Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2018 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
Ken Chen | 5471dca | 2019-04-15 15:25:35 +0800 | [diff] [blame] | 17 | #define LOG_TAG "resolv" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 18 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 19 | #include "DnsTlsSocket.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 20 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 21 | #include <arpa/inet.h> |
| 22 | #include <arpa/nameser.h> |
| 23 | #include <errno.h> |
| 24 | #include <linux/tcp.h> |
| 25 | #include <openssl/err.h> |
| 26 | #include <openssl/sha.h> |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 27 | #include <sys/eventfd.h> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 28 | #include <sys/poll.h> |
Sehee Park | 2c11878 | 2019-05-07 13:02:45 +0900 | [diff] [blame] | 29 | #include <unistd.h> |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 30 | #include <algorithm> |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 31 | |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 32 | #include "DnsTlsSessionCache.h" |
| 33 | #include "IDnsTlsSocketObserver.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 34 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 35 | #include <android-base/logging.h> |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 36 | #include <netdutils/SocketOption.h> |
| 37 | #include <netdutils/ThreadUtil.h> |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 38 | |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 39 | #include "Experiments.h" |
Praveen Moongalam Thyagarajan | 8ab18ba | 2019-09-04 14:46:50 -0700 | [diff] [blame] | 40 | #include "netd_resolv/resolv.h" |
Sehee Park | 2c11878 | 2019-05-07 13:02:45 +0900 | [diff] [blame] | 41 | #include "private/android_filesystem_config.h" // AID_DNS |
Sehee Park | d975bf3 | 2019-08-07 13:21:16 +0900 | [diff] [blame] | 42 | #include "resolv_private.h" |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 43 | |
| 44 | namespace android { |
| 45 | |
| 46 | using netdutils::enableSockopt; |
| 47 | using netdutils::enableTcpKeepAlives; |
| 48 | using netdutils::isOk; |
Mike Yu | cb902c9 | 2020-05-20 19:26:56 +0800 | [diff] [blame] | 49 | using netdutils::setThreadName; |
Bernie Innocenti | ec4219b | 2019-01-30 11:16:36 +0900 | [diff] [blame] | 50 | using netdutils::Slice; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 51 | using netdutils::Status; |
| 52 | |
| 53 | namespace net { |
| 54 | namespace { |
| 55 | |
| 56 | constexpr const char kCaCertDir[] = "/system/etc/security/cacerts"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 57 | |
Mike Yu | a772c20 | 2019-09-23 17:47:21 +0800 | [diff] [blame] | 58 | int waitForReading(int fd, int timeoutMs = -1) { |
| 59 | pollfd fds = {.fd = fd, .events = POLLIN}; |
| 60 | return TEMP_FAILURE_RETRY(poll(&fds, 1, timeoutMs)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 61 | } |
| 62 | |
Mike Yu | a772c20 | 2019-09-23 17:47:21 +0800 | [diff] [blame] | 63 | int waitForWriting(int fd, int timeoutMs = -1) { |
| 64 | pollfd fds = {.fd = fd, .events = POLLOUT}; |
| 65 | return TEMP_FAILURE_RETRY(poll(&fds, 1, timeoutMs)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 66 | } |
| 67 | |
| 68 | } // namespace |
| 69 | |
| 70 | Status DnsTlsSocket::tcpConnect() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 71 | LOG(DEBUG) << mMark << " connecting TCP socket"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 72 | int type = SOCK_NONBLOCK | SOCK_CLOEXEC; |
| 73 | switch (mServer.protocol) { |
| 74 | case IPPROTO_TCP: |
| 75 | type |= SOCK_STREAM; |
| 76 | break; |
| 77 | default: |
| 78 | return Status(EPROTONOSUPPORT); |
| 79 | } |
| 80 | |
| 81 | mSslFd.reset(socket(mServer.ss.ss_family, type, mServer.protocol)); |
| 82 | if (mSslFd.get() == -1) { |
Mike Yu | f6b6409 | 2020-09-18 14:25:58 +0800 | [diff] [blame] | 83 | PLOG(ERROR) << "Failed to create socket"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 84 | return Status(errno); |
| 85 | } |
| 86 | |
Praveen Moongalam Thyagarajan | 8ab18ba | 2019-09-04 14:46:50 -0700 | [diff] [blame] | 87 | resolv_tag_socket(mSslFd.get(), AID_DNS, NET_CONTEXT_INVALID_PID); |
Sehee Park | 2c11878 | 2019-05-07 13:02:45 +0900 | [diff] [blame] | 88 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 89 | const socklen_t len = sizeof(mMark); |
| 90 | if (setsockopt(mSslFd.get(), SOL_SOCKET, SO_MARK, &mMark, len) == -1) { |
Mike Yu | f6b6409 | 2020-09-18 14:25:58 +0800 | [diff] [blame] | 91 | const int err = errno; |
| 92 | PLOG(ERROR) << "Failed to set socket mark"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 93 | mSslFd.reset(); |
Mike Yu | f6b6409 | 2020-09-18 14:25:58 +0800 | [diff] [blame] | 94 | return Status(err); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 95 | } |
| 96 | |
| 97 | const Status tfo = enableSockopt(mSslFd.get(), SOL_TCP, TCP_FASTOPEN_CONNECT); |
| 98 | if (!isOk(tfo) && tfo.code() != ENOPROTOOPT) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 99 | LOG(WARNING) << "Failed to enable TFO: " << tfo.msg(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 100 | } |
| 101 | |
| 102 | // Send 5 keepalives, 3 seconds apart, after 15 seconds of inactivity. |
| 103 | enableTcpKeepAlives(mSslFd.get(), 15U, 5U, 3U).ignoreError(); |
| 104 | |
| 105 | if (connect(mSslFd.get(), reinterpret_cast<const struct sockaddr *>(&mServer.ss), |
| 106 | sizeof(mServer.ss)) != 0 && |
| 107 | errno != EINPROGRESS) { |
Mike Yu | f6b6409 | 2020-09-18 14:25:58 +0800 | [diff] [blame] | 108 | const int err = errno; |
Mike Yu | 423b58e | 2021-04-07 17:09:09 +0800 | [diff] [blame] | 109 | PLOG(WARNING) << "Socket failed to connect"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 110 | mSslFd.reset(); |
Mike Yu | f6b6409 | 2020-09-18 14:25:58 +0800 | [diff] [blame] | 111 | return Status(err); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 112 | } |
| 113 | |
| 114 | return netdutils::status::ok; |
| 115 | } |
| 116 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 117 | bool DnsTlsSocket::setTestCaCertificate() { |
| 118 | bssl::UniquePtr<BIO> bio( |
| 119 | BIO_new_mem_buf(mServer.certificate.data(), mServer.certificate.size())); |
| 120 | bssl::UniquePtr<X509> cert(PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr)); |
| 121 | if (!cert) { |
| 122 | LOG(ERROR) << "Failed to read cert"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 123 | return false; |
| 124 | } |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 125 | |
| 126 | X509_STORE* cert_store = SSL_CTX_get_cert_store(mSslCtx.get()); |
| 127 | if (!X509_STORE_add_cert(cert_store, cert.get())) { |
| 128 | LOG(ERROR) << "Failed to add cert"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 129 | return false; |
| 130 | } |
| 131 | return true; |
| 132 | } |
| 133 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 134 | // TODO: Try to use static sSslCtx instead of mSslCtx |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 135 | bool DnsTlsSocket::initialize() { |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 136 | // This method is called every time when a new SSL connection is created. |
| 137 | // This lock only serves to help catch bugs in code that calls this method. |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 138 | std::lock_guard guard(mLock); |
| 139 | if (mSslCtx) { |
| 140 | // This is a bug in the caller. |
| 141 | return false; |
| 142 | } |
| 143 | mSslCtx.reset(SSL_CTX_new(TLS_method())); |
| 144 | if (!mSslCtx) { |
| 145 | return false; |
| 146 | } |
| 147 | |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 148 | // Load system CA certs from CAPath for hostname verification. |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 149 | // |
| 150 | // For discussion of alternative, sustainable approaches see b/71909242. |
Ken Chen | 18f64f1 | 2020-01-16 21:12:56 +0800 | [diff] [blame] | 151 | if (!mServer.certificate.empty()) { |
Ken Chen | 26dc2b0 | 2020-06-16 18:49:39 +0800 | [diff] [blame] | 152 | // Inject test CA certs from ResolverParamsParcel.caCertificate for INTERNAL TESTING ONLY. |
| 153 | // This is only allowed by DnsResolverService if the caller is AID_ROOT. |
Lorenzo Colitti | 4658b25 | 2019-11-14 23:45:05 +0900 | [diff] [blame] | 154 | LOG(WARNING) << "Setting test CA certificate. This should never happen in production code."; |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 155 | if (!setTestCaCertificate()) { |
| 156 | LOG(ERROR) << "Failed to set test CA certificate"; |
| 157 | return false; |
| 158 | } |
| 159 | } else { |
| 160 | if (SSL_CTX_load_verify_locations(mSslCtx.get(), nullptr, kCaCertDir) != 1) { |
| 161 | LOG(ERROR) << "Failed to load CA cert dir: " << kCaCertDir; |
| 162 | return false; |
| 163 | } |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 164 | } |
| 165 | |
| 166 | // Enable TLS false start |
| 167 | SSL_CTX_set_false_start_allowed_without_alpn(mSslCtx.get(), 1); |
| 168 | SSL_CTX_set_mode(mSslCtx.get(), SSL_MODE_ENABLE_FALSE_START); |
| 169 | |
| 170 | // Enable session cache |
| 171 | mCache->prepareSslContext(mSslCtx.get()); |
| 172 | |
Mike Yu | 441d937 | 2020-07-15 17:06:22 +0800 | [diff] [blame] | 173 | mEventFd.reset(eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC)); |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 174 | mShutdownEvent.reset(eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC)); |
Mike Yu | 441d937 | 2020-07-15 17:06:22 +0800 | [diff] [blame] | 175 | |
Mike Yu | 1919271 | 2020-08-28 11:56:31 +0800 | [diff] [blame] | 176 | const Experiments* const instance = Experiments::getInstance(); |
| 177 | mConnectTimeoutMs = instance->getFlag("dot_connect_timeout_ms", kDotConnectTimeoutMs); |
| 178 | if (mConnectTimeoutMs < 1000) mConnectTimeoutMs = 1000; |
| 179 | |
| 180 | mAsyncHandshake = instance->getFlag("dot_async_handshake", 0); |
| 181 | LOG(DEBUG) << "DnsTlsSocket is initialized with { mConnectTimeoutMs: " << mConnectTimeoutMs |
| 182 | << ", mAsyncHandshake: " << mAsyncHandshake << " }"; |
| 183 | |
Mike Yu | 0c8e452 | 2020-08-24 14:41:32 +0800 | [diff] [blame] | 184 | transitionState(State::UNINITIALIZED, State::INITIALIZED); |
| 185 | |
Mike Yu | 441d937 | 2020-07-15 17:06:22 +0800 | [diff] [blame] | 186 | return true; |
| 187 | } |
| 188 | |
| 189 | bool DnsTlsSocket::startHandshake() { |
| 190 | std::lock_guard guard(mLock); |
Mike Yu | 0c8e452 | 2020-08-24 14:41:32 +0800 | [diff] [blame] | 191 | if (mState != State::INITIALIZED) { |
| 192 | LOG(ERROR) << "Calling startHandshake in unexpected state " << static_cast<int>(mState); |
Mike Yu | 441d937 | 2020-07-15 17:06:22 +0800 | [diff] [blame] | 193 | return false; |
| 194 | } |
Mike Yu | 0c8e452 | 2020-08-24 14:41:32 +0800 | [diff] [blame] | 195 | transitionState(State::INITIALIZED, State::CONNECTING); |
Mike Yu | 441d937 | 2020-07-15 17:06:22 +0800 | [diff] [blame] | 196 | |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 197 | if (!mAsyncHandshake) { |
| 198 | if (Status status = tcpConnect(); !status.ok()) { |
| 199 | transitionState(State::CONNECTING, State::WAIT_FOR_DELETE); |
| 200 | LOG(WARNING) << "TCP Handshake failed: " << status.code(); |
| 201 | return false; |
| 202 | } |
| 203 | if (mSsl = sslConnect(mSslFd.get()); !mSsl) { |
| 204 | transitionState(State::CONNECTING, State::WAIT_FOR_DELETE); |
| 205 | LOG(WARNING) << "TLS Handshake failed"; |
| 206 | return false; |
| 207 | } |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 208 | } |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 209 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 210 | // Start the I/O loop. |
| 211 | mLoopThread.reset(new std::thread(&DnsTlsSocket::loop, this)); |
| 212 | |
| 213 | return true; |
| 214 | } |
| 215 | |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 216 | bssl::UniquePtr<SSL> DnsTlsSocket::prepareForSslConnect(int fd) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 217 | if (!mSslCtx) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 218 | LOG(ERROR) << "Internal error: context is null in sslConnect"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 219 | return nullptr; |
| 220 | } |
| 221 | if (!SSL_CTX_set_min_proto_version(mSslCtx.get(), TLS1_2_VERSION)) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 222 | LOG(ERROR) << "Failed to set minimum TLS version"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 223 | return nullptr; |
| 224 | } |
| 225 | |
| 226 | bssl::UniquePtr<SSL> ssl(SSL_new(mSslCtx.get())); |
| 227 | // This file descriptor is owned by mSslFd, so don't let libssl close it. |
| 228 | bssl::UniquePtr<BIO> bio(BIO_new_socket(fd, BIO_NOCLOSE)); |
| 229 | SSL_set_bio(ssl.get(), bio.get(), bio.get()); |
Maciej Żenczykowski | 3ff678b | 2020-04-23 08:51:26 -0700 | [diff] [blame] | 230 | (void)bio.release(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 231 | |
| 232 | if (!mCache->prepareSsl(ssl.get())) { |
| 233 | return nullptr; |
| 234 | } |
| 235 | |
| 236 | if (!mServer.name.empty()) { |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 237 | LOG(VERBOSE) << "Checking DNS over TLS hostname = " << mServer.name.c_str(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 238 | if (SSL_set_tlsext_host_name(ssl.get(), mServer.name.c_str()) != 1) { |
waynema | 0e73c2e | 2019-07-31 15:04:08 +0800 | [diff] [blame] | 239 | LOG(ERROR) << "Failed to set SNI to " << mServer.name; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 240 | return nullptr; |
| 241 | } |
| 242 | X509_VERIFY_PARAM* param = SSL_get0_param(ssl.get()); |
| 243 | if (X509_VERIFY_PARAM_set1_host(param, mServer.name.data(), mServer.name.size()) != 1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 244 | LOG(ERROR) << "Failed to set verify host param to " << mServer.name; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 245 | return nullptr; |
| 246 | } |
| 247 | // This will cause the handshake to fail if certificate verification fails. |
| 248 | SSL_set_verify(ssl.get(), SSL_VERIFY_PEER, nullptr); |
| 249 | } |
| 250 | |
| 251 | bssl::UniquePtr<SSL_SESSION> session = mCache->getSession(); |
| 252 | if (session) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 253 | LOG(DEBUG) << "Setting session"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 254 | SSL_set_session(ssl.get(), session.get()); |
| 255 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 256 | LOG(DEBUG) << "No session available"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 257 | } |
| 258 | |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 259 | return ssl; |
| 260 | } |
| 261 | |
| 262 | bssl::UniquePtr<SSL> DnsTlsSocket::sslConnect(int fd) { |
| 263 | bssl::UniquePtr<SSL> ssl; |
| 264 | if (ssl = prepareForSslConnect(fd); !ssl) { |
| 265 | return nullptr; |
| 266 | } |
| 267 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 268 | for (;;) { |
Mike Yu | 17bb79a | 2020-05-20 19:57:12 +0800 | [diff] [blame] | 269 | LOG(DEBUG) << " Calling SSL_connect with mark 0x" << std::hex << mMark; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 270 | int ret = SSL_connect(ssl.get()); |
Mike Yu | 17bb79a | 2020-05-20 19:57:12 +0800 | [diff] [blame] | 271 | LOG(DEBUG) << " SSL_connect returned " << ret << " with mark 0x" << std::hex << mMark; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 272 | if (ret == 1) break; // SSL handshake complete; |
| 273 | |
| 274 | const int ssl_err = SSL_get_error(ssl.get(), ret); |
| 275 | switch (ssl_err) { |
| 276 | case SSL_ERROR_WANT_READ: |
Mike Yu | a772c20 | 2019-09-23 17:47:21 +0800 | [diff] [blame] | 277 | // SSL_ERROR_WANT_READ is returned because the application data has been sent during |
| 278 | // the TCP connection handshake, the device is waiting for the SSL handshake reply |
| 279 | // from the server. |
Mike Yu | 1919271 | 2020-08-28 11:56:31 +0800 | [diff] [blame] | 280 | if (int err = waitForReading(fd, mConnectTimeoutMs); err <= 0) { |
Mike Yu | 17bb79a | 2020-05-20 19:57:12 +0800 | [diff] [blame] | 281 | PLOG(WARNING) << "SSL_connect read error " << err << ", mark 0x" << std::hex |
| 282 | << mMark; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 283 | return nullptr; |
| 284 | } |
| 285 | break; |
| 286 | case SSL_ERROR_WANT_WRITE: |
Mike Yu | a772c20 | 2019-09-23 17:47:21 +0800 | [diff] [blame] | 287 | // If no application data is sent during the TCP connection handshake, the |
| 288 | // device is waiting for the connection established to perform SSL handshake. |
Mike Yu | 1919271 | 2020-08-28 11:56:31 +0800 | [diff] [blame] | 289 | if (int err = waitForWriting(fd, mConnectTimeoutMs); err <= 0) { |
Mike Yu | 17bb79a | 2020-05-20 19:57:12 +0800 | [diff] [blame] | 290 | PLOG(WARNING) << "SSL_connect write error " << err << ", mark 0x" << std::hex |
| 291 | << mMark; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 292 | return nullptr; |
| 293 | } |
| 294 | break; |
| 295 | default: |
Mike Yu | 17bb79a | 2020-05-20 19:57:12 +0800 | [diff] [blame] | 296 | PLOG(WARNING) << "SSL_connect ssl error =" << ssl_err << ", mark 0x" << std::hex |
| 297 | << mMark; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 298 | return nullptr; |
| 299 | } |
| 300 | } |
| 301 | |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 302 | LOG(DEBUG) << mMark << " handshake complete"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 303 | |
| 304 | return ssl; |
| 305 | } |
| 306 | |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 307 | bssl::UniquePtr<SSL> DnsTlsSocket::sslConnectV2(int fd) { |
| 308 | bssl::UniquePtr<SSL> ssl; |
| 309 | if (ssl = prepareForSslConnect(fd); !ssl) { |
| 310 | return nullptr; |
| 311 | } |
| 312 | |
| 313 | for (;;) { |
| 314 | LOG(DEBUG) << " Calling SSL_connect with mark 0x" << std::hex << mMark; |
| 315 | int ret = SSL_connect(ssl.get()); |
| 316 | LOG(DEBUG) << " SSL_connect returned " << ret << " with mark 0x" << std::hex << mMark; |
| 317 | if (ret == 1) break; // SSL handshake complete; |
| 318 | |
| 319 | enum { SSLFD = 0, EVENTFD = 1 }; |
| 320 | pollfd fds[2] = { |
| 321 | {.fd = mSslFd.get(), .events = 0}, |
| 322 | {.fd = mShutdownEvent.get(), .events = POLLIN}, |
| 323 | }; |
| 324 | |
| 325 | const int ssl_err = SSL_get_error(ssl.get(), ret); |
| 326 | switch (ssl_err) { |
| 327 | case SSL_ERROR_WANT_READ: |
| 328 | fds[SSLFD].events = POLLIN; |
| 329 | break; |
| 330 | case SSL_ERROR_WANT_WRITE: |
| 331 | fds[SSLFD].events = POLLOUT; |
| 332 | break; |
| 333 | default: |
| 334 | PLOG(WARNING) << "SSL_connect ssl error =" << ssl_err << ", mark 0x" << std::hex |
| 335 | << mMark; |
| 336 | return nullptr; |
| 337 | } |
| 338 | |
Mike Yu | 1919271 | 2020-08-28 11:56:31 +0800 | [diff] [blame] | 339 | int n = TEMP_FAILURE_RETRY(poll(fds, std::size(fds), mConnectTimeoutMs)); |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 340 | if (n <= 0) { |
| 341 | PLOG(WARNING) << ((n == 0) ? "handshake timeout" : "Poll failed"); |
| 342 | return nullptr; |
| 343 | } |
| 344 | |
| 345 | if (fds[EVENTFD].revents & (POLLIN | POLLERR)) { |
| 346 | LOG(WARNING) << "Got shutdown request during handshake"; |
| 347 | return nullptr; |
| 348 | } |
| 349 | if (fds[SSLFD].revents & POLLERR) { |
| 350 | LOG(WARNING) << "Got POLLERR on SSLFD during handshake"; |
| 351 | return nullptr; |
| 352 | } |
| 353 | } |
| 354 | |
| 355 | LOG(DEBUG) << mMark << " handshake complete"; |
| 356 | |
| 357 | return ssl; |
| 358 | } |
| 359 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 360 | void DnsTlsSocket::sslDisconnect() { |
| 361 | if (mSsl) { |
| 362 | SSL_shutdown(mSsl.get()); |
| 363 | mSsl.reset(); |
| 364 | } |
| 365 | mSslFd.reset(); |
| 366 | } |
| 367 | |
| 368 | bool DnsTlsSocket::sslWrite(const Slice buffer) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 369 | LOG(DEBUG) << mMark << " Writing " << buffer.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 370 | for (;;) { |
| 371 | int ret = SSL_write(mSsl.get(), buffer.base(), buffer.size()); |
| 372 | if (ret == int(buffer.size())) break; // SSL write complete; |
| 373 | |
| 374 | if (ret < 1) { |
| 375 | const int ssl_err = SSL_get_error(mSsl.get(), ret); |
| 376 | switch (ssl_err) { |
| 377 | case SSL_ERROR_WANT_WRITE: |
Mike Yu | a772c20 | 2019-09-23 17:47:21 +0800 | [diff] [blame] | 378 | if (int err = waitForWriting(mSslFd.get()); err <= 0) { |
| 379 | PLOG(WARNING) << "Poll failed in sslWrite, error " << err; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 380 | return false; |
| 381 | } |
| 382 | continue; |
| 383 | case 0: |
| 384 | break; // SSL write complete; |
| 385 | default: |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 386 | LOG(DEBUG) << "SSL_write error " << ssl_err; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 387 | return false; |
| 388 | } |
| 389 | } |
| 390 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 391 | LOG(DEBUG) << mMark << " Wrote " << buffer.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 392 | return true; |
| 393 | } |
| 394 | |
| 395 | void DnsTlsSocket::loop() { |
| 396 | std::lock_guard guard(mLock); |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 397 | std::deque<std::vector<uint8_t>> q; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 398 | const int timeout_msecs = DnsTlsSocket::kIdleTimeout.count() * 1000; |
Mike Yu | 04f1d48 | 2019-08-08 11:09:32 +0800 | [diff] [blame] | 399 | |
chenbruce | 9b72daa | 2021-08-20 00:00:49 +0800 | [diff] [blame] | 400 | setThreadName(fmt::format("TlsListen_{}", mMark & 0xffff)); |
Mike Yu | 0c8e452 | 2020-08-24 14:41:32 +0800 | [diff] [blame] | 401 | |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 402 | if (mAsyncHandshake) { |
| 403 | if (Status status = tcpConnect(); !status.ok()) { |
| 404 | LOG(WARNING) << "TCP Handshake failed: " << status.code(); |
| 405 | mObserver->onClosed(); |
| 406 | transitionState(State::CONNECTING, State::WAIT_FOR_DELETE); |
| 407 | return; |
| 408 | } |
| 409 | if (mSsl = sslConnectV2(mSslFd.get()); !mSsl) { |
| 410 | LOG(WARNING) << "TLS Handshake failed"; |
| 411 | mObserver->onClosed(); |
| 412 | transitionState(State::CONNECTING, State::WAIT_FOR_DELETE); |
| 413 | return; |
| 414 | } |
| 415 | LOG(DEBUG) << "Handshaking succeeded"; |
| 416 | } |
| 417 | |
| 418 | transitionState(State::CONNECTING, State::CONNECTED); |
| 419 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 420 | while (true) { |
| 421 | // poll() ignores negative fds |
| 422 | struct pollfd fds[2] = { { .fd = -1 }, { .fd = -1 } }; |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 423 | enum { SSLFD = 0, EVENTFD = 1 }; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 424 | |
| 425 | // Always listen for a response from server. |
| 426 | fds[SSLFD].fd = mSslFd.get(); |
| 427 | fds[SSLFD].events = POLLIN; |
| 428 | |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 429 | // If we have pending queries, wait for space to write one. |
| 430 | // Otherwise, listen for new queries. |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 431 | // Note: This blocks the destructor until q is empty, i.e. until all pending |
| 432 | // queries are sent or have failed to send. |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 433 | if (!q.empty()) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 434 | fds[SSLFD].events |= POLLOUT; |
| 435 | } else { |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 436 | fds[EVENTFD].fd = mEventFd.get(); |
| 437 | fds[EVENTFD].events = POLLIN; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 438 | } |
| 439 | |
| 440 | const int s = TEMP_FAILURE_RETRY(poll(fds, std::size(fds), timeout_msecs)); |
| 441 | if (s == 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 442 | LOG(DEBUG) << "Idle timeout"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 443 | break; |
| 444 | } |
| 445 | if (s < 0) { |
Mike Yu | f6b6409 | 2020-09-18 14:25:58 +0800 | [diff] [blame] | 446 | PLOG(DEBUG) << "Poll failed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 447 | break; |
| 448 | } |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 449 | if (fds[SSLFD].revents & (POLLIN | POLLERR | POLLHUP)) { |
Mike Yu | 5e1b991 | 2020-11-10 16:50:13 +0800 | [diff] [blame] | 450 | bool readFailed = false; |
| 451 | |
| 452 | // readResponse() only reads one DNS (and consumes exact bytes) from ssl. |
| 453 | // Keep doing so until ssl has no pending data. |
| 454 | // TODO: readResponse() can block until it reads a complete DNS response. Consider |
| 455 | // refactoring it to not get blocked in any case. |
| 456 | do { |
| 457 | if (!readResponse()) { |
| 458 | LOG(DEBUG) << "SSL remote close or read error."; |
| 459 | readFailed = true; |
| 460 | } |
| 461 | } while (SSL_pending(mSsl.get()) > 0 && !readFailed); |
| 462 | |
| 463 | if (readFailed) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 464 | break; |
| 465 | } |
| 466 | } |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 467 | if (fds[EVENTFD].revents & (POLLIN | POLLERR)) { |
| 468 | int64_t num_queries; |
| 469 | ssize_t res = read(mEventFd.get(), &num_queries, sizeof(num_queries)); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 470 | if (res < 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 471 | LOG(WARNING) << "Error during eventfd read"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 472 | break; |
| 473 | } else if (res == 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 474 | LOG(WARNING) << "eventfd closed; disconnecting"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 475 | break; |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 476 | } else if (res != sizeof(num_queries)) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 477 | LOG(ERROR) << "Int size mismatch: " << res << " != " << sizeof(num_queries); |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 478 | break; |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 479 | } else if (num_queries < 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 480 | LOG(DEBUG) << "Negative eventfd read indicates destructor-initiated shutdown"; |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 481 | break; |
| 482 | } |
| 483 | // Take ownership of all pending queries. (q is always empty here.) |
| 484 | mQueue.swap(q); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 485 | } else if (fds[SSLFD].revents & POLLOUT) { |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 486 | // q cannot be empty here. |
| 487 | // Sending the entire queue here would risk a TCP flow control deadlock, so |
| 488 | // we only send a single query on each cycle of this loop. |
| 489 | // TODO: Coalesce multiple pending queries if there is enough space in the |
| 490 | // write buffer. |
| 491 | if (!sendQuery(q.front())) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 492 | break; |
| 493 | } |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 494 | q.pop_front(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 495 | } |
| 496 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 497 | LOG(DEBUG) << "Disconnecting"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 498 | sslDisconnect(); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 499 | LOG(DEBUG) << "Calling onClosed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 500 | mObserver->onClosed(); |
Mike Yu | 0c8e452 | 2020-08-24 14:41:32 +0800 | [diff] [blame] | 501 | transitionState(State::CONNECTED, State::WAIT_FOR_DELETE); |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 502 | LOG(DEBUG) << "Ending loop"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 503 | } |
| 504 | |
| 505 | DnsTlsSocket::~DnsTlsSocket() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 506 | LOG(DEBUG) << "Destructor"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 507 | // This will trigger an orderly shutdown in loop(). |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 508 | requestLoopShutdown(); |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 509 | { |
| 510 | // Wait for the orderly shutdown to complete. |
| 511 | std::lock_guard guard(mLock); |
| 512 | if (mLoopThread && std::this_thread::get_id() == mLoopThread->get_id()) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 513 | LOG(ERROR) << "Violation of re-entrance precondition"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 514 | return; |
| 515 | } |
| 516 | } |
| 517 | if (mLoopThread) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 518 | LOG(DEBUG) << "Waiting for loop thread to terminate"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 519 | mLoopThread->join(); |
| 520 | mLoopThread.reset(); |
| 521 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 522 | LOG(DEBUG) << "Destructor completed"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 523 | } |
| 524 | |
| 525 | bool DnsTlsSocket::query(uint16_t id, const Slice query) { |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 526 | // Compose the entire message in a single buffer, so that it can be |
| 527 | // sent as a single TLS record. |
| 528 | std::vector<uint8_t> buf(query.size() + 4); |
| 529 | // Write 2-byte length |
| 530 | uint16_t len = query.size() + 2; // + 2 for the ID. |
| 531 | buf[0] = len >> 8; |
| 532 | buf[1] = len; |
| 533 | // Write 2-byte ID |
| 534 | buf[2] = id >> 8; |
| 535 | buf[3] = id; |
| 536 | // Copy body |
| 537 | std::memcpy(buf.data() + 4, query.base(), query.size()); |
| 538 | |
| 539 | mQueue.push(std::move(buf)); |
| 540 | // Increment the mEventFd counter by 1. |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 541 | return incrementEventFd(1); |
| 542 | } |
| 543 | |
| 544 | void DnsTlsSocket::requestLoopShutdown() { |
Bernie Innocenti | 97ee109 | 2019-03-28 15:52:59 +0900 | [diff] [blame] | 545 | if (mEventFd != -1) { |
| 546 | // Write a negative number to the eventfd. This triggers an immediate shutdown. |
| 547 | incrementEventFd(INT64_MIN); |
| 548 | } |
Mike Yu | e93d9ae | 2020-08-25 19:09:51 +0800 | [diff] [blame] | 549 | if (mShutdownEvent != -1) { |
| 550 | if (eventfd_write(mShutdownEvent.get(), INT64_MIN) == -1) { |
| 551 | PLOG(ERROR) << "Failed to write to mShutdownEvent"; |
| 552 | } |
| 553 | } |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 554 | } |
| 555 | |
| 556 | bool DnsTlsSocket::incrementEventFd(const int64_t count) { |
Bernie Innocenti | 97ee109 | 2019-03-28 15:52:59 +0900 | [diff] [blame] | 557 | if (mEventFd == -1) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 558 | LOG(ERROR) << "eventfd is not initialized"; |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 559 | return false; |
| 560 | } |
Bernie Innocenti | 97ee109 | 2019-03-28 15:52:59 +0900 | [diff] [blame] | 561 | ssize_t written = write(mEventFd.get(), &count, sizeof(count)); |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 562 | if (written != sizeof(count)) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 563 | LOG(ERROR) << "Failed to increment eventfd by " << count; |
Ben Schwartz | 62176fd | 2019-01-22 17:32:17 -0500 | [diff] [blame] | 564 | return false; |
| 565 | } |
| 566 | return true; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 567 | } |
| 568 | |
Mike Yu | 0c8e452 | 2020-08-24 14:41:32 +0800 | [diff] [blame] | 569 | void DnsTlsSocket::transitionState(State from, State to) { |
| 570 | if (mState != from) { |
| 571 | LOG(WARNING) << "BUG: transitioning from an unexpected state " << static_cast<int>(mState) |
| 572 | << ", expect: from " << static_cast<int>(from) << " to " |
| 573 | << static_cast<int>(to); |
| 574 | } |
| 575 | mState = to; |
| 576 | } |
| 577 | |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 578 | // Read exactly len bytes into buffer or fail with an SSL error code |
| 579 | int DnsTlsSocket::sslRead(const Slice buffer, bool wait) { |
| 580 | size_t remaining = buffer.size(); |
| 581 | while (remaining > 0) { |
| 582 | int ret = SSL_read(mSsl.get(), buffer.limit() - remaining, remaining); |
| 583 | if (ret == 0) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 584 | if (remaining < buffer.size()) |
| 585 | LOG(WARNING) << "SSL closed with " << remaining << " of " << buffer.size() |
| 586 | << " bytes remaining"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 587 | return SSL_ERROR_ZERO_RETURN; |
| 588 | } |
| 589 | |
| 590 | if (ret < 0) { |
| 591 | const int ssl_err = SSL_get_error(mSsl.get(), ret); |
| 592 | if (wait && ssl_err == SSL_ERROR_WANT_READ) { |
Mike Yu | a772c20 | 2019-09-23 17:47:21 +0800 | [diff] [blame] | 593 | if (int err = waitForReading(mSslFd.get()); err <= 0) { |
| 594 | PLOG(WARNING) << "Poll failed in sslRead, error " << err; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 595 | return SSL_ERROR_SYSCALL; |
| 596 | } |
| 597 | continue; |
| 598 | } else { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 599 | LOG(DEBUG) << "SSL_read error " << ssl_err; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 600 | return ssl_err; |
| 601 | } |
| 602 | } |
| 603 | |
| 604 | remaining -= ret; |
| 605 | wait = true; // Once a read is started, try to finish. |
| 606 | } |
| 607 | return SSL_ERROR_NONE; |
| 608 | } |
| 609 | |
Ben Schwartz | 2187abe | 2019-01-10 14:30:46 -0500 | [diff] [blame] | 610 | bool DnsTlsSocket::sendQuery(const std::vector<uint8_t>& buf) { |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 611 | if (!sslWrite(netdutils::makeSlice(buf))) { |
| 612 | return false; |
| 613 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 614 | LOG(DEBUG) << mMark << " SSL_write complete"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 615 | return true; |
| 616 | } |
| 617 | |
| 618 | bool DnsTlsSocket::readResponse() { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 619 | LOG(DEBUG) << "reading response"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 620 | uint8_t responseHeader[2]; |
| 621 | int err = sslRead(Slice(responseHeader, 2), false); |
| 622 | if (err == SSL_ERROR_WANT_READ) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 623 | LOG(DEBUG) << "Ignoring spurious wakeup from server"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 624 | return true; |
| 625 | } |
| 626 | if (err != SSL_ERROR_NONE) { |
| 627 | return false; |
| 628 | } |
| 629 | // Truncate responses larger than MAX_SIZE. This is safe because a DNS packet is |
| 630 | // always invalid when truncated, so the response will be treated as an error. |
| 631 | constexpr uint16_t MAX_SIZE = 8192; |
| 632 | const uint16_t responseSize = (responseHeader[0] << 8) | responseHeader[1]; |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 633 | LOG(DEBUG) << mMark << " Expecting response of size " << responseSize; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 634 | std::vector<uint8_t> response(std::min(responseSize, MAX_SIZE)); |
| 635 | if (sslRead(netdutils::makeSlice(response), true) != SSL_ERROR_NONE) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 636 | LOG(DEBUG) << mMark << " Failed to read " << response.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 637 | return false; |
| 638 | } |
| 639 | uint16_t remainingBytes = responseSize - response.size(); |
| 640 | while (remainingBytes > 0) { |
| 641 | constexpr uint16_t CHUNK_SIZE = 2048; |
| 642 | std::vector<uint8_t> discard(std::min(remainingBytes, CHUNK_SIZE)); |
| 643 | if (sslRead(netdutils::makeSlice(discard), true) != SSL_ERROR_NONE) { |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 644 | LOG(DEBUG) << mMark << " Failed to discard " << discard.size() << " bytes"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 645 | return false; |
| 646 | } |
| 647 | remainingBytes -= discard.size(); |
| 648 | } |
chenbruce | aff8584 | 2019-05-31 15:46:42 +0800 | [diff] [blame] | 649 | LOG(DEBUG) << mMark << " SSL_read complete"; |
Mike Yu | bab3daa | 2018-10-19 22:11:43 +0800 | [diff] [blame] | 650 | |
| 651 | mObserver->onResponse(std::move(response)); |
| 652 | return true; |
| 653 | } |
| 654 | |
| 655 | } // end of namespace net |
| 656 | } // end of namespace android |