• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2008 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #define LOG_TAG "res_cache"
30 
31 #include "resolv_cache.h"
32 
33 #include <resolv.h>
34 #include <stdarg.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <time.h>
39 #include <mutex>
40 
41 #include <arpa/inet.h>
42 #include <arpa/nameser.h>
43 #include <errno.h>
44 #include <linux/if.h>
45 #include <net/if.h>
46 #include <netdb.h>
47 
48 #include <android-base/logging.h>
49 #include <android-base/parseint.h>
50 #include <android-base/thread_annotations.h>
51 #include <android/multinetwork.h>  // ResNsendFlags
52 
53 #include <server_configurable_flags/get_flags.h>
54 
55 #include "res_state_ext.h"
56 #include "resolv_private.h"
57 
58 // NOTE: verbose logging MUST NOT be left enabled in production binaries.
59 // It floods logs at high rate, and can leak privacy-sensitive information.
60 constexpr bool kDumpData = false;
61 
62 /* This code implements a small and *simple* DNS resolver cache.
63  *
64  * It is only used to cache DNS answers for a time defined by the smallest TTL
65  * among the answer records in order to reduce DNS traffic. It is not supposed
66  * to be a full DNS cache, since we plan to implement that in the future in a
67  * dedicated process running on the system.
68  *
69  * Note that its design is kept simple very intentionally, i.e.:
70  *
71  *  - it takes raw DNS query packet data as input, and returns raw DNS
72  *    answer packet data as output
73  *
74  *    (this means that two similar queries that encode the DNS name
75  *     differently will be treated distinctly).
76  *
77  *    the smallest TTL value among the answer records are used as the time
78  *    to keep an answer in the cache.
79  *
80  *    this is bad, but we absolutely want to avoid parsing the answer packets
81  *    (and should be solved by the later full DNS cache process).
82  *
83  *  - the implementation is just a (query-data) => (answer-data) hash table
84  *    with a trivial least-recently-used expiration policy.
85  *
86  * Doing this keeps the code simple and avoids to deal with a lot of things
87  * that a full DNS cache is expected to do.
88  *
89  * The API is also very simple:
90  *
91  *   - the client calls _resolv_cache_get() to obtain a handle to the cache.
92  *     this will initialize the cache on first usage. the result can be NULL
93  *     if the cache is disabled.
94  *
95  *   - the client calls _resolv_cache_lookup() before performing a query
96  *
97  *     if the function returns RESOLV_CACHE_FOUND, a copy of the answer data
98  *     has been copied into the client-provided answer buffer.
99  *
100  *     if the function returns RESOLV_CACHE_NOTFOUND, the client should perform
101  *     a request normally, *then* call _resolv_cache_add() to add the received
102  *     answer to the cache.
103  *
104  *     if the function returns RESOLV_CACHE_UNSUPPORTED, the client should
105  *     perform a request normally, and *not* call _resolv_cache_add()
106  *
107  *     note that RESOLV_CACHE_UNSUPPORTED is also returned if the answer buffer
108  *     is too short to accomodate the cached result.
109  */
110 
111 /* default number of entries kept in the cache. This value has been
112  * determined by browsing through various sites and counting the number
113  * of corresponding requests. Keep in mind that our framework is currently
114  * performing two requests per name lookup (one for IPv4, the other for IPv6)
115  *
116  *    www.google.com      4
117  *    www.ysearch.com     6
118  *    www.amazon.com      8
119  *    www.nytimes.com     22
120  *    www.espn.com        28
121  *    www.msn.com         28
122  *    www.lemonde.fr      35
123  *
124  * (determined in 2009-2-17 from Paris, France, results may vary depending
125  *  on location)
126  *
127  * most high-level websites use lots of media/ad servers with different names
128  * but these are generally reused when browsing through the site.
129  *
130  * As such, a value of 64 should be relatively comfortable at the moment.
131  *
132  * ******************************************
133  * * NOTE - this has changed.
134  * * 1) we've added IPv6 support so each dns query results in 2 responses
135  * * 2) we've made this a system-wide cache, so the cost is less (it's not
136  * *    duplicated in each process) and the need is greater (more processes
137  * *    making different requests).
138  * * Upping by 2x for IPv6
139  * * Upping by another 5x for the centralized nature
140  * *****************************************
141  */
142 #define CONFIG_MAX_ENTRIES (64 * 2 * 5)
143 
144 /** BOUNDED BUFFER FORMATTING **/
145 
146 /* technical note:
147  *
148  *   the following debugging routines are used to append data to a bounded
149  *   buffer they take two parameters that are:
150  *
151  *   - p : a pointer to the current cursor position in the buffer
152  *         this value is initially set to the buffer's address.
153  *
154  *   - end : the address of the buffer's limit, i.e. of the first byte
155  *           after the buffer. this address should never be touched.
156  *
157  *           IMPORTANT: it is assumed that end > buffer_address, i.e.
158  *                      that the buffer is at least one byte.
159  *
160  *   the bprint_x() functions return the new value of 'p' after the data
161  *   has been appended, and also ensure the following:
162  *
163  *   - the returned value will never be strictly greater than 'end'
164  *
165  *   - a return value equal to 'end' means that truncation occurred
166  *     (in which case, end[-1] will be set to 0)
167  *
168  *   - after returning from a bprint_x() function, the content of the buffer
169  *     is always 0-terminated, even in the event of truncation.
170  *
171  *  these conventions allow you to call bprint_x() functions multiple times and
172  *  only check for truncation at the end of the sequence, as in:
173  *
174  *     char  buff[1000], *p = buff, *end = p + sizeof(buff);
175  *
176  *     p = bprint_c(p, end, '"');
177  *     p = bprint_s(p, end, my_string);
178  *     p = bprint_c(p, end, '"');
179  *
180  *     if (p >= end) {
181  *        // buffer was too small
182  *     }
183  *
184  *     printf( "%s", buff );
185  */
186 
187 /* Defaults used for initializing res_params */
188 
189 // If successes * 100 / total_samples is less than this value, the server is considered failing
190 #define SUCCESS_THRESHOLD 75
191 // Sample validity in seconds. Set to -1 to disable skipping failing servers.
192 #define NSSAMPLE_VALIDITY 1800
193 
194 /* add a char to a bounded buffer */
bprint_c(char * p,char * end,int c)195 static char* bprint_c(char* p, char* end, int c) {
196     if (p < end) {
197         if (p + 1 == end)
198             *p++ = 0;
199         else {
200             *p++ = (char) c;
201             *p = 0;
202         }
203     }
204     return p;
205 }
206 
207 /* add a sequence of bytes to a bounded buffer */
bprint_b(char * p,char * end,const char * buf,int len)208 static char* bprint_b(char* p, char* end, const char* buf, int len) {
209     int avail = end - p;
210 
211     if (avail <= 0 || len <= 0) return p;
212 
213     if (avail > len) avail = len;
214 
215     memcpy(p, buf, avail);
216     p += avail;
217 
218     if (p < end)
219         p[0] = 0;
220     else
221         end[-1] = 0;
222 
223     return p;
224 }
225 
226 /* add a string to a bounded buffer */
bprint_s(char * p,char * end,const char * str)227 static char* bprint_s(char* p, char* end, const char* str) {
228     return bprint_b(p, end, str, strlen(str));
229 }
230 
231 /* add a formatted string to a bounded buffer */
bprint(char * p,char * end,const char * format,...)232 static char* bprint(char* p, char* end, const char* format, ...) {
233     int avail, n;
234     va_list args;
235 
236     avail = end - p;
237 
238     if (avail <= 0) return p;
239 
240     va_start(args, format);
241     n = vsnprintf(p, avail, format, args);
242     va_end(args);
243 
244     /* certain C libraries return -1 in case of truncation */
245     if (n < 0 || n > avail) n = avail;
246 
247     p += n;
248     /* certain C libraries do not zero-terminate in case of truncation */
249     if (p == end) p[-1] = 0;
250 
251     return p;
252 }
253 
254 /* add a hex value to a bounded buffer, up to 8 digits */
bprint_hex(char * p,char * end,unsigned value,int numDigits)255 static char* bprint_hex(char* p, char* end, unsigned value, int numDigits) {
256     char text[sizeof(unsigned) * 2];
257     int nn = 0;
258 
259     while (numDigits-- > 0) {
260         text[nn++] = "0123456789abcdef"[(value >> (numDigits * 4)) & 15];
261     }
262     return bprint_b(p, end, text, nn);
263 }
264 
265 /* add the hexadecimal dump of some memory area to a bounded buffer */
bprint_hexdump(char * p,char * end,const uint8_t * data,int datalen)266 static char* bprint_hexdump(char* p, char* end, const uint8_t* data, int datalen) {
267     int lineSize = 16;
268 
269     while (datalen > 0) {
270         int avail = datalen;
271         int nn;
272 
273         if (avail > lineSize) avail = lineSize;
274 
275         for (nn = 0; nn < avail; nn++) {
276             if (nn > 0) p = bprint_c(p, end, ' ');
277             p = bprint_hex(p, end, data[nn], 2);
278         }
279         for (; nn < lineSize; nn++) {
280             p = bprint_s(p, end, "   ");
281         }
282         p = bprint_s(p, end, "  ");
283 
284         for (nn = 0; nn < avail; nn++) {
285             int c = data[nn];
286 
287             if (c < 32 || c > 127) c = '.';
288 
289             p = bprint_c(p, end, c);
290         }
291         p = bprint_c(p, end, '\n');
292 
293         data += avail;
294         datalen -= avail;
295     }
296     return p;
297 }
298 
299 /* dump the content of a query of packet to the log */
dump_bytes(const uint8_t * base,int len)300 static void dump_bytes(const uint8_t* base, int len) {
301     if (!kDumpData) return;
302 
303     char buff[1024];
304     char *p = buff, *end = p + sizeof(buff);
305 
306     p = bprint_hexdump(p, end, base, len);
307     LOG(INFO) << __func__ << ": " << buff;
308 }
309 
_time_now(void)310 static time_t _time_now(void) {
311     struct timeval tv;
312 
313     gettimeofday(&tv, NULL);
314     return tv.tv_sec;
315 }
316 
317 /* reminder: the general format of a DNS packet is the following:
318  *
319  *    HEADER  (12 bytes)
320  *    QUESTION  (variable)
321  *    ANSWER (variable)
322  *    AUTHORITY (variable)
323  *    ADDITIONNAL (variable)
324  *
325  * the HEADER is made of:
326  *
327  *   ID     : 16 : 16-bit unique query identification field
328  *
329  *   QR     :  1 : set to 0 for queries, and 1 for responses
330  *   Opcode :  4 : set to 0 for queries
331  *   AA     :  1 : set to 0 for queries
332  *   TC     :  1 : truncation flag, will be set to 0 in queries
333  *   RD     :  1 : recursion desired
334  *
335  *   RA     :  1 : recursion available (0 in queries)
336  *   Z      :  3 : three reserved zero bits
337  *   RCODE  :  4 : response code (always 0=NOERROR in queries)
338  *
339  *   QDCount: 16 : question count
340  *   ANCount: 16 : Answer count (0 in queries)
341  *   NSCount: 16: Authority Record count (0 in queries)
342  *   ARCount: 16: Additionnal Record count (0 in queries)
343  *
344  * the QUESTION is made of QDCount Question Record (QRs)
345  * the ANSWER is made of ANCount RRs
346  * the AUTHORITY is made of NSCount RRs
347  * the ADDITIONNAL is made of ARCount RRs
348  *
349  * Each Question Record (QR) is made of:
350  *
351  *   QNAME   : variable : Query DNS NAME
352  *   TYPE    : 16       : type of query (A=1, PTR=12, MX=15, AAAA=28, ALL=255)
353  *   CLASS   : 16       : class of query (IN=1)
354  *
355  * Each Resource Record (RR) is made of:
356  *
357  *   NAME    : variable : DNS NAME
358  *   TYPE    : 16       : type of query (A=1, PTR=12, MX=15, AAAA=28, ALL=255)
359  *   CLASS   : 16       : class of query (IN=1)
360  *   TTL     : 32       : seconds to cache this RR (0=none)
361  *   RDLENGTH: 16       : size of RDDATA in bytes
362  *   RDDATA  : variable : RR data (depends on TYPE)
363  *
364  * Each QNAME contains a domain name encoded as a sequence of 'labels'
365  * terminated by a zero. Each label has the following format:
366  *
367  *    LEN  : 8     : lenght of label (MUST be < 64)
368  *    NAME : 8*LEN : label length (must exclude dots)
369  *
370  * A value of 0 in the encoding is interpreted as the 'root' domain and
371  * terminates the encoding. So 'www.android.com' will be encoded as:
372  *
373  *   <3>www<7>android<3>com<0>
374  *
375  * Where <n> represents the byte with value 'n'
376  *
377  * Each NAME reflects the QNAME of the question, but has a slightly more
378  * complex encoding in order to provide message compression. This is achieved
379  * by using a 2-byte pointer, with format:
380  *
381  *    TYPE   : 2  : 0b11 to indicate a pointer, 0b01 and 0b10 are reserved
382  *    OFFSET : 14 : offset to another part of the DNS packet
383  *
384  * The offset is relative to the start of the DNS packet and must point
385  * A pointer terminates the encoding.
386  *
387  * The NAME can be encoded in one of the following formats:
388  *
389  *   - a sequence of simple labels terminated by 0 (like QNAMEs)
390  *   - a single pointer
391  *   - a sequence of simple labels terminated by a pointer
392  *
393  * A pointer shall always point to either a pointer of a sequence of
394  * labels (which can themselves be terminated by either a 0 or a pointer)
395  *
396  * The expanded length of a given domain name should not exceed 255 bytes.
397  *
398  * NOTE: we don't parse the answer packets, so don't need to deal with NAME
399  *       records, only QNAMEs.
400  */
401 
402 #define DNS_HEADER_SIZE 12
403 
404 #define DNS_TYPE_A "\00\01"     /* big-endian decimal 1 */
405 #define DNS_TYPE_PTR "\00\014"  /* big-endian decimal 12 */
406 #define DNS_TYPE_MX "\00\017"   /* big-endian decimal 15 */
407 #define DNS_TYPE_AAAA "\00\034" /* big-endian decimal 28 */
408 #define DNS_TYPE_ALL "\00\0377" /* big-endian decimal 255 */
409 
410 #define DNS_CLASS_IN "\00\01" /* big-endian decimal 1 */
411 
412 typedef struct {
413     const uint8_t* base;
414     const uint8_t* end;
415     const uint8_t* cursor;
416 } DnsPacket;
417 
_dnsPacket_init(DnsPacket * packet,const uint8_t * buff,int bufflen)418 static void _dnsPacket_init(DnsPacket* packet, const uint8_t* buff, int bufflen) {
419     packet->base = buff;
420     packet->end = buff + bufflen;
421     packet->cursor = buff;
422 }
423 
_dnsPacket_rewind(DnsPacket * packet)424 static void _dnsPacket_rewind(DnsPacket* packet) {
425     packet->cursor = packet->base;
426 }
427 
_dnsPacket_skip(DnsPacket * packet,int count)428 static void _dnsPacket_skip(DnsPacket* packet, int count) {
429     const uint8_t* p = packet->cursor + count;
430 
431     if (p > packet->end) p = packet->end;
432 
433     packet->cursor = p;
434 }
435 
_dnsPacket_readInt16(DnsPacket * packet)436 static int _dnsPacket_readInt16(DnsPacket* packet) {
437     const uint8_t* p = packet->cursor;
438 
439     if (p + 2 > packet->end) return -1;
440 
441     packet->cursor = p + 2;
442     return (p[0] << 8) | p[1];
443 }
444 
445 /** QUERY CHECKING **/
446 
447 /* check bytes in a dns packet. returns 1 on success, 0 on failure.
448  * the cursor is only advanced in the case of success
449  */
_dnsPacket_checkBytes(DnsPacket * packet,int numBytes,const void * bytes)450 static int _dnsPacket_checkBytes(DnsPacket* packet, int numBytes, const void* bytes) {
451     const uint8_t* p = packet->cursor;
452 
453     if (p + numBytes > packet->end) return 0;
454 
455     if (memcmp(p, bytes, numBytes) != 0) return 0;
456 
457     packet->cursor = p + numBytes;
458     return 1;
459 }
460 
461 /* parse and skip a given QNAME stored in a query packet,
462  * from the current cursor position. returns 1 on success,
463  * or 0 for malformed data.
464  */
_dnsPacket_checkQName(DnsPacket * packet)465 static int _dnsPacket_checkQName(DnsPacket* packet) {
466     const uint8_t* p = packet->cursor;
467     const uint8_t* end = packet->end;
468 
469     for (;;) {
470         int c;
471 
472         if (p >= end) break;
473 
474         c = *p++;
475 
476         if (c == 0) {
477             packet->cursor = p;
478             return 1;
479         }
480 
481         /* we don't expect label compression in QNAMEs */
482         if (c >= 64) break;
483 
484         p += c;
485         /* we rely on the bound check at the start
486          * of the loop here */
487     }
488     /* malformed data */
489     LOG(INFO) << __func__ << ": malformed QNAME";
490     return 0;
491 }
492 
493 /* parse and skip a given QR stored in a packet.
494  * returns 1 on success, and 0 on failure
495  */
_dnsPacket_checkQR(DnsPacket * packet)496 static int _dnsPacket_checkQR(DnsPacket* packet) {
497     if (!_dnsPacket_checkQName(packet)) return 0;
498 
499     /* TYPE must be one of the things we support */
500     if (!_dnsPacket_checkBytes(packet, 2, DNS_TYPE_A) &&
501         !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_PTR) &&
502         !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_MX) &&
503         !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_AAAA) &&
504         !_dnsPacket_checkBytes(packet, 2, DNS_TYPE_ALL)) {
505         LOG(INFO) << __func__ << ": unsupported TYPE";
506         return 0;
507     }
508     /* CLASS must be IN */
509     if (!_dnsPacket_checkBytes(packet, 2, DNS_CLASS_IN)) {
510         LOG(INFO) << __func__ << ": unsupported CLASS";
511         return 0;
512     }
513 
514     return 1;
515 }
516 
517 /* check the header of a DNS Query packet, return 1 if it is one
518  * type of query we can cache, or 0 otherwise
519  */
_dnsPacket_checkQuery(DnsPacket * packet)520 static int _dnsPacket_checkQuery(DnsPacket* packet) {
521     const uint8_t* p = packet->base;
522     int qdCount, anCount, dnCount, arCount;
523 
524     if (p + DNS_HEADER_SIZE > packet->end) {
525         LOG(INFO) << __func__ << ": query packet too small";
526         return 0;
527     }
528 
529     /* QR must be set to 0, opcode must be 0 and AA must be 0 */
530     /* RA, Z, and RCODE must be 0 */
531     if ((p[2] & 0xFC) != 0 || (p[3] & 0xCF) != 0) {
532         LOG(INFO) << __func__ << ": query packet flags unsupported";
533         return 0;
534     }
535 
536     /* Note that we ignore the TC, RD, CD, and AD bits here for the
537      * following reasons:
538      *
539      * - there is no point for a query packet sent to a server
540      *   to have the TC bit set, but the implementation might
541      *   set the bit in the query buffer for its own needs
542      *   between a _resolv_cache_lookup and a
543      *   _resolv_cache_add. We should not freak out if this
544      *   is the case.
545      *
546      * - we consider that the result from a query might depend on
547      *   the RD, AD, and CD bits, so these bits
548      *   should be used to differentiate cached result.
549      *
550      *   this implies that these bits are checked when hashing or
551      *   comparing query packets, but not TC
552      */
553 
554     /* ANCOUNT, DNCOUNT and ARCOUNT must be 0 */
555     qdCount = (p[4] << 8) | p[5];
556     anCount = (p[6] << 8) | p[7];
557     dnCount = (p[8] << 8) | p[9];
558     arCount = (p[10] << 8) | p[11];
559 
560     if (anCount != 0 || dnCount != 0 || arCount > 1) {
561         LOG(INFO) << __func__ << ": query packet contains non-query records";
562         return 0;
563     }
564 
565     if (qdCount == 0) {
566         LOG(INFO) << __func__ << ": query packet doesn't contain query record";
567         return 0;
568     }
569 
570     /* Check QDCOUNT QRs */
571     packet->cursor = p + DNS_HEADER_SIZE;
572 
573     for (; qdCount > 0; qdCount--)
574         if (!_dnsPacket_checkQR(packet)) return 0;
575 
576     return 1;
577 }
578 
579 /** QUERY DEBUGGING **/
dnsPacket_bprintQName(DnsPacket * packet,char * bp,char * bend)580 static char* dnsPacket_bprintQName(DnsPacket* packet, char* bp, char* bend) {
581     const uint8_t* p = packet->cursor;
582     const uint8_t* end = packet->end;
583     int first = 1;
584 
585     for (;;) {
586         int c;
587 
588         if (p >= end) break;
589 
590         c = *p++;
591 
592         if (c == 0) {
593             packet->cursor = p;
594             return bp;
595         }
596 
597         /* we don't expect label compression in QNAMEs */
598         if (c >= 64) break;
599 
600         if (first)
601             first = 0;
602         else
603             bp = bprint_c(bp, bend, '.');
604 
605         bp = bprint_b(bp, bend, (const char*) p, c);
606 
607         p += c;
608         /* we rely on the bound check at the start
609          * of the loop here */
610     }
611     /* malformed data */
612     bp = bprint_s(bp, bend, "<MALFORMED>");
613     return bp;
614 }
615 
dnsPacket_bprintQR(DnsPacket * packet,char * p,char * end)616 static char* dnsPacket_bprintQR(DnsPacket* packet, char* p, char* end) {
617 #define QQ(x) \
618     { DNS_TYPE_##x, #x }
619     static const struct {
620         const char* typeBytes;
621         const char* typeString;
622     } qTypes[] = {QQ(A), QQ(PTR), QQ(MX), QQ(AAAA), QQ(ALL), {NULL, NULL}};
623     int nn;
624     const char* typeString = NULL;
625 
626     /* dump QNAME */
627     p = dnsPacket_bprintQName(packet, p, end);
628 
629     /* dump TYPE */
630     p = bprint_s(p, end, " (");
631 
632     for (nn = 0; qTypes[nn].typeBytes != NULL; nn++) {
633         if (_dnsPacket_checkBytes(packet, 2, qTypes[nn].typeBytes)) {
634             typeString = qTypes[nn].typeString;
635             break;
636         }
637     }
638 
639     if (typeString != NULL)
640         p = bprint_s(p, end, typeString);
641     else {
642         int typeCode = _dnsPacket_readInt16(packet);
643         p = bprint(p, end, "UNKNOWN-%d", typeCode);
644     }
645 
646     p = bprint_c(p, end, ')');
647 
648     /* skip CLASS */
649     _dnsPacket_skip(packet, 2);
650     return p;
651 }
652 
653 /* this function assumes the packet has already been checked */
dnsPacket_bprintQuery(DnsPacket * packet,char * p,char * end)654 static char* dnsPacket_bprintQuery(DnsPacket* packet, char* p, char* end) {
655     int qdCount;
656 
657     if (packet->base[2] & 0x1) {
658         p = bprint_s(p, end, "RECURSIVE ");
659     }
660 
661     _dnsPacket_skip(packet, 4);
662     qdCount = _dnsPacket_readInt16(packet);
663     _dnsPacket_skip(packet, 6);
664 
665     for (; qdCount > 0; qdCount--) {
666         p = dnsPacket_bprintQR(packet, p, end);
667     }
668     return p;
669 }
670 
671 /** QUERY HASHING SUPPORT
672  **
673  ** THE FOLLOWING CODE ASSUMES THAT THE INPUT PACKET HAS ALREADY
674  ** BEEN SUCCESFULLY CHECKED.
675  **/
676 
677 /* use 32-bit FNV hash function */
678 #define FNV_MULT 16777619U
679 #define FNV_BASIS 2166136261U
680 
_dnsPacket_hashBytes(DnsPacket * packet,int numBytes,unsigned hash)681 static unsigned _dnsPacket_hashBytes(DnsPacket* packet, int numBytes, unsigned hash) {
682     const uint8_t* p = packet->cursor;
683     const uint8_t* end = packet->end;
684 
685     while (numBytes > 0 && p < end) {
686         hash = hash * FNV_MULT ^ *p++;
687     }
688     packet->cursor = p;
689     return hash;
690 }
691 
_dnsPacket_hashQName(DnsPacket * packet,unsigned hash)692 static unsigned _dnsPacket_hashQName(DnsPacket* packet, unsigned hash) {
693     const uint8_t* p = packet->cursor;
694     const uint8_t* end = packet->end;
695 
696     for (;;) {
697         int c;
698 
699         if (p >= end) { /* should not happen */
700             LOG(INFO) << __func__ << ": INTERNAL_ERROR: read-overflow";
701             break;
702         }
703 
704         c = *p++;
705 
706         if (c == 0) break;
707 
708         if (c >= 64) {
709             LOG(INFO) << __func__ << ": INTERNAL_ERROR: malformed domain";
710             break;
711         }
712         if (p + c >= end) {
713             LOG(INFO) << __func__ << ": INTERNAL_ERROR: simple label read-overflow";
714             break;
715         }
716         while (c > 0) {
717             hash = hash * FNV_MULT ^ *p++;
718             c -= 1;
719         }
720     }
721     packet->cursor = p;
722     return hash;
723 }
724 
_dnsPacket_hashQR(DnsPacket * packet,unsigned hash)725 static unsigned _dnsPacket_hashQR(DnsPacket* packet, unsigned hash) {
726     hash = _dnsPacket_hashQName(packet, hash);
727     hash = _dnsPacket_hashBytes(packet, 4, hash); /* TYPE and CLASS */
728     return hash;
729 }
730 
_dnsPacket_hashRR(DnsPacket * packet,unsigned hash)731 static unsigned _dnsPacket_hashRR(DnsPacket* packet, unsigned hash) {
732     int rdlength;
733     hash = _dnsPacket_hashQR(packet, hash);
734     hash = _dnsPacket_hashBytes(packet, 4, hash); /* TTL */
735     rdlength = _dnsPacket_readInt16(packet);
736     hash = _dnsPacket_hashBytes(packet, rdlength, hash); /* RDATA */
737     return hash;
738 }
739 
_dnsPacket_hashQuery(DnsPacket * packet)740 static unsigned _dnsPacket_hashQuery(DnsPacket* packet) {
741     unsigned hash = FNV_BASIS;
742     int count, arcount;
743     _dnsPacket_rewind(packet);
744 
745     /* ignore the ID */
746     _dnsPacket_skip(packet, 2);
747 
748     /* we ignore the TC bit for reasons explained in
749      * _dnsPacket_checkQuery().
750      *
751      * however we hash the RD bit to differentiate
752      * between answers for recursive and non-recursive
753      * queries.
754      */
755     hash = hash * FNV_MULT ^ (packet->base[2] & 1);
756 
757     /* mark the first header byte as processed */
758     _dnsPacket_skip(packet, 1);
759 
760     /* process the second header byte */
761     hash = _dnsPacket_hashBytes(packet, 1, hash);
762 
763     /* read QDCOUNT */
764     count = _dnsPacket_readInt16(packet);
765 
766     /* assume: ANcount and NScount are 0 */
767     _dnsPacket_skip(packet, 4);
768 
769     /* read ARCOUNT */
770     arcount = _dnsPacket_readInt16(packet);
771 
772     /* hash QDCOUNT QRs */
773     for (; count > 0; count--) hash = _dnsPacket_hashQR(packet, hash);
774 
775     /* hash ARCOUNT RRs */
776     for (; arcount > 0; arcount--) hash = _dnsPacket_hashRR(packet, hash);
777 
778     return hash;
779 }
780 
781 /** QUERY COMPARISON
782  **
783  ** THE FOLLOWING CODE ASSUMES THAT THE INPUT PACKETS HAVE ALREADY
784  ** BEEN SUCCESSFULLY CHECKED.
785  **/
786 
_dnsPacket_isEqualDomainName(DnsPacket * pack1,DnsPacket * pack2)787 static int _dnsPacket_isEqualDomainName(DnsPacket* pack1, DnsPacket* pack2) {
788     const uint8_t* p1 = pack1->cursor;
789     const uint8_t* end1 = pack1->end;
790     const uint8_t* p2 = pack2->cursor;
791     const uint8_t* end2 = pack2->end;
792 
793     for (;;) {
794         int c1, c2;
795 
796         if (p1 >= end1 || p2 >= end2) {
797             LOG(INFO) << __func__ << ": INTERNAL_ERROR: read-overflow";
798             break;
799         }
800         c1 = *p1++;
801         c2 = *p2++;
802         if (c1 != c2) break;
803 
804         if (c1 == 0) {
805             pack1->cursor = p1;
806             pack2->cursor = p2;
807             return 1;
808         }
809         if (c1 >= 64) {
810             LOG(INFO) << __func__ << ": INTERNAL_ERROR: malformed domain";
811             break;
812         }
813         if ((p1 + c1 > end1) || (p2 + c1 > end2)) {
814             LOG(INFO) << __func__ << ": INTERNAL_ERROR: simple label read-overflow";
815             break;
816         }
817         if (memcmp(p1, p2, c1) != 0) break;
818         p1 += c1;
819         p2 += c1;
820         /* we rely on the bound checks at the start of the loop */
821     }
822     /* not the same, or one is malformed */
823     LOG(INFO) << __func__ << ": different DN";
824     return 0;
825 }
826 
_dnsPacket_isEqualBytes(DnsPacket * pack1,DnsPacket * pack2,int numBytes)827 static int _dnsPacket_isEqualBytes(DnsPacket* pack1, DnsPacket* pack2, int numBytes) {
828     const uint8_t* p1 = pack1->cursor;
829     const uint8_t* p2 = pack2->cursor;
830 
831     if (p1 + numBytes > pack1->end || p2 + numBytes > pack2->end) return 0;
832 
833     if (memcmp(p1, p2, numBytes) != 0) return 0;
834 
835     pack1->cursor += numBytes;
836     pack2->cursor += numBytes;
837     return 1;
838 }
839 
_dnsPacket_isEqualQR(DnsPacket * pack1,DnsPacket * pack2)840 static int _dnsPacket_isEqualQR(DnsPacket* pack1, DnsPacket* pack2) {
841     /* compare domain name encoding + TYPE + CLASS */
842     if (!_dnsPacket_isEqualDomainName(pack1, pack2) ||
843         !_dnsPacket_isEqualBytes(pack1, pack2, 2 + 2))
844         return 0;
845 
846     return 1;
847 }
848 
_dnsPacket_isEqualRR(DnsPacket * pack1,DnsPacket * pack2)849 static int _dnsPacket_isEqualRR(DnsPacket* pack1, DnsPacket* pack2) {
850     int rdlength1, rdlength2;
851     /* compare query + TTL */
852     if (!_dnsPacket_isEqualQR(pack1, pack2) || !_dnsPacket_isEqualBytes(pack1, pack2, 4)) return 0;
853 
854     /* compare RDATA */
855     rdlength1 = _dnsPacket_readInt16(pack1);
856     rdlength2 = _dnsPacket_readInt16(pack2);
857     if (rdlength1 != rdlength2 || !_dnsPacket_isEqualBytes(pack1, pack2, rdlength1)) return 0;
858 
859     return 1;
860 }
861 
_dnsPacket_isEqualQuery(DnsPacket * pack1,DnsPacket * pack2)862 static int _dnsPacket_isEqualQuery(DnsPacket* pack1, DnsPacket* pack2) {
863     int count1, count2, arcount1, arcount2;
864 
865     /* compare the headers, ignore most fields */
866     _dnsPacket_rewind(pack1);
867     _dnsPacket_rewind(pack2);
868 
869     /* compare RD, ignore TC, see comment in _dnsPacket_checkQuery */
870     if ((pack1->base[2] & 1) != (pack2->base[2] & 1)) {
871         LOG(INFO) << __func__ << ": different RD";
872         return 0;
873     }
874 
875     if (pack1->base[3] != pack2->base[3]) {
876         LOG(INFO) << __func__ << ": different CD or AD";
877         return 0;
878     }
879 
880     /* mark ID and header bytes as compared */
881     _dnsPacket_skip(pack1, 4);
882     _dnsPacket_skip(pack2, 4);
883 
884     /* compare QDCOUNT */
885     count1 = _dnsPacket_readInt16(pack1);
886     count2 = _dnsPacket_readInt16(pack2);
887     if (count1 != count2 || count1 < 0) {
888         LOG(INFO) << __func__ << ": different QDCOUNT";
889         return 0;
890     }
891 
892     /* assume: ANcount and NScount are 0 */
893     _dnsPacket_skip(pack1, 4);
894     _dnsPacket_skip(pack2, 4);
895 
896     /* compare ARCOUNT */
897     arcount1 = _dnsPacket_readInt16(pack1);
898     arcount2 = _dnsPacket_readInt16(pack2);
899     if (arcount1 != arcount2 || arcount1 < 0) {
900         LOG(INFO) << __func__ << ": different ARCOUNT";
901         return 0;
902     }
903 
904     /* compare the QDCOUNT QRs */
905     for (; count1 > 0; count1--) {
906         if (!_dnsPacket_isEqualQR(pack1, pack2)) {
907             LOG(INFO) << __func__ << ": different QR";
908             return 0;
909         }
910     }
911 
912     /* compare the ARCOUNT RRs */
913     for (; arcount1 > 0; arcount1--) {
914         if (!_dnsPacket_isEqualRR(pack1, pack2)) {
915             LOG(INFO) << __func__ << ": different additional RR";
916             return 0;
917         }
918     }
919     return 1;
920 }
921 
922 /* cache entry. for simplicity, 'hash' and 'hlink' are inlined in this
923  * structure though they are conceptually part of the hash table.
924  *
925  * similarly, mru_next and mru_prev are part of the global MRU list
926  */
927 typedef struct Entry {
928     unsigned int hash;   /* hash value */
929     struct Entry* hlink; /* next in collision chain */
930     struct Entry* mru_prev;
931     struct Entry* mru_next;
932 
933     const uint8_t* query;
934     int querylen;
935     const uint8_t* answer;
936     int answerlen;
937     time_t expires; /* time_t when the entry isn't valid any more */
938     int id;         /* for debugging purpose */
939 } Entry;
940 
941 /*
942  * Find the TTL for a negative DNS result.  This is defined as the minimum
943  * of the SOA records TTL and the MINIMUM-TTL field (RFC-2308).
944  *
945  * Return 0 if not found.
946  */
answer_getNegativeTTL(ns_msg handle)947 static u_long answer_getNegativeTTL(ns_msg handle) {
948     int n, nscount;
949     u_long result = 0;
950     ns_rr rr;
951 
952     nscount = ns_msg_count(handle, ns_s_ns);
953     for (n = 0; n < nscount; n++) {
954         if ((ns_parserr(&handle, ns_s_ns, n, &rr) == 0) && (ns_rr_type(rr) == ns_t_soa)) {
955             const u_char* rdata = ns_rr_rdata(rr);          // find the data
956             const u_char* edata = rdata + ns_rr_rdlen(rr);  // add the len to find the end
957             int len;
958             u_long ttl, rec_result = ns_rr_ttl(rr);
959 
960             // find the MINIMUM-TTL field from the blob of binary data for this record
961             // skip the server name
962             len = dn_skipname(rdata, edata);
963             if (len == -1) continue;  // error skipping
964             rdata += len;
965 
966             // skip the admin name
967             len = dn_skipname(rdata, edata);
968             if (len == -1) continue;  // error skipping
969             rdata += len;
970 
971             if (edata - rdata != 5 * NS_INT32SZ) continue;
972             // skip: serial number + refresh interval + retry interval + expiry
973             rdata += NS_INT32SZ * 4;
974             // finally read the MINIMUM TTL
975             ttl = ntohl(*reinterpret_cast<const uint32_t*>(rdata));
976             if (ttl < rec_result) {
977                 rec_result = ttl;
978             }
979             // Now that the record is read successfully, apply the new min TTL
980             if (n == 0 || rec_result < result) {
981                 result = rec_result;
982             }
983         }
984     }
985     return result;
986 }
987 
988 /*
989  * Parse the answer records and find the appropriate
990  * smallest TTL among the records.  This might be from
991  * the answer records if found or from the SOA record
992  * if it's a negative result.
993  *
994  * The returned TTL is the number of seconds to
995  * keep the answer in the cache.
996  *
997  * In case of parse error zero (0) is returned which
998  * indicates that the answer shall not be cached.
999  */
answer_getTTL(const void * answer,int answerlen)1000 static u_long answer_getTTL(const void* answer, int answerlen) {
1001     ns_msg handle;
1002     int ancount, n;
1003     u_long result, ttl;
1004     ns_rr rr;
1005 
1006     result = 0;
1007     if (ns_initparse((const uint8_t*) answer, answerlen, &handle) >= 0) {
1008         // get number of answer records
1009         ancount = ns_msg_count(handle, ns_s_an);
1010 
1011         if (ancount == 0) {
1012             // a response with no answers?  Cache this negative result.
1013             result = answer_getNegativeTTL(handle);
1014         } else {
1015             for (n = 0; n < ancount; n++) {
1016                 if (ns_parserr(&handle, ns_s_an, n, &rr) == 0) {
1017                     ttl = ns_rr_ttl(rr);
1018                     if (n == 0 || ttl < result) {
1019                         result = ttl;
1020                     }
1021                 } else {
1022                     PLOG(INFO) << __func__ << ": ns_parserr failed ancount no = " << n;
1023                 }
1024             }
1025         }
1026     } else {
1027         PLOG(INFO) << __func__ << ": ns_initparse failed";
1028     }
1029 
1030     LOG(INFO) << __func__ << ": TTL = " << result;
1031     return result;
1032 }
1033 
entry_free(Entry * e)1034 static void entry_free(Entry* e) {
1035     /* everything is allocated in a single memory block */
1036     if (e) {
1037         free(e);
1038     }
1039 }
1040 
entry_mru_remove(Entry * e)1041 static void entry_mru_remove(Entry* e) {
1042     e->mru_prev->mru_next = e->mru_next;
1043     e->mru_next->mru_prev = e->mru_prev;
1044 }
1045 
entry_mru_add(Entry * e,Entry * list)1046 static void entry_mru_add(Entry* e, Entry* list) {
1047     Entry* first = list->mru_next;
1048 
1049     e->mru_next = first;
1050     e->mru_prev = list;
1051 
1052     list->mru_next = e;
1053     first->mru_prev = e;
1054 }
1055 
1056 /* compute the hash of a given entry, this is a hash of most
1057  * data in the query (key) */
entry_hash(const Entry * e)1058 static unsigned entry_hash(const Entry* e) {
1059     DnsPacket pack[1];
1060 
1061     _dnsPacket_init(pack, e->query, e->querylen);
1062     return _dnsPacket_hashQuery(pack);
1063 }
1064 
1065 /* initialize an Entry as a search key, this also checks the input query packet
1066  * returns 1 on success, or 0 in case of unsupported/malformed data */
entry_init_key(Entry * e,const void * query,int querylen)1067 static int entry_init_key(Entry* e, const void* query, int querylen) {
1068     DnsPacket pack[1];
1069 
1070     memset(e, 0, sizeof(*e));
1071 
1072     e->query = (const uint8_t*) query;
1073     e->querylen = querylen;
1074     e->hash = entry_hash(e);
1075 
1076     _dnsPacket_init(pack, e->query, e->querylen);
1077 
1078     return _dnsPacket_checkQuery(pack);
1079 }
1080 
1081 /* allocate a new entry as a cache node */
entry_alloc(const Entry * init,const void * answer,int answerlen)1082 static Entry* entry_alloc(const Entry* init, const void* answer, int answerlen) {
1083     Entry* e;
1084     int size;
1085 
1086     size = sizeof(*e) + init->querylen + answerlen;
1087     e = (Entry*) calloc(size, 1);
1088     if (e == NULL) return e;
1089 
1090     e->hash = init->hash;
1091     e->query = (const uint8_t*) (e + 1);
1092     e->querylen = init->querylen;
1093 
1094     memcpy((char*) e->query, init->query, e->querylen);
1095 
1096     e->answer = e->query + e->querylen;
1097     e->answerlen = answerlen;
1098 
1099     memcpy((char*) e->answer, answer, e->answerlen);
1100 
1101     return e;
1102 }
1103 
entry_equals(const Entry * e1,const Entry * e2)1104 static int entry_equals(const Entry* e1, const Entry* e2) {
1105     DnsPacket pack1[1], pack2[1];
1106 
1107     if (e1->querylen != e2->querylen) {
1108         return 0;
1109     }
1110     _dnsPacket_init(pack1, e1->query, e1->querylen);
1111     _dnsPacket_init(pack2, e2->query, e2->querylen);
1112 
1113     return _dnsPacket_isEqualQuery(pack1, pack2);
1114 }
1115 
1116 /* We use a simple hash table with external collision lists
1117  * for simplicity, the hash-table fields 'hash' and 'hlink' are
1118  * inlined in the Entry structure.
1119  */
1120 
1121 /* Maximum time for a thread to wait for an pending request */
1122 constexpr int PENDING_REQUEST_TIMEOUT = 20;
1123 
1124 typedef struct resolv_cache {
1125     int max_entries;
1126     int num_entries;
1127     Entry mru_list;
1128     int last_id;
1129     Entry* entries;
1130     struct pending_req_info {
1131         unsigned int hash;
1132         struct pending_req_info* next;
1133     } pending_requests;
1134 } Cache;
1135 
1136 struct resolv_cache_info {
1137     unsigned netid;
1138     Cache* cache;
1139     struct resolv_cache_info* next;
1140     int nscount;
1141     char* nameservers[MAXNS];
1142     struct addrinfo* nsaddrinfo[MAXNS];
1143     int revision_id;  // # times the nameservers have been replaced
1144     res_params params;
1145     struct res_stats nsstats[MAXNS];
1146     char defdname[MAXDNSRCHPATH];
1147     int dnsrch_offset[MAXDNSRCH + 1];  // offsets into defdname
1148     int wait_for_pending_req_timeout_count;
1149 };
1150 
1151 // A helper class for the Clang Thread Safety Analysis to deal with
1152 // std::unique_lock.
1153 class SCOPED_CAPABILITY ScopedAssumeLocked {
1154   public:
ACQUIRE(mutex)1155     ScopedAssumeLocked(std::mutex& mutex) ACQUIRE(mutex) {}
RELEASE()1156     ~ScopedAssumeLocked() RELEASE() {}
1157 };
1158 
1159 // lock protecting everything in the resolve_cache_info structs (next ptr, etc)
1160 static std::mutex cache_mutex;
1161 static std::condition_variable cv;
1162 
1163 /* gets cache associated with a network, or NULL if none exists */
1164 static resolv_cache* find_named_cache_locked(unsigned netid) REQUIRES(cache_mutex);
1165 static int resolv_create_cache_for_net_locked(unsigned netid) REQUIRES(cache_mutex);
1166 
cache_flush_pending_requests_locked(struct resolv_cache * cache)1167 static void cache_flush_pending_requests_locked(struct resolv_cache* cache) {
1168     resolv_cache::pending_req_info *ri, *tmp;
1169     if (!cache) return;
1170 
1171     ri = cache->pending_requests.next;
1172 
1173     while (ri) {
1174         tmp = ri;
1175         ri = ri->next;
1176         free(tmp);
1177     }
1178 
1179     cache->pending_requests.next = NULL;
1180     cv.notify_all();
1181 }
1182 
1183 // Return true - if there is a pending request in |cache| matching |key|.
1184 // Return false - if no pending request is found matching the key. Optionally
1185 //                link a new one if parameter append_if_not_found is true.
cache_has_pending_request_locked(resolv_cache * cache,const Entry * key,bool append_if_not_found)1186 static bool cache_has_pending_request_locked(resolv_cache* cache, const Entry* key,
1187                                              bool append_if_not_found) {
1188     if (!cache || !key) return false;
1189 
1190     resolv_cache::pending_req_info* ri = cache->pending_requests.next;
1191     resolv_cache::pending_req_info* prev = &cache->pending_requests;
1192     while (ri) {
1193         if (ri->hash == key->hash) {
1194             return true;
1195         }
1196         prev = ri;
1197         ri = ri->next;
1198     }
1199 
1200     if (append_if_not_found) {
1201         ri = (resolv_cache::pending_req_info*)calloc(1, sizeof(resolv_cache::pending_req_info));
1202         if (ri) {
1203             ri->hash = key->hash;
1204             prev->next = ri;
1205         }
1206     }
1207     return false;
1208 }
1209 
1210 // Notify all threads that the cache entry |key| has become available
_cache_notify_waiting_tid_locked(struct resolv_cache * cache,const Entry * key)1211 static void _cache_notify_waiting_tid_locked(struct resolv_cache* cache, const Entry* key) {
1212     if (!cache || !key) return;
1213 
1214     resolv_cache::pending_req_info* ri = cache->pending_requests.next;
1215     resolv_cache::pending_req_info* prev = &cache->pending_requests;
1216     while (ri) {
1217         if (ri->hash == key->hash) {
1218             // remove item from list and destroy
1219             prev->next = ri->next;
1220             free(ri);
1221             cv.notify_all();
1222             return;
1223         }
1224         prev = ri;
1225         ri = ri->next;
1226     }
1227 }
1228 
_resolv_cache_query_failed(unsigned netid,const void * query,int querylen,uint32_t flags)1229 void _resolv_cache_query_failed(unsigned netid, const void* query, int querylen, uint32_t flags) {
1230     // We should not notify with these flags.
1231     if (flags & (ANDROID_RESOLV_NO_CACHE_STORE | ANDROID_RESOLV_NO_CACHE_LOOKUP)) {
1232         return;
1233     }
1234     Entry key[1];
1235     Cache* cache;
1236 
1237     if (!entry_init_key(key, query, querylen)) return;
1238 
1239     std::lock_guard guard(cache_mutex);
1240 
1241     cache = find_named_cache_locked(netid);
1242 
1243     if (cache) {
1244         _cache_notify_waiting_tid_locked(cache, key);
1245     }
1246 }
1247 
cache_flush_locked(Cache * cache)1248 static void cache_flush_locked(Cache* cache) {
1249     int nn;
1250 
1251     for (nn = 0; nn < cache->max_entries; nn++) {
1252         Entry** pnode = (Entry**) &cache->entries[nn];
1253 
1254         while (*pnode != NULL) {
1255             Entry* node = *pnode;
1256             *pnode = node->hlink;
1257             entry_free(node);
1258         }
1259     }
1260 
1261     // flush pending request
1262     cache_flush_pending_requests_locked(cache);
1263 
1264     cache->mru_list.mru_next = cache->mru_list.mru_prev = &cache->mru_list;
1265     cache->num_entries = 0;
1266     cache->last_id = 0;
1267 
1268     LOG(INFO) << __func__ << ": *** DNS CACHE FLUSHED ***";
1269 }
1270 
resolv_cache_create()1271 static resolv_cache* resolv_cache_create() {
1272     struct resolv_cache* cache;
1273 
1274     cache = (struct resolv_cache*) calloc(sizeof(*cache), 1);
1275     if (cache) {
1276         cache->max_entries = CONFIG_MAX_ENTRIES;
1277         cache->entries = (Entry*) calloc(sizeof(*cache->entries), cache->max_entries);
1278         if (cache->entries) {
1279             cache->mru_list.mru_prev = cache->mru_list.mru_next = &cache->mru_list;
1280             LOG(INFO) << __func__ << ": cache created";
1281         } else {
1282             free(cache);
1283             cache = NULL;
1284         }
1285     }
1286     return cache;
1287 }
1288 
dump_query(const uint8_t * query,int querylen)1289 static void dump_query(const uint8_t* query, int querylen) {
1290     if (!WOULD_LOG(VERBOSE)) return;
1291 
1292     char temp[256], *p = temp, *end = p + sizeof(temp);
1293     DnsPacket pack[1];
1294 
1295     _dnsPacket_init(pack, query, querylen);
1296     p = dnsPacket_bprintQuery(pack, p, end);
1297     LOG(VERBOSE) << __func__ << ": " << temp;
1298 }
1299 
cache_dump_mru(Cache * cache)1300 static void cache_dump_mru(Cache* cache) {
1301     char temp[512], *p = temp, *end = p + sizeof(temp);
1302     Entry* e;
1303 
1304     p = bprint(temp, end, "MRU LIST (%2d): ", cache->num_entries);
1305     for (e = cache->mru_list.mru_next; e != &cache->mru_list; e = e->mru_next)
1306         p = bprint(p, end, " %d", e->id);
1307 
1308     LOG(INFO) << __func__ << ": " << temp;
1309 }
1310 
1311 /* This function tries to find a key within the hash table
1312  * In case of success, it will return a *pointer* to the hashed key.
1313  * In case of failure, it will return a *pointer* to NULL
1314  *
1315  * So, the caller must check '*result' to check for success/failure.
1316  *
1317  * The main idea is that the result can later be used directly in
1318  * calls to _resolv_cache_add or _resolv_cache_remove as the 'lookup'
1319  * parameter. This makes the code simpler and avoids re-searching
1320  * for the key position in the htable.
1321  *
1322  * The result of a lookup_p is only valid until you alter the hash
1323  * table.
1324  */
_cache_lookup_p(Cache * cache,Entry * key)1325 static Entry** _cache_lookup_p(Cache* cache, Entry* key) {
1326     int index = key->hash % cache->max_entries;
1327     Entry** pnode = (Entry**) &cache->entries[index];
1328 
1329     while (*pnode != NULL) {
1330         Entry* node = *pnode;
1331 
1332         if (node == NULL) break;
1333 
1334         if (node->hash == key->hash && entry_equals(node, key)) break;
1335 
1336         pnode = &node->hlink;
1337     }
1338     return pnode;
1339 }
1340 
1341 /* Add a new entry to the hash table. 'lookup' must be the
1342  * result of an immediate previous failed _lookup_p() call
1343  * (i.e. with *lookup == NULL), and 'e' is the pointer to the
1344  * newly created entry
1345  */
_cache_add_p(Cache * cache,Entry ** lookup,Entry * e)1346 static void _cache_add_p(Cache* cache, Entry** lookup, Entry* e) {
1347     *lookup = e;
1348     e->id = ++cache->last_id;
1349     entry_mru_add(e, &cache->mru_list);
1350     cache->num_entries += 1;
1351 
1352     LOG(INFO) << __func__ << ": entry " << e->id << " added (count=" << cache->num_entries << ")";
1353 }
1354 
1355 /* Remove an existing entry from the hash table,
1356  * 'lookup' must be the result of an immediate previous
1357  * and succesful _lookup_p() call.
1358  */
_cache_remove_p(Cache * cache,Entry ** lookup)1359 static void _cache_remove_p(Cache* cache, Entry** lookup) {
1360     Entry* e = *lookup;
1361 
1362     LOG(INFO) << __func__ << ": entry " << e->id << " removed (count=" << cache->num_entries - 1
1363               << ")";
1364 
1365     entry_mru_remove(e);
1366     *lookup = e->hlink;
1367     entry_free(e);
1368     cache->num_entries -= 1;
1369 }
1370 
1371 /* Remove the oldest entry from the hash table.
1372  */
_cache_remove_oldest(Cache * cache)1373 static void _cache_remove_oldest(Cache* cache) {
1374     Entry* oldest = cache->mru_list.mru_prev;
1375     Entry** lookup = _cache_lookup_p(cache, oldest);
1376 
1377     if (*lookup == NULL) { /* should not happen */
1378         LOG(INFO) << __func__ << ": OLDEST NOT IN HTABLE ?";
1379         return;
1380     }
1381     LOG(INFO) << __func__ << ": Cache full - removing oldest";
1382     dump_query(oldest->query, oldest->querylen);
1383     _cache_remove_p(cache, lookup);
1384 }
1385 
1386 /* Remove all expired entries from the hash table.
1387  */
_cache_remove_expired(Cache * cache)1388 static void _cache_remove_expired(Cache* cache) {
1389     Entry* e;
1390     time_t now = _time_now();
1391 
1392     for (e = cache->mru_list.mru_next; e != &cache->mru_list;) {
1393         // Entry is old, remove
1394         if (now >= e->expires) {
1395             Entry** lookup = _cache_lookup_p(cache, e);
1396             if (*lookup == NULL) { /* should not happen */
1397                 LOG(INFO) << __func__ << ": ENTRY NOT IN HTABLE ?";
1398                 return;
1399             }
1400             e = e->mru_next;
1401             _cache_remove_p(cache, lookup);
1402         } else {
1403             e = e->mru_next;
1404         }
1405     }
1406 }
1407 
1408 // gets a resolv_cache_info associated with a network, or NULL if not found
1409 static resolv_cache_info* find_cache_info_locked(unsigned netid) REQUIRES(cache_mutex);
1410 
_resolv_cache_lookup(unsigned netid,const void * query,int querylen,void * answer,int answersize,int * answerlen,uint32_t flags)1411 ResolvCacheStatus _resolv_cache_lookup(unsigned netid, const void* query, int querylen,
1412                                        void* answer, int answersize, int* answerlen,
1413                                        uint32_t flags) {
1414     // Skip cache lookup, return RESOLV_CACHE_NOTFOUND directly so that it is
1415     // possible to cache the answer of this query.
1416     // If ANDROID_RESOLV_NO_CACHE_STORE is set, return RESOLV_CACHE_SKIP to skip possible cache
1417     // storing.
1418     if (flags & ANDROID_RESOLV_NO_CACHE_LOOKUP) {
1419         return flags & ANDROID_RESOLV_NO_CACHE_STORE ? RESOLV_CACHE_SKIP : RESOLV_CACHE_NOTFOUND;
1420     }
1421     Entry key;
1422     Entry** lookup;
1423     Entry* e;
1424     time_t now;
1425     Cache* cache;
1426 
1427     LOG(INFO) << __func__ << ": lookup";
1428     dump_query((u_char*) query, querylen);
1429 
1430     /* we don't cache malformed queries */
1431     if (!entry_init_key(&key, query, querylen)) {
1432         LOG(INFO) << __func__ << ": unsupported query";
1433         return RESOLV_CACHE_UNSUPPORTED;
1434     }
1435     /* lookup cache */
1436     std::unique_lock lock(cache_mutex);
1437     ScopedAssumeLocked assume_lock(cache_mutex);
1438     cache = find_named_cache_locked(netid);
1439     if (cache == NULL) {
1440         return RESOLV_CACHE_UNSUPPORTED;
1441     }
1442 
1443     /* see the description of _lookup_p to understand this.
1444      * the function always return a non-NULL pointer.
1445      */
1446     lookup = _cache_lookup_p(cache, &key);
1447     e = *lookup;
1448 
1449     if (e == NULL) {
1450         LOG(INFO) << __func__ << ": NOT IN CACHE";
1451         // If it is no-cache-store mode, we won't wait for possible query.
1452         if (flags & ANDROID_RESOLV_NO_CACHE_STORE) {
1453             return RESOLV_CACHE_SKIP;
1454         }
1455 
1456         if (!cache_has_pending_request_locked(cache, &key, true)) {
1457             return RESOLV_CACHE_NOTFOUND;
1458 
1459         } else {
1460             LOG(INFO) << __func__ << ": Waiting for previous request";
1461             // wait until (1) timeout OR
1462             //            (2) cv is notified AND no pending request matching the |key|
1463             // (cv notifier should delete pending request before sending notification.)
1464             bool ret = cv.wait_for(lock, std::chrono::seconds(PENDING_REQUEST_TIMEOUT),
1465                                    [netid, &cache, &key]() REQUIRES(cache_mutex) {
1466                                        // Must update cache as it could have been deleted
1467                                        cache = find_named_cache_locked(netid);
1468                                        return !cache_has_pending_request_locked(cache, &key, false);
1469                                    });
1470             if (!cache) {
1471                 return RESOLV_CACHE_NOTFOUND;
1472             }
1473             if (ret == false) {
1474                 resolv_cache_info* info = find_cache_info_locked(netid);
1475                 if (info != NULL) {
1476                     info->wait_for_pending_req_timeout_count++;
1477                 }
1478             }
1479             lookup = _cache_lookup_p(cache, &key);
1480             e = *lookup;
1481             if (e == NULL) {
1482                 return RESOLV_CACHE_NOTFOUND;
1483             }
1484         }
1485     }
1486 
1487     now = _time_now();
1488 
1489     /* remove stale entries here */
1490     if (now >= e->expires) {
1491         LOG(INFO) << __func__ << ": NOT IN CACHE (STALE ENTRY " << *lookup << "DISCARDED)";
1492         dump_query(e->query, e->querylen);
1493         _cache_remove_p(cache, lookup);
1494         return RESOLV_CACHE_NOTFOUND;
1495     }
1496 
1497     *answerlen = e->answerlen;
1498     if (e->answerlen > answersize) {
1499         /* NOTE: we return UNSUPPORTED if the answer buffer is too short */
1500         LOG(INFO) << __func__ << ": ANSWER TOO LONG";
1501         return RESOLV_CACHE_UNSUPPORTED;
1502     }
1503 
1504     memcpy(answer, e->answer, e->answerlen);
1505 
1506     /* bump up this entry to the top of the MRU list */
1507     if (e != cache->mru_list.mru_next) {
1508         entry_mru_remove(e);
1509         entry_mru_add(e, &cache->mru_list);
1510     }
1511 
1512     LOG(INFO) << __func__ << ": FOUND IN CACHE entry=" << e;
1513     return RESOLV_CACHE_FOUND;
1514 }
1515 
_resolv_cache_add(unsigned netid,const void * query,int querylen,const void * answer,int answerlen)1516 void _resolv_cache_add(unsigned netid, const void* query, int querylen, const void* answer,
1517                        int answerlen) {
1518     Entry key[1];
1519     Entry* e;
1520     Entry** lookup;
1521     u_long ttl;
1522     Cache* cache = NULL;
1523 
1524     /* don't assume that the query has already been cached
1525      */
1526     if (!entry_init_key(key, query, querylen)) {
1527         LOG(INFO) << __func__ << ": passed invalid query?";
1528         return;
1529     }
1530 
1531     std::lock_guard guard(cache_mutex);
1532 
1533     cache = find_named_cache_locked(netid);
1534     if (cache == NULL) {
1535         return;
1536     }
1537 
1538     LOG(INFO) << __func__ << ": query:";
1539     dump_query((u_char*)query, querylen);
1540     res_pquery((u_char*)answer, answerlen);
1541     if (kDumpData) {
1542         LOG(INFO) << __func__ << ": answer:";
1543         dump_bytes((u_char*)answer, answerlen);
1544     }
1545 
1546     lookup = _cache_lookup_p(cache, key);
1547     e = *lookup;
1548 
1549     // Should only happen on ANDROID_RESOLV_NO_CACHE_LOOKUP
1550     if (e != NULL) {
1551         LOG(INFO) << __func__ << ": ALREADY IN CACHE (" << e << ") ? IGNORING ADD";
1552         _cache_notify_waiting_tid_locked(cache, key);
1553         return;
1554     }
1555 
1556     if (cache->num_entries >= cache->max_entries) {
1557         _cache_remove_expired(cache);
1558         if (cache->num_entries >= cache->max_entries) {
1559             _cache_remove_oldest(cache);
1560         }
1561         // TODO: It looks useless, remove below code after having test to prove it.
1562         lookup = _cache_lookup_p(cache, key);
1563         e = *lookup;
1564         if (e != NULL) {
1565             LOG(INFO) << __func__ << ": ALREADY IN CACHE (" << e << ") ? IGNORING ADD";
1566             _cache_notify_waiting_tid_locked(cache, key);
1567             return;
1568         }
1569     }
1570 
1571     ttl = answer_getTTL(answer, answerlen);
1572     if (ttl > 0) {
1573         e = entry_alloc(key, answer, answerlen);
1574         if (e != NULL) {
1575             e->expires = ttl + _time_now();
1576             _cache_add_p(cache, lookup, e);
1577         }
1578     }
1579 
1580     cache_dump_mru(cache);
1581     _cache_notify_waiting_tid_locked(cache, key);
1582 }
1583 
1584 // Head of the list of caches.
1585 static struct resolv_cache_info res_cache_list GUARDED_BY(cache_mutex);
1586 
1587 // insert resolv_cache_info into the list of resolv_cache_infos
1588 static void insert_cache_info_locked(resolv_cache_info* cache_info);
1589 // creates a resolv_cache_info
1590 static resolv_cache_info* create_cache_info();
1591 // empty the nameservers set for the named cache
1592 static void free_nameservers_locked(resolv_cache_info* cache_info);
1593 // return 1 if the provided list of name servers differs from the list of name servers
1594 // currently attached to the provided cache_info
1595 static int resolv_is_nameservers_equal_locked(resolv_cache_info* cache_info, const char** servers,
1596                                               int numservers);
1597 // clears the stats samples contained withing the given cache_info
1598 static void res_cache_clear_stats_locked(resolv_cache_info* cache_info);
1599 
1600 // public API for netd to query if name server is set on specific netid
resolv_has_nameservers(unsigned netid)1601 bool resolv_has_nameservers(unsigned netid) {
1602     std::lock_guard guard(cache_mutex);
1603     resolv_cache_info* info = find_cache_info_locked(netid);
1604     return (info != nullptr) && (info->nscount > 0);
1605 }
1606 
resolv_create_cache_for_net_locked(unsigned netid)1607 static int resolv_create_cache_for_net_locked(unsigned netid) {
1608     resolv_cache* cache = find_named_cache_locked(netid);
1609     // Should not happen
1610     if (cache) {
1611         LOG(ERROR) << __func__ << ": Cache is already created, netId: " << netid;
1612         return -EEXIST;
1613     }
1614 
1615     resolv_cache_info* cache_info = create_cache_info();
1616     if (!cache_info) return -ENOMEM;
1617     cache = resolv_cache_create();
1618     if (!cache) {
1619         free(cache_info);
1620         return -ENOMEM;
1621     }
1622     cache_info->cache = cache;
1623     cache_info->netid = netid;
1624     insert_cache_info_locked(cache_info);
1625 
1626     return 0;
1627 }
1628 
resolv_create_cache_for_net(unsigned netid)1629 int resolv_create_cache_for_net(unsigned netid) {
1630     std::lock_guard guard(cache_mutex);
1631     return resolv_create_cache_for_net_locked(netid);
1632 }
1633 
resolv_delete_cache_for_net(unsigned netid)1634 void resolv_delete_cache_for_net(unsigned netid) {
1635     std::lock_guard guard(cache_mutex);
1636 
1637     struct resolv_cache_info* prev_cache_info = &res_cache_list;
1638 
1639     while (prev_cache_info->next) {
1640         struct resolv_cache_info* cache_info = prev_cache_info->next;
1641 
1642         if (cache_info->netid == netid) {
1643             prev_cache_info->next = cache_info->next;
1644             cache_flush_locked(cache_info->cache);
1645             free(cache_info->cache->entries);
1646             free(cache_info->cache);
1647             free_nameservers_locked(cache_info);
1648             free(cache_info);
1649             break;
1650         }
1651 
1652         prev_cache_info = prev_cache_info->next;
1653     }
1654 }
1655 
resolv_list_caches()1656 std::vector<unsigned> resolv_list_caches() {
1657     std::lock_guard guard(cache_mutex);
1658     struct resolv_cache_info* cache_info = res_cache_list.next;
1659     std::vector<unsigned> result;
1660     while (cache_info) {
1661         result.push_back(cache_info->netid);
1662         cache_info = cache_info->next;
1663     }
1664     return result;
1665 }
1666 
create_cache_info()1667 static resolv_cache_info* create_cache_info() {
1668     return (struct resolv_cache_info*) calloc(sizeof(struct resolv_cache_info), 1);
1669 }
1670 
1671 // TODO: convert this to a simple and efficient C++ container.
insert_cache_info_locked(struct resolv_cache_info * cache_info)1672 static void insert_cache_info_locked(struct resolv_cache_info* cache_info) {
1673     struct resolv_cache_info* last;
1674     for (last = &res_cache_list; last->next; last = last->next) {}
1675     last->next = cache_info;
1676 }
1677 
find_named_cache_locked(unsigned netid)1678 static resolv_cache* find_named_cache_locked(unsigned netid) {
1679     resolv_cache_info* info = find_cache_info_locked(netid);
1680     if (info != NULL) return info->cache;
1681     return NULL;
1682 }
1683 
find_cache_info_locked(unsigned netid)1684 static resolv_cache_info* find_cache_info_locked(unsigned netid) {
1685     struct resolv_cache_info* cache_info = res_cache_list.next;
1686 
1687     while (cache_info) {
1688         if (cache_info->netid == netid) {
1689             break;
1690         }
1691 
1692         cache_info = cache_info->next;
1693     }
1694     return cache_info;
1695 }
1696 
resolv_set_default_params(res_params * params)1697 static void resolv_set_default_params(res_params* params) {
1698     params->sample_validity = NSSAMPLE_VALIDITY;
1699     params->success_threshold = SUCCESS_THRESHOLD;
1700     params->min_samples = 0;
1701     params->max_samples = 0;
1702     params->base_timeout_msec = 0;  // 0 = legacy algorithm
1703     params->retry_count = 0;
1704 }
1705 
resolv_set_experiment_params(res_params * params)1706 static void resolv_set_experiment_params(res_params* params) {
1707     using android::base::ParseInt;
1708     using server_configurable_flags::GetServerConfigurableFlag;
1709 
1710     if (params->retry_count == 0) {
1711         params->retry_count = RES_DFLRETRY;
1712         ParseInt(GetServerConfigurableFlag("netd_native", "retry_count", ""), &params->retry_count);
1713     }
1714 
1715     if (params->base_timeout_msec == 0) {
1716         params->base_timeout_msec = RES_TIMEOUT;
1717         ParseInt(GetServerConfigurableFlag("netd_native", "retransmission_time_interval", ""),
1718                  &params->base_timeout_msec);
1719     }
1720 }
1721 
resolv_set_nameservers_for_net(unsigned netid,const char ** servers,const int numservers,const char * domains,const res_params * params)1722 int resolv_set_nameservers_for_net(unsigned netid, const char** servers, const int numservers,
1723                                    const char* domains, const res_params* params) {
1724     char* cp;
1725     int* offset;
1726     struct addrinfo* nsaddrinfo[MAXNS];
1727 
1728     if (numservers > MAXNS) {
1729         LOG(ERROR) << __func__ << ": numservers=" << numservers << ", MAXNS=" << MAXNS;
1730         return E2BIG;
1731     }
1732 
1733     // Parse the addresses before actually locking or changing any state, in case there is an error.
1734     // As a side effect this also reduces the time the lock is kept.
1735     char sbuf[NI_MAXSERV];
1736     snprintf(sbuf, sizeof(sbuf), "%u", NAMESERVER_PORT);
1737     for (int i = 0; i < numservers; i++) {
1738         // The addrinfo structures allocated here are freed in free_nameservers_locked().
1739         const addrinfo hints = {
1740                 .ai_family = AF_UNSPEC, .ai_socktype = SOCK_DGRAM, .ai_flags = AI_NUMERICHOST};
1741         int rt = getaddrinfo_numeric(servers[i], sbuf, hints, &nsaddrinfo[i]);
1742         if (rt != 0) {
1743             for (int j = 0; j < i; j++) {
1744                 freeaddrinfo(nsaddrinfo[j]);
1745             }
1746             LOG(INFO) << __func__ << ": getaddrinfo_numeric(" << servers[i]
1747                       << ") = " << gai_strerror(rt);
1748             return EINVAL;
1749         }
1750     }
1751 
1752     std::lock_guard guard(cache_mutex);
1753 
1754     resolv_cache_info* cache_info = find_cache_info_locked(netid);
1755 
1756     if (cache_info == NULL) return ENONET;
1757 
1758     uint8_t old_max_samples = cache_info->params.max_samples;
1759     if (params != NULL) {
1760         cache_info->params = *params;
1761     } else {
1762         resolv_set_default_params(&cache_info->params);
1763     }
1764     resolv_set_experiment_params(&cache_info->params);
1765     if (!resolv_is_nameservers_equal_locked(cache_info, servers, numservers)) {
1766         // free current before adding new
1767         free_nameservers_locked(cache_info);
1768         for (int i = 0; i < numservers; i++) {
1769             cache_info->nsaddrinfo[i] = nsaddrinfo[i];
1770             cache_info->nameservers[i] = strdup(servers[i]);
1771             LOG(INFO) << __func__ << ": netid = " << netid << ", addr = " << servers[i];
1772         }
1773         cache_info->nscount = numservers;
1774 
1775         // Clear the NS statistics because the mapping to nameservers might have changed.
1776         res_cache_clear_stats_locked(cache_info);
1777 
1778         // increment the revision id to ensure that sample state is not written back if the
1779         // servers change; in theory it would suffice to do so only if the servers or
1780         // max_samples actually change, in practice the overhead of checking is higher than the
1781         // cost, and overflows are unlikely
1782         ++cache_info->revision_id;
1783     } else {
1784         if (cache_info->params.max_samples != old_max_samples) {
1785             // If the maximum number of samples changes, the overhead of keeping the most recent
1786             // samples around is not considered worth the effort, so they are cleared instead.
1787             // All other parameters do not affect shared state: Changing these parameters does
1788             // not invalidate the samples, as they only affect aggregation and the conditions
1789             // under which servers are considered usable.
1790             res_cache_clear_stats_locked(cache_info);
1791             ++cache_info->revision_id;
1792         }
1793         for (int j = 0; j < numservers; j++) {
1794             freeaddrinfo(nsaddrinfo[j]);
1795         }
1796     }
1797 
1798     // Always update the search paths, since determining whether they actually changed is
1799     // complex due to the zero-padding, and probably not worth the effort. Cache-flushing
1800     // however is not necessary, since the stored cache entries do contain the domain, not
1801     // just the host name.
1802     strlcpy(cache_info->defdname, domains, sizeof(cache_info->defdname));
1803     if ((cp = strchr(cache_info->defdname, '\n')) != NULL) *cp = '\0';
1804     LOG(INFO) << __func__ << ": domains=\"" << cache_info->defdname << "\"";
1805 
1806     cp = cache_info->defdname;
1807     offset = cache_info->dnsrch_offset;
1808     while (offset < cache_info->dnsrch_offset + MAXDNSRCH) {
1809         while (*cp == ' ' || *cp == '\t') /* skip leading white space */
1810             cp++;
1811         if (*cp == '\0') /* stop if nothing more to do */
1812             break;
1813         *offset++ = cp - cache_info->defdname; /* record this search domain */
1814         while (*cp) {                          /* zero-terminate it */
1815             if (*cp == ' ' || *cp == '\t') {
1816                 *cp++ = '\0';
1817                 break;
1818             }
1819             cp++;
1820         }
1821     }
1822     *offset = -1; /* cache_info->dnsrch_offset has MAXDNSRCH+1 items */
1823 
1824     return 0;
1825 }
1826 
resolv_is_nameservers_equal_locked(resolv_cache_info * cache_info,const char ** servers,int numservers)1827 static int resolv_is_nameservers_equal_locked(resolv_cache_info* cache_info, const char** servers,
1828                                               int numservers) {
1829     if (cache_info->nscount != numservers) {
1830         return 0;
1831     }
1832 
1833     // Compare each name server against current name servers.
1834     // TODO: this is incorrect if the list of current or previous nameservers
1835     // contains duplicates. This does not really matter because the framework
1836     // filters out duplicates, but we should probably fix it. It's also
1837     // insensitive to the order of the nameservers; we should probably fix that
1838     // too.
1839     for (int i = 0; i < numservers; i++) {
1840         for (int j = 0;; j++) {
1841             if (j >= numservers) {
1842                 return 0;
1843             }
1844             if (strcmp(cache_info->nameservers[i], servers[j]) == 0) {
1845                 break;
1846             }
1847         }
1848     }
1849 
1850     return 1;
1851 }
1852 
free_nameservers_locked(resolv_cache_info * cache_info)1853 static void free_nameservers_locked(resolv_cache_info* cache_info) {
1854     int i;
1855     for (i = 0; i < cache_info->nscount; i++) {
1856         free(cache_info->nameservers[i]);
1857         cache_info->nameservers[i] = NULL;
1858         if (cache_info->nsaddrinfo[i] != NULL) {
1859             freeaddrinfo(cache_info->nsaddrinfo[i]);
1860             cache_info->nsaddrinfo[i] = NULL;
1861         }
1862         cache_info->nsstats[i].sample_count = cache_info->nsstats[i].sample_next = 0;
1863     }
1864     cache_info->nscount = 0;
1865     res_cache_clear_stats_locked(cache_info);
1866     ++cache_info->revision_id;
1867 }
1868 
_resolv_populate_res_for_net(res_state statp)1869 void _resolv_populate_res_for_net(res_state statp) {
1870     if (statp == NULL) {
1871         return;
1872     }
1873     LOG(INFO) << __func__ << ": netid=" << statp->netid;
1874 
1875     std::lock_guard guard(cache_mutex);
1876     resolv_cache_info* info = find_cache_info_locked(statp->netid);
1877     if (info != NULL) {
1878         int nserv;
1879         struct addrinfo* ai;
1880         for (nserv = 0; nserv < MAXNS; nserv++) {
1881             ai = info->nsaddrinfo[nserv];
1882             if (ai == NULL) {
1883                 break;
1884             }
1885 
1886             if ((size_t) ai->ai_addrlen <= sizeof(statp->_u._ext.ext->nsaddrs[0])) {
1887                 if (statp->_u._ext.ext != NULL) {
1888                     memcpy(&statp->_u._ext.ext->nsaddrs[nserv], ai->ai_addr, ai->ai_addrlen);
1889                     statp->nsaddr_list[nserv].sin_family = AF_UNSPEC;
1890                 } else {
1891                     if ((size_t) ai->ai_addrlen <= sizeof(statp->nsaddr_list[0])) {
1892                         memcpy(&statp->nsaddr_list[nserv], ai->ai_addr, ai->ai_addrlen);
1893                     } else {
1894                         statp->nsaddr_list[nserv].sin_family = AF_UNSPEC;
1895                     }
1896                 }
1897             } else {
1898                 LOG(INFO) << __func__ << ": found too long addrlen";
1899             }
1900         }
1901         statp->nscount = nserv;
1902         // now do search domains.  Note that we cache the offsets as this code runs alot
1903         // but the setting/offset-computer only runs when set/changed
1904         // WARNING: Don't use str*cpy() here, this string contains zeroes.
1905         memcpy(statp->defdname, info->defdname, sizeof(statp->defdname));
1906         char** pp = statp->dnsrch;
1907         int* p = info->dnsrch_offset;
1908         while (pp < statp->dnsrch + MAXDNSRCH && *p != -1) {
1909             *pp++ = &statp->defdname[0] + *p++;
1910         }
1911     }
1912 }
1913 
1914 /* Resolver reachability statistics. */
1915 
_res_cache_add_stats_sample_locked(res_stats * stats,const res_sample * sample,int max_samples)1916 static void _res_cache_add_stats_sample_locked(res_stats* stats, const res_sample* sample,
1917                                                int max_samples) {
1918     // Note: This function expects max_samples > 0, otherwise a (harmless) modification of the
1919     // allocated but supposedly unused memory for samples[0] will happen
1920     LOG(INFO) << __func__ << ": adding sample to stats, next = " << unsigned(stats->sample_next)
1921               << ", count = " << unsigned(stats->sample_count);
1922     stats->samples[stats->sample_next] = *sample;
1923     if (stats->sample_count < max_samples) {
1924         ++stats->sample_count;
1925     }
1926     if (++stats->sample_next >= max_samples) {
1927         stats->sample_next = 0;
1928     }
1929 }
1930 
res_cache_clear_stats_locked(resolv_cache_info * cache_info)1931 static void res_cache_clear_stats_locked(resolv_cache_info* cache_info) {
1932     if (cache_info) {
1933         for (int i = 0; i < MAXNS; ++i) {
1934             cache_info->nsstats->sample_count = cache_info->nsstats->sample_next = 0;
1935         }
1936     }
1937 }
1938 
android_net_res_stats_get_info_for_net(unsigned netid,int * nscount,struct sockaddr_storage servers[MAXNS],int * dcount,char domains[MAXDNSRCH][MAXDNSRCHPATH],res_params * params,struct res_stats stats[MAXNS],int * wait_for_pending_req_timeout_count)1939 int android_net_res_stats_get_info_for_net(unsigned netid, int* nscount,
1940                                            struct sockaddr_storage servers[MAXNS], int* dcount,
1941                                            char domains[MAXDNSRCH][MAXDNSRCHPATH],
1942                                            res_params* params, struct res_stats stats[MAXNS],
1943                                            int* wait_for_pending_req_timeout_count) {
1944     int revision_id = -1;
1945     std::lock_guard guard(cache_mutex);
1946 
1947     resolv_cache_info* info = find_cache_info_locked(netid);
1948     if (info) {
1949         if (info->nscount > MAXNS) {
1950             LOG(INFO) << __func__ << ": nscount " << info->nscount << " > MAXNS " << MAXNS;
1951             errno = EFAULT;
1952             return -1;
1953         }
1954         int i;
1955         for (i = 0; i < info->nscount; i++) {
1956             // Verify that the following assumptions are held, failure indicates corruption:
1957             //  - getaddrinfo() may never return a sockaddr > sockaddr_storage
1958             //  - all addresses are valid
1959             //  - there is only one address per addrinfo thanks to numeric resolution
1960             int addrlen = info->nsaddrinfo[i]->ai_addrlen;
1961             if (addrlen < (int) sizeof(struct sockaddr) || addrlen > (int) sizeof(servers[0])) {
1962                 LOG(INFO) << __func__ << ": nsaddrinfo[" << i << "].ai_addrlen == " << addrlen;
1963                 errno = EMSGSIZE;
1964                 return -1;
1965             }
1966             if (info->nsaddrinfo[i]->ai_addr == NULL) {
1967                 LOG(INFO) << __func__ << ": nsaddrinfo[" << i << "].ai_addr == NULL";
1968                 errno = ENOENT;
1969                 return -1;
1970             }
1971             if (info->nsaddrinfo[i]->ai_next != NULL) {
1972                 LOG(INFO) << __func__ << ": nsaddrinfo[" << i << "].ai_next != NULL";
1973                 errno = ENOTUNIQ;
1974                 return -1;
1975             }
1976         }
1977         *nscount = info->nscount;
1978         for (i = 0; i < info->nscount; i++) {
1979             memcpy(&servers[i], info->nsaddrinfo[i]->ai_addr, info->nsaddrinfo[i]->ai_addrlen);
1980             stats[i] = info->nsstats[i];
1981         }
1982         for (i = 0; i < MAXDNSRCH; i++) {
1983             const char* cur_domain = info->defdname + info->dnsrch_offset[i];
1984             // dnsrch_offset[i] can either be -1 or point to an empty string to indicate the end
1985             // of the search offsets. Checking for < 0 is not strictly necessary, but safer.
1986             // TODO: Pass in a search domain array instead of a string to
1987             // resolv_set_nameservers_for_net() and make this double check unnecessary.
1988             if (info->dnsrch_offset[i] < 0 ||
1989                 ((size_t) info->dnsrch_offset[i]) >= sizeof(info->defdname) || !cur_domain[0]) {
1990                 break;
1991             }
1992             strlcpy(domains[i], cur_domain, MAXDNSRCHPATH);
1993         }
1994         *dcount = i;
1995         *params = info->params;
1996         revision_id = info->revision_id;
1997         *wait_for_pending_req_timeout_count = info->wait_for_pending_req_timeout_count;
1998     }
1999 
2000     return revision_id;
2001 }
2002 
resolv_cache_get_resolver_stats(unsigned netid,res_params * params,res_stats stats[MAXNS])2003 int resolv_cache_get_resolver_stats(unsigned netid, res_params* params, res_stats stats[MAXNS]) {
2004     std::lock_guard guard(cache_mutex);
2005     resolv_cache_info* info = find_cache_info_locked(netid);
2006     if (info) {
2007         memcpy(stats, info->nsstats, sizeof(info->nsstats));
2008         *params = info->params;
2009         return info->revision_id;
2010     }
2011 
2012     return -1;
2013 }
2014 
_resolv_cache_add_resolver_stats_sample(unsigned netid,int revision_id,int ns,const res_sample * sample,int max_samples)2015 void _resolv_cache_add_resolver_stats_sample(unsigned netid, int revision_id, int ns,
2016                                              const res_sample* sample, int max_samples) {
2017     if (max_samples <= 0) return;
2018 
2019     std::lock_guard guard(cache_mutex);
2020     resolv_cache_info* info = find_cache_info_locked(netid);
2021 
2022     if (info && info->revision_id == revision_id) {
2023         _res_cache_add_stats_sample_locked(&info->nsstats[ns], sample, max_samples);
2024     }
2025 }
2026