1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2 /* vim:set ts=4 sw=2 sts=2 et cin: */
3 /* This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
9 #include "nsCharSeparatedTokenizer.h"
10 #include "nsContentUtils.h"
11 #include "nsHttpHandler.h"
12 #include "nsHttpChannel.h"
13 #include "nsHostResolver.h"
14 #include "nsIHttpChannel.h"
15 #include "nsIHttpChannelInternal.h"
16 #include "nsIIOService.h"
17 #include "nsIInputStream.h"
18 #include "nsIObliviousHttp.h"
19 #include "nsISupports.h"
20 #include "nsISupportsUtils.h"
21 #include "nsITimedChannel.h"
22 #include "nsIUploadChannel2.h"
23 #include "nsIURIMutator.h"
24 #include "nsNetUtil.h"
25 #include "nsQueryObject.h"
26 #include "nsStringStream.h"
27 #include "nsThreadUtils.h"
28 #include "nsURLHelper.h"
29 #include "ObliviousHttpChannel.h"
31 #include "TRRService.h"
32 #include "TRRServiceChannel.h"
33 #include "TRRLoadInfo.h"
35 #include "mozilla/Base64.h"
36 #include "mozilla/DebugOnly.h"
37 #include "mozilla/Logging.h"
38 #include "mozilla/Preferences.h"
39 #include "mozilla/StaticPrefs_network.h"
40 #include "mozilla/Telemetry.h"
41 #include "mozilla/TimeStamp.h"
42 #include "mozilla/Tokenizer.h"
43 #include "mozilla/UniquePtr.h"
44 // Put DNSLogging.h at the end to avoid LOG being overwritten by other headers.
45 #include "DNSLogging.h"
46 #include "mozilla/glean/GleanMetrics.h"
51 NS_IMPL_ISUPPORTS(TRR
, nsIHttpPushListener
, nsIInterfaceRequestor
,
52 nsIStreamListener
, nsIRunnable
, nsITimerCallback
)
54 // when firing off a normal A or AAAA query
55 TRR::TRR(AHostResolver
* aResolver
, nsHostRecord
* aRec
, enum TrrType aType
)
56 : mozilla::Runnable("TRR"),
58 mHostResolver(aResolver
),
60 mOriginSuffix(aRec
->originSuffix
) {
63 MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess() || XRE_IsSocketProcess(),
64 "TRR must be in parent or socket process");
67 // when following CNAMEs
68 TRR::TRR(AHostResolver
* aResolver
, nsHostRecord
* aRec
, nsCString
& aHost
,
69 enum TrrType
& aType
, unsigned int aLoopCount
, bool aPB
)
70 : mozilla::Runnable("TRR"),
73 mHostResolver(aResolver
),
76 mCnameLoop(aLoopCount
),
77 mOriginSuffix(aRec
? aRec
->originSuffix
: ""_ns
) {
78 MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess() || XRE_IsSocketProcess(),
79 "TRR must be in parent or socket process");
83 TRR::TRR(AHostResolver
* aResolver
, bool aPB
)
84 : mozilla::Runnable("TRR"), mHostResolver(aResolver
), mPB(aPB
) {
85 MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess() || XRE_IsSocketProcess(),
86 "TRR must be in parent or socket process");
90 TRR::TRR(AHostResolver
* aResolver
, nsACString
& aHost
, enum TrrType aType
,
91 const nsACString
& aOriginSuffix
, bool aPB
, bool aUseFreshConnection
)
92 : mozilla::Runnable("TRR"),
95 mHostResolver(aResolver
),
98 mOriginSuffix(aOriginSuffix
),
99 mUseFreshConnection(aUseFreshConnection
) {
100 MOZ_DIAGNOSTIC_ASSERT(XRE_IsParentProcess() || XRE_IsSocketProcess(),
101 "TRR must be in parent or socket process");
104 void TRR::HandleTimeout() {
106 RecordReason(TRRSkippedReason::TRR_TIMEOUT
);
107 Cancel(NS_ERROR_NET_TIMEOUT_EXTERNAL
);
111 TRR::Notify(nsITimer
* aTimer
) {
112 if (aTimer
== mTimeout
) {
115 MOZ_CRASH("Unknown timer");
123 MOZ_ASSERT_IF(XRE_IsParentProcess() && TRRService::Get(),
124 NS_IsMainThread() || TRRService::Get()->IsOnTRRThread());
125 MOZ_ASSERT_IF(XRE_IsSocketProcess(), NS_IsMainThread());
127 if ((TRRService::Get() == nullptr) || NS_FAILED(SendHTTPRequest())) {
128 RecordReason(TRRSkippedReason::TRR_SEND_FAILED
);
129 FailData(NS_ERROR_FAILURE
);
130 // The dtor will now be run
135 DNSPacket
* TRR::GetOrCreateDNSPacket() {
137 mPacket
= MakeUnique
<DNSPacket
>();
140 return mPacket
.get();
143 nsresult
TRR::CreateQueryURI(nsIURI
** aOutURI
) {
145 nsCOMPtr
<nsIURI
> dnsURI
;
146 if (UseDefaultServer()) {
147 TRRService::Get()->GetURI(uri
);
149 uri
= mRec
->mTrrServer
;
152 nsresult rv
= NS_NewURI(getter_AddRefs(dnsURI
), uri
);
154 RecordReason(TRRSkippedReason::TRR_BAD_URL
);
158 dnsURI
.forget(aOutURI
);
162 bool TRR::MaybeBlockRequest() {
163 if (((mType
== TRRTYPE_A
) || (mType
== TRRTYPE_AAAA
)) &&
164 mRec
->mEffectiveTRRMode
!= nsIRequest::TRR_ONLY_MODE
) {
165 // let NS resolves skip the blocklist check
166 // we also don't check the blocklist for TRR only requests
169 // If TRRService isn't enabled anymore for the req, don't do TRR.
170 if (!TRRService::Get()->Enabled(mRec
->mEffectiveTRRMode
)) {
171 RecordReason(TRRSkippedReason::TRR_MODE_NOT_ENABLED
);
175 if (!StaticPrefs::network_trr_strict_native_fallback() &&
176 UseDefaultServer() &&
177 TRRService::Get()->IsTemporarilyBlocked(mHost
, mOriginSuffix
, mPB
,
179 if (mType
== TRRTYPE_A
) {
180 // count only blocklist for A records to avoid double counts
181 Telemetry::Accumulate(Telemetry::DNS_TRR_BLACKLISTED3
,
182 TRRService::ProviderKey(), true);
185 RecordReason(TRRSkippedReason::TRR_HOST_BLOCKED_TEMPORARY
);
186 // not really an error but no TRR is issued
190 if (TRRService::Get()->IsExcludedFromTRR(mHost
)) {
191 RecordReason(TRRSkippedReason::TRR_EXCLUDED
);
195 if (UseDefaultServer() && (mType
== TRRTYPE_A
)) {
196 Telemetry::Accumulate(Telemetry::DNS_TRR_BLACKLISTED3
,
197 TRRService::ProviderKey(), false);
204 nsresult
TRR::SendHTTPRequest() {
205 // This is essentially the "run" method - created from nsHostResolver
207 return NS_ERROR_FAILURE
;
210 if ((mType
!= TRRTYPE_A
) && (mType
!= TRRTYPE_AAAA
) &&
211 (mType
!= TRRTYPE_NS
) && (mType
!= TRRTYPE_TXT
) &&
212 (mType
!= TRRTYPE_HTTPSSVC
)) {
213 // limit the calling interface because nsHostResolver has explicit slots for
215 return NS_ERROR_FAILURE
;
218 if (MaybeBlockRequest()) {
219 return NS_ERROR_UNKNOWN_HOST
;
222 LOG(("TRR::SendHTTPRequest resolve %s type %u\n", mHost
.get(), mType
));
225 bool disableECS
= StaticPrefs::network_trr_disable_ECS();
227 GetOrCreateDNSPacket()->EncodeRequest(body
, mHost
, mType
, disableECS
);
229 HandleEncodeError(rv
);
233 bool useGet
= StaticPrefs::network_trr_useGET();
234 nsCOMPtr
<nsIURI
> dnsURI
;
235 rv
= CreateQueryURI(getter_AddRefs(dnsURI
));
237 LOG(("TRR:SendHTTPRequest: NewURI failed!\n"));
242 /* For GET requests, the outgoing packet needs to be Base64url-encoded and
243 then appended to the end of the URI. */
244 nsAutoCString encoded
;
245 rv
= Base64URLEncode(body
.Length(),
246 reinterpret_cast<const unsigned char*>(body
.get()),
247 Base64URLEncodePaddingPolicy::Omit
, encoded
);
248 NS_ENSURE_SUCCESS(rv
, rv
);
251 rv
= dnsURI
->GetQuery(query
);
256 if (query
.IsEmpty()) {
257 query
.Assign("?dns="_ns
);
259 query
.Append("&dns="_ns
);
261 query
.Append(encoded
);
263 rv
= NS_MutateURI(dnsURI
).SetQuery(query
).Finalize(dnsURI
);
264 LOG(("TRR::SendHTTPRequest GET dns=%s\n", body
.get()));
267 nsCOMPtr
<nsIChannel
> channel
;
268 bool useOHTTP
= StaticPrefs::network_trr_use_ohttp();
270 nsCOMPtr
<nsIObliviousHttpService
> ohttpService(
271 do_GetService("@mozilla.org/network/oblivious-http-service;1"));
273 return NS_ERROR_FAILURE
;
275 nsCOMPtr
<nsIURI
> relayURI
;
276 nsTArray
<uint8_t> encodedConfig
;
277 rv
= ohttpService
->GetTRRSettings(getter_AddRefs(relayURI
), encodedConfig
);
282 return NS_ERROR_FAILURE
;
284 rv
= ohttpService
->NewChannel(relayURI
, dnsURI
, encodedConfig
,
285 getter_AddRefs(channel
));
287 rv
= DNSUtils::CreateChannelHelper(dnsURI
, getter_AddRefs(channel
));
289 if (NS_FAILED(rv
) || !channel
) {
290 LOG(("TRR:SendHTTPRequest: NewChannel failed!\n"));
294 auto loadFlags
= nsIRequest::LOAD_ANONYMOUS
| nsIRequest::INHIBIT_CACHING
|
295 nsIRequest::LOAD_BYPASS_CACHE
|
296 nsIChannel::LOAD_BYPASS_URL_CLASSIFIER
;
297 if (mUseFreshConnection
) {
298 // Causes TRRServiceChannel to tell the connection manager
299 // to clear out any connection with the current conn info.
300 loadFlags
|= nsIRequest::LOAD_FRESH_CONNECTION
;
302 channel
->SetLoadFlags(loadFlags
);
303 NS_ENSURE_SUCCESS(rv
, rv
);
305 rv
= channel
->SetNotificationCallbacks(this);
306 NS_ENSURE_SUCCESS(rv
, rv
);
308 nsCOMPtr
<nsIHttpChannel
> httpChannel
= do_QueryInterface(channel
);
310 return NS_ERROR_UNEXPECTED
;
313 // This connection should not use TRR
314 rv
= httpChannel
->SetTRRMode(nsIRequest::TRR_DISABLED_MODE
);
315 NS_ENSURE_SUCCESS(rv
, rv
);
317 nsCString
contentType(ContentType());
318 rv
= httpChannel
->SetRequestHeader("Accept"_ns
, contentType
, false);
319 NS_ENSURE_SUCCESS(rv
, rv
);
322 if (UseDefaultServer()) {
323 TRRService::Get()->GetCredentials(cred
);
325 if (!cred
.IsEmpty()) {
326 rv
= httpChannel
->SetRequestHeader("Authorization"_ns
, cred
, false);
327 NS_ENSURE_SUCCESS(rv
, rv
);
330 nsCOMPtr
<nsIHttpChannelInternal
> internalChannel
= do_QueryInterface(channel
);
331 if (!internalChannel
) {
332 return NS_ERROR_UNEXPECTED
;
335 // setting a small stream window means the h2 stack won't pipeline a window
336 // update with each HEADERS or reply to a DATA with a WINDOW UPDATE
337 rv
= internalChannel
->SetInitialRwin(127 * 1024);
338 NS_ENSURE_SUCCESS(rv
, rv
);
339 rv
= internalChannel
->SetIsTRRServiceChannel(true);
340 NS_ENSURE_SUCCESS(rv
, rv
);
342 if (UseDefaultServer() && StaticPrefs::network_trr_async_connInfo()) {
343 RefPtr
<nsHttpConnectionInfo
> trrConnInfo
=
344 TRRService::Get()->TRRConnectionInfo();
347 dnsURI
->GetHost(host
);
348 if (host
.Equals(trrConnInfo
->GetOrigin())) {
349 internalChannel
->SetConnectionInfo(trrConnInfo
);
350 LOG(("TRR::SendHTTPRequest use conn info:%s\n",
351 trrConnInfo
->HashKey().get()));
353 MOZ_DIAGNOSTIC_ASSERT(false);
356 TRRService::Get()->InitTRRConnectionInfo();
361 rv
= httpChannel
->SetRequestMethod("GET"_ns
);
362 NS_ENSURE_SUCCESS(rv
, rv
);
364 nsCOMPtr
<nsIUploadChannel2
> uploadChannel
= do_QueryInterface(httpChannel
);
365 if (!uploadChannel
) {
366 return NS_ERROR_UNEXPECTED
;
368 uint32_t streamLength
= body
.Length();
369 nsCOMPtr
<nsIInputStream
> uploadStream
;
371 NS_NewCStringInputStream(getter_AddRefs(uploadStream
), std::move(body
));
372 NS_ENSURE_SUCCESS(rv
, rv
);
374 rv
= uploadChannel
->ExplicitSetUploadStream(uploadStream
, contentType
,
375 streamLength
, "POST"_ns
, false);
376 NS_ENSURE_SUCCESS(rv
, rv
);
379 rv
= SetupTRRServiceChannelInternal(httpChannel
, useGet
, contentType
);
384 rv
= httpChannel
->AsyncOpen(this);
389 // If the asyncOpen succeeded we can say that we actually attempted to
390 // use the TRR connection.
391 RefPtr
<AddrHostRecord
> addrRec
= do_QueryObject(mRec
);
393 addrRec
->mResolverType
= ResolverType();
396 NS_NewTimerWithCallback(
397 getter_AddRefs(mTimeout
), this,
398 mTimeoutMs
? mTimeoutMs
: TRRService::Get()->GetRequestTimeout(),
399 nsITimer::TYPE_ONE_SHOT
);
406 nsresult
TRR::SetupTRRServiceChannelInternal(nsIHttpChannel
* aChannel
,
408 const nsACString
& aContentType
) {
409 nsCOMPtr
<nsIHttpChannel
> httpChannel
= aChannel
;
410 MOZ_ASSERT(httpChannel
);
415 httpChannel
->SetRequestHeader("Cache-Control"_ns
, "no-store"_ns
, false);
416 NS_ENSURE_SUCCESS(rv
, rv
);
419 // Sanitize the request by removing the Accept-Language header so we minimize
420 // the amount of fingerprintable information we send to the server.
421 if (!StaticPrefs::network_trr_send_accept_language_headers()) {
422 rv
= httpChannel
->SetRequestHeader("Accept-Language"_ns
, ""_ns
, false);
423 NS_ENSURE_SUCCESS(rv
, rv
);
426 // Sanitize the request by removing the User-Agent
427 if (!StaticPrefs::network_trr_send_user_agent_headers()) {
428 rv
= httpChannel
->SetRequestHeader("User-Agent"_ns
, ""_ns
, false);
429 NS_ENSURE_SUCCESS(rv
, rv
);
432 if (StaticPrefs::network_trr_send_empty_accept_encoding_headers()) {
433 rv
= httpChannel
->SetEmptyRequestHeader("Accept-Encoding"_ns
);
434 NS_ENSURE_SUCCESS(rv
, rv
);
437 // set the *default* response content type
438 if (NS_FAILED(httpChannel
->SetContentType(aContentType
))) {
439 LOG(("TRR::SetupTRRServiceChannelInternal: couldn't set content-type!\n"));
442 nsCOMPtr
<nsITimedChannel
> timedChan(do_QueryInterface(httpChannel
));
444 timedChan
->SetTimingEnabled(true);
451 TRR::GetInterface(const nsIID
& iid
, void** result
) {
452 if (!iid
.Equals(NS_GET_IID(nsIHttpPushListener
))) {
453 return NS_ERROR_NO_INTERFACE
;
456 nsCOMPtr
<nsIHttpPushListener
> copy(this);
457 *result
= copy
.forget().take();
461 nsresult
TRR::DohDecodeQuery(const nsCString
& query
, nsCString
& host
,
462 enum TrrType
& type
) {
463 FallibleTArray
<uint8_t> binary
;
464 bool found_dns
= false;
465 LOG(("TRR::DohDecodeQuery %s!\n", query
.get()));
467 // extract "dns=" from the query string
469 for (const nsACString
& token
:
470 nsCCharSeparatedTokenizer(query
, '&').ToRange()) {
471 nsDependentCSubstring dns
= Substring(token
, 0, 4);
472 nsAutoCString
check(dns
);
473 if (check
.Equals("dns=")) {
474 nsDependentCSubstring q
= Substring(token
, 4, -1);
481 LOG(("TRR::DohDecodeQuery no dns= in pushed URI query string\n"));
482 return NS_ERROR_ILLEGAL_VALUE
;
486 Base64URLDecode(data
, Base64URLDecodePaddingPolicy::Ignore
, binary
);
487 NS_ENSURE_SUCCESS(rv
, rv
);
488 uint32_t avail
= binary
.Length();
490 return NS_ERROR_FAILURE
;
492 // check the query bit and the opcode
493 if ((binary
[2] & 0xf8) != 0) {
494 return NS_ERROR_FAILURE
;
496 uint32_t qdcount
= (binary
[4] << 8) + binary
[5];
498 return NS_ERROR_FAILURE
;
505 if (avail
< (index
+ 1)) {
506 return NS_ERROR_UNEXPECTED
;
509 length
= binary
[index
];
514 if (avail
< (index
+ 1 + length
)) {
515 return NS_ERROR_UNEXPECTED
;
517 host
.Append((const char*)(&binary
[0]) + index
+ 1, length
);
519 index
+= 1 + length
; // skip length byte + label
522 LOG(("TRR::DohDecodeQuery host %s\n", host
.get()));
524 if (avail
< (index
+ 2)) {
525 return NS_ERROR_UNEXPECTED
;
528 i16
+= binary
[index
] << 8;
529 i16
+= binary
[index
+ 1];
530 type
= (enum TrrType
)i16
;
532 LOG(("TRR::DohDecodeQuery type %d\n", (int)type
));
537 nsresult
TRR::ReceivePush(nsIHttpChannel
* pushed
, nsHostRecord
* pushedRec
) {
538 if (!mHostResolver
) {
539 return NS_ERROR_UNEXPECTED
;
542 LOG(("TRR::ReceivePush: PUSH incoming!\n"));
544 nsCOMPtr
<nsIURI
> uri
;
545 pushed
->GetURI(getter_AddRefs(uri
));
548 uri
->GetQuery(query
);
551 if (NS_FAILED(DohDecodeQuery(query
, mHost
, mType
)) ||
552 HostIsIPLiteral(mHost
)) { // literal
553 LOG(("TRR::ReceivePush failed to decode %s\n", mHost
.get()));
554 return NS_ERROR_UNEXPECTED
;
557 if ((mType
!= TRRTYPE_A
) && (mType
!= TRRTYPE_AAAA
) &&
558 (mType
!= TRRTYPE_TXT
) && (mType
!= TRRTYPE_HTTPSSVC
)) {
559 LOG(("TRR::ReceivePush unknown type %d\n", mType
));
560 return NS_ERROR_UNEXPECTED
;
563 if (TRRService::Get()->IsExcludedFromTRR(mHost
)) {
564 return NS_ERROR_FAILURE
;
567 uint32_t type
= nsIDNSService::RESOLVE_TYPE_DEFAULT
;
568 if (mType
== TRRTYPE_TXT
) {
569 type
= nsIDNSService::RESOLVE_TYPE_TXT
;
570 } else if (mType
== TRRTYPE_HTTPSSVC
) {
571 type
= nsIDNSService::RESOLVE_TYPE_HTTPSSVC
;
574 RefPtr
<nsHostRecord
> hostRecord
;
576 rv
= mHostResolver
->GetHostRecord(
577 mHost
, ""_ns
, type
, pushedRec
->flags
, pushedRec
->af
, pushedRec
->pb
,
578 pushedRec
->originSuffix
, getter_AddRefs(hostRecord
));
583 // Since we don't ever call nsHostResolver::NameLookup for this record,
584 // we need to copy the trr mode from the previous record
585 if (hostRecord
->mEffectiveTRRMode
== nsIRequest::TRR_DEFAULT_MODE
) {
586 hostRecord
->mEffectiveTRRMode
=
587 static_cast<nsIRequest::TRRMode
>(pushedRec
->mEffectiveTRRMode
);
590 rv
= mHostResolver
->TrrLookup_unlocked(hostRecord
, this);
595 rv
= pushed
->AsyncOpen(this);
602 mRec
.swap(hostRecord
);
608 TRR::OnPush(nsIHttpChannel
* associated
, nsIHttpChannel
* pushed
) {
609 LOG(("TRR::OnPush entry\n"));
610 MOZ_ASSERT(associated
== mChannel
);
612 return NS_ERROR_FAILURE
;
614 if (!UseDefaultServer()) {
615 return NS_ERROR_FAILURE
;
618 RefPtr
<TRR
> trr
= new TRR(mHostResolver
, mPB
);
619 trr
->SetPurpose(mPurpose
);
620 return trr
->ReceivePush(pushed
, mRec
);
624 TRR::OnStartRequest(nsIRequest
* aRequest
) {
625 LOG(("TRR::OnStartRequest %p %s %d\n", this, mHost
.get(), mType
));
627 nsresult status
= NS_OK
;
628 aRequest
->GetStatus(&status
);
630 if (NS_FAILED(status
)) {
631 if (NS_IsOffline()) {
632 RecordReason(TRRSkippedReason::TRR_IS_OFFLINE
);
636 case NS_ERROR_UNKNOWN_HOST
:
637 RecordReason(TRRSkippedReason::TRR_CHANNEL_DNS_FAIL
);
639 case NS_ERROR_OFFLINE
:
640 RecordReason(TRRSkippedReason::TRR_IS_OFFLINE
);
642 case NS_ERROR_NET_RESET
:
643 RecordReason(TRRSkippedReason::TRR_NET_RESET
);
645 case NS_ERROR_NET_TIMEOUT
:
646 case NS_ERROR_NET_TIMEOUT_EXTERNAL
:
647 RecordReason(TRRSkippedReason::TRR_NET_TIMEOUT
);
649 case NS_ERROR_PROXY_CONNECTION_REFUSED
:
650 RecordReason(TRRSkippedReason::TRR_NET_REFUSED
);
652 case NS_ERROR_NET_INTERRUPT
:
653 RecordReason(TRRSkippedReason::TRR_NET_INTERRUPT
);
655 case NS_ERROR_NET_INADEQUATE_SECURITY
:
656 RecordReason(TRRSkippedReason::TRR_NET_INADEQ_SEQURITY
);
659 RecordReason(TRRSkippedReason::TRR_UNKNOWN_CHANNEL_FAILURE
);
666 void TRR::SaveAdditionalRecords(
667 const nsClassHashtable
<nsCStringHashKey
, DOHresp
>& aRecords
) {
672 for (const auto& recordEntry
: aRecords
) {
673 if (!recordEntry
.GetData() || recordEntry
.GetData()->mAddresses
.IsEmpty()) {
674 // no point in adding empty records.
677 // If IPv6 is disabled don't add anything else than IPv4.
678 if (StaticPrefs::network_dns_disableIPv6() &&
679 std::find_if(recordEntry
.GetData()->mAddresses
.begin(),
680 recordEntry
.GetData()->mAddresses
.end(),
681 [](const NetAddr
& addr
) { return !addr
.IsIPAddrV4(); }) !=
682 recordEntry
.GetData()->mAddresses
.end()) {
685 RefPtr
<nsHostRecord
> hostRecord
;
686 rv
= mHostResolver
->GetHostRecord(
687 recordEntry
.GetKey(), EmptyCString(),
688 nsIDNSService::RESOLVE_TYPE_DEFAULT
, mRec
->flags
, AF_UNSPEC
, mRec
->pb
,
689 mRec
->originSuffix
, getter_AddRefs(hostRecord
));
691 LOG(("Failed to get host record for additional record %s",
692 nsCString(recordEntry
.GetKey()).get()));
696 new AddrInfo(recordEntry
.GetKey(), ResolverType(), TRRTYPE_A
,
697 std::move(recordEntry
.GetData()->mAddresses
),
698 recordEntry
.GetData()->mTtl
));
699 mHostResolver
->MaybeRenewHostRecord(hostRecord
);
701 // Since we're not actually calling NameLookup for this record, we need
702 // to set these fields to avoid assertions in CompleteLookup.
703 // This is quite hacky, and should be fixed.
705 hostRecord
->mResolving
++;
706 hostRecord
->mEffectiveTRRMode
=
707 static_cast<nsIRequest::TRRMode
>(mRec
->mEffectiveTRRMode
);
708 LOG(("Completing lookup for additional: %s",
709 nsCString(recordEntry
.GetKey()).get()));
710 (void)mHostResolver
->CompleteLookup(hostRecord
, NS_OK
, ai
, mPB
,
711 mOriginSuffix
, TRRSkippedReason::TRR_OK
,
716 void TRR::StoreIPHintAsDNSRecord(const struct SVCB
& aSVCBRecord
) {
717 LOG(("TRR::StoreIPHintAsDNSRecord [%p] [%s]", this,
718 aSVCBRecord
.mSvcDomainName
.get()));
719 CopyableTArray
<NetAddr
> addresses
;
720 aSVCBRecord
.GetIPHints(addresses
);
722 if (StaticPrefs::network_dns_disableIPv6()) {
723 addresses
.RemoveElementsBy(
724 [](const NetAddr
& addr
) { return !addr
.IsIPAddrV4(); });
727 if (addresses
.IsEmpty()) {
731 RefPtr
<nsHostRecord
> hostRecord
;
732 nsresult rv
= mHostResolver
->GetHostRecord(
733 aSVCBRecord
.mSvcDomainName
, EmptyCString(),
734 nsIDNSService::RESOLVE_TYPE_DEFAULT
,
735 mRec
->flags
| nsIDNSService::RESOLVE_IP_HINT
, AF_UNSPEC
, mRec
->pb
,
736 mRec
->originSuffix
, getter_AddRefs(hostRecord
));
738 LOG(("Failed to get host record"));
742 mHostResolver
->MaybeRenewHostRecord(hostRecord
);
744 RefPtr
<AddrInfo
> ai(new AddrInfo(aSVCBRecord
.mSvcDomainName
, ResolverType(),
745 TRRTYPE_A
, std::move(addresses
), mTTL
));
747 // Since we're not actually calling NameLookup for this record, we need
748 // to set these fields to avoid assertions in CompleteLookup.
749 // This is quite hacky, and should be fixed.
750 hostRecord
->mResolving
++;
751 hostRecord
->mEffectiveTRRMode
=
752 static_cast<nsIRequest::TRRMode
>(mRec
->mEffectiveTRRMode
);
753 (void)mHostResolver
->CompleteLookup(hostRecord
, NS_OK
, ai
, mPB
, mOriginSuffix
,
754 TRRSkippedReason::TRR_OK
, this);
757 nsresult
TRR::ReturnData(nsIChannel
* aChannel
) {
758 if (mType
!= TRRTYPE_TXT
&& mType
!= TRRTYPE_HTTPSSVC
) {
759 // create and populate an AddrInfo instance to pass on
760 RefPtr
<AddrInfo
> ai(new AddrInfo(mHost
, ResolverType(), mType
,
761 nsTArray
<NetAddr
>(), mDNS
.mTtl
));
762 auto builder
= ai
->Build();
763 builder
.SetAddresses(std::move(mDNS
.mAddresses
));
764 builder
.SetCanonicalHostname(mCname
);
767 nsCOMPtr
<nsITimedChannel
> timedChan
= do_QueryInterface(aChannel
);
769 TimeStamp asyncOpen
, start
, end
;
770 if (NS_SUCCEEDED(timedChan
->GetAsyncOpen(&asyncOpen
)) &&
771 !asyncOpen
.IsNull()) {
772 builder
.SetTrrFetchDuration(
773 (TimeStamp::Now() - asyncOpen
).ToMilliseconds());
775 if (NS_SUCCEEDED(timedChan
->GetRequestStart(&start
)) &&
776 NS_SUCCEEDED(timedChan
->GetResponseEnd(&end
)) && !start
.IsNull() &&
778 builder
.SetTrrFetchDurationNetworkOnly((end
- start
).ToMilliseconds());
781 ai
= builder
.Finish();
783 if (!mHostResolver
) {
784 return NS_ERROR_FAILURE
;
786 RecordReason(TRRSkippedReason::TRR_OK
);
787 (void)mHostResolver
->CompleteLookup(mRec
, NS_OK
, ai
, mPB
, mOriginSuffix
,
788 mTRRSkippedReason
, this);
789 mHostResolver
= nullptr;
792 RecordReason(TRRSkippedReason::TRR_OK
);
793 (void)mHostResolver
->CompleteLookupByType(mRec
, NS_OK
, mResult
,
794 mTRRSkippedReason
, mTTL
, mPB
);
799 nsresult
TRR::FailData(nsresult error
) {
800 if (!mHostResolver
) {
801 return NS_ERROR_FAILURE
;
804 // If we didn't record a reason until now, record a default one.
805 RecordReason(TRRSkippedReason::TRR_FAILED
);
807 if (mType
== TRRTYPE_TXT
|| mType
== TRRTYPE_HTTPSSVC
) {
808 TypeRecordResultType
empty(Nothing
{});
809 (void)mHostResolver
->CompleteLookupByType(mRec
, error
, empty
,
810 mTRRSkippedReason
, 0, mPB
);
812 // create and populate an TRR AddrInfo instance to pass on to signal that
813 // this comes from TRR
814 nsTArray
<NetAddr
> noAddresses
;
815 RefPtr
<AddrInfo
> ai
=
816 new AddrInfo(mHost
, ResolverType(), mType
, std::move(noAddresses
));
818 (void)mHostResolver
->CompleteLookup(mRec
, error
, ai
, mPB
, mOriginSuffix
,
819 mTRRSkippedReason
, this);
822 mHostResolver
= nullptr;
827 void TRR::HandleDecodeError(nsresult aStatusCode
) {
828 auto rcode
= mPacket
->GetRCode();
829 if (rcode
.isOk() && rcode
.unwrap() != 0) {
830 if (rcode
.unwrap() == 0x03) {
831 RecordReason(TRRSkippedReason::TRR_NXDOMAIN
);
833 RecordReason(TRRSkippedReason::TRR_RCODE_FAIL
);
835 } else if (aStatusCode
== NS_ERROR_UNKNOWN_HOST
||
836 aStatusCode
== NS_ERROR_DEFINITIVE_UNKNOWN_HOST
) {
837 RecordReason(TRRSkippedReason::TRR_NO_ANSWERS
);
839 RecordReason(TRRSkippedReason::TRR_DECODE_FAILED
);
843 bool TRR::HasUsableResponse() {
844 if (mType
== TRRTYPE_A
|| mType
== TRRTYPE_AAAA
) {
845 return !mDNS
.mAddresses
.IsEmpty();
847 if (mType
== TRRTYPE_TXT
) {
848 return mResult
.is
<TypeRecordTxt
>();
850 if (mType
== TRRTYPE_HTTPSSVC
) {
851 return mResult
.is
<TypeRecordHTTPSSVC
>();
856 nsresult
TRR::FollowCname(nsIChannel
* aChannel
) {
859 while (NS_SUCCEEDED(rv
) && mDNS
.mAddresses
.IsEmpty() && !mCname
.IsEmpty() &&
862 LOG(("TRR::On200Response CNAME %s => %s (%u)\n", mHost
.get(), mCname
.get(),
867 LOG(("TRR: check for CNAME record for %s within previous response\n",
869 nsClassHashtable
<nsCStringHashKey
, DOHresp
> additionalRecords
;
870 rv
= GetOrCreateDNSPacket()->Decode(
871 cname
, mType
, mCname
, StaticPrefs::network_trr_allow_rfc1918(), mDNS
,
872 mResult
, additionalRecords
, mTTL
);
874 LOG(("TRR::FollowCname DohDecode %x\n", (int)rv
));
875 HandleDecodeError(rv
);
879 // restore mCname as DohDecode() change it
881 if (NS_SUCCEEDED(rv
) && HasUsableResponse()) {
882 ReturnData(aChannel
);
886 bool ra
= mPacket
&& mPacket
->RecursionAvailable().unwrapOr(false);
887 LOG(("ra = %d", ra
));
888 if (rv
== NS_ERROR_UNKNOWN_HOST
&& ra
) {
889 // If recursion is available, but no addresses have been returned,
890 // we can just return a failure here.
891 LOG(("TRR::FollowCname not sending another request as RA flag is set."));
892 FailData(NS_ERROR_UNKNOWN_HOST
);
897 LOG(("TRR::On200Response CNAME loop, eject!\n"));
898 return NS_ERROR_REDIRECT_LOOP
;
901 LOG(("TRR::On200Response CNAME %s => %s (%u)\n", mHost
.get(), mCname
.get(),
904 new TRR(mHostResolver
, mRec
, mCname
, mType
, mCnameLoop
, mPB
);
905 trr
->SetPurpose(mPurpose
);
906 if (!TRRService::Get()) {
907 return NS_ERROR_FAILURE
;
909 return TRRService::Get()->DispatchTRRRequest(trr
);
912 nsresult
TRR::On200Response(nsIChannel
* aChannel
) {
913 // decode body and create an AddrInfo struct for the response
914 nsClassHashtable
<nsCStringHashKey
, DOHresp
> additionalRecords
;
915 RefPtr
<TypeHostRecord
> typeRec
= do_QueryObject(mRec
);
916 if (typeRec
&& typeRec
->mOriginHost
) {
917 GetOrCreateDNSPacket()->SetOriginHost(typeRec
->mOriginHost
);
919 nsresult rv
= GetOrCreateDNSPacket()->Decode(
920 mHost
, mType
, mCname
, StaticPrefs::network_trr_allow_rfc1918(), mDNS
,
921 mResult
, additionalRecords
, mTTL
);
923 LOG(("TRR::On200Response DohDecode %x\n", (int)rv
));
924 HandleDecodeError(rv
);
927 if (StaticPrefs::network_trr_add_additional_records()) {
928 SaveAdditionalRecords(additionalRecords
);
931 if (mResult
.is
<TypeRecordHTTPSSVC
>()) {
932 auto& results
= mResult
.as
<TypeRecordHTTPSSVC
>();
933 for (const auto& rec
: results
) {
934 StoreIPHintAsDNSRecord(rec
);
938 if (!mDNS
.mAddresses
.IsEmpty() || mType
== TRRTYPE_TXT
|| mCname
.IsEmpty()) {
939 // pass back the response data
940 ReturnData(aChannel
);
944 LOG(("TRR::On200Response trying CNAME %s", mCname
.get()));
945 return FollowCname(aChannel
);
948 void TRR::RecordProcessingTime(nsIChannel
* aChannel
) {
949 // This method records the time it took from the last received byte of the
950 // DoH response until we've notified the consumer with a host record.
951 nsCOMPtr
<nsITimedChannel
> timedChan
= do_QueryInterface(aChannel
);
956 if (NS_FAILED(timedChan
->GetResponseEnd(&end
))) {
964 Telemetry::AccumulateTimeDelta(Telemetry::DNS_TRR_PROCESSING_TIME
, end
);
966 LOG(("Processing DoH response took %f ms",
967 (TimeStamp::Now() - end
).ToMilliseconds()));
970 void TRR::ReportStatus(nsresult aStatusCode
) {
971 // If the TRR was cancelled by nsHostResolver, then we don't need to report
972 // it as failed; otherwise it can cause the confirmation to fail.
973 if (UseDefaultServer() && aStatusCode
!= NS_ERROR_ABORT
) {
974 // Bad content is still considered "okay" if the HTTP response is okay
975 TRRService::Get()->RecordTRRStatus(this);
979 static void RecordHttpVersion(nsIHttpChannel
* aHttpChannel
) {
980 nsCOMPtr
<nsIHttpChannelInternal
> internalChannel
=
981 do_QueryInterface(aHttpChannel
);
982 if (!internalChannel
) {
983 LOG(("RecordHttpVersion: Failed to QI nsIHttpChannelInternal"));
987 uint32_t major
, minor
;
988 if (NS_FAILED(internalChannel
->GetResponseVersion(&major
, &minor
))) {
989 LOG(("RecordHttpVersion: Failed to get protocol version"));
993 auto label
= Telemetry::LABELS_DNS_TRR_HTTP_VERSION2::h_1
;
995 label
= Telemetry::LABELS_DNS_TRR_HTTP_VERSION2::h_2
;
996 } else if (major
== 3) {
997 label
= Telemetry::LABELS_DNS_TRR_HTTP_VERSION2::h_3
;
1000 Telemetry::AccumulateCategoricalKeyed(TRRService::ProviderKey(), label
);
1002 LOG(("RecordHttpVersion: Provider responded using HTTP version: %d", major
));
1006 TRR::OnStopRequest(nsIRequest
* aRequest
, nsresult aStatusCode
) {
1007 // The dtor will be run after the function returns
1008 LOG(("TRR:OnStopRequest %p %s %d failed=%d code=%X\n", this, mHost
.get(),
1009 mType
, mFailed
, (unsigned int)aStatusCode
));
1010 nsCOMPtr
<nsIChannel
> channel
;
1011 channel
.swap(mChannel
);
1013 mChannelStatus
= aStatusCode
;
1014 if (NS_SUCCEEDED(aStatusCode
)) {
1015 nsCString label
= "regular"_ns
;
1017 label
= "private"_ns
;
1019 mozilla::glean::networking::trr_request_count
.Get(label
).Add(1);
1023 // Cancel the timer since we don't need it anymore.
1024 nsCOMPtr
<nsITimer
> timer
;
1025 mTimeout
.swap(timer
);
1031 auto scopeExit
= MakeScopeExit([&] { ReportStatus(aStatusCode
); });
1033 nsresult rv
= NS_OK
;
1034 // if status was "fine", parse the response and pass on the answer
1035 if (!mFailed
&& NS_SUCCEEDED(aStatusCode
)) {
1036 nsCOMPtr
<nsIHttpChannel
> httpChannel
= do_QueryInterface(aRequest
);
1038 return NS_ERROR_UNEXPECTED
;
1040 nsAutoCString contentType
;
1041 httpChannel
->GetContentType(contentType
);
1042 if (contentType
.Length() &&
1043 !contentType
.LowerCaseEqualsASCII(ContentType())) {
1044 LOG(("TRR:OnStopRequest %p %s %d wrong content type %s\n", this,
1045 mHost
.get(), mType
, contentType
.get()));
1046 FailData(NS_ERROR_UNEXPECTED
);
1050 uint32_t httpStatus
;
1051 rv
= httpChannel
->GetResponseStatus(&httpStatus
);
1052 if (NS_SUCCEEDED(rv
) && httpStatus
== 200) {
1053 rv
= On200Response(channel
);
1054 if (NS_SUCCEEDED(rv
) && UseDefaultServer()) {
1055 RecordReason(TRRSkippedReason::TRR_OK
);
1056 RecordProcessingTime(channel
);
1057 RecordHttpVersion(httpChannel
);
1061 RecordReason(TRRSkippedReason::TRR_SERVER_RESPONSE_ERR
);
1062 LOG(("TRR:OnStopRequest:%d %p rv %x httpStatus %d\n", __LINE__
, this,
1063 (int)rv
, httpStatus
));
1067 LOG(("TRR:OnStopRequest %p status %x mFailed %d\n", this, (int)aStatusCode
,
1069 FailData(NS_SUCCEEDED(rv
) ? NS_ERROR_UNKNOWN_HOST
: rv
);
1074 TRR::OnDataAvailable(nsIRequest
* aRequest
, nsIInputStream
* aInputStream
,
1075 uint64_t aOffset
, const uint32_t aCount
) {
1076 LOG(("TRR:OnDataAvailable %p %s %d failed=%d aCount=%u\n", this, mHost
.get(),
1077 mType
, mFailed
, (unsigned int)aCount
));
1078 // receive DNS response into the local buffer
1080 return NS_ERROR_FAILURE
;
1083 nsresult rv
= GetOrCreateDNSPacket()->OnDataAvailable(aRequest
, aInputStream
,
1085 if (NS_FAILED(rv
)) {
1086 LOG(("TRR::OnDataAvailable:%d fail\n", __LINE__
));
1093 void TRR::Cancel(nsresult aStatus
) {
1094 bool isTRRServiceChannel
= false;
1095 nsCOMPtr
<nsIHttpChannelInternal
> httpChannelInternal(
1096 do_QueryInterface(mChannel
));
1097 if (httpChannelInternal
) {
1099 httpChannelInternal
->GetIsTRRServiceChannel(&isTRRServiceChannel
);
1100 if (NS_FAILED(rv
)) {
1101 isTRRServiceChannel
= false;
1104 // nsHttpChannel can be only canceled on the main thread.
1105 RefPtr
<nsHttpChannel
> httpChannel
= do_QueryObject(mChannel
);
1106 if (isTRRServiceChannel
&& !XRE_IsSocketProcess() && !httpChannel
) {
1107 if (TRRService::Get()) {
1108 nsCOMPtr
<nsIThread
> thread
= TRRService::Get()->TRRThread();
1109 if (thread
&& !thread
->IsOnCurrentThread()) {
1110 thread
->Dispatch(NS_NewRunnableFunction(
1112 [self
= RefPtr(this), aStatus
]() { self
->Cancel(aStatus
); }));
1117 if (!NS_IsMainThread()) {
1118 NS_DispatchToMainThread(NS_NewRunnableFunction(
1120 [self
= RefPtr(this), aStatus
]() { self
->Cancel(aStatus
); }));
1131 RecordReason(TRRSkippedReason::TRR_REQ_CANCELLED
);
1132 LOG(("TRR: %p canceling Channel %p %s %d status=%" PRIx32
"\n", this,
1133 mChannel
.get(), mHost
.get(), mType
, static_cast<uint32_t>(aStatus
)));
1134 mChannel
->Cancel(aStatus
);
1138 bool TRR::UseDefaultServer() { return !mRec
|| mRec
->mTrrServer
.IsEmpty(); }
1141 } // namespace mozilla