Skip to content

Fix multiple DNS leaks #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
liamsmith827 wants to merge 1 commit into
base: 16-qpr2
Choose a base branch
from
Open

Fix multiple DNS leaks #14

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions DnsProxyListener.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -940,8 +940,9 @@ void DnsProxyListener::GetAddrInfoHandler::run() {
NetworkDnsEventReported event;
initDnsEvent(&event, mNetContext);
const bool isUidBlocked = isUidNetworkingBlocked(mNetContext.uid, mNetContext.dns_netid);
if (isUidBlocked) {
LOG(INFO) << "GetAddrInfoHandler::run: network access blocked";
bool isLockdownVpnBlockingDns = gResNetdCallbacks.check_lockdown_vpn_blocking_dns(&mNetContext);
if (isUidBlocked || isLockdownVpnBlockingDns) {
LOG(INFO) << "GetAddrInfoHandler::run: network or DNS server access blocked";
rv = EAI_FAIL;
} else if (startQueryLimiter(uid)) {
const char* host = mHost.starts_with('^') ? nullptr : mHost.c_str();
Expand Down Expand Up @@ -1155,8 +1156,9 @@ void DnsProxyListener::ResNSendHandler::run() {
NetworkDnsEventReported event;
initDnsEvent(&event, mNetContext);
const bool isUidBlocked = isUidNetworkingBlocked(mNetContext.uid, mNetContext.dns_netid);
if (isUidBlocked) {
LOG(INFO) << "ResNSendHandler::run: network access blocked";
bool isLockdownVpnBlockingDns = gResNetdCallbacks.check_lockdown_vpn_blocking_dns(&mNetContext);
if (isUidBlocked || isLockdownVpnBlockingDns) {
LOG(INFO) << "ResNSendHandler::run: network or DNS server access blocked";
ansLen = -ECONNREFUSED;
} else if (startQueryLimiter(uid)) {
if (evaluate_domain_name(mNetContext, rr_name.c_str())) {
Expand Down Expand Up @@ -1379,8 +1381,9 @@ void DnsProxyListener::GetHostByNameHandler::run() {
NetworkDnsEventReported event;
initDnsEvent(&event, mNetContext);
const bool isUidBlocked = isUidNetworkingBlocked(mNetContext.uid, mNetContext.dns_netid);
if (isUidBlocked) {
LOG(INFO) << "GetHostByNameHandler::run: network access blocked";
bool isLockdownVpnBlockingDns = gResNetdCallbacks.check_lockdown_vpn_blocking_dns(&mNetContext);
if (isUidBlocked || isLockdownVpnBlockingDns) {
LOG(INFO) << "GetHostByNameHandler::run: network or DNS server access blocked";
rv = EAI_FAIL;
} else if (startQueryLimiter(uid)) {
const char* name = mName.starts_with('^') ? nullptr : mName.c_str();
Expand Down Expand Up @@ -1543,8 +1546,9 @@ void DnsProxyListener::GetHostByAddrHandler::run() {
initDnsEvent(&event, mNetContext);

const bool isUidBlocked = isUidNetworkingBlocked(mNetContext.uid, mNetContext.dns_netid);
if (isUidBlocked) {
LOG(INFO) << "GetHostByAddrHandler::run: network access blocked";
bool isLockdownVpnBlockingDns = gResNetdCallbacks.check_lockdown_vpn_blocking_dns(&mNetContext);
if (isUidBlocked || isLockdownVpnBlockingDns) {
LOG(INFO) << "GetHostByAddrHandler::run: network or DNS server access blocked";
rv = EAI_FAIL;
} else if (startQueryLimiter(uid)) {
// From Android U, evaluate_domain_name() is not only for OEM customization, but also tells
Expand Down
1 change: 1 addition & 0 deletions DnsResolver.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ bool resolv_init(const ResolverNetdCallbacks* callbacks) {
gResNetdCallbacks.tagSocket = callbacks->tagSocket;
gResNetdCallbacks.evaluate_domain_name = callbacks->evaluate_domain_name;
}
gResNetdCallbacks.check_lockdown_vpn_blocking_dns = callbacks->check_lockdown_vpn_blocking_dns;
android::net::gDnsResolv = android::net::DnsResolver::getInstance();
return android::net::gDnsResolv->start();
}
Expand Down
3 changes: 3 additions & 0 deletions include/netd_resolv/resolv.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,8 @@ typedef int (*tagSocketCallback)(int sockFd, uint32_t tag, uid_t uid, pid_t pid)
typedef bool (*evaluate_domain_name_callback)(
const android_net_context &netcontext, const char *host);

typedef bool (*check_lockdown_vpn_blocking_dns_callback)(android_net_context* netcontext);

/*
* Some functions needed by the resolver (e.g. checkCallingPermission()) live in
* libraries with no ABI stability guarantees, such as libbinder.so.
Expand All @@ -141,6 +143,7 @@ struct ResolverNetdCallbacks {
log_callback log;
tagSocketCallback tagSocket;
evaluate_domain_name_callback evaluate_domain_name;
check_lockdown_vpn_blocking_dns_callback check_lockdown_vpn_blocking_dns;
};

#define TAG_SYSTEM_DNS 0xFFFFFF82
Expand Down