Gitiles
Code Review Sign In
review.blissroms.org / platform_packages_modules_DnsResolver / f5573fdec8dd6bedac5e52b3dfadb309434730cd
commitf5573fdec8dd6bedac5e52b3dfadb309434730cd[log] [tgz]
authorKen Chen <cken@google.com>Tue Jan 14 01:51:05 2020 +0800
committerKen Chen <cken@google.com>Sun Jan 19 10:34:04 2020 +0000
tree261165427317a2fb8dd267561e5f7cded0b1d550
parent0452b8cf515b25e76321ba0ca337fafbc58b5506 [diff]
Enable CFI (Control Flow Integrity)

Enable Control Flow Integrity in DNS resolver

There is no significant difference in PSS (Proportional Set Size) between
non-CFI and CFI binaries. Th performance overhead is also negligible
according to [1][2].

non-CFI (netd + DNS resolver):
+-----------+---------+---------+---------+---------+
|           | round#1 | round#2 | round#3 |   Avg   |
+-----------+---------+---------+---------+---------+
| RssAnon   | 1556 kB | 1528 kB | 1592 kB | 1559 kB |
| RssFile   | 4792 kB | 4872 kB | 4648 kB | 4771 kB |
| RssShmem  | 176 kB  | 176 kB  | 172 kB  | 175 kB  |
| Total PSS | 4381 kB | 4386 kB | 4437 kB | 4401 kB |
+-----------+---------+---------+---------+---------+

CFI (netd + DNS resolver):
+-----------+---------+---------+---------+---------+
|           | round#1 | round#2 | round#3 |   Avg   |
+-----------+---------+---------+---------+---------+
| RssAnon   | 1604 kB | 1608 kB | 1592 kB | 1601 kB |
| RssFile   | 4528 kB | 4892 kB | 4916 kB | 4779 kB |
| RssShmem  | 176 kB  | 176 kB  | 176 kB  | 176 kB  |
| Total PSS | 3962 kB | 4523 kB | 4483 kB | 4323 kB |
+-----------+---------+---------+---------+---------+

Binary size of aarch64 (bytes)
+----------------------+---------+--------+
|                      | non-CFI |  CFI   |
+----------------------+---------+--------+
| libnetd_resolv       |  668584 | 734552 |
+----------------------+---------+--------+

[1] https://source.android.com/devices/tech/debug/cfi
[2] http://clang.llvm.org/docs/ControlFlowIntegrity.html#performance

Bug: 146408702
Test: AOSP master:
      1. patch commit to enable CFI on both netd and resolver.
      2. m
      3. flash ROM.
      4. atest under system/netd/

      Compatibility:
      1. flash Android Q ROM.
      2. patch commit enabling CFI on both netd and resolver in branch
         qt-aml-resolv-release.
      3. build com.android.resolv in branch qt-aml-resolv-release.
      4. adb install CFI enabled resolver apex into Q device (non-CFI
         netd).
      5. atest under packages/modules/DnsResolver.


Change-Id: I65ce931d57bd285e1c49c34b4231f8151380eae3
1 file changed
tree: 261165427317a2fb8dd267561e5f7cded0b1d550
  1. aidl_api/
  2. apex/
  3. binder/
  4. include/
  5. tests/
  6. .clang-format ⇨ ../../../build/soong/scripts/system-clang-format
  7. .editorconfig
  8. Android.bp
  9. Dns64Configuration.cpp
  10. Dns64Configuration.h
  11. DnsProxyListener.cpp
  12. DnsProxyListener.h
  13. DnsQueryLog.cpp
  14. DnsQueryLog.h
  15. DnsQueryLogTest.cpp
  16. DnsResolver.cpp
  17. DnsResolver.h
  18. DnsResolverService.cpp
  19. DnsResolverService.h
  20. DnsStats.cpp
  21. DnsStats.h
  22. DnsStatsTest.cpp
  23. DnsTlsDispatcher.cpp
  24. DnsTlsDispatcher.h
  25. DnsTlsQueryMap.cpp
  26. DnsTlsQueryMap.h
  27. DnsTlsServer.cpp
  28. DnsTlsServer.h
  29. DnsTlsSessionCache.cpp
  30. DnsTlsSessionCache.h
  31. DnsTlsSocket.cpp
  32. DnsTlsSocket.h
  33. DnsTlsSocketFactory.h
  34. DnsTlsTransport.cpp
  35. DnsTlsTransport.h
  36. getaddrinfo.cpp
  37. getaddrinfo.h
  38. gethnamaddr.cpp
  39. gethnamaddr.h
  40. hostent.h
  41. IDnsTlsSocket.h
  42. IDnsTlsSocketFactory.h
  43. IDnsTlsSocketObserver.h
  44. libnetd_resolv.map.txt
  45. LockedQueue.h
  46. NOTICE
  47. OWNERS
  48. params.h
  49. PREUPLOAD.cfg
  50. PrivateDnsConfiguration.cpp
  51. PrivateDnsConfiguration.h
  52. README-DoT.md
  53. README.md
  54. res_cache.cpp
  55. res_comp.cpp
  56. res_debug.cpp
  57. res_debug.h
  58. res_init.cpp
  59. res_init.h
  60. res_mkquery.cpp
  61. res_query.cpp
  62. res_send.cpp
  63. res_send.h
  64. res_stats.cpp
  65. resolv_cache.h
  66. resolv_cache_unit_test.cpp
  67. resolv_callback_unit_test.cpp
  68. resolv_private.h
  69. resolv_tls_unit_test.cpp
  70. resolv_unit_test.cpp
  71. ResolverController.cpp
  72. ResolverController.h
  73. ResolverEventReporter.cpp
  74. ResolverEventReporter.h
  75. ResolverStats.h
  76. sethostent.cpp
  77. stats.h
  78. stats.proto
  79. TEST_MAPPING
  80. util.cpp
  81. util.h
README.md

Logging

This code uses LOG(X) for logging. Log levels are VERBOSE,DEBUG,INFO,WARNING and ERROR. The default setting is WARNING and logs relate to WARNING and ERROR will be shown. If you want to enable the DEBUG level logs, using following command. adb shell service call dnsresolver 10 i32 1 VERBOSE 0 DEBUG 1 INFO 2 WARNING 3 ERROR 4 Verbose resolver logs could contain PII -- do NOT enable in production builds.