6155674102

Committed 12 Sep 2023 06:20AM UTC coverage: 81.002% (+0.01%) from 80.991%

Build # 6155674102

Build Type

Pull #1249

github

Committed by

bassosimone

Commit Message

refactor(netxlite): use *Netx for the system dialer

This diff is like https://github.com/ooni/probe-cli/commit/7224984b3
except that we are converting the system dialer constructors to
use *Netx rather than converting the system resolver.

While there, realize that DialerSystem could become private.

Part of https://github.com/ooni/probe/issues/2531

Pull Request Pull Request #1249: refactor(netxlite): use *Netx for the system dialer

Run Details

7 of 7 new or added lines in 1 file covered. (100.0%)

5 existing lines in 1 file now uncovered.

22321 of 27556 relevant lines covered (81.0%)

44.66 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

82.43

/internal/experiment/webconnectivitylte/analysisdns.go

package webconnectivitylte

//
// DNS analysis
//

import (
        "net"
        "net/url"

        "github.com/ooni/probe-cli/v3/internal/model"
        "github.com/ooni/probe-cli/v3/internal/netxlite"
)

const (
        // AnalysisDNSBogon indicates we got any bogon reply
        AnalysisDNSBogon = 1 << iota

        // AnalysisDNSUnexpectedFailure indicates the TH could
        // resolve a domain while the probe couldn't
        AnalysisDNSUnexpectedFailure

        // AnalysisDNSUnexpectedAddrs indicates the TH resolved
        // different addresses from the probe
        AnalysisDNSUnexpectedAddrs
)

// analysisDNSToplevel is the toplevel analysis function for DNS results.
//
// Note: this function DOES NOT consider failed DNS-over-HTTPS (DoH) submeasurements
// and ONLY considers the IP addrs they have resolved. Failing to contact a DoH service
// provides info about such a DoH service rather than on the measured URL. See the
// https://github.com/ooni/probe/issues/2274 issue for more info.
//
// The goals of this function are the following:
//
// 1. Set the legacy .DNSExperimentFailure field to the failure value of the
// first DNS query that failed among the ones we actually tried. Because we
// have multiple queries, unfortunately we are forced to pick one error among
// possibly many to assign to this field. This is why I consider it legacy.
//
// 2. Compute the XDNSFlags value.
//
// From the XDNSFlags value, we determine, in turn DNSConsistency and
// XBlockingFlags according to the following decision table:
//
//        +-----------+----------------+---------------------+
//        | XDNSFlags | DNSConsistency | XBlockingFlags      |
//        +-----------+----------------+---------------------+
//        | 0         | "consistent"   | no change           |
//        +-----------+----------------+---------------------+
//        | nonzero   | "inconsistent" | set FlagDNSBlocking |
//        +-----------+----------------+---------------------+
//
// We explain how XDNSFlags is determined in the documentation of
// the functions that this function calls to do its job.
func (tk *TestKeys) analysisDNSToplevel(logger model.Logger, lookupper model.GeoIPASNLookupper) {
        tk.analysisDNSExperimentFailure()
        tk.analysisDNSBogon(logger)
        tk.analysisDNSDuplicateResponses(logger)
        tk.analysisDNSUnexpectedFailure(logger)
        tk.analysisDNSUnexpectedAddrs(logger, lookupper)
        if tk.DNSFlags != 0 {
                logger.Warn("DNSConsistency: inconsistent")
                tk.DNSConsistency = "inconsistent"
                tk.BlockingFlags |= analysisFlagDNSBlocking
        } else {
                logger.Info("DNSConsistency: consistent")
                tk.DNSConsistency = "consistent"
        }
}

// analysisDNSDuplicateResponses checks whether we received duplicate
// replies for DNS-over-UDP queries, which is very unexpected.
func (tk *TestKeys) analysisDNSDuplicateResponses(logger model.Logger) {
        if length := len(tk.DNSDuplicateResponses); length > 0 {
                // TODO(bassosimone): write algorithm to analyze this
                logger.Warnf("DNS: got %d unexpected late/duplicate DNS responses", length)
        }
}

// analysisDNSExperimentFailure sets the legacy DNSExperimentFailure field.
func (tk *TestKeys) analysisDNSExperimentFailure() {
        for _, query := range tk.Queries {
                if fail := query.Failure; fail != nil {
                        if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {
                                // maybe this heuristic could be further improved by checking
                                // whether the TH did actually see any IPv6 address?
                                continue
                        }
                        if query.Engine == "doh" {
                                // we SHOULD NOT flag DoH failures _because_ they pertain to the
                                // DoH service rather than to the input URL
                                //
                                // See https://github.com/ooni/probe/issues/2274
                                continue
                        }
                        tk.DNSExperimentFailure = fail
                        return
                }
        }
}

// analysisDNSBogon computes the AnalysisDNSBogon flag. We set this flag if
// we dectect any bogon in the .Queries field of the TestKeys.
func (tk *TestKeys) analysisDNSBogon(logger model.Logger) {
        for _, query := range tk.Queries {
                // Implementation note: any bogon IP address resolved by a DoH service
                // is STILL suspicious since it should not happen. TODO(bassosimone): an
                // even better algorithm could possibly check whether also the TH has
                // observed bogon IP addrs and avoid flagging in such a case.
                //
                // See https://github.com/ooni/probe/issues/2274
                for _, answer := range query.Answers {
                        switch answer.AnswerType {
                        case "A":
                                if net.ParseIP(answer.IPv4) != nil && netxlite.IsBogon(answer.IPv4) {
                                        logger.Warnf(
                                                "DNS: got BOGON answer %s for domain %s (see #%d)",
                                                answer.IPv4,
                                                query.Hostname,
                                                query.TransactionID,
                                        )
                                        tk.DNSFlags |= AnalysisDNSBogon
                                        // continue processing so we print all the bogons we have
                                }
                        case "AAAA":
                                if net.ParseIP(answer.IPv6) != nil && netxlite.IsBogon(answer.IPv6) {
                                        logger.Warnf(
                                                "DNS: got BOGON answer %s for domain %s (see #%d)",
                                                answer.IPv6,
                                                query.Hostname,
                                                query.TransactionID,
                                        )
                                        tk.DNSFlags |= AnalysisDNSBogon
                                        // continue processing so we print all the bogons we have
                                }
                        default:
                                // nothing
                        }
                }
        }
}

// analysisDNSUnexpectedFailure computes the AnalysisDNSUnexpectedFailure flags. We say
// a failure is unexpected when the TH could resolve a domain and the probe couldn't.
func (tk *TestKeys) analysisDNSUnexpectedFailure(logger model.Logger) {
        // make sure we have control before proceeding futher
        if tk.Control == nil || tk.ControlRequest == nil {
                return
        }

        // obtain thRequest and thResponse as shortcuts
        thRequest := tk.ControlRequest
        thResponse := tk.Control

        // obtain the domain that the TH has queried for
        URL, err := url.Parse(thRequest.HTTPRequest)
        if err != nil {
                return // this looks like a bug
        }
        domain := URL.Hostname()

        // we obviously don't care if the domain was an IP adddress
        if net.ParseIP(domain) != nil {
                return
        }

        // if the control didn't lookup any IP addresses our job here is done
        // because we can't say whether we have unexpected failures
        hasAddrs := len(thResponse.DNS.Addrs) > 0
        if !hasAddrs {
                return
        }

        // with TH-resolved addrs, any local query _for the same domain_ queried
        // by the probe that contains an error is suspicious
        for _, query := range tk.Queries {
                if domain != query.Hostname {
                        continue // not the domain queried by the test helper
                }
                if query.Engine == "doh" {
                        // As mentioned above, a DoH failure is not information about
                        // the URL we're measuring but about the DoH service being blocked.
                        //
                        // See https://github.com/ooni/probe/issues/2274
                        continue
                }
                hasAddrs := false
        Loop:
                for _, answer := range query.Answers {
                        switch answer.AnswerType {
                        case "A", "AAA":
                                hasAddrs = true
                                break Loop
                        }
                }
                if hasAddrs {
                        // if the lookup returned any IP address, we are
                        // not dealing with unexpected failures
                        continue
                }
                if query.Failure == nil {
                        // we expect to see a failure if we don't see
                        // answers, so this seems a bug?
                        continue
                }
                if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {
                        // maybe this heuristic could be further improved by checking
                        // whether the TH did actually see any IPv6 address?
                        continue
                }
                logger.Warnf("DNS: unexpected failure %s in #%d", *query.Failure, query.TransactionID)
                tk.DNSFlags |= AnalysisDNSUnexpectedFailure
                // continue processing so we print all the unexpected failures

                // TODO(https://github.com/ooni/probe/issues/2029#issuecomment-1411716295): we need
                // to ensure we correctly handle the android_dns_cache_no_data case.
        }
}

// analysisDNSUnexpectedAddrs computes the AnalysisDNSUnexpectedAddrs flags. This
// algorithm builds upon the original DNSDiff algorithm by introducing an additional
// TLS based heuristic for determining whether an IP address was legit.
func (tk *TestKeys) analysisDNSUnexpectedAddrs(
        logger model.Logger,
        lookupper model.GeoIPASNLookupper,
) {
        // make sure we have control before proceeding futher
        if tk.Control == nil || tk.ControlRequest == nil {
                return
        }

        // obtain thRequest and thResponse as shortcuts
        thRequest := tk.ControlRequest
        thResponse := tk.Control

        // obtain the domain that the TH has queried for
        URL, err := url.Parse(thRequest.HTTPRequest)
        if err != nil {
                return // this looks like a bug
        }
        domain := URL.Hostname()

        // we obviously don't care if the domain was an IP adddress
        if net.ParseIP(domain) != nil {
                return
        }

        // if the control didn't resolve any IP address, then we basically
        // cannot run this algorithm at all
        thAddrs := thResponse.DNS.Addrs
        if len(thAddrs) <= 0 {
                return
        }

        // gather all the IP addresses queried by the probe
        // for the same domain for which the TH queried.
        var probeAddrs []string
        for _, query := range tk.Queries {
                if domain != query.Hostname {
                        continue // not the domain the TH queried for
                }
                // Implementation note: in the case in which DoH returned answers, here
                // it still feels okay to consider them. We should avoid flagging DoH
                // failures as measurement failures but if DoH returns us some unexpected
                // even-non-bogon addr, it seems worth flagging for now.
                //
                // See https://github.com/ooni/probe/issues/2274
                for _, answer := range query.Answers {
                        switch answer.AnswerType {
                        case "A":
                                probeAddrs = append(probeAddrs, answer.IPv4)
                        case "AAAA":
                                probeAddrs = append(probeAddrs, answer.IPv6)
                        }
                }
        }

        // if the probe has not collected any addr for the same domain, it's
        // definitely suspicious and counts as a difference
        if len(probeAddrs) <= 0 {
                logger.Warnf("DNS: the probe did not resolve any IP address")
                tk.DNSFlags |= AnalysisDNSUnexpectedAddrs
                return
        }

        // if there are no different addresses between the probe and the TH then
        // our job here is done and we can just stop searching
        differentAddrs := tk.analysisDNSDiffAddrs(probeAddrs, thAddrs)
        if len(differentAddrs) <= 0 {
                return
        }
        for _, addr := range differentAddrs {
                logger.Infof("DNS: address %s: not resolved by TH", addr)
        }

        // now, let's exclude the differentAddrs for which we successfully
        // completed a TLS handshake: those should be good addrs
        withoutHandshake := tk.findAddrsWithoutTLSHandshake(domain, differentAddrs)
        if len(withoutHandshake) <= 0 {
                return
        }
        for _, addr := range withoutHandshake {
                logger.Infof("DNS: address %s: cannot confirm using TLS handshake", addr)
        }

        // as a last resort, accept the addresses without an handshake whose
        // ASN overlaps with ASNs resolved by the TH
        differentASNs := tk.analysisDNSDiffASN(logger, withoutHandshake, thAddrs, lookupper)
        if len(differentASNs) <= 0 {
                return
        }

        // otherwise, conclude we have unexpected probe addrs
        for addr, asn := range differentASNs {
                logger.Warnf(
                        "DNS: address %s has unexpected AS%d and we cannot use TLS to confirm it",
                        addr, asn,
                )
        }
        tk.DNSFlags |= AnalysisDNSUnexpectedAddrs
}

// analysisDNSDiffAddrs returns all the IP addresses that are
// resolved by the probe but not by the test helper.
func (tk *TestKeys) analysisDNSDiffAddrs(probeAddrs, thAddrs []string) (diff []string) {
        const (
                inProbe = 1 << iota
                inTH
        )
        mapping := make(map[string]int)
        for _, addr := range probeAddrs {
                if net.ParseIP(addr) != nil && netxlite.IsBogon(addr) {
                        // we can exclude bogons from the analysis because we already analyzed them
                        continue
                }
                mapping[addr] |= inProbe
        }
        for _, addr := range thAddrs {
                mapping[addr] = inTH
        }
        for addr, where := range mapping {
                if (where & inTH) == 0 {
                        diff = append(diff, addr)
                }
        }
        return
}

// analysisDNSDiffASN returns whether there are IP addresses in the probe's
// list with different ASNs from the ones in the TH's list.
func (tk *TestKeys) analysisDNSDiffASN(
        logger model.Logger,
        probeAddrs,
        thAddrs []string,
        lookupper model.GeoIPASNLookupper,
) (result map[string]uint) {
        const (
                inProbe = 1 << iota
                inTH
        )
        logger.Debugf("DNS: probeAddrs %+v, thAddrs %+v", probeAddrs, thAddrs)
        uniqueAddrs := make(map[string]uint)
        asnToFlags := make(map[uint]int)
        for _, addr := range probeAddrs {
                asn, _, _ := lookupper.LookupASN(addr)
                asnToFlags[asn] |= inProbe // including the zero ASN that means unknown
                uniqueAddrs[addr] = asn
        }
        for _, addr := range thAddrs {
                asn, _, _ := lookupper.LookupASN(addr)
                asnToFlags[asn] |= inTH // including the zero ASN that means unknown
                uniqueAddrs[addr] = asn
        }
        for addr, asn := range uniqueAddrs {
                logger.Infof("DNS: addr %s has AS%d", addr, asn)
        }
        probeOnlyASNs := make(map[uint]bool)
        for asn, where := range asnToFlags {
                if (where & inTH) == 0 {
                        probeOnlyASNs[asn] = true
                }
        }
        for asn := range probeOnlyASNs {
                logger.Infof("DNS: AS%d: only seen by probe", asn)
        }
        result = make(map[string]uint)
        for addr, asn := range uniqueAddrs {
                if probeOnlyASNs[asn] {
                        result[addr] = asn
                }
        }
        return
}

// findAddrsWithoutTLSHandshake computes the list of probe discovered [addresses]
// for which we couldn't successfully perform a TLS handshake for the given [domain].
func (tk *TestKeys) findAddrsWithoutTLSHandshake(domain string, addresses []string) (output []string) {
        const (
                resolvedByProbe = 1 << iota
                handshakeOK
                hasObviousIPv6Issues
        )
        mapping := make(map[string]int)

        // fill the input map with the addresses we're interested to analyze
        for _, addr := range addresses {
                mapping[addr] = 0
        }

        // flag the subset of addresses resolved by the probe
        for _, query := range tk.Queries {
                for _, answer := range query.Answers {
                        var addr string
                        switch answer.AnswerType {
                        case "A":
                                addr = answer.IPv4
                        case "AAAA":
                                addr = answer.IPv6
                        default:
                                continue
                        }
                        if _, found := mapping[addr]; !found {
                                continue // we're not interested into this addr
                        }
                        mapping[addr] |= resolvedByProbe
                }
        }

        // flag the subset of addrs with obvious IPv6 issues
        //
        // see https://github.com/ooni/probe/issues/2284 for more
        // info on why we need to flag them
        for _, connect := range tk.TCPConnect {
                failure := connect.Status.Failure
                if failure == nil {
                        continue // if we can connect, we don't have IPv6 issues
                }
                ipv6, err := netxlite.IsIPv6(connect.IP)
                if err != nil {
                        continue // looks like a bug
                }
                if !ipv6 {
                        continue // not IPv6
                }
                hasIssues := (*failure == netxlite.FailureNetworkUnreachable ||
                        *failure == netxlite.FailureHostUnreachable)
                if hasIssues {
                        mapping[connect.IP] |= hasObviousIPv6Issues
                }
        }

        // flag the subset of addrs with successful handshake for the right SNI
        for _, thx := range tk.TLSHandshakes {
                addr, _, err := net.SplitHostPort(thx.Address)
                if err != nil {
                        continue // looks like a bug
                }
                if thx.Failure != nil {
                        continue // this handshake failed
                }
                if _, found := mapping[addr]; !found {
                        continue // we're not interested into this addr
                }
                if thx.ServerName != domain {
                        continue // the SNI is different, so...
                }
                mapping[addr] |= handshakeOK
        }

        // compute the list of addresses without the handshakeOK flag
        // excluding though the ones with obvious IPv6 issues
        for addr, flags := range mapping {
                if flags == 0 {
                        continue // this looks like a bug
                }
                if (flags & hasObviousIPv6Issues) != 0 {
                        continue // see https://github.com/ooni/probe/issues/2284
                }
                if (flags & (resolvedByProbe | handshakeOK)) == resolvedByProbe {
                        output = append(output, addr)
                }
        }
        return
}

1	package webconnectivitylte
2
3	//
4	// DNS analysis
5	//
6
7	import (
8	"net"
9	"net/url"
10
11	"github.com/ooni/probe-cli/v3/internal/model"
12	"github.com/ooni/probe-cli/v3/internal/netxlite"
13	)
14
15	const (
16	// AnalysisDNSBogon indicates we got any bogon reply
17	AnalysisDNSBogon = 1 << iota
18
19	// AnalysisDNSUnexpectedFailure indicates the TH could
20	// resolve a domain while the probe couldn't
21	AnalysisDNSUnexpectedFailure
22
23	// AnalysisDNSUnexpectedAddrs indicates the TH resolved
24	// different addresses from the probe
25	AnalysisDNSUnexpectedAddrs
26	)
27
28	// analysisDNSToplevel is the toplevel analysis function for DNS results.
29	//
30	// Note: this function DOES NOT consider failed DNS-over-HTTPS (DoH) submeasurements
31	// and ONLY considers the IP addrs they have resolved. Failing to contact a DoH service
32	// provides info about such a DoH service rather than on the measured URL. See the
33	// https://github.com/ooni/probe/issues/2274 issue for more info.
34	//
35	// The goals of this function are the following:
36	//
37	// 1. Set the legacy .DNSExperimentFailure field to the failure value of the
38	// first DNS query that failed among the ones we actually tried. Because we
39	// have multiple queries, unfortunately we are forced to pick one error among
40	// possibly many to assign to this field. This is why I consider it legacy.
41	//
42	// 2. Compute the XDNSFlags value.
43	//
44	// From the XDNSFlags value, we determine, in turn DNSConsistency and
45	// XBlockingFlags according to the following decision table:
46	//
47	// +-----------+----------------+---------------------+
48	// \| XDNSFlags \| DNSConsistency \| XBlockingFlags \|
49	// +-----------+----------------+---------------------+
50	// \| 0 \| "consistent" \| no change \|
51	// +-----------+----------------+---------------------+
52	// \| nonzero \| "inconsistent" \| set FlagDNSBlocking \|
53	// +-----------+----------------+---------------------+
54	//
55	// We explain how XDNSFlags is determined in the documentation of
56	// the functions that this function calls to do its job.
57	func (tk *TestKeys) analysisDNSToplevel(logger model.Logger, lookupper model.GeoIPASNLookupper) {	11✔
58	tk.analysisDNSExperimentFailure()	11✔
59	tk.analysisDNSBogon(logger)	11✔
60	tk.analysisDNSDuplicateResponses(logger)	11✔
61	tk.analysisDNSUnexpectedFailure(logger)	11✔
62	tk.analysisDNSUnexpectedAddrs(logger, lookupper)	11✔
63	if tk.DNSFlags != 0 {	16✔
64	logger.Warn("DNSConsistency: inconsistent")	5✔
65	tk.DNSConsistency = "inconsistent"	5✔
66	tk.BlockingFlags \|= analysisFlagDNSBlocking	5✔
67	} else {	11✔
68	logger.Info("DNSConsistency: consistent")	6✔
69	tk.DNSConsistency = "consistent"	6✔
70	}	6✔
71	}
72
73	// analysisDNSDuplicateResponses checks whether we received duplicate
74	// replies for DNS-over-UDP queries, which is very unexpected.
75	func (tk *TestKeys) analysisDNSDuplicateResponses(logger model.Logger) {	11✔
76	if length := len(tk.DNSDuplicateResponses); length > 0 {	13✔
77	// TODO(bassosimone): write algorithm to analyze this	2✔
78	logger.Warnf("DNS: got %d unexpected late/duplicate DNS responses", length)	2✔
79	}	2✔
80	}
81
82	// analysisDNSExperimentFailure sets the legacy DNSExperimentFailure field.
83	func (tk *TestKeys) analysisDNSExperimentFailure() {	11✔
84	for _, query := range tk.Queries {	46✔
85	if fail := query.Failure; fail != nil {	48✔
86	if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {	23✔
87	// maybe this heuristic could be further improved by checking	10✔
88	// whether the TH did actually see any IPv6 address?	10✔
89	continue	10✔
90	}
91	if query.Engine == "doh" {	3✔
UNCOV 92	// we SHOULD NOT flag DoH failures _because_ they pertain to the	×
UNCOV 93	// DoH service rather than to the input URL	×
UNCOV 94	//	×
UNCOV 95	// See https://github.com/ooni/probe/issues/2274	×
UNCOV 96	continue	×
97	}
98	tk.DNSExperimentFailure = fail	3✔
99	return	3✔
100	}
101	}
102	}
103
104	// analysisDNSBogon computes the AnalysisDNSBogon flag. We set this flag if
105	// we dectect any bogon in the .Queries field of the TestKeys.
106	func (tk *TestKeys) analysisDNSBogon(logger model.Logger) {	11✔
107	for _, query := range tk.Queries {	52✔
108	// Implementation note: any bogon IP address resolved by a DoH service	41✔
109	// is STILL suspicious since it should not happen. TODO(bassosimone): an	41✔
110	// even better algorithm could possibly check whether also the TH has	41✔
111	// observed bogon IP addrs and avoid flagging in such a case.	41✔
112	//	41✔
113	// See https://github.com/ooni/probe/issues/2274	41✔
114	for _, answer := range query.Answers {	89✔
115	switch answer.AnswerType {	48✔
116	case "A":	37✔
117	if net.ParseIP(answer.IPv4) != nil && netxlite.IsBogon(answer.IPv4) {	37✔
118	logger.Warnf(	×
119	"DNS: got BOGON answer %s for domain %s (see #%d)",	×
120	answer.IPv4,	×
121	query.Hostname,	×
122	query.TransactionID,	×
123	)	×
124	tk.DNSFlags \|= AnalysisDNSBogon	×
125	// continue processing so we print all the bogons we have	×
126	}	×
127	case "AAAA":	8✔
128	if net.ParseIP(answer.IPv6) != nil && netxlite.IsBogon(answer.IPv6) {	8✔
129	logger.Warnf(	×
130	"DNS: got BOGON answer %s for domain %s (see #%d)",	×
131	answer.IPv6,	×
132	query.Hostname,	×
133	query.TransactionID,	×
134	)	×
135	tk.DNSFlags \|= AnalysisDNSBogon	×
136	// continue processing so we print all the bogons we have	×
137	}	×
138	default:	3✔
139	// nothing
140	}
141	}
142	}
143	}
144
145	// analysisDNSUnexpectedFailure computes the AnalysisDNSUnexpectedFailure flags. We say
146	// a failure is unexpected when the TH could resolve a domain and the probe couldn't.
147	func (tk *TestKeys) analysisDNSUnexpectedFailure(logger model.Logger) {	11✔
148	// make sure we have control before proceeding futher	11✔
149	if tk.Control == nil \|\| tk.ControlRequest == nil {	11✔
150	return	×
151	}	×
152
153	// obtain thRequest and thResponse as shortcuts
154	thRequest := tk.ControlRequest	11✔
155	thResponse := tk.Control	11✔
156		11✔
157	// obtain the domain that the TH has queried for	11✔
158	URL, err := url.Parse(thRequest.HTTPRequest)	11✔
159	if err != nil {	11✔
160	return // this looks like a bug	×
161	}	×
162	domain := URL.Hostname()	11✔
163		11✔
164	// we obviously don't care if the domain was an IP adddress	11✔
165	if net.ParseIP(domain) != nil {	11✔
166	return	×
167	}	×
168
169	// if the control didn't lookup any IP addresses our job here is done
170	// because we can't say whether we have unexpected failures
171	hasAddrs := len(thResponse.DNS.Addrs) > 0	11✔
172	if !hasAddrs {	12✔
173	return	1✔
174	}	1✔
175
176	// with TH-resolved addrs, any local query _for the same domain_ queried
177	// by the probe that contains an error is suspicious
178	for _, query := range tk.Queries {	48✔
179	if domain != query.Hostname {	44✔
180	continue // not the domain queried by the test helper	6✔
181	}
182	if query.Engine == "doh" {	34✔
183	// As mentioned above, a DoH failure is not information about	2✔
184	// the URL we're measuring but about the DoH service being blocked.	2✔
185	//	2✔
186	// See https://github.com/ooni/probe/issues/2274	2✔
187	continue	2✔
188	}
189	hasAddrs := false	30✔
190	Loop:	30✔
191	for _, answer := range query.Answers {	57✔
192	switch answer.AnswerType {	27✔
193	case "A", "AAA":	18✔
194	hasAddrs = true	18✔
195	break Loop	18✔
196	}
197	}
198	if hasAddrs {	48✔
199	// if the lookup returned any IP address, we are	18✔
200	// not dealing with unexpected failures	18✔
201	continue	18✔
202	}
203	if query.Failure == nil {	13✔
204	// we expect to see a failure if we don't see	1✔
205	// answers, so this seems a bug?	1✔
206	continue	1✔
207	}
208	if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {	20✔
209	// maybe this heuristic could be further improved by checking	9✔
210	// whether the TH did actually see any IPv6 address?	9✔
211	continue	9✔
212	}
213	logger.Warnf("DNS: unexpected failure %s in #%d", *query.Failure, query.TransactionID)	2✔
214	tk.DNSFlags \|= AnalysisDNSUnexpectedFailure	2✔
215	// continue processing so we print all the unexpected failures
216
217	// TODO(https://github.com/ooni/probe/issues/2029#issuecomment-1411716295): we need
218	// to ensure we correctly handle the android_dns_cache_no_data case.
219	}
220	}
221
222	// analysisDNSUnexpectedAddrs computes the AnalysisDNSUnexpectedAddrs flags. This
223	// algorithm builds upon the original DNSDiff algorithm by introducing an additional
224	// TLS based heuristic for determining whether an IP address was legit.
225	func (tk *TestKeys) analysisDNSUnexpectedAddrs(
226	logger model.Logger,
227	lookupper model.GeoIPASNLookupper,
228	) {	11✔
229	// make sure we have control before proceeding futher	11✔
230	if tk.Control == nil \|\| tk.ControlRequest == nil {	11✔
231	return	×
232	}	×
233
234	// obtain thRequest and thResponse as shortcuts
235	thRequest := tk.ControlRequest	11✔
236	thResponse := tk.Control	11✔
237		11✔
238	// obtain the domain that the TH has queried for	11✔
239	URL, err := url.Parse(thRequest.HTTPRequest)	11✔
240	if err != nil {	11✔
241	return // this looks like a bug	×
242	}	×
243	domain := URL.Hostname()	11✔
244		11✔
245	// we obviously don't care if the domain was an IP adddress	11✔
246	if net.ParseIP(domain) != nil {	11✔
247	return	×
248	}	×
249
250	// if the control didn't resolve any IP address, then we basically
251	// cannot run this algorithm at all
252	thAddrs := thResponse.DNS.Addrs	11✔
253	if len(thAddrs) <= 0 {	12✔
254	return	1✔
255	}	1✔
256
257	// gather all the IP addresses queried by the probe
258	// for the same domain for which the TH queried.
259	var probeAddrs []string	10✔
260	for _, query := range tk.Queries {	48✔
261	if domain != query.Hostname {	44✔
262	continue // not the domain the TH queried for	6✔
263	}
264	// Implementation note: in the case in which DoH returned answers, here
265	// it still feels okay to consider them. We should avoid flagging DoH
266	// failures as measurement failures but if DoH returns us some unexpected
267	// even-non-bogon addr, it seems worth flagging for now.
268	//
269	// See https://github.com/ooni/probe/issues/2274
270	for _, answer := range query.Answers {	76✔
271	switch answer.AnswerType {	44✔
272	case "A":	33✔
273	probeAddrs = append(probeAddrs, answer.IPv4)	33✔
274	case "AAAA":	8✔
275	probeAddrs = append(probeAddrs, answer.IPv6)	8✔
276	}
277	}
278	}
279
280	// if the probe has not collected any addr for the same domain, it's
281	// definitely suspicious and counts as a difference
282	if len(probeAddrs) <= 0 {	10✔
283	logger.Warnf("DNS: the probe did not resolve any IP address")	×
284	tk.DNSFlags \|= AnalysisDNSUnexpectedAddrs	×
285	return	×
286	}	×
287
288	// if there are no different addresses between the probe and the TH then
289	// our job here is done and we can just stop searching
290	differentAddrs := tk.analysisDNSDiffAddrs(probeAddrs, thAddrs)	10✔
291	if len(differentAddrs) <= 0 {	17✔
292	return	7✔
293	}	7✔
294	for _, addr := range differentAddrs {	26✔
295	logger.Infof("DNS: address %s: not resolved by TH", addr)	23✔
296	}	23✔
297
298	// now, let's exclude the differentAddrs for which we successfully
299	// completed a TLS handshake: those should be good addrs
300	withoutHandshake := tk.findAddrsWithoutTLSHandshake(domain, differentAddrs)	3✔
301	if len(withoutHandshake) <= 0 {	3✔
302	return	×
303	}	×
304	for _, addr := range withoutHandshake {	18✔
305	logger.Infof("DNS: address %s: cannot confirm using TLS handshake", addr)	15✔
306	}	15✔
307
308	// as a last resort, accept the addresses without an handshake whose
309	// ASN overlaps with ASNs resolved by the TH
310	differentASNs := tk.analysisDNSDiffASN(logger, withoutHandshake, thAddrs, lookupper)	3✔
311	if len(differentASNs) <= 0 {	3✔
312	return	×
313	}	×
314
315	// otherwise, conclude we have unexpected probe addrs
316	for addr, asn := range differentASNs {	18✔
317	logger.Warnf(	15✔
318	"DNS: address %s has unexpected AS%d and we cannot use TLS to confirm it",	15✔
319	addr, asn,	15✔
320	)	15✔
321	}	15✔
322	tk.DNSFlags \|= AnalysisDNSUnexpectedAddrs	3✔
323	}
324
325	// analysisDNSDiffAddrs returns all the IP addresses that are
326	// resolved by the probe but not by the test helper.
327	func (tk *TestKeys) analysisDNSDiffAddrs(probeAddrs, thAddrs []string) (diff []string) {	10✔
328	const (	10✔
329	inProbe = 1 << iota	10✔
330	inTH	10✔
331	)	10✔
332	mapping := make(map[string]int)	10✔
333	for _, addr := range probeAddrs {	51✔
334	if net.ParseIP(addr) != nil && netxlite.IsBogon(addr) {	41✔
335	// we can exclude bogons from the analysis because we already analyzed them	×
336	continue	×
337	}
338	mapping[addr] \|= inProbe	41✔
339	}
340	for _, addr := range thAddrs {	35✔
341	mapping[addr] = inTH	25✔
342	}	25✔
343	for addr, where := range mapping {	58✔
344	if (where & inTH) == 0 {	71✔
345	diff = append(diff, addr)	23✔
346	}	23✔
347	}
348	return	10✔
349	}
350
351	// analysisDNSDiffASN returns whether there are IP addresses in the probe's
352	// list with different ASNs from the ones in the TH's list.
353	func (tk *TestKeys) analysisDNSDiffASN(
354	logger model.Logger,
355	probeAddrs,
356	thAddrs []string,
357	lookupper model.GeoIPASNLookupper,
358	) (result map[string]uint) {	3✔
359	const (	3✔
360	inProbe = 1 << iota	3✔
361	inTH	3✔
362	)	3✔
363	logger.Debugf("DNS: probeAddrs %+v, thAddrs %+v", probeAddrs, thAddrs)	3✔
364	uniqueAddrs := make(map[string]uint)	3✔
365	asnToFlags := make(map[uint]int)	3✔
366	for _, addr := range probeAddrs {	18✔
367	asn, _, _ := lookupper.LookupASN(addr)	15✔
368	asnToFlags[asn] \|= inProbe // including the zero ASN that means unknown	15✔
369	uniqueAddrs[addr] = asn	15✔
370	}	15✔
371	for _, addr := range thAddrs {	21✔
372	asn, _, _ := lookupper.LookupASN(addr)	18✔
373	asnToFlags[asn] \|= inTH // including the zero ASN that means unknown	18✔
374	uniqueAddrs[addr] = asn	18✔
375	}	18✔
376	for addr, asn := range uniqueAddrs {	36✔
377	logger.Infof("DNS: addr %s has AS%d", addr, asn)	33✔
378	}	33✔
379	probeOnlyASNs := make(map[uint]bool)	3✔
380	for asn, where := range asnToFlags {	9✔
381	if (where & inTH) == 0 {	9✔
382	probeOnlyASNs[asn] = true	3✔
383	}	3✔
384	}
385	for asn := range probeOnlyASNs {	6✔
386	logger.Infof("DNS: AS%d: only seen by probe", asn)	3✔
387	}	3✔
388	result = make(map[string]uint)	3✔
389	for addr, asn := range uniqueAddrs {	36✔
390	if probeOnlyASNs[asn] {	48✔
391	result[addr] = asn	15✔
392	}	15✔
393	}
394	return	3✔
395	}
396
397	// findAddrsWithoutTLSHandshake computes the list of probe discovered [addresses]
398	// for which we couldn't successfully perform a TLS handshake for the given [domain].
399	func (tk *TestKeys) findAddrsWithoutTLSHandshake(domain string, addresses []string) (output []string) {	3✔
400	const (	3✔
401	resolvedByProbe = 1 << iota	3✔
402	handshakeOK	3✔
403	hasObviousIPv6Issues	3✔
404	)	3✔
405	mapping := make(map[string]int)	3✔
406		3✔
407	// fill the input map with the addresses we're interested to analyze	3✔
408	for _, addr := range addresses {	26✔
409	mapping[addr] = 0	23✔
410	}	23✔
411
412	// flag the subset of addresses resolved by the probe
413	for _, query := range tk.Queries {	14✔
414	for _, answer := range query.Answers {	43✔
415	var addr string	32✔
416	switch answer.AnswerType {	32✔
417	case "A":	21✔
418	addr = answer.IPv4	21✔
419	case "AAAA":	8✔
420	addr = answer.IPv6	8✔
421	default:	3✔
422	continue	3✔
423	}
424	if _, found := mapping[addr]; !found {	30✔
425	continue // we're not interested into this addr	1✔
426	}
427	mapping[addr] \|= resolvedByProbe	28✔
428	}
429	}
430
431	// flag the subset of addrs with obvious IPv6 issues
432	//
433	// see https://github.com/ooni/probe/issues/2284 for more
434	// info on why we need to flag them
435	for _, connect := range tk.TCPConnect {	44✔
436	failure := connect.Status.Failure	41✔
437	if failure == nil {	66✔
438	continue // if we can connect, we don't have IPv6 issues	25✔
439	}
440	ipv6, err := netxlite.IsIPv6(connect.IP)	16✔
441	if err != nil {	16✔
442	continue // looks like a bug	×
443	}
444	if !ipv6 {	16✔
445	continue // not IPv6	×
446	}
447	hasIssues := (*failure == netxlite.FailureNetworkUnreachable \|\|	16✔
448	*failure == netxlite.FailureHostUnreachable)	16✔
449	if hasIssues {	32✔
450	mapping[connect.IP] \|= hasObviousIPv6Issues	16✔
451	}	16✔
452	}
453
454	// flag the subset of addrs with successful handshake for the right SNI
455	for _, thx := range tk.TLSHandshakes {	28✔
456	addr, _, err := net.SplitHostPort(thx.Address)	25✔
457	if err != nil {	25✔
458	continue // looks like a bug	×
459	}
460	if thx.Failure != nil {	49✔
461	continue // this handshake failed	24✔
462	}
463	if _, found := mapping[addr]; !found {	2✔
464	continue // we're not interested into this addr	1✔
465	}
466	if thx.ServerName != domain {	×
467	continue // the SNI is different, so...	×
468	}
469	mapping[addr] \|= handshakeOK	×
470	}
471
472	// compute the list of addresses without the handshakeOK flag
473	// excluding though the ones with obvious IPv6 issues
474	for addr, flags := range mapping {	34✔
475	if flags == 0 {	31✔
476	continue // this looks like a bug	×
477	}
478	if (flags & hasObviousIPv6Issues) != 0 {	47✔
479	continue // see https://github.com/ooni/probe/issues/2284	16✔
480	}
481	if (flags & (resolvedByProbe \| handshakeOK)) == resolvedByProbe {	30✔
482	output = append(output, addr)	15✔
483	}	15✔
484	}
485	return	3✔
486	}

ooni / probe-cli / 6155674102

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous