com/android/server/connectivity/DnsManager.java - platform/prebuilts/fullsdk/sources/android-28 - Git at Google

 /*
  * Copyright (C) 2018 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 package com.android.server.connectivity;

 import static android.net.ConnectivityManager.PRIVATE_DNS_DEFAULT_MODE;
 import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_OFF;
 import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_OPPORTUNISTIC;
 import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
 import static android.provider.Settings.Global.DNS_RESOLVER_MIN_SAMPLES;
 import static android.provider.Settings.Global.DNS_RESOLVER_MAX_SAMPLES;
 import static android.provider.Settings.Global.DNS_RESOLVER_SAMPLE_VALIDITY_SECONDS;
 import static android.provider.Settings.Global.DNS_RESOLVER_SUCCESS_THRESHOLD_PERCENT;
 import static android.provider.Settings.Global.PRIVATE_DNS_MODE;
 import static android.provider.Settings.Global.PRIVATE_DNS_SPECIFIER;

 import android.content.ContentResolver;
 import android.content.Context;
 import android.content.Intent;
 import android.net.LinkProperties;
 import android.net.Network;
 import android.net.NetworkUtils;
 import android.net.Uri;
 import android.net.dns.ResolvUtil;
 import android.os.Binder;
 import android.os.INetworkManagementService;
 import android.os.UserHandle;
 import android.provider.Settings;
 import android.text.TextUtils;
 import android.util.Pair;
 import android.util.Slog;

 import com.android.server.connectivity.MockableSystemProperties;

 import java.net.InetAddress;
 import java.net.UnknownHostException;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.Map;
 import java.util.Objects;
 import java.util.stream.Collectors;
 import java.util.Set;
 import java.util.StringJoiner;


 /**
  * Encapsulate the management of DNS settings for networks.
  *
  * This class it NOT designed for concurrent access. Furthermore, all non-static
  * methods MUST be called from ConnectivityService's thread.
  *
  * [ Private DNS ]
  * The code handling Private DNS is spread across several components, but this
  * seems like the least bad place to collect all the observations.
  *
  * Private DNS handling and updating occurs in response to several different
  * events. Each is described here with its corresponding intended handling.
  *
  * [A] Event: A new network comes up.
  * Mechanics:
  *     [1] ConnectivityService gets notifications from NetworkAgents.
  *     [2] in updateNetworkInfo(), the first time the NetworkAgent goes into
  *         into CONNECTED state, the Private DNS configuration is retrieved,
  *         programmed, and strict mode hostname resolution (if applicable) is
  *         enqueued in NetworkAgent's NetworkMonitor, via a call to
  *         handlePerNetworkPrivateDnsConfig().
  *     [3] Re-resolution of strict mode hostnames that fail to return any
  *         IP addresses happens inside NetworkMonitor; it sends itself a
  *         delayed CMD_EVALUATE_PRIVATE_DNS message in a simple backoff
  *         schedule.
  *     [4] Successfully resolved hostnames are sent to ConnectivityService
  *         inside an EVENT_PRIVATE_DNS_CONFIG_RESOLVED message. The resolved
  *         IP addresses are programmed into netd via:
  *
  *             updatePrivateDns() -> updateDnses()
  *
  *         both of which make calls into DnsManager.
  *     [5] Upon a successful hostname resolution NetworkMonitor initiates a
  *         validation attempt in the form of a lookup for a one-time hostname
  *         that uses Private DNS.
  *
  * [B] Event: Private DNS settings are changed.
  * Mechanics:
  *     [1] ConnectivityService gets notifications from its SettingsObserver.
  *     [2] handlePrivateDnsSettingsChanged() is called, which calls
  *         handlePerNetworkPrivateDnsConfig() and the process proceeds
  *         as if from A.3 above.
  *
  * [C] Event: An application calls ConnectivityManager#reportBadNetwork().
  * Mechanics:
  *     [1] NetworkMonitor is notified and initiates a reevaluation, which
  *         always bypasses Private DNS.
  *     [2] Once completed, NetworkMonitor checks if strict mode is in operation
  *         and if so enqueues another evaluation of Private DNS, as if from
  *         step A.5 above.
  *
  * @hide
  */
 public class DnsManager {
     private static final String TAG = DnsManager.class.getSimpleName();
     private static final PrivateDnsConfig PRIVATE_DNS_OFF = new PrivateDnsConfig();

     /* Defaults for resolver parameters. */
     private static final int DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS = 1800;
     private static final int DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT = 25;
     private static final int DNS_RESOLVER_DEFAULT_MIN_SAMPLES = 8;
     private static final int DNS_RESOLVER_DEFAULT_MAX_SAMPLES = 64;

     public static class PrivateDnsConfig {
         public final boolean useTls;
         public final String hostname;
         public final InetAddress[] ips;

         public PrivateDnsConfig() {
             this(false);
         }

         public PrivateDnsConfig(boolean useTls) {
             this.useTls = useTls;
             this.hostname = "";
             this.ips = new InetAddress[0];
         }

         public PrivateDnsConfig(String hostname, InetAddress[] ips) {
             this.useTls = !TextUtils.isEmpty(hostname);
             this.hostname = useTls ? hostname : "";
             this.ips = (ips != null) ? ips : new InetAddress[0];
         }

         public PrivateDnsConfig(PrivateDnsConfig cfg) {
             useTls = cfg.useTls;
             hostname = cfg.hostname;
             ips = cfg.ips;
         }

         public boolean inStrictMode() {
             return useTls && !TextUtils.isEmpty(hostname);
         }

         public String toString() {
             return PrivateDnsConfig.class.getSimpleName() +
                     "{" + useTls + ":" + hostname + "/" + Arrays.toString(ips) + "}";
         }
     }

     public static PrivateDnsConfig getPrivateDnsConfig(ContentResolver cr) {
         final String mode = getPrivateDnsMode(cr);

         final boolean useTls = !TextUtils.isEmpty(mode) && !PRIVATE_DNS_MODE_OFF.equals(mode);

         if (PRIVATE_DNS_MODE_PROVIDER_HOSTNAME.equals(mode)) {
             final String specifier = getStringSetting(cr, PRIVATE_DNS_SPECIFIER);
             return new PrivateDnsConfig(specifier, null);
         }

         return new PrivateDnsConfig(useTls);
     }

     public static PrivateDnsConfig tryBlockingResolveOf(Network network, String name) {
         try {
             final InetAddress[] ips = ResolvUtil.blockingResolveAllLocally(network, name);
             return new PrivateDnsConfig(name, ips);
         } catch (UnknownHostException uhe) {
             return new PrivateDnsConfig(name, null);
         }
     }

     public static Uri[] getPrivateDnsSettingsUris() {
         return new Uri[]{
             Settings.Global.getUriFor(PRIVATE_DNS_MODE),
             Settings.Global.getUriFor(PRIVATE_DNS_SPECIFIER),
         };
     }

     public static class PrivateDnsValidationUpdate {
         final public int netId;
         final public InetAddress ipAddress;
         final public String hostname;
         final public boolean validated;

         public PrivateDnsValidationUpdate(int netId, InetAddress ipAddress,
                 String hostname, boolean validated) {
             this.netId = netId;
             this.ipAddress = ipAddress;
             this.hostname = hostname;
             this.validated = validated;
         }
     }

     private static class PrivateDnsValidationStatuses {
         enum ValidationStatus {
             IN_PROGRESS,
             FAILED,
             SUCCEEDED
         }

         // Validation statuses of <hostname, ipAddress> pairs for a single netId
         private Map<Pair<String, InetAddress>, ValidationStatus> mValidationMap;

         private PrivateDnsValidationStatuses() {
             mValidationMap = new HashMap<>();
         }

         private boolean hasValidatedServer() {
             for (ValidationStatus status : mValidationMap.values()) {
                 if (status == ValidationStatus.SUCCEEDED) {
                     return true;
                 }
             }
             return false;
         }

         private void updateTrackedDnses(String[] ipAddresses, String hostname) {
             Set<Pair<String, InetAddress>> latestDnses = new HashSet<>();
             for (String ipAddress : ipAddresses) {
                 try {
                     latestDnses.add(new Pair(hostname,
                             InetAddress.parseNumericAddress(ipAddress)));
                 } catch (IllegalArgumentException e) {}
             }
             // Remove <hostname, ipAddress> pairs that should not be tracked.
             for (Iterator<Map.Entry<Pair<String, InetAddress>, ValidationStatus>> it =
                     mValidationMap.entrySet().iterator(); it.hasNext(); ) {
                 Map.Entry<Pair<String, InetAddress>, ValidationStatus> entry = it.next();
                 if (!latestDnses.contains(entry.getKey())) {
                     it.remove();
                 }
             }
             // Add new <hostname, ipAddress> pairs that should be tracked.
             for (Pair<String, InetAddress> p : latestDnses) {
                 if (!mValidationMap.containsKey(p)) {
                     mValidationMap.put(p, ValidationStatus.IN_PROGRESS);
                 }
             }
         }

         private void updateStatus(PrivateDnsValidationUpdate update) {
             Pair<String, InetAddress> p = new Pair(update.hostname,
                     update.ipAddress);
             if (!mValidationMap.containsKey(p)) {
                 return;
             }
             if (update.validated) {
                 mValidationMap.put(p, ValidationStatus.SUCCEEDED);
             } else {
                 mValidationMap.put(p, ValidationStatus.FAILED);
             }
         }
     }

     private final Context mContext;
     private final ContentResolver mContentResolver;
     private final INetworkManagementService mNMS;
     private final MockableSystemProperties mSystemProperties;
     // TODO: Replace these Maps with SparseArrays.
     private final Map<Integer, PrivateDnsConfig> mPrivateDnsMap;
     private final Map<Integer, PrivateDnsValidationStatuses> mPrivateDnsValidationMap;

     private int mNumDnsEntries;
     private int mSampleValidity;
     private int mSuccessThreshold;
     private int mMinSamples;
     private int mMaxSamples;
     private String mPrivateDnsMode;
     private String mPrivateDnsSpecifier;

     public DnsManager(Context ctx, INetworkManagementService nms, MockableSystemProperties sp) {
         mContext = ctx;
         mContentResolver = mContext.getContentResolver();
         mNMS = nms;
         mSystemProperties = sp;
         mPrivateDnsMap = new HashMap<>();
         mPrivateDnsValidationMap = new HashMap<>();

         // TODO: Create and register ContentObservers to track every setting
         // used herein, posting messages to respond to changes.
     }

     public PrivateDnsConfig getPrivateDnsConfig() {
         return getPrivateDnsConfig(mContentResolver);
     }

     public void removeNetwork(Network network) {
         mPrivateDnsMap.remove(network.netId);
         mPrivateDnsValidationMap.remove(network.netId);
     }

     public PrivateDnsConfig updatePrivateDns(Network network, PrivateDnsConfig cfg) {
         Slog.w(TAG, "updatePrivateDns(" + network + ", " + cfg + ")");
         return (cfg != null)
                 ? mPrivateDnsMap.put(network.netId, cfg)
                 : mPrivateDnsMap.remove(network.netId);
     }

     public void updatePrivateDnsStatus(int netId, LinkProperties lp) {
         // Use the PrivateDnsConfig data pushed to this class instance
         // from ConnectivityService.
         final PrivateDnsConfig privateDnsCfg = mPrivateDnsMap.getOrDefault(netId,
                 PRIVATE_DNS_OFF);

         final boolean useTls = privateDnsCfg.useTls;
         final boolean strictMode = privateDnsCfg.inStrictMode();
         final String tlsHostname = strictMode ? privateDnsCfg.hostname : "";

         if (strictMode) {
             lp.setUsePrivateDns(true);
             lp.setPrivateDnsServerName(tlsHostname);
         } else if (useTls) {
             // We are in opportunistic mode. Private DNS should be used if there
             // is a known DNS-over-TLS validated server.
             boolean validated = mPrivateDnsValidationMap.containsKey(netId) &&
                     mPrivateDnsValidationMap.get(netId).hasValidatedServer();
             lp.setUsePrivateDns(validated);
             lp.setPrivateDnsServerName(null);
         } else {
             // Private DNS is disabled.
             lp.setUsePrivateDns(false);
             lp.setPrivateDnsServerName(null);
         }
     }

     public void updatePrivateDnsValidation(PrivateDnsValidationUpdate update) {
         final PrivateDnsValidationStatuses statuses =
                 mPrivateDnsValidationMap.get(update.netId);
         if (statuses == null) return;
         statuses.updateStatus(update);
     }

     public void setDnsConfigurationForNetwork(
             int netId, LinkProperties lp, boolean isDefaultNetwork) {
         final String[] assignedServers = NetworkUtils.makeStrings(lp.getDnsServers());
         final String[] domainStrs = getDomainStrings(lp.getDomains());

         updateParametersSettings();
         final int[] params = { mSampleValidity, mSuccessThreshold, mMinSamples, mMaxSamples };

         // We only use the PrivateDnsConfig data pushed to this class instance
         // from ConnectivityService because it works in coordination with
         // NetworkMonitor to decide which networks need validation and runs the
         // blocking calls to resolve Private DNS strict mode hostnames.
         //
         // At this time we do not attempt to enable Private DNS on non-Internet
         // networks like IMS.
         final PrivateDnsConfig privateDnsCfg = mPrivateDnsMap.getOrDefault(netId,
                 PRIVATE_DNS_OFF);

         final boolean useTls = privateDnsCfg.useTls;
         final boolean strictMode = privateDnsCfg.inStrictMode();
         final String tlsHostname = strictMode ? privateDnsCfg.hostname : "";
         final String[] tlsServers =
                 strictMode ? NetworkUtils.makeStrings(
                         Arrays.stream(privateDnsCfg.ips)
                               .filter((ip) -> lp.isReachable(ip))
                               .collect(Collectors.toList()))
                 : useTls ? assignedServers  // Opportunistic
                 : new String[0];            // Off

         // Prepare to track the validation status of the DNS servers in the
         // resolver config when private DNS is in opportunistic or strict mode.
         if (useTls) {
             if (!mPrivateDnsValidationMap.containsKey(netId)) {
                 mPrivateDnsValidationMap.put(netId, new PrivateDnsValidationStatuses());
             }
             mPrivateDnsValidationMap.get(netId).updateTrackedDnses(tlsServers, tlsHostname);
         } else {
             mPrivateDnsValidationMap.remove(netId);
         }

         Slog.d(TAG, String.format("setDnsConfigurationForNetwork(%d, %s, %s, %s, %s, %s)",
                 netId, Arrays.toString(assignedServers), Arrays.toString(domainStrs),
                 Arrays.toString(params), tlsHostname, Arrays.toString(tlsServers)));
         try {
             mNMS.setDnsConfigurationForNetwork(
                     netId, assignedServers, domainStrs, params, tlsHostname, tlsServers);
         } catch (Exception e) {
             Slog.e(TAG, "Error setting DNS configuration: " + e);
             return;
         }

         // TODO: netd should listen on [::1]:53 and proxy queries to the current
         // default network, and we should just set net.dns1 to ::1, not least
         // because applications attempting to use net.dns resolvers will bypass
         // the privacy protections of things like DNS-over-TLS.
         if (isDefaultNetwork) setDefaultDnsSystemProperties(lp.getDnsServers());
         flushVmDnsCache();
     }

     public void setDefaultDnsSystemProperties(Collection<InetAddress> dnses) {
         int last = 0;
         for (InetAddress dns : dnses) {
             ++last;
             setNetDnsProperty(last, dns.getHostAddress());
         }
         for (int i = last + 1; i <= mNumDnsEntries; ++i) {
             setNetDnsProperty(i, "");
         }
         mNumDnsEntries = last;
     }

     private void flushVmDnsCache() {
         /*
          * Tell the VMs to toss their DNS caches
          */
         final Intent intent = new Intent(Intent.ACTION_CLEAR_DNS_CACHE);
         intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
         /*
          * Connectivity events can happen before boot has completed ...
          */
         intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT);
         final long ident = Binder.clearCallingIdentity();
         try {
             mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
         } finally {
             Binder.restoreCallingIdentity(ident);
         }
     }

     private void updateParametersSettings() {
         mSampleValidity = getIntSetting(
                 DNS_RESOLVER_SAMPLE_VALIDITY_SECONDS,
                 DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS);
         if (mSampleValidity < 0 || mSampleValidity > 65535) {
             Slog.w(TAG, "Invalid sampleValidity=" + mSampleValidity + ", using default=" +
                     DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS);
             mSampleValidity = DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS;
         }

         mSuccessThreshold = getIntSetting(
                 DNS_RESOLVER_SUCCESS_THRESHOLD_PERCENT,
                 DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT);
         if (mSuccessThreshold < 0 || mSuccessThreshold > 100) {
             Slog.w(TAG, "Invalid successThreshold=" + mSuccessThreshold + ", using default=" +
                     DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT);
             mSuccessThreshold = DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT;
         }

         mMinSamples = getIntSetting(DNS_RESOLVER_MIN_SAMPLES, DNS_RESOLVER_DEFAULT_MIN_SAMPLES);
         mMaxSamples = getIntSetting(DNS_RESOLVER_MAX_SAMPLES, DNS_RESOLVER_DEFAULT_MAX_SAMPLES);
         if (mMinSamples < 0 || mMinSamples > mMaxSamples || mMaxSamples > 64) {
             Slog.w(TAG, "Invalid sample count (min, max)=(" + mMinSamples + ", " + mMaxSamples +
                     "), using default=(" + DNS_RESOLVER_DEFAULT_MIN_SAMPLES + ", " +
                     DNS_RESOLVER_DEFAULT_MAX_SAMPLES + ")");
             mMinSamples = DNS_RESOLVER_DEFAULT_MIN_SAMPLES;
             mMaxSamples = DNS_RESOLVER_DEFAULT_MAX_SAMPLES;
         }
     }

     private int getIntSetting(String which, int dflt) {
         return Settings.Global.getInt(mContentResolver, which, dflt);
     }

     private void setNetDnsProperty(int which, String value) {
         final String key = "net.dns" + which;
         // Log and forget errors setting unsupported properties.
         try {
             mSystemProperties.set(key, value);
         } catch (Exception e) {
             Slog.e(TAG, "Error setting unsupported net.dns property: ", e);
         }
     }

     private static String getPrivateDnsMode(ContentResolver cr) {
         final String mode = getStringSetting(cr, PRIVATE_DNS_MODE);
         return !TextUtils.isEmpty(mode) ? mode : PRIVATE_DNS_DEFAULT_MODE;
     }

     private static String getStringSetting(ContentResolver cr, String which) {
         return Settings.Global.getString(cr, which);
     }

     private static String[] getDomainStrings(String domains) {
         return (TextUtils.isEmpty(domains)) ? new String[0] : domains.split(" ");
     }
 }
	/*
	* Copyright (C) 2018 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	package com.android.server.connectivity;

	import static android.net.ConnectivityManager.PRIVATE_DNS_DEFAULT_MODE;
	import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_OFF;
	import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_OPPORTUNISTIC;
	import static android.net.ConnectivityManager.PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
	import static android.provider.Settings.Global.DNS_RESOLVER_MIN_SAMPLES;
	import static android.provider.Settings.Global.DNS_RESOLVER_MAX_SAMPLES;
	import static android.provider.Settings.Global.DNS_RESOLVER_SAMPLE_VALIDITY_SECONDS;
	import static android.provider.Settings.Global.DNS_RESOLVER_SUCCESS_THRESHOLD_PERCENT;
	import static android.provider.Settings.Global.PRIVATE_DNS_MODE;
	import static android.provider.Settings.Global.PRIVATE_DNS_SPECIFIER;

	import android.content.ContentResolver;
	import android.content.Context;
	import android.content.Intent;
	import android.net.LinkProperties;
	import android.net.Network;
	import android.net.NetworkUtils;
	import android.net.Uri;
	import android.net.dns.ResolvUtil;
	import android.os.Binder;
	import android.os.INetworkManagementService;
	import android.os.UserHandle;
	import android.provider.Settings;
	import android.text.TextUtils;
	import android.util.Pair;
	import android.util.Slog;

	import com.android.server.connectivity.MockableSystemProperties;

	import java.net.InetAddress;
	import java.net.UnknownHostException;
	import java.util.Arrays;
	import java.util.Collection;
	import java.util.HashMap;
	import java.util.HashSet;
	import java.util.Iterator;
	import java.util.Map;
	import java.util.Objects;
	import java.util.stream.Collectors;
	import java.util.Set;
	import java.util.StringJoiner;


	/**
	* Encapsulate the management of DNS settings for networks.
	*
	* This class it NOT designed for concurrent access. Furthermore, all non-static
	* methods MUST be called from ConnectivityService's thread.
	*
	* [ Private DNS ]
	* The code handling Private DNS is spread across several components, but this
	* seems like the least bad place to collect all the observations.
	*
	* Private DNS handling and updating occurs in response to several different
	* events. Each is described here with its corresponding intended handling.
	*
	* [A] Event: A new network comes up.
	* Mechanics:
	* [1] ConnectivityService gets notifications from NetworkAgents.
	* [2] in updateNetworkInfo(), the first time the NetworkAgent goes into
	* into CONNECTED state, the Private DNS configuration is retrieved,
	* programmed, and strict mode hostname resolution (if applicable) is
	* enqueued in NetworkAgent's NetworkMonitor, via a call to
	* handlePerNetworkPrivateDnsConfig().
	* [3] Re-resolution of strict mode hostnames that fail to return any
	* IP addresses happens inside NetworkMonitor; it sends itself a
	* delayed CMD_EVALUATE_PRIVATE_DNS message in a simple backoff
	* schedule.
	* [4] Successfully resolved hostnames are sent to ConnectivityService
	* inside an EVENT_PRIVATE_DNS_CONFIG_RESOLVED message. The resolved
	* IP addresses are programmed into netd via:
	*
	* updatePrivateDns() -> updateDnses()
	*
	* both of which make calls into DnsManager.
	* [5] Upon a successful hostname resolution NetworkMonitor initiates a
	* validation attempt in the form of a lookup for a one-time hostname
	* that uses Private DNS.
	*
	* [B] Event: Private DNS settings are changed.
	* Mechanics:
	* [1] ConnectivityService gets notifications from its SettingsObserver.
	* [2] handlePrivateDnsSettingsChanged() is called, which calls
	* handlePerNetworkPrivateDnsConfig() and the process proceeds
	* as if from A.3 above.
	*
	* [C] Event: An application calls ConnectivityManager#reportBadNetwork().
	* Mechanics:
	* [1] NetworkMonitor is notified and initiates a reevaluation, which
	* always bypasses Private DNS.
	* [2] Once completed, NetworkMonitor checks if strict mode is in operation
	* and if so enqueues another evaluation of Private DNS, as if from
	* step A.5 above.
	*
	* @hide
	*/
	public class DnsManager {
	private static final String TAG = DnsManager.class.getSimpleName();
	private static final PrivateDnsConfig PRIVATE_DNS_OFF = new PrivateDnsConfig();

	/* Defaults for resolver parameters. */
	private static final int DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS = 1800;
	private static final int DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT = 25;
	private static final int DNS_RESOLVER_DEFAULT_MIN_SAMPLES = 8;
	private static final int DNS_RESOLVER_DEFAULT_MAX_SAMPLES = 64;

	public static class PrivateDnsConfig {
	public final boolean useTls;
	public final String hostname;
	public final InetAddress[] ips;

	public PrivateDnsConfig() {
	this(false);
	}

	public PrivateDnsConfig(boolean useTls) {
	this.useTls = useTls;
	this.hostname = "";
	this.ips = new InetAddress[0];
	}

	public PrivateDnsConfig(String hostname, InetAddress[] ips) {
	this.useTls = !TextUtils.isEmpty(hostname);
	this.hostname = useTls ? hostname : "";
	this.ips = (ips != null) ? ips : new InetAddress[0];
	}

	public PrivateDnsConfig(PrivateDnsConfig cfg) {
	useTls = cfg.useTls;
	hostname = cfg.hostname;
	ips = cfg.ips;
	}

	public boolean inStrictMode() {
	return useTls && !TextUtils.isEmpty(hostname);
	}

	public String toString() {
	return PrivateDnsConfig.class.getSimpleName() +
	"{" + useTls + ":" + hostname + "/" + Arrays.toString(ips) + "}";
	}
	}

	public static PrivateDnsConfig getPrivateDnsConfig(ContentResolver cr) {
	final String mode = getPrivateDnsMode(cr);

	final boolean useTls = !TextUtils.isEmpty(mode) && !PRIVATE_DNS_MODE_OFF.equals(mode);

	if (PRIVATE_DNS_MODE_PROVIDER_HOSTNAME.equals(mode)) {
	final String specifier = getStringSetting(cr, PRIVATE_DNS_SPECIFIER);
	return new PrivateDnsConfig(specifier, null);
	}

	return new PrivateDnsConfig(useTls);
	}

	public static PrivateDnsConfig tryBlockingResolveOf(Network network, String name) {
	try {
	final InetAddress[] ips = ResolvUtil.blockingResolveAllLocally(network, name);
	return new PrivateDnsConfig(name, ips);
	} catch (UnknownHostException uhe) {
	return new PrivateDnsConfig(name, null);
	}
	}

	public static Uri[] getPrivateDnsSettingsUris() {
	return new Uri[]{
	Settings.Global.getUriFor(PRIVATE_DNS_MODE),
	Settings.Global.getUriFor(PRIVATE_DNS_SPECIFIER),
	};
	}

	public static class PrivateDnsValidationUpdate {
	final public int netId;
	final public InetAddress ipAddress;
	final public String hostname;
	final public boolean validated;

	public PrivateDnsValidationUpdate(int netId, InetAddress ipAddress,
	String hostname, boolean validated) {
	this.netId = netId;
	this.ipAddress = ipAddress;
	this.hostname = hostname;
	this.validated = validated;
	}
	}

	private static class PrivateDnsValidationStatuses {
	enum ValidationStatus {
	IN_PROGRESS,
	FAILED,
	SUCCEEDED
	}

	// Validation statuses of <hostname, ipAddress> pairs for a single netId
	private Map<Pair<String, InetAddress>, ValidationStatus> mValidationMap;

	private PrivateDnsValidationStatuses() {
	mValidationMap = new HashMap<>();
	}

	private boolean hasValidatedServer() {
	for (ValidationStatus status : mValidationMap.values()) {
	if (status == ValidationStatus.SUCCEEDED) {
	return true;
	}
	}
	return false;
	}

	private void updateTrackedDnses(String[] ipAddresses, String hostname) {
	Set<Pair<String, InetAddress>> latestDnses = new HashSet<>();
	for (String ipAddress : ipAddresses) {
	try {
	latestDnses.add(new Pair(hostname,
	InetAddress.parseNumericAddress(ipAddress)));
	} catch (IllegalArgumentException e) {}
	}
	// Remove <hostname, ipAddress> pairs that should not be tracked.
	for (Iterator<Map.Entry<Pair<String, InetAddress>, ValidationStatus>> it =
	mValidationMap.entrySet().iterator(); it.hasNext(); ) {
	Map.Entry<Pair<String, InetAddress>, ValidationStatus> entry = it.next();
	if (!latestDnses.contains(entry.getKey())) {
	it.remove();
	}
	}
	// Add new <hostname, ipAddress> pairs that should be tracked.
	for (Pair<String, InetAddress> p : latestDnses) {
	if (!mValidationMap.containsKey(p)) {
	mValidationMap.put(p, ValidationStatus.IN_PROGRESS);
	}
	}
	}

	private void updateStatus(PrivateDnsValidationUpdate update) {
	Pair<String, InetAddress> p = new Pair(update.hostname,
	update.ipAddress);
	if (!mValidationMap.containsKey(p)) {
	return;
	}
	if (update.validated) {
	mValidationMap.put(p, ValidationStatus.SUCCEEDED);
	} else {
	mValidationMap.put(p, ValidationStatus.FAILED);
	}
	}
	}

	private final Context mContext;
	private final ContentResolver mContentResolver;
	private final INetworkManagementService mNMS;
	private final MockableSystemProperties mSystemProperties;
	// TODO: Replace these Maps with SparseArrays.
	private final Map<Integer, PrivateDnsConfig> mPrivateDnsMap;
	private final Map<Integer, PrivateDnsValidationStatuses> mPrivateDnsValidationMap;

	private int mNumDnsEntries;
	private int mSampleValidity;
	private int mSuccessThreshold;
	private int mMinSamples;
	private int mMaxSamples;
	private String mPrivateDnsMode;
	private String mPrivateDnsSpecifier;

	public DnsManager(Context ctx, INetworkManagementService nms, MockableSystemProperties sp) {
	mContext = ctx;
	mContentResolver = mContext.getContentResolver();
	mNMS = nms;
	mSystemProperties = sp;
	mPrivateDnsMap = new HashMap<>();
	mPrivateDnsValidationMap = new HashMap<>();

	// TODO: Create and register ContentObservers to track every setting
	// used herein, posting messages to respond to changes.
	}

	public PrivateDnsConfig getPrivateDnsConfig() {
	return getPrivateDnsConfig(mContentResolver);
	}

	public void removeNetwork(Network network) {
	mPrivateDnsMap.remove(network.netId);
	mPrivateDnsValidationMap.remove(network.netId);
	}

	public PrivateDnsConfig updatePrivateDns(Network network, PrivateDnsConfig cfg) {
	Slog.w(TAG, "updatePrivateDns(" + network + ", " + cfg + ")");
	return (cfg != null)
	? mPrivateDnsMap.put(network.netId, cfg)
	: mPrivateDnsMap.remove(network.netId);
	}

	public void updatePrivateDnsStatus(int netId, LinkProperties lp) {
	// Use the PrivateDnsConfig data pushed to this class instance
	// from ConnectivityService.
	final PrivateDnsConfig privateDnsCfg = mPrivateDnsMap.getOrDefault(netId,
	PRIVATE_DNS_OFF);

	final boolean useTls = privateDnsCfg.useTls;
	final boolean strictMode = privateDnsCfg.inStrictMode();
	final String tlsHostname = strictMode ? privateDnsCfg.hostname : "";

	if (strictMode) {
	lp.setUsePrivateDns(true);
	lp.setPrivateDnsServerName(tlsHostname);
	} else if (useTls) {
	// We are in opportunistic mode. Private DNS should be used if there
	// is a known DNS-over-TLS validated server.
	boolean validated = mPrivateDnsValidationMap.containsKey(netId) &&
	mPrivateDnsValidationMap.get(netId).hasValidatedServer();
	lp.setUsePrivateDns(validated);
	lp.setPrivateDnsServerName(null);
	} else {
	// Private DNS is disabled.
	lp.setUsePrivateDns(false);
	lp.setPrivateDnsServerName(null);
	}
	}

	public void updatePrivateDnsValidation(PrivateDnsValidationUpdate update) {
	final PrivateDnsValidationStatuses statuses =
	mPrivateDnsValidationMap.get(update.netId);
	if (statuses == null) return;
	statuses.updateStatus(update);
	}

	public void setDnsConfigurationForNetwork(
	int netId, LinkProperties lp, boolean isDefaultNetwork) {
	final String[] assignedServers = NetworkUtils.makeStrings(lp.getDnsServers());
	final String[] domainStrs = getDomainStrings(lp.getDomains());

	updateParametersSettings();
	final int[] params = { mSampleValidity, mSuccessThreshold, mMinSamples, mMaxSamples };

	// We only use the PrivateDnsConfig data pushed to this class instance
	// from ConnectivityService because it works in coordination with
	// NetworkMonitor to decide which networks need validation and runs the
	// blocking calls to resolve Private DNS strict mode hostnames.
	//
	// At this time we do not attempt to enable Private DNS on non-Internet
	// networks like IMS.
	final PrivateDnsConfig privateDnsCfg = mPrivateDnsMap.getOrDefault(netId,
	PRIVATE_DNS_OFF);

	final boolean useTls = privateDnsCfg.useTls;
	final boolean strictMode = privateDnsCfg.inStrictMode();
	final String tlsHostname = strictMode ? privateDnsCfg.hostname : "";
	final String[] tlsServers =
	strictMode ? NetworkUtils.makeStrings(
	Arrays.stream(privateDnsCfg.ips)
	.filter((ip) -> lp.isReachable(ip))
	.collect(Collectors.toList()))
	: useTls ? assignedServers // Opportunistic
	: new String[0]; // Off

	// Prepare to track the validation status of the DNS servers in the
	// resolver config when private DNS is in opportunistic or strict mode.
	if (useTls) {
	if (!mPrivateDnsValidationMap.containsKey(netId)) {
	mPrivateDnsValidationMap.put(netId, new PrivateDnsValidationStatuses());
	}
	mPrivateDnsValidationMap.get(netId).updateTrackedDnses(tlsServers, tlsHostname);
	} else {
	mPrivateDnsValidationMap.remove(netId);
	}

	Slog.d(TAG, String.format("setDnsConfigurationForNetwork(%d, %s, %s, %s, %s, %s)",
	netId, Arrays.toString(assignedServers), Arrays.toString(domainStrs),
	Arrays.toString(params), tlsHostname, Arrays.toString(tlsServers)));
	try {
	mNMS.setDnsConfigurationForNetwork(
	netId, assignedServers, domainStrs, params, tlsHostname, tlsServers);
	} catch (Exception e) {
	Slog.e(TAG, "Error setting DNS configuration: " + e);
	return;
	}

	// TODO: netd should listen on [::1]:53 and proxy queries to the current
	// default network, and we should just set net.dns1 to ::1, not least
	// because applications attempting to use net.dns resolvers will bypass
	// the privacy protections of things like DNS-over-TLS.
	if (isDefaultNetwork) setDefaultDnsSystemProperties(lp.getDnsServers());
	flushVmDnsCache();
	}

	public void setDefaultDnsSystemProperties(Collection<InetAddress> dnses) {
	int last = 0;
	for (InetAddress dns : dnses) {
	++last;
	setNetDnsProperty(last, dns.getHostAddress());
	}
	for (int i = last + 1; i <= mNumDnsEntries; ++i) {
	setNetDnsProperty(i, "");
	}
	mNumDnsEntries = last;
	}

	private void flushVmDnsCache() {
	/*
	* Tell the VMs to toss their DNS caches
	*/
	final Intent intent = new Intent(Intent.ACTION_CLEAR_DNS_CACHE);
	intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
	/*
	* Connectivity events can happen before boot has completed ...
	*/
	intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY_BEFORE_BOOT);
	final long ident = Binder.clearCallingIdentity();
	try {
	mContext.sendBroadcastAsUser(intent, UserHandle.ALL);
	} finally {
	Binder.restoreCallingIdentity(ident);
	}
	}

	private void updateParametersSettings() {
	mSampleValidity = getIntSetting(
	DNS_RESOLVER_SAMPLE_VALIDITY_SECONDS,
	DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS);
	if (mSampleValidity < 0 \|\| mSampleValidity > 65535) {
	Slog.w(TAG, "Invalid sampleValidity=" + mSampleValidity + ", using default=" +
	DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS);
	mSampleValidity = DNS_RESOLVER_DEFAULT_SAMPLE_VALIDITY_SECONDS;
	}

	mSuccessThreshold = getIntSetting(
	DNS_RESOLVER_SUCCESS_THRESHOLD_PERCENT,
	DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT);
	if (mSuccessThreshold < 0 \|\| mSuccessThreshold > 100) {
	Slog.w(TAG, "Invalid successThreshold=" + mSuccessThreshold + ", using default=" +
	DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT);
	mSuccessThreshold = DNS_RESOLVER_DEFAULT_SUCCESS_THRESHOLD_PERCENT;
	}

	mMinSamples = getIntSetting(DNS_RESOLVER_MIN_SAMPLES, DNS_RESOLVER_DEFAULT_MIN_SAMPLES);
	mMaxSamples = getIntSetting(DNS_RESOLVER_MAX_SAMPLES, DNS_RESOLVER_DEFAULT_MAX_SAMPLES);
	if (mMinSamples < 0 \|\| mMinSamples > mMaxSamples \|\| mMaxSamples > 64) {
	Slog.w(TAG, "Invalid sample count (min, max)=(" + mMinSamples + ", " + mMaxSamples +
	"), using default=(" + DNS_RESOLVER_DEFAULT_MIN_SAMPLES + ", " +
	DNS_RESOLVER_DEFAULT_MAX_SAMPLES + ")");
	mMinSamples = DNS_RESOLVER_DEFAULT_MIN_SAMPLES;
	mMaxSamples = DNS_RESOLVER_DEFAULT_MAX_SAMPLES;
	}
	}

	private int getIntSetting(String which, int dflt) {
	return Settings.Global.getInt(mContentResolver, which, dflt);
	}

	private void setNetDnsProperty(int which, String value) {
	final String key = "net.dns" + which;
	// Log and forget errors setting unsupported properties.
	try {
	mSystemProperties.set(key, value);
	} catch (Exception e) {
	Slog.e(TAG, "Error setting unsupported net.dns property: ", e);
	}
	}

	private static String getPrivateDnsMode(ContentResolver cr) {
	final String mode = getStringSetting(cr, PRIVATE_DNS_MODE);
	return !TextUtils.isEmpty(mode) ? mode : PRIVATE_DNS_DEFAULT_MODE;
	}

	private static String getStringSetting(ContentResolver cr, String which) {
	return Settings.Global.getString(cr, which);
	}

	private static String[] getDomainStrings(String domains) {
	return (TextUtils.isEmpty(domains)) ? new String[0] : domains.split(" ");
	}
	}