/*
* Copyright (C) 2019 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#define LOG_TAG "ResolverController"
#include "ResolverController.h"
#include <set>
#include <string>
#include <vector>
#include <netdb.h>
#include <aidl/android/net/IDnsResolver.h>
#include <android-base/logging.h>
#include <android-base/strings.h>
#include "Dns64Configuration.h"
#include "DnsResolver.h"
#include "Fwmark.h"
#include "PrivateDnsConfiguration.h"
#include "ResolverEventReporter.h"
#include "ResolverStats.h"
#include "netd_resolv/stats.h"
#include "resolv_cache.h"
using namespace std::placeholders;
using aidl::android::net::ResolverParamsParcel;
namespace android {
using netdutils::DumpWriter;
namespace net {
namespace {
std::string addrToString(const sockaddr_storage* addr) {
char out[INET6_ADDRSTRLEN] = {0};
getnameinfo((const sockaddr*)addr, sizeof(sockaddr_storage), out, INET6_ADDRSTRLEN, nullptr, 0,
NI_NUMERICHOST);
return std::string(out);
}
const char* getPrivateDnsModeString(PrivateDnsMode mode) {
switch (mode) {
case PrivateDnsMode::OFF:
return "OFF";
case PrivateDnsMode::OPPORTUNISTIC:
return "OPPORTUNISTIC";
case PrivateDnsMode::STRICT:
return "STRICT";
}
}
constexpr const char* validationStatusToString(Validation value) {
switch (value) {
case Validation::in_process:
return "in_process";
case Validation::success:
return "success";
case Validation::fail:
return "fail";
case Validation::unknown_server:
return "unknown_server";
case Validation::unknown_netid:
return "unknown_netid";
default:
return "unknown_status";
}
}
void sendNat64PrefixEvent(const Dns64Configuration::Nat64PrefixInfo& args) {
const auto& listeners = ResolverEventReporter::getInstance().getListeners();
if (listeners.size() == 0) {
LOG(ERROR) << __func__ << ": No available listener. dropping NAT64 prefix event";
return;
}
for (const auto& it : listeners) {
it->onNat64PrefixEvent(args.netId, args.added, args.prefixString, args.prefixLength);
}
}
int getDnsInfo(unsigned netId, std::vector<std::string>* servers, std::vector<std::string>* domains,
res_params* params, std::vector<android::net::ResolverStats>* stats,
std::vector<int32_t>* wait_for_pending_req_timeout_count) {
using aidl::android::net::IDnsResolver;
using android::net::ResolverStats;
static_assert(ResolverStats::STATS_SUCCESSES == IDnsResolver::RESOLVER_STATS_SUCCESSES &&
ResolverStats::STATS_ERRORS == IDnsResolver::RESOLVER_STATS_ERRORS &&
ResolverStats::STATS_TIMEOUTS == IDnsResolver::RESOLVER_STATS_TIMEOUTS &&
ResolverStats::STATS_INTERNAL_ERRORS ==
IDnsResolver::RESOLVER_STATS_INTERNAL_ERRORS &&
ResolverStats::STATS_RTT_AVG == IDnsResolver::RESOLVER_STATS_RTT_AVG &&
ResolverStats::STATS_LAST_SAMPLE_TIME ==
IDnsResolver::RESOLVER_STATS_LAST_SAMPLE_TIME &&
ResolverStats::STATS_USABLE == IDnsResolver::RESOLVER_STATS_USABLE &&
ResolverStats::STATS_COUNT == IDnsResolver::RESOLVER_STATS_COUNT,
"AIDL and ResolverStats.h out of sync");
int nscount = -1;
sockaddr_storage res_servers[MAXNS];
int dcount = -1;
char res_domains[MAXDNSRCH][MAXDNSRCHPATH];
res_stats res_stats[MAXNS];
servers->clear();
domains->clear();
*params = res_params{};
stats->clear();
int res_wait_for_pending_req_timeout_count;
int revision_id = android_net_res_stats_get_info_for_net(
netId, &nscount, res_servers, &dcount, res_domains, params, res_stats,
&res_wait_for_pending_req_timeout_count);
// If the netId is unknown (which can happen for valid net IDs for which no DNS servers have
// yet been configured), there is no revision ID. In this case there is no data to return.
if (revision_id < 0) {
return 0;
}
// Verify that the returned data is sane.
if (nscount < 0 || nscount > MAXNS || dcount < 0 || dcount > MAXDNSRCH) {
LOG(ERROR) << __func__ << ": nscount = " << nscount << ", dcount = " << dcount;
return -ENOTRECOVERABLE;
}
// Determine which servers are considered usable by the resolver.
bool valid_servers[MAXNS];
std::fill_n(valid_servers, MAXNS, false);
android_net_res_stats_get_usable_servers(params, res_stats, nscount, valid_servers);
// Convert the server sockaddr structures to std::string.
stats->resize(nscount);
for (int i = 0; i < nscount; ++i) {
char hbuf[NI_MAXHOST];
int rv =
getnameinfo(reinterpret_cast<const sockaddr*>(&res_servers[i]),
sizeof(res_servers[i]), hbuf, sizeof(hbuf), nullptr, 0, NI_NUMERICHOST);
std::string server_str;
if (rv == 0) {
server_str.assign(hbuf);
} else {
LOG(ERROR) << "getnameinfo() failed for server #" << i << ": " << gai_strerror(rv);
server_str.assign("<invalid>");
}
servers->push_back(std::move(server_str));
android::net::ResolverStats& cur_stats = (*stats)[i];
android_net_res_stats_aggregate(&res_stats[i], &cur_stats.successes, &cur_stats.errors,
&cur_stats.timeouts, &cur_stats.internal_errors,
&cur_stats.rtt_avg, &cur_stats.last_sample_time);
cur_stats.usable = valid_servers[i];
}
// Convert the stack-allocated search domain strings to std::string.
for (int i = 0; i < dcount; ++i) {
domains->push_back(res_domains[i]);
}
(*wait_for_pending_req_timeout_count)[0] = res_wait_for_pending_req_timeout_count;
return 0;
}
} // namespace
ResolverController::ResolverController()
: mDns64Configuration(
[](uint32_t netId, uint32_t uid, android_net_context* netcontext) {
gResNetdCallbacks.get_network_context(netId, uid, netcontext);
},
std::bind(sendNat64PrefixEvent, _1)) {}
void ResolverController::destroyNetworkCache(unsigned netId) {
LOG(VERBOSE) << __func__ << ": netId = " << netId;
resolv_delete_cache_for_net(netId);
mDns64Configuration.stopPrefixDiscovery(netId);
gPrivateDnsConfiguration.clear(netId);
}
int ResolverController::createNetworkCache(unsigned netId) {
LOG(VERBOSE) << __func__ << ": netId = " << netId;
return resolv_create_cache_for_net(netId);
}
int ResolverController::setResolverConfiguration(
const ResolverParamsParcel& resolverParams,
const std::set<std::vector<uint8_t>>& tlsFingerprints) {
using aidl::android::net::IDnsResolver;
// At private DNS validation time, we only know the netId, so we have to guess/compute the
// corresponding socket mark.
Fwmark fwmark;
fwmark.netId = resolverParams.netId;
fwmark.explicitlySelected = true;
fwmark.protectedFromVpn = true;
fwmark.permission = PERMISSION_SYSTEM;
// Allow at most MAXNS private DNS servers in a network to prevent too many broken servers.
std::vector<std::string> tlsServers = resolverParams.tlsServers;
if (tlsServers.size() > MAXNS) {
tlsServers.resize(MAXNS);
}
const int err = gPrivateDnsConfiguration.set(resolverParams.netId, fwmark.intValue, tlsServers,
resolverParams.tlsName, tlsFingerprints);
if (err != 0) {
return err;
}
// Convert network-assigned server list to bionic's format.
const size_t serverCount = std::min<size_t>(MAXNS, resolverParams.servers.size());
std::vector<const char*> server_ptrs;
for (size_t i = 0; i < serverCount; ++i) {
server_ptrs.push_back(resolverParams.servers[i].c_str());
}
std::string domains_str = android::base::Join(resolverParams.domains, " ");
// TODO: Change resolv_set_nameservers_for_net() to use ResolverParamsParcel directly.
res_params res_params = {};
res_params.sample_validity = resolverParams.sampleValiditySeconds;
res_params.success_threshold = resolverParams.successThreshold;
res_params.min_samples = resolverParams.minSamples;
res_params.max_samples = resolverParams.maxSamples;
res_params.base_timeout_msec = resolverParams.baseTimeoutMsec;
res_params.retry_count = resolverParams.retryCount;
LOG(VERBOSE) << "setDnsServers netId = " << resolverParams.netId
<< ", numservers = " << resolverParams.domains.size();
return -resolv_set_nameservers_for_net(resolverParams.netId, server_ptrs.data(),
server_ptrs.size(), domains_str.c_str(), &res_params);
}
int ResolverController::getResolverInfo(int32_t netId, std::vector<std::string>* servers,
std::vector<std::string>* domains,
std::vector<std::string>* tlsServers,
std::vector<int32_t>* params, std::vector<int32_t>* stats,
std::vector<int32_t>* wait_for_pending_req_timeout_count) {
using aidl::android::net::IDnsResolver;
using android::net::ResolverStats;
res_params res_params;
std::vector<ResolverStats> res_stats;
int ret = getDnsInfo(netId, servers, domains, &res_params, &res_stats,
wait_for_pending_req_timeout_count);
if (ret != 0) {
return ret;
}
// Serialize the information for binder.
ResolverStats::encodeAll(res_stats, stats);
ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
gPrivateDnsConfiguration.getStatus(netId, &privateDnsStatus);
for (int i = 0; i < privateDnsStatus.numServers; i++) {
std::string tlsServer_str = addrToString(&(privateDnsStatus.serverStatus[i].ss));
tlsServers->push_back(std::move(tlsServer_str));
}
params->resize(IDnsResolver::RESOLVER_PARAMS_COUNT);
(*params)[IDnsResolver::RESOLVER_PARAMS_SAMPLE_VALIDITY] = res_params.sample_validity;
(*params)[IDnsResolver::RESOLVER_PARAMS_SUCCESS_THRESHOLD] = res_params.success_threshold;
(*params)[IDnsResolver::RESOLVER_PARAMS_MIN_SAMPLES] = res_params.min_samples;
(*params)[IDnsResolver::RESOLVER_PARAMS_MAX_SAMPLES] = res_params.max_samples;
(*params)[IDnsResolver::RESOLVER_PARAMS_BASE_TIMEOUT_MSEC] = res_params.base_timeout_msec;
(*params)[IDnsResolver::RESOLVER_PARAMS_RETRY_COUNT] = res_params.retry_count;
return 0;
}
void ResolverController::startPrefix64Discovery(int32_t netId) {
mDns64Configuration.startPrefixDiscovery(netId);
}
void ResolverController::stopPrefix64Discovery(int32_t netId) {
return mDns64Configuration.stopPrefixDiscovery(netId);
}
// TODO: use StatusOr<T> to wrap the result.
int ResolverController::getPrefix64(unsigned netId, netdutils::IPPrefix* prefix) {
netdutils::IPPrefix p = mDns64Configuration.getPrefix64(netId);
if (p.family() != AF_INET6 || p.length() == 0) {
LOG(ERROR) << "No valid NAT64 prefix (" << netId << ", " << p.toString().c_str() << ")";
return -ENOENT;
}
*prefix = p;
return 0;
}
void ResolverController::dump(DumpWriter& dw, unsigned netId) {
// No lock needed since Bionic's resolver locks all accessed data structures internally.
using android::net::ResolverStats;
std::vector<std::string> servers;
std::vector<std::string> domains;
res_params params = {};
std::vector<ResolverStats> stats;
std::vector<int32_t> wait_for_pending_req_timeout_count(1, 0);
time_t now = time(nullptr);
int rv = getDnsInfo(netId, &servers, &domains, ¶ms, &stats,
&wait_for_pending_req_timeout_count);
dw.incIndent();
if (rv != 0) {
dw.println("getDnsInfo() failed for netid %u", netId);
} else {
if (servers.empty()) {
dw.println("No DNS servers defined");
} else {
dw.println(
"DNS servers: # IP (total, successes, errors, timeouts, internal errors, "
"RTT avg, last sample)");
dw.incIndent();
for (size_t i = 0; i < servers.size(); ++i) {
if (i < stats.size()) {
const ResolverStats& s = stats[i];
int total = s.successes + s.errors + s.timeouts + s.internal_errors;
if (total > 0) {
int time_delta = (s.last_sample_time > 0) ? now - s.last_sample_time : -1;
dw.println("%s (%d, %d, %d, %d, %d, %dms, %ds)%s", servers[i].c_str(),
total, s.successes, s.errors, s.timeouts, s.internal_errors,
s.rtt_avg, time_delta, s.usable ? "" : " BROKEN");
} else {
dw.println("%s <no data>", servers[i].c_str());
}
} else {
dw.println("%s <no stats>", servers[i].c_str());
}
}
dw.decIndent();
}
if (domains.empty()) {
dw.println("No search domains defined");
} else {
std::string domains_str = android::base::Join(domains, ", ");
dw.println("search domains: %s", domains_str.c_str());
}
if (params.sample_validity != 0) {
dw.println(
"DNS parameters: sample validity = %us, success threshold = %u%%, "
"samples (min, max) = (%u, %u), base_timeout = %dmsec, retry count = "
"%dtimes",
params.sample_validity, params.success_threshold, params.min_samples,
params.max_samples, params.base_timeout_msec, params.retry_count);
}
mDns64Configuration.dump(dw, netId);
ExternalPrivateDnsStatus privateDnsStatus = {PrivateDnsMode::OFF, 0, {}};
gPrivateDnsConfiguration.getStatus(netId, &privateDnsStatus);
dw.println("Private DNS mode: %s",
getPrivateDnsModeString(static_cast<PrivateDnsMode>(privateDnsStatus.mode)));
if (!privateDnsStatus.numServers) {
dw.println("No Private DNS servers configured");
} else {
dw.println("Private DNS configuration (%u entries)", privateDnsStatus.numServers);
dw.incIndent();
for (int i = 0; i < privateDnsStatus.numServers; i++) {
dw.println("%s name{%s} status{%s}",
addrToString(&(privateDnsStatus.serverStatus[i].ss)).c_str(),
privateDnsStatus.serverStatus[i].hostname,
validationStatusToString(static_cast<Validation>(
privateDnsStatus.serverStatus[i].validation)));
}
dw.decIndent();
}
dw.println("Concurrent DNS query timeout: %d", wait_for_pending_req_timeout_count[0]);
}
dw.decIndent();
}
} // namespace net
} // namespace android