1 /*
2  * Copyright (C) 2019 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  *
16  */
17 
18 #define LOG_TAG "resolv_gold_test"
19 
20 #include <Fwmark.h>
21 #include <android-base/chrono_utils.h>
22 #include <android-base/file.h>
23 #include <android-base/logging.h>
24 #include <android-base/result.h>
25 #include <android-base/stringprintf.h>
26 #include <gmock/gmock-matchers.h>
27 #include <gtest/gtest.h>
28 
29 #include "PrivateDnsConfiguration.h"
30 #include "getaddrinfo.h"
31 #include "gethnamaddr.h"
32 #include "golddata.pb.h"
33 #include "resolv_cache.h"
34 #include "resolv_test_utils.h"
35 #include "tests/dns_responder/dns_responder.h"
36 #include "tests/dns_responder/dns_responder_client_ndk.h"
37 #include "tests/dns_responder/dns_tls_certificate.h"
38 #include "tests/dns_responder/dns_tls_frontend.h"
39 
40 namespace android::net {
41 
42 using android::base::Result;
43 using android::base::StringPrintf;
44 using android::netdutils::ScopedAddrinfo;
45 using std::chrono::milliseconds;
46 
47 enum class DnsProtocol { CLEARTEXT, TLS };
48 
49 // The buffer size of resolv_gethostbyname().
50 // TODO: Consider moving to packages/modules/DnsResolver/tests/resolv_test_utils.h.
51 constexpr unsigned int MAXPACKET = 8 * 1024;
52 
53 // The testdata/*.pb are generated from testdata/*.pbtext.
54 const std::string kTestDataPath = android::base::GetExecutableDirectory() + "/testdata/";
55 const std::vector<std::string> kGoldFilesGetAddrInfo = {
56         "getaddrinfo.topsite.google.pb",    "getaddrinfo.topsite.youtube.pb",
57         "getaddrinfo.topsite.amazon.pb",    "getaddrinfo.topsite.yahoo.pb",
58         "getaddrinfo.topsite.facebook.pb",  "getaddrinfo.topsite.reddit.pb",
59         "getaddrinfo.topsite.wikipedia.pb", "getaddrinfo.topsite.ebay.pb",
60         "getaddrinfo.topsite.netflix.pb",   "getaddrinfo.topsite.bing.pb"};
61 const std::vector<std::string> kGoldFilesGetAddrInfoTls = {"getaddrinfo.tls.topsite.google.pb"};
62 const std::vector<std::string> kGoldFilesGetHostByName = {"gethostbyname.topsite.youtube.pb"};
63 const std::vector<std::string> kGoldFilesGetHostByNameTls = {
64         "gethostbyname.tls.topsite.youtube.pb"};
65 
66 // Fixture test class definition.
67 class TestBase : public ::testing::Test {
68   protected:
SetUpTestSuite()69     static void SetUpTestSuite() {
70         // Unzip *.pb from pb.zip. The unzipped files get 777 permission by default. Remove execute
71         // permission so that Trade Federation test harness has no chance mis-executing on *.pb.
72         const std::string unzipCmd = "unzip -o " + kTestDataPath + "pb.zip -d " + kTestDataPath +
73                                      "&& chmod -R 666 " + kTestDataPath;
74         // NOLINTNEXTLINE(cert-env33-c)
75         if (W_EXITCODE(0, 0) != system(unzipCmd.c_str())) {
76             LOG(ERROR) << "fail to inflate .pb files";
77             GTEST_LOG_(FATAL) << "fail to inflate .pb files";
78         }
79     }
80 
SetUp()81     void SetUp() override {
82         // Create cache for test
83         resolv_create_cache_for_net(TEST_NETID);
84     }
85 
TearDown()86     void TearDown() override {
87         // Clear TLS configuration for test
88         gPrivateDnsConfiguration.clear(TEST_NETID);
89         // Delete cache for test
90         resolv_delete_cache_for_net(TEST_NETID);
91     }
92 
SetResolverConfiguration(const std::vector<std::string> & servers,const std::vector<std::string> & domains,const std::vector<std::string> & tlsServers={},const std::string & tlsHostname="",const std::string & caCert="")93     void SetResolverConfiguration(const std::vector<std::string>& servers,
94                                   const std::vector<std::string>& domains,
95                                   const std::vector<std::string>& tlsServers = {},
96                                   const std::string& tlsHostname = "",
97                                   const std::string& caCert = "") {
98         // Determine the DNS configuration steps from setResolverConfiguration() in
99         // packages/modules/DnsResolver/ResolverController.cpp. The gold test just needs to setup
100         // simply DNS and DNS-over-TLS server configuration. Some implementation in
101         // setResolverConfiguration() are not required. For example, limiting TLS server amount is
102         // not necessary for gold test because gold test has only one TLS server for testing
103         // so far.
104         Fwmark fwmark;
105         fwmark.netId = TEST_NETID;
106         fwmark.explicitlySelected = true;
107         fwmark.protectedFromVpn = true;
108         fwmark.permission = PERMISSION_SYSTEM;
109         ASSERT_EQ(gPrivateDnsConfiguration.set(TEST_NETID, fwmark.intValue, tlsServers, tlsHostname,
110                                                caCert),
111                   0);
112         ASSERT_EQ(resolv_set_nameservers(TEST_NETID, servers, domains, kParams), 0);
113     }
114 
SetResolvers()115     void SetResolvers() { SetResolverConfiguration(kDefaultServers, kDefaultSearchDomains); }
116 
SetResolversWithTls()117     void SetResolversWithTls() {
118         // Pass servers as both network-assigned and TLS servers. Tests can
119         // determine on which server and by which protocol queries arrived.
120         // See also DnsClient::SetResolversWithTls() in
121         // packages/modules/DnsResolver/tests/dns_responder/dns_responder_client.h.
122         SetResolverConfiguration(kDefaultServers, kDefaultSearchDomains, kDefaultServers,
123                                  kDefaultPrivateDnsHostName, kCaCert);
124     }
125 
WaitForPrivateDnsValidation(const std::string & serverAddr)126     bool WaitForPrivateDnsValidation(const std::string& serverAddr) {
127         constexpr milliseconds retryIntervalMs{20};
128         constexpr milliseconds timeoutMs{3000};
129         android::base::Timer t;
130         while (t.duration() < timeoutMs) {
131             const auto& validatedServers =
132                     gPrivateDnsConfiguration.getStatus(TEST_NETID).validatedServers();
133             for (const auto& server : validatedServers) {
134                 if (serverAddr == ToString(&server.ss)) return true;
135             }
136             std::this_thread::sleep_for(retryIntervalMs);
137         }
138         return false;
139     }
140 
ToProto(const std::string & filename)141     Result<GoldTest> ToProto(const std::string& filename) {
142         // Convert the testing configuration from binary .pb file to proto.
143         std::string content;
144         const std::string path = kTestDataPath + filename;
145 
146         bool ret = android::base::ReadFileToString(path, &content);
147         if (!ret) return Errorf("Read {} failed: {}", path, strerror(errno));
148 
149         android::net::GoldTest goldtest;
150         ret = goldtest.ParseFromString(content);
151         if (!ret) return Errorf("Parse {} failed", path);
152 
153         return goldtest;
154     }
155 
SetupMappings(const android::net::GoldTest & goldtest,test::DNSResponder & dns)156     void SetupMappings(const android::net::GoldTest& goldtest, test::DNSResponder& dns) {
157         for (const auto& m : goldtest.packet_mapping()) {
158             // Convert string to bytes because .proto type "bytes" is "string" type in C++.
159             // See also the section "Scalar Value Types" in "Language Guide (proto3)".
160             // TODO: Use C++20 std::span in addMappingBinaryPacket. It helps to take both
161             // std::string and std::vector without conversions.
162             dns.addMappingBinaryPacket(
163                     std::vector<uint8_t>(m.query().begin(), m.query().end()),
164                     std::vector<uint8_t>(m.response().begin(), m.response().end()));
165         }
166     }
167 
GetNetContext(const DnsProtocol protocol)168     android_net_context GetNetContext(const DnsProtocol protocol) {
169         return protocol == DnsProtocol::TLS ? kNetcontextTls : kNetcontext;
170     }
171 
172     template <class AddressType>
VerifyAddress(const android::net::GoldTest & goldtest,const AddressType & result)173     void VerifyAddress(const android::net::GoldTest& goldtest, const AddressType& result) {
174         if (goldtest.result().return_code() != GT_EAI_NO_ERROR) {
175             EXPECT_EQ(result, nullptr);
176         } else {
177             ASSERT_NE(result, nullptr);
178             const auto& addresses = goldtest.result().addresses();
179             EXPECT_THAT(ToStrings(result), ::testing::UnorderedElementsAreArray(addresses));
180         }
181     }
182 
VerifyGetAddrInfo(const android::net::GoldTest & goldtest,const DnsProtocol protocol)183     void VerifyGetAddrInfo(const android::net::GoldTest& goldtest, const DnsProtocol protocol) {
184         ASSERT_TRUE(goldtest.config().has_addrinfo());
185         const auto& args = goldtest.config().addrinfo();
186         const addrinfo hints = {
187                 // Clear the flag AI_ADDRCONFIG to avoid flaky test because AI_ADDRCONFIG looks at
188                 // whether connectivity is available. It makes that the resolver may send only A
189                 // or AAAA DNS query per connectivity even AF_UNSPEC has been assigned. See also
190                 // have_ipv6() and have_ipv4() in packages/modules/DnsResolver/getaddrinfo.cpp.
191                 // TODO: Consider keeping the configuration flag AI_ADDRCONFIG once the unit
192                 // test can treat the IPv4 and IPv6 connectivity.
193                 .ai_flags = args.ai_flags() & ~AI_ADDRCONFIG,
194                 .ai_family = args.family(),
195                 .ai_socktype = args.socktype(),
196                 .ai_protocol = args.protocol(),
197         };
198         addrinfo* res = nullptr;
199         const android_net_context netcontext = GetNetContext(protocol);
200         NetworkDnsEventReported event;
201         const int rv =
202                 resolv_getaddrinfo(args.host().c_str(), nullptr, &hints, &netcontext, &res, &event);
203         ScopedAddrinfo result(res);
204         ASSERT_EQ(rv, goldtest.result().return_code());
205         VerifyAddress(goldtest, result);
206     }
207 
VerifyGetHostByName(const android::net::GoldTest & goldtest,const DnsProtocol protocol)208     void VerifyGetHostByName(const android::net::GoldTest& goldtest, const DnsProtocol protocol) {
209         ASSERT_TRUE(goldtest.config().has_hostbyname());
210         const auto& args = goldtest.config().hostbyname();
211         hostent* hp = nullptr;
212         hostent hbuf;
213         char tmpbuf[MAXPACKET];
214         const android_net_context netcontext = GetNetContext(protocol);
215         NetworkDnsEventReported event;
216         const int rv = resolv_gethostbyname(args.host().c_str(), args.family(), &hbuf, tmpbuf,
217                                             sizeof(tmpbuf), &netcontext, &hp, &event);
218         ASSERT_EQ(rv, goldtest.result().return_code());
219         VerifyAddress(goldtest, hp);
220     }
221 
VerifyResolver(const android::net::GoldTest & goldtest,const test::DNSResponder & dns,const test::DnsTlsFrontend & tls,const DnsProtocol protocol)222     void VerifyResolver(const android::net::GoldTest& goldtest, const test::DNSResponder& dns,
223                         const test::DnsTlsFrontend& tls, const DnsProtocol protocol) {
224         size_t queries;
225         std::string name;
226 
227         // Verify DNS query calls and results by proto. Then, determine expected query times and
228         // queried name for checking server query status later.
229         switch (const auto calltype = goldtest.config().call()) {
230             case android::net::CallType::CALL_GETADDRINFO:
231                 ASSERT_TRUE(goldtest.config().has_addrinfo());
232                 ASSERT_NO_FATAL_FAILURE(VerifyGetAddrInfo(goldtest, protocol));
233                 queries = goldtest.config().addrinfo().family() == AF_UNSPEC ? 2U : 1U;
234                 name = goldtest.config().addrinfo().host();
235                 break;
236             case android::net::CallType::CALL_GETHOSTBYNAME:
237                 ASSERT_TRUE(goldtest.config().has_hostbyname());
238                 ASSERT_NO_FATAL_FAILURE(VerifyGetHostByName(goldtest, protocol));
239                 queries = 1U;
240                 name = goldtest.config().hostbyname().host();
241                 break;
242             default:
243                 FAIL() << "Unsupported call type: " << calltype;
244         }
245 
246         // Verify DNS server query status.
247         EXPECT_EQ(GetNumQueries(dns, name.c_str()), queries);
248         if (protocol == DnsProtocol::TLS) EXPECT_TRUE(tls.waitForQueries(queries));
249     }
250 
251     static constexpr res_params kParams = {
252             .sample_validity = 300,
253             .success_threshold = 25,
254             .min_samples = 8,
255             .max_samples = 8,
256             .base_timeout_msec = 1000,
257             .retry_count = 2,
258     };
259     static constexpr android_net_context kNetcontext = {
260             .app_netid = TEST_NETID,
261             .app_mark = MARK_UNSET,
262             .dns_netid = TEST_NETID,
263             .dns_mark = MARK_UNSET,
264             .uid = NET_CONTEXT_INVALID_UID,
265     };
266     static constexpr android_net_context kNetcontextTls = {
267             .app_netid = TEST_NETID,
268             .app_mark = MARK_UNSET,
269             .dns_netid = TEST_NETID,
270             .dns_mark = MARK_UNSET,
271             .uid = NET_CONTEXT_INVALID_UID,
272             // Set TLS flags. See also maybeFixupNetContext() in
273             // packages/modules/DnsResolver/DnsProxyListener.cpp.
274             .flags = NET_CONTEXT_FLAG_USE_DNS_OVER_TLS | NET_CONTEXT_FLAG_USE_EDNS,
275     };
276 };
277 class ResolvGetAddrInfo : public TestBase {};
278 
279 // Fixture tests.
TEST_F(ResolvGetAddrInfo,RemovePacketMapping)280 TEST_F(ResolvGetAddrInfo, RemovePacketMapping) {
281     test::DNSResponder dns(test::DNSResponder::MappingType::BINARY_PACKET);
282     ASSERT_TRUE(dns.startServer());
283     ASSERT_NO_FATAL_FAILURE(SetResolvers());
284 
285     dns.addMappingBinaryPacket(kHelloExampleComQueryV4, kHelloExampleComResponseV4);
286 
287     addrinfo* res = nullptr;
288     const addrinfo hints = {.ai_family = AF_INET};
289     NetworkDnsEventReported event;
290     int rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
291     ScopedAddrinfo result(res);
292     ASSERT_NE(result, nullptr);
293     ASSERT_EQ(rv, 0);
294     EXPECT_EQ(ToString(result), kHelloExampleComAddrV4);
295 
296     // Remove existing DNS record.
297     dns.removeMappingBinaryPacket(kHelloExampleComQueryV4);
298 
299     // Expect to have no answer in DNS query result.
300     rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
301     result.reset(res);
302     ASSERT_EQ(result, nullptr);
303     ASSERT_EQ(rv, EAI_NODATA);
304 }
305 
TEST_F(ResolvGetAddrInfo,ReplacePacketMapping)306 TEST_F(ResolvGetAddrInfo, ReplacePacketMapping) {
307     test::DNSResponder dns(test::DNSResponder::MappingType::BINARY_PACKET);
308     ASSERT_TRUE(dns.startServer());
309     ASSERT_NO_FATAL_FAILURE(SetResolvers());
310 
311     // Register the record which uses IPv4 address 1.2.3.4.
312     dns.addMappingBinaryPacket(kHelloExampleComQueryV4, kHelloExampleComResponseV4);
313 
314     // Expect that the DNS query returns IPv4 address 1.2.3.4.
315     addrinfo* res = nullptr;
316     const addrinfo hints = {.ai_family = AF_INET};
317     NetworkDnsEventReported event;
318     int rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
319     ScopedAddrinfo result(res);
320     ASSERT_NE(result, nullptr);
321     ASSERT_EQ(rv, 0);
322     EXPECT_EQ(ToString(result), "1.2.3.4");
323 
324     // Replace the registered record with a record which uses new IPv4 address 5.6.7.8.
325     std::vector<uint8_t> newHelloExampleComResponseV4 = {
326             /* Header */
327             0x00, 0x00, /* Transaction ID: 0x0000 */
328             0x81, 0x80, /* Flags: qr rd ra */
329             0x00, 0x01, /* Questions: 1 */
330             0x00, 0x01, /* Answer RRs: 1 */
331             0x00, 0x00, /* Authority RRs: 0 */
332             0x00, 0x00, /* Additional RRs: 0 */
333             /* Queries */
334             0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
335             0x03, 0x63, 0x6f, 0x6d, 0x00, /* Name: hello.example.com */
336             0x00, 0x01,                   /* Type: A */
337             0x00, 0x01,                   /* Class: IN */
338             /* Answers */
339             0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
340             0x03, 0x63, 0x6f, 0x6d, 0x00, /* Name: hello.example.com */
341             0x00, 0x01,                   /* Type: A */
342             0x00, 0x01,                   /* Class: IN */
343             0x00, 0x00, 0x00, 0x00,       /* Time to live: 0 */
344             0x00, 0x04,                   /* Data length: 4 */
345             0x05, 0x06, 0x07, 0x08        /* Address: 5.6.7.8 */
346     };
347     dns.addMappingBinaryPacket(kHelloExampleComQueryV4, newHelloExampleComResponseV4);
348 
349     // Expect that DNS query returns new IPv4 address 5.6.7.8.
350     rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
351     result.reset(res);
352     ASSERT_NE(result, nullptr);
353     ASSERT_EQ(rv, 0);
354     EXPECT_EQ(ToString(result), "5.6.7.8");
355 }
356 
TEST_F(ResolvGetAddrInfo,BasicTlsQuery)357 TEST_F(ResolvGetAddrInfo, BasicTlsQuery) {
358     test::DNSResponder dns;
359     dns.addMapping(kHelloExampleCom, ns_type::ns_t_a, kHelloExampleComAddrV4);
360     dns.addMapping(kHelloExampleCom, ns_type::ns_t_aaaa, kHelloExampleComAddrV6);
361     ASSERT_TRUE(dns.startServer());
362 
363     test::DnsTlsFrontend tls;
364     ASSERT_TRUE(tls.startServer());
365     ASSERT_NO_FATAL_FAILURE(SetResolversWithTls());
366     EXPECT_TRUE(WaitForPrivateDnsValidation(tls.listen_address()));
367 
368     dns.clearQueries();
369     addrinfo* res = nullptr;
370     // If the socket type is not specified, every address will appear twice, once for
371     // SOCK_STREAM and one for SOCK_DGRAM. Just pick one because the addresses for
372     // the second query of different socket type are responded by the cache.
373     const addrinfo hints = {.ai_family = AF_UNSPEC, .ai_socktype = SOCK_STREAM};
374     NetworkDnsEventReported event;
375     const int rv =
376             resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontextTls, &res, &event);
377     ScopedAddrinfo result(res);
378     ASSERT_EQ(rv, 0);
379     EXPECT_EQ(GetNumQueries(dns, kHelloExampleCom), 2U);
380     const std::vector<std::string> result_strs = ToStrings(result);
381     EXPECT_THAT(result_strs, testing::UnorderedElementsAreArray(
382                                      {kHelloExampleComAddrV4, kHelloExampleComAddrV6}));
383     EXPECT_TRUE(tls.waitForQueries(3));
384 }
385 
386 // Parameterized test class definition.
387 using GoldTestParamType = std::tuple<DnsProtocol, std::string /* filename */>;
388 class ResolvGoldTest : public TestBase, public ::testing::WithParamInterface<GoldTestParamType> {
389   public:
390     // Generate readable string for test name from test parameters.
Name(const::testing::TestParamInfo<GoldTestParamType> & info)391     static std::string Name(const ::testing::TestParamInfo<GoldTestParamType>& info) {
392         const auto& [protocol, file] = info.param;
393         std::string name = StringPrintf(
394                 "%s_%s", protocol == DnsProtocol::CLEARTEXT ? "CLEARTEXT" : "TLS", file.c_str());
395         std::replace_if(
396                 std::begin(name), std::end(name), [](char ch) { return !std::isalnum(ch); }, '_');
397         return name;
398     }
399 };
400 
401 // GetAddrInfo tests.
402 INSTANTIATE_TEST_SUITE_P(GetAddrInfo, ResolvGoldTest,
403                          ::testing::Combine(::testing::Values(DnsProtocol::CLEARTEXT),
404                                             ::testing::ValuesIn(kGoldFilesGetAddrInfo)),
405                          ResolvGoldTest::Name);
406 INSTANTIATE_TEST_SUITE_P(GetAddrInfoTls, ResolvGoldTest,
407                          ::testing::Combine(::testing::Values(DnsProtocol::TLS),
408                                             ::testing::ValuesIn(kGoldFilesGetAddrInfoTls)),
409                          ResolvGoldTest::Name);
410 
411 // GetHostByName tests.
412 INSTANTIATE_TEST_SUITE_P(GetHostByName, ResolvGoldTest,
413                          ::testing::Combine(::testing::Values(DnsProtocol::CLEARTEXT),
414                                             ::testing::ValuesIn(kGoldFilesGetHostByName)),
415                          ResolvGoldTest::Name);
416 INSTANTIATE_TEST_SUITE_P(GetHostByNameTls, ResolvGoldTest,
417                          ::testing::Combine(::testing::Values(DnsProtocol::TLS),
418                                             ::testing::ValuesIn(kGoldFilesGetHostByNameTls)),
419                          ResolvGoldTest::Name);
420 
TEST_P(ResolvGoldTest,GoldData)421 TEST_P(ResolvGoldTest, GoldData) {
422     const auto& [protocol, file] = GetParam();
423 
424     // Setup DNS server configuration.
425     test::DNSResponder dns(test::DNSResponder::MappingType::BINARY_PACKET);
426     ASSERT_TRUE(dns.startServer());
427     test::DnsTlsFrontend tls;
428 
429     if (protocol == DnsProtocol::CLEARTEXT) {
430         ASSERT_NO_FATAL_FAILURE(SetResolvers());
431     } else if (protocol == DnsProtocol::TLS) {
432         ASSERT_TRUE(tls.startServer());
433         ASSERT_NO_FATAL_FAILURE(SetResolversWithTls());
434         EXPECT_TRUE(WaitForPrivateDnsValidation(tls.listen_address()));
435         tls.clearQueries();
436     }
437 
438     // Read test configuration from serialized binary to proto.
439     const Result<GoldTest> result = ToProto(file);
440     ASSERT_TRUE(result.ok()) << result.error().message();
441     const GoldTest& goldtest = result.value();
442 
443     // Register packet mappings (query, response) from proto.
444     SetupMappings(goldtest, dns);
445 
446     // Verify the resolver by proto.
447     VerifyResolver(goldtest, dns, tls, protocol);
448 }
449 
450 }  // namespace android::net
451