| /* |
| * Copyright (C) 2018 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #define LOG_TAG "resolv" |
| |
| #include "PrivateDnsConfiguration.h" |
| |
| #include <algorithm> |
| |
| #include <android-base/format.h> |
| #include <android-base/logging.h> |
| #include <android/binder_ibinder.h> |
| #include <netdutils/Slice.h> |
| #include <netdutils/ThreadUtil.h> |
| #include <sys/socket.h> |
| |
| #include "DnsTlsTransport.h" |
| #include "ResolverEventReporter.h" |
| #include "doh.h" |
| #include "netd_resolv/resolv.h" |
| #include "resolv_cache.h" |
| #include "resolv_private.h" |
| #include "util.h" |
| |
| using aidl::android::net::resolv::aidl::IDnsResolverUnsolicitedEventListener; |
| using aidl::android::net::resolv::aidl::PrivateDnsValidationEventParcel; |
| using android::netdutils::IPAddress; |
| using android::netdutils::IPSockAddr; |
| using android::netdutils::setThreadName; |
| using android::netdutils::Slice; |
| using std::chrono::milliseconds; |
| |
| namespace android { |
| namespace net { |
| |
| namespace { |
| |
| bool ensureNoInvalidIp(const std::vector<std::string>& servers) { |
| IPAddress ip; |
| for (const auto& s : servers) { |
| if (!IPAddress::forString(s, &ip)) { |
| LOG(WARNING) << "Invalid IP address: " << s; |
| return false; |
| } |
| } |
| return true; |
| } |
| |
| FeatureFlags makeDohFeatureFlags() { |
| const Experiments* const instance = Experiments::getInstance(); |
| const auto getTimeout = [&](const std::string_view key, int defaultValue) -> uint64_t { |
| static constexpr int kMinTimeoutMs = 1000; |
| uint64_t timeout = instance->getFlag(key, defaultValue); |
| if (timeout < kMinTimeoutMs) { |
| timeout = kMinTimeoutMs; |
| } |
| return timeout; |
| }; |
| |
| return FeatureFlags{ |
| .probe_timeout_ms = getTimeout("doh_probe_timeout_ms", |
| PrivateDnsConfiguration::kDohProbeDefaultTimeoutMs), |
| .idle_timeout_ms = getTimeout("doh_idle_timeout_ms", |
| PrivateDnsConfiguration::kDohIdleDefaultTimeoutMs), |
| .use_session_resumption = instance->getFlag("doh_session_resumption", 0) == 1, |
| .enable_early_data = instance->getFlag("doh_early_data", 0) == 1, |
| }; |
| } |
| |
| std::string toString(const FeatureFlags& flags) { |
| return fmt::format( |
| "probe_timeout_ms={}, idle_timeout_ms={}, use_session_resumption={}, " |
| "enable_early_data={}", |
| flags.probe_timeout_ms, flags.idle_timeout_ms, flags.use_session_resumption, |
| flags.enable_early_data); |
| } |
| |
| // Returns the sorted (sort IPv6 before IPv4) servers. |
| std::vector<std::string> sortServers(const std::vector<std::string>& servers) { |
| std::vector<std::string> out = servers; |
| std::sort(out.begin(), out.end(), [](std::string a, std::string b) { |
| return IPAddress::forString(a) > IPAddress::forString(b); |
| }); |
| return out; |
| } |
| |
| } // namespace |
| |
| PrivateDnsModes convertEnumType(PrivateDnsMode mode) { |
| switch (mode) { |
| case PrivateDnsMode::OFF: |
| return PrivateDnsModes::PDM_OFF; |
| case PrivateDnsMode::OPPORTUNISTIC: |
| return PrivateDnsModes::PDM_OPPORTUNISTIC; |
| case PrivateDnsMode::STRICT: |
| return PrivateDnsModes::PDM_STRICT; |
| default: |
| return PrivateDnsModes::PDM_UNKNOWN; |
| } |
| } |
| |
| int PrivateDnsConfiguration::set(int32_t netId, uint32_t mark, |
| const std::vector<std::string>& unencryptedServers, |
| const std::vector<std::string>& encryptedServers, |
| const std::string& name, const std::string& caCert, |
| const std::optional<DohParamsParcel> dohParams) { |
| LOG(DEBUG) << "PrivateDnsConfiguration::set(" << netId << ", 0x" << std::hex << mark << std::dec |
| << ", " << encryptedServers.size() << ", " << name << ")"; |
| |
| if (!ensureNoInvalidIp(encryptedServers)) return -EINVAL; |
| |
| std::lock_guard guard(mPrivateDnsLock); |
| mUnorderedDnsTracker[netId] = unencryptedServers; |
| mUnorderedDotTracker[netId] = encryptedServers; |
| mUnorderedDohTracker[netId] = encryptedServers; |
| |
| if (!name.empty()) { |
| mPrivateDnsModes[netId] = PrivateDnsMode::STRICT; |
| } else if (!encryptedServers.empty()) { |
| mPrivateDnsModes[netId] = PrivateDnsMode::OPPORTUNISTIC; |
| } else { |
| mPrivateDnsModes[netId] = PrivateDnsMode::OFF; |
| clearDot(netId); |
| clearDoh(netId); |
| return 0; |
| // TODO: signal validation threads to stop. |
| } |
| |
| if (int n = setDot(netId, mark, encryptedServers, name, caCert); n != 0) { |
| return n; |
| } |
| |
| return setDoh(netId, mark, encryptedServers, name, caCert, dohParams); |
| } |
| |
| int PrivateDnsConfiguration::setDot(int32_t netId, uint32_t mark, |
| const std::vector<std::string>& servers, |
| const std::string& name, const std::string& caCert) { |
| // Parse the list of servers that has been passed in |
| std::map<ServerIdentity, DnsTlsServer> tmp; |
| for (const auto& s : servers) { |
| // The IP addresses are guaranteed to be valid. |
| DnsTlsServer server(IPAddress::forString(s)); |
| server.name = name; |
| server.certificate = caCert; |
| server.mark = mark; |
| tmp[ServerIdentity(server)] = server; |
| } |
| |
| // Create the tracker if it was not present |
| auto& tracker = mDotTracker[netId]; |
| |
| // Add the servers if not contained in tracker. |
| for (const auto& [identity, server] : tmp) { |
| if (tracker.find(identity) == tracker.end()) { |
| tracker[identity] = server; |
| } |
| } |
| |
| for (auto& [identity, server] : tracker) { |
| const bool active = tmp.find(identity) != tmp.end(); |
| server.setActive(active); |
| |
| // For simplicity, deem the validation result of inactive servers as unreliable. |
| if (!server.active() && server.validationState() == Validation::success) { |
| updateServerState(identity, Validation::success_but_expired, netId); |
| } |
| |
| if (needsValidation(server)) { |
| updateServerState(identity, Validation::in_process, netId); |
| startDotValidation(identity, netId, false); |
| } |
| } |
| |
| return resolv_stats_set_addrs(netId, PROTO_DOT, servers, kDotPort); |
| } |
| |
| void PrivateDnsConfiguration::clearDot(int32_t netId) { |
| mDotTracker.erase(netId); |
| resolv_stats_set_addrs(netId, PROTO_DOT, {}, kDotPort); |
| } |
| |
| PrivateDnsStatus PrivateDnsConfiguration::getStatus(unsigned netId) const { |
| std::lock_guard guard(mPrivateDnsLock); |
| return getStatusLocked(netId); |
| } |
| |
| PrivateDnsStatus PrivateDnsConfiguration::getStatusLocked(unsigned netId) const { |
| PrivateDnsStatus status{ |
| .mode = PrivateDnsMode::OFF, |
| .dotServersMap = {}, |
| .dohServersMap = {}, |
| }; |
| |
| const auto mode = mPrivateDnsModes.find(netId); |
| if (mode == mPrivateDnsModes.end()) return status; |
| status.mode = mode->second; |
| |
| const auto netPair = mDotTracker.find(netId); |
| if (netPair != mDotTracker.end()) { |
| for (const auto& [_, server] : netPair->second) { |
| if (server.active()) { |
| status.dotServersMap.emplace(server, server.validationState()); |
| } |
| } |
| } |
| |
| auto it = mDohTracker.find(netId); |
| if (it != mDohTracker.end()) { |
| status.dohServersMap.emplace(IPSockAddr::toIPSockAddr(it->second.ipAddr, kDohPort), |
| DohServerInfo(it->second.httpsTemplate, it->second.status)); |
| } |
| |
| return status; |
| } |
| |
| NetworkDnsServerSupportReported PrivateDnsConfiguration::getStatusForMetrics(unsigned netId) const { |
| const auto networkType = resolv_get_network_types_for_net(netId); |
| std::lock_guard guard(mPrivateDnsLock); |
| |
| if (mPrivateDnsModes.find(netId) == mPrivateDnsModes.end()) { |
| // Return NetworkDnsServerSupportReported with private_dns_modes set to PDM_UNKNOWN. |
| return {}; |
| } |
| |
| const PrivateDnsStatus status = getStatusLocked(netId); |
| NetworkDnsServerSupportReported event = {}; |
| event.set_network_type(networkType); |
| event.set_private_dns_modes(convertEnumType(status.mode)); |
| |
| if (const auto it = mUnorderedDnsTracker.find(netId); it != mUnorderedDnsTracker.end()) { |
| for (size_t i = 0; i < it->second.size(); i++) { |
| Server* server = event.mutable_servers()->add_server(); |
| server->set_protocol(PROTO_UDP); |
| server->set_index(i); |
| server->set_validated(false); |
| } |
| } |
| |
| if (const auto it = mUnorderedDotTracker.find(netId); it != mUnorderedDotTracker.end()) { |
| int index = 0; |
| const std::list<DnsTlsServer> validatedServers = status.validatedServers(); |
| for (const std::string& s : it->second) { |
| const IPSockAddr target = IPSockAddr::toIPSockAddr(s, kDotPort); |
| bool validated = |
| std::any_of(validatedServers.begin(), validatedServers.end(), |
| [&target](DnsTlsServer server) { return server.addr() == target; }); |
| Server* server = event.mutable_servers()->add_server(); |
| server->set_protocol(PROTO_DOT); |
| server->set_index(index++); |
| server->set_validated(validated); |
| } |
| } |
| |
| if (const auto it = mUnorderedDohTracker.find(netId); it != mUnorderedDohTracker.end()) { |
| int index = 0; |
| for (const std::string& s : it->second) { |
| const IPSockAddr target = IPSockAddr::toIPSockAddr(s, kDohPort); |
| bool validated = std::any_of(status.dohServersMap.begin(), status.dohServersMap.end(), |
| [&target](const auto& entry) { |
| return entry.first == target && |
| entry.second.status == Validation::success; |
| }); |
| Server* server = event.mutable_servers()->add_server(); |
| server->set_protocol(PROTO_DOH); |
| server->set_index(index++); |
| server->set_validated(validated); |
| } |
| } |
| |
| return event; |
| } |
| |
| void PrivateDnsConfiguration::clear(unsigned netId) { |
| LOG(DEBUG) << "PrivateDnsConfiguration::clear(" << netId << ")"; |
| std::lock_guard guard(mPrivateDnsLock); |
| mPrivateDnsModes.erase(netId); |
| mUnorderedDnsTracker.erase(netId); |
| mUnorderedDotTracker.erase(netId); |
| mUnorderedDohTracker.erase(netId); |
| clearDot(netId); |
| clearDoh(netId); |
| |
| // Notify the relevant private DNS validations, if they are waiting, to finish. |
| mCv.notify_all(); |
| } |
| |
| base::Result<void> PrivateDnsConfiguration::requestDotValidation(unsigned netId, |
| const ServerIdentity& identity, |
| uint32_t mark) { |
| std::lock_guard guard(mPrivateDnsLock); |
| |
| // Running revalidation requires to mark the server as in_process, which means the server |
| // won't be used until the validation passes. It's necessary and safe to run revalidation |
| // when in private DNS opportunistic mode, because there's a fallback mechanics even if |
| // all of the private DNS servers are in in_process state. |
| if (auto it = mPrivateDnsModes.find(netId); it == mPrivateDnsModes.end()) { |
| return Errorf("NetId not found in mPrivateDnsModes"); |
| } else if (it->second != PrivateDnsMode::OPPORTUNISTIC) { |
| return Errorf("Private DNS setting is not opportunistic mode"); |
| } |
| |
| auto result = getDotServerLocked(identity, netId); |
| if (!result.ok()) { |
| return result.error(); |
| } |
| |
| const DnsTlsServer* target = result.value(); |
| |
| if (!target->active()) return Errorf("Server is not active"); |
| |
| if (target->validationState() != Validation::success) { |
| return Errorf("Server validation state mismatched"); |
| } |
| |
| // Don't run the validation if |mark| (from android_net_context.dns_mark) is different. |
| // This is to protect validation from running on unexpected marks. |
| // Validation should be associated with a mark gotten by system permission. |
| if (target->validationMark() != mark) return Errorf("Socket mark mismatched"); |
| |
| updateServerState(identity, Validation::in_process, netId); |
| startDotValidation(identity, netId, true); |
| return {}; |
| } |
| |
| void PrivateDnsConfiguration::startDotValidation(const ServerIdentity& identity, unsigned netId, |
| bool isRevalidation) { |
| // This ensures that the thread sends probe at least once in case |
| // the server is removed before the thread starts running. |
| // TODO: consider moving these code to the thread. |
| const auto result = getDotServerLocked(identity, netId); |
| if (!result.ok()) return; |
| DnsTlsServer server = *result.value(); |
| |
| std::thread validate_thread([this, identity, server, netId, isRevalidation] { |
| setThreadName(fmt::format("TlsVerify_{}", netId)); |
| |
| // cat /proc/sys/net/ipv4/tcp_syn_retries yields "6". |
| // |
| // Start with a 1 minute delay and backoff to once per hour. |
| // |
| // Assumptions: |
| // [1] Each TLS validation is ~10KB of certs+handshake+payload. |
| // [2] Network typically provision clients with <=4 nameservers. |
| // [3] Average month has 30 days. |
| // |
| // Each validation pass in a given hour is ~1.2MB of data. And 24 |
| // such validation passes per day is about ~30MB per month, in the |
| // worst case. Otherwise, this will cost ~600 SYNs per month |
| // (6 SYNs per ip, 4 ips per validation pass, 24 passes per day). |
| auto backoff = mBackoffBuilder.build(); |
| |
| while (true) { |
| // ::validate() is a blocking call that performs network operations. |
| // It can take milliseconds to minutes, up to the SYN retry limit. |
| LOG(WARNING) << "Validating DnsTlsServer " << server.toString() << " with mark 0x" |
| << std::hex << server.validationMark(); |
| const bool success = DnsTlsTransport::validate(server, server.validationMark()); |
| LOG(WARNING) << "validateDnsTlsServer returned " << success << " for " |
| << server.toString(); |
| |
| const bool needs_reeval = |
| this->recordDotValidation(identity, netId, success, isRevalidation); |
| |
| if (!needs_reeval || !backoff.hasNextTimeout()) { |
| break; |
| } |
| |
| std::unique_lock<std::mutex> cvGuard(mPrivateDnsLock); |
| // If the timeout expired and the predicate still evaluates to false, wait_for returns |
| // false. |
| if (mCv.wait_for(cvGuard, backoff.getNextTimeout(), |
| [this, netId]() REQUIRES(mPrivateDnsLock) { |
| return mPrivateDnsModes.find(netId) == mPrivateDnsModes.end(); |
| })) { |
| break; |
| } |
| } |
| }); |
| validate_thread.detach(); |
| } |
| |
| void PrivateDnsConfiguration::sendPrivateDnsValidationEvent(const ServerIdentity& identity, |
| unsigned netId, bool success) const { |
| LOG(DEBUG) << "Sending validation " << (success ? "success" : "failure") << " event on netId " |
| << netId << " for " << identity.sockaddr.toString() << " with hostname {" |
| << identity.provider << "}"; |
| // Send a validation event to NetdEventListenerService. |
| const auto& listeners = ResolverEventReporter::getInstance().getListeners(); |
| if (listeners.empty()) { |
| LOG(ERROR) |
| << "Validation event not sent since no INetdEventListener receiver is available."; |
| } |
| for (const auto& it : listeners) { |
| it->onPrivateDnsValidationEvent(netId, identity.sockaddr.ip().toString(), identity.provider, |
| success); |
| } |
| |
| // Send a validation event to unsolicited event listeners. |
| const auto& unsolEventListeners = ResolverEventReporter::getInstance().getUnsolEventListeners(); |
| const PrivateDnsValidationEventParcel validationEvent = { |
| .netId = static_cast<int32_t>(netId), |
| .ipAddress = identity.sockaddr.ip().toString(), |
| .hostname = identity.provider, |
| .validation = success ? IDnsResolverUnsolicitedEventListener::VALIDATION_RESULT_SUCCESS |
| : IDnsResolverUnsolicitedEventListener::VALIDATION_RESULT_FAILURE, |
| .protocol = (identity.sockaddr.port() == kDotPort) |
| ? IDnsResolverUnsolicitedEventListener::PROTOCOL_DOT |
| : IDnsResolverUnsolicitedEventListener::PROTOCOL_DOH, |
| }; |
| for (const auto& it : unsolEventListeners) { |
| it->onPrivateDnsValidationEvent(validationEvent); |
| } |
| } |
| |
| bool PrivateDnsConfiguration::recordDotValidation(const ServerIdentity& identity, unsigned netId, |
| bool success, bool isRevalidation) { |
| constexpr bool NEEDS_REEVALUATION = true; |
| constexpr bool DONT_REEVALUATE = false; |
| |
| std::lock_guard guard(mPrivateDnsLock); |
| |
| auto netPair = mDotTracker.find(netId); |
| if (netPair == mDotTracker.end()) { |
| LOG(WARNING) << "netId " << netId << " was erased during private DNS validation"; |
| notifyValidationStateUpdate(identity.sockaddr, Validation::fail, netId); |
| return DONT_REEVALUATE; |
| } |
| |
| const auto mode = mPrivateDnsModes.find(netId); |
| if (mode == mPrivateDnsModes.end()) { |
| LOG(WARNING) << "netId " << netId << " has no private DNS validation mode"; |
| notifyValidationStateUpdate(identity.sockaddr, Validation::fail, netId); |
| return DONT_REEVALUATE; |
| } |
| |
| bool reevaluationStatus = NEEDS_REEVALUATION; |
| if (success || (mode->second == PrivateDnsMode::OFF) || |
| (mode->second == PrivateDnsMode::OPPORTUNISTIC && !isRevalidation)) { |
| reevaluationStatus = DONT_REEVALUATE; |
| } |
| |
| auto& tracker = netPair->second; |
| auto serverPair = tracker.find(identity); |
| if (serverPair == tracker.end()) { |
| LOG(WARNING) << "Server " << identity.sockaddr.ip().toString() |
| << " was removed during private DNS validation"; |
| success = false; |
| reevaluationStatus = DONT_REEVALUATE; |
| } else if (!serverPair->second.active()) { |
| LOG(WARNING) << "Server " << identity.sockaddr.ip().toString() |
| << " was removed from the configuration"; |
| success = false; |
| reevaluationStatus = DONT_REEVALUATE; |
| } |
| |
| // Send private dns validation result to listeners. |
| if (needReportEvent(netId, identity, success)) { |
| sendPrivateDnsValidationEvent(identity, netId, success); |
| } |
| |
| if (success) { |
| updateServerState(identity, Validation::success, netId); |
| } else { |
| // Validation failure is expected if a user is on a captive portal. |
| // TODO: Trigger a second validation attempt after captive portal login |
| // succeeds. |
| const auto result = (reevaluationStatus == NEEDS_REEVALUATION) ? Validation::in_process |
| : Validation::fail; |
| updateServerState(identity, result, netId); |
| } |
| LOG(WARNING) << "Validation " << (success ? "success" : "failed"); |
| |
| return reevaluationStatus; |
| } |
| |
| void PrivateDnsConfiguration::updateServerState(const ServerIdentity& identity, Validation state, |
| uint32_t netId) { |
| const auto result = getDotServerLocked(identity, netId); |
| if (!result.ok()) { |
| notifyValidationStateUpdate(identity.sockaddr, Validation::fail, netId); |
| return; |
| } |
| |
| auto* server = result.value(); |
| |
| server->setValidationState(state); |
| notifyValidationStateUpdate(identity.sockaddr, state, netId); |
| |
| RecordEntry record(netId, identity, state); |
| mPrivateDnsLog.push(std::move(record)); |
| } |
| |
| bool PrivateDnsConfiguration::needsValidation(const DnsTlsServer& server) const { |
| // The server is not expected to be used on the network. |
| if (!server.active()) return false; |
| |
| // The server is newly added. |
| if (server.validationState() == Validation::unknown_server) return true; |
| |
| // The server has failed at least one validation attempt. Give it another try. |
| if (server.validationState() == Validation::fail) return true; |
| |
| // The previous validation result might be unreliable. |
| if (server.validationState() == Validation::success_but_expired) return true; |
| |
| return false; |
| } |
| |
| base::Result<DnsTlsServer*> PrivateDnsConfiguration::getDotServer(const ServerIdentity& identity, |
| unsigned netId) { |
| std::lock_guard guard(mPrivateDnsLock); |
| return getDotServerLocked(identity, netId); |
| } |
| |
| base::Result<DnsTlsServer*> PrivateDnsConfiguration::getDotServerLocked( |
| const ServerIdentity& identity, unsigned netId) { |
| auto netPair = mDotTracker.find(netId); |
| if (netPair == mDotTracker.end()) { |
| return Errorf("Failed to get private DNS: netId {} not found", netId); |
| } |
| |
| auto iter = netPair->second.find(identity); |
| if (iter == netPair->second.end()) { |
| return Errorf("Failed to get private DNS: server {{{}/{}}} not found", |
| identity.sockaddr.toString(), identity.provider); |
| } |
| |
| return &iter->second; |
| } |
| |
| void PrivateDnsConfiguration::setObserver(PrivateDnsValidationObserver* observer) { |
| std::lock_guard guard(mPrivateDnsLock); |
| mObserver = observer; |
| } |
| |
| base::Result<netdutils::IPSockAddr> PrivateDnsConfiguration::getDohServer(unsigned netId) const { |
| std::lock_guard guard(mPrivateDnsLock); |
| auto it = mDohTracker.find(netId); |
| if (it != mDohTracker.end()) { |
| return IPSockAddr::toIPSockAddr(it->second.ipAddr, kDohPort); |
| } |
| |
| return Errorf("Failed to get DoH Server: netId {} not found", netId); |
| } |
| |
| void PrivateDnsConfiguration::notifyValidationStateUpdate(const netdutils::IPSockAddr& sockaddr, |
| Validation validation, |
| uint32_t netId) const { |
| if (mObserver) { |
| mObserver->onValidationStateUpdate(sockaddr.ip().toString(), validation, netId); |
| } |
| } |
| |
| void PrivateDnsConfiguration::dump(netdutils::DumpWriter& dw) const { |
| dw.println("PrivateDnsLog:"); |
| netdutils::ScopedIndent indentStats(dw); |
| |
| for (const auto& record : mPrivateDnsLog.copy()) { |
| dw.println(fmt::format( |
| "{} - netId={} PrivateDns={{{}/{}}} state={}", timestampToString(record.timestamp), |
| record.netId, record.serverIdentity.sockaddr.toString(), |
| record.serverIdentity.provider, validationStatusToString(record.state))); |
| } |
| dw.blankline(); |
| } |
| |
| void PrivateDnsConfiguration::initDoh() { |
| std::lock_guard guard(mPrivateDnsLock); |
| initDohLocked(); |
| } |
| |
| void PrivateDnsConfiguration::initDohLocked() { |
| if (mDohDispatcher != nullptr) return; |
| mDohDispatcher = doh_dispatcher_new( |
| [](uint32_t net_id, bool success, const char* ip_addr, const char* host) { |
| android::net::PrivateDnsConfiguration::getInstance().onDohStatusUpdate( |
| net_id, success, ip_addr, host); |
| }, |
| [](int32_t sock) { resolv_tag_socket(sock, AID_DNS, NET_CONTEXT_INVALID_PID); }); |
| } |
| |
| int PrivateDnsConfiguration::setDoh(int32_t netId, uint32_t mark, |
| const std::vector<std::string>& servers, |
| const std::string& name, const std::string& caCert, |
| const std::optional<DohParamsParcel> dohParams) { |
| LOG(DEBUG) << "PrivateDnsConfiguration::setDoh(" << netId << ", 0x" << std::hex << mark |
| << std::dec << ", " << servers.size() << ", " << name << ")"; |
| |
| const NetworkType networkType = resolv_get_network_types_for_net(netId); |
| const PrivateDnsStatus status = getStatusLocked(netId); |
| |
| // Sort the input servers to prefer IPv6. |
| const std::vector<std::string> sortedServers = sortServers(servers); |
| |
| const auto& doh = makeDohIdentity(sortedServers, name, dohParams); |
| if (!doh.ok()) { |
| LOG(INFO) << __func__ << ": No suitable DoH server found"; |
| clearDoh(netId); |
| return 0; |
| } |
| |
| initDohLocked(); |
| |
| auto it = mDohTracker.find(netId); |
| // Skip if the same server already exists and its status == success. |
| if (it != mDohTracker.end() && it->second == doh.value() && |
| it->second.status == Validation::success) { |
| return 0; |
| } |
| const auto& [dohIt, _] = mDohTracker.insert_or_assign(netId, doh.value()); |
| const auto& dohId = dohIt->second; |
| |
| RecordEntry record(netId, {IPSockAddr::toIPSockAddr(dohId.ipAddr, kDohPort), name}, |
| dohId.status); |
| mPrivateDnsLog.push(std::move(record)); |
| LOG(INFO) << __func__ << ": Upgrading server to DoH: " << name; |
| resolv_stats_set_addrs(netId, PROTO_DOH, {dohId.ipAddr}, kDohPort); |
| |
| const FeatureFlags flags = makeDohFeatureFlags(); |
| LOG(DEBUG) << __func__ << ": " << toString(flags); |
| |
| const PrivateDnsModes privateDnsMode = convertEnumType(status.mode); |
| return doh_net_new(mDohDispatcher, netId, dohId.httpsTemplate.c_str(), dohId.host.c_str(), |
| dohId.ipAddr.c_str(), mark, caCert.c_str(), &flags, networkType, |
| privateDnsMode); |
| } |
| |
| void PrivateDnsConfiguration::clearDoh(unsigned netId) { |
| LOG(DEBUG) << "PrivateDnsConfiguration::clearDoh (" << netId << ")"; |
| if (mDohDispatcher != nullptr) doh_net_delete(mDohDispatcher, netId); |
| mDohTracker.erase(netId); |
| resolv_stats_set_addrs(netId, PROTO_DOH, {}, kDohPort); |
| } |
| |
| base::Result<PrivateDnsConfiguration::DohIdentity> PrivateDnsConfiguration::makeDohIdentity( |
| const std::vector<std::string>& servers, const std::string& name, |
| const std::optional<DohParamsParcel> dohParams) const { |
| // 1. Use the DoH servers discovered from DDR. |
| // TODO(b/240259333): check whether dohPath is empty instead of whether dohPath equals to |
| // "/dns-query{?dns}". |
| if (dohParams && !dohParams->ips.empty() && !dohParams->name.empty() && |
| dohParams->dohpath == "/dns-query{?dns}") { |
| // Sort the servers to prefer IPv6. |
| const std::vector<std::string> sortedServers = sortServers(dohParams->ips); |
| return DohIdentity{ |
| .httpsTemplate = fmt::format("https://{}/dns-query", dohParams->name), |
| .ipAddr = sortedServers[0], |
| .host = dohParams->name, |
| .status = Validation::in_process, |
| }; |
| } |
| |
| // 2. If DDR is not supported/enabled (dohParams unset), look up `mAvailableDoHProviders`. |
| if (!dohParams) { |
| for (const auto& entry : mAvailableDoHProviders) { |
| const auto& dohId = entry.getDohIdentity(servers, name); |
| if (!dohId.ok()) continue; |
| |
| // Since the DnsResolver is expected to be configured by the system server, add the |
| // restriction to prevent ResolverTestProvider from being used other than testing. |
| if (entry.requireRootPermission && AIBinder_getCallingUid() != AID_ROOT) continue; |
| |
| return dohId; |
| } |
| } |
| |
| return Errorf("Cannot make a DohIdentity from current DNS configuration"); |
| } |
| |
| ssize_t PrivateDnsConfiguration::dohQuery(unsigned netId, const Slice query, const Slice answer, |
| uint64_t timeoutMs) { |
| { |
| std::lock_guard guard(mPrivateDnsLock); |
| // It's safe because mDohDispatcher won't be deleted after initializing. |
| if (mDohDispatcher == nullptr) return DOH_RESULT_CAN_NOT_SEND; |
| } |
| return doh_query(mDohDispatcher, netId, query.base(), query.size(), answer.base(), |
| answer.size(), timeoutMs); |
| } |
| |
| void PrivateDnsConfiguration::onDohStatusUpdate(uint32_t netId, bool success, const char* ipAddr, |
| const char* host) { |
| LOG(INFO) << __func__ << ": " << netId << ", " << success << ", " << ipAddr << ", " << host; |
| std::lock_guard guard(mPrivateDnsLock); |
| // Update the server status. |
| auto it = mDohTracker.find(netId); |
| if (it == mDohTracker.end() || (it->second.ipAddr != ipAddr && it->second.host != host)) { |
| LOG(WARNING) << __func__ << ": Obsolete event"; |
| return; |
| } |
| Validation status = success ? Validation::success : Validation::fail; |
| it->second.status = status; |
| // Send the events to registered listeners. |
| const ServerIdentity identity = {IPSockAddr::toIPSockAddr(ipAddr, kDohPort), host}; |
| if (needReportEvent(netId, identity, success)) { |
| sendPrivateDnsValidationEvent(identity, netId, success); |
| } |
| // Add log. |
| RecordEntry record(netId, identity, status); |
| mPrivateDnsLog.push(std::move(record)); |
| } |
| |
| bool PrivateDnsConfiguration::needReportEvent(uint32_t netId, ServerIdentity identity, |
| bool success) const { |
| // If the result is success, no concern to report the events. |
| if (success) return true; |
| // If the result is failure, check another transport's status to determine if we should report |
| // the event. |
| switch (identity.sockaddr.port()) { |
| // DoH |
| case kDohPort: { |
| auto netPair = mDotTracker.find(netId); |
| if (netPair == mDotTracker.end()) return true; |
| for (const auto& [id, server] : netPair->second) { |
| if ((identity.sockaddr.ip() == id.sockaddr.ip()) && |
| (identity.sockaddr.port() != id.sockaddr.port()) && |
| (server.validationState() == Validation::success)) { |
| LOG(DEBUG) << __func__ |
| << ": Skip reporting DoH validation failure event, server addr: " |
| << identity.sockaddr.ip().toString(); |
| return false; |
| } |
| } |
| break; |
| } |
| // DoT |
| case kDotPort: { |
| auto it = mDohTracker.find(netId); |
| if (it == mDohTracker.end()) return true; |
| if (it->second == identity && it->second.status == Validation::success) { |
| LOG(DEBUG) << __func__ |
| << ": Skip reporting DoT validation failure event, server addr: " |
| << identity.sockaddr.ip().toString(); |
| return false; |
| } |
| break; |
| } |
| } |
| return true; |
| } |
| |
| } // namespace net |
| } // namespace android |
