1 /*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "resolv"
18
19 #include "DnsTlsDispatcher.h"
20
21 #include <netdutils/Stopwatch.h>
22
23 #include "DnsTlsSocketFactory.h"
24 #include "resolv_cache.h"
25 #include "resolv_private.h"
26 #include "stats.pb.h"
27
28 #include <android-base/logging.h>
29
30 namespace android {
31 namespace net {
32
33 using android::netdutils::IPSockAddr;
34 using android::netdutils::Stopwatch;
35 using netdutils::Slice;
36
37 // static
38 std::mutex DnsTlsDispatcher::sLock;
39
DnsTlsDispatcher()40 DnsTlsDispatcher::DnsTlsDispatcher() {
41 mFactory.reset(new DnsTlsSocketFactory());
42 }
43
getOrderedServerList(const std::list<DnsTlsServer> & tlsServers,unsigned mark) const44 std::list<DnsTlsServer> DnsTlsDispatcher::getOrderedServerList(
45 const std::list<DnsTlsServer> &tlsServers, unsigned mark) const {
46 // Our preferred DnsTlsServer order is:
47 // 1) reuse existing IPv6 connections
48 // 2) reuse existing IPv4 connections
49 // 3) establish new IPv6 connections
50 // 4) establish new IPv4 connections
51 std::list<DnsTlsServer> existing6;
52 std::list<DnsTlsServer> existing4;
53 std::list<DnsTlsServer> new6;
54 std::list<DnsTlsServer> new4;
55
56 // Pull out any servers for which we might have existing connections and
57 // place them at the from the list of servers to try.
58 {
59 std::lock_guard guard(sLock);
60
61 for (const auto& tlsServer : tlsServers) {
62 const Key key = std::make_pair(mark, tlsServer);
63 if (mStore.find(key) != mStore.end()) {
64 switch (tlsServer.ss.ss_family) {
65 case AF_INET:
66 existing4.push_back(tlsServer);
67 break;
68 case AF_INET6:
69 existing6.push_back(tlsServer);
70 break;
71 }
72 } else {
73 switch (tlsServer.ss.ss_family) {
74 case AF_INET:
75 new4.push_back(tlsServer);
76 break;
77 case AF_INET6:
78 new6.push_back(tlsServer);
79 break;
80 }
81 }
82 }
83 }
84
85 auto& out = existing6;
86 out.splice(out.cend(), existing4);
87 out.splice(out.cend(), new6);
88 out.splice(out.cend(), new4);
89 return out;
90 }
91
query(const std::list<DnsTlsServer> & tlsServers,res_state statp,const Slice query,const Slice ans,int * resplen)92 DnsTlsTransport::Response DnsTlsDispatcher::query(const std::list<DnsTlsServer>& tlsServers,
93 res_state statp, const Slice query,
94 const Slice ans, int* resplen) {
95 const std::list<DnsTlsServer> orderedServers(getOrderedServerList(tlsServers, statp->_mark));
96
97 if (orderedServers.empty()) LOG(WARNING) << "Empty DnsTlsServer list";
98
99 DnsTlsTransport::Response code = DnsTlsTransport::Response::internal_error;
100 int serverCount = 0;
101 for (const auto& server : orderedServers) {
102 DnsQueryEvent* dnsQueryEvent =
103 statp->event->mutable_dns_query_events()->add_dns_query_event();
104
105 bool connectTriggered = false;
106 Stopwatch queryStopwatch;
107 code = this->query(server, statp->_mark, query, ans, resplen, &connectTriggered);
108
109 dnsQueryEvent->set_latency_micros(saturate_cast<int32_t>(queryStopwatch.timeTakenUs()));
110 dnsQueryEvent->set_dns_server_index(serverCount++);
111 dnsQueryEvent->set_ip_version(ipFamilyToIPVersion(server.ss.ss_family));
112 dnsQueryEvent->set_protocol(PROTO_DOT);
113 dnsQueryEvent->set_type(getQueryType(query.base(), query.size()));
114 dnsQueryEvent->set_connected(connectTriggered);
115
116 switch (code) {
117 // These response codes are valid responses and not expected to
118 // change if another server is queried.
119 case DnsTlsTransport::Response::success:
120 dnsQueryEvent->set_rcode(
121 static_cast<NsRcode>(reinterpret_cast<HEADER*>(ans.base())->rcode));
122 resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent);
123 return code;
124 case DnsTlsTransport::Response::limit_error:
125 dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR);
126 resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent);
127 return code;
128 // These response codes might differ when trying other servers, so
129 // keep iterating to see if we can get a different (better) result.
130 case DnsTlsTransport::Response::network_error:
131 // Sync from res_tls_send in res_send.cpp
132 dnsQueryEvent->set_rcode(NS_R_TIMEOUT);
133 resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent);
134 break;
135 case DnsTlsTransport::Response::internal_error:
136 dnsQueryEvent->set_rcode(NS_R_INTERNAL_ERROR);
137 resolv_stats_add(statp->netid, IPSockAddr::toIPSockAddr(server.ss), dnsQueryEvent);
138 break;
139 // No "default" statement.
140 }
141 }
142
143 return code;
144 }
145
query(const DnsTlsServer & server,unsigned mark,const Slice query,const Slice ans,int * resplen,bool * connectTriggered)146 DnsTlsTransport::Response DnsTlsDispatcher::query(const DnsTlsServer& server, unsigned mark,
147 const Slice query, const Slice ans, int* resplen,
148 bool* connectTriggered) {
149 // TODO: This can cause the resolver to create multiple connections to the same DoT server
150 // merely due to different mark, such as the bit explicitlySelected unset.
151 // See if we can save them and just create one connection for one DoT server.
152 const Key key = std::make_pair(mark, server);
153 Transport* xport;
154 {
155 std::lock_guard guard(sLock);
156 auto it = mStore.find(key);
157 if (it == mStore.end()) {
158 xport = new Transport(server, mark, mFactory.get());
159 mStore[key].reset(xport);
160 } else {
161 xport = it->second.get();
162 }
163 ++xport->useCount;
164 }
165
166 // Don't call this function and hold sLock at the same time because of the following reason:
167 // TLS handshake requires a lock which is also needed by this function, if the handshake gets
168 // stuck, this function also gets blocked.
169 const int connectCounter = xport->transport.getConnectCounter();
170
171 LOG(DEBUG) << "Sending query of length " << query.size();
172 auto res = xport->transport.query(query);
173 LOG(DEBUG) << "Awaiting response";
174 const auto& result = res.get();
175 *connectTriggered = (xport->transport.getConnectCounter() > connectCounter);
176
177 DnsTlsTransport::Response code = result.code;
178 if (code == DnsTlsTransport::Response::success) {
179 if (result.response.size() > ans.size()) {
180 LOG(DEBUG) << "Response too large: " << result.response.size() << " > " << ans.size();
181 code = DnsTlsTransport::Response::limit_error;
182 } else {
183 LOG(DEBUG) << "Got response successfully";
184 *resplen = result.response.size();
185 netdutils::copy(ans, netdutils::makeSlice(result.response));
186 }
187 } else {
188 LOG(DEBUG) << "Query failed: " << (unsigned int)code;
189 }
190
191 auto now = std::chrono::steady_clock::now();
192 {
193 std::lock_guard guard(sLock);
194 --xport->useCount;
195 xport->lastUsed = now;
196 cleanup(now);
197 }
198 return code;
199 }
200
201 // This timeout effectively controls how long to keep SSL session tickets.
202 static constexpr std::chrono::minutes IDLE_TIMEOUT(5);
cleanup(std::chrono::time_point<std::chrono::steady_clock> now)203 void DnsTlsDispatcher::cleanup(std::chrono::time_point<std::chrono::steady_clock> now) {
204 // To avoid scanning mStore after every query, return early if a cleanup has been
205 // performed recently.
206 if (now - mLastCleanup < IDLE_TIMEOUT) {
207 return;
208 }
209 for (auto it = mStore.begin(); it != mStore.end();) {
210 auto& s = it->second;
211 if (s->useCount == 0 && now - s->lastUsed > IDLE_TIMEOUT) {
212 it = mStore.erase(it);
213 } else {
214 ++it;
215 }
216 }
217 mLastCleanup = now;
218 }
219
220 } // end of namespace net
221 } // end of namespace android
222