1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 *
16 */
17
18 #define LOG_TAG "resolv_gold_test"
19
20 #include <Fwmark.h>
21 #include <android-base/chrono_utils.h>
22 #include <android-base/file.h>
23 #include <android-base/logging.h>
24 #include <android-base/result.h>
25 #include <android-base/stringprintf.h>
26 #include <gmock/gmock-matchers.h>
27 #include <gtest/gtest.h>
28
29 #include "PrivateDnsConfiguration.h"
30 #include "getaddrinfo.h"
31 #include "gethnamaddr.h"
32 #include "golddata.pb.h"
33 #include "resolv_cache.h"
34 #include "resolv_test_utils.h"
35 #include "tests/dns_responder/dns_responder.h"
36 #include "tests/dns_responder/dns_responder_client_ndk.h"
37 #include "tests/dns_responder/dns_tls_certificate.h"
38 #include "tests/dns_responder/dns_tls_frontend.h"
39
40 namespace android::net {
41
42 using android::base::Result;
43 using android::base::StringPrintf;
44 using android::netdutils::ScopedAddrinfo;
45 using std::chrono::milliseconds;
46
47 enum class DnsProtocol { CLEARTEXT, TLS };
48
49 // The buffer size of resolv_gethostbyname().
50 // TODO: Consider moving to packages/modules/DnsResolver/tests/resolv_test_utils.h.
51 constexpr unsigned int MAXPACKET = 8 * 1024;
52
53 // The testdata/*.pb are generated from testdata/*.pbtext.
54 const std::string kTestDataPath = android::base::GetExecutableDirectory() + "/testdata/";
55 const std::vector<std::string> kGoldFilesGetAddrInfo = {
56 "getaddrinfo.topsite.google.pb", "getaddrinfo.topsite.youtube.pb",
57 "getaddrinfo.topsite.amazon.pb", "getaddrinfo.topsite.yahoo.pb",
58 "getaddrinfo.topsite.facebook.pb", "getaddrinfo.topsite.reddit.pb",
59 "getaddrinfo.topsite.wikipedia.pb", "getaddrinfo.topsite.ebay.pb",
60 "getaddrinfo.topsite.netflix.pb", "getaddrinfo.topsite.bing.pb"};
61 const std::vector<std::string> kGoldFilesGetAddrInfoTls = {"getaddrinfo.tls.topsite.google.pb"};
62 const std::vector<std::string> kGoldFilesGetHostByName = {"gethostbyname.topsite.youtube.pb"};
63 const std::vector<std::string> kGoldFilesGetHostByNameTls = {
64 "gethostbyname.tls.topsite.youtube.pb"};
65
66 // Fixture test class definition.
67 class TestBase : public ::testing::Test {
68 protected:
SetUpTestSuite()69 static void SetUpTestSuite() {
70 // Unzip *.pb from pb.zip. The unzipped files get 777 permission by default. Remove execute
71 // permission so that Trade Federation test harness has no chance mis-executing on *.pb.
72 const std::string unzipCmd = "unzip -o " + kTestDataPath + "pb.zip -d " + kTestDataPath +
73 "&& chmod -R 666 " + kTestDataPath;
74 // NOLINTNEXTLINE(cert-env33-c)
75 if (W_EXITCODE(0, 0) != system(unzipCmd.c_str())) {
76 LOG(ERROR) << "fail to inflate .pb files";
77 GTEST_LOG_(FATAL) << "fail to inflate .pb files";
78 }
79 }
80
SetUp()81 void SetUp() override {
82 // Create cache for test
83 resolv_create_cache_for_net(TEST_NETID);
84 }
85
TearDown()86 void TearDown() override {
87 // Clear TLS configuration for test
88 privateDnsConfiguration.clear(TEST_NETID);
89 // Delete cache for test
90 resolv_delete_cache_for_net(TEST_NETID);
91 }
92
SetResolverConfiguration(const std::vector<std::string> & servers,const std::vector<std::string> & domains,const std::vector<std::string> & tlsServers={},const std::string & tlsHostname="",const std::string & caCert="")93 void SetResolverConfiguration(const std::vector<std::string>& servers,
94 const std::vector<std::string>& domains,
95 const std::vector<std::string>& tlsServers = {},
96 const std::string& tlsHostname = "",
97 const std::string& caCert = "") {
98 // Determine the DNS configuration steps from setResolverConfiguration() in
99 // packages/modules/DnsResolver/ResolverController.cpp. The gold test just needs to setup
100 // simply DNS and DNS-over-TLS server configuration. Some implementation in
101 // setResolverConfiguration() are not required. For example, limiting TLS server amount is
102 // not necessary for gold test because gold test has only one TLS server for testing
103 // so far.
104 Fwmark fwmark;
105 fwmark.netId = TEST_NETID;
106 fwmark.explicitlySelected = true;
107 fwmark.protectedFromVpn = true;
108 fwmark.permission = PERMISSION_SYSTEM;
109 ASSERT_EQ(privateDnsConfiguration.set(TEST_NETID, fwmark.intValue, tlsServers, tlsHostname,
110 caCert),
111 0);
112 ASSERT_EQ(resolv_set_nameservers(TEST_NETID, servers, domains, kParams, std::nullopt), 0);
113 }
114
SetResolvers()115 void SetResolvers() { SetResolverConfiguration(kDefaultServers, kDefaultSearchDomains); }
116
SetResolversWithTls()117 void SetResolversWithTls() {
118 // Pass servers as both network-assigned and TLS servers. Tests can
119 // determine on which server and by which protocol queries arrived.
120 // See also DnsClient::SetResolversWithTls() in
121 // packages/modules/DnsResolver/tests/dns_responder/dns_responder_client.h.
122 SetResolverConfiguration(kDefaultServers, kDefaultSearchDomains, kDefaultServers,
123 kDefaultPrivateDnsHostName, kCaCert);
124 }
125
WaitForPrivateDnsValidation(const std::string & serverAddr)126 bool WaitForPrivateDnsValidation(const std::string& serverAddr) {
127 constexpr milliseconds retryIntervalMs{20};
128 constexpr milliseconds timeoutMs{3000};
129 android::base::Timer t;
130 while (t.duration() < timeoutMs) {
131 const auto& validatedServers =
132 privateDnsConfiguration.getStatus(TEST_NETID).validatedServers();
133 for (const auto& server : validatedServers) {
134 if (serverAddr == ToString(&server.ss)) return true;
135 }
136 std::this_thread::sleep_for(retryIntervalMs);
137 }
138 return false;
139 }
140
ToProto(const std::string & filename)141 Result<GoldTest> ToProto(const std::string& filename) {
142 // Convert the testing configuration from binary .pb file to proto.
143 std::string content;
144 const std::string path = kTestDataPath + filename;
145
146 bool ret = android::base::ReadFileToString(path, &content);
147 if (!ret) return Errorf("Read {} failed: {}", path, strerror(errno));
148
149 android::net::GoldTest goldtest;
150 ret = goldtest.ParseFromString(content);
151 if (!ret) return Errorf("Parse {} failed", path);
152
153 return goldtest;
154 }
155
SetupMappings(const android::net::GoldTest & goldtest,test::DNSResponder & dns)156 void SetupMappings(const android::net::GoldTest& goldtest, test::DNSResponder& dns) {
157 for (const auto& m : goldtest.packet_mapping()) {
158 // Convert string to bytes because .proto type "bytes" is "string" type in C++.
159 // See also the section "Scalar Value Types" in "Language Guide (proto3)".
160 // TODO: Use C++20 std::span in addMappingBinaryPacket. It helps to take both
161 // std::string and std::vector without conversions.
162 dns.addMappingBinaryPacket(
163 std::vector<uint8_t>(m.query().begin(), m.query().end()),
164 std::vector<uint8_t>(m.response().begin(), m.response().end()));
165 }
166 }
167
GetNetContext(const DnsProtocol protocol)168 android_net_context GetNetContext(const DnsProtocol protocol) {
169 return protocol == DnsProtocol::TLS ? kNetcontextTls : kNetcontext;
170 }
171
172 template <class AddressType>
VerifyAddress(const android::net::GoldTest & goldtest,const AddressType & result)173 void VerifyAddress(const android::net::GoldTest& goldtest, const AddressType& result) {
174 if (goldtest.result().return_code() != GT_EAI_NO_ERROR) {
175 EXPECT_EQ(result, nullptr);
176 } else {
177 ASSERT_NE(result, nullptr);
178 const auto& addresses = goldtest.result().addresses();
179 EXPECT_THAT(ToStrings(result), ::testing::UnorderedElementsAreArray(addresses));
180 }
181 }
182
VerifyGetAddrInfo(const android::net::GoldTest & goldtest,const DnsProtocol protocol)183 void VerifyGetAddrInfo(const android::net::GoldTest& goldtest, const DnsProtocol protocol) {
184 ASSERT_TRUE(goldtest.config().has_addrinfo());
185 const auto& args = goldtest.config().addrinfo();
186 const addrinfo hints = {
187 // Clear the flag AI_ADDRCONFIG to avoid flaky test because AI_ADDRCONFIG looks at
188 // whether connectivity is available. It makes that the resolver may send only A
189 // or AAAA DNS query per connectivity even AF_UNSPEC has been assigned. See also
190 // have_ipv6() and have_ipv4() in packages/modules/DnsResolver/getaddrinfo.cpp.
191 // TODO: Consider keeping the configuration flag AI_ADDRCONFIG once the unit
192 // test can treat the IPv4 and IPv6 connectivity.
193 .ai_flags = args.ai_flags() & ~AI_ADDRCONFIG,
194 .ai_family = args.family(),
195 .ai_socktype = args.socktype(),
196 .ai_protocol = args.protocol(),
197 };
198 addrinfo* res = nullptr;
199 const android_net_context netcontext = GetNetContext(protocol);
200 NetworkDnsEventReported event;
201 const int rv =
202 resolv_getaddrinfo(args.host().c_str(), nullptr, &hints, &netcontext, &res, &event);
203 ScopedAddrinfo result(res);
204 ASSERT_EQ(rv, goldtest.result().return_code());
205 VerifyAddress(goldtest, result);
206 }
207
VerifyGetHostByName(const android::net::GoldTest & goldtest,const DnsProtocol protocol)208 void VerifyGetHostByName(const android::net::GoldTest& goldtest, const DnsProtocol protocol) {
209 ASSERT_TRUE(goldtest.config().has_hostbyname());
210 const auto& args = goldtest.config().hostbyname();
211 hostent* hp = nullptr;
212 hostent hbuf;
213 char tmpbuf[MAXPACKET];
214 const android_net_context netcontext = GetNetContext(protocol);
215 NetworkDnsEventReported event;
216 const int rv = resolv_gethostbyname(args.host().c_str(), args.family(), &hbuf, tmpbuf,
217 sizeof(tmpbuf), &netcontext, &hp, &event);
218 ASSERT_EQ(rv, goldtest.result().return_code());
219 VerifyAddress(goldtest, hp);
220 }
221
VerifyResolver(const android::net::GoldTest & goldtest,const test::DNSResponder & dns,const test::DnsTlsFrontend & tls,const DnsProtocol protocol)222 void VerifyResolver(const android::net::GoldTest& goldtest, const test::DNSResponder& dns,
223 const test::DnsTlsFrontend& tls, const DnsProtocol protocol) {
224 size_t queries;
225 std::string name;
226
227 // Verify DNS query calls and results by proto. Then, determine expected query times and
228 // queried name for checking server query status later.
229 switch (const auto calltype = goldtest.config().call()) {
230 case android::net::CallType::CALL_GETADDRINFO:
231 ASSERT_TRUE(goldtest.config().has_addrinfo());
232 ASSERT_NO_FATAL_FAILURE(VerifyGetAddrInfo(goldtest, protocol));
233 queries = goldtest.config().addrinfo().family() == AF_UNSPEC ? 2U : 1U;
234 name = goldtest.config().addrinfo().host();
235 break;
236 case android::net::CallType::CALL_GETHOSTBYNAME:
237 ASSERT_TRUE(goldtest.config().has_hostbyname());
238 ASSERT_NO_FATAL_FAILURE(VerifyGetHostByName(goldtest, protocol));
239 queries = 1U;
240 name = goldtest.config().hostbyname().host();
241 break;
242 default:
243 FAIL() << "Unsupported call type: " << calltype;
244 }
245
246 // Verify DNS server query status.
247 EXPECT_EQ(GetNumQueries(dns, name.c_str()), queries);
248 if (protocol == DnsProtocol::TLS) EXPECT_TRUE(tls.waitForQueries(queries));
249 }
250
251 static constexpr res_params kParams = {
252 .sample_validity = 300,
253 .success_threshold = 25,
254 .min_samples = 8,
255 .max_samples = 8,
256 .base_timeout_msec = 1000,
257 .retry_count = 2,
258 };
259 static constexpr android_net_context kNetcontext = {
260 .app_netid = TEST_NETID,
261 .app_mark = MARK_UNSET,
262 .dns_netid = TEST_NETID,
263 .dns_mark = MARK_UNSET,
264 .uid = NET_CONTEXT_INVALID_UID,
265 };
266 static constexpr android_net_context kNetcontextTls = {
267 .app_netid = TEST_NETID,
268 .app_mark = MARK_UNSET,
269 .dns_netid = TEST_NETID,
270 .dns_mark = MARK_UNSET,
271 .uid = NET_CONTEXT_INVALID_UID,
272 // Set TLS flags. See also maybeFixupNetContext() in
273 // packages/modules/DnsResolver/DnsProxyListener.cpp.
274 .flags = NET_CONTEXT_FLAG_USE_DNS_OVER_TLS | NET_CONTEXT_FLAG_USE_EDNS,
275 };
276
277 private:
278 // Only one instance is created and used across tests.
279 PrivateDnsConfiguration& privateDnsConfiguration = PrivateDnsConfiguration::getInstance();
280 };
281 class ResolvGetAddrInfo : public TestBase {};
282
283 // Fixture tests.
TEST_F(ResolvGetAddrInfo,RemovePacketMapping)284 TEST_F(ResolvGetAddrInfo, RemovePacketMapping) {
285 test::DNSResponder dns(test::DNSResponder::MappingType::BINARY_PACKET);
286 ASSERT_TRUE(dns.startServer());
287 ASSERT_NO_FATAL_FAILURE(SetResolvers());
288
289 dns.addMappingBinaryPacket(kHelloExampleComQueryV4, kHelloExampleComResponseV4);
290
291 addrinfo* res = nullptr;
292 const addrinfo hints = {.ai_family = AF_INET};
293 NetworkDnsEventReported event;
294 int rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
295 ScopedAddrinfo result(res);
296 ASSERT_NE(result, nullptr);
297 ASSERT_EQ(rv, 0);
298 EXPECT_EQ(ToString(result), kHelloExampleComAddrV4);
299
300 // Remove existing DNS record.
301 dns.removeMappingBinaryPacket(kHelloExampleComQueryV4);
302
303 // Expect to have no answer in DNS query result.
304 rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
305 result.reset(res);
306 ASSERT_EQ(result, nullptr);
307 ASSERT_EQ(rv, EAI_NODATA);
308 }
309
TEST_F(ResolvGetAddrInfo,ReplacePacketMapping)310 TEST_F(ResolvGetAddrInfo, ReplacePacketMapping) {
311 test::DNSResponder dns(test::DNSResponder::MappingType::BINARY_PACKET);
312 ASSERT_TRUE(dns.startServer());
313 ASSERT_NO_FATAL_FAILURE(SetResolvers());
314
315 // Register the record which uses IPv4 address 1.2.3.4.
316 dns.addMappingBinaryPacket(kHelloExampleComQueryV4, kHelloExampleComResponseV4);
317
318 // Expect that the DNS query returns IPv4 address 1.2.3.4.
319 addrinfo* res = nullptr;
320 const addrinfo hints = {.ai_family = AF_INET};
321 NetworkDnsEventReported event;
322 int rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
323 ScopedAddrinfo result(res);
324 ASSERT_NE(result, nullptr);
325 ASSERT_EQ(rv, 0);
326 EXPECT_EQ(ToString(result), "1.2.3.4");
327
328 // Replace the registered record with a record which uses new IPv4 address 5.6.7.8.
329 std::vector<uint8_t> newHelloExampleComResponseV4 = {
330 /* Header */
331 0x00, 0x00, /* Transaction ID: 0x0000 */
332 0x81, 0x80, /* Flags: qr rd ra */
333 0x00, 0x01, /* Questions: 1 */
334 0x00, 0x01, /* Answer RRs: 1 */
335 0x00, 0x00, /* Authority RRs: 0 */
336 0x00, 0x00, /* Additional RRs: 0 */
337 /* Queries */
338 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
339 0x03, 0x63, 0x6f, 0x6d, 0x00, /* Name: hello.example.com */
340 0x00, 0x01, /* Type: A */
341 0x00, 0x01, /* Class: IN */
342 /* Answers */
343 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65,
344 0x03, 0x63, 0x6f, 0x6d, 0x00, /* Name: hello.example.com */
345 0x00, 0x01, /* Type: A */
346 0x00, 0x01, /* Class: IN */
347 0x00, 0x00, 0x00, 0x00, /* Time to live: 0 */
348 0x00, 0x04, /* Data length: 4 */
349 0x05, 0x06, 0x07, 0x08 /* Address: 5.6.7.8 */
350 };
351 dns.addMappingBinaryPacket(kHelloExampleComQueryV4, newHelloExampleComResponseV4);
352
353 // Expect that DNS query returns new IPv4 address 5.6.7.8.
354 rv = resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontext, &res, &event);
355 result.reset(res);
356 ASSERT_NE(result, nullptr);
357 ASSERT_EQ(rv, 0);
358 EXPECT_EQ(ToString(result), "5.6.7.8");
359 }
360
TEST_F(ResolvGetAddrInfo,BasicTlsQuery)361 TEST_F(ResolvGetAddrInfo, BasicTlsQuery) {
362 test::DNSResponder dns;
363 dns.addMapping(kHelloExampleCom, ns_type::ns_t_a, kHelloExampleComAddrV4);
364 dns.addMapping(kHelloExampleCom, ns_type::ns_t_aaaa, kHelloExampleComAddrV6);
365 ASSERT_TRUE(dns.startServer());
366
367 test::DnsTlsFrontend tls;
368 ASSERT_TRUE(tls.startServer());
369 ASSERT_NO_FATAL_FAILURE(SetResolversWithTls());
370 EXPECT_TRUE(WaitForPrivateDnsValidation(tls.listen_address()));
371 tls.setDelayQueries(2);
372 tls.setDelayQueriesTimeout(200);
373
374 dns.clearQueries();
375 addrinfo* res = nullptr;
376 // If the socket type is not specified, every address will appear twice, once for
377 // SOCK_STREAM and one for SOCK_DGRAM. Just pick one because the addresses for
378 // the second query of different socket type are responded by the cache.
379 const addrinfo hints = {.ai_family = AF_UNSPEC, .ai_socktype = SOCK_STREAM};
380 NetworkDnsEventReported event;
381 const int rv =
382 resolv_getaddrinfo(kHelloExampleCom, nullptr, &hints, &kNetcontextTls, &res, &event);
383 ScopedAddrinfo result(res);
384 ASSERT_EQ(rv, 0);
385 EXPECT_EQ(GetNumQueries(dns, kHelloExampleCom), 2U);
386 const std::vector<std::string> result_strs = ToStrings(result);
387 EXPECT_THAT(result_strs, testing::UnorderedElementsAreArray(
388 {kHelloExampleComAddrV4, kHelloExampleComAddrV6}));
389 EXPECT_TRUE(tls.waitForQueries(3));
390 }
391
392 // Parameterized test class definition.
393 using GoldTestParamType = std::tuple<DnsProtocol, std::string /* filename */>;
394 class ResolvGoldTest : public TestBase, public ::testing::WithParamInterface<GoldTestParamType> {
395 public:
396 // Generate readable string for test name from test parameters.
Name(const::testing::TestParamInfo<GoldTestParamType> & info)397 static std::string Name(const ::testing::TestParamInfo<GoldTestParamType>& info) {
398 const auto& [protocol, file] = info.param;
399 std::string name = StringPrintf(
400 "%s_%s", protocol == DnsProtocol::CLEARTEXT ? "CLEARTEXT" : "TLS", file.c_str());
401 std::replace_if(
402 std::begin(name), std::end(name), [](char ch) { return !std::isalnum(ch); }, '_');
403 return name;
404 }
405 };
406
407 // GetAddrInfo tests.
408 INSTANTIATE_TEST_SUITE_P(GetAddrInfo, ResolvGoldTest,
409 ::testing::Combine(::testing::Values(DnsProtocol::CLEARTEXT),
410 ::testing::ValuesIn(kGoldFilesGetAddrInfo)),
411 ResolvGoldTest::Name);
412 INSTANTIATE_TEST_SUITE_P(GetAddrInfoTls, ResolvGoldTest,
413 ::testing::Combine(::testing::Values(DnsProtocol::TLS),
414 ::testing::ValuesIn(kGoldFilesGetAddrInfoTls)),
415 ResolvGoldTest::Name);
416
417 // GetHostByName tests.
418 INSTANTIATE_TEST_SUITE_P(GetHostByName, ResolvGoldTest,
419 ::testing::Combine(::testing::Values(DnsProtocol::CLEARTEXT),
420 ::testing::ValuesIn(kGoldFilesGetHostByName)),
421 ResolvGoldTest::Name);
422 INSTANTIATE_TEST_SUITE_P(GetHostByNameTls, ResolvGoldTest,
423 ::testing::Combine(::testing::Values(DnsProtocol::TLS),
424 ::testing::ValuesIn(kGoldFilesGetHostByNameTls)),
425 ResolvGoldTest::Name);
426
TEST_P(ResolvGoldTest,GoldData)427 TEST_P(ResolvGoldTest, GoldData) {
428 const auto& [protocol, file] = GetParam();
429
430 // Setup DNS server configuration.
431 test::DNSResponder dns(test::DNSResponder::MappingType::BINARY_PACKET);
432 ASSERT_TRUE(dns.startServer());
433 test::DnsTlsFrontend tls;
434 tls.setDelayQueries(2);
435 tls.setDelayQueriesTimeout(200);
436
437 if (protocol == DnsProtocol::CLEARTEXT) {
438 ASSERT_NO_FATAL_FAILURE(SetResolvers());
439 } else if (protocol == DnsProtocol::TLS) {
440 ASSERT_TRUE(tls.startServer());
441 ASSERT_NO_FATAL_FAILURE(SetResolversWithTls());
442 EXPECT_TRUE(WaitForPrivateDnsValidation(tls.listen_address()));
443 tls.clearQueries();
444 }
445
446 // Read test configuration from serialized binary to proto.
447 const Result<GoldTest> result = ToProto(file);
448 ASSERT_TRUE(result.ok()) << result.error().message();
449 const GoldTest& goldtest = result.value();
450
451 // Register packet mappings (query, response) from proto.
452 SetupMappings(goldtest, dns);
453
454 // Verify the resolver by proto.
455 VerifyResolver(goldtest, dns, tls, protocol);
456 }
457
458 } // namespace android::net
459