1 /**
2  * Copyright (c) 2019, The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *     http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #define LOG_TAG "resolv"
18 
19 #include "DnsResolverService.h"
20 
21 #include <set>
22 #include <vector>
23 
24 #include <BinderUtil.h>
25 #include <android-base/stringprintf.h>
26 #include <android-base/strings.h>
27 #include <android/binder_manager.h>
28 #include <android/binder_process.h>
29 #include <netdutils/DumpWriter.h>
30 #include <private/android_filesystem_config.h>  // AID_SYSTEM
31 
32 #include "DnsResolver.h"
33 #include "Experiments.h"
34 #include "NetdPermissions.h"  // PERM_*
35 #include "ResolverEventReporter.h"
36 #include "resolv_cache.h"
37 
38 using aidl::android::net::ResolverParamsParcel;
39 using android::base::Join;
40 using android::base::StringPrintf;
41 using android::netdutils::DumpWriter;
42 using android::netdutils::IPPrefix;
43 
44 namespace android {
45 namespace net {
46 
47 namespace {
48 
49 #define ENFORCE_ANY_PERMISSION(...)                                      \
50     do {                                                                 \
51         ::ndk::ScopedAStatus status = checkAnyPermission({__VA_ARGS__}); \
52         if (!status.isOk()) {                                            \
53             return status;                                               \
54         }                                                                \
55     } while (0)
56 
57 #define ENFORCE_INTERNAL_PERMISSIONS() \
58     ENFORCE_ANY_PERMISSION(PERM_CONNECTIVITY_INTERNAL, PERM_MAINLINE_NETWORK_STACK)
59 
60 #define ENFORCE_NETWORK_STACK_PERMISSIONS() \
61     ENFORCE_ANY_PERMISSION(PERM_NETWORK_STACK, PERM_MAINLINE_NETWORK_STACK)
62 
statusFromErrcode(int ret)63 inline ::ndk::ScopedAStatus statusFromErrcode(int ret) {
64     if (ret) {
65         return ::ndk::ScopedAStatus(
66                 AStatus_fromServiceSpecificErrorWithMessage(-ret, strerror(-ret)));
67     }
68     return ::ndk::ScopedAStatus(AStatus_newOk());
69 }
70 
71 }  // namespace
72 
DnsResolverService()73 DnsResolverService::DnsResolverService() {
74     // register log callback to BnDnsResolver::logFunc
75     BnDnsResolver::logFunc =
76             std::bind(binderCallLogFn, std::placeholders::_1,
77                       [](const std::string& msg) { gResNetdCallbacks.log(msg.c_str()); });
78 }
79 
start()80 binder_status_t DnsResolverService::start() {
81     // TODO: Add disableBackgroundScheduling(true) after libbinder_ndk support it. b/126506010
82     // NetdNativeService does call disableBackgroundScheduling currently, so it is fine now.
83     std::shared_ptr<DnsResolverService> resolverService =
84             ::ndk::SharedRefBase::make<DnsResolverService>();
85     binder_status_t status =
86             AServiceManager_addService(resolverService->asBinder().get(), getServiceName());
87     if (status != STATUS_OK) {
88         return status;
89     }
90 
91     ABinderProcess_startThreadPool();
92 
93     // TODO: register log callback if binder NDK backend support it. b/126501406
94 
95     return STATUS_OK;
96 }
97 
dump(int fd,const char ** args,uint32_t numArgs)98 binder_status_t DnsResolverService::dump(int fd, const char** args, uint32_t numArgs) {
99     auto dump_permission = checkAnyPermission({PERM_DUMP});
100     if (!dump_permission.isOk()) {
101         return STATUS_PERMISSION_DENIED;
102     }
103 
104     // This method does not grab any locks. If individual classes need locking
105     // their dump() methods MUST handle locking appropriately.
106     DumpWriter dw(fd);
107 
108     if (numArgs == 1 && std::string(args[0]) == DnsQueryLog::DUMP_KEYWORD) {
109         dw.blankline();
110         gDnsResolv->dnsQueryLog().dump(dw);
111         dw.blankline();
112         return STATUS_OK;
113     }
114 
115     for (auto netId : resolv_list_caches()) {
116         dw.println("NetId: %u", netId);
117         gDnsResolv->resolverCtrl.dump(dw, netId);
118         dw.blankline();
119     }
120     Experiments::getInstance()->dump(dw);
121     return STATUS_OK;
122 }
123 
isAlive(bool * alive)124 ::ndk::ScopedAStatus DnsResolverService::isAlive(bool* alive) {
125     ENFORCE_INTERNAL_PERMISSIONS();
126 
127     *alive = true;
128 
129     return ::ndk::ScopedAStatus(AStatus_newOk());
130 }
131 
registerEventListener(const std::shared_ptr<aidl::android::net::metrics::INetdEventListener> & listener)132 ::ndk::ScopedAStatus DnsResolverService::registerEventListener(
133         const std::shared_ptr<aidl::android::net::metrics::INetdEventListener>& listener) {
134     ENFORCE_NETWORK_STACK_PERMISSIONS();
135 
136     int res = ResolverEventReporter::getInstance().addListener(listener);
137 
138     return statusFromErrcode(res);
139 }
140 
checkAnyPermission(const std::vector<const char * > & permissions)141 ::ndk::ScopedAStatus DnsResolverService::checkAnyPermission(
142         const std::vector<const char*>& permissions) {
143     // TODO: Remove callback and move this to unnamed namespace after libbiner_ndk supports
144     // check_permission.
145     if (!gResNetdCallbacks.check_calling_permission) {
146         return ::ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(
147                 EX_NULL_POINTER, "check_calling_permission is null"));
148     }
149     pid_t pid = AIBinder_getCallingPid();
150     uid_t uid = AIBinder_getCallingUid();
151 
152     // If the caller is the system UID, don't check permissions.
153     // Otherwise, if the system server's binder thread pool is full, and all the threads are
154     // blocked on a thread that's waiting for us to complete, we deadlock. http://b/69389492
155     //
156     // From a security perspective, there is currently no difference, because:
157     // 1. The only permissions we check in netd's binder interface are CONNECTIVITY_INTERNAL
158     //    and NETWORK_STACK, which the system server always has (or MAINLINE_NETWORK_STACK, which
159     //    is equivalent to having both CONNECTIVITY_INTERNAL and NETWORK_STACK).
160     // 2. AID_SYSTEM always has all permissions. See ActivityManager#checkComponentPermission.
161     if (uid == AID_SYSTEM) {
162         return ::ndk::ScopedAStatus(AStatus_newOk());
163     }
164 
165     for (const char* permission : permissions) {
166         if (gResNetdCallbacks.check_calling_permission(permission)) {
167             return ::ndk::ScopedAStatus(AStatus_newOk());
168         }
169     }
170 
171     auto err = StringPrintf("UID %d / PID %d does not have any of the following permissions: %s",
172                             uid, pid, Join(permissions, ',').c_str());
173     return ::ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(EX_SECURITY, err.c_str()));
174 }
175 
setResolverConfiguration(const ResolverParamsParcel & resolverParams)176 ::ndk::ScopedAStatus DnsResolverService::setResolverConfiguration(
177         const ResolverParamsParcel& resolverParams) {
178     // Locking happens in PrivateDnsConfiguration and res_* functions.
179     ENFORCE_INTERNAL_PERMISSIONS();
180 
181     // TODO@: Switch to selinux based permission check if AIBinder_getCallingSid and
182     //        AIBinder_setRequestingSid can be supported by libbinder_dnk (b/159135973).
183     uid_t uid = AIBinder_getCallingUid();
184     // CAUTION: caCertificate should NOT be used except for internal testing.
185     if (resolverParams.caCertificate.size() != 0 && uid != AID_ROOT) {
186         auto err = StringPrintf("UID %d is not authorized to set a non-empty CA certificate", uid);
187         return ::ndk::ScopedAStatus(AStatus_fromExceptionCodeWithMessage(EX_SECURITY, err.c_str()));
188     }
189 
190     // TODO: Remove this log after AIDL gen_log supporting more types, b/129732660
191     auto entry =
192             gDnsResolverLog.newEntry()
193                     .prettyFunction(__PRETTY_FUNCTION__)
194                     .args(resolverParams.netId, resolverParams.servers, resolverParams.domains,
195                           resolverParams.sampleValiditySeconds, resolverParams.successThreshold,
196                           resolverParams.minSamples, resolverParams.maxSamples,
197                           resolverParams.baseTimeoutMsec, resolverParams.retryCount,
198                           resolverParams.tlsName, resolverParams.tlsServers);
199 
200     int res = gDnsResolv->resolverCtrl.setResolverConfiguration(resolverParams);
201     gResNetdCallbacks.log(entry.returns(res).withAutomaticDuration().toString().c_str());
202 
203     return statusFromErrcode(res);
204 }
205 
getResolverInfo(int32_t netId,std::vector<std::string> * servers,std::vector<std::string> * domains,std::vector<std::string> * tlsServers,std::vector<int32_t> * params,std::vector<int32_t> * stats,std::vector<int32_t> * wait_for_pending_req_timeout_count)206 ::ndk::ScopedAStatus DnsResolverService::getResolverInfo(
207         int32_t netId, std::vector<std::string>* servers, std::vector<std::string>* domains,
208         std::vector<std::string>* tlsServers, std::vector<int32_t>* params,
209         std::vector<int32_t>* stats, std::vector<int32_t>* wait_for_pending_req_timeout_count) {
210     // Locking happens in PrivateDnsConfiguration and res_* functions.
211     ENFORCE_NETWORK_STACK_PERMISSIONS();
212 
213     int res = gDnsResolv->resolverCtrl.getResolverInfo(netId, servers, domains, tlsServers, params,
214                                                        stats, wait_for_pending_req_timeout_count);
215 
216     return statusFromErrcode(res);
217 }
218 
startPrefix64Discovery(int32_t netId)219 ::ndk::ScopedAStatus DnsResolverService::startPrefix64Discovery(int32_t netId) {
220     // Locking happens in Dns64Configuration.
221     ENFORCE_NETWORK_STACK_PERMISSIONS();
222 
223     gDnsResolv->resolverCtrl.startPrefix64Discovery(netId);
224 
225     return ::ndk::ScopedAStatus(AStatus_newOk());
226 }
227 
stopPrefix64Discovery(int32_t netId)228 ::ndk::ScopedAStatus DnsResolverService::stopPrefix64Discovery(int32_t netId) {
229     // Locking happens in Dns64Configuration.
230     ENFORCE_NETWORK_STACK_PERMISSIONS();
231 
232     gDnsResolv->resolverCtrl.stopPrefix64Discovery(netId);
233 
234     return ::ndk::ScopedAStatus(AStatus_newOk());
235 }
236 
getPrefix64(int netId,std::string * stringPrefix)237 ::ndk::ScopedAStatus DnsResolverService::getPrefix64(int netId, std::string* stringPrefix) {
238     ENFORCE_NETWORK_STACK_PERMISSIONS();
239 
240     netdutils::IPPrefix prefix{};
241     int res = gDnsResolv->resolverCtrl.getPrefix64(netId, &prefix);
242     *stringPrefix = prefix.toString();
243 
244     return statusFromErrcode(res);
245 }
246 
setPrefix64(int netId,const std::string & stringPrefix)247 ::ndk::ScopedAStatus DnsResolverService::setPrefix64(int netId, const std::string& stringPrefix) {
248     ENFORCE_NETWORK_STACK_PERMISSIONS();
249 
250     if (stringPrefix.empty()) {
251         return statusFromErrcode(gDnsResolv->resolverCtrl.clearPrefix64(netId));
252     }
253 
254     IPPrefix prefix;
255     if (!IPPrefix::forString(stringPrefix, &prefix)) {
256         return statusFromErrcode(-EINVAL);
257     }
258 
259     return statusFromErrcode(gDnsResolv->resolverCtrl.setPrefix64(netId, prefix));
260 }
261 
setLogSeverity(int32_t logSeverity)262 ::ndk::ScopedAStatus DnsResolverService::setLogSeverity(int32_t logSeverity) {
263     ENFORCE_NETWORK_STACK_PERMISSIONS();
264 
265     int res = gDnsResolv->setLogSeverity(logSeverity);
266 
267     return statusFromErrcode(res);
268 }
269 
destroyNetworkCache(int netId)270 ::ndk::ScopedAStatus DnsResolverService::destroyNetworkCache(int netId) {
271     // Locking happens in res_cache.cpp functions.
272     ENFORCE_NETWORK_STACK_PERMISSIONS();
273 
274     gDnsResolv->resolverCtrl.destroyNetworkCache(netId);
275     Experiments::getInstance()->update();
276     return ::ndk::ScopedAStatus(AStatus_newOk());
277 }
278 
createNetworkCache(int netId)279 ::ndk::ScopedAStatus DnsResolverService::createNetworkCache(int netId) {
280     // Locking happens in res_cache.cpp functions.
281     ENFORCE_NETWORK_STACK_PERMISSIONS();
282 
283     int res = gDnsResolv->resolverCtrl.createNetworkCache(netId);
284     Experiments::getInstance()->update();
285     return statusFromErrcode(res);
286 }
287 
flushNetworkCache(int netId)288 ::ndk::ScopedAStatus DnsResolverService::flushNetworkCache(int netId) {
289     // Locking happens in res_cache.cpp functions.
290     ENFORCE_NETWORK_STACK_PERMISSIONS();
291 
292     int res = gDnsResolv->resolverCtrl.flushNetworkCache(netId);
293 
294     return statusFromErrcode(res);
295 }
296 
297 }  // namespace net
298 }  // namespace android
299