/* * Copyright (C) 2018, The Android Open Source Project * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package com.android.server.connectivity; import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_OFF; import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_PROVIDER_HOSTNAME; import static android.net.NetworkCapabilities.MAX_TRANSPORT; import static android.net.NetworkCapabilities.MIN_TRANSPORT; import static android.net.NetworkCapabilities.TRANSPORT_VPN; import static android.net.NetworkCapabilities.TRANSPORT_WIFI; import static android.provider.Settings.Global.PRIVATE_DNS_DEFAULT_MODE; import static android.provider.Settings.Global.PRIVATE_DNS_MODE; import static android.provider.Settings.Global.PRIVATE_DNS_SPECIFIER; import static com.android.testutils.MiscAssertsKt.assertContainsExactly; import static com.android.testutils.MiscAssertsKt.assertContainsStringsExactly; import static com.android.testutils.MiscAssertsKt.assertFieldCountEquals; import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; import static org.junit.Assert.assertNotNull; import static org.junit.Assert.assertNull; import static org.junit.Assert.assertTrue; import static org.mockito.Mockito.reset; import static org.mockito.Mockito.times; import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; import android.annotation.NonNull; import android.content.Context; import android.net.IDnsResolver; import android.net.IpPrefix; import android.net.LinkAddress; import android.net.LinkProperties; import android.net.Network; import android.net.NetworkCapabilities; import android.net.ResolverOptionsParcel; import android.net.ResolverParamsParcel; import android.net.RouteInfo; import android.net.shared.PrivateDnsConfig; import android.provider.Settings; import android.test.mock.MockContentResolver; import android.util.SparseArray; import androidx.test.filters.SmallTest; import androidx.test.runner.AndroidJUnit4; import com.android.internal.util.MessageUtils; import com.android.internal.util.test.FakeSettingsProvider; import libcore.net.InetAddressUtils; import org.junit.Before; import org.junit.Test; import org.junit.runner.RunWith; import org.mockito.ArgumentCaptor; import org.mockito.Mock; import org.mockito.MockitoAnnotations; import java.net.InetAddress; import java.util.Arrays; /** * Tests for {@link DnsManager}. * * Build, install and run with: * runtest frameworks-net -c com.android.server.connectivity.DnsManagerTest */ @RunWith(AndroidJUnit4.class) @SmallTest public class DnsManagerTest { static final String TEST_IFACENAME = "test_wlan0"; static final int TEST_NETID = 100; static final int TEST_NETID_ALTERNATE = 101; static final int TEST_NETID_UNTRACKED = 102; static final int TEST_DEFAULT_SAMPLE_VALIDITY_SECONDS = 1800; static final int TEST_DEFAULT_SUCCESS_THRESHOLD_PERCENT = 25; static final int TEST_DEFAULT_MIN_SAMPLES = 8; static final int TEST_DEFAULT_MAX_SAMPLES = 64; static final int[] TEST_TRANSPORT_TYPES = {TRANSPORT_WIFI, TRANSPORT_VPN}; DnsManager mDnsManager; MockContentResolver mContentResolver; @Mock Context mCtx; @Mock IDnsResolver mMockDnsResolver; @Mock MockableSystemProperties mSystemProperties; private void assertResolverOptionsEquals( @NonNull ResolverOptionsParcel actual, @NonNull ResolverOptionsParcel expected) { assertEquals(actual.hosts, expected.hosts); assertEquals(actual.tcMode, expected.tcMode); assertEquals(actual.enforceDnsUid, expected.enforceDnsUid); assertFieldCountEquals(3, ResolverOptionsParcel.class); } private void assertResolverParamsEquals(@NonNull ResolverParamsParcel actual, @NonNull ResolverParamsParcel expected) { assertEquals(actual.netId, expected.netId); assertEquals(actual.sampleValiditySeconds, expected.sampleValiditySeconds); assertEquals(actual.successThreshold, expected.successThreshold); assertEquals(actual.minSamples, expected.minSamples); assertEquals(actual.maxSamples, expected.maxSamples); assertEquals(actual.baseTimeoutMsec, expected.baseTimeoutMsec); assertEquals(actual.retryCount, expected.retryCount); assertContainsStringsExactly(actual.servers, expected.servers); assertContainsStringsExactly(actual.domains, expected.domains); assertEquals(actual.tlsName, expected.tlsName); assertContainsStringsExactly(actual.tlsServers, expected.tlsServers); assertContainsStringsExactly(actual.tlsFingerprints, expected.tlsFingerprints); assertEquals(actual.caCertificate, expected.caCertificate); assertEquals(actual.tlsConnectTimeoutMs, expected.tlsConnectTimeoutMs); assertResolverOptionsEquals(actual.resolverOptions, expected.resolverOptions); assertContainsExactly(actual.transportTypes, expected.transportTypes); assertFieldCountEquals(16, ResolverParamsParcel.class); } @Before public void setUp() throws Exception { MockitoAnnotations.initMocks(this); mContentResolver = new MockContentResolver(); mContentResolver.addProvider(Settings.AUTHORITY, new FakeSettingsProvider()); when(mCtx.getContentResolver()).thenReturn(mContentResolver); mDnsManager = new DnsManager(mCtx, mMockDnsResolver, mSystemProperties); // Clear the private DNS settings Settings.Global.putString(mContentResolver, PRIVATE_DNS_DEFAULT_MODE, ""); Settings.Global.putString(mContentResolver, PRIVATE_DNS_MODE, ""); Settings.Global.putString(mContentResolver, PRIVATE_DNS_SPECIFIER, ""); } @Test public void testTrackedValidationUpdates() throws Exception { mDnsManager.updatePrivateDns(new Network(TEST_NETID), mDnsManager.getPrivateDnsConfig()); mDnsManager.updatePrivateDns(new Network(TEST_NETID_ALTERNATE), mDnsManager.getPrivateDnsConfig()); LinkProperties lp = new LinkProperties(); lp.setInterfaceName(TEST_IFACENAME); lp.addDnsServer(InetAddress.getByName("3.3.3.3")); lp.addDnsServer(InetAddress.getByName("4.4.4.4")); // Send a validation event that is tracked on the alternate netId mDnsManager.updateTransportsForNetwork(TEST_NETID, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.setDefaultDnsSystemProperties(lp.getDnsServers()); mDnsManager.flushVmDnsCache(); mDnsManager.updateTransportsForNetwork(TEST_NETID_ALTERNATE, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID_ALTERNATE, lp); mDnsManager.flushVmDnsCache(); mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID_ALTERNATE, InetAddress.parseNumericAddress("4.4.4.4"), "", true)); LinkProperties fixedLp = new LinkProperties(lp); mDnsManager.updatePrivateDnsStatus(TEST_NETID, fixedLp); assertFalse(fixedLp.isPrivateDnsActive()); assertNull(fixedLp.getPrivateDnsServerName()); fixedLp = new LinkProperties(lp); mDnsManager.updatePrivateDnsStatus(TEST_NETID_ALTERNATE, fixedLp); assertTrue(fixedLp.isPrivateDnsActive()); assertNull(fixedLp.getPrivateDnsServerName()); assertEquals(Arrays.asList(InetAddress.getByName("4.4.4.4")), fixedLp.getValidatedPrivateDnsServers()); // Set up addresses for strict mode and switch to it. lp.addLinkAddress(new LinkAddress("192.0.2.4/24")); lp.addRoute(new RouteInfo((IpPrefix) null, InetAddress.getByName("192.0.2.4"), TEST_IFACENAME)); lp.addLinkAddress(new LinkAddress("2001:db8:1::1/64")); lp.addRoute(new RouteInfo((IpPrefix) null, InetAddress.getByName("2001:db8:1::1"), TEST_IFACENAME)); Settings.Global.putString(mContentResolver, PRIVATE_DNS_MODE, PRIVATE_DNS_MODE_PROVIDER_HOSTNAME); Settings.Global.putString(mContentResolver, PRIVATE_DNS_SPECIFIER, "strictmode.com"); mDnsManager.updatePrivateDns(new Network(TEST_NETID), new PrivateDnsConfig("strictmode.com", new InetAddress[] { InetAddress.parseNumericAddress("6.6.6.6"), InetAddress.parseNumericAddress("2001:db8:66:66::1") })); mDnsManager.updateTransportsForNetwork(TEST_NETID, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.setDefaultDnsSystemProperties(lp.getDnsServers()); mDnsManager.flushVmDnsCache(); fixedLp = new LinkProperties(lp); mDnsManager.updatePrivateDnsStatus(TEST_NETID, fixedLp); assertTrue(fixedLp.isPrivateDnsActive()); assertEquals("strictmode.com", fixedLp.getPrivateDnsServerName()); // No validation events yet. assertEquals(Arrays.asList(new InetAddress[0]), fixedLp.getValidatedPrivateDnsServers()); // Validate one. mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("6.6.6.6"), "strictmode.com", true)); fixedLp = new LinkProperties(lp); mDnsManager.updatePrivateDnsStatus(TEST_NETID, fixedLp); assertEquals(Arrays.asList(InetAddress.parseNumericAddress("6.6.6.6")), fixedLp.getValidatedPrivateDnsServers()); // Validate the 2nd one. mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("2001:db8:66:66::1"), "strictmode.com", true)); fixedLp = new LinkProperties(lp); mDnsManager.updatePrivateDnsStatus(TEST_NETID, fixedLp); assertEquals(Arrays.asList( InetAddress.parseNumericAddress("2001:db8:66:66::1"), InetAddress.parseNumericAddress("6.6.6.6")), fixedLp.getValidatedPrivateDnsServers()); } @Test public void testIgnoreUntrackedValidationUpdates() throws Exception { // The PrivateDnsConfig map is empty, so no validation events will // be tracked. LinkProperties lp = new LinkProperties(); lp.addDnsServer(InetAddress.getByName("3.3.3.3")); mDnsManager.updateTransportsForNetwork(TEST_NETID, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.setDefaultDnsSystemProperties(lp.getDnsServers()); mDnsManager.flushVmDnsCache(); mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("3.3.3.3"), "", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); // Validation event has untracked netId mDnsManager.updatePrivateDns(new Network(TEST_NETID), mDnsManager.getPrivateDnsConfig()); mDnsManager.updateTransportsForNetwork(TEST_NETID, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.setDefaultDnsSystemProperties(lp.getDnsServers()); mDnsManager.flushVmDnsCache(); mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID_UNTRACKED, InetAddress.parseNumericAddress("3.3.3.3"), "", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); // Validation event has untracked ipAddress mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("4.4.4.4"), "", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); // Validation event has untracked hostname mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("3.3.3.3"), "hostname", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); // Validation event failed mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("3.3.3.3"), "", false)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); // Network removed mDnsManager.removeNetwork(new Network(TEST_NETID)); mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("3.3.3.3"), "", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); // Turn private DNS mode off Settings.Global.putString(mContentResolver, PRIVATE_DNS_MODE, PRIVATE_DNS_MODE_OFF); mDnsManager.updatePrivateDns(new Network(TEST_NETID), mDnsManager.getPrivateDnsConfig()); mDnsManager.updateTransportsForNetwork(TEST_NETID, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.setDefaultDnsSystemProperties(lp.getDnsServers()); mDnsManager.flushVmDnsCache(); mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, InetAddress.parseNumericAddress("3.3.3.3"), "", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); assertFalse(lp.isPrivateDnsActive()); assertNull(lp.getPrivateDnsServerName()); } @Test public void testOverrideDefaultMode() throws Exception { // Hard-coded default is opportunistic mode. final PrivateDnsConfig cfgAuto = DnsManager.getPrivateDnsConfig(mContentResolver); assertTrue(cfgAuto.useTls); assertEquals("", cfgAuto.hostname); assertEquals(new InetAddress[0], cfgAuto.ips); // Pretend a gservices push sets the default to "off". Settings.Global.putString(mContentResolver, PRIVATE_DNS_DEFAULT_MODE, "off"); final PrivateDnsConfig cfgOff = DnsManager.getPrivateDnsConfig(mContentResolver); assertFalse(cfgOff.useTls); assertEquals("", cfgOff.hostname); assertEquals(new InetAddress[0], cfgOff.ips); // Strict mode still works. Settings.Global.putString( mContentResolver, PRIVATE_DNS_MODE, PRIVATE_DNS_MODE_PROVIDER_HOSTNAME); Settings.Global.putString(mContentResolver, PRIVATE_DNS_SPECIFIER, "strictmode.com"); final PrivateDnsConfig cfgStrict = DnsManager.getPrivateDnsConfig(mContentResolver); assertTrue(cfgStrict.useTls); assertEquals("strictmode.com", cfgStrict.hostname); assertEquals(new InetAddress[0], cfgStrict.ips); } @Test public void testSendDnsConfiguration() throws Exception { reset(mMockDnsResolver); mDnsManager.updatePrivateDns(new Network(TEST_NETID), mDnsManager.getPrivateDnsConfig()); final LinkProperties lp = new LinkProperties(); lp.setInterfaceName(TEST_IFACENAME); lp.addDnsServer(InetAddress.getByName("3.3.3.3")); lp.addDnsServer(InetAddress.getByName("4.4.4.4")); mDnsManager.updateTransportsForNetwork(TEST_NETID, TEST_TRANSPORT_TYPES); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.setDefaultDnsSystemProperties(lp.getDnsServers()); mDnsManager.flushVmDnsCache(); final ArgumentCaptor resolverParamsParcelCaptor = ArgumentCaptor.forClass(ResolverParamsParcel.class); verify(mMockDnsResolver, times(1)).setResolverConfiguration( resolverParamsParcelCaptor.capture()); final ResolverParamsParcel actualParams = resolverParamsParcelCaptor.getValue(); final ResolverParamsParcel expectedParams = new ResolverParamsParcel(); expectedParams.netId = TEST_NETID; expectedParams.sampleValiditySeconds = TEST_DEFAULT_SAMPLE_VALIDITY_SECONDS; expectedParams.successThreshold = TEST_DEFAULT_SUCCESS_THRESHOLD_PERCENT; expectedParams.minSamples = TEST_DEFAULT_MIN_SAMPLES; expectedParams.maxSamples = TEST_DEFAULT_MAX_SAMPLES; expectedParams.servers = new String[]{"3.3.3.3", "4.4.4.4"}; expectedParams.domains = new String[]{}; expectedParams.tlsName = ""; expectedParams.tlsServers = new String[]{"3.3.3.3", "4.4.4.4"}; expectedParams.transportTypes = TEST_TRANSPORT_TYPES; expectedParams.resolverOptions = new ResolverOptionsParcel(); assertResolverParamsEquals(actualParams, expectedParams); } @Test public void testTransportTypesEqual() throws Exception { SparseArray ncTransTypes = MessageUtils.findMessageNames( new Class[] { NetworkCapabilities.class }, new String[]{ "TRANSPORT_" }); SparseArray dnsTransTypes = MessageUtils.findMessageNames( new Class[] { IDnsResolver.class }, new String[]{ "TRANSPORT_" }); assertEquals(0, MIN_TRANSPORT); assertEquals(MAX_TRANSPORT + 1, ncTransTypes.size()); // TRANSPORT_UNKNOWN in IDnsResolver is defined to -1 and only for resolver. assertEquals("TRANSPORT_UNKNOWN", dnsTransTypes.get(-1)); assertEquals(ncTransTypes.size(), dnsTransTypes.size() - 1); for (int i = MIN_TRANSPORT; i < MAX_TRANSPORT; i++) { String name = ncTransTypes.get(i, null); assertNotNull("Could not find NetworkCapabilies.TRANSPORT_* constant equal to " + i, name); assertEquals(name, dnsTransTypes.get(i)); } } @Test public void testGetPrivateDnsConfigForNetwork() throws Exception { final Network network = new Network(TEST_NETID); final InetAddress dnsAddr = InetAddressUtils.parseNumericAddress("3.3.3.3"); final InetAddress[] tlsAddrs = new InetAddress[]{ InetAddressUtils.parseNumericAddress("6.6.6.6"), InetAddressUtils.parseNumericAddress("2001:db8:66:66::1") }; final String tlsName = "strictmode.com"; LinkProperties lp = new LinkProperties(); lp.addDnsServer(dnsAddr); // The PrivateDnsConfig map is empty, so the default PRIVATE_DNS_OFF is returned. PrivateDnsConfig privateDnsCfg = mDnsManager.getPrivateDnsConfig(network); assertFalse(privateDnsCfg.useTls); assertEquals("", privateDnsCfg.hostname); assertEquals(new InetAddress[0], privateDnsCfg.ips); // An entry with default PrivateDnsConfig is added to the PrivateDnsConfig map. mDnsManager.updatePrivateDns(network, mDnsManager.getPrivateDnsConfig()); mDnsManager.noteDnsServersForNetwork(TEST_NETID, lp); mDnsManager.updatePrivateDnsValidation( new DnsManager.PrivateDnsValidationUpdate(TEST_NETID, dnsAddr, "", true)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); privateDnsCfg = mDnsManager.getPrivateDnsConfig(network); assertTrue(privateDnsCfg.useTls); assertEquals("", privateDnsCfg.hostname); assertEquals(new InetAddress[0], privateDnsCfg.ips); // The original entry is overwritten by a new PrivateDnsConfig. mDnsManager.updatePrivateDns(network, new PrivateDnsConfig(tlsName, tlsAddrs)); mDnsManager.updatePrivateDnsStatus(TEST_NETID, lp); privateDnsCfg = mDnsManager.getPrivateDnsConfig(network); assertTrue(privateDnsCfg.useTls); assertEquals(tlsName, privateDnsCfg.hostname); assertEquals(tlsAddrs, privateDnsCfg.ips); // The network is removed, so the PrivateDnsConfig map becomes empty again. mDnsManager.removeNetwork(network); privateDnsCfg = mDnsManager.getPrivateDnsConfig(network); assertFalse(privateDnsCfg.useTls); assertEquals("", privateDnsCfg.hostname); assertEquals(new InetAddress[0], privateDnsCfg.ips); } }