mPrivateDnsLock) {
Erik Klined739c212018-04-24 23:09:39 +0900240 if (DBG) {
241 ALOGD("validatePrivateDnsProvider(%s, %u)", addrToString(&(server.ss)).c_str(), netId);
242 }
243
244 tracker[server] = Validation::in_process;
245 if (DBG) {
246 ALOGD("Server %s marked as in_process. Tracker now has size %zu",
247 addrToString(&(server.ss)).c_str(), tracker.size());
248 }
249 // Note that capturing |server| and |netId| in this lambda create copies.
Mike Yu2cc198a2018-11-02 13:30:04 +0800250 std::thread validate_thread([this, server, netId, mark] {
Erik Klined739c212018-04-24 23:09:39 +0900251 // cat /proc/sys/net/ipv4/tcp_syn_retries yields "6".
252 //
253 // Start with a 1 minute delay and backoff to once per hour.
254 //
255 // Assumptions:
256 // [1] Each TLS validation is ~10KB of certs+handshake+payload.
257 // [2] Network typically provision clients with <=4 nameservers.
258 // [3] Average month has 30 days.
259 //
260 // Each validation pass in a given hour is ~1.2MB of data. And 24
261 // such validation passes per day is about ~30MB per month, in the
262 // worst case. Otherwise, this will cost ~600 SYNs per month
263 // (6 SYNs per ip, 4 ips per validation pass, 24 passes per day).
264 auto backoff = BackoffSequence<>::Builder()
265 .withInitialRetransmissionTime(std::chrono::seconds(60))
266 .withMaximumRetransmissionTime(std::chrono::seconds(3600))
267 .build();
268
269 while (true) {
270 // ::validate() is a blocking call that performs network operations.
271 // It can take milliseconds to minutes, up to the SYN retry limit.
Mike Yu2cc198a2018-11-02 13:30:04 +0800272 const bool success = DnsTlsTransport::validate(server, netId, mark);
Erik Klined739c212018-04-24 23:09:39 +0900273 if (DBG) {
274 ALOGD("validateDnsTlsServer returned %d for %s", success,
275 addrToString(&(server.ss)).c_str());
276 }
277
278 const bool needs_reeval = this->recordPrivateDnsValidation(server, netId, success);
279 if (!needs_reeval) {
280 break;
281 }
282
283 if (backoff.hasNextTimeout()) {
284 std::this_thread::sleep_for(backoff.getNextTimeout());
285 } else {
286 break;
287 }
288 }
289 });
290 validate_thread.detach();
291 }
292
293 bool recordPrivateDnsValidation(const DnsTlsServer& server, unsigned netId, bool success) {
294 constexpr bool NEEDS_REEVALUATION = true;
295 constexpr bool DONT_REEVALUATE = false;
296
Bernie Innocentiabf8a342018-08-10 15:17:16 +0900297 std::lock_guard guard(mPrivateDnsLock);
Erik Klined739c212018-04-24 23:09:39 +0900298
299 auto netPair = mPrivateDnsTransports.find(netId);
300 if (netPair == mPrivateDnsTransports.end()) {
301 ALOGW("netId %u was erased during private DNS validation", netId);
302 return DONT_REEVALUATE;
303 }
304
Erik Kline533a8422018-06-14 15:16:27 +0900305 const auto mode = mPrivateDnsModes.find(netId);
306 if (mode == mPrivateDnsModes.end()) {
307 ALOGW("netId %u has no private DNS validation mode", netId);
308 return DONT_REEVALUATE;
309 }
310 const bool modeDoesReevaluation = (mode->second == PrivateDnsMode::STRICT);
311
312 bool reevaluationStatus =
313 (success || !modeDoesReevaluation) ? DONT_REEVALUATE : NEEDS_REEVALUATION;
Erik Klined739c212018-04-24 23:09:39 +0900314
315 auto& tracker = netPair->second;
316 auto serverPair = tracker.find(server);
317 if (serverPair == tracker.end()) {
318 ALOGW("Server %s was removed during private DNS validation",
319 addrToString(&(server.ss)).c_str());
320 success = false;
321 reevaluationStatus = DONT_REEVALUATE;
322 } else if (!(serverPair->first == server)) {
323 // TODO: It doesn't seem correct to overwrite the tracker entry for
324 // |server| down below in this circumstance... Fix this.
325 ALOGW("Server %s was changed during private DNS validation",
326 addrToString(&(server.ss)).c_str());
327 success = false;
328 reevaluationStatus = DONT_REEVALUATE;
329 }
330
331 // Send a validation event to NetdEventListenerService.
332 if (mNetdEventListener == nullptr) {
333 mNetdEventListener = mEventReporter.getNetdEventListener();
334 }
335 if (mNetdEventListener != nullptr) {
336 const String16 ipLiteral(addrToString(&(server.ss)).c_str());
337 const String16 hostname(server.name.empty() ? "" : server.name.c_str());
338 mNetdEventListener->onPrivateDnsValidationEvent(netId, ipLiteral, hostname, success);
339 if (DBG) {
340 ALOGD("Sending validation %s event on netId %u for %s with hostname %s",
341 success ? "success" : "failure", netId,
342 addrToString(&(server.ss)).c_str(), server.name.c_str());
343 }
344 } else {
345 ALOGE("Validation event not sent since NetdEventListenerService is unavailable.");
346 }
347
348 if (success) {
349 tracker[server] = Validation::success;
350 if (DBG) {
351 ALOGD("Validation succeeded for %s! Tracker now has %zu entries.",
352 addrToString(&(server.ss)).c_str(), tracker.size());
353 }
354 } else {
355 // Validation failure is expected if a user is on a captive portal.
356 // TODO: Trigger a second validation attempt after captive portal login
357 // succeeds.
Erik Kline533a8422018-06-14 15:16:27 +0900358 tracker[server] = (reevaluationStatus == NEEDS_REEVALUATION) ? Validation::in_process
359 : Validation::fail;
Erik Klined739c212018-04-24 23:09:39 +0900360 if (DBG) {
361 ALOGD("Validation failed for %s!", addrToString(&(server.ss)).c_str());
362 }
363 }
364
365 return reevaluationStatus;
366 }
367
Erik Kline533a8422018-06-14 15:16:27 +0900368 // Start validation for newly added servers as well as any servers that have
369 // landed in Validation::fail state. Note that servers that have failed
370 // multiple validation attempts but for which there is still a validating
371 // thread running are marked as being Validation::in_process.
372 static bool needsValidation(const PrivateDnsTracker& tracker, const DnsTlsServer& server) {
373 const auto& iter = tracker.find(server);
374 return (iter == tracker.end()) || (iter->second == Validation::fail);
375 }
376
Erik Klined739c212018-04-24 23:09:39 +0900377 EventReporter mEventReporter;
378
379 std::mutex mPrivateDnsLock;
380 std::map<unsigned, PrivateDnsMode> mPrivateDnsModes GUARDED_BY(mPrivateDnsLock);
381 // Structure for tracking the validation status of servers on a specific netId.
382 // Using the AddressComparator ensures at most one entry per IP address.
383 std::map<unsigned, PrivateDnsTracker> mPrivateDnsTransports GUARDED_BY(mPrivateDnsLock);
384 android::sp<android::net::metrics::INetdEventListener>
385 mNetdEventListener GUARDED_BY(mPrivateDnsLock);
Erik Kline533a8422018-06-14 15:16:27 +0900386} sPrivateDnsConfiguration;
Erik Klined739c212018-04-24 23:09:39 +0900387
Erik Klined26a2c22018-05-11 19:33:19 +0900388bool allIPv6Only(const std::vector<std::string>& servers) {
389 for (const auto& server : servers) {
390 if (server.find(':') == std::string::npos) return false;
391 }
392 return !servers.empty();
393}
394
Ben Schwartze7601812017-04-28 16:38:29 -0400395} // namespace
396
Pierre Imai95f5f942016-03-09 18:09:25 +0900397int ResolverController::setDnsServers(unsigned netId, const char* searchDomains,
398 const char** servers, int numservers, const __res_params* params) {
Mattias Falk89c1e972011-04-29 14:48:51 +0200399 if (DBG) {
Ben Schwartz4204ecf2017-10-02 12:35:48 -0400400 ALOGD("setDnsServers netId = %u, numservers = %d", netId, numservers);
Mattias Falk89c1e972011-04-29 14:48:51 +0200401 }
Bernie Innocenti189eb502018-10-01 23:10:18 +0900402 return -resolv_set_nameservers_for_net(netId, servers, numservers, searchDomains, params);
Mattias Falk89c1e972011-04-29 14:48:51 +0200403}
Paul Jensen6a46f332014-08-06 18:42:27 +0000404
Erik Kline1564d482018-03-07 17:09:35 +0900405ResolverController::PrivateDnsStatus
Erik Klined739c212018-04-24 23:09:39 +0900406ResolverController::getPrivateDnsStatus(unsigned netId) const {
Erik Kline533a8422018-06-14 15:16:27 +0900407 return sPrivateDnsConfiguration.getStatus(netId);
Ben Schwartze7601812017-04-28 16:38:29 -0400408}
409
Lorenzo Colittidadc5f82014-11-29 13:54:25 +0900410int ResolverController::clearDnsServers(unsigned netId) {
Bernie Innocenti189eb502018-10-01 23:10:18 +0900411 resolv_set_nameservers_for_net(netId, nullptr, 0, "", nullptr);
Lorenzo Colittidadc5f82014-11-29 13:54:25 +0900412 if (DBG) {
413 ALOGD("clearDnsServers netId = %u\n", netId);
414 }
Erik Klined26a2c22018-05-11 19:33:19 +0900415 mDns64Configuration.stopPrefixDiscovery(netId);
Erik Kline533a8422018-06-14 15:16:27 +0900416 sPrivateDnsConfiguration.clear(netId);
Lorenzo Colittidadc5f82014-11-29 13:54:25 +0900417 return 0;
418}
419
Paul Jensen6a46f332014-08-06 18:42:27 +0000420int ResolverController::flushDnsCache(unsigned netId) {
421 if (DBG) {
422 ALOGD("flushDnsCache netId = %u\n", netId);
423 }
424
Bernie Innocenti189eb502018-10-01 23:10:18 +0900425 resolv_flush_cache_for_net(netId);
Paul Jensen6a46f332014-08-06 18:42:27 +0000426
427 return 0;
428}
Pierre Imaibeedec32016-04-13 06:44:51 +0900429
430int ResolverController::getDnsInfo(unsigned netId, std::vector<std::string>* servers,
431 std::vector<std::string>* domains, __res_params* params,
432 std::vector<android::net::ResolverStats>* stats) {
433 using android::net::ResolverStats;
434 using android::net::INetd;
435 static_assert(ResolverStats::STATS_SUCCESSES == INetd::RESOLVER_STATS_SUCCESSES &&
436 ResolverStats::STATS_ERRORS == INetd::RESOLVER_STATS_ERRORS &&
437 ResolverStats::STATS_TIMEOUTS == INetd::RESOLVER_STATS_TIMEOUTS &&
438 ResolverStats::STATS_INTERNAL_ERRORS == INetd::RESOLVER_STATS_INTERNAL_ERRORS &&
439 ResolverStats::STATS_RTT_AVG == INetd::RESOLVER_STATS_RTT_AVG &&
440 ResolverStats::STATS_LAST_SAMPLE_TIME == INetd::RESOLVER_STATS_LAST_SAMPLE_TIME &&
441 ResolverStats::STATS_USABLE == INetd::RESOLVER_STATS_USABLE &&
442 ResolverStats::STATS_COUNT == INetd::RESOLVER_STATS_COUNT,
443 "AIDL and ResolverStats.h out of sync");
444 int nscount = -1;
445 sockaddr_storage res_servers[MAXNS];
446 int dcount = -1;
447 char res_domains[MAXDNSRCH][MAXDNSRCHPATH];
Bernie Innocenti189eb502018-10-01 23:10:18 +0900448 res_stats res_stats[MAXNS];
Pierre Imaibeedec32016-04-13 06:44:51 +0900449 servers->clear();
450 domains->clear();
451 *params = __res_params{};
452 stats->clear();
453 int revision_id = android_net_res_stats_get_info_for_net(netId, &nscount, res_servers, &dcount,
454 res_domains, params, res_stats);
455
456 // If the netId is unknown (which can happen for valid net IDs for which no DNS servers have
457 // yet been configured), there is no revision ID. In this case there is no data to return.
458 if (revision_id < 0) {
459 return 0;
460 }
461
462 // Verify that the returned data is sane.
463 if (nscount < 0 || nscount > MAXNS || dcount < 0 || dcount > MAXDNSRCH) {
464 ALOGE("%s: nscount=%d, dcount=%d", __FUNCTION__, nscount, dcount);
465 return -ENOTRECOVERABLE;
466 }
467
468 // Determine which servers are considered usable by the resolver.
469 bool valid_servers[MAXNS];
470 std::fill_n(valid_servers, MAXNS, false);
471 android_net_res_stats_get_usable_servers(params, res_stats, nscount, valid_servers);
472
473 // Convert the server sockaddr structures to std::string.
474 stats->resize(nscount);
475 for (int i = 0 ; i < nscount ; ++i) {
476 char hbuf[NI_MAXHOST];
477 int rv = getnameinfo(reinterpret_cast<const sockaddr*>(&res_servers[i]),
478 sizeof(res_servers[i]), hbuf, sizeof(hbuf), nullptr, 0, NI_NUMERICHOST);
479 std::string server_str;
480 if (rv == 0) {
481 server_str.assign(hbuf);
482 } else {
483 ALOGE("getnameinfo() failed for server #%d: %s", i, gai_strerror(rv));
484 server_str.assign("<invalid>");
485 }
486 servers->push_back(std::move(server_str));
487 android::net::ResolverStats& cur_stats = (*stats)[i];
488 android_net_res_stats_aggregate(&res_stats[i], &cur_stats.successes, &cur_stats.errors,
489 &cur_stats.timeouts, &cur_stats.internal_errors, &cur_stats.rtt_avg,
490 &cur_stats.last_sample_time);
491 cur_stats.usable = valid_servers[i];
492 }
493
494 // Convert the stack-allocated search domain strings to std::string.
495 for (int i = 0 ; i < dcount ; ++i) {
496 domains->push_back(res_domains[i]);
497 }
498 return 0;
499}
500
501int ResolverController::setResolverConfiguration(int32_t netId,
502 const std::vector<std::string>& servers, const std::vector<std::string>& domains,
Erik Klinea1476fb2018-03-04 21:01:56 +0900503 const std::vector<int32_t>& params, const std::string& tlsName,
504 const std::vector<std::string>& tlsServers,
Ben Schwartz4204ecf2017-10-02 12:35:48 -0400505 const std::set<std::vector<uint8_t>>& tlsFingerprints) {
Pierre Imaibeedec32016-04-13 06:44:51 +0900506 using android::net::INetd;
Bernie Innocenticc93c372018-08-06 15:18:59 +0900507 // TODO: make RESOLVER_PARAMS_BASE_TIMEOUT_MSEC a mandatory parameter once all callers
508 // have been updated to specify it.
509 if (params.size() < INetd::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC ||
510 params.size() > INetd::RESOLVER_PARAMS_COUNT) {
Pierre Imaibeedec32016-04-13 06:44:51 +0900511 ALOGE("%s: params.size()=%zu", __FUNCTION__, params.size());
512 return -EINVAL;
513 }
514
Mike Yu2cc198a2018-11-02 13:30:04 +0800515 // At private DNS validation time, we only know the netId, so we have to guess/compute the
516 // corresponding socket mark.
517 Fwmark fwmark;
518 fwmark.netId = netId;
519 fwmark.explicitlySelected = true;
520 fwmark.protectedFromVpn = true;
521 fwmark.permission = PERMISSION_SYSTEM;
522
523 const int err = sPrivateDnsConfiguration.set(netId, fwmark.intValue, tlsServers, tlsName,
524 tlsFingerprints);
Erik Kline1564d482018-03-07 17:09:35 +0900525 if (err != 0) {
526 return err;
Ben Schwartz4204ecf2017-10-02 12:35:48 -0400527 }
528
Erik Kline1564d482018-03-07 17:09:35 +0900529 // Convert network-assigned server list to bionic's format.
530 auto server_count = std::min<size_t>(MAXNS, servers.size());
Pierre Imaibeedec32016-04-13 06:44:51 +0900531 std::vector<const char*> server_ptrs;
Pierre Imai0452cb52016-05-30 16:42:34 +0900532 for (size_t i = 0 ; i < server_count ; ++i) {
Erik Kline1564d482018-03-07 17:09:35 +0900533 server_ptrs.push_back(servers[i].c_str());
Pierre Imaibeedec32016-04-13 06:44:51 +0900534 }
535
536 std::string domains_str;
537 if (!domains.empty()) {
538 domains_str = domains[0];
539 for (size_t i = 1 ; i < domains.size() ; ++i) {
540 domains_str += " " + domains[i];
541 }
542 }
543
Bernie Innocenticc93c372018-08-06 15:18:59 +0900544 __res_params res_params = {};
Pierre Imaibeedec32016-04-13 06:44:51 +0900545 res_params.sample_validity = params[INetd::RESOLVER_PARAMS_SAMPLE_VALIDITY];
546 res_params.success_threshold = params[INetd::RESOLVER_PARAMS_SUCCESS_THRESHOLD];
547 res_params.min_samples = params[INetd::RESOLVER_PARAMS_MIN_SAMPLES];
548 res_params.max_samples = params[INetd::RESOLVER_PARAMS_MAX_SAMPLES];
Bernie Innocenticc93c372018-08-06 15:18:59 +0900549 if (params.size() > INetd::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC) {
550 res_params.base_timeout_msec = params[INetd::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC];
551 }
Erik Klined26a2c22018-05-11 19:33:19 +0900552
553 const auto rval = setDnsServers(netId, domains_str.c_str(), server_ptrs.data(),
554 server_ptrs.size(), &res_params);
555
556 if (rval == 0) {
557 // Start DNS64 discovery after successfully setting any new DNS servers
558 // as the cache may have been cleared (if the nameservers differ), and
559 // we might discover a different DNS64 prefix. If the cache has not been
560 // cleared, we may quickly rediscover the same prefix.
561 //
562 // Operators may choose to use a longer TTL in order to reduce repeated
563 // resolution (see also https://tools.ietf.org/html/rfc7050#section-5).
564 if (allIPv6Only(servers)) {
Erik Kline603df202018-09-10 18:16:26 +0900565 // TODO: Keep any existing discovered prefix around for use while
566 // re-discovery is in progress. Otherwise, whenever DNS servers are
567 // pushed to netd there can be gaps where it would appear there was
568 // no prefix64 when in fact we had previously discovered one (and
569 // are highly likely to rediscover the same one).
Erik Klined26a2c22018-05-11 19:33:19 +0900570 mDns64Configuration.startPrefixDiscovery(netId);
571 } else {
572 mDns64Configuration.stopPrefixDiscovery(netId);
573 }
574 }
575
576 return rval;
Pierre Imaibeedec32016-04-13 06:44:51 +0900577}
578
579int ResolverController::getResolverInfo(int32_t netId, std::vector<std::string>* servers,
580 std::vector<std::string>* domains, std::vector<int32_t>* params,
581 std::vector<int32_t>* stats) {
582 using android::net::ResolverStats;
583 using android::net::INetd;
584 __res_params res_params;
585 std::vector<ResolverStats> res_stats;
586 int ret = getDnsInfo(netId, servers, domains, &res_params, &res_stats);
587 if (ret != 0) {
588 return ret;
589 }
590
591 // Serialize the information for binder.
592 ResolverStats::encodeAll(res_stats, stats);
593
594 params->resize(INetd::RESOLVER_PARAMS_COUNT);
595 (*params)[INetd::RESOLVER_PARAMS_SAMPLE_VALIDITY] = res_params.sample_validity;
596 (*params)[INetd::RESOLVER_PARAMS_SUCCESS_THRESHOLD] = res_params.success_threshold;
597 (*params)[INetd::RESOLVER_PARAMS_MIN_SAMPLES] = res_params.min_samples;
598 (*params)[INetd::RESOLVER_PARAMS_MAX_SAMPLES] = res_params.max_samples;
Bernie Innocenticc93c372018-08-06 15:18:59 +0900599 (*params)[INetd::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC] = res_params.base_timeout_msec;
Pierre Imaibeedec32016-04-13 06:44:51 +0900600 return 0;
601}
Pierre Imai3a272072016-04-19 16:17:07 +0900602
603void ResolverController::dump(DumpWriter& dw, unsigned netId) {
604 // No lock needed since Bionic's resolver locks all accessed data structures internally.
605 using android::net::ResolverStats;
606 std::vector<std::string> servers;
607 std::vector<std::string> domains;
Bernie Innocenticc93c372018-08-06 15:18:59 +0900608 __res_params params = {};
Pierre Imai3a272072016-04-19 16:17:07 +0900609 std::vector<ResolverStats> stats;
610 time_t now = time(nullptr);
611 int rv = getDnsInfo(netId, &servers, &domains, &params, &stats);
612 dw.incIndent();
613 if (rv != 0) {
614 dw.println("getDnsInfo() failed for netid %u", netId);
615 } else {
616 if (servers.empty()) {
617 dw.println("No DNS servers defined");
618 } else {
619 dw.println("DNS servers: # IP (total, successes, errors, timeouts, internal errors, "
620 "RTT avg, last sample)");
621 dw.incIndent();
622 for (size_t i = 0 ; i < servers.size() ; ++i) {
623 if (i < stats.size()) {
624 const ResolverStats& s = stats[i];
625 int total = s.successes + s.errors + s.timeouts + s.internal_errors;
626 if (total > 0) {
627 int time_delta = (s.last_sample_time > 0) ? now - s.last_sample_time : -1;
628 dw.println("%s (%d, %d, %d, %d, %d, %dms, %ds)%s", servers[i].c_str(),
629 total, s.successes, s.errors, s.timeouts, s.internal_errors,
630 s.rtt_avg, time_delta, s.usable ? "" : " BROKEN");
631 } else {
632 dw.println("%s <no data>", servers[i].c_str());
633 }
634 } else {
635 dw.println("%s <no stats>", servers[i].c_str());
636 }
637 }
638 dw.decIndent();
639 }
640 if (domains.empty()) {
641 dw.println("No search domains defined");
642 } else {
643 std::string domains_str = android::base::Join(domains, ", ");
644 dw.println("search domains: %s", domains_str.c_str());
645 }
646 if (params.sample_validity != 0) {
Bernie Innocenticc93c372018-08-06 15:18:59 +0900647 dw.println(
648 "DNS parameters: sample validity = %us, success threshold = %u%%, "
649 "samples (min, max) = (%u, %u), base_timeout = %dmsec",
650 params.sample_validity, static_cast<unsigned>(params.success_threshold),
Pierre Imai3a272072016-04-19 16:17:07 +0900651 static_cast<unsigned>(params.min_samples),
Bernie Innocenticc93c372018-08-06 15:18:59 +0900652 static_cast<unsigned>(params.max_samples), params.base_timeout_msec);
Pierre Imai3a272072016-04-19 16:17:07 +0900653 }
Erik Klined739c212018-04-24 23:09:39 +0900654
Erik Klined26a2c22018-05-11 19:33:19 +0900655 mDns64Configuration.dump(dw, netId);
Erik Kline533a8422018-06-14 15:16:27 +0900656 sPrivateDnsConfiguration.dump(dw, netId);
Pierre Imai3a272072016-04-19 16:17:07 +0900657 }
658 dw.decIndent();
659}
Lorenzo Colitti7035f222017-02-13 18:29:00 +0900660
661} // namespace net
662} // namespace android