Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4c0ae1ac authored by Android Build Coastguard Worker's avatar Android Build Coastguard Worker
Browse files

Snap for 7814173 from 5fcd7dc8 to mainline-ipsec-release 

Change-Id: I30cc077ab4263b9e191160183a50c9433c4f28ae
parents 9cd7ee9f 5fcd7dc8

Android.bp

+27 −46
Original line number Diff line number Diff line
@@ -53,7 +53,7 @@ cc_library_headers { 
    ],

}



dnsresolver_aidl_interface_lateststable_version = "V9"

dnsresolver_aidl_interface_lateststable_version = "V10"



cc_library_static {

    name: "dnsresolver_aidl_interface-lateststable-ndk",
@@ -107,6 +107,7 @@ aidl_interface { 
        "7",

        "8",

        "9",

        "10",

    ],

    dumpapi: {

        no_license: true,
@@ -197,6 +198,7 @@ cc_library { 
        "libcutils",

        "libnetdutils",

        "libdoh_ffi",

        "libmodules-utils-build",

        "libprotobuf-cpp-lite",

        "libstatslog_resolv",

        "libstatspush_compat",
@@ -324,24 +326,25 @@ filegroup { 
    ],

}



rust_ffi_static {

    name: "libdoh_ffi",

    crate_name: "doh",

    srcs: ["doh.rs"],

    edition: "2018",



    rlibs: [

doh_rust_deps = [

    "libandroid_logger",

    "libanyhow",

    "libbase64_rust",

    "libfutures",

    "liblibc",

    "liblog_rust",

        "libquiche",

    "libring",

    "libtokio",

    "liburl",

    ],

]



rust_ffi_static {

    name: "libdoh_ffi",

    crate_name: "doh",

    srcs: ["doh/doh.rs"],

    edition: "2018",



    rlibs: doh_rust_deps + ["libquiche"],

    prefer_rlib: true,



    shared_libs: [
@@ -351,7 +354,7 @@ rust_ffi_static { 


    apex_available: [

        "//apex_available:platform", // Needed by doh_ffi_test

        "com.android.resolv"

        "com.android.resolv",

    ],

    min_sdk_version: "29",

}
@@ -359,25 +362,14 @@ rust_ffi_static { 
rust_test {

    name: "doh_unit_test",

    crate_name: "doh",

    srcs: ["doh.rs"],

    srcs: ["doh/doh.rs"],

    edition: "2018",

    test_suites: ["general-tests"],

    auto_gen_config: true,

    // Used to enable root permission for the test.

    // TODO: remove after 'require_root' is supported in rust_test.

    test_config_template: ":resolv_rust_test_config_template",

    rustlibs: [

        "libandroid_logger",

        "libanyhow",

        "libbase64_rust",

        "libfutures",

        "liblibc",

        "liblog_rust",

        "libquiche_static",

        "libring",

        "libtokio",

        "liburl",

    ],

    rustlibs: doh_rust_deps + ["libquiche_static"],

    min_sdk_version: "29",

}
@@ -385,28 +377,17 @@ rust_test { 
rust_ffi_static {

    name: "libdoh_ffi_for_test",

    crate_name: "doh",

    srcs: ["doh.rs"],

    srcs: ["doh/doh.rs"],

    edition: "2018",



    rlibs: [

        "libandroid_logger",

        "libanyhow",

        "libbase64_rust",

        "libfutures",

        "liblibc",

        "liblog_rust",

        "libquiche_static",

        "libring",

        "libtokio",

        "liburl",

    ],

    rlibs: doh_rust_deps + ["libquiche_static"],

    prefer_rlib: true,

    // TODO(b/194022174), for unit tests to run on the Android 10 platform,

    // libunwind must be statically linked.

    whole_static_libs: ["libunwind"],

    apex_available: [

        "//apex_available:platform", // Needed by doh_ffi_test

        "com.android.resolv"

        "com.android.resolv",

    ],

    min_sdk_version: "29",

}

DnsResolver.cpp

+1 −1
Original line number Diff line number Diff line
@@ -33,7 +33,7 @@ bool resolv_init(const ResolverNetdCallbacks* callbacks) { 
    // TODO(b/170539625): restore log level to WARNING after clarifying flaky tests.

    const bool isDebug = isUserDebugBuild();

    resolv_set_log_severity(isDebug ? android::base::DEBUG : android::base::WARNING);

    doh_init_logger(isDebug ? LOG_LEVEL_DEBUG : LOG_LEVEL_WARN);

    doh_init_logger(isDebug ? DOH_LOG_LEVEL_DEBUG : DOH_LOG_LEVEL_WARN);

    using android::net::gApiLevel;

    gApiLevel = getApiLevel();

    using android::net::gResNetdCallbacks;

DnsStats.cpp

+3 −0
Original line number Diff line number Diff line
@@ -284,6 +284,9 @@ void DnsStats::dump(DumpWriter& dw) { 
    dw.println("over UDP");

    dumpStatsMap(mStats[PROTO_UDP]);



    dw.println("over DOH");

    dumpStatsMap(mStats[PROTO_DOH]);



    dw.println("over TLS");

    dumpStatsMap(mStats[PROTO_DOT]);

DnsStatsTest.cpp

+13 −11
Original line number Diff line number Diff line
@@ -117,7 +117,8 @@ class DnsStatsTest : public ::testing::Test { 
    void verifyDumpOutput(const std::vector<StatsData>& tcpData,

                          const std::vector<StatsData>& udpData,

                          const std::vector<StatsData>& dotData,

                          const std::vector<StatsData>& mdnsData) {

                          const std::vector<StatsData>& mdnsData,

                          const std::vector<StatsData>& dohData) {

        // A pattern to capture three matches:

        //     server address (empty allowed), the statistics, and the score.

        const std::regex pattern(R"(\s{4,}([0-9a-fA-F:\.]*)[ ]?([<(].*[>)])[ ]?(\S*))");
@@ -149,6 +150,7 @@ class DnsStatsTest : public ::testing::Test { 
        };



        check(udpData, "UDP", &dumpString);

        check(dohData, "DOH", &dumpString);

        check(dotData, "TLS", &dumpString);

        check(tcpData, "TCP", &dumpString);

        check(mdnsData, "MDNS", &dumpString);
@@ -173,7 +175,7 @@ class DnsStatsTest : public ::testing::Test { 


TEST_F(DnsStatsTest, SetAddrs) {

    // Check before any operation to mDnsStats.

    verifyDumpOutput({}, {}, {}, {});

    verifyDumpOutput({}, {}, {}, {}, {});



    static const struct {

        std::vector<std::string> servers;
@@ -230,7 +232,7 @@ TEST_F(DnsStatsTest, SetAddrs) { 
        EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_DOT, expectedStats, NO_AVERAGE_LATENCY));

    }



    verifyDumpOutput({}, {}, {}, {});

    verifyDumpOutput({}, {}, {}, {}, {});

}



TEST_F(DnsStatsTest, SetServersDifferentPorts) {
@@ -249,7 +251,7 @@ TEST_F(DnsStatsTest, SetServersDifferentPorts) { 
    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_TCP, {}, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, {}, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_DOT, {}, NO_AVERAGE_LATENCY));

    verifyDumpOutput({}, {}, {}, {});

    verifyDumpOutput({}, {}, {}, {}, {});



    EXPECT_TRUE(mDnsStats.setAddrs(std::vector(servers.begin() + 2, servers.end()), PROTO_TCP));

    EXPECT_TRUE(mDnsStats.setAddrs(std::vector(servers.begin() + 2, servers.end()), PROTO_UDP));
@@ -264,7 +266,7 @@ TEST_F(DnsStatsTest, SetServersDifferentPorts) { 
    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_TCP, expectedStats, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, expectedStats, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_DOT, expectedStats, NO_AVERAGE_LATENCY));

    verifyDumpOutput(expectedStats, expectedStats, expectedStats, {});

    verifyDumpOutput(expectedStats, expectedStats, expectedStats, {}, {});

}



TEST_F(DnsStatsTest, AddStatsAndClear) {
@@ -311,7 +313,7 @@ TEST_F(DnsStatsTest, AddStatsAndClear) { 
    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, expectedStatsForUdp, 10ms));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_DOT, {}, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_MDNS, expectedStatsForMdns, 10ms));

    verifyDumpOutput(expectedStatsForTcp, expectedStatsForUdp, {}, expectedStatsForMdns);

    verifyDumpOutput(expectedStatsForTcp, expectedStatsForUdp, {}, expectedStatsForMdns, {});



    // Clear stats.

    EXPECT_TRUE(mDnsStats.setAddrs({}, PROTO_TCP));
@@ -322,7 +324,7 @@ TEST_F(DnsStatsTest, AddStatsAndClear) { 
    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, {}, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_DOT, {}, NO_AVERAGE_LATENCY));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_MDNS, {}, NO_AVERAGE_LATENCY));

    verifyDumpOutput({}, {}, {}, {});

    verifyDumpOutput({}, {}, {}, {}, {});

}



TEST_F(DnsStatsTest, StatsRemainsInExistentServer) {
@@ -350,7 +352,7 @@ TEST_F(DnsStatsTest, StatsRemainsInExistentServer) { 
    };

    EXPECT_THAT(mDnsStats.getStats(PROTO_UDP), UnorderedElementsAreArray(expectedStats));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, expectedStats, 106ms));

    verifyDumpOutput({}, expectedStats, {}, {});

    verifyDumpOutput({}, expectedStats, {}, {}, {});



    // Update the server list, the stats of 127.0.0.2 will remain.

    servers = {
@@ -366,7 +368,7 @@ TEST_F(DnsStatsTest, StatsRemainsInExistentServer) { 
    };

    EXPECT_THAT(mDnsStats.getStats(PROTO_UDP), UnorderedElementsAreArray(expectedStats));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, expectedStats, 130ms));

    verifyDumpOutput({}, expectedStats, {}, {});

    verifyDumpOutput({}, expectedStats, {}, {}, {});



    // Let's add a record to 127.0.0.2 again.

    EXPECT_TRUE(mDnsStats.addStats(servers[0], recordNoError));
@@ -377,7 +379,7 @@ TEST_F(DnsStatsTest, StatsRemainsInExistentServer) { 
    };

    EXPECT_THAT(mDnsStats.getStats(PROTO_UDP), UnorderedElementsAreArray(expectedStats));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, expectedStats, 106ms));

    verifyDumpOutput({}, expectedStats, {}, {});

    verifyDumpOutput({}, expectedStats, {}, {}, {});

}



TEST_F(DnsStatsTest, AddStatsRecords_100000) {
@@ -451,7 +453,7 @@ TEST_F(DnsStatsTest, AddStatsRecords_100000) { 
    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_UDP, expectedStats, 99935500us));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_DOT, expectedStats, 99935500us));

    EXPECT_NO_FAILURE(verifyDnsStatsContent(PROTO_MDNS, expectedMdnsStats, 99935500us));

    verifyDumpOutput(expectedStats, expectedStats, expectedStats, expectedMdnsStats);

    verifyDumpOutput(expectedStats, expectedStats, expectedStats, expectedMdnsStats, {});

}



TEST_F(DnsStatsTest, GetServers_SortingByLatency) {

PrivateDnsConfiguration.cpp

+31 −6
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ 
#include "ResolverEventReporter.h"

#include "doh.h"

#include "netd_resolv/resolv.h"

#include "resolv_cache.h"

#include "resolv_private.h"

#include "util.h"
@@ -252,6 +253,9 @@ void PrivateDnsConfiguration::sendPrivateDnsValidationEvent(const ServerIdentity 
            .hostname = identity.provider,

            .validation = success ? IDnsResolverUnsolicitedEventListener::VALIDATION_RESULT_SUCCESS

                                  : IDnsResolverUnsolicitedEventListener::VALIDATION_RESULT_FAILURE,

            .protocol = (identity.sockaddr.port() == 853)

                                ? IDnsResolverUnsolicitedEventListener::PROTOCOL_DOT

                                : IDnsResolverUnsolicitedEventListener::PROTOCOL_DOH,

    };

    for (const auto& it : unsolEventListeners) {

        it->onPrivateDnsValidationEvent(validationEvent);
@@ -383,6 +387,16 @@ void PrivateDnsConfiguration::setObserver(PrivateDnsValidationObserver* observer 
    mObserver = observer;

}



base::Result<netdutils::IPSockAddr> PrivateDnsConfiguration::getDohServer(unsigned netId) const {

    std::lock_guard guard(mPrivateDnsLock);

    auto it = mDohTracker.find(netId);

    if (it != mDohTracker.end()) {

        return netdutils::IPSockAddr::toIPSockAddr(it->second.ipAddr, 443);

    }



    return Errorf("Failed to get DoH Server: netId {} not found", netId);

}



void PrivateDnsConfiguration::notifyValidationStateUpdate(const netdutils::IPSockAddr& sockaddr,

                                                          Validation validation,

                                                          uint32_t netId) const {
@@ -415,16 +429,20 @@ void PrivateDnsConfiguration::initDohLocked() { 
            [](uint32_t net_id, bool success, const char* ip_addr, const char* host) {

                android::net::PrivateDnsConfiguration::getInstance().onDohStatusUpdate(

                        net_id, success, ip_addr, host);

            });

            },

            [](int32_t sock) { resolv_tag_socket(sock, AID_DNS, NET_CONTEXT_INVALID_PID); });

}



int PrivateDnsConfiguration::setDoh(int32_t netId, uint32_t mark,

                                    const std::vector<std::string>& servers,

                                    const std::string& name, const std::string& caCert) {

    if (servers.empty()) return 0;

    LOG(DEBUG) << "PrivateDnsConfiguration::setDoh(" << netId << ", 0x" << std::hex << mark

               << std::dec << ", " << servers.size() << ", " << name << ")";

    std::lock_guard guard(mPrivateDnsLock);

    if (servers.empty()) {

        clearDohLocked(netId);

        return 0;

    }



    // Sort the input servers to ensure that we could get the server vector at the same order.

    std::vector<std::string> sortedServers = servers;
@@ -459,6 +477,7 @@ int PrivateDnsConfiguration::setDoh(int32_t netId, uint32_t mark, 
                           dohId.status);

        mPrivateDnsLog.push(std::move(record));

        LOG(INFO) << __func__ << ": Upgrading server to DoH: " << name;

        resolv_stats_set_addrs(netId, PROTO_DOH, {dohId.ipAddr}, 443);



        int probeTimeout = Experiments::getInstance()->getFlag("doh_probe_timeout_ms",

                                                               kDohProbeDefaultTimeoutMs);
@@ -470,14 +489,20 @@ int PrivateDnsConfiguration::setDoh(int32_t netId, uint32_t mark, 
    }



    LOG(INFO) << __func__ << ": No suitable DoH server found";

    clearDohLocked(netId);

    return 0;

}



void PrivateDnsConfiguration::clearDoh(unsigned netId) {

    LOG(DEBUG) << "PrivateDnsConfiguration::clearDoh (" << netId << ")";

    std::lock_guard guard(mPrivateDnsLock);

void PrivateDnsConfiguration::clearDohLocked(unsigned netId) {

    LOG(DEBUG) << "PrivateDnsConfiguration::clearDohLocked (" << netId << ")";

    if (mDohDispatcher != nullptr) doh_net_delete(mDohDispatcher, netId);

    mDohTracker.erase(netId);

    resolv_stats_set_addrs(netId, PROTO_DOH, {}, 443);

}



void PrivateDnsConfiguration::clearDoh(unsigned netId) {

    std::lock_guard guard(mPrivateDnsLock);

    clearDohLocked(netId);

}



ssize_t PrivateDnsConfiguration::dohQuery(unsigned netId, const Slice query, const Slice answer,
@@ -485,7 +510,7 @@ ssize_t PrivateDnsConfiguration::dohQuery(unsigned netId, const Slice query, con 
    {

        std::lock_guard guard(mPrivateDnsLock);

        // It's safe because mDohDispatcher won't be deleted after initializing.

        if (mDohDispatcher == nullptr) return RESULT_CAN_NOT_SEND;

        if (mDohDispatcher == nullptr) return DOH_RESULT_CAN_NOT_SEND;

    }

    return doh_query(mDohDispatcher, netId, query.base(), query.size(), answer.base(),

                     answer.size(), timeoutMs);